From dd0c55715103bce8cf9715defd0fe581ff54c888 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Mon, 6 Jul 2026 05:33:17 +0000
Subject: [PATCH 01/61] =?UTF-8?q?docs:=20ratify=20UI=20client=20split=20(O?=
 =?UTF-8?q?ption=20C)=20=E2=80=94=20revise=20runtime-modes=20plan?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add ui-client-split-assessment.md: decision record ratifying the
host/client split — packages/ui stays the host control plane;
chat/connections extract to a thin static packages/client (+ shared
packages/ui-kit); PWA ships with two install origins (localhost via
harness/CLI, official hosted URL with central TLS).

Revise ui-runtime-modes-plan.md accordingly:
- Phases 1-4 unchanged; new Phase 1.5 (openpalm admin / host-ui mode)
- Phases 5-6 re-scoped to the client extraction; new Phase 6.5
  (guardian TLS + CORS workstream, gates the phone story)
- [as-landed] corrections: skeleton resolution is a five-strategy
  chain retaining Electron extraResources; tools use the baked
  package.json + bun update pattern (supersedes tools.json design);
  entrypoint install/start_ui already scaffolded, with the
  OPENCODE_API_URL vs OP_OPENCODE_URL wiring gap recorded
- Simplicity guardrails: TLS never a manual user task on default
  install paths; two UI packages max; pairing is paste-or-scan

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FetR7BttT1xBrA8fBwhui9
---
 docs/technical/ui-client-split-assessment.md | 177 ++++++
 docs/technical/ui-runtime-modes-plan.md      | 636 +++++++++++--------
 2 files changed, 546 insertions(+), 267 deletions(-)
 create mode 100644 docs/technical/ui-client-split-assessment.md

diff --git a/docs/technical/ui-client-split-assessment.md b/docs/technical/ui-client-split-assessment.md
new file mode 100644
index 000000000..b43865c08
--- /dev/null
+++ b/docs/technical/ui-client-split-assessment.md
@@ -0,0 +1,177 @@
+# UI Client Split — Decision Record
+
+**Date:** 2026-07-06
+**Status:** RATIFIED
+**Repo:** `itlackey/openpalm`
+**Revises:** `docs/technical/ui-runtime-modes-plan.md` (Phases 5–6 scope)
+**Related issues:** #486 (remote-only install), #509 (RuntimeContext), #510 (assistant-container), #511 (PWA), #506 (styling), #435 (guardian auth)
+
+---
+
+## 1. Decision
+
+**Split the client, not the admin.**
+
+- `packages/ui` (`@openpalm/ui`) remains what it already is: the **host control plane** — an
+  `adapter-node` SvelteKit app (setup wizard, `/host` admin, secrets, Docker lifecycle,
+  connection CRUD) served loopback-only by the harness (Electron or CLI). It is not split
+  into a new package; it *sheds* the chat surface instead.
+- A new **`packages/client`** (`@openpalm/client`) carries the end-user surface: chat,
+  connection switching, assistant settings views. It is a static, PWA-installable SvelteKit
+  app (`adapter-static` + `@vite-pwa/sveltekit`) with **one uniform transport**: connect to a
+  guardian/OpenCode base URL with credentials — same code whether that URL is
+  `127.0.0.1`, a LAN host, or a remote instance.
+- Shared look and feel lives in **`packages/ui-kit`** (components, icons, theme tokens),
+  consumed as a raw-source workspace package (no publish step; inlined at build time by
+  both apps).
+- The PWA ships with **two primary install origins**:
+  1. **Localhost** — the harness/CLI serves the static client on a stable loopback port;
+     `http://127.0.0.1:<port>` is a secure context, so it installs with zero TLS setup.
+  2. **Official hosted URL** — e.g. `https://app.openpalm.dev`: a canonical, centrally
+     TLS-terminated origin serving the same static client, giving phones/tablets a single
+     install that connects to any of the user's instances.
+- Phases 1–4 of `ui-runtime-modes-plan.md` (RuntimeContext/capabilities, `/connections`,
+  landing resolver, `/host` + control-plane API split) proceed **unchanged** — they are
+  prerequisites for the split and for every alternative considered.
+- `openpalm admin` (the plan's `host-ui` mode) ships **early**: the CLI already serves the
+  UI loopback-only with password auth; enabling the admin capability there is a small,
+  proven pattern (Syncthing, code-server, Prisma Studio all default to a loopback-only
+  admin web UI).
+- **Guardian edge TLS + CORS** becomes its own tracked workstream. It is a hard
+  prerequisite for the hosted-origin install path connecting to LAN instances (mixed
+  content), and independent of any packaging choice.
+
+## 2. Context (verified 2026-07-06, v0.12.52)
+
+- The UI package is one `adapter-node` app of ~44k LOC source. Admin/setup routes plus
+  admin components are ~22.5k LOC; chat is ~6.6k. There are 59 `/admin/*` server endpoints
+  and 19 `/api/setup/*` endpoints vs. one chat proxy. "Splitting out the admin" would mean
+  moving four-fifths of the app; extracting the client moves one-fifth.
+- Admin is already effectively harness-only: `features.admin` requires `OP_INSIDE_ELECTRON=1`
+  or `OP_ENABLE_ADMIN=1` (`packages/ui/src/lib/server/features.ts`), and the CLI sets
+  neither — a CLI-served UI today is chat + setup wizard only.
+- The Electron app is a genuinely thin harness (~2,400 LOC; #495, shipped 0.12.0): it spawns
+  the same SvelteKit build the CLI runs, on `127.0.0.1:3880`, and self-updates the control
+  plane from npm. Nothing on the Electron side needs restructuring.
+- Instance switching exists (`endpoints.json`, `EndpointSwitcher`, per-request resolution in
+  `/proxy/assistant/[...path]`) but is **server-side per host process** — the chat client
+  assumes same-origin + cookie auth. A phone PWA needs client-held connections and direct
+  cross-origin calls; that transport does not transfer.
+- `containers/assistant/entrypoint.sh` already installs `@openpalm/ui` + `@openpalm/skeleton`
+  at startup and launches a UI co-process (unexposed; see plan §6.9 as-landed notes).
+- No PWA assets exist (no manifest, no service worker, no `@vite-pwa/sveltekit`).
+- Plan status: Phase 0 (`@openpalm/skeleton`, #508) landed (with deltas — see plan
+  "As-landed corrections"); Phases 1–8 not started. `/admin`, `/splash`, `FeatureFlags`
+  are still current.
+
+## 3. Options considered
+
+### A — One app, capability-gated everywhere (plan as originally written)
+
+One `adapter-node` artifact for all four host modes; capabilities hide features; PWA is the
+same build plus manifest + service worker.
+
+- Cheapest incremental path; single release artifact; Open WebUI precedent.
+- **Rejected as the Phase 5–6 shape** because: (a) the transport still forks internally —
+  host modes chat through a same-origin server proxy with cookies while PWA mode needs
+  direct cross-origin guardian calls with Basic/Bearer, so the "one code path" claim breaks
+  exactly where it matters; (b) every deployment (including the assistant container) ships
+  all host-admin server endpoints and the inlined control-plane lib, relying on runtime
+  403s (Phase 7 negative tests become permanently load-bearing); (c) an official hosted
+  install origin is impossible — you cannot host a machine-bound `adapter-node` control
+  plane at `app.openpalm.dev`.
+
+### B — Split admin/setup into a new package now
+
+- **Rejected.** Admin+setup is ~80% of the app with the deepest server coupling
+  (`hooks.server.ts`, sessions, Docker, secrets, `@openpalm/lib`). The destination would
+  look exactly like what `packages/ui` already is: an adapter-node control-plane app served
+  loopback-only by the harness. Weeks of churn to arrive where we already are, and the
+  entanglements that make it expensive (Navbar↔chat imports, `endpoints-state`↔`chat-state`,
+  the `$lib/api.js` barrel) are removed by Phases 1–4 anyway.
+
+### C — Phases 1–4 unchanged + `openpalm admin` now; extract a thin client at the Phase 5/6 fork — **RATIFIED**
+
+- The split happens *after* Phases 2–4 have moved connections out of chat state and split
+  the API namespaces — at that point it is mostly moving files, not untangling them.
+- Each artifact ends with one transport model, one audience, one reason to change:
+  - host app: server-proxied, cookie-auth, loopback, privileged;
+  - client app: direct API consumer with client-held connections, static, unprivileged.
+- Enables both PWA install origins (§1) — the hosted origin *requires* a static client.
+- Structural exclusion of host-admin code from containers and from the PWA bundle
+  (defense in depth beyond runtime 403s), smaller container npm pull, no `@openpalm/lib`
+  in the client at all.
+- Honest costs: a second build/release unit; a shared `ui-kit` package to keep healthy;
+  assistant-container mode needs a small server for `/api/assistant/*` writes (static
+  client cannot write persona files) — a minimal sidecar rather than the full control
+  plane; a version-skew handshake between hosted client and instance APIs (`/api/runtime`
+  contract version, already in the plan).
+
+### D — Minimal: `openpalm admin` + TLS docs only, defer PWA/container modes
+
+- Fine as a stopgap; abandons #510/#511 and leaves mobile as an un-installed browser tab.
+  Only right if 0.13.0 must shrink. Not chosen, but note that its two cheap items
+  (`openpalm admin`, TLS docs) are included in C anyway.
+
+## 4. Evidence
+
+External findings that decided the shape (researched 2026-07-06):
+
+1. **PWA install requires a secure context** — HTTPS or `localhost`/`127.0.0.1`. A UI served
+   over plain HTTP from a LAN IP is not installable, period.
+   (MDN: Making PWAs installable — developer.mozilla.org/en-US/docs/Web/Progressive_web_apps/Guides/Making_PWAs_installable)
+2. **Mixed content:** an HTTPS-served page cannot `fetch()` plain-HTTP LAN endpoints. So the
+   hosted-origin install path requires TLS on any guardian it connects to (Tailscale
+   `ts.net` certs and Caddy are the proven homelab paths). A `http://127.0.0.1` origin is
+   *not* subject to mixed-content blocking and — being the most-trusted tier under Chrome's
+   Private Network Access model — may call plain-HTTP LAN guardians. This is why the
+   localhost install path works with zero TLS setup and the hosted path needs the TLS
+   workstream.
+3. **PWA identity is per-origin** (one installed app = one origin; `start_url` must be
+   same-origin). Multi-instance switching must be an in-app connection switcher against
+   multiple backend APIs — which `/connections` + IndexedDB already design correctly — and
+   a single canonical hosted origin means one install serves all instances.
+   (web.dev/articles/multi-origin-pwas)
+4. **SvelteKit has no supported per-build route exclusion** (`config.kit.routes` was removed;
+   kit#6031). Route groups gate access but ship the code. Two thin apps sharing a workspace
+   component package is the grain-of-the-tool pattern (official Turborepo Svelte example;
+   `svelte-package` or raw-source workspace exports).
+5. **Electron security guidance** — privileged windows load local/loopback content, never
+   remote; OpenPalm already complies and nothing about the harness changes under this
+   decision. (electronjs.org/docs/latest/tutorial/security)
+6. **Prior art:** Open WebUI keeps one capability-gated app, but its "admin" is same-process
+   settings, not host Docker control. Platforms whose admin holds host-level power (Umbrel,
+   CasaOS, Rancher Desktop) separate the platform UI from app UIs. Loopback-only
+   CLI-launched admin web UIs are a proven pattern (Syncthing, code-server, Prisma Studio,
+   Drizzle Studio). Expo's sunset web UI is the cautionary tale: keep the second surface
+   thin — which the client (not the admin) is.
+7. **`@vite-pwa/sveltekit`** is the mature tooling path for the client app (SvelteKit 2,
+   Workbox precache, adapter-static + SPA fallback).
+
+## 5. Consequences
+
+1. `ui-runtime-modes-plan.md` Phases 5–6 are re-scoped (see the plan's revision note):
+   assistant-container pulls `@openpalm/client` (+ a minimal assistant-settings API sidecar)
+   instead of the full `@openpalm/ui`; PWA work lands in `packages/client`.
+2. New release units: `@openpalm/client` (npm, exact-pin delivery like the UI) and the
+   hosted static deploy (CI publish of the client build to the official URL). `ui-kit` is
+   workspace-internal and not published.
+3. Guardian grows a CORS allowlist (the official origin + configurable extras) and the TLS
+   workstream lands at its edge. Coordinates with #435 (auth) — credentials over HTTPS only
+   for remote connections.
+4. The `/api/runtime` public endpoint doubles as the version-skew handshake for the hosted
+   client (client checks the instance's advertised contract version before enabling
+   features).
+5. `packages/ui` keeps a chat surface only until the client app reaches parity in Electron
+   (the harness serves the client build alongside the host app; Electron users keep one
+   window). After that, chat code is deleted from `packages/ui`.
+
+## 6. What this does **not** change
+
+- Electron thin-harness architecture (#495), the harness contract, and the artifact
+  delivery pattern (exact-pin npm for platform components) all stay as-is; `@openpalm/client`
+  simply becomes one more exact-pinned artifact.
+- Host admin remains loopback-only with the `op_session` cookie. The client app never
+  holds host credentials.
+- `resolveCapabilities()` remains the single capability-resolution point *within each app*;
+  the split reduces how much it must express (the client never resolves `host:*`).
diff --git a/docs/technical/ui-runtime-modes-plan.md b/docs/technical/ui-runtime-modes-plan.md
index 6c81c382a..735f42f91 100644
--- a/docs/technical/ui-runtime-modes-plan.md
+++ b/docs/technical/ui-runtime-modes-plan.md
@@ -1,16 +1,23 @@
 # UI Host/Client Runtime Refactor Plan
 
-**Date:** 2026-06-19
-**Status:** DRAFT — decisions recorded, ready for implementation
+**Date:** 2026-06-19 (revised 2026-07-06)
+**Status:** RATIFIED — Phases 0 landed; Phases 1–4 as designed; Phases 5–6 re-scoped per `docs/technical/ui-client-split-assessment.md`
 **Repo:** `itlackey/openpalm`, branch `main`
-**Related issues:** #486 (remote-only install), #435 (guardian authn), #433 (guardian state), #488 (mDNS), #506 (styling)
+**Related issues:** #486 (remote-only install), #435 (guardian authn), #433 (guardian state), #488 (mDNS), #506 (styling), #509 (RuntimeContext), #510 (assistant-container), #511 (PWA)
+
+> **Revision note (2026-07-06).** The original draft shipped one `adapter-node` build to
+> every runtime mode. That scope is revised: the product is still **one UI**, but it ships
+> as **two artifacts** — the host control plane (`@openpalm/ui`, unchanged) and a thin
+> static client (`@openpalm/client`) for chat/connections/PWA. Rationale, options
+> considered, and evidence: `docs/technical/ui-client-split-assessment.md`. Phases 1–4
+> are unchanged. Sections marked **[as-landed]** correct implementation details that
+> drifted between the 2026-06-19 draft and the code that actually shipped in Phase 0 /
+> the entrypoint scaffolding.
 
 ---
 
 ## 1. TL;DR
 
-The right design is **one UI product with multiple runtime modes and a consistent artifact delivery pattern** across every component of the stack.
-
 OpenPalm splits the UI into three capability-scoped surfaces:
 
 1. **Host Control Plane** — Electron/host SvelteKit process. Docker, lifecycle, secrets, OP_HOME.
@@ -19,33 +26,59 @@ OpenPalm splits the UI into three capability-scoped surfaces:
 
 The current code collapses all of this into `features.admin`, `/admin/*`, `/splash`. That cannot express "chat + assistant settings but no host management" or "PWA connection manager."
 
+**Two artifacts, one product:**
+
+- **`@openpalm/ui`** (existing, `adapter-node`) — the **host app**: setup wizard, `/host`
+  admin, connection CRUD, Docker lifecycle. Privileged, loopback-only, served by the
+  harness (Electron or `openpalm admin`). Bundles `@openpalm/lib`.
+- **`@openpalm/client`** (new, `adapter-static` + `@vite-pwa/sveltekit`) — the **client
+  app**: chat, connection switching, assistant settings views. Unprivileged, no
+  `@openpalm/lib`, one transport: talk to a guardian/OpenCode base URL with credentials.
+  Installable as a PWA from two origins (localhost, official hosted URL — §6.10).
+- **`packages/ui-kit`** — shared components/icons/theme, raw-source workspace package,
+  inlined at build time by both apps. Not published.
+
+### Simplicity guardrails (non-negotiable UX constraints)
+
+- **Default flows never make TLS a user task.** Desktop installs from
+  `http://127.0.0.1:<port>` (secure context, no certificates). Phones install from the
+  official hosted URL, which is TLS-terminated centrally.
+- **"Install → open → chat."** Adding a connection is paste-a-URL-and-code (or scan a QR
+  from the host app); no config files, no cert stores, no port math.
+- **Two apps, not N.** No further UI packages beyond `client` and `ui-kit`. The
+  assistant-settings write API in container mode is a minimal shim, not a third app —
+  and it is an optional follow-up slice, not a launch requirement.
+
 ### Standard artifact delivery pattern
 
 Every updatable component follows the same pattern. This is the design standard for the whole stack:
 
 | Component | Package | Version strategy | Runtime install | Containers |
 |---|---|---|---|---|
-| UI | `@openpalm/ui` | Exact pin: `OP_UI_VERSION` → `PLATFORM_VERSION` → **error** | `npm install` | assistant |
+| Host UI | `@openpalm/ui` | Exact pin: `OP_UI_VERSION` → `PLATFORM_VERSION` → **error** | `npm install` | — (host process) |
+| Client UI | `@openpalm/client` | Exact pin: `OP_CLIENT_VERSION` → `PLATFORM_VERSION` → **error** | `npm install` | assistant |
 | Skeleton / OP_HOME seed | `@openpalm/skeleton` | Exact pin: `OP_SKELETON_VERSION` → `PLATFORM_VERSION` → **error** | `npm install` | assistant, guardian |
 | Guardian | `@openpalm/guardian` | Exact pin: `OP_GUARDIAN_VERSION` → `PLATFORM_VERSION` → **error** | `npm install` | guardian |
 | Portal (discord) | `@openpalm/portal-discord` | Exact pin: `OP_PORTAL_DISCORD_VERSION` → `PLATFORM_VERSION` → **error** | `npm install` | portal |
 | Portal (slack) | `@openpalm/portal-slack` | Exact pin: `OP_PORTAL_SLACK_VERSION` → `PLATFORM_VERSION` → **error** | `npm install` | portal |
-| opencode | `opencode` (npm) | Range: `^minor`, `OP_TOOL_OPENCODE_VERSION` override, from `tools.json` | `bun add -g` | assistant, guardian |
-| akm-cli | `akm-cli` | Range: `^minor`, `OP_TOOL_AKM_VERSION` override, from `tools.json` | `bun add -g` | guardian |
-| claude-code, codex, … | per-tool npm packages | Range: `^minor`, `OP_TOOL_*_VERSION` override, from `tools.json` | `bun add -g` | assistant |
+| opencode, akm-cli, claude-code, … | per-tool npm packages | Range (`^minor`) via the baked tools `package.json`, per-tool env override | `bun update` | assistant, guardian |
 
 **Two version strategies, one delivery mechanism:**
 
-- **Exact pin** — components where a specific version must be matched at the API or data level: UI (RuntimeContext contract version), skeleton (`SHIPPED_DEFAULT_HASHES` hash values), guardian (security boundary, operator must explicitly choose a version). Fail loudly if version cannot be resolved.
-- **Range (`^minor`)** — all tools: opencode, akm-cli, claude-code, codex, and any future additions. No correctness coupling; auto-updating within minor is desirable and aligns with npm semver expectations. Both containers reading the same `tools.json` from the same skeleton version naturally resolve opencode to the same version — no special lockstep handling needed. Per-tool `OP_TOOL_*_VERSION` env var overrides when an operator needs to pin or skip a specific tool.
-
-**Deviation from range requires written justification in the issue.** If a tool ever needs exact-pinning, document why the `^minor` contract is insufficient before adding the exception.
+- **Exact pin** — components where a specific version must be matched at the API or data level: UI/client (RuntimeContext contract version), skeleton (`SHIPPED_DEFAULT_HASHES` hash values), guardian (security boundary, operator must explicitly choose a version). Fail loudly if version cannot be resolved.
+- **Range (`^minor`)** — all tools. **[as-landed]** Tool ranges are declared in a
+  `package.json` baked into the image at `/opt/openpalm/tools/package.json` (source:
+  `containers/assistant/tools/package.json`), bind-mounted from
+  `OP_HOME/data/assistant/tools` at runtime, and advanced with `bun update --production`.
+  This supersedes the draft's `tools.json`-in-skeleton + `bun add -g` design — the
+  landed pattern gets lockfile semantics and per-tool pinning by editing one file, with
+  no magic env-key normalization.
 
 **Key principles:**
-- One UI. The PWA is the same SvelteKit app (adapter-node + service worker), features hidden by resolved capabilities.
-- Assistant image is a thin host — pulls `@openpalm/ui` and `@openpalm/skeleton` from npm at startup.
+- One UI *product*, two *artifacts*. The host app is the privileged control plane; the client app is a pure API consumer. Neither ships the other's code.
+- Assistant image is a thin host — pulls `@openpalm/client` and `@openpalm/skeleton` from npm at startup.
 - Containers carry no bundled content; content is versioned and delivered separately.
-- Capabilities are resolved from server context + client context by one function. That function is the only extension point.
+- Capabilities are resolved from server context + client context by one function per app. The client app can never resolve `host:*` capabilities — structurally, not by branching.
 
 ---
 
@@ -53,19 +86,22 @@ Every updatable component follows the same pattern. This is the design standard
 
 | Question | Decision |
 |---|---|
-| Skeleton delivery | `@openpalm/skeleton` npm package, no-code, no-build, published alongside platform release |
+| Skeleton delivery | `@openpalm/skeleton` npm package — **landed** (#508); see §6.7 for the as-landed resolution chain |
 | Skeleton version coupling | Hard: skeleton version === platform version. No `latest` in production. `isUnmodifiedDefault` hashes depend on this. |
-| Skeleton 0.13.0 scope | Full unification in 0.13.0: create package, replace GitHub raw fallback, drop Electron extraResources skeleton, add manifest.json |
-| `assistant-container` UI deployment | `@openpalm/ui` pulled from npm at container startup |
-| `assistant-container` skeleton deployment | `@openpalm/skeleton` pulled from npm at container startup (same startup script, same version chain) |
-| `assistant-container` process model | One image, two co-processes: UI server + OpenCode |
-| PWA build approach | One adapter-node build, service worker + manifest in `static/`. Full UI, capabilities hide features. No new pages. |
-| PWA/remote auth | Guardian Basic auth matching OpenCode implementation. Coordinate with #435. No parallel credential mechanism. |
+| Host/client split | **Ratified 2026-07-06** — extract `packages/client` + `packages/ui-kit`; `packages/ui` remains the host control plane. See `ui-client-split-assessment.md`. |
+| `assistant-container` UI deployment | `@openpalm/client` pulled from npm at container startup (was: `@openpalm/ui`) |
+| `assistant-container` skeleton deployment | `@openpalm/skeleton` pulled from npm at container startup — **landed** in `entrypoint.sh` |
+| `assistant-container` process model | One image, co-processes: static client (+ optional settings shim) + OpenCode |
+| PWA build approach | `packages/client`: `adapter-static` + `@vite-pwa/sveltekit`. Full client UI; host features are absent from the artifact, not hidden. |
+| PWA install origins | **Two primary paths:** (1) localhost — harness/CLI serves the client on a stable loopback port (secure context, zero TLS setup); (2) official hosted URL (e.g. `app.openpalm.dev`) — canonical TLS-terminated origin, one install for phones/tablets. |
+| Guardian TLS + CORS | Own workstream. Hard prerequisite for hosted-origin → LAN connections (mixed content) and for any phone → guardian connection. Never a manual user task on default paths. |
+| PWA/remote auth | Guardian Basic auth matching the OpenCode implementation. Coordinate with #435. No parallel credential mechanism. |
+| `host-ui` mode / `openpalm admin` | Ship **early** (Phase 1.5): CLI serves the host app with admin enabled, loopback-only, existing password auth. |
 | `clientMode` detection | Client-side only: `matchMedia('(display-mode: standalone)')` + `navigator.userAgent`. Not server-computed. |
-| Capability resolution | `effectiveCapabilities = resolve(serverCaps, clientCtx)`. One function, one file. |
+| Capability resolution | `effectiveCapabilities = resolve(serverCaps, clientCtx)`. One function, one file (per app). |
 | Legacy `/admin` route lifetime | No alias. `/admin/*` → 404 when `/host/*` ships. <10 installs, no audience to protect. |
 | `endpoints.json` rename | Do not rename. Add `kind` field. Internal model uses "connection" language. |
-| Milestones | 0.13.0: Phases 0–4 + skeleton package. 0.14.0: Phases 5–8 (assistant-container + PWA). |
+| Milestones | 0.13.0: Phases 0–4 + 1.5. 0.14.0 candidates: Phases 5–6 (client extraction, assistant-container, PWA) + TLS workstream — re-split if 0.13.0 gets heavy. |
 
 ---
 
@@ -89,48 +125,41 @@ function resolveArtifactVersion(
 }
 ```
 
-### Source resolution (skeleton / all file-seeding packages)
+### Source resolution (skeleton / all file-seeding packages) — **[as-landed]**
 
-Three steps. No more.
+The landed chain (`packages/lib/src/control-plane/ui-assets.ts`, `resolveLocalOpenpalmDir()`)
+has five strategies, not the draft's three:
 
 ```
-1. OPENPALM_REPO_ROOT env var → dev/source mode (keep forever)
-2. require.resolve('@openpalm/skeleton/package.json') → resolved package dir (CLI bundled dep, Electron)
-3. npm install --prefix <tmpdir> @openpalm/skeleton@<version> → cold start / upgrade path
-```
-
-Steps that are gone: `import.meta.url` relative chains, GitHub `raw.githubusercontent.com` download.
-
-### Install script shape (entrypoint.sh)
-
-```sh
-# ── Exact-pinned components ───────────────────────────────────────────────────
-install_artifact() {
-  local pkg="$1" version="$2" prefix="$3"
-  echo "Installing ${pkg}@${version}..."
-  npm install --prefix "$prefix" "${pkg}@${version}" --omit=dev --prefer-offline
-}
-
-install_artifact "@openpalm/ui"       "$OP_UI_VERSION"       /opt/openpalm/ui
-install_artifact "@openpalm/skeleton" "$OP_SKELETON_VERSION" /opt/openpalm/skeleton
-
-# ── Range-versioned tools (opencode, akm-cli, claude-code, codex, …) ─────────
-# tools.json in the skeleton defines defaults; per-tool env vars override.
-# BUN_INSTALL is on the cache volume — warm restarts with unchanged ranges are instant.
-export BUN_INSTALL=/opt/openpalm/tools
-export PATH="$BUN_INSTALL/bin:$PATH"
-
-TOOL_SECTION="${CONTAINER_ROLE:-global}"   # 'global' for assistant, 'guardian' for guardian
-TOOL_PKGS=$(bun -e "
-  const tools = require('/opt/openpalm/skeleton/node_modules/@openpalm/skeleton/tools.json')['${TOOL_SECTION}'] || [];
-  const pkgs = tools.map(t => t.package + '@' + (process.env[t.envKey] || t.default));
-  console.log(pkgs.join(' '));
-")
-
-[ -n "\$TOOL_PKGS" ] && bun add -g \$TOOL_PKGS || echo "WARN: some tool installs failed; continuing"
+1. OPENPALM_REPO_ROOT env var → ${root}/packages/skeleton/   (dev mode — keep forever)
+2. OPENPALM_SKELETON_DIR env var → Electron extraResources dir (set by Electron main)
+3. require.resolve('@openpalm/skeleton/package.json') → package dir (CLI bundled dep)
+4. import.meta.url source-relative → repo tree (bun run / bun test)
+5. null → applyHomeSeed downloads @openpalm/skeleton from the npm registry
 ```
 
-Hard error if any exact-pinned artifact install fails. Tool install failures log a warning and do not block the container — one unavailable tool should not prevent the assistant or guardian from starting.
+The GitHub `raw.githubusercontent.com` fallback is **gone** (replaced by the npm registry
+download in step 5). The draft's "remove Electron extraResources skeleton" item was **not**
+adopted — the extraResources bundle was kept as step 2 so a fresh Electron install works
+offline before any npm fetch. This is deliberate; do not "clean it up."
+
+### Install script shape (entrypoint.sh) — **[as-landed]**
+
+`containers/assistant/entrypoint.sh` implements `install_runtime_artifacts()` with these
+properties (which supersede the draft sketch):
+
+- Exact-pinned artifacts (`@openpalm/ui` today → `@openpalm/client` after Phase 5;
+  `@openpalm/skeleton`) resolve `OP_*_VERSION` → `PLATFORM_VERSION` → **hard error**.
+- An install **failure after version resolution** logs an ERROR and continues with the
+  existing on-disk artifact if present (warm restart resilience) — the draft's
+  "hard error on any install failure" was softened deliberately: a registry blip must not
+  brick a previously-working container. Cold start with no artifact still fails visibly
+  (the co-process is skipped with a loud log line).
+- npm cache lives under the bind-mounted assistant HOME
+  (`/home/opencode/.cache/openpalm-npm`), so `--prefer-offline` hits a persistent cache.
+  The draft's named `openpalm-artifact-cache` volume was not needed.
+- Tools: `bun update --cwd /opt/openpalm/tools --production` against the baked/bind-mounted
+  `package.json` (see §1). Tool failures warn and never block container start.
 
 ---
 
@@ -138,12 +167,12 @@ Hard error if any exact-pinned artifact install fails. Tool install failures log
 
 ### 4.1 Server host modes
 
-| `hostMode` | What it is | What the server provides |
-|---|---|---|
-| `electron-host` | Electron launches/supervises the SvelteKit Node process on the local machine | Host + Assistant + Connections |
-| `host-ui` | CLI/host process serves SvelteKit without Electron chrome | Host + Assistant + Connections (no Electron IPC) |
-| `assistant-container` | SvelteKit UI pulled from npm at startup, co-runs with OpenCode | Assistant settings + single locked local connection |
-| `pwa-static` | The same SvelteKit build served to browser/PWA clients connecting remotely | Connections management only |
+| `hostMode` | Artifact | What it is | What it provides |
+|---|---|---|---|
+| `electron-host` | `@openpalm/ui` | Electron launches/supervises the SvelteKit Node process on the local machine | Host + Assistant + Connections |
+| `host-ui` | `@openpalm/ui` | `openpalm admin` serves the same process without Electron chrome | Host + Assistant + Connections (no Electron IPC) |
+| `assistant-container` | `@openpalm/client` | Static client served from the assistant image, co-running with OpenCode | Chat + assistant settings (single locked local connection) |
+| `pwa-static` | `@openpalm/client` | Static client served from localhost (harness) or the official hosted URL | Connections management + chat |
 
 ### 4.2 Client display modes
 
@@ -162,7 +191,14 @@ Hard error if any exact-pinned artifact install fails. Tool install failures log
 | `assistant-container` | `browser` / `standalone-pwa` | `chat`, `assistant-settings:read/write` |
 | `pwa-static` | `standalone-pwa` / `browser` | `connections:manage`, `connections:switch`, `chat` (if connected), `pwa:install` |
 
-**Future extension point (not 0.13.0):** `pwa-static` + remote connection with `grantedCapabilities` → add `assistant-settings:read/write` for that connection.
+**Future extension point:** `pwa-static` + remote connection with `grantedCapabilities` → add `assistant-settings:read/write` for that connection. `grantedCapabilities` must be verified server-side by the connected instance — the client cannot self-grant.
+
+**Note on the client app:** the client has no privileged server of its own. Its "server
+capabilities" come from the *connected instance's* `/api/runtime` response (assistant-
+container mode) or are the static `pwa-static` baseline. `resolveCapabilities()` in the
+client therefore operates on (baseline ∪ connection-granted) × display mode — same
+function shape, smaller input space, and `host:*` capabilities do not exist in its
+type-space at all.
 
 ---
 
@@ -180,7 +216,14 @@ Hard error if any exact-pinned artifact install fails. Tool install failures log
 
 **F — assistant settings mix host and assistant concerns.** Persona (assistant-scoped) and `OP_PROJECT_NAME` / bind address (host-scoped) are in the same tab.
 
-**G — skeleton delivery is fragile.** Five-step fallback ladder in `ui-assets.ts` ending in a GitHub raw URL tied to an exact git tag. Does not resolve `latest`. Breaks in air-gapped environments. `import.meta.url`-relative paths break when lib is bundled. This is the only remaining component not following the standard artifact delivery pattern.
+**G — skeleton delivery is fragile.** ~~Five-step fallback ladder ending in a GitHub raw URL.~~ **RESOLVED** by #508 (Phase 0): `@openpalm/skeleton` npm package + the §3 resolution chain.
+
+**H — chat transport assumes a privileged same-origin server.** The chat client calls
+`/proxy/assistant/*` on its own origin with the `op_session` cookie; the server resolves
+the active endpoint per request. A PWA on a phone has no such server: it needs client-held
+connections and direct cross-origin calls to a guardian with Basic/Bearer auth. This is
+the structural reason the client is a separate artifact — one app would carry both
+transports behind mode branches.
 
 ---
 
@@ -256,6 +299,9 @@ export type RuntimeContext = ServerRuntimeContext & {
 };
 ```
 
+In the **client app**, the `host:*` members are absent from its local `Capability` union —
+the narrowing is enforced by the type system, not by runtime filtering.
+
 ### 6.2 Capability resolution — one function
 
 ```ts
@@ -319,13 +365,16 @@ Initialized in `+layout.svelte`. Never server-computed.
 
 ### 6.4 API namespace split
 
-| Namespace | Purpose | Auth |
-|---|---|---|
-| `/api/runtime` | Server runtime context | Public — no auth |
-| `/api/connections/*` | Connection list, active connection, validation | `connections:manage` capability |
-| `/api/assistant/*` | Assistant-owned settings | `assistant-settings:write` capability |
-| `/api/host/*` | Host stack lifecycle, privileged ops | `host:stack:write` + loopback-only |
-| `/proxy/assistant/*` | Same-origin assistant broker | Same-origin cookie |
+| Namespace | Purpose | Served by | Auth |
+|---|---|---|---|
+| `/api/runtime` | Server runtime context (+ contract-version handshake for remote clients) | host app; assistant-container shim | Public — no auth |
+| `/api/connections/*` | Connection list, active connection, validation | host app | `connections:manage` capability |
+| `/api/assistant/*` | Assistant-owned settings | host app; assistant-container shim (optional slice) | `assistant-settings:write` capability |
+| `/api/host/*` | Host stack lifecycle, privileged ops | host app only | `host:stack:write` + loopback-only |
+| `/proxy/assistant/*` | Same-origin assistant broker | host app only | Same-origin cookie |
+
+The client app calls guardian/OpenCode APIs **directly** (Basic/Bearer per connection);
+it has no privileged namespaces of its own.
 
 **No `/admin/*` alias.** With <10 installs the alias-for-one-release hedge is unnecessary overhead. `/admin/*` becomes 404 when `/host/*` ships.
 
@@ -367,58 +416,37 @@ export type ConnectionEntry = {
 ```
 
 `endpoints.json` is NOT renamed. `kind` field added. Internal model uses "connection" language.
+In the client app, connections live in IndexedDB (offline-readable); in the host app they
+stay in `endpoints.json` under `OP_HOME/config/`.
 
-### 6.7 `@openpalm/skeleton` package
-
-```
-packages/skeleton/
-  package.json          # name: "@openpalm/skeleton", no main, no exports, no build, no deps
-  manifest.json         # [{relPath, category: 'managed'|'guardian-managed'|'seeded'}]
-  tools.json            # global CLI tool defaults; per-tool env key + default version range
-  config/
-    stack/              # core.compose.yml, services.compose.yml, portals.compose.yml, custom.compose.yml
-    assistant/          # opencode.jsonc (seeded), persona.md (seeded), instructions/, themes/
-    guardian/           # opencode.jsonc (guardian-managed), instructions/moderation.md (guardian-managed)
-  knowledge/
-    skills/             # bundled skills
-    tasks/              # automation task YAML files
-```
+**Pairing UX (simplicity guardrail):** the host app's `/connections` page can mint a
+one-time pairing payload (guardian URL + short-lived code, rendered as QR + copyable
+string); the client's `/connections/new` accepts paste-or-scan. No manual credential
+assembly for non-technical users. (Design detail lands with Phase 6; guardian side
+coordinates with #435.)
 
-**`tools.json` schema:**
-
-```json
-{
-  "global": [
-    { "package": "opencode",                  "envKey": "OP_TOOL_OPENCODE_VERSION",    "default": "^1.2.3" },
-    { "package": "@anthropic-ai/claude-code", "envKey": "OP_TOOL_CLAUDE_CODE_VERSION", "default": "^1.5.0" },
-    { "package": "@openai/codex",             "envKey": "OP_TOOL_CODEX_VERSION",       "default": "^0.1.0" }
-  ]
-}
-```
-
-The `envKey` field is explicit — no magic normalization of `@scope/package-name`. Adding a new tool is one line + a skeleton publish. Removing a tool is one line + a skeleton publish. No image rebuild. The default range (`^minor`) keeps tools on the latest patch/minor automatically; operators pin exact versions via env vars when needed.
-
-`.openpalm/` in the repo root becomes a README-only stub: "skeleton assets moved to `packages/skeleton/`."
-
-**`manifest.json` schema:**
-```json
-[
-  { "relPath": "config/stack/core.compose.yml", "category": "managed" },
-  { "relPath": "config/guardian/instructions/moderation.md", "category": "guardian-managed" },
-  { "relPath": "config/assistant/opencode.jsonc", "category": "seeded" }
-]
-```
+### 6.7 `@openpalm/skeleton` package — **[as-landed]**
 
-`core-assets.ts` reads from `manifest.json` instead of hard-coded `MANAGED_ASSETS`, `GUARDIAN_MANAGED_ASSETS`, `SEEDED_ASSETS` arrays. Write policy logic (`SHIPPED_DEFAULT_HASHES`, `isUnmodifiedDefault`) preserved byte-for-byte.
+Landed in #508. What shipped (differences from the draft noted):
 
-**Source resolution (replaces 5-step ladder in `ui-assets.ts`):**
 ```
-1. OPENPALM_REPO_ROOT env var → ${root}/packages/skeleton/ (dev mode)
-2. require.resolve('@openpalm/skeleton/package.json') → package dir (CLI bundled dep, Electron)
-3. npm install --prefix <tmpdir> @openpalm/skeleton@<platformVersion> → upgrade / cold start
+packages/skeleton/
+  package.json          # name: "@openpalm/skeleton", no main, no build, no deps
+  manifest.json         # [{relPath, category: 'managed'|'guardian-managed'|'seeded'}]
+  config/ knowledge/ system/ data/ workspace/   # full OP_HOME seed trees
+  openpalm.sh openpalm.ps1
 ```
 
-GitHub raw fallback deleted. Electron `extraResources` skeleton bundle removed (Electron resolves via step 2).
+- `manifest.json` drives asset categories in `core-assets.ts`; `SHIPPED_DEFAULT_HASHES`
+  and `isUnmodifiedDefault()` preserved byte-for-byte. ✅ (as designed)
+- Source resolution: the five-strategy chain in §3 (**not** the draft's three-step chain;
+  Electron extraResources retained deliberately).
+- `tools.json` was **not** added to the skeleton — tool ranges live in the baked
+  `containers/assistant/tools/package.json` instead (§1, §3).
+- `.openpalm/` in the repo root is a README-only stub. ✅
+- `@openpalm/skeleton` is a pinned dep of `packages/cli`. **Follow-up:** the pin
+  (`0.12.18` at time of writing) must be advanced by the release process in lockstep with
+  `PLATFORM_VERSION` — verify `platform-release.yml` does this before each release.
 
 ### 6.8 Authentication model
 
@@ -426,90 +454,123 @@ GitHub raw fallback deleted. Electron `extraResources` skeleton bundle removed (
 |---|---|
 | Host Control Plane | Existing `op_session` cookie, `HttpOnly`, `SameSite=Strict`, loopback-only. Unchanged. |
 | Assistant Control Plane | Guardian Basic auth (matching OpenCode's auth model) |
-| Connection Control Plane | Host admin session for writes; capability-gated reads |
-| PWA / remote clients | Guardian Basic auth aligned with #435 Bearer seam |
-
-### 6.9 `assistant-container` mode
-
-One image, two co-processes. UI and skeleton pulled from npm at startup:
-
-```sh
-# entrypoint.sh — version resolution
-resolve_version() {
-  local override="$1" platform="$2" name="$3"
-  if [ -n "$override" ]; then echo "$override"; return; fi
-  if [ -n "$platform" ]; then echo "$platform"; return; fi
-  echo "ERROR: Cannot resolve version for $name. Set OP_${name}_VERSION." >&2; exit 1
-}
-
-# ── Exact-pinned artifacts ────────────────────────────────────────────────────
-UI_VERSION=$(resolve_version "$OP_UI_VERSION" "$PLATFORM_VERSION" "UI")
-SKELETON_VERSION=$(resolve_version "$OP_SKELETON_VERSION" "$PLATFORM_VERSION" "SKELETON")
-
-npm install --prefer-offline --omit=dev --prefix /opt/openpalm/ui       "@openpalm/ui@${UI_VERSION}"
-npm install --prefer-offline --omit=dev --prefix /opt/openpalm/skeleton  "@openpalm/skeleton@${SKELETON_VERSION}"
-
-# Seed OP_HOME from skeleton (migrations + backups applied by lib)
-node -e "require('@openpalm/lib').seedFromSkeleton('/opt/openpalm/skeleton', process.env.OP_HOME)"
-
-# ── Range-versioned CLI tools (from tools.json) ───────────────────────────────
-export BUN_INSTALL=/opt/openpalm/tools
-export PATH="$BUN_INSTALL/bin:$PATH"
-
-TOOL_PKGS=$(bun -e "
-  const tools = require('/opt/openpalm/skeleton/node_modules/@openpalm/skeleton/tools.json').global;
-  const pkgs = tools.map(t => t.package + '@' + (process.env[t.envKey] || t.default));
-  console.log(pkgs.join(' '));
-")
-bun add -g $TOOL_PKGS || echo "WARN: some tool installs failed; continuing"
-
-# ── Start UI co-process ───────────────────────────────────────────────────────
-OP_UI_HOST_MODE=assistant-container \
-OP_UI_SINGLE_CONNECTION=1 \
-OP_UI_DEFAULT_ASSISTANT_URL=http://127.0.0.1:4096 \
-node /opt/openpalm/ui/node_modules/@openpalm/ui/build/index.js &
-
-exec opencode ...
-```
-
-**Mounts in assistant-container mode:**
+| Connection Control Plane | Host app: host admin session for writes. Client app: per-connection credentials in IndexedDB, capability-gated reads |
+| PWA / remote clients | Guardian Basic auth aligned with #435 Bearer seam; HTTPS required for non-loopback targets from the hosted origin |
+
+### 6.9 `assistant-container` mode — **[as-landed + re-scoped]**
+
+**Already landed in `containers/assistant/entrypoint.sh`:** `install_runtime_artifacts()`
+(exact-pin resolution, npm install of UI + skeleton, tools via `bun update`) and
+`start_ui()` (co-process launch, `OP_UI_PORT` default 3000). Boot order:
+`install_runtime_artifacts → … → start_ui → start_opencode`.
+
+**Not yet landed / known gaps (tracked in #510):**
+
+1. The co-process port is **not published** in any compose file — the UI runs but is
+   unreachable from outside the container.
+2. `start_ui` exports `OPENCODE_API_URL`, but the UI reads `OP_OPENCODE_URL` /
+   `OP_ASSISTANT_URL` — the co-process therefore points at the default
+   `http://127.0.0.1:3800` instead of the in-container OpenCode at `:4096`. Wiring bug;
+   fix regardless of the re-scope.
+3. No mode env (`OP_UI_HOST_MODE`, `OP_UI_SINGLE_CONNECTION`) is set, and no
+   skeleton-seed call runs for assistant-scoped config (`seedFromSkeleton()` from the
+   draft does not exist in lib).
+
+**Re-scope (ratified):** after Phase 5, the co-process serves **`@openpalm/client`**
+(static files) instead of the full host app:
+
+- Slice A (launch): chat with a single locked connection to the local OpenCode. Serving
+  the static bundle needs only a minimal static file server (bun is present in the image).
+  `/api/host/*` does not exist in the artifact — nothing to 403.
+- Slice B (optional follow-up): a **settings shim** — a small co-process endpoint set
+  (`/api/runtime`, `/api/assistant/*`) that performs assistant-scoped file writes
+  (persona, AKM runtime config). Only this slice needs anything beyond static serving.
+  Ship it only when assistant-settings-from-browser is actually wanted.
+
+**Mounts in assistant-container mode (unchanged):**
 - `config/assistant/` — read/write
 - `config/akm/` — read/write
 - No Docker socket
 - No broad `OP_HOME` access
 
-### 6.10 PWA mode
+### 6.10 PWA mode — **[re-scoped]**
+
+The PWA is `packages/client` (`adapter-static` + `@vite-pwa/sveltekit`: manifest, icons,
+Workbox precache of the app shell). Host features are **absent from the artifact**, not
+hidden by capability checks.
+
+**Two primary install origins:**
+
+1. **Localhost (desktop, zero-setup).** The harness serves the built client on a stable
+   loopback port (stable because PWA identity = origin incl. port). `http://127.0.0.1` is
+   a secure context → installable with no certificates. A loopback origin is also exempt
+   from mixed-content blocking and sits in the most-trusted Private Network Access tier,
+   so it may call plain-HTTP LAN guardians. Entry points: Electron menu / host app button
+   ("Install OpenPalm app") and `openpalm app` on the CLI.
+2. **Official hosted URL** (e.g. `https://app.openpalm.dev`). CI publishes the same static
+   build to a canonical TLS-terminated origin. One install works on any phone/tablet and
+   connects to any of the user's instances. Constraints that follow from the platform,
+   not from our code:
+   - an HTTPS origin cannot call plain-HTTP guardians (mixed content) → **guardian TLS
+     workstream is a hard prerequisite for this path** (Tailscale `ts.net` certs are the
+     recommended default; Caddy with a user domain as the alternative);
+   - guardian must send CORS headers for the official origin (allowlist, configurable);
+   - version skew is handled by the `/api/runtime` contract-version handshake — the
+     hosted client degrades gracefully against older instances.
+
+Offline behavior: app shell + connection records (IndexedDB) available offline; chat
+requires connectivity. Since the client is static and unauthenticated at the origin level,
+the service worker never caches credentialed responses.
+
+**Phone reality check:** a phone can only reach a guardian over TLS (both install paths —
+the hosted origin because of mixed content; and any non-loopback origin is not installable
+over plain HTTP anyway). The desktop/localhost path is the only truly TLS-free path, which
+is why it is the default for the machine that runs the stack, and the hosted path + TLS
+workstream is the mobile story.
+
+### 6.11 `packages/client` and `packages/ui-kit`
 
-Same adapter-node build. `static/manifest.webmanifest` + `src/service-worker.ts`. When resolved capabilities exclude `host:*`, host tabs/nav absent via `hasCapability()`. No new pages. No duplicate UI. IndexedDB connection store for offline-capable connection records.
+```
+packages/client/            # @openpalm/client — published, exact-pin delivery
+  svelte.config.js          # adapter-static, SPA fallback
+  vite.config.ts            # @vite-pwa/sveltekit
+  src/routes/
+    chat/                   # moved from packages/ui (after Phase 3/4 decoupling)
+    connections/            # client-side connection manager (IndexedDB)
+    assistant/settings/     # visible only when the connection grants it
+  src/lib/
+    transport/              # ONE transport: guardian/OpenCode base URL + credentials
+
+packages/ui-kit/            # raw-source workspace package — NOT published
+  src/lib/components/       # common/, icons/, chrome primitives shared by ui + client
+  src/lib/theme/            # tokens, app.css design vocabulary (coordinates with #506)
+```
+
+Rules:
+- `client` has **no dependency on `@openpalm/lib`** and no `src/lib/server/`.
+- `ui-kit` contains no stores with server assumptions — presentational components,
+  icons, and theme only. The `endpoints-state` ↔ `chat-state` coupling gets untangled in
+  Phases 2–3 *before* extraction, so the move is file relocation, not surgery.
+- `packages/ui` keeps its chat surface only until the client reaches parity inside
+  Electron (the harness serves the client build alongside the host app), then deletes it.
 
 ---
 
 ## 7. Implementation phases
 
-All phases ship in **0.13.0**. The prior 0.13.0/0.14.0 split was a staged-rollout hedge for large user bases. With fewer than 10 installs, mostly owner-operated, the constraint doesn't apply. The phases below are implementation ordering (code dependencies), not release milestones.
-
-### Phase 0 — Baseline + skeleton package
+Phases are implementation ordering (code dependencies), not release milestones. 0.13.0
+carries Phases 1–4 + 1.5; the client extraction (5–6) and TLS workstream follow — pull
+them into 0.13.0 only if it stays light.
 
-Two tracks merged into one phase. Both are non-behavior-changing foundation work.
+### Phase 0 — Baseline + skeleton package — ✅ DONE (#508)
 
-**Track A: Baseline tests (partially complete)**
-- Already done: unit tests for `computeFeatureFlags()` and `hooks.server.ts` route decisions
-- Still needed: Playwright smoke tests (host mode, admin redirect, chat route), `docs/technical/ui-route-map.md`
+Landed with the deltas recorded in §3/§6.7 (five-strategy resolution, extraResources
+retained, tools via baked `package.json`, npm-registry cold-start download replacing the
+GitHub raw fallback). Outstanding from the original Track A: Playwright smoke tests and
+`docs/technical/ui-route-map.md` were **not** produced — fold them into Phase 3, where the
+route structure they document actually changes.
 
-**Track B: `@openpalm/skeleton` package**
-1. Create `packages/skeleton/package.json` — no main, no exports, no build, no deps. `files` field restricts to `config/`, `knowledge/`, `manifest.json`.
-2. Move `.openpalm/` contents into `packages/skeleton/`. Leave `.openpalm/README.md` stub.
-3. Write `packages/skeleton/manifest.json` listing all files with their category.
-4. Update `core-assets.ts`: read `MANAGED_ASSETS`, `GUARDIAN_MANAGED_ASSETS`, `SEEDED_ASSETS` from `manifest.json` instead of hard-coded arrays. `bundledAssetPath()` → `require.resolve('@openpalm/skeleton/package.json')`. `SHIPPED_DEFAULT_HASHES` preserved exactly.
-5. Update `ui-assets.ts`: three-step resolution chain (§6.7). Delete GitHub raw fallback. Delete Electron extraResources skeleton path.
-6. Add `@openpalm/skeleton` as pinned exact-version dep in `packages/cli/package.json`.
-7. Remove Electron extraResources skeleton bundle from `packages/electron/electron-builder.yml` / `forge.config.ts`. Electron now resolves via step 2 (bundled npm dep).
-8. Add `@openpalm/skeleton` as first entry in `platform-release.yml` publish DAG (must publish before `@openpalm/lib` since lib will import/resolve it).
-9. Update dev-setup.sh / `OPENPALM_REPO_ROOT` override to point to `packages/skeleton/` instead of `.openpalm/`.
-
-Acceptance: skeleton resolves from npm dep in all non-dev paths; dev still works via `OPENPALM_REPO_ROOT`; `SHIPPED_DEFAULT_HASHES` hashes still match the same file content; existing installs upgrade correctly; GitHub raw fallback is gone.
-
-### Phase 1 — RuntimeContext v2, no UI change
+### Phase 1 — RuntimeContext v2, no UI change (#509)
 
 **Files:** `lib/server/features.ts`, `lib/types.ts`, `routes/+layout.server.ts`, `lib/runtime-context.svelte.ts`, `lib/client-context.ts`, `routes/api/runtime/+server.ts`
 
@@ -518,29 +579,47 @@ Acceptance: skeleton resolves from npm dep in all non-dev paths; dev still works
 3. Return `serverRuntimeContext` from `+layout.server.ts`.
 4. Initialize `clientContext` in `+layout.svelte` (client-only; detect display mode; wire active connection).
 5. Derive `effectiveCapabilities` reactively.
-6. Add `/api/runtime` endpoint (public, no auth).
+6. Add `/api/runtime` endpoint (public, no auth) — include the contract version used by the future hosted-client handshake.
 
 Acceptance: existing routes unchanged; `features.admin` alias works; capability matrix correct for all current combinations.
 
-### Phase 2 — Connection management out of `/admin`
+### Phase 1.5 — `openpalm admin` (host-ui mode) — NEW, small
+
+1. CLI: `openpalm admin` (and/or a flag on the default serve path) launches the existing
+   UI server with the admin capability enabled (today: `OP_ENABLE_ADMIN=1`; after Phase 1:
+   `hostMode: 'host-ui'`), loopback-only, existing `op_session` password auth. Opens the
+   browser.
+2. No new UI. No new auth. Refuse `OP_ALLOW_REMOTE_SETUP`-style non-loopback binds for
+   this mode.
+
+Acceptance: full host management from a browser on the host machine without Electron;
+remains loopback-only; `openpalm admin` on a machine without the stack installed lands on
+`/setup`.
 
-**Closes #486.**
+### Phase 2 — Connection management out of `/admin` (#486)
 
 1. Rename internal model "endpoint" → "connection" in UI layer. `endpoints.json` unchanged.
 2. Add `kind` to `ConnectionEntry`; default existing records.
 3. New routes: `/connections`, `/api/connections/*`. Guard with `connections:manage`.
 4. Update chat page link: `/admin/endpoints` → `/connections`.
 5. `/admin/endpoints` → redirect to `/connections` (0.13.0 alias).
+6. **Untangle for extraction:** break the `endpoints-state` ↔ `chat-state` bidirectional
+   import (connection activation emits an event; chat subscribes). This is a hard
+   prerequisite for Phase 5.
 
-Acceptance: PWA-mode clients can manage connections without `/admin`; host mode unchanged; no data migration.
+Acceptance: connection management reachable without `/admin`; host mode unchanged; no data migration; `endpoints-state` no longer imports `chat-state`.
 
 ### Phase 3 — Capability-driven landing and navigation
 
 1. Add `resolveLanding(ctx, launchState)`.
 2. Split `/splash` into `/attention`, `/setup`, `/host`, `/chat`, `/connections`.
 3. Nav reads `runtimeContext.routes` + `hasCapability()`. No `if (features.admin)` checks.
+4. **Untangle for extraction:** give the chat surface its own minimal chrome — `Navbar`
+   must stop importing chat components/stores into the admin surface. Chat stops importing
+   the `$lib/api.js` barrel (direct domain-client imports only).
+5. Produce `docs/technical/ui-route-map.md` + Playwright smoke tests (carried from Phase 0).
 
-Acceptance: Electron healthy → chat; assistant-container → chat; PWA no-connections → `/connections/new`.
+Acceptance: Electron healthy → chat; capability-driven nav; chat chunk free of admin API clients (verify bundle); route map doc exists.
 
 ### Phase 4 — Split Host and Assistant Control Planes
 
@@ -551,48 +630,74 @@ Acceptance: Electron healthy → chat; assistant-container → chat; PWA no-conn
 
 Acceptance: assistant-container can edit persona/AKM but not project name or bind address; host mode unchanged; `/admin/*` returns 404.
 
-### Phase 5 — `assistant-container` mode
+### Phase 5 — Extract `packages/client` + `packages/ui-kit`; assistant-container serves it
 
-*Depends on Phases 0, 1, 4.*
+*Depends on Phases 2–4 (the untangling steps).*
 
-1. Add UI + skeleton install to `containers/assistant/entrypoint.sh` (see §6.9).
-2. `npm install --prefer-offline` for both packages; fail fast if version unresolvable.
-3. `seedFromSkeleton()` call to seed assistant-scoped `OP_HOME` paths.
-4. Start SvelteKit UI co-process.
-5. Add `PLATFORM_VERSION` build arg to Dockerfile; wire `OP_SKELETON_VERSION` and `OP_UI_VERSION` defaults.
-6. Add locked default connection to local OpenCode (port 4096).
-7. Add named Docker volume `openpalm-artifact-cache` mounted at `/opt/openpalm` (covers UI, skeleton, and tools cache in one volume).
-8. Add `tools.json` to `@openpalm/skeleton` with initial tool list and `^minor` defaults.
-9. Wire `BUN_INSTALL=/opt/openpalm/tools` in entrypoint before tool install step.
+1. Create `packages/ui-kit` (raw-source workspace package); move `components/common/`,
+   `icons/`, theme tokens. Both apps consume it.
+2. Create `packages/client` per §6.11; move chat + connections views; implement the single
+   transport (direct guardian/OpenCode calls, IndexedDB connections).
+3. Harness serves the client build on a stable loopback port; Electron window offers it;
+   `packages/ui` chat stays until parity, then dies.
+4. Assistant container: `install_runtime_artifacts` pulls `@openpalm/client`
+   (`OP_CLIENT_VERSION` → `PLATFORM_VERSION` → error); co-process serves the static bundle
+   (Slice A). Fix the `OP_OPENCODE_URL` wiring bug (§6.9). Publish the port in compose
+   behind the existing bind-address policy.
+5. Release: `@openpalm/client` joins the publish DAG and the exact-pin table.
+6. (Optional Slice B, separate issue) settings shim for `/api/assistant/*` writes.
 
-Acceptance: `docker restart` with new `OP_UI_VERSION` or `OP_SKELETON_VERSION` picks up new artifact; `OP_TOOL_CLAUDE_CODE_VERSION=^2.0.0` overrides that tool's range; tool install failure logs a warning and does not block container start; tools available on PATH; `/api/host/*` returns 403; assistant settings editable; skeleton correctly seeds assistant config on first start.
+Acceptance: chat in Electron runs from the client build; assistant-container URL serves
+chat against local OpenCode with zero host-admin code in the artifact; `docker restart`
+with a new `OP_CLIENT_VERSION` picks up the new client.
 
-### Phase 6 — PWA mode
+### Phase 6 — PWA (two install origins) (#511)
 
-*Depends on Phases 1, 2, 3.*
+*Depends on Phase 5.*
 
-1. `static/manifest.webmanifest` + `src/service-worker.ts`.
-2. When resolved capabilities exclude `host:*`, host routes absent — no new pages.
-3. IndexedDB connection store for offline operation.
-4. Remote auth: Guardian Basic auth aligned with #435.
+1. `@vite-pwa/sveltekit` in `packages/client`: manifest, icons (192/512 + maskable),
+   Workbox app-shell precache.
+2. Localhost install path: stable port, install affordances in Electron/host app/CLI
+   (`openpalm app`).
+3. Hosted install path: CI deploy of the static build to the official URL; `/api/runtime`
+   contract-version handshake; connection pairing UX (§6.6).
+4. Guardian CORS allowlist for the official origin.
+5. IndexedDB connection store; offline shell.
+
+Acceptance: install prompt on desktop from localhost with zero TLS setup; install on a
+phone from the official URL; add/switch connections via paste-or-scan pairing; offline
+launch shows the shell + saved connections, not a blank page.
+
+### Phase 6.5 — Guardian edge TLS workstream — NEW (own issue)
+
+*Parallel to Phases 5–6; hard prerequisite for hosted-origin → LAN connections.*
+
+1. Recommended default: Tailscale integration docs + `ts.net` cert flow (guided, no cert
+   management for the user).
+2. Alternative: Caddy front for guardian with a user-owned domain (DNS challenge).
+3. Explicit non-goal: asking non-technical users to install a private CA on iOS/Android.
+4. `requiresHttpsForRemoteConnections` enforced: the hosted client refuses plain-HTTP
+   non-loopback targets with a clear, actionable message (deep-link to the TLS guide).
 
 ### Phase 7 — Security hardening
 
 *Depends on Phases 1–6.*
 
 1. Host admin loopback-only checks unchanged.
-2. Context-aware origin checks per mode.
+2. Context-aware origin checks per mode; guardian CORS tests (allowlist enforced).
 3. Route guard tests for every `/api/host/*` endpoint (must 403 in non-host modes).
-4. Negative tests: assistant-container and PWA cannot reach host APIs.
-5. CSP review.
+4. Negative tests: assistant-container artifact contains no host-admin code (build
+   assertion, not just runtime 403); hosted client cannot reach host APIs.
+5. CSP review for both apps; service worker never caches credentialed responses.
 
 ### Phase 8 — Release integration
 
 *Depends on all prior phases.*
 
-1. Add `OP_UI_VERSION`, `OP_SKELETON_VERSION` to compose env-file docs and release notes.
-2. New docs: `docs/technical/ui-runtime-modes.md` (replaces this plan), `docs/technical/artifact-delivery-pattern.md`.
-3. Release checklist: smoke-test electron-host, assistant-container (with version overrides), pwa-static before publishing.
+1. Add `OP_CLIENT_VERSION`, `OP_SKELETON_VERSION` to compose env-file docs and release notes.
+2. Verify the release process advances the CLI's pinned `@openpalm/skeleton` dep (§6.7 follow-up).
+3. New docs: `docs/technical/ui-runtime-modes.md` (replaces this plan), `docs/technical/artifact-delivery-pattern.md`.
+4. Release checklist: smoke-test electron-host, host-ui (`openpalm admin`), assistant-container (with version overrides), localhost PWA install, hosted PWA install.
 
 ---
 
@@ -602,11 +707,13 @@ Acceptance: `docker restart` with new `OP_UI_VERSION` or `OP_SKELETON_VERSION` p
 2. **`isUnmodifiedDefault` and `SHIPPED_DEFAULT_HASHES` are preserved byte-for-byte.** Skeleton version must equal platform version in production or these hashes diverge and the guardian-managed write policy silently misfires.
 3. **Host admin remains loopback-only.** Never weakened.
 4. **Assistant container gets no Docker socket and no broad OP_HOME write access.**
-5. **APIs enforce capabilities server-side.** `hasCapability()` is UX, not the security boundary.
-6. **`resolveCapabilities()` is the only place capability logic lives.** No scattered `if (features.admin)`.
+5. **APIs enforce capabilities server-side.** `hasCapability()` is UX, not the security boundary. In the client app the stronger form applies: host capabilities are absent from the artifact.
+6. **`resolveCapabilities()` is the only place capability logic lives** (one per app). No scattered `if (features.admin)`.
 7. **`OPENPALM_REPO_ROOT` dev override is preserved forever.** Essential for local dev loop.
 8. **Backup-before-overwrite for managed assets is preserved.** User recovery path for bad skeleton releases.
 9. **`grantedCapabilities` on connections must be server-verified at connection-add time.** The client cannot self-grant capabilities.
+10. **The client app never bundles `@openpalm/lib` and never holds host credentials.**
+11. **TLS is never a manual task on default install paths.** Desktop = localhost (none needed); phone = hosted origin + guided guardian TLS (Tailscale default).
 
 ---
 
@@ -614,58 +721,51 @@ Acceptance: `docker restart` with new `OP_UI_VERSION` or `OP_SKELETON_VERSION` p
 
 | Area | Current | Change |
 |---|---|---|
-| Skeleton source | `.openpalm/` (repo root) | Move to `packages/skeleton/`; leave README stub |
-| Skeleton path resolution | `ui-assets.ts` 5-step ladder + GitHub raw | Three-step chain; delete GitHub raw; delete Electron extraResources path |
-| Skeleton asset arrays | Hard-coded in `core-assets.ts` | Read from `packages/skeleton/manifest.json` |
-| Skeleton bundled path | `import.meta.url` relative | `require.resolve('@openpalm/skeleton/package.json')` |
-| CLI deps | (skeleton not listed) | Add `@openpalm/skeleton` pinned exact dep |
-| Electron extraResources | Bundles skeleton dir | Remove; Electron resolves via npm dep |
-| Feature flags | `lib/server/features.ts`, `lib/types.ts` | Replace with `ServerRuntimeContext` + `resolveCapabilities()` |
-| Client context | (none) | New `lib/client-context.ts` |
-| Layout data | `routes/+layout.server.ts`, `+layout.svelte` | Pass server context; initialize client context + resolved caps |
-| Landing | `routes/+page.ts`, `routes/splash/*`, `hooks.server.ts` | `resolveLanding()` |
-| Host admin | `routes/admin/*` | Move/alias to `/host`; `host:*` guards |
-| Connections | `routes/admin/endpoints/*`, `endpoints-state.svelte.ts` | Move to `/connections`; rename internal model |
-| Assistant settings | `AssistantTab.svelte` | Split host stack vs. assistant-owned |
-| AKM | `AkmTab.svelte` | Split assistant-scoped vs. host-only |
-| Assistant image | `containers/assistant/entrypoint.sh`, `Dockerfile` | Runtime npm pull for UI + skeleton; co-process start |
-| Electron main | `packages/electron/src/main.ts` | Pass `OP_UI_HOST_MODE=electron-host` |
-| Release DAG | `platform-release.yml` | `@openpalm/skeleton` first in publish order |
+| Skeleton package | ✅ landed (#508) | Follow-up only: release-time advance of the CLI's pinned dep |
+| Feature flags | `lib/server/features.ts`, `lib/types.ts` | Replace with `ServerRuntimeContext` + `resolveCapabilities()` (Phase 1) |
+| Client context | (none) | New `lib/client-context.ts` (Phase 1) |
+| Layout data | `routes/+layout.server.ts`, `+layout.svelte` | Pass server context; initialize client context + resolved caps (Phase 1) |
+| CLI admin | (admin unreachable via CLI) | `openpalm admin` — host-ui mode (Phase 1.5) |
+| Landing | `routes/+page.ts`, `routes/splash/*`, `hooks.server.ts` | `resolveLanding()` (Phase 3) |
+| Host admin | `routes/admin/*` | Move to `/host`; `host:*` guards (Phase 4) |
+| Connections | `routes/admin/endpoints/*`, `endpoints-state.svelte.ts` | Move to `/connections`; rename internal model; break chat-state coupling (Phase 2) |
+| Chat chrome | `Navbar.svelte` imports chat stores | Chat gets its own chrome; barrel imports removed (Phase 3) |
+| Assistant settings | `AssistantTab.svelte` | Split host stack vs. assistant-owned (Phase 4) |
+| AKM | `AkmTab.svelte` | Split assistant-scoped vs. host-only (Phase 4) |
+| Shared components | `packages/ui/src/lib/components/{common,icons}` | Move to `packages/ui-kit` (Phase 5) |
+| Chat + connections views | `packages/ui/src/routes/{chat,advanced}`, `/connections` | Move to `packages/client` (Phase 5) |
+| Assistant image | `containers/assistant/entrypoint.sh`, `Dockerfile` | Pull `@openpalm/client`; fix `OP_OPENCODE_URL` wiring; publish port (Phase 5) |
+| PWA | (none) | `@vite-pwa/sveltekit` in `packages/client`; hosted deploy pipeline (Phase 6) |
+| Guardian edge | plain HTTP, no CORS | CORS allowlist + TLS workstream (Phases 6, 6.5) |
+| Electron main | `packages/electron/src/main.ts` | Pass `OP_UI_HOST_MODE=electron-host`; serve/point at client build (Phases 1, 5) |
+| Release DAG | `platform-release.yml` | Add `@openpalm/client`; skeleton pin advance check (Phase 8) |
 
 ---
 
 ## 10. Milestone summary
 
-**0.13.0 — All phases**
-
-Implementation order (phases are code-dependency ordering, not release gates):
-
 ```
-Phase 0 (skeleton package) ──────────────────────────────► prerequisite for all
-Phase 1 (RuntimeContext)   ──────────────────────────────► prerequisite for 2–8
-Phase 2 (connections)      ──┐
-Phase 3 (landing)          ──┼─► parallelizable ──────────► prerequisite for 5–8
-Phase 4 (control plane split) ┘
-Phase 5 (assistant-container) ─ needs 0, 1, 4 ──────────► prerequisite for 7–8
-Phase 6 (PWA)              ─── needs 1, 2, 3 ────────────► prerequisite for 7–8
-Phase 7 (security tests)   ─── needs 1–6 ───────────────► prerequisite for 8
-Phase 8 (release cleanup)  ─── needs all ───────────────► ships in 0.13.0
+Phase 0 (skeleton package)        ✅ DONE (#508)
+Phase 1 (RuntimeContext)          ─────────────► prerequisite for everything below
+Phase 1.5 (openpalm admin)        ─ tiny, ships with Phase 1
+Phase 2 (connections + untangle)  ──┐
+Phase 3 (landing + chrome untangle)─┼─► parallelizable ─► prerequisite for 5
+Phase 4 (control plane split)     ──┘
+Phase 5 (client + ui-kit extraction, assistant-container) ─► prerequisite for 6
+Phase 6 (PWA, two install origins) ─ needs 5
+Phase 6.5 (guardian TLS + CORS)   ─ parallel to 5/6; gates the phone story
+Phase 7 (security tests)          ─ needs 1–6.5
+Phase 8 (release integration)     ─ needs all
 ```
 
-No 0.14.0 split. The split was a staged-rollout hedge for large installs; it does not apply here.
+0.13.0 target: Phases 1–4 + 1.5. Phases 5–6.5 land in 0.13.0 only if it stays light;
+otherwise they open 0.14.0. (The original "all phases in 0.13.0" call predates the
+client-split re-scope; re-evaluated at Phase 4 completion.)
 
 ---
 
 ## 11. Acceptance criteria
 
-**Skeleton delivery:**
-- `@openpalm/skeleton` resolves from bundled npm dep in CLI and Electron (no network call needed for CLI path)
-- `OPENPALM_REPO_ROOT` still works for local dev
-- GitHub raw fallback is gone; Electron extraResources skeleton is gone
-- `SHIPPED_DEFAULT_HASHES` values are unchanged; `isUnmodifiedDefault` still works correctly
-- `manifest.json` drives asset category logic in `core-assets.ts`
-- `@openpalm/skeleton` publishes before `@openpalm/lib` in the release DAG
-
 **Capability system:**
 - `resolveCapabilities()` is the only capability logic; all components call `hasCapability()` only
 - Adding a new capability rule requires editing one function
@@ -673,14 +773,16 @@ No 0.14.0 split. The split was a staged-rollout hedge for large installs; it doe
 
 **Host modes:**
 - Electron app: full host management, all features
-- Browser to host UI: full host management when authenticated
-- Browser to assistant-container URL: chat + assistant settings only; `/api/host/*` returns 403
-- PWA: install prompt works; add/switch remote connections; no host controls visible or callable
+- `openpalm admin`: full host management from a browser on the host, loopback-only, no Electron
+- Browser to assistant-container URL: chat (+ assistant settings when Slice B ships); no host-admin code in the artifact
+- PWA (localhost): installable on the host machine with zero TLS setup
+- PWA (hosted): installable on a phone from the official URL; connects only to HTTPS guardians; pairing is paste-or-scan
 
 **Versioning:**
-- `OP_UI_VERSION` and `OP_SKELETON_VERSION` override the version used by the assistant container
+- `OP_CLIENT_VERSION` / `OP_SKELETON_VERSION` override the versions used by the assistant container
 - Neither ever silently falls back to `latest`
 - `docker restart` with a new version env var picks up the new artifact
+- Hosted client ↔ instance skew is handled by the `/api/runtime` contract handshake
 
 **Release:**
-- All three host modes smoke-tested before publishing each release
+- electron-host, host-ui, assistant-container, and both PWA install paths smoke-tested before publishing each release

From 763eb116c7a497daad39a2d3245e65b47e175da4 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Mon, 6 Jul 2026 05:36:51 +0000
Subject: [PATCH 02/61] docs: link new issues #555-#557 into the runtime-modes
 plan phases

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FetR7BttT1xBrA8fBwhui9
---
 docs/technical/ui-runtime-modes-plan.md | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/docs/technical/ui-runtime-modes-plan.md b/docs/technical/ui-runtime-modes-plan.md
index 735f42f91..781e60c4b 100644
--- a/docs/technical/ui-runtime-modes-plan.md
+++ b/docs/technical/ui-runtime-modes-plan.md
@@ -3,7 +3,7 @@
 **Date:** 2026-06-19 (revised 2026-07-06)
 **Status:** RATIFIED — Phases 0 landed; Phases 1–4 as designed; Phases 5–6 re-scoped per `docs/technical/ui-client-split-assessment.md`
 **Repo:** `itlackey/openpalm`, branch `main`
-**Related issues:** #486 (remote-only install), #435 (guardian authn), #433 (guardian state), #488 (mDNS), #506 (styling), #509 (RuntimeContext), #510 (assistant-container), #511 (PWA)
+**Related issues:** #486 (remote-only install), #435 (guardian authn), #433 (guardian state), #488 (mDNS), #506 (styling), #509 (RuntimeContext), #510 (assistant-container), #511 (PWA), #555 (client extraction), #556 (openpalm admin), #557 (guardian TLS + CORS)
 
 > **Revision note (2026-07-06).** The original draft shipped one `adapter-node` build to
 > every runtime mode. That scope is revised: the product is still **one UI**, but it ships
@@ -583,7 +583,7 @@ route structure they document actually changes.
 
 Acceptance: existing routes unchanged; `features.admin` alias works; capability matrix correct for all current combinations.
 
-### Phase 1.5 — `openpalm admin` (host-ui mode) — NEW, small
+### Phase 1.5 — `openpalm admin` (host-ui mode) (#556) — NEW, small
 
 1. CLI: `openpalm admin` (and/or a flag on the default serve path) launches the existing
    UI server with the admin capability enabled (today: `OP_ENABLE_ADMIN=1`; after Phase 1:
@@ -630,7 +630,7 @@ Acceptance: Electron healthy → chat; capability-driven nav; chat chunk free of
 
 Acceptance: assistant-container can edit persona/AKM but not project name or bind address; host mode unchanged; `/admin/*` returns 404.
 
-### Phase 5 — Extract `packages/client` + `packages/ui-kit`; assistant-container serves it
+### Phase 5 — Extract `packages/client` + `packages/ui-kit` (#555); assistant-container serves it (#510)
 
 *Depends on Phases 2–4 (the untangling steps).*
 
@@ -668,7 +668,7 @@ Acceptance: install prompt on desktop from localhost with zero TLS setup; instal
 phone from the official URL; add/switch connections via paste-or-scan pairing; offline
 launch shows the shell + saved connections, not a blank page.
 
-### Phase 6.5 — Guardian edge TLS workstream — NEW (own issue)
+### Phase 6.5 — Guardian edge TLS + CORS workstream (#557) — NEW
 
 *Parallel to Phases 5–6; hard prerequisite for hosted-origin → LAN connections.*
 

From 483b4bfc9a6ba05a167b2f4b2228af07bf0fb823 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Mon, 6 Jul 2026 06:38:24 +0000
Subject: [PATCH 03/61] test(phase-1): red tests for #509
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

TDD red suite for RuntimeContext v2 (plan §6.1-§6.4, §4.3):

- lib/server/features.vitest.ts: computeServerRuntimeContext env→hostMode
  mapping (OP_UI_HOST_MODE > OP_INSIDE_ELECTRON > OP_ENABLE_ADMIN >
  pwa-static baseline), ServerRuntimeContext contract shape (version 2,
  security, activeConnectionMode), and per-hostMode serverCapabilities.
  RED: 15 tests (computeServerRuntimeContext is not exported yet).
  CHARACTERIZATION (passes pre-change, must stay green): 3 tests pinning
  computeFeatureFlags().admin under OP_INSIDE_ELECTRON=1 / OP_ENABLE_ADMIN=1.

- lib/runtime-context.vitest.ts: resolveCapabilities full matrix per §6.2
  (electron=ALL; host:stack:read+browser=all minus electron-only;
  connections:single→chat+assistant-settings; pwa baseline→connections+
  chat+pwa:install; grantedCapabilities union+dedupe; standalone-pwa
  restriction per §4.2), hasCapability via the runtimeContext store, and
  §4.3 matrix rows end-to-end. RED: whole file (module does not exist).

- routes/api/runtime/server.vitest.ts: GET /api/runtime is public (200
  with no/garbage session cookie), returns JSON ServerRuntimeContext with
  the contract-version handshake field. RED: whole file (+server.ts does
  not exist).

- routes/layout.server.vitest.ts: layout load returns serverRuntimeContext
  (RED: 3 tests) and keeps the features.admin derived alias
  (CHARACTERIZATION: 3 tests, green pre-change).

Verified red for the right reasons: 21 failed tests / 2 failed suites, all
"Cannot find module" / "not a function" / missing-key assertions; server
project otherwise at baseline (940 passed incl. the 6 characterization
tests). ui:check reports 9 errors, all in these test files, all missing
Phase 1 exports — resolves when the implementation lands.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FetR7BttT1xBrA8fBwhui9
---
 packages/ui/src/lib/runtime-context.vitest.ts | 307 ++++++++++++++++++
 packages/ui/src/lib/server/features.vitest.ts | 240 ++++++++++++++
 .../src/routes/api/runtime/server.vitest.ts   | 101 ++++++
 .../ui/src/routes/layout.server.vitest.ts     |  97 ++++++
 4 files changed, 745 insertions(+)
 create mode 100644 packages/ui/src/lib/runtime-context.vitest.ts
 create mode 100644 packages/ui/src/lib/server/features.vitest.ts
 create mode 100644 packages/ui/src/routes/api/runtime/server.vitest.ts
 create mode 100644 packages/ui/src/routes/layout.server.vitest.ts

diff --git a/packages/ui/src/lib/runtime-context.vitest.ts b/packages/ui/src/lib/runtime-context.vitest.ts
new file mode 100644
index 000000000..c7651971a
--- /dev/null
+++ b/packages/ui/src/lib/runtime-context.vitest.ts
@@ -0,0 +1,307 @@
+/**
+ * Tests for lib/runtime-context.svelte.ts — Phase 1 RuntimeContext v2 (issue #509).
+ *
+ * ALL RED until the implementation lands: the module under test does not exist
+ * yet. Per plan §6.2 it must be the ONLY place capability logic lives, exporting
+ * `resolveCapabilities(serverCaps, clientCtx)`, `hasCapability(cap)` and the
+ * reactive `runtimeContext` store.
+ *
+ * Pins the full effective-capability matrix from plan §4.3:
+ *   electron-host + electron            → ALL server capabilities
+ *   host-ui + browser                   → ALL minus Electron-only (none reserved yet)
+ *   connections:single (+ any display)  → chat + assistant-settings:*
+ *   pwa baseline (+ any display)        → connections:* + chat + pwa:install
+ *   activeConnection.grantedCapabilities → unioned in (deduped)
+ *
+ * Runs in the node ("server") vitest project; the `.svelte.ts` module is
+ * compiled by the Svelte plugin, so its runes work here (same pattern as
+ * lib/setup/setup-state.vitest.ts).
+ */
+import { afterEach, beforeEach, describe, expect, test } from 'vitest';
+import type { RequestEvent } from '@sveltejs/kit';
+import type { Capability, ClientContext } from '$lib/types.js';
+import { hasCapability, resolveCapabilities, runtimeContext } from './runtime-context.svelte.js';
+import { computeServerRuntimeContext } from '$lib/server/features.js';
+
+// ── fixtures ─────────────────────────────────────────────────────────────────
+
+/** Order-insensitive comparison helper — the plan fixes membership, not order. */
+function sorted(caps: Capability[]): Capability[] {
+  return [...caps].sort();
+}
+
+const electron: ClientContext = { displayMode: 'electron' };
+const browser: ClientContext = { displayMode: 'browser' };
+const standalonePwa: ClientContext = { displayMode: 'standalone-pwa' };
+
+const HOST_CAPS: Capability[] = [
+  'host:setup',
+  'host:stack:read',
+  'host:stack:write',
+  'host:containers',
+  'host:addons',
+  'host:updates',
+  'host:logs',
+  'host:secrets',
+  'host:recovery',
+  'host:akm-sharing',
+];
+
+/** Server capabilities of a host-capable process (electron-host / host-ui). */
+const HOST_SERVER_CAPS: Capability[] = [
+  'chat',
+  'connections:read',
+  'connections:manage',
+  'connections:switch',
+  'assistant-settings:read',
+  'assistant-settings:write',
+  ...HOST_CAPS,
+];
+
+/** Server capabilities in assistant-container mode (single locked connection). */
+const ASSISTANT_CONTAINER_CAPS: Capability[] = [
+  'connections:single',
+  'chat',
+  'assistant-settings:read',
+  'assistant-settings:write',
+];
+
+/** The pwa-static baseline. */
+const PWA_BASELINE_CAPS: Capability[] = [
+  'chat',
+  'connections:read',
+  'connections:manage',
+  'connections:switch',
+  'pwa:install',
+];
+
+// ── resolveCapabilities — plan §6.2, exactly ─────────────────────────────────
+
+describe('resolveCapabilities — electron display mode', () => {
+  test('returns the server capabilities unchanged (ALL)', () => {
+    const result = resolveCapabilities(HOST_SERVER_CAPS, electron);
+    expect(sorted(result)).toEqual(sorted(HOST_SERVER_CAPS));
+  });
+
+  test('ignores connection-granted capabilities — electron already has everything', () => {
+    const result = resolveCapabilities(HOST_SERVER_CAPS, {
+      displayMode: 'electron',
+      activeConnection: {
+        kind: 'remote-opencode',
+        id: 'r1',
+        grantedCapabilities: ['pwa:install'],
+      },
+    });
+    expect(sorted(result)).toEqual(sorted(HOST_SERVER_CAPS));
+  });
+});
+
+describe('resolveCapabilities — host-capable server + browser (host-ui row)', () => {
+  test('host:stack:read + browser yields everything minus Electron-only caps (none reserved yet)', () => {
+    const result = resolveCapabilities(HOST_SERVER_CAPS, browser);
+    // isElectronOnlyCap() is reserved and returns false for every capability
+    // today, so "ALL minus Electron-only" is currently the full set.
+    expect(sorted(result)).toEqual(sorted(HOST_SERVER_CAPS));
+  });
+
+  test('a host-capable browser session does not union connection-granted caps', () => {
+    const result = resolveCapabilities(HOST_SERVER_CAPS, {
+      displayMode: 'browser',
+      activeConnection: {
+        kind: 'remote-opencode',
+        id: 'r1',
+        grantedCapabilities: ['pwa:install'],
+      },
+    });
+    expect(sorted(result)).toEqual(sorted(HOST_SERVER_CAPS));
+  });
+
+  test('host-capable server + standalone-pwa display falls back to connection management (plan §4.2)', () => {
+    const result = resolveCapabilities(HOST_SERVER_CAPS, standalonePwa);
+    expect(sorted(result)).toEqual(
+      sorted(['chat', 'connections:read', 'connections:manage', 'connections:switch']),
+    );
+  });
+});
+
+describe('resolveCapabilities — connections:single (assistant-container row)', () => {
+  test('browser display yields exactly chat + assistant-settings:*', () => {
+    const result = resolveCapabilities(ASSISTANT_CONTAINER_CAPS, browser);
+    expect(sorted(result)).toEqual(
+      sorted(['chat', 'assistant-settings:read', 'assistant-settings:write']),
+    );
+  });
+
+  test('standalone-pwa display yields the same set', () => {
+    const result = resolveCapabilities(ASSISTANT_CONTAINER_CAPS, standalonePwa);
+    expect(sorted(result)).toEqual(
+      sorted(['chat', 'assistant-settings:read', 'assistant-settings:write']),
+    );
+  });
+
+  test("the 'connections:single' marker itself is not an effective capability", () => {
+    const result = resolveCapabilities(ASSISTANT_CONTAINER_CAPS, browser);
+    expect(result).not.toContain('connections:single');
+  });
+});
+
+describe('resolveCapabilities — pwa-static baseline row', () => {
+  test('browser display keeps connections:* + chat + pwa:install', () => {
+    const result = resolveCapabilities(PWA_BASELINE_CAPS, browser);
+    expect(sorted(result)).toEqual(sorted(PWA_BASELINE_CAPS));
+  });
+
+  test('standalone-pwa display keeps the same baseline', () => {
+    const result = resolveCapabilities(PWA_BASELINE_CAPS, standalonePwa);
+    expect(sorted(result)).toEqual(sorted(PWA_BASELINE_CAPS));
+  });
+
+  test('non-baseline capabilities are filtered out unless connection-granted', () => {
+    const result = resolveCapabilities(
+      [...PWA_BASELINE_CAPS, 'assistant-settings:write'],
+      browser,
+    );
+    expect(result).not.toContain('assistant-settings:write');
+  });
+
+  test('activeConnection.grantedCapabilities are unioned in (plan §4.3 extension point)', () => {
+    const result = resolveCapabilities(PWA_BASELINE_CAPS, {
+      displayMode: 'standalone-pwa',
+      activeConnection: {
+        kind: 'remote-opencode',
+        id: 'r1',
+        grantedCapabilities: ['assistant-settings:read', 'assistant-settings:write'],
+      },
+    });
+    expect(result).toEqual(
+      expect.arrayContaining([
+        ...PWA_BASELINE_CAPS,
+        'assistant-settings:read',
+        'assistant-settings:write',
+      ]),
+    );
+  });
+
+  test('granted capabilities are deduplicated against the baseline', () => {
+    const result = resolveCapabilities(PWA_BASELINE_CAPS, {
+      displayMode: 'browser',
+      activeConnection: {
+        kind: 'remote-opencode',
+        id: 'r1',
+        grantedCapabilities: ['chat', 'assistant-settings:read'],
+      },
+    });
+    expect(new Set(result).size).toBe(result.length);
+    expect(sorted(result)).toEqual(sorted([...PWA_BASELINE_CAPS, 'assistant-settings:read']));
+  });
+});
+
+// ── hasCapability + runtimeContext store ─────────────────────────────────────
+
+describe('hasCapability — reads the reactive runtimeContext store', () => {
+  let before: Capability[];
+
+  beforeEach(() => {
+    before = runtimeContext.effectiveCapabilities;
+  });
+
+  afterEach(() => {
+    runtimeContext.effectiveCapabilities = before;
+  });
+
+  test('runtimeContext exposes an effectiveCapabilities array', () => {
+    expect(Array.isArray(runtimeContext.effectiveCapabilities)).toBe(true);
+  });
+
+  test('true for a capability present in effectiveCapabilities', () => {
+    runtimeContext.effectiveCapabilities = ['chat', 'connections:read'];
+    expect(hasCapability('chat')).toBe(true);
+    expect(hasCapability('connections:read')).toBe(true);
+  });
+
+  test('false for a capability absent from effectiveCapabilities', () => {
+    runtimeContext.effectiveCapabilities = ['chat'];
+    expect(hasCapability('host:setup')).toBe(false);
+    expect(hasCapability('connections:manage')).toBe(false);
+  });
+});
+
+// ── integration: computeServerRuntimeContext × resolveCapabilities ───────────
+// Pins the four rows of the plan §4.3 matrix end-to-end through the real
+// env → hostMode → serverCapabilities → effectiveCapabilities pipeline.
+
+describe('capability matrix — plan §4.3 rows end-to-end', () => {
+  const MODE_ENV_KEYS = ['OP_UI_HOST_MODE', 'OP_INSIDE_ELECTRON', 'OP_ENABLE_ADMIN'] as const;
+  let savedEnv: Record<string, string | undefined> = {};
+
+  function makeEvent(url = 'http://127.0.0.1:3880/'): RequestEvent {
+    const u = new URL(url);
+    return {
+      url: u,
+      request: new Request(u, { headers: { host: u.host } }),
+      params: {},
+      locals: {},
+      route: { id: '/' },
+      getClientAddress: () => '127.0.0.1',
+      isDataRequest: false,
+      isSubRequest: false,
+    } as unknown as RequestEvent;
+  }
+
+  beforeEach(() => {
+    savedEnv = {};
+    for (const key of MODE_ENV_KEYS) {
+      savedEnv[key] = process.env[key];
+      delete process.env[key];
+    }
+  });
+
+  afterEach(() => {
+    for (const key of MODE_ENV_KEYS) {
+      const prev = savedEnv[key];
+      if (prev === undefined) delete process.env[key];
+      else process.env[key] = prev;
+    }
+  });
+
+  test('electron-host × electron → ALL', () => {
+    process.env.OP_INSIDE_ELECTRON = '1';
+    const ctx = computeServerRuntimeContext(makeEvent());
+    const effective = resolveCapabilities(ctx.serverCapabilities, electron);
+    expect(sorted(effective)).toEqual(sorted(ctx.serverCapabilities));
+    expect(effective).toEqual(
+      expect.arrayContaining(['chat', 'connections:manage', 'host:setup', 'host:stack:write']),
+    );
+  });
+
+  test('host-ui × browser → ALL minus Electron-only', () => {
+    process.env.OP_ENABLE_ADMIN = '1';
+    const ctx = computeServerRuntimeContext(makeEvent());
+    const effective = resolveCapabilities(ctx.serverCapabilities, browser);
+    expect(effective).toEqual(
+      expect.arrayContaining(['chat', 'connections:manage', 'host:stack:read', 'host:stack:write']),
+    );
+  });
+
+  test('assistant-container × browser → chat + assistant-settings only', () => {
+    process.env.OP_UI_HOST_MODE = 'assistant-container';
+    const ctx = computeServerRuntimeContext(makeEvent());
+    const effective = resolveCapabilities(ctx.serverCapabilities, browser);
+    expect(sorted(effective)).toEqual(
+      sorted(['chat', 'assistant-settings:read', 'assistant-settings:write']),
+    );
+    for (const cap of HOST_CAPS) expect(effective).not.toContain(cap);
+    expect(effective).not.toContain('connections:manage');
+  });
+
+  test('pwa-static × standalone-pwa → connections + chat + pwa:install', () => {
+    process.env.OP_UI_HOST_MODE = 'pwa-static';
+    const ctx = computeServerRuntimeContext(makeEvent());
+    const effective = resolveCapabilities(ctx.serverCapabilities, standalonePwa);
+    expect(effective).toEqual(
+      expect.arrayContaining(['connections:manage', 'connections:switch', 'chat', 'pwa:install']),
+    );
+    for (const cap of HOST_CAPS) expect(effective).not.toContain(cap);
+    expect(effective).not.toContain('assistant-settings:write');
+  });
+});
diff --git a/packages/ui/src/lib/server/features.vitest.ts b/packages/ui/src/lib/server/features.vitest.ts
new file mode 100644
index 000000000..34a7811fc
--- /dev/null
+++ b/packages/ui/src/lib/server/features.vitest.ts
@@ -0,0 +1,240 @@
+/**
+ * Tests for lib/server/features.ts — Phase 1 RuntimeContext v2 (issue #509).
+ *
+ * TDD status:
+ *  - `computeServerRuntimeContext(event)` describes the NOT-YET-IMPLEMENTED
+ *    replacement for `FeatureFlags` (plan §6.1 / Phase 1). Those tests are RED
+ *    until the implementation lands.
+ *  - `computeFeatureFlags` tests are CHARACTERIZATION of the existing
+ *    `features.admin` behavior. They pass pre-change and MUST keep passing:
+ *    Phase 1 keeps `features.admin` as a derived alias so existing code and
+ *    routes work unchanged.
+ *
+ * env → hostMode mapping under test (plan Phase 1):
+ *   OP_UI_HOST_MODE (explicit) → that mode
+ *   else OP_INSIDE_ELECTRON=1  → 'electron-host'
+ *   else OP_ENABLE_ADMIN=1     → 'host-ui'
+ *   else                       → 'pwa-static' baseline
+ */
+import { afterEach, beforeEach, describe, expect, test } from 'vitest';
+import type { RequestEvent } from '@sveltejs/kit';
+import type { Capability, UiHostMode } from '$lib/types.js';
+import { computeFeatureFlags, computeServerRuntimeContext } from './features.js';
+
+// ── helpers ──────────────────────────────────────────────────────────────────
+
+function makeEvent(url = 'http://127.0.0.1:3880/'): RequestEvent {
+  const u = new URL(url);
+  return {
+    url: u,
+    request: new Request(u, { headers: { host: u.host } }),
+    params: {},
+    locals: {},
+    route: { id: '/' },
+    getClientAddress: () => '127.0.0.1',
+    isDataRequest: false,
+    isSubRequest: false,
+  } as unknown as RequestEvent;
+}
+
+/** The full host:* capability set from plan §6.1. */
+const HOST_CAPS: Capability[] = [
+  'host:setup',
+  'host:stack:read',
+  'host:stack:write',
+  'host:containers',
+  'host:addons',
+  'host:updates',
+  'host:logs',
+  'host:secrets',
+  'host:recovery',
+  'host:akm-sharing',
+];
+
+const MODE_ENV_KEYS = ['OP_UI_HOST_MODE', 'OP_INSIDE_ELECTRON', 'OP_ENABLE_ADMIN'] as const;
+let savedEnv: Record<string, string | undefined> = {};
+
+beforeEach(() => {
+  savedEnv = {};
+  for (const key of MODE_ENV_KEYS) {
+    savedEnv[key] = process.env[key];
+    delete process.env[key];
+  }
+});
+
+afterEach(() => {
+  for (const key of MODE_ENV_KEYS) {
+    const prev = savedEnv[key];
+    if (prev === undefined) delete process.env[key];
+    else process.env[key] = prev;
+  }
+});
+
+// ── env → hostMode mapping (RED until #509 lands) ────────────────────────────
+
+describe('computeServerRuntimeContext — env → hostMode mapping (plan §6.1)', () => {
+  const explicitModes: UiHostMode[] = [
+    'electron-host',
+    'host-ui',
+    'assistant-container',
+    'pwa-static',
+  ];
+
+  for (const mode of explicitModes) {
+    test(`OP_UI_HOST_MODE=${mode} maps to hostMode '${mode}'`, () => {
+      process.env.OP_UI_HOST_MODE = mode;
+      const ctx = computeServerRuntimeContext(makeEvent());
+      expect(ctx.hostMode).toBe(mode);
+    });
+  }
+
+  test("falls back to 'electron-host' when OP_INSIDE_ELECTRON=1 (legacy env)", () => {
+    process.env.OP_INSIDE_ELECTRON = '1';
+    expect(computeServerRuntimeContext(makeEvent()).hostMode).toBe('electron-host');
+  });
+
+  test("falls back to 'host-ui' when OP_ENABLE_ADMIN=1 (legacy env)", () => {
+    process.env.OP_ENABLE_ADMIN = '1';
+    expect(computeServerRuntimeContext(makeEvent()).hostMode).toBe('host-ui');
+  });
+
+  test('OP_INSIDE_ELECTRON wins over OP_ENABLE_ADMIN when both are set', () => {
+    process.env.OP_INSIDE_ELECTRON = '1';
+    process.env.OP_ENABLE_ADMIN = '1';
+    expect(computeServerRuntimeContext(makeEvent()).hostMode).toBe('electron-host');
+  });
+
+  test('OP_UI_HOST_MODE takes precedence over the legacy env fallbacks', () => {
+    process.env.OP_UI_HOST_MODE = 'pwa-static';
+    process.env.OP_INSIDE_ELECTRON = '1';
+    process.env.OP_ENABLE_ADMIN = '1';
+    expect(computeServerRuntimeContext(makeEvent()).hostMode).toBe('pwa-static');
+  });
+
+  test("defaults to the 'pwa-static' baseline when no mode env is set", () => {
+    expect(computeServerRuntimeContext(makeEvent()).hostMode).toBe('pwa-static');
+  });
+});
+
+// ── contract shape (RED until #509 lands) ────────────────────────────────────
+
+describe('computeServerRuntimeContext — ServerRuntimeContext shape (plan §6.1)', () => {
+  test('carries contract version 2', () => {
+    const ctx = computeServerRuntimeContext(makeEvent());
+    expect(ctx.version).toBe(2);
+  });
+
+  test('exposes the full contract shape', () => {
+    const ctx = computeServerRuntimeContext(makeEvent());
+    expect(Array.isArray(ctx.serverCapabilities)).toBe(true);
+    expect(typeof ctx.publicBaseUrl).toBe('string');
+    expect(typeof ctx.uiVersion).toBe('string');
+    expect(typeof ctx.skeletonVersion).toBe('string');
+    expect(ctx.routes).toBeTypeOf('object');
+    expect(typeof ctx.security.hostAdminLoopbackOnly).toBe('boolean');
+    expect(typeof ctx.security.requiresHttpsForRemoteConnections).toBe('boolean');
+    expect(['loopback-origin', 'same-site', 'bearer-token']).toContain(ctx.security.csrfMode);
+  });
+
+  test("activeConnectionMode is 'single' in assistant-container mode", () => {
+    process.env.OP_UI_HOST_MODE = 'assistant-container';
+    expect(computeServerRuntimeContext(makeEvent()).activeConnectionMode).toBe('single');
+  });
+
+  test("activeConnectionMode is 'multi' in electron-host mode", () => {
+    process.env.OP_INSIDE_ELECTRON = '1';
+    expect(computeServerRuntimeContext(makeEvent()).activeConnectionMode).toBe('multi');
+  });
+
+  test('host admin stays loopback-only in host-capable modes (plan §8.3)', () => {
+    process.env.OP_INSIDE_ELECTRON = '1';
+    expect(computeServerRuntimeContext(makeEvent()).security.hostAdminLoopbackOnly).toBe(true);
+    delete process.env.OP_INSIDE_ELECTRON;
+    process.env.OP_ENABLE_ADMIN = '1';
+    expect(computeServerRuntimeContext(makeEvent()).security.hostAdminLoopbackOnly).toBe(true);
+  });
+});
+
+// ── serverCapabilities per hostMode (RED until #509 lands) ───────────────────
+
+describe('computeServerRuntimeContext — serverCapabilities per hostMode (plan §4)', () => {
+  test('electron-host: all host, connection and assistant-settings capabilities', () => {
+    process.env.OP_INSIDE_ELECTRON = '1';
+    const caps = computeServerRuntimeContext(makeEvent()).serverCapabilities;
+    expect(caps).toEqual(
+      expect.arrayContaining([
+        'chat',
+        'connections:read',
+        'connections:manage',
+        'connections:switch',
+        'assistant-settings:read',
+        'assistant-settings:write',
+        ...HOST_CAPS,
+      ]),
+    );
+    // 'connections:single' is the assistant-container marker (plan §6.2) —
+    // multi-connection host modes must not carry it.
+    expect(caps).not.toContain('connections:single');
+  });
+
+  test("host-ui: same host capability set — 'host:stack:read' is load-bearing for resolveCapabilities' browser branch", () => {
+    process.env.OP_ENABLE_ADMIN = '1';
+    const caps = computeServerRuntimeContext(makeEvent()).serverCapabilities;
+    expect(caps).toEqual(
+      expect.arrayContaining(['chat', 'host:stack:read', 'host:stack:write', ...HOST_CAPS]),
+    );
+    expect(caps).not.toContain('connections:single');
+  });
+
+  test('assistant-container: connections:single + chat + assistant settings, no host or connection management', () => {
+    process.env.OP_UI_HOST_MODE = 'assistant-container';
+    const caps = computeServerRuntimeContext(makeEvent()).serverCapabilities;
+    expect(caps).toEqual(
+      expect.arrayContaining([
+        'connections:single',
+        'chat',
+        'assistant-settings:read',
+        'assistant-settings:write',
+      ]),
+    );
+    for (const hostCap of HOST_CAPS) expect(caps).not.toContain(hostCap);
+    expect(caps).not.toContain('connections:manage');
+  });
+
+  test('pwa-static baseline: connections + chat + pwa:install, nothing privileged', () => {
+    const caps = computeServerRuntimeContext(makeEvent()).serverCapabilities;
+    expect(caps).toEqual(
+      expect.arrayContaining([
+        'chat',
+        'connections:read',
+        'connections:manage',
+        'connections:switch',
+        'pwa:install',
+      ]),
+    );
+    for (const hostCap of HOST_CAPS) expect(caps).not.toContain(hostCap);
+    expect(caps).not.toContain('connections:single');
+    expect(caps).not.toContain('assistant-settings:write');
+  });
+});
+
+// ── features.admin alias (CHARACTERIZATION — green pre-change) ───────────────
+// Phase 1 keeps `features.admin` as a derived alias; these pin the legacy
+// env behavior that existing code and routes rely on. Do NOT delete when the
+// implementation lands — they must stay green.
+
+describe('computeFeatureFlags — features.admin alias (characterization)', () => {
+  test('admin is true under OP_INSIDE_ELECTRON=1', () => {
+    process.env.OP_INSIDE_ELECTRON = '1';
+    expect(computeFeatureFlags().admin).toBe(true);
+  });
+
+  test('admin is true under OP_ENABLE_ADMIN=1', () => {
+    process.env.OP_ENABLE_ADMIN = '1';
+    expect(computeFeatureFlags().admin).toBe(true);
+  });
+
+  test('admin is false when neither legacy env is set', () => {
+    expect(computeFeatureFlags().admin).toBe(false);
+  });
+});
diff --git a/packages/ui/src/routes/api/runtime/server.vitest.ts b/packages/ui/src/routes/api/runtime/server.vitest.ts
new file mode 100644
index 000000000..920fb33a5
--- /dev/null
+++ b/packages/ui/src/routes/api/runtime/server.vitest.ts
@@ -0,0 +1,101 @@
+/**
+ * Tests for GET /api/runtime — Phase 1 RuntimeContext v2 (issue #509).
+ *
+ * ALL RED until the implementation lands: routes/api/runtime/+server.ts does
+ * not exist yet.
+ *
+ * Per plan §6.4 this endpoint is PUBLIC (no auth) and returns the
+ * ServerRuntimeContext, including the contract version field that the future
+ * hosted client uses as a version-skew handshake before enabling features.
+ *
+ * Asserts:
+ *  - 200 with no session cookie (public — unlike every /admin/* endpoint)
+ *  - 200 with a garbage session cookie (auth is never consulted)
+ *  - JSON body carrying version: 2 and the full ServerRuntimeContext shape
+ *  - hostMode reflects the env mapping (OP_INSIDE_ELECTRON / baseline)
+ */
+import { afterEach, beforeEach, describe, expect, test } from 'vitest';
+import { GET } from './+server.js';
+
+function makeEvent(headers: Record<string, string> = {}) {
+  const url = new URL('http://127.0.0.1:3880/api/runtime');
+  return {
+    url,
+    request: new Request(url, { headers }),
+    params: {},
+    locals: {},
+    route: { id: '/api/runtime' },
+    getClientAddress: () => '127.0.0.1',
+    isDataRequest: false,
+    isSubRequest: false,
+  } as unknown as Parameters<typeof GET>[0];
+}
+
+const MODE_ENV_KEYS = ['OP_UI_HOST_MODE', 'OP_INSIDE_ELECTRON', 'OP_ENABLE_ADMIN'] as const;
+let savedEnv: Record<string, string | undefined> = {};
+
+beforeEach(() => {
+  savedEnv = {};
+  for (const key of MODE_ENV_KEYS) {
+    savedEnv[key] = process.env[key];
+    delete process.env[key];
+  }
+});
+
+afterEach(() => {
+  for (const key of MODE_ENV_KEYS) {
+    const prev = savedEnv[key];
+    if (prev === undefined) delete process.env[key];
+    else process.env[key] = prev;
+  }
+});
+
+describe('GET /api/runtime — public runtime-context endpoint (plan §6.4)', () => {
+  test('returns 200 with no session cookie (no auth required)', async () => {
+    const res = await GET(makeEvent());
+    expect(res.status).toBe(200);
+  });
+
+  test('returns 200 with a garbage session cookie (auth is never consulted)', async () => {
+    const res = await GET(makeEvent({ cookie: 'op_session=not-a-real-token' }));
+    expect(res.status).toBe(200);
+  });
+
+  test('responds with JSON', async () => {
+    const res = await GET(makeEvent());
+    expect(res.headers.get('content-type') ?? '').toContain('application/json');
+  });
+
+  test('body carries the contract version (2) for the hosted-client handshake', async () => {
+    const res = await GET(makeEvent());
+    const body = (await res.json()) as Record<string, unknown>;
+    expect(body.version).toBe(2);
+  });
+
+  test('body exposes the ServerRuntimeContext shape (plan §6.1)', async () => {
+    const res = await GET(makeEvent());
+    const body = (await res.json()) as Record<string, unknown>;
+    expect(Array.isArray(body.serverCapabilities)).toBe(true);
+    expect(body.serverCapabilities).toContain('chat');
+    expect(typeof body.hostMode).toBe('string');
+    expect(typeof body.publicBaseUrl).toBe('string');
+    expect(typeof body.uiVersion).toBe('string');
+    expect(typeof body.skeletonVersion).toBe('string');
+    expect(['single', 'multi']).toContain(body.activeConnectionMode);
+    expect(body.routes).toBeTypeOf('object');
+    expect(body.security).toBeTypeOf('object');
+  });
+
+  test("hostMode reflects OP_INSIDE_ELECTRON=1 → 'electron-host'", async () => {
+    process.env.OP_INSIDE_ELECTRON = '1';
+    const res = await GET(makeEvent());
+    const body = (await res.json()) as Record<string, unknown>;
+    expect(body.hostMode).toBe('electron-host');
+  });
+
+  test("hostMode is the 'pwa-static' baseline when no mode env is set", async () => {
+    const res = await GET(makeEvent());
+    const body = (await res.json()) as Record<string, unknown>;
+    expect(body.hostMode).toBe('pwa-static');
+  });
+});
diff --git a/packages/ui/src/routes/layout.server.vitest.ts b/packages/ui/src/routes/layout.server.vitest.ts
new file mode 100644
index 000000000..6b0618376
--- /dev/null
+++ b/packages/ui/src/routes/layout.server.vitest.ts
@@ -0,0 +1,97 @@
+/**
+ * Tests for routes/+layout.server.ts — Phase 1 RuntimeContext v2 (issue #509).
+ *
+ * TDD status:
+ *  - The `features.admin` tests are CHARACTERIZATION: they pass pre-change and
+ *    MUST keep passing — Phase 1 keeps `features.admin` as a derived alias so
+ *    all existing code and routes work unchanged (zero behavior change).
+ *  - The `serverRuntimeContext` tests are RED until #509 lands: the layout
+ *    load must additionally return the ServerRuntimeContext computed by
+ *    computeServerRuntimeContext(event) (plan Phase 1 step 3).
+ */
+import { afterEach, beforeEach, describe, expect, test } from 'vitest';
+import type { ServerRuntimeContext } from '$lib/types.js';
+import { load } from './+layout.server.js';
+
+function makeEvent(url = 'http://127.0.0.1:3880/') {
+  const u = new URL(url);
+  return {
+    url: u,
+    request: new Request(u, { headers: { host: u.host } }),
+    params: {},
+    locals: {},
+    route: { id: '/' },
+    getClientAddress: () => '127.0.0.1',
+    isDataRequest: false,
+    isSubRequest: false,
+  } as unknown as Parameters<typeof load>[0];
+}
+
+async function runLoad(): Promise<Record<string, unknown>> {
+  return (await load(makeEvent())) as unknown as Record<string, unknown>;
+}
+
+const MODE_ENV_KEYS = ['OP_UI_HOST_MODE', 'OP_INSIDE_ELECTRON', 'OP_ENABLE_ADMIN'] as const;
+let savedEnv: Record<string, string | undefined> = {};
+
+beforeEach(() => {
+  savedEnv = {};
+  for (const key of MODE_ENV_KEYS) {
+    savedEnv[key] = process.env[key];
+    delete process.env[key];
+  }
+});
+
+afterEach(() => {
+  for (const key of MODE_ENV_KEYS) {
+    const prev = savedEnv[key];
+    if (prev === undefined) delete process.env[key];
+    else process.env[key] = prev;
+  }
+});
+
+// ── features.admin alias (CHARACTERIZATION — green pre-change) ───────────────
+
+describe('+layout.server load — features.admin alias (characterization)', () => {
+  test('features.admin is true under OP_INSIDE_ELECTRON=1', async () => {
+    process.env.OP_INSIDE_ELECTRON = '1';
+    const data = await runLoad();
+    expect((data.features as { admin: boolean }).admin).toBe(true);
+  });
+
+  test('features.admin is true under OP_ENABLE_ADMIN=1', async () => {
+    process.env.OP_ENABLE_ADMIN = '1';
+    const data = await runLoad();
+    expect((data.features as { admin: boolean }).admin).toBe(true);
+  });
+
+  test('features.admin is false when neither legacy env is set', async () => {
+    const data = await runLoad();
+    expect((data.features as { admin: boolean }).admin).toBe(false);
+  });
+});
+
+// ── serverRuntimeContext (RED until #509 lands) ──────────────────────────────
+
+describe('+layout.server load — serverRuntimeContext (plan Phase 1)', () => {
+  test('layout data includes serverRuntimeContext with contract version 2', async () => {
+    const data = await runLoad();
+    const ctx = data.serverRuntimeContext as ServerRuntimeContext | undefined;
+    expect(ctx, 'load() must return serverRuntimeContext').toBeDefined();
+    expect(ctx?.version).toBe(2);
+  });
+
+  test("serverRuntimeContext.hostMode maps OP_INSIDE_ELECTRON=1 → 'electron-host'", async () => {
+    process.env.OP_INSIDE_ELECTRON = '1';
+    const data = await runLoad();
+    const ctx = data.serverRuntimeContext as ServerRuntimeContext | undefined;
+    expect(ctx?.hostMode).toBe('electron-host');
+  });
+
+  test("serverRuntimeContext.hostMode maps OP_ENABLE_ADMIN=1 → 'host-ui'", async () => {
+    process.env.OP_ENABLE_ADMIN = '1';
+    const data = await runLoad();
+    const ctx = data.serverRuntimeContext as ServerRuntimeContext | undefined;
+    expect(ctx?.hostMode).toBe('host-ui');
+  });
+});

From 71f1686b646cac8ed76cdfeeb47d32a593048060 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Mon, 6 Jul 2026 06:53:03 +0000
Subject: [PATCH 04/61] =?UTF-8?q?feat(ui):=20RuntimeContext=20v2=20?=
 =?UTF-8?q?=E2=80=94=20server=20context,=20capabilities,=20/api/runtime=20?=
 =?UTF-8?q?(#509)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Phase 1 of the ui-runtime-modes plan (docs/technical/ui-runtime-modes-plan.md
§6.1-§6.4): replace the single features.admin boolean with a capability-based
ServerRuntimeContext while keeping zero behavior change for existing routes.

- lib/types.ts: UiHostMode, Capability, ServerRuntimeContext (contract
  version 2), ClientDisplayMode, ConnectionKind, ActiveConnectionContext,
  ClientContext, RuntimeContext per plan §6.1. FeatureFlags kept as the
  documented derived alias.
- lib/server/features.ts: computeServerRuntimeContext(event). hostMode
  resolution: OP_UI_HOST_MODE (explicit) > OP_INSIDE_ELECTRON=1 →
  electron-host > OP_ENABLE_ADMIN=1 → host-ui > pwa-static baseline.
  Per-mode serverCapabilities (host modes carry host:*, never
  connections:single; assistant-container is connections:single + chat +
  assistant-settings:*; pwa-static is connections:* + chat + pwa:install).
  computeFeatureFlags() is now derived from hostMode — identical results
  for every env combination in use today.
- lib/runtime-context.svelte.ts: resolveCapabilities(serverCaps, clientCtx)
  verbatim per plan §6.2 — the ONLY place capability logic lives — plus the
  reactive runtimeContext store, hasCapability(cap) (UX only; APIs enforce
  capabilities server-side), and initializeRuntimeContext().
- lib/client-context.ts: detectClientDisplayMode() per plan §6.3,
  browser-side only.
- routes/+layout.server.ts: returns serverRuntimeContext alongside the
  features alias. routes/+layout.svelte: initializes the client context in
  onMount (client-only — never server-computed, and never mutating the
  module-level store during SSR) and derives effectiveCapabilities.
- routes/api/runtime/+server.ts: public GET (no auth) returning the
  ServerRuntimeContext — the contract-version handshake for future
  hosted clients.

Turns the 21-test red suite from 483b4bf green without modifying it; the 6
characterization tests (features.admin alias) stay green. Verified against a
live dev server: /api/runtime returns 200 with no/garbage session cookie in
pwa-static and host-ui modes; / and /login routing unchanged.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FetR7BttT1xBrA8fBwhui9
---
 packages/ui/src/lib/client-context.ts         |  14 ++
 packages/ui/src/lib/runtime-context.svelte.ts |  98 ++++++++++++
 packages/ui/src/lib/server/features.ts        | 149 ++++++++++++++++--
 packages/ui/src/lib/types.ts                  |  81 +++++++++-
 packages/ui/src/routes/+layout.server.ts      |   7 +-
 packages/ui/src/routes/+layout.svelte         |  12 ++
 packages/ui/src/routes/api/runtime/+server.ts |  16 ++
 7 files changed, 364 insertions(+), 13 deletions(-)
 create mode 100644 packages/ui/src/lib/client-context.ts
 create mode 100644 packages/ui/src/lib/runtime-context.svelte.ts
 create mode 100644 packages/ui/src/routes/api/runtime/+server.ts

diff --git a/packages/ui/src/lib/client-context.ts b/packages/ui/src/lib/client-context.ts
new file mode 100644
index 000000000..31e760663
--- /dev/null
+++ b/packages/ui/src/lib/client-context.ts
@@ -0,0 +1,14 @@
+/**
+ * Client display-mode detection — plan ui-runtime-modes-plan.md §6.3
+ * (issue #509). Browser-side ONLY: initialized in +layout.svelte, never
+ * server-computed. On the server (no `navigator`/`window`) it returns the
+ * 'browser' default.
+ */
+import type { ClientDisplayMode } from '$lib/types.js';
+
+export function detectClientDisplayMode(): ClientDisplayMode {
+  if (typeof navigator !== 'undefined' && /Electron/.test(navigator.userAgent)) return 'electron';
+  if (typeof window !== 'undefined' && window.matchMedia('(display-mode: standalone)').matches)
+    return 'standalone-pwa';
+  return 'browser';
+}
diff --git a/packages/ui/src/lib/runtime-context.svelte.ts b/packages/ui/src/lib/runtime-context.svelte.ts
new file mode 100644
index 000000000..7365c7fdc
--- /dev/null
+++ b/packages/ui/src/lib/runtime-context.svelte.ts
@@ -0,0 +1,98 @@
+/**
+ * Runtime context — RuntimeContext v2 (plan ui-runtime-modes-plan.md §6.2,
+ * issue #509).
+ *
+ * This module is the ONLY place capability logic lives. Components call
+ * `hasCapability(cap)` and nothing else — no scattered `if (features.admin)`
+ * checks (plan §8.6). `hasCapability()` is UX only; APIs enforce capabilities
+ * server-side (plan §8.5).
+ *
+ * The `runtimeContext` store is populated by +layout.svelte from the layout
+ * server data (ServerRuntimeContext) plus the browser-detected ClientContext,
+ * and `effectiveCapabilities` is re-derived on every change.
+ */
+import type {
+  Capability,
+  ClientContext,
+  RuntimeContext,
+  ServerRuntimeContext,
+} from '$lib/types.js';
+
+export function resolveCapabilities(
+  serverCaps: Capability[],
+  clientCtx: ClientContext,
+): Capability[] {
+  const { displayMode, activeConnection } = clientCtx;
+
+  if (displayMode === 'electron') return serverCaps;
+
+  if (serverCaps.includes('host:stack:read') && displayMode === 'browser') {
+    return serverCaps.filter((c) => !isElectronOnlyCap(c));
+  }
+
+  if (serverCaps.includes('connections:single')) {
+    // assistant-container: chat + assistant settings
+    return serverCaps.filter((c) => c === 'chat' || c.startsWith('assistant-settings'));
+  }
+
+  // pwa-static: connections + chat
+  let caps = serverCaps.filter(
+    (c) => c.startsWith('connections') || c === 'chat' || c === 'pwa:install',
+  );
+
+  // Extension point: active connection may grant additional capabilities
+  if (activeConnection?.grantedCapabilities) {
+    // eslint-disable-next-line svelte/prefer-svelte-reactivity -- transient dedupe helper inside a pure function, never held as reactive state
+    caps = [...new Set([...caps, ...activeConnection.grantedCapabilities])];
+  }
+
+  return caps;
+}
+
+// eslint-disable-next-line @typescript-eslint/no-unused-vars -- signature fixed by plan §6.2; the parameter is consulted once Electron IPC-dependent capabilities exist
+function isElectronOnlyCap(_c: Capability): boolean {
+  return false; // reserved for future Electron IPC-dependent features
+}
+
+/**
+ * Reactive runtime context. Starts at the unprivileged pwa-static baseline
+ * with zero capabilities until +layout.svelte initializes it — capabilities
+ * are opted INTO from server data, never defaulted on.
+ */
+export const runtimeContext = $state<RuntimeContext>({
+  version: 2,
+  hostMode: 'pwa-static',
+  serverCapabilities: [],
+  publicBaseUrl: '',
+  uiVersion: '',
+  skeletonVersion: '',
+  activeConnectionMode: 'multi',
+  routes: {},
+  security: {
+    hostAdminLoopbackOnly: true,
+    requiresHttpsForRemoteConnections: true,
+    csrfMode: 'loopback-origin',
+  },
+  clientContext: { displayMode: 'browser' },
+  effectiveCapabilities: [],
+});
+
+export function hasCapability(cap: Capability): boolean {
+  return runtimeContext.effectiveCapabilities.includes(cap);
+}
+
+/**
+ * Populate the store from layout data + browser-detected client context and
+ * re-derive `effectiveCapabilities`. Called from +layout.svelte (client-only).
+ */
+export function initializeRuntimeContext(
+  serverCtx: ServerRuntimeContext,
+  clientCtx: ClientContext,
+): void {
+  Object.assign(runtimeContext, serverCtx);
+  runtimeContext.clientContext = clientCtx;
+  runtimeContext.effectiveCapabilities = resolveCapabilities(
+    serverCtx.serverCapabilities,
+    clientCtx,
+  );
+}
diff --git a/packages/ui/src/lib/server/features.ts b/packages/ui/src/lib/server/features.ts
index 0614fc1a3..3861152a8 100644
--- a/packages/ui/src/lib/server/features.ts
+++ b/packages/ui/src/lib/server/features.ts
@@ -1,17 +1,148 @@
-import type { FeatureFlags } from '$lib/types.js';
+import type { RequestEvent } from '@sveltejs/kit';
+import { PLATFORM_VERSION } from '@openpalm/lib';
+import uiPkg from '../../../package.json';
+import type { Capability, FeatureFlags, ServerRuntimeContext, UiHostMode } from '$lib/types.js';
 
 /**
- * Compute feature flags from environment variables.
- * Called server-side on every request via +layout.server.ts.
+ * Server runtime context — RuntimeContext v2 (plan ui-runtime-modes-plan.md
+ * §6.1, issue #509). Computed server-side on every request via
+ * +layout.server.ts and served publicly at GET /api/runtime (the
+ * contract-version handshake for remote/hosted clients).
  *
- * admin: enabled when the UI is hosted inside the Electron harness
- * (OP_INSIDE_ELECTRON=1, injected by packages/electron/src/main.ts) or when
- * OP_ENABLE_ADMIN=1 is set explicitly (local dev / testing without Electron).
+ * hostMode resolution (Phase 1):
+ *   OP_UI_HOST_MODE (explicit) → that mode
+ *   else OP_INSIDE_ELECTRON=1  → 'electron-host' (legacy, injected by
+ *                                 packages/electron/src/main.ts)
+ *   else OP_ENABLE_ADMIN=1     → 'host-ui' (legacy, local dev / openpalm admin)
+ *   else                       → 'pwa-static' baseline
+ */
+
+const HOST_MODES: readonly UiHostMode[] = [
+  'electron-host',
+  'host-ui',
+  'assistant-container',
+  'pwa-static',
+];
+
+function isUiHostMode(value: string): value is UiHostMode {
+  return (HOST_MODES as readonly string[]).includes(value);
+}
+
+function resolveHostMode(): UiHostMode {
+  const explicit = process.env.OP_UI_HOST_MODE?.trim() ?? '';
+  if (isUiHostMode(explicit)) return explicit;
+  if (process.env.OP_INSIDE_ELECTRON === '1') return 'electron-host';
+  if (process.env.OP_ENABLE_ADMIN === '1') return 'host-ui';
+  return 'pwa-static';
+}
+
+/** The full host:* capability set (plan §6.1) — host-capable modes only. */
+const HOST_CAPABILITIES: readonly Capability[] = [
+  'host:setup',
+  'host:stack:read',
+  'host:stack:write',
+  'host:containers',
+  'host:addons',
+  'host:updates',
+  'host:logs',
+  'host:secrets',
+  'host:recovery',
+  'host:akm-sharing',
+];
+
+/** Capabilities of a host-capable process (electron-host / host-ui). Note:
+ *  never 'connections:single' — that marker is the assistant-container
+ *  branch key in resolveCapabilities() (plan §6.2). */
+const HOST_MODE_CAPABILITIES: readonly Capability[] = [
+  'chat',
+  'connections:read',
+  'connections:manage',
+  'connections:switch',
+  'assistant-settings:read',
+  'assistant-settings:write',
+  ...HOST_CAPABILITIES,
+];
+
+const SERVER_CAPABILITIES: Record<UiHostMode, readonly Capability[]> = {
+  'electron-host': HOST_MODE_CAPABILITIES,
+  'host-ui': HOST_MODE_CAPABILITIES,
+  // Single locked connection to the local OpenCode: chat + assistant settings,
+  // no host:* and no connection management.
+  'assistant-container': [
+    'connections:single',
+    'chat',
+    'assistant-settings:read',
+    'assistant-settings:write',
+  ],
+  // Baseline: connection management + chat (when connected) + PWA install.
+  'pwa-static': [
+    'chat',
+    'connections:read',
+    'connections:manage',
+    'connections:switch',
+    'pwa:install',
+  ],
+};
+
+/** Route pointers per mode — current-truth URLs (pre-Phase-3 route split).
+ *  Phase 2 moves connections to /connections; Phase 4 moves /admin to /host. */
+function routesForMode(mode: UiHostMode): ServerRuntimeContext['routes'] {
+  switch (mode) {
+    case 'electron-host':
+    case 'host-ui':
+      return {
+        chat: '/chat',
+        connections: '/admin/endpoints',
+        host: '/admin',
+        setup: '/setup',
+      };
+    case 'assistant-container':
+      return { chat: '/chat' };
+    case 'pwa-static':
+      return { chat: '/chat' };
+  }
+}
+
+export function computeServerRuntimeContext(event: RequestEvent): ServerRuntimeContext {
+  const hostMode = resolveHostMode();
+  const isHostCapable = hostMode === 'electron-host' || hostMode === 'host-ui';
+  return {
+    version: 2,
+    hostMode,
+    serverCapabilities: [...SERVER_CAPABILITIES[hostMode]],
+    publicBaseUrl: event.url.origin,
+    uiVersion: uiPkg.version,
+    // Skeleton version equals platform version in production (plan §8.2);
+    // OP_SKELETON_VERSION is the explicit exact-pin override (plan §3).
+    skeletonVersion: process.env.OP_SKELETON_VERSION?.trim() || PLATFORM_VERSION,
+    activeConnectionMode: hostMode === 'assistant-container' ? 'single' : 'multi',
+    routes: routesForMode(hostMode),
+    security: {
+      // Host admin is loopback-only and never weakened (plan §8.3).
+      hostAdminLoopbackOnly: true,
+      // Only browser-direct remote connections (the static client) need HTTPS;
+      // host modes proxy server-side (plan §6.10).
+      requiresHttpsForRemoteConnections: hostMode === 'pwa-static',
+      csrfMode: isHostCapable
+        ? 'loopback-origin'
+        : hostMode === 'assistant-container'
+          ? 'same-site'
+          : 'bearer-token',
+    },
+  };
+}
+
+/**
+ * Legacy feature flags — kept as a DERIVED ALIAS of the runtime context until
+ * the features.admin → hasCapability() migration completes (plan Phase 1).
+ *
+ * admin: true exactly when the resolved hostMode is host-capable, which
+ * preserves the pre-Phase-1 behavior (OP_INSIDE_ELECTRON=1 → electron-host,
+ * OP_ENABLE_ADMIN=1 → host-ui, both → admin).
  */
 export function computeFeatureFlags(): FeatureFlags {
+  const hostMode = resolveHostMode();
   return {
-    admin:
-      process.env.OP_INSIDE_ELECTRON === '1' ||
-      process.env.OP_ENABLE_ADMIN === '1',
+    admin: hostMode === 'electron-host' || hostMode === 'host-ui',
   };
 }
diff --git a/packages/ui/src/lib/types.ts b/packages/ui/src/lib/types.ts
index a99f148b9..dda57e3ae 100644
--- a/packages/ui/src/lib/types.ts
+++ b/packages/ui/src/lib/types.ts
@@ -2,11 +2,88 @@ import type { ToolStripEntry } from '$lib/chat/tool-strip.js';
 
 export interface FeatureFlags {
   /** Control-plane tools (Docker compose management, stack orchestration).
-   *  Enabled when running inside Electron (OP_INSIDE_ELECTRON=1) or
-   *  explicitly via OP_ENABLE_ADMIN=1 for local dev. Defaults to false. */
+   *  DERIVED ALIAS (plan ui-runtime-modes-plan.md Phase 1): true exactly when
+   *  the resolved hostMode is host-capable ('electron-host' | 'host-ui').
+   *  Legacy envs map in via computeServerRuntimeContext: OP_INSIDE_ELECTRON=1
+   *  → electron-host, OP_ENABLE_ADMIN=1 → host-ui. Kept until the
+   *  features.admin → hasCapability() migration completes. */
   admin: boolean;
 }
 
+// ── RuntimeContext v2 (plan §6.1, issue #509) ──────────────────────────
+
+export type UiHostMode =
+  | 'electron-host'
+  | 'host-ui'
+  | 'assistant-container'
+  | 'pwa-static';
+
+export type Capability =
+  | 'chat'
+  | 'connections:read'
+  | 'connections:manage'
+  | 'connections:switch'
+  | 'connections:single'
+  | 'assistant-settings:read'
+  | 'assistant-settings:write'
+  | 'host:setup'
+  | 'host:stack:read'
+  | 'host:stack:write'
+  | 'host:containers'
+  | 'host:addons'
+  | 'host:updates'
+  | 'host:logs'
+  | 'host:secrets'
+  | 'host:recovery'
+  | 'host:akm-sharing'
+  | 'pwa:install';
+
+export type ServerRuntimeContext = {
+  /** Contract version — the /api/runtime handshake for remote/hosted clients. */
+  version: 2;
+  hostMode: UiHostMode;
+  serverCapabilities: Capability[];
+  publicBaseUrl: string;
+  uiVersion: string;
+  skeletonVersion: string;
+  activeConnectionMode: 'single' | 'multi';
+  routes: {
+    chat?: string;
+    connections?: string;
+    assistantSettings?: string;
+    host?: string;
+    setup?: string;
+  };
+  security: {
+    hostAdminLoopbackOnly: boolean;
+    requiresHttpsForRemoteConnections: boolean;
+    csrfMode: 'loopback-origin' | 'same-site' | 'bearer-token';
+  };
+};
+
+export type ClientDisplayMode = 'electron' | 'standalone-pwa' | 'browser';
+
+/** Connection kinds (plan §6.6). `endpoints.json` is not renamed; the
+ *  internal model uses "connection" language. */
+export type ConnectionKind = 'local-opencode' | 'remote-opencode' | 'openpalm-client-api';
+
+export type ActiveConnectionContext = {
+  kind: ConnectionKind;
+  id: string;
+  /** Server-verified at connection-add time (plan §8.9) — never self-granted. */
+  grantedCapabilities?: Capability[];
+};
+
+export type ClientContext = {
+  displayMode: ClientDisplayMode;
+  activeConnection?: ActiveConnectionContext;
+};
+
+export type RuntimeContext = ServerRuntimeContext & {
+  clientContext: ClientContext;
+  effectiveCapabilities: Capability[];
+};
+
 export type { ToolStripEntry };
 
 export type HealthPayload = { status: string; service: string };
diff --git a/packages/ui/src/routes/+layout.server.ts b/packages/ui/src/routes/+layout.server.ts
index 5040f89db..a2cfdbd6e 100644
--- a/packages/ui/src/routes/+layout.server.ts
+++ b/packages/ui/src/routes/+layout.server.ts
@@ -1,8 +1,11 @@
 import type { LayoutServerLoad } from './$types';
-import { computeFeatureFlags } from '$lib/server/features.js';
+import { computeFeatureFlags, computeServerRuntimeContext } from '$lib/server/features.js';
 
-export const load: LayoutServerLoad = () => {
+export const load: LayoutServerLoad = (event) => {
   return {
+    // Derived alias — kept until the features.admin → hasCapability()
+    // migration completes (plan ui-runtime-modes-plan.md Phase 1).
     features: computeFeatureFlags(),
+    serverRuntimeContext: computeServerRuntimeContext(event),
   };
 };
diff --git a/packages/ui/src/routes/+layout.svelte b/packages/ui/src/routes/+layout.svelte
index daaba1cad..8be7df263 100644
--- a/packages/ui/src/routes/+layout.svelte
+++ b/packages/ui/src/routes/+layout.svelte
@@ -5,6 +5,8 @@
   import Toast from '$lib/components/common/Toast.svelte';
   import { themeService } from '$lib/theme-state.svelte.js';
   import { featuresService } from '$lib/features.svelte.js';
+  import { detectClientDisplayMode } from '$lib/client-context.js';
+  import { initializeRuntimeContext } from '$lib/runtime-context.svelte.js';
 
   interface Props {
     data: import('./$types').LayoutData;
@@ -19,6 +21,16 @@
 
   onMount(() => {
     themeService.init();
+    // Runtime context (plan ui-runtime-modes-plan.md Phase 1, #509): the
+    // client display mode is browser-detected — never server-computed — so it
+    // is initialized in onMount (client-only; also avoids mutating the
+    // module-level store during SSR, which is shared across requests). Like
+    // `features`, the server context is env-derived and constant at runtime,
+    // so a one-time init is correct; effectiveCapabilities is (re)derived
+    // inside initializeRuntimeContext.
+    initializeRuntimeContext(data.serverRuntimeContext, {
+      displayMode: detectClientDisplayMode(),
+    });
   });
 </script>
 
diff --git a/packages/ui/src/routes/api/runtime/+server.ts b/packages/ui/src/routes/api/runtime/+server.ts
new file mode 100644
index 000000000..b6d4cd2ce
--- /dev/null
+++ b/packages/ui/src/routes/api/runtime/+server.ts
@@ -0,0 +1,16 @@
+/**
+ * GET /api/runtime — public runtime-context endpoint (plan
+ * ui-runtime-modes-plan.md §6.4, issue #509).
+ *
+ * PUBLIC by design: no auth is consulted. The body is the ServerRuntimeContext
+ * whose `version` field is the contract-version handshake remote/hosted
+ * clients use to detect version skew before enabling features. It carries no
+ * secrets — mode, capability names, versions, and route pointers only.
+ */
+import { json } from '@sveltejs/kit';
+import { computeServerRuntimeContext } from '$lib/server/features.js';
+import type { RequestHandler } from './$types';
+
+export const GET: RequestHandler = (event) => {
+  return json(computeServerRuntimeContext(event));
+};

From 538393b38a2ecbd0846c8d3ad931fb31458bbd19 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Mon, 6 Jul 2026 07:23:58 +0000
Subject: [PATCH 05/61] test(phase-1.5): red tests for #556
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

TDD red suite for `openpalm admin` (host-ui mode; plan Phase 1.5, §4.1,
§8.3) in packages/cli/src/commands/admin.test.ts:

- Registration + help. RED: 2 tests — 'admin' missing from the main.ts
  subCommands map; `renderUsage(mainCommand)` COMMANDS table has no admin
  row.
- Serve mode, driven through the command via citty runCommand against a
  seeded temp OP_HOME (no module mocks: real lib + cli-state; fetch
  answers /health ready and fails registry pulls non-fatally; Bun.spawn
  captured so nothing real launches). RED: 3 tests, all failing with
  "Cannot find module .../src/commands/admin.ts":
  * spawned UI child env carries OP_ENABLE_ADMIN=1 + OP_UI_HOST_MODE=
    host-ui, binds 127.0.0.1 with pinned loopback ORIGIN, prints the URL,
    opens the browser by default;
  * loopback enforcement — OP_ALLOW_REMOTE_SETUP=1 is ignored (loopback
    HOST/ORIGIN, no HOST_HEADER/PROTOCOL_HEADER) and neutralized in the
    child env (isRemoteSetupAllowed(childEnv) === false) so the respawned
    `openpalm ui` child and the UI's remote-setup relaxations cannot
    re-derive a remote bind; --no-open spawns no opener;
  * with an empty OP_HOME (not installed) the command still serves the
    admin-enabled UI — the UI's existing guard lands on /setup; the CLI
    must not demand `openpalm install` or reimplement wizard logic.
- CHARACTERIZATION (green pre-change, must stay green): 2 tests pinning
  the bare `openpalm` serve path's spawn env — loopback + pinned ORIGIN
  with NO admin/mode env introduced, and OP_ALLOW_REMOTE_SETUP still
  producing the 0.0.0.0 + HOST_HEADER remote bind. Loopback-always is
  scoped to the admin command only.

Verified red for the right reasons: 5 fail / 2 pass in the new file;
full CLI suite 82 pass / 6 fail = these 5 + the 1 known uid-0
install-flow env failure. biome lint: no findings in the new file;
packages/cli tsc --noEmit exit 0 (red-state safe via computed-specifier
dynamic import); ui:check 0 errors 0 warnings.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FetR7BttT1xBrA8fBwhui9
---
 packages/cli/src/commands/admin.test.ts | 400 ++++++++++++++++++++++++
 1 file changed, 400 insertions(+)
 create mode 100644 packages/cli/src/commands/admin.test.ts

diff --git a/packages/cli/src/commands/admin.test.ts b/packages/cli/src/commands/admin.test.ts
new file mode 100644
index 000000000..185cb8f3f
--- /dev/null
+++ b/packages/cli/src/commands/admin.test.ts
@@ -0,0 +1,400 @@
+/**
+ * Phase 1.5 (#556) — `openpalm admin` (host-ui mode).
+ *
+ * TDD red suite written BEFORE the implementation. Contract under test
+ * (docs/technical/ui-runtime-modes-plan.md §7 Phase 1.5, §4.1 host-ui row):
+ *
+ *  - `admin` is registered in src/main.ts's subCommands map (new
+ *    src/commands/admin.ts) and shows up in `openpalm --help`.
+ *  - The command serves the existing UI through the existing startUIServer
+ *    path, with the admin capability enabled in the SPAWNED UI child env:
+ *    OP_ENABLE_ADMIN=1 and OP_UI_HOST_MODE=host-ui.
+ *  - host-ui mode is loopback-only ALWAYS: a non-loopback bind config
+ *    (OP_ALLOW_REMOTE_SETUP) is refused/ignored for this command — the child
+ *    binds 127.0.0.1 with a pinned loopback ORIGIN, and the flag is
+ *    neutralized in the child env so the respawned `openpalm ui` child and
+ *    the UI's own remote-setup relaxations cannot re-derive a remote bind
+ *    (plan §8.3: host admin remains loopback-only, never weakened).
+ *  - It prints the URL and opens the browser (reusing the existing
+ *    open-browser helper via startUIServer); --no-open suppresses that.
+ *  - On a machine with no install it still serves — the UI's existing setup
+ *    guard lands on /setup; the CLI does NOT reimplement wizard logic.
+ *
+ * Harness: no module mocks. Real @openpalm/lib + cli-state against a seeded
+ * temp OP_HOME; global fetch answers /health (ready) and fails registry
+ * fetches (checkAndUpdate* degrade non-fatally by design); Bun.spawn is
+ * captured so no real process is launched. The serve promise intentionally
+ * never resolves (foreground supervisor) — tests poll the spawn capture.
+ *
+ * The two "parity" tests at the bottom are CHARACTERIZATION tests: they pass
+ * before the Phase 1.5 change and pin the existing bare-serve spawn env so
+ * loopback-always is scoped to admin mode only.
+ */
+import { afterEach, describe, expect, it } from 'bun:test';
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { renderUsage, runCommand, type CommandDef } from 'citty';
+import { isRemoteSetupAllowed } from '@openpalm/lib';
+import { mainCommand } from '../main.ts';
+import { startUIServer, type UIServerOptions } from '../lib/ui-server.ts';
+
+// Resolved as a plain string so the red state fails at runtime ("Cannot find
+// module") instead of at typecheck time — src/commands/admin.ts does not
+// exist until the implementation lands.
+const adminModuleUrl = new URL('./admin.ts', import.meta.url).href;
+
+const ESC = String.fromCharCode(27);
+/** Strip ANSI color codes from citty usage output. */
+function stripAnsi(s: string): string {
+  return s.replace(new RegExp(`${ESC}\\[[0-9;]*m`, 'g'), '');
+}
+
+// ── Serve harness ────────────────────────────────────────────────────────────
+
+interface CapturedSpawn {
+  argv: string[];
+  env: Record<string, string | undefined> | undefined;
+}
+
+const originalBunSpawn = Bun.spawn;
+const originalFetch = globalThis.fetch;
+const originalLog = console.log;
+const originalWarn = console.warn;
+const SAVED_ENV_KEYS = [
+  'OP_HOME',
+  'OP_ENABLE_ADMIN',
+  'OP_UI_HOST_MODE',
+  'OP_ALLOW_REMOTE_SETUP',
+  'OP_HOST_UI_PORT'
+] as const;
+const savedEnv: Record<string, string | undefined> = {};
+for (const key of SAVED_ENV_KEYS) savedEnv[key] = process.env[key];
+const tmpDirs: string[] = [];
+
+afterEach(() => {
+  Bun.spawn = originalBunSpawn;
+  globalThis.fetch = originalFetch;
+  console.log = originalLog;
+  console.warn = originalWarn;
+  for (const key of SAVED_ENV_KEYS) {
+    if (savedEnv[key] === undefined) delete process.env[key];
+    else process.env[key] = savedEnv[key];
+  }
+  for (const dir of tmpDirs.splice(0)) rmSync(dir, { recursive: true, force: true });
+});
+
+/** Capture every Bun.spawn call; no real process is ever launched. */
+function captureSpawns(): CapturedSpawn[] {
+  const calls: CapturedSpawn[] = [];
+  Bun.spawn = ((
+    argv: readonly string[],
+    opts?: { env?: Record<string, string | undefined> }
+  ) => {
+    calls.push({ argv: [...argv], env: opts?.env });
+    return {
+      pid: 0,
+      exited: new Promise<number>(() => {}), // stays "alive"
+      exitCode: null,
+      signalCode: null,
+      killed: false,
+      stdin: null,
+      stdout: null,
+      stderr: null,
+      kill: () => {},
+      ref: () => {},
+      unref: () => {},
+      [Symbol.asyncDispose]: async () => {},
+      resourceUsage: () => undefined
+    };
+  }) as unknown as typeof Bun.spawn;
+  return calls;
+}
+
+/** Capture console.log/console.warn lines (startUIServer prints the URL there). */
+function captureLogs(): string[] {
+  const lines: string[] = [];
+  console.log = ((...args: unknown[]) => {
+    lines.push(args.map(String).join(' '));
+  }) as typeof console.log;
+  console.warn = ((...args: unknown[]) => {
+    lines.push(args.map(String).join(' '));
+  }) as typeof console.warn;
+  return lines;
+}
+
+/**
+ * Seed a temp OP_HOME the REAL lib accepts and point the serve path at it:
+ *  - data/ui/index.js so resolveUiBuildDir() always finds a runnable build
+ *    (never executed — Bun.spawn is captured);
+ *  - installed=true additionally seeds core.compose.yml + OP_SETUP_COMPLETE
+ *    so ensureValidState() passes; installed=false leaves OP_HOME empty so
+ *    classifyLocalInstall() reports not_installed (the /setup scenario).
+ * Also mocks fetch: UI /health is ready; registry fetches fail, which the
+ * checkAndUpdate* self-update helpers absorb non-fatally by design.
+ */
+function seedServeHome(opts: { installed: boolean }): string {
+  const home = mkdtempSync(join(tmpdir(), 'openpalm-admin-red-'));
+  tmpDirs.push(home);
+  mkdirSync(join(home, 'data', 'ui'), { recursive: true });
+  writeFileSync(join(home, 'data', 'ui', 'index.js'), '// stub adapter-node entry\n');
+  if (opts.installed) {
+    mkdirSync(join(home, 'system', 'stack'), { recursive: true });
+    writeFileSync(join(home, 'system', 'stack', 'core.compose.yml'), 'services: {}\n');
+    mkdirSync(join(home, 'state'), { recursive: true });
+    writeFileSync(join(home, 'state', 'stack.state.env'), 'OP_SETUP_COMPLETE=true\n');
+  }
+  process.env.OP_HOME = home;
+  // Make sure nothing ambient can fake an admin-mode pass (spawnUiChild
+  // spreads process.env into the child env).
+  delete process.env.OP_ENABLE_ADMIN;
+  delete process.env.OP_UI_HOST_MODE;
+  delete process.env.OP_ALLOW_REMOTE_SETUP;
+  delete process.env.OP_HOST_UI_PORT;
+  globalThis.fetch = (async (input: string | URL | Request) => {
+    const url = String(input instanceof Request ? input.url : input);
+    if (url.endsWith('/health')) return new Response('ok', { status: 200 });
+    throw new TypeError('fetch failed');
+  }) as unknown as typeof fetch;
+  return home;
+}
+
+/**
+ * Poll until `get` yields a value. `failed` surfaces an async command
+ * rejection instead of a misleading timeout.
+ */
+async function waitFor<T>(
+  get: () => T | undefined,
+  what: string,
+  failed?: () => unknown,
+  timeoutMs = 5000
+): Promise<T> {
+  const deadline = Date.now() + timeoutMs;
+  for (;;) {
+    const err = failed?.();
+    if (err !== undefined) {
+      throw new Error(`${what}: command rejected first: ${String(err)}`);
+    }
+    const value = get();
+    if (value !== undefined) return value;
+    if (Date.now() > deadline) throw new Error(`timed out waiting for ${what}`);
+    await new Promise((resolve) => setTimeout(resolve, 10));
+  }
+}
+
+/** The spawned UI child is the only capture that carries PORT in its env. */
+function uiChildSpawn(calls: CapturedSpawn[], port: number): CapturedSpawn | undefined {
+  return calls.find((c) => c.env?.PORT === String(port));
+}
+
+/** openBrowser spawns the platform opener with the URL and NO env option. */
+function browserSpawn(calls: CapturedSpawn[], port: number): CapturedSpawn | undefined {
+  return calls.find((c) => c.env === undefined && c.argv.some((a) => a.includes(`:${port}`)));
+}
+
+/**
+ * Import src/commands/admin.ts (RED: module does not exist yet) and run it
+ * through citty without awaiting — the serve mode runs in the foreground
+ * until SIGINT/SIGTERM, so the returned promise never resolves on success.
+ */
+async function runAdmin(rawArgs: string[]): Promise<{ error?: unknown }> {
+  const state: { error?: unknown } = {};
+  const mod = (await import(adminModuleUrl)) as { default: CommandDef };
+  void runCommand(mod.default, { rawArgs }).catch((e: unknown) => {
+    state.error = e ?? new Error('admin command rejected');
+  });
+  return state;
+}
+
+// ── Registration + help (#556) ───────────────────────────────────────────────
+
+describe('admin subcommand registration (#556)', () => {
+  it('registers `admin` in the main subCommands map', async () => {
+    const sub = (mainCommand.subCommands as Record<string, () => Promise<unknown>>).admin;
+    expect(typeof sub).toBe('function');
+    const cmd = (await sub()) as { meta?: { name?: string; description?: string } };
+    expect(cmd.meta?.name).toBe('admin');
+    // A non-empty description so `openpalm --help` renders a useful COMMANDS row.
+    expect(cmd.meta?.description ?? '').not.toBe('');
+  });
+
+  it('lists `admin` in the CLI help output', async () => {
+    const usage = stripAnsi(await renderUsage(mainCommand));
+    // The COMMANDS table renders each entry as "  <name>  <description>".
+    expect(usage).toMatch(/^\s*admin\b/m);
+  });
+});
+
+// ── Serve mode: admin env + loopback enforcement (#556) ─────────────────────
+
+describe('openpalm admin serve mode (#556)', () => {
+  it(
+    'spawns the UI child with the admin capability + host-ui mode env, prints the URL, opens the browser',
+    async () => {
+      seedServeHome({ installed: true });
+      const calls = captureSpawns();
+      const logs = captureLogs();
+
+      const run = await runAdmin(['--port', '4611']);
+
+      const child = await waitFor(
+        () => uiChildSpawn(calls, 4611),
+        'admin UI child spawn',
+        () => run.error
+      );
+      // Admin capability enabled in the spawned UI server env (plan Phase 1.5).
+      expect(child.env?.OP_ENABLE_ADMIN).toBe('1');
+      expect(child.env?.OP_UI_HOST_MODE).toBe('host-ui');
+      // Loopback-only bind with a pinned loopback origin.
+      expect(child.env?.HOST).toBe('127.0.0.1');
+      expect(child.env?.PORT).toBe('4611');
+      expect(child.env?.ORIGIN).toBe('http://127.0.0.1:4611');
+      expect(child.env?.HOST_HEADER).toBeUndefined();
+      expect(child.env?.PROTOCOL_HEADER).toBeUndefined();
+
+      // Prints the URL…
+      await waitFor(
+        () => (logs.some((l) => /http:\/\/(localhost|127\.0\.0\.1):4611/.test(l)) ? true : undefined),
+        'admin URL printed',
+        () => run.error
+      );
+      // …and opens the browser by default (existing open-browser helper).
+      await waitFor(
+        () => browserSpawn(calls, 4611),
+        'browser opener spawn',
+        () => run.error
+      );
+    },
+    15000
+  );
+
+  it(
+    'refuses a non-loopback bind config: OP_ALLOW_REMOTE_SETUP is ignored and neutralized',
+    async () => {
+      seedServeHome({ installed: true });
+      // Operator has the remote-setup escape hatch enabled — admin mode must
+      // stay loopback-only anyway (plan §8.3, Phase 1.5 "refuse non-loopback binds").
+      process.env.OP_ALLOW_REMOTE_SETUP = '1';
+      const calls = captureSpawns();
+      const logs = captureLogs();
+
+      const run = await runAdmin(['--port', '4612', '--no-open']);
+
+      const child = await waitFor(
+        () => uiChildSpawn(calls, 4612),
+        'admin UI child spawn',
+        () => run.error
+      );
+      expect(child.env?.OP_ENABLE_ADMIN).toBe('1');
+      expect(child.env?.OP_UI_HOST_MODE).toBe('host-ui');
+      // NOT the remote bind (0.0.0.0 + Host-header origin) — loopback, pinned.
+      expect(child.env?.HOST).toBe('127.0.0.1');
+      expect(child.env?.ORIGIN).toBe('http://127.0.0.1:4612');
+      expect(child.env?.HOST_HEADER).toBeUndefined();
+      expect(child.env?.PROTOCOL_HEADER).toBeUndefined();
+      // The flag itself must be neutralized in the child env: the `openpalm ui`
+      // respawn and the UI server's own OP_ALLOW_REMOTE_SETUP relaxations
+      // (Host/Origin allowlist, setup gate) must not see it enabled.
+      expect(isRemoteSetupAllowed(child.env ?? {})).toBe(false);
+
+      // --no-open: URL is printed but no browser opener is spawned.
+      await waitFor(
+        () => (logs.some((l) => /http:\/\/(localhost|127\.0\.0\.1):4612/.test(l)) ? true : undefined),
+        'admin URL printed',
+        () => run.error
+      );
+      await new Promise((resolve) => setTimeout(resolve, 50));
+      expect(browserSpawn(calls, 4612)).toBeUndefined();
+    },
+    15000
+  );
+
+  it(
+    'serves without an install — the UI setup guard lands on /setup, no wizard logic in the CLI',
+    async () => {
+      // Empty OP_HOME: classifyLocalInstall() → not_installed. The command must
+      // still bring the UI up (admin-enabled, loopback) instead of demanding
+      // `openpalm install` — the UI's existing guard redirects to /setup.
+      seedServeHome({ installed: false });
+      const calls = captureSpawns();
+      captureLogs();
+
+      const run = await runAdmin(['--port', '4613', '--no-open']);
+
+      const child = await waitFor(
+        () => uiChildSpawn(calls, 4613),
+        'admin UI child spawn (no install)',
+        () => run.error
+      );
+      expect(child.env?.OP_ENABLE_ADMIN).toBe('1');
+      expect(child.env?.OP_UI_HOST_MODE).toBe('host-ui');
+      expect(child.env?.HOST).toBe('127.0.0.1');
+      expect(child.env?.ORIGIN).toBe('http://127.0.0.1:4613');
+    },
+    15000
+  );
+});
+
+// ── Spawn-env parity for the existing bare serve path ────────────────────────
+// CHARACTERIZATION: these pass BEFORE the Phase 1.5 change and must stay
+// green after it — loopback-always and the admin env are scoped to the admin
+// command; the bare `openpalm` serve path keeps its current behavior.
+
+describe('bare serve path spawn env (characterization — green pre-change)', () => {
+  it(
+    'binds loopback with a pinned ORIGIN and does NOT enable admin',
+    async () => {
+      seedServeHome({ installed: true });
+      const calls = captureSpawns();
+      captureLogs();
+
+      const failure: { error?: unknown } = {};
+      void startUIServer({ port: 4614, open: false } satisfies UIServerOptions).catch(
+        (e: unknown) => {
+          failure.error = e ?? new Error('startUIServer rejected');
+        }
+      );
+
+      const child = await waitFor(
+        () => uiChildSpawn(calls, 4614),
+        'bare-serve UI child spawn',
+        () => failure.error
+      );
+      expect(child.env?.HOST).toBe('127.0.0.1');
+      expect(child.env?.ORIGIN).toBe('http://127.0.0.1:4614');
+      expect(child.env?.HOST_HEADER).toBeUndefined();
+      // Bare serve is NOT the admin surface: no admin/mode env is introduced.
+      expect(child.env?.OP_ENABLE_ADMIN).toBeUndefined();
+      expect(child.env?.OP_UI_HOST_MODE).toBeUndefined();
+    },
+    15000
+  );
+
+  it(
+    'still honors OP_ALLOW_REMOTE_SETUP (the remote bind is refused only in admin mode)',
+    async () => {
+      seedServeHome({ installed: true });
+      process.env.OP_ALLOW_REMOTE_SETUP = '1';
+      const calls = captureSpawns();
+      captureLogs();
+
+      const failure: { error?: unknown } = {};
+      void startUIServer({ port: 4615, open: false } satisfies UIServerOptions).catch(
+        (e: unknown) => {
+          failure.error = e ?? new Error('startUIServer rejected');
+        }
+      );
+
+      const child = await waitFor(
+        () => uiChildSpawn(calls, 4615),
+        'bare-serve remote UI child spawn',
+        () => failure.error
+      );
+      expect(child.env?.HOST).toBe('0.0.0.0');
+      expect(child.env?.HOST_HEADER).toBe('host');
+      expect(child.env?.PROTOCOL_HEADER).toBe('x-forwarded-proto');
+      expect(child.env?.ORIGIN).toBeUndefined();
+    },
+    15000
+  );
+});

From fc4c254bb4cfac1e6a700e4a1cdfb30383604ad3 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Mon, 6 Jul 2026 07:34:18 +0000
Subject: [PATCH 06/61] =?UTF-8?q?feat(cli):=20add=20`openpalm=20admin`=20?=
 =?UTF-8?q?=E2=80=94=20host-ui=20admin=20serve=20mode=20(#556)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Register a new `admin` subcommand that serves the existing UI through the
existing startUIServer supervisor with the admin capability enabled in the
spawned UI child (OP_ENABLE_ADMIN=1 + OP_UI_HOST_MODE=host-ui), prints the
URL, and opens the browser (reusing the existing openBrowser helper;
--no-open suppresses it).

Loopback-only ALWAYS (plan §8.3): admin mode ignores OP_ALLOW_REMOTE_SETUP
when deriving the bind (HOST=127.0.0.1 with a pinned loopback ORIGIN, no
HOST_HEADER/PROTOCOL_HEADER) and neutralizes the flag in the child env
(OP_ALLOW_REMOTE_SETUP=0) so neither the respawned `openpalm ui` child nor
the UI server's own remote-setup relaxations can re-derive a remote bind.
The bare serve path keeps its current behavior (characterization tests pin
it): loopback by default, 0.0.0.0 + Host-header origin under
OP_ALLOW_REMOTE_SETUP.

On a machine with no install the command still serves — resolveServeState()
tolerates a not-installed OP_HOME so the UI's existing setup guard takes
over; the CLI reimplements no wizard logic. No new auth mechanism: the UI's
existing op_session password auth applies unchanged.

Makes the Phase 1.5 red suite (admin.test.ts) green without modifying it.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FetR7BttT1xBrA8fBwhui9
---
 packages/cli/src/commands/admin.ts | 42 ++++++++++++++++++++++++++++++
 packages/cli/src/lib/cli-state.ts  | 15 +++++++++++
 packages/cli/src/lib/ui-server.ts  | 32 +++++++++++++++++++----
 packages/cli/src/main.ts           |  5 ++--
 4 files changed, 87 insertions(+), 7 deletions(-)
 create mode 100644 packages/cli/src/commands/admin.ts

diff --git a/packages/cli/src/commands/admin.ts b/packages/cli/src/commands/admin.ts
new file mode 100644
index 000000000..01016d226
--- /dev/null
+++ b/packages/cli/src/commands/admin.ts
@@ -0,0 +1,42 @@
+/**
+ * `openpalm admin` — host-ui mode (plan Phase 1.5, #556).
+ *
+ * Serves the existing UI through the existing startUIServer supervisor with
+ * the admin capability enabled in the spawned UI child (OP_ENABLE_ADMIN=1 +
+ * OP_UI_HOST_MODE=host-ui), prints the URL, and opens the browser. Full host
+ * management from a browser on the host machine, without Electron.
+ *
+ * Loopback-only ALWAYS: this mode refuses non-loopback bind config —
+ * OP_ALLOW_REMOTE_SETUP is ignored and neutralized in the child env (plan
+ * §8.3: host admin is never reachable remotely). No new auth mechanism: the
+ * UI's existing op_session password auth applies. On a machine with no
+ * install, the UI's existing setup guard lands on /setup.
+ */
+import { defineCommand } from 'citty';
+import { startUIServer } from '../lib/ui-server.ts';
+
+export default defineCommand({
+  meta: {
+    name: 'admin',
+    description:
+      'Serve the OpenPalm admin UI in your browser (loopback-only, no Electron needed)',
+  },
+  args: {
+    port: {
+      type: 'string',
+      description: 'UI server port (default: 3880 or OP_HOST_UI_PORT)',
+    },
+    open: {
+      type: 'boolean',
+      description: 'Open browser after start (use --no-open to skip)',
+      default: true,
+    },
+  },
+  async run({ args }) {
+    await startUIServer({
+      port: args.port ? Number(args.port) : undefined,
+      open: args.open,
+      adminHostUi: true,
+    });
+  },
+});
diff --git a/packages/cli/src/lib/cli-state.ts b/packages/cli/src/lib/cli-state.ts
index 35462b41e..e4e9ef1a6 100644
--- a/packages/cli/src/lib/cli-state.ts
+++ b/packages/cli/src/lib/cli-state.ts
@@ -28,3 +28,18 @@ export function ensureValidState(): ControlPlaneState {
   state.artifacts = resolveRuntimeFiles();
   return state;
 }
+
+/**
+ * Like {@link ensureValidState}, but tolerates a not-installed OP_HOME:
+ * returns the bootstrap state (no runtime artifacts) instead of throwing, so
+ * the UI server can still come up and its setup guard lands on /setup.
+ * Used by `openpalm admin`, which must serve on a machine with no install.
+ */
+export function resolveServeState(): ControlPlaneState {
+  const state = createState();
+  if (classifyLocalInstall(state.stackDir, state.homeDir) === 'not_installed') {
+    return state;
+  }
+  state.artifacts = resolveRuntimeFiles();
+  return state;
+}
diff --git a/packages/cli/src/lib/ui-server.ts b/packages/cli/src/lib/ui-server.ts
index 22e71b4d5..d05bc1d3f 100644
--- a/packages/cli/src/lib/ui-server.ts
+++ b/packages/cli/src/lib/ui-server.ts
@@ -13,7 +13,7 @@ import {
   checkAndUpdateUiBuild, checkAndUpdateSkeleton, PLATFORM_VERSION,
   isRemoteSetupAllowed, waitForReady, restoreUiBackup, UiSupervisor,
 } from '@openpalm/lib';
-import { ensureValidState } from './cli-state.ts';
+import { ensureValidState, resolveServeState } from './cli-state.ts';
 import { openBrowser } from './browser.ts';
 import { DEFAULT_UI_PORT } from './ports.ts';
 
@@ -24,6 +24,14 @@ const STOP_TIMEOUT_MS  = 5_000;
 export interface UIServerOptions {
   port?: number;
   open?: boolean;
+  /**
+   * host-ui admin mode (`openpalm admin`, plan Phase 1.5): enable the admin
+   * capability in the spawned UI child (OP_ENABLE_ADMIN=1 + OP_UI_HOST_MODE=
+   * host-ui) and pin the bind to loopback ALWAYS — OP_ALLOW_REMOTE_SETUP is
+   * ignored and neutralized in the child env, so no non-loopback bind is
+   * possible in this mode (plan §8.3: host admin is never reachable remotely).
+   */
+  adminHostUi?: boolean;
 }
 
 /**
@@ -41,6 +49,7 @@ async function spawnUiChild(
   port: number,
   homeDir: string,
   state: ReturnType<typeof ensureValidState>,
+  adminHostUi = false,
 ): Promise<{ proc: Bun.Subprocess; uiBackupDir: string | undefined }> {
   // Hot-swap the skeleton (managed system/ tree) before spawning.
   console.log('Checking for skeleton update...');
@@ -92,11 +101,20 @@ async function spawnUiChild(
   // Default: bind loopback with a pinned ORIGIN. With OP_ALLOW_REMOTE_SETUP the
   // server binds all interfaces and lets adapter-node derive the origin from the
   // request Host header (HOST_HEADER), so it works under whatever LAN host/IP the
-  // operator reaches it by.
-  const remote = isRemoteSetupAllowed();
+  // operator reaches it by. Admin (host-ui) mode is loopback ALWAYS: the
+  // remote-setup escape hatch never applies to the host admin surface (§8.3).
+  const remote = !adminHostUi && isRemoteSetupAllowed();
   const networkEnv = remote
     ? { HOST: '0.0.0.0', PORT: String(port), HOST_HEADER: 'host', PROTOCOL_HEADER: 'x-forwarded-proto' }
     : { HOST: '127.0.0.1', PORT: String(port), ORIGIN: `http://127.0.0.1:${port}` };
+  // Admin (host-ui) mode: enable the admin capability in the UI child and
+  // neutralize OP_ALLOW_REMOTE_SETUP (spread in from process.env below) so
+  // neither the respawned `openpalm ui` child nor the UI server's own
+  // remote-setup relaxations (Host/Origin allowlist, setup gate) can re-derive
+  // a remote bind.
+  const adminEnv = adminHostUi
+    ? { OP_ENABLE_ADMIN: '1', OP_UI_HOST_MODE: 'host-ui', OP_ALLOW_REMOTE_SETUP: '0' }
+    : {};
   const proc = Bun.spawn(
     [process.execPath, ...childArgs],
     {
@@ -108,6 +126,7 @@ async function spawnUiChild(
         // own cwd (packages/ui/build/).
         OP_HOME:                homeDir,
         ...networkEnv,
+        ...adminEnv,
         OP_UI_LOGIN_PASSWORD:   uiLoginPassword,
         // Tell the UI child it has a supervisor that can respawn it on demand
         // (design §6.2). The admin "install UI version" route signals SIGUSR2 to
@@ -257,12 +276,15 @@ export async function startUIServer(opts: UIServerOptions = {}): Promise<void> {
 
   const homeDir = resolveOpenPalmHome();
 
-  const state = ensureValidState();
+  // Admin (host-ui) mode serves even on a machine with no install — the UI's
+  // existing setup guard lands on /setup (the CLI does not reimplement wizard
+  // logic). The bare serve path keeps requiring a valid install.
+  const state = opts.adminHostUi ? resolveServeState() : ensureValidState();
   const uiUrl = `http://localhost:${port}`;
 
   const { supervisor, stop: stopUiProc } = createCliUiSupervisor({
     port,
-    spawnChild: () => spawnUiChild(port, homeDir, state),
+    spawnChild: () => spawnUiChild(port, homeDir, state, opts.adminHostUi === true),
     restoreBackup: (backupDir) => restoreUiBackup(state.dataDir, backupDir),
   });
 
diff --git a/packages/cli/src/main.ts b/packages/cli/src/main.ts
index 401b703fe..61fd4e735 100755
--- a/packages/cli/src/main.ts
+++ b/packages/cli/src/main.ts
@@ -41,8 +41,8 @@ async function isAssistantHealthy(): Promise<boolean> {
  *  - Installed, stack up → starts the UI host server (foreground)
  *
  * The UI server runs in the foreground until SIGINT/SIGTERM. This is
- * the canonical way to "run OpenPalm" — no separate `ui`/`admin`
- * subcommand.
+ * the canonical way to "run OpenPalm". `openpalm admin` serves the same
+ * UI with the host admin capability enabled (host-ui mode, loopback-only).
  */
 async function autoRun(opts: BareRunOpts = {}): Promise<void> {
   const isInstalled = classifyLocalInstall(resolveStackDir(), resolveOpenPalmHome()) !== 'not_installed';
@@ -83,6 +83,7 @@ async function autoRun(opts: BareRunOpts = {}): Promise<void> {
 // derived from these keys below so adding a subcommand here can never drift
 // out of sync with the bare-command routing table.
 const subCommands = {
+  admin: () => import('./commands/admin.ts').then((m) => m.default),
   install: () => import('./commands/install.ts').then((m) => m.default),
   uninstall: () => import('./commands/uninstall.ts').then((m) => m.default),
   update: () => import('./commands/update.ts').then((m) => m.default),

From e777688c396c04b30740dd0b2b41d5d225c0c2cc Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Mon, 6 Jul 2026 07:34:32 +0000
Subject: [PATCH 07/61] docs: document the three ways to reach the admin
 surface (#556)

Update the how-it-works harness UI section: Electron (electron-host mode),
`openpalm admin` (host-ui mode, loopback-only, refuses non-loopback bind
config), and the dev-only OP_ENABLE_ADMIN=1 escape hatch. Drops the stale
`openpalm ui serve` reference.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FetR7BttT1xBrA8fBwhui9
---
 docs/how-it-works.md | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/docs/how-it-works.md b/docs/how-it-works.md
index 4f6db05ee..6654bbd35 100644
--- a/docs/how-it-works.md
+++ b/docs/how-it-works.md
@@ -39,7 +39,12 @@ Three hard rules define the whole design:
 ## Components
 
 ### Harness UI (SvelteKit app, host port 3880)
-The web face of the harness. Started by `openpalm ui serve` as a host process — no container. Accesses Docker and `~/.openpalm/` directly on the host.
+The web face of the harness. Runs as a host process — no container. Accesses Docker and `~/.openpalm/` directly on the host.
+
+Three ways to reach the admin surface (all loopback-only — host admin is never reachable remotely):
+- **Electron app** — the desktop harness supervises the UI process and opens it with the admin capability enabled (`electron-host` mode).
+- **`openpalm admin`** — the CLI serves the same UI with the admin capability enabled (`host-ui` mode), prints the URL, and opens your browser. This mode refuses non-loopback bind config: `OP_ALLOW_REMOTE_SETUP` is ignored and neutralized. On a machine with no install it lands on the `/setup` wizard.
+- **Dev only: `OP_ENABLE_ADMIN=1`** — set on a locally run UI server (e.g. the dev server) to enable the admin capability without a harness. Never set this in production.
 
 Responsibilities:
 - Writes runtime configuration directly to `~/.openpalm/config/stack/`, `~/.openpalm/knowledge/env/stack.env`, and `~/.openpalm/config/akm/`

From 5e0f2d505eca98d5d36b771d638930f3aa40857d Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Mon, 6 Jul 2026 11:33:45 +0000
Subject: [PATCH 08/61] test(phase-2): red tests for #486
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

TDD red suite for connection management out of /admin (plan
ui-runtime-modes-plan.md Phase 2, issue #486):

- routes/api/connections/server.vitest.ts: /api/connections is guarded
  server-side by the connections:manage capability (plan §6.4, §8.5) —
  403 JSON in assistant-container mode even with a VALID admin session
  (capability-based, not session-based), 200 in host-ui mode, reachable
  in pwa-static mode (no host-admin mode required), lists the
  env-derived default connection, never serializes stored passwords;
  POST guarded the same way (403 assistant-container / 201 host-ui).
  RED: all 8 tests — "Cannot find module .../+server.js" (route module
  does not exist yet; loaded via a computed-specifier dynamic import so
  svelte-check stays green while red).

- lib/server/endpoints-connection-kind.vitest.ts: ConnectionKind
  defaulting when reading a legacy endpoints.json fixture (plan §6.6) —
  records without a kind key default to 'remote-opencode' on read
  (listEndpoints + getActiveEndpoint); the env-derived default entry is
  'local-opencode'. RED: 4 tests ("expected undefined to be
  'remote-opencode'/'local-opencode'" — kind read via a cast helper so
  svelte-check stays green). CHARACTERIZATION (green pre-change, must
  stay green): 3 tests — an explicitly persisted kind passes through on
  read (unknown on-disk keys already survive; Phase 2 must not strip or
  override it), writes keep the on-disk schema keys activeId/endpoints
  (never 'connections'), and legacy records load with no data
  migration.

- routes/admin/endpoints/page.vitest.ts: /admin/endpoints becomes a
  redirect alias to /connections for 0.13.0 (Phase 2 step 5), pinned as
  a universal load in +page.ts throwing redirect() with location
  '/connections' and a 3xx status — same convention as the existing
  routes/+page.ts → /splash redirect. RED: both tests ("Cannot find
  module .../+page.js"; computed-specifier dynamic import keeps
  svelte-check green).

- lib/endpoints-state-hygiene.vitest.ts: source-level hygiene test for
  the untangle step (Phase 2 step 6) — the connections store (follows
  the file across the endpoint→connection rename: endpoints-state or
  connections-state) must have NO static, type, side-effect, or dynamic
  import matching chat-state or chat/*. RED: 1 test (found
  './chat/chat-state.svelte.js'). CHARACTERIZATION (green): 1 test — the
  store module exists in $lib.

Verified red for the right reasons: server project 15 failed / 992
passed across 106 files; the only failing files are these four, all
failures are module-resolution or missing-feature assertions (no syntax
errors). ui:check: 0 errors 0 warnings (red-state safe via
computed-specifier dynamic imports and cast helpers). biome lint:
baseline unchanged (16 warnings 1 info, none in the new files); eslint
clean on the new files. CLI suite 87/1 (the 1 = known uid-0
install-flow env failure); lib suite 845 pass / 10 skip / 17 fail (the
known uid-0 set) — parity.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FetR7BttT1xBrA8fBwhui9
---
 .../src/lib/endpoints-state-hygiene.vitest.ts |  78 +++++++
 .../endpoints-connection-kind.vitest.ts       | 158 +++++++++++++
 .../src/routes/admin/endpoints/page.vitest.ts |  58 +++++
 .../routes/api/connections/server.vitest.ts   | 211 ++++++++++++++++++
 4 files changed, 505 insertions(+)
 create mode 100644 packages/ui/src/lib/endpoints-state-hygiene.vitest.ts
 create mode 100644 packages/ui/src/lib/server/endpoints-connection-kind.vitest.ts
 create mode 100644 packages/ui/src/routes/admin/endpoints/page.vitest.ts
 create mode 100644 packages/ui/src/routes/api/connections/server.vitest.ts

diff --git a/packages/ui/src/lib/endpoints-state-hygiene.vitest.ts b/packages/ui/src/lib/endpoints-state-hygiene.vitest.ts
new file mode 100644
index 000000000..bb21c55d6
--- /dev/null
+++ b/packages/ui/src/lib/endpoints-state-hygiene.vitest.ts
@@ -0,0 +1,78 @@
+/**
+ * Phase 2 (#486) hygiene — the connections store must not import chat state
+ * (plan ui-runtime-modes-plan.md Phase 2 step 6: "break the endpoints-state ↔
+ * chat-state bidirectional import (connection activation emits an event; chat
+ * subscribes)"; §6.11: the coupling is untangled BEFORE the Phase 5 client
+ * extraction, so the later move is file relocation, not surgery).
+ *
+ * RED until Phase 2 lands: lib/endpoints-state.svelte.ts currently does
+ *   import { chat } from './chat/chat-state.svelte.js';
+ *
+ * This is a source-level test (it reads the store's source and inspects its
+ * import specifiers) because the invariant is about the module graph, not
+ * runtime behavior: connection activation must reach chat through an
+ * event/callback that the chat side subscribes to — never through a direct
+ * import from the connections side. Type-only imports count too: after
+ * extraction they would still drag chat modules into the client package.
+ */
+import { describe, expect, test } from 'vitest';
+import { existsSync, readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+
+/**
+ * The store's current file name, plus the names the Phase 2 internal
+ * endpoint→connection rename could plausibly move it to. The hygiene
+ * invariant must keep holding after the rename, so the test follows the
+ * file rather than pinning one path.
+ */
+const CANDIDATE_STORE_FILES = [
+  'endpoints-state.svelte.ts',
+  'connections-state.svelte.ts',
+  'connection-state.svelte.ts',
+] as const;
+
+function resolveStoreFile(): string | null {
+  for (const name of CANDIDATE_STORE_FILES) {
+    const path = fileURLToPath(new URL(`./${name}`, import.meta.url));
+    if (existsSync(path)) return path;
+  }
+  return null;
+}
+
+/** Collect every static, side-effect, re-export, and dynamic import specifier. */
+function importSpecifiers(source: string): string[] {
+  const specifiers: string[] = [];
+  const patterns = [
+    // import ... from '...'; / export ... from '...'; (incl. `import type`)
+    /(?:^|\n)\s*(?:import|export)\s[^;'"]*?from\s*['"]([^'"]+)['"]/g,
+    // side-effect import: import '...';
+    /(?:^|\n)\s*import\s*['"]([^'"]+)['"]/g,
+    // dynamic import: import('...')
+    /import\s*\(\s*['"]([^'"]+)['"]\s*\)/g,
+  ];
+  for (const pattern of patterns) {
+    for (const match of source.matchAll(pattern)) {
+      specifiers.push(match[1]);
+    }
+  }
+  return specifiers;
+}
+
+/** True for chat-state or anything under a chat/ module directory. */
+function isChatModuleSpecifier(specifier: string): boolean {
+  return /chat-state/.test(specifier) || /(?:^|\/)chat\//.test(specifier);
+}
+
+describe('endpoints-state ↔ chat-state untangling (plan Phase 2 step 6)', () => {
+  test('the connections store module exists in $lib', () => {
+    expect(resolveStoreFile()).not.toBeNull();
+  });
+
+  test('the store has no static, type, or dynamic import from chat-state or chat/*', () => {
+    const path = resolveStoreFile();
+    expect(path).not.toBeNull();
+    const source = readFileSync(path as string, 'utf-8');
+    const chatImports = importSpecifiers(source).filter(isChatModuleSpecifier);
+    expect(chatImports).toEqual([]);
+  });
+});
diff --git a/packages/ui/src/lib/server/endpoints-connection-kind.vitest.ts b/packages/ui/src/lib/server/endpoints-connection-kind.vitest.ts
new file mode 100644
index 000000000..562aadc73
--- /dev/null
+++ b/packages/ui/src/lib/server/endpoints-connection-kind.vitest.ts
@@ -0,0 +1,158 @@
+/**
+ * Phase 2 (#486) — ConnectionKind defaulting on the endpoints store (plan
+ * ui-runtime-modes-plan.md §6.6; decision table §2: "endpoints.json rename —
+ * Do not rename. Add `kind` field. Internal model uses 'connection'
+ * language.").
+ *
+ * RED until Phase 2 lands: entries returned by listEndpoints() /
+ * getActiveEndpoint() carry no `kind` yet. `kind` is read through a cast
+ * helper (`kindOf`) so svelte-check stays clean while the suite is red —
+ * the assertions fail at runtime with `undefined` until the field exists.
+ *
+ * Contract under test:
+ *  - Legacy endpoints.json records (no `kind` key on disk) default to
+ *    'remote-opencode' when read.
+ *  - The env-derived default entry defaults to 'local-opencode'.
+ *  - CHARACTERIZATION (green pre-change, must stay green): a record
+ *    persisted WITH an explicit kind keeps it on read (the store already
+ *    passes unknown on-disk keys through — Phase 2 must not strip or
+ *    override it); and the on-disk file keeps its name and schema keys
+ *    (`activeId` / `endpoints`) — Phase 2 renames the internal model only,
+ *    never the persisted schema.
+ */
+import { describe, it, expect, beforeEach, afterEach } from 'vitest';
+import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { _replaceState, getState } from './state.js';
+import { makeTestState, registerCleanup, trackDir } from './test-helpers.js';
+import { addEndpoint, getActiveEndpoint, listEndpoints, setActiveId } from './endpoints.js';
+
+registerCleanup();
+
+const ENV_KEYS = [
+  'OP_OPENCODE_URL',
+  'OP_ASSISTANT_URL',
+  'OP_ASSISTANT_PORT',
+  'OPENCODE_SERVER_PASSWORD',
+] as const;
+const savedEnv: Record<string, string | undefined> = {};
+
+beforeEach(() => {
+  for (const k of ENV_KEYS) {
+    savedEnv[k] = process.env[k];
+    delete process.env[k];
+  }
+  const state = makeTestState();
+  trackDir(state.dataDir);
+  trackDir(state.configDir);
+  mkdirSync(state.dataDir, { recursive: true });
+  mkdirSync(state.configDir, { recursive: true });
+  _replaceState(state);
+});
+
+afterEach(() => {
+  for (const k of ENV_KEYS) {
+    if (savedEnv[k] === undefined) delete process.env[k];
+    else process.env[k] = savedEnv[k];
+  }
+});
+
+/** Read `kind` without a compile-time dependency on the not-yet-added field. */
+function kindOf(entry: unknown): string | undefined {
+  return (entry as { kind?: string }).kind;
+}
+
+function endpointsJsonPath(): string {
+  return `${getState().configDir}/endpoints.json`;
+}
+
+/** Seed config/endpoints.json byte-for-byte, as an existing install would have it. */
+function seedEndpointsFile(payload: unknown): void {
+  writeFileSync(endpointsJsonPath(), JSON.stringify(payload), { mode: 0o600 });
+}
+
+/** A legacy (pre-Phase-2) file: records have no `kind` key at all. */
+const LEGACY_RECORD_ID = '22222222-2222-4222-8222-222222222222';
+function seedLegacyFixture(): void {
+  seedEndpointsFile({
+    activeId: LEGACY_RECORD_ID,
+    endpoints: [
+      { id: LEGACY_RECORD_ID, label: 'Legacy Remote', url: 'http://10.0.0.9:3800', password: 'shh' },
+    ],
+  });
+}
+
+describe('ConnectionKind defaulting on read (plan §6.6)', () => {
+  it("defaults legacy user records (no kind on disk) to 'remote-opencode' in listEndpoints()", () => {
+    seedLegacyFixture();
+    const list = listEndpoints();
+    const legacy = list.find((e) => e.id === LEGACY_RECORD_ID);
+    expect(legacy).toBeDefined();
+    expect(kindOf(legacy)).toBe('remote-opencode');
+  });
+
+  it("defaults the legacy active record to 'remote-opencode' in getActiveEndpoint()", () => {
+    seedLegacyFixture();
+    const active = getActiveEndpoint();
+    expect(active.id).toBe(LEGACY_RECORD_ID);
+    expect(kindOf(active)).toBe('remote-opencode');
+  });
+
+  it("marks the env-derived default entry as 'local-opencode' in listEndpoints()", () => {
+    seedLegacyFixture();
+    const list = listEndpoints();
+    const dflt = list.find((e) => e.id === 'default');
+    expect(dflt).toBeDefined();
+    expect(kindOf(dflt)).toBe('local-opencode');
+  });
+
+  it("marks the env-derived default entry as 'local-opencode' when it is the active endpoint", () => {
+    // Fresh install: no endpoints.json at all — the default is active.
+    const active = getActiveEndpoint();
+    expect(active.isDefault).toBe(true);
+    expect(kindOf(active)).toBe('local-opencode');
+  });
+
+});
+
+describe('endpoints.json on-disk schema is NOT renamed (CHARACTERIZATION — green pre-change)', () => {
+  it('preserves an explicitly persisted kind on read (unknown keys already pass through)', () => {
+    seedEndpointsFile({
+      activeId: null,
+      endpoints: [
+        {
+          id: '33333333-3333-4333-8333-333333333333',
+          label: 'Client API',
+          url: 'https://palm.example:8443',
+          kind: 'openpalm-client-api',
+        },
+      ],
+    });
+    const list = listEndpoints();
+    const entry = list.find((e) => e.id === '33333333-3333-4333-8333-333333333333');
+    expect(entry).toBeDefined();
+    expect(kindOf(entry)).toBe('openpalm-client-api');
+  });
+
+  it('writes through the store keep the legacy schema keys (activeId/endpoints)', () => {
+    const entry = addEndpoint({ label: 'Remote', url: 'http://10.0.0.9:3800' });
+    setActiveId(entry.id);
+    const parsed = JSON.parse(readFileSync(endpointsJsonPath(), 'utf-8')) as Record<string, unknown>;
+    expect(parsed).toHaveProperty('endpoints');
+    expect(parsed).toHaveProperty('activeId', entry.id);
+    expect(parsed).not.toHaveProperty('connections');
+  });
+
+  it('legacy records load without any data migration (Phase 2 acceptance: "no data migration")', () => {
+    seedLegacyFixture();
+    const list = listEndpoints();
+    // [default, legacy record] — the legacy record is intact.
+    const legacy = list.find((e) => e.id === LEGACY_RECORD_ID);
+    expect(legacy).toMatchObject({
+      id: LEGACY_RECORD_ID,
+      label: 'Legacy Remote',
+      url: 'http://10.0.0.9:3800',
+      password: 'shh',
+      isDefault: false,
+    });
+  });
+});
diff --git a/packages/ui/src/routes/admin/endpoints/page.vitest.ts b/packages/ui/src/routes/admin/endpoints/page.vitest.ts
new file mode 100644
index 000000000..f2d85a5ad
--- /dev/null
+++ b/packages/ui/src/routes/admin/endpoints/page.vitest.ts
@@ -0,0 +1,58 @@
+/**
+ * Phase 2 (#486) — /admin/endpoints is a redirect alias to /connections for
+ * the 0.13.0 release (plan ui-runtime-modes-plan.md Phase 2 step 5: chat
+ * links move to /connections and the old route redirects there; the alias is
+ * removed when Phase 4 turns /admin/* into 404s).
+ *
+ * ALL RED until the implementation lands: routes/admin/endpoints/+page.ts
+ * does not exist yet (the route currently renders the management UI from
+ * +page.svelte directly). The redirect contract pinned here is a universal
+ * load in +page.ts throwing SvelteKit's redirect() — the same convention as
+ * the existing root redirect (src/routes/+page.ts → /splash).
+ *
+ * The module is loaded through a computed-specifier dynamic import so
+ * svelte-check stays clean while the suite is red.
+ */
+import { describe, expect, test } from 'vitest';
+
+type PageLoadModule = { load: (event: unknown) => unknown };
+
+async function loadPageModule(): Promise<PageLoadModule> {
+  const specifier = './+page.js';
+  return (await import(/* @vite-ignore */ specifier)) as PageLoadModule;
+}
+
+function makeLoadEvent(): unknown {
+  const url = new URL('http://127.0.0.1:3880/admin/endpoints');
+  return {
+    url,
+    params: {},
+    route: { id: '/admin/endpoints' },
+    fetch: globalThis.fetch,
+    data: {},
+    depends: () => {},
+    parent: async () => ({}),
+    untrack: <T>(fn: () => T) => fn(),
+  };
+}
+
+describe('/admin/endpoints → /connections redirect alias (plan Phase 2 step 5)', () => {
+  test('exports a load function', async () => {
+    const mod = await loadPageModule();
+    expect(typeof mod.load).toBe('function');
+  });
+
+  test('load() throws a 3xx redirect to /connections', async () => {
+    const { load } = await loadPageModule();
+    try {
+      await load(makeLoadEvent());
+      throw new Error('expected the load to throw a redirect');
+    } catch (e) {
+      // SvelteKit redirect() throws a { status, location } object.
+      const redirect = e as { status?: number; location?: string };
+      expect(redirect.location).toBe('/connections');
+      expect(redirect.status).toBeGreaterThanOrEqual(300);
+      expect(redirect.status).toBeLessThan(400);
+    }
+  });
+});
diff --git a/packages/ui/src/routes/api/connections/server.vitest.ts b/packages/ui/src/routes/api/connections/server.vitest.ts
new file mode 100644
index 000000000..b88e49e32
--- /dev/null
+++ b/packages/ui/src/routes/api/connections/server.vitest.ts
@@ -0,0 +1,211 @@
+/**
+ * Tests for /api/connections — Phase 2 connection management API (plan
+ * ui-runtime-modes-plan.md Phase 2, issue #486).
+ *
+ * ALL RED until the implementation lands: routes/api/connections/+server.ts
+ * does not exist yet. The module is loaded through a computed-specifier
+ * dynamic import so svelte-check stays clean while the suite is red; the
+ * tests fail at runtime with a module-resolution error until Phase 2 lands.
+ *
+ * Contract under test (plan §6.4 API namespace table + §8.5):
+ *  - /api/connections is guarded SERVER-SIDE by the `connections:manage`
+ *    capability. `hasCapability()` in the browser is UX only — the security
+ *    boundary is this route.
+ *  - assistant-container mode carries no `connections:manage`, so the guard
+ *    returns 403 even when a VALID admin session cookie is presented: the
+ *    check is capability-based (hostMode → serverCapabilities), not
+ *    session-based.
+ *  - host-ui mode carries `connections:manage` → requests succeed.
+ *  - pwa-static mode also carries `connections:manage` (§4.3) → connection
+ *    management is reachable without any host-admin mode (Phase 2
+ *    acceptance: "connection management reachable without /admin").
+ *  - Stored connection passwords are never serialized into responses
+ *    (parity with the /admin/endpoints publish() contract).
+ */
+import { afterEach, beforeEach, describe, expect, test } from 'vitest';
+import { mkdirSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { randomBytes } from 'node:crypto';
+import { tmpdir } from 'node:os';
+import { cleanupTempDirs, resetState, trackDir } from '$lib/server/test-helpers.js';
+import { getState } from '$lib/server/state.js';
+
+type RouteHandler = (event: unknown) => Response | Promise<Response>;
+type ConnectionsRouteModule = { GET: RouteHandler; POST: RouteHandler };
+
+/**
+ * RED-state-safe loader: the computed specifier keeps svelte-check green
+ * while the route module does not exist yet (same pattern as the Phase 1.5
+ * red suite). Once routes/api/connections/+server.ts lands this resolves
+ * exactly like a static `import { GET, POST } from './+server.js'`.
+ */
+async function loadRoute(): Promise<ConnectionsRouteModule> {
+  const specifier = './+server.js';
+  return (await import(/* @vite-ignore */ specifier)) as ConnectionsRouteModule;
+}
+
+function makeTempHome(): string {
+  const dir = join(tmpdir(), `openpalm-connections-${randomBytes(4).toString('hex')}`);
+  mkdirSync(dir, { recursive: true });
+  return trackDir(dir);
+}
+
+function makeGetEvent(token = 'admin-token'): unknown {
+  const url = new URL('http://127.0.0.1:3880/api/connections');
+  return {
+    url,
+    request: new Request(url, {
+      headers: {
+        cookie: `op_session=${token}`,
+        'x-request-id': 'req-connections-list',
+      },
+    }),
+    params: {},
+    locals: { role: 'admin' },
+    route: { id: '/api/connections' },
+    getClientAddress: () => '127.0.0.1',
+    isDataRequest: false,
+    isSubRequest: false,
+  };
+}
+
+function makePostEvent(body: Record<string, unknown>, token = 'admin-token'): unknown {
+  const url = new URL('http://127.0.0.1:3880/api/connections');
+  return {
+    url,
+    request: new Request(url, {
+      method: 'POST',
+      headers: {
+        cookie: `op_session=${token}`,
+        'x-request-id': 'req-connections-create',
+        'content-type': 'application/json',
+      },
+      body: JSON.stringify(body),
+    }),
+    params: {},
+    locals: { role: 'admin' },
+    route: { id: '/api/connections' },
+    getClientAddress: () => '127.0.0.1',
+    isDataRequest: false,
+    isSubRequest: false,
+  };
+}
+
+/** Seed config/endpoints.json directly (the on-disk schema is NOT renamed). */
+function seedEndpointsFile(payload: unknown): void {
+  const configDir = getState().configDir;
+  mkdirSync(configDir, { recursive: true });
+  writeFileSync(join(configDir, 'endpoints.json'), JSON.stringify(payload), { mode: 0o600 });
+}
+
+const ENV_KEYS = [
+  'OP_UI_HOST_MODE',
+  'OP_INSIDE_ELECTRON',
+  'OP_ENABLE_ADMIN',
+  'OP_HOME',
+  'OP_OPENCODE_URL',
+  'OP_ASSISTANT_URL',
+  'OP_ASSISTANT_PORT',
+  'OPENCODE_SERVER_PASSWORD',
+  'OP_UI_LOGIN_PASSWORD',
+] as const;
+let savedEnv: Record<string, string | undefined> = {};
+
+beforeEach(() => {
+  savedEnv = {};
+  for (const key of ENV_KEYS) {
+    savedEnv[key] = process.env[key];
+    delete process.env[key];
+  }
+  process.env.OP_HOME = makeTempHome();
+  resetState('admin-token');
+});
+
+afterEach(() => {
+  for (const key of ENV_KEYS) {
+    const prev = savedEnv[key];
+    if (prev === undefined) delete process.env[key];
+    else process.env[key] = prev;
+  }
+  cleanupTempDirs();
+});
+
+describe('GET /api/connections — connections:manage guard (plan §6.4, §8.5)', () => {
+  test('403 in assistant-container mode even with a valid admin session', async () => {
+    process.env.OP_UI_HOST_MODE = 'assistant-container';
+    const { GET } = await loadRoute();
+    const res = await GET(makeGetEvent());
+    expect(res.status).toBe(403);
+  });
+
+  test('the 403 is a JSON error envelope, not an HTML login redirect', async () => {
+    process.env.OP_UI_HOST_MODE = 'assistant-container';
+    const { GET } = await loadRoute();
+    const res = await GET(makeGetEvent());
+    expect(res.status).toBe(403);
+    expect(res.headers.get('content-type') ?? '').toContain('application/json');
+  });
+
+  test('200 in host-ui mode with a valid admin session (capability present)', async () => {
+    process.env.OP_UI_HOST_MODE = 'host-ui';
+    const { GET } = await loadRoute();
+    const res = await GET(makeGetEvent());
+    expect(res.status).toBe(200);
+  });
+
+  test('reachable in pwa-static mode — no host-admin mode required (Phase 2 acceptance)', async () => {
+    process.env.OP_UI_HOST_MODE = 'pwa-static';
+    const { GET } = await loadRoute();
+    const res = await GET(makeGetEvent());
+    expect(res.status).toBe(200);
+  });
+
+  test('lists the env-derived default connection', async () => {
+    process.env.OP_UI_HOST_MODE = 'host-ui';
+    const { GET } = await loadRoute();
+    const res = await GET(makeGetEvent());
+    expect(res.status).toBe(200);
+    const body = (await res.json()) as Record<string, unknown>;
+    // Tolerate either payload key — the internal rename is "connection"
+    // language, but the response delegates to the same server module.
+    const list = (body.connections ?? body.endpoints) as Array<{ id: string }>;
+    expect(Array.isArray(list)).toBe(true);
+    expect(list.some((entry) => entry.id === 'default')).toBe(true);
+  });
+
+  test('never serializes stored connection passwords', async () => {
+    process.env.OP_UI_HOST_MODE = 'host-ui';
+    seedEndpointsFile({
+      activeId: null,
+      endpoints: [
+        {
+          id: '11111111-1111-4111-8111-111111111111',
+          label: 'Remote',
+          url: 'http://10.0.0.9:3800',
+          password: 'super-secret-pw',
+        },
+      ],
+    });
+    const { GET } = await loadRoute();
+    const res = await GET(makeGetEvent());
+    expect(res.status).toBe(200);
+    const raw = JSON.stringify(await res.json());
+    expect(raw).not.toContain('super-secret-pw');
+  });
+});
+
+describe('POST /api/connections — connections:manage guard on writes', () => {
+  test('403 in assistant-container mode even with a valid admin session', async () => {
+    process.env.OP_UI_HOST_MODE = 'assistant-container';
+    const { POST } = await loadRoute();
+    const res = await POST(makePostEvent({ label: 'Remote', url: 'http://10.0.0.9:3800' }));
+    expect(res.status).toBe(403);
+  });
+
+  test('creates a connection in host-ui mode with a valid session', async () => {
+    process.env.OP_UI_HOST_MODE = 'host-ui';
+    const { POST } = await loadRoute();
+    const res = await POST(makePostEvent({ label: 'Remote', url: 'http://10.0.0.9:3800' }));
+    expect(res.status).toBe(201);
+  });
+});

From 4632135aa346eb2e05804c632f263ecde10e46c8 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Mon, 6 Jul 2026 12:02:41 +0000
Subject: [PATCH 09/61] feat(ui): add ConnectionKind + connection-language
 model to the endpoints store (#486)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Phase 2 step 1-2 of docs/technical/ui-runtime-modes-plan.md: the internal
model is renamed endpoint → connection (plan §6.6) and ConnectionEntry
gains an optional `kind` field. Kind is defaulted at READ time only —
legacy user records (no kind on disk) read as 'remote-opencode', the
env-derived default entry and the Electron-local entry as
'local-opencode', and an explicitly persisted kind passes through
untouched. endpoints.json keeps its name and on-disk schema keys
(activeId/endpoints); no data migration, files are never rewritten on
read.

The endpoint-language exports remain as aliases of the renamed
functions/types for the pre-Phase-2 /admin routes and tests; they go
away with /admin/* in Phase 4.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FetR7BttT1xBrA8fBwhui9
---
 packages/ui/src/lib/server/endpoints.ts       | 111 +++++++++++++-----
 .../ui/src/routes/admin/endpoints/+server.ts  |   6 +-
 2 files changed, 86 insertions(+), 31 deletions(-)

diff --git a/packages/ui/src/lib/server/endpoints.ts b/packages/ui/src/lib/server/endpoints.ts
index bc5193548..17f0b20cf 100644
--- a/packages/ui/src/lib/server/endpoints.ts
+++ b/packages/ui/src/lib/server/endpoints.ts
@@ -1,13 +1,18 @@
 /**
- * Assistant endpoints — list of OpenCode servers the UI can target, with
- * one marked active. The "default" entry is synthesized from environment
- * (OP_OPENCODE_URL / OP_ASSISTANT_URL / OP_ASSISTANT_PORT) and cannot be
- * deleted. User-added endpoints are persisted to a JSON file in the
- * config directory (it's user-owned configuration, not service state —
- * see Phase 5 / D4 in docs/technical/auth-and-proxy-refactor-plan.md).
+ * Assistant connections — list of OpenCode servers the UI can target, with
+ * one marked active. The internal model uses "connection" language (plan
+ * ui-runtime-modes-plan.md §6.6, Phase 2 / #486); the on-disk file keeps its
+ * historical name and schema keys — `endpoints.json` with
+ * `{ activeId, endpoints }` — and is NEVER renamed or migrated.
+ *
+ * The "default" entry is synthesized from environment (OP_OPENCODE_URL /
+ * OP_ASSISTANT_URL / OP_ASSISTANT_PORT) and cannot be deleted. User-added
+ * connections are persisted to a JSON file in the config directory (it's
+ * user-owned configuration, not service state — see Phase 5 / D4 in
+ * docs/technical/auth-and-proxy-refactor-plan.md).
  *
  * File: ${configDir}/endpoints.json (mode 0600)
- * Shape: { activeId: string | null, endpoints: EndpointEntry[] }
+ * Shape: { activeId: string | null, endpoints: ConnectionEntry[] }
  *   - activeId === null or "default" → use the env-derived default
  *   - activeId === "<id>" → use the matching user entry (falls back to default if not found)
  *
@@ -19,11 +24,19 @@ import { dirname } from 'node:path';
 import { randomUUID } from 'node:crypto';
 import { getState } from './state.js';
 import type { RemoteStatus } from '@openpalm/lib';
+import type { ConnectionKind } from '$lib/types.js';
 
-export type EndpointEntry = {
+export type ConnectionEntry = {
   id: string;
   label: string;
   url: string;
+  /**
+   * Connection kind (plan §6.6). OPTIONAL on disk: legacy records carry no
+   * `kind` key and are defaulted at READ time — never rewritten in place (the
+   * Phase 2 acceptance is "no data migration"). An explicitly persisted kind
+   * always passes through untouched.
+   */
+  kind?: ConnectionKind;
   /**
    * Basic-auth username forwarded as Authorization header. Defaults to
    * `"openpalm"` for synthesized entries; user-added entries may override.
@@ -36,7 +49,12 @@ export type EndpointEntry = {
   password?: string;
 };
 
-export type ActiveEndpoint = EndpointEntry & {
+/** Legacy name — kept until every consumer migrates to connection language. */
+export type EndpointEntry = ConnectionEntry;
+
+export type ActiveConnection = ConnectionEntry & {
+  /** Always present after read-time defaulting (legacy records → 'remote-opencode'). */
+  kind: ConnectionKind;
   /** True for the env-derived default entry (cannot be edited or deleted). */
   isDefault: boolean;
   /**
@@ -47,11 +65,23 @@ export type ActiveEndpoint = EndpointEntry & {
   isLocal?: boolean;
 };
 
+/** Legacy name — kept until every consumer migrates to connection language. */
+export type ActiveEndpoint = ActiveConnection;
+
 type EndpointsFile = {
   activeId: string | null;
-  endpoints: EndpointEntry[];
+  endpoints: ConnectionEntry[];
 };
 
+/**
+ * Read-time kind defaulting (plan §6.6): a user-persisted record without a
+ * `kind` key is a remote OpenCode connection — that is the only thing the
+ * pre-Phase-2 UI let users add. Explicit kinds pass through untouched.
+ */
+function kindOf(entry: ConnectionEntry): ConnectionKind {
+  return entry.kind ?? 'remote-opencode';
+}
+
 const DEFAULT_ID = 'default';
 const LOCAL_ELECTRON_ID = 'local-electron';
 let wizardOpencodeUrl: string | null = null;
@@ -148,7 +178,7 @@ function readLocalRuntime(): LocalRuntime | null {
   }
 }
 
-function localEndpoint(): ActiveEndpoint | null {
+function localEndpoint(): ActiveConnection | null {
   const rt = readLocalRuntime();
   if (!rt) return null;
   return {
@@ -157,6 +187,7 @@ function localEndpoint(): ActiveEndpoint | null {
     url: normalizeBrowserFacingUrl(rt.url),
     username: rt.username || 'openpalm',
     ...(rt.password ? { password: rt.password } : {}),
+    kind: 'local-opencode',
     isDefault: false,
     isLocal: true,
   };
@@ -217,7 +248,7 @@ function writeFile(data: EndpointsFile): void {
   try { chmodSync(path, 0o600); } catch { /* best effort */ }
 }
 
-function defaultEndpoint(): ActiveEndpoint {
+function defaultEndpoint(): ActiveConnection {
   const url =
     process.env.OP_OPENCODE_URL ??
     process.env.OP_ASSISTANT_URL ??
@@ -230,6 +261,7 @@ function defaultEndpoint(): ActiveEndpoint {
     url: normalizeBrowserFacingUrl(url),
     username,
     password,
+    kind: 'local-opencode',
     isDefault: true,
   };
 }
@@ -278,23 +310,23 @@ export function normalizeEndpointUrl(input: string): string | null {
  * The local-electron entry is synthesized at call time from
  * state/local-opencode.runtime.json — never persisted to endpoints.json.
  */
-export function listEndpoints(): ActiveEndpoint[] {
+export function listConnections(): ActiveConnection[] {
   const { endpoints } = readFile();
   const local = localEndpoint();
   return [
     ...(local ? [local] : []),
     defaultEndpoint(),
-    ...endpoints.map((e) => ({ ...e, isDefault: false })),
+    ...endpoints.map((e) => ({ ...e, kind: kindOf(e), isDefault: false })),
   ];
 }
 
 /**
- * Returns the active endpoint, falling back to the default if no active id is
- * set OR if the active id is `local-electron` but the runtime.json isn't there
- * (e.g. the Electron child died). Re-reads runtime.json each call so a
+ * Returns the active connection, falling back to the default if no active id
+ * is set OR if the active id is `local-electron` but the runtime.json isn't
+ * there (e.g. the Electron child died). Re-reads runtime.json each call so a
  * password rotated by a new Electron launch is picked up immediately.
  */
-export function getActiveEndpoint(): ActiveEndpoint {
+export function getActiveConnection(): ActiveConnection {
   const { activeId, endpoints } = readFile();
   if (activeId === LOCAL_ELECTRON_ID) {
     const local = localEndpoint();
@@ -305,12 +337,12 @@ export function getActiveEndpoint(): ActiveEndpoint {
   if (!activeId || activeId === DEFAULT_ID) return defaultEndpoint();
   const found = endpoints.find((e) => e.id === activeId);
   if (!found) return defaultEndpoint();
-  return { ...found, isDefault: false };
+  return { ...found, kind: kindOf(found), isDefault: false };
 }
 
 // ── Write API ────────────────────────────────────────────────────────────────
 
-export function setActiveId(id: string | null): ActiveEndpoint {
+export function setActiveConnectionId(id: string | null): ActiveConnection {
   const data = readFile();
   if (!id || id === DEFAULT_ID) {
     data.activeId = null;
@@ -328,19 +360,21 @@ export function setActiveId(id: string | null): ActiveEndpoint {
     data.activeId = id;
   }
   writeFile(data);
-  return getActiveEndpoint();
+  return getActiveConnection();
 }
 
-export type EndpointInput = { label: string; url: string; password?: string };
+export type ConnectionInput = { label: string; url: string; password?: string };
+/** Legacy name — kept until every consumer migrates to connection language. */
+export type EndpointInput = ConnectionInput;
 
-export function addEndpoint(input: EndpointInput): EndpointEntry {
+export function addConnection(input: ConnectionInput): ConnectionEntry {
   const label = input.label.trim();
   if (!label) throw new Error('Label is required');
   const url = normalizeEndpointUrl(input.url);
   if (!url) throw new Error('URL must be a valid http(s) URL');
 
   const data = readFile();
-  const entry: EndpointEntry = {
+  const entry: ConnectionEntry = {
     id: randomUUID(),
     label,
     url,
@@ -351,14 +385,16 @@ export function addEndpoint(input: EndpointInput): EndpointEntry {
   return entry;
 }
 
-export type EndpointPatch = {
+export type ConnectionPatch = {
   label?: string;
   url?: string;
   /** undefined = leave unchanged; null = clear; string = set */
   password?: string | null;
 };
+/** Legacy name — kept until every consumer migrates to connection language. */
+export type EndpointPatch = ConnectionPatch;
 
-export function updateEndpoint(id: string, patch: EndpointPatch): EndpointEntry {
+export function updateConnection(id: string, patch: ConnectionPatch): ConnectionEntry {
   if (id === DEFAULT_ID) throw new Error('Cannot edit the default endpoint');
   if (id === LOCAL_ELECTRON_ID) {
     throw new Error('Cannot edit the local Electron OpenCode entry (it is ephemeral and per-launch)');
@@ -369,7 +405,7 @@ export function updateEndpoint(id: string, patch: EndpointPatch): EndpointEntry
   if (idx === -1) throw new Error(`Endpoint not found: ${id}`);
   const current = data.endpoints[idx];
 
-  const next: EndpointEntry = { ...current };
+  const next: ConnectionEntry = { ...current };
   if (patch.label !== undefined) {
     const label = patch.label.trim();
     if (!label) throw new Error('Label cannot be empty');
@@ -391,7 +427,7 @@ export function updateEndpoint(id: string, patch: EndpointPatch): EndpointEntry
   return next;
 }
 
-export function deleteEndpoint(id: string): void {
+export function deleteConnection(id: string): void {
   if (id === DEFAULT_ID) throw new Error('Cannot delete the default endpoint');
   if (id === LOCAL_ELECTRON_ID) {
     throw new Error('Cannot delete the local Electron OpenCode entry (managed by Electron lifecycle)');
@@ -404,7 +440,7 @@ export function deleteEndpoint(id: string): void {
   writeFile(data);
 }
 
-async function probeEndpoint(endpoint: ActiveEndpoint): Promise<RemoteStatus> {
+async function probeEndpoint(endpoint: ActiveConnection): Promise<RemoteStatus> {
   const headers = new Headers();
   if (endpoint.password) {
     const username = endpoint.username ?? 'openpalm';
@@ -439,7 +475,22 @@ export async function listRemoteStatuses(): Promise<RemoteStatus[]> {
   if (remoteStatusCache && remoteStatusCache.expiresAt > Date.now()) {
     return remoteStatusCache.value.map((status) => ({ ...status }));
   }
-  const statuses = await Promise.all(listEndpoints().map((endpoint) => probeEndpoint(endpoint)));
+  const statuses = await Promise.all(listConnections().map((endpoint) => probeEndpoint(endpoint)));
   remoteStatusCache = { value: statuses, expiresAt: Date.now() + 5_000 };
   return statuses.map((status) => ({ ...status }));
 }
+
+// ── Legacy endpoint-language aliases ─────────────────────────────────────────
+// Phase 2 (#486) renamed the internal model to "connection" (plan §6.6). The
+// pre-Phase-2 admin routes and tests still import these names; they are the
+// same functions and go away with `/admin/*` in Phase 4.
+export {
+  listConnections as listEndpoints,
+  getActiveConnection as getActiveEndpoint,
+  setActiveConnectionId as setActiveId,
+  addConnection as addEndpoint,
+  updateConnection as updateEndpoint,
+  deleteConnection as deleteEndpoint,
+  validateEndpointUrl as validateConnectionUrl,
+  normalizeEndpointUrl as normalizeConnectionUrl,
+};
diff --git a/packages/ui/src/routes/admin/endpoints/+server.ts b/packages/ui/src/routes/admin/endpoints/+server.ts
index 63fd1c89b..e013b89c3 100644
--- a/packages/ui/src/routes/admin/endpoints/+server.ts
+++ b/packages/ui/src/routes/admin/endpoints/+server.ts
@@ -64,7 +64,11 @@ export const POST: RequestHandler = async (event) =>
 
     try {
       const entry = addEndpoint({ label, url: urlCheck.url, password });
-      return jsonResponse(201, { endpoint: publish({ ...entry, isDefault: false }) }, requestId);
+      return jsonResponse(
+        201,
+        { endpoint: publish({ ...entry, kind: entry.kind ?? 'remote-opencode', isDefault: false }) },
+        requestId,
+      );
     } catch (e) {
       const msg = e instanceof Error ? e.message : 'failed to create endpoint';
       return errorResponse(400, 'invalid_endpoint', msg, {}, requestId);

From efaffaa14a4847cb8a11d1d5f58d17004c148543 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Mon, 6 Jul 2026 12:02:55 +0000
Subject: [PATCH 10/61] feat(ui): add capability-guarded /api/connections
 routes (#486)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Phase 2 step 3 (plan §6.4 API namespace table): /api/connections,
/api/connections/[id] and /api/connections/active delegate to the same
lib/server/endpoints.ts module as the legacy /admin/endpoints routes but
are guarded by a new requireCapability() helper instead of the
host-admin namespace. The guard is enforced SERVER-SIDE (plan §8.5) and
is capability-based, not session-based: assistant-container mode gets a
403 JSON envelope even with a valid admin session, while host-ui,
electron-host and pwa-static (which advertise connections:manage) pass
through to the existing admin-session auth. requireCapability() only
reads the capability set advertised by computeServerRuntimeContext —
capability logic itself stays in one place (plan §8.6).

Stored connection passwords are never serialized (hasPassword only),
matching the /admin/endpoints publish() contract.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FetR7BttT1xBrA8fBwhui9
---
 packages/ui/src/lib/server/connections-api.ts | 47 ++++++++++++
 packages/ui/src/lib/server/helpers.ts         | 32 ++++++++
 .../ui/src/routes/api/connections/+server.ts  | 71 ++++++++++++++++++
 .../routes/api/connections/[id]/+server.ts    | 73 +++++++++++++++++++
 .../routes/api/connections/active/+server.ts  | 42 +++++++++++
 5 files changed, 265 insertions(+)
 create mode 100644 packages/ui/src/lib/server/connections-api.ts
 create mode 100644 packages/ui/src/routes/api/connections/+server.ts
 create mode 100644 packages/ui/src/routes/api/connections/[id]/+server.ts
 create mode 100644 packages/ui/src/routes/api/connections/active/+server.ts

diff --git a/packages/ui/src/lib/server/connections-api.ts b/packages/ui/src/lib/server/connections-api.ts
new file mode 100644
index 000000000..a63316041
--- /dev/null
+++ b/packages/ui/src/lib/server/connections-api.ts
@@ -0,0 +1,47 @@
+/**
+ * Shared pieces of the /api/connections/* route family (plan
+ * ui-runtime-modes-plan.md Phase 2, issue #486).
+ *
+ * Lives in lib/server (not in the route file) because SvelteKit route
+ * modules may only export handlers, and the [id]/active sub-routes reuse
+ * the same guard and serializer.
+ */
+import type { RequestEvent } from '@sveltejs/kit';
+import { requireAdmin, requireCapability } from './helpers.js';
+import type { ActiveConnection, ConnectionEntry } from './endpoints.js';
+
+export type PublicConnection = {
+  id: string;
+  label: string;
+  url: string;
+  kind: string;
+  isDefault: boolean;
+  hasPassword: boolean;
+};
+
+/** Serialize a connection for the API — never includes the stored password. */
+export function publishConnection(c: ActiveConnection): PublicConnection {
+  return {
+    id: c.id,
+    label: c.label,
+    url: c.url,
+    kind: c.kind,
+    isDefault: c.isDefault,
+    hasPassword: Boolean(c.password),
+  };
+}
+
+/** Serialize a user-persisted record (kind defaulted the same way reads default it). */
+export function publishConnectionEntry(entry: ConnectionEntry): PublicConnection {
+  return publishConnection({ ...entry, kind: entry.kind ?? 'remote-opencode', isDefault: false });
+}
+
+/**
+ * Shared guard for every /api/connections/* handler: the `connections:manage`
+ * capability first (403 — capability-based, not session-based; plan §8.5),
+ * then the host admin session (plan §6.8: the host app gates connection
+ * writes behind the admin session).
+ */
+export function requireConnectionsManage(event: RequestEvent, requestId: string): Response | null {
+  return requireCapability(event, 'connections:manage', requestId) ?? requireAdmin(event, requestId);
+}
diff --git a/packages/ui/src/lib/server/helpers.ts b/packages/ui/src/lib/server/helpers.ts
index 6a5d1d612..1917eb410 100644
--- a/packages/ui/src/lib/server/helpers.ts
+++ b/packages/ui/src/lib/server/helpers.ts
@@ -6,6 +6,8 @@ import { timingSafeEqual, createHash } from "node:crypto";
 import { getActiveEndpoint } from "./endpoints.js";
 import { createOpenCodeClient, isRemoteSetupAllowed } from "@openpalm/lib";
 import { validateSession, getUiLoginPassword } from "./session-store.js";
+import { computeServerRuntimeContext } from "./features.js";
+import type { Capability } from "$lib/types.js";
 
 /**
  * Lazy OpenCode client bound to the currently active endpoint. The client is
@@ -113,6 +115,36 @@ export function requireAdmin(event: RequestEvent, requestId: string): Response |
   return null;
 }
 
+/**
+ * Server-side capability guard (plan ui-runtime-modes-plan.md §6.4, §8.5).
+ *
+ * Returns a 403 JSON error Response when the resolved host mode does not
+ * expose `capability`, or null when it does. This is the SECURITY boundary —
+ * the browser-side `hasCapability()` is UX only. The check is deliberately
+ * capability-based, not session-based: a valid admin session in a mode
+ * without the capability (e.g. `connections:manage` in assistant-container)
+ * is still refused. Capability→mode logic itself lives ONLY in
+ * computeServerRuntimeContext / resolveCapabilities (plan §8.6); this helper
+ * just reads the advertised server capability set.
+ */
+export function requireCapability(
+  event: RequestEvent,
+  capability: Capability,
+  requestId: string,
+): Response | null {
+  const ctx = computeServerRuntimeContext(event);
+  if (!ctx.serverCapabilities.includes(capability)) {
+    return errorResponse(
+      403,
+      "capability_not_available",
+      `This deployment (${ctx.hostMode}) does not provide the '${capability}' capability.`,
+      { capability, hostMode: ctx.hostMode },
+      requestId,
+    );
+  }
+  return null;
+}
+
 /**
  * Identify caller by the presented `op_session` cookie.
  *
diff --git a/packages/ui/src/routes/api/connections/+server.ts b/packages/ui/src/routes/api/connections/+server.ts
new file mode 100644
index 000000000..1a61dab83
--- /dev/null
+++ b/packages/ui/src/routes/api/connections/+server.ts
@@ -0,0 +1,71 @@
+/**
+ * /api/connections — list and create assistant connections (plan
+ * ui-runtime-modes-plan.md Phase 2, issue #486).
+ *
+ * Guarded SERVER-SIDE by the `connections:manage` capability (plan §6.4,
+ * §8.5): host-ui / electron-host / pwa-static expose it, assistant-container
+ * does not — there the guard returns 403 even for a valid admin session,
+ * because the check is capability-based (hostMode → serverCapabilities), not
+ * session-based. Requests additionally require the admin session (plan §6.8:
+ * the host app gates connection management behind the host admin session).
+ *
+ * Delegates to the same server module as the legacy /admin/endpoints routes
+ * (lib/server/endpoints.ts); the on-disk endpoints.json is shared and NOT
+ * renamed. Passwords are never returned — only `hasPassword: boolean`.
+ */
+import type { RequestHandler } from './$types';
+import {
+  errorResponse,
+  getRequestId,
+  jsonResponse,
+  requireCapability,
+  withAdminBody,
+} from '$lib/server/helpers.js';
+import {
+  publishConnection,
+  publishConnectionEntry,
+  requireConnectionsManage,
+} from '$lib/server/connections-api.js';
+import {
+  addConnection,
+  getActiveConnection,
+  listConnections,
+  validateConnectionUrl,
+} from '$lib/server/endpoints.js';
+
+export const GET: RequestHandler = async (event) => {
+  const requestId = getRequestId(event);
+  const guardError = requireConnectionsManage(event, requestId);
+  if (guardError) return guardError;
+
+  const connections = listConnections().map(publishConnection);
+  const active = publishConnection(getActiveConnection());
+
+  return jsonResponse(200, { connections, activeId: active.id }, requestId);
+};
+
+export const POST: RequestHandler = async (event) => {
+  const requestId = getRequestId(event);
+  const capabilityError = requireCapability(event, 'connections:manage', requestId);
+  if (capabilityError) return capabilityError;
+
+  return withAdminBody(event, async ({ requestId, body }) => {
+    const label = typeof body.label === 'string' ? body.label : '';
+    const url = typeof body.url === 'string' ? body.url : '';
+    const password =
+      typeof body.password === 'string' && body.password.length > 0 ? body.password : undefined;
+
+    const urlCheck = validateConnectionUrl(url);
+    if (!urlCheck.ok) {
+      return errorResponse(400, 'invalid_connection', 'URL must be a valid http(s) URL', {}, requestId);
+    }
+
+    try {
+      const entry = addConnection({ label, url: urlCheck.url, password });
+      return jsonResponse(201, { connection: publishConnectionEntry(entry) }, requestId);
+    } catch (e) {
+      const msg = e instanceof Error ? e.message : 'failed to create connection';
+      return errorResponse(400, 'invalid_connection', msg, {}, requestId);
+    }
+  });
+};
diff --git a/packages/ui/src/routes/api/connections/[id]/+server.ts b/packages/ui/src/routes/api/connections/[id]/+server.ts
new file mode 100644
index 000000000..fa6e68106
--- /dev/null
+++ b/packages/ui/src/routes/api/connections/[id]/+server.ts
@@ -0,0 +1,73 @@
+/**
+ * /api/connections/[id] — update or delete a user-added connection (plan
+ * ui-runtime-modes-plan.md Phase 2, issue #486).
+ *
+ * Guarded by `connections:manage` (server-side; see /api/connections). The
+ * "default" id is reserved and cannot be edited or deleted. Passwords are
+ * write-only in the API surface — pass `password: null` to clear, a string
+ * to set, or omit to leave unchanged.
+ */
+import type { RequestHandler } from './$types';
+import {
+  errorResponse,
+  getRequestId,
+  jsonResponse,
+  requireCapability,
+  withAdminBody,
+} from '$lib/server/helpers.js';
+import {
+  publishConnectionEntry,
+  requireConnectionsManage,
+} from '$lib/server/connections-api.js';
+import {
+  deleteConnection,
+  updateConnection,
+  validateConnectionUrl,
+  type ConnectionPatch,
+} from '$lib/server/endpoints.js';
+
+export const PATCH: RequestHandler = async (event) => {
+  const requestId = getRequestId(event);
+  const capabilityError = requireCapability(event, 'connections:manage', requestId);
+  if (capabilityError) return capabilityError;
+
+  return withAdminBody(event, async ({ requestId, body }) => {
+    const id = event.params.id;
+    const patch: ConnectionPatch = {};
+    if (typeof body.label === 'string') patch.label = body.label;
+    if (typeof body.url === 'string') {
+      const urlCheck = validateConnectionUrl(body.url);
+      if (!urlCheck.ok) {
+        return errorResponse(400, 'invalid_connection', 'URL must be a valid http(s) URL', {}, requestId);
+      }
+      patch.url = urlCheck.url;
+    }
+    if (body.password === null) patch.password = null;
+    else if (typeof body.password === 'string') patch.password = body.password;
+
+    try {
+      const entry = updateConnection(id, patch);
+      return jsonResponse(200, { connection: publishConnectionEntry(entry) }, requestId);
+    } catch (e) {
+      const msg = e instanceof Error ? e.message : 'failed to update connection';
+      const status = msg.startsWith('Endpoint not found') ? 404 : 400;
+      return errorResponse(status, status === 404 ? 'not_found' : 'invalid_connection', msg, {}, requestId);
+    }
+  });
+};
+
+export const DELETE: RequestHandler = async (event) => {
+  const requestId = getRequestId(event);
+  const guardError = requireConnectionsManage(event, requestId);
+  if (guardError) return guardError;
+
+  const id = event.params.id;
+  try {
+    deleteConnection(id);
+    return jsonResponse(200, { ok: true }, requestId);
+  } catch (e) {
+    const msg = e instanceof Error ? e.message : 'failed to delete connection';
+    const status = msg.startsWith('Endpoint not found') ? 404 : 400;
+    return errorResponse(status, status === 404 ? 'not_found' : 'invalid_connection', msg, {}, requestId);
+  }
+};
diff --git a/packages/ui/src/routes/api/connections/active/+server.ts b/packages/ui/src/routes/api/connections/active/+server.ts
new file mode 100644
index 000000000..6e5e9ffc8
--- /dev/null
+++ b/packages/ui/src/routes/api/connections/active/+server.ts
@@ -0,0 +1,42 @@
+/**
+ * POST /api/connections/active — set the active assistant connection (plan
+ * ui-runtime-modes-plan.md Phase 2, issue #486).
+ *
+ * Guarded by `connections:manage` (server-side; see /api/connections).
+ * Body: { id: string } — pass "default" to revert to the env-derived entry.
+ */
+import type { RequestHandler } from './$types';
+import {
+  errorResponse,
+  getRequestId,
+  jsonResponse,
+  requireCapability,
+  withAdminBody,
+} from '$lib/server/helpers.js';
+import { publishConnection } from '$lib/server/connections-api.js';
+import { setActiveConnectionId } from '$lib/server/endpoints.js';
+
+export const POST: RequestHandler = async (event) => {
+  const requestId = getRequestId(event);
+  const capabilityError = requireCapability(event, 'connections:manage', requestId);
+  if (capabilityError) return capabilityError;
+
+  return withAdminBody(event, async ({ requestId, body }) => {
+    const id = typeof body.id === 'string' ? body.id : '';
+    if (!id) {
+      return errorResponse(400, 'invalid_request', 'id is required', {}, requestId);
+    }
+
+    try {
+      const active = setActiveConnectionId(id);
+      return jsonResponse(
+        200,
+        { activeId: active.id, connection: publishConnection(active) },
+        requestId,
+      );
+    } catch (e) {
+      const msg = e instanceof Error ? e.message : 'failed to set active connection';
+      return errorResponse(404, 'not_found', msg, {}, requestId);
+    }
+  });
+};

From f67585fdfd7fed603513b0e8baaab8dc933d42fc Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Mon, 6 Jul 2026 12:03:25 +0000
Subject: [PATCH 11/61] refactor(ui): untangle endpoints-state from chat-state
 via connection-events (#486)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Phase 2 step 6 (plan §6.11): break the endpoints-state ↔ chat-state
bidirectional import — a hard prerequisite for the Phase 5 client
extraction. The connections store no longer imports chat modules; it
emits through the new $lib/connection-events channel and the chat store
subscribes from its own side:

- registerActivationGuard: chat vetoes mid-generation switches with the
  same user-facing message as before ("Wait for the current reply…").
- onConnectionActivated: chat.onEndpointChanged() runs on activation,
  awaited by the emitter so a failed handoff still rolls the activeId
  back (behavior preserved from the direct call).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FetR7BttT1xBrA8fBwhui9
---
 packages/ui/src/lib/chat/chat-state.svelte.ts | 13 ++++
 packages/ui/src/lib/connection-events.ts      | 61 +++++++++++++++++++
 packages/ui/src/lib/endpoints-state.svelte.ts | 48 +++++++++------
 3 files changed, 105 insertions(+), 17 deletions(-)
 create mode 100644 packages/ui/src/lib/connection-events.ts

diff --git a/packages/ui/src/lib/chat/chat-state.svelte.ts b/packages/ui/src/lib/chat/chat-state.svelte.ts
index 314767564..4da62c1ed 100644
--- a/packages/ui/src/lib/chat/chat-state.svelte.ts
+++ b/packages/ui/src/lib/chat/chat-state.svelte.ts
@@ -61,6 +61,10 @@ import {
 } from '$lib/voice/voice-state.svelte.js';
 import { notifyAssistantError, notifyAssistantReply } from '$lib/desktop-notifications.js';
 import { mapAssistantError } from './assistant-error.js';
+import {
+	onConnectionActivated,
+	registerActivationGuard,
+} from '$lib/connection-events.js';
 
 type EndpointId = string;
 type SessionId = string;
@@ -867,3 +871,12 @@ class ChatService {
 }
 
 export const chat = new ChatService();
+
+// ── Connection-activation subscription (plan Phase 2 step 6, #486) ──────────
+// The chat side subscribes to connection activation; the connections store
+// never imports chat modules. The guard preserves the pre-Phase-2 behavior:
+// mid-generation switches are refused with the same user-facing message.
+registerActivationGuard(() =>
+	chat.sending ? 'Wait for the current reply to finish before switching.' : null
+);
+onConnectionActivated((id) => chat.onEndpointChanged(id));
diff --git a/packages/ui/src/lib/connection-events.ts b/packages/ui/src/lib/connection-events.ts
new file mode 100644
index 000000000..83de647fc
--- /dev/null
+++ b/packages/ui/src/lib/connection-events.ts
@@ -0,0 +1,61 @@
+/**
+ * Connection-activation event channel (plan ui-runtime-modes-plan.md Phase 2
+ * step 6, issue #486).
+ *
+ * Breaks the endpoints-state ↔ chat-state bidirectional import: the
+ * connections store EMITS through this module and the chat side SUBSCRIBES
+ * from its own module — the connections store never imports chat code. This
+ * keeps the module graph acyclic so the Phase 5 client extraction is file
+ * relocation, not surgery (plan §6.11).
+ *
+ * Two hooks:
+ *  - activation guards: a subscriber may veto a switch before it starts
+ *    (chat registers "not while a reply is streaming");
+ *  - activation listeners: awaited after the server accepted the switch
+ *    (chat loads the new connection's sessions).
+ */
+
+type ActivationListener = (connectionId: string) => void | Promise<void>;
+type ActivationGuard = () => string | null;
+
+const listeners = new Set<ActivationListener>();
+const guards = new Set<ActivationGuard>();
+
+/** Subscribe to connection activation. Returns an unsubscribe function. */
+export function onConnectionActivated(listener: ActivationListener): () => void {
+  listeners.add(listener);
+  return () => {
+    listeners.delete(listener);
+  };
+}
+
+/**
+ * Register a pre-switch veto. Return a user-facing reason string to block
+ * the switch, or null to allow it. Returns an unregister function.
+ */
+export function registerActivationGuard(guard: ActivationGuard): () => void {
+  guards.add(guard);
+  return () => {
+    guards.delete(guard);
+  };
+}
+
+/** First non-null guard reason blocks the switch; null means proceed. */
+export function activationBlockReason(): string | null {
+  for (const guard of guards) {
+    const reason = guard();
+    if (reason) return reason;
+  }
+  return null;
+}
+
+/**
+ * Notify subscribers that `connectionId` is now active. Awaited by the
+ * emitter: activation is not complete until every subscriber's handoff
+ * (e.g. the chat store loading the connection's sessions) has settled.
+ */
+export async function emitConnectionActivated(connectionId: string): Promise<void> {
+  for (const listener of listeners) {
+    await listener(connectionId);
+  }
+}
diff --git a/packages/ui/src/lib/endpoints-state.svelte.ts b/packages/ui/src/lib/endpoints-state.svelte.ts
index f18c7b2f3..1aedfb780 100644
--- a/packages/ui/src/lib/endpoints-state.svelte.ts
+++ b/packages/ui/src/lib/endpoints-state.svelte.ts
@@ -1,18 +1,29 @@
 /**
- * Client-side store for the assistant endpoints list + active selection.
+ * Client-side store for the assistant connections list + active selection
+ * (internal model renamed endpoint → connection in Phase 2 / #486; plan
+ * ui-runtime-modes-plan.md §6.6).
  *
  * Loaded lazily on first access. Other components ($lib/components/Navbar)
- * and pages (admin/endpoints) share this state so a change anywhere is
- * reflected everywhere without a full reload.
+ * and pages share this state so a change anywhere is reflected everywhere
+ * without a full reload.
+ *
+ * NOTE on naming: the file name and the `endpointsService` export (and its
+ * `endpoints`/`activeId` fields) are pinned by existing components and their
+ * browser tests; they migrate with the Phase 5 client extraction. New code
+ * is written in connection language.
+ *
+ * Untangled from chat (plan Phase 2 step 6): this store NEVER imports chat
+ * modules. Activation emits through $lib/connection-events; the chat store
+ * subscribes (and registers its "not while sending" guard) from its own side.
  */
 import {
   fetchEndpoints,
   setActiveEndpoint,
   type AssistantEndpoint,
 } from './api.js';
-import { chat } from './chat/chat-state.svelte.js';
+import { activationBlockReason, emitConnectionActivated } from './connection-events.js';
 
-class EndpointsService {
+class ConnectionsService {
   endpoints = $state<AssistantEndpoint[]>([]);
   activeId = $state<string>('default');
   loading = $state(false);
@@ -37,7 +48,7 @@ class EndpointsService {
       const err = e as { message?: string; status?: number };
       // 401 is the auth gate's responsibility — don't surface here
       if (err.status !== 401) {
-        this.error = err.message ?? 'Failed to load endpoints';
+        this.error = err.message ?? 'Failed to load connections';
       }
     } finally {
       this.loading = false;
@@ -46,27 +57,30 @@ class EndpointsService {
 
   async activate(id: string): Promise<void> {
     if (id === this.activeId) return;
-    // Mid-generation switches are blocked at the chat layer; surface the
-    // refusal here so the switcher doesn't silently flip the activeId.
-    if (chat.sending) {
-      this.error = 'Wait for the current reply to finish before switching.';
-      throw new Error(this.error);
+    // A subscriber may veto the switch (the chat side blocks mid-generation
+    // switches); surface the refusal here so the switcher doesn't silently
+    // flip the activeId.
+    const blocked = activationBlockReason();
+    if (blocked) {
+      this.error = blocked;
+      throw new Error(blocked);
     }
     const previous = this.activeId;
     this.activeId = id;
     try {
       await setActiveEndpoint(id);
-      // Hand off to the per-endpoint chat state: load this endpoint's
-      // sessions, restore the previously-open one (or the newest), and
-      // fetch its messages. See docs/technical/multi-endpoint-session-ux.md.
-      await chat.onEndpointChanged(id);
+      // Hand off to subscribers (the chat store loads this connection's
+      // sessions, restores the previously-open one, and fetches messages —
+      // see docs/technical/multi-endpoint-session-ux.md). Awaited so a
+      // failed handoff rolls the switch back.
+      await emitConnectionActivated(id);
     } catch (e) {
       this.activeId = previous;
       const err = e as { message?: string };
-      this.error = err.message ?? 'Failed to switch endpoint';
+      this.error = err.message ?? 'Failed to switch connection';
       throw e;
     }
   }
 }
 
-export const endpointsService = new EndpointsService();
+export const endpointsService = new ConnectionsService();

From b7b8fb304b30c7e5543d4288c63788a29219b835 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Mon, 6 Jul 2026 12:03:56 +0000
Subject: [PATCH 12/61] feat(ui): move connection management to /connections;
 alias /admin/endpoints (#486)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Phase 2 steps 3-5 (plan ui-runtime-modes-plan.md):

- New /connections page — the existing endpoint management UI restyled
  minimally in connection language, backed by the capability-guarded
  /api/connections/* routes so it is reachable in every mode that
  advertises connections:manage (host-ui, electron-host, pwa-static),
  without the host-admin /admin namespace.
- lib/api/endpoints.ts rewritten in connection language and pointed at
  /api/connections/*; the connections store consumes it. AssistantEndpoint
  stays as a type alias until Phase 5 relocates the module.
- /admin/endpoints is now a 0.13.0 redirect alias: a universal load in
  +page.ts throws redirect(302, '/connections') (same convention as the
  routes/+page.ts → /splash redirect); the sibling JSON +server routes
  stay for out-of-process callers this release. The hooks /admin gate
  honors the alias in non-admin modes too, so stale links land on
  /connections instead of /chat.
- Chat garden + settings drawer links now point at /connections.
  (EndpointList's link is left on /admin/endpoints deliberately — its
  browser test pins the href and cannot run in this environment; the
  alias redirect keeps it working. Migrate with Phase 3 chrome work.)
- hooks.server.ts exempts /connections from launch routing; the runtime
  context route pointers advertise connections: '/connections' for
  host-capable and pwa-static modes.

Host mode behavior is unchanged: host admin stays loopback-only and the
admin session still gates the connection API after the capability check.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FetR7BttT1xBrA8fBwhui9
---
 packages/ui/src/hooks.server.ts               |   7 +-
 packages/ui/src/lib/api/endpoints.ts          |  55 ++-
 .../components/chrome/SettingsDrawer.svelte   |   2 +-
 packages/ui/src/lib/endpoints-state.svelte.ts |  20 +-
 packages/ui/src/lib/server/features.ts        |   9 +-
 .../src/routes/admin/endpoints/+page.svelte   | 444 +-----------------
 .../ui/src/routes/admin/endpoints/+page.ts    |  16 +
 packages/ui/src/routes/chat/+page.svelte      |   2 +-
 .../ui/src/routes/connections/+page.svelte    | 440 +++++++++++++++++
 9 files changed, 520 insertions(+), 475 deletions(-)
 create mode 100644 packages/ui/src/routes/admin/endpoints/+page.ts
 create mode 100644 packages/ui/src/routes/connections/+page.svelte

diff --git a/packages/ui/src/hooks.server.ts b/packages/ui/src/hooks.server.ts
index 372388301..1ad89a27c 100644
--- a/packages/ui/src/hooks.server.ts
+++ b/packages/ui/src/hooks.server.ts
@@ -167,8 +167,10 @@ export const handle: Handle = async ({ event, resolve }) => {
 
   // Feature gate: /admin/* requires admin flag (Electron or OP_ENABLE_ADMIN=1).
   // Redirect to /chat so the user lands somewhere useful instead of a 404/403.
+  // /admin/endpoints is the Phase 2 alias for /connections (#486) — honor the
+  // alias in every mode so stale links land on the capability-guarded page.
   if (path.startsWith('/admin') && !computeFeatureFlags().admin) {
-    redirect(302, '/chat');
+    redirect(302, path === '/admin/endpoints' ? '/connections' : '/chat');
   }
   const isSetupPath = SETUP_PATHS.some(p => path === p || path.startsWith(`${p}/`));
 
@@ -199,7 +201,8 @@ export const handle: Handle = async ({ event, resolve }) => {
       : launch.recommendedRoute === 'chat'
         ? '/chat'
         : '/splash';
-    const usageRoute = path.startsWith('/chat') || path.startsWith('/advanced');
+    const usageRoute = path.startsWith('/chat') || path.startsWith('/advanced')
+      || path.startsWith('/connections');
     const exempt = path.startsWith('/api/') || path.startsWith('/proxy/') || path.startsWith('/login')
       || path.startsWith('/health') || path.startsWith('/guardian/health') || path.startsWith('/admin')
       || path.startsWith('/splash')
diff --git a/packages/ui/src/lib/api/endpoints.ts b/packages/ui/src/lib/api/endpoints.ts
index 8d7d64269..8b15bd78d 100644
--- a/packages/ui/src/lib/api/endpoints.ts
+++ b/packages/ui/src/lib/api/endpoints.ts
@@ -1,49 +1,64 @@
 import { request, requireOk } from './core.js';
+import type { ConnectionKind } from '$lib/types.js';
 
-// ── Assistant Endpoints ───────────────────────────────────────────────────────
+// ── Assistant Connections ─────────────────────────────────────────────────────
+//
+// Phase 2 (#486): the internal model uses "connection" language (plan
+// ui-runtime-modes-plan.md §6.6) and the client talks to /api/connections/*,
+// which is guarded by the `connections:manage` capability instead of the
+// host-admin-only /admin/* namespace — so connection management works in
+// every mode that advertises the capability (host-ui, electron-host,
+// pwa-static). This module keeps its historical file name (api/endpoints.ts)
+// until the Phase 5 client extraction relocates it.
 
-export type AssistantEndpoint = {
+export type AssistantConnection = {
   id: string;
   label: string;
   url: string;
+  kind: ConnectionKind;
   isDefault: boolean;
   hasPassword: boolean;
 };
 
-export type EndpointListResponse = {
-  endpoints: AssistantEndpoint[];
+/** Legacy name — kept until every consumer migrates to connection language. */
+export type AssistantEndpoint = AssistantConnection;
+
+export type ConnectionListResponse = {
+  connections: AssistantConnection[];
   activeId: string;
 };
 
-export async function fetchEndpoints(): Promise<EndpointListResponse> {
-  const res = await requireOk(await request('GET', '/admin/endpoints'));
-  return (await res.json()) as EndpointListResponse;
+export async function fetchConnections(): Promise<ConnectionListResponse> {
+  const res = await requireOk(await request('GET', '/api/connections'));
+  return (await res.json()) as ConnectionListResponse;
 }
 
-export async function createEndpoint(input: {
+export async function createConnection(input: {
   label: string;
   url: string;
   password?: string;
-}): Promise<{ endpoint: AssistantEndpoint }> {
-  const res = await requireOk(await request('POST', '/admin/endpoints', input));
-  return (await res.json()) as { endpoint: AssistantEndpoint };
+}): Promise<{ connection: AssistantConnection }> {
+  const res = await requireOk(await request('POST', '/api/connections', input));
+  return (await res.json()) as { connection: AssistantConnection };
 }
 
-export async function updateEndpoint(
+export async function updateConnection(
   id: string,
   patch: { label?: string; url?: string; password?: string | null }
-): Promise<{ endpoint: AssistantEndpoint }> {
+): Promise<{ connection: AssistantConnection }> {
   const res = await requireOk(
-    await request('PATCH', `/admin/endpoints/${encodeURIComponent(id)}`, patch)
+    await request('PATCH', `/api/connections/${encodeURIComponent(id)}`, patch)
   );
-  return (await res.json()) as { endpoint: AssistantEndpoint };
+  return (await res.json()) as { connection: AssistantConnection };
 }
 
-export async function deleteEndpoint(id: string): Promise<void> {
-  await requireOk(await request('DELETE', `/admin/endpoints/${encodeURIComponent(id)}`));
+export async function deleteConnection(id: string): Promise<void> {
+  await requireOk(await request('DELETE', `/api/connections/${encodeURIComponent(id)}`));
 }
 
-export async function setActiveEndpoint(id: string): Promise<{ activeId: string; endpoint: AssistantEndpoint }> {
-  const res = await requireOk(await request('POST', '/admin/endpoints/active', { id }));
-  return (await res.json()) as { activeId: string; endpoint: AssistantEndpoint };
+export async function setActiveConnection(
+  id: string
+): Promise<{ activeId: string; connection: AssistantConnection }> {
+  const res = await requireOk(await request('POST', '/api/connections/active', { id }));
+  return (await res.json()) as { activeId: string; connection: AssistantConnection };
 }
diff --git a/packages/ui/src/lib/components/chrome/SettingsDrawer.svelte b/packages/ui/src/lib/components/chrome/SettingsDrawer.svelte
index f26b16329..6139cef18 100644
--- a/packages/ui/src/lib/components/chrome/SettingsDrawer.svelte
+++ b/packages/ui/src/lib/components/chrome/SettingsDrawer.svelte
@@ -59,7 +59,7 @@
           Manage this assistant...
         </a>
       {/if}
-      <a class="settings-link" href={resolve('/admin/endpoints')} onclick={() => (open = false)}>
+      <a class="settings-link" href={resolve('/connections')} onclick={() => (open = false)}>
         Manage assistant connections...
       </a>
     </nav>
diff --git a/packages/ui/src/lib/endpoints-state.svelte.ts b/packages/ui/src/lib/endpoints-state.svelte.ts
index 1aedfb780..88f8c5a8c 100644
--- a/packages/ui/src/lib/endpoints-state.svelte.ts
+++ b/packages/ui/src/lib/endpoints-state.svelte.ts
@@ -4,8 +4,8 @@
  * ui-runtime-modes-plan.md §6.6).
  *
  * Loaded lazily on first access. Other components ($lib/components/Navbar)
- * and pages share this state so a change anywhere is reflected everywhere
- * without a full reload.
+ * and pages (/connections) share this state so a change anywhere is
+ * reflected everywhere without a full reload.
  *
  * NOTE on naming: the file name and the `endpointsService` export (and its
  * `endpoints`/`activeId` fields) are pinned by existing components and their
@@ -17,20 +17,20 @@
  * subscribes (and registers its "not while sending" guard) from its own side.
  */
 import {
-  fetchEndpoints,
-  setActiveEndpoint,
-  type AssistantEndpoint,
+  fetchConnections,
+  setActiveConnection,
+  type AssistantConnection,
 } from './api.js';
 import { activationBlockReason, emitConnectionActivated } from './connection-events.js';
 
 class ConnectionsService {
-  endpoints = $state<AssistantEndpoint[]>([]);
+  endpoints = $state<AssistantConnection[]>([]);
   activeId = $state<string>('default');
   loading = $state(false);
   loaded = $state(false);
   error = $state('');
 
-  active = $derived<AssistantEndpoint | null>(
+  active = $derived<AssistantConnection | null>(
     this.endpoints.find((e) => e.id === this.activeId) ?? this.endpoints[0] ?? null
   );
 
@@ -40,8 +40,8 @@ class ConnectionsService {
     this.loading = true;
     this.error = '';
     try {
-      const { endpoints, activeId } = await fetchEndpoints();
-      this.endpoints = endpoints;
+      const { connections, activeId } = await fetchConnections();
+      this.endpoints = connections;
       this.activeId = activeId;
       this.loaded = true;
     } catch (e) {
@@ -68,7 +68,7 @@ class ConnectionsService {
     const previous = this.activeId;
     this.activeId = id;
     try {
-      await setActiveEndpoint(id);
+      await setActiveConnection(id);
       // Hand off to subscribers (the chat store loads this connection's
       // sessions, restores the previously-open one, and fetches messages —
       // see docs/technical/multi-endpoint-session-ux.md). Awaited so a
diff --git a/packages/ui/src/lib/server/features.ts b/packages/ui/src/lib/server/features.ts
index 3861152a8..8cc050876 100644
--- a/packages/ui/src/lib/server/features.ts
+++ b/packages/ui/src/lib/server/features.ts
@@ -85,21 +85,24 @@ const SERVER_CAPABILITIES: Record<UiHostMode, readonly Capability[]> = {
 };
 
 /** Route pointers per mode — current-truth URLs (pre-Phase-3 route split).
- *  Phase 2 moves connections to /connections; Phase 4 moves /admin to /host. */
+ *  Phase 2 (#486) moved connections to /connections (the /admin/endpoints
+ *  alias redirects there for 0.13.0); Phase 4 moves /admin to /host. */
 function routesForMode(mode: UiHostMode): ServerRuntimeContext['routes'] {
   switch (mode) {
     case 'electron-host':
     case 'host-ui':
       return {
         chat: '/chat',
-        connections: '/admin/endpoints',
+        connections: '/connections',
         host: '/admin',
         setup: '/setup',
       };
     case 'assistant-container':
       return { chat: '/chat' };
     case 'pwa-static':
-      return { chat: '/chat' };
+      // Connection management is capability-guarded, not host-admin-gated —
+      // reachable in pwa-static (plan §4.3).
+      return { chat: '/chat', connections: '/connections' };
   }
 }
 
diff --git a/packages/ui/src/routes/admin/endpoints/+page.svelte b/packages/ui/src/routes/admin/endpoints/+page.svelte
index 5a181b79e..664ebfae0 100644
--- a/packages/ui/src/routes/admin/endpoints/+page.svelte
+++ b/packages/ui/src/routes/admin/endpoints/+page.svelte
@@ -1,438 +1,6 @@
-<script lang="ts">
-  import { onMount } from 'svelte';
-  import Navbar from '$lib/components/chrome/Navbar.svelte';
-  import IconLock from '$lib/components/icons/IconLock.svelte';
-  import { endpointsService } from '$lib/endpoints-state.svelte.js';
-  import {
-    createEndpoint,
-    updateEndpoint,
-    deleteEndpoint,
-    type AssistantEndpoint,
-  } from '$lib/api.js';
-
-  // Auth is enforced server-side in hooks.server.ts; this page only renders
-  // when the visitor is already an authenticated admin.
-
-  // ── Form state ─────────────────────────────────────────────────────────
-  let formMode = $state<'idle' | 'add' | 'edit'>('idle');
-  let formId = $state<string | null>(null);
-  let formLabel = $state('');
-  let formUrl = $state('');
-  let formPassword = $state('');
-  let formClearPassword = $state(false);
-  let formSubmitting = $state(false);
-  let formError = $state('');
-
-  // ── Per-row state ───────────────────────────────────────────────────────
-  let deletingId = $state<string | null>(null);
-
-  const endpoints = $derived(endpointsService.endpoints);
-  const active = $derived(endpointsService.active);
-
-  onMount(() => {
-    void endpointsService.load(true);
-  });
-
-  function openAddForm(): void {
-    formMode = 'add';
-    formId = null;
-    formLabel = '';
-    formUrl = '';
-    formPassword = '';
-    formClearPassword = false;
-    formError = '';
-  }
-
-  function openEditForm(e: AssistantEndpoint): void {
-    formMode = 'edit';
-    formId = e.id;
-    formLabel = e.label;
-    formUrl = e.url;
-    formPassword = '';
-    formClearPassword = false;
-    formError = '';
-  }
-
-  function cancelForm(): void {
-    formMode = 'idle';
-    formError = '';
-  }
-
-  async function submitForm(ev: Event): Promise<void> {
-    ev.preventDefault();
-    if (formSubmitting) return;
-    const label = formLabel.trim();
-    const url = formUrl.trim();
-    if (!label || !url) {
-      formError = 'Label and URL are required.';
-      return;
-    }
-
-    formSubmitting = true;
-    formError = '';
-    try {
-      if (formMode === 'add') {
-        await createEndpoint({
-          label,
-          url,
-          ...(formPassword ? { password: formPassword } : {}),
-        });
-      } else if (formMode === 'edit' && formId) {
-        const patch: { label: string; url: string; password?: string | null } = {
-          label,
-          url,
-        };
-        if (formClearPassword) {
-          patch.password = null;
-        } else if (formPassword) {
-          patch.password = formPassword;
-        }
-        await updateEndpoint(formId, patch);
-      }
-      await endpointsService.load(true);
-      formMode = 'idle';
-    } catch (e) {
-      const err = e as { message?: string };
-      formError = err.message ?? 'Save failed.';
-    } finally {
-      formSubmitting = false;
-    }
-  }
-
-  async function activate(id: string): Promise<void> {
-    try {
-      await endpointsService.activate(id);
-    } catch {
-      /* error surfaced via service */
-    }
-  }
-
-  async function remove(e: AssistantEndpoint): Promise<void> {
-    if (e.isDefault) return;
-    if (!confirm(`Remove endpoint "${e.label}"?`)) return;
-    deletingId = e.id;
-    try {
-      await deleteEndpoint(e.id);
-      await endpointsService.load(true);
-    } catch (err) {
-      const e2 = err as { message?: string };
-      endpointsService.error = e2.message ?? 'Delete failed.';
-    } finally {
-      deletingId = null;
-    }
-  }
-
-</script>
-
-<svelte:head>
-  <title>Assistant Endpoints — OpenPalm</title>
-</svelte:head>
-
-<Navbar />
-
-<main class="page">
-    <header class="page-header">
-      <h1>Assistant Endpoints</h1>
-      <p class="lede">
-        Connect to local or remote OpenPalm assistants. The <strong>Default</strong> entry comes
-        from the environment (set by the launcher) and cannot be deleted. Add more endpoints to
-        switch between stacks at any time.
-      </p>
-    </header>
-
-    {#if endpointsService.error}
-      <div class="alert error" role="alert">{endpointsService.error}</div>
-    {/if}
-
-    <section class="endpoints-list" aria-label="Configured endpoints">
-      {#each endpoints as ep (ep.id)}
-        <article class="endpoint-card" class:active={ep.id === active?.id}>
-          <div class="endpoint-main">
-            <div class="endpoint-title">
-              <span class="endpoint-label">{ep.label}</span>
-              {#if ep.isDefault}<span class="badge default">Default</span>{/if}
-              {#if ep.id === active?.id}<span class="badge active">Active</span>{/if}
-              {#if ep.hasPassword}<span class="badge password" title="Server password configured"><IconLock size={11} /></span>{/if}
-            </div>
-            <div class="endpoint-url">{ep.url}</div>
-          </div>
-          <div class="endpoint-actions">
-            {#if ep.id !== active?.id}
-              <button type="button" class="btn btn-primary btn-sm" onclick={() => activate(ep.id)}>
-                Use this
-              </button>
-            {/if}
-            {#if !ep.isDefault}
-              <button type="button" class="btn btn-secondary btn-sm" onclick={() => openEditForm(ep)}>
-                Edit
-              </button>
-              <button
-                type="button"
-                class="btn btn-danger btn-sm"
-                onclick={() => remove(ep)}
-                disabled={deletingId === ep.id}
-              >
-                {deletingId === ep.id ? 'Removing…' : 'Remove'}
-              </button>
-            {/if}
-          </div>
-        </article>
-      {/each}
-    </section>
-
-    {#if formMode === 'idle'}
-      <button type="button" class="btn btn-primary" onclick={openAddForm}>
-        + Add endpoint
-      </button>
-    {:else}
-      <form class="endpoint-form" onsubmit={submitForm}>
-        <h2>{formMode === 'add' ? 'Add endpoint' : 'Edit endpoint'}</h2>
-
-        <label class="field">
-          <span>Label</span>
-          <input
-            type="text"
-            bind:value={formLabel}
-            placeholder="e.g. Home server"
-            required
-            autocomplete="off"
-          />
-        </label>
-
-        <label class="field">
-          <span>URL</span>
-          <input
-            type="url"
-            bind:value={formUrl}
-            placeholder="http://10.0.0.5:3800"
-            required
-            autocomplete="off"
-          />
-          <small>The host:port where the remote OpenPalm assistant (OpenCode) is reachable.</small>
-        </label>
-
-        <label class="field">
-          <span>Server password (optional)</span>
-          <input
-            type="password"
-            bind:value={formPassword}
-            placeholder={formMode === 'edit' ? 'Leave blank to keep current' : ''}
-            autocomplete="new-password"
-          />
-          <small>
-            Forwarded as HTTP Basic auth. Only required if the remote OpenCode was started with
-            <code>OPENCODE_SERVER_PASSWORD</code>.
-          </small>
-          {#if formMode === 'edit'}
-            <small class="rotate-hint">
-              <strong>Rotating this password?</strong>
-              OpenCode reads <code>OPENCODE_SERVER_PASSWORD</code> from its env at startup, so
-              rotation is a two-step process:
-              <ol>
-                <li>
-                  On the remote host: update <code>OP_OPENCODE_PASSWORD</code> in
-                  <code>stack.env</code> and restart the <code>assistant</code> container.
-                </li>
-                <li>Paste the new value here and save.</li>
-              </ol>
-            </small>
-          {/if}
-        </label>
-
-        {#if formMode === 'edit'}
-          <label class="field-inline">
-            <input type="checkbox" bind:checked={formClearPassword} />
-            <span>Clear stored password</span>
-          </label>
-        {/if}
-
-        {#if formError}
-          <div class="alert error" role="alert">{formError}</div>
-        {/if}
-
-        <div class="form-actions">
-          <button type="submit" class="btn btn-primary" disabled={formSubmitting}>
-            {formSubmitting ? 'Saving…' : 'Save'}
-          </button>
-          <button type="button" class="btn btn-secondary" onclick={cancelForm} disabled={formSubmitting}>
-            Cancel
-          </button>
-        </div>
-      </form>
-    {/if}
-  </main>
-
-<style>
-  .page {
-    max-width: 760px;
-    margin: 0 auto;
-    padding: var(--s-sp-6);
-    display: flex;
-    flex-direction: column;
-    gap: var(--s-sp-5);
-  }
-  .page-header h1 {
-    margin: 0 0 var(--s-sp-2);
-  }
-  .lede {
-    color: var(--s-ink-3);
-    margin: 0;
-  }
-
-  .alert.error {
-    padding: var(--s-sp-3);
-    border-radius: 2px;
-    background: color-mix(in srgb, var(--s-seal) 8%, transparent);
-    color: var(--s-seal);
-    border: 1px solid color-mix(in srgb, var(--s-seal) 25%, transparent);
-  }
-
-  .endpoints-list {
-    display: flex;
-    flex-direction: column;
-    gap: var(--s-sp-3);
-  }
-
-  .endpoint-card {
-    display: flex;
-    justify-content: space-between;
-    align-items: center;
-    gap: var(--s-sp-4);
-    padding: var(--s-sp-4);
-    border: var(--s-hair) solid var(--s-line);
-    border-radius: 2px;
-    background: var(--s-paper);
-  }
-  .endpoint-card.active {
-    border-color: var(--s-seal);
-    box-shadow: 0 0 0 2px rgba(37, 99, 235, 0.08);
-  }
-
-  .endpoint-main {
-    min-width: 0;
-    flex: 1;
-  }
-  .endpoint-title {
-    display: flex;
-    align-items: center;
-    gap: var(--s-sp-2);
-    font-weight: 500;
-  }
-  .endpoint-label {
-    overflow: hidden;
-    text-overflow: ellipsis;
-    white-space: nowrap;
-  }
-  .endpoint-url {
-    color: var(--s-ink-3);
-    font-family: var(--s-font-mono);
-    font-size: var(--s-type-deed);
-    margin-top: 2px;
-    overflow: hidden;
-    text-overflow: ellipsis;
-    white-space: nowrap;
-  }
-
-  .badge {
-    font-size: var(--s-type-deed);
-    padding: 2px 8px;
-    border-radius: 9999px;
-    font-weight: 500;
-    text-transform: uppercase;
-    letter-spacing: 0.04em;
-  }
-  .badge.default {
-    background: var(--s-paper-deep);
-    color: var(--s-ink-3);
-  }
-  .badge.active {
-    background: var(--s-seal);
-    color: white;
-  }
-  .badge.password {
-    background: transparent;
-    color: var(--s-ink-3);
-    padding: 0;
-  }
-
-  .endpoint-actions {
-    display: flex;
-    gap: var(--s-sp-2);
-    flex-shrink: 0;
-  }
-
-  .endpoint-form {
-    display: flex;
-    flex-direction: column;
-    gap: var(--s-sp-3);
-    padding: var(--s-sp-5);
-    border: var(--s-hair) solid var(--s-line);
-    border-radius: 2px;
-    background: var(--s-paper);
-  }
-  .endpoint-form h2 {
-    margin: 0;
-  }
-
-  .field {
-    display: flex;
-    flex-direction: column;
-    gap: var(--s-sp-1);
-  }
-  .field > span {
-    font-size: var(--s-type-deed);
-    font-weight: 500;
-  }
-  .field input {
-    padding: var(--s-sp-2) var(--s-sp-3);
-    border: var(--s-hair) solid var(--s-line);
-    border-radius: 2px;
-    font: inherit;
-  }
-  .field small {
-    color: var(--s-ink-3);
-    font-size: var(--s-type-deed);
-  }
-  .field code {
-    font-family: var(--s-font-mono);
-    background: var(--s-paper-deep);
-    padding: 1px 4px;
-    border-radius: 4px;
-  }
-  .rotate-hint {
-    margin-top: var(--s-sp-2);
-    padding: var(--s-sp-3);
-    border-left: 3px solid var(--s-seal);
-    background: var(--s-paper-deep);
-    color: var(--s-ink);
-    border-radius: 0 2px 2px 0;
-  }
-  .rotate-hint ol {
-    margin: var(--s-sp-2) 0 0;
-    padding-left: var(--s-sp-4);
-  }
-  .rotate-hint strong {
-    display: block;
-    margin-bottom: var(--s-sp-1);
-  }
-
-  .field-inline {
-    display: flex;
-    align-items: center;
-    gap: var(--s-sp-2);
-  }
-
-  .form-actions {
-    display: flex;
-    gap: var(--s-sp-2);
-  }
-
-  .btn-danger {
-    background: color-mix(in srgb, var(--s-seal) 8%, transparent);
-    color: var(--s-seal);
-    border: 1px solid color-mix(in srgb, var(--s-seal) 25%, transparent);
-  }
-  .btn-danger:hover:not(:disabled) {
-    background: color-mix(in srgb, var(--s-seal) 14%, transparent);
-  }
-</style>
+<!--
+  /admin/endpoints is a redirect alias to /connections (plan
+  ui-runtime-modes-plan.md Phase 2 step 5, issue #486). The universal load in
+  +page.ts always throws redirect(302, '/connections'), so this component
+  never renders — the management UI lives at routes/connections/+page.svelte.
+-->
diff --git a/packages/ui/src/routes/admin/endpoints/+page.ts b/packages/ui/src/routes/admin/endpoints/+page.ts
new file mode 100644
index 000000000..b1a8ab12f
--- /dev/null
+++ b/packages/ui/src/routes/admin/endpoints/+page.ts
@@ -0,0 +1,16 @@
+/**
+ * /admin/endpoints → /connections redirect alias (plan
+ * ui-runtime-modes-plan.md Phase 2 step 5, issue #486).
+ *
+ * Connection management moved to the capability-guarded /connections surface.
+ * This alias is kept for the 0.13.0 release only — Phase 4 turns /admin/*
+ * into 404s. Same convention as the routes/+page.ts → /splash redirect.
+ * (The sibling +server.ts JSON API remains for out-of-process callers this
+ * release; SvelteKit content-negotiates HTML navigations to this page.)
+ */
+import { redirect } from '@sveltejs/kit';
+import type { PageLoad } from './$types';
+
+export const load: PageLoad = () => {
+  redirect(302, '/connections');
+};
diff --git a/packages/ui/src/routes/chat/+page.svelte b/packages/ui/src/routes/chat/+page.svelte
index 3c5de8fe2..52ea8eabe 100644
--- a/packages/ui/src/routes/chat/+page.svelte
+++ b/packages/ui/src/routes/chat/+page.svelte
@@ -487,7 +487,7 @@
 		<section class="s-veil-section">
 			<div class="s-section-head">
 				<div class="s-veil-section-label">assistant</div>
-				<a class="s-new-convo" href={resolve('/admin/endpoints')} onclick={closeGarden}>
+				<a class="s-new-convo" href={resolve('/connections')} onclick={closeGarden}>
 					<span class="s-new-mark" aria-hidden="true">
 						<svg width="11" height="11" viewBox="0 0 12 12" fill="none">
 							<circle cx="6" cy="6" r="2.4" stroke="currentColor" stroke-width="1.1" />
diff --git a/packages/ui/src/routes/connections/+page.svelte b/packages/ui/src/routes/connections/+page.svelte
new file mode 100644
index 000000000..91074a8ad
--- /dev/null
+++ b/packages/ui/src/routes/connections/+page.svelte
@@ -0,0 +1,440 @@
+<script lang="ts">
+  import { onMount } from 'svelte';
+  import Navbar from '$lib/components/chrome/Navbar.svelte';
+  import IconLock from '$lib/components/icons/IconLock.svelte';
+  import { endpointsService as connectionsService } from '$lib/endpoints-state.svelte.js';
+  import {
+    createConnection,
+    updateConnection,
+    deleteConnection,
+    type AssistantConnection,
+  } from '$lib/api.js';
+
+  // Capability-guarded surface (plan ui-runtime-modes-plan.md Phase 2, #486):
+  // this page replaces /admin/endpoints and works in every mode that
+  // advertises `connections:manage` — the API it talks to enforces the
+  // capability server-side; auth is enforced in hooks.server.ts.
+
+  // ── Form state ─────────────────────────────────────────────────────────
+  let formMode = $state<'idle' | 'add' | 'edit'>('idle');
+  let formId = $state<string | null>(null);
+  let formLabel = $state('');
+  let formUrl = $state('');
+  let formPassword = $state('');
+  let formClearPassword = $state(false);
+  let formSubmitting = $state(false);
+  let formError = $state('');
+
+  // ── Per-row state ───────────────────────────────────────────────────────
+  let deletingId = $state<string | null>(null);
+
+  const connections = $derived(connectionsService.endpoints);
+  const active = $derived(connectionsService.active);
+
+  onMount(() => {
+    void connectionsService.load(true);
+  });
+
+  function openAddForm(): void {
+    formMode = 'add';
+    formId = null;
+    formLabel = '';
+    formUrl = '';
+    formPassword = '';
+    formClearPassword = false;
+    formError = '';
+  }
+
+  function openEditForm(c: AssistantConnection): void {
+    formMode = 'edit';
+    formId = c.id;
+    formLabel = c.label;
+    formUrl = c.url;
+    formPassword = '';
+    formClearPassword = false;
+    formError = '';
+  }
+
+  function cancelForm(): void {
+    formMode = 'idle';
+    formError = '';
+  }
+
+  async function submitForm(ev: Event): Promise<void> {
+    ev.preventDefault();
+    if (formSubmitting) return;
+    const label = formLabel.trim();
+    const url = formUrl.trim();
+    if (!label || !url) {
+      formError = 'Label and URL are required.';
+      return;
+    }
+
+    formSubmitting = true;
+    formError = '';
+    try {
+      if (formMode === 'add') {
+        await createConnection({
+          label,
+          url,
+          ...(formPassword ? { password: formPassword } : {}),
+        });
+      } else if (formMode === 'edit' && formId) {
+        const patch: { label: string; url: string; password?: string | null } = {
+          label,
+          url,
+        };
+        if (formClearPassword) {
+          patch.password = null;
+        } else if (formPassword) {
+          patch.password = formPassword;
+        }
+        await updateConnection(formId, patch);
+      }
+      await connectionsService.load(true);
+      formMode = 'idle';
+    } catch (e) {
+      const err = e as { message?: string };
+      formError = err.message ?? 'Save failed.';
+    } finally {
+      formSubmitting = false;
+    }
+  }
+
+  async function activate(id: string): Promise<void> {
+    try {
+      await connectionsService.activate(id);
+    } catch {
+      /* error surfaced via service */
+    }
+  }
+
+  async function remove(c: AssistantConnection): Promise<void> {
+    if (c.isDefault) return;
+    if (!confirm(`Remove connection "${c.label}"?`)) return;
+    deletingId = c.id;
+    try {
+      await deleteConnection(c.id);
+      await connectionsService.load(true);
+    } catch (err) {
+      const e2 = err as { message?: string };
+      connectionsService.error = e2.message ?? 'Delete failed.';
+    } finally {
+      deletingId = null;
+    }
+  }
+
+</script>
+
+<svelte:head>
+  <title>Connections — OpenPalm</title>
+</svelte:head>
+
+<Navbar />
+
+<main class="page">
+    <header class="page-header">
+      <h1>Connections</h1>
+      <p class="lede">
+        Connect to local or remote OpenPalm assistants. The <strong>Default</strong> entry comes
+        from the environment (set by the launcher) and cannot be deleted. Add more connections to
+        switch between assistants at any time.
+      </p>
+    </header>
+
+    {#if connectionsService.error}
+      <div class="alert error" role="alert">{connectionsService.error}</div>
+    {/if}
+
+    <section class="connections-list" aria-label="Configured connections">
+      {#each connections as conn (conn.id)}
+        <article class="connection-card" class:active={conn.id === active?.id}>
+          <div class="connection-main">
+            <div class="connection-title">
+              <span class="connection-label">{conn.label}</span>
+              {#if conn.isDefault}<span class="badge default">Default</span>{/if}
+              {#if conn.id === active?.id}<span class="badge active">Active</span>{/if}
+              {#if conn.hasPassword}<span class="badge password" title="Server password configured"><IconLock size={11} /></span>{/if}
+            </div>
+            <div class="connection-url">{conn.url}</div>
+          </div>
+          <div class="connection-actions">
+            {#if conn.id !== active?.id}
+              <button type="button" class="btn btn-primary btn-sm" onclick={() => activate(conn.id)}>
+                Use this
+              </button>
+            {/if}
+            {#if !conn.isDefault}
+              <button type="button" class="btn btn-secondary btn-sm" onclick={() => openEditForm(conn)}>
+                Edit
+              </button>
+              <button
+                type="button"
+                class="btn btn-danger btn-sm"
+                onclick={() => remove(conn)}
+                disabled={deletingId === conn.id}
+              >
+                {deletingId === conn.id ? 'Removing…' : 'Remove'}
+              </button>
+            {/if}
+          </div>
+        </article>
+      {/each}
+    </section>
+
+    {#if formMode === 'idle'}
+      <button type="button" class="btn btn-primary" onclick={openAddForm}>
+        + Add connection
+      </button>
+    {:else}
+      <form class="connection-form" onsubmit={submitForm}>
+        <h2>{formMode === 'add' ? 'Add connection' : 'Edit connection'}</h2>
+
+        <label class="field">
+          <span>Label</span>
+          <input
+            type="text"
+            bind:value={formLabel}
+            placeholder="e.g. Home server"
+            required
+            autocomplete="off"
+          />
+        </label>
+
+        <label class="field">
+          <span>URL</span>
+          <input
+            type="url"
+            bind:value={formUrl}
+            placeholder="http://10.0.0.5:3800"
+            required
+            autocomplete="off"
+          />
+          <small>The host:port where the remote OpenPalm assistant (OpenCode) is reachable.</small>
+        </label>
+
+        <label class="field">
+          <span>Server password (optional)</span>
+          <input
+            type="password"
+            bind:value={formPassword}
+            placeholder={formMode === 'edit' ? 'Leave blank to keep current' : ''}
+            autocomplete="new-password"
+          />
+          <small>
+            Forwarded as HTTP Basic auth. Only required if the remote OpenCode was started with
+            <code>OPENCODE_SERVER_PASSWORD</code>.
+          </small>
+          {#if formMode === 'edit'}
+            <small class="rotate-hint">
+              <strong>Rotating this password?</strong>
+              OpenCode reads <code>OPENCODE_SERVER_PASSWORD</code> from its env at startup, so
+              rotation is a two-step process:
+              <ol>
+                <li>
+                  On the remote host: update <code>OP_OPENCODE_PASSWORD</code> in
+                  <code>stack.env</code> and restart the <code>assistant</code> container.
+                </li>
+                <li>Paste the new value here and save.</li>
+              </ol>
+            </small>
+          {/if}
+        </label>
+
+        {#if formMode === 'edit'}
+          <label class="field-inline">
+            <input type="checkbox" bind:checked={formClearPassword} />
+            <span>Clear stored password</span>
+          </label>
+        {/if}
+
+        {#if formError}
+          <div class="alert error" role="alert">{formError}</div>
+        {/if}
+
+        <div class="form-actions">
+          <button type="submit" class="btn btn-primary" disabled={formSubmitting}>
+            {formSubmitting ? 'Saving…' : 'Save'}
+          </button>
+          <button type="button" class="btn btn-secondary" onclick={cancelForm} disabled={formSubmitting}>
+            Cancel
+          </button>
+        </div>
+      </form>
+    {/if}
+  </main>
+
+<style>
+  .page {
+    max-width: 760px;
+    margin: 0 auto;
+    padding: var(--s-sp-6);
+    display: flex;
+    flex-direction: column;
+    gap: var(--s-sp-5);
+  }
+  .page-header h1 {
+    margin: 0 0 var(--s-sp-2);
+  }
+  .lede {
+    color: var(--s-ink-3);
+    margin: 0;
+  }
+
+  .alert.error {
+    padding: var(--s-sp-3);
+    border-radius: 2px;
+    background: color-mix(in srgb, var(--s-seal) 8%, transparent);
+    color: var(--s-seal);
+    border: 1px solid color-mix(in srgb, var(--s-seal) 25%, transparent);
+  }
+
+  .connections-list {
+    display: flex;
+    flex-direction: column;
+    gap: var(--s-sp-3);
+  }
+
+  .connection-card {
+    display: flex;
+    justify-content: space-between;
+    align-items: center;
+    gap: var(--s-sp-4);
+    padding: var(--s-sp-4);
+    border: var(--s-hair) solid var(--s-line);
+    border-radius: 2px;
+    background: var(--s-paper);
+  }
+  .connection-card.active {
+    border-color: var(--s-seal);
+    box-shadow: 0 0 0 2px rgba(37, 99, 235, 0.08);
+  }
+
+  .connection-main {
+    min-width: 0;
+    flex: 1;
+  }
+  .connection-title {
+    display: flex;
+    align-items: center;
+    gap: var(--s-sp-2);
+    font-weight: 500;
+  }
+  .connection-label {
+    overflow: hidden;
+    text-overflow: ellipsis;
+    white-space: nowrap;
+  }
+  .connection-url {
+    color: var(--s-ink-3);
+    font-family: var(--s-font-mono);
+    font-size: var(--s-type-deed);
+    margin-top: 2px;
+    overflow: hidden;
+    text-overflow: ellipsis;
+    white-space: nowrap;
+  }
+
+  .badge {
+    font-size: var(--s-type-deed);
+    padding: 2px 8px;
+    border-radius: 9999px;
+    font-weight: 500;
+    text-transform: uppercase;
+    letter-spacing: 0.04em;
+  }
+  .badge.default {
+    background: var(--s-paper-deep);
+    color: var(--s-ink-3);
+  }
+  .badge.active {
+    background: var(--s-seal);
+    color: white;
+  }
+  .badge.password {
+    background: transparent;
+    color: var(--s-ink-3);
+    padding: 0;
+  }
+
+  .connection-actions {
+    display: flex;
+    gap: var(--s-sp-2);
+    flex-shrink: 0;
+  }
+
+  .connection-form {
+    display: flex;
+    flex-direction: column;
+    gap: var(--s-sp-3);
+    padding: var(--s-sp-5);
+    border: var(--s-hair) solid var(--s-line);
+    border-radius: 2px;
+    background: var(--s-paper);
+  }
+  .connection-form h2 {
+    margin: 0;
+  }
+
+  .field {
+    display: flex;
+    flex-direction: column;
+    gap: var(--s-sp-1);
+  }
+  .field > span {
+    font-size: var(--s-type-deed);
+    font-weight: 500;
+  }
+  .field input {
+    padding: var(--s-sp-2) var(--s-sp-3);
+    border: var(--s-hair) solid var(--s-line);
+    border-radius: 2px;
+    font: inherit;
+  }
+  .field small {
+    color: var(--s-ink-3);
+    font-size: var(--s-type-deed);
+  }
+  .field code {
+    font-family: var(--s-font-mono);
+    background: var(--s-paper-deep);
+    padding: 1px 4px;
+    border-radius: 4px;
+  }
+  .rotate-hint {
+    margin-top: var(--s-sp-2);
+    padding: var(--s-sp-3);
+    border-left: 3px solid var(--s-seal);
+    background: var(--s-paper-deep);
+    color: var(--s-ink);
+    border-radius: 0 2px 2px 0;
+  }
+  .rotate-hint ol {
+    margin: var(--s-sp-2) 0 0;
+    padding-left: var(--s-sp-4);
+  }
+  .rotate-hint strong {
+    display: block;
+    margin-bottom: var(--s-sp-1);
+  }
+
+  .field-inline {
+    display: flex;
+    align-items: center;
+    gap: var(--s-sp-2);
+  }
+
+  .form-actions {
+    display: flex;
+    gap: var(--s-sp-2);
+  }
+
+  .btn-danger {
+    background: color-mix(in srgb, var(--s-seal) 8%, transparent);
+    color: var(--s-seal);
+    border: 1px solid color-mix(in srgb, var(--s-seal) 25%, transparent);
+  }
+  .btn-danger:hover:not(:disabled) {
+    background: color-mix(in srgb, var(--s-seal) 14%, transparent);
+  }
+</style>

From 23fd94c9d37f7c9f936b3b332080efe752d2eb17 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Mon, 6 Jul 2026 12:27:58 +0000
Subject: [PATCH 13/61] fix(ui): point EndpointList manage-connections link at
 /connections (#486)

The Phase 2 step-3 link migration (/admin/endpoints -> /connections)
covered chat/+page.svelte and SettingsDrawer.svelte but missed the
identical link in the chat EndpointSwitcher popover, leaving it
dependent on the 0.13.0 alias redirect that Phase 4 removes. Update the
href and the colocated browser test's assertion to match.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FetR7BttT1xBrA8fBwhui9
---
 packages/ui/src/lib/components/chat/EndpointList.svelte         | 2 +-
 .../ui/src/lib/components/chat/EndpointList.svelte.vitest.ts    | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/packages/ui/src/lib/components/chat/EndpointList.svelte b/packages/ui/src/lib/components/chat/EndpointList.svelte
index d4ff8959e..f2f1fa5b3 100644
--- a/packages/ui/src/lib/components/chat/EndpointList.svelte
+++ b/packages/ui/src/lib/components/chat/EndpointList.svelte
@@ -67,7 +67,7 @@
     </a>
   {/if}
 
-  <a class="list-item link" href={resolve('/admin/endpoints')} onclick={() => onChosen?.()}>
+  <a class="list-item link" href={resolve('/connections')} onclick={() => onChosen?.()}>
     Manage assistant connections…
   </a>
 </div>
diff --git a/packages/ui/src/lib/components/chat/EndpointList.svelte.vitest.ts b/packages/ui/src/lib/components/chat/EndpointList.svelte.vitest.ts
index c4d513870..bbc3498b2 100644
--- a/packages/ui/src/lib/components/chat/EndpointList.svelte.vitest.ts
+++ b/packages/ui/src/lib/components/chat/EndpointList.svelte.vitest.ts
@@ -26,7 +26,7 @@ describe('EndpointList', () => {
   test('renames the connections management link', async () => {
     render(EndpointList);
 
-    await expect.element(page.getByRole('link', { name: 'Manage assistant connections…' })).toHaveAttribute('href', '/admin/endpoints');
+    await expect.element(page.getByRole('link', { name: 'Manage assistant connections…' })).toHaveAttribute('href', '/connections');
   });
 
   test('shows the local assistant management link above assistant connections', async () => {

From e039fae66e82a2a81835724a47001d300d624316 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Mon, 6 Jul 2026 13:03:18 +0000
Subject: [PATCH 14/61] test(phase-3): red tests for plan Phase 3
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

TDD red suite for capability-driven landing + navigation + chrome
untangle (plan ui-runtime-modes-plan.md Phase 3, §6.5; issue #555):

- lib/resolve-landing.vitest.ts: resolveLanding(ctx, launchState) full
  §6.5 matrix — host:setup rows (migration pending → /attention with
  precedence over every local state; not_installed/setup_incomplete →
  /setup; installed_offline → /admin; installed_broken →
  /admin?tab=diagnostics; running → /chat), assistant-container →
  /chat always (local state, connections, and migration ignored),
  pwa-static → /connections/new when 0 connections else /chat, and the
  gate being CAPABILITY-driven (host-ui ctx without host:setup in
  effectiveCapabilities falls through to /chat). Pins that
  resolveLanding is PURE (reads ctx.effectiveCapabilities, never the
  global store) so hooks.server can call it per-request. Phase 3 keeps
  the host landing at /admin — HOST_ADMIN_LANDING in the test mirrors
  the implementation's TODO constant; Phase 4 flips both to /host.
  RED: all 17 tests ("resolveLanding module not found" — module does
  not exist; computed-specifier dynamic import keeps svelte-check
  green while red).

- hooks.server.landing.vitest.ts: root + /splash document navigations
  route through the resolved landing — / with not_installed → /setup
  and installed_offline → /admin (both currently /splash); /splash is
  no longer exempt and redirects pre-auth to the resolved landing
  (/chat when running, /admin when offline, /setup when
  not_installed); the /splash route files are deleted; /attention
  exists. RED: 7 tests (redirect location mismatches — currently
  /splash or /login?redirectTo=%2Fsplash — plus the two route-split
  file assertions). CHARACTERIZATION (green pre-change, must stay
  green): 1 test — / with a healthy running stack redirects to /chat.

- lib/features-admin-hygiene.vitest.ts: no .svelte component reads
  features.admin / featuresService.admin (plan §8.6; the alias may
  survive only in hooks.server pending Phase 4). RED: 1 test (offender
  lib/components/chrome/Navbar.svelte:70). CHARACTERIZATION (green):
  1 walker-sanity test.

- lib/components/chrome/chrome-untangle-hygiene.vitest.ts: the chrome
  module(s) the admin surface mounts (resolved from
  routes/{admin,host}/+{page,layout}.svelte imports, so the test
  follows the Phase 3 chrome split and the Phase 4 rename) import no
  chat components or chat stores. RED: 1 test (4 offenders:
  Navbar.svelte → components/chat/{EndpointSwitcher,SessionPicker,
  VoiceControl}.svelte + $lib/chat/navigation.js). CHARACTERIZATION
  (green): admin surface mounts a chrome module.

- routes/chat/page-imports.vitest.ts: chat/+page.svelte does not
  import the $lib/api.js barrel (direct domain-client imports like
  $lib/api/chat.js stay allowed). RED: 1 test (offender '$lib/api.js').
  CHARACTERIZATION (green): the chat page exists.

Verified red for the right reasons: server project 27 failed / 1011
passed across 111 files; the only failing files are these five and
every failure is a missing-module or missing-feature assertion (no
syntax errors). ui:check: 0 errors 0 warnings (red-state safe).
biome: clean on the new files (baseline elsewhere unchanged); eslint:
clean on the new files. CLI suite 87 pass / 1 known uid-0 env failure;
lib suite 845 pass / 10 skip / 17 known uid-0 failures — parity.

No production code changed. Playwright e2e specs are deliberately not
added here: browsers cannot run in this container and the Phase 3
route split they would smoke-test lands with the implementation.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FetR7BttT1xBrA8fBwhui9
---
 .../ui/src/hooks.server.landing.vitest.ts     | 196 ++++++++++++
 .../chrome/chrome-untangle-hygiene.vitest.ts  | 110 +++++++
 .../src/lib/features-admin-hygiene.vitest.ts  |  54 ++++
 packages/ui/src/lib/resolve-landing.vitest.ts | 293 ++++++++++++++++++
 .../ui/src/routes/chat/page-imports.vitest.ts |  62 ++++
 5 files changed, 715 insertions(+)
 create mode 100644 packages/ui/src/hooks.server.landing.vitest.ts
 create mode 100644 packages/ui/src/lib/components/chrome/chrome-untangle-hygiene.vitest.ts
 create mode 100644 packages/ui/src/lib/features-admin-hygiene.vitest.ts
 create mode 100644 packages/ui/src/lib/resolve-landing.vitest.ts
 create mode 100644 packages/ui/src/routes/chat/page-imports.vitest.ts

diff --git a/packages/ui/src/hooks.server.landing.vitest.ts b/packages/ui/src/hooks.server.landing.vitest.ts
new file mode 100644
index 000000000..ba015f989
--- /dev/null
+++ b/packages/ui/src/hooks.server.landing.vitest.ts
@@ -0,0 +1,196 @@
+/**
+ * Phase 3 — root + /splash routing through resolveLanding (plan
+ * ui-runtime-modes-plan.md §6.5, Phase 3 step 2).
+ *
+ * Contract pinned here:
+ *  - hooks.server.ts derives the landing for document navigations from
+ *    resolveLanding(ctx, launchState) instead of the binary
+ *    recommendedRoute → '/chat' | '/splash' table.
+ *  - The /splash ROUTE is removed (its files are gone from routes/splash/),
+ *    but the /splash PATH keeps redirecting to the resolved landing for this
+ *    release. The redirect is issued by the hooks launch-routing guard —
+ *    i.e. /splash is no longer exempt — so it fires BEFORE the auth guard,
+ *    exactly like the existing '/' redirect (a stale /splash bookmark must
+ *    not bounce through /login first).
+ *  - /attention exists as the new migration/blocking surface split out of
+ *    /splash. /host is NOT created in Phase 3 — until Phase 4 renames
+ *    /admin, the installed_offline/broken landing stays '/admin' (a TODO
+ *    constant in the implementation; flip HOST_ADMIN_LANDING here with it).
+ *
+ * RED until Phase 3 lands, EXCEPT the test explicitly labeled
+ * CHARACTERIZATION (healthy stack → /chat), which passes today and must
+ * keep passing.
+ *
+ * Deterministic like hooks.server.vitest.ts: the host probes (composePs,
+ * detectRuntime, listRemoteStatuses) are stubbed so results don't depend on
+ * what happens to be running on the dev machine.
+ */
+import { afterEach, beforeEach, describe, expect, test, vi } from 'vitest';
+import { existsSync, mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { tmpdir } from 'node:os';
+import { fileURLToPath } from 'node:url';
+import type { RequestEvent } from '@sveltejs/kit';
+import { resetState } from '$lib/server/test-helpers.js';
+
+vi.mock('$lib/server/endpoints.js', async (orig) => ({
+  ...(await orig<typeof import('$lib/server/endpoints.js')>()),
+  listRemoteStatuses: vi.fn(async () => []),
+}));
+vi.mock('@openpalm/lib', async (orig) => ({
+  ...(await orig<typeof import('@openpalm/lib')>()),
+  composePs: vi.fn(async () => ({ ok: false, stdout: '', stderr: '', code: 1 })),
+  detectRuntime: vi.fn(async () => ({ dockerPresent: false, composeAvailable: false })),
+}));
+
+import { composePs } from '@openpalm/lib';
+import { handle, _resetLaunchCache } from './hooks.server.js';
+
+// Phase 3 value. TODO(phase-4): flip to '/host' when /admin is renamed.
+const HOST_ADMIN_LANDING = '/admin';
+
+// ── helpers (same conventions as hooks.server.vitest.ts) ─────────────────────
+
+function seedStackEnv(stackDir: string, setupComplete: boolean): void {
+  const kvDir = join(stackDir, '..', '..', 'knowledge', 'env');
+  mkdirSync(kvDir, { recursive: true });
+  writeFileSync(join(kvDir, 'stack.env'), `OP_SETUP_COMPLETE=${setupComplete}\n`);
+}
+
+/** compose ps --format json output for a single healthy running service. */
+const RUNNING_PS = '{"Service":"assistant","State":"running","Health":"healthy"}\n';
+
+function makeEvent(path: string): RequestEvent {
+  const url = new URL(`http://localhost:3880${path}`);
+  const headers: Record<string, string> = {
+    host: 'localhost:3880',
+    accept: 'text/html',
+  };
+  return {
+    url,
+    request: new Request(url.toString(), { headers }),
+    params: {},
+    locals: {} as App.Locals,
+    route: { id: path },
+    platform: undefined,
+    getClientAddress: () => '127.0.0.1',
+    isDataRequest: false,
+    isSubRequest: false,
+  } as unknown as RequestEvent;
+}
+
+const resolve = () => Promise.resolve(new Response('ok', { status: 200 }));
+
+const MODE_ENV_KEYS = ['OP_UI_HOST_MODE', 'OP_INSIDE_ELECTRON'] as const;
+
+describe('hooks.server — landing routing through resolveLanding (plan Phase 3)', () => {
+  let home = '';
+  let prevHome: string | undefined;
+  let savedModeEnv: Record<string, string | undefined> = {};
+
+  beforeEach(() => {
+    process.env.PORT = '3880';
+    // host-ui mode: host:setup is in the server capabilities, so the host
+    // rows of the §6.5 matrix apply.
+    process.env.OP_ENABLE_ADMIN = '1';
+    savedModeEnv = {};
+    for (const key of MODE_ENV_KEYS) {
+      savedModeEnv[key] = process.env[key];
+      delete process.env[key];
+    }
+    prevHome = process.env.OP_HOME;
+    home = mkdtempSync(join(tmpdir(), 'op-hooks-landing-'));
+    process.env.OP_HOME = home;
+    _resetLaunchCache(); // the 5s launch cache is module-level — resolve fresh per test
+    vi.mocked(composePs).mockResolvedValue({ ok: false, stdout: '', stderr: '', code: 1 });
+    resetState('test-admin-pw');
+  });
+
+  afterEach(() => {
+    delete process.env.PORT;
+    delete process.env.OP_ENABLE_ADMIN;
+    for (const key of MODE_ENV_KEYS) {
+      const prev = savedModeEnv[key];
+      if (prev === undefined) delete process.env[key];
+      else process.env[key] = prev;
+    }
+    if (prevHome === undefined) delete process.env.OP_HOME;
+    else process.env.OP_HOME = prevHome;
+    rmSync(home, { recursive: true, force: true });
+  });
+
+  // ── root ('/') ──────────────────────────────────────────────────────────────
+
+  test('CHARACTERIZATION: / with a healthy running stack redirects to /chat', async () => {
+    const state = resetState('test-admin-pw');
+    seedStackEnv(state.stackDir, true);
+    vi.mocked(composePs).mockResolvedValue({ ok: true, stdout: RUNNING_PS, stderr: '', code: 0 });
+
+    await expect(handle({ event: makeEvent('/'), resolve })).rejects.toMatchObject({
+      location: '/chat',
+    });
+  });
+
+  test('/ with nothing installed redirects to /setup (was /splash)', async () => {
+    const state = resetState('test-admin-pw');
+    seedStackEnv(state.stackDir, false); // no core.compose.yml → not_installed
+
+    await expect(handle({ event: makeEvent('/'), resolve })).rejects.toMatchObject({
+      location: '/setup',
+    });
+  });
+
+  test(`/ with an installed-but-offline stack redirects to ${HOST_ADMIN_LANDING} (was /splash)`, async () => {
+    const state = resetState('test-admin-pw');
+    seedStackEnv(state.stackDir, true); // setup complete, composePs fails → installed_offline
+
+    await expect(handle({ event: makeEvent('/'), resolve })).rejects.toMatchObject({
+      location: HOST_ADMIN_LANDING,
+    });
+  });
+
+  // ── /splash → resolved landing (kept as a redirect this release) ───────────
+
+  test('/splash with a healthy running stack redirects to /chat', async () => {
+    const state = resetState('test-admin-pw');
+    seedStackEnv(state.stackDir, true);
+    vi.mocked(composePs).mockResolvedValue({ ok: true, stdout: RUNNING_PS, stderr: '', code: 0 });
+
+    await expect(handle({ event: makeEvent('/splash'), resolve })).rejects.toMatchObject({
+      location: '/chat',
+    });
+  });
+
+  test(`/splash with an installed-but-offline stack redirects to ${HOST_ADMIN_LANDING}`, async () => {
+    const state = resetState('test-admin-pw');
+    seedStackEnv(state.stackDir, true);
+
+    await expect(handle({ event: makeEvent('/splash'), resolve })).rejects.toMatchObject({
+      location: HOST_ADMIN_LANDING,
+    });
+  });
+
+  test('/splash with nothing installed redirects to /setup', async () => {
+    const state = resetState('test-admin-pw');
+    seedStackEnv(state.stackDir, false);
+
+    await expect(handle({ event: makeEvent('/splash'), resolve })).rejects.toMatchObject({
+      location: '/setup',
+    });
+  });
+});
+
+// ── route split: /splash removed, /attention created (Phase 3 step 2) ────────
+
+describe('route split — /splash removed, /attention exists (plan Phase 3)', () => {
+  const routesDir = fileURLToPath(new URL('./routes/', import.meta.url));
+
+  test('the /splash route files are removed (redirect lives in hooks, not a route)', () => {
+    expect(existsSync(join(routesDir, 'splash', '+page.svelte'))).toBe(false);
+    expect(existsSync(join(routesDir, 'splash', '+page.server.ts'))).toBe(false);
+  });
+
+  test('the /attention route exists (migration/blocking surface split from /splash)', () => {
+    expect(existsSync(join(routesDir, 'attention', '+page.svelte'))).toBe(true);
+  });
+});
diff --git a/packages/ui/src/lib/components/chrome/chrome-untangle-hygiene.vitest.ts b/packages/ui/src/lib/components/chrome/chrome-untangle-hygiene.vitest.ts
new file mode 100644
index 000000000..e564d5685
--- /dev/null
+++ b/packages/ui/src/lib/components/chrome/chrome-untangle-hygiene.vitest.ts
@@ -0,0 +1,110 @@
+/**
+ * Phase 3 hygiene — the admin-surface chrome must not import chat
+ * components/stores (plan ui-runtime-modes-plan.md Phase 3 step 4, issue
+ * #555: "Navbar must stop importing chat components/stores into the admin
+ * surface — split chrome so admin surface uses a chrome without chat state;
+ * chat surface gets its own chrome composition").
+ *
+ * RED until Phase 3 lands: the admin surface (routes/admin/+page.svelte)
+ * mounts chrome/Navbar.svelte, which imports EndpointSwitcher, SessionPicker
+ * and VoiceControl from $lib/components/chat/ plus $lib/chat/navigation.js.
+ *
+ * Source-level test, same rationale as endpoints-state-hygiene.vitest.ts:
+ * the invariant is about the module graph — after the Phase 5 extraction the
+ * admin surface must not drag chat modules into the host bundle, so the
+ * coupling has to be gone BEFORE the move. The test follows the files rather
+ * than pinning names: it resolves whichever module(s) under
+ * $lib/components/chrome/ the admin surface imports (routes/admin today,
+ * routes/host after Phase 4; +page.svelte or +layout.svelte) and inspects
+ * THOSE modules' import specifiers. Type-only imports count too.
+ */
+import { describe, expect, test } from 'vitest';
+import { existsSync, readFileSync } from 'node:fs';
+import { basename, dirname, join, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const SRC_ROOT = fileURLToPath(new URL('../../../', import.meta.url));
+
+/** Admin-surface entry files, in both pre- and post-Phase-4 locations. */
+const ADMIN_SURFACE_CANDIDATES = [
+  'routes/admin/+layout.svelte',
+  'routes/admin/+page.svelte',
+  'routes/host/+layout.svelte',
+  'routes/host/+page.svelte',
+] as const;
+
+function adminSurfaceFiles(): string[] {
+  return ADMIN_SURFACE_CANDIDATES.map((rel) => join(SRC_ROOT, rel)).filter((abs) =>
+    existsSync(abs),
+  );
+}
+
+/** Collect every static, side-effect, re-export, and dynamic import specifier. */
+function importSpecifiers(source: string): string[] {
+  const specifiers: string[] = [];
+  const patterns = [
+    // import ... from '...'; / export ... from '...'; (incl. `import type`)
+    /(?:^|\n)\s*(?:import|export)\s[^;'"]*?from\s*['"]([^'"]+)['"]/g,
+    // side-effect import: import '...';
+    /(?:^|\n)\s*import\s*['"]([^'"]+)['"]/g,
+    // dynamic import: import('...')
+    /import\s*\(\s*['"]([^'"]+)['"]\s*\)/g,
+  ];
+  for (const pattern of patterns) {
+    for (const match of source.matchAll(pattern)) {
+      specifiers.push(match[1]);
+    }
+  }
+  return specifiers;
+}
+
+/** Resolve a $lib/ or relative specifier to an absolute file path. */
+function resolveImportPath(fromFile: string, specifier: string): string | null {
+  if (specifier.startsWith('$lib/')) return join(SRC_ROOT, 'lib', specifier.slice('$lib/'.length));
+  if (specifier.startsWith('.')) return resolve(dirname(fromFile), specifier);
+  return null;
+}
+
+function isChromeSpecifier(specifier: string): boolean {
+  return specifier.includes('components/chrome/') && specifier.endsWith('.svelte');
+}
+
+/** True for chat state or anything under a chat/ module directory —
+ *  $lib/chat/* (stores/navigation) and $lib/components/chat/* alike. */
+function isChatModuleSpecifier(specifier: string): boolean {
+  return /chat-state/.test(specifier) || /(?:^|\/)chat\//.test(specifier);
+}
+
+/** The chrome modules the admin surface actually mounts. */
+function adminChromeModules(): string[] {
+  const files = new Set<string>();
+  for (const surfaceFile of adminSurfaceFiles()) {
+    const source = readFileSync(surfaceFile, 'utf-8');
+    for (const specifier of importSpecifiers(source).filter(isChromeSpecifier)) {
+      const abs = resolveImportPath(surfaceFile, specifier);
+      if (abs && existsSync(abs)) files.add(abs);
+    }
+  }
+  return [...files];
+}
+
+describe('admin-surface chrome ↔ chat untangling (plan Phase 3 step 4, #555)', () => {
+  test('the admin surface exists and mounts a chrome module from $lib/components/chrome/', () => {
+    // CHARACTERIZATION (green today): guards the resolver — if the admin
+    // surface stopped importing any chrome module, the hygiene assertion
+    // below would pass vacuously.
+    expect(adminSurfaceFiles().length).toBeGreaterThan(0);
+    expect(adminChromeModules().length).toBeGreaterThan(0);
+  });
+
+  test('the admin-surface chrome imports no chat components or chat stores', () => {
+    const offenders: string[] = [];
+    for (const chromeFile of adminChromeModules()) {
+      const source = readFileSync(chromeFile, 'utf-8');
+      for (const specifier of importSpecifiers(source).filter(isChatModuleSpecifier)) {
+        offenders.push(`${basename(chromeFile)} → ${specifier}`);
+      }
+    }
+    expect(offenders).toEqual([]);
+  });
+});
diff --git a/packages/ui/src/lib/features-admin-hygiene.vitest.ts b/packages/ui/src/lib/features-admin-hygiene.vitest.ts
new file mode 100644
index 000000000..85a1a9bb7
--- /dev/null
+++ b/packages/ui/src/lib/features-admin-hygiene.vitest.ts
@@ -0,0 +1,54 @@
+/**
+ * Phase 3 hygiene — no component reads `features.admin` (plan
+ * ui-runtime-modes-plan.md Phase 3 step 3, §8.6: "hasCapability(cap) is the
+ * only check components call. No `if (features.admin)` anywhere").
+ *
+ * RED until Phase 3 lands: chrome/Navbar.svelte still branches on
+ * `featuresService.admin`.
+ *
+ * Source-level test (scans every .svelte file under src/ for the read
+ * pattern) because the invariant is about where capability logic lives, not
+ * runtime behavior: components must consult runtimeContext.routes +
+ * hasCapability() so that adding a capability rule stays a one-function
+ * change (plan §11). The legacy alias may survive Phase 3 only in
+ * hooks.server.ts (computeFeatureFlags) pending Phase 4 — that is server
+ * code, deliberately outside this scan.
+ */
+import { describe, expect, test } from 'vitest';
+import { readFileSync, readdirSync } from 'node:fs';
+import { join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const SRC_ROOT = fileURLToPath(new URL('../', import.meta.url));
+
+function svelteFiles(): string[] {
+  return (readdirSync(SRC_ROOT, { recursive: true }) as string[])
+    .filter((rel) => rel.endsWith('.svelte'))
+    .map((rel) => join(SRC_ROOT, rel));
+}
+
+/** Matches reads of the legacy admin flag: `features.admin`,
+ *  `featuresService.admin`, `data.features.admin`, optional-chained forms. */
+const FEATURES_ADMIN_READ = /\bfeatures(?:Service)?\??\.admin\b/;
+
+describe('no features.admin reads in .svelte components (plan §8.6, Phase 3 step 3)', () => {
+  test('the scan sees the component tree (sanity)', () => {
+    // Guards the walker itself: if this ever returns [], the hygiene
+    // assertion below would pass vacuously.
+    expect(svelteFiles().length).toBeGreaterThan(50);
+  });
+
+  test('no .svelte file reads features.admin / featuresService.admin', () => {
+    const offenders: string[] = [];
+    for (const file of svelteFiles()) {
+      const source = readFileSync(file, 'utf-8');
+      const lines = source.split('\n');
+      for (let i = 0; i < lines.length; i++) {
+        if (FEATURES_ADMIN_READ.test(lines[i])) {
+          offenders.push(`${file.slice(SRC_ROOT.length)}:${i + 1}`);
+        }
+      }
+    }
+    expect(offenders).toEqual([]);
+  });
+});
diff --git a/packages/ui/src/lib/resolve-landing.vitest.ts b/packages/ui/src/lib/resolve-landing.vitest.ts
new file mode 100644
index 000000000..e96a957e1
--- /dev/null
+++ b/packages/ui/src/lib/resolve-landing.vitest.ts
@@ -0,0 +1,293 @@
+/**
+ * Phase 3 — resolveLanding(ctx, launchState) landing matrix (plan
+ * ui-runtime-modes-plan.md §6.5, Phase 3 step 1).
+ *
+ * ALL RED until the implementation lands: the module under test does not
+ * exist yet. The contract pinned here:
+ *
+ *  - `resolveLanding` lives in its own module at $lib/resolve-landing.ts
+ *    (see CANDIDATE_MODULE_BASES for the accepted names), together with the
+ *    LaunchState type derived from the existing splash launch-state logic:
+ *    `local.state` is @openpalm/lib's LocalStackState, `connections` is the
+ *    connection list, and `migration.status` is the blocking-migration gate
+ *    ('pending' blocks; anything else does not).
+ *  - `resolveLanding` is PURE: it consults ctx.effectiveCapabilities — never
+ *    the global runtimeContext store — so hooks.server.ts can call it
+ *    per-request on the server, where no client store exists. Capability
+ *    RESOLUTION still lives only in resolveCapabilities() (plan §8.6);
+ *    resolveLanding merely reads the already-resolved list.
+ *
+ *  Landing matrix (plan §6.5, exactly):
+ *    host:setup capability present:
+ *      migration pending          → /attention
+ *      local not_installed        → /setup
+ *      local setup_incomplete     → /setup
+ *      local installed_offline    → host admin landing
+ *      local installed_broken     → host admin landing + ?tab=diagnostics
+ *      otherwise (running)        → /chat
+ *    no host:setup capability:
+ *      assistant-container        → /chat (always)
+ *      pwa-static, 0 connections  → /connections/new
+ *      pwa-static, ≥1 connection  → /chat
+ *      anything else              → /chat
+ *
+ * Phase 3 does NOT create /host (that is Phase 4): the host admin landing
+ * stays at the existing /admin, encoded in the implementation as a TODO
+ * constant so Phase 4 flips exactly one value. When Phase 4 lands, update
+ * HOST_ADMIN_LANDING below to '/host' (and nothing else in this file).
+ *
+ * The module is loaded through a computed-specifier dynamic import so
+ * svelte-check stays clean while the suite is red (same convention as the
+ * Phase 2 red tests).
+ */
+import { describe, expect, test } from 'vitest';
+import { existsSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import type { Capability, RuntimeContext, UiHostMode } from '$lib/types.js';
+
+// Phase 3 value. TODO(phase-4): flip to '/host' when /admin is renamed.
+const HOST_ADMIN_LANDING = '/admin';
+
+// ── module loading (red-state safe) ──────────────────────────────────────────
+
+/** Accepted file names for "its own module" in $lib (implementation picks one). */
+const CANDIDATE_MODULE_BASES = ['resolve-landing', 'landing', 'resolve-landing.svelte'] as const;
+
+type ResolveLandingFn = (ctx: RuntimeContext, launchState: unknown) => string;
+
+async function loadResolveLanding(): Promise<ResolveLandingFn> {
+  for (const base of CANDIDATE_MODULE_BASES) {
+    if (!existsSync(fileURLToPath(new URL(`./${base}.ts`, import.meta.url)))) continue;
+    const specifier = `./${base}.js`;
+    const mod = (await import(/* @vite-ignore */ specifier)) as { resolveLanding?: unknown };
+    if (typeof mod.resolveLanding !== 'function') {
+      throw new Error(`$lib/${base}.ts exists but does not export resolveLanding()`);
+    }
+    return mod.resolveLanding as ResolveLandingFn;
+  }
+  throw new Error(
+    `resolveLanding module not found — expected packages/ui/src/lib/<${CANDIDATE_MODULE_BASES.join(
+      '|',
+    )}>.ts exporting resolveLanding(ctx, launchState) per plan §6.5`,
+  );
+}
+
+// ── fixtures ──────────────────────────────────────────────────────────────────
+
+/** Effective capabilities of a host-capable session (electron / host-ui browser). */
+const HOST_EFFECTIVE: Capability[] = [
+  'chat',
+  'connections:read',
+  'connections:manage',
+  'connections:switch',
+  'assistant-settings:read',
+  'assistant-settings:write',
+  'host:setup',
+  'host:stack:read',
+  'host:stack:write',
+  'host:containers',
+  'host:addons',
+  'host:updates',
+  'host:logs',
+  'host:secrets',
+  'host:recovery',
+  'host:akm-sharing',
+];
+
+/** assistant-container effective set (resolveCapabilities output, plan §4.3). */
+const ASSISTANT_CONTAINER_EFFECTIVE: Capability[] = [
+  'chat',
+  'assistant-settings:read',
+  'assistant-settings:write',
+];
+
+/** pwa-static effective baseline (resolveCapabilities output, plan §4.3). */
+const PWA_EFFECTIVE: Capability[] = [
+  'chat',
+  'connections:read',
+  'connections:manage',
+  'connections:switch',
+  'pwa:install',
+];
+
+function makeCtx(hostMode: UiHostMode, effectiveCapabilities: Capability[]): RuntimeContext {
+  return {
+    version: 2,
+    hostMode,
+    serverCapabilities: [...effectiveCapabilities],
+    publicBaseUrl: 'http://127.0.0.1:3880',
+    uiVersion: '0.0.0-test',
+    skeletonVersion: '0.0.0-test',
+    activeConnectionMode: hostMode === 'assistant-container' ? 'single' : 'multi',
+    routes: {},
+    security: {
+      hostAdminLoopbackOnly: true,
+      requiresHttpsForRemoteConnections: hostMode === 'pwa-static',
+      csrfMode: 'loopback-origin',
+    },
+    clientContext: { displayMode: 'browser' },
+    effectiveCapabilities,
+  };
+}
+
+type TestLocalState =
+  | 'not_installed'
+  | 'setup_incomplete'
+  | 'installed_offline'
+  | 'installed_broken'
+  | 'running';
+
+type TestLaunchState = {
+  migration: { status: 'pending' | 'none' };
+  local: { state: TestLocalState };
+  connections: Array<{ id: string }>;
+};
+
+function makeLaunchState(overrides: Partial<TestLaunchState> = {}): TestLaunchState {
+  return {
+    migration: { status: 'none' },
+    local: { state: 'running' },
+    connections: [{ id: 'local' }],
+    ...overrides,
+  };
+}
+
+// ── module contract ───────────────────────────────────────────────────────────
+
+describe('resolveLanding — module contract', () => {
+  test('exports resolveLanding(ctx, launchState) from its own $lib module', async () => {
+    const resolveLanding = await loadResolveLanding();
+    expect(typeof resolveLanding).toBe('function');
+  });
+});
+
+// ── host:setup rows (electron-host / host-ui with full capabilities) ──────────
+
+describe('resolveLanding — host:setup capability present (plan §6.5)', () => {
+  const hostCtx = makeCtx('host-ui', HOST_EFFECTIVE);
+
+  test('pending migration lands on /attention', async () => {
+    const resolveLanding = await loadResolveLanding();
+    const state = makeLaunchState({ migration: { status: 'pending' } });
+    expect(resolveLanding(hostCtx, state)).toBe('/attention');
+  });
+
+  test('pending migration takes precedence over not_installed', async () => {
+    const resolveLanding = await loadResolveLanding();
+    const state = makeLaunchState({
+      migration: { status: 'pending' },
+      local: { state: 'not_installed' },
+    });
+    expect(resolveLanding(hostCtx, state)).toBe('/attention');
+  });
+
+  test('pending migration takes precedence over installed_broken', async () => {
+    const resolveLanding = await loadResolveLanding();
+    const state = makeLaunchState({
+      migration: { status: 'pending' },
+      local: { state: 'installed_broken' },
+    });
+    expect(resolveLanding(hostCtx, state)).toBe('/attention');
+  });
+
+  test('not_installed lands on /setup', async () => {
+    const resolveLanding = await loadResolveLanding();
+    const state = makeLaunchState({ local: { state: 'not_installed' }, connections: [] });
+    expect(resolveLanding(hostCtx, state)).toBe('/setup');
+  });
+
+  test('setup_incomplete lands on /setup', async () => {
+    const resolveLanding = await loadResolveLanding();
+    const state = makeLaunchState({ local: { state: 'setup_incomplete' } });
+    expect(resolveLanding(hostCtx, state)).toBe('/setup');
+  });
+
+  test(`installed_offline lands on the host admin surface (${HOST_ADMIN_LANDING} until Phase 4)`, async () => {
+    const resolveLanding = await loadResolveLanding();
+    const state = makeLaunchState({ local: { state: 'installed_offline' } });
+    expect(resolveLanding(hostCtx, state)).toBe(HOST_ADMIN_LANDING);
+  });
+
+  test('installed_broken lands on the host admin diagnostics tab', async () => {
+    const resolveLanding = await loadResolveLanding();
+    const state = makeLaunchState({ local: { state: 'installed_broken' } });
+    expect(resolveLanding(hostCtx, state)).toBe(`${HOST_ADMIN_LANDING}?tab=diagnostics`);
+  });
+
+  test('running (healthy) lands on /chat', async () => {
+    const resolveLanding = await loadResolveLanding();
+    expect(resolveLanding(hostCtx, makeLaunchState())).toBe('/chat');
+  });
+
+  test('electron-host resolves through the same host rows', async () => {
+    const resolveLanding = await loadResolveLanding();
+    const electronCtx = makeCtx('electron-host', HOST_EFFECTIVE);
+    expect(resolveLanding(electronCtx, makeLaunchState())).toBe('/chat');
+    expect(
+      resolveLanding(electronCtx, makeLaunchState({ local: { state: 'installed_offline' } })),
+    ).toBe(HOST_ADMIN_LANDING);
+  });
+
+  test('the gate is CAPABILITY-driven, not hostMode-driven: a host-capable server viewed without host:setup falls through to /chat', async () => {
+    const resolveLanding = await loadResolveLanding();
+    // host-ui × standalone-pwa display: resolveCapabilities strips host:* per
+    // plan §4.2, so even a broken local stack must not land this session on
+    // the host admin surface it cannot use.
+    const restrictedCtx = makeCtx('host-ui', [
+      'chat',
+      'connections:read',
+      'connections:manage',
+      'connections:switch',
+    ]);
+    const state = makeLaunchState({ local: { state: 'installed_broken' } });
+    expect(resolveLanding(restrictedCtx, state)).toBe('/chat');
+  });
+});
+
+// ── assistant-container row ───────────────────────────────────────────────────
+
+describe('resolveLanding — assistant-container (plan §6.5)', () => {
+  const ctx = makeCtx('assistant-container', ASSISTANT_CONTAINER_EFFECTIVE);
+
+  test('always lands on /chat', async () => {
+    const resolveLanding = await loadResolveLanding();
+    expect(resolveLanding(ctx, makeLaunchState())).toBe('/chat');
+  });
+
+  test('lands on /chat regardless of local stack state or connection count', async () => {
+    const resolveLanding = await loadResolveLanding();
+    // The co-process has no view of a host stack — local state is meaningless.
+    const state = makeLaunchState({ local: { state: 'not_installed' }, connections: [] });
+    expect(resolveLanding(ctx, state)).toBe('/chat');
+  });
+
+  test('a pending migration does not divert it (no host:setup → gate skipped)', async () => {
+    const resolveLanding = await loadResolveLanding();
+    const state = makeLaunchState({ migration: { status: 'pending' } });
+    expect(resolveLanding(ctx, state)).toBe('/chat');
+  });
+});
+
+// ── pwa-static row ────────────────────────────────────────────────────────────
+
+describe('resolveLanding — pwa-static (plan §6.5)', () => {
+  const ctx = makeCtx('pwa-static', PWA_EFFECTIVE);
+
+  test('zero connections lands on /connections/new', async () => {
+    const resolveLanding = await loadResolveLanding();
+    const state = makeLaunchState({ connections: [] });
+    expect(resolveLanding(ctx, state)).toBe('/connections/new');
+  });
+
+  test('one or more connections lands on /chat', async () => {
+    const resolveLanding = await loadResolveLanding();
+    const state = makeLaunchState({ connections: [{ id: 'r1' }] });
+    expect(resolveLanding(ctx, state)).toBe('/chat');
+  });
+
+  test('a pending migration does not divert it (no host:setup → gate skipped)', async () => {
+    const resolveLanding = await loadResolveLanding();
+    const state = makeLaunchState({ migration: { status: 'pending' }, connections: [] });
+    expect(resolveLanding(ctx, state)).toBe('/connections/new');
+  });
+});
diff --git a/packages/ui/src/routes/chat/page-imports.vitest.ts b/packages/ui/src/routes/chat/page-imports.vitest.ts
new file mode 100644
index 000000000..9d7b784ec
--- /dev/null
+++ b/packages/ui/src/routes/chat/page-imports.vitest.ts
@@ -0,0 +1,62 @@
+/**
+ * Phase 3 hygiene — the chat page must not import the $lib/api.js barrel
+ * (plan ui-runtime-modes-plan.md Phase 3 step 4, issue #555: "Chat stops
+ * importing the $lib/api.js barrel (direct domain-client imports only)").
+ *
+ * RED until Phase 3 lands: chat/+page.svelte still does
+ *   import { probeChatBackend } from '$lib/api.js';
+ *
+ * Source-level test because the invariant is about the module graph: the
+ * barrel re-exports every admin domain client (containers, versions,
+ * backups, secrets, akm, …), so one barrel import drags the entire admin API
+ * surface into the chat chunk — exactly what the Phase 5 client extraction
+ * (and the "chat chunk imports no admin API clients" acceptance) forbids.
+ * Direct domain-client imports (e.g. $lib/api/chat.js) remain allowed.
+ */
+import { describe, expect, test } from 'vitest';
+import { existsSync, readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+
+const CHAT_PAGE = fileURLToPath(new URL('./+page.svelte', import.meta.url));
+
+/** Collect every static, side-effect, re-export, and dynamic import specifier. */
+function importSpecifiers(source: string): string[] {
+  const specifiers: string[] = [];
+  const patterns = [
+    // import ... from '...'; / export ... from '...'; (incl. `import type`)
+    /(?:^|\n)\s*(?:import|export)\s[^;'"]*?from\s*['"]([^'"]+)['"]/g,
+    // side-effect import: import '...';
+    /(?:^|\n)\s*import\s*['"]([^'"]+)['"]/g,
+    // dynamic import: import('...')
+    /import\s*\(\s*['"]([^'"]+)['"]\s*\)/g,
+  ];
+  for (const pattern of patterns) {
+    for (const match of source.matchAll(pattern)) {
+      specifiers.push(match[1]);
+    }
+  }
+  return specifiers;
+}
+
+/** The $lib/api barrel, in alias or relative form — NOT the $lib/api/ domain
+ *  modules, which stay allowed. */
+function isApiBarrelSpecifier(specifier: string): boolean {
+  return (
+    /^\$lib\/api(?:\.(?:js|ts))?$/.test(specifier) ||
+    /^(?:\.\.?\/)+lib\/api(?:\.(?:js|ts))?$/.test(specifier)
+  );
+}
+
+describe('chat page ↔ admin API barrel untangling (plan Phase 3 step 4, #555)', () => {
+  test('the chat page exists (sanity)', () => {
+    // CHARACTERIZATION (green today): guards the path this hygiene scan pins.
+    expect(existsSync(CHAT_PAGE)).toBe(true);
+  });
+
+  test('chat/+page.svelte does not import the $lib/api.js barrel', () => {
+    const offenders = importSpecifiers(readFileSync(CHAT_PAGE, 'utf-8')).filter(
+      isApiBarrelSpecifier,
+    );
+    expect(offenders).toEqual([]);
+  });
+});

From d4cd80f3d45fa943ca0739378709c6948a9022f6 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Mon, 6 Jul 2026 13:30:43 +0000
Subject: [PATCH 15/61] feat(ui): capability-driven landing via
 resolveLanding(); split /splash into /attention (#555)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Plan ui-runtime-modes-plan.md Phase 3 steps 1-2 (§6.5):

- New $lib/resolve-landing.ts: pure resolveLanding(ctx, launchState) — reads
  ctx.effectiveCapabilities (never the global store) so hooks.server can call
  it per-request. LaunchState derives from the launch-status probes that fed
  /splash (LocalStackState + connections + a migration gate). The host
  landing stays '/admin' behind the HOST_ADMIN_LANDING TODO constant; Phase 4
  flips that one value to '/host'.
  One documented delta from the §6.5 pseudocode: the host not_installed row
  lands on /chat when an accessible connection exists, preserving the
  authoritative #440 remote-only rule (nothing local to set up is no reason
  to block a working remote) — mirrors the pwa-static row's shape.

- New $lib/server/landing.ts: resolveRequestLanding(event) collects the
  launch facts (moved from hooks.server.ts, same 5s cache; _resetLaunchCache
  is re-exported from hooks for the existing test import site), resolves
  capabilities with the 'browser' baseline (display mode is client-only by
  design, §6.3 — resolveCapabilities() remains the only capability logic,
  §8.6), and runs resolveLanding(). The pre-Phase-3 nuance is preserved: an
  interrupted install with running containers lands on /setup, not chat.

- hooks.server.ts: the launch-routing guard now redirects document
  navigations through the resolved landing instead of the binary
  recommendedRoute → '/chat'|'/splash' table. /splash is no longer exempt:
  the ROUTE is removed and the path 302s pre-auth to the resolved landing for
  this release only.

- Route split: routes/splash/* deleted; routes/attention/+page.svelte is the
  migration/blocking surface (nothing produces migration 'pending' yet — the
  gate is wired ahead of the first blocking migration); /connections/new
  aliases to /connections?new=1 for the pwa-static zero-connections landing;
  routes/+page.ts's static /splash redirect becomes +page.server.ts resolving
  the same landing for client-side navigations.

- hooks.server.vitest.ts: 'first-run document navigation routes to splash
  instead of setup' pinned the pre-Phase-3 landing; the ratified Phase 3
  matrix (red-suite hooks.server.landing.vitest.ts pins the same scenario)
  sends not_installed to /setup, so the expectation is updated — the
  companion rule (not_installed + accessible remote → /chat) still passes
  unmodified. e2e/setup-guard.pw.ts's loose landing regex swaps splash for
  the new landings (Playwright cannot run in this container; not executed).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FetR7BttT1xBrA8fBwhui9
---
 packages/ui/e2e/setup-guard.pw.ts             |   9 +-
 packages/ui/src/hooks.server.ts               |  80 ++------
 packages/ui/src/hooks.server.vitest.ts        |   7 +-
 packages/ui/src/lib/resolve-landing.ts        |  75 +++++++
 packages/ui/src/lib/server/landing.ts         | 124 ++++++++++++
 packages/ui/src/lib/server/state.ts           |   3 +-
 packages/ui/src/routes/+page.server.ts        |  16 ++
 packages/ui/src/routes/+page.svelte           |   4 +-
 packages/ui/src/routes/+page.ts               |   6 -
 .../ui/src/routes/admin/endpoints/+page.ts    |   2 +-
 packages/ui/src/routes/attention/+page.svelte |  89 +++++++++
 .../src/routes/connections/new/+page.svelte   |   6 +
 .../ui/src/routes/connections/new/+page.ts    |  13 ++
 packages/ui/src/routes/splash/+page.server.ts |  39 ----
 packages/ui/src/routes/splash/+page.svelte    | 188 ------------------
 15 files changed, 353 insertions(+), 308 deletions(-)
 create mode 100644 packages/ui/src/lib/resolve-landing.ts
 create mode 100644 packages/ui/src/lib/server/landing.ts
 create mode 100644 packages/ui/src/routes/+page.server.ts
 delete mode 100644 packages/ui/src/routes/+page.ts
 create mode 100644 packages/ui/src/routes/attention/+page.svelte
 create mode 100644 packages/ui/src/routes/connections/new/+page.svelte
 create mode 100644 packages/ui/src/routes/connections/new/+page.ts
 delete mode 100644 packages/ui/src/routes/splash/+page.server.ts
 delete mode 100644 packages/ui/src/routes/splash/+page.svelte

diff --git a/packages/ui/e2e/setup-guard.pw.ts b/packages/ui/e2e/setup-guard.pw.ts
index ef2eb8543..4d9733981 100644
--- a/packages/ui/e2e/setup-guard.pw.ts
+++ b/packages/ui/e2e/setup-guard.pw.ts
@@ -24,10 +24,11 @@ test.describe('Setup guard — fresh instance (mocked-lib)', () => {
   test('GET / never serves raw admin/chat content unauthenticated', async ({ page }) => {
     const res = await page.goto('/');
     expect(res?.status()).toBeLessThan(400);
-    // Whatever the guard's recommended landing page is (splash, setup, or a
-    // bounce through chat straight to the login gate), it must be one of
-    // these — never a bare admin page rendered with no session.
-    await expect(page).toHaveURL(/\/(splash|setup|login)/);
+    // Whatever landing resolveLanding() picks (plan §6.5: setup, attention,
+    // connections, or a bounce through chat/admin straight to the login
+    // gate), it must be one of these — never a bare admin page rendered with
+    // no session.
+    await expect(page).toHaveURL(/\/(setup|attention|connections|login)/);
   });
 
   test('GET /setup is directly reachable, unauthenticated, from localhost', async ({ page }) => {
diff --git a/packages/ui/src/hooks.server.ts b/packages/ui/src/hooks.server.ts
index 1ad89a27c..7508119cd 100644
--- a/packages/ui/src/hooks.server.ts
+++ b/packages/ui/src/hooks.server.ts
@@ -18,37 +18,23 @@ import { sessionCookieHeader, SESSION_COOKIE_NAME } from "$lib/server/session-co
 import { computeFeatureFlags } from '$lib/server/features.js';
 import {
   createLogger,
-  composePs,
-  deriveLaunchStatus,
-  deriveLocalStackState,
   isSetupComplete,
   resolveOpenPalmHome,
   readStackRuntimeEnv,
   readSecret,
-  classifyLocalInstall,
-  detectRuntime,
-  buildComposeOptions,
   collectBindAddressWarnings,
   isRemoteSetupAllowed,
-  type ComposeServiceStatus,
 } from "@openpalm/lib";
-import { listRemoteStatuses } from "$lib/server/endpoints.js";
+import { resolveRequestLanding } from "$lib/server/landing.js";
+
+// Launch-fact collection + the 5s cache live in $lib/server/landing.ts; the
+// reset hook is re-exported here so tests keep one import site.
+export { _resetLaunchCache } from "$lib/server/landing.js";
 
 const logger = createLogger("admin");
 
 let startupApplyDone = false;
 let setupCompleteMemo = false;
-type LaunchRouting = {
-  installState: ReturnType<typeof classifyLocalInstall>;
-  launch: ReturnType<typeof deriveLaunchStatus>;
-};
-
-let localStatusCache: { expiresAt: number; value: LaunchRouting } | null = null;
-
-/** Test-only: clear the 5s launch-routing cache so each test resolves fresh. */
-export function _resetLaunchCache(): void {
-  localStatusCache = null;
-}
 
 // Load the process-level config the UI needs to serve, READ-ONLY w.r.t. OP_HOME.
 // install/update own every OP_HOME write (via applyHome), so merely serving
@@ -119,44 +105,6 @@ function isLocalhostAddress(ip: string): boolean {
   return ip === "127.0.0.1" || ip === "::1" || ip === "::ffff:127.0.0.1";
 }
 
-function parseComposePsServices(stdout: string): ComposeServiceStatus[] {
-  const services: ComposeServiceStatus[] = [];
-  for (const line of stdout.split('\n')) {
-    const trimmed = line.trim();
-    if (!trimmed) continue;
-    try {
-      const parsed = JSON.parse(trimmed) as Record<string, unknown>;
-      services.push({
-        service: String(parsed.Service ?? parsed.Name ?? ''),
-        state: String(parsed.State ?? ''),
-        health: String(parsed.Health ?? ''),
-      });
-    } catch {
-    }
-  }
-  return services;
-}
-
-async function resolveLaunchRouting(): Promise<LaunchRouting> {
-  if (localStatusCache && localStatusCache.expiresAt > Date.now()) return localStatusCache.value;
-  const state = getState();
-  const installState = classifyLocalInstall(state.stackDir, state.homeDir);
-  const composeResult = await composePs(buildComposeOptions(state));
-  const services = composeResult.ok ? parseComposePsServices(composeResult.stdout) : [];
-  const localState = deriveLocalStackState(installState, services);
-  const launch = deriveLaunchStatus({
-    local: {
-      state: localState,
-      runtime: installState === 'not_installed' ? await detectRuntime() : undefined,
-      detail: { installState },
-    },
-    remotes: await listRemoteStatuses(),
-  });
-  const value = { installState, launch };
-  localStatusCache = { value, expiresAt: Date.now() + 5_000 };
-  return value;
-}
-
 export const handle: Handle = async ({ event, resolve }) => {
   const hostError = checkHostHeader(event.request);
   if (hostError) return hostError;
@@ -194,21 +142,21 @@ export const handle: Handle = async ({ event, resolve }) => {
     }
   }
 
+  // ── Launch routing: document navigations land where resolveLanding() says
+  // (plan ui-runtime-modes-plan.md §6.5, Phase 3). Fires BEFORE the auth guard
+  // so `/` and stale `/splash` bookmarks never bounce through /login first.
+  // The /splash ROUTE is gone (Phase 3 split it into /attention + the §6.5
+  // landings); the /splash PATH keeps redirecting here for this release.
   if (!isSetupPath) {
-    const { installState, launch } = await resolveLaunchRouting();
-    const desiredPath = installState === 'setup_incomplete' && launch.local.state === 'running'
-      ? '/splash'
-      : launch.recommendedRoute === 'chat'
-        ? '/chat'
-        : '/splash';
+    const landing = await resolveRequestLanding(event);
+    const [landingPath] = landing.split('?');
     const usageRoute = path.startsWith('/chat') || path.startsWith('/advanced')
       || path.startsWith('/connections');
     const exempt = path.startsWith('/api/') || path.startsWith('/proxy/') || path.startsWith('/login')
       || path.startsWith('/health') || path.startsWith('/guardian/health') || path.startsWith('/admin')
-      || path.startsWith('/splash')
       || usageRoute;
-    if (path === '/' || (path !== desiredPath && !exempt)) {
-      redirect(302, desiredPath);
+    if (path === '/' || (path !== landingPath && !exempt)) {
+      redirect(302, landing);
     }
   }
 
diff --git a/packages/ui/src/hooks.server.vitest.ts b/packages/ui/src/hooks.server.vitest.ts
index 4e497c28d..d96dac153 100644
--- a/packages/ui/src/hooks.server.vitest.ts
+++ b/packages/ui/src/hooks.server.vitest.ts
@@ -119,7 +119,10 @@ describe('hooks.server — sliding renewal', () => {
     expect(setCookie).not.toContain(`${SESSION_COOKIE_NAME}=`);
   });
 
-  test('first-run document navigation routes to splash instead of setup', async () => {
+  test('first-run document navigation routes to /setup (resolveLanding, plan §6.5)', async () => {
+    // Pre-Phase-3 this pinned '/' → /splash; the Phase 3 landing matrix sends
+    // not_installed straight to /setup (same scenario is also pinned in
+    // hooks.server.landing.vitest.ts).
     const state = resetState('test-admin-pw');
     const kvDir = join(state.stackDir, '..', '..', 'knowledge', 'env');
     mkdirSync(kvDir, { recursive: true });
@@ -127,7 +130,7 @@ describe('hooks.server — sliding renewal', () => {
 
     const event = makeEvent('/', null, 'text/html');
 
-    await expect(handle({ event, resolve })).rejects.toMatchObject({ location: '/splash' });
+    await expect(handle({ event, resolve })).rejects.toMatchObject({ location: '/setup' });
   });
 
   test('not_installed + an accessible remote skips splash → /chat', async () => {
diff --git a/packages/ui/src/lib/resolve-landing.ts b/packages/ui/src/lib/resolve-landing.ts
new file mode 100644
index 000000000..cc74407d6
--- /dev/null
+++ b/packages/ui/src/lib/resolve-landing.ts
@@ -0,0 +1,75 @@
+/**
+ * Landing resolver — the single place that decides where a session lands
+ * (plan ui-runtime-modes-plan.md §6.5, Phase 3 step 1).
+ *
+ * PURE by contract: reads `ctx.effectiveCapabilities` — never the global
+ * `runtimeContext` store — so hooks.server.ts can call it per-request on the
+ * server (where no client store exists) and +layout/svelte code can call it
+ * with the store's value. Capability RESOLUTION stays in
+ * `resolveCapabilities()` (plan §8.6); this function only reads the
+ * already-resolved list.
+ *
+ * Landing matrix (plan §6.5):
+ *   host:setup capability present:
+ *     migration pending          → /attention (precedence over local state)
+ *     local not_installed        → /setup — unless an accessible connection
+ *                                  exists, then /chat (the authoritative #440
+ *                                  remote-only rule: nothing local to set up
+ *                                  is no reason to block a working remote)
+ *     local setup_incomplete     → /setup
+ *     local installed_offline    → HOST_ADMIN_LANDING
+ *     local installed_broken     → HOST_ADMIN_LANDING?tab=diagnostics
+ *     otherwise (running)        → /chat
+ *   no host:setup capability:
+ *     assistant-container        → /chat (always — no host stack in view)
+ *     pwa-static, 0 connections  → /connections/new
+ *     pwa-static, ≥1 connection  → /chat
+ *     anything else              → /chat
+ */
+import type { LocalStackState } from '@openpalm/lib';
+import type { RuntimeContext } from '$lib/types.js';
+
+/**
+ * Where the host admin surface lives. Phase 3 keeps the existing /admin.
+ * TODO(phase-4): flip to '/host' when /admin is renamed — this constant is
+ * the only value that changes.
+ */
+export const HOST_ADMIN_LANDING = '/admin';
+
+/** Blocking-migration gate: 'pending' blocks; anything else does not.
+ *  Nothing produces 'pending' yet — the gate (and the /attention surface it
+ *  routes to) is wired ahead of the first blocking OP_HOME migration. */
+export type MigrationStatus = 'pending' | 'none';
+
+/**
+ * Launch facts, derived from the launch-status probes that used to feed the
+ * /splash page (`local.state` is @openpalm/lib's LocalStackState). On the
+ * server, `connections` is the list of connections usable right now
+ * (accessible remotes, plus the local assistant when it is running); the
+ * static client feeds its own stored connection list.
+ */
+export type LaunchState = {
+  migration: { status: MigrationStatus };
+  local: { state: LocalStackState };
+  connections: ReadonlyArray<{ id: string }>;
+};
+
+/** Resolve the landing path for a session (plan §6.5). Pure — no I/O, no
+ *  global state; the gate is CAPABILITY-driven, not hostMode-driven. */
+export function resolveLanding(ctx: RuntimeContext, state: LaunchState): string {
+  if (ctx.effectiveCapabilities.includes('host:setup')) {
+    if (state.migration.status === 'pending') return '/attention';
+    if (state.local.state === 'not_installed') {
+      return state.connections.length === 0 ? '/setup' : '/chat';
+    }
+    if (state.local.state === 'setup_incomplete') return '/setup';
+    if (state.local.state === 'installed_offline') return HOST_ADMIN_LANDING;
+    if (state.local.state === 'installed_broken') return `${HOST_ADMIN_LANDING}?tab=diagnostics`;
+    return '/chat';
+  }
+  if (ctx.hostMode === 'assistant-container') return '/chat';
+  if (ctx.hostMode === 'pwa-static') {
+    return state.connections.length === 0 ? '/connections/new' : '/chat';
+  }
+  return '/chat';
+}
diff --git a/packages/ui/src/lib/server/landing.ts b/packages/ui/src/lib/server/landing.ts
new file mode 100644
index 000000000..0de425198
--- /dev/null
+++ b/packages/ui/src/lib/server/landing.ts
@@ -0,0 +1,124 @@
+/**
+ * Server-side landing resolution (plan ui-runtime-modes-plan.md §6.5,
+ * Phase 3 step 2).
+ *
+ * Collects the launch facts (local install state, container health, remote
+ * reachability — the probes that used to feed the /splash page) and runs them
+ * through the pure `resolveLanding()`. Used by hooks.server.ts for document
+ * navigations to `/` and `/splash`, and by routes/+page.server.ts for
+ * client-side navigations to `/`.
+ *
+ * The server cannot detect the client display mode (client-only by design,
+ * plan §6.3), so capabilities are resolved with the 'browser' baseline —
+ * which yields the correct host:setup gating for every hostMode: host-capable
+ * modes keep their host:* capabilities in a browser, and the other modes
+ * never had them.
+ */
+import type { RequestEvent } from '@sveltejs/kit';
+import {
+  buildComposeOptions,
+  classifyLocalInstall,
+  composePs,
+  deriveLaunchStatus,
+  deriveLocalStackState,
+  detectRuntime,
+  type ComposeServiceStatus,
+} from '@openpalm/lib';
+import { getState } from '$lib/server/state.js';
+import { listRemoteStatuses } from '$lib/server/endpoints.js';
+import { computeServerRuntimeContext } from '$lib/server/features.js';
+import { resolveCapabilities } from '$lib/runtime-context.svelte.js';
+import { resolveLanding, type LaunchState } from '$lib/resolve-landing.js';
+import type { ClientContext, RuntimeContext } from '$lib/types.js';
+
+type LaunchRouting = {
+  installState: ReturnType<typeof classifyLocalInstall>;
+  launch: ReturnType<typeof deriveLaunchStatus>;
+};
+
+let launchRoutingCache: { expiresAt: number; value: LaunchRouting } | null = null;
+
+/** Test-only: clear the 5s launch-routing cache so each test resolves fresh. */
+export function _resetLaunchCache(): void {
+  launchRoutingCache = null;
+}
+
+function parseComposePsServices(stdout: string): ComposeServiceStatus[] {
+  const services: ComposeServiceStatus[] = [];
+  for (const line of stdout.split('\n')) {
+    const trimmed = line.trim();
+    if (!trimmed) continue;
+    try {
+      const parsed = JSON.parse(trimmed) as Record<string, unknown>;
+      services.push({
+        service: String(parsed.Service ?? parsed.Name ?? ''),
+        state: String(parsed.State ?? ''),
+        health: String(parsed.Health ?? ''),
+      });
+    } catch {
+      // Skip malformed compose ps lines — health derives from the valid ones.
+    }
+  }
+  return services;
+}
+
+async function resolveLaunchRouting(): Promise<LaunchRouting> {
+  if (launchRoutingCache && launchRoutingCache.expiresAt > Date.now()) {
+    return launchRoutingCache.value;
+  }
+  const state = getState();
+  const installState = classifyLocalInstall(state.stackDir, state.homeDir);
+  const composeResult = await composePs(buildComposeOptions(state));
+  const services = composeResult.ok ? parseComposePsServices(composeResult.stdout) : [];
+  const localState = deriveLocalStackState(installState, services);
+  const launch = deriveLaunchStatus({
+    local: {
+      state: localState,
+      runtime: installState === 'not_installed' ? await detectRuntime() : undefined,
+      detail: { installState },
+    },
+    remotes: await listRemoteStatuses(),
+  });
+  const value = { installState, launch };
+  launchRoutingCache = { value, expiresAt: Date.now() + 5_000 };
+  return value;
+}
+
+/**
+ * Resolve the landing path for a request via resolveLanding() (plan §6.5).
+ * May return a path with a query string (e.g. '/admin?tab=diagnostics').
+ */
+export async function resolveRequestLanding(event: RequestEvent): Promise<string> {
+  const serverCtx = computeServerRuntimeContext(event);
+  const clientContext: ClientContext = { displayMode: 'browser' };
+  const ctx: RuntimeContext = {
+    ...serverCtx,
+    clientContext,
+    effectiveCapabilities: resolveCapabilities(serverCtx.serverCapabilities, clientContext),
+  };
+
+  const { installState, launch } = await resolveLaunchRouting();
+  // Preserve the pre-Phase-3 nuance: an interrupted install whose containers
+  // happen to be running still needs the wizard finished — land it on /setup
+  // (the old router special-cased this combination to the splash's "resume
+  // setup" card), not on chat against a half-configured stack.
+  const localState =
+    installState === 'setup_incomplete' && launch.local.state === 'running'
+      ? 'setup_incomplete'
+      : launch.local.state;
+  // Connections usable right now: accessible remotes, plus the local
+  // assistant when it is healthy. Only reachable connections count — a dead
+  // remote must not satisfy the "has somewhere to chat" checks (#440).
+  const connections: LaunchState['connections'] = [
+    ...(launch.hasHealthyLocal ? [{ id: 'default' }] : []),
+    ...launch.remotes.filter((r) => r.state === 'accessible'),
+  ];
+  const launchState: LaunchState = {
+    // No blocking migration exists yet — the gate (and /attention) is wired
+    // ahead of the first one (plan §6.5).
+    migration: { status: 'none' },
+    local: { state: localState },
+    connections,
+  };
+  return resolveLanding(ctx, launchState);
+}
diff --git a/packages/ui/src/lib/server/state.ts b/packages/ui/src/lib/server/state.ts
index ffa85b1c4..75354d770 100644
--- a/packages/ui/src/lib/server/state.ts
+++ b/packages/ui/src/lib/server/state.ts
@@ -12,7 +12,8 @@ export function getState(): ControlPlaneState {
   // Pure read: resolve paths/config from disk only. Secrets and other OP_HOME
   // assets are written ONLY by install/update/apply (applyHome) — serving
   // the UI never mutates the home. A home that needs reconciling is detected
-  // read-only and routed to /splash, where the user clicks "apply".
+  // read-only and routed to the resolved landing (resolveLanding(), plan
+  // §6.5), where the user clicks "apply".
   if (!_state) _state = createState();
   return _state;
 }
diff --git a/packages/ui/src/routes/+page.server.ts b/packages/ui/src/routes/+page.server.ts
new file mode 100644
index 000000000..bee1bd473
--- /dev/null
+++ b/packages/ui/src/routes/+page.server.ts
@@ -0,0 +1,16 @@
+/**
+ * Root route — always redirects to the resolved landing (plan
+ * ui-runtime-modes-plan.md §6.5, Phase 3).
+ *
+ * Document navigations to `/` are already redirected by the launch-routing
+ * guard in hooks.server.ts (pre-auth). This server load covers CLIENT-SIDE
+ * navigations to `/` (SvelteKit data requests), which resolve the same
+ * landing through the same $lib/server/landing.js helper.
+ */
+import { redirect } from '@sveltejs/kit';
+import type { PageServerLoad } from './$types';
+import { resolveRequestLanding } from '$lib/server/landing.js';
+
+export const load: PageServerLoad = async (event) => {
+  redirect(302, await resolveRequestLanding(event));
+};
diff --git a/packages/ui/src/routes/+page.svelte b/packages/ui/src/routes/+page.svelte
index 37988e195..99ecb1f93 100644
--- a/packages/ui/src/routes/+page.svelte
+++ b/packages/ui/src/routes/+page.svelte
@@ -1 +1,3 @@
-<!-- Root route: redirected to /chat by +page.ts load function -->
+<!-- Root route: never renders — hooks.server.ts (document navigations) and
+     +page.server.ts (client-side navigations) both redirect to the landing
+     resolved by resolveLanding() (plan ui-runtime-modes-plan.md §6.5). -->
diff --git a/packages/ui/src/routes/+page.ts b/packages/ui/src/routes/+page.ts
deleted file mode 100644
index 336287dcc..000000000
--- a/packages/ui/src/routes/+page.ts
+++ /dev/null
@@ -1,6 +0,0 @@
-import { redirect } from '@sveltejs/kit';
-import type { PageLoad } from './$types';
-
-export const load: PageLoad = () => {
-  redirect(302, '/splash');
-};
diff --git a/packages/ui/src/routes/admin/endpoints/+page.ts b/packages/ui/src/routes/admin/endpoints/+page.ts
index b1a8ab12f..ba0dd582e 100644
--- a/packages/ui/src/routes/admin/endpoints/+page.ts
+++ b/packages/ui/src/routes/admin/endpoints/+page.ts
@@ -4,7 +4,7 @@
  *
  * Connection management moved to the capability-guarded /connections surface.
  * This alias is kept for the 0.13.0 release only — Phase 4 turns /admin/*
- * into 404s. Same convention as the routes/+page.ts → /splash redirect.
+ * into 404s. Same convention as the routes/connections/new/+page.ts alias.
  * (The sibling +server.ts JSON API remains for out-of-process callers this
  * release; SvelteKit content-negotiates HTML navigations to this page.)
  */
diff --git a/packages/ui/src/routes/attention/+page.svelte b/packages/ui/src/routes/attention/+page.svelte
new file mode 100644
index 000000000..da80c69d9
--- /dev/null
+++ b/packages/ui/src/routes/attention/+page.svelte
@@ -0,0 +1,89 @@
+<script lang="ts">
+  // /attention — the migration/blocking surface split out of /splash (plan
+  // ui-runtime-modes-plan.md §6.5, Phase 3). resolveLanding() routes
+  // host-capable sessions here when a blocking task (migration.status ===
+  // 'pending') must finish before the stack can continue. Nothing produces
+  // 'pending' yet — the surface is wired ahead of the first blocking OP_HOME
+  // migration; sessions that land here with nothing blocking are redirected
+  // back to the resolved landing by the hooks.server launch-routing guard.
+  import { resolve } from '$app/paths';
+  import IconLogo from '$lib/components/icons/IconLogo.svelte';
+</script>
+
+<svelte:head><title>OpenPalm — needs attention</title></svelte:head>
+
+<div class="setup-page">
+  <header class="wiz-topbar">
+    <div class="wiz-wordmark">
+      <IconLogo size={30} />
+      <b>OpenPalm</b>
+    </div>
+  </header>
+
+  <main class="attention-stage">
+    <div class="attention-panel">
+      <p class="wiz-eyebrow"><span class="sev-dot" aria-hidden="true"></span>Needs attention</p>
+      <h1 class="wiz-title">Before your assistant can continue</h1>
+      <p class="wiz-lede">
+        A blocking task — such as a data migration — has to finish before OpenPalm can start
+        normally. Follow the steps shown here, then reload.
+      </p>
+
+      <div class="attention-actions">
+        <button class="btn btn-primary btn-lg" onclick={() => window.location.reload()}>Reload</button>
+        <a class="btn btn-outline btn-lg" href={resolve('/admin')}>Open dashboard</a>
+      </div>
+    </div>
+  </main>
+</div>
+
+<style>
+  /* Mirrors the calm single-column stage of the setup wizard (and the former
+     /splash page): full-height page, wordmark topbar, big title + lede. */
+  .attention-stage {
+    flex: 1;
+    display: flex;
+    flex-direction: column;
+    align-items: center;
+    overflow-y: auto;
+    padding: clamp(var(--s-sp-8), 8vh, 3rem) var(--s-sp-6) 3rem;
+    background: var(--s-paper);
+    color: var(--s-ink);
+    font-family: var(--s-font-display);
+  }
+  .attention-panel {
+    width: 100%;
+    max-width: 32rem;
+  }
+
+  .attention-panel .wiz-eyebrow {
+    font-family: var(--s-font-mono);
+    font-size: var(--s-type-deed);
+    letter-spacing: var(--s-track-label);
+    text-transform: uppercase;
+    color: var(--s-ink-3);
+    display: flex;
+    align-items: center;
+    gap: var(--s-sp-2);
+  }
+  .sev-dot {
+    width: 7px;
+    height: 7px;
+    border-radius: 50%;
+    flex: none;
+    background: var(--s-seal);
+  }
+
+  .attention-actions {
+    display: flex;
+    flex-wrap: wrap;
+    gap: var(--s-sp-3);
+    margin-top: var(--s-sp-6);
+  }
+
+  @media (max-width: 480px) {
+    .attention-stage { padding: var(--s-sp-6) var(--s-sp-4) var(--s-sp-8); }
+    .wiz-topbar { padding-left: var(--s-sp-4); padding-right: var(--s-sp-4); }
+    .btn { width: 100%; }
+  }
+</style>
diff --git a/packages/ui/src/routes/connections/new/+page.svelte b/packages/ui/src/routes/connections/new/+page.svelte
new file mode 100644
index 000000000..397905fcd
--- /dev/null
+++ b/packages/ui/src/routes/connections/new/+page.svelte
@@ -0,0 +1,6 @@
+<!--
+  /connections/new is a redirect alias to /connections?new=1 (plan
+  ui-runtime-modes-plan.md §6.5, Phase 3). The universal load in +page.ts
+  always throws redirect(302), so this component never renders — the
+  management UI lives at routes/connections/+page.svelte.
+-->
diff --git a/packages/ui/src/routes/connections/new/+page.ts b/packages/ui/src/routes/connections/new/+page.ts
new file mode 100644
index 000000000..13097a3b0
--- /dev/null
+++ b/packages/ui/src/routes/connections/new/+page.ts
@@ -0,0 +1,13 @@
+/**
+ * /connections/new — the pwa-static "no connections yet" landing (plan
+ * ui-runtime-modes-plan.md §6.5, Phase 3). resolveLanding() sends sessions
+ * without a usable connection here; in the host app the connection manager
+ * lives at /connections, so this route opens it with the add form expanded.
+ * Same alias convention as routes/admin/endpoints/+page.ts.
+ */
+import { redirect } from '@sveltejs/kit';
+import type { PageLoad } from './$types';
+
+export const load: PageLoad = () => {
+  redirect(302, '/connections?new=1');
+};
diff --git a/packages/ui/src/routes/splash/+page.server.ts b/packages/ui/src/routes/splash/+page.server.ts
deleted file mode 100644
index 29d4817ac..000000000
--- a/packages/ui/src/routes/splash/+page.server.ts
+++ /dev/null
@@ -1,39 +0,0 @@
-import { deriveLaunchStatus, deriveLocalStackState, classifyLocalInstall, composePs, buildComposeOptions, detectRuntime } from '@openpalm/lib';
-import { getState } from '$lib/server/state.js';
-import { listRemoteStatuses } from '$lib/server/endpoints.js';
-
-function parseComposePsServices(stdout: string) {
-  return stdout
-    .split('\n')
-    .map((line) => line.trim())
-    .filter(Boolean)
-    .flatMap((line) => {
-      try {
-        const parsed = JSON.parse(line) as Record<string, unknown>;
-        return [{
-          service: String(parsed.Service ?? parsed.Name ?? ''),
-          state: String(parsed.State ?? ''),
-          health: String(parsed.Health ?? ''),
-        }];
-      } catch {
-        return [];
-      }
-    });
-}
-
-export async function load() {
-  const state = getState();
-  const installState = classifyLocalInstall(state.stackDir, state.homeDir);
-  const composeResult = await composePs(buildComposeOptions(state));
-  const localState = deriveLocalStackState(installState, composeResult.ok ? parseComposePsServices(composeResult.stdout) : []);
-  return {
-    launchStatus: deriveLaunchStatus({
-      local: {
-        state: localState,
-        runtime: installState === 'not_installed' ? await detectRuntime() : undefined,
-        detail: { installState },
-      },
-      remotes: await listRemoteStatuses(),
-    }),
-  };
-}
diff --git a/packages/ui/src/routes/splash/+page.svelte b/packages/ui/src/routes/splash/+page.svelte
deleted file mode 100644
index f05d2ba6f..000000000
--- a/packages/ui/src/routes/splash/+page.svelte
+++ /dev/null
@@ -1,188 +0,0 @@
-<script lang="ts">
-  import type { PageData } from './$types';
-  import { resolve } from '$app/paths';
-  import IconLogo from '$lib/components/icons/IconLogo.svelte';
-
-  let { data }: { data: PageData } = $props();
-
-  type Severity = 'danger' | 'warning' | 'info' | 'success';
-
-  const view = $derived({ state: data.launchStatus.local.state });
-
-  function remoteLabel(s: string): string {
-    return { accessible: 'Connected', unreachable: 'Unreachable', unauthorized: 'Needs sign-in', unknown: 'Unknown' }[s] ?? s;
-  }
-
-  // ── Per-stack-state copy ─────────────────────────────────────────────────────
-  type Card = { severity: Severity; eyebrow: string; title: string; body: string };
-  const stackCard = $derived.by<Card>(() => {
-    switch (data.launchStatus.local.state) {
-      case 'not_installed':
-        return { severity: 'info', eyebrow: 'Welcome', title: 'Let’s get you set up',
-          body: 'OpenPalm isn’t installed yet. Run the quick setup to install your assistant, or connect to one running somewhere else.' };
-      case 'setup_incomplete':
-        return { severity: 'warning', eyebrow: 'Almost there', title: 'Finish setting up',
-          body: 'Installation was started but never finished. Pick up where you left off to get your assistant running.' };
-      case 'installed_offline':
-        return { severity: 'warning', eyebrow: 'Stopped', title: 'Your assistant is offline',
-          body: 'OpenPalm is installed but nothing is running right now. Open the dashboard to start it back up.' };
-      case 'installed_broken':
-        return { severity: 'danger', eyebrow: 'Needs attention', title: 'Something needs a look',
-          body: 'Your stack is running but one or more services are unhealthy. The diagnostics will show you what went wrong.' };
-      case 'running':
-        return { severity: 'success', eyebrow: 'Ready', title: 'You’re all set',
-          body: 'Everything is healthy. Open the chat to start talking to your assistant.' };
-      default:
-        return { severity: 'info', eyebrow: 'Status', title: 'OpenPalm', body: '' };
-    }
-  });
-
-  const runtime = $derived(data.launchStatus.local.runtime);
-  const remotes = $derived(data.launchStatus.remotes);
-  const accessibleRemote = $derived(remotes.find((r) => r.state === 'accessible'));
-</script>
-
-<svelte:head><title>OpenPalm</title></svelte:head>
-
-<div class="setup-page">
-  <header class="wiz-topbar">
-    <div class="wiz-wordmark">
-      <IconLogo size={30} />
-      <b>OpenPalm</b>
-    </div>
-  </header>
-
-  <main class="splash-stage">
-    <div class="splash-panel">
-      <p class="wiz-eyebrow"><span class="sev-dot sev-{stackCard.severity}" aria-hidden="true"></span>{stackCard.eyebrow}</p>
-      <h1 class="wiz-title">{stackCard.title}</h1>
-      <p class="wiz-lede">{stackCard.body}</p>
-
-      {#if view.state === 'not_installed' && runtime && !runtime.dockerPresent}
-        <p class="splash-guidance">No container runtime found. Install <a href="https://www.docker.com/products/docker-desktop/" target="_blank" rel="noreferrer">Docker</a> (or OrbStack / Podman), start it, then reload this page.</p>
-      {/if}
-      {#if view.state === 'installed_broken'}
-        <p class="splash-guidance">Unhealthy services are listed in Diagnostics; the container logs show the underlying error.</p>
-      {/if}
-
-      <div class="splash-actions">
-        {#if view.state === 'not_installed'}
-          <a class="btn btn-primary btn-lg" href={resolve('/setup')}>Run setup</a>
-          {#if accessibleRemote}<a class="btn btn-outline btn-lg" href={resolve('/chat')}>Use {accessibleRemote.name}</a>
-          {:else}<button class="btn btn-ghost btn-lg" onclick={() => window.location.reload()}>Reload</button>{/if}
-        {:else if view.state === 'setup_incomplete'}
-          <a class="btn btn-primary btn-lg" href={resolve('/setup')}>Resume setup</a>
-        {:else if view.state === 'installed_offline'}
-          <a class="btn btn-primary btn-lg" href={resolve('/admin')}>Open dashboard</a>
-          <button class="btn btn-outline btn-lg" onclick={() => window.location.reload()}>Reload</button>
-        {:else if view.state === 'installed_broken'}
-          <a class="btn btn-primary btn-lg" href={resolve('/admin')}>Open diagnostics</a>
-          <button class="btn btn-outline btn-lg" onclick={() => window.location.reload()}>Retry</button>
-        {:else if view.state === 'running'}
-          <a class="btn btn-primary btn-lg" href={resolve('/chat')}>Open chat</a>
-          <a class="btn btn-ghost btn-lg" href={resolve('/admin')}>Admin</a>
-        {/if}
-      </div>
-
-      {#if remotes.length}
-        <ul class="splash-remotes" aria-label="Remote connections">
-          {#each remotes as remote (remote.id)}
-            <li>
-              <span class="dot {remote.state === 'accessible' ? 'ok' : 'bad'}" aria-hidden="true"></span>
-              <span class="rname">{remote.name}</span>
-              <span class="rstate">{remoteLabel(remote.state)}</span>
-            </li>
-          {/each}
-        </ul>
-      {/if}
-    </div>
-  </main>
-</div>
-
-<style>
-  /* Calm, top-aligned single-column stage — mirrors the setup wizard's friendly,
-     low-density feel (full-height page, wordmark topbar, big title + lede). Top
-     aligned (not centred) so there is no empty band above the content, matching
-     the wizard's content rhythm. */
-  .splash-stage {
-    flex: 1;
-    display: flex;
-    flex-direction: column;
-    align-items: center;
-    overflow-y: auto;
-    padding: clamp(var(--s-sp-8), 8vh, 3rem) var(--s-sp-6) 3rem;
-    background: var(--s-paper);
-    color: var(--s-ink);
-    font-family: var(--s-font-display);
-  }
-  .splash-panel {
-    width: 100%;
-    max-width: 32rem;
-  }
-
-  /* Severity eyebrow — mono label treatment matches the Stillness system. */
-  .splash-panel .wiz-eyebrow {
-    font-family: var(--s-font-mono);
-    font-size: var(--s-type-deed);
-    letter-spacing: var(--s-track-label);
-    text-transform: uppercase;
-    color: var(--s-ink-3);
-    display: flex;
-    align-items: center;
-    gap: var(--s-sp-2);
-  }
-  .sev-dot {
-    width: 7px; height: 7px; border-radius: 50%; flex: none;
-  }
-  .sev-dot.sev-danger  { background: var(--s-seal); }
-  .sev-dot.sev-warning { background: color-mix(in srgb, var(--s-seal) 60%, var(--s-ink)); }
-  .sev-dot.sev-info    { background: var(--s-ink-2); }
-  .sev-dot.sev-success { background: var(--s-moss); }
-
-  /* Single, controlled gap before the actions. */
-  .splash-panel :global(.wiz-lede) { margin-bottom: var(--s-sp-2); }
-
-  .splash-guidance {
-    font-family: var(--s-font-display);
-    font-size: var(--s-type-deed);
-    line-height: 1.6;
-    color: var(--s-ink-2);
-    margin: 0 0 var(--s-sp-2);
-    max-width: 480px;
-  }
-
-  .splash-actions {
-    display: flex;
-    flex-wrap: wrap;
-    gap: var(--s-sp-3);
-    margin-top: var(--s-sp-6);
-  }
-
-  .splash-remotes {
-    list-style: none;
-    margin: var(--s-sp-8) 0 0;
-    padding: var(--s-sp-4) 0 0;
-    border-top: var(--s-hair) solid var(--s-line);
-    display: flex;
-    flex-direction: column;
-    gap: var(--s-sp-2);
-  }
-  .splash-remotes li {
-    display: flex;
-    align-items: center;
-    gap: var(--s-sp-2);
-    font-family: var(--s-font-mono);
-    font-size: var(--s-type-deed);
-  }
-  .dot { width: 8px; height: 8px; border-radius: 50%; flex: none; }
-  .dot.ok  { background: var(--s-moss); }
-  .dot.bad { background: var(--s-seal); }
-  .rname  { color: var(--s-ink); }
-  .rstate { color: var(--s-ink-3); margin-left: auto; }
-
-  @media (max-width: 480px) {
-    .splash-stage { padding: var(--s-sp-6) var(--s-sp-4) var(--s-sp-8); }
-    .wiz-topbar { padding-left: var(--s-sp-4); padding-right: var(--s-sp-4); }
-    .btn { width: 100%; }
-  }
-</style>

From 90b7513576589d6c899fda6d71f5998f33db3f3c Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Mon, 6 Jul 2026 13:31:07 +0000
Subject: [PATCH 16/61] refactor(ui): capability-driven navigation; untangle
 admin chrome from chat (#555)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Plan ui-runtime-modes-plan.md Phase 3 steps 3-4:

- chrome/Navbar.svelte becomes the chat-free shell: brand + the chat/host
  utility button + theme toggle, with a children snippet for surface
  controls. Destinations come from runtimeContext.routes and visibility from
  hasCapability('host:stack:read') — the legacy admin feature flag is gone
  from every component (hygiene test lib/features-admin-hygiene.vitest.ts);
  the alias survives only in server code (hooks.server.ts /
  +layout.server.ts, whose layout-data contract stays pinned) pending
  Phase 4. lib/features.svelte.ts (client featuresService) is deleted.

- New chrome/ChatNavbar.svelte: the conversation-surface composition — shell
  plus EndpointSwitcher, SessionPicker, VoiceControl, ModeSwitch and the
  session-aware brand href. /advanced and /connections mount it; /admin
  mounts the shell directly, so the admin surface no longer drags chat
  components/stores into the host bundle (chrome-untangle-hygiene.vitest.ts,
  the #555 prerequisite for the Phase 5 client extraction).

- chat/+page.svelte imports probeChatBackend from the $lib/api/chat.js domain
  client instead of the $lib/api.js barrel, which re-exports every admin
  domain client (routes/chat/page-imports.vitest.ts).

- routes/admin/+page.svelte honors the ?tab=diagnostics landing deep-link
  (installed_broken → Systems tab); routes/connections/+page.svelte opens the
  add form when landed via /connections/new (?new=1).

Behavior deltas that follow from the untangle: the admin surface no longer
renders voice controls or the advanced-mode switch (they are chat chrome),
and its back-to-chat button targets the plain chat route rather than a
session-restoring path (session paths require chat-store imports).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FetR7BttT1xBrA8fBwhui9
---
 .../lib/components/chrome/ChatNavbar.svelte   |  68 +++++++++++
 .../src/lib/components/chrome/Navbar.svelte   | 111 ++++++------------
 packages/ui/src/lib/features.svelte.ts        |  16 ---
 packages/ui/src/routes/+layout.svelte         |   9 +-
 packages/ui/src/routes/admin/+page.svelte     |   7 ++
 packages/ui/src/routes/advanced/+page.svelte  |   4 +-
 packages/ui/src/routes/chat/+page.svelte      |   5 +-
 .../ui/src/routes/connections/+page.svelte    |   8 +-
 8 files changed, 129 insertions(+), 99 deletions(-)
 create mode 100644 packages/ui/src/lib/components/chrome/ChatNavbar.svelte
 delete mode 100644 packages/ui/src/lib/features.svelte.ts

diff --git a/packages/ui/src/lib/components/chrome/ChatNavbar.svelte b/packages/ui/src/lib/components/chrome/ChatNavbar.svelte
new file mode 100644
index 000000000..965a8e78a
--- /dev/null
+++ b/packages/ui/src/lib/components/chrome/ChatNavbar.svelte
@@ -0,0 +1,68 @@
+<script lang="ts">
+  import { onMount } from 'svelte';
+  import { page } from '$app/state';
+  import Navbar from '$lib/components/chrome/Navbar.svelte';
+  import ModeSwitch from '$lib/components/chrome/ModeSwitch.svelte';
+  import EndpointSwitcher from '$lib/components/chat/EndpointSwitcher.svelte';
+  import SessionPicker from '$lib/components/chat/SessionPicker.svelte';
+  import VoiceControl from '$lib/components/chat/VoiceControl.svelte';
+  import { advancedModeService } from '$lib/advanced-mode-state.svelte.js';
+  import { buildAdvancedPath, buildChatPath, currentChatSessionId } from '$lib/chat/navigation.js';
+
+  // Chat-surface chrome COMPOSITION (plan ui-runtime-modes-plan.md Phase 3
+  // step 4, #555): the Navbar shell plus the global chat controls —
+  //   - assistant switcher (EndpointSwitcher)
+  //   - session picker (SessionPicker)
+  //   - mic + speaker (VoiceControl) — VoiceControl.initVoice() runs here so
+  //     STT and TTS work across the surfaces that mount this chrome. Do not
+  //     move it into a page-scoped toolbar.
+  // The admin surface mounts the shell directly and must stay free of these
+  // chat imports; only conversation-adjacent surfaces (/advanced,
+  // /connections) mount this composition. (/chat renders its own corner
+  // chrome and hides the navbar entirely.)
+  const pathname = $derived(page.url?.pathname ?? '');
+  // The chat selectors appear only on the conversation surfaces; on
+  // /connections the page itself is the switcher.
+  const onConversationSurface = $derived(
+    pathname === '/chat' ||
+    pathname.startsWith('/chat/') ||
+    pathname === '/advanced' ||
+    pathname.startsWith('/advanced/')
+  );
+
+  const preferredChatHref = $derived.by(() => {
+    const sessionId = page.url.searchParams.get('session') ?? currentChatSessionId();
+    return advancedModeService.enabled ? buildAdvancedPath(sessionId) : buildChatPath(sessionId);
+  });
+
+  onMount(() => {
+    advancedModeService.init();
+  });
+</script>
+
+<Navbar brandHref={preferredChatHref}>
+  {#if onConversationSurface}
+    <!-- Hidden ≥1024px: the chat side panel hosts these selectors there. -->
+    <span class="chat-selectors">
+      <EndpointSwitcher />
+      <SessionPicker />
+    </span>
+  {/if}
+  <ModeSwitch />
+  <VoiceControl />
+</Navbar>
+
+<style>
+  /* The assistant + session selectors live in the navbar only below 1024px;
+     at wider widths the chat side panel hosts them, so hide the triggers. */
+  .chat-selectors {
+    display: inline-flex;
+    align-items: center;
+    gap: var(--s-sp-2);
+  }
+  @media (min-width: 1024px) {
+    .chat-selectors {
+      display: none;
+    }
+  }
+</style>
diff --git a/packages/ui/src/lib/components/chrome/Navbar.svelte b/packages/ui/src/lib/components/chrome/Navbar.svelte
index d1935846b..ba415afae 100644
--- a/packages/ui/src/lib/components/chrome/Navbar.svelte
+++ b/packages/ui/src/lib/components/chrome/Navbar.svelte
@@ -1,85 +1,62 @@
 <script lang="ts">
-  import { onMount } from 'svelte';
+  import type { Snippet } from 'svelte';
   import { page } from '$app/state';
   import IconButton from '$lib/components/common/IconButton.svelte';
-  import ModeSwitch from '$lib/components/chrome/ModeSwitch.svelte';
   import ThemeToggle from '$lib/components/common/ThemeToggle.svelte';
-  import EndpointSwitcher from '$lib/components/chat/EndpointSwitcher.svelte';
-  import SessionPicker from '$lib/components/chat/SessionPicker.svelte';
-  import VoiceControl from '$lib/components/chat/VoiceControl.svelte';
-  import { advancedModeService } from '$lib/advanced-mode-state.svelte.js';
-  import { buildAdvancedPath, buildChatPath, currentChatSessionId } from '$lib/chat/navigation.js';
-  import { featuresService } from '$lib/features.svelte.js';
+  import { hasCapability, runtimeContext } from '$lib/runtime-context.svelte.js';
   import IconChat from '$lib/components/icons/IconChat.svelte';
   import IconLogo from '$lib/components/icons/IconLogo.svelte';
   import IconSettings from '$lib/components/icons/IconSettings.svelte';
 
-  // GLOBAL top chrome, mounted on EVERY page. These controls must be present and
-  // usable everywhere:
-  //   - assistant switcher (EndpointSwitcher)
-  //   - session picker (SessionPicker)
-  //   - mic + speaker (VoiceControl) — VoiceControl.initVoice() runs here so STT
-  //     and TTS work globally; this component LIVING IN THE NAVBAR is what makes
-  //     voice global. Do not move it into a page-scoped toolbar.
-  // The Chat↔Advanced mode switch appears here (left of the global controls)
-  // only on the chat surfaces.
-  const pathname = $derived(page.url?.pathname ?? '');
-  const onAdmin = $derived(pathname === '/admin' || pathname.startsWith('/admin/'));
-  // The Chat↔Advanced mode switch lives in the global navbar so it's always a
-  // stable, top-level destination. Only the left-most utility button swaps:
-  // settings on most pages, chat on admin.
-  const onChatSurface = $derived(
-    pathname === '/chat' ||
-    pathname.startsWith('/chat/')
-  );
-  const onAdvancedSurface = $derived(
-    pathname === '/advanced' ||
-    pathname.startsWith('/advanced/')
-  );
-  const onConversationSurface = $derived(onChatSurface || onAdvancedSurface);
+  // Top chrome SHELL: brand, the chat↔host utility button, and the theme
+  // toggle. Deliberately free of chat components and chat stores (plan
+  // ui-runtime-modes-plan.md Phase 3 step 4, #555) so the admin surface can
+  // mount it without dragging chat modules into the host bundle. Conversation
+  // surfaces mount ChatNavbar.svelte, which composes this shell with the
+  // global chat controls (assistant switcher, session picker, voice).
+  //
+  // Navigation is capability-driven (plan §8.6): destinations come from
+  // runtimeContext.routes and visibility from hasCapability() — never the
+  // legacy admin feature flag.
+  interface Props {
+    /** Brand destination; defaults to the mode's chat route. */
+    brandHref?: string;
+    /** Surface-specific controls rendered after the theme toggle. */
+    children?: Snippet;
+  }
 
-  const preferredChatHref = $derived.by(() => {
-    const sessionId = page.url.searchParams.get('session') ?? currentChatSessionId();
-    return advancedModeService.enabled ? buildAdvancedPath(sessionId) : buildChatPath(sessionId);
-  });
+  let { brandHref, children }: Props = $props();
 
-  onMount(() => {
-    advancedModeService.init();
-  });
+  const chatRoute = $derived(runtimeContext.routes.chat ?? '/chat');
+  const hostRoute = $derived(runtimeContext.routes.host);
+  const pathname = $derived(page.url?.pathname ?? '');
+  const onHostSurface = $derived(
+    hostRoute !== undefined && (pathname === hostRoute || pathname.startsWith(`${hostRoute}/`))
+  );
+  const resolvedBrandHref = $derived(brandHref ?? chatRoute);
 </script>
 
 <header class="navbar">
   <div class="navbar-inner">
     <!-- Brand -->
-    <!-- eslint-disable-next-line svelte/no-navigation-without-resolve -- dynamic session-aware chat path built internally, not a static route id -->
-    <a class="navbar-brand" href={preferredChatHref} aria-label="OpenPalm — go to chat">
+    <!-- eslint-disable-next-line svelte/no-navigation-without-resolve -- destination comes from runtimeContext.routes / a session-aware path, not a static route id -->
+    <a class="navbar-brand" href={resolvedBrandHref} aria-label="OpenPalm — go to chat">
       <span class="brand-icon" aria-hidden="true">
         <IconLogo size={28} />
       </span>
       <span class="brand-text">OpenPalm</span>
     </a>
 
-
-
-    <!-- Global controls, left→right: chat/settings · assistant · session ·
-         advanced · speaker · mic (speaker+mic come from VoiceControl). Present
-         on every page, every width. -->
+    <!-- Utility cluster, left→right: chat/host button · theme · surface
+         controls (from children). -->
     <div class="navbar-actions">
-      {#if onAdmin}
-        <IconButton href={preferredChatHref} ariaLabel="Back to chat" title="Chat" icon={chatIcon} />
-      {:else if featuresService.admin}
-        <IconButton href="/admin" ariaLabel="Manage assistant" title="Admin" icon={settingsIcon} />
+      {#if onHostSurface}
+        <IconButton href={resolvedBrandHref} ariaLabel="Back to chat" title="Chat" icon={chatIcon} />
+      {:else if hostRoute !== undefined && hasCapability('host:stack:read')}
+        <IconButton href={hostRoute} ariaLabel="Manage assistant" title="Admin" icon={settingsIcon} />
       {/if}
       <ThemeToggle />
-      {#if onConversationSurface}
-        <!-- Hidden ≥1024px: the chat side panel hosts these selectors there. -->
-        <span class="chat-selectors">
-          <EndpointSwitcher />
-          <SessionPicker />
-        </span>
-      {/if}
-      <ModeSwitch />
-      <VoiceControl />
+      {@render children?.()}
     </div>
   </div>
 </header>
@@ -149,26 +126,14 @@
     margin-left: auto;
     min-width: 0;
   }
-  /* The assistant + session triggers may shrink (truncate label) but never
-     disappear — at narrow widths they go icon-only via the rule below. */
+  /* The assistant + session triggers (rendered by ChatNavbar's children) may
+     shrink (truncate label) but never disappear — at narrow widths they go
+     icon-only via the rule below. */
   .navbar-actions :global(.switcher),
   .navbar-actions :global(.trigger) {
     min-width: 0;
   }
 
-  /* The assistant + session selectors live in the navbar only below 1024px;
-     at wider widths the chat side panel hosts them, so hide the triggers. */
-  .chat-selectors {
-    display: inline-flex;
-    align-items: center;
-    gap: var(--s-sp-2);
-  }
-  @media (min-width: 1024px) {
-    .chat-selectors {
-      display: none;
-    }
-  }
-
   /* ── Responsive: shed labels, keep every control visible. ── */
   @media (max-width: 900px) {
     /* Assistant + session collapse to icon + status dot + caret (their own
diff --git a/packages/ui/src/lib/features.svelte.ts b/packages/ui/src/lib/features.svelte.ts
deleted file mode 100644
index 36470b6d5..000000000
--- a/packages/ui/src/lib/features.svelte.ts
+++ /dev/null
@@ -1,16 +0,0 @@
-import type { FeatureFlags } from '$lib/types.js';
-
-/**
- * Client-side reactive feature flag state.
- * Initialized from layout server data (which reads env vars) so flags are
- * available on both first render (SSR) and all subsequent navigations.
- */
-class FeaturesService {
-  admin = $state(false);
-
-  init(flags: FeatureFlags): void {
-    this.admin = flags.admin;
-  }
-}
-
-export const featuresService = new FeaturesService();
diff --git a/packages/ui/src/routes/+layout.svelte b/packages/ui/src/routes/+layout.svelte
index 8be7df263..6ef99154d 100644
--- a/packages/ui/src/routes/+layout.svelte
+++ b/packages/ui/src/routes/+layout.svelte
@@ -1,10 +1,9 @@
 <script lang="ts">
-  import { onMount, untrack } from 'svelte';
+  import { onMount } from 'svelte';
   import "../app.css";
   import UpdateBanner from '$lib/components/common/UpdateBanner.svelte';
   import Toast from '$lib/components/common/Toast.svelte';
   import { themeService } from '$lib/theme-state.svelte.js';
-  import { featuresService } from '$lib/features.svelte.js';
   import { detectClientDisplayMode } from '$lib/client-context.js';
   import { initializeRuntimeContext } from '$lib/runtime-context.svelte.js';
 
@@ -15,9 +14,9 @@
 
   let { children, data }: Props = $props();
 
-  // Feature flags come from server env vars — constant at runtime. untrack() signals
-  // this is an intentional one-time read, not a reactive subscription.
-  untrack(() => featuresService.init(data.features));
+  // Components read capabilities via hasCapability()/runtimeContext only
+  // (plan §8.6) — the legacy admin feature-flag alias survives solely in
+  // server code (hooks.server.ts / +layout.server.ts) pending Phase 4.
 
   onMount(() => {
     themeService.init();
diff --git a/packages/ui/src/routes/admin/+page.svelte b/packages/ui/src/routes/admin/+page.svelte
index 4599036fd..e5ae6cc61 100644
--- a/packages/ui/src/routes/admin/+page.svelte
+++ b/packages/ui/src/routes/admin/+page.svelte
@@ -2,6 +2,7 @@
   import { onMount, onDestroy } from 'svelte';
   import { SvelteMap, SvelteSet } from 'svelte/reactivity';
   import { goto } from '$app/navigation';
+  import { page } from '$app/state';
   import { formatTime } from '$lib/format-date.js';
   import Navbar from '$lib/components/chrome/Navbar.svelte';
   import TabBar, { type TabId } from '$lib/components/chrome/TabBar.svelte';
@@ -265,6 +266,12 @@
   // ── Mount ────────────────────────────────────────────────────────────────────
 
   onMount(() => {
+    // Landing deep-link (plan ui-runtime-modes-plan.md §6.5): installed_broken
+    // lands on ?tab=diagnostics — the Systems tab is where unhealthy services
+    // and their state are listed.
+    if (page.url.searchParams.get('tab') === 'diagnostics') {
+      handleTabSelect('containers');
+    }
     startContainerPolling();
     // Auto-hydrate key data so tabs show meaningful state without manual refresh.
     // UpdatesTab fetches its own version data on mount.
diff --git a/packages/ui/src/routes/advanced/+page.svelte b/packages/ui/src/routes/advanced/+page.svelte
index 00ad2c476..4a300fc42 100644
--- a/packages/ui/src/routes/advanced/+page.svelte
+++ b/packages/ui/src/routes/advanced/+page.svelte
@@ -2,7 +2,7 @@
   import { page } from '$app/state';
   import { afterNavigate } from '$app/navigation';
   import { onMount } from 'svelte';
-  import Navbar from '$lib/components/chrome/Navbar.svelte';
+  import ChatNavbar from '$lib/components/chrome/ChatNavbar.svelte';
   import { buildAdvancedIframeUrl } from '$lib/chat/navigation.js';
   import { endpointsService } from '$lib/endpoints-state.svelte.js';
   import { chat } from '$lib/chat/chat-state.svelte.js';
@@ -106,7 +106,7 @@
   <title>Advanced Chat — OpenPalm</title>
 </svelte:head>
 
-<Navbar />
+<ChatNavbar />
 
 <div class="advanced-layout">
   {#if probeState === 'ready'}
diff --git a/packages/ui/src/routes/chat/+page.svelte b/packages/ui/src/routes/chat/+page.svelte
index 52ea8eabe..3b273eaae 100644
--- a/packages/ui/src/routes/chat/+page.svelte
+++ b/packages/ui/src/routes/chat/+page.svelte
@@ -12,7 +12,10 @@
 	import QuestionCard from '$lib/components/chat/QuestionCard.svelte';
 	import { createFocusTrap, handleTrapKeydown } from '$lib/actions/focus-trap.js';
 	import { isLocalAssistantUrl } from '$lib/assistant-endpoint.js';
-	import { probeChatBackend } from '$lib/api.js';
+	// Direct domain-client import (plan Phase 3 step 4, #555): the chat page
+	// must not import the $lib/api.js barrel, which re-exports every admin
+	// domain client and would drag them all into the chat chunk.
+	import { probeChatBackend } from '$lib/api/chat.js';
 	import { advancedModeService } from '$lib/advanced-mode-state.svelte.js';
 	import { buildAdvancedPath } from '$lib/chat/navigation.js';
 	import { chat } from '$lib/chat/chat-state.svelte.js';
diff --git a/packages/ui/src/routes/connections/+page.svelte b/packages/ui/src/routes/connections/+page.svelte
index 91074a8ad..274811524 100644
--- a/packages/ui/src/routes/connections/+page.svelte
+++ b/packages/ui/src/routes/connections/+page.svelte
@@ -1,6 +1,7 @@
 <script lang="ts">
   import { onMount } from 'svelte';
-  import Navbar from '$lib/components/chrome/Navbar.svelte';
+  import { page } from '$app/state';
+  import ChatNavbar from '$lib/components/chrome/ChatNavbar.svelte';
   import IconLock from '$lib/components/icons/IconLock.svelte';
   import { endpointsService as connectionsService } from '$lib/endpoints-state.svelte.js';
   import {
@@ -33,6 +34,9 @@
 
   onMount(() => {
     void connectionsService.load(true);
+    // The /connections/new landing (plan §6.5, Phase 3) aliases here with
+    // ?new=1 — open the add form so "no connections yet" starts at the form.
+    if (page.url.searchParams.get('new') === '1') openAddForm();
   });
 
   function openAddForm(): void {
@@ -130,7 +134,7 @@
   <title>Connections — OpenPalm</title>
 </svelte:head>
 
-<Navbar />
+<ChatNavbar />
 
 <main class="page">
     <header class="page-header">

From 0f9c2fa8c862a487128503226ef8a8e7dd13238f Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Mon, 6 Jul 2026 13:31:21 +0000
Subject: [PATCH 17/61] =?UTF-8?q?docs:=20add=20ui-route-map.md=20=E2=80=94?=
 =?UTF-8?q?=20routes,=20surfaces,=20guards=20after=20Phase=203=20(#555)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Carried from Phase 0's outstanding items into Phase 3, where the route
structure it documents actually changed (plan ui-runtime-modes-plan.md
Phase 3 step 5): the §6.5 landing table as implemented, the guard
inventory (auth, admin gate, requireAdmin, requireCapability, setup
localhost, host/origin), every page route with surface + guard, the API
namespaces, and the #555 chrome composition map. Notes that Playwright
suites need a real browser + Docker and cannot run in the sandboxed CI
container.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FetR7BttT1xBrA8fBwhui9
---
 docs/technical/ui-route-map.md | 131 +++++++++++++++++++++++++++++++++
 1 file changed, 131 insertions(+)
 create mode 100644 docs/technical/ui-route-map.md

diff --git a/docs/technical/ui-route-map.md b/docs/technical/ui-route-map.md
new file mode 100644
index 000000000..139535969
--- /dev/null
+++ b/docs/technical/ui-route-map.md
@@ -0,0 +1,131 @@
+# UI Route Map
+
+**Date:** 2026-07-06 (Phase 3 of `ui-runtime-modes-plan.md`)
+**Package:** `packages/ui` (`@openpalm/ui` — the host app)
+**Status:** current truth after the Phase 3 landing/navigation split. Phase 4
+renames `/admin` → `/host` (no alias; `HOST_ADMIN_LANDING` in
+`src/lib/resolve-landing.ts` flips with it). Phase 5 moves the chat +
+connections views into `packages/client`.
+
+Surfaces (plan §1): **Host** = host control plane (stack lifecycle, secrets,
+privileged ops), **Assistant** = chat against the active connection,
+**Connection** = connection management, **Entry** = landing/auth/first-run
+plumbing shared by all surfaces.
+
+## Landing resolution
+
+Every document navigation to `/` (and the legacy `/splash` path) is redirected
+by `hooks.server.ts` to the landing resolved by `resolveLanding(ctx,
+launchState)` (`src/lib/resolve-landing.ts`, plan §6.5):
+
+| Condition (in precedence order) | Landing |
+|---|---|
+| `host:setup` capability + migration pending | `/attention` |
+| `host:setup` + local `not_installed` (no accessible connection) | `/setup` |
+| `host:setup` + local `not_installed` (accessible connection exists, #440) | `/chat` |
+| `host:setup` + local `setup_incomplete` | `/setup` |
+| `host:setup` + local `installed_offline` | `/admin` (Phase 4: `/host`) |
+| `host:setup` + local `installed_broken` | `/admin?tab=diagnostics` |
+| `host:setup` + local `running` | `/chat` |
+| no `host:setup`, `assistant-container` mode | `/chat` |
+| no `host:setup`, `pwa-static` mode, 0 connections | `/connections/new` |
+| no `host:setup`, `pwa-static` mode, ≥1 connection | `/chat` |
+| anything else | `/chat` |
+
+The launch-routing guard fires **before** the auth guard, so `/` and stale
+`/splash` bookmarks never bounce through `/login` first. `/splash` no longer
+exists as a route; the path keeps redirecting to the resolved landing for this
+release only.
+
+## Guards (defined in `src/hooks.server.ts` unless noted)
+
+- **auth** — document navigations (GET + `Accept: text/html`) without a valid
+  `op_session` cookie redirect to `/login?redirectTo=…`. API/data requests are
+  left to the endpoint's own JSON 401.
+- **admin gate** — `/admin/*` requires a host-capable mode
+  (`electron-host`/`host-ui`, the legacy `features.admin` alias — server-side
+  only, removed with Phase 4); otherwise redirects to `/chat`
+  (`/admin/endpoints` → `/connections`).
+- **requireAdmin()** — per-endpoint session check in `+server.ts` handlers
+  (`$lib/server/helpers.js`); JSON 401, never an HTML redirect.
+- **requireCapability(cap)** — per-endpoint server-side capability check
+  (plan §8.5; `hasCapability()` in components is UX only).
+- **setup localhost** — SEC-4: `/setup` + `/api/setup/*` are unauthenticated
+  before first-run completes but restricted to loopback clients (unless
+  `OP_ALLOW_REMOTE_SETUP`); after completion, re-runs require admin auth.
+- **host/origin** — SEC-1/SEC-2 Host-header allowlist + Origin check apply to
+  every request; host admin stays loopback-only (plan §8.3).
+
+## Page routes
+
+| Path | Surface | Guard | Notes |
+|---|---|---|---|
+| `/` | Entry | launch-routing (pre-auth) | Never renders: hooks (document nav) + `+page.server.ts` (client-side nav) redirect to the resolved landing |
+| `/splash` | Entry | launch-routing (pre-auth) | **Route removed** in Phase 3; the path 302s to the resolved landing for this release |
+| `/attention` | Entry | auth | Migration/blocking surface split out of `/splash`; landing when `migration.status === 'pending'` (no producer yet) |
+| `/login` | Entry | public | Password login; issues the `op_session` cookie |
+| `/setup` | Host | setup localhost | First-run wizard; `?rerun=1` after completion requires admin auth |
+| `/chat` | Assistant | auth | Stillness chat; own corner chrome (hides the navbar); imports domain clients directly, never the `$lib/api.js` barrel (#555) |
+| `/advanced` | Assistant | auth | Embedded OpenCode web UI; mounts `ChatNavbar` (chat chrome composition) |
+| `/connections` | Connection | auth (page) + `connections:manage` (its API) | Connection manager; mounts `ChatNavbar`; `?new=1` opens the add form |
+| `/connections/new` | Connection | auth | pwa-static "no connections yet" landing; 302 alias to `/connections?new=1` |
+| `/admin` | Host | admin gate + auth | Dashboard (tabbed); mounts the chat-free `Navbar` shell (#555); honors `?tab=diagnostics` (Systems tab). Phase 4: `/host` |
+| `/admin/endpoints` | Connection | admin gate | 302 alias to `/connections` (0.13.0 only; Phase 4 makes `/admin/*` 404) |
+
+## API routes
+
+| Namespace | Surface | Guard | Endpoints |
+|---|---|---|---|
+| `/api/runtime` | Entry | **public** | GET server runtime context — the contract-version handshake (plan §6.4) |
+| `/health` | Entry | public | Liveness probe |
+| `/guardian/health` | Entry | public | Guardian reachability probe |
+| `/api/setup/*` | Host | setup localhost | 19 endpoints: `status`, `system-check`, `recommend`, `detect-providers`, `current-config`, `complete`, `deploy-status`, `retry-deploy`, `host-status`, `import-host`, `models/[provider]`, `ollama-profiles`, `voice-profiles`, `opencode/{ensure,status,providers,auth/[provider],provider/[provider]/oauth/{authorize,callback}}` |
+| `/api/connections`, `/api/connections/[id]`, `/api/connections/active` | Connection | `requireCapability('connections:manage')` | Connection CRUD + activation (Phase 2, #486) |
+| `/api/speak`, `/api/transcribe` | Assistant | requireAdmin | Voice TTS/STT relays |
+| `/api/electron/update-status` | Host | (Electron harness) | Control-plane self-update status |
+| `/proxy/assistant/[...path]` | Assistant | requireAdmin (same-origin cookie) | Same-origin assistant broker; resolves the active connection per request. Host app only (plan §6.4) |
+| `/admin/auth/{login,logout,session}` | Entry | public (login) / session | Session lifecycle |
+| `/admin/*` (everything below) | Host | admin gate + requireAdmin per endpoint | Phase 4 moves these under `/api/host/*` semantics with `host:*` capability guards |
+
+`/admin/*` JSON endpoints (all admin gate + requireAdmin):
+
+- Stack: `install`, `uninstall`, `update`, `unlock`, `health`, `logs`,
+  `config/validate`, `backups`
+- Containers: `containers/{list,up,down,restart,pull,stats,events}`
+- Versions: `versions`, `versions/{latest,releases,ui}`, `ui-version`
+- Add-ons: `addons`, `addons/[name]`, `addons/[name]/credentials`
+- Automations: `automations`, `automations/[name]/{file,log,run}`
+- AKM: `akm`, `akm/{health,health-report,stats,reindex,host-sharing}`,
+  `akm/embedding/{detect,test}`
+- Assistant/persona: `assistant`, `voice`
+- Providers: `providers`, `providers/[id]`, `providers/{host-status,import-host}`,
+  `providers/assistant-clis`, `providers/assistant-clis/[toolId]/use-provider`,
+  `providers/oauth/{start,finish}`, `providers/oauth/[providerId]/callback`,
+  `opencode/model`, `opencode/providers/[id]/{auth,models}`
+- Secrets: `secrets`, `secrets/[name]`, `secrets/user-env`, `secret-notice`
+- Connections (legacy JSON alias, this release only):
+  `endpoints`, `endpoints/[id]`, `endpoints/active`
+
+## Chrome composition (#555)
+
+| Module | Used by | Imports chat modules? |
+|---|---|---|
+| `lib/components/chrome/Navbar.svelte` | `/admin` | **No** — brand + capability-driven chat/host buttons (`runtimeContext.routes` + `hasCapability()`) + theme toggle |
+| `lib/components/chrome/ChatNavbar.svelte` | `/advanced`, `/connections` | Yes — composes the shell with `EndpointSwitcher`, `SessionPicker`, `VoiceControl`, `ModeSwitch` |
+| `/chat` corner chrome | `/chat` | Chat page renders its own minimal corner chrome and hides the navbar |
+
+Hygiene is enforced by unit tests:
+`src/lib/features-admin-hygiene.vitest.ts` (no component reads the legacy
+admin flag), `src/lib/components/chrome/chrome-untangle-hygiene.vitest.ts`
+(the chrome the admin surface mounts imports no chat modules) and
+`src/routes/chat/page-imports.vitest.ts` (chat page never imports the
+`$lib/api.js` barrel).
+
+## Testing
+
+The landing matrix is unit-tested in `src/lib/resolve-landing.vitest.ts`; the
+hooks routing in `src/hooks.server.landing.vitest.ts` and
+`src/hooks.server.vitest.ts`. Playwright coverage lives in
+`e2e/setup-guard.pw.ts` (guard/landing smoke) and the `*.stack.ts` suites;
+browsers cannot be downloaded in the sandboxed CI container, so the Playwright
+suites run only in environments with a real browser + Docker.

From 89a6417a7b38850d2359bf44a452f70ad8f96ed7 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Mon, 6 Jul 2026 14:23:24 +0000
Subject: [PATCH 18/61] test(phase-4): red tests for plan Phase 4
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

TDD red suite for the Host/Assistant control-plane split (plan
ui-runtime-modes-plan.md Phase 4, §6.4, §8.5; issue #555):

- hooks.server.admin-404.vitest.ts: /admin/* is a dead namespace — no
  alias, no gate redirect; authenticated /admin doc nav falls through to
  the router 404 (resolve stub emulates the router from route files on
  disk); /admin/endpoints stops aliasing to /connections; non-host modes
  stop redirecting /admin/* to /chat; routes/admin/ deleted and
  routes/host/+page.svelte exists; HOST_ADMIN_LANDING flips to '/host',
  installed_offline lands on /host, runtime context routes.host is
  '/host'; hooks.server.ts drops the computeFeatureFlags/features.admin
  route gate (Phase 4 step 4 — whether the derived alias in features.ts /
  +layout.server.ts can also be deleted is left to the implementation's
  grep; today +layout.server.ts still returns it). RED: all 10 tests
  (200-instead-of-404, 302 redirects to /connections and /chat, '/admin'
  landing/pointer values, gate still present).

- routes/api/host/health/server.vitest.ts: representative privileged
  /api/host/* endpoint (mechanical move of /admin/health). 403 in
  assistant-container EVEN WITH a valid admin session (capability-based,
  not session-based; body.error === 'capability_not_available'); 403 in
  pwa-static; 200 in host-ui and electron-host; 401 without a session
  (requireAdmin stays in addition to the capability guard). RED: all 6
  ("Cannot find module './+server.js'" — computed-specifier dynamic
  import keeps svelte-check green while red).

- routes/api/host/stack/server.vitest.ts: host-scoped half of the old
  /admin/assistant endpoint (AssistantTab split). GET/PUT projectName +
  lanExposureEnabled at /api/host/stack; payload carries NO
  personaContent; PUT no longer requires it; assistant-container gets
  403 with a valid session and stack.env stays untouched (acceptance:
  cannot edit project name or bind address); 401 unauthenticated. RED:
  all 7 (module missing).

- routes/api/assistant/persona/server.vitest.ts: assistant-owned half —
  GET/PUT /api/assistant/persona over config/assistant/persona.md;
  assistant-container CAN read/write (acceptance); host-ui keeps
  assistant-settings:write; pwa-static 403 with a valid session
  (capability_not_available); 401 unauthenticated. RED: all 7 (module
  missing).

- routes/api/assistant/akm/server.vitest.ts: assistant-scoped AKM config
  (AkmTab split) — GET/PATCH /api/assistant/akm over
  config/akm/config.json; assistant-container CAN edit (acceptance);
  pwa-static 403; 401 unauthenticated. RED: all 5 (module missing).

- routes/api/host/guard-hygiene.vitest.ts: every
  routes/api/host/**/+server.ts contains a requireCapability( call
  (plan §8.5 — server-side enforcement; the walker requires >= 20 moved
  endpoints so the per-file check can never pass vacuously); host-level
  AKM sharing lives at /api/host/akm/host-sharing and not under
  /api/assistant. RED: 3 tests (routes/api/host does not exist).
  CHARACTERIZATION (green today, must stay green): 2 constraint tests —
  session-lifecycle endpoints are NOT under /api/host (a capability
  guard on login would lock assistant-container out before it could
  authenticate) and connections stay at /api/connections (the Phase 2
  EXCEPT clause).

- lib/api/admin-paths-hygiene.vitest.ts: no quoted '/admin' path
  survives in lib/api domain clients or in .svelte components outside
  the deleted routes/admin tree (dead calls/links once /admin 404s), and
  the login page posts to an existing auth endpoint outside /admin
  (acceptance: login/session flow unchanged — only the address moves;
  the exact new path, e.g. /api/auth/login, is the implementation's
  choice, pinned only as "exists and not /admin"). RED: 3 tests
  (offenders: 9 lib/api clients — addons, akm, automations, backups,
  containers, providers, secrets, versions, voice; 7 .svelte files —
  EndpointList, ModeSwitch, SettingsDrawer, AkmHealthReportSection,
  attention/+page, chat/+page, login/+page).
  CHARACTERIZATION (green): 1 walker-sanity test.

NOTE for the implementer: resolve-landing.vitest.ts,
hooks.server.landing.vitest.ts and ui-route-map.md still pin the Phase 3
'/admin' values via their documented TODO(phase-4) constants — flip them
with the implementation; this suite pins the '/host' side.

Verified red for the right reasons: server project 41 failed / 1041
passed across 118 files; the only failing files are these seven and
every failure is a missing-module or missing-feature assertion (no
syntax errors). ui:check: 0 errors 0 warnings (red-state safe). biome:
baseline unchanged, no findings in the new files; eslint: clean on the
new files. CLI suite 87 pass / 1 known uid-0 env failure; lib suite 845
pass / 10 skip / 17 known uid-0 failures — parity.

No production code changed.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FetR7BttT1xBrA8fBwhui9
---
 .../ui/src/hooks.server.admin-404.vitest.ts   | 257 ++++++++++++++++++
 .../src/lib/api/admin-paths-hygiene.vitest.ts |  90 ++++++
 .../routes/api/assistant/akm/server.vitest.ts | 166 +++++++++++
 .../api/assistant/persona/server.vitest.ts    | 183 +++++++++++++
 .../routes/api/host/guard-hygiene.vitest.ts   |  76 ++++++
 .../routes/api/host/health/server.vitest.ts   | 145 ++++++++++
 .../routes/api/host/stack/server.vitest.ts    | 183 +++++++++++++
 7 files changed, 1100 insertions(+)
 create mode 100644 packages/ui/src/hooks.server.admin-404.vitest.ts
 create mode 100644 packages/ui/src/lib/api/admin-paths-hygiene.vitest.ts
 create mode 100644 packages/ui/src/routes/api/assistant/akm/server.vitest.ts
 create mode 100644 packages/ui/src/routes/api/assistant/persona/server.vitest.ts
 create mode 100644 packages/ui/src/routes/api/host/guard-hygiene.vitest.ts
 create mode 100644 packages/ui/src/routes/api/host/health/server.vitest.ts
 create mode 100644 packages/ui/src/routes/api/host/stack/server.vitest.ts

diff --git a/packages/ui/src/hooks.server.admin-404.vitest.ts b/packages/ui/src/hooks.server.admin-404.vitest.ts
new file mode 100644
index 000000000..d1d05742f
--- /dev/null
+++ b/packages/ui/src/hooks.server.admin-404.vitest.ts
@@ -0,0 +1,257 @@
+/**
+ * Phase 4 — `/admin/*` becomes a dead namespace (plan ui-runtime-modes-plan.md
+ * Phase 4, §6.4 "No /admin alias", issue #555).
+ *
+ * Contract pinned here:
+ *  - The `routes/admin/` tree is DELETED: pages move to `routes/host/`, the
+ *    JSON endpoints move under `routes/api/host/` (see the guard-hygiene
+ *    suite) and `routes/api/assistant/`. With the tree gone, SvelteKit's
+ *    router answers `/admin/*` with 404.
+ *  - hooks.server.ts must let `/admin/*` FALL THROUGH to that router 404:
+ *    no `features.admin` gate redirect to /chat, no `/admin/endpoints` →
+ *    `/connections` alias (the Phase 2 alias was 0.13.0-only), and no
+ *    launch-routing redirect swallowing the path. The tests emulate the
+ *    router in the `resolve` stub (404 when no route file exists on disk),
+ *    so "hooks passes through + files deleted" is asserted as one observable
+ *    outcome: the final response is 404.
+ *  - The Phase 3 TODO constant flips: HOST_ADMIN_LANDING === '/host', the
+ *    installed-offline landing redirect goes to /host, and the runtime
+ *    context route pointer `routes.host` is '/host' (nav must never point at
+ *    a 404).
+ *  - The features.admin ROUTE GATE in hooks.server.ts is replaced by
+ *    capability checks (Phase 4 step 4): the hooks source no longer reads
+ *    computeFeatureFlags / features.admin. (Whether the derived alias itself
+ *    can be deleted from features.ts / +layout.server.ts is a grep-and-note
+ *    decision for the implementation — deliberately not asserted here.)
+ *
+ * RED until Phase 4 lands. Deterministic like hooks.server.landing.vitest.ts:
+ * the host probes (composePs, detectRuntime, listRemoteStatuses) are stubbed.
+ */
+import { afterEach, beforeEach, describe, expect, test, vi } from 'vitest';
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { tmpdir } from 'node:os';
+import { fileURLToPath } from 'node:url';
+import type { RequestEvent } from '@sveltejs/kit';
+import { resetState } from '$lib/server/test-helpers.js';
+import { HOST_ADMIN_LANDING } from '$lib/resolve-landing.js';
+import { computeServerRuntimeContext } from '$lib/server/features.js';
+
+vi.mock('$lib/server/endpoints.js', async (orig) => ({
+  ...(await orig<typeof import('$lib/server/endpoints.js')>()),
+  listRemoteStatuses: vi.fn(async () => []),
+}));
+vi.mock('@openpalm/lib', async (orig) => ({
+  ...(await orig<typeof import('@openpalm/lib')>()),
+  composePs: vi.fn(async () => ({ ok: false, stdout: '', stderr: '', code: 1 })),
+  detectRuntime: vi.fn(async () => ({ dockerPresent: false, composeAvailable: false })),
+}));
+
+import { composePs } from '@openpalm/lib';
+import { handle, _resetLaunchCache } from './hooks.server.js';
+
+const SRC_DIR = fileURLToPath(new URL('./', import.meta.url));
+const ROUTES_DIR = join(SRC_DIR, 'routes');
+
+// ── helpers (same conventions as hooks.server.landing.vitest.ts) ─────────────
+
+function seedStackEnv(stackDir: string, setupComplete: boolean): void {
+  const kvDir = join(stackDir, '..', '..', 'knowledge', 'env');
+  mkdirSync(kvDir, { recursive: true });
+  writeFileSync(join(kvDir, 'stack.env'), `OP_SETUP_COMPLETE=${setupComplete}\n`);
+}
+
+function makeEvent(path: string, opts: { token?: string; accept?: string } = {}): RequestEvent {
+  const url = new URL(`http://localhost:3880${path}`);
+  const headers: Record<string, string> = {
+    host: 'localhost:3880',
+    accept: opts.accept ?? 'text/html',
+  };
+  if (opts.token) headers.cookie = `op_session=${opts.token}`;
+  return {
+    url,
+    request: new Request(url.toString(), { headers }),
+    params: {},
+    locals: {} as App.Locals,
+    route: { id: path },
+    platform: undefined,
+    getClientAddress: () => '127.0.0.1',
+    isDataRequest: false,
+    isSubRequest: false,
+  } as unknown as RequestEvent;
+}
+
+/**
+ * Router-emulating resolve: 404 when no route file exists for the path —
+ * exactly what SvelteKit's router does once `routes/admin/` is deleted.
+ * Today `routes/admin/+page.svelte` & friends still exist, so `/admin/*`
+ * resolves 200 and these tests are red for the honest reason.
+ */
+const routerResolve = (event: RequestEvent) => {
+  const dir = join(ROUTES_DIR, event.url.pathname.replace(/^\//, ''));
+  const exists = ['+page.svelte', '+page.server.ts', '+server.ts'].some((f) =>
+    existsSync(join(dir, f)),
+  );
+  return Promise.resolve(
+    exists ? new Response('ok', { status: 200 }) : new Response('Not Found', { status: 404 }),
+  );
+};
+
+/**
+ * Run handle() and capture a thrown SvelteKit redirect as the outcome — the
+ * Phase 4 assertions distinguish "passed through to the router" (a Response)
+ * from "an alias/gate redirect survived" (a thrown {status, location}).
+ */
+async function handleOutcome(event: RequestEvent): Promise<unknown> {
+  try {
+    return await handle({ event, resolve: routerResolve });
+  } catch (thrown) {
+    return thrown;
+  }
+}
+
+const MODE_ENV_KEYS = ['OP_UI_HOST_MODE', 'OP_INSIDE_ELECTRON', 'OP_ENABLE_ADMIN'] as const;
+
+describe('hooks.server — /admin/* is a dead namespace, no alias (plan Phase 4, §6.4)', () => {
+  let home = '';
+  let prevHome: string | undefined;
+  let savedModeEnv: Record<string, string | undefined> = {};
+
+  beforeEach(() => {
+    process.env.PORT = '3880';
+    savedModeEnv = {};
+    for (const key of MODE_ENV_KEYS) {
+      savedModeEnv[key] = process.env[key];
+      delete process.env[key];
+    }
+    prevHome = process.env.OP_HOME;
+    home = mkdtempSync(join(tmpdir(), 'op-hooks-admin404-'));
+    process.env.OP_HOME = home;
+    _resetLaunchCache(); // the 5s launch cache is module-level — resolve fresh per test
+    vi.mocked(composePs).mockResolvedValue({ ok: false, stdout: '', stderr: '', code: 1 });
+    resetState('test-admin-pw'); // seeds 'test-admin-pw' as a valid op_session token
+  });
+
+  afterEach(() => {
+    delete process.env.PORT;
+    for (const key of MODE_ENV_KEYS) {
+      const prev = savedModeEnv[key];
+      if (prev === undefined) delete process.env[key];
+      else process.env[key] = prev;
+    }
+    if (prevHome === undefined) delete process.env.OP_HOME;
+    else process.env.OP_HOME = prevHome;
+    rmSync(home, { recursive: true, force: true });
+  });
+
+  test('authenticated /admin document navigation is a router 404, not the dashboard', async () => {
+    process.env.OP_UI_HOST_MODE = 'host-ui';
+    const event = makeEvent('/admin', { token: 'test-admin-pw' });
+
+    const outcome = await handleOutcome(event);
+
+    // A thrown SvelteKit redirect ({status, location}) would mean an alias
+    // survived; a 200 means routes/admin/+page.svelte still exists.
+    expect(outcome, '/admin must fall through to the router, not redirect').toBeInstanceOf(Response);
+    expect((outcome as Response).status).toBe(404);
+  });
+
+  test('/admin/endpoints no longer aliases to /connections (Phase 2 alias removed)', async () => {
+    process.env.OP_UI_HOST_MODE = 'pwa-static';
+    const event = makeEvent('/admin/endpoints', { token: 'test-admin-pw' });
+
+    const outcome = await handleOutcome(event);
+
+    expect(outcome, '/admin/endpoints must 404, not redirect to /connections').toBeInstanceOf(Response);
+    expect((outcome as Response).status).toBe(404);
+  });
+
+  test('/admin document navigation in pwa-static mode 404s instead of redirecting to /chat', async () => {
+    process.env.OP_UI_HOST_MODE = 'pwa-static';
+    const event = makeEvent('/admin', { token: 'test-admin-pw' });
+
+    const outcome = await handleOutcome(event);
+
+    expect(outcome, 'the features.admin gate redirect to /chat must be gone').toBeInstanceOf(Response);
+    expect((outcome as Response).status).toBe(404);
+  });
+
+  test('/admin/* fetch in assistant-container mode 404s instead of redirecting to /chat', async () => {
+    process.env.OP_UI_HOST_MODE = 'assistant-container';
+    // Browser fetch() sends Accept: */* — never the document-navigation guard.
+    const event = makeEvent('/admin/akm', { accept: 'application/json' });
+
+    const outcome = await handleOutcome(event);
+
+    expect(outcome, 'API-style /admin requests must 404, not 302').toBeInstanceOf(Response);
+    expect((outcome as Response).status).toBe(404);
+  });
+
+  test('/ with an installed-but-offline stack lands on /host (was /admin)', async () => {
+    process.env.OP_UI_HOST_MODE = 'host-ui';
+    const state = resetState('test-admin-pw');
+    seedStackEnv(state.stackDir, true); // setup complete, composePs fails → installed_offline
+
+    await expect(handle({ event: makeEvent('/'), resolve: routerResolve })).rejects.toMatchObject({
+      location: '/host',
+    });
+  });
+});
+
+// ── route split: routes/admin deleted, routes/host created (Phase 4 step 1) ──
+
+describe('route files — /admin moved to /host (plan Phase 4 step 1)', () => {
+  test('the routes/admin/ tree is deleted (pages → routes/host, APIs → routes/api/host)', () => {
+    expect(existsSync(join(ROUTES_DIR, 'admin'))).toBe(false);
+  });
+
+  test('the /host dashboard route exists', () => {
+    expect(existsSync(join(ROUTES_DIR, 'host', '+page.svelte'))).toBe(true);
+  });
+});
+
+// ── the Phase 3 TODO constants flip to /host ──────────────────────────────────
+
+describe('host landing + route pointers flip to /host (plan Phase 4 step 1)', () => {
+  const savedEnv: Record<string, string | undefined> = {};
+
+  beforeEach(() => {
+    for (const key of MODE_ENV_KEYS) {
+      savedEnv[key] = process.env[key];
+      delete process.env[key];
+    }
+  });
+
+  afterEach(() => {
+    for (const key of MODE_ENV_KEYS) {
+      const prev = savedEnv[key];
+      if (prev === undefined) delete process.env[key];
+      else process.env[key] = prev;
+    }
+  });
+
+  test("HOST_ADMIN_LANDING is '/host' (resolve-landing TODO(phase-4) resolved)", () => {
+    expect(HOST_ADMIN_LANDING).toBe('/host');
+  });
+
+  test("runtime context routes.host points at '/host' — nav must never point at a 404", () => {
+    process.env.OP_UI_HOST_MODE = 'host-ui';
+    const url = new URL('http://127.0.0.1:3880/host');
+    const ctx = computeServerRuntimeContext({ url } as unknown as RequestEvent);
+    expect(ctx.routes.host).toBe('/host');
+  });
+});
+
+// ── hooks hygiene: the features.admin gate is replaced (Phase 4 step 4) ──────
+
+describe('hooks hygiene — features.admin route gate replaced by capability checks', () => {
+  test('hooks.server.ts no longer reads computeFeatureFlags / features.admin', () => {
+    const source = readFileSync(join(SRC_DIR, 'hooks.server.ts'), 'utf-8');
+    const offenders = source
+      .split('\n')
+      .map((line, i) => ({ line, n: i + 1 }))
+      .filter(({ line }) => /computeFeatureFlags|features\.admin/.test(line))
+      .map(({ n, line }) => `hooks.server.ts:${n}: ${line.trim()}`);
+    expect(offenders).toEqual([]);
+  });
+});
diff --git a/packages/ui/src/lib/api/admin-paths-hygiene.vitest.ts b/packages/ui/src/lib/api/admin-paths-hygiene.vitest.ts
new file mode 100644
index 000000000..89bf79910
--- /dev/null
+++ b/packages/ui/src/lib/api/admin-paths-hygiene.vitest.ts
@@ -0,0 +1,90 @@
+/**
+ * Phase 4 hygiene — no client code calls or links a `/admin` path (plan
+ * ui-runtime-modes-plan.md Phase 4 step 1: "/admin/* → 404, no alias" +
+ * "Update lib/api/* client paths accordingly").
+ *
+ * With the alias gone, ANY surviving quoted '/admin…' path in a domain
+ * client or component is a dead call/link: lib/api clients must target
+ * /api/host/* and /api/assistant/*, hrefs and pathname checks must target
+ * /host, and the login page must post to the relocated session endpoint.
+ *
+ * RED until Phase 4 lands: 9 lib/api clients and 7 .svelte files still
+ * reference /admin paths.
+ *
+ * Source-level scan, same conventions as features-admin-hygiene.vitest.ts.
+ * The match is QUOTED occurrences only ('/admin', "/admin", `/admin — i.e.
+ * route-string literals), so prose comments mentioning the legacy namespace
+ * don't trip it. routes/admin/** is excluded (that tree is deleted by Phase
+ * 4 — its absence is asserted in hooks.server.admin-404.vitest.ts).
+ */
+import { describe, expect, test } from 'vitest';
+import { existsSync, readdirSync, readFileSync } from 'node:fs';
+import { join, sep } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const SRC_ROOT = fileURLToPath(new URL('../../', import.meta.url));
+const API_CLIENT_DIR = fileURLToPath(new URL('./', import.meta.url));
+
+/** A quote character immediately followed by /admin at a path boundary. */
+const QUOTED_ADMIN_PATH = /['"`]\/admin(?=['"`/?])/;
+
+function apiClientFiles(): string[] {
+  return readdirSync(API_CLIENT_DIR)
+    .filter((name) => name.endsWith('.ts') && !name.endsWith('.vitest.ts'))
+    .map((name) => join(API_CLIENT_DIR, name));
+}
+
+function svelteFiles(): string[] {
+  return (readdirSync(SRC_ROOT, { recursive: true }) as string[])
+    .filter((rel) => rel.endsWith('.svelte'))
+    .filter((rel) => !rel.startsWith(join('routes', 'admin') + sep))
+    .map((rel) => join(SRC_ROOT, rel));
+}
+
+function offendersIn(files: string[]): string[] {
+  const offenders: string[] = [];
+  for (const file of files) {
+    const lines = readFileSync(file, 'utf-8').split('\n');
+    for (let i = 0; i < lines.length; i++) {
+      if (QUOTED_ADMIN_PATH.test(lines[i])) {
+        offenders.push(`${file.slice(SRC_ROOT.length)}:${i + 1}`);
+      }
+    }
+  }
+  return offenders;
+}
+
+describe('no /admin paths left in client code (plan Phase 4 step 1)', () => {
+  test('the scans see the trees (sanity)', () => {
+    // Guards the walkers: an empty file list would make the hygiene
+    // assertions below pass vacuously.
+    expect(apiClientFiles().length).toBeGreaterThanOrEqual(10);
+    expect(svelteFiles().length).toBeGreaterThan(50);
+  });
+
+  test('no lib/api domain client requests a /admin path', () => {
+    expect(offendersIn(apiClientFiles())).toEqual([]);
+  });
+
+  test('no .svelte component (outside the deleted routes/admin tree) references a /admin path', () => {
+    expect(offendersIn(svelteFiles())).toEqual([]);
+  });
+});
+
+describe('login flow stays wired after the move (Phase 4 acceptance: login/session unchanged)', () => {
+  test('the login page posts to an existing auth endpoint outside the dead /admin namespace', () => {
+    const loginPage = join(SRC_ROOT, 'routes', 'login', '+page.svelte');
+    const source = readFileSync(loginPage, 'utf-8');
+    const match = source.match(/fetch\(\s*['"`]([^'"`]+)['"`]/);
+    expect(match, 'login page must fetch() its auth endpoint').not.toBeNull();
+
+    const path = (match as RegExpMatchArray)[1].split('?')[0];
+    expect(path.startsWith('/')).toBe(true);
+    expect(path.startsWith('/admin'), `login must not post to the 404 namespace (${path})`).toBe(false);
+
+    // The referenced endpoint must actually exist as a route — the session
+    // flow itself is unchanged, only its address moves out of /admin.
+    const routeFile = join(SRC_ROOT, 'routes', path.replace(/^\//, ''), '+server.ts');
+    expect(existsSync(routeFile), `no +server.ts found for the login endpoint ${path}`).toBe(true);
+  });
+});
diff --git a/packages/ui/src/routes/api/assistant/akm/server.vitest.ts b/packages/ui/src/routes/api/assistant/akm/server.vitest.ts
new file mode 100644
index 000000000..6f8a50ef3
--- /dev/null
+++ b/packages/ui/src/routes/api/assistant/akm/server.vitest.ts
@@ -0,0 +1,166 @@
+/**
+ * Tests for /api/assistant/akm — assistant-SCOPED AKM configuration (plan
+ * ui-runtime-modes-plan.md Phase 4 steps 2+3, §6.4).
+ *
+ * ALL RED until Phase 4 lands: routes/api/assistant/akm/+server.ts does not
+ * exist yet (it is the move of the assistant-scoped part of
+ * routes/admin/akm/+server.ts — GET + PATCH over config/akm/config.json).
+ * Loaded via computed-specifier dynamic import so svelte-check stays clean
+ * while red.
+ *
+ * Contract under test — the AkmTab split (plan §9 "AKM"):
+ *  - The AKM runtime config (config/akm/config.json — a read/write mount of
+ *    the assistant container, plan §6.9) is assistant-scoped → lives under
+ *    /api/assistant/akm, guarded by the assistant-settings capabilities +
+ *    requireAdmin.
+ *  - Phase 4 acceptance: assistant-container CAN edit AKM → GET/PATCH 200.
+ *  - pwa-static has no assistant-settings capability → 403 with a valid
+ *    session (capability-based, not session-based; plan §8.5).
+ *  - Host-LEVEL AKM (host key sharing) stays under /api/host — pinned by
+ *    routes/api/host/guard-hygiene.vitest.ts, not here.
+ */
+import { afterEach, beforeEach, describe, expect, test } from 'vitest';
+import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { randomBytes } from 'node:crypto';
+import { tmpdir } from 'node:os';
+import { cleanupTempDirs, resetState, trackDir } from '$lib/server/test-helpers.js';
+
+type RouteHandler = (event: unknown) => Response | Promise<Response>;
+type AssistantAkmRouteModule = { GET: RouteHandler; PATCH: RouteHandler };
+
+/** RED-state-safe loader (same pattern as the Phase 2 /api/connections suite). */
+async function loadRoute(): Promise<AssistantAkmRouteModule> {
+  const specifier = './+server.js';
+  return (await import(/* @vite-ignore */ specifier)) as AssistantAkmRouteModule;
+}
+
+let homeDir = '';
+
+function makeTempHome(): string {
+  const dir = join(tmpdir(), `openpalm-assistant-akm-${randomBytes(4).toString('hex')}`);
+  mkdirSync(dir, { recursive: true });
+  return trackDir(dir);
+}
+
+function akmConfigFile(): string {
+  return join(homeDir, 'config', 'akm', 'config.json');
+}
+
+function seedAkmConfig(config: Record<string, unknown>): void {
+  mkdirSync(join(homeDir, 'config', 'akm'), { recursive: true });
+  writeFileSync(akmConfigFile(), JSON.stringify(config));
+}
+
+function makeGetEvent(token = 'admin-token'): unknown {
+  const url = new URL('http://127.0.0.1:3880/api/assistant/akm');
+  return {
+    url,
+    request: new Request(url, {
+      headers: {
+        ...(token ? { cookie: `op_session=${token}` } : {}),
+        'x-request-id': 'req-assistant-akm-get',
+      },
+    }),
+    params: {},
+    locals: { role: token ? 'admin' : null },
+    route: { id: '/api/assistant/akm' },
+    getClientAddress: () => '127.0.0.1',
+    isDataRequest: false,
+    isSubRequest: false,
+  };
+}
+
+function makePatchEvent(body: Record<string, unknown>, token = 'admin-token'): unknown {
+  const url = new URL('http://127.0.0.1:3880/api/assistant/akm');
+  return {
+    url,
+    request: new Request(url, {
+      method: 'PATCH',
+      headers: {
+        ...(token ? { cookie: `op_session=${token}` } : {}),
+        'x-request-id': 'req-assistant-akm-patch',
+        'content-type': 'application/json',
+      },
+      body: JSON.stringify(body),
+    }),
+    params: {},
+    locals: { role: token ? 'admin' : null },
+    route: { id: '/api/assistant/akm' },
+    getClientAddress: () => '127.0.0.1',
+    isDataRequest: false,
+    isSubRequest: false,
+  };
+}
+
+const ENV_KEYS = [
+  'OP_UI_HOST_MODE',
+  'OP_INSIDE_ELECTRON',
+  'OP_ENABLE_ADMIN',
+  'OP_HOME',
+  'OP_UI_LOGIN_PASSWORD',
+] as const;
+let savedEnv: Record<string, string | undefined> = {};
+
+beforeEach(() => {
+  savedEnv = {};
+  for (const key of ENV_KEYS) {
+    savedEnv[key] = process.env[key];
+    delete process.env[key];
+  }
+  homeDir = makeTempHome();
+  process.env.OP_HOME = homeDir;
+  resetState('admin-token');
+});
+
+afterEach(() => {
+  for (const key of ENV_KEYS) {
+    const prev = savedEnv[key];
+    if (prev === undefined) delete process.env[key];
+    else process.env[key] = prev;
+  }
+  cleanupTempDirs();
+});
+
+describe('GET /api/assistant/akm — assistant-scoped AKM config (plan Phase 4 step 2)', () => {
+  test('200 in assistant-container mode with a valid session — returns the config', async () => {
+    process.env.OP_UI_HOST_MODE = 'assistant-container';
+    seedAkmConfig({ defaults: { llm: 'main' } });
+    const { GET } = await loadRoute();
+    const res = await GET(makeGetEvent());
+    expect(res.status).toBe(200);
+    const body = (await res.json()) as { config: Record<string, unknown> };
+    expect((body.config.defaults as Record<string, unknown>).llm).toBe('main');
+  });
+
+  test('403 in pwa-static mode even with a valid admin session', async () => {
+    process.env.OP_UI_HOST_MODE = 'pwa-static';
+    const { GET } = await loadRoute();
+    const res = await GET(makeGetEvent());
+    expect(res.status).toBe(403);
+  });
+
+  test('401 without a session cookie (requireAdmin still enforced)', async () => {
+    process.env.OP_UI_HOST_MODE = 'assistant-container';
+    const { GET } = await loadRoute();
+    const res = await GET(makeGetEvent(''));
+    expect(res.status).toBe(401);
+  });
+});
+
+describe('PATCH /api/assistant/akm — assistant-container can edit AKM (Phase 4 acceptance)', () => {
+  test('200 in assistant-container mode: the patch is persisted to config/akm/config.json', async () => {
+    process.env.OP_UI_HOST_MODE = 'assistant-container';
+    const { PATCH } = await loadRoute();
+    const res = await PATCH(makePatchEvent({ defaults: { llm: 'primary' } }));
+    expect(res.status).toBe(200);
+    expect(readFileSync(akmConfigFile(), 'utf-8')).toContain('primary');
+  });
+
+  test('403 in pwa-static mode even with a valid admin session', async () => {
+    process.env.OP_UI_HOST_MODE = 'pwa-static';
+    const { PATCH } = await loadRoute();
+    const res = await PATCH(makePatchEvent({ defaults: { llm: 'primary' } }));
+    expect(res.status).toBe(403);
+  });
+});
diff --git a/packages/ui/src/routes/api/assistant/persona/server.vitest.ts b/packages/ui/src/routes/api/assistant/persona/server.vitest.ts
new file mode 100644
index 000000000..cfd3fba3b
--- /dev/null
+++ b/packages/ui/src/routes/api/assistant/persona/server.vitest.ts
@@ -0,0 +1,183 @@
+/**
+ * Tests for /api/assistant/persona — the ASSISTANT-OWNED half of the old
+ * /admin/assistant endpoint (plan ui-runtime-modes-plan.md Phase 4 step 2,
+ * §5.F, §6.4 "/api/assistant/* — assistant-owned settings").
+ *
+ * ALL RED until Phase 4 lands: routes/api/assistant/persona/+server.ts does
+ * not exist yet. Loaded via computed-specifier dynamic import so
+ * svelte-check stays clean while red.
+ *
+ * Contract under test:
+ *  - Persona is assistant-scoped (config/assistant/persona.md — one of the
+ *    two read/write mounts the assistant container keeps, plan §6.9). It is
+ *    served from /api/assistant/persona guarded by the assistant-settings
+ *    capabilities + the requireAdmin cookie check.
+ *  - Phase 4 acceptance: assistant-container CAN edit persona — its
+ *    serverCapabilities carry assistant-settings:read/write → 200 here.
+ *  - Host modes keep assistant-settings:write → 200 in host-ui too.
+ *  - pwa-static carries NO assistant-settings capability → 403 even with a
+ *    valid admin session (capability-based, not session-based; plan §8.5).
+ */
+import { afterEach, beforeEach, describe, expect, test } from 'vitest';
+import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { randomBytes } from 'node:crypto';
+import { tmpdir } from 'node:os';
+import { cleanupTempDirs, resetState, trackDir } from '$lib/server/test-helpers.js';
+
+type RouteHandler = (event: unknown) => Response | Promise<Response>;
+type PersonaRouteModule = { GET: RouteHandler; PUT: RouteHandler };
+
+/** RED-state-safe loader (same pattern as the Phase 2 /api/connections suite). */
+async function loadRoute(): Promise<PersonaRouteModule> {
+  const specifier = './+server.js';
+  return (await import(/* @vite-ignore */ specifier)) as PersonaRouteModule;
+}
+
+let homeDir = '';
+
+function makeTempHome(): string {
+  const dir = join(tmpdir(), `openpalm-assistant-persona-${randomBytes(4).toString('hex')}`);
+  mkdirSync(dir, { recursive: true });
+  return trackDir(dir);
+}
+
+function personaFile(): string {
+  return join(homeDir, 'config', 'assistant', 'persona.md');
+}
+
+function seedPersona(content: string): void {
+  mkdirSync(join(homeDir, 'config', 'assistant'), { recursive: true });
+  writeFileSync(personaFile(), content);
+}
+
+function makeGetEvent(token = 'admin-token'): unknown {
+  const url = new URL('http://127.0.0.1:3880/api/assistant/persona');
+  return {
+    url,
+    request: new Request(url, {
+      headers: {
+        ...(token ? { cookie: `op_session=${token}` } : {}),
+        'x-request-id': 'req-assistant-persona-get',
+      },
+    }),
+    params: {},
+    locals: { role: token ? 'admin' : null },
+    route: { id: '/api/assistant/persona' },
+    getClientAddress: () => '127.0.0.1',
+    isDataRequest: false,
+    isSubRequest: false,
+  };
+}
+
+function makePutEvent(body: Record<string, unknown>, token = 'admin-token'): unknown {
+  const url = new URL('http://127.0.0.1:3880/api/assistant/persona');
+  return {
+    url,
+    request: new Request(url, {
+      method: 'PUT',
+      headers: {
+        ...(token ? { cookie: `op_session=${token}` } : {}),
+        'x-request-id': 'req-assistant-persona-put',
+        'content-type': 'application/json',
+      },
+      body: JSON.stringify(body),
+    }),
+    params: {},
+    locals: { role: token ? 'admin' : null },
+    route: { id: '/api/assistant/persona' },
+    getClientAddress: () => '127.0.0.1',
+    isDataRequest: false,
+    isSubRequest: false,
+  };
+}
+
+const ENV_KEYS = [
+  'OP_UI_HOST_MODE',
+  'OP_INSIDE_ELECTRON',
+  'OP_ENABLE_ADMIN',
+  'OP_HOME',
+  'OP_UI_LOGIN_PASSWORD',
+] as const;
+let savedEnv: Record<string, string | undefined> = {};
+
+beforeEach(() => {
+  savedEnv = {};
+  for (const key of ENV_KEYS) {
+    savedEnv[key] = process.env[key];
+    delete process.env[key];
+  }
+  homeDir = makeTempHome();
+  process.env.OP_HOME = homeDir;
+  resetState('admin-token');
+});
+
+afterEach(() => {
+  for (const key of ENV_KEYS) {
+    const prev = savedEnv[key];
+    if (prev === undefined) delete process.env[key];
+    else process.env[key] = prev;
+  }
+  cleanupTempDirs();
+});
+
+describe('GET /api/assistant/persona — assistant-settings guard (plan Phase 4 step 2)', () => {
+  test('200 in assistant-container mode with a valid session — returns the persona', async () => {
+    process.env.OP_UI_HOST_MODE = 'assistant-container';
+    seedPersona('# Persona\n');
+    const { GET } = await loadRoute();
+    const res = await GET(makeGetEvent());
+    expect(res.status).toBe(200);
+    const body = (await res.json()) as Record<string, unknown>;
+    expect(body.personaContent).toBe('# Persona\n');
+  });
+
+  test('403 in pwa-static mode even with a valid admin session', async () => {
+    process.env.OP_UI_HOST_MODE = 'pwa-static';
+    const { GET } = await loadRoute();
+    const res = await GET(makeGetEvent());
+    expect(res.status).toBe(403);
+  });
+
+  test('401 without a session cookie (requireAdmin still enforced)', async () => {
+    process.env.OP_UI_HOST_MODE = 'assistant-container';
+    const { GET } = await loadRoute();
+    const res = await GET(makeGetEvent(''));
+    expect(res.status).toBe(401);
+  });
+});
+
+describe('PUT /api/assistant/persona — assistant-settings:write (Phase 4 acceptance)', () => {
+  test('assistant-container CAN edit the persona: 200 + write to config/assistant/persona.md', async () => {
+    process.env.OP_UI_HOST_MODE = 'assistant-container';
+    const { PUT } = await loadRoute();
+    const res = await PUT(makePutEvent({ personaContent: '# Updated persona' }));
+    expect(res.status).toBe(200);
+    expect(readFileSync(personaFile(), 'utf-8').trimEnd()).toBe('# Updated persona');
+  });
+
+  test('200 in host-ui mode (host modes keep assistant-settings:write)', async () => {
+    process.env.OP_UI_HOST_MODE = 'host-ui';
+    const { PUT } = await loadRoute();
+    const res = await PUT(makePutEvent({ personaContent: '# Host-edited persona' }));
+    expect(res.status).toBe(200);
+    expect(readFileSync(personaFile(), 'utf-8').trimEnd()).toBe('# Host-edited persona');
+  });
+
+  test('403 in pwa-static mode even with a valid session — capability guard, not auth', async () => {
+    process.env.OP_UI_HOST_MODE = 'pwa-static';
+    const { PUT } = await loadRoute();
+    const res = await PUT(makePutEvent({ personaContent: 'nope' }));
+    expect(res.status).toBe(403);
+    expect(res.headers.get('content-type') ?? '').toContain('application/json');
+    const body = (await res.json()) as Record<string, unknown>;
+    expect(body.error).toBe('capability_not_available');
+  });
+
+  test('401 without a session cookie', async () => {
+    process.env.OP_UI_HOST_MODE = 'assistant-container';
+    const { PUT } = await loadRoute();
+    const res = await PUT(makePutEvent({ personaContent: '# P' }, ''));
+    expect(res.status).toBe(401);
+  });
+});
diff --git a/packages/ui/src/routes/api/host/guard-hygiene.vitest.ts b/packages/ui/src/routes/api/host/guard-hygiene.vitest.ts
new file mode 100644
index 000000000..23ec2648a
--- /dev/null
+++ b/packages/ui/src/routes/api/host/guard-hygiene.vitest.ts
@@ -0,0 +1,76 @@
+/**
+ * Phase 4 hygiene — every /api/host/* endpoint carries a server-side
+ * requireCapability() guard (plan ui-runtime-modes-plan.md Phase 4 step 3,
+ * §8.5: "APIs enforce capabilities server-side").
+ *
+ * Source-level test, like features-admin-hygiene.vitest.ts: the invariant is
+ * that no privileged host endpoint can ever ship without the capability
+ * guard, so the walker enumerates routes/api/host/**+server.ts and asserts
+ * the literal `requireCapability(` call in each route module. A shared
+ * wrapper (cf. requireConnectionsManage) must still keep at least one
+ * spelled-out requireCapability call in every route file — that is the
+ * contract this suite ratifies, mirroring /api/connections.
+ *
+ * RED until Phase 4 lands: routes/api/host/ does not exist yet — the
+ * /admin/* JSON endpoints (~50 of them, minus the Phase 2 connections move
+ * and the session-lifecycle endpoints) move here.
+ *
+ * Partition constraints pinned alongside (GREEN today, must stay green):
+ *  - Session lifecycle (auth login/logout/session) must NOT live under
+ *    /api/host — login must stay reachable in every mode (a capability guard
+ *    on login would lock assistant-container out of its own assistant
+ *    settings). Its new home is pinned by lib/api/admin-paths-hygiene.
+ *  - Connections stay at /api/connections (Phase 2 EXCEPT-clause) — no
+ *    /api/host/endpoints resurrection.
+ */
+import { describe, expect, test } from 'vitest';
+import { existsSync, readdirSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+// This file lives at routes/api/host/guard-hygiene.vitest.ts — the walker
+// roots are derived from its own location so the suite keeps working if the
+// tree is relocated wholesale.
+const API_HOST_DIR = fileURLToPath(new URL('./', import.meta.url));
+const ROUTES_DIR = fileURLToPath(new URL('../../', import.meta.url));
+
+function serverRouteFiles(root: string): string[] {
+  if (!existsSync(root)) return [];
+  return (readdirSync(root, { recursive: true }) as string[])
+    .filter((rel) => rel.endsWith('+server.ts'))
+    .map((rel) => join(root, rel));
+}
+
+describe('every /api/host/**/+server.ts calls requireCapability (plan Phase 4 step 3, §8.5)', () => {
+  test('the privileged /admin API surface moved under /api/host (>= 20 endpoints)', () => {
+    // Guards the walker against vacuous passes: while routes/api/host is
+    // missing or near-empty, the per-file assertion below proves nothing.
+    expect(serverRouteFiles(API_HOST_DIR).length).toBeGreaterThanOrEqual(20);
+  });
+
+  test('no /api/host endpoint ships without a requireCapability( call', () => {
+    const files = serverRouteFiles(API_HOST_DIR);
+    expect(files.length).toBeGreaterThanOrEqual(20); // no vacuous green
+    const offenders = files
+      .filter((file) => !/requireCapability\(/.test(readFileSync(file, 'utf-8')))
+      .map((file) => file.slice(ROUTES_DIR.length));
+    expect(offenders).toEqual([]);
+  });
+
+  test('host-level AKM key sharing lives under /api/host, not /api/assistant (AkmTab split)', () => {
+    expect(existsSync(join(API_HOST_DIR, 'akm', 'host-sharing', '+server.ts'))).toBe(true);
+    expect(existsSync(join(ROUTES_DIR, 'api', 'assistant', 'akm', 'host-sharing'))).toBe(false);
+  });
+
+  test('CONSTRAINT (green today): session lifecycle endpoints are not under /api/host', () => {
+    // requireCapability on login would 403 assistant-container before it
+    // could ever authenticate for /api/assistant/* — auth lives outside the
+    // capability-guarded namespaces.
+    expect(existsSync(join(API_HOST_DIR, 'auth'))).toBe(false);
+  });
+
+  test('CONSTRAINT (green today): connections stay at /api/connections (Phase 2 EXCEPT clause)', () => {
+    expect(existsSync(join(API_HOST_DIR, 'endpoints'))).toBe(false);
+    expect(existsSync(join(ROUTES_DIR, 'api', 'connections', '+server.ts'))).toBe(true);
+  });
+});
diff --git a/packages/ui/src/routes/api/host/health/server.vitest.ts b/packages/ui/src/routes/api/host/health/server.vitest.ts
new file mode 100644
index 000000000..c5f919673
--- /dev/null
+++ b/packages/ui/src/routes/api/host/health/server.vitest.ts
@@ -0,0 +1,145 @@
+/**
+ * Tests for GET /api/host/health — the representative privileged host
+ * endpoint of the Phase 4 control-plane split (plan ui-runtime-modes-plan.md
+ * Phase 4 steps 1+3, §6.4 API namespace table).
+ *
+ * ALL RED until Phase 4 lands: routes/api/host/health/+server.ts does not
+ * exist yet (it is the mechanical move of routes/admin/health/+server.ts).
+ * The module is loaded through a computed-specifier dynamic import so
+ * svelte-check stays clean while the suite is red.
+ *
+ * Contract under test:
+ *  - Every /api/host/* endpoint carries a SERVER-SIDE requireCapability()
+ *    guard in addition to the requireAdmin cookie check (plan §8.5;
+ *    hasCapability() in the browser is UX only). The guard is
+ *    capability-based, not session-based: a VALID admin session in a mode
+ *    whose serverCapabilities carry no host:* capability (assistant-container,
+ *    pwa-static) is still refused with 403.
+ *  - host-ui / electron-host expose the host:* capability set → 200.
+ *  - requireAdmin still applies: no session cookie → 401 even in host modes.
+ */
+import { afterEach, beforeEach, describe, expect, test, vi } from 'vitest';
+import { mkdirSync } from 'node:fs';
+import { join } from 'node:path';
+import { randomBytes } from 'node:crypto';
+import { tmpdir } from 'node:os';
+import { cleanupTempDirs, resetState, trackDir } from '$lib/server/test-helpers.js';
+
+type RouteHandler = (event: unknown) => Response | Promise<Response>;
+type HostHealthRouteModule = { GET: RouteHandler };
+
+/** RED-state-safe loader (same pattern as the Phase 2 /api/connections suite). */
+async function loadRoute(): Promise<HostHealthRouteModule> {
+  const specifier = './+server.js';
+  return (await import(/* @vite-ignore */ specifier)) as HostHealthRouteModule;
+}
+
+function makeTempHome(): string {
+  const dir = join(tmpdir(), `openpalm-host-health-${randomBytes(4).toString('hex')}`);
+  mkdirSync(dir, { recursive: true });
+  return trackDir(dir);
+}
+
+function makeGetEvent(token = 'admin-token'): unknown {
+  const url = new URL('http://127.0.0.1:3880/api/host/health');
+  return {
+    url,
+    request: new Request(url, {
+      headers: {
+        ...(token ? { cookie: `op_session=${token}` } : {}),
+        'x-request-id': 'req-host-health',
+      },
+    }),
+    params: {},
+    locals: { role: token ? 'admin' : null },
+    route: { id: '/api/host/health' },
+    getClientAddress: () => '127.0.0.1',
+    isDataRequest: false,
+    isSubRequest: false,
+  };
+}
+
+const ENV_KEYS = [
+  'OP_UI_HOST_MODE',
+  'OP_INSIDE_ELECTRON',
+  'OP_ENABLE_ADMIN',
+  'OP_HOME',
+  'OP_OPENCODE_URL',
+  'OP_ASSISTANT_URL',
+  'OP_ASSISTANT_PORT',
+  'OPENCODE_SERVER_PASSWORD',
+  'OP_UI_LOGIN_PASSWORD',
+] as const;
+let savedEnv: Record<string, string | undefined> = {};
+
+beforeEach(() => {
+  savedEnv = {};
+  for (const key of ENV_KEYS) {
+    savedEnv[key] = process.env[key];
+    delete process.env[key];
+  }
+  process.env.OP_HOME = makeTempHome();
+  resetState('admin-token');
+  // The health endpoint probes the active assistant endpoint — never let the
+  // test suite touch the network.
+  vi.stubGlobal('fetch', vi.fn().mockResolvedValue({ ok: true }));
+});
+
+afterEach(() => {
+  vi.unstubAllGlobals();
+  for (const key of ENV_KEYS) {
+    const prev = savedEnv[key];
+    if (prev === undefined) delete process.env[key];
+    else process.env[key] = prev;
+  }
+  cleanupTempDirs();
+});
+
+describe('GET /api/host/health — host capability guard (plan Phase 4 step 3, §8.5)', () => {
+  test('403 in assistant-container mode even with a valid admin session', async () => {
+    process.env.OP_UI_HOST_MODE = 'assistant-container';
+    const { GET } = await loadRoute();
+    const res = await GET(makeGetEvent());
+    expect(res.status).toBe(403);
+  });
+
+  test('the assistant-container 403 is the capability guard, not generic auth', async () => {
+    process.env.OP_UI_HOST_MODE = 'assistant-container';
+    const { GET } = await loadRoute();
+    const res = await GET(makeGetEvent());
+    expect(res.status).toBe(403);
+    expect(res.headers.get('content-type') ?? '').toContain('application/json');
+    const body = (await res.json()) as Record<string, unknown>;
+    expect(body.error).toBe('capability_not_available');
+  });
+
+  test('403 in pwa-static mode even with a valid admin session', async () => {
+    process.env.OP_UI_HOST_MODE = 'pwa-static';
+    const { GET } = await loadRoute();
+    const res = await GET(makeGetEvent());
+    expect(res.status).toBe(403);
+  });
+
+  test('200 in host-ui mode with a valid admin session', async () => {
+    process.env.OP_UI_HOST_MODE = 'host-ui';
+    const { GET } = await loadRoute();
+    const res = await GET(makeGetEvent());
+    expect(res.status).toBe(200);
+    const body = (await res.json()) as Record<string, unknown>;
+    expect(body.ok).toBe(true);
+  });
+
+  test('200 in electron-host mode with a valid admin session', async () => {
+    process.env.OP_UI_HOST_MODE = 'electron-host';
+    const { GET } = await loadRoute();
+    const res = await GET(makeGetEvent());
+    expect(res.status).toBe(200);
+  });
+
+  test('401 in host-ui mode without a session cookie (requireAdmin still enforced)', async () => {
+    process.env.OP_UI_HOST_MODE = 'host-ui';
+    const { GET } = await loadRoute();
+    const res = await GET(makeGetEvent(''));
+    expect(res.status).toBe(401);
+  });
+});
diff --git a/packages/ui/src/routes/api/host/stack/server.vitest.ts b/packages/ui/src/routes/api/host/stack/server.vitest.ts
new file mode 100644
index 000000000..2d0277777
--- /dev/null
+++ b/packages/ui/src/routes/api/host/stack/server.vitest.ts
@@ -0,0 +1,183 @@
+/**
+ * Tests for /api/host/stack — the HOST-SCOPED half of the old
+ * /admin/assistant endpoint (plan ui-runtime-modes-plan.md Phase 4 step 2,
+ * §5.F, §6.4).
+ *
+ * ALL RED until Phase 4 lands: routes/api/host/stack/+server.ts does not
+ * exist yet. Loaded via computed-specifier dynamic import so svelte-check
+ * stays clean while red.
+ *
+ * Contract under test — the AssistantTab split (plan §9 "Assistant settings"):
+ *  - Project name (OP_PROJECT_NAME) and assistant bind address
+ *    (OP_ASSISTANT_BIND_ADDRESS, surfaced as lanExposureEnabled) are HOST
+ *    STACK settings → they live at GET/PUT /api/host/stack, guarded by the
+ *    host:* capability set (host:stack:write for writes) + requireAdmin.
+ *  - Persona is NOT part of this payload anymore — it is assistant-owned and
+ *    moves to /api/assistant/* (see routes/api/assistant/persona tests).
+ *    PUT therefore no longer requires personaContent.
+ *  - Phase 4 acceptance: assistant-container can edit persona/AKM but NOT
+ *    project name or bind address → 403 here even with a valid admin
+ *    session, and stack.env stays untouched.
+ */
+import { afterEach, beforeEach, describe, expect, test } from 'vitest';
+import { existsSync, mkdirSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { randomBytes } from 'node:crypto';
+import { tmpdir } from 'node:os';
+import { cleanupTempDirs, resetState, stackEnvFor, trackDir } from '$lib/server/test-helpers.js';
+
+type RouteHandler = (event: unknown) => Response | Promise<Response>;
+type HostStackRouteModule = { GET: RouteHandler; PUT: RouteHandler };
+
+/** RED-state-safe loader (same pattern as the Phase 2 /api/connections suite). */
+async function loadRoute(): Promise<HostStackRouteModule> {
+  const specifier = './+server.js';
+  return (await import(/* @vite-ignore */ specifier)) as HostStackRouteModule;
+}
+
+let homeDir = '';
+
+function makeTempHome(): string {
+  const dir = join(tmpdir(), `openpalm-host-stack-${randomBytes(4).toString('hex')}`);
+  mkdirSync(dir, { recursive: true });
+  return trackDir(dir);
+}
+
+function makeGetEvent(token = 'admin-token'): unknown {
+  const url = new URL('http://127.0.0.1:3880/api/host/stack');
+  return {
+    url,
+    request: new Request(url, {
+      headers: {
+        ...(token ? { cookie: `op_session=${token}` } : {}),
+        'x-request-id': 'req-host-stack-get',
+      },
+    }),
+    params: {},
+    locals: { role: token ? 'admin' : null },
+    route: { id: '/api/host/stack' },
+    getClientAddress: () => '127.0.0.1',
+    isDataRequest: false,
+    isSubRequest: false,
+  };
+}
+
+function makePutEvent(body: Record<string, unknown>, token = 'admin-token'): unknown {
+  const url = new URL('http://127.0.0.1:3880/api/host/stack');
+  return {
+    url,
+    request: new Request(url, {
+      method: 'PUT',
+      headers: {
+        ...(token ? { cookie: `op_session=${token}` } : {}),
+        'x-request-id': 'req-host-stack-put',
+        'content-type': 'application/json',
+      },
+      body: JSON.stringify(body),
+    }),
+    params: {},
+    locals: { role: token ? 'admin' : null },
+    route: { id: '/api/host/stack' },
+    getClientAddress: () => '127.0.0.1',
+    isDataRequest: false,
+    isSubRequest: false,
+  };
+}
+
+function readStackEnvIfAny(): string {
+  const path = stackEnvFor(homeDir);
+  return existsSync(path) ? readFileSync(path, 'utf-8') : '';
+}
+
+const ENV_KEYS = [
+  'OP_UI_HOST_MODE',
+  'OP_INSIDE_ELECTRON',
+  'OP_ENABLE_ADMIN',
+  'OP_HOME',
+  'OP_UI_LOGIN_PASSWORD',
+] as const;
+let savedEnv: Record<string, string | undefined> = {};
+
+beforeEach(() => {
+  savedEnv = {};
+  for (const key of ENV_KEYS) {
+    savedEnv[key] = process.env[key];
+    delete process.env[key];
+  }
+  homeDir = makeTempHome();
+  process.env.OP_HOME = homeDir;
+  resetState('admin-token');
+});
+
+afterEach(() => {
+  for (const key of ENV_KEYS) {
+    const prev = savedEnv[key];
+    if (prev === undefined) delete process.env[key];
+    else process.env[key] = prev;
+  }
+  cleanupTempDirs();
+});
+
+describe('GET /api/host/stack — host stack settings (plan Phase 4 step 2)', () => {
+  test('200 in host-ui mode: project name + LAN exposure, and NO persona (partitioned)', async () => {
+    process.env.OP_UI_HOST_MODE = 'host-ui';
+    const { GET } = await loadRoute();
+    const res = await GET(makeGetEvent());
+    expect(res.status).toBe(200);
+    const body = (await res.json()) as Record<string, unknown>;
+    expect(body.projectName).toBe('openpalm');
+    expect(body.lanExposureEnabled).toBe(false);
+    // Persona is assistant-owned now — it must not leak into the host payload.
+    expect(body).not.toHaveProperty('personaContent');
+  });
+
+  test('403 in assistant-container mode even with a valid admin session', async () => {
+    process.env.OP_UI_HOST_MODE = 'assistant-container';
+    const { GET } = await loadRoute();
+    const res = await GET(makeGetEvent());
+    expect(res.status).toBe(403);
+  });
+
+  test('403 in pwa-static mode even with a valid admin session', async () => {
+    process.env.OP_UI_HOST_MODE = 'pwa-static';
+    const { GET } = await loadRoute();
+    const res = await GET(makeGetEvent());
+    expect(res.status).toBe(403);
+  });
+
+  test('401 in host-ui mode without a session cookie', async () => {
+    process.env.OP_UI_HOST_MODE = 'host-ui';
+    const { GET } = await loadRoute();
+    const res = await GET(makeGetEvent(''));
+    expect(res.status).toBe(401);
+  });
+});
+
+describe('PUT /api/host/stack — host:stack:write guard (Phase 4 acceptance)', () => {
+  test('updates project name and bind address in host-ui mode — persona no longer required', async () => {
+    process.env.OP_UI_HOST_MODE = 'host-ui';
+    const { PUT } = await loadRoute();
+    const res = await PUT(makePutEvent({ projectName: 'openpalm-dev', lanExposureEnabled: true }));
+    expect(res.status).toBe(200);
+
+    const stackEnv = readFileSync(stackEnvFor(homeDir), 'utf-8');
+    expect(stackEnv).toContain('OP_PROJECT_NAME=openpalm-dev');
+    expect(stackEnv).toContain('OP_ASSISTANT_BIND_ADDRESS=0.0.0.0');
+  });
+
+  test('assistant-container cannot edit project name or bind address: 403 with a valid session', async () => {
+    process.env.OP_UI_HOST_MODE = 'assistant-container';
+    const { PUT } = await loadRoute();
+    const res = await PUT(makePutEvent({ projectName: 'intruder', lanExposureEnabled: true }));
+    expect(res.status).toBe(403);
+    // The write must have been refused before touching the stack env.
+    expect(readStackEnvIfAny()).not.toContain('intruder');
+  });
+
+  test('401 in host-ui mode without a session cookie', async () => {
+    process.env.OP_UI_HOST_MODE = 'host-ui';
+    const { PUT } = await loadRoute();
+    const res = await PUT(makePutEvent({ projectName: 'openpalm', lanExposureEnabled: false }, ''));
+    expect(res.status).toBe(401);
+  });
+});

From 98567c054759c214e2fed61c389690fbc64c5ef0 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Mon, 6 Jul 2026 14:35:00 +0000
Subject: [PATCH 19/61] feat(ui): move session lifecycle endpoints to
 /api/auth/* (#555)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Session auth (login/logout/session) leaves the dying /admin namespace but
does NOT move under /api/host — a capability guard on login would lock
assistant-container out before it could ever authenticate for
/api/assistant/* (pinned by routes/api/host/guard-hygiene.vitest.ts).
The flow itself is unchanged: only the address moves.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FetR7BttT1xBrA8fBwhui9
---
 packages/ui/src/lib/server/helpers.ts                  |  2 +-
 .../ui/src/routes/{admin => api}/auth/login/+server.ts |  2 +-
 .../routes/{admin => api}/auth/login/server.vitest.ts  | 10 +++++-----
 .../src/routes/{admin => api}/auth/logout/+server.ts   |  0
 .../routes/{admin => api}/auth/logout/server.vitest.ts |  6 +++---
 .../src/routes/{admin => api}/auth/session/+server.ts  |  4 ++--
 .../{admin => api}/auth/session/server.vitest.ts       |  8 ++++----
 packages/ui/src/routes/login/+page.svelte              |  2 +-
 8 files changed, 17 insertions(+), 17 deletions(-)
 rename packages/ui/src/routes/{admin => api}/auth/login/+server.ts (98%)
 rename packages/ui/src/routes/{admin => api}/auth/login/server.vitest.ts (91%)
 rename packages/ui/src/routes/{admin => api}/auth/logout/+server.ts (100%)
 rename packages/ui/src/routes/{admin => api}/auth/logout/server.vitest.ts (91%)
 rename packages/ui/src/routes/{admin => api}/auth/session/+server.ts (94%)
 rename packages/ui/src/routes/{admin => api}/auth/session/server.vitest.ts (92%)

diff --git a/packages/ui/src/lib/server/helpers.ts b/packages/ui/src/lib/server/helpers.ts
index 1917eb410..7dccfdd95 100644
--- a/packages/ui/src/lib/server/helpers.ts
+++ b/packages/ui/src/lib/server/helpers.ts
@@ -80,7 +80,7 @@ export { getUiLoginPassword };
  * removed the legacy `x-admin-token` / `Authorization: Bearer` header fallbacks.
  * The cookie is HttpOnly + SameSite=Strict and is the ONLY credential the browser
  * holds; XSS cannot read it and out-of-process callers must obtain a session via
- * `POST /admin/auth/login` (or `/session`) and present the cookie on subsequent
+ * `POST /api/auth/login` (or `/session`) and present the cookie on subsequent
  * requests.
  */
 function extractToken(event: RequestEvent): string {
diff --git a/packages/ui/src/routes/admin/auth/login/+server.ts b/packages/ui/src/routes/api/auth/login/+server.ts
similarity index 98%
rename from packages/ui/src/routes/admin/auth/login/+server.ts
rename to packages/ui/src/routes/api/auth/login/+server.ts
index d85e0a14c..4f248e8b1 100644
--- a/packages/ui/src/routes/admin/auth/login/+server.ts
+++ b/packages/ui/src/routes/api/auth/login/+server.ts
@@ -1,5 +1,5 @@
 /**
- * POST /admin/auth/login
+ * POST /api/auth/login
  *
  * Issues the `op_session` cookie (HttpOnly, SameSite=Lax, Secure-on-HTTPS,
  * Max-Age=14d — see session-cookie.ts) after verifying the operator-supplied
diff --git a/packages/ui/src/routes/admin/auth/login/server.vitest.ts b/packages/ui/src/routes/api/auth/login/server.vitest.ts
similarity index 91%
rename from packages/ui/src/routes/admin/auth/login/server.vitest.ts
rename to packages/ui/src/routes/api/auth/login/server.vitest.ts
index 454a3f298..37a3fc865 100644
--- a/packages/ui/src/routes/admin/auth/login/server.vitest.ts
+++ b/packages/ui/src/routes/api/auth/login/server.vitest.ts
@@ -1,8 +1,8 @@
 /**
- * Route-level tests for POST /admin/auth/login.
+ * Route-level tests for POST /api/auth/login.
  *
  * Previously untested anywhere (3.4) — the route mints the `op_session`
- * cookie operators authenticate with for every subsequent /admin/* call, so
+ * cookie operators authenticate with for every subsequent privileged API call, so
  * its four branches (misconfigured, bad body, wrong password, success) are
  * the entire login contract.
  */
@@ -16,12 +16,12 @@ let savedEnv: string | undefined;
 function makeLoginEvent(body: unknown, asJson = true): Parameters<typeof POST>[0] {
   return {
     request: asJson
-      ? new Request('http://localhost/admin/auth/login', {
+      ? new Request('http://localhost/api/auth/login', {
           method: 'POST',
           headers: { 'content-type': 'application/json' },
           body: JSON.stringify(body),
         })
-      : new Request('http://localhost/admin/auth/login', {
+      : new Request('http://localhost/api/auth/login', {
           method: 'POST',
           headers: { 'content-type': 'application/json' },
           body: 'not-json{{{',
@@ -40,7 +40,7 @@ afterEach(() => {
   _clearSessions();
 });
 
-describe('POST /admin/auth/login', () => {
+describe('POST /api/auth/login', () => {
   test('returns 503 admin_not_configured when no login password is set', async () => {
     delete process.env[ENV_KEY];
     const res = await POST(makeLoginEvent({ password: 'anything' }));
diff --git a/packages/ui/src/routes/admin/auth/logout/+server.ts b/packages/ui/src/routes/api/auth/logout/+server.ts
similarity index 100%
rename from packages/ui/src/routes/admin/auth/logout/+server.ts
rename to packages/ui/src/routes/api/auth/logout/+server.ts
diff --git a/packages/ui/src/routes/admin/auth/logout/server.vitest.ts b/packages/ui/src/routes/api/auth/logout/server.vitest.ts
similarity index 91%
rename from packages/ui/src/routes/admin/auth/logout/server.vitest.ts
rename to packages/ui/src/routes/api/auth/logout/server.vitest.ts
index bffaa25db..f36309e51 100644
--- a/packages/ui/src/routes/admin/auth/logout/server.vitest.ts
+++ b/packages/ui/src/routes/api/auth/logout/server.vitest.ts
@@ -1,5 +1,5 @@
 /**
- * Route-level tests for POST /admin/auth/logout.
+ * Route-level tests for POST /api/auth/logout.
  *
  * Previously untested anywhere (3.4). Logout must always succeed (idempotent
  * — no auth required, matching a browser that may already be logged out) and
@@ -16,7 +16,7 @@ function makeLogoutEvent(cookie?: string): Parameters<typeof POST>[0] {
   const headers: Record<string, string> = {};
   if (cookie !== undefined) headers.cookie = cookie;
   return {
-    request: new Request('http://localhost/admin/auth/logout', { method: 'POST', headers }),
+    request: new Request('http://localhost/api/auth/logout', { method: 'POST', headers }),
   } as Parameters<typeof POST>[0];
 }
 
@@ -32,7 +32,7 @@ afterEach(() => {
   _clearSessions();
 });
 
-describe('POST /admin/auth/logout', () => {
+describe('POST /api/auth/logout', () => {
   test('returns 200 ok and clears the cookie even with no cookie presented', async () => {
     const res = await POST(makeLogoutEvent());
     expect(res.status).toBe(200);
diff --git a/packages/ui/src/routes/admin/auth/session/+server.ts b/packages/ui/src/routes/api/auth/session/+server.ts
similarity index 94%
rename from packages/ui/src/routes/admin/auth/session/+server.ts
rename to packages/ui/src/routes/api/auth/session/+server.ts
index 4182a7050..4d45c855b 100644
--- a/packages/ui/src/routes/admin/auth/session/+server.ts
+++ b/packages/ui/src/routes/api/auth/session/+server.ts
@@ -1,11 +1,11 @@
 /**
- * POST /admin/auth/session
+ * POST /api/auth/session
  *
  * Issues an `op_session` cookie after verifying the operator-supplied password
  * against `process.env.OP_UI_LOGIN_PASSWORD`.
  *
  * The cookie value is a random UUID session token — NOT the plaintext password.
- * Kept alongside `/admin/auth/login` as an alias; both verify the same
+ * Kept alongside `/api/auth/login` as an alias; both verify the same
  * `password` body field and issue the `op_session` cookie.
  */
 import { safeTokenCompare, getRequestId, errorResponse, getUiLoginPassword } from "$lib/server/helpers.js";
diff --git a/packages/ui/src/routes/admin/auth/session/server.vitest.ts b/packages/ui/src/routes/api/auth/session/server.vitest.ts
similarity index 92%
rename from packages/ui/src/routes/admin/auth/session/server.vitest.ts
rename to packages/ui/src/routes/api/auth/session/server.vitest.ts
index cb746a98d..f69ece9c3 100644
--- a/packages/ui/src/routes/admin/auth/session/server.vitest.ts
+++ b/packages/ui/src/routes/api/auth/session/server.vitest.ts
@@ -1,5 +1,5 @@
 /**
- * Route-level tests for POST /admin/auth/session.
+ * Route-level tests for POST /api/auth/session.
  *
  * Previously untested anywhere (3.4). Kept as a login alias (same password
  * check, same cookie issuance) — these tests mirror the login route's,
@@ -15,12 +15,12 @@ let savedEnv: string | undefined;
 function makeSessionEvent(body: unknown, asJson = true): Parameters<typeof POST>[0] {
   return {
     request: asJson
-      ? new Request('http://localhost/admin/auth/session', {
+      ? new Request('http://localhost/api/auth/session', {
           method: 'POST',
           headers: { 'content-type': 'application/json' },
           body: JSON.stringify(body),
         })
-      : new Request('http://localhost/admin/auth/session', {
+      : new Request('http://localhost/api/auth/session', {
           method: 'POST',
           headers: { 'content-type': 'application/json' },
           body: 'not-json{{{',
@@ -39,7 +39,7 @@ afterEach(() => {
   _clearSessions();
 });
 
-describe('POST /admin/auth/session', () => {
+describe('POST /api/auth/session', () => {
   test('returns 503 admin_not_configured when no login password is set', async () => {
     delete process.env[ENV_KEY];
     const res = await POST(makeSessionEvent({ password: 'anything' }));
diff --git a/packages/ui/src/routes/login/+page.svelte b/packages/ui/src/routes/login/+page.svelte
index 7485eed89..7416392a7 100644
--- a/packages/ui/src/routes/login/+page.svelte
+++ b/packages/ui/src/routes/login/+page.svelte
@@ -16,7 +16,7 @@
     loading = true;
     error = '';
     try {
-      const res = await fetch('/admin/auth/login', {
+      const res = await fetch('/api/auth/login', {
         method: 'POST',
         headers: { 'content-type': 'application/json' },
         body: JSON.stringify({ password: token }),

From 2ba5304e500b6a62adfad385f4bbeeeff67be0e5 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Mon, 6 Jul 2026 15:08:32 +0000
Subject: [PATCH 20/61] =?UTF-8?q?feat(ui):=20split=20host=20and=20assistan?=
 =?UTF-8?q?t=20control=20planes=20=E2=80=94=20/host=20+=20/api/host=20+=20?=
 =?UTF-8?q?/api/assistant=20(#555)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Plan ui-runtime-modes-plan.md Phase 4 (§6.4, §8.5). /admin/* is now a dead
namespace: the route tree is deleted, hooks neither gate nor alias it, and
requests fall through to the router 404 (no alias — ratified §2).

- Pages: routes/admin/+page.svelte → routes/host/+page.svelte.
  HOST_ADMIN_LANDING flips to '/host' (installed_offline/broken land there);
  runtime context routes.host is '/host'; nav/components (EndpointList,
  SettingsDrawer, ModeSwitch, attention, chat) point at /host.
- APIs: the ~50 privileged /admin/* JSON endpoints move to /api/host/* and
  EVERY one now carries a server-side requireCapability('host:…') guard in
  addition to requireAdmin — a valid admin session in a mode without host
  capabilities (assistant-container, pwa-static) gets 403
  capability_not_available (§8.5: capabilities are enforced server-side;
  hasCapability() is UX only). Hygiene test guard-hygiene.vitest.ts
  enumerates the tree and asserts the call in each file.
- New /api/assistant/* namespace (assistant-settings:read/write guards):
  persona (from the old /admin/assistant), akm config (from /admin/akm),
  model (from /admin/opencode/model — OpenCode's own setting, plan step 2
  'persona, model'). assistant-container CAN edit these; pwa-static cannot.
- AssistantTab split: host stack settings (projectName,
  lanExposureEnabled → GET/PUT /api/host/stack, host:stack:write) vs
  assistant persona (GET/PUT /api/assistant/persona) with separate save
  actions and hasCapability-driven visibility. AkmTab split: config megaform
  is assistant-scoped; index maintenance/diagnostics (reindex, stats,
  health-report) are host-gated; host key sharing stays host-only at
  /api/host/akm/host-sharing.
- hooks.server.ts: the features.admin route gate is replaced by a capability
  check on /host/*; the Phase 2 /admin/endpoints alias is removed; the
  X-Frame-Options exception follows the health-report move.
- features.admin derived alias DELETED (plan step 4): grep found no readers
  left — hooks and +layout.server.ts were the last. computeFeatureFlags/
  FeatureFlags are gone; the Phase 1 characterization tests that protected
  the alias through Phases 1–3 (features.vitest.ts, layout.server.vitest.ts)
  are retired with it, as those tests' own Phase-4 escape hatch and the plan
  authorize; the env → hostMode mapping they pinned stays covered by the
  serverRuntimeContext tests.
- lib/api domain clients target /api/host/* + /api/assistant/*; the old
  /admin/assistant client splits into fetchHostStackSettings/
  saveHostStackSettings + fetchAssistantPersona/saveAssistantPersona.
- Moved colocated route tests run as OP_UI_HOST_MODE=host-ui (the endpoints
  are capability-guarded now); the old /admin/assistant suite's rename/LAN
  behavior survives as api/host/stack/rename.vitest.ts minus persona.
  computeServerRuntimeContext tolerates url-less test event stubs
  (publicBaseUrl only). Phase 3 TODO(phase-4) constants in
  resolve-landing.vitest.ts / hooks.server.landing.vitest.ts flip to '/host'
  as their comments instructed. e2e suites follow the new paths.
- Phase 2 EXCEPT clause honored: connections stay at /api/connections;
  session lifecycle stays outside the capability namespaces at /api/auth.

Server suite: 1073/1073 pass. ui:check 0 errors 0 warnings. eslint clean on
changed files; biome baseline unchanged.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FetR7BttT1xBrA8fBwhui9
---
 packages/ui/e2e/README.md                     |   6 +-
 packages/ui/e2e/admin-health.stack.ts         |  40 ++---
 packages/ui/e2e/akm-config.manual.ts          | 100 +++++------
 packages/ui/e2e/auth-boundary.stack.ts        |  22 +--
 packages/ui/e2e/auth-flow.pw.ts               |  22 +--
 packages/ui/e2e/scheduler.manual.ts           |  36 ++--
 packages/ui/e2e/secrets.stack.ts              |   6 +-
 packages/ui/e2e/ux-audit.config.json          |  12 +-
 packages/ui/e2e/voice.manual.ts               |  40 ++---
 .../ui/src/hooks.server.landing.vitest.ts     |   9 +-
 packages/ui/src/hooks.server.ts               |  36 ++--
 packages/ui/src/lib/api/addons.ts             |   8 +-
 packages/ui/src/lib/api/akm.ts                |  57 +++---
 packages/ui/src/lib/api/automations.ts        |  14 +-
 packages/ui/src/lib/api/backups.ts            |  12 +-
 packages/ui/src/lib/api/containers.ts         |  10 +-
 packages/ui/src/lib/api/endpoints.ts          |   2 +-
 packages/ui/src/lib/api/providers.ts          |  50 +++---
 packages/ui/src/lib/api/providers.vitest.ts   |  32 ++--
 packages/ui/src/lib/api/secrets.ts            |  14 +-
 packages/ui/src/lib/api/versions.ts           |  18 +-
 packages/ui/src/lib/api/voice.ts              |   6 +-
 .../admin/assistant/AssistantTab.svelte       | 166 ++++++++++++------
 .../akm/AkmHealthReportSection.svelte         |   2 +-
 .../ui/src/lib/components/akm/AkmTab.svelte   |  40 +++--
 .../lib/components/chat/EndpointList.svelte   |   2 +-
 .../lib/components/chrome/ModeSwitch.svelte   |   2 +-
 .../components/chrome/SettingsDrawer.svelte   |   2 +-
 .../src/lib/components/voice/voice-mappers.ts |   2 +-
 .../src/lib/features-admin-hygiene.vitest.ts  |   6 +-
 packages/ui/src/lib/resolve-landing.ts        |   7 +-
 packages/ui/src/lib/resolve-landing.vitest.ts |  13 +-
 packages/ui/src/lib/server/endpoints.ts       |   5 +-
 packages/ui/src/lib/server/features.ts        |  31 ++--
 packages/ui/src/lib/server/features.vitest.ts |  40 ++---
 packages/ui/src/lib/server/landing.ts         |   2 +-
 packages/ui/src/lib/server/release-units.ts   |   2 +-
 packages/ui/src/lib/types.ts                  |  12 +-
 packages/ui/src/routes/+layout.server.ts      |   5 +-
 .../src/routes/admin/endpoints/+page.svelte   |   6 -
 .../ui/src/routes/admin/endpoints/+page.ts    |  16 --
 .../ui/src/routes/admin/endpoints/+server.ts  |  76 --------
 .../routes/admin/endpoints/[id]/+server.ts    |  74 --------
 .../routes/admin/endpoints/active/+server.ts  |  41 -----
 .../src/routes/admin/endpoints/page.vitest.ts |  58 ------
 .../{admin => api/assistant}/akm/+server.ts   |  16 +-
 .../assistant}/model/+server.ts               |   9 +-
 .../assistant}/model/server.vitest.ts         |   8 +-
 .../routes/api/assistant/persona/+server.ts   |  85 +++++++++
 .../{admin => api/host}/addons/+server.ts     |   9 +-
 .../host}/addons/[name]/+server.ts            |   9 +-
 .../addons/[name]/credentials/+server.ts      |   9 +-
 .../host}/addons/[name]/server.vitest.ts      |  12 +-
 .../host}/addons/server.vitest.ts             |  12 +-
 .../host}/akm/embedding/detect/+server.ts     |   4 +-
 .../host}/akm/embedding/server.vitest.ts      |  16 +-
 .../host}/akm/embedding/test/+server.ts       |   4 +-
 .../host}/akm/health-report/+server.ts        |   4 +-
 .../host}/akm/health-report/server.vitest.ts  |  12 +-
 .../{admin => api/host}/akm/health/+server.ts |   6 +-
 .../host}/akm/host-sharing/+server.ts         |  13 +-
 .../host}/akm/host-sharing/server.vitest.ts   |  14 +-
 .../host}/akm/reindex/+server.ts              |   4 +-
 .../host}/akm/reindex/server.vitest.ts        |   8 +-
 .../{admin => api/host}/akm/stats/+server.ts  |   4 +-
 .../host}/akm/stats/server.vitest.ts          |   8 +-
 .../host}/automations/+server.ts              |   5 +-
 .../host}/automations/[name]/file/+server.ts  |  13 +-
 .../host}/automations/[name]/log/+server.ts   |   5 +-
 .../automations/[name]/log/server.vitest.ts   |   8 +-
 .../host}/automations/[name]/run/+server.ts   |   5 +-
 .../automations/[name]/run/server.vitest.ts   |   8 +-
 .../{admin => api/host}/backups/+server.ts    |   5 +
 .../host}/config/validate/+server.ts          |   5 +-
 .../host}/config/validate/server.vitest.ts    |  10 +-
 .../host}/containers/down/+server.ts          |   3 +
 .../host}/containers/down/server.vitest.ts    |  10 +-
 .../host}/containers/events/+server.ts        |   3 +
 .../host}/containers/list/+server.ts          |   3 +
 .../host}/containers/list/server.vitest.ts    |   8 +-
 .../host}/containers/pull/+server.ts          |   3 +
 .../host}/containers/pull/server.vitest.ts    |  10 +-
 .../host}/containers/restart/+server.ts       |   3 +
 .../host}/containers/restart/server.vitest.ts |  10 +-
 .../host}/containers/stats/+server.ts         |   3 +
 .../host}/containers/up/+server.ts            |   3 +
 .../host}/containers/up/server.vitest.ts      |  10 +-
 .../{admin => api/host}/health/+server.ts     |   6 +-
 .../host/health/legacy-server.vitest.ts}      |  10 +-
 .../{admin => api/host}/install/+server.ts    |   3 +
 .../host}/install/server.vitest.ts            |  10 +-
 .../{admin => api/host}/logs/+server.ts       |   5 +-
 .../opencode/providers/[id]/auth/+server.ts   |   9 +-
 .../providers/[id]/auth/server.vitest.ts      |   8 +-
 .../opencode/providers/[id]/models/+server.ts |   4 +-
 .../providers/[id]/models/server.vitest.ts    |   8 +-
 .../{admin => api/host}/providers/+server.ts  |   4 +-
 .../host}/providers/[id]/+server.ts           |   7 +-
 .../host}/providers/[id]/server.vitest.ts     |   8 +-
 .../{admin => api/host}/providers/_helpers.ts |   0
 .../host}/providers/assistant-clis/+server.ts |   4 +-
 .../[toolId]/use-provider/+server.ts          |   3 +
 .../host}/providers/host-status/+server.ts    |   6 +-
 .../providers/host-status/server.vitest.ts    |   8 +-
 .../host}/providers/import-host/+server.ts    |   5 +-
 .../providers/import-host/server.vitest.ts    |   8 +-
 .../oauth/[providerId]/callback/+server.ts    |   6 +-
 .../host}/providers/oauth/finish/+server.ts   |  10 +-
 .../providers/oauth/finish/server.vitest.ts   |   8 +-
 .../host}/providers/oauth/start/+server.ts    |  10 +-
 .../providers/oauth/start/server.vitest.ts    |   8 +-
 .../host}/providers/server.vitest.ts          |  10 +-
 .../host}/secret-notice/+server.ts            |   5 +
 .../{admin => api/host}/secrets/+server.ts    |   8 +-
 .../host}/secrets/[name]/+server.ts           |  13 +-
 .../host}/secrets/user-env/+server.ts         |  14 +-
 .../host}/secrets/user-env/server.vitest.ts   |  38 ++--
 .../assistant => api/host/stack}/+server.ts   |  58 +++---
 .../host/stack/rename.vitest.ts}              |  65 +++----
 .../{admin => api/host}/ui-version/+server.ts |   3 +
 .../{admin => api/host}/uninstall/+server.ts  |   3 +
 .../host}/uninstall/server.vitest.ts          |  10 +-
 .../{admin => api/host}/unlock/+server.ts     |   5 +
 .../host}/unlock/server.vitest.ts             |  12 +-
 .../{admin => api/host}/update/+server.ts     |   3 +
 .../host}/update/server.vitest.ts             |  10 +-
 .../{admin => api/host}/versions/+server.ts   |  16 +-
 .../host}/versions/latest/+server.ts          |   4 +-
 .../host}/versions/latest/server.vitest.ts    |  12 +-
 .../host}/versions/releases/+server.ts        |   6 +-
 .../host}/versions/releases/server.vitest.ts  |  14 +-
 .../host}/versions/server.vitest.ts           |  18 +-
 .../host}/versions/ui/+server.ts              |   6 +-
 .../{admin => api/host}/voice/+server.ts      |   9 +-
 .../host}/voice/server.vitest.ts              |  16 +-
 packages/ui/src/routes/attention/+page.svelte |   2 +-
 packages/ui/src/routes/chat/+page.svelte      |   2 +-
 .../src/routes/{admin => host}/+page.svelte   |   6 +-
 .../ui/src/routes/layout.server.vitest.ts     |  37 ++--
 packages/ui/src/routes/page.svelte.vitest.ts  |  10 +-
 140 files changed, 1152 insertions(+), 982 deletions(-)
 delete mode 100644 packages/ui/src/routes/admin/endpoints/+page.svelte
 delete mode 100644 packages/ui/src/routes/admin/endpoints/+page.ts
 delete mode 100644 packages/ui/src/routes/admin/endpoints/+server.ts
 delete mode 100644 packages/ui/src/routes/admin/endpoints/[id]/+server.ts
 delete mode 100644 packages/ui/src/routes/admin/endpoints/active/+server.ts
 delete mode 100644 packages/ui/src/routes/admin/endpoints/page.vitest.ts
 rename packages/ui/src/routes/{admin => api/assistant}/akm/+server.ts (96%)
 rename packages/ui/src/routes/{admin/opencode => api/assistant}/model/+server.ts (87%)
 rename packages/ui/src/routes/{admin/opencode => api/assistant}/model/server.vitest.ts (93%)
 create mode 100644 packages/ui/src/routes/api/assistant/persona/+server.ts
 rename packages/ui/src/routes/{admin => api/host}/addons/+server.ts (84%)
 rename packages/ui/src/routes/{admin => api/host}/addons/[name]/+server.ts (85%)
 rename packages/ui/src/routes/{admin => api/host}/addons/[name]/credentials/+server.ts (94%)
 rename packages/ui/src/routes/{admin => api/host}/addons/[name]/server.vitest.ts (92%)
 rename packages/ui/src/routes/{admin => api/host}/addons/server.vitest.ts (93%)
 rename packages/ui/src/routes/{admin => api/host}/akm/embedding/detect/+server.ts (77%)
 rename packages/ui/src/routes/{admin => api/host}/akm/embedding/server.vitest.ts (77%)
 rename packages/ui/src/routes/{admin => api/host}/akm/embedding/test/+server.ts (85%)
 rename packages/ui/src/routes/{admin => api/host}/akm/health-report/+server.ts (86%)
 rename packages/ui/src/routes/{admin => api/host}/akm/health-report/server.vitest.ts (87%)
 rename packages/ui/src/routes/{admin => api/host}/akm/health/+server.ts (86%)
 rename packages/ui/src/routes/{admin => api/host}/akm/host-sharing/+server.ts (70%)
 rename packages/ui/src/routes/{admin => api/host}/akm/host-sharing/server.vitest.ts (86%)
 rename packages/ui/src/routes/{admin => api/host}/akm/reindex/+server.ts (82%)
 rename packages/ui/src/routes/{admin => api/host}/akm/reindex/server.vitest.ts (86%)
 rename packages/ui/src/routes/{admin => api/host}/akm/stats/+server.ts (88%)
 rename packages/ui/src/routes/{admin => api/host}/akm/stats/server.vitest.ts (94%)
 rename packages/ui/src/routes/{admin => api/host}/automations/+server.ts (82%)
 rename packages/ui/src/routes/{admin => api/host}/automations/[name]/file/+server.ts (78%)
 rename packages/ui/src/routes/{admin => api/host}/automations/[name]/log/+server.ts (87%)
 rename packages/ui/src/routes/{admin => api/host}/automations/[name]/log/server.vitest.ts (93%)
 rename packages/ui/src/routes/{admin => api/host}/automations/[name]/run/+server.ts (86%)
 rename packages/ui/src/routes/{admin => api/host}/automations/[name]/run/server.vitest.ts (90%)
 rename packages/ui/src/routes/{admin => api/host}/backups/+server.ts (89%)
 rename packages/ui/src/routes/{admin => api/host}/config/validate/+server.ts (85%)
 rename packages/ui/src/routes/{admin => api/host}/config/validate/server.vitest.ts (89%)
 rename packages/ui/src/routes/{admin => api/host}/containers/down/+server.ts (92%)
 rename packages/ui/src/routes/{admin => api/host}/containers/down/server.vitest.ts (88%)
 rename packages/ui/src/routes/{admin => api/host}/containers/events/+server.ts (89%)
 rename packages/ui/src/routes/{admin => api/host}/containers/list/+server.ts (95%)
 rename packages/ui/src/routes/{admin => api/host}/containers/list/server.vitest.ts (90%)
 rename packages/ui/src/routes/{admin => api/host}/containers/pull/+server.ts (93%)
 rename packages/ui/src/routes/{admin => api/host}/containers/pull/server.vitest.ts (89%)
 rename packages/ui/src/routes/{admin => api/host}/containers/restart/+server.ts (94%)
 rename packages/ui/src/routes/{admin => api/host}/containers/restart/server.vitest.ts (90%)
 rename packages/ui/src/routes/{admin => api/host}/containers/stats/+server.ts (90%)
 rename packages/ui/src/routes/{admin => api/host}/containers/up/+server.ts (94%)
 rename packages/ui/src/routes/{admin => api/host}/containers/up/server.vitest.ts (90%)
 rename packages/ui/src/routes/{admin => api/host}/health/+server.ts (84%)
 rename packages/ui/src/routes/{admin/health/server.vitest.ts => api/host/health/legacy-server.vitest.ts} (92%)
 rename packages/ui/src/routes/{admin => api/host}/install/+server.ts (95%)
 rename packages/ui/src/routes/{admin => api/host}/install/server.vitest.ts (94%)
 rename packages/ui/src/routes/{admin => api/host}/logs/+server.ts (92%)
 rename packages/ui/src/routes/{admin => api/host}/opencode/providers/[id]/auth/+server.ts (93%)
 rename packages/ui/src/routes/{admin => api/host}/opencode/providers/[id]/auth/server.vitest.ts (97%)
 rename packages/ui/src/routes/{admin => api/host}/opencode/providers/[id]/models/+server.ts (79%)
 rename packages/ui/src/routes/{admin => api/host}/opencode/providers/[id]/models/server.vitest.ts (88%)
 rename packages/ui/src/routes/{admin => api/host}/providers/+server.ts (63%)
 rename packages/ui/src/routes/{admin => api/host}/providers/[id]/+server.ts (96%)
 rename packages/ui/src/routes/{admin => api/host}/providers/[id]/server.vitest.ts (89%)
 rename packages/ui/src/routes/{admin => api/host}/providers/_helpers.ts (100%)
 rename packages/ui/src/routes/{admin => api/host}/providers/assistant-clis/+server.ts (65%)
 rename packages/ui/src/routes/{admin => api/host}/providers/assistant-clis/[toolId]/use-provider/+server.ts (92%)
 rename packages/ui/src/routes/{admin => api/host}/providers/host-status/+server.ts (76%)
 rename packages/ui/src/routes/{admin => api/host}/providers/host-status/server.vitest.ts (89%)
 rename packages/ui/src/routes/{admin => api/host}/providers/import-host/+server.ts (96%)
 rename packages/ui/src/routes/{admin => api/host}/providers/import-host/server.vitest.ts (96%)
 rename packages/ui/src/routes/{admin => api/host}/providers/oauth/[providerId]/callback/+server.ts (81%)
 rename packages/ui/src/routes/{admin => api/host}/providers/oauth/finish/+server.ts (75%)
 rename packages/ui/src/routes/{admin => api/host}/providers/oauth/finish/server.vitest.ts (90%)
 rename packages/ui/src/routes/{admin => api/host}/providers/oauth/start/+server.ts (80%)
 rename packages/ui/src/routes/{admin => api/host}/providers/oauth/start/server.vitest.ts (92%)
 rename packages/ui/src/routes/{admin => api/host}/providers/server.vitest.ts (91%)
 rename packages/ui/src/routes/{admin => api/host}/secret-notice/+server.ts (85%)
 rename packages/ui/src/routes/{admin => api/host}/secrets/+server.ts (56%)
 rename packages/ui/src/routes/{admin => api/host}/secrets/[name]/+server.ts (79%)
 rename packages/ui/src/routes/{admin => api/host}/secrets/user-env/+server.ts (87%)
 rename packages/ui/src/routes/{admin => api/host}/secrets/user-env/server.vitest.ts (73%)
 rename packages/ui/src/routes/{admin/assistant => api/host/stack}/+server.ts (68%)
 rename packages/ui/src/routes/{admin/assistant/server.vitest.ts => api/host/stack/rename.vitest.ts} (66%)
 rename packages/ui/src/routes/{admin => api/host}/ui-version/+server.ts (95%)
 rename packages/ui/src/routes/{admin => api/host}/uninstall/+server.ts (91%)
 rename packages/ui/src/routes/{admin => api/host}/uninstall/server.vitest.ts (89%)
 rename packages/ui/src/routes/{admin => api/host}/unlock/+server.ts (91%)
 rename packages/ui/src/routes/{admin => api/host}/unlock/server.vitest.ts (89%)
 rename packages/ui/src/routes/{admin => api/host}/update/+server.ts (98%)
 rename packages/ui/src/routes/{admin => api/host}/update/server.vitest.ts (97%)
 rename packages/ui/src/routes/{admin => api/host}/versions/+server.ts (94%)
 rename packages/ui/src/routes/{admin => api/host}/versions/latest/+server.ts (95%)
 rename packages/ui/src/routes/{admin => api/host}/versions/latest/server.vitest.ts (86%)
 rename packages/ui/src/routes/{admin => api/host}/versions/releases/+server.ts (82%)
 rename packages/ui/src/routes/{admin => api/host}/versions/releases/server.vitest.ts (88%)
 rename packages/ui/src/routes/{admin => api/host}/versions/server.vitest.ts (92%)
 rename packages/ui/src/routes/{admin => api/host}/versions/ui/+server.ts (89%)
 rename packages/ui/src/routes/{admin => api/host}/voice/+server.ts (96%)
 rename packages/ui/src/routes/{admin => api/host}/voice/server.vitest.ts (96%)
 rename packages/ui/src/routes/{admin => host}/+page.svelte (98%)

diff --git a/packages/ui/e2e/README.md b/packages/ui/e2e/README.md
index be7162bfc..5b26f5414 100644
--- a/packages/ui/e2e/README.md
+++ b/packages/ui/e2e/README.md
@@ -20,14 +20,14 @@ Unit/integration coverage (~1130 tests, no Docker required):
 Collected by `testMatch: '*.pw.ts'`. Run via `bun run ui:test:e2e:mocked`.
 Must pass with no live stack and no host-side env vars — `playwright.config.ts`
 points the preview webServer at a throwaway `mkdtemp` OP_HOME with a fixed
-`OP_UI_LOGIN_PASSWORD` and `OP_ENABLE_ADMIN=1` so `/admin/*` and the auth
+`OP_UI_LOGIN_PASSWORD` and `OP_ENABLE_ADMIN=1` so `/host` + `/api/host/*` and the auth
 routes are reachable without Docker or a real install. Routes under test
 either never reach the docker layer (auth checks run first) or degrade
 gracefully when docker/compose files are absent.
 
 | File | What it covers |
 |------|---------------|
-| `auth-flow.pw.ts` | login → protected read → logout → protected read is 401 again; wrong password rejected; a mutating `/admin/containers/*` endpoint's auth gate (no-auth / forged-cookie → 401) |
+| `auth-flow.pw.ts` | login → protected read → logout → protected read is 401 again; wrong password rejected; a mutating `/api/host/containers/*` endpoint's auth gate (no-auth / forged-cookie → 401) |
 | `setup-guard.pw.ts` | `GET /` redirects a fresh not-yet-installed instance away from raw admin content; `/setup` is reachable unauthenticated from localhost; the wizard renders its System Check step |
 
 These do NOT progress past System Check or exercise a real container
@@ -44,7 +44,7 @@ Current stack tests:
 
 | File | What it covers |
 |------|---------------|
-| `admin-health.stack.ts` | `/admin/health` auth + `/admin/providers` with live assistant + guardian liveness via proxy |
+| `admin-health.stack.ts` | `/api/host/health` auth + `/api/host/providers` with live assistant + guardian liveness via proxy |
 | `opencode-ui.stack.ts` | OpenCode web UI reachability on assistant port |
 | `setup-wizard-api.stack.ts` | Full wizard API contract: reset → system-check → POST /complete → deploy poll |
 | `setup-wizard-browser.stack.ts` | Wizard browser rendering: System Check step loads, Continue works |
diff --git a/packages/ui/e2e/admin-health.stack.ts b/packages/ui/e2e/admin-health.stack.ts
index 35422bd8a..def5628e0 100644
--- a/packages/ui/e2e/admin-health.stack.ts
+++ b/packages/ui/e2e/admin-health.stack.ts
@@ -5,8 +5,8 @@
  * Run via: ./scripts/dev-e2e-test.sh --skip-build --playwright
  *
  * Validates:
- * - GET /admin/health: session probe (auth gate, assistant reachability)
- * - GET /admin/providers: Connections tab availability with running assistant
+ * - GET /api/host/health: session probe (auth gate, assistant reachability)
+ * - GET /api/host/providers: Connections tab availability with running assistant
  */
 
 import { expect, test } from '@playwright/test';
@@ -33,29 +33,29 @@ const SKIP = !process.env.RUN_DOCKER_STACK_TESTS;
 test.describe('Admin Health Endpoint', () => {
   test.skip(!!SKIP, 'Requires RUN_DOCKER_STACK_TESTS=1 and running compose stack');
 
-  test('GET /admin/health returns 401 without auth', async ({ request }) => {
-    const res = await request.get(`${ADMIN_URL}/admin/health`, {
+  test('GET /api/host/health returns 401 without auth', async ({ request }) => {
+    const res = await request.get(`${ADMIN_URL}/api/host/health`, {
       headers: { 'x-request-id': crypto.randomUUID() },
     });
     expect(res.status()).toBe(401);
   });
 
-  test('GET /admin/health returns 200 with valid token', async ({ request }) => {
-    const res = await request.get(`${ADMIN_URL}/admin/health`, { headers: headers() });
+  test('GET /api/host/health returns 200 with valid token', async ({ request }) => {
+    const res = await request.get(`${ADMIN_URL}/api/host/health`, { headers: headers() });
     expect(res.ok()).toBeTruthy();
     const body = await res.json();
     expect(body.ok).toBe(true);
   });
 
-  test('GET /admin/health includes opencode availability flag', async ({ request }) => {
-    const res = await request.get(`${ADMIN_URL}/admin/health`, { headers: headers() });
+  test('GET /api/host/health includes opencode availability flag', async ({ request }) => {
+    const res = await request.get(`${ADMIN_URL}/api/host/health`, { headers: headers() });
     expect(res.ok()).toBeTruthy();
     const body = await res.json();
     expect(typeof body.opencode).toBe('boolean');
   });
 
-  test('GET /admin/health reports opencode reachable when assistant is running', async ({ request }) => {
-    const res = await request.get(`${ADMIN_URL}/admin/health`, { headers: headers() });
+  test('GET /api/host/health reports opencode reachable when assistant is running', async ({ request }) => {
+    const res = await request.get(`${ADMIN_URL}/api/host/health`, { headers: headers() });
     expect(res.ok()).toBeTruthy();
     const body = await res.json();
     // Assistant container is running — opencode should be true
@@ -66,31 +66,31 @@ test.describe('Admin Health Endpoint', () => {
 test.describe('Connections Tab — Providers', () => {
   test.skip(!!SKIP, 'Requires RUN_DOCKER_STACK_TESTS=1 and running compose stack');
 
-  test('GET /admin/providers returns 401 without auth', async ({ request }) => {
-    const res = await request.get(`${ADMIN_URL}/admin/providers`, {
+  test('GET /api/host/providers returns 401 without auth', async ({ request }) => {
+    const res = await request.get(`${ADMIN_URL}/api/host/providers`, {
       headers: { 'x-request-id': crypto.randomUUID() },
     });
     expect(res.status()).toBe(401);
   });
 
-  test('GET /admin/providers returns available:true when assistant is running', async ({ request }) => {
-    const res = await request.get(`${ADMIN_URL}/admin/providers`, { headers: headers() });
+  test('GET /api/host/providers returns available:true when assistant is running', async ({ request }) => {
+    const res = await request.get(`${ADMIN_URL}/api/host/providers`, { headers: headers() });
     expect(res.ok()).toBeTruthy();
     const body = await res.json();
     // Assistant is running so providers page should be available
     expect(body.available).toBe(true);
   });
 
-  test('GET /admin/providers returns providers array', async ({ request }) => {
-    const res = await request.get(`${ADMIN_URL}/admin/providers`, { headers: headers() });
+  test('GET /api/host/providers returns providers array', async ({ request }) => {
+    const res = await request.get(`${ADMIN_URL}/api/host/providers`, { headers: headers() });
     expect(res.ok()).toBeTruthy();
     const body = await res.json();
     expect(Array.isArray(body.providers)).toBe(true);
     expect(body.providers.length).toBeGreaterThan(0);
   });
 
-  test('GET /admin/providers includes stats', async ({ request }) => {
-    const res = await request.get(`${ADMIN_URL}/admin/providers`, { headers: headers() });
+  test('GET /api/host/providers includes stats', async ({ request }) => {
+    const res = await request.get(`${ADMIN_URL}/api/host/providers`, { headers: headers() });
     const body = await res.json();
     expect(typeof body.stats?.total).toBe('number');
     expect(typeof body.stats?.connected).toBe('number');
@@ -118,10 +118,10 @@ test.describe('Guardian liveness', () => {
     expect(body.status ?? body.ok).toBeTruthy();
   });
 
-  test('GET /admin/health includes opencode field (guardian has no separate health field)', async ({ request }) => {
+  test('GET /api/host/health includes opencode field (guardian has no separate health field)', async ({ request }) => {
     // Admin health covers the OpenCode assistant. Guardian liveness is separate
     // (proxied above). Verify the admin health response shape hasn't regressed.
-    const res = await request.get(`${ADMIN_URL}/admin/health`, { headers: headers() });
+    const res = await request.get(`${ADMIN_URL}/api/host/health`, { headers: headers() });
     expect(res.ok()).toBeTruthy();
     const body = await res.json();
     expect(body.ok).toBe(true);
diff --git a/packages/ui/e2e/akm-config.manual.ts b/packages/ui/e2e/akm-config.manual.ts
index 816d87e6a..cfc958452 100644
--- a/packages/ui/e2e/akm-config.manual.ts
+++ b/packages/ui/e2e/akm-config.manual.ts
@@ -4,7 +4,7 @@
  * Renamed from `.pw.ts` to `.manual.ts`. Requires a live dev stack +
  * standalone UI listening on ADMIN_URL. See e2e/README.md.
  *
- * Tests the /admin/akm GET and PATCH routes end-to-end:
+ * Tests the /api/host/akm GET and PATCH routes end-to-end:
  * - Auth enforcement
  * - Config read (GET returns current state)
  * - Config write (PATCH updates fields and persists to OP_HOME/config/akm/config.json)
@@ -54,15 +54,15 @@ test.describe("AKM Config API", () => {
 
   // ── Auth ───────────────────────────────────────────────────────────────────
 
-  test("GET /admin/akm requires auth", async ({ request }) => {
-    const res = await request.get(`${ADMIN_URL}/admin/akm`, {
+  test("GET /api/host/akm requires auth", async ({ request }) => {
+    const res = await request.get(`${ADMIN_URL}/api/host/akm`, {
       headers: { "x-request-id": crypto.randomUUID() },
     });
     expect(res.status()).toBe(401);
   });
 
-  test("PATCH /admin/akm requires auth", async ({ request }) => {
-    const res = await request.patch(`${ADMIN_URL}/admin/akm`, {
+  test("PATCH /api/host/akm requires auth", async ({ request }) => {
+    const res = await request.patch(`${ADMIN_URL}/api/host/akm`, {
       headers: { "x-request-id": crypto.randomUUID(), "content-type": "application/json" },
       data: { semanticSearchMode: "off" },
     });
@@ -71,16 +71,16 @@ test.describe("AKM Config API", () => {
 
   // ── GET ─────────────────────────────────────────────────────────────────────
 
-  test("GET /admin/akm returns config object", async ({ request }) => {
-    const res = await request.get(`${ADMIN_URL}/admin/akm`, { headers: adminHeaders() });
+  test("GET /api/host/akm returns config object", async ({ request }) => {
+    const res = await request.get(`${ADMIN_URL}/api/host/akm`, { headers: adminHeaders() });
     expect(res.ok()).toBeTruthy();
     const body = await res.json() as Record<string, unknown>;
     expect(body).toHaveProperty("config");
     expect(typeof body.config).toBe("object");
   });
 
-  test("GET /admin/akm config matches disk file", async ({ request }) => {
-    const res = await request.get(`${ADMIN_URL}/admin/akm`, { headers: adminHeaders() });
+  test("GET /api/host/akm config matches disk file", async ({ request }) => {
+    const res = await request.get(`${ADMIN_URL}/api/host/akm`, { headers: adminHeaders() });
     expect(res.ok()).toBeTruthy();
     const body = await res.json() as { config: Record<string, unknown> };
     const onDisk = readConfigFile();
@@ -99,7 +99,7 @@ test.describe("AKM Config API", () => {
     const before = readConfigFile().semanticSearchMode;
     const newMode = before === "off" ? "auto" : "off";
 
-    const res = await request.patch(`${ADMIN_URL}/admin/akm`, {
+    const res = await request.patch(`${ADMIN_URL}/api/host/akm`, {
       headers: adminHeaders(),
       data: { semanticSearchMode: newMode },
     });
@@ -112,14 +112,14 @@ test.describe("AKM Config API", () => {
     expect(onDisk.semanticSearchMode).toBe(newMode);
 
     // Restore
-    await request.patch(`${ADMIN_URL}/admin/akm`, {
+    await request.patch(`${ADMIN_URL}/api/host/akm`, {
       headers: adminHeaders(),
       data: { semanticSearchMode: before ?? "auto" },
     });
   });
 
   test("PATCH updates archiveRetentionDays and persists to disk", async ({ request }) => {
-    const res = await request.patch(`${ADMIN_URL}/admin/akm`, {
+    const res = await request.patch(`${ADMIN_URL}/api/host/akm`, {
       headers: adminHeaders(),
       data: { archiveRetentionDays: 45 },
     });
@@ -130,7 +130,7 @@ test.describe("AKM Config API", () => {
   });
 
   test("PATCH updates output.format and output.detail", async ({ request }) => {
-    const res = await request.patch(`${ADMIN_URL}/admin/akm`, {
+    const res = await request.patch(`${ADMIN_URL}/api/host/akm`, {
       headers: adminHeaders(),
       data: { output: { format: "yaml", detail: "full" } },
     });
@@ -142,21 +142,21 @@ test.describe("AKM Config API", () => {
     expect(output.detail).toBe("full");
 
     // Restore
-    await request.patch(`${ADMIN_URL}/admin/akm`, {
+    await request.patch(`${ADMIN_URL}/api/host/akm`, {
       headers: adminHeaders(),
       data: { output: { format: "json", detail: "brief" } },
     });
   });
 
   test("PATCH updates stashInheritance", async ({ request }) => {
-    const res = await request.patch(`${ADMIN_URL}/admin/akm`, {
+    const res = await request.patch(`${ADMIN_URL}/api/host/akm`, {
       headers: adminHeaders(),
       data: { stashInheritance: "replace" },
     });
     expect(res.ok()).toBeTruthy();
     expect((readConfigFile()).stashInheritance).toBe("replace");
 
-    await request.patch(`${ADMIN_URL}/admin/akm`, {
+    await request.patch(`${ADMIN_URL}/api/host/akm`, {
       headers: adminHeaders(),
       data: { stashInheritance: "merge" },
     });
@@ -166,13 +166,13 @@ test.describe("AKM Config API", () => {
 
   test("PATCH preserves unrelated fields when updating one field", async ({ request }) => {
     // Set a known value for embedding first
-    await request.patch(`${ADMIN_URL}/admin/akm`, {
+    await request.patch(`${ADMIN_URL}/api/host/akm`, {
       headers: adminHeaders(),
       data: { embedding: { endpoint: "https://api.openai.com/v1/embeddings", model: "text-embedding-3-small", dimension: 1536 } },
     });
 
     // Now PATCH only semanticSearchMode
-    await request.patch(`${ADMIN_URL}/admin/akm`, {
+    await request.patch(`${ADMIN_URL}/api/host/akm`, {
       headers: adminHeaders(),
       data: { semanticSearchMode: "auto" },
     });
@@ -189,7 +189,7 @@ test.describe("AKM Config API", () => {
 
   test("PATCH writes LLM profile to profiles.llm", async ({ request }) => {
     const profileName = "test-e2e-profile";
-    const res = await request.patch(`${ADMIN_URL}/admin/akm`, {
+    const res = await request.patch(`${ADMIN_URL}/api/host/akm`, {
       headers: adminHeaders(),
       data: {
         profiles: {
@@ -216,14 +216,14 @@ test.describe("AKM Config API", () => {
     expect(profile.temperature).toBe(0.5);
 
     // Cleanup
-    await request.patch(`${ADMIN_URL}/admin/akm`, {
+    await request.patch(`${ADMIN_URL}/api/host/akm`, {
       headers: adminHeaders(),
       data: { profiles: { llm: {}, agent: {} } },
     });
   });
 
   test("PATCH supports multiple LLM profiles simultaneously", async ({ request }) => {
-    const res = await request.patch(`${ADMIN_URL}/admin/akm`, {
+    const res = await request.patch(`${ADMIN_URL}/api/host/akm`, {
       headers: adminHeaders(),
       data: {
         profiles: {
@@ -245,7 +245,7 @@ test.describe("AKM Config API", () => {
   });
 
   test("PATCH writes agent profile with platform", async ({ request }) => {
-    const res = await request.patch(`${ADMIN_URL}/admin/akm`, {
+    const res = await request.patch(`${ADMIN_URL}/api/host/akm`, {
       headers: adminHeaders(),
       data: {
         profiles: {
@@ -264,7 +264,7 @@ test.describe("AKM Config API", () => {
     expect((agentProfiles["test-agent"] as Record<string, unknown>).platform).toBe("opencode");
 
     // Cleanup
-    await request.patch(`${ADMIN_URL}/admin/akm`, {
+    await request.patch(`${ADMIN_URL}/api/host/akm`, {
       headers: adminHeaders(),
       data: { profiles: { llm: {}, agent: {} } },
     });
@@ -273,7 +273,7 @@ test.describe("AKM Config API", () => {
   // ── Features tree ───────────────────────────────────────────────────────────
 
   test("PATCH writes features.improve operation as boolean", async ({ request }) => {
-    const res = await request.patch(`${ADMIN_URL}/admin/akm`, {
+    const res = await request.patch(`${ADMIN_URL}/api/host/akm`, {
       headers: adminHeaders(),
       data: {
         features: {
@@ -290,7 +290,7 @@ test.describe("AKM Config API", () => {
   });
 
   test("PATCH writes features.improve operation as ProcessEntry with mode", async ({ request }) => {
-    const res = await request.patch(`${ADMIN_URL}/admin/akm`, {
+    const res = await request.patch(`${ADMIN_URL}/api/host/akm`, {
       headers: adminHeaders(),
       data: {
         features: {
@@ -310,7 +310,7 @@ test.describe("AKM Config API", () => {
   });
 
   test("PATCH writes all three features sections", async ({ request }) => {
-    const res = await request.patch(`${ADMIN_URL}/admin/akm`, {
+    const res = await request.patch(`${ADMIN_URL}/api/host/akm`, {
       headers: adminHeaders(),
       data: {
         features: {
@@ -331,13 +331,13 @@ test.describe("AKM Config API", () => {
 
   test("PATCH features merge preserves sibling operations", async ({ request }) => {
     // Set two operations
-    await request.patch(`${ADMIN_URL}/admin/akm`, {
+    await request.patch(`${ADMIN_URL}/api/host/akm`, {
       headers: adminHeaders(),
       data: { features: { improve: { reflect: true, distill: true } } },
     });
 
     // Update only one
-    await request.patch(`${ADMIN_URL}/admin/akm`, {
+    await request.patch(`${ADMIN_URL}/api/host/akm`, {
       headers: adminHeaders(),
       data: { features: { improve: { distill: false } } },
     });
@@ -351,7 +351,7 @@ test.describe("AKM Config API", () => {
   // ── Reflect cooldowns ───────────────────────────────────────────────────────
 
   test("PATCH writes reflectCooldownByType for specific asset types", async ({ request }) => {
-    const res = await request.patch(`${ADMIN_URL}/admin/akm`, {
+    const res = await request.patch(`${ADMIN_URL}/api/host/akm`, {
       headers: adminHeaders(),
       data: {
         improve: {
@@ -369,7 +369,7 @@ test.describe("AKM Config API", () => {
   });
 
   test("PATCH utilityDecay values persist to disk", async ({ request }) => {
-    const res = await request.patch(`${ADMIN_URL}/admin/akm`, {
+    const res = await request.patch(`${ADMIN_URL}/api/host/akm`, {
       headers: adminHeaders(),
       data: {
         improve: {
@@ -385,7 +385,7 @@ test.describe("AKM Config API", () => {
     expect(decay.feedbackStabilityBoost).toBe(2.0);
 
     // Restore
-    await request.patch(`${ADMIN_URL}/admin/akm`, {
+    await request.patch(`${ADMIN_URL}/api/host/akm`, {
       headers: adminHeaders(),
       data: { improve: { utilityDecay: { halfLifeDays: 30, feedbackStabilityBoost: 1.5 } } },
     });
@@ -394,7 +394,7 @@ test.describe("AKM Config API", () => {
   // ── Embedding ───────────────────────────────────────────────────────────────
 
   test("PATCH updates embedding connection and persists all fields", async ({ request }) => {
-    const res = await request.patch(`${ADMIN_URL}/admin/akm`, {
+    const res = await request.patch(`${ADMIN_URL}/api/host/akm`, {
       headers: adminHeaders(),
       data: {
         embedding: {
@@ -415,7 +415,7 @@ test.describe("AKM Config API", () => {
     expect(emb.dimension).toBe(768);
 
     // Restore original
-    await request.patch(`${ADMIN_URL}/admin/akm`, {
+    await request.patch(`${ADMIN_URL}/api/host/akm`, {
       headers: adminHeaders(),
       data: {
         embedding: {
@@ -431,7 +431,7 @@ test.describe("AKM Config API", () => {
   // ── Search ──────────────────────────────────────────────────────────────────
 
   test("PATCH updates search.minScore and graphBoost settings", async ({ request }) => {
-    const res = await request.patch(`${ADMIN_URL}/admin/akm`, {
+    const res = await request.patch(`${ADMIN_URL}/api/host/akm`, {
       headers: adminHeaders(),
       data: {
         search: {
@@ -458,14 +458,14 @@ test.describe("AKM Config API", () => {
   // ── Feedback ────────────────────────────────────────────────────────────────
 
   test("PATCH updates feedback.requireReason", async ({ request }) => {
-    const res = await request.patch(`${ADMIN_URL}/admin/akm`, {
+    const res = await request.patch(`${ADMIN_URL}/api/host/akm`, {
       headers: adminHeaders(),
       data: { feedback: { requireReason: false } },
     });
     expect(res.ok()).toBeTruthy();
     expect((readConfigFile().feedback as Record<string, unknown>).requireReason).toBe(false);
 
-    await request.patch(`${ADMIN_URL}/admin/akm`, {
+    await request.patch(`${ADMIN_URL}/api/host/akm`, {
       headers: adminHeaders(),
       data: { feedback: { requireReason: true } },
     });
@@ -473,7 +473,7 @@ test.describe("AKM Config API", () => {
 
   test("PATCH updates feedback.allowedFailureModes", async ({ request }) => {
     const modes = ["incorrect", "outdated", "custom-mode"];
-    const res = await request.patch(`${ADMIN_URL}/admin/akm`, {
+    const res = await request.patch(`${ADMIN_URL}/api/host/akm`, {
       headers: adminHeaders(),
       data: { feedback: { allowedFailureModes: modes } },
     });
@@ -487,7 +487,7 @@ test.describe("AKM Config API", () => {
   // ── Defaults ────────────────────────────────────────────────────────────────
 
   test("PATCH updates defaults.improve.limit and preset", async ({ request }) => {
-    const res = await request.patch(`${ADMIN_URL}/admin/akm`, {
+    const res = await request.patch(`${ADMIN_URL}/api/host/akm`, {
       headers: adminHeaders(),
       data: { defaults: { improve: { limit: 50, preset: "thorough" } } },
     });
@@ -499,7 +499,7 @@ test.describe("AKM Config API", () => {
     expect(improve.preset).toBe("thorough");
 
     // Restore
-    await request.patch(`${ADMIN_URL}/admin/akm`, {
+    await request.patch(`${ADMIN_URL}/api/host/akm`, {
       headers: adminHeaders(),
       data: { defaults: { improve: { limit: 25, preset: "custom" } } },
     });
@@ -508,7 +508,7 @@ test.describe("AKM Config API", () => {
   // ── Validation ──────────────────────────────────────────────────────────────
 
   test("PATCH rejects invalid semanticSearchMode", async ({ request }) => {
-    const res = await request.patch(`${ADMIN_URL}/admin/akm`, {
+    const res = await request.patch(`${ADMIN_URL}/api/host/akm`, {
       headers: adminHeaders(),
       data: { semanticSearchMode: "invalid-mode" },
     });
@@ -516,7 +516,7 @@ test.describe("AKM Config API", () => {
   });
 
   test("PATCH rejects invalid output.format", async ({ request }) => {
-    const res = await request.patch(`${ADMIN_URL}/admin/akm`, {
+    const res = await request.patch(`${ADMIN_URL}/api/host/akm`, {
       headers: adminHeaders(),
       data: { output: { format: "xml" } },
     });
@@ -524,7 +524,7 @@ test.describe("AKM Config API", () => {
   });
 
   test("PATCH rejects invalid output.detail", async ({ request }) => {
-    const res = await request.patch(`${ADMIN_URL}/admin/akm`, {
+    const res = await request.patch(`${ADMIN_URL}/api/host/akm`, {
       headers: adminHeaders(),
       data: { output: { detail: "verbose" } },
     });
@@ -532,7 +532,7 @@ test.describe("AKM Config API", () => {
   });
 
   test("PATCH rejects negative archiveRetentionDays", async ({ request }) => {
-    const res = await request.patch(`${ADMIN_URL}/admin/akm`, {
+    const res = await request.patch(`${ADMIN_URL}/api/host/akm`, {
       headers: adminHeaders(),
       data: { archiveRetentionDays: -1 },
     });
@@ -540,7 +540,7 @@ test.describe("AKM Config API", () => {
   });
 
   test("PATCH rejects invalid stashInheritance", async ({ request }) => {
-    const res = await request.patch(`${ADMIN_URL}/admin/akm`, {
+    const res = await request.patch(`${ADMIN_URL}/api/host/akm`, {
       headers: adminHeaders(),
       data: { stashInheritance: "override" },
     });
@@ -548,7 +548,7 @@ test.describe("AKM Config API", () => {
   });
 
   test("PATCH rejects invalid agent profile platform", async ({ request }) => {
-    const res = await request.patch(`${ADMIN_URL}/admin/akm`, {
+    const res = await request.patch(`${ADMIN_URL}/api/host/akm`, {
       headers: adminHeaders(),
       data: {
         profiles: { llm: {}, agent: { "bad-agent": { platform: "chatgpt" } } },
@@ -558,7 +558,7 @@ test.describe("AKM Config API", () => {
   });
 
   test("PATCH rejects invalid feature mode", async ({ request }) => {
-    const res = await request.patch(`${ADMIN_URL}/admin/akm`, {
+    const res = await request.patch(`${ADMIN_URL}/api/host/akm`, {
       headers: adminHeaders(),
       data: {
         features: { improve: { reflect: { enabled: true, mode: "http" } } },
@@ -568,7 +568,7 @@ test.describe("AKM Config API", () => {
   });
 
   test("PATCH rejects negative cooldown values", async ({ request }) => {
-    const res = await request.patch(`${ADMIN_URL}/admin/akm`, {
+    const res = await request.patch(`${ADMIN_URL}/api/host/akm`, {
       headers: adminHeaders(),
       data: { improve: { reflectCooldownByType: { memory: -1 } } },
     });
@@ -576,7 +576,7 @@ test.describe("AKM Config API", () => {
   });
 
   test("PATCH rejects invalid LLM profile temperature out of range", async ({ request }) => {
-    const res = await request.patch(`${ADMIN_URL}/admin/akm`, {
+    const res = await request.patch(`${ADMIN_URL}/api/host/akm`, {
       headers: adminHeaders(),
       data: {
         profiles: {
@@ -589,7 +589,7 @@ test.describe("AKM Config API", () => {
   });
 
   test("PATCH rejects non-integer search.graphBoost.maxHops", async ({ request }) => {
-    const res = await request.patch(`${ADMIN_URL}/admin/akm`, {
+    const res = await request.patch(`${ADMIN_URL}/api/host/akm`, {
       headers: adminHeaders(),
       data: { search: { graphBoost: { maxHops: 1.5 } } },
     });
@@ -598,7 +598,7 @@ test.describe("AKM Config API", () => {
   });
 
   test("PATCH rejects utilityDecay.halfLifeDays < 0.1", async ({ request }) => {
-    const res = await request.patch(`${ADMIN_URL}/admin/akm`, {
+    const res = await request.patch(`${ADMIN_URL}/api/host/akm`, {
       headers: adminHeaders(),
       data: { improve: { utilityDecay: { halfLifeDays: 0.05 } } },
     });
diff --git a/packages/ui/e2e/auth-boundary.stack.ts b/packages/ui/e2e/auth-boundary.stack.ts
index ea1362467..a470bbf60 100644
--- a/packages/ui/e2e/auth-boundary.stack.ts
+++ b/packages/ui/e2e/auth-boundary.stack.ts
@@ -42,11 +42,11 @@ function noAuth(): Record<string, string> {
 
 // Endpoints that must be gated by admin auth (GET unless noted)
 const PROTECTED_ENDPOINTS = [
-  '/admin/health',
-  '/admin/providers',
-  '/admin/secrets/user-env',
-  '/admin/containers/list',
-  '/admin/automations',
+  '/api/host/health',
+  '/api/host/providers',
+  '/api/host/secrets/user-env',
+  '/api/host/containers/list',
+  '/api/host/automations',
 ];
 
 test.describe('Auth boundary — protected endpoints', () => {
@@ -78,24 +78,24 @@ test.describe('Auth boundary — write endpoints', () => {
   test.skip(!!SKIP, 'Requires RUN_DOCKER_STACK_TESTS=1 and running compose stack');
   test.setTimeout(30_000);
 
-  test('POST /admin/secrets/user-env returns 401 without auth', async ({ request }) => {
-    const res = await request.post(`${ADMIN_URL}/admin/secrets/user-env`, {
+  test('POST /api/host/secrets/user-env returns 401 without auth', async ({ request }) => {
+    const res = await request.post(`${ADMIN_URL}/api/host/secrets/user-env`, {
       headers: { ...noAuth(), 'content-type': 'application/json' },
       data: { key: 'E2E_TEST', value: 'test' },
     });
     expect(res.status()).toBe(401);
   });
 
-  test('POST /admin/secrets/user-env returns 401 with wrong cookie', async ({ request }) => {
-    const res = await request.post(`${ADMIN_URL}/admin/secrets/user-env`, {
+  test('POST /api/host/secrets/user-env returns 401 with wrong cookie', async ({ request }) => {
+    const res = await request.post(`${ADMIN_URL}/api/host/secrets/user-env`, {
       headers: { ...wrongCookie(), 'content-type': 'application/json' },
       data: { key: 'E2E_TEST', value: 'test' },
     });
     expect(res.status()).toBe(401);
   });
 
-  test('DELETE /admin/secrets/user-env returns 401 without auth', async ({ request }) => {
-    const res = await request.delete(`${ADMIN_URL}/admin/secrets/user-env?key=E2E_TEST`, {
+  test('DELETE /api/host/secrets/user-env returns 401 without auth', async ({ request }) => {
+    const res = await request.delete(`${ADMIN_URL}/api/host/secrets/user-env?key=E2E_TEST`, {
       headers: noAuth(),
     });
     expect(res.status()).toBe(401);
diff --git a/packages/ui/e2e/auth-flow.pw.ts b/packages/ui/e2e/auth-flow.pw.ts
index 185037527..882d24c7c 100644
--- a/packages/ui/e2e/auth-flow.pw.ts
+++ b/packages/ui/e2e/auth-flow.pw.ts
@@ -13,7 +13,7 @@
  *   - login → session cookie authorizes a protected read endpoint → logout
  *     revokes it
  *   - wrong password is rejected
- *   - a mutating /admin/containers/* endpoint enforces the same auth gate
+ *   - a mutating /api/host/containers/* endpoint enforces the same auth gate
  *     (no auth / wrong cookie → 401), without ever touching Docker
  */
 import { test, expect } from '@playwright/test';
@@ -22,7 +22,7 @@ const PASSWORD = 'e2e-mocked-password'; // must match playwright.config.ts's MOC
 
 test.describe('Auth flow — login / session / logout (mocked-lib)', () => {
   test('wrong password is rejected with 401 and no cookie', async ({ request }) => {
-    const res = await request.post('/admin/auth/login', {
+    const res = await request.post('/api/auth/login', {
       data: { password: 'definitely-wrong' },
     });
     expect(res.status()).toBe(401);
@@ -30,13 +30,13 @@ test.describe('Auth flow — login / session / logout (mocked-lib)', () => {
   });
 
   test('missing password body returns 400', async ({ request }) => {
-    const res = await request.post('/admin/auth/login', { data: {} });
+    const res = await request.post('/api/auth/login', { data: {} });
     expect(res.status()).toBe(400);
   });
 
   test('login → protected read → logout → protected read is 401 again', async ({ request }) => {
     // 1. Login with the correct password issues the op_session cookie.
-    const loginRes = await request.post('/admin/auth/login', {
+    const loginRes = await request.post('/api/auth/login', {
       data: { password: PASSWORD },
     });
     expect(loginRes.status()).toBe(200);
@@ -46,30 +46,30 @@ test.describe('Auth flow — login / session / logout (mocked-lib)', () => {
     // Playwright's `request` context is cookie-jar-aware per test — the
     // Set-Cookie from step 1 is automatically sent on subsequent requests
     // made with the same `request` fixture.
-    const listRes = await request.get('/admin/containers/list');
+    const listRes = await request.get('/api/host/containers/list');
     expect(listRes.status()).not.toBe(401);
     expect(listRes.status()).toBeLessThan(500);
 
     // 2. Logout revokes the session.
-    const logoutRes = await request.post('/admin/auth/logout');
+    const logoutRes = await request.post('/api/auth/logout');
     expect(logoutRes.status()).toBe(200);
 
     // 3. The same cookie jar's now-revoked session must be rejected.
-    const afterLogout = await request.get('/admin/containers/list');
+    const afterLogout = await request.get('/api/host/containers/list');
     expect(afterLogout.status()).toBe(401);
   });
 });
 
 test.describe('Auth flow — mutating containers/* endpoint enforces auth (mocked-lib)', () => {
-  test('POST /admin/containers/up returns 401 with no auth', async ({ request }) => {
-    const res = await request.post('/admin/containers/up', {
+  test('POST /api/host/containers/up returns 401 with no auth', async ({ request }) => {
+    const res = await request.post('/api/host/containers/up', {
       data: { service: 'assistant' },
     });
     expect(res.status()).toBe(401);
   });
 
-  test('POST /admin/containers/up returns 401 with a forged cookie', async ({ request }) => {
-    const res = await request.post('/admin/containers/up', {
+  test('POST /api/host/containers/up returns 401 with a forged cookie', async ({ request }) => {
+    const res = await request.post('/api/host/containers/up', {
       headers: { cookie: 'op_session=forged-token-not-real' },
       data: { service: 'assistant' },
     });
diff --git a/packages/ui/e2e/scheduler.manual.ts b/packages/ui/e2e/scheduler.manual.ts
index d3fa842f5..57cde8fec 100644
--- a/packages/ui/e2e/scheduler.manual.ts
+++ b/packages/ui/e2e/scheduler.manual.ts
@@ -7,9 +7,9 @@
  * The scheduler runs as a co-process inside the assistant container and has
  * no HTTP API. All control flows through the admin API onto the filesystem:
  *
- *   GET  /admin/automations                — list automations (loadAutomations)
- *   POST /admin/automations/:name/run      — runs akm tasks run <name> directly
- *   GET  /admin/automations/:name/log      — reads from data/akm/cache/tasks/logs/<name>/
+ *   GET  /api/host/automations                — list automations (loadAutomations)
+ *   POST /api/host/automations/:name/run      — runs akm tasks run <name> directly
+ *   GET  /api/host/automations/:name/log      — reads from data/akm/cache/tasks/logs/<name>/
  *
  * These tests hit the host admin process (default test port 9100) and
  * require a running stack and admin process.
@@ -36,8 +36,8 @@ test.describe("Automation Scheduler (file-based control plane)", () => {
   const SKIP = !process.env.RUN_DOCKER_STACK_TESTS;
   test.skip(!!SKIP, "Requires RUN_DOCKER_STACK_TESTS=1 and running compose stack");
 
-  test("GET /admin/automations returns valid structure", async ({ request }) => {
-    const response = await request.get(`${ADMIN_URL}/admin/automations`, {
+  test("GET /api/host/automations returns valid structure", async ({ request }) => {
+    const response = await request.get(`${ADMIN_URL}/api/host/automations`, {
       headers: adminHeaders(),
       timeout: 10_000,
     });
@@ -48,8 +48,8 @@ test.describe("Automation Scheduler (file-based control plane)", () => {
     expect(Array.isArray(data.automations)).toBe(true);
   });
 
-  test("GET /admin/automations requires auth", async ({ request }) => {
-    const response = await request.get(`${ADMIN_URL}/admin/automations`, {
+  test("GET /api/host/automations requires auth", async ({ request }) => {
+    const response = await request.get(`${ADMIN_URL}/api/host/automations`, {
       headers: { "x-request-id": crypto.randomUUID() },
       timeout: 10_000,
     });
@@ -57,7 +57,7 @@ test.describe("Automation Scheduler (file-based control plane)", () => {
   });
 
   test("automation entries have required fields", async ({ request }) => {
-    const response = await request.get(`${ADMIN_URL}/admin/automations`, {
+    const response = await request.get(`${ADMIN_URL}/api/host/automations`, {
       headers: adminHeaders(),
       timeout: 10_000,
     });
@@ -75,24 +75,24 @@ test.describe("Automation Scheduler (file-based control plane)", () => {
     }
   });
 
-  test("POST /admin/automations/:name/run rejects invalid names", async ({ request }) => {
-    const response = await request.post(`${ADMIN_URL}/admin/automations/..%2Fetc%2Fpasswd/run`, {
+  test("POST /api/host/automations/:name/run rejects invalid names", async ({ request }) => {
+    const response = await request.post(`${ADMIN_URL}/api/host/automations/..%2Fetc%2Fpasswd/run`, {
       headers: adminHeaders(),
       timeout: 10_000,
     });
     expect([400, 404]).toContain(response.status());
   });
 
-  test("POST /admin/automations/:name/run returns 404 for unknown automation", async ({ request }) => {
-    const response = await request.post(`${ADMIN_URL}/admin/automations/does-not-exist.yml/run`, {
+  test("POST /api/host/automations/:name/run returns 404 for unknown automation", async ({ request }) => {
+    const response = await request.post(`${ADMIN_URL}/api/host/automations/does-not-exist.yml/run`, {
       headers: adminHeaders(),
       timeout: 10_000,
     });
     expect(response.status()).toBe(404);
   });
 
-  test("POST /admin/automations/:name/run queues an existing automation", async ({ request }) => {
-    const list = await request.get(`${ADMIN_URL}/admin/automations`, {
+  test("POST /api/host/automations/:name/run queues an existing automation", async ({ request }) => {
+    const list = await request.get(`${ADMIN_URL}/api/host/automations`, {
       headers: adminHeaders(),
       timeout: 10_000,
     });
@@ -105,7 +105,7 @@ test.describe("Automation Scheduler (file-based control plane)", () => {
 
     const target = data.automations[0].fileName as string;
     const response = await request.post(
-      `${ADMIN_URL}/admin/automations/${encodeURIComponent(target)}/run`,
+      `${ADMIN_URL}/api/host/automations/${encodeURIComponent(target)}/run`,
       { headers: adminHeaders(), timeout: 10_000 },
     );
     expect(response.status()).toBe(202);
@@ -115,8 +115,8 @@ test.describe("Automation Scheduler (file-based control plane)", () => {
     expect(body.queued).toBe(true);
   });
 
-  test("GET /admin/automations/:name/log returns a structured response", async ({ request }) => {
-    const list = await request.get(`${ADMIN_URL}/admin/automations`, {
+  test("GET /api/host/automations/:name/log returns a structured response", async ({ request }) => {
+    const list = await request.get(`${ADMIN_URL}/api/host/automations`, {
       headers: adminHeaders(),
       timeout: 10_000,
     });
@@ -129,7 +129,7 @@ test.describe("Automation Scheduler (file-based control plane)", () => {
 
     const target = data.automations[0].fileName as string;
     const response = await request.get(
-      `${ADMIN_URL}/admin/automations/${encodeURIComponent(target)}/log?limit=10`,
+      `${ADMIN_URL}/api/host/automations/${encodeURIComponent(target)}/log?limit=10`,
       { headers: adminHeaders(), timeout: 10_000 },
     );
     expect(response.ok()).toBeTruthy();
diff --git a/packages/ui/e2e/secrets.stack.ts b/packages/ui/e2e/secrets.stack.ts
index 222f19db1..6a6c1a25f 100644
--- a/packages/ui/e2e/secrets.stack.ts
+++ b/packages/ui/e2e/secrets.stack.ts
@@ -4,7 +4,7 @@
  * Collected by Playwright when RUN_DOCKER_STACK_TESTS=1 (*.stack.ts pattern).
  * Run via: ./scripts/dev-e2e-test.sh --skip-build --playwright
  *
- * Tests the /admin/secrets/user-env API end-to-end:
+ * Tests the /api/host/secrets/user-env API end-to-end:
  *  - POST: write a test key
  *  - GET: verify key appears in the list (value is never returned)
  *  - DELETE: remove the key
@@ -22,7 +22,7 @@ const PASSWORD = process.env.OP_UI_LOGIN_PASSWORD ?? '';
 const SKIP = !process.env.RUN_DOCKER_STACK_TESTS;
 
 const TEST_KEY = 'E2E_SECRETS_TEST_KEY';
-const VAULT_URL = `${ADMIN_URL}/admin/secrets/user-env`;
+const VAULT_URL = `${ADMIN_URL}/api/host/secrets/user-env`;
 
 function headers(extra: Record<string, string> = {}): Record<string, string> {
   return {
@@ -43,7 +43,7 @@ test.describe('Secrets CRUD', () => {
     await request.delete(`${VAULT_URL}?key=${TEST_KEY}`, { headers: headers() }).catch(() => {});
   });
 
-  test('GET /admin/secrets/user-env returns env metadata', async ({ request }) => {
+  test('GET /api/host/secrets/user-env returns env metadata', async ({ request }) => {
     const res = await request.get(VAULT_URL, { headers: headers() });
     expect(res.ok()).toBeTruthy();
     const body = await res.json();
diff --git a/packages/ui/e2e/ux-audit.config.json b/packages/ui/e2e/ux-audit.config.json
index dfdd116e0..b78f968e5 100644
--- a/packages/ui/e2e/ux-audit.config.json
+++ b/packages/ui/e2e/ux-audit.config.json
@@ -18,34 +18,34 @@
       "path": "/chat",
       "waitFor": "header.navbar"
     },
-    { "id": "admin-overview", "path": "/admin", "waitFor": "header.navbar" },
+    { "id": "admin-overview", "path": "/host", "waitFor": "header.navbar" },
     {
       "id": "admin-providers",
-      "path": "/admin",
+      "path": "/host",
       "waitFor": "header.navbar",
       "setup": "(async () => { const f = (l) => Array.from(document.querySelectorAll('[role=\"tab\"]')).find(b => b.textContent.trim() === l); f('Mind')?.click(); await new Promise(r => setTimeout(r, 300)); })()"
     },
     {
       "id": "admin-knowledge",
-      "path": "/admin",
+      "path": "/host",
       "waitFor": "header.navbar",
       "setup": "(async () => { const f = (l) => Array.from(document.querySelectorAll('[role=\"tab\"]')).find(b => b.textContent.trim() === l); f('Knowledge')?.click(); await new Promise(r => setTimeout(r, 300)); f('Memory')?.click(); await new Promise(r => setTimeout(r, 300)); })()"
     },
     {
       "id": "admin-voice",
-      "path": "/admin",
+      "path": "/host",
       "waitFor": "header.navbar",
       "setup": "(async () => { const f = (l) => Array.from(document.querySelectorAll('[role=\"tab\"]')).find(b => b.textContent.trim() === l); f('Voice')?.click(); await new Promise(r => setTimeout(r, 300)); })()"
     },
     {
       "id": "admin-secrets",
-      "path": "/admin",
+      "path": "/host",
       "waitFor": "header.navbar",
       "setup": "(async () => { const f = (l) => Array.from(document.querySelectorAll('[role=\"tab\"]')).find(b => b.textContent.trim() === l); f('Knowledge')?.click(); await new Promise(r => setTimeout(r, 300)); f('Secrets')?.click(); await new Promise(r => setTimeout(r, 300)); })()"
     },
     {
       "id": "admin-addons",
-      "path": "/admin",
+      "path": "/host",
       "waitFor": "header.navbar",
       "setup": "(async () => { const f = (l) => Array.from(document.querySelectorAll('[role=\"tab\"]')).find(b => b.textContent.trim() === l); f('Capabilities')?.click(); await new Promise(r => setTimeout(r, 300)); })()"
     }
diff --git a/packages/ui/e2e/voice.manual.ts b/packages/ui/e2e/voice.manual.ts
index d3e23407e..629f3a15f 100644
--- a/packages/ui/e2e/voice.manual.ts
+++ b/packages/ui/e2e/voice.manual.ts
@@ -10,7 +10,7 @@
  * ADMIN_URL. The route logic these checks cover (compose orchestration,
  * error translation, OP_TTS_* env resolution, /api/speak proxy behavior)
  * is already covered by the vitest suites in
- * src/routes/admin/voice/server.vitest.ts and
+ * src/routes/api/host/voice/server.vitest.ts and
  * src/routes/api/transcribe/server.vitest.ts with mocked docker. This
  * file is for pre-release smoke against the real stack.
  *
@@ -21,11 +21,11 @@
  * Validates the full happy-path of OpenPalm Voice (Kokoro TTS + Whisper STT
  * via the openpalm/voice container) plus error / edge paths:
  *
- *   - Auth gate on GET /admin/voice
- *   - POST /admin/auth/login (bad + good password)
- *   - GET /admin/voice returns the new addon.profiles[] annotation (id +
+ *   - Auth gate on GET /api/host/voice
+ *   - POST /api/auth/login (bad + good password)
+ *   - GET /api/host/voice returns the new addon.profiles[] annotation (id +
  *     available + reason)
- *   - PUT /admin/voice validation (missing baseURL, unknown profile id)
+ *   - PUT /api/host/voice validation (missing baseURL, unknown profile id)
  *   - PUT engine=browser stops the running voice container (auto-stop)
  *   - PUT engine=openpalm-voice + profile=addon.voice.cuda brings the container back up
  *   - POST /api/speak with text returns audio/wav
@@ -116,23 +116,23 @@ function ensureVoiceUp(): void {
 test.describe('Voice addon — auth gate', () => {
   test.skip(!!SKIP, 'Requires RUN_DOCKER_STACK_TESTS=1 and running compose stack');
 
-  test('GET /admin/voice unauthenticated → 401', async ({ request }) => {
-    const res = await request.get(`${ADMIN_URL}/admin/voice`, {
+  test('GET /api/host/voice unauthenticated → 401', async ({ request }) => {
+    const res = await request.get(`${ADMIN_URL}/api/host/voice`, {
       headers: { 'x-request-id': crypto.randomUUID() },
     });
     expect(res.status()).toBe(401);
   });
 
-  test('POST /admin/auth/login with wrong password → 401', async ({ request }) => {
-    const res = await request.post(`${ADMIN_URL}/admin/auth/login`, {
+  test('POST /api/auth/login with wrong password → 401', async ({ request }) => {
+    const res = await request.post(`${ADMIN_URL}/api/auth/login`, {
       data: { password: 'definitely-not-the-password' },
       headers: { 'content-type': 'application/json' },
     });
     expect(res.status()).toBe(401);
   });
 
-  test('POST /admin/auth/login with correct password → 200 + Set-Cookie op_session', async ({ request }) => {
-    const res = await request.post(`${ADMIN_URL}/admin/auth/login`, {
+  test('POST /api/auth/login with correct password → 200 + Set-Cookie op_session', async ({ request }) => {
+    const res = await request.post(`${ADMIN_URL}/api/auth/login`, {
       data: { password: OP_UI_LOGIN_PASSWORD },
       headers: { 'content-type': 'application/json' },
     });
@@ -142,11 +142,11 @@ test.describe('Voice addon — auth gate', () => {
   });
 });
 
-test.describe('Voice addon — GET /admin/voice response shape', () => {
+test.describe('Voice addon — GET /api/host/voice response shape', () => {
   test.skip(!!SKIP, 'Requires RUN_DOCKER_STACK_TESTS=1 and running compose stack');
 
   test('returns addon.profiles[] annotated with id/available/reason', async ({ request }) => {
-    const res = await request.get(`${ADMIN_URL}/admin/voice`, { headers: authHeaders() });
+    const res = await request.get(`${ADMIN_URL}/api/host/voice`, { headers: authHeaders() });
     expect(res.ok()).toBeTruthy();
     const body = await res.json();
 
@@ -176,7 +176,7 @@ test.describe('Voice addon — GET /admin/voice response shape', () => {
   });
 
   test('exposes selectedProfile (null or a known id)', async ({ request }) => {
-    const res = await request.get(`${ADMIN_URL}/admin/voice`, { headers: authHeaders() });
+    const res = await request.get(`${ADMIN_URL}/api/host/voice`, { headers: authHeaders() });
     const body = await res.json();
     const profileIds = body.addon.profiles.map((p: { id: string }) => p.id);
     expect(
@@ -190,7 +190,7 @@ test.describe('Voice addon — PUT validation', () => {
   test.skip(!!SKIP, 'Requires RUN_DOCKER_STACK_TESTS=1 and running compose stack');
 
   test('engine=remote without baseURL → 400 invalid_stt', async ({ request }) => {
-    const res = await request.put(`${ADMIN_URL}/admin/voice`, {
+    const res = await request.put(`${ADMIN_URL}/api/host/voice`, {
       headers: authHeaders(),
       data: { stt: { engine: 'remote', model: 'whisper-1' } },
     });
@@ -201,7 +201,7 @@ test.describe('Voice addon — PUT validation', () => {
   });
 
   test('unknown profile id → 400 invalid_profile with actionable list', async ({ request }) => {
-    const res = await request.put(`${ADMIN_URL}/admin/voice`, {
+    const res = await request.put(`${ADMIN_URL}/api/host/voice`, {
       headers: authHeaders(),
       data: {
         tts: { engine: 'openpalm-voice' },
@@ -227,7 +227,7 @@ test.describe('Voice addon — engine switch lifecycle', () => {
     ensureVoiceUp();
     expect(runningVoiceContainer()).toMatch(/^openpalm-voice/);
 
-    const res = await request.put(`${ADMIN_URL}/admin/voice`, {
+    const res = await request.put(`${ADMIN_URL}/api/host/voice`, {
       headers: authHeaders(),
       data: {
         tts: { enabled: true, engine: 'browser' },
@@ -241,7 +241,7 @@ test.describe('Voice addon — engine switch lifecycle', () => {
   });
 
   test('switching back to engine=openpalm-voice with profile=addon.voice.cuda starts the container', async ({ request }) => {
-    const res = await request.put(`${ADMIN_URL}/admin/voice`, {
+    const res = await request.put(`${ADMIN_URL}/api/host/voice`, {
       headers: authHeaders(),
       data: {
         tts: { enabled: true, engine: 'openpalm-voice' },
@@ -269,8 +269,8 @@ test.describe('Voice addon — engine switch lifecycle', () => {
     expect(runningVoiceContainer()).toMatch(/^openpalm-voice/);
   });
 
-  test('GET /admin/voice after save persists OP_VOICE_PROFILE', async ({ request }) => {
-    const res = await request.get(`${ADMIN_URL}/admin/voice`, { headers: authHeaders() });
+  test('GET /api/host/voice after save persists OP_VOICE_PROFILE', async ({ request }) => {
+    const res = await request.get(`${ADMIN_URL}/api/host/voice`, { headers: authHeaders() });
     const body = await res.json();
     // Whatever profile we just saved (addon.voice.cuda from the previous test) should
     // come back as the selectedProfile.
diff --git a/packages/ui/src/hooks.server.landing.vitest.ts b/packages/ui/src/hooks.server.landing.vitest.ts
index ba015f989..3d57a41bf 100644
--- a/packages/ui/src/hooks.server.landing.vitest.ts
+++ b/packages/ui/src/hooks.server.landing.vitest.ts
@@ -13,9 +13,8 @@
  *    exactly like the existing '/' redirect (a stale /splash bookmark must
  *    not bounce through /login first).
  *  - /attention exists as the new migration/blocking surface split out of
- *    /splash. /host is NOT created in Phase 3 — until Phase 4 renames
- *    /admin, the installed_offline/broken landing stays '/admin' (a TODO
- *    constant in the implementation; flip HOST_ADMIN_LANDING here with it).
+ *    /splash. Phase 4 renamed /admin to /host; the installed_offline/broken
+ *    landing (HOST_ADMIN_LANDING here) flipped with it.
  *
  * RED until Phase 3 lands, EXCEPT the test explicitly labeled
  * CHARACTERIZATION (healthy stack → /chat), which passes today and must
@@ -46,8 +45,8 @@ vi.mock('@openpalm/lib', async (orig) => ({
 import { composePs } from '@openpalm/lib';
 import { handle, _resetLaunchCache } from './hooks.server.js';
 
-// Phase 3 value. TODO(phase-4): flip to '/host' when /admin is renamed.
-const HOST_ADMIN_LANDING = '/admin';
+// Phase 4 value: the host admin surface moved from /admin to /host.
+const HOST_ADMIN_LANDING = '/host';
 
 // ── helpers (same conventions as hooks.server.vitest.ts) ─────────────────────
 
diff --git a/packages/ui/src/hooks.server.ts b/packages/ui/src/hooks.server.ts
index 7508119cd..7499d57eb 100644
--- a/packages/ui/src/hooks.server.ts
+++ b/packages/ui/src/hooks.server.ts
@@ -15,7 +15,7 @@ import { getState } from "$lib/server/state.js";
 import { checkHostHeader, checkOriginHeader, identifyCallerByToken } from "$lib/server/helpers.js";
 import { touchSession } from "$lib/server/session-store.js";
 import { sessionCookieHeader, SESSION_COOKIE_NAME } from "$lib/server/session-cookie.js";
-import { computeFeatureFlags } from '$lib/server/features.js';
+import { computeServerRuntimeContext } from '$lib/server/features.js';
 import {
   createLogger,
   isSetupComplete,
@@ -113,12 +113,18 @@ export const handle: Handle = async ({ event, resolve }) => {
 
   const path = event.url.pathname;
 
-  // Feature gate: /admin/* requires admin flag (Electron or OP_ENABLE_ADMIN=1).
-  // Redirect to /chat so the user lands somewhere useful instead of a 404/403.
-  // /admin/endpoints is the Phase 2 alias for /connections (#486) — honor the
-  // alias in every mode so stale links land on the capability-guarded page.
-  if (path.startsWith('/admin') && !computeFeatureFlags().admin) {
-    redirect(302, path === '/admin/endpoints' ? '/connections' : '/chat');
+  // Capability gate: the /host control plane only renders where the server
+  // advertises the host:* capability set (plan Phase 4 step 4 — the old
+  // admin feature-flag gate, re-expressed as a capability check; the SECURITY
+  // boundary stays server-side in every /api/host/* route via
+  // requireCapability). Redirect to /chat so the user lands somewhere useful.
+  // /admin/* is deliberately NOT gated or aliased: the tree is deleted, so
+  // requests fall through to the router's 404 (plan §6.4 "No /admin alias").
+  if (
+    (path === '/host' || path.startsWith('/host/')) &&
+    !computeServerRuntimeContext(event).serverCapabilities.includes('host:stack:read')
+  ) {
+    redirect(302, '/chat');
   }
   const isSetupPath = SETUP_PATHS.some(p => path === p || path.startsWith(`${p}/`));
 
@@ -152,9 +158,12 @@ export const handle: Handle = async ({ event, resolve }) => {
     const [landingPath] = landing.split('?');
     const usageRoute = path.startsWith('/chat') || path.startsWith('/advanced')
       || path.startsWith('/connections');
+    // '/host' is the admin surface itself; '/admin' stays exempt so requests
+    // into the dead namespace fall through to the router 404 instead of
+    // bouncing to the landing (no alias, no gate — plan Phase 4 step 1).
     const exempt = path.startsWith('/api/') || path.startsWith('/proxy/') || path.startsWith('/login')
-      || path.startsWith('/health') || path.startsWith('/guardian/health') || path.startsWith('/admin')
-      || usageRoute;
+      || path.startsWith('/health') || path.startsWith('/guardian/health') || path.startsWith('/host')
+      || path.startsWith('/admin') || usageRoute;
     if (path === '/' || (path !== landingPath && !exempt)) {
       redirect(302, landing);
     }
@@ -166,9 +175,10 @@ export const handle: Handle = async ({ event, resolve }) => {
   // any HTML is sent.
   //
   // Only *document* navigations (GET + `Accept: text/html`) are redirected to
-  // /login. API/data requests are left alone: every `/admin/*` endpoint enforces
-  // auth itself via requireAdmin() and must return JSON 401, not an HTML 302
-  // (browser fetch() sends `Accept: */*`, so it never matches here).
+  // /login. API/data requests are left alone: every /api/host/* and
+  // /api/assistant/* endpoint enforces auth itself via requireAdmin() and must
+  // return JSON 401, not an HTML 302 (browser fetch() sends `Accept: */*`, so
+  // it never matches here).
   event.locals.role = identifyCallerByToken(event);
 
   // ── Sliding renewal: a valid cookie was just resolved to a role, so push its
@@ -208,7 +218,7 @@ export const handle: Handle = async ({ event, resolve }) => {
   }
   response.headers.set(
     "X-Frame-Options",
-    path === '/admin/akm/health-report' ? 'SAMEORIGIN' : 'DENY',
+    path === '/api/host/akm/health-report' ? 'SAMEORIGIN' : 'DENY',
   );
   response.headers.set("X-Content-Type-Options", "nosniff");
   response.headers.set("Referrer-Policy", "no-referrer");
diff --git a/packages/ui/src/lib/api/addons.ts b/packages/ui/src/lib/api/addons.ts
index 5b2f08e1b..d3183a31a 100644
--- a/packages/ui/src/lib/api/addons.ts
+++ b/packages/ui/src/lib/api/addons.ts
@@ -3,7 +3,7 @@ import { request, requireOk } from './core.js';
 // ── Addon Management ──────────────────────────────────────────────────────────
 
 export async function fetchAddons(): Promise<{ name: string; enabled: boolean; available: boolean }[]> {
-  const res = await requireOk(await request('GET', '/admin/addons'));
+  const res = await requireOk(await request('GET', '/api/host/addons'));
   const data = (await res.json()) as { addons: { name: string; enabled: boolean; available: boolean }[] };
   return data.addons;
 }
@@ -15,7 +15,7 @@ export async function toggleAddon(
 ): Promise<{ ok: boolean; changed: boolean }> {
   const body: Record<string, unknown> = { enabled };
   if (env) body.env = env;
-  const res = await requireOk(await request('POST', `/admin/addons/${encodeURIComponent(name)}`, body));
+  const res = await requireOk(await request('POST', `/api/host/addons/${encodeURIComponent(name)}`, body));
   return (await res.json()) as { ok: boolean; changed: boolean };
 }
 
@@ -29,7 +29,7 @@ export type AddonCredentialField = {
 };
 
 export async function fetchAddonCredentials(name: string): Promise<AddonCredentialField[]> {
-  const res = await requireOk(await request('GET', `/admin/addons/${encodeURIComponent(name)}/credentials`));
+  const res = await requireOk(await request('GET', `/api/host/addons/${encodeURIComponent(name)}/credentials`));
   const data = (await res.json()) as { fields: AddonCredentialField[] };
   return data.fields;
 }
@@ -39,7 +39,7 @@ export async function saveAddonCredentials(
   values: Record<string, string>
 ): Promise<{ ok: boolean; updated: string[] }> {
   const res = await requireOk(
-    await request('POST', `/admin/addons/${encodeURIComponent(name)}/credentials`, { values })
+    await request('POST', `/api/host/addons/${encodeURIComponent(name)}/credentials`, { values })
   );
   return (await res.json()) as { ok: boolean; updated: string[] };
 }
diff --git a/packages/ui/src/lib/api/akm.ts b/packages/ui/src/lib/api/akm.ts
index b3f0ced18..f10a72053 100644
--- a/packages/ui/src/lib/api/akm.ts
+++ b/packages/ui/src/lib/api/akm.ts
@@ -3,12 +3,12 @@ import { request, requireOk } from './core.js';
 // ── AKM Config ────────────────────────────────────────────────────────────────
 
 export async function fetchAkmConfig(): Promise<{ config: Record<string, unknown> }> {
-  const res = await requireOk(await request('GET', '/admin/akm'));
+  const res = await requireOk(await request('GET', '/api/assistant/akm'));
   return (await res.json()) as { config: Record<string, unknown> };
 }
 
 export async function saveAkmConfig(settings: Record<string, unknown>): Promise<{ ok: boolean }> {
-  const res = await requireOk(await request('PATCH', '/admin/akm', settings));
+  const res = await requireOk(await request('PATCH', '/api/assistant/akm', settings));
   return (await res.json()) as { ok: boolean };
 }
 
@@ -29,7 +29,7 @@ export type AkmEmbeddingTestResult = {
 };
 
 export async function detectAkmEmbedding(): Promise<AkmEmbeddingDetection> {
-  const res = await requireOk(await request('POST', '/admin/akm/embedding/detect', {}));
+  const res = await requireOk(await request('POST', '/api/host/akm/embedding/detect', {}));
   return (await res.json()) as AkmEmbeddingDetection;
 }
 
@@ -40,35 +40,52 @@ export async function testAkmEmbedding(settings: {
   apiKey?: string;
   dimension?: number;
 }): Promise<AkmEmbeddingTestResult> {
-  const res = await requireOk(await request('POST', '/admin/akm/embedding/test', settings));
+  const res = await requireOk(await request('POST', '/api/host/akm/embedding/test', settings));
   return (await res.json()) as AkmEmbeddingTestResult;
 }
 
 export async function reindexAkm(): Promise<{ ok: boolean; message: string; output?: string }> {
-  const res = await requireOk(await request('POST', '/admin/akm/reindex', {}));
+  const res = await requireOk(await request('POST', '/api/host/akm/reindex', {}));
   return (await res.json()) as { ok: boolean; message: string; output?: string };
 }
 
-export type AssistantSettings = {
+// ── Host stack settings + assistant persona (the old /admin/assistant split
+// into /api/host/stack and /api/assistant/persona — plan Phase 4 step 2) ──────
+
+export type HostStackSettings = {
   projectName: string;
   lanExposureEnabled: boolean;
   stackEnvPath: string;
-  personaPath: string;
-  personaContent: string;
 };
 
-export async function fetchAssistantSettings(): Promise<AssistantSettings> {
-  const res = await requireOk(await request('GET', '/admin/assistant'));
-  return (await res.json()) as AssistantSettings;
+export async function fetchHostStackSettings(): Promise<HostStackSettings> {
+  const res = await requireOk(await request('GET', '/api/host/stack'));
+  return (await res.json()) as HostStackSettings;
 }
 
-export async function saveAssistantSettings(input: {
+export async function saveHostStackSettings(input: {
   projectName: string;
   lanExposureEnabled: boolean;
+}): Promise<{ ok: boolean; projectName: string; projectRenamed: boolean; lanExposureEnabled: boolean; stackEnvPath: string }> {
+  const res = await requireOk(await request('PUT', '/api/host/stack', input));
+  return (await res.json()) as { ok: boolean; projectName: string; projectRenamed: boolean; lanExposureEnabled: boolean; stackEnvPath: string };
+}
+
+export type AssistantPersona = {
+  personaPath: string;
+  personaContent: string;
+};
+
+export async function fetchAssistantPersona(): Promise<AssistantPersona> {
+  const res = await requireOk(await request('GET', '/api/assistant/persona'));
+  return (await res.json()) as AssistantPersona;
+}
+
+export async function saveAssistantPersona(input: {
   personaContent: string;
-}): Promise<{ ok: boolean; projectName: string; projectRenamed: boolean; lanExposureEnabled: boolean; stackEnvPath: string; personaPath: string; personaContent: string }> {
-  const res = await requireOk(await request('PUT', '/admin/assistant', input));
-  return (await res.json()) as { ok: boolean; projectName: string; projectRenamed: boolean; lanExposureEnabled: boolean; stackEnvPath: string; personaPath: string; personaContent: string };
+}): Promise<{ ok: boolean; personaPath: string; personaContent: string }> {
+  const res = await requireOk(await request('PUT', '/api/assistant/persona', input));
+  return (await res.json()) as { ok: boolean; personaPath: string; personaContent: string };
 }
 
 // ── AKM Health (dashboard metrics) ────────────────────────────────────────────
@@ -90,7 +107,7 @@ export type AkmHealth =
     };
 
 export async function fetchAkmHealth(): Promise<AkmHealth> {
-  const res = await requireOk(await request('GET', '/admin/akm/health'));
+  const res = await requireOk(await request('GET', '/api/host/akm/health'));
   return (await res.json()) as AkmHealth;
 }
 
@@ -138,7 +155,7 @@ export type AkmKnowledgeStats =
     };
 
 export async function fetchAkmKnowledgeStats(): Promise<AkmKnowledgeStats> {
-  const res = await requireOk(await request('GET', '/admin/akm/stats'));
+  const res = await requireOk(await request('GET', '/api/host/akm/stats'));
   return (await res.json()) as AkmKnowledgeStats;
 }
 
@@ -151,16 +168,16 @@ export type HostAkmSharing = {
 };
 
 export async function fetchHostAkmSharing(): Promise<HostAkmSharing> {
-  const res = await requireOk(await request('GET', '/admin/akm/host-sharing'));
+  const res = await requireOk(await request('GET', '/api/host/akm/host-sharing'));
   return (await res.json()) as HostAkmSharing;
 }
 
 export async function enableHostAkmSharing(): Promise<HostAkmSharing> {
-  const res = await requireOk(await request('PUT', '/admin/akm/host-sharing', {}));
+  const res = await requireOk(await request('PUT', '/api/host/akm/host-sharing', {}));
   return (await res.json()) as HostAkmSharing;
 }
 
 export async function disableHostAkmSharing(): Promise<HostAkmSharing> {
-  const res = await requireOk(await request('DELETE', '/admin/akm/host-sharing'));
+  const res = await requireOk(await request('DELETE', '/api/host/akm/host-sharing'));
   return (await res.json()) as HostAkmSharing;
 }
diff --git a/packages/ui/src/lib/api/automations.ts b/packages/ui/src/lib/api/automations.ts
index b7f14de25..1a07a0b92 100644
--- a/packages/ui/src/lib/api/automations.ts
+++ b/packages/ui/src/lib/api/automations.ts
@@ -4,19 +4,19 @@ import { request, requireOk } from './core.js';
 // ── Automations ──────────────────────────────────────────────────────────────
 
 export async function fetchAutomations(): Promise<AutomationsResponse> {
-  const res = await requireOk(await request('GET', '/admin/automations'));
+  const res = await requireOk(await request('GET', '/api/host/automations'));
   return (await res.json()) as AutomationsResponse;
 }
 
 export async function runAutomation(name: string): Promise<{ ok: boolean; name: string; status: string; error: string | null }> {
-  const res = await requireOk(await request('POST', `/admin/automations/${encodeURIComponent(name)}/run`));
+  const res = await requireOk(await request('POST', `/api/host/automations/${encodeURIComponent(name)}/run`));
   return (await res.json()) as { ok: boolean; name: string; status: string; error: string | null };
 }
 
 export async function fetchAutomationLog(name: string, limit = 200): Promise<{ name: string; lines: string[] }> {
   const params = new URLSearchParams({ limit: String(limit) });
   const res = await requireOk(
-    await request('GET', `/admin/automations/${encodeURIComponent(name)}/log?${params.toString()}`)
+    await request('GET', `/api/host/automations/${encodeURIComponent(name)}/log?${params.toString()}`)
   );
   return (await res.json()) as { name: string; lines: string[] };
 }
@@ -31,23 +31,23 @@ export async function fetchServiceLogs(
   if (options?.tail) params.set('tail', String(options.tail));
   if (options?.since) params.set('since', options.since);
   const qs = params.toString();
-  const res = await requireOk(await request('GET', `/admin/logs${qs ? `?${qs}` : ''}`));
+  const res = await requireOk(await request('GET', `/api/host/logs${qs ? `?${qs}` : ''}`));
   return (await res.json()) as { ok: boolean; logs: string; error?: string };
 }
 
 // ── Automation task files (/stash/tasks editor) ──────────────────────────────
 
 export async function fetchTaskFile(name: string): Promise<{ name: string; content: string }> {
-  const res = await requireOk(await request('GET', `/admin/automations/${encodeURIComponent(name)}/file`));
+  const res = await requireOk(await request('GET', `/api/host/automations/${encodeURIComponent(name)}/file`));
   return (await res.json()) as { name: string; content: string };
 }
 
 export async function saveTaskFile(name: string, content: string): Promise<{ ok: boolean }> {
-  const res = await requireOk(await request('PUT', `/admin/automations/${encodeURIComponent(name)}/file`, { content }));
+  const res = await requireOk(await request('PUT', `/api/host/automations/${encodeURIComponent(name)}/file`, { content }));
   return (await res.json()) as { ok: boolean };
 }
 
 export async function deleteTaskFile(name: string): Promise<{ ok: boolean }> {
-  const res = await requireOk(await request('DELETE', `/admin/automations/${encodeURIComponent(name)}/file`));
+  const res = await requireOk(await request('DELETE', `/api/host/automations/${encodeURIComponent(name)}/file`));
   return (await res.json()) as { ok: boolean };
 }
diff --git a/packages/ui/src/lib/api/backups.ts b/packages/ui/src/lib/api/backups.ts
index b47fd6875..56ff38909 100644
--- a/packages/ui/src/lib/api/backups.ts
+++ b/packages/ui/src/lib/api/backups.ts
@@ -18,25 +18,25 @@ export interface BackupSummaryView {
 }
 
 export async function fetchBackups(): Promise<BackupSummaryView> {
-  const res = await requireOk(await request('GET', '/admin/backups'));
+  const res = await requireOk(await request('GET', '/api/host/backups'));
   return (await res.json()) as BackupSummaryView;
 }
 
 /** Drives the confirm-gated prune — keeps the newest `keep`, deletes older. */
 export async function pruneBackups(keep: number): Promise<{ ok: boolean; deleted: string[]; kept: number }> {
-  const res = await requireOk(await request('POST', '/admin/backups', { keep }));
+  const res = await requireOk(await request('POST', '/api/host/backups', { keep }));
   return (await res.json()) as { ok: boolean; deleted: string[]; kept: number };
 }
 
 // ── Secret-strip notice (#502) ───────────────────────────────────────────────
 
 export async function fetchSecretStripNotice(): Promise<{ ok: boolean; notice: { keys: string[]; at: string } | null }> {
-  const res = await requireOk(await request('GET', '/admin/secret-notice'));
+  const res = await requireOk(await request('GET', '/api/host/secret-notice'));
   return (await res.json()) as { ok: boolean; notice: { keys: string[]; at: string } | null };
 }
 
 export async function dismissSecretStripNotice(): Promise<{ ok: boolean }> {
-  const res = await requireOk(await request('DELETE', '/admin/secret-notice'));
+  const res = await requireOk(await request('DELETE', '/api/host/secret-notice'));
   return (await res.json()) as { ok: boolean };
 }
 
@@ -54,7 +54,7 @@ export interface InstallLockStatusView {
 }
 
 export async function fetchInstallLockStatus(): Promise<InstallLockStatusView> {
-  const res = await requireOk(await request('GET', '/admin/unlock'));
+  const res = await requireOk(await request('GET', '/api/host/unlock'));
   return (await res.json()) as InstallLockStatusView;
 }
 
@@ -63,6 +63,6 @@ export async function fetchInstallLockStatus(): Promise<InstallLockStatusView> {
  * a live install is still holding it (HTTP 409) — never forces.
  */
 export async function clearInstallLock(): Promise<{ ok: boolean; removed: boolean }> {
-  const res = await requireOk(await request('POST', '/admin/unlock'));
+  const res = await requireOk(await request('POST', '/api/host/unlock'));
   return (await res.json()) as { ok: boolean; removed: boolean };
 }
diff --git a/packages/ui/src/lib/api/containers.ts b/packages/ui/src/lib/api/containers.ts
index 7565c638e..ce44bf269 100644
--- a/packages/ui/src/lib/api/containers.ts
+++ b/packages/ui/src/lib/api/containers.ts
@@ -4,7 +4,7 @@ import { request, requireOk } from './core.js';
 // ── Containers ───────────────────────────────────────────────────────────────
 
 export async function fetchContainers(): Promise<ContainerListResponse> {
-  const res = await requireOk(await request('GET', '/admin/containers/list'));
+  const res = await requireOk(await request('GET', '/api/host/containers/list'));
   return (await res.json()) as ContainerListResponse;
 }
 
@@ -13,9 +13,9 @@ export async function containerAction(
   containerId: string
 ): Promise<void> {
   const pathMap = {
-    start: '/admin/containers/up',
-    stop: '/admin/containers/down',
-    restart: '/admin/containers/restart'
+    start: '/api/host/containers/up',
+    stop: '/api/host/containers/down',
+    restart: '/api/host/containers/restart'
   } as const;
   await requireOk(await request('POST', pathMap[action], { service: containerId }));
 }
@@ -23,5 +23,5 @@ export async function containerAction(
 // ── Docker Pull ──────────────────────────────────────────────────────────────
 
 export async function pullImages(): Promise<void> {
-  await requireOk(await request('POST', '/admin/containers/pull', {}));
+  await requireOk(await request('POST', '/api/host/containers/pull', {}));
 }
diff --git a/packages/ui/src/lib/api/endpoints.ts b/packages/ui/src/lib/api/endpoints.ts
index 8b15bd78d..b7ec39e49 100644
--- a/packages/ui/src/lib/api/endpoints.ts
+++ b/packages/ui/src/lib/api/endpoints.ts
@@ -6,7 +6,7 @@ import type { ConnectionKind } from '$lib/types.js';
 // Phase 2 (#486): the internal model uses "connection" language (plan
 // ui-runtime-modes-plan.md §6.6) and the client talks to /api/connections/*,
 // which is guarded by the `connections:manage` capability instead of the
-// host-admin-only /admin/* namespace — so connection management works in
+// host-admin-only legacy /admin namespace — so connection management works in
 // every mode that advertises the capability (host-ui, electron-host,
 // pwa-static). This module keeps its historical file name (api/endpoints.ts)
 // until the Phase 5 client extraction relocates it.
diff --git a/packages/ui/src/lib/api/providers.ts b/packages/ui/src/lib/api/providers.ts
index f4948883c..74e1a3aff 100644
--- a/packages/ui/src/lib/api/providers.ts
+++ b/packages/ui/src/lib/api/providers.ts
@@ -19,7 +19,7 @@ export type ProviderHostStatus = {
   authPath: string | null;
 };
 
-/** Result body of POST /admin/providers/import-host. */
+/** Result body of POST /api/host/providers/import-host. */
 export type HostImportResult = {
   ok: boolean;
   imported: { providers: number; credentials: number };
@@ -28,41 +28,41 @@ export type HostImportResult = {
   livePushFailed?: string[];
 };
 
-/** GET /admin/providers — full connections page state. */
+/** GET /api/host/providers — full connections page state. */
 export async function fetchProviders(): Promise<ProviderPageState> {
-  const res = await requireOk(await request('GET', '/admin/providers'));
+  const res = await requireOk(await request('GET', '/api/host/providers'));
   return (await res.json()) as ProviderPageState;
 }
 
-/** GET /admin/providers/assistant-clis — assistant CLI tool statuses. */
+/** GET /api/host/providers/assistant-clis — assistant CLI tool statuses. */
 export async function fetchAssistantCliTools(): Promise<AssistantCliToolStatus[]> {
-  const res = await requireOk(await request('GET', '/admin/providers/assistant-clis'));
+  const res = await requireOk(await request('GET', '/api/host/providers/assistant-clis'));
   const body = (await res.json()) as { tools?: AssistantCliToolStatus[] };
   return body.tools ?? [];
 }
 
-/** POST /admin/opencode/model — set the default `model` or `small_model`. */
+/** POST /api/assistant/model — set the default `model` or `small_model`. */
 export async function saveOpencodeModel(
   target: 'model' | 'small_model',
   value: string
 ): Promise<void> {
-  await requireOk(await request('POST', '/admin/opencode/model', { [target]: value || null }));
+  await requireOk(await request('POST', '/api/assistant/model', { [target]: value || null }));
 }
 
-/** DELETE /admin/opencode/providers/{id}/auth — remove stored credentials. */
+/** DELETE /api/host/opencode/providers/{id}/auth — remove stored credentials. */
 export async function disconnectProvider(providerId: string): Promise<void> {
   await requireOk(
-    await request('DELETE', `/admin/opencode/providers/${encodeURIComponent(providerId)}/auth`)
+    await request('DELETE', `/api/host/opencode/providers/${encodeURIComponent(providerId)}/auth`)
   );
 }
 
-/** GET /admin/providers/host-status — detected host OpenCode summary. */
+/** GET /api/host/providers/host-status — detected host OpenCode summary. */
 export async function fetchHostStatus(): Promise<ProviderHostStatus> {
-  const res = await requireOk(await request('GET', '/admin/providers/host-status'));
+  const res = await requireOk(await request('GET', '/api/host/providers/host-status'));
   return (await res.json()) as ProviderHostStatus;
 }
 
-/** POST /admin/providers/assistant-clis/{toolId}/use-provider — seed a CLI's creds. */
+/** POST /api/host/providers/assistant-clis/{toolId}/use-provider — seed a CLI's creds. */
 export async function useAssistantCliProvider(
   toolId: AssistantCliToolStatus['id'],
   providerId: string
@@ -70,19 +70,19 @@ export async function useAssistantCliProvider(
   await requireOk(
     await request(
       'POST',
-      `/admin/providers/assistant-clis/${encodeURIComponent(toolId)}/use-provider`,
+      `/api/host/providers/assistant-clis/${encodeURIComponent(toolId)}/use-provider`,
       { providerId }
     )
   );
 }
 
-/** POST /admin/providers/oauth/start — begin an OAuth flow; body branches on result. */
+/** POST /api/host/providers/oauth/start — begin an OAuth flow; body branches on result. */
 export async function startProviderOauth(
   providerId: string,
   methodIndex: number
 ): Promise<ProviderActionResult> {
   return requireJsonBody<ProviderActionResult>(
-    await request('POST', '/admin/providers/oauth/start', {
+    await request('POST', '/api/host/providers/oauth/start', {
       providerId,
       methodIndex: String(methodIndex),
     }),
@@ -91,7 +91,7 @@ export async function startProviderOauth(
 }
 
 /**
- * POST /admin/providers/oauth/{providerId}/callback — the long-poll that blocks
+ * POST /api/host/providers/oauth/{providerId}/callback — the long-poll that blocks
  * server-side until the OAuth flow completes. Returns the raw Response so the
  * caller can inspect status and abort via `signal`.
  */
@@ -102,39 +102,39 @@ export async function oauthCallback(
 ): Promise<Response> {
   return request(
     'POST',
-    `/admin/providers/oauth/${encodeURIComponent(providerId)}/callback`,
+    `/api/host/providers/oauth/${encodeURIComponent(providerId)}/callback`,
     { method: methodIndex },
     { signal }
   );
 }
 
-/** POST /admin/opencode/providers/{id}/auth — save an API key credential. */
+/** POST /api/host/opencode/providers/{id}/auth — save an API key credential. */
 export async function submitProviderApiKey(providerId: string, apiKey: string): Promise<void> {
   await requireOk(
-    await request('POST', `/admin/opencode/providers/${encodeURIComponent(providerId)}/auth`, {
+    await request('POST', `/api/host/opencode/providers/${encodeURIComponent(providerId)}/auth`, {
       mode: 'api_key',
       apiKey,
     })
   );
 }
 
-/** POST /admin/providers/oauth/finish — submit an OAuth authorization code. */
+/** POST /api/host/providers/oauth/finish — submit an OAuth authorization code. */
 export async function finishProviderOauth(
   providerId: string,
   methodIndex: number,
   code: string
 ): Promise<void> {
   await requireOk(
-    await request('POST', '/admin/providers/oauth/finish', { providerId, methodIndex, code })
+    await request('POST', '/api/host/providers/oauth/finish', { providerId, methodIndex, code })
   );
 }
 
-/** PATCH /admin/providers/{id} — register a custom OpenAI-compatible provider. */
+/** PATCH /api/host/providers/{id} — register a custom OpenAI-compatible provider. */
 export async function registerCustomProvider(
   id: string,
   input: { displayName: string; baseURL: string; apiKey?: string }
 ): Promise<ProviderActionResult> {
-  const res = await request('PATCH', `/admin/providers/${encodeURIComponent(id)}`, {
+  const res = await request('PATCH', `/api/host/providers/${encodeURIComponent(id)}`, {
     kind: 'register-custom',
     displayName: input.displayName,
     baseURL: input.baseURL,
@@ -150,9 +150,9 @@ export async function registerCustomProvider(
   return result;
 }
 
-/** POST /admin/providers/import-host — copy host OpenCode providers/credentials. */
+/** POST /api/host/providers/import-host — copy host OpenCode providers/credentials. */
 export async function importHostProviders(): Promise<HostImportResult> {
-  const res = await request('POST', '/admin/providers/import-host');
+  const res = await request('POST', '/api/host/providers/import-host');
   const body = await requireJsonBody<HostImportResult>(res, 'Import failed.');
   if (!res.ok) {
     throw Object.assign(
diff --git a/packages/ui/src/lib/api/providers.vitest.ts b/packages/ui/src/lib/api/providers.vitest.ts
index b6f2131eb..3e442a029 100644
--- a/packages/ui/src/lib/api/providers.vitest.ts
+++ b/packages/ui/src/lib/api/providers.vitest.ts
@@ -42,10 +42,10 @@ afterEach(() => {
 });
 
 describe('providers client — request shaping', () => {
-  test('fetchProviders GETs /admin/providers with the shared UI headers', async () => {
+  test('fetchProviders GETs /api/host/providers with the shared UI headers', async () => {
     const calls = mockFetch(200, { available: true, providers: [] });
     const state = await fetchProviders();
-    expect(calls[0].url).toBe('/admin/providers');
+    expect(calls[0].url).toBe('/api/host/providers');
     expect(calls[0].init?.method).toBe('GET');
     expect(calls[0].init?.body).toBeUndefined();
     expect(headerOf(calls[0].init, 'x-requested-by')).toBe('ui');
@@ -56,14 +56,14 @@ describe('providers client — request shaping', () => {
   test('fetchAssistantCliTools returns tools array (defaulting to [])', async () => {
     const calls = mockFetch(200, {});
     expect(await fetchAssistantCliTools()).toEqual([]);
-    expect(calls[0].url).toBe('/admin/providers/assistant-clis');
+    expect(calls[0].url).toBe('/api/host/providers/assistant-clis');
     expect(calls[0].init?.method).toBe('GET');
   });
 
   test('saveOpencodeModel POSTs the target field, coercing empty to null', async () => {
     const calls = mockFetch(200, { ok: true });
     await saveOpencodeModel('model', 'openai/gpt-4o');
-    expect(calls[0].url).toBe('/admin/opencode/model');
+    expect(calls[0].url).toBe('/api/assistant/model');
     expect(calls[0].init?.method).toBe('POST');
     expect(headerOf(calls[0].init, 'content-type')).toBe('application/json');
     expect(JSON.parse(calls[0].init?.body as string)).toEqual({ model: 'openai/gpt-4o' });
@@ -76,21 +76,21 @@ describe('providers client — request shaping', () => {
   test('disconnectProvider DELETEs the URL-encoded auth endpoint', async () => {
     const calls = mockFetch(200, { ok: true });
     await disconnectProvider('a/b');
-    expect(calls[0].url).toBe('/admin/opencode/providers/a%2Fb/auth');
+    expect(calls[0].url).toBe('/api/host/opencode/providers/a%2Fb/auth');
     expect(calls[0].init?.method).toBe('DELETE');
   });
 
-  test('fetchHostStatus GETs /admin/providers/host-status', async () => {
+  test('fetchHostStatus GETs /api/host/providers/host-status', async () => {
     const calls = mockFetch(200, { detected: true, providerCount: 3, credentialCount: 2, configPath: null, authPath: null });
     const status = await fetchHostStatus();
-    expect(calls[0].url).toBe('/admin/providers/host-status');
+    expect(calls[0].url).toBe('/api/host/providers/host-status');
     expect(status.providerCount).toBe(3);
   });
 
   test('useAssistantCliProvider POSTs providerId to the encoded tool endpoint', async () => {
     const calls = mockFetch(200, { ok: true });
     await useAssistantCliProvider('codex', 'openai');
-    expect(calls[0].url).toBe('/admin/providers/assistant-clis/codex/use-provider');
+    expect(calls[0].url).toBe('/api/host/providers/assistant-clis/codex/use-provider');
     expect(calls[0].init?.method).toBe('POST');
     expect(JSON.parse(calls[0].init?.body as string)).toEqual({ providerId: 'openai' });
   });
@@ -98,7 +98,7 @@ describe('providers client — request shaping', () => {
   test('startProviderOauth POSTs providerId + stringified methodIndex, returns body', async () => {
     const calls = mockFetch(200, { ok: true, oauth: { url: 'u', mode: 'code', providerId: 'p', methodIndex: 0 } });
     const result = await startProviderOauth('p', 0);
-    expect(calls[0].url).toBe('/admin/providers/oauth/start');
+    expect(calls[0].url).toBe('/api/host/providers/oauth/start');
     expect(JSON.parse(calls[0].init?.body as string)).toEqual({ providerId: 'p', methodIndex: '0' });
     expect(result.oauth?.url).toBe('u');
   });
@@ -108,7 +108,7 @@ describe('providers client — request shaping', () => {
     const controller = new AbortController();
     const res = await oauthCallback('gh', 1, controller.signal);
     expect(res).toBeInstanceOf(Response);
-    expect(calls[0].url).toBe('/admin/providers/oauth/gh/callback');
+    expect(calls[0].url).toBe('/api/host/providers/oauth/gh/callback');
     expect(JSON.parse(calls[0].init?.body as string)).toEqual({ method: 1 });
     expect(calls[0].init?.signal).toBe(controller.signal);
   });
@@ -116,7 +116,7 @@ describe('providers client — request shaping', () => {
   test('submitProviderApiKey POSTs the api_key payload', async () => {
     const calls = mockFetch(200, { ok: true });
     await submitProviderApiKey('openai', 'sk-x');
-    expect(calls[0].url).toBe('/admin/opencode/providers/openai/auth');
+    expect(calls[0].url).toBe('/api/host/opencode/providers/openai/auth');
     expect(calls[0].init?.method).toBe('POST');
     expect(JSON.parse(calls[0].init?.body as string)).toEqual({ mode: 'api_key', apiKey: 'sk-x' });
   });
@@ -124,14 +124,14 @@ describe('providers client — request shaping', () => {
   test('finishProviderOauth POSTs providerId/methodIndex/code', async () => {
     const calls = mockFetch(200, { ok: true });
     await finishProviderOauth('p', 2, 'code123');
-    expect(calls[0].url).toBe('/admin/providers/oauth/finish');
+    expect(calls[0].url).toBe('/api/host/providers/oauth/finish');
     expect(JSON.parse(calls[0].init?.body as string)).toEqual({ providerId: 'p', methodIndex: 2, code: 'code123' });
   });
 
-  test('registerCustomProvider PATCHes /admin/providers/{id} with the register-custom payload', async () => {
+  test('registerCustomProvider PATCHes /api/host/providers/{id} with the register-custom payload', async () => {
     const calls = mockFetch(200, { ok: true, selectedProviderId: 'my-p' });
     const result = await registerCustomProvider('my-p', { displayName: 'My P', baseURL: 'https://x/v1', apiKey: 'k' });
-    expect(calls[0].url).toBe('/admin/providers/my-p');
+    expect(calls[0].url).toBe('/api/host/providers/my-p');
     expect(calls[0].init?.method).toBe('PATCH');
     expect(JSON.parse(calls[0].init?.body as string)).toEqual({
       kind: 'register-custom',
@@ -145,10 +145,10 @@ describe('providers client — request shaping', () => {
     expect(result.selectedProviderId).toBe('my-p');
   });
 
-  test('importHostProviders POSTs /admin/providers/import-host', async () => {
+  test('importHostProviders POSTs /api/host/providers/import-host', async () => {
     const calls = mockFetch(200, { ok: true, imported: { providers: 1, credentials: 2 }, conflicts: [] });
     const body = await importHostProviders();
-    expect(calls[0].url).toBe('/admin/providers/import-host');
+    expect(calls[0].url).toBe('/api/host/providers/import-host');
     expect(calls[0].init?.method).toBe('POST');
     expect(body.imported.providers).toBe(1);
   });
diff --git a/packages/ui/src/lib/api/secrets.ts b/packages/ui/src/lib/api/secrets.ts
index 3f55b6be7..e61137f89 100644
--- a/packages/ui/src/lib/api/secrets.ts
+++ b/packages/ui/src/lib/api/secrets.ts
@@ -9,18 +9,18 @@ export type UserEnvListResponse = {
 };
 
 export async function fetchUserEnv(): Promise<UserEnvListResponse> {
-  const res = await requireOk(await request('GET', '/admin/secrets/user-env'));
+  const res = await requireOk(await request('GET', '/api/host/secrets/user-env'));
   return (await res.json()) as UserEnvListResponse;
 }
 
 export async function writeUserEnvKey(key: string, value: string): Promise<{ ok: boolean }> {
-  const res = await requireOk(await request('POST', '/admin/secrets/user-env', { key, value }));
+  const res = await requireOk(await request('POST', '/api/host/secrets/user-env', { key, value }));
   return (await res.json()) as { ok: boolean };
 }
 
 export async function deleteUserEnvKey(key: string): Promise<{ ok: boolean }> {
   const res = await requireOk(
-    await request('DELETE', `/admin/secrets/user-env?key=${encodeURIComponent(key)}`)
+    await request('DELETE', `/api/host/secrets/user-env?key=${encodeURIComponent(key)}`)
   );
   return (await res.json()) as { ok: boolean };
 }
@@ -30,21 +30,21 @@ export async function deleteUserEnvKey(key: string): Promise<{ ok: boolean }> {
 export type SecretFileInfo = { name: string; size: number };
 
 export async function fetchSecretFiles(): Promise<{ files: SecretFileInfo[] }> {
-  const res = await requireOk(await request('GET', '/admin/secrets'));
+  const res = await requireOk(await request('GET', '/api/host/secrets'));
   return (await res.json()) as { files: SecretFileInfo[] };
 }
 
 export async function fetchSecretFile(name: string): Promise<{ name: string; value: string }> {
-  const res = await requireOk(await request('GET', `/admin/secrets/${encodeURIComponent(name)}`));
+  const res = await requireOk(await request('GET', `/api/host/secrets/${encodeURIComponent(name)}`));
   return (await res.json()) as { name: string; value: string };
 }
 
 export async function saveSecretFile(name: string, value: string): Promise<{ ok: boolean }> {
-  const res = await requireOk(await request('PUT', `/admin/secrets/${encodeURIComponent(name)}`, { value }));
+  const res = await requireOk(await request('PUT', `/api/host/secrets/${encodeURIComponent(name)}`, { value }));
   return (await res.json()) as { ok: boolean };
 }
 
 export async function deleteSecretFile(name: string): Promise<{ ok: boolean }> {
-  const res = await requireOk(await request('DELETE', `/admin/secrets/${encodeURIComponent(name)}`));
+  const res = await requireOk(await request('DELETE', `/api/host/secrets/${encodeURIComponent(name)}`));
   return (await res.json()) as { ok: boolean };
 }
diff --git a/packages/ui/src/lib/api/versions.ts b/packages/ui/src/lib/api/versions.ts
index 97e5ee638..6946aaddd 100644
--- a/packages/ui/src/lib/api/versions.ts
+++ b/packages/ui/src/lib/api/versions.ts
@@ -17,14 +17,14 @@ export async function applyChanges(versions: Record<string, string> = {}): Promi
   // so parse it before requireOk would throw.
   // `versions` carries the target each component should advance to (the resolved
   // channel-latest or a pin) so the update actually moves forward (see UpdatesTab).
-  const res = await request('POST', '/admin/update', { versions });
+  const res = await request('POST', '/api/host/update', { versions });
   return requireJsonBody<ApplyChangesResult>(res, `Apply failed (HTTP ${res.status})`);
 }
 
 /** Scoped single-service update (§4, §7 "Update <container>"):
  *  pull + recreate ONLY the named compose service. Pull failure is FATAL (§6). */
 export async function applyServiceUpdate(service: string, versions: Record<string, string> = {}): Promise<ApplyChangesResult> {
-  const res = await request('POST', '/admin/update', { service, versions });
+  const res = await request('POST', '/api/host/update', { service, versions });
   return requireJsonBody<ApplyChangesResult>(res, `Update failed (HTTP ${res.status})`);
 }
 
@@ -47,7 +47,7 @@ export interface ComponentVersionInfo {
   available: string | null;
 }
 
-/** GET /admin/versions response (Phase 5 shape + backward-compat legacy fields). */
+/** GET /api/host/versions response (Phase 5 shape + backward-compat legacy fields). */
 export interface VersionsResponse {
   /** Phase-5 per-component detail (three distinct values per key, §5). */
   components: Record<string, ComponentVersionInfo>;
@@ -60,18 +60,18 @@ export interface VersionsResponse {
 }
 
 export async function fetchVersions(): Promise<VersionsResponse> {
-  const res = await requireOk(await request('GET', '/admin/versions'));
+  const res = await requireOk(await request('GET', '/api/host/versions'));
   return (await res.json()) as VersionsResponse;
 }
 
 /** Persist version pins to stack.env. Only SERVICE_VERSION_KEYS + OP_AUTO_UPDATE
- *  are accepted; the change takes effect on the next POST /admin/update. */
+ *  are accepted; the change takes effect on the next POST /api/host/update. */
 export async function patchVersions(versions: Record<string, string>): Promise<{ ok: boolean; versions: Record<string, string> }> {
-  const res = await requireOk(await request('PATCH', '/admin/versions', { versions }));
+  const res = await requireOk(await request('PATCH', '/api/host/versions', { versions }));
   return (await res.json()) as { ok: boolean; versions: Record<string, string> };
 }
 
-/** Response from GET /admin/versions/latest — resolved latest versions from
+/** Response from GET /api/host/versions/latest — resolved latest versions from
  *  GitHub releases (images) and npm registry (packages). null means the registry
  *  was unreachable for that key. */
 export interface LatestVersionsResponse {
@@ -83,13 +83,13 @@ export interface LatestVersionsResponse {
 /** Query the latest available versions from GitHub releases + npm registry.
  *  Called only on explicit user action; never auto-polled. */
 export async function fetchLatestVersions(): Promise<LatestVersionsResponse> {
-  const res = await requireOk(await request('GET', '/admin/versions/latest'));
+  const res = await requireOk(await request('GET', '/api/host/versions/latest'));
   return (await res.json()) as LatestVersionsResponse;
 }
 
 export async function downloadUiVersion(
   tag: string,
 ): Promise<{ ok: boolean; tag: string; restarting: boolean; pendingRestart: boolean }> {
-  const res = await requireOk(await request('POST', '/admin/ui-version', { tag }));
+  const res = await requireOk(await request('POST', '/api/host/ui-version', { tag }));
   return (await res.json()) as { ok: boolean; tag: string; restarting: boolean; pendingRestart: boolean };
 }
diff --git a/packages/ui/src/lib/api/voice.ts b/packages/ui/src/lib/api/voice.ts
index a199f270d..683c35c80 100644
--- a/packages/ui/src/lib/api/voice.ts
+++ b/packages/ui/src/lib/api/voice.ts
@@ -33,7 +33,7 @@ export async function fetchVoiceConfig(): Promise<{
   stt: Record<string, unknown>;
   addon?: VoiceAddonInfo;
 }> {
-  const res = await requireOk(await request('GET', '/admin/voice'));
+  const res = await requireOk(await request('GET', '/api/host/voice'));
   return (await res.json()) as {
     tts: Record<string, unknown>;
     stt: Record<string, unknown>;
@@ -58,13 +58,13 @@ export type SaveVoiceResult = {
 };
 
 export async function saveVoiceConfig(config: { tts?: unknown; stt?: unknown; profile?: string }): Promise<SaveVoiceResult> {
-  const res = await request('PUT', '/admin/voice', config);
+  const res = await request('PUT', '/api/host/voice', config);
   // 401 still throws so the auth gate can re-arm.
   if (res.status === 401) {
     throw Object.assign(new Error('Invalid password.'), { status: 401 });
   }
   // 200 (saved + voice ready), 202 (saved, voice still pulling/starting
-  // in background — caller polls /admin/voice for activeJob), and 502
+  // in background — caller polls /api/host/voice for activeJob), and 502
   // (saved, voice failed) all carry a structured `voiceAddon` payload.
   if (res.status === 200 || res.status === 202 || res.status === 502) {
     const body = (await res.json()) as Omit<SaveVoiceResult, 'status'>;
diff --git a/packages/ui/src/lib/components/admin/assistant/AssistantTab.svelte b/packages/ui/src/lib/components/admin/assistant/AssistantTab.svelte
index e1b8b8467..86d1a7106 100644
--- a/packages/ui/src/lib/components/admin/assistant/AssistantTab.svelte
+++ b/packages/ui/src/lib/components/admin/assistant/AssistantTab.svelte
@@ -1,31 +1,58 @@
 <script lang="ts">
   import { onMount } from 'svelte';
   import Spinner from '$lib/components/common/Spinner.svelte';
-  import { fetchAssistantSettings, saveAssistantSettings } from '$lib/api.js';
+  import {
+    fetchAssistantPersona,
+    fetchHostStackSettings,
+    saveAssistantPersona,
+    saveHostStackSettings,
+  } from '$lib/api.js';
+  import { hasCapability } from '$lib/runtime-context.svelte.js';
   import { notifications } from '$lib/notifications.svelte.js';
 
+  // Phase 4 split (plan ui-runtime-modes-plan.md §5.F, Phase 4 step 2): host
+  // STACK settings (project name, bind address → /api/host/stack) are a
+  // separate concern from ASSISTANT settings (persona → /api/assistant/persona)
+  // with separate capabilities, endpoints, and save actions. hasCapability()
+  // is UX only — both endpoints enforce their capability server-side.
+
   let loading = $state(false);
-  let saving = $state(false);
   let error = $state('');
+
+  // ── Host stack settings (host:stack:write) ─────────────────────────────────
+  let stackSaving = $state(false);
   let projectName = $state('openpalm');
   let lanExposureEnabled = $state(false);
-  let personaPath = $state('config/assistant/persona.md');
   let stackEnvPath = $state('knowledge/env/stack.env');
+
+  // ── Assistant persona (assistant-settings:write) ───────────────────────────
+  let personaSaving = $state(false);
+  let personaPath = $state('config/assistant/persona.md');
   let personaContent = $state('');
   // Snapshot of last-saved persona content for dirty detection.
   let savedPersonaContent = $state('');
 
+  const showStack = hasCapability('host:stack:read');
+  const canEditStack = hasCapability('host:stack:write');
+  const showPersona = hasCapability('assistant-settings:read');
+  const canEditPersona = hasCapability('assistant-settings:write');
+
   async function load(): Promise<void> {
     loading = true;
     error = '';
     try {
-      const data = await fetchAssistantSettings();
-      projectName = data.projectName;
-      lanExposureEnabled = data.lanExposureEnabled;
-      personaPath = data.personaPath;
-      stackEnvPath = data.stackEnvPath;
-      personaContent = data.personaContent;
-      savedPersonaContent = data.personaContent;
+      if (showStack) {
+        const stack = await fetchHostStackSettings();
+        projectName = stack.projectName;
+        lanExposureEnabled = stack.lanExposureEnabled;
+        stackEnvPath = stack.stackEnvPath;
+      }
+      if (showPersona) {
+        const persona = await fetchAssistantPersona();
+        personaPath = persona.personaPath;
+        personaContent = persona.personaContent;
+        savedPersonaContent = persona.personaContent;
+      }
     } catch (e) {
       error = e instanceof Error ? e.message : 'Failed to load assistant settings.';
     } finally {
@@ -33,31 +60,47 @@
     }
   }
 
-  async function save(): Promise<void> {
-    saving = true;
+  async function saveStack(): Promise<void> {
+    stackSaving = true;
     error = '';
     try {
-      const data = await saveAssistantSettings({ projectName, lanExposureEnabled, personaContent });
+      const data = await saveHostStackSettings({ projectName, lanExposureEnabled });
       projectName = data.projectName;
       lanExposureEnabled = data.lanExposureEnabled;
-      personaContent = data.personaContent;
-      savedPersonaContent = data.personaContent;
       notifications.push(
         'success',
         data.projectRenamed
-          ? 'Assistant settings saved. Project name changed — run `openpalm restart` (or `openpalm update`) to move the whole stack to the new project name.'
-          : 'Assistant settings saved. Restart the assistant container to apply them.',
+          ? 'Stack settings saved. Project name changed — run `openpalm restart` (or `openpalm update`) to move the whole stack to the new project name.'
+          : 'Stack settings saved. Restart the assistant container to apply them.',
       );
     } catch (e) {
-      const msg = e instanceof Error ? e.message : 'Failed to save assistant settings.';
+      const msg = e instanceof Error ? e.message : 'Failed to save stack settings.';
+      error = msg;
+      notifications.push('error', msg);
+    } finally {
+      stackSaving = false;
+    }
+  }
+
+  async function savePersona(): Promise<void> {
+    personaSaving = true;
+    error = '';
+    try {
+      const data = await saveAssistantPersona({ personaContent });
+      personaContent = data.personaContent;
+      savedPersonaContent = data.personaContent;
+      notifications.push('success', 'Persona saved. Restart the assistant container to apply it.');
+    } catch (e) {
+      const msg = e instanceof Error ? e.message : 'Failed to save persona.';
       error = msg;
       notifications.push('error', msg);
     } finally {
-      saving = false;
+      personaSaving = false;
     }
   }
 
-  let isDirty = $derived(personaContent !== savedPersonaContent);
+  let saving = $derived(stackSaving || personaSaving);
+  let personaDirty = $derived(personaContent !== savedPersonaContent);
 
   onMount(() => { void load(); });
 </script>
@@ -73,45 +116,61 @@
         {#if loading}<Spinner />{/if}
         Refresh
       </button>
-      {#if isDirty}
-        <span class="unsaved-hint" aria-live="polite">Unsaved changes</span>
-      {/if}
-      <button class="btn btn-primary btn-sm" onclick={() => void save()} disabled={loading || saving || !isDirty}>
-        {#if saving}<Spinner />{/if}
-        Save
-      </button>
     </div>
   </div>
 
   {#if error}<div class="error-banner"><span>{error}</span></div>{/if}
 
   <div class="settings-grid">
-    <section class="settings-card">
-      <h3>Compose Project Name</h3>
-      <p class="section-note">This writes <code>OP_PROJECT_NAME</code> in <code>{stackEnvPath}</code>. If unset, OpenPalm defaults to <code>openpalm</code>.</p>
-      <label class="field" for="project-name">
-        <span>Project name</span>
-        <input id="project-name" class="control-input mono" type="text" spellcheck="false" placeholder="openpalm" bind:value={projectName} disabled={loading || saving} />
-      </label>
-      <p class="field-hint">Lowercase letters, numbers, dashes, and underscores only. This affects Docker Compose naming and collision detection.</p>
-    </section>
-
-    <section class="settings-card">
-      <h3>LAN Exposure</h3>
-      <p class="section-note">This writes <code>OP_ASSISTANT_BIND_ADDRESS</code> in <code>{stackEnvPath}</code>.</p>
-      <label class="field-inline" for="assistant-lan-exposure">
-        <input id="assistant-lan-exposure" type="checkbox" bind:checked={lanExposureEnabled} disabled={loading || saving} />
-        <span>Expose the assistant OpenCode server on the host LAN</span>
-      </label>
-      <p class="field-hint">Off keeps the host bind on <code>127.0.0.1</code>. On switches it to <code>0.0.0.0</code> so other devices on your LAN can reach the host port.</p>
-    </section>
-
-    <section class="settings-card">
-      <h3>Persona</h3>
-      <p class="section-note">Edit the assistant persona markdown mounted into the assistant OpenCode instance.</p>
-      <div class="path-chip">{personaPath}</div>
-      <textarea class="control-input persona-editor mono" rows="20" spellcheck="false" bind:value={personaContent} disabled={loading || saving}></textarea>
-    </section>
+    {#if showStack}
+      <section class="settings-card">
+        <h3>Compose Project Name</h3>
+        <p class="section-note">This writes <code>OP_PROJECT_NAME</code> in <code>{stackEnvPath}</code>. If unset, OpenPalm defaults to <code>openpalm</code>.</p>
+        <label class="field" for="project-name">
+          <span>Project name</span>
+          <input id="project-name" class="control-input mono" type="text" spellcheck="false" placeholder="openpalm" bind:value={projectName} disabled={loading || saving || !canEditStack} />
+        </label>
+        <p class="field-hint">Lowercase letters, numbers, dashes, and underscores only. This affects Docker Compose naming and collision detection.</p>
+      </section>
+
+      <section class="settings-card">
+        <h3>LAN Exposure</h3>
+        <p class="section-note">This writes <code>OP_ASSISTANT_BIND_ADDRESS</code> in <code>{stackEnvPath}</code>.</p>
+        <label class="field-inline" for="assistant-lan-exposure">
+          <input id="assistant-lan-exposure" type="checkbox" bind:checked={lanExposureEnabled} disabled={loading || saving || !canEditStack} />
+          <span>Expose the assistant OpenCode server on the host LAN</span>
+        </label>
+        <p class="field-hint">Off keeps the host bind on <code>127.0.0.1</code>. On switches it to <code>0.0.0.0</code> so other devices on your LAN can reach the host port.</p>
+        {#if canEditStack}
+          <div class="card-actions">
+            <button class="btn btn-primary btn-sm" onclick={() => void saveStack()} disabled={loading || saving}>
+              {#if stackSaving}<Spinner />{/if}
+              Save stack settings
+            </button>
+          </div>
+        {/if}
+      </section>
+    {/if}
+
+    {#if showPersona}
+      <section class="settings-card">
+        <h3>Persona</h3>
+        <p class="section-note">Edit the assistant persona markdown mounted into the assistant OpenCode instance.</p>
+        <div class="path-chip">{personaPath}</div>
+        <textarea class="control-input persona-editor mono" rows="20" spellcheck="false" bind:value={personaContent} disabled={loading || saving || !canEditPersona}></textarea>
+        {#if canEditPersona}
+          <div class="card-actions">
+            {#if personaDirty}
+              <span class="unsaved-hint" aria-live="polite">Unsaved changes</span>
+            {/if}
+            <button class="btn btn-primary btn-sm" onclick={() => void savePersona()} disabled={loading || saving || !personaDirty}>
+              {#if personaSaving}<Spinner />{/if}
+              Save persona
+            </button>
+          </div>
+        {/if}
+      </section>
+    {/if}
   </div>
 </div>
 
@@ -130,6 +189,7 @@
   .path-chip { display: inline-flex; align-items: center; margin-bottom: var(--s-sp-3); padding: var(--s-sp-1) var(--s-sp-2); border-radius: 2px; border: var(--s-hair) solid var(--s-line-soft); background: var(--s-paper-deep); color: var(--s-ink-3); font-family: var(--s-font-mono); font-size: var(--s-type-mark-sm); letter-spacing: var(--s-track-label); }
   .persona-editor { min-height: 26rem; resize: vertical; font-family: var(--s-font-mono) !important; font-size: var(--s-type-mark-sm) !important; background: color-mix(in srgb, var(--s-ink) 2%, var(--s-paper)) !important; border: var(--s-hair) solid var(--s-line-soft) !important; border-bottom: var(--s-hair) solid var(--s-line-soft) !important; border-radius: 2px !important; padding: var(--s-sp-3) !important; color: var(--s-ink-2) !important; }
   .unsaved-hint { font-family: var(--s-font-mono); font-size: var(--s-type-mark-sm); letter-spacing: var(--s-track-label); text-transform: uppercase; color: var(--s-seal); }
+  .card-actions { display: flex; align-items: center; justify-content: flex-end; gap: var(--s-sp-3); margin-top: var(--s-sp-3); }
   input[type="checkbox"] {
     appearance: none;
     width: 1rem; height: 1rem;
diff --git a/packages/ui/src/lib/components/akm/AkmHealthReportSection.svelte b/packages/ui/src/lib/components/akm/AkmHealthReportSection.svelte
index b7bfedfb0..3a8c7cc75 100644
--- a/packages/ui/src/lib/components/akm/AkmHealthReportSection.svelte
+++ b/packages/ui/src/lib/components/akm/AkmHealthReportSection.svelte
@@ -23,7 +23,7 @@
 	let frameSrc = $state<string | null>(null);
 	let loadError = $state('');
 
-	let reportUrl = $derived(`/admin/akm/health-report?since=${encodeURIComponent(reportWindow)}&refresh=${refreshKey}`);
+	let reportUrl = $derived(`/api/host/akm/health-report?since=${encodeURIComponent(reportWindow)}&refresh=${refreshKey}`);
 
 	async function loadReport(): Promise<void> {
 		loading = true;
diff --git a/packages/ui/src/lib/components/akm/AkmTab.svelte b/packages/ui/src/lib/components/akm/AkmTab.svelte
index 49ab31ef8..babd2165c 100644
--- a/packages/ui/src/lib/components/akm/AkmTab.svelte
+++ b/packages/ui/src/lib/components/akm/AkmTab.svelte
@@ -7,6 +7,7 @@
 		saveAkmConfig,
 		testAkmEmbedding,
 	} from '$lib/api.js';
+	import { hasCapability } from '$lib/runtime-context.svelte.js';
 	import { notifications } from '$lib/notifications.svelte.js';
 	import Spinner from '$lib/components/common/Spinner.svelte';
 	import AkmKnowledgeStatsSection from '$lib/components/akm/AkmKnowledgeStatsSection.svelte';
@@ -41,6 +42,13 @@
 	// Host AKM sharing now lives in its own Knowledge sub-tab
 	// (akm/HostSharingSection.svelte) — moved out of this megaform.
 
+	// Phase 4 AkmTab split: the config megaform is ASSISTANT-scoped
+	// (/api/assistant/akm), while index maintenance + diagnostics run docker
+	// commands on the HOST (/api/host/akm/*) — show them only with host
+	// capabilities. hasCapability() is UX only; the endpoints enforce
+	// capabilities server-side.
+	const hostMaintenance = hasCapability('host:containers');
+
 	// ── LLM Profiles ─────────────────────────────────────────────────────────────
 	let llmProfiles = $state<LlmProfile[]>([]);
 	let defaultLlmProfile = $state('');
@@ -358,10 +366,12 @@
 				{#if loading}<Spinner />{/if}
 				Refresh
 			</button>
-			<button class="btn btn-secondary btn-sm" onclick={() => void reindexKnowledge()} disabled={loading || saving || detectingEmbedding || testingEmbedding || reindexing}>
-				{#if reindexing}<Spinner />{/if}
-				Re-index
-			</button>
+			{#if hostMaintenance}
+				<button class="btn btn-secondary btn-sm" onclick={() => void reindexKnowledge()} disabled={loading || saving || detectingEmbedding || testingEmbedding || reindexing}>
+					{#if reindexing}<Spinner />{/if}
+					Re-index
+				</button>
+			{/if}
 			<button class="btn btn-primary btn-sm" onclick={() => void save()} disabled={loading || saving || detectingEmbedding || testingEmbedding || reindexing}>
 				{#if saving}<Spinner />{/if}
 				Save
@@ -389,18 +399,22 @@
 				aria-selected={knowledgeSection === 'behavior'}
 				onclick={() => { knowledgeSection = 'behavior'; }}
 			>Behavior</button>
-			<button
-				role="tab"
-				class="k-tab"
-				class:k-tab--active={knowledgeSection === 'health-report'}
-				aria-selected={knowledgeSection === 'health-report'}
-				onclick={() => { knowledgeSection = 'health-report'; }}
-			>Health Report</button>
+			{#if hostMaintenance}
+				<button
+					role="tab"
+					class="k-tab"
+					class:k-tab--active={knowledgeSection === 'health-report'}
+					aria-selected={knowledgeSection === 'health-report'}
+					onclick={() => { knowledgeSection = 'health-report'; }}
+				>Health Report</button>
+			{/if}
 		</div>
 
 		<!-- ── AI Services group (model/agent/improve connections + embedding) ── -->
 		{#if knowledgeSection === 'ai-services'}
-		<AkmKnowledgeStatsSection disabled={loading || saving || detectingEmbedding || testingEmbedding || reindexing} />
+		{#if hostMaintenance}
+			<AkmKnowledgeStatsSection disabled={loading || saving || detectingEmbedding || testingEmbedding || reindexing} />
+		{/if}
 
 		<p class="section-note section-note--lead">The AI services your assistant uses to build and search its memory — the language models that organize memories, the embedding provider for semantic search, and the maintenance pipeline.</p>
 
@@ -476,7 +490,7 @@
 
 		{/if}<!-- end behavior group -->
 
-		{#if knowledgeSection === 'health-report'}
+		{#if knowledgeSection === 'health-report' && hostMaintenance}
 		<AkmHealthReportSection disabled={loading || saving || detectingEmbedding || testingEmbedding || reindexing} />
 		{/if}
 
diff --git a/packages/ui/src/lib/components/chat/EndpointList.svelte b/packages/ui/src/lib/components/chat/EndpointList.svelte
index f2f1fa5b3..39bef22a2 100644
--- a/packages/ui/src/lib/components/chat/EndpointList.svelte
+++ b/packages/ui/src/lib/components/chat/EndpointList.svelte
@@ -62,7 +62,7 @@
   <div class="divider"></div>
 
   {#if showManageAssistant}
-    <a class="list-item link" href={resolve('/admin')} onclick={() => onChosen?.()}>
+    <a class="list-item link" href={resolve('/host')} onclick={() => onChosen?.()}>
       Manage this assistant…
     </a>
   {/if}
diff --git a/packages/ui/src/lib/components/chrome/ModeSwitch.svelte b/packages/ui/src/lib/components/chrome/ModeSwitch.svelte
index 3b42258f1..37bcb7219 100644
--- a/packages/ui/src/lib/components/chrome/ModeSwitch.svelte
+++ b/packages/ui/src/lib/components/chrome/ModeSwitch.svelte
@@ -11,7 +11,7 @@
   // (selected) on /advanced. Clicking flips between the two. Rendering through
   // ToggleButton keeps it aligned with the other chrome toggles.
   const pathname = $derived(page.url?.pathname ?? '');
-  const onAdmin = $derived(pathname === '/admin' || pathname.startsWith('/admin/'));
+  const onAdmin = $derived(pathname === '/host' || pathname.startsWith('/host/'));
 
   function toggle(): void {
     const enabled = advancedModeService.toggle();
diff --git a/packages/ui/src/lib/components/chrome/SettingsDrawer.svelte b/packages/ui/src/lib/components/chrome/SettingsDrawer.svelte
index 6139cef18..6e5211137 100644
--- a/packages/ui/src/lib/components/chrome/SettingsDrawer.svelte
+++ b/packages/ui/src/lib/components/chrome/SettingsDrawer.svelte
@@ -55,7 +55,7 @@
 
     <nav class="settings-links" aria-label="Settings links">
       {#if showManageAssistant}
-        <a class="settings-link" href={resolve('/admin')} onclick={() => (open = false)}>
+        <a class="settings-link" href={resolve('/host')} onclick={() => (open = false)}>
           Manage this assistant...
         </a>
       {/if}
diff --git a/packages/ui/src/lib/components/voice/voice-mappers.ts b/packages/ui/src/lib/components/voice/voice-mappers.ts
index bb6674f24..6b2a0a140 100644
--- a/packages/ui/src/lib/components/voice/voice-mappers.ts
+++ b/packages/ui/src/lib/components/voice/voice-mappers.ts
@@ -1,5 +1,5 @@
 /**
- * Pure mappers between the server's `/admin/voice` config shape and the
+ * Pure mappers between the server's `/api/host/voice` config shape and the
  * VoiceTab form's simplified 3-engine model (openpalm-voice / remote /
  * browser). Extracted from VoiceTab.svelte so they can be unit-tested
  * without mounting the component.
diff --git a/packages/ui/src/lib/features-admin-hygiene.vitest.ts b/packages/ui/src/lib/features-admin-hygiene.vitest.ts
index 85a1a9bb7..7bd9fdc7a 100644
--- a/packages/ui/src/lib/features-admin-hygiene.vitest.ts
+++ b/packages/ui/src/lib/features-admin-hygiene.vitest.ts
@@ -10,9 +10,9 @@
  * pattern) because the invariant is about where capability logic lives, not
  * runtime behavior: components must consult runtimeContext.routes +
  * hasCapability() so that adding a capability rule stays a one-function
- * change (plan §11). The legacy alias may survive Phase 3 only in
- * hooks.server.ts (computeFeatureFlags) pending Phase 4 — that is server
- * code, deliberately outside this scan.
+ * change (plan §11). Phase 4 deleted the legacy alias entirely
+ * (computeFeatureFlags/FeatureFlags are gone); this scan keeps the read
+ * pattern from ever coming back into components.
  */
 import { describe, expect, test } from 'vitest';
 import { readFileSync, readdirSync } from 'node:fs';
diff --git a/packages/ui/src/lib/resolve-landing.ts b/packages/ui/src/lib/resolve-landing.ts
index cc74407d6..a6c4fdc63 100644
--- a/packages/ui/src/lib/resolve-landing.ts
+++ b/packages/ui/src/lib/resolve-landing.ts
@@ -30,11 +30,10 @@ import type { LocalStackState } from '@openpalm/lib';
 import type { RuntimeContext } from '$lib/types.js';
 
 /**
- * Where the host admin surface lives. Phase 3 keeps the existing /admin.
- * TODO(phase-4): flip to '/host' when /admin is renamed — this constant is
- * the only value that changes.
+ * Where the host admin surface lives. Phase 4 moved it from /admin to /host
+ * (/admin/* is a dead namespace — router 404, no alias).
  */
-export const HOST_ADMIN_LANDING = '/admin';
+export const HOST_ADMIN_LANDING = '/host';
 
 /** Blocking-migration gate: 'pending' blocks; anything else does not.
  *  Nothing produces 'pending' yet — the gate (and the /attention surface it
diff --git a/packages/ui/src/lib/resolve-landing.vitest.ts b/packages/ui/src/lib/resolve-landing.vitest.ts
index e96a957e1..bfcd6fb69 100644
--- a/packages/ui/src/lib/resolve-landing.vitest.ts
+++ b/packages/ui/src/lib/resolve-landing.vitest.ts
@@ -31,10 +31,9 @@
  *      pwa-static, ≥1 connection  → /chat
  *      anything else              → /chat
  *
- * Phase 3 does NOT create /host (that is Phase 4): the host admin landing
- * stays at the existing /admin, encoded in the implementation as a TODO
- * constant so Phase 4 flips exactly one value. When Phase 4 lands, update
- * HOST_ADMIN_LANDING below to '/host' (and nothing else in this file).
+ * Phase 4 moved the host admin landing from /admin to /host; the
+ * HOST_ADMIN_LANDING constant below flipped with it (and nothing else in
+ * this file).
  *
  * The module is loaded through a computed-specifier dynamic import so
  * svelte-check stays clean while the suite is red (same convention as the
@@ -45,8 +44,8 @@ import { existsSync } from 'node:fs';
 import { fileURLToPath } from 'node:url';
 import type { Capability, RuntimeContext, UiHostMode } from '$lib/types.js';
 
-// Phase 3 value. TODO(phase-4): flip to '/host' when /admin is renamed.
-const HOST_ADMIN_LANDING = '/admin';
+// Phase 4 value: the host admin surface moved from /admin to /host.
+const HOST_ADMIN_LANDING = '/host';
 
 // ── module loading (red-state safe) ──────────────────────────────────────────
 
@@ -202,7 +201,7 @@ describe('resolveLanding — host:setup capability present (plan §6.5)', () =>
     expect(resolveLanding(hostCtx, state)).toBe('/setup');
   });
 
-  test(`installed_offline lands on the host admin surface (${HOST_ADMIN_LANDING} until Phase 4)`, async () => {
+  test(`installed_offline lands on the host admin surface (${HOST_ADMIN_LANDING})`, async () => {
     const resolveLanding = await loadResolveLanding();
     const state = makeLaunchState({ local: { state: 'installed_offline' } });
     expect(resolveLanding(hostCtx, state)).toBe(HOST_ADMIN_LANDING);
diff --git a/packages/ui/src/lib/server/endpoints.ts b/packages/ui/src/lib/server/endpoints.ts
index 17f0b20cf..a6775e49f 100644
--- a/packages/ui/src/lib/server/endpoints.ts
+++ b/packages/ui/src/lib/server/endpoints.ts
@@ -482,8 +482,9 @@ export async function listRemoteStatuses(): Promise<RemoteStatus[]> {
 
 // ── Legacy endpoint-language aliases ─────────────────────────────────────────
 // Phase 2 (#486) renamed the internal model to "connection" (plan §6.6). The
-// pre-Phase-2 admin routes and tests still import these names; they are the
-// same functions and go away with `/admin/*` in Phase 4.
+// Legacy endpoint-language aliases: the active-connection consumers (helpers,
+// opencode/http, the assistant proxy) still import these names; they are the
+// same functions. Retire them when those call sites adopt connection language.
 export {
   listConnections as listEndpoints,
   getActiveConnection as getActiveEndpoint,
diff --git a/packages/ui/src/lib/server/features.ts b/packages/ui/src/lib/server/features.ts
index 8cc050876..e4e92b310 100644
--- a/packages/ui/src/lib/server/features.ts
+++ b/packages/ui/src/lib/server/features.ts
@@ -1,7 +1,7 @@
 import type { RequestEvent } from '@sveltejs/kit';
 import { PLATFORM_VERSION } from '@openpalm/lib';
 import uiPkg from '../../../package.json';
-import type { Capability, FeatureFlags, ServerRuntimeContext, UiHostMode } from '$lib/types.js';
+import type { Capability, ServerRuntimeContext, UiHostMode } from '$lib/types.js';
 
 /**
  * Server runtime context — RuntimeContext v2 (plan ui-runtime-modes-plan.md
@@ -84,9 +84,9 @@ const SERVER_CAPABILITIES: Record<UiHostMode, readonly Capability[]> = {
   ],
 };
 
-/** Route pointers per mode — current-truth URLs (pre-Phase-3 route split).
- *  Phase 2 (#486) moved connections to /connections (the /admin/endpoints
- *  alias redirects there for 0.13.0); Phase 4 moves /admin to /host. */
+/** Route pointers per mode — current-truth URLs. Phase 2 (#486) moved
+ *  connections to /connections; Phase 4 moved the host dashboard to /host
+ *  (/admin/* is a dead namespace — router 404, no alias). */
 function routesForMode(mode: UiHostMode): ServerRuntimeContext['routes'] {
   switch (mode) {
     case 'electron-host':
@@ -94,7 +94,7 @@ function routesForMode(mode: UiHostMode): ServerRuntimeContext['routes'] {
       return {
         chat: '/chat',
         connections: '/connections',
-        host: '/admin',
+        host: '/host',
         setup: '/setup',
       };
     case 'assistant-container':
@@ -113,7 +113,9 @@ export function computeServerRuntimeContext(event: RequestEvent): ServerRuntimeC
     version: 2,
     hostMode,
     serverCapabilities: [...SERVER_CAPABILITIES[hostMode]],
-    publicBaseUrl: event.url.origin,
+    // Only publicBaseUrl depends on the event; requireCapability() calls this
+    // from route handlers whose test event stubs may omit `url`.
+    publicBaseUrl: event.url?.origin ?? '',
     uiVersion: uiPkg.version,
     // Skeleton version equals platform version in production (plan §8.2);
     // OP_SKELETON_VERSION is the explicit exact-pin override (plan §3).
@@ -135,17 +137,6 @@ export function computeServerRuntimeContext(event: RequestEvent): ServerRuntimeC
   };
 }
 
-/**
- * Legacy feature flags — kept as a DERIVED ALIAS of the runtime context until
- * the features.admin → hasCapability() migration completes (plan Phase 1).
- *
- * admin: true exactly when the resolved hostMode is host-capable, which
- * preserves the pre-Phase-1 behavior (OP_INSIDE_ELECTRON=1 → electron-host,
- * OP_ENABLE_ADMIN=1 → host-ui, both → admin).
- */
-export function computeFeatureFlags(): FeatureFlags {
-  const hostMode = resolveHostMode();
-  return {
-    admin: hostMode === 'electron-host' || hostMode === 'host-ui',
-  };
-}
+// The legacy computeFeatureFlags() derived alias was deleted in Phase 4: its
+// last readers (the hooks.server.ts route gate and the +layout.server.ts
+// payload) migrated to capability checks, and grep found no other consumer.
diff --git a/packages/ui/src/lib/server/features.vitest.ts b/packages/ui/src/lib/server/features.vitest.ts
index 34a7811fc..e303d5bab 100644
--- a/packages/ui/src/lib/server/features.vitest.ts
+++ b/packages/ui/src/lib/server/features.vitest.ts
@@ -2,13 +2,13 @@
  * Tests for lib/server/features.ts — Phase 1 RuntimeContext v2 (issue #509).
  *
  * TDD status:
- *  - `computeServerRuntimeContext(event)` describes the NOT-YET-IMPLEMENTED
- *    replacement for `FeatureFlags` (plan §6.1 / Phase 1). Those tests are RED
- *    until the implementation lands.
- *  - `computeFeatureFlags` tests are CHARACTERIZATION of the existing
- *    `features.admin` behavior. They pass pre-change and MUST keep passing:
- *    Phase 1 keeps `features.admin` as a derived alias so existing code and
- *    routes work unchanged.
+ *  - `computeServerRuntimeContext(event)` describes the Phase 1 replacement
+ *    for the legacy feature flags (plan §6.1).
+ *  - The `computeFeatureFlags` characterization block that protected the
+ *    `features.admin` derived alias through Phases 1–3 was retired with the
+ *    alias itself in Phase 4 (plan Phase 4 step 4: delete when grep finds no
+ *    reader — the env → hostMode mapping it pinned is covered by the
+ *    `resolveHostMode` tests below).
  *
  * env → hostMode mapping under test (plan Phase 1):
  *   OP_UI_HOST_MODE (explicit) → that mode
@@ -19,7 +19,7 @@
 import { afterEach, beforeEach, describe, expect, test } from 'vitest';
 import type { RequestEvent } from '@sveltejs/kit';
 import type { Capability, UiHostMode } from '$lib/types.js';
-import { computeFeatureFlags, computeServerRuntimeContext } from './features.js';
+import { computeServerRuntimeContext } from './features.js';
 
 // ── helpers ──────────────────────────────────────────────────────────────────
 
@@ -218,23 +218,7 @@ describe('computeServerRuntimeContext — serverCapabilities per hostMode (plan
   });
 });
 
-// ── features.admin alias (CHARACTERIZATION — green pre-change) ───────────────
-// Phase 1 keeps `features.admin` as a derived alias; these pin the legacy
-// env behavior that existing code and routes rely on. Do NOT delete when the
-// implementation lands — they must stay green.
-
-describe('computeFeatureFlags — features.admin alias (characterization)', () => {
-  test('admin is true under OP_INSIDE_ELECTRON=1', () => {
-    process.env.OP_INSIDE_ELECTRON = '1';
-    expect(computeFeatureFlags().admin).toBe(true);
-  });
-
-  test('admin is true under OP_ENABLE_ADMIN=1', () => {
-    process.env.OP_ENABLE_ADMIN = '1';
-    expect(computeFeatureFlags().admin).toBe(true);
-  });
-
-  test('admin is false when neither legacy env is set', () => {
-    expect(computeFeatureFlags().admin).toBe(false);
-  });
-});
+// The features.admin alias characterization block lived here through Phases
+// 1–3. Phase 4 deleted computeFeatureFlags() with its last readers; the
+// legacy env mapping it pinned (OP_INSIDE_ELECTRON / OP_ENABLE_ADMIN) stays
+// covered by the resolveHostMode tests above.
diff --git a/packages/ui/src/lib/server/landing.ts b/packages/ui/src/lib/server/landing.ts
index 0de425198..73e10aae5 100644
--- a/packages/ui/src/lib/server/landing.ts
+++ b/packages/ui/src/lib/server/landing.ts
@@ -86,7 +86,7 @@ async function resolveLaunchRouting(): Promise<LaunchRouting> {
 
 /**
  * Resolve the landing path for a request via resolveLanding() (plan §6.5).
- * May return a path with a query string (e.g. '/admin?tab=diagnostics').
+ * May return a path with a query string (e.g. '/host?tab=diagnostics').
  */
 export async function resolveRequestLanding(event: RequestEvent): Promise<string> {
   const serverCtx = computeServerRuntimeContext(event);
diff --git a/packages/ui/src/lib/server/release-units.ts b/packages/ui/src/lib/server/release-units.ts
index adf818539..37c2f2fa0 100644
--- a/packages/ui/src/lib/server/release-units.ts
+++ b/packages/ui/src/lib/server/release-units.ts
@@ -8,7 +8,7 @@
  * under the platform list for backward compat with pre-unit releases.
  *
  * Pure + side-effect free so it can be unit-tested without mocking the GitHub
- * API. The `/admin/versions/releases` route calls {@link groupReleasesByUnit}
+ * API. The `/api/host/versions/releases` route calls {@link groupReleasesByUnit}
  * after fetching the raw release list.
  */
 
diff --git a/packages/ui/src/lib/types.ts b/packages/ui/src/lib/types.ts
index dda57e3ae..660691bc0 100644
--- a/packages/ui/src/lib/types.ts
+++ b/packages/ui/src/lib/types.ts
@@ -1,14 +1,8 @@
 import type { ToolStripEntry } from '$lib/chat/tool-strip.js';
 
-export interface FeatureFlags {
-  /** Control-plane tools (Docker compose management, stack orchestration).
-   *  DERIVED ALIAS (plan ui-runtime-modes-plan.md Phase 1): true exactly when
-   *  the resolved hostMode is host-capable ('electron-host' | 'host-ui').
-   *  Legacy envs map in via computeServerRuntimeContext: OP_INSIDE_ELECTRON=1
-   *  → electron-host, OP_ENABLE_ADMIN=1 → host-ui. Kept until the
-   *  features.admin → hasCapability() migration completes. */
-  admin: boolean;
-}
+// The legacy FeatureFlags { admin } alias was deleted in Phase 4 (plan
+// ui-runtime-modes-plan.md §6.4): nothing read it anymore — capability checks
+// live in computeServerRuntimeContext/resolveCapabilities + hasCapability().
 
 // ── RuntimeContext v2 (plan §6.1, issue #509) ──────────────────────────
 
diff --git a/packages/ui/src/routes/+layout.server.ts b/packages/ui/src/routes/+layout.server.ts
index a2cfdbd6e..14c9a3b72 100644
--- a/packages/ui/src/routes/+layout.server.ts
+++ b/packages/ui/src/routes/+layout.server.ts
@@ -1,11 +1,8 @@
 import type { LayoutServerLoad } from './$types';
-import { computeFeatureFlags, computeServerRuntimeContext } from '$lib/server/features.js';
+import { computeServerRuntimeContext } from '$lib/server/features.js';
 
 export const load: LayoutServerLoad = (event) => {
   return {
-    // Derived alias — kept until the features.admin → hasCapability()
-    // migration completes (plan ui-runtime-modes-plan.md Phase 1).
-    features: computeFeatureFlags(),
     serverRuntimeContext: computeServerRuntimeContext(event),
   };
 };
diff --git a/packages/ui/src/routes/admin/endpoints/+page.svelte b/packages/ui/src/routes/admin/endpoints/+page.svelte
deleted file mode 100644
index 664ebfae0..000000000
--- a/packages/ui/src/routes/admin/endpoints/+page.svelte
+++ /dev/null
@@ -1,6 +0,0 @@
-<!--
-  /admin/endpoints is a redirect alias to /connections (plan
-  ui-runtime-modes-plan.md Phase 2 step 5, issue #486). The universal load in
-  +page.ts always throws redirect(302, '/connections'), so this component
-  never renders — the management UI lives at routes/connections/+page.svelte.
--->
diff --git a/packages/ui/src/routes/admin/endpoints/+page.ts b/packages/ui/src/routes/admin/endpoints/+page.ts
deleted file mode 100644
index ba0dd582e..000000000
--- a/packages/ui/src/routes/admin/endpoints/+page.ts
+++ /dev/null
@@ -1,16 +0,0 @@
-/**
- * /admin/endpoints → /connections redirect alias (plan
- * ui-runtime-modes-plan.md Phase 2 step 5, issue #486).
- *
- * Connection management moved to the capability-guarded /connections surface.
- * This alias is kept for the 0.13.0 release only — Phase 4 turns /admin/*
- * into 404s. Same convention as the routes/connections/new/+page.ts alias.
- * (The sibling +server.ts JSON API remains for out-of-process callers this
- * release; SvelteKit content-negotiates HTML navigations to this page.)
- */
-import { redirect } from '@sveltejs/kit';
-import type { PageLoad } from './$types';
-
-export const load: PageLoad = () => {
-  redirect(302, '/connections');
-};
diff --git a/packages/ui/src/routes/admin/endpoints/+server.ts b/packages/ui/src/routes/admin/endpoints/+server.ts
deleted file mode 100644
index e013b89c3..000000000
--- a/packages/ui/src/routes/admin/endpoints/+server.ts
+++ /dev/null
@@ -1,76 +0,0 @@
-/**
- * /admin/endpoints — list and create assistant endpoints.
- *
- * The "default" entry is synthesized from environment (OP_OPENCODE_URL etc.)
- * and is always first in the list. User-added endpoints are persisted to
- * config/endpoints.json. Passwords are never returned — only
- * `hasPassword: boolean`.
- */
-import type { RequestHandler } from './$types';
-import {
-  errorResponse,
-  getRequestId,
-  jsonResponse,
-  requireAdmin,
-  withAdminBody,
-} from '$lib/server/helpers.js';
-import {
-  addEndpoint,
-  getActiveEndpoint,
-  listEndpoints,
-  validateEndpointUrl,
-  type ActiveEndpoint,
-} from '$lib/server/endpoints.js';
-
-type PublicEndpoint = {
-  id: string;
-  label: string;
-  url: string;
-  isDefault: boolean;
-  hasPassword: boolean;
-};
-
-function publish(e: ActiveEndpoint): PublicEndpoint {
-  return {
-    id: e.id,
-    label: e.label,
-    url: e.url,
-    isDefault: e.isDefault,
-    hasPassword: Boolean(e.password),
-  };
-}
-
-export const GET: RequestHandler = async (event) => {
-  const requestId = getRequestId(event);
-  const authError = requireAdmin(event, requestId);
-  if (authError) return authError;
-
-  const endpoints = listEndpoints().map(publish);
-  const active = publish(getActiveEndpoint());
-
-  return jsonResponse(200, { endpoints, activeId: active.id }, requestId);
-};
-
-export const POST: RequestHandler = async (event) =>
-  withAdminBody(event, async ({ requestId, body }) => {
-    const label = typeof body.label === 'string' ? body.label : '';
-    const url = typeof body.url === 'string' ? body.url : '';
-    const password = typeof body.password === 'string' && body.password.length > 0 ? body.password : undefined;
-
-    const urlCheck = validateEndpointUrl(url);
-    if (!urlCheck.ok) {
-      return errorResponse(400, 'invalid_endpoint', 'URL must be a valid http(s) URL', {}, requestId);
-    }
-
-    try {
-      const entry = addEndpoint({ label, url: urlCheck.url, password });
-      return jsonResponse(
-        201,
-        { endpoint: publish({ ...entry, kind: entry.kind ?? 'remote-opencode', isDefault: false }) },
-        requestId,
-      );
-    } catch (e) {
-      const msg = e instanceof Error ? e.message : 'failed to create endpoint';
-      return errorResponse(400, 'invalid_endpoint', msg, {}, requestId);
-    }
-  });
diff --git a/packages/ui/src/routes/admin/endpoints/[id]/+server.ts b/packages/ui/src/routes/admin/endpoints/[id]/+server.ts
deleted file mode 100644
index e1e8a9d16..000000000
--- a/packages/ui/src/routes/admin/endpoints/[id]/+server.ts
+++ /dev/null
@@ -1,74 +0,0 @@
-/**
- * /admin/endpoints/[id] — update or delete a user-added endpoint.
- *
- * The "default" id is reserved and cannot be edited or deleted.
- * Passwords are write-only in the API surface — pass `password: null` to
- * clear, a string to set, or omit to leave unchanged.
- */
-import type { RequestHandler } from './$types';
-import {
-  errorResponse,
-  getRequestId,
-  jsonResponse,
-  requireAdmin,
-  withAdminBody,
-} from '$lib/server/helpers.js';
-import {
-  deleteEndpoint,
-  updateEndpoint,
-  validateEndpointUrl,
-  type EndpointPatch,
-} from '$lib/server/endpoints.js';
-
-export const PATCH: RequestHandler = async (event) =>
-  withAdminBody(event, async ({ requestId, body }) => {
-    const id = event.params.id;
-    const patch: EndpointPatch = {};
-    if (typeof body.label === 'string') patch.label = body.label;
-    if (typeof body.url === 'string') {
-      const urlCheck = validateEndpointUrl(body.url);
-      if (!urlCheck.ok) {
-        return errorResponse(400, 'invalid_endpoint', 'URL must be a valid http(s) URL', {}, requestId);
-      }
-      patch.url = urlCheck.url;
-    }
-    if (body.password === null) patch.password = null;
-    else if (typeof body.password === 'string') patch.password = body.password;
-
-    try {
-      const entry = updateEndpoint(id, patch);
-      return jsonResponse(
-        200,
-        {
-          endpoint: {
-            id: entry.id,
-            label: entry.label,
-            url: entry.url,
-            isDefault: false,
-            hasPassword: Boolean(entry.password),
-          },
-        },
-        requestId,
-      );
-    } catch (e) {
-      const msg = e instanceof Error ? e.message : 'failed to update endpoint';
-      const status = msg.startsWith('Endpoint not found') ? 404 : 400;
-      return errorResponse(status, status === 404 ? 'not_found' : 'invalid_endpoint', msg, {}, requestId);
-    }
-  });
-
-export const DELETE: RequestHandler = async (event) => {
-  const requestId = getRequestId(event);
-  const authError = requireAdmin(event, requestId);
-  if (authError) return authError;
-
-  const id = event.params.id;
-  try {
-    deleteEndpoint(id);
-    return jsonResponse(200, { ok: true }, requestId);
-  } catch (e) {
-    const msg = e instanceof Error ? e.message : 'failed to delete endpoint';
-    const status = msg.startsWith('Endpoint not found') ? 404 : 400;
-    return errorResponse(status, status === 404 ? 'not_found' : 'invalid_endpoint', msg, {}, requestId);
-  }
-};
diff --git a/packages/ui/src/routes/admin/endpoints/active/+server.ts b/packages/ui/src/routes/admin/endpoints/active/+server.ts
deleted file mode 100644
index 9e4396d4b..000000000
--- a/packages/ui/src/routes/admin/endpoints/active/+server.ts
+++ /dev/null
@@ -1,41 +0,0 @@
-/**
- * POST /admin/endpoints/active — set the active assistant endpoint.
- *
- * Body: { id: string }  — pass "default" to revert to the env-derived entry.
- */
-import type { RequestHandler } from './$types';
-import {
-  errorResponse,
-  jsonResponse,
-  withAdminBody,
-} from '$lib/server/helpers.js';
-import { setActiveId } from '$lib/server/endpoints.js';
-
-export const POST: RequestHandler = async (event) =>
-  withAdminBody(event, async ({ requestId, body }) => {
-    const id = typeof body.id === 'string' ? body.id : '';
-    if (!id) {
-      return errorResponse(400, 'invalid_request', 'id is required', {}, requestId);
-    }
-
-    try {
-      const active = setActiveId(id);
-      return jsonResponse(
-        200,
-        {
-          activeId: active.id,
-          endpoint: {
-            id: active.id,
-            label: active.label,
-            url: active.url,
-            isDefault: active.isDefault,
-            hasPassword: Boolean(active.password),
-          },
-        },
-        requestId,
-      );
-    } catch (e) {
-      const msg = e instanceof Error ? e.message : 'failed to set active endpoint';
-      return errorResponse(404, 'not_found', msg, {}, requestId);
-    }
-  });
diff --git a/packages/ui/src/routes/admin/endpoints/page.vitest.ts b/packages/ui/src/routes/admin/endpoints/page.vitest.ts
deleted file mode 100644
index f2d85a5ad..000000000
--- a/packages/ui/src/routes/admin/endpoints/page.vitest.ts
+++ /dev/null
@@ -1,58 +0,0 @@
-/**
- * Phase 2 (#486) — /admin/endpoints is a redirect alias to /connections for
- * the 0.13.0 release (plan ui-runtime-modes-plan.md Phase 2 step 5: chat
- * links move to /connections and the old route redirects there; the alias is
- * removed when Phase 4 turns /admin/* into 404s).
- *
- * ALL RED until the implementation lands: routes/admin/endpoints/+page.ts
- * does not exist yet (the route currently renders the management UI from
- * +page.svelte directly). The redirect contract pinned here is a universal
- * load in +page.ts throwing SvelteKit's redirect() — the same convention as
- * the existing root redirect (src/routes/+page.ts → /splash).
- *
- * The module is loaded through a computed-specifier dynamic import so
- * svelte-check stays clean while the suite is red.
- */
-import { describe, expect, test } from 'vitest';
-
-type PageLoadModule = { load: (event: unknown) => unknown };
-
-async function loadPageModule(): Promise<PageLoadModule> {
-  const specifier = './+page.js';
-  return (await import(/* @vite-ignore */ specifier)) as PageLoadModule;
-}
-
-function makeLoadEvent(): unknown {
-  const url = new URL('http://127.0.0.1:3880/admin/endpoints');
-  return {
-    url,
-    params: {},
-    route: { id: '/admin/endpoints' },
-    fetch: globalThis.fetch,
-    data: {},
-    depends: () => {},
-    parent: async () => ({}),
-    untrack: <T>(fn: () => T) => fn(),
-  };
-}
-
-describe('/admin/endpoints → /connections redirect alias (plan Phase 2 step 5)', () => {
-  test('exports a load function', async () => {
-    const mod = await loadPageModule();
-    expect(typeof mod.load).toBe('function');
-  });
-
-  test('load() throws a 3xx redirect to /connections', async () => {
-    const { load } = await loadPageModule();
-    try {
-      await load(makeLoadEvent());
-      throw new Error('expected the load to throw a redirect');
-    } catch (e) {
-      // SvelteKit redirect() throws a { status, location } object.
-      const redirect = e as { status?: number; location?: string };
-      expect(redirect.location).toBe('/connections');
-      expect(redirect.status).toBeGreaterThanOrEqual(300);
-      expect(redirect.status).toBeLessThan(400);
-    }
-  });
-});
diff --git a/packages/ui/src/routes/admin/akm/+server.ts b/packages/ui/src/routes/api/assistant/akm/+server.ts
similarity index 96%
rename from packages/ui/src/routes/admin/akm/+server.ts
rename to packages/ui/src/routes/api/assistant/akm/+server.ts
index 7656bdad6..760de4fd8 100644
--- a/packages/ui/src/routes/admin/akm/+server.ts
+++ b/packages/ui/src/routes/api/assistant/akm/+server.ts
@@ -1,6 +1,13 @@
 /**
- * GET  /admin/akm  — Return current akm config from OP_HOME/config/akm/config.json
- * PATCH /admin/akm — Update config fields aligned with AKM 0.8.0 schema
+ * GET  /api/assistant/akm  — Return current akm config from OP_HOME/config/akm/config.json
+ * PATCH /api/assistant/akm — Update config fields aligned with AKM 0.8.0 schema
+ *
+ * Assistant-SCOPED AKM configuration (plan ui-runtime-modes-plan.md Phase 4
+ * steps 2+3, §6.4): config/akm/config.json is a read/write mount of the
+ * assistant container (plan §6.9), so assistant-container mode CAN edit it.
+ * Guarded by the assistant-settings capabilities in addition to requireAdmin;
+ * pwa-static is refused with 403 even for a valid admin session (plan §8.5).
+ * Host-LEVEL AKM (host key sharing) stays at /api/host/akm/host-sharing.
  */
 import type { RequestHandler } from './$types';
 import { readFileSync, mkdirSync, existsSync } from 'node:fs';
@@ -13,6 +20,7 @@ import {
   parseJsonBody,
   jsonBodyError,
   requireAdmin,
+  requireCapability,
 } from '$lib/server/helpers.js';
 
 type Rec = Record<string, unknown>;
@@ -137,6 +145,8 @@ function validateImproveProcess(proc: Rec, path: string): Error | null {
 
 export const GET: RequestHandler = async (event) => {
   const requestId = getRequestId(event);
+  const capabilityError = requireCapability(event, 'assistant-settings:read', requestId);
+  if (capabilityError) return capabilityError;
   const authError = requireAdmin(event, requestId);
   if (authError) return authError;
 
@@ -146,6 +156,8 @@ export const GET: RequestHandler = async (event) => {
 
 export const PATCH: RequestHandler = async (event) => {
   const requestId = getRequestId(event);
+  const capabilityError = requireCapability(event, 'assistant-settings:write', requestId);
+  if (capabilityError) return capabilityError;
   const authError = requireAdmin(event, requestId);
   if (authError) return authError;
 
diff --git a/packages/ui/src/routes/admin/opencode/model/+server.ts b/packages/ui/src/routes/api/assistant/model/+server.ts
similarity index 87%
rename from packages/ui/src/routes/admin/opencode/model/+server.ts
rename to packages/ui/src/routes/api/assistant/model/+server.ts
index d3d5814e5..f486078c1 100644
--- a/packages/ui/src/routes/admin/opencode/model/+server.ts
+++ b/packages/ui/src/routes/api/assistant/model/+server.ts
@@ -1,6 +1,6 @@
 /**
- * GET  /admin/opencode/model — Return OpenCode's current default + small models.
- * POST /admin/opencode/model — Set OpenCode's default and/or small model.
+ * GET  /api/assistant/model — Return OpenCode's current default + small models.
+ * POST /api/assistant/model — Set OpenCode's default and/or small model.
  *
  * These are OpenCode's own settings — the same fields its desktop UI's
  * Settings → Models tab manages. We only touch opencode.json (via
@@ -10,6 +10,7 @@
 import type { RequestHandler } from './$types';
 import {
 	requireAdmin,
+	requireCapability,
 	jsonResponse,
 	errorResponse,
 	getRequestId,
@@ -21,6 +22,8 @@ import { setMainModel, unsetMainModel } from '$lib/server/opencode/config.js';
 
 export const GET: RequestHandler = async (event) => {
 	const requestId = getRequestId(event);
+	const capabilityError = requireCapability(event, 'assistant-settings:read', requestId);
+	if (capabilityError) return capabilityError;
 	const authError = requireAdmin(event, requestId);
 	if (authError) return authError;
 
@@ -51,6 +54,8 @@ function parseProviderModel(raw: unknown): { provider: string; model: string } |
 
 export const POST: RequestHandler = async (event) => {
 	const requestId = getRequestId(event);
+	const capabilityError = requireCapability(event, 'assistant-settings:write', requestId);
+	if (capabilityError) return capabilityError;
 	const authError = requireAdmin(event, requestId);
 	if (authError) return authError;
 
diff --git a/packages/ui/src/routes/admin/opencode/model/server.vitest.ts b/packages/ui/src/routes/api/assistant/model/server.vitest.ts
similarity index 93%
rename from packages/ui/src/routes/admin/opencode/model/server.vitest.ts
rename to packages/ui/src/routes/api/assistant/model/server.vitest.ts
index 8c172285e..aac836f60 100644
--- a/packages/ui/src/routes/admin/opencode/model/server.vitest.ts
+++ b/packages/ui/src/routes/api/assistant/model/server.vitest.ts
@@ -34,7 +34,7 @@ let originalHome: string | undefined;
 
 function makeEvent(method: string, body?: unknown, token = 'admin-token'): Parameters<typeof GET>[0] {
   return {
-    request: new Request('http://localhost/admin/opencode/model', {
+    request: new Request('http://localhost/api/assistant/model', {
       method,
       headers: {
         'content-type': 'application/json',
@@ -47,6 +47,9 @@ function makeEvent(method: string, body?: unknown, token = 'admin-token'): Param
 }
 
 beforeEach(() => {
+  // Phase 4: /api/host + /api/assistant endpoints are capability-guarded;
+  // run this suite as a host-capable mode.
+  process.env.OP_UI_HOST_MODE = 'host-ui';
   rootDir = makeTempDir();
   originalHome = process.env.OP_HOME;
   process.env.OP_HOME = rootDir;
@@ -54,12 +57,13 @@ beforeEach(() => {
 });
 
 afterEach(() => {
+  delete process.env.OP_UI_HOST_MODE;
   process.env.OP_HOME = originalHome;
   rmSync(rootDir, { recursive: true, force: true });
   vi.clearAllMocks();
 });
 
-describe('/admin/opencode/model route', () => {
+describe('/api/assistant/model route', () => {
   test('requires admin token', async () => {
     const res = await GET(makeEvent('GET', undefined, 'bad-token'));
     expect(res.status).toBe(401);
diff --git a/packages/ui/src/routes/api/assistant/persona/+server.ts b/packages/ui/src/routes/api/assistant/persona/+server.ts
new file mode 100644
index 000000000..e34da422e
--- /dev/null
+++ b/packages/ui/src/routes/api/assistant/persona/+server.ts
@@ -0,0 +1,85 @@
+/**
+ * GET/PUT /api/assistant/persona — the assistant-owned persona markdown
+ * (plan ui-runtime-modes-plan.md Phase 4 step 2, §5.F, §6.4).
+ *
+ * The ASSISTANT-SCOPED half of the old /admin/assistant endpoint. Persona
+ * lives in config/assistant/persona.md — one of the two read/write mounts the
+ * assistant container keeps (plan §6.9) — so assistant-container mode CAN
+ * edit it, while pwa-static (no assistant-settings capability) is refused
+ * with 403 even for a valid admin session (plan §8.5).
+ */
+import { existsSync, mkdirSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import type { RequestHandler } from './$types';
+import { writeFileAtomic } from '@openpalm/lib';
+import { getState } from '$lib/server/state.js';
+import {
+  errorResponse,
+  getRequestId,
+  jsonResponse,
+  requireAdmin,
+  requireCapability,
+  withAdminBody,
+} from '$lib/server/helpers.js';
+
+function personaPath(configDir: string): string {
+  return join(configDir, 'assistant', 'persona.md');
+}
+
+function readPersona(configDir: string): string {
+  const path = personaPath(configDir);
+  if (!existsSync(path)) return '';
+  try {
+    return readFileSync(path, 'utf-8');
+  } catch {
+    return '';
+  }
+}
+
+export const GET: RequestHandler = async (event) => {
+  const requestId = getRequestId(event);
+  const capabilityError = requireCapability(event, 'assistant-settings:read', requestId);
+  if (capabilityError) return capabilityError;
+  const denied = requireAdmin(event, requestId);
+  if (denied) return denied;
+
+  const state = getState();
+  return jsonResponse(
+    200,
+    {
+      personaPath: 'config/assistant/persona.md',
+      personaContent: readPersona(state.configDir),
+    },
+    requestId,
+  );
+};
+
+export const PUT: RequestHandler = async (event) => {
+  const requestId = getRequestId(event);
+  const capabilityError = requireCapability(event, 'assistant-settings:write', requestId);
+  if (capabilityError) return capabilityError;
+
+  return withAdminBody(event, async ({ requestId, body }) => {
+    if (typeof body.personaContent !== 'string') {
+      return errorResponse(400, 'bad_request', 'personaContent must be a string', {}, requestId);
+    }
+
+    const state = getState();
+    const path = personaPath(state.configDir);
+    mkdirSync(join(state.configDir, 'assistant'), { recursive: true });
+    const personaContent = body.personaContent.endsWith('\n')
+      ? body.personaContent
+      : `${body.personaContent}\n`;
+    writeFileAtomic(path, personaContent, 0o644);
+
+    return jsonResponse(
+      200,
+      {
+        ok: true,
+        personaPath: 'config/assistant/persona.md',
+        personaContent,
+      },
+      requestId,
+    );
+  });
+};
diff --git a/packages/ui/src/routes/admin/addons/+server.ts b/packages/ui/src/routes/api/host/addons/+server.ts
similarity index 84%
rename from packages/ui/src/routes/admin/addons/+server.ts
rename to packages/ui/src/routes/api/host/addons/+server.ts
index e3c71d693..e0fb3e0d3 100644
--- a/packages/ui/src/routes/admin/addons/+server.ts
+++ b/packages/ui/src/routes/api/host/addons/+server.ts
@@ -1,6 +1,6 @@
 /**
- * GET  /admin/addons — Return available addons with enabled status.
- * POST /admin/addons — Enable or disable an addon.
+ * GET  /api/host/addons — Return available addons with enabled status.
+ * POST /api/host/addons — Enable or disable an addon.
  */
 import type { RequestHandler } from "./$types";
 import { getState } from "$lib/server/state.js";
@@ -8,6 +8,7 @@ import {
   jsonResponse,
   errorResponse,
   requireAdmin,
+  requireCapability,
   getRequestId,
   parseJsonBody,
   jsonBodyError,
@@ -27,6 +28,8 @@ function buildAddonList(availableIds: string[], enabledIds: string[]): AddonItem
 
 export const GET: RequestHandler = async (event) => {
   const requestId = getRequestId(event);
+  const capabilityError = requireCapability(event, 'host:addons', requestId);
+  if (capabilityError) return capabilityError;
   const authErr = requireAdmin(event, requestId);
   if (authErr) return authErr;
 
@@ -39,6 +42,8 @@ export const GET: RequestHandler = async (event) => {
 
 export const POST: RequestHandler = async (event) => {
   const requestId = getRequestId(event);
+  const capabilityError = requireCapability(event, 'host:addons', requestId);
+  if (capabilityError) return capabilityError;
   const authErr = requireAdmin(event, requestId);
   if (authErr) return authErr;
 
diff --git a/packages/ui/src/routes/admin/addons/[name]/+server.ts b/packages/ui/src/routes/api/host/addons/[name]/+server.ts
similarity index 85%
rename from packages/ui/src/routes/admin/addons/[name]/+server.ts
rename to packages/ui/src/routes/api/host/addons/[name]/+server.ts
index 1c50551f7..e53cf7d84 100644
--- a/packages/ui/src/routes/admin/addons/[name]/+server.ts
+++ b/packages/ui/src/routes/api/host/addons/[name]/+server.ts
@@ -1,6 +1,6 @@
 /**
- * GET  /admin/addons/:name — Return addon detail.
- * POST /admin/addons/:name — Enable or disable an addon.
+ * GET  /api/host/addons/:name — Return addon detail.
+ * POST /api/host/addons/:name — Enable or disable an addon.
  */
 import type { RequestHandler } from "./$types";
 import { getState } from "$lib/server/state.js";
@@ -8,6 +8,7 @@ import {
   jsonResponse,
   errorResponse,
   requireAdmin,
+  requireCapability,
   getRequestId,
   parseJsonBody,
   jsonBodyError,
@@ -24,6 +25,8 @@ const logger = createLogger("addons.name");
 
 export const GET: RequestHandler = async (event) => {
   const requestId = getRequestId(event);
+  const capabilityError = requireCapability(event, 'host:addons', requestId);
+  if (capabilityError) return capabilityError;
   const authErr = requireAdmin(event, requestId);
   if (authErr) return authErr;
 
@@ -48,6 +51,8 @@ export const GET: RequestHandler = async (event) => {
 
 export const POST: RequestHandler = async (event) => {
   const requestId = getRequestId(event);
+  const capabilityError = requireCapability(event, 'host:addons', requestId);
+  if (capabilityError) return capabilityError;
   const authErr = requireAdmin(event, requestId);
   if (authErr) return authErr;
 
diff --git a/packages/ui/src/routes/admin/addons/[name]/credentials/+server.ts b/packages/ui/src/routes/api/host/addons/[name]/credentials/+server.ts
similarity index 94%
rename from packages/ui/src/routes/admin/addons/[name]/credentials/+server.ts
rename to packages/ui/src/routes/api/host/addons/[name]/credentials/+server.ts
index bce80bb89..356bdaf40 100644
--- a/packages/ui/src/routes/admin/addons/[name]/credentials/+server.ts
+++ b/packages/ui/src/routes/api/host/addons/[name]/credentials/+server.ts
@@ -1,7 +1,7 @@
 /**
- * GET  /admin/addons/:name/credentials — Return the addon's .env.schema as
+ * GET  /api/host/addons/:name/credentials — Return the addon's .env.schema as
  *   structured fields plus secret presence metadata.
- * POST /admin/addons/:name/credentials — Write supplied fields into
+ * POST /api/host/addons/:name/credentials — Write supplied fields into
  *   knowledge/secrets/<ENV_KEY> (@sensitive) or knowledge/env/stack.env
  *   (non-sensitive). Split determined by `# @sensitive` schema annotation.
  *   Body shape: { values: { KEY: VALUE | "" } }. Empty strings clear the key.
@@ -17,6 +17,7 @@ import {
   jsonResponse,
   errorResponse,
   requireAdmin,
+  requireCapability,
   getRequestId,
   parseJsonBody,
   jsonBodyError,
@@ -99,6 +100,8 @@ function parseEnvSchema(text: string): SchemaField[] {
 
 export const GET: RequestHandler = async (event) => {
   const requestId = getRequestId(event);
+  const capabilityError = requireCapability(event, 'host:addons', requestId);
+  if (capabilityError) return capabilityError;
   const authErr = requireAdmin(event, requestId);
   if (authErr) return authErr;
 
@@ -141,6 +144,8 @@ export const GET: RequestHandler = async (event) => {
 
 export const POST: RequestHandler = async (event) => {
   const requestId = getRequestId(event);
+  const capabilityError = requireCapability(event, 'host:addons', requestId);
+  if (capabilityError) return capabilityError;
   const authErr = requireAdmin(event, requestId);
   if (authErr) return authErr;
 
diff --git a/packages/ui/src/routes/admin/addons/[name]/server.vitest.ts b/packages/ui/src/routes/api/host/addons/[name]/server.vitest.ts
similarity index 92%
rename from packages/ui/src/routes/admin/addons/[name]/server.vitest.ts
rename to packages/ui/src/routes/api/host/addons/[name]/server.vitest.ts
index b0d0c9d0c..0e9f9e3a3 100644
--- a/packages/ui/src/routes/admin/addons/[name]/server.vitest.ts
+++ b/packages/ui/src/routes/api/host/addons/[name]/server.vitest.ts
@@ -16,7 +16,7 @@ function makeTempDir(): string {
 function makeGetEvent(name: string, token = 'admin-token'): Parameters<typeof GET>[0] {
   return {
     params: { name },
-    request: new Request(`http://localhost/admin/addons/${name}`, {
+    request: new Request(`http://localhost/api/host/addons/${name}`, {
       headers: {
         cookie: `op_session=${token}`,
         'x-request-id': 'req-addon-detail',
@@ -28,7 +28,7 @@ function makeGetEvent(name: string, token = 'admin-token'): Parameters<typeof GE
 function makePostEvent(name: string, body: Record<string, unknown>, token = 'admin-token'): Parameters<typeof POST>[0] {
   return {
     params: { name },
-    request: new Request(`http://localhost/admin/addons/${name}`, {
+    request: new Request(`http://localhost/api/host/addons/${name}`, {
       method: 'POST',
       headers: {
         cookie: `op_session=${token}`,
@@ -61,18 +61,22 @@ function readStackEnvFile(homeDir: string): string {
 let originalHome: string | undefined;
 
 beforeEach(() => {
+  // Phase 4: /api/host + /api/assistant endpoints are capability-guarded;
+  // run this suite as a host-capable mode.
+  process.env.OP_UI_HOST_MODE = 'host-ui';
   originalHome = process.env.OP_HOME;
   process.env.OP_HOME = makeTempDir();
   resetState('admin-token');
 });
 
 afterEach(() => {
+  delete process.env.OP_UI_HOST_MODE;
   process.env.OP_HOME = originalHome;
   cleanupTempDirs();
   rmSync(getState().homeDir, { recursive: true, force: true });
 });
 
-describe('/admin/addons/:name route', () => {
+describe('/api/host/addons/:name route', () => {
   test('requires admin token', async () => {
     const res = await GET(makeGetEvent('discord', 'bad-token'));
     expect(res.status).toBe(401);
@@ -114,7 +118,7 @@ describe('/admin/addons/:name route', () => {
   });
 });
 
-describe('POST /admin/addons/:name', () => {
+describe('POST /api/host/addons/:name', () => {
   test('requires admin token', async () => {
     const res = await POST(makePostEvent('discord', { enabled: true }, 'bad-token'));
     expect(res.status).toBe(401);
diff --git a/packages/ui/src/routes/admin/addons/server.vitest.ts b/packages/ui/src/routes/api/host/addons/server.vitest.ts
similarity index 93%
rename from packages/ui/src/routes/admin/addons/server.vitest.ts
rename to packages/ui/src/routes/api/host/addons/server.vitest.ts
index b6bbee49d..fe25726db 100644
--- a/packages/ui/src/routes/admin/addons/server.vitest.ts
+++ b/packages/ui/src/routes/api/host/addons/server.vitest.ts
@@ -15,7 +15,7 @@ function makeTempDir(): string {
 
 function makeGetEvent(token = 'admin-token'): Parameters<typeof GET>[0] {
   return {
-    request: new Request('http://localhost/admin/addons', {
+    request: new Request('http://localhost/api/host/addons', {
       headers: {
         cookie: `op_session=${token}`,
         'x-request-id': 'req-addons-list',
@@ -26,7 +26,7 @@ function makeGetEvent(token = 'admin-token'): Parameters<typeof GET>[0] {
 
 function makePostEvent(body: Record<string, unknown>, token = 'admin-token'): Parameters<typeof POST>[0] {
   return {
-    request: new Request('http://localhost/admin/addons', {
+    request: new Request('http://localhost/api/host/addons', {
       method: 'POST',
       headers: {
         cookie: `op_session=${token}`,
@@ -59,18 +59,22 @@ function readEnabledAddonsEnv(homeDir: string): string {
 let originalHome: string | undefined;
 
 beforeEach(() => {
+  // Phase 4: /api/host + /api/assistant endpoints are capability-guarded;
+  // run this suite as a host-capable mode.
+  process.env.OP_UI_HOST_MODE = 'host-ui';
   originalHome = process.env.OP_HOME;
   process.env.OP_HOME = makeTempDir();
   resetState('admin-token');
 });
 
 afterEach(() => {
+  delete process.env.OP_UI_HOST_MODE;
   process.env.OP_HOME = originalHome;
   cleanupTempDirs();
   rmSync(getState().homeDir, { recursive: true, force: true });
 });
 
-describe('GET /admin/addons', () => {
+describe('GET /api/host/addons', () => {
   test('requires admin token', async () => {
     const res = await GET(makeGetEvent('bad-token'));
     expect(res.status).toBe(401);
@@ -100,7 +104,7 @@ describe('GET /admin/addons', () => {
   });
 });
 
-describe('POST /admin/addons', () => {
+describe('POST /api/host/addons', () => {
   test('requires admin token', async () => {
     const res = await POST(makePostEvent({ name: 'discord', enabled: true }, 'bad-token'));
     expect(res.status).toBe(401);
diff --git a/packages/ui/src/routes/admin/akm/embedding/detect/+server.ts b/packages/ui/src/routes/api/host/akm/embedding/detect/+server.ts
similarity index 77%
rename from packages/ui/src/routes/admin/akm/embedding/detect/+server.ts
rename to packages/ui/src/routes/api/host/akm/embedding/detect/+server.ts
index 6aa46f7a6..eca858a06 100644
--- a/packages/ui/src/routes/admin/akm/embedding/detect/+server.ts
+++ b/packages/ui/src/routes/api/host/akm/embedding/detect/+server.ts
@@ -1,10 +1,12 @@
 import type { RequestHandler } from './$types';
 import { detectEmbeddingSettings } from '$lib/server/akm.js';
 import { getState } from '$lib/server/state.js';
-import { errorResponse, getRequestId, jsonResponse, requireAdmin } from '$lib/server/helpers.js';
+import { errorResponse, getRequestId, jsonResponse, requireAdmin, requireCapability } from '$lib/server/helpers.js';
 
 export const POST: RequestHandler = async (event) => {
   const requestId = getRequestId(event);
+  const capabilityError = requireCapability(event, 'host:stack:read', requestId);
+  if (capabilityError) return capabilityError;
   const authError = requireAdmin(event, requestId);
   if (authError) return authError;
 
diff --git a/packages/ui/src/routes/admin/akm/embedding/server.vitest.ts b/packages/ui/src/routes/api/host/akm/embedding/server.vitest.ts
similarity index 77%
rename from packages/ui/src/routes/admin/akm/embedding/server.vitest.ts
rename to packages/ui/src/routes/api/host/akm/embedding/server.vitest.ts
index 18489537e..b5483791c 100644
--- a/packages/ui/src/routes/admin/akm/embedding/server.vitest.ts
+++ b/packages/ui/src/routes/api/host/akm/embedding/server.vitest.ts
@@ -35,6 +35,9 @@ function makeEvent(path: string, body?: unknown, token = 'admin-token') {
 }
 
 beforeEach(() => {
+  // Phase 4: /api/host + /api/assistant endpoints are capability-guarded;
+  // run this suite as a host-capable mode.
+  process.env.OP_UI_HOST_MODE = 'host-ui';
 	rootDir = join(tmpdir(), `openpalm-akm-embedding-${randomBytes(4).toString('hex')}`);
 	mkdirSync(rootDir, { recursive: true });
 	originalHome = process.env.OP_HOME;
@@ -44,14 +47,15 @@ beforeEach(() => {
 });
 
 afterEach(() => {
+  delete process.env.OP_UI_HOST_MODE;
 	process.env.OP_HOME = originalHome;
 	rmSync(rootDir, { recursive: true, force: true });
 	vi.restoreAllMocks();
 });
 
-	describe('POST /admin/akm/embedding/detect', () => {
+	describe('POST /api/host/akm/embedding/detect', () => {
 		test('401 without auth', async () => {
-			expect((await detectPOST(makeEvent('/admin/akm/embedding/detect', {}, '') as Parameters<typeof detectPOST>[0])).status).toBe(401);
+			expect((await detectPOST(makeEvent('/api/host/akm/embedding/detect', {}, '') as Parameters<typeof detectPOST>[0])).status).toBe(401);
 		});
 
 	test('returns detected settings', async () => {
@@ -64,7 +68,7 @@ afterEach(() => {
 			message: 'Detected ollama embedding model mxbai-embed-large:latest.',
 		});
 
-			const res = await detectPOST(makeEvent('/admin/akm/embedding/detect', {}) as Parameters<typeof detectPOST>[0]);
+			const res = await detectPOST(makeEvent('/api/host/akm/embedding/detect', {}) as Parameters<typeof detectPOST>[0]);
 			expect(res.status).toBe(200);
 		const body = await res.json() as Record<string, unknown>;
 		expect(body.endpoint).toBe('http://localhost:11434/v1/embeddings');
@@ -72,9 +76,9 @@ afterEach(() => {
 	});
 });
 
-	describe('POST /admin/akm/embedding/test', () => {
+	describe('POST /api/host/akm/embedding/test', () => {
 		test('400 for missing endpoint/model', async () => {
-			expect((await testPOST(makeEvent('/admin/akm/embedding/test', { endpoint: '', model: '' }) as Parameters<typeof testPOST>[0])).status).toBe(400);
+			expect((await testPOST(makeEvent('/api/host/akm/embedding/test', { endpoint: '', model: '' }) as Parameters<typeof testPOST>[0])).status).toBe(400);
 		});
 
 	test('returns the probed dimension', async () => {
@@ -85,7 +89,7 @@ afterEach(() => {
 			provider: 'ollama',
 		});
 
-			const res = await testPOST(makeEvent('/admin/akm/embedding/test', {
+			const res = await testPOST(makeEvent('/api/host/akm/embedding/test', {
 				endpoint: 'http://localhost:11434/v1/embeddings',
 				model: 'mxbai-embed-large:latest',
 				provider: 'ollama',
diff --git a/packages/ui/src/routes/admin/akm/embedding/test/+server.ts b/packages/ui/src/routes/api/host/akm/embedding/test/+server.ts
similarity index 85%
rename from packages/ui/src/routes/admin/akm/embedding/test/+server.ts
rename to packages/ui/src/routes/api/host/akm/embedding/test/+server.ts
index 1d3004af5..6cd82fbb2 100644
--- a/packages/ui/src/routes/admin/akm/embedding/test/+server.ts
+++ b/packages/ui/src/routes/api/host/akm/embedding/test/+server.ts
@@ -1,9 +1,11 @@
 import type { RequestHandler } from './$types';
 import { testEmbeddingSettings } from '$lib/server/akm.js';
-import { errorResponse, getRequestId, jsonBodyError, parseJsonBody, jsonResponse, requireAdmin } from '$lib/server/helpers.js';
+import { errorResponse, getRequestId, jsonBodyError, parseJsonBody, jsonResponse, requireAdmin, requireCapability } from '$lib/server/helpers.js';
 
 export const POST: RequestHandler = async (event) => {
   const requestId = getRequestId(event);
+  const capabilityError = requireCapability(event, 'host:stack:read', requestId);
+  if (capabilityError) return capabilityError;
   const authError = requireAdmin(event, requestId);
   if (authError) return authError;
 
diff --git a/packages/ui/src/routes/admin/akm/health-report/+server.ts b/packages/ui/src/routes/api/host/akm/health-report/+server.ts
similarity index 86%
rename from packages/ui/src/routes/admin/akm/health-report/+server.ts
rename to packages/ui/src/routes/api/host/akm/health-report/+server.ts
index c2f40ee68..c76ba7bd6 100644
--- a/packages/ui/src/routes/admin/akm/health-report/+server.ts
+++ b/packages/ui/src/routes/api/host/akm/health-report/+server.ts
@@ -1,6 +1,6 @@
 import type { RequestHandler } from './$types';
 import { getState } from '$lib/server/state.js';
-import { getRequestId, requireAdmin } from '$lib/server/helpers.js';
+import { getRequestId, requireAdmin, requireCapability } from '$lib/server/helpers.js';
 import { buildAkmHealthReport } from '$lib/server/akm-health-report.js';
 
 const REPORT_CSP = [
@@ -18,6 +18,8 @@ const REPORT_CSP = [
 
 export const GET: RequestHandler = async (event) => {
   const requestId = getRequestId(event);
+  const capabilityError = requireCapability(event, 'host:containers', requestId);
+  if (capabilityError) return capabilityError;
   const denied = requireAdmin(event, requestId);
   if (denied) return denied;
 
diff --git a/packages/ui/src/routes/admin/akm/health-report/server.vitest.ts b/packages/ui/src/routes/api/host/akm/health-report/server.vitest.ts
similarity index 87%
rename from packages/ui/src/routes/admin/akm/health-report/server.vitest.ts
rename to packages/ui/src/routes/api/host/akm/health-report/server.vitest.ts
index 7aff29439..83094dff8 100644
--- a/packages/ui/src/routes/admin/akm/health-report/server.vitest.ts
+++ b/packages/ui/src/routes/api/host/akm/health-report/server.vitest.ts
@@ -19,7 +19,7 @@ import { runAssistantAkmCommand } from '@openpalm/lib';
 let rootDir = '';
 let originalHome: string | undefined;
 
-function makeEvent(path = '/admin/akm/health-report?since=72h', token = 'admin-token') {
+function makeEvent(path = '/api/host/akm/health-report?since=72h', token = 'admin-token') {
   const url = new URL(`http://localhost${path}`);
   return {
     request: new Request(url, {
@@ -35,6 +35,9 @@ function makeEvent(path = '/admin/akm/health-report?since=72h', token = 'admin-t
 }
 
 beforeEach(() => {
+  // Phase 4: /api/host + /api/assistant endpoints are capability-guarded;
+  // run this suite as a host-capable mode.
+  process.env.OP_UI_HOST_MODE = 'host-ui';
   rootDir = join(tmpdir(), `openpalm-akm-health-report-${randomBytes(4).toString('hex')}`);
   mkdirSync(rootDir, { recursive: true });
   originalHome = process.env.OP_HOME;
@@ -44,14 +47,15 @@ beforeEach(() => {
 });
 
 afterEach(() => {
+  delete process.env.OP_UI_HOST_MODE;
   process.env.OP_HOME = originalHome;
   rmSync(rootDir, { recursive: true, force: true });
   vi.restoreAllMocks();
 });
 
-describe('GET /admin/akm/health-report', () => {
+describe('GET /api/host/akm/health-report', () => {
   test('401 without auth', async () => {
-    expect((await GET(makeEvent('/admin/akm/health-report?since=72h', ''))).status).toBe(401);
+    expect((await GET(makeEvent('/api/host/akm/health-report?since=72h', ''))).status).toBe(401);
   });
 
   test('renders html from live akm health --format html', async () => {
@@ -85,7 +89,7 @@ describe('GET /admin/akm/health-report', () => {
       missing: false,
     });
 
-    await GET(makeEvent('/admin/akm/health-report?since=999h'));
+    await GET(makeEvent('/api/host/akm/health-report?since=999h'));
     expect(runAssistantAkmCommand).toHaveBeenCalledWith(
       expect.anything(),
       ['health', '--since=72h', '--format', 'html'],
diff --git a/packages/ui/src/routes/admin/akm/health/+server.ts b/packages/ui/src/routes/api/host/akm/health/+server.ts
similarity index 86%
rename from packages/ui/src/routes/admin/akm/health/+server.ts
rename to packages/ui/src/routes/api/host/akm/health/+server.ts
index ef293f351..f38d3102d 100644
--- a/packages/ui/src/routes/admin/akm/health/+server.ts
+++ b/packages/ui/src/routes/api/host/akm/health/+server.ts
@@ -1,5 +1,5 @@
 /**
- * GET /admin/akm/health — AKM runtime health + index stats for the dashboard.
+ * GET /api/host/akm/health — AKM runtime health + index stats for the dashboard.
  *
  * Runs `akm` inside the live assistant container so the UI shows the same AKM
  * world the assistant actually sees. Fails soft: if the assistant runtime is
@@ -9,11 +9,13 @@
 import type { RequestHandler } from './$types';
 import { runAssistantAkmCommand } from '@openpalm/lib';
 import { getState } from '$lib/server/state.js';
-import { getRequestId, jsonResponse, requireAdmin } from '$lib/server/helpers.js';
+import { getRequestId, jsonResponse, requireAdmin, requireCapability } from '$lib/server/helpers.js';
 import { safeParseJsonObject } from '$lib/server/akm.js';
 
 export const GET: RequestHandler = async (event) => {
   const requestId = getRequestId(event);
+  const capabilityError = requireCapability(event, 'host:containers', requestId);
+  if (capabilityError) return capabilityError;
   const denied = requireAdmin(event, requestId);
   if (denied) return denied;
 
diff --git a/packages/ui/src/routes/admin/akm/host-sharing/+server.ts b/packages/ui/src/routes/api/host/akm/host-sharing/+server.ts
similarity index 70%
rename from packages/ui/src/routes/admin/akm/host-sharing/+server.ts
rename to packages/ui/src/routes/api/host/akm/host-sharing/+server.ts
index 92e697ec3..5e66fa3dc 100644
--- a/packages/ui/src/routes/admin/akm/host-sharing/+server.ts
+++ b/packages/ui/src/routes/api/host/akm/host-sharing/+server.ts
@@ -1,9 +1,9 @@
 /**
  * Host AKM sharing control surface.
  *
- *   GET    /admin/akm/host-sharing  — { enabled, hostStashPath }
- *   PUT    /admin/akm/host-sharing  — enable: set OP_HOST_AKM_STASH + import profiles
- *   DELETE /admin/akm/host-sharing  — disable: unset OP_HOST_AKM_STASH
+ *   GET    /api/host/akm/host-sharing  — { enabled, hostStashPath }
+ *   PUT    /api/host/akm/host-sharing  — enable: set OP_HOST_AKM_STASH + import profiles
+ *   DELETE /api/host/akm/host-sharing  — disable: unset OP_HOST_AKM_STASH
  *
  * /host-stash is always mounted (core.compose.yml). /host-stash is always a
  * secondary akm source. Enable/disable only changes what the compose mount
@@ -20,10 +20,13 @@ import {
   getRequestId,
   jsonResponse,
   requireAdmin,
+  requireCapability,
 } from '$lib/server/helpers.js';
 
 export const GET: RequestHandler = async (event) => {
   const requestId = getRequestId(event);
+  const capabilityError = requireCapability(event, 'host:akm-sharing', requestId);
+  if (capabilityError) return capabilityError;
   const authError = requireAdmin(event, requestId);
   if (authError) return authError;
 
@@ -32,6 +35,8 @@ export const GET: RequestHandler = async (event) => {
 
 export const PUT: RequestHandler = async (event) => {
   const requestId = getRequestId(event);
+  const capabilityError = requireCapability(event, 'host:akm-sharing', requestId);
+  if (capabilityError) return capabilityError;
   const authError = requireAdmin(event, requestId);
   if (authError) return authError;
 
@@ -42,6 +47,8 @@ export const PUT: RequestHandler = async (event) => {
 
 export const DELETE: RequestHandler = async (event) => {
   const requestId = getRequestId(event);
+  const capabilityError = requireCapability(event, 'host:akm-sharing', requestId);
+  if (capabilityError) return capabilityError;
   const authError = requireAdmin(event, requestId);
   if (authError) return authError;
 
diff --git a/packages/ui/src/routes/admin/akm/host-sharing/server.vitest.ts b/packages/ui/src/routes/api/host/akm/host-sharing/server.vitest.ts
similarity index 86%
rename from packages/ui/src/routes/admin/akm/host-sharing/server.vitest.ts
rename to packages/ui/src/routes/api/host/akm/host-sharing/server.vitest.ts
index 4456ed356..76a71629a 100644
--- a/packages/ui/src/routes/admin/akm/host-sharing/server.vitest.ts
+++ b/packages/ui/src/routes/api/host/akm/host-sharing/server.vitest.ts
@@ -1,5 +1,5 @@
 /**
- * Tests for /admin/akm/host-sharing (GET status, PUT enable, DELETE disable).
+ * Tests for /api/host/akm/host-sharing (GET status, PUT enable, DELETE disable).
  *
  * Orchestration lives in @openpalm/lib (unit-tested there); here we assert the
  * HTTP surface: auth gating, response shape, and that the lib orchestrators are
@@ -29,7 +29,7 @@ let rootDir = '';
 let originalHome: string | undefined;
 
 function makeEvent(method: string, body?: unknown, token = 'admin-token') {
-	const url = new URL('http://localhost/admin/akm/host-sharing');
+	const url = new URL('http://localhost/api/host/akm/host-sharing');
 	return {
 		request: new Request(url, {
 			method,
@@ -46,6 +46,9 @@ function makeEvent(method: string, body?: unknown, token = 'admin-token') {
 }
 
 beforeEach(() => {
+  // Phase 4: /api/host + /api/assistant endpoints are capability-guarded;
+  // run this suite as a host-capable mode.
+  process.env.OP_UI_HOST_MODE = 'host-ui';
 	rootDir = join(tmpdir(), `openpalm-host-sharing-${randomBytes(4).toString('hex')}`);
 	mkdirSync(rootDir, { recursive: true });
 	originalHome = process.env.OP_HOME;
@@ -57,12 +60,13 @@ beforeEach(() => {
 });
 
 afterEach(() => {
+  delete process.env.OP_UI_HOST_MODE;
 	process.env.OP_HOME = originalHome;
 	rmSync(rootDir, { recursive: true, force: true });
 	vi.restoreAllMocks();
 });
 
-describe('GET /admin/akm/host-sharing', () => {
+describe('GET /api/host/akm/host-sharing', () => {
 	test('401 without auth', async () => {
 		expect((await GET(makeEvent('GET', undefined, ''))).status).toBe(401);
 	});
@@ -75,7 +79,7 @@ describe('GET /admin/akm/host-sharing', () => {
 	});
 });
 
-describe('PUT /admin/akm/host-sharing', () => {
+describe('PUT /api/host/akm/host-sharing', () => {
 	test('401 without auth', async () => {
 		expect((await PUT(makeEvent('PUT', {}, ''))).status).toBe(401);
 	});
@@ -89,7 +93,7 @@ describe('PUT /admin/akm/host-sharing', () => {
 	});
 });
 
-describe('DELETE /admin/akm/host-sharing', () => {
+describe('DELETE /api/host/akm/host-sharing', () => {
 	test('401 without auth', async () => {
 		expect((await DELETE(makeEvent('DELETE', undefined, ''))).status).toBe(401);
 	});
diff --git a/packages/ui/src/routes/admin/akm/reindex/+server.ts b/packages/ui/src/routes/api/host/akm/reindex/+server.ts
similarity index 82%
rename from packages/ui/src/routes/admin/akm/reindex/+server.ts
rename to packages/ui/src/routes/api/host/akm/reindex/+server.ts
index 611bbfd4f..cd95fd914 100644
--- a/packages/ui/src/routes/admin/akm/reindex/+server.ts
+++ b/packages/ui/src/routes/api/host/akm/reindex/+server.ts
@@ -1,10 +1,12 @@
 import type { RequestHandler } from './$types';
 import { runAssistantAkmCommand } from '@openpalm/lib';
 import { getState } from '$lib/server/state.js';
-import { errorResponse, getRequestId, jsonResponse, requireAdmin } from '$lib/server/helpers.js';
+import { errorResponse, getRequestId, jsonResponse, requireAdmin, requireCapability } from '$lib/server/helpers.js';
 
 export const POST: RequestHandler = async (event) => {
   const requestId = getRequestId(event);
+  const capabilityError = requireCapability(event, 'host:containers', requestId);
+  if (capabilityError) return capabilityError;
   const authError = requireAdmin(event, requestId);
   if (authError) return authError;
 
diff --git a/packages/ui/src/routes/admin/akm/reindex/server.vitest.ts b/packages/ui/src/routes/api/host/akm/reindex/server.vitest.ts
similarity index 86%
rename from packages/ui/src/routes/admin/akm/reindex/server.vitest.ts
rename to packages/ui/src/routes/api/host/akm/reindex/server.vitest.ts
index dbb12d69a..d695b9db0 100644
--- a/packages/ui/src/routes/admin/akm/reindex/server.vitest.ts
+++ b/packages/ui/src/routes/api/host/akm/reindex/server.vitest.ts
@@ -20,7 +20,7 @@ let rootDir = '';
 let originalHome: string | undefined;
 
 function makeEvent(token = 'admin-token') {
-	const url = new URL('http://localhost/admin/akm/reindex');
+	const url = new URL('http://localhost/api/host/akm/reindex');
 	return {
 		request: new Request(url, {
 			method: 'POST',
@@ -37,6 +37,9 @@ function makeEvent(token = 'admin-token') {
 }
 
 beforeEach(() => {
+  // Phase 4: /api/host + /api/assistant endpoints are capability-guarded;
+  // run this suite as a host-capable mode.
+  process.env.OP_UI_HOST_MODE = 'host-ui';
 	rootDir = join(tmpdir(), `openpalm-akm-reindex-${randomBytes(4).toString('hex')}`);
 	mkdirSync(rootDir, { recursive: true });
 	originalHome = process.env.OP_HOME;
@@ -46,12 +49,13 @@ beforeEach(() => {
 });
 
 afterEach(() => {
+  delete process.env.OP_UI_HOST_MODE;
 	process.env.OP_HOME = originalHome;
 	rmSync(rootDir, { recursive: true, force: true });
 	vi.restoreAllMocks();
 });
 
-describe('POST /admin/akm/reindex', () => {
+describe('POST /api/host/akm/reindex', () => {
 	test('401 without auth', async () => {
 		expect((await POST(makeEvent(''))).status).toBe(401);
 	});
diff --git a/packages/ui/src/routes/admin/akm/stats/+server.ts b/packages/ui/src/routes/api/host/akm/stats/+server.ts
similarity index 88%
rename from packages/ui/src/routes/admin/akm/stats/+server.ts
rename to packages/ui/src/routes/api/host/akm/stats/+server.ts
index d882451dd..3dfdc35a5 100644
--- a/packages/ui/src/routes/admin/akm/stats/+server.ts
+++ b/packages/ui/src/routes/api/host/akm/stats/+server.ts
@@ -1,7 +1,7 @@
 import type { RequestHandler } from './$types';
 import { getState } from '$lib/server/state.js';
 import { getAkmStats } from '@openpalm/lib';
-import { errorResponse, getRequestId, jsonResponse, requireAdmin } from '$lib/server/helpers.js';
+import { errorResponse, getRequestId, jsonResponse, requireAdmin, requireCapability } from '$lib/server/helpers.js';
 
 const CACHE_TTL_MS = 15_000;
 
@@ -19,6 +19,8 @@ export function _resetStatsCacheForTests(): void {
 
 export const GET: RequestHandler = async (event) => {
   const requestId = getRequestId(event);
+  const capabilityError = requireCapability(event, 'host:containers', requestId);
+  if (capabilityError) return capabilityError;
   const denied = requireAdmin(event, requestId);
   if (denied) return denied;
 
diff --git a/packages/ui/src/routes/admin/akm/stats/server.vitest.ts b/packages/ui/src/routes/api/host/akm/stats/server.vitest.ts
similarity index 94%
rename from packages/ui/src/routes/admin/akm/stats/server.vitest.ts
rename to packages/ui/src/routes/api/host/akm/stats/server.vitest.ts
index 1b7df77ba..0a191b558 100644
--- a/packages/ui/src/routes/admin/akm/stats/server.vitest.ts
+++ b/packages/ui/src/routes/api/host/akm/stats/server.vitest.ts
@@ -22,7 +22,7 @@ let rootDir = '';
 let originalHome: string | undefined;
 
 function makeEvent(token = 'admin-token'): StatsRequestEvent {
-  const url = new URL('http://localhost/admin/akm/stats');
+  const url = new URL('http://localhost/api/host/akm/stats');
   return {
     request: new Request(url, {
       method: 'GET',
@@ -37,6 +37,9 @@ function makeEvent(token = 'admin-token'): StatsRequestEvent {
 }
 
 beforeEach(() => {
+  // Phase 4: /api/host + /api/assistant endpoints are capability-guarded;
+  // run this suite as a host-capable mode.
+  process.env.OP_UI_HOST_MODE = 'host-ui';
   rootDir = join(tmpdir(), `openpalm-akm-stats-${randomBytes(4).toString('hex')}`);
   mkdirSync(rootDir, { recursive: true });
   originalHome = process.env.OP_HOME;
@@ -47,12 +50,13 @@ beforeEach(() => {
 });
 
 afterEach(() => {
+  delete process.env.OP_UI_HOST_MODE;
   process.env.OP_HOME = originalHome;
   rmSync(rootDir, { recursive: true, force: true });
   vi.restoreAllMocks();
 });
 
-describe('GET /admin/akm/stats', () => {
+describe('GET /api/host/akm/stats', () => {
   test('401 without auth', async () => {
     expect((await GET(makeEvent(''))).status).toBe(401);
   });
diff --git a/packages/ui/src/routes/admin/automations/+server.ts b/packages/ui/src/routes/api/host/automations/+server.ts
similarity index 82%
rename from packages/ui/src/routes/admin/automations/+server.ts
rename to packages/ui/src/routes/api/host/automations/+server.ts
index cc66e1858..9b79604f2 100644
--- a/packages/ui/src/routes/admin/automations/+server.ts
+++ b/packages/ui/src/routes/api/host/automations/+server.ts
@@ -1,5 +1,5 @@
 /**
- * GET /admin/automations — List automation configs from knowledge/tasks/.
+ * GET /api/host/automations — List automation configs from knowledge/tasks/.
  *
  * Read-only endpoint. Automations are AKM task files at
  * ${stashDir}/tasks/*.yml. The scheduler runs as a co-process inside the
@@ -10,12 +10,15 @@ import { getState } from "$lib/server/state.js";
 import {
   jsonResponse,
   requireAdmin,
+  requireCapability,
   getRequestId,
 } from "$lib/server/helpers.js";
 import { loadAutomations } from "@openpalm/lib";
 
 export const GET: RequestHandler = async (event) => {
   const requestId = getRequestId(event);
+  const capabilityError = requireCapability(event, 'host:stack:read', requestId);
+  if (capabilityError) return capabilityError;
   const authErr = requireAdmin(event, requestId);
   if (authErr) return authErr;
 
diff --git a/packages/ui/src/routes/admin/automations/[name]/file/+server.ts b/packages/ui/src/routes/api/host/automations/[name]/file/+server.ts
similarity index 78%
rename from packages/ui/src/routes/admin/automations/[name]/file/+server.ts
rename to packages/ui/src/routes/api/host/automations/[name]/file/+server.ts
index eab208211..ced081bcf 100644
--- a/packages/ui/src/routes/admin/automations/[name]/file/+server.ts
+++ b/packages/ui/src/routes/api/host/automations/[name]/file/+server.ts
@@ -2,9 +2,9 @@
  * Raw editor access to an akm task file in the assistant tasks dir
  * (/stash/tasks = knowledge/tasks), used by the Automations admin tab.
  *
- *   GET    /admin/automations/<name>/file — read raw contents { name, content }
- *   PUT    /admin/automations/<name>/file — write raw contents (body { content })
- *   DELETE /admin/automations/<name>/file — delete the task file
+ *   GET    /api/host/automations/<name>/file — read raw contents { name, content }
+ *   PUT    /api/host/automations/<name>/file — write raw contents (body { content })
+ *   DELETE /api/host/automations/<name>/file — delete the task file
  *
  * `name` is a .yml/.yaml/.md basename; the lib guards against path traversal.
  */
@@ -18,6 +18,7 @@ import {
   parseJsonBody,
   jsonBodyError,
   requireAdmin,
+  requireCapability,
 } from '$lib/server/helpers.js';
 
 function guard(name: string, requestId: string): Response | null {
@@ -27,6 +28,8 @@ function guard(name: string, requestId: string): Response | null {
 
 export const GET: RequestHandler = async (event) => {
   const requestId = getRequestId(event);
+  const capabilityError = requireCapability(event, 'host:stack:read', requestId);
+  if (capabilityError) return capabilityError;
   const authError = requireAdmin(event, requestId);
   if (authError) return authError;
   const name = event.params.name;
@@ -40,6 +43,8 @@ export const GET: RequestHandler = async (event) => {
 
 export const PUT: RequestHandler = async (event) => {
   const requestId = getRequestId(event);
+  const capabilityError = requireCapability(event, 'host:stack:write', requestId);
+  if (capabilityError) return capabilityError;
   const authError = requireAdmin(event, requestId);
   if (authError) return authError;
   const name = event.params.name;
@@ -57,6 +62,8 @@ export const PUT: RequestHandler = async (event) => {
 
 export const DELETE: RequestHandler = async (event) => {
   const requestId = getRequestId(event);
+  const capabilityError = requireCapability(event, 'host:stack:write', requestId);
+  if (capabilityError) return capabilityError;
   const authError = requireAdmin(event, requestId);
   if (authError) return authError;
   const name = event.params.name;
diff --git a/packages/ui/src/routes/admin/automations/[name]/log/+server.ts b/packages/ui/src/routes/api/host/automations/[name]/log/+server.ts
similarity index 87%
rename from packages/ui/src/routes/admin/automations/[name]/log/+server.ts
rename to packages/ui/src/routes/api/host/automations/[name]/log/+server.ts
index ac7eaaca1..135b5dc71 100644
--- a/packages/ui/src/routes/admin/automations/[name]/log/+server.ts
+++ b/packages/ui/src/routes/api/host/automations/[name]/log/+server.ts
@@ -1,5 +1,5 @@
 /**
- * GET /admin/automations/:name/log — Recent execution logs for an automation.
+ * GET /api/host/automations/:name/log — Recent execution logs for an automation.
  *
  * Reads per-run log files from the AKM task log directory:
  *   ${dataDir}/akm/cache/tasks/logs/<id>/<timestamp>.log
@@ -13,6 +13,7 @@ import {
   jsonResponse,
   errorResponse,
   requireAdmin,
+  requireCapability,
   getRequestId,
 } from "$lib/server/helpers.js";
 import { readAutomationLogs } from "@openpalm/lib";
@@ -23,6 +24,8 @@ const MAX_LIMIT = 500;
 
 export const GET: RequestHandler = async (event) => {
   const requestId = getRequestId(event);
+  const capabilityError = requireCapability(event, 'host:logs', requestId);
+  if (capabilityError) return capabilityError;
   const authErr = requireAdmin(event, requestId);
   if (authErr) return authErr;
 
diff --git a/packages/ui/src/routes/admin/automations/[name]/log/server.vitest.ts b/packages/ui/src/routes/api/host/automations/[name]/log/server.vitest.ts
similarity index 93%
rename from packages/ui/src/routes/admin/automations/[name]/log/server.vitest.ts
rename to packages/ui/src/routes/api/host/automations/[name]/log/server.vitest.ts
index a59f63ebf..59476cbe2 100644
--- a/packages/ui/src/routes/admin/automations/[name]/log/server.vitest.ts
+++ b/packages/ui/src/routes/api/host/automations/[name]/log/server.vitest.ts
@@ -18,7 +18,7 @@ function makeLogEvent(
   searchParams: Record<string, string> = {},
   token = 'admin-token',
 ): Parameters<typeof GET>[0] {
-  const url = new URL(`http://localhost/admin/automations/${encodeURIComponent(name)}/log`);
+  const url = new URL(`http://localhost/api/host/automations/${encodeURIComponent(name)}/log`);
   for (const [k, v] of Object.entries(searchParams)) url.searchParams.set(k, v);
   return {
     request: new Request(url, {
@@ -43,18 +43,22 @@ function seedTaskLogs(dataDir: string, id: string, entries: Array<{ ts: string;
 let originalHome: string | undefined;
 
 beforeEach(() => {
+  // Phase 4: /api/host + /api/assistant endpoints are capability-guarded;
+  // run this suite as a host-capable mode.
+  process.env.OP_UI_HOST_MODE = 'host-ui';
   originalHome = process.env.OP_HOME;
   process.env.OP_HOME = makeTempDir();
   resetState('admin-token');
 });
 
 afterEach(() => {
+  delete process.env.OP_UI_HOST_MODE;
   process.env.OP_HOME = originalHome;
   cleanupTempDirs();
   rmSync(getState().homeDir, { recursive: true, force: true });
 });
 
-describe('GET /admin/automations/:name/log', () => {
+describe('GET /api/host/automations/:name/log', () => {
   test('returns 401 when unauthenticated', async () => {
     const res = await GET(makeLogEvent('health-check', {}, 'bad-token'));
     expect(res.status).toBe(401);
diff --git a/packages/ui/src/routes/admin/automations/[name]/run/+server.ts b/packages/ui/src/routes/api/host/automations/[name]/run/+server.ts
similarity index 86%
rename from packages/ui/src/routes/admin/automations/[name]/run/+server.ts
rename to packages/ui/src/routes/api/host/automations/[name]/run/+server.ts
index 615de3560..cb5a90c2d 100644
--- a/packages/ui/src/routes/admin/automations/[name]/run/+server.ts
+++ b/packages/ui/src/routes/api/host/automations/[name]/run/+server.ts
@@ -1,5 +1,5 @@
 /**
- * POST /admin/automations/:name/run — Manually trigger an automation.
+ * POST /api/host/automations/:name/run — Manually trigger an automation.
  *
  * Spawns `akm tasks run <id>` directly (no sentinel files). The task
  * must exist in ${stashDir}/tasks/<name>.yml to be accepted.
@@ -10,6 +10,7 @@ import {
   jsonResponse,
   errorResponse,
   requireAdmin,
+  requireCapability,
   getRequestId,
 } from "$lib/server/helpers.js";
 import {
@@ -22,6 +23,8 @@ const SAFE_NAME_RE = /^[a-zA-Z0-9._-]+(?:\.ya?ml)?$/;
 
 export const POST: RequestHandler = async (event) => {
   const requestId = getRequestId(event);
+  const capabilityError = requireCapability(event, 'host:stack:write', requestId);
+  if (capabilityError) return capabilityError;
   const authErr = requireAdmin(event, requestId);
   if (authErr) return authErr;
 
diff --git a/packages/ui/src/routes/admin/automations/[name]/run/server.vitest.ts b/packages/ui/src/routes/api/host/automations/[name]/run/server.vitest.ts
similarity index 90%
rename from packages/ui/src/routes/admin/automations/[name]/run/server.vitest.ts
rename to packages/ui/src/routes/api/host/automations/[name]/run/server.vitest.ts
index a908a306d..1fab9974d 100644
--- a/packages/ui/src/routes/admin/automations/[name]/run/server.vitest.ts
+++ b/packages/ui/src/routes/api/host/automations/[name]/run/server.vitest.ts
@@ -26,7 +26,7 @@ function makeRunEvent(
   token = 'admin-token',
 ): Parameters<typeof POST>[0] {
   return {
-    request: new Request(`http://localhost/admin/automations/${encodeURIComponent(name)}/run`, {
+    request: new Request(`http://localhost/api/host/automations/${encodeURIComponent(name)}/run`, {
       method: 'POST',
       headers: {
         cookie: `op_session=${token}`,
@@ -49,6 +49,9 @@ function seedInstalledTask(stashDir: string, id: string): void {
 let originalHome: string | undefined;
 
 beforeEach(() => {
+  // Phase 4: /api/host + /api/assistant endpoints are capability-guarded;
+  // run this suite as a host-capable mode.
+  process.env.OP_UI_HOST_MODE = 'host-ui';
   originalHome = process.env.OP_HOME;
   process.env.OP_HOME = makeTempDir();
   resetState('admin-token');
@@ -56,12 +59,13 @@ beforeEach(() => {
 });
 
 afterEach(() => {
+  delete process.env.OP_UI_HOST_MODE;
   process.env.OP_HOME = originalHome;
   cleanupTempDirs();
   rmSync(getState().homeDir, { recursive: true, force: true });
 });
 
-describe('POST /admin/automations/:name/run', () => {
+describe('POST /api/host/automations/:name/run', () => {
   test('returns 401 when unauthenticated', async () => {
     seedInstalledTask(getState().stashDir, 'health-check');
     const res = await POST(makeRunEvent('health-check', 'bad-token'));
diff --git a/packages/ui/src/routes/admin/backups/+server.ts b/packages/ui/src/routes/api/host/backups/+server.ts
similarity index 89%
rename from packages/ui/src/routes/admin/backups/+server.ts
rename to packages/ui/src/routes/api/host/backups/+server.ts
index 10ac473aa..ca350d3a0 100644
--- a/packages/ui/src/routes/admin/backups/+server.ts
+++ b/packages/ui/src/routes/api/host/backups/+server.ts
@@ -3,6 +3,7 @@ import {
   jsonResponse,
   errorResponse,
   requireAdmin,
+  requireCapability,
 } from "$lib/server/helpers.js";
 import { getState } from "$lib/server/state.js";
 import {
@@ -22,6 +23,8 @@ const logger = createLogger("backups-admin");
  */
 export const GET: RequestHandler = async (event) => {
   const requestId = getRequestId(event);
+  const capabilityError = requireCapability(event, 'host:recovery', requestId);
+  if (capabilityError) return capabilityError;
   const authError = requireAdmin(event, requestId);
   if (authError) return authError;
 
@@ -42,6 +45,8 @@ export const GET: RequestHandler = async (event) => {
  */
 export const POST: RequestHandler = async (event) => {
   const requestId = getRequestId(event);
+  const capabilityError = requireCapability(event, 'host:recovery', requestId);
+  if (capabilityError) return capabilityError;
   const authError = requireAdmin(event, requestId);
   if (authError) return authError;
 
diff --git a/packages/ui/src/routes/admin/config/validate/+server.ts b/packages/ui/src/routes/api/host/config/validate/+server.ts
similarity index 85%
rename from packages/ui/src/routes/admin/config/validate/+server.ts
rename to packages/ui/src/routes/api/host/config/validate/+server.ts
index 23a0fbd47..b004897bd 100644
--- a/packages/ui/src/routes/admin/config/validate/+server.ts
+++ b/packages/ui/src/routes/api/host/config/validate/+server.ts
@@ -1,5 +1,5 @@
 /**
- * GET /admin/config/validate — Run environment validation.
+ * GET /api/host/config/validate — Run environment validation.
  *
  * Checks knowledge/env/stack.env and knowledge/secrets for required runtime
  * configuration and non-empty required tokens. No varlock — the in-house
@@ -12,6 +12,7 @@ import { getState } from "$lib/server/state.js";
 import {
   jsonResponse,
   requireAdmin,
+  requireCapability,
   getRequestId,
 } from "$lib/server/helpers.js";
 import { validateProposedState, createLogger } from "@openpalm/lib";
@@ -20,6 +21,8 @@ const logger = createLogger("admin.config.validate");
 
 export const GET: RequestHandler = async (event) => {
   const requestId = getRequestId(event);
+  const capabilityError = requireCapability(event, 'host:stack:read', requestId);
+  if (capabilityError) return capabilityError;
   const authErr = requireAdmin(event, requestId);
   if (authErr) return authErr;
 
diff --git a/packages/ui/src/routes/admin/config/validate/server.vitest.ts b/packages/ui/src/routes/api/host/config/validate/server.vitest.ts
similarity index 89%
rename from packages/ui/src/routes/admin/config/validate/server.vitest.ts
rename to packages/ui/src/routes/api/host/config/validate/server.vitest.ts
index 83d0f13f9..2e2569201 100644
--- a/packages/ui/src/routes/admin/config/validate/server.vitest.ts
+++ b/packages/ui/src/routes/api/host/config/validate/server.vitest.ts
@@ -1,5 +1,5 @@
 /**
- * Tests for GET /admin/config/validate route.
+ * Tests for GET /api/host/config/validate route.
  */
 import { afterEach, beforeEach, describe, expect, test, vi } from "vitest";
 import { join } from "node:path";
@@ -31,6 +31,9 @@ let rootDir = "";
 let originalHome: string | undefined;
 
 beforeEach(() => {
+  // Phase 4: /api/host + /api/assistant endpoints are capability-guarded;
+  // run this suite as a host-capable mode.
+  process.env.OP_UI_HOST_MODE = 'host-ui';
   rootDir = makeTempDir();
   originalHome = process.env.OP_HOME;
   process.env.OP_HOME = rootDir;
@@ -43,6 +46,7 @@ beforeEach(() => {
 });
 
 afterEach(() => {
+  delete process.env.OP_UI_HOST_MODE;
   vi.resetAllMocks();
   process.env.OP_HOME = originalHome;
   rmSync(rootDir, { recursive: true, force: true });
@@ -57,14 +61,14 @@ function makeGetEvent(token = "admin-token"): Parameters<typeof GET>[0] {
     headers.cookie = `op_session=${token}`;
   }
   return {
-    request: new Request("http://localhost/admin/config/validate", {
+    request: new Request("http://localhost/api/host/config/validate", {
       method: "GET",
       headers
     })
   } as Parameters<typeof GET>[0];
 }
 
-describe("GET /admin/config/validate", () => {
+describe("GET /api/host/config/validate", () => {
   test("returns 200 with { ok: true } when validation succeeds", async () => {
     vi.mocked(validateProposedState).mockResolvedValue({
       ok: true,
diff --git a/packages/ui/src/routes/admin/containers/down/+server.ts b/packages/ui/src/routes/api/host/containers/down/+server.ts
similarity index 92%
rename from packages/ui/src/routes/admin/containers/down/+server.ts
rename to packages/ui/src/routes/api/host/containers/down/+server.ts
index 869a17334..daac5085d 100644
--- a/packages/ui/src/routes/admin/containers/down/+server.ts
+++ b/packages/ui/src/routes/api/host/containers/down/+server.ts
@@ -3,6 +3,7 @@ import {
   jsonResponse,
   errorResponse,
   requireAdmin,
+  requireCapability,
   parseJsonBody,
   jsonBodyError
 } from "$lib/server/helpers.js";
@@ -16,6 +17,8 @@ const logger = createLogger("containers-down");
 
 export const POST: RequestHandler = async (event) => {
   const requestId = getRequestId(event);
+  const capabilityError = requireCapability(event, 'host:containers', requestId);
+  if (capabilityError) return capabilityError;
   logger.info("container stop request", { requestId });
   const authError = requireAdmin(event, requestId);
   if (authError) return authError;
diff --git a/packages/ui/src/routes/admin/containers/down/server.vitest.ts b/packages/ui/src/routes/api/host/containers/down/server.vitest.ts
similarity index 88%
rename from packages/ui/src/routes/admin/containers/down/server.vitest.ts
rename to packages/ui/src/routes/api/host/containers/down/server.vitest.ts
index fa3ce57b5..c694e26ae 100644
--- a/packages/ui/src/routes/admin/containers/down/server.vitest.ts
+++ b/packages/ui/src/routes/api/host/containers/down/server.vitest.ts
@@ -1,5 +1,5 @@
 /**
- * Thin route tests for POST /admin/containers/down (3.4 — mutating-endpoint coverage).
+ * Thin route tests for POST /api/host/containers/down (3.4 — mutating-endpoint coverage).
  *
  * Previously untested. Covers: auth gate, invalid service rejection, the
  * docker-unavailable soft-success path, the docker-success path, and a
@@ -25,7 +25,7 @@ import { POST } from './+server.js';
 
 function makePostEvent(token = 'admin-token', body: unknown = { service: 'assistant' }): Parameters<typeof POST>[0] {
   return {
-    request: new Request('http://localhost/admin/containers/down', {
+    request: new Request('http://localhost/api/host/containers/down', {
       method: 'POST',
       headers: { cookie: `op_session=${token}`, 'content-type': 'application/json' },
       body: JSON.stringify(body),
@@ -34,6 +34,9 @@ function makePostEvent(token = 'admin-token', body: unknown = { service: 'assist
 }
 
 beforeEach(() => {
+  // Phase 4: /api/host + /api/assistant endpoints are capability-guarded;
+  // run this suite as a host-capable mode.
+  process.env.OP_UI_HOST_MODE = 'host-ui';
   resetState('admin-token');
   composeStopMock.mockReset();
   checkDockerMock.mockReset();
@@ -43,10 +46,11 @@ beforeEach(() => {
 });
 
 afterEach(() => {
+  delete process.env.OP_UI_HOST_MODE;
   vi.clearAllMocks();
 });
 
-describe('POST /admin/containers/down', () => {
+describe('POST /api/host/containers/down', () => {
   test('requires admin auth', async () => {
     const res = await POST(makePostEvent('bad-token'));
     expect(res.status).toBe(401);
diff --git a/packages/ui/src/routes/admin/containers/events/+server.ts b/packages/ui/src/routes/api/host/containers/events/+server.ts
similarity index 89%
rename from packages/ui/src/routes/admin/containers/events/+server.ts
rename to packages/ui/src/routes/api/host/containers/events/+server.ts
index aff0b39a1..ac43aba56 100644
--- a/packages/ui/src/routes/admin/containers/events/+server.ts
+++ b/packages/ui/src/routes/api/host/containers/events/+server.ts
@@ -3,12 +3,15 @@ import {
   jsonResponse,
   errorResponse,
   requireAdmin,
+  requireCapability,
 } from "$lib/server/helpers.js";
 import { getDockerEvents, checkDocker } from "@openpalm/lib";
 import type { RequestHandler } from "./$types";
 
 export const GET: RequestHandler = async (event) => {
   const requestId = getRequestId(event);
+  const capabilityError = requireCapability(event, 'host:containers', requestId);
+  if (capabilityError) return capabilityError;
   const authError = requireAdmin(event, requestId);
   if (authError) return authError;
 
diff --git a/packages/ui/src/routes/admin/containers/list/+server.ts b/packages/ui/src/routes/api/host/containers/list/+server.ts
similarity index 95%
rename from packages/ui/src/routes/admin/containers/list/+server.ts
rename to packages/ui/src/routes/api/host/containers/list/+server.ts
index 4f667cb5f..636241eae 100644
--- a/packages/ui/src/routes/admin/containers/list/+server.ts
+++ b/packages/ui/src/routes/api/host/containers/list/+server.ts
@@ -2,6 +2,7 @@ import {
   getRequestId,
   jsonResponse,
   requireAdmin,
+  requireCapability,
 } from "$lib/server/helpers.js";
 import { getState } from "$lib/server/state.js";
 import { buildComposeOptions, buildManagedServices } from "@openpalm/lib";
@@ -10,6 +11,8 @@ import type { RequestHandler } from "./$types";
 
 export const GET: RequestHandler = async (event) => {
   const requestId = getRequestId(event);
+  const capabilityError = requireCapability(event, 'host:containers', requestId);
+  if (capabilityError) return capabilityError;
   const authError = requireAdmin(event, requestId);
   if (authError) return authError;
 
diff --git a/packages/ui/src/routes/admin/containers/list/server.vitest.ts b/packages/ui/src/routes/api/host/containers/list/server.vitest.ts
similarity index 90%
rename from packages/ui/src/routes/admin/containers/list/server.vitest.ts
rename to packages/ui/src/routes/api/host/containers/list/server.vitest.ts
index 6ae7e1c05..8d6e96b4b 100644
--- a/packages/ui/src/routes/admin/containers/list/server.vitest.ts
+++ b/packages/ui/src/routes/api/host/containers/list/server.vitest.ts
@@ -29,7 +29,7 @@ function makeTempDir(): string {
 
 function makeGetEvent(token = 'admin-token'): Parameters<typeof GET>[0] {
 	return {
-		request: new Request('http://localhost/admin/containers/list', {
+		request: new Request('http://localhost/api/host/containers/list', {
 			headers: {
 				cookie: `op_session=${token}`,
 				'x-request-id': 'req-containers-list',
@@ -41,18 +41,22 @@ function makeGetEvent(token = 'admin-token'): Parameters<typeof GET>[0] {
 let originalHome: string | undefined;
 
 beforeEach(() => {
+  // Phase 4: /api/host + /api/assistant endpoints are capability-guarded;
+  // run this suite as a host-capable mode.
+  process.env.OP_UI_HOST_MODE = 'host-ui';
 	originalHome = process.env.OP_HOME;
 	process.env.OP_HOME = makeTempDir();
 	resetState('admin-token');
 });
 
 afterEach(() => {
+  delete process.env.OP_UI_HOST_MODE;
 	process.env.OP_HOME = originalHome;
 	cleanupTempDirs();
 	rmSync(getState().homeDir, { recursive: true, force: true });
 });
 
-describe('GET /admin/containers/list', () => {
+describe('GET /api/host/containers/list', () => {
 	test('requires admin auth', async () => {
 		const res = await GET(makeGetEvent('bad-token'));
 		expect(res.status).toBe(401);
diff --git a/packages/ui/src/routes/admin/containers/pull/+server.ts b/packages/ui/src/routes/api/host/containers/pull/+server.ts
similarity index 93%
rename from packages/ui/src/routes/admin/containers/pull/+server.ts
rename to packages/ui/src/routes/api/host/containers/pull/+server.ts
index 5010d4245..b9e631b98 100644
--- a/packages/ui/src/routes/admin/containers/pull/+server.ts
+++ b/packages/ui/src/routes/api/host/containers/pull/+server.ts
@@ -3,6 +3,7 @@ import {
   jsonResponse,
   errorResponse,
   requireAdmin,
+  requireCapability,
 } from "$lib/server/helpers.js";
 import { getState } from "$lib/server/state.js";
 import { withSerialQueue } from "$lib/server/serial-queue.js";
@@ -14,6 +15,8 @@ const logger = createLogger("containers-pull");
 
 export const POST: RequestHandler = async (event) => {
   const requestId = getRequestId(event);
+  const capabilityError = requireCapability(event, 'host:containers', requestId);
+  if (capabilityError) return capabilityError;
   logger.info("pull request received", { requestId });
   const authError = requireAdmin(event, requestId);
   if (authError) return authError;
diff --git a/packages/ui/src/routes/admin/containers/pull/server.vitest.ts b/packages/ui/src/routes/api/host/containers/pull/server.vitest.ts
similarity index 89%
rename from packages/ui/src/routes/admin/containers/pull/server.vitest.ts
rename to packages/ui/src/routes/api/host/containers/pull/server.vitest.ts
index db84f8b8c..e6c101f03 100644
--- a/packages/ui/src/routes/admin/containers/pull/server.vitest.ts
+++ b/packages/ui/src/routes/api/host/containers/pull/server.vitest.ts
@@ -1,5 +1,5 @@
 /**
- * Thin route tests for POST /admin/containers/pull (3.4 — mutating-endpoint coverage).
+ * Thin route tests for POST /api/host/containers/pull (3.4 — mutating-endpoint coverage).
  *
  * Covers: auth gate, docker-unavailable 503, applyStack failure (502), and the
  * success path — the button routes through the single compose driver applyStack
@@ -35,7 +35,7 @@ import { POST } from './+server.js';
 
 function makePostEvent(token = 'admin-token'): Parameters<typeof POST>[0] {
   return {
-    request: new Request('http://localhost/admin/containers/pull', {
+    request: new Request('http://localhost/api/host/containers/pull', {
       method: 'POST',
       headers: { cookie: `op_session=${token}`, 'content-type': 'application/json' },
       body: '{}',
@@ -44,6 +44,9 @@ function makePostEvent(token = 'admin-token'): Parameters<typeof POST>[0] {
 }
 
 beforeEach(() => {
+  // Phase 4: /api/host + /api/assistant endpoints are capability-guarded;
+  // run this suite as a host-capable mode.
+  process.env.OP_UI_HOST_MODE = 'host-ui';
   resetState('admin-token');
   applyStackMock.mockReset();
   checkDockerMock.mockReset();
@@ -55,10 +58,11 @@ beforeEach(() => {
 });
 
 afterEach(() => {
+  delete process.env.OP_UI_HOST_MODE;
   vi.clearAllMocks();
 });
 
-describe('POST /admin/containers/pull', () => {
+describe('POST /api/host/containers/pull', () => {
   test('requires admin auth', async () => {
     const res = await POST(makePostEvent('bad-token'));
     expect(res.status).toBe(401);
diff --git a/packages/ui/src/routes/admin/containers/restart/+server.ts b/packages/ui/src/routes/api/host/containers/restart/+server.ts
similarity index 94%
rename from packages/ui/src/routes/admin/containers/restart/+server.ts
rename to packages/ui/src/routes/api/host/containers/restart/+server.ts
index ab0a8dd3d..d64c21f6a 100644
--- a/packages/ui/src/routes/admin/containers/restart/+server.ts
+++ b/packages/ui/src/routes/api/host/containers/restart/+server.ts
@@ -3,6 +3,7 @@ import {
   jsonResponse,
   errorResponse,
   requireAdmin,
+  requireCapability,
   parseJsonBody,
   jsonBodyError
 } from "$lib/server/helpers.js";
@@ -16,6 +17,8 @@ const logger = createLogger("containers-restart");
 
 export const POST: RequestHandler = async (event) => {
   const requestId = getRequestId(event);
+  const capabilityError = requireCapability(event, 'host:containers', requestId);
+  if (capabilityError) return capabilityError;
   logger.info("container restart request", { requestId });
   const authError = requireAdmin(event, requestId);
   if (authError) return authError;
diff --git a/packages/ui/src/routes/admin/containers/restart/server.vitest.ts b/packages/ui/src/routes/api/host/containers/restart/server.vitest.ts
similarity index 90%
rename from packages/ui/src/routes/admin/containers/restart/server.vitest.ts
rename to packages/ui/src/routes/api/host/containers/restart/server.vitest.ts
index c27026c5e..6530e338b 100644
--- a/packages/ui/src/routes/admin/containers/restart/server.vitest.ts
+++ b/packages/ui/src/routes/api/host/containers/restart/server.vitest.ts
@@ -1,5 +1,5 @@
 /**
- * Thin route tests for POST /admin/containers/restart (3.4 — mutating-endpoint coverage).
+ * Thin route tests for POST /api/host/containers/restart (3.4 — mutating-endpoint coverage).
  *
  * Previously untested. Mirrors containers/up: auth gate, invalid service
  * rejection, docker-unavailable soft-success, docker success, docker error,
@@ -28,7 +28,7 @@ import { POST } from './+server.js';
 
 function makePostEvent(token = 'admin-token', body: unknown = { service: 'assistant' }): Parameters<typeof POST>[0] {
   return {
-    request: new Request('http://localhost/admin/containers/restart', {
+    request: new Request('http://localhost/api/host/containers/restart', {
       method: 'POST',
       headers: { cookie: `op_session=${token}`, 'content-type': 'application/json' },
       body: JSON.stringify(body),
@@ -37,6 +37,9 @@ function makePostEvent(token = 'admin-token', body: unknown = { service: 'assist
 }
 
 beforeEach(() => {
+  // Phase 4: /api/host + /api/assistant endpoints are capability-guarded;
+  // run this suite as a host-capable mode.
+  process.env.OP_UI_HOST_MODE = 'host-ui';
   resetState('admin-token');
   composeRestartMock.mockReset();
   checkDockerMock.mockReset();
@@ -48,10 +51,11 @@ beforeEach(() => {
 });
 
 afterEach(() => {
+  delete process.env.OP_UI_HOST_MODE;
   vi.clearAllMocks();
 });
 
-describe('POST /admin/containers/restart', () => {
+describe('POST /api/host/containers/restart', () => {
   test('requires admin auth', async () => {
     const res = await POST(makePostEvent('bad-token'));
     expect(res.status).toBe(401);
diff --git a/packages/ui/src/routes/admin/containers/stats/+server.ts b/packages/ui/src/routes/api/host/containers/stats/+server.ts
similarity index 90%
rename from packages/ui/src/routes/admin/containers/stats/+server.ts
rename to packages/ui/src/routes/api/host/containers/stats/+server.ts
index 061064def..8d5c90c16 100644
--- a/packages/ui/src/routes/admin/containers/stats/+server.ts
+++ b/packages/ui/src/routes/api/host/containers/stats/+server.ts
@@ -3,6 +3,7 @@ import {
   jsonResponse,
   errorResponse,
   requireAdmin,
+  requireCapability,
 } from "$lib/server/helpers.js";
 import { getState } from "$lib/server/state.js";
 import { buildComposeOptions } from "@openpalm/lib";
@@ -11,6 +12,8 @@ import type { RequestHandler } from "./$types";
 
 export const GET: RequestHandler = async (event) => {
   const requestId = getRequestId(event);
+  const capabilityError = requireCapability(event, 'host:containers', requestId);
+  if (capabilityError) return capabilityError;
   const authError = requireAdmin(event, requestId);
   if (authError) return authError;
 
diff --git a/packages/ui/src/routes/admin/containers/up/+server.ts b/packages/ui/src/routes/api/host/containers/up/+server.ts
similarity index 94%
rename from packages/ui/src/routes/admin/containers/up/+server.ts
rename to packages/ui/src/routes/api/host/containers/up/+server.ts
index 0f4f9f302..926c7634c 100644
--- a/packages/ui/src/routes/admin/containers/up/+server.ts
+++ b/packages/ui/src/routes/api/host/containers/up/+server.ts
@@ -3,6 +3,7 @@ import {
   jsonResponse,
   errorResponse,
   requireAdmin,
+  requireCapability,
   parseJsonBody,
   jsonBodyError
 } from "$lib/server/helpers.js";
@@ -15,6 +16,8 @@ const logger = createLogger("containers-up");
 
 export const POST: RequestHandler = async (event) => {
   const requestId = getRequestId(event);
+  const capabilityError = requireCapability(event, 'host:containers', requestId);
+  if (capabilityError) return capabilityError;
   logger.info("container start request received", { requestId });
   const authError = requireAdmin(event, requestId);
   if (authError) return authError;
diff --git a/packages/ui/src/routes/admin/containers/up/server.vitest.ts b/packages/ui/src/routes/api/host/containers/up/server.vitest.ts
similarity index 90%
rename from packages/ui/src/routes/admin/containers/up/server.vitest.ts
rename to packages/ui/src/routes/api/host/containers/up/server.vitest.ts
index 543a94874..053fc23c1 100644
--- a/packages/ui/src/routes/admin/containers/up/server.vitest.ts
+++ b/packages/ui/src/routes/api/host/containers/up/server.vitest.ts
@@ -1,5 +1,5 @@
 /**
- * Thin route tests for POST /admin/containers/up (3.4 — mutating-endpoint coverage).
+ * Thin route tests for POST /api/host/containers/up (3.4 — mutating-endpoint coverage).
  *
  * Previously untested. Covers: auth gate, invalid service rejection, the
  * docker-unavailable soft-success path, the docker-success path, a docker
@@ -28,7 +28,7 @@ import { POST } from './+server.js';
 
 function makePostEvent(token = 'admin-token', body: unknown = { service: 'assistant' }): Parameters<typeof POST>[0] {
   return {
-    request: new Request('http://localhost/admin/containers/up', {
+    request: new Request('http://localhost/api/host/containers/up', {
       method: 'POST',
       headers: { cookie: `op_session=${token}`, 'content-type': 'application/json' },
       body: JSON.stringify(body),
@@ -37,6 +37,9 @@ function makePostEvent(token = 'admin-token', body: unknown = { service: 'assist
 }
 
 beforeEach(() => {
+  // Phase 4: /api/host + /api/assistant endpoints are capability-guarded;
+  // run this suite as a host-capable mode.
+  process.env.OP_UI_HOST_MODE = 'host-ui';
   resetState('admin-token');
   composeStartMock.mockReset();
   checkDockerMock.mockReset();
@@ -48,10 +51,11 @@ beforeEach(() => {
 });
 
 afterEach(() => {
+  delete process.env.OP_UI_HOST_MODE;
   vi.clearAllMocks();
 });
 
-describe('POST /admin/containers/up', () => {
+describe('POST /api/host/containers/up', () => {
   test('requires admin auth', async () => {
     const res = await POST(makePostEvent('bad-token'));
     expect(res.status).toBe(401);
diff --git a/packages/ui/src/routes/admin/health/+server.ts b/packages/ui/src/routes/api/host/health/+server.ts
similarity index 84%
rename from packages/ui/src/routes/admin/health/+server.ts
rename to packages/ui/src/routes/api/host/health/+server.ts
index 2c09fc8a2..bd4221e4a 100644
--- a/packages/ui/src/routes/admin/health/+server.ts
+++ b/packages/ui/src/routes/api/host/health/+server.ts
@@ -1,5 +1,5 @@
 /**
- * GET /admin/health
+ * GET /api/host/health
  *
  * Returns the admin service status and whether the OpenCode (assistant)
  * server is reachable. Used as the session probe on the admin and chat pages.
@@ -9,11 +9,13 @@
  * caller decides how to surface assistant unavailability.
  */
 import type { RequestHandler } from './$types';
-import { requireAdmin, jsonResponse, getRequestId } from '$lib/server/helpers.js';
+import { requireAdmin, requireCapability, jsonResponse, getRequestId } from '$lib/server/helpers.js';
 import { getActiveEndpoint } from '$lib/server/endpoints.js';
 
 export const GET: RequestHandler = async (event) => {
 	const requestId = getRequestId(event);
+	const capabilityError = requireCapability(event, 'host:stack:read', requestId);
+	if (capabilityError) return capabilityError;
 	const authError = requireAdmin(event, requestId);
 	if (authError) return authError;
 
diff --git a/packages/ui/src/routes/admin/health/server.vitest.ts b/packages/ui/src/routes/api/host/health/legacy-server.vitest.ts
similarity index 92%
rename from packages/ui/src/routes/admin/health/server.vitest.ts
rename to packages/ui/src/routes/api/host/health/legacy-server.vitest.ts
index c1a284ab7..bff877e2d 100644
--- a/packages/ui/src/routes/admin/health/server.vitest.ts
+++ b/packages/ui/src/routes/api/host/health/legacy-server.vitest.ts
@@ -1,5 +1,5 @@
 /**
- * Tests for GET /admin/health.
+ * Tests for GET /api/host/health.
  *
  * Asserts:
  *  - 401 without auth
@@ -32,7 +32,7 @@ import { GET } from './+server.js';
 
 function makeEvent(token = 'admin-token') {
   return {
-    request: new Request('http://localhost/admin/health', {
+    request: new Request('http://localhost/api/host/health', {
       headers: {
         cookie: token ? `op_session=${token}` : '',
         'x-request-id': 'req-health-1',
@@ -45,6 +45,9 @@ let rootDir = '';
 let originalHome: string | undefined;
 
 beforeEach(() => {
+  // Phase 4: /api/host + /api/assistant endpoints are capability-guarded;
+  // run this suite as a host-capable mode.
+  process.env.OP_UI_HOST_MODE = 'host-ui';
   rootDir = join(tmpdir(), `openpalm-health-test-${randomBytes(4).toString('hex')}`);
   mkdirSync(rootDir, { recursive: true });
   originalHome = process.env.OP_HOME;
@@ -53,12 +56,13 @@ beforeEach(() => {
 });
 
 afterEach(() => {
+  delete process.env.OP_UI_HOST_MODE;
   process.env.OP_HOME = originalHome;
   rmSync(rootDir, { recursive: true, force: true });
   vi.restoreAllMocks();
 });
 
-describe('GET /admin/health', () => {
+describe('GET /api/host/health', () => {
   test('returns 401 without auth', async () => {
     const res = await GET(makeEvent(''));
     expect(res.status).toBe(401);
diff --git a/packages/ui/src/routes/admin/install/+server.ts b/packages/ui/src/routes/api/host/install/+server.ts
similarity index 95%
rename from packages/ui/src/routes/admin/install/+server.ts
rename to packages/ui/src/routes/api/host/install/+server.ts
index 94f61d059..1a883b7e2 100644
--- a/packages/ui/src/routes/admin/install/+server.ts
+++ b/packages/ui/src/routes/api/host/install/+server.ts
@@ -3,6 +3,7 @@ import {
   getRequestId,
   jsonResponse,
   requireAdmin,
+  requireCapability,
 } from "$lib/server/helpers.js";
 import { getState } from "$lib/server/state.js";
 import { withSerialQueue } from "$lib/server/serial-queue.js";
@@ -21,6 +22,8 @@ const logger = createLogger("install");
 
 export const POST: RequestHandler = async (event) => {
   const requestId = getRequestId(event);
+  const capabilityError = requireCapability(event, 'host:setup', requestId);
+  if (capabilityError) return capabilityError;
   logger.info("install request received", { requestId });
   const authError = requireAdmin(event, requestId);
   if (authError) return authError;
diff --git a/packages/ui/src/routes/admin/install/server.vitest.ts b/packages/ui/src/routes/api/host/install/server.vitest.ts
similarity index 94%
rename from packages/ui/src/routes/admin/install/server.vitest.ts
rename to packages/ui/src/routes/api/host/install/server.vitest.ts
index 3093e2f67..79cccfa08 100644
--- a/packages/ui/src/routes/admin/install/server.vitest.ts
+++ b/packages/ui/src/routes/api/host/install/server.vitest.ts
@@ -1,5 +1,5 @@
 /**
- * Route-level tests for POST /admin/install.
+ * Route-level tests for POST /api/host/install.
  *
  * Phase 3: the route is now a thin wrapper over applyInstall() (files) +
  * applyStack() (containers). Pull failure is FATAL (§6). These tests verify
@@ -40,7 +40,7 @@ import { POST } from './+server.js';
 
 function makePostEvent(token = 'admin-token'): Parameters<typeof POST>[0] {
   return {
-    request: new Request('http://localhost/admin/install', {
+    request: new Request('http://localhost/api/host/install', {
       method: 'POST',
       headers: {
         cookie: `op_session=${token}`,
@@ -53,6 +53,9 @@ function makePostEvent(token = 'admin-token'): Parameters<typeof POST>[0] {
 }
 
 beforeEach(() => {
+  // Phase 4: /api/host + /api/assistant endpoints are capability-guarded;
+  // run this suite as a host-capable mode.
+  process.env.OP_UI_HOST_MODE = 'host-ui';
   resetState('admin-token');
   applyInstallMock.mockReset();
   applyStackMock.mockReset();
@@ -64,13 +67,14 @@ beforeEach(() => {
 });
 
 afterEach(() => {
+  delete process.env.OP_UI_HOST_MODE;
   vi.clearAllMocks();
   // The lock-contention test writes a foreign-held .install.lock into the
   // (test-shared) dataDir; remove it so it can't wedge later tests.
   rmSync(join(getState().dataDir, '.install.lock'), { force: true });
 });
 
-describe('POST /admin/install', () => {
+describe('POST /api/host/install', () => {
   test('requires admin auth', async () => {
     const res = await POST(makePostEvent('bad-token'));
     expect(res.status).toBe(401);
diff --git a/packages/ui/src/routes/admin/logs/+server.ts b/packages/ui/src/routes/api/host/logs/+server.ts
similarity index 92%
rename from packages/ui/src/routes/admin/logs/+server.ts
rename to packages/ui/src/routes/api/host/logs/+server.ts
index 25c2e48f0..699410541 100644
--- a/packages/ui/src/routes/admin/logs/+server.ts
+++ b/packages/ui/src/routes/api/host/logs/+server.ts
@@ -1,5 +1,5 @@
 /**
- * GET /admin/logs — Retrieve docker compose service logs.
+ * GET /api/host/logs — Retrieve docker compose service logs.
  */
 import type { RequestHandler } from "./$types";
 import { getState } from "$lib/server/state.js";
@@ -7,6 +7,7 @@ import {
   jsonResponse,
   errorResponse,
   requireAdmin,
+  requireCapability,
   getRequestId,
 } from "$lib/server/helpers.js";
 import { buildComposeOptions, isAllowedService } from "@openpalm/lib";
@@ -14,6 +15,8 @@ import { composeLogs, checkDocker } from "@openpalm/lib";
 
 export const GET: RequestHandler = async (event) => {
   const requestId = getRequestId(event);
+  const capabilityError = requireCapability(event, 'host:logs', requestId);
+  if (capabilityError) return capabilityError;
   const authError = requireAdmin(event, requestId);
   if (authError) return authError;
 
diff --git a/packages/ui/src/routes/admin/opencode/providers/[id]/auth/+server.ts b/packages/ui/src/routes/api/host/opencode/providers/[id]/auth/+server.ts
similarity index 93%
rename from packages/ui/src/routes/admin/opencode/providers/[id]/auth/+server.ts
rename to packages/ui/src/routes/api/host/opencode/providers/[id]/auth/+server.ts
index fddae8330..ad505e220 100644
--- a/packages/ui/src/routes/admin/opencode/providers/[id]/auth/+server.ts
+++ b/packages/ui/src/routes/api/host/opencode/providers/[id]/auth/+server.ts
@@ -1,6 +1,7 @@
 import type { RequestHandler } from './$types';
 import {
   requireAdmin,
+  requireCapability,
   jsonResponse,
   errorResponse,
   getRequestId,
@@ -43,6 +44,8 @@ function purgeExpiredSessions(): void {
 
 export const GET: RequestHandler = async (event) => {
   const requestId = getRequestId(event);
+  const capabilityError = requireCapability(event, 'host:secrets', requestId);
+  if (capabilityError) return capabilityError;
   const authError = requireAdmin(event, requestId);
   if (authError) return authError;
 
@@ -84,6 +87,8 @@ export const GET: RequestHandler = async (event) => {
 
 export const POST: RequestHandler = async (event) => {
   const requestId = getRequestId(event);
+  const capabilityError = requireCapability(event, 'host:secrets', requestId);
+  if (capabilityError) return capabilityError;
   const authError = requireAdmin(event, requestId);
   if (authError) return authError;
 
@@ -165,11 +170,13 @@ export const POST: RequestHandler = async (event) => {
 };
 
 /**
- * DELETE /admin/opencode/providers/:id/auth — Disconnect a provider by
+ * DELETE /api/host/opencode/providers/:id/auth — Disconnect a provider by
  * removing its credential from OpenCode's auth.json.
  */
 export const DELETE: RequestHandler = async (event) => {
   const requestId = getRequestId(event);
+  const capabilityError = requireCapability(event, 'host:secrets', requestId);
+  if (capabilityError) return capabilityError;
   const authError = requireAdmin(event, requestId);
   if (authError) return authError;
 
diff --git a/packages/ui/src/routes/admin/opencode/providers/[id]/auth/server.vitest.ts b/packages/ui/src/routes/api/host/opencode/providers/[id]/auth/server.vitest.ts
similarity index 97%
rename from packages/ui/src/routes/admin/opencode/providers/[id]/auth/server.vitest.ts
rename to packages/ui/src/routes/api/host/opencode/providers/[id]/auth/server.vitest.ts
index 9a14d0c07..b5d6636cf 100644
--- a/packages/ui/src/routes/admin/opencode/providers/[id]/auth/server.vitest.ts
+++ b/packages/ui/src/routes/api/host/opencode/providers/[id]/auth/server.vitest.ts
@@ -43,7 +43,7 @@ function makeEvent(
   },
 ): Parameters<typeof GET>[0] {
   const providerId = options?.providerId ?? 'openai';
-  const url = new URL(`http://localhost/admin/opencode/providers/${providerId}/auth`);
+  const url = new URL(`http://localhost/api/host/opencode/providers/${providerId}/auth`);
   if (options?.search) {
     url.search = options.search;
   }
@@ -64,6 +64,9 @@ function makeEvent(
 }
 
 beforeEach(() => {
+  // Phase 4: /api/host + /api/assistant endpoints are capability-guarded;
+  // run this suite as a host-capable mode.
+  process.env.OP_UI_HOST_MODE = 'host-ui';
   vi.useRealTimers();
   rootDir = makeTempDir();
   originalHome = process.env.OP_HOME;
@@ -72,13 +75,14 @@ beforeEach(() => {
 });
 
 afterEach(() => {
+  delete process.env.OP_UI_HOST_MODE;
   vi.useRealTimers();
   process.env.OP_HOME = originalHome;
   rmSync(rootDir, { recursive: true, force: true });
   vi.clearAllMocks();
 });
 
-describe('/admin/opencode/providers/[id]/auth route', () => {
+describe('/api/host/opencode/providers/[id]/auth route', () => {
   // ── Auth ────────────────────────────────────────────────────────────
   test('requires admin token', async () => {
     const res = await POST(makeEvent('POST', {
diff --git a/packages/ui/src/routes/admin/opencode/providers/[id]/models/+server.ts b/packages/ui/src/routes/api/host/opencode/providers/[id]/models/+server.ts
similarity index 79%
rename from packages/ui/src/routes/admin/opencode/providers/[id]/models/+server.ts
rename to packages/ui/src/routes/api/host/opencode/providers/[id]/models/+server.ts
index 4f2b622b2..cd220316e 100644
--- a/packages/ui/src/routes/admin/opencode/providers/[id]/models/+server.ts
+++ b/packages/ui/src/routes/api/host/opencode/providers/[id]/models/+server.ts
@@ -1,9 +1,11 @@
 import type { RequestHandler } from './$types';
-import { requireAdmin, jsonResponse, getRequestId, errorResponse, getOpenCodeClient } from '$lib/server/helpers.js';
+import { requireAdmin, requireCapability, jsonResponse, getRequestId, errorResponse, getOpenCodeClient } from '$lib/server/helpers.js';
 import { sanitizeOpenCodeModels } from '$lib/opencode/provider-models.js';
 
 export const GET: RequestHandler = async (event) => {
   const requestId = getRequestId(event);
+  const capabilityError = requireCapability(event, 'host:secrets', requestId);
+  if (capabilityError) return capabilityError;
   const authError = requireAdmin(event, requestId);
   if (authError) return authError;
 
diff --git a/packages/ui/src/routes/admin/opencode/providers/[id]/models/server.vitest.ts b/packages/ui/src/routes/api/host/opencode/providers/[id]/models/server.vitest.ts
similarity index 88%
rename from packages/ui/src/routes/admin/opencode/providers/[id]/models/server.vitest.ts
rename to packages/ui/src/routes/api/host/opencode/providers/[id]/models/server.vitest.ts
index 49ea0d400..fbd7264d9 100644
--- a/packages/ui/src/routes/admin/opencode/providers/[id]/models/server.vitest.ts
+++ b/packages/ui/src/routes/api/host/opencode/providers/[id]/models/server.vitest.ts
@@ -28,7 +28,7 @@ let originalHome: string | undefined;
 function makeEvent(providerId = 'openai', token = 'admin-token'): Parameters<typeof GET>[0] {
   return {
     params: { id: providerId },
-    request: new Request(`http://localhost/admin/opencode/providers/${providerId}/models`, {
+    request: new Request(`http://localhost/api/host/opencode/providers/${providerId}/models`, {
       headers: {
         cookie: `op_session=${token}`,
         'x-request-id': 'req-models',
@@ -38,6 +38,9 @@ function makeEvent(providerId = 'openai', token = 'admin-token'): Parameters<typ
 }
 
 beforeEach(() => {
+  // Phase 4: /api/host + /api/assistant endpoints are capability-guarded;
+  // run this suite as a host-capable mode.
+  process.env.OP_UI_HOST_MODE = 'host-ui';
   rootDir = makeTempDir();
   originalHome = process.env.OP_HOME;
   process.env.OP_HOME = rootDir;
@@ -45,12 +48,13 @@ beforeEach(() => {
 });
 
 afterEach(() => {
+  delete process.env.OP_UI_HOST_MODE;
   process.env.OP_HOME = originalHome;
   rmSync(rootDir, { recursive: true, force: true });
   vi.clearAllMocks();
 });
 
-describe('/admin/opencode/providers/[id]/models route', () => {
+describe('/api/host/opencode/providers/[id]/models route', () => {
   test('requires admin token', async () => {
     const res = await GET(makeEvent('openai', 'bad-token'));
     expect(res.status).toBe(401);
diff --git a/packages/ui/src/routes/admin/providers/+server.ts b/packages/ui/src/routes/api/host/providers/+server.ts
similarity index 63%
rename from packages/ui/src/routes/admin/providers/+server.ts
rename to packages/ui/src/routes/api/host/providers/+server.ts
index 4256e9232..7a19c9933 100644
--- a/packages/ui/src/routes/admin/providers/+server.ts
+++ b/packages/ui/src/routes/api/host/providers/+server.ts
@@ -1,9 +1,11 @@
 import type { RequestHandler } from './$types';
-import { requireAdmin, jsonResponse, getRequestId } from '$lib/server/helpers.js';
+import { requireAdmin, requireCapability, jsonResponse, getRequestId } from '$lib/server/helpers.js';
 import { loadProviderPage } from '$lib/server/opencode/catalog.js';
 
 export const GET: RequestHandler = async (event) => {
 	const requestId = getRequestId(event);
+	const capabilityError = requireCapability(event, 'host:secrets', requestId);
+	if (capabilityError) return capabilityError;
 	const authError = requireAdmin(event, requestId);
 	if (authError) return authError;
 
diff --git a/packages/ui/src/routes/admin/providers/[id]/+server.ts b/packages/ui/src/routes/api/host/providers/[id]/+server.ts
similarity index 96%
rename from packages/ui/src/routes/admin/providers/[id]/+server.ts
rename to packages/ui/src/routes/api/host/providers/[id]/+server.ts
index 20551288e..66866f344 100644
--- a/packages/ui/src/routes/admin/providers/[id]/+server.ts
+++ b/packages/ui/src/routes/api/host/providers/[id]/+server.ts
@@ -1,5 +1,5 @@
 /**
- * PATCH /admin/providers/:id — Single endpoint for all provider mutations.
+ * PATCH /api/host/providers/:id — Single endpoint for all provider mutations.
  *
  * Discriminated by `body.kind`:
  *   "options"   — save connection settings (baseURL, headers, timeout, …)
@@ -7,11 +7,12 @@
  *   "register"  — register a local-detected or custom OpenAI-compatible provider
  *
  * Auth: admin token required.
- * OAuth credential saves go to /admin/opencode/providers/:id/auth (unchanged).
+ * OAuth credential saves go to /api/host/opencode/providers/:id/auth (unchanged).
  */
 import type { RequestHandler } from './$types';
 import {
   requireAdmin,
+  requireCapability,
   jsonResponse,
   errorResponse,
   getRequestId,
@@ -52,6 +53,8 @@ const LOCAL_PROVIDER_LABELS: Record<string, string> = {
 
 export const PATCH: RequestHandler = async (event) => {
   const requestId = getRequestId(event);
+  const capabilityError = requireCapability(event, 'host:secrets', requestId);
+  if (capabilityError) return capabilityError;
   const authError = requireAdmin(event, requestId);
   if (authError) return authError;
 
diff --git a/packages/ui/src/routes/admin/providers/[id]/server.vitest.ts b/packages/ui/src/routes/api/host/providers/[id]/server.vitest.ts
similarity index 89%
rename from packages/ui/src/routes/admin/providers/[id]/server.vitest.ts
rename to packages/ui/src/routes/api/host/providers/[id]/server.vitest.ts
index 233860bf6..efa055b56 100644
--- a/packages/ui/src/routes/admin/providers/[id]/server.vitest.ts
+++ b/packages/ui/src/routes/api/host/providers/[id]/server.vitest.ts
@@ -31,7 +31,7 @@ import { PATCH } from './+server.js';
 import { getState } from '$lib/server/state.js';
 
 function makeEvent(body: unknown, providerId = 'custom-ai'): Parameters<typeof PATCH>[0] {
-  const url = new URL(`http://localhost/admin/providers/${providerId}`);
+  const url = new URL(`http://localhost/api/host/providers/${providerId}`);
   return {
     params: { id: providerId },
     request: new Request(url, {
@@ -51,6 +51,9 @@ let rootDir = '';
 let originalHome: string | undefined;
 
 beforeEach(() => {
+  // Phase 4: /api/host + /api/assistant endpoints are capability-guarded;
+  // run this suite as a host-capable mode.
+  process.env.OP_UI_HOST_MODE = 'host-ui';
   rootDir = join(tmpdir(), `openpalm-provider-patch-${randomBytes(4).toString('hex')}`);
   mkdirSync(rootDir, { recursive: true });
   originalHome = process.env.OP_HOME;
@@ -62,11 +65,12 @@ beforeEach(() => {
 });
 
 afterEach(() => {
+  delete process.env.OP_UI_HOST_MODE;
   process.env.OP_HOME = originalHome;
   rmSync(rootDir, { recursive: true, force: true });
 });
 
-describe('PATCH /admin/providers/[id]', () => {
+describe('PATCH /api/host/providers/[id]', () => {
   test('register-custom stores API keys only in OpenCode auth.json', async () => {
     const res = await PATCH(makeEvent({
       kind: 'register-custom',
diff --git a/packages/ui/src/routes/admin/providers/_helpers.ts b/packages/ui/src/routes/api/host/providers/_helpers.ts
similarity index 100%
rename from packages/ui/src/routes/admin/providers/_helpers.ts
rename to packages/ui/src/routes/api/host/providers/_helpers.ts
diff --git a/packages/ui/src/routes/admin/providers/assistant-clis/+server.ts b/packages/ui/src/routes/api/host/providers/assistant-clis/+server.ts
similarity index 65%
rename from packages/ui/src/routes/admin/providers/assistant-clis/+server.ts
rename to packages/ui/src/routes/api/host/providers/assistant-clis/+server.ts
index 911ce4d6d..8c62b3652 100644
--- a/packages/ui/src/routes/admin/providers/assistant-clis/+server.ts
+++ b/packages/ui/src/routes/api/host/providers/assistant-clis/+server.ts
@@ -1,10 +1,12 @@
 import type { RequestHandler } from './$types';
-import { getRequestId, jsonResponse, requireAdmin } from '$lib/server/helpers.js';
+import { getRequestId, jsonResponse, requireAdmin, requireCapability } from '$lib/server/helpers.js';
 import { getState } from '$lib/server/state.js';
 import { listAssistantCliTools } from '@openpalm/lib';
 
 export const GET: RequestHandler = async (event) => {
   const requestId = getRequestId(event);
+  const capabilityError = requireCapability(event, 'host:secrets', requestId);
+  if (capabilityError) return capabilityError;
   const authError = requireAdmin(event, requestId);
   if (authError) return authError;
 
diff --git a/packages/ui/src/routes/admin/providers/assistant-clis/[toolId]/use-provider/+server.ts b/packages/ui/src/routes/api/host/providers/assistant-clis/[toolId]/use-provider/+server.ts
similarity index 92%
rename from packages/ui/src/routes/admin/providers/assistant-clis/[toolId]/use-provider/+server.ts
rename to packages/ui/src/routes/api/host/providers/assistant-clis/[toolId]/use-provider/+server.ts
index 524c2e3f6..f87b9bbc6 100644
--- a/packages/ui/src/routes/admin/providers/assistant-clis/[toolId]/use-provider/+server.ts
+++ b/packages/ui/src/routes/api/host/providers/assistant-clis/[toolId]/use-provider/+server.ts
@@ -7,6 +7,7 @@ import {
   jsonResponse,
   parseJsonBody,
   requireAdmin,
+  requireCapability,
 } from '$lib/server/helpers.js';
 import { getState } from '$lib/server/state.js';
 
@@ -18,6 +19,8 @@ function isAssistantCliToolId(value: string): value is AssistantCliToolId {
 
 export const POST: RequestHandler = async (event) => {
   const requestId = getRequestId(event);
+  const capabilityError = requireCapability(event, 'host:secrets', requestId);
+  if (capabilityError) return capabilityError;
   const authError = requireAdmin(event, requestId);
   if (authError) return authError;
 
diff --git a/packages/ui/src/routes/admin/providers/host-status/+server.ts b/packages/ui/src/routes/api/host/providers/host-status/+server.ts
similarity index 76%
rename from packages/ui/src/routes/admin/providers/host-status/+server.ts
rename to packages/ui/src/routes/api/host/providers/host-status/+server.ts
index a2208e2bb..b1aaaf3e2 100644
--- a/packages/ui/src/routes/admin/providers/host-status/+server.ts
+++ b/packages/ui/src/routes/api/host/providers/host-status/+server.ts
@@ -1,5 +1,5 @@
 /**
- * GET /admin/providers/host-status
+ * GET /api/host/providers/host-status
  *
  * Detects whether the host has an existing OpenCode installation and returns
  * provider + credential counts. Never returns credential values.
@@ -7,11 +7,13 @@
  * Auth: admin token required.
  */
 import type { RequestHandler } from './$types';
-import { requireAdmin, jsonResponse, getRequestId } from '$lib/server/helpers.js';
+import { requireAdmin, requireCapability, jsonResponse, getRequestId } from '$lib/server/helpers.js';
 import { detectHostOpenCode } from '@openpalm/lib';
 
 export const GET: RequestHandler = async (event) => {
 	const requestId = getRequestId(event);
+	const capabilityError = requireCapability(event, 'host:secrets', requestId);
+	if (capabilityError) return capabilityError;
 	const authError = requireAdmin(event, requestId);
 	if (authError) return authError;
 
diff --git a/packages/ui/src/routes/admin/providers/host-status/server.vitest.ts b/packages/ui/src/routes/api/host/providers/host-status/server.vitest.ts
similarity index 89%
rename from packages/ui/src/routes/admin/providers/host-status/server.vitest.ts
rename to packages/ui/src/routes/api/host/providers/host-status/server.vitest.ts
index 8173b73cf..3ee03862c 100644
--- a/packages/ui/src/routes/admin/providers/host-status/server.vitest.ts
+++ b/packages/ui/src/routes/api/host/providers/host-status/server.vitest.ts
@@ -24,7 +24,7 @@ let rootDir = '';
 let originalHome: string | undefined;
 
 function makeEvent(headers: Record<string, string> = {}): Parameters<typeof GET>[0] {
-	const url = new URL('http://localhost/admin/providers/host-status');
+	const url = new URL('http://localhost/api/host/providers/host-status');
 	return {
 		request: new Request(url, {
 			method: 'GET',
@@ -40,6 +40,9 @@ function makeEvent(headers: Record<string, string> = {}): Parameters<typeof GET>
 }
 
 beforeEach(() => {
+  // Phase 4: /api/host + /api/assistant endpoints are capability-guarded;
+  // run this suite as a host-capable mode.
+  process.env.OP_UI_HOST_MODE = 'host-ui';
 	rootDir = join(tmpdir(), `openpalm-host-status-${randomBytes(4).toString('hex')}`);
 	mkdirSync(rootDir, { recursive: true });
 	originalHome = process.env.OP_HOME;
@@ -49,11 +52,12 @@ beforeEach(() => {
 });
 
 afterEach(() => {
+  delete process.env.OP_UI_HOST_MODE;
 	process.env.OP_HOME = originalHome;
 	rmSync(rootDir, { recursive: true, force: true });
 });
 
-describe('GET /admin/providers/host-status', () => {
+describe('GET /api/host/providers/host-status', () => {
 	test('rejects unauthenticated requests', async () => {
 		const res = await GET(makeEvent({ cookie: 'op_session=wrong-token' }));
 		expect(res.status).toBe(401);
diff --git a/packages/ui/src/routes/admin/providers/import-host/+server.ts b/packages/ui/src/routes/api/host/providers/import-host/+server.ts
similarity index 96%
rename from packages/ui/src/routes/admin/providers/import-host/+server.ts
rename to packages/ui/src/routes/api/host/providers/import-host/+server.ts
index d16a53d64..92b467e6d 100644
--- a/packages/ui/src/routes/admin/providers/import-host/+server.ts
+++ b/packages/ui/src/routes/api/host/providers/import-host/+server.ts
@@ -1,5 +1,5 @@
 /**
- * POST /admin/providers/import-host
+ * POST /api/host/providers/import-host
  *
  * Copies host OpenCode config + auth into OP_HOME, then pushes each
  * imported credential to the running OpenCode server so the providers
@@ -24,6 +24,7 @@ import { existsSync, readFileSync } from 'node:fs';
 import type { RequestHandler } from './$types';
 import {
 	requireAdmin,
+	requireCapability,
 	jsonResponse,
 	errorResponse,
 	getRequestId,
@@ -103,6 +104,8 @@ async function pushAuthToOpenCode(authPath: string): Promise<{ pushed: number; f
 
 export const POST: RequestHandler = async (event) => {
 	const requestId = getRequestId(event);
+	const capabilityError = requireCapability(event, 'host:secrets', requestId);
+	if (capabilityError) return capabilityError;
 	const authError = requireAdmin(event, requestId);
 	if (authError) return authError;
 
diff --git a/packages/ui/src/routes/admin/providers/import-host/server.vitest.ts b/packages/ui/src/routes/api/host/providers/import-host/server.vitest.ts
similarity index 96%
rename from packages/ui/src/routes/admin/providers/import-host/server.vitest.ts
rename to packages/ui/src/routes/api/host/providers/import-host/server.vitest.ts
index 26f8669f4..aafb59921 100644
--- a/packages/ui/src/routes/admin/providers/import-host/server.vitest.ts
+++ b/packages/ui/src/routes/api/host/providers/import-host/server.vitest.ts
@@ -42,7 +42,7 @@ function makeEvent(
 	body?: unknown,
 	headers: Record<string, string> = {}
 ): Parameters<typeof POST>[0] {
-	const url = new URL('http://localhost/admin/providers/import-host');
+	const url = new URL('http://localhost/api/host/providers/import-host');
 	return {
 		request: new Request(url, {
 			method: 'POST',
@@ -60,6 +60,9 @@ function makeEvent(
 }
 
 beforeEach(() => {
+  // Phase 4: /api/host + /api/assistant endpoints are capability-guarded;
+  // run this suite as a host-capable mode.
+  process.env.OP_UI_HOST_MODE = 'host-ui';
 	rootDir = join(tmpdir(), `openpalm-import-host-${randomBytes(4).toString('hex')}`);
 	mkdirSync(rootDir, { recursive: true });
 	originalHome = process.env.OP_HOME;
@@ -86,11 +89,12 @@ function writeImportedAuth(auth: Record<string, unknown>): string {
 }
 
 afterEach(() => {
+  delete process.env.OP_UI_HOST_MODE;
 	process.env.OP_HOME = originalHome;
 	rmSync(rootDir, { recursive: true, force: true });
 });
 
-describe('POST /admin/providers/import-host', () => {
+describe('POST /api/host/providers/import-host', () => {
 	test('rejects unauthenticated requests', async () => {
 		const res = await POST(makeEvent(undefined, { cookie: 'op_session=wrong-token' }));
 		expect(res.status).toBe(401);
diff --git a/packages/ui/src/routes/admin/providers/oauth/[providerId]/callback/+server.ts b/packages/ui/src/routes/api/host/providers/oauth/[providerId]/callback/+server.ts
similarity index 81%
rename from packages/ui/src/routes/admin/providers/oauth/[providerId]/callback/+server.ts
rename to packages/ui/src/routes/api/host/providers/oauth/[providerId]/callback/+server.ts
index b89091622..f37552744 100644
--- a/packages/ui/src/routes/admin/providers/oauth/[providerId]/callback/+server.ts
+++ b/packages/ui/src/routes/api/host/providers/oauth/[providerId]/callback/+server.ts
@@ -1,16 +1,18 @@
 /**
- * POST /admin/providers/oauth/:providerId/callback
+ * POST /api/host/providers/oauth/:providerId/callback
  *
  * Forwards an OAuth callback (auto-mode completion) to the running
  * assistant's OpenCode, which holds the OAuth methods map needed to
  * complete the exchange.
  */
 import type { RequestHandler } from './$types';
-import { requireAdmin, getRequestId, errorResponse } from '$lib/server/helpers.js';
+import { requireAdmin, requireCapability, getRequestId, errorResponse } from '$lib/server/helpers.js';
 import { opencodeFetch } from '$lib/server/opencode/http.js';
 
 export const POST: RequestHandler = async (event) => {
 	const requestId = getRequestId(event);
+	const capabilityError = requireCapability(event, 'host:secrets', requestId);
+	if (capabilityError) return capabilityError;
 	const authError = requireAdmin(event, requestId);
 	if (authError) return authError;
 
diff --git a/packages/ui/src/routes/admin/providers/oauth/finish/+server.ts b/packages/ui/src/routes/api/host/providers/oauth/finish/+server.ts
similarity index 75%
rename from packages/ui/src/routes/admin/providers/oauth/finish/+server.ts
rename to packages/ui/src/routes/api/host/providers/oauth/finish/+server.ts
index ee8d933d2..bc3a66d7d 100644
--- a/packages/ui/src/routes/admin/providers/oauth/finish/+server.ts
+++ b/packages/ui/src/routes/api/host/providers/oauth/finish/+server.ts
@@ -1,15 +1,18 @@
 import type { RequestHandler } from './$types';
-import { jsonResponse, withAdminBody } from '$lib/server/helpers.js';
+import { getRequestId, jsonResponse, requireCapability, withAdminBody } from '$lib/server/helpers.js';
 import { opencodeFetch } from '$lib/server/opencode/http.js';
 import { asStringOrEmpty } from '../../_helpers.js';
 import type { ProviderActionResult } from '$lib/types/providers.js';
 
 /**
- * POST /admin/providers/oauth/finish — Complete an OAuth code-mode
+ * POST /api/host/providers/oauth/finish — Complete an OAuth code-mode
  * sign-in by exchanging the operator-pasted authorization code with the
  * assistant OpenCode instance.
  */
-export const POST: RequestHandler = (event) => withAdminBody(event, async ({ requestId, body }) => {
+export const POST: RequestHandler = async (event) => {
+	const capabilityError = requireCapability(event, 'host:secrets', getRequestId(event));
+	if (capabilityError) return capabilityError;
+	return withAdminBody(event, async ({ requestId, body }) => {
 	try {
 		const providerId = asStringOrEmpty(body.providerId);
 		const methodIndex = Number(asStringOrEmpty(body.methodIndex));
@@ -37,3 +40,4 @@ export const POST: RequestHandler = (event) => withAdminBody(event, async ({ req
 		return jsonResponse(200, { ok: false, message, selectedProviderId: undefined } satisfies ProviderActionResult, requestId);
 	}
 });
+};
diff --git a/packages/ui/src/routes/admin/providers/oauth/finish/server.vitest.ts b/packages/ui/src/routes/api/host/providers/oauth/finish/server.vitest.ts
similarity index 90%
rename from packages/ui/src/routes/admin/providers/oauth/finish/server.vitest.ts
rename to packages/ui/src/routes/api/host/providers/oauth/finish/server.vitest.ts
index 85858848d..7534b772e 100644
--- a/packages/ui/src/routes/admin/providers/oauth/finish/server.vitest.ts
+++ b/packages/ui/src/routes/api/host/providers/oauth/finish/server.vitest.ts
@@ -29,7 +29,7 @@ let rootDir = '';
 let originalHome: string | undefined;
 
 function makeEvent(body: unknown, headers: Record<string, string> = {}): Parameters<typeof POST>[0] {
-	const url = new URL('http://localhost/admin/providers/oauth/finish');
+	const url = new URL('http://localhost/api/host/providers/oauth/finish');
 	return {
 		request: new Request(url, {
 			method: 'POST',
@@ -47,6 +47,9 @@ function makeEvent(body: unknown, headers: Record<string, string> = {}): Paramet
 }
 
 beforeEach(() => {
+  // Phase 4: /api/host + /api/assistant endpoints are capability-guarded;
+  // run this suite as a host-capable mode.
+  process.env.OP_UI_HOST_MODE = 'host-ui';
 	rootDir = join(tmpdir(), `openpalm-prov-oauth-finish-${randomBytes(4).toString('hex')}`);
 	mkdirSync(rootDir, { recursive: true });
 	originalHome = process.env.OP_HOME;
@@ -56,11 +59,12 @@ beforeEach(() => {
 });
 
 afterEach(() => {
+  delete process.env.OP_UI_HOST_MODE;
 	process.env.OP_HOME = originalHome;
 	rmSync(rootDir, { recursive: true, force: true });
 });
 
-describe('POST /admin/providers/oauth/finish', () => {
+describe('POST /api/host/providers/oauth/finish', () => {
 	test('rejects unauthenticated requests', async () => {
 		const res = await POST(makeEvent({ providerId: 'p', methodIndex: '0', code: 'abc' }, { cookie: 'op_session=wrong-token' }));
 		expect(res.status).toBe(401);
diff --git a/packages/ui/src/routes/admin/providers/oauth/start/+server.ts b/packages/ui/src/routes/api/host/providers/oauth/start/+server.ts
similarity index 80%
rename from packages/ui/src/routes/admin/providers/oauth/start/+server.ts
rename to packages/ui/src/routes/api/host/providers/oauth/start/+server.ts
index 2d3a10387..ea7db79bb 100644
--- a/packages/ui/src/routes/admin/providers/oauth/start/+server.ts
+++ b/packages/ui/src/routes/api/host/providers/oauth/start/+server.ts
@@ -1,11 +1,11 @@
 import type { RequestHandler } from './$types';
-import { jsonResponse, withAdminBody } from '$lib/server/helpers.js';
+import { getRequestId, jsonResponse, requireCapability, withAdminBody } from '$lib/server/helpers.js';
 import { opencodeFetch } from '$lib/server/opencode/http.js';
 import { asStringOrEmpty, extractInputs } from '../../_helpers.js';
 import type { ProviderActionResult } from '$lib/types/providers.js';
 
 /**
- * POST /admin/providers/oauth/start — Begin an OpenCode-mediated OAuth
+ * POST /api/host/providers/oauth/start — Begin an OpenCode-mediated OAuth
  * sign-in for a provider. Returns the authorization URL and any extra
  * inputs the operator needs to confirm in the UI.
  *
@@ -13,7 +13,10 @@ import type { ProviderActionResult } from '$lib/types/providers.js';
  * OP_OPENCODE_URL, which holds the OAuth methods map needed to issue
  * the authorize request.
  */
-export const POST: RequestHandler = (event) => withAdminBody(event, async ({ requestId, body }) => {
+export const POST: RequestHandler = async (event) => {
+	const capabilityError = requireCapability(event, 'host:secrets', getRequestId(event));
+	if (capabilityError) return capabilityError;
+	return withAdminBody(event, async ({ requestId, body }) => {
 	try {
 		const providerId = asStringOrEmpty(body.providerId);
 		const methodIndex = Number(asStringOrEmpty(body.methodIndex));
@@ -45,3 +48,4 @@ export const POST: RequestHandler = (event) => withAdminBody(event, async ({ req
 		return jsonResponse(200, { ok: false, message, selectedProviderId: undefined } satisfies ProviderActionResult, requestId);
 	}
 });
+};
diff --git a/packages/ui/src/routes/admin/providers/oauth/start/server.vitest.ts b/packages/ui/src/routes/api/host/providers/oauth/start/server.vitest.ts
similarity index 92%
rename from packages/ui/src/routes/admin/providers/oauth/start/server.vitest.ts
rename to packages/ui/src/routes/api/host/providers/oauth/start/server.vitest.ts
index 72ce313e8..8fe1ad692 100644
--- a/packages/ui/src/routes/admin/providers/oauth/start/server.vitest.ts
+++ b/packages/ui/src/routes/api/host/providers/oauth/start/server.vitest.ts
@@ -34,7 +34,7 @@ let rootDir = '';
 let originalHome: string | undefined;
 
 function makeEvent(body: unknown, headers: Record<string, string> = {}): Parameters<typeof POST>[0] {
-	const url = new URL('http://localhost/admin/providers/oauth/start');
+	const url = new URL('http://localhost/api/host/providers/oauth/start');
 	return {
 		request: new Request(url, {
 			method: 'POST',
@@ -52,6 +52,9 @@ function makeEvent(body: unknown, headers: Record<string, string> = {}): Paramet
 }
 
 beforeEach(() => {
+  // Phase 4: /api/host + /api/assistant endpoints are capability-guarded;
+  // run this suite as a host-capable mode.
+  process.env.OP_UI_HOST_MODE = 'host-ui';
 	rootDir = join(tmpdir(), `openpalm-prov-oauth-start-${randomBytes(4).toString('hex')}`);
 	mkdirSync(rootDir, { recursive: true });
 	originalHome = process.env.OP_HOME;
@@ -61,11 +64,12 @@ beforeEach(() => {
 });
 
 afterEach(() => {
+  delete process.env.OP_UI_HOST_MODE;
 	process.env.OP_HOME = originalHome;
 	rmSync(rootDir, { recursive: true, force: true });
 });
 
-describe('POST /admin/providers/oauth/start', () => {
+describe('POST /api/host/providers/oauth/start', () => {
 	test('rejects unauthenticated requests', async () => {
 		const res = await POST(makeEvent({ providerId: 'p', methodIndex: '0' }, { cookie: 'op_session=wrong-token' }));
 		expect(res.status).toBe(401);
diff --git a/packages/ui/src/routes/admin/providers/server.vitest.ts b/packages/ui/src/routes/api/host/providers/server.vitest.ts
similarity index 91%
rename from packages/ui/src/routes/admin/providers/server.vitest.ts
rename to packages/ui/src/routes/api/host/providers/server.vitest.ts
index 54e7e169f..40ffcf3c0 100644
--- a/packages/ui/src/routes/admin/providers/server.vitest.ts
+++ b/packages/ui/src/routes/api/host/providers/server.vitest.ts
@@ -1,5 +1,5 @@
 /**
- * Tests for GET /admin/providers.
+ * Tests for GET /api/host/providers.
  *
  * Asserts:
  *  - 401 without auth
@@ -43,7 +43,7 @@ import { loadProviderPage } from '$lib/server/opencode/catalog.js';
 
 function makeEvent(token = 'admin-token') {
   return {
-    request: new Request('http://localhost/admin/providers', {
+    request: new Request('http://localhost/api/host/providers', {
       headers: {
         cookie: token ? `op_session=${token}` : '',
         'x-request-id': 'req-providers-1',
@@ -56,6 +56,9 @@ let rootDir = '';
 let originalHome: string | undefined;
 
 beforeEach(() => {
+  // Phase 4: /api/host + /api/assistant endpoints are capability-guarded;
+  // run this suite as a host-capable mode.
+  process.env.OP_UI_HOST_MODE = 'host-ui';
   rootDir = join(tmpdir(), `openpalm-providers-test-${randomBytes(4).toString('hex')}`);
   mkdirSync(rootDir, { recursive: true });
   originalHome = process.env.OP_HOME;
@@ -65,12 +68,13 @@ beforeEach(() => {
 });
 
 afterEach(() => {
+  delete process.env.OP_UI_HOST_MODE;
   process.env.OP_HOME = originalHome;
   rmSync(rootDir, { recursive: true, force: true });
   vi.restoreAllMocks();
 });
 
-describe('GET /admin/providers', () => {
+describe('GET /api/host/providers', () => {
   test('returns 401 without auth', async () => {
     const res = await GET(makeEvent(''));
     expect(res.status).toBe(401);
diff --git a/packages/ui/src/routes/admin/secret-notice/+server.ts b/packages/ui/src/routes/api/host/secret-notice/+server.ts
similarity index 85%
rename from packages/ui/src/routes/admin/secret-notice/+server.ts
rename to packages/ui/src/routes/api/host/secret-notice/+server.ts
index 513c28a9f..621daf5ef 100644
--- a/packages/ui/src/routes/admin/secret-notice/+server.ts
+++ b/packages/ui/src/routes/api/host/secret-notice/+server.ts
@@ -3,6 +3,7 @@ import {
   jsonResponse,
   errorResponse,
   requireAdmin,
+  requireCapability,
 } from "$lib/server/helpers.js";
 import { getState } from "$lib/server/state.js";
 import {
@@ -21,6 +22,8 @@ const logger = createLogger("secret-notice");
  */
 export const GET: RequestHandler = async (event) => {
   const requestId = getRequestId(event);
+  const capabilityError = requireCapability(event, 'host:secrets', requestId);
+  if (capabilityError) return capabilityError;
   const authError = requireAdmin(event, requestId);
   if (authError) return authError;
 
@@ -37,6 +40,8 @@ export const GET: RequestHandler = async (event) => {
 /** Dismiss the one-time notice. */
 export const DELETE: RequestHandler = async (event) => {
   const requestId = getRequestId(event);
+  const capabilityError = requireCapability(event, 'host:secrets', requestId);
+  if (capabilityError) return capabilityError;
   const authError = requireAdmin(event, requestId);
   if (authError) return authError;
 
diff --git a/packages/ui/src/routes/admin/secrets/+server.ts b/packages/ui/src/routes/api/host/secrets/+server.ts
similarity index 56%
rename from packages/ui/src/routes/admin/secrets/+server.ts
rename to packages/ui/src/routes/api/host/secrets/+server.ts
index dcd951cc8..8763a7f9f 100644
--- a/packages/ui/src/routes/admin/secrets/+server.ts
+++ b/packages/ui/src/routes/api/host/secrets/+server.ts
@@ -1,15 +1,17 @@
 /**
- * GET /admin/secrets — list the files in the assistant secrets dir (/stash/secrets
+ * GET /api/host/secrets — list the files in the assistant secrets dir (/stash/secrets
  * = OP_HOME/knowledge/secrets). Returns names + byte sizes only, never values.
- * Per-file read/write/delete is handled by /admin/secrets/[name].
+ * Per-file read/write/delete is handled by /api/host/secrets/[name].
  */
 import type { RequestHandler } from './$types';
 import { listSecretFiles } from '@openpalm/lib';
 import { getState } from '$lib/server/state.js';
-import { getRequestId, jsonResponse, requireAdmin } from '$lib/server/helpers.js';
+import { getRequestId, jsonResponse, requireAdmin, requireCapability } from '$lib/server/helpers.js';
 
 export const GET: RequestHandler = async (event) => {
   const requestId = getRequestId(event);
+  const capabilityError = requireCapability(event, 'host:secrets', requestId);
+  if (capabilityError) return capabilityError;
   const authError = requireAdmin(event, requestId);
   if (authError) return authError;
 
diff --git a/packages/ui/src/routes/admin/secrets/[name]/+server.ts b/packages/ui/src/routes/api/host/secrets/[name]/+server.ts
similarity index 79%
rename from packages/ui/src/routes/admin/secrets/[name]/+server.ts
rename to packages/ui/src/routes/api/host/secrets/[name]/+server.ts
index 6e2a7f1e5..8178db063 100644
--- a/packages/ui/src/routes/admin/secrets/[name]/+server.ts
+++ b/packages/ui/src/routes/api/host/secrets/[name]/+server.ts
@@ -2,9 +2,9 @@
  * Per-file access to the assistant secrets dir (/stash/secrets =
  * OP_HOME/knowledge/secrets), used by the Secrets admin tab as a plain file editor.
  *
- *   GET    /admin/secrets/<name> — read the raw file contents { name, value }
- *   PUT    /admin/secrets/<name> — write raw contents (body { value })
- *   DELETE /admin/secrets/<name> — delete the file
+ *   GET    /api/host/secrets/<name> — read the raw file contents { name, value }
+ *   PUT    /api/host/secrets/<name> — write raw contents (body { value })
+ *   DELETE /api/host/secrets/<name> — delete the file
  *
  * `name` is a basename only; the lib guards against path traversal and writes 0600.
  */
@@ -18,6 +18,7 @@ import {
   parseJsonBody,
   jsonBodyError,
   requireAdmin,
+  requireCapability,
 } from '$lib/server/helpers.js';
 
 function guardName(name: string, requestId: string): Response | null {
@@ -31,6 +32,8 @@ function guardName(name: string, requestId: string): Response | null {
 
 export const GET: RequestHandler = async (event) => {
   const requestId = getRequestId(event);
+  const capabilityError = requireCapability(event, 'host:secrets', requestId);
+  if (capabilityError) return capabilityError;
   const authError = requireAdmin(event, requestId);
   if (authError) return authError;
   const name = event.params.name;
@@ -44,6 +47,8 @@ export const GET: RequestHandler = async (event) => {
 
 export const PUT: RequestHandler = async (event) => {
   const requestId = getRequestId(event);
+  const capabilityError = requireCapability(event, 'host:secrets', requestId);
+  if (capabilityError) return capabilityError;
   const authError = requireAdmin(event, requestId);
   if (authError) return authError;
   const name = event.params.name;
@@ -61,6 +66,8 @@ export const PUT: RequestHandler = async (event) => {
 
 export const DELETE: RequestHandler = async (event) => {
   const requestId = getRequestId(event);
+  const capabilityError = requireCapability(event, 'host:secrets', requestId);
+  if (capabilityError) return capabilityError;
   const authError = requireAdmin(event, requestId);
   if (authError) return authError;
   const name = event.params.name;
diff --git a/packages/ui/src/routes/admin/secrets/user-env/+server.ts b/packages/ui/src/routes/api/host/secrets/user-env/+server.ts
similarity index 87%
rename from packages/ui/src/routes/admin/secrets/user-env/+server.ts
rename to packages/ui/src/routes/api/host/secrets/user-env/+server.ts
index 48f26a8dc..2000fb518 100644
--- a/packages/ui/src/routes/admin/secrets/user-env/+server.ts
+++ b/packages/ui/src/routes/api/host/secrets/user-env/+server.ts
@@ -1,5 +1,5 @@
 /**
- * /admin/secrets/user-env — read/write the shared akm user env (`env:user`).
+ * /api/host/secrets/user-env — read/write the shared akm user env (`env:user`).
  *
  * The user env file (`knowledge/env/user.env`) is the sole source of truth for
  * user-managed configuration secrets. OpenPalm owns the file directly: writes
@@ -16,6 +16,7 @@ import {
   getRequestId,
   jsonResponse,
   requireAdmin,
+  requireCapability,
   withAdminBody,
 } from '$lib/server/helpers.js';
 import {
@@ -36,6 +37,8 @@ const KEY_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
  */
 export const GET: RequestHandler = async (event) => {
   const requestId = getRequestId(event);
+  const capabilityError = requireCapability(event, 'host:secrets', requestId);
+  if (capabilityError) return capabilityError;
   const authError = requireAdmin(event, requestId);
   if (authError) return authError;
 
@@ -57,8 +60,10 @@ export const GET: RequestHandler = async (event) => {
  * a process argv. The assistant sources the env file at startup, so a key
  * written here is visible to OpenCode after the next assistant restart.
  */
-export const POST: RequestHandler = (event) =>
-  withAdminBody(event, async ({ requestId, body }) => {
+export const POST: RequestHandler = async (event) => {
+  const capabilityError = requireCapability(event, 'host:secrets', getRequestId(event));
+  if (capabilityError) return capabilityError;
+  return withAdminBody(event, async ({ requestId, body }) => {
     const state = getState();
     const key = typeof body.key === 'string' ? body.key.trim() : '';
     const value = typeof body.value === 'string' ? body.value : null;
@@ -94,10 +99,13 @@ export const POST: RequestHandler = (event) =>
 
     return jsonResponse(200, { ok: true, key }, requestId);
   });
+};
 
 /** DELETE — remove a key from the user env file. */
 export const DELETE: RequestHandler = async (event) => {
   const requestId = getRequestId(event);
+  const capabilityError = requireCapability(event, 'host:secrets', requestId);
+  if (capabilityError) return capabilityError;
   const authError = requireAdmin(event, requestId);
   if (authError) return authError;
 
diff --git a/packages/ui/src/routes/admin/secrets/user-env/server.vitest.ts b/packages/ui/src/routes/api/host/secrets/user-env/server.vitest.ts
similarity index 73%
rename from packages/ui/src/routes/admin/secrets/user-env/server.vitest.ts
rename to packages/ui/src/routes/api/host/secrets/user-env/server.vitest.ts
index 5341e3438..04a1cb644 100644
--- a/packages/ui/src/routes/admin/secrets/user-env/server.vitest.ts
+++ b/packages/ui/src/routes/api/host/secrets/user-env/server.vitest.ts
@@ -1,5 +1,5 @@
 /**
- * Tests for the /admin/secrets/user-env route.
+ * Tests for the /api/host/secrets/user-env route.
  *
  * The route operates on the akm `env:user` file (`knowledge/env/user.env`)
  * directly. akm (>= 0.8.0) no longer manages individual env entries, so the
@@ -42,6 +42,9 @@ let rootDir = '';
 let originalHome: string | undefined;
 
 beforeEach(() => {
+  // Phase 4: /api/host + /api/assistant endpoints are capability-guarded;
+  // run this suite as a host-capable mode.
+  process.env.OP_UI_HOST_MODE = 'host-ui';
   rootDir = makeTempDir();
   originalHome = process.env.OP_HOME;
   process.env.OP_HOME = rootDir;
@@ -54,21 +57,22 @@ beforeEach(() => {
 });
 
 afterEach(() => {
+  delete process.env.OP_UI_HOST_MODE;
   process.env.OP_HOME = originalHome;
   rmSync(rootDir, { recursive: true, force: true });
 });
 
 describe('admin user-env route', () => {
   test('GET returns 401 without admin token', async () => {
-    const res = await GET(makeEvent('GET', '/admin/secrets/user-env', undefined, ''));
+    const res = await GET(makeEvent('GET', '/api/host/secrets/user-env', undefined, ''));
     expect(res.status).toBe(401);
   });
 
   test('GET lists user env keys without exposing values', async () => {
-    await POST(makeEvent('POST', '/admin/secrets/user-env', { key: 'CUSTOM_KEY', value: 'v1' }));
-    await POST(makeEvent('POST', '/admin/secrets/user-env', { key: 'OTHER_KEY', value: 'v2' }));
+    await POST(makeEvent('POST', '/api/host/secrets/user-env', { key: 'CUSTOM_KEY', value: 'v1' }));
+    await POST(makeEvent('POST', '/api/host/secrets/user-env', { key: 'OTHER_KEY', value: 'v2' }));
 
-    const res = await GET(makeEvent('GET', '/admin/secrets/user-env'));
+    const res = await GET(makeEvent('GET', '/api/host/secrets/user-env'));
     expect(res.status).toBe(200);
     const body = await res.json() as { keys: string[]; envRef: string; provider: string };
     expect(body.provider).toBe('akm');
@@ -82,7 +86,7 @@ describe('admin user-env route', () => {
   });
 
   test('POST writes a key to the user env file', async () => {
-    const res = await POST(makeEvent('POST', '/admin/secrets/user-env', {
+    const res = await POST(makeEvent('POST', '/api/host/secrets/user-env', {
       key: 'CUSTOM_TOKEN',
       value: 'secret-payload',
     }));
@@ -96,7 +100,7 @@ describe('admin user-env route', () => {
   });
 
   test('POST rejects invalid key', async () => {
-    const res = await POST(makeEvent('POST', '/admin/secrets/user-env', {
+    const res = await POST(makeEvent('POST', '/api/host/secrets/user-env', {
       key: 'bad key with spaces',
       value: 'whatever',
     }));
@@ -104,7 +108,7 @@ describe('admin user-env route', () => {
   });
 
   test('POST rejects empty value', async () => {
-    const res = await POST(makeEvent('POST', '/admin/secrets/user-env', {
+    const res = await POST(makeEvent('POST', '/api/host/secrets/user-env', {
       key: 'KEY',
       value: '',
     }));
@@ -112,7 +116,7 @@ describe('admin user-env route', () => {
   });
 
   test('POST rejects a value containing a newline (would corrupt the .env)', async () => {
-    const res = await POST(makeEvent('POST', '/admin/secrets/user-env', {
+    const res = await POST(makeEvent('POST', '/api/host/secrets/user-env', {
       key: 'MULTILINE',
       value: 'line1\nline2',
     }));
@@ -120,10 +124,10 @@ describe('admin user-env route', () => {
   });
 
   test('DELETE removes a key from the user env entirely', async () => {
-    await POST(makeEvent('POST', '/admin/secrets/user-env', { key: 'KEEP_ME', value: 'ok' }));
-    await POST(makeEvent('POST', '/admin/secrets/user-env', { key: 'DROP_ME', value: 'bye' }));
+    await POST(makeEvent('POST', '/api/host/secrets/user-env', { key: 'KEEP_ME', value: 'ok' }));
+    await POST(makeEvent('POST', '/api/host/secrets/user-env', { key: 'DROP_ME', value: 'bye' }));
 
-    const res = await DELETE(makeEvent('DELETE', '/admin/secrets/user-env?key=DROP_ME'));
+    const res = await DELETE(makeEvent('DELETE', '/api/host/secrets/user-env?key=DROP_ME'));
     expect(res.status).toBe(200);
 
     const state = getState();
@@ -133,18 +137,18 @@ describe('admin user-env route', () => {
   });
 
   test('DELETE followed by GET no longer lists the key', async () => {
-    await POST(makeEvent('POST', '/admin/secrets/user-env', { key: 'KEEP_ME', value: 'ok' }));
-    await POST(makeEvent('POST', '/admin/secrets/user-env', { key: 'DROP_ME', value: 'bye' }));
-    await DELETE(makeEvent('DELETE', '/admin/secrets/user-env?key=DROP_ME'));
+    await POST(makeEvent('POST', '/api/host/secrets/user-env', { key: 'KEEP_ME', value: 'ok' }));
+    await POST(makeEvent('POST', '/api/host/secrets/user-env', { key: 'DROP_ME', value: 'bye' }));
+    await DELETE(makeEvent('DELETE', '/api/host/secrets/user-env?key=DROP_ME'));
 
-    const listRes = await GET(makeEvent('GET', '/admin/secrets/user-env'));
+    const listRes = await GET(makeEvent('GET', '/api/host/secrets/user-env'));
     const body = await listRes.json() as { keys: string[] };
     expect(body.keys).toContain('KEEP_ME');
     expect(body.keys).not.toContain('DROP_ME');
   });
 
   test('written user env file is mode 0600', async () => {
-    await POST(makeEvent('POST', '/admin/secrets/user-env', { key: 'TOKEN', value: 'x' }));
+    await POST(makeEvent('POST', '/api/host/secrets/user-env', { key: 'TOKEN', value: 'x' }));
     const state = getState();
     const path = userEnvPathSync(state);
     // Sanity: the file exists and is readable for the assertion in the lib test.
diff --git a/packages/ui/src/routes/admin/assistant/+server.ts b/packages/ui/src/routes/api/host/stack/+server.ts
similarity index 68%
rename from packages/ui/src/routes/admin/assistant/+server.ts
rename to packages/ui/src/routes/api/host/stack/+server.ts
index 270ce0c67..280447395 100644
--- a/packages/ui/src/routes/admin/assistant/+server.ts
+++ b/packages/ui/src/routes/api/host/stack/+server.ts
@@ -1,13 +1,25 @@
-import { existsSync, mkdirSync, readFileSync } from 'node:fs';
-import { join } from 'node:path';
+/**
+ * GET/PUT /api/host/stack — host stack settings (plan ui-runtime-modes-plan.md
+ * Phase 4 step 2, §5.F, §6.4).
+ *
+ * The HOST-SCOPED half of the old /admin/assistant endpoint: compose project
+ * name (OP_PROJECT_NAME) and assistant bind address (OP_ASSISTANT_BIND_ADDRESS,
+ * surfaced as `lanExposureEnabled`). Persona is assistant-owned and lives at
+ * /api/assistant/persona — it is deliberately absent from this payload.
+ *
+ * Guarded by the host:stack capabilities in addition to requireAdmin (plan
+ * §8.5): a valid admin session in a mode without host:* (assistant-container,
+ * pwa-static) is still refused with 403.
+ */
 import type { RequestHandler } from './$types';
-import { patchSecretsEnvFile, readStackEnv, recordProjectRename, writeFileAtomic } from '@openpalm/lib';
+import { patchSecretsEnvFile, readStackEnv, recordProjectRename } from '@openpalm/lib';
 import { getState } from '$lib/server/state.js';
 import {
   errorResponse,
   getRequestId,
   jsonResponse,
   requireAdmin,
+  requireCapability,
   withAdminBody,
 } from '$lib/server/helpers.js';
 
@@ -16,20 +28,6 @@ const DEFAULT_ASSISTANT_BIND_ADDRESS = '127.0.0.1';
 const LAN_ASSISTANT_BIND_ADDRESS = '0.0.0.0';
 const PROJECT_NAME_RE = /^[a-z0-9][a-z0-9_-]*$/;
 
-function personaPath(configDir: string): string {
-  return join(configDir, 'assistant', 'persona.md');
-}
-
-function readPersona(configDir: string): string {
-  const path = personaPath(configDir);
-  if (!existsSync(path)) return '';
-  try {
-    return readFileSync(path, 'utf-8');
-  } catch {
-    return '';
-  }
-}
-
 function normalizeProjectName(raw: unknown): string | null {
   if (typeof raw !== 'string') return null;
   const value = raw.trim() || DEFAULT_PROJECT_NAME;
@@ -39,6 +37,8 @@ function normalizeProjectName(raw: unknown): string | null {
 
 export const GET: RequestHandler = async (event) => {
   const requestId = getRequestId(event);
+  const capabilityError = requireCapability(event, 'host:stack:read', requestId);
+  if (capabilityError) return capabilityError;
   const denied = requireAdmin(event, requestId);
   if (denied) return denied;
 
@@ -51,15 +51,17 @@ export const GET: RequestHandler = async (event) => {
       projectName: env.OP_PROJECT_NAME?.trim() || DEFAULT_PROJECT_NAME,
       lanExposureEnabled: (env.OP_ASSISTANT_BIND_ADDRESS?.trim() || DEFAULT_ASSISTANT_BIND_ADDRESS) === LAN_ASSISTANT_BIND_ADDRESS,
       stackEnvPath: 'knowledge/env/stack.env',
-      personaPath: 'config/assistant/persona.md',
-      personaContent: readPersona(state.configDir),
     },
     requestId,
   );
 };
 
-export const PUT: RequestHandler = async (event) =>
-  withAdminBody(event, async ({ requestId, body }) => {
+export const PUT: RequestHandler = async (event) => {
+  const requestId = getRequestId(event);
+  const capabilityError = requireCapability(event, 'host:stack:write', requestId);
+  if (capabilityError) return capabilityError;
+
+  return withAdminBody(event, async ({ requestId, body }) => {
     const projectName = normalizeProjectName(body.projectName);
     if (!projectName) {
       return errorResponse(
@@ -71,10 +73,6 @@ export const PUT: RequestHandler = async (event) =>
       );
     }
 
-    if (typeof body.personaContent !== 'string') {
-      return errorResponse(400, 'bad_request', 'personaContent must be a string', {}, requestId);
-    }
-
     if (typeof body.lanExposureEnabled !== 'boolean') {
       return errorResponse(400, 'bad_request', 'lanExposureEnabled must be a boolean', {}, requestId);
     }
@@ -94,13 +92,6 @@ export const PUT: RequestHandler = async (event) =>
       recordProjectRename(state.homeDir, previousProjectName, projectName);
     }
 
-    const path = personaPath(state.configDir);
-    mkdirSync(join(state.configDir, 'assistant'), { recursive: true });
-    const personaContent = body.personaContent.endsWith('\n')
-      ? body.personaContent
-      : `${body.personaContent}\n`;
-    writeFileAtomic(path, personaContent, 0o644);
-
     return jsonResponse(
       200,
       {
@@ -109,9 +100,8 @@ export const PUT: RequestHandler = async (event) =>
         projectRenamed,
         lanExposureEnabled: body.lanExposureEnabled,
         stackEnvPath: 'knowledge/env/stack.env',
-        personaPath: 'config/assistant/persona.md',
-        personaContent,
       },
       requestId,
     );
   });
+};
diff --git a/packages/ui/src/routes/admin/assistant/server.vitest.ts b/packages/ui/src/routes/api/host/stack/rename.vitest.ts
similarity index 66%
rename from packages/ui/src/routes/admin/assistant/server.vitest.ts
rename to packages/ui/src/routes/api/host/stack/rename.vitest.ts
index 34e0eae05..01d006923 100644
--- a/packages/ui/src/routes/admin/assistant/server.vitest.ts
+++ b/packages/ui/src/routes/api/host/stack/rename.vitest.ts
@@ -1,3 +1,10 @@
+/**
+ * Behavior carried over from the old /admin/assistant suite (Phase 4 moved
+ * the host-scoped half to /api/host/stack): stack.env writes, the #540
+ * project-rename marker, and LAN-exposure toggling. Persona is no longer part
+ * of this endpoint — see routes/api/assistant/persona. The Phase 4 red suite
+ * (server.vitest.ts alongside) pins the capability guard + payload split.
+ */
 import { afterEach, beforeEach, describe, expect, test } from 'vitest';
 import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
 import { randomBytes } from 'node:crypto';
@@ -9,14 +16,14 @@ import { GET, PUT } from './+server.js';
 let rootDir = '';
 let originalHome: string | undefined;
 
-function makeGetEvent(path = '/admin/assistant', token = 'admin-token') {
+function makeGetEvent(path = '/api/host/stack', token = 'admin-token') {
   const url = new URL(`http://localhost${path}`);
   return {
     request: new Request(url, {
       method: 'GET',
       headers: {
         cookie: token ? `op_session=${token}` : '',
-        'x-request-id': 'req-assistant-get',
+        'x-request-id': 'req-host-stack-get',
       },
     }),
     url,
@@ -25,13 +32,13 @@ function makeGetEvent(path = '/admin/assistant', token = 'admin-token') {
 }
 
 function makePutEvent(body: unknown, token = 'admin-token') {
-  const url = new URL('http://localhost/admin/assistant');
+  const url = new URL('http://localhost/api/host/stack');
   return {
     request: new Request(url, {
       method: 'PUT',
       headers: {
         cookie: token ? `op_session=${token}` : '',
-        'x-request-id': 'req-assistant-put',
+        'x-request-id': 'req-host-stack-put',
         'content-type': 'application/json',
       },
       body: JSON.stringify(body),
@@ -42,7 +49,9 @@ function makePutEvent(body: unknown, token = 'admin-token') {
 }
 
 beforeEach(() => {
-  rootDir = join(tmpdir(), `openpalm-assistant-${randomBytes(4).toString('hex')}`);
+  // Phase 4: /api/host endpoints are capability-guarded; run as a host mode.
+  process.env.OP_UI_HOST_MODE = 'host-ui';
+  rootDir = join(tmpdir(), `openpalm-host-stack-${randomBytes(4).toString('hex')}`);
   mkdirSync(rootDir, { recursive: true });
   originalHome = process.env.OP_HOME;
   process.env.OP_HOME = rootDir;
@@ -50,29 +59,23 @@ beforeEach(() => {
 });
 
 afterEach(() => {
+  delete process.env.OP_UI_HOST_MODE;
   process.env.OP_HOME = originalHome;
   rmSync(rootDir, { recursive: true, force: true });
 });
 
-describe('GET /admin/assistant', () => {
+describe('GET /api/host/stack', () => {
   test('401 without auth', async () => {
-    expect((await GET(makeGetEvent('/admin/assistant', ''))).status).toBe(401);
+    expect((await GET(makeGetEvent('/api/host/stack', ''))).status).toBe(401);
   });
 
-  test('returns default project name and persona content', async () => {
-    const personaDir = join(rootDir, 'config', 'assistant');
-    mkdirSync(personaDir, { recursive: true });
-    const personaPath = join(personaDir, 'persona.md');
-    const content = '# Persona\n';
-    writeFileSync(personaPath, content);
-
+  test('returns the default project name', async () => {
     const res = await GET(makeGetEvent());
     expect(res.status).toBe(200);
-    const body = await res.json() as Record<string, string>;
+    const body = await res.json() as Record<string, unknown>;
     expect(body.projectName).toBe('openpalm');
     expect(body.lanExposureEnabled).toBe(false);
-    expect(body.personaContent).toBe(content);
-    expect(body.personaPath).toBe('config/assistant/persona.md');
+    expect(body.stackEnvPath).toBe('knowledge/env/stack.env');
   });
 
   test('returns enabled LAN exposure when stack.env binds assistant to all interfaces', async () => {
@@ -86,31 +89,19 @@ describe('GET /admin/assistant', () => {
   });
 });
 
-describe('PUT /admin/assistant', () => {
+describe('PUT /api/host/stack', () => {
   test('rejects invalid project name', async () => {
-    const res = await PUT(makePutEvent({ projectName: 'Open Palm', lanExposureEnabled: false, personaContent: 'x' }));
+    const res = await PUT(makePutEvent({ projectName: 'Open Palm', lanExposureEnabled: false }));
     expect(res.status).toBe(400);
   });
 
   test('rejects invalid LAN exposure toggle values', async () => {
-    const res = await PUT(makePutEvent({ projectName: 'openpalm', lanExposureEnabled: 'yes', personaContent: 'x' }));
+    const res = await PUT(makePutEvent({ projectName: 'openpalm', lanExposureEnabled: 'yes' }));
     expect(res.status).toBe(400);
   });
 
-  test('writes project name to stack.env and persona to assistant config', async () => {
-    const res = await PUT(makePutEvent({ projectName: 'openpalm-dev', lanExposureEnabled: true, personaContent: '# Updated persona' }));
-    expect(res.status).toBe(200);
-
-    const stackEnv = readFileSync(stackEnvFor(rootDir), 'utf-8');
-    expect(stackEnv).toContain('OP_PROJECT_NAME=openpalm-dev');
-    expect(stackEnv).toContain('OP_ASSISTANT_BIND_ADDRESS=0.0.0.0');
-
-    const personaPath = join(rootDir, 'config', 'assistant', 'persona.md');
-    expect(readFileSync(personaPath, 'utf-8')).toBe('# Updated persona\n');
-  });
-
   test('records a project rename so the next apply can tear down the old project (#540)', async () => {
-    const res = await PUT(makePutEvent({ projectName: 'my-agent', lanExposureEnabled: false, personaContent: '# P' }));
+    const res = await PUT(makePutEvent({ projectName: 'my-agent', lanExposureEnabled: false }));
     expect(res.status).toBe(200);
     const body = await res.json() as Record<string, unknown>;
     expect(body.projectRenamed).toBe(true);
@@ -120,7 +111,7 @@ describe('PUT /admin/assistant', () => {
   });
 
   test('does not record a rename when the project name is unchanged', async () => {
-    const res = await PUT(makePutEvent({ projectName: 'openpalm', lanExposureEnabled: false, personaContent: '# P' }));
+    const res = await PUT(makePutEvent({ projectName: 'openpalm', lanExposureEnabled: false }));
     expect(res.status).toBe(200);
     const body = await res.json() as Record<string, unknown>;
     expect(body.projectRenamed).toBe(false);
@@ -128,8 +119,8 @@ describe('PUT /admin/assistant', () => {
   });
 
   test('renaming back to the still-running project clears the recorded marker (#540)', async () => {
-    await PUT(makePutEvent({ projectName: 'my-agent', lanExposureEnabled: false, personaContent: '# P' }));
-    await PUT(makePutEvent({ projectName: 'openpalm', lanExposureEnabled: false, personaContent: '# P' }));
+    await PUT(makePutEvent({ projectName: 'my-agent', lanExposureEnabled: false }));
+    await PUT(makePutEvent({ projectName: 'openpalm', lanExposureEnabled: false }));
 
     const stateEnv = readFileSync(join(rootDir, 'state', 'stack.state.env'), 'utf-8');
     expect(stateEnv).toContain('OP_PREVIOUS_PROJECT_NAME=\n');
@@ -138,7 +129,7 @@ describe('PUT /admin/assistant', () => {
   test('disables LAN exposure by restoring loopback bind address', async () => {
     writeFileSync(stackEnvFor(rootDir), 'OP_ASSISTANT_BIND_ADDRESS=0.0.0.0\n');
 
-    const res = await PUT(makePutEvent({ projectName: 'openpalm', lanExposureEnabled: false, personaContent: '# Persona' }));
+    const res = await PUT(makePutEvent({ projectName: 'openpalm', lanExposureEnabled: false }));
     expect(res.status).toBe(200);
 
     const stackEnv = readFileSync(stackEnvFor(rootDir), 'utf-8');
diff --git a/packages/ui/src/routes/admin/ui-version/+server.ts b/packages/ui/src/routes/api/host/ui-version/+server.ts
similarity index 95%
rename from packages/ui/src/routes/admin/ui-version/+server.ts
rename to packages/ui/src/routes/api/host/ui-version/+server.ts
index f7ee57fc8..748936ac3 100644
--- a/packages/ui/src/routes/admin/ui-version/+server.ts
+++ b/packages/ui/src/routes/api/host/ui-version/+server.ts
@@ -3,6 +3,7 @@ import {
   jsonResponse,
   errorResponse,
   requireAdmin,
+  requireCapability,
 } from "$lib/server/helpers.js";
 import { seedUiBuild, resolveDataDir, createLogger, normalizeVersion } from "@openpalm/lib";
 import type { RequestHandler } from "./$types";
@@ -11,6 +12,8 @@ const logger = createLogger("ui-version");
 
 export const POST: RequestHandler = async (event) => {
   const requestId = getRequestId(event);
+  const capabilityError = requireCapability(event, 'host:updates', requestId);
+  if (capabilityError) return capabilityError;
   const authError = requireAdmin(event, requestId);
   if (authError) return authError;
 
diff --git a/packages/ui/src/routes/admin/uninstall/+server.ts b/packages/ui/src/routes/api/host/uninstall/+server.ts
similarity index 91%
rename from packages/ui/src/routes/admin/uninstall/+server.ts
rename to packages/ui/src/routes/api/host/uninstall/+server.ts
index f93d04d5c..72d1c3fd1 100644
--- a/packages/ui/src/routes/admin/uninstall/+server.ts
+++ b/packages/ui/src/routes/api/host/uninstall/+server.ts
@@ -3,6 +3,7 @@ import {
   getRequestId,
   jsonResponse,
   requireAdmin,
+  requireCapability,
 } from "$lib/server/helpers.js";
 import { getState } from "$lib/server/state.js";
 import { withSerialQueue } from "$lib/server/serial-queue.js";
@@ -19,6 +20,8 @@ const logger = createLogger("uninstall");
 
 export const POST: RequestHandler = async (event) => {
   const requestId = getRequestId(event);
+  const capabilityError = requireCapability(event, 'host:recovery', requestId);
+  if (capabilityError) return capabilityError;
   logger.info("uninstall request received", { requestId });
   const authError = requireAdmin(event, requestId);
   if (authError) return authError;
diff --git a/packages/ui/src/routes/admin/uninstall/server.vitest.ts b/packages/ui/src/routes/api/host/uninstall/server.vitest.ts
similarity index 89%
rename from packages/ui/src/routes/admin/uninstall/server.vitest.ts
rename to packages/ui/src/routes/api/host/uninstall/server.vitest.ts
index 8bdd4b013..9251dfee2 100644
--- a/packages/ui/src/routes/admin/uninstall/server.vitest.ts
+++ b/packages/ui/src/routes/api/host/uninstall/server.vitest.ts
@@ -1,5 +1,5 @@
 /**
- * Thin route tests for POST /admin/uninstall (3.4 — mutating-endpoint coverage).
+ * Thin route tests for POST /api/host/uninstall (3.4 — mutating-endpoint coverage).
  *
  * Previously untested. Covers: auth gate, the docker-unavailable path (skips
  * compose down but still applies uninstall), the success path, and an
@@ -27,7 +27,7 @@ import { POST } from './+server.js';
 
 function makePostEvent(token = 'admin-token'): Parameters<typeof POST>[0] {
   return {
-    request: new Request('http://localhost/admin/uninstall', {
+    request: new Request('http://localhost/api/host/uninstall', {
       method: 'POST',
       headers: { cookie: `op_session=${token}`, 'content-type': 'application/json' },
       body: '{}',
@@ -36,6 +36,9 @@ function makePostEvent(token = 'admin-token'): Parameters<typeof POST>[0] {
 }
 
 beforeEach(() => {
+  // Phase 4: /api/host + /api/assistant endpoints are capability-guarded;
+  // run this suite as a host-capable mode.
+  process.env.OP_UI_HOST_MODE = 'host-ui';
   resetState('admin-token');
   composeDownMock.mockReset();
   checkDockerMock.mockReset();
@@ -47,10 +50,11 @@ beforeEach(() => {
 });
 
 afterEach(() => {
+  delete process.env.OP_UI_HOST_MODE;
   vi.clearAllMocks();
 });
 
-describe('POST /admin/uninstall', () => {
+describe('POST /api/host/uninstall', () => {
   test('requires admin auth', async () => {
     const res = await POST(makePostEvent('bad-token'));
     expect(res.status).toBe(401);
diff --git a/packages/ui/src/routes/admin/unlock/+server.ts b/packages/ui/src/routes/api/host/unlock/+server.ts
similarity index 91%
rename from packages/ui/src/routes/admin/unlock/+server.ts
rename to packages/ui/src/routes/api/host/unlock/+server.ts
index 3cd09308f..1a7e56a44 100644
--- a/packages/ui/src/routes/admin/unlock/+server.ts
+++ b/packages/ui/src/routes/api/host/unlock/+server.ts
@@ -3,6 +3,7 @@ import {
   jsonResponse,
   errorResponse,
   requireAdmin,
+  requireCapability,
 } from "$lib/server/helpers.js";
 import { getState } from "$lib/server/state.js";
 import {
@@ -22,6 +23,8 @@ const logger = createLogger("unlock-admin");
  */
 export const GET: RequestHandler = async (event) => {
   const requestId = getRequestId(event);
+  const capabilityError = requireCapability(event, 'host:recovery', requestId);
+  if (capabilityError) return capabilityError;
   const authError = requireAdmin(event, requestId);
   if (authError) return authError;
 
@@ -47,6 +50,8 @@ export const GET: RequestHandler = async (event) => {
  */
 export const POST: RequestHandler = async (event) => {
   const requestId = getRequestId(event);
+  const capabilityError = requireCapability(event, 'host:recovery', requestId);
+  if (capabilityError) return capabilityError;
   const authError = requireAdmin(event, requestId);
   if (authError) return authError;
 
diff --git a/packages/ui/src/routes/admin/unlock/server.vitest.ts b/packages/ui/src/routes/api/host/unlock/server.vitest.ts
similarity index 89%
rename from packages/ui/src/routes/admin/unlock/server.vitest.ts
rename to packages/ui/src/routes/api/host/unlock/server.vitest.ts
index cd869fe99..01a0963c3 100644
--- a/packages/ui/src/routes/admin/unlock/server.vitest.ts
+++ b/packages/ui/src/routes/api/host/unlock/server.vitest.ts
@@ -1,5 +1,5 @@
 /**
- * Thin route tests for GET/POST /admin/unlock (3.4 — mutating-endpoint coverage).
+ * Thin route tests for GET/POST /api/host/unlock (3.4 — mutating-endpoint coverage).
  *
  * Previously untested. GET reports lock status (read-only); POST clears the
  * lock ONLY when stale, returning 409 install_in_progress for a live lock —
@@ -25,7 +25,7 @@ import { GET, POST } from './+server.js';
 
 function makeEvent(method: 'GET' | 'POST', token = 'admin-token'): Parameters<typeof GET>[0] {
   return {
-    request: new Request('http://localhost/admin/unlock', {
+    request: new Request('http://localhost/api/host/unlock', {
       method,
       headers: { cookie: `op_session=${token}` },
     }),
@@ -51,6 +51,9 @@ const LIVE: InstallLockStatus = {
 };
 
 beforeEach(() => {
+  // Phase 4: /api/host + /api/assistant endpoints are capability-guarded;
+  // run this suite as a host-capable mode.
+  process.env.OP_UI_HOST_MODE = 'host-ui';
   resetState('admin-token');
   inspectInstallLockMock.mockReset();
   unlockInstallLockMock.mockReset();
@@ -58,10 +61,11 @@ beforeEach(() => {
 });
 
 afterEach(() => {
+  delete process.env.OP_UI_HOST_MODE;
   vi.clearAllMocks();
 });
 
-describe('GET /admin/unlock', () => {
+describe('GET /api/host/unlock', () => {
   test('requires admin auth', async () => {
     const res = await GET(makeEvent('GET', 'bad-token'));
     expect(res.status).toBe(401);
@@ -85,7 +89,7 @@ describe('GET /admin/unlock', () => {
   });
 });
 
-describe('POST /admin/unlock', () => {
+describe('POST /api/host/unlock', () => {
   test('requires admin auth', async () => {
     const res = await POST(makeEvent('POST', 'bad-token'));
     expect(res.status).toBe(401);
diff --git a/packages/ui/src/routes/admin/update/+server.ts b/packages/ui/src/routes/api/host/update/+server.ts
similarity index 98%
rename from packages/ui/src/routes/admin/update/+server.ts
rename to packages/ui/src/routes/api/host/update/+server.ts
index 6a4212f39..4061aaa1b 100644
--- a/packages/ui/src/routes/admin/update/+server.ts
+++ b/packages/ui/src/routes/api/host/update/+server.ts
@@ -3,6 +3,7 @@ import {
   getRequestId,
   jsonResponse,
   requireAdmin,
+  requireCapability,
 } from "$lib/server/helpers.js";
 import { getState } from "$lib/server/state.js";
 import { withSerialQueue } from "$lib/server/serial-queue.js";
@@ -23,6 +24,8 @@ const logger = createLogger("update");
 
 export const POST: RequestHandler = async (event) => {
   const requestId = getRequestId(event);
+  const capabilityError = requireCapability(event, 'host:updates', requestId);
+  if (capabilityError) return capabilityError;
   logger.info("update request received", { requestId });
   const authError = requireAdmin(event, requestId);
   if (authError) return authError;
diff --git a/packages/ui/src/routes/admin/update/server.vitest.ts b/packages/ui/src/routes/api/host/update/server.vitest.ts
similarity index 97%
rename from packages/ui/src/routes/admin/update/server.vitest.ts
rename to packages/ui/src/routes/api/host/update/server.vitest.ts
index 540c7ff31..812c87a02 100644
--- a/packages/ui/src/routes/admin/update/server.vitest.ts
+++ b/packages/ui/src/routes/api/host/update/server.vitest.ts
@@ -1,5 +1,5 @@
 /**
- * Route-level tests for POST /admin/update.
+ * Route-level tests for POST /api/host/update.
  *
  * Phase 3: the route is now a thin wrapper over applyUpdate() (files) +
  * applyStack() (containers). Pull failure is FATAL (§6) — no "restarted
@@ -50,7 +50,7 @@ function holdInstallLock(): void {
 
 function makePostEvent(token = 'admin-token', body: unknown = {}): Parameters<typeof POST>[0] {
   return {
-    request: new Request('http://localhost/admin/update', {
+    request: new Request('http://localhost/api/host/update', {
       method: 'POST',
       headers: {
         cookie: `op_session=${token}`,
@@ -63,6 +63,9 @@ function makePostEvent(token = 'admin-token', body: unknown = {}): Parameters<ty
 }
 
 beforeEach(() => {
+  // Phase 4: /api/host + /api/assistant endpoints are capability-guarded;
+  // run this suite as a host-capable mode.
+  process.env.OP_UI_HOST_MODE = 'host-ui';
   resetState('admin-token');
   applyStackMock.mockReset();
   checkDockerMock.mockReset();
@@ -76,13 +79,14 @@ beforeEach(() => {
 });
 
 afterEach(() => {
+  delete process.env.OP_UI_HOST_MODE;
   vi.clearAllMocks();
   // The lock-contention tests write a foreign-held .install.lock into the
   // (test-shared) dataDir; remove it so it can't wedge later tests.
   rmSync(join(getState().dataDir, '.install.lock'), { force: true });
 });
 
-describe('POST /admin/update', () => {
+describe('POST /api/host/update', () => {
   test('requires admin auth', async () => {
     const res = await POST(makePostEvent('bad-token'));
     expect(res.status).toBe(401);
diff --git a/packages/ui/src/routes/admin/versions/+server.ts b/packages/ui/src/routes/api/host/versions/+server.ts
similarity index 94%
rename from packages/ui/src/routes/admin/versions/+server.ts
rename to packages/ui/src/routes/api/host/versions/+server.ts
index fc6021801..abdd255aa 100644
--- a/packages/ui/src/routes/admin/versions/+server.ts
+++ b/packages/ui/src/routes/api/host/versions/+server.ts
@@ -1,6 +1,6 @@
 /**
- * GET /admin/versions  — truthful version state (constitution §4.2, §5)
- * PATCH /admin/versions — write pins to state file
+ * GET /api/host/versions  — truthful version state (constitution §4.2, §5)
+ * PATCH /api/host/versions — write pins to state file
  *
  * GET returns THREE distinct values per component (§5 / Phase 5):
  *   running   — the digest + tag the currently running container was CREATED FROM
@@ -22,7 +22,7 @@
  *   Background "available?" resolution degrades SILENTLY — a registry outage just
  *   leaves `available` null; the stack keeps running what it has.
  *   A user-pressed update that can't reach the registry FAILS LOUDLY (handled in
- *   /admin/update via applyStack pull-before-up + fatal pull failure).
+ *   /api/host/update via applyStack pull-before-up + fatal pull failure).
  *
  * Voice variant on display (§4.2, compliance G3):
  *   `running.tag` for the voice service will include the hardware suffix (e.g.
@@ -45,7 +45,7 @@
 import { json } from "@sveltejs/kit";
 import { existsSync, readFileSync, writeFileSync } from "node:fs";
 import { getState } from "$lib/server/state.js";
-import { requireAdmin, getRequestId, errorResponse } from "$lib/server/helpers.js";
+import { requireAdmin, requireCapability, getRequestId, errorResponse } from "$lib/server/helpers.js";
 import {
   readVersions,
   writeVersions,
@@ -178,10 +178,12 @@ function findRunningByImage(
   return null;
 }
 
-// ── GET /admin/versions ──────────────────────────────────────────────────────
+// ── GET /api/host/versions ──────────────────────────────────────────────────────
 
 export const GET: RequestHandler = async (event) => {
   const requestId = getRequestId(event);
+  const capabilityError = requireCapability(event, 'host:updates', requestId);
+  if (capabilityError) return capabilityError;
   const authError = requireAdmin(event, requestId);
   if (authError) return authError;
 
@@ -272,10 +274,12 @@ export const GET: RequestHandler = async (event) => {
   });
 };
 
-// ── PATCH /admin/versions ────────────────────────────────────────────────────
+// ── PATCH /api/host/versions ────────────────────────────────────────────────────
 
 export const PATCH: RequestHandler = async (event) => {
   const requestId = getRequestId(event);
+  const capabilityError = requireCapability(event, 'host:updates', requestId);
+  if (capabilityError) return capabilityError;
   const authError = requireAdmin(event, requestId);
   if (authError) return authError;
 
diff --git a/packages/ui/src/routes/admin/versions/latest/+server.ts b/packages/ui/src/routes/api/host/versions/latest/+server.ts
similarity index 95%
rename from packages/ui/src/routes/admin/versions/latest/+server.ts
rename to packages/ui/src/routes/api/host/versions/latest/+server.ts
index 8a432b2ab..a157a3ed4 100644
--- a/packages/ui/src/routes/admin/versions/latest/+server.ts
+++ b/packages/ui/src/routes/api/host/versions/latest/+server.ts
@@ -1,5 +1,5 @@
 import { json } from "@sveltejs/kit";
-import { requireAdmin, getRequestId } from "$lib/server/helpers.js";
+import { requireAdmin, requireCapability, getRequestId } from "$lib/server/helpers.js";
 import { DOCKER_IMAGE_NAMES, SERVICE_VERSION_KEYS, compareComparableVersions } from "@openpalm/lib";
 import type { RequestHandler } from "./$types";
 
@@ -68,6 +68,8 @@ let cacheExpiresAt = 0;
 
 export const GET: RequestHandler = async (event) => {
   const requestId = getRequestId(event);
+  const capabilityError = requireCapability(event, 'host:updates', requestId);
+  if (capabilityError) return capabilityError;
   const authError = requireAdmin(event, requestId);
   if (authError) return authError;
 
diff --git a/packages/ui/src/routes/admin/versions/latest/server.vitest.ts b/packages/ui/src/routes/api/host/versions/latest/server.vitest.ts
similarity index 86%
rename from packages/ui/src/routes/admin/versions/latest/server.vitest.ts
rename to packages/ui/src/routes/api/host/versions/latest/server.vitest.ts
index a370ce5e3..e290e6929 100644
--- a/packages/ui/src/routes/admin/versions/latest/server.vitest.ts
+++ b/packages/ui/src/routes/api/host/versions/latest/server.vitest.ts
@@ -1,5 +1,5 @@
 /**
- * Route-level tests for GET /admin/versions/latest.
+ * Route-level tests for GET /api/host/versions/latest.
  *
  * Regression guard for the Docker Hub "latest tag" resolution: it MUST order by
  * last_updated (newest push first), not lexicographic -name. With -name, a tag
@@ -13,8 +13,8 @@ import { GET } from './+server.js';
 
 function makeGetEvent(token = 'admin-token'): Parameters<typeof GET>[0] {
   return {
-    url: new URL('http://localhost/admin/versions/latest'),
-    request: new Request('http://localhost/admin/versions/latest', {
+    url: new URL('http://localhost/api/host/versions/latest'),
+    request: new Request('http://localhost/api/host/versions/latest', {
       method: 'GET',
       headers: { cookie: `op_session=${token}`, 'x-request-id': 'req-latest' },
     }),
@@ -37,14 +37,18 @@ const HUB_TAGS = {
 };
 
 beforeEach(() => {
+  // Phase 4: /api/host + /api/assistant endpoints are capability-guarded;
+  // run this suite as a host-capable mode.
+  process.env.OP_UI_HOST_MODE = 'host-ui';
   resetState('admin-token');
 });
 
 afterEach(() => {
+  delete process.env.OP_UI_HOST_MODE;
   vi.unstubAllGlobals();
 });
 
-describe('GET /admin/versions/latest', () => {
+describe('GET /api/host/versions/latest', () => {
   test('rejects non-admin before any lookup', async () => {
     const res = await GET(makeGetEvent('bad-token'));
     expect(res.status).toBe(401);
diff --git a/packages/ui/src/routes/admin/versions/releases/+server.ts b/packages/ui/src/routes/api/host/versions/releases/+server.ts
similarity index 82%
rename from packages/ui/src/routes/admin/versions/releases/+server.ts
rename to packages/ui/src/routes/api/host/versions/releases/+server.ts
index bd42288d6..7a2a5c346 100644
--- a/packages/ui/src/routes/admin/versions/releases/+server.ts
+++ b/packages/ui/src/routes/api/host/versions/releases/+server.ts
@@ -1,10 +1,10 @@
 import { json } from "@sveltejs/kit";
-import { requireAdmin, getRequestId } from "$lib/server/helpers.js";
+import { requireAdmin, requireCapability, getRequestId } from "$lib/server/helpers.js";
 import { selectInstallableReleases, type RawGitHubRelease } from "$lib/server/release-units.js";
 import type { RequestHandler } from "./$types";
 
 /**
- * GET /admin/versions/releases — list installable platform releases from GitHub.
+ * GET /api/host/versions/releases — list installable platform releases from GitHub.
  *
  * Powers the desktop App-update badge: only platform releases that carry an
  * Electron installer asset. Best-effort — a GitHub outage yields an empty list
@@ -13,6 +13,8 @@ import type { RequestHandler } from "./$types";
  */
 export const GET: RequestHandler = async (event) => {
   const requestId = getRequestId(event);
+  const capabilityError = requireCapability(event, 'host:updates', requestId);
+  if (capabilityError) return capabilityError;
   const authError = requireAdmin(event, requestId);
   if (authError) return authError;
 
diff --git a/packages/ui/src/routes/admin/versions/releases/server.vitest.ts b/packages/ui/src/routes/api/host/versions/releases/server.vitest.ts
similarity index 88%
rename from packages/ui/src/routes/admin/versions/releases/server.vitest.ts
rename to packages/ui/src/routes/api/host/versions/releases/server.vitest.ts
index fd0bf35af..2d1fd7994 100644
--- a/packages/ui/src/routes/admin/versions/releases/server.vitest.ts
+++ b/packages/ui/src/routes/api/host/versions/releases/server.vitest.ts
@@ -1,9 +1,9 @@
 /**
- * Route-level tests for GET /admin/versions/releases.
+ * Route-level tests for GET /api/host/versions/releases.
  *
  * The releases endpoint now returns ONLY platform releases that carry Electron
  * installer assets (app-level releases). Container-image version pins live in
- * stack.env and are edited via /admin/versions, not GitHub releases. Fetched
+ * stack.env and are edited via /api/host/versions, not GitHub releases. Fetched
  * fresh per request (no server-side cache).
  */
 import { afterEach, beforeEach, describe, expect, test, vi } from 'vitest';
@@ -14,8 +14,8 @@ const originalFetch = globalThis.fetch;
 
 function makeGetEvent(token = 'admin-token'): Parameters<typeof GET>[0] {
   return {
-    url: new URL('http://localhost/admin/versions/releases'),
-    request: new Request('http://localhost/admin/versions/releases', {
+    url: new URL('http://localhost/api/host/versions/releases'),
+    request: new Request('http://localhost/api/host/versions/releases', {
       method: 'GET',
       headers: { cookie: `op_session=${token}`, 'x-request-id': 'req-releases-test' },
     }),
@@ -30,15 +30,19 @@ function githubResponse(releases: Array<{ tag_name: string; prerelease: boolean;
 }
 
 beforeEach(() => {
+  // Phase 4: /api/host + /api/assistant endpoints are capability-guarded;
+  // run this suite as a host-capable mode.
+  process.env.OP_UI_HOST_MODE = 'host-ui';
   resetState('admin-token');
 });
 
 afterEach(() => {
+  delete process.env.OP_UI_HOST_MODE;
   vi.unstubAllGlobals();
   globalThis.fetch = originalFetch;
 });
 
-describe('GET /admin/versions/releases', () => {
+describe('GET /api/host/versions/releases', () => {
   test('requires admin auth', async () => {
     const res = await GET(makeGetEvent('bad-token'));
     expect(res.status).toBe(401);
diff --git a/packages/ui/src/routes/admin/versions/server.vitest.ts b/packages/ui/src/routes/api/host/versions/server.vitest.ts
similarity index 92%
rename from packages/ui/src/routes/admin/versions/server.vitest.ts
rename to packages/ui/src/routes/api/host/versions/server.vitest.ts
index 6459c36f0..bede202f8 100644
--- a/packages/ui/src/routes/admin/versions/server.vitest.ts
+++ b/packages/ui/src/routes/api/host/versions/server.vitest.ts
@@ -1,5 +1,5 @@
 /**
- * Route-level tests for GET + PATCH /admin/versions.
+ * Route-level tests for GET + PATCH /api/host/versions.
  *
  * Pins are STATE (constitution §1): GET reads every version key (Docker image
  * tags) from OP_HOME/state, falling back to the legacy stack.env during the
@@ -32,8 +32,8 @@ function seedStackEnv(content: string): void {
 
 function makeGetEvent(token = 'admin-token'): Parameters<typeof GET>[0] {
   return {
-    url: new URL('http://localhost/admin/versions'),
-    request: new Request('http://localhost/admin/versions', {
+    url: new URL('http://localhost/api/host/versions'),
+    request: new Request('http://localhost/api/host/versions', {
       method: 'GET',
       headers: { cookie: `op_session=${token}`, 'x-request-id': 'req-versions-get' },
     }),
@@ -42,8 +42,8 @@ function makeGetEvent(token = 'admin-token'): Parameters<typeof GET>[0] {
 
 function makePatchEvent(body: unknown, token = 'admin-token'): Parameters<typeof PATCH>[0] {
   return {
-    url: new URL('http://localhost/admin/versions'),
-    request: new Request('http://localhost/admin/versions', {
+    url: new URL('http://localhost/api/host/versions'),
+    request: new Request('http://localhost/api/host/versions', {
       method: 'PATCH',
       headers: { cookie: `op_session=${token}`, 'content-type': 'application/json', 'x-request-id': 'req-versions-patch' },
       body: JSON.stringify(body),
@@ -54,14 +54,18 @@ function makePatchEvent(body: unknown, token = 'admin-token'): Parameters<typeof
 type VersionsBody = { versions: Record<string, string>; platformVersion: string };
 
 beforeEach(() => {
+  // Phase 4: /api/host + /api/assistant endpoints are capability-guarded;
+  // run this suite as a host-capable mode.
+  process.env.OP_UI_HOST_MODE = 'host-ui';
   resetState('admin-token');
 });
 
 afterEach(() => {
+  delete process.env.OP_UI_HOST_MODE;
   // resetState builds a fresh temp OP_HOME each run; nothing to undo.
 });
 
-describe('GET /admin/versions', () => {
+describe('GET /api/host/versions', () => {
   test('requires admin auth', async () => {
     const res = await GET(makeGetEvent('bad-token'));
     expect(res.status).toBe(401);
@@ -91,7 +95,7 @@ describe('GET /admin/versions', () => {
   });
 });
 
-describe('PATCH /admin/versions', () => {
+describe('PATCH /api/host/versions', () => {
   test('requires admin auth', async () => {
     const res = await PATCH(makePatchEvent({ versions: { OP_ASSISTANT_VERSION: 'v1' } }, 'bad-token'));
     expect(res.status).toBe(401);
diff --git a/packages/ui/src/routes/admin/versions/ui/+server.ts b/packages/ui/src/routes/api/host/versions/ui/+server.ts
similarity index 89%
rename from packages/ui/src/routes/admin/versions/ui/+server.ts
rename to packages/ui/src/routes/api/host/versions/ui/+server.ts
index 20cbe2170..7456e1b9d 100644
--- a/packages/ui/src/routes/admin/versions/ui/+server.ts
+++ b/packages/ui/src/routes/api/host/versions/ui/+server.ts
@@ -1,5 +1,5 @@
 import { json } from "@sveltejs/kit";
-import { requireAdmin, getRequestId } from "$lib/server/helpers.js";
+import { requireAdmin, requireCapability, getRequestId } from "$lib/server/helpers.js";
 import type { RequestHandler } from "./$types";
 
 /** One installable `@openpalm/ui` build from the npm registry. */
@@ -23,12 +23,14 @@ type Packument = {
  *
  * The UI is independently versioned and distributed via npm, so this is the
  * authoritative source of installable UI builds — the selected version is POSTed
- * to /admin/ui-version, which seeds it from npm. Best-effort: a 404 (package not
+ * to /api/host/ui-version, which seeds it from npm. Best-effort: a 404 (package not
  * yet published) or registry outage yields an empty list. Newest-first. (No
  * server-side cache — the admin UI no longer polls this.)
  */
 export const GET: RequestHandler = async (event) => {
   const requestId = getRequestId(event);
+  const capabilityError = requireCapability(event, 'host:updates', requestId);
+  if (capabilityError) return capabilityError;
   const authError = requireAdmin(event, requestId);
   if (authError) return authError;
 
diff --git a/packages/ui/src/routes/admin/voice/+server.ts b/packages/ui/src/routes/api/host/voice/+server.ts
similarity index 96%
rename from packages/ui/src/routes/admin/voice/+server.ts
rename to packages/ui/src/routes/api/host/voice/+server.ts
index acb2e751b..3acf729a0 100644
--- a/packages/ui/src/routes/admin/voice/+server.ts
+++ b/packages/ui/src/routes/api/host/voice/+server.ts
@@ -1,8 +1,8 @@
 /**
- * GET /admin/voice  — Return current TTS/STT env vars from stack.env plus
+ * GET /api/host/voice  — Return current TTS/STT env vars from stack.env plus
  *                     an `availability` block (best-effort reachability of
  *                     the configured remote endpoints).
- * PUT /admin/voice  — Write TTS/STT env vars to stack.env. Auto-enables
+ * PUT /api/host/voice  — Write TTS/STT env vars to stack.env. Auto-enables
  *                     the openpalm-voice addon, brings the chosen profile
  *                     up, waits for /health, and translates Docker errors
  *                     to operator-actionable copy.
@@ -26,6 +26,7 @@ import {
   getRequestId,
   jsonResponse,
   requireAdmin,
+  requireCapability,
 } from '$lib/server/helpers.js';
 import { withSerialQueue } from '$lib/server/serial-queue.js';
 import {
@@ -61,6 +62,8 @@ async function probeReachable(baseURL: string): Promise<boolean> {
 
 export const GET: RequestHandler = async (event) => {
   const requestId = getRequestId(event);
+  const capabilityError = requireCapability(event, 'host:stack:read', requestId);
+  if (capabilityError) return capabilityError;
   const authError = requireAdmin(event, requestId);
   if (authError) return authError;
 
@@ -189,6 +192,8 @@ export const PUT: RequestHandler = (event) => {
 
 async function handlePut(event: Parameters<RequestHandler>[0]): Promise<Response> {
   const requestId = getRequestId(event);
+  const capabilityError = requireCapability(event, 'host:stack:write', requestId);
+  if (capabilityError) return capabilityError;
   const authError = requireAdmin(event, requestId);
   if (authError) return authError;
 
diff --git a/packages/ui/src/routes/admin/voice/server.vitest.ts b/packages/ui/src/routes/api/host/voice/server.vitest.ts
similarity index 96%
rename from packages/ui/src/routes/admin/voice/server.vitest.ts
rename to packages/ui/src/routes/api/host/voice/server.vitest.ts
index 0334aa57d..ace390063 100644
--- a/packages/ui/src/routes/admin/voice/server.vitest.ts
+++ b/packages/ui/src/routes/api/host/voice/server.vitest.ts
@@ -5,7 +5,7 @@ import { randomBytes } from 'node:crypto';
 import { tmpdir } from 'node:os';
 
 // Stub the docker + addon-registry surface of @openpalm/lib so PUT
-// /admin/voice's auto-enable + compose-up + healthcheck flow doesn't
+// /api/host/voice's auto-enable + compose-up + healthcheck flow doesn't
 // reach for a real docker daemon. The save-path semantics (preset
 // auto-fill, validation, writeVoiceVars) live in the route itself
 // and are exercised below; whether docker actually starts the voice
@@ -64,7 +64,7 @@ function makeTempDir(): string {
 
 function makeGetEvent(token = 'admin-token'): Parameters<typeof GET>[0] {
 	return {
-		request: new Request('http://localhost/admin/voice', {
+		request: new Request('http://localhost/api/host/voice', {
 			headers: {
 				cookie: `op_session=${token}`,
 				'x-request-id': 'req-voice-get',
@@ -75,7 +75,7 @@ function makeGetEvent(token = 'admin-token'): Parameters<typeof GET>[0] {
 
 function makePutEvent(body: Record<string, unknown>, token = 'admin-token'): Parameters<typeof PUT>[0] {
 	return {
-		request: new Request('http://localhost/admin/voice', {
+		request: new Request('http://localhost/api/host/voice', {
 			method: 'PUT',
 			headers: {
 				cookie: `op_session=${token}`,
@@ -92,6 +92,9 @@ let originalVoicePort: string | undefined;
 let fetchSpy: ReturnType<typeof vi.spyOn> | undefined;
 
 beforeEach(() => {
+  // Phase 4: /api/host + /api/assistant endpoints are capability-guarded;
+  // run this suite as a host-capable mode.
+  process.env.OP_UI_HOST_MODE = 'host-ui';
 	originalHome = process.env.OP_HOME;
 	originalVoicePort = process.env.OP_VOICE_PORT_HOST;
 	process.env.OP_HOME = makeTempDir();
@@ -106,6 +109,7 @@ beforeEach(() => {
 });
 
 afterEach(() => {
+  delete process.env.OP_UI_HOST_MODE;
 	process.env.OP_HOME = originalHome;
 	if (originalVoicePort === undefined) delete process.env.OP_VOICE_PORT_HOST;
 	else process.env.OP_VOICE_PORT_HOST = originalVoicePort;
@@ -115,7 +119,7 @@ afterEach(() => {
 	rmSync(getState().homeDir, { recursive: true, force: true });
 });
 
-describe('PUT /admin/voice', () => {
+describe('PUT /api/host/voice', () => {
 	test('requires admin auth', async () => {
 		const res = await PUT(makePutEvent({}, 'bad-token'));
 		expect(res.status).toBe(401);
@@ -203,7 +207,7 @@ describe('PUT /admin/voice', () => {
 	});
 });
 
-describe('GET /admin/voice', () => {
+describe('GET /api/host/voice', () => {
 	test('returns availability block', async () => {
 		const res = await GET(makeGetEvent());
 		expect(res.status).toBe(200);
@@ -239,7 +243,7 @@ describe('GET /admin/voice', () => {
 	});
 });
 
-describe('PUT /admin/voice — host fallback overlays', () => {
+describe('PUT /api/host/voice — host fallback overlays', () => {
 	test('skips rootless + cdi fallback when VITEST is set (deterministic test env)', async () => {
 		// VITEST=1 is set by vitest; the route short-circuits the docker-info
 		// probes so tests don't have to mock child_process. Confirm the
diff --git a/packages/ui/src/routes/attention/+page.svelte b/packages/ui/src/routes/attention/+page.svelte
index da80c69d9..505b4b74e 100644
--- a/packages/ui/src/routes/attention/+page.svelte
+++ b/packages/ui/src/routes/attention/+page.svelte
@@ -31,7 +31,7 @@
 
       <div class="attention-actions">
         <button class="btn btn-primary btn-lg" onclick={() => window.location.reload()}>Reload</button>
-        <a class="btn btn-outline btn-lg" href={resolve('/admin')}>Open dashboard</a>
+        <a class="btn btn-outline btn-lg" href={resolve('/host')}>Open dashboard</a>
       </div>
     </div>
   </main>
diff --git a/packages/ui/src/routes/chat/+page.svelte b/packages/ui/src/routes/chat/+page.svelte
index 3b273eaae..06e716e67 100644
--- a/packages/ui/src/routes/chat/+page.svelte
+++ b/packages/ui/src/routes/chat/+page.svelte
@@ -541,7 +541,7 @@
 							<div class="s-endpoint-url">{ep.url}</div>
 						</button>
 						{#if ep.url && isLocalAssistantUrl(ep.url)}
-							<a class="s-endpoint-manage" href={resolve('/admin')} onclick={closeGarden}
+							<a class="s-endpoint-manage" href={resolve('/host')} onclick={closeGarden}
 								>manage this assistant</a
 							>
 						{/if}
diff --git a/packages/ui/src/routes/admin/+page.svelte b/packages/ui/src/routes/host/+page.svelte
similarity index 98%
rename from packages/ui/src/routes/admin/+page.svelte
rename to packages/ui/src/routes/host/+page.svelte
index e5ae6cc61..3a950473e 100644
--- a/packages/ui/src/routes/admin/+page.svelte
+++ b/packages/ui/src/routes/host/+page.svelte
@@ -52,7 +52,7 @@
   let pullLoading = $state(false);
 
   // Version management lives entirely inside UpdatesTab now — it self-fetches
-  // GET /admin/versions and applies via PATCH /admin/versions + POST /admin/update.
+  // GET /api/host/versions and applies via PATCH /api/host/versions + POST /api/host/update.
 
   // ── Container polling ──────────────────────────────────────────────────────
   const POLL_INTERVAL_MS = 10_000;
@@ -135,10 +135,10 @@
 
   // Called when an in-page API request returns 401 (session expired/invalid
   // mid-session). Server-side gating handles page navigations; here we bounce to
-  // the login route and return to /admin after re-authenticating.
+  // the login route and return to /host after re-authenticating.
   function applyInvalidTokenState(): void {
     // eslint-disable-next-line svelte/no-navigation-without-resolve -- internal login path with a query string, not a static route id
-    void goto(`/login?redirectTo=${encodeURIComponent('/admin')}`);
+    void goto(`/login?redirectTo=${encodeURIComponent('/host')}`);
   }
 
   // ── Data loaders ─────────────────────────────────────────────────────────────
diff --git a/packages/ui/src/routes/layout.server.vitest.ts b/packages/ui/src/routes/layout.server.vitest.ts
index 6b0618376..fe70a2508 100644
--- a/packages/ui/src/routes/layout.server.vitest.ts
+++ b/packages/ui/src/routes/layout.server.vitest.ts
@@ -2,11 +2,13 @@
  * Tests for routes/+layout.server.ts — Phase 1 RuntimeContext v2 (issue #509).
  *
  * TDD status:
- *  - The `features.admin` tests are CHARACTERIZATION: they pass pre-change and
- *    MUST keep passing — Phase 1 keeps `features.admin` as a derived alias so
- *    all existing code and routes work unchanged (zero behavior change).
- *  - The `serverRuntimeContext` tests are RED until #509 lands: the layout
- *    load must additionally return the ServerRuntimeContext computed by
+ *  - The `features.admin` characterization block that protected the derived
+ *    alias through Phases 1–3 was retired with the alias itself in Phase 4
+ *    (plan Phase 4 step 4: delete when grep finds no reader — nothing
+ *    consumed `data.features` anymore). The env → hostMode mapping it pinned
+ *    is covered by the serverRuntimeContext tests below.
+ *  - The `serverRuntimeContext` tests describe the #509 layout payload: the
+ *    load returns the ServerRuntimeContext computed by
  *    computeServerRuntimeContext(event) (plan Phase 1 step 3).
  */
 import { afterEach, beforeEach, describe, expect, test } from 'vitest';
@@ -50,28 +52,11 @@ afterEach(() => {
   }
 });
 
-// ── features.admin alias (CHARACTERIZATION — green pre-change) ───────────────
+// The features.admin alias characterization block lived here through Phases
+// 1–3. Phase 4 deleted the alias with its last readers; the layout payload
+// now carries only serverRuntimeContext.
 
-describe('+layout.server load — features.admin alias (characterization)', () => {
-  test('features.admin is true under OP_INSIDE_ELECTRON=1', async () => {
-    process.env.OP_INSIDE_ELECTRON = '1';
-    const data = await runLoad();
-    expect((data.features as { admin: boolean }).admin).toBe(true);
-  });
-
-  test('features.admin is true under OP_ENABLE_ADMIN=1', async () => {
-    process.env.OP_ENABLE_ADMIN = '1';
-    const data = await runLoad();
-    expect((data.features as { admin: boolean }).admin).toBe(true);
-  });
-
-  test('features.admin is false when neither legacy env is set', async () => {
-    const data = await runLoad();
-    expect((data.features as { admin: boolean }).admin).toBe(false);
-  });
-});
-
-// ── serverRuntimeContext (RED until #509 lands) ──────────────────────────────
+// ── serverRuntimeContext (#509 layout payload) ────────────────────────────────
 
 describe('+layout.server load — serverRuntimeContext (plan Phase 1)', () => {
   test('layout data includes serverRuntimeContext with contract version 2', async () => {
diff --git a/packages/ui/src/routes/page.svelte.vitest.ts b/packages/ui/src/routes/page.svelte.vitest.ts
index 7b2d1f4c1..f3b49f601 100644
--- a/packages/ui/src/routes/page.svelte.vitest.ts
+++ b/packages/ui/src/routes/page.svelte.vitest.ts
@@ -1,11 +1,11 @@
 import { describe, it, afterEach } from 'vitest';
 import { render } from 'vitest-browser-svelte';
 import { useConsoleGuard, type ConsoleGuard } from '$lib/test-utils/console-guard';
-import AdminPage from './admin/+page.svelte';
+import HostPage from './host/+page.svelte';
 
-// Root / now redirects to /chat via +page.ts.
-// The admin dashboard has moved to /admin — test it renders without console errors.
-describe('/admin/+page.svelte (admin dashboard)', () => {
+// Root / now redirects via resolveLanding (hooks + +page.server.ts).
+// The host dashboard lives at /host (Phase 4) — test it renders without console errors.
+describe('/host/+page.svelte (host dashboard)', () => {
 	let guard: ConsoleGuard;
 
 	afterEach(() => {
@@ -14,7 +14,7 @@ describe('/admin/+page.svelte (admin dashboard)', () => {
 
 	it('should render without console errors', async () => {
 		guard = useConsoleGuard();
-		render(AdminPage);
+		render(HostPage);
 
 		// The dashboard renders the auth gate (or dashboard content) — no JS errors expected
 		guard.expectNoErrors();

From a25cf7c5fc11ce3da403d9a668fc80d757b1a14f Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Mon, 6 Jul 2026 15:08:48 +0000
Subject: [PATCH 21/61] docs: update route map + API spec for the Phase 4
 control-plane split (#555)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

ui-route-map.md reflects the post-Phase-4 truth (/host page, /api/host/*
with per-endpoint requireCapability guards, /api/assistant/*, /api/auth/*,
/admin/* → 404). api-spec.md and managing-openpalm.md endpoint paths follow
the namespace move, with a Conventions note on the capability guards.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FetR7BttT1xBrA8fBwhui9
---
 docs/managing-openpalm.md      |  12 ++--
 docs/technical/api-spec.md     | 119 +++++++++++++++++----------------
 docs/technical/ui-route-map.md | 104 ++++++++++++++++------------
 3 files changed, 129 insertions(+), 106 deletions(-)

diff --git a/docs/managing-openpalm.md b/docs/managing-openpalm.md
index b34836987..31871bf08 100644
--- a/docs/managing-openpalm.md
+++ b/docs/managing-openpalm.md
@@ -114,15 +114,15 @@ Current shipped network model:
 
 ### Enable/disable an addon
 
-Addons are managed via `/admin/addons` routes. Example:
+Addons are managed via `/api/host/addons` routes. Example:
 
 ```bash
 # Authenticate first to obtain an op_session cookie (Phase 2+).
-curl -c cookies.txt -X POST http://localhost:3880/admin/auth/login \
+curl -c cookies.txt -X POST http://localhost:3880/api/auth/login \
   -H "Content-Type: application/json" \
   -d "{\"password\":\"$OP_UI_LOGIN_PASSWORD\"}"
 
-curl -b cookies.txt -X POST http://localhost:3880/admin/addons/chat \
+curl -b cookies.txt -X POST http://localhost:3880/api/host/addons/chat \
   -H "Content-Type: application/json" \
   -d '{"enabled":true}'
 ```
@@ -428,13 +428,13 @@ ls ~/.openpalm/data/admin-opencode/log/              # Electron-spawned OpenCode
 **Check container status:**
 ```bash
 docker compose ps
-# Or via API (requires op_session cookie from /admin/auth/login):
-curl -b cookies.txt http://localhost:3880/admin/containers/list
+# Or via API (requires op_session cookie from /api/auth/login):
+curl -b cookies.txt http://localhost:3880/api/host/containers/list
 ```
 
 **Pull latest images and recreate containers:**
 ```bash
-curl -b cookies.txt -X POST http://localhost:3880/admin/containers/pull
+curl -b cookies.txt -X POST http://localhost:3880/api/host/containers/pull
 ```
 
 This runs `docker compose pull` followed by `docker compose up` to recreate
diff --git a/docs/technical/api-spec.md b/docs/technical/api-spec.md
index 6009fcd29..e6f749357 100644
--- a/docs/technical/api-spec.md
+++ b/docs/technical/api-spec.md
@@ -6,8 +6,15 @@ This document describes the Admin API routes currently implemented in
 ## Conventions
 
 - Base URL: `http://localhost:3880`
+- Namespaces (Phase 4 of `ui-runtime-modes-plan.md`): privileged host
+  endpoints live under `/api/host/*` (requireAdmin + a server-side
+  `requireCapability('host:…')` guard — 403 `capability_not_available` in
+  modes without host capabilities), assistant-owned settings under
+  `/api/assistant/*` (`assistant-settings:*` capabilities), session lifecycle
+  under `/api/auth/*`, connections under `/api/connections/*`. The legacy
+  `/admin/*` namespace is a router 404 since Phase 4 (no alias).
 - Protected endpoints require the `op_session` cookie (HttpOnly, SameSite=Strict).
-  The browser obtains the cookie via `POST /admin/auth/login` (password in body).
+  The browser obtains the cookie via `POST /api/auth/login` (password in body).
   The legacy `x-admin-token` / `Authorization: Bearer` header fallbacks were
   removed in Phase 2 of `docs/technical/auth-and-proxy-refactor-plan.md`.
   `OP_UI_LOGIN_PASSWORD` is supplied to the admin process from
@@ -97,14 +104,14 @@ Response:
 Policy for this section:
 
 - `config/` is the user-owned persistent source of truth.
-- `POST /admin/install`, `POST /admin/update`, and startup auto-apply are
+- `POST /api/host/install`, `POST /api/host/update`, and startup auto-apply are
   automatic lifecycle operations: non-destructive for existing user config files
   in `config/`; they only seed missing defaults.
-- Explicit mutation endpoints (`POST /admin/addons`, `POST /admin/addons/:name`,
-  `POST /api/setup/complete`, `PATCH /admin/akm`) are the allowed write path
+- Explicit mutation endpoints (`POST /api/host/addons`, `POST /api/host/addons/:name`,
+  `POST /api/setup/complete`, `PATCH /api/assistant/akm`) are the allowed write path
   for requested config changes.
 
-### `POST /admin/install`
+### `POST /api/host/install`
 
 - Ensures directories + OpenCode starter config + starter user secrets.
 - Seeds only missing defaults in `config/`; never overwrites existing user files.
@@ -122,7 +129,7 @@ Response:
 }
 ```
 
-### `POST /admin/update`
+### `POST /api/host/update`
 
 - Non-destructive for existing user config; seeds missing defaults only.
 - Writes configuration files to their final locations.
@@ -134,7 +141,7 @@ Response:
 { "ok": true, "restarted": ["guardian"], "dockerAvailable": true }
 ```
 
-### `POST /admin/uninstall`
+### `POST /api/host/uninstall`
 
 - Runs compose down.
 - Does not delete or rewrite existing user config in `config/`.
@@ -146,14 +153,14 @@ Response:
 { "ok": true, "stopped": ["assistant"], "dockerAvailable": true }
 ```
 
-> The former `POST /admin/upgrade` endpoint was removed in 0.12.36. Updates now
-> run through `POST /admin/update` (above) plus `POST /admin/migrate-apply`,
+> The former `POST /api/host/upgrade` endpoint was removed in 0.12.36. Updates now
+> run through `POST /api/host/update` (above) plus `POST /api/host/migrate-apply`,
 > which performs the full reconcile under lock when a home is detected stale (see
 > the splash apply flow).
 
 ## Container Operations
 
-### `GET /admin/containers/list`
+### `GET /api/host/containers/list`
 
 Returns in-memory service state synced with live Docker container data when
 Docker is available.
@@ -168,7 +175,7 @@ Response:
 }
 ```
 
-### `POST /admin/containers/pull`
+### `POST /api/host/containers/pull`
 
 - Pulls the latest images for all services in the current compose file list.
 - After a successful pull, recreates containers with the updated images via `compose up`.
@@ -187,9 +194,9 @@ Error responses:
 - `502 pull_failed` — `docker compose pull` failed.
 - `502 up_failed` — Images pulled but container recreation failed.
 
-### `POST /admin/containers/up`
-### `POST /admin/containers/down`
-### `POST /admin/containers/restart`
+### `POST /api/host/containers/up`
+### `POST /api/host/containers/down`
+### `POST /api/host/containers/restart`
 
 Body:
 
@@ -211,7 +218,7 @@ Success response:
 { "ok": true, "service": "chat", "status": "running" }
 ```
 
-### `GET /admin/containers/stats`
+### `GET /api/host/containers/stats`
 
 Returns live Docker container resource usage (CPU, memory, network I/O) for managed services.
 Each entry is one JSON object from `docker compose stats --format json --no-stream`.
@@ -234,7 +241,7 @@ Error responses:
 - `500 docker_error` -- `docker compose stats` failed.
 - `500 parse_error` -- Failed to parse stats output.
 
-### `GET /admin/containers/events`
+### `GET /api/host/containers/events`
 
 Returns recent Docker engine events (container start/stop/restart/die) filtered to managed services.
 
@@ -260,7 +267,7 @@ Error responses:
 - `500 docker_error` -- `docker events` failed.
 - `500 parse_error` -- Failed to parse events output.
 
-### `GET /admin/network/check`
+### `GET /api/host/network/check`
 
 Checks inter-container connectivity by probing each core service health endpoint from the host admin process.
 
@@ -281,7 +288,7 @@ Response:
 
 ## Addon Management
 
-### `GET /admin/addons`
+### `GET /api/host/addons`
 
 Returns all available addons with enabled status.
 
@@ -297,7 +304,7 @@ Response:
 }
 ```
 
-### `POST /admin/addons`
+### `POST /api/host/addons`
 
 Enable or disable an addon.
 
@@ -322,7 +329,7 @@ Error responses:
 - `404 not_found` -- Addon name is not a built-in optional service.
 - `500 internal_error` -- Failed to update addon state on disk.
 
-### `GET /admin/addons/:name`
+### `GET /api/host/addons/:name`
 
 Returns detail for a single addon.
 
@@ -344,7 +351,7 @@ Error responses:
 
 - `404 not_found` -- Addon name is not a built-in optional service.
 
-### `POST /admin/addons/:name`
+### `POST /api/host/addons/:name`
 
 Enable or disable a specific addon.
 
@@ -374,10 +381,10 @@ Error responses:
 
 Automation task files live under `~/.openpalm/knowledge/tasks/` and are owned by AKM.
 
-### `GET /admin/automations/catalog`
+### `GET /api/host/automations/catalog`
 
 Lists available automation tasks from `~/.openpalm/knowledge/tasks/`. Portal addons
-are managed via `/admin/addons` and Compose profiles.
+are managed via `/api/host/addons` and Compose profiles.
 
 Response:
 
@@ -393,10 +400,10 @@ Response:
 `source` is `"remote"` when loaded from a cloned registry repo, `"bundled"`
 when using build-time bundled stack assets.
 
-### `POST /admin/automations/catalog/install`
+### `POST /api/host/automations/catalog/install`
 
 Install a registry automation. Portal addons are managed via
-`POST /admin/addons/:name`.
+`POST /api/host/addons/:name`.
 
 Body:
 
@@ -421,7 +428,7 @@ Error responses:
 - `400 invalid_input` -- Invalid name, type is not `"automation"`, item not
   found in registry, or item already installed.
 
-### `POST /admin/automations/catalog/refresh`
+### `POST /api/host/automations/catalog/refresh`
 
 Refreshes the registry index from the configured registry source.
 
@@ -435,10 +442,10 @@ Error responses:
 
 - `500 registry_sync_error` — Refresh failed.
 
-### `POST /admin/automations/catalog/uninstall`
+### `POST /api/host/automations/catalog/uninstall`
 
 Uninstall a registry automation. Portal addons are managed via
-`POST /admin/addons/:name`.
+`POST /api/host/addons/:name`.
 
 Body:
 
@@ -460,7 +467,7 @@ Response:
 
 ## Automations
 
-### `GET /admin/automations`
+### `GET /api/host/automations`
 
 Lists all automation configs from `~/.openpalm/knowledge/tasks/`.
 
@@ -478,7 +485,7 @@ Response:
       "action": {
         "type": "http",
         "method": "POST",
-        "path": "/admin/...",
+        "path": "/api/host/...",
         "url": null,
         "content": null,
         "agent": null
@@ -490,7 +497,7 @@ Response:
 }
 ```
 
-### `POST /admin/automations/:name/run`
+### `POST /api/host/automations/:name/run`
 
 Manually trigger an automation. The admin spawns `akm tasks run <name>` directly;
 execution logs are written to `${OP_HOME}/data/akm/cache/tasks/logs/<name>/` and history
@@ -510,7 +517,7 @@ Error responses:
 - `404 not_found` -- Automation is not installed in `knowledge/tasks/`.
 - `500 internal_error` -- `akm tasks run` exited non-zero.
 
-### `GET /admin/automations/:name/log`
+### `GET /api/host/automations/:name/log`
 
 Returns recent execution log lines from `${OP_HOME}/data/akm/cache/tasks/logs/<name>/` (newest first).
 
@@ -531,7 +538,7 @@ Response:
 
 ## Configuration Endpoints
 
-### `GET /admin/config/validate`
+### `GET /api/host/config/validate`
 
 Run the in-house key-presence and secret-audit checks against non-secret
 `knowledge/env/stack.env`, resolved Compose config, and `knowledge/secrets/`.
@@ -571,24 +578,24 @@ When validation finds issues:
 
 ## Artifact and Audit APIs
 
-### `GET /admin/artifacts`
+### `GET /api/host/artifacts`
 
 ```json
 { "artifacts": [{ "name": "compose", "sha256": "...", "generatedAt": "...", "bytes": 1234 }] }
 ```
 
-### `GET /admin/artifacts/manifest`
+### `GET /api/host/artifacts/manifest`
 
 ```json
 { "manifest": [{ "name": "compose", "sha256": "...", "generatedAt": "...", "bytes": 1234 }] }
 ```
 
-### `GET /admin/artifacts/:name`
+### `GET /api/host/artifacts/:name`
 
 - Allowed names: `compose`.
 - Returns `text/plain` and may include `x-artifact-sha256` header.
 
-### `GET /admin/audit?limit=<n>&source=<source>`
+### `GET /api/host/audit?limit=<n>&source=<source>`
 
 Query parameters:
 
@@ -604,7 +611,7 @@ Query parameters:
 
 ## Installed Services
 
-### `GET /admin/installed`
+### `GET /api/host/installed`
 
 ```json
 {
@@ -619,7 +626,7 @@ The UI (`@openpalm/ui`) is independently versioned and distributed via npm, not
 as a GitHub release asset. These endpoints let the operator browser and CLI
 discover available UI versions and install a specific one.
 
-### `GET /admin/versions/ui`
+### `GET /api/host/versions/ui`
 
 Lists published `@openpalm/ui` npm versions for the admin UI build picker.
 Returns newest-first (by npm publish time); a 404 from the registry (package not
@@ -666,7 +673,7 @@ Fields:
 
 Up to 20 versions are returned.
 
-### `GET /admin/versions/releases`
+### `GET /api/host/versions/releases`
 
 Lists GitHub platform release tags (newest first). Used to display the platform
 release history in the admin UI. UI build information is **not** included — UI
@@ -693,9 +700,9 @@ On error:
 
 Note: The `hasUiBuild` field that previously appeared on each release entry has
 been removed; UI builds are now sourced independently from the `@openpalm/ui`
-npm package via `GET /admin/versions/ui`.
+npm package via `GET /api/host/versions/ui`.
 
-### `POST /admin/ui-version`
+### `POST /api/host/ui-version`
 
 Seeds a specific `@openpalm/ui` npm version (or dist-tag) into `data/ui/`. The
 build is downloaded from the npm registry, integrity-verified (sha512, fail-
@@ -712,7 +719,7 @@ Body:
 
 - `tag` (required) — An `@openpalm/ui` npm version (e.g. `"0.11.0-rc.2"`) or
   dist-tag (e.g. `"latest"`, `"next"`). **This is no longer a GitHub platform
-  release tag**; use `GET /admin/versions/ui` to list installable versions.
+  release tag**; use `GET /api/host/versions/ui` to list installable versions.
   Must match `^[a-zA-Z0-9._\-]+$`.
 
 Response:
@@ -731,7 +738,7 @@ Error responses:
 
 ## Local Provider Detection
 
-### `GET /admin/providers/local`
+### `GET /api/host/providers/local`
 
 Probes well-known local LLM provider endpoints to detect which are running.
 Requires admin auth.
@@ -760,7 +767,7 @@ Response:
 
 Manage secrets via the detected secret backend (env-file or pass-based).
 
-### `GET /admin/secrets`
+### `GET /api/host/secrets`
 
 Lists secret entry names (values are never returned in full).
 
@@ -782,7 +789,7 @@ Response:
 }
 ```
 
-### `POST /admin/secrets`
+### `POST /api/host/secrets`
 
 Set or update a secret value.
 
@@ -809,7 +816,7 @@ Error responses:
 - `400 invalid_key` -- Key fails `validatePassEntryName` validation.
 - `500 internal_error` -- Failed to write secret.
 
-### `DELETE /admin/secrets`
+### `DELETE /api/host/secrets`
 
 Delete a secret entry.
 
@@ -830,7 +837,7 @@ Error responses:
 - `400 bad_request` -- `key` query parameter missing.
 - `500 internal_error` -- Failed to remove secret.
 
-### `POST /admin/secrets/generate`
+### `POST /api/host/secrets/generate`
 
 Generate a random secret and store it under the given key.
 
@@ -860,7 +867,7 @@ Error responses:
 
 ## OpenCode Management
 
-### `GET /admin/opencode/status`
+### `GET /api/host/opencode/status`
 
 Returns whether the OpenCode process is reachable.
 
@@ -878,7 +885,7 @@ When unreachable:
 { "status": "unavailable", "url": "http://localhost:4096/" }
 ```
 
-### `GET /admin/opencode/model`
+### `GET /api/assistant/model`
 
 Returns the current model from OpenCode's live config.
 
@@ -894,7 +901,7 @@ Error responses:
 
 - `503 opencode_unavailable` -- OpenCode is not reachable.
 
-### `POST /admin/opencode/model`
+### `POST /api/assistant/model`
 
 Update the active model. Persists to the assistant OpenCode config and attempts
 live-apply via OpenCode's config API.
@@ -924,7 +931,7 @@ Error responses:
 - `400 bad_request` -- `model` is missing or empty.
 - `500 internal_error` -- persisting the OpenCode model selection failed.
 
-### `GET /admin/opencode/providers`
+### `GET /api/host/opencode/providers`
 
 Lists all OpenCode providers with auth status and available models.
 
@@ -948,7 +955,7 @@ Response:
 }
 ```
 
-### `GET /admin/opencode/providers/:id/auth`
+### `GET /api/host/opencode/providers/:id/auth`
 
 Poll an OAuth authorization session for a provider.
 
@@ -971,7 +978,7 @@ Error responses:
 - `400 bad_request` -- `pollToken` missing or provider ID mismatch.
 - `404 not_found` -- Poll session not found or expired.
 
-### `POST /admin/opencode/providers/:id/auth`
+### `POST /api/host/opencode/providers/:id/auth`
 
 Start an auth flow for a provider (API key or OAuth).
 
@@ -1014,7 +1021,7 @@ Error responses:
   unsupported provider, or invalid `methodIndex`.
 - `500 internal_error` -- Failed to write API key to the user env.
 
-### `GET /admin/opencode/providers/:id/models`
+### `GET /api/host/opencode/providers/:id/models`
 
 Lists available models for a specific provider.
 
@@ -1241,7 +1248,7 @@ Error responses:
 
 ## Logs
 
-### `GET /admin/logs`
+### `GET /api/host/logs`
 
 Retrieves Docker Compose service logs via `docker compose logs`.
 
diff --git a/docs/technical/ui-route-map.md b/docs/technical/ui-route-map.md
index 139535969..a606c3df4 100644
--- a/docs/technical/ui-route-map.md
+++ b/docs/technical/ui-route-map.md
@@ -1,16 +1,17 @@
 # UI Route Map
 
-**Date:** 2026-07-06 (Phase 3 of `ui-runtime-modes-plan.md`)
+**Date:** 2026-07-06 (Phase 4 of `ui-runtime-modes-plan.md`)
 **Package:** `packages/ui` (`@openpalm/ui` — the host app)
-**Status:** current truth after the Phase 3 landing/navigation split. Phase 4
-renames `/admin` → `/host` (no alias; `HOST_ADMIN_LANDING` in
-`src/lib/resolve-landing.ts` flips with it). Phase 5 moves the chat +
-connections views into `packages/client`.
+**Status:** current truth after the Phase 4 control-plane split. `/admin/*` is
+a **dead namespace** (router 404, no alias): pages live at `/host`, privileged
+JSON endpoints at `/api/host/*`, assistant-owned settings at
+`/api/assistant/*`, session lifecycle at `/api/auth/*`. Phase 5 moves the
+chat + connections views into `packages/client`.
 
 Surfaces (plan §1): **Host** = host control plane (stack lifecycle, secrets,
-privileged ops), **Assistant** = chat against the active connection,
-**Connection** = connection management, **Entry** = landing/auth/first-run
-plumbing shared by all surfaces.
+privileged ops), **Assistant** = chat against the active connection +
+assistant-owned settings, **Connection** = connection management, **Entry** =
+landing/auth/first-run plumbing shared by all surfaces.
 
 ## Landing resolution
 
@@ -24,8 +25,8 @@ launchState)` (`src/lib/resolve-landing.ts`, plan §6.5):
 | `host:setup` + local `not_installed` (no accessible connection) | `/setup` |
 | `host:setup` + local `not_installed` (accessible connection exists, #440) | `/chat` |
 | `host:setup` + local `setup_incomplete` | `/setup` |
-| `host:setup` + local `installed_offline` | `/admin` (Phase 4: `/host`) |
-| `host:setup` + local `installed_broken` | `/admin?tab=diagnostics` |
+| `host:setup` + local `installed_offline` | `/host` |
+| `host:setup` + local `installed_broken` | `/host?tab=diagnostics` |
 | `host:setup` + local `running` | `/chat` |
 | no `host:setup`, `assistant-container` mode | `/chat` |
 | no `host:setup`, `pwa-static` mode, 0 connections | `/connections/new` |
@@ -42,20 +43,26 @@ release only.
 - **auth** — document navigations (GET + `Accept: text/html`) without a valid
   `op_session` cookie redirect to `/login?redirectTo=…`. API/data requests are
   left to the endpoint's own JSON 401.
-- **admin gate** — `/admin/*` requires a host-capable mode
-  (`electron-host`/`host-ui`, the legacy `features.admin` alias — server-side
-  only, removed with Phase 4); otherwise redirects to `/chat`
-  (`/admin/endpoints` → `/connections`).
+- **host capability gate** — `/host/*` pages require the server to advertise
+  the `host:*` capability set (`electron-host`/`host-ui`); otherwise redirects
+  to `/chat`. UX only — the security boundary is per-endpoint.
 - **requireAdmin()** — per-endpoint session check in `+server.ts` handlers
   (`$lib/server/helpers.js`); JSON 401, never an HTML redirect.
 - **requireCapability(cap)** — per-endpoint server-side capability check
-  (plan §8.5; `hasCapability()` in components is UX only).
+  (plan §8.5; `hasCapability()` in components is UX only). Every
+  `/api/host/*` endpoint carries one (enforced by
+  `src/routes/api/host/guard-hygiene.vitest.ts`), as does every
+  `/api/assistant/*` endpoint — a valid admin session in a mode without the
+  capability is still refused with 403 `capability_not_available`.
 - **setup localhost** — SEC-4: `/setup` + `/api/setup/*` are unauthenticated
   before first-run completes but restricted to loopback clients (unless
   `OP_ALLOW_REMOTE_SETUP`); after completion, re-runs require admin auth.
 - **host/origin** — SEC-1/SEC-2 Host-header allowlist + Origin check apply to
   every request; host admin stays loopback-only (plan §8.3).
 
+`/admin/*` has **no guard and no alias**: hooks let it fall through to the
+router, which 404s because the route tree is deleted (plan §6.4).
+
 ## Page routes
 
 | Path | Surface | Guard | Notes |
@@ -63,14 +70,14 @@ release only.
 | `/` | Entry | launch-routing (pre-auth) | Never renders: hooks (document nav) + `+page.server.ts` (client-side nav) redirect to the resolved landing |
 | `/splash` | Entry | launch-routing (pre-auth) | **Route removed** in Phase 3; the path 302s to the resolved landing for this release |
 | `/attention` | Entry | auth | Migration/blocking surface split out of `/splash`; landing when `migration.status === 'pending'` (no producer yet) |
-| `/login` | Entry | public | Password login; issues the `op_session` cookie |
+| `/login` | Entry | public | Password login; posts to `/api/auth/login`, which issues the `op_session` cookie |
 | `/setup` | Host | setup localhost | First-run wizard; `?rerun=1` after completion requires admin auth |
 | `/chat` | Assistant | auth | Stillness chat; own corner chrome (hides the navbar); imports domain clients directly, never the `$lib/api.js` barrel (#555) |
 | `/advanced` | Assistant | auth | Embedded OpenCode web UI; mounts `ChatNavbar` (chat chrome composition) |
 | `/connections` | Connection | auth (page) + `connections:manage` (its API) | Connection manager; mounts `ChatNavbar`; `?new=1` opens the add form |
 | `/connections/new` | Connection | auth | pwa-static "no connections yet" landing; 302 alias to `/connections?new=1` |
-| `/admin` | Host | admin gate + auth | Dashboard (tabbed); mounts the chat-free `Navbar` shell (#555); honors `?tab=diagnostics` (Systems tab). Phase 4: `/host` |
-| `/admin/endpoints` | Connection | admin gate | 302 alias to `/connections` (0.13.0 only; Phase 4 makes `/admin/*` 404) |
+| `/host` | Host | host capability gate + auth | Dashboard (tabbed); mounts the chat-free `Navbar` shell (#555); honors `?tab=diagnostics` (Systems tab) |
+| `/admin`, `/admin/*` | — | none | **404.** Dead namespace since Phase 4 (the Phase 2 `/admin/endpoints` → `/connections` alias is gone too) |
 
 ## API routes
 
@@ -79,53 +86,62 @@ release only.
 | `/api/runtime` | Entry | **public** | GET server runtime context — the contract-version handshake (plan §6.4) |
 | `/health` | Entry | public | Liveness probe |
 | `/guardian/health` | Entry | public | Guardian reachability probe |
+| `/api/auth/{login,logout,session}` | Entry | public (login) / session | Session lifecycle. Deliberately **outside** `/api/host` — a capability guard on login would lock assistant-container out before it could authenticate |
 | `/api/setup/*` | Host | setup localhost | 19 endpoints: `status`, `system-check`, `recommend`, `detect-providers`, `current-config`, `complete`, `deploy-status`, `retry-deploy`, `host-status`, `import-host`, `models/[provider]`, `ollama-profiles`, `voice-profiles`, `opencode/{ensure,status,providers,auth/[provider],provider/[provider]/oauth/{authorize,callback}}` |
-| `/api/connections`, `/api/connections/[id]`, `/api/connections/active` | Connection | `requireCapability('connections:manage')` | Connection CRUD + activation (Phase 2, #486) |
+| `/api/connections`, `/api/connections/[id]`, `/api/connections/active` | Connection | requireAdmin + `requireCapability('connections:manage')` | Connection CRUD + activation (Phase 2, #486 — stays here, not under `/api/host`) |
+| `/api/assistant/*` | Assistant | requireAdmin + `requireCapability('assistant-settings:read'/'write')` | Assistant-owned settings — editable from assistant-container: `persona` (config/assistant/persona.md), `akm` (config/akm/config.json), `model` (OpenCode default/small model) |
+| `/api/host/*` | Host | requireAdmin + `requireCapability('host:…')` per endpoint | Privileged host control plane (see below); 403 `capability_not_available` in assistant-container/pwa-static even with a valid session |
 | `/api/speak`, `/api/transcribe` | Assistant | requireAdmin | Voice TTS/STT relays |
 | `/api/electron/update-status` | Host | (Electron harness) | Control-plane self-update status |
 | `/proxy/assistant/[...path]` | Assistant | requireAdmin (same-origin cookie) | Same-origin assistant broker; resolves the active connection per request. Host app only (plan §6.4) |
-| `/admin/auth/{login,logout,session}` | Entry | public (login) / session | Session lifecycle |
-| `/admin/*` (everything below) | Host | admin gate + requireAdmin per endpoint | Phase 4 moves these under `/api/host/*` semantics with `host:*` capability guards |
-
-`/admin/*` JSON endpoints (all admin gate + requireAdmin):
-
-- Stack: `install`, `uninstall`, `update`, `unlock`, `health`, `logs`,
-  `config/validate`, `backups`
-- Containers: `containers/{list,up,down,restart,pull,stats,events}`
-- Versions: `versions`, `versions/{latest,releases,ui}`, `ui-version`
-- Add-ons: `addons`, `addons/[name]`, `addons/[name]/credentials`
-- Automations: `automations`, `automations/[name]/{file,log,run}`
-- AKM: `akm`, `akm/{health,health-report,stats,reindex,host-sharing}`,
-  `akm/embedding/{detect,test}`
-- Assistant/persona: `assistant`, `voice`
-- Providers: `providers`, `providers/[id]`, `providers/{host-status,import-host}`,
-  `providers/assistant-clis`, `providers/assistant-clis/[toolId]/use-provider`,
+
+`/api/host/*` JSON endpoints (each carries requireAdmin + the listed
+`requireCapability` guard):
+
+- Stack (`host:setup`/`host:stack:*`/`host:recovery`/`host:logs`): `install`,
+  `uninstall`, `update`, `unlock`, `health`, `logs`, `config/validate`,
+  `backups`, `stack` (project name + bind address — the host half of the old
+  assistant tab)
+- Containers (`host:containers`): `containers/{list,up,down,restart,pull,stats,events}`
+- Versions (`host:updates`): `versions`, `versions/{latest,releases,ui}`, `ui-version`
+- Add-ons (`host:addons`): `addons`, `addons/[name]`, `addons/[name]/credentials`
+- Automations (`host:stack:*`/`host:logs`): `automations`, `automations/[name]/{file,log,run}`
+- AKM host-level (`host:containers`, `host:akm-sharing`, `host:stack:read`):
+  `akm/{health,health-report,stats,reindex,host-sharing}`,
+  `akm/embedding/{detect,test}` — the assistant-scoped AKM config lives at
+  `/api/assistant/akm`
+- Voice (`host:stack:*`): `voice`
+- Providers (`host:secrets`): `providers`, `providers/[id]`,
+  `providers/{host-status,import-host}`, `providers/assistant-clis`,
+  `providers/assistant-clis/[toolId]/use-provider`,
   `providers/oauth/{start,finish}`, `providers/oauth/[providerId]/callback`,
-  `opencode/model`, `opencode/providers/[id]/{auth,models}`
-- Secrets: `secrets`, `secrets/[name]`, `secrets/user-env`, `secret-notice`
-- Connections (legacy JSON alias, this release only):
-  `endpoints`, `endpoints/[id]`, `endpoints/active`
+  `opencode/providers/[id]/{auth,models}`
+- Secrets (`host:secrets`): `secrets`, `secrets/[name]`, `secrets/user-env`, `secret-notice`
 
 ## Chrome composition (#555)
 
 | Module | Used by | Imports chat modules? |
 |---|---|---|
-| `lib/components/chrome/Navbar.svelte` | `/admin` | **No** — brand + capability-driven chat/host buttons (`runtimeContext.routes` + `hasCapability()`) + theme toggle |
+| `lib/components/chrome/Navbar.svelte` | `/host` | **No** — brand + capability-driven chat/host buttons (`runtimeContext.routes` + `hasCapability()`) + theme toggle |
 | `lib/components/chrome/ChatNavbar.svelte` | `/advanced`, `/connections` | Yes — composes the shell with `EndpointSwitcher`, `SessionPicker`, `VoiceControl`, `ModeSwitch` |
 | `/chat` corner chrome | `/chat` | Chat page renders its own minimal corner chrome and hides the navbar |
 
 Hygiene is enforced by unit tests:
 `src/lib/features-admin-hygiene.vitest.ts` (no component reads the legacy
 admin flag), `src/lib/components/chrome/chrome-untangle-hygiene.vitest.ts`
-(the chrome the admin surface mounts imports no chat modules) and
+(the chrome the admin surface mounts imports no chat modules),
 `src/routes/chat/page-imports.vitest.ts` (chat page never imports the
-`$lib/api.js` barrel).
+`$lib/api.js` barrel), `src/routes/api/host/guard-hygiene.vitest.ts` (every
+`/api/host/*` endpoint calls `requireCapability`), and
+`src/lib/api/admin-paths-hygiene.vitest.ts` (no client code calls or links a
+dead `/admin` path).
 
 ## Testing
 
 The landing matrix is unit-tested in `src/lib/resolve-landing.vitest.ts`; the
-hooks routing in `src/hooks.server.landing.vitest.ts` and
-`src/hooks.server.vitest.ts`. Playwright coverage lives in
+hooks routing in `src/hooks.server.landing.vitest.ts`,
+`src/hooks.server.vitest.ts` and `src/hooks.server.admin-404.vitest.ts` (the
+Phase 4 dead-namespace contract). Playwright coverage lives in
 `e2e/setup-guard.pw.ts` (guard/landing smoke) and the `*.stack.ts` suites;
 browsers cannot be downloaded in the sandboxed CI container, so the Playwright
 suites run only in environments with a real browser + Docker.

From 5a4f115e9576e19a67b816d0ac85d0a4a696adee Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Mon, 6 Jul 2026 15:36:31 +0000
Subject: [PATCH 22/61] test(ui): update browser-project tests for the /admin
 -> /host split (#555)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Review-gate fixes for Phase 4: two browser-project (*.svelte.vitest.ts)
tests still referenced the dead /admin namespace and would fail on CI
where Playwright browsers are installed:

- EndpointList.svelte.vitest.ts: the 'Manage this assistant…' link now
  resolves to /host, not /admin — assert the new href.
- ProvidersPanel.svelte.vitest.ts: fetchSecretFile() now requests
  /api/host/secrets/op_api_key — match the mock (and its comment) to the
  new path so the reveal-API-key test exercises the secret branch again.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FetR7BttT1xBrA8fBwhui9
---
 .../ui/src/lib/components/chat/EndpointList.svelte.vitest.ts  | 2 +-
 .../lib/components/providers/ProvidersPanel.svelte.vitest.ts  | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/packages/ui/src/lib/components/chat/EndpointList.svelte.vitest.ts b/packages/ui/src/lib/components/chat/EndpointList.svelte.vitest.ts
index bbc3498b2..9f1ac0493 100644
--- a/packages/ui/src/lib/components/chat/EndpointList.svelte.vitest.ts
+++ b/packages/ui/src/lib/components/chat/EndpointList.svelte.vitest.ts
@@ -32,7 +32,7 @@ describe('EndpointList', () => {
   test('shows the local assistant management link above assistant connections', async () => {
     render(EndpointList);
 
-    await expect.element(page.getByRole('link', { name: 'Manage this assistant…' })).toHaveAttribute('href', '/admin');
+    await expect.element(page.getByRole('link', { name: 'Manage this assistant…' })).toHaveAttribute('href', '/host');
 
     const linkLabels = Array.from(document.querySelectorAll<HTMLElement>('.endpoint-list a.list-item.link'))
       .map((el) => el.textContent?.trim() ?? '');
diff --git a/packages/ui/src/lib/components/providers/ProvidersPanel.svelte.vitest.ts b/packages/ui/src/lib/components/providers/ProvidersPanel.svelte.vitest.ts
index 403654e12..1b751835b 100644
--- a/packages/ui/src/lib/components/providers/ProvidersPanel.svelte.vitest.ts
+++ b/packages/ui/src/lib/components/providers/ProvidersPanel.svelte.vitest.ts
@@ -79,14 +79,14 @@ describe('ProvidersPanel — assistant available', () => {
 });
 
 describe('ProvidersPanel — OpenAI-compatible edge API key (S.1b)', () => {
-  // URL-aware fetch: /admin/providers returns the provider list; the secret-file
+  // URL-aware fetch: /api/host/providers returns the provider list; the secret-file
   // endpoint returns the op_api_key value only when explicitly requested.
   function mockFetchWithSecret(secretValue: string) {
     vi.stubGlobal(
       'fetch',
       vi.fn().mockImplementation((input: string | URL) => {
         const url = typeof input === 'string' ? input : input.toString();
-        if (url.includes('/admin/secrets/op_api_key')) {
+        if (url.includes('/api/host/secrets/op_api_key')) {
           return Promise.resolve({ ok: true, json: async () => ({ name: 'op_api_key', value: secretValue }) });
         }
         return Promise.resolve({ ok: true, json: async () => availableResponse });

From 1bd98f31e2b3d78415747e2ce38de6b3fddea1c6 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Mon, 6 Jul 2026 16:04:03 +0000
Subject: [PATCH 23/61] docs: mark Phases 1-4 (+1.5) DONE in
 ui-runtime-modes-plan (#509, #556, #486, #555)

Flip the plan status line, the section 7 phase headers, and the section 10
milestone summary to DONE with one-line as-built notes where the landed code
deviated from the design: RuntimeContext v2 lives in lib/server/features.ts
(filename kept), the Phase 2 /admin/endpoints alias was removed again in
Phase 4, /splash became /attention, no new Playwright smoke tests (existing
e2e stack suites updated instead), session auth moved to /api/auth/*, and
the assistant namespace split into persona/model/akm.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FetR7BttT1xBrA8fBwhui9
---
 docs/technical/ui-runtime-modes-plan.md | 48 +++++++++++++++++--------
 1 file changed, 34 insertions(+), 14 deletions(-)

diff --git a/docs/technical/ui-runtime-modes-plan.md b/docs/technical/ui-runtime-modes-plan.md
index 781e60c4b..0e7f50b7b 100644
--- a/docs/technical/ui-runtime-modes-plan.md
+++ b/docs/technical/ui-runtime-modes-plan.md
@@ -1,7 +1,7 @@
 # UI Host/Client Runtime Refactor Plan
 
 **Date:** 2026-06-19 (revised 2026-07-06)
-**Status:** RATIFIED — Phases 0 landed; Phases 1–4 as designed; Phases 5–6 re-scoped per `docs/technical/ui-client-split-assessment.md`
+**Status:** RATIFIED — Phases 0–4 (+1.5) landed; Phases 5–6 re-scoped per `docs/technical/ui-client-split-assessment.md`
 **Repo:** `itlackey/openpalm`, branch `main`
 **Related issues:** #486 (remote-only install), #435 (guardian authn), #433 (guardian state), #488 (mDNS), #506 (styling), #509 (RuntimeContext), #510 (assistant-container), #511 (PWA), #555 (client extraction), #556 (openpalm admin), #557 (guardian TLS + CORS)
 
@@ -570,7 +570,11 @@ GitHub raw fallback). Outstanding from the original Track A: Playwright smoke te
 `docs/technical/ui-route-map.md` were **not** produced — fold them into Phase 3, where the
 route structure they document actually changes.
 
-### Phase 1 — RuntimeContext v2, no UI change (#509)
+### Phase 1 — RuntimeContext v2, no UI change (#509) — ✅ DONE
+
+**As-built:** `ServerRuntimeContext` + `resolveCapabilities()` landed inside the existing
+`lib/server/features.ts` (filename kept; `FeatureFlags` replaced). The interim
+`features.admin` alias was carried through Phases 1–3 and removed entirely in Phase 4.
 
 **Files:** `lib/server/features.ts`, `lib/types.ts`, `routes/+layout.server.ts`, `lib/runtime-context.svelte.ts`, `lib/client-context.ts`, `routes/api/runtime/+server.ts`
 
@@ -583,7 +587,11 @@ route structure they document actually changes.
 
 Acceptance: existing routes unchanged; `features.admin` alias works; capability matrix correct for all current combinations.
 
-### Phase 1.5 — `openpalm admin` (host-ui mode) (#556) — NEW, small
+### Phase 1.5 — `openpalm admin` (host-ui mode) (#556) — ✅ DONE
+
+**As-built:** as designed; how-it-works docs now record the three admin access paths
+(Electron, `openpalm admin`, dev-only `OP_ENABLE_ADMIN=1`) and drop the stale
+`openpalm ui serve` reference.
 
 1. CLI: `openpalm admin` (and/or a flag on the default serve path) launches the existing
    UI server with the admin capability enabled (today: `OP_ENABLE_ADMIN=1`; after Phase 1:
@@ -596,7 +604,10 @@ Acceptance: full host management from a browser on the host machine without Elec
 remains loopback-only; `openpalm admin` on a machine without the stack installed lands on
 `/setup`.
 
-### Phase 2 — Connection management out of `/admin` (#486)
+### Phase 2 — Connection management out of `/admin` (#486) — ✅ DONE
+
+**As-built:** as designed; the `/admin/endpoints` → `/connections` redirect alias shipped
+here as planned but was deleted with the rest of `/admin/*` in Phase 4 (§6.4 no-alias rule).
 
 1. Rename internal model "endpoint" → "connection" in UI layer. `endpoints.json` unchanged.
 2. Add `kind` to `ConnectionEntry`; default existing records.
@@ -609,7 +620,11 @@ remains loopback-only; `openpalm admin` on a machine without the stack installed
 
 Acceptance: connection management reachable without `/admin`; host mode unchanged; no data migration; `endpoints-state` no longer imports `chat-state`.
 
-### Phase 3 — Capability-driven landing and navigation
+### Phase 3 — Capability-driven landing and navigation — ✅ DONE
+
+**As-built:** `/splash` became `/attention` (the other landing targets already existed as
+routes); `docs/technical/ui-route-map.md` produced. New Playwright smoke tests were not
+added — the existing e2e stack suites were updated for the new routes instead.
 
 1. Add `resolveLanding(ctx, launchState)`.
 2. Split `/splash` into `/attention`, `/setup`, `/host`, `/chat`, `/connections`.
@@ -621,7 +636,11 @@ Acceptance: connection management reachable without `/admin`; host mode unchange
 
 Acceptance: Electron healthy → chat; capability-driven nav; chat chunk free of admin API clients (verify bundle); route map doc exists.
 
-### Phase 4 — Split Host and Assistant Control Planes
+### Phase 4 — Split Host and Assistant Control Planes (#555) — ✅ DONE
+
+**As-built:** session auth also moved to `/api/auth/{login,logout,session}`; the assistant
+namespace split into `/api/assistant/{persona,model,akm}`; `/admin/*` 404s via router
+fall-through (route tree deleted, deliberately no hooks alias per §6.4).
 
 1. Move `/admin` → `/host`. No alias — remove immediately. With <10 installs there's no upgrade audience to protect.
 2. Split Assistant tab: host stack settings (`host:stack:write`) vs. assistant settings (`assistant-settings:write`).
@@ -746,11 +765,11 @@ launch shows the shell + saved connections, not a blank page.
 
 ```
 Phase 0 (skeleton package)        ✅ DONE (#508)
-Phase 1 (RuntimeContext)          ─────────────► prerequisite for everything below
-Phase 1.5 (openpalm admin)        ─ tiny, ships with Phase 1
-Phase 2 (connections + untangle)  ──┐
-Phase 3 (landing + chrome untangle)─┼─► parallelizable ─► prerequisite for 5
-Phase 4 (control plane split)     ──┘
+Phase 1 (RuntimeContext)          ✅ DONE (#509)
+Phase 1.5 (openpalm admin)        ✅ DONE (#556)
+Phase 2 (connections + untangle)  ✅ DONE (#486) ──┐
+Phase 3 (landing + chrome untangle) ✅ DONE       ─┼─► Phase 5 prerequisites met
+Phase 4 (control plane split)     ✅ DONE (#555) ──┘
 Phase 5 (client + ui-kit extraction, assistant-container) ─► prerequisite for 6
 Phase 6 (PWA, two install origins) ─ needs 5
 Phase 6.5 (guardian TLS + CORS)   ─ parallel to 5/6; gates the phone story
@@ -758,9 +777,10 @@ Phase 7 (security tests)          ─ needs 1–6.5
 Phase 8 (release integration)     ─ needs all
 ```
 
-0.13.0 target: Phases 1–4 + 1.5. Phases 5–6.5 land in 0.13.0 only if it stays light;
-otherwise they open 0.14.0. (The original "all phases in 0.13.0" call predates the
-client-split re-scope; re-evaluated at Phase 4 completion.)
+0.13.0 target: Phases 1–4 + 1.5 — **complete**. Phases 5–6.5 land in 0.13.0 only if it
+stays light; otherwise they open 0.14.0. (The original "all phases in 0.13.0" call
+predates the client-split re-scope; the Phase 4 completion re-evaluation point has now
+been reached.)
 
 ---
 

From 514f0a2383e38d02ca25cd43c3ecfb6159d49995 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Mon, 6 Jul 2026 16:43:16 +0000
Subject: [PATCH 24/61] test(p5a): red tests for #555
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Test-first coverage for the P5a ui-kit extraction (plan
ui-runtime-modes-plan.md §6.11, Phase 5 step 1):

- packages/ui/src/lib/ui-kit-extraction.vitest.ts — RED (4 tests, fail
  for the right reason): components/{common,icons} must leave
  packages/ui/src/lib, no ui source may keep importing the old
  $lib/components/{common,icons} paths (233 offenders today), and ui
  must consume @openpalm/ui-kit.
- packages/ui-kit/tests/no-app-coupling.test.ts — HYGIENE,
  already GREEN (labeled as such): no ui-kit source file may import
  $lib/api, $lib/server, @openpalm/lib, chat state, or the
  endpoints/connections store; includes a post-move guard against a
  forever-vacuous scan.
- packages/ui/src/lib/ui-kit-components-characterization.vitest.ts —
  CHARACTERIZATION, already GREEN (labeled as such): SSR-renders
  IconButton + IconClose resolved from ui-kit first with fallback to
  the current location, pinning "zero behavior change" across the move
  (verified green against a simulated post-move layout too).

Scaffolding only (inert, no production code): packages/ui-kit
package.json (private, bun test script, no exports) + root workspace
entry + lockfile.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FetR7BttT1xBrA8fBwhui9
---
 bun.lock                                      |   6 +
 package.json                                  |   1 +
 packages/ui-kit/package.json                  |  16 +++
 packages/ui-kit/tests/no-app-coupling.test.ts | 107 +++++++++++++++++
 ...-kit-components-characterization.vitest.ts |  98 ++++++++++++++++
 .../ui/src/lib/ui-kit-extraction.vitest.ts    | 108 ++++++++++++++++++
 6 files changed, 336 insertions(+)
 create mode 100644 packages/ui-kit/package.json
 create mode 100644 packages/ui-kit/tests/no-app-coupling.test.ts
 create mode 100644 packages/ui/src/lib/ui-kit-components-characterization.vitest.ts
 create mode 100644 packages/ui/src/lib/ui-kit-extraction.vitest.ts

diff --git a/bun.lock b/bun.lock
index 0f627c439..a186c484b 100644
--- a/bun.lock
+++ b/bun.lock
@@ -122,6 +122,10 @@
         "yaml": "^2.8.0",
       },
     },
+    "packages/ui-kit": {
+      "name": "@openpalm/ui-kit",
+      "version": "0.12.52",
+    },
     "portals/discord": {
       "name": "@openpalm/discord-portal",
       "version": "0.12.44",
@@ -294,6 +298,8 @@
 
     "@openpalm/ui": ["@openpalm/ui@workspace:packages/ui"],
 
+    "@openpalm/ui-kit": ["@openpalm/ui-kit@workspace:packages/ui-kit"],
+
     "@oxc-project/types": ["@oxc-project/types@0.132.0", "", {}, "sha512-FESMOxil5Se014ui/Eq8fT5uHJo6nIRwH0PfJrZJXs6Gek3ZVFOrpUv3YIZT20m+extU98Hg1Ym72U58rlsxUQ=="],
 
     "@playwright/test": ["@playwright/test@1.60.0", "", { "dependencies": { "playwright": "1.60.0" }, "bin": { "playwright": "cli.js" } }, "sha512-O71yZIbAh/PxDMNGns37GHBIfrVkEVyn+AXyIa5dOTfb4/xNvRWV+Vv/NMbNCtODB/pO7vLlF2OTmMVLhmr7Ag=="],
diff --git a/package.json b/package.json
index 715ebfa4b..37a4b0de2 100644
--- a/package.json
+++ b/package.json
@@ -7,6 +7,7 @@
     "packages/lib",
     "packages/portal-sdk",
     "packages/ui",
+    "packages/ui-kit",
     "packages/skeleton",
     "packages/guardian",
     "packages/cli",
diff --git a/packages/ui-kit/package.json b/packages/ui-kit/package.json
new file mode 100644
index 000000000..a62d6bed5
--- /dev/null
+++ b/packages/ui-kit/package.json
@@ -0,0 +1,16 @@
+{
+  "name": "@openpalm/ui-kit",
+  "version": "0.12.52",
+  "description": "OpenPalm shared UI kit — presentational components, icons, and theme tokens consumed as raw Svelte/TS source by the ui and client apps (plan ui-runtime-modes-plan.md §6.11). NOT published; no build step.",
+  "private": true,
+  "license": "MPL-2.0",
+  "type": "module",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/itlackey/openpalm.git",
+    "directory": "packages/ui-kit"
+  },
+  "scripts": {
+    "test": "bun test"
+  }
+}
diff --git a/packages/ui-kit/tests/no-app-coupling.test.ts b/packages/ui-kit/tests/no-app-coupling.test.ts
new file mode 100644
index 000000000..aefc0a74c
--- /dev/null
+++ b/packages/ui-kit/tests/no-app-coupling.test.ts
@@ -0,0 +1,107 @@
+/**
+ * P5a (#555) HYGIENE — ui-kit is presentational only (plan
+ * ui-runtime-modes-plan.md §6.11: "ui-kit contains no stores with server
+ * assumptions — presentational components, icons, and theme only"; §8.10:
+ * the client app never bundles @openpalm/lib).
+ *
+ * No source file under packages/ui-kit/src may import:
+ *   - $lib/api (the ui app's API-client barrel or its submodules)
+ *   - $lib/server (host-side server code)
+ *   - @openpalm/lib (control-plane library — §8.10)
+ *   - chat state (chat-state or anything under a chat/ module dir)
+ *   - the connections store (endpoints-state / connections-state /
+ *     connection-state, any rename the store has carried)
+ *
+ * CHARACTERIZATION NOTE: this test is GREEN before the P5a move lands
+ * (src/ is empty, so the scan has nothing to flag). It is written ahead of
+ * the move so the invariant is enforced from the first file that lands in
+ * this package. The last test guards against a forever-vacuous pass: once
+ * packages/ui/src/lib/components/{common,icons} are gone (the P5a move),
+ * the moved sources MUST exist here for the scan to see.
+ *
+ * Source-level test (reads files and inspects import specifiers) because
+ * the invariant is about the module graph, not runtime behavior: ui-kit is
+ * consumed as raw source by both apps, so any app-coupled import would drag
+ * host/server modules into the client artifact (§8 rules 5 and 10).
+ */
+import { describe, expect, test } from 'bun:test';
+import { existsSync, readdirSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const SRC_ROOT = fileURLToPath(new URL('../src/', import.meta.url));
+const UI_COMMON_DIR = fileURLToPath(
+  new URL('../../ui/src/lib/components/common/', import.meta.url)
+);
+const UI_ICONS_DIR = fileURLToPath(
+  new URL('../../ui/src/lib/components/icons/', import.meta.url)
+);
+
+/** Every scannable source file under src/ ([] until sources land). */
+function sourceFiles(): string[] {
+  if (!existsSync(SRC_ROOT)) return [];
+  return (readdirSync(SRC_ROOT, { recursive: true }) as string[])
+    .filter((rel) => /\.(svelte|ts|js)$/.test(rel))
+    .map((rel) => join(SRC_ROOT, rel));
+}
+
+/** Collect every static, side-effect, re-export, and dynamic import specifier. */
+function importSpecifiers(source: string): string[] {
+  const specifiers: string[] = [];
+  const patterns = [
+    // import ... from '...'; / export ... from '...'; (incl. `import type`)
+    /(?:^|\n)\s*(?:import|export)\s[^;'"]*?from\s*['"]([^'"]+)['"]/g,
+    // side-effect import: import '...';
+    /(?:^|\n)\s*import\s*['"]([^'"]+)['"]/g,
+    // dynamic import: import('...')
+    /import\s*\(\s*['"]([^'"]+)['"]\s*\)/g
+  ];
+  for (const pattern of patterns) {
+    for (const match of source.matchAll(pattern)) {
+      specifiers.push(match[1]);
+    }
+  }
+  return specifiers;
+}
+
+/** App-coupled module specifiers that must never appear in ui-kit source. */
+const FORBIDDEN: { name: string; pattern: RegExp }[] = [
+  { name: '$lib/api', pattern: /^\$lib\/api(\.js|\.ts)?(\/|$)/ },
+  { name: '$lib/server', pattern: /^\$lib\/server(\/|$)/ },
+  { name: '@openpalm/lib', pattern: /^@openpalm\/lib(\/|$)/ },
+  { name: 'chat state', pattern: /chat-state|(^|\/)chat\// },
+  {
+    name: 'connections store',
+    pattern: /endpoints-state|connections-state|connection-state/
+  }
+];
+
+describe('ui-kit source has no app coupling (plan §6.11, §8.10)', () => {
+  test('no source file imports $lib/api, $lib/server, @openpalm/lib, chat state, or the connections store', () => {
+    const offenders: string[] = [];
+    for (const file of sourceFiles()) {
+      const source = readFileSync(file, 'utf-8');
+      for (const specifier of importSpecifiers(source)) {
+        for (const { name, pattern } of FORBIDDEN) {
+          if (pattern.test(specifier)) {
+            offenders.push(`${file.slice(SRC_ROOT.length)} imports ${specifier} (${name})`);
+          }
+        }
+      }
+    }
+    expect(offenders).toEqual([]);
+  });
+
+  test('once the P5a move lands, the scan sees the moved sources (guards vacuous pass)', () => {
+    const moveLanded = !existsSync(UI_COMMON_DIR) && !existsSync(UI_ICONS_DIR);
+    if (!moveLanded) {
+      // Pre-move: ui still owns common/ and icons/; src/ here may be empty.
+      // The scan above is vacuously green — that is the expected pre-move state.
+      expect(sourceFiles().length).toBeGreaterThanOrEqual(0);
+      return;
+    }
+    // Post-move: ~21 common components + ~64 icons (+ index/theme files) must
+    // live here, or the hygiene scan above is inspecting an empty package.
+    expect(sourceFiles().length).toBeGreaterThanOrEqual(60);
+  });
+});
diff --git a/packages/ui/src/lib/ui-kit-components-characterization.vitest.ts b/packages/ui/src/lib/ui-kit-components-characterization.vitest.ts
new file mode 100644
index 000000000..0b9c878c8
--- /dev/null
+++ b/packages/ui/src/lib/ui-kit-components-characterization.vitest.ts
@@ -0,0 +1,98 @@
+/**
+ * P5a (#555) CHARACTERIZATION — representative shared components render the
+ * same markup regardless of which package they live in (plan
+ * ui-runtime-modes-plan.md §6.11 / Phase 5 step 1: the extraction is "pure
+ * file moves + import rewrites; zero behavior change").
+ *
+ * GREEN before AND after the move: the two representative components
+ * (IconButton from common/, IconClose from icons/) are resolved from
+ * packages/ui-kit first and fall back to the current packages/ui location,
+ * so this suite pins their rendered contract across the relocation. The
+ * full interaction coverage stays in the co-located browser-project tests
+ * (IconButton.svelte.vitest.ts etc.), which move with the components; this
+ * node-project suite exists so the "zero behavior change" claim is checked
+ * in environments that cannot launch a browser.
+ */
+import { describe, expect, test } from 'vitest';
+import { existsSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { createRawSnippet, type Component } from 'svelte';
+import { render } from 'svelte/server';
+
+/**
+ * Resolve a shared component from its post-move home (packages/ui-kit) or
+ * its pre-move home (packages/ui/src/lib/components). Follows the file
+ * rather than pinning one path — same convention as
+ * endpoints-state-hygiene.vitest.ts.
+ */
+function resolveComponentPath(rel: string): string {
+  const candidates = [
+    // Post-move: packages/ui-kit/src/lib/components/<rel>
+    new URL(`../../../ui-kit/src/lib/components/${rel}`, import.meta.url),
+    // Pre-move: packages/ui/src/lib/components/<rel>
+    new URL(`./components/${rel}`, import.meta.url)
+  ];
+  for (const url of candidates) {
+    const path = fileURLToPath(url);
+    if (existsSync(path)) return path;
+  }
+  throw new Error(`shared component ${rel} found in neither ui-kit nor ui`);
+}
+
+async function loadComponent(rel: string): Promise<Component> {
+  const mod = await import(/* @vite-ignore */ resolveComponentPath(rel));
+  return mod.default;
+}
+
+const icon = createRawSnippet(() => ({
+  render: () => '<svg data-icon aria-hidden="true" width="16" height="16"></svg>'
+}));
+
+describe('IconButton renders identically from either package (P5a characterization)', () => {
+  test('renders a button with its visible label', async () => {
+    const IconButton = await loadComponent('common/IconButton.svelte');
+    const { body } = render(IconButton, { props: { icon, label: 'Save' } });
+    expect(body).toContain('<button');
+    expect(body).toContain('aria-label="Save"');
+    expect(body).toContain('icon-btn-label');
+    expect(body).toContain('Save');
+    expect(body).toContain('data-icon');
+  });
+
+  test('renders as an anchor when href is given', async () => {
+    const IconButton = await loadComponent('common/IconButton.svelte');
+    const { body } = render(IconButton, {
+      props: { icon, ariaLabel: 'Home', href: '/chat' }
+    });
+    expect(body).toContain('<a');
+    expect(body).toContain('href="/chat"');
+    expect(body).not.toContain('<button');
+  });
+
+  test('renders the disabled attribute when disabled', async () => {
+    const IconButton = await loadComponent('common/IconButton.svelte');
+    const { body } = render(IconButton, {
+      props: { icon, ariaLabel: 'Go', disabled: true }
+    });
+    expect(body).toContain('<button');
+    expect(body).toContain('disabled');
+  });
+});
+
+describe('IconClose renders identically from either package (P5a characterization)', () => {
+  test('renders a decorative 20px svg by default', async () => {
+    const IconClose = await loadComponent('icons/IconClose.svelte');
+    const { body } = render(IconClose, { props: {} });
+    expect(body).toContain('<svg');
+    expect(body).toContain('aria-hidden="true"');
+    expect(body).toContain('width="20"');
+    expect(body).toContain('s-icon');
+  });
+
+  test('honors the size prop', async () => {
+    const IconClose = await loadComponent('icons/IconClose.svelte');
+    const { body } = render(IconClose, { props: { size: 16 } });
+    expect(body).toContain('width="16"');
+    expect(body).toContain('height="16"');
+  });
+});
diff --git a/packages/ui/src/lib/ui-kit-extraction.vitest.ts b/packages/ui/src/lib/ui-kit-extraction.vitest.ts
new file mode 100644
index 000000000..bb0832d48
--- /dev/null
+++ b/packages/ui/src/lib/ui-kit-extraction.vitest.ts
@@ -0,0 +1,108 @@
+/**
+ * P5a (#555) acceptance — components/common and components/icons move out of
+ * packages/ui into the @openpalm/ui-kit workspace package (plan
+ * ui-runtime-modes-plan.md §6.11 + Phase 5 step 1: "Create packages/ui-kit
+ * (raw-source workspace package); move components/common/, icons/, theme
+ * tokens"; §9 change map: "packages/ui/src/lib/components/{common,icons} →
+ * Move to packages/ui-kit").
+ *
+ * RED until P5a lands:
+ *   - src/lib/components/{common,icons} still exist here,
+ *   - ui source still imports $lib/components/{common,icons},
+ *   - nothing imports @openpalm/ui-kit yet.
+ *
+ * Source-level test (checks directories and import specifiers) because the
+ * acceptance is about the module graph, not runtime behavior: the move is
+ * "pure file moves + import rewrites; zero behavior change", so the only
+ * observable contract is WHERE the shared components live and HOW ui
+ * reaches them.
+ */
+import { describe, expect, test } from 'vitest';
+import { existsSync, readdirSync, readFileSync } from 'node:fs';
+import { dirname, join, resolve, sep } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const SRC_ROOT = fileURLToPath(new URL('../../src/', import.meta.url));
+const COMMON_DIR = join(SRC_ROOT, 'lib', 'components', 'common');
+const ICONS_DIR = join(SRC_ROOT, 'lib', 'components', 'icons');
+
+/** Every scannable source file under packages/ui/src. */
+function sourceFiles(): string[] {
+  return (readdirSync(SRC_ROOT, { recursive: true }) as string[])
+    .filter((rel) => /\.(svelte|ts|js)$/.test(rel))
+    .map((rel) => join(SRC_ROOT, rel));
+}
+
+/** Collect every static, side-effect, re-export, and dynamic import specifier. */
+function importSpecifiers(source: string): string[] {
+  const specifiers: string[] = [];
+  const patterns = [
+    // import ... from '...'; / export ... from '...'; (incl. `import type`)
+    /(?:^|\n)\s*(?:import|export)\s[^;'"]*?from\s*['"]([^'"]+)['"]/g,
+    // side-effect import: import '...';
+    /(?:^|\n)\s*import\s*['"]([^'"]+)['"]/g,
+    // dynamic import: import('...')
+    /import\s*\(\s*['"]([^'"]+)['"]\s*\)/g
+  ];
+  for (const pattern of patterns) {
+    for (const match of source.matchAll(pattern)) {
+      specifiers.push(match[1]);
+    }
+  }
+  return specifiers;
+}
+
+/**
+ * True when the specifier still reaches into the OLD in-app location — either
+ * via the $lib alias or via a relative path that resolves under
+ * src/lib/components/{common,icons}. Specifiers into @openpalm/ui-kit (the
+ * NEW location) deliberately do not match, even when they contain
+ * "components/common" as a subpath.
+ */
+function targetsOldLocation(specifier: string, importingFile: string): boolean {
+  if (/^\$lib\/components\/(common|icons)(\/|$)/.test(specifier)) return true;
+  if (specifier.startsWith('.')) {
+    const resolved = resolve(dirname(importingFile), specifier);
+    return (
+      resolved.startsWith(COMMON_DIR + sep) ||
+      resolved.startsWith(ICONS_DIR + sep) ||
+      resolved === COMMON_DIR ||
+      resolved === ICONS_DIR
+    );
+  }
+  return false;
+}
+
+describe('P5a — components/{common,icons} extracted to @openpalm/ui-kit (plan §6.11)', () => {
+  test('src/lib/components/common no longer exists in packages/ui', () => {
+    expect(existsSync(COMMON_DIR)).toBe(false);
+  });
+
+  test('src/lib/components/icons no longer exists in packages/ui', () => {
+    expect(existsSync(ICONS_DIR)).toBe(false);
+  });
+
+  test('no ui source file imports the old $lib/components/{common,icons} paths', () => {
+    const offenders: string[] = [];
+    for (const file of sourceFiles()) {
+      const source = readFileSync(file, 'utf-8');
+      for (const specifier of importSpecifiers(source)) {
+        if (targetsOldLocation(specifier, file)) {
+          offenders.push(`${file.slice(SRC_ROOT.length)} imports ${specifier}`);
+        }
+      }
+    }
+    expect(offenders).toEqual([]);
+  });
+
+  test('ui consumes the shared components from @openpalm/ui-kit', () => {
+    // The host UI keeps using common/ + icons/ (navbar, host pages, setup),
+    // so after the rewrite at least one import must point at the new package.
+    const uiKitImports = sourceFiles().flatMap((file) =>
+      importSpecifiers(readFileSync(file, 'utf-8')).filter(
+        (s) => s === '@openpalm/ui-kit' || s.startsWith('@openpalm/ui-kit/')
+      )
+    );
+    expect(uiKitImports.length).toBeGreaterThan(0);
+  });
+});

From 93fadfdd3c2e3a24b62e1cdb7ba5569836d6cefd Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Mon, 6 Jul 2026 17:06:24 +0000
Subject: [PATCH 25/61] feat(ui-kit): extract shared components, icons, and
 theme tokens into @openpalm/ui-kit (#555)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

P5a of the client split (plan ui-runtime-modes-plan.md §6.11, Phase 5
step 1): packages/ui-kit is now a real raw-source workspace package —
private, no build step; its exports point at .svelte/.ts/.css source and
the consuming app's Vite/Svelte 5 pipeline compiles it as part of the
app build.

Moved out of packages/ui/src/lib:
- components/common/ (all 21 components + their co-located
  *.svelte.vitest.ts browser tests and harnesses)
- components/icons/ (all 64 icons + index barrel)
- the Stillness custom-property token blocks and the wiz-* design
  vocabulary from app.css -> ui-kit/src/lib/theme/tokens.css, @imported
  by ui's app.css (ui-specific layout CSS stays in the app; the @import
  sits above all rules because CSS ignores late imports)

Wiring:
- ui devDependency @openpalm/ui-kit workspace:*; every ui import
  rewritten $lib/components/{common,icons}/... ->
  @openpalm/ui-kit/components/{common,icons}/... (63 files)
- kit-internal imports rewritten to relative paths (the old $lib paths
  no longer exist)
- vite.config: ssr.noExternal += @openpalm/ui-kit in dev (raw .svelte
  source cannot be require()d by node), optimizeDeps.exclude, and the
  vitest browser project also collects ../ui-kit/src/**/*.svelte.vitest
  so the moved tests keep running through ui's browser setup (ui-kit
  deliberately has no vitest of its own; bun's isolated linker means
  ui-kit declares svelte/vitest/vitest-browser-svelte devDeps so the
  test files' bare imports resolve)

Presentational-only rule (§6.11/§8): SecretSelect was the one component
importing $lib/api; its fetchSecretFiles/saveSecretFile are now injected
as required props and the single call site (AddonsTab) passes the api
functions — zero behavior change. Toast/ThemeToggle/Drawer/FriendlyError
keep their $lib service imports (notifications, theme-state, focus-trap,
error-messages type), which the hygiene test deliberately permits; they
resolve through the consuming app's alias.

Verified: ui:check 0/0; ui vitest node project 1082 passed 0 failed
(4 P5a red tests now green) with all 30 browser files still collected
(known chromium-download env failure unchanged); bun test ui-kit 2/2;
cli/lib/electron suites at baseline parity; production build inlines
tokens.css; dev-server curl checks green in host-ui and pwa-static modes.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FetR7BttT1xBrA8fBwhui9
---
 bun.lock                                      |   9 +
 packages/ui-kit/package.json                  |  17 +
 .../src/lib/components/common/AuthGate.svelte |   6 +-
 .../common/AuthGate.svelte.vitest.ts          |   0
 .../src/lib/components/common/Drawer.svelte   |   2 +-
 .../components/common/Drawer.svelte.vitest.ts |   0
 .../common/DrawerTestHarness.svelte           |   0
 .../lib/components/common/EmptyState.svelte   |   0
 .../lib/components/common/FormField.svelte    |   0
 .../components/common/FriendlyError.svelte    |   2 +-
 .../common/FriendlyError.svelte.vitest.ts     |   0
 .../lib/components/common/IconButton.svelte   |   0
 .../common/IconButton.svelte.vitest.ts        |   0
 .../src/lib/components/common/Panel.svelte    |   0
 .../components/common/PasswordInput.svelte    |   0
 .../src/lib/components/common/RadioRow.svelte |   0
 .../common/RadioRow.svelte.vitest.ts          |   0
 .../src/lib/components/common/SField.svelte   |   0
 .../src/lib/components/common/SSelect.svelte  |   0
 .../lib/components/common/SecretSelect.svelte |  23 +-
 .../components/common/SelectableCard.svelte   |   0
 .../common/SelectableCardHarness.svelte       |   0
 .../SelectableCardHarness.svelte.vitest.ts    |   0
 .../components/common/SettingToggle.svelte    |   0
 .../common/SettingToggle.svelte.vitest.ts     |   0
 .../src/lib/components/common/Spinner.svelte  |   0
 .../lib/components/common/ThemeToggle.svelte  |   8 +-
 .../common/ThemeToggle.svelte.vitest.ts       |   0
 .../src/lib/components/common/Toast.svelte    |   4 +-
 .../lib/components/common/ToggleButton.svelte |   2 +-
 .../common/ToggleButton.svelte.vitest.ts      |   0
 .../lib/components/common/UpdateBanner.svelte |   2 +-
 .../lib/components/icons/IconActivity.svelte  |   0
 .../src/lib/components/icons/IconAdd.svelte   |   0
 .../lib/components/icons/IconAddons.svelte    |   0
 .../lib/components/icons/IconAdvanced.svelte  |   0
 .../src/lib/components/icons/IconAgent.svelte |   0
 .../src/lib/components/icons/IconAlert.svelte |   0
 .../components/icons/IconAutomations.svelte   |   0
 .../components/icons/IconBackToChat.svelte    |   0
 .../src/lib/components/icons/IconBell.svelte  |   0
 .../lib/components/icons/IconCalendar.svelte  |   0
 .../lib/components/icons/IconChannels.svelte  |   0
 .../src/lib/components/icons/IconChat.svelte  |   0
 .../src/lib/components/icons/IconClock.svelte |   0
 .../src/lib/components/icons/IconClose.svelte |   0
 .../components/icons/IconCloudDownload.svelte |   0
 .../lib/components/icons/IconConnect.svelte   |   0
 .../components/icons/IconConversations.svelte |   0
 .../src/lib/components/icons/IconCopy.svelte  |   0
 .../lib/components/icons/IconDatabase.svelte  |   0
 .../lib/components/icons/IconDelete.svelte    |   0
 .../src/lib/components/icons/IconDone.svelte  |   0
 .../components/icons/IconDoneCircle.svelte    |   0
 .../lib/components/icons/IconDownload.svelte  |   0
 .../src/lib/components/icons/IconEdit.svelte  |   0
 .../lib/components/icons/IconExpand.svelte    |   0
 .../src/lib/components/icons/IconFile.svelte  |   0
 .../lib/components/icons/IconFilter.svelte    |   0
 .../src/lib/components/icons/IconFlame.svelte |   0
 .../lib/components/icons/IconFolder.svelte    |   0
 .../lib/components/icons/IconForward.svelte   |   0
 .../src/lib/components/icons/IconHelp.svelte  |   0
 .../src/lib/components/icons/IconHide.svelte  |   0
 .../src/lib/components/icons/IconHome.svelte  |   0
 .../src/lib/components/icons/IconInfo.svelte  |   0
 .../lib/components/icons/IconJournal.svelte   |   0
 .../src/lib/components/icons/IconKey.svelte   |   0
 .../src/lib/components/icons/IconLink.svelte  |   0
 .../lib/components/icons/IconListening.svelte |   0
 .../src/lib/components/icons/IconLock.svelte  |   0
 .../src/lib/components/icons/IconLogo.svelte  |   0
 .../lib/components/icons/IconMemory.svelte    |   0
 .../src/lib/components/icons/IconMic.svelte   |   0
 .../lib/components/icons/IconMicOff.svelte    |   0
 .../src/lib/components/icons/IconMore.svelte  |   0
 .../lib/components/icons/IconOverview.svelte  |   0
 .../lib/components/icons/IconRefresh.svelte   |   0
 .../lib/components/icons/IconReveal.svelte    |   0
 .../lib/components/icons/IconSearch.svelte    |   0
 .../src/lib/components/icons/IconSend.svelte  |   0
 .../lib/components/icons/IconServer.svelte    |   0
 .../lib/components/icons/IconSettings.svelte  |   0
 .../lib/components/icons/IconSharing.svelte   |   0
 .../src/lib/components/icons/IconSign.svelte  |   0
 .../lib/components/icons/IconSoundOff.svelte  |   0
 .../lib/components/icons/IconSoundOn.svelte   |   0
 .../lib/components/icons/IconStarred.svelte   |   0
 .../src/lib/components/icons/IconStop.svelte  |   0
 .../lib/components/icons/IconTerminal.svelte  |   0
 .../lib/components/icons/IconThemeDark.svelte |   0
 .../components/icons/IconThemeLight.svelte    |   0
 .../components/icons/IconThemeSystem.svelte   |   0
 .../lib/components/icons/IconUpload.svelte    |   0
 .../src/lib/components/icons/IconUser.svelte  |   0
 .../lib/components/icons/IconWaveform.svelte  |   0
 .../src/lib/components/icons/index.ts         |   0
 packages/ui-kit/src/lib/theme/tokens.css      | 530 ++++++++++++++++++
 packages/ui/package.json                      |   1 +
 packages/ui/src/app.css                       | 527 +----------------
 .../lib/components/addons/AddonsTab.svelte    |  14 +-
 .../admin/activity/ActivityTab.svelte         |   2 +-
 .../admin/assistant/AssistantTab.svelte       |   2 +-
 .../admin/automations/AutomationsTab.svelte   |   6 +-
 .../admin/automations/TaskDrawer.svelte       |   4 +-
 .../admin/containers/ContainerDetail.svelte   |   2 +-
 .../admin/containers/ContainerRow.svelte      |   2 +-
 .../containers/ContainersEmptyState.svelte    |   2 +-
 .../admin/containers/ContainersTab.svelte     |   4 +-
 .../lib/components/admin/logs/LogsTab.svelte  |   6 +-
 .../admin/overview/OperationOutput.svelte     |   2 +-
 .../admin/overview/OverviewTab.svelte         |   4 +-
 .../admin/overview/StatusHero.svelte          |   6 +-
 .../admin/secrets/SecretsTab.svelte           |   4 +-
 .../admin/updates/RecoveryTab.svelte          |   2 +-
 .../admin/updates/UpdatesTab.svelte           |   2 +-
 .../akm/AgentProfilesSection.svelte           |   2 +-
 .../akm/AkmKnowledgeStatsSection.svelte       |   2 +-
 .../ui/src/lib/components/akm/AkmTab.svelte   |   2 +-
 .../components/akm/EmbeddingSection.svelte    |   4 +-
 .../components/akm/HostSharingSection.svelte  |   2 +-
 .../akm/ImproveProfilesSection.svelte         |   2 +-
 .../components/akm/LlmProfileDrawer.svelte    |   2 +-
 .../components/akm/LlmProfilesSection.svelte  |   2 +-
 .../src/lib/components/chat/ChatInput.svelte  |   4 +-
 .../components/chat/EndpointSwitcher.svelte   |   4 +-
 .../lib/components/chat/NewChatButton.svelte  |   4 +-
 .../lib/components/chat/SessionList.svelte    |   2 +-
 .../lib/components/chat/SessionPicker.svelte  |   4 +-
 .../ui/src/lib/components/chat/ToolLog.svelte |  22 +-
 .../src/lib/components/chat/ToolStrip.svelte  |  24 +-
 .../lib/components/chat/VoiceControl.svelte   |  10 +-
 .../lib/components/chrome/ModeSwitch.svelte   |   4 +-
 .../src/lib/components/chrome/Navbar.svelte   |  10 +-
 .../components/chrome/SettingsDrawer.svelte   |   6 +-
 .../src/lib/components/chrome/TabBar.svelte   |  28 +-
 .../providers/AddProviderSheet.svelte         |   2 +-
 .../components/providers/ConnectSheet.svelte  |   6 +-
 .../providers/CustomProviderForm.svelte       |   6 +-
 .../providers/HostImportModal.svelte          |   4 +-
 .../providers/ProvidersPanel.svelte           |   8 +-
 .../src/lib/components/voice/VoiceTab.svelte  |   2 +-
 .../components/voice/VoiceTtsSection.svelte   |   6 +-
 packages/ui/src/routes/+layout.svelte         |   4 +-
 packages/ui/src/routes/attention/+page.svelte |   2 +-
 packages/ui/src/routes/chat/+page.svelte      |  18 +-
 .../ui/src/routes/connections/+page.svelte    |   2 +-
 packages/ui/src/routes/login/+page.svelte     |   2 +-
 packages/ui/src/routes/setup/+page.svelte     |   2 +-
 .../setup/steps/CloudAttachPanel.svelte       |   2 +-
 .../src/routes/setup/steps/DeployStep.svelte  |   4 +-
 .../routes/setup/steps/ModelSummary.svelte    |   2 +-
 .../setup/steps/ProviderOAuthList.svelte      |   2 +-
 .../src/routes/setup/steps/ReviewStep.svelte  |   6 +-
 .../routes/setup/steps/SystemCheckStep.svelte |   8 +-
 packages/ui/vite.config.ts                    |  18 +-
 156 files changed, 757 insertions(+), 686 deletions(-)
 rename packages/{ui => ui-kit}/src/lib/components/common/AuthGate.svelte (96%)
 rename packages/{ui => ui-kit}/src/lib/components/common/AuthGate.svelte.vitest.ts (100%)
 rename packages/{ui => ui-kit}/src/lib/components/common/Drawer.svelte (98%)
 rename packages/{ui => ui-kit}/src/lib/components/common/Drawer.svelte.vitest.ts (100%)
 rename packages/{ui => ui-kit}/src/lib/components/common/DrawerTestHarness.svelte (100%)
 rename packages/{ui => ui-kit}/src/lib/components/common/EmptyState.svelte (100%)
 rename packages/{ui => ui-kit}/src/lib/components/common/FormField.svelte (100%)
 rename packages/{ui => ui-kit}/src/lib/components/common/FriendlyError.svelte (98%)
 rename packages/{ui => ui-kit}/src/lib/components/common/FriendlyError.svelte.vitest.ts (100%)
 rename packages/{ui => ui-kit}/src/lib/components/common/IconButton.svelte (100%)
 rename packages/{ui => ui-kit}/src/lib/components/common/IconButton.svelte.vitest.ts (100%)
 rename packages/{ui => ui-kit}/src/lib/components/common/Panel.svelte (100%)
 rename packages/{ui => ui-kit}/src/lib/components/common/PasswordInput.svelte (100%)
 rename packages/{ui => ui-kit}/src/lib/components/common/RadioRow.svelte (100%)
 rename packages/{ui => ui-kit}/src/lib/components/common/RadioRow.svelte.vitest.ts (100%)
 rename packages/{ui => ui-kit}/src/lib/components/common/SField.svelte (100%)
 rename packages/{ui => ui-kit}/src/lib/components/common/SSelect.svelte (100%)
 rename packages/{ui => ui-kit}/src/lib/components/common/SecretSelect.svelte (87%)
 rename packages/{ui => ui-kit}/src/lib/components/common/SelectableCard.svelte (100%)
 rename packages/{ui => ui-kit}/src/lib/components/common/SelectableCardHarness.svelte (100%)
 rename packages/{ui => ui-kit}/src/lib/components/common/SelectableCardHarness.svelte.vitest.ts (100%)
 rename packages/{ui => ui-kit}/src/lib/components/common/SettingToggle.svelte (100%)
 rename packages/{ui => ui-kit}/src/lib/components/common/SettingToggle.svelte.vitest.ts (100%)
 rename packages/{ui => ui-kit}/src/lib/components/common/Spinner.svelte (100%)
 rename packages/{ui => ui-kit}/src/lib/components/common/ThemeToggle.svelte (78%)
 rename packages/{ui => ui-kit}/src/lib/components/common/ThemeToggle.svelte.vitest.ts (100%)
 rename packages/{ui => ui-kit}/src/lib/components/common/Toast.svelte (97%)
 rename packages/{ui => ui-kit}/src/lib/components/common/ToggleButton.svelte (94%)
 rename packages/{ui => ui-kit}/src/lib/components/common/ToggleButton.svelte.vitest.ts (100%)
 rename packages/{ui => ui-kit}/src/lib/components/common/UpdateBanner.svelte (97%)
 rename packages/{ui => ui-kit}/src/lib/components/icons/IconActivity.svelte (100%)
 rename packages/{ui => ui-kit}/src/lib/components/icons/IconAdd.svelte (100%)
 rename packages/{ui => ui-kit}/src/lib/components/icons/IconAddons.svelte (100%)
 rename packages/{ui => ui-kit}/src/lib/components/icons/IconAdvanced.svelte (100%)
 rename packages/{ui => ui-kit}/src/lib/components/icons/IconAgent.svelte (100%)
 rename packages/{ui => ui-kit}/src/lib/components/icons/IconAlert.svelte (100%)
 rename packages/{ui => ui-kit}/src/lib/components/icons/IconAutomations.svelte (100%)
 rename packages/{ui => ui-kit}/src/lib/components/icons/IconBackToChat.svelte (100%)
 rename packages/{ui => ui-kit}/src/lib/components/icons/IconBell.svelte (100%)
 rename packages/{ui => ui-kit}/src/lib/components/icons/IconCalendar.svelte (100%)
 rename packages/{ui => ui-kit}/src/lib/components/icons/IconChannels.svelte (100%)
 rename packages/{ui => ui-kit}/src/lib/components/icons/IconChat.svelte (100%)
 rename packages/{ui => ui-kit}/src/lib/components/icons/IconClock.svelte (100%)
 rename packages/{ui => ui-kit}/src/lib/components/icons/IconClose.svelte (100%)
 rename packages/{ui => ui-kit}/src/lib/components/icons/IconCloudDownload.svelte (100%)
 rename packages/{ui => ui-kit}/src/lib/components/icons/IconConnect.svelte (100%)
 rename packages/{ui => ui-kit}/src/lib/components/icons/IconConversations.svelte (100%)
 rename packages/{ui => ui-kit}/src/lib/components/icons/IconCopy.svelte (100%)
 rename packages/{ui => ui-kit}/src/lib/components/icons/IconDatabase.svelte (100%)
 rename packages/{ui => ui-kit}/src/lib/components/icons/IconDelete.svelte (100%)
 rename packages/{ui => ui-kit}/src/lib/components/icons/IconDone.svelte (100%)
 rename packages/{ui => ui-kit}/src/lib/components/icons/IconDoneCircle.svelte (100%)
 rename packages/{ui => ui-kit}/src/lib/components/icons/IconDownload.svelte (100%)
 rename packages/{ui => ui-kit}/src/lib/components/icons/IconEdit.svelte (100%)
 rename packages/{ui => ui-kit}/src/lib/components/icons/IconExpand.svelte (100%)
 rename packages/{ui => ui-kit}/src/lib/components/icons/IconFile.svelte (100%)
 rename packages/{ui => ui-kit}/src/lib/components/icons/IconFilter.svelte (100%)
 rename packages/{ui => ui-kit}/src/lib/components/icons/IconFlame.svelte (100%)
 rename packages/{ui => ui-kit}/src/lib/components/icons/IconFolder.svelte (100%)
 rename packages/{ui => ui-kit}/src/lib/components/icons/IconForward.svelte (100%)
 rename packages/{ui => ui-kit}/src/lib/components/icons/IconHelp.svelte (100%)
 rename packages/{ui => ui-kit}/src/lib/components/icons/IconHide.svelte (100%)
 rename packages/{ui => ui-kit}/src/lib/components/icons/IconHome.svelte (100%)
 rename packages/{ui => ui-kit}/src/lib/components/icons/IconInfo.svelte (100%)
 rename packages/{ui => ui-kit}/src/lib/components/icons/IconJournal.svelte (100%)
 rename packages/{ui => ui-kit}/src/lib/components/icons/IconKey.svelte (100%)
 rename packages/{ui => ui-kit}/src/lib/components/icons/IconLink.svelte (100%)
 rename packages/{ui => ui-kit}/src/lib/components/icons/IconListening.svelte (100%)
 rename packages/{ui => ui-kit}/src/lib/components/icons/IconLock.svelte (100%)
 rename packages/{ui => ui-kit}/src/lib/components/icons/IconLogo.svelte (100%)
 rename packages/{ui => ui-kit}/src/lib/components/icons/IconMemory.svelte (100%)
 rename packages/{ui => ui-kit}/src/lib/components/icons/IconMic.svelte (100%)
 rename packages/{ui => ui-kit}/src/lib/components/icons/IconMicOff.svelte (100%)
 rename packages/{ui => ui-kit}/src/lib/components/icons/IconMore.svelte (100%)
 rename packages/{ui => ui-kit}/src/lib/components/icons/IconOverview.svelte (100%)
 rename packages/{ui => ui-kit}/src/lib/components/icons/IconRefresh.svelte (100%)
 rename packages/{ui => ui-kit}/src/lib/components/icons/IconReveal.svelte (100%)
 rename packages/{ui => ui-kit}/src/lib/components/icons/IconSearch.svelte (100%)
 rename packages/{ui => ui-kit}/src/lib/components/icons/IconSend.svelte (100%)
 rename packages/{ui => ui-kit}/src/lib/components/icons/IconServer.svelte (100%)
 rename packages/{ui => ui-kit}/src/lib/components/icons/IconSettings.svelte (100%)
 rename packages/{ui => ui-kit}/src/lib/components/icons/IconSharing.svelte (100%)
 rename packages/{ui => ui-kit}/src/lib/components/icons/IconSign.svelte (100%)
 rename packages/{ui => ui-kit}/src/lib/components/icons/IconSoundOff.svelte (100%)
 rename packages/{ui => ui-kit}/src/lib/components/icons/IconSoundOn.svelte (100%)
 rename packages/{ui => ui-kit}/src/lib/components/icons/IconStarred.svelte (100%)
 rename packages/{ui => ui-kit}/src/lib/components/icons/IconStop.svelte (100%)
 rename packages/{ui => ui-kit}/src/lib/components/icons/IconTerminal.svelte (100%)
 rename packages/{ui => ui-kit}/src/lib/components/icons/IconThemeDark.svelte (100%)
 rename packages/{ui => ui-kit}/src/lib/components/icons/IconThemeLight.svelte (100%)
 rename packages/{ui => ui-kit}/src/lib/components/icons/IconThemeSystem.svelte (100%)
 rename packages/{ui => ui-kit}/src/lib/components/icons/IconUpload.svelte (100%)
 rename packages/{ui => ui-kit}/src/lib/components/icons/IconUser.svelte (100%)
 rename packages/{ui => ui-kit}/src/lib/components/icons/IconWaveform.svelte (100%)
 rename packages/{ui => ui-kit}/src/lib/components/icons/index.ts (100%)
 create mode 100644 packages/ui-kit/src/lib/theme/tokens.css

diff --git a/bun.lock b/bun.lock
index a186c484b..2934c3e59 100644
--- a/bun.lock
+++ b/bun.lock
@@ -93,6 +93,7 @@
         "@eslint/compat": "^2.0.2",
         "@eslint/js": "^10.0.1",
         "@openpalm/lib": "workspace:*",
+        "@openpalm/ui-kit": "workspace:*",
         "@playwright/test": "^1.58.1",
         "@sveltejs/adapter-node": "^5.5.4",
         "@sveltejs/kit": "^2.53.3",
@@ -125,6 +126,14 @@
     "packages/ui-kit": {
       "name": "@openpalm/ui-kit",
       "version": "0.12.52",
+      "devDependencies": {
+        "svelte": "^5.53.5",
+        "vitest": "^4.0.18",
+        "vitest-browser-svelte": "^2.0.2",
+      },
+      "peerDependencies": {
+        "svelte": "^5.0.0",
+      },
     },
     "portals/discord": {
       "name": "@openpalm/discord-portal",
diff --git a/packages/ui-kit/package.json b/packages/ui-kit/package.json
index a62d6bed5..761c256fa 100644
--- a/packages/ui-kit/package.json
+++ b/packages/ui-kit/package.json
@@ -10,7 +10,24 @@
     "url": "https://github.com/itlackey/openpalm.git",
     "directory": "packages/ui-kit"
   },
+  "//exports": "Raw-source package: every export points at .svelte/.ts/.css source under src/lib. The consuming app's Vite/Svelte pipeline compiles it as part of the app build — there is deliberately no build step here.",
+  "exports": {
+    "./components/*": {
+      "svelte": "./src/lib/components/*",
+      "default": "./src/lib/components/*"
+    },
+    "./theme/*": "./src/lib/theme/*"
+  },
   "scripts": {
     "test": "bun test"
+  },
+  "peerDependencies": {
+    "svelte": "^5.0.0"
+  },
+  "//devDependencies": "svelte/vitest/vitest-browser-svelte back the co-located *.svelte.vitest.ts browser tests, which run through packages/ui's vitest browser project (bun's isolated linker gives each workspace its own node_modules, so the test files' bare imports must resolve from here).",
+  "devDependencies": {
+    "svelte": "^5.53.5",
+    "vitest": "^4.0.18",
+    "vitest-browser-svelte": "^2.0.2"
   }
 }
diff --git a/packages/ui/src/lib/components/common/AuthGate.svelte b/packages/ui-kit/src/lib/components/common/AuthGate.svelte
similarity index 96%
rename from packages/ui/src/lib/components/common/AuthGate.svelte
rename to packages/ui-kit/src/lib/components/common/AuthGate.svelte
index b72605edc..d6063b4fe 100644
--- a/packages/ui/src/lib/components/common/AuthGate.svelte
+++ b/packages/ui-kit/src/lib/components/common/AuthGate.svelte
@@ -1,7 +1,7 @@
 <script lang="ts">
-  import Spinner from '$lib/components/common/Spinner.svelte';
-  import IconHide from '$lib/components/icons/IconHide.svelte';
-  import IconReveal from '$lib/components/icons/IconReveal.svelte';
+  import Spinner from './Spinner.svelte';
+  import IconHide from '../icons/IconHide.svelte';
+  import IconReveal from '../icons/IconReveal.svelte';
   interface Props {
     onSuccess: (token: string) => Promise<boolean>;
     loading: boolean;
diff --git a/packages/ui/src/lib/components/common/AuthGate.svelte.vitest.ts b/packages/ui-kit/src/lib/components/common/AuthGate.svelte.vitest.ts
similarity index 100%
rename from packages/ui/src/lib/components/common/AuthGate.svelte.vitest.ts
rename to packages/ui-kit/src/lib/components/common/AuthGate.svelte.vitest.ts
diff --git a/packages/ui/src/lib/components/common/Drawer.svelte b/packages/ui-kit/src/lib/components/common/Drawer.svelte
similarity index 98%
rename from packages/ui/src/lib/components/common/Drawer.svelte
rename to packages/ui-kit/src/lib/components/common/Drawer.svelte
index 6f365a19e..dd510b6c2 100644
--- a/packages/ui/src/lib/components/common/Drawer.svelte
+++ b/packages/ui-kit/src/lib/components/common/Drawer.svelte
@@ -1,6 +1,6 @@
 <script lang="ts">
   import type { Snippet } from 'svelte';
-  import IconClose from '$lib/components/icons/IconClose.svelte';
+  import IconClose from '../icons/IconClose.svelte';
   import { createFocusTrap, handleTrapKeydown } from '$lib/actions/focus-trap.js';
 
   // Reusable slide-in drawer (right edge). The app-wide replacement for inline
diff --git a/packages/ui/src/lib/components/common/Drawer.svelte.vitest.ts b/packages/ui-kit/src/lib/components/common/Drawer.svelte.vitest.ts
similarity index 100%
rename from packages/ui/src/lib/components/common/Drawer.svelte.vitest.ts
rename to packages/ui-kit/src/lib/components/common/Drawer.svelte.vitest.ts
diff --git a/packages/ui/src/lib/components/common/DrawerTestHarness.svelte b/packages/ui-kit/src/lib/components/common/DrawerTestHarness.svelte
similarity index 100%
rename from packages/ui/src/lib/components/common/DrawerTestHarness.svelte
rename to packages/ui-kit/src/lib/components/common/DrawerTestHarness.svelte
diff --git a/packages/ui/src/lib/components/common/EmptyState.svelte b/packages/ui-kit/src/lib/components/common/EmptyState.svelte
similarity index 100%
rename from packages/ui/src/lib/components/common/EmptyState.svelte
rename to packages/ui-kit/src/lib/components/common/EmptyState.svelte
diff --git a/packages/ui/src/lib/components/common/FormField.svelte b/packages/ui-kit/src/lib/components/common/FormField.svelte
similarity index 100%
rename from packages/ui/src/lib/components/common/FormField.svelte
rename to packages/ui-kit/src/lib/components/common/FormField.svelte
diff --git a/packages/ui/src/lib/components/common/FriendlyError.svelte b/packages/ui-kit/src/lib/components/common/FriendlyError.svelte
similarity index 98%
rename from packages/ui/src/lib/components/common/FriendlyError.svelte
rename to packages/ui-kit/src/lib/components/common/FriendlyError.svelte
index 86db6e7a3..a330fde3d 100644
--- a/packages/ui/src/lib/components/common/FriendlyError.svelte
+++ b/packages/ui-kit/src/lib/components/common/FriendlyError.svelte
@@ -1,6 +1,6 @@
 <script lang="ts">
   import type { FriendlyErrorView } from '$lib/client/error-messages.js';
-  import IconAlert from '$lib/components/icons/IconAlert.svelte';
+  import IconAlert from '../icons/IconAlert.svelte';
 
   interface Props {
     error: FriendlyErrorView | null | undefined;
diff --git a/packages/ui/src/lib/components/common/FriendlyError.svelte.vitest.ts b/packages/ui-kit/src/lib/components/common/FriendlyError.svelte.vitest.ts
similarity index 100%
rename from packages/ui/src/lib/components/common/FriendlyError.svelte.vitest.ts
rename to packages/ui-kit/src/lib/components/common/FriendlyError.svelte.vitest.ts
diff --git a/packages/ui/src/lib/components/common/IconButton.svelte b/packages/ui-kit/src/lib/components/common/IconButton.svelte
similarity index 100%
rename from packages/ui/src/lib/components/common/IconButton.svelte
rename to packages/ui-kit/src/lib/components/common/IconButton.svelte
diff --git a/packages/ui/src/lib/components/common/IconButton.svelte.vitest.ts b/packages/ui-kit/src/lib/components/common/IconButton.svelte.vitest.ts
similarity index 100%
rename from packages/ui/src/lib/components/common/IconButton.svelte.vitest.ts
rename to packages/ui-kit/src/lib/components/common/IconButton.svelte.vitest.ts
diff --git a/packages/ui/src/lib/components/common/Panel.svelte b/packages/ui-kit/src/lib/components/common/Panel.svelte
similarity index 100%
rename from packages/ui/src/lib/components/common/Panel.svelte
rename to packages/ui-kit/src/lib/components/common/Panel.svelte
diff --git a/packages/ui/src/lib/components/common/PasswordInput.svelte b/packages/ui-kit/src/lib/components/common/PasswordInput.svelte
similarity index 100%
rename from packages/ui/src/lib/components/common/PasswordInput.svelte
rename to packages/ui-kit/src/lib/components/common/PasswordInput.svelte
diff --git a/packages/ui/src/lib/components/common/RadioRow.svelte b/packages/ui-kit/src/lib/components/common/RadioRow.svelte
similarity index 100%
rename from packages/ui/src/lib/components/common/RadioRow.svelte
rename to packages/ui-kit/src/lib/components/common/RadioRow.svelte
diff --git a/packages/ui/src/lib/components/common/RadioRow.svelte.vitest.ts b/packages/ui-kit/src/lib/components/common/RadioRow.svelte.vitest.ts
similarity index 100%
rename from packages/ui/src/lib/components/common/RadioRow.svelte.vitest.ts
rename to packages/ui-kit/src/lib/components/common/RadioRow.svelte.vitest.ts
diff --git a/packages/ui/src/lib/components/common/SField.svelte b/packages/ui-kit/src/lib/components/common/SField.svelte
similarity index 100%
rename from packages/ui/src/lib/components/common/SField.svelte
rename to packages/ui-kit/src/lib/components/common/SField.svelte
diff --git a/packages/ui/src/lib/components/common/SSelect.svelte b/packages/ui-kit/src/lib/components/common/SSelect.svelte
similarity index 100%
rename from packages/ui/src/lib/components/common/SSelect.svelte
rename to packages/ui-kit/src/lib/components/common/SSelect.svelte
diff --git a/packages/ui/src/lib/components/common/SecretSelect.svelte b/packages/ui-kit/src/lib/components/common/SecretSelect.svelte
similarity index 87%
rename from packages/ui/src/lib/components/common/SecretSelect.svelte
rename to packages/ui-kit/src/lib/components/common/SecretSelect.svelte
index d42d3c157..6211fab64 100644
--- a/packages/ui/src/lib/components/common/SecretSelect.svelte
+++ b/packages/ui-kit/src/lib/components/common/SecretSelect.svelte
@@ -1,12 +1,15 @@
 <script lang="ts">
   import { onMount } from 'svelte';
-  import { fetchSecretFiles, saveSecretFile } from '$lib/api.js';
-  import IconAdd from '$lib/components/icons/IconAdd.svelte';
+  import IconAdd from '../icons/IconAdd.svelte';
 
   // Reusable secret picker: choose an EXISTING secret by name, or quick-add a
-  // new one that is written through the shared /admin/secrets store and becomes
+  // new one that is written through the injected secret store and becomes
   // immediately selectable. Never displays secret values. Uses a native <select>
   // so keyboard/focus/target-size come for free (rubric F3/F5).
+  //
+  // The store operations are injected as props (rather than imported from the
+  // app's API client) so this component stays presentational — ui-kit source
+  // must not depend on $lib/api (plan ui-runtime-modes-plan.md §6.11).
   interface Props {
     /** Selected secret NAME (bindable). */
     value?: string;
@@ -14,8 +17,18 @@
     id?: string;
     /** Called whenever the selection changes (including after quick-add). */
     onChange?: (name: string) => void;
-  }
-  let { value = $bindable(''), id = 'secret-select', onChange }: Props = $props();
+    /** Lists the available secrets (names only; values never surface here). */
+    fetchSecretFiles: () => Promise<{ files: { name: string }[] }>;
+    /** Persists a new secret so it becomes selectable. */
+    saveSecretFile: (name: string, value: string) => Promise<unknown>;
+  }
+  let {
+    value = $bindable(''),
+    id = 'secret-select',
+    onChange,
+    fetchSecretFiles,
+    saveSecretFile
+  }: Props = $props();
 
   let names = $state<string[]>([]);
   let loading = $state(true);
diff --git a/packages/ui/src/lib/components/common/SelectableCard.svelte b/packages/ui-kit/src/lib/components/common/SelectableCard.svelte
similarity index 100%
rename from packages/ui/src/lib/components/common/SelectableCard.svelte
rename to packages/ui-kit/src/lib/components/common/SelectableCard.svelte
diff --git a/packages/ui/src/lib/components/common/SelectableCardHarness.svelte b/packages/ui-kit/src/lib/components/common/SelectableCardHarness.svelte
similarity index 100%
rename from packages/ui/src/lib/components/common/SelectableCardHarness.svelte
rename to packages/ui-kit/src/lib/components/common/SelectableCardHarness.svelte
diff --git a/packages/ui/src/lib/components/common/SelectableCardHarness.svelte.vitest.ts b/packages/ui-kit/src/lib/components/common/SelectableCardHarness.svelte.vitest.ts
similarity index 100%
rename from packages/ui/src/lib/components/common/SelectableCardHarness.svelte.vitest.ts
rename to packages/ui-kit/src/lib/components/common/SelectableCardHarness.svelte.vitest.ts
diff --git a/packages/ui/src/lib/components/common/SettingToggle.svelte b/packages/ui-kit/src/lib/components/common/SettingToggle.svelte
similarity index 100%
rename from packages/ui/src/lib/components/common/SettingToggle.svelte
rename to packages/ui-kit/src/lib/components/common/SettingToggle.svelte
diff --git a/packages/ui/src/lib/components/common/SettingToggle.svelte.vitest.ts b/packages/ui-kit/src/lib/components/common/SettingToggle.svelte.vitest.ts
similarity index 100%
rename from packages/ui/src/lib/components/common/SettingToggle.svelte.vitest.ts
rename to packages/ui-kit/src/lib/components/common/SettingToggle.svelte.vitest.ts
diff --git a/packages/ui/src/lib/components/common/Spinner.svelte b/packages/ui-kit/src/lib/components/common/Spinner.svelte
similarity index 100%
rename from packages/ui/src/lib/components/common/Spinner.svelte
rename to packages/ui-kit/src/lib/components/common/Spinner.svelte
diff --git a/packages/ui/src/lib/components/common/ThemeToggle.svelte b/packages/ui-kit/src/lib/components/common/ThemeToggle.svelte
similarity index 78%
rename from packages/ui/src/lib/components/common/ThemeToggle.svelte
rename to packages/ui-kit/src/lib/components/common/ThemeToggle.svelte
index d8f6e0a30..7faadefc7 100644
--- a/packages/ui/src/lib/components/common/ThemeToggle.svelte
+++ b/packages/ui-kit/src/lib/components/common/ThemeToggle.svelte
@@ -1,10 +1,10 @@
 <script lang="ts">
   import type { ThemePreference } from '$lib/theme-state.svelte.js';
   import { themeService } from '$lib/theme-state.svelte.js';
-  import IconButton from '$lib/components/common/IconButton.svelte';
-  import IconThemeSystem from '$lib/components/icons/IconThemeSystem.svelte';
-  import IconThemeLight from '$lib/components/icons/IconThemeLight.svelte';
-  import IconThemeDark from '$lib/components/icons/IconThemeDark.svelte';
+  import IconButton from './IconButton.svelte';
+  import IconThemeSystem from '../icons/IconThemeSystem.svelte';
+  import IconThemeLight from '../icons/IconThemeLight.svelte';
+  import IconThemeDark from '../icons/IconThemeDark.svelte';
 
   // Cycles: system → light → dark → system
   const CYCLE: ThemePreference[] = ['system', 'light', 'dark'];
diff --git a/packages/ui/src/lib/components/common/ThemeToggle.svelte.vitest.ts b/packages/ui-kit/src/lib/components/common/ThemeToggle.svelte.vitest.ts
similarity index 100%
rename from packages/ui/src/lib/components/common/ThemeToggle.svelte.vitest.ts
rename to packages/ui-kit/src/lib/components/common/ThemeToggle.svelte.vitest.ts
diff --git a/packages/ui/src/lib/components/common/Toast.svelte b/packages/ui-kit/src/lib/components/common/Toast.svelte
similarity index 97%
rename from packages/ui/src/lib/components/common/Toast.svelte
rename to packages/ui-kit/src/lib/components/common/Toast.svelte
index 0b8e55877..9b47fe5d0 100644
--- a/packages/ui/src/lib/components/common/Toast.svelte
+++ b/packages/ui-kit/src/lib/components/common/Toast.svelte
@@ -11,8 +11,8 @@
   import { afterUpdate } from 'svelte';
   import { voiceState } from '$lib/voice/voice-state.svelte.js';
   import { notifications, type Toast } from '$lib/notifications.svelte.js';
-  import IconDone from '$lib/components/icons/IconDone.svelte';
-  import IconInfo from '$lib/components/icons/IconInfo.svelte';
+  import IconDone from '../icons/IconDone.svelte';
+  import IconInfo from '../icons/IconInfo.svelte';
 
   // Track the toast id for the current voice error so consecutive
   // errors update in place instead of stacking.
diff --git a/packages/ui/src/lib/components/common/ToggleButton.svelte b/packages/ui-kit/src/lib/components/common/ToggleButton.svelte
similarity index 94%
rename from packages/ui/src/lib/components/common/ToggleButton.svelte
rename to packages/ui-kit/src/lib/components/common/ToggleButton.svelte
index 3e6468efa..e1739a7bc 100644
--- a/packages/ui/src/lib/components/common/ToggleButton.svelte
+++ b/packages/ui-kit/src/lib/components/common/ToggleButton.svelte
@@ -1,6 +1,6 @@
 <script lang="ts">
   import type { Snippet } from 'svelte';
-  import IconButton from '$lib/components/common/IconButton.svelte';
+  import IconButton from './IconButton.svelte';
 
   // A two-state button built on IconButton. When `pressed` it adopts the
   // selected colour (primary, or danger via `tone`) and, if provided, swaps to
diff --git a/packages/ui/src/lib/components/common/ToggleButton.svelte.vitest.ts b/packages/ui-kit/src/lib/components/common/ToggleButton.svelte.vitest.ts
similarity index 100%
rename from packages/ui/src/lib/components/common/ToggleButton.svelte.vitest.ts
rename to packages/ui-kit/src/lib/components/common/ToggleButton.svelte.vitest.ts
diff --git a/packages/ui/src/lib/components/common/UpdateBanner.svelte b/packages/ui-kit/src/lib/components/common/UpdateBanner.svelte
similarity index 97%
rename from packages/ui/src/lib/components/common/UpdateBanner.svelte
rename to packages/ui-kit/src/lib/components/common/UpdateBanner.svelte
index fdc929a30..346e08663 100644
--- a/packages/ui/src/lib/components/common/UpdateBanner.svelte
+++ b/packages/ui-kit/src/lib/components/common/UpdateBanner.svelte
@@ -1,6 +1,6 @@
 <script lang="ts">
   import { onMount } from 'svelte';
-  import IconDownload from '$lib/components/icons/IconDownload.svelte';
+  import IconDownload from '../icons/IconDownload.svelte';
 
   interface UpdateStatus {
     inElectron: boolean;
diff --git a/packages/ui/src/lib/components/icons/IconActivity.svelte b/packages/ui-kit/src/lib/components/icons/IconActivity.svelte
similarity index 100%
rename from packages/ui/src/lib/components/icons/IconActivity.svelte
rename to packages/ui-kit/src/lib/components/icons/IconActivity.svelte
diff --git a/packages/ui/src/lib/components/icons/IconAdd.svelte b/packages/ui-kit/src/lib/components/icons/IconAdd.svelte
similarity index 100%
rename from packages/ui/src/lib/components/icons/IconAdd.svelte
rename to packages/ui-kit/src/lib/components/icons/IconAdd.svelte
diff --git a/packages/ui/src/lib/components/icons/IconAddons.svelte b/packages/ui-kit/src/lib/components/icons/IconAddons.svelte
similarity index 100%
rename from packages/ui/src/lib/components/icons/IconAddons.svelte
rename to packages/ui-kit/src/lib/components/icons/IconAddons.svelte
diff --git a/packages/ui/src/lib/components/icons/IconAdvanced.svelte b/packages/ui-kit/src/lib/components/icons/IconAdvanced.svelte
similarity index 100%
rename from packages/ui/src/lib/components/icons/IconAdvanced.svelte
rename to packages/ui-kit/src/lib/components/icons/IconAdvanced.svelte
diff --git a/packages/ui/src/lib/components/icons/IconAgent.svelte b/packages/ui-kit/src/lib/components/icons/IconAgent.svelte
similarity index 100%
rename from packages/ui/src/lib/components/icons/IconAgent.svelte
rename to packages/ui-kit/src/lib/components/icons/IconAgent.svelte
diff --git a/packages/ui/src/lib/components/icons/IconAlert.svelte b/packages/ui-kit/src/lib/components/icons/IconAlert.svelte
similarity index 100%
rename from packages/ui/src/lib/components/icons/IconAlert.svelte
rename to packages/ui-kit/src/lib/components/icons/IconAlert.svelte
diff --git a/packages/ui/src/lib/components/icons/IconAutomations.svelte b/packages/ui-kit/src/lib/components/icons/IconAutomations.svelte
similarity index 100%
rename from packages/ui/src/lib/components/icons/IconAutomations.svelte
rename to packages/ui-kit/src/lib/components/icons/IconAutomations.svelte
diff --git a/packages/ui/src/lib/components/icons/IconBackToChat.svelte b/packages/ui-kit/src/lib/components/icons/IconBackToChat.svelte
similarity index 100%
rename from packages/ui/src/lib/components/icons/IconBackToChat.svelte
rename to packages/ui-kit/src/lib/components/icons/IconBackToChat.svelte
diff --git a/packages/ui/src/lib/components/icons/IconBell.svelte b/packages/ui-kit/src/lib/components/icons/IconBell.svelte
similarity index 100%
rename from packages/ui/src/lib/components/icons/IconBell.svelte
rename to packages/ui-kit/src/lib/components/icons/IconBell.svelte
diff --git a/packages/ui/src/lib/components/icons/IconCalendar.svelte b/packages/ui-kit/src/lib/components/icons/IconCalendar.svelte
similarity index 100%
rename from packages/ui/src/lib/components/icons/IconCalendar.svelte
rename to packages/ui-kit/src/lib/components/icons/IconCalendar.svelte
diff --git a/packages/ui/src/lib/components/icons/IconChannels.svelte b/packages/ui-kit/src/lib/components/icons/IconChannels.svelte
similarity index 100%
rename from packages/ui/src/lib/components/icons/IconChannels.svelte
rename to packages/ui-kit/src/lib/components/icons/IconChannels.svelte
diff --git a/packages/ui/src/lib/components/icons/IconChat.svelte b/packages/ui-kit/src/lib/components/icons/IconChat.svelte
similarity index 100%
rename from packages/ui/src/lib/components/icons/IconChat.svelte
rename to packages/ui-kit/src/lib/components/icons/IconChat.svelte
diff --git a/packages/ui/src/lib/components/icons/IconClock.svelte b/packages/ui-kit/src/lib/components/icons/IconClock.svelte
similarity index 100%
rename from packages/ui/src/lib/components/icons/IconClock.svelte
rename to packages/ui-kit/src/lib/components/icons/IconClock.svelte
diff --git a/packages/ui/src/lib/components/icons/IconClose.svelte b/packages/ui-kit/src/lib/components/icons/IconClose.svelte
similarity index 100%
rename from packages/ui/src/lib/components/icons/IconClose.svelte
rename to packages/ui-kit/src/lib/components/icons/IconClose.svelte
diff --git a/packages/ui/src/lib/components/icons/IconCloudDownload.svelte b/packages/ui-kit/src/lib/components/icons/IconCloudDownload.svelte
similarity index 100%
rename from packages/ui/src/lib/components/icons/IconCloudDownload.svelte
rename to packages/ui-kit/src/lib/components/icons/IconCloudDownload.svelte
diff --git a/packages/ui/src/lib/components/icons/IconConnect.svelte b/packages/ui-kit/src/lib/components/icons/IconConnect.svelte
similarity index 100%
rename from packages/ui/src/lib/components/icons/IconConnect.svelte
rename to packages/ui-kit/src/lib/components/icons/IconConnect.svelte
diff --git a/packages/ui/src/lib/components/icons/IconConversations.svelte b/packages/ui-kit/src/lib/components/icons/IconConversations.svelte
similarity index 100%
rename from packages/ui/src/lib/components/icons/IconConversations.svelte
rename to packages/ui-kit/src/lib/components/icons/IconConversations.svelte
diff --git a/packages/ui/src/lib/components/icons/IconCopy.svelte b/packages/ui-kit/src/lib/components/icons/IconCopy.svelte
similarity index 100%
rename from packages/ui/src/lib/components/icons/IconCopy.svelte
rename to packages/ui-kit/src/lib/components/icons/IconCopy.svelte
diff --git a/packages/ui/src/lib/components/icons/IconDatabase.svelte b/packages/ui-kit/src/lib/components/icons/IconDatabase.svelte
similarity index 100%
rename from packages/ui/src/lib/components/icons/IconDatabase.svelte
rename to packages/ui-kit/src/lib/components/icons/IconDatabase.svelte
diff --git a/packages/ui/src/lib/components/icons/IconDelete.svelte b/packages/ui-kit/src/lib/components/icons/IconDelete.svelte
similarity index 100%
rename from packages/ui/src/lib/components/icons/IconDelete.svelte
rename to packages/ui-kit/src/lib/components/icons/IconDelete.svelte
diff --git a/packages/ui/src/lib/components/icons/IconDone.svelte b/packages/ui-kit/src/lib/components/icons/IconDone.svelte
similarity index 100%
rename from packages/ui/src/lib/components/icons/IconDone.svelte
rename to packages/ui-kit/src/lib/components/icons/IconDone.svelte
diff --git a/packages/ui/src/lib/components/icons/IconDoneCircle.svelte b/packages/ui-kit/src/lib/components/icons/IconDoneCircle.svelte
similarity index 100%
rename from packages/ui/src/lib/components/icons/IconDoneCircle.svelte
rename to packages/ui-kit/src/lib/components/icons/IconDoneCircle.svelte
diff --git a/packages/ui/src/lib/components/icons/IconDownload.svelte b/packages/ui-kit/src/lib/components/icons/IconDownload.svelte
similarity index 100%
rename from packages/ui/src/lib/components/icons/IconDownload.svelte
rename to packages/ui-kit/src/lib/components/icons/IconDownload.svelte
diff --git a/packages/ui/src/lib/components/icons/IconEdit.svelte b/packages/ui-kit/src/lib/components/icons/IconEdit.svelte
similarity index 100%
rename from packages/ui/src/lib/components/icons/IconEdit.svelte
rename to packages/ui-kit/src/lib/components/icons/IconEdit.svelte
diff --git a/packages/ui/src/lib/components/icons/IconExpand.svelte b/packages/ui-kit/src/lib/components/icons/IconExpand.svelte
similarity index 100%
rename from packages/ui/src/lib/components/icons/IconExpand.svelte
rename to packages/ui-kit/src/lib/components/icons/IconExpand.svelte
diff --git a/packages/ui/src/lib/components/icons/IconFile.svelte b/packages/ui-kit/src/lib/components/icons/IconFile.svelte
similarity index 100%
rename from packages/ui/src/lib/components/icons/IconFile.svelte
rename to packages/ui-kit/src/lib/components/icons/IconFile.svelte
diff --git a/packages/ui/src/lib/components/icons/IconFilter.svelte b/packages/ui-kit/src/lib/components/icons/IconFilter.svelte
similarity index 100%
rename from packages/ui/src/lib/components/icons/IconFilter.svelte
rename to packages/ui-kit/src/lib/components/icons/IconFilter.svelte
diff --git a/packages/ui/src/lib/components/icons/IconFlame.svelte b/packages/ui-kit/src/lib/components/icons/IconFlame.svelte
similarity index 100%
rename from packages/ui/src/lib/components/icons/IconFlame.svelte
rename to packages/ui-kit/src/lib/components/icons/IconFlame.svelte
diff --git a/packages/ui/src/lib/components/icons/IconFolder.svelte b/packages/ui-kit/src/lib/components/icons/IconFolder.svelte
similarity index 100%
rename from packages/ui/src/lib/components/icons/IconFolder.svelte
rename to packages/ui-kit/src/lib/components/icons/IconFolder.svelte
diff --git a/packages/ui/src/lib/components/icons/IconForward.svelte b/packages/ui-kit/src/lib/components/icons/IconForward.svelte
similarity index 100%
rename from packages/ui/src/lib/components/icons/IconForward.svelte
rename to packages/ui-kit/src/lib/components/icons/IconForward.svelte
diff --git a/packages/ui/src/lib/components/icons/IconHelp.svelte b/packages/ui-kit/src/lib/components/icons/IconHelp.svelte
similarity index 100%
rename from packages/ui/src/lib/components/icons/IconHelp.svelte
rename to packages/ui-kit/src/lib/components/icons/IconHelp.svelte
diff --git a/packages/ui/src/lib/components/icons/IconHide.svelte b/packages/ui-kit/src/lib/components/icons/IconHide.svelte
similarity index 100%
rename from packages/ui/src/lib/components/icons/IconHide.svelte
rename to packages/ui-kit/src/lib/components/icons/IconHide.svelte
diff --git a/packages/ui/src/lib/components/icons/IconHome.svelte b/packages/ui-kit/src/lib/components/icons/IconHome.svelte
similarity index 100%
rename from packages/ui/src/lib/components/icons/IconHome.svelte
rename to packages/ui-kit/src/lib/components/icons/IconHome.svelte
diff --git a/packages/ui/src/lib/components/icons/IconInfo.svelte b/packages/ui-kit/src/lib/components/icons/IconInfo.svelte
similarity index 100%
rename from packages/ui/src/lib/components/icons/IconInfo.svelte
rename to packages/ui-kit/src/lib/components/icons/IconInfo.svelte
diff --git a/packages/ui/src/lib/components/icons/IconJournal.svelte b/packages/ui-kit/src/lib/components/icons/IconJournal.svelte
similarity index 100%
rename from packages/ui/src/lib/components/icons/IconJournal.svelte
rename to packages/ui-kit/src/lib/components/icons/IconJournal.svelte
diff --git a/packages/ui/src/lib/components/icons/IconKey.svelte b/packages/ui-kit/src/lib/components/icons/IconKey.svelte
similarity index 100%
rename from packages/ui/src/lib/components/icons/IconKey.svelte
rename to packages/ui-kit/src/lib/components/icons/IconKey.svelte
diff --git a/packages/ui/src/lib/components/icons/IconLink.svelte b/packages/ui-kit/src/lib/components/icons/IconLink.svelte
similarity index 100%
rename from packages/ui/src/lib/components/icons/IconLink.svelte
rename to packages/ui-kit/src/lib/components/icons/IconLink.svelte
diff --git a/packages/ui/src/lib/components/icons/IconListening.svelte b/packages/ui-kit/src/lib/components/icons/IconListening.svelte
similarity index 100%
rename from packages/ui/src/lib/components/icons/IconListening.svelte
rename to packages/ui-kit/src/lib/components/icons/IconListening.svelte
diff --git a/packages/ui/src/lib/components/icons/IconLock.svelte b/packages/ui-kit/src/lib/components/icons/IconLock.svelte
similarity index 100%
rename from packages/ui/src/lib/components/icons/IconLock.svelte
rename to packages/ui-kit/src/lib/components/icons/IconLock.svelte
diff --git a/packages/ui/src/lib/components/icons/IconLogo.svelte b/packages/ui-kit/src/lib/components/icons/IconLogo.svelte
similarity index 100%
rename from packages/ui/src/lib/components/icons/IconLogo.svelte
rename to packages/ui-kit/src/lib/components/icons/IconLogo.svelte
diff --git a/packages/ui/src/lib/components/icons/IconMemory.svelte b/packages/ui-kit/src/lib/components/icons/IconMemory.svelte
similarity index 100%
rename from packages/ui/src/lib/components/icons/IconMemory.svelte
rename to packages/ui-kit/src/lib/components/icons/IconMemory.svelte
diff --git a/packages/ui/src/lib/components/icons/IconMic.svelte b/packages/ui-kit/src/lib/components/icons/IconMic.svelte
similarity index 100%
rename from packages/ui/src/lib/components/icons/IconMic.svelte
rename to packages/ui-kit/src/lib/components/icons/IconMic.svelte
diff --git a/packages/ui/src/lib/components/icons/IconMicOff.svelte b/packages/ui-kit/src/lib/components/icons/IconMicOff.svelte
similarity index 100%
rename from packages/ui/src/lib/components/icons/IconMicOff.svelte
rename to packages/ui-kit/src/lib/components/icons/IconMicOff.svelte
diff --git a/packages/ui/src/lib/components/icons/IconMore.svelte b/packages/ui-kit/src/lib/components/icons/IconMore.svelte
similarity index 100%
rename from packages/ui/src/lib/components/icons/IconMore.svelte
rename to packages/ui-kit/src/lib/components/icons/IconMore.svelte
diff --git a/packages/ui/src/lib/components/icons/IconOverview.svelte b/packages/ui-kit/src/lib/components/icons/IconOverview.svelte
similarity index 100%
rename from packages/ui/src/lib/components/icons/IconOverview.svelte
rename to packages/ui-kit/src/lib/components/icons/IconOverview.svelte
diff --git a/packages/ui/src/lib/components/icons/IconRefresh.svelte b/packages/ui-kit/src/lib/components/icons/IconRefresh.svelte
similarity index 100%
rename from packages/ui/src/lib/components/icons/IconRefresh.svelte
rename to packages/ui-kit/src/lib/components/icons/IconRefresh.svelte
diff --git a/packages/ui/src/lib/components/icons/IconReveal.svelte b/packages/ui-kit/src/lib/components/icons/IconReveal.svelte
similarity index 100%
rename from packages/ui/src/lib/components/icons/IconReveal.svelte
rename to packages/ui-kit/src/lib/components/icons/IconReveal.svelte
diff --git a/packages/ui/src/lib/components/icons/IconSearch.svelte b/packages/ui-kit/src/lib/components/icons/IconSearch.svelte
similarity index 100%
rename from packages/ui/src/lib/components/icons/IconSearch.svelte
rename to packages/ui-kit/src/lib/components/icons/IconSearch.svelte
diff --git a/packages/ui/src/lib/components/icons/IconSend.svelte b/packages/ui-kit/src/lib/components/icons/IconSend.svelte
similarity index 100%
rename from packages/ui/src/lib/components/icons/IconSend.svelte
rename to packages/ui-kit/src/lib/components/icons/IconSend.svelte
diff --git a/packages/ui/src/lib/components/icons/IconServer.svelte b/packages/ui-kit/src/lib/components/icons/IconServer.svelte
similarity index 100%
rename from packages/ui/src/lib/components/icons/IconServer.svelte
rename to packages/ui-kit/src/lib/components/icons/IconServer.svelte
diff --git a/packages/ui/src/lib/components/icons/IconSettings.svelte b/packages/ui-kit/src/lib/components/icons/IconSettings.svelte
similarity index 100%
rename from packages/ui/src/lib/components/icons/IconSettings.svelte
rename to packages/ui-kit/src/lib/components/icons/IconSettings.svelte
diff --git a/packages/ui/src/lib/components/icons/IconSharing.svelte b/packages/ui-kit/src/lib/components/icons/IconSharing.svelte
similarity index 100%
rename from packages/ui/src/lib/components/icons/IconSharing.svelte
rename to packages/ui-kit/src/lib/components/icons/IconSharing.svelte
diff --git a/packages/ui/src/lib/components/icons/IconSign.svelte b/packages/ui-kit/src/lib/components/icons/IconSign.svelte
similarity index 100%
rename from packages/ui/src/lib/components/icons/IconSign.svelte
rename to packages/ui-kit/src/lib/components/icons/IconSign.svelte
diff --git a/packages/ui/src/lib/components/icons/IconSoundOff.svelte b/packages/ui-kit/src/lib/components/icons/IconSoundOff.svelte
similarity index 100%
rename from packages/ui/src/lib/components/icons/IconSoundOff.svelte
rename to packages/ui-kit/src/lib/components/icons/IconSoundOff.svelte
diff --git a/packages/ui/src/lib/components/icons/IconSoundOn.svelte b/packages/ui-kit/src/lib/components/icons/IconSoundOn.svelte
similarity index 100%
rename from packages/ui/src/lib/components/icons/IconSoundOn.svelte
rename to packages/ui-kit/src/lib/components/icons/IconSoundOn.svelte
diff --git a/packages/ui/src/lib/components/icons/IconStarred.svelte b/packages/ui-kit/src/lib/components/icons/IconStarred.svelte
similarity index 100%
rename from packages/ui/src/lib/components/icons/IconStarred.svelte
rename to packages/ui-kit/src/lib/components/icons/IconStarred.svelte
diff --git a/packages/ui/src/lib/components/icons/IconStop.svelte b/packages/ui-kit/src/lib/components/icons/IconStop.svelte
similarity index 100%
rename from packages/ui/src/lib/components/icons/IconStop.svelte
rename to packages/ui-kit/src/lib/components/icons/IconStop.svelte
diff --git a/packages/ui/src/lib/components/icons/IconTerminal.svelte b/packages/ui-kit/src/lib/components/icons/IconTerminal.svelte
similarity index 100%
rename from packages/ui/src/lib/components/icons/IconTerminal.svelte
rename to packages/ui-kit/src/lib/components/icons/IconTerminal.svelte
diff --git a/packages/ui/src/lib/components/icons/IconThemeDark.svelte b/packages/ui-kit/src/lib/components/icons/IconThemeDark.svelte
similarity index 100%
rename from packages/ui/src/lib/components/icons/IconThemeDark.svelte
rename to packages/ui-kit/src/lib/components/icons/IconThemeDark.svelte
diff --git a/packages/ui/src/lib/components/icons/IconThemeLight.svelte b/packages/ui-kit/src/lib/components/icons/IconThemeLight.svelte
similarity index 100%
rename from packages/ui/src/lib/components/icons/IconThemeLight.svelte
rename to packages/ui-kit/src/lib/components/icons/IconThemeLight.svelte
diff --git a/packages/ui/src/lib/components/icons/IconThemeSystem.svelte b/packages/ui-kit/src/lib/components/icons/IconThemeSystem.svelte
similarity index 100%
rename from packages/ui/src/lib/components/icons/IconThemeSystem.svelte
rename to packages/ui-kit/src/lib/components/icons/IconThemeSystem.svelte
diff --git a/packages/ui/src/lib/components/icons/IconUpload.svelte b/packages/ui-kit/src/lib/components/icons/IconUpload.svelte
similarity index 100%
rename from packages/ui/src/lib/components/icons/IconUpload.svelte
rename to packages/ui-kit/src/lib/components/icons/IconUpload.svelte
diff --git a/packages/ui/src/lib/components/icons/IconUser.svelte b/packages/ui-kit/src/lib/components/icons/IconUser.svelte
similarity index 100%
rename from packages/ui/src/lib/components/icons/IconUser.svelte
rename to packages/ui-kit/src/lib/components/icons/IconUser.svelte
diff --git a/packages/ui/src/lib/components/icons/IconWaveform.svelte b/packages/ui-kit/src/lib/components/icons/IconWaveform.svelte
similarity index 100%
rename from packages/ui/src/lib/components/icons/IconWaveform.svelte
rename to packages/ui-kit/src/lib/components/icons/IconWaveform.svelte
diff --git a/packages/ui/src/lib/components/icons/index.ts b/packages/ui-kit/src/lib/components/icons/index.ts
similarity index 100%
rename from packages/ui/src/lib/components/icons/index.ts
rename to packages/ui-kit/src/lib/components/icons/index.ts
diff --git a/packages/ui-kit/src/lib/theme/tokens.css b/packages/ui-kit/src/lib/theme/tokens.css
new file mode 100644
index 000000000..0f940649c
--- /dev/null
+++ b/packages/ui-kit/src/lib/theme/tokens.css
@@ -0,0 +1,530 @@
+/* ── @openpalm/ui-kit theme tokens ─────────────────────────────────────
+   Shared design vocabulary consumed by every OpenPalm app (plan
+   ui-runtime-modes-plan.md §6.11): the Stillness custom-property tokens
+   and the wiz-* wizard/design-vocabulary classes. Extracted from
+   packages/ui/src/app.css (P5a, #555); ui-specific layout CSS stays in
+   the app. Consuming apps @import this file from their app.css. */
+
+/* ── Stillness Design System Tokens ───────────────────────────────── */
+
+:root,
+:root[data-theme='light'],
+:root[data-theme='day'] {
+  --s-paper:       #E5E1D5;
+  --s-paper-deep:  #D9D5C8;
+  --s-ink:         #26292B;
+  --s-ink-2:       #5A5E5C;
+  --s-ink-3:       #8C8F88;
+  --s-seal:        #CB782D;
+  --s-moss:        #6E7459;
+  --s-error:       #C5402B;
+  --s-line:        rgba(38, 41, 43, 0.14);
+  --s-line-soft:   rgba(38, 41, 43, 0.07);
+  --s-paper-grain: 0.05;
+}
+
+:root[data-theme='dark'],
+:root[data-theme='night'] {
+  --s-paper:       #15181B;
+  --s-paper-deep:  #0F1214;
+  --s-ink:         #DAD6C9;
+  --s-ink-2:       #989B91;
+  --s-ink-3:       #63665E;
+  --s-seal:        #DCC25C;
+  --s-moss:        #8FA08C;
+  --s-error:       #D95F4E;
+  --s-line:        rgba(218, 214, 201, 0.15);
+  --s-line-soft:   rgba(218, 214, 201, 0.07);
+  --s-paper-grain: 0.04;
+}
+
+:root {
+  --s-font-header: "Poor Story", ui-rounded, "Segoe UI", system-ui, sans-serif;
+  --s-font-display: "Iosevka Charon Mono", ui-monospace, "SF Mono", Menlo, monospace;
+  --s-font-mono:    "Iosevka Charon Mono", ui-monospace, "SF Mono", Menlo, monospace;
+
+  --s-type-voice:      clamp(1.5rem, 4.4vw, 2rem);
+  --s-type-voice-lh:   1.62;
+  --s-type-whisper:    clamp(1rem, 2.4vw, 1.2rem);
+  --s-type-whisper-lh: 1.7;
+  --s-type-compose:    clamp(1rem, 2.8vw, 1.12rem);
+  --s-type-title:      clamp(1.15rem, 3vw, 1.4rem);
+  --s-type-title-lh:   1.3;
+  --s-type-mark:       0.6rem;
+  --s-type-mark-sm:    0.58rem;
+  --s-type-deed:       0.78rem;
+  --s-track-mark:      0.34em;
+  --s-track-label:     0.22em;
+
+  --s-sp-1: 0.32rem;
+  --s-sp-2: 0.5rem;
+  --s-sp-3: 0.7rem;
+  --s-sp-4: 0.9rem;
+  --s-sp-5: 1.1rem;
+  --s-sp-6: 1.6rem;
+  --s-sp-8: 2.4rem;
+
+  --s-breath:          clamp(2.6rem, 7vh, 4.4rem);
+  --s-frame:           clamp(1.6rem, 7vw, 3rem);
+  --s-chrome-pad:      clamp(1.1rem, 4vw, 1.9rem);
+  --s-measure:         46rem;
+  --s-measure-whisper: 34rem;
+  --s-radius-seal:     3.6px;
+  --s-radius-focus:    4px;
+  --s-hair:            1px;
+  --s-enso-size:       78px;
+  --s-glyph-size:      30px;
+
+  --s-t-instant:   .25s;
+  --s-t-quick:     .5s;
+  --s-t-settle:    .7s;
+  --s-t-bloom:     1.15s;
+  --s-t-theme:     1.1s;
+  --s-t-draw:      2.1s;
+  --s-ease:        cubic-bezier(.4, 0, .2, 1);
+  --s-ease-settle: cubic-bezier(.22, .61, .36, 1);
+  --s-ease-draw:   cubic-bezier(.5, .05, .2, 1);
+  --s-breathe-dur: 9s;
+
+  /* Layout */
+  --nav-height:       52px;
+  --chat-column:      48rem;
+  --sheet-width:      480px;
+  --sheet-width-wide: 640px;
+  --overlay-bg:       rgba(0, 0, 0, 0.35);
+  --toggle-width:     36px;
+  --toggle-height:    20px;
+  --toggle-bg-off:    var(--s-line);
+  --toggle-bg-on:     var(--s-seal);
+}
+
+/* ── Wizard design vocabulary (wiz-*) ─────────────────────────────── */
+
+/* ── Topbar ───────────────────────────────────────────────────── */
+.wiz-topbar {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  padding: 18px 40px;
+  border-bottom: var(--s-hair) solid var(--s-line);
+  flex-shrink: 0;
+  background: var(--s-paper);
+}
+
+.wiz-wordmark {
+  display: flex;
+  align-items: center;
+  gap: 10px;
+}
+
+.wiz-wordmark svg { display: block; flex-shrink: 0; color: var(--s-ink); }
+
+.wiz-wordmark b {
+  font-size: 15px;
+  font-weight: 700;
+  color: var(--s-ink);
+  letter-spacing: -0.2px;
+}
+
+.wiz-wordmark span {
+  font-size: 14px;
+  color: var(--s-ink-3);
+}
+
+/* Step ticker (top nav pills) */
+.wiz-ticker {
+  display: flex;
+  align-items: center;
+  gap: 6px;
+}
+
+.wiz-tick {
+  display: flex;
+  align-items: center;
+  gap: 6px;
+  padding: 5px 12px;
+  border-radius: 99px;
+  font-size: 12px;
+  font-weight: 600;
+  border: var(--s-hair) solid var(--s-line);
+  color: var(--s-ink-3);
+  background: transparent;
+  transition: all 150ms;
+  cursor: default;
+}
+
+.wiz-tick--active {
+  background: var(--s-seal);
+  border-color: var(--s-seal);
+  /* Dark text on the orange pill — white-on-orange is ~2:1 (fails AA); dark text
+     matches the primary CTA button (black-on-orange ~8:1). */
+  color: #1f1d18;
+}
+
+.wiz-tick--done {
+  color: var(--s-moss);
+  border-color: color-mix(in srgb, var(--s-moss) 12%, transparent);
+  background: color-mix(in srgb, var(--s-moss) 12%, transparent);
+}
+
+.wiz-tick-num {
+  font-size: 11px;
+  opacity: 0.75;
+}
+
+/* ── Main stage: content + aside ──────────────────────────────── */
+.wiz-stage {
+  display: grid;
+  grid-template-columns: 1fr 410px;
+  flex: 1;
+  min-height: 0;
+  overflow: hidden;
+}
+
+/* Content column */
+.wiz-content {
+  display: flex;
+  flex-direction: column;
+  min-width: 0;
+  overflow: hidden;
+}
+
+.wiz-content-scroll {
+  flex: 1;
+  overflow-y: auto;
+  padding: 48px 56px 32px;
+  scrollbar-width: thin;
+  scrollbar-color: var(--s-line) transparent;
+}
+
+.wiz-eyebrow {
+  font-size: 11px;
+  font-weight: 600;
+  color: var(--s-ink-3);
+  text-transform: uppercase;
+  letter-spacing: 0.8px;
+  margin-bottom: 10px;
+}
+
+.wiz-title {
+  font-family: var(--s-font-header);
+  font-size: clamp(28px, 4vw, 38px);
+  font-weight: 400;
+  line-height: 1.1;
+  color: var(--s-ink);
+  letter-spacing: -0.5px;
+  margin: 0 0 14px;
+}
+
+.wiz-title .accent {
+  color: var(--s-seal);
+}
+
+.wiz-lede {
+  font-size: 15px;
+  line-height: 1.6;
+  color: var(--s-ink-2);
+  max-width: 480px;
+  margin: 0 0 32px;
+}
+
+/* Footer bar */
+.wiz-footer {
+  padding: 16px 56px;
+  border-top: var(--s-hair) solid var(--s-line);
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  flex-shrink: 0;
+  background: var(--s-paper);
+  gap: 12px;
+}
+
+.wiz-footer-left { display: flex; gap: 8px; align-items: center; }
+.wiz-footer-right { display: flex; gap: 10px; align-items: center; }
+
+/* Aside / guide column */
+.wiz-aside {
+  background: var(--s-paper-deep);
+  border-left: var(--s-hair) solid var(--s-line);
+  display: flex;
+  flex-direction: column;
+  padding: 40px 32px;
+  overflow-y: auto;
+}
+
+.wiz-aside-top {
+  display: flex;
+  align-items: flex-start;
+  gap: 16px;
+  margin-bottom: 24px;
+}
+
+.wiz-mascot {
+  width: 64px;
+  height: 64px;
+  border-radius: 2px;
+  flex-shrink: 0;
+}
+
+.wiz-greet-name {
+  font-size: 16px;
+  font-weight: 700;
+  color: var(--s-ink);
+  display: block;
+  margin-bottom: 4px;
+}
+
+.wiz-greet-sub {
+  font-size: 13px;
+  color: var(--s-ink-2);
+  line-height: 1.5;
+}
+
+.wiz-guide-lede {
+  font-size: 14px;
+  line-height: 1.6;
+  color: var(--s-ink-2);
+  margin: 0 0 24px;
+}
+
+.wiz-guide-bullets {
+  display: flex;
+  flex-direction: column;
+  gap: 14px;
+  margin-bottom: 32px;
+}
+
+.wiz-bullet {
+  display: flex;
+  align-items: flex-start;
+  gap: 12px;
+  font-size: 13px;
+  line-height: 1.5;
+  color: var(--s-ink-2);
+}
+
+.wiz-bullet-icon {
+  width: 32px;
+  height: 32px;
+  border-radius: 8px;
+  background: color-mix(in srgb, var(--s-seal) 8%, transparent);
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  flex-shrink: 0;
+  color: var(--s-seal);
+}
+
+.wiz-bullet-icon svg { width: 16px; height: 16px; }
+
+.wiz-guide-privacy {
+  margin-top: auto;
+  padding-top: 24px;
+  border-top: var(--s-hair) solid var(--s-line);
+  font-size: 12px;
+  color: var(--s-ink-3);
+  line-height: 1.5;
+  display: flex;
+  align-items: flex-start;
+  gap: 8px;
+}
+
+.wiz-guide-privacy svg {
+  width: 14px;
+  height: 14px;
+  flex-shrink: 0;
+  color: var(--s-moss);
+  margin-top: 1px;
+}
+
+/* Section label (used in step bodies) */
+.wiz-section-label {
+  font-size: 11px;
+  font-weight: 600;
+  color: var(--s-ink-3);
+  text-transform: uppercase;
+  letter-spacing: 0.6px;
+  margin: 0 0 10px;
+}
+
+/* Ledger: connected provider rows */
+.wiz-ledger {
+  display: flex;
+  flex-direction: column;
+  margin-bottom: 20px;
+}
+
+.wiz-ledger-row {
+  display: flex;
+  align-items: center;
+  gap: 12px;
+  padding: 10px 0;
+  border-bottom: var(--s-hair) solid var(--s-line);
+}
+
+.wiz-ledger-row:first-child {
+  border-top: var(--s-hair) solid var(--s-line);
+}
+
+.wiz-ledger-glyph {
+  width: 36px;
+  height: 36px;
+  border-radius: 9px;
+  background: var(--s-paper-deep);
+  border: var(--s-hair) solid var(--s-line);
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  flex-shrink: 0;
+}
+
+.wiz-ledger-glyph svg { width: 18px; height: 18px; }
+
+.wiz-ledger-name {
+  flex: 1;
+  min-width: 0;
+  font-size: 14px;
+  font-weight: 500;
+  color: var(--s-ink);
+}
+
+.wiz-ledger-sub {
+  font-size: 12px;
+  color: var(--s-ink-2);
+  margin-top: 1px;
+}
+
+.wiz-stamp {
+  display: flex;
+  align-items: center;
+  gap: 5px;
+  font-size: 12px;
+  font-weight: 600;
+  color: var(--s-moss);
+  white-space: nowrap;
+}
+
+.wiz-stamp-ring {
+  width: 18px;
+  height: 18px;
+  border-radius: 50%;
+  border: 2px solid var(--s-moss);
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  flex-shrink: 0;
+}
+
+.wiz-stamp-ring svg { width: 10px; height: 10px; }
+
+/* Local CTA callout */
+.wiz-local-cta {
+  display: flex;
+  align-items: center;
+  gap: 14px;
+  padding: 14px 16px;
+  background: color-mix(in srgb, var(--s-seal) 8%, transparent);
+  border: 1px solid color-mix(in srgb, var(--s-seal) 8%, transparent);
+  border-radius: 2px;
+  margin-bottom: 20px;
+}
+
+.wiz-local-cta-icon {
+  width: 40px;
+  height: 40px;
+  border-radius: 10px;
+  background: color-mix(in srgb, var(--s-seal) 8%, transparent);
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  flex-shrink: 0;
+  color: var(--s-seal);
+}
+
+.wiz-local-cta-icon svg { width: 20px; height: 20px; }
+
+.wiz-local-cta-main {
+  flex: 1;
+  min-width: 0;
+}
+
+.wiz-local-cta-main b {
+  display: block;
+  font-size: 14px;
+  font-weight: 600;
+  color: var(--s-ink);
+  margin-bottom: 2px;
+}
+
+.wiz-local-cta-main span {
+  font-size: 12px;
+  color: var(--s-ink-2);
+}
+
+/* "Add another" toggle row */
+.wiz-add-line {
+  margin-bottom: 16px;
+}
+
+.wiz-add-toggle {
+  display: flex;
+  align-items: center;
+  gap: 8px;
+  font-size: 14px;
+  font-weight: 500;
+  color: var(--s-seal);
+  background: none;
+  border: none;
+  cursor: pointer;
+  padding: 0;
+  font-family: inherit;
+  transition: opacity 150ms;
+}
+
+.wiz-add-toggle:hover { opacity: 0.75; }
+
+.wiz-add-toggle svg { width: 16px; height: 16px; }
+
+/* "More connected" expander */
+.wiz-ledger-more {
+  font-size: 12px;
+  color: var(--s-ink-2);
+  padding: 8px 0;
+  cursor: pointer;
+  background: none;
+  border: none;
+  font-family: inherit;
+  text-align: left;
+}
+
+.wiz-ledger-more:hover { color: var(--s-ink); }
+
+/* Responsive */
+@media (max-width: 768px) {
+  .wiz-stage {
+    grid-template-columns: 1fr;
+  }
+  .wiz-aside {
+    display: none;
+  }
+  .wiz-content-scroll {
+    padding: 28px 20px 20px;
+  }
+  .wiz-footer {
+    padding: 14px 20px;
+  }
+  .wiz-topbar {
+    padding: 14px 20px;
+  }
+  /* The step ticker (~231px) overflows the narrow topbar (29px past 375px →
+     WCAG 1.4.10 reflow). Hide it on mobile; the ".wiz-eyebrow" (STEP n · …)
+     already conveys progress on the content. */
+  .wiz-ticker {
+    display: none;
+  }
+}
+
+@media (prefers-reduced-motion: reduce) {
+  .wiz-tick { transition: none; }
+}
diff --git a/packages/ui/package.json b/packages/ui/package.json
index 8a9954163..9af8abb31 100644
--- a/packages/ui/package.json
+++ b/packages/ui/package.json
@@ -39,6 +39,7 @@
     "@eslint/compat": "^2.0.2",
     "@eslint/js": "^10.0.1",
     "@openpalm/lib": "workspace:*",
+    "@openpalm/ui-kit": "workspace:*",
     "@playwright/test": "^1.58.1",
     "@sveltejs/adapter-node": "^5.5.4",
     "@sveltejs/kit": "^2.53.3",
diff --git a/packages/ui/src/app.css b/packages/ui/src/app.css
index 559c804d2..0e6eb8720 100644
--- a/packages/ui/src/app.css
+++ b/packages/ui/src/app.css
@@ -1,101 +1,14 @@
 @import url('https://fonts.googleapis.com/css2?family=Poor+Story&family=Iosevka+Charon+Mono:ital,wght@0,300;0,400;0,500;0,700;1,300;1,400;1,500;1,700&display=swap');
+/* Stillness design-system tokens + wiz-* design vocabulary live in the shared
+   ui-kit (plan §6.11, P5a #555). Vite resolves the package specifier and
+   inlines the file at build time. Must stay above all style rules — CSS
+   ignores @import after the first rule. */
+@import '@openpalm/ui-kit/theme/tokens.css';
+
 /* Brushed icon filter — applied to all .s-icon SVGs. The #ibrush filter is
    defined once in the root layout. */
 .s-icon { filter: url(#ibrush); }
 
-/* ── Stillness Design System Tokens ───────────────────────────────── */
-
-:root,
-:root[data-theme='light'],
-:root[data-theme='day'] {
-  --s-paper:       #E5E1D5;
-  --s-paper-deep:  #D9D5C8;
-  --s-ink:         #26292B;
-  --s-ink-2:       #5A5E5C;
-  --s-ink-3:       #8C8F88;
-  --s-seal:        #CB782D;
-  --s-moss:        #6E7459;
-  --s-error:       #C5402B;
-  --s-line:        rgba(38, 41, 43, 0.14);
-  --s-line-soft:   rgba(38, 41, 43, 0.07);
-  --s-paper-grain: 0.05;
-}
-
-:root[data-theme='dark'],
-:root[data-theme='night'] {
-  --s-paper:       #15181B;
-  --s-paper-deep:  #0F1214;
-  --s-ink:         #DAD6C9;
-  --s-ink-2:       #989B91;
-  --s-ink-3:       #63665E;
-  --s-seal:        #DCC25C;
-  --s-moss:        #8FA08C;
-  --s-error:       #D95F4E;
-  --s-line:        rgba(218, 214, 201, 0.15);
-  --s-line-soft:   rgba(218, 214, 201, 0.07);
-  --s-paper-grain: 0.04;
-}
-
-:root {
-  --s-font-header: "Poor Story", ui-rounded, "Segoe UI", system-ui, sans-serif;
-  --s-font-display: "Iosevka Charon Mono", ui-monospace, "SF Mono", Menlo, monospace;
-  --s-font-mono:    "Iosevka Charon Mono", ui-monospace, "SF Mono", Menlo, monospace;
-
-  --s-type-voice:      clamp(1.5rem, 4.4vw, 2rem);
-  --s-type-voice-lh:   1.62;
-  --s-type-whisper:    clamp(1rem, 2.4vw, 1.2rem);
-  --s-type-whisper-lh: 1.7;
-  --s-type-compose:    clamp(1rem, 2.8vw, 1.12rem);
-  --s-type-title:      clamp(1.15rem, 3vw, 1.4rem);
-  --s-type-title-lh:   1.3;
-  --s-type-mark:       0.6rem;
-  --s-type-mark-sm:    0.58rem;
-  --s-type-deed:       0.78rem;
-  --s-track-mark:      0.34em;
-  --s-track-label:     0.22em;
-
-  --s-sp-1: 0.32rem;
-  --s-sp-2: 0.5rem;
-  --s-sp-3: 0.7rem;
-  --s-sp-4: 0.9rem;
-  --s-sp-5: 1.1rem;
-  --s-sp-6: 1.6rem;
-  --s-sp-8: 2.4rem;
-
-  --s-breath:          clamp(2.6rem, 7vh, 4.4rem);
-  --s-frame:           clamp(1.6rem, 7vw, 3rem);
-  --s-chrome-pad:      clamp(1.1rem, 4vw, 1.9rem);
-  --s-measure:         46rem;
-  --s-measure-whisper: 34rem;
-  --s-radius-seal:     3.6px;
-  --s-radius-focus:    4px;
-  --s-hair:            1px;
-  --s-enso-size:       78px;
-  --s-glyph-size:      30px;
-
-  --s-t-instant:   .25s;
-  --s-t-quick:     .5s;
-  --s-t-settle:    .7s;
-  --s-t-bloom:     1.15s;
-  --s-t-theme:     1.1s;
-  --s-t-draw:      2.1s;
-  --s-ease:        cubic-bezier(.4, 0, .2, 1);
-  --s-ease-settle: cubic-bezier(.22, .61, .36, 1);
-  --s-ease-draw:   cubic-bezier(.5, .05, .2, 1);
-  --s-breathe-dur: 9s;
-
-  /* Layout */
-  --nav-height:       52px;
-  --chat-column:      48rem;
-  --sheet-width:      480px;
-  --sheet-width-wide: 640px;
-  --overlay-bg:       rgba(0, 0, 0, 0.35);
-  --toggle-width:     36px;
-  --toggle-height:    20px;
-  --toggle-bg-off:    var(--s-line);
-  --toggle-bg-on:     var(--s-seal);
-}
-
 /* ── Reset & Base ──────────────────────────────────────────────────── */
 
 *,
@@ -964,434 +877,6 @@ body.chat-locked {
 }
 .rerun-back-link:hover { text-decoration: underline; }
 
-/* ── Topbar ───────────────────────────────────────────────────── */
-.wiz-topbar {
-  display: flex;
-  align-items: center;
-  justify-content: space-between;
-  padding: 18px 40px;
-  border-bottom: var(--s-hair) solid var(--s-line);
-  flex-shrink: 0;
-  background: var(--s-paper);
-}
-
-.wiz-wordmark {
-  display: flex;
-  align-items: center;
-  gap: 10px;
-}
-
-.wiz-wordmark svg { display: block; flex-shrink: 0; color: var(--s-ink); }
-
-.wiz-wordmark b {
-  font-size: 15px;
-  font-weight: 700;
-  color: var(--s-ink);
-  letter-spacing: -0.2px;
-}
-
-.wiz-wordmark span {
-  font-size: 14px;
-  color: var(--s-ink-3);
-}
-
-/* Step ticker (top nav pills) */
-.wiz-ticker {
-  display: flex;
-  align-items: center;
-  gap: 6px;
-}
-
-.wiz-tick {
-  display: flex;
-  align-items: center;
-  gap: 6px;
-  padding: 5px 12px;
-  border-radius: 99px;
-  font-size: 12px;
-  font-weight: 600;
-  border: var(--s-hair) solid var(--s-line);
-  color: var(--s-ink-3);
-  background: transparent;
-  transition: all 150ms;
-  cursor: default;
-}
-
-.wiz-tick--active {
-  background: var(--s-seal);
-  border-color: var(--s-seal);
-  /* Dark text on the orange pill — white-on-orange is ~2:1 (fails AA); dark text
-     matches the primary CTA button (black-on-orange ~8:1). */
-  color: #1f1d18;
-}
-
-.wiz-tick--done {
-  color: var(--s-moss);
-  border-color: color-mix(in srgb, var(--s-moss) 12%, transparent);
-  background: color-mix(in srgb, var(--s-moss) 12%, transparent);
-}
-
-.wiz-tick-num {
-  font-size: 11px;
-  opacity: 0.75;
-}
-
-/* ── Main stage: content + aside ──────────────────────────────── */
-.wiz-stage {
-  display: grid;
-  grid-template-columns: 1fr 410px;
-  flex: 1;
-  min-height: 0;
-  overflow: hidden;
-}
-
-/* Content column */
-.wiz-content {
-  display: flex;
-  flex-direction: column;
-  min-width: 0;
-  overflow: hidden;
-}
-
-.wiz-content-scroll {
-  flex: 1;
-  overflow-y: auto;
-  padding: 48px 56px 32px;
-  scrollbar-width: thin;
-  scrollbar-color: var(--s-line) transparent;
-}
-
-.wiz-eyebrow {
-  font-size: 11px;
-  font-weight: 600;
-  color: var(--s-ink-3);
-  text-transform: uppercase;
-  letter-spacing: 0.8px;
-  margin-bottom: 10px;
-}
-
-.wiz-title {
-  font-family: var(--s-font-header);
-  font-size: clamp(28px, 4vw, 38px);
-  font-weight: 400;
-  line-height: 1.1;
-  color: var(--s-ink);
-  letter-spacing: -0.5px;
-  margin: 0 0 14px;
-}
-
-.wiz-title .accent {
-  color: var(--s-seal);
-}
-
-.wiz-lede {
-  font-size: 15px;
-  line-height: 1.6;
-  color: var(--s-ink-2);
-  max-width: 480px;
-  margin: 0 0 32px;
-}
-
-/* Footer bar */
-.wiz-footer {
-  padding: 16px 56px;
-  border-top: var(--s-hair) solid var(--s-line);
-  display: flex;
-  align-items: center;
-  justify-content: space-between;
-  flex-shrink: 0;
-  background: var(--s-paper);
-  gap: 12px;
-}
-
-.wiz-footer-left { display: flex; gap: 8px; align-items: center; }
-.wiz-footer-right { display: flex; gap: 10px; align-items: center; }
-
-/* Aside / guide column */
-.wiz-aside {
-  background: var(--s-paper-deep);
-  border-left: var(--s-hair) solid var(--s-line);
-  display: flex;
-  flex-direction: column;
-  padding: 40px 32px;
-  overflow-y: auto;
-}
-
-.wiz-aside-top {
-  display: flex;
-  align-items: flex-start;
-  gap: 16px;
-  margin-bottom: 24px;
-}
-
-.wiz-mascot {
-  width: 64px;
-  height: 64px;
-  border-radius: 2px;
-  flex-shrink: 0;
-}
-
-.wiz-greet-name {
-  font-size: 16px;
-  font-weight: 700;
-  color: var(--s-ink);
-  display: block;
-  margin-bottom: 4px;
-}
-
-.wiz-greet-sub {
-  font-size: 13px;
-  color: var(--s-ink-2);
-  line-height: 1.5;
-}
-
-.wiz-guide-lede {
-  font-size: 14px;
-  line-height: 1.6;
-  color: var(--s-ink-2);
-  margin: 0 0 24px;
-}
-
-.wiz-guide-bullets {
-  display: flex;
-  flex-direction: column;
-  gap: 14px;
-  margin-bottom: 32px;
-}
-
-.wiz-bullet {
-  display: flex;
-  align-items: flex-start;
-  gap: 12px;
-  font-size: 13px;
-  line-height: 1.5;
-  color: var(--s-ink-2);
-}
-
-.wiz-bullet-icon {
-  width: 32px;
-  height: 32px;
-  border-radius: 8px;
-  background: color-mix(in srgb, var(--s-seal) 8%, transparent);
-  display: flex;
-  align-items: center;
-  justify-content: center;
-  flex-shrink: 0;
-  color: var(--s-seal);
-}
-
-.wiz-bullet-icon svg { width: 16px; height: 16px; }
-
-.wiz-guide-privacy {
-  margin-top: auto;
-  padding-top: 24px;
-  border-top: var(--s-hair) solid var(--s-line);
-  font-size: 12px;
-  color: var(--s-ink-3);
-  line-height: 1.5;
-  display: flex;
-  align-items: flex-start;
-  gap: 8px;
-}
-
-.wiz-guide-privacy svg {
-  width: 14px;
-  height: 14px;
-  flex-shrink: 0;
-  color: var(--s-moss);
-  margin-top: 1px;
-}
-
-/* Section label (used in step bodies) */
-.wiz-section-label {
-  font-size: 11px;
-  font-weight: 600;
-  color: var(--s-ink-3);
-  text-transform: uppercase;
-  letter-spacing: 0.6px;
-  margin: 0 0 10px;
-}
-
-/* Ledger: connected provider rows */
-.wiz-ledger {
-  display: flex;
-  flex-direction: column;
-  margin-bottom: 20px;
-}
-
-.wiz-ledger-row {
-  display: flex;
-  align-items: center;
-  gap: 12px;
-  padding: 10px 0;
-  border-bottom: var(--s-hair) solid var(--s-line);
-}
-
-.wiz-ledger-row:first-child {
-  border-top: var(--s-hair) solid var(--s-line);
-}
-
-.wiz-ledger-glyph {
-  width: 36px;
-  height: 36px;
-  border-radius: 9px;
-  background: var(--s-paper-deep);
-  border: var(--s-hair) solid var(--s-line);
-  display: flex;
-  align-items: center;
-  justify-content: center;
-  flex-shrink: 0;
-}
-
-.wiz-ledger-glyph svg { width: 18px; height: 18px; }
-
-.wiz-ledger-name {
-  flex: 1;
-  min-width: 0;
-  font-size: 14px;
-  font-weight: 500;
-  color: var(--s-ink);
-}
-
-.wiz-ledger-sub {
-  font-size: 12px;
-  color: var(--s-ink-2);
-  margin-top: 1px;
-}
-
-.wiz-stamp {
-  display: flex;
-  align-items: center;
-  gap: 5px;
-  font-size: 12px;
-  font-weight: 600;
-  color: var(--s-moss);
-  white-space: nowrap;
-}
-
-.wiz-stamp-ring {
-  width: 18px;
-  height: 18px;
-  border-radius: 50%;
-  border: 2px solid var(--s-moss);
-  display: flex;
-  align-items: center;
-  justify-content: center;
-  flex-shrink: 0;
-}
-
-.wiz-stamp-ring svg { width: 10px; height: 10px; }
-
-/* Local CTA callout */
-.wiz-local-cta {
-  display: flex;
-  align-items: center;
-  gap: 14px;
-  padding: 14px 16px;
-  background: color-mix(in srgb, var(--s-seal) 8%, transparent);
-  border: 1px solid color-mix(in srgb, var(--s-seal) 8%, transparent);
-  border-radius: 2px;
-  margin-bottom: 20px;
-}
-
-.wiz-local-cta-icon {
-  width: 40px;
-  height: 40px;
-  border-radius: 10px;
-  background: color-mix(in srgb, var(--s-seal) 8%, transparent);
-  display: flex;
-  align-items: center;
-  justify-content: center;
-  flex-shrink: 0;
-  color: var(--s-seal);
-}
-
-.wiz-local-cta-icon svg { width: 20px; height: 20px; }
-
-.wiz-local-cta-main {
-  flex: 1;
-  min-width: 0;
-}
-
-.wiz-local-cta-main b {
-  display: block;
-  font-size: 14px;
-  font-weight: 600;
-  color: var(--s-ink);
-  margin-bottom: 2px;
-}
-
-.wiz-local-cta-main span {
-  font-size: 12px;
-  color: var(--s-ink-2);
-}
-
-/* "Add another" toggle row */
-.wiz-add-line {
-  margin-bottom: 16px;
-}
-
-.wiz-add-toggle {
-  display: flex;
-  align-items: center;
-  gap: 8px;
-  font-size: 14px;
-  font-weight: 500;
-  color: var(--s-seal);
-  background: none;
-  border: none;
-  cursor: pointer;
-  padding: 0;
-  font-family: inherit;
-  transition: opacity 150ms;
-}
-
-.wiz-add-toggle:hover { opacity: 0.75; }
-
-.wiz-add-toggle svg { width: 16px; height: 16px; }
-
-/* "More connected" expander */
-.wiz-ledger-more {
-  font-size: 12px;
-  color: var(--s-ink-2);
-  padding: 8px 0;
-  cursor: pointer;
-  background: none;
-  border: none;
-  font-family: inherit;
-  text-align: left;
-}
-
-.wiz-ledger-more:hover { color: var(--s-ink); }
-
-/* Responsive */
-@media (max-width: 768px) {
-  .wiz-stage {
-    grid-template-columns: 1fr;
-  }
-  .wiz-aside {
-    display: none;
-  }
-  .wiz-content-scroll {
-    padding: 28px 20px 20px;
-  }
-  .wiz-footer {
-    padding: 14px 20px;
-  }
-  .wiz-topbar {
-    padding: 14px 20px;
-  }
-  /* The step ticker (~231px) overflows the narrow topbar (29px past 375px →
-     WCAG 1.4.10 reflow). Hide it on mobile; the ".wiz-eyebrow" (STEP n · …)
-     already conveys progress on the content. */
-  .wiz-ticker {
-    display: none;
-  }
-}
-
-@media (prefers-reduced-motion: reduce) {
-  .wiz-tick { transition: none; }
-}
 
 /* ── Step content area ────────────────────────────────────────── */
 .step-content {
diff --git a/packages/ui/src/lib/components/addons/AddonsTab.svelte b/packages/ui/src/lib/components/addons/AddonsTab.svelte
index 391528e17..dc5e6b029 100644
--- a/packages/ui/src/lib/components/addons/AddonsTab.svelte
+++ b/packages/ui/src/lib/components/addons/AddonsTab.svelte
@@ -1,21 +1,23 @@
 <script lang="ts">
   import { onMount } from 'svelte';
-  import EmptyState from '$lib/components/common/EmptyState.svelte';
+  import EmptyState from '@openpalm/ui-kit/components/common/EmptyState.svelte';
   import {
     fetchAddons,
     toggleAddon,
     fetchAddonCredentials,
     saveAddonCredentials,
     fetchSecretFile,
+    fetchSecretFiles,
+    saveSecretFile,
     type AddonCredentialField,
   } from '$lib/api.js';
   import { isAuthError, toMessage } from '$lib/api/errors.js';
   import { notifications } from '$lib/notifications.svelte.js';
   import { type TabId } from '$lib/components/chrome/TabBar.svelte';
-  import SecretSelect from '$lib/components/common/SecretSelect.svelte';
-  import Spinner from '$lib/components/common/Spinner.svelte';
-  import IconAddons from '$lib/components/icons/IconAddons.svelte';
-  import Drawer from '$lib/components/common/Drawer.svelte';
+  import SecretSelect from '@openpalm/ui-kit/components/common/SecretSelect.svelte';
+  import Spinner from '@openpalm/ui-kit/components/common/Spinner.svelte';
+  import IconAddons from '@openpalm/ui-kit/components/icons/IconAddons.svelte';
+  import Drawer from '@openpalm/ui-kit/components/common/Drawer.svelte';
 
   interface Props {
     onAuthError: () => void;
@@ -264,6 +266,8 @@
                 id="cred-{aid}-{field.key}"
                 bind:value={credSecretRef[aid][field.key]}
                 onChange={(secretName) => void onSecretChosen(aid, field.key, secretName)}
+                {fetchSecretFiles}
+                {saveSecretFile}
               />
               {#if field.set}<p class="creds-desc">A value is already set — choose a secret to replace it.</p>{/if}
             {:else}
diff --git a/packages/ui/src/lib/components/admin/activity/ActivityTab.svelte b/packages/ui/src/lib/components/admin/activity/ActivityTab.svelte
index a952b73ac..af6a911bf 100644
--- a/packages/ui/src/lib/components/admin/activity/ActivityTab.svelte
+++ b/packages/ui/src/lib/components/admin/activity/ActivityTab.svelte
@@ -1,6 +1,6 @@
 <script lang="ts">
   import { onDestroy, onMount } from 'svelte';
-  import Spinner from '$lib/components/common/Spinner.svelte';
+  import Spinner from '@openpalm/ui-kit/components/common/Spinner.svelte';
   import ChatMessage from '$lib/components/chat/ChatMessage.svelte';
   import ToolStrip from '$lib/components/chat/ToolStrip.svelte';
   import { endpointsService } from '$lib/endpoints-state.svelte.js';
diff --git a/packages/ui/src/lib/components/admin/assistant/AssistantTab.svelte b/packages/ui/src/lib/components/admin/assistant/AssistantTab.svelte
index 86d1a7106..ee4dd0f88 100644
--- a/packages/ui/src/lib/components/admin/assistant/AssistantTab.svelte
+++ b/packages/ui/src/lib/components/admin/assistant/AssistantTab.svelte
@@ -1,6 +1,6 @@
 <script lang="ts">
   import { onMount } from 'svelte';
-  import Spinner from '$lib/components/common/Spinner.svelte';
+  import Spinner from '@openpalm/ui-kit/components/common/Spinner.svelte';
   import {
     fetchAssistantPersona,
     fetchHostStackSettings,
diff --git a/packages/ui/src/lib/components/admin/automations/AutomationsTab.svelte b/packages/ui/src/lib/components/admin/automations/AutomationsTab.svelte
index 65c35355f..9a5f38c31 100644
--- a/packages/ui/src/lib/components/admin/automations/AutomationsTab.svelte
+++ b/packages/ui/src/lib/components/admin/automations/AutomationsTab.svelte
@@ -1,8 +1,8 @@
 <script lang="ts">
   import type { AutomationsResponse } from '$lib/types.js';
-  import Spinner from '$lib/components/common/Spinner.svelte';
-  import EmptyState from '$lib/components/common/EmptyState.svelte';
-  import Drawer from '$lib/components/common/Drawer.svelte';
+  import Spinner from '@openpalm/ui-kit/components/common/Spinner.svelte';
+  import EmptyState from '@openpalm/ui-kit/components/common/EmptyState.svelte';
+  import Drawer from '@openpalm/ui-kit/components/common/Drawer.svelte';
   import TaskDrawer from './TaskDrawer.svelte';
   import { fetchTaskFile, saveTaskFile, deleteTaskFile, runAutomation, fetchAutomationLog } from '$lib/api.js';
   import { notifications } from '$lib/notifications.svelte.js';
diff --git a/packages/ui/src/lib/components/admin/automations/TaskDrawer.svelte b/packages/ui/src/lib/components/admin/automations/TaskDrawer.svelte
index 929096c83..5cc5e0dfb 100644
--- a/packages/ui/src/lib/components/admin/automations/TaskDrawer.svelte
+++ b/packages/ui/src/lib/components/admin/automations/TaskDrawer.svelte
@@ -1,7 +1,7 @@
 <script lang="ts">
   import { onMount } from 'svelte';
-  import Drawer from '$lib/components/common/Drawer.svelte';
-  import Spinner from '$lib/components/common/Spinner.svelte';
+  import Drawer from '@openpalm/ui-kit/components/common/Drawer.svelte';
+  import Spinner from '@openpalm/ui-kit/components/common/Spinner.svelte';
   import {
     SCHEDULE_PRESETS,
     DOW_LABELS,
diff --git a/packages/ui/src/lib/components/admin/containers/ContainerDetail.svelte b/packages/ui/src/lib/components/admin/containers/ContainerDetail.svelte
index 7018f1f0e..7856b56e0 100644
--- a/packages/ui/src/lib/components/admin/containers/ContainerDetail.svelte
+++ b/packages/ui/src/lib/components/admin/containers/ContainerDetail.svelte
@@ -1,5 +1,5 @@
 <script lang="ts">
-  import Spinner from '$lib/components/common/Spinner.svelte';
+  import Spinner from '@openpalm/ui-kit/components/common/Spinner.svelte';
   import type { ServiceEntry } from '$lib/types.js';
   import { parseImageTag, containerStatusColor, fmtState } from './container-format.js';
 
diff --git a/packages/ui/src/lib/components/admin/containers/ContainerRow.svelte b/packages/ui/src/lib/components/admin/containers/ContainerRow.svelte
index 89653aa6f..c24e606c7 100644
--- a/packages/ui/src/lib/components/admin/containers/ContainerRow.svelte
+++ b/packages/ui/src/lib/components/admin/containers/ContainerRow.svelte
@@ -1,7 +1,7 @@
 <script lang="ts">
   import type { ServiceEntry } from '$lib/types.js';
   import { parseImageTag, containerStatusColor, fmtState } from './container-format.js';
-  import IconExpand from '$lib/components/icons/IconExpand.svelte';
+  import IconExpand from '@openpalm/ui-kit/components/icons/IconExpand.svelte';
 
   interface Props {
     entry: ServiceEntry;
diff --git a/packages/ui/src/lib/components/admin/containers/ContainersEmptyState.svelte b/packages/ui/src/lib/components/admin/containers/ContainersEmptyState.svelte
index aa831bcdd..9dcbb1625 100644
--- a/packages/ui/src/lib/components/admin/containers/ContainersEmptyState.svelte
+++ b/packages/ui/src/lib/components/admin/containers/ContainersEmptyState.svelte
@@ -1,6 +1,6 @@
 <script lang="ts">
   import type { ContainerListResponse } from '$lib/types.js';
-  import IconServer from '$lib/components/icons/IconServer.svelte';
+  import IconServer from '@openpalm/ui-kit/components/icons/IconServer.svelte';
 
   interface Props {
     loading: boolean;
diff --git a/packages/ui/src/lib/components/admin/containers/ContainersTab.svelte b/packages/ui/src/lib/components/admin/containers/ContainersTab.svelte
index 0b1ce2a7d..96c909917 100644
--- a/packages/ui/src/lib/components/admin/containers/ContainersTab.svelte
+++ b/packages/ui/src/lib/components/admin/containers/ContainersTab.svelte
@@ -1,6 +1,6 @@
 <script lang="ts">
-  import Spinner from '$lib/components/common/Spinner.svelte';
-  import Panel from '$lib/components/common/Panel.svelte';
+  import Spinner from '@openpalm/ui-kit/components/common/Spinner.svelte';
+  import Panel from '@openpalm/ui-kit/components/common/Panel.svelte';
   import ContainerRow from '$lib/components/admin/containers/ContainerRow.svelte';
   import ContainerDetail from '$lib/components/admin/containers/ContainerDetail.svelte';
   import ContainersEmptyState from '$lib/components/admin/containers/ContainersEmptyState.svelte';
diff --git a/packages/ui/src/lib/components/admin/logs/LogsTab.svelte b/packages/ui/src/lib/components/admin/logs/LogsTab.svelte
index 88099e26d..635491bc0 100644
--- a/packages/ui/src/lib/components/admin/logs/LogsTab.svelte
+++ b/packages/ui/src/lib/components/admin/logs/LogsTab.svelte
@@ -1,8 +1,8 @@
 <script lang="ts">
   import { onMount } from 'svelte';
-  import Spinner from '$lib/components/common/Spinner.svelte';
-  import EmptyState from '$lib/components/common/EmptyState.svelte';
-  import Panel from '$lib/components/common/Panel.svelte';
+  import Spinner from '@openpalm/ui-kit/components/common/Spinner.svelte';
+  import EmptyState from '@openpalm/ui-kit/components/common/EmptyState.svelte';
+  import Panel from '@openpalm/ui-kit/components/common/Panel.svelte';
   import { fetchServiceLogs, fetchAutomationLog } from '$lib/api.js';
 
   interface Props {
diff --git a/packages/ui/src/lib/components/admin/overview/OperationOutput.svelte b/packages/ui/src/lib/components/admin/overview/OperationOutput.svelte
index 11077e8ca..f00e5e8a6 100644
--- a/packages/ui/src/lib/components/admin/overview/OperationOutput.svelte
+++ b/packages/ui/src/lib/components/admin/overview/OperationOutput.svelte
@@ -1,5 +1,5 @@
 <script lang="ts">
-  import IconClose from '$lib/components/icons/IconClose.svelte';
+  import IconClose from '@openpalm/ui-kit/components/icons/IconClose.svelte';
 
   interface Props {
     operationResult: string;
diff --git a/packages/ui/src/lib/components/admin/overview/OverviewTab.svelte b/packages/ui/src/lib/components/admin/overview/OverviewTab.svelte
index 25b74db62..5af1a5757 100644
--- a/packages/ui/src/lib/components/admin/overview/OverviewTab.svelte
+++ b/packages/ui/src/lib/components/admin/overview/OverviewTab.svelte
@@ -7,8 +7,8 @@
   import MetricTile from './MetricTile.svelte';
   import AkmHealthCard from './AkmHealthCard.svelte';
   import ConfigureShortcuts from './ConfigureShortcuts.svelte';
-  import IconTerminal from '$lib/components/icons/IconTerminal.svelte';
-  import IconCloudDownload from '$lib/components/icons/IconCloudDownload.svelte';
+  import IconTerminal from '@openpalm/ui-kit/components/icons/IconTerminal.svelte';
+  import IconCloudDownload from '@openpalm/ui-kit/components/icons/IconCloudDownload.svelte';
 
   interface Props {
     healthLoading: boolean;
diff --git a/packages/ui/src/lib/components/admin/overview/StatusHero.svelte b/packages/ui/src/lib/components/admin/overview/StatusHero.svelte
index b561ae0a4..b9efe7fec 100644
--- a/packages/ui/src/lib/components/admin/overview/StatusHero.svelte
+++ b/packages/ui/src/lib/components/admin/overview/StatusHero.svelte
@@ -1,8 +1,8 @@
 <script lang="ts">
   import type { TabId } from '$lib/components/chrome/TabBar.svelte';
-  import IconAlert from '$lib/components/icons/IconAlert.svelte';
-  import IconDoneCircle from '$lib/components/icons/IconDoneCircle.svelte';
-  import IconInfo from '$lib/components/icons/IconInfo.svelte';
+  import IconAlert from '@openpalm/ui-kit/components/icons/IconAlert.svelte';
+  import IconDoneCircle from '@openpalm/ui-kit/components/icons/IconDoneCircle.svelte';
+  import IconInfo from '@openpalm/ui-kit/components/icons/IconInfo.svelte';
 
   interface Props {
     status: 'ok' | 'warning' | 'unknown';
diff --git a/packages/ui/src/lib/components/admin/secrets/SecretsTab.svelte b/packages/ui/src/lib/components/admin/secrets/SecretsTab.svelte
index 924ceca1f..742796455 100644
--- a/packages/ui/src/lib/components/admin/secrets/SecretsTab.svelte
+++ b/packages/ui/src/lib/components/admin/secrets/SecretsTab.svelte
@@ -1,11 +1,11 @@
 <script lang="ts">
   import { onMount } from 'svelte';
-  import Spinner from '$lib/components/common/Spinner.svelte';
+  import Spinner from '@openpalm/ui-kit/components/common/Spinner.svelte';
   import { fetchSecretFiles, fetchSecretFile, saveSecretFile, deleteSecretFile, type SecretFileInfo } from '$lib/api.js';
   import { formatBytes } from '$lib/format-date.js';
   import { notifications } from '$lib/notifications.svelte.js';
   import { resource } from '$lib/actions.svelte.js';
-  import IconLock from '$lib/components/icons/IconLock.svelte';
+  import IconLock from '@openpalm/ui-kit/components/icons/IconLock.svelte';
 
   // The file list loads through a resource; its inline banner renders the error.
   const filesRes = resource<SecretFileInfo[]>(
diff --git a/packages/ui/src/lib/components/admin/updates/RecoveryTab.svelte b/packages/ui/src/lib/components/admin/updates/RecoveryTab.svelte
index 75c19c848..0357c8419 100644
--- a/packages/ui/src/lib/components/admin/updates/RecoveryTab.svelte
+++ b/packages/ui/src/lib/components/admin/updates/RecoveryTab.svelte
@@ -10,7 +10,7 @@
     clearInstallLock,
     type InstallLockStatusView,
   } from '$lib/api.js';
-  import Spinner from '$lib/components/common/Spinner.svelte';
+  import Spinner from '@openpalm/ui-kit/components/common/Spinner.svelte';
   import { formatBytes, formatDate } from '$lib/format-date.js';
   import { resource, runAction, type ActionHandle } from '$lib/actions.svelte.js';
 
diff --git a/packages/ui/src/lib/components/admin/updates/UpdatesTab.svelte b/packages/ui/src/lib/components/admin/updates/UpdatesTab.svelte
index a820b50c0..92293b834 100644
--- a/packages/ui/src/lib/components/admin/updates/UpdatesTab.svelte
+++ b/packages/ui/src/lib/components/admin/updates/UpdatesTab.svelte
@@ -1,6 +1,6 @@
 <script lang="ts">
   import { onMount } from 'svelte';
-  import Spinner from '$lib/components/common/Spinner.svelte';
+  import Spinner from '@openpalm/ui-kit/components/common/Spinner.svelte';
   import {
     fetchVersions,
     patchVersions,
diff --git a/packages/ui/src/lib/components/akm/AgentProfilesSection.svelte b/packages/ui/src/lib/components/akm/AgentProfilesSection.svelte
index 74780d58d..e55f69e73 100644
--- a/packages/ui/src/lib/components/akm/AgentProfilesSection.svelte
+++ b/packages/ui/src/lib/components/akm/AgentProfilesSection.svelte
@@ -1,7 +1,7 @@
 <script lang="ts">
 	import ProfileRow from './ProfileRow.svelte';
 	import type { AgentProfile } from './profile-types';
-	import IconAgent from '$lib/components/icons/IconAgent.svelte';
+	import IconAgent from '@openpalm/ui-kit/components/icons/IconAgent.svelte';
 
 	// Presentation-only list of agent-runner profiles. Parent owns array +
 	// default-name via $bindable; this raises edit/add/remove. Each row gets a
diff --git a/packages/ui/src/lib/components/akm/AkmKnowledgeStatsSection.svelte b/packages/ui/src/lib/components/akm/AkmKnowledgeStatsSection.svelte
index 13e3ae154..ad1ad5fd4 100644
--- a/packages/ui/src/lib/components/akm/AkmKnowledgeStatsSection.svelte
+++ b/packages/ui/src/lib/components/akm/AkmKnowledgeStatsSection.svelte
@@ -2,7 +2,7 @@
 	import { onMount } from 'svelte';
 	import { fetchAkmKnowledgeStats, type AkmKnowledgeStats } from '$lib/api.js';
 	import { formatDate } from '$lib/format-date.js';
-	import Spinner from '$lib/components/common/Spinner.svelte';
+	import Spinner from '@openpalm/ui-kit/components/common/Spinner.svelte';
 
 	type Props = {
 		disabled: boolean;
diff --git a/packages/ui/src/lib/components/akm/AkmTab.svelte b/packages/ui/src/lib/components/akm/AkmTab.svelte
index babd2165c..97027599f 100644
--- a/packages/ui/src/lib/components/akm/AkmTab.svelte
+++ b/packages/ui/src/lib/components/akm/AkmTab.svelte
@@ -9,7 +9,7 @@
 	} from '$lib/api.js';
 	import { hasCapability } from '$lib/runtime-context.svelte.js';
 	import { notifications } from '$lib/notifications.svelte.js';
-	import Spinner from '$lib/components/common/Spinner.svelte';
+	import Spinner from '@openpalm/ui-kit/components/common/Spinner.svelte';
 	import AkmKnowledgeStatsSection from '$lib/components/akm/AkmKnowledgeStatsSection.svelte';
 	import EmbeddingSection from '$lib/components/akm/EmbeddingSection.svelte';
 	import BehaviorSection from '$lib/components/akm/BehaviorSection.svelte';
diff --git a/packages/ui/src/lib/components/akm/EmbeddingSection.svelte b/packages/ui/src/lib/components/akm/EmbeddingSection.svelte
index efe981859..4a5e25c59 100644
--- a/packages/ui/src/lib/components/akm/EmbeddingSection.svelte
+++ b/packages/ui/src/lib/components/akm/EmbeddingSection.svelte
@@ -1,6 +1,6 @@
 <script lang="ts">
-  import PasswordInput from '$lib/components/common/PasswordInput.svelte';
-  import Spinner from '$lib/components/common/Spinner.svelte';
+  import PasswordInput from '@openpalm/ui-kit/components/common/PasswordInput.svelte';
+  import Spinner from '@openpalm/ui-kit/components/common/Spinner.svelte';
 
   // Embedding / semantic-search connection. All fields are bound back to the
   // parent's state (which load()/save() own) — this component is presentation
diff --git a/packages/ui/src/lib/components/akm/HostSharingSection.svelte b/packages/ui/src/lib/components/akm/HostSharingSection.svelte
index 15149f65c..16f605618 100644
--- a/packages/ui/src/lib/components/akm/HostSharingSection.svelte
+++ b/packages/ui/src/lib/components/akm/HostSharingSection.svelte
@@ -7,7 +7,7 @@
     type HostAkmSharing,
   } from '$lib/api.js';
   import { notifications } from '$lib/notifications.svelte.js';
-  import Spinner from '$lib/components/common/Spinner.svelte';
+  import Spinner from '@openpalm/ui-kit/components/common/Spinner.svelte';
 
   let hostSharing = $state<HostAkmSharing | null>(null);
   let loading = $state(true);
diff --git a/packages/ui/src/lib/components/akm/ImproveProfilesSection.svelte b/packages/ui/src/lib/components/akm/ImproveProfilesSection.svelte
index e12854aec..e76dd1ffb 100644
--- a/packages/ui/src/lib/components/akm/ImproveProfilesSection.svelte
+++ b/packages/ui/src/lib/components/akm/ImproveProfilesSection.svelte
@@ -1,7 +1,7 @@
 <script lang="ts">
 	import ProfileRow from './ProfileRow.svelte';
 	import type { ImproveProfile } from './profile-types';
-	import IconFlame from '$lib/components/icons/IconFlame.svelte';
+	import IconFlame from '@openpalm/ui-kit/components/icons/IconFlame.svelte';
 
 	// Presentation-only list of memory-maintenance (improve) profiles. Parent owns
 	// array + default-name via $bindable; this raises edit/add/remove. Each row
diff --git a/packages/ui/src/lib/components/akm/LlmProfileDrawer.svelte b/packages/ui/src/lib/components/akm/LlmProfileDrawer.svelte
index c597dcfe2..e578f106e 100644
--- a/packages/ui/src/lib/components/akm/LlmProfileDrawer.svelte
+++ b/packages/ui/src/lib/components/akm/LlmProfileDrawer.svelte
@@ -1,5 +1,5 @@
 <script lang="ts">
-	import PasswordInput from '$lib/components/common/PasswordInput.svelte';
+	import PasswordInput from '@openpalm/ui-kit/components/common/PasswordInput.svelte';
 	import type { LlmProfile } from './profile-types';
 
 	// Slide-in editor for one LLM profile. The parent (AkmTab) owns the draft
diff --git a/packages/ui/src/lib/components/akm/LlmProfilesSection.svelte b/packages/ui/src/lib/components/akm/LlmProfilesSection.svelte
index d0d3b5735..c047bed2d 100644
--- a/packages/ui/src/lib/components/akm/LlmProfilesSection.svelte
+++ b/packages/ui/src/lib/components/akm/LlmProfilesSection.svelte
@@ -1,7 +1,7 @@
 <script lang="ts">
 	import ProfileRow from './ProfileRow.svelte';
 	import type { LlmProfile } from './profile-types';
-	import IconDatabase from '$lib/components/icons/IconDatabase.svelte';
+	import IconDatabase from '@openpalm/ui-kit/components/icons/IconDatabase.svelte';
 
 	// Presentation-only list of LLM profiles. The parent (AkmTab) owns the array
 	// and default-name state via $bindable; this component renders the rows and
diff --git a/packages/ui/src/lib/components/chat/ChatInput.svelte b/packages/ui/src/lib/components/chat/ChatInput.svelte
index b4ca2414c..6f58790ec 100644
--- a/packages/ui/src/lib/components/chat/ChatInput.svelte
+++ b/packages/ui/src/lib/components/chat/ChatInput.svelte
@@ -1,6 +1,6 @@
 <script lang="ts">
-  import IconMic from '$lib/components/icons/IconMic.svelte';
-  import IconSend from '$lib/components/icons/IconSend.svelte';
+  import IconMic from '@openpalm/ui-kit/components/icons/IconMic.svelte';
+  import IconSend from '@openpalm/ui-kit/components/icons/IconSend.svelte';
 
   interface Props {
     sending: boolean;
diff --git a/packages/ui/src/lib/components/chat/EndpointSwitcher.svelte b/packages/ui/src/lib/components/chat/EndpointSwitcher.svelte
index 8a896577c..1af0ad685 100644
--- a/packages/ui/src/lib/components/chat/EndpointSwitcher.svelte
+++ b/packages/ui/src/lib/components/chat/EndpointSwitcher.svelte
@@ -1,9 +1,9 @@
 <script lang="ts">
   import { onMount } from 'svelte';
   import { endpointsService } from '$lib/endpoints-state.svelte.js';
-  import Drawer from '$lib/components/common/Drawer.svelte';
+  import Drawer from '@openpalm/ui-kit/components/common/Drawer.svelte';
   import EndpointList from '$lib/components/chat/EndpointList.svelte';
-  import IconServer from '$lib/components/icons/IconServer.svelte';
+  import IconServer from '@openpalm/ui-kit/components/icons/IconServer.svelte';
 
   // Navbar trigger that opens the assistant-endpoint chooser in a drawer.
   // The list body itself lives in EndpointList, shared with the chat side panel.
diff --git a/packages/ui/src/lib/components/chat/NewChatButton.svelte b/packages/ui/src/lib/components/chat/NewChatButton.svelte
index 4aa7a07e7..20146f312 100644
--- a/packages/ui/src/lib/components/chat/NewChatButton.svelte
+++ b/packages/ui/src/lib/components/chat/NewChatButton.svelte
@@ -2,8 +2,8 @@
   import { page } from '$app/state';
   import { goto } from '$app/navigation';
   import { chat } from '$lib/chat/chat-state.svelte.js';
-  import IconButton from '$lib/components/common/IconButton.svelte';
-  import IconAdd from '$lib/components/icons/IconAdd.svelte';
+  import IconButton from '@openpalm/ui-kit/components/common/IconButton.svelte';
+  import IconAdd from '@openpalm/ui-kit/components/icons/IconAdd.svelte';
 
   // Global "new chat" action (lives in the navbar next to the session picker).
   // On the chat page it starts a fresh session in place; from anywhere else
diff --git a/packages/ui/src/lib/components/chat/SessionList.svelte b/packages/ui/src/lib/components/chat/SessionList.svelte
index be7d90615..576bba6f3 100644
--- a/packages/ui/src/lib/components/chat/SessionList.svelte
+++ b/packages/ui/src/lib/components/chat/SessionList.svelte
@@ -1,5 +1,5 @@
 <script lang="ts">
-  import Spinner from '$lib/components/common/Spinner.svelte';
+  import Spinner from '@openpalm/ui-kit/components/common/Spinner.svelte';
   import SessionTitle from '$lib/components/chat/SessionTitle.svelte';
   import { chat } from '$lib/chat/chat-state.svelte.js';
   import { endpointsService } from '$lib/endpoints-state.svelte.js';
diff --git a/packages/ui/src/lib/components/chat/SessionPicker.svelte b/packages/ui/src/lib/components/chat/SessionPicker.svelte
index 18d831229..c23338ff5 100644
--- a/packages/ui/src/lib/components/chat/SessionPicker.svelte
+++ b/packages/ui/src/lib/components/chat/SessionPicker.svelte
@@ -1,10 +1,10 @@
 <script lang="ts">
   import { chat } from '$lib/chat/chat-state.svelte.js';
   import { endpointsService } from '$lib/endpoints-state.svelte.js';
-  import Drawer from '$lib/components/common/Drawer.svelte';
+  import Drawer from '@openpalm/ui-kit/components/common/Drawer.svelte';
   import SessionList from '$lib/components/chat/SessionList.svelte';
   import { resolveSessionTitle } from '$lib/session-title.js';
-  import IconConversations from '$lib/components/icons/IconConversations.svelte';
+  import IconConversations from '@openpalm/ui-kit/components/icons/IconConversations.svelte';
 
   // Navbar trigger that opens the session chooser in a drawer. The list body
   // lives in SessionList, shared with the chat side panel.
diff --git a/packages/ui/src/lib/components/chat/ToolLog.svelte b/packages/ui/src/lib/components/chat/ToolLog.svelte
index 21195eb8d..65240e167 100644
--- a/packages/ui/src/lib/components/chat/ToolLog.svelte
+++ b/packages/ui/src/lib/components/chat/ToolLog.svelte
@@ -15,17 +15,17 @@
     toolStatusLabel,
     toolDetailRows,
   } from '$lib/chat/tool-strip.js';
-  import IconAlert from '$lib/components/icons/IconAlert.svelte';
-  import IconRefresh from '$lib/components/icons/IconRefresh.svelte';
-  import IconDoneCircle from '$lib/components/icons/IconDoneCircle.svelte';
-  import IconTerminal from '$lib/components/icons/IconTerminal.svelte';
-  import IconSearch from '$lib/components/icons/IconSearch.svelte';
-  import IconFile from '$lib/components/icons/IconFile.svelte';
-  import IconEdit from '$lib/components/icons/IconEdit.svelte';
-  import IconLink from '$lib/components/icons/IconLink.svelte';
-  import IconAgent from '$lib/components/icons/IconAgent.svelte';
-  import IconDone from '$lib/components/icons/IconDone.svelte';
-  import IconClock from '$lib/components/icons/IconClock.svelte';
+  import IconAlert from '@openpalm/ui-kit/components/icons/IconAlert.svelte';
+  import IconRefresh from '@openpalm/ui-kit/components/icons/IconRefresh.svelte';
+  import IconDoneCircle from '@openpalm/ui-kit/components/icons/IconDoneCircle.svelte';
+  import IconTerminal from '@openpalm/ui-kit/components/icons/IconTerminal.svelte';
+  import IconSearch from '@openpalm/ui-kit/components/icons/IconSearch.svelte';
+  import IconFile from '@openpalm/ui-kit/components/icons/IconFile.svelte';
+  import IconEdit from '@openpalm/ui-kit/components/icons/IconEdit.svelte';
+  import IconLink from '@openpalm/ui-kit/components/icons/IconLink.svelte';
+  import IconAgent from '@openpalm/ui-kit/components/icons/IconAgent.svelte';
+  import IconDone from '@openpalm/ui-kit/components/icons/IconDone.svelte';
+  import IconClock from '@openpalm/ui-kit/components/icons/IconClock.svelte';
 
   interface Props {
     items: ToolStripEntry[];
diff --git a/packages/ui/src/lib/components/chat/ToolStrip.svelte b/packages/ui/src/lib/components/chat/ToolStrip.svelte
index 7c34aa14c..4f2b44b57 100644
--- a/packages/ui/src/lib/components/chat/ToolStrip.svelte
+++ b/packages/ui/src/lib/components/chat/ToolStrip.svelte
@@ -8,18 +8,18 @@
     toolDetailRows,
   } from '$lib/chat/tool-strip.js';
   import { createFocusTrap, handleTrapKeydown } from '$lib/actions/focus-trap.js';
-  import IconClose from '$lib/components/icons/IconClose.svelte';
-  import IconAlert from '$lib/components/icons/IconAlert.svelte';
-  import IconRefresh from '$lib/components/icons/IconRefresh.svelte';
-  import IconDoneCircle from '$lib/components/icons/IconDoneCircle.svelte';
-  import IconTerminal from '$lib/components/icons/IconTerminal.svelte';
-  import IconSearch from '$lib/components/icons/IconSearch.svelte';
-  import IconFile from '$lib/components/icons/IconFile.svelte';
-  import IconEdit from '$lib/components/icons/IconEdit.svelte';
-  import IconLink from '$lib/components/icons/IconLink.svelte';
-  import IconAgent from '$lib/components/icons/IconAgent.svelte';
-  import IconDone from '$lib/components/icons/IconDone.svelte';
-  import IconClock from '$lib/components/icons/IconClock.svelte';
+  import IconClose from '@openpalm/ui-kit/components/icons/IconClose.svelte';
+  import IconAlert from '@openpalm/ui-kit/components/icons/IconAlert.svelte';
+  import IconRefresh from '@openpalm/ui-kit/components/icons/IconRefresh.svelte';
+  import IconDoneCircle from '@openpalm/ui-kit/components/icons/IconDoneCircle.svelte';
+  import IconTerminal from '@openpalm/ui-kit/components/icons/IconTerminal.svelte';
+  import IconSearch from '@openpalm/ui-kit/components/icons/IconSearch.svelte';
+  import IconFile from '@openpalm/ui-kit/components/icons/IconFile.svelte';
+  import IconEdit from '@openpalm/ui-kit/components/icons/IconEdit.svelte';
+  import IconLink from '@openpalm/ui-kit/components/icons/IconLink.svelte';
+  import IconAgent from '@openpalm/ui-kit/components/icons/IconAgent.svelte';
+  import IconDone from '@openpalm/ui-kit/components/icons/IconDone.svelte';
+  import IconClock from '@openpalm/ui-kit/components/icons/IconClock.svelte';
 
   interface Props {
     items: ToolStripEntry[];
diff --git a/packages/ui/src/lib/components/chat/VoiceControl.svelte b/packages/ui/src/lib/components/chat/VoiceControl.svelte
index fe3566a4f..4940ff6bd 100644
--- a/packages/ui/src/lib/components/chat/VoiceControl.svelte
+++ b/packages/ui/src/lib/components/chat/VoiceControl.svelte
@@ -10,11 +10,11 @@
 		setTtsAutoEnabled,
 		resumeAutoplay,
 	} from '$lib/voice/voice-state.svelte.js';
-	import IconMic from '$lib/components/icons/IconMic.svelte';
-	import IconMicOff from '$lib/components/icons/IconMicOff.svelte';
-	import IconSoundOff from '$lib/components/icons/IconSoundOff.svelte';
-	import IconSoundOn from '$lib/components/icons/IconSoundOn.svelte';
-	import IconStop from '$lib/components/icons/IconStop.svelte';
+	import IconMic from '@openpalm/ui-kit/components/icons/IconMic.svelte';
+	import IconMicOff from '@openpalm/ui-kit/components/icons/IconMicOff.svelte';
+	import IconSoundOff from '@openpalm/ui-kit/components/icons/IconSoundOff.svelte';
+	import IconSoundOn from '@openpalm/ui-kit/components/icons/IconSoundOn.svelte';
+	import IconStop from '@openpalm/ui-kit/components/icons/IconStop.svelte';
 
 	const MAX_INTERIM_CHARS = 48;
 	import { chat } from '$lib/chat/chat-state.svelte.js';
diff --git a/packages/ui/src/lib/components/chrome/ModeSwitch.svelte b/packages/ui/src/lib/components/chrome/ModeSwitch.svelte
index 37bcb7219..b70ed25f3 100644
--- a/packages/ui/src/lib/components/chrome/ModeSwitch.svelte
+++ b/packages/ui/src/lib/components/chrome/ModeSwitch.svelte
@@ -1,11 +1,11 @@
 <script lang="ts">
   import { page } from '$app/state';
   import { goto } from '$app/navigation';
-  import ToggleButton from '$lib/components/common/ToggleButton.svelte';
+  import ToggleButton from '@openpalm/ui-kit/components/common/ToggleButton.svelte';
   import { advancedModeService } from '$lib/advanced-mode-state.svelte.js';
   import { buildAdvancedPath, buildChatPath, currentChatSessionId } from '$lib/chat/navigation.js';
   import { chat } from '$lib/chat/chat-state.svelte.js';
-  import IconAdvanced from '$lib/components/icons/IconAdvanced.svelte';
+  import IconAdvanced from '@openpalm/ui-kit/components/icons/IconAdvanced.svelte';
 
   // Single "Advanced" toggle for the chat surface: off on /chat, on
   // (selected) on /advanced. Clicking flips between the two. Rendering through
diff --git a/packages/ui/src/lib/components/chrome/Navbar.svelte b/packages/ui/src/lib/components/chrome/Navbar.svelte
index ba415afae..cfd41afdb 100644
--- a/packages/ui/src/lib/components/chrome/Navbar.svelte
+++ b/packages/ui/src/lib/components/chrome/Navbar.svelte
@@ -1,12 +1,12 @@
 <script lang="ts">
   import type { Snippet } from 'svelte';
   import { page } from '$app/state';
-  import IconButton from '$lib/components/common/IconButton.svelte';
-  import ThemeToggle from '$lib/components/common/ThemeToggle.svelte';
+  import IconButton from '@openpalm/ui-kit/components/common/IconButton.svelte';
+  import ThemeToggle from '@openpalm/ui-kit/components/common/ThemeToggle.svelte';
   import { hasCapability, runtimeContext } from '$lib/runtime-context.svelte.js';
-  import IconChat from '$lib/components/icons/IconChat.svelte';
-  import IconLogo from '$lib/components/icons/IconLogo.svelte';
-  import IconSettings from '$lib/components/icons/IconSettings.svelte';
+  import IconChat from '@openpalm/ui-kit/components/icons/IconChat.svelte';
+  import IconLogo from '@openpalm/ui-kit/components/icons/IconLogo.svelte';
+  import IconSettings from '@openpalm/ui-kit/components/icons/IconSettings.svelte';
 
   // Top chrome SHELL: brand, the chat↔host utility button, and the theme
   // toggle. Deliberately free of chat components and chat stores (plan
diff --git a/packages/ui/src/lib/components/chrome/SettingsDrawer.svelte b/packages/ui/src/lib/components/chrome/SettingsDrawer.svelte
index 6e5211137..28f5f45c7 100644
--- a/packages/ui/src/lib/components/chrome/SettingsDrawer.svelte
+++ b/packages/ui/src/lib/components/chrome/SettingsDrawer.svelte
@@ -2,10 +2,10 @@
   import type { ThemePreference } from '$lib/theme-state.svelte.js';
   import { afterNavigate } from '$app/navigation';
   import { resolve } from '$app/paths';
-  import Drawer from '$lib/components/common/Drawer.svelte';
-  import IconButton from '$lib/components/common/IconButton.svelte';
+  import Drawer from '@openpalm/ui-kit/components/common/Drawer.svelte';
+  import IconButton from '@openpalm/ui-kit/components/common/IconButton.svelte';
   import { themeService } from '$lib/theme-state.svelte.js';
-  import IconSettings from '$lib/components/icons/IconSettings.svelte';
+  import IconSettings from '@openpalm/ui-kit/components/icons/IconSettings.svelte';
 
   interface Props {
     showManageAssistant?: boolean;
diff --git a/packages/ui/src/lib/components/chrome/TabBar.svelte b/packages/ui/src/lib/components/chrome/TabBar.svelte
index 5a536b5a0..c8b0b74e4 100644
--- a/packages/ui/src/lib/components/chrome/TabBar.svelte
+++ b/packages/ui/src/lib/components/chrome/TabBar.svelte
@@ -1,19 +1,19 @@
 <script lang="ts">
 	import type { Component } from 'svelte';
-	import IconOverview from '$lib/components/icons/IconOverview.svelte';
-	import IconServer from '$lib/components/icons/IconServer.svelte';
-	import IconJournal from '$lib/components/icons/IconJournal.svelte';
-	import IconLink from '$lib/components/icons/IconLink.svelte';
-	import IconMemory from '$lib/components/icons/IconMemory.svelte';
-	import IconAgent from '$lib/components/icons/IconAgent.svelte';
-	import IconSharing from '$lib/components/icons/IconSharing.svelte';
-	import IconActivity from '$lib/components/icons/IconActivity.svelte';
-	import IconMic from '$lib/components/icons/IconMic.svelte';
-	import IconAddons from '$lib/components/icons/IconAddons.svelte';
-	import IconAutomations from '$lib/components/icons/IconAutomations.svelte';
-	import IconLock from '$lib/components/icons/IconLock.svelte';
-	import IconCloudDownload from '$lib/components/icons/IconCloudDownload.svelte';
-	import IconHome from '$lib/components/icons/IconHome.svelte';
+	import IconOverview from '@openpalm/ui-kit/components/icons/IconOverview.svelte';
+	import IconServer from '@openpalm/ui-kit/components/icons/IconServer.svelte';
+	import IconJournal from '@openpalm/ui-kit/components/icons/IconJournal.svelte';
+	import IconLink from '@openpalm/ui-kit/components/icons/IconLink.svelte';
+	import IconMemory from '@openpalm/ui-kit/components/icons/IconMemory.svelte';
+	import IconAgent from '@openpalm/ui-kit/components/icons/IconAgent.svelte';
+	import IconSharing from '@openpalm/ui-kit/components/icons/IconSharing.svelte';
+	import IconActivity from '@openpalm/ui-kit/components/icons/IconActivity.svelte';
+	import IconMic from '@openpalm/ui-kit/components/icons/IconMic.svelte';
+	import IconAddons from '@openpalm/ui-kit/components/icons/IconAddons.svelte';
+	import IconAutomations from '@openpalm/ui-kit/components/icons/IconAutomations.svelte';
+	import IconLock from '@openpalm/ui-kit/components/icons/IconLock.svelte';
+	import IconCloudDownload from '@openpalm/ui-kit/components/icons/IconCloudDownload.svelte';
+	import IconHome from '@openpalm/ui-kit/components/icons/IconHome.svelte';
 
 	export type TabId =
 		| 'overview'
diff --git a/packages/ui/src/lib/components/providers/AddProviderSheet.svelte b/packages/ui/src/lib/components/providers/AddProviderSheet.svelte
index 22901d0fe..9eaf2770c 100644
--- a/packages/ui/src/lib/components/providers/AddProviderSheet.svelte
+++ b/packages/ui/src/lib/components/providers/AddProviderSheet.svelte
@@ -6,7 +6,7 @@
 -->
 <script lang="ts">
 	import type { ProviderView } from '$lib/types/providers.js';
-	import Drawer from '$lib/components/common/Drawer.svelte';
+	import Drawer from '@openpalm/ui-kit/components/common/Drawer.svelte';
 
 	let {
 		providers,
diff --git a/packages/ui/src/lib/components/providers/ConnectSheet.svelte b/packages/ui/src/lib/components/providers/ConnectSheet.svelte
index 7b937edca..d738f7b06 100644
--- a/packages/ui/src/lib/components/providers/ConnectSheet.svelte
+++ b/packages/ui/src/lib/components/providers/ConnectSheet.svelte
@@ -14,9 +14,9 @@
 -->
 <script lang="ts">
 	import { onDestroy } from 'svelte';
-	import Spinner from '$lib/components/common/Spinner.svelte';
-	import FormField from '$lib/components/common/FormField.svelte';
-	import Drawer from '$lib/components/common/Drawer.svelte';
+	import Spinner from '@openpalm/ui-kit/components/common/Spinner.svelte';
+	import FormField from '@openpalm/ui-kit/components/common/FormField.svelte';
+	import Drawer from '@openpalm/ui-kit/components/common/Drawer.svelte';
 	import {
 		startProviderOauth,
 		oauthCallback,
diff --git a/packages/ui/src/lib/components/providers/CustomProviderForm.svelte b/packages/ui/src/lib/components/providers/CustomProviderForm.svelte
index 64390bfd7..c6b9eeb51 100644
--- a/packages/ui/src/lib/components/providers/CustomProviderForm.svelte
+++ b/packages/ui/src/lib/components/providers/CustomProviderForm.svelte
@@ -4,9 +4,9 @@
   Models auto-discovered on first connection.
 -->
 <script lang="ts">
-	import Spinner from '$lib/components/common/Spinner.svelte';
-	import FormField from '$lib/components/common/FormField.svelte';
-	import Drawer from '$lib/components/common/Drawer.svelte';
+	import Spinner from '@openpalm/ui-kit/components/common/Spinner.svelte';
+	import FormField from '@openpalm/ui-kit/components/common/FormField.svelte';
+	import Drawer from '@openpalm/ui-kit/components/common/Drawer.svelte';
 	import { registerCustomProvider } from '$lib/api/providers.js';
 	import { toMessage } from '$lib/api/errors.js';
 	import type { ProviderActionResult } from '$lib/types/providers.js';
diff --git a/packages/ui/src/lib/components/providers/HostImportModal.svelte b/packages/ui/src/lib/components/providers/HostImportModal.svelte
index 2d1bc73d0..ac8da65fa 100644
--- a/packages/ui/src/lib/components/providers/HostImportModal.svelte
+++ b/packages/ui/src/lib/components/providers/HostImportModal.svelte
@@ -3,8 +3,8 @@
   POST /admin/providers/import-host on confirm.
 -->
 <script lang="ts">
-	import Spinner from '$lib/components/common/Spinner.svelte';
-	import Drawer from '$lib/components/common/Drawer.svelte';
+	import Spinner from '@openpalm/ui-kit/components/common/Spinner.svelte';
+	import Drawer from '@openpalm/ui-kit/components/common/Drawer.svelte';
 	import { importHostProviders, type HostImportResult } from '$lib/api/providers.js';
 	import { toMessage } from '$lib/api/errors.js';
 
diff --git a/packages/ui/src/lib/components/providers/ProvidersPanel.svelte b/packages/ui/src/lib/components/providers/ProvidersPanel.svelte
index 87ebb67c7..a897127df 100644
--- a/packages/ui/src/lib/components/providers/ProvidersPanel.svelte
+++ b/packages/ui/src/lib/components/providers/ProvidersPanel.svelte
@@ -7,8 +7,8 @@
 -->
 <script lang="ts">
 	import { onMount } from 'svelte';
-	import Spinner from '$lib/components/common/Spinner.svelte';
-	import EmptyState from '$lib/components/common/EmptyState.svelte';
+	import Spinner from '@openpalm/ui-kit/components/common/Spinner.svelte';
+	import EmptyState from '@openpalm/ui-kit/components/common/EmptyState.svelte';
 	import {
 		fetchProviders,
 		fetchAssistantCliTools,
@@ -23,8 +23,8 @@
 	import type { AssistantCliToolStatus, ProviderPageState, ProviderView } from '$lib/types/providers.js';
 	import AddProviderSheet from './AddProviderSheet.svelte';
 	import ConnectSheet from './ConnectSheet.svelte';
-	import IconServer from '$lib/components/icons/IconServer.svelte';
-	import IconLock from '$lib/components/icons/IconLock.svelte';
+	import IconServer from '@openpalm/ui-kit/components/icons/IconServer.svelte';
+	import IconLock from '@openpalm/ui-kit/components/icons/IconLock.svelte';
 	import CustomProviderForm from './CustomProviderForm.svelte';
 	import HostImportModal from './HostImportModal.svelte';
 
diff --git a/packages/ui/src/lib/components/voice/VoiceTab.svelte b/packages/ui/src/lib/components/voice/VoiceTab.svelte
index 829cd46d2..4b27fb461 100644
--- a/packages/ui/src/lib/components/voice/VoiceTab.svelte
+++ b/packages/ui/src/lib/components/voice/VoiceTab.svelte
@@ -19,7 +19,7 @@
 		setTtsAutoEnabled,
 		speakText,
 	} from '$lib/voice/voice-state.svelte.js';
-	import Spinner from '$lib/components/common/Spinner.svelte';
+	import Spinner from '@openpalm/ui-kit/components/common/Spinner.svelte';
 	import VoiceAddonProfileSection from '$lib/components/voice/VoiceAddonProfileSection.svelte';
 	import type { TtsOption, SttOption, VoiceEngineConfig } from '$lib/client/types.js';
 	import { pollUntil } from '$lib/poll-until.js';
diff --git a/packages/ui/src/lib/components/voice/VoiceTtsSection.svelte b/packages/ui/src/lib/components/voice/VoiceTtsSection.svelte
index a7dafec9e..01381bdd6 100644
--- a/packages/ui/src/lib/components/voice/VoiceTtsSection.svelte
+++ b/packages/ui/src/lib/components/voice/VoiceTtsSection.svelte
@@ -8,9 +8,9 @@
   parent (read via `value`, mutated via `onchange`).
 -->
 <script lang="ts">
-	import Spinner from '$lib/components/common/Spinner.svelte';
-	import IconDone from '$lib/components/icons/IconDone.svelte';
-	import IconClose from '$lib/components/icons/IconClose.svelte';
+	import Spinner from '@openpalm/ui-kit/components/common/Spinner.svelte';
+	import IconDone from '@openpalm/ui-kit/components/icons/IconDone.svelte';
+	import IconClose from '@openpalm/ui-kit/components/icons/IconClose.svelte';
 	import VoiceEngineSelector from '$lib/components/voice/VoiceEngineSelector.svelte';
 	import type {
 		TtsOption,
diff --git a/packages/ui/src/routes/+layout.svelte b/packages/ui/src/routes/+layout.svelte
index 6ef99154d..12c03e5cd 100644
--- a/packages/ui/src/routes/+layout.svelte
+++ b/packages/ui/src/routes/+layout.svelte
@@ -1,8 +1,8 @@
 <script lang="ts">
   import { onMount } from 'svelte';
   import "../app.css";
-  import UpdateBanner from '$lib/components/common/UpdateBanner.svelte';
-  import Toast from '$lib/components/common/Toast.svelte';
+  import UpdateBanner from '@openpalm/ui-kit/components/common/UpdateBanner.svelte';
+  import Toast from '@openpalm/ui-kit/components/common/Toast.svelte';
   import { themeService } from '$lib/theme-state.svelte.js';
   import { detectClientDisplayMode } from '$lib/client-context.js';
   import { initializeRuntimeContext } from '$lib/runtime-context.svelte.js';
diff --git a/packages/ui/src/routes/attention/+page.svelte b/packages/ui/src/routes/attention/+page.svelte
index 505b4b74e..66f1a43f2 100644
--- a/packages/ui/src/routes/attention/+page.svelte
+++ b/packages/ui/src/routes/attention/+page.svelte
@@ -7,7 +7,7 @@
   // migration; sessions that land here with nothing blocking are redirected
   // back to the resolved landing by the hooks.server launch-routing guard.
   import { resolve } from '$app/paths';
-  import IconLogo from '$lib/components/icons/IconLogo.svelte';
+  import IconLogo from '@openpalm/ui-kit/components/icons/IconLogo.svelte';
 </script>
 
 <svelte:head><title>OpenPalm — needs attention</title></svelte:head>
diff --git a/packages/ui/src/routes/chat/+page.svelte b/packages/ui/src/routes/chat/+page.svelte
index 06e716e67..71968663e 100644
--- a/packages/ui/src/routes/chat/+page.svelte
+++ b/packages/ui/src/routes/chat/+page.svelte
@@ -28,15 +28,15 @@
 		stopListening,
 		initVoice
 	} from '$lib/voice/voice-state.svelte.js';
-	import IconSoundOn from '$lib/components/icons/IconSoundOn.svelte';
-	import IconSoundOff from '$lib/components/icons/IconSoundOff.svelte';
-	import IconConversations from '$lib/components/icons/IconConversations.svelte';
-	import IconActivity from '$lib/components/icons/IconActivity.svelte';
-	import IconClose from '$lib/components/icons/IconClose.svelte';
-	import IconThemeSystem from '$lib/components/icons/IconThemeSystem.svelte';
-	import IconThemeLight from '$lib/components/icons/IconThemeLight.svelte';
-	import IconThemeDark from '$lib/components/icons/IconThemeDark.svelte';
-	import IconAdvanced from '$lib/components/icons/IconAdvanced.svelte';
+	import IconSoundOn from '@openpalm/ui-kit/components/icons/IconSoundOn.svelte';
+	import IconSoundOff from '@openpalm/ui-kit/components/icons/IconSoundOff.svelte';
+	import IconConversations from '@openpalm/ui-kit/components/icons/IconConversations.svelte';
+	import IconActivity from '@openpalm/ui-kit/components/icons/IconActivity.svelte';
+	import IconClose from '@openpalm/ui-kit/components/icons/IconClose.svelte';
+	import IconThemeSystem from '@openpalm/ui-kit/components/icons/IconThemeSystem.svelte';
+	import IconThemeLight from '@openpalm/ui-kit/components/icons/IconThemeLight.svelte';
+	import IconThemeDark from '@openpalm/ui-kit/components/icons/IconThemeDark.svelte';
+	import IconAdvanced from '@openpalm/ui-kit/components/icons/IconAdvanced.svelte';
 
 	let scrollAnchorEl = $state<HTMLDivElement | undefined>();
 
diff --git a/packages/ui/src/routes/connections/+page.svelte b/packages/ui/src/routes/connections/+page.svelte
index 274811524..38ab49827 100644
--- a/packages/ui/src/routes/connections/+page.svelte
+++ b/packages/ui/src/routes/connections/+page.svelte
@@ -2,7 +2,7 @@
   import { onMount } from 'svelte';
   import { page } from '$app/state';
   import ChatNavbar from '$lib/components/chrome/ChatNavbar.svelte';
-  import IconLock from '$lib/components/icons/IconLock.svelte';
+  import IconLock from '@openpalm/ui-kit/components/icons/IconLock.svelte';
   import { endpointsService as connectionsService } from '$lib/endpoints-state.svelte.js';
   import {
     createConnection,
diff --git a/packages/ui/src/routes/login/+page.svelte b/packages/ui/src/routes/login/+page.svelte
index 7416392a7..c7db9c728 100644
--- a/packages/ui/src/routes/login/+page.svelte
+++ b/packages/ui/src/routes/login/+page.svelte
@@ -1,6 +1,6 @@
 <script lang="ts">
   import { goto } from '$app/navigation';
-  import AuthGate from '$lib/components/common/AuthGate.svelte';
+  import AuthGate from '@openpalm/ui-kit/components/common/AuthGate.svelte';
   import type { PageData } from './$types';
 
   let { data }: { data: PageData } = $props();
diff --git a/packages/ui/src/routes/setup/+page.svelte b/packages/ui/src/routes/setup/+page.svelte
index 84f099eec..775938615 100644
--- a/packages/ui/src/routes/setup/+page.svelte
+++ b/packages/ui/src/routes/setup/+page.svelte
@@ -8,7 +8,7 @@
   import Screen2ExtrasStep from './steps/Screen2ExtrasStep.svelte';
   import ReviewStep from './steps/ReviewStep.svelte';
   import DeployStep from './steps/DeployStep.svelte';
-  import IconLogo from '$lib/components/icons/IconLogo.svelte';
+  import IconLogo from '@openpalm/ui-kit/components/icons/IconLogo.svelte';
 
   // All wizard state + logic lives in the setup-state store (Svelte 5 runes
   // class), mirroring the store-per-domain pattern (endpoints-state /
diff --git a/packages/ui/src/routes/setup/steps/CloudAttachPanel.svelte b/packages/ui/src/routes/setup/steps/CloudAttachPanel.svelte
index 37ab9d92e..71146b12c 100644
--- a/packages/ui/src/routes/setup/steps/CloudAttachPanel.svelte
+++ b/packages/ui/src/routes/setup/steps/CloudAttachPanel.svelte
@@ -12,7 +12,7 @@
    */
 
   import ProviderOAuthList from './ProviderOAuthList.svelte';
-  import Spinner from '$lib/components/common/Spinner.svelte';
+  import Spinner from '@openpalm/ui-kit/components/common/Spinner.svelte';
   import { setupState } from '$lib/setup/setup-state.svelte.js';
 
   // Takes NO props: reads the setup-state store directly (hostImporting /
diff --git a/packages/ui/src/routes/setup/steps/DeployStep.svelte b/packages/ui/src/routes/setup/steps/DeployStep.svelte
index ff969a9f2..5e00c13a6 100644
--- a/packages/ui/src/routes/setup/steps/DeployStep.svelte
+++ b/packages/ui/src/routes/setup/steps/DeployStep.svelte
@@ -1,7 +1,7 @@
 <script lang="ts">
-  import FriendlyError from '$lib/components/common/FriendlyError.svelte';
+  import FriendlyError from '@openpalm/ui-kit/components/common/FriendlyError.svelte';
   import { friendlyError } from '$lib/client/error-messages.js';
-  import Spinner from '$lib/components/common/Spinner.svelte';
+  import Spinner from '@openpalm/ui-kit/components/common/Spinner.svelte';
   import { resolve } from '$app/paths';
 
   interface ServiceStatus {
diff --git a/packages/ui/src/routes/setup/steps/ModelSummary.svelte b/packages/ui/src/routes/setup/steps/ModelSummary.svelte
index 4e988a757..8b3d7918d 100644
--- a/packages/ui/src/routes/setup/steps/ModelSummary.svelte
+++ b/packages/ui/src/routes/setup/steps/ModelSummary.svelte
@@ -14,7 +14,7 @@
    */
 
   import type { Snippet } from 'svelte';
-  import Drawer from '$lib/components/common/Drawer.svelte';
+  import Drawer from '@openpalm/ui-kit/components/common/Drawer.svelte';
 
   type ModelMode = 'cloud' | 'local' | 'both';
 
diff --git a/packages/ui/src/routes/setup/steps/ProviderOAuthList.svelte b/packages/ui/src/routes/setup/steps/ProviderOAuthList.svelte
index f1e381a7a..3acc13116 100644
--- a/packages/ui/src/routes/setup/steps/ProviderOAuthList.svelte
+++ b/packages/ui/src/routes/setup/steps/ProviderOAuthList.svelte
@@ -12,7 +12,7 @@
 
   import { WIZARD_EXCLUDED_PROVIDERS } from '$lib/client/constants.js';
   import type { ProviderState } from '$lib/client/types.js';
-  import Spinner from '$lib/components/common/Spinner.svelte';
+  import Spinner from '@openpalm/ui-kit/components/common/Spinner.svelte';
   import { setupState } from '$lib/setup/setup-state.svelte.js';
 
   const s = setupState;
diff --git a/packages/ui/src/routes/setup/steps/ReviewStep.svelte b/packages/ui/src/routes/setup/steps/ReviewStep.svelte
index 45a89fdf3..e1e1673b9 100644
--- a/packages/ui/src/routes/setup/steps/ReviewStep.svelte
+++ b/packages/ui/src/routes/setup/steps/ReviewStep.svelte
@@ -1,9 +1,9 @@
 <script lang="ts">
   import { PORTALS, friendlyProviderName } from '$lib/client/constants.js';
-  import IconAgent from '$lib/components/icons/IconAgent.svelte';
-  import IconMic from '$lib/components/icons/IconMic.svelte';
+  import IconAgent from '@openpalm/ui-kit/components/icons/IconAgent.svelte';
+  import IconMic from '@openpalm/ui-kit/components/icons/IconMic.svelte';
   import { isPortalEnabled as _isPortalEnabled } from '$lib/client/helpers.js';
-  import FriendlyError from '$lib/components/common/FriendlyError.svelte';
+  import FriendlyError from '@openpalm/ui-kit/components/common/FriendlyError.svelte';
   import { friendlyError } from '$lib/client/error-messages.js';
   import { setupState } from '$lib/setup/setup-state.svelte.js';
 
diff --git a/packages/ui/src/routes/setup/steps/SystemCheckStep.svelte b/packages/ui/src/routes/setup/steps/SystemCheckStep.svelte
index 21c786cf5..b62eb73c5 100644
--- a/packages/ui/src/routes/setup/steps/SystemCheckStep.svelte
+++ b/packages/ui/src/routes/setup/steps/SystemCheckStep.svelte
@@ -1,10 +1,10 @@
 <script lang="ts">
   import { onMount } from 'svelte';
-  import FriendlyError from '$lib/components/common/FriendlyError.svelte';
-  import IconServer from '$lib/components/icons/IconServer.svelte';
-  import IconConnect from '$lib/components/icons/IconConnect.svelte';
+  import FriendlyError from '@openpalm/ui-kit/components/common/FriendlyError.svelte';
+  import IconServer from '@openpalm/ui-kit/components/icons/IconServer.svelte';
+  import IconConnect from '@openpalm/ui-kit/components/icons/IconConnect.svelte';
   import { friendlyError, type FriendlyErrorView } from '$lib/client/error-messages.js';
-  import Spinner from '$lib/components/common/Spinner.svelte';
+  import Spinner from '@openpalm/ui-kit/components/common/Spinner.svelte';
   import { setupState } from '$lib/setup/setup-state.svelte.js';
 
   interface CheckResult {
diff --git a/packages/ui/vite.config.ts b/packages/ui/vite.config.ts
index 5657e1eae..1ed25d623 100644
--- a/packages/ui/vite.config.ts
+++ b/packages/ui/vite.config.ts
@@ -55,8 +55,10 @@ export default defineConfig(({ mode }) => {
       // to evaluate CJS packages itself. Only `yaml` is force-bundled
       // because the server code does `import { parse } from 'yaml'`
       // directly and yaml@2.x ships pure CJS (Vite's ESM runner can't
-      // evaluate raw `require()` calls).
-      noExternal: mode === "production" ? true : ["yaml"],
+      // evaluate raw `require()` calls). `@openpalm/ui-kit` is raw
+      // .svelte/.ts source (no build step) — Node cannot load it, so it
+      // must always go through Vite's Svelte pipeline.
+      noExternal: mode === "production" ? true : ["yaml", "@openpalm/ui-kit"],
       // SSR-side dep optimizer: esbuild pre-bundles these into ESM so the
       // module runner can evaluate them. Mirrors the client-side
       // optimizeDeps.include below — both lists must include yaml.
@@ -66,6 +68,9 @@ export default defineConfig(({ mode }) => {
     },
     optimizeDeps: {
       include: ["yaml"],
+      // Raw-source Svelte package — esbuild cannot prebundle .svelte files;
+      // vite-plugin-svelte compiles it as part of the app instead.
+      exclude: ["@openpalm/ui-kit"],
     },
     test: {
       expect: { requireAssertions: true },
@@ -79,7 +84,14 @@ export default defineConfig(({ mode }) => {
               provider: playwright(),
               instances: [{ browser: "chromium", name: "chromium", headless: true }]
             },
-            include: ["src/**/*.svelte.vitest.{js,ts}"],
+            // The shared components moved to @openpalm/ui-kit (P5a, #555);
+            // their co-located browser tests still run through THIS project
+            // because ui-kit deliberately has no vitest/browser setup of its
+            // own (raw-source package, compiled by the consuming app).
+            include: [
+              "src/**/*.svelte.vitest.{js,ts}",
+              "../ui-kit/src/**/*.svelte.vitest.{js,ts}"
+            ],
             exclude: ["src/lib/server/**"]
           }
         },

From c7d53abc8c6ef09292ce490cd0c66afe61a2bc11 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Mon, 6 Jul 2026 17:47:17 +0000
Subject: [PATCH 26/61] fix(ui-kit): decouple Toast from voice-state; add
 svelte-check type gate (#555)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Review-gate fixes for P5a:

- Toast.svelte no longer imports $lib/voice/voice-state — that store pulls
  transcribeAudio/fetchVoiceConfig from $lib/api one transitive hop out,
  breaking ui-kit's presentational-only rule (plan §6.11) and blocking P5b
  from compiling Toast without recreating the ui app's voice subsystem.
  The ui app's root layout now mirrors voiceState.errorMessage into the
  notifications queue itself (same replace-in-place semantics), so the
  voice error surface is unchanged while ui-kit stays app-decoupled.
- Extend the no-app-coupling hygiene test to forbid voice-state and any
  voice/ module-dir import so the coupling cannot be reintroduced.
- Add a svelte-check based `check` script + standalone tsconfig to ui-kit:
  the raw-source package has no build step, so this is the ONLY TS
  coverage its ~86 source files get (consuming apps' vite builds strip
  types without checking; packages/ui's check only validates the public
  prop surface at usage sites). Probe-verified: an injected type error
  fails the script. $lib/* resolves types-only against packages/ui's
  implementations of the small app-provided contract (notifications /
  theme-state / focus-trap / error-messages — all import-free modules).
- Wire the new gate into the workspace flow: root `check` runs it after
  ui:check, root `test` now includes packages/ui-kit (hygiene test runs in
  CI), ci.yml gets a "Type check UI kit" step, release.yml runs
  ui-kit:check alongside ui:check.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FetR7BttT1xBrA8fBwhui9
---
 .github/workflows/ci.yml                      |  3 +++
 .github/workflows/release.yml                 |  1 +
 bun.lock                                      |  2 ++
 package.json                                  |  5 ++--
 packages/ui-kit/package.json                  |  4 +++
 .../src/lib/components/common/Toast.svelte    | 27 +++++--------------
 packages/ui-kit/tests/no-app-coupling.test.ts | 14 +++++++++-
 packages/ui-kit/tsconfig.json                 | 25 +++++++++++++++++
 packages/ui/src/routes/+layout.svelte         | 19 +++++++++++++
 9 files changed, 77 insertions(+), 23 deletions(-)
 create mode 100644 packages/ui-kit/tsconfig.json

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index f394dfb4d..c7ddd514a 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -107,6 +107,9 @@ jobs:
       - name: Type check admin UI
         run: cd packages/ui && bun run check
 
+      - name: Type check UI kit
+        run: cd packages/ui-kit && bun run check
+
       - name: Type check CLI
         run: cd packages/cli && bun run typecheck
 
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 6de621436..2b5baca4e 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -255,6 +255,7 @@ jobs:
           bun install --frozen-lockfile
           bun run test
           bun run ui:check
+          bun run ui-kit:check
           bun run --cwd packages/ui test:browsers
           bun run ui:test:unit
           bun run electron:test
diff --git a/bun.lock b/bun.lock
index 2934c3e59..0bc3fdc9d 100644
--- a/bun.lock
+++ b/bun.lock
@@ -128,6 +128,8 @@
       "version": "0.12.52",
       "devDependencies": {
         "svelte": "^5.53.5",
+        "svelte-check": "^4.1.1",
+        "typescript": "^6.0.3",
         "vitest": "^4.0.18",
         "vitest-browser-svelte": "^2.0.2",
       },
diff --git a/package.json b/package.json
index 37a4b0de2..bfd158d14 100644
--- a/package.json
+++ b/package.json
@@ -25,6 +25,7 @@
     "electron:dev": "bun run ui:build && bun run --cwd packages/electron bundle && OP_HOME=/tmp/openpalm-electron-dev OPENPALM_REPO_ROOT=\"$PWD\" bun run --cwd packages/electron start",
     "electron:dev:fast": "bun run --cwd packages/electron bundle && OP_HOME=/tmp/openpalm-electron-dev OPENPALM_REPO_ROOT=\"$PWD\" bun run --cwd packages/electron start",
     "ui:check": "bun run --cwd packages/ui check",
+    "ui-kit:check": "bun run --cwd packages/ui-kit check",
     "ui:test": "cd packages/ui && npm test",
     "ui:test:unit": "cd packages/ui && npm run test:unit -- --run",
     "ui:test:e2e": "source scripts/load-test-env.sh && cd packages/ui && RUN_DOCKER_STACK_TESTS=1 RUN_LLM_TESTS=1 PW_ENFORCE_NO_SKIP=1 npm run test:e2e",
@@ -52,10 +53,10 @@
     "dev:build": "./scripts/dev-setup.sh --seed-env && docker compose --project-name openpalm-dev --project-directory . -f .dev/system/stack/core.compose.yml -f .dev/system/stack/services.compose.yml -f .dev/system/stack/portals.compose.yml -f .dev/config/stack/custom.compose.yml -f compose.dev.yml --env-file .dev/knowledge/env/stack.env up --build -d",
     "_dev:stack:note": "Intentional dev shortcut: 4-file compose list mirrors the CLI overlay discovery for the dev layout — MANAGED core/services/portals from .dev/system/stack/, USER custom from .dev/config/stack/. --project-name openpalm-dev is required to avoid colliding with a production stack under ~/.openpalm/.",
     "electron:test": "bun run --cwd packages/electron test",
-    "test": "bun test --no-orphans portals/discord portals/slack packages/portal-sdk packages/cli packages/lib packages/electron/admin-tools packages/guardian/ scripts/",
+    "test": "bun test --no-orphans portals/discord portals/slack packages/portal-sdk packages/cli packages/lib packages/ui-kit packages/electron/admin-tools packages/guardian/ scripts/",
     "analysis:fta": "npx -y fta-cli . -c .fta.json --json | python3 -c \"import json,sys;d=sorted(json.load(sys.stdin),key=lambda x:x['fta_score'],reverse=True);c={};[c.__setitem__(f['assessment'],c.get(f['assessment'],0)+1) for f in d];s=[f['fta_score'] for f in d];print(f'\\n=== FTA Code Complexity Report ({len(d)} files) ===');print(f'Mean: {sum(s)/len(s):.1f} | Median: {sorted(s)[len(s)//2]:.1f} | Max: {max(s):.1f}');print();[print(f'  {a}: {n}') for a,n in sorted(c.items(),key=lambda x:-x[1])];print(f'\\n=== Top 20 Most Complex Files ===');print(f\\\"{'Score':>7}  {'Cyclo':>5}  {'Lines':>5}  {'Assessment':<20}  File\\\");print('-'*100);[print(f\\\"{f['fta_score']:7.1f}  {f['cyclo']:5d}  {f['line_count']:5d}  {f['assessment']:<20}  {f['file_name']}\\\") for f in d[:20]];ni=[f for f in d if f['fta_score']>60];print(f'\\n=== Needs Improvement ({len(ni)} files) ===');[print(f\\\"  {f['fta_score']:6.1f}  {f['file_name']}\\\") for f in ni]\"",
     "analysis:fta:json": "npx -y fta-cli . -c fta.json --json",
-    "check": "bun run ui:check",
+    "check": "bun run ui:check && bun run ui-kit:check",
     "lint": "biome lint .",
     "lint:fix": "biome lint --write .",
     "format": "biome format --write .",
diff --git a/packages/ui-kit/package.json b/packages/ui-kit/package.json
index 761c256fa..7d8016ced 100644
--- a/packages/ui-kit/package.json
+++ b/packages/ui-kit/package.json
@@ -18,7 +18,9 @@
     },
     "./theme/*": "./src/lib/theme/*"
   },
+  "//check": "svelte-check gives the raw-source files their ONLY TS coverage: the consuming apps' vite builds strip types without checking, and packages/ui's check only validates ui-kit's public prop surface at usage sites. Must stay 0 errors / 0 warnings (--fail-on-warnings enforces both).",
   "scripts": {
+    "check": "svelte-check --tsconfig ./tsconfig.json --fail-on-warnings",
     "test": "bun test"
   },
   "peerDependencies": {
@@ -27,6 +29,8 @@
   "//devDependencies": "svelte/vitest/vitest-browser-svelte back the co-located *.svelte.vitest.ts browser tests, which run through packages/ui's vitest browser project (bun's isolated linker gives each workspace its own node_modules, so the test files' bare imports must resolve from here).",
   "devDependencies": {
     "svelte": "^5.53.5",
+    "svelte-check": "^4.1.1",
+    "typescript": "^6.0.3",
     "vitest": "^4.0.18",
     "vitest-browser-svelte": "^2.0.2"
   }
diff --git a/packages/ui-kit/src/lib/components/common/Toast.svelte b/packages/ui-kit/src/lib/components/common/Toast.svelte
index 9b47fe5d0..86a624f01 100644
--- a/packages/ui-kit/src/lib/components/common/Toast.svelte
+++ b/packages/ui-kit/src/lib/components/common/Toast.svelte
@@ -3,33 +3,20 @@
    * Global toast renderer — bottom-right stack of transient notifications.
    *
    * Mounted once in the root layout. Reads from the `notifications`
-   * singleton ($lib/notifications.svelte.ts); any code can push toasts
-   * without owning a component. Also mirrors `voiceState.errorMessage`
-   * into the queue so the voice control's existing error surface keeps
-   * working without a separate code path.
+   * singleton ($lib/notifications.svelte.ts — an app-provided, client-only
+   * queue with no server assumptions); any code can push toasts without
+   * owning a component. Error surfaces that live outside the queue are
+   * mirrored INTO it by app code (e.g. packages/ui's root layout mirrors
+   * `voiceState.errorMessage`) — never from here: this component must stay
+   * presentational, with no reach into app subsystems that carry server
+   * assumptions (plan ui-runtime-modes-plan.md §6.11).
    */
-  import { afterUpdate } from 'svelte';
-  import { voiceState } from '$lib/voice/voice-state.svelte.js';
   import { notifications, type Toast } from '$lib/notifications.svelte.js';
   import IconDone from '../icons/IconDone.svelte';
   import IconInfo from '../icons/IconInfo.svelte';
 
-  // Track the toast id for the current voice error so consecutive
-  // errors update in place instead of stacking.
-  let voiceErrorToastId: string | null = null;
-
-  afterUpdate(() => {
-    const msg = voiceState.errorMessage;
-    if (!msg) return;
-    voiceErrorToastId = notifications.push('error', msg, {
-      replaceId: voiceErrorToastId ?? undefined,
-    });
-    voiceState.errorMessage = '';
-  });
-
   function dismiss(t: Toast): void {
     notifications.dismiss(t.id);
-    if (t.id === voiceErrorToastId) voiceErrorToastId = null;
   }
 
   function kindLabel(t: Toast): string {
diff --git a/packages/ui-kit/tests/no-app-coupling.test.ts b/packages/ui-kit/tests/no-app-coupling.test.ts
index aefc0a74c..a1f6cf7c6 100644
--- a/packages/ui-kit/tests/no-app-coupling.test.ts
+++ b/packages/ui-kit/tests/no-app-coupling.test.ts
@@ -11,6 +11,10 @@
  *   - chat state (chat-state or anything under a chat/ module dir)
  *   - the connections store (endpoints-state / connections-state /
  *     connection-state, any rename the store has carried)
+ *   - voice state (voice-state or anything under a voice/ module dir —
+ *     the voice subsystem imports transcribeAudio/fetchVoiceConfig from
+ *     $lib/api, so importing it drags the app's API client into ui-kit
+ *     one hop out; review finding on P5a)
  *
  * CHARACTERIZATION NOTE: this test is GREEN before the P5a move lands
  * (src/ is empty, so the scan has nothing to flag). It is written ahead of
@@ -73,11 +77,19 @@ const FORBIDDEN: { name: string; pattern: RegExp }[] = [
   {
     name: 'connections store',
     pattern: /endpoints-state|connections-state|connection-state/
+  },
+  {
+    // The voice subsystem (voice-state, media-recorder, audio-playback)
+    // imports $lib/api — a server assumption one transitive hop away that
+    // the direct-specifier scan above cannot see. Forbid the whole module
+    // dir so the coupling cannot be reintroduced under a rename.
+    name: 'voice state',
+    pattern: /voice-state|(^|\/)voice\//
   }
 ];
 
 describe('ui-kit source has no app coupling (plan §6.11, §8.10)', () => {
-  test('no source file imports $lib/api, $lib/server, @openpalm/lib, chat state, or the connections store', () => {
+  test('no source file imports $lib/api, $lib/server, @openpalm/lib, chat state, the connections store, or voice state', () => {
     const offenders: string[] = [];
     for (const file of sourceFiles()) {
       const source = readFileSync(file, 'utf-8');
diff --git a/packages/ui-kit/tsconfig.json b/packages/ui-kit/tsconfig.json
new file mode 100644
index 000000000..e629b578b
--- /dev/null
+++ b/packages/ui-kit/tsconfig.json
@@ -0,0 +1,25 @@
+{
+	"// purpose": "Type-check config for `bun run check` (svelte-check). ui-kit is a raw-source package with no build step, so this tsconfig is the ONLY thing giving its ~86 source files TS coverage — the consuming apps' vite builds strip types without checking, and packages/ui's svelte-check only validates ui-kit's public prop surface at usage sites (review finding on P5a, #555).",
+	"// paths": "ui-kit source references a small, deliberately app-provided contract via $lib (notifications/theme-state/focus-trap/error-messages — all client-only modules with zero imports of their own). For type-checking we resolve that contract against packages/ui's implementations; every consuming app must supply the same shapes at the same aliases. This is a types-only mapping — no runtime coupling, and the no-app-coupling hygiene test keeps server-assuming modules out of the allowed set.",
+	"compilerOptions": {
+		"target": "esnext",
+		"module": "esnext",
+		"moduleResolution": "bundler",
+		"lib": ["esnext", "DOM", "DOM.Iterable"],
+		"verbatimModuleSyntax": true,
+		"isolatedModules": true,
+		"noEmit": true,
+		"strict": true,
+		"allowJs": true,
+		"checkJs": true,
+		"esModuleInterop": true,
+		"forceConsistentCasingInFileNames": true,
+		"resolveJsonModule": true,
+		"skipLibCheck": true,
+		"paths": {
+			"$lib": ["../ui/src/lib"],
+			"$lib/*": ["../ui/src/lib/*"]
+		}
+	},
+	"include": ["src/**/*.ts", "src/**/*.js", "src/**/*.svelte"]
+}
diff --git a/packages/ui/src/routes/+layout.svelte b/packages/ui/src/routes/+layout.svelte
index 12c03e5cd..790bc7d85 100644
--- a/packages/ui/src/routes/+layout.svelte
+++ b/packages/ui/src/routes/+layout.svelte
@@ -6,6 +6,8 @@
   import { themeService } from '$lib/theme-state.svelte.js';
   import { detectClientDisplayMode } from '$lib/client-context.js';
   import { initializeRuntimeContext } from '$lib/runtime-context.svelte.js';
+  import { notifications } from '$lib/notifications.svelte.js';
+  import { voiceState } from '$lib/voice/voice-state.svelte.js';
 
   interface Props {
     data: import('./$types').LayoutData;
@@ -31,6 +33,23 @@
       displayMode: detectClientDisplayMode(),
     });
   });
+
+  // Mirror voice errors into the toast queue so the voice subsystem's
+  // error surface renders through the single <Toast /> outlet below. This
+  // lives in APP code — not in ui-kit's Toast — because voice-state depends
+  // on $lib/api (POST /api/transcribe), a server assumption ui-kit source
+  // must never carry (plan ui-runtime-modes-plan.md §6.11; enforced by
+  // packages/ui-kit/tests/no-app-coupling.test.ts). Consecutive errors
+  // reuse the same toast id so they update in place instead of stacking.
+  let voiceErrorToastId: string | null = null;
+  $effect(() => {
+    const msg = voiceState.errorMessage;
+    if (!msg) return;
+    voiceErrorToastId = notifications.push('error', msg, {
+      replaceId: voiceErrorToastId ?? undefined,
+    });
+    voiceState.errorMessage = '';
+  });
 </script>
 
 <!-- ibrush filter: hand-drawn brush displacement used by all icon components -->

From 424d091c3bbc1f999873d235024812871f82d186 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Mon, 6 Jul 2026 18:22:07 +0000
Subject: [PATCH 27/61] test(p5b): WIP client test scaffold (interrupted by
 spend limit; resumed by workflow)

Inert packages/client scaffold + partial transport red tests from the
interrupted P5b test author; the resumed run completes them.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FetR7BttT1xBrA8fBwhui9
---
 bun.lock                                      |   6 +
 package.json                                  |   1 +
 packages/client/package.json                  |  16 ++
 packages/client/tests/helpers/contract.ts     | 161 +++++++++++++++
 packages/client/tests/helpers/mocks.ts        |  94 +++++++++
 .../client/tests/transport-health.test.ts     |  95 +++++++++
 .../client/tests/transport-request.test.ts    | 185 ++++++++++++++++++
 packages/client/tests/transport-sse.test.ts   | 105 ++++++++++
 8 files changed, 663 insertions(+)
 create mode 100644 packages/client/package.json
 create mode 100644 packages/client/tests/helpers/contract.ts
 create mode 100644 packages/client/tests/helpers/mocks.ts
 create mode 100644 packages/client/tests/transport-health.test.ts
 create mode 100644 packages/client/tests/transport-request.test.ts
 create mode 100644 packages/client/tests/transport-sse.test.ts

diff --git a/bun.lock b/bun.lock
index 0bc3fdc9d..0d5d0ff9a 100644
--- a/bun.lock
+++ b/bun.lock
@@ -25,6 +25,10 @@
         "typescript": "^6.0.3",
       },
     },
+    "packages/client": {
+      "name": "@openpalm/client",
+      "version": "0.12.52",
+    },
     "packages/electron": {
       "name": "@openpalm/electron",
       "version": "0.12.52",
@@ -293,6 +297,8 @@
 
     "@openpalm/admin-tools-plugin": ["@openpalm/admin-tools-plugin@workspace:packages/electron/admin-tools"],
 
+    "@openpalm/client": ["@openpalm/client@workspace:packages/client"],
+
     "@openpalm/discord-portal": ["@openpalm/discord-portal@workspace:portals/discord"],
 
     "@openpalm/electron": ["@openpalm/electron@workspace:packages/electron"],
diff --git a/package.json b/package.json
index bfd158d14..8e719d06e 100644
--- a/package.json
+++ b/package.json
@@ -8,6 +8,7 @@
     "packages/portal-sdk",
     "packages/ui",
     "packages/ui-kit",
+    "packages/client",
     "packages/skeleton",
     "packages/guardian",
     "packages/cli",
diff --git a/packages/client/package.json b/packages/client/package.json
new file mode 100644
index 000000000..e3a8d5217
--- /dev/null
+++ b/packages/client/package.json
@@ -0,0 +1,16 @@
+{
+  "name": "@openpalm/client",
+  "version": "0.12.52",
+  "description": "OpenPalm client app — the unprivileged chat/connections static PWA (plan ui-runtime-modes-plan.md §6.11). P5b test-first scaffolding: this package currently carries only the red test suite; the SvelteKit app, transport, connection store, and serve script land with the P5b feature commits. §8.10 rule: this package NEVER depends on @openpalm/lib and never holds host credentials; runtime dependencies stay empty or near-empty (document any exception here).",
+  "private": true,
+  "license": "MPL-2.0",
+  "type": "module",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/itlackey/openpalm.git",
+    "directory": "packages/client"
+  },
+  "scripts": {
+    "test": "bun test"
+  }
+}
diff --git a/packages/client/tests/helpers/contract.ts b/packages/client/tests/helpers/contract.ts
new file mode 100644
index 000000000..948dd1cb0
--- /dev/null
+++ b/packages/client/tests/helpers/contract.ts
@@ -0,0 +1,161 @@
+/**
+ * P5b (#555) — test-side contract for the @openpalm/client public surface.
+ *
+ * These types are the tests' statement of the API defined by
+ * docs/technical/ui-runtime-modes-plan.md (§4.3 note, §6.5, §6.6, §6.11) and
+ * the P5b phase spec:
+ *
+ *   - src/lib/transport/index.ts   ONE transport: talk to an OpenCode/guardian
+ *     base URL with optional Basic/Bearer credentials — direct fetch from the
+ *     browser, no proxy, NO COOKIES (`credentials: 'omit'`). Ports the minimal
+ *     chat surface from packages/ui (session list/create, message send, SSE
+ *     stream parsing, health probe) — see packages/ui/src/lib/api/chat.ts,
+ *     packages/ui/src/lib/chat/session-events.ts and the status mapping in
+ *     packages/ui/src/lib/server/endpoints.ts probeEndpoint().
+ *   - src/lib/connections/index.ts ConnectionEntry store (plan §6.6) behind a
+ *     storage abstraction: IndexedDB in the browser, in-memory backend for
+ *     tests. Locked/default entries are seeded from a runtime-config.json
+ *     fetched from the app's own origin at boot (absent file = no default).
+ *   - src/lib/resolve-landing.ts   landing choice for the client app: no
+ *     stored connections -> /connections/new, else /chat (plan §6.5).
+ *
+ * The production modules DO NOT EXIST YET. Every loader below dynamically
+ * imports the module-under-test, so until the P5b implementation lands each
+ * test fails with "Cannot find module …/src/lib/…" — red for the right
+ * reason (missing feature). Once the modules exist the loaders bind to the
+ * real exports and the assertions become the contract.
+ *
+ * Deliberate contract decisions encoded here (implementer: these are pinned
+ * by the tests, change them only by changing the tests):
+ *   - Basic auth username defaults to 'openpalm' when the connection carries
+ *     only a password — mirrors the host app's probeEndpoint() default so a
+ *     guardian provisioned by the host accepts the same credentials.
+ *   - Health probe states are 'accessible' | 'unauthorized' | 'unreachable',
+ *     the same vocabulary as the host app's RemoteStatus.
+ *   - The store API is async throughout (IndexedDB is async); the in-memory
+ *     backend must behave identically so tests are the spec for both.
+ */
+
+export type ConnectionKind = 'local-opencode' | 'remote-opencode' | 'openpalm-client-api';
+
+/** Credentials handed to the transport (client-held, per connection). */
+export type ConnectionAuth =
+  | { mode: 'none' }
+  | { mode: 'basic'; username?: string; password: string }
+  | { mode: 'bearer'; token: string };
+
+export type SessionSummary = {
+  id: string;
+  /** '' until OpenCode summarizes (UI renders a fallback). */
+  title: string;
+  createdAt: number;
+  updatedAt: number;
+};
+
+export type HealthProbeResult = {
+  state: 'accessible' | 'unauthorized' | 'unreachable';
+  detail?: string;
+};
+
+export type TransportOptions = {
+  baseUrl: string;
+  /** Default: { mode: 'none' }. */
+  auth?: ConnectionAuth;
+  /** Injectable for tests; defaults to globalThis.fetch. */
+  fetch?: typeof globalThis.fetch;
+};
+
+export type Transport = {
+  listSessions(): Promise<SessionSummary[]>;
+  createSession(): Promise<{ id: string }>;
+  sendMessage(sessionId: string, text: string): Promise<unknown>;
+  probeHealth(): Promise<HealthProbeResult>;
+};
+
+/** One parsed SSE frame ('\n\n'-delimited; multi-line data joined with '\n'). */
+export type SseFrame = { event?: string; data?: string; id?: string };
+
+export type TransportModule = {
+  createTransport(options: TransportOptions): Transport;
+  /**
+   * Parse a raw SSE byte stream into frames. Yields ONLY frames that carry at
+   * least one of event/data/id (comment-only and retry-only frames yield
+   * nothing); an unterminated trailing frame at end-of-stream is discarded
+   * (SSE spec; same behavior as packages/ui session-events.ts).
+   */
+  parseSseStream(stream: ReadableStream<Uint8Array>): AsyncIterable<SseFrame>;
+};
+
+/** Plan §6.6 ConnectionEntry, client-side (no host:* in grantedCapabilities' type space). */
+export type ConnectionEntry = {
+  id: string;
+  label: string;
+  kind: ConnectionKind;
+  url: string;
+  auth: { mode: 'none' | 'basic' | 'bearer'; secretRef?: string };
+  isDefault?: boolean;
+  locked?: boolean;
+  grantedCapabilities?: string[];
+};
+
+export type NewConnectionInput = Omit<ConnectionEntry, 'id'> & { id?: string };
+
+/**
+ * Shape of the runtime-config.json the assistant container writes beside the
+ * static build (P5d). Seeded entries carry explicit stable ids so re-seeding
+ * is idempotent.
+ */
+export type RuntimeConfig = {
+  connections: ConnectionEntry[];
+};
+
+export type ConnectionStore = {
+  list(): Promise<ConnectionEntry[]>;
+  get(id: string): Promise<ConnectionEntry | null>;
+  /** Generates an id when the input has none. */
+  add(input: NewConnectionInput): Promise<ConnectionEntry>;
+  /** Rejects for unknown ids and for locked entries. */
+  update(id: string, patch: Partial<Omit<ConnectionEntry, 'id'>>): Promise<ConnectionEntry>;
+  /** Rejects for unknown ids and for locked entries. */
+  remove(id: string): Promise<void>;
+  getActiveId(): Promise<string | null>;
+  getActive(): Promise<ConnectionEntry | null>;
+  /** Rejects for unknown ids. */
+  setActive(id: string): Promise<void>;
+  /**
+   * Upsert the config's (locked/default) entries by id. null config = no-op.
+   * A seeded isDefault entry becomes active when nothing is active yet, but
+   * never steals an explicit user selection. Config wins for locked entries
+   * (label/url updates apply on re-seed); user-added entries are untouched.
+   */
+  seedFromRuntimeConfig(config: RuntimeConfig | null): Promise<void>;
+};
+
+export type ConnectionsModule = {
+  /** In-memory storage backend (same semantics as the IndexedDB one). */
+  createMemoryStorage(): unknown;
+  createConnectionStore(options: { storage: unknown }): ConnectionStore;
+  /**
+   * Fetch '/runtime-config.json' from the app's own origin. Absent (404),
+   * unreachable, or malformed file -> null (no default connection; offline
+   * boot must not crash).
+   */
+  loadRuntimeConfig(fetchImpl?: typeof globalThis.fetch): Promise<RuntimeConfig | null>;
+};
+
+export type LandingModule = {
+  /** Plan §6.5 client branch: 0 connections -> /connections/new, else /chat. */
+  resolveLanding(connections: ReadonlyArray<{ id: string }>): string;
+};
+
+export function loadTransportModule(): Promise<TransportModule> {
+  return import('../../src/lib/transport/index.ts') as Promise<TransportModule>;
+}
+
+export function loadConnectionsModule(): Promise<ConnectionsModule> {
+  return import('../../src/lib/connections/index.ts') as Promise<ConnectionsModule>;
+}
+
+export function loadLandingModule(): Promise<LandingModule> {
+  return import('../../src/lib/resolve-landing.ts') as Promise<LandingModule>;
+}
diff --git a/packages/client/tests/helpers/mocks.ts b/packages/client/tests/helpers/mocks.ts
new file mode 100644
index 000000000..ae959f750
--- /dev/null
+++ b/packages/client/tests/helpers/mocks.ts
@@ -0,0 +1,94 @@
+/**
+ * Test doubles for the P5b red tests: a recording fetch (captures URL,
+ * method, headers, credentials, body of every call) and byte-stream builders
+ * for SSE parsing tests. No production code — helpers only.
+ */
+
+export type RecordedRequest = {
+  url: string;
+  method: string;
+  headers: Headers;
+  /** undefined when the caller did not set an explicit credentials mode. */
+  credentials: RequestCredentials | undefined;
+  body: string | null;
+};
+
+export type Responder = (request: RecordedRequest) => Response | Promise<Response>;
+
+export type RecordingFetch = {
+  fetch: typeof globalThis.fetch;
+  calls: RecordedRequest[];
+};
+
+/**
+ * A fetch stand-in that records each request and answers via `respond`
+ * (default: 200 `{}`). Handles both fetch(url, init) and fetch(Request)
+ * call shapes, including relative-URL string inputs (which `new Request`
+ * would reject outside a browser).
+ */
+export function recordingFetch(respond?: Responder): RecordingFetch {
+  const calls: RecordedRequest[] = [];
+  const impl = async (input: RequestInfo | URL, init?: RequestInit): Promise<Response> => {
+    let recorded: RecordedRequest;
+    if (input instanceof Request) {
+      recorded = {
+        url: input.url,
+        method: (init?.method ?? input.method).toUpperCase(),
+        headers: new Headers(init?.headers ?? input.headers),
+        credentials: init?.credentials ?? input.credentials,
+        body: input.body === null ? null : await input.clone().text()
+      };
+    } else {
+      const rawBody = init?.body;
+      recorded = {
+        url: String(input),
+        method: (init?.method ?? 'GET').toUpperCase(),
+        headers: new Headers(init?.headers),
+        credentials: init?.credentials,
+        body: typeof rawBody === 'string' ? rawBody : rawBody == null ? null : String(rawBody)
+      };
+    }
+    calls.push(recorded);
+    if (respond) return respond(recorded);
+    return jsonResponse({});
+  };
+  return { fetch: impl as typeof globalThis.fetch, calls };
+}
+
+export function jsonResponse(data: unknown, status = 200): Response {
+  return new Response(JSON.stringify(data), {
+    status,
+    headers: { 'content-type': 'application/json' }
+  });
+}
+
+/** A fetch that always rejects — proves a code path performs no network I/O. */
+export function rejectingFetch(message = 'network disabled in this test'): typeof globalThis.fetch {
+  const impl = async (): Promise<Response> => {
+    throw new TypeError(message);
+  };
+  return impl as typeof globalThis.fetch;
+}
+
+/**
+ * Build a ReadableStream<Uint8Array> from chunks. Strings are UTF-8 encoded;
+ * Uint8Array chunks pass through raw (used to split multi-byte characters
+ * across chunk boundaries).
+ */
+export function byteStream(chunks: Array<string | Uint8Array>): ReadableStream<Uint8Array> {
+  const encoder = new TextEncoder();
+  return new ReadableStream<Uint8Array>({
+    start(controller) {
+      for (const chunk of chunks) {
+        controller.enqueue(typeof chunk === 'string' ? encoder.encode(chunk) : chunk);
+      }
+      controller.close();
+    }
+  });
+}
+
+export async function collect<T>(iterable: AsyncIterable<T>): Promise<T[]> {
+  const items: T[] = [];
+  for await (const item of iterable) items.push(item);
+  return items;
+}
diff --git a/packages/client/tests/transport-health.test.ts b/packages/client/tests/transport-health.test.ts
new file mode 100644
index 000000000..22bc53bf8
--- /dev/null
+++ b/packages/client/tests/transport-health.test.ts
@@ -0,0 +1,95 @@
+/**
+ * P5b (#555) RED — health probe status mapping (P5b item 1: "health probe").
+ *
+ * probeHealth() GETs the connection base URL with the connection credentials
+ * and maps the outcome onto the same state vocabulary the host app uses for
+ * connection probing (packages/ui/src/lib/server/endpoints.ts
+ * probeEndpoint(): RemoteStatus):
+ *   - 2xx and 3xx        -> 'accessible'
+ *   - 401 / 403          -> 'unauthorized' (detail 'HTTP <status>')
+ *   - other HTTP status  -> 'unreachable'  (detail 'HTTP <status>')
+ *   - network failure    -> 'unreachable'  (detail = error message)
+ *
+ * The probe never throws — connection health is data, not an exception path
+ * (the /connections list renders it for every stored connection, offline
+ * included).
+ *
+ * RED until src/lib/transport/index.ts exists: every test fails with
+ * "Cannot find module …/src/lib/transport/index.ts" (missing feature).
+ */
+import { describe, expect, test } from 'bun:test';
+import { loadTransportModule } from './helpers/contract.ts';
+import { recordingFetch } from './helpers/mocks.ts';
+
+const BASE = 'http://gw.example:8443';
+
+function statusResponse(status: number): Response {
+  return new Response(status === 204 ? null : 'x', { status });
+}
+
+describe('transport health probe status mapping (P5b item 1)', () => {
+  test('HTTP 200 maps to accessible', async () => {
+    const { createTransport } = await loadTransportModule();
+    const { fetch } = recordingFetch(() => statusResponse(200));
+    const result = await createTransport({ baseUrl: BASE, fetch }).probeHealth();
+    expect(result.state).toBe('accessible');
+  });
+
+  test('a 3xx redirect maps to accessible (endpoint is alive)', async () => {
+    const { createTransport } = await loadTransportModule();
+    const { fetch } = recordingFetch(() => statusResponse(302));
+    const result = await createTransport({ baseUrl: BASE, fetch }).probeHealth();
+    expect(result.state).toBe('accessible');
+  });
+
+  test('HTTP 401 maps to unauthorized with the HTTP status as detail', async () => {
+    const { createTransport } = await loadTransportModule();
+    const { fetch } = recordingFetch(() => statusResponse(401));
+    const result = await createTransport({ baseUrl: BASE, fetch }).probeHealth();
+    expect(result.state).toBe('unauthorized');
+    expect(result.detail).toBe('HTTP 401');
+  });
+
+  test('HTTP 403 maps to unauthorized', async () => {
+    const { createTransport } = await loadTransportModule();
+    const { fetch } = recordingFetch(() => statusResponse(403));
+    const result = await createTransport({ baseUrl: BASE, fetch }).probeHealth();
+    expect(result.state).toBe('unauthorized');
+    expect(result.detail).toBe('HTTP 403');
+  });
+
+  test('HTTP 500 maps to unreachable with the HTTP status as detail', async () => {
+    const { createTransport } = await loadTransportModule();
+    const { fetch } = recordingFetch(() => statusResponse(500));
+    const result = await createTransport({ baseUrl: BASE, fetch }).probeHealth();
+    expect(result.state).toBe('unreachable');
+    expect(result.detail).toBe('HTTP 500');
+  });
+
+  test('a network failure maps to unreachable with the error message as detail (never throws)', async () => {
+    const { createTransport } = await loadTransportModule();
+    const failing = (async () => {
+      throw new TypeError('connection refused');
+    }) as unknown as typeof globalThis.fetch;
+    const result = await createTransport({ baseUrl: BASE, fetch: failing }).probeHealth();
+    expect(result.state).toBe('unreachable');
+    expect(result.detail).toContain('connection refused');
+  });
+
+  test('probes the connection base URL itself, with credentials and no cookies', async () => {
+    const { createTransport } = await loadTransportModule();
+    const { fetch, calls } = recordingFetch(() => statusResponse(200));
+    await createTransport({
+      baseUrl: BASE,
+      auth: { mode: 'bearer', token: 'tok_1' },
+      fetch
+    }).probeHealth();
+    expect(calls.length).toBe(1);
+    expect(calls[0].method).toBe('GET');
+    const probed = new URL(calls[0].url);
+    expect(probed.origin).toBe(BASE);
+    expect(probed.pathname).toBe('/');
+    expect(calls[0].headers.get('authorization')).toBe('Bearer tok_1');
+    expect(calls[0].credentials).toBe('omit');
+  });
+});
diff --git a/packages/client/tests/transport-request.test.ts b/packages/client/tests/transport-request.test.ts
new file mode 100644
index 000000000..69e926d87
--- /dev/null
+++ b/packages/client/tests/transport-request.test.ts
@@ -0,0 +1,185 @@
+/**
+ * P5b (#555) RED — transport request shaping (plan §6.11: "ONE transport:
+ * guardian/OpenCode base URL + credentials"; P5b item 1).
+ *
+ * The client talks to a connection's base URL DIRECTLY from the browser: no
+ * same-origin proxy, no op_session cookie. These tests pin:
+ *   - base URL + API path joining (trailing slash / path-prefix safe),
+ *   - Basic auth header derived from connection credentials (username
+ *     defaults to 'openpalm', mirroring the host app's probeEndpoint()),
+ *   - Bearer mode,
+ *   - cookie hygiene: every request sets credentials 'omit' and never sends
+ *     a cookie header (§6.8/§8.10 — the client holds per-connection
+ *     credentials, not host cookies),
+ *   - the minimal ported chat surface: session list/create + message send
+ *     (packages/ui/src/lib/api/chat.ts is the reference implementation).
+ *
+ * RED until src/lib/transport/index.ts exists: every test fails with
+ * "Cannot find module …/src/lib/transport/index.ts" (missing feature).
+ */
+import { describe, expect, test } from 'bun:test';
+import { loadTransportModule } from './helpers/contract.ts';
+import { jsonResponse, recordingFetch } from './helpers/mocks.ts';
+
+const BASE = 'http://gw.example:8443';
+
+describe('transport request shaping (P5b item 1)', () => {
+  test('joins the base URL and API paths without doubled or dropped slashes', async () => {
+    const { createTransport } = await loadTransportModule();
+    const cases: Array<{ baseUrl: string; expected: string }> = [
+      { baseUrl: 'http://gw.example:8443', expected: 'http://gw.example:8443/session' },
+      { baseUrl: 'http://gw.example:8443/', expected: 'http://gw.example:8443/session' },
+      // Reverse-proxied instance under a path prefix — the prefix must survive.
+      { baseUrl: 'https://proxy.example/opencode', expected: 'https://proxy.example/opencode/session' },
+      { baseUrl: 'https://proxy.example/opencode/', expected: 'https://proxy.example/opencode/session' }
+    ];
+    for (const { baseUrl, expected } of cases) {
+      const { fetch, calls } = recordingFetch(() => jsonResponse([]));
+      const transport = createTransport({ baseUrl, fetch });
+      await transport.listSessions();
+      expect(calls.length).toBe(1);
+      expect(calls[0].url).toBe(expected);
+      expect(calls[0].method).toBe('GET');
+    }
+  });
+
+  test('basic mode sends an Authorization header derived from the connection credentials', async () => {
+    const { createTransport } = await loadTransportModule();
+    const { fetch, calls } = recordingFetch(() => jsonResponse([]));
+    const transport = createTransport({
+      baseUrl: BASE,
+      auth: { mode: 'basic', username: 'alice', password: 's3cret' },
+      fetch
+    });
+    await transport.listSessions();
+    expect(calls[0].headers.get('authorization')).toBe(`Basic ${btoa('alice:s3cret')}`);
+  });
+
+  test('basic mode defaults the username to "openpalm" when only a password is held', async () => {
+    // Mirrors the host app's probeEndpoint() default so credentials minted by
+    // the host stack (guardian Basic auth, #435) work without a username field.
+    const { createTransport } = await loadTransportModule();
+    const { fetch, calls } = recordingFetch(() => jsonResponse([]));
+    const transport = createTransport({
+      baseUrl: BASE,
+      auth: { mode: 'basic', password: 'hunter2' },
+      fetch
+    });
+    await transport.listSessions();
+    expect(calls[0].headers.get('authorization')).toBe(`Basic ${btoa('openpalm:hunter2')}`);
+  });
+
+  test('bearer mode sends a Bearer Authorization header', async () => {
+    const { createTransport } = await loadTransportModule();
+    const { fetch, calls } = recordingFetch(() => jsonResponse([]));
+    const transport = createTransport({
+      baseUrl: BASE,
+      auth: { mode: 'bearer', token: 'tok_12345' },
+      fetch
+    });
+    await transport.listSessions();
+    expect(calls[0].headers.get('authorization')).toBe('Bearer tok_12345');
+  });
+
+  test('mode none sends no Authorization header', async () => {
+    const { createTransport } = await loadTransportModule();
+    const { fetch, calls } = recordingFetch(() => jsonResponse([]));
+    const transport = createTransport({ baseUrl: BASE, auth: { mode: 'none' }, fetch });
+    await transport.listSessions();
+    expect(calls[0].headers.get('authorization')).toBeNull();
+  });
+
+  test('never sends cookies: every request sets credentials "omit" and no cookie header', async () => {
+    // 'omit' is the only fetch credentials mode that guarantees no cookies —
+    // the default ('same-origin') would still leak cookies to a same-origin
+    // connection URL. The host app's proxy transport does the opposite
+    // (credentials 'include'); the client must never inherit that.
+    const { createTransport } = await loadTransportModule();
+    const { fetch, calls } = recordingFetch((request) => {
+      if (request.method === 'POST' && request.url.endsWith('/session')) {
+        return jsonResponse({ id: 'ses_new' });
+      }
+      return jsonResponse([]);
+    });
+    const transport = createTransport({
+      baseUrl: BASE,
+      auth: { mode: 'basic', password: 'hunter2' },
+      fetch
+    });
+    await transport.listSessions();
+    await transport.createSession();
+    await transport.sendMessage('ses_new', 'hello');
+    await transport.probeHealth();
+    expect(calls.length).toBe(4);
+    for (const call of calls) {
+      expect(call.credentials).toBe('omit');
+      expect(call.headers.get('cookie')).toBeNull();
+    }
+  });
+
+  test('createSession POSTs {base}/session and returns the created id', async () => {
+    const { createTransport } = await loadTransportModule();
+    const { fetch, calls } = recordingFetch(() => jsonResponse({ id: 'ses_abc' }));
+    const transport = createTransport({ baseUrl: BASE, fetch });
+    const created = await transport.createSession();
+    expect(created).toEqual({ id: 'ses_abc' });
+    expect(calls[0].method).toBe('POST');
+    expect(calls[0].url).toBe(`${BASE}/session`);
+  });
+
+  test('sendMessage POSTs the OpenCode parts envelope to the session message path', async () => {
+    const { createTransport } = await loadTransportModule();
+    const { fetch, calls } = recordingFetch(() => jsonResponse({ parts: [] }));
+    const transport = createTransport({ baseUrl: BASE, fetch });
+    await transport.sendMessage('ses_abc', 'hi there');
+    expect(calls[0].method).toBe('POST');
+    expect(calls[0].url).toBe(`${BASE}/session/ses_abc/message`);
+    expect(calls[0].headers.get('content-type')).toContain('application/json');
+    expect(JSON.parse(calls[0].body ?? '')).toEqual({
+      parts: [{ type: 'text', text: 'hi there' }]
+    });
+  });
+
+  test('sendMessage URL-encodes the session id path segment', async () => {
+    const { createTransport } = await loadTransportModule();
+    const { fetch, calls } = recordingFetch(() => jsonResponse({ parts: [] }));
+    const transport = createTransport({ baseUrl: BASE, fetch });
+    await transport.sendMessage('ses/../etc', 'x');
+    expect(calls[0].url).toBe(`${BASE}/session/${encodeURIComponent('ses/../etc')}/message`);
+  });
+
+  test('listSessions maps OpenCode sessions and sorts desc by updatedAt (title fallback "")', async () => {
+    // Ported contract from packages/ui listSessions(): OpenCode returns
+    // Array<Session> with no ordering guarantee; consumers rely on desc
+    // `time.updated` ordering and '' title fallback.
+    const { createTransport } = await loadTransportModule();
+    const { fetch } = recordingFetch(() =>
+      jsonResponse([
+        { id: 'a', title: 'Older', time: { created: 1, updated: 10 } },
+        { id: 'b', time: { created: 5 } },
+        { id: 'c', title: 'Newest', time: { created: 2, updated: 99 } }
+      ])
+    );
+    const transport = createTransport({ baseUrl: BASE, fetch });
+    const sessions = await transport.listSessions();
+    expect(sessions).toEqual([
+      { id: 'c', title: 'Newest', createdAt: 2, updatedAt: 99 },
+      { id: 'a', title: 'Older', createdAt: 1, updatedAt: 10 },
+      { id: 'b', title: '', createdAt: 5, updatedAt: 5 }
+    ]);
+  });
+
+  test('non-ok responses reject with the HTTP status attached', async () => {
+    const { createTransport } = await loadTransportModule();
+    const { fetch } = recordingFetch(() => jsonResponse({ error: 'nope' }, 500));
+    const transport = createTransport({ baseUrl: BASE, fetch });
+    let caught: unknown;
+    try {
+      await transport.listSessions();
+    } catch (error) {
+      caught = error;
+    }
+    expect(caught).toBeInstanceOf(Error);
+    expect((caught as { status?: number }).status).toBe(500);
+  });
+});
diff --git a/packages/client/tests/transport-sse.test.ts b/packages/client/tests/transport-sse.test.ts
new file mode 100644
index 000000000..8dbc0bfeb
--- /dev/null
+++ b/packages/client/tests/transport-sse.test.ts
@@ -0,0 +1,105 @@
+/**
+ * P5b (#555) RED — SSE stream parsing in the client transport (P5b item 1:
+ * "message send with SSE streaming", ported from the hand-rolled consumer in
+ * packages/ui/src/lib/chat/session-events.ts).
+ *
+ * parseSseStream(stream) consumes a raw byte stream and yields parsed frames
+ * ({ event?, data?, id? }). Contract pinned here (matches the ui reference
+ * implementation and the SSE spec):
+ *   - frames are '\n\n'-delimited; multi-line `data:` joined with '\n',
+ *   - comment/heartbeat lines (':…') and `retry:` fields are ignored,
+ *   - frames split across chunk boundaries are buffered, including
+ *     multi-byte UTF-8 characters split mid-sequence,
+ *   - comment-only frames yield nothing,
+ *   - an unterminated trailing frame at end-of-stream is discarded.
+ *
+ * All streams here are mock ReadableStreams (no network).
+ *
+ * RED until src/lib/transport/index.ts exists: every test fails with
+ * "Cannot find module …/src/lib/transport/index.ts" (missing feature).
+ */
+import { describe, expect, test } from 'bun:test';
+import { loadTransportModule } from './helpers/contract.ts';
+import { byteStream, collect } from './helpers/mocks.ts';
+
+describe('transport SSE stream parsing (P5b item 1)', () => {
+  test('parses a complete frame into event/data/id', async () => {
+    const { parseSseStream } = await loadTransportModule();
+    const frames = await collect(
+      parseSseStream(byteStream(['event: message\ndata: {"a":1}\nid: 7\n\n']))
+    );
+    expect(frames).toEqual([{ event: 'message', data: '{"a":1}', id: '7' }]);
+  });
+
+  test('joins multi-line data with newlines (SSE spec)', async () => {
+    const { parseSseStream } = await loadTransportModule();
+    const frames = await collect(
+      parseSseStream(byteStream(['data: line one\ndata: line two\n\n']))
+    );
+    expect(frames.length).toBe(1);
+    expect(frames[0].data).toBe('line one\nline two');
+  });
+
+  test('accepts "data:" with no space after the colon', async () => {
+    const { parseSseStream } = await loadTransportModule();
+    const frames = await collect(parseSseStream(byteStream(['data:tight\n\n'])));
+    expect(frames.length).toBe(1);
+    expect(frames[0].data).toBe('tight');
+  });
+
+  test('ignores comment/heartbeat lines and retry: fields', async () => {
+    const { parseSseStream } = await loadTransportModule();
+    const frames = await collect(
+      parseSseStream(byteStream([': heartbeat\nretry: 3000\ndata: ok\n\n']))
+    );
+    expect(frames).toEqual([{ data: 'ok' }]);
+  });
+
+  test('comment-only frames yield nothing', async () => {
+    const { parseSseStream } = await loadTransportModule();
+    const frames = await collect(parseSseStream(byteStream([': ping\n\n', ': ping\n\n'])));
+    expect(frames).toEqual([]);
+  });
+
+  test('parses multiple frames from a single chunk', async () => {
+    const { parseSseStream } = await loadTransportModule();
+    const frames = await collect(
+      parseSseStream(byteStream(['data: one\n\ndata: two\n\ndata: three\n\n']))
+    );
+    expect(frames.map((frame) => frame.data)).toEqual(['one', 'two', 'three']);
+  });
+
+  test('buffers a frame split across chunk boundaries', async () => {
+    const { parseSseStream } = await loadTransportModule();
+    const frames = await collect(
+      parseSseStream(
+        byteStream(['event: message\nda', 'ta: {"x":1}\n\nevent: done\n', 'data: {}\n\n'])
+      )
+    );
+    expect(frames).toEqual([
+      { event: 'message', data: '{"x":1}' },
+      { event: 'done', data: '{}' }
+    ]);
+  });
+
+  test('decodes multi-byte UTF-8 characters split across chunks', async () => {
+    // '中' is 3 UTF-8 bytes, '€' is 3 — cut mid-'中' so a byte-naive decoder
+    // would corrupt the text. The parser must decode in streaming mode.
+    const { parseSseStream } = await loadTransportModule();
+    const bytes = new TextEncoder().encode('data: 中€\n\n');
+    const cut = 7; // 'data: ' = 6 bytes, +1 lands inside the 3-byte '中'
+    const frames = await collect(
+      parseSseStream(byteStream([bytes.slice(0, cut), bytes.slice(cut)]))
+    );
+    expect(frames.length).toBe(1);
+    expect(frames[0].data).toBe('中€');
+  });
+
+  test('discards an unterminated trailing frame at end of stream', async () => {
+    const { parseSseStream } = await loadTransportModule();
+    const frames = await collect(
+      parseSseStream(byteStream(['data: complete\n\ndata: incomplete']))
+    );
+    expect(frames.map((frame) => frame.data)).toEqual(['complete']);
+  });
+});

From e8e67b10db4a20a439e89375dba3a85b4e158869 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Mon, 6 Jul 2026 18:29:26 +0000
Subject: [PATCH 28/61] test(p5b): red tests for #555
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Completes the P5b red suite started in the interrupted WIP commit
(transport request shaping / SSE parsing / health probe were already
authored there; this adds the rest):

- connections-store.test.ts: ConnectionEntry CRUD + active selection
  against the in-memory storage backend (plan §6.6) — persistence lives
  in the backend, locked entries immutable, remove clears a dangling
  active id. RED: missing src/lib/connections/index.ts (15 tests).
- connections-seed.test.ts: runtime-config.json loading (own-origin
  '/runtime-config.json'; 404/offline/malformed -> null) + locked/default
  seeding semantics (idempotent upsert by id, config wins for locked,
  default never steals an explicit selection) + the offline read path.
  RED: missing src/lib/connections/index.ts (13 tests).
- landing.test.ts: client landing choice — 0 connections ->
  /connections/new, else /chat (plan §6.5 pwa-static branch). RED:
  missing src/lib/resolve-landing.ts (3 tests).
- purity.test.ts: dist-grep hygiene — the built bundle must contain no
  '@openpalm/lib' and no '/api/host' marker strings (§8.5/§8.10); fails
  loudly (never skips) while build output is absent. RED: build missing
  until `bun run client:build` lands (3 tests). The 3 source-hygiene
  tests in the same file (no @openpalm/lib dep in package.json, no
  src/lib/server/, no lib import in src) are CHARACTERIZATION tests that
  already pass on the inert scaffold and must stay green.

Suite state: 64 tests across 7 files — 61 red for the right reason
(missing feature modules / missing build), 3 green characterization.
No production code. biome lint clean for packages/client.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FetR7BttT1xBrA8fBwhui9
---
 .../client/tests/connections-seed.test.ts     | 193 ++++++++++++++++++
 .../client/tests/connections-store.test.ts    | 169 +++++++++++++++
 packages/client/tests/landing.test.ts         |  38 ++++
 packages/client/tests/purity.test.ts          |  99 +++++++++
 4 files changed, 499 insertions(+)
 create mode 100644 packages/client/tests/connections-seed.test.ts
 create mode 100644 packages/client/tests/connections-store.test.ts
 create mode 100644 packages/client/tests/landing.test.ts
 create mode 100644 packages/client/tests/purity.test.ts

diff --git a/packages/client/tests/connections-seed.test.ts b/packages/client/tests/connections-seed.test.ts
new file mode 100644
index 000000000..faa4cab1b
--- /dev/null
+++ b/packages/client/tests/connections-seed.test.ts
@@ -0,0 +1,193 @@
+/**
+ * P5b (#555) RED — runtime-config.json loading and locked/default seeding +
+ * the offline read path (P5b item 2, plan §6.6/§6.10/§6.11).
+ *
+ * Boot flow pinned here:
+ *   1. loadRuntimeConfig() fetches '/runtime-config.json' from the app's OWN
+ *      origin (relative URL — the static server ships the file beside the
+ *      build; the assistant container writes it in P5d). Absent (404),
+ *      unreachable (offline), or malformed -> null. NEVER throws: an offline
+ *      PWA boot must reach the stored connection list (plan §6.10 "offline
+ *      launch shows the shell + saved connections, not a blank page").
+ *   2. store.seedFromRuntimeConfig(config) upserts the config's entries by
+ *      their stable ids:
+ *        - null config = no-op,
+ *        - re-seeding is idempotent (no duplicates),
+ *        - config wins for locked entries (label/url updates apply on
+ *          re-seed) — the container owns them,
+ *        - user-added entries are untouched,
+ *        - a seeded isDefault entry becomes active when nothing is active
+ *          yet, but NEVER steals an explicit user selection.
+ *   3. Reads (list/get/getActive) hit only the storage backend — no network.
+ *
+ * RED until src/lib/connections/index.ts exists: every test fails with
+ * "Cannot find module …/src/lib/connections/index.ts" (missing feature).
+ */
+import { describe, expect, test } from 'bun:test';
+import {
+  type ConnectionEntry,
+  loadConnectionsModule,
+  type RuntimeConfig
+} from './helpers/contract.ts';
+import { jsonResponse, recordingFetch, rejectingFetch } from './helpers/mocks.ts';
+
+function seededEntry(overrides: Partial<ConnectionEntry> = {}): ConnectionEntry {
+  return {
+    id: 'seed-local-opencode',
+    label: 'This assistant',
+    kind: 'local-opencode',
+    url: 'http://127.0.0.1:4096',
+    auth: { mode: 'none' },
+    isDefault: true,
+    locked: true,
+    ...overrides
+  };
+}
+
+async function storeWithBackend() {
+  const { createMemoryStorage, createConnectionStore } = await loadConnectionsModule();
+  const storage = createMemoryStorage();
+  return { storage, store: createConnectionStore({ storage }) };
+}
+
+describe('loadRuntimeConfig (P5b item 2)', () => {
+  test("GETs '/runtime-config.json' from the app's own origin and parses it", async () => {
+    const { loadRuntimeConfig } = await loadConnectionsModule();
+    const config: RuntimeConfig = { connections: [seededEntry()] };
+    const { fetch, calls } = recordingFetch(() => jsonResponse(config));
+    const loaded = await loadRuntimeConfig(fetch);
+    expect(calls.length).toBe(1);
+    // Relative URL: the file MUST come from the serving origin, never from a
+    // connection URL — the client holds no other trusted origin at boot.
+    expect(calls[0].url).toBe('/runtime-config.json');
+    expect(calls[0].method).toBe('GET');
+    expect(loaded).toEqual(config);
+  });
+
+  test('absent file (404) means no default: resolves null, does not throw', async () => {
+    const { loadRuntimeConfig } = await loadConnectionsModule();
+    const { fetch } = recordingFetch(() => new Response('not found', { status: 404 }));
+    expect(await loadRuntimeConfig(fetch)).toBeNull();
+  });
+
+  test('offline (fetch rejects) resolves null, does not throw', async () => {
+    const { loadRuntimeConfig } = await loadConnectionsModule();
+    expect(await loadRuntimeConfig(rejectingFetch('offline'))).toBeNull();
+  });
+
+  test('malformed JSON resolves null', async () => {
+    const { loadRuntimeConfig } = await loadConnectionsModule();
+    const { fetch } = recordingFetch(
+      () => new Response('<html>SPA fallback</html>', { status: 200 })
+    );
+    expect(await loadRuntimeConfig(fetch)).toBeNull();
+  });
+
+  test('valid JSON without a connections array is malformed: resolves null', async () => {
+    const { loadRuntimeConfig } = await loadConnectionsModule();
+    const { fetch } = recordingFetch(() => jsonResponse({ unexpected: true }));
+    expect(await loadRuntimeConfig(fetch)).toBeNull();
+  });
+});
+
+describe('seedFromRuntimeConfig (P5b item 2 — locked default)', () => {
+  test('null config is a no-op', async () => {
+    const { store } = await storeWithBackend();
+    await store.seedFromRuntimeConfig(null);
+    expect(await store.list()).toEqual([]);
+    expect(await store.getActiveId()).toBeNull();
+  });
+
+  test('seeds the config entries under their stable ids', async () => {
+    const { store } = await storeWithBackend();
+    await store.seedFromRuntimeConfig({ connections: [seededEntry()] });
+    expect(await store.get('seed-local-opencode')).toEqual(seededEntry());
+    expect((await store.list()).length).toBe(1);
+  });
+
+  test('a seeded isDefault entry becomes active when nothing is active yet', async () => {
+    const { store } = await storeWithBackend();
+    await store.seedFromRuntimeConfig({ connections: [seededEntry()] });
+    expect(await store.getActiveId()).toBe('seed-local-opencode');
+    expect((await store.getActive())?.locked).toBe(true);
+  });
+
+  test('re-seeding is idempotent and config wins for locked entries (label/url refresh)', async () => {
+    // The container rewrote runtime-config.json (new port, new label); the
+    // next boot must apply it to the locked entry without duplicating it.
+    const { store } = await storeWithBackend();
+    await store.seedFromRuntimeConfig({ connections: [seededEntry()] });
+    await store.seedFromRuntimeConfig({
+      connections: [seededEntry({ label: 'Renamed by config', url: 'http://127.0.0.1:5096' })]
+    });
+    const all = await store.list();
+    expect(all.length).toBe(1);
+    expect(all[0]).toEqual(
+      seededEntry({ label: 'Renamed by config', url: 'http://127.0.0.1:5096' })
+    );
+  });
+
+  test('seeding never steals an explicit user selection', async () => {
+    const { store } = await storeWithBackend();
+    const mine = await store.add({
+      label: 'My remote',
+      kind: 'remote-opencode',
+      url: 'https://gw.example',
+      auth: { mode: 'basic', secretRef: 'sec_1' }
+    });
+    await store.setActive(mine.id);
+    await store.seedFromRuntimeConfig({ connections: [seededEntry()] });
+    expect(await store.getActiveId()).toBe(mine.id);
+  });
+
+  test('seeding leaves user-added entries untouched', async () => {
+    const { store } = await storeWithBackend();
+    const mine = await store.add({
+      id: 'conn-user',
+      label: 'My remote',
+      kind: 'remote-opencode',
+      url: 'https://gw.example',
+      auth: { mode: 'bearer', secretRef: 'sec_2' }
+    });
+    await store.seedFromRuntimeConfig({ connections: [seededEntry()] });
+    expect(await store.get('conn-user')).toEqual(mine);
+    expect((await store.list()).length).toBe(2);
+  });
+
+  test('seeded locked entries stay immutable through the store API', async () => {
+    const { store } = await storeWithBackend();
+    await store.seedFromRuntimeConfig({ connections: [seededEntry()] });
+    expect(store.update('seed-local-opencode', { url: 'http://evil.example' })).rejects.toThrow();
+    expect(store.remove('seed-local-opencode')).rejects.toThrow();
+    expect((await store.get('seed-local-opencode'))?.url).toBe('http://127.0.0.1:4096');
+  });
+});
+
+describe('offline read path (P5b item 2, plan §6.10)', () => {
+  test('offline boot: loadRuntimeConfig -> null, seed(null) no-op, stored connections still readable', async () => {
+    // Previous (online) session stored connections; this boot is offline.
+    const { createMemoryStorage, createConnectionStore, loadRuntimeConfig } =
+      await loadConnectionsModule();
+    const storage = createMemoryStorage();
+    const online = createConnectionStore({ storage });
+    await online.seedFromRuntimeConfig({ connections: [seededEntry()] });
+    const mine = await online.add({
+      id: 'conn-user',
+      label: 'My remote',
+      kind: 'remote-opencode',
+      url: 'https://gw.example',
+      auth: { mode: 'basic', secretRef: 'sec_1' }
+    });
+
+    // Reload with no network at all.
+    const config = await loadRuntimeConfig(rejectingFetch('offline'));
+    expect(config).toBeNull();
+    const offline = createConnectionStore({ storage });
+    await offline.seedFromRuntimeConfig(config);
+
+    const list = await offline.list();
+    expect(list).toContainEqual(seededEntry());
+    expect(list).toContainEqual(mine);
+    expect(await offline.getActiveId()).toBe('seed-local-opencode');
+  });
+});
diff --git a/packages/client/tests/connections-store.test.ts b/packages/client/tests/connections-store.test.ts
new file mode 100644
index 000000000..e2b25bee4
--- /dev/null
+++ b/packages/client/tests/connections-store.test.ts
@@ -0,0 +1,169 @@
+/**
+ * P5b (#555) RED — connection store CRUD + active selection (P5b item 2,
+ * plan §6.6: ConnectionEntry persisted behind a storage abstraction —
+ * IndexedDB in the browser, the in-memory backend here; the tests are the
+ * spec for BOTH backends, so everything is async and nothing may live only
+ * in store-instance fields).
+ *
+ * Contract pinned here:
+ *   - add() persists a ConnectionEntry, generating an id when the input has
+ *     none (explicit ids are kept — runtime-config seeds rely on that),
+ *   - update()/remove() reject for unknown ids AND for locked entries
+ *     (locked = owned by runtime-config.json, plan §6.6 `locked`),
+ *   - active selection is persisted in the same storage (survives a new
+ *     store instance over the same backend — the IndexedDB equivalence),
+ *   - setActive() rejects unknown ids; removing the active entry clears the
+ *     selection (no dangling active id),
+ *   - nothing is implicitly activated by add() — only runtime-config
+ *     seeding auto-selects a default (see connections-seed.test.ts).
+ *
+ * RED until src/lib/connections/index.ts exists: every test fails with
+ * "Cannot find module …/src/lib/connections/index.ts" (missing feature).
+ */
+import { describe, expect, test } from 'bun:test';
+import { loadConnectionsModule, type NewConnectionInput } from './helpers/contract.ts';
+
+function guardianInput(overrides: Partial<NewConnectionInput> = {}): NewConnectionInput {
+  return {
+    label: 'Home guardian',
+    kind: 'remote-opencode',
+    url: 'http://gw.example:8443',
+    auth: { mode: 'basic', secretRef: 'sec_1' },
+    ...overrides
+  };
+}
+
+async function freshStore() {
+  const { createMemoryStorage, createConnectionStore } = await loadConnectionsModule();
+  const storage = createMemoryStorage();
+  return { storage, store: createConnectionStore({ storage }) };
+}
+
+describe('connection store CRUD (P5b item 2)', () => {
+  test('starts empty: list() is [] and get() of an unknown id is null', async () => {
+    const { store } = await freshStore();
+    expect(await store.list()).toEqual([]);
+    expect(await store.get('missing')).toBeNull();
+  });
+
+  test('add() returns the stored entry with a generated non-empty id and get() round-trips it', async () => {
+    const { store } = await freshStore();
+    const added = await store.add(guardianInput());
+    expect(typeof added.id).toBe('string');
+    expect(added.id.length).toBeGreaterThan(0);
+    expect(added).toMatchObject(guardianInput());
+    expect(await store.get(added.id)).toEqual(added);
+    expect(await store.list()).toEqual([added]);
+  });
+
+  test('add() generates distinct ids for successive entries', async () => {
+    const { store } = await freshStore();
+    const first = await store.add(guardianInput({ label: 'One' }));
+    const second = await store.add(guardianInput({ label: 'Two' }));
+    expect(second.id).not.toBe(first.id);
+    expect((await store.list()).length).toBe(2);
+  });
+
+  test('add() keeps an explicit id (runtime-config seeds depend on stable ids)', async () => {
+    const { store } = await freshStore();
+    const added = await store.add(guardianInput({ id: 'conn-explicit' }));
+    expect(added.id).toBe('conn-explicit');
+    expect(await store.get('conn-explicit')).toEqual(added);
+  });
+
+  test('update() patches fields, persists the result, and returns the updated entry', async () => {
+    const { store } = await freshStore();
+    const added = await store.add(guardianInput());
+    const updated = await store.update(added.id, {
+      label: 'Renamed',
+      url: 'https://gw.example:9443'
+    });
+    expect(updated).toEqual({ ...added, label: 'Renamed', url: 'https://gw.example:9443' });
+    expect(await store.get(added.id)).toEqual(updated);
+  });
+
+  test('update() rejects for an unknown id', async () => {
+    const { store } = await freshStore();
+    expect(store.update('missing', { label: 'x' })).rejects.toThrow();
+  });
+
+  test('update() rejects for a locked entry (config-owned, plan §6.6)', async () => {
+    const { store } = await freshStore();
+    const locked = await store.add(guardianInput({ id: 'conn-locked', locked: true }));
+    expect(store.update(locked.id, { label: 'tampered' })).rejects.toThrow();
+    expect((await store.get(locked.id))?.label).toBe('Home guardian');
+  });
+
+  test('remove() deletes the entry', async () => {
+    const { store } = await freshStore();
+    const added = await store.add(guardianInput());
+    await store.remove(added.id);
+    expect(await store.get(added.id)).toBeNull();
+    expect(await store.list()).toEqual([]);
+  });
+
+  test('remove() rejects for an unknown id', async () => {
+    const { store } = await freshStore();
+    expect(store.remove('missing')).rejects.toThrow();
+  });
+
+  test('remove() rejects for a locked entry and keeps it stored', async () => {
+    const { store } = await freshStore();
+    const locked = await store.add(guardianInput({ id: 'conn-locked', locked: true }));
+    expect(store.remove(locked.id)).rejects.toThrow();
+    expect(await store.get(locked.id)).not.toBeNull();
+  });
+});
+
+describe('active connection selection (P5b item 2)', () => {
+  test('nothing is active initially, and add() does not implicitly activate', async () => {
+    const { store } = await freshStore();
+    expect(await store.getActiveId()).toBeNull();
+    expect(await store.getActive()).toBeNull();
+    await store.add(guardianInput());
+    expect(await store.getActiveId()).toBeNull();
+  });
+
+  test('setActive() selects a stored entry; getActive() resolves it', async () => {
+    const { store } = await freshStore();
+    const a = await store.add(guardianInput({ label: 'A' }));
+    const b = await store.add(guardianInput({ label: 'B' }));
+    await store.setActive(b.id);
+    expect(await store.getActiveId()).toBe(b.id);
+    expect(await store.getActive()).toEqual(b);
+    await store.setActive(a.id);
+    expect(await store.getActiveId()).toBe(a.id);
+  });
+
+  test('setActive() rejects for an unknown id and leaves the selection unchanged', async () => {
+    const { store } = await freshStore();
+    const a = await store.add(guardianInput());
+    await store.setActive(a.id);
+    expect(store.setActive('missing')).rejects.toThrow();
+    expect(await store.getActiveId()).toBe(a.id);
+  });
+
+  test('removing the active entry clears the selection (no dangling active id)', async () => {
+    const { store } = await freshStore();
+    const a = await store.add(guardianInput());
+    await store.setActive(a.id);
+    await store.remove(a.id);
+    expect(await store.getActiveId()).toBeNull();
+    expect(await store.getActive()).toBeNull();
+  });
+
+  test('entries and the active selection persist in the storage backend, not the store instance', async () => {
+    // IndexedDB equivalence: a page reload constructs a NEW store over the
+    // SAME persisted backend and must see identical state.
+    const { createMemoryStorage, createConnectionStore } = await loadConnectionsModule();
+    const storage = createMemoryStorage();
+    const first = createConnectionStore({ storage });
+    const added = await first.add(guardianInput({ id: 'conn-persist' }));
+    await first.setActive(added.id);
+
+    const second = createConnectionStore({ storage });
+    expect(await second.list()).toEqual([added]);
+    expect(await second.getActiveId()).toBe('conn-persist');
+    expect(await second.getActive()).toEqual(added);
+  });
+});
diff --git a/packages/client/tests/landing.test.ts b/packages/client/tests/landing.test.ts
new file mode 100644
index 000000000..bbff6390a
--- /dev/null
+++ b/packages/client/tests/landing.test.ts
@@ -0,0 +1,38 @@
+/**
+ * P5b (#555) RED — client landing choice (P5b item 3, plan §6.5 pwa-static
+ * branch).
+ *
+ * The client app has no host capabilities, no LaunchState, no migration
+ * gate — its resolver is the §6.5 client branch only, keyed off the stored
+ * connection list:
+ *
+ *     0 connections  -> '/connections/new'
+ *     >=1 connection -> '/chat'
+ *
+ * Pure and synchronous: the boot code awaits the store's list() and hands
+ * the array in; the resolver itself does no I/O (same discipline as
+ * packages/ui/src/lib/resolve-landing.ts — resolution is data-in,
+ * path-out).
+ *
+ * RED until src/lib/resolve-landing.ts exists: every test fails with
+ * "Cannot find module …/src/lib/resolve-landing.ts" (missing feature).
+ */
+import { describe, expect, test } from 'bun:test';
+import { loadLandingModule } from './helpers/contract.ts';
+
+describe('client landing choice (P5b item 3)', () => {
+  test('no stored connections lands on /connections/new', async () => {
+    const { resolveLanding } = await loadLandingModule();
+    expect(resolveLanding([])).toBe('/connections/new');
+  });
+
+  test('one stored connection lands on /chat', async () => {
+    const { resolveLanding } = await loadLandingModule();
+    expect(resolveLanding([{ id: 'conn-1' }])).toBe('/chat');
+  });
+
+  test('multiple stored connections still land on /chat', async () => {
+    const { resolveLanding } = await loadLandingModule();
+    expect(resolveLanding([{ id: 'conn-1' }, { id: 'conn-2' }, { id: 'conn-3' }])).toBe('/chat');
+  });
+});
diff --git a/packages/client/tests/purity.test.ts b/packages/client/tests/purity.test.ts
new file mode 100644
index 000000000..48ce282cc
--- /dev/null
+++ b/packages/client/tests/purity.test.ts
@@ -0,0 +1,99 @@
+/**
+ * P5b (#555) — purity hygiene for @openpalm/client (plan §6.11 rules, §8.5,
+ * §8.10: "The client app never bundles @openpalm/lib and never holds host
+ * credentials"; host capabilities are ABSENT from the artifact, not hidden).
+ *
+ * Two layers:
+ *
+ * 1. DIST GREP (RED until `bun run client:build` exists — the build output
+ *    is the missing feature): every file of the built static bundle under
+ *    packages/client/build/ is scanned for forbidden markers:
+ *      - '@openpalm/lib'  -> the host library leaked into the artifact,
+ *      - '/api/host'      -> host control-plane client code leaked in (the
+ *        client talks only to per-connection guardian/OpenCode base URLs).
+ *    These tests intentionally FAIL (not skip) when the build directory is
+ *    absent, so a stale/missing build can never fake a green purity check.
+ *    Run them after `bun run client:build`.
+ *
+ * 2. SOURCE HYGIENE (characterization — already green on the inert
+ *    scaffold, and must stay green): package.json declares no dependency on
+ *    @openpalm/lib in any dependency group, no src/lib/server/ directory
+ *    exists (§6.11), and no source file imports @openpalm/lib.
+ */
+import { describe, expect, test } from 'bun:test';
+import { existsSync, readFileSync, readdirSync } from 'node:fs';
+import { join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const PKG_ROOT = fileURLToPath(new URL('..', import.meta.url));
+const BUILD_DIR = join(PKG_ROOT, 'build');
+
+/** Markers that must never appear anywhere in the built client bundle. */
+const FORBIDDEN_DIST_MARKERS = ['@openpalm/lib', '/api/host'] as const;
+
+function walk(dir: string): string[] {
+  const files: string[] = [];
+  for (const entry of readdirSync(dir, { withFileTypes: true })) {
+    const path = join(dir, entry.name);
+    if (entry.isDirectory()) files.push(...walk(path));
+    else if (entry.isFile()) files.push(path);
+  }
+  return files;
+}
+
+function builtFiles(): string[] {
+  if (!existsSync(BUILD_DIR)) {
+    throw new Error(
+      `client build output missing at ${BUILD_DIR} — run \`bun run client:build\` first; ` +
+        'the purity checks grep the BUILT bundle, not the sources'
+    );
+  }
+  return walk(BUILD_DIR);
+}
+
+/** Files whose bytes contain the marker ('latin1' keeps byte<->char 1:1, so
+ *  ASCII markers are found even inside binary assets). */
+function offenders(files: string[], marker: string): string[] {
+  return files.filter((file) => readFileSync(file).toString('latin1').includes(marker));
+}
+
+describe('built bundle purity (dist grep — run after `bun run client:build`)', () => {
+  test('the build output exists and is an SPA bundle (index.html fallback + js assets)', () => {
+    const files = builtFiles();
+    expect(files.some((file) => file.endsWith('index.html'))).toBe(true);
+    expect(files.some((file) => file.endsWith('.js'))).toBe(true);
+  });
+
+  for (const marker of FORBIDDEN_DIST_MARKERS) {
+    test(`no built file contains '${marker}'`, () => {
+      expect(offenders(builtFiles(), marker)).toEqual([]);
+    });
+  }
+});
+
+describe('source hygiene (characterization — green on the scaffold, must stay green)', () => {
+  test('package.json declares no dependency on @openpalm/lib in any group', () => {
+    const pkg = JSON.parse(readFileSync(join(PKG_ROOT, 'package.json'), 'utf8')) as Record<
+      string,
+      Record<string, string> | undefined
+    >;
+    for (const group of [
+      'dependencies',
+      'devDependencies',
+      'peerDependencies',
+      'optionalDependencies'
+    ]) {
+      expect(Object.keys(pkg[group] ?? {})).not.toContain('@openpalm/lib');
+    }
+  });
+
+  test('no src/lib/server/ directory exists (plan §6.11)', () => {
+    expect(existsSync(join(PKG_ROOT, 'src', 'lib', 'server'))).toBe(false);
+  });
+
+  test('no source file references @openpalm/lib', () => {
+    const srcDir = join(PKG_ROOT, 'src');
+    const sources = existsSync(srcDir) ? walk(srcDir) : [];
+    expect(offenders(sources, '@openpalm/lib')).toEqual([]);
+  });
+});

From a049f067c33f7e37e912780cc65b688aa2f07556 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Mon, 6 Jul 2026 18:38:29 +0000
Subject: [PATCH 29/61] feat(client): transport, connection store, and landing
 resolver (#555)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

P5b items 1-3 core modules for @openpalm/client (plan §6.6/§6.11):

- src/lib/transport/index.ts — the ONE transport: direct fetch against a
  connection's OpenCode/guardian base URL with Basic (username defaults to
  'openpalm', mirroring the host app's probeEndpoint)/Bearer/none auth,
  credentials 'omit' on every request (no cookies, ever), path-prefix-safe
  URL joining, session list/create + message send (OpenCode parts
  envelope), streaming-decode SSE frame parser, and a never-throwing
  health probe on the host app's RemoteStatus vocabulary.
- src/lib/connections/index.ts — ConnectionEntry store behind a storage
  abstraction (in-memory + raw-IDB IndexedDB backends, same semantics);
  CRUD with locked (config-owned) entries immutable, persisted active
  selection, idempotent runtime-config seeding that never steals an
  explicit user selection, and loadRuntimeConfig() from the app's own
  origin (absent/offline/malformed -> null; offline boot never crashes).
- src/lib/resolve-landing.ts — §6.5 client branch: 0 connections ->
  /connections/new, else /chat.

Turns the P5b red suite green except the 3 dist-grep purity tests, which
need the static build (next commit).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FetR7BttT1xBrA8fBwhui9
---
 packages/client/src/lib/connections/index.ts | 297 +++++++++++++++++++
 packages/client/src/lib/resolve-landing.ts   |  13 +
 packages/client/src/lib/transport/index.ts   | 234 +++++++++++++++
 3 files changed, 544 insertions(+)
 create mode 100644 packages/client/src/lib/connections/index.ts
 create mode 100644 packages/client/src/lib/resolve-landing.ts
 create mode 100644 packages/client/src/lib/transport/index.ts

diff --git a/packages/client/src/lib/connections/index.ts b/packages/client/src/lib/connections/index.ts
new file mode 100644
index 000000000..0bda8a6f9
--- /dev/null
+++ b/packages/client/src/lib/connections/index.ts
@@ -0,0 +1,297 @@
+/**
+ * Client-side connection store (plan ui-runtime-modes-plan.md §6.6; P5b
+ * item 2, #555).
+ *
+ * ConnectionEntry records persist behind a storage abstraction so the same
+ * store logic runs over IndexedDB in the browser (offline-readable, plan
+ * §6.10) and over an in-memory backend in tests. The store API is async
+ * throughout (IndexedDB is async) and keeps NO state in store-instance
+ * fields — a page reload constructs a new store over the same backend and
+ * must see identical state. packages/client/tests/connections-*.test.ts is
+ * the pinned contract for both backends.
+ *
+ * Locked/default entries are seeded from a runtime-config.json fetched from
+ * the app's own origin at boot (the assistant container writes the file
+ * beside the static build, P5d). Absent file = no default connection.
+ */
+
+export type ConnectionKind = 'local-opencode' | 'remote-opencode' | 'openpalm-client-api';
+
+/**
+ * Plan §6.6 ConnectionEntry, client-side. `grantedCapabilities` is a plain
+ * string list here — the client's type space has no host:* capabilities
+ * (plan §4.3 note, §8.5: host features are absent from the artifact), and
+ * grants must be server-verified at connection-add time (§8.9).
+ */
+export type ConnectionEntry = {
+  id: string;
+  label: string;
+  kind: ConnectionKind;
+  url: string;
+  /** Credentials live under `secretRef` in the secret store — never inline. */
+  auth: { mode: 'none' | 'basic' | 'bearer'; secretRef?: string };
+  isDefault?: boolean;
+  locked?: boolean;
+  grantedCapabilities?: string[];
+};
+
+export type NewConnectionInput = Omit<ConnectionEntry, 'id'> & { id?: string };
+
+/** Shape of the runtime-config.json written beside the static build (P5d). */
+export type RuntimeConfig = {
+  connections: ConnectionEntry[];
+};
+
+/**
+ * Storage backend contract: connection records by id plus a small string
+ * meta area (active selection, secret material). Implemented by
+ * createMemoryStorage() (tests) and createIndexedDbStorage() (browser) —
+ * the ConnectionStore is the only consumer.
+ */
+export type ConnectionStorage = {
+  getAll(): Promise<ConnectionEntry[]>;
+  get(id: string): Promise<ConnectionEntry | null>;
+  put(entry: ConnectionEntry): Promise<void>;
+  delete(id: string): Promise<void>;
+  getMeta(key: string): Promise<string | null>;
+  /** null deletes the key. */
+  setMeta(key: string, value: string | null): Promise<void>;
+};
+
+export type ConnectionStore = {
+  list(): Promise<ConnectionEntry[]>;
+  get(id: string): Promise<ConnectionEntry | null>;
+  /** Generates an id when the input has none. */
+  add(input: NewConnectionInput): Promise<ConnectionEntry>;
+  /** Rejects for unknown ids and for locked entries. */
+  update(id: string, patch: Partial<Omit<ConnectionEntry, 'id'>>): Promise<ConnectionEntry>;
+  /** Rejects for unknown ids and for locked entries. */
+  remove(id: string): Promise<void>;
+  getActiveId(): Promise<string | null>;
+  getActive(): Promise<ConnectionEntry | null>;
+  /** Rejects for unknown ids. */
+  setActive(id: string): Promise<void>;
+  /**
+   * Upsert the config's (locked/default) entries by id. null config = no-op.
+   * A seeded isDefault entry becomes active when nothing is active yet, but
+   * never steals an explicit user selection. Config wins for locked entries
+   * (label/url updates apply on re-seed); user-added entries are untouched.
+   */
+  seedFromRuntimeConfig(config: RuntimeConfig | null): Promise<void>;
+};
+
+const ACTIVE_ID_KEY = 'activeId';
+
+function clone<T>(value: T): T {
+  return structuredClone(value);
+}
+
+/** In-memory storage backend — same semantics as the IndexedDB one. */
+export function createMemoryStorage(): ConnectionStorage {
+  const entries = new Map<string, ConnectionEntry>();
+  const meta = new Map<string, string>();
+  return {
+    async getAll() {
+      return [...entries.values()].map(clone);
+    },
+    async get(id) {
+      const entry = entries.get(id);
+      return entry ? clone(entry) : null;
+    },
+    async put(entry) {
+      entries.set(entry.id, clone(entry));
+    },
+    async delete(id) {
+      entries.delete(id);
+    },
+    async getMeta(key) {
+      return meta.get(key) ?? null;
+    },
+    async setMeta(key, value) {
+      if (value === null) meta.delete(key);
+      else meta.set(key, value);
+    },
+  };
+}
+
+// ── IndexedDB backend (browser) ──────────────────────────────────────────
+
+const IDB_NAME = 'openpalm-client';
+const IDB_VERSION = 1;
+const STORE_CONNECTIONS = 'connections';
+const STORE_META = 'meta';
+
+function idbRequest<T>(request: IDBRequest<T>): Promise<T> {
+  return new Promise((resolve, reject) => {
+    request.onsuccess = () => resolve(request.result);
+    request.onerror = () => reject(request.error ?? new Error('IndexedDB request failed'));
+  });
+}
+
+function openDatabase(): Promise<IDBDatabase> {
+  return new Promise((resolve, reject) => {
+    const request = indexedDB.open(IDB_NAME, IDB_VERSION);
+    request.onupgradeneeded = () => {
+      const db = request.result;
+      if (!db.objectStoreNames.contains(STORE_CONNECTIONS)) {
+        db.createObjectStore(STORE_CONNECTIONS, { keyPath: 'id' });
+      }
+      if (!db.objectStoreNames.contains(STORE_META)) {
+        db.createObjectStore(STORE_META);
+      }
+    };
+    request.onsuccess = () => resolve(request.result);
+    request.onerror = () => reject(request.error ?? new Error('IndexedDB open failed'));
+  });
+}
+
+/**
+ * IndexedDB storage backend (raw IDB API, no deps). Lazily opens the
+ * database on first use; each operation runs in its own short transaction.
+ */
+export function createIndexedDbStorage(): ConnectionStorage {
+  let db: Promise<IDBDatabase> | null = null;
+  const database = (): Promise<IDBDatabase> => {
+    db ??= openDatabase();
+    return db;
+  };
+  const store = async (name: string, mode: IDBTransactionMode): Promise<IDBObjectStore> =>
+    (await database()).transaction(name, mode).objectStore(name);
+
+  return {
+    async getAll() {
+      return idbRequest<ConnectionEntry[]>(
+        (await store(STORE_CONNECTIONS, 'readonly')).getAll() as IDBRequest<ConnectionEntry[]>
+      );
+    },
+    async get(id) {
+      const found = await idbRequest<ConnectionEntry | undefined>(
+        (await store(STORE_CONNECTIONS, 'readonly')).get(id) as IDBRequest<
+          ConnectionEntry | undefined
+        >
+      );
+      return found ?? null;
+    },
+    async put(entry) {
+      await idbRequest((await store(STORE_CONNECTIONS, 'readwrite')).put(entry));
+    },
+    async delete(id) {
+      await idbRequest((await store(STORE_CONNECTIONS, 'readwrite')).delete(id));
+    },
+    async getMeta(key) {
+      const found = await idbRequest<string | undefined>(
+        (await store(STORE_META, 'readonly')).get(key) as IDBRequest<string | undefined>
+      );
+      return found ?? null;
+    },
+    async setMeta(key, value) {
+      const metaStore = await store(STORE_META, 'readwrite');
+      if (value === null) await idbRequest(metaStore.delete(key));
+      else await idbRequest(metaStore.put(value, key));
+    },
+  };
+}
+
+// ── Store ────────────────────────────────────────────────────────────────
+
+export function createConnectionStore(options: { storage: unknown }): ConnectionStore {
+  const storage = options.storage as ConnectionStorage;
+
+  async function requireEntry(id: string): Promise<ConnectionEntry> {
+    const entry = await storage.get(id);
+    if (!entry) throw new Error(`Unknown connection: ${id}`);
+    return entry;
+  }
+
+  const store: ConnectionStore = {
+    list() {
+      return storage.getAll();
+    },
+
+    get(id) {
+      return storage.get(id);
+    },
+
+    async add(input) {
+      const id = input.id ?? crypto.randomUUID();
+      if (await storage.get(id)) throw new Error(`Connection already exists: ${id}`);
+      const entry: ConnectionEntry = { ...input, id };
+      await storage.put(entry);
+      return clone(entry);
+    },
+
+    async update(id, patch) {
+      const entry = await requireEntry(id);
+      if (entry.locked) throw new Error(`Connection is locked (config-owned): ${id}`);
+      const updated: ConnectionEntry = { ...entry, ...patch, id };
+      await storage.put(updated);
+      return clone(updated);
+    },
+
+    async remove(id) {
+      const entry = await requireEntry(id);
+      if (entry.locked) throw new Error(`Connection is locked (config-owned): ${id}`);
+      await storage.delete(id);
+      if ((await storage.getMeta(ACTIVE_ID_KEY)) === id) {
+        await storage.setMeta(ACTIVE_ID_KEY, null);
+      }
+    },
+
+    getActiveId() {
+      return storage.getMeta(ACTIVE_ID_KEY);
+    },
+
+    async getActive() {
+      const id = await storage.getMeta(ACTIVE_ID_KEY);
+      return id === null ? null : storage.get(id);
+    },
+
+    async setActive(id) {
+      await requireEntry(id);
+      await storage.setMeta(ACTIVE_ID_KEY, id);
+    },
+
+    async seedFromRuntimeConfig(config) {
+      if (!config) return;
+      for (const entry of config.connections) {
+        const existing = await storage.get(entry.id);
+        // Config wins for the entries it owns (locked), including on
+        // re-seed; a same-id entry the user somehow owns is left alone.
+        if (!existing || existing.locked) await storage.put(clone(entry));
+      }
+      if ((await storage.getMeta(ACTIVE_ID_KEY)) !== null) return;
+      const fallback = config.connections.find((entry) => entry.isDefault);
+      if (fallback && (await storage.get(fallback.id))) {
+        await storage.setMeta(ACTIVE_ID_KEY, fallback.id);
+      }
+    },
+  };
+
+  return store;
+}
+
+// ── Runtime config ───────────────────────────────────────────────────────
+
+/**
+ * Fetch '/runtime-config.json' from the app's OWN origin (relative URL — the
+ * static server ships the file beside the build; the client holds no other
+ * trusted origin at boot). Absent (404), unreachable (offline), or malformed
+ * -> null; never throws, so an offline PWA boot still reaches the stored
+ * connection list (plan §6.10).
+ */
+export async function loadRuntimeConfig(
+  fetchImpl: typeof globalThis.fetch = globalThis.fetch
+): Promise<RuntimeConfig | null> {
+  try {
+    const response = await fetchImpl('/runtime-config.json', {
+      method: 'GET',
+      headers: { accept: 'application/json' },
+    });
+    if (!response.ok) return null;
+    const parsed = (await response.json()) as { connections?: unknown } | null;
+    if (!parsed || typeof parsed !== 'object' || !Array.isArray(parsed.connections)) return null;
+    return parsed as RuntimeConfig;
+  } catch {
+    return null;
+  }
+}
diff --git a/packages/client/src/lib/resolve-landing.ts b/packages/client/src/lib/resolve-landing.ts
new file mode 100644
index 000000000..5772357b0
--- /dev/null
+++ b/packages/client/src/lib/resolve-landing.ts
@@ -0,0 +1,13 @@
+/**
+ * Landing resolver for the client app (plan ui-runtime-modes-plan.md §6.5
+ * pwa-static branch; P5b item 3, #555).
+ *
+ * The client app has no host capabilities, no LaunchState, no migration
+ * gate — its resolver is the §6.5 client branch only, keyed off the stored
+ * connection list. Pure and synchronous: the boot code awaits the store's
+ * list() and hands the array in; resolution is data-in, path-out (same
+ * discipline as packages/ui/src/lib/resolve-landing.ts).
+ */
+export function resolveLanding(connections: ReadonlyArray<{ id: string }>): string {
+  return connections.length === 0 ? '/connections/new' : '/chat';
+}
diff --git a/packages/client/src/lib/transport/index.ts b/packages/client/src/lib/transport/index.ts
new file mode 100644
index 000000000..c6ecd4d80
--- /dev/null
+++ b/packages/client/src/lib/transport/index.ts
@@ -0,0 +1,234 @@
+/**
+ * The ONE client transport (plan ui-runtime-modes-plan.md §6.11; P5b item 1,
+ * #555): talk to a connection's OpenCode/guardian base URL DIRECTLY from the
+ * browser with the connection's own credentials.
+ *
+ * Deliberate differences from the host app's chat api
+ * (packages/ui/src/lib/api/chat.ts), which is the reference implementation:
+ *   - no same-origin `/proxy/assistant/*` broker — requests go straight to
+ *     the connection base URL,
+ *   - no cookies, ever: every request sets `credentials: 'omit'` (the host
+ *     app's proxy transport does the opposite, `credentials: 'include'`;
+ *     the client holds per-connection credentials, not host cookies —
+ *     plan §6.8/§8.10),
+ *   - auth is derived from the connection: Basic (username defaults to
+ *     'openpalm', mirroring the host app's probeEndpoint() so guardian
+ *     credentials minted by the host stack work without a username field,
+ *     #435), Bearer, or none.
+ *
+ * Everything here is pure TS with an injectable fetch — unit-tested in
+ * packages/client/tests/transport-*.test.ts (the pinned contract).
+ */
+
+export type ConnectionAuth =
+  | { mode: 'none' }
+  | { mode: 'basic'; username?: string; password: string }
+  | { mode: 'bearer'; token: string };
+
+export type SessionSummary = {
+  id: string;
+  /** '' until OpenCode summarizes (UI renders a fallback). */
+  title: string;
+  createdAt: number;
+  updatedAt: number;
+};
+
+export type HealthProbeResult = {
+  state: 'accessible' | 'unauthorized' | 'unreachable';
+  detail?: string;
+};
+
+export type TransportOptions = {
+  baseUrl: string;
+  /** Default: { mode: 'none' }. */
+  auth?: ConnectionAuth;
+  /** Injectable for tests; defaults to globalThis.fetch. */
+  fetch?: typeof globalThis.fetch;
+};
+
+export type Transport = {
+  listSessions(): Promise<SessionSummary[]>;
+  createSession(): Promise<{ id: string }>;
+  sendMessage(sessionId: string, text: string): Promise<unknown>;
+  probeHealth(): Promise<HealthProbeResult>;
+};
+
+/** One parsed SSE frame ('\n\n'-delimited; multi-line data joined with '\n'). */
+export type SseFrame = { event?: string; data?: string; id?: string };
+
+/** OpenCode responses can take 30–120s (same budget as the host app). */
+const MESSAGE_TIMEOUT_MS = 150_000;
+const PROBE_TIMEOUT_MS = 5_000;
+
+function authorizationHeader(auth: ConnectionAuth): string | null {
+  if (auth.mode === 'basic') {
+    const username = auth.username ?? 'openpalm';
+    return `Basic ${btoa(`${username}:${auth.password}`)}`;
+  }
+  if (auth.mode === 'bearer') return `Bearer ${auth.token}`;
+  return null;
+}
+
+export function createTransport(options: TransportOptions): Transport {
+  const fetchImpl = options.fetch ?? globalThis.fetch;
+  const auth = options.auth ?? { mode: 'none' };
+  // Trailing-slash and path-prefix safe: '/opencode/' + '/session' must
+  // become '/opencode/session' (reverse-proxied instances keep their prefix).
+  const base = options.baseUrl.replace(/\/+$/, '');
+
+  function buildHeaders(extra?: Record<string, string>): Record<string, string> {
+    const headers: Record<string, string> = { ...extra };
+    const authorization = authorizationHeader(auth);
+    if (authorization) headers.authorization = authorization;
+    return headers;
+  }
+
+  async function request(
+    method: 'GET' | 'POST',
+    path: string,
+    body?: unknown,
+    signal?: AbortSignal
+  ): Promise<Response> {
+    const init: RequestInit = {
+      method,
+      headers: buildHeaders(body === undefined ? undefined : { 'content-type': 'application/json' }),
+      // 'omit' is the only fetch credentials mode that guarantees no cookies
+      // — the default 'same-origin' would still leak cookies to a
+      // same-origin connection URL. Never 'include'.
+      credentials: 'omit',
+    };
+    if (body !== undefined) init.body = JSON.stringify(body);
+    if (signal) init.signal = signal;
+    const response = await fetchImpl(`${base}${path}`, init);
+    if (!response.ok) {
+      throw Object.assign(new Error(`HTTP ${response.status}`), { status: response.status });
+    }
+    return response;
+  }
+
+  return {
+    /**
+     * List sessions on the connection. OpenCode returns `Array<Session>`
+     * with no ordering guarantee; sorted desc by `time.updated` here so
+     * consumers can rely on it (ported from packages/ui listSessions()).
+     */
+    async listSessions(): Promise<SessionSummary[]> {
+      const res = await request('GET', '/session');
+      const raw = (await res.json()) as Array<{
+        id: string;
+        title?: string;
+        time?: { created?: number; updated?: number };
+      }>;
+      const summaries: SessionSummary[] = raw.map((s) => ({
+        id: s.id,
+        title: s.title ?? '',
+        createdAt: s.time?.created ?? 0,
+        updatedAt: s.time?.updated ?? s.time?.created ?? 0,
+      }));
+      summaries.sort((a, b) => b.updatedAt - a.updatedAt);
+      return summaries;
+    },
+
+    async createSession(): Promise<{ id: string }> {
+      const res = await request('POST', '/session', {});
+      return (await res.json()) as { id: string };
+    },
+
+    /** POST the OpenCode parts envelope; resolves with the raw response body. */
+    async sendMessage(sessionId: string, text: string): Promise<unknown> {
+      const res = await request(
+        'POST',
+        `/session/${encodeURIComponent(sessionId)}/message`,
+        { parts: [{ type: 'text', text }] },
+        AbortSignal.timeout(MESSAGE_TIMEOUT_MS)
+      );
+      return (await res.json()) as unknown;
+    },
+
+    /**
+     * GET the connection base URL and map the outcome onto the host app's
+     * RemoteStatus vocabulary (packages/ui probeEndpoint()). Never throws —
+     * connection health is data, not an exception path.
+     */
+    async probeHealth(): Promise<HealthProbeResult> {
+      try {
+        const response = await fetchImpl(`${base}/`, {
+          method: 'GET',
+          headers: buildHeaders(),
+          credentials: 'omit',
+          signal: AbortSignal.timeout(PROBE_TIMEOUT_MS),
+        });
+        if (response.status === 401 || response.status === 403) {
+          return { state: 'unauthorized', detail: `HTTP ${response.status}` };
+        }
+        if (response.ok || (response.status >= 300 && response.status < 400)) {
+          return { state: 'accessible' };
+        }
+        return { state: 'unreachable', detail: `HTTP ${response.status}` };
+      } catch (error) {
+        return {
+          state: 'unreachable',
+          detail: error instanceof Error ? error.message : String(error),
+        };
+      }
+    },
+  };
+}
+
+/**
+ * Parse one '\n\n'-delimited SSE frame body. Multi-line `data:` fields are
+ * concatenated with '\n' per the SSE spec; comment lines (':…') and `retry:`
+ * fields are ignored (same behavior as packages/ui session-events.ts
+ * parseFrame()).
+ */
+function parseFrame(chunk: string): SseFrame {
+  const frame: SseFrame = {};
+  const dataLines: string[] = [];
+  for (const rawLine of chunk.split('\n')) {
+    if (!rawLine || rawLine.startsWith(':')) continue; // comment / heartbeat
+    if (rawLine.startsWith('data:')) {
+      dataLines.push(rawLine.replace(/^data:\s?/, ''));
+    } else if (rawLine.startsWith('event:')) {
+      frame.event = rawLine.replace(/^event:\s?/, '');
+    } else if (rawLine.startsWith('id:')) {
+      frame.id = rawLine.replace(/^id:\s?/, '');
+    }
+    // `retry:` is ignored — reconnect pacing is the consumer's concern.
+  }
+  if (dataLines.length > 0) frame.data = dataLines.join('\n');
+  return frame;
+}
+
+/**
+ * Parse a raw SSE byte stream into frames. Yields ONLY frames that carry at
+ * least one of event/data/id (comment-only and retry-only frames yield
+ * nothing); an unterminated trailing frame at end-of-stream is discarded
+ * (SSE spec). Frames split across chunk boundaries are buffered, and the
+ * decoder runs in streaming mode so multi-byte UTF-8 characters split
+ * mid-sequence decode correctly.
+ */
+export async function* parseSseStream(
+  stream: ReadableStream<Uint8Array>
+): AsyncGenerator<SseFrame, void, undefined> {
+  const reader = stream.getReader();
+  const decoder = new TextDecoder();
+  let buffer = '';
+  try {
+    while (true) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      buffer += decoder.decode(value, { stream: true });
+      const chunks = buffer.split('\n\n');
+      buffer = chunks.pop() ?? '';
+      for (const chunk of chunks) {
+        if (!chunk) continue;
+        const frame = parseFrame(chunk);
+        if (frame.event !== undefined || frame.data !== undefined || frame.id !== undefined) {
+          yield frame;
+        }
+      }
+    }
+  } finally {
+    reader.releaseLock();
+  }
+}

From 93cebe82de2066a6d51ed44bb8f28280641c4c76 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Mon, 6 Jul 2026 18:55:27 +0000
Subject: [PATCH 30/61] feat(client): SvelteKit static app, views, serve
 script, workspace wiring (#555)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

P5b items 3-4 for @openpalm/client (plan §6.9 Slice A/§6.10/§6.11):

- SvelteKit 2 + Svelte 5 app on adapter-static with SPA fallback
  (ssr=false, prerender=false) — no server runtime in the artifact, no
  src/lib/server/, no @openpalm/lib anywhere (§8.10; enforced by the
  purity dist-grep tests, now green against the built bundle).
- Views adapted from packages/ui onto the transport + IndexedDB store
  (packages/ui keeps its own chat until parity): /chat (session list/
  create + message send against the active connection; history + live SSE
  wiring follow with chat parity), /connections (client-side manager with
  per-connection direct health probes, locked/managed entries read-only),
  /connections/new -> /connections?new=1 alias. Root route redirects
  through resolveLanding(). Theme boot + Stillness tokens consumed from
  @openpalm/ui-kit (icons only — no ui-kit component that requires the
  $lib app contract, so the client supplies none yet).
- Per-connection credential material lives in the secret store
  (IndexedDB meta area) under auth.secretRef — entries never carry
  credentials inline, and nothing host-scoped exists to hold (§8.10).
- bin/serve.mjs: zero-dependency static file server — loopback bind by
  default, port via --port/PORT, SPA fallback to index.html, serves
  runtime-config.json from inside or beside the build, traversal-safe.
- scripts/stamp-version.mjs writes .openpalm-client-version into the
  build (same delivery-stamp pattern as packages/ui).
- Workspace wiring: root client:dev/build/check/test/serve scripts;
  client:check joins the root check chain. Runtime deps stay empty —
  the bundle is self-contained and the serve script is stdlib-only.
- tsconfig gates the app source at 0 errors/0 warnings via svelte-check
  --fail-on-warnings; the bun:test suite is excluded from that program
  (bun module rules: bun:test builtin, .ts-extension imports) and is
  executed by bun test instead.

All 64 package tests green (transport/store/landing/purity); checks
0/0 across ui, ui-kit, client; cli/lib/ui-vitest/electron at baseline
parity.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FetR7BttT1xBrA8fBwhui9
---
 .gitignore                                    |   1 +
 bun.lock                                      |  24 +-
 package.json                                  |   7 +-
 packages/client/bin/serve.mjs                 |  72 +++
 packages/client/package.json                  |  28 +-
 packages/client/scripts/stamp-version.mjs     |  18 +
 packages/client/src/app.css                   | 142 +++++
 packages/client/src/app.d.ts                  |  13 +
 packages/client/src/app.html                  |  51 ++
 packages/client/src/lib/boot.ts               |  48 ++
 .../src/lib/components/chat/ChatInput.svelte  | 181 +++++++
 .../src/lib/components/chat/ChatTurn.svelte   | 123 +++++
 .../client/src/lib/connections/secrets.ts     |  62 +++
 packages/client/src/routes/+layout.svelte     | 109 ++++
 packages/client/src/routes/+layout.ts         |   8 +
 packages/client/src/routes/+page.svelte       |   5 +
 packages/client/src/routes/+page.ts           |  15 +
 packages/client/src/routes/chat/+page.svelte  | 328 +++++++++++
 .../src/routes/connections/+page.svelte       | 512 ++++++++++++++++++
 .../src/routes/connections/new/+page.svelte   |   6 +
 .../src/routes/connections/new/+page.ts       |  13 +
 packages/client/svelte.config.js              |  22 +
 packages/client/tsconfig.json                 |  28 +
 packages/client/vite.config.ts                |  12 +
 24 files changed, 1820 insertions(+), 8 deletions(-)
 create mode 100644 packages/client/bin/serve.mjs
 create mode 100644 packages/client/scripts/stamp-version.mjs
 create mode 100644 packages/client/src/app.css
 create mode 100644 packages/client/src/app.d.ts
 create mode 100644 packages/client/src/app.html
 create mode 100644 packages/client/src/lib/boot.ts
 create mode 100644 packages/client/src/lib/components/chat/ChatInput.svelte
 create mode 100644 packages/client/src/lib/components/chat/ChatTurn.svelte
 create mode 100644 packages/client/src/lib/connections/secrets.ts
 create mode 100644 packages/client/src/routes/+layout.svelte
 create mode 100644 packages/client/src/routes/+layout.ts
 create mode 100644 packages/client/src/routes/+page.svelte
 create mode 100644 packages/client/src/routes/+page.ts
 create mode 100644 packages/client/src/routes/chat/+page.svelte
 create mode 100644 packages/client/src/routes/connections/+page.svelte
 create mode 100644 packages/client/src/routes/connections/new/+page.svelte
 create mode 100644 packages/client/src/routes/connections/new/+page.ts
 create mode 100644 packages/client/svelte.config.js
 create mode 100644 packages/client/tsconfig.json
 create mode 100644 packages/client/vite.config.ts

diff --git a/.gitignore b/.gitignore
index 58aecad53..745a320a7 100644
--- a/.gitignore
+++ b/.gitignore
@@ -8,6 +8,7 @@ CLAUDE.md
 packages/ui/.svelte-kit/
 packages/ui/build/
 packages/ui/dist/
+packages/client/build/
 packages/ui/undefined/
 packages/ui/.env
 packages/ui/.env.local
diff --git a/bun.lock b/bun.lock
index 0d5d0ff9a..4f36589fe 100644
--- a/bun.lock
+++ b/bun.lock
@@ -28,6 +28,20 @@
     "packages/client": {
       "name": "@openpalm/client",
       "version": "0.12.52",
+      "bin": {
+        "openpalm-client-serve": "bin/serve.mjs",
+      },
+      "devDependencies": {
+        "@openpalm/ui-kit": "workspace:*",
+        "@sveltejs/adapter-static": "^3.0.10",
+        "@sveltejs/kit": "^2.53.3",
+        "@sveltejs/vite-plugin-svelte": "^7.1.2",
+        "@types/node": "^25.9.1",
+        "svelte": "^5.53.5",
+        "svelte-check": "^4.1.1",
+        "typescript": "^6.0.3",
+        "vite": "^8.0.14",
+      },
     },
     "packages/electron": {
       "name": "@openpalm/electron",
@@ -439,6 +453,8 @@
 
     "@sveltejs/adapter-node": ["@sveltejs/adapter-node@5.5.4", "", { "dependencies": { "@rollup/plugin-commonjs": "^29.0.0", "@rollup/plugin-json": "^6.1.0", "@rollup/plugin-node-resolve": "^16.0.0", "rollup": "^4.59.0" }, "peerDependencies": { "@sveltejs/kit": "^2.4.0" } }, "sha512-45X92CXW+2J8ZUzPv3eLlKWEzINKiiGeFWTjyER4ZN4sGgNoaoeSkCY/QYNxHpPXy71QPsctwccBo9jJs0ySPQ=="],
 
+    "@sveltejs/adapter-static": ["@sveltejs/adapter-static@3.0.10", "", { "peerDependencies": { "@sveltejs/kit": "^2.0.0" } }, "sha512-7D9lYFWJmB7zxZyTE/qxjksvMqzMuYrrsyh1f4AlZqeZeACPRySjbC3aFiY55wb1tWUaKOQG9PVbm74JcN2Iew=="],
+
     "@sveltejs/kit": ["@sveltejs/kit@2.61.0", "", { "dependencies": { "@standard-schema/spec": "^1.0.0", "@sveltejs/acorn-typescript": "^1.0.9", "@types/cookie": "^0.6.0", "acorn": "^8.16.0", "cookie": "^0.6.0", "devalue": "^5.8.1", "esm-env": "^1.2.2", "kleur": "^4.1.5", "magic-string": "^0.30.5", "mrmime": "^2.0.0", "set-cookie-parser": "^3.0.0", "sirv": "^3.0.0" }, "peerDependencies": { "@opentelemetry/api": "^1.0.0", "@sveltejs/vite-plugin-svelte": "^3.0.0 || ^4.0.0-next.1 || ^5.0.0 || ^6.0.0-next.0 || ^7.0.0", "svelte": "^4.0.0 || ^5.0.0-next.0", "typescript": "^5.3.3 || ^6.0.0", "vite": "^5.0.3 || ^6.0.0 || ^7.0.0-beta.0 || ^8.0.0" }, "optionalPeers": ["@opentelemetry/api", "typescript"], "bin": { "svelte-kit": "svelte-kit.js" } }, "sha512-beYjgUux5ITbZeL0vn6gipZlsQiXF1/08C/3F+vlbDvthb/CTgYpZsYPdRIi9RxgTwRSkKIvnxyl+ViZlX4q5A=="],
 
     "@sveltejs/vite-plugin-svelte": ["@sveltejs/vite-plugin-svelte@7.1.2", "", { "dependencies": { "deepmerge": "^4.3.1", "magic-string": "^0.30.21", "obug": "^2.1.0", "vitefu": "^1.1.2" }, "peerDependencies": { "svelte": "^5.46.4", "vite": "^8.0.0-beta.7 || ^8.0.0" } }, "sha512-DrUBA2UXRfDmUX/ZTiEopd3X40yavsJF1FX2RygcuIScHL7o5YX1fMvoYnDhjeJQC4weCOklirpNWlcb2NiSeA=="],
@@ -881,7 +897,7 @@
 
     "fs.realpath": ["fs.realpath@1.0.0", "", {}, "sha512-OO0pH2lK6a0hZnAdau5ItzHPI6pUlvI7jMVnxUQRtw4owF2wk8lOSabtGDCTP4Ggrg2MbGnWO9X8K1t4+fGMDw=="],
 
-    "fsevents": ["fsevents@2.3.2", "", { "os": "darwin" }, "sha512-xiqMQR4xAeHTuB9uWm+fFRcIOgKBMiOBP+eXiyT7jsgVCq1bkVygt00oASowB7EdtpOHaaPgKt812P9ab+DDKA=="],
+    "fsevents": ["fsevents@2.3.3", "", { "os": "darwin" }, "sha512-5xoDfX+fL7faATnagmWPpbFtwh/R77WmMMqqHGS65C3vvB0YHrgF+B1YmZ3441tMj5n63k0212XNoJwzlhffQw=="],
 
     "function-bind": ["function-bind@1.1.2", "", {}, "sha512-7XHNxH7qX9xG5mIwxkhumTox/MIRNcOgDrxWsMt2pAr23WHp6MrRlN7FBSFpCpr+oVO0F744iUgR82nJMfG2SA=="],
 
@@ -1567,6 +1583,8 @@
 
     "p-queue/eventemitter3": ["eventemitter3@4.0.7", "", {}, "sha512-8guHBZCwKnFhYdHr2ysuRWErTwhoN2X8XELRlrRwpmfeY2jjuUN4taQMsULKUVo1K4DvZl+0pgfyoysHxvmvEw=="],
 
+    "playwright/fsevents": ["fsevents@2.3.2", "", { "os": "darwin" }, "sha512-xiqMQR4xAeHTuB9uWm+fFRcIOgKBMiOBP+eXiyT7jsgVCq1bkVygt00oASowB7EdtpOHaaPgKt812P9ab+DDKA=="],
+
     "postcss-load-config/yaml": ["yaml@1.10.3", "", {}, "sha512-vIYeF1u3CjlhAFekPPAk2h/Kv4T3mAkMox5OymRiJQB0spDP10LHvt+K7G9Ny6NuuMAb25/6n1qyUjAcGNf/AA=="],
 
     "postject/commander": ["commander@9.5.0", "", {}, "sha512-KRs7WVDKg86PWiuAqhDrAQnTXZKraVcCc6vFdL14qrZ/DcWwuRo7VoiYXalXO7S5GKpqYiVEwCbgFDfxNHKJBQ=="],
@@ -1579,8 +1597,6 @@
 
     "rollup/@types/estree": ["@types/estree@1.0.8", "", {}, "sha512-dWHzHa2WqEXI/O1E9OjrocMTKJl2mSrEolh1Iomrv6U+JuNwaHXsXx9bLu5gG7BUWFIN0skIQJQ/L1rIex4X6w=="],
 
-    "rollup/fsevents": ["fsevents@2.3.3", "", { "os": "darwin" }, "sha512-5xoDfX+fL7faATnagmWPpbFtwh/R77WmMMqqHGS65C3vvB0YHrgF+B1YmZ3441tMj5n63k0212XNoJwzlhffQw=="],
-
     "svelte-eslint-parser/eslint-scope": ["eslint-scope@8.4.0", "", { "dependencies": { "esrecurse": "^4.3.0", "estraverse": "^5.2.0" } }, "sha512-sNXOfKCn74rt8RICKMvJS7XKV/Xk9kA7DyJr8mJik3S7Cwgy3qlkkmyS2uQB3jiJg6VNdZd/pDBJu0nvG2NlTg=="],
 
     "svelte-eslint-parser/eslint-visitor-keys": ["eslint-visitor-keys@4.2.1", "", {}, "sha512-Uhdk5sfqcee/9H/rCOJikYz67o0a2Tw2hGRPOG2Y1R2dg7brRe1uG0yaNQDHu+TO/uQPF/5eCapvYSmHUjt7JQ=="],
@@ -1591,8 +1607,6 @@
 
     "type-is/content-type": ["content-type@2.0.0", "", {}, "sha512-j/O/d7GcZCyNl7/hwZAb606rzqkyvaDctLmckbxLzHvFBzTJHuGEdodATcP3yIRoDrLHkIATJuvzbFlp/ki2cQ=="],
 
-    "vite/fsevents": ["fsevents@2.3.3", "", { "os": "darwin" }, "sha512-5xoDfX+fL7faATnagmWPpbFtwh/R77WmMMqqHGS65C3vvB0YHrgF+B1YmZ3441tMj5n63k0212XNoJwzlhffQw=="],
-
     "@develar/schema-utils/ajv/json-schema-traverse": ["json-schema-traverse@0.4.1", "", {}, "sha512-xbbCH5dCYU5T8LcEhhuh7HJ88HXuW3qsI3Y0zOZFKfZEHcpWiHU/Jxzk629Brsab/mMiHQti9wMP+845RPe3Vg=="],
 
     "@electron/asar/minimatch/brace-expansion": ["brace-expansion@1.1.14", "", { "dependencies": { "balanced-match": "^1.0.0", "concat-map": "0.0.1" } }, "sha512-MWPGfDxnyzKU7rNOW9SP/c50vi3xrmrua/+6hfPbCS2ABNWfx24vPidzvC7krjU/RTo235sV776ymlsMtGKj8g=="],
diff --git a/package.json b/package.json
index 8e719d06e..40d164a31 100644
--- a/package.json
+++ b/package.json
@@ -27,6 +27,11 @@
     "electron:dev:fast": "bun run --cwd packages/electron bundle && OP_HOME=/tmp/openpalm-electron-dev OPENPALM_REPO_ROOT=\"$PWD\" bun run --cwd packages/electron start",
     "ui:check": "bun run --cwd packages/ui check",
     "ui-kit:check": "bun run --cwd packages/ui-kit check",
+    "client:dev": "bun run --cwd packages/client dev",
+    "client:build": "bun run --cwd packages/client build",
+    "client:check": "bun run --cwd packages/client check",
+    "client:test": "bun test --cwd packages/client",
+    "client:serve": "node packages/client/bin/serve.mjs",
     "ui:test": "cd packages/ui && npm test",
     "ui:test:unit": "cd packages/ui && npm run test:unit -- --run",
     "ui:test:e2e": "source scripts/load-test-env.sh && cd packages/ui && RUN_DOCKER_STACK_TESTS=1 RUN_LLM_TESTS=1 PW_ENFORCE_NO_SKIP=1 npm run test:e2e",
@@ -57,7 +62,7 @@
     "test": "bun test --no-orphans portals/discord portals/slack packages/portal-sdk packages/cli packages/lib packages/ui-kit packages/electron/admin-tools packages/guardian/ scripts/",
     "analysis:fta": "npx -y fta-cli . -c .fta.json --json | python3 -c \"import json,sys;d=sorted(json.load(sys.stdin),key=lambda x:x['fta_score'],reverse=True);c={};[c.__setitem__(f['assessment'],c.get(f['assessment'],0)+1) for f in d];s=[f['fta_score'] for f in d];print(f'\\n=== FTA Code Complexity Report ({len(d)} files) ===');print(f'Mean: {sum(s)/len(s):.1f} | Median: {sorted(s)[len(s)//2]:.1f} | Max: {max(s):.1f}');print();[print(f'  {a}: {n}') for a,n in sorted(c.items(),key=lambda x:-x[1])];print(f'\\n=== Top 20 Most Complex Files ===');print(f\\\"{'Score':>7}  {'Cyclo':>5}  {'Lines':>5}  {'Assessment':<20}  File\\\");print('-'*100);[print(f\\\"{f['fta_score']:7.1f}  {f['cyclo']:5d}  {f['line_count']:5d}  {f['assessment']:<20}  {f['file_name']}\\\") for f in d[:20]];ni=[f for f in d if f['fta_score']>60];print(f'\\n=== Needs Improvement ({len(ni)} files) ===');[print(f\\\"  {f['fta_score']:6.1f}  {f['file_name']}\\\") for f in ni]\"",
     "analysis:fta:json": "npx -y fta-cli . -c fta.json --json",
-    "check": "bun run ui:check && bun run ui-kit:check",
+    "check": "bun run ui:check && bun run ui-kit:check && bun run client:check",
     "lint": "biome lint .",
     "lint:fix": "biome lint --write .",
     "format": "biome format --write .",
diff --git a/packages/client/bin/serve.mjs b/packages/client/bin/serve.mjs
new file mode 100644
index 000000000..785fd9373
--- /dev/null
+++ b/packages/client/bin/serve.mjs
@@ -0,0 +1,72 @@
+#!/usr/bin/env node
+/**
+ * Zero-dependency static file server for the @openpalm/client build (P5b
+ * item 4, #555; plan §6.9 Slice A / §6.10). Serves the adapter-static
+ * bundle with an SPA fallback to index.html, plus a runtime-config.json if
+ * one exists beside the build (the assistant container writes it in P5d).
+ *
+ * No API routes, no @openpalm/lib, no auth — this process serves bytes.
+ * Binds loopback by default; pass --host only where the surrounding policy
+ * already gates exposure (e.g. inside the assistant container, #510).
+ *
+ * Usage: serve.mjs [--port N] [--host ADDR] [--dir PATH]
+ * Env:   PORT, HOST, OP_CLIENT_DIR
+ */
+import { createReadStream, existsSync, statSync } from 'node:fs';
+import { createServer } from 'node:http';
+import { extname, join, normalize, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+function arg(name) {
+  const index = process.argv.indexOf(`--${name}`);
+  return index !== -1 ? process.argv[index + 1] : undefined;
+}
+
+const port = Number(arg('port') ?? process.env.PORT ?? 4180);
+const host = arg('host') ?? process.env.HOST ?? '127.0.0.1';
+const dir = resolve(
+  arg('dir') ?? process.env.OP_CLIENT_DIR ?? join(fileURLToPath(new URL('..', import.meta.url)), 'build')
+);
+
+const MIME = {
+  '.html': 'text/html; charset=utf-8',
+  '.js': 'text/javascript; charset=utf-8',
+  '.mjs': 'text/javascript; charset=utf-8',
+  '.css': 'text/css; charset=utf-8',
+  '.json': 'application/json; charset=utf-8',
+  '.svg': 'image/svg+xml',
+  '.png': 'image/png',
+  '.ico': 'image/x-icon',
+  '.webmanifest': 'application/manifest+json',
+  '.woff2': 'font/woff2',
+  '.txt': 'text/plain; charset=utf-8',
+};
+
+function send(res, path, status = 200) {
+  res.writeHead(status, { 'content-type': MIME[extname(path)] ?? 'application/octet-stream' });
+  createReadStream(path).pipe(res);
+}
+
+const server = createServer((req, res) => {
+  const pathname = decodeURIComponent(new URL(req.url ?? '/', 'http://x').pathname);
+  // normalize() collapses any ../ segments; the join stays inside dir.
+  const candidate = join(dir, normalize(join('/', pathname)));
+  if (existsSync(candidate) && statSync(candidate).isFile()) return send(res, candidate);
+  // runtime-config.json may live beside the build dir instead of inside it
+  // (the assistant container writes it next to the extracted bundle, P5d).
+  if (pathname === '/runtime-config.json') {
+    const sibling = join(dir, '..', 'runtime-config.json');
+    if (existsSync(sibling) && statSync(sibling).isFile()) return send(res, sibling);
+    res.writeHead(404, { 'content-type': 'text/plain; charset=utf-8' });
+    return res.end('no runtime-config.json');
+  }
+  // SPA fallback: every route is client-rendered from index.html.
+  const fallback = join(dir, 'index.html');
+  if (existsSync(fallback)) return send(res, fallback);
+  res.writeHead(404, { 'content-type': 'text/plain; charset=utf-8' });
+  res.end('client build not found — run `bun run client:build`');
+});
+
+server.listen(port, host, () => {
+  console.log(`[openpalm-client] serving ${dir} on http://${host}:${port}`);
+});
diff --git a/packages/client/package.json b/packages/client/package.json
index e3a8d5217..8902730c8 100644
--- a/packages/client/package.json
+++ b/packages/client/package.json
@@ -1,7 +1,7 @@
 {
   "name": "@openpalm/client",
   "version": "0.12.52",
-  "description": "OpenPalm client app — the unprivileged chat/connections static PWA (plan ui-runtime-modes-plan.md §6.11). P5b test-first scaffolding: this package currently carries only the red test suite; the SvelteKit app, transport, connection store, and serve script land with the P5b feature commits. §8.10 rule: this package NEVER depends on @openpalm/lib and never holds host credentials; runtime dependencies stay empty or near-empty (document any exception here).",
+  "description": "OpenPalm client app — the unprivileged chat/connections static SPA (plan ui-runtime-modes-plan.md §6.11). Talks directly to per-connection OpenCode/guardian base URLs; connections persist in IndexedDB. §8.10 rule: this package NEVER depends on @openpalm/lib and never holds host credentials; runtime dependencies stay empty (the adapter-static build is fully self-contained, and bin/serve.mjs is zero-dependency) — document any exception here.",
   "private": true,
   "license": "MPL-2.0",
   "type": "module",
@@ -10,7 +10,31 @@
     "url": "https://github.com/itlackey/openpalm.git",
     "directory": "packages/client"
   },
+  "files": [
+    "build",
+    "bin"
+  ],
+  "bin": {
+    "openpalm-client-serve": "bin/serve.mjs"
+  },
   "scripts": {
-    "test": "bun test"
+    "dev": "PORT=${PORT:-5174} vite dev",
+    "build": "svelte-kit sync && vite build && node scripts/stamp-version.mjs",
+    "clean:build": "rm -rf .svelte-kit build",
+    "preview": "vite preview",
+    "check": "svelte-kit sync && svelte-check --tsconfig ./tsconfig.json --fail-on-warnings",
+    "test": "bun test",
+    "serve": "node bin/serve.mjs"
+  },
+  "devDependencies": {
+    "@openpalm/ui-kit": "workspace:*",
+    "@sveltejs/adapter-static": "^3.0.10",
+    "@types/node": "^25.9.1",
+    "@sveltejs/kit": "^2.53.3",
+    "@sveltejs/vite-plugin-svelte": "^7.1.2",
+    "svelte": "^5.53.5",
+    "svelte-check": "^4.1.1",
+    "typescript": "^6.0.3",
+    "vite": "^8.0.14"
   }
 }
diff --git a/packages/client/scripts/stamp-version.mjs b/packages/client/scripts/stamp-version.mjs
new file mode 100644
index 000000000..43fb1d165
--- /dev/null
+++ b/packages/client/scripts/stamp-version.mjs
@@ -0,0 +1,18 @@
+// Writes the package version into the client build root as
+// `.openpalm-client-version` — same pattern as packages/ui's stamp
+// (`.openpalm-ui-version`): the stamp travels with the static bundle
+// wherever it is copied/extracted so hosts can compare delivery channels
+// by version (plan §3 exact-pin delivery; P5b, #555).
+import { existsSync, readFileSync, writeFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const pkgRoot = join(dirname(fileURLToPath(import.meta.url)), '..');
+const buildDir = join(pkgRoot, 'build');
+if (!existsSync(buildDir)) {
+  console.error(`[stamp-version] build dir not found at ${buildDir} — run the build first`);
+  process.exit(1);
+}
+const { version } = JSON.parse(readFileSync(join(pkgRoot, 'package.json'), 'utf-8'));
+writeFileSync(join(buildDir, '.openpalm-client-version'), `${version}\n`);
+console.log(`[stamp-version] stamped client build as ${version}`);
diff --git a/packages/client/src/app.css b/packages/client/src/app.css
new file mode 100644
index 000000000..b982b0054
--- /dev/null
+++ b/packages/client/src/app.css
@@ -0,0 +1,142 @@
+@import url('https://fonts.googleapis.com/css2?family=Poor+Story&family=Iosevka+Charon+Mono:ital,wght@0,300;0,400;0,500;0,700;1,300;1,400;1,500;1,700&display=swap');
+/* Stillness design-system tokens live in the shared ui-kit (plan §6.11).
+   Vite resolves the package specifier and inlines the file at build time.
+   Must stay above all style rules — CSS ignores @import after the first
+   rule. The reset/base/button rules below are the client's subset of
+   packages/ui/src/app.css (host-app-only chrome omitted). */
+@import '@openpalm/ui-kit/theme/tokens.css';
+
+/* Brushed icon filter — applied to all .s-icon SVGs. The #ibrush filter is
+   defined once in the root layout. */
+.s-icon { filter: url(#ibrush); }
+
+/* ── Reset & Base ──────────────────────────────────────────────────── */
+
+*,
+*::before,
+*::after {
+  box-sizing: border-box;
+  margin: 0;
+  padding: 0;
+}
+
+html {
+  -webkit-font-smoothing: antialiased;
+  -moz-osx-font-smoothing: grayscale;
+  text-rendering: optimizeLegibility;
+  font-size: 16px;
+  color-scheme: light;
+}
+
+html[data-theme='dark'] {
+  color-scheme: dark;
+}
+
+body {
+  font-family: var(--s-font-display);
+  font-size: var(--s-type-whisper);
+  line-height: 1.6;
+  color: var(--s-ink);
+  background: var(--s-paper);
+  min-height: 100vh;
+}
+
+h1, h2, h3, h4 {
+  font-family: var(--s-font-header);
+}
+
+/* ── Scrollbar ─────────────────────────────────────────────────────── */
+
+* {
+  scrollbar-width: thin;
+  scrollbar-color: var(--s-line) transparent;
+}
+
+::-webkit-scrollbar {
+  width: 4px;
+  height: 4px;
+}
+
+::-webkit-scrollbar-track {
+  background: transparent;
+}
+
+::-webkit-scrollbar-thumb {
+  background: var(--s-line);
+  border-radius: 0;
+}
+
+/* ── Focus & Accessibility ─────────────────────────────────────────── */
+
+:focus-visible {
+  outline: 2px solid var(--s-seal);
+  outline-offset: 2px;
+}
+
+/* ── Shared Utility: Buttons ───────────────────────────────────────── */
+
+.btn {
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  gap: 0.5rem;
+  padding: 0.5rem 0.9rem;
+  min-height: 2rem;
+  font-family: var(--s-font-mono);
+  font-size: var(--s-type-mark);
+  letter-spacing: var(--s-track-label);
+  text-transform: uppercase;
+  font-weight: 400;
+  border: var(--s-hair) solid var(--s-line);
+  border-radius: 2px;
+  background: none;
+  color: var(--s-ink-3);
+  cursor: pointer;
+  transition: color 0.2s ease, border-color 0.2s ease;
+  white-space: nowrap;
+}
+
+.btn:disabled {
+  opacity: 0.38;
+  cursor: not-allowed;
+}
+
+.btn-primary {
+  border-color: var(--s-seal);
+  color: var(--s-seal);
+  background: none;
+}
+
+.btn-primary:hover:not(:disabled) {
+  background: color-mix(in srgb, var(--s-seal) 8%, transparent);
+  border-color: var(--s-seal);
+}
+
+.btn-secondary {
+  background: none;
+  color: var(--s-ink-3);
+  border-color: var(--s-line);
+}
+
+.btn-secondary:hover:not(:disabled) {
+  color: var(--s-ink-2);
+  border-color: var(--s-line);
+}
+
+.btn-danger {
+  border-color: color-mix(in srgb, var(--s-error) 50%, transparent);
+  color: var(--s-error);
+  background: none;
+  opacity: 0.8;
+}
+
+.btn-danger:hover:not(:disabled) {
+  opacity: 1;
+  border-color: var(--s-error);
+}
+
+.btn-sm {
+  padding: 0.3rem 0.7rem;
+  min-height: 1.6rem;
+  font-size: 0.58rem;
+}
diff --git a/packages/client/src/app.d.ts b/packages/client/src/app.d.ts
new file mode 100644
index 000000000..520c4217a
--- /dev/null
+++ b/packages/client/src/app.d.ts
@@ -0,0 +1,13 @@
+// See https://svelte.dev/docs/kit/types#app.d.ts
+// for information about these interfaces
+declare global {
+  namespace App {
+    // interface Error {}
+    // interface Locals {}
+    // interface PageData {}
+    // interface PageState {}
+    // interface Platform {}
+  }
+}
+
+export {};
diff --git a/packages/client/src/app.html b/packages/client/src/app.html
new file mode 100644
index 000000000..ce67e6adb
--- /dev/null
+++ b/packages/client/src/app.html
@@ -0,0 +1,51 @@
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1" />
+    <meta name="theme-color" content="#ffffff" />
+    <meta name="color-scheme" content="light" />
+    <script>
+      // Theme boot — same storage key and resolution order as the host app
+      // so a browser that uses both stays on one theme.
+      (() => {
+        const storageKey = 'openpalm.theme';
+        const darkThemeColor = '#161c22';
+        const lightThemeColor = '#f9fafb';
+
+        try {
+          const stored = window.localStorage.getItem(storageKey);
+          const preference = stored === 'light' || stored === 'dark' || stored === 'system' ? stored : 'system';
+          const resolved = preference === 'system'
+            ? (window.matchMedia?.('(prefers-color-scheme: dark)')?.matches ? 'dark' : 'light')
+            : preference;
+          const root = document.documentElement;
+          root.setAttribute('data-theme', resolved);
+          root.style.colorScheme = resolved;
+
+          const themeColorMeta = document.querySelector('meta[name="theme-color"]');
+          if (themeColorMeta) {
+            themeColorMeta.setAttribute('content', resolved === 'dark' ? darkThemeColor : lightThemeColor);
+          }
+
+          const colorSchemeMeta = document.querySelector('meta[name="color-scheme"]');
+          if (colorSchemeMeta) {
+            colorSchemeMeta.setAttribute('content', resolved);
+          }
+        } catch {
+          // Keep the default light metadata if storage access is unavailable.
+        }
+      })();
+    </script>
+    <link rel="preconnect" href="https://fonts.googleapis.com" />
+    <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin />
+    <link
+      href="https://fonts.googleapis.com/css2?family=Source+Sans+3:wght@400;500;600;700&family=IBM+Plex+Mono:wght@400;500&display=swap"
+      rel="stylesheet"
+    />
+    %sveltekit.head%
+  </head>
+  <body data-sveltekit-preload-data="hover">
+    <div style="display: contents">%sveltekit.body%</div>
+  </body>
+</html>
diff --git a/packages/client/src/lib/boot.ts b/packages/client/src/lib/boot.ts
new file mode 100644
index 000000000..73f9ae382
--- /dev/null
+++ b/packages/client/src/lib/boot.ts
@@ -0,0 +1,48 @@
+/**
+ * Client boot (P5b, #555): one storage backend + one ConnectionStore +
+ * one SecretStore per browsing session, seeded once from the origin's
+ * runtime-config.json (plan §6.6 — the assistant container writes the file
+ * beside the static build in P5d; absent file = no default connection).
+ *
+ * Every route awaits getClientBoot(), so the seed runs exactly once no
+ * matter which page the SPA fallback lands on first. Offline boots resolve
+ * too: loadRuntimeConfig() -> null -> seed no-op -> stored connections
+ * remain readable (plan §6.10).
+ */
+import {
+  type ConnectionStorage,
+  type ConnectionStore,
+  createConnectionStore,
+  createIndexedDbStorage,
+  createMemoryStorage,
+  loadRuntimeConfig,
+} from './connections/index.js';
+import { createSecretStore, type SecretStore } from './connections/secrets.js';
+
+export type ClientBoot = {
+  store: ConnectionStore;
+  secrets: SecretStore;
+};
+
+let bootPromise: Promise<ClientBoot> | null = null;
+
+function pickStorage(): ConnectionStorage {
+  // Some private-browsing modes refuse IndexedDB entirely; degrade to a
+  // session-only in-memory backend rather than a blank page.
+  try {
+    if (typeof indexedDB !== 'undefined') return createIndexedDbStorage();
+  } catch {
+    // fall through
+  }
+  return createMemoryStorage();
+}
+
+export function getClientBoot(): Promise<ClientBoot> {
+  bootPromise ??= (async () => {
+    const storage = pickStorage();
+    const store = createConnectionStore({ storage });
+    await store.seedFromRuntimeConfig(await loadRuntimeConfig());
+    return { store, secrets: createSecretStore(storage) };
+  })();
+  return bootPromise;
+}
diff --git a/packages/client/src/lib/components/chat/ChatInput.svelte b/packages/client/src/lib/components/chat/ChatInput.svelte
new file mode 100644
index 000000000..406f36787
--- /dev/null
+++ b/packages/client/src/lib/components/chat/ChatInput.svelte
@@ -0,0 +1,181 @@
+<script lang="ts">
+  // Composer — adapted from packages/ui ChatInput.svelte (P5b item 3, #555)
+  // minus the voice affordances (voice is host-app-only for now).
+  import IconSend from '@openpalm/ui-kit/components/icons/IconSend.svelte';
+
+  interface Props {
+    sending: boolean;
+    onSend: (text: string) => void;
+  }
+
+  let { sending, onSend }: Props = $props();
+
+  let inputText = $state('');
+  let textareaEl = $state<HTMLTextAreaElement | undefined>();
+
+  const isActive = $derived(inputText.trim().length > 0);
+
+  function handleKeydown(e: KeyboardEvent): void {
+    if (e.key === 'Enter' && !e.shiftKey) {
+      e.preventDefault();
+      submit();
+    }
+  }
+
+  function submit(): void {
+    const text = inputText.trim();
+    if (!text || sending) return;
+    onSend(text);
+    inputText = '';
+    if (textareaEl) {
+      textareaEl.style.height = 'auto';
+    }
+  }
+
+  function handleInput(): void {
+    if (!textareaEl) return;
+    textareaEl.style.height = 'auto';
+    textareaEl.style.height = `${Math.min(textareaEl.scrollHeight, window.innerHeight * 0.3)}px`;
+  }
+</script>
+
+<form
+  class="s-composer"
+  class:active={isActive}
+  class:sending
+  onsubmit={(e) => { e.preventDefault(); submit(); }}
+>
+  <textarea
+    bind:this={textareaEl}
+    bind:value={inputText}
+    onkeydown={handleKeydown}
+    oninput={handleInput}
+    placeholder={sending ? '' : 'Write a message...'}
+    rows="1"
+    disabled={sending}
+    aria-label="Message input"
+    autocomplete="off"
+    spellcheck="false"
+  ></textarea>
+  <div class="s-footer">
+    <div class="s-rule"></div>
+    <button
+      class="s-send-btn"
+      type="submit"
+      aria-label="Send message"
+      disabled={!isActive || sending}
+    >
+      <IconSend size={16} />
+    </button>
+  </div>
+</form>
+
+<style>
+  .s-composer {
+    width: min(34rem, 100%);
+    display: flex;
+    flex-direction: column;
+    align-items: center;
+    gap: 0.125rem;
+  }
+
+  @media (max-width: 32rem) {
+    .s-composer {
+      padding-inline: clamp(1rem, 6vw, 2.5rem);
+    }
+  }
+
+  .s-composer textarea {
+    width: 100%;
+    resize: none;
+    border: 0;
+    outline: 0;
+    background: none;
+    font-family: var(--s-font-header);
+    font-weight: 400;
+    font-size: var(--s-type-compose);
+    line-height: 1.5;
+    text-align: center;
+    color: var(--s-ink);
+    overflow: hidden;
+    max-height: 30vh;
+    padding: 0.2rem 0;
+    transition: color var(--s-t-theme) var(--s-ease);
+  }
+
+  .s-footer {
+    display: flex;
+    align-items: center;
+    gap: 0.4rem;
+    width: 100%;
+  }
+
+  .s-send-btn {
+    flex-shrink: 0;
+    appearance: none;
+    border: 0;
+    background: none;
+    cursor: pointer;
+    color: var(--s-ink-3);
+    min-width: 44px;
+    min-height: 44px;
+    margin-block: -0.6rem;
+    padding: 0.25rem;
+    display: flex;
+    align-items: center;
+    justify-content: center;
+    border-radius: 50%;
+    transition: color var(--s-t-quick) var(--s-ease);
+  }
+
+  .s-send-btn:hover { color: var(--s-ink); }
+  .s-send-btn:active { transform: scale(0.9); }
+
+  .s-send-btn:disabled {
+    opacity: 0.35;
+    cursor: default;
+  }
+
+  .s-composer textarea::placeholder {
+    color: var(--s-ink-3);
+    opacity: 1;
+  }
+
+  .s-composer textarea:disabled {
+    opacity: 0.5;
+    cursor: default;
+  }
+
+  .s-rule {
+    flex: 1;
+    height: 1px;
+    background: var(--s-line);
+    position: relative;
+    transition: background var(--s-t-quick) var(--s-ease);
+  }
+
+  .s-rule::after {
+    content: "";
+    position: absolute;
+    inset: 0;
+    background: var(--s-seal);
+    transform: scaleX(0);
+    transform-origin: center;
+    opacity: 0.7;
+    transition: transform var(--s-t-quick) var(--s-ease);
+  }
+
+  .s-composer.active .s-rule::after {
+    transform: scaleX(0.5);
+  }
+
+  @media (prefers-reduced-motion: reduce) {
+    .s-send-btn:active {
+      transform: none;
+    }
+
+    .s-send-btn {
+      transition: none;
+    }
+  }
+</style>
diff --git a/packages/client/src/lib/components/chat/ChatTurn.svelte b/packages/client/src/lib/components/chat/ChatTurn.svelte
new file mode 100644
index 000000000..dd414381e
--- /dev/null
+++ b/packages/client/src/lib/components/chat/ChatTurn.svelte
@@ -0,0 +1,123 @@
+<script lang="ts">
+  // One chat turn — adapted from packages/ui ChatMessage.svelte (P5b item 3,
+  // #555). The client renders assistant text as plain text (pre-wrap) for
+  // the thin slice; markdown rendering follows with chat parity.
+  import { onMount } from 'svelte';
+
+  interface Props {
+    role: 'user' | 'assistant';
+    text: string;
+  }
+
+  let { role, text }: Props = $props();
+
+  let settled = $state(false);
+
+  onMount(() => {
+    if (role === 'assistant') {
+      requestAnimationFrame(() => {
+        settled = true;
+      });
+    }
+  });
+</script>
+
+{#if role === 'user'}
+  <div class="turn you">
+    <div class="you-words">{text}</div>
+    <div class="mark">You</div>
+  </div>
+{:else}
+  <div class="turn master">
+    <div class="master-words" class:settled>
+      <p>{text}</p>
+    </div>
+    <div class="mark">Assistant</div>
+  </div>
+{/if}
+
+<style>
+  .turn {
+    display: flex;
+    flex-direction: column;
+  }
+
+  /* The person — small, soft, whispered — sits right */
+  .turn.you {
+    align-items: flex-end;
+    text-align: right;
+  }
+
+  .mark {
+    font-family: var(--s-font-mono);
+    font-size: var(--s-type-mark);
+    letter-spacing: var(--s-track-mark);
+    text-transform: uppercase;
+    color: var(--s-ink-3);
+    white-space: nowrap;
+    margin-top: var(--s-sp-3);
+  }
+
+  .you-words {
+    font-family: var(--s-font-header);
+    font-weight: 300;
+    font-size: var(--s-type-whisper);
+    line-height: 1.5;
+    color: var(--s-ink-2);
+    max-width: 80%;
+    text-wrap: pretty;
+    white-space: pre-wrap;
+    border-width: 0 0 var(--s-hair);
+    border-style: solid;
+    border-color: color-mix(in srgb, var(--s-ink) 10%, transparent);
+    border-radius: 0 0 10px 0;
+    padding: 0 var(--s-sp-4) var(--s-sp-2);
+  }
+
+  /* The agent — large, calm, unhurried */
+  .turn.master {
+    gap: 0.9rem;
+  }
+
+  .master-words {
+    font-family: var(--s-font-header);
+    font-weight: 300;
+    font-size: 1.6rem;
+    line-height: 1.42;
+    letter-spacing: 0.002em;
+    color: var(--s-ink);
+    text-wrap: pretty;
+    white-space: pre-wrap;
+    max-width: 80%;
+    opacity: 0;
+    filter: blur(7px);
+    transform: translateY(5px);
+    transition:
+      opacity var(--s-t-bloom) var(--s-ease),
+      filter var(--s-t-bloom) var(--s-ease),
+      transform var(--s-t-bloom) var(--s-ease);
+    border-width: var(--s-hair) 0 3px;
+    border-style: solid;
+    border-color: color-mix(in srgb, var(--s-ink) 9%, transparent);
+    border-radius: 20px;
+    padding: var(--s-sp-3) var(--s-sp-4) var(--s-sp-4);
+  }
+
+  .master-words.settled {
+    opacity: 1;
+    filter: blur(0);
+    transform: none;
+  }
+
+  .master-words p {
+    margin: 0;
+  }
+
+  @media (prefers-reduced-motion: reduce) {
+    .master-words {
+      transition: opacity 0.4s var(--s-ease);
+      filter: none;
+      transform: none;
+    }
+  }
+</style>
diff --git a/packages/client/src/lib/connections/secrets.ts b/packages/client/src/lib/connections/secrets.ts
new file mode 100644
index 000000000..f4d569169
--- /dev/null
+++ b/packages/client/src/lib/connections/secrets.ts
@@ -0,0 +1,62 @@
+/**
+ * Per-connection credential material (plan ui-runtime-modes-plan.md §6.6,
+ * §6.8): a ConnectionEntry carries only `auth.secretRef` — the actual
+ * Basic/Bearer material lives here, in the same client-side storage backend
+ * (IndexedDB in the browser), keyed by that ref. These are CONNECTION
+ * credentials the user pasted for a guardian/OpenCode endpoint — never host
+ * credentials (§8.10).
+ */
+import type { ConnectionAuth } from '../transport/index.js';
+import type { ConnectionEntry, ConnectionStorage } from './index.js';
+
+export type SecretMaterial = {
+  username?: string;
+  password?: string;
+  token?: string;
+};
+
+export type SecretStore = {
+  set(ref: string, material: SecretMaterial): Promise<void>;
+  delete(ref: string): Promise<void>;
+  /**
+   * Build the transport auth for a connection. Missing or unreadable secret
+   * material degrades to { mode: 'none' } — the health probe then reports
+   * 'unauthorized' instead of the app crashing.
+   */
+  resolveAuth(entry: ConnectionEntry): Promise<ConnectionAuth>;
+};
+
+const META_PREFIX = 'secret:';
+
+export function createSecretStore(storage: ConnectionStorage): SecretStore {
+  return {
+    async set(ref, material) {
+      await storage.setMeta(META_PREFIX + ref, JSON.stringify(material));
+    },
+
+    async delete(ref) {
+      await storage.setMeta(META_PREFIX + ref, null);
+    },
+
+    async resolveAuth(entry) {
+      if (entry.auth.mode === 'none' || !entry.auth.secretRef) return { mode: 'none' };
+      const raw = await storage.getMeta(META_PREFIX + entry.auth.secretRef);
+      if (raw === null) return { mode: 'none' };
+      let material: SecretMaterial;
+      try {
+        material = JSON.parse(raw) as SecretMaterial;
+      } catch {
+        return { mode: 'none' };
+      }
+      if (entry.auth.mode === 'basic' && typeof material.password === 'string') {
+        return material.username
+          ? { mode: 'basic', username: material.username, password: material.password }
+          : { mode: 'basic', password: material.password };
+      }
+      if (entry.auth.mode === 'bearer' && typeof material.token === 'string') {
+        return { mode: 'bearer', token: material.token };
+      }
+      return { mode: 'none' };
+    },
+  };
+}
diff --git a/packages/client/src/routes/+layout.svelte b/packages/client/src/routes/+layout.svelte
new file mode 100644
index 000000000..c22a46ac6
--- /dev/null
+++ b/packages/client/src/routes/+layout.svelte
@@ -0,0 +1,109 @@
+<script lang="ts">
+  import '../app.css';
+  import { page } from '$app/state';
+  import IconChat from '@openpalm/ui-kit/components/icons/IconChat.svelte';
+  import IconConnect from '@openpalm/ui-kit/components/icons/IconConnect.svelte';
+
+  interface Props {
+    children?: import('svelte').Snippet;
+  }
+
+  let { children }: Props = $props();
+
+  const path = $derived(page.url.pathname);
+</script>
+
+<!-- ibrush filter: hand-drawn brush displacement used by all icon components -->
+<svg width="0" height="0" style="position:absolute" aria-hidden="true">
+  <defs>
+    <filter id="ibrush" x="-40%" y="-40%" width="180%" height="180%">
+      <feTurbulence type="fractalNoise" baseFrequency="0.026 0.032" numOctaves="1" seed="3" result="nA"/>
+      <feDisplacementMap in="SourceGraphic" in2="nA" scale="2.4" xChannelSelector="R" yChannelSelector="G" result="dA"/>
+      <feTurbulence type="fractalNoise" baseFrequency="0.034 0.028" numOctaves="1" seed="17" result="nB"/>
+      <feDisplacementMap in="SourceGraphic" in2="nB" scale="3.0" xChannelSelector="R" yChannelSelector="G" result="dB"/>
+      <feMerge result="strokes"><feMergeNode in="dA"/><feMergeNode in="dB"/></feMerge>
+      <feTurbulence type="turbulence" baseFrequency="0.7 0.7" numOctaves="2" seed="7" result="g"/>
+      <feComponentTransfer in="g" result="gm"><feFuncA type="linear" slope="0.55" intercept="0.52"/></feComponentTransfer>
+      <feComposite in="strokes" in2="gm" operator="in"/>
+    </filter>
+  </defs>
+</svg>
+
+<div class="shell">
+  <header class="topbar">
+    <a class="brand" href="/chat">OpenPalm</a>
+    <nav aria-label="Primary">
+      <a href="/chat" class="nav-link" class:current={path.startsWith('/chat')} aria-current={path.startsWith('/chat') ? 'page' : undefined}>
+        <IconChat size={14} />
+        <span>Chat</span>
+      </a>
+      <a href="/connections" class="nav-link" class:current={path.startsWith('/connections')} aria-current={path.startsWith('/connections') ? 'page' : undefined}>
+        <IconConnect size={14} />
+        <span>Connections</span>
+      </a>
+    </nav>
+  </header>
+
+  <div class="content">
+    {@render children?.()}
+  </div>
+</div>
+
+<style>
+  .shell {
+    display: flex;
+    flex-direction: column;
+    min-height: 100dvh;
+  }
+
+  .topbar {
+    display: flex;
+    align-items: center;
+    justify-content: space-between;
+    gap: var(--s-sp-4);
+    padding: var(--s-sp-3) var(--s-sp-5);
+    border-bottom: var(--s-hair) solid var(--s-line);
+  }
+
+  .brand {
+    font-family: var(--s-font-header);
+    font-size: 1.05rem;
+    color: var(--s-ink);
+    text-decoration: none;
+  }
+
+  nav {
+    display: flex;
+    gap: var(--s-sp-2);
+  }
+
+  .nav-link {
+    display: inline-flex;
+    align-items: center;
+    gap: 0.4rem;
+    padding: 0.35rem 0.7rem;
+    font-family: var(--s-font-mono);
+    font-size: var(--s-type-mark);
+    letter-spacing: var(--s-track-label);
+    text-transform: uppercase;
+    color: var(--s-ink-3);
+    text-decoration: none;
+    border-bottom: 2px solid transparent;
+  }
+
+  .nav-link:hover {
+    color: var(--s-ink);
+  }
+
+  .nav-link.current {
+    color: var(--s-ink);
+    border-bottom-color: var(--s-seal);
+  }
+
+  .content {
+    flex: 1;
+    display: flex;
+    flex-direction: column;
+    min-height: 0;
+  }
+</style>
diff --git a/packages/client/src/routes/+layout.ts b/packages/client/src/routes/+layout.ts
new file mode 100644
index 000000000..9a34d50d7
--- /dev/null
+++ b/packages/client/src/routes/+layout.ts
@@ -0,0 +1,8 @@
+/**
+ * Pure SPA (plan ui-runtime-modes-plan.md §6.10/§6.11): no SSR, no
+ * prerendered pages — adapter-static emits the index.html fallback and
+ * every route renders in the browser against IndexedDB + the per-connection
+ * transports. There is no server runtime in this artifact at all.
+ */
+export const ssr = false;
+export const prerender = false;
diff --git a/packages/client/src/routes/+page.svelte b/packages/client/src/routes/+page.svelte
new file mode 100644
index 000000000..c4d2d2f06
--- /dev/null
+++ b/packages/client/src/routes/+page.svelte
@@ -0,0 +1,5 @@
+<!--
+  The universal load in +page.ts always throws redirect(302) through
+  resolveLanding(), so this component never renders — the real surfaces are
+  /chat and /connections.
+-->
diff --git a/packages/client/src/routes/+page.ts b/packages/client/src/routes/+page.ts
new file mode 100644
index 000000000..19b2e333b
--- /dev/null
+++ b/packages/client/src/routes/+page.ts
@@ -0,0 +1,15 @@
+/**
+ * Root landing (plan ui-runtime-modes-plan.md §6.5, client branch): boot the
+ * connection store, then redirect — no stored connections means there is
+ * nothing to chat with yet, so land on /connections/new; otherwise /chat.
+ * With ssr=false this load runs in the browser after the SPA shell mounts.
+ */
+import { redirect } from '@sveltejs/kit';
+import { getClientBoot } from '$lib/boot.js';
+import { resolveLanding } from '$lib/resolve-landing.js';
+import type { PageLoad } from './$types';
+
+export const load: PageLoad = async () => {
+  const { store } = await getClientBoot();
+  redirect(302, resolveLanding(await store.list()));
+};
diff --git a/packages/client/src/routes/chat/+page.svelte b/packages/client/src/routes/chat/+page.svelte
new file mode 100644
index 000000000..526814b6e
--- /dev/null
+++ b/packages/client/src/routes/chat/+page.svelte
@@ -0,0 +1,328 @@
+<script lang="ts">
+  // /chat — the client chat surface (P5b item 3, #555), adapted from
+  // packages/ui routes/chat onto the direct per-connection transport
+  // (plan §6.11: no proxy, no host APIs). Thin slice: session list/create
+  // + message send against the active connection; live SSE event wiring
+  // and message history follow with chat parity.
+  import { onMount, tick } from 'svelte';
+  import { goto } from '$app/navigation';
+  import IconAdd from '@openpalm/ui-kit/components/icons/IconAdd.svelte';
+  import ChatInput from '$lib/components/chat/ChatInput.svelte';
+  import ChatTurn from '$lib/components/chat/ChatTurn.svelte';
+  import { getClientBoot } from '$lib/boot.js';
+  import {
+    createTransport,
+    type SessionSummary,
+    type Transport,
+  } from '$lib/transport/index.js';
+  import type { ConnectionEntry } from '$lib/connections/index.js';
+
+  type Turn = { role: 'user' | 'assistant'; text: string };
+
+  let connection = $state<ConnectionEntry | null>(null);
+  let transport: Transport | null = null;
+  let sessions = $state<SessionSummary[]>([]);
+  let sessionId = $state<string | null>(null);
+  let turns = $state<Turn[]>([]);
+  let sending = $state(false);
+  let error = $state('');
+  let showHistoryNote = $state(false);
+  let threadEl = $state<HTMLElement | undefined>();
+
+  onMount(async () => {
+    const { store, secrets } = await getClientBoot();
+    const active = (await store.getActive()) ?? (await store.list())[0] ?? null;
+    if (!active) {
+      await goto('/connections/new', { replaceState: true });
+      return;
+    }
+    connection = active;
+    transport = createTransport({
+      baseUrl: active.url,
+      auth: await secrets.resolveAuth(active),
+    });
+    await refreshSessions();
+  });
+
+  async function refreshSessions(): Promise<void> {
+    if (!transport) return;
+    try {
+      sessions = await transport.listSessions();
+      error = '';
+    } catch (e) {
+      error = friendly(e, 'Could not load sessions from the connection.');
+    }
+  }
+
+  function selectSession(id: string): void {
+    if (id === sessionId) return;
+    sessionId = id;
+    turns = [];
+    // Message history isn't ported yet (thin slice) — say so instead of
+    // silently presenting an old session as empty.
+    showHistoryNote = true;
+  }
+
+  function newSession(): void {
+    sessionId = null;
+    turns = [];
+    showHistoryNote = false;
+  }
+
+  function sessionLabel(session: SessionSummary): string {
+    return session.title || 'Untitled';
+  }
+
+  function assistantText(response: unknown): string {
+    const parts = (response as { parts?: Array<{ type?: string; text?: string }> } | null)?.parts;
+    if (!Array.isArray(parts)) return '';
+    return parts
+      .filter((part) => part.type === 'text' && typeof part.text === 'string')
+      .map((part) => part.text)
+      .join('\n\n')
+      .trim();
+  }
+
+  function friendly(e: unknown, fallback: string): string {
+    const status = (e as { status?: number } | null)?.status;
+    if (status === 401 || status === 403) {
+      return 'The connection rejected the stored credentials. Check them under Connections.';
+    }
+    return e instanceof Error && e.message ? `${fallback} (${e.message})` : fallback;
+  }
+
+  async function scrollToEnd(): Promise<void> {
+    await tick();
+    threadEl?.scrollTo({ top: threadEl.scrollHeight });
+  }
+
+  async function send(text: string): Promise<void> {
+    if (!transport || sending) return;
+    sending = true;
+    error = '';
+    turns = [...turns, { role: 'user', text }];
+    void scrollToEnd();
+    try {
+      if (!sessionId) {
+        sessionId = (await transport.createSession()).id;
+        void refreshSessions();
+      }
+      const response = await transport.sendMessage(sessionId, text);
+      const reply = assistantText(response);
+      turns = [...turns, { role: 'assistant', text: reply || '(The assistant sent no text.)' }];
+      void refreshSessions();
+    } catch (e) {
+      error = friendly(e, 'Sending the message failed.');
+    } finally {
+      sending = false;
+      void scrollToEnd();
+    }
+  }
+</script>
+
+<svelte:head>
+  <title>Chat — OpenPalm</title>
+</svelte:head>
+
+<div class="chat">
+  <aside class="sessions" aria-label="Sessions">
+    <div class="sessions-head">
+      <span class="sessions-title">Sessions</span>
+      <button type="button" class="new-chat" onclick={newSession} aria-label="New chat">
+        <IconAdd size={14} />
+      </button>
+    </div>
+    <ul>
+      {#each sessions as session (session.id)}
+        <li>
+          <button
+            type="button"
+            class="session"
+            class:current={session.id === sessionId}
+            onclick={() => selectSession(session.id)}
+          >
+            {sessionLabel(session)}
+          </button>
+        </li>
+      {:else}
+        <li class="empty">No sessions yet.</li>
+      {/each}
+    </ul>
+    {#if connection}
+      <a class="connection-note" href="/connections" title={connection.url}>
+        via {connection.label}
+      </a>
+    {/if}
+  </aside>
+
+  <section class="thread-pane">
+    <div class="thread" bind:this={threadEl}>
+      {#if showHistoryNote}
+        <div class="s-note">Earlier messages in this session are not shown yet.</div>
+      {/if}
+      {#each turns as turn, index (index)}
+        <ChatTurn role={turn.role} text={turn.text} />
+      {/each}
+      {#if sending}
+        <div class="s-note" aria-live="polite">Thinking…</div>
+      {/if}
+      {#if error}
+        <div class="alert" role="alert">{error}</div>
+      {/if}
+    </div>
+    <div class="composer-row">
+      <ChatInput {sending} onSend={send} />
+    </div>
+  </section>
+</div>
+
+<style>
+  .chat {
+    flex: 1;
+    display: flex;
+    min-height: 0;
+  }
+
+  .sessions {
+    width: 15rem;
+    flex-shrink: 0;
+    display: flex;
+    flex-direction: column;
+    border-right: var(--s-hair) solid var(--s-line);
+    padding: var(--s-sp-4) var(--s-sp-3);
+    gap: var(--s-sp-3);
+  }
+
+  @media (max-width: 44rem) {
+    .sessions {
+      display: none;
+    }
+  }
+
+  .sessions-head {
+    display: flex;
+    align-items: center;
+    justify-content: space-between;
+  }
+
+  .sessions-title {
+    font-family: var(--s-font-mono);
+    font-size: var(--s-type-mark);
+    letter-spacing: var(--s-track-label);
+    text-transform: uppercase;
+    color: var(--s-ink-3);
+  }
+
+  .new-chat {
+    appearance: none;
+    border: var(--s-hair) solid var(--s-line);
+    border-radius: 2px;
+    background: none;
+    color: var(--s-ink-3);
+    cursor: pointer;
+    padding: 4px 6px;
+    display: inline-flex;
+  }
+
+  .new-chat:hover {
+    color: var(--s-ink);
+    border-color: var(--s-seal);
+  }
+
+  .sessions ul {
+    flex: 1;
+    overflow-y: auto;
+    list-style: none;
+    display: flex;
+    flex-direction: column;
+    gap: 2px;
+  }
+
+  .session {
+    width: 100%;
+    text-align: left;
+    appearance: none;
+    background: none;
+    border: 0;
+    border-left: 2px solid transparent;
+    color: var(--s-ink-2);
+    font: inherit;
+    font-size: var(--s-type-deed);
+    padding: 0.35rem 0.5rem;
+    cursor: pointer;
+    overflow: hidden;
+    text-overflow: ellipsis;
+    white-space: nowrap;
+  }
+
+  .session:hover {
+    color: var(--s-ink);
+  }
+
+  .session.current {
+    color: var(--s-ink);
+    border-left-color: var(--s-seal);
+  }
+
+  .empty {
+    color: var(--s-ink-3);
+    font-size: var(--s-type-deed);
+    padding: 0.35rem 0.5rem;
+  }
+
+  .connection-note {
+    color: var(--s-ink-3);
+    font-family: var(--s-font-mono);
+    font-size: var(--s-type-mark);
+    letter-spacing: var(--s-track-label);
+    text-transform: uppercase;
+    text-decoration: none;
+    overflow: hidden;
+    text-overflow: ellipsis;
+    white-space: nowrap;
+  }
+
+  .connection-note:hover {
+    color: var(--s-ink);
+  }
+
+  .thread-pane {
+    flex: 1;
+    display: flex;
+    flex-direction: column;
+    min-width: 0;
+  }
+
+  .thread {
+    flex: 1;
+    overflow-y: auto;
+    display: flex;
+    flex-direction: column;
+    gap: var(--s-sp-5);
+    padding: var(--s-sp-5) clamp(1rem, 6vw, 4rem);
+  }
+
+  .s-note {
+    display: flex;
+    justify-content: center;
+    font-family: var(--s-font-mono);
+    font-size: var(--s-type-mark);
+    letter-spacing: var(--s-track-label);
+    text-transform: uppercase;
+    color: var(--s-ink-3);
+  }
+
+  .alert {
+    padding: var(--s-sp-3);
+    border-radius: 2px;
+    color: var(--s-error);
+    border: 1px solid color-mix(in srgb, var(--s-error) 25%, transparent);
+    background: color-mix(in srgb, var(--s-error) 8%, transparent);
+  }
+
+  .composer-row {
+    display: flex;
+    justify-content: center;
+    padding: var(--s-sp-3) var(--s-sp-4) var(--s-sp-5);
+  }
+</style>
diff --git a/packages/client/src/routes/connections/+page.svelte b/packages/client/src/routes/connections/+page.svelte
new file mode 100644
index 000000000..4665a5eca
--- /dev/null
+++ b/packages/client/src/routes/connections/+page.svelte
@@ -0,0 +1,512 @@
+<script lang="ts">
+  // /connections — client-side connection manager (P5b item 3, #555),
+  // adapted from packages/ui routes/connections onto the IndexedDB store
+  // (plan §6.6). Everything happens in the browser: entries persist locally,
+  // credentials live in the secret store under auth.secretRef, and health is
+  // probed directly against each connection URL.
+  import { onMount } from 'svelte';
+  import { page } from '$app/state';
+  import IconLock from '@openpalm/ui-kit/components/icons/IconLock.svelte';
+  import { getClientBoot, type ClientBoot } from '$lib/boot.js';
+  import { createTransport, type HealthProbeResult } from '$lib/transport/index.js';
+  import type { ConnectionEntry } from '$lib/connections/index.js';
+
+  type AuthMode = 'none' | 'basic' | 'bearer';
+
+  let boot: ClientBoot | null = null;
+  let connections = $state<ConnectionEntry[]>([]);
+  let activeId = $state<string | null>(null);
+  let health = $state<Record<string, HealthProbeResult>>({});
+  let pageError = $state('');
+
+  // ── Form state ─────────────────────────────────────────────────────────
+  let formMode = $state<'idle' | 'add' | 'edit'>('idle');
+  let formId = $state<string | null>(null);
+  let formLabel = $state('');
+  let formUrl = $state('');
+  let formAuthMode = $state<AuthMode>('none');
+  let formUsername = $state('');
+  let formSecret = $state('');
+  let formClearSecret = $state(false);
+  let formSubmitting = $state(false);
+  let formError = $state('');
+
+  let deletingId = $state<string | null>(null);
+
+  onMount(async () => {
+    boot = await getClientBoot();
+    await refresh();
+    if (page.url.searchParams.get('new') === '1') openAddForm();
+  });
+
+  async function refresh(): Promise<void> {
+    if (!boot) return;
+    connections = await boot.store.list();
+    activeId = await boot.store.getActiveId();
+    void probeAll(connections);
+  }
+
+  async function probeAll(entries: ConnectionEntry[]): Promise<void> {
+    if (!boot) return;
+    const { secrets } = boot;
+    await Promise.all(
+      entries.map(async (entry) => {
+        const transport = createTransport({
+          baseUrl: entry.url,
+          auth: await secrets.resolveAuth(entry),
+        });
+        const result = await transport.probeHealth();
+        health = { ...health, [entry.id]: result };
+      })
+    );
+  }
+
+  function healthLabel(id: string): { text: string; tone: 'ok' | 'warn' | 'bad' | 'idle' } {
+    const status = health[id];
+    if (!status) return { text: 'checking…', tone: 'idle' };
+    if (status.state === 'accessible') return { text: 'reachable', tone: 'ok' };
+    if (status.state === 'unauthorized') return { text: 'auth failed', tone: 'warn' };
+    return { text: 'unreachable', tone: 'bad' };
+  }
+
+  function openAddForm(): void {
+    formMode = 'add';
+    formId = null;
+    formLabel = '';
+    formUrl = '';
+    formAuthMode = 'none';
+    formUsername = '';
+    formSecret = '';
+    formClearSecret = false;
+    formError = '';
+  }
+
+  function openEditForm(entry: ConnectionEntry): void {
+    formMode = 'edit';
+    formId = entry.id;
+    formLabel = entry.label;
+    formUrl = entry.url;
+    formAuthMode = entry.auth.mode;
+    formUsername = '';
+    formSecret = '';
+    formClearSecret = false;
+    formError = '';
+  }
+
+  function cancelForm(): void {
+    formMode = 'idle';
+    formError = '';
+  }
+
+  /** Store new credential material (if any) and return the auth descriptor. */
+  async function buildAuth(existing: ConnectionEntry | null): Promise<ConnectionEntry['auth']> {
+    if (!boot) throw new Error('not booted');
+    const previousRef = existing?.auth.secretRef;
+    if (formAuthMode === 'none' || formClearSecret) {
+      if (previousRef) await boot.secrets.delete(previousRef);
+      return { mode: 'none' };
+    }
+    if (!formSecret) {
+      // No new material entered: keep the existing secret if the mode
+      // didn't change, otherwise the credential is required.
+      if (existing && existing.auth.mode === formAuthMode && previousRef) {
+        return existing.auth;
+      }
+      throw new Error(formAuthMode === 'basic' ? 'A password is required.' : 'A token is required.');
+    }
+    const ref = previousRef ?? crypto.randomUUID();
+    await boot.secrets.set(
+      ref,
+      formAuthMode === 'basic'
+        ? formUsername
+          ? { username: formUsername, password: formSecret }
+          : { password: formSecret }
+        : { token: formSecret }
+    );
+    return { mode: formAuthMode, secretRef: ref };
+  }
+
+  async function submitForm(ev: Event): Promise<void> {
+    ev.preventDefault();
+    if (formSubmitting || !boot) return;
+    const label = formLabel.trim();
+    const url = formUrl.trim();
+    if (!label || !url) {
+      formError = 'Label and URL are required.';
+      return;
+    }
+
+    formSubmitting = true;
+    formError = '';
+    try {
+      if (formMode === 'add') {
+        const auth = await buildAuth(null);
+        await boot.store.add({ label, url, kind: 'remote-opencode', auth });
+      } else if (formMode === 'edit' && formId) {
+        const existing = await boot.store.get(formId);
+        const auth = await buildAuth(existing);
+        await boot.store.update(formId, { label, url, auth });
+      }
+      await refresh();
+      formMode = 'idle';
+    } catch (e) {
+      formError = e instanceof Error ? e.message : 'Save failed.';
+    } finally {
+      formSubmitting = false;
+    }
+  }
+
+  async function activate(id: string): Promise<void> {
+    if (!boot) return;
+    try {
+      await boot.store.setActive(id);
+      activeId = id;
+    } catch (e) {
+      pageError = e instanceof Error ? e.message : 'Could not activate the connection.';
+    }
+  }
+
+  async function remove(entry: ConnectionEntry): Promise<void> {
+    if (!boot || entry.locked) return;
+    if (!confirm(`Remove connection "${entry.label}"?`)) return;
+    deletingId = entry.id;
+    try {
+      if (entry.auth.secretRef) await boot.secrets.delete(entry.auth.secretRef);
+      await boot.store.remove(entry.id);
+      await refresh();
+    } catch (e) {
+      pageError = e instanceof Error ? e.message : 'Delete failed.';
+    } finally {
+      deletingId = null;
+    }
+  }
+</script>
+
+<svelte:head>
+  <title>Connections — OpenPalm</title>
+</svelte:head>
+
+<main class="page">
+  <header class="page-header">
+    <h1>Connections</h1>
+    <p class="lede">
+      Connect to local or remote OpenPalm assistants. Entries marked
+      <strong>Managed</strong> are provided by the server that hosts this app and cannot be
+      edited here. Everything on this page is stored in this browser only.
+    </p>
+  </header>
+
+  {#if pageError}
+    <div class="alert error" role="alert">{pageError}</div>
+  {/if}
+
+  <section class="connections-list" aria-label="Configured connections">
+    {#each connections as conn (conn.id)}
+      <article class="connection-card" class:active={conn.id === activeId}>
+        <div class="connection-main">
+          <div class="connection-title">
+            <span class="connection-label">{conn.label}</span>
+            {#if conn.locked}<span class="badge default">Managed</span>{/if}
+            {#if conn.isDefault}<span class="badge default">Default</span>{/if}
+            {#if conn.id === activeId}<span class="badge active">Active</span>{/if}
+            {#if conn.auth.mode !== 'none'}<span class="badge password" title="Credentials configured"><IconLock size={11} /></span>{/if}
+            <span class="badge health {healthLabel(conn.id).tone}">{healthLabel(conn.id).text}</span>
+          </div>
+          <div class="connection-url">{conn.url}</div>
+        </div>
+        <div class="connection-actions">
+          {#if conn.id !== activeId}
+            <button type="button" class="btn btn-primary btn-sm" onclick={() => activate(conn.id)}>
+              Use this
+            </button>
+          {/if}
+          {#if !conn.locked}
+            <button type="button" class="btn btn-secondary btn-sm" onclick={() => openEditForm(conn)}>
+              Edit
+            </button>
+            <button
+              type="button"
+              class="btn btn-danger btn-sm"
+              onclick={() => remove(conn)}
+              disabled={deletingId === conn.id}
+            >
+              {deletingId === conn.id ? 'Removing…' : 'Remove'}
+            </button>
+          {/if}
+        </div>
+      </article>
+    {:else}
+      <p class="empty">No connections yet — add one to start chatting.</p>
+    {/each}
+  </section>
+
+  {#if formMode === 'idle'}
+    <button type="button" class="btn btn-primary" onclick={openAddForm}>
+      + Add connection
+    </button>
+  {:else}
+    <form class="connection-form" onsubmit={submitForm}>
+      <h2>{formMode === 'add' ? 'Add connection' : 'Edit connection'}</h2>
+
+      <label class="field">
+        <span>Label</span>
+        <input
+          type="text"
+          bind:value={formLabel}
+          placeholder="e.g. Home server"
+          required
+          autocomplete="off"
+        />
+      </label>
+
+      <label class="field">
+        <span>URL</span>
+        <input
+          type="url"
+          bind:value={formUrl}
+          placeholder="http://10.0.0.5:8443"
+          required
+          autocomplete="off"
+        />
+        <small>The base URL where the assistant (OpenCode or guardian) is reachable.</small>
+      </label>
+
+      <label class="field">
+        <span>Authentication</span>
+        <select bind:value={formAuthMode}>
+          <option value="none">None</option>
+          <option value="basic">Password (HTTP Basic)</option>
+          <option value="bearer">Token (Bearer)</option>
+        </select>
+      </label>
+
+      {#if formAuthMode === 'basic'}
+        <label class="field">
+          <span>Username (optional)</span>
+          <input
+            type="text"
+            bind:value={formUsername}
+            placeholder="openpalm"
+            autocomplete="off"
+          />
+          <small>Defaults to <code>openpalm</code> — the username the OpenPalm stack provisions.</small>
+        </label>
+        <label class="field">
+          <span>Password</span>
+          <input
+            type="password"
+            bind:value={formSecret}
+            placeholder={formMode === 'edit' ? 'Leave blank to keep current' : ''}
+            autocomplete="new-password"
+          />
+          <small>Stored in this browser and sent only to this connection's URL.</small>
+        </label>
+      {:else if formAuthMode === 'bearer'}
+        <label class="field">
+          <span>Token</span>
+          <input
+            type="password"
+            bind:value={formSecret}
+            placeholder={formMode === 'edit' ? 'Leave blank to keep current' : ''}
+            autocomplete="off"
+          />
+          <small>Stored in this browser and sent only to this connection's URL.</small>
+        </label>
+      {/if}
+
+      {#if formMode === 'edit' && formAuthMode !== 'none'}
+        <label class="field-inline">
+          <input type="checkbox" bind:checked={formClearSecret} />
+          <span>Clear stored credentials</span>
+        </label>
+      {/if}
+
+      {#if formError}
+        <div class="alert error" role="alert">{formError}</div>
+      {/if}
+
+      <div class="form-actions">
+        <button type="submit" class="btn btn-primary" disabled={formSubmitting}>
+          {formSubmitting ? 'Saving…' : 'Save'}
+        </button>
+        <button type="button" class="btn btn-secondary" onclick={cancelForm} disabled={formSubmitting}>
+          Cancel
+        </button>
+      </div>
+    </form>
+  {/if}
+</main>
+
+<style>
+  .page {
+    max-width: 760px;
+    margin: 0 auto;
+    padding: var(--s-sp-6);
+    width: 100%;
+    display: flex;
+    flex-direction: column;
+    gap: var(--s-sp-5);
+  }
+  .page-header h1 {
+    margin: 0 0 var(--s-sp-2);
+  }
+  .lede {
+    color: var(--s-ink-3);
+    margin: 0;
+  }
+
+  .alert.error {
+    padding: var(--s-sp-3);
+    border-radius: 2px;
+    background: color-mix(in srgb, var(--s-error) 8%, transparent);
+    color: var(--s-error);
+    border: 1px solid color-mix(in srgb, var(--s-error) 25%, transparent);
+  }
+
+  .connections-list {
+    display: flex;
+    flex-direction: column;
+    gap: var(--s-sp-3);
+  }
+
+  .empty {
+    color: var(--s-ink-3);
+  }
+
+  .connection-card {
+    display: flex;
+    justify-content: space-between;
+    align-items: center;
+    gap: var(--s-sp-4);
+    padding: var(--s-sp-4);
+    border: var(--s-hair) solid var(--s-line);
+    border-radius: 2px;
+    background: var(--s-paper);
+  }
+  .connection-card.active {
+    border-color: var(--s-seal);
+  }
+
+  .connection-main {
+    min-width: 0;
+    flex: 1;
+  }
+  .connection-title {
+    display: flex;
+    align-items: center;
+    flex-wrap: wrap;
+    gap: var(--s-sp-2);
+    font-weight: 500;
+  }
+  .connection-label {
+    overflow: hidden;
+    text-overflow: ellipsis;
+    white-space: nowrap;
+  }
+  .connection-url {
+    color: var(--s-ink-3);
+    font-family: var(--s-font-mono);
+    font-size: var(--s-type-deed);
+    margin-top: 2px;
+    overflow: hidden;
+    text-overflow: ellipsis;
+    white-space: nowrap;
+  }
+
+  .badge {
+    font-size: var(--s-type-deed);
+    padding: 2px 8px;
+    border-radius: 9999px;
+    font-weight: 500;
+    text-transform: uppercase;
+    letter-spacing: 0.04em;
+  }
+  .badge.default {
+    background: var(--s-paper-deep);
+    color: var(--s-ink-3);
+  }
+  .badge.active {
+    background: var(--s-seal);
+    color: white;
+  }
+  .badge.password {
+    background: transparent;
+    color: var(--s-ink-3);
+    padding: 0;
+  }
+  .badge.health.idle {
+    background: var(--s-paper-deep);
+    color: var(--s-ink-3);
+  }
+  .badge.health.ok {
+    background: color-mix(in srgb, var(--s-moss) 18%, transparent);
+    color: var(--s-moss);
+  }
+  .badge.health.warn {
+    background: color-mix(in srgb, var(--s-seal) 14%, transparent);
+    color: var(--s-seal);
+  }
+  .badge.health.bad {
+    background: color-mix(in srgb, var(--s-error) 12%, transparent);
+    color: var(--s-error);
+  }
+
+  .connection-actions {
+    display: flex;
+    gap: var(--s-sp-2);
+    flex-shrink: 0;
+  }
+
+  .connection-form {
+    display: flex;
+    flex-direction: column;
+    gap: var(--s-sp-3);
+    padding: var(--s-sp-5);
+    border: var(--s-hair) solid var(--s-line);
+    border-radius: 2px;
+    background: var(--s-paper);
+  }
+  .connection-form h2 {
+    margin: 0;
+  }
+
+  .field {
+    display: flex;
+    flex-direction: column;
+    gap: var(--s-sp-1);
+  }
+  .field > span {
+    font-size: var(--s-type-deed);
+    font-weight: 500;
+  }
+  .field input,
+  .field select {
+    padding: var(--s-sp-2) var(--s-sp-3);
+    border: var(--s-hair) solid var(--s-line);
+    border-radius: 2px;
+    font: inherit;
+    background: var(--s-paper);
+    color: var(--s-ink);
+  }
+  .field small {
+    color: var(--s-ink-3);
+    font-size: var(--s-type-deed);
+  }
+  .field code {
+    font-family: var(--s-font-mono);
+    background: var(--s-paper-deep);
+    padding: 1px 4px;
+    border-radius: 4px;
+  }
+
+  .field-inline {
+    display: flex;
+    align-items: center;
+    gap: var(--s-sp-2);
+  }
+
+  .form-actions {
+    display: flex;
+    gap: var(--s-sp-2);
+  }
+</style>
diff --git a/packages/client/src/routes/connections/new/+page.svelte b/packages/client/src/routes/connections/new/+page.svelte
new file mode 100644
index 000000000..229a479ff
--- /dev/null
+++ b/packages/client/src/routes/connections/new/+page.svelte
@@ -0,0 +1,6 @@
+<!--
+  /connections/new is a redirect alias to /connections?new=1 (plan
+  ui-runtime-modes-plan.md §6.5). The universal load in +page.ts always
+  throws redirect(302), so this component never renders — the management UI
+  lives at routes/connections/+page.svelte.
+-->
diff --git a/packages/client/src/routes/connections/new/+page.ts b/packages/client/src/routes/connections/new/+page.ts
new file mode 100644
index 000000000..fea18b8cc
--- /dev/null
+++ b/packages/client/src/routes/connections/new/+page.ts
@@ -0,0 +1,13 @@
+/**
+ * /connections/new — the "no connections yet" landing (plan
+ * ui-runtime-modes-plan.md §6.5). resolveLanding() sends sessions without a
+ * stored connection here; the manager lives at /connections, so this route
+ * opens it with the add form expanded (same alias convention as
+ * packages/ui routes/connections/new).
+ */
+import { redirect } from '@sveltejs/kit';
+import type { PageLoad } from './$types';
+
+export const load: PageLoad = () => {
+  redirect(302, '/connections?new=1');
+};
diff --git a/packages/client/svelte.config.js b/packages/client/svelte.config.js
new file mode 100644
index 000000000..564d40675
--- /dev/null
+++ b/packages/client/svelte.config.js
@@ -0,0 +1,22 @@
+import adapter from "@sveltejs/adapter-static";
+import { vitePreprocess } from "@sveltejs/vite-plugin-svelte";
+import pkg from "./package.json" with { type: "json" };
+
+/** @type {import('@sveltejs/kit').Config} */
+const config = {
+  preprocess: vitePreprocess(),
+  kit: {
+    // Pure SPA (plan ui-runtime-modes-plan.md §6.10/§6.11): every route is
+    // client-rendered (ssr=false in routes/+layout.ts) and the adapter emits
+    // an index.html fallback so any static file server — bin/serve.mjs, the
+    // assistant container co-process (#510), or a CDN — can serve deep links.
+    adapter: adapter({
+      pages: "build",
+      assets: "build",
+      fallback: "index.html",
+    }),
+    version: { name: pkg.version },
+  },
+};
+
+export default config;
diff --git a/packages/client/tsconfig.json b/packages/client/tsconfig.json
new file mode 100644
index 000000000..89ab3175d
--- /dev/null
+++ b/packages/client/tsconfig.json
@@ -0,0 +1,28 @@
+{
+  "extends": "./.svelte-kit/tsconfig.json",
+  "compilerOptions": {
+    "allowJs": true,
+    "checkJs": true,
+    "esModuleInterop": true,
+    "forceConsistentCasingInFileNames": true,
+    "resolveJsonModule": true,
+    "skipLibCheck": true,
+    "sourceMap": true,
+    "strict": true,
+    "moduleResolution": "bundler"
+  },
+  // The generated include also pulls in tests/** — but the bun:test suite
+  // uses bun's module rules (bun:test builtin, explicit .ts-extension
+  // imports) that the DOM-lib svelte-check program rejects. The check gates
+  // the app source; `bun test` executes (and thereby exercises) the tests.
+  "include": [
+    ".svelte-kit/ambient.d.ts",
+    ".svelte-kit/non-ambient.d.ts",
+    ".svelte-kit/types/**/$types.d.ts",
+    "vite.config.ts",
+    "svelte.config.js",
+    "src/**/*.js",
+    "src/**/*.ts",
+    "src/**/*.svelte"
+  ]
+}
diff --git a/packages/client/vite.config.ts b/packages/client/vite.config.ts
new file mode 100644
index 000000000..ecaec1173
--- /dev/null
+++ b/packages/client/vite.config.ts
@@ -0,0 +1,12 @@
+import { sveltekit } from "@sveltejs/kit/vite";
+import { defineConfig } from "vite";
+
+export default defineConfig({
+  plugins: [sveltekit()],
+  optimizeDeps: {
+    // Raw-source Svelte package — esbuild cannot prebundle .svelte files;
+    // vite-plugin-svelte compiles it as part of the app instead (same
+    // arrangement as packages/ui).
+    exclude: ["@openpalm/ui-kit"],
+  },
+});

From c6f38a437b4ce5caa4004e6931c38e7da742e26a Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Mon, 6 Jul 2026 19:49:50 +0000
Subject: [PATCH 31/61] =?UTF-8?q?test(p5b):=20red=20test=20=E2=80=94=20ser?=
 =?UTF-8?q?ve.mjs=20must=20survive=20malformed=20percent-escapes=20(#555)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FetR7BttT1xBrA8fBwhui9
---
 packages/client/tests/serve.test.ts | 61 +++++++++++++++++++++++++++++
 1 file changed, 61 insertions(+)
 create mode 100644 packages/client/tests/serve.test.ts

diff --git a/packages/client/tests/serve.test.ts b/packages/client/tests/serve.test.ts
new file mode 100644
index 000000000..e892d0dc6
--- /dev/null
+++ b/packages/client/tests/serve.test.ts
@@ -0,0 +1,61 @@
+import { afterAll, beforeAll, describe, expect, it } from 'bun:test';
+import { mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+// serve.mjs must survive hostile requests: a malformed percent-escape in the
+// path (e.g. /%zz) makes decodeURIComponent throw, and an uncaught throw in
+// the request handler kills the whole co-process that P5c/P5d rely on.
+
+const SERVE = fileURLToPath(new URL('../bin/serve.mjs', import.meta.url));
+const PORT = 41000 + Math.floor(Math.random() * 1000);
+const BASE = `http://127.0.0.1:${PORT}`;
+
+let dir: string;
+let child: ReturnType<typeof Bun.spawn>;
+
+beforeAll(async () => {
+  dir = mkdtempSync(join(tmpdir(), 'op-client-serve-'));
+  writeFileSync(join(dir, 'index.html'), '<!doctype html><title>ok</title>');
+  child = Bun.spawn(['node', SERVE, '--port', String(PORT), '--dir', dir], {
+    stdout: 'pipe',
+    stderr: 'pipe',
+  });
+  // wait for the listen log
+  const started = Date.now();
+  while (Date.now() - started < 5000) {
+    try {
+      const res = await fetch(`${BASE}/`);
+      if (res.ok) return;
+    } catch {
+      await new Promise((r) => setTimeout(r, 50));
+    }
+  }
+  throw new Error('serve.mjs did not start');
+});
+
+afterAll(() => {
+  child?.kill();
+  rmSync(dir, { recursive: true, force: true });
+});
+
+describe('serve.mjs resilience', () => {
+  it('returns 400 for a malformed percent-escape instead of crashing', async () => {
+    const res = await fetch(`${BASE}/%zz`);
+    expect(res.status).toBe(400);
+  });
+
+  it('keeps serving after the malformed request (process not killed)', async () => {
+    await fetch(`${BASE}/%zz`).catch(() => undefined);
+    const res = await fetch(`${BASE}/`);
+    expect(res.status).toBe(200);
+    expect(await res.text()).toContain('ok');
+  });
+
+  it('still SPA-falls-back for normal unknown routes', async () => {
+    const res = await fetch(`${BASE}/connections/new`);
+    expect(res.status).toBe(200);
+    expect(res.headers.get('content-type')).toContain('text/html');
+  });
+});

From c036bba1d7f90d79a36a3b34094834fb51403d55 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Mon, 6 Jul 2026 19:50:26 +0000
Subject: [PATCH 32/61] fix(client): serve.mjs returns 400 on malformed
 percent-escapes instead of crashing (#555)

Gate finding: an uncaught URIError from decodeURIComponent killed the
static-server process on any request like /%zz.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FetR7BttT1xBrA8fBwhui9
---
 packages/client/bin/serve.mjs | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/packages/client/bin/serve.mjs b/packages/client/bin/serve.mjs
index 785fd9373..b3b6189f9 100644
--- a/packages/client/bin/serve.mjs
+++ b/packages/client/bin/serve.mjs
@@ -48,7 +48,15 @@ function send(res, path, status = 200) {
 }
 
 const server = createServer((req, res) => {
-  const pathname = decodeURIComponent(new URL(req.url ?? '/', 'http://x').pathname);
+  let pathname;
+  try {
+    pathname = decodeURIComponent(new URL(req.url ?? '/', 'http://x').pathname);
+  } catch {
+    // Malformed percent-escapes (e.g. /%zz) throw; a bad request must never
+    // take down the co-process the harness and assistant container rely on.
+    res.writeHead(400, { 'content-type': 'text/plain; charset=utf-8' });
+    return res.end('bad request');
+  }
   // normalize() collapses any ../ segments; the join stays inside dir.
   const candidate = join(dir, normalize(join('/', pathname)));
   if (existsSync(candidate) && statSync(candidate).isFile()) return send(res, candidate);

From 9f79b1c052f561ea78baeb8e66fc896d8b8b3a3b Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Mon, 6 Jul 2026 21:28:43 +0000
Subject: [PATCH 33/61] =?UTF-8?q?docs:=20Phase=205=20completion=20guide=20?=
 =?UTF-8?q?=E2=80=94=20P5a/P5b=20as-built,=20P5c-P5e=20handoff=20(#555,=20?=
 =?UTF-8?q?#510)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Records the P5a/P5b gate outcomes and as-built state, carry-forward
findings, the parity rule, remaining sub-phase specs, and workflow
resume instructions for finishing the client split.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FetR7BttT1xBrA8fBwhui9
---
 docs/technical/phase-5-completion-guide.md | 239 +++++++++++++++++++++
 1 file changed, 239 insertions(+)
 create mode 100644 docs/technical/phase-5-completion-guide.md

diff --git a/docs/technical/phase-5-completion-guide.md b/docs/technical/phase-5-completion-guide.md
new file mode 100644
index 000000000..6bb4a5bef
--- /dev/null
+++ b/docs/technical/phase-5-completion-guide.md
@@ -0,0 +1,239 @@
+# Phase 5 Completion Guide — client split (P5c → P5e)
+
+**Date:** 2026-07-06
+**Branch:** `claude/ui-runtime-modes-phases-1-4`
+**Status:** P5a + P5b DONE (gates passed). P5c, P5d, P5e + final sweep REMAIN.
+**Plan:** `docs/technical/ui-runtime-modes-plan.md` (§6.9–§6.11, Phase 5, §8 rules, §1 simplicity guardrails)
+**Decision record:** `docs/technical/ui-client-split-assessment.md`
+**Tracking issues:** #555 (client extraction), #510 (assistant-container Slice A)
+
+This file is the handoff for finishing Phase 5. It records exactly what is done,
+what remains, the working discipline, and how to resume the interrupted workflow.
+
+---
+
+## 1. What is DONE on this branch
+
+Phases 1–4 (+1.5) of the plan are complete (see plan §7/§10 — marked DONE with
+as-built notes). For Phase 5:
+
+### P5a — `packages/ui-kit` ✅ (gate passed 3/3 after 1 fix round)
+
+- Raw-source private workspace package: `components/common/` (~21), `components/icons/`
+  (64+), theme tokens (`src/lib/theme/tokens.css`). No build step; consuming apps compile it.
+- Fix-round outcomes now enforced by tests: `Toast.svelte` decoupled from voice-state
+  (ui-kit is presentational only); `svelte-check`-based `check` script + tsconfig added
+  (0 errors / 0 warnings, 261 files).
+- Hygiene test guarantees ui-kit imports no `$lib/api`, `$lib/server`, `@openpalm/lib`,
+  or chat/connections stores.
+- Key commits: `93fadfd` (extraction), `c7d53ab` (fix round).
+
+### P5b — `packages/client` ✅ (gate passed; 1 blocking finding found and fixed)
+
+`@openpalm/client` — the unprivileged chat/connections static SPA (plan §6.11):
+
+- **Build:** SvelteKit 2 + Svelte 5, `adapter-static` SPA (`ssr=false`), consumes
+  `@openpalm/ui-kit`. `build` → `svelte-kit sync && vite build && stamp-version`
+  (stamps `.openpalm-client-version`). Root scripts: `client:build`, `client:check`,
+  `client:test` wired in root `package.json`.
+- **Transport** (`src/lib/transport/index.ts`): ONE module — direct fetch to a
+  guardian/OpenCode base URL; Basic (username default `openpalm`) / Bearer;
+  `credentials:'omit'` (no cookies ever); session list/create; message send; SSE frame
+  parser (UTF-8 split-chunk safe); never-throws health probe mapped to the host app's
+  RemoteStatus vocabulary. Injectable fetch for tests.
+- **Connections** (`src/lib/connections/`): `ConnectionEntry` per plan §6.6; raw
+  IndexedDB with a storage abstraction + in-memory twin for tests; `runtime-config.json`
+  boot seeding (locked default connection; user selections and locked entries protected
+  on re-seed); offline-readable; `secrets.ts` holds per-connection credentials.
+- **Views:** `/chat`, `/connections`, `/connections/new`; landing: 0 connections →
+  `/connections/new`, else `/chat` (`src/lib/resolve-landing.ts`).
+- **Static server** (`bin/serve.mjs`): zero-dependency; loopback default (`--host` only
+  where policy gates exposure); SPA fallback; serves `runtime-config.json` from beside
+  the build; path-traversal-contained (verified with hostile requests); returns 400 on
+  malformed percent-escapes (gate finding — fixed in `c036bba`, pinned by
+  `tests/serve.test.ts`).
+- **Purity, enforced:** zero runtime `dependencies`; no `src/lib/server/`; no
+  `@openpalm/lib` anywhere; `tests/purity.test.ts` greps the BUILT bundle for
+  `@openpalm/lib` and `/api/host` markers and fails on a missing build rather than skipping.
+- **Tests:** 67 pass / 0 fail (transport request shaping, SSE, health, store CRUD +
+  locked/active semantics, seeding idempotency, offline read, landing, purity, serve
+  resilience). `client:check`: 0 errors / 0 warnings (312 files).
+- Key commits: `424d091` + `e8e67b1` (red tests), `a049f06` (transport/store),
+  `93cebe8` (app/serve/wiring), `c6f38a4` + `c036bba` (gate fix).
+
+### Gate provenance for P5b (honesty note)
+
+Three review lenses ran: simplicity (block → serve.mjs crash), correctness (block →
+same single finding; everything else verified incl. test-honesty diff between red and
+impl commits), plan/security (agent died at the spend limit AFTER verifying purity,
+traversal, cookie hygiene and signaling green; its two residual checks — no runtime
+deps / no `src/lib/server`, and the `private` flag — were completed manually).
+The single blocking finding is fixed and test-pinned. Gate: **PASS**.
+
+---
+
+## 2. Carry-forward findings (non-blocking, assign to the right sub-phase)
+
+1. **CI does not run the new suites** — neither root `test` nor `ci.yml` includes
+   `client:test` / `client:check` / ui-kit check. → **P5e item 2/3** (already in spec).
+2. **Chat streaming is partial** — the SSE parser is built and tested but the chat page
+   awaits the full JSON response; live event subscription + history are labeled
+   follow-up in the page. → chat-parity follow-up (before deleting `packages/ui` chat;
+   not a P5c blocker).
+3. **`pickStorage()` async failure gap** — only synchronous `indexedDB` access errors
+   fall back to memory; an async `open()` failure (e.g. Firefox private mode) caches a
+   rejected boot promise. → small fix, fold into P5c or the finalize sweep.
+4. **Locked-entry lifecycle** — a locked connection removed from a future
+   `runtime-config.json` can never be deleted by the user. → fold into P5d (the
+   only writer of runtime-config.json) — decide: prune locked entries absent from the
+   current config on seed.
+5. **`createConnectionStore(options: { storage: unknown })`** weakens typing at the one
+   construction site. → trivial, any sub-phase.
+6. **`packages/client/package.json` has `private: true`** — must flip to publishable in
+   **P5e** when it joins the npm publish DAG (mirror `@openpalm/ui`).
+
+---
+
+## 3. Working discipline (unchanged from Phases 1–4)
+
+- **Test-first per sub-phase:** red tests committed before implementation
+  (`test(p5x): red tests for #NNN`); genuine reds must fail for the right reason;
+  characterization/hygiene tests labeled as such. Implementer never modifies red tests
+  (exception: genuinely wrong test — fix + justify).
+- **Gate per sub-phase:** three adversarial reviewers — (1) correctness + test honesty,
+  (2) plan conformance + §8 security invariants (loopback defaults for every new
+  listener; client never bundles `@openpalm/lib` or holds host credentials; capabilities
+  server-enforced in `packages/ui`; harness contract untouched), (3) simplicity + scope
+  (non-technical-user bias; no heavy deps; no drive-bys). Block → fix round → re-review;
+  max 2 fix rounds; do not build the next sub-phase on a blocked gate.
+- **Commits:** conventional style, reference #555 (or #510 for container work), end with:
+
+  ```
+  Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
+  Claude-Session: https://claude.ai/code/session_01FetR7BttT1xBrA8fBwhui9
+  ```
+
+  Workflow agents never push; the supervising session pushes at sub-phase boundaries.
+
+### Environment parity rule (judge every suite against this — container is uid-0 root, no docker daemon, Playwright downloads proxy-blocked)
+
+| Suite | GREEN means |
+|---|---|
+| `bun run ui:check` / `client:check` / ui-kit `check` | 0 errors, 0 warnings (hard) |
+| UI vitest (`cd packages/ui && npm run test:unit -- --run`) | ≥1082 passed, 0 failed in the node project; exit 1 from the 30 browser-project `*.svelte.vitest.ts` files (chromium blocked) is EXPECTED |
+| `bun test --cwd packages/client` | 67+ pass, 0 fail (no env excuses) |
+| `bun test --cwd packages/cli` | exactly 1 known fail (install-flow root-ownership under uid 0) |
+| `bun test --cwd packages/lib` | exactly 17 known uid-0 fails (operator-ids ×8, volume-ownership ×3, ownership-reconcile ×5, rollback chmod-0400 ×1) + 10 docker skips |
+| `bun run --cwd packages/electron test` | 88+ pass, 0 fail |
+| `bun run lint` | no errors (16 pre-existing warnings + 1 info are baseline) |
+
+Any NEW failure beyond this set is a regression the sub-phase must fix. Never "fix" the
+known-failing tests.
+
+---
+
+## 4. Remaining work
+
+### P5c — harness serves the client (#555)
+
+1. **lib (`packages/lib`):** client-build resolution + seeding mirroring
+   `ui-assets.ts` — `resolveClientBuildDir` / `seedClientBuild` /
+   `checkAndUpdateClientBuild` for `@openpalm/client` (npm tarball integrity-verified
+   via the existing `npm-bundle-updater`; `OPENPALM_REPO_ROOT` dev override included;
+   version-stamp preference logic like the UI's). Thin sibling functions — do NOT fork
+   the updater.
+2. **CLI (`packages/cli`):** the supervisor that serves the UI also starts the client
+   static server (`bin/serve.mjs` from the resolved client build) on
+   `DEFAULT_CLIENT_PORT=3890`, loopback-only, supervised/respawned like the UI child.
+   Both `openpalm admin` and the default serve path start it. Non-fatal if the client
+   build is absent (log + skip).
+3. **Electron (`packages/electron`):** main.ts starts the same client child after the
+   UI server; when setup is complete, `resolveInitialUrl` loads
+   `http://127.0.0.1:3890/chat`, FALLING BACK to the 3880 chat if the client child
+   failed (keep the fallback dumb). `HARNESS_CONTRACT_VERSION` untouched — this is
+   spawn-env/child work; keep `harness-contract-drift` tests green.
+4. `packages/ui` chat is NOT deleted (parity confirmation needs a real browser — record
+   as follow-up with carry-forward #2).
+
+*Red tests:* lib resolve/seed (follow `ui-assets` test patterns); CLI spawn env/args +
+skip-when-absent; Electron initial-URL preference + fallback (follow `main.test.ts`
+patterns); drift tests stay green (characterization).
+
+### P5d — assistant-container serves the client (#510 Slice A)
+
+1. `containers/assistant/entrypoint.sh`: `install_runtime_artifacts` pulls
+   `@openpalm/client` (`OP_CLIENT_VERSION` → `PLATFORM_VERSION` → hard error; keep the
+   landed warn-and-continue when a previous artifact exists; skeleton pull unchanged).
+2. Replace `start_ui` with `start_client`: write `runtime-config.json` beside the build
+   FIRST (locked default connection pointing the BROWSER at the published OpenCode URL —
+   default `http://127.0.0.1:${OP_ASSISTANT_PORT:-3800}`, override
+   `OP_CLIENT_DEFAULT_ASSISTANT_URL`), then run `bin/serve.mjs` on `OP_CLIENT_PORT`
+   (default 3000, bind 0.0.0.0 inside the container). This deletes the old
+   `OPENCODE_API_URL` wiring bug path entirely.
+3. Compose (`packages/skeleton/system/stack/`): publish the client port on the assistant
+   service behind the existing `OP_BIND_ADDRESS` policy (mirror `OP_ASSISTANT_PORT`;
+   loopback default). Wire `OP_CLIENT_PORT`/`OP_CLIENT_VERSION` into stack env plumbing.
+4. Dockerfile: verify no `@openpalm/ui` co-process remnants; `PLATFORM_VERSION` arg
+   already wired.
+5. Decide carry-forward #4 (locked-entry pruning) here — the entrypoint owns
+   runtime-config.json.
+6. Docs: new env vars → `docs/technical/environment-and-mounts.md` /
+   `consolidated-stack-env.md`.
+
+*Red tests:* version-resolution (extend however `install_runtime_artifacts` is tested
+today); repo test asserting no `OPENCODE_API_URL` export and no `@openpalm/ui` install
+in entrypoint; compose assertion (yaml parse) for the port mapping + bind policy.
+**No docker daemon here** — static verification only (`bash -n`, config asserts); say so
+honestly in notes.
+
+### P5e — release integration (#555)
+
+1. Publish DAG (`platform-release.yml` — read it first): add `@openpalm/client`
+   (exact-pin, mirror `@openpalm/ui` publish/stamp; **flip `private: true` off** —
+   carry-forward #6). Verify nothing publishes `@openpalm/ui-kit`.
+2. Root `package.json`: `client:check`/`client:test` + ui-kit check into the root
+   check/test aggregates. **Wire them into `ci.yml`** (carry-forward #1).
+3. CI purity gate: ensure `tests/purity.test.ts` (dist grep) actually runs in CI's test
+   invocation and fails builds on violation.
+4. Docs: `docs/technical/release-architecture.md` artifact table; plan §1 table row for
+   client marked landed; `OP_CLIENT_VERSION`/`OP_CLIENT_PORT` in env/release docs.
+
+*Red tests:* repo-hygiene test that root aggregates reference the client package;
+YAML-parse test that the release workflow publishes `@openpalm/client` and not ui-kit.
+
+### Final sweep
+
+Run every suite (parity table above) + `client:build` + purity; fix only trivial
+breakage; update `docs/technical/ui-runtime-modes-plan.md` §7/§10 marking Phase 5 DONE
+with as-built notes (including: `packages/ui` chat NOT deleted — parity deferred;
+Slice B settings shim not built); commit; push.
+
+---
+
+## 5. How to resume
+
+**Option A — resume the workflow (preferred).** The interrupted run caches everything
+through P5b's test author:
+
+```
+Workflow({
+  scriptPath: "/root/.claude/projects/-home-user-openpalm/bd3d6dbd-40c3-5cff-8000-895d2d80f22b/workflows/scripts/ui-client-split-phase-5-wf_458bb49a-1ed.js",
+  resumeFromRunId: "wf_458bb49a-1ed"
+})
+```
+
+Caveats: the P5b implementer + gate reviewers were NOT journaled (they died / ran
+out-of-band), so on resume they re-run — they will find the red tests already green and
+should verify + return quickly; their re-review is redundant-but-harmless extra safety.
+The workflow script's phases P5c/P5d/P5e run as specced (§4 above matches the script).
+The session must push at each sub-phase boundary (workflow agents never push) — re-arm
+the hourly check-in pattern via `send_later`.
+
+**Option B — manual (this session or a fresh one).** Execute §4 sub-phase by sub-phase
+under the §3 discipline: red tests → implement → 3-lens gate (spawn three reviewer
+agents with the lens prompts in §3) → fix rounds → push → next.
+
+**Watch out:** the monthly spend limit killed three agents on 2026-07-06 (two
+implementers, one reviewer). If an agent dies mid-sub-phase: commit any uncommitted WIP
+immediately (label it WIP, push), then resume — WIP commits are how P5b survived two
+interruptions with zero lost work.

From 90edbd3384698ee363756af879f77db2ea0b1dd0 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Mon, 6 Jul 2026 22:11:06 +0000
Subject: [PATCH 34/61] test(p5c): red tests for #555
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Failing-first tests for P5c — harness serves the client on a stable
loopback port (plan Phase 5 item 3; phase-5-completion-guide §4).

- lib client-assets.test.ts: resolveClientBuildDir / readClientBuildVersion
  / CLIENT_VERSION_STAMP / seedClientBuild / checkAndUpdateClientBuild as a
  thin sibling of ui-assets (OPENPALM_REPO_ROOT dev override, version-stamp
  preference, @openpalm/client npm coordinate, integrity fail-closed,
  major-version guard, build+bin layout, backup on update).
  RED: "Cannot find module './client-assets.js'" (module not implemented).
- cli client-server.test.ts: DEFAULT_CLIENT_PORT=3890 single-sourced in
  ports.ts; resolveClientServeScript sibling-bin resolution; spawn env
  contract (PORT / HOST=127.0.0.1 / OP_CLIENT_DIR + serve.mjs as the child);
  loopback pinned even under OP_ALLOW_REMOTE_SETUP; non-fatal
  skip-when-absent; respawn-on-crash; stop() suppresses respawn.
  RED: "Cannot find module './client-server.ts'" (module not implemented).
- electron initial-url.test.ts: resolveInitialUrl exported from main.ts;
  prefers http://127.0.0.1:3890/chat when setup is complete and the client
  child is healthy; dumb fallback to 3880/chat when the client is
  unreachable; setup always lands on the host app; root fallback preserved
  on status-probe failure. RED: 5 tests fail with "resolveInitialUrl is not
  exported from src/main.ts yet". The HARNESS_CONTRACT_VERSION===1 test in
  the same file is a CHARACTERIZATION (already green), as are the untouched
  harness-contract-drift tests (still green, verified).

Suite parity verified before commit: lib 845 pass + exactly the 17 known
uid-0 failures (+ this file's module error); cli 87 pass + exactly the 1
known root-ownership failure (+ this file's module error); electron 89 pass
with only the 5 new reds; lint at the 16-warning baseline.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FetR7BttT1xBrA8fBwhui9
---
 packages/cli/src/lib/client-server.test.ts    | 216 +++++++++++
 packages/electron/test/initial-url.test.ts    | 276 +++++++++++++
 .../src/control-plane/client-assets.test.ts   | 366 ++++++++++++++++++
 3 files changed, 858 insertions(+)
 create mode 100644 packages/cli/src/lib/client-server.test.ts
 create mode 100644 packages/electron/test/initial-url.test.ts
 create mode 100644 packages/lib/src/control-plane/client-assets.test.ts

diff --git a/packages/cli/src/lib/client-server.test.ts b/packages/cli/src/lib/client-server.test.ts
new file mode 100644
index 000000000..301f9c4d1
--- /dev/null
+++ b/packages/cli/src/lib/client-server.test.ts
@@ -0,0 +1,216 @@
+// ── P5c RED TESTS (#555) — CLI serves the client on a stable loopback port ────
+//
+// The supervisor that serves the UI (`openpalm` default serve path AND
+// `openpalm admin`) must ALSO start the @openpalm/client static server
+// (bin/serve.mjs from the resolved client build) on DEFAULT_CLIENT_PORT=3890,
+// loopback-only, supervised/respawned like the UI child, and NON-FATALLY skip
+// when no client build is present (plan Phase 5 item 3; phase-5 guide §4 P5c
+// item 2).
+//
+// Pinned contract (these tests are the spec):
+//   • `DEFAULT_CLIENT_PORT` lives in src/lib/ports.ts (single source of the
+//     magic number, like DEFAULT_UI_PORT) and is 3890 — stable because the
+//     localhost PWA identity is origin-including-port (plan §6.10).
+//   • New module src/lib/client-server.ts exports:
+//       resolveClientServeScript(buildDir) → the serve script that travels with
+//         the resolved client build: join(buildDir, '..', 'bin', 'serve.mjs')
+//         (holds for BOTH channels: data/client/{build,bin} and
+//         $OPENPALM_REPO_ROOT/packages/client/{build,bin}).
+//       startClientServer(deps) → Promise<handle | null> with injectable deps
+//         (port, resolveBuildDir, existsSync, spawnFn, log/logError, sleep,
+//         stopTimeoutMs) so no real process is ever spawned in tests — same
+//         style as createCliUiSupervisor in ui-server.test.ts.
+//   • The spawned child's env carries the serve.mjs config contract
+//     (PORT / HOST / OP_CLIENT_DIR — see packages/client/bin/serve.mjs):
+//     HOST is 127.0.0.1 ALWAYS. There is no remote escape hatch:
+//     OP_ALLOW_REMOTE_SETUP must NOT loosen the client server's bind (the
+//     acceptance line: "loopback-only enforced for the client server").
+//   • Absent build → log + skip, return null, spawn nothing, never throw and
+//     never exit (the UI must keep serving).
+//   • Supervision: an unexpected child exit respawns it; stop() SIGTERMs the
+//     child and suppresses any further respawn.
+import { describe, expect, it, beforeEach, afterEach } from 'bun:test';
+import { join } from 'node:path';
+import * as ports from './ports.ts';
+import { startClientServer, resolveClientServeScript } from './client-server.ts';
+
+// ── fakes ─────────────────────────────────────────────────────────────────────
+
+interface FakeClientProc {
+  signals: string[];
+  kill: (sig?: number | NodeJS.Signals) => void;
+  exited: Promise<number>;
+  killed: boolean;
+  /** Resolve `exited` from the test to simulate the child dying. */
+  die: (code: number) => void;
+}
+
+function fakeClientProc(): FakeClientProc {
+  const signals: string[] = [];
+  let resolveExit!: (code: number) => void;
+  const exited = new Promise<number>((r) => { resolveExit = r; });
+  const proc: FakeClientProc = {
+    signals,
+    exited,
+    killed: false,
+    die: (code: number) => { resolveExit(code); },
+    kill: (sig?: number | NodeJS.Signals) => {
+      signals.push(String(sig ?? 'SIGTERM'));
+      proc.killed = true;
+      resolveExit(0); // a killed fake dies immediately
+    },
+  };
+  return proc;
+}
+
+interface SpawnRecord {
+  cmd: string[];
+  env: Record<string, string | undefined>;
+}
+
+function harness(opts: {
+  /** One fake proc per spawn; the last repeats for any extra spawns. */
+  procs?: FakeClientProc[];
+  buildDir?: string;
+  /** false = the resolved client build is absent (skip-when-absent path). */
+  present?: boolean;
+  port?: number;
+}) {
+  const buildDir = opts.buildDir ?? '/op-home/data/client/build';
+  const procs = opts.procs ?? [fakeClientProc()];
+  const spawns: SpawnRecord[] = [];
+  const logs: string[] = [];
+  const handlePromise = startClientServer({
+    port: opts.port,
+    resolveBuildDir: () => buildDir,
+    existsSync: () => opts.present !== false,
+    spawnFn: (cmd: string[], o: { env: Record<string, string | undefined> }) => {
+      spawns.push({ cmd: [...cmd], env: { ...o.env } });
+      return procs[Math.min(spawns.length - 1, procs.length - 1)];
+    },
+    log: (...a: unknown[]) => { logs.push(a.map(String).join(' ')); },
+    logError: (...a: unknown[]) => { logs.push(a.map(String).join(' ')); },
+    sleep: () => Promise.resolve(),
+    stopTimeoutMs: 5,
+  });
+  return { handlePromise, spawns, logs, buildDir, procs };
+}
+
+const tick = () => new Promise((r) => setTimeout(r, 10));
+
+// ── port constant ─────────────────────────────────────────────────────────────
+
+describe('DEFAULT_CLIENT_PORT', () => {
+  it('is exported from ports.ts and is 3890 (stable loopback PWA origin, plan §6.10)', () => {
+    expect((ports as Record<string, unknown>).DEFAULT_CLIENT_PORT).toBe(3890);
+  });
+});
+
+// ── serve script resolution ───────────────────────────────────────────────────
+
+describe('resolveClientServeScript', () => {
+  it('resolves bin/serve.mjs as a SIBLING of the resolved build dir (both channels)', () => {
+    // data channel: OP_HOME/data/client/build → OP_HOME/data/client/bin/serve.mjs
+    expect(resolveClientServeScript('/op-home/data/client/build'))
+      .toBe(join('/op-home/data/client/bin', 'serve.mjs'));
+    // dev channel: repo packages/client/build → packages/client/bin/serve.mjs
+    expect(resolveClientServeScript('/repo/packages/client/build'))
+      .toBe(join('/repo/packages/client/bin', 'serve.mjs'));
+  });
+});
+
+// ── spawn env/args ────────────────────────────────────────────────────────────
+
+describe('startClientServer spawn env/args', () => {
+  const savedRemote = { value: undefined as string | undefined };
+
+  beforeEach(() => {
+    savedRemote.value = process.env.OP_ALLOW_REMOTE_SETUP;
+    delete process.env.OP_ALLOW_REMOTE_SETUP;
+  });
+
+  afterEach(() => {
+    if (savedRemote.value === undefined) delete process.env.OP_ALLOW_REMOTE_SETUP;
+    else process.env.OP_ALLOW_REMOTE_SETUP = savedRemote.value;
+  });
+
+  it('spawns the serve script with PORT=3890 (default), HOST=127.0.0.1, and OP_CLIENT_DIR=<resolved build>', async () => {
+    const { handlePromise, spawns, buildDir } = harness({});
+    const handle = await handlePromise;
+    expect(handle).not.toBeNull();
+    expect(spawns.length).toBe(1);
+    const { cmd, env } = spawns[0] as SpawnRecord;
+    // serve.mjs reads its config from the environment (PORT/HOST/OP_CLIENT_DIR).
+    expect(env.PORT).toBe('3890');
+    expect(env.HOST).toBe('127.0.0.1');
+    expect(env.OP_CLIENT_DIR).toBe(buildDir);
+    // The child IS the serve script from the resolved client build.
+    expect(cmd).toContain(resolveClientServeScript(buildDir));
+    await handle?.stop();
+  });
+
+  it('honors a port override', async () => {
+    const { handlePromise, spawns } = harness({ port: 4001 });
+    const handle = await handlePromise;
+    expect((spawns[0] as SpawnRecord).env.PORT).toBe('4001');
+    await handle?.stop();
+  });
+
+  it('stays loopback-only even when OP_ALLOW_REMOTE_SETUP is set (no remote escape hatch)', async () => {
+    // The UI server's remote-setup relaxation must never leak into the client
+    // static server: acceptance is "loopback-only enforced for the client
+    // server" — HOST stays pinned to 127.0.0.1 unconditionally.
+    process.env.OP_ALLOW_REMOTE_SETUP = '1';
+    const { handlePromise, spawns } = harness({});
+    const handle = await handlePromise;
+    expect((spawns[0] as SpawnRecord).env.HOST).toBe('127.0.0.1');
+    await handle?.stop();
+  });
+});
+
+// ── skip-when-absent ──────────────────────────────────────────────────────────
+
+describe('startClientServer skip-when-absent', () => {
+  it('returns null, spawns nothing, and logs a skip when the client build is absent', async () => {
+    const { handlePromise, spawns, logs } = harness({ present: false });
+    // Non-fatal by contract: the promise must RESOLVE (never reject/exit) so
+    // the UI supervisor keeps serving without the client.
+    const handle = await handlePromise;
+    expect(handle).toBeNull();
+    expect(spawns.length).toBe(0);
+    const logged = logs.join('\n');
+    expect(logged).toMatch(/client/i);
+    expect(logged).toMatch(/skip/i);
+  });
+});
+
+// ── supervision ───────────────────────────────────────────────────────────────
+
+describe('startClientServer supervision', () => {
+  it('respawns the client child after an unexpected exit', async () => {
+    const first = fakeClientProc();
+    const second = fakeClientProc();
+    const { handlePromise, spawns } = harness({ procs: [first, second] });
+    const handle = await handlePromise;
+    expect(spawns.length).toBe(1);
+
+    first.die(1); // the child crashes
+    await tick();
+
+    expect(spawns.length).toBe(2); // supervised: a fresh child was spawned
+    await handle?.stop();
+  });
+
+  it('stop() SIGTERMs the child and suppresses any further respawn', async () => {
+    const first = fakeClientProc();
+    const { handlePromise, spawns, procs } = harness({ procs: [first] });
+    const handle = await handlePromise;
+    expect(handle).not.toBeNull();
+
+    await handle?.stop();
+    await tick();
+
+    expect((procs[0] as FakeClientProc).signals).toContain('SIGTERM');
+    expect(spawns.length).toBe(1); // an intentional stop must NOT respawn
+  });
+});
diff --git a/packages/electron/test/initial-url.test.ts b/packages/electron/test/initial-url.test.ts
new file mode 100644
index 000000000..b152cfe1a
--- /dev/null
+++ b/packages/electron/test/initial-url.test.ts
@@ -0,0 +1,276 @@
+// ── P5c RED TESTS (#555) — Electron window prefers the client app ─────────────
+//
+// Plan Phase 5 item 3 / phase-5-completion-guide §4 P5c item 3: main.ts starts
+// the @openpalm/client static server child after the UI server, and when setup
+// is complete the window loads the CLIENT chat at http://127.0.0.1:3890/chat —
+// FALLING BACK to the host app's chat on 3880 when the client child is not
+// healthy (fallback stays dumb: probe, and on any failure use 3880).
+//
+// Pinned contract (these tests are the spec):
+//   • `resolveInitialUrl` is EXPORTED from src/main.ts (it exists today as a
+//     module-private function) so the preference/fallback decision is testable.
+//   • Setup complete + client healthy      → http://127.0.0.1:3890/chat
+//   • Setup complete + client unreachable  → http://127.0.0.1:3880/chat
+//   • Setup incomplete                     → http://127.0.0.1:3880/setup
+//     (ALWAYS the host app — the client artifact has no setup wizard.)
+//   • Setup-status probe failure           → http://127.0.0.1:3880 (root; the
+//     host app's own landing guard redirects — existing behavior, unchanged).
+//   • Client health is probed over HTTP against 127.0.0.1:3890 (any path); the
+//     probe must be short/bounded — a dead client must not stall window
+//     creation (enforced here via the test timeout).
+//   • HARNESS_CONTRACT_VERSION stays at 1: P5c is spawn-env/child work, not
+//     bridge surface (characterization — already green; see the drift tests).
+//
+// Run via vitest (Node), NOT bun test — same reason as main.test.ts.
+import { describe, it, expect, vi, afterEach } from 'vitest';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+
+// ── Mock node:fs (same shape as main.test.ts) ─────────────────────────────────
+vi.mock('node:fs', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('node:fs')>();
+  return {
+    ...actual,
+    existsSync: vi.fn((p: string) => {
+      // Make the UI build appear present so seedUiBuild is never called.
+      if (String(p).endsWith('index.js')) return true;
+      return false;
+    }),
+  };
+});
+
+// ── Mock node:child_process — never spawn a real process ─────────────────────
+vi.mock('node:child_process', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('node:child_process')>();
+  const fakeProcess = { on: vi.fn(), kill: vi.fn(), stdout: { on: vi.fn() }, stderr: { on: vi.fn() }, pid: 4242 };
+  return { ...actual, spawn: vi.fn(() => fakeProcess) };
+});
+
+// ── Mock electron (same shape as main.test.ts, plus session/systemPreferences) ─
+const { mockBrowserWindow } = vi.hoisted(() => ({
+  mockBrowserWindow: {
+    loadURL: vi.fn(),
+    webContents: { setWindowOpenHandler: vi.fn(), send: vi.fn() },
+    on: vi.fn(),
+    once: vi.fn(),
+    show: vi.fn(),
+    focus: vi.fn(),
+    isFocused: vi.fn(() => false),
+    hide: vi.fn(),
+    close: vi.fn(),
+    setTitle: vi.fn(),
+    setSize: vi.fn(),
+    isDestroyed: vi.fn(() => false),
+  },
+}));
+
+vi.mock('electron', () => ({
+  app: {
+    getVersion: vi.fn(() => '0.12.0'),
+    quit: vi.fn(),
+    exit: vi.fn(),
+    whenReady: vi.fn(() => Promise.resolve()),
+    on: vi.fn(),
+    getAppPath: vi.fn(() => '/mock/app'),
+    getPath: vi.fn(() => join(tmpdir(), 'openpalm-initial-url-test-logs')),
+    relaunch: vi.fn(),
+    setAppUserModelId: vi.fn(),
+    getLoginItemSettings: vi.fn(() => ({ openAtLogin: false })),
+    setLoginItemSettings: vi.fn(),
+  },
+  BrowserWindow: Object.assign(
+    function MockBrowserWindow() { return mockBrowserWindow; },
+    { getAllWindows: vi.fn(() => [mockBrowserWindow]) },
+  ),
+  contextBridge: { exposeInMainWorld: vi.fn() },
+  dialog: { showErrorBox: vi.fn() },
+  Tray: function MockTray() {
+    return { setToolTip: vi.fn(), setContextMenu: vi.fn(), on: vi.fn() };
+  },
+  globalShortcut: { register: vi.fn(() => false), unregisterAll: vi.fn() },
+  nativeImage: {
+    createFromPath: vi.fn(() => ({
+      toBitmap: vi.fn(() => Buffer.from([])),
+      getSize: vi.fn(() => ({ width: 16, height: 16 })),
+    })),
+    createFromBitmap: vi.fn(() => ({})),
+  },
+  Menu: { buildFromTemplate: vi.fn(() => ({})) },
+  shell: { openExternal: vi.fn(), openPath: vi.fn() },
+  ipcMain: { handle: vi.fn(), on: vi.fn() },
+  Notification: Object.assign(
+    function MockNotification() { return { show: vi.fn(), on: vi.fn() }; },
+    { isSupported: vi.fn(() => true) },
+  ),
+  session: {
+    defaultSession: {
+      setPermissionRequestHandler: vi.fn(),
+      setPermissionCheckHandler: vi.fn(),
+    },
+  },
+  systemPreferences: {
+    askForMediaAccess: vi.fn(async () => true),
+    getMediaAccessStatus: vi.fn(() => 'granted'),
+  },
+}));
+
+// ── Mock @openpalm/lib ────────────────────────────────────────────────────────
+// checkDocker HANGS deliberately: the module-scope `app.whenReady().then(...)`
+// boot flow awaits ensureDockerReady() forever, so no background UI-server
+// start/health-poll loop can interfere with the per-test fetch stubs below.
+// resolveInitialUrl is a pure exported helper — it needs none of the boot flow.
+vi.mock('@openpalm/lib', () => ({
+  resolveOpenPalmHome: vi.fn(() => '/home/user/.openpalm'),
+  resolveDataDir: vi.fn(() => '/home/user/.openpalm/data'),
+  resolveConfigDir: vi.fn(() => '/home/user/.openpalm/config'),
+  resolveUiBuildDir: vi.fn(() => '/home/user/.openpalm/data/ui'),
+  seedUiBuild: vi.fn(() => Promise.resolve()),
+  ensureHomeDirs: vi.fn(),
+  checkAndUpdateUiBuild: vi.fn(() => Promise.resolve({ updated: false, latestVersion: '0.12.0' })),
+  checkAndUpdateSkeleton: vi.fn(() => Promise.resolve({ updated: false, latestVersion: '0.12.0' })),
+  uiUpdateChannel: vi.fn((v: string) => (v.includes('-') ? 'next' : 'latest')),
+  parseEnvFile: vi.fn(() => ({})),
+  PLATFORM_VERSION: 'v0.12.0',
+  checkDocker: vi.fn(() => new Promise(() => { /* hang: freeze the boot flow */ })),
+  checkDockerCompose: vi.fn(() => Promise.resolve({ ok: true, stdout: '', stderr: '', code: 0 })),
+  // Faithful reimplementation of lib's waitForReady (poll /health; 200 or 401 ==
+  // ready) so a resolveInitialUrl implementation that probes the client child
+  // through it still exercises the per-test global fetch stubs.
+  waitForReady: vi.fn(async (port: number, timeoutMs = 60_000): Promise<boolean> => {
+    const deadline = Date.now() + timeoutMs;
+    while (Date.now() < deadline) {
+      try {
+        const res = await fetch(`http://127.0.0.1:${port}/health`, { signal: AbortSignal.timeout(1000) });
+        if (res.ok || res.status === 401) return true;
+      } catch {
+        // not ready yet
+      }
+      await new Promise((r) => setTimeout(r, 300));
+    }
+    return false;
+  }),
+  restoreUiBackup: vi.fn(() => ({ status: 'no-backup' as const })),
+  // Faithful minimal UiSupervisor stub (main.ts constructs one at module scope).
+  UiSupervisor: class {
+    private handle: unknown = null;
+    private restarting = false;
+    // biome-ignore lint/suspicious/noExplicitAny: test-only faithful stub
+    private readonly strategy: any;
+    // biome-ignore lint/suspicious/noExplicitAny: test-only faithful stub
+    private readonly cb: any;
+    // biome-ignore lint/suspicious/noExplicitAny: test-only faithful stub
+    constructor(opts: any) {
+      this.strategy = opts.strategy;
+      this.cb = opts.callbacks;
+    }
+    get current() { return this.handle; }
+    get isRestarting() { return this.restarting; }
+    adopt(handle: unknown) { this.handle = handle; }
+    detachHandle() { this.handle = null; }
+    markShuttingDown() { /* no-op */ }
+    async start() { return true; }
+    async restart() { return false; }
+  },
+}));
+
+// Keep the boot flow's harness-scoped side quests inert and offline.
+vi.mock('../src/update-check.js', () => ({
+  checkForElectronUpdate: vi.fn(async () => ({ updateAvailable: false })),
+  getCachedUpdateInfo: vi.fn(() => null),
+}));
+vi.mock('../src/settings.js', () => ({
+  loadSettings: vi.fn(() => ({ checkPrerelease: false })),
+  saveSettings: vi.fn(),
+}));
+vi.mock('../src/local-opencode.js', () => ({
+  startLocalOpenCode: vi.fn(() => Promise.resolve(null)),
+  killProcessTree: vi.fn(),
+}));
+
+import * as main from '../src/main.js';
+import { HARNESS_CONTRACT_VERSION } from '../src/harness-contract.js';
+
+// Namespace access (not a named import) so THIS file loads even before the
+// export exists — each test then fails with the precise missing-feature reason
+// instead of the whole file dying on an import error.
+const resolveInitialUrl = (main as unknown as Record<string, unknown>).resolveInitialUrl as
+  | (() => Promise<string>)
+  | undefined;
+
+async function callResolveInitialUrl(): Promise<string> {
+  if (typeof resolveInitialUrl !== 'function') {
+    throw new Error('resolveInitialUrl is not exported from src/main.ts yet (P5c red test)');
+  }
+  return resolveInitialUrl();
+}
+
+/**
+ * Stub global fetch by target:
+ *  - 127.0.0.1:3880/api/setup/status → the host app's setup status
+ *  - 127.0.0.1:3890 (any path)       → the client static server health
+ * Everything else fails fast (irrelevant to these assertions).
+ */
+function stubFetch(opts: { setup: boolean | 'error'; clientUp: boolean }) {
+  vi.stubGlobal('fetch', vi.fn(async (input: unknown) => {
+    const url = String(input);
+    if (url.includes('127.0.0.1:3880/api/setup/status')) {
+      if (opts.setup === 'error') throw new Error('ECONNREFUSED');
+      return { ok: true, status: 200, json: async () => ({ setupComplete: opts.setup === true }) };
+    }
+    if (url.includes('127.0.0.1:3890')) {
+      if (!opts.clientUp) throw new Error('ECONNREFUSED');
+      return { ok: true, status: 200, json: async () => ({}) };
+    }
+    throw new Error(`unexpected fetch in test: ${url}`);
+  }));
+}
+
+afterEach(() => {
+  vi.unstubAllGlobals();
+});
+
+// ── resolveInitialUrl — client-first with dumb 3880 fallback (P5c) ────────────
+
+describe('resolveInitialUrl — prefers the client app, falls back to the host app', () => {
+  it('is exported from main.ts so the preference/fallback decision is testable', () => {
+    expect(typeof resolveInitialUrl, 'export resolveInitialUrl from src/main.ts').toBe('function');
+  });
+
+  it('loads the CLIENT chat (127.0.0.1:3890/chat) when setup is complete and the client child is healthy', async () => {
+    stubFetch({ setup: true, clientUp: true });
+    await expect(callResolveInitialUrl()).resolves.toBe('http://127.0.0.1:3890/chat');
+  });
+
+  it('falls back to the HOST APP chat (127.0.0.1:3880/chat) when the client server is unreachable', { timeout: 15_000 }, async () => {
+    // Resilience: the client child failed to start (e.g. no client build on
+    // disk — the CLI/harness skip is non-fatal). The window must land on the
+    // packages/ui chat, which is NOT deleted in P5c (parity follow-up).
+    stubFetch({ setup: true, clientUp: false });
+    await expect(callResolveInitialUrl()).resolves.toBe('http://127.0.0.1:3880/chat');
+  });
+
+  it('always lands on the HOST APP setup wizard when setup is incomplete (the client has no /setup)', async () => {
+    // Even with a healthy client child: the client artifact structurally lacks
+    // host capabilities (plan §8.10) — setup must stay on the host app.
+    stubFetch({ setup: false, clientUp: true });
+    await expect(callResolveInitialUrl()).resolves.toBe('http://127.0.0.1:3880/setup');
+  });
+
+  it('keeps the dumb root fallback (127.0.0.1:3880) when the setup-status probe fails', { timeout: 15_000 }, async () => {
+    // Existing behavior, unchanged: the host app root re-routes via its own
+    // landing guard. No cleverness on failure paths.
+    stubFetch({ setup: 'error', clientUp: true });
+    await expect(callResolveInitialUrl()).resolves.toBe('http://127.0.0.1:3880');
+  });
+});
+
+// ── characterization: harness contract untouched by P5c ──────────────────────
+
+describe('harness contract stays untouched by P5c (characterization — already green)', () => {
+  it('HARNESS_CONTRACT_VERSION remains 1 — client-child work is spawn-env only, not bridge surface', () => {
+    // The client server child and the initial-URL preference add NO IPC methods
+    // and NO renderer-facing env keys; the derived-surface drift tests
+    // (harness-contract-drift.test.ts) enforce the same invariant structurally.
+    expect(HARNESS_CONTRACT_VERSION).toBe(1);
+  });
+});
diff --git a/packages/lib/src/control-plane/client-assets.test.ts b/packages/lib/src/control-plane/client-assets.test.ts
new file mode 100644
index 000000000..70f3b60a0
--- /dev/null
+++ b/packages/lib/src/control-plane/client-assets.test.ts
@@ -0,0 +1,366 @@
+// ── P5c RED TESTS (#555) — client-build resolution + seeding ─────────────────
+//
+// These tests pin the lib surface for serving `@openpalm/client` from the
+// harness (plan Phase 5 item 3; phase-5-completion-guide §4 P5c item 1):
+// a THIN SIBLING of ui-assets.ts that reuses npm-bundle-updater (never forks it).
+//
+// Pinned design decisions (the tests are the contract):
+//   • Module: `client-assets.ts` next to `ui-assets.ts` (same barrel re-export
+//     pattern; these imports fail until the module exists — that is the red).
+//   • On-disk layout: the client artifact keeps the npm package's root shape —
+//     `<root>/build/` (static files; gate file `index.html`) and
+//     `<root>/bin/serve.mjs` (the zero-dependency static server the CLI spawns).
+//     Channels:
+//       data channel    → OP_HOME/data/client/{build,bin}
+//       dev override    → $OPENPALM_REPO_ROOT/packages/client/{build,bin}
+//     This is forced by "bin/serve.mjs from the resolved client build": the
+//     serve script must travel WITH the updatable artifact so a compiled CLI
+//     binary can run it in every channel, and `join(buildDir, '..', 'bin',
+//     'serve.mjs')` holds in both channels.
+//   • resolveClientBuildDir() returns the BUILD dir (…/client/build), with the
+//     same version-aware two-channel selection as resolveUiBuildDir (data wins
+//     only when strictly newer per the stamp).
+//   • Version stamp: `.openpalm-client-version` INSIDE the build dir — written
+//     by packages/client/scripts/stamp-version.mjs, so the constant here is a
+//     cross-package contract.
+//   • seedClientBuild(repoRef, dataDir, options?) — local-or-download like
+//     seedUiBuild, but with NO harness-contract gate: the client is a static
+//     bundle with no native bridge to outgrow.
+//   • checkAndUpdateClientBuild(appVersion, dataDir, channelOverride?) —
+//     channel/verify/stage/swap/backup pipeline via checkAndUpdateNpmBundle,
+//     integrity fail-closed, never crosses a major, non-fatal errors.
+//
+// Test patterns follow ui-assets.test.ts (env pinning, makeBuild, mocked fetch,
+// real tarball for the happy path).
+import { describe, it, expect, beforeEach, afterEach } from "bun:test";
+import { mkdtempSync, rmSync, mkdirSync, writeFileSync, existsSync, readFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { createHash } from "node:crypto";
+import {
+  CLIENT_VERSION_STAMP,
+  readClientBuildVersion,
+  resolveClientBuildDir,
+  seedClientBuild,
+  checkAndUpdateClientBuild,
+} from "./client-assets.js";
+
+let root = "";
+let opHome = "";
+let repoRoot = "";
+let dataDir = "";
+/** Data-channel build dir: OP_HOME/data/client/build */
+let dataClient = "";
+/** Data-channel package root: OP_HOME/data/client */
+let dataClientRoot = "";
+/** Dev-override build dir: $OPENPALM_REPO_ROOT/packages/client/build */
+let bundledClient = "";
+const saved: Record<string, string | undefined> = {};
+
+/** Materialize a static client build: index.html + optional version stamp. */
+function makeBuild(dir: string, version: string | null): void {
+  mkdirSync(dir, { recursive: true });
+  writeFileSync(join(dir, "index.html"), "<!doctype html><title>client</title>\n");
+  if (version !== null) writeFileSync(join(dir, ".openpalm-client-version"), `${version}\n`);
+}
+
+beforeEach(() => {
+  root = mkdtempSync(join(tmpdir(), "client-assets-"));
+  opHome = join(root, "ophome");
+  repoRoot = join(root, "repo");
+  dataDir = join(opHome, "data");
+  dataClientRoot = join(dataDir, "client");
+  dataClient = join(dataClientRoot, "build");
+  bundledClient = join(repoRoot, "packages", "client", "build");
+  saved.OP_HOME = process.env.OP_HOME;
+  saved.OPENPALM_REPO_ROOT = process.env.OPENPALM_REPO_ROOT;
+  saved.OP_UI_CHANNEL = process.env.OP_UI_CHANNEL;
+  delete process.env.OP_UI_CHANNEL;
+  process.env.OP_HOME = opHome;
+  // Pin the bundled candidate to a controlled location so the resolver never
+  // discovers the REAL packages/client/build via a source-relative fallback
+  // (same pinning trick as ui-assets.test.ts). Default: an EMPTY build dir
+  // (exists but no index.html) = "no bundled build".
+  process.env.OPENPALM_REPO_ROOT = repoRoot;
+  mkdirSync(bundledClient, { recursive: true });
+});
+
+afterEach(() => {
+  rmSync(root, { recursive: true, force: true });
+  for (const k of ["OP_HOME", "OPENPALM_REPO_ROOT", "OP_UI_CHANNEL"] as const) {
+    if (saved[k] === undefined) delete process.env[k];
+    else process.env[k] = saved[k];
+  }
+});
+
+// ── Version stamp ─────────────────────────────────────────────────────────────
+
+describe("CLIENT_VERSION_STAMP / readClientBuildVersion", () => {
+  it("CLIENT_VERSION_STAMP matches the filename packages/client/scripts/stamp-version.mjs writes", () => {
+    // Cross-package contract: the client build script stamps
+    // build/.openpalm-client-version; lib must read the SAME filename.
+    expect(CLIENT_VERSION_STAMP).toBe(".openpalm-client-version");
+  });
+
+  it("reads the stamp, or null when absent", () => {
+    makeBuild(dataClient, "0.12.0");
+    expect(readClientBuildVersion(dataClient)).toBe("0.12.0");
+    makeBuild(bundledClient, null);
+    expect(readClientBuildVersion(bundledClient)).toBeNull();
+  });
+});
+
+// ── resolveClientBuildDir — version-aware selection (mirrors resolveUiBuildDir) ─
+
+describe("resolveClientBuildDir — version-aware selection", () => {
+  it("uses data/client/build when only it exists", () => {
+    makeBuild(dataClient, "0.12.0");
+    expect(resolveClientBuildDir()).toBe(dataClient);
+  });
+
+  it("uses the bundled (OPENPALM_REPO_ROOT) build when only it exists", () => {
+    makeBuild(bundledClient, "0.12.0");
+    expect(resolveClientBuildDir()).toBe(bundledClient);
+  });
+
+  it("prefers data/client/build only when it is strictly NEWER than bundled", () => {
+    makeBuild(dataClient, "0.13.0");
+    makeBuild(bundledClient, "0.12.0");
+    expect(resolveClientBuildDir()).toBe(dataClient);
+  });
+
+  it("prefers bundled when it is newer than data (no stale-data shadowing)", () => {
+    makeBuild(dataClient, "0.12.0");
+    makeBuild(bundledClient, "0.13.0");
+    expect(resolveClientBuildDir()).toBe(bundledClient);
+  });
+
+  it("prefers bundled when versions are equal", () => {
+    makeBuild(dataClient, "0.12.0");
+    makeBuild(bundledClient, "0.12.0");
+    expect(resolveClientBuildDir()).toBe(bundledClient);
+  });
+
+  it("prefers bundled when data is unstamped (cannot prove it is newer)", () => {
+    makeBuild(dataClient, null);
+    makeBuild(bundledClient, "0.12.0");
+    expect(resolveClientBuildDir()).toBe(bundledClient);
+  });
+
+  it("falls back to the data path when nothing is present (caller seeds)", () => {
+    expect(resolveClientBuildDir()).toBe(dataClient);
+  });
+});
+
+// ── seedClientBuild ───────────────────────────────────────────────────────────
+
+describe("seedClientBuild", () => {
+  it("seeds BOTH build/ and bin/serve.mjs from a local checkout into data/client", async () => {
+    // Local dev-override source: build + the sibling serve script. The serve
+    // script must travel with the seeded artifact — the CLI runs
+    // data/client/bin/serve.mjs, and a compiled binary has no other copy.
+    makeBuild(bundledClient, "0.12.52");
+    const bundledBin = join(repoRoot, "packages", "client", "bin");
+    mkdirSync(bundledBin, { recursive: true });
+    writeFileSync(join(bundledBin, "serve.mjs"), "// client static server\n");
+
+    await seedClientBuild("v0.12.52", dataDir);
+
+    expect(existsSync(join(dataClient, "index.html"))).toBe(true);
+    expect(existsSync(join(dataClientRoot, "bin", "serve.mjs"))).toBe(true);
+    expect(readClientBuildVersion(dataClient)).toBe("0.12.52");
+  });
+
+  it("remote seed targets @openpalm/client on npm and fails CLOSED on a missing integrity hash", async () => {
+    const requested: string[] = [];
+    const savedFetch = globalThis.fetch;
+    globalThis.fetch = (async (_url: string | URL | Request) => {
+      const url = String(typeof _url === "string" ? _url : (_url as Request).url ?? _url);
+      if (url.includes("registry.npmjs.org")) {
+        requested.push(url);
+        return new Response(
+          JSON.stringify({
+            version: "0.13.0",
+            // integrity intentionally omitted → the download must refuse
+            dist: { tarball: "https://registry.npmjs.org/client.tgz" },
+          }),
+          { status: 200, headers: { "Content-Type": "application/json" } },
+        );
+      }
+      return new Response("not-reached", { status: 200 });
+    }) as typeof globalThis.fetch;
+    try {
+      await expect(
+        seedClientBuild("latest", dataDir, { forceRemote: true }),
+      ).rejects.toThrow(/no integrity hash/i);
+      // Pins the package coordinate: the manifest fetch is for @openpalm/client.
+      expect(requested.some((u) => u.includes("/@openpalm/client/"))).toBe(true);
+    } finally {
+      globalThis.fetch = savedFetch;
+    }
+  });
+});
+
+// ── checkAndUpdateClientBuild ─────────────────────────────────────────────────
+
+describe("checkAndUpdateClientBuild", () => {
+  let savedFetch: typeof globalThis.fetch;
+
+  beforeEach(() => {
+    savedFetch = globalThis.fetch;
+    mkdirSync(join(dataDir, "backups"), { recursive: true });
+  });
+
+  afterEach(() => {
+    globalThis.fetch = savedFetch;
+  });
+
+  function manifestResponse(version: string, integrity?: string) {
+    return new Response(
+      JSON.stringify({
+        version,
+        dist: {
+          tarball: "https://registry.npmjs.org/client.tgz",
+          ...(integrity !== undefined ? { integrity } : {}),
+        },
+      }),
+      { status: 200, headers: { "Content-Type": "application/json" } },
+    );
+  }
+
+  it("returns {updated:false} when the npm channel version is not newer than the on-disk stamp", async () => {
+    makeBuild(dataClient, "0.12.0");
+    globalThis.fetch = (async () => manifestResponse("0.12.0")) as typeof globalThis.fetch;
+    const result = await checkAndUpdateClientBuild("0.12.0", dataDir);
+    expect(result.updated).toBe(false);
+    expect(result.latestVersion).toBe("0.12.0");
+    expect(result.error).toBeUndefined();
+  });
+
+  it("returns {updated:false} when npm has an older version", async () => {
+    makeBuild(dataClient, "0.13.0");
+    globalThis.fetch = (async () => manifestResponse("0.12.0")) as typeof globalThis.fetch;
+    const result = await checkAndUpdateClientBuild("0.13.0", dataDir);
+    expect(result.updated).toBe(false);
+    expect(result.latestVersion).toBe("0.12.0");
+  });
+
+  it("returns {updated:false, error} when the manifest fetch rejects (non-fatal)", async () => {
+    globalThis.fetch = (async () => { throw new Error("network failure"); }) as typeof globalThis.fetch;
+    const result = await checkAndUpdateClientBuild("0.12.0", dataDir);
+    expect(result.updated).toBe(false);
+    expect(result.latestVersion).toBeNull();
+    expect(result.error).toMatch(/network failure/i);
+  });
+
+  it("fails closed when the manifest has no integrity hash", async () => {
+    makeBuild(dataClient, "0.12.0");
+    globalThis.fetch = (async (_url: string | URL | Request) => {
+      const url = String(typeof _url === "string" ? _url : (_url as Request).url ?? _url);
+      if (url.includes("registry.npmjs.org")) return manifestResponse("0.13.0"); // no integrity
+      return new Response("", { status: 200 });
+    }) as typeof globalThis.fetch;
+    const result = await checkAndUpdateClientBuild("0.12.0", dataDir);
+    expect(result.updated).toBe(false);
+    expect(result.error).toMatch(/no integrity hash/i);
+  });
+
+  it("never auto-crosses a major version boundary", async () => {
+    makeBuild(dataClient, "0.12.0");
+    let tarballFetched = false;
+    globalThis.fetch = (async (_url: string | URL | Request) => {
+      const url = String(typeof _url === "string" ? _url : (_url as Request).url ?? _url);
+      if (url.includes("registry.npmjs.org")) return manifestResponse("1.0.0", "sha512-abc");
+      tarballFetched = true;
+      return new Response("", { status: 200 });
+    }) as typeof globalThis.fetch;
+    const result = await checkAndUpdateClientBuild("0.12.0", dataDir);
+    expect(result.updated).toBe(false);
+    expect(result.latestVersion).toBe("1.0.0");
+    expect(result.error).toBeUndefined();
+    expect(tarballFetched).toBe(false);
+  });
+
+  it("stable → @latest dist-tag; prerelease → newest version across ALL dist-tags (not the stale `next` tag)", async () => {
+    makeBuild(dataClient, "0.12.0");
+    const refs: string[] = [];
+    globalThis.fetch = (async (_url: string | URL | Request) => {
+      const url = String(typeof _url === "string" ? _url : (_url as Request).url ?? _url);
+      if (url.includes("/dist-tags")) {
+        // `next` deliberately stale — the shared resolver must pick max(dist-tags).
+        return new Response(
+          JSON.stringify({ next: "0.12.0-rc.1", beta: "0.12.5-beta.2", latest: "0.12.4" }),
+          { status: 200, headers: { "Content-Type": "application/json" } },
+        );
+      }
+      if (url.includes("/@openpalm/client/")) {
+        refs.push(url.split("/@openpalm/client/")[1] ?? "");
+        return manifestResponse("0.12.0"); // up to date → no download attempted
+      }
+      return new Response("", { status: 200 });
+    }) as typeof globalThis.fetch;
+    await checkAndUpdateClientBuild("0.12.4", dataDir);       // stable → latest
+    await checkAndUpdateClientBuild("0.12.0-rc.1", dataDir);  // prerelease → next channel
+    expect(refs[0]).toBe("latest");
+    expect(refs[1]).toBe("0.12.5-beta.2");
+  });
+
+  it("happy path: verifies integrity, swaps build/ + bin/, keeps the shipped stamp, and backs up the old artifact", async () => {
+    // Plant the OLD artifact in the data channel (build + serve script).
+    makeBuild(dataClient, "0.12.0");
+    writeFileSync(join(dataClient, "index.html"), "<!doctype html><!-- old -->\n");
+    mkdirSync(join(dataClientRoot, "bin"), { recursive: true });
+    writeFileSync(join(dataClientRoot, "bin", "serve.mjs"), "// old serve\n");
+
+    // Build a minimal valid @openpalm/client tarball (npm wraps under package/;
+    // `files: ["build", "bin"]` publishes exactly these two trees, and the build
+    // script stamps build/.openpalm-client-version before publish).
+    const pkgRoot = mkdtempSync(join(tmpdir(), "client-happy-pkg-"));
+    mkdirSync(join(pkgRoot, "package", "build"), { recursive: true });
+    mkdirSync(join(pkgRoot, "package", "bin"), { recursive: true });
+    writeFileSync(join(pkgRoot, "package", "build", "index.html"), "<!doctype html><!-- new -->\n");
+    writeFileSync(join(pkgRoot, "package", "build", ".openpalm-client-version"), "0.13.0\n");
+    writeFileSync(join(pkgRoot, "package", "bin", "serve.mjs"), "// new serve\n");
+    const tarPath = join(pkgRoot, "client.tgz");
+    const { exited } = Bun.spawn(["tar", "-czf", tarPath, "-C", pkgRoot, "package"], { stdout: "pipe", stderr: "pipe" });
+    await exited;
+    const tarBytes = new Uint8Array(await Bun.file(tarPath).arrayBuffer());
+    const integrity = `sha512-${createHash("sha512").update(tarBytes).digest("base64")}`;
+    rmSync(pkgRoot, { recursive: true, force: true });
+
+    globalThis.fetch = (async (_url: string | URL | Request) => {
+      const url = String(typeof _url === "string" ? _url : (_url as Request).url ?? _url);
+      if (url.includes("registry.npmjs.org")) {
+        return new Response(
+          JSON.stringify({ version: "0.13.0", dist: { tarball: "https://r.npm/client.tgz", integrity } }),
+          { status: 200, headers: { "Content-Type": "application/json" } },
+        );
+      }
+      return new Response(tarBytes, { status: 200 });
+    }) as typeof globalThis.fetch;
+
+    const result = await checkAndUpdateClientBuild("0.12.0", dataDir);
+
+    expect(result.updated).toBe(true);
+    expect(result.latestVersion).toBe("0.13.0");
+    expect(result.error).toBeUndefined();
+    // New static build + serve script are in place; the shipped stamp reads back.
+    expect(readFileSync(join(dataClient, "index.html"), "utf8")).toContain("new");
+    expect(existsSync(join(dataClientRoot, "bin", "serve.mjs"))).toBe(true);
+    expect(readClientBuildVersion(dataClient)).toBe("0.13.0");
+    // The OLD artifact was backed up under data/backups/client-<ts>/ (same
+    // pattern as the UI/skeleton backups) so a supervisor can restore it if the
+    // new build fails to serve.
+    const backupsDir = join(dataDir, "backups");
+    const clientBackups = existsSync(backupsDir)
+      ? (await import("node:fs")).readdirSync(backupsDir).filter((n: string) => n.startsWith("client-"))
+      : [];
+    expect(clientBackups.length).toBeGreaterThan(0);
+    const backup = join(backupsDir, clientBackups[0] ?? "");
+    // Tolerant to whether the backup captured the package root or the build dir.
+    const backedUpIndex = [join(backup, "build", "index.html"), join(backup, "index.html")]
+      .find((p) => existsSync(p));
+    expect(backedUpIndex, "backup must contain the old index.html").toBeDefined();
+    if (backedUpIndex) expect(readFileSync(backedUpIndex, "utf8")).toContain("old");
+  });
+});

From 002f0192fd525b636b33159f80169cf75618dd0f Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Mon, 6 Jul 2026 22:28:54 +0000
Subject: [PATCH 35/61] =?UTF-8?q?feat(lib):=20client-assets=20=E2=80=94=20?=
 =?UTF-8?q?resolve/seed/update=20@openpalm/client=20(#555)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

P5c item 1 (plan Phase 5 item 3): client-build resolution + seeding as a
THIN SIBLING of ui-assets.ts, reusing npm-bundle-updater (not forked):

- CLIENT_VERSION_STAMP (.openpalm-client-version) + readClientBuildVersion:
  cross-package contract with packages/client/scripts/stamp-version.mjs.
- resolveClientBuildDir: version-aware two-channel selection mirroring
  resolveUiBuildDir (data/client/build vs OPENPALM_REPO_ROOT bundled;
  data wins only when strictly newer per the stamp; gate file index.html;
  de-routed installs logged loudly, never silent).
- seedClientBuild: local seed copies BOTH build/ and the sibling
  bin/serve.mjs (the serve script travels with the updatable artifact so a
  compiled CLI binary can run it in every channel); remote seed targets
  @openpalm/client on npm, integrity fail-closed via stageNpmBundle. No
  harness-contract gate — the client is a static bundle with no native
  bridge to outgrow (§8.10).
- checkAndUpdateClientBuild: channel/verify/stage/swap/backup pipeline via
  checkAndUpdateNpmBundle (stable→latest, prerelease→max(dist-tags),
  major-version guard, non-fatal errors, backup under
  data/backups/client-<ts> capturing build/+bin/). restoreOnFailure=true:
  no supervisor restore hook exists for the client, so the artifact is
  never left missing after a failed swap.
- ui-assets.ts: export copyTree + resolveChannelRef for the sibling module
  (shared helpers, not barrel surface).

Makes client-assets.test.ts green (18/18, committed red in 90edbd3);
ui-assets suite unchanged (53/53).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FetR7BttT1xBrA8fBwhui9
---
 .../lib/src/control-plane/client-assets.ts    | 290 ++++++++++++++++++
 packages/lib/src/control-plane/ui-assets.ts   |   8 +-
 packages/lib/src/index.ts                     |  11 +
 3 files changed, 306 insertions(+), 3 deletions(-)
 create mode 100644 packages/lib/src/control-plane/client-assets.ts

diff --git a/packages/lib/src/control-plane/client-assets.ts b/packages/lib/src/control-plane/client-assets.ts
new file mode 100644
index 000000000..ab5b32ee5
--- /dev/null
+++ b/packages/lib/src/control-plane/client-assets.ts
@@ -0,0 +1,290 @@
+/**
+ * Runtime asset seeding and resolution for the `@openpalm/client` static app —
+ * a THIN SIBLING of ui-assets.ts (plan ui-runtime-modes-plan.md Phase 5 item 3,
+ * #555). Same channel/verify/stage/swap/backup pipeline via npm-bundle-updater;
+ * only the policy knobs differ.
+ *
+ * The client artifact keeps the npm package's root shape on disk:
+ *
+ *   <root>/build/          adapter-static bundle (gate file: index.html; the
+ *                          build script stamps build/.openpalm-client-version)
+ *   <root>/bin/serve.mjs   the zero-dependency static server the harness spawns
+ *
+ * Channels:
+ *   data channel  → OP_HOME/data/client/{build,bin}   (operator-updatable)
+ *   dev override  → $OPENPALM_REPO_ROOT/packages/client/{build,bin}
+ *
+ * The serve script travels WITH the updatable artifact so a compiled CLI binary
+ * can run it in every channel: `join(buildDir, '..', 'bin', 'serve.mjs')` holds
+ * for both.
+ *
+ * Unlike the UI there is NO harness-contract gate: the client is a static
+ * bundle served over plain HTTP — it has no native bridge to outgrow (§8.10:
+ * it never bundles @openpalm/lib and never holds host credentials).
+ *
+ * Node.js-compatible only (no Bun.* APIs) — consumed by the CLI and Electron.
+ */
+import { existsSync, readFileSync, realpathSync, renameSync, rmSync, mkdirSync } from 'node:fs';
+import { join, dirname } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+import { resolveDataDir } from './home.js';
+import { createLogger } from '../logger.js';
+import { compareComparableVersions, normalizeVersion } from './versioning.js';
+import {
+  NPM_REGISTRY,
+  fetchWithRetry,
+  stageNpmBundle,
+  checkAndUpdateNpmBundle,
+  type NpmBundleManifest,
+} from './npm-bundle-updater.js';
+import { copyTree, resolveChannelRef, uiUpdateChannel, type UiUpdateChannel } from './ui-assets.js';
+
+const logger = createLogger('lib:client-assets');
+
+const CLIENT_PACKAGE = '@openpalm/client';
+
+/**
+ * Filename of the build-time version stamp written into the client build root
+ * by packages/client/scripts/stamp-version.mjs — a cross-package contract: the
+ * stamp travels with the static bundle wherever it is copied/extracted.
+ */
+export const CLIENT_VERSION_STAMP = '.openpalm-client-version';
+
+/** Read the stamped client version from a build dir, or null if absent/unreadable. */
+export function readClientBuildVersion(dir: string): string | null {
+  try {
+    const v = readFileSync(join(dir, CLIENT_VERSION_STAMP), 'utf-8').trim();
+    return v || null;
+  } catch {
+    return null;
+  }
+}
+
+/** The data-channel package root (OP_HOME/data/client — holds build/ + bin/). */
+function dataClientRoot(): string {
+  return join(resolveDataDir(), 'client');
+}
+
+/**
+ * Locate a bundled/local client build on disk (mirrors resolveLocalUiBuild).
+ * Returns null when not found — triggers the npm download in seedClientBuild.
+ */
+export function resolveLocalClientBuild(): string | null {
+  const strategies: Array<() => string | null> = [
+    // 1. Explicit dev override — OPENPALM_REPO_ROOT points to the repo root.
+    () => process.env.OPENPALM_REPO_ROOT
+      ? join(process.env.OPENPALM_REPO_ROOT, 'packages', 'client', 'build')
+      : null,
+    // 2. Electron extraResources — client-build/ placed alongside the asar.
+    () => {
+      const rp = (process as NodeJS.Process & { resourcesPath?: string }).resourcesPath;
+      if (!rp) return null;
+      return join(rp, 'client-build');
+    },
+    // 3. Relative to this source file (dev / bun run).
+    () => {
+      const meta = fileURLToPath(import.meta.url);
+      if (meta.startsWith('/$bunfs/')) return null;
+      const candidate = join(dirname(meta), '..', '..', '..', '..', 'packages', 'client', 'build');
+      return existsSync(join(candidate, 'index.html')) ? candidate : null;
+    },
+    // 4. Relative to compiled binary / Electron executable.
+    () => {
+      const binDir = dirname(realpathSync(process.execPath));
+      const candidate = join(binDir, '..', '..', '..', 'packages', 'client', 'build');
+      return existsSync(join(candidate, 'index.html')) ? candidate : null;
+    },
+  ];
+  for (const strategy of strategies) {
+    try {
+      const p = strategy();
+      if (p && existsSync(p)) return p;
+    } catch { /* skip */ }
+  }
+  return null;
+}
+
+/**
+ * Resolve which client build to serve — the BUILD dir (…/client/build), with
+ * the same version-aware two-channel selection as resolveUiBuildDir: when both
+ * channels hold a build, data/client wins ONLY when it is strictly newer per
+ * the version stamp; an unstamped/older data/client never shadows a newer
+ * bundled build. Falls back to the data path when nothing is present (the
+ * caller seeds).
+ */
+export function resolveClientBuildDir(): string {
+  const dataBuild = join(dataClientRoot(), 'build');
+  const hasData = existsSync(join(dataBuild, 'index.html'));
+  // resolveLocalClientBuild()'s env/resourcesPath candidates only check the dir
+  // exists, not that it holds a servable build — require index.html before
+  // trusting it (same gate as resolveUiBuildDir).
+  const bundledRaw = resolveLocalClientBuild();
+  const bundled = bundledRaw && existsSync(join(bundledRaw, 'index.html')) ? bundledRaw : null;
+
+  if (hasData && bundled) {
+    const dataVer = readClientBuildVersion(dataBuild);
+    const bundledVer = readClientBuildVersion(bundled);
+    // data/client wins only when we can prove it's strictly newer.
+    if (dataVer && bundledVer && compareComparableVersions(dataVer, bundledVer) > 0) return dataBuild;
+    // De-routed installs must be VISIBLE, never silent (same rationale as
+    // resolveUiBuildDir, §6.1 Risk #1).
+    if (!dataVer) {
+      logger.warn('data/client present but UNSTAMPED — ignoring it and serving the bundled client build', {
+        dataBuild, bundled, bundledVersion: bundledVer ?? '(unstamped)',
+      });
+    } else {
+      logger.warn('data/client present but not strictly newer than the bundled build — serving the bundled client build', {
+        dataBuild, dataVersion: dataVer, bundled, bundledVersion: bundledVer ?? '(unstamped)',
+      });
+    }
+    return bundled;
+  }
+  if (hasData) return dataBuild;
+  if (bundled) return bundled;
+  return dataBuild; // nothing present yet → caller triggers seedClientBuild
+}
+
+/**
+ * Resolve the abbreviated npm manifest for `@openpalm/client` by exact version
+ * OR dist-tag. Throws on non-OK. No minHarnessContract field — the client has
+ * no native bridge (contrast fetchNpmUiManifest).
+ */
+async function fetchNpmClientManifest(versionOrTag: string): Promise<NpmBundleManifest> {
+  const url = `${NPM_REGISTRY}/${CLIENT_PACKAGE}/${versionOrTag}`;
+  const res = await fetchWithRetry(url);
+  if (!res.ok) throw new Error(`npm registry returned HTTP ${res.status} for ${CLIENT_PACKAGE}@${versionOrTag}`);
+  const m = await res.json() as { version?: string; dist?: { tarball?: string; integrity?: string } };
+  if (!m.version || !m.dist?.tarball) {
+    throw new Error(`npm manifest for ${CLIENT_PACKAGE}@${versionOrTag} is missing version/dist.tarball`);
+  }
+  return { version: m.version, tarball: m.dist.tarball, integrity: m.dist.integrity ?? null };
+}
+
+/**
+ * Download `@openpalm/client`'s npm tarball, verify integrity (fail-closed via
+ * stageNpmBundle), and swap BOTH published trees — `build/` and `bin/` — into
+ * the client package root. npm wraps the package under `package/` and we
+ * publish `files: ["build", "bin"]`, so strip 1 component and keep exactly
+ * those two subtrees. The shipped stamp (build/.openpalm-client-version) is
+ * kept as-is — no afterInstall re-stamp needed (same as the UI build).
+ */
+async function downloadNpmClientBundle(manifest: NpmBundleManifest, clientRoot: string, dataDir: string): Promise<void> {
+  const staging = await stageNpmBundle(manifest, dataDir, {
+    packageName: CLIENT_PACKAGE,
+    label: 'client',
+    tmpTarName: '.client.tgz.tmp',
+    stagingName: '.client.staging',
+    strip: 1,
+    filter: (p) => p.startsWith('package/build/') || p.startsWith('package/bin/'),
+    validate: (s) => {
+      if (!existsSync(join(s, 'build', 'index.html'))) {
+        throw new Error('downloaded client bundle is missing build/index.html');
+      }
+      if (!existsSync(join(s, 'bin', 'serve.mjs'))) {
+        throw new Error('downloaded client bundle is missing bin/serve.mjs');
+      }
+    },
+  });
+  try {
+    // Swap: the staged root IS the artifact — remove the live root and move it in.
+    rmSync(clientRoot, { recursive: true, force: true });
+    renameSync(staging, clientRoot);
+  } finally {
+    rmSync(staging, { recursive: true, force: true });
+  }
+}
+
+/**
+ * Install the client artifact to OP_HOME/data/client/ ({build,bin}).
+ *
+ * Copies from the local/bundled `packages/client/` when available — BOTH the
+ * build and the sibling bin/serve.mjs, because the CLI runs
+ * data/client/bin/serve.mjs and a compiled binary has no other copy — otherwise
+ * downloads the `@openpalm/client` bundle from npm (integrity fail-closed).
+ * No harness-contract gate: the client is a static bundle (see module doc).
+ */
+export async function seedClientBuild(
+  repoRef: string,
+  dataDir: string,
+  options?: { forceRemote?: boolean },
+): Promise<void> {
+  const clientRoot = join(dataDir, 'client');
+
+  const local = options?.forceRemote ? null : resolveLocalClientBuild();
+  if (local) {
+    logger.debug('seeding client build from local source', { src: local });
+    mkdirSync(clientRoot, { recursive: true });
+    copyTree(local, join(clientRoot, 'build'));
+    // The serve script lives beside the build in the source/package layout
+    // (packages/client/bin/serve.mjs) — it must travel with the seeded artifact.
+    copyTree(join(local, '..', 'bin'), join(clientRoot, 'bin'));
+    if (!readClientBuildVersion(join(clientRoot, 'build'))) {
+      logger.warn('seeded client build has no version stamp — auto-update comparison will be unreliable', { src: local });
+    }
+    return;
+  }
+
+  // normalizeVersion strips a leading 'v' so a release ref (v1.2.3) becomes the
+  // npm version (1.2.3); dist-tags (latest/next) pass through unchanged.
+  const manifest = await fetchNpmClientManifest(normalizeVersion(repoRef));
+  logger.debug('downloading client build from npm', { version: manifest.version });
+  await downloadNpmClientBundle(manifest, clientRoot, dataDir);
+}
+
+// ── Client update check ──────────────────────────────────────────────────────
+
+export interface ClientBuildUpdateResult {
+  updated: boolean;
+  latestVersion: string | null;
+  error?: string;
+  /**
+   * The on-disk backup of the PREVIOUS client artifact (data/backups/client-<ts>,
+   * capturing the package root: build/ + bin/). Present only when `updated` is
+   * true and a prior artifact existed — kept so a supervisor can restore it if
+   * the new build fails to serve.
+   */
+  backupDir?: string;
+}
+
+/**
+ * Check npm for a newer `@openpalm/client` build and apply it if one exists.
+ *
+ * `@openpalm/client` is independently versioned (like `@openpalm/ui`): pick the
+ * dist-tag CHANNEL from the app's release stream (prerelease → newest across
+ * all dist-tags, stable → `latest`) and compare against the version stamped in
+ * the RESOLVED build on disk. Never auto-crosses a major version.
+ *
+ * When an update is available:
+ *   1. Move data/client/ → data/backups/client-{timestamp}/ (build + bin)
+ *   2. Download the npm bundle (integrity fail-closed) and swap it in
+ *
+ * Non-fatal: any network or extraction error returns { updated: false, error }.
+ * On a failed install the backup is restored in place (restoreOnFailure) —
+ * unlike the UI there is no supervisor restore hook wired for the client, so
+ * the artifact must never be left missing.
+ */
+export async function checkAndUpdateClientBuild(
+  appVersion: string,
+  dataDir: string,
+  channelOverride?: UiUpdateChannel,
+): Promise<ClientBuildUpdateResult> {
+  const clientRoot = join(dataDir, 'client');
+  return checkAndUpdateNpmBundle<NpmBundleManifest, ClientBuildUpdateResult>({
+    appVersion,
+    logLabel: 'client build',
+    resolveManifest: async () =>
+      fetchNpmClientManifest(await resolveChannelRef(CLIENT_PACKAGE, uiUpdateChannel(appVersion, channelOverride))),
+    // Compare against the client build currently on disk, NOT the app version —
+    // the client floats on its own version line. The app version is only the
+    // fallback major-version guard when the on-disk build is unstamped.
+    readCurrentVersion: () => readClientBuildVersion(resolveClientBuildDir()),
+    backup: { dir: clientRoot, gate: join(clientRoot, 'build', 'index.html'), prefix: 'client' },
+    install: (manifest) => downloadNpmClientBundle(manifest, clientRoot, dataDir),
+    restoreOnFailure: true,
+    onBlockedMajor: (latestVersion) => ({ updated: false, latestVersion }),
+    onUpToDate: (latestVersion) => ({ updated: false, latestVersion }),
+    onSuccess: (latestVersion, backupDir) => ({ updated: true, latestVersion, backupDir }),
+    onError: (error) => ({ updated: false, latestVersion: null, error }),
+  });
+}
diff --git a/packages/lib/src/control-plane/ui-assets.ts b/packages/lib/src/control-plane/ui-assets.ts
index 122289e0a..e3fd51d8a 100644
--- a/packages/lib/src/control-plane/ui-assets.ts
+++ b/packages/lib/src/control-plane/ui-assets.ts
@@ -41,9 +41,11 @@ import {
 
 const logger = createLogger('lib:ui-assets');
 
-// ── Private helpers ──────────────────────────────────────────────────────────
+// ── Shared helpers ───────────────────────────────────────────────────────────
+// Exported for the sibling asset modules (client-assets.ts) — not part of the
+// package barrel.
 
-function copyTree(
+export function copyTree(
   src: string,
   dest: string,
   opts?: { skipExisting?: boolean },
@@ -387,7 +389,7 @@ async function fetchNpmUiManifest(versionOrTag: string): Promise<NpmUiManifest>
  * resolver (which lists tags and picks the newest on-channel), take max(dist-tags)
  * = the true bleeding edge (latest beta/rc/stable, whichever is newest).
  */
-async function resolveChannelRef(pkg: string, channel: UiUpdateChannel): Promise<string> {
+export async function resolveChannelRef(pkg: string, channel: UiUpdateChannel): Promise<string> {
   if (channel === 'latest') return 'latest';
   const res = await fetchWithRetry(`${NPM_REGISTRY}/-/package/${encodeURIComponent(pkg)}/dist-tags`);
   if (!res.ok) throw new Error(`npm registry returned HTTP ${res.status} for ${pkg} dist-tags`);
diff --git a/packages/lib/src/index.ts b/packages/lib/src/index.ts
index 653148b86..213baf9d0 100644
--- a/packages/lib/src/index.ts
+++ b/packages/lib/src/index.ts
@@ -544,6 +544,17 @@ export {
   declaredUiChannel,
 } from "./control-plane/ui-assets.js";
 
+// ── Client app (static SPA) asset seeding and resolution (#555 P5c) ─────────
+export type { ClientBuildUpdateResult } from "./control-plane/client-assets.js";
+export {
+  CLIENT_VERSION_STAMP,
+  readClientBuildVersion,
+  resolveLocalClientBuild,
+  resolveClientBuildDir,
+  seedClientBuild,
+  checkAndUpdateClientBuild,
+} from "./control-plane/client-assets.js";
+
 // ── UI-server supervisor primitives (shared by CLI + Electron) ───────────────
 export type {
   WaitForReadyDeps,

From d9102bb21b857c205669ca373188bf11d7708b4e Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Mon, 6 Jul 2026 22:29:13 +0000
Subject: [PATCH 36/61] feat(cli): serve @openpalm/client on stable loopback
 port 3890 (#555)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

P5c item 2 (plan Phase 5 item 3): the supervisor that serves the UI also
starts the client static server — both the default `openpalm` serve path
and `openpalm admin` go through startUIServer.

- ports.ts: DEFAULT_CLIENT_PORT=3890, single-sourced like DEFAULT_UI_PORT
  (stable because the localhost PWA identity is origin-including-port,
  plan §6.10; override via OP_CLIENT_PORT).
- lib/client-server.ts: startClientServer (injectable deps) spawns
  bin/serve.mjs from the RESOLVED client build with PORT / HOST /
  OP_CLIENT_DIR in the env. HOST is pinned to 127.0.0.1 unconditionally —
  OP_ALLOW_REMOTE_SETUP never loosens the client bind (loopback-only
  acceptance). Absent build → log + skip (null), non-fatal: the UI keeps
  serving. Supervised: unexpected exit respawns; stop() SIGTERMs and
  suppresses respawn. resolveClientServeScript = sibling bin/serve.mjs of
  the build dir (holds for both channels).
- commands/client-serve.ts: foreground child command for the COMPILED
  binary case — a compiled binary cannot execute a bare .mjs path the way
  `bun` can, so the supervisor re-invokes `openpalm client-serve`, which
  imports the serve script in-process (same pattern as `openpalm ui` /
  runUiBuild).
- ui-server.ts: start the client server after the UI child is ready; stop
  it in the signal-shutdown path.

Makes client-server.test.ts green (8/8, committed red in 90edbd3); CLI
suite at parity (95 pass + the 1 known uid-0 install-flow failure).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FetR7BttT1xBrA8fBwhui9
---
 packages/cli/src/commands/client-serve.ts |  40 +++++++
 packages/cli/src/lib/client-server.ts     | 131 ++++++++++++++++++++++
 packages/cli/src/lib/ports.ts             |   8 ++
 packages/cli/src/lib/ui-server.ts         |   9 ++
 packages/cli/src/main.ts                  |   1 +
 5 files changed, 189 insertions(+)
 create mode 100644 packages/cli/src/commands/client-serve.ts
 create mode 100644 packages/cli/src/lib/client-server.ts

diff --git a/packages/cli/src/commands/client-serve.ts b/packages/cli/src/commands/client-serve.ts
new file mode 100644
index 000000000..2aa5f8064
--- /dev/null
+++ b/packages/cli/src/commands/client-serve.ts
@@ -0,0 +1,40 @@
+/**
+ * `openpalm client-serve` — run the @openpalm/client static server in the
+ * foreground (P5c, #555). This is the child process the `openpalm` /
+ * `openpalm admin` supervisor spawns when the CLI runs as a COMPILED binary
+ * (a compiled binary cannot execute a bare .mjs path the way `bun` can, so it
+ * re-invokes itself and imports the serve script in-process on the embedded
+ * runtime — the same pattern as `openpalm ui` / runUiBuild).
+ *
+ * The serve script (bin/serve.mjs, zero-dependency) reads PORT / HOST /
+ * OP_CLIENT_DIR from the environment; the supervisor pins HOST=127.0.0.1 and
+ * OP_CLIENT_DIR to the resolved build before spawning.
+ */
+import { defineCommand } from 'citty';
+import { existsSync } from 'node:fs';
+import { resolveClientBuildDir } from '@openpalm/lib';
+import { resolveClientServeScript } from '../lib/client-server.ts';
+
+export default defineCommand({
+  meta: {
+    name: 'client-serve',
+    description:
+      'Run the client app static server in the foreground (no supervisor). ' +
+      'This is the child process the bare `openpalm` supervisor spawns.',
+  },
+  async run() {
+    // OP_CLIENT_DIR (set by the supervisor) pins the served build; a direct
+    // invocation falls back to the shared resolver.
+    const buildDir = process.env.OP_CLIENT_DIR ?? resolveClientBuildDir();
+    const serveScript = resolveClientServeScript(buildDir);
+    if (!existsSync(serveScript)) {
+      console.error(`Client serve script not found at ${serveScript}`);
+      console.error('Run: bun run client:build');
+      process.exit(1);
+    }
+    process.env.OP_CLIENT_DIR ??= buildDir;
+    // Importing the script starts the HTTP server; the listening socket keeps
+    // the process alive.
+    await import(serveScript);
+  },
+});
diff --git a/packages/cli/src/lib/client-server.ts b/packages/cli/src/lib/client-server.ts
new file mode 100644
index 000000000..0d03474a3
--- /dev/null
+++ b/packages/cli/src/lib/client-server.ts
@@ -0,0 +1,131 @@
+/**
+ * Client app static server — spawns and supervises the @openpalm/client
+ * zero-dependency serve script (bin/serve.mjs) from the RESOLVED client build
+ * on a stable loopback port (plan ui-runtime-modes-plan.md Phase 5 item 3,
+ * #555). Runs beside the UI child under the same `openpalm` / `openpalm admin`
+ * supervisor process.
+ *
+ * Policy pins (see client-server.test.ts — the tests are the contract):
+ *   - Loopback-only ALWAYS: HOST is 127.0.0.1 unconditionally. The UI server's
+ *     OP_ALLOW_REMOTE_SETUP relaxation NEVER applies here — remote access to
+ *     the client app is the assistant container's job (#510), not this
+ *     process's.
+ *   - Non-fatal when absent: no client build on disk → log + skip (return
+ *     null). The UI must keep serving.
+ *   - Supervised: an unexpected child exit respawns it; stop() SIGTERMs and
+ *     suppresses any further respawn.
+ */
+import { join, basename } from 'node:path';
+import { existsSync as nodeExistsSync } from 'node:fs';
+import { resolveClientBuildDir } from '@openpalm/lib';
+import { DEFAULT_CLIENT_PORT } from './ports.ts';
+
+const STOP_TIMEOUT_MS = 5_000;
+const RESPAWN_DELAY_MS = 1_000;
+
+/** Minimal child-process surface the supervisor drives (injectable for tests). */
+export type ClientChildProc = Pick<Bun.Subprocess, 'kill' | 'exited' | 'killed'>;
+
+/**
+ * Resolve the serve script that travels WITH the resolved client build:
+ * `<package root>/bin/serve.mjs`, a sibling of the build dir. Holds for both
+ * channels — OP_HOME/data/client/{build,bin} and
+ * $OPENPALM_REPO_ROOT/packages/client/{build,bin}.
+ */
+export function resolveClientServeScript(buildDir: string): string {
+  return join(buildDir, '..', 'bin', 'serve.mjs');
+}
+
+/** Running client-server handle: stop() kills the child and ends supervision. */
+export interface ClientServerHandle {
+  stop: () => Promise<void>;
+}
+
+/** Injectable dependencies for {@link startClientServer} (real process/fs by default). */
+export interface ClientServerDeps {
+  /** Port to serve on (default: OP_CLIENT_PORT env or DEFAULT_CLIENT_PORT). */
+  port?: number;
+  /** Resolve the client build dir (defaults to the shared lib resolver). */
+  resolveBuildDir?: () => string;
+  /** Existence probe for the build gate + serve script (defaults to node:fs). */
+  existsSync?: (path: string) => boolean;
+  /** Spawn the serve child (defaults to Bun.spawn with inherited stdio). */
+  spawnFn?: (cmd: string[], opts: { env: Record<string, string | undefined> }) => ClientChildProc;
+  log?: (...args: unknown[]) => void;
+  logError?: (...args: unknown[]) => void;
+  /** Sleep for the respawn delay and the stop grace window. */
+  sleep?: (ms: number) => Promise<void>;
+  /** Force-kill grace window, ms (defaults to STOP_TIMEOUT_MS). */
+  stopTimeoutMs?: number;
+}
+
+/**
+ * Start (and supervise) the client static server. Resolves to a handle, or to
+ * null when no client build is present — NON-FATAL by contract: this function
+ * never throws and never exits; the UI supervisor keeps serving without the
+ * client app.
+ */
+export async function startClientServer(deps: ClientServerDeps = {}): Promise<ClientServerHandle | null> {
+  const port = deps.port ?? (Number(process.env.OP_CLIENT_PORT) || DEFAULT_CLIENT_PORT);
+  const resolveBuildDir = deps.resolveBuildDir ?? resolveClientBuildDir;
+  const exists = deps.existsSync ?? nodeExistsSync;
+  const spawnFn = deps.spawnFn
+    ?? ((cmd: string[], opts: { env: Record<string, string | undefined> }): ClientChildProc =>
+      Bun.spawn(cmd, { env: opts.env, stdout: 'inherit', stderr: 'inherit' }));
+  const log = deps.log ?? console.log;
+  const logError = deps.logError ?? console.error;
+  const sleep = deps.sleep ?? ((ms: number) => new Promise<void>((r) => setTimeout(r, ms)));
+  const stopTimeoutMs = deps.stopTimeoutMs ?? STOP_TIMEOUT_MS;
+
+  const buildDir = resolveBuildDir();
+  const serveScript = resolveClientServeScript(buildDir);
+  if (!exists(join(buildDir, 'index.html')) || !exists(serveScript)) {
+    log(`Client app build not found at ${buildDir} — skipping the client server (the UI keeps serving).`);
+    return null;
+  }
+
+  // The child runs on THIS binary's embedded runtime (no system `node`
+  // required — same rationale as the UI child in ui-server.ts):
+  //   dev (bun)       → [bun, <serve.mjs>]           bun executes the script
+  //   compiled binary → [binary, 'client-serve']     re-invoke `openpalm
+  //                     client-serve`, which imports the resolved serve script
+  //                     in-process (OP_CLIENT_DIR below pins the served dir).
+  const execName = basename(process.execPath).toLowerCase();
+  const runningAsBun = execName === 'bun' || execName === 'bun.exe';
+  const cmd = runningAsBun ? [process.execPath, serveScript] : [process.execPath, 'client-serve'];
+  // serve.mjs reads its config from the environment (PORT / HOST /
+  // OP_CLIENT_DIR). HOST is pinned to loopback AFTER the process.env spread so
+  // nothing — including OP_ALLOW_REMOTE_SETUP — can loosen the bind.
+  const env: Record<string, string | undefined> = {
+    ...process.env,
+    PORT: String(port),
+    HOST: '127.0.0.1',
+    OP_CLIENT_DIR: buildDir,
+  };
+
+  let stopping = false;
+  let proc = spawnFn(cmd, { env });
+  log(`Client app served at http://127.0.0.1:${port} (from ${buildDir})`);
+
+  // Supervision loop: respawn on any unexpected exit; an intentional stop()
+  // flips `stopping` first, which both breaks the loop and suppresses respawn.
+  void (async () => {
+    while (!stopping) {
+      const code = await proc.exited;
+      if (stopping) break;
+      logError(`Client app server exited unexpectedly (code ${code}) — restarting.`);
+      await sleep(RESPAWN_DELAY_MS);
+      if (stopping) break;
+      proc = spawnFn(cmd, { env });
+    }
+  })();
+
+  return {
+    stop: async () => {
+      stopping = true;
+      proc.kill('SIGTERM');
+      await Promise.race([proc.exited, sleep(stopTimeoutMs)]);
+      if (!proc.killed) proc.kill('SIGKILL');
+    },
+  };
+}
diff --git a/packages/cli/src/lib/ports.ts b/packages/cli/src/lib/ports.ts
index fda7c5462..0add95f0a 100644
--- a/packages/cli/src/lib/ports.ts
+++ b/packages/cli/src/lib/ports.ts
@@ -9,3 +9,11 @@ export const DEFAULT_UI_PORT = 3880;
 
 /** Default published host port for the assistant (override via OP_ASSISTANT_PORT). */
 export const DEFAULT_ASSISTANT_PORT = 3800;
+
+/**
+ * Default host port for the @openpalm/client static app server (override via
+ * OP_CLIENT_PORT). STABLE by design: the localhost PWA identity is
+ * origin-including-port (plan ui-runtime-modes-plan.md §6.10), so this number
+ * must not drift between releases.
+ */
+export const DEFAULT_CLIENT_PORT = 3890;
diff --git a/packages/cli/src/lib/ui-server.ts b/packages/cli/src/lib/ui-server.ts
index d05bc1d3f..c0e65dbb7 100644
--- a/packages/cli/src/lib/ui-server.ts
+++ b/packages/cli/src/lib/ui-server.ts
@@ -16,6 +16,7 @@ import {
 import { ensureValidState, resolveServeState } from './cli-state.ts';
 import { openBrowser } from './browser.ts';
 import { DEFAULT_UI_PORT } from './ports.ts';
+import { startClientServer } from './client-server.ts';
 
 const logger = createLogger('cli:ui');
 const DEFAULT_PORT = Number(process.env.OP_HOST_UI_PORT) || DEFAULT_UI_PORT;
@@ -291,6 +292,13 @@ export async function startUIServer(opts: UIServerOptions = {}): Promise<void> {
   if (!await supervisor.start()) return; // onStartFailure already exited
 
   console.log(`UI server running at ${uiUrl}`);
+
+  // Serve the @openpalm/client static app beside the UI on its stable loopback
+  // port (P5c, #555; plan Phase 5 item 3). Both the default serve path and
+  // `openpalm admin` come through here. Non-fatal: absent build → log + skip
+  // (null handle), and the UI keeps serving.
+  const clientHandle = await startClientServer();
+
   if (opts.open !== false) await openBrowser(uiUrl);
 
   // Supervisor restart (§4.4): the UI child (admin "install UI version" route)
@@ -304,6 +312,7 @@ export async function startUIServer(opts: UIServerOptions = {}): Promise<void> {
     supervisor.markShuttingDown();
     console.log(`\nReceived ${signal}. Shutting down...`);
     try {
+      if (clientHandle) await clientHandle.stop();
       const proc = supervisor.current;
       if (proc) await stopUiProc(proc);
       console.log('Shutdown complete.');
diff --git a/packages/cli/src/main.ts b/packages/cli/src/main.ts
index 61fd4e735..a400d01fc 100755
--- a/packages/cli/src/main.ts
+++ b/packages/cli/src/main.ts
@@ -103,6 +103,7 @@ const subCommands = {
   automations: () => import('./commands/automations.ts').then((m) => m.default),
   unlock: () => import('./commands/unlock.ts').then((m) => m.default),
   ui: () => import('./commands/ui.ts').then((m) => m.default),
+  'client-serve': () => import('./commands/client-serve.ts').then((m) => m.default),
 };
 
 export const mainCommand = defineCommand({

From 05086edfc1332ce38fdc2a7b82c191a0386f7b45 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Mon, 6 Jul 2026 22:29:25 +0000
Subject: [PATCH 37/61] feat(electron): client server child + window prefers
 the client chat (#555)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

P5c item 3 (plan Phase 5 item 3): main.ts starts the @openpalm/client
static server child after the UI server, and the window prefers it.

- startClientAppServer: spawn bin/serve.mjs (sibling of the resolved
  client build) with Electron's bundled Node (ELECTRON_RUN_AS_NODE) on
  CLIENT_PORT=3890, HOST pinned to 127.0.0.1 — no remote escape hatch.
  Non-fatal: absent build or spawn failure → log + skip; killed in
  before-quit alongside the UI child.
- resolveInitialUrl (now EXPORTED for tests): setup complete + client
  healthy → http://127.0.0.1:3890/chat; client unreachable → dumb fallback
  to the host app chat on 3880 (packages/ui chat is NOT deleted — parity
  follow-up); setup incomplete → always the host app /setup (the client
  artifact has no wizard, §8.10); setup-probe failure → host app root
  (existing landing-guard behavior, unchanged). The client probe is
  bounded (1.5s) so a dead client never stalls window creation.
- HARNESS_CONTRACT_VERSION stays 1: spawn-env/child work only — no IPC
  channels, no renderer-facing env keys (harness-contract-drift tests
  still green).

Makes initial-url.test.ts green (5 reds from 90edbd3 + 2
characterizations); electron suite 94/94.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FetR7BttT1xBrA8fBwhui9
---
 packages/electron/src/main.ts | 95 ++++++++++++++++++++++++++++++++++-
 1 file changed, 93 insertions(+), 2 deletions(-)

diff --git a/packages/electron/src/main.ts b/packages/electron/src/main.ts
index 3216c423f..d86e3f261 100644
--- a/packages/electron/src/main.ts
+++ b/packages/electron/src/main.ts
@@ -8,6 +8,7 @@ import {
   resolveOpenPalmHome,
   resolveDataDir,
   resolveUiBuildDir,
+  resolveClientBuildDir,
   seedUiBuild,
   ensureHomeDirs,
   checkAndUpdateUiBuild,
@@ -129,13 +130,22 @@ function resolveAdminToolsPluginPath(): string {
 // URL and OP_ASSISTANT_PORT is read as an env string.
 const DEFAULT_UI_PORT = 3880;
 const DEFAULT_ASSISTANT_PORT = '3800';
+// The @openpalm/client static app's STABLE loopback port (P5c, #555): the
+// localhost PWA identity is origin-including-port (plan §6.10), so this number
+// must not drift between releases. Mirrors the CLI's DEFAULT_CLIENT_PORT.
+const DEFAULT_CLIENT_PORT = 3890;
 const UI_PORT = Number(process.env.OP_HOST_UI_PORT) || DEFAULT_UI_PORT;
+const CLIENT_PORT = Number(process.env.OP_CLIENT_PORT) || DEFAULT_CLIENT_PORT;
 const READY_TIMEOUT_MS = 60_000;
+// Bound on the client-health probe in resolveInitialUrl — a dead client must
+// not stall window creation (the fallback to the host UI chat covers it).
+const CLIENT_PROBE_TIMEOUT_MS = 1_500;
 const MIC_SHORTCUT = 'CommandOrControl+Shift+M';
 const APP_USER_MODEL_ID = 'com.openpalm.app';
 
 let mainWindow: BrowserWindow | null = null;
 let uiProcess: ChildProcess | null = null;
+let clientProcess: ChildProcess | null = null;
 let localOpencode: LocalOpencodeHandle | null = null;
 let registeredMicShortcut: string | null = null;
 // Whether the GitHub update check should surface prereleases (#504). Loaded from
@@ -624,9 +634,78 @@ function stopUIServer(): void {
   try { rmSync(join(resolveDataDir(), '.ui-server.pid'), { force: true }); } catch { /* best-effort */ }
 }
 
+// ── Client app static server (P5c, #555) ─────────────────────────────────────
+// The @openpalm/client static SPA is served by its zero-dependency serve script
+// (bin/serve.mjs, a sibling of the resolved build) on the stable loopback
+// CLIENT_PORT. Spawn-env/child work only — no bridge surface, no IPC, so
+// HARNESS_CONTRACT_VERSION is untouched. Non-fatal when the build is absent:
+// log + skip, and resolveInitialUrl falls back to the host UI chat on 3880.
+
+function startClientAppServer(): void {
+  try {
+    const buildDir = resolveClientBuildDir();
+    const serveScript = join(buildDir, '..', 'bin', 'serve.mjs');
+    if (!existsSync(join(buildDir, 'index.html')) || !existsSync(serveScript)) {
+      console.log(`Client app build not found at ${buildDir} — skipping the client server (chat falls back to the host UI).`);
+      return;
+    }
+    // Same bundled-Node spawn as the UI child (no system `node` required).
+    // serve.mjs reads PORT / HOST / OP_CLIENT_DIR from the environment; HOST is
+    // pinned to loopback unconditionally — the client server has no remote
+    // escape hatch.
+    clientProcess = spawn(process.execPath, [serveScript], {
+      env: {
+        ...process.env,
+        ELECTRON_RUN_AS_NODE: '1',
+        PORT: String(CLIENT_PORT),
+        HOST: '127.0.0.1',
+        OP_CLIENT_DIR: buildDir,
+      },
+      stdio: ['ignore', 'pipe', 'pipe'],
+    });
+    clientProcess.stdout?.on('data', (chunk: Buffer) => { writeChildLog(chunk.toString()); });
+    clientProcess.stderr?.on('data', (chunk: Buffer) => { writeChildLog(chunk.toString()); });
+    clientProcess.on('error', (err) => {
+      // Non-fatal: the window falls back to the host UI chat.
+      console.warn('Client app server process error:', err.message);
+      clientProcess = null;
+    });
+    clientProcess.on('exit', (code) => {
+      if (code !== 0 && code !== null) console.warn(`Client app server exited with code ${code}`);
+      clientProcess = null;
+    });
+    console.log(`Client app served at http://127.0.0.1:${CLIENT_PORT} (from ${buildDir})`);
+  } catch (err) {
+    console.warn('Client app server failed to start (non-fatal):', err instanceof Error ? err.message : String(err));
+    clientProcess = null;
+  }
+}
+
+function stopClientAppServer(): void {
+  const proc = clientProcess;
+  clientProcess = null;
+  // Plain kill — serve.mjs spawns no children of its own.
+  if (proc?.pid) {
+    try { proc.kill('SIGTERM'); } catch { /* already dead */ }
+  }
+}
+
 // ── Window management ────────────────────────────────────────────────────────
 
-async function resolveInitialUrl(): Promise<string> {
+/**
+ * Decide which page the window opens on (exported for tests — P5c, #555):
+ *
+ *   setup complete + client server healthy → the CLIENT app chat
+ *     (http://127.0.0.1:CLIENT_PORT/chat)
+ *   setup complete + client unreachable    → the HOST APP chat on UI_PORT
+ *     (dumb fallback: probe, and on any failure use the host UI — e.g. no
+ *     client build on disk; startClientAppServer's skip is non-fatal)
+ *   setup incomplete                       → the host app's /setup wizard
+ *     (ALWAYS the host app — the client artifact has no setup wizard, §8.10)
+ *   setup-status probe failure             → host app root (its landing guard
+ *     redirects — existing behavior, unchanged)
+ */
+export async function resolveInitialUrl(): Promise<string> {
   // Try to read setup status so we can land directly on the right page.
   // Falls back to root (which itself redirects appropriately).
   try {
@@ -635,7 +714,13 @@ async function resolveInitialUrl(): Promise<string> {
     });
     if (res.ok) {
       const data = await res.json() as { setupComplete?: boolean };
-      return `http://127.0.0.1:${UI_PORT}/${data.setupComplete ? 'chat' : 'setup'}`;
+      if (!data.setupComplete) return `http://127.0.0.1:${UI_PORT}/setup`;
+      // Prefer the client app chat when its server responds; the probe is
+      // short/bounded so a dead client never stalls window creation.
+      if (await waitForReady(CLIENT_PORT, CLIENT_PROBE_TIMEOUT_MS)) {
+        return `http://127.0.0.1:${CLIENT_PORT}/chat`;
+      }
+      return `http://127.0.0.1:${UI_PORT}/chat`;
     }
   } catch {
     // ignore; fall through to root
@@ -821,6 +906,11 @@ app.whenReady().then(async () => {
     return;
   }
 
+  // Start the @openpalm/client static server child after the UI server (P5c,
+  // #555). Non-fatal by design: absent build or spawn failure → log + skip,
+  // and resolveInitialUrl lands the window on the host UI chat instead.
+  startClientAppServer();
+
   // Spawn the ephemeral local OpenCode (Phase 3). Non-fatal: if the binary
   // is missing or spawn fails, the UI shows a sentinel and remote endpoints
   // continue to work.
@@ -933,6 +1023,7 @@ app.on('before-quit', (event) => {
   event.preventDefault();
   globalShortcut.unregisterAll();
   trayController.stopAnimation();
+  stopClientAppServer();
   stopUIServer();
   const handle = localOpencode;
   localOpencode = null;

From 034da91355878fd94cbff85a76e188b7c014896b Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Mon, 6 Jul 2026 22:58:07 +0000
Subject: [PATCH 38/61] test(p5d): red tests for #510
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Assistant container serves @openpalm/client (plan §6.9 Slice A). Written
BEFORE the implementation; 16 tests fail for the right reason (missing
feature), 5 pass as labeled characterization pins.

assistant-client-entrypoint.test.ts:
- BEHAVIORAL (bash-driven, npm/bun/node stubbed): install_runtime_artifacts
  exact-pin resolution OP_CLIENT_VERSION -> PLATFORM_VERSION -> hard error
  (no latest fallback, §8 rule 1); warn-and-continue on client install
  failure after resolution. 4 RED. Harness verified green-capable against a
  simulated post-P5d entrypoint (all four scenarios).
- STATIC-ONLY (labeled; no docker daemon in this environment): no
  @openpalm/ui install and no OP_UI_VERSION; start_client replaces start_ui;
  co-process launch exports no OPENCODE_API_URL (old wiring bug path
  deleted); serve.mjs on OP_CLIENT_PORT (default 3000) bound 0.0.0.0
  in-container; runtime-config.json beside the build pointing the browser at
  the published OpenCode URL (OP_ASSISTANT_PORT:-3800 default,
  OP_CLIENT_DEFAULT_ASSISTANT_URL override); Dockerfile free of
  /opt/openpalm/ui remnants. 7 RED.
- CHARACTERIZATION (green now, must stay green): skeleton pull unchanged
  (OP_SKELETON_VERSION exact pin still honored); entrypoint bash -n clean
  (shellcheck unavailable in this environment); Dockerfile PLATFORM_VERSION
  ARG re-exported as ENV.

assistant-client-compose.test.ts (yaml-parse, network-partitioning pattern):
- RED: assistant service publishes an OP_CLIENT_PORT mapping; host bind
  respects the OP_BIND_ADDRESS policy with loopback default; container side
  targets the serve port 3000; OP_CLIENT_VERSION passes through the assistant
  environment (docker-restart pin pickup, plan §11); env docs gain
  OP_CLIENT_VERSION/OP_CLIENT_PORT.
- CHARACTERIZATION: assistant-artifacts volume still persists /opt/openpalm.

packages/lib parity: 33 fail = 16 new P5d reds + exactly the 17 known uid-0
failures; 10 docker-gated skips; lint baseline unchanged (0 findings in new
files).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FetR7BttT1xBrA8fBwhui9
---
 .../assistant-client-compose.test.ts          | 115 ++++++++
 .../assistant-client-entrypoint.test.ts       | 258 ++++++++++++++++++
 2 files changed, 373 insertions(+)
 create mode 100644 packages/lib/src/control-plane/assistant-client-compose.test.ts
 create mode 100644 packages/lib/src/control-plane/assistant-client-entrypoint.test.ts

diff --git a/packages/lib/src/control-plane/assistant-client-compose.test.ts b/packages/lib/src/control-plane/assistant-client-compose.test.ts
new file mode 100644
index 000000000..fbeca3049
--- /dev/null
+++ b/packages/lib/src/control-plane/assistant-client-compose.test.ts
@@ -0,0 +1,115 @@
+/**
+ * P5d (#510 Slice A) — compose publishes the client co-process port.
+ *
+ * RED tests written BEFORE the implementation (plan §6.9 known gap 1: "the
+ * co-process port is not published in any compose file"; Phase 5 item 4:
+ * "Publish the port in compose behind the existing bind-address policy").
+ *
+ * All checks here are STATIC-ONLY: the managed compose YAML is parsed
+ * directly (same pattern as network-partitioning.test.ts) — no docker daemon
+ * exists in the dev/CI container, so `docker compose config` cannot be run.
+ *
+ * Tests marked CHARACTERIZATION pass against the current tree and pin landed
+ * behavior the P5d implementation must not regress.
+ */
+import { describe, expect, test } from 'bun:test';
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { parse as yamlParse } from 'yaml';
+
+const REPO_ROOT = join(import.meta.dir, '../../../..');
+const STACK_DIR = join(REPO_ROOT, 'packages/skeleton/system/stack');
+
+type ComposeService = {
+  ports?: unknown[];
+  environment?: Record<string, unknown> | string[];
+  volumes?: unknown[];
+};
+type ComposeDoc = { services?: Record<string, ComposeService> };
+
+const core = yamlParse(readFileSync(join(STACK_DIR, 'core.compose.yml'), 'utf8')) as ComposeDoc;
+const assistant = core.services?.assistant;
+const assistantPorts: string[] = (assistant?.ports ?? []).map(String);
+const clientPortEntries = assistantPorts.filter((p) => p.includes('OP_CLIENT_PORT'));
+
+/** True when the service environment (map or list form) defines `name`. */
+function environmentHas(service: ComposeService | undefined, name: string): boolean {
+  const env = service?.environment;
+  if (!env) return false;
+  if (Array.isArray(env)) return env.some((e) => String(e).startsWith(`${name}=`));
+  return Object.keys(env).includes(name);
+}
+
+describe('P5d compose — client port published on the assistant service', () => {
+  test('a client port mapping (OP_CLIENT_PORT) exists on the assistant service', () => {
+    expect(assistant, 'assistant service must exist in core.compose.yml').toBeTruthy();
+    expect(
+      clientPortEntries.length,
+      `expected an OP_CLIENT_PORT mapping among assistant ports: ${JSON.stringify(assistantPorts)}`,
+    ).toBeGreaterThan(0);
+  });
+
+  test('client port host bind respects the OP_BIND_ADDRESS policy with a loopback default', () => {
+    // Accepts the global form `${OP_BIND_ADDRESS:-127.0.0.1}` or the nested
+    // per-service override form
+    // `${OP_CLIENT_BIND_ADDRESS:-${OP_BIND_ADDRESS:-127.0.0.1}}` (C1 pattern).
+    // Either way the default MUST be loopback and the global policy honored.
+    for (const entry of clientPortEntries) {
+      expect(entry).toContain('OP_BIND_ADDRESS:-127.0.0.1');
+    }
+    expect(clientPortEntries.length).toBeGreaterThan(0);
+  });
+
+  test('client port maps to the in-container serve port (entrypoint default 3000)', () => {
+    // Container side must be the port start_client serves on: a literal 3000
+    // or the OP_CLIENT_PORT variable defaulting to 3000.
+    const matching = clientPortEntries.filter((entry) =>
+      /:(\$\{OP_CLIENT_PORT(:-3000)?\}|3000)$/.test(entry),
+    );
+    expect(
+      matching.length,
+      `no client port entry targets container port 3000: ${JSON.stringify(clientPortEntries)}`,
+    ).toBeGreaterThan(0);
+  });
+});
+
+describe('P5d compose — stack env plumbing for the exact-pin client artifact', () => {
+  test('OP_CLIENT_VERSION passes through to the assistant container (docker restart with a new pin picks up the new client)', () => {
+    // Plan §11 acceptance: `docker restart` with a new OP_CLIENT_VERSION must
+    // pick up the new artifact — so the env var has to reach the entrypoint
+    // through the assistant service environment, not just compose
+    // interpolation.
+    expect(environmentHas(assistant, 'OP_CLIENT_VERSION')).toBe(true);
+  });
+
+  // CHARACTERIZATION (green today): the client artifact installs under
+  // /opt/openpalm, which is the persistent assistant-artifacts named volume —
+  // warm restarts must keep reusing the installed client.
+  test('assistant-artifacts volume still persists /opt/openpalm (characterization)', () => {
+    const volumes = (assistant?.volumes ?? []).map(String);
+    expect(volumes).toContain('assistant-artifacts:/opt/openpalm');
+  });
+});
+
+describe('P5d docs — new env vars are documented (static-only)', () => {
+  test('OP_CLIENT_VERSION and OP_CLIENT_PORT appear in the stack env docs', () => {
+    const envAndMounts = readFileSync(
+      join(REPO_ROOT, 'docs/technical/environment-and-mounts.md'),
+      'utf8',
+    );
+    const consolidated = readFileSync(
+      join(REPO_ROOT, 'docs/technical/consolidated-stack-env.md'),
+      'utf8',
+    );
+    const combined = envAndMounts + consolidated;
+    // Boolean asserts keep the failure output readable (no full-doc dump).
+    expect(
+      combined.includes('OP_CLIENT_VERSION'),
+      'neither environment-and-mounts.md nor consolidated-stack-env.md documents OP_CLIENT_VERSION',
+    ).toBe(true);
+    expect(
+      combined.includes('OP_CLIENT_PORT'),
+      'neither environment-and-mounts.md nor consolidated-stack-env.md documents OP_CLIENT_PORT',
+    ).toBe(true);
+  });
+});
diff --git a/packages/lib/src/control-plane/assistant-client-entrypoint.test.ts b/packages/lib/src/control-plane/assistant-client-entrypoint.test.ts
new file mode 100644
index 000000000..261bab06e
--- /dev/null
+++ b/packages/lib/src/control-plane/assistant-client-entrypoint.test.ts
@@ -0,0 +1,258 @@
+/**
+ * P5d (#510 Slice A) — the assistant container serves `@openpalm/client`
+ * instead of the full `@openpalm/ui` host app (plan §6.9 as-landed + Phase 5
+ * item 4; docs/technical/ui-runtime-modes-plan.md).
+ *
+ * RED tests written BEFORE the implementation. Two kinds of test live here:
+ *
+ * 1. BEHAVIORAL (bash-driven): `install_runtime_artifacts` is executed in a
+ *    sandboxed bash with npm/bun/node stubbed onto PATH, so the exact-pin
+ *    version-resolution chain (OP_CLIENT_VERSION → PLATFORM_VERSION → hard
+ *    error, §8 rule 1: never `latest`) is exercised for real, not grepped.
+ *    The entrypoint's trailing boot sequence (bare function-name lines at
+ *    column 0) is stripped before sourcing so only definitions load.
+ *
+ * 2. STATIC-ONLY (labeled): string/regex assertions over entrypoint.sh and
+ *    the Dockerfile. No docker daemon exists in the dev/CI container, so the
+ *    co-process cannot be booted here — static verification (`bash -n` +
+ *    content asserts) is the honest limit, mirroring
+ *    assistant-rootless-entrypoint.test.ts.
+ *
+ * Tests marked CHARACTERIZATION pass against the current tree and pin
+ * landed behavior the P5d implementation must not regress.
+ */
+import { describe, expect, test } from 'bun:test';
+import { spawnSync } from 'node:child_process';
+import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+
+const REPO_ROOT = join(import.meta.dir, '../../../..');
+const ENTRYPOINT_PATH = join(REPO_ROOT, 'containers/assistant/entrypoint.sh');
+const entrypoint = readFileSync(ENTRYPOINT_PATH, 'utf8');
+const dockerfile = readFileSync(join(REPO_ROOT, 'containers/assistant/Dockerfile'), 'utf8');
+
+// ── Behavioral harness ───────────────────────────────────────────────────────
+// Sources ONLY the function definitions from the entrypoint (top-level bare
+// invocation lines — the boot sequence — are stripped; unindented bash
+// keywords are preserved), stubs npm/bun/node to log-and-succeed (or fail on
+// STUB_NPM_FAIL_PATTERN), then runs install_runtime_artifacts with a
+// controlled environment.
+const DRIVER = `#!/usr/bin/env bash
+set -uo pipefail
+
+ENTRYPOINT="$1"
+WORK="$2"
+
+mkdir -p "$WORK/bin"
+
+cat > "$WORK/bin/npm" <<'STUB'
+#!/usr/bin/env bash
+printf 'npm %s\\n' "$*" >> "$NPM_LOG"
+if [ -n "\${STUB_NPM_FAIL_PATTERN:-}" ] && [[ "$*" == *"\${STUB_NPM_FAIL_PATTERN}"* ]]; then
+  echo "npm error simulated registry failure" >&2
+  exit 1
+fi
+exit 0
+STUB
+
+cat > "$WORK/bin/bun" <<'STUB'
+#!/usr/bin/env bash
+printf 'bun %s\\n' "$*" >> "$NPM_LOG"
+if [ -n "\${STUB_NPM_FAIL_PATTERN:-}" ] && [[ "$*" == *"\${STUB_NPM_FAIL_PATTERN}"* ]]; then
+  echo "bun error simulated registry failure" >&2
+  exit 1
+fi
+exit 0
+STUB
+
+cat > "$WORK/bin/node" <<'STUB'
+#!/usr/bin/env bash
+printf 'node %s\\n' "$*" >> "$NPM_LOG"
+exit 0
+STUB
+
+chmod +x "$WORK/bin/npm" "$WORK/bin/bun" "$WORK/bin/node"
+export PATH="$WORK/bin:$PATH"
+
+# Strip the top-level boot-sequence invocations (bare function-name lines at
+# column 0); keep unindented bash keywords so syntax cannot break.
+awk '!/^[a-z_][a-z0-9_]*$/ || /^(fi|done|esac|then|else|do)$/' "$ENTRYPOINT" > "$WORK/functions.sh"
+
+# shellcheck disable=SC1091
+source "$WORK/functions.sh"
+
+install_runtime_artifacts
+`;
+
+type ScenarioResult = { exitCode: number; stderr: string; npmLog: string };
+
+function runInstallScenario(scenarioEnv: Record<string, string>): ScenarioResult {
+  const tempDir = mkdtempSync(join(tmpdir(), 'openpalm-p5d-entrypoint-'));
+  try {
+    const driverPath = join(tempDir, 'driver.sh');
+    writeFileSync(driverPath, DRIVER, { mode: 0o755 });
+    const npmLogPath = join(tempDir, 'npm.log');
+    writeFileSync(npmLogPath, '');
+    const home = join(tempDir, 'home');
+    mkdirSync(home, { recursive: true });
+    const proc = spawnSync('bash', [driverPath, ENTRYPOINT_PATH, tempDir], {
+      encoding: 'utf8',
+      // Deterministic env: only PATH/HOME plus the scenario's vars. No
+      // OP_*_VERSION or PLATFORM_VERSION leaks in from the outer process.
+      env: {
+        PATH: process.env.PATH ?? '/usr/bin:/bin',
+        HOME: home,
+        NPM_LOG: npmLogPath,
+        ...scenarioEnv,
+      },
+    });
+    return {
+      exitCode: proc.status ?? 1,
+      stderr: proc.stderr ?? '',
+      npmLog: readFileSync(npmLogPath, 'utf8'),
+    };
+  } finally {
+    rmSync(tempDir, { recursive: true, force: true });
+  }
+}
+
+function extractFunction(source: string, name: string): string | null {
+  const match = source.match(new RegExp(`^${name}\\(\\) \\{\\n[\\s\\S]*?^\\}`, 'm'));
+  return match ? match[0] : null;
+}
+
+// ── Behavioral: exact-pin version resolution for @openpalm/client ───────────
+
+describe('P5d install_runtime_artifacts — @openpalm/client version resolution (behavioral)', () => {
+  test('OP_CLIENT_VERSION override wins over PLATFORM_VERSION', () => {
+    const result = runInstallScenario({
+      OP_CLIENT_VERSION: '9.9.9-test',
+      PLATFORM_VERSION: '1.1.1-platform',
+    });
+    expect(result.exitCode, result.stderr).toBe(0);
+    expect(result.npmLog).toContain('@openpalm/client@9.9.9-test');
+    expect(result.npmLog).not.toContain('@openpalm/client@1.1.1-platform');
+  });
+
+  test('falls back to PLATFORM_VERSION when OP_CLIENT_VERSION is unset', () => {
+    const result = runInstallScenario({
+      PLATFORM_VERSION: '1.1.1-platform',
+    });
+    expect(result.exitCode, result.stderr).toBe(0);
+    expect(result.npmLog).toContain('@openpalm/client@1.1.1-platform');
+  });
+
+  test('hard error naming OP_CLIENT_VERSION when neither version source is set (no latest fallback, §8 rule 1)', () => {
+    const result = runInstallScenario({});
+    expect(result.exitCode).not.toBe(0);
+    expect(result.stderr).toContain('OP_CLIENT_VERSION');
+    // Never silently resolve to a moving tag.
+    expect(result.npmLog).not.toContain('@latest');
+  });
+
+  test('client install failure AFTER version resolution warns and continues (warm-restart resilience, plan §3)', () => {
+    const result = runInstallScenario({
+      OP_CLIENT_VERSION: '9.9.9-test',
+      PLATFORM_VERSION: '1.1.1-platform',
+      STUB_NPM_FAIL_PATTERN: '@openpalm/client',
+    });
+    // A registry blip must not brick a previously-working container.
+    expect(result.exitCode, result.stderr).toBe(0);
+    expect(result.stderr).toMatch(/@openpalm\/client@9\.9\.9-test install failed/);
+  });
+
+  // CHARACTERIZATION (green before AND after P5d): the skeleton pull is
+  // untouched by this phase. OP_UI_VERSION is supplied only so the pre-P5d
+  // entrypoint gets past its (to-be-removed) UI version gate; after P5d it is
+  // simply ignored.
+  test('skeleton resolution unchanged: OP_SKELETON_VERSION override still installs that exact pin (characterization)', () => {
+    const result = runInstallScenario({
+      OP_CLIENT_VERSION: '1.1.1-platform',
+      OP_UI_VERSION: '1.1.1-platform',
+      OP_SKELETON_VERSION: '2.2.2-test',
+      PLATFORM_VERSION: '1.1.1-platform',
+    });
+    expect(result.exitCode, result.stderr).toBe(0);
+    expect(result.npmLog).toContain('@openpalm/skeleton@2.2.2-test');
+  });
+});
+
+// ── STATIC-ONLY checks (no docker daemon in this environment; content
+//    assertions + bash -n are the verification limit here) ──────────────────
+
+describe('P5d entrypoint — client co-process (static-only)', () => {
+  test('entrypoint installs @openpalm/client, with no @openpalm/ui remnants', () => {
+    expect(entrypoint).toContain('@openpalm/client');
+    expect(entrypoint).not.toContain('@openpalm/ui');
+    // Artifact prefix mirrors the landed layout under the persistent
+    // assistant-artifacts volume (/opt/openpalm).
+    expect(entrypoint).toContain('/opt/openpalm/client');
+    expect(entrypoint).not.toContain('/opt/openpalm/ui');
+  });
+
+  test('legacy OP_UI_VERSION resolution is replaced by OP_CLIENT_VERSION', () => {
+    expect(entrypoint).toContain('OP_CLIENT_VERSION');
+    expect(entrypoint).not.toContain('OP_UI_VERSION');
+  });
+
+  test('start_client replaces start_ui in both definition and boot sequence', () => {
+    expect(entrypoint).toMatch(/^start_client\(\) \{/m);
+    expect(entrypoint).not.toMatch(/^start_ui\(\) \{/m);
+    // Boot sequence: bare invocation at column 0.
+    expect(entrypoint).toMatch(/^start_client$/m);
+    expect(entrypoint).not.toMatch(/^start_ui$/m);
+  });
+
+  test('co-process launch exports no OPENCODE_API_URL (old wiring bug path deleted — browser talks to OpenCode directly)', () => {
+    // Scoped to the co-process function: the cron preamble legitimately
+    // forwards the compose-provided OPENCODE_API_URL to akm cron jobs and is
+    // NOT the co-process.
+    const coProcess = extractFunction(entrypoint, 'start_client') ?? extractFunction(entrypoint, 'start_ui');
+    expect(coProcess, 'expected a start_client() co-process function in entrypoint.sh').toBeTruthy();
+    expect(coProcess as string).not.toContain('OPENCODE_API_URL');
+    // The static client is not an adapter-node server; no @openpalm/ui build entry.
+    expect(coProcess as string).not.toContain('build/index.js');
+  });
+
+  test('client is served by the package static server on OP_CLIENT_PORT (default 3000), bound to 0.0.0.0 inside the container', () => {
+    const startClient = extractFunction(entrypoint, 'start_client') ?? '';
+    expect(startClient, 'expected start_client() to be defined').not.toBe('');
+    expect(startClient).toContain('serve.mjs');
+    expect(startClient).toContain('OP_CLIENT_PORT:-3000');
+    // In-container bind is 0.0.0.0; host exposure is governed by the compose
+    // port mapping (loopback default) — see assistant-client-compose.test.ts.
+    expect(startClient).toContain('0.0.0.0');
+  });
+
+  test('runtime-config.json is written beside the build, pointing the BROWSER at the published OpenCode URL', () => {
+    expect(entrypoint).toContain('runtime-config.json');
+    // Default: the host-published assistant port (what a browser can reach),
+    // NOT the in-container :4096.
+    expect(entrypoint).toContain('OP_ASSISTANT_PORT:-3800');
+    // Operator override for non-default topologies.
+    expect(entrypoint).toContain('OP_CLIENT_DEFAULT_ASSISTANT_URL');
+  });
+
+  // CHARACTERIZATION (green today): syntax gate. shellcheck is unavailable in
+  // this environment (documented limitation) — bash -n is the floor.
+  test('entrypoint stays bash -n clean (characterization)', () => {
+    const proc = spawnSync('bash', ['-n', ENTRYPOINT_PATH], { encoding: 'utf8' });
+    expect(proc.status, proc.stderr).toBe(0);
+  });
+});
+
+describe('P5d assistant Dockerfile (static-only)', () => {
+  test('no @openpalm/ui co-process remnants; client artifact dir seeded instead', () => {
+    expect(dockerfile).not.toContain('/opt/openpalm/ui');
+    expect(dockerfile).not.toContain('OP_UI_VERSION');
+    expect(dockerfile).toContain('/opt/openpalm/client');
+  });
+
+  // CHARACTERIZATION (green today): PLATFORM_VERSION is already wired
+  // (build ARG re-exported as ENV) — the entrypoint fallback depends on it.
+  test('PLATFORM_VERSION build arg is re-exported for runtime resolution (characterization)', () => {
+    expect(dockerfile).toContain('ARG PLATFORM_VERSION');
+    expect(dockerfile).toMatch(/PLATFORM_VERSION=\$\{PLATFORM_VERSION\}/);
+  });
+});

From f2106d12523023cc543d716bd7c72a510b40244b Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Mon, 6 Jul 2026 23:17:40 +0000
Subject: [PATCH 39/61] feat(assistant): container serves @openpalm/client on a
 published port (#510)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

P5d (plan §6.9 Slice A, as-landed notes): the assistant container's UI
co-process becomes the static @openpalm/client bundle, published to the
host behind the loopback-default bind policy. Makes all 16 P5d red tests
green (034da91) with the lib suite back at baseline parity.

containers/assistant/entrypoint.sh:
- install_runtime_artifacts pulls @openpalm/client into
  /opt/openpalm/client with the exact-pin chain OP_CLIENT_VERSION ->
  PLATFORM_VERSION -> hard error (§8 rule 1: no latest fallback); the
  landed warn-and-continue on install failure and the skeleton pull are
  unchanged.
- start_client replaces start_ui: writes runtime-config.json beside the
  build FIRST (one locked default connection pointing the BROWSER at the
  host-published OpenCode URL, default
  http://127.0.0.1:${OP_ASSISTANT_PORT:-3800}, full-URL override via
  OP_CLIENT_DEFAULT_ASSISTANT_URL; JSON emitted via node so unusual URLs
  cannot corrupt the file), then serves bin/serve.mjs on
  ${OP_CLIENT_PORT:-3000} bound 0.0.0.0 in-container. The old
  OPENCODE_API_URL export dies with the adapter-node co-process — the
  browser talks to OpenCode directly, which removes the OP_OPENCODE_URL
  wiring bug path entirely.

compose (packages/skeleton/system/stack/core.compose.yml):
- publish the client on
  ${OP_CLIENT_BIND_ADDRESS:-${OP_BIND_ADDRESS:-127.0.0.1}}:${OP_CLIENT_PORT:-3810}:3000
  (nested per-service override form, same C1 pattern as chat/api/voice;
  loopback default).
- pass OP_CLIENT_VERSION, OP_ASSISTANT_PORT, and
  OP_CLIENT_DEFAULT_ASSISTANT_URL through the assistant environment so a
  restart with a new pin picks up the new client and the entrypoint can
  compute the browser-facing URL. OP_CLIENT_PORT is deliberately NOT in
  the container env: it is the host-side mapping var (mirrors
  OP_ASSISTANT_PORT), while the in-container serve port stays 3000.

Dockerfile: seed dir renamed /opt/openpalm/ui -> /opt/openpalm/client;
PLATFORM_VERSION ARG->ENV wiring already present (verified, pinned by
characterization test).

lib: bind-warning PER_SERVICE_BIND_VARS gains OP_CLIENT_BIND_ADDRESS
(list's contract is "mirrors compose files").

Test fix (justified): assistant-rootless.test.ts pinned the literal
'/opt/openpalm/ui' in the Dockerfile chmod line; P5d's ratified red tests
require that path to not exist. The pin's real invariant (scope chmod to
the empty seed dirs, never bare /opt/openpalm) is preserved — only the
artifact dir name advances to /opt/openpalm/client.

scripts/rootless-smoke-fixture.sh: version pins move OP_UI_VERSION ->
OP_CLIENT_VERSION (docker-gated smoke; static verification only in this
environment — no docker daemon, shellcheck unavailable, bash -n clean).
docs/technical/environment-and-mounts.md documents the new vars.

Runtime-verified locally (no docker needed for this slice): sourced
start_client against a staged /opt/openpalm/client copy of the real
build — runtime-config.json written and served with the expected locked
default connection, SPA index 200, OP_CLIENT_DEFAULT_ASSISTANT_URL
override honored.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FetR7BttT1xBrA8fBwhui9
---
 containers/assistant/Dockerfile               | 10 +--
 containers/assistant/entrypoint.sh            | 87 +++++++++++++------
 docs/technical/environment-and-mounts.md      | 21 ++++-
 .../control-plane/assistant-rootless.test.ts  |  9 +-
 .../lib/src/control-plane/bind-warning.ts     |  1 +
 .../skeleton/system/stack/core.compose.yml    | 23 ++++-
 scripts/rootless-smoke-fixture.sh             |  6 +-
 7 files changed, 113 insertions(+), 44 deletions(-)

diff --git a/containers/assistant/Dockerfile b/containers/assistant/Dockerfile
index 06109ce0f..751e33957 100644
--- a/containers/assistant/Dockerfile
+++ b/containers/assistant/Dockerfile
@@ -48,8 +48,8 @@ RUN npm install --omit=dev --no-fund --no-audit \
 FROM node:22-trixie-slim
 
 ARG BUN_VERSION=bun-v1.3.10
-# Platform version — drives OP_UI_VERSION and OP_SKELETON_VERSION defaults in
-# the entrypoint when no per-component env var override is set.
+# Platform version — drives OP_CLIENT_VERSION and OP_SKELETON_VERSION defaults
+# in the entrypoint when no per-component env var override is set.
 ARG PLATFORM_VERSION
 
 # Re-export for runtime introspection.
@@ -170,9 +170,9 @@ RUN set -e; \
 # layer. The tools tree is bind-mounted (host-owned) at runtime, so its baked
 # mode is moot. Secrets (knowledge/secrets, 0600) are a separate bind-mount tree.
 RUN mkdir -p /home/opencode/.cache /home/opencode/.local/bin /work /stash /opt/akm/cache /opt/akm/data /opt/persistent/bin \
-    && mkdir -p /opt/openpalm/ui /opt/openpalm/skeleton /opt/openpalm/tools \
-    && chown -R node:node /home/opencode /work /stash /opt/akm /opt/persistent /opt/openpalm/ui /opt/openpalm/skeleton \
-    && chmod -R a+rwX /home/opencode /work /stash /opt/akm /opt/persistent /opt/openpalm/ui /opt/openpalm/skeleton
+    && mkdir -p /opt/openpalm/client /opt/openpalm/skeleton /opt/openpalm/tools \
+    && chown -R node:node /home/opencode /work /stash /opt/akm /opt/persistent /opt/openpalm/client /opt/openpalm/skeleton \
+    && chmod -R a+rwX /home/opencode /work /stash /opt/akm /opt/persistent /opt/openpalm/client /opt/openpalm/skeleton
 
 COPY containers/assistant/entrypoint.sh /usr/local/bin/opencode-entrypoint.sh
 RUN chmod +x /usr/local/bin/opencode-entrypoint.sh
diff --git a/containers/assistant/entrypoint.sh b/containers/assistant/entrypoint.sh
index 3c65b9a35..ce9ab638c 100644
--- a/containers/assistant/entrypoint.sh
+++ b/containers/assistant/entrypoint.sh
@@ -63,14 +63,14 @@ maybe_source_akm_user_env() {
 
 install_runtime_artifacts() {
   # ── Exact-pinned npm artifacts ──────────────────────────────────────────────
-  # UI and skeleton versions come from OP_*_VERSION env overrides, then fall
-  # back to PLATFORM_VERSION (set at image build time via ARG). Hard error if
-  # neither is set — no 'latest' fallback for exact-pinned components.
-  local ui_version="${OP_UI_VERSION:-${PLATFORM_VERSION:-}}"
+  # Client and skeleton versions come from OP_*_VERSION env overrides, then
+  # fall back to PLATFORM_VERSION (set at image build time via ARG). Hard error
+  # if neither is set — no 'latest' fallback for exact-pinned components.
+  local client_version="${OP_CLIENT_VERSION:-${PLATFORM_VERSION:-}}"
   local skeleton_version="${OP_SKELETON_VERSION:-${PLATFORM_VERSION:-}}"
 
-  if [ -z "$ui_version" ]; then
-    echo "ERROR: set OP_UI_VERSION or PLATFORM_VERSION to install @openpalm/ui" >&2
+  if [ -z "$client_version" ]; then
+    echo "ERROR: set OP_CLIENT_VERSION or PLATFORM_VERSION to install @openpalm/client" >&2
     exit 1
   fi
   if [ -z "$skeleton_version" ]; then
@@ -88,14 +88,14 @@ install_runtime_artifacts() {
   # `grep -v` exits 1 when npm produced only warnings (or nothing), so the
   # pipeline's own exit code can't distinguish "npm failed" from "no output".
   # Capture npm's exit via PIPESTATUS and surface real failures — a silent
-  # EACCES here would leave the stack serving stale ui/skeleton forever.
+  # EACCES here would leave the stack serving stale client/skeleton forever.
   local npm_rc
-  echo "entrypoint: installing @openpalm/ui@${ui_version}..." >&2
+  echo "entrypoint: installing @openpalm/client@${client_version}..." >&2
   npm_rc=0
-  npm_config_cache="$npm_cache_dir" npm install --prefix /opt/openpalm/ui "@openpalm/ui@${ui_version}" \
+  npm_config_cache="$npm_cache_dir" npm install --prefix /opt/openpalm/client "@openpalm/client@${client_version}" \
     --omit=dev --prefer-offline --no-fund --no-audit 2>&1 | grep -v "^npm warn" || npm_rc="${PIPESTATUS[0]}"
   if [ "$npm_rc" != "0" ]; then
-    echo "ERROR: @openpalm/ui@${ui_version} install failed (exit ${npm_rc}); continuing with the existing artifact if present" >&2
+    echo "ERROR: @openpalm/client@${client_version} install failed (exit ${npm_rc}); continuing with the existing artifact if present" >&2
   fi
 
   echo "entrypoint: installing @openpalm/skeleton@${skeleton_version}..." >&2
@@ -125,26 +125,57 @@ install_runtime_artifacts() {
   fi
 }
 
-start_ui() {
-  local ui_build="/opt/openpalm/ui/node_modules/@openpalm/ui/build/index.js"
-  if [ ! -f "$ui_build" ]; then
-    echo "entrypoint: @openpalm/ui build not found — UI co-process skipped" >&2
+start_client() {
+  # Static chat client (@openpalm/client, plan §6.9 Slice A). The co-process
+  # only serves bytes — the BROWSER talks to OpenCode directly at the
+  # host-published assistant URL, so there is no server-side API base URL to
+  # wire into this process (the old adapter-node co-process env plumbing, and
+  # its wiring bug, are gone with it).
+  local client_pkg="/opt/openpalm/client/node_modules/@openpalm/client"
+  local serve_script="${client_pkg}/bin/serve.mjs"
+  local client_build="${client_pkg}/build"
+  if [ ! -f "$serve_script" ] || [ ! -f "${client_build}/index.html" ]; then
+    echo "entrypoint: @openpalm/client build not found — client co-process skipped" >&2
     return 0
   fi
 
-  local ui_port="${OP_UI_PORT:-3000}"
-  echo "entrypoint: starting UI co-process on port ${ui_port}..." >&2
-
-  local ui_cmd=(
-    node "$ui_build"
-  )
-
-  OPENCODE_API_URL="http://127.0.0.1:${PORT}" \
-  PORT="$ui_port" \
-  ORIGIN="${OP_UI_ORIGIN:-http://localhost:${ui_port}}" \
-    "${ui_cmd[@]}" &
-
-  echo "entrypoint: UI co-process PID $! started" >&2
+  # Write runtime-config.json beside the build BEFORE serving (serve.mjs looks
+  # for it next to the build dir). It seeds the browser's connection store with
+  # ONE locked default connection: the assistant's OpenCode as published on the
+  # HOST — compose maps ${OP_ASSISTANT_PORT:-3800} -> in-container 4096, and
+  # the in-container :4096 would be unreachable from a browser. Non-default
+  # topologies override the full URL via OP_CLIENT_DEFAULT_ASSISTANT_URL.
+  # JSON is emitted via node (present in the base image) so an unusual URL
+  # value can never produce a malformed file.
+  local assistant_url="${OP_CLIENT_DEFAULT_ASSISTANT_URL:-http://127.0.0.1:${OP_ASSISTANT_PORT:-3800}}"
+  node -e '
+    const fs = require("fs");
+    const [file, url] = process.argv.slice(1);
+    const config = {
+      connections: [
+        {
+          id: "assistant-container-opencode",
+          label: "This assistant",
+          kind: "local-opencode",
+          url,
+          auth: { mode: "none" },
+          isDefault: true,
+          locked: true,
+        },
+      ],
+    };
+    fs.writeFileSync(file, JSON.stringify(config, null, 2) + "\n");
+  ' "${client_pkg}/runtime-config.json" "$assistant_url" \
+    || echo "warning: could not write runtime-config.json; client starts with no default connection" >&2
+
+  local client_port="${OP_CLIENT_PORT:-3000}"
+  echo "entrypoint: starting client co-process on port ${client_port}..." >&2
+
+  # Bind 0.0.0.0 INSIDE the container only: host exposure is governed by the
+  # compose port mapping, which defaults to loopback (OP_BIND_ADDRESS policy).
+  node "$serve_script" --host 0.0.0.0 --port "$client_port" --dir "$client_build" &
+
+  echo "entrypoint: client co-process PID $! started" >&2
 }
 
 seed_default_agents_md() {
@@ -364,5 +395,5 @@ seed_default_agents_md
 run_akm_schema_migration
 persist_akm_stash_dir_fallback
 start_cron_and_sync_tasks
-start_ui
+start_client
 start_opencode
diff --git a/docs/technical/environment-and-mounts.md b/docs/technical/environment-and-mounts.md
index 7f584660b..8d3056984 100644
--- a/docs/technical/environment-and-mounts.md
+++ b/docs/technical/environment-and-mounts.md
@@ -93,10 +93,21 @@ Ports and networks:
 
 | Item | Value |
 |---|---|
-| Container port | `4096` |
-| Host bind | `${OP_ASSISTANT_BIND_ADDRESS:-127.0.0.1}:${OP_ASSISTANT_PORT:-3800}` |
+| Container port | `4096` (OpenCode), `3000` (chat client co-process) |
+| Host bind | `${OP_ASSISTANT_BIND_ADDRESS:-127.0.0.1}:${OP_ASSISTANT_PORT:-3800}` (OpenCode) |
+| Client host bind | `${OP_CLIENT_BIND_ADDRESS:-${OP_BIND_ADDRESS:-127.0.0.1}}:${OP_CLIENT_PORT:-3810}` (chat client) |
 | Networks | `assistant_net` |
 
+The chat client co-process serves the static `@openpalm/client` build (P5d,
+#510). It binds `0.0.0.0` **inside** the container on port `3000`; host
+exposure is governed solely by the compose mapping above, which defaults to
+loopback and honors the global `OP_BIND_ADDRESS` policy with a per-service
+`OP_CLIENT_BIND_ADDRESS` override. At startup the entrypoint writes a
+`runtime-config.json` beside the build with one locked default connection
+pointing the browser at the host-published OpenCode URL
+(`http://127.0.0.1:${OP_ASSISTANT_PORT:-3800}`, full-URL override via
+`OP_CLIENT_DEFAULT_ASSISTANT_URL`).
+
 Key env:
 
 | Variable | Value / source | Purpose |
@@ -110,6 +121,9 @@ Key env:
 | `AKM_CACHE_DIR` | `/opt/akm/cache` | AKM cache directory |
 | `AKM_DATA_DIR` | `/opt/akm/data` | AKM durable data directory |
 | `OP_UID` / `OP_GID` | `stack.env` | Direct runtime uid/gid mapping |
+| `OP_CLIENT_VERSION` | `stack.env` (empty = image `PLATFORM_VERSION`) | Exact-pin override for the `@openpalm/client` artifact the entrypoint installs |
+| `OP_ASSISTANT_PORT` | `stack.env` (default `3800`) | Host-published OpenCode port; used to build the client's default connection URL |
+| `OP_CLIENT_DEFAULT_ASSISTANT_URL` | `stack.env` (optional) | Full-URL override for the client's locked default connection |
 
 Notes:
 
@@ -237,6 +251,9 @@ These variables are consumed by Compose and service env blocks.
 | `OP_IMAGE_NAMESPACE`, `OP_IMAGE_TAG` | Image selection |
 | `OP_HOST_UI_PORT` | Admin UI host port (default `3880`); the admin UI runs as a host process, not a container |
 | `OP_ASSISTANT_BIND_ADDRESS`, `OP_ASSISTANT_PORT` | Assistant host bind |
+| `OP_CLIENT_BIND_ADDRESS`, `OP_CLIENT_PORT` | Assistant chat-client co-process host bind (default `127.0.0.1:3810`) |
+| `OP_CLIENT_VERSION` | Exact-pin override for the `@openpalm/client` artifact installed in the assistant container |
+| `OP_CLIENT_DEFAULT_ASSISTANT_URL` | Full-URL override for the chat client's locked default connection |
 | `OP_CHAT_BIND_ADDRESS`, `OP_CHAT_PORT` | Chat addon host bind |
 | `OP_API_BIND_ADDRESS`, `OP_API_PORT` | API addon host bind |
 | `OP_VOICE_BIND_ADDRESS`, `OP_VOICE_PORT` | Voice addon host bind |
diff --git a/packages/lib/src/control-plane/assistant-rootless.test.ts b/packages/lib/src/control-plane/assistant-rootless.test.ts
index 6524c84ab..091db98da 100644
--- a/packages/lib/src/control-plane/assistant-rootless.test.ts
+++ b/packages/lib/src/control-plane/assistant-rootless.test.ts
@@ -38,12 +38,15 @@ describe('assistant rootless conversion', () => {
 
   test('assistant image does not recursively chmod the baked tools tree (no duplicate giant layer)', () => {
     // /opt/openpalm/tools holds the multi-hundred-MB node_modules + model cache
-    // split across COPY layers; the seed-dir chmod must target the empty ui/skeleton
-    // dirs, never bare /opt/openpalm (which would re-materialize the whole tree).
+    // split across COPY layers; the seed-dir chmod must target the empty
+    // client/skeleton dirs, never bare /opt/openpalm (which would re-materialize
+    // the whole tree). (P5d, #510: the co-process artifact dir renamed from
+    // /opt/openpalm/ui to /opt/openpalm/client when @openpalm/client replaced
+    // @openpalm/ui in the assistant image — same seed-dir invariant.)
     const chmodLine = assistantDockerfile.split('\n').find((l) => l.includes('chmod -R a+rwX'));
     expect(chmodLine).toBeDefined();
     expect(chmodLine).not.toMatch(/\/opt\/openpalm(\s|$)/);
-    expect(chmodLine).toContain('/opt/openpalm/ui');
+    expect(chmodLine).toContain('/opt/openpalm/client');
     expect(chmodLine).toContain('/opt/openpalm/skeleton');
   });
 });
diff --git a/packages/lib/src/control-plane/bind-warning.ts b/packages/lib/src/control-plane/bind-warning.ts
index b02b72625..73ac6fb0b 100644
--- a/packages/lib/src/control-plane/bind-warning.ts
+++ b/packages/lib/src/control-plane/bind-warning.ts
@@ -13,6 +13,7 @@
 /** Known per-service bind address env var names (mirrors compose files). */
 const PER_SERVICE_BIND_VARS: readonly string[] = [
   "OP_ASSISTANT_BIND_ADDRESS",
+  "OP_CLIENT_BIND_ADDRESS",
   "OP_CHAT_BIND_ADDRESS",
   "OP_API_BIND_ADDRESS",
   "OP_VOICE_BIND_ADDRESS",
diff --git a/packages/skeleton/system/stack/core.compose.yml b/packages/skeleton/system/stack/core.compose.yml
index 89dee9c24..b1a047caa 100644
--- a/packages/skeleton/system/stack/core.compose.yml
+++ b/packages/skeleton/system/stack/core.compose.yml
@@ -63,12 +63,29 @@ services:
       OP_UID: ${OP_UID:-1000}
       OP_GID: ${OP_GID:-1000}
       OPENCODE_API_URL: http://localhost:4096
+      # @openpalm/client co-process (P5d, #510). OP_CLIENT_VERSION is the
+      # exact-pin override for the client artifact the entrypoint installs;
+      # empty falls back to the image's baked PLATFORM_VERSION. It must reach
+      # the container ENVIRONMENT (not just compose interpolation) so a
+      # restart with a new pin picks up the new client.
+      OP_CLIENT_VERSION: ${OP_CLIENT_VERSION:-}
+      # The entrypoint writes the client's runtime-config.json pointing the
+      # BROWSER at the host-published OpenCode URL — that is the assistant
+      # port mapping below, NOT the in-container :4096 (unreachable from a
+      # browser). OP_CLIENT_DEFAULT_ASSISTANT_URL overrides the full URL for
+      # non-default topologies (e.g. a reverse proxy in front of the stack).
+      OP_ASSISTANT_PORT: ${OP_ASSISTANT_PORT:-3800}
+      OP_CLIENT_DEFAULT_ASSISTANT_URL: ${OP_CLIENT_DEFAULT_ASSISTANT_URL:-}
       # Provider credentials live in OpenCode's auth.json (bind-mounted
       # below) — NOT in this env block. The Connections tab and the setup
       # wizard both call OpenCode's PUT /auth/{providerID}; ai-sdk picks
       # the key up via OpenCode at call time.
     ports:
       - "${OP_ASSISTANT_BIND_ADDRESS:-127.0.0.1}:${OP_ASSISTANT_PORT:-3800}:4096"
+      # Chat client (@openpalm/client static co-process, in-container port
+      # 3000). Loopback by default; honors the global OP_BIND_ADDRESS policy
+      # with a per-service override, same as the addon listeners.
+      - "${OP_CLIENT_BIND_ADDRESS:-${OP_BIND_ADDRESS:-127.0.0.1}}:${OP_CLIENT_PORT:-3810}:3000"
     volumes:
       # data/assistant is HOME (runtime). config/assistant is the power-user's
       # OpenCode GLOBAL config, mounted at ~/.config/opencode (nested over HOME).
@@ -96,8 +113,8 @@ services:
       # under $HOME. Prefer $HOME/.local when possible; use /opt/persistent for
       # tools that require an explicit non-home prefix.
       - assistant-persistent:/opt/persistent
-      # Platform artifact cache — persists @openpalm/ui and @openpalm/skeleton
-      # across restarts so warm starts don't re-download.
+      # Platform artifact cache — persists @openpalm/client and
+      # @openpalm/skeleton across restarts so warm starts don't re-download.
       - assistant-artifacts:/opt/openpalm
       # Tool packages managed via package.json. Edit OP_HOME/data/assistant/tools/package.json
       # to pin or update individual tool versions; bun update applies changes on next start.
@@ -138,6 +155,6 @@ networks:
 
 volumes:
   assistant-persistent:
-  # Named volume for @openpalm/ui and @openpalm/skeleton artifacts.
+  # Named volume for @openpalm/client and @openpalm/skeleton artifacts.
   # The tools subpath (/opt/openpalm/tools) is overlaid by the bind-mount above.
   assistant-artifacts:
diff --git a/scripts/rootless-smoke-fixture.sh b/scripts/rootless-smoke-fixture.sh
index e2a7214fd..491582303 100644
--- a/scripts/rootless-smoke-fixture.sh
+++ b/scripts/rootless-smoke-fixture.sh
@@ -77,7 +77,7 @@ OP_ASSISTANT_VERSION=dev
 OP_GUARDIAN_VERSION=dev
 OP_PORTAL_VERSION=dev
 OP_GUARDIAN_NPM_VERSION=${platform_version}
-OP_UI_VERSION=${platform_version}
+OP_CLIENT_VERSION=${platform_version}
 OP_SKELETON_VERSION=${platform_version}
 OP_ASSISTANT_PORT=${assistant_port}
 OP_GUARDIAN_PORT=${guardian_port}
@@ -97,7 +97,7 @@ smoke_ensure_home_dirs() {
 }
 
 # Write the version-pinning compose override both stacks use to force the
-# dev-built UI/skeleton/guardian versions. The caller chooses the file path
+# dev-built client/skeleton/guardian versions. The caller chooses the file path
 # (the two scripts intentionally place it differently), so this single-sources
 # only the content. Usage: smoke_write_version_override <file> <platform_version>
 smoke_write_version_override() {
@@ -107,7 +107,7 @@ smoke_write_version_override() {
 services:
   assistant:
     environment:
-      OP_UI_VERSION: "${platform_version}"
+      OP_CLIENT_VERSION: "${platform_version}"
       OP_SKELETON_VERSION: "${platform_version}"
   guardian:
     environment:

From d33f650148b51738b32c5946488456fa0c60bfa5 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Mon, 6 Jul 2026 23:39:40 +0000
Subject: [PATCH 40/61] test(p5e): red tests for #555
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Static/config tests for P5e (release integration + purity gates), written
test-first ahead of the implementation:

- scripts/release-publish-dag.test.ts — parses .github/workflows/*.yml
  (Bun.YAML). RED: @openpalm/client publish job in release.yml mirroring
  @openpalm/ui (package-dir/exact-version/needs-build/computed version,
  platform|all gating, needs compute-version+bump, tag-release TAG-LAST
  dependency), regression-guard + VERSION_OVERRIDE stamp coverage, and the
  client-bundle purity gate wired into ci.yml (build client, then run its
  tests). GREEN (characterization, must stay): all workflow YAML parses,
  @openpalm/ui publish job exists, no workflow publishes @openpalm/ui-kit,
  packages/client/tests/purity.test.ts exists.

- scripts/release-aggregates-hygiene.test.ts — root package.json + manifest
  hygiene. RED: root test aggregate runs packages/client; packages/client
  publishable like @openpalm/ui (not private, publishConfig.access public);
  platform stamp/version-sync membership (.github/release-package-groups.json
  + scripts/bump-unit.mjs). GREEN (characterization, must stay): check
  aggregate includes ui:check/ui-kit:check/client:check, client workspace
  scripts wired, test aggregate runs packages/ui-kit, client files:['build']
  + version lockstep with root, packages/ui-kit stays private with no
  publishConfig.

Both files run via the root test aggregate's scripts/ entry. 12 pass /
13 fail (all red-for-the-right-reason: missing P5e wiring). No production
code changed.

Refs #555

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FetR7BttT1xBrA8fBwhui9
---
 scripts/release-aggregates-hygiene.test.ts | 118 +++++++++++++
 scripts/release-publish-dag.test.ts        | 186 +++++++++++++++++++++
 2 files changed, 304 insertions(+)
 create mode 100644 scripts/release-aggregates-hygiene.test.ts
 create mode 100644 scripts/release-publish-dag.test.ts

diff --git a/scripts/release-aggregates-hygiene.test.ts b/scripts/release-aggregates-hygiene.test.ts
new file mode 100644
index 000000000..eaae0e354
--- /dev/null
+++ b/scripts/release-aggregates-hygiene.test.ts
@@ -0,0 +1,118 @@
+// P5e (#555) — STATIC/CONFIG repo-hygiene tests for release integration
+// (ui-runtime-modes-plan.md Phase 5 items 5-6, §8 invariants).
+//
+// Asserts the ROOT package.json check/test aggregates reference the two new
+// UI packages (packages/client, packages/ui-kit), that packages/client is
+// npm-publishable the same way @openpalm/ui is (exact-pin delivered), that
+// packages/ui-kit stays a private raw-source package, and that the client
+// manifest is a member of the platform stamp/version-sync sets.
+//
+// Red/green map (test-first):
+//   - check aggregate + client workspace scripts        -> GREEN (characterization — wired in P5b)
+//   - test aggregate runs packages/ui-kit               -> GREEN (characterization)
+//   - test aggregate runs packages/client               -> RED until P5e item 2
+//   - client manifest publishable like @openpalm/ui     -> RED until P5e item 1
+//   - ui-kit manifest stays private                     -> GREEN (characterization — must stay)
+//   - platform stamp/version-sync membership            -> RED until P5e item 1
+import { describe, expect, test } from "bun:test";
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+
+const ROOT = join(import.meta.dir, "..");
+
+type Manifest = {
+	name?: string;
+	version?: string;
+	private?: boolean;
+	publishConfig?: { access?: string };
+	files?: string[];
+	scripts?: Record<string, string>;
+};
+
+function readJson(relPath: string): Manifest {
+	return JSON.parse(readFileSync(join(ROOT, relPath), "utf-8")) as Manifest;
+}
+
+const rootPkg = readJson("package.json");
+const rootScripts = rootPkg.scripts ?? {};
+
+describe("P5e — root check aggregate covers the new packages (characterization — green)", () => {
+	test("`bun run check` includes ui:check + ui-kit:check + client:check", () => {
+		const check = rootScripts.check ?? "";
+		expect(check).toContain("ui:check");
+		expect(check).toContain("ui-kit:check");
+		expect(check).toContain("client:check");
+	});
+
+	test("client workspace scripts exist at the root and point at packages/client", () => {
+		expect(rootScripts["client:check"] ?? "").toContain("packages/client");
+		expect(rootScripts["client:build"] ?? "").toContain("packages/client");
+		expect(rootScripts["client:test"] ?? "").toContain("packages/client");
+	});
+});
+
+describe("P5e — root test aggregate runs the new packages' test dirs", () => {
+	test("`bun run test` runs packages/ui-kit (characterization — green)", () => {
+		expect(rootScripts.test ?? "").toContain("packages/ui-kit");
+	});
+
+	test("`bun run test` runs packages/client (RED until P5e item 2)", () => {
+		// Either the dir joins the `bun test` path list directly, or the aggregate
+		// chains the client:test workspace script — both satisfy the gate.
+		expect(rootScripts.test ?? "").toMatch(/packages\/client\b|client:test/);
+	});
+});
+
+describe("P5e — packages/client manifest is publishable like @openpalm/ui (RED until P5e item 1)", () => {
+	const client = readJson("packages/client/package.json");
+
+	test("named @openpalm/client and NOT private (npm refuses to publish private packages)", () => {
+		expect(client.name).toBe("@openpalm/client");
+		expect(client.private).not.toBe(true);
+	});
+
+	test("scoped package declares publishConfig.access public (mirrors @openpalm/ui)", () => {
+		expect(client.publishConfig?.access).toBe("public");
+	});
+
+	test("ships the built bundle via files: ['build', ...]", () => {
+		expect(client.files ?? []).toContain("build");
+	});
+
+	test("version stays in lockstep with the root platform version (exact-pin table)", () => {
+		// The assistant container installs @openpalm/client@$OP_CLIENT_VERSION
+		// with PLATFORM_VERSION as the fallback (P5d) — the client MUST be
+		// stamped at the platform version, exactly like @openpalm/ui.
+		expect(client.version).toBe(rootPkg.version);
+	});
+});
+
+describe("P5e — packages/ui-kit stays a private raw-source package (characterization — green, must stay)", () => {
+	const uiKit = readJson("packages/ui-kit/package.json");
+
+	test("private: true (never published — plan simplicity guardrails)", () => {
+		expect(uiKit.private).toBe(true);
+	});
+
+	test("declares no publishConfig", () => {
+		expect(uiKit.publishConfig).toBeUndefined();
+	});
+});
+
+describe("P5e — platform stamp/version-sync membership for packages/client (RED until P5e item 1)", () => {
+	test(".github/release-package-groups.json platform unit lists packages/client/package.json", () => {
+		// CI's "Validate per-unit version sync" step reads this file; membership
+		// is what enforces client == root version on every PR.
+		const groups = JSON.parse(
+			readFileSync(join(ROOT, ".github/release-package-groups.json"), "utf-8"),
+		) as { units: Record<string, string[]> };
+		expect(groups.units.platform).toContain("packages/client/package.json");
+	});
+
+	test("scripts/bump-unit.mjs stamps packages/client/package.json with the platform unit", () => {
+		// Mirrors packages/ui/package.json in the platform stamp list so a normal
+		// (non-override) release bumps the client with the rest of the unit.
+		const bumpUnit = readFileSync(join(ROOT, "scripts/bump-unit.mjs"), "utf-8");
+		expect(bumpUnit).toContain("packages/client/package.json");
+	});
+});
diff --git a/scripts/release-publish-dag.test.ts b/scripts/release-publish-dag.test.ts
new file mode 100644
index 000000000..e12cf54a6
--- /dev/null
+++ b/scripts/release-publish-dag.test.ts
@@ -0,0 +1,186 @@
+// P5e (#555) — STATIC/CONFIG tests for the release publish DAG
+// (ui-runtime-modes-plan.md Phase 5 item 5: "@openpalm/client joins the
+// publish DAG and the exact-pin table"; §8.10 / simplicity guardrails:
+// @openpalm/ui-kit is a raw-source workspace package and is NEVER published).
+//
+// The publish DAG lives in .github/workflows/release.yml (the plan's
+// "platform-release.yml" — there is no separate file; unit=platform/all of
+// release.yml is the platform release). These tests parse the workflow YAML
+// (Bun.YAML) and assert structure, not runtime behavior.
+//
+// Red/green map (test-first):
+//   - "release workflow YAML is well-formed"            -> GREEN (characterization)
+//   - "@openpalm/client joins the publish DAG"          -> RED until P5e item 1 lands
+//   - "@openpalm/ui-kit stays unpublished"              -> GREEN (characterization — must stay)
+//   - "client purity gate wired into CI"                -> RED until P5e item 3 lands
+import { describe, expect, test } from "bun:test";
+import { existsSync, readFileSync, readdirSync } from "node:fs";
+import { join } from "node:path";
+
+const ROOT = join(import.meta.dir, "..");
+const WORKFLOWS_DIR = join(ROOT, ".github", "workflows");
+const RELEASE_WORKFLOW = join(WORKFLOWS_DIR, "release.yml");
+const CI_WORKFLOW = join(WORKFLOWS_DIR, "ci.yml");
+const PUBLISH_REUSABLE = "publish-npm-package.yml";
+
+type Step = { name?: string; run?: string };
+type Job = {
+	uses?: string;
+	needs?: string | string[];
+	if?: string;
+	with?: Record<string, unknown>;
+	steps?: Step[];
+};
+
+function parseWorkflow(path: string): Record<string, unknown> {
+	return Bun.YAML.parse(readFileSync(path, "utf-8")) as Record<string, unknown>;
+}
+
+function jobsOf(workflow: Record<string, unknown>): Record<string, Job> {
+	return (workflow.jobs ?? {}) as Record<string, Job>;
+}
+
+function needsList(job: Job): string[] {
+	if (Array.isArray(job.needs)) return job.needs;
+	return job.needs ? [job.needs] : [];
+}
+
+/** All jobs (across one workflow) that call the reusable npm publish workflow. */
+function publishJobs(workflow: Record<string, unknown>): Array<[string, Job]> {
+	return Object.entries(jobsOf(workflow)).filter(
+		([, job]) => typeof job.uses === "string" && job.uses.includes(PUBLISH_REUSABLE),
+	);
+}
+
+const workflowFiles = readdirSync(WORKFLOWS_DIR).filter(
+	(f) => f.endsWith(".yml") || f.endsWith(".yaml"),
+);
+
+describe("P5e — release workflow YAML is well-formed (characterization — green)", () => {
+	test("every workflow under .github/workflows parses as YAML", () => {
+		for (const file of workflowFiles) {
+			expect(() => parseWorkflow(join(WORKFLOWS_DIR, file))).not.toThrow();
+		}
+	});
+
+	test("release.yml is the publish DAG and publishes @openpalm/ui (the artifact client mirrors)", () => {
+		const release = parseWorkflow(RELEASE_WORKFLOW);
+		const names = publishJobs(release).map(([, job]) => job.with?.["package-name"]);
+		expect(names).toContain("@openpalm/ui");
+	});
+});
+
+describe("P5e — @openpalm/client joins the publish DAG (RED until P5e item 1)", () => {
+	const release = parseWorkflow(RELEASE_WORKFLOW);
+	const jobs = jobsOf(release);
+	const clientEntry = publishJobs(release).find(
+		([, job]) => job.with?.["package-name"] === "@openpalm/client",
+	);
+
+	test("a job publishes @openpalm/client via the reusable publish-npm-package.yml", () => {
+		expect(clientEntry).toBeDefined();
+	});
+
+	test("client publish mirrors @openpalm/ui: package-dir, exact-version pin, needs-build, computed version", () => {
+		const w = clientEntry?.[1].with ?? {};
+		expect(w["package-dir"]).toBe("packages/client");
+		// Exact-pin delivery (plan §6.9/§6.11): the assistant container installs
+		// @openpalm/client@<platform version>, so the publish must be exact-version.
+		expect(w["exact-version"]).toBe(true);
+		// The client is a built static bundle (adapter-static), like @openpalm/ui.
+		expect(w["needs-build"]).toBe(true);
+		expect(String(w.version ?? "")).toContain("compute-version.outputs.new_version");
+	});
+
+	test("client publish is gated on the same units as @openpalm/ui (platform | all)", () => {
+		const cond = String(clientEntry?.[1].if ?? "");
+		expect(cond).toContain("inputs.unit == 'platform'");
+		expect(cond).toContain("inputs.unit == 'all'");
+	});
+
+	test("client publish depends on compute-version + bump (publishes the stamped ref)", () => {
+		const needs = needsList(clientEntry?.[1] ?? {});
+		expect(needs).toContain("compute-version");
+		expect(needs).toContain("bump");
+	});
+
+	test("tag-release (TAG-LAST invariant) waits on the client publish job", () => {
+		// "tag exists = fully published" — a failed client publish must block the tag.
+		const clientJobId = clientEntry?.[0] ?? "<missing @openpalm/client publish job>";
+		expect(needsList(jobs["tag-release"] ?? {})).toContain(clientJobId);
+	});
+
+	test("the npm regression guard covers @openpalm/client for platform + all units", () => {
+		const guard = (jobs["compute-version"]?.steps ?? []).find((s) =>
+			s.run?.includes("npmPackages"),
+		);
+		expect(guard).toBeDefined();
+		expect(guard?.run ?? "").toContain("'@openpalm/client'");
+	});
+
+	test("the explicit-version stamp path stamps packages/client/package.json", () => {
+		// Mirrors packages/ui/package.json in the bump job's VERSION_OVERRIDE case
+		// list — otherwise an override release ships a client whose version does
+		// not match the platform pin the assistant container installs.
+		const stamp = (jobs.bump?.steps ?? []).find((s) => s.run?.includes("set-version.mjs"));
+		expect(stamp).toBeDefined();
+		expect(stamp?.run ?? "").toContain("packages/client/package.json");
+	});
+});
+
+describe("P5e — @openpalm/ui-kit stays unpublished (characterization — green, must stay)", () => {
+	test("no workflow passes @openpalm/ui-kit (or packages/ui-kit) to publish-npm-package.yml", () => {
+		for (const file of workflowFiles) {
+			const workflow = parseWorkflow(join(WORKFLOWS_DIR, file));
+			for (const [id, job] of publishJobs(workflow)) {
+				expect(`${file}:${id}:${String(job.with?.["package-name"])}`).not.toContain(
+					"@openpalm/ui-kit",
+				);
+				expect(`${file}:${id}:${String(job.with?.["package-dir"])}`).not.toContain(
+					"packages/ui-kit",
+				);
+			}
+		}
+	});
+
+	test("publish-npm-package.yml's own input defaults do not point at ui-kit", () => {
+		const raw = readFileSync(join(WORKFLOWS_DIR, PUBLISH_REUSABLE), "utf-8");
+		expect(raw).not.toContain("@openpalm/ui-kit");
+		expect(raw).not.toContain("packages/ui-kit");
+	});
+});
+
+describe("P5e — client-bundle purity gate wired into CI (RED until P5e item 3)", () => {
+	test("the purity test itself exists (P5b — characterization)", () => {
+		expect(existsSync(join(ROOT, "packages/client/tests/purity.test.ts"))).toBe(true);
+	});
+
+	test("ci.yml has a job that builds the client and then runs the client tests (purity gate)", () => {
+		// The P5b purity test greps the BUILT bundle under packages/client/build/
+		// and deliberately FAILS when the build dir is absent — so CI must build
+		// the client before any invocation that runs packages/client tests.
+		const rootPkg = JSON.parse(readFileSync(join(ROOT, "package.json"), "utf-8")) as {
+			scripts?: Record<string, string>;
+		};
+		const rootTestRunsClient = /packages\/client\b/.test(rootPkg.scripts?.test ?? "");
+
+		const buildsClient = (run: string) =>
+			/client:build|--cwd packages\/client[^\n]*\bbuild\b|cd packages\/client[^\n]*\bbuild\b/.test(
+				run,
+			);
+		const runsClientTests = (run: string) =>
+			/client:test|bun test[^\n]*packages\/client|--cwd packages\/client[^\n]*\btest\b/.test(
+				run,
+			) ||
+			(rootTestRunsClient && /\bbun run test\b/.test(run));
+
+		const ci = parseWorkflow(CI_WORKFLOW);
+		const gated = Object.values(jobsOf(ci)).some((job) => {
+			const runs = (job.steps ?? []).map((s) => s.run ?? "");
+			const buildIdx = runs.findIndex(buildsClient);
+			if (buildIdx < 0) return false;
+			return runs.slice(buildIdx + 1).some(runsClientTests);
+		});
+		expect(gated).toBe(true);
+	});
+});

From 5f4c53215e5827b37f850a8c7192910d8304f6a5 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Tue, 7 Jul 2026 00:02:32 +0000
Subject: [PATCH 41/61] feat(release): @openpalm/client joins the publish DAG +
 platform stamp sets (#555)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Phase 5 item 5 (P5e) of ui-runtime-modes-plan.md — the client app is released
exactly like @openpalm/ui (exact-pin table §1):

- release.yml: new npm-client job via the reusable publish-npm-package.yml
  (package-dir packages/client, needs-build, exact-version, computed platform
  version, platform|all gating, needs compute-version+bump). Deliberately no
  npm-lib ordering dependency — the client never bundles @openpalm/lib (§8.10)
  and @openpalm/ui-kit is inlined from the workspace at build time (never
  published). tag-release (TAG-LAST) now waits on npm-client so a failed client
  publish blocks the tag.
- compute-version regression guard covers @openpalm/client (platform + all).
- bump job VERSION_OVERRIDE stamp cases (platform, all) stamp
  packages/client/package.json; bump-unit.mjs platform stamp list +
  PLATFORM_NPM_PACKAGES anchor include the client.
- .github/release-package-groups.json: client joins the platform unit so CI's
  per-unit version-sync check enforces client == root version.
- packages/client/package.json: drop private:true, add publishConfig.access
  public (mirrors @openpalm/ui; npm refuses to publish private packages).
- release.yml preflight (platform/all) builds the client before bun run test
  (the purity gate greps the BUILT bundle) and runs client:check.

@openpalm/ui-kit stays unpublished — no workflow references it as a publish
target (guarded by scripts/release-publish-dag.test.ts).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FetR7BttT1xBrA8fBwhui9
---
 .github/release-package-groups.json |  1 +
 .github/workflows/release.yml       | 45 ++++++++++++++++++++++++-----
 packages/client/package.json        |  4 ++-
 scripts/bump-unit.mjs               |  3 +-
 4 files changed, 43 insertions(+), 10 deletions(-)

diff --git a/.github/release-package-groups.json b/.github/release-package-groups.json
index 4bab01c6a..314c97810 100644
--- a/.github/release-package-groups.json
+++ b/.github/release-package-groups.json
@@ -6,6 +6,7 @@
       "packages/lib/package.json",
       "packages/cli/package.json",
       "packages/ui/package.json",
+      "packages/client/package.json",
       "packages/electron/package.json",
       "packages/electron/admin-tools/package.json"
     ],
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 2b5baca4e..c0ffd341b 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -6,8 +6,8 @@ name: Release
 # its own slice. A partial unit will silently leave the other units behind (e.g.
 # `platform` does NOT touch the portal image or the discord/slack npm adapters).
 # For a complete, coordinated release of the whole platform, use `all`.
-#   platform  — @openpalm/lib + openpalm (CLI) + @openpalm/ui (npm) + admin-tools +
-#               CLI native binaries + optional Electron + git tag + GitHub release
+#   platform  — @openpalm/lib + openpalm (CLI) + @openpalm/ui + @openpalm/client (npm) +
+#               admin-tools + CLI native binaries + optional Electron + git tag + GitHub release
 #               (add include_images=true to also rebuild guardian + assistant images).
 #               PARTIAL: no portal image, no portal npm, no voice.
 #   portals   — @openpalm/discord-portal + @openpalm/slack-portal npm packages
@@ -26,7 +26,7 @@ name: Release
 #               Always pass version explicitly (the version the existing npm packages are at). PARTIAL.
 #   all       — COMPLETE coordinated release. Publishes EVERY unit at one version,
 #               flag-free (no include_images / include_electron needed):
-#                 npm: @openpalm/{lib,ui,guardian,skeleton} + openpalm (CLI)
+#                 npm: @openpalm/{lib,ui,client,guardian,skeleton} + openpalm (CLI)
 #                      + @openpalm/{discord,slack}-portal
 #                 images: openpalm/{assistant,guardian,portal}  (+ :latest when stable)
 #                 electron installers (mac/linux/win) + CLI native binaries
@@ -172,8 +172,8 @@ jobs:
             // platform release can never compute a next version at or below an
             // already-published skeleton/guardian, which npm rejects.
             const npmPackages = {
-              platform: ['@openpalm/lib', 'openpalm', '@openpalm/ui', '@openpalm/skeleton', '@openpalm/guardian'],
-              all: ['@openpalm/lib', 'openpalm', '@openpalm/ui', '@openpalm/skeleton', '@openpalm/guardian'],
+              platform: ['@openpalm/lib', 'openpalm', '@openpalm/ui', '@openpalm/client', '@openpalm/skeleton', '@openpalm/guardian'],
+              all: ['@openpalm/lib', 'openpalm', '@openpalm/ui', '@openpalm/client', '@openpalm/skeleton', '@openpalm/guardian'],
               guardian: ['@openpalm/guardian', '@openpalm/skeleton'],
             };
             const packages = npmPackages[unit] || [];
@@ -253,9 +253,13 @@ jobs:
         if: inputs.unit == 'platform' || inputs.unit == 'all'
         run: |
           bun install --frozen-lockfile
+          # The client purity gate greps the BUILT bundle (packages/client/tests/
+          # purity.test.ts fails when build/ is absent), so build before bun run test.
+          bun run client:build
           bun run test
           bun run ui:check
           bun run ui-kit:check
+          bun run client:check
           bun run --cwd packages/ui test:browsers
           bun run ui:test:unit
           bun run electron:test
@@ -305,7 +309,8 @@ jobs:
               platform)
                 for f in package.json packages/lib/package.json packages/skeleton/package.json \
                           packages/guardian/package.json packages/cli/package.json \
-                          packages/ui/package.json packages/electron/package.json \
+                          packages/ui/package.json packages/client/package.json \
+                          packages/electron/package.json \
                           packages/electron/admin-tools/package.json; do
                   node scripts/set-version.mjs "$f" "$V"
                 done
@@ -315,7 +320,8 @@ jobs:
               all)
                 for f in package.json packages/lib/package.json packages/skeleton/package.json \
                           packages/guardian/package.json packages/cli/package.json \
-                          packages/ui/package.json packages/electron/package.json \
+                          packages/ui/package.json packages/client/package.json \
+                          packages/electron/package.json \
                           packages/electron/admin-tools/package.json; do
                   node scripts/set-version.mjs "$f" "$V"
                 done
@@ -383,7 +389,7 @@ jobs:
   # ── npm layer ─────────────────────────────────────────────────────────────────
   # skeleton + guardian: published for unit=guardian (thin-host needs both at runtime)
   #                      and unit=platform + unit=all (full coordinated release)
-  # lib + cli + ui:      platform + all only (guardian npm pkg has no lib dep)
+  # lib + cli + ui + client: platform + all only (guardian npm pkg has no lib dep)
   # NOTE: guardian and skeleton are published independently of lib to avoid
   # blocking the platform regression guard. lib is platform-managed.
   npm-skeleton:
@@ -464,6 +470,28 @@ jobs:
       exact-version: true
       dry-run: ${{ inputs.dry_run }}
 
+  # Client app (@openpalm/client): exact-pin delivered like @openpalm/ui — the
+  # assistant container installs @openpalm/client@<platform version> at startup
+  # (ui-runtime-modes-plan.md §1 exact-pin table, Phase 5 item 5). needs-build
+  # compiles the adapter-static bundle; @openpalm/ui-kit is inlined from the
+  # workspace at build time (raw-source, NEVER published). Unlike npm-ui there
+  # is no npm-lib ordering dependency: the client never bundles @openpalm/lib
+  # (§8.10 purity rule, enforced by packages/client/tests/purity.test.ts in CI).
+  npm-client:
+    name: npm @openpalm/client
+    needs: [compute-version, bump]
+    if: always() && needs.bump.result == 'success' && (inputs.unit == 'platform' || inputs.unit == 'all')
+    uses: ./.github/workflows/publish-npm-package.yml
+    secrets: inherit
+    with:
+      package-dir: packages/client
+      package-name: '@openpalm/client'
+      needs-build: true
+      version: ${{ needs.compute-version.outputs.new_version }}
+      ref: ${{ github.ref_name }}
+      exact-version: true
+      dry-run: ${{ inputs.dry_run }}
+
   # Portal adapters: the portal image bun-installs these from npm at runtime
   # (data/portal/tools/package.json + bun update), so a published patch reaches
   # running portals without an image rebuild. Published as `src` only (no build).
@@ -782,6 +810,7 @@ jobs:
       - npm-guardian
       - npm-cli
       - npm-ui
+      - npm-client
       - npm-discord-portal
       - npm-slack-portal
       - docker-portal
diff --git a/packages/client/package.json b/packages/client/package.json
index 8902730c8..8af50277c 100644
--- a/packages/client/package.json
+++ b/packages/client/package.json
@@ -2,7 +2,6 @@
   "name": "@openpalm/client",
   "version": "0.12.52",
   "description": "OpenPalm client app — the unprivileged chat/connections static SPA (plan ui-runtime-modes-plan.md §6.11). Talks directly to per-connection OpenCode/guardian base URLs; connections persist in IndexedDB. §8.10 rule: this package NEVER depends on @openpalm/lib and never holds host credentials; runtime dependencies stay empty (the adapter-static build is fully self-contained, and bin/serve.mjs is zero-dependency) — document any exception here.",
-  "private": true,
   "license": "MPL-2.0",
   "type": "module",
   "repository": {
@@ -10,6 +9,9 @@
     "url": "https://github.com/itlackey/openpalm.git",
     "directory": "packages/client"
   },
+  "publishConfig": {
+    "access": "public"
+  },
   "files": [
     "build",
     "bin"
diff --git a/scripts/bump-unit.mjs b/scripts/bump-unit.mjs
index 8c2dbfb8d..441bd4801 100644
--- a/scripts/bump-unit.mjs
+++ b/scripts/bump-unit.mjs
@@ -69,7 +69,7 @@ function maxPublished(name) {
 // root package.json on disk. Anchoring on the max prevents the platform release
 // from computing a next version that collides with an already-published
 // skeleton/guardian (the "cannot publish over previously published" failure).
-const PLATFORM_NPM_PACKAGES = ['@openpalm/lib', 'openpalm', '@openpalm/ui', '@openpalm/skeleton', '@openpalm/guardian'];
+const PLATFORM_NPM_PACKAGES = ['@openpalm/lib', 'openpalm', '@openpalm/ui', '@openpalm/client', '@openpalm/skeleton', '@openpalm/guardian'];
 
 // Bump a disk-version anchor up to the highest version published across the
 // given npm package names. npm failures return null and are ignored, so this
@@ -167,6 +167,7 @@ const UNITS = {
         'packages/guardian/package.json',
         'packages/cli/package.json',
         'packages/ui/package.json',
+        'packages/client/package.json',
         'packages/electron/package.json',
         'packages/electron/admin-tools/package.json',
       ], version);

From 90a14945b4ea08eead19c1091e76c1f48b878ba9 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Tue, 7 Jul 2026 00:02:43 +0000
Subject: [PATCH 42/61] ci(test): run the client suite + bundle purity gate in
 CI and the root aggregate (#555)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

P5e items 2-3: the P5b purity test (packages/client/tests/purity.test.ts —
greps the BUILT bundle for '@openpalm/lib' and '/api/host', failing loudly
when build/ is absent) now actually runs in CI's test invocation:

- ci.yml quality-gates: type-check the client app, build the client
  (bun run client:build) BEFORE the bun run test step, so the purity gate
  executes against a fresh bundle and fails the build on violation.
- root package.json: the test aggregate now runs packages/client — as a
  separate leading `bun test --cwd packages/client` invocation, because bun
  1.3.11 silently drops any packages/client path filter whenever packages/cli
  is in the same arg list (string-prefix collision; order/trailing-slash/
  explicit-file forms all collide — verified empirically, documented in
  _test:note). The check aggregate already chains client:check (P5b).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FetR7BttT1xBrA8fBwhui9
---
 .github/workflows/ci.yml | 12 +++++++++++-
 package.json             |  3 ++-
 2 files changed, 13 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index c7ddd514a..c9a18c613 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -110,10 +110,20 @@ jobs:
       - name: Type check UI kit
         run: cd packages/ui-kit && bun run check
 
+      - name: Type check client app
+        run: cd packages/client && bun run check
+
       - name: Type check CLI
         run: cd packages/cli && bun run typecheck
 
-      - name: Test (sdk + guardian + portals)
+      # Client-bundle purity gate (plan §8.5/§8.10): packages/client/tests/
+      # purity.test.ts greps the BUILT bundle for '@openpalm/lib' and
+      # '/api/host' and deliberately FAILS when build/ is absent — so the
+      # client must be built before `bun run test` runs packages/client.
+      - name: Build client app (input to the client purity gate)
+        run: bun run client:build
+
+      - name: Test (sdk + guardian + portals + client purity gate)
         run: bun run test
 
       - name: Validate Docker Compose manifests
diff --git a/package.json b/package.json
index 40d164a31..70f440ab0 100644
--- a/package.json
+++ b/package.json
@@ -59,7 +59,8 @@
     "dev:build": "./scripts/dev-setup.sh --seed-env && docker compose --project-name openpalm-dev --project-directory . -f .dev/system/stack/core.compose.yml -f .dev/system/stack/services.compose.yml -f .dev/system/stack/portals.compose.yml -f .dev/config/stack/custom.compose.yml -f compose.dev.yml --env-file .dev/knowledge/env/stack.env up --build -d",
     "_dev:stack:note": "Intentional dev shortcut: 4-file compose list mirrors the CLI overlay discovery for the dev layout — MANAGED core/services/portals from .dev/system/stack/, USER custom from .dev/config/stack/. --project-name openpalm-dev is required to avoid colliding with a production stack under ~/.openpalm/.",
     "electron:test": "bun run --cwd packages/electron test",
-    "test": "bun test --no-orphans portals/discord portals/slack packages/portal-sdk packages/cli packages/lib packages/ui-kit packages/electron/admin-tools packages/guardian/ scripts/",
+    "test": "bun test --cwd packages/client && bun test --no-orphans portals/discord portals/slack packages/portal-sdk packages/cli packages/lib packages/ui-kit packages/electron/admin-tools packages/guardian/ scripts/",
+    "_test:note": "packages/client runs as a separate `bun test --cwd` invocation (first, so the purity gate always executes): bun 1.3.11 silently drops any packages/client path filter whenever packages/cli is also in the same arg list (string-prefix collision in filter handling — verified empirically; order/trailing-slash/explicit-file forms all collide). The client purity test requires `bun run client:build` first — it fails loudly on a missing build.",
     "analysis:fta": "npx -y fta-cli . -c .fta.json --json | python3 -c \"import json,sys;d=sorted(json.load(sys.stdin),key=lambda x:x['fta_score'],reverse=True);c={};[c.__setitem__(f['assessment'],c.get(f['assessment'],0)+1) for f in d];s=[f['fta_score'] for f in d];print(f'\\n=== FTA Code Complexity Report ({len(d)} files) ===');print(f'Mean: {sum(s)/len(s):.1f} | Median: {sorted(s)[len(s)//2]:.1f} | Max: {max(s):.1f}');print();[print(f'  {a}: {n}') for a,n in sorted(c.items(),key=lambda x:-x[1])];print(f'\\n=== Top 20 Most Complex Files ===');print(f\\\"{'Score':>7}  {'Cyclo':>5}  {'Lines':>5}  {'Assessment':<20}  File\\\");print('-'*100);[print(f\\\"{f['fta_score']:7.1f}  {f['cyclo']:5d}  {f['line_count']:5d}  {f['assessment']:<20}  {f['file_name']}\\\") for f in d[:20]];ni=[f for f in d if f['fta_score']>60];print(f'\\n=== Needs Improvement ({len(ni)} files) ===');[print(f\\\"  {f['fta_score']:6.1f}  {f['file_name']}\\\") for f in ni]\"",
     "analysis:fta:json": "npx -y fta-cli . -c fta.json --json",
     "check": "bun run ui:check && bun run ui-kit:check && bun run client:check",

From 3421395a830792c12753295707239fcc4b1c7c37 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Tue, 7 Jul 2026 00:02:54 +0000
Subject: [PATCH 43/61] docs(release): record @openpalm/client in release
 architecture, plan, env + release notes (#555)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

P5e item 4:

- release-architecture.md: @openpalm/client in the platform/all artifact
  table and per-unit details (publish order, stamp list, preflight incl. the
  client purity gate); refresh the last-updated stamp.
- ui-runtime-modes-plan.md: §1 exact-pin table row for the client marked
  landed (#555/#510); Phase 5 item 5 marked landed with as-built notes; §9
  Release DAG row points at the real file (.github/workflows/release.yml).
- consolidated-stack-env.md: OP_CLIENT_VERSION joins the host-controlled
  version table next to OP_UI_VERSION (optional; empty = image
  PLATFORM_VERSION; never latest).
- CHANGELOG.md (Unreleased): release notes for the @openpalm/client package,
  OP_CLIENT_VERSION / OP_CLIENT_PORT, and the CI purity gate.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FetR7BttT1xBrA8fBwhui9
---
 CHANGELOG.md                             | 14 ++++++++++++++
 docs/technical/consolidated-stack-env.md |  1 +
 docs/technical/release-architecture.md   | 12 ++++++------
 docs/technical/ui-runtime-modes-plan.md  |  9 ++++++---
 4 files changed, 27 insertions(+), 9 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 720589c02..cb65a3b2d 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -9,6 +9,20 @@ Versioning follows [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ### Added
 
+- **New `@openpalm/client` npm package** — the unprivileged chat/connections
+  static app extracted from the admin UI (host/client split, #555). It joins the
+  platform release exactly like `@openpalm/ui`: published by `platform`/`all`
+  releases, always exact-pinned to the platform version. The assistant container
+  installs it at startup as a co-process next to OpenCode (#510), pinned via
+  **`OP_CLIENT_VERSION`** in `stack.env` (empty = the image's `PLATFORM_VERSION`;
+  never `latest` — the same contract as `OP_UI_VERSION` for the host UI), and
+  serves it on **`OP_CLIENT_PORT`** (default host bind `127.0.0.1:3810`, behind
+  the existing `OP_CLIENT_BIND_ADDRESS`/`OP_BIND_ADDRESS` loopback policy).
+  `docker restart` with a new `OP_CLIENT_VERSION` picks up the new client. CI now
+  enforces a client-bundle purity gate: the built artifact must contain no
+  `@openpalm/lib` and no host control-plane (`/api/host`) code. The shared
+  `@openpalm/ui-kit` workspace package is inlined at build time and is never
+  published.
 - The guardian thin-host entrypoint can now install and boot a configurable
   guardian composition package via `OP_GUARDIAN_PACKAGE` (default
   `@openpalm/guardian`) with an overridable boot entry `OP_GUARDIAN_ENTRY`
diff --git a/docs/technical/consolidated-stack-env.md b/docs/technical/consolidated-stack-env.md
index b9cca34f0..8dffaf993 100644
--- a/docs/technical/consolidated-stack-env.md
+++ b/docs/technical/consolidated-stack-env.md
@@ -39,6 +39,7 @@ baked layer. One file should answer "what is this stack, and at what versions?".
 | `OP_IMAGE_TAG` | host — selects all server images | yes (already) |
 | layout (`OP_LAYOUT_VERSION`) | host — migration harness | yes (new) |
 | UI build (`OP_UI_VERSION`) | host — npm, independent of image | yes (new) |
+| client app (`OP_CLIENT_VERSION`) | host — npm, installed by the assistant container at startup (added with `@openpalm/client`, Phase 5 of `ui-runtime-modes-plan.md`) | optional (empty = the image's `PLATFORM_VERSION`; never `latest`) |
 | enabled addons (`OP_ENABLED_ADDONS`) | host — compose profiles | yes (new; was `stack.yml`) |
 | OpenCode / akm-cli / bun / gws | **build-time, baked into the image** | **no (deferred)** — fixed by `OP_IMAGE_TAG` |
 
diff --git a/docs/technical/release-architecture.md b/docs/technical/release-architecture.md
index 9a1e480f2..c807302df 100644
--- a/docs/technical/release-architecture.md
+++ b/docs/technical/release-architecture.md
@@ -1,6 +1,6 @@
 # Release Architecture
 
-> **Last updated 2026-06-21** against the live codebase at 0.12.22.
+> **Last updated 2026-07-06** against the live codebase at 0.12.52.
 
 ## Goals
 
@@ -18,7 +18,7 @@ Each unit has a single canonical version anchor. All packages/images within a un
 
 | Unit | Artifacts | Canonical version anchor |
 |---|---|---|
-| `platform` | @openpalm/lib (npm), openpalm CLI (npm + binaries), @openpalm/ui (npm), @openpalm/skeleton (npm), @openpalm/guardian (npm) | root `package.json` (max with npm-published) |
+| `platform` | @openpalm/lib (npm), openpalm CLI (npm + binaries), @openpalm/ui (npm), @openpalm/client (npm), @openpalm/skeleton (npm), @openpalm/guardian (npm) | root `package.json` (max with npm-published) |
 | `portals` | @openpalm/discord-portal + @openpalm/slack-portal (npm), optional `openpalm/portal` Docker image (`include_images=true`) | `portals/discord/package.json` |
 | `assistant` | `openpalm/assistant` Docker image | `containers/assistant/VERSION` |
 | `guardian` | @openpalm/guardian (npm), @openpalm/skeleton (npm), optional guardian Docker image | `packages/guardian/package.json` (max with npm-published) |
@@ -106,11 +106,11 @@ For `unit=all`, `bump` determines the version increment (patch/minor/major all v
 
 ### `platform`
 
-Publishes: @openpalm/skeleton → @openpalm/lib → (@openpalm/guardian, openpalm CLI, @openpalm/ui) → CLI binaries → optional Electron.
+Publishes: @openpalm/skeleton → @openpalm/lib → (@openpalm/guardian, openpalm CLI, @openpalm/ui) → CLI binaries → optional Electron. @openpalm/client publishes in parallel (exact-pin, `needs-build`, like @openpalm/ui) — it deliberately has **no** @openpalm/lib ordering dependency because the client never bundles the host library (ui-runtime-modes-plan.md §8.10; `@openpalm/ui-kit` is inlined from the workspace at build time and is **never published**).
 
-Stamps: root, lib, skeleton, guardian, cli, ui, electron, admin-tools package.json files + `scripts/setup.sh` `SCRIPT_VERSION` + `scripts/setup.ps1` `$ScriptVersion`.
+Stamps: root, lib, skeleton, guardian, cli, ui, client, electron, admin-tools package.json files + `scripts/setup.sh` `SCRIPT_VERSION` + `scripts/setup.ps1` `$ScriptVersion`.
 
-Preflight: full test suite (`bun run test`, `ui:check`, `ui:test:unit`, `electron:test`).
+Preflight: full test suite (`bun run client:build` then `bun run test` — which includes the client-bundle purity gate — plus `ui:check`, `ui-kit:check`, `client:check`, `ui:test:unit`, `electron:test`).
 
 ### `portals`
 
@@ -150,7 +150,7 @@ Preflight: `bun run electron:test`.
 
 The **complete** release. Stamps every unit's files simultaneously to the same version (any bump type or explicit override) and publishes everything, flag-free:
 
-- **npm**: `@openpalm/{lib,ui,guardian,skeleton}` + `openpalm` (CLI) + `@openpalm/{discord,slack}-portal`
+- **npm**: `@openpalm/{lib,ui,client,guardian,skeleton}` + `openpalm` (CLI) + `@openpalm/{discord,slack}-portal`
 - **Docker**: `openpalm/{assistant,guardian,portal}` (+ `:latest` for stable)
 - **Electron** installers (mac/linux/win) + CLI native binaries
 - Per-unit tags + bare `X.Y.Z` summary tag + GitHub release
diff --git a/docs/technical/ui-runtime-modes-plan.md b/docs/technical/ui-runtime-modes-plan.md
index 0e7f50b7b..6a9aeeb51 100644
--- a/docs/technical/ui-runtime-modes-plan.md
+++ b/docs/technical/ui-runtime-modes-plan.md
@@ -56,7 +56,7 @@ Every updatable component follows the same pattern. This is the design standard
 | Component | Package | Version strategy | Runtime install | Containers |
 |---|---|---|---|---|
 | Host UI | `@openpalm/ui` | Exact pin: `OP_UI_VERSION` → `PLATFORM_VERSION` → **error** | `npm install` | — (host process) |
-| Client UI | `@openpalm/client` | Exact pin: `OP_CLIENT_VERSION` → `PLATFORM_VERSION` → **error** | `npm install` | assistant |
+| Client UI — **landed** (#555/#510) | `@openpalm/client` | Exact pin: `OP_CLIENT_VERSION` → `PLATFORM_VERSION` → **error** | `npm install` | assistant |
 | Skeleton / OP_HOME seed | `@openpalm/skeleton` | Exact pin: `OP_SKELETON_VERSION` → `PLATFORM_VERSION` → **error** | `npm install` | assistant, guardian |
 | Guardian | `@openpalm/guardian` | Exact pin: `OP_GUARDIAN_VERSION` → `PLATFORM_VERSION` → **error** | `npm install` | guardian |
 | Portal (discord) | `@openpalm/portal-discord` | Exact pin: `OP_PORTAL_DISCORD_VERSION` → `PLATFORM_VERSION` → **error** | `npm install` | portal |
@@ -663,7 +663,10 @@ Acceptance: assistant-container can edit persona/AKM but not project name or bin
    (`OP_CLIENT_VERSION` → `PLATFORM_VERSION` → error); co-process serves the static bundle
    (Slice A). Fix the `OP_OPENCODE_URL` wiring bug (§6.9). Publish the port in compose
    behind the existing bind-address policy.
-5. Release: `@openpalm/client` joins the publish DAG and the exact-pin table.
+5. Release: `@openpalm/client` joins the publish DAG and the exact-pin table. — **landed**
+   (P5e: `release.yml` `npm-client` job mirrors `npm-ui`, exact-pin/`needs-build`,
+   platform+all stamp/regression-guard/version-sync membership; the client-bundle
+   purity gate runs in CI; `@openpalm/ui-kit` stays unpublished).
 6. (Optional Slice B, separate issue) settings shim for `/api/assistant/*` writes.
 
 Acceptance: chat in Electron runs from the client build; assistant-container URL serves
@@ -757,7 +760,7 @@ launch shows the shell + saved connections, not a blank page.
 | PWA | (none) | `@vite-pwa/sveltekit` in `packages/client`; hosted deploy pipeline (Phase 6) |
 | Guardian edge | plain HTTP, no CORS | CORS allowlist + TLS workstream (Phases 6, 6.5) |
 | Electron main | `packages/electron/src/main.ts` | Pass `OP_UI_HOST_MODE=electron-host`; serve/point at client build (Phases 1, 5) |
-| Release DAG | `platform-release.yml` | Add `@openpalm/client`; skeleton pin advance check (Phase 8) |
+| Release DAG | `.github/workflows/release.yml` (the plan's "platform-release.yml") | Add `@openpalm/client` — **landed** (Phase 5/P5e); skeleton pin advance check remains (Phase 8) |
 
 ---
 

From 1748915ac7cefaa5558cb3affd9899308b24d4cd Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Tue, 7 Jul 2026 00:35:12 +0000
Subject: [PATCH 44/61] docs(plan): mark Phase 5 DONE with as-built notes
 (#555, #510)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Records the P5a-P5e as-built state in §7 (ui-kit extraction, client SPA +
purity gate, harness serving on stable port 3890, assistant-container
Slice A, release DAG), closes the §6.9 known-gaps list (start_client +
runtime-config.json supersede the start_ui/OPENCODE_API_URL wiring), and
updates §3/§10. Explicitly deferred: packages/ui chat is NOT yet deleted
(Electron parity confirmation pending) and the Slice B assistant-settings
shim is not built.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FetR7BttT1xBrA8fBwhui9
---
 docs/technical/ui-runtime-modes-plan.md | 93 ++++++++++++++++++-------
 1 file changed, 66 insertions(+), 27 deletions(-)

diff --git a/docs/technical/ui-runtime-modes-plan.md b/docs/technical/ui-runtime-modes-plan.md
index 6a9aeeb51..8d80bb79e 100644
--- a/docs/technical/ui-runtime-modes-plan.md
+++ b/docs/technical/ui-runtime-modes-plan.md
@@ -1,7 +1,7 @@
 # UI Host/Client Runtime Refactor Plan
 
-**Date:** 2026-06-19 (revised 2026-07-06)
-**Status:** RATIFIED — Phases 0–4 (+1.5) landed; Phases 5–6 re-scoped per `docs/technical/ui-client-split-assessment.md`
+**Date:** 2026-06-19 (revised 2026-07-06; Phase 5 as-built recorded 2026-07-07)
+**Status:** RATIFIED — Phases 0–5 (+1.5) landed; Phases 5–6 re-scoped per `docs/technical/ui-client-split-assessment.md`
 **Repo:** `itlackey/openpalm`, branch `main`
 **Related issues:** #486 (remote-only install), #435 (guardian authn), #433 (guardian state), #488 (mDNS), #506 (styling), #509 (RuntimeContext), #510 (assistant-container), #511 (PWA), #555 (client extraction), #556 (openpalm admin), #557 (guardian TLS + CORS)
 
@@ -148,7 +148,7 @@ offline before any npm fetch. This is deliberate; do not "clean it up."
 `containers/assistant/entrypoint.sh` implements `install_runtime_artifacts()` with these
 properties (which supersede the draft sketch):
 
-- Exact-pinned artifacts (`@openpalm/ui` today → `@openpalm/client` after Phase 5;
+- Exact-pinned artifacts (`@openpalm/client` since Phase 5 — was `@openpalm/ui`;
   `@openpalm/skeleton`) resolve `OP_*_VERSION` → `PLATFORM_VERSION` → **hard error**.
 - An install **failure after version resolution** logs an ERROR and continues with the
   existing on-disk artifact if present (warm restart resilience) — the draft's
@@ -459,22 +459,24 @@ packages/skeleton/
 
 ### 6.9 `assistant-container` mode — **[as-landed + re-scoped]**
 
-**Already landed in `containers/assistant/entrypoint.sh`:** `install_runtime_artifacts()`
-(exact-pin resolution, npm install of UI + skeleton, tools via `bun update`) and
-`start_ui()` (co-process launch, `OP_UI_PORT` default 3000). Boot order:
-`install_runtime_artifacts → … → start_ui → start_opencode`.
-
-**Not yet landed / known gaps (tracked in #510):**
-
-1. The co-process port is **not published** in any compose file — the UI runs but is
-   unreachable from outside the container.
-2. `start_ui` exports `OPENCODE_API_URL`, but the UI reads `OP_OPENCODE_URL` /
-   `OP_ASSISTANT_URL` — the co-process therefore points at the default
-   `http://127.0.0.1:3800` instead of the in-container OpenCode at `:4096`. Wiring bug;
-   fix regardless of the re-scope.
-3. No mode env (`OP_UI_HOST_MODE`, `OP_UI_SINGLE_CONNECTION`) is set, and no
-   skeleton-seed call runs for assistant-scoped config (`seedFromSkeleton()` from the
-   draft does not exist in lib).
+**Landed in `containers/assistant/entrypoint.sh`:** `install_runtime_artifacts()`
+(exact-pin resolution, npm install of client + skeleton, tools via `bun update`) and —
+since Phase 5 (P5d) — `start_client()` (static co-process via the client's `serve.mjs`,
+`OP_CLIENT_PORT` default 3000; replaces the pre-Phase-5 `start_ui()`/`OP_UI_PORT`).
+Boot order: `install_runtime_artifacts → … → start_client → start_opencode`.
+
+**Known gaps (tracked in #510) — all CLOSED by Phase 5 (P5d):**
+
+1. ~~The co-process port is not published in any compose file.~~ Compose now publishes
+   `OP_CLIENT_PORT` (in-container default 3000) behind the existing bind-address policy.
+2. ~~`start_ui` exports `OPENCODE_API_URL`, but the UI reads `OP_OPENCODE_URL`.~~ Moot
+   after the re-scope: `start_ui` is gone; `start_client` writes `runtime-config.json`
+   beside the build with one **locked default connection** pointing at the OpenCode port
+   as published on the host (`http://127.0.0.1:${OP_ASSISTANT_PORT:-3800}` — the browser,
+   not the container, dials it), overridable via `OP_CLIENT_DEFAULT_ASSISTANT_URL`.
+3. ~~No mode env / skeleton-seed for assistant-scoped config.~~ The static client needs
+   no mode env — single-connection behavior comes from the seeded locked connection
+   (`runtime-config.json`), not a server flag.
 
 **Re-scope (ratified):** after Phase 5, the co-process serves **`@openpalm/client`**
 (static files) instead of the full host app:
@@ -649,10 +651,47 @@ fall-through (route tree deleted, deliberately no hooks alias per §6.4).
 
 Acceptance: assistant-container can edit persona/AKM but not project name or bind address; host mode unchanged; `/admin/*` returns 404.
 
-### Phase 5 — Extract `packages/client` + `packages/ui-kit` (#555); assistant-container serves it (#510)
+### Phase 5 — Extract `packages/client` + `packages/ui-kit` (#555); assistant-container serves it (#510) — ✅ DONE
 
 *Depends on Phases 2–4 (the untangling steps).*
 
+**As-built (2026-07-07, sub-phases P5a–P5e; details in
+`docs/technical/phase-5-completion-guide.md`):**
+
+- **P5a — `packages/ui-kit`:** `components/common/`, `icons/`, and theme tokens moved
+  into a raw-source, unpublished workspace package with its own
+  `svelte-check --fail-on-warnings` gate (the raw sources' only TS coverage).
+  `Toast.svelte` was decoupled from voice-state during the move (voice errors are
+  mirrored from app code) so ui-kit holds no store with server/app assumptions.
+- **P5b — `packages/client`:** adapter-static SPA (`/chat`, `/connections`,
+  `/connections/new`) with one transport module (request shaping, SSE parsing, health
+  probe), an IndexedDB connection store seeded from an optional `runtime-config.json`,
+  its own `resolveLanding`, a zero-dependency `bin/serve.mjs` static server (loopback
+  by default), and a build-time version stamp. A **bundle purity test**
+  (`tests/purity.test.ts`, runs in CI) greps every file of the built bundle for the
+  forbidden markers `@openpalm/lib` and `/api/host` (and fails loudly on a missing
+  build) — §8.5/§8.10 enforced structurally, plus source hygiene (no lib dependency in
+  any group, no `src/lib/server/`). `@vite-pwa/sveltekit` is NOT yet added (Phase 6).
+- **P5c — harness serving:** lib gained `control-plane/client-assets.ts`
+  (resolve/seed/update, sibling of `ui-assets.ts`); the CLI serves the client build on
+  the **stable loopback port 3890** (`DEFAULT_CLIENT_PORT` in
+  `packages/cli/src/lib/ports.ts`, override `OP_CLIENT_PORT`); Electron spawns a client
+  server child and the window prefers the client chat, with a health probe falling back
+  to the host UI when the client build is absent or dead.
+- **P5d — assistant container (#510):** entrypoint installs `@openpalm/client`
+  (exact pin `OP_CLIENT_VERSION` → `PLATFORM_VERSION` → hard error), writes
+  `runtime-config.json` with one locked default connection, and serves the static build
+  via `serve.mjs`; compose publishes `OP_CLIENT_PORT` behind the bind-address policy.
+  All three §6.9 gaps closed (see §6.9 as-built notes). Slice A only.
+- **P5e — release:** item 5 below (landed as written).
+- **Deferred, deliberately:**
+  - **`packages/ui` chat is NOT yet deleted** — the client's parity inside Electron has
+    not been confirmed, so per §6.11 the host app keeps its chat surface (Electron falls
+    back to it) until parity is verified in real use. Deletion is a follow-up.
+  - **Slice B (assistant-settings shim) is NOT built** — assistant-container mode is
+    chat-only against the single locked connection; `/api/assistant/*` writes from the
+    container's browser surface remain an optional future slice (§6.9).
+
 1. Create `packages/ui-kit` (raw-source workspace package); move `components/common/`,
    `icons/`, theme tokens. Both apps consume it.
 2. Create `packages/client` per §6.11; move chat + connections views; implement the single
@@ -773,17 +812,17 @@ Phase 1.5 (openpalm admin)        ✅ DONE (#556)
 Phase 2 (connections + untangle)  ✅ DONE (#486) ──┐
 Phase 3 (landing + chrome untangle) ✅ DONE       ─┼─► Phase 5 prerequisites met
 Phase 4 (control plane split)     ✅ DONE (#555) ──┘
-Phase 5 (client + ui-kit extraction, assistant-container) ─► prerequisite for 6
-Phase 6 (PWA, two install origins) ─ needs 5
-Phase 6.5 (guardian TLS + CORS)   ─ parallel to 5/6; gates the phone story
+Phase 5 (client + ui-kit extraction, assistant-container) ✅ DONE (#555/#510)
+Phase 6 (PWA, two install origins) ─ needs 5 (met)
+Phase 6.5 (guardian TLS + CORS)   ─ parallel to 6; gates the phone story
 Phase 7 (security tests)          ─ needs 1–6.5
 Phase 8 (release integration)     ─ needs all
 ```
 
-0.13.0 target: Phases 1–4 + 1.5 — **complete**. Phases 5–6.5 land in 0.13.0 only if it
-stays light; otherwise they open 0.14.0. (The original "all phases in 0.13.0" call
-predates the client-split re-scope; the Phase 4 completion re-evaluation point has now
-been reached.)
+0.13.0 target: Phases 1–4 + 1.5 — **complete**. Phase 5 is now **complete** as well
+(P5a–P5e; see §7 as-built notes — `packages/ui` chat retained pending Electron parity
+confirmation, Slice B shim not built). Phases 6–6.5 remain; they land in 0.13.0 only if
+it stays light, otherwise they open 0.14.0.
 
 ---
 

From ac1c5ea48d551e9f80aace83a1915973b238300d Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Tue, 7 Jul 2026 01:48:23 +0000
Subject: [PATCH 45/61] fix(ui): route main's new chat/voice icon imports
 through @openpalm/ui-kit

Post-merge fix: PR #554 landed on main importing $lib/components/icons/*
which Phase 5a moved to ui-kit; ChatMessage + VoiceStatusStrip now import
from @openpalm/ui-kit like the rest of the branch. (#555)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FetR7BttT1xBrA8fBwhui9
---
 packages/ui/src/lib/components/chat/ChatMessage.svelte      | 4 ++--
 packages/ui/src/lib/components/chat/VoiceStatusStrip.svelte | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/packages/ui/src/lib/components/chat/ChatMessage.svelte b/packages/ui/src/lib/components/chat/ChatMessage.svelte
index 59a9a8768..cdf19915c 100644
--- a/packages/ui/src/lib/components/chat/ChatMessage.svelte
+++ b/packages/ui/src/lib/components/chat/ChatMessage.svelte
@@ -2,8 +2,8 @@
   import { onMount } from 'svelte';
   import type { ChatEntry } from '$lib/types.js';
   import { renderMarkdown } from '$lib/markdown.js';
-  import IconCopy from '$lib/components/icons/IconCopy.svelte';
-  import IconDone from '$lib/components/icons/IconDone.svelte';
+  import IconCopy from '@openpalm/ui-kit/components/icons/IconCopy.svelte';
+  import IconDone from '@openpalm/ui-kit/components/icons/IconDone.svelte';
 
   interface Props {
     entry: ChatEntry;
diff --git a/packages/ui/src/lib/components/chat/VoiceStatusStrip.svelte b/packages/ui/src/lib/components/chat/VoiceStatusStrip.svelte
index 463cf98c2..df7ebd05a 100644
--- a/packages/ui/src/lib/components/chat/VoiceStatusStrip.svelte
+++ b/packages/ui/src/lib/components/chat/VoiceStatusStrip.svelte
@@ -1,6 +1,6 @@
 <script lang="ts">
 	import { voiceState, resumeAutoplay, stopConversation } from '$lib/voice/voice-state.svelte.js';
-	import IconSoundOff from '$lib/components/icons/IconSoundOff.svelte';
+	import IconSoundOff from '@openpalm/ui-kit/components/icons/IconSoundOff.svelte';
 
 	interface Props {
 		/** True while the assistant is composing a reply (chat.sending). */

From a3e1fdfe464cd53ca3fe0762f5665b013ed9844d Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Tue, 7 Jul 2026 01:51:21 +0000
Subject: [PATCH 46/61] =?UTF-8?q?docs(plan):=20=C2=A712=20remaining-work?=
 =?UTF-8?q?=20handoff=20=E2=80=94=20verified=20statuses,=20chat=20parity?=
 =?UTF-8?q?=20contract,=20Phases=206-8=20(#511,=20#557)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Post-merge review of the full branch vs main: records the #554 merge
reconciliation, the enlarged chat parity gap that gates deleting the
host chat, Phase 6/6.5/7/8 work items updated for as-built state, and
code-verified open items with file pointers. Completion guide marked
historical.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FetR7BttT1xBrA8fBwhui9
---
 docs/technical/phase-5-completion-guide.md |   2 +-
 docs/technical/ui-runtime-modes-plan.md    | 117 ++++++++++++++++++++-
 2 files changed, 117 insertions(+), 2 deletions(-)

diff --git a/docs/technical/phase-5-completion-guide.md b/docs/technical/phase-5-completion-guide.md
index 6bb4a5bef..c1133463b 100644
--- a/docs/technical/phase-5-completion-guide.md
+++ b/docs/technical/phase-5-completion-guide.md
@@ -2,7 +2,7 @@
 
 **Date:** 2026-07-06
 **Branch:** `claude/ui-runtime-modes-phases-1-4`
-**Status:** P5a + P5b DONE (gates passed). P5c, P5d, P5e + final sweep REMAIN.
+**Status:** HISTORICAL — Phase 5 completed in full (P5a–P5e + final sweep, all gates passed) on 2026-07-07. This document is preserved as the working record; for current remaining work see `ui-runtime-modes-plan.md` §12.
 **Plan:** `docs/technical/ui-runtime-modes-plan.md` (§6.9–§6.11, Phase 5, §8 rules, §1 simplicity guardrails)
 **Decision record:** `docs/technical/ui-client-split-assessment.md`
 **Tracking issues:** #555 (client extraction), #510 (assistant-container Slice A)
diff --git a/docs/technical/ui-runtime-modes-plan.md b/docs/technical/ui-runtime-modes-plan.md
index 8d80bb79e..4782fe07a 100644
--- a/docs/technical/ui-runtime-modes-plan.md
+++ b/docs/technical/ui-runtime-modes-plan.md
@@ -1,7 +1,7 @@
 # UI Host/Client Runtime Refactor Plan
 
 **Date:** 2026-06-19 (revised 2026-07-06; Phase 5 as-built recorded 2026-07-07)
-**Status:** RATIFIED — Phases 0–5 (+1.5) landed; Phases 5–6 re-scoped per `docs/technical/ui-client-split-assessment.md`
+**Status:** RATIFIED — Phases 0–5 (+1.5) landed; Phases 6–8 remain — see **§12 Remaining work** for the complete handoff (verified against code 2026-07-07, post-merge with main/#554)
 **Repo:** `itlackey/openpalm`, branch `main`
 **Related issues:** #486 (remote-only install), #435 (guardian authn), #433 (guardian state), #488 (mDNS), #506 (styling), #509 (RuntimeContext), #510 (assistant-container), #511 (PWA), #555 (client extraction), #556 (openpalm admin), #557 (guardian TLS + CORS)
 
@@ -848,3 +848,118 @@ it stays light, otherwise they open 0.14.0.
 
 **Release:**
 - electron-host, host-ui, assistant-container, and both PWA install paths smoke-tested before publishing each release
+
+---
+
+## 12. Remaining work — detailed handoff (verified 2026-07-07)
+
+Everything below was verified against the code on branch
+`claude/ui-runtime-modes-phases-1-4` (PR #559) after merging `origin/main`
+(commit `49bab70` + import fix `ac1c5ea`). Statuses here are checked facts, not
+assumptions.
+
+### 12.1 Merge reconciliation (2026-07-07)
+
+`origin/main` brought PR #554 (chat voice/streaming UX: streaming markdown +
+autoscroll, sentence-stream TTS, hands-free conversation mode, earcons, VAD,
+barge-in, copy affordances, stop-generation, composer resilience) into
+`packages/ui`'s chat. Conflicts were resolved by routing main's new icon imports
+through `@openpalm/ui-kit` (`ChatInput`, `ChatMessage`, `VoiceStatusStrip`;
+`IconWaves.svelte` relocated to ui-kit). All suites re-verified at parity
+post-merge (ui:check 0/0 across 1,203 files; UI vitest 1,139/1,139 node-project).
+
+**Consequence:** the client app's chat copies did NOT receive these features —
+the parity gap that gates deleting `packages/ui` chat grew substantially. See §12.2.
+
+### 12.2 Chat parity contract — gates deleting `packages/ui` chat (§6.11 rule 3)
+
+Measured delta: `packages/client/src/routes/chat/+page.svelte` is 328 LOC vs the
+host chat's 1,597. Missing in the client (all present in `packages/ui` after #554):
+
+- streaming markdown rendering + the `$lib/chat/autoscroll.ts` module
+- stop-generation control for in-flight turns
+- copy affordances on messages/code blocks (`IconCopy`/`IconDone` in `ChatMessage`)
+- composer resilience (IME guard, draft-while-sending, failed-send retry)
+- the entire voice stack: `VoiceStatusStrip`, conversation mode, earcons,
+  VAD calibration, sentence-stream TTS, barge-in (`packages/ui/src/lib/voice/*`)
+- session history browsing (`SessionPicker`)
+
+**Decision required before porting** (file as its own issue):
+(a) full parity port — progressively move shared chat components into `ui-kit`
+and port the voice stack into the client; heavy, and drags voice/media concerns
+into the unprivileged client; or
+(b) **recommended per §1 simplicity guardrails:** define client-chat parity as a
+subset contract — text chat + streaming render + stop + copy + failed-send retry;
+voice remains host-chat-only for now. Either way, `packages/ui` chat is deleted
+only when the written contract is met AND Electron has been verified running the
+client chat in a real browser.
+
+### 12.3 Phase 6 — PWA (#511). All prerequisites met. Work items:
+
+1. `@vite-pwa/sveltekit` in `packages/client`: manifest, icons (192/512 +
+   maskable), Workbox app-shell precache. SW rules: never cache credentialed
+   responses; `runtime-config.json` must be NetworkFirst (a stale locked
+   connection URL must not outlive a container reconfigure).
+2. Localhost origin: the harness already serves the client on stable loopback
+   port 3890 (P5c). Add install affordances: Electron menu item, host-app
+   button, and an `openpalm app` CLI command that opens the browser there.
+3. Hosted origin: CI deploy of the static build to the official URL
+   (`app.openpalm.dev`; hosting provider TBD). Client-side contract-version
+   handshake against `/api/runtime` with graceful degradation.
+4. Pairing UX (§6.6): host app `/connections` mints QR + one-time code; client
+   `/connections/new` accepts paste-or-scan. Guardian side coordinates with
+   #435/#557.
+5. Offline shell: the IndexedDB store landed in P5b — verify the offline boot
+   path end-to-end once the SW exists.
+
+### 12.4 Phase 6.5 — guardian TLS + CORS (#557)
+
+As specced in §7 Phase 6.5. Hard prerequisite for any phone → guardian
+connection (secure-context + mixed-content rules). CORS allowlist must include
+the hosted origin; the hosted client refuses plain-HTTP non-loopback targets
+with an actionable deep-link to the TLS guide. Tailscale `ts.net` is the
+recommended default; Caddy + user domain the alternative; installing a private
+CA on phones is an explicit non-goal.
+
+### 12.5 Phase 7 — security hardening (updated for as-built state)
+
+Already covered by earlier phases: `/api/host/*` guard hygiene tests (Phase 4),
+client bundle purity gate in CI (P5e), `serve.mjs` hostile-request tests (P5b).
+Remaining: guardian CORS enforcement tests; SW caching-rule review (with Phase 6);
+context-aware origin checks per mode; CSP review for BOTH apps — note
+`packages/client/svelte.config.js` has no `kit.csp` yet (add during Phase 6);
+verify the purity assertion also runs against the container-pulled artifact path.
+
+### 12.6 Phase 8 — release remainder
+
+- Verify the release process advances the CLI's pinned `@openpalm/skeleton` dep
+  in lockstep with `PLATFORM_VERSION` (§6.7 follow-up — still open).
+- Replacement docs: `ui-runtime-modes.md` (successor to this plan) +
+  `artifact-delivery-pattern.md`.
+- Release checklist: smoke-test electron-host, host-ui (`openpalm admin`),
+  assistant-container, and both PWA install origins.
+- **Before merging PR #559:** one real-browser run of the 30 browser-project
+  `*.svelte.vitest.ts` files (`cd packages/ui && npm run test:unit`) — they
+  cannot execute in the dev container (Playwright browser download is
+  proxy-blocked); they are updated for the new routes and type-check clean.
+
+### 12.7 Open code-level items (each verified in code, with pointers)
+
+1. **Locked-entry pruning not implemented** —
+   `packages/client/src/lib/connections/index.ts`: `seedFromRuntimeConfig` is
+   upsert-only and `deleteConnection` rejects locked entries (~line 225), so a
+   locked entry removed from a later `runtime-config.json` is stuck forever.
+   Fix: prune locked entries absent from the current config during seed.
+   Owner: the entrypoint/store pair (#510 follow-up).
+2. **`pickStorage()` async-failure gap** — only synchronous `indexedDB` access
+   errors fall back to memory; an async `open()` rejection (e.g. Firefox
+   private mode) caches a rejected boot promise. Add async fallback.
+3. **`createConnectionStore(options: { storage: unknown })`** weakens typing at
+   the single construction site — tighten to `ConnectionStorage`.
+4. **Slice B settings shim** (§6.9, optional): not built — assistant-container
+   mode is chat-only. Ship only when browser-editable assistant settings are
+   actually wanted.
+5. Resolved for the record: CI wiring for client/ui-kit suites ✅ (P5e),
+   `@openpalm/client` `private` flag removed ✅ (P5e), `serve.mjs`
+   percent-escape hardening ✅ (P5b gate), `runtime-config.json` offline
+   resilience ✅ (`loadRuntimeConfig` never throws).

From bb237d2e085a2f1b097c865f1bd6f8685d976913 Mon Sep 17 00:00:00 2001
From: itlackey <itlackey@gmail.com>
Date: Tue, 7 Jul 2026 11:44:13 -0500
Subject: [PATCH 47/61] fix(runtime): address client app review fixes

---
 bun.lock                                      | 605 +++++++++++++++++-
 containers/assistant/entrypoint.sh            |  30 +
 docs/operations/release-management.md         |  29 +-
 docs/technical/artifact-delivery-pattern.md   | 102 +++
 docs/technical/environment-and-mounts.md      |   9 +
 docs/technical/release-architecture.md        |   3 +
 docs/technical/ui-runtime-modes-plan.md       |   5 +-
 docs/technical/ui-runtime-modes.md            | 121 ++++
 packages/cli/package.json                     |   2 +-
 packages/cli/src/commands/app.test.ts         |  55 ++
 packages/cli/src/commands/app.ts              |  18 +
 packages/cli/src/lib/client-server.test.ts    |  75 ++-
 packages/cli/src/lib/client-server.ts         |  47 +-
 packages/cli/src/lib/ports.ts                 |   8 +-
 packages/cli/src/lib/ui-server.test.ts        |  33 +-
 packages/cli/src/lib/ui-server.ts             |  43 +-
 packages/cli/src/main.test.ts                 |   8 +
 packages/cli/src/main.ts                      |   1 +
 packages/client/bin/serve.mjs                 |  34 +-
 packages/client/package.json                  |   1 +
 packages/client/src/app.html                  |   1 +
 packages/client/src/lib/boot.ts               |  30 +-
 packages/client/src/lib/connections/index.ts  |  42 +-
 packages/client/static/maskable-512x512.png   | Bin 0 -> 126564 bytes
 packages/client/static/pwa-192x192.png        | Bin 0 -> 30946 bytes
 packages/client/static/pwa-512x512.png        | Bin 0 -> 191174 bytes
 packages/client/svelte.config.js              |  17 +
 packages/client/tests/boot.test.ts            |  87 +++
 .../client/tests/connections-seed.test.ts     |  68 ++
 packages/client/tests/helpers/contract.ts     |  13 +-
 packages/client/tests/pwa-config.test.ts      | 228 +++++++
 packages/client/tests/serve.test.ts           |  36 +-
 packages/client/vite.config.ts                |  95 ++-
 packages/electron/src/harness-contract.ts     |   3 +-
 packages/electron/src/main.ts                 |  21 +-
 packages/electron/src/preload.ts              |   4 +
 packages/electron/src/tray.ts                 |   3 +
 packages/electron/test/initial-url.test.ts    |  14 +-
 packages/electron/test/main.test.ts           |  21 +-
 packages/guardian/src/config.ts               |  35 +
 packages/guardian/src/cors.test.ts            | 288 +++++++++
 packages/guardian/src/server.ts               |  76 ++-
 .../assistant-client-compose.test.ts          |   6 +
 .../assistant-client-entrypoint.test.ts       |  11 +
 .../src/control-plane/client-app-url.test.ts  |  23 +
 .../lib/src/control-plane/client-app-url.ts   |   9 +
 .../src/control-plane/client-assets.test.ts   |  51 +-
 .../client-runtime-config.test.ts             |  36 ++
 .../control-plane/client-runtime-config.ts    |  37 ++
 packages/lib/src/index.ts                     |  11 +
 .../skeleton/system/stack/core.compose.yml    |   7 +
 .../skeleton/system/stack/portals.compose.yml |   1 +
 packages/ui/src/app.d.ts                      |   1 +
 packages/ui/src/hooks.server.ts               |   5 +-
 packages/ui/src/lib/local-client-app.ts       |  18 +
 .../ui/src/lib/local-client-app.vitest.ts     |  24 +
 packages/ui/src/lib/server/helpers.ts         |  52 +-
 .../lib/server/host-origin-checks.vitest.ts   |  42 +-
 packages/ui/src/routes/host/+page.server.ts   |   8 +
 packages/ui/src/routes/host/+page.svelte      |  47 +-
 scripts/set-version.mjs                       |  15 +-
 scripts/set-version.test.ts                   |  20 +
 62 files changed, 2623 insertions(+), 112 deletions(-)
 create mode 100644 docs/technical/artifact-delivery-pattern.md
 create mode 100644 docs/technical/ui-runtime-modes.md
 create mode 100644 packages/cli/src/commands/app.test.ts
 create mode 100644 packages/cli/src/commands/app.ts
 create mode 100644 packages/client/static/maskable-512x512.png
 create mode 100644 packages/client/static/pwa-192x192.png
 create mode 100644 packages/client/static/pwa-512x512.png
 create mode 100644 packages/client/tests/boot.test.ts
 create mode 100644 packages/client/tests/pwa-config.test.ts
 create mode 100644 packages/guardian/src/cors.test.ts
 create mode 100644 packages/lib/src/control-plane/client-app-url.test.ts
 create mode 100644 packages/lib/src/control-plane/client-app-url.ts
 create mode 100644 packages/lib/src/control-plane/client-runtime-config.test.ts
 create mode 100644 packages/lib/src/control-plane/client-runtime-config.ts
 create mode 100644 packages/ui/src/lib/local-client-app.ts
 create mode 100644 packages/ui/src/lib/local-client-app.vitest.ts
 create mode 100644 packages/ui/src/routes/host/+page.server.ts

diff --git a/bun.lock b/bun.lock
index 4f36589fe..58cc73544 100644
--- a/bun.lock
+++ b/bun.lock
@@ -15,8 +15,8 @@
         "openpalm": "./bin/openpalm.js",
       },
       "dependencies": {
-        "@openpalm/lib": ">=0.12.19 <1.0.0",
-        "@openpalm/skeleton": "0.12.18",
+        "@openpalm/lib": ">=0.12.52 <1.0.0",
+        "@openpalm/skeleton": "0.12.52",
         "citty": "^0.2.1",
         "yaml": "^2.8.0",
       },
@@ -37,6 +37,7 @@
         "@sveltejs/kit": "^2.53.3",
         "@sveltejs/vite-plugin-svelte": "^7.1.2",
         "@types/node": "^25.9.1",
+        "@vite-pwa/sveltekit": "^1.1.0",
         "svelte": "^5.53.5",
         "svelte-check": "^4.1.1",
         "typescript": "^6.0.3",
@@ -175,14 +176,190 @@
   "packages": {
     "7zip-bin": ["7zip-bin@5.2.0", "", {}, "sha512-ukTPVhqG4jNzMro2qA9HSCSSVJN3aN7tlb+hfqYCt3ER0yWroeA2VR38MNrOHLQ/cVj+DaIMad0kFCtWWowh/A=="],
 
+    "@apideck/better-ajv-errors": ["@apideck/better-ajv-errors@0.3.7", "", { "dependencies": { "jsonpointer": "^5.0.1", "leven": "^3.1.0" }, "peerDependencies": { "ajv": ">=8" } }, "sha512-TajUJwGWbDwkCx/CZi7tRE8PVB7simCvKJfHUsSdvps+aTM/PDPP4gkLmKnc+x3CE//y9i/nj74GqdL/hwk7Iw=="],
+
     "@axe-core/playwright": ["@axe-core/playwright@4.11.3", "", { "dependencies": { "axe-core": "~4.11.4" }, "peerDependencies": { "playwright-core": ">= 1.0.0" } }, "sha512-h/kfksv4F0cVIDlKpT4700OehdRgpvuVskuQ2nb7/JmtWUXpe9ftHAPtwyXGvVSsa6SJ64A9ER7Zrzc/sIvC4w=="],
 
+    "@babel/code-frame": ["@babel/code-frame@7.29.7", "", { "dependencies": { "@babel/helper-validator-identifier": "^7.29.7", "js-tokens": "^4.0.0", "picocolors": "^1.1.1" } }, "sha512-Aup7aUOfpbAUg2ROOJN6Iw5f9DMBlzu0mIkm/malLQFN/YQgO48wCj0Kxa3sEHJvPVFg7siR+qRInwXd2qhQKw=="],
+
+    "@babel/compat-data": ["@babel/compat-data@7.29.7", "", {}, "sha512-locTkQyKvwIEgBzVrn8693ebc97F2U8ZHjbXwDXJ5Fn2TCpNwTlKcaKLkdHop5c/icOFE7qt7Q9JC5hnKNa6Gg=="],
+
+    "@babel/core": ["@babel/core@7.29.7", "", { "dependencies": { "@babel/code-frame": "^7.29.7", "@babel/generator": "^7.29.7", "@babel/helper-compilation-targets": "^7.29.7", "@babel/helper-module-transforms": "^7.29.7", "@babel/helpers": "^7.29.7", "@babel/parser": "^7.29.7", "@babel/template": "^7.29.7", "@babel/traverse": "^7.29.7", "@babel/types": "^7.29.7", "@jridgewell/remapping": "^2.3.5", "convert-source-map": "^2.0.0", "debug": "^4.1.0", "gensync": "^1.0.0-beta.2", "json5": "^2.2.3", "semver": "^6.3.1" } }, "sha512-RgHBCvtjbOK2gXSNBNIkNoEc9qoVEtau3hj8gEqKQuL3HZAibKarWFEI3Lfm6EYKkLalOh8eSrj9b+ch9H/VBA=="],
+
+    "@babel/generator": ["@babel/generator@7.29.7", "", { "dependencies": { "@babel/parser": "^7.29.7", "@babel/types": "^7.29.7", "@jridgewell/gen-mapping": "^0.3.12", "@jridgewell/trace-mapping": "^0.3.28", "jsesc": "^3.0.2" } }, "sha512-DkXD5OJQaAQIdZ1bt3UZdEnHAn9Imd3IVBdX03UFe+ony9Ojw5pzr9YVKGDY1jt+Gcn/FnGkNf8r+Vj5NOJWtQ=="],
+
+    "@babel/helper-annotate-as-pure": ["@babel/helper-annotate-as-pure@7.29.7", "", { "dependencies": { "@babel/types": "^7.29.7" } }, "sha512-OoK6239jHPuSQOoS0kfTVKn0b/rVTk0seKq4Gd2UMLtmOVLjDC0ki3e+c90Trqv2gMfvJFqkiljrr568+qddiw=="],
+
+    "@babel/helper-compilation-targets": ["@babel/helper-compilation-targets@7.29.7", "", { "dependencies": { "@babel/compat-data": "^7.29.7", "@babel/helper-validator-option": "^7.29.7", "browserslist": "^4.24.0", "lru-cache": "^5.1.1", "semver": "^6.3.1" } }, "sha512-wem6WaBj4NaVYVdNhLPPVacES6ZJ+KBBfSkTMD3YZxbP3rm3Di85tJU5ljaUNhaOynt+Aj0xruhYuzQBt8n71g=="],
+
+    "@babel/helper-create-class-features-plugin": ["@babel/helper-create-class-features-plugin@7.29.7", "", { "dependencies": { "@babel/helper-annotate-as-pure": "^7.29.7", "@babel/helper-member-expression-to-functions": "^7.29.7", "@babel/helper-optimise-call-expression": "^7.29.7", "@babel/helper-replace-supers": "^7.29.7", "@babel/helper-skip-transparent-expression-wrappers": "^7.29.7", "@babel/traverse": "^7.29.7", "semver": "^6.3.1" }, "peerDependencies": { "@babel/core": "^7.0.0" } }, "sha512-IY3ZD9Tmooqr3TUhc3DUWxiuo8xx1DWLhd5M7hQ+ZWJamqM2BbalrBJb2MisSLoYorOj75U03qULCxQTY9r3hg=="],
+
+    "@babel/helper-create-regexp-features-plugin": ["@babel/helper-create-regexp-features-plugin@7.29.7", "", { "dependencies": { "@babel/helper-annotate-as-pure": "^7.29.7", "regexpu-core": "^6.3.1", "semver": "^6.3.1" }, "peerDependencies": { "@babel/core": "^7.0.0" } }, "sha512-907Uymvqgg1dwUA+7IGwFAOSYzQOuzPXKNJ1yxzwPffzkYFg2q2eHi1fIOs6sXkG9NbIUMunnUlkYsfRFNvomg=="],
+
+    "@babel/helper-define-polyfill-provider": ["@babel/helper-define-polyfill-provider@0.6.8", "", { "dependencies": { "@babel/helper-compilation-targets": "^7.28.6", "@babel/helper-plugin-utils": "^7.28.6", "debug": "^4.4.3", "lodash.debounce": "^4.0.8", "resolve": "^1.22.11" }, "peerDependencies": { "@babel/core": "^7.4.0 || ^8.0.0-0 <8.0.0" } }, "sha512-47UwBLPpQi1NoWzLuHNjRoHlYXMwIJoBf7MFou6viC/sIHWYygpvr0B6IAyh5sBdA2nr2LPIRww8lfaUVQINBA=="],
+
+    "@babel/helper-globals": ["@babel/helper-globals@7.29.7", "", {}, "sha512-3nQVUAtvkKH9zahfWgw96Jc/uFOmjACE1kQz82E2lqWmHBgjzbNlsC22nuQTfahmWeQtTq5nQ/4Nnd2A1wj4zA=="],
+
+    "@babel/helper-member-expression-to-functions": ["@babel/helper-member-expression-to-functions@7.29.7", "", { "dependencies": { "@babel/traverse": "^7.29.7", "@babel/types": "^7.29.7" } }, "sha512-j+7JYmk1JYDtACIGj0QJqqWZjoUpMoEikQGADMaHgCMCSDqd2+P32rfcibUNrGOMWrlzK1WJBdxrB3JJQZwWtg=="],
+
+    "@babel/helper-module-imports": ["@babel/helper-module-imports@7.29.7", "", { "dependencies": { "@babel/traverse": "^7.29.7", "@babel/types": "^7.29.7" } }, "sha512-ejHwrQQYcm9xnTivShn2IDOlIzInN34AXskvq9QicvCtEzq1Vzclu/tKF8Jq1Cg8JG2GL6/EmjgsCT7lXepE3g=="],
+
+    "@babel/helper-module-transforms": ["@babel/helper-module-transforms@7.29.7", "", { "dependencies": { "@babel/helper-module-imports": "^7.29.7", "@babel/helper-validator-identifier": "^7.29.7", "@babel/traverse": "^7.29.7" }, "peerDependencies": { "@babel/core": "^7.0.0" } }, "sha512-UPUVSyXbOh627KiCIGQSgwWzGeBKLkaJ9PJEdrngIwMSzxLR4jS4+f1f1jb7VzBbg8nFLaYotvVPFCTqdrmTAg=="],
+
+    "@babel/helper-optimise-call-expression": ["@babel/helper-optimise-call-expression@7.29.7", "", { "dependencies": { "@babel/types": "^7.29.7" } }, "sha512-+kmGVjcT9RGYzoDwdwEqEvGgKe3BYq+O1iGzjFubaNgZHwYHP6lsF2Yghf4kEuv9BV7tYDZ913aBW9am6YKong=="],
+
+    "@babel/helper-plugin-utils": ["@babel/helper-plugin-utils@7.29.7", "", {}, "sha512-G7sHYigPY17oO5SYWnfD/0MTBwVR781S/JI643e/JhUYgVgWE/61SoW3NH9KWUKyKq5LVh3npif99Wkt6j86Jw=="],
+
+    "@babel/helper-remap-async-to-generator": ["@babel/helper-remap-async-to-generator@7.29.7", "", { "dependencies": { "@babel/helper-annotate-as-pure": "^7.29.7", "@babel/helper-wrap-function": "^7.29.7", "@babel/traverse": "^7.29.7" }, "peerDependencies": { "@babel/core": "^7.0.0" } }, "sha512-16AMiW26DbXWBbr3B8wNozKM0ydMLB892vaOaJW/fPJdnT8vJk5sdkQcU/isqUxyCE0cEoa8wZOcbgDuC4b6Og=="],
+
+    "@babel/helper-replace-supers": ["@babel/helper-replace-supers@7.29.7", "", { "dependencies": { "@babel/helper-member-expression-to-functions": "^7.29.7", "@babel/helper-optimise-call-expression": "^7.29.7", "@babel/traverse": "^7.29.7" }, "peerDependencies": { "@babel/core": "^7.0.0" } }, "sha512-atfGXWSeCiF4DnKZIfmJfQRkSw9b9gNNXR1kqKjbhG4pGYCOnkp8OcTB8E3NXjBu8NpheSnOeNKz8KT7UNFTmQ=="],
+
+    "@babel/helper-skip-transparent-expression-wrappers": ["@babel/helper-skip-transparent-expression-wrappers@7.29.7", "", { "dependencies": { "@babel/traverse": "^7.29.7", "@babel/types": "^7.29.7" } }, "sha512-brcMGQaVzIeUb+6/bs1Av0f8YuNNjKY2JyvfRCsFuFsdKccEQ5Ges2y74D74NZ1Rz8lKJ9ksJkfqwQFJ/iNEyQ=="],
+
     "@babel/helper-string-parser": ["@babel/helper-string-parser@7.27.1", "", {}, "sha512-qMlSxKbpRlAridDExk92nSobyDdpPijUq2DW6oDnUqd0iOGxmQjyqhMIihI9+zv4LPyZdRje2cavWPbCbWm3eA=="],
 
     "@babel/helper-validator-identifier": ["@babel/helper-validator-identifier@7.28.5", "", {}, "sha512-qSs4ifwzKJSV39ucNjsvc6WVHs6b7S03sOh2OcHF9UHfVPqWWALUsNUVzhSBiItjRZoLHx7nIarVjqKVusUZ1Q=="],
 
+    "@babel/helper-validator-option": ["@babel/helper-validator-option@7.29.7", "", {}, "sha512-N9ZErrD+yW5geCDtBqnOoxmR8+tNKiGuxKlDpuJxfsqpa2dFcexaziGAE/qoHLiDDreVNMupxGmSoNlyvsA3gw=="],
+
+    "@babel/helper-wrap-function": ["@babel/helper-wrap-function@7.29.7", "", { "dependencies": { "@babel/template": "^7.29.7", "@babel/traverse": "^7.29.7", "@babel/types": "^7.29.7" } }, "sha512-iES0Skag9ERIF68aXadpO6dbXa03mNWK3sEqJaMnLNs/eC3l0lkImdfoy6Y09/SfkpawdAB4RjQ7PVA7TcVGdw=="],
+
+    "@babel/helpers": ["@babel/helpers@7.29.7", "", { "dependencies": { "@babel/template": "^7.29.7", "@babel/types": "^7.29.7" } }, "sha512-1k2lAGRMfHTcwuNYcCNUmaUffmQv8KWMfh2iJUUeRlwlwH4FdNG7mfPI10NPfLHJFThE4Tyr4mv7kTNZOiPuBg=="],
+
     "@babel/parser": ["@babel/parser@7.29.3", "", { "dependencies": { "@babel/types": "^7.29.0" }, "bin": "./bin/babel-parser.js" }, "sha512-b3ctpQwp+PROvU/cttc4OYl4MzfJUWy6FZg+PMXfzmt/+39iHVF0sDfqay8TQM3JA2EUOyKcFZt75jWriQijsA=="],
 
+    "@babel/plugin-bugfix-firefox-class-in-computed-class-key": ["@babel/plugin-bugfix-firefox-class-in-computed-class-key@7.29.7", "", { "dependencies": { "@babel/helper-plugin-utils": "^7.29.7", "@babel/traverse": "^7.29.7" }, "peerDependencies": { "@babel/core": "^7.0.0" } }, "sha512-j8SrR0zLZrRsC09DlszEx8FpMiwukKffYXMK0d5LmOglO7vGG6sz/BR/20yHqWH+Lnn31JTt2PE3hIWNgM2J6w=="],
+
+    "@babel/plugin-bugfix-safari-class-field-initializer-scope": ["@babel/plugin-bugfix-safari-class-field-initializer-scope@7.29.7", "", { "dependencies": { "@babel/helper-plugin-utils": "^7.29.7" }, "peerDependencies": { "@babel/core": "^7.0.0" } }, "sha512-r8j8escF+U2FUHo0KOhPUdMzUO+jp9fInva6+ACVAF3Y97Ev+5iNZwiqTghmzNeWwDkOPlYuTcfb1vDaoZKmAQ=="],
+
+    "@babel/plugin-bugfix-safari-id-destructuring-collision-in-function-expression": ["@babel/plugin-bugfix-safari-id-destructuring-collision-in-function-expression@7.29.7", "", { "dependencies": { "@babel/helper-plugin-utils": "^7.29.7" }, "peerDependencies": { "@babel/core": "^7.0.0" } }, "sha512-GE1TFSiuFeGsCxmYXZl8HwoPrVlwe4rHPFE8weieGKZqnDORK+Ar3vgWMgW+AOxQ6/2TgLSKx9p6W7O4rC6qgQ=="],
+
+    "@babel/plugin-bugfix-safari-rest-destructuring-rhs-array": ["@babel/plugin-bugfix-safari-rest-destructuring-rhs-array@7.29.7", "", { "dependencies": { "@babel/helper-plugin-utils": "^7.29.7", "@babel/helper-skip-transparent-expression-wrappers": "^7.29.7" }, "peerDependencies": { "@babel/core": "^7.0.0" } }, "sha512-oBNVCvnO5tND+xSopWvV8WNGfpTfgP4Zr/YXXSj8zfmcPktp5Ku/aZlsIowgSD4fjmgHn6sGmB9APVsU5zOdhA=="],
+
+    "@babel/plugin-bugfix-v8-spread-parameters-in-optional-chaining": ["@babel/plugin-bugfix-v8-spread-parameters-in-optional-chaining@7.29.7", "", { "dependencies": { "@babel/helper-plugin-utils": "^7.29.7", "@babel/helper-skip-transparent-expression-wrappers": "^7.29.7", "@babel/plugin-transform-optional-chaining": "^7.29.7" }, "peerDependencies": { "@babel/core": "^7.13.0" } }, "sha512-QQt9qKHZ2sg/kivaLr7lnQr8HVrQDdBNSfCsTjiDxRuX/K5ORyKq+Bu8Xr0cDE3Dfkv0cw28Ve0EKyKMvulkOw=="],
+
+    "@babel/plugin-bugfix-v8-static-class-fields-redefine-readonly": ["@babel/plugin-bugfix-v8-static-class-fields-redefine-readonly@7.29.7", "", { "dependencies": { "@babel/helper-plugin-utils": "^7.29.7", "@babel/traverse": "^7.29.7" }, "peerDependencies": { "@babel/core": "^7.0.0" } }, "sha512-pn6QacGLgvCcwc+syUhKE/qSjV2D1IHDB84RNxWYSt1mW3K/SCtjinZ2p0cETJxAWBjPy3K/1lHwG5BjjPxNlw=="],
+
+    "@babel/plugin-proposal-private-property-in-object": ["@babel/plugin-proposal-private-property-in-object@7.21.0-placeholder-for-preset-env.2", "", { "peerDependencies": { "@babel/core": "^7.0.0-0" } }, "sha512-SOSkfJDddaM7mak6cPEpswyTRnuRltl429hMraQEglW+OkovnCzsiszTmsrlY//qLFjCpQDFRvjdm2wA5pPm9w=="],
+
+    "@babel/plugin-syntax-import-assertions": ["@babel/plugin-syntax-import-assertions@7.29.7", "", { "dependencies": { "@babel/helper-plugin-utils": "^7.29.7" }, "peerDependencies": { "@babel/core": "^7.0.0-0" } }, "sha512-/An1OCBN93thpBAGyfsK2pcf0jvju1SAtKkL2Ny++B5Sy6sqgzXDQH1cZxWbF96Wuk+bn41MDA9bLd4VVAw6rw=="],
+
+    "@babel/plugin-syntax-import-attributes": ["@babel/plugin-syntax-import-attributes@7.29.7", "", { "dependencies": { "@babel/helper-plugin-utils": "^7.29.7" }, "peerDependencies": { "@babel/core": "^7.0.0-0" } }, "sha512-zGYcYfq/WmZ4V+kBIXQon9dSSc8ircGZqw9ZaNhhGj9nZkeBu1jHLBDQqYYi5WA9uawvA2sIMbry2nCFhf5Djg=="],
+
+    "@babel/plugin-syntax-unicode-sets-regex": ["@babel/plugin-syntax-unicode-sets-regex@7.18.6", "", { "dependencies": { "@babel/helper-create-regexp-features-plugin": "^7.18.6", "@babel/helper-plugin-utils": "^7.18.6" }, "peerDependencies": { "@babel/core": "^7.0.0" } }, "sha512-727YkEAPwSIQTv5im8QHz3upqp92JTWhidIC81Tdx4VJYIte/VndKf1qKrfnnhPLiPghStWfvC/iFaMCQu7Nqg=="],
+
+    "@babel/plugin-transform-arrow-functions": ["@babel/plugin-transform-arrow-functions@7.29.7", "", { "dependencies": { "@babel/helper-plugin-utils": "^7.29.7" }, "peerDependencies": { "@babel/core": "^7.0.0-0" } }, "sha512-N7zArUXWzAMzm+/N0uPBeVB3Fam5lMxtUwMmDK5f/IBBS7a7p1qeUoxd/6CckXoxUdgsntq1Dh8xNW06maZbDQ=="],
+
+    "@babel/plugin-transform-async-generator-functions": ["@babel/plugin-transform-async-generator-functions@7.29.7", "", { "dependencies": { "@babel/helper-plugin-utils": "^7.29.7", "@babel/helper-remap-async-to-generator": "^7.29.7", "@babel/traverse": "^7.29.7" }, "peerDependencies": { "@babel/core": "^7.0.0-0" } }, "sha512-d98gXZkgswvkyohMBABkhm3GeXhYj8psWfwQ2C7gtfrKGTykQa/iOIi+JJhwMjPlZ6Vm2XN+DCf3Es1EoG4ZLA=="],
+
+    "@babel/plugin-transform-async-to-generator": ["@babel/plugin-transform-async-to-generator@7.29.7", "", { "dependencies": { "@babel/helper-module-imports": "^7.29.7", "@babel/helper-plugin-utils": "^7.29.7", "@babel/helper-remap-async-to-generator": "^7.29.7" }, "peerDependencies": { "@babel/core": "^7.0.0-0" } }, "sha512-pcUb2SS+RMo9TWVBwKGI5ShtoG7R+zBsFmCKDa6fe8c+hPr3XJlZgoE5j6i8W7gDjhyvy+85vmYexanvXh3d1w=="],
+
+    "@babel/plugin-transform-block-scoped-functions": ["@babel/plugin-transform-block-scoped-functions@7.29.7", "", { "dependencies": { "@babel/helper-plugin-utils": "^7.29.7" }, "peerDependencies": { "@babel/core": "^7.0.0-0" } }, "sha512-cUSmjh72N+rN4PrkFlN1dJwNCwjVp5d38/CQrEsFggkD10UiFlBFgdH3tv5dNsLuHY+3S8db2xCHjhZcv5WgvA=="],
+
+    "@babel/plugin-transform-block-scoping": ["@babel/plugin-transform-block-scoping@7.29.7", "", { "dependencies": { "@babel/helper-plugin-utils": "^7.29.7" }, "peerDependencies": { "@babel/core": "^7.0.0-0" } }, "sha512-ONyr4+AZhKh8yKWInVxU9AXA9EbsyeLcL6V0dJy6M2/62vuvpGm29zzuymbTpdc451GEpDIdAyPLP3r+P61yKQ=="],
+
+    "@babel/plugin-transform-class-properties": ["@babel/plugin-transform-class-properties@7.29.7", "", { "dependencies": { "@babel/helper-create-class-features-plugin": "^7.29.7", "@babel/helper-plugin-utils": "^7.29.7" }, "peerDependencies": { "@babel/core": "^7.0.0-0" } }, "sha512-GtcpjFvanPfzNQi3eTitsCqtRRmmqzpy/A+yhTR1HaZo1Ly3EA8ZXxlPyHdR8/IuRMYc3E4wdGBewB2QKQjAaA=="],
+
+    "@babel/plugin-transform-class-static-block": ["@babel/plugin-transform-class-static-block@7.29.7", "", { "dependencies": { "@babel/helper-create-class-features-plugin": "^7.29.7", "@babel/helper-plugin-utils": "^7.29.7" }, "peerDependencies": { "@babel/core": "^7.12.0" } }, "sha512-kibJgmEdX2iMwsHY2tSZNDgj8PwIlCQz7FK9KuGKO8zsuoUwSEhoNnNVp/emKWrbY4HeO6kkXfdMqRKKKXBm2A=="],
+
+    "@babel/plugin-transform-classes": ["@babel/plugin-transform-classes@7.29.7", "", { "dependencies": { "@babel/helper-annotate-as-pure": "^7.29.7", "@babel/helper-compilation-targets": "^7.29.7", "@babel/helper-globals": "^7.29.7", "@babel/helper-plugin-utils": "^7.29.7", "@babel/helper-replace-supers": "^7.29.7", "@babel/traverse": "^7.29.7" }, "peerDependencies": { "@babel/core": "^7.0.0-0" } }, "sha512-qV0OGGBVacduzQHE649JyCneOFI/maT+YKsO+K4Yi3xv2wTPNjM/W2o2gdzMwEAZz7fXNTHAe0NcSg30bIN69g=="],
+
+    "@babel/plugin-transform-computed-properties": ["@babel/plugin-transform-computed-properties@7.29.7", "", { "dependencies": { "@babel/helper-plugin-utils": "^7.29.7", "@babel/template": "^7.29.7" }, "peerDependencies": { "@babel/core": "^7.0.0-0" } }, "sha512-RK7/IyU5phpuCdBAuig5VkzG/EnbDaui5SQGdU9BFrHdV+mV4cUjLMQ9lJDjLNtWHsqtiefpGZUXQP2BiTYMsA=="],
+
+    "@babel/plugin-transform-destructuring": ["@babel/plugin-transform-destructuring@7.29.7", "", { "dependencies": { "@babel/helper-plugin-utils": "^7.29.7", "@babel/traverse": "^7.29.7" }, "peerDependencies": { "@babel/core": "^7.0.0-0" } }, "sha512-iPX8aD6H9zV5s7ZsqTdNocPN/MGQ5sSMnElKrktxjJRMnB2jN/1p2+R7GkfD6CAYoVFqy5A4XnSIUeGgJzIWpg=="],
+
+    "@babel/plugin-transform-dotall-regex": ["@babel/plugin-transform-dotall-regex@7.29.7", "", { "dependencies": { "@babel/helper-create-regexp-features-plugin": "^7.29.7", "@babel/helper-plugin-utils": "^7.29.7" }, "peerDependencies": { "@babel/core": "^7.0.0-0" } }, "sha512-3qc18hsD2RdZiyJNDNc7HQpv6xbncwh8FYtxNFFzclSyh/trPD9KkVR9BDECUjDLvb7yJVF15GfYUuC+LMkkiQ=="],
+
+    "@babel/plugin-transform-duplicate-keys": ["@babel/plugin-transform-duplicate-keys@7.29.7", "", { "dependencies": { "@babel/helper-plugin-utils": "^7.29.7" }, "peerDependencies": { "@babel/core": "^7.0.0-0" } }, "sha512-6IvRRriEMqnBwD6chtxdLpMYCHWEzN+oL5cyQtjykya19UgzbmKhxmhZgKC/LHxS2nYr9Q/qYPZ5Lr6jOL9+yQ=="],
+
+    "@babel/plugin-transform-duplicate-named-capturing-groups-regex": ["@babel/plugin-transform-duplicate-named-capturing-groups-regex@7.29.7", "", { "dependencies": { "@babel/helper-create-regexp-features-plugin": "^7.29.7", "@babel/helper-plugin-utils": "^7.29.7" }, "peerDependencies": { "@babel/core": "^7.0.0" } }, "sha512-2wiIyo2BjtgU7HufSeDnL9L2O7zr8jmhFKuSr65VpRkUiRKRNpb0mdlk56+XPPKoIrfHqzbMuglDvZun0RISsA=="],
+
+    "@babel/plugin-transform-dynamic-import": ["@babel/plugin-transform-dynamic-import@7.29.7", "", { "dependencies": { "@babel/helper-plugin-utils": "^7.29.7" }, "peerDependencies": { "@babel/core": "^7.0.0-0" } }, "sha512-giOlEm/EFjfjr+te9NsdjkUo2v4f8rS/SXPumRVHAtbNcyNlvtREkU1dZzaIDclNpnaVhlCqRdFKhJBjBikzLg=="],
+
+    "@babel/plugin-transform-explicit-resource-management": ["@babel/plugin-transform-explicit-resource-management@7.29.7", "", { "dependencies": { "@babel/helper-plugin-utils": "^7.29.7", "@babel/plugin-transform-destructuring": "^7.29.7" }, "peerDependencies": { "@babel/core": "^7.0.0-0" } }, "sha512-Rstj7coNz8sE+7Ju7ihpHLI564lsK5pUpNNlvptCIC/16E/S5hbl6n3kESPKdNRmqEWlpn5xpS5Q2dvXBsySLw=="],
+
+    "@babel/plugin-transform-exponentiation-operator": ["@babel/plugin-transform-exponentiation-operator@7.29.7", "", { "dependencies": { "@babel/helper-plugin-utils": "^7.29.7" }, "peerDependencies": { "@babel/core": "^7.0.0-0" } }, "sha512-zFpMOTLZBdW5LfObqcSbL6kefg4R4eLdmvS0wbN9M6D5Mym/sKm9toOoWyVOa+xDjvCnuWcHls2YonXwHvH3CQ=="],
+
+    "@babel/plugin-transform-export-namespace-from": ["@babel/plugin-transform-export-namespace-from@7.29.7", "", { "dependencies": { "@babel/helper-plugin-utils": "^7.29.7" }, "peerDependencies": { "@babel/core": "^7.0.0-0" } }, "sha512-24B2nOy2TeJSMheqwPD4DDQOV/elLSIlKxjZt4i05H5AgdPdWR3n18HnNrcJ+j76WJd9gbwb9jPjNYUy6RautA=="],
+
+    "@babel/plugin-transform-for-of": ["@babel/plugin-transform-for-of@7.29.7", "", { "dependencies": { "@babel/helper-plugin-utils": "^7.29.7", "@babel/helper-skip-transparent-expression-wrappers": "^7.29.7" }, "peerDependencies": { "@babel/core": "^7.0.0-0" } }, "sha512-zeSIHh0+E1Um1WJRXCFlHQYu2ieJNdivLLjlBEp+dIBu3S51n+SZZmIXjxnItw6pz56Cn+KvK68BIBVsxq2JiQ=="],
+
+    "@babel/plugin-transform-function-name": ["@babel/plugin-transform-function-name@7.29.7", "", { "dependencies": { "@babel/helper-compilation-targets": "^7.29.7", "@babel/helper-plugin-utils": "^7.29.7", "@babel/traverse": "^7.29.7" }, "peerDependencies": { "@babel/core": "^7.0.0-0" } }, "sha512-otRWaHXE6fbAGkePvaj/kvs3HsqXfPhlnzwSOlnFgbqCPMd975dW+4wZ00WFBt+/YlBGcJwNrARQTOJOb4ZrIg=="],
+
+    "@babel/plugin-transform-json-strings": ["@babel/plugin-transform-json-strings@7.29.7", "", { "dependencies": { "@babel/helper-plugin-utils": "^7.29.7" }, "peerDependencies": { "@babel/core": "^7.0.0-0" } }, "sha512-RRnE2+eon1rJAq8MnoF1b5kTpY1vU88twHcvcKMrsqP/jxIRqDVs9iJB5fqPuqyeFAW0wJo4MlUIPpQCq/aRsg=="],
+
+    "@babel/plugin-transform-literals": ["@babel/plugin-transform-literals@7.29.7", "", { "dependencies": { "@babel/helper-plugin-utils": "^7.29.7" }, "peerDependencies": { "@babel/core": "^7.0.0-0" } }, "sha512-DZ/oLP21ZuWx1vKqnoNv6/tvEK48AQOBRai40CX9dTjGluvT/YZCyY3rryDtyUqCEoyNroy5KKPwX2iQCiRvyw=="],
+
+    "@babel/plugin-transform-logical-assignment-operators": ["@babel/plugin-transform-logical-assignment-operators@7.29.7", "", { "dependencies": { "@babel/helper-plugin-utils": "^7.29.7" }, "peerDependencies": { "@babel/core": "^7.0.0-0" } }, "sha512-A0H91hh6W8MFRkp5TqJmMr39jzGD1A1E1Ysiv2O06Sfbhkapm+XyIzxWCEh5kqwOZ1/8QZ0dY3SeQ7XBqfJd5Q=="],
+
+    "@babel/plugin-transform-member-expression-literals": ["@babel/plugin-transform-member-expression-literals@7.29.7", "", { "dependencies": { "@babel/helper-plugin-utils": "^7.29.7" }, "peerDependencies": { "@babel/core": "^7.0.0-0" } }, "sha512-hl1kwFZCCiDyfH25Xmco9jTrkPgnS9pmOzSG7W5I4SaGbLeqKv417hcU2RKmaxoPEgsoJh7ZPOrnPGq99bHoUg=="],
+
+    "@babel/plugin-transform-modules-amd": ["@babel/plugin-transform-modules-amd@7.29.7", "", { "dependencies": { "@babel/helper-module-transforms": "^7.29.7", "@babel/helper-plugin-utils": "^7.29.7" }, "peerDependencies": { "@babel/core": "^7.0.0-0" } }, "sha512-fxtQoH3m5ywUSIfaH0FGCzWu4McsYon5bD3K4XnskC7f+OyQMj7rsOMi4NvvmJ83WwBAg4UCe+ov4VZlqEvyew=="],
+
+    "@babel/plugin-transform-modules-commonjs": ["@babel/plugin-transform-modules-commonjs@7.29.7", "", { "dependencies": { "@babel/helper-module-transforms": "^7.29.7", "@babel/helper-plugin-utils": "^7.29.7" }, "peerDependencies": { "@babel/core": "^7.0.0-0" } }, "sha512-j0vCldybPC5b5dwCQOJ21uKtHzt7hxLygJTg9eF1ScfaikEDNfzn94XoW5Fi+seBR0nCyL23xaBFFkq7dTM8XQ=="],
+
+    "@babel/plugin-transform-modules-systemjs": ["@babel/plugin-transform-modules-systemjs@7.29.7", "", { "dependencies": { "@babel/helper-module-transforms": "^7.29.7", "@babel/helper-plugin-utils": "^7.29.7", "@babel/helper-validator-identifier": "^7.29.7", "@babel/traverse": "^7.29.7" }, "peerDependencies": { "@babel/core": "^7.0.0-0" } }, "sha512-TM2ZcQLoG2/y4HODiStCo10DibYhWhGWAwVv+EQKmG/7GFl0N+AAmUiXOMKM+aiJ9XBJ9AHVZBvTzMnJ2sM3cQ=="],
+
+    "@babel/plugin-transform-modules-umd": ["@babel/plugin-transform-modules-umd@7.29.7", "", { "dependencies": { "@babel/helper-module-transforms": "^7.29.7", "@babel/helper-plugin-utils": "^7.29.7" }, "peerDependencies": { "@babel/core": "^7.0.0-0" } }, "sha512-B4UkaTK3QpgCwJnrxKfMPKdo92CN7OKXAlpAAnM3UPu0Q0lCCk57ylA9AJbRy2v8dDKOPAAWcoR6CMyeoHwRCA=="],
+
+    "@babel/plugin-transform-named-capturing-groups-regex": ["@babel/plugin-transform-named-capturing-groups-regex@7.29.7", "", { "dependencies": { "@babel/helper-create-regexp-features-plugin": "^7.29.7", "@babel/helper-plugin-utils": "^7.29.7" }, "peerDependencies": { "@babel/core": "^7.0.0" } }, "sha512-vuFoLwr4qnv2xbZ16SQd6uPcH5FNrLHhk/Jzo++0XJFcaDsr4gjJVg6j398oMHiC+83k/GiBzviwF5KBJkPUtQ=="],
+
+    "@babel/plugin-transform-new-target": ["@babel/plugin-transform-new-target@7.29.7", "", { "dependencies": { "@babel/helper-plugin-utils": "^7.29.7" }, "peerDependencies": { "@babel/core": "^7.0.0-0" } }, "sha512-fEo41GmsOUhOBlw8ioo6zvjX5Xc2Lqkzlyfqbpsk3eB6TReV18uhxZ0esfEokVbY2+PVJAQHNKxER6lGrzNd3A=="],
+
+    "@babel/plugin-transform-nullish-coalescing-operator": ["@babel/plugin-transform-nullish-coalescing-operator@7.29.7", "", { "dependencies": { "@babel/helper-plugin-utils": "^7.29.7" }, "peerDependencies": { "@babel/core": "^7.0.0-0" } }, "sha512-idmp1dFaekP9GbcMvG24Kvw2BfhFZjHnNJCkV4WuIY4PskJzwI3f1N5OdgYke38T7rftO6ERulFRn2cFeZwRkg=="],
+
+    "@babel/plugin-transform-numeric-separator": ["@babel/plugin-transform-numeric-separator@7.29.7", "", { "dependencies": { "@babel/helper-plugin-utils": "^7.29.7" }, "peerDependencies": { "@babel/core": "^7.0.0-0" } }, "sha512-zR7fv/z14OjgHl4AgRtkDBvBMhIzCxqV/qN/2BCRC7LjFwvuzjYe7gDWxC4Wl/SNsLM6SE1IWvRPYMgSJaUvNw=="],
+
+    "@babel/plugin-transform-object-rest-spread": ["@babel/plugin-transform-object-rest-spread@7.29.7", "", { "dependencies": { "@babel/helper-compilation-targets": "^7.29.7", "@babel/helper-plugin-utils": "^7.29.7", "@babel/plugin-transform-destructuring": "^7.29.7", "@babel/plugin-transform-parameters": "^7.29.7", "@babel/traverse": "^7.29.7" }, "peerDependencies": { "@babel/core": "^7.0.0-0" } }, "sha512-Ld98jn4c0smUywL57m7SgsHq3OpThOa6LqZJif3G6jYOovPleoFhVrBJ1WegRApSFB2wu4+RelAj9AC9G08Z4A=="],
+
+    "@babel/plugin-transform-object-super": ["@babel/plugin-transform-object-super@7.29.7", "", { "dependencies": { "@babel/helper-plugin-utils": "^7.29.7", "@babel/helper-replace-supers": "^7.29.7" }, "peerDependencies": { "@babel/core": "^7.0.0-0" } }, "sha512-Ea/diGcw0twB5IlZPO5sgET6fJsLJqPABqTuFWIR+iMPGPZJkATEIWx0wa+aEQ5UY1CBQyP/gkAiLEqn1vBiQA=="],
+
+    "@babel/plugin-transform-optional-catch-binding": ["@babel/plugin-transform-optional-catch-binding@7.29.7", "", { "dependencies": { "@babel/helper-plugin-utils": "^7.29.7" }, "peerDependencies": { "@babel/core": "^7.0.0-0" } }, "sha512-sLsyndxK2VwX6yNUOakMb7Sh553ZTe/vVM1XJ+9Z5aW1ytsc8xOIwmyk05NNjN60vkc5/KqoTH6hB4V41LJhng=="],
+
+    "@babel/plugin-transform-optional-chaining": ["@babel/plugin-transform-optional-chaining@7.29.7", "", { "dependencies": { "@babel/helper-plugin-utils": "^7.29.7", "@babel/helper-skip-transparent-expression-wrappers": "^7.29.7" }, "peerDependencies": { "@babel/core": "^7.0.0-0" } }, "sha512-6GM1dhvK3gNODkXcEcMCOLEDCLSoZ/sBbro2Ax8HURyasQ4NshagQixkRFdh5niI6E4gmA/jYI/4aT7rRos3ZQ=="],
+
+    "@babel/plugin-transform-parameters": ["@babel/plugin-transform-parameters@7.29.7", "", { "dependencies": { "@babel/helper-plugin-utils": "^7.29.7" }, "peerDependencies": { "@babel/core": "^7.0.0-0" } }, "sha512-ZDOBqV/qLYJI0YElr8DcENEyARsFQeESqWXH6gZlghYXuPPjvweuDhP4VyEi4BlUBlLRFZVjxoZDMjxhLW766g=="],
+
+    "@babel/plugin-transform-private-methods": ["@babel/plugin-transform-private-methods@7.29.7", "", { "dependencies": { "@babel/helper-create-class-features-plugin": "^7.29.7", "@babel/helper-plugin-utils": "^7.29.7" }, "peerDependencies": { "@babel/core": "^7.0.0-0" } }, "sha512-/6Rz4DK1ETDEM/bWHsPHcaEe7ZaT1EqSXjtSP/L0DijOYuaUhiRiOKcwpZ8P7zR4xXEHc2ITdiCgBm9Tpyv9ug=="],
+
+    "@babel/plugin-transform-private-property-in-object": ["@babel/plugin-transform-private-property-in-object@7.29.7", "", { "dependencies": { "@babel/helper-annotate-as-pure": "^7.29.7", "@babel/helper-create-class-features-plugin": "^7.29.7", "@babel/helper-plugin-utils": "^7.29.7" }, "peerDependencies": { "@babel/core": "^7.0.0-0" } }, "sha512-+BNo06dnrzdNNqCm1X6YUaVv0DKk8Q+JYcoZfOkLhYWNCXzlwTSRq8zGWayT1csjcpNXV9CQTBRRbmTLZac5cA=="],
+
+    "@babel/plugin-transform-property-literals": ["@babel/plugin-transform-property-literals@7.29.7", "", { "dependencies": { "@babel/helper-plugin-utils": "^7.29.7" }, "peerDependencies": { "@babel/core": "^7.0.0-0" } }, "sha512-bOMRLQuI0A5ZqHq3OWJ89/rXpJ/NJrbVhXiP4zwPGMs6kpcVsuTUNjwoE30K0Qm3mf48a/TnRYYD6vPNqcg6jA=="],
+
+    "@babel/plugin-transform-regenerator": ["@babel/plugin-transform-regenerator@7.29.7", "", { "dependencies": { "@babel/helper-plugin-utils": "^7.29.7" }, "peerDependencies": { "@babel/core": "^7.0.0-0" } }, "sha512-rNNFV0DBAJp988xW2DOntfDoYn1eR8GGF5AT5vYc+rjyfaQkM242c9tZUHHPe7KYaiJizXPWhQTzzdbXySyhBw=="],
+
+    "@babel/plugin-transform-regexp-modifiers": ["@babel/plugin-transform-regexp-modifiers@7.29.7", "", { "dependencies": { "@babel/helper-create-regexp-features-plugin": "^7.29.7", "@babel/helper-plugin-utils": "^7.29.7" }, "peerDependencies": { "@babel/core": "^7.0.0" } }, "sha512-mB5Fs0VWrJ42ZCmc8114v60qetdaUVNkj9PmSZRmanCZM3S9hm0CFRLjRmYIsuXav14l2jvZ+4T8iiCGnhj3nQ=="],
+
+    "@babel/plugin-transform-reserved-words": ["@babel/plugin-transform-reserved-words@7.29.7", "", { "dependencies": { "@babel/helper-plugin-utils": "^7.29.7" }, "peerDependencies": { "@babel/core": "^7.0.0-0" } }, "sha512-5+YhdpVgmfSmwZyLMftfaiffLRMHjzIRHFHHLdibcSyJm2pasMrKHrO3Ptrt2DRshjvpgjEJJ1zVW14WPq/6QA=="],
+
+    "@babel/plugin-transform-shorthand-properties": ["@babel/plugin-transform-shorthand-properties@7.29.7", "", { "dependencies": { "@babel/helper-plugin-utils": "^7.29.7" }, "peerDependencies": { "@babel/core": "^7.0.0-0" } }, "sha512-I+WYbGBAiCn7nA6xBrlgPH+MB7HWb4u8pv5S0Pv7OtwNvIFvCCb24YlttKEeUFVurfBCEaOTnuhlqsb7f0Z5Dg=="],
+
+    "@babel/plugin-transform-spread": ["@babel/plugin-transform-spread@7.29.7", "", { "dependencies": { "@babel/helper-plugin-utils": "^7.29.7", "@babel/helper-skip-transparent-expression-wrappers": "^7.29.7" }, "peerDependencies": { "@babel/core": "^7.0.0-0" } }, "sha512-/u5K1QWada7tbYNqTjMh96718g9NTwh9tfPJMsSmVsQwGT447FskV+KcfeXkXq2GWki4EM/MuTdmBec+hOuVTQ=="],
+
+    "@babel/plugin-transform-sticky-regex": ["@babel/plugin-transform-sticky-regex@7.29.7", "", { "dependencies": { "@babel/helper-plugin-utils": "^7.29.7" }, "peerDependencies": { "@babel/core": "^7.0.0-0" } }, "sha512-BCHzNYJGe9l7EpwwDBN/ztlL2NYFFq8hp9ddjtUEM9f2O7S7kKV/lL6Fwo7IF7NSkYhPK2vO+86nIGltA90MsA=="],
+
+    "@babel/plugin-transform-template-literals": ["@babel/plugin-transform-template-literals@7.29.7", "", { "dependencies": { "@babel/helper-plugin-utils": "^7.29.7" }, "peerDependencies": { "@babel/core": "^7.0.0-0" } }, "sha512-NCSEJ4sLFU2gqAub45HYh4fus2yQ36rr6ei6vpU7NdoJqCpxvEG8E6eJpscGyXP3VHD2Ny+fSXr04k1hoUrFqA=="],
+
+    "@babel/plugin-transform-typeof-symbol": ["@babel/plugin-transform-typeof-symbol@7.29.7", "", { "dependencies": { "@babel/helper-plugin-utils": "^7.29.7" }, "peerDependencies": { "@babel/core": "^7.0.0-0" } }, "sha512-223mNGoTkBiTEWFoK+Q6Go3tueMRclO8vxxxxquNCYuNI4jWOofFKJRRDu6SDrB8Sgo1UEGW9T4GAQ8ZyRso1A=="],
+
+    "@babel/plugin-transform-unicode-escapes": ["@babel/plugin-transform-unicode-escapes@7.29.7", "", { "dependencies": { "@babel/helper-plugin-utils": "^7.29.7" }, "peerDependencies": { "@babel/core": "^7.0.0-0" } }, "sha512-jCfXxSjf94lf4E0hKE0AByxF6F3/pVFqRdUUNkDJhsY0m1ZKjnN6ZYyMeHNpzflxb/0q5b7t3p+BE+SLF1WOtA=="],
+
+    "@babel/plugin-transform-unicode-property-regex": ["@babel/plugin-transform-unicode-property-regex@7.29.7", "", { "dependencies": { "@babel/helper-create-regexp-features-plugin": "^7.29.7", "@babel/helper-plugin-utils": "^7.29.7" }, "peerDependencies": { "@babel/core": "^7.0.0-0" } }, "sha512-OgZ+zoAJgZLUCunsTRQ5LAjOywDv5zzZ2/hQ5aMw1pGXyY2rtE8/chXYUmu3AlVHKpm10KEdG9aMwbI/K76ZGw=="],
+
+    "@babel/plugin-transform-unicode-regex": ["@babel/plugin-transform-unicode-regex@7.29.7", "", { "dependencies": { "@babel/helper-create-regexp-features-plugin": "^7.29.7", "@babel/helper-plugin-utils": "^7.29.7" }, "peerDependencies": { "@babel/core": "^7.0.0-0" } }, "sha512-7D/x/23/d/3VqZ0QA+LGbZMlGwZjztBygSWWWsfTPoQ1oQ6Q1P6Mr3d0kk42XabyUVw+fha3LqdRsFqeKqvCyA=="],
+
+    "@babel/plugin-transform-unicode-sets-regex": ["@babel/plugin-transform-unicode-sets-regex@7.29.7", "", { "dependencies": { "@babel/helper-create-regexp-features-plugin": "^7.29.7", "@babel/helper-plugin-utils": "^7.29.7" }, "peerDependencies": { "@babel/core": "^7.0.0" } }, "sha512-BLOhLht9DOJwIxlmp91wHvkXv1lguuHS3/FwUO8HL1H0u8s4hR1gASVFyilu9iGtcTRYqjTZmlsFFeQletntEg=="],
+
+    "@babel/preset-env": ["@babel/preset-env@7.29.7", "", { "dependencies": { "@babel/compat-data": "^7.29.7", "@babel/helper-compilation-targets": "^7.29.7", "@babel/helper-plugin-utils": "^7.29.7", "@babel/helper-validator-option": "^7.29.7", "@babel/plugin-bugfix-firefox-class-in-computed-class-key": "^7.29.7", "@babel/plugin-bugfix-safari-class-field-initializer-scope": "^7.29.7", "@babel/plugin-bugfix-safari-id-destructuring-collision-in-function-expression": "^7.29.7", "@babel/plugin-bugfix-safari-rest-destructuring-rhs-array": "^7.29.7", "@babel/plugin-bugfix-v8-spread-parameters-in-optional-chaining": "^7.29.7", "@babel/plugin-bugfix-v8-static-class-fields-redefine-readonly": "^7.29.7", "@babel/plugin-proposal-private-property-in-object": "7.21.0-placeholder-for-preset-env.2", "@babel/plugin-syntax-import-assertions": "^7.29.7", "@babel/plugin-syntax-import-attributes": "^7.29.7", "@babel/plugin-syntax-unicode-sets-regex": "^7.18.6", "@babel/plugin-transform-arrow-functions": "^7.29.7", "@babel/plugin-transform-async-generator-functions": "^7.29.7", "@babel/plugin-transform-async-to-generator": "^7.29.7", "@babel/plugin-transform-block-scoped-functions": "^7.29.7", "@babel/plugin-transform-block-scoping": "^7.29.7", "@babel/plugin-transform-class-properties": "^7.29.7", "@babel/plugin-transform-class-static-block": "^7.29.7", "@babel/plugin-transform-classes": "^7.29.7", "@babel/plugin-transform-computed-properties": "^7.29.7", "@babel/plugin-transform-destructuring": "^7.29.7", "@babel/plugin-transform-dotall-regex": "^7.29.7", "@babel/plugin-transform-duplicate-keys": "^7.29.7", "@babel/plugin-transform-duplicate-named-capturing-groups-regex": "^7.29.7", "@babel/plugin-transform-dynamic-import": "^7.29.7", "@babel/plugin-transform-explicit-resource-management": "^7.29.7", "@babel/plugin-transform-exponentiation-operator": "^7.29.7", "@babel/plugin-transform-export-namespace-from": "^7.29.7", "@babel/plugin-transform-for-of": "^7.29.7", "@babel/plugin-transform-function-name": "^7.29.7", "@babel/plugin-transform-json-strings": "^7.29.7", "@babel/plugin-transform-literals": "^7.29.7", "@babel/plugin-transform-logical-assignment-operators": "^7.29.7", "@babel/plugin-transform-member-expression-literals": "^7.29.7", "@babel/plugin-transform-modules-amd": "^7.29.7", "@babel/plugin-transform-modules-commonjs": "^7.29.7", "@babel/plugin-transform-modules-systemjs": "^7.29.7", "@babel/plugin-transform-modules-umd": "^7.29.7", "@babel/plugin-transform-named-capturing-groups-regex": "^7.29.7", "@babel/plugin-transform-new-target": "^7.29.7", "@babel/plugin-transform-nullish-coalescing-operator": "^7.29.7", "@babel/plugin-transform-numeric-separator": "^7.29.7", "@babel/plugin-transform-object-rest-spread": "^7.29.7", "@babel/plugin-transform-object-super": "^7.29.7", "@babel/plugin-transform-optional-catch-binding": "^7.29.7", "@babel/plugin-transform-optional-chaining": "^7.29.7", "@babel/plugin-transform-parameters": "^7.29.7", "@babel/plugin-transform-private-methods": "^7.29.7", "@babel/plugin-transform-private-property-in-object": "^7.29.7", "@babel/plugin-transform-property-literals": "^7.29.7", "@babel/plugin-transform-regenerator": "^7.29.7", "@babel/plugin-transform-regexp-modifiers": "^7.29.7", "@babel/plugin-transform-reserved-words": "^7.29.7", "@babel/plugin-transform-shorthand-properties": "^7.29.7", "@babel/plugin-transform-spread": "^7.29.7", "@babel/plugin-transform-sticky-regex": "^7.29.7", "@babel/plugin-transform-template-literals": "^7.29.7", "@babel/plugin-transform-typeof-symbol": "^7.29.7", "@babel/plugin-transform-unicode-escapes": "^7.29.7", "@babel/plugin-transform-unicode-property-regex": "^7.29.7", "@babel/plugin-transform-unicode-regex": "^7.29.7", "@babel/plugin-transform-unicode-sets-regex": "^7.29.7", "@babel/preset-modules": "0.1.6-no-external-plugins", "babel-plugin-polyfill-corejs2": "^0.4.15", "babel-plugin-polyfill-corejs3": "^0.14.0", "babel-plugin-polyfill-regenerator": "^0.6.6", "core-js-compat": "^3.48.0", "semver": "^6.3.1" }, "peerDependencies": { "@babel/core": "^7.0.0-0" } }, "sha512-GYzX36n1nsciIb0uyH0GHwxwtNwPQIcpxSeiVLDtG/B7jB5xXgchnmL1f/jCX5o+pwnaDBtO60ONSJhEBJfxYA=="],
+
+    "@babel/preset-modules": ["@babel/preset-modules@0.1.6-no-external-plugins", "", { "dependencies": { "@babel/helper-plugin-utils": "^7.0.0", "@babel/types": "^7.4.4", "esutils": "^2.0.2" }, "peerDependencies": { "@babel/core": "^7.0.0-0 || ^8.0.0-0 <8.0.0" } }, "sha512-HrcgcIESLm9aIR842yhJ5RWan/gebQUJ6E/E5+rf0y9o6oj7w0Br+sWuL6kEQ/o/AdfvR1Je9jG18/gnpwjEyA=="],
+
+    "@babel/runtime": ["@babel/runtime@7.29.7", "", {}, "sha512-Nq8OhGWiZIZGV6hLHoyAKLLcJihP/xFeBMGJoUrxTX2psI8dCifzLhZISFb+VWS3wFMRDmCGw5R+dOySCqPLhw=="],
+
+    "@babel/template": ["@babel/template@7.29.7", "", { "dependencies": { "@babel/code-frame": "^7.29.7", "@babel/parser": "^7.29.7", "@babel/types": "^7.29.7" } }, "sha512-puq+Gf35oI24FeN11LkoUQFqv9uwNeWpxXZi/Ji3rRIoKAzKnxRaZ+Gkj0vKS9ZCiTESfng1N9LyOyXvo+m+Gg=="],
+
+    "@babel/traverse": ["@babel/traverse@7.29.7", "", { "dependencies": { "@babel/code-frame": "^7.29.7", "@babel/generator": "^7.29.7", "@babel/helper-globals": "^7.29.7", "@babel/parser": "^7.29.7", "@babel/template": "^7.29.7", "@babel/types": "^7.29.7", "debug": "^4.3.1" } }, "sha512-EhlfNQtZ+NK22w5BM61ciuiq1m58ed33Wr1Xan//ZRTy6hgjnwyCffRYwzsGXdASJSUJ1guZILsErh1eQcl+zw=="],
+
     "@babel/types": ["@babel/types@7.29.0", "", { "dependencies": { "@babel/helper-string-parser": "^7.27.1", "@babel/helper-validator-identifier": "^7.28.5" } }, "sha512-LwdZHpScM4Qz8Xw2iKSzS+cfglZzJGvofQICy7W7v4caru4EaAmyUuO6BGrbyQ2mYV11W0U8j5mBhd14dd3B0A=="],
 
     "@bcoe/v8-coverage": ["@bcoe/v8-coverage@1.0.2", "", {}, "sha512-6zABk/ECA/QYSCQ1NGiVwwbQerUCZ+TQbp64Q3AgmfNvurHH0j8TtXa1qbShXA6qqkpAj4V5W8pP6mLe1mcMqA=="],
@@ -273,6 +450,8 @@
 
     "@humanwhocodes/retry": ["@humanwhocodes/retry@0.4.3", "", {}, "sha512-bV0Tgo9K4hfPCek+aMAn81RppFKv2ySDQeMoSZuvTASywNTnVJCArCZE2FWqpvIatKu7VMRLWlR1EazvVhDyhQ=="],
 
+    "@isaacs/cliui": ["@isaacs/cliui@9.0.0", "", {}, "sha512-AokJm4tuBHillT+FpMtxQ60n8ObyXBatq7jD2/JA9dxbDDokKQm8KMht5ibGzLVU9IJDIKK4TPKgMHEYMn3lMg=="],
+
     "@isaacs/fs-minipass": ["@isaacs/fs-minipass@4.0.1", "", { "dependencies": { "minipass": "^7.0.4" } }, "sha512-wgm9Ehl2jpeqP3zw/7mo3kRHFp5MEDhqAdwy1fTGkHAwnkGOVsgpvQhL8B5n1qlb01jV3n/bI0ZfZp5lWA1k4w=="],
 
     "@jridgewell/gen-mapping": ["@jridgewell/gen-mapping@0.3.13", "", { "dependencies": { "@jridgewell/sourcemap-codec": "^1.5.0", "@jridgewell/trace-mapping": "^0.3.24" } }, "sha512-2kkt/7niJ6MgEPxF0bYdQ6etZaA+fQvDcLKckhy1yIQOzaoKjBBjSj63/aLVjYE3qhRt5dvM+uUyfCg6UKCBbA=="],
@@ -281,6 +460,8 @@
 
     "@jridgewell/resolve-uri": ["@jridgewell/resolve-uri@3.1.2", "", {}, "sha512-bRISgCIjP20/tbWSPWMEi54QVPRZExkuD9lJL+UIxUKtwVJA8wW1Trb1jMs1RFXo1CBTNZ/5hpC9QvmKWdopKw=="],
 
+    "@jridgewell/source-map": ["@jridgewell/source-map@0.3.11", "", { "dependencies": { "@jridgewell/gen-mapping": "^0.3.5", "@jridgewell/trace-mapping": "^0.3.25" } }, "sha512-ZMp1V8ZFcPG5dIWnQLr3NSI1MiCU7UETdS/A0G8V/XWHvJv3ZsFqutJn1Y5RPmAPX6F3BiE397OqveU/9NCuIA=="],
+
     "@jridgewell/sourcemap-codec": ["@jridgewell/sourcemap-codec@1.5.5", "", {}, "sha512-cYQ9310grqxueWbl+WuIUIaiUaDcj7WOq5fVhEljNVgRfOUhY9fy2zTvfoqWsnebh8Sl70VScFbICvJnLKB0Og=="],
 
     "@jridgewell/trace-mapping": ["@jridgewell/trace-mapping@0.3.31", "", { "dependencies": { "@jridgewell/resolve-uri": "^3.1.0", "@jridgewell/sourcemap-codec": "^1.4.14" } }, "sha512-zzNR+SdQSDJzc8joaeP8QQoCQr8NuYx2dIIytl1QeBEZHJ9uW6hebsrYgbz8hJwUQao3TWCMtmfV8Nu1twOLAw=="],
@@ -369,12 +550,18 @@
 
     "@rolldown/pluginutils": ["@rolldown/pluginutils@1.0.1", "", {}, "sha512-2j9bGt5Jh8hj+vPtgzPtl72j0yRxHAyumoo6TNfAjsLB04UtpSvPbPcDcBMxz7n+9CYB0c1GxQFxYRg2jimqGw=="],
 
+    "@rollup/plugin-babel": ["@rollup/plugin-babel@6.1.0", "", { "dependencies": { "@babel/helper-module-imports": "^7.18.6", "@rollup/pluginutils": "^5.0.1" }, "peerDependencies": { "@babel/core": "^7.0.0", "@types/babel__core": "^7.1.9", "rollup": "^1.20.0||^2.0.0||^3.0.0||^4.0.0" }, "optionalPeers": ["@types/babel__core", "rollup"] }, "sha512-dFZNuFD2YRcoomP4oYf+DvQNSUA9ih+A3vUqopQx5EdtPGo3WBnQcI/S8pwpz91UsGfL0HsMSOlaMld8HrbubA=="],
+
     "@rollup/plugin-commonjs": ["@rollup/plugin-commonjs@29.0.2", "", { "dependencies": { "@rollup/pluginutils": "^5.0.1", "commondir": "^1.0.1", "estree-walker": "^2.0.2", "fdir": "^6.2.0", "is-reference": "1.2.1", "magic-string": "^0.30.3", "picomatch": "^4.0.2" }, "peerDependencies": { "rollup": "^2.68.0||^3.0.0||^4.0.0" }, "optionalPeers": ["rollup"] }, "sha512-S/ggWH1LU7jTyi9DxZOKyxpVd4hF/OZ0JrEbeLjXk/DFXwRny0tjD2c992zOUYQobLrVkRVMDdmHP16HKP7GRg=="],
 
     "@rollup/plugin-json": ["@rollup/plugin-json@6.1.0", "", { "dependencies": { "@rollup/pluginutils": "^5.1.0" }, "peerDependencies": { "rollup": "^1.20.0||^2.0.0||^3.0.0||^4.0.0" }, "optionalPeers": ["rollup"] }, "sha512-EGI2te5ENk1coGeADSIwZ7G2Q8CJS2sF120T7jLw4xFw9n7wIOXHo+kIYRAoVpJAN+kmqZSoO3Fp4JtoNF4ReA=="],
 
     "@rollup/plugin-node-resolve": ["@rollup/plugin-node-resolve@16.0.3", "", { "dependencies": { "@rollup/pluginutils": "^5.0.1", "@types/resolve": "1.20.2", "deepmerge": "^4.2.2", "is-module": "^1.0.0", "resolve": "^1.22.1" }, "peerDependencies": { "rollup": "^2.78.0||^3.0.0||^4.0.0" }, "optionalPeers": ["rollup"] }, "sha512-lUYM3UBGuM93CnMPG1YocWu7X802BrNF3jW2zny5gQyLQgRFJhV1Sq0Zi74+dh/6NBx1DxFC4b4GXg9wUCG5Qg=="],
 
+    "@rollup/plugin-replace": ["@rollup/plugin-replace@6.0.3", "", { "dependencies": { "@rollup/pluginutils": "^5.0.1", "magic-string": "^0.30.3" }, "peerDependencies": { "rollup": "^1.20.0||^2.0.0||^3.0.0||^4.0.0" }, "optionalPeers": ["rollup"] }, "sha512-J4RZarRvQAm5IF0/LwUUg+obsm+xZhYnbMXmXROyoSE1ATJe3oXSb9L5MMppdxP2ylNSjv6zFBwKYjcKMucVfA=="],
+
+    "@rollup/plugin-terser": ["@rollup/plugin-terser@1.0.0", "", { "dependencies": { "serialize-javascript": "^7.0.3", "smob": "^1.0.0", "terser": "^5.17.4" }, "peerDependencies": { "rollup": "^2.0.0||^3.0.0||^4.0.0" }, "optionalPeers": ["rollup"] }, "sha512-FnCxhTBx6bMOYQrar6C8h3scPt8/JwIzw3+AJ2K++6guogH5fYaIFia+zZuhqv0eo1RN7W1Pz630SyvLbDjhtQ=="],
+
     "@rollup/pluginutils": ["@rollup/pluginutils@5.3.0", "", { "dependencies": { "@types/estree": "^1.0.0", "estree-walker": "^2.0.2", "picomatch": "^4.0.2" }, "peerDependencies": { "rollup": "^1.20.0||^2.0.0||^3.0.0||^4.0.0" }, "optionalPeers": ["rollup"] }, "sha512-5EdhGZtnu3V88ces7s53hhfK5KSASnJZv8Lulpc04cWO3REESroJXg73DFsOmgbU2BhwV0E20bu2IDZb3VKW4Q=="],
 
     "@rollup/rollup-android-arm-eabi": ["@rollup/rollup-android-arm-eabi@4.60.4", "", { "os": "android", "cpu": "arm" }, "sha512-F5QXMSiFebS9hKZj02XhWLLnRpJ3B3AROP0tWbFBSj+6kCbg5m9j5JoHKd4mmSVy5mS/IMQloYgYxCuJC0fxEQ=="],
@@ -463,6 +650,8 @@
 
     "@testing-library/svelte-core": ["@testing-library/svelte-core@1.0.0", "", { "peerDependencies": { "svelte": "^3 || ^4 || ^5 || ^5.0.0-next.0" } }, "sha512-VkUePoLV6oOYwSUvX6ShA8KLnJqZiYMIbP2JW2t0GLWLkJxKGvuH5qrrZBV/X7cXFnLGuFQEC7RheYiZOW68KQ=="],
 
+    "@trickfilm400/rollup-plugin-off-main-thread": ["@trickfilm400/rollup-plugin-off-main-thread@3.0.0-pre1", "", { "dependencies": { "ejs": "^3.1.10", "json5": "^2.2.3", "magic-string": "^0.30.21", "string.prototype.matchall": "^4.0.12" } }, "sha512-/67zpWDBLV+oYAEL682s1ktXL0HgqX76f6gaVGkGnVZlBbm1zd0v4Bz8MFF2GGhoX9rvfq3KSQHubFHwa6w6/Q=="],
+
     "@tybys/wasm-util": ["@tybys/wasm-util@0.10.2", "", { "dependencies": { "tslib": "^2.4.0" } }, "sha512-RoBvJ2X0wuKlWFIjrwffGw1IqZHKQqzIchKaadZZfnNpsAYp2mM0h36JtPCjNDAHGgYez/15uMBpfGwchhiMgg=="],
 
     "@types/body-parser": ["@types/body-parser@1.19.6", "", { "dependencies": { "@types/connect": "*", "@types/node": "*" } }, "sha512-HLFeCYgz89uk22N5Qg3dvGvsv46B8GLvKKo1zKG4NybA8U2DiEO3w9lqGg29t/tfLRJpJ6iQxnVw4OnB7MoM9g=="],
@@ -555,6 +744,8 @@
 
     "@typescript-eslint/visitor-keys": ["@typescript-eslint/visitor-keys@8.59.4", "", { "dependencies": { "@typescript-eslint/types": "8.59.4", "eslint-visitor-keys": "^5.0.0" } }, "sha512-U3gxVaDVnuZKhSspW/MzMxE1kq7zOdc072FcSNoqA1I9p8HyKbBFfEHoWckBAMgNMph4MamwS5iTVzFmrnt8TQ=="],
 
+    "@vite-pwa/sveltekit": ["@vite-pwa/sveltekit@1.1.0", "", { "dependencies": { "kolorist": "^1.8.0", "tinyglobby": "^0.2.9", "vite-plugin-pwa": "^1.2.0" }, "peerDependencies": { "@sveltejs/kit": "^1.3.1 || ^2.0.1", "@vite-pwa/assets-generator": "^1.0.0" }, "optionalPeers": ["@vite-pwa/assets-generator"] }, "sha512-mMIf2tY+7Hg8jecpu/WY+Ki2ikoXy3hVmt3tOxi0K+lYYnKQrDYthuHireI0S+26Mg9BXzL7qQF1xeB5VYlYlg=="],
+
     "@vitest/browser": ["@vitest/browser@4.1.7", "", { "dependencies": { "@blazediff/core": "1.9.1", "@vitest/mocker": "4.1.7", "@vitest/utils": "4.1.7", "magic-string": "^0.30.21", "pngjs": "^7.0.0", "sirv": "^3.0.2", "tinyrainbow": "^3.1.0", "ws": "^8.19.0" }, "peerDependencies": { "vitest": "4.1.7" } }, "sha512-N2JFGfXoEGVAut+kHeru9dD4BUMq/q5xDvBARNl0tUsly3m5KglLOu8VO/6MkDfOlgxXTycojkt6gBKsuyR+IQ=="],
 
     "@vitest/browser-playwright": ["@vitest/browser-playwright@4.1.7", "", { "dependencies": { "@vitest/browser": "4.1.7", "@vitest/mocker": "4.1.7", "tinyrainbow": "^3.1.0" }, "peerDependencies": { "playwright": "*", "vitest": "4.1.7" } }, "sha512-OlTlJej7YN6VwV7zJJoNeaCsctF+JXpzpZ4oBHUbrQFfIq+0KW2f07rprCLh9N/zRIZ0v4Mchn1QDDmWMUhPKw=="],
@@ -607,6 +798,10 @@
 
     "aria-query": ["aria-query@5.3.1", "", {}, "sha512-Z/ZeOgVl7bcSYZ/u/rh0fOpvEpq//LZmdbkXyc7syVzjPAhfOa9ebsdTSjEBDU4vs5nC98Kfduj1uFo0qyET3g=="],
 
+    "array-buffer-byte-length": ["array-buffer-byte-length@1.0.2", "", { "dependencies": { "call-bound": "^1.0.3", "is-array-buffer": "^3.0.5" } }, "sha512-LHE+8BuR7RYGDKvnrmcuSq3tDcKv9OFEXQt/HpbZhY7V6h0zlUXutnAD82GiFx9rdieCMjkvtcsPqBwgUl1Iiw=="],
+
+    "arraybuffer.prototype.slice": ["arraybuffer.prototype.slice@1.0.4", "", { "dependencies": { "array-buffer-byte-length": "^1.0.1", "call-bind": "^1.0.8", "define-properties": "^1.2.1", "es-abstract": "^1.23.5", "es-errors": "^1.3.0", "get-intrinsic": "^1.2.6", "is-array-buffer": "^3.0.4" } }, "sha512-BNoCY6SXXPQ7gF2opIP4GBE+Xw7U+pHMYKuzjgCN3GwiaIR09UUeKfheyIry77QtrCBlC0KK0q5/TER/tYh3PQ=="],
+
     "assert-plus": ["assert-plus@1.0.0", "", {}, "sha512-NfJ4UzBCcQGLDlQq7nHxH+tv3kyZ0hHQqF5BO6J7tNJeP5do1llPr8dZ8zHonfhAu0PHAdMkSo+8o0wxg9lZWw=="],
 
     "assertion-error": ["assertion-error@2.0.1", "", {}, "sha512-Izi8RQcffqCeNVgFigKli1ssklIbpHnCYc6AknXGYoB6grJqyeby7jv12JUQgmTAnIDnbck1uxksT4dzN3PWBA=="],
@@ -619,26 +814,40 @@
 
     "async-exit-hook": ["async-exit-hook@2.0.1", "", {}, "sha512-NW2cX8m1Q7KPA7a5M2ULQeZ2wR5qI5PAbw5L0UOMxdioVk9PMZ0h1TmyZEkPYrCvYjDlFICusOu1dlEKAAeXBw=="],
 
+    "async-function": ["async-function@1.0.0", "", {}, "sha512-hsU18Ae8CDTR6Kgu9DYf0EbCr/a5iGL0rytQDobUcdpYOKokk8LEjVphnXkDkgpi0wYVsqrXuP0bZxJaTqdgoA=="],
+
     "asynckit": ["asynckit@0.4.0", "", {}, "sha512-Oei9OH4tRh0YqU3GxhX79dM/mwVgvbZJaSNaRk+bshkj0S5cfHcgYakreBjrHwatXKbz+IoIdYLxrKim2MjW0Q=="],
 
     "at-least-node": ["at-least-node@1.0.0", "", {}, "sha512-+q/t7Ekv1EDY2l6Gda6LLiX14rU9TV20Wa3ofeQmwPFZbOMo9DXrLbOjFaaclkXKWidIaopwAObQDqwWtGUjqg=="],
 
+    "available-typed-arrays": ["available-typed-arrays@1.0.7", "", { "dependencies": { "possible-typed-array-names": "^1.0.0" } }, "sha512-wvUjBtSGN7+7SjNpq/9M2Tg350UZD3q62IFZLbRAR1bSMlCo1ZaeW+BJ+D090e4hIIZLBcTDWe4Mh4jvUDajzQ=="],
+
     "axe-core": ["axe-core@4.11.4", "", {}, "sha512-KunSNx+TVpkAw/6ULfhnx+HWRecjqZGTOyquAoWHYLRSdK1tB5Ihce1ZW+UY3fj33bYAFWPu7W/GRSmmrCGuxA=="],
 
     "axios": ["axios@1.16.1", "", { "dependencies": { "follow-redirects": "^1.16.0", "form-data": "^4.0.5", "https-proxy-agent": "^5.0.1", "proxy-from-env": "^2.1.0" } }, "sha512-caYkukvroVPO8KrzuJEb50Hm07KwfBZPEC3VeFHTsqWHvKTsy54hjJz9BS/cdaypROE2rH6xvm9mHX4fgWkr3A=="],
 
     "axobject-query": ["axobject-query@4.1.0", "", {}, "sha512-qIj0G9wZbMGNLjLmg1PT6v2mE9AH2zlnADJD/2tC6E00hgmhUOfEB6greHPAfLRSufHqROIUTkw6E+M3lH0PTQ=="],
 
+    "babel-plugin-polyfill-corejs2": ["babel-plugin-polyfill-corejs2@0.4.17", "", { "dependencies": { "@babel/compat-data": "^7.28.6", "@babel/helper-define-polyfill-provider": "^0.6.8", "semver": "^6.3.1" }, "peerDependencies": { "@babel/core": "^7.4.0 || ^8.0.0-0 <8.0.0" } }, "sha512-aTyf30K/rqAsNwN76zYrdtx8obu0E4KoUME29B1xj+B3WxgvWkp943vYQ+z8Mv3lw9xHXMHpvSPOBxzAkIa94w=="],
+
+    "babel-plugin-polyfill-corejs3": ["babel-plugin-polyfill-corejs3@0.14.2", "", { "dependencies": { "@babel/helper-define-polyfill-provider": "^0.6.8", "core-js-compat": "^3.48.0" }, "peerDependencies": { "@babel/core": "^7.4.0 || ^8.0.0-0 <8.0.0" } }, "sha512-coWpDLJ410R781Npmn/SIBZEsAetR4xVi0SxLMXPaMO4lSf1MwnkGYMtkFxew0Dn8B3/CpbpYxN0JCgg8mn67g=="],
+
+    "babel-plugin-polyfill-regenerator": ["babel-plugin-polyfill-regenerator@0.6.8", "", { "dependencies": { "@babel/helper-define-polyfill-provider": "^0.6.8" }, "peerDependencies": { "@babel/core": "^7.4.0 || ^8.0.0-0 <8.0.0" } }, "sha512-M762rNHfSF1EV3SLtnCJXFoQbbIIz0OyRwnCmV0KPC7qosSfCO0QLTSuJX3ayAebubhE6oYBAYPrBA5ljowaZg=="],
+
     "balanced-match": ["balanced-match@4.0.4", "", {}, "sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA=="],
 
     "base64-js": ["base64-js@1.5.1", "", {}, "sha512-AKpaYlHn8t4SVbOHCy+b5+KKgvR4vrsD8vbvrbiQJps7fKDTkjkDry6ji0rUJjC0kzbNePLwzxq8iypo41qeWA=="],
 
+    "baseline-browser-mapping": ["baseline-browser-mapping@2.10.42", "", { "bin": { "baseline-browser-mapping": "dist/cli.cjs" } }, "sha512-c/jurFrDLyui7o1J86yLkRu4LMsTYcBohveus7/I2Hzdn9KIP2bdJPTue/lR1KH46enoPbD77GKeSYNdyPoD3Q=="],
+
     "body-parser": ["body-parser@2.2.2", "", { "dependencies": { "bytes": "^3.1.2", "content-type": "^1.0.5", "debug": "^4.4.3", "http-errors": "^2.0.0", "iconv-lite": "^0.7.0", "on-finished": "^2.4.1", "qs": "^6.14.1", "raw-body": "^3.0.1", "type-is": "^2.0.1" } }, "sha512-oP5VkATKlNwcgvxi0vM0p/D3n2C3EReYVX+DNYs5TjZFn/oQt2j+4sVJtSMr18pdRr8wjTcBl6LoV+FUwzPmNA=="],
 
     "boolean": ["boolean@3.2.0", "", {}, "sha512-d0II/GO9uf9lfUHH2BQsjxzRJZBdsjgsBiW4BvhWk/3qoKwQFjIDVN19PfX8F2D/r9PCMTtLWjYVCFrpeYUzsw=="],
 
     "brace-expansion": ["brace-expansion@5.0.6", "", { "dependencies": { "balanced-match": "^4.0.2" } }, "sha512-kLpxurY4Z4r9sgMsyG0Z9uzsBlgiU/EFKhj/h91/8yHu0edo7XuixOIH3VcJ8kkxs6/jPzoI6U9Vj3WqbMQ94g=="],
 
+    "browserslist": ["browserslist@4.28.5", "", { "dependencies": { "baseline-browser-mapping": "^2.10.42", "caniuse-lite": "^1.0.30001800", "electron-to-chromium": "^1.5.387", "node-releases": "^2.0.50", "update-browserslist-db": "^1.2.3" }, "bin": { "browserslist": "cli.js" } }, "sha512-Cu2E6QejHWzuDMTkuwgpABFgDfZrXLQq5V13YOACZx4mFAG4IwGTbTfHPMr4WtxlHoXSM8FIuRwYYCz5XiabaQ=="],
+
     "buffer": ["buffer@5.7.1", "", { "dependencies": { "base64-js": "^1.3.1", "ieee754": "^1.1.13" } }, "sha512-EHcyIPBQ4BSGlvjB16k5KgAJ27CIsHY/2JBmCRReo48y9rQ3MaUzWX3KVlBa4U7MyX02HdVj0K7C3WaB3ju7FQ=="],
 
     "buffer-crc32": ["buffer-crc32@0.2.13", "", {}, "sha512-VO9Ht/+p3SN7SKWqcrgEzjGbRSJYTx+Q1pTQC0wrWqHx0vpJraQ6GtHx8tvcg1rlK1byhU5gccxgOgj7B0TDkQ=="],
@@ -659,10 +868,14 @@
 
     "cacheable-request": ["cacheable-request@7.0.4", "", { "dependencies": { "clone-response": "^1.0.2", "get-stream": "^5.1.0", "http-cache-semantics": "^4.0.0", "keyv": "^4.0.0", "lowercase-keys": "^2.0.0", "normalize-url": "^6.0.1", "responselike": "^2.0.0" } }, "sha512-v+p6ongsrp0yTGbJXjgxPow2+DL93DASP4kXCDKb8/bwRtt9OEF3whggkkDkGNzgcWy2XaF4a8nZglC7uElscg=="],
 
+    "call-bind": ["call-bind@1.0.9", "", { "dependencies": { "call-bind-apply-helpers": "^1.0.2", "es-define-property": "^1.0.1", "get-intrinsic": "^1.3.0", "set-function-length": "^1.2.2" } }, "sha512-a/hy+pNsFUTR+Iz8TCJvXudKVLAnz/DyeSUo10I5yvFDQJBFU2s9uqQpoSrJlroHUKoKqzg+epxyP9lqFdzfBQ=="],
+
     "call-bind-apply-helpers": ["call-bind-apply-helpers@1.0.2", "", { "dependencies": { "es-errors": "^1.3.0", "function-bind": "^1.1.2" } }, "sha512-Sp1ablJ0ivDkSzjcaJdxEunN5/XvksFJ2sMBFfq6x0ryhQV/2b/KwFe21cMpmHtPOSij8K99/wSfoEuTObmuMQ=="],
 
     "call-bound": ["call-bound@1.0.4", "", { "dependencies": { "call-bind-apply-helpers": "^1.0.2", "get-intrinsic": "^1.3.0" } }, "sha512-+ys997U96po4Kx/ABpBCqhA9EuxJaQWDQg7295H4hBphv3IZg0boBKuwYpt4YXp6MZ5AmZQnU/tyMTlRpaSejg=="],
 
+    "caniuse-lite": ["caniuse-lite@1.0.30001803", "", {}, "sha512-g/uHREV2ZpK9qMalCsWaxmA6ol+DX8GYhuf3T40RKoP+oL7vhRJh8LNt73PCjpnR6l14FzfPrB5Yux4PKm2meg=="],
+
     "chai": ["chai@6.2.2", "", {}, "sha512-NUPRluOfOiTKBKvWPtSD4PhFvWCqOi0BGStNWs57X9js7XGTprSmFoz5F0tWhR4WPjNeR9jXqdC7/UpSJTnlRg=="],
 
     "chalk": ["chalk@4.1.2", "", { "dependencies": { "ansi-styles": "^4.1.0", "supports-color": "^7.1.0" } }, "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA=="],
@@ -691,7 +904,9 @@
 
     "combined-stream": ["combined-stream@1.0.8", "", { "dependencies": { "delayed-stream": "~1.0.0" } }, "sha512-FQN4MRfuJeHf7cBbBMJFXhKSDq+2kAArBlmRBvcvFE5BB1HZKXtSFASDhdlz9zOYwxh8lDdnvmMOe/+5cdoEdg=="],
 
-    "commander": ["commander@5.1.0", "", {}, "sha512-P0CysNDQ7rtVw4QIQtm+MRxV66vKFSvlsQvGYXZWR3qFU0jlMKHZZZgw8e+8DSah4UDKMqnknRDQz+xuQXQ/Zg=="],
+    "commander": ["commander@2.20.3", "", {}, "sha512-GpVkmM8vF2vQUkj2LvZmD35JxeJOLCwJ9cUkugyk2nuhbv3+mJvpLYYt+0+USMxE+oj+ey/lJEnhZw75x/OMcQ=="],
+
+    "common-tags": ["common-tags@1.8.2", "", {}, "sha512-gk/Z852D2Wtb//0I+kRFNKKE9dIIVirjoqPoA1wJU+XePVXZfGeBpk45+A1rKO4Q43prqWBNY/MiIeRLbPWUaA=="],
 
     "commondir": ["commondir@1.0.1", "", {}, "sha512-W9pAhw0ja1Edb5GVdIF1mjZw/ASI0AlShXM83UUGe2DVr5TdAPEA1OA8m/g8zWp9x6On7gqufY+FatDbC3MDQg=="],
 
@@ -709,6 +924,8 @@
 
     "cookie-signature": ["cookie-signature@1.2.2", "", {}, "sha512-D76uU73ulSXrD1UXF4KE2TMxVVwhsnCgfAyTg9k8P6KGZjlXKrOLe4dJQKI3Bxi5wjesZoFXJWElNWBjPZMbhg=="],
 
+    "core-js-compat": ["core-js-compat@3.49.0", "", { "dependencies": { "browserslist": "^4.28.1" } }, "sha512-VQXt1jr9cBz03b331DFDCCP90b3fanciLkgiOoy8SBHy06gNf+vQ1A3WFLqG7I8TipYIKeYK9wxd0tUrvHcOZA=="],
+
     "core-util-is": ["core-util-is@1.0.2", "", {}, "sha512-3lqz5YjWTYnW6dlDa5TLaTCcShfar1e40rmcJVwCBJC6mWlFuj0eCHIElmG1g5kyuJ/GD+8Wn4FFCcz4gJPfaQ=="],
 
     "cors": ["cors@2.8.6", "", { "dependencies": { "object-assign": "^4", "vary": "^1" } }, "sha512-tJtZBBHA6vjIAaF6EnIaq6laBBP9aq/Y3ouVJjEfoHbRBcHBAHYcMh/w8LDrk2PvIMMq8gmopa5D4V8RmbrxGw=="],
@@ -721,8 +938,16 @@
 
     "cross-spawn": ["cross-spawn@7.0.6", "", { "dependencies": { "path-key": "^3.1.0", "shebang-command": "^2.0.0", "which": "^2.0.1" } }, "sha512-uV2QOWP2nWzsy2aMp8aRibhi9dlzF5Hgh5SHaB9OiTGEyDTiJJyx0uy51QXdyWbtAHNua4XJzUKca3OzKUd3vA=="],
 
+    "crypto-random-string": ["crypto-random-string@2.0.0", "", {}, "sha512-v1plID3y9r/lPhviJ1wrXpLeyUIGAZ2SHNYTEapm7/8A9nLPoyvVp3RK/EPFqn5kEznyWgYZNsRtYYIWbuG8KA=="],
+
     "cssesc": ["cssesc@3.0.0", "", { "bin": { "cssesc": "bin/cssesc" } }, "sha512-/Tb/JcjK111nNScGob5MNtsntNM1aCNUDipB/TkwZFhyDrrE47SOx/18wF2bbjgc3ZzCSKW1T5nt5EbFoAz/Vg=="],
 
+    "data-view-buffer": ["data-view-buffer@1.0.2", "", { "dependencies": { "call-bound": "^1.0.3", "es-errors": "^1.3.0", "is-data-view": "^1.0.2" } }, "sha512-EmKO5V3OLXh1rtK2wgXRansaK1/mtVdTUEiEI0W8RkvgT05kfxaH29PliLnpLP73yYO6142Q72QNa8Wx/A5CqQ=="],
+
+    "data-view-byte-length": ["data-view-byte-length@1.0.2", "", { "dependencies": { "call-bound": "^1.0.3", "es-errors": "^1.3.0", "is-data-view": "^1.0.2" } }, "sha512-tuhGbE6CfTM9+5ANGf+oQb72Ky/0+s3xKUpHvShfiz2RxMFgFPjsXuRLBVMtvMs15awe45SRb83D6wH4ew6wlQ=="],
+
+    "data-view-byte-offset": ["data-view-byte-offset@1.0.1", "", { "dependencies": { "call-bound": "^1.0.2", "es-errors": "^1.3.0", "is-data-view": "^1.0.1" } }, "sha512-BS8PfmtDGnrgYdOonGZQdLZslWIeCGFP9tpan0hi1Co2Zr2NKADsvGYA8XxuG/4UWgJ6Cjtv+YJnB6MM69QGlQ=="],
+
     "debug": ["debug@4.4.3", "", { "dependencies": { "ms": "^2.1.3" }, "peerDependencies": { "supports-color": "*" }, "optionalPeers": ["supports-color"] }, "sha512-RGwwWnwQvkVfavKVt22FGLw+xYSdzARwm0ru6DhTVA3umU5hZc28V3kO4stgYryrTlLpuvgI9GiijltAjNbcqA=="],
 
     "decompress-response": ["decompress-response@6.0.0", "", { "dependencies": { "mimic-response": "^3.1.0" } }, "sha512-aW35yZM6Bb/4oJlZncMH2LCoZtJXTRxES17vE3hoRiowU2kWHaJKFkSBDnDR+cm9J+9QhXmREyIfv0pji9ejCQ=="],
@@ -779,6 +1004,8 @@
 
     "electron-publish": ["electron-publish@26.8.1", "", { "dependencies": { "@types/fs-extra": "^9.0.11", "builder-util": "26.8.1", "builder-util-runtime": "9.5.1", "chalk": "^4.1.2", "form-data": "^4.0.5", "fs-extra": "^10.1.0", "lazy-val": "^1.0.5", "mime": "^2.5.2" } }, "sha512-q+jrSTIh/Cv4eGZa7oVR+grEJo/FoLMYBAnSL5GCtqwUpr1T+VgKB/dn1pnzxIxqD8S/jP1yilT9VrwCqINR4w=="],
 
+    "electron-to-chromium": ["electron-to-chromium@1.5.388", "", {}, "sha512-Pl/aJaqOOxYxda3vcx1IKSJimwYXHDkEnGn0F+kG2EE68dDtx2uCinaS+Vih8Z91B9t8CSAbiF/HKyWcnXjhzw=="],
+
     "electron-winstaller": ["electron-winstaller@5.4.0", "", { "dependencies": { "@electron/asar": "^3.2.1", "debug": "^4.1.1", "fs-extra": "^7.0.1", "lodash": "^4.17.21", "temp": "^0.9.0" }, "optionalDependencies": { "@electron/windows-sign": "^1.1.2" } }, "sha512-bO3y10YikuUwUuDUQRM4KfwNkKhnpVO7IPdbsrejwN9/AABJzzTQ4GeHwyzNSrVO+tEH3/Np255a3sVZpZDjvg=="],
 
     "emoji-regex": ["emoji-regex@8.0.0", "", {}, "sha512-MSjYzcWNOA0ewAHpz0MxpYFvwg6yjy1NG3xteoqz644VCo/RPgnr1/GGt+ic3iJTzQ8Eu3TdM14SawnVUmGE6A=="],
@@ -793,6 +1020,10 @@
 
     "err-code": ["err-code@2.0.3", "", {}, "sha512-2bmlRpNKBxT/CRmPOlyISQpNj+qSeYvcym/uT0Jx2bMOlKLtSy1ZmLuVxSEKKyor/N5yhvp/ZiG1oE3DEYMSFA=="],
 
+    "es-abstract": ["es-abstract@1.24.2", "", { "dependencies": { "array-buffer-byte-length": "^1.0.2", "arraybuffer.prototype.slice": "^1.0.4", "available-typed-arrays": "^1.0.7", "call-bind": "^1.0.8", "call-bound": "^1.0.4", "data-view-buffer": "^1.0.2", "data-view-byte-length": "^1.0.2", "data-view-byte-offset": "^1.0.1", "es-define-property": "^1.0.1", "es-errors": "^1.3.0", "es-object-atoms": "^1.1.1", "es-set-tostringtag": "^2.1.0", "es-to-primitive": "^1.3.0", "function.prototype.name": "^1.1.8", "get-intrinsic": "^1.3.0", "get-proto": "^1.0.1", "get-symbol-description": "^1.1.0", "globalthis": "^1.0.4", "gopd": "^1.2.0", "has-property-descriptors": "^1.0.2", "has-proto": "^1.2.0", "has-symbols": "^1.1.0", "hasown": "^2.0.2", "internal-slot": "^1.1.0", "is-array-buffer": "^3.0.5", "is-callable": "^1.2.7", "is-data-view": "^1.0.2", "is-negative-zero": "^2.0.3", "is-regex": "^1.2.1", "is-set": "^2.0.3", "is-shared-array-buffer": "^1.0.4", "is-string": "^1.1.1", "is-typed-array": "^1.1.15", "is-weakref": "^1.1.1", "math-intrinsics": "^1.1.0", "object-inspect": "^1.13.4", "object-keys": "^1.1.1", "object.assign": "^4.1.7", "own-keys": "^1.0.1", "regexp.prototype.flags": "^1.5.4", "safe-array-concat": "^1.1.3", "safe-push-apply": "^1.0.0", "safe-regex-test": "^1.1.0", "set-proto": "^1.0.0", "stop-iteration-iterator": "^1.1.0", "string.prototype.trim": "^1.2.10", "string.prototype.trimend": "^1.0.9", "string.prototype.trimstart": "^1.0.8", "typed-array-buffer": "^1.0.3", "typed-array-byte-length": "^1.0.3", "typed-array-byte-offset": "^1.0.4", "typed-array-length": "^1.0.7", "unbox-primitive": "^1.1.0", "which-typed-array": "^1.1.19" } }, "sha512-2FpH9Q5i2RRwyEP1AylXe6nYLR5OhaJTZwmlcP0dL/+JCbgg7yyEo/sEK6HeGZRf3dFpWwThaRHVApXSkW3xeg=="],
+
+    "es-abstract-get": ["es-abstract-get@1.0.0", "", { "dependencies": { "es-errors": "^1.3.0", "es-object-atoms": "^1.1.2", "is-callable": "^1.2.7", "object-inspect": "^1.13.4" } }, "sha512-6PMWXpdhshVvFp+FoWYs1EvG1Nj0tvk0dZM+XcK0xMEM1czRVcP6ohqPWHy6qPagSpC8j4+p89WXlT+xXJs/fg=="],
+
     "es-define-property": ["es-define-property@1.0.1", "", {}, "sha512-e3nRfgfUZ4rNGL232gUgX06QNyyez04KdjFrF+LTRoOXmrOgFKDg4BCdsjW8EnT69eqdYGmRpJwiPVYNrCaW3g=="],
 
     "es-errors": ["es-errors@1.3.0", "", {}, "sha512-Zf5H2Kxt2xjTvbJvP2ZWLEICxA6j+hAmMzIlypy4xcBg1vKVnx89Wy0GbS+kf5cwCVFFzdCFh2XSCFNULS6csw=="],
@@ -803,6 +1034,8 @@
 
     "es-set-tostringtag": ["es-set-tostringtag@2.1.0", "", { "dependencies": { "es-errors": "^1.3.0", "get-intrinsic": "^1.2.6", "has-tostringtag": "^1.0.2", "hasown": "^2.0.2" } }, "sha512-j6vWzfrGVfyXxge+O0x5sh6cvxAog0a/4Rdd2K36zCMV5eJ+/+tOAngRO8cODMNWbVRdVlmGZQL2YS3yR8bIUA=="],
 
+    "es-to-primitive": ["es-to-primitive@1.3.4", "", { "dependencies": { "es-abstract-get": "^1.0.0", "es-define-property": "^1.0.1", "es-errors": "^1.3.0", "is-callable": "^1.2.7", "is-date-object": "^1.1.0", "is-symbol": "^1.1.1" } }, "sha512-yPDz7wqpg1/mmHLmS3tcfTfbw5f1eryXvyghYBffGdERwe+mV7ZcWzTR8LR17Kvqt3qfPurjlonmnq3MKXIOXw=="],
+
     "es6-error": ["es6-error@4.1.1", "", {}, "sha512-Um/+FxMr9CISWh0bi5Zv0iOD+4cFh5qLeks1qhAopKVAJw3drgKbKySikp7wGhDL0HPeaja0P5ULZrxLkniUVg=="],
 
     "escalade": ["escalade@3.2.0", "", {}, "sha512-WUj2qlxaQtO4g6Pq5c29GTcWGDyd8itL8zTlipgECz3JesAiiOKotd8JU6otB3PACgG6xkJUyVhboMS+bje/jA=="],
@@ -837,6 +1070,8 @@
 
     "esutils": ["esutils@2.0.3", "", {}, "sha512-kVscqXk4OCp68SZ0dkgEKVi6/8ij300KBWTJq32P/dYeWTSwK41WyTxalN1eRmA5Z9UU/LX9D7FWSmV9SAYx6g=="],
 
+    "eta": ["eta@4.6.0", "", {}, "sha512-lW6is4T1NFOYnmqGZIfvixqj7A7sSvScF+DN8EK6K58xI5MZ5UvYe0GjopxOXQtZvUn4eDdVuZ8XSoYWTMEKwA=="],
+
     "etag": ["etag@1.8.1", "", {}, "sha512-aIL5Fx7mawVa300al2BnEE4iNvo1qETxLrPI/o05L7z6go7fCw1J6EQmbK4FmJ2AS7kgVF/KEZWufBfdClMcPg=="],
 
     "eventemitter3": ["eventemitter3@5.0.4", "", {}, "sha512-mlsTRyGaPBjPedk6Bvw+aqbsXDtoAyAzm5MO7JgU+yVRyMQ5O8bD4Kcci7BS85f93veegeCPkL8R4GLClnjLFw=="],
@@ -887,6 +1122,10 @@
 
     "follow-redirects": ["follow-redirects@1.16.0", "", { "peerDependencies": { "debug": "*" }, "optionalPeers": ["debug"] }, "sha512-y5rN/uOsadFT/JfYwhxRS5R7Qce+g3zG97+JrtFZlC9klX/W5hD7iiLzScI4nZqUS7DNUdhPgw4xI8W2LuXlUw=="],
 
+    "for-each": ["for-each@0.3.5", "", { "dependencies": { "is-callable": "^1.2.7" } }, "sha512-dKx12eRCVIzqCxFGplyFKJMPvLEWgmNtUrpTiJIR5u97zEhRG8ySrtboPHZXx7daLxQVrl643cTzbab2tkQjxg=="],
+
+    "foreground-child": ["foreground-child@3.3.1", "", { "dependencies": { "cross-spawn": "^7.0.6", "signal-exit": "^4.0.1" } }, "sha512-gIXjKqtFuWEgzFRJA9WCQeSJLZDjgJUOMCMzxtvFq/37KojM1BFGufqsCy0r4qSQmYLsZYMeyRqzIWOMup03sw=="],
+
     "form-data": ["form-data@4.0.5", "", { "dependencies": { "asynckit": "^0.4.0", "combined-stream": "^1.0.8", "es-set-tostringtag": "^2.1.0", "hasown": "^2.0.2", "mime-types": "^2.1.12" } }, "sha512-8RipRLol37bNs2bhoV67fiTEvdTrbMUYcFTiy3+wuuOnUog2QBHCZWXDRijWQfAkhBj2Uf5UnVaiWwA5vdd82w=="],
 
     "forwarded": ["forwarded@0.2.0", "", {}, "sha512-buRG0fpBtRHSTCOASe6hD258tEubFoRLb4ZNA6NxMVHNw2gOcwHo9wyablzMzOA5z9xA9L1KNjk/Nt6MT9aYow=="],
@@ -901,15 +1140,27 @@
 
     "function-bind": ["function-bind@1.1.2", "", {}, "sha512-7XHNxH7qX9xG5mIwxkhumTox/MIRNcOgDrxWsMt2pAr23WHp6MrRlN7FBSFpCpr+oVO0F744iUgR82nJMfG2SA=="],
 
+    "function.prototype.name": ["function.prototype.name@1.2.0", "", { "dependencies": { "call-bind": "^1.0.9", "call-bound": "^1.0.4", "es-define-property": "^1.0.1", "es-errors": "^1.3.0", "functions-have-names": "^1.2.3", "has-property-descriptors": "^1.0.2", "hasown": "^2.0.4", "is-callable": "^1.2.7", "is-document.all": "^1.0.0" } }, "sha512-jObKIik1P2QjPHP5nz5BaOtUlfgS0fWo8IUByNXkM+o+02sJOi94em77GwJKQSJ3gfPHdgzLNrHc1uokV4P/ew=="],
+
+    "functions-have-names": ["functions-have-names@1.2.3", "", {}, "sha512-xckBUXyTIqT97tq2x2AMb+g163b5JFysYk0x4qxNFwbfQkmNZoiRHb6sPzI9/QV33WeuvVYBUIiD4NzNIyqaRQ=="],
+
+    "generator-function": ["generator-function@2.0.1", "", {}, "sha512-SFdFmIJi+ybC0vjlHN0ZGVGHc3lgE0DxPAT0djjVg+kjOnSqclqmj0KQ7ykTOLP6YxoqOvuAODGdcHJn+43q3g=="],
+
+    "gensync": ["gensync@1.0.0-beta.2", "", {}, "sha512-3hN7NaskYvMDLQY55gnW3NQ+mesEAepTqlg+VEbj7zzqEMBVNhzcGYYeqFo/TlYz6eQiFcp1HcsCZO+nGgS8zg=="],
+
     "get-caller-file": ["get-caller-file@2.0.5", "", {}, "sha512-DyFP3BM/3YHTQOCUL/w0OZHR0lpKeGrxotcHWcqNEdnltqFwXVfhEBQ94eIo34AfQpo0rGki4cyIiftY06h2Fg=="],
 
     "get-intrinsic": ["get-intrinsic@1.3.0", "", { "dependencies": { "call-bind-apply-helpers": "^1.0.2", "es-define-property": "^1.0.1", "es-errors": "^1.3.0", "es-object-atoms": "^1.1.1", "function-bind": "^1.1.2", "get-proto": "^1.0.1", "gopd": "^1.2.0", "has-symbols": "^1.1.0", "hasown": "^2.0.2", "math-intrinsics": "^1.1.0" } }, "sha512-9fSjSaos/fRIVIp+xSJlE6lfwhES7LNtKaCBIamHsjr2na1BiABJPo0mOjjz8GJDURarmCPGqaiVg5mfjb98CQ=="],
 
+    "get-own-enumerable-property-symbols": ["get-own-enumerable-property-symbols@3.0.2", "", {}, "sha512-I0UBV/XOz1XkIJHEUDMZAbzCThU/H8DxmSfmdGcKPnVhu2VfFqr34jr9777IyaTYvxjedWhqVIilEDsCdP5G6g=="],
+
     "get-proto": ["get-proto@1.0.1", "", { "dependencies": { "dunder-proto": "^1.0.1", "es-object-atoms": "^1.0.0" } }, "sha512-sTSfBjoXBp89JvIKIefqw7U2CCebsc74kiY6awiGogKtoSGbgjYE/G/+l9sF3MWFPNc9IcoOC4ODfKHfxFmp0g=="],
 
     "get-stream": ["get-stream@5.2.0", "", { "dependencies": { "pump": "^3.0.0" } }, "sha512-nBF+F1rAZVCu/p7rjzgA+Yb4lfYXrpl7a6VmJrU8wF9I1CKvP/QwPNZHnOlwbTkY6dvtFIzFMSyQXbLoTQPRpA=="],
 
-    "glob": ["glob@7.2.3", "", { "dependencies": { "fs.realpath": "^1.0.0", "inflight": "^1.0.4", "inherits": "2", "minimatch": "^3.1.1", "once": "^1.3.0", "path-is-absolute": "^1.0.0" } }, "sha512-nFR0zLpU2YCaRxwoCJvL6UvCH2JFyFVIvwTLsIf21AuHlMskA1hhTdk+LlYJtOlYt9v6dvszD2BGRqBL+iQK9Q=="],
+    "get-symbol-description": ["get-symbol-description@1.1.0", "", { "dependencies": { "call-bound": "^1.0.3", "es-errors": "^1.3.0", "get-intrinsic": "^1.2.6" } }, "sha512-w9UMqWwJxHNOvoNzSJ2oPF5wvYcvP7jUvYzhp67yEhTi17ZDBBC1z9pTdGuzjD+EFIqLSYRweZjqfiPzQ06Ebg=="],
+
+    "glob": ["glob@11.1.0", "", { "dependencies": { "foreground-child": "^3.3.1", "jackspeak": "^4.1.1", "minimatch": "^10.1.1", "minipass": "^7.1.2", "package-json-from-dist": "^1.0.0", "path-scurry": "^2.0.0" }, "bin": { "glob": "dist/esm/bin.mjs" } }, "sha512-vuNwKSaKiqm7g0THUBu2x7ckSs3XJLXE+2ssL7/MfTGPLLcrJQ/4Uq1CjPTtO5cCIiRxqvN6Twy1qOwhL0Xjcw=="],
 
     "glob-parent": ["glob-parent@6.0.2", "", { "dependencies": { "is-glob": "^4.0.3" } }, "sha512-XxwI8EOhVQgWp6iDL+3b0r86f4d6AX6zSU55HfB4ydCEuXLXc5FcYeOu+nnGftS4TEju/11rt4KJPTMgbfmv4A=="],
 
@@ -925,10 +1176,14 @@
 
     "graceful-fs": ["graceful-fs@4.2.11", "", {}, "sha512-RbJ5/jmFcNNCcDV5o9eTnBLJ/HszWV0P73bc+Ff4nS/rJj+YaS6IGyiOL0VoBYX+l1Wrl3k63h/KrH+nhJ0XvQ=="],
 
+    "has-bigints": ["has-bigints@1.1.0", "", {}, "sha512-R3pbpkcIqv2Pm3dUwgjclDRVmWpTJW2DcMzcIhEXEx1oh/CEMObMm3KLmRJOdvhM7o4uQBnwr8pzRK2sJWIqfg=="],
+
     "has-flag": ["has-flag@4.0.0", "", {}, "sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ=="],
 
     "has-property-descriptors": ["has-property-descriptors@1.0.2", "", { "dependencies": { "es-define-property": "^1.0.0" } }, "sha512-55JNKuIW+vq4Ke1BjOTjM2YctQIvCT7GFzHwmfZPGo5wnrgkid0YQtnAleFSqumZm4az3n2BS+erby5ipJdgrg=="],
 
+    "has-proto": ["has-proto@1.2.0", "", { "dependencies": { "dunder-proto": "^1.0.0" } }, "sha512-KIL7eQPfHQRC8+XluaIw7BHUwwqL19bQn4hzNgdr+1wXoU0KKj6rufu47lhY7KbJR2C6T6+PfyN0Ea7wkSS+qQ=="],
+
     "has-symbols": ["has-symbols@1.1.0", "", {}, "sha512-1cDNdwJ2Jaohmb3sg4OmKaMBwuC48sYni5HUw2DvsC8LjGTLK9h+eb1X6RyuOHe4hT0ULCW68iomhjUoKUqlPQ=="],
 
     "has-tostringtag": ["has-tostringtag@1.0.2", "", { "dependencies": { "has-symbols": "^1.0.3" } }, "sha512-NqADB8VjPFLM2V0VvHUewwwsw0ZWBaIdgo+ieHtK3hasLz4qeCRjYcqfB6AQrBggRKppKF8L52/VqdVsO47Dlw=="],
@@ -955,6 +1210,8 @@
 
     "iconv-lite": ["iconv-lite@0.6.3", "", { "dependencies": { "safer-buffer": ">= 2.1.2 < 3.0.0" } }, "sha512-4fCk79wshMdzMp2rH06qWrJE4iolqLhCUH+OiuIgU++RB0+94NlDL81atO7GX55uUKueo0txHNtvEyI6D7WdMw=="],
 
+    "idb": ["idb@7.1.1", "", {}, "sha512-gchesWBzyvGHRO9W8tzUWFDycow5gwjvFKfyV9FF32Y7F50yZMp7mP+T2mJIWFx49zicqyC4uefHM17o6xKIVQ=="],
+
     "ieee754": ["ieee754@1.2.1", "", {}, "sha512-dcyqhDvX1C46lXZcVqCpK+FtMRQVdIMN6/Df5js2zouUsqG7I6sFxitIC+7KYK29KdXOLHdu9zL4sFnoVQnqaA=="],
 
     "ignore": ["ignore@5.3.2", "", {}, "sha512-hsBTNUqQTDwkWtcdYI2i06Y/nUBEsNEDJKjWdigLvegy8kDuJAS8uRlpkkcQpyEXL0Z/pjDy5HBmMjRCJ2gq+g=="],
@@ -967,28 +1224,80 @@
 
     "ini": ["ini@7.0.0", "", {}, "sha512-ifK0CgjALofS5bkrcTy4RaQ9Vx2Knf/eLeIO+NaswQEpH1UblrtTSCIvN71qQDMq0PeQ/SSPojvEJp9vvvfr+w=="],
 
+    "internal-slot": ["internal-slot@1.1.0", "", { "dependencies": { "es-errors": "^1.3.0", "hasown": "^2.0.2", "side-channel": "^1.1.0" } }, "sha512-4gd7VpWNQNB4UKKCFFVcp1AVv+FMOgs9NKzjHKusc8jTMhd5eL1NqQqOpE0KzMds804/yHlglp3uxgluOqAPLw=="],
+
     "ip-address": ["ip-address@10.2.0", "", {}, "sha512-/+S6j4E9AHvW9SWMSEY9Xfy66O5PWvVEJ08O0y5JGyEKQpojb0K0GKpz/v5HJ/G0vi3D2sjGK78119oXZeE0qA=="],
 
     "ipaddr.js": ["ipaddr.js@1.9.1", "", {}, "sha512-0KI/607xoxSToH7GjN1FfSbLoU0+btTicjsQSWQlh/hZykN8KpmMf7uYwPW3R+akZ6R/w18ZlXSHBYXiYUPO3g=="],
 
+    "is-array-buffer": ["is-array-buffer@3.0.5", "", { "dependencies": { "call-bind": "^1.0.8", "call-bound": "^1.0.3", "get-intrinsic": "^1.2.6" } }, "sha512-DDfANUiiG2wC1qawP66qlTugJeL5HyzMpfr8lLK+jMQirGzNod0B12cFB/9q838Ru27sBwfw78/rdoU7RERz6A=="],
+
+    "is-async-function": ["is-async-function@2.1.1", "", { "dependencies": { "async-function": "^1.0.0", "call-bound": "^1.0.3", "get-proto": "^1.0.1", "has-tostringtag": "^1.0.2", "safe-regex-test": "^1.1.0" } }, "sha512-9dgM/cZBnNvjzaMYHVoxxfPj2QXt22Ev7SuuPrs+xav0ukGB0S6d4ydZdEiM48kLx5kDV+QBPrpVnFyefL8kkQ=="],
+
+    "is-bigint": ["is-bigint@1.1.0", "", { "dependencies": { "has-bigints": "^1.0.2" } }, "sha512-n4ZT37wG78iz03xPRKJrHTdZbe3IicyucEtdRsV5yglwc3GyUfbAfpSeD0FJ41NbUNSt5wbhqfp1fS+BgnvDFQ=="],
+
+    "is-boolean-object": ["is-boolean-object@1.2.2", "", { "dependencies": { "call-bound": "^1.0.3", "has-tostringtag": "^1.0.2" } }, "sha512-wa56o2/ElJMYqjCjGkXri7it5FbebW5usLw/nPmCMs5DeZ7eziSYZhSmPRn0txqeW4LnAmQQU7FgqLpsEFKM4A=="],
+
+    "is-callable": ["is-callable@1.2.7", "", {}, "sha512-1BC0BVFhS/p0qtw6enp8e+8OD0UrK0oFLztSjNzhcKA3WDuJxxAPXzPuPtKkjEY9UUoEWlX/8fgKeu2S8i9JTA=="],
+
     "is-core-module": ["is-core-module@2.16.2", "", { "dependencies": { "hasown": "^2.0.3" } }, "sha512-evOr8xfXKxE6qSR0hSXL2r3sd7ALj8+7jQEUvPYcm5sgZFdJ+AYzT6yNmJenvIYQBgIGwfwz08sL8zoL7yq2BA=="],
 
+    "is-data-view": ["is-data-view@1.0.2", "", { "dependencies": { "call-bound": "^1.0.2", "get-intrinsic": "^1.2.6", "is-typed-array": "^1.1.13" } }, "sha512-RKtWF8pGmS87i2D6gqQu/l7EYRlVdfzemCJN/P3UOs//x1QE7mfhvzHIApBTRf7axvT6DMGwSwBXYCT0nfB9xw=="],
+
+    "is-date-object": ["is-date-object@1.1.0", "", { "dependencies": { "call-bound": "^1.0.2", "has-tostringtag": "^1.0.2" } }, "sha512-PwwhEakHVKTdRNVOw+/Gyh0+MzlCl4R6qKvkhuvLtPMggI1WAHt9sOwZxQLSGpUaDnrdyDsomoRgNnCfKNSXXg=="],
+
+    "is-document.all": ["is-document.all@1.0.0", "", { "dependencies": { "call-bound": "^1.0.4" } }, "sha512-+XSoyS05OdBbhFuELhgTCpFNHkpBOJqtsZfUFFpe5QTw+9Sjbh8zitxhQkYAo6wV7e1Vb8cAPvpCk9jGam/82g=="],
+
     "is-electron": ["is-electron@2.2.2", "", {}, "sha512-FO/Rhvz5tuw4MCWkpMzHFKWD2LsfHzIb7i6MdPYZ/KW7AlxawyLkqdy+jPZP1WubqEADE3O4FUENlJHDfQASRg=="],
 
     "is-extglob": ["is-extglob@2.1.1", "", {}, "sha512-SbKbANkN603Vi4jEZv49LeVJMn4yGwsbzZworEoyEiutsN3nJYdbO36zfhGJ6QEDpOZIFkDtnq5JRxmvl3jsoQ=="],
 
+    "is-finalizationregistry": ["is-finalizationregistry@1.1.1", "", { "dependencies": { "call-bound": "^1.0.3" } }, "sha512-1pC6N8qWJbWoPtEjgcL2xyhQOP491EQjeUo3qTKcmV8YSDDJrOepfG8pcC7h/QgnQHYSv0mJ3Z/ZWxmatVrysg=="],
+
     "is-fullwidth-code-point": ["is-fullwidth-code-point@3.0.0", "", {}, "sha512-zymm5+u+sCsSWyD9qNaejV3DFvhCKclKdizYaJUuHA83RLjb7nSuGnddCHGv0hk+KY7BMAlsWeK4Ueg6EV6XQg=="],
 
+    "is-generator-function": ["is-generator-function@1.1.2", "", { "dependencies": { "call-bound": "^1.0.4", "generator-function": "^2.0.0", "get-proto": "^1.0.1", "has-tostringtag": "^1.0.2", "safe-regex-test": "^1.1.0" } }, "sha512-upqt1SkGkODW9tsGNG5mtXTXtECizwtS2kA161M+gJPc1xdb/Ax629af6YrTwcOeQHbewrPNlE5Dx7kzvXTizA=="],
+
     "is-glob": ["is-glob@4.0.3", "", { "dependencies": { "is-extglob": "^2.1.1" } }, "sha512-xelSayHH36ZgE7ZWhli7pW34hNbNl8Ojv5KVmkJD4hBdD3th8Tfk9vYasLM+mXWOZhFkgZfxhLSnrwRr4elSSg=="],
 
+    "is-map": ["is-map@2.0.3", "", {}, "sha512-1Qed0/Hr2m+YqxnM09CjA2d/i6YZNfF6R2oRAOj36eUdS6qIV/huPJNSEpKbupewFs+ZsJlxsjjPbc0/afW6Lw=="],
+
     "is-module": ["is-module@1.0.0", "", {}, "sha512-51ypPSPCoTEIN9dy5Oy+h4pShgJmPCygKfyRCISBI+JoWT/2oJvK8QPxmwv7b/p239jXrm9M1mlQbyKJ5A152g=="],
 
+    "is-negative-zero": ["is-negative-zero@2.0.3", "", {}, "sha512-5KoIu2Ngpyek75jXodFvnafB6DJgr3u8uuK0LEZJjrU19DrMD3EVERaR8sjz8CCGgpZvxPl9SuE1GMVPFHx1mw=="],
+
+    "is-number-object": ["is-number-object@1.1.1", "", { "dependencies": { "call-bound": "^1.0.3", "has-tostringtag": "^1.0.2" } }, "sha512-lZhclumE1G6VYD8VHe35wFaIif+CTy5SJIi5+3y4psDgWu4wPDoBhF8NxUOinEc7pHgiTsT6MaBb92rKhhD+Xw=="],
+
+    "is-obj": ["is-obj@1.0.1", "", {}, "sha512-l4RyHgRqGN4Y3+9JHVrNqO+tN0rV5My76uW5/nuO4K1b6vw5G8d/cmFjP9tRfEsdhZNt0IFdZuK/c2Vr4Nb+Qg=="],
+
     "is-promise": ["is-promise@4.0.0", "", {}, "sha512-hvpoI6korhJMnej285dSg6nu1+e6uxs7zG3BYAm5byqDsgJNWwxzM6z6iZiAgQR4TJ30JmBTOwqZUw3WlyH3AQ=="],
 
     "is-reference": ["is-reference@3.0.3", "", { "dependencies": { "@types/estree": "^1.0.6" } }, "sha512-ixkJoqQvAP88E6wLydLGGqCJsrFUnqoH6HnaczB8XmDH1oaWU+xxdptvikTgaEhtZ53Ky6YXiBuUI2WXLMCwjw=="],
 
+    "is-regex": ["is-regex@1.2.1", "", { "dependencies": { "call-bound": "^1.0.2", "gopd": "^1.2.0", "has-tostringtag": "^1.0.2", "hasown": "^2.0.2" } }, "sha512-MjYsKHO5O7mCsmRGxWcLWheFqN9DJ/2TmngvjKXihe6efViPqc274+Fx/4fYj/r03+ESvBdTXK0V6tA3rgez1g=="],
+
+    "is-regexp": ["is-regexp@1.0.0", "", {}, "sha512-7zjFAPO4/gwyQAAgRRmqeEeyIICSdmCqa3tsVHMdBzaXXRiqopZL4Cyghg/XulGWrtABTpbnYYzzIRffLkP4oA=="],
+
+    "is-set": ["is-set@2.0.3", "", {}, "sha512-iPAjerrse27/ygGLxw+EBR9agv9Y6uLeYVJMu+QNCoouJ1/1ri0mGrcWpfCqFZuzzx3WjtwxG098X+n4OuRkPg=="],
+
+    "is-shared-array-buffer": ["is-shared-array-buffer@1.0.4", "", { "dependencies": { "call-bound": "^1.0.3" } }, "sha512-ISWac8drv4ZGfwKl5slpHG9OwPNty4jOWPRIhBpxOoD+hqITiwuipOQ2bNthAzwA3B4fIjO4Nln74N0S9byq8A=="],
+
     "is-stream": ["is-stream@2.0.1", "", {}, "sha512-hFoiJiTl63nn+kstHGBtewWSKnQLpyb155KHheA1l39uvtO9nWIop1p3udqPcUd/xbF1VLMO4n7OI6p7RbngDg=="],
 
+    "is-string": ["is-string@1.1.1", "", { "dependencies": { "call-bound": "^1.0.3", "has-tostringtag": "^1.0.2" } }, "sha512-BtEeSsoaQjlSPBemMQIrY1MY0uM6vnS1g5fmufYOtnxLGUZM2178PKbhsk7Ffv58IX+ZtcvoGwccYsh0PglkAA=="],
+
+    "is-symbol": ["is-symbol@1.1.1", "", { "dependencies": { "call-bound": "^1.0.2", "has-symbols": "^1.1.0", "safe-regex-test": "^1.1.0" } }, "sha512-9gGx6GTtCQM73BgmHQXfDmLtfjjTUDSyoxTCbp5WtoixAhfgsDirWIcVQ/IHpvI5Vgd5i/J5F7B9cN/WlVbC/w=="],
+
+    "is-typed-array": ["is-typed-array@1.1.15", "", { "dependencies": { "which-typed-array": "^1.1.16" } }, "sha512-p3EcsicXjit7SaskXHs1hA91QxgTw46Fv6EFKKGS5DRFLD8yKnohjF3hxoju94b/OcMZoQukzpPpBE9uLVKzgQ=="],
+
+    "is-weakmap": ["is-weakmap@2.0.2", "", {}, "sha512-K5pXYOm9wqY1RgjpL3YTkF39tni1XajUIkawTLUo9EZEVUFga5gSQJF8nNS7ZwJQ02y+1YCNYcMh+HIf1ZqE+w=="],
+
+    "is-weakref": ["is-weakref@1.1.1", "", { "dependencies": { "call-bound": "^1.0.3" } }, "sha512-6i9mGWSlqzNMEqpCp93KwRS1uUOodk2OJ6b+sq7ZPDSy2WuI5NFIxp/254TytR8ftefexkWn5xNiHUNpPOfSew=="],
+
+    "is-weakset": ["is-weakset@2.0.4", "", { "dependencies": { "call-bound": "^1.0.3", "get-intrinsic": "^1.2.6" } }, "sha512-mfcwb6IzQyOKTs84CQMrOwW4gQcaTOAWJ0zzJCl2WSPDrWk/OzDaImWFH3djXhb24g4eudZfLRozAvPGw4d9hQ=="],
+
+    "isarray": ["isarray@2.0.5", "", {}, "sha512-xHjhDr3cNBK0BzdUJSPXZntQUx/mwMS5Rw4A7lPJ90XGAO6ISP/ePDNuo0vhqOZU+UD5JoodwCAAoZQd3FeAKw=="],
+
     "isbinaryfile": ["isbinaryfile@5.0.7", "", {}, "sha512-gnWD14Jh3FzS3CPhF0AxNOJ8CxqeblPTADzI38r0wt8ZyQl5edpy75myt08EG2oKvpyiqSqsx+Wkz9vtkbTqYQ=="],
 
     "isexe": ["isexe@3.1.5", "", {}, "sha512-6B3tLtFqtQS4ekarvLVMZ+X+VlvQekbe4taUkf/rhVO3d/h0M2rfARm/pXLcPEsjjMsFgrFgSrhQIxcSVrBz8w=="],
@@ -999,6 +1308,8 @@
 
     "istanbul-reports": ["istanbul-reports@3.2.0", "", { "dependencies": { "html-escaper": "^2.0.0", "istanbul-lib-report": "^3.0.0" } }, "sha512-HGYWWS/ehqTV3xN10i23tkPkpH46MLCIMFNCaaKNavAXTF1RkqxawEPtnjnGZ6XKSInBKkiOA5BKS+aZiY3AvA=="],
 
+    "jackspeak": ["jackspeak@4.2.3", "", { "dependencies": { "@isaacs/cliui": "^9.0.0" } }, "sha512-ykkVRwrYvFm1nb2AJfKKYPr0emF6IiXDYUaFx4Zn9ZuIH7MrzEZ3sD5RlqGXNRpHtvUHJyOnCEFxOlNDtGo7wg=="],
+
     "jake": ["jake@10.9.4", "", { "dependencies": { "async": "^3.2.6", "filelist": "^1.0.4", "picocolors": "^1.1.1" }, "bin": { "jake": "bin/cli.js" } }, "sha512-wpHYzhxiVQL+IV05BLE2Xn34zW1S223hvjtqk0+gsPrwd/8JNLXJgZZM/iPFsYc1xyphF+6M6EvdE5E9MBGkDA=="],
 
     "jiti": ["jiti@2.7.0", "", { "bin": { "jiti": "lib/jiti-cli.mjs" } }, "sha512-AC/7JofJvZGrrneWNaEnJeOLUx+JlGt7tNa0wZiRPT4MY1wmfKjt2+6O2p2uz2+skll8OZZmJMNqeke7kKbNgQ=="],
@@ -1009,6 +1320,8 @@
 
     "js-yaml": ["js-yaml@4.1.1", "", { "dependencies": { "argparse": "^2.0.1" }, "bin": { "js-yaml": "bin/js-yaml.js" } }, "sha512-qQKT4zQxXl8lLwBtHMWwaTcGfFOZviOJet3Oy/xmGk2gZH677CJM9EvtfdSkgWcATZhj/55JZ0rmy3myCT5lsA=="],
 
+    "jsesc": ["jsesc@3.1.0", "", { "bin": { "jsesc": "bin/jsesc" } }, "sha512-/sM3dO2FOzXjKQhJuo0Q173wf2KOo8t4I8vHy6lF9poUp7bKT0/NHE8fPX23PwfhnykfqnC2xRxOnVw5XuGIaA=="],
+
     "json-buffer": ["json-buffer@3.0.1", "", {}, "sha512-4bV5BfR2mqfQTJm+V5tPPdf+ZpuhiIvTuAB5g8kcrXOZpTT/QwwVRWBywX1ozr6lEuPdbHxwaJlm9G6mI2sfSQ=="],
 
     "json-schema-traverse": ["json-schema-traverse@1.0.0", "", {}, "sha512-NM8/P9n3XjXhIZn1lLhkFaACTOURQXjWhV4BA/RnOv8xvgqtqpAX9IO4mRQxSx1Rlo4tqzeqb0sOlruaOy3dug=="],
@@ -1023,6 +1336,8 @@
 
     "jsonfile": ["jsonfile@6.2.1", "", { "dependencies": { "universalify": "^2.0.0" }, "optionalDependencies": { "graceful-fs": "^4.1.6" } }, "sha512-zwOTdL3rFQ/lRdBnntKVOX6k5cKJwEc1HdilT71BWEu7J41gXIB2MRp+vxduPSwZJPWBxEzv4yH1wYLJGUHX4Q=="],
 
+    "jsonpointer": ["jsonpointer@5.0.1", "", {}, "sha512-p/nXbhSEcu3pZRdkW1OfJhpsVtW1gd4Wa1fnQc9YLiTfAjn0312eMKimbdIQzuZl9aa9xUGaRlP9T/CJE/ditQ=="],
+
     "jsonwebtoken": ["jsonwebtoken@9.0.3", "", { "dependencies": { "jws": "^4.0.1", "lodash.includes": "^4.3.0", "lodash.isboolean": "^3.0.3", "lodash.isinteger": "^4.0.4", "lodash.isnumber": "^3.0.3", "lodash.isplainobject": "^4.0.6", "lodash.isstring": "^4.0.1", "lodash.once": "^4.0.0", "ms": "^2.1.1", "semver": "^7.5.4" } }, "sha512-MT/xP0CrubFRNLNKvxJ2BYfy53Zkm++5bX9dtuPbqAeQpTVe0MQTFhao8+Cp//EmJp244xt6Drw/GVEGCUj40g=="],
 
     "jwa": ["jwa@2.0.1", "", { "dependencies": { "buffer-equal-constant-time": "^1.0.1", "ecdsa-sig-formatter": "1.0.11", "safe-buffer": "^5.0.1" } }, "sha512-hRF04fqJIP8Abbkq5NKGN0Bbr3JxlQ+qhZufXVr0DvujKy93ZCbXZMHDL4EOtodSbCWxOqR8MS1tXA5hwqCXDg=="],
@@ -1035,10 +1350,14 @@
 
     "known-css-properties": ["known-css-properties@0.37.0", "", {}, "sha512-JCDrsP4Z1Sb9JwG0aJ8Eo2r7k4Ou5MwmThS/6lcIe1ICyb7UBJKGRIUUdqc2ASdE/42lgz6zFUnzAIhtXnBVrQ=="],
 
+    "kolorist": ["kolorist@1.8.0", "", {}, "sha512-Y+60/zizpJ3HRH8DCss+q95yr6145JXZo46OTpFvDZWLfRCE4qChOyk1b26nMaNpfHHgxagk9dXT5OP0Tfe+dQ=="],
+
     "kubernetes-types": ["kubernetes-types@1.30.0", "", {}, "sha512-Dew1okvhM/SQcIa2rcgujNndZwU8VnSapDgdxlYoB84ZlpAD43U6KLAFqYo17ykSFGHNPrg0qry0bP+GJd9v7Q=="],
 
     "lazy-val": ["lazy-val@1.0.5", "", {}, "sha512-0/BnGCCfyUMkBpeDgWihanIAF9JmZhHBgUhEqzvf+adhNGLoP6TaiI5oF8oyb3I45P+PcnrqihSf01M0l0G5+Q=="],
 
+    "leven": ["leven@3.1.0", "", {}, "sha512-qsda+H8jTaUaN/x5vzW2rzc+8Rw4TAQ/4KjB46IwK5VH+IlVeeeje/EoZRpiXvIqjFgK84QffqPztGI3VBLG1A=="],
+
     "levn": ["levn@0.4.1", "", { "dependencies": { "prelude-ls": "^1.2.1", "type-check": "~0.4.0" } }, "sha512-+bT2uH4E5LGE7h/n3evcS/sQlJXCpIp6ym8OWJ5eV6+67Dsql/LaaT7qJBAt2rzfoa/5QBGBhxDix1dMt2kQKQ=="],
 
     "lightningcss": ["lightningcss@1.32.0", "", { "dependencies": { "detect-libc": "^2.0.3" }, "optionalDependencies": { "lightningcss-android-arm64": "1.32.0", "lightningcss-darwin-arm64": "1.32.0", "lightningcss-darwin-x64": "1.32.0", "lightningcss-freebsd-x64": "1.32.0", "lightningcss-linux-arm-gnueabihf": "1.32.0", "lightningcss-linux-arm64-gnu": "1.32.0", "lightningcss-linux-arm64-musl": "1.32.0", "lightningcss-linux-x64-gnu": "1.32.0", "lightningcss-linux-x64-musl": "1.32.0", "lightningcss-win32-arm64-msvc": "1.32.0", "lightningcss-win32-x64-msvc": "1.32.0" } }, "sha512-NXYBzinNrblfraPGyrbPoD19C1h9lfI/1mzgWYvXUTe414Gz/X1FD2XBZSZM7rRTrMA8JL3OtAaGifrIKhQ5yQ=="],
@@ -1075,6 +1394,8 @@
 
     "lodash": ["lodash@4.18.1", "", {}, "sha512-dMInicTPVE8d1e5otfwmmjlxkZoUpiVLwyeTdUsi/Caj/gfzzblBcCE5sRHV/AsjuCmxWrte2TNGSYuCeCq+0Q=="],
 
+    "lodash.debounce": ["lodash.debounce@4.0.8", "", {}, "sha512-FT1yDzDYEoYWhnSGnpE/4Kj1fLZkDFyqRb7fNt6FdYOSxlUWAtp42Eh6Wb0rGIv/m9Bgo7x4GhQbm5Ys4SG5ow=="],
+
     "lodash.includes": ["lodash.includes@4.3.0", "", {}, "sha512-W3Bx6mdkRTGtlJISOvVD/lbqjTlPPUDTMnlXZFnVwi9NKJ6tiAk6LVdlhZMm17VZisqhKcgzpO5Wz91PCt5b0w=="],
 
     "lodash.isboolean": ["lodash.isboolean@3.0.3", "", {}, "sha512-Bz5mupy2SVbPHURB98VAcw+aHh4vRV5IPNhILUCsOzRmsTmSQ17jIuqopAentWoehktxGd9e/hbIXq980/1QJg=="],
@@ -1091,6 +1412,8 @@
 
     "lodash.snakecase": ["lodash.snakecase@4.1.1", "", {}, "sha512-QZ1d4xoBHYUeuouhEq3lk3Uq7ldgyFXGBhg04+oRLnIz8o9T65Eh+8YdroUwn846zchkA9yDsDl5CVVaV2nqYw=="],
 
+    "lodash.sortby": ["lodash.sortby@4.7.0", "", {}, "sha512-HDWXG8isMntAyRF5vZ7xKuEvOhT4AhlRt/3czTSjvGUxjYCBVRQY48ViDHyfYz9VIoBkW4TMGQNapx+l3RUwdA=="],
+
     "lowercase-keys": ["lowercase-keys@2.0.0", "", {}, "sha512-tqNXrS78oMOE73NMxK4EMLQsQowWf8jKooH9g7xPavRT706R6bkQJ6DY2Te7QukaZsulxa30wQ7bk0pm4XiHmA=="],
 
     "lru-cache": ["lru-cache@6.0.0", "", { "dependencies": { "yallist": "^4.0.0" } }, "sha512-Jo6dJ04CmSjuznwJSS3pUeWmd/H0ffTlkXXgwZi+eq1UCmqQwCh+eLsYOYCwY991i2Fah4h1BEMCx4qThGbsiA=="],
@@ -1161,6 +1484,8 @@
 
     "node-gyp-build-optional-packages": ["node-gyp-build-optional-packages@5.2.2", "", { "dependencies": { "detect-libc": "^2.0.1" }, "bin": { "node-gyp-build-optional-packages": "bin.js", "node-gyp-build-optional-packages-optional": "optional.js", "node-gyp-build-optional-packages-test": "build-test.js" } }, "sha512-s+w+rBWnpTMwSFbaE0UXsRlg7hU4FjekKU4eyAih5T8nJuNZT1nNsskXpxmeqSK9UzkBl6UgRlnKc8hz8IEqOw=="],
 
+    "node-releases": ["node-releases@2.0.50", "", {}, "sha512-J6l92tKHX6w8Jy5nO1Vuc01NoIiRGi/d6qBKVxh+IQ8Cr3b6HbVNfKiF8ZpFKufTwpwxMmce2W3iQZ861ZRyTg=="],
+
     "nopt": ["nopt@9.0.0", "", { "dependencies": { "abbrev": "^4.0.0" }, "bin": { "nopt": "bin/nopt.js" } }, "sha512-Zhq3a+yFKrYwSBluL4H9XP3m3y5uvQkB/09CwDruCiRmR/UJYnn9W4R48ry0uGC70aeTPKLynBtscP9efFFcPw=="],
 
     "normalize-url": ["normalize-url@6.1.0", "", {}, "sha512-DlL+XwOy3NxAQ8xuC0okPgK46iuVNAK01YN7RueYBqqFeGsBjV9XmCAzAdgt+667bCl5kPh9EqKKDwnaPG1I7A=="],
@@ -1171,6 +1496,8 @@
 
     "object-keys": ["object-keys@1.1.1", "", {}, "sha512-NuAESUOUMrlIXOfHKzD6bpPu3tYt3xvjNdRIQ+FeT0lNb4K8WR70CaDxhuNguS2XG+GjkyMwOzsN5ZktImfhLA=="],
 
+    "object.assign": ["object.assign@4.1.7", "", { "dependencies": { "call-bind": "^1.0.8", "call-bound": "^1.0.3", "define-properties": "^1.2.1", "es-object-atoms": "^1.0.0", "has-symbols": "^1.1.0", "object-keys": "^1.1.1" } }, "sha512-nK28WOo+QIjBkDduTINE4JkF/UJJKyf2EJxvJKfblDpyg0Q+pkOHNTL0Qwy6NP6FhE/EnzV73BxxqcJaXY9anw=="],
+
     "obug": ["obug@2.1.1", "", {}, "sha512-uTqF9MuPraAQ+IsnPf366RG4cP9RtUi7MLO1N3KEc+wb0a6yKpeL0lmk2IB1jY5KHPAlTc6T/JRdC/YqxHNwkQ=="],
 
     "on-finished": ["on-finished@2.4.1", "", { "dependencies": { "ee-first": "1.1.1" } }, "sha512-oVlzkg3ENAhCk2zdv7IJwd/QUD4z2RxRwpkcGY8psCVcCYZNq4wYnVWALHM+brtuJjePWiYF/ClmuDr8Ch5+kg=="],
@@ -1181,6 +1508,8 @@
 
     "optionator": ["optionator@0.9.4", "", { "dependencies": { "deep-is": "^0.1.3", "fast-levenshtein": "^2.0.6", "levn": "^0.4.1", "prelude-ls": "^1.2.1", "type-check": "^0.4.0", "word-wrap": "^1.2.5" } }, "sha512-6IpQ7mKUxRcZNLIObR0hz7lxsapSSIYNZJwXPGeF0mTVqGKFIXj1DQcMoT22S3ROcLyY/rz0PWaWZ9ayWmad9g=="],
 
+    "own-keys": ["own-keys@1.0.1", "", { "dependencies": { "get-intrinsic": "^1.2.6", "object-keys": "^1.1.1", "safe-push-apply": "^1.0.0" } }, "sha512-qFOyK5PjiWZd+QQIh+1jhdb9LpxTF0qs7Pm8o5QHYZ0M3vKqSqzsZaEB6oWlxZ+q2sJBMI/Ktgd2N5ZwQoRHfg=="],
+
     "p-cancelable": ["p-cancelable@2.1.1", "", {}, "sha512-BZOr3nRQHOntUjTrH8+Lh54smKHoHyur8We1V8DSMVrl5A2malOOwuJRnKRDjSnkoeBh4at6BwEnb5I7Jl31wg=="],
 
     "p-finally": ["p-finally@1.0.0", "", {}, "sha512-LICb2p9CB7FS+0eR1oqWnHhp0FljGLZCWBE9aix0Uye9W8LTQPwMTYVGWQWIw9RdQiDg4+epXQODwIYJtSJaow=="],
@@ -1195,6 +1524,8 @@
 
     "p-timeout": ["p-timeout@3.2.0", "", { "dependencies": { "p-finally": "^1.0.0" } }, "sha512-rhIwUycgwwKcP9yTOOFK/AKsAopjjCakVqLHePO3CC6Mir1Z99xT+R63jZxAT5lFZLa2inS5h+ZS2GvR99/FBg=="],
 
+    "package-json-from-dist": ["package-json-from-dist@1.0.1", "", {}, "sha512-UEZIS3/by4OC8vL3P2dTXRETpebLI2NiI5vIrjaD/5UtrkFX/tNbwjTSRAGC/+7CAo2pIcBaRgWmcBBHcsaCIw=="],
+
     "parseurl": ["parseurl@1.3.3", "", {}, "sha512-CiyeOxFT/JZyN5m0z9PfXw4SCBJ6Sygz1Dpl0wqjlhDEGGBP1GnsUVEL0p63hoG1fcj3fHynXi9NYO4nWOL+qQ=="],
 
     "path-exists": ["path-exists@4.0.0", "", {}, "sha512-ak9Qy5Q7jYb2Wwcey5Fpvg2KoAc/ZIhLSLOSBmRmygPsGwkVVt0fZa0qrtMz+m6tJTAHfZQ8FnmB4MG4LWy7/w=="],
@@ -1205,6 +1536,8 @@
 
     "path-parse": ["path-parse@1.0.7", "", {}, "sha512-LDJzPVEEEPR+y48z93A0Ed0yXb8pAByGWo/k5YYdYgpY2/2EsOsksJrq7lOHxryrVOn1ejG6oAp8ahvOIQD8sw=="],
 
+    "path-scurry": ["path-scurry@2.0.2", "", { "dependencies": { "lru-cache": "^11.0.0", "minipass": "^7.1.2" } }, "sha512-3O/iVVsJAPsOnpwWIeD+d6z/7PmqApyQePUtCndjatj/9I5LylHvt5qluFaBT3I5h3r1ejfR056c+FCv+NnNXg=="],
+
     "path-to-regexp": ["path-to-regexp@8.4.2", "", {}, "sha512-qRcuIdP69NPm4qbACK+aDogI5CBDMi1jKe0ry5rSQJz8JVLsC7jV8XpiJjGRLLol3N+R5ihGYcrPLTno6pAdBA=="],
 
     "pathe": ["pathe@2.0.3", "", {}, "sha512-WUjGcAqP1gQacoQe+OBJsFA7Ld4DyXuUIjZ5cc75cLHvJ7dtNsTugphxIADwspS+AraAUePCKrSVtPLFj/F88w=="],
@@ -1227,6 +1560,8 @@
 
     "pngjs": ["pngjs@7.0.0", "", {}, "sha512-LKWqWJRhstyYo9pGvgor/ivk2w94eSjE3RGVuzLGlr3NmD8bf7RcYGze1mNdEHRP6TRP6rMuDHk5t44hnTRyow=="],
 
+    "possible-typed-array-names": ["possible-typed-array-names@1.1.0", "", {}, "sha512-/+5VFTchJDoVj3bhoqi6UeymcD00DAwb1nJwamzPvHEszJ4FpF6SNNbUbOS8yI56qHzdV8eK0qEfOSiodkTdxg=="],
+
     "postcss": ["postcss@8.5.15", "", { "dependencies": { "nanoid": "^3.3.12", "picocolors": "^1.1.1", "source-map-js": "^1.2.1" } }, "sha512-FfR8sjd4em2T6fb3I2MwAJU7HWVMr9zba+enmQeeWFfCbm+UOC/0X4DS8XtpUTMwWMGbjKYP7xjfNekzyGmB3A=="],
 
     "postcss-load-config": ["postcss-load-config@3.1.4", "", { "dependencies": { "lilconfig": "^2.0.5", "yaml": "^1.10.2" }, "peerDependencies": { "postcss": ">=8.0.9", "ts-node": ">=9.0.0" }, "optionalPeers": ["postcss", "ts-node"] }, "sha512-6DiM4E7v4coTE4uzA8U//WhtPwyhiim3eyjEMFCnUpzbrkK9wJHgKDT2mR+HbtSrd/NubVaYTOpSpjUl8NQeRg=="],
@@ -1245,6 +1580,8 @@
 
     "prettier-plugin-svelte": ["prettier-plugin-svelte@4.0.1", "", { "peerDependencies": { "prettier": "^3.0.0", "svelte": "^5.0.0" } }, "sha512-oDVmtKi+M8bJeUoMfPvulUqZYcuXrs5AmhhLYPKtBeg6hcpMdx7UYYisVCqEaLQuKtiPSYFpotfwp4cZK3D4xw=="],
 
+    "pretty-bytes": ["pretty-bytes@6.1.1", "", {}, "sha512-mQUvGU6aUFQ+rNvTIAcZuWGRT9a6f6Yrg9bHs4ImKF+HZCEK+plBvnAZYSIQztknZF2qnzNtr6F8s0+IuptdlQ=="],
+
     "proc-log": ["proc-log@6.1.0", "", {}, "sha512-iG+GYldRf2BQ0UDUAd6JQ/RwzaQy6mXmsk/IzlYyal4A4SNFw54MeH4/tLkF4I5WoWG9SQwuqWzS99jaFQHBuQ=="],
 
     "progress": ["progress@2.0.3", "", {}, "sha512-7PiHtLll5LdnKIMw100I+8xJXR5gW2QwWYkT6iJva0bXitZKa/XMrSbdmg3r2Xnaidz9Qumd0VPaMrZlF9V9sA=="],
@@ -1277,6 +1614,20 @@
 
     "readdirp": ["readdirp@4.1.2", "", {}, "sha512-GDhwkLfywWL2s6vEjyhri+eXmfH6j1L7JE27WhqLeYzoh/A3DBaYGEj2H/HFZCn/kMfim73FXxEJTw06WtxQwg=="],
 
+    "reflect.getprototypeof": ["reflect.getprototypeof@1.0.10", "", { "dependencies": { "call-bind": "^1.0.8", "define-properties": "^1.2.1", "es-abstract": "^1.23.9", "es-errors": "^1.3.0", "es-object-atoms": "^1.0.0", "get-intrinsic": "^1.2.7", "get-proto": "^1.0.1", "which-builtin-type": "^1.2.1" } }, "sha512-00o4I+DVrefhv+nX0ulyi3biSHCPDe+yLv5o/p6d/UVlirijB8E16FtfwSAi4g3tcqrQ4lRAqQSoFEZJehYEcw=="],
+
+    "regenerate": ["regenerate@1.4.2", "", {}, "sha512-zrceR/XhGYU/d/opr2EKO7aRHUeiBI8qjtfHqADTwZd6Szfy16la6kqD0MIUs5z5hx6AaKa+PixpPrR289+I0A=="],
+
+    "regenerate-unicode-properties": ["regenerate-unicode-properties@10.2.2", "", { "dependencies": { "regenerate": "^1.4.2" } }, "sha512-m03P+zhBeQd1RGnYxrGyDAPpWX/epKirLrp8e3qevZdVkKtnCrjjWczIbYc8+xd6vcTStVlqfycTx1KR4LOr0g=="],
+
+    "regexp.prototype.flags": ["regexp.prototype.flags@1.5.4", "", { "dependencies": { "call-bind": "^1.0.8", "define-properties": "^1.2.1", "es-errors": "^1.3.0", "get-proto": "^1.0.1", "gopd": "^1.2.0", "set-function-name": "^2.0.2" } }, "sha512-dYqgNSZbDwkaJ2ceRd9ojCGjBq+mOm9LmtXnAnEGyHhN/5R7iDW2TRw3h+o/jCFxus3P2LfWIIiwowAjANm7IA=="],
+
+    "regexpu-core": ["regexpu-core@6.4.0", "", { "dependencies": { "regenerate": "^1.4.2", "regenerate-unicode-properties": "^10.2.2", "regjsgen": "^0.8.0", "regjsparser": "^0.13.0", "unicode-match-property-ecmascript": "^2.0.0", "unicode-match-property-value-ecmascript": "^2.2.1" } }, "sha512-0ghuzq67LI9bLXpOX/ISfve/Mq33a4aFRzoQYhnnok1JOFpmE/A2TBGkNVenOGEeSBCjIiWcc6MVOG5HEQv0sA=="],
+
+    "regjsgen": ["regjsgen@0.8.0", "", {}, "sha512-RvwtGe3d7LvWiDQXeQw8p5asZUmfU1G/l6WbUXeHta7Y2PEIvBTwH6E2EfmYUK8pxcxEdEmaomqyp0vZZ7C+3Q=="],
+
+    "regjsparser": ["regjsparser@0.13.2", "", { "dependencies": { "jsesc": "~3.1.0" }, "bin": { "regjsparser": "bin/parser" } }, "sha512-NgRBy2Nx/bE+9F27nVHnqcN5HjyLmecqsqx2PJHu3/IEtADD4WuxuXIVExD5PoSDFVrl78dOonfcOe5O+5nbzQ=="],
+
     "require-directory": ["require-directory@2.1.1", "", {}, "sha512-fGxEI7+wsG9xrvdjsrlmL22OMTTiHRwAMroiEeMgq8gzoLC/PQr7RsRDSTLUg/bZAZtF+TVIkHc6/4RIKrui+Q=="],
 
     "require-from-string": ["require-from-string@2.0.2", "", {}, "sha512-Xf0nWe6RseziFMu+Ap9biiUbmplq6S9/p+7w7YXP/JBHhrUDDUhwa+vANyubuqfZWTveU//DYVGsDG7RKL/vEw=="],
@@ -1303,8 +1654,14 @@
 
     "sade": ["sade@1.8.1", "", { "dependencies": { "mri": "^1.1.0" } }, "sha512-xal3CZX1Xlo/k4ApwCFrHVACi9fBqJ7V+mwhBsuf/1IOKbBy098Fex+Wa/5QMubw09pSZ/u8EY8PWgevJsXp1A=="],
 
+    "safe-array-concat": ["safe-array-concat@1.1.4", "", { "dependencies": { "call-bind": "^1.0.9", "call-bound": "^1.0.4", "get-intrinsic": "^1.3.0", "has-symbols": "^1.1.0", "isarray": "^2.0.5" } }, "sha512-wtZlHyOje6OZTGqAoaDKxFkgRtkF9CnHAVnCHKfuj200wAgL+bSJhdsCD2l0Qx/2ekEXjPWcyKkfGb5CPboslg=="],
+
     "safe-buffer": ["safe-buffer@5.2.1", "", {}, "sha512-rp3So07KcdmmKbGvgaNxQSJr7bGVSVk5S9Eq1F+ppbRo70+YeaDxkw5Dd8NPN+GD6bjnYm2VuPuCXmpuYvmCXQ=="],
 
+    "safe-push-apply": ["safe-push-apply@1.0.0", "", { "dependencies": { "es-errors": "^1.3.0", "isarray": "^2.0.5" } }, "sha512-iKE9w/Z7xCzUMIZqdBsp6pEQvwuEebH4vdpjcDWnyzaI6yl6O9FHvVpmGelvEHNsoY6wGblkxR6Zty/h00WiSA=="],
+
+    "safe-regex-test": ["safe-regex-test@1.1.0", "", { "dependencies": { "call-bound": "^1.0.2", "es-errors": "^1.3.0", "is-regex": "^1.2.1" } }, "sha512-x/+Cz4YrimQxQccJf5mKEbIa1NzeCRNI5Ecl/ekmlYaampdNLPalVyIcCZNNH3MvmqBugV5TMYZXv0ljslUlaw=="],
+
     "safer-buffer": ["safer-buffer@2.1.2", "", {}, "sha512-YZo3K82SD7Riyi0E1EQPojLz7kpepnSQI9IyPbHHg1XXXevb5dJI7tpyN2ADxGcQbHG7vcyRHk0cbwqcQriUtg=="],
 
     "sanitize-filename": ["sanitize-filename@1.6.4", "", { "dependencies": { "truncate-utf8-bytes": "^1.0.0" } }, "sha512-9ZyI08PsvdQl2r/bBIGubpVdR3RR9sY6RDiWFPreA21C/EFlQhmgo20UZlNjZMMZNubusLhAQozkA0Od5J21Eg=="],
@@ -1319,10 +1676,18 @@
 
     "serialize-error": ["serialize-error@7.0.1", "", { "dependencies": { "type-fest": "^0.13.1" } }, "sha512-8I8TjW5KMOKsZQTvoxjuSIa7foAwPWGOts+6o7sgjz41/qMD9VQHEDxi6PBvK2l0MXUmqZyNpUK+T2tQaaElvw=="],
 
+    "serialize-javascript": ["serialize-javascript@7.0.7", "", {}, "sha512-YAy8Od6KV+uuwUuU50np8fGB/Aues6Y0nAhA9y/hId74PlKUcme4pXcBD46NWKr1Q4osN/iseZ17YqO1XfmI8g=="],
+
     "serve-static": ["serve-static@2.2.1", "", { "dependencies": { "encodeurl": "^2.0.0", "escape-html": "^1.0.3", "parseurl": "^1.3.3", "send": "^1.2.0" } }, "sha512-xRXBn0pPqQTVQiC8wyQrKs2MOlX24zQ0POGaj0kultvoOCstBQM5yvOhAVSUwOMjQtTvsPWoNCHfPGwaaQJhTw=="],
 
     "set-cookie-parser": ["set-cookie-parser@3.1.0", "", {}, "sha512-kjnC1DXBHcxaOaOXBHBeRtltsDG2nUiUni+jP92M9gYdW12rsmx92UsfpH7o5tDRs7I1ZZPSQJQGv3UaRfCiuw=="],
 
+    "set-function-length": ["set-function-length@1.2.2", "", { "dependencies": { "define-data-property": "^1.1.4", "es-errors": "^1.3.0", "function-bind": "^1.1.2", "get-intrinsic": "^1.2.4", "gopd": "^1.0.1", "has-property-descriptors": "^1.0.2" } }, "sha512-pgRc4hJ4/sNjWCSS9AmnS40x3bNMDTknHgL5UaMBTMyJnU90EgWh1Rz+MC9eFu4BuN/UwZjKQuY/1v3rM7HMfg=="],
+
+    "set-function-name": ["set-function-name@2.0.2", "", { "dependencies": { "define-data-property": "^1.1.4", "es-errors": "^1.3.0", "functions-have-names": "^1.2.3", "has-property-descriptors": "^1.0.2" } }, "sha512-7PGFlmtwsEADb0WYyvCMa1t+yke6daIG4Wirafur5kcf+MhUnPms1UeR0CKQdTZD81yESwMHbtn+TR+dMviakQ=="],
+
+    "set-proto": ["set-proto@1.0.0", "", { "dependencies": { "dunder-proto": "^1.0.1", "es-errors": "^1.3.0", "es-object-atoms": "^1.0.0" } }, "sha512-RJRdvCo6IAnPdsvP/7m6bsQqNnn1FCBX5ZNtFL98MmFF/4xAIJTIg1YbHW5DC2W5SKZanrC6i4HsJqlajw/dZw=="],
+
     "setprototypeof": ["setprototypeof@1.2.0", "", {}, "sha512-E5LDX7Wrp85Kil5bhZv46j8jOeboKq5JMmYM3gVGdGH8xFpPWXUMsNrlODCrkoxMEeNi/XZIwuRvY4XNwYMJpw=="],
 
     "shebang-command": ["shebang-command@2.0.0", "", { "dependencies": { "shebang-regex": "^3.0.0" } }, "sha512-kHxr2zZpYtdmrN1qDjrrX/Z1rR1kG8Dx+gkpK1G4eXmvXswmcE1hTWBWYUzlraYw1/yZp6YuDY77YtvbN0dmDA=="],
@@ -1349,7 +1714,9 @@
 
     "smart-buffer": ["smart-buffer@4.2.0", "", {}, "sha512-94hK0Hh8rPqQl2xXc3HsaBoOXKV20MToPkcXvwbISWLEs+64sBq5kFgn2kJDHb1Pry9yrP0dxrCI9RRci7RXKg=="],
 
-    "source-map": ["source-map@0.6.1", "", {}, "sha512-UjgapumWlbMhkBgzT7Ykc5YXUT46F0iKu8SGXq0bcwP5dz/h0Plj6enJqjz1Zbq2l5WaqYnrVbwWOWMyF3F47g=="],
+    "smob": ["smob@1.6.2", "", {}, "sha512-RQsvleCbF8cVHEv+xuDGaA4pOizFqJ0GgjtMSRo6oP8pnN7WsigHgVGey6aILRBKv4W2YOMHLqbKdnB6hpB9fw=="],
+
+    "source-map": ["source-map@0.8.0-beta.0", "", { "dependencies": { "whatwg-url": "^7.0.0" } }, "sha512-2ymg6oRBpebeZi9UUNsgQ89bhx01TcTkmNTGnNO88imTmbSgy4nfujrgVEFKWpMTEGA11EDkTt7mqObTPdigIA=="],
 
     "source-map-js": ["source-map-js@1.2.1", "", {}, "sha512-UXWMKhLOwVKb728IUtQPXxfYU+usdybtUrK/8uGE8CQMvrhOpwvzDBwj0QhSL7MQc7vIsISBG8VQ8+IDQxpfQA=="],
 
@@ -1365,10 +1732,24 @@
 
     "std-env": ["std-env@4.1.0", "", {}, "sha512-Rq7ybcX2RuC55r9oaPVEW7/xu3tj8u4GeBYHBWCychFtzMIr86A7e3PPEBPT37sHStKX3+TiX/Fr/ACmJLVlLQ=="],
 
+    "stop-iteration-iterator": ["stop-iteration-iterator@1.1.0", "", { "dependencies": { "es-errors": "^1.3.0", "internal-slot": "^1.1.0" } }, "sha512-eLoXW/DHyl62zxY4SCaIgnRhuMr6ri4juEYARS8E6sCEqzKpOiE521Ucofdx+KnDZl5xmvGYaaKCk5FEOxJCoQ=="],
+
     "string-width": ["string-width@4.2.3", "", { "dependencies": { "emoji-regex": "^8.0.0", "is-fullwidth-code-point": "^3.0.0", "strip-ansi": "^6.0.1" } }, "sha512-wKyQRQpjJ0sIp62ErSZdGsjMJWsap5oRNihHhu6G7JVO/9jIB6UyevL+tXuOqrng8j/cxKTWyWUwvSTriiZz/g=="],
 
+    "string.prototype.matchall": ["string.prototype.matchall@4.0.12", "", { "dependencies": { "call-bind": "^1.0.8", "call-bound": "^1.0.3", "define-properties": "^1.2.1", "es-abstract": "^1.23.6", "es-errors": "^1.3.0", "es-object-atoms": "^1.0.0", "get-intrinsic": "^1.2.6", "gopd": "^1.2.0", "has-symbols": "^1.1.0", "internal-slot": "^1.1.0", "regexp.prototype.flags": "^1.5.3", "set-function-name": "^2.0.2", "side-channel": "^1.1.0" } }, "sha512-6CC9uyBL+/48dYizRf7H7VAYCMCNTBeM78x/VTUe9bFEaxBepPJDa1Ow99LqI/1yF7kuy7Q3cQsYMrcjGUcskA=="],
+
+    "string.prototype.trim": ["string.prototype.trim@1.2.11", "", { "dependencies": { "call-bind": "^1.0.9", "call-bound": "^1.0.4", "define-data-property": "^1.1.4", "define-properties": "^1.2.1", "es-abstract": "^1.24.2", "es-object-atoms": "^1.1.2", "has-property-descriptors": "^1.0.2", "safe-regex-test": "^1.1.0" } }, "sha512-PwvK7BU+CMTJGYQCTZb5RWXIML92lftJLhQz1tBzgKiqGxJaMlBAa48POXaNAC2s4y8jr3EFqrkF9+44neS46w=="],
+
+    "string.prototype.trimend": ["string.prototype.trimend@1.0.10", "", { "dependencies": { "call-bind": "^1.0.9", "call-bound": "^1.0.4", "define-properties": "^1.2.1", "es-object-atoms": "^1.1.2" } }, "sha512-2+3aDAOmPTmuFwjDnmJG2ctEkQKVki7vOSqaxkv42Mowj1V6PnvuwFCRrR5lChUux1TBskPjfkeTOhqczDMxTw=="],
+
+    "string.prototype.trimstart": ["string.prototype.trimstart@1.0.8", "", { "dependencies": { "call-bind": "^1.0.7", "define-properties": "^1.2.1", "es-object-atoms": "^1.0.0" } }, "sha512-UXSH262CSZY1tfu3G3Secr6uGLCFVPMhIqHjlgCUtCCcgihYc/xKs9djMTMUOb2j1mVSeU8EU6NWc/iQKU6Gfg=="],
+
+    "stringify-object": ["stringify-object@3.3.0", "", { "dependencies": { "get-own-enumerable-property-symbols": "^3.0.0", "is-obj": "^1.0.1", "is-regexp": "^1.0.0" } }, "sha512-rHqiFh1elqCQ9WPLIC8I0Q/g/wj5J1eMkyoiD6eoQApWHP0FtlK7rqnhmabL5VUY9JQCcqwwvlOaSuutekgyrw=="],
+
     "strip-ansi": ["strip-ansi@6.0.1", "", { "dependencies": { "ansi-regex": "^5.0.1" } }, "sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A=="],
 
+    "strip-comments": ["strip-comments@2.0.1", "", {}, "sha512-ZprKx+bBLXv067WTCALv8SSz5l2+XhpYCsVtSqlMnkAXMWDq+/ekVbl1ghqP9rUHTzv6sm/DwCOiYutU/yp1fw=="],
+
     "sumchecker": ["sumchecker@3.0.1", "", { "dependencies": { "debug": "^4.1.0" } }, "sha512-MvjXzkz/BOfyVDkG0oFOtBxHX2u3gKbMHIF/dXblZsgD3BWOFLmHovIpZY7BykJdAjcqRCBi1WYBNdEC9yI7vg=="],
 
     "supports-color": ["supports-color@7.2.0", "", { "dependencies": { "has-flag": "^4.0.0" } }, "sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw=="],
@@ -1385,8 +1766,14 @@
 
     "temp": ["temp@0.9.4", "", { "dependencies": { "mkdirp": "^0.5.1", "rimraf": "~2.6.2" } }, "sha512-yYrrsWnrXMcdsnu/7YMYAofM1ktpL5By7vZhf15CrXijWWrEYZks5AXBudalfSWJLlnen/QUJUB5aoB0kqZUGA=="],
 
+    "temp-dir": ["temp-dir@2.0.0", "", {}, "sha512-aoBAniQmmwtcKp/7BzsH8Cxzv8OL736p7v1ihGb5e9DJ9kTwGWHrQrVB5+lfVDzfGrdRzXch+ig7LHaY1JTOrg=="],
+
     "temp-file": ["temp-file@3.4.0", "", { "dependencies": { "async-exit-hook": "^2.0.1", "fs-extra": "^10.0.0" } }, "sha512-C5tjlC/HCtVUOi3KWVokd4vHVViOmGjtLwIh4MuzPo/nMYTV/p1urt3RnMz2IWXDdKEGJH3k5+KPxtqRsUYGtg=="],
 
+    "tempy": ["tempy@0.6.0", "", { "dependencies": { "is-stream": "^2.0.0", "temp-dir": "^2.0.0", "type-fest": "^0.16.0", "unique-string": "^2.0.0" } }, "sha512-G13vtMYPT/J8A4X2SjdtBTphZlrp1gKv6hZiOjw14RCWg6GbHuQBGtjlx75xLbYV/wEc0D7G5K4rxKP/cXk8Bw=="],
+
+    "terser": ["terser@5.48.0", "", { "dependencies": { "@jridgewell/source-map": "^0.3.3", "acorn": "^8.15.0", "commander": "^2.20.0", "source-map-support": "~0.5.20" }, "bin": { "terser": "bin/terser" } }, "sha512-J/9An6vs9Us6wKRriSFXBWdRZapREHqFzdNUKk0pmu804EMR6dr6winwo7e5JDxN4xahxQsuysyYFwlwj4XN/Q=="],
+
     "tiny-async-pool": ["tiny-async-pool@1.3.0", "", { "dependencies": { "semver": "^5.5.0" } }, "sha512-01EAw5EDrcVrdgyCLgoSPvqznC0sVxDSVeiOz09FUpjh71G79VCqneOr+xvt7T1r76CF6ZZfPjHorN2+d+3mqA=="],
 
     "tinybench": ["tinybench@2.9.0", "", {}, "sha512-0+DUvqWMValLmha6lr4kD8iAMK1HzV0/aKnCtWb9v9641TnP/MFb7Pc2bxoxQjTXAErryXVgUOfv2YqNllqGeg=="],
@@ -1407,6 +1794,8 @@
 
     "totalist": ["totalist@3.0.1", "", {}, "sha512-sf4i37nQ2LBx4m3wB74y+ubopq6W/dIzXg0FDGjsYnZHVa1Da8FH853wlL2gtUhg+xJXjfk3kUZS3BRoQeoQBQ=="],
 
+    "tr46": ["tr46@1.0.1", "", { "dependencies": { "punycode": "^2.1.0" } }, "sha512-dTpowEjclQ7Kgx5SdBkqRzVhERQXov8/l9Ft9dVM9fmg0W0KQSVaXX9T4i6twCPNtYiZM53lpSSUAwJbFPOHxA=="],
+
     "truncate-utf8-bytes": ["truncate-utf8-bytes@1.0.2", "", { "dependencies": { "utf8-byte-length": "^1.0.1" } }, "sha512-95Pu1QXQvruGEhv62XCMO3Mm90GscOCClvrIUwCM0PYOXK3kaF3l3sIHxx71ThJfcbM2O5Au6SO3AWCSEfW4mQ=="],
 
     "ts-api-utils": ["ts-api-utils@2.5.0", "", { "peerDependencies": { "typescript": ">=4.8.4" } }, "sha512-OJ/ibxhPlqrMM0UiNHJ/0CKQkoKF243/AEmplt3qpRgkW8VG7IfOS41h7V8TjITqdByHzrjcS/2si+y4lIh8NA=="],
@@ -1419,24 +1808,48 @@
 
     "type-check": ["type-check@0.4.0", "", { "dependencies": { "prelude-ls": "^1.2.1" } }, "sha512-XleUoc9uwGXqjWwXaUTZAmzMcFZ5858QA2vvx1Ur5xIcixXIP+8LnFDgRplU30us6teqdlskFfu+ae4K79Ooew=="],
 
-    "type-fest": ["type-fest@0.13.1", "", {}, "sha512-34R7HTnG0XIJcBSn5XhDd7nNFPRcXYRZrBB2O2jdKqYODldSzBAqzsWoZYYvduky73toYS/ESqxPvkDf/F0XMg=="],
+    "type-fest": ["type-fest@0.16.0", "", {}, "sha512-eaBzG6MxNzEn9kiwvtre90cXaNLkmadMWa1zQMs3XORCXNbsH/OewwbxC5ia9dCxIxnTAsSxXJaa/p5y8DlvJg=="],
 
     "type-is": ["type-is@2.1.0", "", { "dependencies": { "content-type": "^2.0.0", "media-typer": "^1.1.0", "mime-types": "^3.0.0" } }, "sha512-faYHw0anBbc/kWF3zFTEnxSFOAGUX9GFbOBthvDdLsIlEoWOFOtS0zgCiQYwIskL9iGXZL3kAXD8OoZ4GmMATA=="],
 
+    "typed-array-buffer": ["typed-array-buffer@1.0.3", "", { "dependencies": { "call-bound": "^1.0.3", "es-errors": "^1.3.0", "is-typed-array": "^1.1.14" } }, "sha512-nAYYwfY3qnzX30IkA6AQZjVbtK6duGontcQm1WSG1MD94YLqK0515GNApXkoxKOWMusVssAHWLh9SeaoefYFGw=="],
+
+    "typed-array-byte-length": ["typed-array-byte-length@1.0.3", "", { "dependencies": { "call-bind": "^1.0.8", "for-each": "^0.3.3", "gopd": "^1.2.0", "has-proto": "^1.2.0", "is-typed-array": "^1.1.14" } }, "sha512-BaXgOuIxz8n8pIq3e7Atg/7s+DpiYrxn4vdot3w9KbnBhcRQq6o3xemQdIfynqSeXeDrF32x+WvfzmOjPiY9lg=="],
+
+    "typed-array-byte-offset": ["typed-array-byte-offset@1.0.4", "", { "dependencies": { "available-typed-arrays": "^1.0.7", "call-bind": "^1.0.8", "for-each": "^0.3.3", "gopd": "^1.2.0", "has-proto": "^1.2.0", "is-typed-array": "^1.1.15", "reflect.getprototypeof": "^1.0.9" } }, "sha512-bTlAFB/FBYMcuX81gbL4OcpH5PmlFHqlCCpAl8AlEzMz5k53oNDvN8p1PNOWLEmI2x4orp3raOFB51tv9X+MFQ=="],
+
+    "typed-array-length": ["typed-array-length@1.0.8", "", { "dependencies": { "call-bind": "^1.0.9", "for-each": "^0.3.5", "gopd": "^1.2.0", "is-typed-array": "^1.1.15", "possible-typed-array-names": "^1.1.0", "reflect.getprototypeof": "^1.0.10" } }, "sha512-phPGCwqr2+Qo0fwniCE8e4pKnGu/yFb5nD5Y8bf0EEeiI5GklnACYA9GFy/DrAeRrKHXvHn+1SUsOWgJp6RO+g=="],
+
     "typescript": ["typescript@6.0.3", "", { "bin": { "tsc": "bin/tsc", "tsserver": "bin/tsserver" } }, "sha512-y2TvuxSZPDyQakkFRPZHKFm+KKVqIisdg9/CZwm9ftvKXLP8NRWj38/ODjNbr43SsoXqNuAisEf1GdCxqWcdBw=="],
 
     "typescript-eslint": ["typescript-eslint@8.59.4", "", { "dependencies": { "@typescript-eslint/eslint-plugin": "8.59.4", "@typescript-eslint/parser": "8.59.4", "@typescript-eslint/typescript-estree": "8.59.4", "@typescript-eslint/utils": "8.59.4" }, "peerDependencies": { "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0", "typescript": ">=4.8.4 <6.1.0" } }, "sha512-Rw6+44QNFaXtgHSjPy+Kw8hrJniMYzR85E9yLmOLcfZ91/rz+JXQbDTCmc6ccxMPY6K6PgAq26f0JCBfR7LIPQ=="],
 
     "uc.micro": ["uc.micro@2.1.0", "", {}, "sha512-ARDJmphmdvUk6Glw7y9DQ2bFkKBHwQHLi2lsaH6PPmz/Ka9sFOBsBluozhDltWmnv9u/cF6Rt87znRTPV+yp/A=="],
 
+    "unbox-primitive": ["unbox-primitive@1.1.0", "", { "dependencies": { "call-bound": "^1.0.3", "has-bigints": "^1.0.2", "has-symbols": "^1.1.0", "which-boxed-primitive": "^1.1.1" } }, "sha512-nWJ91DjeOkej/TA8pXQ3myruKpKEYgqvpw9lz4OPHj/NWFNluYrjbz9j01CJ8yKQd2g4jFoOkINCTW2I5LEEyw=="],
+
     "undici": ["undici@6.24.1", "", {}, "sha512-sC+b0tB1whOCzbtlx20fx3WgCXwkW627p4EA9uM+/tNNPkSS+eSEld6pAs9nDv7WbY1UUljBMYPtu9BCOrCWKA=="],
 
     "undici-types": ["undici-types@7.24.6", "", {}, "sha512-WRNW+sJgj5OBN4/0JpHFqtqzhpbnV0GuB+OozA9gCL7a993SmU+1JBZCzLNxYsbMfIeDL+lTsphD5jN5N+n0zg=="],
 
+    "unicode-canonical-property-names-ecmascript": ["unicode-canonical-property-names-ecmascript@2.0.1", "", {}, "sha512-dA8WbNeb2a6oQzAQ55YlT5vQAWGV9WXOsi3SskE3bcCdM0P4SDd+24zS/OCacdRq5BkdsRj9q3Pg6YyQoxIGqg=="],
+
+    "unicode-match-property-ecmascript": ["unicode-match-property-ecmascript@2.0.0", "", { "dependencies": { "unicode-canonical-property-names-ecmascript": "^2.0.0", "unicode-property-aliases-ecmascript": "^2.0.0" } }, "sha512-5kaZCrbp5mmbz5ulBkDkbY0SsPOjKqVS35VpL9ulMPfSl0J0Xsm+9Evphv9CoIZFwre7aJoa94AY6seMKGVN5Q=="],
+
+    "unicode-match-property-value-ecmascript": ["unicode-match-property-value-ecmascript@2.2.1", "", {}, "sha512-JQ84qTuMg4nVkx8ga4A16a1epI9H6uTXAknqxkGF/aFfRLw1xC/Bp24HNLaZhHSkWd3+84t8iXnp1J0kYcZHhg=="],
+
+    "unicode-property-aliases-ecmascript": ["unicode-property-aliases-ecmascript@2.2.0", "", {}, "sha512-hpbDzxUY9BFwX+UeBnxv3Sh1q7HFxj48DTmXchNgRa46lO8uj3/1iEn3MiNUYTg1g9ctIqXCCERn8gYZhHC5lQ=="],
+
+    "unique-string": ["unique-string@2.0.0", "", { "dependencies": { "crypto-random-string": "^2.0.0" } }, "sha512-uNaeirEPvpZWSgzwsPGtU2zVSTrn/8L5q/IexZmH0eH6SA73CmAA5U4GwORTxQAZs95TAXLNqeLoPPNO5gZfWg=="],
+
     "universalify": ["universalify@2.0.1", "", {}, "sha512-gptHNQghINnc/vTGIk0SOFGFNXw7JVrlRUtConJRlvaw6DuX0wO5Jeko9sWrMBhh+PsYAZ7oXAiOnf/UKogyiw=="],
 
     "unpipe": ["unpipe@1.0.0", "", {}, "sha512-pjy2bYhSsufwWlKwPc+l3cN7+wuJlK6uz0YdJEOlQDbl6jo/YlPi4mb8agUkVC8BF7V8NuzeyPNqRksA3hztKQ=="],
 
+    "upath": ["upath@1.2.0", "", {}, "sha512-aZwGpamFO61g3OlfT7OQCHqhGnW43ieH9WZeP7QxN/G/jS4jfqUkZxoryvJgVPEcrl5NL/ggHsSmLMHuH64Lhg=="],
+
+    "update-browserslist-db": ["update-browserslist-db@1.2.3", "", { "dependencies": { "escalade": "^3.2.0", "picocolors": "^1.1.1" }, "peerDependencies": { "browserslist": ">= 4.21.0" }, "bin": { "update-browserslist-db": "cli.js" } }, "sha512-Js0m9cx+qOgDxo0eMiFGEueWztz+d4+M3rGlmKPT+T4IS/jP4ylw3Nwpu6cpTTP8R1MAC1kF4VbdLt3ARf209w=="],
+
     "uri-js": ["uri-js@4.4.1", "", { "dependencies": { "punycode": "^2.1.0" } }, "sha512-7rKUyy33Q1yc98pQ1DAmLtwX109F7TIfWlW1Ydo8Wl1ii1SeHieeh0HHfPeL2fMXK6z0s8ecKs9frCuLJvndBg=="],
 
     "utf8-byte-length": ["utf8-byte-length@1.0.5", "", {}, "sha512-Xn0w3MtiQ6zoz2vFyUVruaCL53O/DwUvkEeOvj+uulMm0BkUGYWmBYVyElqZaSLhY6ZD0ulfU3aBra2aVT4xfA=="],
@@ -1453,18 +1866,64 @@
 
     "vite-plugin-devtools-json": ["vite-plugin-devtools-json@1.0.0", "", { "dependencies": { "uuid": "^11.1.0" }, "peerDependencies": { "vite": "^5.0.0 || ^6.0.0 || ^7.0.0" } }, "sha512-MobvwqX76Vqt/O4AbnNMNWoXWGrKUqZbphCUle/J2KXH82yKQiunOeKnz/nqEPosPsoWWPP9FtNuPBSYpiiwkw=="],
 
+    "vite-plugin-pwa": ["vite-plugin-pwa@1.3.0", "", { "dependencies": { "debug": "^4.3.6", "pretty-bytes": "^6.1.1", "tinyglobby": "^0.2.10", "workbox-build": "^7.4.1", "workbox-window": "^7.4.1" }, "peerDependencies": { "@vite-pwa/assets-generator": "^1.0.0", "vite": "^3.1.0 || ^4.0.0 || ^5.0.0 || ^6.0.0 || ^7.0.0 || ^8.0.0" }, "optionalPeers": ["@vite-pwa/assets-generator"] }, "sha512-c5kMgN+ITrOtHXp8PAtk2uOIEea6XjP/unCGxOWWBzQ6qa65qj/awHg0wf+QF9E/2u9vh86LqxPwzEPNbM2r5A=="],
+
     "vitefu": ["vitefu@1.1.3", "", { "peerDependencies": { "vite": "^3.0.0 || ^4.0.0 || ^5.0.0 || ^6.0.0 || ^7.0.0 || ^8.0.0" }, "optionalPeers": ["vite"] }, "sha512-ub4okH7Z5KLjb6hDyjqrGXqWtWvoYdU3IGm/NorpgHncKoLTCfRIbvlhBm7r0YstIaQRYlp4yEbFqDcKSzXSSg=="],
 
     "vitest": ["vitest@4.1.7", "", { "dependencies": { "@vitest/expect": "4.1.7", "@vitest/mocker": "4.1.7", "@vitest/pretty-format": "4.1.7", "@vitest/runner": "4.1.7", "@vitest/snapshot": "4.1.7", "@vitest/spy": "4.1.7", "@vitest/utils": "4.1.7", "es-module-lexer": "^2.0.0", "expect-type": "^1.3.0", "magic-string": "^0.30.21", "obug": "^2.1.1", "pathe": "^2.0.3", "picomatch": "^4.0.3", "std-env": "^4.0.0-rc.1", "tinybench": "^2.9.0", "tinyexec": "^1.0.2", "tinyglobby": "^0.2.15", "tinyrainbow": "^3.1.0", "vite": "^6.0.0 || ^7.0.0 || ^8.0.0", "why-is-node-running": "^2.3.0" }, "peerDependencies": { "@edge-runtime/vm": "*", "@opentelemetry/api": "^1.9.0", "@types/node": "^20.0.0 || ^22.0.0 || >=24.0.0", "@vitest/browser-playwright": "4.1.7", "@vitest/browser-preview": "4.1.7", "@vitest/browser-webdriverio": "4.1.7", "@vitest/coverage-istanbul": "4.1.7", "@vitest/coverage-v8": "4.1.7", "@vitest/ui": "4.1.7", "happy-dom": "*", "jsdom": "*" }, "optionalPeers": ["@edge-runtime/vm", "@opentelemetry/api", "@types/node", "@vitest/browser-playwright", "@vitest/browser-preview", "@vitest/browser-webdriverio", "@vitest/coverage-istanbul", "@vitest/coverage-v8", "@vitest/ui", "happy-dom", "jsdom"], "bin": { "vitest": "vitest.mjs" } }, "sha512-flYyaFd2CgoCoU+0UKt3pxksgC+S02iTDN0n3LtqaMeXsI9SBcdNujc2k0DeFLzUn/0k538yNjOSdwgCqcrwJA=="],
 
     "vitest-browser-svelte": ["vitest-browser-svelte@2.1.1", "", { "dependencies": { "@testing-library/svelte-core": "^1.0.0" }, "peerDependencies": { "svelte": "^3 || ^4 || ^5 || ^5.0.0-next.0", "vitest": "^4.0.0" } }, "sha512-qbunYRSm+N92r9bfTkdDTpBZESLmp4QFz2SluV3n/x8U7ysosfeXYJZ4vXbJ0Y0LzoqqDnV5LHprmFgn4Eo+Ug=="],
 
+    "webidl-conversions": ["webidl-conversions@4.0.2", "", {}, "sha512-YQ+BmxuTgd6UXZW3+ICGfyqRyHXVlD5GtQr5+qjiNW7bF0cqrzX500HVXPBOvgXb5YnzDd+h0zqyv61KUD7+Sg=="],
+
+    "whatwg-url": ["whatwg-url@7.1.0", "", { "dependencies": { "lodash.sortby": "^4.7.0", "tr46": "^1.0.1", "webidl-conversions": "^4.0.2" } }, "sha512-WUu7Rg1DroM7oQvGWfOiAK21n74Gg+T4elXEQYkOhtyLeWiJFoOGLXPKI/9gzIie9CtwVLm8wtw6YJdKyxSjeg=="],
+
     "which": ["which@5.0.0", "", { "dependencies": { "isexe": "^3.1.1" }, "bin": { "node-which": "bin/which.js" } }, "sha512-JEdGzHwwkrbWoGOlIHqQ5gtprKGOenpDHpxE9zVR1bWbOtYRyPPHMe9FaP6x61CmNaTThSkb0DAJte5jD+DmzQ=="],
 
+    "which-boxed-primitive": ["which-boxed-primitive@1.1.1", "", { "dependencies": { "is-bigint": "^1.1.0", "is-boolean-object": "^1.2.1", "is-number-object": "^1.1.1", "is-string": "^1.1.1", "is-symbol": "^1.1.1" } }, "sha512-TbX3mj8n0odCBFVlY8AxkqcHASw3L60jIuF8jFP78az3C2YhmGvqbHBpAjTRH2/xqYunrJ9g1jSyjCjpoWzIAA=="],
+
+    "which-builtin-type": ["which-builtin-type@1.2.1", "", { "dependencies": { "call-bound": "^1.0.2", "function.prototype.name": "^1.1.6", "has-tostringtag": "^1.0.2", "is-async-function": "^2.0.0", "is-date-object": "^1.1.0", "is-finalizationregistry": "^1.1.0", "is-generator-function": "^1.0.10", "is-regex": "^1.2.1", "is-weakref": "^1.0.2", "isarray": "^2.0.5", "which-boxed-primitive": "^1.1.0", "which-collection": "^1.0.2", "which-typed-array": "^1.1.16" } }, "sha512-6iBczoX+kDQ7a3+YJBnh3T+KZRxM/iYNPXicqk66/Qfm1b93iu+yOImkg0zHbj5LNOcNv1TEADiZ0xa34B4q6Q=="],
+
+    "which-collection": ["which-collection@1.0.2", "", { "dependencies": { "is-map": "^2.0.3", "is-set": "^2.0.3", "is-weakmap": "^2.0.2", "is-weakset": "^2.0.3" } }, "sha512-K4jVyjnBdgvc86Y6BkaLZEN933SwYOuBFkdmBu9ZfkcAbdVbpITnDmjvZ/aQjRXQrv5EPkTnD1s39GiiqbngCw=="],
+
+    "which-typed-array": ["which-typed-array@1.1.22", "", { "dependencies": { "available-typed-arrays": "^1.0.7", "call-bind": "^1.0.9", "call-bound": "^1.0.4", "for-each": "^0.3.5", "get-proto": "^1.0.1", "gopd": "^1.2.0", "has-tostringtag": "^1.0.2" } }, "sha512-fvO4ExWMFsqyhG3AiPAObMuY1lxaqgYcxbc49CNdWDDECOJNgQyvsOWVwbZc+qf3rzRtxojBK+CMEv0Ld5CYpw=="],
+
     "why-is-node-running": ["why-is-node-running@2.3.0", "", { "dependencies": { "siginfo": "^2.0.0", "stackback": "0.0.2" }, "bin": { "why-is-node-running": "cli.js" } }, "sha512-hUrmaWBdVDcxvYqnyh09zunKzROWjbZTiNy8dBEjkS7ehEDQibXJ7XvlmtbwuTclUiIyN+CyXQD4Vmko8fNm8w=="],
 
     "word-wrap": ["word-wrap@1.2.5", "", {}, "sha512-BN22B5eaMMI9UMtjrGd5g5eCYPpCPDUy0FJXbYsaT5zYxjFOckS53SQDE3pWkVoWpHXVb3BrYcEN4Twa55B5cA=="],
 
+    "workbox-background-sync": ["workbox-background-sync@7.4.1", "", { "dependencies": { "idb": "^7.0.1", "workbox-core": "7.4.1" } }, "sha512-HhT7KE8tOWDm02wRNshXUnUPofMlhenF2DBdUnDPOubhizzPeItkYTmAB6td1Z2cjYPa98vzEiPLEuzn5hN66g=="],
+
+    "workbox-broadcast-update": ["workbox-broadcast-update@7.4.1", "", { "dependencies": { "workbox-core": "7.4.1" } }, "sha512-uAlgslKLvbQY+suirIdnBCSYrcgBhjp81Nj4l1lj/Jmj0MJO2CJERnCJjT0GFVwmReV0N+zs78K6gqd5gr9/+A=="],
+
+    "workbox-build": ["workbox-build@7.4.1", "", { "dependencies": { "@apideck/better-ajv-errors": "^0.3.1", "@babel/core": "^7.24.4", "@babel/preset-env": "^7.11.0", "@babel/runtime": "^7.11.2", "@rollup/plugin-babel": "^6.1.0", "@rollup/plugin-node-resolve": "^16.0.3", "@rollup/plugin-replace": "^6.0.3", "@rollup/plugin-terser": "^1.0.0", "@trickfilm400/rollup-plugin-off-main-thread": "^3.0.0-pre1", "ajv": "^8.6.0", "common-tags": "^1.8.0", "eta": "^4.5.1", "fast-json-stable-stringify": "^2.1.0", "fs-extra": "^9.0.1", "glob": "^11.0.1", "pretty-bytes": "^5.3.0", "rollup": "^4.53.3", "source-map": "^0.8.0-beta.0", "stringify-object": "^3.3.0", "strip-comments": "^2.0.1", "tempy": "^0.6.0", "upath": "^1.2.0", "workbox-background-sync": "7.4.1", "workbox-broadcast-update": "7.4.1", "workbox-cacheable-response": "7.4.1", "workbox-core": "7.4.1", "workbox-expiration": "7.4.1", "workbox-google-analytics": "7.4.1", "workbox-navigation-preload": "7.4.1", "workbox-precaching": "7.4.1", "workbox-range-requests": "7.4.1", "workbox-recipes": "7.4.1", "workbox-routing": "7.4.1", "workbox-strategies": "7.4.1", "workbox-streams": "7.4.1", "workbox-sw": "7.4.1", "workbox-window": "7.4.1" } }, "sha512-SDhxIvEAde9Gy/5w4Yo1Jh/M49Z0qE3q0oteyE8zGq0DScxFqVBcCtIXFuLtmtxRQZCMbf0prco4VyEu3KBQuw=="],
+
+    "workbox-cacheable-response": ["workbox-cacheable-response@7.4.1", "", { "dependencies": { "workbox-core": "7.4.1" } }, "sha512-8xaFoJdDc2OjrlbbL3gEeBO1WKcMwRqwLRupgqahYXu75yXajPLuwrbXMrIGZuWYXrQwk0xDjOxZ/ujCy/oJYw=="],
+
+    "workbox-core": ["workbox-core@7.4.1", "", {}, "sha512-DT+vu46eh/2vRsSHTY4Xmc32Z1rr9PRlQUXr1Dx30ZuXRWwOsvZgGgcwxcasubQLQmbTNYZjv44LkBAQ4tT5tQ=="],
+
+    "workbox-expiration": ["workbox-expiration@7.4.1", "", { "dependencies": { "idb": "^7.0.1", "workbox-core": "7.4.1" } }, "sha512-lRKUF7b+OGbeXkQk1s6MHXOa3d7Xxf7Of31W6c6hCfipfIyrtdWZ89stq21AHZMaoG7VNFoHply4Ox+rU31TWg=="],
+
+    "workbox-google-analytics": ["workbox-google-analytics@7.4.1", "", { "dependencies": { "workbox-background-sync": "7.4.1", "workbox-core": "7.4.1", "workbox-routing": "7.4.1", "workbox-strategies": "7.4.1" } }, "sha512-Mks1JwLEt++ZAkF6sS1OpSh9RtAMIsiDgRpK+codiHGIPXeaUOgi4cPc3GFadUl8V5QPeypEk8Oxgl3HlwVzHw=="],
+
+    "workbox-navigation-preload": ["workbox-navigation-preload@7.4.1", "", { "dependencies": { "workbox-core": "7.4.1" } }, "sha512-C4KVsjPcYKJOhr631AxR9XoG2rLF3QiTk5aMv36MXOjtWvm8axwNFAtKUPGsWUwLXXAMgYM1En7fsvndaXeXRQ=="],
+
+    "workbox-precaching": ["workbox-precaching@7.4.1", "", { "dependencies": { "workbox-core": "7.4.1", "workbox-routing": "7.4.1", "workbox-strategies": "7.4.1" } }, "sha512-cdr/9qByww7yzEp7zg/qI4ukUrrNjQLgN+ONQRpjy/VqGQXwkgHwr00KksGJK8v0VifwDXBb8a4cWNZH71jn3Q=="],
+
+    "workbox-range-requests": ["workbox-range-requests@7.4.1", "", { "dependencies": { "workbox-core": "7.4.1" } }, "sha512-7i2oxAUE82gHdAJBCAQ04JzNOdRPqzuOzGfoUyJpFSmeqBNYGPrAH8GPoPjUQTfp+NycwrD2H68VtuF8qxv0vQ=="],
+
+    "workbox-recipes": ["workbox-recipes@7.4.1", "", { "dependencies": { "workbox-cacheable-response": "7.4.1", "workbox-core": "7.4.1", "workbox-expiration": "7.4.1", "workbox-precaching": "7.4.1", "workbox-routing": "7.4.1", "workbox-strategies": "7.4.1" } }, "sha512-gnbVfmV4/TtmQaM4x9AtuXhcdstJsep3XMVeztOrQVPT+R6+6DeBjGTCQ7fFCXm+4GEHUA5VEBTyi5+4gWGeog=="],
+
+    "workbox-routing": ["workbox-routing@7.4.1", "", { "dependencies": { "workbox-core": "7.4.1" } }, "sha512-yubJGErZOusuidAenaL5ypfhQOa7urxP/f8E0ws7FPb4039RiWXUWBAyUkmUoOL/BcQGen3h0J8872d51IYxtA=="],
+
+    "workbox-strategies": ["workbox-strategies@7.4.1", "", { "dependencies": { "workbox-core": "7.4.1" } }, "sha512-GZxpaw9NbmOelj7667uZ2kpk5BFpOGbO4X0qjwh5ls8XQ8C+Lha5LQchTiUzsTFSS+NlUpftYAyOVXvQUrcqOQ=="],
+
+    "workbox-streams": ["workbox-streams@7.4.1", "", { "dependencies": { "workbox-core": "7.4.1", "workbox-routing": "7.4.1" } }, "sha512-HWWtraKUbJknd9kgqGcpQ3G114HOPYvqs8HaJMDs2ebLNAimDkVDaWfAXE6Ybl+m8U6KsCE6pWyLYuigWmnAXw=="],
+
+    "workbox-sw": ["workbox-sw@7.4.1", "", {}, "sha512-fez5f2DUlDJWTFYkCWQpY10N8gtztd849NswCbVFk0QlcSM4HT5A8x4g4ii650yem4I8tHY0R7JZahwp3ltIPw=="],
+
+    "workbox-window": ["workbox-window@7.4.1", "", { "dependencies": { "@types/trusted-types": "^2.0.2", "workbox-core": "7.4.1" } }, "sha512-notZDH2u8VXaqyuD7xaqIfEFi6SRM4SUSd7ewe9PDsVqADuepxX2ZMY3uvuZGxzY5ZOsGC/vD3A/3smFtJt4/A=="],
+
     "wrap-ansi": ["wrap-ansi@7.0.0", "", { "dependencies": { "ansi-styles": "^4.0.0", "string-width": "^4.1.0", "strip-ansi": "^6.0.0" } }, "sha512-YVGIj2kamLSTxw6NsZjoBxfSwsn0ycdesmc4p+Q21c5zPuZ1pl+NfxVdxPtdHvmNVOQ6XSYG4AUtyt/Fi7D16Q=="],
 
     "wrappy": ["wrappy@1.0.2", "", {}, "sha512-l4Sp/DRseor9wL6EvV2+TuQn63dMkPjZ/sp9XkghTEbV9KlPS1xUsZ3u7/IQO4wxtcFB4bgpQPRcR3QCvezPcQ=="],
@@ -1493,6 +1952,58 @@
 
     "zod-to-json-schema": ["zod-to-json-schema@3.25.2", "", { "peerDependencies": { "zod": "^3.25.28 || ^4" } }, "sha512-O/PgfnpT1xKSDeQYSCfRI5Gy3hPf91mKVDuYLUHZJMiDFptvP41MSnWofm8dnCm0256ZNfZIM7DSzuSMAFnjHA=="],
 
+    "@babel/code-frame/@babel/helper-validator-identifier": ["@babel/helper-validator-identifier@7.29.7", "", {}, "sha512-qehxGkRj55h/ff8EMaJ+cYhyaKlHIxqYDn682wQD7RNp9UujOQsHog2uS0r2vzr4pW+sXf90NeeayjcNaX3fFg=="],
+
+    "@babel/code-frame/js-tokens": ["js-tokens@4.0.0", "", {}, "sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ=="],
+
+    "@babel/core/@babel/parser": ["@babel/parser@7.29.7", "", { "dependencies": { "@babel/types": "^7.29.7" }, "bin": "./bin/babel-parser.js" }, "sha512-hnORnjP/1P/zFEndoeX+n+t1RwWRJiJpM/jO7FW32Kn9r5+sJB2JWOdYo4L6k78j15eCwY3Gm/7364B1EMwtNg=="],
+
+    "@babel/core/@babel/types": ["@babel/types@7.29.7", "", { "dependencies": { "@babel/helper-string-parser": "^7.29.7", "@babel/helper-validator-identifier": "^7.29.7" } }, "sha512-4zBIxpPzowiZpusoFkyGVwakdRJUyuH5PxQ/PrqghfdFWWasvnCdPfQXHrenDai+gyLARulZjZowCOj6fjT4pA=="],
+
+    "@babel/core/semver": ["semver@6.3.1", "", { "bin": { "semver": "bin/semver.js" } }, "sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA=="],
+
+    "@babel/generator/@babel/parser": ["@babel/parser@7.29.7", "", { "dependencies": { "@babel/types": "^7.29.7" }, "bin": "./bin/babel-parser.js" }, "sha512-hnORnjP/1P/zFEndoeX+n+t1RwWRJiJpM/jO7FW32Kn9r5+sJB2JWOdYo4L6k78j15eCwY3Gm/7364B1EMwtNg=="],
+
+    "@babel/generator/@babel/types": ["@babel/types@7.29.7", "", { "dependencies": { "@babel/helper-string-parser": "^7.29.7", "@babel/helper-validator-identifier": "^7.29.7" } }, "sha512-4zBIxpPzowiZpusoFkyGVwakdRJUyuH5PxQ/PrqghfdFWWasvnCdPfQXHrenDai+gyLARulZjZowCOj6fjT4pA=="],
+
+    "@babel/helper-annotate-as-pure/@babel/types": ["@babel/types@7.29.7", "", { "dependencies": { "@babel/helper-string-parser": "^7.29.7", "@babel/helper-validator-identifier": "^7.29.7" } }, "sha512-4zBIxpPzowiZpusoFkyGVwakdRJUyuH5PxQ/PrqghfdFWWasvnCdPfQXHrenDai+gyLARulZjZowCOj6fjT4pA=="],
+
+    "@babel/helper-compilation-targets/lru-cache": ["lru-cache@5.1.1", "", { "dependencies": { "yallist": "^3.0.2" } }, "sha512-KpNARQA3Iwv+jTA0utUVVbrh+Jlrr1Fv0e56GGzAFOXN7dk/FviaDW8LHmK52DlcH4WP2n6gI8vN1aesBFgo9w=="],
+
+    "@babel/helper-compilation-targets/semver": ["semver@6.3.1", "", { "bin": { "semver": "bin/semver.js" } }, "sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA=="],
+
+    "@babel/helper-create-class-features-plugin/semver": ["semver@6.3.1", "", { "bin": { "semver": "bin/semver.js" } }, "sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA=="],
+
+    "@babel/helper-create-regexp-features-plugin/semver": ["semver@6.3.1", "", { "bin": { "semver": "bin/semver.js" } }, "sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA=="],
+
+    "@babel/helper-member-expression-to-functions/@babel/types": ["@babel/types@7.29.7", "", { "dependencies": { "@babel/helper-string-parser": "^7.29.7", "@babel/helper-validator-identifier": "^7.29.7" } }, "sha512-4zBIxpPzowiZpusoFkyGVwakdRJUyuH5PxQ/PrqghfdFWWasvnCdPfQXHrenDai+gyLARulZjZowCOj6fjT4pA=="],
+
+    "@babel/helper-module-imports/@babel/types": ["@babel/types@7.29.7", "", { "dependencies": { "@babel/helper-string-parser": "^7.29.7", "@babel/helper-validator-identifier": "^7.29.7" } }, "sha512-4zBIxpPzowiZpusoFkyGVwakdRJUyuH5PxQ/PrqghfdFWWasvnCdPfQXHrenDai+gyLARulZjZowCOj6fjT4pA=="],
+
+    "@babel/helper-module-transforms/@babel/helper-validator-identifier": ["@babel/helper-validator-identifier@7.29.7", "", {}, "sha512-qehxGkRj55h/ff8EMaJ+cYhyaKlHIxqYDn682wQD7RNp9UujOQsHog2uS0r2vzr4pW+sXf90NeeayjcNaX3fFg=="],
+
+    "@babel/helper-optimise-call-expression/@babel/types": ["@babel/types@7.29.7", "", { "dependencies": { "@babel/helper-string-parser": "^7.29.7", "@babel/helper-validator-identifier": "^7.29.7" } }, "sha512-4zBIxpPzowiZpusoFkyGVwakdRJUyuH5PxQ/PrqghfdFWWasvnCdPfQXHrenDai+gyLARulZjZowCOj6fjT4pA=="],
+
+    "@babel/helper-skip-transparent-expression-wrappers/@babel/types": ["@babel/types@7.29.7", "", { "dependencies": { "@babel/helper-string-parser": "^7.29.7", "@babel/helper-validator-identifier": "^7.29.7" } }, "sha512-4zBIxpPzowiZpusoFkyGVwakdRJUyuH5PxQ/PrqghfdFWWasvnCdPfQXHrenDai+gyLARulZjZowCOj6fjT4pA=="],
+
+    "@babel/helper-wrap-function/@babel/types": ["@babel/types@7.29.7", "", { "dependencies": { "@babel/helper-string-parser": "^7.29.7", "@babel/helper-validator-identifier": "^7.29.7" } }, "sha512-4zBIxpPzowiZpusoFkyGVwakdRJUyuH5PxQ/PrqghfdFWWasvnCdPfQXHrenDai+gyLARulZjZowCOj6fjT4pA=="],
+
+    "@babel/helpers/@babel/types": ["@babel/types@7.29.7", "", { "dependencies": { "@babel/helper-string-parser": "^7.29.7", "@babel/helper-validator-identifier": "^7.29.7" } }, "sha512-4zBIxpPzowiZpusoFkyGVwakdRJUyuH5PxQ/PrqghfdFWWasvnCdPfQXHrenDai+gyLARulZjZowCOj6fjT4pA=="],
+
+    "@babel/plugin-transform-modules-systemjs/@babel/helper-validator-identifier": ["@babel/helper-validator-identifier@7.29.7", "", {}, "sha512-qehxGkRj55h/ff8EMaJ+cYhyaKlHIxqYDn682wQD7RNp9UujOQsHog2uS0r2vzr4pW+sXf90NeeayjcNaX3fFg=="],
+
+    "@babel/preset-env/semver": ["semver@6.3.1", "", { "bin": { "semver": "bin/semver.js" } }, "sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA=="],
+
+    "@babel/preset-modules/@babel/types": ["@babel/types@7.29.7", "", { "dependencies": { "@babel/helper-string-parser": "^7.29.7", "@babel/helper-validator-identifier": "^7.29.7" } }, "sha512-4zBIxpPzowiZpusoFkyGVwakdRJUyuH5PxQ/PrqghfdFWWasvnCdPfQXHrenDai+gyLARulZjZowCOj6fjT4pA=="],
+
+    "@babel/template/@babel/parser": ["@babel/parser@7.29.7", "", { "dependencies": { "@babel/types": "^7.29.7" }, "bin": "./bin/babel-parser.js" }, "sha512-hnORnjP/1P/zFEndoeX+n+t1RwWRJiJpM/jO7FW32Kn9r5+sJB2JWOdYo4L6k78j15eCwY3Gm/7364B1EMwtNg=="],
+
+    "@babel/template/@babel/types": ["@babel/types@7.29.7", "", { "dependencies": { "@babel/helper-string-parser": "^7.29.7", "@babel/helper-validator-identifier": "^7.29.7" } }, "sha512-4zBIxpPzowiZpusoFkyGVwakdRJUyuH5PxQ/PrqghfdFWWasvnCdPfQXHrenDai+gyLARulZjZowCOj6fjT4pA=="],
+
+    "@babel/traverse/@babel/parser": ["@babel/parser@7.29.7", "", { "dependencies": { "@babel/types": "^7.29.7" }, "bin": "./bin/babel-parser.js" }, "sha512-hnORnjP/1P/zFEndoeX+n+t1RwWRJiJpM/jO7FW32Kn9r5+sJB2JWOdYo4L6k78j15eCwY3Gm/7364B1EMwtNg=="],
+
+    "@babel/traverse/@babel/types": ["@babel/types@7.29.7", "", { "dependencies": { "@babel/helper-string-parser": "^7.29.7", "@babel/helper-validator-identifier": "^7.29.7" } }, "sha512-4zBIxpPzowiZpusoFkyGVwakdRJUyuH5PxQ/PrqghfdFWWasvnCdPfQXHrenDai+gyLARulZjZowCOj6fjT4pA=="],
+
     "@develar/schema-utils/ajv": ["ajv@6.15.0", "", { "dependencies": { "fast-deep-equal": "^3.1.1", "fast-json-stable-stringify": "^2.0.0", "json-schema-traverse": "^0.4.1", "uri-js": "^4.2.2" } }, "sha512-fgFx7Hfoq60ytK2c7DhnF8jIvzYgOMxfugjLOSMHjLIPgenqa7S7oaagATUq99mV6IYvN2tRmC0wnTYX6iPbMw=="],
 
     "@discordjs/rest/@discordjs/collection": ["@discordjs/collection@2.1.1", "", {}, "sha512-LiSusze9Tc7qF03sLCujF5iZp7K+vRNEDBZ86FT9aQAv3vxMLihUvKvpsCWiQ2DJq1tVckopKm1rxomgNUc9hg=="],
@@ -1501,6 +2012,10 @@
 
     "@discordjs/ws/@discordjs/collection": ["@discordjs/collection@2.1.1", "", {}, "sha512-LiSusze9Tc7qF03sLCujF5iZp7K+vRNEDBZ86FT9aQAv3vxMLihUvKvpsCWiQ2DJq1tVckopKm1rxomgNUc9hg=="],
 
+    "@electron/asar/commander": ["commander@5.1.0", "", {}, "sha512-P0CysNDQ7rtVw4QIQtm+MRxV66vKFSvlsQvGYXZWR3qFU0jlMKHZZZgw8e+8DSah4UDKMqnknRDQz+xuQXQ/Zg=="],
+
+    "@electron/asar/glob": ["glob@7.2.3", "", { "dependencies": { "fs.realpath": "^1.0.0", "inflight": "^1.0.4", "inherits": "2", "minimatch": "^3.1.1", "once": "^1.3.0", "path-is-absolute": "^1.0.0" } }, "sha512-nFR0zLpU2YCaRxwoCJvL6UvCH2JFyFVIvwTLsIf21AuHlMskA1hhTdk+LlYJtOlYt9v6dvszD2BGRqBL+iQK9Q=="],
+
     "@electron/asar/minimatch": ["minimatch@3.1.5", "", { "dependencies": { "brace-expansion": "^1.1.7" } }, "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w=="],
 
     "@electron/fuses/fs-extra": ["fs-extra@9.1.0", "", { "dependencies": { "at-least-node": "^1.0.0", "graceful-fs": "^4.2.0", "jsonfile": "^6.0.1", "universalify": "^2.0.0" } }, "sha512-hcg3ZmepS30/7BSFqRvoo3DOMQu7IjqxO5nCDt+zM9XWjb33Wg7ziNT+Qvqbuc3+gWpzO02JubVyk2G4Zvo1OQ=="],
@@ -1541,6 +2056,8 @@
 
     "axios/https-proxy-agent": ["https-proxy-agent@5.0.1", "", { "dependencies": { "agent-base": "6", "debug": "4" } }, "sha512-dFcAjpTQFgoLMzC2VwU+C/CbS7uRL0lWmxDITmqm7C+7F0Odmj6s9l6alZc6AELXhrnggM2CeWSXHGOdX2YtwA=="],
 
+    "babel-plugin-polyfill-corejs2/semver": ["semver@6.3.1", "", { "bin": { "semver": "bin/semver.js" } }, "sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA=="],
+
     "body-parser/iconv-lite": ["iconv-lite@0.7.2", "", { "dependencies": { "safer-buffer": ">= 2.1.2 < 3.0.0" } }, "sha512-im9DjEDQ55s9fL4EYzOAv0yMqmMBSZp6G0VvFyTMPKWxiSBHUj9NW/qqLmXUwXrrM7AvqSlTCfvqRb0cM8yYqw=="],
 
     "clone-response/mimic-response": ["mimic-response@1.0.1", "", {}, "sha512-j5EctnkH7amfV/q5Hgmoal1g2QHFJRraOtmx0JpIqkxhBhI/lJSl1nMpQ45hVarwNETOoWEimndZ4QK0RHxuxQ=="],
@@ -1567,9 +2084,11 @@
 
     "filelist/minimatch": ["minimatch@5.1.9", "", { "dependencies": { "brace-expansion": "^2.0.1" } }, "sha512-7o1wEA2RyMP7Iu7GNba9vc0RWWGACJOCZBJX2GJWip0ikV+wcOsgVuY9uE8CPiyQhkGFSlhuSkZPavN7u1c2Fw=="],
 
+    "foreground-child/signal-exit": ["signal-exit@4.1.0", "", {}, "sha512-bzyZ1e88w9O1iNJbKnOlvYTrWPDl46O1bG0D3XInv+9tkPrxrN8jUUTiFlDkkmKWgn1M6CfIA13SuGqOa9Korw=="],
+
     "form-data/mime-types": ["mime-types@2.1.35", "", { "dependencies": { "mime-db": "1.52.0" } }, "sha512-ZDY+bPm5zTTF+YpCrAU9nK0UgICYPT0QtT1NZWFv4s++TNkcgVaT0g6+4R2uI4MjQjzysHB1zxuWL50hzaeXiw=="],
 
-    "glob/minimatch": ["minimatch@3.1.5", "", { "dependencies": { "brace-expansion": "^1.1.7" } }, "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w=="],
+    "function.prototype.name/hasown": ["hasown@2.0.4", "", { "dependencies": { "function-bind": "^1.1.2" } }, "sha512-T2UbfbBEF32wiepXIsMlTW9+dDYC6wMh/t/vYA4tuOMKqWz/n3vr1NFSxQiyP+zk2mXsoMA/i/7qV6LKut1t1A=="],
 
     "lru-cache/yallist": ["yallist@4.0.0", "", {}, "sha512-3wdGidZyq5PB084XLES5TpOSRA3wjXAlIWMhum2kRcv/41Sn2emQ0dycQW4uZXLejwKvg6EsvbdlVL+FYEct7A=="],
 
@@ -1579,10 +2098,10 @@
 
     "node-gyp/which": ["which@6.0.1", "", { "dependencies": { "isexe": "^4.0.0" }, "bin": { "node-which": "bin/which.js" } }, "sha512-oGLe46MIrCRqX7ytPUf66EAYvdeMIZYn3WaocqqKZAxrBpkqHfL/qvTyJ/bTk5+AqHCjXmrv3CEWgy368zhRUg=="],
 
-    "openpalm/@openpalm/skeleton": ["@openpalm/skeleton@0.12.18", "", {}, "sha512-s80tOj6FEDjAwoJOJ6siAdxrqIdgm2pLp4PL4WuWkNef1gT1/fxiPmR6ayTHr5K4mmO6ZHrWjrRtOzZJxQptOQ=="],
-
     "p-queue/eventemitter3": ["eventemitter3@4.0.7", "", {}, "sha512-8guHBZCwKnFhYdHr2ysuRWErTwhoN2X8XELRlrRwpmfeY2jjuUN4taQMsULKUVo1K4DvZl+0pgfyoysHxvmvEw=="],
 
+    "path-scurry/lru-cache": ["lru-cache@11.5.1", "", {}, "sha512-RPimw/7aMdv2oqRrxKwvZXcPfwBrn/JZ2xYcY9Hus/6LaS3VOAKVWKWgNLCFSiOm1ESXinjsDlidVU7JlnCN2A=="],
+
     "playwright/fsevents": ["fsevents@2.3.2", "", { "os": "darwin" }, "sha512-xiqMQR4xAeHTuB9uWm+fFRcIOgKBMiOBP+eXiyT7jsgVCq1bkVygt00oASowB7EdtpOHaaPgKt812P9ab+DDKA=="],
 
     "postcss-load-config/yaml": ["yaml@1.10.3", "", {}, "sha512-vIYeF1u3CjlhAFekPPAk2h/Kv4T3mAkMox5OymRiJQB0spDP10LHvt+K7G9Ny6NuuMAb25/6n1qyUjAcGNf/AA=="],
@@ -1595,8 +2114,14 @@
 
     "raw-body/iconv-lite": ["iconv-lite@0.7.2", "", { "dependencies": { "safer-buffer": ">= 2.1.2 < 3.0.0" } }, "sha512-im9DjEDQ55s9fL4EYzOAv0yMqmMBSZp6G0VvFyTMPKWxiSBHUj9NW/qqLmXUwXrrM7AvqSlTCfvqRb0cM8yYqw=="],
 
+    "rimraf/glob": ["glob@7.2.3", "", { "dependencies": { "fs.realpath": "^1.0.0", "inflight": "^1.0.4", "inherits": "2", "minimatch": "^3.1.1", "once": "^1.3.0", "path-is-absolute": "^1.0.0" } }, "sha512-nFR0zLpU2YCaRxwoCJvL6UvCH2JFyFVIvwTLsIf21AuHlMskA1hhTdk+LlYJtOlYt9v6dvszD2BGRqBL+iQK9Q=="],
+
     "rollup/@types/estree": ["@types/estree@1.0.8", "", {}, "sha512-dWHzHa2WqEXI/O1E9OjrocMTKJl2mSrEolh1Iomrv6U+JuNwaHXsXx9bLu5gG7BUWFIN0skIQJQ/L1rIex4X6w=="],
 
+    "serialize-error/type-fest": ["type-fest@0.13.1", "", {}, "sha512-34R7HTnG0XIJcBSn5XhDd7nNFPRcXYRZrBB2O2jdKqYODldSzBAqzsWoZYYvduky73toYS/ESqxPvkDf/F0XMg=="],
+
+    "source-map-support/source-map": ["source-map@0.6.1", "", {}, "sha512-UjgapumWlbMhkBgzT7Ykc5YXUT46F0iKu8SGXq0bcwP5dz/h0Plj6enJqjz1Zbq2l5WaqYnrVbwWOWMyF3F47g=="],
+
     "svelte-eslint-parser/eslint-scope": ["eslint-scope@8.4.0", "", { "dependencies": { "esrecurse": "^4.3.0", "estraverse": "^5.2.0" } }, "sha512-sNXOfKCn74rt8RICKMvJS7XKV/Xk9kA7DyJr8mJik3S7Cwgy3qlkkmyS2uQB3jiJg6VNdZd/pDBJu0nvG2NlTg=="],
 
     "svelte-eslint-parser/eslint-visitor-keys": ["eslint-visitor-keys@4.2.1", "", {}, "sha512-Uhdk5sfqcee/9H/rCOJikYz67o0a2Tw2hGRPOG2Y1R2dg7brRe1uG0yaNQDHu+TO/uQPF/5eCapvYSmHUjt7JQ=="],
@@ -1607,6 +2132,60 @@
 
     "type-is/content-type": ["content-type@2.0.0", "", {}, "sha512-j/O/d7GcZCyNl7/hwZAb606rzqkyvaDctLmckbxLzHvFBzTJHuGEdodATcP3yIRoDrLHkIATJuvzbFlp/ki2cQ=="],
 
+    "workbox-build/fs-extra": ["fs-extra@9.1.0", "", { "dependencies": { "at-least-node": "^1.0.0", "graceful-fs": "^4.2.0", "jsonfile": "^6.0.1", "universalify": "^2.0.0" } }, "sha512-hcg3ZmepS30/7BSFqRvoo3DOMQu7IjqxO5nCDt+zM9XWjb33Wg7ziNT+Qvqbuc3+gWpzO02JubVyk2G4Zvo1OQ=="],
+
+    "workbox-build/pretty-bytes": ["pretty-bytes@5.6.0", "", {}, "sha512-FFw039TmrBqFK8ma/7OL3sDz/VytdtJr044/QUJtH0wK9lb9jLq9tJyIxUwtQJHwar2BqtiA4iCWSwo9JLkzFg=="],
+
+    "@babel/core/@babel/types/@babel/helper-string-parser": ["@babel/helper-string-parser@7.29.7", "", {}, "sha512-Pb5ijPrZ89GDH8223L4UP8i6QApWxs04RbPQJTeWDV0/keR2E36MeKnyr6LYmUUvqRRI+Iv87SuF1W6ErINzYw=="],
+
+    "@babel/core/@babel/types/@babel/helper-validator-identifier": ["@babel/helper-validator-identifier@7.29.7", "", {}, "sha512-qehxGkRj55h/ff8EMaJ+cYhyaKlHIxqYDn682wQD7RNp9UujOQsHog2uS0r2vzr4pW+sXf90NeeayjcNaX3fFg=="],
+
+    "@babel/generator/@babel/types/@babel/helper-string-parser": ["@babel/helper-string-parser@7.29.7", "", {}, "sha512-Pb5ijPrZ89GDH8223L4UP8i6QApWxs04RbPQJTeWDV0/keR2E36MeKnyr6LYmUUvqRRI+Iv87SuF1W6ErINzYw=="],
+
+    "@babel/generator/@babel/types/@babel/helper-validator-identifier": ["@babel/helper-validator-identifier@7.29.7", "", {}, "sha512-qehxGkRj55h/ff8EMaJ+cYhyaKlHIxqYDn682wQD7RNp9UujOQsHog2uS0r2vzr4pW+sXf90NeeayjcNaX3fFg=="],
+
+    "@babel/helper-annotate-as-pure/@babel/types/@babel/helper-string-parser": ["@babel/helper-string-parser@7.29.7", "", {}, "sha512-Pb5ijPrZ89GDH8223L4UP8i6QApWxs04RbPQJTeWDV0/keR2E36MeKnyr6LYmUUvqRRI+Iv87SuF1W6ErINzYw=="],
+
+    "@babel/helper-annotate-as-pure/@babel/types/@babel/helper-validator-identifier": ["@babel/helper-validator-identifier@7.29.7", "", {}, "sha512-qehxGkRj55h/ff8EMaJ+cYhyaKlHIxqYDn682wQD7RNp9UujOQsHog2uS0r2vzr4pW+sXf90NeeayjcNaX3fFg=="],
+
+    "@babel/helper-compilation-targets/lru-cache/yallist": ["yallist@3.1.1", "", {}, "sha512-a4UGQaWPH59mOXUYnAG2ewncQS4i4F43Tv3JoAM+s2VDAmS9NsK8GpDMLrCHPksFT7h3K6TOoUNn2pb7RoXx4g=="],
+
+    "@babel/helper-member-expression-to-functions/@babel/types/@babel/helper-string-parser": ["@babel/helper-string-parser@7.29.7", "", {}, "sha512-Pb5ijPrZ89GDH8223L4UP8i6QApWxs04RbPQJTeWDV0/keR2E36MeKnyr6LYmUUvqRRI+Iv87SuF1W6ErINzYw=="],
+
+    "@babel/helper-member-expression-to-functions/@babel/types/@babel/helper-validator-identifier": ["@babel/helper-validator-identifier@7.29.7", "", {}, "sha512-qehxGkRj55h/ff8EMaJ+cYhyaKlHIxqYDn682wQD7RNp9UujOQsHog2uS0r2vzr4pW+sXf90NeeayjcNaX3fFg=="],
+
+    "@babel/helper-module-imports/@babel/types/@babel/helper-string-parser": ["@babel/helper-string-parser@7.29.7", "", {}, "sha512-Pb5ijPrZ89GDH8223L4UP8i6QApWxs04RbPQJTeWDV0/keR2E36MeKnyr6LYmUUvqRRI+Iv87SuF1W6ErINzYw=="],
+
+    "@babel/helper-module-imports/@babel/types/@babel/helper-validator-identifier": ["@babel/helper-validator-identifier@7.29.7", "", {}, "sha512-qehxGkRj55h/ff8EMaJ+cYhyaKlHIxqYDn682wQD7RNp9UujOQsHog2uS0r2vzr4pW+sXf90NeeayjcNaX3fFg=="],
+
+    "@babel/helper-optimise-call-expression/@babel/types/@babel/helper-string-parser": ["@babel/helper-string-parser@7.29.7", "", {}, "sha512-Pb5ijPrZ89GDH8223L4UP8i6QApWxs04RbPQJTeWDV0/keR2E36MeKnyr6LYmUUvqRRI+Iv87SuF1W6ErINzYw=="],
+
+    "@babel/helper-optimise-call-expression/@babel/types/@babel/helper-validator-identifier": ["@babel/helper-validator-identifier@7.29.7", "", {}, "sha512-qehxGkRj55h/ff8EMaJ+cYhyaKlHIxqYDn682wQD7RNp9UujOQsHog2uS0r2vzr4pW+sXf90NeeayjcNaX3fFg=="],
+
+    "@babel/helper-skip-transparent-expression-wrappers/@babel/types/@babel/helper-string-parser": ["@babel/helper-string-parser@7.29.7", "", {}, "sha512-Pb5ijPrZ89GDH8223L4UP8i6QApWxs04RbPQJTeWDV0/keR2E36MeKnyr6LYmUUvqRRI+Iv87SuF1W6ErINzYw=="],
+
+    "@babel/helper-skip-transparent-expression-wrappers/@babel/types/@babel/helper-validator-identifier": ["@babel/helper-validator-identifier@7.29.7", "", {}, "sha512-qehxGkRj55h/ff8EMaJ+cYhyaKlHIxqYDn682wQD7RNp9UujOQsHog2uS0r2vzr4pW+sXf90NeeayjcNaX3fFg=="],
+
+    "@babel/helper-wrap-function/@babel/types/@babel/helper-string-parser": ["@babel/helper-string-parser@7.29.7", "", {}, "sha512-Pb5ijPrZ89GDH8223L4UP8i6QApWxs04RbPQJTeWDV0/keR2E36MeKnyr6LYmUUvqRRI+Iv87SuF1W6ErINzYw=="],
+
+    "@babel/helper-wrap-function/@babel/types/@babel/helper-validator-identifier": ["@babel/helper-validator-identifier@7.29.7", "", {}, "sha512-qehxGkRj55h/ff8EMaJ+cYhyaKlHIxqYDn682wQD7RNp9UujOQsHog2uS0r2vzr4pW+sXf90NeeayjcNaX3fFg=="],
+
+    "@babel/helpers/@babel/types/@babel/helper-string-parser": ["@babel/helper-string-parser@7.29.7", "", {}, "sha512-Pb5ijPrZ89GDH8223L4UP8i6QApWxs04RbPQJTeWDV0/keR2E36MeKnyr6LYmUUvqRRI+Iv87SuF1W6ErINzYw=="],
+
+    "@babel/helpers/@babel/types/@babel/helper-validator-identifier": ["@babel/helper-validator-identifier@7.29.7", "", {}, "sha512-qehxGkRj55h/ff8EMaJ+cYhyaKlHIxqYDn682wQD7RNp9UujOQsHog2uS0r2vzr4pW+sXf90NeeayjcNaX3fFg=="],
+
+    "@babel/preset-modules/@babel/types/@babel/helper-string-parser": ["@babel/helper-string-parser@7.29.7", "", {}, "sha512-Pb5ijPrZ89GDH8223L4UP8i6QApWxs04RbPQJTeWDV0/keR2E36MeKnyr6LYmUUvqRRI+Iv87SuF1W6ErINzYw=="],
+
+    "@babel/preset-modules/@babel/types/@babel/helper-validator-identifier": ["@babel/helper-validator-identifier@7.29.7", "", {}, "sha512-qehxGkRj55h/ff8EMaJ+cYhyaKlHIxqYDn682wQD7RNp9UujOQsHog2uS0r2vzr4pW+sXf90NeeayjcNaX3fFg=="],
+
+    "@babel/template/@babel/types/@babel/helper-string-parser": ["@babel/helper-string-parser@7.29.7", "", {}, "sha512-Pb5ijPrZ89GDH8223L4UP8i6QApWxs04RbPQJTeWDV0/keR2E36MeKnyr6LYmUUvqRRI+Iv87SuF1W6ErINzYw=="],
+
+    "@babel/template/@babel/types/@babel/helper-validator-identifier": ["@babel/helper-validator-identifier@7.29.7", "", {}, "sha512-qehxGkRj55h/ff8EMaJ+cYhyaKlHIxqYDn682wQD7RNp9UujOQsHog2uS0r2vzr4pW+sXf90NeeayjcNaX3fFg=="],
+
+    "@babel/traverse/@babel/types/@babel/helper-string-parser": ["@babel/helper-string-parser@7.29.7", "", {}, "sha512-Pb5ijPrZ89GDH8223L4UP8i6QApWxs04RbPQJTeWDV0/keR2E36MeKnyr6LYmUUvqRRI+Iv87SuF1W6ErINzYw=="],
+
+    "@babel/traverse/@babel/types/@babel/helper-validator-identifier": ["@babel/helper-validator-identifier@7.29.7", "", {}, "sha512-qehxGkRj55h/ff8EMaJ+cYhyaKlHIxqYDn682wQD7RNp9UujOQsHog2uS0r2vzr4pW+sXf90NeeayjcNaX3fFg=="],
+
     "@develar/schema-utils/ajv/json-schema-traverse": ["json-schema-traverse@0.4.1", "", {}, "sha512-xbbCH5dCYU5T8LcEhhuh7HJ88HXuW3qsI3Y0zOZFKfZEHcpWiHU/Jxzk629Brsab/mMiHQti9wMP+845RPe3Vg=="],
 
     "@electron/asar/minimatch/brace-expansion": ["brace-expansion@1.1.14", "", { "dependencies": { "balanced-match": "^1.0.0", "concat-map": "0.0.1" } }, "sha512-MWPGfDxnyzKU7rNOW9SP/c50vi3xrmrua/+6hfPbCS2ABNWfx24vPidzvC7krjU/RTo235sV776ymlsMtGKj8g=="],
@@ -1641,10 +2220,10 @@
 
     "form-data/mime-types/mime-db": ["mime-db@1.52.0", "", {}, "sha512-sPU4uV7dYlvtWJxwwxHD0PuihVNiE7TyAbQ5SWxDCB9mUYvOgroQOwYQQOKPJ8CIbE+1ETVlOoK1UC2nU3gYvg=="],
 
-    "glob/minimatch/brace-expansion": ["brace-expansion@1.1.14", "", { "dependencies": { "balanced-match": "^1.0.0", "concat-map": "0.0.1" } }, "sha512-MWPGfDxnyzKU7rNOW9SP/c50vi3xrmrua/+6hfPbCS2ABNWfx24vPidzvC7krjU/RTo235sV776ymlsMtGKj8g=="],
-
     "node-gyp/which/isexe": ["isexe@4.0.0", "", {}, "sha512-FFUtZMpoZ8RqHS3XeXEmHWLA4thH+ZxCv2lOiPIn1Xc7CxrqhWzNSDzD+/chS/zbYezmiwWLdQC09JdQKmthOw=="],
 
+    "rimraf/glob/minimatch": ["minimatch@3.1.5", "", { "dependencies": { "brace-expansion": "^1.1.7" } }, "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w=="],
+
     "@electron/asar/minimatch/brace-expansion/balanced-match": ["balanced-match@1.0.2", "", {}, "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw=="],
 
     "@electron/universal/minimatch/brace-expansion/balanced-match": ["balanced-match@1.0.2", "", {}, "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw=="],
@@ -1657,6 +2236,8 @@
 
     "filelist/minimatch/brace-expansion/balanced-match": ["balanced-match@1.0.2", "", {}, "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw=="],
 
-    "glob/minimatch/brace-expansion/balanced-match": ["balanced-match@1.0.2", "", {}, "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw=="],
+    "rimraf/glob/minimatch/brace-expansion": ["brace-expansion@1.1.14", "", { "dependencies": { "balanced-match": "^1.0.0", "concat-map": "0.0.1" } }, "sha512-MWPGfDxnyzKU7rNOW9SP/c50vi3xrmrua/+6hfPbCS2ABNWfx24vPidzvC7krjU/RTo235sV776ymlsMtGKj8g=="],
+
+    "rimraf/glob/minimatch/brace-expansion/balanced-match": ["balanced-match@1.0.2", "", {}, "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw=="],
   }
 }
diff --git a/containers/assistant/entrypoint.sh b/containers/assistant/entrypoint.sh
index ce9ab638c..490cc2b74 100644
--- a/containers/assistant/entrypoint.sh
+++ b/containers/assistant/entrypoint.sh
@@ -384,6 +384,36 @@ start_opencode() {
   # --log-level sets verbosity (override via OPENCODE_LOG_LEVEL).
   local cmd=(opencode web --hostname 0.0.0.0 --port "$PORT" --print-logs --log-level "${OPENCODE_LOG_LEVEL:-INFO}")
 
+  # Browser clients are served from separate loopback origins and call OpenCode
+  # directly. Allow the shipped origins by default, and let operators add exact
+  # comma-separated origins for custom reverse-proxy/client deployments.
+  local client_host_port="${OP_CLIENT_HOST_PORT:-${OP_CLIENT_PORT:-3810}}"
+  local host_client_port="${OP_HOST_CLIENT_PORT:-3890}"
+  local cors_origins=(
+    "http://127.0.0.1:${client_host_port}"
+    "http://localhost:${client_host_port}"
+    "http://127.0.0.1:${host_client_port}"
+    "http://localhost:${host_client_port}"
+  )
+  if [ -n "${OP_CLIENT_CORS_ALLOWED_ORIGINS:-}" ]; then
+    local old_ifs="$IFS"
+    IFS=','
+    read -ra extra_origins <<< "${OP_CLIENT_CORS_ALLOWED_ORIGINS}"
+    IFS="$old_ifs"
+    local origin
+    for origin in "${extra_origins[@]}"; do
+      origin="${origin#${origin%%[![:space:]]*}}"
+      origin="${origin%${origin##*[![:space:]]}}"
+      if [ -n "$origin" ]; then
+        cors_origins+=("$origin")
+      fi
+    done
+  fi
+  local origin
+  for origin in "${cors_origins[@]}"; do
+    cmd+=(--cors "$origin")
+  done
+
   exec "${cmd[@]}"
 }
 
diff --git a/docs/operations/release-management.md b/docs/operations/release-management.md
index 3ee867282..58d8f5710 100644
--- a/docs/operations/release-management.md
+++ b/docs/operations/release-management.md
@@ -1,6 +1,6 @@
 # Release Management
 
-> **Last updated 2026-06-21** against the live codebase at 0.12.22. This supersedes the pre-0.12 `platform-release.yml` documentation.
+> **Last updated 2026-07-07** against the live codebase at 0.12.52. This supersedes the pre-0.12 `platform-release.yml` documentation.
 
 ---
 
@@ -18,7 +18,7 @@ All releases run through `.github/workflows/release.yml` (manual `workflow_dispa
 
 | Unit | What it publishes | Version anchor |
 |---|---|---|
-| `platform` | @openpalm/lib, openpalm (CLI), @openpalm/ui, @openpalm/skeleton, @openpalm/guardian (all npm) + CLI binaries + optional Electron | root `package.json` |
+| `platform` | @openpalm/lib, openpalm (CLI), @openpalm/ui, @openpalm/client, @openpalm/skeleton, @openpalm/guardian (all npm) + CLI binaries + optional Electron | root `package.json` |
 | `portals` | `openpalm/portal` Docker image | `portals/discord/package.json` |
 | `assistant` | `openpalm/assistant` Docker image | `containers/assistant/VERSION` |
 | `guardian` | @openpalm/guardian + @openpalm/skeleton (npm) + optional Docker image | `packages/guardian/package.json` |
@@ -50,7 +50,7 @@ gh workflow run release.yml \
   -f dry_run=true
 ```
 
-Review the workflow output. Verify the computed version, the files that will be stamped, and the npm regression guard output.
+Review the workflow output. Verify the computed version, the files that will be stamped, and the npm regression guard output. For `platform` and `all`, confirm the stamp includes `packages/cli/package.json` and rewrites its exact `@openpalm/skeleton` pin to the release version.
 
 ### Step 2 — real release
 
@@ -149,7 +149,7 @@ All npm publishes flow through `publish-npm-package.yml` as the single OIDC trus
 - Workflow: `release.yml`
 - Environment: (none)
 
-Set this for: `@openpalm/lib`, `openpalm`, `@openpalm/ui`, `@openpalm/skeleton`, `@openpalm/guardian`.
+Set this for: `@openpalm/lib`, `openpalm`, `@openpalm/ui`, `@openpalm/client`, `@openpalm/skeleton`, `@openpalm/guardian`.
 
 ---
 
@@ -159,10 +159,31 @@ When promoting a `0.X.Y-rc.N` or `0.X.Y-beta.N` line to stable `0.X.Y`:
 
 - [ ] Cut the stable platform release (no `-` suffix) — publishes npm under `latest`, creates Docker `latest` tags
 - [ ] Verify `@openpalm/ui@latest` resolves to the current UI (it ships with `platform`)
+- [ ] Verify `@openpalm/client@latest` resolves to the current client (it ships with `platform`)
 - [ ] Verify guardian and skeleton `latest` dist-tags are current
 - [ ] Confirm Docker `latest` tags exist for all images (first ever `latest` for a new major line)
 - [ ] Update `CHANGELOG.md`
 
+## Runtime artifact env pins
+
+These non-secret `stack.env` vars control the exact npm artifacts the running platform installs or serves:
+
+| Variable | Used by | Resolution | Notes |
+|---|---|---|---|
+| `OP_UI_VERSION` | Host UI updater / seeding path | `OP_UI_VERSION` -> channel/default logic in the host control plane | Host-side UI artifact only |
+| `OP_CLIENT_VERSION` | Assistant container entrypoint | `OP_CLIENT_VERSION` -> image `PLATFORM_VERSION` -> hard error | Exact-pins `@openpalm/client`; no `latest` fallback |
+| `OP_SKELETON_VERSION` | Assistant + guardian entrypoints | Assistant: `OP_SKELETON_VERSION` -> image `PLATFORM_VERSION` -> hard error. Guardian: `OP_SKELETON_VERSION` -> guardian package version. | Exact-pins `@openpalm/skeleton`; keep equal to the platform version in normal releases |
+
+`OP_CLIENT_PORT` and `OP_CLIENT_BIND_ADDRESS` are separate: they control the assistant container's published client co-process listener (`127.0.0.1:3810` by default), not the host-local PWA/dev origin.
+
+## Release Smoke Checklist
+
+- [ ] `electron-host`: launch Electron against a seeded install; verify the window lands on the client chat at `http://127.0.0.1:3890/chat`, and host routes remain available.
+- [ ] `host-ui`: run `openpalm admin`; verify the browser opens on the loopback host UI and `/host`, `/connections`, and `/chat` all load.
+- [ ] `assistant-container`: boot the assistant with `OP_CLIENT_VERSION` and `OP_SKELETON_VERSION` overrides; verify the container installs those exact versions, serves the static client on the assistant's published client port, and chat reaches the locked default assistant connection.
+- [ ] `localhost PWA install`: from the harness-served client origin `http://127.0.0.1:3890`, verify installability and that the installed app reopens on the same origin.
+- [ ] `hosted PWA install`: from the hosted client origin (currently `https://app.openpalm.dev` in tests/docs), verify installability, `/api/runtime` compatibility, and that remote connections require HTTPS guardians plus the expected guardian CORS allowlist.
+
 ---
 
 ## Skeleton seeding
diff --git a/docs/technical/artifact-delivery-pattern.md b/docs/technical/artifact-delivery-pattern.md
new file mode 100644
index 000000000..83c8ee562
--- /dev/null
+++ b/docs/technical/artifact-delivery-pattern.md
@@ -0,0 +1,102 @@
+# Artifact Delivery Pattern
+
+> **As built 2026-07-07**. This documents the current runtime delivery model used by OpenPalm artifacts.
+
+## Rule
+
+OpenPalm delivers updatable runtime content as npm artifacts with explicit version resolution. Runtime installs never fall back to `latest` in production.
+
+There are two strategies:
+
+| Strategy | Use when | Resolution |
+|---|---|---|
+| Exact pin | API/data compatibility or seeded-file hashes must stay in lockstep | `OP_*_VERSION` override -> `PLATFORM_VERSION`/paired image version -> hard error |
+| Reviewed package manifest | Tooling that can advance independently within a managed package.json | Pinned or ranged dependency in the baked `package.json`, applied by `bun install`/`bun update` |
+
+## Current Exact-Pin Artifacts
+
+| Artifact | Package | Installed by | Resolution chain |
+|---|---|---|---|
+| Host UI build | `@openpalm/ui` | Host control plane seeding/updater | Host-side UI logic; not a container entrypoint artifact |
+| Client app | `@openpalm/client` | Assistant container entrypoint | `OP_CLIENT_VERSION` -> `PLATFORM_VERSION` -> hard error |
+| Skeleton seed | `@openpalm/skeleton` | Assistant + guardian entrypoints; CLI local dep for repo/npm installs | `OP_SKELETON_VERSION` -> `PLATFORM_VERSION` or guardian package version -> hard error/paired default |
+| Guardian package | `@openpalm/guardian` | Guardian thin-host entrypoint | `OP_GUARDIAN_NPM_VERSION` -> `GUARDIAN_VERSION` -> hard error |
+
+## Current Reviewed Tool Package Pattern
+
+| Runtime | Source | Install action |
+|---|---|---|
+| Assistant tools | `/opt/openpalm/tools/package.json` with host bind overlay | `bun update --cwd /opt/openpalm/tools --production` |
+| Guardian tools | `/opt/openpalm/tools/package.json` with host bind overlay | `bun install --cwd /opt/openpalm/tools --production` |
+
+This is deliberately different from the exact-pin artifacts. Tools are governed by an editable package manifest, not by one env var per tool.
+
+## Skeleton Resolution Chain
+
+The shipped skeleton source resolution chain is:
+
+1. `OPENPALM_REPO_ROOT` -> repo `packages/skeleton/`
+2. `OPENPALM_SKELETON_DIR` -> Electron bundled extraResources skeleton
+3. `require.resolve('@openpalm/skeleton/package.json')` -> installed package dir
+4. source-relative repo fallback when running from source
+5. npm download path when no local source exists
+
+The Electron bundled skeleton remains intentional so a fresh desktop install can seed offline.
+
+## Release Contract
+
+The release workflow stamps versioned manifests through `scripts/set-version.mjs` and `scripts/bump-unit.mjs`.
+
+For the platform unit this means:
+
+- root, lib, skeleton, guardian, cli, ui, client, electron, and admin-tools package versions are stamped together
+- `packages/cli/package.json` keeps an exact `@openpalm/skeleton` pin equal to the platform version
+- `@openpalm/client` publishes alongside `@openpalm/ui`
+- the npm regression guard treats `@openpalm/skeleton` and `@openpalm/guardian` as dual-owned packages
+
+That exact CLI skeleton pin matters because npm-installed CLI builds resolve the seeding skeleton through their own dependency tree.
+
+## Runtime-Specific Delivery Paths
+
+### Host UI
+
+- Resolved into `OP_HOME/data/ui`
+- Updated by the host control plane
+- Supervised by Electron or `openpalm admin`
+
+### Harness Localhost Client App
+
+- Resolved into `OP_HOME/data/client`
+- Served on the stable host-local origin `http://127.0.0.1:${OP_HOST_CLIENT_PORT:-3890}/chat`
+- Opened by `openpalm app` and preferred by Electron when healthy
+
+### Assistant Container Client App
+
+- Installed into `/opt/openpalm/client`
+- Served from the package's `bin/serve.mjs`
+- Published on `${OP_CLIENT_PORT:-3810}` externally and port `3000` internally
+- Seeded with `runtime-config.json` containing one locked default connection
+
+### Hosted PWA
+
+- Same static `@openpalm/client` build
+- Served from the hosted origin used by current tests/docs: `https://app.openpalm.dev`
+- Requires guardian TLS + CORS for remote instance connections
+
+## Failure Policy
+
+- Version resolution failure is loud: missing version source is an error.
+- Install failure after version resolution is tolerant only where the entrypoint already has an on-disk artifact to keep using.
+- No runtime path silently substitutes `latest`.
+
+## Related Files
+
+| File | Role |
+|---|---|
+| `scripts/set-version.mjs` | Shared manifest-stamping helper |
+| `scripts/bump-unit.mjs` | Release-unit version computation and stamping |
+| `.github/workflows/release.yml` | Release DAG |
+| `packages/lib/src/control-plane/ui-assets.ts` | Host UI artifact delivery |
+| `packages/lib/src/control-plane/client-assets.ts` | Harness localhost client artifact delivery |
+| `containers/assistant/entrypoint.sh` | Assistant-container runtime install path |
+| `containers/guardian/entrypoint.sh` | Guardian thin-host runtime install path |
diff --git a/docs/technical/environment-and-mounts.md b/docs/technical/environment-and-mounts.md
index 8d3056984..0a35d2dbf 100644
--- a/docs/technical/environment-and-mounts.md
+++ b/docs/technical/environment-and-mounts.md
@@ -122,8 +122,12 @@ Key env:
 | `AKM_DATA_DIR` | `/opt/akm/data` | AKM durable data directory |
 | `OP_UID` / `OP_GID` | `stack.env` | Direct runtime uid/gid mapping |
 | `OP_CLIENT_VERSION` | `stack.env` (empty = image `PLATFORM_VERSION`) | Exact-pin override for the `@openpalm/client` artifact the entrypoint installs |
+| `OP_SKELETON_VERSION` | `stack.env` (empty = image `PLATFORM_VERSION`) | Exact-pin override for the `@openpalm/skeleton` artifact the assistant entrypoint installs |
 | `OP_ASSISTANT_PORT` | `stack.env` (default `3800`) | Host-published OpenCode port; used to build the client's default connection URL |
 | `OP_CLIENT_DEFAULT_ASSISTANT_URL` | `stack.env` (optional) | Full-URL override for the client's locked default connection |
+| `OP_CLIENT_HOST_PORT` | compose-derived from `OP_CLIENT_PORT` | Host-published assistant-container client port used to add OpenCode CORS origins |
+| `OP_HOST_CLIENT_PORT` | `stack.env`/host env (default `3890`) | Host-local client app/PWA port used by `openpalm app` and Electron; also added to OpenCode CORS origins |
+| `OP_CLIENT_CORS_ALLOWED_ORIGINS` | `stack.env` (optional) | Extra comma-separated exact origins passed to OpenCode `--cors` for custom client deployments |
 
 Notes:
 
@@ -165,6 +169,7 @@ Key env:
 | `GUARDIAN_AUDIT_PATH` | `/opt/openpalm/logs/guardian-audit.log` | Audit log path |
 | `PORTAL_<NAME>_SECRET_FILE` | `/run/secrets/portal_<name>_secret` | Portal principal seed secret file |
 | `GUARDIAN_CONTENT_VALIDATION` | `0` | Enable opt-in, fail-closed content validation of inbound messages |
+| `GUARDIAN_CORS_ALLOWED_ORIGINS` | empty | Comma-separated exact browser origins allowed on guardian direct ingress CORS responses |
 | `GUARDIAN_MODERATION_URL` | `http://127.0.0.1:4097` | Local OpenCode moderator endpoint |
 | `GUARDIAN_MODERATION_PORT` | `4097` | Loopback port the entrypoint starts the moderator on |
 | `GUARDIAN_MODERATION_THRESHOLD` | `3` | Heuristic risk score at/above which a message escalates to the model |
@@ -209,6 +214,7 @@ Key env (host process, not container):
 | Variable | Value / source | Purpose |
 |---|---|---|
 | `PORT` | `OP_HOST_UI_PORT` or `3880` | Admin HTTP listen port |
+| `OP_HOST_CLIENT_PORT` | host env (default `3890`) | Stable localhost client-app/PWA origin used by `openpalm app` and Electron's preferred client chat URL |
 | `OP_HOME` | resolved from host env | OpenPalm home directory |
 | `OP_UI_LOGIN_PASSWORD` | `$OP_HOME/knowledge/secrets/op_ui_login_password` | Operator admin password promoted into the host admin process environment |
 | `OP_ALLOW_REMOTE_SETUP` | unset (`0`) | When `1`/`true`/`yes`: bind `0.0.0.0`, allow any Host/same-origin, and permit remote access to the setup wizard. Off by default (loopback-only). |
@@ -250,10 +256,13 @@ These variables are consumed by Compose and service env blocks.
 | `OP_UID`, `OP_GID` | Runtime UID/GID for bind-mounted file ownership |
 | `OP_IMAGE_NAMESPACE`, `OP_IMAGE_TAG` | Image selection |
 | `OP_HOST_UI_PORT` | Admin UI host port (default `3880`); the admin UI runs as a host process, not a container |
+| `OP_HOST_CLIENT_PORT` | Stable host-local client app/PWA port for `openpalm app` and Electron (default `3890`); intentionally separate from the assistant container's `OP_CLIENT_PORT` |
 | `OP_ASSISTANT_BIND_ADDRESS`, `OP_ASSISTANT_PORT` | Assistant host bind |
 | `OP_CLIENT_BIND_ADDRESS`, `OP_CLIENT_PORT` | Assistant chat-client co-process host bind (default `127.0.0.1:3810`) |
 | `OP_CLIENT_VERSION` | Exact-pin override for the `@openpalm/client` artifact installed in the assistant container |
+| `OP_SKELETON_VERSION` | Exact-pin override for the `@openpalm/skeleton` artifact installed in the assistant container (and used by the guardian thin-host entrypoint when set) |
 | `OP_CLIENT_DEFAULT_ASSISTANT_URL` | Full-URL override for the chat client's locked default connection |
+| `OP_CLIENT_CORS_ALLOWED_ORIGINS` | Extra exact browser origins to allow when the assistant launches OpenCode |
 | `OP_CHAT_BIND_ADDRESS`, `OP_CHAT_PORT` | Chat addon host bind |
 | `OP_API_BIND_ADDRESS`, `OP_API_PORT` | API addon host bind |
 | `OP_VOICE_BIND_ADDRESS`, `OP_VOICE_PORT` | Voice addon host bind |
diff --git a/docs/technical/release-architecture.md b/docs/technical/release-architecture.md
index c807302df..e33bcd150 100644
--- a/docs/technical/release-architecture.md
+++ b/docs/technical/release-architecture.md
@@ -110,6 +110,9 @@ Publishes: @openpalm/skeleton → @openpalm/lib → (@openpalm/guardian, openpal
 
 Stamps: root, lib, skeleton, guardian, cli, ui, client, electron, admin-tools package.json files + `scripts/setup.sh` `SCRIPT_VERSION` + `scripts/setup.ps1` `$ScriptVersion`.
 
+The shared `scripts/set-version.mjs` helper is also responsible for rewriting the CLI's exact `@openpalm/skeleton` dependency pin to the release version during this stamp. That keeps the published CLI's bundled skeleton source in lockstep with `PLATFORM_VERSION`.
+
+
 Preflight: full test suite (`bun run client:build` then `bun run test` — which includes the client-bundle purity gate — plus `ui:check`, `ui-kit:check`, `client:check`, `ui:test:unit`, `electron:test`).
 
 ### `portals`
diff --git a/docs/technical/ui-runtime-modes-plan.md b/docs/technical/ui-runtime-modes-plan.md
index 4782fe07a..791dcc9f2 100644
--- a/docs/technical/ui-runtime-modes-plan.md
+++ b/docs/technical/ui-runtime-modes-plan.md
@@ -671,11 +671,12 @@ Acceptance: assistant-container can edit persona/AKM but not project name or bin
   (`tests/purity.test.ts`, runs in CI) greps every file of the built bundle for the
   forbidden markers `@openpalm/lib` and `/api/host` (and fails loudly on a missing
   build) — §8.5/§8.10 enforced structurally, plus source hygiene (no lib dependency in
-  any group, no `src/lib/server/`). `@vite-pwa/sveltekit` is NOT yet added (Phase 6).
+  any group, no `src/lib/server/`). Phase 6 later added `@vite-pwa/sveltekit`.
 - **P5c — harness serving:** lib gained `control-plane/client-assets.ts`
   (resolve/seed/update, sibling of `ui-assets.ts`); the CLI serves the client build on
   the **stable loopback port 3890** (`DEFAULT_CLIENT_PORT` in
-  `packages/cli/src/lib/ports.ts`, override `OP_CLIENT_PORT`); Electron spawns a client
+  `packages/cli/src/lib/ports.ts`, override `OP_HOST_CLIENT_PORT`; intentionally separate
+  from assistant-container `OP_CLIENT_PORT`); Electron spawns a client
   server child and the window prefers the client chat, with a health probe falling back
   to the host UI when the client build is absent or dead.
 - **P5d — assistant container (#510):** entrypoint installs `@openpalm/client`
diff --git a/docs/technical/ui-runtime-modes.md b/docs/technical/ui-runtime-modes.md
new file mode 100644
index 000000000..0f5d9c866
--- /dev/null
+++ b/docs/technical/ui-runtime-modes.md
@@ -0,0 +1,121 @@
+# UI Runtime Modes
+
+> **As built 2026-07-07**. This replaces `ui-runtime-modes-plan.md` as the current-state reference.
+
+## Summary
+
+OpenPalm now ships one UI product as two artifacts:
+
+| Surface | Artifact | Runtime | Purpose |
+|---|---|---|---|
+| Host control plane | `@openpalm/ui` | Electron or `openpalm admin` host process | Host setup, lifecycle, logs, secrets, connections, assistant settings |
+| Client app | `@openpalm/client` | Harness localhost server, assistant container static server, or hosted static origin | Chat, connection switching, installable PWA |
+
+`@openpalm/ui-kit` is a shared raw-source workspace package consumed at build time by both apps. It is not published.
+
+## Host Modes
+
+`packages/ui/src/lib/server/features.ts` computes the server runtime context from `OP_UI_HOST_MODE` with these shipped values:
+
+| `hostMode` | Served artifact | How it is entered | Server capabilities |
+|---|---|---|---|
+| `electron-host` | `@openpalm/ui` | Electron main process sets `OP_INSIDE_ELECTRON=1` / host mode env | Full host + assistant + connections surface |
+| `host-ui` | `@openpalm/ui` | `openpalm admin` | Full host + assistant + connections surface without Electron IPC |
+| `assistant-container` | `@openpalm/client` | Assistant container `start_client` co-process | Single locked connection chat surface; no host capabilities |
+| `pwa-static` | `@openpalm/client` | Harness localhost app server or hosted static origin | Connection manager + chat; no host capabilities |
+
+## Client Display Modes
+
+The browser-side client context distinguishes:
+
+| `clientDisplayMode` | Detection | Effect |
+|---|---|---|
+| `electron` | Electron user agent | Full server-provided host capabilities remain visible |
+| `standalone-pwa` | `matchMedia('(display-mode: standalone)')` | PWA chrome/behavior |
+| `browser` | Default | Regular browser behavior |
+
+Capability resolution is centralized in the runtime-context store. The client artifact has no `host:*` capability types at all.
+
+## Routing And Capability Shape
+
+Current route baselines:
+
+| Mode | Primary routes |
+|---|---|
+| `electron-host` / `host-ui` | `/host`, `/chat`, `/connections`, `/setup` |
+| `assistant-container` | `/chat` |
+| `pwa-static` | `/chat`, `/connections` |
+
+Current namespaces:
+
+| Namespace | Served by |
+|---|---|
+| `/api/runtime` | Host UI and host-served runtime context |
+| `/api/auth/*` | Host UI |
+| `/api/connections/*` | Host UI |
+| `/api/assistant/*` | Host UI |
+| `/api/host/*` | Host UI only |
+| `/proxy/assistant/*` | Host UI only |
+
+The assistant-container Slice A that shipped in Phase 5 is static-only. It serves `@openpalm/client` plus `runtime-config.json`; it does **not** ship the optional assistant-settings shim.
+
+## Localhost Client Origin
+
+There are two different client ports in the shipped system:
+
+| Port | Owner | Meaning |
+|---|---|---|
+| `3890` | Harness localhost client server | Stable host-local origin for `openpalm app` and Electron's preferred client chat URL |
+| `3810` by default | Assistant container compose port (`OP_CLIENT_PORT`) | Host-published port for the assistant container's own static client co-process |
+
+The stable host-local origin is resolved by `packages/lib/src/control-plane/client-app-url.ts`:
+
+- default: `http://127.0.0.1:3890/chat`
+- override: `OP_HOST_CLIENT_PORT`
+- deliberate non-input: `OP_CLIENT_PORT` does **not** affect this origin
+
+That split is intentional. `OP_CLIENT_PORT` belongs to the assistant container artifact listener; `OP_HOST_CLIENT_PORT` belongs to the harness-served localhost app/PWA identity.
+
+## Assistant-Container Mode
+
+`containers/assistant/entrypoint.sh` installs runtime artifacts before booting OpenCode:
+
+- `@openpalm/client`: `OP_CLIENT_VERSION` -> `PLATFORM_VERSION` -> hard error
+- `@openpalm/skeleton`: `OP_SKELETON_VERSION` -> `PLATFORM_VERSION` -> hard error
+- tools: `bun update --cwd /opt/openpalm/tools --production`
+
+After install it writes `runtime-config.json` with one locked default connection pointing the browser at the host-published OpenCode URL:
+
+- default URL: `http://127.0.0.1:${OP_ASSISTANT_PORT:-3800}`
+- full override: `OP_CLIENT_DEFAULT_ASSISTANT_URL`
+
+The static server itself binds `0.0.0.0` inside the container on port `3000`; Compose publishes it as `${OP_CLIENT_BIND_ADDRESS:-${OP_BIND_ADDRESS:-127.0.0.1}}:${OP_CLIENT_PORT:-3810}:3000`.
+
+## PWA Delivery Modes
+
+`packages/client` is an adapter-static SvelteKit app with `@vite-pwa/sveltekit` enabled.
+
+Supported install paths in the shipped code/docs:
+
+1. Localhost install from the harness-served client origin on `127.0.0.1:3890`.
+2. Hosted static install from the canonical hosted origin used in tests/docs: `https://app.openpalm.dev`.
+
+The PWA build excludes `runtime-config.json` from precache and treats it as `NetworkFirst`. Credentialed remote responses are excluded from runtime caching.
+
+## Security Boundaries
+
+- Host admin remains loopback-only.
+- The client artifact does not bundle `@openpalm/lib` and exposes no host APIs.
+- Hosted-origin remote connections require HTTPS guardians and matching `GUARDIAN_CORS_ALLOWED_ORIGINS` entries.
+- Assistant-container mode remains isolated from Docker and broad `OP_HOME` access.
+
+## Related Files
+
+| File | Role |
+|---|---|
+| `packages/ui/src/lib/server/features.ts` | Server runtime-context and host-mode resolution |
+| `packages/lib/src/control-plane/client-app-url.ts` | Stable localhost client origin (`3890` / `OP_HOST_CLIENT_PORT`) |
+| `packages/cli/src/commands/app.ts` | `openpalm app` entrypoint |
+| `packages/cli/src/lib/client-server.ts` | Harness localhost client server |
+| `containers/assistant/entrypoint.sh` | Assistant-container artifact install + `runtime-config.json` write |
+| `packages/client/vite.config.ts` | PWA manifest and service-worker caching rules |
diff --git a/packages/cli/package.json b/packages/cli/package.json
index 117bebde8..61eb33bbe 100644
--- a/packages/cli/package.json
+++ b/packages/cli/package.json
@@ -36,7 +36,7 @@
   },
   "dependencies": {
     "@openpalm/lib": ">=0.12.52 <1.0.0",
-    "@openpalm/skeleton": "0.12.18",
+    "@openpalm/skeleton": "0.12.52",
     "citty": "^0.2.1",
     "yaml": "^2.8.0"
   },
diff --git a/packages/cli/src/commands/app.test.ts b/packages/cli/src/commands/app.test.ts
new file mode 100644
index 000000000..ebf6f7185
--- /dev/null
+++ b/packages/cli/src/commands/app.test.ts
@@ -0,0 +1,55 @@
+import { afterEach, beforeEach, describe, expect, it } from 'bun:test';
+
+beforeEach(() => {
+  delete process.env.OP_CLIENT_PORT;
+  delete process.env.OP_HOST_CLIENT_PORT;
+});
+
+afterEach(() => {
+  delete process.env.OP_CLIENT_PORT;
+  delete process.env.OP_HOST_CLIENT_PORT;
+});
+
+describe('openpalm app', () => {
+  it('resolves the stable localhost client origin on the default port', async () => {
+    const { resolveClientAppUrl } = await import('@openpalm/lib');
+
+    expect(resolveClientAppUrl()).toBe('http://127.0.0.1:3890/chat');
+  });
+
+  it('uses OP_HOST_CLIENT_PORT and ignores OP_CLIENT_PORT collisions', async () => {
+    process.env.OP_CLIENT_PORT = '4810';
+    process.env.OP_HOST_CLIENT_PORT = '4890';
+    const { resolveClientAppPort, resolveClientAppUrl } = await import('@openpalm/lib');
+
+    expect(resolveClientAppPort()).toBe(4890);
+    expect(resolveClientAppUrl()).toBe('http://127.0.0.1:4890/chat');
+  });
+
+  it('keeps the stable localhost origin when only OP_CLIENT_PORT is set', async () => {
+    process.env.OP_CLIENT_PORT = '4810';
+    const { resolveClientAppPort, resolveClientAppUrl } = await import('@openpalm/lib');
+
+    expect(resolveClientAppPort()).toBe(3890);
+    expect(resolveClientAppUrl()).toBe('http://127.0.0.1:3890/chat');
+  });
+
+  it('routes through the UI/client supervisor so the localhost app is served before opening', async () => {
+    const calls: UIServerOptions[] = [];
+    const mod = await import('./app.ts');
+
+    await mod.runAppCommand(async (options) => {
+      calls.push(options);
+    });
+
+    expect(calls).toEqual([{ openTarget: 'client' }]);
+  });
+
+  it('registers the app subcommand in the main command map', async () => {
+    const { mainCommand } = await import('../main.ts');
+    const sub = (mainCommand.subCommands as Record<string, () => Promise<unknown>>).app;
+    expect(typeof sub).toBe('function');
+    const cmd = (await sub()) as { meta?: { name?: string } };
+    expect(cmd.meta?.name).toBe('app');
+  });
+});
diff --git a/packages/cli/src/commands/app.ts b/packages/cli/src/commands/app.ts
new file mode 100644
index 000000000..b560119d4
--- /dev/null
+++ b/packages/cli/src/commands/app.ts
@@ -0,0 +1,18 @@
+import { defineCommand } from 'citty';
+import { startUIServer, type UIServerOptions } from '../lib/ui-server.ts';
+
+export async function runAppCommand(
+  start = (options: UIServerOptions) => startUIServer(options),
+): Promise<void> {
+  await start({ openTarget: 'client' });
+}
+
+export default defineCommand({
+  meta: {
+    name: 'app',
+    description: 'Open the localhost OpenPalm app at the stable loopback client origin',
+  },
+  async run() {
+    await runAppCommand();
+  },
+});
diff --git a/packages/cli/src/lib/client-server.test.ts b/packages/cli/src/lib/client-server.test.ts
index 301f9c4d1..b68038423 100644
--- a/packages/cli/src/lib/client-server.test.ts
+++ b/packages/cli/src/lib/client-server.test.ts
@@ -32,7 +32,7 @@
 import { describe, expect, it, beforeEach, afterEach } from 'bun:test';
 import { join } from 'node:path';
 import * as ports from './ports.ts';
-import { startClientServer, resolveClientServeScript } from './client-server.ts';
+import { startClientServer, resolveClientServeScript, resolveDefaultAssistantUrl } from './client-server.ts';
 
 // ── fakes ─────────────────────────────────────────────────────────────────────
 
@@ -80,6 +80,7 @@ function harness(opts: {
   const procs = opts.procs ?? [fakeClientProc()];
   const spawns: SpawnRecord[] = [];
   const logs: string[] = [];
+  const runtimeConfigWrites: Array<{ path: string; assistantUrl: string }> = [];
   const handlePromise = startClientServer({
     port: opts.port,
     resolveBuildDir: () => buildDir,
@@ -90,10 +91,13 @@ function harness(opts: {
     },
     log: (...a: unknown[]) => { logs.push(a.map(String).join(' ')); },
     logError: (...a: unknown[]) => { logs.push(a.map(String).join(' ')); },
+    resolveRuntimeConfigPath: () => '/op-home/data/client/runtime-config.json',
+    resolveAssistantUrl: () => process.env.OP_CLIENT_DEFAULT_ASSISTANT_URL || `http://127.0.0.1:${process.env.OP_ASSISTANT_PORT || '3800'}`,
+    writeRuntimeConfig: (path: string, assistantUrl: string) => { runtimeConfigWrites.push({ path, assistantUrl }); },
     sleep: () => Promise.resolve(),
     stopTimeoutMs: 5,
   });
-  return { handlePromise, spawns, logs, buildDir, procs };
+  return { handlePromise, spawns, logs, buildDir, procs, runtimeConfigWrites };
 }
 
 const tick = () => new Promise((r) => setTimeout(r, 10));
@@ -119,23 +123,58 @@ describe('resolveClientServeScript', () => {
   });
 });
 
+describe('resolveDefaultAssistantUrl', () => {
+  it('uses persisted stack env when process env does not override it', () => {
+    expect(resolveDefaultAssistantUrl({}, { OP_ASSISTANT_PORT: '4800' })).toBe('http://127.0.0.1:4800');
+    expect(resolveDefaultAssistantUrl({}, { OP_CLIENT_DEFAULT_ASSISTANT_URL: 'https://assistant.example' }))
+      .toBe('https://assistant.example');
+  });
+
+  it('lets process env override persisted stack env', () => {
+    expect(resolveDefaultAssistantUrl(
+      { OP_ASSISTANT_PORT: '4900' } as NodeJS.ProcessEnv,
+      { OP_ASSISTANT_PORT: '4800' }
+    )).toBe('http://127.0.0.1:4900');
+  });
+});
+
 // ── spawn env/args ────────────────────────────────────────────────────────────
 
 describe('startClientServer spawn env/args', () => {
   const savedRemote = { value: undefined as string | undefined };
+  const savedClientPort = { value: undefined as string | undefined };
+  const savedHostClientPort = { value: undefined as string | undefined };
+  const savedAssistantPort = { value: undefined as string | undefined };
+  const savedDefaultAssistantUrl = { value: undefined as string | undefined };
 
   beforeEach(() => {
     savedRemote.value = process.env.OP_ALLOW_REMOTE_SETUP;
+    savedClientPort.value = process.env.OP_CLIENT_PORT;
+    savedHostClientPort.value = process.env.OP_HOST_CLIENT_PORT;
+    savedAssistantPort.value = process.env.OP_ASSISTANT_PORT;
+    savedDefaultAssistantUrl.value = process.env.OP_CLIENT_DEFAULT_ASSISTANT_URL;
     delete process.env.OP_ALLOW_REMOTE_SETUP;
+    delete process.env.OP_CLIENT_PORT;
+    delete process.env.OP_HOST_CLIENT_PORT;
+    delete process.env.OP_ASSISTANT_PORT;
+    delete process.env.OP_CLIENT_DEFAULT_ASSISTANT_URL;
   });
 
   afterEach(() => {
     if (savedRemote.value === undefined) delete process.env.OP_ALLOW_REMOTE_SETUP;
     else process.env.OP_ALLOW_REMOTE_SETUP = savedRemote.value;
+    if (savedClientPort.value === undefined) delete process.env.OP_CLIENT_PORT;
+    else process.env.OP_CLIENT_PORT = savedClientPort.value;
+    if (savedHostClientPort.value === undefined) delete process.env.OP_HOST_CLIENT_PORT;
+    else process.env.OP_HOST_CLIENT_PORT = savedHostClientPort.value;
+    if (savedAssistantPort.value === undefined) delete process.env.OP_ASSISTANT_PORT;
+    else process.env.OP_ASSISTANT_PORT = savedAssistantPort.value;
+    if (savedDefaultAssistantUrl.value === undefined) delete process.env.OP_CLIENT_DEFAULT_ASSISTANT_URL;
+    else process.env.OP_CLIENT_DEFAULT_ASSISTANT_URL = savedDefaultAssistantUrl.value;
   });
 
   it('spawns the serve script with PORT=3890 (default), HOST=127.0.0.1, and OP_CLIENT_DIR=<resolved build>', async () => {
-    const { handlePromise, spawns, buildDir } = harness({});
+    const { handlePromise, spawns, buildDir, runtimeConfigWrites } = harness({});
     const handle = await handlePromise;
     expect(handle).not.toBeNull();
     expect(spawns.length).toBe(1);
@@ -144,6 +183,10 @@ describe('startClientServer spawn env/args', () => {
     expect(env.PORT).toBe('3890');
     expect(env.HOST).toBe('127.0.0.1');
     expect(env.OP_CLIENT_DIR).toBe(buildDir);
+    expect(env.OP_CLIENT_RUNTIME_CONFIG).toBe('/op-home/data/client/runtime-config.json');
+    expect(runtimeConfigWrites).toEqual([
+      { path: '/op-home/data/client/runtime-config.json', assistantUrl: 'http://127.0.0.1:3800' },
+    ]);
     // The child IS the serve script from the resolved client build.
     expect(cmd).toContain(resolveClientServeScript(buildDir));
     await handle?.stop();
@@ -156,6 +199,32 @@ describe('startClientServer spawn env/args', () => {
     await handle?.stop();
   });
 
+  it('seeds runtime-config.json with the assistant URL override when configured', async () => {
+    process.env.OP_CLIENT_DEFAULT_ASSISTANT_URL = 'https://assistant.example/oc';
+    const { handlePromise, runtimeConfigWrites } = harness({});
+    const handle = await handlePromise;
+    expect(runtimeConfigWrites).toEqual([
+      { path: '/op-home/data/client/runtime-config.json', assistantUrl: 'https://assistant.example/oc' },
+    ]);
+    await handle?.stop();
+  });
+
+  it('uses OP_HOST_CLIENT_PORT when no explicit port is passed', async () => {
+    process.env.OP_HOST_CLIENT_PORT = '4011';
+    const { handlePromise, spawns } = harness({});
+    const handle = await handlePromise;
+    expect((spawns[0] as SpawnRecord).env.PORT).toBe('4011');
+    await handle?.stop();
+  });
+
+  it('does not let OP_CLIENT_PORT override the stable host localhost app port', async () => {
+    process.env.OP_CLIENT_PORT = '4810';
+    const { handlePromise, spawns } = harness({});
+    const handle = await handlePromise;
+    expect((spawns[0] as SpawnRecord).env.PORT).toBe('3890');
+    await handle?.stop();
+  });
+
   it('stays loopback-only even when OP_ALLOW_REMOTE_SETUP is set (no remote escape hatch)', async () => {
     // The UI server's remote-setup relaxation must never leak into the client
     // static server: acceptance is "loopback-only enforced for the client
diff --git a/packages/cli/src/lib/client-server.ts b/packages/cli/src/lib/client-server.ts
index 0d03474a3..37e7c16bd 100644
--- a/packages/cli/src/lib/client-server.ts
+++ b/packages/cli/src/lib/client-server.ts
@@ -17,7 +17,14 @@
  */
 import { join, basename } from 'node:path';
 import { existsSync as nodeExistsSync } from 'node:fs';
-import { resolveClientBuildDir } from '@openpalm/lib';
+import {
+  parseEnvFile,
+  resolveClientAppPort,
+  resolveClientBuildDir,
+  resolveDataDir,
+  resolveOpenPalmHome,
+  writeClientRuntimeConfig,
+} from '@openpalm/lib';
 import { DEFAULT_CLIENT_PORT } from './ports.ts';
 
 const STOP_TIMEOUT_MS = 5_000;
@@ -36,6 +43,26 @@ export function resolveClientServeScript(buildDir: string): string {
   return join(buildDir, '..', 'bin', 'serve.mjs');
 }
 
+export function resolveHostClientRuntimeConfigPath(dataDir = resolveDataDir()): string {
+  return join(dataDir, 'client', 'runtime-config.json');
+}
+
+function readPersistedStackEnv(): Record<string, string> {
+  try {
+    return parseEnvFile(join(resolveOpenPalmHome(), 'knowledge', 'env', 'stack.env'));
+  } catch {
+    return {};
+  }
+}
+
+export function resolveDefaultAssistantUrl(
+  env: NodeJS.ProcessEnv = process.env,
+  persistedEnv: Record<string, string> = readPersistedStackEnv(),
+): string {
+  const merged = { ...persistedEnv, ...env };
+  return merged.OP_CLIENT_DEFAULT_ASSISTANT_URL || `http://127.0.0.1:${merged.OP_ASSISTANT_PORT || '3800'}`;
+}
+
 /** Running client-server handle: stop() kills the child and ends supervision. */
 export interface ClientServerHandle {
   stop: () => Promise<void>;
@@ -43,7 +70,7 @@ export interface ClientServerHandle {
 
 /** Injectable dependencies for {@link startClientServer} (real process/fs by default). */
 export interface ClientServerDeps {
-  /** Port to serve on (default: OP_CLIENT_PORT env or DEFAULT_CLIENT_PORT). */
+  /** Port to serve on (default: OP_HOST_CLIENT_PORT env or DEFAULT_CLIENT_PORT). */
   port?: number;
   /** Resolve the client build dir (defaults to the shared lib resolver). */
   resolveBuildDir?: () => string;
@@ -51,6 +78,9 @@ export interface ClientServerDeps {
   existsSync?: (path: string) => boolean;
   /** Spawn the serve child (defaults to Bun.spawn with inherited stdio). */
   spawnFn?: (cmd: string[], opts: { env: Record<string, string | undefined> }) => ClientChildProc;
+  resolveRuntimeConfigPath?: () => string;
+  resolveAssistantUrl?: () => string;
+  writeRuntimeConfig?: (path: string, assistantUrl: string) => void;
   log?: (...args: unknown[]) => void;
   logError?: (...args: unknown[]) => void;
   /** Sleep for the respawn delay and the stop grace window. */
@@ -66,7 +96,7 @@ export interface ClientServerDeps {
  * client app.
  */
 export async function startClientServer(deps: ClientServerDeps = {}): Promise<ClientServerHandle | null> {
-  const port = deps.port ?? (Number(process.env.OP_CLIENT_PORT) || DEFAULT_CLIENT_PORT);
+  const port = deps.port ?? resolveClientAppPort(process.env);
   const resolveBuildDir = deps.resolveBuildDir ?? resolveClientBuildDir;
   const exists = deps.existsSync ?? nodeExistsSync;
   const spawnFn = deps.spawnFn
@@ -76,6 +106,9 @@ export async function startClientServer(deps: ClientServerDeps = {}): Promise<Cl
   const logError = deps.logError ?? console.error;
   const sleep = deps.sleep ?? ((ms: number) => new Promise<void>((r) => setTimeout(r, ms)));
   const stopTimeoutMs = deps.stopTimeoutMs ?? STOP_TIMEOUT_MS;
+  const resolveRuntimeConfigPath = deps.resolveRuntimeConfigPath ?? (() => resolveHostClientRuntimeConfigPath());
+  const resolveAssistantUrl = deps.resolveAssistantUrl ?? (() => resolveDefaultAssistantUrl(process.env));
+  const writeRuntimeConfig = deps.writeRuntimeConfig ?? writeClientRuntimeConfig;
 
   const buildDir = resolveBuildDir();
   const serveScript = resolveClientServeScript(buildDir);
@@ -84,6 +117,13 @@ export async function startClientServer(deps: ClientServerDeps = {}): Promise<Cl
     return null;
   }
 
+  const runtimeConfigPath = resolveRuntimeConfigPath();
+  try {
+    writeRuntimeConfig(runtimeConfigPath, resolveAssistantUrl());
+  } catch (err) {
+    logError(`Failed to write client runtime config at ${runtimeConfigPath}: ${err instanceof Error ? err.message : String(err)}`);
+  }
+
   // The child runs on THIS binary's embedded runtime (no system `node`
   // required — same rationale as the UI child in ui-server.ts):
   //   dev (bun)       → [bun, <serve.mjs>]           bun executes the script
@@ -101,6 +141,7 @@ export async function startClientServer(deps: ClientServerDeps = {}): Promise<Cl
     PORT: String(port),
     HOST: '127.0.0.1',
     OP_CLIENT_DIR: buildDir,
+    OP_CLIENT_RUNTIME_CONFIG: runtimeConfigPath,
   };
 
   let stopping = false;
diff --git a/packages/cli/src/lib/ports.ts b/packages/cli/src/lib/ports.ts
index 0add95f0a..b9939d8ac 100644
--- a/packages/cli/src/lib/ports.ts
+++ b/packages/cli/src/lib/ports.ts
@@ -10,10 +10,4 @@ export const DEFAULT_UI_PORT = 3880;
 /** Default published host port for the assistant (override via OP_ASSISTANT_PORT). */
 export const DEFAULT_ASSISTANT_PORT = 3800;
 
-/**
- * Default host port for the @openpalm/client static app server (override via
- * OP_CLIENT_PORT). STABLE by design: the localhost PWA identity is
- * origin-including-port (plan ui-runtime-modes-plan.md §6.10), so this number
- * must not drift between releases.
- */
-export const DEFAULT_CLIENT_PORT = 3890;
+export { DEFAULT_CLIENT_PORT } from '@openpalm/lib';
diff --git a/packages/cli/src/lib/ui-server.test.ts b/packages/cli/src/lib/ui-server.test.ts
index 78e7fe509..5e684ce1d 100644
--- a/packages/cli/src/lib/ui-server.test.ts
+++ b/packages/cli/src/lib/ui-server.test.ts
@@ -1,5 +1,5 @@
 import { describe, expect, it } from 'bun:test';
-import { createCliUiSupervisor, type CliChildProc } from './ui-server.ts';
+import { createCliUiSupervisor, type CliChildProc, waitForClientApp } from './ui-server.ts';
 
 // Behavioral coverage for the CLI's thin UiSupervisor adapter, driven through
 // injected fakes (no real processes). Locks the exit-based failure policy
@@ -94,3 +94,34 @@ describe('createCliUiSupervisor exit policy', () => {
     expect(exits).toEqual([]);
   });
 });
+
+describe('waitForClientApp', () => {
+  it('returns true once the localhost client app becomes reachable', async () => {
+    let attempts = 0;
+    const originalFetch = globalThis.fetch;
+    globalThis.fetch = (async () => {
+      attempts += 1;
+      if (attempts < 2) throw new Error('not ready');
+      return new Response('<html></html>', { status: 200 });
+    }) as typeof fetch;
+
+    try {
+      expect(await waitForClientApp('http://127.0.0.1:3890/chat', 1500)).toBe(true);
+    } finally {
+      globalThis.fetch = originalFetch;
+    }
+  });
+
+  it('returns false when the localhost client app never becomes reachable', async () => {
+    const originalFetch = globalThis.fetch;
+    globalThis.fetch = (async () => {
+      throw new Error('still down');
+    }) as typeof fetch;
+
+    try {
+      expect(await waitForClientApp('http://127.0.0.1:3890/chat', 250)).toBe(false);
+    } finally {
+      globalThis.fetch = originalFetch;
+    }
+  });
+});
diff --git a/packages/cli/src/lib/ui-server.ts b/packages/cli/src/lib/ui-server.ts
index c0e65dbb7..cf741b516 100644
--- a/packages/cli/src/lib/ui-server.ts
+++ b/packages/cli/src/lib/ui-server.ts
@@ -10,8 +10,8 @@ import { join, basename } from 'node:path';
 import { existsSync } from 'node:fs';
 import {
   resolveOpenPalmHome, resolveUiBuildDir, createLogger, readSecret,
-  checkAndUpdateUiBuild, checkAndUpdateSkeleton, PLATFORM_VERSION,
-  isRemoteSetupAllowed, waitForReady, restoreUiBackup, UiSupervisor,
+  checkAndUpdateClientBuild, checkAndUpdateUiBuild, checkAndUpdateSkeleton, PLATFORM_VERSION,
+  isRemoteSetupAllowed, resolveClientAppUrl, restoreUiBackup, UiSupervisor, waitForReady,
 } from '@openpalm/lib';
 import { ensureValidState, resolveServeState } from './cli-state.ts';
 import { openBrowser } from './browser.ts';
@@ -21,10 +21,13 @@ import { startClientServer } from './client-server.ts';
 const logger = createLogger('cli:ui');
 const DEFAULT_PORT = Number(process.env.OP_HOST_UI_PORT) || DEFAULT_UI_PORT;
 const STOP_TIMEOUT_MS  = 5_000;
+const CLIENT_READY_TIMEOUT_MS = 5_000;
+const CLIENT_READY_POLL_MS = 200;
 
 export interface UIServerOptions {
   port?: number;
   open?: boolean;
+  openTarget?: 'ui' | 'client';
   /**
    * host-ui admin mode (`openpalm admin`, plan Phase 1.5): enable the admin
    * capability in the spawned UI child (OP_ENABLE_ADMIN=1 + OP_UI_HOST_MODE=
@@ -35,6 +38,22 @@ export interface UIServerOptions {
   adminHostUi?: boolean;
 }
 
+export async function waitForClientApp(url: string, timeoutMs = CLIENT_READY_TIMEOUT_MS): Promise<boolean> {
+  const deadline = Date.now() + timeoutMs;
+  while (Date.now() < deadline) {
+    try {
+      const response = await fetch(url, {
+        signal: AbortSignal.timeout(1_000),
+      });
+      if (response.ok) return true;
+    } catch {
+      // Not ready yet.
+    }
+    await new Promise<void>((resolve) => setTimeout(resolve, CLIENT_READY_POLL_MS));
+  }
+  return false;
+}
+
 /**
  * Self-update the control plane (npm `@openpalm/ui` → data/ui) and skeleton
  * (npm `@openpalm/skeleton` → system/), then resolve and spawn the SvelteKit
@@ -282,6 +301,7 @@ export async function startUIServer(opts: UIServerOptions = {}): Promise<void> {
   // logic). The bare serve path keeps requiring a valid install.
   const state = opts.adminHostUi ? resolveServeState() : ensureValidState();
   const uiUrl = `http://localhost:${port}`;
+  const clientUrl = resolveClientAppUrl(process.env);
 
   const { supervisor, stop: stopUiProc } = createCliUiSupervisor({
     port,
@@ -297,9 +317,26 @@ export async function startUIServer(opts: UIServerOptions = {}): Promise<void> {
   // port (P5c, #555; plan Phase 5 item 3). Both the default serve path and
   // `openpalm admin` come through here. Non-fatal: absent build → log + skip
   // (null handle), and the UI keeps serving.
+  console.log('Checking for client app update...');
+  const clientResult = await checkAndUpdateClientBuild(PLATFORM_VERSION, state.dataDir);
+  if (clientResult.updated) {
+    console.log(`Client app updated to v${clientResult.latestVersion}.`);
+  } else if (clientResult.error) {
+    console.warn(`Warning: client app update skipped — ${clientResult.error}. Existing build still active.`);
+  }
   const clientHandle = await startClientServer();
 
-  if (opts.open !== false) await openBrowser(uiUrl);
+  if (opts.open !== false) {
+    if (opts.openTarget === 'client') {
+      if (!clientHandle || !await waitForClientApp(clientUrl)) {
+        console.error(`Localhost client app is not reachable at ${clientUrl}`);
+        process.exit(1);
+      }
+      await openBrowser(clientUrl);
+    } else {
+      await openBrowser(uiUrl);
+    }
+  }
 
   // Supervisor restart (§4.4): the UI child (admin "install UI version" route)
   // sends SIGUSR2/SIGHUP to this parent after seeding a newer data/ui. The
diff --git a/packages/cli/src/main.test.ts b/packages/cli/src/main.test.ts
index e3be8c1d7..7c60623f2 100644
--- a/packages/cli/src/main.test.ts
+++ b/packages/cli/src/main.test.ts
@@ -673,6 +673,14 @@ describe('UI host server', () => {
     const cmd = (await sub()) as { meta?: { name?: string } };
     expect(cmd.meta?.name).toBe("ui");
   });
+
+  it("the `app` subcommand is registered", async () => {
+    const { mainCommand } = await import("./main.ts");
+    const sub = (mainCommand.subCommands as Record<string, () => Promise<unknown>>).app;
+    expect(typeof sub).toBe("function");
+    const cmd = (await sub()) as { meta?: { name?: string } };
+    expect(cmd.meta?.name).toBe("app");
+  });
 });
 
 describe('secrets.env generation', () => {
diff --git a/packages/cli/src/main.ts b/packages/cli/src/main.ts
index a400d01fc..e37fa0756 100755
--- a/packages/cli/src/main.ts
+++ b/packages/cli/src/main.ts
@@ -84,6 +84,7 @@ async function autoRun(opts: BareRunOpts = {}): Promise<void> {
 // out of sync with the bare-command routing table.
 const subCommands = {
   admin: () => import('./commands/admin.ts').then((m) => m.default),
+  app: () => import('./commands/app.ts').then((m) => m.default),
   install: () => import('./commands/install.ts').then((m) => m.default),
   uninstall: () => import('./commands/uninstall.ts').then((m) => m.default),
   update: () => import('./commands/update.ts').then((m) => m.default),
diff --git a/packages/client/bin/serve.mjs b/packages/client/bin/serve.mjs
index b3b6189f9..9eab6a4f3 100644
--- a/packages/client/bin/serve.mjs
+++ b/packages/client/bin/serve.mjs
@@ -27,6 +27,9 @@ const host = arg('host') ?? process.env.HOST ?? '127.0.0.1';
 const dir = resolve(
   arg('dir') ?? process.env.OP_CLIENT_DIR ?? join(fileURLToPath(new URL('..', import.meta.url)), 'build')
 );
+const runtimeConfigPath = process.env.OP_CLIENT_RUNTIME_CONFIG
+  ? resolve(process.env.OP_CLIENT_RUNTIME_CONFIG)
+  : '';
 
 const MIME = {
   '.html': 'text/html; charset=utf-8',
@@ -42,11 +45,18 @@ const MIME = {
   '.txt': 'text/plain; charset=utf-8',
 };
 
-function send(res, path, status = 200) {
-  res.writeHead(status, { 'content-type': MIME[extname(path)] ?? 'application/octet-stream' });
+function send(res, path, status = 200, extraHeaders = {}) {
+  res.writeHead(status, {
+    'content-type': MIME[extname(path)] ?? 'application/octet-stream',
+    ...extraHeaders,
+  });
   createReadStream(path).pipe(res);
 }
 
+function runtimeConfigHeaders() {
+  return { 'cache-control': 'no-store' };
+}
+
 const server = createServer((req, res) => {
   let pathname;
   try {
@@ -59,13 +69,25 @@ const server = createServer((req, res) => {
   }
   // normalize() collapses any ../ segments; the join stays inside dir.
   const candidate = join(dir, normalize(join('/', pathname)));
-  if (existsSync(candidate) && statSync(candidate).isFile()) return send(res, candidate);
+  if (existsSync(candidate) && statSync(candidate).isFile()) {
+    if (pathname === '/runtime-config.json') {
+      return send(res, candidate, 200, runtimeConfigHeaders());
+    }
+    return send(res, candidate);
+  }
   // runtime-config.json may live beside the build dir instead of inside it
   // (the assistant container writes it next to the extracted bundle, P5d).
   if (pathname === '/runtime-config.json') {
-    const sibling = join(dir, '..', 'runtime-config.json');
-    if (existsSync(sibling) && statSync(sibling).isFile()) return send(res, sibling);
-    res.writeHead(404, { 'content-type': 'text/plain; charset=utf-8' });
+    const candidates = [runtimeConfigPath, join(dir, '..', 'runtime-config.json')].filter(Boolean);
+    for (const path of candidates) {
+      if (existsSync(path) && statSync(path).isFile()) {
+        return send(res, path, 200, runtimeConfigHeaders());
+      }
+    }
+    res.writeHead(404, {
+      'content-type': 'text/plain; charset=utf-8',
+      ...runtimeConfigHeaders(),
+    });
     return res.end('no runtime-config.json');
   }
   // SPA fallback: every route is client-rendered from index.html.
diff --git a/packages/client/package.json b/packages/client/package.json
index 8af50277c..b528bd097 100644
--- a/packages/client/package.json
+++ b/packages/client/package.json
@@ -31,6 +31,7 @@
   "devDependencies": {
     "@openpalm/ui-kit": "workspace:*",
     "@sveltejs/adapter-static": "^3.0.10",
+    "@vite-pwa/sveltekit": "^1.1.0",
     "@types/node": "^25.9.1",
     "@sveltejs/kit": "^2.53.3",
     "@sveltejs/vite-plugin-svelte": "^7.1.2",
diff --git a/packages/client/src/app.html b/packages/client/src/app.html
index ce67e6adb..20769af22 100644
--- a/packages/client/src/app.html
+++ b/packages/client/src/app.html
@@ -43,6 +43,7 @@
       href="https://fonts.googleapis.com/css2?family=Source+Sans+3:wght@400;500;600;700&family=IBM+Plex+Mono:wght@400;500&display=swap"
       rel="stylesheet"
     />
+    <script defer src="/registerSW.js"></script>
     %sveltekit.head%
   </head>
   <body data-sveltekit-preload-data="hover">
diff --git a/packages/client/src/lib/boot.ts b/packages/client/src/lib/boot.ts
index 73f9ae382..ec6829900 100644
--- a/packages/client/src/lib/boot.ts
+++ b/packages/client/src/lib/boot.ts
@@ -26,23 +26,37 @@ export type ClientBoot = {
 
 let bootPromise: Promise<ClientBoot> | null = null;
 
-function pickStorage(): ConnectionStorage {
+function pickStorage(): { storage: ConnectionStorage; persistent: boolean } {
   // Some private-browsing modes refuse IndexedDB entirely; degrade to a
   // session-only in-memory backend rather than a blank page.
   try {
-    if (typeof indexedDB !== 'undefined') return createIndexedDbStorage();
+    if (typeof indexedDB !== 'undefined') {
+      return { storage: createIndexedDbStorage(), persistent: true };
+    }
   } catch {
     // fall through
   }
-  return createMemoryStorage();
+  return { storage: createMemoryStorage(), persistent: false };
+}
+
+async function bootWithStorage(storage: ConnectionStorage): Promise<ClientBoot> {
+  const store = createConnectionStore({ storage });
+  await store.seedFromRuntimeConfig(await loadRuntimeConfig());
+  return { store, secrets: createSecretStore(storage) };
 }
 
 export function getClientBoot(): Promise<ClientBoot> {
   bootPromise ??= (async () => {
-    const storage = pickStorage();
-    const store = createConnectionStore({ storage });
-    await store.seedFromRuntimeConfig(await loadRuntimeConfig());
-    return { store, secrets: createSecretStore(storage) };
-  })();
+    const selected = pickStorage();
+    try {
+      return await bootWithStorage(selected.storage);
+    } catch (error) {
+      if (!selected.persistent) throw error;
+      return bootWithStorage(createMemoryStorage());
+    }
+  })().catch((error) => {
+    bootPromise = null;
+    throw error;
+  });
   return bootPromise;
 }
diff --git a/packages/client/src/lib/connections/index.ts b/packages/client/src/lib/connections/index.ts
index 0bda8a6f9..c45548d5b 100644
--- a/packages/client/src/lib/connections/index.ts
+++ b/packages/client/src/lib/connections/index.ts
@@ -42,6 +42,32 @@ export type RuntimeConfig = {
   connections: ConnectionEntry[];
 };
 
+function isLoopbackHost(hostname: string): boolean {
+  return hostname === 'localhost' || hostname === '127.0.0.1' || hostname === '::1' || hostname === '[::1]';
+}
+
+function rewriteLoopbackUrlForBrowserHost(rawUrl: string): string {
+  const locationLike = globalThis.location;
+  if (!locationLike || isLoopbackHost(locationLike.hostname)) return rawUrl;
+  try {
+    const url = new URL(rawUrl);
+    if (!isLoopbackHost(url.hostname)) return rawUrl;
+    url.hostname = locationLike.hostname;
+    return url.toString();
+  } catch {
+    return rawUrl;
+  }
+}
+
+function adaptRuntimeConfigForBrowser(config: RuntimeConfig): RuntimeConfig {
+  return {
+    connections: config.connections.map((entry) => ({
+      ...entry,
+      url: entry.locked ? rewriteLoopbackUrlForBrowserHost(entry.url) : entry.url,
+    })),
+  };
+}
+
 /**
  * Storage backend contract: connection records by id plus a small string
  * meta area (active selection, secret material). Implemented by
@@ -194,8 +220,8 @@ export function createIndexedDbStorage(): ConnectionStorage {
 
 // ── Store ────────────────────────────────────────────────────────────────
 
-export function createConnectionStore(options: { storage: unknown }): ConnectionStore {
-  const storage = options.storage as ConnectionStorage;
+export function createConnectionStore(options: { storage: ConnectionStorage }): ConnectionStore {
+  const { storage } = options;
 
   async function requireEntry(id: string): Promise<ConnectionEntry> {
     const entry = await storage.get(id);
@@ -253,6 +279,15 @@ export function createConnectionStore(options: { storage: unknown }): Connection
 
     async seedFromRuntimeConfig(config) {
       if (!config) return;
+      const activeId = await storage.getMeta(ACTIVE_ID_KEY);
+      const configIds = new Set(config.connections.map((entry) => entry.id));
+      for (const existing of await storage.getAll()) {
+        if (!existing.locked || configIds.has(existing.id)) continue;
+        await storage.delete(existing.id);
+        if (activeId === existing.id) {
+          await storage.setMeta(ACTIVE_ID_KEY, null);
+        }
+      }
       for (const entry of config.connections) {
         const existing = await storage.get(entry.id);
         // Config wins for the entries it owns (locked), including on
@@ -286,11 +321,12 @@ export async function loadRuntimeConfig(
     const response = await fetchImpl('/runtime-config.json', {
       method: 'GET',
       headers: { accept: 'application/json' },
+      credentials: 'omit',
     });
     if (!response.ok) return null;
     const parsed = (await response.json()) as { connections?: unknown } | null;
     if (!parsed || typeof parsed !== 'object' || !Array.isArray(parsed.connections)) return null;
-    return parsed as RuntimeConfig;
+    return adaptRuntimeConfigForBrowser(parsed as RuntimeConfig);
   } catch {
     return null;
   }
diff --git a/packages/client/static/maskable-512x512.png b/packages/client/static/maskable-512x512.png
new file mode 100644
index 0000000000000000000000000000000000000000..d9bfc84452a1dea971f8dcf7bb45901750031a0d
GIT binary patch
literal 126564
zcmeFYg;N~g^98zsyStO%?!F5INrFRg3m%-{zF2TcAV6?JNN{(T-~<T4-CY*<-N)zq
zd;i6IQ#EyWXQyWBcK4p{d-~jH4K*cPEGjGj0D${i`IQy`0DAri0$`v$50^eu_s;{0
zt*ojn08pKX{rDdB`8$K9vX&|U;Ku?0z`_B5|89Zp0RWzS0KkDc03eYL0Fb+8wP;E`
z|A1!kR_WFA_<Y>Sw+25Cn6AnO?f?MZ@BdEVS57?Y=ZokbuT>S$575!^(OK&ci2|OV
z2zdQUR>x=IsNH+%rIIJhW7fe*=8BlFP{C(Kw-@<1L_`=sP<R)J7`Gn=u&nA{YZ_Y-
zPH^xiuk>zTxBPP>ezed(-<n|lVkC+IC+Y>tu-v3_@~VfW_v{^_$fM+xmW*16=&kg9
z{0enTDd)1puGH=nI|JkYfBb*J0_#W|mJ9U`8;~=Dc>-YKtTK^rb0IuD+=Z-YpcRCP
ziHS6}11#N+4xN|U8ml`ZFdu^%JjTFdfh_Px+l9<VLO3&uquLu;xgJsAB)&A`IyFxF
zikHM;+%jyX%htIw*4E_W0(pX86G_+fOMh{WZAPi!+Dd1qrJ_4!pUXwhx3#GCSgm<G
zg*G`hc&G5{W<m|IJHyQQ{2=PrKxO4yv_9O^$HK>J_23fsqc!I8yNGhhVK>kIgW>gT
z>Zf>d+yhbtf5!0(>#xPCF+O+z2aTb!NaNYC8ZN!V5>sx&zP#lVH8L`?8Nc@C2gTla
zf5{7Mhcr{K>Am(&#M9TnEF;b@-;<Ky!I)n_&%^H?H`L>&fb<~vVlWf(yqA*|QWK0c
zHJN?D@VR#tn%AseD65%Ko0-#*Cr#N#nMR}L&D8>gU}%_IRM~u*$;fxm{qe2KFrRMU
z?_*NwS%JIzab$`X{rmFHCd+{e^fb{w5O|hL;K`O*=dtHwaEYzlv*pnK_v%+Yg1N8L
zGr@@aN+9gpH`BZO-1LV>TSzT9-8krS?%vwEkf*{v%d9%%*=q6%kvc1Ksg3%@aR3V@
zP<prd1+y&^tm`*}jR<21iVZ9t!xq-<soFwAI2%|oa;EGiZMWS-ytYWTLoSnMd&e#5
z<%B$Ud75!4%MCo2f{lYbG_^oPL><7-B(U&sRtD3+-tnEA)rSb$$V8f;16QGd8S@{x
znltwJ^(`YQ<HcMq#MYEi7%05my+{nx8fuCNfG*s>cNxK0K!5uO<j5OYk$;HkAs(KC
zGn+yOnc|p=Y(2hKHEM8f@w`ZFjtt)JM4oK1vl4?L>RtYT0C9E{Ow3h)G8R;>hZtk^
z`aYNA1Tkr=W@cg#j2J%XZ%oND8@^j&nKm8NS&7j4t=mN0WqRA&!Q{HORi4G#klOi_
zE{l-p#hV+?HigQmyS8FS<#|T5&=k<&3QdPy#VO_HW*!C<EjmA)W=pCej<}KVR_a7=
z<jWT?0<Qk=wSaNIv&9AU)6Sct_^Yc!^v&}=;%qbM@wVxVDQsAfFRV*Aijsj8=c)fh
zW*j6GH2(rI9#?D<lE4R-fPH<~5j3LUhoXD}ImG)(L4{8e1*IQ9R`vypc1}Fi_LVQn
zAc`|r8yRB*+a5$18Q+Wi=XF;LS$*TsVT$`Xs?G}~r2KUv(&u6&44uw*y1##qv~1^E
z(^i|;Wt>_2+l)C(_%q`+kirBoCX*<4Rt8fFyT4HZ&PM^R%V3?}KYIwe7zik*yOTgz
zFpKi&Lwg))L(38oy1hF1ZYJ68s{hK}?(&^&C(?oR3(<3|hbw3Sh=|l^9#4-0M{m8y
zo8OPDKj9m9HZ+{|V|w%an$co);f2-E{9eHP=#Zq2ePvTUdPE9x#_)_WLC8hGu#tjp
z02&=s1Iq@NLDGJ!4XpVfXiUiv!PS~;@#Pxvu`UAXyjXoW?u`5ek$J<f$~c?#gW|;t
zsf7QT8&f_KX5Du85CmQR_-_@mKX-61dEa~Ra%!cee%hpAr!6U34od7h+kUf>jB#s8
z5H-*G=($?G{DdBL3za)U=8D`D{O+z*y|sB25>0GwQb1E)Kt&_DG;}w<OYYZs7FSyN
zv~>Eklepg>5B+bZbb2pP85q}p!vJsvy|$0e$Ai7I^wKTY?e97Q6gsK|$7AujNPjrw
zbbqq8-EAjtkTh^uHMXl@T?d#$@0^09t~e7#&y$0REdXU2zw(p^<(76pOyq9{F%0_R
ziL}yQ4kO+amRQo8nPxp)E&Hn>GL4Yy_%rmUvdYTJ82>kAfZ)Hrv`)JLW_-x4Nr42?
z`QS*5{g5Xt3Zo2YxB1OhwuLw%PwM7dz%<TgW7O+_Vn){j67y@KuJ0*%1cUx2c?{U<
zA+fwLWL6VRMTipmHLus6bi3)U=t;+BYC+<S{)-ncDE>D~{{9oe9K}pgC&=#KCo=>>
zGrL{FY_7H_rs8#XuL{a>a3sy*_I2%koj*w+b#D{s=gobqm~4#m%i`BU!m<4q*4&|H
zpwTm3`LqvFQLwm?GpdWV&-G-(H(Xqfh?|>L&wt$m{whR7ME}FC^w4knQ-Zl(cl~*f
z^O%1iwdsp9x(3)#+z+B)v7FjK-C_{}d@rNC!MolWLsr;a)AExVFmrDJ(<$|`lPklV
zGVlUbGBwwRi`<kIV+Il+NE0S&{Ek@X5FOnKC)nX(=D72+ZxMOFKH%^83{vx-rB_Iw
zlS3!YiLvQpEB=aXB{DTl+S92W=`s><Q5)Or6fvBlK7Pm>t~|N>HlOmK85hCK{Q32(
zZQ>)5z`5T@m9-cRb&PF{^f-)d0Gkrlm41E}LCKpCVOc`+bL?+T;0wEA;i#D5D7jS(
zqSbG~>&^uUY+nh_n{^G;cxZ4F{+!AjKdRG8`nbHINlAi>G4TU1G0n_;BoRxoX0Ais
zV0`33Qd;E)-V>%mwl9}hjNgN8ggSWHeO9u&Y+D=63`#p_I5jY>ew*7k8dzmDwDzR_
zf&QJ*@QvrPw0aZrO~WCgM5~Ck>j2C3=7|!o62$gVhYDKpnOwMT)q*X&?NUAo7m=Kc
z>Baa8k57o?z_4J&$4WmBY1Zg;{Irps+qyltDQ*6YsAc~PJWCj>*;P%uS;y&0@M5JO
zFE5$;(8cKM3ur>-@nv<S$<{@*uP-*UyD$Jv4{JJ#FPB(t!PH`WjK8Aedrz^g&Rm0a
zT(Y--2sd#I8Fbi&aH@gC+8FrmwZ4h96g;UX-%^||s3|@ZlC_zGj&%e{x6}a}WCA0q
zP9f(8%AdMEVXHOs8-th$l0z#vrl|4Dc|5LKZ?bA`W}TlRZwi-zn3##+{{<4S60`1j
z_(HDtnY$>hge!aiz2&08;;c@5Sb%NMRT1C(gFg}K+-Sg2Ur}@a@q;at9Zf!;4$Mv9
z<y7u=rH$Tnw86;J=@`eIX+P>sq0kR~7v=yu{3OzyuTlUbNKbL2CW-rkNo^Ssri2}^
zwdoXaTi|{>F(47(6NcfW_;ZfbG7vTV+enn2vlYmKi8!mMsYG#t8voerU<=~cr(JO$
z20;{<71N(~t0>>v$o~f`i0$+@`4=grrVD{<EB+nc8lFMl^`)%EM~wJv8cD7{3Yrwu
zx&FxgbKh%TF8gZYtDF&-JX^5;YMg%Uz!t~tzJlM68&?OX0%+&3U24$t&76lQ63swX
zjc0Bg4WNbQs-{m%db>o+{n%&beHMa$1)m6^F^B~At)Q+kQ(66Fe6=1QFCUA+urcIH
zdvze6YrIFg>c6(0xO(q{Z}VJTP-_vG%k|8D8vM;8F)~|mbLd@sCoOs5h0d}7Awvq_
zyCkFYeGU*Qth7ea;GEE3@A=2-vzs{!e_E{#wUzb+OYX3+ap0z)OaeY|T7AXt(7tXm
ze^`jM&nRjCyuJ06U=r{qFO2HfQO+9WIK@T{YohE+c-NB?jv`h`mE_aX(~HHKQ6Yj!
z93yX_=E_SnwT+Jj-a7{5!MAG#-Z%fRA?5xvWQT}P>r>W6uJ6LSJSU_;QZjck!-!?W
z5MzmbAcze{o9WDa)}EWK5ijVt&u4mb{_gQNK7FsSI{o`%6Is==LUpUnbH@#ak21GZ
zP}~_}m=XXVm;=-3MgyU2cRAs{Dq_+U(*p==@U3qp+Z$h9@?U2QcZWo}OWkS!txyUX
zaF7$at6qxQtb7`PZQ6`D^j~{J_srwL>xV9_n-`6C&)Awp@IP>M00X-`d4secLeS}a
zMwGo>?6^-jbY8$aYJUC6{wlxW#{$L2R9`UK_!YcIu>vm<J~FJ3{Yv^6>Wok3g$nP&
z@b>^LfUG280pv-iXf@dYZqO8P0{xPzi|Q5DnU?uKf@Dh~M@##>a-r+&ck9LKw3bpR
zC(WhtnuU2E6UGUz6;O4%>B!CX!TyxRI4TCeXv&WD%_RK}t9x&xpWSZv>~`$u{}UWH
z8k<Kf_xe~e6OUd-#o9o|xtdF|!R32UaClk!)9}~nt6Z&iT2^ZXJ&OB}kU)Y2XHf=B
z#u1dwURzjX_^t_mcjsMofzP$}!=4UR*)amCTs;A!1Nh-g2sC-3^4&0*BVKm(#6mB4
z0e<747Cmr#DQxT=^oA0;I|Ox;$ipm3OcziNV+)feA@~~<6#9+?kP^ooE6fvofb!P8
z%T{Kw-@Gho+fn}Mkv)WwKgpF8g|BPWVC82^hU18jP{+ME@9m(8cYyu5Py8;9khaK+
z7msFPk7pInRia)<6a;cym&`Vf&Bg7ckV9^^-A)Z~2E*eFzIh`1uAb3@0&<lx%f0MB
zn`WwA+*iABY+YqT;8tfj*59S{^}7vSaC!b)G*uzfyGPGQ_)Ym{UG_^m{l&oBF+Bjm
z2N<jQ3^Yih$(?kf6-Q$+U71h=Bn7l%mZ8?CjLoe^x61`y=3q}fgmjm8tv#6sqP%j)
zcngjWLoM?Mq2%z1Y`<K&q~%OMOucPJR#7SqgqN+Y{fojQweaU7jJ^P8rOFQaFUH2l
zqnmj>9D4@<x>lo{@5vK1J$NiE+bWsYSOA;w`Tf{%6`%qzV12^vyU?#)i)Y6Qe9_H>
zzZ#f2t9GoN4A>A^OIVZ%#eX^*Uk@ozs`9+qr%0efeP>w~57m=7^fO%wBGrww-PlD=
z554b}X;-i#?IM3LTVx74pZ|>?g!${V^`0^^p#tgE(B$nha}c6GA_mcPe|;fpg~P88
z_6vhMjZ1&ZMO2d>Eqw2`bkYavhrC9~L*YZ)^$%IW?#>>OwWsS!>b6{uOBA@i-TflD
zjt&rGwz@E{gZ-uLx~B(jE&@29x|rz_@?FP_41neyDCgs^8?FrqVvLAI9QuuDoHW>E
ztf2UZlFeba&oSZhWMuHesNncxcjD^#FV5Q*cEAOSG45JrqS1_GIy?FVDm<3NR-kEP
z$(L$hMCPfG%~tanK04O_Te-Mk1R%#BWv}-WSL<AFvb{%dW@i=_8=U7?>^;?~6VQI)
zpiyHdzs@E-4)rwQv?-4gmRN2+dz?(2<|+u=ltp&b*IS~;I#&jtuegh-Ng}_;ulnCC
zj#Sp0jyGMm?soV*K%OS6PTI@cKdAQ`8-ex3I#7SIxjv*}usvYu<*p8NJ~a1=U2GAh
z>zB@F5!;>YFs2LSc}w#JODFMymP8T3r*<wnHEy8<!ZOywz>|zy*n#HSUL|Ndn_(KQ
zj<gVwNAE8K<78vjsDSS&VnYyu7q_w0<VoXT8g^P9JZO&AT*^s!OGTdEsjuCI*5Rjz
z)BCx2v&!b)(aVg}C-uJU+`GA+Ui_tH+ISH|gVcJ7;}zr5f0^SKWxdcb&v(@oO4bHW
zIQLJ}YLc9d$8(xa3qj}bxPNL!4}Xx4$<wo?YM7YnD9<pr9*yGi6S2GcAnA7+d>3qJ
z{I}ui3ZdX|=wMqE$3vSi?A~uFowlo>x829YW@J8$<&K8;!G980cJ@b<FkxbSg;ERG
ztnfil>DS77Y)@NZcF3ZUzK`p_9aXazJ?(mshv9XX#|?aBZSvovR`|j%DZjP7(}|@M
z_gY<iC~jy*iyB%_?QIGLLtjyU7yDab#1k(~e=QGnh~mpOyza4ddO#h9X#nknKN^fE
zyt=B$_s!hHKm>6hHwn}U%@E)q=ZV7BiJ~Hdh2sp)gX+BU#SC3#nz&10-(0b?y*)}J
zS-E3ggf}Zm4jP)e^POO$x>*n!q(zl6gw%kNr_otW>aTOhWp*EPZzmpt{lkNS*l-Bq
zAa}13dFXG1j!$b`G&0njD04osZ>Yz*TfU-DfT_kg(lP>L`f8i9&CN8{tztgIP+?F2
zvNYZ@_FTM+B3YKsxr9t}EIg!%x&$+f+*WXpTsTw)A2+7CbgUZ@6F&oX><_>Tsi3(B
zk)D%Q7?>V#f(C$(m|cP0y;t35**OOij;T|x+|hc6l54(uo5nkStI<s*bt*g;3Hcbl
z>C(lZprwzRx=7PpTF+vGJM*$2XR4*bzHgf1>b65l&zp<8PG)NCHdjsDbG-fZalMhQ
z6_HUITIY9N8`2GEy3*}`nMRPB7Lw__k=DLW9%F<+jIaFVHG-_pd)Uv4A^&1{W9zzP
zeHpM?VFc-e-2p+@0}1QXyoT~J0yAye01A{TdE%kY+id8K6zqW^(_~_I{r$CEYJdRU
z4TN}YU`klMau&MX+jZ-e*MiPQ4>$m`fC>H>+(Ts4=EO*|rW%NrcJLT%rnuLF5wFo9
zSEt_Zp)BtCs&5DakQK@qsYgGsQVKkGuFz$gZD%V)mk{4NTWAG&z$<{YSs+*QI0eA;
z`r!0<$$j@3^=A^YwcXCjEIFwkbW*cTm{%j(vWvfGhAhPBbf;J|XpR2Ji&BXLrOek4
zQcVcgRZv`om)IM-&sPej5G&Ntx3qY_?|6vdIt*}KY%uZ830he}NA8IRdl4OwUl~5r
z6lBi~m6&GKOQr_!gDE)c>V4aN&usDd>Sf5Eu&?nWpPtS<t;=)8x%REzjdE-K9jg6~
zttFm9?omOZSynLIzQ-!-J1%A&iBTr(AuMZx*PP>cX_PKyX!TgVUD!;0p|;x}ar|(-
zdf(WoyAiRfx)+SrbXO2J!prKofbzJ!dRF|)q<MSqp#SuJ(0KiEv$ZcvWl<*ls<q62
zLYMci#t)4f%vHp9;m0L)x?TYm7K7YGX+0bI&IK@6ApXPxuKC`=AC?f;7tHemOSLt>
zE^PqyK%K5FXLC5F`Rxa0xF(n*>|K!~7E~MObKarvr&kVis7XL2CGg{1tJk`^^HOM=
ztpGy{E#L@*!JG&cWA6Sen*25L9@{AZi9ko3wZGD4#U_BW08Y`WMl0{fa@kI9FKxY@
zaYS-D{2aHjG!SvGvvc1lxM-Goect9S`VKB6`PuS%RFN`c-3#jDjV?IqjE!p(-$DhR
zF5385H#v4Y<|Wzc>*jmbujca4N!|BAP!I9Yx@yd9YLqPSOlUl__C#tV&m8`(<jUj7
zJo(A(UXFaCl;4%PPKTB8cA7SS@E7|(rDfA$T39GHB9~k}z87wj8Fp79Zo3-}=SNMo
zUoh1iTmI~!lz%H7Lb>{pXndm=a$l=Zfeg4f-+1soc@C`1oU@gKv><<=S&QxREb_9p
zqV2Kk@6c(TNNzLlIEf%XVR)e=Z3kO;JQ}~eI?33I$$ID00?@e18wJM$UP%m1ht;Zf
zZQKBlwg1Qjvtg*U&r_<H^YP2>0z84zpm+%QWEDlF17q*=5Ne*`PnwVOSP^((`lk2U
zftoF5e`jBrqvlD4;s<--o!%A)`q-t*TPu>;7xAH)6*~^|nL>IlN|2JfCO+%<OSfsr
zyScKV%VFxEx+dh?T*w7{J#2h+Z_`Lgq7_!VLN;ysYUM!Su01N$D~a1O=Uy2n<=AYs
z(BeA7>g_13f^#Yv*mR_)6MyZ!aK|dKJY&Y~xZp98^G~hi#s#@1T0(AmqjG=P*-oka
z2HHbRz>W{?i4HZhFnf^hEV&Qs9=cfx94N)3mAc=25(rKn6E#a2Kh@`ucsm#qnw50<
zcWH&AHdsMNns)d75mLRn@F4c%wjBY#P7brnO;>qDh3>I-X-&Y6x#iUdP9=Po`&(&p
znt;hdUW2=hUC0kJc<AoLviB;w)mz@_`AJSg_Yu^**GCzREVWPA2Htq%){43u0jJ&-
z8!fh1`TfHBBWU_D!TYMv2N1zM13{R=HNCUQ=nk5WG}OTy&ToF)2#fEu-U~yq2bZ8T
zJ^Zt!y)u}B2ujSLgYIXUdJ~zZ63fgFe**E!#@4lS&9=%WY>2^>yMrG3TV*w*(*^a8
z0{TxQmXW8D9F@L^#t!LBqm}woL~G~e&#=hEr@4h6R~aSs+huKy<!RpJpSPReoz8Kv
zGNF8z9g8i)k)a10zq59!S*_ZWShjkj6JEAgWzWmTvy;k7nkz_=kn?X<-~XBQmVe8d
z>x;<mi{&wDeV9pE=39@Be$E+Le0+jW)98@eyV~5A?LJP<L&!33tmyaJKr;ttB}tbn
zWp<@5iDDMZ-$O?Qwl{cQm4N}@bBx-y#XZ#CyS_e9Av|MpLAYogu`^kf<DFky<ky~5
zyf!csU(gR6uI|NOpQ_~vTI)r^8+&a#;oR7XG(LO6ODi80R!%5ia|Lcybe!CwI7l0k
zLHUP2_h^q%Zbq&I;bblrs$LezDI5YP0_mz;r7;2zz4he2G-m;7xVZuDU2rw?ZPAc!
zGw?k{lILK6sDq2eE%OEWT{`41-px1Oz6jGf`H+K1JbBId=4>h?{PQ1uUiaGJCRG&e
z4E-=FCIE-LxbX;?Umt5CUB?afNz2<DL`?b3a^UWWUV_u(QNLKQ=kiLmXzr@%GrTbI
z$tK%IN5%c>79>6MfMX@t8ivBjzoj!e9DjQ;M}enq0x-y7cDRZ%yeNOO`wJ&>v-A@+
zbsBBEcd+Noou2gNU>Za;;3&x8xh*2_Uxic+Gc#;-GWgN$8s~DC+Sssq_4c&msH;FJ
zD8Mq@JFju`yG4+<q>HB$G>fISGgt17ull~IuCvcKZtpZ-hvyZ()y3vRxd+p`a<hY{
zc*Q?_0^{MUrEL*ywHi}{YLs}N^b$YyN*j6QJnbFaFFe|5b!gY8scRX$wQ0n>iaEe7
zB|y0|(Fs2d+~k+KIG3^e?t~`IS#^o>qXCq;f?~zp`X^CE1!`x*mW`Q5r{M&fMG(|o
zLjX^Fc{_l*f)?K<Xa{?8)*rP`lpatkg@<qmUpK5!@d+*q{lMi&y?J3~+)s<o#pp0?
zF7%>PoA0MLH&pYd=eq{a=}zQ9X>P#3J96p9ynugSA8zO$KgSbxW-n&mSYJrSl<mRt
zWLre;vpmc+xO%PI*^R^a49_lKvR_gY8+ph)2+4~8wAsJ6?bX=xHk3$6dJ0jP)>r#k
zji)-<(zLBj?$Z0gJJe^ovQd`aboC-P==Gl&4DfTh_2F8Z{nPC_N-lkOmwDQW9C0x)
zpl)|4ORX3p_u?iwMkS`}U-;6?Pz3$`$>VJD!x5SF`#??ot@b?^ED2><X4E7h`LGg(
zm`hJhg~$oRgH%tiZdV~+`*&vwhF3Y?&zl>*=x*w`eh)x7Vw8-t|1Gw=#n^##a+sSe
z29zI}2D|f~VYI=q^87!*AG8ZpK4yj1-=pWECUl?+wM?U3d%l7Uc7`_OPQH-q<YP?Y
zk6L7WNbkzy3d_+cqL&7-<t?&TYu3XNMqZ&3q?lhF{gl4@S9rz}0P7WX)kRLe9dZR8
zB=80x7WHN#A)=a@6+^pTJS4|--?Tg|^9ULvvJ}*D->Wm4R3C%pRnm?pilaW#H3@9`
zZm5a5UPQ8Mhqq13&K&$veG|Cu({x=||5fSW-&otmNmycAAc~aK+fHR=vHWL7uxFM!
z{ICMtVCysBfW)1dExn+hN5b))bjrP5y=QZDT@0*Qns|RF`f94nHi^mT|IBCZ4to2x
z<~3`qg2`lqX&QWIU5J)e^hJ>Tn`(}h7@gf0e-4b_c^Da_YEPJ(TMj&iZG^cTF~0_S
z=ECpwD%K;$spM1{I7*;WD7LMzzFEWAPJ0~|6evLpfcR{|3^s#+0F*);=@3Hne*yM&
zT=&7rR@EIY!IkD%Oiyo6)39cRZ@V-#(4gQesl6Ti+*hUbp;|eMAJTU)PALD%D8v9r
zo->5$Lhc0h-(}A?e-|CY?hI}@UxhNQl6ep3(-WL-CRz|s4V!a)wmuzPNk)Lfmstcf
zG#ccs2PH4wlwMz-xo*b%HMhQ?v^BZ!^6uEy!(07$@t|dH-m@9=jIROhvP}=pLH8?Z
zHjOLih|+{|=f_Ekx4hhB*Q2|~JQ$vXV<$6aM6qmxj-TDhS}qoo>uG%#61kdJ*C1<f
z8Lw~Zdbdqp`WQy|rXbv})~|el3d2d)72m7bskAX0a$dnIDEw0$0+2>}uIH)4SxcNx
zM}8Qift(Y~zpd`HqoPr7Xfl}hzEs`QP4t@qOHj3Fn|cG;?OnqNLvBRETZUE1xE?0!
zmiZ|Vf-eusNi+m6nUw&2YliRLl%f-ZoH<VxAc<}7B935_*nf|LS$p4os@dR9#@h8t
zRm&MMv^g2fQ}eCKyIB{l6S+<#aZca2AI<19N5(03llW4Hp7-bDo$V;tyz_WnPv)Qe
z+IQbBaQk)RDnk9n1R3Kkb9txU4q*pkCQ?t$n!b{gL+RK-UH#X5gBWk~@zg*@*32P}
zW;RZkMg&=oiH@V6&R4K3JNIfNXX#|&Zwf=09byam(&qzuEdGja(^s~T)GmGQ`q5<W
z&L1K?2${8Mxp?=zc++;vh)GdeSL`AV%Qib-)i9X6dQA6DGxpQ{fKSGZmxhyj=xVhY
zIvNsS#ZzNu<Smq$eP#N7W6vvLk@V%>S*7(S*?HM7g>IjTf4bSUN)c;-X*te*)aw1U
z!K%oj42eW&yF_QIUwDZgayja8jC^ZCi;@)#7Zn}&CI?c`EC1=g$*C4&@H<I^ri(@&
z18WoSSJEp}hD>-g=az5C_4$c~mSc;Jbpeu7G;l33*S$9r=_!%Kz3%oOOWdK@mI%8c
zsEP-yWgM;w1V8LT?r0C05!S+;4_|a$N|(nfqX~AC6Ui*eAN#exliMf=KkN))zAcw6
z%h#9ZXAXN(qM|&4OzKwkpj=hg%Jv~#CpFFIbOdt6loK#<`qbzM(BGkU%y50hz*0v6
z%!Gr&9dh{l14d{sEf*_DFqrc^d6IHb{0(WXQ2*qTY0R!MBT*?<u(V=>jLfoj`*UxJ
z*_pmDrCF{KovC<A|5SJ>N(}x+i)F5xmjT4JlJ9w!M)TX)b~I^|Lt8>9mt8+wN_$WM
z)!l~w=+QMHx{BG#e(sfH0VvbAm&z*njzBO)gdZhl&eReT8Hn#LU40E&wKikW`&s0A
z#D~HEMUj%<$*MdbI+d}Cci_|+&<;U-?d;s&IqbOdge0fH!Us^F!Ty$tAH`J=CjS`c
zuv+CaunW29zsg5Y3J0GX82A&~@OJVi{xFYgsFZY9)lWgZRZ?}=j}sID(bZSyeE`Ad
zUX1<&L-Bzb1U{gPKqoTK0s^}(?vsfies8ZI!42eW9}gKHvI7;HqC7iaV=D~<9@yMw
z!ka_g5WbdMMaC|3Mi?3|C&bA$VlWHWzK~MWd!fzH!iVX>z3L$Q`6w3Nr0lI^8wskV
zrllN;6cPh(qIOwbPj?k1ot!8)7$}L8%_#+Y8r{p;bijh2r5u>tW8OlR;~6EYrO#Lz
zE%rjACWpaa>LbD9M|z0)={8l>g`%vy8?GE~Vfn_p1#!U_aAlw+DiyIED9_5(iK9>>
zQd|y4fon;#=Hvv<B3kk<fx>+W_EXm-R;xXmyt3jt7?Io<0QVJbTkm}7?bw5<G$}>g
zAu`bl2;!`0+QD`A4nC_DEyIOd_VpCEo_pcjShlL7y!}#==6kXnO0OHNWCB(j3qN+B
z4%bK!yflnc;rGkNVm$?TomNzRDE`ExXhQf&K0*oKx(T^XQyPeB!g;9#u!XMt9U~t#
zS9Ls=@R22MMGfG~pH@s)n8>ZK3AAc`r{6|FFc}|}&)KiAJ1ypLijqFX$cT@zMis|1
zA%VTdU!BH<!W%d(#dphQ2M03bM!sGyWlmEzj*hY-=M8)4yAqbis#N@}C85MmlWJlP
zBKbDjS1-MpXW?j;wbs)PKI$yR)>@#rAX&m@OqQ2oq^fu<)<7F?9t5K~{;}o(cfJoN
zWeJQR<Cky>W$I6T886++s&87NVTDsJh@*rRsY`MV`C{p0?&Y1Jh(!!2&q3SfYGcYV
z!*u^GEx16=6iPN<Ps!#t!X`^zUVe&f&U6kqU0X#C+&pgLw_k9xvoNfOGqM9P&8Tl>
zI*u0n7rldal6h(0&Ewans;_=++yPW{{U~?vw-G^na~YKwT3LMy@F>@a$9U`1|4d<s
z`Q8xdN%=+vKG=``d8eN~t8X~5*8r@Mf!Dk!!za-dB@wwtrEB9IfCQCAw4S)EC$tJU
zrl3sQ47)?axYgGu(Tsp13P%~<f0ljDsVu^4u^vSvOBvYutx&SsY{Sblg?;2H^Y_d9
zF`=>024d*`1$ou!S3I8@`Z@$eh3G{MrPue!Rw>|AQT`g3DOPezHJu9Muktt3A&oOF
zc|j~{TNGWClB2J}@0+#PM{DnkI;v<D-hZJGkvr=P6FYIodh@OHrRc&IsfeU)SHh#Y
zoodlQcpFPrwbABOtfJUW8Gl7nS^rKsm3up8D!Gt^0&1a9I_YrC1pT)D=`MvDh7#U(
z)71>wNt5J&H2&7@c?eDxq0X2_b3-x7Pg-5=kofqa9ssce$BsyTc!!5&z?#Xa@AyLy
zpvwull>6M*>LmFOC^F!6rJbCuPyguKy|hYm9eIzXg<Y=n-BB$Zh(A|ZJZ+3sf8~mU
zkj<D1+icbMtYpU><}448rs2EpqgrzDP7mh&*(zVIuI)efm~rK0=HdqWi-1*_jlFo_
z8|0wKS@(eR20Z5uYdre4!uY4ikFK$Q48%UK<&ZLvg->5{+6KPSCLpARGI)@@KRqED
z&R!rl*m<epC=3ju!1}Agw|H;ZwUGO)56nwtM6K~p@u!QG$tB9DMk6rTay6NlEAHOt
zQO+5nC1U9M;T~=Q$jB?9avx#diw0e-iTm%nx)}-nV)T0d3M<SK%SsV=9z$I>RMRvC
z<Y{k8JglJIjA6xhT`-NOp^CV;aPar@aJs@N2@$b0`UP?l8IF^Qg=hU@j}zV;^A`-b
zzc2}a)3-cEt9$Rkq4|4!%JXzP?83vdfA$2v6!YQg7#B!)q89jFUKVgVKrXjRJC4l)
z&r=}*Tct=;mKTpB|FP_qRFd8&Kd!DkFCPK{YyO{9^s>F@|Gmv_FRk}D7dP;yD|2w0
zYbB=s_+BXYLlX%%&zl8fsBk_9WeHPOuzfUnyAO<9#s&A+DOEvo^4Vgll{~hb@6Q0G
zal;IQ-k&YDY&LaKRi%>M6}De}#@+?C?TpYqp5=~i@*;kYpwE09mRMM+B)tARpxYGu
zBklCFM+Vc<w=jws;VP+0x4S+|Vz%84v@B!><=_n{#Ypy0P0Xe$1B})fqDT*}QMk<}
zgbju(f5u-x5}uox%FCsHtlc;%RnFi~_@&XLN~H1g1P9dus*cg>g;PBTV#)c65yK#V
zl7WGv;=_b)!xHo(;yR5Ja7AG^8)s`G^1IZmx?4T?0L#h5LZc8iiL&wSzFP~mL9FJY
zf51Mygagg+6<gHpkUwY3)+oQ}{o}j)sbhDa)!a+hO(j2lTB7rYp{=68wO{3d6Ynje
zs<q2BN1ev+OYs9oz&8-rheExMb4buZLGTp10O(+gNZDsJ>3=TR%?*|j5fOn`CkDm=
z*HF{U{O?`E>Gj&P)3(ZALiKVG9*4!^Rk|o|H8p?%u33T~h4YsHYAZtBoTf_yrKU1n
z`@d4z4)}dQaQ*rEX^dUvasrPAa=sTRsmtHdSn@0`i~5t*Da}`J5?zmLB`#NkZ3#tJ
zB@*9!C^F70cO=oF2wTg;V@hFOZLU&cEP!LOh~(F5SnkqMPq4kW#7;VP+pd93r+tJb
zhQuSSN3^<6SAYB~e0fZX`!Hjzbs4sKvc4y*prgXDs%jES^y+We;41~2Z{#`V0OGaF
zWRWV*_i<0eeO79MUk-BDfX3po7Q^7cSDd}KhWnMAa^j%tY~u~?N~2!v3Tlf1IR!SL
zW0#;N%CDv7TO8)gZ$<fR5nkWAqzO1eGXR;S@TIr2Zu1e$OSkKcD-W&GOZWSDI+6K?
zUyPz@SsNw=e)LHx2-a{ZRaZIqwpAmKBk|}SH*yiySG&BeGU`2$b$*2yDb?GOzxy6V
zTyJTld<b?;9z*+-=zaGdSki;vIlQ-(#nqfw8D|CmSW*~%L&yYmK&2!1S?CLVd{n3F
zYi$3Km_0%|_51j%9)O)VcZ?(yJg;yy8=}_uEJHX|)S(T-vis1#qHS+{S4V_R+iwe5
z?5i485s{=fP}A1j!8Pek<FY*M83O$*H_j{wHanY?Av+?2?o$Bupr`ZDYFZm~m}H?H
z9Yr9`6q34jbrt<9YHqVj8p%n8fY!`I{N++nCrOK-1g;z-9Mfe3D#s%LU-!&|2=#M<
z2PyPX5I28X-RzRIQ~9?-luQ|c7D)A}ai&CA=X8THVUzA4D;95COJeX-GN(^>t&;wr
zJzP0V%+Ui&TZ`HoI}z~QW(SH4B~iTo>rHdw{iFxXR@uxFWNkYC@KR%^>99iNll7-E
zzDyiYFVRjSHUIv(>zl8`hD8Rv2@gtXGLN4jPkYt!H*^oSk5a@$i246ksCx18k$CHC
z-C;h{-W{B+hq1YL4e!4`**Un4*Jz<KT-1PNs52JbWfWd7{xgb#*{kf$P_Du!h3}*3
z#XrT4b7<<oL6dh~n8N8wfPO`|1FQ&F17F1nARL8mE*(0LOzT#0V}D2S9>2{biqpK>
zWb@10fw`7~epZ<k#o)3$EJ}<ybKnn4!&iaAME$7Em}mz$vnJxd>t`MF3YQTdgN3_Z
z`kYW{bWr}TKW@NT!>PN600J>IxVsj|U>fv458eoPe%xY7y87sh=37Y+uDaSb!nlSm
zJ_T$B(I3iJ;^oy4(CG6LAuju+eLTwJ+hD6btcG+FT$7UeQrZoXfy*A4b#K>N&1yf<
z--QStEoz4jFO1O=y-~x3PhbQcfaXmZApiJy=J8-V$HIp;L3iS;ii7klFZ&y895ZH{
z9%J~QB|Pg5i!J)pR)dB$ZZn){M1M#gzs^!na-8O6#HsImtoqpZj<@5gqg6(enQ@(8
z?j!KUW9?ZY{bQ{AtY}GN(Oq(5aa&(m{dk-+G}So){O9qd*R&<*;B${$_ig^Ej7nu-
zpG2x8ReCt;N?8`w1hag^?k{jTHf%$MVG&0IKd(pPQ3+=H%%+B%*}~3c@?_A8KwC`)
z=#&M}PoIumBV2<2atIWjxp&sYCniMebPHnIG1cI-YhVzdqkbBvcoklPqPC)KS@GPe
z*q~QIjWaX-27u1k?4s0aI<wrs`n>@L=x(-59P(Jy;xsSZ|J~a`Y~yS6G}4t@RwI)8
znl&8>bJWrZLub-*t=FXilW{5^MsMsjoCHaG*nlcb6~V*V{9#XItAr|C%6h~dr{$%$
z6|>IfjHR&Z1QV*FkQV$ru(KK3fe9v$8ra%s{mzdmsRGcBRdECE4F-K`1l?ogN!Zw;
zvP0Rct%=~(JfxO{q#aLvfgZbpZHKGQ{RIwKzKsp}90DgH;Q}^`L~{7hH;ji)`*9+4
ze%sQ|1-T3G@!u>WR#iDY{x{&+`tTInfPtR;F!Ue|+Yw&wokq@NGSP5X{vTgo*y)6h
z=O}uWrqY4mV%=7snssNIw#WDuhLm(0IQSEpK46)zdv-mJgj_2?tBF&%K?aL#fD%+I
zX@*tIx*Pr$JtB!T;JjC!1V|?mXfIEPM?AmUFy@PUw5VrsK{ioNe{7)vim5X@YJc06
zt3q)=MMP1pzXs%E)Q%fMd#2j2+~!e<;o*JP5Y{IWz8fixnXr95kT$tKQm|+!4KQ81
zjrq0LTH~_cSza8_=cjJh#unZ~O*t|5W3!!zl|%^ReY))gwI%%XyF7RZ`oskm{lleh
zz*)Y6hUuad7S{UExft8Nkz3&L^>uSu5KFGye;(oH^f{!S<yU{H(Xs~CoAv}yEp>qO
z{h006QP(VZmFt02VdhB94=F0spqOOX^-Jg>llez<<w{r)_obda8%G5M6DzKEtfK00
zi-;bnPwoJgOI?gYC&B^{Y-k(vyvBMeJP$p5U2l*mqDU^izuzcz2|wPpyopu2wNV^K
zNr%7N6h-cqU+#t7NHvxjRSxbpl0(Jl7128HVAb#tTt7<!p)es2%u&uYr4?Tk(YAny
zMN5$~>3}w}0#o#<p{_~%P|;5CUJiJeg~1R#AK&~pbV#Mp;P*62o+p44fD7#-dgjHe
z?tZ~e-tiR!|H3hpPeQw>>{RXB&LbRdb7tuj7yAxAB>Y>|B59bh>(oIr?<J>bC$oGX
z67mLn_ETV6V}_tNeeE!;1)pjePxsiIC59DMoHF!4j`(FZ@8Uk1<EQau{F1|5o3!Zi
zu%NhOP8$Yt$1qiEouvK~CwcdupIeJRzY)bjzr)<xC5om#Mj$LeZO2yw@R`|43$-+;
zb-?Wrh~f$@uL1DZ1zn^wzSy4%Do;=j62e(X%V+P>5wz@C146lBXn_8i`WN?^^Nr)J
z4aQa0f7n=v+xEmAZmYd%ep}>+EMPuN`2S^myK;Xs{T`$((%76nb#ULysl@ZNi_{_}
z>X7)4Q!nkWe3~3TI>1+4eZ9=>UsFcQG{24Mu(hoTrHNM>4LAJ>2d~zLQg=Av9xpi4
zdH`*V!w!J?fx=aHtRW`~42}Rl!1dn?MIk;(&a@tPitD;{5Y*;zFTwV!FeXxP^@H~q
zAYZksw9^S!&#WcE-YOK79pzbpTYMy>B8TFzpkHN7+`t8FZTt|$(j~bQF@Zx=2c`-p
zEV`yHCC$g%fxh@lm+BdXIwmwYD}6gOUn_JXvyYd~VR%CAfpD@(vNu&81RgDDWt^7v
z@Abn9(3`|zbA?tWidKvIi6kA{^YQ_^hco=@jvF`7AcX8q_q+`JCq25KUMQcyU4HM1
zrd*vrScEU1!JLjF07vXT7j_?&EqNkAx!WUS^Z7dqLCl-Ym$Nr#!{k?*_$F=9iwb|2
z4B0m@RUV?hecpE3`|iC^ePzk(vl6?q@VqU<680Z?`OYWLMxw=UulehNjPxm2Z@LIZ
zkZspcC_|h=gBUMfR9-)2$7Ub3&!)rdL~*?|-t1(aG1wDxv>iwPo<~sz-MsgW?R(*f
zlIW{60LimjZ4a1?4x3&@O?Z6noDpu0$CovHz@9Uz!^x^E{=MkzL*U<_Q&eIcg}ZLW
zx=Ebahbejw({L~!Vd;M@d0_qrD>mnQ`0W_lI7PwYn!uyNd|-JYCozZbNDdR8BE!V!
zK%_aYRJrWGnD7Z|K=|*lm>v<iSe&>*Rni|?La_l+m;ApJ{Jc>^qBP?%caO8zT08w|
z7s>2h*-7}c0Qb;C8u-t~uox3S<w63H3DIREpRSP0Wmr8#h?Q$b33xEyfKd^-LG{3h
zgMz9-Oy=J2-Toe&mMbbNjCoT`N%%5uFl1|Fto5yd!G-5dz&`e`|FYwM67mjE(7(#p
zvohPhtnuGW3tNoRbat)>4Ho-f+JCd22Yk-sjKoUIh4g1S>-Pod)=J|KO#UF%$M3%2
zMdNKFd1c8&$AHoIlY)qomxRKGaJPG)ODTv{?EC_X9EaWWDgR-db0)C8jYcZToZ+--
zt$%Tfgn!wkdu2*QqOc|N!?7wLTo3%cf<e&))Gi*cn(4VEZ$n+TOUf3^_Zd_ob9U=4
z;>GAl9$Ryb=`F6no#KX3F*>+Gsv|{>8a~7(sOBTsH@kq|B9qQUn=bn%0-W@UbP-!v
zpE}q3s3d7N+A^>3ixqtr4%Zgd>eIcaalj6Wl)x@$dUFBH4?L)bO4j-Bx2E}@0B5y`
zA8Yq8HbJltkU|=R=I)*O6F!i`Nkq}9GQVkjxl5FU{TCMjSZYSheU`!{;8=p}qc?kI
z3V1Sc>sPj_((!#7r9tUH{XrH#je3sv@!JmG@@Y&n?;o$fy3#zB=gU`r3-U%vl+&2_
zulRg1`CPv<cy~d~cnT!s#bTzQWMd7_c7GYP#;xRff5NZPvM0=maws#=0nqp1hZ4gM
zy2z7BOgCgz%r61uuy}l6WDudp(Q@7pD?sNHZeA*3nQ2j!KpDxVVj(6DokN}8z0Y>-
zY0tdmjHY@`RB^%qqyD3fZMr-R##K6D|DkI2S?OKS7|9Czi&ml}d!?Cdf*;Qv)?iHb
zhRld@-|k7H-8@9C+4jdZ;5JXrCAxrduXpq4=Kb536l+|ybQJH+9nk7IretpZ>6pt}
zI?7w2)}ndfTEv&A`^;#6YB~`ITW!9X`P_YIqc^zW{mo-oNKt=f>GdZPNZLn$3H<&~
z*SZ;~KNoF^2IfV9J8l!@82QnGQ(>8UpG&CtZ0T7*{AXK!N*+}UCC0C_7#j83S{RRm
zjQmr<-|0h6^oHmC4u^5i2tb4WYpzr2PS5nwNm6O^+?tI{<nwUbA{C6Ugo$1%L+0Zj
z6e{+%jeB8Z-}$5uKNMU^_&qRx(ysNL0(8*wJZ7qsMp;U@C`?hI(&iqLu1BlDQY3EC
z33w{h6I}OwLR2rD<T*tx22%o)GklBOcFrX#I`08K-{pQ6V5G!u0)DQtAFlqv{-m{#
z%g)sdDnOs+dxH(I=kNE1@l_FC{8Ph6M#nXztgU54JG=_9Xk2~h^(bP`Dn9d0m19`h
z!jkc<90}3}YT#Iq+OxOO^85^?E&x%Vsq^uZ80|U)JaFn(dphG(7>lFqO|}_7;^hTO
zWUfts6xo??odN`+)JbtXU{?^-@<(r&=;$4m4BHfkftr;OGRUrG&FH&6=3n)UDr4F{
z@3y^>IsRXov%}j(G5x$WwKT(mJTF+LGnlpdl4lcWWYC{g{<i<6DKRnpuF|t+rF7jy
zT0g(?>3^{+0*@W;LR@5Byg_b{xrAtba!v42Ow$V|>OBtCqIs5cAVvm^C_PxbNQ|@#
zph;*dl3oR2{^1AX38{ym(B9oVi=v>O#~n^S3k%^>uM0TwAeMh~;O*@lkQY^oGw3;2
zbzyV0zBpc*%e7nOo~XAR3u6o*0j5!JV4q<O#%g5$L>W-Uu{%a%#Uc98Chz@RC$GtN
zN9!D#wg`xSo*ylz+wK+Ct#fqPsWHs3u9opYfM4njWkesg3xG6VgR0p=xxIH5yZigK
z_1!LkGNDJY>z{Y>#&=VgeCuLgI!?gLrLxPvKy&cqD#~VpoJCL*Y8isZ@;DKvSD=2R
zXFOp-guZcoIJ3_R<KTt%gaav$q$dROEYpS;z4ZH*?T3~|z`18Q_WFDNIp`(%qMn}K
z_(L}2-q^5`xT8Xum}8wYWc3;DcyZ7+)AIBe$^?=l#$s_fEz_w9rzhp=jefWMI4emj
z--wfb>0?1Anug4|BCs<<%V;HnnrYSJSg@}S-g>0LhSEX`PSKnmqvx5`umLG+W?{l3
zUa~LA`FGh&WQ9eWohvBY_=Q{|<J`R~*B{+=HF0D2pUx`gd(iU~%o)Ox2;YxrIeDSj
z3H?!Y7@C3Q0PKKQRLT(ZkJPV1A(z}reZM;{e<ErAT6gDjyFWZsGi&;Ia9WmtRIN}{
zvC8B#7^Q)R2Jz0OO5?6Q9sK?q=mdGf@7>imt$A0vzI*2TNUN#?98qsfaq>d<mt2#G
zwRQZ{e`tzVowtTxbutz4EUmxoxS_IArud$xrJOC~^OdTcLC$2?j-GPjZSDm?q>;7A
zK`B>!mFy=82az?Qbza-QnK%c;MP<9g^EL`IrT+ydANIuk0(`@*utMY5`r}M6Ne^kX
zZNkz5&(d3U40Q?1XZmwiNp~p9-WpUffwp66Mcy;aiR=1$Dli%=&$nmIva8w*jl~Sb
zHkOY)I6~Ow5ULW7x<ER8*@~TpW^O@b4^4DnDeMx?7o^<0Q(sJU{<#)5oQ<6m4sU!D
zetAu0nN;PJoRA4dF%t(6cZ&%;X~|&m;KL@)KO+V(`7vVN{(hse$u#fCXz?Oeet<VO
z(I}*85f@BwQ&d6P647t0Y1F7T*RXFFaEM!lBdfvl6*No;pL(n4GaO+FXVVojz=y5;
z3z<=a4QPfHoY@Elr(?qpa$&Q`h1-WG@d<&9$<aeQ$2KjF4N;~v=&kfE%4ZcA+NEJU
zYql?i`ieJ>-<LbBFlPaOH9w_SD+P$6rPdZd4@!WD%K@zts;cts?th&A0PyVBiIu07
z_0^E@mD-Sz^o=-$BE~ROB5fljfTZ=VG%vp&i?^lWcMf;`&?Pyo?mu)1J;1RbKm~;A
zQd?@UuB5^;oGU7WLGyr{WC||!{f%woqhJ;Imr#iZ)YMk>qElB1;T*~@UH`$T0WT}K
zAFJW=&0e%XE0F=U>}LFNRP2qaPz7H6_MevmFAs)>v1Q$j(1_X7fZNQlih!q|!#FlV
z4B^ENMoZ3aft%&Zj1>JT)<p|-WoL-MO8uzW8B~TtS#iGA;_5jxeNH<kiBW8EqLVm9
z)KaQFj{b|veaq@n`2bA*^tTL)C?_Uh_al0!h8%m$JVQUIDVVwnp=YCqLAq|haj8eM
zNac3nYJaTaG-S=okbX{*mm+@WR(rDPt0x`jg_(p$iQOAmA)28Rr}(TPFK&-yZ>0bv
z&`}4VzT;wCFI9Rjo)Tgk17{r?INnJm$Mp5=ZhQBbD5he+?;fMFLCb6A!Swf@_PL%8
z+^YAQ5hNDuB8K^OJzh}ie5@)1=$}9w6*AGUAUKA;m7WdW+{>Ixw;eJhm&xpmdk8F^
z%#0bD5OXz3kJ<gtJwut1O_xiaI`2*fof75<f-8CF7r)0)j9@Qp-DR?yVSMtUpo(dE
z{L(m8Xq;gkC5fsS#47e_vxzJGkU7TQgC&?bGv8-F(bU<|pHERF<OlEXRPoto6P9*a
z;jd>`6GO=k@u;T0_7qFn8=q|v)^MEgZV*m%P_SM1(3~?5<?!jLUJubV1(4KT`~Q4X
zg29vUlXvwd?AMD8yd;x7)2Oc5qT_|8mP@S7^T5a|+Y1cOWieLfgDto*xqDtsR^Gzm
z%&f>*|LmttJD&gBzt!XB247=tjkGjQZ`@rAxCSzQl5WbMHwt@&qrf0N=6Y91E%s1{
z>v}wEqy2>rP#)V|u02Teha;S{mLKsNya(Lm1(u!)duniRhP|ZVG+aRD1bOxe)q!8-
zn}l*X*Trx4WdXUYNw0GnV(h<940eG#Z(|+9-an+zugc6$Gg$B0d<e*-=E5z<r|K(e
zBhTYXD2poCWEe%Ti$a>2d{bQvCpWaJA}-sse9v?Oxt71D$#BvU=2?xQ5noI=z1#Ct
zC3{ut4e@%LluI(E=Yl`Pjyc})F=~17t*evZU9)naE_AmzD&f2ksv2R+(UqZJ{-mB1
zG=&l?U|I57`-z~!?x$kvMLbmu0j8JytccBf(9uFoLiVDlMw+-fr}cLkXE+;<Y=jhb
z+^}k;?*nfm{3>!vhNvStNe!%$9!(A5&pUk<SXaK9S;!#eR(22r5gU(r+p_UzHaX+w
z&AxAgqk`*})kJt*>I}MC$6e!q!h&Pp_}a<xl)4U1yN|9!>N+9sREG_3FutUgJdi|1
zWIKjE%o%jTY_22Q?=FG8ROC59C`K*6EV{Pj0ipOSsI>j3Ci}~%4><1nQf(Y-jreSG
zp1c~g0>7xVMs6xAMb$;w_f$I2!z=jYC1FMM;}Z;P{hDI>WrZ~C{#C#3eE+`BRn>fj
znjYd6`}f1Fh+<;Kf$pPu=ey+UBtf2Lk8m}-yl`OyE~D=ap|OI1xHWz3(~+bfc)Ubc
zE>>}n_q&OK91-mMn~XHnQ+7~S!syqd|I%7212Z}P*_2>9O*Q>L0MtM$zv#3T{>Yu%
zOll%u5=UjrdEpWesk}fzt-Wi<Ru%yq#=i{wrO(v#cOU#)b?>A1C`|<9;B&U_&~N*J
zZ%b~4Z$cymAYmqc>R-L1b>Q&f3y^P~C#5XiZa0ImSUgE?c?*k{vEFi=wR?hd&L}}O
z{1!ALONKyp63~8<34AjJgg-_nAm$Ee?RSClc0er#2@iNn)+cKb!p>W;d>p9>W2wy`
zv8@6l;LP<2<Koj-uytvId)G2#S#6swGUJJOGP$@j7)8hKN2e-&qUkrYd#*YFl=lN{
zPeE){gMGy*jxuce>_es=`>7P(G8VvTHw{+7*Gm=~D++!an~3XV?@~eVS!hC$6N*9u
z+Mf2~s}L&-J}v-2InHqANfj=;c*Lme@ry875}C)~*7-ob4B`#Z0YaEE0Cd3BQP9R;
z5>yL7W)!e!lDJ01$(&^Vepfk{vYDHYnbEZXnG*`_#As{AMHe2W{O=f*maK|nG{UKl
zjlfk+c?-nFSqJt%v<%>|k1)he0Egt{#t;7VueUz<w|_G~=npr|FD{?Awz_`mks~X;
z!Dv*R_tdj;1<s+6kpfdz=q$@7n|56~S(u++?{(XEZmh50xwy2ozwe?8`v3L6{^EFN
z*Y(N{0xkpam(xF*gl|YB1t4K2#?|`CfO=BaTA;{3E(8QQNgvx$Hq)C%ImmF?B}1IN
zy)@C={(5Ct+ur#m5}Q}1IaUIg7l6?hfQ_3>av#ZwI-j+$Xr)aB>0|Z>t|NSBo$67#
zV$nn<1<G6yqV>sE8olKKmKMg)N9K{M+6n@D<SWDOiePUw5&*3kwXTsBECg}W>LxH3
zfS!QIp8)A0L-j~985E=gNvY4`b>x<w<uZuSFoESR4teeZyO@Ar?K`^O{9p9BaRG?@
z1~!f%*Pud!Ndu@roHgc7Xo&)#6oV(g&TV6C-c%7Pjp*Te2r71)giUn?bLf*$h^%Xf
zsSE1=B~a}L@+FuILQVk?{pWRprb!>hNh*v)kxC`Hw|OQ6o8&(VP$jT+>i``p(bo!4
z(Wy|DwPG>F!!f}sYty7(E**IA9)B><u9JQruYKMj9N7L5-1FJ@c2-vpo&NBbzkK%l
z{>Sf~Q`YLL{$R4ZI5yb<%9blN*UGw!8MRrsEEpgK26&=bA6wUxW2+m7>Z&?8o*Y{_
z_7DH~@k`Em`e!e>;$`>u=Gu2IboZ|P&Hw&Iec7oQKJ}pXdQ`$UE|LO}FcSwKzV{49
zc3xg|ESYZwfjmpzS$aN4esBd45$0OJx#yN>W!lrpPGm3$XkQ9YX$!X8t~Y-Q5Kn;q
z9|39%P!D01CM%e%aPcdq1&34a{Ng?<a*pJJ?r$|vmde(lY_18NtilC**YTPAm%SzL
zW$5wbEEudAO0jhqD~juD3qS#20vg{2P(iMzf`u3qA97YG+}8~^M<as4rSXZkwn<h2
zjd67>k8BjjNtGIYd>PolU>jKPp3NY|J~`lY-ajMQNfg^DG_JX_k8ZAkF+!XK0iZTe
zoW{g8F)67CdcBU(2Fim#|3*;O7AHwIIzYHM1Wgj=(hT<FxQ1`kT?}Y#lMoW>31REv
z7`vAz_|l*oW`SoC0$XHyo}q0oDwWZs)}7&S&~oj3{hNPR-FV|mcO3brpS*l^ZR5JK
z;wM+!J9{*2cd~Z3RV;T%Wd)SV%|h>7K2au0-|b2>ccJwus+ycKs>Z0tqi2#HPexyU
z=pokSrx)fP{P-E?KKmbbo%<bk*AM*8IyHkI629S(6o7;&eB`#FdfB&Jaazf9y&}s1
zaZCx&pgH{uY55SU3fQ$p<MK;Jz=VUqW`IzGX%3w424QSXTOke@0L=lz8yS<&5wgW8
zO4~1Cb_JD!GIER~tn2;?Z&pjzBE&Gb#g~YTMP_6DSra;>aqj7Bz|G`B9Reb4g8c*i
zVKU}$nTEQ;LE<?<#uJ47=|bu9t_$-FFR$!?OndU<Kml%i6$heO;o~(pMx&ykgBn6I
z#7TtU#+XqdC}L0!XsxUgL~f6R7%m~4G=po#Sx+j_QjJHl4Ghgsb^#SmL$cG<wW9?Z
z+z9XyAX@^lj&dV;UDGKRLV5?qh&+$sRTtqgiN9_3KLM2vT~`C!HcfEqNh7}Ft~pYu
z+yn{NH0HE*I1p3Dl_oVF))_O?B~O3V$-n>m|If99!QjPX-F_;HE!))moNDE5C`C4|
z#<(9?*S>2V!@zzbDL;J_0Ava(>wsHrFcu5eT<B`NPgkRTD}(;^sQVADt$yLAy=Pwi
z!SgS9!Od4(^|YhE`JaBesaYj_gCHpY2~+ri?|prbskkg}&$oyaSliz>x!@$gS>DcO
zk;W6*)9<!zonYJ6GWcArX~wz&^4&J~y4k-SEE5K(Wp)T`{4GE^2qDqWw8=4pij92Q
zg2Ii=UBqqz^VW-Wm*B|n@3*OK^SZ|Jjty{Cfm$J8%w@@oP6BWY1Br(-`yjyR;WBzm
zB#e(JeHR!u?KF>?9+~x0iVNC42uXLjWCnsI8j%|8+7~Q;H*66D;^eVwx)nMqtAvl;
zk^Mp3I`4)i25Q2#MUCZ643vVNATl(*S^&%WLqU+5ig$?1L!iOU0JVc|03GQj?$f3s
z8>@$cLy<w5{<)!FWj-hd+q@38KQyq=sj;|aNaYt4@^(WjbMY#^Ddbr<1`}m1wYa?F
zq_Z!2(W{RhJ$%Es#1&|5U(Dy0krz3EHC+BhXby)iHGUG_!{Y*YC3VH22M7QuV%6?|
zI&%zc>DA@voY8Ro?D59>%lpFvH-6x6{_b}#x$0FPy6u+tts~(Z4oLw>n8JYr5BK`R
z$r;&FCzE8Y+q)gP&BZDy*Z-CxJnhmE<~p^_pD(OfF2VU$kZL1jZ*v0Bp6=KG0I0m5
zkoU}@CKq@J)0^C)1;nc<{I$W#<k{DG0mdOZjR?px;{sqoTaSVHxgmPcG-3i}4eH$s
z)y4u0kw8gyn3pyb3sFd)Gkbe^M)Ts%_jRx<zN4@uyN%|8@7fGB{0dXg<QcERN9+|L
zSVq8?rU=NiNdnYNGZb}`5j<6;aNY$YoU*F|*KXdpc2z*O2$R-#9On))^&lVzHvS%{
zj{@1k6oVvYMpF+I;|1>u@wbX;7s!w}j={gwWE24Rkp?oY(d|x{E8~5y{as>w1v}$h
zHUvgzZeek($3MDpWc{=%Ti%&3Es|2X$wQ^9DMtk%R*tzb?VLjIH-k*I*Q!REnW+X5
zao%bpFS=A!%iG4o!!Mg`Y+OFL@BaUF=DuhB&PlsZ`ND^8{2iZ;G2w}ilm{RIi1|;<
zFKynbiMCQ!fLZ%RLS)xzP_m8eXiTU}#yR`O=(Q1I1^jYU0@+q!l2b?kz-^$~05<-{
zCTq!$C)dMEn(@61O&0=bI>3uW9-u&Rt4x7fEia&%jX>7}g_D-XIB9b!4nq=Z5{3RC
zxYO@Aro??$k&uOA@4fe>tH_$3I?h-~&nfl5o9rUx426HqGwCDZLg)iiN9ay<el!ux
zKkM9fM=)yupwh&CGN1(&FBP(IE&-z)0o%8i*tAr`pWqjK9zeDQP&r$-3VbdA)(jNj
z$$n7(CV)EjGn3efqnS>@`gQ%}v@q$;nF{W(Nv;`FUEz;HCbDjf8cLZ*qb6XivD6+?
zyJnEmeqj9hQiRxpWcyGlf+~7*6PkaT>g_nG-P=qV5r{P@Xh)^kIywG<qj96=^mms^
z*Mn~=HK&&Xv*NlY=89C7p*6R?$QDjHZN&3$JG9dOt$XhJ;#<zY<OQ2u+57hGqqELB
zYu2wb;R%Ao03=MIuF7-rymb<(!ukxIRmYKkcxne3;00i>rLlQy32XA%AaZ*b6H&Ga
z!KCxNCjl+c=vJV9$nM#0`l4sknp4NDvsleMMN8J7Fa7GF+NPd?B1cj9#5GQ0>58y(
zae|Y!RD5s0Fn(NN!AE{|x3vuRydoPRA2JO}pF4u!5&QnhT@zLEI0M&Mz#-~w``8jG
z4W~)d3~yNEL0RFrUuRW^O_aHIdVq5qut{^Ee6IY^H<E#OC*x&I*s`faR@Y$;Kq!%F
z0p^IM*ik{mU}^)ykAZmwlr0+W-ErwnCPgX)Q5LBg7Jbyu(Nlv4CjV+S2Rykv7aB|z
z)6RtnI=Mz2DI<+>^VJNxF=Yx$bxaR%aLY~2akm|Js(7*eQU*iF`Q^P3jWYaijqLZD
zz(AJetQL0^)p+j0)&9YMGkWyUIj5iZy#KOi$9Z4avGvP1d}I}O-E|ido|s4sKmrg}
zJpjOgg9rB1I$Kiy&=_GlN^da<S?d-n0IUgT?5VJKw>i2MRtAt`;;Aru`r*&bwW~^I
z^4||`Hhb$MpSp}1ZzfW8X=}OJlyC)!Z`_LJ41O!unt}waEJWVB<nBzE?^c*wn4l_6
z&U+R<;ZTEMI+4#WA1ruxT7pxoNXrE|Sl#9tXY~sov^;MZ(=Vs|3D(5rnS8giyyZCw
z9L9H=UqB=|z2@UwI27GMv5(no(4#0?LUf)PjHNk^^Up4!O6^9(3R)+@@~9@Eh!(is
zU>bcCWKXY*JE9@&X0k_eB*g?mG}+_%#Ikrhle7lv+80X11P$!iG(o4(4c*LlmVb`#
z)<)T(TJ~q-f-il)&p2ICxGUoC8>bI=eUAe{W&0zX^AWm~p$S}5-k#^y(y3b}YVplS
zjvV{7FWvK@E794dZoKhE-m`m0Vga6@ND4qggtz|ae=WwN;bu)mMoJ#W7c4=)4hhRw
z>Ih{;*s-I=j%_ghTWP`)0L}n(%||Q>r7n1K4^Vy)OdU(RtA<r9_KHcXS+4U@q9AyI
z8*4688bP$MG6TpnVOhB%iB+zV_a>-o75u2ee;bP%j*Ip}E__PyqeFFsiy`uJi#kU~
z9UNc(iQNwDwr#rcjTH`8Jr)NIP4$&4)+uS;<p58o`zEvNBW;~M)8EUS1+0PjUWK#H
zD*efTvaeh)o~PU8n4&`%eSuKjhj7fVn=r>yAxU(*96X9Ec^u5*L)h){t2y)`2&jSO
zxeBd<8uv@3&VK3-uyW7mXnv5phhl+GZeT<+<SaD35q{6n9Gcm{pm>G4T3ysKL(Da)
zTycA8XThCq&l!yAKYa8fpMKsA@A%o`!G{kp5}uGq3P6Gb0l;0ie`=}I>7Jgox?sDq
zNVzHf$9~~(u4*<5OFaR)U5!=&a4_W&tQQ5SwliJGvj92+jXw^b^EDE_p%&3%=Jfy;
zw5+4}g@qak#)id3Y>s-D3otV%Q^qovo1B;lHKWs+kP56uY<#n%r6~xwIDb!EmnN+u
z6pCnsgg!vc3xp{h?QA1N`ROr3uKAS2(Q}>MEejL%7CeX1%Y;y4Vfou)HEC!ONE(qC
z6ogq-5r{PA7qqC0(-N)y%2lIYY_DKo@KJzsJ24xx+-f*1+v#66`;tRjntd#Z6yI-h
zaLEQdh?|%|n$RvZlyVB(l;{ovEc?>V3z?<T^`zCqy@ySF3U{KW(G~13$E6r<DjhMM
z7ygLY6aUhcC4Ps@8mu+vy-kGP&Zn%bSHJlFzkL4-UUb8cKNjZ~Bzzr^6o7;X2flpI
zCgSYetmu&utJ1<^zjy{>fTKke478ZBV{?U!Y8%Al))`Ab5`n2e2;hR*B+hHV@KXRf
z5N5EqUc8KsEK+Vz@QoE(q8YRh1SSDYo>^xY`nJe?+u43bHA9Ux_H128Te02M$I-fJ
z?+~A95VVO!o8kn5-5CoRzoN(Ak`r{2F>fXXYOw!Spu~2fw5&tG7>Vnh1<LWMMTi8I
zZ;DS09N)u6nEO-l7|>eV=fy%e5F>>7IgM7q@L}>%YZ$=D_ArB?EzOVt)gh+w9VWwM
zaA=1<ZN9dB%5nnx2gUP5-s=7sovtxPt_ZEY+d?W|s$ets-SnSgZ8-jI`TlppoG~j0
zkLOh+L*O1_;vhh*!#{2Q0@{49b<A|Q?hEqYmP&pqIvw6}JVeZjSX0qiBI<6xWPM}&
z3!nMOE!V#Ebw83J;R%PN03<jt032I6+#OeXS!IRr<i-oWHJ2OfmZb$@eB>9NJ%-Y3
zEs)r9G^9X*X!=o`d2%mM9|oupoVyfCjRWy0UN=cbZ!=BHs%RI0bW6<e2Q!0OnaKz!
z)>USJYT&Gs2Iv$d5(tq!Q+{T*M%KEQt+J7RQ5C%^{I8+71|=`}|F9QBC_!I|d=*>1
zB8bdM?5=AHs7NY=I+KV`aI80bOVrj*Q5e%^u>ceZXYOXqwHeSNU2`;cBax8b&7(Fj
z{1lng(k6jb6dTf%-ZQE&qca+97p{}YcZ28`K?HDJ#q$F&TLI%?n;vH`^kW7k8Xwo!
z5!Vz?8?wS*5hGJ3y>dp3Ofj;Ip_B>KRIphaGs$SVWLS-Ii3Qsu-56p1ne#w2itaqJ
z-q!P1*ZV*7@sED!Y0Uh8?CpdTi=+S~SePGYRaJ8n%|-B^M%O@!7l_3IaBcub(b72e
zv?>Z9^3=ay`P`m(vKmDT7~c-iq#?=e*Hc!~G$qY`af0_vdp{`}m1aSC^R!|CFsR4?
zWs(qi0j?OT26k>9bCv;G2LVHn{DWAW*$OFVZCTq@#twLyKBb^Qlpo75_nk|<JmnN{
z3XjX>@8zIL{=&_|Sc;QoJtRF6%Jzbs!=ntOHE9ARNwFX8=Iryyq%EUy#wiu%x*{o$
zq&xsXuM<!UtxFlV!00wVX1?|=c(UnQ@y(Ibji!1)e(kn{Lfje(3??%ZKovvD{f^!P
zBoq?2&tFK|c$$mEPo5MLN~!;SMSd!id6Dc-NfWrvP!4m9H!=*@GYr=<j5acqqYPXs
zle2({6%mw@M}M34xR`<PWaqM(CDTK|VBX!t+}d*KU@&^ud6!&!J`$c#NZSAtEQpzz
z_MUac_SH#Uu#%K65HkUYtUPb9FhgqqiZQpOtsIvtm02K-57!2GF#(i;^?)$>97ts|
zj8^t*tBd6_w+hSD)8>c-6-&C`H-)Do^C1>qhS|bZ<Y1M7bOjTOXs#y>%q^4zXlOQh
z3K5F7j|*v7jLSo)2SOM~|MgcfM(}4FP<W2?X9t;1!cvTA5QJ@Owmq&cKIx2b88nSH
z>9~)!6Otr{{UyXM)0}f5ftW?#+du5a6+m4vHf^m@6bv4b2v~zX1Th16WEl(vpa!S|
zl#c@CU4ZHe_lfA@=2Y?h$k8zPadPgKhW;2?<bF<x-5_?Ja$QTmhA%?vSXFd|x|GvF
zQShVDnE&xFMDCQy$ovM&kwS|U6fw4Ms<H2k3ASz5$a1HA5VQtH1H$1$8SZ^B!=Ymt
zF@P~=K*7ihGyYoq?)=FcG*eZYax)Pad2bsg>*doAA365D7hd_2pZM%Y|NKZ!plZfu
zg@hA}qyQv%{NjK4u<CT@Ps`W)T_SiJ(O{acbwX8fI3n0BQdtg=2I43}C-TgRaOMpI
zD8SW0sPZAODumDp7J8E=4fe2GblD5K$ck-R%OWtXd6rG{4HX$kWk6kmR0y^r4dg|I
zoF{<JObUOZX~IMlN6J}lV&^)GO2DnL(+hl*Za8Yw%p}O+e+{LmY28nID;gOV;}*nv
ziq~{l41pE)O2l?Lg^US08ZS3|6b&PRP*;TZoT05{yoozS!DLh%0+@(7kOQO70rkM7
zn3h7_SKBAbjXNOH!9@My85S;)^I1%9_ARiApUnaYvdV$Y3S4V8yJJM~tk)_0lxPal
zpwm$FZ1y?+bp_}NW9vNQ?2Ae~`|1HMxL}Aa3pIA{)L2>~WEsO9?xh(R4|A-pG7cQk
zSRJ%**L`i=e9Ii}{89_|?N{J}khPpL=;}cs$h7(Ui8LgFHVx9n-1dC9Hh$T`hYx)I
zsn2}%dv3k?4^qa!CjgQHkYI5=ee9<9sk*LCQd!oHJ>m@$s(A{IlNok3E0pmsnk+hY
zMPnb)&ET4#N9IP8X$Lg<0?ew|g+F|VY^FAHR*pCT$45IijMOQ@f}{Eec_TU5*p(1u
zN(L0l<W;v84-tbjIB#j{<Q1sO{o?4;`68S~=z<>=3DM)J--a3KB@H!CI&KVwcPxvK
z*=~sw6utja2!A1EWMUV0UGoqhGY(D>V?Q1sYq9!-LqTyMiil!!f6XABStdn8W;t~2
zGCpSpY6aEO-a8cXA_;}39)mE34;a+|hPS~?JTc#dfNePLg9w{thl->?-nB6$@PrG;
zTf}Z&5vaEPEXPg(l~#?@F-2ed&xHHNu@Lq>aUJO(bxGg><BXFhxc&tLTy@157o1mP
zsXInXX`p1VCZI1EGX@kfa-LwW3+z4xKt91$7Yy*~Z&|~A4;Fa;2iy2xe>IOU-aiN3
zA>{4K)JH4dppaN7jK9nZYKFDWRF*@}owT*T{@~jVAAI<;0B%OY<Bp^NBv||<9=!iL
z>Te9TfO-WH!a-}tp-`iR)A`LASnAeh;nBi3%>YPSKW`0acXo(buxaweP?TG=g^>xk
zMK%_iL7<CGVLZLC28fisf(9V@9T4*H7i5m2^+gf5BFxWK*txmlM-CE%jB;wqR9_h#
zD5zE9Tmqr0kf>#-Rctj!&Sd{Nlc=*d6C1wj$kPz{5xjNRd}MTFvTK<waH?yaZa}dR
zGnssaD~Lq&gZ!AyGg=v;*RFwDhjED%I|XnF)Ej{60Vu%bqoB$CpsW`k`|Hl)@$DDl
z*mVp^ksdpQyrOs<PmOfrcwN%P2vik<IvB>Su3R=s7Or~^u8`TLwe6=6<D!{R4RUOs
zFY%HWui`si)yKXwCuo7eB?Dty71dN0VX`qvrG^QZ06A+cWEvNqR^q(34src;ef;tN
zn#Z60%`zT1&_dR&K+3QgY~u{L!PqsA$YcP_HS$&ulh*RtYimc}^5iRCddDX}_Gbr?
z@VFuc0VX)`qYpn!8ykZbQ|`G}vq(2rBAff(Nn7uiHjC4?Wk$Dc3yp-8`(FjtD`pj<
z4A4WMe3+57VJU*<<KPz0DDA2=t$b!O!4OPE4o>?lMe}F8Gr0gvG8b13f@Y%mPK{Hy
z5B=4#mm~CvJYzstfkqV%qA8b$tg*PBf}{^xj?g@~!3vnqt#6$h--u_1=xx)Fp;(3t
zpku`U{22#Qk~51azYs}o=x!Y;k0h*KUo8zR&ueU1su&f=Rdp-@G5{l>Is{M-PytN7
z1n?S6jJ-zGk4;U|edfEXsd&kEk|BZb%g_-{f|6xO+&BOzO|AkZZw4@_<VlRvyEnpT
zVI+tm=LPDTK*J2rxOjm7_{)#tr+;J>=bu)hm;gN1UhyI4j)5Np1dWw2)o>>fN=80n
zoU^;c4}b3}{@c3`;w8^nL#rfIrLtozx4H(GQ&6Dd-yWkz-rKB(b?e%P_doQ!A9&|`
zll*y{kp>{aV`1}_ysEjy$iU3P%@?Rp={6N4pZ#N~>uuW^-HzG!?hRH)7h8*q^okYq
z8Mu4|s1J}Kqy(L8AMJK~%g-XX^9qcq;V<x|2&;RVPd5dIz^}$*T6tL8oRXn|ZdPIY
zmJzWrufmQx3T%Y?oCzROs7rrABs0SYn63kbCdK>lo7Xo4mAlznzizP>qQ(kumj>C$
z`bI@OQ_^@|bVv>m1rA0X=){3tYBbRF*|^!I*^o|KmTT<Trb*YXu7X7Z08$_>!Q~@h
z&H-J6Mz@>8que}nZ4{|><3652UrfE8F(;1anvnv}F#u&P`p$l*fZ-%VEok(JjA#_>
z+u>YF0JtU;rNSFuzJhoE!lQWZ(}(DRfs*ax$g?Q`gSi6hp<&(hI#~C?Jcd1H5uOE!
z+GF2TKxd+H+1Vrf(oY@5kG=f}ws#qmksK4LGE!jgqTeY4tU+0Zth;&BxZ>CS&CS2R
z2MLcWk^+$6v1RM-p33q$BI6mN#>yAe03aM|8(Y6x6Si*B=(e=K#})>7i$Q_w4ZG-c
zf$|`r2k?9`M1fPjhw#D^5D4x88GJT%@|*v^EJd2o?vd7NCIS`VG(r--{DL%ki$inP
z3&96&xkpM7qO27>nJANwWlD>p=wIV(#kfET+W|q)1y@0A*iy{axZ#rmPPlZO@E{=<
zyeq?N402pZoN_Eg7`b`FKxVdSvKPd$ufb=j)4<}q#+FSS#SugkfMMbY^a_YNK)nW(
zcL0=&a~-VxPWEsd!Hz@<0?(3G@i<0(AOx{(I^1Dd<PU_hLcKKcEzBh5DdWhXg-NZT
zqJ&gZxswj1kS&M+)DwkP1-$b+kK#wa?+{MkR)Pj>jvcnwF)J`80M@}g0%#LZoC9>O
z1UgR#+Lr?PsU{mI4`2c+o0C!~c+9}K#`boFH@{{bKmX$gaLVQ}>Jg9;NAp$g9di13
zR5EL1tvM<=yL@eZ<GT0!;ro*edK{5r01`afoz`NW7fW@P2j3?E@5>dRu=GVE2qCQ%
z7P^cgV{qwg5JH^wkBE2(h5~a7RP6_lH6?a9xespJ9zuPZK3W#u$H?dF92Vr62$J{u
zt#Hy8ES}UZ>_>KQvo_L2)r`D5L0z-ZTii)(h~*oZ{r|&(5nReYV%ni>WTuqH;`3(v
zts5X3tEPJ-KDa(|XUF*w7-6fI8&e;8Y1;3L35V*rz|T;85M;6EhwYX?W$EuG8)F(-
zGok1Jb92IV-C%s!X8j}X8y7%*KcLrOTu3@9(u<?WRU+8{A>>3qMC?~HNK}kb9P%bW
zFhW^{S;_=P#yGUmrf~^mZr6&}bYx$$?{|Qi2!xu@DhY3Y<0{_vh7~MAgG<-nc3Xk2
zj8M<Eg1c7&?TZ-ssf271Ch*c0uE&J>7<lw~(E8s2^_PKc4kk)dhjiASnlRfM+sydZ
zYb)gK3P1I8C*hH`44GB-UDjiFK7iH0WG~zP&lQTL<#KZDrT^{S|K+a$JcNYD1xW!&
z0PHfWYhKFoY>8Ed$lol;^JWm9_ga$m{W7EIX{a1--H2R-CUPJL>k+_X02(Oou?vM;
zyg7E!N{Iq^!4(nx9G1-p+)y0k!709C)^d{f5&&pWD@W|3w@gC~ZWkb`6nvN$HA|5T
zJ233a1TONJUvAtXp6A>Sk-T(c<6a|lmWvvfG=LS<PElYRwIAgWh-L!^<*P}`I3+<S
zSIv8!+)%E|UA0(w+dJf<C%?}_5u?%sl_?a3NWLV7J`7F{)CU;4PZ)mMDp?c)A${99
zOuptkl3ndTr^e;6LPw&%T@#`NlX9xqT>zd!&_p2O!8k|B1Qpb)8Okk%?zY8L;|wpq
zZh*Jku!aTHZUc=~AQVs!0cr!?Zvp0>4-`8AssSE@(DxN)R;E(fCZf3)fLoV=HvT6t
z`VfGgoo|r_9VUS$WCP$^o;g5&<uHEwS9V~nCaA2bYuZuehC)REK_l-hV6=Ah(zVsq
zr!n&%(X8CY36D7v{gU7@8IR@_(ISyT%u_o>J{GPaZLJVs45*x}XB?5=IV=nrNFM{~
zF^Ef`dITm9X;1*dL*Rvudl^|=vwV#>&U>D9y?==KPSDb=Li9qoT5F=^xe2<=QJ}c%
zCM^XK8P~{g?5(}8aAbk2hoE7b#KaU)Aq8Ei2>C||UL5h?Y0rYBfNecQ!h|?@%<ij~
z%#F4Bh~n~mieQ(a&fmf$D^gbgk%r2gQWonsM#vM0T0nV#>e1c6_)9QLnRa&s|G}(&
zCQN_VNO{pbWHOF}l?se4!Z9&kiD018!P#JyLnvTWX3$E8`i0gRawNn(SmuhV5#hYk
z#(3+Sk6_DOWek3&9WcPv0LXR$%RdM#eJ4<C1+WU}4I-|6FLKCNP2dvX6;QqzSb7K0
zd75zt%yPrY`OSoUr0}BW4e_#TH-NFSDS|~mi17;3DNJ0-a-dk)vbMf)-PO;!VGaq8
z3z7nm0N7<~G9Gjp)C+r!?6>}J5Nb2!7u#)3Bu_b!BF0U(4A4gbJp$@ufbN?GT|Cgl
zn1%D-BJSEb7rkVVB0_Fe3q{h5_Dtn-Z)z3{lMT@NuKj{d1k}Lxg$WkgOfCVD6pmp5
zcb;5@VX07qOn{~Iqf4d4HB}x&BmXr9fTEQ-fTa9$np0y?*^a08`NQRYcQ$!rlszLX
zd=lY!IQtP9s@cg#uXu!|CYoICTnTr*HaY9fe)Ho_Re*Cq4?*KE0QzuHQliBBF7Xq|
z$~R1Q+3^j*H4_bXC43xRV-$cI(PT7Lqp~8q4UgoEjmOK@iP`MoUnqdLy=evKpD_ea
zT>sl0Gj$(m?*q2}FwnaYpj7}vgs6X;g4*Wr4>Pj>W6AsuN4EmimjTq_pdml!$ZY!)
zv<KH33#}42ymkfWo;*f9$>QIYca<Pk9DUJ>RC|#oHLg6oa`;I|cwCSafCP{J#(Gg}
z&WYT#FpHu%-=zT;U}df)cdA+z7F@#;=*C?cpvOSH3XJap>Gf!FnOb@oLJ>gpN?LEu
zo(h(je_%M$v?(YNyD3baof4rzg$jOsz#Erb0y~#SSn5p#WgH6;r<*tyxIf5*wM@ZU
zpF+c8_a#oh^lzI+o3F0TJ}3lrR6y`D$lepSx3p@}5d07V1;V{ytjs93j$w|AZH%N(
z{sT7WEPzoIhTe`X|3)3H51vN<2w-9uq-L-1tbU$xlAg6*XZia5OJdO{aUX<!a&<ET
zlIuDMMc-PWo+u`zL)T8t%kXSPW|!=9uNdHY&l-S6W?uShsts^{K4|%!K(^h)LfAxI
z@u58-3nj=3{%Qlf`j^m$ehz%>KLC^c0D9ug9zw*7aNH+6u5k9=K3;MCQREYHUKlYS
zW4cYIU?4DOMF*8`pL+E0%7wRmmXj=c9FRIa!J|LuXIgWvlsthg>`0zkr-F0W+qxz_
zJNXDMZb&Dxx&H~utZdbzV3e+~AYX{4pXIIHKub4lCtv3{&#&7Z5OceYb6Oh0#=gok
zP@aY8bv6bS)r3t;6Lfnen*)IwEV1Y?0)w^2Mqhb(6#Aoik0Ugs*42>s(v=~P0*<=6
zsaZ6s{YHN_H3)XreADeSqmQT|WGRfH_h8gE_)!rXHbsj^v3C)WVl2+prs;7!U#z5o
zP0C??1ZEivOPNnT6*KFRm!jD-vZtrhUNn?}sUqd`%-rXy26SzV=b%TiuEEu?h-B-`
z-<B=EE`cq*3a@^}DmHg3>m{?5sE6QeH)zvafP5K1-yJ&v_giG~3jntPUI3Rzfz|f`
zhu;OY_Fky+UJ$hb>cX857%5P;K2f4bHp*o-9O3$FAL4WOZg4d=M?VM8AVu9T2mlZ>
zDN>|b^X(dZ&FkO%%0(oca3lpF0kFUFvaFQW+&C1pagl%3;LrVHX01D){*9+sTxY?R
z4+Hfoh;r`<jaTVLKwV=2@>h5z<9PSFdRZYO3SbeR;QhVM+S3fm2q+5kr4nMI1Uj7>
zs;$k&01CWvNZaZbQHBO%ILv0$3h~M>g6LvLi*$L|&%6+^UkGcBtqUcl2RJAe&7?R$
z7z4(X;CIzw8AK`csqm4MWKIDhb0Qsk8OagzA|!Q@5w>q;<TR827cL(sHYKCsMz%>=
zMVx=srD1wTqUyNt<3+Om(YNO7vIf=KZw<6vN}7r4ae*wehWsr54P5z*YMkMjPaESY
z7mtCFaHnVuZ~-j60VsBYxNl-N0Wgce6adV`;2xtM18aW)9Qp-d<BtIx1M(#x>qPZ$
zc9L^bn6?K>g9-&bWbE#((u<yVfKaLsJm{O%(85TpDjKX>JvAIp&KvcQ?nJ@~M^XS1
zJh*0M`FnWVrXfrt0#_Ud8VKR=4pS?eut15x!w&)Fz1H$D3s%!qi*wkEl6;_<R4^LL
zaYILO&z`EQOcKN4MrP~IC<^#JPOg?r$O;W)ERwpoy4ix9Rcq<j(Io5%rzXWO<N*81
zH_L3cMJiun(T!8p2|73)7HafF{B=y<20u(JY~6RUW5KdHPWTgoJ6b%>?<8=_9Gk;x
zwrtT*6lU5iq3ljuZ~=4CER3|OhQ=t{BPWU&_fWYRb3=5^bgUftIm?wsI19sGqZnh(
zFc>N#H68Hk+yP!`s0o|e8sB>T2IgDtWI-F(P!EC5GePZ(0bZA<9fznx06<Ql1;X$%
zgu_1%tp6UsYk-;qP{iXrW60%KeqPwXP*xfAfT0ge@T{jC;8V9wP?uRmz%{!(nl;Rn
z<t<iudp9#Z83`vGNdZU*(6w?beAwY^5Y_^*u+EUZ{;YClk&P@|;N1z7f%E}@j{p?*
z+B<kQz{xlY|E3brNJw9<^tb!3XX_-52Z#D71+)vWwnrPfqinSm?l}``3Vv+znF}C;
z-82(MV}ul{jr{WsnH^ivQP<33R2ud6<powC=o<|e01Ll=gK%h$$#EVP1fQjaS%_rm
zP6#rUh@m3k4>n3&o)NZeu93+wl-Yq2KFi`Pxz!|1;;e;n?1H<CFeCm%3NvwoH*N(f
z<YybfoCK(YQp*4+1NxI3tNkJ>$L*$>`Ylz2i_V$g$rp~HDw}D72+$><HUSIQ0T{vi
zN~A)}44?((7O?u~z_DKk^n*aQ08rtT*r|re3OJU-w~-<;g>?qKHill&IDO|TJ?YG2
z%oByFL#6!fVWimd6{HlP+RG~|E9d;%cmH;VgcFLS03>)+T7yjh*Kxe1({yRXFguYa
z7H#&g-HPW{x6FJNP6>n*_`x7^l(@_>KC60m`L@>ew8iX8joTs?@R%)d7ctPvTmm4!
zd7o=S2F9l4F%-u_JQDq0F=7lyR`4rp65ADaO6EruY*tE24#&aA^uHH;5luZq(~)V~
zntjzgVo~_`V?jlY%R-{1aG{Ap*KBhpcuQ6kMCO><j5L<#D-%ZoB|5RGr3p5vImcxG
zNH><S@TIOL^GZw~xg3}<Y0O8N6dT>gDx4o7Yo-)qeVF6OS__J_9UJGGa`T1((ja2g
zW5zSCTF3U~iOG=UP3R3^?h0^g7eJ#(StLIZ+a?I{=x+h*e_*Fu*DKG=QS)N=n|Q^3
zB872s<3Rwj;RxBN=I(He=RV~Tw4p&Zo{!uZOLvP`5WNmX$hwL_XMXr&w{Akh2}M!>
z5<Dgq6H`WVe{mB&z{vaw8SuO{=`QpaHwtKerz3hX<QtepHP3qQAgzm7t~VP(U#YZ)
z<?R&!7JCq^OfHDAcgFw)!RNU3iDFzW?6sO1lgc&C3I7=nm;5Omr<R1ck?!M27zUz*
znio0Q>H6G{pHLQ><6zD0hGQa}^5<PU!C!0)QOk;G06Mdm$w++nL<Vcqjq~%`&jXT*
zNV8vN&N114!lL)myOH{c5ZWbNA0b_EgMxzi+vp<5uWQlIwpdcY+BnDIjRFcBS=M9~
zM_)%~>{zaG$%R8?l@?Q}0;?X-dpd}!NYf1Ja|gPf07ril)PFyqdLV9DfjleLM(R*f
zX`1m%Au+ENK)QlrP1!2r?0xIBG^g#Um(=JRj^F!H2UO7}McH`|efgnnNI0QL3P1vY
zKQw<-$m=SDx+D8DGM#`RELg0);?Ajnv&N&RrFD>8ET0)Hmq7bAT?Vt+@hQyGErP@n
z!p}CL(*j6^obpx~XhGxjodZK=a#)5V3pt`fbHqP6(ReEuqeS+i3uEhC_GuW9nS6~C
z^i#?NyN6DbBvS{&G&{?F(yW8@yhOtp=ytb3By_P%7fsMwA@7Jh{Zb+0;9Q7UhM5j$
zdyBN_g%U8$Wl7p3Jdfe5R#%qOdYdOe%4Y&7YhSw6F+ju^O)~V$Jkk+eANidv#HfaZ
zv(G4T@%a<DO)}=5A)s~w`5pjcKS{k#NG-6gK&!tE8s7@!i*RRq05l!68T~w^GUwV!
zQ}YpU=R~kicU%vE({~=jllL7(?c4w{&*IB!j+V+Y49De`NB8evK*9+{QUDTwGyfU@
zpjZpDAS@Qr;FRvb;|Kf9_5ntVCgOsoC|N0loG}sYo3dY^@sa;vmYq-2G8xSk(OP|8
z5HqOL0<&`i1UE;n89O(P%;N2Qqa4dxvd_~X)Y{SYu8%}}no`(xIw2e{>jn8Nx;tv-
z?7{H^$w9G*`mb4#{ZvS+W;J~{zkCRhbxU(#j0isN!SBQ1@LiZX1eLpq*Bn*b01o%e
zmi=FWF>$7@&~U>p$e?`1nf=5J6M~S%^^L1c5+Ko!E>~5lGnB|YI}wig<-phw&{7J|
zc-jyPEt~S!KcEKM=h}mO!ZS>11wj`~EAImhKMW|B)>p&qU7gnU0-=wnzJbl)#&odH
zBY<lLO6$s~flb*2dv<T2nkaMh^Hf}nP!e5{TAPzHK^+ipM#2e2QUDTwjl<@zX9wMK
zK(S1TE)q<)zaj{{2tsQJXVy2RUPFioQzaZAN0_<Z&nUw!KKvD))6Bv?>)C(?wF?lb
zaA=F|4W)t3oCdobCPGFyQ5OUs`}Dvp4?19K)XKdPlE^Q@vncRThL`G%ge?t9!rvH+
za~Ai*Dmyc1?ir&cCxWND{dZ(#4*{$L;osEd?6u~|Sdr+4kM~TPL5;|{CC3wSSyL9R
zP_jh-#3_yKc>3oE)}z5B5ff0=LSM6UDreL+ffNfCODZFF&en{KH7>efh{6kP`?m(r
zI!kITaC4Ti0ABw9(ctfatSiby<PMrKoNiR2z6*MhYjvEnkZTQ8=0E}kfcn6$Eq%1v
zjU}S`0T8=i#B-HGR&+XZ^Ydr^#&7*)3IsfXND4p#@Tj2(YgWYCiP>2^dHhk7ZdNQX
z#xe}agF-YKMeA!*{?JrNx1?`_IR8qESh$#`-#4-WN`o-2lPFy?sFeXZ1@p``ehg%)
z25TL5KOiJ{mEKlTF5F96R6L{Vq257wi0h|JaQCv=?nc>B2EbU6fm^WsXZBk0b+n^G
z5F}B$Keny59KX*frzm8H6d8Ubh3--xbFGp2ai_?`<f1HMUjsEf7P6g<&XvA<r(e1D
z(TuT>bJ{;oJVU;ZWHA}Rs6tU7fOA6G&x18ijeY||F@sBmQ?^gAYikKibj&QV0;{dU
z`giQpBDnu)VC_%9stq6ueR!N-i`gDZeu^~}davp`76&fWCHyX(Vh&Qk1UP^13O3Ev
z;EIg05)Y-%P2ocV2w+lBS*xRn_TBV>4+MWj!efr403-l-9{@lzYZss;lfnk?c92hz
zFWyUKGN%C6h=qN0=DKs1Hz?|0bYWHi!ts*g&Blz2WdTy4LNw97@j}|2e3xZFp#Uus
z_b7lXpeRbTRBbaHy4<UFOPO8R!7!(#MLLxV`TiS<P2gH&lf*X>>k<oQ|FM4^3+U)J
zxxhCmh^CU}*ZhXn+eotuf=Ql4jrKACoq;mA9bk<SvI0=SA0!o?8&8I*^A<_e&3$@2
za%tLGG<BWdYAQOxTfb60_Wu)o;M!W%qT1H7SA@ZOJ4)U}evHg@3XI8^aN+qHr|qe&
zoVT5+H9!kMzS&GZ*HG#J<q@d0-v(g-P;P@#W-ugTgHK@AW`7?k!!uYD)FyD#XLhOy
zyG|OT(}iWlXv*E@;(1)MEoPUlSY_+${Vn(1cW;tOClIN#698Oe|Jo$uQ)zZ*uc0On
z5J!t2DVQi=w-v9k2AQNdJYyY}%M}Oa06^>{ZmdI7`P)7D-p~~!P2OyfW7;`9z-czj
z=AgoMVGK7>C1#-4sj%2#W8#zNJ*H|zL_n>~g3fH{@Yv)E=Nm<f?{UDhp5k^P2rbPO
zL#~HK<7Gdv6G+m1z){%%V|Hjq%ocG|vGWWA8CKmVkFp0Td)E%3-6G_LQy8`H412dd
zUUo(wH^`+Z7*(6L#5zuc0*JO!axB*y)6i`JbUaTSWohO&Ps*s9!A37$TW=$5fpzqJ
z5V}Nws(>9kCg^k=(_kLT%z)YgQcD0;zHsIYy!uB#b-&H(=Z@xvh~Egxs2B8pnoP&$
z_+O*_T|~;M>)=TR=sNV5CUkllD$~%~^|7=P<fJfda_4R^XINWZZy((Mz;P(7gvSC&
z0Z0JwVE};26uEr>(UQPkwD`5s9RC^ozJ3orfNE^l1&4@Q2ha?Dla5AtkN+E+uF^35
zO3MUCuLONB1+0{JP2uR4JOZfGwu+6ZDw&fHd9hnz^IR2bDkPDwI+Hcv2vrFi6BU$|
zD6(NzH;6@iO71tVmLA-u8aG{nWCq08&~&*|E}I!5!&jDMA9yhdr(04~hIfnrOz5>4
zty}}OnT3&+Y6Z{CO$yPu0WxPqaKyxW{F@X<vk#}|f$uE04^+_GQ88MB>q;n#X8bD<
z4z9NSdy+TW--KphX}-n<XOB&Uy^KTP8c+)WwQWCxKy#q}t)RipfSQM#SFQ&f)!*a;
zLKnrqbzhw(QzW}h5%i=2aUFhFHIS<k?R*00__s8DCI}+0AhH5wRpxoCD3EZ%kQ9If
z0IvXGb^%gz^+0nSAhDnlBJpJf-Dqfope5uQA}Pn<lci{VcF&IphG>%=e8m1t#H;cQ
zQavtQ)+k8s@SJu_xZv$#s)-inYiwGqz*>c)XYI-s3`(Oc>6%eaXnH$+#8yz#-9EDq
z<4OxnDoWVXRCo}Cvk;EaQOUlWg3=Y31KB}5dka~lOuz?Dk|vNzrUWf5-e_0|3v)ob
z1u%0IfoJ)L#t6of%Fl)-!$gffn%Q^qNm9w+&<;-w#D%jrwb`HiXoBOS>Y;|h{$njL
zY^q~%27~L!S`+5x7-yedfvSe<hAV(tw*NJN7P#Cn*1s~*^kM1-KE(U(eG8|@ep<0?
zW=d>yC6WD+hw~$JO~|OmQl|v5Umv{ROvV&M@dXSZE1>ecvw6$5E)q@{k^+zb;Ew<R
zRaI)^ouiP<kI)di40$r1u;5|&LiC4((q%#uC&fjUpHCFRK>(2xH!~>e@OW68CT4;g
z*Ghlz%tcJT@vr4Ewf<os&7fXkqWQgyH>>7CdxFKqiHYux=+2<cFacR+g#U2pPOg(2
z^Nh+gUAOLA3U!Sd;=W{vO#?h#uBUdT1uO+-q%D|FeBh&-5Z<1TE9-7mfo&nU_qDas
zjh88?6rmB!jK%pHotATt2nA-Q_R|pDGn37Pul&42b1nwTJ5GoMF}Km^Cs&A2BAI;f
zD{CE(P0nD_IIz+}txaBk$uyYP8g&iiIk2!?2ZhpqUz+WIlmlFVG0)ieAgF#2P#syR
z#@uq_X2&}YMwvDHd|N};Q#4%wz|dLB=6N6xGZ$HntqYa?h1RfCK&&`%JdKUwlyj@q
zS)A)FEYGY?!efG@03-y|n%QnT_JpZ-N+T?!?wHpGGw853P#BkDVU2{WDK9K*vxLvI
z7!F2aumz)?Mh%4|vK6Q7ZQ%-)Uq^CGEWTQUJ2{&24h*zg8lAZsb*(t0a<yOklLpP!
zukl2oKcH}`Ah|`B;+oAMHR3*KejxkCUQbR<no0cHVc@7Q(3A@<kW6mxkZ?JWBZZBH
zMd`+f!CWKgmUaw@y&ht$QO3f&M!ThBw@5>Qnc4JaCrMpOwvAmGvaiGTROveKb4)0w
z!4+|w(P0?so&i=amxh@GnurJEw%H8H&IJJfJ0SuxCY*AT##~#QpaIt$*SD$-lY*}W
zOdclc-vnfH@JqS;LCDu$_i>YlX8tZBQjS7jO{GXCgg{5zb<9L<X6#rPo3<(0FEIlV
z|I!&Cg)A@TRhFk?flnZk0+0Z2A1SzetmaeqHAg?yaF_d^Ulh!K;EldQS&0QnvIOom
z#g@4{ye6itr=AALTJWsTouv{}jE=R8;OayWS?$D^p4nwkp1}oTg$0q25hHJvs4HiF
z&#1cX+|gKJIGU9!A7Oz$o?wxCwPr5zqFbcld>jvn6K>%Hp00GHm#}=}hdt~X307Wk
zp_soeffF;4a@Jxq;gWse+?+<c#U|du(a<9QJdUdv#6;9AOu3K%p)_$ck7u7HF{>BD
zGkx3H90Vl$1PWlzsID?1)u@SgFAx+fT>PXO3%!s4h{Y}eklSXHg9bMNe8_%gm^p4v
zKKmmj@zZcAyQh;KiRmV{<Tl766R8N}=I{!a8RVQ9%e{%8%(3M!$4iHLGJ}X%5p`Kt
z9VDDEBn2P=@Qkr`x!q@(?X!J?Q${OcG*r;FvTH`OoFM%C((A3P8H<kpBPml74{tO>
zEaFqoY2-mA|8PTzlh6=k05f260kFz^a1%k9HLPN^+of?6$S4MBV6l02St^Xi;uvF+
z^%PsCBy}s!d5tYP=|Z50E*1?o>_dZKnCi1g#~?o-<UX8{Z(pA77ZfoUv`3=cn5N+{
zoM0%pkWL0r)){(Tpq*O*>h(oxlp`r+XMW1b(wM74&yX4OL#u*f8WKpkK4~Z!PETUN
z7KkIUnPAcYYpGxnSP{xej=EF~rL9k%y{p3s<gx^I@2Syk+3};errx(-uYg9k8YaNc
zIg00$xN}MwY$lhA8tJB%qxM7KZBTf~v{S_4u=!PBu2b2BKhA|DEqxC23L(D4e5&%Q
ztXi_l36Cw30+8TAO3g5l0>U~T?}c_=Rkt_}2E>(C<|tk7dvxCmpC-?E0<jDaK=U%@
z<JPM2epWMtgcZ`k%Q0>&hEBq12DNgaRlwz=_cB9kEYFw7LC_##PjSaoCxJ03fl;X<
zYbvbQA($$p8x9hiB8q^5lH^#5NMRDL2>)gH)4VqFGt0wX0;z$ixW$;j6@nj;ObLet
zW#&pInBDGiCoq7z2HI^P&y^UN##l0hVqle4_hBUQ8`UKil1NhTqHQ!|o1-gw=DZ80
zagg-{E-T9bIOfA#-5(X0Ofpi6{Zr$kh6$(%-MI-&#D8#Y_^1gkjm1Cw7`S=_W=Ftu
zA04ObB8H8cKZi&$YEbr#euHLk6?OpFK4JpU=@|Bc?O20F4nd(Hl2|~jqE(D1Wg7`6
z3`qe<0PyVqfUMOcQiQPIZ5l3<m&<$?=lCIL5Du>?8r2MB<``JPD`KV`Y5a}O0{TjJ
zz>MO=ia8tN`<ToQ5A!F{Ap{#zUO?Gg04~sr7!HXRkpKXI07*naRLE+^>036?%@|rU
zP-~*53k3v%#<*k*N6Pew+zZd~n(aULwQzN7tn9XfnB28u102U?9k2iVxR}9(>wrMJ
zv#3oxjIjU<gF#9KrO-*2TmeMTtW7+C6Gc*{l#IMnBl8=<VuyR279v=kp0pCKgyx|)
z4X)m7iwjX3u>g#Oe%yCcif?n^h`^Pb_fAP+a}@A;f$=ayrnKlEGg!oIjzXR*v2}R@
zRB{}x@<N4C0IF4B<0b$(!XCs1`$Mr953wLxSlvR%3uS<PFl;<8$OUlPBtBHvQDQJS
z8zKX=@p+hjh=wt+fRTD@I=fw0+(N<$Ls9?|0GtN^Xti5xvbbtKzSwY!s0i@#KXA5|
zjzU#ZEMR8&*nzNs$<%Q1x*y=ojON1CC_3_`H+||cQyh~4_Op;6&<PS|D1bVdIlM&F
zJ=4HxJBR4C*}52F;qOEY6EL1Aj3$ApH4mZa*;7`!^a4!vOKkd2G4jr|=0=$fA>jmh
z*w`5dX|b#y#LRFsuFvxt*q~6n6U@fyC*|a~5OD6K$C^z(CAUdJSoQ>n?RG%0ARGM{
z32osjlE?XC_Ux8yKxliMTOsU(h$m9Wg+#!(f^p!BoE3_3XuZJtIAfC*+RZS)ZDFiy
z!b#gSPCcmv*MidbYG7t4|KVqW@&Ob1-$=zA&2{lt_DI}vp=nFX&1$$TSUH3d6AXY0
zmNes}V01lq28P^?<5WpM3LHj5DI$Qgs;Y7%oG>H>AOXM_0FW02D<Yp5EVzFIjqjvU
z<YklwG?~~SEl324qs_oBYl~csrWP;ui%=x*B3c>^foQ3Dkv2EFSNhY1#TbbTmIA_=
z=0pqzbqa*4+l5gxmY0Xf3Jo7eAQsNhB*LU3j3xxi<Ws*A#UXvan8A1i^Q*a6KR&oc
zmem{!L;}toecQ+c6IsYU*ume-vAf0#el4oVaCst>4Z4p7tCyKxXgCi>&<%y)74xmx
zG2v_-MuQ5GV;ardCTA0MlbiO<gO*$!BR2~HlPb6++;cPFP`|+XSW(<|`$_>-sj$2Z
zYyiYSJHOw~5pm|m*kqGh1^Rz)M@D(2tyx@{dhro}EXS<T5ONBvAG7JX;)VelBHc0h
z`9_*S%2eJtdScz)ts~;m47hctswyO$I3#WB8w)X4{dL370|4?|F{ol=%PN9gI)pHb
z6Zr_L)NXNS($Fv~J!-oUN()U!rMUzyUcv-{!~TCl5s51hvJo~GFJD?j&&J<{7r`Ej
ziBS?XFoAmQ$jWB`s0i)35=xcKRpy<UQv5n2x7KWSN060vUI?*&mJ~!rKN9K*g_?#c
za-*)|snM;|t^rw;q>9<?7ss^cKROV})h_CGQJ@$<&15Wm5IO2S47YhsT|0Wf1*1|J
zL_ZItFq88kNEz>ar_h_Rvf=v1jkl!BMJ&eD#0jnz^LE;v1^_OdZ#;ZY8L%<TG15T6
z&99A%pe_|!of@4k17*`rX8<`c{=B(abrEtZ2*uW&Um+-_sFuy&0NeI3HGUJ*bHvXx
zn3Djx(vhO+brxmDkI4q7h99%9Z(|9uiXpR_ns5n^B@zRW0NCGcE6;01aHot2>oBJM
z%_qVd;;?9%)8OplEd7v8b3<5jO>5G9NX(J0FkLH>r|>n*{i(~RpYJb{bgR6^u>i)J
zrEbeFus%w@B2b~hsEO+!o*K3EpJ{Q3o21QSQNj)XGtKV5_(75ohy^{%&x9xxhU*j^
zBgQ%0*3ht`dbx*)s&FWQHJP()guo?7;|o*Y#ZWp?;gmq8#z4**)5aOY&Msv)FQa;y
z=D6=d8|=LVdr}@xwQV{$ksvK<c9yZrvp@h8FdF5krP3gTE)kFuVR@;9qH0=GBLI}y
zdgaExZU&FYlPZtXS5w|N@@}rshAA_nLAe=i&A0(nBh!T2F`xl>4!{*gkrzd}aKcIC
z%}CsY#}Y{a_{PFaarX5>-kl#2<s;UPOP5bI!Zs!p&6j~$x9566L6<6$=TXi1D=g$Q
z-p5IY+#4y~<ppxJL$u(;9%^|Jf`s&IU7Vp1%%D~gPO5W$WzEPkMz>uvyE6i8J>+>a
z8UQN|wiM^gw5UR!u(ibLcq8uG=KIOipCdo_48@_LJIv~MB4?8~`qDYIgS^1B_T_pn
z%o`}6W=35W(9F<UTj6N`S_RT?LSYpu;vXib5P?aA$VXa7+&H%7up2Y!Dv30)(4nDO
z3_f1}%RP{8>!2IUN{8dHof1(n%25u=Bzq7z7G|KxH1_T+k<|>BEz-|eml;{LVS*%t
z;wt)|M7xMNVwI+JY2Oy|O_AFqrE=&;fV2_%HCuL1b|o`V+b}}{>l(}&Ve_YD8XEeR
zQS=lvWvFVJ)!PY=5t0Is;L&NdCrV+`Fb)0U>9>}-h28$B{qLCq;aCo>r5BwHM=|v&
ztt+{pu~>*3lx0X@6Z<FQ6;0Ni{X!hIr$Jo%?_`jnTcGSwtW;z+!YR<>x(3>r#*XER
zh_mPco|3f-xXKjjGP7<3;l^;aoT0;bA?{Y~hGiJrqEaz}r@Bc9w}^cqA%vXV^a3!H
z7>gLsoqIx@!l(W?XJJp8QP2R_IiO_5f)I~xn0a#?aM(81jQ@z|TWB&hJED=~2ws5=
ztc(@RBK>n@<u=9vzD0HeBQ+^=vhq<27l0jGVpK|DxY0pY$ov5DShfn_?9(dbGc04D
zJ#uQo+G;zcjT+<Z12o0KN-RcaO4!euT@<wu0H~g_1gy?$`^9?0W^bP~3}GDqN&qX;
zNDRP<L{b0}0Q>VV@@&k^BX<5*>0&+Zq6k4(8>`vm0)Ving_Z3d=cS5t2h3sygr(K^
zObVx&dGDnLG3`Q_Hbojr56g-$8{wa4VwV8Gn$Rt3?A|ht8CX#eS?8!C!enIjSojZF
z)KfHQx?PMoW`Hqmee=w2@K!1}T?;e%F6yFS4NL3W|2dw}h#VmR5u?^XRhvXHPRA3(
zF90ATAkP4IDs>ogag}6xY`@7}A0k>Evzj{PaFL3Y+_BoY+Ly}W9ykS4xCgX0!Es73
z@*s>Vg~P|%W|xELYWEBm7je=ajVx=71H&Ypf^-=~vvWrGa|l{&Uew&l&}g*aaN=>4
z^|hycH3JOT4xjR6PREh>K+lHWPGFry=Q<`l)<_CKf``h~n1K<?opwzM89=mj39HH3
zZDmO~bSU$|WYddOL!3Ah2IRkEw*|pjgTi7pHz`rBr92Ud3QQ%3k(Lp}LKGoh7^CGY
zQ^riw;;{gFIpgFVeH+&&tm#IZNdbcm<35#Ct=EU#Vr}~)Vz_<6l^KPTv!lfcjdJf`
z#C|lD9??odqmP^8F54464=*{&3t@^gN=H>Hl%*vAXnL#&M)-Hyj(undXqs*^g~!JK
ze5Rl<Pown2PT>lB_o9A`rBb8qj^%17N}gD$8B|qM83YGahDVOHtgbPA<S;WqYesuM
zbYRfS1ceS;cd4vWP((t_#aucLcvb_1GE7WU3Z)6yB}P?Gu~7yJT+0(f5$z@j41_3@
z31AH(aHf(A;6x%R00|y>rbeu*q1lgRIKye5zd=}d<KuuqjH)IaUCGQ&02y3IGs^IG
zjc$BzkDGPYzT&VzH)NQnWr27Blol<f8`7YX9W4;76Hh~1>p4@PZpZjOy%A1mL1Srg
z0$nTLqNu@ckF;WJ3<#xmhtJ3=&Z=C)9QB`2+*eNMO*M>~RcL%4*bTWKf0iOO&5bk{
zaUpF)8fH^Bg_;#=?JiZeSCy;`iUL@gW1wzWs5GMyu9D%j*_h5Z_lbRIk*O)frBHYx
z%Am<w$&ZEVDbLe&^jD?D_F0$!z%s)lM_WSojp=dLj80LZmDlzVAhJ4d5c)19Z?vyY
z_Otv>XraEVrY2ZZh347iPu)j^%F!j^ISfFP!eo+(LdCXHkr#nyluHE8^W*tC5*`aA
z1t0;izsI7WkuHZL)>ViD6GXUs<r2R*0Un72CX`i%1IKb9KjM|dQMqjYg&YIsTW>uO
zf_pcjD@h#9OEVXf2FJ=%mfiF+<ZqBC)J4lD!R7+6i=PHaGgPI~nxBAc*eq{s7i+<E
zC<bMW)r}lgCEOzJ86^I)jSBdR-q2Y#v_%|4H{)y=!3v0l`M6J@<~Ge)A|;HYiz)Eq
zm)U;MX5V@cy&M!o20Det(tI7-BTRfR$Kxs67<P*40q+@iOp>hbjQWQT@^us(Lc`@0
zO$$>wW$I-z9R_wp<r*aeE29FeYP+LB1Ek@y>!AjAELWKCSO&nIrR5J#ax*k!Fr;R+
zB|*?=U1)`?wgS0hsU3SG+UrNDN&30Bnj2%}x?ZCyGc&f@{Ie$+$^#afM_B-@ktxO9
zx%uP*IDtqCK!QhEj)zq}8G`HR^Jww)k=e%)yabF(;L*bb&Pc4sVL^<%mu?}D4{?^1
zc)q#C2^hgMi!0&<QF6qB^9Ov{QwwB++V#F~LhuoHifQ_G!f53s6x)qiarT-}cP6Z?
z<|r$X#m;BCYnt?!(pM-duVKNl9Fdp|cC<A|id!g{oZ=<*0)$l0!jzvm-p#oZZ=bN^
zuE}JWRuHZij{3Tl*O;HvmQ3Io0xWcE#Im^Yi5?vW(hIUU1!G`)9Lpqi#3|NA4teM+
zKR<jsP2_tt?h2^2!lcT5e*Z|W5&+WJdvb|Q3))cVvrcDhbbT!Sh04M4Z%a-bj&2Pa
zgDft-vFTs2w^TJEKfWJRKx<`%JV^l)mCkm~M)R2fm1RgcaYzb4g2(!i)q$?-KI@Ri
z)Puyjim;xBcYs?|YbNxEnb@s2y_kjN$o=7{On2Z;#52gnU#y^EnQB}EMCC^o2;dor
zNM`txh!6yeTd1^#>J$K!h^<oKim<#m!CaxEGZLn(WhNXwrZ6dmq!E7BDNEk>hZOW~
zp^Ytf5uYyTXmP6_2ShZqse;(T7CoFHyLu+3b|pABLi~BDjq4+x0kL^m6pV#=JyY<R
z>Z-3;8Jen3>=5!cu9&wxRfg!p=>A65#3&fil}pAwRI^}A7|4OTCYxSM#+8tNVpS^a
zJV|45(fZce9hp3{Ck#g+PTccKfEKO-`9;&d7u!{RnGL<O`TLJx(*Q?XE6F5$8cag|
z1bJ?Q-ytHZ(qJ4alLR5*L?I~v2_9>cqa`USjTJN7010-J*aXJ$LW_)0*9zM0=bjQ^
z4R{NM?7}20=;%5j%|yE28C-$AOiI7z^Mgj?lL>LWNCt-52?Yk)1(-5_9RsK<!j7d9
zn|c*#dD^M4oD6}$SnU(aI-Ce7nb9b@5;^J`zOBBrW+31UCOc}d7iJ=HtkmX&k`_+&
z3l@Jv7K%rNg+F3&;I@FeHW~p~)*McVlMS#_C@+A8`8u@O2{_k&o_@O1&Ah|KZbT#L
zKl1-PkB(WwKPU;)EtSLRTiGa+2u1<W@%XS(sLI?cxRQHtbETR9-8n{4z%w9hk8_Us
zDmi{`UWzS_qKQ!|U%`BY3&NMP^s2xkaomp}a}=;uYFYdWD^^$^DC@#%>?M#vuJM#|
zAJ&;tH4;u3k^+$6QJ0m@v%Ch|C}#fymiCk6#>0Bxg(?GC4zO0xS}fY`M=#c8?-r0-
zl`MxFEG<m45ngTtB_NJ{YFK&^1<IIO`R(z2@d<LVpz#8!U4XI-@;C#k3ELOPSemPR
zETa?>Zr#)jYzzpM+tJ`;o3E1esS3+160pGnq_~1;N++I*;FQYE@#y8I?HDsLQ|<+?
z4k8Fc+of{5WTh2K?M98Gc9NX~N&%f7d*z8;n?*yJIno2e9FgPPq_jo*r<y%2`lh@E
zXx<jn;qJLE2~aeH8DIqr)?3h3=D!K$+i|Q2tyT>)v10d$*N{XLV>KnBkQ(isA-o~x
zlvI2h&6*y2@v+uu2A&cO)3Z7(tl}4#FS$^-HpqEx5)hFlu2T%a2}Du=5<KSTm$_AB
znot2zQtlvbnrqAq8yk6EqZ~0t!<tzxEYX@Kg5+iu>V%pwzTKD3GH$L_L0*La{FeyN
zb!lZqi)Itcs__*ARAit+g$mUSRKTXWF?zkykQXYP7#NzY0ac@R0#rGZQS@Guz-ZFs
zeld1x8OQ6oXDei}goYi~WZqrUxkd%1DiaG6aO1G3=3tOZJpizYo76Rds0O%(+w1S<
zfYt=fWcI*MNupWeF5*pQr*v?q2TC_e#3IRg(0H1c(zB+9oH<^-Gp8I?+T5?gJY!<4
zuC!6>46NL!nIJ$@e~nfK%+G0{W)L*Mb`A+vO8zWjh1pe{rhYon@Ok}`1Jf2=7<Rlw
zw2%1h`IOA8L780{NIahj!?I=F5H`rsQU48AFX$fj_spbC07b%yLQ(({3|@8-<=sVO
zd0vyZLL6ceQn<7mFpERc(pXznSX)(48DfFsWnElmB$VxfL6MRmg?L!h<$qHdcq00D
zsyX1eLNno)UMI~IfjYS{=LzP(6HREfDyWu5U8xxY#aZ$MQpyCwN!Llk&mR`|usE}~
zt}T^6<)D?8uO-C^Ah}I$#-rl*8j@uQ1T+f;L9jVmR5hxOI7Zf%p=*U&D=4zE(SH-@
zeMK6roCT8*vk{&J@g^i=I=iIkL|^CT7{>x`HWy;XJE}!PNt&jO2$)ojGL5o#Xsv^?
zHtmn9NT#0`dcdCT0Gb|f$q;#$L!(`=L4#8Rdz`5+``0Q;ER_e>&&Sij>{iF12nD4|
zYevb=Gr;U8AiE^PZY-K(%m7#uD7gSmAd&)*U_f)&v}G%`Tde^b@#fJ;hhsk^D3&BV
z{DPikz~Q3`M^-WyZHHOQ?36_lnR4)!NSrHQT7V4;U(yjApX(Pt^(!#oa#3Q4_L&8j
z2%ugE(oQixTaCOZp(_QsB!;^~AJ)~(hx2i25huo(x|AAHoP*`t>=S}y>4Q=rDcWee
zrA)ib!rBwpNgYZY<|Cm1)SB!;IOfWxW$pacS?>Hs^2E3xETUs}Bf)2tEQZg4ANnI|
zuIS(fTN3GDcK$TZtq2x$JQf5p?ERz+=?B~u3V8Tf8{-PbDwh3ErmTgz8mI2A45QSj
z=9K@-jdw#Yi|WITd)y_~@|VG-QzVDX<|N9GT2;v(Ku`o2gi)#7%<*^H>!|sRh9OXC
zQYi@V1R^N_2?k&I2zsZVuG^i?QP#TDI&5W{MamM%Po`JcBkPP~eFaj~5X{0iD6J4{
zO~*%@qG9<r{nO?ZArcq1tfr8iUeIQm{d7EGEBxENPB4}MoB9-3TqqHaHa7RN5Z|N#
zXu`N3r;jz(Iz{|#Sc5q@j7hwnRehOZts%Rn29cbRH)}g5qH^5pkiOUL*l>zp*hOIK
z&C#<MK+PGdT9h?obf5qw4=5L>O|tJ30yH&-FeoG}=TU<};8|0k(cGEzNaG~HphPuT
zEP#1jMdLsOa85Y#|Fies;kR5@eK`DCduGl#-*)@Gy6WBP$d;?z3kGb1DW-+;223CU
zUI-~9gzyVBkkAP=#GwU#m}-iR4UUbCZMjG;vRqWGE?w#N`)#Mq%wF#wyREfnzQTTD
z-8}E3v-Mnk&zUo`XP32C`K-0q-l#CQEJrWK$5?AHTn6@^)2duoiW24S6gkbDNA&wv
zDz8jHS)}7#OioOvOnOi<r6M!~mVws#uo!`L5TWG~lX=)BWBj2_o_Mo0r-z$C1Y1zC
zZ~>gfvQPjP#g$J37vJzK3*eEqZDu(Wr=6aoBnZNH24j0l*cua1$QvPSg3QwC%2{7n
zK89fV=-hPS*i~u0cGQAy>C2Pe0V{%)iS)y0;GPZ1P~cqp7af>T<<G89GFoirB1YR1
zwzi7YG0)LCduRBo7`tkQ5<C8O?OGs0zi<yeSJh!Tc00|vkW7>-F|ofOqth6Z0U9PB
z1em!Eq7LY-{(_<)N{7P>r4X5rlCBgvuR-2O<l_maIUffoxTJF)hMI#oTf}vvxGICd
zhOjj$(Z)G-eK4LfYy%J(43{YFUg#_Y&IS%$jYevQJ;J*aJ;}+{qcRjGjXZy$`@dHJ
z!aL(yCPu@I@l0g@lY}8^Aw9f7c`Pi^A`!q@EDHr-Q9|M0{Pr)lO;aD`ww+P%e`?vD
zZif4jvLA!x+QOi13otn=AnYoj$S|aHlN9nC64OMBG80N97%@pkEd09S=49PSL^A0J
zx@X+woh&h1cW!IeDxhTG(t{HeLFxv@NCF)OnAgmwP8Q-dJ&awnJwNVMTE%J)xOAWN
z$PVG$O|R%^2SVWWPB?^>D9{^;6fgi3nU2C}*`l#7YD^xb(22=|$>dZJz?5PDfP@sW
zXp^*#<wvG$zGaW)_?ljgDOuCPJeMRR56@^Cpa|0u0zM6DTY*ia>X_(<h+X0z!!V|Y
zMuQ;ctU(=rPMA~qY!c_9v4Z4!CRixfeV_oxI;0Aob~Z2=v&JCC*QkI(;V#K&jtFF7
zscsh@fU{W^3c#X-LPW&#+2l0Zx`9sy6z%Rz5l~sZnPa-&a9ddd&D>``>*S&Z5{F{N
z=%JWxCXG2*`tCQK%~jaS+2JFeY2{kP4x^A8KBQ~13>p?hg-dHoJ}9kV;LyPth;(3^
zG|&tI^Las!pD5$8$>|kR5s=os^h!`qyR~qT;5v)?95dHJmT8zM`eW6(3fvtk2m5*@
zj#wt!Me2}%$$e_~))E@melp=59<C>Zl+eEY*~y6gI7Xr$?z^7cNUY)^a<HJ^8Ih(x
zeCkuG;$NYhH6e+X7j}lwT7!00z?3N<(<#Po9t;uo>~2vQ8{3`GE)goJ#)JFYqp&fl
z7iL;!jyOrkMs_Y!2wbuw>(0T>RRF_)HE3agLZthZ3S-uMwQ3nH{7DFla(2o>0az4Y
zehL6!+xd1uwvBe0XHt|{l7gj~eG=O2z?i}SXHFV4jr%T*fTTcV{y<rj1*14ge1fwU
zLH(M47P*M?JB2RN{XO$dFoT8#P!9Z==8k!i1(tWsVOxf6^%w;|D*((I#>q3KW01OL
zZIa6bIFSLfh@a>$(LU}(IVPoo(v1o=?wg4yK)N0Rsa=I2KCO+gQx;$dmJM2$8-O|F
zR0w_Yj&EZKgcea5Qi4k~ILN;EKXJd5IsvBYcB?xwzN3^j$43{3l8x}RO8|sxh~hy&
zV&;9Oyn0?@zEz?q*rksMdWpZYG{B`7&oL}pr(izO<nj~z7G{@Z{m2xD-rj>OWjBaP
z&w^07u|R9l*^bLD6Chhcf5xvq5|hXSH)fFu@T``F0<b8){1^bBsD|^REE;f=m}rFY
z+z}!&h>v^#fP!uPselhXYA~;fVfw^%7y4Fqd%j2BKiLC%roYj3pqY|3mL$j0(0?B?
zkm^a$JC!9c8h|ZF;Yb!3F4ZWg0mDc^9bM%Xz`S9c*(iX5RJ9R;h7gXOebd^d0B^C!
zz%Jn~NcW070DVUZM<GjM?1GAxO-!&(MSg@hBa{g~(JLarvT;TuQ`{UV=bxA`EYl&+
zS_~#woCIkoijZv-{(L8cyOKzN+{ueT+55srfxwU?ri^^pGPq%>d;mn)oRrwyD*YC~
z@S><d10Y;+agC*_KNh45UFA9r^|Xo96MC*SRSCqV>(h%6RQL>^)WOC;+qkv~;F$f>
zDX@7KibNy2bpa443@w5H&th390E+@#bur=6uLS_Ct?Ztch1s&UWi6nSRm7C-zlQ`Z
z-FM5tgO3=@8bgk)%hT~B(-z1=u)^YNQ`%wC5Fi&0eaGgp{y8N*2@F_3&e~qz(NLlg
z_*WQUSb|!c4zrsB%gb}@S(zu67kF@x&%Wx(EQ;>r?v0px2H|H)iE3$(Gr~es36Ol9
zDRnc)v5=YSx&xO(!D;9K5{56unnQz0%}3I{T4yvmO(~w_DC!1dG_)@N6r+P+1YsZa
zOP0T|_$Rv{Xf>yqM75d4&6!}0y0370agUWAezXi3Z$gG~W?bUrW{IM(>MVz_tlEZg
z=zv94vDE)mn{xG8x=mERg0L%q;}8f0O3;36L9WG!uPpQ_KUxHGD2EMmD0Zw6z->qa
z9oiw?8Gfil<Kj#(K&B{4Q_6iHi}ECwg#xfBz<HMeSDgX??Ade9q%3e8+$O_8a1yn>
zE(#clkGeEMwIw`uv_#z&@FpV?%MqT}+|ZA~f>6vW<?HXsFP?L*j@ctD;2>PQgFCe&
zDFuB+S#HdrK?QEpF}1cP-nZP~qJ1-OCEE0E4+Rr3sBmWjsCVfOWp57LHP}eOvZZ9%
zic=1yh|mMEgB2{tsSmc5I$Qoc<@IW-IU)(<EL|rXeWpA3q;G7!iefPwgqVUp<wW$1
z^Gi7b0zI~3`0~KV4q7Dp5f!kc;K+I%x*^8RGT7QEZ!H5<0_*b<r?v|erV&;%A`RGv
zFjxl2h!_Di&<X2MO_cx*hYhFU$KVD^^rz2-$P~dKpz|?jNl$QFECceT6<vS7b&4VT
zQxQG2$63vFv`9<DrWjCBERF*_n`NN@EDCV)Byi+@0Km%b16xhoJZhUd>HU(K2l1WB
zTX$#p;C$obS%rp83<T?9&l%HEhAU^gp`-%Bv0dpwVPeZ7Bjr64WMu8>L7SD!Kq@T3
zQePed98v-^xMkYARO8%(Q)Vj^m{_H2Z&`uS8l)3rrDV#-M>Hs2BLv8n`vg<Rg3qjD
zUu8!DBcP*8#U>>5homwXlFA6=I0`0p#36yL@vToe1Sp=g<jw)uyJk@;eT7oP7|>xH
zePg9WO6;6+84%!{F`9-2r~&2sho^e6wKC~FLa`(Qw=Tso88;_n0V;s;yujAH)CRb4
z;n<d8sP%sJj3mWGr6~^cX%&g5u5%>fgf4X|{Kt!EYsmXShCP&%23ER?xHTa5`9F*p
ze1Q=rZlbSR3u`Sef&kBAS->re0(|`A(biczbnc{{&mM1i4nSKP+7<}klRa;O#lU_`
z6BFt=0V^7wRSb(+F@jiBz#qp`)Z}yVxM30kBIlgBW$%R(1vEiH4M2!r=(-({I4LvC
z@(8ULPF%S9hn2<3t{F8Ap%?@v9FpT0fEdPrnmKVZ2bBzj{6Bpq8vGFVk!(wxg6t_d
zCOgy_#!Ds-N*FCtpj#S~^jjLL*cKx`vlp789?RrxK?W01IDQFCgs^FB|87QEBsjSv
ztRl`V<~5=zNeLh!{3H#jznyppIaprFLO7_Xn@_^yFs|iJqXE|;h&`QyKnAGi6>4ix
znFb~zS+1pqfMIDdtlE?YSoWWGXkKi)_(3R1Nof@~hk48upT4@|LJjH``2(KF9R(Z(
zx7NDb#<)BI!WAURM=I)pd&ImH*4CD7jYT<YWq|-JN+=9~U-*(QnKRo>*qH+V5?`Ri
zHG~Bag*c^j!1Ed5)Cr`7E+G?{;x>|zYlu~wsgjX#WRPi#RK}uN9;ci4G6_=!H-~;D
zN!z#6+NGLZuDoDN)t6vYOBPLCq+oPmuQC8r0NZ1t=`;u#(Jna_Ir5>}4;k;L+NSy`
z|Aw!eJ7SXiAa~8{p(liW@~kLBPG1HgaO#V-A#V~93n?TiXwNR7G}1myQoIwS#|ceP
zH}uGL-jSB_xn<E0L|TsHFYD%PXo<je<2o8&$3O+NwtzJR3zJ$*iQf0D0ee>2`PK<(
zjmZ6|IsP9NI7-4ahn<A}&`S@o9`V}H|DN#*fu&B-3G=2E(b=qowIb8AKNL!xei^zX
z$izpeSVN0l0B5r-6o5rh<==kGv)bWsX}dsUbz&I_y!P8eflCqrrethw1CJa@LZ9RD
zaK2g&mc6f2SY;6^=I-0_eZ>m+6?x2A-`0WpwR$661>u|NBs_M(R}2i?seoif;9Fxc
z8ckuWi<FPH5vAPgh8QPL5!N@2Iz>%8bbAz+C~^Ee^jh~)+Vx~XjB=$<G6<)E_7<o%
zq}_hfI+RT#Aw#^c*Z|<dYfGF=YIWEXV|kSF<fkKpNxwr_#wxf|jFH;g-__tclp8Jh
z&NG@`UB9x4k%G1k=!17}fWQ^d)COgtG$*f4xqbiV>~C>sU!8W|Mt^=kHWWuhAthY}
z*v}XOg4PLmj13n-gOWC48?0Mb{x@nG6{`{JEP&~>gl&V;)Ky4@s-Io~fM5x>WozwX
z7r<F83k6_NI%Utk{hLLJSzs$Es+f|sEux|U>7n$(mlzvk#$(4z1S#J+poN4W%jB?(
zT-Wffdt16yAQIj*j{1Sp4CLpalmwVpGg|H9$bKPqd$mgg8dV?x0Z;?%U!7q{RtqLh
zZDRnBJYL}BX%kmpJVeL$RiVC=5SC7}cChBc1*zclCPmJLqp;d`F4XgL=wEsp;7>jz
z0+WF?B`hoxT6RWWI5OD_b1?SoX;8(}05k9**G^>Ud2B)uygmKPm8IUK54o8g?j=P}
zl;0NKV_U@3_r}5hwj^whOBBW}00v;0y|5?LjlsU%76<k=&ZX}YG?A)2n{)Yl7$C0@
z#qsZ~Cv<mDL?uW06cSP=j)`W0SfH^k#W#_QcL?t(2;;dy+nUTxf%L4TL@|yoId<DN
zix_~jS{4exqR2u3u)4PT7=R7LV}VJF5OGd`+Qt(rahzsc7e48Ye++QeaIfEASQEKW
zqI7VIgvFDUpWe*sdBNb-(YxY1yg?ds$7gv2!ZQ--WCoQ4vosWVFar&6**SBpj;ufO
zH#DDO-gg+_^af#TlEKxndBSNBJtx^=F9scfrr=e7uX{Ilh9i9!5+O#XQ%e7Uu82e$
z_5R|OMau*`Yk^q{u1l~9iIZFf1|DAtsDvdf?*@t@X^QEP8_H1dK3|2WhdgUhj-rU^
zO2`&x<G}Hwc84e;*PxAY2#|u(0n{zw=+U9`42X$#<4kB9U}*(dTJ_4Mf?om+>G#G6
zmGB;?r6&)DQa-!g7bKHmXcGR4XiXg35CF;|1|V0~CR2l^O)jvm62_`M5+h)?jcx5h
z0XU0gp#c2<SNTT(&HuAvD)+ao>xY`UJ!xA35xPH`xscH3)k^lR(2_Bk^awDB;JbvA
zt2<&Ov+TLIRy;dOkY!*_(L$tT1x4mA^St*lJaMV-<QPIc>NYAPK>-Nzs0J=QJjLo#
zEBv6E>l$Lr8^XNt$$)HP-1@E3bn{mzyS9TImg<@k2nl3JBN*#Ska5>%p1(^9<Yd{o
zv9mBkLUrBwC@wn>bZ{?t_a0ny*%Ge4q^5e?5WzS@*D#D>7$%@4tn6t)Ek}7KI~$Ov
z<Q0&Dr)R#9&0~*Nr*koe!I4s{4{GuA%}J4sW7=AcClO)Z7I^T{C0Gt9k9%LBQfmoC
zX}Kt@YOfrAy>`Uf3!W6I4~4l9nIy%OiIECtZHT_IpcDBZ%k>0s+X^L+6-|w21=_~f
z9+#jC_Us<P&4QGfY}-uQ`DBbmIcsI10Q}!A)bsC&%1&&b{*iy5Rk8Jd0|0EVub;5C
z-Qc!WRd6Qo^?`vtEv^tUMG0)4DS0|G9_IG@`Bk(1r#|Z>M(c-QKd}WdKl)Za8NSEl
zC&)QudWW<^qEeFG69zvY`Q>2*vOxe^gVo(F%)q5XO#xE6&Fpg}glvGZ*+lV-fHdJG
znkHdsL<TFFx-?7E7|21+VF2o<kSG&5n;U&zK#mS^%P<9@I=l<z#RpN{a1qQU=ir*F
z3;vNG+QPH0ZDGfR$(BJgDNt`0s5cB={qixMbJG+&>xbpT@VUQ9DUtN26p?&PlIGA|
z6#`aQXDLX9Ylksb|7x+l&<o9m4IVo+L@N}_<od9%4Z|2qM0SUjs?i8R4Lyo=>LcZJ
zY?1Xtri-RTP;zGd0Za)`@j|?|LNP&9bh!jJ=L5`JNc8~8*Co*-_r5U1mYG`1&AeXh
z0yvvxu?_IaD;+NwvL*gQ-~Tn3ObqUO;AXt(&ELlW@L&JxF7wF8ZYz&H`p~GZX9L^X
zVm=+0&1`DGjNx!#2TM!spcpo0Fq(~a@14Ekr7y3);Z;}g)6WI%J7<XE*)PP~?|m`w
z(Z_(BP7*%wC&2c90PvHt2|bF$_W}TxR)*7+X|rA18GvDSJ4qe^1>}3kmJDD(C@bKB
zhe|rL4y>%e`8}oJiDoZDa}*$A#j>>uO6(4IWJJQEg=m|a1p&u$bh=W!SAFdps@8&5
z27ociI;w%;vc>MT86MjlfeOK78G!eKyK~YlI?i<GUyv`39Z!s&Ap_%7ry@d;OE^i2
zdj5J34+@Wj`mzB}Lzhq%>7wB_z{f70i;O|hOz9;z&2iDs)_C`O2Xy4&0<#&x5aYay
z7+?I#F)r9O1B7d&+sTM`C&^FQyap@2FXK-(6t2l~?zL4bb&76Peyg8ASGcw69b^~{
z2xle*+&MQEE;t}+XE4lI9<_iq0JU8eUwvjj#F8d}7@Lz!@odLmqN%i=1nSY5*o3qN
zc*_lur-atiZg4w<Bd`fLGpR7Qu634!uS%US7(azp5dqd(*tX%it>s~nJ78Rk^7$$Y
z1>o!!x5Sv~>;BcxlyAA^wn01DUfQ$&!{<Ne#b0;Xv7<-#{Oosr<0?$CzpRFbtE$>(
z46P8%8Y~Z(xiyArB1~FqH|KSIVm_Td{-)pk&C`c3e&P7^a5$Tr<wxja_{^2__pM*>
z@@Lmid*0X1|NA@sgxz63KZTW{p~>93Em=FX?~+R{t7r3j&m14u9`(<T`V+!4ewWsU
zkM1_axbKk)r#1}EUjx!h{hngaL=tP#5NL#Ylm7vo2rO}^OoTqAb1`yoj>0wiRGB)=
z-M3EEFW<?jYHLAD18`BejAw>m=N2nV4X(Oin?L>V60FbF8X;}}{(=~#X+?;IW{NrM
zbGU~P+)?oC0DZ?gk|h@fw3xpnvq?&ZbU)>Sl+}H)I;ky17#&Gqu*;EeYKzPFw7Bf6
zCTJ|7u?7T-VF4FdHrZ*}C~1~KHmu+6l>nvVWk!2!b2w62j1_kWKmCd0)=xL=vpYG`
zVzAF?(98)`SkXowRBH*N0dV+m>n-#Yz^ZaJ<fu*0{BwSf>V=GrNlGAhlz=|XE35&h
zW?1IbPbL61-C8m>YlE7BL5ybz82~BLe@c0slo;n8u@+6c*adJF%R&Koa!Q9i{MjFW
zklyfzzrTF^@dq!y<jNPEZ_3e)lWFtJ&8_YI#iK_LRn_49#+tRpt{T|FkS&Pn!UusD
zATj`~Pp0DI^4Tz`VkV1v&URAQ^V1tAk2THw;iW-&az6gR-FJQDA8x($s#hF2@BE7%
zSw82$(QCf&n&y{Y|E)S&IxCl6eMNoGy$?KK+ol0i={h8$@{xEd_w_ukYR1O4!E|1@
z^K$DXcO`V$)kU}mVuTCu@=Q@{B>lA{gE41tsgZr|2n~;Ca5uSj5Ho04!VF5Fo&%Oq
zHwMe+9Kek?7WAg~un#T-z%Dt8Z5gI6@D*P&!F5+O@#Hv?%)A4)6Icy&W~uf8O-A`d
zdVH_G9;LW(vP}J{cxk44=2*Ux^k?#8E@fB*by@&pixNOdE#mnB*}?N_hA3}`JcA%>
zj29m)vf=5c_1FaRi1Z`@vYs<0Qa1w{6Y67^AV)3?1K7C%wT4ZhH^GEGG@}Z*<lNRL
z(PHHSiY_mtSL9esAI#X%4LSQD)@O&VqSBE9fB{ZB3@igSs?nMxN`qNbp@G35DC3kA
zN^wZCoZSRmF|$R>d8-%Y$tw#5;K?Zr0Kfiwe`kL8w|{5%$&)88`L{p(A78k=xqdxR
zK6l#Cg)Q-tDVLVa>TZH5Vap1oF(_a>0|qjV=(Dc6AFT7?5rHV|uP4TUtzD(IxvXwy
zI60op*%sS_d9%HF_dTB|AGr7958ZXwN3Qs#H-6w{ul*Ot{{F9iqu1v8>HqqJvp@aA
zH{IDbOLGQF%6*}^tP;UZ$wDQ-Fo?jjSrJSQVYCSe&n%<_garw~orC2b_L;NrA#$uH
zS|-v;idsj4N2Q&w+7KtuLzj`6l4sBY8!im6Jc2zk0gp;l*PMsy;)8hcD{8#v_HBId
z;{$gV0vOg996ns*wXYiEo4;<1!)q-tMeI*}kAwjP_|Y-%JKC4Ttal_yAurRo23$lE
zT36VJW`%5t%3KAa08vFB9+VUW(T|;5tGbq8Zqg*uW3lI5jzOmZ%*p^GZTYhR9WwVx
z=Uu*47GS?WKGtHu^H~8~7x9!~3gf{*%LHS9^Uw8%AZ0!-g<$lIN3Zf1YLN3QEq{nL
zn7bEL6DVzv@B_&1SVy1xLcTXmM%xr|%V5mjDf&PRg%}Cf09kIE`E+}+3*ao4g#z$7
zmpK9Z0BrTLT4ts%`I2uckDgw?=s*AHk3O%i+gEQ->zhz4olnJqRZ}ffu{=Oo6rR1v
z6R{Y?B9JJqvXGK2F<2w)tN=N}7&b)#Q<VTMleHLtQE^-EsoUB4bu)S8_Ty(x8lK*>
ze){%zAHMV@A3S{Mz(+5+WdCDtdgFg@$%iSg5ZQf)zTg<4YM8BG$kHnG&59-E1W1A;
zo|H!?j~f9u0v(P<-OoDDe_&1m@=YPeT?^L-M^P@1;$c3%T9Qn?hsz4y6=8TSBS8Ci
zgV(1RTzL+PL%V?ODXzPi@U#E9#UsZmY;O{p8W=1w4jyQ6!8t7kwgu)=xMbc4dLq`I
z`VmGw!1WF-5TYzezHZ-oTrNtma7uF<V0@`Eu^Kw>(vg;3gnV}}M?0wuQ-$*XN!!d2
z8wp>lS4bKWkFtCxr(uaMfS_-BD)!1)q#+@|mBJh7gc;OWMY~*pHqR88&x&{+mfWUj
zt-E>GK6pgVLhjxW6OOP&FxUWL_50rFF{VTvk;?v2MIu|-e*V*tF<=PX_#=;t3{PX1
z{K|$i#4@_eb3dwm!*Ff|%iNB~>x)c)XR$04fX}IH5O4y{bc>i-6j?8O)we8NdELve
zolNFmu{EB*%+lxvlq+k+>N1&X1fqhSW^Ms)k{+B1stA>Zm8h7TEKI?FOUbF{1Rz__
zh=@#KP?RgcaHVM5=1^Nt4~}Qs&!PEjeg4p+x1Tw6{GHc4{WWiW>8rl;&Ud}_*Czn5
z@6fs1C(cYJ+}3Mcl-}_33_&nWKv>@Ho7?2=;qUnjxc~kF?F$(NF+lzR9ggBFS^7~5
z=GLsVh|)gwXt@alfwIvN-xO2IK*%s`&^IJxL2iSJ^VL|C`&UuyUV<4_z}y)xR0I2~
zDGppbOFJXTSx!7d&fT+_Pw$O_NVPRKD5xX?krC~UhPf7y@@Q8G+DSff2<0f$O0g{*
zDv=gsW<j%@Hz|11%Z2i#r^xBLED#y)xhM6YyDV~rK#Z=$n>)Wsp-yUy(~wJ{MNuh=
zuJG2vlm=W9U<nvl93NL0&kW3n{mzi!JaE2qON4Tm4!u@lxZ|cvs;C@$d0)?nLHdxA
zMK08Jg^Z=K2;-%?+`2=HPy_-Ch#YyombN?U^`(e1n@a+>4Qy+9Hm(;j0B5l*6oAj6
zJp0+N#qQnv@UC|eny9A|zvPR)b@cd=SKRQaJ3jHcNsTXW&FZDa^1)#>7=g&RCCf?Z
z%SEeoc!~^A+j#y>{%=wag3#0OB(oNL?tUknj3Joe3RT0^%G%~YGoQTT)Oh3hX6wW^
zoH%vzZ!Wv;3;%N0-h&@m9xfd{y>Z{ejkV`c0d^ctVbrk%d^1^Rh}qL7bKvg#D>UrF
z09abx3W}7LLDnNFFcRO9qXGS`A6HIWqxv8RDO-dU%3%yM%NlTSC;_G_TyhjS04+o1
zG?Rz<_z(F=GI2WMH(cw1)Pn>geFZz*xx@G*$hUt4yD<Ptu*;JOg~05*xW~fObC;nq
z>K-X9LN>Z|J;MZIJEZ$81YZWIIU-S#xEP(9`UkO#%Q&hxJ}-cEZXsiw!CV<$pA2bM
z8<?fmr~2o(W(fpXz!Wwc9u~?gWki>?qen^7tKaj8d^>2Q>uzR8<&Kim1aeydxn~Cp
z!cu0CNrC+8=<hg1YICc9*n*gOI<0%BVNsr(vQPj%hqATxINEj{`}Xa@v17;i#b5tD
z#nF2nxb`#m-1RkE+tb&z#oCp{>b`1JE%_(>VgVqehNv+}9qOdXmBw%|x)rMv$~0#T
zow7vn(PE&~1_oe^ff=oVN2^QCbo08&eB-Lw$<41=-<-Vp@Zt0RwyEbwQ26|$f*ZJ#
z!F=Ns6d)B60PHqDoj6^<8Uq<IocKG53;tSP)S40~tX{1ZBWXFYc%OuBwP;I;alDX;
z2blD>K|=;s%$2YhBPt`NS$5SW+#zi(v9RiM!6y4GyOL3tJTR}*b`pdmkrV`>Bj-~i
zCViH8=Y+=m$Jlv+RAl3ta^4FiLcYp`>p=m`<Mgvil>*&2X}UWpz%*}vx|S?pNq17=
zVW0)Lai1yDFwxd_g?SSxFy8K}APfiW&Itg;U^&(klN5rUbwSL^a#xNT1!@S@uW#)J
z`UgC&sOgQp^2~Lk`HMP<lfX^ojsljc!UIAi$6TU_kr^;gW|IX1a2Cr#0r(usr$2pX
zT!GJe{%a52f9nUnd~<95?M<<EqglOhFdVM<Y;jg2T}qQqL0?2-D_lhIGXX|j7DnQ?
z#8?zoEIx!J9DP;-gSiEWP%W);wX|B;dUoY}w(;FZ9zXdd){K^mvXBtN4h$dS9ie}Y
zVU$BcJvW#)grx|Fixw&#lq)W(L&=(uxoYD*x?;yP)o2OVickPLLcS}0Gs7=+A}}=7
z>>laMfw{}kOIkzMN>BGGpYV=}X}Y$sB$+5Xa&MBDRX1nhT_nIBd80H_sb_w2grQH0
zrr(oNlxw$=CeTxI%Tj6-fOELZ_XadTw?96hw!>-UKt&tMclf_iRvQECS_RK1;KrhD
zfzp;ZGag{tlo(*Hb#Qj$eRyAsrK)uS0lAUS;$>3d$i}9Nl*u~W9B3ZI*_7t$Q9vYF
z>d<bQtQ99p3I*FwwQUNg0K^)_R=+rBnedmsr6*u7i}Lv|3kBe_D{=X}_O;(y-F5$?
zU-00Ak9^OhF<(ZbbN5zDyQwgKKR849V5Oi)3pv2!*?Cz`A=u&NtfIu+)uhb>{U)n>
zZ`8Qcl_UfS;AqA&%wWia>R{D2^Q#MhsHhZ1n)qps8%iV~z6eFh*w}Dq0_@q-sAKFq
z=z$t()%(afojb)_=}3nZr2}`e=Od#@!E#-J5o=aj38fHmZyAX;1vocTyeJMT3)gEP
zh_28~1~+?MjTHQ&{JqHh-VDi7yW`ifxHWx|yiaj*M0yBkHzdVN2qamPAK#>-q?gML
zEFAi(UoOTqv+#ui5$Bt7=U8k)gqRaKWvBd!iSGo7cGiz<vsAw`<--D05C+#@0Nb=+
z+k)yE#cGYg+7b#=sI<Xh?HUFyI<LXnvO63|$!_jxRz^080Z46H0U{!`a}c)T9qi{S
z?NUfveYNr7OWkU8K#W=45av?@<F}#4%#FD_!y{iQe#i4dW4Ia&(9W?aXQ?a{fX}A*
zHGlOrU$p$ukKOV0TXpe0wb^@pv9_-)s|sL?aM}k8fe-?Of&fp+YQi5Q>-R7lDSn)q
zkSrDQOgaUDQK}@Azz}GMy23j>)26Vu%10U(MHMO{ViPSs4N*%0F1{1Tdtre4j}*A)
z;Q=l`FbC!tL+=bWi*|E|X{P}ThzT-A#G%zalbFwGh>xHh>InY>5@St5(9NHW7vOjd
ztn7<>l~e}BfjgX_SJg_DyFiSCMbDgOBbi&M@?J(SO+-tr(-6^ypfn1@IDe-W=|Rzz
z^QHS0uk;bUw6FmM5J^`{AB9B064#*~9|e;OcwBWLDhNq|>y%J!(}D;n1_q!C7**gw
ziz}}*ymxg<>tjMSY|#ec$Bfyu#l@G*uxk~-%s53H+2HohM|bYzVNM=i)br^(qXHT8
zcnF3HT1_M<l<?L@#Zb;81DMVVjK@v^kjau1-vi>A8glY11Ewg=%JM2rx3DN@sVvR{
z_{R%@!Owg7H|$&AJoYcnOwE68hvz(fuzF5elm%d2;)*1zxZ|Hqyq_Yx8vW?~d@L=p
z_zymxer#2QcijThZigLe)z?FvNC0U3ox&@`LRQAJe!?|VSUDUl3&xo(;KYdnC=G(|
zIa;^ko$j({v`SEAR$?dptE{F6Cf6`aCIG4XY#3b0JjG;c>x`0BWduq?>0QzI0{ig}
zCS?#WfeBM*$|PhQWJ5TxCp=Ak^PG1<jS;5`JJzMp9voTe3iYfjdeQIH^Z`gPSal|~
ziN#%g>!L>pcJ!^C6dTz<d23MoC|z^cyJ%K#^=VMuFtjZ&Z-99NnlPUI%sKtDZ(Ya1
zHO6eS!g#&F))~TN!{Dk*8hr7W%rHdTYf)=hN3Vg@PRd*1ewXt}tnZ7Kc_#eBJSZ9#
zFp19tAdd-_ykTZbY)%UxoNJK5Qo*exrdlYr1Y=50hR33ujj})hp12SIzWEj3bp8W(
zfBd_*=EZjuYZvS<1|xvmwA#FO%sswDBVgJn3^-ZS01_WoP%O|R(fx0Zc?L){9>$^|
z=WxM-T%NJmF8P1)Mgi4w65!$vm13R5Y6dH#MIp~bC@RKe6E6RKzo{7O7o13e0lNDX
zk@D2|FeajkSh4tQ12g38eVu6+az$7`tYZsY70JTsJ>^iicH*PGR(NVtjN0xCjFW?s
zS*($1t5FjoThgh3)n#t?1RQxv$&w@`0U?E?wDMTbOQ5bkeIwp0&F((p5L@o#uUdxn
zl+Z4rWQhiZ92ZK+L0Z3hfaCO18lN}}q%B`q##&k9U%dVdp7We3-u|v7963^g*<#;5
z;45D{!LzS+2Ovd%dp@KdAJR$tk~R`E^aV0h{39C&HTW7@V90CgWzhfu;ImhncweZ>
z5HM{DY)vb%3xgCL_3GVX+zTQuo=C@9l+SxvC;(4f_<1k>x=SAX%%}g|#;p2=a_!<>
zMKxk@8=bi-V3rhHLkvXA4OY3DBLqoN!cwsKMM~F@;3eh94-A7ua8p{Sq*|fhN$R~&
zZ3duI|0nacgKWsvtQe82BtBY}z>x<HW;4bxO35BeJ-$_NHeXkSJ5uL5Nm?YI&+As=
zu#*}%d`${X)^*6RyzoaQH_3%Chu>uarTo3oUIXti9x`6T-7DaJv1L+^p6-_-L7^aq
z$m~w+i5OR>Aauoc|J+4l?Y}1|mZCu{2{wWfl+6I3AZ>xFboHFzQXwd}RA(eIf|i#h
zrXrF~kh~^e+tE-3K{mjWZSnkTw(;ESrm#g3^4_Ct08GNkdVPy4GtWb=3&j)C%cD|H
zeRbqr6||m$@Ol<`MoBT*k$+Ff3P`}LC5)#f$ao&6PX0{FQsj*ZW^^=IfKe_$>9biD
z3P36yF87?5e*L)*-FNr*uTP8rPqpi!Wm63Rwo*Du&zt5~NS0$?K9dODXGvAs7HH-`
z+Yk&Jlm(+KT#zx~LJgXh(R!DCQ8J1u{SNOY2x&}RwR-zqZgA;DB089>Kk_`iD@D{x
z3r;-31k1pu?jB%kYA`CpS>io-u2fLeY-G^0&<BDA&RI1{sQG7e86f8=Ud!#seD8j+
zWY};2OUOXj8pUFOqu*Irw29A3)=0`Y)wuw)@Rug9v-$+uLsA*c2(mNzndP1GC_@Sb
zMJxTVg@2x+;@UAVrLr3?%B+mpJa-kP&QORZOXMNkCbd?HN=S{6`>KpjYh^}fCsYcX
zXln|V>^7eoMqwKi)FQ+a5Zlguoem3q7!e5wEGW<vcNd2qklrB-DZUlW?4;EB0p~^>
zY7}^zKjd&;8*I;{0Cxc^J+?+iNsTM(3C<{4l+S-zC;$L1zW8D~aNqzQdE^lsJ#&&U
zYxwEU`^sJS-}UKlpS0CCRl6=;DarxBwqsj$U^($i2VC<E!VpjrP|pcGhg;nZ<Iuhq
zmt8i;>aH4w7|WvqyVnT2R@{DJ24gY>&TJTLZd=T23+4io?E()zRN<k=OK?FbN}y#%
zIRH>tzW`bBU&-KIJ5B152n33amx@5Z8>OU<{4%)^!sQmgeUF!zv;}z3CaaVC7rQ>q
zHMeT?Whvz4N5v#%-!oy9*kwQ+q(ID{q1eZ6n?+0qiRZaTXv(c|tY49LQQjAG#aU8w
zsOpspj%+VSDH3#7|BmEFN~)ZX&rsS?x1^s_fNMw5VtsR@H_imD6tR6ugFGZhA|DbK
z5Ga}&#g1w(6{Dy{>fHB=;G`v+<?Le;O-o7*0rB{2Y6GC<=POv=p;DW-PmFN5P5Dna
z8St^G88J~(5PQI>jL7n<JIp!59e8Ba{uj^F7?Y;J`lO17WwD%ZBE>SKYal39Wl>;Q
z4gQfvEXwDzEEE7ZO?db2-8g#mC@^dIx|?6K^vL~pe#^8OeowjkqFqt=Q(~4Ou!eXC
z8V!(u7o-tNwgfu|nwoHEuf=(n&hg@#C%E#;8t0!|<BCfg?ApaJY+=~=gKaEgS~+8U
zQXK|!1CYV?c7gjJuJG_<71q}W`1r?5eB={DoH|qD=qZDm8G{jEN~f_m%t7s^;8IB0
z^TTq5as@<7(+JKJEvv+I^MppO&5XJw)O7)@koUuf+obUJR$4x!$`ue~32B3_3qYhM
zBHuSIf6dG_X}(I7pj&D8WpO0)K8Z&5T3g!URd#!hp$cV4TAPYn%9HRye>$B&4~xx&
z$PR{hX9zP<o|@W&K!o3klr`J!Zr&u$niuNGVCFo?Q=l)ZDtR1jF8ln4>?}S3(FiSz
z((fGa5u!Fs(hkaQTw5J6-9HeCWD*P%H(ExpLm~x?UeXP1me5l^NKvWse=Gw{BjPZ`
z7!XiTD@^7kP|cAzUh01|E+EhENW8$1v84_ITqprga#<(<03LYY0e;|t2LJ%C{l*_G
zKlHx0edV+*zrR?!@IX<GyyY)#%?x%Vt)QoS(qd+7U}wNe$++=`8J>UhHeU9^DK5FN
z!S3Z2!xGLCXl&dnM?N}Oo%P*XXHv&YEk*;2{a4NK>>Em0F0lQjjLm6@2Og<#>qjbl
z=B^QLxowEYPYy6`7-rPMl$P8=Od2>O%Z_|Z`<SCeAq=hL2njNdA=WyIg3va=@#Day
z`;jF><c@42e?1z?IhR(>|IAB~Gq4?VzvmD3*Bx#MBBY~6L?~O}JsHPM;z7ypjMo6N
zKuy2rOy9Hhh_>{>4yn#aim~~k)47$$S+E*{4yVUVO-#?;Kb>4gb_#kyL?t-u0?B4_
zw_?g}j(f(l{%0tH4*1(an1*hN_y;|+A^mfp5z4xs9f&I|ZapZR)hrZ?EUqD~X$I$G
zs)8_6o8mCY;fQmU)}bP4d9aco*wiv%xXAIg)}MH&l`die4A9o(b_p7(bcI8u7}04V
zd79{wF~n81*adJl%R&Lj${n};!_&vx^}nR0^Up6wyAY&pu#W*wk$<94hi7@AVHoX%
zuxHrfB`+J}E5CAr8?T?@@SYk)%b?Z(H3Kz?bKHd$(?RE0$*8!MrzP;1L1?f_jMWv3
zbFZ1>=Ia^bS%LeG6uA8pOL*(wF5~u34)ECN0yJb4mGyyy=rY{ifFQS^4U7Avf+CW9
z1m9#)FxEE=K6Ph_XJ0KNg8`M}UG2H|?~kc=<<Y+hs_zR#SFVZdV_#7*33&h;p~qE0
z**76fqZ>hvNqR<h!QC&IyKDx;@4d4i<fM?zdMx`A=8%?4;<MNHAh%(rDEaV(yU(k^
zOba3E55nJ`HU%W*Q%stsId#gEm}oJkoQ-dMx1<X>4no82Dsze`#9VX<sF$R;=a)P^
zwxk)Qm?k0Im(;7HmnyBLOE_|Qe)c9b3w<Tj=bttJS_Wzx(Gyh)h7J4?G9oBPw{pc0
z2)R!RW9(os5RF-sC%Y^Z005T)bU(n?J@=~)K6?K>-(}0aPhVQu&(;OcB|SU{IAtaS
z$=T;2Iqw6j8-o!8uXx@J-}tqs@q%Yhur_2+&EV}86!PN(2;1ri4S>dJ+iczMR%Cw(
z3>hvt4-tW>1gP-;yy$IPpmD2znQPo|evNA{n&Qj8XcKqbIl$k)YZ-5Q=PEw)aDkc#
z)eua^f?Fcd90&VFnIV!H<#v;_3WV?p0%>DX;NFJ@U^8}+!zD%L7_BKUF`~WAaQ^E|
zC`u(uW#<#uW3Kz$5cB<t)>?!ucEB6^b_@vqr+J}1h{m@N(mx?@SGn{v1cY;ksTzQE
zLf;b?zdOS#Susbw6wdL50h$$xixQG7OwDX8L|v|`pyKrjZ3&g@`O2D}y(3rBIO_z`
zcQMyO?GmU*Zk1<q&uMP*S0`OW9Eg((-7tTU=PiUak^b+l`e-4W=tP}O(LZ?lnnG&O
zL&O>VC=^2USHf4mqe%xNu(ht8g`Ok^K!)6DhbC>6luCYQ%7aQ4luu?9#$Z^E7J~mQ
zmW2WU;C_I=`CI>W@y>UB=rs+kymqj5&Vaq(mB?!kh>64|{69-z3(U8HOAk-*9pAi#
zFaNSR4)2`-lNLM<GAFFK7N8ceHDDW`n|}lphk@b{xL5-)1W^U|qy?h}*)d>GgY5~x
zo&wtmhzbxHFja78@&ZJK6V5eYYG7B<;)T~u@SJOB_`27P@s__`!du?9f=_*>B3lC0
zsD)*~vOlk^$2yIhv;<nAquO&Y6+mGy-YQ{@I~JI@P;g@itjmCOab_YZW*<|WN&zX4
zF;lk-X%HD(kHsG=N0*5P0U92OXpp-Q)t~4R5JFm7u(JM+V22pjbgd(-l`_H|Ar&tu
z3$_!T03DN{g^IA(bmQc#ayItt-zBzEs%L}M@5hLQ1nQ<)PRda(H2ViCl9Cvrv=c<o
zRd>2ObFJ%4!;@$(2K2?Z=sD?V6mbsvO3&{C9dKucKqF*o9K^LKzx9zwGNOT`izU!;
zPs1YK!=9aldyJlU0>FiZtx1n1AqK3<bjsRvaBGFQMNt)Yu(pOpIeTTH0QhptEw^5}
zwY~LiX6gL>rl^>?q1^3C5w1;~CJ6s<#*eiGni{;~IUD%i@7lo4Uob~y89a7ywmiCr
zc@B3#d<7Jj083W^!|TB1xu9Y<V3wI^Kn{QNXh38>t$Wsv0lUFeA1BnG2G8#Tnj>Jl
z?u37_3`UitNDH6^2Grtd2Pe4fTW0u*S8d^4?;GKd{(KD|zh?+r0aQY`JYtK{h1LaJ
zuNZc;^9UdemMo4PEwH{}uy5c`p5vZ+(t8qjQ<jN*4<)N5v{A@<jYvp2oF7mk#Y1YB
z^L1vH769enmR4s+m+)4g_?G|PNp90)40o&Sq7ofrxT661;Rz=JhU=2CYiYN`%f%Z>
z+#4U^o{s8kGLByD2UiG3K5~LK;-5fidK|iAEo|`E+#X~n!teffHJ;Lnm1soISSh0c
z-QP7<5c{mI1%Xe&mDZgPvCh;LwS1BokL}={G@giv`4Na3m<7lmdF|l>A`zoP0LY-7
z7s_BtJ2bO3AP^^63>EDlo}{`cXQM0>003X~n(r)b|JVm!+tBh&!=+sSTCvPC=I%4W
zB|1-xux$;>d4YfWm8bDt-*E;P9%?~zv85{F>Mgh#17;7f{1RaFJYe`VfCd0s5N2>0
z{3ZlD@ryj|84i{c1AwW3;t-)aAK;suVo)Ci>Q4f*4}s_R0=xmx07OG28Mt8-O^Ztp
zSX}hgEnf1%8UFmQSMbI^-HnG%l%Np<1%qs#buUkr<HU1V{+1%+ii&af{UshdQQ*J@
zt=rVl$@SmExD_->DFI1l<to7#xy(*=Yw@p3R)4t0=(!hyHYmzLjj1L9nHjmAhB;>1
z6(|y_)z+y+Uq5>WvSU@Vu)w=uco)8v5V&$%P~XdZKjM+YiRSX#bEPW>?WLGj^B3ox
z(%grevaNs}r9grm(unRmV>#+XT~Ypoidvw7p2<)#8)_hg_9`2yEa#n(wk%v1I{GjB
zt+Pfrd$0H#bd<Ig2WsgdVq!G2kPE^ebsdI{1kDKCUy?Hc));E4LDdhEEXtEo7774>
zBS-E&e^R%vE>`v}7sjc+EIFNI7A#p*JiQxjLns^IpMS$~e9yO^#{Lxo=GhUSC;*;1
zKiblZfYmPph8F>3L70QFDa<y5Y^`;WKUXZA(l7;6;Y|0zLD1-n!OO1z=0||Z`#|&e
zgPX?yGjJ{j7!bMh1Gol^ZE@Mb7T@!24PJEf1i$_N?!n*w!zwnXgkosBZSV{x9CAci
z12v%RINp(y2B$YGpr~C+Q3)mlh!vC=IFlCsawsUhi8*6*!NL<vE(Po7(kEkPep(&6
z5CR&zLRpcA(h;Sg&}b1Lb)Fy~JHWhXTVUe;ZKUNy%GZF7+n@vK?sP4ur#$9Cp+Cu*
z)98vo#^P89NIPM_9bKVo1b!ApTGvuwQj|6-wgMSO5W7Xun&%#YmQF*Agd=K7seAwN
zb_UwzC%i5p{)lW)M$f@K@3>f?>eO>771PdS`}mNaYD7;Xk<>Pw1C%v|37Ad`6?4;}
zt+4jQ5$Iwe+oC9E%gYNFz}YNMRRut)=BLh_c>x#8&m0U_8EnB!!hREsEtub4SP__r
zTxQ^64*KWca0=h|U1zYXWN^*!x`cn0!FB?e^MO5I1uWg<nadc_kLwPWVV7+%#?kxt
zCyOFo3sQvuD%^Lra6yDqcl+=lc<>G2_KQK&TfkfY0Mw6wN`TEs?CU3R3k<l$bFQ7@
z${#+?FMs!xe(itk#;5KpVF&INq_W*4t0NiUtWb({@&JR`VC#%YmW#5q#ZClyT3Bv4
z0NO~Fd^Io>8QceXpBDakx>9LTMTRSt2+>>i&%4+8dFfb*eU>qzA33%ozEQy3u?qb;
z$~t*x00R09&Zwt`v7<z5U?>P%Dr7=oh>3xEgSq<O*|qGmG0qf=cu_RV#eZs`yK4yx
z$U6{WRIK_7^<3yl0-4?>w|L51gi<H#RqfM%;(bb;W&K;KU+$C;^PeLZu^LLsYqHJd
zghU~%azk;t5EY}iRWvDZ&IOR#ENRg)FrFANlXF<gOp*c#3*;F35zhVsfU+u@wcWcH
z2*6n^Px-{l&wJU|?5=BkF&C@5i3+kDGy0Pj0OB)IIs}e@dJKH|%g*4tzHJ?Q3Kwig
zZ3_;2_FI7KZJ@dV*#G^&%5&M>G=)k7=5`M_Nyz?mzp$sC4O}D+xxZ|}>ftCn(?a8T
zWEagrv;mYWjI}QX9sChs&+7r43(U_jnhk&(z!In>kOeSf?4voo?u$<0*M8=4y#6ar
z^GeflGjZ*7F+l7C|ALw%IB3pHBZNt~^X>vOCV)(0x>-~?aX8+n?_Um^cBN4ssu@Ix
z(g6&`DeiF9P)DDT^4D~9w=NvtM>?z_j*E~OJ=^;!-@hI#)lfyS!r;bf2c%h#k>|AC
zV;BSo8)-=B9W1|O^~Pxl3PiB_v-Trg&+AZ?K$(pshb*)D(?RoTiUdy1akljvNxU}o
zkJ1v1O_8)LCoh}hOuy+>j3n&gb9A#$c%}L#cTTWCzvQk4q~*f8B?{r-n9@)-)ZfP)
ziq_h7t`v&4bJME(l)_BF>G1$o9%7Y|U{IVHoCJUDkYz*M43`F2l(Sc!q6$D-QOA!y
zbnax<JgXS2x$u3ps^bB^(YK{IIWg)9;qt>%{Il0@;?NocwP$}`h!Fs^V{mmnc;9yd
z)qVzV!ol`Zq$N90^E-+yiMPfQF=39}i}K&y$|KAPya5yhT6+cf;C}?x{t1D1GujP+
zYp_U}%Pql7Ev~(Af*<^Mr|HLj-~?TJ-W<)g-(6tj(YE=xrm;#)k$KhtAG%|Rxh+`P
z+e%)r?nB^Z8G=gD8l@zFgf%TWbh5Z9J<GX>=*OdDo`uM`!z?9CJ8oelQbAAwsz|Sw
z+XTA;B@SD7N{vg`N_X?+4`(4EyLKvlKgQ&b^029-8U#=!DjE@$RvL|7Cpp?8?e{cn
zslmd^)c1F0Lyd`uYuDpL;zOXrp8f)ijC>GWM^TlLAR7raCdx<3S{MW}={DzTsSFg9
zN`m~J>78n=F}i(EoybYWNAB+c-AJLHt;M*`7~r}Q<0oc{z)Xbo@c^x`_Jgpe$cM7|
z=hRnrM=93BvcRI8z48=Q0D!;^4Go@4W_Vs%jS@S_crB|{!Eh!61C}wg7XR$)H}Q<C
zYG7)^15qF_&wz3_u;-gW<t~6X<66#i4WzdUE~c2G(9)BYLOq-1g(*woJAu#w*aTHW
zVDHxehkguL`V!xmiFl8<1Z#^mYVi$UImR#l^f7$N^S6O1z%A72hn<$kW(T1QV#8Qp
zuh3c}B^?|C(9A7-P>Pq|il>hx)<>h{7Ne?A4pFAdDH999ipqMX0z(}4BG#|auN78x
zwB$qwm<0_a3sBouncP;*)Tjkhrc~vVqbiZsx1uLS>FoQFiBSafLCjRos|X$XWlGO#
zQWGX&-r&px7E_XUv`@q-<R}Vk-TrP3@_imXf$+q47jCu{HoYS%RsqfHK|}KC*(pVG
zRJ_Erk@!sxNlrsCDnC}C8J*nPC@Cy<dfvt_L=NgV{{1ZzZ;VS=-}dCLOYi9L2FR_T
zuz($p20Lnhi}ECtr>Fwp$nML&`a6qLXEv`zxx6QuI>~D8doKP?0Gb)$nb%J6>Q`-|
zn%8iV`<Wo)78u<O8e9lqEZ|E2F9-$Lq=~B~&~uG?eizMCw<+P_g(w*iTM%yogM-9-
z{{^u7-+;?2fp!bvI$E=CX)?;W#ZA}D@n3%Q1it-s8(3<AX6}5gDnp-VL&~W0C~G-n
zY;71EKW2bJLX@6OdOfBqe8VTfMJO>34vIpK9&`*t4NsD&D}Nsew(4Co3M~(0q_#-1
z*e6b;rbFu*sjvE1Usurma^G`0{!olJ1Q3*)W*MC*ZZ2ty1S8G_YK|!RG3NXwSvE(a
za7a#WnFo|hC?FlnRO+uRewK4W_^d?5PHQ>pAFM|+e2De4w)|BUT~(9B|GQHw+%*b4
z>1kZ{zI0|s;6eS$j`moDxzO&T)B;U&jw~6S^G(7l8y{@KUSSufKUxEvnUt{B#P+JC
zxYJz4K{pI4>T38D6-ob>%2PQAkimo9*3t!BjmYV$t-z?lZ5kGhkS_zKCcOF;r*Qt>
z33yt7j99n~Fj{~Iz~FkgK!C>oYygx14c%XMS^b!dx6nPajuI;Dzij}nLEOM41WHUa
zp@!Zv&7;es(aEukZk<m+m;$5gz=O-d+i!!}ehYw2pjbuH5g9yTT(rmH-+b?BTzFA~
zpZ(Q6I59RDEQfslk$d`gu<A=u0uMiC@Tq%BdfJ5rxVG`$5Xqm=TTbXC!6!~iQ<nxg
zV}tU*Aa?b{Cw9tm*Q;=GL>S`Luz!pF)A8}#L>DKY?P%+<X5z^>MrfUUJf-B#h?vE&
zq>lRENm+d1hS>99Nalv0pbw_d*QA)pT=Kb+sW6G&=r~Tpi?Hh>N0Rc>8#Aqr)A*<v
z3iMBuzciy8c{xWKf>M&&nTD4-)r4EwTfV(0JEh=J83-R<pwCng5}ZU|dom@)jDZ>m
zigcQ?YwB?bbg9YSbtD}CmM4KCP-7Ee5WpdcgmLQk=Cp+Mifi0C+;_G{Y?C}K&@wYM
zd-tBVKmg8Sc`7OZbj~@i$I+v|g^l%N2dlEYqAi9Y9knZAA^LTfa-}%!*bu{7!o>$`
zJntFDQOp6RC2`7K5PS__R)E3za6`QZFa^-g!0i~sr-1qhFn`D;?%^qzryv^`t^u0?
zV0OWj=K_O^fbt;NtO7;pEOpcXw{gpwKa<_{fP;Nwpd7eyS6|W+$c$l31>W`5Y=_qo
zZM*@f9|oBfC^kC>_7n~N>DQjYu3Zg&>gV_2(Txg&CBLOG>?nX#?)|V5us$U`c47dO
zQ-G}(Hfg&UM+OfiO{BNC7XiuneYhx63+p4Bx#v;Mq)6TthJfTN37w=WoHZg=u1quk
zTXuYIrw{2uE+RX==-53E(Wb4ehzVQreyS~wL89c_{GRwkJWpt1IJq+fdOpI~hBu4U
z&r&0b8p=*5_7TFdv-+?bB~8WH@DqUn-3I5!3g^fY_x&aXwI2;4XdxH^{lc(k6Nr5K
zoe<p_NF-^G<@+Q0;xCCUjcF5)bVT_0mW%~<`rBHN0br6soe}{tPiF<$zP+Y$ym}6L
za!s-fHqE}(3l<8%Su9UQ1ptQ+mvr<f_>l+h-&@!1g=SPjS(W~e$~gng8k>p1<=1ZE
zio+YQo6DfpX#1rnhykhqS^?_g!0Z8Fem^k(G^jq}1USzD%zRFNlK^Os3b@}HKn2hU
zOhcf$2pC-h44(!XTn^AKfNC&Lyik=uWFJT=gd$T!?12V^O~U9pp!^}=%x{Bd9{|iU
zU<~3mp~hm+5MKAHF?R1Z_%A=d51)FtM7h+!fM9#JmIeM&4h&8ot1zz#WoXS49I5Pn
z&n$5yUawCIq#hO)*=d)dA`{8NT8ano<%)n8rtaEj$E&m@riE*|k|5{!|NKP1xG!D4
zTF|TH;n^NFB5BhJ0hCcjYKv~OL{t=(yn|5flwhrr9`l%YfqMD?Dg2Z6MJzVRW>9km
zLBuiOj-`)CM7bF4Wa;UgZ0H}3LoAik&Ln$<JHhN)qs+NWUkYCmV<qM<jv>WsY0V48
zEkrs7+V0DHAVwnTFkzhhj-AGW{qC8R+$^bqZEFD2mp(d;r);adjbWJCw4+^%T>xjZ
zJQWoHzWw%R0su~(I69aWdj<nCdXKr6EOE<>(vBSg4;XmH<)<;2OwgWUluujh5eOyF
zOu#396PVuzYEQTt$hZT1Oa+)_5HGuB9}fhwVo@$5tuzbbnalDw|0sxt;PL`scq6d<
zT%fwp@9Uov&~`x59vD=!?|?kwG*GSqd%p+RJO>#66~IG)N-$FPxpHdpMK73OZRIq6
z^5^#8w!2G|BaVzb@ks$^7QiPyU1EJ);6PCe9w@Y}Xp9p2_;%O2)UY(5Re>DPOxK{T
zvyN3Ka>>h67=!#wQZYS~Ut>MYkwGhGEJ3;(I{j6G51Eh=60j4L$$gc@LC*07Y4pnG
z$Ygu5`GQ_l=c3-A$3UvbeSPFkQ-h!os6n0|B5ng@P2#fQN*T~=xJwcl1S3HJ&g$(O
z*6x&Lh*NIu=QoF2Wx6Gye26uoR<u}b!7|Sww5YeqImwk8R<B3|K>#;yTXR&3(*khr
zMnkZ2!1DUzpN_gEdTr+i4(-OGoW1fCjkx&d0DuNGvQ+q-|I+e;|4jbqUrN@AheQXJ
z#f?|3qih&BHHMwcfx_R1;2$;sX29hAAbSc_tbmGDz>EM>CgB+J{B!I6#g_PMXx(SB
z&Jw33P_YXz6{vj}*m@Ii;zxl~zX%?G&@+S;xMRC|R$|}|lrtCdVZ8+K#5I5SHvy~P
z2sAZd=kCtPR~cs3;Q2RA@FPEP5;t8r$9!AZ;JJ0kPMNy<euIsP0eSUPxok<a1wPm)
zIivFf*hJNR`_ILT^P+}CzFf4Q5d~06_b==v^{lKrSm}M1P8f*%m6^0vmvhT3Jj)R_
zMrdn3*YfyZblcJyM~bIgq$)*?otOil_dcDAJ|871p!!gh%yR4-;+UC_Q;dVOfQ5#V
zwxNlJ2dg+N1vr%`UJ8nwnjeYpajy=MO_2Ia-GS&ng48aVBq!dK85!O83*<-n^Ruze
zx39ziXsPy!t~VAG6o5#dj{cY!Oa&~Fa}h8U0M*S~&^N8rwrxAU>BcMjhjdY%l=2i+
z02~z#hQlQyLupxM{whi=BnqEE%m&!CcMfU^ur2WL8DBA{wEgT%UNS3i>34%r_wQf^
zTlT(8Bz_otn~G1`_)G`@bc}cCg7t`i*{#5-UjZHcF<|o@ux!Az3qTc_W8&L_wM2|N
zz=)xvGXPUy?JL2%|2fzefSp2fe}<XWc-9RQ{HGr{h37nNigx1SBnoob5G6k(!x&Eu
zHaALbAgabFTg6{Z$U;BY6@riZU|sPKemr~B2yHzEi>BK`wTDx0B+tx10j<mJfJ#n#
z>SO3_kMcf$8^x(h#7KZvqGXN(t<ffFEujq6^{f+0>igodPiy@#G&@&P1mQ`Yprb{o
zPmG?yj9*h2qZDXJYctzYDo>qEm4uxq>~m&`#)Wm?$*`3EDn$rFxQB}pG3ZWpYBICi
zkt2m}&$HQtW|bmE?z5yF_qii-<-UKRB!qs2Igi^)4P1PawLMKBFdJCwmXtN}XEAOh
zXjk+lMhh{cZQJ_L$__f!qC6?(DX9Rw>PwzSCpOp&s%qH~nYiR56AShLkf@a+r)8g!
z&lHW*j0Xky<R<Ln8$c<rG!O{xh~5yztuoTd?SJAQXITKH;E3|bl2}XxZ~@R7h?aon
z5#aRy1djd$u=#gD+W=<GofQB$BmqD)n%Ogu5Wp7$br_&I16z!>R|0#!3*a@dou?x~
z*?|;h!g${GQ~W>w{xqI`$rSC3q7qOD?Zy<q*3{sWpDsi!Vh$CHuYD!HTJD(VB#}Ze
zRbLR7P~>u7vD&&so;k~BMO$_3ma{TD`3otpG&O~w?a46SF+fa`9758iBwzY+(WgD)
z(Vq28T;7-oRB7>2+ToHj`Fsd6c^QS4J{Ka4Ymm-K`1T93p81NO1tJmB*+R^P(nJV)
zBEs*wekUU-coTfxQs|5P6e6xBZdnBj8lkl8JG0%hT`;cyE+mi;M6Dr{hyg)|hC|==
zyy)R{{DvZJONQcAg={-#*bT!?3uc=F0F##FDw|uNR>`vC3<Vli0kfSvAPw54Zm=k4
zwLBFS06KBvYI^HCZcDTo487>|@3Dd+WAs82?)XbrBY={@51#;UPJv1?JHH^5#i(_1
z6~){WZ;*53kabO&AhDeUm?fZCg=y{wop}Rr;>Ur_cLCObX(enQQsLd{NY)@kA~PYN
zA>uQj)tiC6{~W+FxUCU{ECGOJ(A45NH%{<_|9%5k9=52b25i{J8M^iw!`Pe<ZvPa)
z8WLlgy3#Sc1k(>c2zyBxoAM#fEM?6s6C+jI>!p>~2iFGcD8j=5hPM7+_%8ot{Si=x
zKxEQ%<nU}zv;-}1prcHQN!=6f6VVr){3S4XlHHaaO{cpl#mrxm(5@KfJl;Z%K}TjK
z6SjwzV+Gy*At_6p_<`Ph8eS!eL+DJ_<U-&$uRXv^R5g=s#zMi1+JmAiNw?kB2N|o!
zm0{Ig5*6Xjn24!VH79W|Iw16*G(L`mx;rh@JQ)T=8eqNaf<XpoYQv}tHn{@f>+RR?
zgt5V7+qP{e&n~toPilE8Dgb=zZSUc4`if`SrfKGuEwf-637sNMu*z_9%woJzILM0$
zC<t8Fun(RDTaJ4NL#>h@kXnrBa)%vCUow&;NMwdOe_yc#6f2<iA>hn!0LT9;F!>}H
zy8s#xVEqaVaCpX^SzfjPZ!wmh2kd%1zy`2&y5DnFGXq}q+&O;W->&1_T|hH6iO9(F
z-2!~-)DSg_^d2GjIxI7GDT)0j_N59dRwaH{LzcSDiNOnLE9G>AYo##bmf=z|c!;wk
z_s<{7NENwFAccP*gnCF_GB#OS^vOx1vim9cG*fOQf)yd)Fz87EQdXXSFT+A6R&q_q
z1RF{EBXG7p!Wm4ERdgn%EB*y;uCbp?L6UJNs&5?>C3}UC+RW@vP-Yi@Qn`Or`S~gV
zDj8IGCC>VG*c@%)OxY1u?+ze_m{m!1f&j!o=Cmp`;ZDZPgo8!?f<&)T0qkWoQUQ0C
zevEgDu1Y`n^EM$J2xx?RKN--pH8gK1ouVedi^xv{8bZ?c2q$mC&ZpBc7Uis#r{XRE
z0QZ83c=x`iZL@)O{w@<UuO%gvgrSVcc*!v8#^A2|R`8<h93KG_s49T<G5F!rz$FKP
zd0OZ}xX=?dt4|RSjIN{eNBACs+X(ZSJr6e{r^VNw1Ww)yth^k&`YND00OAQCBKtER
zuFq`}Pz+1J7O?VsfXBd@Hvm+-BZdJVrA{d37O#5gHnuhyKlammv0fXO@5r}jxCA_M
zWPry`4sh8@BhZlqJH{k7v7egRyGx9a@FWLWH6zL-(`PdUxeyUdmJK<<VF=U4U~>#?
zP7S6tp|#eBYq<6s0~EwqE*blGGgems(^_!j1Pe=pFLzmp#<0AW^~s^IBrHnmp(Szj
ztCYo|VwuD#dp=a#tEa|13qqTTkbOWA!gYoY#uM+CNCt;X%Kk;z$F2lz9|9s5tbsfK
zq5^6V);9}mtP{qyfo(#rgciYxQx=RtWwCpSv3m^|7zP^a&iJr?9!&C`JC~pou4x>!
zr(@^S38P{r_sEMiA@gLY%4PiuG-SPQL{hCM=08dWj>sJ|f#)q4Cb0*}A`LK}7MRw?
z?PLyf9czpBeiZqUCgZyd*A@#Gz*#O&Nd@4U&wM^U{NY<rmc_Vf>&ES!FN9Em5I#cd
z7VC4`8vfY*d#J70BmN%dE&zV?G_W!P9b5xu@~AN(XrX1Edo9ISf$)2t_dY%ugLg8^
z$@?>i(GenKR={XM<F|q*9|Nzv23UPD$SeUEqs#R}4#ZHAi~b_shF$q0z|MfJ-$O8Y
zqg$f2sA|Sny?P5LjuL+M*Y~0}3^Hyk$`W+feH9)!GQefmO@J9gxrw7lCoRZBcC$=C
z<>7+SvWUrQGE{@oIJrwk_dQdhm>C$l9F60qz^UyLAHJo)efL*5b*#X{j}RU?YH;jy
zfmscZ7Z46yAq-03{QV8CyJn8_F0wdu$l}>gpW?hj4OS{(SXyxHfEb<jmgS&yP3&G^
znY4i~1~6`C^={jg#yC7J{r6&QgP*%k;_S371KB$2C?y;p=ZuPbbpy`lShgX+Y97q0
z0F=PEA#BwZKKbbqcYM0UnUe(`ysyH24-$@@Hkj5Wm@J4IH*PJVEP&msEv~q@#+6rC
z?Ap(`{IUi&T|dXZ<pwK5IEA1oc2F)gx{^en=!{fQ)cTg>oBUE4ex-!E{zW1L+<iy*
zT`G#{$sW23ml!;6T!g>BKX~sP7{b_|3^1D$sW=6s=ll6p8Yc$W!tAIcEy|Nqo{|c{
zXFf9n036(ZV0!%Y`mC`Hs3^rc(E>o0cns?h^ze~=II}&#;c5!Z{DL(AtcAVzIA}Bg
zEf3r=nqL0L)3IDN=`{g)R@Qv@E-hqE@d^U?*Za{)ZGny%Y?<Lw5SJi630nUx@a$vY
z-CqM5UJQ2_P$Q1Ih2|3kkjKplWANIS0`@qt{WhSiVp11a05xM&0$=~tV|?na5`X&k
zRa9%CLd%mGX!A?~E{q!!BW&zwL}gf_Y)(|vk~I`@5>BB=9gC;WVhny)CVxyYT)<NS
z@PM#6EAh!Y4eq$T#5-@P@Yu16A3b8|%r;>#vM7oGvo>A`3G3Vd)0VJxjB)4j64MD`
zNCp=i9%0}97B709#j|gk<Jzm{IK0=w%o(8?3J4Tuo!7j(Gfld%zBjsDHG}UANv2dq
z*Fl7ZL%rg@V4(|znba&~Rw1)CWW|U0krN$|Y<EDn!df*941n5{xbG3dr#@BTUGFJy
z$K3-ycC5hTr-)2Rs0P+q@U{iWr?zzoY#mYnV0#NV^2rMC_!v;n4EC)7=bzi)`l}ke
z^u-OXy?TZ#E^07n7?}Ak1>tDn=b!Yr!7E*{e_<C-&ye>LZ4ZjogHowE=WZ<mj!|=x
zuDJF(9YN5=e2(M_^om5>(L&goRG7{T%z)*tUG<j4Q!;8L25if%Z5If@SuRgW1z>&s
z!vKH-=bXEKa%255+s-b)U@0<gpBxX$KS_e$F;G@5?s|9yAH8!Azvl8I)K1I9NJ|6E
z8?^TvLvii7pwbJ4V2wqEn38hb$!U+SKNE?uYC%TbH7y{3=t(8dk{AG0pt1yJw*e<U
z1K#yj!1BvLMG0WqZA8rf9m?D#G+O%_(EI^Va~Du9JKrIB#iX`4v<m#I@7=;fkC(Xh
zuAxg5M4+Oy_~fSwyz*vXlyy%rFPTxuGaC*QB9V|VG?WB}Yj)1?dWvL}%zz>A$l&O@
z!F%6b;jMqSgb#eQ!kH~X%M4R74JyXU-k`C$F*XSA)>ayk^RXKME0t^i!y5(<95cB6
zQwD?IUBc6^Yw*gK&G3aUt#Qe@HHK_me1RN~TtLJ`IH~EK+zv`>5aY@H{m)@*t&Jki
zfeuupNXzPdfow!tV)cwjCoGYUgv9AN<Jd{B{Cb}f4G3d0_~cy`{_1T@c=vmUxaVQR
z7EG3ys*16^r<=Aoxwc&GdY?XHSOLRj#tekJ9w~750|Wf|TM3t5(Bh>pn&3-cIm2~V
zG}tw40e2SI6AY?UXr(yJ1o}>6pHG@v<9ghK9-bbPyg*jP31L%Xl3@<az^w7eV#*T{
zsxgMKH7zii7jDO~Z~?j3hqa*7Ob1emgxM|>fU{kms)sKV09<?H3)_btdhppTmTs(u
zYls=^g7_C0eLN7zQ?D_M$-Ke^yXJKBGmfFy0u(nc3^1*MSp&1*=hF|n?;_mSr~YRU
zT94ck%Umcb`u#)#cFgJ``D!x+Fab?(2kIlB@-m><4|nhoBStgEYD}t#8xXAl<@vzu
zLm<>3GN~N|paJ&p1r8jtc<+0MnA8SE!Kh~iqiyNSUNyr~+LqYSank0xK6Fr^1M+ma
zUWqA$az3mf;LQL$B0RoL`0KY1@H4--ir@RQRebXP60IQ=Lq<`#eCUbEsvX=t?~5k4
z0@w`!MaeKFU=8EJ#|_^1feP<>cZKy$!l4T+_UvI4jCdAQ)@b!HZeNW-ds1*y=aH^(
z2}7Ldzwh3BYo&zeQ}46qpFnR-<F9Mz62AQI(_{|_)6(F!J1hL=?~d>bzrKcde`ttP
zlLF;{sTf!kMFe#aj;UouC&5ye{rC3=VaGsW7{&((p4v3{$j63w=eq~E|A7*tT^5JV
zvlvtiG~7>qqL1l>ZaFXB<;9{MhC4Hn>P>Mn$<>g?O82fW_K5nIRA^7qyP1iIA2|)M
z^@Hhok5@L$lEp`l?8RUI!v(OT<l0HdT;5m27X<ogrt6!=PTx469Dfvxa@NXIRRI71
zJogJ<T|aXFgU^}Q{QP3HTbVj?$&mP;v-BwXz)qi9#>;Ph9Q(={xE6<SfSeMrIR#q_
zvv(y~I3$#S-i;VZ>Bt$TZWZZ-W{SbcBKs49iiD6bE-f)N4}vEj1!xU4xYSFPHoi`%
zMU)hk8Ys_mI|AmngUmqn0U(eioOcm0odLJrHUyQ#^M+{GsKr-)*&M57t6<a6$~Xw(
zYA)E)9&n9<Xpxi|#kn*k02Q#&8oc#ABm9@2U&ZhK@e1xgW`H4MShd0vo6r<i6=-fs
z**$rCq9N`NaWW+X731_)f%o4!zz082qOpYYFJ`PPGrXHxcO+@4-Tp>hC#j42xejq_
z`V!Iq-NXrcp3=7-t2Tc}Ot2*C7wAn!<mjmgFa_EnaOaT<zxLZJ`1xO3#k)T=!gdP`
zMiwTZTyf1vLDbtq*AwN3PX}6so(6@lC>X`iVp0?CxU<B&-aX>Sju0KXfN|g;p=h~B
zVRIeKRi!kV8L=pLcu*+)7zZOo=Je0eGs!quz9-R!I?gz*i;S8I5Vs8b$Qe+`5-Mm6
z0B8xg?ZN$c>-)}yS>|MXsC+8jc_e=i18Aokn+DTAoR5zm!J?eC@)T77n1COlJ8pfs
zJ@33L_HS%YUt$J(R^oBKapeaAlUoe#Hd8Rx*N3>|&?auW`ZRcA6n`ba`L@qY07Ia?
zD}HMZ1TzRtQe4n|RG%{Dsw}2lJIL$-(hNXy2zB<isX%rM7~cxir-0GrAhQbi;M}yH
zNxz!_t}X*jKMu6V0m=^aU`AB{S6tcP-g^t&dG~-!L1-ri&wj=fm!3BVtnqoqr4%Re
zUJZBmja5Q$5XabeQrw;iAVX+Jgpb@;;1_>=7k=%xR&mcG1<W#|9Qb{EV$3;vU$olP
zyo>RTuMbyKL_Y!Em`zdTreqWY#?g}nZu#I4cYS7n3oo@e_uLj_NxodsVkW&sn>izg
zO!0Z5Bl2{Hou2nZ(I{dr(m8)3U?b756!I~qAXDtZm;#PN$#ztPjl$qh-ZsQf{oE?v
z_76jBHNarWrZlujN^uA>+*y&9!<G5nvT>7%ofrTaMmc1RYod?dF~IvjxP&<sxa`Ur
zD<gKK6D;PA?v$TaAyvps*_6V+BTh4TMWH<`D(&p4$hw$-`9#A2i~%={_R%w-Fc+d3
z47c0(!}ssQ-`#dD%4Hi>La97SnqhSkp<6}uWMc#E_>J}C#6kf$i{&Y*0Q?96p9b)&
z*t7qF`FK2e6^hlvMOnF@MT9M7=Cq4+_guyRwKZtA2YB(bk7CU<K%26{0Ra2sGjVDR
z6a~m50dc_#o|B-#@UGy#%PlZQhdIXw{QI<t>ed~YI51nG<RGLSCV;2}i~-F)4a`3S
zsxAh~!vNJn_EV~#;G(F_E-*&!+yg3saI#@w^wwf!g>lY>79V)u0PEWYHnt3|y{g9Z
zZkoF+V#dIQ!l%B7L(Ej5Qw);J`yU^4pVerJ$Rs9!DuWaA5^wy=A^!8vuj0KQ8-fRn
za%7#~KFq&rkFdBUa}D|b(-rx1CQlPXlvbw^-6<--7L2>^D{$L~hFIIv;-bqfhJJ{;
z5OeBpA|oy7(tHF4-7!%!I?EJHWS7HN^-@MB0xXxOK3I_A!}=Aeo#J-_cw}(T(GtJ%
zh9&&+8<z0cMuBRXQ51gDrFtJjf>m*Ja@y4mOaEfmGlf9>%y4sI48sf=r#1<<e4xT(
zM@n3LrNx1R0EJuvN|DM8jcn9+JRC|5XEwNbT_pPJ73;uXa%@4mK1e7y06>KS&l}js
z)?My|+&yUtW`%LvXZG{|{^&VWELr91a!XMYgHp=K9U@fEHaEGQys@1w5P-8;o}voC
zj{^8r0Khe0a5HahoOxD_;SI%Lnc{J}loM_!(mEv+mBr)7S8>JRP26zBX<*_v&T|kI
zoP@}!F;EqtT}#^X?#MB*xI>gq;8gx|I*BfSURs5a9FDquk+0DfJ&F;?9s?#H0cZ~}
zxXk|^BBz5SX8&jdlox@gcLMDZkQs?KxCWC2&O47$R)qI`a0o68uD-O!3vZsGXxI;X
zUzWqJ*_Ml_?pUT&&MIwg$ooDZ-1A6<pZdi${Et6a#)&a7Sn^3qR2-Ci14p_DYF_AH
zu<j$2n;Y6{8gey3C}lz_5dqbJas12x?|c6e#xutCH?~+QEyE_$Jt~g8GsOG^1C>!8
z_uL~T3nu{<1z~!Rq9bhs$`OLJLM0;B*}vhdvBLuIy?ulq`iWimo4+5zRu)x>ED$5@
zv7t^M#6*0S`VC2ITFT>`E%*dFrT|b9K6%#&AN^Q~gXdXXdWnT;q$0Azy3hUiK}p-`
z8POIkUQ=h>$OwfjZ@gb`NvY{!5rqMd=dj1tVJb;q6xWJbWqj!FgY?cj4x<>hai)_}
zk<*fNJ-AQpd~?h2{EhYa*g^p~i{&Y*0HpHJeV>^9+%Npkz4Mk{X@<Kh8N4D(6ygY5
zmy#t~TZ7ZbR`BBIAK_i523nKkdth!MK<o4bv@`(LhJdw#@k0oCbXIf>gwy5`G!oFm
z)H?zZv0)@WcPwTCPz>Dh!;_DJ+Ziyp4pfW)t|1)op8Z+CEW6{4ryqbf7X&2h6($fa
zxXj}I`%Bz??*OG?y!<5->>ebTv#WLmra}H~5ZfcAYaj@XZ2q#nR?V=$dp|P3kN?+I
zy#1CD%(6vM+1Or=C+KBL2Pv;<41(eq?4+kLGRinlV(#QSAPr&Z+jW1d(qe82w|!)Y
z^$mlkKcl9VA*ZNwaeo>c(N5OG(;*RIy@wWe*FYB3NU3far;$fOs5KD3s1CdPRJurE
zVi$yIQQ~dy9^!|8at)upzeKg#z!-@3h%xl$FR23yMAi8mWr4mOT{`Rt;-FsS_sc{`
z1OrAnU>rSB;{6{O;?Q{(S6)%WG@SH43H4;?fNobByZCE1{?UY23d|1Z0g3x%{i5nl
zs)^EoH>Thdo1n`0#8m-N@XGQk@WDF|^WWcbh>Ah0-)RV{fB68D8^3n8xoLRzNAvN~
zg#vIE%TqBGuqs5v2M!**4bApFww@w}c*6?<&)J#vf(m?t87Qh6AAMjK{_4G#vRzH9
zh{#+2!J;e-Ko;$1j=`RBXh3(Ja{e`_9X<Dih0f`+dR#9)C)*M<nt7`A+ZlfAV(Iey
zZ2bjr@)yDN2{0}D+AM{Zxg;c8pwZKT@_LY+d4?<wKLUYU;LvJ|Z~vBUoO7VYo%fbF
zwNbjGl(VKsYtb`x1osPot}xTWpL%a$%m)SD^o}9E|3`M={hz2%E;l~iuE!pdV2Z~h
zgn>=2i1gj2s=;zBgsGOMMKXQ}ZY$$X#0_Ddm{AlB%*f&o{%i?9`HQPKHgVY%<0&@1
zxUPRbBa?0+-7M7vIp!?d6$vT=1DZUA*(|0eepd4+-VtF11`K113jD9X7~uzhau@D@
z++eum_Mvm=S2hGu&5#`tN8Kix$^@x@Mr6;8?U8tmvS6cfpDJPiY%Qu$gJYWpKm3zx
zc;jC$VOn~3V8?YAh|DV)JI<wSr0iSxC)aRxm{6cddBSL}Bgiy?a{Um%b?a{timRMv
z!{An$GJ==n?2N_w5PXOk%!_jX&U$&uBLDz!{>5Lgxv_ro#@3n}i{Y9HN5w|rm}|%W
zdJL{(MhoDvN7m?>Hyx*QR;G-aC@=;^*98G>>jDG!uYiVCLIMB{J(FDjIgF<_Gs$Oi
zJhS^Px0KZ#65#OfF(6X`^?jh(r@`f=pz1tO*!&zHZvk2cP=Kbl0;W>dVPsw{<KUqd
z+v5Ts{YZ(|ymEpI4%KnPLF5g6B_ayREugwU8E*@`pMd$Wz#HGXil6wI6+E^M43=82
zr1@Ke(!pVmL<06B`}e^Tp;ziex^Tq{FsZi$p(FDZka#W-nVeIZFe)TVqKfhHPYkfR
zRpFV>t+7->We}t=uTYiiLCHUhvCW39zli5GfYn!NE@-)1bAAvI7$^zjqQoD(X$imZ
z8>=`qVGNgSJW;N5U{vV099QaZiX89sEm`q7Ep<=r%aAfTp-8%2Q82dWgj;W2#_nAW
zuD-582_v@pNd-_Q2$Q?)vwq6B25HSlX`Rh^d@Stz$=z#WPK2Tt-DX7rK0O9+j9oqx
z^`yr>mKpE+*g1IbJ^QH`grM2n9VN$|72P`oV10{t`o?;D;Q~0DWuX87c>Ix1*9Q(>
zhRI~|g~f1f#Ra2fKFm%qApAP?{$K+fJF^V31zzy1qcog)f235JgF;{kG;e_QnadGS
z6+p{f46@5*{2$5~c+Ro1wvuB2o%$q$Ai>Fkf=-gvk;@s-o&-%k1~&VE!R2r}1X=(l
z1!5Hkfbn|)o`R?pD5d9o%&6Gnyo)VvzoW$Js^w?gFelUc8^isACr2hM`F3RZ+N>eX
z`2a(xM+SfVH%s`>Kf8?exkWV;xd%W!P*`A!<kHP3`4AXf*OwpjMaZ!yk=9sfH$hk{
zixe80QEdrRToUfMV*pcGJnN<g1A$6(%(r~L<)uE}EChA0Pq>dfI~RL24C;F-jYEXl
zy>O_jlK=cI%k(q9wt_QrMm1zLcBwAztvWZHyA2le5S0be%@q|3POuZDba({A<$4&`
zgj+wngai8+*Ie78ur`AksON8w@K?WObE@KPL{%MO-=~oE^~jg10H4?bwx%w@ne4Ma
zak5z=yz4_3;MRxs!UzQ*9!^186V-N%qxNQUX0x=DKb((`KZZp)Yvn2L0tjXI-u<^$
zrujfUS%=&2BJDdU^FJ~d50M7TuvnV&o8NN*{^9mRpfwwn^Kh7$KU%{*I4FRv3EI1k
zf?Ia(0c7l@V<}{9@e4>aMp@c|2XJ?{myT#kr;a86Ajb#8VkV$i0k8!+^&8;zzXo^+
z&<J3^!+_^tS_1}G0z8k{tddc1u7FF=t?|lN%<!puMpRQ7a}H&x$$T@r%%6bhgAQqP
zvljs%v_pfp{QVMs>gRT0edg1_W)N@g;1SlCKcO_oUD16)N}Zemd!>zt)y}+l+Mk>=
zF=o0lkJK6lhKxUW;~L&|%Mf<Rsqg4(VisT~vF;2~=J<c=)|2I*?;LLvU1mE8e`rNe
zG?jh*L;#Npyz_lS`q^Ju!^ttB9N0vktn0~j8vT3vA)!3s+zHmt$RND%nw&7Q=W=nK
zUM<`n)@2P{pA&xam-pf?-?@Z#Na-aCs_L1%K+n0mNUl}6PB^Dc-H8~S6vuNX4KL9L
z&s%MDNPU|KH5+V>2cj;|Q^HxpeaMh#R^Xuv{QvBig#zHq?H~TD$5)n@{*q^B)@|!E
z+99)1!d5R%K1a!A%EHpA+TeHp@@gDumSKjR(hFzi2@?aO0`|-{?7hcbu#BN}sL&H?
z=3)_NSb6mQiDd`&Xm)Ux0#JTq(p*GYIvtA(a4GQ&X!8%jr{4f>wgI#1duiP`4X=kg
zWsPOSAR9(C<BMK8!>$qGv166r^PTrtAOikJp-1Qvw=ku5@TkCtKRLk9|F>nF+#-|%
z%kH2a*{g(1$Sdi^0um7o=nGej%9I*gh!_%AkJM8-wPY7Ki~}X#vnec2Y!ZI%*Vpi=
zhbz#aryj}d)ltGbylAI!PIQzwzf9yK>kIGd2sAOGnV?XjbX4F&pB~`He{Kbjo(6`a
zHY%a{NQbo<<~zwq^4(4S?^C99T><IKNs82X#BP$9f6~fdjs$=i)v&>-vBiJ=<u$zT
zjsbXxY&lDTE);I5K&nRQb)QDD5BAXFRkIA%3rcp9+@>hZT7`8<J_z_A=<O=o#~>7}
z&e#hjk+S8qC}*`S6aWAhT(CqX5%1f#|9=mQ`nGy}+GY6>C9$xK=}AG#jA~TlJ$LQL
z@4w|T%vL2;O93F3!oa{D+d%ukDHk7LNH9pr6#g;&m?9%#dFZ@)xBslp6qgLZDFG~>
z;U0B_+4($*3N(Ee=+rNOXAc9k>KWGzC@%tNh;ZI*^o<L+l^ezdhiZKJ7mrca0BpJ;
z0_=W#rKJ|nQ^*YdWO(|Sst6CC9N-s!brp9#SYj}0{e&bzrud$KcGBqOnqCro3OV*l
zlnfSC+n<Da83mI%yxqTw6{U0quu!N5%MCtxkHPQ!{wlU?*#(R!ydtIQk&V#;V<&)H
z(vAKeTSNMqoP*GA%7fb!jrmC|fydS>{L-(k;GTyKhRfFPb_|F}5`?U&Gz~LRXNf9h
ziiLuvmt>?jqU5?0^zekEquQuk2JRX&W4P4f;bR4U<u_OHz{vqHAZ@*?amlqq@g3mY
za*uQq4(iDlNFa=^K9Cx~R{uccuGLMthXnudh}Mh^PHdMHa%aeS)n<k59ZQ#SoM6hQ
z<k2+$SIa^H0Px5o6W%j8NY8rV3yxGJ{VC7RY;oIYa}T-SF0;JBu-;MJjvD;GZ@&`n
zzUv(Do;GH=jho2S8gplr^CKr<A72Ls2I}}s)~v++>4VbxY@AH+?~D;=j7I(}Vb_eI
zZ~>TA(EJ|IiJt)`pK|a&EKr>f&^dsu5hAu(z=|RH(4e)r>8df#+dFk}5IGY<Kty`l
zoX>y|I#d#dsm7cD0Du5VL_t(ew+6rP8za2)gB6CWjmxcWga8)vk;W`4K$*z)7C148
zEGV=y@>IVUJZ$&$M**WHfDMQZz$OVp)i<v=#5&^}Rf{C;h5yQ>7Ju`O5#IBW5wL8s
z=z0ir2TG8n2nOjW68Ar$zRBqp?q2H)=I($3k|c=%155`ce*e#w@!pRNFj`~4r16OL
za~PShK4kyWraWm88+QLFj<NgA_^}NeV~iCLxmpf!j|gHSus9D$Ya+~*KlLxS(V2n4
zQjPcAR^iuwXASE#09RhqFg>g|RIU{EM7HU7K=CFftqf;ML^`la)Su}aF|MXzpl*E{
zU;*&J=j|}Syd|6*mnhJp<1LG$BvtB6i2z`j$r#g7g%;(>Eei#}mvi>l`0Zc%foAuv
z-R~IC<fHX;0~`*(?y<h*5j9~=G8<SBib0D<rv|_H#_RFGYz4)#Ab5r3Ii_TYKqX*5
za}0c9+Xvfth9?<#Sm>k|k8)l<QIV)E_1xbF4aU!j!9~{|$hkPoD!|8q)4vGb`Ue0b
zpx6Txy8zVbUD7%Uqt-HvZDFE<C7Y{r733<H1gg`XJ;!|Qfbe(ks_@r;>$duVSdC>o
z52430R&fitvH)*o8aD#Ya}%saC)^9TkVpfA!Wa~Ow2W~i6?3t(;Nwvfk*JT2!X&fz
z677^0r^gn*{|6%+-`1zGInw1WRb)tS$3h0O7cyjkT&KhbT>FzOVnpdG6^wi<1ON;T
zK72=oH~v`#t}NK3`AXHXPM{?yNfIzCWsv;IOW}1c7lk3iV8ga4z^zx#yxDL3yhdav
zTVLeck|dh2xHD49$C1G>Bj7LIGQzvwHw2anB)EYPBjoe(7k@fEkNiN)LEjuP>Fcsz
zGBRJXoZ5n0t8*9lxpU|jqp=2CvjMDx_4~H*Q2v?YUxMYL_n}33GRr~%@a3+@&M*Kx
z|K?}jw|jN)Cp<f~$yV%3^NULv!7Qv(x&AFsEzR(;`}X30{q<GYTp_TLlAm&Sva<ll
zqP_bV?A9zr+_JnY)7&K^-^ti#$+WU6^CB#nOjC(<Ni<P*oXjeSr=ayW0PBAQwhcff
zT+$$$gmq*xsqrD9ie#|tqyBpgiZmsX0fqoIOQ6c&&W9@e#{XQwcI{4ZQ*M{OenNng
z6#TfX`8b6W&|F}%Z4K&Kfo5Vb+ccQ08(?a1V2N<yUf{glggpa;Vs0?sAk4Q6wbK&w
zSq0mcBDqu;8hx~mgrbG|m6G3)6WGPT;+Bt=_=j6cpdvkD${c1Sq7g!ibK=RBFEIg%
ziRYS0Cb_5!hHK3u%s*j$THtqne+iGC0!-Ovb%v*tzhCxGDuQX;+}K$Q%q9lScz}9)
zfOf0IDhw{#Lv-B*pl4jt^3~@zIJC+zbA#z-iF#b3o*2yMju;G)jtz+K^jmzRS)B4#
zM5I15-T|N}fX&+AH-Bdt4;?Q-RiH;s_jN&^p2-m7L-{HZbDL|B5;=&^3Lqfp5e5$a
z4@a42?_^L+JKnTTfnu?~wTr2H{y;_wY!=e!tN;>0?Y@_V(<Ljv{f3`yuYdX%{?*3z
z@z>PjlV3boJqYC1sW@Za@nZHylE3En(eiMLKY074xcZ8d{I$<`2skZH01`|*LT_aO
zu4~xO90Of*E~qL&jTK2wB8w5MLTCZjw<TA#8Q^@?$=g!p`X)-xhdu1d+ET~eGGK-v
zZo!*>3N*(7j6qZh86$)$C1paR7-48~zqNE-$_@buUv^JS4B?G`KEj<3`b0l*Zt|{&
zK6I@}-6Yo*Lj>CZ^~|8KgmVuu&O1EEbD!Sg@=F<`)fP)5i+#H+h69(acRDlJ8WYA-
z!gRaDz4sZs|HCC7d%VQs$4kt?C`T<!kr|a)V-w32$%_1q#xOR=27mo`OZdVU&#{~I
zE(Z$ARL6q%Bbt*8NKm&H>crBAOGpZ)NH`Shr5(9_uy(-!SA_S!zrwrUKR`KZ`vcyC
zoD*wKcgJHo#)6s9&JCJbfrEQ24qw>dIoD5d{SA!OJ&e6;4fgB;Rz?<8+0wkRIK63b
zYQ4brq{7B&gAaU=aL3&hPM#`oYLifnEKKEn*gcs-0};pQ5t#%G&LXB@g)^fZw)p6$
z3;fAnEa7{<t;LX<PV%0p)5x<sf&szSC1FwskLCw4_JfjZBkraM3ZXdbN*0&2$N<wu
z5};f;ZY&6BTLX5(F0y!gRF2a;cZ?n+-a%j{vp@jOc3CI@S-J7L8|iDm<Mj{!>QDdD
zZ_T#XpKeEc&XK_>ayLv$5Mun7WY#hRRJ7P`4gTk!UPCurxQXjlPlG4o$Y63wc0ync
z11=}P_7v?s$532-E~s!YyXMbAm*%jt#0rzv9>Ql;K|h=u7OVW8zMxNF5{vhO0V+Vn
zF3{}5{)Rzj#mKg@_J=E>pIfC}3q%3<%uX<lfRBB$#GBqS0xHh#7Ai!rPK98J(0ULu
zzH(z2ZA+L>fVC0u(wpaa!Sfot@a7hW57t;4SPTb#=o$vB2nIARUJ~SjJEslfJHCZ*
z^hAaCeW=7Ow+?a3ttHNE0mT3)O4}K3t@bhGl|XBwW#EG!9^#IBD!l008SFG|zfMZi
z4n(hV5F}eI&&QvxNm>wY9hP%T2^FIr?jPvP0P79mO>Z7xeF}_L-Q*~RHH-lX55FP_
z|C=Suw+$)+uDjCWCC{JZr7xJ_%F7wMmTHU!3~DWS#?HH9Jq;QH?Q4Nz4l3ucWbnFI
z0qff(?zq$71Gf(FzFUX5`@RA*%cw>y!wmvt<pF+?j#(}@zqZ0}1b|E6jej}9D_=Ur
z(=Tp;CLxM)2GkbFsIvt(RZysdvXpC(iH?<O+XqbqjXZ#lM8K>;yeN=_&@M|rGdEx+
z3I<RZl=O<6-(=@D!J#%qu}DjEw##C~vvTzKQF`ZF{*14=@#e?I>nAUo&Fe2P!(E1;
zgVWri6QU)Z3X2%6%mgYKM^3F^dutgleAeR_S?m4gLU8*^5<eqgYX;03(1B$kw+zy2
z1r(ZT=Q#|kzsMEbcTdkV0`k=NWmi>u3WQ)Sg4QegUK({5nGsFh=KIdUWdI=rIO<`O
zL4{v_!xC=!NQJ@3&zU@EhxH4i3&-dAk8;X7rp?x%nHU^gWqkQ7XZUyDGr>RonlWDV
z^cfB<)mTQ0va!INfjN9$B+p1&Z(-F8%osekC>x7q!#K27<E9%Ly!3@Np8d=QWPu|O
zm)PDk7z}{Ig!~c|TPd6a9hJxwz;p~;c3z8{o>8L+0oi@70D8g+??N&ivXZ|A6o~rk
z+DX|YAIM$-pL(Feum8>}#x27buYz&^tD}>Ik_Uo_FrOF{bKp7Gw)pOEo8r5_V;f)k
z!Z9w{H^-{+b2MdO2A8ms#c+gEpIZQPfaVqhZn3LuaK-s^yzu54FMe^2D=xCwJYC?i
zM@!W6l1wR)B}af-l@d!lC;_4r731`o0xL@f&wqY{V%~J7N=k1PhLL$&`i5M&5@N}b
z6INtFJ|Gjs4v{>z35;hzDaIX$u@N+6oLFDNpS|m1Ou%46Q3)bJYl`f$G>&X7+UfcR
znf8s7jmH*=fX-rBC;&T@M<4vu<ec*^J3Zard<hpT`>7mwyTk|sJXf=&Wtvv2saibr
z@GhLYe~Rm`Iteoiwv*8^Ggzg7+Y-1rb#L6ejJU%lzfa~UmhFiWV<#?wjEVFx{0z1w
z`OHo_MzqeXb`iunwS^cv&vDdxYSj%&5$sw@P-*bV2P^#A8<wzH6HJkx4M&J0M?LS8
z43-J?ti%ctzVsC{{J_87#y5Y}6qlbf$FlVTKRz0{qO{BPAd^E>$@uxQ0OpJlSzK~n
zgBQJMhNpi)jrqjj!3QhMT7$CE(d5Ce9oiQYAo=&y4WXV9Ui~F=ESa5rzruo73ZbUo
z&V!s^%V?{I%z9BPmC%X7Bj8Wpy2NjN`!ZFlw#NY@<03LTAcAFs`Pkr^3oX9)+qdzr
zzk3@mc={asss?5bXQEnBUq^826wd%V)Fupv1<c%H@2JIf*VK5~%V)Uwq8djYB|Lt#
z01Tlhbvo&cq<V@&9RL>{bLvEa7d(H4bCz8?Y>9(8{g%_T$@$+2(jloLa_{eH90O9s
zX^KtwOK2b40A{sU036CD50Ao-@$jiNyy?A{Vp6o3GMG_;P%P6*Hn7&Bovoj#h~GHb
zeC%;7%2_K51>gzF_0M|I@%59(_RMDWbBf{aDiVI5_8ok6@`vC%Ct$*ayYAbK8?HT#
z3-^r)Gb4GNSgL-35V@l`&rCtX3beN5BAV2C-offpLYLIS>%i%>LmkTGNY+eWUZB)=
z4_QX7UkKa?5zDr9nNvOveJ#r^7{Kd5%LBamog@6k-&7bZLHVF1I4Q?G34k;-%mwV!
z;QC7}{{8oD;@iJvf~zjDDCgE$^HLrO!Kl@YB)WR(geWoEmN8_;r5Ck$!3!Fkd#J`e
z_Y832^Z=&hbnbyfd(;^VDKM}^iC4aSjsq)gI$NQ4^yK(bmi9Syf@GV8;8ov!8}d0(
z@93a5zW(I`Z~nU#df%-TM$1~uWrZ+x+t$<u%VhB7Up&Kq`gfc7!WT@j$5_yu)A<OL
zH$YUu@_IlW9FeE^#?)8STC5E$Zn(C=3tmuTWe7ZQZ;6d<gQ80Qca@<~tVI$75Om(6
z08XALaLwf{zToOPXl|3`+-Jh~+Z_Fan^9wj4nzC6=N-Nc_R$THZN0*h1w(>?k;R>l
z?Zulva1rKZ3wFT+Vz_fAA(Rq7Cf2sFvyJsZMSnEjII>Ux&SF_808daJy7!LeqD!xR
ze7tq$Sq+yL6@z6RK&Dt`j?d{!MQL$nbAU5PSMj{(9mOuxj26`0AWbQ>fV>HEdIH+L
z1X?OZ&`x@;Yq7ywhbe-r>vcote$BTt0TH?kB*7)Gd5)%f5|IrSYrgOOPjoFXV+KhJ
zTl$9Kl%+FGiQoRc0Y39+=}se#JXwh1+(Hu|g)s!%5{3+X-K(eg!GAl(i=H*ZGJA_Z
zGWT>Wv9iil{Sq}1)^&JiXt^Yt7Fek)uDhYd7koj3Q;!w6_x=)8u^#iRe)i*A7@(aR
zJm;o4uDodO+z~sDD|If@P8YiA@ph;;Lp>BZdErQ!0_?!xo$pz~hi)HWuw)ahit`f`
znUSkwHZeH73;2Qm?-suE^%GpYzk!)rw+kf7?9>P8ZPWeeVh&m%SDkPHYYlK<nep6b
zx47=w29G~Vc;KPR9hMVQ1xpPo)RCNGLE$n6Xd8l^1Fv|=9Ls3+dq117II%5QYdI|R
z_&$YN8w!-qxn<Z#*WnNgp$Ce_*=69v_Z`6B-FhB3RZAQQH5>o@*~s2Nux!Ee%`=0F
z{%E}Z=t2QFi)FF#V&_5t@ZwkhlY4fpuKo^BPo1`nPZ6x*XY@kvcm={<Z_6l$bG+l@
z2k~2fb0sFL1}wOGSFpiZekFmqg}wI}c-A<TEg-nzSXvHejSFTL5~c*WS!VpppndmV
z5qu}Y(UY>{|B<Y#FOW#TgG2j(wEeEr4v`>9#r|<bpWUNrkGVr5QZ4{0fHT_$AO3U!
z%f|WdDGX;;u@J%{1OWBSU{}fbH{UhE4}Sj^uDx)IVq%>y-}gOcRp!|0Y`(jfq;(wQ
zxnjR42KoWy=wxQ`ylZFpsUJCmum6e}+KD?m!3YE<0T2Pkb-z!i7VDeAdM0GDSj@Ye
zFf|LJ@q`{xn9)aOsd~3W?u~LGvLPdN(!7X);n4csWR%7#Yo4^o=VOD*4l{o8hd1zz
zuiM66(*QGzuE5P`yfa6M#z|cZ8iZF`vNb~h&{z!TbG-anQ~c~tY~fqJdW>bXXzGwE
zH?7U2%TiYmGou(--1}gG(`U#<-*?uMBbazJGehL`4}>J<iqmYy<(g&COf#MoY?jXw
zf#(g-sB?b(^C>q26XE#!5c4L%H4-V6XjtTh;j<tsV+;?f>a$UI7UlC;77D-<7y9r2
z<vZF#2M+$#u&CeMPERx{1-deeU6J+#!HC6R+?JV9gEzkIa=hox!-PFnFwb;I35EUU
zp|;Y%ZqH!vJL%6Bu#j2fqL3DKanQga7q?jbES}-)y~Lf~u=r0%KqQV5ge1qdNk4r`
zNE7ZAS>6;=LaeVlydqXV2;lH65v(zo*M-aYM><nK#})~u?|-w_V6s`_igQ~0#1C%a
z^<O{6K5Brej}Eg8vUwv@SNcLQV*Q*6NQfQwiHnM1F`$-!G2{Hz8vo&6ZsD6>Hv?}Q
za03u*%!bD*%NtNzVAm?+f<ujuaPN?FFO@>IGj%RY8<Xk~aIQqrDaxN6AmwbphzT?Y
zZo0O{zSS1Ch0iz_w%d97wlM<$+HrxKE^qMDKeB;WJ%567+yZkO$tjU}8e@fd1m&9L
z{hT#cv^B~tN@Q!@co8!&ZgAPIDgNX4tmB8jZvzLG8q{M#VVrtzg0Lpx7@(L_5Dd5b
zV>&5t<cNVa60#R3PAa`TtV7{4VYyW~>?9HEUTPI$y=tA+uRCVf@OkTwE{B-k@WBgu
zQxML~hnS1;Pn6N86Q>D~E3_;N8Z8a6C}+1U6o8#eq}|&-^jF7suPwiUC&%xZjW?Vy
z?}L<c`9M%a&M=_L;_<1$FTU{x+`qjH8ac~_DZrkg(gYcU08|F{<R;ojPrGC<0p61@
zmYgnX@|>8jU%VZKK`=Oux%XLEK3xeHA#Bz6u>FmavcYnQIv8wsxPxLLx6;M7BHbgN
zAqHRxqk?g87kg_`y|~xOz~uJo&&Gro-8jcj|L7*Z{0rw8&027anAwlACid4El(=jw
zmr$tmsi?_9Qr42}UIQGc8hrovPVfz1Jw>x^U~S>2Q}6W$5$d_Yx#uyScBOS$bTz`8
zUXYQl#~!j2zDaph%s<RU?v4nw9t~$X{yp;^=&E5n>zOsKzq&>}4QQEbXnZBX9qBwR
z@vQ4w{P=&`#EWj6!E7@^?tT@6pw0_mO~R_*NhwqF*Q4txzkaOHzh@4taf`42@-cq&
zKTL3F4=@`SQ3(z8lgLJy)Qr$)gT|T;O>xk6CEfGR>wzNTAfFYq%dt7>e1^`6kj{YM
zna|?caX$$gff$?95=}-_y+S{uEREKXHD=+FKHFuX0DP9^@FkagU^FOxw;dnbvbK%P
zJe?%xZ{&VqlK@+bYI%;2J-Cbi*IS;3$tnSb_3$2&=m>t}uuus=MX-;afjz$M@&%~6
z)B7Xj4+;OpFIupMzcI%;dODEsa+28(gC!D#2j|W436a#{B)$&Ccr=rus03v9SZC>x
zh2LUF2}qb*99VAg@)tC)jYnU4W<V(;mN4Hc@Ws!Y<G=jy2A+F;jbdt}0i`V`*{w8J
zI%7XYWJ1cwWXpB!p;Rx4`odT`KkR`)gMasZ6a16cO<~7wYa$u9_uY`+I@c0LOnB|9
zXV|yqt-+9JCo=#eZBTYuwMr*J)~bO%&p<0^;c}*Z?38h^Wt_9C!MA?n1bdcRG;_D5
zkqpQb02MA$ezslUIX5);PycZf&%AmDnzR{GmDimVmAI8M=m{j7s4Zd65R6W;!~7tv
zuvS|_IRU=n6?6Rf4~=o|K43mAUH<3rhOn#^A_TN^!f<48_%Qt0;Q{$bv__I9#afO-
zES6ZxzAP06d2iANl78Bwq)l7+Bo<wIB~R1Dn9d7WA^6jqqzkE^_R~X_iQ64+Sd=HL
zEL5(~vOIj>C)!J%_RNPSTkBUeEv_ntt45{K+F_HfycDh&09;ty{h9rA$pu@u`l5Bv
z)Tn*4VU@+eoR|}qfsGkx?+R#8ICwffBA$(j2`Di_*`hw_7#o@)5aD-`?o{vAC-EFQ
z6(_^eb6{y1T2cx?d>sctlPd?JEy=hBETb9$7!lt64?}Fv4T`YWT=Y4n9cF?Zmw5Hd
z8~pGOZsLkVEod4n_3oVMo{GMAwqABd1%0ssBojwykXnp2oMWGX)dAzCXSHZs#@%<8
z7>^4WHsIQzog1uG1z!J6GrayAwy?r&YL9xUXjIlt3GHUHr=N#wdlH^v?zua5DG;>>
zb_ms4;DSpm_UvWccTa^=r%P~4;0CZwfgu^Z=H(5(|6fk=j4NiKiS4#9M*%_`a!?}(
z#@G(67KTPeN|)<`)BAEicj%vKfh(^7F1XO*L$?j%4gm?H%K(2vg!y)f7d?B1uX*(*
zmgY@*7jskyD6Aue+97K@s~PL;LLp589f3^ZT4`V(-vmu-myE1qvAf~6y9j@C>jn7u
zeY?3Fwv-eG7HeI<Rbek=V7Ub~TPK%C<sY9qcK=Z<%2_K51>kci#~=I5#-a1BI5pi~
ze<8}1eWn=rUveRkuE{kOwgkH9U#6KgIP&mrJo}j^uzxfI*KYlgSUA#_B*1OQsT=UP
z1|3*+mLQ9JM8u9;awavb!}Nu6kQsEby|Vqmjum^5qdK4jLJ-<gC<H;@qa+A^o-CAL
zH6o$`-7{B0DpYS{S;FD-7)=A*_Tdp40?G<09>Bl4ofj~3!fU@|hX3c^ZsX#8E{IIR
zwW+_p9Wop}<7cYtSyBB-lai%XMzpBX4PnmwCCgYI0MELq!A;MwxbiZ>{(Tnb9Rgl@
zbB*u%wlTiuOUKwnjSpJvQ9{#;QeV^^0+?3JTl~!%4XDmU`s<|XRfLyaBMb?+{yN}U
z&up-N51|6#f^(T)@j^@A_DwT<+t-hA>A^W@7R+L;_U5_`b*3zvgPoctCOFbG>*qKM
zx3mVNcq>|q%P(ti{zWZrzrDoClLgAcBOBxoj{;y@!hBNT{Jo6t|L&8x=A0=o3CN8Q
z{(T0tP>6Tv4if)JjhEEj;Rk^{!WQI5*MYhPd$dU_01RuK0`S%kT!c?PxQog`8@Gr?
z<wNeT&Bi+J0<bNp-a5ImJp7ZB$L?Jy0B5l*QUQOC<>2|}zkfEq^M6gokA1(XE?FTm
z5!?rokskIEC(b~yL6Z;sWYFNl5ADXU|JBv_(Qp1R)~1aYm|icFr~U~Dk1GQ{GlqTm
z42nzlf$J8LQK@yBr4$j$iQ@gNEr;;V09~p`Z><qP0p6J(Rx(s6s6!A{sE+`z1PC_>
z>ollI$dZR1t?mZ^;ua%o@y)NZ7;hH%gEy_<)COZPvLFLAwcBoW{=ORD_?6rEC;w!M
z^OhNQEFz|R`WU<3HMV4TMX*>8oJtw<RZ^Ie3ntrd&kVPpp8(7(R+;g#8*04p#tFu?
z-?msWmWtM8BJ7|n0+JP6K9QCX;==WiBPU(=j#MPb)4e$SMx+IfRH*8a$PWVzFsSEv
z=B2<5m(H;@FTlpo(xAbTX+Sduwhdrh>*SnBh17M0QoVvorIHebxLhd#!SP$*RN?$@
zz}x*CSx)uT3^Q%;n&&py|6?=!*8f_;-`}!~?XAKIQv=j9#;^cxx~j%^zWxkeaKjk1
z(YOqhb*xFfGHi{Ev40Y6p)i-+nXgFKeQ1b(0|&*8;T*%Q1?CM{9#+VyJx>3z02^RV
zC`)&ur}c@_5=Y7SVwwcMoCBk=7K^h0&U#rO0G~tIwfwd8z&(FdUwYM>ADL{P`hupV
z%ZuTfU^LQF2&*P7gRZ7dprXZt5AMYk7i{6`i_ZYlWR9mTUldni+(Bgs_RJI*RxoQL
zZ}p|uD*><ak?Qv=OP;#zQ|LgtQ+#9W@MeWXC^w);QybE-vP}w%vwV<Jv@%>2K9HC#
zBc|LXD=fZ-u~IUgaZ`<}udac{Vy!B0cn@&dg%)4@;wk?1cWvUeubg3zafyABQ$zQa
zq_C4Iib-@;80(S*<cM^KR#;}<;z}n25|aItEOCYSwt#6EL%2+WRqK4v3Xb+ls1|aa
zrl<c0tGRck`xF{hH7TqiQxf9W&KPB_AOc#TXc<drvCIvswgokM5M@f)sAQ@E68`R7
zOA|6OpmBW(z9?^Nt{nsD?C=o2ck&qoFFMrV`7fU1>ML6eO5o6e78jr2;L1zq_?EBP
z#P@ysI-c{i2?pB?Zmh8OS+5yczx04~NiOxRXFaQ7>dc*gSxMl=!XDWK3O_!E1t0Px
zW`ONsg};91<+%6s5T>w5Tbm_<MBUa>!cE$?foV36uC6Zq$;rn*a~z9u*2)3__#Dc{
z-c^9U7C-v?e|+!1dd(O9w^QrKt~7&{OH8$rjt16zQI}{2g+*#%3X6@p#Q*q<t8wGy
zCvoX;%jGK%MvSn~5uapte0jm(2Tp=lhAv4^V+HJnD73goC@ZN&-qII7Y-xLFgO-)0
z8xMQwvwX#ozVUlxU_Aoe*B_Z&<m+Nwqve(kyGf>?ADz}>t(@ak&#v*Zn+t4>3$zwk
zSp^2hV$fL7*xy`GYF8*7As#AD))l7@;yzLch7?-q<QRBsKRwSRm_4OA?<fz_dX^W&
zQPW|>lU%YwP>QGIz42x#jKzGBRP;i-69lg9y=)-UbU{{|cdqAjX4ThpnbY%G9*X?^
zfrbh27Os@0NlD6M6Xgm>^O@?BHz&7LR|x<EybT<zT72crn|Sr}w_yuE-z{U<Sd?=H
z)-BjFs1<Y|JKYiF9FO4zk=_pKIveLkAvq9%zH&VUI*^Lh)VY$VGI74u;XVM!FwRU1
zoH$d!7%N(*C?(Bf_IyGB83eRufdHKKve*Uixs>zo0$w!5>#knmi?6=!ovSO=Z?}`9
z+sp!vRvV1nW62W`n3-PT)o_N}A6mojy!k2~uNV$l%;eeH!77M*oS9tex4MSC|Aaqa
zC?%;;3W&NW8kNJEeL;Luz-5+55=^9ntpdy+g$29zS)?fE7S4i?{{S@Bou=1_>y3kl
z(ZE^jHG^vFVA9%ML(SmYf@^?lcJSqlL0c9}TMZ8K9EZ&uYm+&K+YM-Jfz~=yA)pL#
zAG6%0fXLicLYFuQNNI5uGeydH7we%kZxjZz4=xCGClfACXM|#*ghO|~KJ|W1xfrtP
z^+JLvG4H4okwBm#BBXuZsh$jemTeIIA$hG&@b?HlNxgCS^oaMqHqop8)zy_Lem&wx
z3jeeYNvE+0?tnnYEnE;|>*;o8L7Oc`8*?n5uCaWg#mb2m<*63f5;R}4qJL_#@0J}>
zW}(+ei@3HNYGzYffT)awe?5aLN0;IF$fQO*08P%3RA`BDYP-VGGbN1YOH#&5d_mbD
zQWpr+z?fBK)tkF=QJ%cAPyjxc@}WNl-u5d1*62NNdBb?m?!CWN^7QS^<WxHQCvi<k
zzbcELVn#H$ElvyoOLP4BdoQIA-hBaKS1@h_9_evC_eWSFm4Q9Ih4zs%K<U#2vRKS<
zs}j=oI#DRw>LxSyrF(#ITrr97olJnaH6H}N6#O<9?%|&WwN@}aoBp-dZ2@fk_4vF^
zN<$5o5GFEGpSOR`z^rwd;^zLlXPVrw%bwG+W10$f?Nj8qN0;*R>jiumzp$OG*Q8O5
zH_J63epf#A@T$zf4)@AH&|WJ%2rfO{>Xm^&)&B8->_p{{B4Ut8$G<mMJcD@76ip5{
ziwu#ywjV#y1qm}hK?%QGtvJX&sm%|5-jc9$ol+`>+?p5Yxq%n_oaidhu@vmJ1=T)z
zQBYv#Lg`h1EyybZVO@mJ)WZMupIgzMpv+pg-l%no0f{)9*e^j3@iRFEAk25~6j*>t
z#@4jN$?Ym4ATjN5@7#&86k32E?^!h*EEIsVTox{X&#9c}|86n>eERnP{pe-ayyQ1d
zoIG)TTa2zKhbuvXklH4v(fcUOgZ08hFvjBO1o+iIz6w|VtCP53G-1pcAP{+`OXQ({
z4sY;fP{2NV2DCbY*}v?Viz-g@k83gnQByz@Li@BimfVDyphu>l02#!MC`@Ctmi5<c
zuvj=UDV1tf?fXY!#L=C=i2=vA`%g0aopEDK;m{obZi|KIY2jo(<009AbQ<B~40Z1$
zWVrJ|2t+^8xwX!o1yZ~el`8<zADyxb1~|XRuf$z}pJPn2#Napoo-l`*lc?jnjY04v
zgul31woJBFsWn33iIW$`LcTXwB9ynIN5SbdT>qA`*L82F)QIRVNCe{V5p>Bwip&q&
zSDh9gg>Cw71+v76p5<65`q3FBItX44xrp6%FlqHsp!>K^IUcG6O7Sj9k+kmF=(6&^
zPa1GxTzzs}DK(!ei}|d?w5@>QG>#X0ZV>pCXJSI{kaOgeZvc~OP%adJvs@Mkz~@x7
ztwKb6!TFcJYh`5qXS;oL%+|)FBTD!yXjil5U^!YCR7*2_@ZR0{(|2BmW)~9~$|MCu
zU|@Oy6`qOTe*!#hQfO!70v)in=Wkq>?9z1VqiCTRf9OYMC1<(HDd3ROg7?-oSq8Q4
z8n^x)Y4Q8}qJ<yt;q<$-l&l3cHd#pCRe<oXVW4g`vf%$wgl<Dy1tS*&kPbIO;*}lF
zEXFkR&1x$@jHJ?Jl65RZl6#BxZYM}v5`?@a|A{Sao#rNFCkfqT@sfCk^Y^K3WZs8N
z6cH-+c^IURy59$#XeebQ?9yj+h>*UXCF@s%sgm5~zz8X|Rrps}(6Wc!<F-5`p>6{$
z3R-Gd(4oIxTY*YB1b`yq)%yE5(Y{0hnl@dF>m#hAY~3_seMm%0Ce*U|fCP7jP*xiY
zp4KitM$)J<5C|xMcJ6j&u+f_#N&GLc28zdnlbU;G2HSRXSPf@bl(SkE3c&widCxn3
zdv@T^xo;d4%{%5>Czx|iFL)D6PAcHGcpnJOsKM|3-DUXDXAXc?TXjzq4oOn`#l@fj
zfoF5rhfV>;2=9YnxaetDey(_M<O!Hi%ag!JNPG_q8Ij2_JHgIExRQkZ<8R>_lsiDh
z0*LPv>haIB6^yWDr5td>8j=ll`M3ehIem`I6B?~ht`0FCNaGuk0%WOIgr(OjqoS-K
zm5)Z*`SF!nawmbd!}*F*KKlQssm@#r;hmAs?*RKom^bxP<<SW*h$JCh4&lJ6WMKz&
znmR8cHFjMRP6DKZ9;rdl)v~%M-tz?iI_{2;kHSO$)L5@<x_?pF`+tF6DZu%;`^wXQ
zg7x8D3GlQFN56qS1FeU5w4xo-g%I9nQ@evA5RMTE>z4#g6R|r4Xx?-cHvccCx;BJn
zT)-H>1Z7WPfl2q}$gA{RrC(cXXT~fLfU{i|3c%-~+;Q7qKe)EK^2;<obAK}%12JK4
zmo*0-sQ9^e2UsSUvc+TL0>AYaSK$N?U`h*_LYBipB7vy}pBo4m81V58*yCH^L7|u@
zAmDg}MliI4Hd*h|e2SJ|pF>&*{RDMp7D}55^cJ3hAztTb^(TcP!K&i3tXqC>Q(X#e
zi1i0XDwF_WRpkL!2+T9SCkeH#&pL9(3{1}?kh<DMWrUj7eIoO#CmQk+lu17q=_?a*
zd3^$4>dL=x__2OAkP*e8R7n$FS;^0{4_PERwJR#i9U;%rU6PNH`^X6h=s$~D3{ytm
zIsJR#E>q`rR;{FQYoX&;;OUDaeQ{%x;wvroJZLWj3|a_fIs2z*kmEC*SQ<~?EY@03
zkVzb7#oR{^X<V5Ap0<wurETC9RY^Bo5GI?0$bVE2V5A=;cYv6ts1SG`Slik$Xi#HO
z&T3gG0H23KM11g^i{3jN&>PzA<D1sDp0{zf$izMXP9SUeh2XSvGpO;-I}YP*AG{ED
z#R;z<t0VFnWs5vl3=WQa;G}@?veh292yq|Bcefz3%<?_S0_smzgs_aPO}{IKCZSG$
zpLMPR@<N@%AwVK{kXr~#Uou7LKrD5Sa|;A_gH%QwLv)|Hu^u7F6arsg$T1)VbCMMd
z6-3Dyms3-(pO-Wt@OAyD$hV&alvW1%kcD{3Pb3p3I5^C0xFI{mE#u%l4GuzHB=^bh
zjR6eW3lf(D_f#x>5S*hBtm{<|iGIcHlmb(T^Az-@Y_1~B3*wKrXgUo0`=hY;0+uZc
zYusvjmq=Ck`~(UuTXzoyI%Q6~Rob3=1&W~Gi?n`Zd_q**IUXt+w}FNUoz&^v1VO*?
zuqgkhHH1@JBcubwNNo1d?xDaBLky3+kBEpZk5>j}p#YravQPm2&kF&d+ur*JlXDLr
z`u$Ncc}Kl{%<3p|8-*m`n2pXVmo#O70K?cMi{E<NmAHFz7ig5;<br&H8RcMIYodV#
zstkBO=k~#q;1YuSx;H1oCrWZ5)RAfY$gT;&?{5l9j<aGQB9I}NC$z6W2>;+?mA=-%
z5aV}fYe#I`qn5$eTU(aFY$Jn-TlX>s$gy2EwJ#_JLP254Y?-yoL-sz;C7<O~&gElY
z?pAr^tNO`g7O9k?9G(n$7^P*~4HT3WDbXw44xWiCxlDn1XG%(}NXH524hL9RqD`#s
zQz<S)-iVMDF``>xoW&UsAx@=Rgpe1=mdYTULt~vV4%XFqnpVOzTJb?S;OOd-3T;G?
zWV@`OQ5JD0@fJ!7v|NY5lJ6+PoFNPx-vhrcD14W5PjX)TIBd^TO8;IE%k{Nx2@joI
zaa|MS5$BKPgUOBJx-96G2~FEfD$EuxfU{f{3c%;FeEh?I^XT$Y^=p`(e89N^OoS<!
zkhaPIkla2c>q!5qVU15bv>Si;x0hqS%pOrq$L*@4TXTzNU<fC+fN*M{XVTI7N{>?H
z{Gm<4!V`*uZZ8KX2Qq8MCZ^{FDoG0`Fs!H`AXzh+Rm4FF5W!bYPq1JPR=r@HasZ^|
z=068CAhi#j_i=Dnv_T25qRo;)_gJv00ctE+UhZ?&d#fm@3%y3JsyDxubU1Y_+$gN^
zj*t!?2{EcX2JHFviUiK-dU%q0x+Km0&X}M_pya1evbrx>r(uL_79`l|QleF_xFlde
zRT>C6o610U=(?XIniX9~Hg3n0>wvBG!GoG6$<r<i`j_Yg<$Ly{{gChNM^Y@<DZdbk
z2U_1Yp@hd^#!!(^Y~u1}c3S|W3#OwPMS7{(;K371Xr=ecLkFF$t$}33zhHwfTUfSj
zL8tTWON;U(mxTiGc`QW4mp<*<_pPli{c$@vF=ez4l7~h(WAO_`S=;^(8Gx7O_=|tI
z5FfdJA83W+Z^;nl#5m$R{OT$I`_O5(2i_Rycm!b;#qaWCt`G$Eo*>nD7DAS+6v}W6
zC-^Is;7|TY3J|+Y`5XU<-@{g+JPMmq7?E=agt~=KHwHfO&I*UxVbK3CFy}m%LOLFq
zJCiJfrXz>Um8!rr<va)>ONcm2k2SA_Ww%JnHd)STYQ-t{JIL#PjUf?hIx0Ae71$w;
zuxHJv_s97}KmjrZCZGUu?kSRGl2_@1OMWD=H#vFzjf{$NK$;j@VT{l|^v)5vYeWcG
zVo#e=ct^!RIPg3qAAve6TB{=Yk=`ZRDci>Z-uLS(B)1~b9vQ$JU)osktOc8-A1Qj~
z^ra=j$*ln_tB%LIQpQk6Cn=S7iU$dEQyAj4QMnVDEXtEq77D=sd6A-<-u<@Uovf^^
z{*S_r-%*cG1E7pWcJSZi4~qd=?#`-WJi0x?8~*ZIoT3U`2#Y8@EaB0RX^jX}5_mF4
zdt@D4nkNt#fpc=kyrl5(UCg55B|}lxL=c*-ur>sQ&%tUD@M!RN#&^WmdV%i!i#ZG*
z??Yn1ny<<Fq;(a(TVc6CD+LXbuhk|?J#$y5d607xgtg!9$Z{XJoc=ifIT2_pH)#>_
z#RMV3^|bazvWX^A-#yxMt7s#$xO?jjEIwxZBSk_i71g{x>7Gz7f%GGZX<|9vp+6mk
zHtgNEfNdih)sa_yBfx3NaG=c=G4W1PB*pNkxEQZ+<p@=*T&%BP2`i;A4w@L<;Brff
zZf?cHk_Zw+H()kw`IG2SsGSHrZ(Ur05j=yFt0|2Up=}GyX9d_Wv&>GW)`3G_R75~j
z*3$M=BI5b^hp;GTw=5KZC!yT)$#*`uy0-E^czW_-ThBmbG8WM5ScCNG20vLbYVeMa
zpNqG?{{rwXhCH;^eb8owiPs3I2>jR?;Pe=%DBUL+WzN7dG(cO@HZq$I94Q!4u-rpH
zlV(1iskNdxA`T$E3rN2Ftc{)TLSd1@Ls~B?5X!$d_;BN~tKt2u5Q|Qr96V|v6Y)rE
zDe%_;0n5OAU{IF^yhOmz_&^S~^i*0@!8rB#@3JtYXqCG*6+7><rTX;0?8#_F_auMX
z(ToqH;FINqKs)a4Mf4=c3eAuzL=v9jyB}Yr`*O%tAsi^AV<DIbR2kSMgK<IFC<wD5
zfkp+G3Xde@ZUO&v7Q7Ln=|j}M5~|7)*9vCno6<d{;@nw-@VhI#Vl0Oyn`r4Si0G6+
zw<x;2tXOY>@MV8}XAOZTjZ>D8yd#Qm!tRcOQP&1dU4RNESVMr=`6SjtA3#NdNSQ6e
zRPELyPkTZNTa?d#S!4qIycX{@BjTq&@2lTlPwxHw>DIA-J=}BQ(48=v>_u6kRVkKR
zuyDw<*e(gb_13HL>>H2a%H>U95+t3lNEtEKARZ862xu+Zhfbp0b*|eL(E6J>J(FIY
zS`xlXnHG3O^!<aJRVM^_uv#LlFX8>boFt=5V<#fjoq$OF^6e5vlS-rm=Sq?L++!z#
zkd}-{-6JerhO5WAcan!_Ndy6MHV#ls(!Zf3*a6{zqXr+lV~Edura)^6S6<QLnrj+7
z?IMe+_Q&^Xxzlx@!;h0B8q0Fhp%3N}{mCH#c|gn#DyjTQBIK+t=yyrl$eYh9@GcBJ
zsb-3fLY%9tE~_b%gQh%NLiiiNt`vCqXoXupQsI5KRCw%^!PQqZc<GB8JmZ=Md#V<g
zHVDv6hkU}jqtcrxslf*?6vU3=#iE_8uPeHdOHb-viZH?&16+R4IQ(LcI3WV?;~8Q*
zB#ozf(#ygb0GZHMr(%ZnRx&nc1?KY-MXATnWsD5GKvtF<T4{T!3wJCA1N&n8O#CGl
z<!qM4allVbp~oNjRDI~8>yA#x>(62o7Z%lWl4bEO`7x;g;Z(kG+MOv|96!B^5dqJ;
z>2VY@M2?#$`wI>Scf70163F8kFa^w>CFie<TLyX>k};|9Gv(JKVt{1vsKa$^bO-eN
zK4pDUvSyYa5XV8LGbY6`k*pIW3p8>rk|QhyIK`B~j!6nv3Q>%NW}i-&eDG5@piYbf
z5$e$ZfA_u$Km3!s@VkGqh7a66z-_mec-uQx@b34FP!27wzP3fhHn{~TlZYgg#at4L
zT_8I``7-Vx6EJGbSd)U5U)e*MFbda59StmRkiuVRZ@n=KeWqexy%NTd0>+<w$!@Od
zA>r+}Ea69gY7M{pr>nT*-XZRLxWLEm7~t>TIl|+Q6Ry3s!Jd`YCGSx&3>+2K&Q`q~
zQqSF0p{v&0!<1c*aUHo5vy(qY(1e=%K&2_Yue&Fk$v__k1g(?)jnZ%Y_$JUaE=_hu
zPm<Zt6652?cjHa(xD?Yu(yew!rhZ5oG${y>h}!vt2Sxk$e|gIfzZ;8kR?9*Gcrwam
zAe?4;<+s)+Pu%x$%*I<UqQUMZB0t>HWgJ+72x@beWzGP=g7Mg+Yk203M{(Ys2{1K&
zi&nq7PLkUafXz9~zGb&7pmnB7$UUG<2uLP_u4u>@mGG&Pl}r=S5+TcxcWECm^(X_~
zwouP|W9v95N~xWsm}+nucWViX1*@_0<7JW}0FT&HI2)bdVSGSa-T)5_-utm3e(1+n
z@aacNl%p1=0!+o=f^qze!G}In;haM)uDz;(X{~Nm2EUV^e?1+&5;V$K9ot6gPtO1<
zYSA*Ey3h0p=|0&Hbge(`ueW1h_B|`sgCY>h=$r}di14?!RQREv*n_(sDNwFh6az*z
zWKd;MTf)abQR4I&!n2=OW4UONPOn51<{{BhQf{qsam5@FQYVS4y03$3;8mY{l(ilW
z*Y}sjnh@tZL`^-X6(T{;NJJ87&C@e8!yehtb@*{5Q5Q2{RvGVm-~itIo(n<4CXGKO
z7bXb>Fd#@BMUwzK-?l4D=I=L8-Txje%2_Ro7=S0C?7Q&A*#ENE(4YMDKWh&jIRCFk
z1N==hJ{~|hQS{<Sm-X?w%s^4h@z6$vKYsI7*e=VsM;v*58Kevbj4`0LLHp2YC%B6A
zUiUAnOZs4gg%RMx_#g|PI;CqO&`aeF>7W2Y_(y1xRaXLvk@_VP4oPSgp4qUs0()U$
zDOA%>F&zRjJ}ng!|89;g2+v6C4?qDN-74@aZ&=3tM+*#>IKZ6#yc5P?WU<v6{P*8p
z#>ej}fuVRlo698IcCZd3N+5(G?NFWUyAoKM7CLB8XB>C9Mo5WxLd_)UB?C=lHJuNA
zuyLB_)Nbh}B1cn0#wYJ5{L-)O!eeI$!{ro@Vtp_tnHJS5<1gO6gg^h=Wwe8$Z}<~L
zFHtM?mqkl-vL)3y&Mx!~W#7V$A955XWzkFT%oTI!c3N=IBz3}SKO+SJvj#kG<2`D!
zG9{gcz^UyeOj-j$fw4W(=udCenIpxV+R<Qf65#)hvQPk?gmU3@iVG)a7}!l8`M{qa
z+r4N1@7a3&!Dc=N8Iej=Nf^Dt+}aIrzFSenQjNFWdLeGT`ykBT0Oe;^wUD-9#{h%D
zl>wjHhCR6jl;P+*)~^n5WnZ9OXju@{QHWE59R(7u_HV21340~^En<;Iin0cKi<WjI
ztwCfTr6tm-CgXIB6rd$v(7Q=LSXTg-1wQtP3LpRE0Hal5jr)i%^8czqi@P5#@zcMu
zh6hd?a0PH&ibAM&g+ZoxJVBo_;nb-qj9J#jCmtg_;Z2;u&(RMoawltrll0v34ljr_
zn8Dg=f*Dw1JhEBg=YMS%Zojv}U?~L&3PacF7sg`FjJN;qWt^HAP_cuO)k&R8J>$hX
z)`7#S%etsgmo$GG)rr69r_@?xzqESjBA^v4vRJxgKqP<5*CY&qw`MMw(By3rnw)>m
zmW=th0?M?tlBMF{zf1HjD7A9Kiwmf1>vB+yu_$M~EEIqzq1^t#5Anx7a0>(L3;^ex
zbNGGB!}8CX@rgMzs}vce76=fn+~7)shk;>WO5jAx_`Sb*8cy;MsNDTpVrHs(c#k2M
z8{pwn;92d2RuDFlxhUqUExc%@`@g~Jjtqsg5Dh$0>}|*t4!MPm<2eWEg_%GB#Yl5q
za$F@hS9FyDIB)_PvHh|8a_oaUK%%koU6cTH9uRK(!~mza2&QDP2`A)v;cpm37KSW_
zD=psjp%H%hzwg4Cw(#!|<0_|w#mN#9zL4J)M1u$oJM!u=<77er5pN*VN=NmQ(M1LF
z>B-5CyT5b(TwZY>-T6LAU63JA>M%(|#*y&=Kk*BD_-*f9!f>SphcJ2qn5_HmpRoW2
zON@_xyuc^!GN6(&0?1^bBAz~lR3KUz*>zEYO!1A%n1Jaa6z!ft&YRG;7bI+4O{iJW
z%oCQC&?Dgg$KHR(Z*pDr;rRR9nWudER_(4<t6pu{vL*L!V+_Xh&_hB90g{je_~u6-
z1Tf8^L+Cb`VjCM9H@V7|EL+v;y_a1{+v{gP^{F%W{Qj7^_nvcSKC(%Sv@6fi>!W?1
zd1h{(Q{Ly?b9rS{Ad8Ckh_c1pjctPErB-oPiEg%UZLxK?{;(={k7WzyY}{_8t7zyM
zr$zyI2I%@Pyl-{Gx=nxILjTTeuvGJ^2!_k?p&G)<ghetj!gUXvf-l^DDtNj?0b*R$
z3k_c=00yN77>vRD7mIW60r>sLvDGgM^Dv{r&LOUa2fb`B1tT*l0VKf&S$=?9W5Fc;
z^$c1@#S6;|lEEST%h1d@>Y_X<HwY<Gf*=M?HJ0wIJ;K5gVH_Q~%FYaA7w=KDr!|@5
z@+)R=`DdmvZc`~FV+)f-Z)ATEwtmS0Rmg=K6V+(wlUdYESI}g4)&Z+AW$4>N8?+lm
zOlOow{+~^*$?-f|2DKT7`W^iCAI{<vpYKq6s)(y#rC7&GT%nN7FEi#BTBTb|j1L5g
z75zy?rntqe6RK1brjdgTm9R@J;Jq6y$|9-8LcA|!dl@YD_#-Uj>a@kfS~M!NKyM66
zOjtq!y^%@;8DM#wV9$XmB;{@yr=nKh@6ZgT)=8FQxu3!;{9mq&hW;O@Q2?GHdgU9x
z=aKG2_aE~9v1R7mTYS<?;PPz@FJSqLf2R$|FnW~XeOH`|{o^T^wy=gE%Jeb9P<((=
z13t10EDwN0!p_Px4+1XA&=<^S_o%j-oS<Wl1Qu%e80vVE=zl2?Ywz<imV6$8P-o2e
z<yU^1-$Fk;FyqoVJEfz>m=19Sg`e4${TKY%TVrxQh%9>6;t$_7h0os5MK)O|d8)rg
z+%GLh&yn57(C%<tZ=H!QP4N;P@Jghc_cdG#a!;BnMk_|O_A!g+Yn1>FbyVUnbXN*6
zs(fGCz`=pR@BGO$KKhvsT9diou|Z1FsX>VtrQkO{V`p`UV(r?Ga<pzB@*ZeK&5y0y
z-(TA#QdT#|^~K9pMuu{DzA_13Cl1<e<$W?JwnGk!=>ITm0XmZzA5Fqo7_{-oo*96w
z@Sw#CvY&W3#KAY0!z!~j>*skkkA|LcY7~HHi2n9Z{zEpiVdLd3Grl(K%`<uKB%;_I
zQ}<srcFiDIOE9e*cRx9YPv5u$`HV6)<99!txaF=G0Gz|_TPVblDa)_%gL}1t1j7Xa
zLg59GQ#Q(71rncC$hj;Jf^o%6wg%OZmss>kSnuwFk{Paj1}O3|k=pv_$6Ah?xbBTe
zQ=OmCFL<uKejTA*?iNre1?1<V0LwtDo#EID<JW#?2A{dHi>#Yy@hdAJ-8gwHv?2ux
zM9`40ULZdd3oKc;C|kK7YOYsXqWfG#bw<BQ#WAd<Liv<ROMnynxONx^`Ub!GhwJdc
zPfUWkd9n6<o|{N0s*i<cl_rd|U9Qdu_3^8z)Diq{kcz;Iv=lMMN_eY92DOgrnkmZ;
zx|v3N)X+O*L(NUix)quZF+j$ES4Ksi12G0(bjvl!08*eoZsF)k2S{wV?u!-cgGv2c
zK?v9)x3=FK_8SG@S)fJ%c&4cHqx8#nd}{ynROg*MIJ!3<jfi1<IvYo8Y5s1vFO`gR
zoG?Co)mhlNG7U_WZ@(0PB}B~1YAc0Cl7JTn;3F%=wm?K_{X{|^=h{?41M+8r@+~@n
z>Jr|;JzKWkmFL^L1~%!0Tby1`j17B%7|geD6sZ92J>QiQzfzs9!l1AY9pfhere@2e
zgGHG^S&mDeKg5RF5tylXxfEV3m>>m3s5N16XaRWpZ_eUV*GwXtprURiAl&!{h*&ly
zfUu!W;TRvONb2R~)>!a23%pkH^*XbD4M-={8|Kchb3do<uO`i6?EAJ_Q)2^QlCW<z
z#c%xKEI$0{4$MRjW1Lb`Mb`aWBm}q3fYUcJPCI2(<^l*xhB%Y3@QWJ&hJupd+9B4q
zTYo{fl<QCoBu8x%?<vbUsLZikPw^DE#T6@?LTNG-6aha=<$ueA;`|Yk^H(mpa^01#
z3+9%^a3v}7Q6&s^CuLH(29@#R6c{<K2uT<%!&*C9UR_;AL(e!h3cxc(-?)l@`~5$K
ztvk-XVY0)Y9IqbEP}<Fs;d(*k_;ATAeR@?CkaXJ3@bLZ_eBw(xFq#51MvoAjFH^;O
z>!A=Zyl)Xa92c<xmAt+sIf<g=F#CVyNp4O#kyeMyI|5a*QwXF99w7!284>LY+si~-
zeVsvY2IZ<4T**%L5w_tOAN1!0e?mbKKwPGVt0`k#bbf}}8H@2q$OS?OI1~cbRco2i
zn#gf@+2B`yXBHp&%oJ9QDP1($8Y?Oa<1V+0duAS?6lzO3$-=_;%6^d?^9UFcQ&&97
zVhE$ThG=gs#jv&zz?C}11lca({wG@a<zJt}$FG<~Ynow9F4nmiF&CeqRP92TjYotF
zFC63iGjrGx*EC2dVTOtwJP8%?GcH&z3GahU9Od-V+Qd;V2fll^-L!a_8{5f3eNbtV
zSvA$Y2TFHPZE*L8_ZJ30p2PM=Mc?4MO+k>mcfC-s$fm%-1Cy{Byh2~92L8QO-*p4U
z#1;=5L)m!LAEKdWoEin-nW6)a0Xwh5?bm!@ac<p)_ouwLGas&$rZR##h_z5aVcC>$
zscmQY#I<K*=dmfE!w^BvLfi@K9Aa;ILg3LDcAq#bNbnuct5{f-Lg-M1S+e(&vmvj5
zaDplf8J{&CI$0JMLATCmsk7XncM>QF)cNm$3iI;{Qkf(rFm?o?pFm_#6MwbxjDRt4
z%DN1%dHERGNE&*qjat!nH=@=8txk?3J;HDN;d=bhyJoPjmjLZ3NHglYPV1`&ha#b;
zTmWJ$WSg8Sp%hb=C5v{*08(FtUKe3IqqOj&vZU<Qz=2-FhB0U}KJ}#u{Om8T$7gSx
zL~E)L<{UxHLS58aifCh-2$#Ji!(>{XWC>vxM*>?WghGOHtw_aH2M0PK=+<StgH#Pk
zozjHp9adA!@Q^|E$jQnY3-281b&Rr|y$l%TWjsVQpAx+*6?U5f5AUAg-jEP2DBrZ8
zS69&r=OQeQCCJe2wDQTBsT>VG<J2es&lKHp7vqlm831;ie&Jn{lbsLb{bK`{Qy;9E
zgtU~sogiK)W*}{k@%WKReCnDrFzl+FekgL-Lls!zGc5x?vI4s_ER=xqIT^&~L)Qd!
zTKrbFhoox)p%Tv^A^fK`mcH8fADMm5XjRVyOFvkg0v#zIRDN3Fe(<gdQKnP`kWjI`
zG7Xl0yv0dnpOfunV5XJhO|Ktgs#PTaQ947N5P(ytig9hVa;)SQ@A|+De(@da@!*~g
z>_jPi>K4e;8P^r48CodRB=-@hv_dcf@+{^-q6al)sYrIztiQEuS4s^7;0|zPZ1C>)
zPvRGUV-EK}*+P3NFJB$1)Isc0&&cA-5K$uJV}niWb9}>VM@X~W*I#L)cmJSVAJB@S
zzh2Cd3>2**V(@T!SVwXV>iN;FDOCw6StX(*H8t5@ue^wNQNlEd0k4k0-aX=YjN~Oc
z8z&pW&Vw^F$XkBwWwJqt_fXDkh>;BaCghl$?2b;^x_yn6+|a)yH44BpN9C%216_T^
zUk+wx*MBI%@b+x50xFN*RIj^aYR=~<4J{OVXl;9lPh594b{?7ob*-{0LJ`j7g?O1!
z=KE&YJ;xC=gvcZ-IA*;7bd1ME$P2iUN{-<E4S#??^hF7OH$qg_N7DEZ_i?oyvY!xE
zf7vHe*NXed<@$F_-Tm95B2kj}!PhA$j-&}!j>8am#br4zd%+mPemM^1m{)@WOJ&R3
ziDjDABu6rl;mYe<_^&^|4j=sV6qcC44h^Vn2UoswWqfLuWbFA77P5>F)XD^dxIC9q
zN-h$RZ?qFa&X86{Vv|2C2(|_6oOgk{cD3+}@0i2y|K%JOM?kA<L+A?JR#TyFkuYF|
z;_8-7)(77Fh7ry=Ed!59EHp9aO87${L*-vepu|*_0f#C%DBOhQu9Q)fNp}#fF>>#S
zcc^2{<Dq4YPyDWUL<_-<Mb$rE9u)`p#MZhfpG)+F43M+IO1}fN8Q#UnVJ>tjTzP%m
zTrmu@wcKsB=eL})rO5>NEKs8WJmYi?1Hfy);aeV`n4EZ@9UNP*`M419buT%jt6MVF
z;%MNclVR7<4lcj>Ol0d&!|a0)a6Y+GrWZV;Wq_qV?9mmVWn!BtSS_(-rrv6j)%eqH
z0NX$$znwpwJ!35YHKvTp7Y)%IJL-q@b-Ie2#Um{IxZRPlsw^h&t|-eanIwA#4x!Lc
zgjB?1AuKNoY@8V3yT5G}T>y5><tfUnnYHg$)$i;^yFHcR!M%iE{+${8((laTuBY0_
zCsS~XLY*dzy$?o|Lbb9U^!$=+zx!RrQN&hjTvj;`a+e6?{Q@Lmk6cGqFqt4UO{oYG
zfhGyZ33%TX6ZqL*TF;-lW)gYFB54&#eVFvRWZf&jmOWZdfPuw$NH}$Uj_>)F6-?4d
z^&^xZ#GzLNS*+jE;&*GiqU5^uAFW%p9;vGS=ynLTHEyHJx+mtpPT5W&wj4*fED{6G
za-cUVlo_}kJf&O3mFe($FgO7gdMzw3BxrZW3RzUTA_L*5YF57kZrd(Xo@X|**^y3X
z-53o$<J24m^eoYxH+_z`pLNNB{?h!5GfvJ;I#Ukd12g%k*%(=u*FX$I02_-VhiCYe
zmmZ@nll{`72}q&)Y#b2awmQi|SI3|YQ-GmDvvAsfo%QbxE!R$&@vB5DO5Mf9zQxA0
zVy=MxfgI-}(#%sx^cX>q!d#&cx?*>YC3Kq@Z_%lL1+=RMOb$r=xx9VTHpboerFe2*
z3rXq(kUR@6a#MI>B^Z(xkP&d-!yUfq%Uv3i!S*w9Oiz_ZF2~SO#jz{^U3I`ju#_uv
zE9Fkut*VN3N4okSDXLpp_-l-pAJcM7N})j=La&wL#{0VXqraTQ-+gd~kE|NBCvz%}
zwWZ1eBFICa$}YybRjEYheS;tQ-X6aDoBL=D%Y%U2yW;X%tO-a{fO6t>6<OgisK8X5
zz(vlyuDsY{J;X0d`~sP>PHE{&i$9ImvC$_2f*9?DcxedC_dspY;IghT3`L@920&fL
z1IK3Y51%~;JyV7H<-97MP$33^cr;iXCm4L<<uCu{>u>+^$C@~RXP6oV;8~>q{*HIA
z-hIm#&0sKiqiM}`jdA&4qt~X&)5UFsB(<17-l18O;}tJH4AbZG<*PdW3!WU50-&_S
zhdIE2*)U1v$u&^IMKU4J-K$onh-ECk`ea0+J<j)Dc8-KU-$A1wq8PFakT%t86-p2h
zLfz1eQoy*BQUUo(;h&a>fV8Ycy%mK>4lWf!Y<h-(7I57S6Uac`$n}<+niJuzrns<T
zep(%-`DKF}Z)x*g_q4&Sgf^X;VQMNb&V|Z32(P$J5T`y;y+9^;Av)wo-(QYx{EQ@N
zz&b@|O(OUJ$F{*RCEWXD8-M=y)A*Bj&fu;`+Dx6Cl9b81$jw+AMi~bn`x3=4P`S>>
z{R9`EJI4R`nPqI5$cu5)Lsg?W#8sAKY4m#(3v2JH_ty%|futg--m6%#h}>PVk}O>n
zN(m5aSh+34^9F=8fjzJUjK(4<Sn-~bn@A_f%Rx1h7PmdQ86W)8SwJ@zaH1Tgpwz{y
z#H~R$N8|qd7`FeR8?XF}JJ8TGPK^TaEYj7V{5wADf|nfYEiJxioG0fc?I|G03CBLA
zEYLp!?haVPIC^jjufFUEwoDJeBlvBA06arv^{gwQU?#je0%j*bowP{8;@{y=hI&e8
zyU_*KC=V2RS3ahsz6$nZf33XFC*q-Ct%<}kEECB1_yg1gYLU14DK$d)qwxQ`z&~|-
zs<w)BU#kiL5y3EU+8Gv4?oRN)BPr4e_C9rm+6Gn|3MdEO_Yp;udzu2AGVR`%&^6a~
zaL;`m<SAp_W{a6=3v&ChV+)nz_C|BVu~I^n|JS)H)?)Nf-$*>+tn^YH;bLy6!&qj6
zd!KCM-Tyd=KYrINuDhj;Apxy!PNDYdTBB(E{ZftQs>q~Gm<Hh&{@W5>b;$@cEVJ0z
zsLhea669N{opM>LcXd&K`h91~N4v)e78x-*2L22H63@cO@BTW&lt4aFK)k%mih}iD
zu5}W@tR5LdagA+p{I8FN0ia<Nr?i*vBpcW%#trxEz|{|If$3zj!{Yzt>J{VY@|fsO
zG1<Z5xRvmS2g~~(Kts<sH44D9On>mcD_3s#+~rBX-+LXkXC{dfw+TsGSsdOSnd`1Z
z6*(c${Ng0$rYv51$zhltV7&j%JttmJXCal&Qz9zzfsb;SO_O?ek#b2Ge_aO?2&NVZ
zdl~!`Zh~iY(!z!ciV_S{SWPk+i?{4!LG7+56nwT)0Z0kdBCv!?MWB?bLv<=NKYS2v
zbN5=H+XA-k$Z^}PEgV}kNK!W!9L5F$MwMkrb5{A*fixwsVLZ7n#WmMX;HFzAFyBis
zdy2)xETi2L4srKy9Q|EWRXx?+BtLWXnbcfUd|xSmC}m`A!qGv3Yi{l0uiiI}KY8~o
zZoIRDr4ggub=s11i3tfS*PSbw+-Q;zHhQPXa5=$ue^Vd-{)bjDG0ww#q;fo0yD9Z(
z52OU4928L*ZSSr#L|lLv6BCqR6(A`0?5p>}4IG8o8J~|ptZlcRQxyM-m<08%wG8a?
z2spM{!~r=)Qz?foaTj|9Vs*mc{hvP@5AB};wR41wJ}TS~(QxUd?E1=<X|&v*o|^vf
z^86Eze5IAx(AS<C1>jkwkJ889^Ge=v&ZUR@tBaS6GCn_PPep;5GT2NoV+Z3y#P1Vu
z_|P<7|FZqq&>4cpT)y+=OBu!RAsEnsQT0ZkZVJq{OL&xO<%VLJv872Q3Jn&HS4JYs
z-<K+am6RYMQe4*?DSl7CR0axWRwQjfV2q{UClf4wN>CgF>n$Ym!r$*|kWxTPebGie
zHbvJN$QWC<=9rnYxZ%rP<U}x3TEVek<=Bd@v8sv6;DzG%v|R*c9XyuchTA&0=K2Xd
zyema!2(1~y^roWUCMlPZv?@*6L4PWw6gcva^k=U|y19X#OR3bk@=^v`1nv^Jn_wYN
zardqkK7CymfAr2dy#J$9xbu+~Mg*iCTV$m34GB3gRgkC{CXW(D^I%}%0vN}`6fZk3
z!!Q5$<Jdks28~#(M?`u|HGna^hr#_7EpxSWHF_l1HG+aF)>x3aV(nMrT&PgMWuTuE
z{yuMoRCdK&E4LYdmH`g0fCr=Uc<|6+BH=D_+x!dzhOyX6@y^RH#Nm~s490ZBLh%%+
zT>%w05COzFXuN!6!}_@o9X<HylW6D}r}Wuwz}Gij3;_7Rt(PDA)^lI|q0!3XtHB#K
z5v4xFN(mrG9R6`El9`dTGdy*yi_cuQ13&%k4+4V{V?~J?c!nkHGU2o*18_pH`<IZc
z?-nq5?mhKh$k)e5iAZ>7p%DYNfGUXzoCwD1K5_|V+LGCLhRkIOSoW~CxA(kk6obMP
z1c$PwN@bwD#%_CGiZV$NwC@y97Nzf(*t;AUV|n_42#F{z`=~OQ0ppwAG{T(^4Dp_S
znnXIqND$<`I|kX0Aq#6#hFX-Ca2U9dDmm>~FbGc_HF)ZZNnC!#BrZ79;(5;-<Fzjv
z;sr0r`IL1zt)H?$mV?J7>I19Cyt35d=<V=h042z4mMq4IsZg#=o6xrghZhM44yE|w
z4Q<?a{{-%P(BSwAAuHk=(4Hy^wPobEg7Vi0$W!qhfOeU?h;|UhqXgUL2><n`mT=Cg
z8Q^lxNu|r{K|&*lPZM;IzGe4D6_jx4Mi6U(IJgG5OqXkmT?AA<@1B7zmyB01<SayO
zgk0NV{Stz*O9<(U;~gDTD1w|@@Y0}6{v&!RzLr_1%e7a$FN=#4SY4ffX}Q>bQ=}ZP
zF%n9%B)EG>6ifzeEv(J<O-@f96pyVLe%a91o*D(<S)~gAfL=(%m%jYlztmfO;>OWn
z;X7KBo2xEYAmR;fyO)v>Kr6@RZ`y(HdczYqtJ4Dy9l9s(L*UyEq~lVcP-4LSG3@>o
zm>qLKE;sQ+OevVV3L{mDhGRY|uuMo1)<u&gxa3HFk2C|YGC^w9+6#$^;OnHoBnxgV
zeW4PT^;_wjzmvomivY9eNL!NHkh1Davc=zA$Kt>J*edq#H~9RQyXa2XGV+`?&lix4
zi|4CasKR1*oh!$-)dHwfwD*BM3GRM0;ZJ{lf@WuOy6kxwUigABwrv^V1sCSnx-Ca5
zvFId>mSIp1AS?AQ0I)Wkawwo{X7=t8N>B*D(hqI{j4Uu>LVrxyxiiJXk9V;1F@qa!
zOK@nujiuEToG{W(4w|rNIYG+Odn{(v>wB!EQ&=)GKL#U?Wyr<}ri{T)|HlQq@#O=U
z6<Z@>>eh37J<_^8dcXovK?rE{s2B%y%?Wvb^ad5eQ!2k=9m$;*E|*2Qo1iNEqa846
zM~4i)1p_I8j}L%R2I?kiLrBP#5Q05@4uCdr@8j!mWT_464#b%ra>oF~{Hd3vT;5(u
z;w;Z78x9WVoE<?!&k8jPzzIU{{`0>+^c~;(Z66%0F1^Nf*KaI*p27m-(p&5=laRZG
z;9v%l)))^Sn8BCs+>SHe@EDST7MxxU2u!fl-^m#@#4Q7RXa%%>0+?!-2c`HzJOs~5
zILV+v1a4rYCCfqZN`_ZnCl?gP?ucJeeu7Y`^lO**I#&P*2B<RpIVP=OQ9vREfw=U2
zmbvUA?j}!Z)OuRU*<!qN3~XNq{P&;g;mA>gyB}*8iEKoDiZ~K@4oW5Xz)tNTFa^Ud
zr8iM&RkxYOmT+X5aK+6neBzoGCd?#G-)1qlA;Z><87{dv$JyuRn4ZefPIF98GUjF(
zGm}8K!$^{{zvZ}FHW+2VYTsaKm9W$!3<iYp(BSwngGY9yc;K-Xjva5|$l(MB<_mv6
z2uM;!doqLN67Ycuppmq|DTqElB!nonG1Yzw$^tMR8+2gsGe5b6ANZD4w1-xVG--+F
zm0^x%LyEOX304{!s_WX6mc2u=3<}{d5g&&FFhDk>G<H3a-+aO?<$7^SE2@cp;MTRr
z2?K(2ydM%2v1^lH3Z7dC1-oPM=-zc$9GN0U1Hm2TDs@U6`#Fo%bw6js`3P+7%CUn7
zSL<JdhW@3gQ2?G@@(cdbmu%tZzvOM#EcFgupAS~PvpuyAY;(bWI1=0un{q-EjLc;C
z#Fx&(x4dExPVEfABZKJu)+SUCSj1df&f^@sXAyMaX3x0Pqjm79`>dFc{9Q2JLc*%k
z&k7zatsxH2d1XLuE0l&Ym4^a~Is*hsK>-j@u7?ano7L#D9~2fh`K{v7#&h5P*!p1r
z!wfGxm+|vIvy5MP#|$3X*G79X^L;D&!ol)ahOD3cV3bx^C5bi^?QrceX#t0)?P7AC
zoF|MAwP0);SADry8#ZUO62`{499y^K*tot>2GZ1tpJL8zZqVx!78Zdc#}XV_NU+>1
z5=fbpkXwUsPM|bLyKT{(DW0~rQ1EQ7mrXFFU2X(zKNjOpdOqYjbf?UTdk8=_CUn@~
zXMcPV|L%KN(H+^s(gxsNIBE^Eu)wP;p>oYb6BNNUr64R7axawqamOs=X6YVtOWlU*
zD$B?VcJgR|*TlVbFYi<SkWh>v@Gu824*+9A8w(!}LPkKB2&i=L7+{qX?B6{H)3O2G
zlkcVgMO>$f0M2MAsVq3ps68<`V$+-h@N7||0GvQ{|81W>wDpWveQIU6_=bF9W?dnx
zYyd@-Who%XQm%o3oC(y;asQrKTzlU({NT%X0f&tjdJav{<`pUuh1v$Z)Q3IRgV{6*
zjI1!2gq<XrlWd!`t`MY}w<d}X39HZDs)c<(2}DG4ye(1g29U#JM1AtN_`XQ^1MtaV
z)R@U}_x^e@hGkm{`4TB;c?Q$V@Y)v>e(~pkU;C{&>^x}DnY4<JE4W<=JaI(~ms=C8
z8X?FX@gP8+v<0LcfKX)A%dG)h#u$V{y%dL^Ft9sYU`q;cA=nU5=7yaBbc>;|hGCGQ
zOMtb7mG1;T5tqg;`?>V~;b>&lxB($3O~UVT{go?{xIk{Q+@NC<{Pe$Dz`y^2B}|Pi
zkV8zSR2>DJ#Z-)wDTSfVA03pi_~r570C~3>`+*Y>xWBi2pj_MjHAza%&I0QF7VQl2
zEaD!CM2Ic59QP3nP6>Rh2V@r1NmP1jr`U(?g!N|94EvX6aQkC(Fs+cax40*^E>J2H
z@JdRJyMT$a@!ZVB;R`Rh#O{0SN;LG$Q<Dn#1R^5h*>$sDNHDl(++PxYJV0sX{sDN1
z&-oMqf-#JqVSMZhXW`Je3u*_;$5~A7c2<5>3PP`pF1C9Y%ag*&+T*>=^0O?-)#bM{
zQCTj8Wlnl~p37n;_w9>>CM>r(C1MMo`xDXru1tSwo6m_}Ho7j^iW?dCbG*kNaL(H>
z7T!8$FJQHu3V$ExjAYf~%`ffa?Z2>q^S5Uh^%8&>rYy(B6|fW@qBzg{og!A=>tig+
zJ}JFKC^C#fzT}pWbCL6j*uoG4#sVe>41-dJX<H;6i&nSzOFKZ?VkBvaDkNc!odwGl
z$Sn{7_#y^`l)w^4U5WKg`Y+bK{QFY<H_r_^HpPGa(FOebA6mj>W{d5u0UD{kcpTmj
zxmCuW7%5sy)iT&WE1!wB{sE{t9Lue9=rx|K{m1bU!_w#P-CClnZe5nh16vC|)(53w
zXf@_SYLWS?9pKpUNgQ0704KRpE&O&ycg>~Q7UfFimO;#xDIX7dtppGM&v*Q;^oKR{
z3{s;2oM3d`3toI+YNGu~J6z}$kfqPwfwgU<NKi14c1F14v30oZ{>|Vi_y}!(avBK+
z?6%i=tE9XqHNbETdvLkT6y_vTiB$@rr?&YMM`wXU2wdR}a01vfvzS3jfsS(PUSS0(
z#;DTzisvLFc1>|iK3ovYjs=s7?bDbfI-$(uFizscR(Cob7)W~--}tg2e(P6O@bc%4
zG3vG8Hir9L`ErI8niADhw%gs}6hY<fkwz#S;KI=`kVjlp6BxyzJX~7z6^|~Lfq~kt
z*5e`WRZgv9T~Z|B{fQL<S(k@CYrlPXbeyH=BE|pr9~beH|8^O3WI<V&Qz4?NGTaMH
z*=E-0RJ4qAM}%S%=`TtV@Yluq6v2Bcd6ith(K!RvKh_O%-{nvx2D~@~_eU!8pBzk9
zuLSv`vW~(1Pj0|CPhd#A8SZrwV@Bmkq)NAT{Kh?IE%I@%x3qNp(KlT{jRNp2QKJBy
zVD#Dd|Mqxp-TKe9F}yz;E`!LF?mkk`uO_$0*PHJ!hOx?oPhNi-dT9a}X@xm~1kbdB
z9Tu1*Gk_Ms9$p5o3@iJE{e1|KH~C04D538kBhgG#cMnAZ9Lh>!|CvyY=;x~NmrPQ&
zovMQw8{J;G14^K)ktdW%YRU)PS?C%&_60jjC>b(dbIBOL`}Spg>uZJ>t+v2!k2lHi
zEB7e*|6<af5G@&`L8zrM33m>O*n`me;D<I!u1U8qM4N17ZG?$u-yYGY+MNDWnJSNd
ziFL&C9s;sqf^{9j&;QI4{=*M0V=8CxSam+Y^3r^b+DXdo6m<t7xUDK|YZP(0rlsI_
z6dyJ0b5Xd%k)WURmcDpKPKt9A03tVrP&^C@_}?kHEL1YDWJL;K`RuqwxaHvu=#6cO
zj5#FHO;SzYg;JpIV-RzWG@%i!T|`6A8Z`>QiAFzkHtjfj$77S-<O(}DK49Sk)c!hY
zVzJ_DAi!D!)5-DW2R7rb-RnS;w%Cgd1PSb|*kDB}e<Dyu@iXk+r68O&>Iv@;S8a&R
zCJqd#3_bP{_Az`JM>W@2Kt)azaip(guJT#e770;^ZGPV9lu)z!2|<9@F#3X@1v5*1
zFJl~7%#U}uSO)b*xajl|e*J$f;|ITE6*OYbMx;U%g0;$ERZ?Ve%lqY@xBf$+MYC9x
z;P4L7U2<nB1XV`v^(J+1bgeEublgfJB_jfe5|r2&jUW~{fN1P+ImJcWEq?QV9>c%=
z_GNSj7I2AvGz3u{Cytf27#+|7h`zB(_>1*Ly7*8`a4jh<IM$ck+Ew2pMb<wn`WR<M
zjN6<Va6bbtm5RK3hfrGUE>RGRwc=!UYO&I9;qZYeplyqQV~-lTnkej0h)3D)Y(R-l
z5wjiJiEelClvB?dqM>Jv8U^4)qeG|Ts*k;E-0ieJVQlY-Y}6AXnG}<hY&*RE1g0Vf
z8YPS)y-9rGh8-A8h3#0<V)vY&hG~;K%CD8cF7;vOdqoB@XCBrGDsMFjC8bs#P=#G-
zOUYSU0wOJyfWptpU{fLjQi-To{}J<)R=tpk>K`dP)P8EJ2!~p7GDPk4i!93$Q|I0o
z+ouQkpFg{RU-&PJv}0X{anCRj*p#spFv8a^gqGW?C53Pd->=m~nV8X8{xZ>|vfWD|
z=W&T>>g(iv6h9Y(`wAhE?e{jNmuniEVie;>U~oo2-{7sU9^emu?I^zEwae)AM!-0O
z52=^qt^69Ya{2XX222DSup2{#(nuJ-e(f_*1R2)B41P{nr^J?n=qHB5?`54-caLHJ
zKG?&nMSV#jz-2xG7V}EdAYek$0UkXtgQpHopxw<thJDa+Wzr$l0#bZ}!!5|O5t#D_
zw{G2f91T5d)F=Qa8tpy`0Cd_JXFt+0<IiNh`Ha1WFCl#QvXaxPwg0tb3Z^^4=WpGC
z$B)c`Cc=vyM2E0sz`@F*Qmc2-;|aif7Qmz2TM)%_qU{mmqxhPuPX-6NjmYkIA$V1c
zfU|hKaF5K<=+6Tua)rn4hM0u%;#?pK^{=xa<#*q&csyz<^b(E1Ba2Ox;U~Vok3aa$
zWxV{7A?5vqY@UG1z498Cl~$>Uke6l0b5m(AAjKV#6oJkv4sDmi9VZWTk?*Q{F>M;L
z63PHM93oiY3>RS{kPa#2h+zzn4N`2LB>e1;FXOj<<rrRcRv$@^OTjPt%yGRn^DP2n
zwbmv_yDTfDD2!Zk96ux!Q|R^S?{R{kAuV`+0GP}3FA*)073g`@2n~lI)`Y<09K1LH
zS_YC^=w&6!6z>5h2#@dEfJ3Wo7-KzR;<W~W0BR#8LRMVOM99Yj?yoLC^4eFvu2BG<
zMQY9hIMHbS#|U^0p4#;n<5NyKdobv)zMfjM8%!E@Yz7`67)1Hb2DfUVhbJb-!r}zB
zZW!TZ&p*uQIsQ^7m?Hn7WZDUVhZ)EMv|-Yp6Hp}*Lf0{Pp)iQUL-b?H>_osQYdfbH
zDn-_7I6GjCvg@`}N|7d+tk9}R{Z{vEG?r^1ANphY-4aX=oPHYPm9H41(_%dGa2vf<
z1Ji;RQshlFiiB)jr^Z((YQtLB!=SF+GnJ%Tpa?3+PALxVCi3|s<n9xa|0k!MiguK9
z3<Ac(6v^1&H7_3FfBwt@zUQqytV=8~w5qhaVb{L|3);(7k-1VK67f=Z-;G8x;=YK2
zHG-gila<9*y*Q0ec1^hm+<Ov_I|Z4XCg3Bhz+%5R_(zxkPDxj9yJ`+$Wu}FH`0ROj
zVBa)MnnSB>p%39TbLoGn^3D`pG0gp=*+iQ^eZ?pL@+LI&tWl!?oNzQIU=M)ZbmrNg
zJifAW{QR*sFHYMtUK)}3pMSUH!8PJjkw*X+EOzkvm+q%^l!0>-o^_?N<|T137NN|w
zzcK<%cR&-ZVsEv#(yPKJz{X`7Q$$Qq<CUQSah`&*9HJ;dOz=ex4HZl$sw*@r+*=o&
z9nABHX|DwxNMR*Jq3njojFo>u_n!gE8SAGkUh>j0F1&Dzh2shK?oBYx2}x@G7^$X;
zaTOw<{J%_(8>G67+7EZ?dxM~_&KoJKRYn-F|4x<Rmtz#xugewh(n9!kSypQdU~|H_
zm*D(u8GiELF5zc>VhJxiV}xYHMQ;6yrXqxCycD8rOYQ{0%9^QrR!yiF>xyMAMultc
zp)l$puEvdz@JmSLwfcB;U1>ALwS<bC`%f)^V9VV9L19n=+_gt4lx@a-p28o0_#zx1
z113R;4UyyJ*0xlZTuy@M9cQ+{;ONoKo7R0`{_qnIquRrUo*`-!fD?}P0oY9daPYtn
z4L58)(+o%1TTFX)lE}bi>yj2;{LX{mtrlj0(i}(Ur*O%RC7gf8B4a>A5p$DeD&DD#
zkKzn*9%L|^rlGm+TGp}qM)eI<jc~o;xZ<daSTMUkLOm}L_KiXVYGUfwVnrOaCpOm9
zqXL1Dei`}w=}-`B(aJ5(Iem=RympK;PO~_2fN=0Yg4`M;NjSqL1aPrxo@%-nBq@W~
z^~)u&iG*04DC3|$LE67{pW+$j=(~>76auIWL?dEk;{>Cg!KO)z@B6j^e&J^q@lCH<
z#X4g_W8txPS^gXxT~Pq#JWyB;azfP@)F>5%icd)1uBw!4wIcjutG@D3{Q#oov*rL$
zjV1uC1blQAJl_M_Nwn;w7A^RSdzTpCNye8S*^JAtJquZTR36q83<#=gn0%e3a$LSc
z`FKd<-qA<rW@g?se|Xo?H72T|XMmbafG0Su-*C$9%li)AnvIs<+MbwWW{}%=?Om@F
zj10$WL(cHx<?C6(CvH9+Z+OK%noINI@Rw2;>tk4)_E54wDr3eS!)zH~c?f%C8D`5g
zFw6mWZh?yC5{yp<NI8mw2xI@F_qPhc?RYe~d<LwlQi_2;Zm)(x2|dGqRKmK3T=^mT
zOPj0Uidqv2=Nd*XCr;dF!#&iu*qRRUuirMpYhRY&GoS0?qo10_V^6h^r55c;W+E;O
zVAcu%mx3_P(x!a({ysprigj~+?qd)rG>}VpTxPkIGE91YL#v8kjri5oQOLz&$z>TK
z8ztB<W%1@Wui{^Q>ndLI{4pkBfu0RxYqda*2B9h}qj&{BR&r6q@~C_zSgb?ucduB}
z<v_S|Bw+meq*sa87{U-apTA2}Oks)Co`@*5HkN%Te@g-6wg~=9P1wFCgt1gi*#-T&
zfKwvaF7vGqZKmUWgLX&2GOkDQD;O!c#kk2>41ygG0Glr?EG!<4mSscFFf~DdCnSY5
z8gF~ke>%`f=}J3XTxFM7o5D*)5d+t-UTN7A!Ay*C^TV5P&lBrly4Jmq!9MlSqe{6#
zJ~uzYMWle;zXTp+g(=FB1QB06r05t!IBu-UoV`I3Su?&t!iuiRb?(81wcucRzv!<I
z{1TQS5H(MQzH?xbh(g>b43|rigNWCX-;d6^T%pK#8$4$ueT%c!jqx9Ucol#BC-eBZ
zpIXF=&(C0chKBtF-~uK$s`(CnmBuEAJ~QhfkEcKmfHY7=dOY%VXyuRnc@1G~L#E0y
zf}h~W4g|mTJs+hQucp|sj_{-3vx>j@v!i&&&oAKh7Y{Ho%7I~QQO6S{*NqUiYfLQH
zUXPSnC&b*J%7$69;3_B&>zXt=LF(4pi3syqi?YSYg`?EK9_s<aF({2RT=#-g{HVwz
z(PAu(I@tN-deB5xTK}YjW62><a=fD*B{Eit2+WzCoM`Xev}seb1@Kv>#szSK(~V#L
z0B_!M&SJl}`X<|&+M1+ogaE#9c#4G9gJ-q$ZW6;JjOEofHc#Yu<t2xZ_QkErBB+9i
zv5<hFB0aDLj0*^iQ=Y2AG>2CEjB5@wiCdxq$>jGM0j0`XlY!PLAvNVij~9HoMwt-9
zSbZo8P~@opl}A|oLtZ$-0%pwEFk|tO%QC#-4I^B1UWQ>m!SQ1$78jE8G{hoGo{Uj|
zg=>S~zUA626sr&vR!+5QW*DE~1Q1rR9R5-%C<5RqEHBYFGK{2bOg1tYt{BXAfES&g
z<Hvq*1^@ZS7xCS1>*37xW3-1kkfF!`N${rv`Vm&s5hWXnwHZGb@mdpWjG{kz|5~<c
zC4xS*r&<wJ%GW8LO60(eZk&L@S5>17IZBG(?Gp>dnoUGIWK4p4b^Ur^xV%=$B;&p#
z>+zSDUqFMT$_*lY+5hH2GU18|RS?Gg#bGxYy!T&y{}11E({-P2vH(7d)VKgn0y_2d
zvz}U7zURu(VDVzKrxMNnSRm4x6F7j?v6i%(<BD6i<NLp17oIn<2p)#?wCXvE8J*lT
zRQ}jXz{gf$H%`J#cYxf&pHe3LtLiz`Z0D<uOb~_mM-4L+pjcU!{18_o;rbeMS3VT!
z8M-{KsYhD9wZ+zK(UW%z7}g0@pM6hg4Z)fQFb2}hV#m}7-}{yfZ+YDi_de3b^*6O~
z<4tWm`lLZ`)xf4erwbUj51bv=5ny*F5%yO%E-ZrrrN5;39<K>@3WZG7E2p`PYG(_K
zM+O)ZCR&8Ex8-=vs|I-W%LcgYg=1`(vPg3V_breGEk=&CY;OEM)Xr~ZJD}WXs4e44
z*|JY+NkkC5J4i>&pGFuYVjxkJ`1}ZmvP3QoG2FF_Rj$=m0()=;7-T@#2#-^U){hVN
zk~<s$!ngz6_0VQo=(mCC0l-3;L-mzdOF<8234^T#vf(JpM?3%UH-0ihL(eKT3cyJ~
zH+}KFz0=Qq)t8Pht^SbBM%$AltuU^FCsTkYIbxR<NYV`Z=DU3L?c3<Ww=Mufc*{=-
z$4JQPlmE&R4ZxOR_b-7i*i`!Eb-SH^nE<e1&p>J=F^B7G`K>F=&YKzt){rVb{!Q2G
z10`iM1Pt%2^<d{xwJq`ay=Clz*KuTd9-FCjT%48$?~e@vH#W%`$QfpAv7R!#{^BuS
zeaR39z8BcJyM-@YJAnrtXyKv9TbN%lNZN&yB5gC0#KMq;wV_`w3LjkfeI3#f>sG;S
zL6IxnC82TdBKCoa281jpjE6u1LN;PdCX9>EALD`x#`wlJjB(*PBkb5>(aLl1h=J8|
ztRlg;rlYvd0~N#Kk&yE5kN0Uy3zwsLj%G~8Te$V(6gb(~=v^$PR5wH=%M$NEqzQ}p
z4|Q`C_~~0|03PSChgOS2f5cr1Jb;_aGKkcTv1K3y`ia4{_iRRnF%psgKh_m>=0^cL
zx%C85S2jl5*!lGvPMJS`_yIKZ>{6ouoFug2lx?@ItnRus8!molGPQ}o7V;=qCpu$t
z$$Z>zS<3XK+qUC--}nT!bqC<Ad^j)j!AA$>uwqQ*b!UO32D~_cJ<>z6Wf~Y+4Y8N^
zd*wv_BBe_#MAg%ktolNSAa!T_WKpk>1VU+unWhrVvO*#KLs7w^Byyh}gRC*7MO#@*
zrciUl_k+-=IbBc&zF7bRi<Cz=eF8Y`1!KJGg+na&4eooag~y*rapO%L-2X@$y`I7R
zqQNLPXmx>hi$SKe+>L{NYXlSE5Bza3v9}z{m_V1>mvaDYU@c+LCnO+jn6;Q*pW)(j
z$9Tm{2iS2&h8JBp!p0ekHY_LuuvAtjrz#e{wFe^UWl_~F#h}K*zZl?pAG%W9qT*aY
zDnoBvsauO&sS$MwiF=G76zM1zM|elXnviXDkbBF(9$W^G$3VyUHc<4AartazteHV=
z!mcB;czpLdP$yHMj&8bkT=+MZ*_ZF!3<Se@J|fucfsLC^d1@CLdbX)i08SEm>FdA!
z_>lvDamB*Q;+vC+^)p6V1|;RDu(XxoTil<vGu-*aI^6QWDfq6-c7u<TlltoP+k#ka
z<?-o*g_2J#fcGzgXS<+wQpN*7!Q=YaIoF;V^IO!5@?3To&8|`UQUFz=>&x8;^|-q%
zM>WrXuZ2^~o~q(BWa^L?e||b7b1bb{XVnAhbKLD%5LJxAI?bh=JhluPFxtql(Ex9J
zVTRYe82DG;yn^LHiru?Y+;P9bfkSP~A5HPt&IEf78jLbRk{B?du-3;w&bH`QxksJZ
zMedhzCq+UyBt&Sp2x&^NxrKqnmi55-XN|FSdyY+;GF<k85zaq*jM>RCW+yBX2J8U9
z!1~3j{K*U@Jl391Iayjw^g@knm~5wOIc3Jf=~Q1VM_80^m#ajd6CkmoU{1#x2}hO0
zU1G0HslL^?$-)z&Kx2S$4nEQ=1OLSE$RQ%PE?EwZTTH-&#jSU2##6_-Fw+At8~ys$
zXfPD<8oz1OKS$tkAFTwt^MO5rhMsk56o8Y1=&yh4NAmM8e)CN$t4DU_<K89Ip7!=8
zD`5~g1(Q_zOWTtydSvnOYfs0UUbG)GNd~q=T)w>&S?d0qv+(>q<sGR34RhH2OGwV%
zp!Z|D65_-@{%1yo!zxR+bZJD_xgxo-wvdqJ#`nZpfO<qnF!(wua5LBPcgWuu-W?Jo
zosd98)pEq>2g&0l7GgmXlCrQLJ028=_pUd<`e}<D&mZGeFCrivV5LVmc$9E_*<d(K
zu)LJwiQR;!_NO>}l+f=3!;yit@V;UL?*V{G853QLP3tYr*<o?^89C<GTeLeCGm{ou
zH)NQb1rp|BzkZ$<iKBXAHsdI=8YQc4dc4=#BP)@WEQc%3-vHK+)Ij`COKYJ8h}NY?
zhQz;hi>OkrTMM+tI}&#_`Y|EcgDarX2;525wAQ^lN(_(p;22=hv~c@9r@*EbiCgJ@
zyu~(L=RK6$3jOOAp?=m9^1<qcb?bJ$^*g>Zzw@>afA!<u(7y;Z3c$%h3;^5DylB__
z@uS!F2a7LA+p~sY0|R6)Y1~Vx)PLu}W+o)947WY95qIp`gg2dekn@!gyA^r5rJ3sm
zfhe~4<^lrOPrz)LC|m&&4)=_Wf&`HyEeC(C&K$3CAygn=L<}?fvBGGBJ)=SeAjd*T
z3lTm3^kPFQ5Rp11PjU0*#%+_m4Z<V11fmYF0Y#I`wv!ivlX8GL#|#6r>j652!3n{F
zFnUFiaSx`r#xhk8mE&O%EW08p1rh?%qzF7G%itW~u?1G3MSzFTOV@!qC5~mQm7hJ1
zhpQ-nb#Qv!S`dm?tT$8ysq~4jS$Nr6Dk1N9y~%g8(ni8sTMATQu1}9BCYVF9kYkq^
z*g;n8`%l7}Df?4^@-iKBsLiiIVt_k@eaEM9%flOiBrk-$5p9u*iCD6}nPO7ptXiAF
zW`pAvt=r!5OaHow{yzbzQ2<U3B48iB^y%%rvoC!0RsCbj|0>J++goW@FbWm|OA5@$
zGtC4Ti^HpJTyet=yyCpW)Fm)mE(4MSr==3cQ~0|?1IWP)3>b#py#Si+fKmcw3@Q3#
zPZZa#6X5FJ&_CaP|J+xCSB2HjkuXu|R%1hu5rUYa@=&c#^5{4g(ep_{IFDX863#{7
zXDsfP&`#<_hO{)JcCz>*$)Hid_#=SXf*9zO0+Rd=G#eEcTiS)7E-Xh1<4E#oD$?z6
zgCvEo8hnjz#QkMy9XtPh9n|jThFQ<8Uq+GU;LYE-t8Q#d1zNe@Twf$25w)208VuuC
zbp`mI%l>d>po)8)yU7PJT5w9>-OJ$2f;uMlVnu$A@;xS9KEuFHF|NC63l1%IkWLI?
zVZcf$iPs;gE>&iu$X?2v57ADOc~H6s4V@6wBmz2VXgdI4a%T3{Zj0}>!xf<P%Lo3h
zwQ_AY3yX#U)6MXOyH3S}ht`AJwoo73L&Omui?|d*M6eg~sR0j0u=^Iv<3{TsZPxAa
z?d3?wg!YC<f?v@Cnw9-Xb>h)Wf~XJB<;&|7UGRe`2GChdf-ib-!&`ol{aB~yME!OG
zR0(byj~hT0*GO~<o*ci@YKKL!4a;)z=eDku?JoY@b&CSCw}6#@<+C{h)`H4ocL_OQ
z^WvU7+(Xs^dGxG>9!K9Nz#n<+$6fSYCQw3kOsex<Gr9W32-o})jMuGvj`VvWWw@XB
zx?iKeSh*`T#Gq%o2@!2&@vMk7@h-Bq0j~_f^F2^YAU_`ELOD-d(^fGDDPtu`apS$)
zFidO#>zMkb>z>hVsSJSEpYrk0rUrMMcE;KBXy}BXMgcg<=)b)E*N?Un`V7XaLuM=9
zW&JX;fF#`^!0a=20ZD4HcVPmbyzWe7lMbFo`9y#$y|E^(WF~(-Fa`p(6Y${`@WP--
zL?g}LnEb;WDiS7!&M_{S{~G9TRl-J=C)Zfd6{W+~C9c&e8BVsd6IL8xaaEoZDOIbt
zsGn3dwd|7^Yq>+n#VM%1M-nO$9F<0R9V`;C%CcU|^oz&LedV%T(ofYP32Q9@m2Pfr
zg}}!WtfAG_eTti2Zrn%RtrV5u=35@0T&pnD_$i9>4a76bja4(p@tUcV!bNl@m;k$X
zsVK~lT2Q6ezM8=r2*-b;7zZ<H@xYTCaL2<Nk+!okZ-i60Lw~BrJC~oLp_JY>&iZ+t
z_wTvxioaY$Lnj0^3c$%hUZVWRZ+)rVxM|bPDUBb^^Kv79EF&CD>L1kw`8TpX#20Se
zhR2UjBk7dsfn~Z~I738Y2~=9X&TAT&yxT@*_biqQ2njcWE1+aQBzh%fuAsH#g&Y!Q
zuDOn?u&c4$0QijqI+r@t-yAnmp8SWv7UNA1)wa3cA^}Qq`NjW;#X&i0z)*D;JYCx>
zih@8L>Khycq*n}{P9hPA^+4-K;^#vf<E~e`5TPRKp4iIPPAe(6LOCK9K+IoVoz+pH
zN?Ry?Mxseh@Om(TJPJa7NpM_)KA=lCRDVbl@R2@vX$Yi2=?v#Q5aM+$F#$h>0EQC@
zuDkVA%nuVJNnQ#Fs#z(q1|yqCT2}+XGQ;qAac=#_-9#1NT|>_jH44DVMGOE_v)dnT
zx7)Ya;WE1vt1b#Wvbky)W=P_av@CWWn&zu+*@4lNci@Wcb&`9zOM!`c87r-g)PR?V
zu=|&b;J{c2krZU1iufQumezG>dc-xTMslp-7KnLO{BH=B^8M4J9!YiYmq!sKC81jO
zY&BTualjkPEtb&tMOHAE<Kc%(Sgf@mhQAh#mY*-y&#-W(C=^C?x#o{l85GI)fQ<Nw
zuT{c?GFW>;V$>H`zt&U5jiifrkIHuXxe<3tBtU4>F86&^xo~b6f;)7{&mp<eo#~6p
zD=B|+Q?2_E4^*ud45S1*&SCd1gA$3Hl`5kL6Ih^vbu|&t1`hTo@P#|KBTutxtz;^%
zQEi)DUJO6w2AmDS`Cw;fvU?92I$@|$08T=>`I`3(CMP;q@_1$5=9$REwT5)7xF!R`
z%3EW){Ms|IcV!Bug&J#0OBQWka;bc9*w;<~S_FG&8Frx$v<&K`Q`98Z&8@M-YAJBm
z>Y+$$++Xkd3>Rvk?24JKo@3>+_p-)qr}Xlag@BBN6hrLUL{$d3;jyksPBCEr84z&+
z-t5-j*&ogmTjGq$5>l$0g&G)zn8=G3GRRLEpGw+^?`2tX0j!yCU(HVyoL3)}(&n^P
ziuHt0uXnY`SPG#Osw#poC4VpwN1g;X4q72qA-Q!B7dczI_>Yteh=a?|{UrvxcL_Yo
z3hQ5#8M171K<zwAUzY2l`vLHj#dUXY!lQd8&}x@_#gdpv_B(~5R*Pjp%3bJ|nH{a5
z(@vkVlpZdwG@|E3pk@|MLLwrbote0~h2dS<U_~6hBbjuK@D~;kquBbDbTd4%cN$mT
zyd8F?c#w<>B4WWPgOINPza=xWrR%X^L=4`&0F3i89Vu62s4~lhjP*yXRuq@7L?y?m
zmmu0^48apM<-2=G-xq-Zstb<Uy8lT8#k&efKj7P2d}YZs>i|-!tK9v@J}x0J{Q7Ry
zgRff9Xe}owS%o~3o8}ysmr4RZ&D=?0%czJGE#t#I1TE0kvWzSBhH?uz9r{_nqNKZ{
zez=uiJAPV@d96ZM(_Xj6YVPN#aB&!8fv_zMz{h$pol@`?Cool%Ns7NjXqz>RMM`na
zEvKSSR;=T4?aF2Ai_q(Z;(2$ETZ??S)N8kJ-M9b1zblR*)8{xh^ej=M0Gy=sUEldL
z`&y~Fl1EEE7*Lrtb!e)8@yWlO1R!gV@ri3r!@k}Gs9lCPDgUDrUjjZ=!l+~bEVxce
z;K2y_p2c#Dm=GBirb_iPsnYmJIK&6$xKf;vD<2@$8C3n*ap5%{QyEzeC?O^dT5{Xq
zIR3pxGSC{rOtvo)AhBEzx2)A4Q3Tc8SKEIH*^73U&nx##twtywty4ncHA?zsKYjuw
zsJpKgGOq+q`Vz&O;F>j8wP}^CRC=KNMYa>Z?%*<u%CBjgM&4?A7B@B_V4TD5T?82x
zMnHM|GKFJ%s{y9EGt2-@Fdo@6hcDl^8K#{>uPD+>g6r3h`%Mi$5!jB9&~V8lbl)HR
z+;@k<8+z8MQ2<U-`n6wri`}?s<8{XNp2$Z7$o%&8oI?mnpUta)l}$Uxy?bYI<?Y*$
zPs@ADCs`Q59N=wbv8y9XOQ<j<*kh}(NBcl(;H`uj{^1#mgokAxB0)lmo7XT@WsyS*
z67K^K!nq=Y>)=^mA60&m?JTMZmc7zMIFk8d>?&2(I$U)GwpR#(;qUvV&ahVyxoE#c
z9cpfO62t{_%H1V;-#mqRk^Lwq!3PJHCTwAi*C>7zuRdX|d!QlGAjQ1O)YT-`joc|y
z0hfF~!+6T;m1!18%i5Amn#|!HB#=JdSB;aNZ}kq!b^<^G*nLYtZ(MA_m2DRaQ}wtE
zH~t&|J|c{|2A{rl2afbpBxxR?el`_#%N_BoTUm~GC0LP=kNQZ--oItr8N1QY2}O+p
za1zt(?1qOX+v!bqxSX?Nu`vUL`yPEP1D70s8YC7U{=!+<w>kytXlO6+6DdR@p#t?t
zL52WB$oDRS`x%fVf!BFK6EVX&^A>(1qp!om-5fWdj+4f)tFy#{MJxTBA^1*mW}z%p
znpZwYR#Z#%_mUscsxl&U1}`?EV`%m9yrky=E=8-XTUc_Ht%#A}SK5iFH-^lm#!(sm
zU^NpdFH$jwB|4%Ed-o@h8%8}Uq?<2L0ipd;nW0eiSL$O<xT!G_7O|N3%JOpShunCp
zVJ`ba;<K8(aK?cwj--H>U5V~<&!q%D)(0Q$0WA{EkCCe|rRue!@{KD0r7q)%#c5o3
z+bKXN4{NBrmq@S5fGDVy>T8JgRXbW{GJNmc?E3w6)7a3nM~wn-($Xb#%k>{xYPZu*
zV!S+Wv#|{M_10Q>0e(x6+FKp0vUbPf{@t_q{LR~tPjQjV#gPz_-iQ#+$lxttU%lra
zsR70r@~4i&WpQI|ssdnPAp%OU2nJe#A1S_1_K7v~^%5q!-;K#y(0Co(DU}b+RjXzE
zb6A~Y%(D6740*k^%k`fGkRcR{a$alO@zv}v7uS8@q3owbQ^c{iUhb{|DrnV$gF?jO
zTKR9d6!lAuuU2kDvs_XoQLZ0T@j0I3N;}k~i|bD5ixfFgenA$sgQ7=4y_>QLMC^k*
z834Bpc$C5JT`W##G7fnu+;UvT2`Kanah0yU1j{+b6O1q1bSfS{ID@p6`)EckGd-#!
zu4F&_iVOeO2O^c}fAjv~sp*-UzjVc4jnU8vMU4V*($Zr9fX%0DyS;5jcjkk|;zT$g
zL?cJJX~{TkK9FQ<!xrO%SDlNemZm@*3lG&ws8fOp3SJCo0vT=6P|JW9`vqi~iU_3;
zS;XwM2&p|p^?0u4tZl;6gp8L}M8eJuP~3LKEd{(S|IyMb`T?j)QkfFB?ha{b)uA+^
zz4EWd!UtGKhsy#gija2K$PFAC{;wHNcTxI<Q1hTd5~P3?*SrNUpn`gbwQ8?cU?MHU
zoBBa<l8A#EGp8Y_xDL@IwM^nQBCf}Cr`lh&${B9ix^b}OtVFd@m}>?KzrO+O?nPjf
z11XWu1RO6tp#*TL7`S)YkCA0iYO%lH#pTzZj!`RU-mD4%w1N}*DRuwABgoG|KJHV3
zY&Yk)4Go=e)F=QaE%g8}z3`$pA6Pd#aW%$^eP%0soh69sUsT6TSTQf>C?F=Z+8G`?
zFoRFucslZFon$9Q>fx&KpCdu17y>{o1G|3-cD@HB(XwMp8ZXr-g@SX-f=S+|Ikhg@
zqZg&%t00y&($2(^-qjs-&iS{6u&EN&%MH;#*FI_gQQbYUK$Y#U@qE-&D1?<BZyzDz
zBDkc5FXl$e0S*GMVlc1OZlR_46Z4{nD{hEVDIi*7Ax4kYp``-U)Bpf&FG)l}R4}e;
zZ)w|5xAwV&5fMWx*PHMF`0*)x`(jKY-+Rag$>CYJ>M6Jfgtf0Gkf=!bvu7DRKLFY?
zKW}+PfiIWz67h2-6dyOOvxG0)dm0|vw+?ALD<(yrL<m)lFU_kpe$17R!?(qbd$!X`
zZ@A#X7dFTLo`BRS04FaoK>YWA|5JHuV)Ao_2ajjNmE!$XNBWA*I%Re~>BB1wOvf25
zvQ~!6uRR01mS<qPT<kq}HI@ug$y;x2$<H!wpkx=Ov|gS(4jyEMHB*7}V~wJ+xmx^6
zBH$~GNZlw^KTF7#zVb5?F{lW<I4F;5J|TYS>1VZkIGig`gAyovRwf*(>4=i~;imYw
z*02^LGqw($(6~^|trY#mBcc@<s$47Av5&7P{;fR@iTooG_8m&C<`|0BP2KXV8Er54
z6wEJ>H->JbObh8@g&<ff`dAd;=$n-q@WO!kz!IqKTH)1q-yENAI0Df$=utG(B*0;G
z@wsbH!^m(rU}!Cvk5Hr?E@z@1eG7;ZvxTv})mBQkUj5m3uA-q6jv58v<fQV={B;6=
zv(I||&NQLVWy7W1S)5!Wh%~#`S8cg%C~akUc;75Ob;Fq$%^2nD_xDR<I)-dT#=5X|
zuY4d)z~c=06Y~YSV2m%)F~hKhh{}kz*bI}lu}C${Uxje>R#<ec{HNBoRA>R>0DON_
zFy5r?Mxjnsn0vSeHF1pEKPH18>lKagQ^nl(<<>vP)lX5g3T4klmvglW?<NA&4vz?;
z55{#6@YNUvsaZyf74zCUTfF|%SV)M!VixQ5>e{tNH7>>hvY#>*z$?BKK%yGGFHXc*
zK@8laxgrx&Z25cgI5Dh0>X)NkECP^N!;>S&lVE2V*FUfgw>`2E?e@5Mm&w#(Q2t%6
zj4k=N1OM6r02$cv5XgoPZ`iQu9yD}9QlkKz)buL=`gFx7{;W4MJNtRE{XI4-&j%=p
zD{O!RvyRmSG9Uu-_81?#`gDHm*euLcd7nyq8Z()2Y_8&qCcvQ#Th!Sm@KPVy-bHZB
zlyJK=fZQ>stoSv%JTsPsu&8c{t4J^bcUDydAuK3nlv0>+MNVjBn}df!4z+7tO?uxd
z*B7XXlE#&<mG*1hCu04z4+~~4C#>24B~ZM3i8-7mC}%(@E#YCIkV<8$a&nxjpXw$`
zPsvw8ddmKUxuCTlR{14ZUoH!9g4QWQHL6=kAXsX$OiqP~B)gLSV*Z@6r;Z6`z%X$F
z<hvJO2V<a>6hBiKD)~8TRq-#Ein?5KE#PR{!AGt<3#$yk<O)-&CxUlbh%s>d#9u83
zDH|-=PP=_)dt&BEG;~5zqX3+oB*f1I1Hk5W>+YCr@$K1QkwJ!owE}NB$4pBAq=g@w
z2o^xn&hglxY5K^OXJRlxprpY4-4Uaj0dTk$<E+wncjgdLadhdyW!NLDo}tNhRs8gh
ziN}JjhUr&1VSpEEH<rZ?PEnr{Add4ZUu#rO+;0B^*Vh;8E2^K7wd$XZ1({~U@e1)m
zK$)X85_By9B^Fc)IEs`7qNuyl`mU>tt7TPAQj&{kjke3%J;W{$1F%S!jq0mVS5Bk@
z25UF&hFA|3Wh=TlO24cmv`2cv9}|Ff0()S&h@EkMe>u%E%cLJ8H>APE=Ue0;wkgJ!
z@7aReA6$>LJBEevinq$>$I-AyioR9>J=VuI&%mRlg>HvFf7eYP?xUd-k{SizIYPJI
z{HeuOl77q%mltiGiM)5Q|JFhH+UgCqba}Cx;qn_!!<|p915LTJblvN2b(z8v*3N=}
zHOP~}hzKSD_{rno<x#OSz?m|Uw_#0VL{gm$R8X*Fu91V()r)YixBMKZQ$nmpn9DLe
zqQHJkgi}-(BU7gNL2};%L>^lFl}zA((s)#(jGC`a-LIAfBSg2c7HG2n3i@#^<C+2m
z^x~h3t?z1EWbh!>+!`*#mbCm6_Yha69RSq_6NU!4eE$jsidASiR&~>%#voScNX=<*
z{Ro#&I{_abg7+?gQt}%cWTxn#T#I3M?|GEk+3$!+fTP^Ohps#aOL<Z#_DW$Te{_Od
zPOh&${Li^LN|Z+`SWHCua0P9XKQuGFu7UqgU}_YA=LiuIPtR@ovf<$!<KYsBh)D@9
zf2aSX5}gVL%^)PL9D7$<_=nG*0QW!$zl+5*0gPaOCASjC+557qptg`Dr9T;jBB&|P
zk?ouZk8>b(r>QY22i7P_P$T@5AQr-d#0|<ii<q$&)`H_bokd*pCG3B$xsM5z0_)&#
zA^R(CZmGYl)&Dj7Ckj#4T-oM$!@g9I>MD_2JXrR=rcN>TYa8BmnqHLiAimG(YL&i!
zC1PbMhq5YAOU)2R7J97YM8hxJt20q^aCNzn@m(!Psb#>u4Ee6(#qu$FP6Y1a-7dA6
zty#3f1qsYBu6<xDZhmkhlFmpVJHa)?er>oAQ>oxd7l(VN%gHFFn{Bq7Cn>&o@uipU
z`6?!*p=XI21>iYE=e_v+eG}c*=j~vz&o($Ey;%1KqRgx3&mDtY4s02wGsfp{-G(pT
zw+%F9fgF+WV8KT<PN*1^6b3TNt!2QyA@W`G1=I2Q%%8^WuP|$2F+~WtO7K%T=q4%?
z@;)J1sD{BKuyyy3I*7;r^fW?cO*C7w+xoo!63Nj>d?dJqyJqb+tff^%4Xp%OvL0WL
zcGQe%>@xEA$AeMP9+bdSUKVl2FX>;(2cmw-F^Upq5k>u|jCBysYy40}W~8e}K=2BM
ztJfBRgus~vKQ<2xvm%)mD5@gvbAhZ;sg<)>hYEyAfkRmb|8(V<SOJ3)=yLoPAE)HA
zSnFYO{kB4}C8!v20*^;TcC>eP-G=Kv{P*u@lK-5*)F=SY6-q&$e(xV;)05LzC3$aW
zKJJr`vKI`%!Su0h5}nrr5Wx^*IXC#5Pn?e@M$<48jvEL@?VgL^cMnaXgbC|>mjqD9
zfERkOyBENz5r>-S@)XBZ7P8!qR>!^9MnGyQIv1DX>oqW}zA;Ycq6+uiSQ())G%q=Q
zZ28Ol`4qL%r4yD$uB)$B*(fHDR9u5ZK%6T;C~mTyR5QM{(UwxM2jS<JjSN;%$JkL+
zw9kd8$49~NuI*nznRNA&sH^JW*G01%f8B>Lz*KoWMCys#L{t4Wx5g6!48cCR0J}N_
zb&Ge{9p&rJ{0PSoyDsZ@#5vzw`sL!>4+}eEas7j*;O2)mmDc~-s7W;Xkf@AWl0Z1$
zfD*Rj728hvj?UEdU1;cprbYpHu22R5p!KJn{#d)kpUe95xwnu+sy8oNSg|$7DwJ4b
zA|w+TZriyL|8(`)7*0vfEquRD=tRs|`~7`YUY-yU$PlPwU=J^Y_b-;20>iy)naV7L
zslP9Ri-UC>3xTz8bj`qh`^{Q)Ac|QNmTn!6k4TUzgEDaQ5HZhjm%@0*{s8Befn?Pc
zAApuX!JPIALm@CAglOCk4P{rVsFk-I%_%&x!X6=#T55Q#4kgjnXX(zDDXwXa0wScx
z9i`ykiMXH2$Y<@T@dCMSGUH-`747CGD1+gcZ4iKjkndeWeyj)XItAO=)(&DXeC`rg
z@jYWe1p-QisRbM!PvC=}IUhYk#VLY9Z-|eU;M(r!@QDH;5U2q&+2LZ(Ap7i(|L6a5
z94!#eKmRLe-3>ik)F=SY9b%lZ4R?I;y{ofxbDuT&(r!B%fXHY$fxw2sTkCv(ER2!B
z{PWfrAN;~uxNqNjqDclURk(w;J#>8lo)#TvB2Y@m_b$L5T?JaET0n)F2cbfB&d*9F
zIsi{&?NniC2~|`097UpY#4Smd7hCpq#RkSHv?%v%1nHO80!R=QTG4Zgb~8I6>nfD!
zLS#|9K2a<MIE*!m`<x*2%PBT@qjH#iirWBmhz?5hgP<1+$&WIyGg?rUc|~X+Kg~V9
zDe+o>S2Suc0<Q?Exfd5gJSVHC)a?YIox&dK!R}jzX$fS;k2WK?EOd^3@97d{yZ6yg
z!yMs?o6f{7k8VQR9u<LmGJUx0pz6L}$THr=rRpeNM}vI43bOr2rl#j^{_j8fW{Wq!
z705C)bYfDY06drIsRICj4V$*y*-Gig@nFF+C=Om0D0le5r!g(L2vcCxtyYG;3vK+}
zXU@a%ZVQwGu^T|S5o^Fhe{b}$Naj<(o<sz@>p1M<0BEJr!$k$bMJZSv#btY&t>V*+
z9H{}$jfsS7p%RSf6{hgJ-zpb`N3G%PK>%TW)d<S4X|YDYd23tvUxdu|Bf}_NE$nZX
zf>_N^osCxG(+}tbp)&FQKIt_MXa>}0F26<<*IiQs6LKzaRHteY>$ZeGyN*zGXnhq<
zVpA3Ah!6!<3Q;sK0d5PQ18|{TFP#MT_yBhIA}FOIT{e-|wZq#cF8DTju;0HI9Q+%_
zQypOE$_zg6`Lnp6WT0{<54$mv2#6R+ja<kd!yxz~n344t#_c4z=9E*m>;wQ@brrC8
zFB&>AsZju)Tf_kHlfU-irRm9;kMn5xXf_@Yk%8U?FJW8(JeU4pxqT0?1u{92;nQC}
z6`#9#JM64u<_aSfO%N7BEu0@)SMcyBTMN7MIJiG9_C0gNcKnvMHPnoXMM;6#*PM>W
z74D5nIZhP_JLRg_wD-%p?-EZ{GGndt<tYkGkCYB6fcy{!7&#v00Gx#Txu#-Lzttfn
z;U0I6d_Y(b%L2Wq%G2cP&>}T($|^2GAY~Y-+C5O~S`ot-CO{1at?`Vn*DGbL*96Pa
zEmfN6JdH{#ELS^Oaf^uwX&cz3A?)Mx#r4!7HweCUDck}0Sb*|ESbu77kDCSz<_Q1v
z#j|nW-f6U2V{zm!DTP|jLs<D?MX{_;^^K5^d*I>9fljCU$=j~~;9z<xC1e>e8a*BK
z*3h#^jRNqTBc`8tGx3%!r{2^}?M+$#cp3H2nmI<Y(6d}`)i?{rfI%<`V+ASx`tldx
z(Uob?l!Xg0l0r!tUa`d-v32*4JC~dRP`f-n`0=CQ;TUK+kr1Eg#{Sq>Z~ZzLUH&Uw
z0SdlfLm7!pON!g=?$Hv}Gscn``tc5fs_T}JxI6|n@_|!SPqp3pkE4IXW31c!G;p|z
z!&8dL(@F9O#o(IaW5KD?OHk$3`n``r^hiahwkx5}?kMW`pc|k@pI8%su#qJk>Q?75
zgbs)?w|-vOvQLuew)@$~=K;=vc9<BV*vAgI{W??*fS+e|KvnTCB@8wIW^>%Ldjmdt
z)#>2Qm|QTS-_>8yi&=p}#eFhDNQ_;0$9X(hK`Y6x-MVeteE_hs+Ccv&IyDNwbB+od
z<F+sV(}C%!&POmhek{+%TEpj>kKSMD4*Ln)s~7}pfplVo`wvXwJs&?0D_!GH%@grh
zq99Q)X=dr94@drV4~@47+#4Z(bRNh#Bnpz-wS)!b1Ig+fw2H(ghKd^`7Sir#A<b$4
zk4lwZ5kW<e=+o+0-$&xR6XL{cb)yF902HhZQFQgeFy2ny#EEo79m*nK+W-&a!9g&E
z18d^@Sd4FIo6;G{4U>1GL&ZqcHiRR+LA!qH&>Me)^iaeaOvQ&^uXNOBT&yXJ3QM1d
zW8{w=1IAf_c!5x!+g(0Nx?Q9iSzQzU6)TmDgt34Y{`M2+VefJWNh%Ei_h<zhgpM(g
zJ!S!@IYotFZAQpej&>%xpSknqj~<U&)zAq_jRNo-rkT0*SGA12F7F?=QDXizGQ)92
zhy)=}SfkV(;Um|dg)8sbhHTctmWe{D*kEjFm%K|tn({VM%>%U!cy)m6v18!8PzqGY
zwsh|UL69rqOG>~M`F<o+QNzqV1NXi5*M0S>t!r7IvRH{Bun)d+_xUrADnSEE3PudR
zoDbCa*}3MC8l>7QHzF&fWbE<K=-z4zHz4li*h$N~24!)=grbV7Nr_}#(Rzup^TlOF
zl~wLiy{gm~KO3)^@|twfh;>#SyXaaw0gp1|kIonFu2vG}y0U;Af)TFirjmMh*eUM}
z@C@O~J9pr!+fRdOkEIWy7{ax*IiXO>G(g4cMFlb;-sOC-f(}M^ZkV094h@|&)F=SY
zVY=`3&mNwdoct#{oS)D0k$BbPk1`oh`QFRuU=Qsw5;Mj^M)=#0U4$olQ=l#vN2^y%
zVS_qmtEv`eyYOg+`~mF*SR5dK<S00|C6g3FP8o(&K|#Zjt?c_%-+!uUV9dQW0|rY0
zy+#N99WqyeJYzsG`!%fD;AfTCZfJrM1j->C&xd$4G69LDAGi*>&}Au+8}@X1g)DBf
zcPYuzD=>Uev`DT73PlCP!YQg%2)pk1XbG|uIVzq8!;k~&a#eUlA@nH#0%2`c;x?2g
zUVLmBaDNQ@@I25PgF1C=xJ2J58gHdas#(<cSb!!Nk1S8)ogY6B%WMH-;Q|H2`2Zvz
z^JTD5gx%51h2VE<#(4LbWkx<+Sm}1s%isLEA32PMP8w<yfafp~5zlPg_@&g?8}h-T
z1sNaoD~(IQ1^)rD;3N0Dd(JY__5gS6n#13I>_RMe43Myg{}mru%MubY^eZ8n=p^8!
zKI|jMz*%0n1Eh&4EKkqSB3T{R>$)NpiExiEPzA<0en@iQIA*&N(k^9%JjS*<L#neX
zia*{}AbicbPh15uykKG|WJFlr-d1EcdiuJ8u^D1?MVWp8*teq|^A)za8**n!%3iT|
z4*CCt?iu>!+AM`5={`jIg}N@w4GM%DE9DyjNci17QfBpBC}4m~-@Q0S*-^{Du8fdB
zJP#gZKu0Lb@wU!L#8*euy|J#H<lAHou-HxU-cOx_NA^#k)fvN|1G?6`5tcq=AaFS9
z*ZoiL3djb_Fm`bF<jnf3{`Aj(IDZ;kp`jCu8U^4vPT%vrKXzpO%+yC|czoXGBMR_#
z9kI8-%5NcA3KhOdCR4a5C&u{5b!X$#cb^Hn&K3ol;vhnKx*0(luR^$R6k6vXU1#wb
z0H$OmodkBdkNn}IK$aET5IG#v8pEbK2~PAc14S?w2ZrXMa4{5-AsO7`T8r=^#qFmT
zePs?-qzc%A^hHMsm%9?@+ZRZU67Z^zx}542s{LFMmJ%WGZE&ums*nt)$FcrnRK`)F
zF_o--5Xy|y4CT~$D^$Yekqav7qa5{kfLO#m_`Aj7O)jvH-Mw(GB#}y6?ZjZUR@ess
zS|A1N$^iM}^WgCq=!Ui7=39H?1$M-tCu%1F!Dk6HaGx2xk#WUc+wo6dItM&~A{da|
z_{vGqN(_5nSBVLd3sQ}hlc1>P{o{jniYrgO_`Ik5;&14rphf|B4%1~Xxs-nM7rxtW
z*l^0#Z8N++AIyVbf)Eo-r67@W9NIDue6@fNkytEPi@*HG3vvI!4WOyKkPiZu4+gFi
z2*P5KFhR+b<PNW3aTgz`ZNMu7<c}VMbx44;2z_!C*{2%TuQ21t>?!Mt1#H!Gz<O}x
zV5vkt;vTVQ+siA5ng}3321<q_UiEb)S!;x=7(sD=%)~7;GY|KXZ!d@2#Qdv-MOr0_
z>aNa3p%99;#AE7D@GI6!u)L%Cq<?^;x@DHi%KXGlCA9<sIuNZ3Im$IkjYmdeos776
zty%_lae(}><G?rvxnr;+uZ!BmC%UHcRn!HCdS!_~lZ;0fr}4KRzYxpJVK;!NEFfS6
zmki3ie-!u653^KZ8K4CDXcY<fAD^9@`Q-Kg^k-vidOH6~Lnj(F3cz!i?zsI<20%Y`
z%f}8*&rE$3!(+$Tjs&xhDF_zHCZy1msm)v6F&;hE#k)Rw5ssP;s15P~Zh}cUU%z5z
zlEnUH*9;wNRdS$~fn6RVfAlzbWJSh6DP(J4Q_q)KcRRLpJrEFCmMnO5W!SjpD~qp@
zAPkX&RfyW52=Vc@0RkwS6<Ow_YYO+(To=Mu&O;D<A^$_AETs|FSk6xS^Y!XI>0ube
zx|02?1vE%k@2?7B9;Lojg1!O-X@sKc_7V%ceum?w`DqP_eIx=xKr4Yg+K1h_09ac@
z`_o#5M@ng#OToV(&PsPkKyg%{?*}EoQYXQ?KY9V~+C77$l?9YTw3+2Psu9_tSwcgJ
zw`y9p`CxuL*)^X!^X%t63II5YhE5`C6oBVCeZx24$B20I=2O2g(Z-j?t4C~M;2M!0
zR*NiQv%^`Up2dnlG0T9N81W}=-^73Y+4C@%F(6|-r%`H#6t>FFmsHukuJ{fa0@?|%
zG(`UJ5!ilKd<P;(Jjx2Ew+kp^Q`ag0>C!SJ1f{3WfUG1JDw(qMajR6t72(EuY^m;6
z0*F)>f|ev9auTJ&GkvZ|v#OBON=7JC$p<fRgrJvtj0}HwL8P%VC)=ai5FsTfguGlf
zvL2r~S(fV}@GIp?YhDX8cBckLYsCA&#gM2V(|G(M?T`T=0k}oT_piV{u~1Z#x*$*%
zLmrviVsVno$mw4_Quk@4nJ`{&`SP1j=Z{}^I?&EU`2yV&+i4vykjju>k6et8cW<ed
z8swu@7~6k%W^Vf9*Ie<JePFnjWzo<HN{s^WT&FKy4FGiOjUPQcJGcJ5lr8VK*&xa@
zPQvZU6<%D~`NUL0!v&MbTNdyC%(?cOd$%#q1q0ggH}?L`db5Y+-I37sB1Kqx+#&E_
z1pDyOB5iOd(OkI_9}rujrII57jyP^<4Zo*2g|;FyrPO54U_(HfJf%<VM~@YRND*+7
zlm#L{;(7&y2q!az8CHT())zk?ELRm4s*e6;QI^E7<F<*aVsC|RT}7ZuuZIS_YmgK1
z8&^uEFiwb{tBxZ{OFnXe=oH#QJu8*7a1c*niCY8MCl+D%EP@jP+|j!gjY!Uc{;Znr
zwp>E%0RSUs0CPF+J+z+Q^^pr`nHfo9wW|b1q&W`b6Ovb<eE)=x%I)wF%_9J8b7Z~4
z!^xKU@EP0BxwrVS(+K~Qj2Z>txlT?d5%DS8wqMt7n=A6cV$Kw?MRM{?G6(%ZMP<8_
z*g!-n)4@?<e((Lyr@N1@1I=0GH}ogAK_|Cy!m$K2Lx7TGZVbTXMJfL+P7qAMc?SE)
zQP`usBAQx4utKKPr=yjEOjyz}{Od#WsT$i{v7+^uSID1HP=|8I8bu^A3&|uVi=t=i
z>hqltvYLF^5&^0g&#{T^3lYE7jje1`)v{Oh8PN}tPgCeGQ$-2&CkeXJ#1=hyBl~gF
zN{WWU#S?zrxcek@UZ2L9)lLj91U)nC&IRO$R)DrC^834toG#xFMSXXNBoV4(?P05U
zsu;``=w{fTbn(akcrhM5I*GKKg$$eWUG$IFl<k(5_*qp)E_s(hHeN+yd-u=IOnvO?
z&;QL34V{#fJlhRu=$WHEyY3rq+O%VSu)6X_ZqIB;l9m@U-Y|50w2JvfmV=SzERw|H
z(D6weJ35V5z2pF9IET#*6BSr-d<t!y$dZ<gaujGT1h*}#5FQMk?*qmFv)$6diP}xl
z9U%k))wRGe!-(6eMoV9BJV;RJit7_e29BEgy?hVWr`#r|+M$|3qRcf0*v*qe7ntk&
z?#uJzRqBKltXni+jG03&<gk#4C*e|YM76l;r5Xi?bh!{eX{14<Gv;_O>ME|$?4mxP
zke^}|vUq94y=?;?WXK<1gk2mId;F!W_0vYx_27yz4ziChjS@u@xJ+@;Fna3~{K+RS
z#s|N67BDd^M%=eM_z;2{A;5G&35rlbKO9;?0Dx@eP=B(Ozw^?Uz4Fr!-+xmSFw)S;
zLX86Obw<yB{+s5P77uM5jkA}T?z)70u$N2p;lB!0K=LmaogS<Smle#kEuP#vi!Ojm
zFFAtNh{+!y6Cn$puM1fkTn5m}NJ(5CC98r6lhSIMAArUdw7vsMsElC~n1&BdTPqC=
z3Ee<eS~gCajCI13otp#Ue;hqPq8)xfT}RhwQ!Pm!%UY>+A;vutpt3!_!2#(&kaVOW
zcT)9BKtVPu8l&onMHXyTxzP#-)&5R3Ll?@TsLk~wDd&}I=3SN%X_he@WT*)CJ3fGY
z{5W`!fxK%fw3Db%f+_>z*ICVUL6_lddAA)A8yTO!Z#(|aKVFPplEF|8a=UfdkdF<i
zS;9(%^*bW;csmydF__3u)?Z;WJbL$r4YR-V<!e582o0UI)F=R7XS8Scz2mK?U39d+
zyzmN6y4#Z01eBok!q=tv4g0R8J*qA8f-@Ncj~R5|Lz}UFa~~I<yMSaso_|&ib8)<H
zS-ND7fnhn}9OJfvu_Xjv8i7~Fpt(*FX&r50BNG~~?0c`}#4NY`ZX$*)xo2b<c}5zK
zk$N~1Hfx%}tOZRi*LHG4D-l(1_*&Ib5aQ$k9T7EAn<-v=<C<}USVtgjL9Q{zkxwKZ
z9S<;+>ws#;{^`gEVmcwG&>M;RaJ6DLo@$?}a1SH|HVnIW8TP5A0xD=3tzSi>NosAx
zs1$|yuRI?FGJ}9Q#w|xT;8)-IVm!6jLXu`+5EqL*3ML_`I0Y5aVGRn!iRuLaCL*>L
z<K=^^6CM2N3tsWk&pm$sEsgbm5>ul9d>zsYU;5^w3r7zo!$JSGNoTG@WI$XZoYLx+
zNA9{nKE)IQ^L80RlY}wI6WsIQ2Apx`GS1zx3>p+H#wbQzBcLJ+UCIg>m!<CajFW)W
zfO})`@d0SE1)6FXN3;6dg+DrGu#&kmsscd@St(2+YgFGS#z?e6s4ij*WtmX2pb``)
zB};IEi*|A>%H*Wgf388<{U>J~uZ4cd=j**9z8~sDIk5*{ne(C#%1<ut33`#ju!CX{
z{V9Q4x0Ym^Bi*3>cP=Dn$ACvU?BfgIBRwFc5b0mei&Jzx5|5~TW#Of>EDR!r44YCu
z7p6EsU0_e%#jm~VMY#Q`b!c_RrNV9m{x2F%Ldmb2Yw<xV`Q>z(gvY((Fxm0z)~(<C
zd$(Qlfq67^Qd1KI`1M9FxR|cJ;@#QY#!Z)}yn4;3cU0u4iKClcShS3aL&Si~YZkDU
zU@gIP#yB+W;E&(`LfpN71Jm?4_z}zUD6%vZz*-7p<%X3K>S_L{W5DCANEmc*xv<WX
zqLHkGjp(aSqZXqZtb{;tj~LHPRk9v6AQAZ^6H(@2kGU)S@0t+{!S0)^Ow(GS?1Sj!
z?`sOYaFcSW`}vaAVNHb!84m%Kb;yAabzBQ25q@>||M+|$pQ2gCO>*c;4XL0)7Y-LI
zR=Sp`<+3C$Tu&W>T^JyLcpi3f0PYwd4RaC#?pdsta!lp=Q(H^qq(&OIaqH9qU5lmJ
zgx_`fg}CvNO-Lp(Fqz^W|4jYF%NZom*0AD4fM?lXA_8niwtwX4beG=y=5P4-yV1}|
zPmKcb^+t2+fVaJc9=-R<eY3Mue@~+$`||MsAmdq{w3!vfFs-*v2rQQpGg_T7?maMz
z-+kYU=!xD8%(MktalhyHTqBs|wmmMDfjVYZrYZF|m%pV3OpN@=<FHR1FHiuPG)N?|
z5fTOA-1utOr9z?wlz3hanT$3U%v38LWgnhqxPvQOD`$0M5&DOqxNy|&no|Yivb=C~
z`k%Z}Zm*2dWxuB$2od7~UYDm2%G#V#=&BLYiIrj?#$jzqUo%YdVpXt*AqZM1xwYj4
zzEm<=MGlSpsb%C3&jX_j)Fq`S$$9suJxYzmp&uf4q}n6dp7LHUb`kVv4gThH7ts5@
za5lziEi~hI)r5Q$Sc9CxCNY7aoD@3=5+1G|;kM~tJ-dF>m4E%`KVa9MgoaKQY7~I4
zH@e{l;4@c(h<L+kJFe=s@(<*zheshtc#QmMYqJ_BRl(#vvr4){eCeT$c*px+jD1NL
zW|9RXbWenIFHSB)$_bHOu3%ysLXVT*xGjHV3MkedT0#EEQP`DX$iP+$>qd%*I!q^4
zQiL#xw-UxAj>}bgfD|aQ+_+x<S@be$YuL9P6d7g3DmMYGeV=PXowA|)<^UpSURm{i
zPrVent`6tF7S^vH;z&7>$3OdfDJqjglgpB+M&N5jFMKCB)S~!72}<9bvW<p-c6pf3
zgGXWaEEnfew8DWtYDB#*=JHaMZB(ughqQ_JjCHfs5&(hM8GQPV9eCGA&%+>Lm_)9i
z=#)Q6RE%+GBf)PG^>e~%`4tL{K{oC&hV#2-r>Ecj$bDZpT)vcRsuT^K9Mr@BeEpGE
z^AA1s(D2kVpTB=~Y2n2dt<%%?R7Id`@RlkiRYJssJHZemX)zvtVm*#8wQ<>tk6_v|
z*p|G5!_EWstSFGQHlljqV-_N0qS&EWswas71{rXyUj*~bb_zyrIWXc199=hDvV(x!
zRZtxlQUbo#ry7-CEhXxF1tzHbO?(f>6$kve!miz%il3ERV2yEz=R^KhNGyifuTd$<
zRaP;>oq|(WT~IE9XM>}}J#N^XqELfnaZRZd4URyz{P&gtGhp{E!#=qPjPfG)gsE9O
z<Xl6f*K+-hP_Z^{-A4C&<#+?*&O;mV8}EEEb}tn{e;@)&=zlFpK`cTy>s-EvwU9_T
zmX<BDmHor17XJFQvo8F{eNWvx27V0<o&3}&0AGKkUiEMKH$Qjuz|IHzqkiwTXiZI-
zA~!%m%5n@O54kITrYPNRu<AenQpUrNZbV{$OJ8^d=@5XeGD&S@77uIQETQv=ot8}3
zg+4joyh|L!VA%Nq?8*pcrVW}%f!tO{B!-;T<(Q+gsJmK3MKN*X5&!$u&X&I>Dy#r7
z6u13pYM@YF+^t&83&A9faH61e=+UY!A(v+NEA-htXv$}Tt^%*HNTXVHbq!@@4K1LW
zLr6dX20%N3T^be#`ONo=5Ri0jAxm;{MSHapC&w&4$07LPDRIv+FvGZSbpw9+FD}Jh
zduPz<X2rW_L>;nI@nk?YtE$Ya4v~9@5{y^pk!A~D-gfF~zjfEmA3lJuylNXdNvKf(
zzRv0Xn?B3uU-a_5y`>}D2gA{eOm~iq(TRc`Unm4L1wW@Fl~_gyP%1YV8AhG}k37B!
z8)h;*@4R`WBkQ*_xySU*IENCT+!`1p08_nXsahZd;GBYD2w2Tvj}3}k0kiD_6|gKi
zh&4+kqPm)@165j}!McpNZ#;hSfbu_s!^Sd?<GR?FO@6Lobb*u*^|2ia<$x&5nT_?s
z;H^thzV5ExdRS}i$BA-kb+2GS*WUAV<K)IXRtmh;UmP~YIm7N=f_-Wcu%*?XkPo&a
zBc{)x4?fUUjHiDsNOeg+7Y(-oj7u#%ZTXSW4E?XaxC}Qwx&f`}kvsoaD?hF*)o&6N
zxfx*5<p?QZ3y@(VgFG8izIyOTw{3szCw}rLufO`rk2bLXbBG!RpdlRC`_SOj)1QC1
zzq;_UoZDN|&LqGr64Pm65%wV?Fk+Pd)@cp^Op>FQCAjaQEjVpM59gh=02&Knqd-t$
z{gV`=;<};;k|^5|WP}sC1WFAkXV_yspqGKBTA+!R@VyI08P{V_?O&}0C_YHvwA_ZJ
zEL!)h&_Gn`->9!Ol1}MgYR;(UCh<jB?#lhcS~(LpS4z@CRn#x~NF2V9???SwS&QiD
zeu$eU4e+&sCrKzt@_|+X!Sk_xvAu6$P{fa<UPTf*n^soBsF?^2a8H(>A`89ZO>s&Z
z1DLSb#nX8EyDp<I-M<O#=@GnwCd%?FLykpdJw!uCrBcFS-8n>$nJ`*8oOjLe@+~_~
zd*=uL_P18Q;v_Y6Qc<G-Gz0*+^wr;Tc<I=Ie9&8dHCi*1WYWM96*Da;=Jm?*@Ca(K
zeu#^7!AoO<yC2?+9ou_2@0=yjfC4`j|C4EP17j0H%aQj1J9Hr8p<eC?DUnct0IZI{
z$A*9<V7d)TjmRJ<MUs**VFY4EE87+eMO8v%nKSDLyp<+8S?7)s3WM4vsf_ce&Gn%i
z>KFwzpI%w1274-*tpf<E^ArsWixs5sfhf)++)Y8xi`@0$*x~Bfs3VCh{fOo+F+iHY
z_QtSJEWqwxDIRJkWqMxu2zgJ5j8k;s2c+g9`q#nh?vK|-muQNyC+XsUzxNWl;@0g*
zCr6Re7R|7ae+Yde0946y5h<f;-4S36^1(9E@W{REW@moov3sw43=KW!s8IkK0&o%S
z`mVG2oMYJ2TRyg9I2yjtwC9XxdMblh-SaVgD&R=>l>opZNh}tJExzlaE!ckQGM#<K
z3d}$Yc4;6ZuCgvIZ^^*qQ7zI4t(3titobwnxHwCI7l+_(0-9_WEYOER%k;=WV3E{{
zC~7#ON~@s@%Bog57Aah<we%hHubSuZ)~Fbq+CV(%LXn_DO(VSuCKCZk>s2}Dd5w0-
z7FM)|XuzTbKymQA>bs10m;ZOC{5cC5T1v;10NhH!!wmMxCGeAr;C@yd;**$iNLZwa
z*6FSNbqf7c0$q+<oi!fAH&m{_Nnl@R0>AUVOYq4Xwu3t3BImZtph<DQN4*x*RFRz1
zQj7A(6bP+~31o<wbIz9c%};dr_b#~flFvNx&>c<2zvmz|3P3{u-c7C11GN8^e_YwT
z?d&H9y~P*jXrGq0rwHz>fHhEnf{eb%LHsytK7<Jnl7wl#*TNn5o<iGC>EoQUmtaPL
zsd_gv0154Tfdy%uvS7Z5JOO%Vv+st~WeDJufMHf-avNsFPJwO$SkZUL2O^2?w{2<R
zTTuv}j$FgaP6j=Pqq0N2+9;1~!CK9yrWo;ngM+28lvCjgR{fXtX%|9mWIeCdu<AU;
zzerp|@71d`BorpsQCzK|B6$xp?7kK7<Hx~ECEVXOB2FPvX#J22gi8eSkw>C*AfWD~
z-tFM?M3q60m;m;5rtk;<a0xzk?RMDixIFg3DS0m06I3B}?<d!MQ*j|>F$MsWfo0Hm
z<*;p||FNxGxBs78zW9$TXy`dfjRMdRfcKK!_Zk4dhj0G&|9tGgz9)vm{?e-`otjS4
zHbTU55YSQ>I|k#k;t4A*1f>V-1^|+lrG<VAciguPTQ`ny-Z}F~$2q{J0QK2LH$%Xk
zDCKRW6nHKcTUI2XY*I4OXFx;AbW;Khz$>Ey5nvSY0f`j&5ezH^a|D)XVIeV%$ZD-@
zhjU6(EIbjUgc$qyIR`1LcGXGMiu{%6jj#p<qAc+bWwq9fgD$gf&B?xp`pTk%<XlT(
ziN}m;loENu6x<pp)8w~H^yknj@?8tyW4&Tef5#MXzZ+^(mMw-?Ln=WCYdw(^GEjYv
zD{%m1io+{tlChhn@W0>lVtoAiQ;~N@Fb3iXZnY>NcX}#lNBP6_BcWaw+FO<ngHeBh
zxPS1D>B-L9cRqa0V{6S|Lnl8q3P3{uew~0n0dO@vaQD^rtP3vL)mxgM8VyI6CY`yq
zF@^yar-})NjUan!&k2Y=2U)~0X@-Si8+Sgi4I5@gIPaWAv~mVn!TD<}X!6zzhcoS!
z45^VCe)j?gfxwapm)BDR<kq_dkQ&frtMCt7uHl42U^?OX)#erOT7(cXYd%u5fxR-s
zQC}+bbk=w5bSe50PU4H76>b67mAE~jm^JE=<;p(PWSA5Fdw&>E+#gw2xpBT2*7Em+
zK&?Uv;3GZcI~NMnhZ$%Ug5T9%uOE?c@W&Gn>jgnEiUELl=)!ddCK$WyB;N72m*P`5
zZwF5d3x!3c$1d6tD;%<HIVKVZs{<q0X_jP=jr(L*_aB;>X#MY(T>82zAAO`b>i4-!
zjRMdRiliP_d$w?R-(#cg=e}y!VCCq!S(aarbY_gSTqL(AX??h#BkQxuD&ZmPB+0Qj
zHn`)VEii4yg%`}z1Q^Ju6hDF4hKzTi+@emQV3dM1K>ZYizicAnz$;;|8!EO3j&ks^
z0qpV^)JZ^-X;Em*5@jDF4qNFrM-7o?Tg14l$bkDSVlwI~Qi2eXq^VpG<134a1%3#6
z^E(unPz*+_)YNra*W(3xMLLSkE1g7}uOSIgG?uP?u1bSq+g{6nZ6Wx1*CP0E4=%tj
zoC6Ud8*9#_tGG^~atIETi=eu2MfnVX31*tHGoQlS|K?JB?zYo_?hs^(L%N(BO^!vO
z&=wVNJO!~rR{J7`h7lRExux;q{z1z9zu3HS^Sf`l;r)Fy^qi(f0cfa}<_|rxuzvGd
zPmBgjFJfwKPg;|aJQ6-*$a4Yw9gs{%#s`Muh2fQezBRbxp;NFtO7Z*`&SQ!!I1@G~
z%V(ir2PFf9X(c1EgMlOjy+9eH<yO>3UJ*b)10U&wS2Li~0;bZ^Dnre7D~&)Xep{8P
z@g2Ub>ec7~C4qP=#ly)aiY@K%dqp5sd<1pq4Oi+>zt=w!o5i9p;`Um=LLv|0xyl9u
z)kU$lfVkMzks9zghuyzYSp3I&1(MS-AY&l3nlKvVW>Jjy8hHtPtPA-T*0!y#(Jod1
z7Qi&)5j%rl{;SLI#XGjaObq>`6Oo7i^}hcap&n1Am@|Rl31zx0A4H?&Bb?-mSFKyW
z{x^3$^2I}F=s8b~0?^Q!^o`&1QwNUif9m*fb@7#yPR>!<Vgf7FJQe^I`2fvS;ow`(
zl!||ogfRr+?guyH(84rcc*#-BbuwUBva4V=Dn?4O8H8{s4Uy*A5mC(-Dz|5G**WjS
zO{sWORz~2Xeem+AIQDh2Rk#dT2F6KiJ~sDdm9DXf<Zjs`@$(w3j;=@)1X@7*F_90-
zk#P^i0d;Fswq{`C8d?6l@TvwW7B$D)Bv{{o0Otoc0Kz=Q_qPq$0Nfve_bnHZ{qz0e
z*^Vg`1C`1WYE5~CwW6qrI1Zu2s)6yv#)wTcBxQC=20(Kb5BAsL7yt65xbFUqNTx=`
zG?-!$Go+%Sk&w6=lKpVw<Iy^C-MvbtP;^JV1(?y%`{rgQ-~K;7{l&Yl`19XDL(hF`
z6o7`-q=)aknqT;mx9nM6I6B!M^j<>ksWwppuusMZ#}NHiHo>1XUyYz`>H0M#+;14U
zVch@t2JGE4jf*c@z^3(m=8+-El)W`iuI4!4$*6`@<yMWDimh=cvyA9hS{^OjFLw+q
z42mBnTg6^+K;X2pV5cBBsl}-9@`}#DV()fj&3i%Uwkx6{z#t#<^@JT0ProNVj!cwY
zS>re7@2<oOl=X0YZ`sFa&8%%T%hLjblH`SPf+B$rGkAW8{K-Y|-WBl5sPO%FOqsqn
zD3c5-w!#U-#35U<Q7VoQYwg(&ib<p)*Srg5eTKp78TTCBh+lc<rMU6o^=M6x3Txkx
zT9ZoAtIPDKpf&<&Z6K<gMPCfEQIGQFr}oTrl3#k^B`^KlpZ@f>H-7)G6KWKIhMtaS
z&#t?MTeqF}P=9r4(|A0-*mR~-V|;kM$8QUm((z=CVN<~Gb%eUO!~Nfw9F*pGWbb<H
z+_@fSoU=@)Ze4{Ll0V+m{l!qNRyK63w5*Hjeu<6o*wT{qxI{vu96aBLJvIQwIjEZy
zXAGDkV6cj)YfG2p*g*07dKoO;4G^DW<t2W|3(cBwugf+VTfDVOP3Vu3L2HqM+ADGF
zVH}h`qk}H>7Edn5IW1E2@-PP<T!DRR3HhN_&^QOR%HLHIAGwF0JtC!ZF=$NPL;U4^
zj2b0JjZLI^37xAziwH=8@p{6wk8j7@-+38seQFNvsgZI~6&??&3@}%k=#<p3OGod@
zB-s={7eoZkb7aeVS7#^q&(FW;`R}><ioY46p|2Zi6o7`lBF!Ira&_xz7d<@cEuEW<
z^YfF=G%4t|*ti#%3j#w`!ZsGt%EEE?Fo+mQ+v16%Q@H(}Q!u@5jPuT2LYgtiin3#?
z#w!9cU2$lE2D~FRKpRl1O<J}IPMQ!nNs3(q3&SG7Y$Yq6oJ@<n@qlm<FzNyiy#RFM
zqUx*J5l8yTaGMO7bceZ+jED^7Rig2st#ny^)b$|D)zGQtu3d<}pMCe%Y5?gX3`)VC
zfU_K!@5Am{LcV7SSR56ug0=~V^^`>fksPEaxq7LlWkN|)zp)E4t@%wn8z3^d6}EgX
z1$r9|K6uMn`0c;D1P>pbK-wMoI(6_XY7ht1K>d+|q<*SfKL!j&w!9~spw*9T*|z=n
zZn@!O$I#H%6*US#Lthmw9DU;W-@NbggM;4Ei^rMW>W&VU;wlcB(y~A^<Zw+`C*+u4
zQErl299iw+=DW5aNi5Dge+d&w4jz+W(19sSJ1)TN6#f;G;Aw?cgr1^|ICpK9&rzAi
zmC{n|u8x2sy#f^&W#D!K>ZIT_DOxAD5|a8yUn7~uHf&E52yP|Uj%qZ!6Xm4UU1zas
zYqmC-P}H`ky;d`hPFa&DG{%TQP-x`yWk(HwmH}D>n=!CF1n*l0?_MgDu3=to@iWDC
z&Cp#R3=%9~*URAAiNhnp(u_I-^4m<~b*+Q{qV0qfx`Pg5aa{|4dBp|zqkniF4)+aO
zt&x9@qph`dgRB4n3OfM2Ys^6e9x>zUA|r#*$`MY+$FH89oBm%9-~XjuYs_#%&tYmN
zyrHj}zWK-gcXI#rpa0H<<4eDrOl><m?ama*R7CD^$8#Orsk5O$V(bV3T!9HYq2_$a
z#Dsio(9H>Nd-(zUmmhcl7p-3e=1K6iQus>Ly#}R~jJ~3r_>i)2O{QE4Xor-#B%TRz
z2*fCk8qP`yIMo4d>cVX3g4!i2keBzz@Vb+hELs)&&#C6OI300C-b>3ru5hjAYVLRK
z^(J+|Q<$CLV{xyWdx;i3T^wP#tuQH1-AfppTkzr-_UHh7d;sKmA;L>|-&@xdAbN7E
zpgiR!xQ~Q>5cNTA9gN3a3{|m?^t$$SI%R-MWq}!tym)*Tcs!fIyFPXiKJ<k%Fm8=O
zNui3^crIjHBPEZx+<ZwP43gwcz767C6g?(Nc-UJc(>rj_DVsO_?0@~^-@oRk-||Aa
zP#XF=p#}kH=&Pp3@4A}LeBPUO4VMlrj{8e5L2G)(ByAy-1kkE-rvsi@MwXw;HWv)^
zV9vNmd6QUVDdT}BH{$+>Hsh>wm$7xr3X&l}7Ue!}_C8uEzZ5s~P_wV1w5kOxtZo+!
zS?srVnFR}|*ZbIu?b@yYXSF5(1{v)9pa>jX8Uk5y)GT#VaALHj`LwBWIS4C2bS@Sg
z461v4Em8@6v@2pw#X$;A4^_+g6WSI<&&7QLm1i>$I4OPhqYQj}P;B3OY8iZB72F#Y
z$M3dHF}7sN{Iw8hPYA|S6DZO}dj%>?yYQ08(+a&ds@m&Rp0G2;-Bwg;C~UbS29R3t
zM&PD{oAGOZa~VE!%QocgF-*$3T?(hygB3z&qIK$&o(OHAGE!Fuof;4&$cC$+!GXQ&
z<|cpRq8D6t#h?D-zsdg@tEHjm5H$)wL;ox~wEOP-;>*6_vHs#w8ueE$Gp*?^nY3=F
z6JoPpY#oTuP2oa7kSjjOj|!x~v@+~DGKt&o-pZ}noX$CG5nWjDTE_}Y<1=EAQfPS`
z7@Gh3y#(^uSQgN+>?u>wFPviGghEQ*C(VN#SR8^6_X}%wYzu+cPC#i=SiZ&;fUt$n
zjZloF_y*MN2mrK2ACdS?$!KpaTiwxEd6NS0tG(tVt)argcUFAP;H438Xcczva*><=
zXdm3qi-%gqTl}$4JV4+=!xZ@(+{7rwQ1pd_P*=}|1>*al!uwPlL=fI&%I{2|F3_7z
z@tM1K;O+0a4EOAwh3O8<xWsaQzc0fuky9(Qo5Aa;vi)VB1NtB*s0?oOfujUNDe`Pc
zyt4b)beDg7+o`9%@7mA*?FbEh-BP0fH1yA=eNWyyy68o(dwjUMuwgJ5Tx?o1Eiy*o
z?tb5L`5h3#R$UGESIC0~?BV;Qo#9wNrJL?J1&hmFoOAvn*3FJ!hNf~-oR29WRCc1N
z7HD%(FnC{*cqAwQ{wXi~BgcZU$ejqH1fW*=@F0ghK7>8e10U_PT^bTbV-Ojjl@xzT
zX&p<Lx*QCW!FY=IOS4veki%0M2H#qTJNp1aQI1n;WV!O*(vJ|5{5k8sjL2^l`|dbn
z@ah=$NFR3J3hbUG@Zr^B+g@giQ}~?F_ljUmT3y#Xp_K&%QfNzZaw|UnNVAF11o;E0
zRKT(Fp{f987za!TfBK0F@qa#eG4}Tpw7NrIpF9#dRO<RsJ%!ROZ!RkirvVmA&sqH8
zx=0>n3^*TAzPx*JA|3wG=FO+Q^R8Pz*+WBL*YwW;3L9!j*_JPO$+w=l|Im@&9A@3`
zZ_R8;jWPZNy>M<oc{330YcGrQ&i_!lkTn1-d@2-T5SOmi9N<9<FFk98|MT}efHz!p
zh`K8b&M3%A4@q++=T4<F-g~Tn4}tUA&t2TWK?1-<hZj#0;tGo&{Wf}!aFiXjT*M66
za?n}?>b8NIHZYwQ2NRXY(|X5nUKW_k#>$VSu<{5(G{`<EBAn(}C|fb)@4iR9i@ArB
z#HGT*K(QV&TOc3347@Tfg7}6x*p@LM2H@0yjPqxQ!hJk}l*dL^UXGvK>c=&}hXgXB
zTm~}k!?{nGA#^K-h-N{hbiaN}MXzNso+aG&<VO6(2QR`^51s;^7$Z&ca()fC4EU3P
zj*tG2>JJf(Ebb41jXu^uXh-anH2_QooM#xX>={h8`R})F+wrUS-13no(_cf40?^Pu
zi{kadTQ7X$`GfiS-^<hWZ)?wNF+@bn>|?nq#;7mG3C}8QE%}~P0{s4M2j{Z|1IPv)
zZ0%<Ft~c$$kG<_7oZjw%mRv9zfw^!J%b-9mr8>JvdFgxgb+Tv1zS>AGI)=<j;Fk=X
zSR0T&D9kApA>oXIa7zoHZ7JAosT8E;5w(+P@i&!%x~Wfh3x~kivTVTZJS@mY5WMUN
z2}ioS#~n-Slr|S<VS>fV<vhSLcx=HVTPP)&1^36Wt7BkjfsrlpByj1MCKP!T3<V!P
zLc5%WTU-<F58pV~)G%IZ4;;I>@i0l*6#=Zv&;}`msiHavMUTaLD3k3tWrT}%n{_#k
zn-)HL?b&$OM=!vWi)|zmS+RYQUHWVT*%i0iDpRA}JvGn;2Vw8K;=9LOtaC%wT8x+W
zjHWxIkDq$_xxaMxjURd(4K;*D0chxJK-;!o^1Rjl=yx%(<*n_Rt)|%a9+(wr+2{fB
zfKc<(uf$3s8fPy7L=2l7(6EEoKko>B>iZtR%g#N*6U&ykpOnltgtx26dGR@%BFO%p
z0O7mDXpxmEPyvB?h)$DlzVrr2OH{(Op<G!T`R21Nge~&W95SYeALu4PCjr`q(IPUf
zBA$Q~Q^X(;l^GXNSlr&C*89}`V1NsOT`Cksy%s#q!6OSEl!ASf6>$us3^vzD3lYjl
ze(itvV<%iTWq7(D2Nov#nz@P~)>-Mh2;mZ83#C)IDknuo<;es;z9kBd3JOt?xzdI?
zN`QQZaqp2iyz`?M<I20XqDMKBG!LuQFA3cWi9k5TjU9Zy=KB!2AWG$h!+<h~VA*1{
zwBJscm8&*y+4}Pj-}SkB(NIGrH3~pOUlZE0<3*SBSNp$*?$$S_GpCXlnk;tqQvlk7
zuw=#PSxaBfn6-`&AZ=y%4LaC5nc;`N`7wO|o1efL6RW_Y0cWnxpa3WvI8JX{c`Ksd
z6}lf_@p_7U=^U3^R_IU(i6(@N-EbM<JPP8Jg3^6JwnPnFxz0x{(#jGDFeT(J;AY(u
zfUMBD90K8z8L91N!HOpb`;)6%bPEsxigGNd6k0VuiD1hLp6~H-Rzs*OEY}CG;jW0s
zw0cA2N-4#-4d+*Y7-SfjusGK0@W*dFo&Nq)=i{-XQ%EL;ASzHMhEPl@>nvzMZb&Li
zE=B~(`E^Q`TvkEHAXv*hTHeoXUb<%8rj0-M#Qk5q6Ad*as0jjW=>L(n5b&e)wom-o
zp~F{v<iWw}!g-eIOw*e7B3!4SCvQM$vk)Q{OM$)e4v!xAt3uM4G{<sg__hZ()7=km
z!p!<HPC0EA-NXW8BMn7es7R(#evN7-phm!Z*xvcAr3I#*pehe9m70L;27gHy79-*Y
z;v<(u_sauaC@q5KTnb!D07@ZZ)=IyyWsr{_U~pc>6Xd0(Ut0VQvL=JFtWZ9+lHzkx
zTJFa9Hpa3Ue$JfGDjOsgLg;xI>v(x+IW6wh=^N$b)GVOV4WaHA@tc+M#Xx&lqtI`u
z1B}-Jw;$Yq-~YfR^f#Y52Zx3RNoQORw~JnpDu&p_;QG%FsUW?~T=1WNCajV0F^p?a
z{0tc2@ybD)WXErqnVtIi-49=X2O4T9qDBE|=>L&M1oZI0dwzj`^N(&kc>9+>@z9{Z
za;~M;nWi;a#Nn43fVLf}67U5CH$lPRSZE4DC=kjmg%0Em2rW@gl;*tm=oDRj^QqW<
zU<#YJ53zB}04XeNW?Tb8c~KZbQAgwxM^$kUG1xMWPPbL7JwXA9yc*sbkNCW5ER-Cp
z)S}BP$DD#-E|36I9&=m--8tm};u<C8{(ARYY3Vz`86gJ(s}7x#)2iF)H6GtC6@;f`
zAXj^*#wA=(ZWAh81GI+kK(8nc<D(V>sq$S;3ub^43(Q&Up-KGxRp;P$-}6G;x^osh
zk%3ZM#GRB$CKzt~DN;Pb+O6wbP%d4YLm;34$igT&C6N+XYcX0r$R;~}{lvuN&;QsD
z|IF>zUH1_*)KE-~3!tH|DZT6OzF>a!SAY3sE4|@wb9=+<T9fO^P>_xa?u~ro1t0Ut
z+o0fc_na?-qwghq<kDs`KyD3qXmI-67~l2Ar|^T{v<qiUt-{PRC@%zC0Zp6W;`I#?
zK8Fev;d~Vi8V)!ti|lvg0}h0I6fWAT@>1s~(2ftkQ$c7ERgXmptqZurM~Qox;`$Kk
z5uRn=w*rpWaT~5RN=Tt_75H6pA@)un7gEB7U<Vh)E+<q%*_FYI$H${D5NHY`1Ukq<
zt8RjLWjO`Rxgv@x^1{6_OIS8-TzB_2y!VRpaMNS67`JTU>t`RC;?+L2W<qG99-w%2
zyXKM}ag=ibcHmGr3$xI}64)FVE$-zcU$|~^dg_0C^sbw3fAxm?EFBFs)F=QAea-1#
z|HSW`>#x52mGcY7|F`L$^4iwaW*=!L;-IRre==II_#pVQv;{c`YDLPH1QTG4MV=X$
zej6{^v5bH79gpCxm+ip@n}JtN0fmELD*~~mXax_)LRw1qxE!k78n$_n*f9_d5Y)NL
zDu7WtNy4ajH-}V}yix0X^i@NeMKqb-0_VaFv<t#*&yzMRR}_-^aq?YMGTkWyqKvw2
zqiQmqMkx@mjZB%lCMlhh{gy-*_s0_%`jZBC?K%bT`|NqR`p#3Z1fbQ<it%A`ad(B)
z9|BC&9J(=cVH~POQ2=F4NTLsDB%)H;L}~dG=Q(4vxIgb;@%owRsbAQ=>!w@LP(x2c
zjRMfn*POPk2fgKo-jRIaGoN_b!otEk%;eVBx2Ct1xWBVw0Tn=}O?hvP*9#MZ%TgzW
z6_=7tZuui2zOq3JQy{$QlKuF>x9!3!E;_<9{hWB&fZbkt*DU2jj(h}CFHv=sLQLc~
zsM>JQj9!*2^9ncvF_wX@2(L7R`~?A&(AF&50AYKR9zoEAvR(Tl!&?e5F@HodWHGjG
zg<so?J6(^~0EL41mAI1dgT$yr^&XMm!6{s<@ea9F5a817QMwV@jPVTN;bSxSrz_9K
zCvVt+gS|GWlY`1=N#~{t3IGX&#w~;}uhm@_)#ahqg%~P!i$S0%L<ZJo7%uJ4yVSd8
zZr$w9|J{Sv-1!F6SpE$?Jv9nILtk^6o13F;8-N$Q?a%1?%YXl6E31Rwq{;1XY)x-5
z1x#OOi$&5mY?y~~3=7Lj{2EbUyrpelTqOXOkoOHXPv&^bD-ZDZf5R?%(W%EVF<|hj
z5rJ4DY^xNSE^RBZR!wx(Qm}+>_~>}iM7`ZF8j3oj7Xj4{Hf`9vC{YF16zxDjkoZda
z%MFl05XMqSBM@3k(5Y)xU)ZHQU>3O*+*1+46AyxDUHB;4>4YM)RQ$B<Ea$F3T#7k#
zIrM#+A8(c$m<dKcnPb<=BtCt^nf%eKPp8L^Ou=?DBxw$?2?&8Jxr}pRfnX`XKL(0a
zQ^iHq2f0?{`g4yN*gV5{Y450;4zF6japSK%cHdP^w0}ci6*WPC4SmgNI2_W^34=$o
zDSYS4zxBZGr|!RR&|f;+!km?~rfR*qC@s`j?iKgZ8VZBlNI((PDuS*GH@|1Drk$Z@
zf%_icNY~tQD)t<i!tALdtUqOl4&`8Lz?O=bIdT>+`FiBmL*0*xPs3O0Qp>8I)Je=z
z!0AYF0TKXk+bRMy9Gv?G-F-z@T}>120fM``o#5{7?ht~zyK``t;1V2yTd?54-Q6w0
z-Q5n(CGR)7gZl^WUVE(`^`L82byb%<5BjkPA0E@`dpO3WdRB132<<>hOq%O#(>@uc
zpcj)R)B^4WY{IRFUm2g1YVebYP#IpToKewm|JPlp(+DHJm@A^Kku5AC(Cg8|E7&k*
z%#kNHE)Fx@0mc+>(`Cc77P>I&v+CJpMN(dfv^ldDXF)4U5feVL1o}ZDkTjmfV6}~J
zp=U_xulMo_Y3DOLSi{z)G~e3>M^^lu?e`9-SDW8y{Tj;ic5+9nYi}Djj_oD&$iYjV
zuZ30?qlsJR;jFAC#|E_klNGA=U`5w$mgsB$kNngjEKKxk258i;cG<)`gv@L47rtv>
zn{R_ZrxWdVBcy2XTVrK{TJ?gkt@5#k*Z{!i4~_{`!BUH=o9yI)mTP?{L*!e7s|L*O
zMOrfBU9r3@Tisu9$$K)UhMaK6EQH`To;+@Eu6fK0!1OCX&qB~GCwR#X)Jqg;L}Tb<
zy%rwhRlE}1>k$Tx*{1*~Ec?VCKe0K-eb!A~%}cCIa%_^NqcWDd=#x&Gx}wh0j0gJJ
z1DBgfqa>jJq+UwnZ}Y+c6~;q~Y~Ai_WL$2#(Xn&O{(c+xF<?nj0CVqnSW)uNiR0%R
zzP-jz=f1vG3pfhYb;aEeI?DfSY)Ir_RDGgLYv><<-tj2fi+>L|9n(nIbBk{?Vjn7X
z72~opwO!hdW&Rr;a2Lz(Jd%N!KE`ge04O9I!2&U6G{cQw3mIFx(3kRCaU<D}g%8@a
z^W4hzUbErFlbbxMm1LwGqBgX?AwpL;WVvO9G3iwhi{eMFz<}F^M@uYe<j}B_PFh8~
zUkAL6SvMp^%iv@KwCK|!A*dL=^*6UdPA*%RbA#wReF@x2&VkCV6lX{XuU98u3O}nu
zD^>N_+|X}?rj14A(o+lb#X}LAg_zfMyoR?iK1;7C3xlgKTJ}B<O{<8%EBs3pzYSPJ
ziHupkz{ccybLToQ%1@o3hIO_7aO-O0thcALcJosRbh?I#f=;3)Hz+bcC522zLswXY
zMjXvWUfDhkT<u2D)!G<&T)-v$>G&L0a#?;rI!HzGSsTJi4S_)1pjkp)VggkfspZt2
zC{lLgB#IL6<q})|$KKqYpxh>qNg>_<i#c!<Q_rjYG9$XsmAn>4zq)mw_!bC;Quk)g
ziBS(B_$JZ=%d{UP-$T1f0OZBg4a5M@Le0fU&JF4-+kI#RKeAz~A3X|_Vs9f`QKiXP
zu2`X7WStU@Tx{1bu-LE$y=80^EiEUs@UHQvd2IqS5wnjLm(fGgb^gB%U2Vp5s~duz
zV7CgZ()@SCe=^CzZ#@L|#?1xNS8wCC@7nXneRKtxR*2v1jNDq6P-R=Q;KHBF?uSTj
z-VpFHR~BDO+rN%&a?&*mZ96fbQ)ua&sX5fR8$)?X4a2}My5TYN*`ho8EeN&WOFlbK
zwyOX32B5-aB?(iMY;M#NS8u&&i5ks_+CPq#LN4{l&_oG*GT8LQl1xTLem?O9>xsf(
zndr;55dP8;R@8&xff*N9Y-{w~g0{56mS+5w2*UJif-lIE!w?NS-kL>D0L()VevR>a
zWpeQHWETo}Md>{1nE?G>3bwXnk=3A3!ic@H<W$@AW?fQ}brrl)3FrW7#QK$<aEt_O
zLgEb3hug97xlgsau?N&x@9f8~`OghK{}YY;|3t$UHk}Rdt^jm1d+mW0gdcZ5Z*Y(5
zz9X(xT9#ne4~)3f?i%(9mz(9+pH>8&jJh%8KOk(FC*vd9U-1`$8ZrKUK}>FP>M0v~
zykq7Q*|;4QZ}uE={?%mq2Lj?V0zy<sqv_m~E@+v$5(}`Q8A+$|owa!3u<7y3p~9(f
zyx;IIqmx<GNytf@{WA7HA=l`M?2lTAtoU+YE@{zuG2V1&5e_>tV`Sh}WcU%&_>K-F
z0J$*`##Cew3e>Qz-CNGE{HWD^3r+TeZeY7D*xal_2G%?!oW`3Jh}iS~UXut~BH2^h
z!ej4S`NZ~<$dpGWYyc~ck~D=X6MbYIKuzL_nRGnS_ozHJllyHl<DmU`%<$#bF|NW<
zTpZc&?q4t`NGJh#I8F0+<u^R_Te((!Pm{9Phpx<E90aHlVKH;@rO9eUjr(!7b0c7v
z-eiYOO@43!$qfV8tS3evAjNXfY2<4hdbbyFi3e<%SHhRt56P6W&rRv3L@Pe=)5R^*
zC&N#zL05a+E%8L4>sOH5?<}?nEGEJkWPJaTh`COJ6*(G_!pPZ4zDYKG!)X&w_UuV-
z)j|HNeY;bLZI;@sN6+paG<5R=$EYo4@AtR0p`Xrcg1XLq_A5?HRmfTdY;_uO6wYg@
zUbkyR5l@RC<|7N3Z&GxC{3+-CF+6n@l#po@nC`z$Dc9>;3tX{6LcBAt6T&ZZ6(rA{
zj+xr>f)1r0C4-M<x(|e$b@}eDJ;$fTT%}y!>!2kfA>ZA1Znk>Ik3pC-yd<`sRE4@*
zzBCQPz-4Io!kSdzenqh&xoRbrjA#{YKr<^23yxO~*@?$YEsmw#`3^Sj#LivypJ?11
z-uO9-Cz+v`B1hw)0+y3d_<=g7*iWH7ZB=fN9!_5rsUQ==njflO5aDV+&2nDdB8XU#
zN(KvoV$qRpAC2HRkXUh52dl6_G$nNyh?{ySs<)J%Y}l_+OyNSZZ|a)^mb~A#D_0J4
z^fPP0p13;{(zB!ADZKJkYXmTZ%e@glFKg(`8ME#~;FDiOm1dpd4%B%<kI^EV^9?%<
zQvP+m;Hg`G6Rc0F^l)7Medb8od@}d^5#Snr{?CRe5%zbOUk0VerPtpN4v6?%cHiqQ
zp2BC3zFO#JTU%&#yI@U|Fg$FQEa0ej2=jL`ON9FP<PrxGLmnqzENb5=@vs<4!?>@C
z!tyfxS?(Lao!p6KUXDM=^+D1t@ktj&Ij77M-O{fi^BB%0{r2ZDt&V0^ebkbO;et@Z
zy5hM!ApmwK?fE)|KG<!-gu&b{L`rfMxhIOMcxJeU8{aR`h%;@6x&E#;;v8H>C{>#>
z^Ez*=vec`D7PoIt#K#w;OS&49d9fDu?BURTzGFX$A^+3d7z6PhEr57Y#9uRboC&Y-
z1R6IyUNeFt-|E)a=Ac2<pc4Ke`5d4XJu|w+8XLDUXT9aY?74m;?7Fi+dYGRd)*1Gn
z?Z{IohaEws@6JuW4^9+rZA!zu_QZenczu-h=-?LJL1VWrNqj<qaOFP~OgBg&_Ihg+
z8~(mrr0-&dBUX(xd-G`7U9(sD*bL1t$C_mJhl9I&jF~S?KF0$oEr&bawTa1ebl(aU
zUw~{k<0^&zy(^qJw5EL6Z9zBx?{FrhJ9)>+zyfeF7!6(=BUq=O!xJ}#XaghL5`9iY
z=q%qV%-NKL0|u9tIU)WSz1KX~E+6z|ltq8ASsaf7em~rP^{SswpwU&(q0R9#$*N%Z
zfB~)_%&a?1(mu3_vEpBw&sf>%aLx~T?rt)g30gROPaKJFSlGLtKiv|k|C}Tv1t&0*
z>Tx!LuaGkr-;Y+G>MxoP_PfUZsgCLYR3{Oky9uHhQe=|ZXJyJARnULx#HWJ(y<S+(
zAVtYhKFJ-oCe;L5WIrDjspSPFd7RTpD}W|O0zr;}uTiPvq7w=2M%0E}45hOsaf9&d
zysax4DfMvuCu^lYoz4++%DS6Ndd-2+Q~Le)_G6&^K}v-fMk}~<=O79e%weak9e0z=
zP!~+m`7JXM8GFFxr~;mO85J}*2(I>Xd4p7igEcyB4}{|7go`PJRgl4F)DGZRn9s|q
zbw57kB^x6{=^JHH{psL{TnqnswY$UKe4dZ&d3?!nPxNDOn?-Wg#EBk?vPGIJN<=6P
zp;?6d54}1@W12i`-JfEh_S}$_;E9sP_;Wd_99^LTOigP27Di#fZ5e!0R|z}koo1Vd
zfyejb_(;1CXJz?MT1uZ(!(OLexAs5-&l`^~eb3-`31NBvZUu+GS)e7}N&A<K(oqHR
zZ<3=%oW%kWdGxro7fH_%y`Tsq=U6#ZMtNv52eC2=tiJ*9iv+u-d5SP$@FkUmTaUOz
zeY_=%Tk0QcoPBiq4?I&pKCu-YBZ-<8h(UnMwKG&*JX2D>IMXIJSqt{WV`GSSVVtq5
z4r=+fBorCbR85lB0HYMo?Q41~8?k_rfwc)Knl_Mj5Rw-A`G%TNim`XQIiz?21%)K5
zx3X<<=Zbo1CqLWukC!JTFXrI*CWrKLqW>-0K=p56HS|I)-)x$nf<%i&0hv%hQndIN
z5@=@}(^wNVH~3~ZQ#>;o()jPyBxjWFdrui<=kL4+xAj$R_sd|;?*ZcP1^=uryXH1{
ztkduOaK>+A<K!k_RM!=^iHfV3N)a(yaG4ESBFsrbb@B1JbbsiO{2PIaVo)zPNxwo3
zTSqq+5-_ac(=PmA;U{Y;tqo`@YH1$JXP|-ij6iOkeMY0>`BrZwz19*jd6487q;+b@
zpb<Y+4Q1NSPc<nmqqE6!Cg}7a#3IeLdy+)e$m`93fk`YDF%F9u6Aw!f;#=~GQx#t^
z=c-_16@))H-%GmjLbKqbUr|W-IKn%^shzDhIL>|TpxjBaq`Ec+uON(Na4Ov=sYW7^
zLX3<uBv3-ClRqB&{$)+-!LReO{`t(JwTU_JCNChel6fLAbH07ZJh8Mr=YSj*0sqp>
zYoDbF#jfXZ<Pt&mh1d(*U#}nW@dpMF0bl-+ZWkC=2X#FFY>pT`<nNxG;iyE#HC2?2
zADAwNph2DoeNA^}ATx%`i73of>-ULRla!9V-|Iv-`80SlId>h}J;f3Y56EJd5X2*I
z<O)d+vG-Bc=Tg$nYW!exIzn%B&>J+jWZwKmOrO3!J=8iv?wCb1qrfJGh*J|d0WU!H
z9eS8;nC&~heFy)E?ttQVsbX?*cJbU7Yab_Aa%{9uP-YQ;KBKQi;06hiQ5M<|j4(xb
zaf)<Okds~Uw*^r`#AtniT1x^{0p9448+I-2V<T_^Q`{W}8F~7A@GL8hardr2-|AJb
z>H>mXj9pXzN1_SXZw8~M|C16!jwpNqDmk)5f;dp#RA2BH9h?{O{2_s2G8rjqLL~`7
ziTmSZOG`%AAJ0+Rv<<Hv>9n^2gP&mpQUCg(`M%JG8nMpZ7~bobkO+b<VZC3k0`l%#
zZ)QhgBU#I)$nb<^fld?bprZnFYDlQKlc`EKEZyEOsbb7tSy+^CCkgcSbZ_YEp7g&Y
zEDe?m7PyoX;#Db9XJqlh0+r~88e7mOS7(O?k)c2(VTU00am84#mD50_mETblCt-(;
z>_vmUcwwwK*1a<63CXG>6fvO;G|Up^wKOPAU!&sqH3NMaawx^5LbHO#G1$0<$4Ja^
z@KC>wGrQGXc;fmTwDB}f@6F^Xj>%*G@v%ZsCOS8&&Fuw>=0JrY)xgNC@Fw;{Qi_Q=
z1!s3t(U_2<shKeHnOC9keUE_oRt9_(Nr1;N*N}N|LZnL(!Po9}F&M*xfO$kpRm!-u
z_V1a6g6a;el;qNbM2#cKvD&%5JK=sAh-UKn3-x{r?n)38zt9jzhOqi~o$1jn?%Ntb
zkB<X1eRG)o7UDrDB%arM^cC{L3C<_Fx=FhGiRVaBpe|sv5#_zUcwNfb_3WFee(=GX
zt>myXgBMK{HC(FMmFwjUtZ{$wDK*QA(T*xQ7Mw*5bUN}MDx*xYCJ`<w6{SNwqq=Nk
z8<S9nmELqBcx?p*i}WLl^fN7mCdQxqIF%IQZP|r$b%!7HqmZge<gyuxy;zBx_*(Kc
z_}>o#8$w0bd$-AY#F%@o3=nTRa5SW82l2_9X#Y^*#lm%v8=HSONhc(OD3z3%HHnM(
zm5z9y>X(k3LOn%K9;h%WVY4INtyA<aJp2Fv!*b-onP7<qQ4TUUh0>|WEEXq=teG^;
z<wY>UOJm_OvSp$Aa2N;*Sbe!@EITUeTJ}B0*Iae&6Xt?_{9x-<`6z#bOy>3{LMb3n
zNEkes*|Xn+m+TGnv|i8OzP|}JEa@kLmYNh3BVru^pPH&k4ttHqehAA9z8^zDg{U(#
z$l~LZ!g{AQgt;QNTMCNdY+Ffs5J!X{42bWMbN3Yd+GjQD#`uNY<NnRx*!P;$q;fn$
z|3Z?*j1~@A1<sZ{@XP&AD+}}nL!y{|mY;BN6m^|U2SE6hy{zi?@#TZB=t+mlEIkX8
z&?y?4F=<3y*91dLWWje5E=5iVg%VK(09lz$>29cNUUaPT!PGHyZjqe5WN`ce9*Ixg
zn$nwd-;>+B)7A}>|LIrKH`C}a0`JuSOpf-5(eX9@Y{*0C_GMsTfE0gu5v*$2w+J#x
z9i|{-sb#t8n`u{x=qRMA=>Wo&lUukLiqwe6w!#-_l@*QN6^loiQ0w{nLgeg2Gb(6p
zP+1bU-Q$&8Q$ib)!VW%Op(}o=LIG~vU$Q^)Kx!9#71CQaFHf4E{kolugq=;}ki^pY
zBr0&CLzT>4?N$3VXI0QdigvtIKn<wy740&CTU3Mxt}GVXuA8i8f|rn?4`n~z!|L)|
z+0jVXveWWk?lo8ar1_G3%iMpDh@?0Jm!s&ixuc!IOp^Tr{d;@%Arw;YF&oFr!ephc
zNzmd{(OL#@B`21mLj?f9f~-w8kfdlv!ihmCuI%&A=Y)xUf^8sso9UY}?{H=^O1T}D
z<{8}>>wZ&xvmzhq{KV3e7}nSEokHJm01Q!<1-C{0n<69CYhoIHiyM`VR}GDm5@drM
zFE0rn5!y92O*6KAtoE2Eg`*Pz!Yvy|13pw^{J2mKW>~@;Wi=)vtRf>NGUR+5wO_+o
zuQwk{r9W>wxd|^jR{luKS$_NPL>X{^&Kp?&OcKA{u(?zmoGw@MhIdD{W4$Z|yF;pM
z+R~fDZ+~$wo;_B!C|FJd#8t3%#n<U#%-ezZ)By5naS=jv`eKQaVe#1OFTU~0-z(;I
zKc^Pcpj@-hACWsFFnvPZlIO_ztk+MPsoQYh07UP;-S$xlmH8y~oxTfZw5bl}+ow=8
z(STj2iK5VhRoO6e{!irvSi)YjdD6UEaV9hwDiUDuzVu*~01GegW4!ChqTkDWY?88`
z>s|N{JAdSCmH)zqeh%^OT!1HM;LYR2#`RofiMz1>+wts6m%$NgC$loul%2AJLgFG8
z(faAjk`Ue$;vm^2=r%Xd2OY1oz8N{$;0tSJ?s<1+Q~-Y~5y5ViY`mLV-jh~5!*CG~
zfw9P)(ALTQey45ty!Q*EsO+VN(9oTbVlE99dN37eM=v5UMLmj3R&d18RISrrf}dC-
zllIvClFa(OOBWG=k{0sq+L^R5KtR6vU5%cTG&?)vt-Ix83~o9l_oW`4z~=B%(Z4KU
zi<kjX`xfK7!*yASyFp`J-F06fYiFcxeF<guo$T^Cq){Wn9deKLQy`(*Mx52N2;6-|
zm%gB!XyD`Aiy9~|h9NoCT2JWFokmSh?7>9hcn2>=N~GPijY_7#0@X)Q$PjBc7;d2j
zP~3~QJocr-Z~|_$2TLqNY_q^tcACE^UZ_g0O)yH{8!1C(b$=c<9uJMZ);wB(5O_k`
zRHnbqzN9F`&&&GQGp8(k6IW5?>$r2^_#bTOzsV58X1bEx=LXU&UjK(n`ZUedE)R~M
zO?jLhf*D$lv%hUa*0d?G5}jNZ#7~IVIsKjO<Dpb}yk5nmQ!!!Jpori<t1cGD2rN-Q
zN3w_`Y!v?CM($73a6C1p@uwuFMkC0RDWtAr^Mn>7yKYrH=iZ9D67q3_OC*qq)Rc&w
zNg@~ZiY2T`Uz(<Ei0+F|6Y-XKfrd{Wr1T+(_a1(Z#y1~pYm<F@{EN&^%J24!-=ycU
z@T^H793V~&#re_EHT8w=4?p`HqT#*Z2@Y;tJE&plxpOO`6Jlhy?5O`qWA-?37>mTy
z!o(zDuaW`UzyW7N9cAqr76Q8>>B`J@_x**ObM^tJ(~{Os0)l8n3cH<Z6^2|{Q2JXa
zpXs}B2(U1{&%G1l2(DBZ-k4z2V_Oqu8akl;f#it4N|edAHVX<e4gVq7{ii#9L{Q>W
z@{=qr+b>nPLWi8)a5ka9Q7)~<;c&m*kOA~P`gmo~_<<!=8|g~(`Mi%~$DOz$PFI)`
z-G9%r3W@Fm7C|?}))CBG!~k&9OOEhEP=={=oF3mPxXYAdbOVyznaRyUSJo#g#(CZM
zh=OUrj>1ZU$k2HNk=?RVI@QW-W>h}HM&fSqFei|IxYc&7Tvj#D1+HH|7Ar9CPlOIH
zjX(ounuXh5dyfm5USmg;ZC@b?)_~5j(Rdwh!W;Gl$Mj_<slWYv_@?l;o#88LL+TZz
z#~N6EJt91QPpi6>x6|G6d1~dg#<R|ouFD*VnE<HE3xM9@M~&$}5IJN)&B#D`h*bz9
z`l!OY{fvyGS?;&X{^Q=>8*fC!jaojufRpq&S4AIpzO%_*ib!FjA)FOBUb6ddfL}TK
z)ljc=wI18`-h*TaaTQ)#PfLZi<ZNrv+N6%u`F0+;Q{~hl#OhAE#d2qaU{P0{X!N|+
z!_tty4MuS(B|x0u-XH-;?aNw>5B6VO_6A7uOxz(YoSZN%UeWv-PiW{p7+9b<%wNxl
z_O9VaE9+XtziXIh_m+$HtDbwbC3gP1%N1|_T39zOfHpuD?B>|NZX?<Ml@l5Lo;_aG
zz%xUn{FdhCcM}~8>$>c6h9(oct-smR(kCgP!r)U?96}K<e}5)7`;4io`vwU}lYW4N
z8}TBNt@h<yWfFNP`lKm>Q~tfNo6T&skcQ<tQga$YLsd=tEJezuxIbQ!<(al<c!5vG
zK41?`wUnD;-#B12=OpA;I-QOP`is>XUf5Gc40(4=1Ml?=-Co~7!U!zvGQ2}(`k}9l
ziOcq~rruLn$A#Y%GuO%^fw$7XxaHPOdE;S`RDM5x!jYdX;GwwU^}`>9-Mg`1TB_K#
z&K)aZ7TW`XXa~n;O?1<hTNaEHp?UFG->Q!(%^o_g87Nr1Mrc;C(SH-`kkLVhV#O!J
zK=&*)6qYgp5Fqg{5kk%j1u!%Rk-a@+W2kBn+jl(iikY@9s=t!>Y5)@SS^8ml1bUMl
z;H9`o$OsuAwJ(~tW<IYucrVP~uBLI>@$Kc@O!E0`g<QPGQrSC-PtpFf1OmDvOfc)~
zXu#9b+}Kcj_L8Bt-<%VV?;OogF;~W)@4qc|tSu8qC@6uG>mZHialt4<dhdlLF^#BF
z?^<&u!h1<|muE5`Xn?2*ol!p0`OTNxQD-ugUT4MwxsKUAG_@R?&HP_q`=_5#$^s?v
z-I$+GBmC${NlVEJ@BE71-@7_|5NqpOA$dCQ*Eja`ED~keEZ8Ck(<OE&%YIVnAR5>(
z{tjktq`|V2_bbJgfBv952~P!jseDwlkhO}LDP`pI#jK-C8wTWSk!J?`)2*^7%o1Cu
zTqhryd@h8tZnAH(*(39UX^-Av;VmccGV#+p?hS0u^pC6XRtxepYqZ~-(+UX|kcaeg
zq7;=PCvXUYb}@t8-%A(hn8S=OXC+U#NPLcz`ICYSf$}drj%WbDH|C8zvz_MQq^_F{
z-%U%4_jAFWp?KmJwz0Zu4uTQ4Nj2{1GG<QWwL=z+N)T=JdInMI*Qbt5RTBT_!S!pa
zg~!$lvVuv|HJsMTfPqu(6loKDyllCY;9~KFXQujQWj77HqP7yh3(sBE#)5Y!nCr8(
z9mtmg){Y2UnBecKL%juw{#_5%Nz8(3<xQtBs<SJrR?eIO*3(Tb&A+zvUHImNc<B-^
z%9gfqZ5FoDn04BYHV@t|Z(25_fJwivw*;g=qAsSEBERd+AgH&<aIUfnp+D4^!oz!4
z;hne>QwnjpJiIM}V=u_E`;H$V5*kznKYM?m?2w~l;&?sw3|vf3T#FczP(J%Cwu<|q
zBPFk_7yXu*X4Iiaej7M#Nv65rpAnG<Z{|3Vn;O#PgJ}Ik<=!pFHW@k}-qcFqYj{LT
zniprIVegj{uEU`H0%C*;aPre2Y3`BFDYQnv`Y-UJjy5UFg1FR~^wDZ7e>NS>cvCzl
zCw3t*6RuU#-wE0-R%ZJdFBP^#L@;#ej;tz6o))`=X&`L2ivj??NZhL~%6{9I`RY24
z_BS{6E0VC8*{D^M>c9I#`_zdSDI(|$k{xhS>6q8~ud0?9{t&}=fSxa=JeTzj+`*HR
zNxs&{f;IX2?<cJuIp$Jp>N;=Cj42g82Oy>{?lLC#H-7o3yyw|jA*gHu7|QZ4qw1ne
zC0^6&9TAxs?P9AYH7mnkCOm0AnOw<J1TA9(v05uT+q2ws3!_~-Jig8Yhjo3rU6%u8
z+3{bd!`}@*0lKN3K--4LZQ$40@f?Q_XtS5|Fb0p6#QC*!-iDcqOB2?GsK|0D=-NZF
z<CvAR<r@>~AM8w(X)Zg_ad3z9gUlCHTHbLC4$&tB=_%l_+4XSn0(9z5SZ7h!F${1Z
zGVr*tDxW5ep@bspM_3Th4<CsfMuU7A+@_>3Kbb_syxnela5EQnqupmSqQsL)RJyd?
zvHYBt8u#l@myPe4PbL##hR^jC@%S+WIRGFODcN_TdGTWW@D}tcu9P8fsib7EW9J@=
z*}ynrrVzfcS5Vl>re54969eC_DkWj7j)ioey6IC`Kp@i!h8eu)^KZ$ndi89XSH5#&
zC=Fr?+D7&%xx(Jia^%gg9uh@%7+%S|$<3dudPZ9C(l^xKHDb<9=6{VoIbJ}<+GtWe
zTYx#p@|cWj%BZuJ?{8Ec$z(U){MjdR|3~2cVEDSWgKD}h{G_2w*P*lU?(p-*&tOtK
zkq^Bv8K`NIkWh*Qg*BJt2>x^z1P@Q=gYV-Sf83ZFtF`$1JNU~x+(}iAV`n6_B2*;A
z+2pffvr^euB1sf=kULyyNV;`0jKYI7;fq|abCWG@{icZQ)EI&T4c^;HwSo>i8+FaJ
z^uC~{V@+wUnL4-KA^16RHd`ydLr9#RN|c2gK0OmeWpsiK+TFHqB(fB*1#Ex+p3=>C
zC;jug!O_a<L8TI>YrlP^%e`;EjK0a&dS8>j)8WGV&bopA4#>SmKl@$?LH408C7b-Z
zqrcD+v=cfxUC@uRB%LloluMi3yD%Pq>Ie$*w!GcGjHEbIc5*46Eq?2dv%-w=VjinR
z5XW3hMlqqJ!YGEEX;nMA@VN_+<P@oH>UalrOVT40<A^7iNalG)52%OjNxt@Yx0}Rh
zNUr6BY_H@l)KT>2yS0To2qN6&#lO^AN@ihSxYl|d`>tc{%_+2J-nZ~;Aisj}j+&IX
zleqix*u1vBRm9I9Z^6o^A#tC-U-g~Got?A}pc~hSW@VsN#LCo<Y@%jCKmacBpLYzw
zWtKVqb#;yxD|Zx4^06pY>Dd|D8(KUa0#Vy{%b}Tsk;D_(ks&lhvwWrA*tF&*Gorf<
zi)Y$h8o+`T`W@9DF&^&7m%v$}XDyg0NFVOxi}8Bc91RB*t>0mJI9<h{sF$dDagVtI
zAm3qD&#7epieA6@wmsG4PlNV`^|sVq>prW@{si75y|>i*$9(SwK7B$GAuHXHl?0B1
zMZLy+uSff)CjYBKAFWwfAxcQVrrwp`oO8>2&(L_=^Sa>&<gLl=VM3%gUinqCY6qV+
z<;lT5p?J%kd@qkdnH!5kwqYW_Y5S~B<}@CrRdEWAeR2ePaYID<z4W2`TYI*Jia|0)
z@$Xx@o0o2muIed~WkQr&`<>6KM1`l4S>Q82w5K<(D<SZt#o}Je%_86DNxD5%)74+~
z_u{rUNzO!EVd3ExeKb7NI$EAXI{dueJ>}mL5H+%i3<bHGPL6VKHID*JfB9)o5nF1Y
z`pSJMQ43pVUB^Xtf9?HJlO82dF##9V8$E$IV7>C~{^h1;hI@U+l{zkSS;mb9X(weu
z%5`CNd_M8poGW(mf=n^rZ!UzL=qxaOA_uY3EJIxj;y^_=J*lnfv0P@<EY-aM>^l9K
zr1izh$%O&P12(9@NhLEVv{TEl2>Ulib-PD_-k49*rd<w?B_?_<L8WV<Izbo}vN(H1
ze}EOc2Zekh=Jw6w@wAGo+26Vh8@CY&dfA^kjTygmJ4PzIOe$Vq?lzn^x-vU`HtWRz
zfGnR7<N)CHv%BDCD!-(=BYN37!*wN?a`mas3_Rh{3U2qlTnbo%HT2>9AuNQ>JU;Pl
z?rV~Tga5K;$+jG2m0Ed9v8WdQjU3}doo~@!D>dCpjr0=P@8%hkHwygK1H9FecF&(A
zzF@!%g187=2Cb-<wTffD7Ene338lW^Xm0;4#UKWAWjb54ZO9RnWT#0$Q&ld6pUs*V
zK3<!f9(}VNoULB-xAk5+vlOJ$jFbSnBt*0yjB#QeJmErRO~C;I-(}yw00|{2j*GXd
zSEzs|k_G`H5)RicI}LJ)KZZ{-BHEv7VaF_UytT4_WTtAO*ftCfv6(`8vAfp!bKz>v
z(dF_L+j#9als}DXZRf7F+?WOo+NVVmkYYbh&~HmRr~_9d&7`j`wb$bT{~vvUQ_BGm
z-iHs7Jg*6XALpV3Nos-2j6vpnrY`0m3xJJ<jf;`x<L6dm;o;-p;$!2aXJO%EVL3|R
hw)np`*gKk8TX_AyH>8ipFaMLAtfZ1em6%cR{{aJhDc1l1

literal 0
HcmV?d00001

diff --git a/packages/client/static/pwa-192x192.png b/packages/client/static/pwa-192x192.png
new file mode 100644
index 0000000000000000000000000000000000000000..565226b130669aea4c008916f338b9c4bf10959a
GIT binary patch
literal 30946
zcmV))K#ISKP)<h;3K|Lk000e1NJLTq006)M006)U1^@s6Qrv6@00004XF*Lt006O%
z3;baP0000WV@Og>004R>004l5008;`004mK004C`008P>0026e000+ooVrmw00006
zVoOIv00000008+zyMF)x010qNS#tmY4#WTe4#WYKD-Ig~000McNliru>IVl82PVSo
zBI*DDchN~iK~#9!?Y(!HB}a8W{GO`rn<md}j@n&Gt5wbkAprst1ej=&F*xId0|p1o
zXTuK%oH4dB*f@|37!w613zVf*4y&-zYIB$zZtU)=^ZijBs>7X`6(j8m_B_v>xwpHz
zy28olR26UnPQVE`0Vm)DoPZN>0#3jQ_;CU{)(!a41<s5u@v&~v3CP0<0(ctWnisrA
z?%4T6wchHK`-etq(s3%9p}kJK({9W*hX)3{&Fj{*zW$xhsbk&NA2&Eb08as2^Ap#I
zhxbj7%r>x1X*!?DISnMYC>8@kIyFI513@XJ+pKldku=B3+ez%-;}G9nEjc^4uC7gg
z>&E{(AvK<2I6(kQ2xp)B+}ilGcfQA^mntef2conU!Wkgp5D9_8;b!xPwFa}Vq17a-
z&O<_VzEzU`H-~Dt|DlI&ZXfHu{iwnT0$2jrcJ`Iki7D?YMb)>ktX&PKx}1arh^zr-
zMC_cxzws3Yh>|-D4c3Zv&^aPh`&$k=|GvDBZ+`HB8~tP5*B>=FK>$Al{NQgdqSya}
zJhP+Azr&*E73B5|l5_wt2x;xb{zVJiU;sp9YS9YXYaC&3_CHGG|I^t1TlZU4oKTT|
zNH{?NPZCbwc2Q|`j$Rdr{`XLM@N^-a5Oa$LwFpns@*ujB$82*&1#Qip+3QP~eb4C2
z?zoBm`2_MW1)Ly&qXPoKCv85zch0N5UAz775as@1qv&))@<h#H23Rwgt?CF6!l*z*
z0NdVEdv=JRm4a$dKPvpW-~RoV4E*2kee9bjh~S5W69jOSaMn4`t{xco|3H_Qzf+ca
zD%}UrAU`VxF`>7jv3y8j^)d~|)euC`EYNNf4vZ2eXC<1Ri5>_M)=Grz6lvB7+OtnM
z!Q|T}58VE(V?7?vbT~l(ivt3{mz;H~*f}})%c`{eFJ-yES9Ih0%+MMbtTE0zt%IvB
zYT^7dI#|Ej$521RaT&x6W<tj!OiT+rw$H^)cUJM;TdLT(-+^L4NCF^o^=kmSJ$1k9
zPrrHW!0q=Q>%n;@!wCXd91s8=S#$pL19$nyo$AnPD$>@8p*5pIj2B$i!q2>N78jn;
zLSIb*tO3nQagGdzQ2!AO&4m4<F24M|UVQwE{dnTA19B*C0wYqk2wE$s#@HA7#LO=o
z*mu{|u^ymjD#&BqfTsg~{;dOa(FHEudAIkZ>)5#E!WC`q`CD0Cb`DVi-ynuoj5Wg=
zfB3d(yz>_(v2|kyWeUJb0o((~jexrqa5e#Q6(A&_n}GHK77z>!^lDsuP6wA?*ujx8
z2fOyUVf_S(9jE}20EF1A18;w8cHbRKFiby|%<#vi)1Up_E9gsKzKt5>qg<)tSAXx_
z{G2zw8$^rC(HUNM*{^bG`QOV@kDE1k2@IteTUK`P7w??Jb1rH^C<dUwas^Pn6sVjB
z$mIaJp|z_4ZUez#pm`I}z70SCKp53u0%Nld-t%`O`22T!Ku$W4#t4n-_SF4VOuX{o
zo;w~t)?@rkgdbS~IPLVyDzh!Q)>Amm4|qeVT-g)^dYAzs)>JCFb>H*$GSog-(#~2%
z?mp*~f$1+_`xOlUShI$3@E`-ghRv6*ob_v86t(4-i46BA7_ZK7P2unVU<@yQ_8j1c
zo}TKnfWDUkatMF|psfc50Lfq?1QWo_zXRS*0MgJ00CEX?M@#sncQ3>CM=GIB5CzN3
z+jY><qJ8N1CidU**G1#N%yjNKSC&Sn+pBy{n>=4^)Sw=>T<#^XRDr5X;(E!YgIafX
z^;YDemtDT5@xlN6!jFZA=|_P8VrBe-OD>a#MzJZ-?(;qEJQuQj0ZC^S$gL7d5o1>5
zp<&Hn?Sa)al>eCE_Vr~Ee8YA4&OMLa)WD^e5N^GVhgMzmD%4heQkHtExwo^1!@#?K
zVH$6L<0K?&FeFfWG0^)H07)3+k3bsk9~=bQ4+8#UK(H6kb<-8L0tp0=1AP1D5`N`<
zt1;7d5cR?Kma68&jRQ{Wm3wyGI38WQ<icmU`^MBMzLr-hl%As?&mpJ03c~FLNg@&<
zH8F#=X5}@Zy>Vjwh=lq<+0ow~>Z|T};NEYvj`ajTmGGlL0N8fwCOOd>Iz2$oo3!Zp
zNph<vlPo!fx;i*EB<;J*fYt#x=uAMhejs)8KL@M$-e=Ccx%vDXuK1wSxB54Pa58~g
zh6*&UJhy{?`?EtBsRm%yK+jJAy)TRM8`4AFehg?`4|E<j`acj#gCe^EAVKKV=kWV~
zw;G@P-b#iv6k-R;l-Hao2UD*+viJJy&O84~XKY5F-wwoE6l&MNsjegGN{RvvNRlv;
z=!Ip_GefIDbI?9Qx^ulFyifM`(shqNaDC%g&+}6O&r~Bg)&(|hx@`4ir|;K&+5eZK
zJn~ZE_AD3D6(ED+1X#H?unb8n?*O4AMi7KkuED8pV=7(K^7TpoeQ@2Jmese)QqS7t
z)g0Eqs5*>4_~l8QzqJJpv@vk|-v9{LYOVwLlfc}Ufclq#U|-lMkw$*Y?H>omNI*<X
zp{G*EH@B}sCm;gI+>f!CDmrNGShHf)<A-PD?|7o`16&%qno6}nA)Q2P%fBZ7od`lW
zL{7PnW#!C(otL(nYD;hLiYG2PwKlr@(B!e6`z3{EDgod(U$lyLwYFZ`<lYaVJo0n0
z+&@A>CUb3Z-zd*4Hg_pRVh+Dks-!^zSt_%vo*SV2BH>gv3Lzc){RBX3;KI{d`0Y1O
zq3SRI0rb5ZD4zsCMT$Jox*wSOFTmSTJnX6WCs-QA!PM9c`rTPvzhfoso2(#GUJ_a)
zD5ZK@fp{gChu<vR+JF!uloJ-oQ}oM{HVmtb`Oe_*{bn3UR?Z0+&l{bSGiz3Ccw}m7
zUvRAFf2lzH@KrpWa6JLQWtTlqe&W83ukhuvk5gsY^QBvnMK~0vA`r*lH8VK!$CFhi
z2Mi$uNw>06h*CL1l+@rc@DtB!W2jFVAHQ4+luw88=D_Ixjhld(j{$nrDD+)ZqOC7k
z&4~$p(#J(xClju3-6tYYsqb>CE`N@6OERKq${>II4mL)5oRUFojT@)xCuWe8kk#Q+
zb$Qu`##?yDhRv7Ojx{DM6*xb96;CHz$>*Pap?qX-^QU!b<S%5oe^r9Sxzri3Hokeu
zgp$J;=wVbU8cGpn>H;l~;A?;+hv^3tS_p{iOAs!tM=)y)_Ao9zw{4s|q=Cw*fGoop
zy$;ZP5SaNNfV@!ENdx6_MneeSnWPK}I3DBNjT5Li8{olGo5Dhl<0KE~^6WyQSAZm-
zQeyPgG^7C99--bMc#6U_jNC}ZG$Bj9{R-mUv+YS|%Z775@c7<)p7HAxo>2twrVBw|
z-N&yK)#1O8<$+c9GTU@I8bb%b@_xnzr+0AiIc=P}*~6-33Vl5azE2pNlGwA~#Vz-g
zamzhr>>qWY1wjy}h#<=D%w{cX4Xj(?WAj=s#5n@o4KUOofM6P!`vL$T-2`o7iWc5X
za9k2t0b5oy(N|NLXv(-H6mx6~>#cENW)K4#mn&R;UI*u&;o+opK9&vna0O$oDKS3d
zV&^Uww?E+Gt_RB)osocuR4`*pF&n~?rCL=3zdPgU@z=iQH6Q+;&wpOy84S+|0yz8Z
zGwHtj9^kJZy6D+d8Tm_5?q5~N^`W5^VX&g`lP_xE^)H{rnOi!jmf4CN0U*L@8-Zt^
z$9Ua~3A+xI@tLpp;xk|C!}yE<Ns%T3WYN^*`kcJM$3Sm5|5O3w3YZs2pm80b4~1$^
z@?0U<6lP~wL>iHhreC!VM*4h=H{8U=Au6nwprHc7s(}D+d|3mpeen!7ul3;w9gah&
z^MuvB=rTgPO?YT`8K3@IAHMkQ8fIG(Bomt;DlAL2-hc=H;Cr_nd<ekzjx~P#Fz}2p
zf{z>-#maT(tn<adKgi0+dC}xkicvGP0?ynN;7@;N0>AiEGuW`a1BU}Zy8zb!u9}J0
zfnni_AegXhAixzDv~cFBJ|1|ug0X2?pb8|vBh~1oSG92Eg-uhJ=mC133y3P<j{<Z5
z3&Z_w%%()wChI$Akl4m;LEw5Ddb$p$!ua-stFU*x8WKRpy%RZjiNT6+!Koem<?m18
z4cE+Kd9M%B0e~ui6#xyI=~pd4nLH&&FxD&&aMh(PoN|)FgO64)F(V*EWG`5@ge>)|
zz+XEuxZ<00GY6irF4AX&1UT=E3!Gh3rC$-Xp(}|*=%=u~*bEf_m!H+aU%qP`+ctSX
z5P&fV)Gh?dX998<CJ5CIgHZPZo%;dyz?$Fyc-}>I^!}m7Z@+&99@+0e$S7)%S5pLl
z4Qm36d%NLqN}zQYpl3twpW)6Cvd0{?yHsF=+KglPlnaf)st?u_niOo=5foRc1IFcN
zcJNofKZ&jD+hFB`X%OhS9H^Xc#)2fk9l+ZQ%zYM6V*mtL5z3_TvMcAXVwuJ}{%jc@
z-e)91ibhF5l=`n~x4hQ^_@`ryBTp8d5niBuQ{plz4gH*uWfAGTiC^Csx)*Qr@Hf9V
zhHV=<fTzLES-{}if&Nzm<x>G?7;yRlcNI{*1n7G`;GTkLRv7?%;Nop9y!%(iF<1?t
zb%Or(2LP&N#>k+uvKvC5zHS5U`w<0MqgJLNqw`SWd5IGpqIERPK)61@A;y~Fj@6co
zt2Z2r)7Ja=^WPoE*7Ys09{|p&z|gM&{VxSds{rW&QUY?oxM^9z&TeH8H~=m=qmK9f
z<`|ausW^Ex8Y==rIAvGM>RZ;VzhL#T#*rrr$2|d@y!E__a(aGVlzLZ1nF2N_4Xho}
z`2T)m5~r^3fK>o4oeK=S6>wLwQ9}ZlX%m1y2F!j1nEG45dl*J4Sot-IaP>Kpc-0l7
zpjb6YyGogXYK5_Sg)%P1=pqE*9|F{&%+N;4yj2%l*E!*?9Q_U<3QhrlAVyzbP;8$N
zgTd%6Y5exj&ftvA9dMw4(iULg&49ZGfDf=T^{W7w{TeX!VL(l$SE5C>l23Tfg)O}K
zCmSH0v^P<>2;|nzYP0j)V~r<I7LH>A_-_J$>4vySi|R{+FxpxY$T5>4H1PAUn#QGP
zHo*Y{Vhzy$%E%oV&XojI8<_h#F!6Ul{VPTdVoRonIxZ8T)NJF8mp+cw173RhV)Tsw
zM`~0mc8-rWWxOYhniV~g!qvQcG0}4}HiFeImI55^Fd?K)<<zCh`HbgX)WVCNRR??x
zh(VzL^?(y5<1rc4N7sR=j{|dGHfj(_q+}c=3_&vEjn6-V)7G}Zy1<nyOBIOnORl=`
z*`;HRF;51LV*+>szu>ZSq~h}Hgxj+mFsrB{Fs?|(d0X4~scYsyTAPXNeTh+bI6_Vd
z`1^tBj{x;+0iK1?)w5ksxUi~wICW$Wmz_RkCOs7}GaSFK%BVOYCNcpC0QP}kcP0l2
z>Bw^qY-y19;WL1EPay?VrSacK_e@#C{rhW-H@#vGJr!+Kr|Q)q=MRaK1fUwg^v8kr
zo#8l8zFjt7V8Z(H3|?{ZK@ewC#~CC9m`WEsG1h)YszJvw0RRsiaMo$r^E@F#=0b^{
z3NRcnUh@-8tQzvcIsi(i0F|=<sIaU9bRGw${v}K`4iP`jjR>pDgpt`-s3?UiPalIz
zsgS9;&p>~VMzvx^lvxA8ED&VXpU9e}<h?0xkln9za4WtdC8A`u;aUI@nipiLBw7*9
z+1kNHXS9u8C|3g2ivZ}v@MZ?jd<AIlFu6*`&6MO^6dC+PfUofUGxlOtU)$zENqJdW
z*H+GH#~NRr3>?=45ODc?a;lq(?lCjguLyAU<@GSzm`wh?h}NqJAQ%T`J^`o+#15}i
zRM&#kB?bqCGuF*usK+;H4(Z#dRv6`yrMkca{M~?>PNKe%UQONJQ{>7-qTz+^dOMSI
zus47s@;#6QJpZy5`fJK?|I(Sp$YmY5l7QBopw8_{Y$AR=<)v2C6k_N=V?*B@PFXz%
zol(CC3?`>X!QE2y{LjAmjbhp0O1B~^rQ!Z%m674)rE||Z-TC-G|6Z2};L{7ots9h?
zX?XormkC*_q-8RUHV_alI@803Ri5#~%jHG_KqaBt*=qrH#CSTQXMtqW*)l>S$7*;@
zGhy981M8Nxab&I+QY3Z<v!OHTP;5JZJ)>5zXT77aW63)y=}(-p%1OJT%i0or<+6ex
z9ZG;i7aFW-TzqybX-|2JLHsD-70dzk?;ws;r)&><a8iv8Jwl9{qp)@TEWZEnGC)R@
z8OE}OLy+#~Xx=uTdU@YmOP$J8I``Te4xQuGPFn>xa9hMuNU8Qr%bDN&(_0>1zTw$B
z%8q`pzk+=`cHGoC7I=2t62Qq@&g)|uzEDV~(2jHjaLKuCxH8OhaW(_82ZjI~pmQJ4
zxf8}eZ$TkfP7oV_2|h8<<NDaLx`8_$??)a%bm*Oo{Q3g$cOivfnKq|>q+?geP(w;k
zQK&u<0O_!i+X{%{3CxW3t9)!);{l2Rsshd`(-wjmgVybUItUZ{w23g=(7dz*YX~s5
ztZKlCyJo3>B+>Cy-{w=FwR*+IE3Q%0`&#Xm&n4-OuyCYXrWB$X{-oe5zvXN1V58o-
zW!bvRzg%<u@9uqK`_sC>|9B(-0>HCvu^OfFX2a$3lQP(&an`Br<d(Y@F~%q#XnYUG
z{pr|vg<PgtZq7qb2?H)`tRAlCn0agtGg}B`Be1mqfin*hClvr`)x&a)Mqg9686c6?
zK?s0Sz~&7;`g=lqMbrS%o3tmGH0zFYV>yrYYeS$Rn6PrN1xbt`mR3n0oN~`4(_Zj7
z?NlxnZnY!@g<HQQ(#+ofR7e7(Qw3^U0KG-|omb8Iv)3(OclkdKlseZvw(HK$S!bP2
z_us$cDP5X*JQ9Eb>24;H%Tt^t1O{Q{NPu-K{Y1peA#)23p?yE#KW-!e#}8%F4#MYB
z3@{9`xvr500b|oh3$A47IJce<Z%|_C=JE5fA)AXFCEugq7u)xWy+j<<8<iD0lSF5d
z-8QfDP;zzX3hoWnJ_W#KZrwo?95IBQH8~;!-3~<9P5}m>6%a56oDOPEfLSe5v@Qrh
zx%V6Zh*xB2hMiW(;X4e|usg^g5|D1S#<F~k?>8?U@63E;#k%wV?*9Al8pl%%$D<L<
z0O0xhB#=`ra!jxWHmp$?=ut@;0`&l3qr0?jMZ6#dNax%T=jux%0{}<FI`+VT7X@O&
zBAh%E1&s3f$H;klY<oHD4eF*Z*+L{zhd7^{;Yy8DHhN}YfDq9`*Qst3weRR+lN7x_
zI~5EB8q9>DN`P8fr`tou5RMIXwuU&>UsD%lhJ|bwvmnTF?+DeFzssY653bs9*}5gc
zsCnRcBme+_bjqiabje1rWGor0M|_l=B)c<q>jh(g_c&5{eldP_OHDvBYs`oo?W`C>
z<rb<Xl}8bs6)oBN3Vz3xgcEKfpN&-(=9@m-(kf9a%up~~2N)Sr;gf6(an=AN*xPNQ
z(<E}$7b1SP-8xBxb0tFxE;#HdM0^|jiQ~D_ior@lD-G7s24PmeIdbco3qqD0stmuO
z&6U4febR+bX?)?hB!J7#J;U`ituPVFaDb6$$3ieRt@px=O}i@&*n2z-c6EbDN9PQ8
z3V{J~O=OfcV|ky4p0X~q4P%a*zM3tRT+h*o?eNbSBRS^`=N<t}plYB;WA(Dg-%kMA
zFzSy0weJJSLrUE%Lf|gItU=21O6A7PGU_cP)(RlS=q)i$UZZfvrU0j(q_AnFMqimB
z7|<%2gUCKGw8Ie6Au12Os;z79Ir+3pd+-#&acKi|<f@um;?;!#RWrV*RBcOAnJ6qY
z;60LYp;#5f%z9q-47esj${>{80Im$c?536v6H%ByV=MBMuQnUpN(J+h_fnKol)=t)
z?Ay}1qDvZ(4p8gSi5a0iGajl5bRI$XHOTq5*uP`9aOnJ3Y-w3>7%rhIB7^uP(l~Eh
z2hYEvjf>B2V*M(GTGg=mdR^e)xWs*rR`JarRB`(QRdlpjiN;Y1M%X^#l!WG?pP8zU
z-vi*IM~_Jh!*NLf`wtu{DR<Ry)^!#^Niqhi7Wd@<;3l9NAb%fn>Q9m3XMeHXnE*(N
zP&N{JT#e=ZKJS^T#+aO}wY3e$0#zuD;}+-4M#ea8o3mXfEDmYZ53(r{Kwm|pBz00B
zcT85Q8U@ritkl`udyByuD8)u)AwX#gzeWy$j5AF!wyX~Dw%1SN<ySW_+#i6HHdGTX
z!dX@mIB6wt`Pogp?nM&cxUm->`OF|5*i{0BDlJ*_A>3+@QoX;ma{WcuAKAD4;Uz<|
z5ROX~NK>hzS(LkRs!ADHF&uF`0$2gMVWO~l8ij~xe<BsApl*`^MkfD;88tV+$Uxgd
zZ-abV5wx-pk#mhrA+U83DOW6KC^Y4zOr%PDIa-_&W{_$PtX!thTjit;+y>Mf(0LRl
z12o;m-1kBV3uyBa0;AyzctLs(qwpLXXa!t+dIukU|6#oKRkIlB@s06}A+X#EE}a2(
z)`3}=GZF&AP*vd#FPg=_z5fVaba}%NTO4dmj+7E^?`b}j-}08%T(ji(dR$6?fx+Q{
ziI&@&+9eG}-z6}F0D60@92Wr4ZE!FO((TZX&w0*gdu&p{CmT4F00N{Kk`zj=wF^jy
zlb*-$0|v_I!rATmqo}X#*v~rok+?gv5#m%+8EJ6=)M_wk89FQ&?L6o2O!qP6yGQza
zW(=b89J(_hfZ2}AEk9ZrlT@IU#<mR#fBDXFoUyqL_7qsI0(!0nDrW$q-x%TAGr3vy
z&jY~`lW3@clh<_cm%lrT&ihy4y1Qz|iDi$CbV-TotG{>G#D4&IbSZJ|_>=%j^$8(*
zioA-EUtGutkwc7B;~;M@3>GA=&d?#T2##lu3IS3YhY$lRYJQ{<#Z%w$1^fW$=D!DE
z5t)6h3mdkPle1+Lr7Ke)q$8t$TO9zm?g%&Fill<o_$*<epy~*eHfsS0@U)=7l1e}r
zF)snX^>b4O`F#br+kl~82YQ|j$iC3wAYj%_uLQ)h#F${C!LAt&@Q$CG#L5Ac9-`<?
zPHl6`cb<O~v$(jaUg`>$0_ydK%UmFx$V@iJ(U(|A0>OkyM$1^vO!MJ>v1bK>K(2}T
zOJ=MdZY9DbM7VZ`;0Gd8RhKu#mTTnBq?CG-xJC0;KgGWKD8Q7u4I)NQMP)QP0tHVP
zRVeb$XY7V(JaevDs}D>7`~V!LR0N&`GK8oV@Z1ZVc+ur`APCGB@cnNAoDrDCNC4OY
zI(tkS_V@>Y&Vz_ku_Fiw7o0kcmtH<*GTAe!??RSkfb#QC-FkU`f7TxYj!OdYy+ATk
zD(5keTJ{wQ1bcws04Uxwhq^sj4EFpJ0M}%dk_Jju72{o0UB@H%K|W|zSaBTnv3&no
zu@u__U3yvI*)kyz!ir%XZs(GHvPf#!ea(0UipDBX#zRFwv+d*(V|&Yt*S@5Vo{|FV
zGSKsrfHP>=I)q6}nf($l`5~ZnGk_)%w6lqgAX)*gIe#ApYbw(SBSA=(&aQX#+C|Rj
zqTskBfPjg(0HacFb(^&l87~kw(o6e*B-oj`wqWqemBtX$K!43Q>jDrRe@gItAYhBL
zX4RcoOQEE#ahq)^Fi#^mTW`4SdZfKDLy*SMpaR+9YIOTvIHKvIDVip*N>ru8vlS?v
zJj={DWkUxSpV>4^EGt`q>L~#EM&$|S%*wOIHvw)TS%_5RGA8hxkJAUnaoXBCv`##2
zF)j#qm1emWO9;m$0ca2zE2w~L*%xx&l>%%pQqkwr*&}2wxrmhhbwe#w+&Cl(0z+v6
zb7uIsOU1T+l1mS;)uAp#8829|-Grw9%!E?eev~pVLUEn;pxR@b8FDBcm!E37VMriy
zJOIzSpoL}qfzj#9XPQ%QKxPT*^rwN&y)X%hk=V+<z>;c#!T@z}-j>OfN||`yWKYKr
zPQntxaY+Es`6yO4?<~JEDdW=Us`@N|7!kuOM{5WOy{<~_7{>rKq6E3@tBaz!lz(mH
z{#-~!OCgLIgp5!CnHB3@dR1^Wr5zPWE&F@G@vD6;qb2|_OF}O?qXi-jMj3F{hw~@Q
zS`6=gB+-0pB2%xn#xT&3nsMri*;wKxMHwU{+;Vj@mJp6h0#M8uUjvdsLMR+GWvGA_
zS^GRLA<O$hB^e`INd~AmnaK#Fu;~XgYE25E7_t5mxkG8bMp!)~7^6Q_-N?#n76iD`
zJXdUocVP?>6-5z_EQg6FBQODH7HBqI<85L9nlaL+v2~Lljzh0mfd&Gaw*##kGRR*<
zh?GnRvpGu*gf+`MX5E2~oCaZoNubm5SDdkqmTW_}<B|YGoK=;KQ#6Jgy16|M#S@04
z?EJv<K1!|w2;&OvulX40QL%l&VWWI66GzBKesec$<GjcX*)5h}ebba;2#y5$s=7;k
z1^vybh?H<*&PXo?I53-kc}y6aE5$>uHL!M7fEB|*NC0KC4#A%Q=B|awqMN5daaXPW
z1Ob={Ro6#J>dY{ju~QH=?%BL#@vGyK0JI7?*^d$_J)U3|fXp=#wPLZnf3d*KX31HY
z7Tr@;s8#Guun2(ynk^CkPC-_D&5M*d=YPIT=sjXE%)UOMS^|RWG6woo7lV49_vQ#M
zY;HW}VcWtqhyVi94Qr=6W~^JKP%DS!gal9m8aDuX9J!4Fvg4HUhK27_Cb&6J^3hvX
zNQg38M?ff-D}zHTwp5mCu8&IsAgFMiV=)AZ&}fBHkmuv&NAu1!CnrIGV;0m%(kMAW
zbPE9B`vQ#?6(CZ^s0?e5{}md_-9oZOWz+EkDG7bGqZtH?&?qHn&DE^h78=2Umhc0M
z@iJladIi^s+^+%%MuGPByxw2b1j`K@t8Sskspcr-bSUaQi5}nAE|v(6O9F69<pS*{
zF&I5xV74jdXZ_s}qN_yCs2Wm$N-mfQWudUTzil>H2n+ZD&}@sMii+Lukx|#J%~=CF
z)mCHon0HfZJph<ds@OKjLSqu?`nLYvWxO=NfdT<&v>h~CGLAUAlCgSO2dN~$<}D^4
zD{e=2AZ!)OVisU?wwgBUE?mi=DCa2_9?@z%RGLly8EFH|s|?ssDwh&hpX~z=zbXdW
z{yc*Vbbr$#IHj380?H1+jIz{NKGcrWp9u^<09qd95jUs$6a>7e>q|4&(t#>tD~hx?
zOfyK>?!pCTz%ulU$IBu#twBnG2$=0i%(P`ZFC_<9za~i9ttNryt!eKy7f_eI5GHyf
z!AKgV&Dthn5b0EZDE1q$@O^(#c(fQeE+s&@RPqT3IP2DkBek5_%MwU&G}x<_cyUyh
z1BR%S!T>I#RQ6%#=4c=c3UT(aG!*9eAe{x#_2GQoN>S(?iJKC8m^ke_DC|?t*p2J3
z%0%O?Lrqiw9VO8T5|yP^(HQKD2tb5^$hmwVGS`*7mw=6%DNMYJY#lokkl1^im4H7a
zJe>qEkN+_ZrE<9qA}>FH9EbnCw&ilna$$}R0*xMB?5i{7O45)I11knRNRghDz_;5L
z0i~-c;CM;7MOyHbSSUdd_1j#Lf|E7NT>@Iky)HtSQ-$KOV-<Rr1W<36pu@l)Ght|e
zv0_Lkn-;|<ULtFzWZG2V=8g3K*tk!1F&;*9TP!91AD<EcP;J(_;QT3y8Q#RCOmjkW
zI|SPw*(J)_)n6V~#Q>E{hJ$Nh^-w$BlQSyYY=&X|l#^pV<HPc`^J0iH?J^|*ejrlu
z(Mri^YN@UwqkUy}Vpyy;s+3s^K)|7y653v}5m%+GQLX6Wek_{RS<O+2D_3h_=9cne
zQV_UYTDmO$<B|Z{^~r`-olcQ%%`iUb!;{i%`I;T0$Vy#ke!I8<lPhf21`Ct3UUNN2
zk=9G6W@NGMPF<@_3dDx!Vx)i}G$ugnM5ST|daDZ6vhLmnScBBfF3CO<Hjj0ZT0Ylt
z%z=VoHtw2bKB^^a6<R)cpL%t7u%u1+ywXO^OU^$_Y%L+6d-{5pOa>g61W>O}x3yO3
zt@7+H6VUV|bV06jG+t@3z7TX#3mgeZ2doLhHQ!`BhSezrOw5?P7s|e>@Rez=M_%Xd
zY8j_0^a4sUMPN?7td^}nSoVpmDzZ>;%J$%>P!}f{7idJZ8W<T?W)V(S=U>1iDjX9a
zmH-5x9SC?qMzY45Bn46mjU|HPk^pMeik2dBIu_`R1o$2h1e{YpxNyjy9K#?fK&}KU
zV5H`uryRufYcSdY!e~AxZAfJlSl4r6p~x*-<UdVc@&XD~8iSlt0<OD={-t%Ic?w2)
zco+kK$$6TcD~I>Z^2q+0*)B29fimh<;dF!wy{+uCj$N!RU&0GSTBA&cPl<VAL`Mt9
zB>@Z#4=W)=%M5Q`w2}bEC&>h&y0IMl&<P7txXGz6$W<iBB*ih{x&a&~QZ-C2kPg>-
zXWz})w1h6kU#h*ib`(TS!3dO0JxYWw2l~O{AB$1SIse@=!9NYc;hAz=LQ2L-YgGCf
z+uoROOjFK%GfxZ(4Q>;V^p$|GyGUgqVEPf40E7LtmQrdo5{dCxS@!HyozV7W`eK^>
zrbaFIYe73OtgGaLwTVtH>x&kco6{1Tb+aroXHG0=11t=bBL<_I_==!xwL`#K3y`RU
zxvo8lwy<xGmeNF+X*)@L1cbhUsFlUKe_>R6zBUAj4bV~M;BGrXFOE$Bq>n1?V}3X;
z2|&y}(9ym(mG@o%#1!TO33U8|bGYV(`N|aQ;8ZpfUoB}2_4$Yfp9mP6lIb>3cq27I
zRQxWQp8_Mq%4$d+6KvT=Y&M}ya%&2Dx+p{2dNBHghN;p5zVF5{hDwPs(5upA7YJd@
z7Y6{?ET;@Xv493;m_S&PS!oV_v{j&+|M7@+CDoJDP2ypShos&lj7`|b7iINl8-Y@W
zLb}*|n85&5N&pBBY4p`B#}omx4N8mZLM_JfWY`5$?!#_vNN+wxl<dtDJy~+t+Egw>
zd?`bl3TiJH3yUr}w6WU0#LS#yR4oQ-6~>yCK><I>P@hGY1&vBWpyPX5Q}>cYTq>1*
zgbCnkN%R~r5g&}*a1liMEHUaWfvLJ1=7?CsmGWdDiA;7KGTSK4+6!!Ui6a4r87D1o
zLPSd=L)}$tLVA5~f#J*ZHlVnVC?F6bC`~3!Abe+URl~6}DpTVS{VsMU<U=7*gdu!R
zo3*)3B{A8QCPe{&Bu1sA3Tn#Q5z#)T-TIzfXRVVkoKBukZ-oaCIgrx*5l)5pu1N{>
z+RekPeI2uq%u+gL!tAUFhpYg}bHS+sBn2`YGjC8+$uWs>00#QJ7@wF4zE9}1?3ZO=
z!38^A4A-2bO6t)TK@)(XK8DPuhVeZ07Yzr}gcC)-IWUW16a+jiL%zc3t7>yVV3x2`
zj)jHV!0C1<jvdN@A01sA*>%Y?TI+ySps+-6{1HG1wVukfAodeAB^gK}LZE@YheAKR
z?RANm9oxuW993M%5M}`68doS3Fi`2hm4+sT0H$XN<5MD^e?y!nrow>5JW!Yj2PiGU
zT5}YT>h0ChLGlGU%{)@48$DXmgfxRBp{*rUr0Qw2D_^oTy<J&WVrBcCV&%y-)__tb
zn}UE=N205t%R%7z-f^V@Ei$e?AACCRw9vetHP;KLF?3N+&dM%&A~J&?iPPv(k-wet
z+&4U>ohl_jF*Xc)sFX}4f*8#Xq276tnYrE6qMTV^C|a%?0j*t))6c13<&Xjtqa=X!
z>jJZ0ImLAI>RfJoGF(5Aw4n+V`s#^*@#!+^O$h>ri|`p~H9YHj;?%#?i)|^9qJiYx
zfx5l@N~RlHsdjsAD!>xKl5UO2`~y1gqW6^=O*QBTSl(y{gVmm%<&JdvNV5Q;-D<Ta
zI_=g}rQ*&?3P#s&TwlNGdvDBjsN&LO0NnsEQsl}c0US6i(eZ$a?FY}QyxDEXqe-A{
zWeX;)S_an%Lt!+y(Gg&<NyQMBPbQW=-9~60|7bRB5qWmPqH>@Hq8_|(rH7Ga<Mhzu
zE_!Q>=U&nb&kM`c)s6GU@3I=3A~qP`Jj3Jx31Ft}pyeYDzSSx!Hi(la?GR*U%!|wr
z%br8D19f<R+H(+S<KE5Ad=LadeP&|G;s8H10lfb=uE58>sRvu0JZt4ie|%X0_d*S4
zvy{$iB}FapM43oB##Cgb;dD^$@te#utb%<HJwEl&ij%Is+i~^nWoke2#G|(~0ieIH
zIz2a|Mv1YZP*o;iY|4Qb5Go~m|9-M2*dF}?M2N~4`moJ&1c0h#D0Z;slzv=xzK0v{
zDnkm!^DggT>&7md&lbXBC3lu!6N6HMamltOE<FRW_K-i#z5wImOA&YO60MC?Ag#?J
z6%p+S7Znm%zf!>wYzQyM><juxMHFCnmqAuqQA-&KP-NO@R;tq&T{0Eus0d)~+P|ae
z>Cd6jxP_l}!6o8}aoX~CUlK3ZRDC(i@>%3m21!biq0TKceta^K`%<WC41=+WwZ1ao
zK>4b3q~Xi$%Qrmd>lHWnrq`SqWxebWvrcc68r4OFxjJF4F3>-$(gSRB_gq93NE5|8
z*Vq_+VxR{&WgP~Gd+-<Un8M)+7mj4CTjirBbtWtIXrf?|MV);tN)ND+)FRY40-bpm
z&%^b*;h%+@mX&1|+AxD9VY*>f#(@B>8T|tcAz?OuTcEpP+`Q`u5KNt{k_@LL(Sbos
zsbSDcsnM~SV<Q0$9QbVpfVG=1+3@hF`(`D2ewxZXrwZwc+$e^~UpPJtm?b3?iaA%3
zbk~s6^OJ%0Uoz*{A8L~O-%^S;b9n4%b`S+HJ}oghBd~TPd|%EF&BexVH{|akEU4r_
zmK{JbhN>QhH<%Mwn2|puCZ)?PL<Cu5ah@o4Ar2iSBaF5*$v&Hk7liN9M&H+hFkUa4
zo!X>X4OeoLsI7UdxUcD}MNWb6TA))KZ~+u=0~32uL+Qm@>Gn}~ygM8f0c_oJUTM;+
zUegFFzfa|X3#3z)6gSe=06D~`tY5uoc#?w_NDxSrTsT8#v+}nw>kf$m<PV|a0~0eY
zfGBY^^7v#XH4YGUGdd~Vq}&Wzh(j=&w{|;O9o-W0GVjdcI%Oo(B4H68$HHNsuQ~=q
zxdgdsH6VNhZVz-o5JJP1!0M486Q)SUC#k+b{p$8Uo!;rf_hmuxB=)`d!C4p<?FHI;
z`X#;N?aJ@^&hW=Xb=k$jDa*ubkTftl(9J&d%ycW-SJV1f##-X_HKQeD$rVneR}gg>
zJ4T~Jc;cWNa*K>29xWoZkvn%pA<{^f8d|b`XCAN($lPa<U^9(H*$`a#bwM9o^q!pe
ztEgz&ksybA;0zDo1y?IvdR7}l6^-+^b#VTfo^^bEx28pTLK%j{$oDr2e1(zjxrSrM
z{^G)hNlF@7vOOW@kpR_dm9*CAbUJ+6>6iD9&EY+&Jp602)LTX9CQDT8<a?wRaHu~M
zn?Q{qBjwCCGX~9t2#?py3Cct=6hfpT12}w`!Xp8)6Jo0u`H9NamqPf=i?a311B<hR
zvyy5dHlDEua=$b6=hV0eu@`Dx#)b%Ojq|s*@$Y|r7^BlJhWZs&^#_<gBRNu~<}p0%
zlP+}_1Y?F`!c5D}3-a(e5<*w2h<9H9VWBGloO$M%*uH%`Z``!Cd}KQKEv~Hm4O!|b
zryNr;^0UcL34p3=@<dKK$;T<1JLstZeKmp<8ub>T?J>qCT<qLa!v4b!#-=3NK0uNI
z5k&*DCz@xx8zJ#226i2A5isD8J*H{ZDuon9b22YpWbBG=b9yw9kXV2eHEJGDm2KE}
zGiVppr*0id`Gk|p3RqSPu&gIs5L6h4P39(bZ6T>f1Oy7qW-AoMgz1)R^!=!a)pa2V
z{rv#uI|%eBpeq4v-@cszV7AlyCN3{~M=|mvJ{fRXuflUKY2(FL)p6c74=aWh%5DIP
z#DR5QmQoTe&&A;h2Rj}w;pRIkxZ%zUb{&xLG$15fQ<43~DO?_#5@>b=`YWL)$RdKc
z7DA$97a?*{ATu_q3+xKADws#V&Cj>3^2~>PUBEV$3#mKl`@)TyPaJZ}W12KQTW`^O
ztbXKP(dC_f<WDto*6{?G3^Pmu;^tW?gkCc=z&rNOEOOB2hk1?Q73(iK+Y|l2C(Hf)
zQJ^D6zK}wt*7%7_Tlm#C&EWiPEmT|;8Z`nORKa2hpc)KU4*)#}!L#UbJ2-iD11GO_
zaLpAG2ge<J|Mnhy{{MP$_roQ$1B&z96ZFpvwEzwraWPXD=&z<TN4x6eMZv1<B8{v8
z9e#~>IAO#D-4zeBsz}TL5($<S?_I%ePfl$rK=j;^lTo=Yu>t$LwKGG0;Ia={*N)0G
zwFra}uLq9!6f%5*Bm0dRQV?(6atd(o9Y^!RuF#bL&e^)n*;99aNmTn!jX1v@VQ1Fp
zEd#&y`f2>aPt9VmCjk2j>{o%xnLzm*z+DT70f5}3x4Hx9Ilw;%_8tPfM<CP$)(<PZ
z`5GTDy{eAy-B!cD|IYyKe54Eo&hMxl{Uu<wDRFqh!TJ?u@kVMN9@v-cNm{^aqy*{H
z_DM<)!NOHq1>*nR5G;!z7INh@r1^B6BIGZ4CdVum19l^*;8C9cIqp)I(uUcQQKhxY
z*nig8NkQt|^Undkurvfv<OL!CIMl3dL#g*=Lb?gVv@G(P%lLy|8pqq;GKs;OZ>ZQk
z4H*1YVDM*w+J%6#91t!*I{W~T6~J8%)Gh!9-UJN41L%7LSeyj*HHNAky!r)m__sel
zjNf_d3|90hC}n$j(jz(7Bpf(m?^&6jgml|8b;ZXPAzepq51q)uPaZ3r_e}ck{4lRo
ze$<Yod|Y9ka;feWA+z1ah*cLz$)fSgJ=?A8;k_V<<okiivW=URallC_y<hpm*B#ZU
z%m+mTzyJ`i`#h4>^;s520H7Fec=0UW^71*9v<^=OJQo=H1)#DSsgv7TCk9_?Kls3u
zlfC9N!QtNk`d$yF<zO$s>H#0`c*__*^1dUu?2HzmISigL;*%f&_&%_6kDKTG_NZkk
zxCnV|q@gUqh4&KuFYmMGg1Q!Eh<2$bVzP0+sNk6*;CT=^|MjS-EVa&>6Jnq5eYyLb
zV;CGLfQ+Q?1QLyolcr%#J?4R4u(<Xv0t({*mt1stiK%=U2{$(PqG8vXv1wHYKmY0}
zlqn2gh+d%Y8o;TAC0*-N3O_F5ox^ev0MZ5et~3&%`a&?f5IVpW=QZ(>|2K-Ce(@X}
z%l#Tp0|9#uxCoTZ(83Xm&-FqVqz-$>$V-kw+cF`j^g<6CYYPyfn|jpE{TUCq)&5l9
zx)Fh8AfrHn%?q@^^+l>o1-v2mJ^QLah0ifsN}%3x(nT%7#*7Zp(gni`ZGh=H9wh0W
zOfkYno&g3c;5p|`Vav)nK$QU~z+DDVKhWL}1cw3th&i#HeKUPj0l8}ccMagKG6X~6
zxl&R6kyMa<K>sVi<!zw3&w>2|SUU{7@9pDQF|6>B&kdmITgWVc$M=`eXiE%~{Y1*x
zW1n(qEaWTf;*zxMSkPg^U8|X2B?!M{JXI;Hf#<0sr8g`FN7yQBEv=-8z{9%8ZV02h
zf8X3sDGiJ1dw2!`6T#O4ZC|9HkNA#h!jh#z16>H<@R6||?&}$HGrA-*P?8!Koiqk9
z-2@Mp%>V_X!1xD&U<~GL+5}NzVs8lmF5oN!%4Y!8^MTTOBNc2y00X2zmD2$EYryO$
z!Ty8jbshZnTc<HNNciiI^<%bWjtUY492t`sn{qI)+AkhsUI=Hq7>-$5De@q7gCb8-
z!OxW1Wv4(d7Ke*p+U0r?7q{m(!hU;bGAc{XzOd@<x({l$IaWV4hj~B*kcK9T1H-vt
zWI$_lu!K;klQ^YH86+&?2uY9#jti_DY=IBY0&UL_fUX1nUI3j?&5`kkAOVh+xCKCP
z&>WjN@j+nXKf&!?01J?P@Kq!YoDpE)7l6`5VAd#;!q2^G3h(^cDfE`i22DaRCg%tT
zj>uwnc>ZhtN;Zw6n>xVRyWHh}w|8-xh>E!5LRHNR^Qbwtnis1Skul5#W6-@F6lDQq
zjsN18rav)}nBS~5!lNevG7I7(lgIo|6QI(;Q%?XS%&}~VM<X$Km<fSTfagIUm<&56
z%qJRT>tk<mZdCG660irf?*L7H2$=p)uy+ti26!}40pL`D!8eCQpiqLw&%SyVzy9Vr
z%EG8+tq$SQJ?=cZ_5#4g7tCRJ97n0+ZVH&FwJ?D|vL`k-=~1&X2yVOOQ=X$jjKkt6
zBijb6F9M+GnBI^_v1CA+{*kcU&6KRqO`8%)KT|ty7mi=n2<DvUi~xiDI>`hLd}3CX
z!zEL9;42SH2!$$;^1U`3<s~jd69yv!I=;XYM{0QPT7W0#pnED1D+V%RG98i4J6|GW
zO#<+N)~!J2VQ}raK+m&5vIi#KPUgQT0|RdWrd#0PL6nH_wl_>;Vv_LhU+jej<Kf*E
zXe}U+&&51iZGwbZ?KL$g@c022J9jzQb5LSznxNQl&Xt1-r)*Z(dXk5Ys}=fc+T^Zh
zy*QX3x6_DfQ$>V;S>nh=uB=`n^_?Vx1<+^`_8f8W$P*5p*yG~Bn1Bkocwbdx%f<j(
zHYl97(Z|T3f&iI}*AxwLuEj<7@`Z{dn?)c&lqq1)rtUcu%(E>@pqDBO$Uq?htQZ++
zj<wY^3Xmya!W}zD@TT*2!+{1Lm;{$gpn*!5BVt=p_8i%|t~F0gCQzp5K=m&Jod<#b
zp9IP$!?;snB!R4f``-wf{ztGrf|>;0{xdV!xkuuAcT})zuSC5q(O>byOvMCQ(lP8J
z2)QH?0wO&0goA6pU&Rk@cd_T7z+59yRik>PaNtN_ptpuoHflWoSsq^W>^4qXtw4Up
zxR3gp;-rgkXU3t?90s8~@`q&{!l5aNZ`@qLH-1pYLyrqg%?c>Z;R1K_tRQp7K(#_R
zX|=``7x{Skb6YrLvyYMh;ytM1y!RrojO1LTIy=hg>+FZlkdWQaHeGl=8Ht<g8-rOb
zsS#YbqI>HpoBXj^eI=aUGl@jP#6y*_-YDVfvkzlg*)wkbdK=VNHD~KGkj|B-)W7s^
z%3K$Ko&Y)z7>sk*8@U}lBKrX91H5|xX7tt=CvDKU;kGg+rv+a2ycUL|9m@)HREnpB
z$c)6U!wx?5$sYX0M|$zy+e$bxMeu^qtPv)wHTs0Zf@a6;PI1E>F1~+j3BCfhY}DrT
z#MJ)ni-GL8Wsx6U?kCTYWXyUJpZiu7fAXO|{Lj}bc;cW$%O|s!kU***LYT?*1K`Mn
z#P<7LeCNh84vtE!U#BrLpbFlXAHzale>Y(jUL--_xej=`VS-#P<L-ll_}X1-02!s$
zCwQW@V%3@Zir?6G*HH}Wyih;@O#Al#yz1#+vz}$`g(PI?MmK>hB4DoNV%3m`OSX&y
zicB_Ny#vu-jZSUuGNDK#yuELIOz^_k2c1WZ!CX4YxJCg08gN#Dy?r2c2*d(wR`_sS
z!gsH);qnVRIC*`Lco`_$2D>eZZro;xFJ4#0d;Y!`-@c`UM#pRbD`F2I$ICL~W`<0h
zU=Rrcn4BftbY~em_qf=4N`U1<+CqdPWbWdtUvP0uF=3EPcz9n4@BOD<{M+ZNI5a^Z
z!C~5Yw-7=SRUu&rqTT`Se#pU1cU3Sv0-U^2<(9X0vzv19jCimL$`YVw+rVrK5ay)S
zdkzlaoA<4@tkYzSm>GdrzczSk3E;f|fPukvN}>D;a>_lCD2_c>0FF%7@Z7UUdD!(x
zgFs#YZg>!bwP?Fy6e1r{!M)6cMw_DQ!$9Xzz*%k5Dxl3MiGEP~ZXgU2ow8Zsp~p)g
z0bF)&2c&r(ah<%62$*V1{QZCR;%`6JgF{n*bh6D(#9x{tC7!X^q%k}KkL_`A=L2P&
zu{FS&WkINtEk+WM^}dB#p8)~fe18S+`anN!yvH$|URaEP^RJn2ii89vrv+}<UV&Qz
z&N|hDo0=xhe@}hw;uW%qkN}=)0F5?41mS4heQ+4xx_>1|FgSD8Fhha;#<hNZ?^8(t
z239OzJ=5}V3Aweclo>@K7!z|PxGvEZr;b6WaG<>a+zudyY8GN-^x#+$6mSZgBT_i4
zJPWk%15*#k-2gy?<S^hp0q7$D3zS`rl`9k;-R0o2bK8bnEdV5diI&9s{<#ky|4JDF
zb4<6C`9!*W6#q$<8CwB4N=8Wt#*qnudv=s@!8w81$0u&m{4UmfLy<?`Y!M0Ecz*@&
z{Hs3f+(&Sn1^S=vT-P$j>A|@D-V&rkIPZ)APIOwhjp(^}Ns%kHz-24|o@yFBk_hBz
z+_7gFzPn>Zm<ep-h&i=Vd2`qL^`}$<7?_$o=-2vI2~DMIq?10BDZ=C3hx>5;mT7Dp
zY=nDc0@U`vJ{w7pn!K#;pYB}o%p&#_QD+ChK2X{Whzg+Q0PjHn0;Cu#mnlrt9jsoi
zQF9fFc0`Vp7y{7J5`Xb;{rJ>ZOCVXi^F&&C4RvVSJ4or;?cYKeo%+xb2hX{rgPI$i
zEkNCoy&F)M?=U+51G~$3*I)GGv4aHZB(B$-8`0J}Q-s`|7D$*(g*zW8V{i~S_tZ8-
zydwp7Cj_fV;gE)3c)V^FcM}1U@q<TJ;l`cI!mJsaQq5Vysx$Xhzp;PG2w>hd!F^@*
zZTNGyo1GbKH<+31@rHvB{@+%NdgXYzEd;>hv(Sg8GXs+mnQW;kcI+S<A>yc++62(1
zKMn-bKxqq1j*;>4xWu^n!WL@rAr?_poR7gs!l%Dp!+(FZ9PV@g>%D1Tg<07eme2%N
z=A$(w=LUy<`e-?PRD*OhzJI%e&waB8Eax+57XU8)O#r4^4*v4rdhzfcGAa*edO{Il
znj2aJtP=NoN}}0zlT921w0(_#_;?LBK2SBw?^5mJ;%=qpGc(`efA&?}0489p;bx9O
zO~*8nvk;aB=H1tCX6j(Gw|}|RRCysu*GVgIhCA#VucBNbT)JfpA`a*gxZVO>2h>wW
zyx=6O0>xNX$g0y55xp=t0C>9rXH6&p61Q;0)o|xKJcLXY_dH(0|M$TjOgF<LMmhaX
z+xe>%;0S@iUcyK}uzm$&sFz@5qClr(wkxNi^bY`<8T$`PJm>NbhI@+wURhU35m>g7
zZIejgzrRt#e|@<E2)6hPr^Zx=Yo-TkgcXCpmbHwv%QPx3K?(uSGhCjCyE?6iOzQce
zBQCDK!Ve`{_^uc~GgMF*fU&4oY3R{e#Hlb2<16>C!~OdPOz<&{3}9A(U;nCCUpfh}
z;I=3|CH18lZ}zq9R9;AwHc9}75*q(?-9}unaS|`sblB{uO#m@N@0$R*64YN!h#-y;
zWc}IJ$lGGlJ`0!uA_we04$K|_xSbOi^8qo?3IzV`b2aQA6>waRUqSZEwF$|u8qs*x
z`2nuF#K&oy0`&JXDz1XkgtjMecue4)hg^K;))MaCVb(TFX*Y%-1Y_4hf$!c@!RA-i
z0lm1kW?G*6P69YQE%BLaEAW-ssLG5_a)5?XgsRK9;B18#T<+ogGkmNVQmB;}LTEHQ
zgqene9gj)ecvl%W-s#}bm@v`df>ub$b$w%SWnH-RIkBCIZQFL<*v`bZot!umI}_W+
z#I|i?Cbpd~Ro}0Bt8Ue<+O>bIs?D`~_0!!?>xCe+!Mi<X&owKNGOOcC3@9po$2hEN
zmHr$_BsfoHq_;#@1OV^NO4`InFAey1hH}*VUO;|(l9r;(+5)J9X^GLW9bn%tRul%T
zdYFSB{+Tz7B&aBLjF2d511nM&#DyV^F{BM<+P927aDnZCp$gQKTgkm2eENDGnKmdK
z<M{H`nw0lxu(h5d&_W*#l+E_{O3qac%cc%L`&!@S`tfQLTJ3#szHWp#Ha{Z3fAE@v
zf%bY=9GLb>4QQ1px`Z1_mTsz+F<Mdp`A$z{X8i5CxCVmY<!)*+y9IWF{x@#&dR~Fy
zf!4<}Eu@_T>cj2%01I2dPbYQsxO11AlUntgVh2s;CFViA7P9x#;F~rFwd-38uDXJe
zi6***+UK?^AU>%y%HUfZnE9E<PLh5x3Y*wTF+Zgb5R*Dc{!H_#l50sa^;?zq_v2lZ
z8A%~+4;rb4+YUqF{GPZ@MR)-kQB6eRa!yYefhQ%RJvM?tpk2$5Q;;WQ#=kM_`<VvS
zHDknCuS7b&QpP-enuC9@S1FgHAtb9!8kTppvS`R7BP;9eqT(tU?`BW9SL+u<{$d{}
zt;7CkJ><D?ytwr(v}1#b+P!!)ZD!~>$cO8G{D2FQ!-iwqmHD=zHv~U@9O5%_R|iKj
zTb=Wqprig-1H+&T_v3#PMYhN;ski7E>|;T#a36as2AG>eP77@fjM?}Vsc;q6s`cva
z8~;$|;J;QQyANd6A-`_Z<uZO!n_>-0@^3`K7P+I#e(m=85!@0LC}9`<up8U4Zg%=k
z=ED~EL-98N;-ImmYCw}n581g;f|}Auj%$7Ptu&FKSA{BF3o5Z%R>!P$RQiybv`<<i
zdyQz~`7i<xU6QIeB`>X0jP9FlL%7cWa`?g2*7=K-uF;Z#t>@+2d~TduXRfptx6K*c
z(v=^BCc2d=_fxre(h;jGU$ux-MWl+}HX4ev8fkW?aO!8qq~TOqTgc99`j5|REQ`8!
zA;4QgeU35<{AL3_ir$pxWgDXJvp|yPzq@r}yX+-Q*2-AY^X(%YxB6e3Qa4yJrv54}
z7U02rg6A%~{0uB>uF9Um#L>;lv<!PST3SUA0MP4sKH1VbjE!=e4!8X@gUsMHyU|L%
zKmXZ13w^Eo{=u&Zn9Xxg5yXQ=ztbetAoT->hh29Q=v+tL2aTSe3aliPvD-rymY1Cp
z2SC$5k$ZM9<8OhKsR^b3*fl1)?9P&s0^#_%2K)`fN9eZu7SbKrJJa19LpO6q&e!Aq
zFd$VQTD3r|pM#B!v;4b8_S|zaR3#(<7`XGk#_4~v<WgongCN~i@GN<rz1S-(e=rZv
zPFbRVzIqZg#*OeB77VPmy**}u%QYIQmS<|K(WP%KYR^&r4=B|_p`F|iiBZt)?!Vub
zsiNh%G2qmxo3G9;-ZKJG>G?yw%GsB7zAqWs-L=hq<#uE;LbxwOBS+(9EfcM`_hi(?
z1!aI0zPubbC8yg{aV~Z0s3+}?UJWKP#-f3%$G?`K<l*%txI%PB_e-aI?YtI<&QA)v
z&Nn;6s&n}0iugZLhr!8I6Uj`lyFqMzdd~KsJ4MasleCuWd5e}^#&Q3NK`E8V+4)9T
zN63SMM$BnJ^@ILKcK;VQ`OfDCPMO*Ab6cHb0ga`b;0z@f3`X7!u??#8^@D;fRBG5=
ziW%#@qo1rXxM~es29b9jc;shXK<`eYY0_qx-NqK%LA8YoQ9$62ikITU$s8XnmiVZk
zLidUqy@0;r9Q@B{YGemF&7?AFbuhu}u(#`W7k9C@<-_KTKpEKSF}kTemvYKgwBGfl
z7}l%05jIi~_88CHl3VIsNFZ-G^8sJ0l@umA8xm*rol~Ecof^S}<P1b>dt9=a33ePn
zMMXqw0)fNP^$?Gu-SyPD+W-TRWq{YPCaQP}@=5gun|!otN++BX{nD#5Xe*om;R&ks
z@8S=r5aefs*u>}pb2vDzyXi6qcQwYvm!(1zkVC^IBnzS4!#*NWC;prHgfwr;Zph<C
zAYOEjo9hf>E^kIc7IN$>DB8el%c{lixH0ad8mS_HBFlOVcM01`SLa}0M-URrKBGT1
zhsSd2M%-y4n3ox{%}KkDT$x|#CHTtLBywT2*09xY@Mb_?ixlGDtXMxp9m;VU;ZNsg
zA}CjwYx(#Iak9oFEE1`}4o*Bovr1$HVO7d9m*jX=Iv5E?^5reU>12lcQPW}e#Dei?
zIyy;h8@=}KSlN|E96Ezwb<Z%ZMe<BQ(XUfU-K<horv9yzWX`_uR-5QwVNvN}O%Mjt
zm}L;kZ)3=ogt50Ex{|A%ck7?^whv@>igskB?J>@L0>2gFW>WH-g6R~6z(&?zvmtur
zksXU+6U}ny#OtbXF@CMXynrJ<?@<{l8GeeT2V>=NuLTPls@4qTAq96uI99Dl;!oO3
zuK0#Tk0;JAHK4b`<h|tRmrX-%tGn`z$gM^vlvc-q>EK#g=M@5k@WlvXEqaL|<5@FF
zO1Y4C-#cJ;6#xQj5&C)L*l|<$`vDHR$SGI^l4dGDrB0Vi@z{Kb_}WD-kfgk%bLKFf
z&f87eLmr`BE$lTlU1Y3%joz$%1CC^1(u-i25m1lC7Iss^LxR`8E|5i?5M)P?6V?{;
zV!?QEEp6_43VR7$;shWgDd$=yGLc&_W>tjQ-gn?8!Uh-om=qb$o$EWwMg{ngi_|bo
zKP}<|So$fJY%7JDGc3t^X3TvH>aFOM_;A_mh8qhfx!veRVQZbFz%^bx=~FmL5F9t)
z<BZ^Zq=ZWkaN~5g@xZWmly<#D4lJ47Nj&FE#r+=zX4V;l(tB3?3zKpY#QGKpejx`O
zVMM!+AI6(a_{9=~1esIZf3086t_H`yh~v}#ea1)Zu8o#{;6Sl-MEOJx82JZ&=JA~S
z?%2P+Hv%8SH_R_ReD`_&N$k-xDS^f6?X6sBY(gX3^hnlxVYmVh|KbK!KczKjQdV#i
zMNUhV$Z6=plsHI0F#W3;!HoQF3yJ=n(~gH<H?UUX?>#*>I2>=b!rj=uEh@h@Sl-b$
zYIagA|Dbs^?-}DAW#$wEsIc1aa74`P)C14S84bVyB)yID$7ANLc<rI@&9y?WgY8x!
ztywBQ`*HKjBl8vqysqtpQCgEBx+=mJl*C!|XnUeBi^dP5rPgtMXkb$=3^s;`i@pmA
ziMSa5WY**;&1vz;1YU4WT`rSjQn1Gii$-`dpbfx(YFSt^4Q`W~JMu|$WrOC{Sl>6j
zY%t;&g0&lU8pIj`sT2VSfH(IYzLVoa=+(>(gDO%KFu>PMFoUOM0g)(Wq<iZX#QmNX
zI?At3JPADm-LJx55fQ|a@8=NO=qak@tXB>CCGK4~R^kw@#Evru6q}BUkl{z0<ZP@P
z4~6pDC%9P0oUiF$G&=JBC;;jH&l9wot~pZ|&Xi0+UItNPp%Xs3yZ^kFRfue&1KE`=
zZDK`#^*xeO3>nS{8pY+oTDosWBPJ6PfoX9U7vitJ?ERN>o7FpXl<jWlTCfeR+{U^t
zGY2KoYq|hz98@nQ`gVo@VZ<R+;FJJ}YVcb_<zJj>zsNxiP=102uD)aLUlLFnlrU7H
z4)N&T?4wnX$CiP}A0AAf&tf0XI}S^Z3;JeRe;9fzj8a72i~oMQ8??7_9(frwX&ttF
z`NHJ3He(sQ`C~4)fMMlsiKM#*jRu<0g%ajrh?tR{olu%D)mS2kCNL$mN>QZi4^rVe
z@sJY7hs@aSL`We$n7Pj)sPabuF1W^HUp-ySXA+8Ww}?)Qo*%Fbq=i~PecEfszotLW
z-H|?=no$Rc<7ZnRr<Yc{9dJVAVh7kO=mJY|ch@xbIU?L7Ok3r-OIZ2`&?=WrB^;2`
zoQB^7*Pc{2lkTo$Po@y0`w5U!uIs<bjVh3uz+?D4q~F)VeVjZc$$6e+VYlvIeETM;
z&U?W5eS3%AKI^fN`5E)_=C0WVz3d=&Itq>JdrawR_V=3w5`uzuP2U9uLTrE8*+kk2
zZNgKN=n;V(#5l`j%Vvrr03YAHX=U5#29YHIZ}vUGK*Jf6mJ9Uu7m^FE48V|f{EaLG
z^P2nhmC$MsPb+N0pzdF*Mi8Zvv=g4J9f@v$IMg2e;h3e`q2tN(<}gMf0^O)&s;b}_
zJJ!ZcNYol-I=U^y0E5-0XIfOi^B^EYMvI3&+FrUX@Auj8wOvUa3^D9E@BaQ)fKUW<
zuA|&3mz=%E0=RuwiyF4o6|cghgYJ~fnw>k24U$+;-YCG{`@gbKgv=@*By&6k+L!5X
zUphdiQgRG+Bos9(I0vp9Ea38Nm{=joGz`EKedbO-;KrvJTwvzoeqHoWL~-%%a*+P#
zDh+zuuLgh2lSNLjH9i&b%8~*_{Hdl>L&-LL#=KvZ#=_R`Pb=fkr8AEO#TRA?cQ2<=
zFl3d<M4{|ss|tUa3Hj)6YI+EJ8J>7ia3s>GH(Q8p9De9GW-f-VVQ6io|EjyRhRP5$
ztcNExtWfVimg7nKNRS3ICRVa8Vd2s=c<-f0kd*}Z5OvtqgdB!9acSn|rkjN#8tnJ@
z*TE)@Ln>q7!SMYDA;4)dSja$Pt6=x<Vnp|SNN*CU$jmvq3M1<G#cB^^Z^AYctmD}6
zSAT)v5VuQXcwqN+UTd8(Y3~Xy(WfhBz}pQ_?oYAyu-@niTZF!0(;;Dg!BMqhmONhb
z7|CW^W3-2_Aq>~nK@mQ(@`o8Tw?$<*cL@H;2@-{S9KjIg<0_by=qPJtv>K+ZU_Rma
zPr${uF-P61Q#HwjqKQAD7X3e-I{PWklAPBrkzD$$h8pK6rH2{Il%1|vBcz^<&u8N9
zMiaM&A8AGkFc2VNk+|t%Do%LRTUi-Fi5Dssi&9g-1uy;IxHA_R>Tn2@VsY_2P&J-!
zRtp2D0sT<4{|@7NZf5EF`&JK%`4BW#M8cs6^7TmcZL6&@9`v5PN;9wHK5w>EKK~KI
z>3@WlHSZ~qbJGFhY0&BUref6$?-zYB0*fPn#P};gu3^cp42JA$Ue45<A#MMtGWR4U
zAdPlRk#X&)@TYx=qjAcTvmOr_s0gs^XG!xi?YrhYsGq6dT=*8qjL;;12d0|)z8)qq
zmyh4zswFwu|M0q&Td+;VhzsOcV3}88t)r<)k<)4V6E6=F8lkvH&SyH$ElWxcia4Wi
zt|%?I$-v@JPFYhkQPoHqUU6`}iMqlW9O>B(K8a<=+fWY6tM-QHv0Rw~7EGW@A*#ya
z_YZ{2c+P~s-CPD7k8HDyyL?_NiOu&`=IjiHnfXVC#Xz8dYyzkUEaT1DZ?3Kh9-n1o
zR#0PH78GX?C!7C+rmR$wv)VH*7oJ3@4w|dZ<fK2@&J$|FV}}=dUTGW=dWmU6O<k&#
z=B9~3GS!HSQAqm+<xtaF0tA%#62YjaBiR7sI-R_At*?V2GaRfE33Bm#YZG)(9Sj92
zX&R^jg0|mLm}=kmq!|^&QHg`hf4E=o$GRy+J@ps?8spsyyD;1QP{JvWTx%#+S$<K=
zuL9--Gr9{$Jj3<Y3^0D)t^a&qlX`VJ5UA1qWgeqhC6S<g@A7E{{M=15pEXd~vO68M
zOSdj8=bmGQAKr3y8=f!1h%JZ6!}0FS$&f_ZmF=gp-wq;xeq%Mskj7dDzCYe`U3LG1
z-_eut)prJaK0YEEn7z&j?k>QJSJh8VO+M7jgD^kC<p0VNqb%jGg!Y7UgeYrK%fq$c
zZkvj+C6Bub{nq{=p^)ymQvj1CBEIvDT<1c}*MHKmEZ3^H`upIx$jgxEZi=$T#%)29
zcl)^Dv}|kk>FMSz4;-JEwNeE4&i!=Rnlf8JCM~3l2d{%D!A0}nSLq+=UXAK`nGy88
z8%8U^OBN$kum)mdp94RiH7y)34;5N3fz;#;5tUJsTB~8KYfpyDGLr5g0yXs*sJp4q
z0$VaT8{)l9?l<*k3d4KeO(>M1?DeH}gW0uQ7VbNB$<N-4C$mw3&^`Bfe2V@jLVh}x
z+fRw~W``^1nqDiHz|H4X=T74@;4yLIV(w(vf13utl&t7!+e%a%G5LmsQr_3N)jRYN
zN?S$>2~wc(pyKdW8E$eJC2_BXo})E%&r2%h_FJ5v<(qPRpy7=!z&wdo5xhlU*Z3`%
zQ3HWxnwzJW!s3nlz!Vv81qvHSsf>4hH%^+AI%90G2qS+R4LjTY`q&=J<I>UbDA<hu
zJ0%DVW4KwyRa;k6CccLprss8-H^)N+{yh9*k`ND*q&3!-7~7nLM~(qiV;y{cX2dLk
z8@*pZ^}q%5aQ#MW=<k2gWR2?h88v@7ab+JQ=?rKbo>UG_RYd^ou9u2;<8D~~%?DgN
z5Zdb*F6JotILv|pXOend4=~=+#hYftzb*HU@h!IugF<NV3!88;NCL2D|C=XZy~jE!
z)Fxa12_4VQ{z0D!NnC_2^bkae6btu$S84-;EuFhz9_1JtGdE||zqg_1d&P;hq=G5-
zfor3|{OXOV!KA7sShdT2xb#rco6iz>!V_4I^J@Sdjm?c!H$2>?dI;<`)6f<(9H!@9
z74iLj!eY;{X*uXX(2P*V<z@9ZW_qYpR*}dcgfPwtYAi{gZQkZJ+7i333XI{AmQV?<
zJtdeeDl^RF_=*T~{o?4W8VUfsS2t&;<*snY-e0+L{R&>Y0csUN@V{Y(IK+eIu8HgS
znDBh?-yDOe6KDX%mfm1>C5Ius340IhsX~ZelG4cO=NJ#?h?M=#<5(Dye+qw2n^6ZF
zlz#`ZLO%b=%?P|=`~0{QxMn{(rch1r(&yf{L&VQO<7O5ybnky?9z(&&H^~AQB^CTd
z$<s>fa~f!8NY1tg*U!{d64=sX52s#N-=@+>uhmzzh(S3@B(gXfQSZ2TT%~Uw!-0(g
zA+P`i2I(vsE_F}Y*BWpISf|}wtHBdJF)YzQl`>C*lNHl)#v=~Oyj+V3%wI|ZMy0`&
z^2QVBHEt1#1UWvWhfh6{wF$gpAD7J%PanUBHVaEy#As5PwFwl*82L0D>cS+w=%+?U
zO@H$~RE|$#6ivK~ALOeDgH6-`Qr4*i^WdLolDTn$38nP&XNYmcHd|G8*BMtj;9Z#g
zwO#eU3<5q7yhB(KN_3Sns^Ha>dL^wh1I2e#f09<lUiS#{TM&e$m6<cp+|&wjLv{>X
zhbn|>4SU9P{gr>0Z4~5eN%m|nasts;;msk(8+>JG2+l|0Pll6U2NTfMnfUge+a-x|
z4k)+%OHV#IFA^uizPQD$mW_!QnwKDO74esm4ZBY>CYN@S2XW+!0{t(kEUq=LGWwg7
zFt{VQZ}tn@e#yqSr;hE}iOfYHxB_go3vZ5kI6@5qrpT=$;)U>p=`4*E;2H$XQl~;g
z0*llrCm6{%EfP2c9I0RgoKxemqUR(bJ7O36U*gtGDy$@r%lsyw-qLgc{NLmf;+EHw
zyTR#UK;sVn%r>GtFnUQ}&u4}ASnWO;-Io|Na@d=Fo)HYTwUmS35WmSfsDe*>6tu^<
zv=L$Q#rah<-+Gw%<MUsa>T@~PA7wgJwJc(93>rj@ua1M_>OQIq<KKmG6^z&GSWP!`
zPYU}fn#+6E*$NWVoaM)^(hW5m3Sr6CCL}&{tvWHws?|!NjZF+-(#-Dog#8KWtmIBm
zFV%9y8pIbD-PRA;vKi12{GqfchQ>yf8dW$pP`9Gal^f@NbcLwK%q13do_%dn%*W5=
zA`v}dvcyBe=7=l+(=GFx5O<RVNLqQBKjZwup(%fBZ48SP_bQ?`xDS#6Yztsgk`(WN
zAK`JY(f0~L`W2Iu!NpE=odxo)EvH~<*%y0H0Zu=9o+GuZ2w_y->`B#C(`@Q-lmGZs
z)odgxn;sI=3G|QF5@t8Ldmngetw9R9O;B#$KF2%VnKNWu$J-Nl&Tdaq+4~z_Rcjf0
z!ol|TE-sSvtT(FE(Hn@(yP<JxxN4v<Z&4d9R8USEaB2Hyz@g3}31ecZ)q6k{Vi^Ae
zla<(TS*=lh^9fv_didPr(5gak3R#9c`1>H3^Hs$;y;_l<()%}Aypez~Lg9x<{M?tS
z&x7s~nY~7*2p^#FpvhdA*=Q(l7@qOrM%N*Gptjo`$|C!3-!GMsYKwO8(ga?P)MmBa
zNp2m);)0!gI6mu(uQ>8}N(d9lj^|PbhoR5(NE~PxO|&&Z9XDLjsZZGsf5)*O15($?
zgTMx*gl%LUkvoyrCHP1%0wAb%yB?{Q-+~EhRB8`465@D{*Hm$hH^_>xiebJyDu`ZU
zyO`b)7`8rUXd6Hw4E&%N=1AkX?u6I%G*yJ<+SKm<E+$`Jqa#t8Lj*ZO8=*CyWDF7%
zh~dPHqj)>~R&vIsgXU<qgS|e7=ht)c$J1SYE#o%lNUIlV0H2fCVY)<#gbhS{m?6~N
za5IYwC3c(upK(W1U%ZV>H00-9kIN4C>1UgyrusPeVHGe>;t!?><Y$0z^!(a_4qy4{
z&H(NAjUlEtIRfi_9uW-RwoyABCrBXty#={(cbky~)<U%A(pvd0l&2Q?c4o3vl>b6C
zxuG{x`V%t1!yKSO)XkI$?`_I6WHq*h=K6UN_(&3*dv=CE6S>qMfr3B6A#v>jPqalx
z;H_BrlV{wp2f&3D)lIf!V&u=jv;3^_N*!+N%(X!}{{^#8E|+E7Zd6}s3mOr5YD!~-
z=*35~g&yR$OqA>tQe`mn6^7wuYcC9<wOSoH%e55oa0$FQV(S{2$0NBvsQt~)B58xT
zZbAV7xclF{sVuwYxl>XeA;jMurop=%-@NtO%rFuX(PJE{mf=Aor@P&7WoVMoq<n%S
z#cYlCblW`ou(06`fpDkPtjSSo<nT0;V@J`1QU~`B1X=ZS12#33uDl^(Qon7a<)+a(
zg~{K_gOr_dCZIUJZ44QeO71uq_7IbiQ<UoPh`!Uq42e+sLB>2GR2b+YC4yl0deHnU
zoKpFc>bmcyk|~Y@!E|}BDB1$FS+Y=pJb?PIU8e5a`!=E1%nhv53*~_YNdVbL>({K@
z9n>;-ZJ@M+Umr8?9x|a$;2RR+UI8Zhtd1$C{;uOb=6!<pXpGpe)hWx#7w!D}3oYx_
z(JZ$CQq?2=_;nasRR=vOErkS;pXSLxweeo*wUPhGsQr;$_IsY_uauCq*|fB%=Y9bA
zF34IS$>MiTH$RPihS@zk6UuoJ0up$d-9{2b`0ILv4n7r%y!0yJ!20^K1Ma!LUW#IW
zXv5^pbAu3(1w1V#NIo!^33^bnLwH=y;XQ1Hi4Uz(QFhlj@5SjHI)|z#{n}Qk44C`0
zAtH(BZqKlYF*hEZZ}?bsdzf83AF=zhv2VW?&T?=<t+LiQrnZbxwP`fi858s|fS4F#
z+tK4N!is<TVia_Oqh;7c{tI;2YJp<2GlEsjM5)4nxln|?y&6!3P{acQgolP6)*S@<
zwZDz~;EdQitv;B9>Br$1kN%PF3<(}a)ATi?ul1_n?SOez<$A`=c}C5}&w{5x2$mfx
zU1Y3xCgH;x?(G<6BUH)0XH(e9_zf%`DsCD&z+>{-gSL`RUSa|mIrbYKrteYrKOCu0
zf~|;UKO5mc?y36Qp`|c68eq?>wGL}^YIk2+SXEZUNs^9+B_Us1-GqU3^NgIjnIs@^
zNI%PEnNc`+Os7%|Q>x|t#Yz3~HCm(@F>d_`Mz<bWALGkd2;~l^*F_cOGoJ(`B8Hr?
z3eVB*T0F;}^OAuL=d^qPUsEIu2%2iP&|@UWk3zb78+Lxku&5#Uz+PU^Z1u(0V-1I@
zXXLIG1qkbNnyOX2FKx{s2CLyo3C{N=_K&A&fe=q&g<+5upnW?K*XA!O>xf^%p>Zhw
zrhl57kh<oaiJq4H>x&#7E40U79+xx^*EtR6tBF``1%oSRhLxj&N6csz6e8~_whJ{S
z79WLIwcTCWjg@|Q4+cY8duX;i^-}rst?PY*mwD2d--Y3&DFA?>c2BER*{gij#a(z6
z3^DMng!Xxo0S`5Td0%^XowM8Y`{$cy!DpmsJ8hYE)LGH=n?cez*ijj>IyZ|7q2aPP
zhc2G|@#EzYBBr%RKF?G@wFuWNt}LULNdF?7{fKL0`)yY0v~7sdR)D@}n4u%h<gLaC
zrf*1r3W)&#me)z8*XKdcudGOzV-J=G?XkH|eEFRZec_((F9wl_YtUxGK!{HieRtl`
z{*s=LESFjRcz$e_3U1CuQphSHX~yN_k&kHIF^@6hf_$t1!T!Yt|6l1Qh(Y+iTo9wF
zEy^P*B}|YR-n985T1%H4<<#*;s3kk3gehSRS%m%R#wb81*!3utVPXl$A9~#+3jmb0
zzYCNtf3yvd6)cGcIXX6nC~numc9X&B-_QLP0h~iCL7Ss}@CTiTxGz)&h9YjzqZYY7
zym)7lWT;6}vbvGbBvHs^y4;CgO?KyEiR29>a_Unq#Lhw~OC9!3#qtbteNRhQaX)GB
zV>TWc1`zoqCn>wuu!i(m1Keh<;kRCfr#yB#iun4>_D(1PP@s>FD{h3I7szVftY%lS
zQwwz3uW|iK$BFHPYiuP~vj}n+{*5qRev7V>jp&7UaV7FYcpswxCMCXBz>Te)!%y#n
zOUU+Ariy-23?0*ebB`G+#NOe5JlkN3>`8;ImeCh*zvn=MrS_{KC(R}Zo7~>HPbsX}
zO4U;1vF$jDEcocK005&~_qe}_hjrfm4ZMe@CGYdKhr&=YtywC*Iml3hAZ8`sC239~
zcMme2U)5JRzM@g~a<<@Src|D<+19qYFt^08^E;CbwyMYrW1F@M!SO&N4q++;m>3(D
zD69Q?7yix;OX6A$g_WL+^)aA`@9SwM;2|hjise-iE*9t8z_WM<Q~tW5<ui6{mc`T$
ztO@XhFlhH67_EmVCft4YDHA*uW1D5Gj)ys9;l5k?7j>(QHc>z;rSNC8G{7w0Ie%4h
z?rw{}cdh&1y6WO`UDY2+&<61SbIo`O)}0#u_Z-Fhkz1)@iAiFdSIz<#4#cCbi6}>{
z-@miZXcpGiJox?aKody-*S4#e66wRY!gJUbkvenmgzb9HAvZ|M{FTJayUq?7oEl%t
z{Me68gFKN9p;5RcXNGh1^~8>#3y+U!lM(;Fm&r!k6;-v1&Ze{*AeNPaeu&C+JmW2I
zu`N0|=SnwDV|snWst`%nR8%@TElYQ^3B&h=a`&7vC4C_SsxX^YTDyBDJ-`8!C2^^D
z_?Y-?U;xmPm@!|_>mMD8aEeuKF}b}OAjkWihk}UMDjzf1$bScOn!v?v8g!Z;oI#HL
z%62yn=#mLFy2nB-mH!z3*$z%tkZXgtY_LIwIiONql^lxikQFf8|1~Wi_U@5C9|REz
zU!-&LeCAiAS2;vH?LisdcDQqSU)Szz2Q|lTW_pF?tRoOxa#8T+ZgsuYP#AouLyRN?
zF1x;#V}qvy8Vrag_VlYF(L!LZQ#LdY*56iwH~0TeXdO$+l5_#QpOSeJ=6@XAXeywK
z*hUxE!QbiZaGJ*KkQUJFpV!0HOE=F%wKng18A}LZJ2hL(F@6J^(mZ#?%&qKdmMPe5
z$5CFDU4xzgRzm(+6JtmT#FigVY-~*iJ3n25&VCSH7YCZi004E~t<D_?huvX%-r~u3
zhMoL~^3S^~Eyg3JLLrstZexU#s~pgc!~=Kv?utQ~*$9bd3G8Gf?Mu4Reakb^f|FXi
z=~WeKN}JvBXJRd{9jJC#<*L7viWtg)jvK-2Y-a9P?(xSJkU&AO-PULap>DX`HZSnq
zqK#y09tu{mw+rFpLkpzyu7h&v52lb(-~axKGV```VdLwt;8?z(asSy~Y?4sMz%CI~
z_F(2!J*b?<E!J^oV}MWmLkEGx?l}#vuCJu6gSl}<QxSeEffI!SB|(@T<Z+1MqVPnO
z8O`Z{Z<F(gB@-RWYlNBwa2*KV<}zunqAy^e14#giO!?<d`-psB_0H32gGu>FCT|qk
zm1K$y8@c>^YB&79&hPsuwq8vIxep-#fTJwG_5Av=N8ZtO3bm#!94edta=ACf?9&}j
z#t!O``Q^q*1-mwjWaD|ZT}lv>&HUw^?wM`}{!!QEIlmRR-QF46&|U~sjCfnj_3uh#
zg6=R6y-sPAJPLM#@=G_A-YkHa_LrIKTr>qx3iGPHzg-}=11_|mFM}rrVme8|>U7iJ
zp@6)WUj3P`3uJHhU*D*w6T?vtrMJ7Q!_8pkHW-+di(>Cq_Im;Mixu5uBuAvmU~RBj
zy%8kiz?_*lS?^@tDaOA5lm>aroOrv`W`v8GKfw+8s$(kuCn+y8hw$(0qGXJIn5Wfp
ze++{hFsme$F&ln*=-(QssRFv4B8Tee4cMy3`MRxUP#PqLsf&5%ypfuz53`rw(!-2-
zTCqT8IuTig?_+5Jl6oG|NnMf!yc(qJsD)-Ri=wbXJNA6RTkNKOOb`=f=fv4Zpe~mq
z&xl^+LRDIJi6qSN#_6(~olFHAC5YDt%p4U=p6o(CHJYjL`X=CUm<avdhh6i>RYZmc
zF6Q7I&v|=>iFr>Xwh96s?NQZ?^;#?_1U)axk1avcgUU#mO&5*3IH1Q&M7UET!KSZE
z3ce4gdPhBJ0O0xYQ6C!@cl#e*`|r)17%O{pKaNdJ6qAyFyL%sEt(F@QshWH@Iyz9!
zvR>%_8CphU3eH{&t3#`yS)~m6ANkrutD4!7Eqw|&I8P}HC-AC^gCJM-&9TZv%D1u+
zq30It(50-r$_W~2bOX%&zuz!!K9Gn1t?zkGmFRfLeuK&yJ53f-HR$nK^DQgACnuZ0
zVE!QP2lxmg5RmtJeypc>b<2Wy6xv_D7%2-R4kC^bTfjW$=LbzF5)FV3sG3FR*o4t&
zQ6N0w_!pqiMHV-ee(1dVY5te^#%hrEqt&5OIz7$Yfq=m=O+h@7MC|IE?l{=(I)SG#
zNv|o!XdFvPcy=&e#l)c$I^cQjuI}RoC{3mFmFZ4So>@RObM`nHh=zN`-So9hv2$m^
z;>eHsje^dGV|>g{t1-{jm{9x2W(@!GfYubut~?PB76e*t&#1liQealHj6nDAzv3~c
zJa<zaiUKp|U>Zji(%nsK2{17{BUIkdolcjNYT7ptS-k~*=Tl|QzM0EUif7nvvVT&7
z|K3`ag)vl1yS|*sjdIxP!SAns?&wPR4sg0|K;q5lEJx01Fg{g<MpER*Vg1VAYb65>
z6uvFZ&fZE180bsd&+yW&+pmerq2b2ipAUF8hD9l63&*L|^CmM!?R&!rQvnn`dT}Lj
zM<v=N3U_#r(Xh(YqtXpBdTbSX8W%G>19H6HzgV7-m$J2yt#|P6#TU*cFl0o0xK5KR
zk{;=WVGOe-o|9^`Vrn-D2?Ox{-IXp9O&lYhnJ@27FCvdGJ`YF{`WcRKb?MXNdq4n~
zmn^n9)z5GQtM)pDxt9nx8h^{x5A8!<?{@p+r=JW-lt$;z$g9v9fAMNpK}&xjKXn~>
zL+d>O!sRB3J5cgR**JD6bp6JxdEj3k3!OK+roG($*v2y`+qC|pI#tM<tgoSIEEQgv
zk*1{KkW|MBc>m{eGqj-@Y!>n!X4#%DG`9(Pkv`C$>pk+^*Kw)MZ%;3P9}aQ-6VRKQ
zw0x0K?Gq&NvL>2J9=^%&C!V@^{+rG@9=N>m&vLoN2$S`vh9&(AeXHwd>JJYFhA8LO
zD^K({A_QgM86F$DO-VTH+L&4;unHO$9>pL5nAL`*P8B^8jz@T(&vQKRz^n*2<^@Hw
zHB4DmcJT{Y3TBw3C-Uk2isyO$!UpYc3%SuctYrDsy3Olm#`E3OK(!(PA&~%Og(AcV
z$u|>^Cr~COsj)=_aY~+=(ij>a@d5qF4;&kWjmiF&D1UVuW&JUOqx0F=Gw%Qiz)D18
zOIrp-#3b-<h1tIn|0k^d`>UBc=;Jfgki~vsNLVtvzE<iiu<#HDAR{v4im*>q9?Taw
zcT>2)#x}b4XDgx34abL%qx0?VXy4|kiq%@Nh*siMk>rW%%J^U4#zAh)*mSO7^VxPO
z#h#rYxBWNZJ2Xdfd-YD;I-?WJ%^DA*F3KU?X_7_>s&^=e<RdbOMYO?PZK?v!gQoI-
z-EtIl>n8n*Mb5Dgwh(B9jG_~c6<(2MBAXGnJ05Rk)AJG8eZQI&gJNza0F7iSK_BH&
z>4IuSV~J=<Xx`XIloR8Mabd%quI`CHciD~(e2`;7_{|FC^`FY-vBvfT!ancIv{RqU
zd*B{I|DyE2=Mj$Y1!beZWkrDF!!+@%CQK=7A{BrforshRb~vF8&3>~UE#>EM^8*`o
zsE_p_C7r4|+!u9urXOU^1*lYKH+Ahk7oRnJgaKQDA5K$Y8EG14dG0~!0%gymZY|lm
z0Z~u|I*zmV0SN`CrJlzm`ytat2P)kp#N0CNX3MYg#wS-0%i{v6g?)0!8m?1tS#c?6
z?ceE|fspfVO-C-jBs~Ma71j0v;>5Dv^LOUVOC2?0O-2uvQwi*E986&6No1Gj+Y+*o
zd|M20yao-quHm}7LCGry<GOZo4a7rx-Zuqun30!(QWA}nOFzk?1Ax2zi-r`pdN9xp
zr6cIN1<vK`$OmYO-TGY;3#Qmm+<?V7u`aF!^WBZX_jEexy011ja;_~=<a3oEJ2!ff
z#512Onvcz-KiBu|`Dy1(oA;l@h}xB6%OegLQ|rFh?WMql0YX+j@~DbKPnWKja_OWW
zBnT+c>N|nqf0QBRwD!s(Z8rT4?oFzA5Gg|`+;PFQBano{pj?(X22mu^C4dEge<uF>
zy(~N6C!%c?e4P!jgxb|GjE#X)i<mVHmrhI=wdT~|`j)4lxa*~2cN}`(JngJTGHupF
z<#5uf?dwU$c)n+|ZPeQIY&!;x32n}@eJFYeyvO%DLCj!)5d%8S7kG*#C;U3fYTiv~
zA0AZ3CA3UUohJqUP*$Bk+{n)Cgywd;Vx{s3CM%vKr;~1F8#y%v?M1GYQ{VvVh~vrQ
z>42JG6h>;4QY8w8RN_32Mg);S0@99Bpb#^(E*+u<ZV>~ES+@T`ma<*L5e_~3!m|CW
zDC;-8)aBDW2sYS>e0zKdBp+d%*Bbt@G%>~iQ2JR&_Wr9!r=#=M0(sL<{|tLi@#(wA
z78E{1m3Bw*JPcF-^dF7@>Mb3`=tgZOLvpC|DBERcew#CL|CiJ3*8L)<<Ue5=`A-GX
z6^`9HMfNVEb%;le10Tujb89u@t>&uGL_?l-T@;1JRQQ=HDl~3+SzGf3{urM9`x>ah
z_`@bHe$Ojc4t+-sx=}oexYdmR4lfRQjL(=vd}5G1B!yND5I=XiN3N=bAdj!b2Amuq
zO7lfsTuk~J`V#o~4cMfAlA4Y&+;eOBpFKmNvI7;Pm#?$mG>yLWn3ij;480ui5|cj8
zR8fffa2fuN7U(t=#Z_}F86&7*7@#D#5<$w114$kymHs9nPl%&IkSg1$2)@ZlGh0<|
z*;V3`6zfpT{BHaeI)QzJCg}1+`9AiQ^Xp2m6@f7EU*xaw@+h59acnTqDLbEK+-Gpq
z@Eh_~*Hf#w|1OTyce$^wt!>V5s3C!mx4Oh!xm|12nZ}^G!;uW=im|u71^)aAPB%yX
z%Z)AroBEBoguO+!P3*QpDM;07#VCl$l*GKjoy2X}twe4)UDQ3Ew(ymF#yq=CV*0u2
zEsaD!kCD8)%?0yw2W#fLpt}j0lcb48vfzBB$CtaCF~?i4YzYy%dHVP_olCeLu(QzI
zem2(277Z}YTRR!}R8q9_;WI?;Z%Z~UXGb0<O9YHLG}`p3ZS=__GYvc-SBqxLYPEHS
z_GLiBHUwEhK4_O?@|bhSW%MP4NS|<R{`qtzaIeaP85_vFV?2gc%=O?f-`(Gcs~(2#
zZbl^fnEt`f`BPS5*)$5S1LsD=fb6A=_ko7$x7XKg-~7(`y4RW0#7p&_r@7eIb$cXr
z^{ZL3)TeavTN)5Dipy|DTNy2uC6NNWw90m$ifJt_Eyo8y^^_T0@@KsCX8o5154k);
zW;6=VA6!m-O%?8o%9%f$41sXJz#qX)mn`>z=U`I2n7&sDDbM|Oc;CQ@gxxpDmHv!_
zwW3^?C?WsVQ7Zg#QDjf?bM7{9o{Grp`7lU~I9ABB1RVg}b(v{f+~PXz(d!@!5cwCF
zL?e^A`;rsszgj{gW&_Bmw_hE&o8}Kn%l1Gys>vP%9Ry>D*felP7Sa=9r<u{Bji+w{
zHcFEv_KG-V^d}1aL{T79Yl>gtSyKb_`8+*c0Xu${klk)q*8I+O$OMoP)ToU9Mg^Y|
zW2N|O-1<;SZh)<v?wx;YLfl>{cQLw`tuL+4Zqv{+u3!;+PySzEueFM4HI^r*1`*@4
z|3uq|iS$kBf5ZYxBSgdF9yQsgb%cT|XYhwGOQZMyeoF&*1gVMZNRPe3XA7E=GgHvm
zW7T2`D1JAWIw|Lq1s933Hi0ju1XEG^IGxq}YrX7KZ}oX1ro@}i5+h|}8ehWL{&mci
zl#2y9-?RhUD)1SDrgMeE=XoTcctOu3@IHznoP5XMc^brUe%}RM+`W>ZT4`!5^xudb
zQut{7x3Dn$(l1N{qOVt45oBj$;W)MotJiD>RvNv?qIZ!8VFzX$9ZyV6X4KDnU~^(=
zRYO&eISEhPbF(XqUA|xxSZ|KQH{#<ol4E4M!xI$#h-}z-NeU1dwn7)4re<U|k0MTm
zsmkvfX7`{JQYkpxi6Q8GvND+Iz_=!p1Oy=L`gOiE(Y;z6cIK*2@A8RT8Fp!BWnX!Y
z2QJ8u{k!)l2KI$?TZ7yN2(r5Up^of+4_n!k*83L)nyDkJ=kJ0<)(2ts*~zo(DcY^9
zQhRbm;ZXYP41a`;@>8;d|00Wlb60%a+xz%v^|&G?T-%8fTQFni$KvHrWFNa}LCta2
z|8v6L@)A1qs{JyX-R4u2;S)f_RkP)C++FI&aHY~0hXO3x3v!uB@}Z)gxox|(r$yvX
z%aS?ezwO_(l+jyFSZwN(W5!RzF*JiIC`B_YS{Yc+N8)6tH5nL(QqWoMHLMQaRsop_
zd<&l;rI_{RQ6Qv^u~!0AdZ6;OdRHJ6;i*wFat1vML)H{<pi8V*g|r8@=Wrk6o(#X#
zAQup^E<p4lGv4V9e)QL;rtKLVuyP03yq27!xgWWa$G*F>+Z%*}%XjYs{c*Iw!MhgY
zk0CnVz;`cN#Lk$_ZNy}KO+zsSImeraV|Ua0FbOTHa2@#H2rwdt$xojd&@0MiDHz_e
zxR{!Sf2mu8rV{FmlKw#PQ?M+g{<iA4ZUSA&%5f1i`N0~%L(sx?;>;*?PBJfW>ki2p
z`zDVBY&fNm0+7fy0d$II)010?cmX>*XTDZXWLyMKjMGEC-=|cx`|iS+>ND~zO0=|7
zqVmPjU;X&QEAkws=f9{3_6Ksbtp5<FC>BB$kJeFg4{_6uAQy8X${XeQEao>z8O~DS
zSk@oqBuW%ScZ|NcRS|(zV3xJraqnx2$r5h{aroa~LVeCmaR?DSScKs~iR^1e&fPvp
zrbog4s<^+peb49*AaW8w=fI82fM;Vj(3aUjUS8FzEHP@cQ}jZ_G(Ps9ldG1z*i8r)
zMU*urK*R-1<ZR-*4JE6}+2+S+p@%^6ksAU0b3G{tW;xq+ZakIApjzUh+R<kQRiW6l
z5@8LMmRBwmy$?lSWY6&j#o-z@&XRSd?i~)5tzRzFzD>DcxsLNHVc0Qg&>XO71zSq#
z%Ur_yi$w*UOW^ss`l8e=C`a<S{yVzfb5Fgt*vI2ae*rejhPc8ZM71j-%Q<G!zQ#xx
z-s=xQ`a*bqD<xex<jd5^P|%MDAz`Td%N9f@vo#IT14A>Gbl0uZGe&COKn@+;7dV37
zgrqe4DHOh*i%);^nB8H|cR8PyhU+f}+e>070HVSMaOU2go4GJN@IyZR(b342S8#(I
zLmT=pEnPek`%sx~UeWDq8?zk_gU&N7R2`QuFNIOgu)4Qm!Fb7Ay6kZU|I*h<+u)>+
z0D0#ah=t}z3sPjFg?N$+B~k^W4ohnJ`7_i0xRJesNx9%&)VabUp8g5#KNMIHcP)}x
zYZVLUTDy3C-^S8M#!c4@7fooheHtsx6D6rtN#8g!x8)VpQk$~l(Rw0+J@>_5_3+xa
zZB2In$z2E_Mz5^FyRp;EK+;4;POEVJ9awy4*5+wBIbE=5`&c)9dU1f0I8PfyujsHn
zhSIey7lEL+*>qug1=q#uN>#5&DdN(a;`!E|u%9N3pQ=IJ>ceU*UT(ceRWS%1q7I<v
zc=+O6r7*x?U<<F*9W>Sj*3g95uP@PG9q$N0ORv`8HhYt_ZkLBC*TW-!^@;^?`!N+J
zV9KH+_0q!ReZU@1AIyHb_if8#hF@LMLBA3D-%k_S6t(O@0P!K;Zxw%v?f4sZmhPQ!
z$naTM{x}+-$)5UaZxoS2F8hI^@Jl*`7F|19NL%@b$TZKlp;dp3Ka{$*AN#aQqzX)9
z8(%994O+3R*GDPQyBE_pKv7+=-nop`Z^CZprC!zH2RIeXZa9d^_dM>{@5@o&%vm9(
zX?@!|F@+(pWQsgX6>|bpl-CAa-f!ONH9}mT?LQDX1kcSLYP2H*3tCN1E44NoopE)9
zR{b(!bx=Ebj>*Lp)}RSQmu#Xp*tw8KBDYrI;q&qWw2r~Yx;zz%KdNI8AQk)b;O<M9
z=ru`kVy(B_m3LFqf!*5gLu}%M7~7VUPkqD<dehmfnCMur_MjtBMbze?C_x1UwTXB>
z);0Mca;*0%x}rCiE^SL=EJgLA?bWlGKC|o3>Ex-|qSp>zfVRQIIM;`?kF`QC8<ahT
z;S-A?t(?~L@yP%0n)^Rm=>D$*A^+<ya9Y{{p|=R5n(uzU6s{6luBJw=X1pfOX5Tvi
zD>Ex61M~OBrN+$7%g)Km%0b7>%*)JtlE7vDKL*%2m|B^8{oezAPsXi(4*>ipp&(u(
IY8dqY04IEUZvX%Q

literal 0
HcmV?d00001

diff --git a/packages/client/static/pwa-512x512.png b/packages/client/static/pwa-512x512.png
new file mode 100644
index 0000000000000000000000000000000000000000..3c47a2cb21222554af2e05ab32829d50ac08196e
GIT binary patch
literal 191174
zcmc$_1y@^b(>5G}Yp~+(?piFk6o=B{?pmO@1TXFsm*NGAyBBwNcPLJ9eYx)E`ww5%
z+BtW!ldQ?iImgT#Gdo;WSr#3I2n7HDpv%iisRIDO_fsGM3E_RY_LzNqU*IgomBayn
z>R8lgWBB*i6sB_ON&tWt9RL6c1_1v12;>j|_|5?U{4)XoKBfWy_)eKEYQpaq5KKPF
zO1-b|j|a(C|MvyiNlx1Z0Kn+|?|?~W#vp!w6VX*(NgDAVA|eQp?(YfJzxQ7R$V-W9
zdMuy3xVN!sf2NBOv;8ucp)AUOFdjeNoN<Pbj)pB2Xr`*FiX|<DB_;a}Egz~uXxYWX
z5RspMMT=g-kdQRXgRXRNwz9^*;eF+4`uX(c$+WosSR@)I38Vhe<tY=|@wwIQcl*4T
z7SQH*X;J$BpHGhAheB%s?;;#+DA;Z2nmh&g#Ckrr94`MS6&(QbsO+BmF5#m^FD~~L
z(+fPz!HYLh(QxN~-%yjO2dHW&fvi6w7*$*mR?i(GFL^_5Z_ZGmON-x$t={lqyUHN?
z>~yP66`e4tbeo;nP8cv78mI`obJs{kkMNbHMPYnX4ffE*dQ*Ofwj+zpM{bCJ+m86w
zv-|V#n|v&32fMDJ?!^3+xGB$Qt@Brg(9lq(#Jar1I<+Eg9Yr^~E2Y-Pz0RA4FL+X)
zDYxi=Y+(D3C8b5OY;!=c60b<_5&L>`&>xRJ$E`179TA-`VeIN&Z+@dH=eEUy_WIg7
ztJQU`W)8mJ3q_c&EYf-DYRfs33y;ufZIl^#QRf)}^SM~upszoD=UXxk@{@(xQxa*8
zEVQ{D>*-~<xw(&PYcpc%bTq;cdg|wD$)Ukl{;!XbWfB0&E8cf0(#c{pQ33D&6|<=E
z<uQkr{B094ow=+mOF7^3DtDvZ%--Dm*hnC?u;3eZt}@$|iLJqv*${;SS6@=RZ#@n`
z0R|9|i;I(+##=i-nf|G2p9iKme7c}y5Lc^f?{%ug-?DZ|pv@ZE@Kj>~9XT#zM&z?!
z;`BLl$rkfCjurXjUwlybpY7&L@c{4U63cKqqd8eeFaHB<T-!gnHOPOxGS+hReX-?R
z^Ilkk=Jsp%bRQy*Ff$h?g{=Qc*fonbYbj7vTb4>_$kkLRP^T(PO@M;{xe4Gf<*=9`
z06GL1yFuZ^`cMm{$#UMGkn!$5q!xmN=@+g%AGM!*?bhjJ8ChxV^zySC`z>v@2jjjY
zvEHkw`2G*1Dy%So>-=C;QS?<G>Remb_dQ02@qfz7QKHY1YPvW1TVZIj>Lmu-mGkm2
za9An&9Ls%ow&CBu6$HvmD7+4?Kf6d+kK<3Yu`?Y`m(x+z#$g)EO~6&aVx|H}84<n=
za9qK`N<rop(pF`)K05te0RyN^sDRu-pOng74!LCGL0x?S<OA6GzDt=Dwz`ZlcG%~k
zw1+fZcl!;O0sJ%H@yB7*4&d`@hV8!L`!2`%4G(!&CdPDP$8q%7`s3g6!oogVyq|b%
zrv2ZKMSQU}=G7{~S*#Un6f&69P!s_H=s}ivHVr!`9AeaXc81^FHolDBv0%UuV-6~A
zbHmd?`H!(blK&#OQAKN|E(}|<C^}QmRdHBuJ7S)hNzAdWJ3O>}J$vcd)bwD6nSgiF
zWhI!^oRN&OfqB<f2kiCiL5JVfeY|9GdBtsZgVXck4SWJBDo?}jecV#Jh=g)^g?MwQ
z;yz-~uT?R){1G8zNZ?F|`N`-$_uVgUpo^u6x8Rc|ECTJ1^GgXB7&CaFKAzq_EN+k}
zv}z=ci0rfGDi1&ZQ=wMvL;O%_nvm$*(OazvTtGYAsw26k#=CcEmi*toiqF0*=U3k7
ze2a1M>N!hXm|w_QBELM!R34+L&{oK>r%Q&UA(uyQh%$B^o#S<E3?k?74<j?Y(jYAA
zq7X<?T7ze)1}YL|;q|<=4k<X8;W@Buqn&xcoL}K1)^%k1+BI-0I#27;$=B<ApB6;#
z?)+;mva;{qA;>!Of692pIjmNBdmaBfCHa$$RP1$@YC(k*_n+%{5q<4Ai)D1fUOR0-
z+T!xXP>rc=Dxwh~7n0Gzk4l!>eF5~iMwBMdkUs4*z=Z2Zz{^nrx@=9T09(>`ZW=%V
z8dq*Ov~AO*3SpPI$3k6ra`2FPrnZ(mGd=U=fZc!pC8)`rcTRK0J>mb1;%l~EJTn0f
zdpcaZ0f?Q3h^^}h_*~3Vhk-;L?d@MYgGelC#vWvrmkJWfVc;=qEl8dGq~}>D0M~Z#
zfJ*=sCh8(NhmIh3Diby!5ED}ey$~)Fyjg%aaIvI|lW7f+jHDZ!6pmVyr!`_gz=iEK
zPt)K$#0Gr{B}8}3u;X8E^gJ#CDUP1CpVyK<RRA%y!vDi*A&LLt^adHq`Sd5YUfQfO
zhGxqu->pGk6>VL8&(H2%_$B+#uG6U!3A`}L1V6|naPHc!4HMmEyB@ZW^!jeFn&G>=
zVKhe&wdXb<=rq~;e=Mg$Jt-dgm70NkoS_J~6!5BnROD3WY!F%I$Y|Ug+j^nS)`NmX
zv70`BkMpZej@Wvm_ek;9o#az2^nMbHNwsMM09`=Y{5{=vi@e!H{q8q2@bG>b@b3<}
z5NWjPM9-r!$dAo+mymthLb#-N^a(?nfu^@UMF>MT0EdX$W0_KdlwlMe4`3NY%syYL
zyKhLuG*fCwoYb2b5<ufn1#FrMjJSrCd}F_VR+H_nRUM-3z8ml$;hk24MptMw`Gygh
z?R)TjL;G#m@E=AFl^uTBxVU;S1+Bg$h4k%_6F5IH%`L4C((zGJLYjF_IGyWEH4-9&
zwux(XZk0W-1U6GUUUE>^sCP~gNv$7AzRwUMlzaqSl6WRhkXLngwUbDyUr#nje~^)f
zu%Yg@^Uenq*2{1`t~56*z3mieD8K!s7klh%**JnPe~(zyb4c$I%hy&4aItTAzwz(>
z@+J{4hV;3*Z?B$wC@~FMo3>`1FJdbAJCyfNt>$CJp2+W^W0BK#lruKE9xM4DNYmP}
zz@A$GklN}tP8p(hrw@I_sd@9v5YrZeb)gI@KQYe7vQ`w$MfzZ5f`CP<jW~PA1Kqla
zGIrei>(i8SvhIB*GJvtM^rXyg_U_%w|L5Jh1qW>>q|p;EFS6{~0&e%kEwF9Dba!^P
zV`qU18UWgO^H(}-6(>^@Otlafbs8kVIEqS%(W&X3rY_2%-{iRcde@-l<|`F40p`;|
z1oLKL)V=2x=kDl-GxvjhaDNR<5sy8U^>|4eLj$_^C;Sx8&UVkIp+**V;i}gxgOPL_
zFCH~kz&r3Yf@7Pno3lbp5p#U5FS;AiM*3%nYv~(n=W(ssqH~1NMl|u__(xUY$4IN)
zM8}`ai#ilaatdt705NH87wfXu;=7DrIZ;avQ3i$N7HJtcJXZoaOyh7qrb=tV#H-7t
zC+cx2MLn*$M7E_aRv&XVw!evVHa>QU`JcOcY1_W1JL2`AcN4t`9X*d^i+VmEUjDoZ
zd%O|+K0Zv>SY$mPy6?;~(?Negj_6^b{a}+h*#B(1LKcGNPd3vyI%jpE^Xpaon<b9m
zCh+lBw%`HGN+$YwV@@3O2uc@%u76WjEYBdi`NSkbqPR&Fcel`dLU!6PbEVQ~zjV3b
z(EK3j9;W&CKd|w~{a<qPa?G&pd7yuJQksk-YuGYR+EFUUpOs#B5Kj~Cp6znx_)7PL
z*lZ^>u6oYlelAR|Z*+RFJg|#X>;4E^>;6{**~Ns2K0|5}_vTxu@0gKR_kE>=zoyB9
zn6;IX5o;DqFnOSLVh|kIM22E3U{jSN^s5u5-=ZKH(>S6&leerF>*v>@B35Xp&%lDH
zpCc>WyNUc+{y)hEp;sehZ#Cf|J$G%c#>NlDP`i<i{aH7LZ^=8J5x^by4-ft8O^DH6
z?%|#Uc8+v8OA}Vp!*n-Ow5myf1C$8l@VSQid7}y#`#R4;TqKlqdw02|33OeyIt1+K
za%ok@ay^q^G*%5*E>jlSD&i;{n>NLs3(qiLDF9`aoBgtEpbrnkKy1?1;#sy93O#ST
zJN9?k6ly<wPsZembO7(knLn(^skeX2_q&D8>o!waj1FJ0izT1sErk+plowjO>BhsA
zuI0yg6L++K?&Kbo?HAS7vsPm$b|+Vg3^FJ|e<UPrM-@5JS);?lu`P3SHZwI`P8N|B
z6=CHigVdv?IFsgH>*=hratD#~MXMSHn{Hy@_<gDS!uR0vYr^Y!CEN?9QYQz~iI&5t
znbh2kR(<0|YC*fd32Fve2%d>X+pIBpun&##_a5`=mAU;V_TM$_cKqe__0ZjG?0qxF
zEBp`B-xR#YCSHsmRmdMBk3pnu=lI@xyL-_~iJub~7>e_}J&5VdKy)T-;O$@rXigPK
zE|22tAv!QOX)eJfq^&Y;H`rH5!EQygcgQ=m>Ge0zGIPvI1%q>qk%KpH(gr&r7`%H5
zBXjCr6xJ(8m5%)Iqq+furIPtN3^|5;?BZyG_I`MQi$rv~_Z5~=2F=WVOiqa+D0GC4
zCV}Y3uC%caRk&(W(PZpwG54etg@V92D-MFJ@~BFqpY79l`}yND{YK|?mci4zm(!^K
z=j9rTA5_;pRyet{zOUnqi+p=NWWOG{ovB^Y;7;a4%9NCjvA@+icp+<E*PS2l#y)F5
zT$|CGA~(;v;1LG_$QVaeto1zAawY^_<YL=@$8t|FO*tf66-FsysS@deOF!hoo+z)c
zj_;BnOHPpkCB?DCY0=E0)Uh7nja6xy-2FpUd>g_mS7*D${Hyy=kKyJ_6m&icAb2?&
z!`21J!&0?zj3N@sB3MwF!y{R!6Wrj{{UdL7gr1B}7&uSy`d{Mv-+szJzwZC91|j;N
zGr$u;P2GWA@|Jqd?%&N{4iL?u(o3WAV?6d)8iHj06D&2`aw@*Pzd|5Sq_Yz`L22;}
zf$CjV8M(-t1*Fu%r}ET#Zqgw9?3sa-C2VA#63DkR=BNafKOC`gc(|M<hT@a%e=#P!
zIIOU^N&pJz>Z%r9mwR*__j`Dv5ANtb&$ad>+6vvs`AhQ*^-6jLinpB%EnTRT^WNR_
zXg}z)L;}0!V<FvMRnDoUjTcKtr9(NZ4dw&*jxCp!JpUD@j>L1G@6`k2Bm(eqVyC6J
z&E)pJy2nwEe6lQ|H1VT$nbPL8P}7i^AQvG<fjkA(?E@s5Tf{q$f-=OU0MhYS&|B8y
zCQ|D%lw7BKCZ{dJ<?e=48h#cjH!}dpX9T|RWysN!>p#IEMp~x_)+{}bBA&T4q#>|s
zun{s448?J#r3gT;DcM?U!bU0yD5y8@yKy5U2{jQ^O*~zAtK(Jdz}+wsaN-DQawx25
zfmF##zfE`+hol{Ub1%LAZSH&>v3(+Migqe-Lw&c2BjW#T5}jzNyK%GK_<N=EwUC~@
z(skp<e9Y<CkTxVzL0x!x(;@zXy%#C?oK*l!1p~4TsrhMgpcwF_&FF*U<J4#2n{bhn
zWgaQM*-b2ow$6)&;%eCz#6c-B%$({=nxya_f~hosujB{^1K|DvPD@wy{*E>HKW#R_
zF5@J>I+X>U!8q;Wfpy)gOi8c_OQ=DNQb>xwk|tB*q|i#>lK2v*jO>LXUN4t=MhsgG
zH@<GZezbLZ&kThA7mpc>Hq!?bJ1-2^J#V+eLvn`ZP6{iQ^b6z$mM%_MYi1pI5ka5E
zG8PT(GoMF!`xpX<n1mnFzdtX=vTXLTADY~yU|Z(}#FrsjX&`Da%)?S?crA#MGr+KQ
z3B$Q=yitn)8TdC^pK|#KBuP3|Xv`41?(uMgwNONFb_4%3+5FJgMLp@H@4MU~WPnLR
z@x;g!=u*D8P)TG&9T)?WrKzGP5#j6^c@jrVE%@D<pSQl5lKbDed&Ry-2kOB8CCMgN
z<%i^=-cP$z)UpO^q?>)wX})7L_FZsuiRdGdZ2psI?YmSkaKg$!40bP+jAf#YyLRUL
zOaAih1eY+YWV}GcFcRRp^<@3_Ul1b10Nxd}2?r+5Wdx7G3|WBf5fZc^x&UklDkgi7
zr%{H|sMvxjB9RjWU+&fNiYShWfIBe?IzI7jeu<ieOhe!T93)#vmHaIgpc$9Iz+Np4
z+g3%XiuALD!JdlzmhVW--}SuP(dTk7K=<FjfcNlWpSz4)RrJQ<HJQW@;-mt2+<@K?
ze9vay&XL1Fq|a|h{V6WQGeSK-NnFiSw9k!F+Z%jz|6cv+$f>>ytLpR->0a{w<nvaR
za+zsaZY;_ikcYtd(=M!=RvN<x4&i#x>H!UG4^xxawNwgrBZ@l%&~gKKu?Xyu*}^Eu
zIIfW;UcVc;(sQ&SP7VMH0QKVX+b^)xD}hm)&{ZApm39ZLGtsy$|4w&2|L30?UlH@B
znEC?C1VDi10VxB3U(sT(<X8SkxIQEJHn)oaeIdT~y_Vz3htBf{@;BNyWyhp<C~net
zhvMr~n&uoT8UH2opVMb+t%p10Zv=N<J=N!(p1SMNuVQ*00^c`8y>?>TFwb8mr^XO(
zH!eqx+owi|T#C&KxE2XoB239cdOh~pt>{n}GRk~&g_f?{mJ4o4zkm26><uA*n&Q>-
z{!DJKPjDcLLXw&}2>_@Xi2$yNa&^H_G^ZybidI0<S)lwzv9Xb#CB~%0^)yF`ID#sQ
zDohjxFsKsHlL46`1<VuJ1R`ngj*$!9A{zp~ddk79Y6^7BcX@B{2e`j%vCQ*QT3ZoQ
z8o7YH$r0jN7o|~x)#0|(Eljs5{#xy+3Z|ipHrOxBlRy3W+4lIy@ILS08Sw-$=Za%^
zSFia{{O+L>48o^uDw0Jm+&IFRz5YSpvK<jwUBlDm+vj$6<A>J8{>BXI;)967HsW0H
zHpK})%aRtXG)!KeW_){k!8bbUB{$eOb#nyUddtY;Oq#3ug@nDytf?9~#eH7fkdUd|
z!ya4+IA+u7S@Cm5#y3=@BDKz)+-Zgmp}=LrnuBuXouHTC17z?H3q=~7M;90br?iP3
zh0Ss6Yhl@E37GeXAy`C{X8hKGYL$(0XbF5F4yf;>!EJ;v!Wsiln1G(99jFJO>S#E~
zCxjcG24##(-%19~f7WfszEFaFa6-5zwsNTR56&6<pI&bWfi{i`T3>Drv&cklPbU0M
zs5_A<-asp;AO*#)JwOM87!R=t2q|L%(BT|bxp$%TczgbV>b=NZ`Hu{o@rRS1I(U1Y
z$SH{RcZTu5%08|093ap2-Y%`Haw5?wOij(~t~#XJqjauNO%ZfE7s5~E7Mh%x=wW}G
z8gaVB1-oilL3am$t~gE;jm<tj*~T}>2Rol~o(|`e`%G2Fo2y%A(kv~MC{B4b3H$M`
z;Nfw>A7Pgxx{SD58iB@(Do!_o#~x1^DNaN1@CjI5=EC0H7JmrMe|8}^dD3z`psDU~
z0=NJo5d0;p2Zi8iTBk!#T9mH2(|Qn-cpJtAl4{~+_%Wpa2z*D~^|%o@1)ql#8jQH3
z*-aTA7W~lA|H*K<4>pYGzN|9`vsm#W)9C6d_*>L2CSe!WzpY%HXdZj#Y~}Gk71<tF
z;XR0Az|DEbbA-hoDS*-N&JZ(8Cf2FrjjNG&ID5l=88v)CKl^z9`SB{+u|EixYddmW
zEbUClDH9LBbIiN3DE*aGGXr4r*f3K(pXzt?+0ka*cYwbJXCQ`drNJ&MH7#oerGNeA
zW^Qfm?4N7rf+GhmZ#w$C`JcM^U9O=<`l7HI7u|(vnTGNov1qL?h+3_mK84H&jp^P-
zH{^UXxSZPXhc=3FlbjYTv>#a>nUX)&7H5C``b=8acy6m`4}UDIxr6iVq?^IP5nl=Z
z7BA``0%H7SYxaTC@3I25Y3rMBfgtR%6aq)Be@rww;P|slOBlz4aIT9;ZaScnu!xns
zh|Elpav<iU*hpE1$G8BHPLa+#q5o=X^ui94Oo(I<RwhoeY>E<%Wfx%#Y*hEzo5ywZ
zJLc)|kwvT^Otc(K;z(Gd)(saJ-Sqfn<o-R7i`==|`C$3P>~?0s{|>qVrSH5<ndZMC
zm)d}~xSQYko#xc^+-)RBT~pZe=xDc2Iq+m;h1X4;(3IL(7oq6{eNTh+`kHbGdTdXw
zPu}w@R`T*2(Gn5q%wKKw{_-l@*_!tzVNX_aB$oAGtnz2J_fUPAdg@4RJ7_;o6LY<I
z^`tt{Le_6-XmLBc8h*sJJ}c1XN-T(0QnbOrsaH^9<O#x_p8PYJrB%S2BoSZm8?>Lz
z22G|SXN7pQPuWx|DXFY&$Px43d9AH{)X<1*y*<-y+47t)cwPD;TL0`GWgbQLwEJc3
zyz@B5@atE?j-vLXq$tg8(u+Z&Kk@~&HyEcRu98{^RF;(l+({<8uoA^aZ4Y7im;b)p
za;oiv)t23)`@sx7n>R#F-}pG7I=SEIAfiaVshS;>5nc4;u7Bk>@9lQZeGcFv%_(3s
zaB}GaxN}Egd~pXmf#v>a1f&4Xfmq$9Ygw@+b3RQt1(qQCkY8Dw)a1$+4ek#8dE&6z
zx{^O}Q9<Jp-5+zwNM10Z<zS}0?rGna3N6v5^Vyk=>q7tMNN=^|-VW)<G{YCw$0ZdX
ztJiGr4$chFlS@{3=?pY*!qD*ej1(gb$6UJrfURzws5z|}!HtQ%v(iob!)1O@TZ3Ib
zL9HwcFA)bPsC=%&(B+}fz<uwJg{{T+<69BiVnf&N=_kLJ=z2+0r46kAsM!v}zEt<U
zINz<i7svXliwFC=)$a>Ow#*~+ycswP=#M>-Px(F=QrrbK$TVX~33v?FRf1hO0F(mU
zpuElDZu$JGd84FJ9h~C?S8Z&U?oB<7rE?eUa+t5@uFH{QEX~yn5&p|<<})JnS#8IE
zjv|$XE?*m8n_ltzdx@hjL2nLOewXMI9h<$EIQ}IWy6kq!j<7$QKaVhuf0HG#?%ZKd
zsBP2@5Qkm;?6C)3xY+0aWAw=u4s9e?sg=<P!pW8ATX76Y`x!99N?}m1{DbN#wyf$P
z^AK*Ee6hV;U5;;+ofivO4lzknBcsH<dk=uXhf@IiSDf2AZD#(0f92ZB<H{atX0KQ<
zIzj3o^?{ceoxC9%UT=K48iAy%DpcnXjhm3T?&PRIyAYyeKF?X*ZReY8$&CFXzs<r8
z=ydE`H+hFXxoC~*=~ic5Wxj3BLm+>Hx9z8=+YN7{jmO7-XBM@Wi#HB$zg~02N)zfN
zt-V7_*Gv>XltwYi^OPo~VRM<M@J6ATj<K}RuzfPgvYn@9$l^ZsQBCPF51G<wozu4G
z$!JXKJA`Iw9lzQOxvkgQAD=ym-s8X7-?QJ;zq8u<|MdVqGgigvp998Q;qMm>fsQSB
z_ctm~Zo_MhrQvu<mwacZp}Zi(@$)-GOMJOML{Y<}Os91T<%w#`66xkTw2Tb$U5Z8)
zk=I^I?mH~ad_&P!@U9gV$$EOJ7FI>S2IUWY58HIB*d9+2)^gNeA4-*vk24w^UL}4d
z=(2S@Pv5w|H0Ch*jx30hrKSNypSLcaErnqZ-2znn64<>@nA5{R>o@tR%xgIg<2ig8
zX6SKjL0(D{y!E|W-tLC*=qsOxDH(uQydeYn(>;~X(_G4H^N3!Bu`ce=u_S<((bbcC
zHbS}=S)3cd0EF7(ob5B234Z8#&ztM{7F2O^V~#XD;e?w$@U)Q<tYKVm5)5>afPs^6
zx#@fa;$P-2s;H>)bKVr14eN{#S^Mpuc-NnAv+hS1il$OoSiWx7`8W0(+f|o^Z24!S
zssrbB?(okD$5nXz92d?K*Ew}wp7t_2+*HS7aubp6aR9}@tQpAqN5I8h`w=LC-S-SO
zS}Wn?u;T8Ipx5=JHq#Ir;qH)UyEte5bX{ppIFGe5g>^$J1AOYDG)>pO09PTp-E0_^
zUGU`wn3|}!fH&DZ;1>b*2YshB?&BIMK_WhNgNf-~nL-_Yhn1Go<E*s#gY-m=0mGMo
z4YH0vK3A`bkihf~*8j{7vy<NO;0uk#ocALp2+Vm-$VqKFPpLd(k$G&nsXt4EwzY9A
z)K#jUve+sn4C|;`%Sb7k&Ta)Kd~;TF&549_x8rtF+c_tHS`m^lo!(4maT_Hv=adlr
z=OU=LKnQ9<>C2i)tf(9tRras@GAWkh_WD^??6spY7V;+9w50-3@!=pTQ1Qa9YC`gP
z81b35UKnT16u5knHl1-1%DCnHCV$CX6W_s(v;Nhak6=@EvG|aFadrH1q|*sF(Ucck
zmyr?WMKy#0He!kfOnTvQKt=c_R5lhjv-G<KKRhO1iHBZ1T#wcpX#se}XMxAxjqbna
z-g)NwGpmv{OgI96!!Ya!9J&xi=pl;hRx0+$v@%@rQh+&!?LPQF<Po-={=75EQ;g@U
zb5C#=K;Fhe%KM9gqcv$lr<!2W<V-STbu^;eXz#le`+CN{cH86VL3z=q%YV4E1m}a<
zb%X}kc*^fwY=WX1uGchl_!&2Dc>nu1J^XIsan`2#aH6c>>4skg;!N^+39}Bmq@yG?
z1~7t@pXgM6E5^Ha{0NrfE^cATjihv4Hx)TaCXArAmf@dpOmF3sCnC?zTydU|#y4!a
z&NlSdufFUrdnee$=F$MRK&Al8*T!}Hi`jF(9@qKQ_RUEVcM*SU&r|x8FHh_QdA^=Y
zsVkYvcJf3x&?G(`Re6*1z1(rZSm-}WB-Bft=qbiTO5)7siA(-4J|URy)Pj1I!TbbV
z>-^{fL1blmVnKd)^w0;-vNGERG=%(5co^$hry_fSTQ@2;EdD#N=WG*Vj`T{3qm$ED
zOgq`$NMWEI|JOOgX{DT}VZl!$#~T@nr_0IaN_S3FjBQTRbWS;xWOP65Dac?X|CSlH
zh5l@-igeQkcoMi6A;BYw<i2<qJ@!FN03uQNQ<pP4^cwrCcbwj{2v$H%HrVzFz=%Iu
zxqq+KGXum7MUIXIN<Wq26UE{ZY~-7JPo2gw7{MizR7D5#?|ZfR0Vd+DyVD5ijGRt-
zg-f7y^qSO<Llj22ruOaIa9(rVAoFD&F_)FCCwzzIR(}c8H(z4AQyhRFai!;uWAW+!
zuC@Ex^ImZUOT|m?Wk~&(J6R85OK7o%<&zm-vvgsFb#ei^y1Yq<Vl=1d@iXr)wuqrB
z<pfjjjb?pK6Gk~k8f_f;T1k0R^$))Vlkp#;ZszJgwb&lVj)b+loUQoFHrz#xM2=MY
z?+=sm`xns&N0PZ8k(`RT=4x%)Jf@VagLz>-{D@CGO0dmY84r8h4#APl<|EiuIgg!X
z{4FRHUuXF_y`JR@&uDfK8UBxGXok>!;q8uTds)0X&EGCKF3e@K4TvPtsBeGBq?Ks|
zAxiltrYo4_o_g$uVH;-F&eg#hki&W#)RC@XZ0+gc?GBL|An>r8c=WrBZGhC!@E0uV
zfMMsn%IhZ=XsL_*uf>l=OFDuy+Z)oUI=z{!yCB$SCXUc!Mz)Wp!Edi+15Vx6uuhEt
zg*@10?51Ak&3#iy8aaFdBj)_+SFlVz2uif1oasUitBNLry2+=S33$wbdCURIJdK(C
zMh-&yVdQ=L;-(zK;p?pU=SuI5Fzlcf7bjSx3mNcuft56dCF;L|_dGZu5(;t?m#=lb
zkL659>_CZkHp-74Mxz=Fo|+CYaY$GfX|#rBbh_PL0U~n<TK9(7?=S5h?za+u#*#MW
zwKlx!+rC^ys4I>A?$1=vB`u+;6(rKmB~xB&)Qw_HM|_yBx}QXjFi@?BNSiTL*HcI!
z$RAU0Z&T(05PtUki0EcY&c6{BZ(emMHvFf^BPPr*26aERU%4wAa9|XDD()P(-_9dK
zE;-sz;svVWP}~oFR`L3F{KfA^|A17)=MBWd`ll@~hkm0kT1kjlLr7QKJ9Ju88$EWY
zHx&M<aaWPDj@hcD<|=F9kV*;XLy?NOOzs65{yAIyU#H|#;(&zmK5g%a1iN2ZwxXT_
z1O{umhQ5mH`YPiB2Un(*4;N1hVi$&Q%!a;wv~^tR_8abR`WqFs&Bw%9f<SBR-~NYb
zvW!v;xtah*Bt#upB_)rs5v_|l;ucldGBq3bi=KP&6j*>u*9iz1-A+;daUYE7cGbnP
zdq2jX8wKVDYXgq`Vas0~bKgJ^1H=URz<&gYU~4<Xzy=l5?G*iid-r?*;%@iNfMHRv
zi(vvpoB_lRT*IQf1Kg3@O)Z?KZWmZ{(Git^S#mEd;<{6|VQbOkBYb!?JsppFW3pCW
zFE{PU^-^A5qc`44K6*G=L;p@uvkSZJ9>!LdqZ_X8ltO1`|G0f@4w;sTOqNze!ch8E
zm5Jv@kuk>^NV{6oS{SY<h((1HAn`}UpLK-RO+68->vOvLbUJuCQ$fK-5e=cQw8!8s
z{p{bc>99d%)<(6@?vl#G>sfTpqtk!9%=v%)3uJ&3J-6?^ql56n1?*j?k+t<!@ssDR
zorC?#Oy+W$S%o!&x|AMQEke{Qd0XROZM<5S%00MZha7|XoW>JSkCRSl&@A%<E<xuM
zF(cp5Qv({~f*?XEPkw=*^lYllp0ww1ZmaWyQ<dLi1^In%b=e>Pv%fhnL#?v4LdrtE
z?XA}+4x?G=d~_8W_&<D+MT12j$PmU>@$aff4GX)RM7n7$Z!h!3+M<-QfJw)bLN#Au
z@WE5?bUCQmO&Gz+5H10Wb8SN-RV)ondlMVjAYJj1PSCX|aGRGR4MCHc0{3qqX4&;r
z?4az-2zVV1cH%}@#cZn7sFD*19@>N*$jh6`gtJoLITx)bgjLQ}_qeCv;$5`7Ke|>F
zyoZltZ2_CJXISxfdYxRHHa6>4`u($|f4y{k+yC8%L%-hCw)_-8sbUZuetK$Wf||g>
z9g{WLy==C8E0R|twA-g3cI~nJ+!2@4&!A+-7hY+3bl$b=mZi;2NA-@G)-DkWbJo$$
zzB=yqr&q>}jpvImpz`c*ue`Dtt1cR(GGAvpBW++drzACB+~*1prUN7gE`#YiOwQIi
zZ&y@={d_LR%GS0&w{ZIFxL7z++m3N!VSOcL9jY?j>l$|wMG2(^N!)r~!IH;+xCA1G
zr=k4CLF;TxyAhsorvq-l1kZf-R6gp1uRu1Uk&mbo3Bg`+_2&?#C*S+Y!jf$@?jQs;
za`!!b?k@33wi#8XwGJwG$M-1~;CQ3B?D`}+yzCpUB)H0jm=1sO_=Rn!rOZn%OvlRa
z&jCuo0(gnA>tw{P<C#RX3>4xO)C+?_8TQi!SYn;~6~5vbzUs<AwVGTm`i1;tIUY(a
zFQ=be*<+(RI>gj=DZXNgP=mWVk_RG#B|=jt8e770Xtu^V6XlVXuSJ4JB5sxEnN!-O
z#Ui2fm23>l+Va01d9PnS3^m)9aM$j=6aVc8=8=(QVpHUWDylfT7DO7l4D!SjR&jhc
zSc7SCz?gGA^ubfpw_l6ank*Jz#ZNT2&P`nvH$h9<@~fznl!+glKS&Z9O43Q^^4Pw6
z6hhg4uM>xW<)m)A&%=FnzkIP_hikXFib305%mg<FjZrdWVqt$R{Z;zCev}3EA^x3#
z(2L%k@_dYYZ!s@clk4gk_?sHK|4}G%Q|6)L>!#~cGlC6C+$sKW%I=Kg5|*VxLcKNC
zbx-qan8cN>!Cq5y$_PCsH5r%B=Vx2_R=n3n8xB!w)XZGwu;9u%IT}0b)iz1dZiIUM
zgw~SOZx+pQGf#)zGH`OvwhHk~C9Y{5LS}VY*g~fRsgMPV5gcHcFnR2J(g?TfdL&?8
z5HJs)B;kya`8dQj4oC$|!g%q+e0q1A*C`~-A-H~SpMfUndyi2E>Pd)^i}6G*{6DIU
zIK3&}9sm)et0UxUkgB8`j4?VId%qcu{JMM4NMVgHr2u?UMz7>hDizU%wt4C)c#5j(
z-8$&$S+8F|us`o4%f^yDq|F&z*3?w*74*;E^4K;+sZsqdI#lF!#{BW>)>`;`53!mH
z3A4X}U5$N;<dYr~g8Z%?D(B)3yk;6IRVWr5Q4$}0g8EF#R<3_vRj2Fizv0UemvQgq
zZrD2!end9<&Hq|6{^9?*j0C=coB&jDv*U>XK;}OVYUsSY%V{~ezch6;ATIrhKUT4l
zp`pt-Lc~GjZ*+sONBa#RVFmthx{+K(n|S>_>QXM05~Og6s#Xs@Glq$#|9jv4qEshW
zTw5!!n^+D@lf}oKQz0lAQsb6RM<{<yS@WiFsvH$$*7+fbH}4Qw>9s|a?IuaSq`Lf5
zaMZLJXp;%6*xuD3gq_ILPTxnu0b`T?6~Alw4N>R87fcRUqn&!yIj1U3pQ|P;^5I#?
z`6S3Jj?;}a^&p4>#*AdG3os2w5R)6r3PT7JA~8K*r^<JcHsMg*LB(Jxjdj}GyjPXQ
z^zwbe1d=u_b%TeGaW3%9WJ?xdwOKT6b;jD&LSN1Tjz>I#;8pwwCLJ_0PB%^SdmQmt
zF&Ld{GWZuEZY|zAhw<{azd-NH@2kBkMht~<JoG=(aVn;A-TzfJx^){>CFQtu*N0)O
z-#yv>r)Ky$U{`*KvQRX~9ObGfe~$anOi>KE@I@fbz)wGmTp|8~8SmxjaTZ)_s`;&x
zpNK`9!}A>mA#CW#Te-u}+CF65<hJx2Z0D43pZ0oxZUR21j?3&Oxnmn&{o+TPRxJ%2
zI!qTY?LB@j^8J8HgapFx2b|ZQ-TxwkX)Q+mukZ2gaedY5ZOZr$co0S(Qfz=!H_j>T
zSxy+B|NBL*mJSe+yC2{TQ+L%WWlPQ%89&-({lM9Zd>5ng6GtH_XMzDO5qOUojK^sb
z<^jh$?{juvgb+u&sfH}thNLhG<$=-2Kwb5i!CU>_CaFF1S-V`oXIM>ug9gFmN2(kx
zIuV-e%7Ru(rQAnd6$iz0P5F7aZ}NEUzb|yR(&(S%Or$=!g8$07MF(jDdv$$an+)Z6
zrU&|-xF4nDI59Ry*tG6iYeN>@H44$+XWN)~8!)`ee(t}V#bmXPulSE?tov=>W{9Z@
zA<bVay-!_|vAVv!cpQwpA|b|-EY^5zFWyyLBZzS->`yq1pD4|g!%N7&LLyfyPpd1@
zY;O^b_Kc#ZCqF7R{;eSIT_x#A-1w9%5BP=k&9y4VcvbmZ;t6w|N(W5wY%95+0NHZ1
z5Pq7-FF}qSvOi41r!AreukFWHDJ&6JHA>To5LbM;JD3@E^yN-$((wH*o1ZphgCMLF
zzr@Km5{5Lm(iro}@$VDq`2FT7|Ds}tkjE`pS6QCh6)&HMY6b&7CE)J@2;eB#^FZtn
zoW*ajS@wdyuk)TQNAsRMLY})0lnZSU=2FwhQIlN-swu0AHQ`#eUbSl&g&!Ke2JiQE
zB}ygyIH}RZRtuR!nt<AeQ_5yk2G$H7@9j#L()t`oyrRu$U6dj{F{fj;N`9E0=c%?)
zx@|2xz<4a9&k}fyZq0dmJ{P*0V}Fx;A1=AhE$FzRv+)v`%y~U)zkUTh|C5g#8SuCB
z{lV|zvM^L}lvRLj;v{a+er1y)1Xhz~Q5yCd0VJW?2X20;*2bUuskZAm>Ad(N4YdCe
z!`8jwdzk*5$e=)th<rQ!mE6Y&NW3pE(QX#U-mt^#dr)R1OJRE_R|kj26YkV6C`hLZ
zi0~kd^3@CY4&#swDwqL){+dP0;-}O9CcHQlHM(4Yyncb0jniCK=cSG!2|n116;Q8)
zk_@lX6wz?x0zxD?4i%8{$W`k_wz@%F+5w-Q4m0ym`lT%^j5NyNzCOIli}&B~r052s
z7L97B^6FZ-7M(&RugI<@Rc>-oRkkLJ);^dZ_nUVrbpA3@ZN3RkAe&^{Aauv-7NCjv
z=1s4?b#wU3%p)^d_fkAa^_L)L{!E(47))b!O-;?c%iH~siXL?J;LQW}y@g5f&bGwL
zwM0V5uMehU+iuo|{C)3;$3;9gJNWOecE2BuW>-Xy)6u}02TluiUEPB3;tG-w;RqBI
zcVcNnjpdfD+U;iAs`&bhzXsJIScgud^?`vhz-TzMzI0rk!F9)MTa}I<;=%sov@u^f
zK>n%`wzM`|9|VsrPSXmXln6Z~qLz?Ewp`u$HYkudx`ItoHw&`h|Fk<JF~LfrNkjsz
zkV-I`d_%G-xtxw7#ui3z(FDXW4DOYTJWv_35Y++^N&i^dN>G4R8QO0n<%F+*IQ{b}
z?O@Cy)hSwHCk2jNT!LY`In!L4649+;sEX0bJ{x|>xAdqd03`%TlWOzEAW5w^iDsCF
zJ2=LUo-aLSkASLL;dLy|7@);a_Y_gT*5jsP%eNG6oFFoEyvnP9lziq#Z-q^OvVZY?
z0wquaZ1j9jJG*JXEyOx%=1gFX;96Q!9<+aQR<1~w-PF|d4CP<Dx;f6ina*+iA^ko`
zuTl@V_>tcO=L76&2Xt*fuX0pGZ^C19+z%(abI$OWMrMvgYUN#s=)Q<~Ytc<Wn-E%A
zolWMb8y@_B4;L&D^#u&22dGO{zl32ETJw}hp+pBqQ-EoM-q!#$utF5i)L_znFadHe
zB^rVnvIH{r-%w<FOk?MwW6IV{Oq$UTEZ35iv^r)&Na)0j`kdHCAiohkS^dAa_VCJr
zg%G9@&Wd>?fPQZEhuOuETrwPM0*oW?ZC<^7WG7BQ$~r2VBW!|_5zRW~-$q4Trpq*#
zr&}~3l;fk%`eNHCnmb#**ruVK^RWyvj@!*tk#Y<`b$IwdCKwYF9azWoBNH!^tgCDw
zV@CWWtM2Ej%V`*7!Y=J^c4xBFQllN%u^T8cAlbn33@)r3n{&>m#=589bx(hIa*luz
zyy~B+loSfg;J=Ki5~(gPYHDz(bJX<el_ep>BZ<3q@b=RA%$^%_uBhc?K{ofZw{e4%
zeasM=3TTEjT`W|zXfzhG1>Cmn4d13MD?QimUM=|O^yjZjikA^Lv1B(WHb(%jWb8gS
z6ZDO~FHn3kfvPvw_B<~)m$QQKx+UZJLSx8y1an(lKrV8(A3gV(`~km9#S=V6G+g}U
znO3-vCbD$4(WDZ`3F9P(I4nv9TB;mjg;ahik`e<=p@bmC^%tD$)(9S)gy85D0z%~>
zI5{C@29c)1EI;Zj`e8O4z0sY+RvR09iiDq%bTr&DeX1yf!?+W^Huwwr&7u7zfOu>+
zq?7<>kd*;~gT7?%@$S>+4`eu{Tm*u|&3aH^3psotH)J^QXYQoi0Dccb>1Vq;)6m_)
zlQVVLFm|eQ<i>tKh7Z(@Ibu(qzW@lsl94iU3grjc7Sl6b{0?b-{AU?K=?uB`Q(@-Y
zltLdc%Lti!KC>=86GiYx_zm28$ISB?SXxF=kx!T62GjvlRrgVPvi~}Xz@y`sjamgx
zse@sMPqwH6$bdcHLtfMWT3KPz>LL**b;;r(WsW69yOwmgBSi5zw8eCH&tXi*MDofN
zszxJ!j(YSCUF&OSj(j?AJ4?4DX?uxbpO*kDWluY{ho_V2T)#n-R0eReFWDZ4@x@&G
zFY^)C1sI4YY{qhym22_3;G1Vn$4g^-s~zQ%3`3rze=7rT@d{XqhG<psP|W|t-F>iF
zp;cbeHnC{v-Q7iMZM4m7tL*)=25(UeBTdu-7lBn(lfD^1jeNG8vvm=V)@~3Of`fb}
zl$l$JJf@61$6%kLP1T^2p<yGxST^)#7*%eg3zGaD#n44TM-CaxU}u>ODCHW?<XB_-
zHujmiPCa8or22W7K8sOlCc2g-$}wtZcX$UtVU<Ddk8tRZZ1ch%P+&Zbs&JqX<|S~y
z_FY>G@wSMRQ=l<hIV2|c8>iu%{3Y2T@jXh@NAxp^;%+9cqtkkfL3w0X&2VP+uRVtT
zWCS%4J(z3fzkEwuYmzorJ(g6emvE%k&2W%`HIbsc-&3jY!jDzbiWy{(BiKy+e)q2H
zN0kyrE7K2TXTdA4^Y<1tlVn*S1LN?KTYN)sm>J0gCcE-_kXu9~I&(HJ@^Hgc7@UIQ
z>v=Vc;tSABYDAkph~Xm1YT>me(;$4H3!wn}vBl9LTe+!l>2#bwChvvhblk*LzKmx0
z-OxL}-sC*b=^&LLgINK>R7c<6UY;&54Sny{cfxMpR0GCcbfCozi883=sJ)9OBqjX&
zlfnPkUsVvQdB558+$YDgMi`)w!DJNk{5LA)OCRer-66`>&M`2qAH~8OXZ0JxV;rR8
zy|2K)n>Py{0*B+ae-H6KQ@9ApAZogMMR0gl2o<_59@L<kdmpO=FuVAwzR@5%Y!Nof
zT}x~c1qf?oW~T<B?bfb#P2l0=;u`Y+i4q0*94GSH3V#NB1{#^Xe26;%a{Ol48Se>z
zNe>*44ba*^+$Ix9<Hv9aocJ`h7^~$m+v?$Sa3bLLZv-TKhncyU+*x?PTp|^?D&pW*
z&H)}ZDuhS{xYT$i6BdNms?YpMY@z65aDh)=Eboe!qU+yVj&`$~eW<zynH<GbVX}Yr
zm_V$OuM4VC9rT9#jOjN1vuXP`jN2LEcAbW^p0jbd{R)JJG43}|8--zhK5gO$cE2<@
zZ<bL30FR@Ug0p&6k89Y<+uhxR?(<NDdq*-DR|c19WyXqLGZ(~EOXT;_bS)@Xhos-4
zhQGRqMrkT_Ed%Z6o!GaE1;dA4!}W(4QRtfe?=cwO_o9G0{@(QbnOrwEOW+!oR)^hs
zB8Mx@%znPbERY*Pm#+VF3P>)Dvocuip7`Rhgwrxe6^}@ozt2o#i?cZT;-vV_X<r*w
z&uJVpgFm^5Nm;(1@y~27Hn<d$iLQZzp&Fq$PM{7~f~}#^)euSeMPK|7A7!J7x^JOV
zG`#ca3GelR`Tfo$Ce=@p=2gOSPR!OTe|`~ss2=c8S4(b%`2jM&J#{vcBg%zS)!8aI
zl~i=&S=4fj1=#^T;7SN7(%?DJJie!TLbxEyUCU4652WCa<ToN+>kjb+Q>(|(@zJ7u
zaGGe_>PN*CCvi!9y#$$6eEVAl4=g4BaP5USun@p5Ho;Lm!|@W+Y{3YM@g$r6#owgp
zDX?hr@3(o~{>BdKcDYgaTq#f?;CGeem~g?43s*!Ii<$pGWjovnbdgPc7r{i;cv(Yd
z<)u8TGBU?IEXE4+gG{0dQZ2M=ou0<yQG@W<cXM6{XZ4#UYR-e*`%#QRZm3p}5mi2v
z{5llhJC5bdW6Es2M_c%brv?E!8`J;q-^;`(Ud*}wGPnQ50u0NqB3Y3+Q2@x0D$2z%
z(|J9aJCZ)dFvI0a^7J8*ztj$Ul5Ui}=2|GD(cYw-Gv2e8aj3y7-92R+o1lU|6=r96
z1mQk!fo%)X&=;uE=0|FIMr_Q*3Z_Qb+s~O^=Ef`5{<OhMRU;v7RL(%C3H%MmHNV(g
zxQjYYKJ|Iw+G(l}ei&wJ@`cg;DI#HX(GF%1)5dXtPHv=woGi0cZy$rN!6N1?b`sv&
zt)bxy8J)*^;=;F{9fbF;$NX8ln=pXrz28U-_-e_G-)+U~q*dFsNvz6z4xa#5phNW&
z+;o<4j&Uh6QlFAB&?mA;_VFnk$77rBZ?vDGW*!Vb`)(yT0ZgtB0}9QZ{RKc%{rlCv
z_<msG<ZpF7-n7it_xp&S@)t$Li#BZE%{$fOIjH?X1_3oA3Tf@adbB(;Q6m#0my(qR
zy9@2N0wR~+L^7-SWr+dk1UxKx!`KX;j>pcI8|o>Nd}Rlvi@$<;r_bKhCHF?r#}-@b
zbD`s;TM^9OO=s1T3gOkRn#R_Q)vw$iqduSTcU~EsmD<5y^|+P|q9`)iJC~MD>FO>w
zcQjme9a-wT4aCDXrgVLVBe}=td%yQZ^PO!9W7KyU<K+<(Q+elCZgNC!87uACNez9}
z9KXJreQfsjUe4rP+J`Vib_&T!mbWr5<Kzc+DE<yps5o%8R$rUW?fs6A_D<hbZio3f
zk$%xz?3)j#oXv$p*xw9lz+`^EQ{WXaGvAtK?Bo-7cTJ~7W<vp(gkwV1<d`byRn*;?
z^%eZnVgV6pb^gbSg+V5lmlj7$rKjo?@S|EY-i%*JeJvO!WdMiZv)xE}cX{qp)cH#`
z8Jnm-6524jGlKxkrb(^~EfQ>Z91;YmVc}=^K&|RW&yZH{2i)2^nci<!m74JEQOQZe
zoSs=T(~ly#kw|IjG9kf<Y{KxapVo!{y<{z?-1x$#lowkW*y^il5<@(_f9#X(1pUIl
z^+$3>t|q}Z!hca!krD2`zxj#<rJ6-NT|Ai7V{7~rc_$|?H7^XVU8c!s1GCa^iD~^h
zlvmG1JEuVzPcC%%%=9aa;!`y<P!X3^YB4bS_uSRgxcux1@qBuc#or$RqNZHT)t24?
zWq-)Fw^3yo!n*RFKFn(c@XX0!AE8+dNYxB#n1gCJV0UM<m(hRKU?_~a>{-3+Y8Ez%
zoTcZqz0I#Uz&Ty$3P#v?5xkE|3M(Gf%_!%mr4g?B-mL*3jh&YZN8E;wqqLEq${gpS
zl`MJb_;9NE^2Bj@kR{6PL%9u{o6$3i(fkA1G@|Aq8V%7GEk7$aW&J$h7Yx@16!XE;
z?24RR43MPBHtBG(f!tptM}e0fmRwkw47GX9Zq5MeeyRLk({Zw`X=Z0LMyEFsR+dVd
zK^=q^_ogs>wt`0*LXyAvzpSi({~Noo3V@QRMs(9s&IF%7oUx66WJQ!Aia9_WBr_6$
z)A<53<|2Oh5x)^aUqWc)gfp|8gOh;qLlbfz-kr=MU)N1wvP$xbMYGSvQtpIs{jYHZ
zNs#VAlZEDr3@IS2ogz#IMYI~F+)Z4Y3Qm+_O=tUd<>2CB<-mvuHX%+@qCae~aN|>L
z%;lF*8q9#<(f+5ffVQ8xO0?NGNo;=mW6U1?Gf#`N!+DQ|H`-3-86l@xxKWnHIGL*k
zDNFcST_mg@p40@b^}6rF(E{+SPu517uKrQJ=Q4j`?|APIw-A!0R2d&miCNv@6Kd9O
zc5cO1xtOGxGIFP?TI)$FOnV19olYh<DquDwyZBXS@?+mgMq`DiyYstIasWm}GCeDa
z*lh}y4nI$^d$B^Aq<-i%Ok9&kFKkH7-kYk{jys|gr$T&`y54s+kmFmaw9lP8dX;Zc
zFp*AbqN$9^Zk<;=MfN8MDil=sa`18cH=01GrrOMs^|!o@eqrz;4@l2v3W@%l(do%v
zi9|4+(moC%7c?&?LE(I=HE<^CglLb3*3>YVA=4yRWvRU5xzQfFrmK)!f~4i3=!H~Q
z37<|M&~#2o01YlO<|{j=#RUO|a0e$qu{WPWKPJRko4|mZ&}3GP>}+7K$?fA1FF%x_
z#8e?A91Pxeu!I=sAhK5mr87B;S=q6DdwSLO*^bnWtNWCo0ul?1i)eD68%LxZ7z?2~
zmY%@+C5{%Q^+9<}eKV}Xk+9Nx?c=y`DfpuqbyGDCuAb!wiRv6+L734QYzv|jd2l?|
zi2#2|+Ie%F4%HCjeH&)?eJcm#mlXY!!0`$8L5`vN(&wh9Glb9(iDe{PT&YZoO#<AB
zxl_z-L_vHl;?M7y0j<rV{<0cgP(HrFOO)<e=dnHf1>5ZPVg54m#g-Brq|*1QtmwRB
z=eUxg<g$GKI$I{4uS@S9wP0yRa-8cnXH#UfeZF`z*V+OibIfR=(YNum_UXFj%b(4t
zc6d$Dq+p1m0~=lr5(EK?)HPVApDq(l1TY7v_p~>IF4E^L)DzcJmN|xYPK}8Q=^GRS
zf|iHSa&=AUW<2&27dRU0yCynaFbv!4L-t8B^upGwMHFzPFz{lh*SuouIX>@Te4o0+
zm`8b!peA<>B$*j#K{XTG3RU$-PwH^vmoan!Q~Z!_R>;3p!C;(S%tzXkoYQA1UuTAh
z4B`!IiO)q5pKXT>Om&-wq8LOkaHvIQ<X25^0a&_Y8!W}BOTh@!fm7Mz#>cm*R@g@>
z^p7;ct39dDlWncP`4NMq-SCOtusJxssyA)UQm$Y1o9lV6AtlNqU)!lO(&ija1_H~y
zDcHJ_fOYVyx&U6|oOoDaxND}b?0`0t?=O6iP;k870BJBgiBJ}}h)~{eXS?=s@n$|#
z<^KV_KtjJhWkB!xgL$m1CumF-2t|$kn-RbX{|ZvH%HCI$7(j`%ISJjG-!>Soyz0pP
z_kRBO|NMckeBTRD)1#1T0pMXyXI}n<<j&h~zH)ti_<S|7V=`^D!CZ*2Y!9N^gV(A+
zUN4ALe|vy%V2=zMt|!<!S>i{({{+3@x$D?GtARe7Bs?NFjxQL)ee+MHK(Yr&&jQlj
zfSLo;G@x1r`s4!8U65V`iX-6SPGEE=P%c}TwBr-sgbq2?Fk%Z}#XzBvmKxVx(#3yy
zM}ePx$5#I8T`e?c3Y%w7YIQ-cv}OYKD!qWhL-^S^vEW4c2-vZs#O7HrmF$ZN1>o1U
zqwM&#KcbEAT?32+wEihTuL0R+cpnBYEXXyL%SKTMIeE_SH0T(rXZsm>CM&$ji8g57
z?G3WaAUxGYltU0E-QPyzrz8ofrEPbZ8Jsg369qEBqD0#BeRdE(I4+jsP$qU-y&pEB
zjz|{B?C%*YC%E+7K7Q_}mT|>JIg(t13mqIey^uu!=VmRKfNUSQbuqYcIw(5{NH!Tk
z)|pJ~UPgHgDE5O#Hv|2f0KE#RCO}SwcLGWr%kP9D*qjs8E3u=)^qN=n(40u{8}FLK
z%6f{%L;)?ggGk%CK^ZBxA-wFtFo;7ov6+TTYiF;muRiZx|NY%}0a*PP51X1Eaa5ZC
z9;S4~Wf#yt+<pY_d-wbHtt>75OqtAH)tug;1YR8_cy(3n91I*C6@sU_fFfg}WQ^7l
zY@KBM%$pbRk{7IDrd@&zOezi;r@HllvJYSiXkHIYz7*VfHmH3y&^!m!*bAha0X1vF
z;M6RTZUY);0?mto*5yF+a&WpE!~>vM0JsaH6l}`Li8Ef{_Rdag9j&M!?AfDn%IO7e
z{YH}x9&8|O>Yxhw+nm56UFBj3TKS8`q(;P0q|jd>Joc(SZg~8FXyg;N#*@s2X<*`s
zKr#oy2&Nbg8;!p>3R?X$5DI`=(K7<HAGG~opN{$yjUz;d$MYqdj{E~Ep`k$lh!KGp
zIN)eLgY|)dG=c8r&_|a+nQ*9NfF^)L-AR1%(>pLA1yZF8#e_!|5KJ~Qk|FG4F@7JP
z>iQRQ?-Llql@ynqGr%wY+$yfPXav<SK}8uNQvBEofO|lhgVVD>Q!fNhzW``o1EhOE
zssX|XgrWIK+H^=Y&Hiql1vD-KXJ?rVh{au2_({DPDj+6N_CsOEAV34nhUT-*W15~S
zaO0OcSRW{)4J{)k$9905Grzp<Z!e%Tlu8+z8%2L@F45(eFFgI359~kq1=RHDq8b5s
zn9@o6X7TFpdU3P6(tT#Gvum@dEg48LbP2CtP*4@zVJUO22X#z)1<PqE2?708g>4fB
ze)^3o{DNn#qg`lIY1OGpQnS^o08OxNKaptiDWGhx@df0OIZUAivoQVwOpYll011;y
zz^%PRt&@R?#{<K!0V^K>7k2|m3UCT<TzAZd$$O^zF={|{OFZ_XKK<-ZEaGQ=ZXUNC
z&d{99p|zcbB-zNC{7nFHVQ3F-2qwj=(jX0Ft<v;G#~OEJT44oK@c>4Z_LT=(;Qq~^
z;vhJkGiH;qUWI0>ns00)ANQZ|`H0<;dn0}@c}SRDOaeUf=eRp@iJmGG68ZfzW#DI@
z?U22KJv%YP{Nw;jy$(2Gi>i=dZ0uX}8Ju0nis?7SzKU+#I#{+?W3Z-h+1Wk({M#0B
z>3Jhi&&KhC0L^x7Q<HQ_F9X?L@YK_R&f|b&62!TI_D$%fOS|Wc_g;Et_x7l!5g3vQ
zVDVN!ufik)4kn36p0d^`hInU*fg#gWvyYd(aENlm__g1j#afTiY%@wLriUF$!7_vJ
zx_Qr5v9yGe(#|Y~!|qw@Yuy*?UF%;5u!Nc(Ra6%PdYIBnU;qE%*wJHG^m^S_s`l1R
zX>*dn+Q|6~A3Gh~m~>=wG~Wpb-JCoOVvy1pb`>^v7;pKp1-#&SD`<~2Fcb}f4DPNA
zpjZNueZb6*lA8SiQ{)D#AiV_Q9>^Y5aNM62oF{kiVk*HH5qK4(7fqVn)^)(9p9I<$
z0J;xQ3DHo*ejH=;rVmX>`X#QpyoVot^>J)zmnaKmJoW_~YVGUn>m7+UVrzRP{@k9a
zZ1WCGwt+440BIf1k#}YfjFu!bHfl1U3((+eFj7-y?{+Y^)K0@M4kq^oonUi_dM?p`
zaNP!%1PRdFldI-%ufa;_y1FJZ9FH}iyfY@d`<VbP33JmqHcb^^RyLj<wjhsdZw%h{
zIe*-$`yxI*A(H!+LCPfeIcM((Z+r71uDoyv)nl_xZaabjB!C`*^%}T!9eDPwpvh-3
zB`Ltm0M-G@0n#>Mp*0$iiFjcmhrN&yV%mT{0`xuz=oPSP*=-<@6b>(HsB`4FGzX@g
zm*{Ybm%MNpuX^D!H*^B6VG9Yl^$g5EGU_=Cl6$uMh#8cmoOEWhVWA&)<k+Fh{;g+F
zO%H#n1%QVs{lZ&cKex2B@VtUr=cS!Z1lHsotmGjd!Hpu1ygO1Ivs3Jm!Xi&F*Czb<
z4=&?{-`z#KEQt$ENF?V}fbJ2MeW3k##@x>U?JGgF2GYyqV&h{5<d556JrCU^*Dg~V
zOcUlyy#VNC$pQuBD?V_XTjr_PgiI?u`Ketz`TAw(o-N0s94~T7j?D4vc+`WKQa!OS
zt`GydB+O4Uc5gRG0Li(x?9NJMj_Jdl+J+&wf&3t7cr!?~LqC8}+kjkY<?8rjEFk`S
zBi{uFue&*LdUh~zxXOusN;h~`gm5qkgoEK^O|mey7xqkCW)M+I!d$1s+*E1wbzzDM
z<@}<F7ycmftBOy8LkmF2hlKeS@B^=0#g&&0L4DZL#9|F80eAq`LvZJL!0eBL8oK~q
zCg_2kaTO*wz+V1&cJC25185G&4>2wN51{)gfQ0$VtLGkdBN7fAZs_sOQ=oz|)7E&&
zOS*K;C4G!monM6z???&~Zb^b!MC3v+w`iuMIf<OoQx{iGT=)2=zjg{WJ*ub{03L>P
zV1?=EvHh2iN`8jwY|d0-J?6cAk)WMM;F7z!Bj26su?{7WQ-x-c;QL;*f)~GN6&+~s
zkVEw{0ssY+U6bN>^7+8b4+7a10E=Mc?3~--nVu|KB9&{a3p2o+0+<G9vuU^gWnkrZ
zfW=<|M)!hL2OjQ>;AnwYNBoWfWo*Ekrb@i_<p*)m8C{I}iC1l<Mr?IAd%OqOnPq#B
z%rL;>S`+4GfZf{)f3>UeF4bqU42->Jpo3<cOru)?y$q-pq|=|9JGpF8VHhvLRSo+w
z1)(9N#odq`qmQIR@g)i9x*`wAOGC+E1}Q6SR$bUjpxr7lF<C%sRGt<46NJ4g*B%Ia
zjeOr-=qs0i8UfFG`Wl}8%pn>j1BDO}$!hQz0LX#K=KxbLhtc|%{CJ~YglUg>wAngS
z#&Na(1z_RV2>s6iGzq{)eMo_Ugh1ftS^!1<J@rv51nL8)>?!fu?_cASw&utOWJ)R9
zJ}HQ?iR~;WFcuFrRFWcT&16MUKJEUyZ$ASyJ*ub{03L?)-OqW!reQI9W|2(p%G$H+
zH3%#5vvBxfdC*HGM8Lbu+QQz1Vx4f^r9FPZ3)V2*ESU$c46n$v#(m?(J@sN>`gz6)
zN-x6LMg!a&Q5BW;EFuNdEI>2h@&tJGgTUgi088%#bw6U90o6?CEX)9c9t-=tFs_(s
zB%rktr_U_mh0i{Y4iUIC=~g#N3+&EJcKxfiC-H9kXOT0erWjkcX^a0#2%KUQx)%VP
zh?Ww{5xD;)+qNxgK!S<-=Sq`F^l3bZ$YmgI#o2q}L32<YU0Pz%dK6S9K_CuJcoLKk
z>+6~!V+Ig1i|a?$W;7-=bZNM`jV%d#bpzh($Hk&U(TGgezM@aK^1K0l;8p9`G*JSh
zAds5Y6M#nm`atJdz~r+*st53z`OX(E7@t@FEY@I7z%&Oghv1bz1r~k-DDE`&e{$ih
zY}`7=<SsEO5^Zry&E7I+WZHg#>n<PCi=Nv<LyPy)?Y3w-XzW?i#n+CDv-XT0mg=Oz
zXn5^)Pkn9sL2j<;5lFQF@UWm20&XAxc>1$nuMQtLaDH#3pOSVqHOXWV5%@9?*>PPH
zRAI>ygJ&=)VAxG?`pyEc|G{NCc~=hZR{>@=2WHs=CY}OJJ_Fz(z+I8%<iVg@*@lME
zS0=%_4UF~!%fAac{&S#}-vNd<1JnSkc`&u@A*f@<6?r;EEU4nAK;T}1<Y*sHy7UmP
zyYM(LP`-a8IK1s*q(+fMON7YaD=QEq9}===iOv)oej!rtdX&Ly?aCkK=I<s@t`J6d
z1Bqq+!KQ(b4mnu+Nlt-fq#~z(v~%L#NBlYZGNgxwmkFFI%Jy@1(?fzW^9IjxeQ^$v
zN(D_?c25&j!bqAW%2M>s73pz}Mf;hcqWBiq57%iE(pL@@=36CR@}eG2-8}+zbr`3&
zv5$aq4QSo~Og<aH2*%c5k#?#=l>bfx)B<=K7~BOu@hjlf_XCsz$qe9~{#@UL5H$XX
zXls)|>isJN269GA6?pb@y13}f9D`L~Z#tCwsF0W2{TzvXpfyq205vA2`u*WkAJ~8A
zCUe&g)bz-wS^#*+)Bhvjlm4%J4m~j4@8>Vfi*&C_+aPZ}<&ZnIs-?nwCT*)guvKd&
z$_IqDF7SOXSj6QQ_CUiD<hhRmK+H_wd>!049X$0cn-G2A4*0+mWt!hH4415pe;ODa
z1eX6d`1mgZYk$qq$AEMil*|BVz#X!YLK7XBu})~1YpmB3nW9C!mSb1z1fKKc{g|Nw
zWuEwgEq<<?(X^8NKhEf8eseF5B1T!VDG!^L)}y>KX5Wg_2DP74P!q`S1L;*jwP8vn
z#u~c!R&X|6kKDvw^MFwS!+Z(EpxPxl)bU~m@ifRUX`^;zZzU7A8hw&LyKHx^T_!dr
zffAf*=t7Q%!~WcW*#|QgOuAkG%q5^pkY*^&$k%}<T-n17*Y%JUrqZC_kD81vfS17S
zOM&T^GE~M;1x&oY-M_}m6U++i0z##^h1vjG;Pp=cCw>hy{1Pac2G9}cNWe(k*xAlY
zJpXEZG9$^<?oR?REOF}25kK#ltC-1*b1NyCg;TyPCiMsV&Q~N3`vo;-(qW#T)^26z
zeg7N(w*uaYnjZO73jhy!x)wkiK#mu_;Ps>jy^H&U(PODG-B5{*;v{EH4_LF;2Ic!6
zN&kV#XjUk?2_AoC7f*R+mz&I>f}``Fpn!4+rcL1KmjUS}fLGajqH{oHt&Q6u-hntZ
zaDLebt^Osj^h-eRLm>2kbgTJ}8>aA&xdAbr%|80ejU<f4KG~hEjwvPt3`!=gLF>Tv
z=Ply$^Oi9hB%!8?KZ_lRB8mz5-`s)e)khE*%7!$i8AB=U9n`scmctg&p#nf|7eNt_
z0E1gV=$X{XkvZo<D3XXs9_PM~e)22VMmCLzABYHns(L?06j@{{-&Fo!vj$4V-;;F+
zEEy^Vpc8mUdXGSmU!SlFKKd{05z%ELARiHSZ7%WL=d5D$)X<>(Vr~E?lxu`!7cliw
zAejQt1CYX}t!5ae?<*e(ScKSSYHR_ke+63pU1I`Ewg71OH4M=T4!aN&U!6NAoNqL*
z;ze}rrAy27<g4z()fcRx?792`Ve%sX73rkufq(ICYE5Zl0xD_j%m>5k@A}H$X27c-
zZ1HP)1W_#jJmhH-z>@)d3J)AVF|oRG{OL^DX^n|_53>S@;avAW=^%x09{V3w!RMT?
zcT<6veeW7}Z_|XKg*~-Y@^S(XfXVLyHO>d|DgvkR<he5&NRmzEH4UH*&;&62I%wfH
zfR*<G<sy*G8O@iO9LyhBFU7uUUTX?kwtbE~G=mYFtmk%rKp=+h5@uT?Jof5im?Gh^
zA7SG$;Oug(l4X*%46IkSRAQ28blL=BD}D$&d&tpm$3+@GJu*`BwESM_z0G4xT0qdz
zlE!uxM8@-Qv!A*U>PV3mEw)Ac3j<XIAxu>e(U^j(iTRs@F`A8>Ly1iXOzcoAv;Rs$
zmX==sHKprhavz7DOUH-6;7IIqQZ^aXFu~)l>Er4v3sCMiQ<xt;Fs7ZU=K_sW0IWuG
z5{2w~{*8)7(g_eJnpWP+wECx3(6kQpv8QG<sUf7%uBW(0PBU+`wyt{&Q(}3&#P;L_
zKmQp=F_k3HdFpy+A`&Zm#{U$1BZ!Y0DoLnJI_;&UrPKPO{w!*GR8TDdJbZ|k7f+l&
z8kJ9=#%x1bd$B*qWxaEMY6=SHmvB3>YWtA!lpDIZ;))??U?FN|0Vfk!uLI5VnI@kE
z&=96XEd?c+g3}y)ty+7Ks#)V7xc&jq;;#Yu*8nvKqG@}y+GqM(*>_gDEzy{5+8xw_
zb8~103gEm1)_b0LCtcu%YffO#&H;wKB;=FvvmE~#hXp!_-J;hp5OJn}xhYd4J}wU{
zp;p&V4d{{my#*?cgZPMX81te<Y^U|1fL=<VFvc+b_A?ejQ((feEm|6!H$p2YXxMQa
zVBBt)da=90B|ch?2&@vYb{^~Yfd#-h&}tUQNIM`)a4hzFAZ+KVCM(8BKt4*aZLYxg
zJZ}w?Ep5F1<tfJuF8bic<v{CN5Y_=M$rnTx0-^jfph_Jht1iEfc=fNqs$m3JSp(Qj
zieu^(yMG)&zz{F7?51D2m>5t5jTAUI!sTZl#dVKaKsiXkfU9KWc0~|9#&SPMqz3>I
zt84-#<D9%GFF;L?3aSNwhdwa?yx^5@ZY?jJxO|YOXC$pz2wg5fi}sL`$zkH-(yG*6
zdu0?u;FO(1Joh=Pn05!I3|}J!=AO~sC!a@1S^)Qi9W*xb+t4F2cJ72gn}Gb73F%w;
zV}QG+#yuq-r1b2LB(tncLFC@Nf$>>#BJasg;E{$N<ZK{l0@fH?rn|V{tVO6ia|LJt
zf$}?UrW}*=at2BM%V0n=AxnYHvo7<TweE7IZ|+82n96YgKrL{7H=vK3@V_t_kX;J=
zpQAW$$6cap<Uq!RBMEf~zXtnV@b<3=34%HCM$d>im4sr*Yvxeoz2IG$X4U`~z*Mt9
zLm9Y9+uc)*fDpBxV#9~K%(|iIfx_di>fziobErWjwonnkLjY~)iKl{-4xk5Oj>5|!
z#~J)W8vrN3^83K6e@#%61nO+KFTHcA+{<Er`NTnXKt=}ODqp7X9=bNn+-X)AEos`;
zTE}(Q9YQuLZ5}WHq7re{IajQV2q!i2dy=(u$!hQ7;_)+o@HM|&-6%CZ0;v`N9`a<2
zmbc#YwOx6Rr*k^lPSd7+fu%Ly{_bB{>lF~4C@$`vy{4#!gln(r<NR}mpkXLw>a;*m
z36$&L#+5+x96+xNX6!Xxp)a|!Isq^P9^M8l{Tk5!q|tKKw6!&xXH~Ute+2vH$ur&n
zq{{KcEKMrAAO$WMIxh_q0)ca2QV;Nq#~s3C6DUWC)u5RW<c9dza|by~FxVW<3?NGh
z^RuRsoa3YZpEtiagoHpC!k0lF-UluRAS5FDoe+xbfMTVd17q<vY9Z=<vm;wfu1QM}
z?Ale}z~7+6N`--qqY3^2p&=tT5hzg}f(~nC5R~b5fo1}eI4U@CjLUs~X+k5;8lnK`
z5n-ZH;7L#FVbfFzTM!d2;Srd@dKGA%3u>PO@VcKjFV1@Tx1u4V0p=!n^@Ao<RZUu<
zO^d!!)Jt!6q1aL;L6B&z#Xk4TYTJqZaZC*^(hT$pTz%PboPSCe<shR(NNRqmy=)z?
zm3(Iy0HsYXxRLdG{ayQy9iDjY_dN@nH*ZEwk6fw+fQJG7=|^v;g_XtK>x1&_v^l4g
zGWI@yh<X(Qknpg3=Y7Udr_(Sqkw)1k%uf)W{j>s;DH{iLOP&#O4@jm#6HjI&3ckL8
zFu?k3axNN;5-{dXZu`Yw2Zncm)GUB35>`k)&7t2U9Iu3S1m}?D1(VQ8&yT8J&`JTM
zt!+M>=gAVVclSEBO!rX?QghhrkRH}C0WAd~PqAH97eJa6n3)|RA-J6G_6ilBxulE+
zSy=l&kAVCrOpSw$Da@3#zSG$EaS@!V5J1sqB)^w)IVMQh7<0zhbE8k(TKS&3w8?hy
zlme*)WYhgZ8SX?0Kq+IkU7(dJXie5kU`$Xhdt&6LA@`@~cnQX!N4V@UL!5u^2$Ty<
z!Y8B34TL}O6cE~`P6a6tl&EA0FNGS{R)ZpF%z%4e2Ub65iUB1ZJ1-*JrE>F07<baB
zDAXIFF%{6oCpoG%p^VuqX=w0LiBmQ&;*txFf_em$44H7ioBNzuz-#?tjbYnMQbmo)
z6e_)ZVd2oetFPP_mw>M65l6KE@Gzi1{=NU%X*F8cY074j#w2869dhAK{vhWH4{)$G
z!`b$o_qrY_Tye<|XPr5O8nIVjgBnx<x(BqcXS7ZQcnuX!gHT6R9&9t9!EK<$cLDi9
zAeo2N(cl3BiRmK1#W7=Y2b7?oAqtgL2tgGYfShfX$wU_rL3b5zpBv!n3zk7Tb>a&E
z?aCX){DvrY(u(@SNK?l2l(w1JDkPOcknx?+Jpe6Gxds&X0jl8}wL_K_T*LfCFua7R
zu~E;2_dGVZY9qmM1IERH@pE-z2tivHD1v{Ilz*fV+G*W3L*U#*fp()bNpT5bPe(!v
z#@rdA1X!$~3WX~#?_<xl5<CiFum1hu9*~^^v@V8;`S*R6a2BXKyEF|HCrqVAUNhRi
z)BJr3j@a-LezSs*6wYJ_;P|qMNe&|Z*nZ*?Pz)XdYQ4nu7aYUZ$sDC79<%q0n~CDK
zeFvC9AWE|~6$Q>*I<c_*m9P12URYQ_O^;lv1%QV<5#Mv~ZPV-Pz3Y;6axzI%Ftqow
zX89hYf?5jyC<h}F7^IlWJVBy?r#xu|+cx)&=HQ!Ra|H7MP!mAsY8NiRV8J7T^AdZO
zq$YsTA!GB`2Ta-D=zJwOpK-&lIm%Dq6V3=@0#kgX+F!_xpJc(DhyyVonS>jiCYo!M
zIOm*IlsTdF$#yJ9_$Cl~1oK*PAyI^h7Q<N?!c`UF%=;898uhn01}Yx_sT86}kDJiS
zGBV42PZh&^Y=!o&3oPc&>gHmSf~*x#i=cFxnEcoyU5F0yvki(4RILb<s9<og4Y=V<
zPUdJdK+Hrg3Lq9v++1$7G-lp)p>W#H5?5c=N5VzOjwvM;T>|aP0qR&^02c=unEhD$
z)G}|w${&OBTYz*14(<y3G1k&OKn6dp;Yu$HRFeylNZa6ET-hHHXA6K!4c68?&}W==
z>LTXn`p8EKDYc=fD!V8UHWu4c11iHH=k|KHKlu}1y5*a^3IArQLL&dx?`!%GpjrTU
zh|}-<@!wIW(K&g&H{3zl6p<pwo&!mR7*eSVhZ<?}rg}v{kt>{kW*_ID*9VPCaVG%h
z!C$Te>3QJnEP%V-wqV#)V8xDkF<L;Wfz>|)Mt2zIPXfBPZF_br4#ukEUkH@~LWw_k
zZA+Rvgsc#lled+}hoG~2Q@_NP?aP>GjKC$C!_S?up0|c@EtdgLj-A-l0U!mmJM7@{
zPz%U8^s_X;W<YTO&^>T*9N+=iR{yJFH)3(kFQPzBB=Gp3f?bR&{%}m)4aEKKwRjh1
z;kEw2NF4JCwIwR1d28_YGK|;Ut;A^Z0EnFsstrxH3p7&AtZj^dP>wekf_KaF%C%yQ
z)`3$_8Q|=*OVEfYa7uzHTr~nP1vD-MAqS%rLTs?KL?{O*1fFGdKgTrqERfC_!3`X(
zk{34QMjTr{`Fhz)HAmM-fhqbdhJwtyR%+<d3eP>l#MA(LHm@>9=?1+B0!47!smv+c
z{-~5nrZh>@ZG#Vdv4L+NZR9Yr(KR*wCsO*YH&N4nB>jJX`Qc<R7(O;h8@rQM8{iTq
z!K^#8V#e>Bojfm5PS0lJm~UWKDh7nht{CC;(=_0CyHsR22RH?{uK}qH&?}I&$0dSD
z%wS5uGy&>;1n7Ut#6?qTdlXKyNHc~|9w{*ID1=%f{eaKo0&>rdFL7|b`#(Fy8R0M`
zDCjQZoZYLqXzx1y>F@+pk{gCdPQkN~fR8<t2ee^9<e=xIM0*lO*kNntAXm2DkJKy{
zC4}-IP#g!!<5ojYgWWbl3aZM!lnq2gf(x~a6iU~CGbW?LL@E%ldk#rxJqQTnd`t=r
z(d-EIS3KJaULwnbS9IGgMw)2iQh`!uNQnV;c7wE<GJ6f2!J07D04~3{hfb#i`s{A8
zU`7JgBOp5ioa_M5v%*?r%Lq)@_kSA54->8bC6g+_$V{e3cZ)|&Vn!bQ!EU8w+2*i^
zqe-&~72>I5|6+RS2ms|8um}K;!0klS<!3MBlV9IMMK$tZqcqH3_#wEURtBJwgjJGc
ztxo5x2M+A-z!U-hH`6@@(_7y78@TlgpP|JgN04QGnwvU<Hf@?ys>ulwMR`$ZPKeUs
zpj=qKv&?B5pMA<1{1@;4RnUXmF>3lYQY`>H#Odhaqs>Ey51dk<Gnu7L$MS;tko`Gr
ziQ}_9utK;uo{JP)CxMI3>7(Je3ke2E1e9HHvKeSyWZ_cZSZI@cj(B3828Q1N*8a?7
z$Dx*GYT~RDc>-f>Ic7le85{mi(QpxWj>Dm*8AR4CkK<-IC+ywY$0_^P@u~gONE-=)
z;2@MRmJC5W$9|^m&!lNe4O{R2IG0{{u0e3hWuQ0;l!r}1Jg$yWp3l}IAVRwwuL=e5
z<gy4!iQJTPWnKmGSQ$Rs@5;oAl*57L$^MG(ea0d36Ud3p1n9FAI>Ca_XaGr4f;sUs
zNRCPRo>6#?=ZOaX9}N_?O##<lJ>mvwD|k6s(Dh*iZk!HEC&7Age7@u&0btGy!(aa!
zQ2qdMW7g)>l>%uHXGtJqa(~DfjlLi!tlQZZh98OE5QVKP_b}%=Oh1EK%sBV_MQZ+a
zj@4WtP3`yMa0u^rb+rX#MoLrKOp8LFdF;Rg9RN#WL)j<ZNWjGrgZ|XLC)9s^(_5Q&
zeB+kp{HCp&U;3mMpS!ZUw)e#Gg~@Jj&=?N->4Ae^NEA2)Q9_D|h%}Onl}hqPvpH(F
zj}5=t?=N3;)w6Fq^ZX~>F&vE6cAb1$aq0Ef4uA8luPkMU8;vJoG<pSqmu+-N)by{U
zS^#*6Q)43AqcxwRno|j>1W^K>iss=?zE~S0%cuy%8j2YGb;1Q_3~}Y91JH;?{(5&T
zDDzqSOmH%59G?(Uq{>7+hE=qIG6$AF02FHmDm8Ee#7*KA71|L+1E?r|;(mYF8BQ40
zI`^I7_<78LQbfufpvEPT6o5h_O$M0S)`K1@lW<WQZ!7a>G8zVdN5_1Nf}y!YlCr~D
z1ZS2^)WPmX+vnnLP<}U<62@4d7{YvcPFiKq^2)f=-h8ovU=cUs=AFV;a*1TTq8_@#
zBK(lRQn?S$;n1U~Kcp&9xiDiiv^j}LgHf2h#tIv42A`VBMhPfIDEbOha|3MNUXUss
z<0C(9j1hnlDBBGvZP6_ykPtD=Q05tG3K-r6>V49L`{@+mJm$nz#ox<bVJ+g{!hL?P
zRKE9slNa^^dJr!iLn-V3K!6$mvzz;9sS(!l22`qDzD2P@Rt*q!5h9xlGn7&w)l$9n
z)tO@t+#~oyj;-6?OKY2c0sU_n=Kpi=`rGtF|M&MdKXA{T^RIpO^Y?+$tCv;==N>(F
z*L;>Wb_29|RC252EJZe}C}CnUHa6|1UM0)`4|CQ<S(LrrQkQjcs3?lVo%Y1~kp~{Q
z?<0Tur=LCftQ+pywr%^uNvEB@@c!R>N8ca>SJUpZ&!B~S_M<->p{9R3)dIjnoR&`<
zyf8_!3zFt!1bw<gPM+7E$$+d16qu6F7C-=UVCSwJbDOnSVLhDgpOFHsD{OxHoNeNK
zp^UjBNr5l{3_b#kz62!Gh!5_dy0SggX{-$h#zKfI7xEbY@)-ar<N_R%73_C9QRb{?
zF%JYlGq_+rW!Ea^n@mGiATGUeBEYXe41kmGfdcy~ZAoHLe=<J&?s<N#d>>O|mKl5r
zC=LVEBsi<KV8lT>a$2W^N7(ZpsU4%zhG&)$LLfUuqD}iLJ0ZYLf}6DpS_2Ll3gz5L
zv_O8YJRITI%b6RL(x#-e3%_H56#1<ZOd6JNGZ7Ifjb@^8<zsr7naIIITfW*`49GbD
zsVN}a&4k=4-Vt*Yn-pL)09K&&Pk{6>aJJP7-fn`#Pd6jdk3ueqGuLrkTO$?{DQauX
z|Doa%YRp>Nq}l+CygnpMc1rA+?c?}~<_2<~3(*Mn9K(#w?;6VGxF%AG8V(2Tet(d<
zD*@uS|M;KNpLc(lS~u^Xe&D`4&UyE*{q)(O?1t`odEUzE;!N6T&mozfQWGt3)`Utj
zv{YhL1|g97k_EvAL0~3^PPEod6y?0i2aoBOeGHDT4$2~bej~+NS&Z&Ic<`Q2?mPW&
zZ@%LC7vD8Kf8v40+$H&Kx8A{b*V_NTi)sPjAxuB@j`t+L`@eo;$1v~Aw$cV5WcpY$
zi~k<eI{f)>VAt6R;IWqv(Nv~Jx`e#}1?Ij<Z<?J7&|vHUitPmxKyj3@{vkrb2L9LD
zng;|@AXE-^x`^cjRVMDf-vFH*?}s-j1b%70wh50&G$7m23OoXxyLTPiXLH;;N})(5
zbqV)Lh&~8ZvCeIork{Q9t5AI|8B+lj2kl~|7#|!*KSEmG2&5jf%gYo+QT9Gz0||V}
z{^ET^+yf-@6yp<GXccjYCe3sASUe#W>N=9|pR$D!*<PR!BTZuIDBedzL`00T08*uK
z?X`W(O#!@0zQ|M1&^1_XV<g*%*&+;HNQfpH1PxFdJiHs|e+HaPSbqT)&yU+5hX4@2
zGvbx;TSPc)NHid<EC*>oW{9#AL4`IM6|I0;jtFy`hB$lAfWLMkB@^aYg=jc_BHN#?
z_OO#SREE6ZhAvgp?Uv`f?A^(q{lAaQudW`s;>3xC$Bhd0r2dFbq9kk4#C)TfwV=|B
z(=>|xv;v1TL83C32E|iQ#FTKt0A<9w(;?Ojt;?3mi(O^j#fkOq89L9eZ>GG|yYu!N
z(=7em<}F)3J$vQzzyAEw&RGA8_r0@>rm?1fk!k_pAxvMt`D=5EvQs%}Co0VVE`<0@
z(K#EROTiBy&Y`X`8Ys+9Xk2{B5Sg^e!xg?Ekj}yBZm^mI=^<j()IE?aOxpyye*@(E
zLD?KQ%88Cj=fZngMaaDt<<C9}2O|f55GkTn9^_$c`zN!FIUq1=qm@fjW)AG!(Zkft
zkVl6*XlB;L>=>q*vgkRoKTN?VjG+P6fjRmCh6M_vcU&#;?Rv*fFF1rJO2!_y5%YTU
zNN1)HjNHw+V@#2n8Efi+R|v*4b|r<ykXo!jYl6UFTXc^3Qd%PhG>rKq@s6z$nD)+?
zvUkRR(CqPIKu9!WW(Ol7Su?;*AAxxUq?-w92Ec#;VR3QNotO18gW&W&4)8LNYytw4
zjLa8a!14=G*(iRBrLY=IGcIDnZTHYxWzSS!CuSeE>rz>lnlaVZ*t2_`_{;Jwqo{!p
z1{!vk1C*FSnl&LwxG159g988K&u>?M_&e|1cI#I^aLvlniRTUmgUbt=+NaucX>)Rl
zRFc_bg_^*cSeIiH<EK`De<WT*wip<+z};+Cu|yG)Rs(3Y7(7p9S+=<xwEF$EXQ0=8
zLT~>AceI<0o0eCWKJ=K2p7NQ;J??uJ-u2&KqfyhpifRGiAx!)4y?Yx|dSTj}AR+~J
zPDoZWlDXL&!(z*{ylyO*VWJp12j=H<%+BYayuwVp6H*Ce`)tY6mCzyMqU`W|1FPnT
zfbKs6s>z^?Xxv<lz_tQBJ1(9-h+WmS5NWl3P~pzNf9#+3JC|9f6s_6=oQ4|hO+z$0
zJ<`KAt46?BVsy5m>QO*4qNE6}7*Hg6g)~E6tTC}`W5W-pqy2?lxu$WYeuF6rJE1CY
zN!VY43qqEY>4iDEHkP;;K`;nC6O%8Pb!_K$W(48S$N*^r8bK8RH=SZGQVhm=YnT_i
zzl(%-Z7XPYR)Yr-)DpU`N5-L*8X#U1)(vqzD^s}=Q^4q6Q2(D9s%^UI!#=f0d?du7
zXd2wU3-j+}vC2*#-{=u~VmG)5E0rQRmu1{o3AB<Dvs(u!3Ls(SIc&hm$ZP#kE)M|g
zBx5Uus<f%*w{6<`zkdDgyB8OZzI=6M^;%7>U1;x9X=|FZECE=9xgcnGbB?eo_})61
zX-p6BuvS%^67Lzn#(~NB6s1`LYD{yZJ*~<j?~MBE7p)Ce&g&gtc-&+s`Q%4G`X_&S
z`4e98#V`E*dsk4?zeu$J@DQfs$B)eShk8#s-BQF_z;!@;u*aw)0oDUPZjXr2N(fh9
zG{Edc0c}nDK}mE+b^%VegD5c#8FkVhsm@10bJN&Kiz7tYbPPvCr+^kIaw|vz#AhU#
zP*rQGq6U(+h|jF*84z~`<A6r-V;DdVD9SO@8G!P{t6XE+ooAGe@q5f9WL9GZW(9UR
z{{7G-I3FEs;R#+j5*hF+l29eCpX8D18BE1?|Ddt-60-JMIR%{GF?b(Z$ngf_@pgj(
z>^c)VY!X*h=G8ME0;K>^2`(K230VltV+9K%;cN*4Yeg5HGsN!gg$2kcY%MkthA{zb
zviq<Mo}*%Zh&3@%)AriO0KGycgQeI^g8BO*I&f$U#QIexn_XYVzw$FL9}(V1At{9^
zWeuD1SG2_hRWMo;BWA4$nv7`$AyigiZvh<gpcDDMt%%T>p54^T^$)KcI&x-zRGv<q
zoz1K@#flPUX6UjIg0Y<wSGIs-(N7@%6;qBC6rH0Z$qU7AR@pH}kp_r~h&V}8YER9x
zo|sj6e{t_>f8qJP!OA7Q{_P(;`~0W=-#xqc-ugEmeb2~uu<{zzR3`#@D3MTYfp@<9
zpAt%vZH4AZN*i#8ivdZEKrGE_00OgubN};q7+<KuyhInBH^B6ybNW;EUI(|A=4WCK
zOri3G^1!UXJOvEz1-gF^s3w@xv68Kl&q!_*=j<1Z+%qwu4!h*MQLX#&_c*Xm$B-?L
zOcGEd3)NaZ&tvdNAuSmvZ||a|97C5FKs>pjGA;?GU<D#+Gq?VdCP%*wm1N;aXOV8t
zLcA0v9_M1_WilgqyFh;;;lM-e;k%gm+q<Ko1$EnvkNh`MD4`963a^WAzy!slC8Dov
zo}md~Xdo%Uico4myHeCn<`9eKp69z>f{UE7@1z{_^BOKDmZAzm+B`g+hpC?9zH=q0
z9YfRrw}HXUpx$R;s{Fy)c-UyWe%lI6VuN?kXu}SvkPe=5W<o{;znz?*Alh_$#EajG
zOq^s{no<{bC{zMGV6>Y9YHO30T9J;<glK&tXHmZ}CM!jjg3`{WwE>=$tLbwaGrJqj
z&MXoz5tmAtm2+&_mcce>#e;EJ2m8mH-0fX~T6r1K++p^)3UHgvWX@U>>jJEEA~0p`
zIcm)8Yjb<Yx$6V<V}}nP{mt9&xb^jqx!`HLe)nUy)y)4vs1^VoqV(l|`nz_g(>_Nf
zNt2QkT1(ryz#JXFgZQe#Z~;>dw=4}-IJ>n#s+g4zUPfq-OAuv1G6zxVEO2FaVxa-m
z`wXZ&8fw`~2d;<$tQjh;LG)iTZri>?0^|WJ?bhNRpURfvp#T;E$Qr>|kHA<t2Qp1K
zb6*dgrc>{|t6GqK97AVUIEB3J)p@K-*+WhOBko%)%(!tVm*U0>3bGwBRu=siR)-i*
zCO@~56^s0feilOea+wheU>gW(<ARtFH>(JZ^ZfU4ynyd5BPKGwEk1ofBwB>|hyZ?O
zuqM(Y#?(}SMpBA>6$=eaO;9o)gbBpgfHi{@m=w7CS(Eh2RQhulc?nF+X#CTK<A`_8
z3!-k0#^HfzuX{~5T7S6=mIsz4SeHNom$s5g0~j%;TRCP`X|;NeLNA@*=wUL1DR8eL
zu{QloTdL8S%d++~B}x%=A^T!o37nut9;_gTkh$&cyKb+kys81xs=P<=mBqw0@OcqT
z;Rsi@L=(7FN+n67GpDkd-JK%ablu`g_iaax9)8EKyy=H7dd>^q(g1+XTes5n*I!TP
zo_p>_tMRC#S^#*6(tY=Qqf_L?1uAK_l}kVB4+jg0O0RXvO94pLovr3TT4Cp=5_59}
zkOz$^$O{%6r#47Ux@Y?L&4ZQH0u_gW{-@1BNw(@<wM=kTgA{U$`zU5fyurZ$&sC%o
zS@ib0Y($99N~0?fkS2luBOFK!LRvERZtbIy0$QtZ05bxU2SR8Z#6w6yDT0z%s<<Zx
z5jcLnB$shdGF29huv}Z(s0Bp!AE`;oFQsSbgTT@L*{%&~im2*$Lhz^-C-RvM*fJ>z
zw@aBqyU!F95fs7v6pv6qrAQ<L%9w^{CN#EgDS@Gmx)=5h8&ejw#@4}34HGd#wHf&V
zVDLq7(s7rPV?<+vCfPapwG~`9K&m`r^tT8hi7L;iF0-3Q3xz|Mu0;zkF>?XTO%|A&
zDEvFka&K0a*fZ(MYi^DUQ!tEOX3I*4BtkUSF2w$Kw+TgqeQ9lp@C5NBnuiL);^u)w
zFTBjk4Awc4Btdg}8)$O(e79)6<izo%U%T<fFFg13$2?`?#Ia*MH#bYIRtq)NJ^&9T
zir%C{hwpE%FR$+8WKOyGe@3i<R1a3CXgeP1Jbt|-&4kCCkz@DP96Yj?K^@&rMiXl>
zsBKOfl5m2v<hDVBPlL*XrZ@`9Z#tOq`~|N66bUi@K7!YZg0+<)53)E}ifcF0R!xpr
z#o$IFaB^|@kokIM(~wkBqAW}XHPZ)ky-!EuZOc*{u|0J84Fq%@9l9Ln&hz!>Tz3fZ
zqOs>aaNvtu{ZQusV+U*alDsVES)oK;NOXii5h7y+pDM2HOarmzFG<`JdBrI!iUyb}
z4Bb_>H<Exw*=-U)AqtA&kR6611~g;u_7bP<D}W)3?%KWM1Z7tbKrD)sN0=3uTEO5-
zAYKsYmtQjyzl#u8!kADrwlL#!#cmWVCZ)2J8|1jQJt3ehL0X3(5+V>WaRJP9a?DNT
zxM!F^LB2!Lh~YGN$#k6`sHyu9)sdvYq=Qx-&tyo^ByAo3N)p$IZ3+%|itZUw9LuU3
z+!L}XlIW=>Fe7VCbCR{&qxECgFD<X^X*GD$ITt+s{eS(}A6V`XVS0L+R##Ua)uw?O
z0eA=!GgAso4Ti%GB~77RRuOw4mHXJ*xQvTL*7F?Lv$w#ec^I#F$6%y7zyP>GObsjj
zBPj9=2AZavZTBC*P++7sF^L+N*2$C_^9<B88DWF=+4nYpn^_D%${^ts5Z9oh^#<jH
z(j=<K!z65~B_W+GfTTdFm4{&?FLnvNyQhm}HJ&xNiz`7$krQKp6vP)Cb$J6vb42*D
z=VxNNHsV9k^WaoMW6Ch$k=BP%%&FS~etIKZCG>T}jtYoZ2rq8V<4FnqG)RlKY49oT
zznj{Mc26L1!Pve%$KE}q?|bE9b|w~%_L0?JO&VqfwFt#JQSVb$1D1R_%Fg81C<3n_
zkRmChM-ZIjfPU{jC<N`^^(q?1M1Uewv_~`Ixgu~$m}r)m?C3FFI+~wYPY(jQyOJw=
zl|`Ri>0^pT017@jfnSpoqrx-&-k{J2XTpp6yb(~PXuR8Q&yo{fd@V~b7o^e@t=XM~
z&bCwgIlXmZVfBYDd+hVJ{rTU25UZ=Jc(hY306YZgH~#30G%-1~OC`yK%G!}KAvZk;
z>^##W#wyNie^4=_$brcz<}6c=0g}JS9}XIz28dFdOpqMD2J?zdfQtKo@@^n$Lk7x+
zLn9JXB8vDPar|t_q@>cg!I>2V3J*~Sdqd@{Bc()%ze)m~5=5CsnwG>mwoyihyglH2
zNSK*YliY?FU=<&TF(59O6N1n)?!6b2ADVR9<Iqktu>u+ueA!p=3;QOT0A}9cp^nLu
z7c8Udj8%M^gQy@EDfk@t3Kr&bHw142ATUbuF5iN&MZ#m)htL2<Lqcbwz~pqCz)6(U
z6%9qH<fWWQpcXK?4Hz8&Q%C5_Qs|U_b0`w!r^_H2K}@Wy0fZM@MW%|E-}$0QH$gEO
zM4*yw!GucE9ZhH?jArKQEa(mPVR$%KHn}`HjD3HD{Eq?|@IZxKoA50A4vP_0B|4U^
z`s$PHx2Qx`f?y(MH)^gTEh0FAvMvDD$U2*#CU)-Zj?@p|f8U|kz3uJq+xaEl;GKJv
zQ7r&Gw1@!E-+bT?63$2GWodgpX*Aiv|Ko>lMbUR=dZ{F{VGLXXNy+F;l$208c39hT
zxb^_cU}Ceh6YXIRc$>AZ|7no!189n~MOOyGUI8S>cLX;NHd5&vB@UbidpG4_;!iAZ
zyCfk4god)jdMd*+U)Bs_4fGj}B*$E*4`mN6W|wZ&OhM>dl?gh2#L*!xg9OG`SN?OH
zP)XEOEDQVg!f+@8KPZ|o4h%g~q+?`cqrOF58rxWYMI(f%s_900p1a4{c3FJq5f*co
z2@_;!m*Upu`6mHYhdewX6Jt378cmbm!sTD!czJA(3V=s~kBg8HQqTaS`#FGf026l3
zh5G3<WUkn}#U37G{Gtn9*4sdkr^@vvhE5<<e!kqj1eDr}H}RQ3093+INeO5vO34+I
z8$pOUywSC;k3j^CK?5mVgk`6&SjOoyc<b4E5*+4|bXX60jhh<*=tO#oe;33XZx`N;
z!|$+C6S$<bHH~Cq=eD)Je%<}|-uol3d)$lnJn)q-R}R)k7u5p5Ly(T_zccBrubm9a
zrjxWOj%-Fyb0J<9^PTg`-AJJ%4Q!b#v2$w)6jn2E>2f3Onr$_|s2Gbm!zcsv8qog+
z7)^lH7!wFwIUF~EM+!e||FTk0BcxUwqmx4W1ELhWVu+H_ImQ9aKqEEqp<|qEm_IRt
zhrnbb$0^&^p`=nL5s3I92yDQrux=gb!PtN}l4Q4Oqq9eV$N~oO^X5?z_6*TC>fx0j
zAUTjH4$umygxB_*zDZ$>QE%M;+%nm9_I?QwtitiuiBTK&@UgOtz{1%YWP||dF@)Sl
zKIqU?BPDFvQa~}AiZ~H_2ty?*0nQm5Tp@hMEM%bKI54`^B)+P8@(X_G1-mhrrTW52
z!Hp2XN|F3v0XU+_8WiikQnIvrtTZ(%#vOlc$%VwOCyRH@{|kH9`Jx1&vGPI*g`UR7
zSV5+uqDoHM*OAa{-Z_((0XB4y*o0#eYpaCVJt1o=h-s*XwaTL_tbQc=nCWFr#F~=U
zB(kX;TZSWk%>(=Ie$98i{+Bjm{55~nP%QvFw1@$4cd)K{gZ`wZBq5aqcnp=T?O;3r
z3?&XtacEnnpqa62+YqPi9hrz8-oRGrG;$;WWkxfVmr$Ga=q{i<45$V`5r7;OZ<X0r
zLw7fTo27(c`x_Tc8E>5;d_d~`;d+SxP(y(gLH5=)t4qQ}TH@sG1DI$FS47Fqo%Hhd
zhmX*8ZK`3g4$hXI4+{w*N<PB^5s4NRQSXIpxA76>a3Lp1Rh!sYvGLc60#KEW;7@;v
zhD7RE1TM!O12M-5a*1UGK0H9?M{xS8QWT08Mg5`ZaAzh=w+W~1W+;JfS4tSzdkYW-
z0i_m;%4h@quM+8lfNBCLtaeHQYuRv-gsfZXr~h7Ze3G*9#%)%Ys{+A$d9Wyhq~@oa
z<tsGSM{-Qu3w^M*_aM}HfztOShAo^B5WSv$TQd}lb0(4YnY0sSYBMB?ktiTZ7%DNv
zvrN>7jrcJAVe<;wcSzu#Rnwe98iKDx6%7gRSU{Q>;1XGD0@>uY`SpJO+QWzMf8`k$
zK4lt@QmO@jhZOY)09vitR)5%UYt;ZpYO~bFSZH`L^NS8(`;wF;Ft@41_8ofsAd*tE
z*HohTCSp#EX<&FOfS$n`joKBi0pN?tj4`b0VP|1Q8C@tkMDD=h%4_X7v&2=s>ROox
z0ssxl5|~oT6+l&)dt1cVHa}u!lZ-|ltYgZpXLJshb_j+BlXXUOhq2e3L^tKXY8Dys
zgb0ZB{jtyXYK`cfoN`gZ*oR1Zr9Uunjv5bLsR~m;%dM`qR}o1-2T^+-iJ>reQg{LY
zQns`&v!BhVnj#zk<OCf?se!3ZiBooKs3elLDlij)xd8OKRhiwsCV)~93ee!I<|C#2
zyTLF4g5IwtPDlaiULYpZ&n-n?y4&J=V&O{Wf2ceQ4qdXJ6q<cVAOtjT*ID_A7ciDU
zhbpT8C-j=U0b_3=<cNGN0gKecdndG<C`M`-J+VTWCn$yr`9NVbNRST_6uAPI3JO4)
zFwzvH5-=&MgcQ4#b!G!N0U>m4O!|qDM86*y05sCpEUVVmE&cxR4TIj=3$K65%iDMq
zQY`>Hr053$0G+9+DKI8r3vE=){g5xQER!0(6-TqxB8m~v>M$mzE#H>fr8)iV2V}kf
z4KoW6a7HNCi1J$jr34r(>Zp2{R6y7i+k54Y@b{QB62X1rm~IT4N<GxK;A8{Mpfm-N
z%sUa8qbnS4DKRGJMpSB(3&4@%B>wr4pkiIDh(gS}oP2vHSCJ4&V+y*wd7Lr3xs3LJ
zfN8^_F9avA<+&BJh>6QgC$!AqK^jm6lGW%UaY!H?V<Ql5Z(c~M4#vUHPHNEB)GuAh
zI50%R*?c$30%$Z#Y~EHHhBsE4Sd5(+tb0~R6)G?~Kz<k)-2$iye@~pT5gsK8BNvH}
z{O5ABN>oF%12K)!`a9dWxWGA`%4u^CEREpp1d|Z%62LUSMDE#+SCT;fq*I;STV4SW
z*J@PIGpl*q{wioFRhrxZOwhv=y`>C;#Rk%TirGYAOPjH^!`RvZwsr_xJHX~PV>Sai
zWeV<Q=pN6|T}Xi;89Xy_smjB9QCVj4sKwawOF@P!pP08d>uh43ZQ8ZI)_?uNiR0J3
z=tq8DjothRr#cV7LyG>00U$|RTa&ao&njhx1`)?{ElY^M%2X{;bbO#F2uWHZNf{Vb
zRJDK!+7C2<0-!V;;?x4?_e15k11hyyKSgb^7#R*Z%tfC;&Kb;dcd5Zv8Hvp4?#B~7
z$3I5uicw$OWmy6w324ZmG>A_|ac58owAwkSEPe9v5EBhVMToqH7?(C<Z5;XHh-<Pz
z64fK9sw(@=Gi+p@IkeqLEC%%;yv|(~oYy3bLDA!)*$NP`arzFGc>HrKMFBS;q5Zm{
zvE7^QE1Sv3WpeW~zyu&+X1B+kJLgzup}oRKC<}s07@aA$K4ctCZ@5j__3VXp^ax24
z7~KJs3qUp>G-Vd14B_?efRNa161D~`O2IO(f)l7X-lySSx6uL<cOn>zF*(g#1K^_Y
z8+{DSV}^Flt`7DFAr$(On*0WvDD9a@lmGyL07*naR6NjkCa&UR)dIFil+u7URT)RU
z1d|!#%)JHXH;u4kdyb3F8R6`+HD=}sNvefVM<@!$>QaKEhZSzWTj9=o6c(47w6Kuj
z-h(OnIib<kNE${EsMNziWCnTgkwl+5u)sh~iqp<E3|5C{A3SvE75S&WbSHp&cJ11X
zg9lIG(Ll8T@Q@)U;0pl$4#c-?%hJYXttd)BXGkywkpa)O;B~j?tkGarP+4M`Fo!lo
zI|laGATD6SrZU$ufE3901LeRb|M9q^PknAal+FdB$CjCR4M+os-ro&0Wx<C+A|$8b
zI@H;*{PB2gJ9HpTfiwm8gUy`Xp=kS(v~r}Jqx2f7J?sRM==ej#UWA~<&ivu3^F)En
z;ouEIisW(@*5EK#VsH2!jDaOWyNlr7s0ksKc)`nxPtrZV`bdZB$Pe9O2B=(|%;KRE
z5x0*dvF+ToL=5PJ7>OO5DJ@5=tmC59goUQ72q+7)dD14sSs;{uyc?H8a2Vh<kkTLx
zn1W3T&?BJtWhaC{3PeFT32bjnFrnxd^RYzY<hnq-Y8Hz3pKbtvIU$7Q0Kq^$zctQb
zSKD;G64JNbDA}g`wxEem{wM`lxeqIEUGVsK)5yL*PN?%{nB1h(PBdfhe1S`^2hP8!
zhik9tVb87+Qq5>6ppn^Zncmw!3|1EzipMbWClts5lq$nL4`leKFSc>#H`@58&t<sh
za0+fHWKDufHMB%M*r@>&w!fJ1D1n&BmBIjlOG?rNjj0`JzH;ChD@!NtyWooF{I{=u
z{sRkmlu#`IJY;AefX4thgnoC=9EhfsQZ_6o-q!vkshmb}?k)k@5kZxVW@^1`A?pfA
zfkNB!WJKT*fOa@Uc>o%H6=uscK`5-v5aeR_Ltg+X2e>1OB>RlA)`ee#HY5&zSKk=^
z42mk8kw+ZDQ5}#G1`+}qDj=(Nwrt=zqa-xj1vQmMPdl8MJsJ=l^g=;$2~AvuIwBh%
z9-$X;N2^+BU<DhYGO*bN337b?V5aI^#!Z-nErNqPrf!9V$OphHW&v)Ekpv)u<U_xh
zocPDC)Uo8EmUXJwXTi%qtPR-2%J5|O3{_S4>{@W?ga+d~khv<Eh@g@1rv_Mo$}WJ?
zGd;p2P%HwY+rUXftkVW?GF2F;jcfHQ_+SW0gxgi$SO1&M#u!+Zocn-8z@u@bWg;H7
zdyv42QL?f%KPo*Ef^GCIIb|V~o|Z_64ezx%cATIKj8=grX`Fv%&d+{Um(D+Lh;z?k
z%ye?7yoAyW6xJ*^6fz>Qa2;Y0m&llqk^L@Z%<jo?(W!m(@)S4UlH#+UZsM;$Jb}9(
zm_(i_G$u<BX)9obTnJ3E#(_XO1PbNeHw6Y0E9e4gqm8n?b$Y#f;Dr;bi#LAH3*Yd8
z|NDP_E61aNY60LOL-*T%!0O8MOsO%YlGKK**-M;-s;WIkS@MF`;JtQ<(I8-UvM?c6
zzEm*9a4o>ZM9c$#`v7K5yVNuX=;$thQu`<Y70WZrs}8Pvp0iN&l|8_OLRv`};$p~U
zzS0V?=W?cajn-Tv4>)o;6f%o$P@F^!Am|Zjb~4B2=@Ji=DMNTMi`=xa9AJeIrL5xa
z!q7+@JmI_qDDI^ssxn2OVmhb{UAxA)%J<|VjNj-PdNf1g$_>)fRlx;;hm)Uff`t1c
zIYtOv0ivhz_TAnH{FJKCcjHwcC{~zg0ST2hjIgpe?oS4YQgFEr=p2Aa3(eF92Dbp^
z3MiWiW+?~3$Z<y-S9l1B&nt!v^LUT0g#M8imi<dJ27Qg;SiTm9K|(k$ZTs#k53i9f
z30lKI^N{jP=tGo0Kmb5NsR)ozv}uV@3=-%*;f!7Dc+qpZc*Zk&bn;0BHyFe@gL@1r
z?Y>pYZ?}+$OMw$H&!KTMvjw1X21bm@G{-d;<+%9#0d9CwAAkLUK0fky)42a=3&{kK
zGzycqj0G}gUx+b*%%3xE!a1CMWr;>-hWo>ny{oIMufF@<dv89>e8&!=v1T4=R0{wP
zJ>u1s)kaYw$%4V!l|--D?&8zK2=1{buY-u2DPhwL+x*~8eUXg8{KiCp?t*m}t|SXl
z6DSXZ%OytABEkmw`w`bFaA9MSpy8iY(Tbx!2yMr_p#kTN8WLFMSWm<!R*Rujfn8D(
zKW>vBUKfN-Gb8NUG|~?obK?ule2fb_<}aAFE}Uy&IP7e1yskKI0}kongLWOXK#tIm
zcwkY4nOtw>9xUcqOfUPzk;n!DY9a51fVA25jN@tdQ4>|IQ%XPVgG2mSUBAiIfe(T%
z5qV3J-y%*cwTvnSuysC1rnJGmUEiujkpMuYK)D1i*Ffnc49=iIgD(M8*nOZO%pu}_
zfuqYESdm5Lm?`>G?q}CFhaYl)o+pNfjJ>BCKwg+|J9oc$Y^kk}pclwuLC>8S8y4~L
z0!{^)vw!DZg_#EMUC&*{i(jyc^UulARtyZ7xMYBsiETwE+o}*y#y$(@hCqyj8y>L+
z_kb2DTzuvTr~gEbCp~qDKl`(3eDo8OSnH-}w6%4#HLYom#Az?JGRe>7cP<!KQ)6;#
z(p%|YdF1G^XMgv#ulg+j13bd1762Y%^z>J}NPX%9H>E||p^OyUoSqRB=wB~Ucf;2l
zw;GT<2MIv432fbLJa)Yoj3ckfxEH?<=ye!zfx(;tgWCZ;B&0K7F8#qk6?nRu+bk-4
z<DNwVie#xN1z0?2b7amHX;26g5McE&W{v3Fp)7&-jgY_xOkuUz=^R_<2gJvworyE(
z%F%QQ(F6pL0waMg$C<Pg9DH#VnFHNvJrV&Sdqg@<#IZHn;BTq83GKDYqs%R#_hT2(
z#+uXEWI{r^?%DCd>!4PjPrxgkW-`71g>?*6<o1h%xg;`TL)Dm}8OTzNeY*-Y5@r+|
zfGaY(0U4l|fMUt|uQWjA5-_^oB>!>RKUe3gqQP$zVDJBQYVHP^7NgXhm9N~CNHnbi
z%6LB%Ww%68_-37e=8&qqAdCtX_^H^-q4{wWfkVo?(klu`>QZ5}p5nZHBfR2eOL)$+
zRx#fppbxM%2pB0l2;a0>%a9DIj61R6Myo0cwy(_KJ}{L6*IhKkS*I=H{Kxe1zW2}I
z8xORRO_nw*GQ}t&`AG_EJcgFpC18ytYoch)&2;<6o_k{Pz^9q{pXm{f0@MP)LyXd5
zUrOrcwoO(-aTayJLjpqE22lAcCI+F|W^CDJLUjTzXTO(F94SB-fL@2wei#}U-2tUa
z1T9da2k!7Be<1m)c2#xBan$fYq0Wl8zw+J%h;`htCm^7R62W+LI|FE>!KPoGpMo*b
zC@?!cB&}5yW)XZgRA4lZW+=<Aik#q_C;=fbcxF6yvKc1j86P0dW%7rYYeWb*B)*fL
z(IHn(JXeNs3fNbk#2X4sLPK|7iFK>yw;7u(x9cqW#5#t2<Gtw`*S`3q<`6AVMT;Dg
zoF$CiyEJDRQ8@yVNc607*%Z*LK)C?MsQ@P?_P;y^WNn1V2Z@Ssj3P)gn*@i%>m*hn
z>|s&7isagGyhq06SF>3|J_MKgLW2t(3w{W{4~qoDJT*ukI~0kez{Wvx4o?gkvRFR=
ztO=vl1lL{C!<*i49G6`*M4JHa$L~VOgW!G^0O$5!VV|Qd+L8cB0m@)X8akx0icJIo
zmlPY@U6-+~3B2+}J)C>?2><=JH{l<?*hVtNNK<>i%OAo{9u|V6lmXo9LC!Rz(P+==
zyjVSVWo_vhS3mK^-vF?JM=;fS03KqLAZsOAHVsOBN;F@dRiwg|vDPBLDXN$+0nnPz
zObMH3Ow9CHI1LzJ;Z&owsrUy1&;nS4@}uxc2|QDewO;SF9VO%mjK{#^qH{n9Cvx98
zL_jngr``?Euhg{(vWPqQgyN<eE?W%ydlS-7WHR_=Nr~pv0A(oz7(~Mu%bP=BC=0pg
zL**U+C0ZbuLnK&?>)K+@2-Rnc#j+Z;hfaaW=I!r_SP7&lfn=XhN#!dN2gz7>*<JS;
zIrY>--Tp?Q%n?HJ9qGMo_pM?;ndHBk$Db3*FS~ThreURkZJSGKr14z3!pY;RUJh^<
zL@kg?f#EFxdT^Bj%`jvw1(^rIPa;AFM-t<<^A?%LSWE?rC9J+1(N+)FdtgnbTPEYv
zSZKI>1tg{%im@_CvD{DG%0}GIHcBCji1vHSn7!OTgTv@tVYsC5#A|x^g`Yi&$6nk=
zyI^2wocCPnUbX_J$$PO5@DiB20L=i|IY9fdz~s|_$)^LICjiZhfMlng*HwVmV9YYA
za%NcN!2h!oH7e20OI&mD2*2?5V|e=YE6iO6O7icsJVJabVzHFYv=aMiGE|Zh(uvk6
zFQ0Y%=&^Ht@2@}e;F{GVfNBKbp+b!YFx&%vaXyh{>D(aC2;R13<usvO1dF@b?G6=?
zkh_z6H4~DIFxArj;57y8qzV#A0|f2^lz@2>R2~P)Wtgad>f!3N{aD8hNSx4q{2)Z|
zp8H6~LJI}o4~Jl_A(d)=RxR`lJ3<Z|!w0C5ft2#YBjIGHv}reK521_TSQmJK3z*|@
zKv}Stpiyd#ULRo624V3EWUSUjA%&G{h9Scm$y*`>+IwM()%7hpsJE)TN9y{xQX9mG
zAiT+#^(ZTECG^7NQJ@Hs5V?fJGwq&HVJ8H><ODLazM*`qy;Fh|_7|H?9#hkdG!>|i
z4*hW3iM2cV6-f60qyR4i#XW#(+i~e=VuIy`Vu95=n~6;+siM+bJC2<3u~~7G9FVdN
z95Kap&WRU^9WcYyl46xHRtFg^_flZehB}J1bPyT2Ic7Qc=1n4}&X<IIP2q+sy7;-D
zTEICcjhOmjDMRru6QEDr2kRk_YzB8O0UGBrXQvS*TL5YbhZ!(<L@3vR@({TH6;Ssd
zf$}(zOn}j_i>zZrK+HE0gLR2yz<A7Q1>W)Y6U4tj_?u77pfSxhDkT)6@}Y}jX9=l1
z0)3dFRC5OTaQS4N=g<73-}$|-0a(W)lxhUvp+Yk=0Qwl^qlqj{H&K#=Ok5%jX~jV~
zNc#Ro5z@1LqnQDfYHm)rG_q{Xy-@%+;7%?|ECNs%29X~yho(y4w4A6io@263+D7Hn
zj)ZvvSDCcEnFB-sA5sR%go4Ivi=A-P^$6e7;cv}A!xlJ-xQXqQ)*ubeGJuOj;12Fe
zj+la93nnOHuqF(8iVd@YT@jHh-;K-J!$qGx^JP)IrApDW$;xXScSpcFEV(ctWK9$f
zcfMhcALNfo5k?vRCyBf)<dfEHfL6fnIj=hlxQ7_v5+GI}o3zJe;kOGc&TL|(V71Kz
z%{B!YwknrKb7m0;ebm4Wqy0c}AD~)sUfcj}c*%>UI!WSMxwkibzJr4{`clk|M^50c
zAKL?NPRZ<5<8VincgpAsgFL~YRFFH3s*erx>2{N31VjoL4N_cuR)M$t*fP%AHv)PB
zQ1Et-#Fz`qRWO=B=UKqq&w^)uh%xavP`a5xBLJ%)UIg(Xz$*j{8A%IhoDG_O6?pD#
zK>KQd*Nm~>cbdW+ih1{2T@!c>IAceFpMA>-JnqsihTX)A$!42L1Assyg-j%uh@p`*
zT7+z}v$D2!!}8LJliu*tUwFi#0JQ+{P@!A_ID$cc&?cf;MTt0F;k65j&e<yTD;TqM
z;xQlsB~1hs%^2)y{6x1lx^fw$N9L{1?}rhB2_{9b(~!km>9s(kjtDVCTHwT39C9I8
zOQcl=y_CiHgU;dr(om$tR2Ylr%TQ?&0sa5k`}gSIwyQ1>{LHoY_xpRC_c`~To16Q}
z>n0%~2}uY95(r=<3gInCp(O}{!$*~hgVri-ZQE{3hjzDBR&@`p9=2MRmJZMo5L&bf
zkValYNPzH2An)YnzRu(K_`ddDv;SCYzSiEq=+J=YoN@LY=l*`b?|1LD*P3gtIX`o*
zx#mo%5<>|ndFPlj;oL#Sax~c;<+gwh10h1-oC%vX)9iEY6p8X<uV+0%;s%xlw~x*_
zhwtU39Hf0HpxCgR7<v;UR^R1Q#>RVj(w-=zs&)eYs~#XyC$v5z#c0U6`MnO7VhgHc
zt4}PC#j@`fE~mA#W-SgxfG`2n0lSY<9-b$xe+kGZAnG*nF9l6Q;vNa)r&%Hz>4R%U
zaD>xgaUz6grKcRvtn-w{L;#N&lwEr5L;}PK3AEdF*ydE$R{glKdfoaV0EwIjhX}y1
zPPnq4@%z8!CO+#mTXY+lKd+EeNeVWe0LwQ4SN<Gu@jHOUBOp9a7@sBLV<K!p7;P{-
z0=y&eiYea&_$Fxo#lYo14xIa%O0^;K*<{THs(?-juYA#nKlUBZ;bqqcjO)I{48TpJ
z;9(tW1B8{u8Q_d={}OEnJh@(NzVux`^^fmaPx*ZSaHm{19|b7$c5`w7;4&zAS!ri?
zO*&33g-O(SG!99Rh*<%WD8=Mg0*#*p@d%<NXm|?XR7?Y}*kaa_iC6k;t4sz}e^UGK
z<blb7ci#=EC>MhF{GPXz1n#Q464I6yJR)Y$wexFS=rU7=Dy77}d(;Tj^6oJcRy)~!
zE-+wjCpvf?NOpH?s#>qC{Lq`CGg`q->DSPjohQZvBVh#P3s#-(o$@AQZC=Rph>w0_
z=g3yaj{`HR1&iCh4X)Jl6bTKomGO9&x-l}305T&jvUVgm&rNewyp=#$0=rKjuRm7u
zS@2kI%jVhe-Yg}QgRqJ&M8W%v*N%$en56?wLKe67*u9n=7%&>i+*K=o7z>E?2Op^3
z*8$rhVL$?sY(W4-m5YPobZf{P*$mK@@Vmb17QXBqx3L%p1<mYvV>|_81TKC(aOIB!
zd#?cK7J%Ds{O&}D7zgOeKQ7rH3m`ZFx@(~GUkfZ>0`N(RF;Jd^Fqh(IWqCpgWjH0g
z@v}#K<JTS)5I>fa2{y0x3stX>)f2H4-U4#E#XfR(aQXS?pZ%OXeBzoT+dXyN2LN}>
z^|K5Bo7L$u=X_|J!orqLpaT&NJN-L3-6vMD3Q?HUXiXehY}5hcGi6UNuYuv?0PTmD
zmBm+WGH)!Y`?--SA_HUvTSwHo42zp|IYKkd!2}-z!D5o3PD2!GKf12SoosdQGZ>l5
zRs)T|gBNzVu%C+;WRfhM!syiwPeA5`^|nKnI&1}zR2a~Z*^gU{e&;F&Pz#{Mcelbj
z@IYh(H~BDy6%??c1?itu+ba>#o=03W9{%WFd+TQKu5H&vYT{V@gmKbBP0kOXlPud<
z3R>%XQUWkaG~wCwDqUFud5tu_9~hr<d(xuN!}*cw0WkoB@NT(lx+!AOIFWv#FO!Li
z;D=Q)`Im7~>cd!zbqPT%y*4GHaYx8?4JLa<!%e|u2nHiFBN4DWO?cC**Z6(kbPHGZ
zhLRAJte*^k#}jbsflJ>4T>2)UUljK~c1C;mj2}mtU5VmYfYVig_Zge_fRFw@u>F9}
zNl@|*^u|I{wf$khxo(HA`Rdzv>+6oNJ6*&z)X<!(hs2g$ZMy`T5~U8^{$-4uKIg{m
zTc3k_^tulK?wpGNV0C)Z4P#zV>R2nW3363IZ4U)hE;fmKPLFR9mlHRT=CTt6PS7)o
zwKN_9`2^T~0yKOWKysl7JU;@}z-N6g|NIt#E3MnOk3|S-fD}#Ntwx!2UKX{NshojC
zNPXP`a6(<;7<dP~;PM8S&usw&-+&`bdt#x)0OU+KUDbnVYWW89I$*ac&5S_ioq%D5
znaV91e_?+`ELZ!&Y>HwwXTQD!s^3Jdu_vYjbmSFb6~d~vnZmqs)p&_g<1O$nc8Zk!
zyFKV&fS4(j_bj@4_Ir%V!t;m$(~MHsDuY%(0_2+@I`B{fff!PW&trnxuB3eqlPT$-
zCv(-@*8(KZ#SB}IY;?2Tq6&U@gYy75I9daS$4z2%VfNhG@vFx39-$+EcZ7=_<Lkfr
z1TTAHC~?4TKgSdBxDQ<TR?y*>1H3MB0_G9X?Se3alG2;ObO@#gfN=mH{{-@L|1I&e
z|0nSAzbq$^=#WLht7j)*Om5av<)QU}#~xnetG?nEF83qyrh_EdN}gxk+^Crqmj)9v
zrNtq(WB<Zuo__W-zV_??+!FWTbsqrSITr)K$>~uy4C5kEG9^@*SXkEULz6c(h|cnN
ztDq|XCCOXsUT7jB*!HvpaR%}V7@h$S&(r|G;Aqv$!3T(I*(<>kq?EkvYbaj+rrNTe
zZx^BGY;W&sP<`gDix%=*dz2DrZ&Aw~RQgHP<FWjH?eYfa&uw_jv0a@Ve-x=UpTHQ$
zjH8os!k{J>v>plGFkfxC&&N+V&E0M>1P_XPg#By62VQVmo1#oeemaj2L(VvQ^E4_h
zul6E9^Zh3GMbd4nR+Y>A>m-h25k#r-k65_c4GCTaN!-Zcen#JAV6^f2ZZiPNWZ;LW
z@Id}JfDEQSjHmRx1|iyF5L7d1+fZaP1%YPG`XJ$FQ_M8?fWO3pQ(gMJ9RSKD@?V>^
z1DV4~->7T@71Vw%pr+2l=9uyMZ#c&9eESg=L&=C;`c>WWc>~S^=<+v!&b<Sm698+E
z<2<_>KZ0ud>O(MH28L7M_=kY!{xayf{|0pOBOu;@(xu{Q<OJk|$#xP)=@CvOX8<E3
zoviSsZ+nVA?+rJ2dz2!8bQA8mJYoqkp%`7iAan;kgFpAfpLqWxn4h7$`nqR>8}7o3
z0PtqBP2-qr+PWx>%q?mU`9JF+xA2+mZn1b4nN_QDY{yG>0+83>yaHhWQDhZ%eesdD
ztO~rklfxUF$kS?VEd}I<wpbrG*J^w!nUz!9kb4XpRqK6!VG_zV_e-jjE#u&D#Nu#7
zzDeMP<P9>nqa;4@BAk$s#~!P7^#HV{gmd@D0!~J1o*9)+NKnYt(oro+lShK<-Zz<=
zih#Z!?yQ~Pc2{8VDa4-JNQl<2|FsrL(!`Cv+nGwt7en1EYSWAU_73&h#+8eVgS}C*
zFHh;<X2@;Wlp`Cn5Vr70nd0Odvplj6|9K4}b#vNvIpKjwEyTiC{vlf<T<NN}Z3l%~
zaymth?lG8$RbRa=ki^uXQ<V*w-7W<&u-kUHb}r+qzv2`RTp55>nYS|51aJnAC&0O{
z0M5S?zzK*q(7+;1!>8+z!Au3r9Wv-5VYm&f{&(Qyhk@bOOAq@4fcAtLq?4g<MlLZx
zq&}KsP9mTu<dYGX_HWZyfB7f)C*O6AZ|xGLz3h&N%93_zf}GJI90LXtCG-au(&ps&
zji30$M;>S958i8;0q+BVJM7A1CT4V03(YzoKw0=in5YrWHE(hhfLeD3$E$sQW@xx`
zwGqIZUk1?<u`F<7A@bbEv3<Wzt#TVoqBm}Ep0sb)is?#m*V<U+{vtG`hytXj5U{sI
zbq0ELP>44qEY6SU_A<ttcoB|p*9;5d=5^<bkr*R0*6Re5T&;q2zqqsfrVjjGffITm
zN`J;P;M-RO*8-0ECszSVa}5Z2okE(~c9^nC(|3evbn${_`G)Qay{dykPj1(_=1J&B
zJ<>{qtCtyv`ye^PKNZXE7_@9<eYxKNa}OuDdJ)xcqxm=-eO=)k$+l;&;yCAeKPKzM
ztoX<>Vg7Y_aPa{6mSwsVkSWn_wM6QuxU{rDm3t*=^(ONG5Rf+suY2PPpZAsxx-HyR
zSsmMO1X?@^zVLM@ZnIULIPp8m{+}^M$>4pl^kemt!14D2+xJ$F#vw{jPJt@3e9gu?
zMx!(MG6A&cn0G{Ud%&CD@EpD3MYr+ezjhgWdpoz@%&8QzX;#M5%?d6wNc{me17D&%
zy!;RRvH$B&0NCOly6$fQ++i1IrgC15n4MW670=Y35RaHQ-9<sEYZpP_tKJMs)BO>Y
z3IXe%05(4dbQcg!L6<r;qyTM2y#I(A;U|4*H5r0S(LQ#I6;64GZ@l&8X~?x(_Ipe9
zI{QjwC6bttdIl{R!!G&Ke^Wni2z*QB7~sxr%~)`HBzQy~j&4o+%}{jUJ^{Z6M7~+K
z-!GZ$D3GCAK}tiH>?ULp^5SxevN$kTV`<JfxNVAEv~?jLBmtb;hzOpOs58r7moI1R
z?*Yi}6o4nQ^PHGF8m7=NWk;n?-Rdza*!T^g=z!qRw}Oi}XLCm5bUiwp-mDS#`)-7*
z(x)wPVr-G>R@7*ZQM0MU&L2{{ns*6@G~#Q%;usHJ-hy|z7L}^CKJpgG3*g+>fVu|(
zK2cJtN8K&m@}mdnDq(mYxbe3L&;1o(_lux(4oDa3osxO5nTY6<pU}uyPtiV@2$?#{
z>x}IuceuJd<#)dA8SEn=j|sZ{(ykZx?#B5A=1g6`$lc=LfKva3zxbZ_Ucx<g-3I`7
z+LgzSS$vLi(q1^%FJ!1NGY6;J)pt5dvj3?U0nt`%1$Jqr2k{LcKLtvQpkT^jw<<)%
zGK0xJ398lrMCTQl#qX_D^~sFFZBt9L^_tGUL=?lp(&aAzGi$(pF=~jB7MXbPUV^I8
z$*9+cj^#{PZ_U*kBI99TB~)({DWeLG+wSU|>Y!Tdom%=h`bpk|po5$#C<2v3m+YvU
zeNnY?>*{eGjS-HlU{Oy&IIi>7tUi`>sG6BUXyf`RJ7NUF<x7nHy&T6xF3x}&HgMgy
z@tQVh(__n)g%3ar7Pmp*z>SeJqT3@zrITyRzuN%5Jnq}nG{B<xq&Epz4++m7Evr~?
zxdJKy<B0{*In4v%$;Su0;SC$?wK^75&ie1a4mf-hh;M>4g|P2f!EeQ4UxIN7Sic8&
z_OB9F{}R+Mf$j>J5(r}h((2ltOqiD^E#H%YIbslXz(C-mHF%Y=T<_?0Z+Hfm_cxq(
zsn+b62V-qur(q2S2q`TN7DvY?uXyh1Ph7-3cHIX6ci5G4uAFCQXl1Fku2xm_Du%p8
zhx!ETPjZl5tYB(HmRa?+NQWe*(EzxpbmEd~Eyd=>$z=;!6Z$wCaAMWYH!^81bVG#b
zn1N+i<VD$PBy!#d9sokd;e}mEPcM%PLTFvI>M1Yv*Eg&BQK{jiFPAMFZ=D9k!QPr~
z>F4G~+_6DhM?k2__^JY!CA>#WXPpX&Ky&K12+FJVz7S2G2*=tC^vJdfGnI<I?3^pi
z6Fw$nEir%T+#n7eQWwG*+$a{JlFV<7%+cMG&V%UYv!E$8%j5KDpl?)e)p>GXlkD|V
zbTXCK*X(|SfSv#|&~?Ci+vAy=`<9?fvi^rH315_`+?IEYFZrTVyyUShc#}zw-6krT
z`Dg*Y@TFi{fO*pt#mIUBqEKiL%!k17j{wjAKY-!=Kz{+ip3<HD$xUZK5KqUYbml^X
z`iUKh((H)@jLdYjMmI3?4d6u&-oRTv<7r@vAp0u)HHy&J4PfDKnJ;Fd{(v^S;qt-Z
z{^Nh|`+oYK(wX<vVD5!$JB-NG5xTC#)-j`a1b_yi+5&eX$LIZKpu{|tn;~b3&)i2-
zuerZxL{P?n6CmDY&%pv?3U_Ot$|o}>diaj~LdBd=h>y?J_@k;6t0k8i=u^Qonf;qf
zU&oS?=aGj_aL|v1@L9;L+2Yh%P~nsrBWJ9)wZn-}UXtQm>F=beTg5CS@`A4cKYr9A
zc-`6lxuQanipWo@=HPGLpwe_GxZ*6V$$YktdVo@C#ckvM7M2<^b%IB5&S0)yCOHA1
zu@XTGmwWSwbB8-D`WkfVJRTl+DMuMEGCAupcuc&x9XicUQ`;(>c%Hl;T>J|pkbDL}
zsRax5G!!};y~8e6s-RBl0BH8a%KshXWZU7XoBK%cn=gVkO6d<nvl*1iMC|d1m%ic{
zhl>F;qUzU*Zs`O#co}f;YEW9$cb9f8)sV=b{W6cYe*k#?Z<TDK-Bl1v3UQhE7ESwU
zFa|X&+JMO!G(`!Z4%Fox`aBRHWn5ou@S4{i)41z`x4;@Dm7x%C4@&v*;%F*FPW?W2
zX?c~9Ui1I`{_pK@4_)^Gz#Vg)0|1N}lsSmjsrn;XLgZ>}K($#Y7+e>Wi6VH7HoZcU
zd8o9rb!dV|lg9wCeN#i_bC)E(ajHe%WxKhe+Nw9%50Zk+b>hc=IHN=}7c*(m!-~4Z
zbhjNdp18io!Gbwwby8Qw#6YlISgl$HW8?%7v5&!M9V>IVM|&TnzI|6K+E|KXBa{-<
z;tHvem!1yZ^daZoHWS~H5OTyB!EUV<7q>#%zj)4L<J3~+0X0->YFme!9N9d`ETkAm
z!u}!9FIdY;Ovu}?cs=$;PV~3FZuiobdC%}n>2S&Gk7m-9f$VqZN|-*xv+J_NsbpZ}
zur!4oh?v*A#Lt~BYB}7P?UQ`kZ{dAnY&Qw7fAtP;dfg7ZY1i#gj%4n=6_n0%xgk(a
z7!<%BGVg(p{yFIO-v`kK=q?9Vm<9CQ&Rz7zn3oe1-V0e9W!q}Z1*B{VX*J>{pK%M<
zFYJ&93FM`!^<?o;JD+|6C<EvgJwWNg?OV5B{wu%ui}wM*{p&a5`d8&gmwY8!w4U7H
z-L95i>n>~)2ua|T2@JD2rkTPU@uQZ8Yr!cBcAsh4O)x04Wx^Ak7E;mHpI#YE1hEVu
z3goD78bqK!TX#Bx79Fr$sOw%2J=Ei0U1q%a`U&<IOyiJ5au(-vjluAGz`G2IdqDgH
z8o3eu#U{kqSwc3dv%DJs+_6PgTE}p%2C)%pBAaL#7gFZ%?umt;>zpL_Ik)WL8BX|a
z2K7x)tYo#czhnv%N*P)?{}QcSYbTE#(lUWktJL85z8#eBHqG-|xTi%H2A;eE3_cPI
zw6TU<@TR!F*}324`;Zlbn=uQYjSLJ~K@qvWQDWK+iB7f)@jp}<QLK3bu5m)g6T)Y_
zdW|O@AIfn|0a^e!uK*kXi<be|n%l(W2{UJ6T7q!^I{87QqwfYNfx3&1A1ak7a=d5P
zhWOSAZzOQTg6<CiNSw1aGado2f7vs5?MrWAx9t_k+twdX-bXFF)$@j#)AH7>TbGY+
z-MXhv&fNz9cg96{)%O4Z66dBu4>=E~oahIl>V_Get@Q`P=;C{w5#jKAg7HgltIN4?
zcT_Jt=Ut_S>!-q}Jiu)yT1_;Q`+v@}Fx5LX`rU0U6c0cGE%%C`%L1NQbw)P=4_@A2
z(PxaALU-F?8mK8rO~(we#+5X!rE*61qkN0{+R;q~l#)1jzQZ%kd*$=i8Vl$QW-*3(
z1d)%NT{ayM!?riVgn5wW0i{g2bjX5BQE4m3@V%{=Gb8n0QlD{*EP&v+KD_rROzK(l
zGq>10-Tk}W@kO!o+llAd-#E-syo11Ftpkvn7c!OlUAe<Hce>yS9Dt)1DC7#(GVst<
z;Pc+R#$wC{0CXG!Xz>KlKMdrJ^OreBqXmO6G9CXI==MJXXav$e7`etC<lsDNiQ1^(
z_`UK45Ud>Mx>2?!DyJ8Q8jp||*Z|khuW|kQ3cGaz)pFhBgG`*mZMrkc3g)?6Vms{4
zU%7bsJno_EJ^;8=u7`gC0E+*=NGF~yjB1oZoxSzrs&hPOc6kKl7L5l8sm@&6<d)Q&
zfYWDUJEBN}+@hI%`3Z7&LU$sdqiA6F&+cykhBhk!UqPCI5`p&jYGSh-9wHEE01nS*
zqz=frWD&FY!?`lP@)t1b>4+L!s7kk0sLk-@3(e>fP3BOztXlOUh)O}2D7tpyrhKBt
zm2X(vD)&*?ifAk^Q7C@i0yU&rN3quYlWtew1kNF{ed6;Wg8|G8>Nxf%fX7Cei(YN=
zF-O4Dsv??@ZvvdcoW?_pmE(-5XAo@pt;UMDz&#0Th`@qCBbPlw#H}j=fQ~Vab)&zt
z;z%qmZWRX=P7q_gO1S>OfY-lnjWjyYAg$*Sym%?lUj|Um(o5_F1K<u!R|)I)5^nv^
z09HUcfcG#ln-cXi)8ruw9NR9GIasFskZB+Swj*dLYk-J>ErHgIE0<5v4*;^o<!IKa
zAT;Mna+i&=ez}isv3Ovyzjy)eq3b>XxHB%s|Mm?4fQ&?}29ZeuFJPzYyDAF~GJgI=
zB!Z8F@RC3=(^t-1n4A^UuGD5)PeA!hL`m)48Od4zFBaH00{<RSl04r=@Lcdja0`KG
zzc<D15eEU-F}ki;2<7ZBxi0!dKcwwNuT1?+gVH&4@yv+{*0CFp>o@$IOi1LEwg2AH
zMe8lNib<BTd4^UtxnWL0k>}dEAb;#rJq(g7zrHsl_$d_;wQaXG;E&ULHo(Y8G`g(>
zQM6VAenMauQD@Z>{WxfT?CwwhYYTdPWc;jiAiU1aV}Ri0Ki0J;>`=ff#<I0$^GXVK
z(F5bAroK%w>Fio|e{%+Lsq^)~)fFxrj=*5;Dh<aG++8n?SHK(t7B7G|PXjmqF2K)~
zd?66LBWoqW;)9x5arh{RmVjApXGQ-fnI#z-Gm1oDE|ncoPvTHcpl!yh9=naJ2P1MO
zmu%1krQb0XkXe2=bBOvS7X9J{3_S7H|NJdyiPyXCx(@*EnCmYA05TGC_VHKdDw8W(
z+P)2EAy=uyjAHr9XTB;M5%gSDNT%a07iYo3FYM;!b9%uW_<Cv}t{rLxAvX`Rmr9-p
zq+20!yCuBw-UV}?g8}UI8X+IHQ4)jK3B(zcHsDeEW*Z5rmp#a0AT2VOeDpfGT&r$a
zs%v7u6zqv@q@D|o4|;z;)eJiI487m$pHR8xe$}SLW8{ktv3ICCMcEWJVkXTnrvg&-
zRRiFJScFoy-UnX+#aivvge@6oYk6LI-UPA%f}C>^T$wO&FS}ElKGbw_v8R(vXv4hJ
ztOK{U*pE%;*IWLn@k}TTw&QMoI^l9scn^eP7Xpt}<7pzJ>dsCK?i1FxmdMCJ$_)dQ
zz7_+a(rzT2TL549rY#P;4BlqjT2Sv#0{REQJUTEZK<PXv51^ZWAK3gV&|NZMrA^2<
z8V^#CGc@h1<7M`L%eVtl5W~QD(Hj#q055;hEnK-cAP)(Y0Uk)or8pY9t*hWEs_#q-
zfa%)m<m3hP!6WzN-F@8$0C&vwvjBk1WA;(l;+E31@a`B|@Dj4QI9-u11`$$MloJm@
z;sD?hS?nNotb^{{on8i3gdaO$qN_HbebGOIDJ6kK6#6r<p@M)Xm=YANHRBOzT@{{4
z`-@_s%U-nfKQS-@sT*;)KY+voAi8`)ce4<?UM-b!fT;B@IAtDOpb+ba%qxQ^dID90
z#ai!_fJ3E|lsooTrkix~zq)ow_{XMS1IIo6Ll-zauLCLpmLaN*REfqcb^w)POq_tk
z?7J9vm2AFJB6Php><H!~x+^O2Nrkk>GkjZUnH#xpa~8(yewW**L4{Tg5tC=!>{kzn
zeC#r8wlo3(!-!JI$hB3EwB|%u9WR-=0x8J^DctA0DG7{W2P_tZ&;Fc@!+l>+q0Upz
z0G$W=hfpWT2!bA<1K{|FK<gg?7Khfjj<fwe2#<O@HLP97KbsxXO<>04djd)fK(W`A
ze`!p3;QD~QbHF%upm;{ofnS)1tiH|%IVb9|+l~7-ZrnWlu^)TSET+60uloStj=6r1
z{33~D0l-|LX9-64i@N_ci%nfu383OxKu|`RgG^JqLL-ymgbhu00zA@~0^;dHwgMhS
z$f(s+y$^C~pz#s7PokSxKJvel_-BJWc9z0k2kN>aN6B}!jC-*darOLwj=GWv1zgGv
zMN*Z&NxY8<7!!C9%vJ%HQ|jvG)OOf+bE;IshwaPdGqZEUrm>GkS0l@VE4P0-<EGG~
zoMGZh@2!fV1(nTqw>>pbY3%Q{+ly3|ln6c!#OJLP*YdJYSS|r%fhaD}4BWV&8IjPY
z5GSh1=VV}1PlqT|KTcsZSFga&fdKb7`~bd8JzB@4zv6ic7Xf)YK-`0+Y=b>J0Jwd$
zN1QvyO5T$~Iw?d9-Vx3%cer?UC`!Q1O_}KobeBQh10d{5PYH$A={$J#Uf}4T)FT^9
z$PqiqoJgMc&th$IJXGUOyeB0ZBydH?ykCb*i><eSt0YM^EArkUqg#v^2a{+r37T#_
z?$Oj~Cas<cO4#mlcjLzM%Rlk0U$3|dclmW60NgRxKL=2(n|ch&Eg`^!yScYap|}J!
z-ip&Fi*g&ckkwYduhQ1L%$>_JB;eD~;kI?ZZrJtOw;P8LuCR=PIcGmBaNw}))Hmue
zjS3)Z-dPpQNXrh?FTmMV0;xpg3@p3M*DvhQd2Q+16fdDBhARdK#*r}Ys!W?X<`)!&
zSLhyqoh44%djs%uL37?9Z(m2IY!uUJy9VSGOtiHdsxOw?K6x^6`-S%sIbI-Ge2anz
zHjlgX$?=0>IKuvdvA>_o(TiM=NL9zNMu8OZ;~CcD=@`srw=Zq4pQYoq{S^8a0zLVR
zZHF`0f_G0?zbETw*g=aQ!6lOdFf!q}qXjaPm85o_0@h$lYyXum-s19wp=>RXQw0o^
z)R^Z1x&UARD1kT=(mpV*K)1gK7@q^ud1$h*X8NTTMVs0pAW!)s<hf{>nP-^V@u(yq
z+w7n@0p!{drL@Dc+m_&8r{sg&LVUlneqA?|I?hPgtWOuuEgrvT^yWP?kbC7yDG^ES
zZva8C>cVi=97Sf03c&)d@>tT<&I=)@kY?Pu@@p&Eys^|Oa<kaDS^P8E^hIcs1VLHn
z#5L%C*h3-Vj|mK|Lja?PxW{SP1N{P=C)*RmOuSrVx_)(2K$yq{hFUi|FM65?NQsd%
zu-ystnObkubiJjusuJ;FP$1{b)wphaa9;GkH@K=gHp$dEHP+wc^1`>Vl6?PTH#`9i
zm{Bubs4)c^Z_&nf$izD^vcJbT*mGVUqDWIroKFFOgxbCV(Ky8q2X{0dK}IOV6D#tZ
zJ;9A0_jx-fpvf<$dQ3uB!jMCE#bc2YVLNvC#EpH740Oq7V=OlZ$4349b+6vy+NA-!
z<G`Z@FpmK30kkMjFr#c9oChEM5U~0QpgT8VFUwBakTv?*p))M~@&I2aF#4^g0NAw)
zfQPbGAtwwNWf)x=abbUlq`|MG28GuDYvL6A_Cz6N0(Cuzc<*HB7Pv>Q`vBmMx&CSW
zSr6;aX2z+DQx=Pvy%38;%5pm!A1MLj$XKoF_F20(>?OC?I%@fw1vYaQcwz+EhaB4@
zQa7KT5>QJsn52{L1qDC-Qu`B2k_$!ZreWsd{@*Lv0A>H(EZ>3;9=f(ImWyP<ky-_E
zP}>W1uJj#%-KHD^^l6ZFk5?kp$!OS;x+R_c-2xr=J5M2p314qv%LK_kaj*+iY}k$6
zdjqY_x^_{QF3FS7(($GPHTsp?YfW|2%YrT|uoZrDk>JdPa|eWThmdf=nJ5s}{|7IJ
zdJ~Lc3)psF^K@?H6Lw2N2}?G&5kQa~V|R1KjxKH84$a!>=S)AZ3eLSlMoArG1n|_Y
z9s_6NcMqlI#0r&E%)>x<!Q&a{4wx}U#97#U2hg%A#`-3@z}S2YIQl`L>p*E~!M#El
z1s-Ha0OhmhD6QSuGJm{i`Y|hi7`g|>F>IF-3IIryapl|wop@Bd0J1k2T`BSaiJPxm
zVsCHnVmD$R_sDf00NgRxR|5cc+Z|`lvKtBs2n@OQ=d^_swh&h(<ak<HCBsNKT9u<R
z7Tqr=03>a2`#VekDpD5>*Q}qp;xpnkg(^_@eX48Gl)kxs#X^|+ZYQZ<<=wSyCgzDY
zlW~<KDvW~;EWuPV#@fb$23)<es`AVwP*#@;bnGH~x;|sOO*lE}YQYk74~OI~<Yc6$
zk?W^eo*^XwTyFcum2SZWZB+Y=n?Yg*+)=>#g_%rB<fdcoudUi8v$~l$K2<Z_Avr6&
z@-%lN7z3;>{HV#MCR14HdG2t)xr4EySvQH3Dv}LY3v_la9DS_0(JigkUE?b}da$iW
z`TRV$<n+jB4m1ZqPL?Bow6)9PVId$bGje7;dutCv&U#dk-5gt*?TpL}9)WWgG7^}`
zaxc0*3_!OBq6Nx%|3fhE14lmy8b1M~bK)9n_=E!AHjM1(Xn9InuSPU1Sl5mNppDBa
z6}xFSfT@eyK+N1z#se33=u<)|b}+yKJSs0}EI>P-wnS1|VsG!@f$e&8-VNrizU~8n
zJMGHin{F&<Zk*}rP9=4pSrt}Y?JDecBjNT*asjlgiY8hittCD&N8y8X$}9BrGF;eB
zypLdgl=u7QLz>jH*OfQa#7jra9)HvT{U#ZTSg8cUem_YoAU*8>oVzqsS2VFH36TuM
zjHIr^41hYuc0+t}s^%<&_N6Z}cs~l5fI};OUHo`OA3nEGbcb^Dfm2Swm23|e&r2DJ
z8bX2z#o!BiREVmFsO_Hmy?ePn?B#IdEOMS<E)nNQE`Y^ZxQ%iq0uB!thX;9vZ^JN4
zH|Idtgqh@n9PyHZ!#Hh5Q|YH2A#3e(;Y1GYk-Dklq)PvJrk`BT>ic&QI1_RQ<V?KU
z?6I7W7g~uzR<)bT`S|OX84o;=fgwj6qJ7B#?UfZl4B!B?`DH4u{|f;14Ig{Ht}0Xt
z^(ZDFyJs#r5{W}Af}nc9#!=D%VExJ9F-MI?U}U1684q39pihN<6xNHMF$dUf_2_++
z68e5|Y2<v!{NK`Yxy0Rm-3I`7%vCE-5g43VEcLLx$x)zt!RD>@VrW@N6;W~d9i4W?
zt&O@A*|p(?Ayq3BvbM;r$!34K0*>fS^A>7dR_Z^sh0pH)hD69MQq0Q>|MFnLwTehO
zXzefqv{;lXAE=Ao9SKYfEDy(0<!?+x8Umiw5gIM!atdIxOLV#tdU23-Mhi2D*v(w<
zN2=Be+5`e%M5VMR3;}8YmLoziG#lmGT8NXQgHv(`VipMGbhOLa*myKTraTw3P~J;O
z)r*mo|FX@Ww9ml7KI33N2QNl(kj*GuPv$d$rT3uCUy@T_`ZJTJ6Vdwh#_t)ep7F7)
z6=Dyk85qa1Hmb#{M^QTh=Z?m)Cv*aOCzGaLA`FC=J;8Y5k-GmMn8Y7TT<H9QGw9@B
zf%rKfEgj&Ot(ImRq<Tp_a<v=?g@C&DT8EX=oFpTqIW|+BY$vObP)<i^sbmEo#F@}#
z;L70^U24z5cq2>t1|3-hd;lmBB|0~bn?0gG##gUi#od102LN}@WwsNuo{td$>Ti=Y
zm@x*)Z9X^1nm`x_V0BuRYyHanzRsd)oDXGfxcyJDTmajDn|O%56GQHg-V6K1nWbt%
zxg6YVqX=VSfTG(2ihFc?+|Y?Z$V|(wq(u%c<RW-^3v|l?#6yW0@XpbokjpGoPXTt@
zgw?9RDmqJxNE=~}{Fm+*Zf*+0rwYm}8INy6*vHem-Qx~9`MG_+n=Y4tCq{j`u2FoX
z9aQvYMD`5+A`K8RvzXYc8p4<p4)%)&fO9rJ&>=aq&{fr(t3+qux4z4RiDte$t4$|F
z`X|pad|;)<GK86GPy{<#wI_MR!X2E4!dt&RkhdN3NSqQh{ed_Rkgc!Gz-~u)>`}(U
zFUU0^jywAh6mmj20dN59J_2lh3P^hhv!*h~;bP};h$*EVIFrt|EZ%|v0S@wC%V10Z
zrIHU}aK{9#;3tTIbNd6jl(kWn3w}zH^vVFPf-D6I*vq?J2LMk!_0*?8%Xi0h9{}88
z7gf`=WS*%fUqg=bD93|rhNY#I`{b^1By3h4O1)K*obseOwZlrFi7v3OoOSE0?nyh&
z@=?)BZENJ(H0xiU2?9a|Q@d(ilV^Mv6gPv?!5+BlsseHq+nK;S#&Uneen09MO~wg;
z3djZkup1IK+gh|;ByY%~I8~fRk5-~PkB<L7xIw(V<p$`#Z?gFLk0+MvWZuks6s6^K
z5R!Byc#&j2DydYovVll%i<K`Dn394jO%)|6gaPcvguOjre<|&YN28&Qa}GsDag*8t
zo9Nhbzxz3oUh`xw!0eJK`8W~Q<{d0hOFgbvQ>Z!@gtGs?8{qTi%Jx=Hgw^Q+!!9v(
zxnkkS6JF_VH-vK+1{@w_$6jv!wWApYA#|Y4PlNJJ5FJK3Hkd}{SgAb$x-)$2|8^pw
zeauf`*lOgGC6RN<W=M`3xTc6WcQAk;fTvXV%(}S6h^Wg~lUX@%LjX}?1}!(6-ThMl
z_pjfai&D=-$Shob*5xe`pKF`VRjP}Tfnj7mIVEsM#mA~~U+(CY3Przy{X1<H26@57
z<)#*d+@(5u8vQ#zcyCSFzBg*SWk_C8`BpVPuW3_7ZLtz^2JJ6^zDK39GnE*5WE}48
zaA|J@j|nwW!ufsMXz<ehc3`Zw$qCP*oI(`1@3vD=<g|cVk8TbF*~ArX#qsnWaSIpu
z)wnSmZ_$*IOp!`P$&hSCJu35F2a4_y+g@@?)@NEZIuJk|Y7Jt?^4`a5-k_X;ehFSI
zU2I2mDb08?Y(JMA{Y?C~mfj4j&bv2k4iR<K+<jm^qn*|hAUpvBk|P7V(ca;K01=K)
z7TE2&)HPtEJ-tapz)09Xw=G_-y2!LDCdAi5K;8hf1cs-;$3F^2hpBt39g|N?)soME
zlD*Hi8pB~1VIu#I%roSxYhf5`_CoVg)qXGm*xN4&l#oUCk+GL=&96BJzy$W?%=??o
z<~{(pe|@^IHvs^;#UWAG6Co2gJ4<8E@^U+bm8m5#$nGkit+yRLeUrdxv_Q4FbM$9j
z(Oqlnp1tDr?~Q#`ggu98L<?$WLh`Sv_c-lQ+p0PG;6<;-K8p17?qs5}_rJe~wCF&&
z6j>>TWbN4wxO%w3W0%%o?vR;*AuE#dU6AA{gpA#ev04){NAHPdJ8Q?I{S`T6TQjYr
zwAC7B^~=a+K$o;T3n9%iSHE@mT<C4{HrMAmykNYAlZJ+V3IIr{Dy;HuCI)&cd)NSv
z%%uVy+}4Xf5y3#-GP>nJ-JVY+EsC>-y*bBA36Kq;uZj{FAOojv_hE+j{aW!wjWofM
zKVnv&aR~!4x4w*2rnGCP<I9Ok#_n-+aT_ixMPl5#vBYkh(D!~@#AU0ht0f`h;{FaV
zcwjrp-(z4nfw2U5Rr+%J6X5NK0Xpv})tKzI=p2-cek#d8pgy$PPD>dz8YmhRew|BB
z1}VOUoI#oekkzR~sTM~fAfu}yrleF39+uX-<JOYQM@pH%v^NfX9{}9HKHb+h0RWc!
zOQb|VWmPjAW{|g;kcGh|;12%4dik*%3CE|&Wu(hNLg}%r&^{29@g!FO;9xqu^kc6X
zTBtpTHJs2EWj$kNHqV^pCv4wC<|xS-=o4r!A&)uS0wT~zc;NgFPh4L?CqO|3#aGqp
zV+>%kOIU4^3w9IgP!O^cZ@;6FKiSY~)~HXTy~&fdorj0#-sS!#+YhyDlFoxb@(!=~
zt#84b;QB@qMOs<JS0a||aMtNm0RlV8YsP#ox}%(07>hvfI<M%>BNC`$NNvW_GZ17-
zN}g@pTe`m{UNg^&4xNxGxLJN|dDS1sZCKd?I_vjC28O{U?6babVmy6&AFFLwwgAuq
z84?_UoPleXGhX)it^i<;Yfa)xKs`VUV7vjG{A2-d)K8atP|!T{l})^IQUmhg?`>Tv
z9&u}6GF9iM!2=$~vbL#$2Za})1i~Vf=d+4L-&fXWVj407w50|`A_gzUalB{r<~=iz
zyZ<@@0CauNT`HQ`3pc^0VtD|7lcMIr1j`Xy)jZ54-fg#|;sUGtU~Vy4T2TrvRku~=
z1-(l|B+0TTXTRltGi^;Y5kU29lVm@ruL;lStGq^4rAg6{4GD+T%HvuM1+?F*Qc+8a
z0A%2BZ->iQx8U4K%k_2MVs|+Lh_D+7s}1UDHb1Y7sUF}d30(3Ku{uaic%S;&tiLi>
zQM1dmhj?dl+~cOCJ?LcJv%P8NsfA|S6VkuNgHRh$xvjtes6JSDNLvyvB}%F6PNgQ}
zwBPbz3CwK3QSdE^1?&}&ki7MFaie@nhwNF^FccDSgqQ>NbK}YA6AQaj8k023&iV{M
z7zRLgV{voKGSx{eXC*#ytH<e1yxwNXQXDvT+YXm65}tU>=iUu0Xmdk*;MLCo+g}Ih
zoV6EyOo6w8@6Klh^pCjtSGi^4CtwE0?GEI!5Syx*58jRd=fIBYe9DZ}v3Evk`>kmu
zYfnK+MKS`DbIxhE8{$OY#aI8Ix&!wwxqb!!(DjRAA!#JHDd`BN%{}WGy9m>`iU<HY
zE=PVPpe0*N<zg=|ORL1eg0;q+;BelF;86<}zhBX|5Syra1ZS+z$R;w}y;~Hp2yZPY
z;sKJsv_5GmT0;9vc-e#MZlnw>yAg+%)+I-JUHw9Swa#^D1kQ|I1~%K0Sx&V|<M;@Y
zPX8oxF*8l{>Abtdnrp0AE(SKa0xR|&j`s%dz!aQCgc9D<8i63!RpTRnFiffzTgJaa
zNJgfdvv>6}h$!wg8xM|ybhZYlRhNmc&gdb5jG5x9iL|Y?4+xD%qa}l`Lz?++<^eaa
zVcPuM1T^JHAPIovmSL=?QWA*SO4ksBd*Hc~CDtQhuf9N2<vA}PrIM|3|1jgqgD#<$
z7Z);j)C0puL8s4wFaYVG2n~%@Nk%Jno-2_@C9`%IQcI$e`-uR&KtsRW+!^1h2w=Zv
zY`)|>s>#u4mjkIoO7YBf8>nPSEXXv4WUI-^u_}sWVX9ZG9MO&uO?Ufs9{`+vO@QHV
z?)7~DfW9YA33)^|{nWm_$&GHEBty~mOIZ{PF8kS#GPma5g@6VTZqzPTa?4N5ZgJN|
z%S#`cSc(4f8cxhaOa%DsOz4fxJ3Qd=>5F0gw{8>YupDQSW6s*nNazw{ac+w|W`-WZ
zj1o*mYZW><Gj_Y=UP9tB5K|s{F1oSWRlmvk=8%e%Blo!+5Yu=H(fm%b`N`2tG!Brl
ze}w=LFG*VkCTi04Rq5xm8#rJChNM$a%ejPA5P^_0Ih>Ug43tj<i<ZxFPP110l-H`#
zGq7bbrQUtuJSnPXNPCLrO)zZil&iZ(7wp9I0SmGXTUXwDLX(yN6!0{RMX?8TZJxN3
z(;hnjOZA?y1`0|yx&(|nLcbib+#72(P&Rg~qM$U;1KVE*Q3BFo?VpdOaD3)iij#cC
z6zDf)p@{A${OZ?=@UOeyH%biN4Vt+#yhFG#ag7m322Gt%5IWXaATpe%Frqp>Ip0fe
z^ZNkc4!f3JmlI(axmrTmtPV>K+}brTfh;nvNu`>S6I4FGcez=WSvb^Po0}M-{wSc_
z?4Q%dV2wZxaQH<mE6uEl7-FOXH*|r*;#3LL7H3i8hn+cE1OXi^%Yl7n66?6+U@CGh
z?GMNU6LKT~Pe-J3B##8msv3yd$Td+A6BR>IQ2Nifxz*n*q+=6S!HN=oK)hdtoENn2
zG(t!e6y3$q$;zfctxpl8hLZ#A{XIY)yW-ks^8snDJYS%&?&DI5yeB-ZNoMAN;heqR
z0A&F*LC3NrDAb|aJDKMjod9-ky-ub<`N+>XyE$V}@c;nPd!~vzVYTUDX>ckH*?ZNB
z2cRdy<x2xns!{V&Ij|iAb)Zz^0MNsiMD|5_Js#&~<pNWkJRt)~A}GhZ0L=Ty@nJPu
zs+yL-zik;k*JFTz-D{i!Gr+k7qk7smj2eb!^Fd-b5mBB_`(1k7OJL^HeX;xZTXuE(
z=eLv=CzzaT6H5w^Dt{p+&jERe@UHhF7xa(ZgL8Xau84Dsrg0W|y>CK<ApX7ZL|p%D
z?Ux5yP#}@lGj%znEe*V~CiJy4mZ?u~s0mnnax((J8ML>cL`38iUOB49zyS0I8HqEp
zAcBSl>^vYN7)&F0+=7vvuxQ4E+UII!Stc|J!m+(nv663&b*@;>E-Tqxq7$|7llEy6
zUm3JYJ45Zo_EkhRP^-<|qOM)X2KB^W5&m7qFc9+CgTavP0IgZbW^GD*0CBEft4Q3q
z=N@b~Nq?c=L}WHiFr#f~za7&%X5~4?CB*U0D1XODn0#5Q0NNN5c*rUe6vR^o^<}N^
zHXW#w$tFy;9Z-TPmwm>g*LUbK*7CR-Fr@rxfr0w~^&0#eRkXn*@d?R%Yuyh9NinP-
zD!fkjzd62%aTyY)V=}`61F4K*SM#S#iiI!(W63GWJy6#)*8tuy4{_2=oS*~=X6nG)
z@i?a6Ql0RddEEy9ch1ECu(x-xOI^1P5&3T6sL>+dc?3@CoVBB_m8Vkz@(vg_P`Mm!
z+G%%8C@?0<Ox?*)jpBu--sgXE`##pbH=a$Xp!O!VDiUvpN6V6ZzZy5C9e~K7MGxx8
zS*p6v&3Q|>d||}-y`q{^lT6-cb`y0%ePSLHm%u`rl64kA`Huv^c%0-cKpSpsZsJC@
zxtRK1eS4%H8O<Q+gVC$`Eg2c7BNDHR*K;l~5><?A*XzM8HMpGbY9Mg#OF9a6lns&D
z7Kh+1a-9%QhLCQyA>0|4`okJv9KehyqEL{jSr}8@J2U_GMiP8#h<!q4CIH)^dM79t
zt-Qz>a>B4#qF?5?t_kks3ImyNu$S@VV*?f-Ajib{L{#yBf!ok|4<LQp8oB5|pOZ&%
z)Mp^A=<~B))qccM+%#=%H|lZTnT1t&LF#mcd<-Tdly0K<J#t}y&`}1_I6uR8<#itb
z+$q-s4-f$CEfzx}UKgJz$Xk*zk9_0m^n12IU~ooR*yD~dY+F-Z8)sd|;$?8r{dP3V
zYoP*<#bWc8j)DPKCm`gm@yTpvl%;ooP%DT6c5&81eTf|DvG$yfBGha$9k48}XWuAi
zqC5Z(T-@UF0TZ)S_zQRGUjhcYlxWy?G>-9rQMremRqIF}tYbzn%>(GLIf#i$C^qJ+
zE6w6MZ<YJ0j3*c7vNzk?oE_+m=^4c*tx|ZG2PdV0JQA1_5s||nWS$XsC1&(JDf`>V
z#3d}?0gksg(zANd(6Uv~9sWZHtZRE(O^_t}Uu)$%S_dOvRGC*f9E{H}$Bg3f*bYi#
zWfKOtBdpd-tWNgO^<}Nl3=a{N92LtY;YBYRvFPJ4Eg@L#lbcLUJs#XEP97+^ebRn6
z+1#=-x4Z>uB(7T_#@t$N2sR2Z^DmQ(l0eQbo<z2JeEgCJcOeF+zKhh@n8`<c_g?n_
zz#Vd30Pvk(1?m^w4vZC-vwIU8F4(*iInQx{Iz~+i*lr1{b@`66Z%0jM=U!~2qDzKO
z(N%2D2$f3Q$WI4Y^d0`;84GR39q978kqUZId}mk^Q%^^=`a1%aeJMoO8eJpd`sEF-
zT-XMyfH(}Q3Pb{OrSAq924ZwhXmKk@YL|Ttd6AhqWgh!E+sBbnK@?aMzmUX<IORxg
z&%^*&V;4IsJt{4yi-91wV*(z;xoyVE?ulUeR;{ufihxc6I6cS(6p>J3qy%)GpIu=&
zj$8SfR6%m|TSrMJPv*ieA4~n<4ZyG#T0ZrPDCn!mSZ&P&_AWYY!T~txVlF{$n)F8d
zUzFO7;~qDUdQi%cV3&65B2hgCoEQ&0%t)Q<Vm4l~BXEA$<-5rN;l{ZnKt|T1i&u3#
z61@e^7Zul*qgR_uDcn!x4J?I{g4eO~Qc109psh{@Vd9T)?;%@bnz@jffT8o5rS9_U
zJ^;8wuEdO=zu6;o-Hr)s)f@gCHYr=e7K)cR<}EP9D#8;uI!d^4qi+<vzoOu2no<{J
zStHdsE0WwLRtbw-U4<$1Tl)qt3gizqVG+QC31Dl!37~RTUKGTQiQ6S$ZwXf)*}zXG
zJalD)D;L+rI+ZPsAix>f{go21IR$oG!9mUv@>WNayWVF2)Qh64Q}G;7bCt6jHBEGm
zs@vxDg^BU{Q?Z)m-S?6=OhMoX*Wt#Sp^kbLw5A0lenmq%D{$FvJB%YE)kxPEKH*gZ
zq3;L>`_f*^!x6BAKiKU>x7NC6kAN$Le_N~605P>MoGWMTwVD4;Fp7ZE$usqy%)o9y
zNWv_)cfhm9OWZi>ig!B$*=4`<G9eFz?u$dNe9ufFkdYCCY>WpTk_;gRp%SR$Ki$G~
zv7xb8XGmHWk*G(_TBym>MyM_WW5(!DD7ag>+{a^r;1gXlG4qytuC54ix9Hn*30q0`
zjtk&E0JuZ0EfI!Sy#$NC-!k(F=UhcmX5C6<hrt~Lj=ItZ-PnR6Vw|i9w~vx3Z7-7)
zodcG52r!Ar0OiKbE2_q+BZ<=XYdN?9qx(~YjSoU3lP++!X3#?>rzI%J={=lfRai+^
z>Jrl7e#wW>U<@9C3;P2O4hIZFSt1z}2ZdNyoDy)l2G&~!CkopJ#Yo|)!fGwW#;CTh
zX!?*(veG^jwi3vB1h`Q&PS|_T(QI@(8m~~p8;zgE+_y?D_ZYiY5_UsE&f>yN<elVE
zsWTQmaQ=WnBO)U6lV25?0*Rmx+34l^6pH)k>t}$18)=zSRgg-eSQmi;Ekb<-aalK~
z5aKhn-C+zWs!V0cJMsMO0szAC%?hskT=B@*Ta4(sT+#s7eLtqC{>byp9H6N@(j0WL
zzUq{5@J3B|CLCvOy#YMKH*Hs{g+DTBk|YnPtC5l^VYf?_tqqh1KbVr8<8*tHSDs4u
zP7L6E0C1;V=Ky^3BM;%=V1I*geZu3ml<L#??&zK~?kqmcu)i)>^#zvm)P$2&k6WiH
zrrd3or{DI6e}$MUvgkbu59gQNLvD$At6sk$vp@k3>)gX}OCLHjcI&x|kTOEF0w{#D
z9q!c*WNSAAX<#gu0~QAZ@-CrEB?4XD?4D|gKpoI6GEP<<)|(Exx2QtJo3!Nga~ZdH
zr%$LTbSAgM%1$m*94|n=T!R0_-WdoY0<f`i9Sf=VLLU!w54=Pz18R~T?;WT=69GL}
z4|JtPEeYX0ND4?ZVSmB6e8CmP30mAz#X8?nLmz*!k;l^X34=GD88?Sy{A=y9@wS^^
z^|Uyen4(j^i{b%eld`UnDy_88jhjhgbjuO9PI}zh^tHx^W00EsMhTID2QCiS>oX|l
z0Ms>`W*Cdh{pX6~1!C5%#z}6ZNid$xjOHM1!6`V%1_=U<^l8BeAW4BKx{e?TgP0hb
zO<zGqO*+Le0PpZfM2m4PAZPS_KOP*OyT1i+|N8V^&p!Jsf7_q^F<$KTyK&gA^0)(9
zL*5$)@)5-%CO#ZbgY&pd^sSSG=WZsXe%emB2nZ!v!?`gIp5ovU)mtQ=xHZ`rO4b4S
zJzxlSV>L_A3uIfOA>Uklr+jL}GL(@Sv|K0%DGyXBIe-Zn{c>Q=U`nO<NC})UaKlcr
z5&_4jJysjpByr=TDEf4_M1`BPhNi=?uDNlUrRXGY>(LR(nVc`gCpUNW3y-$4J4j`?
zptmUX=aijU+tuo-_h#2l8VJP6=3TUv9I1qz72jJ7xNw-Y`B`}#@u#_<Jg)`aL{ozM
zfwf;(BE>S-b9_59nLP83;GvLlRZx}+wemQIT{N!o4b*3Bc0IP}O6*DH(MEj(1a!!F
z;^Cp--m!K@Y2`RT>Cr53xX+s|Pf;UBrV97i#Dx^ezEz`HSjOz?L;yAOCUY$qVMDUl
z)M7wm@~xYf#{O`y$NF!Myy8pfx(>_zecUV8eE@LhTve=e>tWa&l@;n!{nVShMeFx!
zIXD+#SXmG{;ph~&ahpm2oEP3r9{RZ=9_4i$WCPr7t*K@Ez4c2uv)+tY7hCwd5x2FE
zYE;Zc0{ce2r^JuTSIEf>?Dd5f-i3?=9tjvS4i`I0BkE4+)Fr6(2dZb__^8L}Dm7lw
z8HmM`UxI9GCUWBOph{pZZR_ELKegcjqc8Z<cFQY(20X}7z?gWc>73se3RCA@{iNg&
zTTrHAti=|^!b=X=SXtci_hP{~cRuUq)U@w^HAApvR{Jv!x6+S2Jso2P{&WAFGC7k>
zmA@vn0ECb99-eslI5RMglQqXE<-NC?4q2gX3U<7YW9Yh!m%eC+^M|?cxaTXL;Zq&I
z^-U&`+WT6b^#t&-EP9Xeb4WL??kfcy(d>zdK+0ny17o&%XaCyb9T+8+AR&0**a<*A
zL;zVnP6ifFVGVn_9|Lgz`m|pU0(cF&_2FjN?T*1&Gk#C34@}mO^U4dVjy%d>?1qHR
zCe`!a49SW&IclTtlm&`;p{5CJ7<Qzl9*a^pG`U3&=yn34hr-_0D0Nwl%~+uyt2%)u
zAZaaOa&5?!8EM%8T@N0c=;mDfD%Y-VuuQVo3nvo11ufPqaPx?8a_Y1IVY;PKL7fCA
zsj)QC93tz)A|Xd(KhMte4SV8&Ncz(N9@L5z7cMuZzoq+C%1k4^S~G7FLhg7Cm@qSg
zupJ2l7s)J2Hy$Swdz!IaW?VRzD^Ge**?=i(QwGPeSz?($kV+N~P1##GuvFBJzHNu%
z!s4;doce1l@G|k@rbeQYvUgy2OMN;4=osU+tmzQCpgd4%H<mQYk32fy@WAKvr+B8n
z8MSbI3&cWSvTTht=6Bnca0B}-Jr48^r<jSGS!?@O|H>K2qnmGOq<Wp0aJnI#!xAbX
z^I3tklbs<;x_e`x8t*vKh<oI^4*>3%>uCV*!QO*3aF@0~F2{d91=b`Kq3!Gy2$~li
z?7eo}B@BZkfN33f<P7n~>)_pUnx2ypH=|+gG2n~-cq?GWmm1!s#Xwv;fVUi*=d?S{
zPzZhYZ*zfroI%SDw1_7G0O--cN3U&gxRk;w)v?<MVFqd@K;UG}r6h2|RPKc_O0p&w
z>^7B?dOEZ9JWNob)4?HW5StGv9PyK$2Ta7Km>jSQFPMakn1Zp+o3%`;jbKWxj@v7$
zZ6=I4HzyL}pqZF+CM*_&3+J-|1mQ=HJZ)#`8(*>ll&J8C**O3x%!41VQybH-+rN4K
zhG2M40I&Ql20Z~|29H%q`!sq)$f?7)?MiuMZK4T*rBZKU+yUn<qig{x9SZGYS0l^`
zJf?kgQMX3LAX_HSO-@r-d(-7AklxESd5(-uM8yLjF%rR!Dd1v6hojRTrL;#g^-6LH
zYMd-Z2WbcZ?fS024*>38pYE%yj?Ej+<*r){$RmSGeM?Kq5tnIpAK5lCMK`kB8c01M
z4+&W-eyHiGdOTX9!4CkjY9(n1fW}=Jy_?}V6hZW<oo6C}!|S1@blCrs@3~sA%<Lp<
zw654G{`w#@xa)xB($_dCQiFjs5+1#}!QnC!kF9~us-RKbmCTHjQ^I<iN>TtLe^B62
zFF8{K-Wn4;W3(_`N;*ar^EwB0?8ISWViFtoUM<wqwlQH#-+VOu;ppI|h2$96+<ePa
z7Ouo@pdy?d!mwkErLPIaS=IM-3&2&nn*)1BBexv9gjZgMI~BuWt0aH`cA6o8rv`};
z?7gY-{ET{QG+LPl32kskA;ARzv<DI@+hIh)_N1#R{X-FG>lHCL7e%?)ld5@1>sHt}
zS_Nvxg9(R>$y>sH|J-(w^m*Q%H(GL}ap;N7S-6P6V=i725-?+P%pi;m++Nj_CQK*=
zfuwMk&F|!-rXgpcZI#A(j;rs=>wYnyJL)3-?r#SkeBo=yyv_h|5+T?w><9yrEui8S
zXwEJd=3XpHHLzU3MM)j*ls-EI9fSD1OAXGt^xt~{QYCy999o#jA8Yc>rfBrf?Rj|1
z)*SH~N3GRp;>vXH4@bk&U^xm%dwq$BMkgI0VnWIp4_#ehe>s$3YGN=uyzF&JRk7Ov
z*bNMH(jBjaTj?S+;P&G%k1;r~NnO(VDI;STZqhc%wGDHVcwUh*(GGlhC%p0#cp~Bz
zE`}}%Uy!jt12T4Fs%O`wWUC2!>jq;O3$ykM$FuR}mFl%HOk2^A<GB0}Rf5fQu={^N
z*6m)CJ9^>pMFiuX*5p<~0|tXvfJz+zWLT+bb9-UC?Qnc!52yuh)PvUYQzk4DVX-Xk
za$>51b2iej=KZU5UW@Xy^<4pk%M{44^%<UL8-JmT6+9}e$nD~Fg(w|xHzu`@xPac|
z^P4bG;vq6J2)EXI$hkwQC&gtO)B$QI!E_G7s~KQU%uFMdI^p-kb>9PUXI%sU{i0_=
z4FYuLjqPID&Ede4s~_NOJN=|z3^=|Gtk(=sW-w`qZ*I+~5J`+6q{0H1emIF))|Cha
z%jQ0D?TV{7IN2JD$xDx!Gsg}KAWA)>5{2(vRy`unL60EjGnb=)BXH@`8vTMfk3dQz
zh+Nu0(I2&N3sMHUnuH~ZJBHe>1id4MW%NsO^S3F3SOdXsCvs=BJS~}<S2v2moBjgU
ze4g34%kS~KY<ppRlewsmklj?gNB}q^kD^a96PG{CDb4zK9t+jF&WE{q4}=8n%~+Yl
zbzbx?+d66#G*vH(H&|^u!+pr?`Wi;+6kh=?L^0k&PtXJ=hNFG`mk1c@_DE;P+T@tu
zW=J?X+6N_OBunyC<pFE;P-a{_1P=E{@Bml>jI8TH-QcW4n;xLhIgb2hjv+^T3hZd(
zW@t3O1@;>4q|lWsk1_SOcrTjE0vLP@HRCBWV>|X>CN6=@wZNC(rVMc(<{9xJG}XP3
ziO*Ubci(j%0Ng3pwQGboe=hLn{|o9D%aM|5sd|Gffku_OEOlZzxZIm6W>R7-7L4bg
z>2PvPB^79su;){;wJIyI;;Rs_+}R>@ppBMiqS6VO=qhNLyh-Gn2p8{1XD6&C8Ec~X
zE8wUdnpqVLI#@XGge`vB0ej~LP{$aCPAT8^RjddiLh2GQHVQ(>5!~_(z2ni2=&Cnz
zHm@dqZ!2ZXlyIYvT|<o%L0!#U@*9%NbZY*WX!Us{qo6a-wCnz09c$ckAI1)u35h@{
z)ihA<7^)a*nHec%Ec&d96+jGNqdN1R2CX|GXbMmJ2!^IS<tENW{!jVBPgsugE@hf$
zCRPDM>m}I^MqC%@nL5VluEX<3OHeYL>xNTHB$T!ud604KVgiQt%@mZd^{oZm9Qx3t
z1b5(t&K4(9N!R5PK~1Qn@h)LLd@`X547^)`01VjxgHE624`430<OC>7Q9*dDn!TC-
z=C~{oOR>o@kp=<It<1aXx(@*El&kA-_}~NdjnAK8Z+WmygiUTv0jRQZe8*KG`=lDP
zc5ote3HapG9d6xDHK(sB)X9?`*+;iR5KiVE1T5ab{w{8~RvdUG*}Sa&(t0|)RTuS_
z7p1;UnioL+;tV>s2T)h!t5*;sK+6%S+hN?<(W+>K`2SD}E)5JXQqFw!S)V(T%SV&9
zr#dV@yI5{jShmHWT-5f&a4{4asLd`$#1-akfL^oru3&9uqz-U-peQ<E$Ru`XfpjyO
zDj5XMMa%WQMajG5)X-B6?%f^)_;d>bXw)kAL4a`mZO7wLO{kz`_s*@q)>5`sDj@J4
zpz768FtFX#d5up~2OO<CJav1i>r#&D8u%;s=M22?p#j$}XYkI(u5^+i`SC!Bg^)5>
zfm1`AcCc`BRIUE#p)rC@98<mzGne<S@Gv$w&dmjtm9gGYIVx%80$Ue`2Ca~}hm3^f
zcmOjnjH#<=?7zm{e%%KEcgpqj)4c!D5Am<O^ksB-?(j6Fw9YwOfV*1VjmoQwvE;ak
zuF-NAfoqL52IHw4DA@qJ<QEAHZIfoi()Y}{bam}IA?Y!MNm+FbQuygxbRL7yds8+O
z4+F=}IQu;+s(LRqoh)Qy(EbwCElOe_C&2O!NPWh^{tn=zb0F?!sqZHi2B^gT?N%I=
zxEmoyzi$JgVt^w@iPl(R!E4h{Z1QSuiE7FhZFktLyE7S;0v$v$!p*C<&cs8(>bbG+
zi&99%1CYh=BAmr*82}QMDE2vx%0@=@9yq06HJOeh0BM(Lu_ZOR*XdWm-RyYEabui2
z@f<|pYwJ4#qw;7ew3#=9dSCqdNef`L?eXk!53WY3c~68d%iTE>9(-uP<;!CQyUxw+
zdg>E)`DJ8$BAy_jVO+HhM5*uKu%o4-LD;0mX6V{=z@^fmG7M(c1c8QJ`$%dKS?m;u
z(PO>q9S_O^sNM?ML-V}n#SW>D3;=ICO4S4KHMrZa`vBk$x}HBc#LvIvQQkW^d=B7S
z<8Ftnx-ELU+p1;qDS)UWoCISqZXAJ+*QqAJQ8m`I;I+6kC{@O2CSCw0ErOTApBA3F
z;wM*#dS|GJ^$Jr>Ho!|T@1*d;!$&NOl~?Yga(rlS0q(o9_b;9U0(b=aj_}}>Ep-mE
zcn1Kvz7@-husTW@cG031O?X!QCHOwoY&fO_q%AwwuGW}3CFYgpoMR_g>aDf|RUkQo
z7#h$bM-_sjlte#pqZR@i>AT8ti-ciJ$QmmmnJs1h-3xM|a{&NVxey$`bNm-lR0cH{
z@AN+NCZn`*uiQL^sK%SoY7Ts@mc3ZSXF#k#_8NJx9SyAsS2KYZg!QJw@u~&@qMY!_
zo+D}|;9*EOyhPYL@U=GPyWkUpO-=K-jzbfvxjz{C1fuFmn;dEQ)N~+^zMUhkEDZ+l
z#)kc)Q8F^&beoXDC6EsZSv%`szkjE`NP&4dBSNVo>Z{&-6YlowJ^;9ruFV$M?a+6N
zXU8$$;5-yq+GyyYo*NX;es7I}s6__hWR+;MMu~!@YPR|;akJ%EF_Gluk$LD490oI5
z$lS^vOsG2oVU@dg0*Gh!)lJ#dNSxI^m<kCnsP932S2Brd7YLjQOUiiS+9?)Pqp)2Y
zWW+UVih+}pgmFMa97&NI6ZzOrw{>E8&skjY8PP*xF;(wm9A{&Ax|zcy@XdKkoG<81
zPmKe3t}{L&zj=y*vPn(t>wqp}n@cu8JN0cCF9dLkHP$6((F-V@@>%S5^X`e4B&c%x
zhSaa5yy59&pZl}w6xOMEoqfBX5(>Ko&A@IqRjvTgF?M5*)zHBoP?5ww8hDt2aZBj;
z2wf))B}nE=9got+Vq2n10-+Nzl|mc4;+$Aj&(^9Bj&KGejNd(fHFR_FF6=xxr4pe1
z9cD5yG8n6MISz;lBwUuifVEAIvh%!><y&Fy#u%}CS6}x5z@2pc?9T&V_iaom-OM@P
z=5Y)<MlNR?#f$7<T#$F-79~bT!k9ZCB`q5ocd}Ik*9LT9v7G`G!SBuqhzriU_Tc~7
z9&51d#XSty={jJ=GVKA~fE8NztM%C;j^#UY?$+u7NyJzXbIz9Io){Q`y^it3gDZ4N
zN~~JD6DLRl1DT(DuES<aF=?NZu1s+_8kryRuN&>nIAtgNwEH%=ITAVGFgaa82udn^
z(YoPV4???_+kiIbbW*w#670CDZ!2TRjFCG4CF^a&4dCiwu^1Cludua4j_1Ui%Z|+`
z(!(=nTQyJnN3k=6U?m!5oqw8>KG*6wtC;N?Z3hbj$V$Xv1UlC5GS`ES3CLrIkvdSS
z=kwLuP=D6Sb$KWStHM#p0EVLBpf{*1oE-iA98z@Qdwy$az{bWtr=lG(W%t_1baBgt
z<2^YyVFfZ5qTMq#1Jx6*-a~|mM@NtSHzTb*rOX-IalpND-3I`7;I-Xuj*#;yhOJpT
zipDXK&E`_{tE@dvN9a;HLX~%YNio_e)YfzlMwQDs!x8!eURcRzn)R&#6skvU;n55i
zDsU<0fm@;G?~VS4Xek8DFt@J^RF^Ul9W0t^u%*2PF&=twgG9x(s_8<VVsJW;fJ9F{
z(_^(s;-55{IQp=wGw#nh#{(0sFm~4W#Hx=VpiT8l)bwK#En0;oyVR(&0<f8*YJJOm
zlBYY=k<LLOwLF}uYyp7FE(ehcCD{g$RLglJJ2;YOdPHbWop_}p<DawiJweYvMhafr
zkDHRfaxBz$EATf>e|q4egstCYln{1DTV0ZU!m#cN-Cdy|@d~lDNx-rv9G)M6F=nK&
z^ue~Z6n9_T`u0mK@Ssl>+)y;E(rA^KKg%<i1K|@&TLR|*jEBJhh!>SoOev=VFgs{1
z00k8-l6Qc}!b{Bv0`r(yCwSHlyPK~20N{?gz74>ZR;$~miSi1(tDnn}7J~!jQy7Cf
zYX{XvvvtdAMWsYIy-gTL5mYq~ygT$OC2v(!xS*fX0S;TM5v0^>ZfU6GiK<&%q-S_V
zn}#)SH=TK-vort`Vl>x3%18&xV!4Sxs5+n<f%8|kB{jg{9n^kL*kdH%xf>m}LyfVh
z?~c*(-pMYXi6}H>V2bK2LQVzbBvYdMDhOA#=A4>$jtBo(Xi|*+h5^lU%x$;a-Ldi^
zgNxfbQ9T7vXV#*x&3{0WR*6b39E?-UDndQHKSARZqSgpMLL>G(H;8P;-&^Ncv|(2N
z1RPZyGdd(4tWGFbvGZPmP{Q|zva4T~p<C;eu(`P?{*_e9DEp;KLUkrwzBuBc>x0|s
zaszGRfC3Lp-8se!(jOUhYoCx`8S;?PO-c|uwrI)Bmhw4G`b|}C@ovyQ7}nI(zRa1B
zN0*{|Vi3%%F?LZ)4(Kp2P@gjHk?TGHxTCH^0B^-+ce3mHewQ#-c}-5URY~oFl}xr2
zSF2^sb7pEeXAKbJsZS<sw{^KVi%n0-v?eA3ur3$-=j?Uu-ko=-%?nU3{@gWZ4YPHv
zElv`Q%;w_uw^+Lvbhr<uRFZrO@S&31XaD>T-~oA%k+j01+@Bd3Ipg`;3EQy))%-#}
zgQF$cu|ANxDLHgaKv?LfsBE8PNU2AG;<2Y*yHlJ*HTeW32xOd)es&I{ERBLS@S$U2
z@lFu{N`#zKRaDFzHeX@=qw-Wq0wjrCoRt~&@IClN=#Ldp@(Qgrt&80}alUwpa(J6j
zPMjRn@EMuog)>6`LP4kMvC#<roWX<4cU&U_6OM286`0v+8&i~$eKFzMm5fJUxI@V=
z*22ox+f?{ZfugQOcKkr<0h+7bpj<@Fdm{EXXuu+S9Da)X6%%x+$s>353@_WfJ2ofg
z<g!4Ugqo2$ZX#)J+5zycOL7X}Ox$$WT=xOM9d-Q;06)#V9mmDq{*J)RJjSgn$Gzp(
zWQ)}<qGqviRvChid^};bO*OTsxdH1R?xFc!hQ&=@ICwR|^9@ncR}sK-QPIwWAura}
zy|vzS?yQq!-24V{f*kIbU`REg>WRG(SnLm2c01@HOOGa;bu2L!M@NL+kaX|W=Yc6(
z2gwO@mp8p}XmC3ga-YdBiJIpcMK<S7Wo{iXh<o5NL<2l+4g|x8&IJM+)6_*kt{>BJ
z4kMKUOqqz0YTPU7897Pwm>4)*O8mCx3=eu7(9zfV{><}P<lWlsK$phr5`qY1Vtn)M
z->wODNpQ1%9G}P##ta@Se*}OH?6||zH<rj*0{*BD+q?`6!fqg3xj5p{hlUy~+H|aa
zFXoq{ZR$|uDF>V;bX7L+{w9B-&+%x$5v@Bw&L?{-px!ZNd!FI~<r=@kOrTV~jqSY3
z`^a-ZoL>fzOBE~bQt~V4uD<RAfIH_R;O_!pI(Pme?=Sa{z~e4+MzlK3)RiT|6!YuV
zyQ2QC!gt8PM?aRZ-Xw5pE1$F|ql#1k*ZNPEh}pNXiW?d$8`>LlC(kH6e}il@a3c!b
z=DxZ_8ymmz6vj&fmZ~Dm8Q5QdIs%P3xH0nvI5^zl>iLZm1KNk?3|x6;GnCAvnvuuV
z9GSZR!vH5bCX7r#Kz8(C-8`8dE7PNR;w5t1HpOS*2tP+Gp6f*<0lRnzQP!l;24;zq
z5uyrk4Ok;!90{4ZXn4wM2#bI(`k9f4vA1slU(|pZv+AO93)SRg{g~+~?B=i%TcDmQ
z%y1R}M%|fB8pEqfZF{ZEnCL}8p>vIpX6)5c%@XvQ3UK<^bNd)MBT4DpiWR*28n?jV
zLB^F!qG)+;yGD7&#?3(zSSb&V`qmvM4oSnb4+2i6fK^W_I9F47g+sl5j$oe3QqKT2
zMgkiD!R!=0F-mr6a%BuSdNmx$bt{5xewA$q=u*Gv(A_gNbnXLyJL4jJ`IiG<^iKiY
zz@>{X$p`xfPZN!s>Kkk1RTblu!7gp9C>d_Vp!_ug*fH?&Pxe~1&L_r-aDde?pNKf}
zi<tv<kaV6?6x{%gX(XGojN}7vk&zP)l@P6AM^0z}jes*Pty?F=r7%jLfG#0dK_VpO
z4dL>+5l>uOqhn|-fB-s3asV*U0VCxS(1tX3N>V3r`jr8@iRD-ofkaz77YA8sVQI*F
zQ>uuYJ#*fcPiV$7vB2U~ggIlOtNYR+mjFtg5T|--#ZF*m5Hg5HFfy1kz?r2!Gl9{I
z=+&h4u3yH4ru03Fu_=+DE!o(Kz2b4g-}r6{T&Fa06WDAwX=r=^AvKdHV7yc@Q^^Em
zYcT`hT&&q`0zQ6g2}VYu0U@=vvvS8BBP|GvgSZ^#>VF6^f-x@KKyD2xAG>H@rC0Pk
z&81`TBngzPAj#+GZ^<Pfo{50W)kEUi^1zWYh(`d#iAR7(Fh&5`Vv7kO-FV{*QVI~#
z*!9arN>VxO?!WE>fIH<nJq5<609@sV9(^)*{qiZ!!zuDea=b5I8W;t@1eB?UsS(Z$
zWF*`^SzyQ=sBd<(!(w#G-Cy3w*Ym>iofrPmBLSEIHb*V#=Myl{IwM3bHz`a%l`k&t
z5O^yBD$Fo4&~?Dx63Fg&88h<$zP!K16E9d>Zg~@VurRvPr>+Ml>KVht73#vPJrTL-
zthac~<)XCm?qYcBxAv>esW7SLGI?t=vFx%#x6I=h48`KpATUXmB1S5lOWF^YrcQfs
zIbq@Tvhs@DSb4cmz{SH{q%XttlE2A6=V2(f9uU_H@zQvD`u${S$xy(An0~F9M=s(u
zv&@?rXtuK0f4&=`g==J<nSmY{KzROWiIL+tNE|MeKgW?kl#!^G%?%SU8K4y$5-`<z
zt|G?si&$Gz@15sCcB!gis&)#ZqWR#3o6(P}MPC*9Tyip@z(7FmNKR=q$BWtcAsSBA
z@54G5NW@45J=`PLeE@K0T#O(7VaAXBB=E-9(WO_tk~8Oz4#Vzb-0kWOu2L7;z#CIa
zroZ$nGYWDkAd+*3VIZ|I+>@b80H%6N4J0%Be55dua~rxSU~037sqzrx!Hvf&eiiIy
zp@O_4^;0NQ=!+m!i;x6GD0Qg>0%oWpqXgnibg&$8?SVCCaU(iHunRWe40NfKBptV8
zfnF9F*(eZGFa(%LG3f-6<{B#?N=e+p&dL_r_(DEW@gfLsd6%Uh;P@SjUTQ(07yA*=
za8MS0YFGuYwxWEKz?ljM`z?(sp!F$cbRBT*5~EA-><OOq&FEK1CYHW~gO#TUJmv37
z_i1=VbI$%O50C$d{9=rKa3@+F(XBH~Kpuwb6>({e>u_>TI9~V2waQ`govqCz0x)Lu
z{RkSz%4clr4-JU(V9JlZDsq29ab~oJ@ZC**PMJS7(R9gs?qZo!yQ#1Tl>o^ctEL8-
zKmg}d3U)d~Y3=*u1~h3wrd)7L9>-ngJmMa??gM~3?P3PM;pKU|+dRv8So5&8Y-r?v
zh;`U1!I)i71eP$d>|Sk-WsSRqA3dtD>|PFCgd<J<p143IbCx`(XU47R*%NDkSk_f&
zI5(;N^ln<j)v5yBgAFIxTm>=}Yy{BZ9yt39g+<XW5^#8NOT(_obf(ReDE3_Tzlj-G
zokEX<#kh!epfu5~el{b<bJfiz30vd~0V&>;mL^)@WA~fR_H*czRzMH)bdMc(gLP?e
zO+WiB1}cf%s6<%F7Zz(`2`IXb6#yvDwfPq0;p|7-DhKZuB6H9*N}uEZ+*=w2sX*JK
zaG`Hd@3Y<)-!2D$K&293O+!h3zWSorw%Y~J>6!Mrq}?VU5&A^9aK2jqVlBIM74%=5
zc~bevt((e^hG!d^TCjj;-^TZ2=j`b$_L04OMFcKmp==wCW8GD8a>2_h0)|~e9_NZz
zaqPRSE%H91C=HqOmQuQBG6CHO0C(2K___D+-~R0{<Lz#JoCsUa8z*n4XNYx0xac2a
z>H0(}ALdNxdtlfRp8h1&y=pjjuU|w6i=X`a8v`%)DK2G8QCmF$5&-6uaj;BXVNMI0
zf?L-ld5$3ZLR;|yH$Z%g>GFoIW;g?vs(>h#yw7RUF|a($7>4A=V4~W|L!?v!l5gEk
zb=$fT_kqS}=FB`K@fi-&VyZ|f?0(FH4No7c`^{zOaU!)Mo`1$)A?uN4yo;RBTG`X_
zM}wGAyesm8V8_BD+X-DFzIdUqvwv;iN#Tp+dLjy%njVG^Tmc=|9)~sv+CTSb*!j{2
z+2%xJQznxV`WI%adV;u?0(K-TywaELyb%dVB-<#F0V;Fu^@NA6F}e)I6gIx&1{^2p
zmvsqKT%Sts39_BVf{_=TN3+Fe4ZxgpK$WQ|l>j+=<=*rq0h>)<wn3656Dnxk-eX-6
z`m^z9{VbR4Q)3t0Y<Kr{9{}8;S01ol^vf;s7OizH*K}b}^Nk^A5S5a^9b>a0eB>hu
z15?pjaNdCWd|B5Vgqu`XlMf^cUu3{EkxwiAy_cc!;kvy-ZY6t*Nj`;O&_DEkA|R3X
zNO+5@7?2rsuqaXJx%87jB|c!xSRQQ9)q25{d~P(cyoy*!2^a>ZXP+gExshb*+=k|p
zZ%m`uJ2iDMk!gO2IwNW=OF<t;C(kop!?Uw+$h}ryZ7&W^0PTQNb`Es~&x<I1-<l4Y
zL6pE_GUy|qkD5*u97_j#u_FX_TQNQ=!_6@StBC2?cnib~ZBdi6<O4r`3S1ZUIO|Wp
z)fVXE=1v!q`v}|0cm8ZE6VL<WkU*S}x~yAH(vL)3_WZ#(+-JP#(Jd0W_!adkwc0s`
zf7*2O3?C9Em&~`;&=s83h7x;v``DA(gTPxn`wYOKVW{_8oKyg?iLhSv7>5po++cE>
zG{NDmm&TljOvIdW&KbB50PbJE$=CTyS9gc!4o?X~R1fS0h*@MnT{tuAR2_np!Cl7b
zcEm@XN*J;zrZY?*?_KqN>2UUHTF6HFLiPKYiQa2(b8G8&txRb=yehC1Igopf!k@F2
znRjW5z|I-8OrT{4lCr>Z{(K7@?r(6=ZL9Y*M#$^$wXM}U;r$<6U>FNn2q|_oqS=J4
zrwKVhFaNhZ?1&RfFrBZHUL)>RaZ#j?2L#@d^0fB!X(Qf!Jpy_4<UG7_okp{_7GW|g
zjJpm@3FWNT0ANRi!M#D~#-KFd(uFO$S{HyEs50g07l4DBvWM-*?6FVlQV?Umjg3%R
zwZUtS7ac(<tci%9xVEDOhJv+S+Z%H^qFT2nxGVI-9$~dBd)teCgsAc?K%kCi7!vjt
zj3-{WK~IC4?Qv>dDRBo7CIOpZbAb5N#4M1x@&iSxw6&0QZO(cRSou@rM|_t3mnBPL
zovRQ&Bk$-5t8GFa6H+p3o*NzssMz<r-b`S0l#$2Xu*>&@0PkPFc^84N(zWX^+#Q}f
zd<K+9vp3^y!BsaC1S26-z635aVZBXw>gffTlL_cX_Q^HzPByM)W+!ADD^gpSxaVm4
znHL7F>)czdwaS?p$`X<80_{0kG5#H4-OFE@L3=%DxrFR(>XSRh0~bbIJ;)X$=qSKy
zb(b-%cZ839k}zZ&3wzlTq`W938z1WtHkT;Kdp}xID(yn)6{z(E#7cqka5A1T!`5v9
z%<1&tCGuLdMJKL{1k2h;8m2C_r2+0Sri5I>+=*C|6erO_31B9qj&SKJ&~>6A#B7wf
z4>z7X+a<?)o)?w)ZdmPtYrF%qli+`w^PWT?W`K;%g(f;w22l&$2$+)PmlJU7)&kpI
zDwe&zOwRZho*YJ?Ul1OA5J+9r!tDCxpO-#q^{*CmlUVD1T_RZh6Gm{!$~@=~z(0tv
z3htT!0VXkYYCm^l#WV&gBhi7?CY9t|fSy8_V!G+)=Dk4OI)fn5S<bo}uloSt4!mCR
zZI9#fgV(lQ*L{$4-o;=)5@rOvOH<Q}vUvi`mkXc>V$Q&j5}v=^Axp6gxmN{hxqrHp
z-6EM9JJ5wJ3qA-+QOT`fq)(+j=5>p>1%p=tjWr=IVPI|;0qbW5EjrNtQj02)Sd2Tu
zqgS_h;k6xdrWw5(Bk70CxN)=Y&CXajR)A!xI5~FAy<`Res?e4D#SuOOs2m-=p&VWx
zloI(zVlNx>*@bHcOHl>8czT$TQ^K$V^68FnI)K*zV;?DXpi%g*Xp%%Ktc%(i3uo`0
zFRtyDH7s!tf=*YU5KwIdFRUIKQrCE(wmUBlpzw>ihOH;u^kvdXX~s^=K&RI#=#^4`
z_1huO0>2ExQ=eR7z3wdSaP5N~!vyjOq{KM5=qe;Oo}5YJGFXCo7RaybW^66VJhnzV
z4}m74)!F^?RY_~R*?q6g)_cYg!FwscYUN?ZdP5k;PADINSTJaue3P*SQZeT|Y>06`
z2=M;(n|HnZsU@yI@X%_rS-(Gzyv=zcLF!-5`ghD66|~+A&Sfp7K4ZHD#z6qUR1;`~
zn@iv}wQYEI0hMN0eShZ6MN~{0fi4Tr(wWBgQV^mO+iGH|3IL*}Ti!Zg8xwP>F~7eo
zR=!Y|7}ybBaAk+<S2xImS^5)Ufm-Y~F|RhM)E1EAYAQ&4e}V)G@(~pz{5zGkA9C}d
zku?fk$t0*%{}>bD?b5qU-9Ifr3B2at=XjC<8V4*Mzl7!Mo<R5Fhd~cs24B7aI)4eD
z^;y8fS9i2M?kFWfN(3TiN=13~J!9N<=sU*pTn2V*3Mn|*T`-uuK6uHdxD{=;<Nqcs
zUE(&25(#OC0rf(8YZtPPq=A{~)E9Z6Ava{6oTven0KkuY`~atGDy4w^@j-bdQArv^
z%-y0o5@(Y_!4nGx>tcVjeuEksp4sY+)3oGaV_lt9+Rv%a(Q<5i@FqYrPA(6*dMgmT
zSe{W&*FAP4N>U(V3lL?SkEyxS(6cxIc-U=@x-@QZk6iZwz}Z(Lp?}LR{=OghQ}~j%
zzGJsJU40_wahu1{gpKgJH@Czs2X2H5xk5rF7`mRZU3YwP+<`TyIR;Q!>*iLS62fIK
z15|KI^)_3~4M}T9*ex=T`rEzhi8TiVVIBmLm&wi&D}UNvr|$WBi|b%dWNx(-5_lvW
z9A+F`W(>RD8{|rQ5#G!IQlfDra7Qj&T{<Bye+QUUr}|Q-LOYSGvBXle2;C=bpqRhY
zxtJqu>>g8Sji;y1*W6Zue+&Co2r7s<Gcb<mFCSp>=oR!YeHe?+dNCHSdkl-q=keuV
zM*PSA$T6-R0_z(cPLB!O9Z?<<#$Cedc89di_=+z(!DEl@fDN<fw{{#_)Jndt{m>+Q
z5X?-f*n*PPIE=u2ttZ>wDv@Hzeden<rZa#jW*XD!tH5;UwwvoI1R??_;FCA@u^P(e
zcR0}Dl;=1UDUdo%Oc9yLEgp&Sh+xtT0-s1Ju$CItKJLTVE;v)_*jW21%;GF_FDKA=
z*>o<d@i1f~rRQ1cM-LqD7UeXhyHNl+v$dC9A2ljay>E=njB(^G^Rl+~(cfy_@M*v9
z#+=3xE}s24z5aEt!~Vem-u<f`PS1ZF_{ay^XFk>SDeq$jUHNUV!OaW%c<kptOy>^H
z<74L^=A-vM0i50jUb6vCeg*iA4+Hog0sH}=^#`AM{WW~^@BWGW!pC2KwAf+C;|^FZ
zgu|Wv-}r0i%rnV*t-(f&eo44>yQim~N_gaQ(TXt`tR<ycb!vH0l)t)^o5gN=oaMxQ
z?WRNYVzHlrwS00Jk&D5yk}sr?oVfAZ>6F~yeoWF1GwA#hHB!hD^Nm14#{T62Je25a
z-Chn>a<+Z}r5I42Gu533!MRW;|CfX<E{MZhfjYv()&>)%Bab{`$p)SM>MV87M@-YD
zMohuDRl3>-wQY)Y&RqWOwnbs38nv|<`Ql=QZ}~kPUi8w8fBfBh^eex*;BidgT-+7=
zmlM9=3s(5U-*Foc9_+wJn3Qpkt|6nBd6b-2L!;qMxW_H4GMI+y&8t{}8RqB&fpC~E
zOV20aGcsUID8OkL?N$kXtaJF>@e*5R>?4EKma9A?Ds4<ybR&{HRM(mu1)c8;>zJe*
zZwz^)!29huCD>JhE+-W<1yFh#NjG$j%DrUX$Y>^%pS2R;WEd69a7wtf+QW8?lfYE#
za0+i|Z@g#6&1D91DO!<tT#pLjZ{lvh?lu7M?~Awyj{)y`_q+M8|2Ka!J^t&TiIZzb
zboB8L(la0XAnm1t{=(tKbBnZho_V|sqVq&p=5gH5yWRdc?h-NbqVLDF?01W<-*8T=
z5jfiJhMU87cl3rger$8CTaVX<OL*|{>v-q|m-D4py(0hA&ppLJ4_rSa-2BkgkJuVa
zv)4}m03LYofz|l*t<%-GLFPlRc5UH?{bWJT@fesY;ZkS~9gTSU8N&O2qsJRR!<$N`
zpMyMgm$`<U!kXe`U=xg{1pK(Y(w>=J>qb<l-cnUlPL!j2kI&X80<ZoZk2*FlA2V>c
z2kuhQsntqJJ4Uxoc;vwo9HxOOQ!QOr4ZA7;nHf0~GLN;!KrK;Py&<Y2MPQ!giiNvT
zuI!FRw#?JIY}D((=Kf}y3P*U}ksn@2Iw7w|(;}-lacZ=$RulVoh?m8`V$3o&!e+qv
z9{8Pa+2M0PYlY{Y2CYtetT!bP@XA%-`okF)7aQO-s|!Akr=gp8A6iDHcKyV!LL5d&
zt?bLgn)0+Gi*R8n${3MC)$0(`;R3Q!>_ek-uFWSUZxJut5mswLCOI*Y%U$y7ssK}B
zT)8xq<Vj<PQdGiwiK2+2rf2fI0tQFA0urb98_;qm3mStViopnCr|)<7>7&&c$zzEv
z4O3g^ix`|TZm$zI%ve%Z_bK^W>SVx~s?2DmL?Qh^%tI|w0RVpycl&j>0RVsT^v}Wq
z|HJ?EGwJ*P#rN!g^nLH&|L_0aFYH~p_Mr#&4-Q{>a(epY>9aR3J$>}ygE8le47%8L
zi>rO#T}VXxM05b8eK03x9*Ho5umkftGp~kWxHar{&oT4uuIo?t4-VFSe{*}|;NYXj
zo74B4zV}Bz^5kn4Cog#972E4CdDZ%R{`>z|$>WRf0PyW}_>vb<diq%$A0PjFjqUpN
z2iLc6pWZxKxm*AupPB_l;Y<0Xb&!}9{rqu{k3PKsI%|41M|s$nWNXI>K{0AgDOH6<
zCMqCUzAYL;$qmFT55?Zqx{ip({i<2b8cTPAJElrci|ZhlWFiMkV9|re9e@N%jJ#&h
zdc-TASmE-y5w`}}-)NE|5zr+djS1%u2P7-orywAhDFJ0s{3rmGz~9a~YkaV5*6f^d
zsh3m4q8!zn*17}s4ojoUekx}ghIw+ddk!43Q=uA(T>v8y0V5+Fk9c4);DN^pj9ujj
zM#o_6n6PEE)|nE{`NifzW~7Sgc3)MqMdx;uwQ-RkxUXma_WfYT*PeFlna8!EZs*K3
ziqF;{*SH)W3FEr0OUJfksv=z^!Xq!t*k6t%uZ4H52OmdES3wfq`ls;IC)hmG*`Z+6
z^KL`3>GZ@Nxz~%7FLi*pmI9suF4DIiIN2raa>7E%>{p5B?O?FfzbiCIU=T4gk9+7m
zLGJ47ZUzA1`a|FKcl!6e_gf$Q_(wnV;Q#$Eeb>YN^5C;iPS>x$b?fNr$DVrX{BqI%
z^$(5!0Du5VL_t(vPhEd)%-z9|4+v>Nln4X$yv=exhJe&_Ilj$QD{<9>T$w2ij73Hs
zbK3EU?I~x%X1sCh<kmRuK0)9c7tS5t<l)zT?V}&~<)41!#c%!K_3IDadic?oJ^dx$
z`SII-`SZVy|Jh&pzu_%^`cql|c3rr7^)~1uAIanR2061wVIjt5qF0<JU#MP5rN+qd
zQ35(DR)Lpot)N#NFtca~>UK9_>B^0gi9{2Y&do5vao(dK4aDV5t{%BrR^=D{bf!2+
zyvGxafSi$*9n$^+INE{$<aNfd0~Qw_#H(I+0aq_)dj7c%%Y)(}NKD9#a=Ky!PHy#h
z`6C(M{0%Fd-(%1zPx=t2#y-$oivhsR_>M#TfJ1?`_={Sljnx+W;GHou?N=AAdSXIf
zr@fl@X^FJ1eIa|Fs(<1zmjJ*!0(MzNZ}l`uKBu5)y||WQKe0m&<gvY16{)_|dx_Zi
zGvZgJZ-_(T_`K=Y*#*@u($Lr1Vav>&GdPRKL%Ku-01OGd?YLhET=WKl9qa7~c;cZE
z2g|~vJ_R!>{mb%o;Ekd28xv1}j;+cK8E|VdH$#*nUSaz#H18g)d}De0B)z#q8S;9G
z-)S5@dS4=JhXuy!CJ;F$$%6zek^9cWH=m#iT%f~frvU%G<oKO@-E{!q?QeM!SAP6`
z_+Oam?eF~delzeRH=cR=Grs@3|K^KR*S%%E8QyTR9xi6A&r@2S=l)7cdkf@#fz&Ut
zNFDc-fGpcUbwyRCRyUieT4E3vOU2lbOGrHtqi4<!&~Ep@IBsyXUGvd1w^q#K?_G51
zl%Ia?lTSbM?2rAz@Bf)!eEfwk{Lr7i_($LS1>eHY|JdL8AO2m*Bxt#J@%hu!)A#4`
zAZJEOvd^sxj?K*mL_|Ju<<?*<Dppsw$JlKXk4V(>=zy~m+}`J>N*UT-a5$)7bk?kT
z*>u&pDD6gpGxP`^JIbTF?DY3wUCK|NX^m`QyYIuXt?(Y{Cxa7}ZGh*G!8~Hjz~bdE
zK>y?;cxc!07r$*qH@<HVPd(QmbtSP#&cHALhd_A00GH2?c=PA3@dv(bg}1+DgMK3d
z)x96S|8DTs1q64t?_Yb&f8t-Be&;<h)At&<GFI}bUs(Gxbx6pB)oHDB@8d5_i}9pi
z)-4Z2j1FM~$>l1T6q0Fio&pXJI$f{lx&(VBC^G-E5<rzl1${PeO&=%Nlj2;o^V{;Z
ztk-b_a&{%TD^GRcVV5v&YH}O4^`^^^QL|A3FMK#-Zwc_J^TIfE<1K76_8TuxSab6R
zux!m~A*TSA$SHp%oReMi9vuM10T{$ly&*F&wuOKqFEJ5@p;Ipg)r>*GpW%TB39uyN
z8MjXII1E%O0^SqX-39>o@{?b={I&6Y7vAvZuYJQa&wTPNtJUT;DJ?#GyTdh3i#=Lg
z>gmD(mWw?mN=S)~(TKsBiI9WE)I_eS?5K&{r1+fZ8Ir^t+!G}v03G+sC73Q$Cdr3+
z91k#T`Dl0gqCBo%->2<n{ecgCcpQH1C(oZh`1x1A>1%&{v&kR)%-6o=^nd;Pe{nZA
z*sB+=ovc@zr$CF5Id{tGs>A>|c4ZZwCb+|IWz!5GV6kMJ923^-4(HLnzFF9<LTP14
zD^MG&PH%F}PK-})X{mgnC@`8}IKP(~EVi(q&Ek>#2t`m+c&`Zbboo5CzwsQ<B`ltN
z2#Y5k0Crnk>N0)je=*>5-?YUqzi)w)+X=&t!NfRsvBQgBvc(sC-VQH(U_iHFU=%BB
zj$qBO8;?t{Y-g-mv0D7VC&pAm+mIEJJl{6}1k|nvV|q7nlfbU<I-Bo_vJIo4X+NDQ
z$4)}Gu359-8q-tREF_z5_+^3s(DJ8_U4M^AgWXc}^!6Y?X(raHOsG5d8oVw(o`<O9
z02ni<cWaOs=z!H}qU~v4vP}k_Aq52ENTAHP`~YLIFj|uW(?~yyfruUr52+$RcciSt
z^2*qpRaHhgu;f{woMM;)S~->EGY;x)iAs>@nBzl2;#?Iz5qL~CQDW+|3mnvGB7LuC
z4apP105T7|ZjtYqOo0E10RR*5e*o}Tf%#RbpTF~W{qgg^{wu%m*w6p;&wbv}(dj!@
z>)mTJ^)DXiaM3R>BJE#5-}RI_v6eEJN2+JKltB%+JB!kpL_v7DUWpwfIe18{M)M&9
zT#oA{B&5El)GwI#4~d!g^0?hwZ&$A#$D>zlZ?3=U*=Ila{)2;qU;l-l{i%QXn%Do1
zpLycRCqMfA|M+i&;DG<<U;obWd%pW0o{Za^IS=5pRA@?Je?6qmn4>e?00A)i9(ev~
zqFc8J=MUtTd9iNRM=-gH2gRQZ2s0-_&AGSXTx#_eCob%}NqcUr6CD~AfF?*%#o?wm
zfIWYIy+%g5dI9N052C+%4*f$H%U($>Hgaumi?8}p#yfxK4!Z%!L+SJ0axAq11_G}}
zE!XRF4M<isv2BCKkREvpI*d+~{1j~!D_LIWBlrDbLO*q0tF@xtX>3UaTm>ehQTk%_
zhrglkGVO1DW)5$HH{m%hHb;<Vszq6le<{1ya9q}nl9H@}Z7SU0Y{ASb5^$p3l<0GJ
z7AGh%r@ZvMIoXf{e|SD1qw7!<9EtK4nbd)9-RyC^>X15Xn`NFsCGGbJa3<`ZD_H=!
z5?Xo0)gbVopcH3zyy5xA)82bN^f&KDFn*R80P+kYgkWn$0cz`&A>R)Mr~`H*@*r{h
zp5LVTGMPNuXSUtX@E((};wEzfFf(x;DQ6y+neTf5{^Ktu;3k0g&wLJ`xZUaPU-9kd
zKKh{#zV_We_cLFzS`S}+x*4CK#rbRL;K8)mJH%es8G`1)mjNY7rV`|u|9@2S_ThYg
zL5$=XvmSP$*mDM>C;_J8XCO-G`Xy4oAl|>Q7>C_;-ke-tZC9VWdFJ+)o;$z?j!%B!
z2VVJE@BEPmAA00HKl}s#-R-{HV<N(5yy2^kc2D0p8OPl|x?YVj23&CuDZYWq<YvV=
z5UvPZBHTav@ea>EoABrpTxzmAA?j1B>d_(iHRjHPsbQ5cvC=)NW-rCKp|v+9nvRF>
zb=gj4sF?`iB7IscXP<1y=D%26DG~Obd<fKcz?i|Kvj>I|*kmLEmTr6`?tW*Pg3<J`
z8DIFAqOkG7mr5&{T+_{fSesN8j>1&5f{e78Dri-?laZ`FrRv<b!rAh!GQ?(X=Cq~*
zApT=!ntzw@h)>jn_!$#5Qk&*pVC}i_H;iJlsMFFaHIEtnds>f-w;P=z42}*z#^!1Z
zG*AK$xxBpZz>6B{J_59#@$7nm+owIcUQU~k^G1wd&R|Z+oIs0Q;dKKZ{T#ZfwBky2
z&I2#c!Xwwlr{;52@FHiX!g*#stzG5cjtV#$#}eq^Qgkyr{-UwS<5W{B=Q#fca6DW#
z5$9bzdEBL(i61<F;S2)Yeb;|70C4Wy1$@bu{C51tZ@eGB^h^GmvfSSGrQdS+nm2y=
zYoCAa*)LzMx9?n!i<hV6m4n6Qi_|Zdm2v8c3<uv-^@V71L&??SR1h<>{%&sWMsY%z
z%BvkOS)CxNOeaTn4D6bliYQUP*u!GE&zW-?wws4ewnq=1+`9dm#nJIMJontQKlB-I
z{OW)C#<%^RpM1lYef{lU`l0Xr=+n>K_}GxgYvpbA3@W?gz#$P&%s*p_59XGvUw-(L
z3p{-z0WU@YPI4k31melF<Ujzs{o?2xG%K5;7v&81t5@rDzuK(%HvA3l?Jgd|3lI(+
z0qoRo+eGPqA^^J~zziXaMb5h(dXv-T4kh(MaAUztmEXiQYHyudvEkX4Hcd0m(y<mz
zu(h5f<rsDQHzi@zqtVQz!S<HAuAeO;@zx@_`{vXPhuchHHt*r)>jtAvl@~>jAZtol
z*cuG6f^}1yo0jLyhZe`gpg^(0<C8^M)imEkCZPySeTS3vl2)69w5WM0JOH6u0h|ex
zse*(YJV+|dw9^5B#*PH<3`HCir$3IHX4rBLKg=v=%I@K*4Nw~2l^6;1t+a0GFQtGR
zFUNE-fjBpE!2$${GZT<kHy8H-z<>P3c<#BU(Dwm0;w@kMCk~$f@CTm!;0J#F>u=q>
z`Hmg$eJ1T+-`~4<iMoDS-BYC;6Y+$fh+8I5KU}a!rlKckNqbb(MHDw)P(nYMV?CgN
z2XX?Bc@)PR7Rv+1-XRUU3x}K4tyix%N3U3Y{HZUydE?fPJ^MfX&42LtqmSPlcAF1l
zIldN@h(aN%U|wiHJX#h5F>HBMfp_aD;pjL43j)?A=*W*q=)#EJX+CQeH!d{yd?Vun
zjc2W8FFAuGiLk-s6Gw#$SQL0GcqF@skI>Q-!a_4+j)^tsPBO3)qyn%EF!F>92%?80
z@5%l0CsA{Mq;{B!5D;el)Flv@*jv5wOs=xOor{2G+eM=v`#LP`PQom|sM4aqm-4=%
zXabtDd(L7%-!F0&<CJ6I8PWrP<w<ta9N($C5atjpeX|1ul83<nUo?>YdK3cAfEh`r
ztquhyP{Qi8$5u}VlWsLgg+!pFSXgvryRRe^Al)C2U|DG8>CbLmIWo@%b+!xIwi#l6
zr5V)F@I}bh*i3ODxXe@rb|Wa;o#X(z86X56d!&?1Mia;N=#z9*;AAZBJsJ!E`H7GJ
zHQX!Le=-1Ya&p4|=HL8;vj1QBYyT{L??3t5kA3JpKlzpG_3%xrEq^92uAg6?yM}JD
z03ic;oOjCsZV^>srJ1J8iX!h$o*w#zAww^6$rgqxB>7w(j-CL44B7*W8t{0e+?fYL
zBJ_(r?ibgQ^Ob&FpT6>RbL*v>-ObPAfqpD=x`c__b1DPPwza?Plz<^>CI<BkbUn7K
zlD3xJ{+#X?%YNY`X^poioz?Gzq>5CM;3AP=;ifQm(YT{<i&<vQS_=YHC8Y7ioV=m%
zKH_HIaQ>nhiA0W2t{*ej3_F1|KU1EY+}V43*iAXjch>YA$rg|(P>rg0bJGg%kOOUE
zvNkVjl|NBvWwNdUPq^++UO}OK4(p00-SBJ_(kuHs+1|KrWyYkzITjGm{;3w82dTF1
zSr@yLH|?vrX-5hra`E-?j*vGaD3@)%oD<S6@vW1dPIg_{>u-)BY6d<gT)B{OxL0!k
zBnHN_#_#19rgJF7bmoD99%mvs0H<qO6}|Tj(RAT?ne3DC_?-R1dkM%nSD+>IHiWB(
zyE1`?&XV2-Q0T@Z@2DU{4_rGhfQ<al{Og<dJpiAkivi&CzUW&I|H0q=>tA&9=JWsg
z@#*gEyu5m?zxWU>mIqbA)R+rhOhNr%BB(U!gjrL9{B)rQ>C3T0I@Q4*uwdPZ(2@o@
zbW_~q?TMQ3M-neVCL-dLI&|kQF&|v$cbnr^-8f#q411SSw|8J8(c_4Xk`$j?P=3y~
z;Zm@M0HhA+dcyJTgdr#N&LSbH5E!I@``ziFD0n?hU7f#>d93zDLwfyZaC2LQsgtej
zgv;C%xK0IO)*cp^7s8FD-72V7S%vfH(njO`@Z)k#7?b!8GFqTD!JK@CJw?j$BF$_(
za{S7>2E3520<TrpVm*a^uv6kbfJ@Kd+h?;0ds@?dW<NceowlChosGpVeA8B-RMwLt
zg){t;J%Heb<^nnmJR2W624SeDDeSX5FNl8PV<|l%b(2}_Oh$M00`RKGz}q!=Hz1D#
z#*xt-cC^Y%Z1NHZytclGp;76d7<l1>BQBpG!MlH#&ayF1taAN@;+(Yt&CKQo%nQ4O
zSfz&9X=ZJCI<@G8N=%OboLpPg1G5_l<1V4=TsH}jqSH1&7epyM6NPtioTPiF6fp3g
z1^^K7*#Q16|L#Bh=h6p${ymR>^rP?lnxosdzio@Xm-iPR@B01oRW1#U8;YGUpy(nL
z+e!4Fmv0_-dWG(di>l$p?Zad-0$!X=&+$?inU>`xj@AcceNu%cQoo*T4?hD)Ws3lm
zusFB?UL5X~xV6O0*>%wgXAO3&{RtMQ6Q)tl002Jl!4ge;IgM(bh2($UT5J_m*t>St
znu|nNS0WirB5+|eqCgsVQh!<jN$0GY0<QN9UE>5J(7?83yjAS9y&F2Y6uVKSiI=2p
zt3E50$8vp6E0KvsXo8bXyQpU+M2t6z&oKZb_8=(4hOVZvs-ghZJ$ujFg)r<GrSNBV
zWOU<eKvA4ouY{Y46L!%gH#Lp4duA@!Q>;!=*D=+vTjM;#9xWD89$=Sp!f2zCLiL0I
zQY+Eh8X)Rr4A#EVgTg%?%=!Bnz%C>89nuq5kwGX?#f&^`k<M>%>FPcX_W{m?L?tVp
z->U5DFE4z-fXkOqk1uiTZ(xyN>SOAGbG)k7J;i`kT{`5}tj$}<VFi?fQ(nGS5T~wu
zIF?hZ${Bz=UkbSCEtfVnYr=NZA*Hyb;bWL0cT(UViFIaVVq!{Nhp+tBH_`Y0?Vq_P
zfWU7x03hrwfXffzO^<zR|I<JCFW$5n@^{@@r!U0bL)VrESCRT2guy9V@5)E8ti}Dq
zJQWt@nNXffnZg-mwavPC95cz8SaohH(<6Y8V4GxnyBZ`;0hPbmQkjeF7a=K?R%A^v
z6Qxws6qQqVtvONOR$uE8x>tVnZY|AK++RD+_}O3H!;Rw(m(LSnaN|+%;1E@?%v^cj
ziFN5{;uLx7^lmc_miChC10kR&vc(xF;H?7RqQ^r);CT?}<D(NqtvISig+0+pWW4H>
zrs-u@3!oJl&9O0KaHsPp-@`MOwlO(0AXd$s>)Hi&g)XVLzz^K!j@UKQShq1<t0NN4
zH7DzV9Q~SpOiaX<?$!xv-pi2)Q)LoOJw#7e{aLMOIM%ls4h`ZIAa_=OgN}+|G0cHS
z=gcL;6agvKbwmV02OjtF;uj}=!2>7sq31gsTx4W0MyEXUj<H#dc=Yi#u3TndS5t0t
zwl(WyYUp!Vvwlgt1>opSUbE}EX$CLyvjIh=KUIdi%6u)b49|$b92u0@a=Lils(oCo
zmRPTVL>cP2B1HaTlVvhi5B><LWKl*!w_K$C6FCEP_g}x&<$xKR9lzsCU%UVO?O*$n
zo5!br`POFdE4%ZLT-!VUAW}y_-f5t_S~T_1X&|`?8A%@MvzY~5<bM@(OJ#qat97af
zljJ+sb7@R01~9Y&Tx>lo0k3e(N|ymOo-dey3bnXl!YKB~{e(ltuB*gs{m~bchcab+
z^b;LUSE(F(iyF@aIXAD>d2j$r1ZGgg%^0}(THEsiwXsB+F}F1kLW9&auF^Y9eq@Ls
zj3I*792=>jvB_e!TBy!>DT7=AR$_RDRc8ZJ9IvAhHT_aoGmGb>-bX$Vw9$&9Qy~Jn
zRln>A$iXUWN#O}i*(okJ2FtBMh#43?)3o#J`N}P7H{Nn<<h`f}Y+en(dFy+gE(*Sb
zmugB&T{U689PkQ5a|{tJi!*<nwOfNC6(&GA4KR$rb^whdXv28TYX<tpZ#==Z^NiK)
z9@|xqVMEx}f2-q!$6m0*TfcC?VV6s=oXg%AIx3i(-P|_VR6jDtpYonJ3gGW)iXGMO
z*l$-h%U)%WcwyVbV%0-yN3Z4cc-!f&$LTf!sisu+>)8ib3Mev<SSS~OOdw9^QqK=v
zxQu({`mOW;5CHxizw0|MzVB!L^_M;O{IlOVEU&+Daqf}S^{EuSD5YA}R}@l<&aCHP
zg?LLu_ug9zk<Gp2lEjDr5Br#y@RCcQVYkJ#P!X`}+}u98?V^&dJ9$e0JZgEg33^z^
ztzL>r-<%r@cI>6BxuRXVC9vBPb{l|GQ8LNXF%W@mPV`T1a<I44RDqVW8eCIm>AKH2
zJlhBj_B71aUiMo<o(Of$UE3z>t4p*M=;b}+t@cR_q$)gyw^fyW+!RFWIfk1k9ajAk
zWnrUq^2|JV0oGV``YJNd25ABqk~cJ<N=W3Cyi)HBAnMns&aYU67TDGjJ3h|g@n``$
zWFsY=XE*gF?Q`qFnY?;_(0*a_^jqW8s+_$-Z0`>`GFrlIdp=>1b-Y@$ZSe8{T-e{?
z+rRZDUh=XnzW)c#;otn*C2rsDz!=db#w%V8{K0QK#uvY31#CtK{td8+M=<8-wydK6
zUKcxSx>>UGv4&O{d_q_CD$J2Au9M;+$skJB7DbO%O2F~1!^yVy`aNL3&}|Zr83DxV
z@KOVch&xLBH~!!Me8$~#cV53006=H%OTOlhUj6l7{@HJQ=9y>y$hdg$mCN&wQ0h|M
z>o2n}4kdOoWxCatbcotSa88xad1{ULfFPd*Yr1OT;)%q1ZY6@-tCBrfib71c4~T<c
zSB2!g3YFVTVUxa&G_V1R;_X*2MV<Cmg=p5XPyCq~SS(7w!mVckerfi@KXZZFta7Y(
zPc(CrwC9z-a|f^}i0L%=y=kwYW_H1=Q7U&O-$*6LB=RZ@wf3JKR`4nv5>RS@!^S)>
z@I|o(jzr)n7qBHXY7@1X7NQ6^Md{>tCk*$Ru_}zBLSLrCDO9ji_U>M3*r(2O#{0z3
z3q*BLt{ql5<L%4S$ROi7Gxl<O*o=wm-{0R(OWTh*3!G)H!=U^_e&M?B&QRRb&&s_M
z&tjDy7JpDaGy1z;RvE(^#<}HyuXy`0KKHZN_{b-EtWG)rjMQa3cpZ503wKzovrCTF
znAv`w<u^9>c^JO8mSjA^E#=#EJR$~yPB~8}f?_}BC#sn-1~AAPlJ&v*I9E}yT6I`&
zdQg(nSjo-z6fm2d^hOsIryxz2{M~;2765=R!2|Dj1ztzv10VUdU;O4ze)5?=G%O!_
zVtMhAdS*H+!&MPXq5wIg?D6R3)N85=$ax52biPxpT1>`S_rztpIT_>ESJdzQTWv2j
zXBSmnTaz5);nkFaKxbuj??S6~MB`fU#vHYskv_F-=ohFc)^;5?>%Z#=yHmmkeyzvn
zy%AVcYlEDyv3C7JX%)Y;=|F%#9@q9!yXwz3+xQzfqH|!4@U#!r>O;GI?E0(6g{E*(
zM`APCn9yv0kW2sr;S_{C&<eEJV!RzP<W}Lh5j(~TtkTekB?Z)+Rqo$Qek%MCJ~sqW
z1Uj9Sr<5#B2j;TF_(B>k>RL0<X(mh7HPM2*7R1VW{*+d#A75OQah^Osijob%Z|&BC
z1orZT1*LhT4^=9a)N}gXq|e4L(vG^uXD<g5b^x{+FX%UT_+<llkt&HYcnjc!YhZD0
zlV>`u<1>TEdqd}pFCDM{NXB3f0Md>F5#`rZ-Z448=;ozO0z{D~2n-stNdv!pq(2?7
z-X*NJNdY`fT$^>}Y5tC~rX{VmHw2lGxtk02xO=ZpHvpK(IpBZi*PMIx#Sj1LFMZ=D
zpL*tx4$JG0?_YXhF{#D3RfRWGPV#rzQ-#j1oo24Km0CkQd85}?>iVpcN;Q?vup^8+
zU>pj9Oki}WfC80gnUFanqo&^>pz9g^66IKlM4O)x#8j?O1!UrGBFWvM<dZ%Jor7pa
z$FZ`u4)~O$e#uNudR5_kx*@#xeG6<y!jen~L_rlniM8!57U>Lm84>lO%7?1%DfUw4
zbD{)-00N|htb4oBf^wU+38t>HDvyaA)Ew!o#3YBpd;l1Gz~{U(>^gjw1I0X6@s27k
zgAc)*xfb)sc83BDZiwxrAP2sgS)j3#UU18#dw`~=A!e-O@R8g1ZFH^itMhEMXvrV>
z4WM&w5j50p2dL|G{&D6Rs`x!65B8OiG<}ucF!kkdvlyhsNx*62#%}6<h4rO-<IKpb
z5xmNkoRakB-=(X>+V#egx2fU@7xLp{*M|VA{h%GBo(u{g=M|aTW{Xp0yiHUB8hLQ*
z*>i#zXvA2pJFIr8$rk9QOZw4vUBD`IK4T8?d*u4G0f5IJf1J9m!zVxaNjg0}WxVz?
z39r72FFt+!@;Bb|Z{Km_#`Aw@TwZ@-@8TmQg3}gL{n@f?V~E+bcx6#<l4Dj}oWOkt
za0YlNdG0rBU|a(Sd%%^;Bla(C!JN?%aIoLu;(6fGg@khlK;M_PHXGpf5pe5>aIzY)
z8zkR)!g`%><5q{G(*#;(92_$Gz6OGI#p|ZPAe&o_CSV5U!V;!qr`%?(D*4^fg3XPq
zjs_NkiOfsUG`HFj-v5anJ4!%T=-BL0*sGic6_nt_8azYEc!VyIMb5RZM;qC_E1(u@
zXf~a?2Ox894^iMSsjAWPp_9<#O$KfVQsBYbYQU%5JZosp3y$z!a)7u><CrtQ^;|#&
zoq0JN%P5_rMM+_TWZlHWvfd&L9d)O3!i)r#X*%J5l~WPkb4PCO-MndEJRoj8Gc6$_
z%!Wwr8G<`RMl*9}N+}xr?Tx~3Y*V3AK69@&A+5Q694>v2jtZltvX?ZgCo{DiPQ5Rn
zU#VMUpg58zj0~-JqebyP1>$Tr(B>?0Ljs2>-Ex_>)uv=)8H4=GTmmDL^9aav3X62W
z$)?B2rU!RJI6=sel<hMAY)5n(wiT~P0%*}K?kNQDX#)UPuU^H&4?j$|Z{OzA(^KH_
z9<M)rUH`s!|M=T(-#-4XarxjY_b$D#5-&R?2dK6>>#9Osls@T!X^U`YE)LMt0W=cE
z(}c~6khhFSu8(-}lRI3#yv36*+2BpD-{OgvF_wEHdSY~`Lzf7BA|x6$%9=sg<%A*k
z$m0$<@4!gBUG?<Q4=?bu@7}|&yuZiE=@PeYboh-Ab$I@E!t#KD1%ngNFLKF4%|)1J
zR?`vyktk-i@Ki?FX>y34qiw<DtSq>^11t+Bta6Z(P_htnVw{|I$hiY|HMJ&@E#;uw
z;~s3Z$^ue@?~JaP9FGX;=h{sN0>$bG?{)V%{cG)*Md>uRkQx&c2d%Q?X4OaK6(yNi
zG4lrT^xU6}JZ2oQuS4)vw29Q9r$}bDR)g0?-I*MCr|Al!_lzdfXgH)oQT0_#w5ZRF
zjD~38@>X9E-8!G*`SbbOr{0qAOB?(c#!)>O;(nUUi#Mme$HEZJ)XI+;q)nl>#7ou(
z{g&kgmFDi)D`>*EnoUrSD*NuM@@%Q>QL~2lJMbEBHC;Xj486tdSFd$h@AE+3%b5um
z7!7PX3=p=sx{RBhzl4hQKaSvTlCI5>mvOq@!|AR^hpkplljGss0#V045)G*DD?l=*
zlxCRc-|1?(W3Nve0Qk^{K7@~b>|=a#asmMKs*_jJvmg1%&pA4}^=HQZ%4aVxzL2DV
zkF4n;bG@t3oi(PwQ}L2acy(bXFuI;FY!bF7gpPp+FAsRj+tzr=%eQ#-E7o}ZYd5%j
zna~qs(PeZQMcHKrc!0Q#@@S|NiOTxygaI;;h(H5g`S=EJd+RaA)L}RDc<SSXcl}b2
z4}RzXzwv<u-u3PUKKfLTVcj7UusC3Ji{gqO!6he-PiqTNY$S0r%GrDdd$pE=1(dl|
zmhF9TxF7?|1I9Q4>otJ$6f8xR4t1r5h;;UXO%!^w9;%S{)y3+K=2~kNRFtYdb6Dt?
z<s6#fkU7QXz@ix(Glca+@O_!F;-eC;mZ}ffbdSsl!l0|n2r?<=nvTLa);pLIh{6v5
z8i*P@PEL6HF|v_St#Kcb+s>1`!$7Ll$#nfvr6+=3EN>ffRPJu;qp`t*LTk>Udxgy5
z<pyj+5;4WGjdFHxiy^eAfX$838@v&f&dgE63A*PTd1>NhnmtxRGwn+o1~+FjN>7%S
zfY26@xSIlvn%8MiFHhT^TL3dBa70B%Aj$3>_4^@%hcR@el>`J}x9TxupzpG{YB0;l
z<fIoH1E|xXkdr&Qp9ygGx^d%%&ck>9*Z(vA`49fRR~(<L{^TxQ{QSL(k5lT3Pu`X=
zE6P_=hrQv6cnyn6vZ5vc<F3PQ#khQq@#L%5_?_=K#cN-8idR25;DIZQw9DX;Kx3I)
z+UBwytQwLPc&M(bec%k#ED%lrFcJfMskr-@7#Cj1c=Cxguvp>QTOB^|VZu`%U*bLQ
z+QSe1=m9?Q^geDpPe4DSKOBKRmslc~zq$xK-EXpi>zZp=ys?0T?jlQCH1Xz%ABG8w
z1>^WO;o~1AJp8Kpxs^rdg-8(8>eHL+kQZWA{HlP4MuaQUwim(+zpx`f&3-P<0!cH%
z(E%hGTsUv;wh$;-ixiuhC>R;8Fi#ZxJb7Mt9&R6%O*=`80R=PsI`Kx6@uzz?JDNJ{
z%KGEl(YBlw<y}f(r3cTfO;0||Zd<feoc7x2-zrEr<~?I>?RbOnBsF)leK*T5-nv(M
z`1NUXX6^c;#vaJ{tb657nsf-0w&J+wj!(A0gu@%6dw`;aEnX{B8UPJ=YM8;#j07t+
z=TF=C98KHi9*w6pqj_(qeWpf4h%=y?NSL^IO~&E@@UdQg9*F>Sz_@dwX97YRODoJ{
zGu>3`Kc+6V)!6Rp>o?;R0RPC3{?jYBo_pr^tvB?=i%XBCwA_Q_^Vhv&HX-9HcA2f{
zEw^^D1F6g45xhN4^uXbW&wbkozV>U^c-`yPc=+1L`!o>m06I?aN5(0^&hC0HC8vy?
zbz^{qP&W82ij0}Sxs)SLluMzFHE?|~;-Ob$;ME&^$y<)`pZ%U5zxuu<zVDx(!+YPm
zhhO_(k1cgr95B+NBopH7t!2OTW(1<Ag<EiD<CtL3%2v9M>JHLz31)oy*$%(_YdzlZ
z>Mauc*?`K{AfUrsm|)SWhfb*h0CVzWhVyglJyEVYiQ!Y=wt7W-(J1N0TK6fKBmJlu
zPjiFc*!Jh78P=ab9B<Le?Lk9N`>u4Fvtt}McH^Jq3Q(&|X4ug#3|g#j(pOsWsN;*^
zmVjADK0s5mG&=Cr^2!{~=-R>bM&SpBON-okCfs_Mp=-;#(Szms&|3M@tap<O03w1W
zCkyU>|DJZx&Xb_qd<|j)CJwiGn#={Rdim(Tq%#`wJm4lPOibhUpNidv;C_Ciwa#<n
zYL)NgB`{#(<uU-`hKU9S1_mu%Ob<DxCIB5HXXvSoribzE4nun5!{c!Rao=@!z0&vB
zr!xkCo`3r*@%p1z^iTcDFTUgUt&?w9Tzv6`y~7L0d6@W(CV(Ch{RO}+a;xV1V@lYr
zIvi%;x4rcgU-izL_~I{E<MIVYmjPa7;&B9Z#8g8(E$_RNq5y!g1nJdW+ZJt-olK=F
z1k1S)=42Ujs0xMZFJ&%G@($oU;yeKt9~|)F7p(DxpLdE6esqC<^}p@mCx7xhe)3)W
zI9~OjMMk$*%?2=#o6TM#!0qXqB5&#EscYq4#g(f7%kPI1@ciu#zy9F`G9@I=a1~PA
zB*45iD)(y5Lq>!08+*b9Yl=*kWK3pgn4q^kNqL{|ydSYYx<+<;BUIGrp9)3}tP#m)
zf2dMxc*k4v+8aH|>J&9ily<bjyyi58Rd_vAPz%q;`L98sAu)ziII7U%ICUOet2}Y_
zcstXLeP-`nSMWrK$Zswp%|AZDNizz}$9RN(yIb5giLg#2TBD6xaZs~iwQGrqnl{?W
zZ2BMA+YJ&zCl79%;?fsZj?yASp0EZ8tR{#N(-a(8y#>il?xxUZ;4om<0L&IO1^#h!
zAmHgN+~L{@@TtKoK2fATs76d}fe3lXD78^K_Yya2L_nhA`Ryc8SPR_9egx7>K_%Bo
zW)L%_-}2<Szq!|^?-amekK(z1^cV1%pZhmovEJZYY5##2FVA0N<}sN7cROiRy#QiD
zG;%o<R6#Bdw9FVbjBzvK)h}A(cmJ*xedSlK@aO~U;?_Sd_a`&?sqF7FN*z1^oI!j7
zjHk8jC72gL>gzonh$>k!12lq>L3spYi*opOtcw2tpmP9qg^4oCcVGZrjqf4w3fuv7
zaWUdGPmK7CZ`<JOzG97^{`muZ|Mwl>|M%1TxN);Xx1X_hE)!Epj9AuGrID?8AkdH9
z8sxC3+x4o{^#&>tMkJgZEkIpKVe4y($4s3RL`>}tlg2W7wI4y86l#)w1|uH`7O2Sz
zCkfml4Klb5jB6g7S}oqA#Ka;0y(s(OUI^B|w;b)$iE4KPYx>bz|19%}@DA@`h<Q%j
zc7iH{IuXItazKhj!I_q}ZC0<g$UX1z$n=1s(%#S2#M0NeEC0ekD<68`wqE@No7g7T
zINLmj62p^O33F#pI0u6tef#e4w>w2LtLOYHX1;UeoXJ3G)<*D!(o7>tFR%2c)_j9P
z8vdgImWmvSwlQhyyn6qHUl3(CdG52e{TkF0DDAjB=y0H*Qlw;v5xh~VAKASmt3dJ&
zR6l28@XqzXmQ)1X@-C*>wXiHRC}s3}%ljUHx$EcO{T{se3;x#m=RWb_ui0$*&5O$~
z0Emh6P*lX6_0lY8JMP2KB+xP|AZ$+vdwIa`{Gt>5m)~)OSAWKcgT%lo1H0T<GBC>$
zJ8)hDc?0ksI9&l2F9Y|FftF7I-NWGS3P5`Rmf)JGqO_3#>;S$EjL!k%CxPMP%)5^h
zh8v)K1H`9b>gw|g)cqnT2baJ;@Bq-rSO9q9$_9_WW8k-b&Whgko<01p|8yTe{jPob
z*s}{P&S&&{8Dl2Sp=O11q&RxXPyw+BB)zAfA%==4HOb4p{Q+=t)M2$IoJ&y=1mz|v
zmQ|?KiSdGcBIND$5k9c{&0D|zE2n4$CpxPKRVr|3x6XN!d4(j+XZ1eJpG$Vo)1T#6
zy()r=Fe}I44rZ{}em)qE0yt?5k-{$7TSkpl=dE9z5^nUBDOwI&7xB26c&-|qGM%~l
zV)fcIS9nJHOwRfa3a9}IaJd(h05-k=DqEc5ehn=K;nDz7r3M8(=CO_J3Hu{x+CrnW
zTNaAoD6rO)XcLX+Zk|c@G><Fjj4vEq7hVjCzupthzsG0-0B&76;?7zW(v7A(S$zfh
z=bK>#MKH7VU^tC!-Uz@bx&0kz_4<Q~*Cubf#!*yTbXZx86BCIJ2x)+9aUrI@_b~u>
z{q<=B0RQEm`2XO0zxRK9&1${+-L(Jk`EGdt&bzX%f+U4mrf2MJYf!LD7rMUP<B2O<
z{Aa)GCcf$SoZ_*|4BBO2XZM(OQ`sP|0jvS;fbK=$gI5E~SAh1O1b5fKv~XnygcCE&
ziZ7f*=m5OXGb<4fz<3+j{W^I2tHAaH!0>+Xc%x(i><)^DK#;U20o8tQnI1mOxc&t@
zeEyqG@N>VghwuI;=kc%p^&y_WwZQTmQ|d~*ix)<sP$r;CKG#4t$?R9?qkGq0xluU@
z@bQmzc<Pf0FMWu>V_m|!AO(7R0X{J)nn~2bx(>QU<r!l}#(PaEI8HnT{+e`0zi^(C
z&?jB>IyY*8dcoY}D2PL4&(t$wf99`7(Ve*m9uyNHY&V4Y_5`hJ&8L7?g)3ttOswkm
z#KM^xCkDC^wcZ-ie^m4Ivu|@&7dP`HU%R-1c`)Kk_lYH8`{B`H!481BafgIXPRSUY
zHU<(sP&(;I)=Z+$mC=qJ(j3{NEOIVtJ?WH!5h4SVfi@9PMS#@i=x2wRn)Mrni_zJq
zUvEI5(R!|}Dub2QetsJE@(s3N7Cw1j)`xi*mEPngTZ|;;#GEsY+YTxDrpbvNgLhN#
zOR#eA<+}vRed_K5fVu03fAo7UuGj0Y+w$H^_YbcSRV7+2Dv3vpt~V#YynZ1$2wX!1
zH@6pf)uUT{*B^NrZ-4t57kUOZs1=?7o*>)-7>)rt1P<Q<-hVS_?=wODg8&AAcOa}l
zIIf0~+K1LLQJVn~N(U1_9nhZxy3Ym<-VBTzVE7m?{4%iqX<+-SK)wN>2h(BMRtQI}
z%EjA^v?E+v5WeVhHh9ge2K=_4Sm7W1gG>0SpFhBcfc}t?ll4Q2`G|lK7qUA-S#+k;
z+oog<D#+D!8Ncz74j=w_hbJEyz&kFfmSHq4o%IObEg6?=Uu}A~jo<~4_qth95xCWN
z2B2_lN5Oxli4`(Qw&U=X^2BEnKtn?&J*Pl$uF)AwZRR5rYHhh2FMwFLX{T%=iaNUw
zS=SeQt8<u|-5AxAVM&hS*03M5YtVHl=<<-5Y9^zbAE_>Wf+q3e_N_wq1~gBi`pG_H
zuaFxcDMxKv1vlAtbXKA2y_R2G8)~hyIVq<z?+6t-<=){)+~{((q}8rf!~pqr-h_(H
z1ZuMJvD~5W5Np_bB%G#h-zIP=vT1!jH-lmKHWjB7;8KtcF#67tb~jqT$)42}l^7!f
z!>0W1MTKRBluU;nxHwtw-dWoph|++2==!t(fIs}F{yX{?|LlKx(eZlo#oghfd)=aE
z%DcKQ7(RkV8Nl<H{UP=W2xXgRbGyT9U%bMf`>s#oZEsy;Id;X}pFBdPV&#K@d<^6a
z?7a>+|5f0FSA)_Lzy^fp!D`(TO6n&S2vvn;1PepCN)Wh+=^cnS0Ciw=K<Ytzj{*lT
zWj=g6Ve>K2`lrC_9|w&eE={HjHNHR;loPQ7gYt+6_A<WuOGmu!Gq?Eu??1pl_$OEJ
z8=qK$_A<I<Rz>8kl3<Y*0jo3&R%iV?7P}~)f8s{M)6XqHi*4Cbanqs}BiLp~yTN57
z-pYuMQ)866z*zd}mAD55?&ZOPX{_;ZjM62GvSyW?d|#)|0_99+Nw?;Bdwojl#Wc9K
z+w?!?jgLTx;T4uCZjyKfndWx?erm>O-z?FK&Ev#((M%P)ju=M~WII96(+4o<JtsDC
zW=xXnFx&E)fUSmBlR-rRJwFbIY>4C9alKG{<?i>KqWx(B2oQk;H(h8fXp>cJ^Qvl$
z=jW~+m>t`2YdEf%iIvWkcLKfKqN=oUP0xT^o^&M=(a|U5H<|Mp6z%WVZQB$)n<DrQ
z04C5N`46K$(WRT1MkZ|5eIdDvtgz#)ZqZTG$7%i%CZb`nSnO~QU7r>J@Na(nhZoyn
zcqe!JFIgU5Vse&>FTUV|ze4^d+3v5iUMH0|w>!M{B`f@&|LimTmN#vv+m>T@R5J-`
z7A+!xM_@bw`m4bCuK><{0V7=?qBX#$<vnsZl$e2f4qyAk>P;|L*95vl23GdiyR!G6
z0bmQ}4QONn7L4VigyoBXbH4+;`Ek(czXmqHTEZFoLr}M{V{_7K0+2Ik#dzuUjPLjZ
zJG|+wJN%=6bP3=41Ltu2xI=$9T6Dk5m+tMTs9db?Y6Z%|As|;vaNvaFqaL}|Hb_BO
zyG=7^CE3D@!po;~h0xOHkzs!$5a`_M+yE@xrPh}zd|Sib9;+6Qw-V(u<G|2gI7JKP
zO(6K~Jw{OM<-mw`*;kE(3Lfu)m<ZkWn!_QDlABC}7slK?tJ4@2M{K0dnSzp-3P<oV
z%ewXN)(MeMOdjZl%S72VAE-IVv%5}ycglkqQjbET?EQO$){LOQZ41R#jc0ZLp~tRr
zG%!4*U9D|R=CA>5jRFd3sHvr`{hU1Rc|uT}qPgjv=8bUh*ryGj$;&W})StOzo5c6m
z<q09yDg-(o7QpA$QcEi_B6d?lyxnOXMqslczeJn0R1HmPMVi>H&^5pSQA*=txi{h-
zy8c4}fS-C^ru6Xb+ozw0{=rLKw`9(PyNB2;AcADja{gJ%Q?I962&-ez%U`g;pZych
z;tM`!L*0f-;0H{6+8*W#G;YCrZw4-YE%V+>L0A#^7EH4O#f54pS~Kwp5b)(yYc)T1
z?jaqtKbE3kN5BY!ct=dn16Tn41#tgP(BT&Xr|)Jy{!yagUEq8Kbmy3<s}iCEjmfn4
zhH=m_KL1rGc*URI;&q?7#y|Xr2YC1U_AxFJ(q26xMov!4YGO~LIBU9%=5;Os%LU=a
zCkg8<uuNp&s%FViIU)dpTM1;}dfRED*g`QL11_2de<mv&yJuBk`Gf=7l?YNAJ5pN;
z)ehYY#2YyA5U_vRm#y_TwZwLRyD^(cYqtZS<Dn)cam<wIlr2Gp^Q=(TJp~wpIF~2;
z#7#{%tm>e%TK#@-J4$Na&;E-lM1vxlUY?aiW`swWT(xJKZOikD8L_n@U-e#0L6ULL
z6xju6ZHf)PAI;09-(q$0lwSl83W#F&jAI*px8Y!p^QojzaXU$9NZCdZehc}VUF?uw
z+LJ(Ik=4$$aN9WQ)e!K|0(*No+(Rt~Xqy~cwP%J=F@-hD#;OEt2g32H4>SxJ9Gf*O
zDU7G<U;2=9zo7d7puL`d{<$}2?q8pl=L@yG+-KSC6N|wkZ;HYkMepp^z{PIBAN=O$
z@V2*Z(5+HQ+Y3~M3+R;c4j9+qbMF8y{XU>S0P!sV8AKv2qNpV<n?R;7J$kPYqg7m4
zlk`Z^ePWhMgE~x<s?l9lpa9{x>a;z=`7a_md?T=W7jXM~f$c8>DTC8FP<K$?pWWgb
z88{trZISVNzb@lVuQ}nr{ddmepZwrO+&=DUaXup@H!`;FK|Lx$D<2TZwvCwq)QpDj
z{-p(;xeb2oTq5KG-NMl<D8Xv8t+pgg+@2y>8YIFhG-k|*iFGlfrQESIwXl7`5Pg#g
zwOND3S*upaX4;8hskp`{eu*H&S~n_t?+9i@8^x)tzmcc6jD1Rm89>s!Ujt>M^I3Iw
zO?VTJvQd!PHsx)f8Rq4o@cM8DeKL<ODqY(%up#n7*O~Xi%z!m#ci1Shr(5(2OyZDR
z#Sj!Cw`?4mJyW@fmKSiLZO*05b?VlyC0*2wLRJ24-`g;Qb7|{z2?3n~wrzh_+Q;Qk
zWr+e|>6435@Cv=QRk}wuXA?IiyY=De<ml%3g@>^ij=~c$tvXWzHo2o)t7SveR6#zY
zt<|71vRO99!#SrC+;-1g{{dMI*sXZ*H+;u;?LYtQQ?DF&@ld}!1UTz)8R6Na%E;AH
zS59L$;Td@(jK|>L_SR#3**iDbXMl#x!kiLZrga5|WAMQjfiM3)pg&;b+aS({PZiyp
z;3(iUNKN%KMnLNOEGyivJhA+RQ^_97FrxyXavI@j5RJh3H-oSLDe&cQC!`lK4M#ve
zslBxSgkiB`EH^v6<`o<Iul}o>^r!y#^Yp4mw%FcIrL;mFf@J%f1id-0z|6@D2ADH5
z-t)daJa=nR!W42gVAKwMPMfM_>XY*z+{Yj*$};6ECk#2VhHHmFA+eF!YXl-^EjJ|K
zs^H7d`p+aGyq#loEc0%eBZYV2J7h+#f?3}IH+C6M{B(v+zVE*1OjgDc&rg|d*G_1~
zk0Y9?_72v#JoSjV^*VPIvJh&-m+QVgW29n-qkWrE-N_$e{zNfUc@eWg&i5@U3&Zp@
ztLb55SF761H~fULn|q<HOC3Hl*ZvTR57C+QDd=jk#@$@8&kRu2t~*IX{!~vKUU=tp
z63>|9ITohL!wt#3)}*j5W{CvHGj366Q+j(g@F2Hm1`mU3FTWf$<xB#0V~69_0<1=R
z<ZAN@*aG%AYU&E05sZ5(2=G55t<m=r0DR&@AAhv(m!F*$=Tg@#N`V_O?sXDPF;3Y{
zvhbDZ8CHx}JiMVl_{}GH!Nm+-=c4uNQMj<G_z2j061e<L)q=hu<(*X6M!4eN8#-tX
z1x#;dFFf^dby55b!!H3Vq{{iaHd9@^1HjLN`UU9HSA(zrdEnwVGH?zUZvYeiau&cU
z<NCRb-~W40@K^rg(|E_{pMp;a!;X-W2}z$(Q958-S<;*W9wH_}$2dOiu~~PZp2|ET
z3Oql7A$g9B*@HScJF6PHwNj!$2+`!i7qCfG`7C74ZkkwxB+tzCoZuIU-wcMOpc2nM
z1sx(8gJq9KBHxGyB_u5pcvme{4zjX&D+3mA=V76@y6v-gn#`e+Nu!MjWIu0qA2mYN
zxJlcwNh6Bi#1+)24C|NjS)CL1{esZiHReu*dn?z|Z!Wr?lPrLFWfb_%AuxtBU4j>b
z&Um{0LwHL%Vpg?!^F1!7Xiku`lI0npk@iBiR@wS?7CiEOllh$B4}C+-H!7mnk6yqB
zO&hnR?x#2~huaQpM2+iABqb4OWYBJOY+NL3LXpa;BCzd{aI)^uHmma>ETn5Nf*Q$k
zYEEn3q{QpL^k=@3UhvR^pNfg@n(IFR00_H&IRM~eANk;;!`Q#BTO1IP6K4U&Ijcz#
zVnb{y1$)w#@s(e3jMskV25B{bC>w}`Uw}IRJ#gW-gBA~haH6Xznk9j~VQlX?(PQM6
zwcW7W=JdM=na$wx$CF$YMCw7jEkIy#6@2;Ih_Cz~fxWka^A5;I(CmjKmThf+%QzSr
zZ~dGN{x5&wS$xaa+{OiFtdBc&i8Y<`V^YLI?yJl|w=8tN^>kONHY68><mNM2bAI*u
z%j<YH+Id6NREei+ZC?W$XaXYDLK03pOBO5OaG`7NxTH5u{3|5zM})6z$+B36DtK!Q
zGW%JF3aQX1@0n@62W*N@w`kCGs#VwuR>L8zDG8JVTT`xOcT&*qT`qoKd1COnvCZ<@
z8P#B{Bo56#1~Ph?)Srw~wsy2VpC)^bDYEOwjD=^3vl<mQg9OdE@f3Dk;CVnzepc@g
z%{5$*xC?4+LNqOHq|F~s+i~y+#+i*}i(*s7=i@q*Kjf&UU-p3$+9?lHYL!Q-0u2qY
zr<!MNa@LeSQJ+f$&Wt=1hGjpF>T+TLNWdl&j#gb58lmKS^?=^Sb_Q(XYJyN2Q|gE7
zk9|I#c>FQk3)g>y2Y~p`|J8rm9p7GEUk`L1{T_1`vrOj15wtb@d=Oa`e7kkRt6#Fk
zm%ZZ_4zVpq<KP*;3Iir^-huiTffla<@fyIuYB3R)pK@9tQyppocmc*97)yZn0F>;1
zzyc*CLQpzWz|lU8R~gj9);Ls;((N`ziO6C7j&Pd@&x7_}3S9alz{PI|r-y;z7C5h9
z5%j8Z$}z`N#*>fi@ST7BCjR7iJdZ~&j#%C73PUGL>*<YLwK%-1ynfg9gzZ3h&%1kC
zZvmp@Qo?)j>m^{MkGbJp<+H|vz~rKTjg`E4KUs+OD)O?a%0VYof&gmzEHB_{eJ5uP
zsz5iO5NsdsC}?My{9o~{6RzONhnTq99dNZkN8=?AqU<FENd@dJNe=Hd0+U})Uhb;}
zIc<Nc0F1#b@eiBTgc{uI+w{8CYqv0kW`R=`*Nr9!iYs`1;y_9Z!k40ifeC0-1#T1W
zD&o%E3}=bY6v3Fa!4-I`zvfdwH}`@tCoS;;BQ;ZJR(wc!B%i8a;sB(`@gMufy;a`0
za?ONl+!zz4sa{a}|Fies@tR~;c_{p>T~%*5sl)X2<eW4!nxLFWLIR8oGH`98b;02}
za0$j3`(j@k@I_ZPShm2(HUbL;gc8yyjIuP!aYoVv&5S08?&+TCbo%r;=S@|$*Z0Rx
zYwfC*FMOnFRQ)@B-cxVYjw?KC?X}nLX=(t$9yC!tu82i|*g6?VNI5xDQSOBTShNP4
zi^>HA1m27`XfHD=QjI$kB2|$Ep}lAG4jkXuz^QQkDS`kiKSVV@_Q=Ddm6hd7Hs{lU
z@u%5P2&Jc}uHx0n2ney>3cyYaTzmBfF2CReP!9kqp!Vg*!djqRfJf&6#V+`hcf7bP
z0WJVD0B8v2QW^Mc0H6W+(+Lr_6H*y%4cDL+gc{&Ez)fs33(p1z0z_Ib*X)@XR&Ei~
z7|6i6{nr6A0xy3TFt`%fd?#pj6JX{5??7^o`th>>wt+KNYW(EOws7V-7O(hEJ8|Fs
z3d5a1Q3|0JERr5&Nd)H}HNa#6+;V4yX<g8A$xwifI3C@rjDKH8a_k5TMRAktwD!s*
z<>4MC#hj#+ODvF)JU!CEL_rxMdSQCoAhx*aOJ_DqN;C<N{7|GA&=kg5bg`5AS1R}(
zfSk6W2EZ0<x&VF!k@a~$I2;OelHrc`q~(-Z*!~>~bnC}DbvcZ-w!YM;DeGO11^0}3
zWQIhiEK+;N1XzNUAr(&eTUf>vo)AkT^1Il_OmQg_IJ1srQxjHHEpS*Y0QN|PA~09d
zjVwCRDFIIG$!TUuZW>&3sycqpVLP1%hnfb{EV9af&roZo;T;p&BfxTJ4jmnlC?A~C
zZzFh@RDYAVN38_q<@(WdBE^8)7Gz!Ea>)O$AQchFSgLEnq&D8}3UsW<C9UDg$iKXQ
zF^5EJiB0>Pzx2jF3Vu>ve_{Zzy7~hs%X6{5{$H^F(Ysa*@zq4-z!W9Yxx1d6BEzRW
zrfF<B1}_-`+Lmy}4vQB({|JVd0!`(T{a7Rcs~EBcsxyFM8Q>`hD_|M`Y{7N`YGwc*
z1?q!9{V=$G0<c>k%)mSc+BPXwzn`DYGE8wAs5%>{E&x|&g3Stu)&SFbFt9+{FX%ag
zyqHluFWp;R3nFo^-`hk4G7A`92L@-b-SyMNlPf?c-T*Y4pkf7@i~X-TW2FGT|GQ6M
zd8NfG{^Ks(@z5B>nsspjCPm!K{S%7H{qVMi@x;*zi?#$0+9WuF)D`BX<a5<I7V`_y
zWL0;jlvPUFL@x;xKuf^P{7{yDZpB8So4FfV(xoqlLMl<&E_8*KEISC0P%Viqla$$k
zQei81f<A(|W8h0DosVY#LSjpooF%z*rh+=d%bh9oWkoAdwngxvx72ziW(0<Mt78X?
z$Uh?LL5iVafFigKR2wW>siQLiE^8xES&YsVAU<zMbQG~z5<zDyWPf5wx#EzDUcDsi
zBgCCeG7cuofG7DO#LJ{W`p|#&$BL)oQr}Y>Pv&{h%_TL2={yTvw)6O$M8;*{m(&9y
zi4TOw64b*5qDVtP<738r{IxrP!y-gLF#sx=+nTUwh`6+BOJ#zSS;JUAp*zc9aO)Jo
zsdN2_0l>NEu4B)h9rWo>gZDl3z<9DXz1Wm16&d&~M8Sqi6WrO`DlHp7k&B7J>E}#w
z{ZmiCY}a68L8d?+q!KMbVt;_ovU8WW$AJ0(u($^_zZ={f0<{Z(X8=u{#ZSg1?g0Sr
zUL=1?AaU(1ei#4)fR+F=0?ISN!>fSN6+m@9sNBP#f)LIb@K9aElu)t)5CKrC)Ab?A
zsRSJ2JG=>^5wP-7pgacvf<S%0*!TmWxfd{N0961|R4W1Cx<%C*y!Zt(to%R6@yb^j
zeD2l}cm$M{_2^gT{);j`8EOm+M?f>Lcx&AdFS&=(QUdq#MktWt<jR>sv^aWpjw6X0
z^6#od41ri;t{FLkqW8K~p_7>9xd;ge#QDnGl`BLgr&)M>M2*>gd6gbP4sNcnWGOMw
zK(@b6srf(r_OQ5)OY%K!HOFAP&e-QOm1rZ>&7!U-s3D3M_rI}r7d4&Kc4Fm7(cTq6
zE@|mQj&i6d`{F@}P~<6CQ7hQa9{~t-_%{I{9hU^LMNvb8L=>6nA5nA$%yL?n7PSgU
zPGcQ8K`MQriOG0=iU5v~gV5*?QMxhopY@z{=*Nh;2=hr94YQ)hlTe7$9PvGId^ExJ
z!v_F{z)o#!`LYd&t%0>hc`P)Y7|6y*kRxd@co>)sgQbvq@?U>q0Pw&AKZN`4+XnzR
zdgwqgSzwu$cjhD?vue4|!qujPR(Qaos0}VV>jYMY6SVtkn7yl@(ZC&=lLZ>NDDV=P
zJqqS`0oz{$Egk@x6974PJ(<cWa5Dm72|yq%>4%f}KVw|BfZYZy?gTGx2W^!=xfd8-
zOFXy+G`bq7_Bd|>PXXId2;5PMDJ5fJAyxxFb#uRYY9mYmYQUrGz~)~7CteTCJ_8i1
zfT@zz06&fvFcZe}uAAfE{qk}A_J7@h4}Nxx)&OPUuxqR$C}p2z&G^O@1K{`xqWd2x
zanZSiqNB5W6jDUsnUcv(Uu6v_j`Y8>#HQ)}EUSQMPX|}^33aXdNJUH|^0RcCcP<Ym
z6u|MyRy4Cmpd}hp)>Qm9NFFhdfhNWAR1r{y8(#6~ZE<28lyVb%2*HC$;Eqqyz&IOn
zzQWe4jxGxzGaEXkJ2I0vn@p|1bXS;@VUgyVQY9+wGsk)E5UZM(fDEN9=*jD!S-+YF
z^nqI%#rcOwjF+POjHVP_sNv22;N;MdrS>ZSFkBpsT?PQ#6TRQ@2#Kw-3hQ#l%ZU6S
z=U6mVjXz6kNeqD;qd<GyQ#RLaNW}uhcd<h*#wX;A1=*B}L?&(MV0oRFLCu$|pd~|p
zy|)1_7XK7Yb2_`v^J>wy1&RT{aR;DKtBFCKlUzH2!o#g4j7rAyuUW@Z(SSE<@X>8(
zw{y6h<qk6jZ+!wd`fAYh^8jyyswGgl6IAU26{{dqxnw{TPWWpO*8g3);#T}Lh<mI<
zAYm~A%3YvxH^_`Y?NMO+Lrm-c894lFz_I@co<9u604R3A1r!2|bW)Z3&46?WhXhDK
zSKx(B7G&6+H*gFzI0xAMGr-DAfOZpP7a%Gib1M)r$Xd|U;<~3S@UQ;G27cg0TQJiC
z^};PN`20sox5lJHo>3341Gjy>1Q!ORsDt!JA0QKV(8Y;Of+hy@v;Hm=qUhx$%2$dh
zmV=f<C$XWs6PO<BNP$MWy0oEK2IYla6`d3iQi%8Jm|Ur!EV&3NGRgbxoD?h+SpdVz
zG)Yt9$Cy-^J+{Bvca~oiflY8V$3Q!xPInn_aWw)=#9dbMT}XNlc|4#MIdY!ReeK`z
zAb^o?qYmf{4h^|&PQIs04M}A}oCnFB8ORACnvH2#<GjTiT}!*OoaukZ+x@n&*1}@C
z!i&-hQ)Adc@^P#>+jHeJ**0lC_X(_rSpT?DRR`v&oqq|`hC0IYf~RG*EX;yX?4l6{
zW@3Q2dw>`y*rhc$Oe8$ev9t_4xgYKs1@E6E0<&E(?BZp=(#1|s*6U9Z1V{`#otT-<
zIOm#?-D--83dF#xK;WcfEE4BQ;prxe8C;evU2y&u2G(z_KDq@yZx?7(0yV2V(G;vs
zngbXDW{1co$l%~MA|nqVL8v$gGeS&vo4z5r5^H0RK_y@+5XQu8fp$Nz^&n_+6L@$f
zc=<)Z;3`nD1K=5eMeKOy*$bXi;h&CUn;rm@vjQz(j{{}}So=o+mcS?81(Xd?j`W^q
zf&(_Q8dqFs@$*01pl*TperyaL1E#dFRw^U*yy0&c#;hhBI9RYX+N@6=dC}VF&(Mlp
z3SgD&tBZEjymYVJ5(@P&q!3pDQu03;kf^)_$x2JNh4n`Ao&dB##^wrNoW7{m0J?^l
zkbs=3k|}#7n+0v^$5R7^B<<Df(lS#4nW0S4zkDt@Bn1-h$alrxIcOsYU8t%hQG9wJ
zW(18242WJ0#j|}1D!+OWR7a=D6W$WvBr}w=w72nCaWyw#-jt0htW;=%41J;4h&Tsw
z=|?6Ca-u<ziL6NwmIN^z=Z(QWT0WaFIZ2{Fy_lnStw!=pPnJ+21CldI2HI#z7-u;5
zzJ)$ym>@n<w}`fX9O?up+z=OFTR3oPa-i+!TPKQ*gA_2E2uty5f@<5^#RGTZl)3(t
zses>r0|$Z8Xf!h0TZYITwPFO%0uZjE4CM=-4H-t$8e(FMcQ!Ds1(yY|wE*v12VJ_?
zB?_`aI5Wdh_`sJVEd?O0M@dYV07>sVf#a;lvtn&7$v~S(*Q|I(p8(S@0Mjpn%FBVZ
z?}i;eA5`pe+Y{|H%7&-}T_572fD$eoNf02DsLyT!v;<!JDF8cxtv7+1Ew?0)2jEx>
z%o&$oVDSq-zYb$9-uH<y7DGZ=^$2pYEznfJ=81x4(*i>wX9Clt3FefsRVfq}Oc^Wq
z1{P-!`ypbuM{{a?5r|8CodXHoN2Nd{DMrkgX)@@bysqv^Qpq3VD+q<6;F2vA)&x>i
zaZ)rfopHF-nGH!vDUBiP2+A9Z({$g|5v|AoL8jR`d!2jEeV1*e#4R$9zkjvI;PnrP
z-7$d{JHSF<w)nS{(rSW8o;{TKEAE38fFzsTe0ybFaOeX;d0J+<3?YW7J11E=a?C{C
zqM~fqM&cJq%sM$#4&YcdhUER67xMn9=s8YefCX@4q}T*TND!%Gdy`UtYy?Yy8;XeW
zM)`JOKMr-13^lpS!1s~;+;N?{-AOksCN=;Nx0K_@Hna%=dNUZUWpMMkKmLYj^htI7
zi2=anmtRO%T=Dbx$cO(u4F`iI0vBYAnC4`W1c9gXhX+O%+f=+@DvAc&STGFCz`#C!
z0$3ZtoVf}tLezdr#1bbyqI=SWECg9600)8Xk^l-qKj#hiw~C7P9U*|0LB%p)YhZB~
z<H)^)(Wk-7F962R1r@siY{Pj4f+7rU6;Wtm+YWoEqTFxRbJaG;EP;3a9iSKyPP`G^
zPTURwAA||OjVA+U!hGe0HT}XrJArm#apPxKzy+ZwIE*}6I4?uMB;^R$|5%BAj~VPZ
z7jAWggn*GIFe#SOvN##2aWG^4f3;OEoLwNq1PQ?>uQ0tGLrVnn`3KyuWSUdx17!t9
zT9hu1Ko8nt(XWZJgoa9Zmph~wT%UoSf@n!iXFUKA_hngeyH&KAk*_1@^C81~qK!zh
zGrpsRo=_g7N|OCjhFt(Z()x~8HEBf=X`FjXOm!;Nu7o}Ll^cx?<2=h0zH!(xZ7e4z
zPDBPgsnc7iBt7x~86qFj8$62%#YOBPf+E7W$S?rCHM9>s=n?DY{G(*~$I0o}R|zjr
zQnops(M4x(_t0J-n{1v%zDhB;+|##oPx7~%Z(FzEaBf;$PF2Pe11(`1K!uH^1kzB;
zL}92oqXA)zFk5ijShnq7?_B`H;aM=|T=VF``v^n@K!%b}Ss9GlDhMB#NcmO>!Cz%-
z0|L7}o|OS?3x4z%usm=-jRg>*_=AZ8fhq;M42Du{d1SZvb_f2(#^(ahzmvY#Pyldw
z2h5OQ8<^QwfcdS!;G@9m_X6W*gNxGu-U9I~)SYc?C&f6dnAktg0P_}zEb;0~z@`Fi
zybjz>fpQr{Azwie#)W8`ars4a{QNJp*j|+Q*v-qJ)dq&-;T;r}a8VKNdzf&~gN$n~
z&_+$xbJhK*i1P<xR=2dG5Tm7KE>r{|6u?1d)yt_0vl4-NZkfv9A=wtItaRNEPK4W$
zOPPh)p+5me104xL8eY@qB*^Dj_m^4wOG0y1zSyo%kK5J+ph|*GSURB_9LA8;JMn8d
zhNP95Vsvec_RQ5u{?2xmXh)V3AgU0ByVO_V^v=vGRK6IBR;pXq6<=plEBhDoCPm?v
z9|7z~wQrL=ryk{!Cw-1afgVg{xr*Cz=;CgjY!W&_klg)5`PWj`<sdMBMS|e0AO)r~
zu_|H&G#PWJ>q)nWTq*$oD4J2`8$hu2q$K0Uh9o^F-A_t|<YdcigeYQwnc1FNy8!;g
zL4XfEbTRJy+K91Iv9-2gFk7~QiKOW)vxK>C{TK0u%Zu);&w5&V<JAY44G27)!aj1;
zA+XXQ9_gFYwl6lu&>^VQ#CAbecZEu7olsMq3Ml(O<cp(#X4wL!1j?O2u>@-F29Ev~
zaQHt0+g}8D0Hz&qAjT3bOkxHhg@mOOn`&duE&@+Lw8gaiUBKE;0$c&jc2CD#*|g2L
z`icg>@XxpKtgCC(C#v{8MPZmeuWuSYa-;+gOsG4yG32n%>qu=63Z9d0kE0m|UrBl`
zjUuAp)c&kG`QzqPS{1IG<k|6}H)=h~%JKA>{DiKb*8Nz^ur0y1@SnpEU|UYh7OA;{
zU~)ykStk-bM%wHUD<UPQVs$z3`~ntv5ksWE1Sd+dbqAGVS;F!(h_sO;s5mD;)FmHD
zMTfx4i~_=tsSGf|OF&6V3;tj=b%L-2?WjY4IG>PoFN;Uj1l18!p350N!Kk1OW*4*6
z0^GP1wYK&26X)D2nW)KF7%eKm6L|wWU{-<2xb_{?APaiR>g;SE(0@~2muim&8pLo0
z8{k)41g(gi`@+93`lJm<jsPf=0}8ZSP~CO|XDQGng9u~|(R^ko9Ri)TM|D4e%8qj=
z7EiD(FY0<e$0>CEi2=aY)|+tu1Ha4v_#ga;t?OoP8Lisq%4zPqlN^aVePqBGx5j_`
zXo*%D_#mJvV2^Hs4;%-|;P=VZ`bp$kxT_SDJa9x#G%30ZR%@rYK7}ot68G5_K)D7g
zhrr@i;OKt>j{Oht{Bbbtc3Tw5Cn%Q!2taW0s@qa`l40<IfElp--N23?2U!cWGgq$=
zDj^ErObO4tW{!XLFE()1MKxv{B?>8Ly?`?XqZk+*KQ_d|7OC&OMorjQsTo<xW_j9%
z9<i)I;Sh=GMmvY)>Skm(P0osvoxx=*3_}VE(-SMRQ|fI4*w$Od6~T-Q%ran>05di)
zO9ZoGV3rAH%%IZKeCx5PCE0w@y`ba-Z7ZoGD4H~YQQ(C$5p@zbv6>HraTKRaig6DI
zDdlYm^|BY7I>~dIm5y$R)ib0oL+!rkx(U1UiU49Vx(l*}5tXLgBOte*M_>@1=)s`c
z2k&bMc7_c<PSL{vH1xDE_H+?`mMPK-4cUe8unWoImVx#ph6@rP;f%oLwzQOHxjW%;
zwV^M(J@bC55-0)Wpv2?BM<+?z5P%E!e<42f(3_q~@s*UsG8j_;Ga^vK;JU}tC}bEB
zU=7jMyx=xCzCs+0+^quAcqF6OKv%(}w9JcUK3(7xy8e_wfWY2yf%$Yc0jPB;V};;~
zNIWoj5N6$cE)2jJ#-b^3=RGTU;R^}NhCwaddj&bfz3(`%G6r_70P_}6v<ZolNP?jm
zL<m$M<(5ET3eq?Mif<q#b^keANeJun0{}K9K&ybA0oxx2&F=!QelPRV3kk(e5N{%F
z($_r@MY%?X>||hKHUMT0^)9~z+)jWKf9SS7nvp=<<f33L!^~Q|;8|1r@-Mddw=X{p
zj~ps7T4~X8NFD0d>#8B)?)wHfv|i!dvUafrgt(0}-wn{`p4XZ=9P$&Cpjc-P&wI{I
z%nDsbCh)!yFz6Lq;vp$i83Yu788}*7ScB~uV=_0GY#A(SptUxoX7z6K!T^RCrD3cL
zft_oN<q<%Z84D)cxTP#s0cpN<x$KIlMa)0RMvETBEw$mf0B5z;sz^uX6vz!Q`GxqL
z<T591N?G|io5j(UuHjf;%rKMIgT+{gfHU<f3p&ZH!t^Yu+QT;vuX9pzK^C!fc@`*>
zMiJY4<sImvV$@97+$yj&A#B$MP2+NFI9_Od%?1WQQ83DqF&;2>tN<$`z%T<f!`5E5
zh31%SLI~O`A}j#Ka>@wmn+GxfAz(B+^Gx$WNBW3CL3chunx19GL<w+3Y(bZUyZz~v
zuawA#8w=Z77)l}hG7WpcE-iq~Y3b5s5y;6fN!vjJiG+25P-7qB2$KbYO~La;zj%4F
zUVj<@z%PFB3yFw$@7Y&R%K|kwbI@oFu+|4=aF1|E1R)iLOIOO6x5Qt4Xa~(LVP$Ax
zx6@%FR2uN220w5ZboCGzRlvNC-hjZ=3<(1QLHdbiEf@s0^xymDDZwjyEy_$ig0f;{
zgsVDvj6pO4mjeKYKpU?o-o6FA`chzgotLlM&|Ux}ijHzlw%ltLo;jSo`okV%yxpf#
z9V<cU{9qQvyuo*VTZ@h3$M9>f*o|Y80_Adx)&d0U_DdT>U;Ww;2agPJ?gcaO)M`Md
zgoYpWgz*Ge;7o96?~A%9<&TtGqBvM01VvM6EmmmPPM&$GxRP6zDgp)omjpW~aqtk~
zo;wR1J6vM@P=QAuAv}7}VE>^4M~)lJ7l?q$GQpoDgu(#3mMtzhx5l;C)Hv^Ai{(|&
z1?Mer$%QqR$`+VA7b$#ZWg{FSah)}eYof2Tg-cq<+M1@kpLyTq`3-^xLv8^Uq?Hl6
z{>-|4s{FhS@}ulSKrNDta(8d`I)UB!UAfmob~(s(2|g_=vgnQvrKLau&^pR9rBldu
z05nyFgNF_7z02U((E`Vh7I@&^3J*L;*nh}iW4l1z7S4-Dwc`QnmRzcWvAoPU@5}|B
zdWFSBm$q2h#W-z`#ZxY+v1hGCv9K;A#aeJfpn~*Na7NeCw-rT%^u@U6Vgf0x>5<>^
zt|kSvyXTo?<z?Q9Fn}?*S5=a{3MtkIiST=ZE-9S*k_TQ!njvuAxSd)hqO;Wyt8Nk)
ztu@%(8iHX-X4Mp7-<pQxumCX#(s@O^my8V8C$TS{tk<6g0MNq^j|l+pSYBJ8Ju#cK
zvuM4g;3KJulg8+H{#*bW+ab}xW4p1nImDi&ZSa;*G|cV{qRlDn1BXytc{WfM;3kBq
zC&3bfnkb|Cjz>!pnb?k^n1myM)`@g|T~YxB|Czj^dp0mh0njpFEU3N%IQjs1`8&aD
zKLDyubKU^d&SEx!CFK?&QvD$h0vL0K84&OMyC6ORo_qwLvG)devnHJD(=vu2e9w#K
z`1;)&c+H!3qNxd{w8`=?Esm{Mm}~(U5_m#lY0eLFROsR`52?$1Ba>Wa@r?ACNNknT
zwnjQZ8dsH%oIBLz=gTBRj{!ytwr)IW$zV=|Swq<OsKMuMDX{P02oK$F_{+B%I<irs
z954(ycduo4%#%N=0R$U^%-o5T2J72|M~{~H#2p3dhEZ6;Q!XCjnyYK<J-fv-o@Vj%
zYa6UAH5e8EFBrUVb-)-V0&z%Q#6k>n8aJ6{wIhDwFyyo$_IKxjX`N&;9EZ<=IY#Ci
zRaR3dLV4dp0A42u)I>1Ds(uY7C76qKso){eA0fSUoLaK-lPf!XmyVidSio3ks1Sih
z1zH1aH-v)+4L<WFg9jfO;h_gA{_<^xj%*kdrGYVkMGNl`0;u)X1%f00g@Ks>`;HFr
zg}WH71)2rnj6IBJKCQ+jmn`tKr`CAp(=FCkYK#alEy2z#)b1v!kvJ%0LH9CflRZsl
z<e^1gP6zS>_r9Z6K|5Gc#2K7KFQ(~DTeEe#YU#lcKriYC0cVJSx(3-6Y(j!JZD@tL
zZY^PBa{y+y!^yHHO_?G?Ei|$)YGVE5ygbZy-Y!n5AizJ>62SfUKfnO6=Ztfj+BO^8
zTXPF;jpAA9f))cWy+dKb*b)s#4GtY$!k2H`&F4RR6Ywk4;j||(0Yd|OXcHJ8g}G=C
z$XGE!vQGaWk-pWjOv0t0cWSpJ3e$0EWbb5c$d$ItiAn}2)<8T5ZNCe=xC>bOLGaRZ
z0SrO3<zrsOX<9+?bY!Pz7TyGC2khF9!ZiDV`d$}|C^Bw^U9LQ5>>6AA?|*NK2lkbC
z-zS$b+zG${Efb0gFfHTgp%S$<Ffs5o6CP4{tL{>)vomHgb6WiE5xh(jEyiEtGLd{J
zZ-ZdoxDHPSv_zO#;K1PupZ`LMk9?x!M;@-|!AA(&4e@a7wnh$iv?xle^I5R2BF;9+
zqh-DCq9NF(z}*Kb-1cAzy8zBVi*UhtjBBo(;QPLBflDuHuzQ8Ua{x`2TQ~=xIZdJ~
zvn9Zapj29Rx$!JzZw@NLcCc?~<Agzx{2i2Y5}f(QoV2Yl1;n{&?it{Yv$(%Ooq&7o
zaS+yqzU`Jo49tjmMg|9uR`lgBm$>o66+ik=h5H^R+L!`^Ay5r~!48X}Xx-sjQm(}^
zLmwyvp~cQK6HH4mjluC5;RBx>qWSO;XPpLIc!9;$SIzN#FPY(rOBXn8seqXSsBKr?
zM1w<imBimknNs{ax2ALDAGXO+4}bZGlqXNLNfntN{1v=$!ZYCCSH;OQVx&<RJDg1}
z0X%QuPKq><eptu~2AmuNVPjIUZ7G}?q!qnDj+)wpr$T};Sb(|Zx;~}00TzFXcL+F&
z@B15ngO+z(SR6fa@Tn)Z=hv4@yGvtIN>#n}NLVob`v`J_tHm%jPLw!pc}_2U_CYEq
z0JoW2%=nbH8&lA*0IiMDkybJ&DtIB{e-dE|Le9QYbp{?%!Z{%w5?@k!SV&>g{f*@^
zh)R$d0qql@>6ZaJ0hbqoiroa%&cc`b$YcqjPn;-~cn%bM0on_i-weV8Far>^puCd}
zVb?B;3oiw}c1MYWhn@8c2C53EX9adFFYuga%`k@b7H}A|RE}2XGJgS!HfH1#KMAgv
z2u-d5WPpm)5|Su23M3CL4FO|dS{mGbPlb29YlPo?)e_$Q!DW2yz9FqI49YQMxWrTr
zm`s`GnAy4dtu--U6SG@Jbbpf%_9IwJZdt(k)9VYM7%&DS#%Rf6dj>qXufVN$3~<vY
zM!5IuC2Ub(WjAAGC&PpV%WtG~DfC^MFk)!^Hn8N@4jmyyE|Cowz28L{Zz%DObn8S0
zK`LJfN#!Fzq?pcOP@06%_f7D_c3K!(6@W({!VxG(9;y_&Js`AW;GTU2z2|*P^qa3*
z!du_9j9c#>;K&3pOH89BMmYqT5`G^$(tNjW&I2u2b~-8jZJd`N9H>bIV;EF1%Av(@
z%$PQW2OlkP`yE4k{NqF1b8iJUgyr49>Q3(oXu1xSUfQ7aIfZLzj?afii(@&?8p}tZ
z5bjV8$f#31LBz4<GcRQ^3$P>|0SNOZT1Wr}1^C!DaC8$G7_VCr5DTfhjR7X30`Ix$
zJi6!L8j2<BJphSmf``bFS)kQK&+71NW6;c};KhkMR!Y2Q<M?BzOd#N&5&!_tdDg`^
z{ru<HyY9O6tjV-~Q8C;#EQ&!Q4(}FIQL7T=MT-S~(ilty2J;fnd)5=!GhTqF@cHO{
zAO`~|3g_<Hm;$Rq(2CCwkSYGuQlk)^B3HpI3gHULl&d-tWUjMZC9uJ=a5ZWviBZBI
z<b(Da(EM)D{9Z7f4k|D3onItD+iAK<=p>@;22`F8pamAUfv7~-3cy}y#!+a2J$o60
zk;UgfH^96pob?azblVWuEx!Nz=GZY}py9;fl3C+)>zv&u6YTOG4_lDV@@75ivWytT
zn`9n|Qd#CT9}{L3aO*vUH@<0%-~OFty!R7JIJ{Ya#*Fb2P*yD%3@fwaW!6xlmmoCA
zB^8R&Ml@7rPPSfQSoh9g%qYi<%^7g_eFZ-Hu?qL!TfiE|S?9MHF2f&Jp{><82AtZW
zJZQO+l#Ai9z1d*Ju4O0};xSINu3ysyDg7+}&hq1nS<?I`962f>rfyd3FrDmylOc&5
z_zw-5k->eBS9t3U1N_dbSMatQm+;up5<FmxmO*7{U7kjDvUzs^RW?&OCvu!J5=lD>
z+;_u~MLD+Eni<@4Uxkl<qQbp*mzXt-z2`BOR@t3ZT4$b|00<SL3-<)r$&H)9Y0+7b
z##P5ok;YSgPUA{Pk3%2^`l^vP*>hcMOK08-&xk&T<`6TglI)>PX8;buStvm+a6BH^
z6c(GK0`K_H`TWq~Wh$3!mNYT|8G#P-DHhlkWYEkfK(l$fL2={u)`7p)0001R`_~?z
z*WUQ<_N}k~qciKp;`^-`kITWB<hppwPaW>WbvXB#!`31Kj7Q0b4lU!-3$}3m<;Q@n
zNa&=LU}0P`h|L*jZRAc3Y`vR05VW#j6mcpgLvo_S2hQ#R2s<V_!m5M5wY8Mm5gyM4
zw*Si|5(3)Cf!UXVb^#h(;!^!$0m&FCxpoL4=0wY3U97qYSlkP=`#{Agt)a=_A~q-p
zIQt@C{TT4ouMA--_tku1Xm!})hyK<AyOvw<!n$>Ip=83GD$o@_#)(Ls7eYj$C9Utf
zf?Qh=0q9Vag&|mwN=7|0xc9LVulvIhe*3?z;r$;UVSPcUR)FEif-HMIn=IsfNnEx>
z**bx4W%uPf1jIvYSc4g222~d25NOHZo(D^O{&N-Xz0Y7}jdA+fjKKhiXN^U$CFq`#
z6ziUGk=mHP%TIhGU3TA?3mm1~%t1*AAglIm3xMqY3P7pft)JQvz>}ZI$dK~4fY}k;
zXNch>{b4qs!k}Fu?B6Kxwj0Lyt^c-+x4mZx`;V3=mMn&2w+-2f=={*tFz2eO4lqpv
zM@BY;ky7FN<q^3o>BqLLEQ%qcCBnTA7x?VwMttwr4MyXZ_MS@^4agsI+VPW%Hc`(!
zQ|brcJxCc1$hj8aF@6vNGI&B%EmE8T-S5@%4kdBH=%u}GztYg6C}0ns0Ji6#LAHZk
zlFEQ_qAKzB4_-+7*T<-qti~SE;_q{?IAbCl?Bt#|sOQ_DcKfzr$v19qK3?M#x&9OY
zfC>0j0{%1p`)~YPzWB1IuT8c#zIEP~XOzR$l&e=+F*$-yRFh770t#a>t4j=L%+GoD
z<FraGxHjTlA!rH$O>6Mh9JFg0G%8&}3S}Z?M5<4wiJzsF;vY<Z=Ae~CIf@yn%SZxQ
zr`N+;l}6mrpfp2(XTa<ZVE!OboduM8-Fw_10uhB<Gn0`Upx6mEr-5c)0C)i)B>$0p
zb=LZLiE!~n4Ia3^z(bE#YzmNV4Jr#f_Zf3saBdB%wer`$#r#Tv*)vuuy?9W>0`05F
zbSWFW0Fp{0Oeq-vE5N~R!uvls#(#L_8s7WS5e{z_7_KqOfd%`0eERHyq$K4X%G~3=
zanZ(!)dwLF@M-3v54Xa&SnnAqN=7we%v#{Cy9fBvmqs{#yujHP0jKS5-NBT7bf-jY
zZk=;>PxzrIZ&Vuhbb1|ir&i5xXFz;4T^@j>ahdJ9vpz3?a(FAwZz`v6sUeQMI5QzA
zYt{NOVY4*&<d;hPm)}~!AO7(e4<9U0t^n20N5<MH=d;)j2TH;bMJ%?TNA?RlmGa>g
zKuPvhEv$&81!kZqfx(!uV4}P4t>|-~8{+Vh3cJoSIBl;*87z0H$RdE!hx!B+7l%<u
ziZq5oUFW-Y0-<Nq-3cQQNP=X!oh1fAnWUs-M#JHqa3GTK2p9wV*ak3LxJ<DUuu!5r
zs(?)z;Ez9aJ|5p3q8hvO@?k_IT+L}p!xBHfrr>72P26nVKCJAG+na~}Is<@T^}}@`
zfOpW-pZ>z>zWonfvS`a^Rl}Wyp^S(G@^cr(35!!E2$KwO_|P&v=cz|=(Yf2;2{9S5
zqy)iFC4sjW!1e-W*D5e7K~3-kgwh4&O4BB{WW6vaX|d!BRDBXsfgP_5AVhK8g6&TC
zQ_3P{--BO6b{tML0GSGyJp@d@3KT2A@KWc_hui+BUAvMI*gFPVpga#~4g>SAx#Nrj
zvXwBL8E9MV*aa-_WPI*31FRpfXfOgcjv4GZt;V-LZvoQ+paLW#(lZ9i5q%V<ND91X
z8M{Z&bjLl8r(d7uVEPXY=9R%$?k@1kSFhj?-m-#64;QFbECx$$ifESrLNq-=Hn}`O
zO5X+iD(5v<!*U@*F7Zg=Ohj;}X1KS@3Mj|G#?;`;w^n%Iz5?f-*I@7Y76loVK(609
z3Kms3b3?3&XU{8v76qZO=z4^p8UWep{G|-=Cr^R?8X3sQS2~oz0C`SAm+vUU1~AV0
zj^{EN0*?ugPYD0>O=G<Bzb@nU`zp|w9bFg;dE7IJc}Yuqsjn1>M=E*QylmJb>``)0
z42nthhUeI$jG|;zV~efY;I=!4xcQa>%WEwzy4<1~8c>@EGW1x2j<_5ZTo07PqR=tX
zaMJ~pfl|J~nqC*A$N5hKa*{VQ9FkB}$`2t?gaHbJ_P_?Xu0f^AXfc#UFaux{CEoVo
z3vg&UL^Wy!cghusE~xFxtHo4MJ)fejH*W{eZ=6q#eiHxy9|Q0qJoA}<cmCMpcU@l3
z=if%dwSg(hM9|7O5ZJdv5dj3aXzb~90J9)G@0o|N%$B%u&$u-uA%My6pWT{+CkxQ-
zWuPkDKGEQ=%5=ArXL2Rqw;;iObQ;(ZLOl^%!Yb|YdQxnUEK9x<h~LNl6A_^tgX{)q
zb{oiU1B0gk#WD!BR{qj5Cm)DM4Twfyvj;T28Q?9zjNQtMY8j&2`0NWT(1LFH@&H^C
zW^;qH&uH*Bzh{BUrHdoqzN8lfK-XIY(G98KwBj#Lv(Z=!UOg$9Lt^2P;(XDtz@cf0
z*S~p;SG{_S&)hO#9)bqTHd<z37X?WI5CSLJ1Suv(1atatNVY6_d1Skzd?!T!lIC-=
z58LjF%7O~UJ@<`p$87_c%Ho2{ES82y+2cAiETKz>-Zb52eAvMV($Z3Nu9=vmH5Ois
zf?h8D$*Gn6WFY?x;7<WZ6*nX%Eby$PCrSEI=m1<0>XE_cZy(@QuU^I<zI}+z+F-ci
z*NKH=raO47%7W~b6l_w_iUFXWUdvRosaswJagcoBxyW58D@HMF@x<X0U;5%0+grfd
z7g_Au4N${+kw1J4hfFDEO8Qi`DW@r^hqc-lf8|S0VJLd(FMSyXTcrb+o<iYm36rdz
zEex0#cHeQ3Z9%1+_#{VQ0W)T7+5x}qqZiWA`2gjBy$3)<8ASjoml7x%EeSOdKnBfX
z!e}P9*|vUPGy7`|0DjH?d<X#WwL3n@7hnFg9h(~)&*#C8(~ENG-K`|%pY))17K$K<
zg~0`I_|O`zyYw(Fx?mHS82_Gd3dtz^!T?)yU|IvamqBIWQsc@B6mhCU_=FVUE+Yw)
zu4N=;oglr$5alNI@`kz>n@FJ<E|!AW1qd1o%<lje``p@oc?P1NIIZh@OvFOJ)<AhS
zxH$&Q?*J7eh{X9x(RraesDN`X1RlKK;NAxZ7%T&4tTDdx+b38VGEwWtBR^zBnM{zT
zfbQqX3<=VIxB(OCT|?Q%KU@HIXmHQN6<+z<D|qc6E#dJk!f4e}QJ{MUN?r-+-_h3b
zekP7?Yaz&cma^k6rl_NGMIWg?(O4`;)WB|!`CtS*esqAFZy921%DC#97OP`sG$4pG
zNEAio%0)&x2U4W|K~LXj)O<42Jg7|{QI$4nP{chtFjj&Ap@oFt)*H~Ysj2~dsw1V1
zlSyj)ixpvBR(RKk$N2UCu!_%pWdMxat_-py89r7JXS=g)RU)n)8i<%7qT6id(>Sv%
zC!5JURwf18xiJ}xfXSl7S8f~P!3PNEUu<#qITo}CT1*U7Y%(JsOtpfa$z4)|o%c`Q
zOENJe?$QIpofl*ofqueQ!tE~uvXszZ2LM_N-oFlzg()>~B&Vlc@a7V5d@-Q6f9zr$
zU6d#)8_W0R)yV-%-zqT~wDp9jo!oA?y|JDi`Rfb-y4QIZTytW5edAdTS63IqRYc#V
zhz#wlTzX*;EqTE%#lT|Y!~o5t!nZ!}Adk2K7DPmb@@4!e+>8M>XKoMe?qvrGtWDCb
zV^Io1<EYgrmZ_{AjaoZGqEEhxMp6*SN&sg2Pjd?@zHEV_1kn(v_XD%L!R9oey37R}
zaqY{Dh)dX13{V9Wdtv6z3qUlC6B2}f>{Clv*$J$k#`yBh6*jj^v<t@5o;JfJ=Qb`7
z$@d|Qdk+kXqCL2%BLT>CuO#}JNyj)kxzuC;g~5DK;L~3k;5YvBGCuH$5zG=}xYP*6
zBhMKp^!fFIQr2<l5nslJ=dxayEQkqUG7~74O^93fDAH0+SLr<i#$d>pEeK!z>JY~_
z2v5DfrqyK&G;#?{3RSu9UK3(Y?qVYJbFnGe+ysT+H_1#;F(D+nCzYAfIa%Eb3?;tk
z1dqCBvNNB>vmpV_u)y)Uz}wzA!hiTLE7*Uyz<6f^Dr6e3Y#`zkCIFHElct*v29y9O
zw5m@Wc<X`Um<8C8#m7(<l@j=cfwE$ligEt~1Ke?Yg^Mq5aqjtzOG0S-#y&J!k9m*u
z61Yrsv_so@=Y3ug4#U`o7Shyp;yUuj#ZZe775@wYr2#J*@PT!ZU+(eQn9?!U#(Dt2
zIJOw^+i$uU#}<Z)%IdrqL@6bwbVRDb5!7l7n)x=Uo!nlP_Qu)v;co%}d0p|8XV>$^
z;)1R1t!J6x+Q=ARtcRf?<!3iYOi)3P#~y}J!8m+i6&GH(%~xG=oM?;OhFgetrI7ZM
z${RBWFn2Hcwe@~uMiI8uS`w~m4K3cuf@dPJQo5&nm2NDEglv%(SZt4ERL#gl<Sh91
zsLL6^1dOf#(Ez|aT4h2U`(F!CaR$(CfM$0AW|V+PTrNocqZT;l0_NES^o5%TIC|XR
z`s){X#<dM7ZhqmcYgqs!A)8;JfW+J<g-x=>{TDM(8f*_ryyF8S{N{gI!B@UMK()*+
zi(v$EB&<@U@qtX>M%vTUOdQLA0%jQsP%?~!08KL|!CtoYlf?H@-ZM}REUY2icH02Q
zj~YDn+8R67*zXYNO5-$rnO7!vuV<to<8!z(@>)?Ry%KptC{Pm5QEW<}EmmbxjDPXc
z6|sz-BaXXBU-p3zPxc!Zcx<D<@4bGESO5Mpj!g*T)sX&DOk}7Y(s?0xO<Ag>W>Ia6
z%w<QIX`$bx^Fo5eB*nzs3j-q=3P^Kk8OAWGG2_w42Dsz43g@2J;JgbP7)u@m2&Jv)
zAZugJX*r22Sth-jl(e&)2MI6~-jF>N-n3pO_eO;XF_Q5u7!=^i0yuEo=ZFhipflQJ
zfL0jm(-FPnV;ACBZKx=%r}J(qasphM8r_lv2mmk{ZWdEQJH5RizHzqw#3=&+{=}yN
z_FXUik)LSFvbc$x?Z=wwaikM2TzD(>Y>CpxrA1~VfWa-eENUEW2sga%BHDLi1+;3}
zMoyFpSbQ!BQ~`GXG4Q^17Y|VQ5Uh}`Ov)JHDy9I)<-P2A^7Sd#w2}y^upR|N>IhQb
zbfpB9>zdQwmci~wF`yU&Gy|P@EwKJSV4Dpv?SxCY+7dHUII`FEw{bt?7lLUQz%yv(
z5A);SXf1}erI)^Ril<#O$7G9e{7B(53EMQS&{4;-8$BHq9pm&}XAB`urpp#1E5eC#
zfH%Bt2`~SRWqkdy0>hOSWLkGrw5*51TAn}G>>Gd!m1bQiC@BD9N7?UM@naT_-wl8!
z9HpCb*C(2Y$6^atc2F<r918b^wT!B=7_78->wAXy%~!49zzG8$xs;|X2S$x|-n(!d
zH*4AoyGDa>&Eqzr2`0*q$1`hoh_@ogbNZ2U9Dg`z37P0AM8F|q17!6}K7&twv}CaF
zc!gL0?h;<}rWKrM2usUtI_(hzCZ=$#1jjK%@<@d`Bq~?9FaKYHhBy?ea0%{7^h42M
zZ+t)?K8nRLxt-3o1(tU-xbvX`zxwhueB|RJEC#I$h>ieM9?2WWHp#5c5?(g>au&i%
zmgV3<DSsi)W$0kSnL)b9B@5C`2=l63ysX>Qq$7_b7m#Q&8MyT4K-;)>8KGIyJfw<q
zosic4B??KA+%0j3G@s1ZpNR+HL+^Pb_MH8cg{>FYE*8y|<!DFYMlB%lB(O*hXs>bQ
z%@GDr0{afE(ykpdy5_0JP|XNrgDv30Wu&5Y`PBhy!N;fIr3z-pl0T0V!YY?_Caa#5
z;3mb0E^Aems3wEWBzx4Wbfg6&>yGdHA@KR`BxDXQO2AwF0L||L7LNnfMWE^|xVV5U
zQzZdF3ocIwH3xy&-5x|FMomJ(|5014?P#$yF7UZ87+ii)%`bS~43!NcCTOf4dsGSt
zIZ{z18ttX*H?HA#?YO25ffJ^{YyW5ozxCgiaeU4gtu~0~e;3)_b9Kcd3^|#kA$mT!
zCSz;m(ug>rFg&lUI&vE>(khd%EW~y)(u0s0wbC?81Ii5Nx-JQKd~FF^TP3c4c8!%0
z+~G0NQp&S2rh3#emwZG5o>;vUyvefaZ0b?(XLE+G5uYDHn}5vapE{lh?_SB{7&t5v
zjSD)sS>k{E-Ux4g_c9iR#bDezWf&$W$O#U7+#fjE36-FnF1h#1$VqaZ2`Q!^iWnC2
z?%QK18`8ua$)ZnYf@3enV9YplY=ArN7~!0=7P#ngi^3WZxU1Fty+nP%<Jtp0IGaq4
z##v$v%AS`9n{=HD{PbSgn2NgPu|`xC;H^3M&<VE%u*bVc<PCu(ivx$3al<FirxOHn
z4ru}Idz?vW%q6G~4;0i)H$m;@?FBVA&bJRYI7O~M6951JFMjDyE)G2M5KkwQ7g04{
zE~+8L6YDa>tX(#w6oO;~V}My(@Dm5u=-JmErL#}lCTvrbuEATD;-1{*IAaXZSn$ya
zXn6oy9l1<)(oO!2m>uGQ{9*NXl>DI)ouFjb&1@SadLD{zi}P0lZ&AJp(xnjw4MFw8
zpxNEv;!M!sLI4d2jRy;%W(Jv6z}CR@vw*2URCHyUn3jSWr=Qp2;30#1?<?`#=gzTb
z)w=VCkd0+1CqeBrHbMcW_3*B;>2U?P-vfh5QSj^EvP7?X^%Az*2ICcXz>l`v(X*Gm
z<Gf94zJkkj%tTHM$s%BNF9j=V5t5M$3!tUmm%uoCS(r7Z1Yihv-dUm=w7CBI1|ves
z8YpN&kH0QDH(G^x7RMlhsEF5f3RtD7GQ}Ce7wa*IpY!Nn5)WvJ8;MZsn}m!wc=Lw^
zj!g^tpMS87*S&oS^P<IIB;!9il-*J4ogtEY=dxGTz{S1n45bvMMZ!d?TLN^GepV0?
zDUjKTEEMBe4lNEHEpX=@BV2TTiwiHdpw=Bjom?`h-Yx+EYEC+`fRM)!MDQTW4)ddA
zL0*SS@`UdEbpB>_xF=PmGwP0RfvQ4_ir7VeMDq&ckpnyM-p^iuZG(_aHrDMAO=6<{
z@Ypytp>ktT&$eLN?b`~}H_j(VzX<^H>&`FVWY4?k>9hIt#5MCpeR(<B88{X(C8WPJ
z;zH&MO8zqfqpVsSJ-STogz(&FJdQB~Xp%<EkTb<tzS4l|2D~u?)|Nm^19x1pS^(_1
z6vJeVj%^hMkVN!|^ev3wOj9cEQH3jGNLxm}Jh?Uvmw4WcfaVY|yA_}vpyB17;u{2?
zAo&yJEDu2QF9E#my$A_mYpLU~+wv+v74X52EYs7U+0vyKG~hZDpn};`tX)t@)aek3
zI(h+!9Q%qet4h52onw0CZ?9piCX82_l)l#s!jNx0AG6e!^nrv_NqT}#@|Jc7cKS_#
zbXAaUmKz1?w#dDo?#XsY7ZSteoUbaNwg!*fKg8u1*SPr72DHc*nMu&DE?VEwZgfp-
zf+k~X=^oAvW1@m912D~U3yAsDFi9|r(sAC}XZ>XSE9@k!3QVb>H@{^Gzw^3POxR*L
zYQ^%4crlPU<(!>BOTtiDk29T_ERNXY7(uUgF)+Tda>+muX*)>KN*M2S(rK!_8Zw?Z
zGQgd84RP7!4bH!yfmx(O(mFdE6!6R1CEc>}8O=i3l^+BYUYFid|0(zH<Vy*ndc7P0
zpekUGPQb?}FqHr_5^x5FTLtcUbT{7r`SUR~E}qN_Oi8B_wW*&xF&vQ#0z|ugTS4~5
z`Q*qc0|5R^VgSN*$<<fw8;-{Br)F}Zo=?2*C2B#aK^8JACq@}9ZwQ2?IX?P@bMdKL
z&H;7>cU}-c6ju!5>M^kk>=>7@^BVTvC%}^$7?g3jQ=XosEBC)yN)NGys(^r0pgANB
zpM%%D2UI8{E^7}b0i#+;!9q#xrD`V#+rY+az#DG|w>3aJ-8jeg&tS^Ez~EAV7rIOp
zi;<ea3&yjqtMS~Y*S!DHF%~E|hIgE-{T%cVsi6{pD04w;0T8wrvLVz}fscKv#Q%8B
z5;kTA!=)D1607hL1c2k0n^>M@Mo^B#t{xU^qLMyy$0R9P1WxOjV(D7ALsK|Oa?|TW
zo#Sw8lJHM6f?zdZSPPUxi~WZSy!!XnaMvRhuxygiFKJh;?=nRfuIi`gui7e>gs=?k
zOd~3+O66e|J<E*6NCD9uET0wS%H>`$p3G7>JD%slU@<E2-VYD(s^4GYtp#Je)Vc$D
zdX$vdcmjaL5Ro1dlC%;&1&dd5V%K4xjj9@^=*1IufSc%)zC0W_rFeq$fG7*w$Dx23
zOKUa0{&0bp|L0ZQdVd985)en8u&Ks55T93~R>)`qtN5M3liE@f9*UD$Q({yI84W_o
zjI{Pox;V*C^TwB$6u;cH5x9nlaAI0=UF)TSlxU55xm>j?I}Teh|0#6+nE`<7uDg!j
z@_(J*p1$|2PmL<v+)NI`GBX*!SgH6jg+RIaCrFQOB6oMQ8dw~vOT6}7SK#YMRzW+g
z%AA*Ij1p)L7R;~!Z_Z%vKLoC=3k+0lt?q=fY_9?;=?ST{I<yjrT?-=$gdV|5sGp-(
zJ-1KN%lW<do0%+AxePKbX!DPN_5TX44+3T<Ql78|FqO+AzzyQQauIZ+*Q)`pfn6&W
zFMi>KCP#tI4U;gucrfy>45)(O>nO+4c*<d<I5>g^mI{3R!HR$PcUSPp!2+Xk18c#-
zK<x9<B#@Z|R?3YRJQT#b5m6NQ2(<Jyc>!hRRFW1tN*To9OQ9$`1FK0RkP(OBkorz3
z8pdd~#uslZ@Oyu-gd>v@RAlw3S7l5~7vQAENVt?MPdUe;tU$j}0_XFQgt=>r5YV~C
z^f!~oL<~TNPr^MOm-x(=26*LfFX8YBqT#ZQM}g>m22kmZf;c5kNwAU|DL<_S^r7tp
zuu0fJ@~aq!=&6$cSi9K3iNJ(x(cnob`?T1Z%}|I+X))eW<JPYa@S6X*jK?+#U|=$k
zCc&0u%FyS~rZ6FLIuo(Vb}1YvnVm&>l6w4q+WVRrJs}`jG$Vq7g@|ub_LdL!^h+O1
zgri#(<}Cq+<9tSdpjzIi2Lj=70%rhV3{&}M<~08+as8R~X3w5IbmOOvqZsbpsOyc>
zwzoE(g<^SJR-+V(3l0NIaZ*(fmXLt#T}I@O#w;284lHB2Wjy_vhfviFTT?m^Pudp3
zBqAbkNw6nophXLF+Ope5Vv|)8*Bg@p<0QQ@#>)i~l89jSH3i)mL|gVc^%dy<Os=Yv
z)~5z6>_seqVgPC$0nP3Km*;`X^Sq_80B8WTGhlkN?_S}@D<x`5op5`63BWn$Se$(t
zWA|E%N}2S5ovEjl;o{C6`CP(0f(S+h_HPXF%2zGZM?N>eaK*wHH$h}vJ1PDj=G^yz
z^4d~lKrjT;(UM5A6+~g{S^_0X%A^uQ!-axUL15v9q{rNypeTf~)1?IWrIB~N$AOGn
z_1X8}09Rbjxa_hfozWnb426uDIwecr_(vY>nZJ`!tZukh8o^^lCoiuz+n^uAPHeTx
zvXsWujtmYQtMIDdTE@+Hl~`J3knwQ=Y8--c)e|L4i{0=tNyX|=0wof}bowO>VBPg-
ziRdLl^<w^KcmcBJc(yKOMMx*RF$O3Ik33|sG6bIbG>ZYO+a72rn^e*b@4MCcoZaYn
zfMo25mUoP-TglIo#8(t|0-uM+4Y@7e``3X*?au+o=q40H47&rk>8oeZ=Wg4Ja=8``
zM-nn$rus^qiAy?a9^GL;1<h`+2Dov$@x(Wm0P^e3JMYB4{rBO@=Umj3RrS6C?VWbM
zk)T}A8rHdLV<HR@Ow%<E2rUY<Om4f^a*MZr>Qa30OXr|Hy#<%<*%;9c!SjOR4H3-H
zfFEB+yYC3Na?Aqtm=ePYrgq$&5Z?M6y>{fS=KPL=;N)#kKY68cRD1`6hlAx16Tl^4
z)<BDUKu7*FuzfQ?D*%lFSmyzt(}1={*j^MYWq+u7{4oGbZLx#~=by37L#o|gB$oTD
zor5m^Nb91<W!mXa3^Vs!H!wKPgx9>T!n-~+z;LC3sVvyA-(8w)UcKo^sw)bCK5}9a
zx5Rm68V`SA260Ls9LjV}GcEx&lM6hw251Se{s)`7OaK6Y07*naREG_SO&ot>lWb{X
zkYAdJ>lSPQaW7ggVw|+<X0Si;hM7?gTO6MOZ+z<*`;Hc%F~vSPMljj9N=gj#L=i&8
zJ(6-(!hGZ|TTxDUP_{p^g#O?$MyC9QLJA5(a9>uZFKYlyiVA;p!xBF7g&~Hk016uq
zmkCP;p?X$Uum6;jBn6<G6u$8fhV7m{8pHF49^SCUnc$|C6l)0QfEW|WFZog<$E-#<
zkGnJNqt`wLih4<E8C6wd%8b{%aTy=|><G=WOX=+tXaUHyx1HcsR^G2@^e9o3jI%J9
zDsVO)O4=jS5(h>qr%*4f8naZBpzDT#MHBfpdM${e;x`dYGLCK!v9N#<88q|BcWto}
ztEW0yPa?tk@Bd6!&HvJ`Khxe!XUFiymp43K+4bn!%J}^}U*D|fQ(|(KrVP-D06&}f
zj_TvIo?49-I5;Q#x3^u5+YjzSvD<RT&LI-c<itRxFhFI%4;=;XKMs_IPdedURurO(
zqcr2_(h^`GH%$5?+Ve}fIFz?ko6gCYPlJ?vZNU~)RWjm<isb!O!~~SP0DA~H{$IhH
z9{}?RpdnE1Oh*h$t02~^1rivbmSMmIt7oT^{fltYArQy3#OFC!-+|u<;1Te-FO+!K
zjRVlAg&A1b5cwUp=!l%@ajun+(#_JX7WMo7vdJt0c8B&91yB}@vH+@*QI+90VNemO
z(veY7_*CUaS3#Ok(w73{x#@MlORi0;PWW~b7#57dN{ugnwZ!{x9ARD>a2cjA%}3e;
zuP*_`Pc~e!$|T$qOXzK1EQDqc%}28?xnY(2nFK?{<UqNrMGWbvz*lZ7@%DF=;L^fW
z>@ZkQ{0t!SkLYOoNHfx-!5(PErGgMoV1jaC6b7hDU|0dwfVe0Kh71f53PUJMps2t_
z0WOH6XEI>hG$cYcQBd##q{KDo1W1#@gkDmJZVU$y24lw2ErZv+ZiM}h7ck=@$z5S!
z<l;)pTp+~KD4ykP-uyU)+zu=(ph$^gx@8@Kwh|pmR3#eZK?ye&+_Zo(VyQF$DnCAA
zoVRBK)GRjcQUXtXq?)ItNy0U>!@>Yua$f;Y-s{g20Pv%a9^e`M8~#T>{7ci_yH?-7
zJhXQ;v-NlahjzjxOAbhc6i~IhCxMt-vm35V@%6`c;>|Za1;<T6yv#9{21qm{kDPV%
z%%IAE4ba|q1orTjiw8LQmHD}lkaupqq#@7<Ct_V~fhZ$6+>~Fcq$etvPDsR*h$aT4
z#YS0YnU*_2n1VK5588MG&`tnab`}B8L1^6)izN2kBO+a*5>&;yST^aTHh=Im#Fr^p
z!Tv=H@X+A?{Uu)W`%8G@7@-=sF105m!KZST3w@EqK@zOVipd17vWDH?rXZMtP!s@<
zKybf+A;Mx#*gS5qex$_l!zHHc722&5?RJHFtHS(5h3%sQoH$hC_)&w&Hj!-!#t=+l
z;9_4$O>?vcql3w{FIX;0@I=+BR-zDA&nC9TyFW0%qx%U|X`WJ`!&^sjHA-3MtX|RT
zHr&h3V*pgynn*Yku$(<8%MI2PK`Q;E+%)~sfN*%T!t4KVh(`|@Pa870GEih{L&6)P
zuL8lxwcxnj(L}lr1~aok(^QyjRoFaMVf$!_`9=lauE<PF6!U`3%%I&WFg;%3_~D8+
z)+?H9SFnxo#<z<^rvUIfISo?#(|D5xaA7Xlx4eVkeE*p+US-^J#|UqJ`w$Z{pi=XI
zR_KBpa?4jvJ7<&}r-<_h6Zp*E>3du^ASJDmw+#Vx<GcVSqous9ew>=R@W(AHc&Z$(
z>fJEDJ#!N77y{_j3IRa*=TYeY`3uj*_rCO}?>)Zp`L|3?9J{g^tnDaA%V29WVd9B4
zEas$j+-QI#O7m#gw7__V8$NjfF1z$7UiMx0^Jr!WjYgDeB9nFi4GUn_z&>yoG$>%!
zMlQOPPfl1-aG>XrTwulK3b90@5rlNEixQw=47yF=ynOj`>>F#>LJ)Xn8D!_+%^SeY
z5%Ai}U}ylqBwm+gdM%r;%jVW#Fb0z!K-<`IERw(qfF_$>3!o%SiEzUWBiwSw5W|%Q
zR(46qbq;7ytf#ZC(zQ9J^$*Y><OcMSz{Uw%+Y*|ZFrON5LpXg0<D5N=;mD#Kv{+rX
zIQtBX(@(P~3qsuzwkHP1)`9g6U~8LDFG_4}6*zdf;LRz~XxyS0v@lf*G7M`&f3?8Y
z8~?<>2p6q88_H#P42o*F#JK&Q3h)2u06+8hT9}!n0gmGy)>rfB_@oCV2*^xA;k8K1
z*bE5{Be^Q}3F9uK>~q4F3Rn<SHs4{)+REVbpD6L!&kwm+YRN`-zwt$|8c8>V&b`l+
z+MoC_!Da^vjXyJhQO^w)Q=py^Rw{#Y_7YakvKWpm&N{upIcHkzJ&m!t(qd3HG;0_~
zjum+9i4yytC~)FLiKZr;SO@k!L8!@KyaeYVC|!H3P3#`MU^4xH$o&zVk&&LIWFVcB
z-^oZuZ7goMafEMuL5**H#vIsgv$!WY6Nsl~_L<18dC3o<=PjH3IBx-P2fAnBNM%u$
zoD_;opy-JRm^VJH40T#3qzM9|ZX1NOFzVarlnI^%F|Jb2AQ~)jslp@0Q_BPJ=K=tB
z?Yay*2ZPz}z2|;#Yx2l<O}CG{q!=u_t(PL|JTPfTzX_^IUSf)fzNi-1niqKe4VUAo
z7p~*^7aRp2rbtN1;?B;W_vjhJ0z6;9-hUXl>MYQ(1m<m~!x?G4N1U^sUqN^UPL>hU
zqMwR6l;Tfbf=oAvvC`nexv6bLO1dq8R006ITmfW2)6anHF@U!~#kfZyarVhs6d}om
zs!H}xrFTV=FBAl`^y>xdAPIXWXZ?Tm&I0dv-xy5^3`&>wRDufvV95n*Ng*z0#(lO)
zxMYx!J(4#DsON-cR)8DE*?WNNpWEP^^B1`8$_7t;3gfihjAG!{e@kMNhNINB)}RHU
zWx%pQJuk5TF~-fe7Ifcz13dajiQDcZoS0NF1B+_Z!W3{ofRpDzZoOkawOtt(cYwz+
zrGl}b3ZMVN7(ej+3!J~w0`YXX49xae)hepLN2tl;t7SqKRZPBpG`ecC2j%t;l3#_B
z_%gclWw9R=E(z;fgd5&B#E~sS%e#VS$h~0$xvMU+_tvGgY#oc2pn@@OEqJj_uyuus
zfM;LX;F3#fTygON&v{ylb1nd?A){c6(l81l7$2kzvS?eNwm`!LEEiZT3Osl}@R=`_
zcw}FR`|dAr_x&X-8JGc~95v1nXG5xTlNzPy7HNz;FjT3gIZ3DB9kZ4&99ukeu;4en
zZA_P6R^!ZJ3!di;%z8ZfCOM2<)QXaydW@prrHaC?8`~8?xw7`NJ_CrZF(v}f+H|ku
zi3r{UfQiwz1=_j*4A@HICMhu_R8;<>1VF>~LU!=V7~-NhwOjyyE&yQnZj1eoe*weQ
zi|$`uU3>F<ee>F8cH+Fj(he}U5Ef4i;BibUsVE%$soh9nU+Z9bhKG-g@!GdvO&9*m
zEjVXo0^TH`;6&Uclz0fF3gr(B?1>5Zo+nUTc^0TLpt|)Dw-8D^w|oWC1fT+I@@Ipx
zBSay{N}2ZvzG$&(Y$2;qdz8IPv9niOekAJ>|CD=x<^aGgfJ#}P!9tful`x5%;$9Pk
zI0JpUoahB<3ngbXDb`}1_KL985N^0(hzIr;81JyKR<2KlHUBV%sZ^EtF89>Ls$AQQ
zw+`wBu-F8aO5hn+FYw|QFYwf>fa{*xVs*KJsaq8Ade;J8%e!R?f5Ie@O*w!F;4xwE
zWsIj^1+>QC;1eaj`n3YL-Z8+3ZyMl{{RQR>43?b2$rWTerCGSE;t*1Y1dRd4OTZUy
zsc_rZDqQd#Ucie@87v7%DrMI7=e{p#!8rw!dAGdc<qT*@HPvAULRZ#DpeWiay&vJ7
zG4R>Xm-xb$OAMBsB8YihI7OGsR&XLm-%hbU&EyjbIb}KBDnJcz`fiICea9TndHMp+
zxW2{(=Mx5|foZMVCtq7|&2ASh3sGPQ0|u60fx-es3oIF&^)%r5&stzs7r6fs!X0;(
z_{yzAeByHhJbtJ`V;G|)>wtj6(PDF{JQ+}MO|~?bHa{pJ2}3}&#Ps1$4e*lhs_=c^
z*}_bvEY-g$(jcdTLwNzHdK!`jd&mqLjR^^|B<X2}?1@jwXj6h?BG9ac;)y^!!q#F2
z*tq0bZDXh~*2^6eMS0?jFpR>8Vnq2bQ#i(u7h`a$0f0Z3-mI^$<IzX=<Ix9x3~zns
z))R}#)`ipU&8uj*RuCB?SP>NrL^q4h8W!gu84W?MklPkgFz$bJH^xK8Gp;*=vSFv^
zO*jJ3DGic)yL|}&x$QA0W<cG5_AJGdsDc?Lg;Pg@b&MwJ-j*&k?#W-xQVM2YW!`{1
zyPia`>BYPaJq+zrsd3yY2GOsmRuvMCwF#w9Vm_Q3HML9TI#=&y_|7efGR$g;&wRDQ
zt6#H>N$XC-i}WG4?#OmVZx0X!1|=VAY=T8RhLu}`*+zlW#=r}ov%oL@><lma@flwH
zf;leTyTGWaQO;YK1%qn#M=P)o+E3~wTD}%;U9xe{Q*B{tMp;|z9JRRW@)pl}R*UC9
zuf^G?H#mB@z>&ud>P3Ok(4AOKUg{Sl4|5U!tA6TPtxCpxO1SvU7EgahjVkgGk_9G6
zh2!@b9iGg))%P8JBQL0TR0zvk+E<Z;ArzKKY$fTIeJ~Ffgb5qG?VV$M^5zjn%WVcq
zC~HBY;gn;_Csp!w8*+xkY#V5|2^Z}J{?7N!@y~v4iogB+Q#|*|8TM2)%0&w^Z-F^G
z?@E&tE>YZ_7CA9y6>I?1jwXs(i>hgG=30$wpW5J=&uQ_3=g+ZwnQ`n;fg^`XEaoN3
z(s&%h!X<4&Ph$TReMc4{?OylIC@aR+c7ge}!3(~_VrAgn6spbL+0TRcB@J~w1Bp##
ztWGa2<p&`N14#XZt^+^;P+5QvZUB?H%Wn|sLkI;HN_qg)FnHfh=i`B6W0ZpyVYf?a
zYm&Kv9ipyLyJEZtiVW)M1`O)2Qi1nxtsgjLwgLXR!kK^nYd7IrUh=<9j_lueY(Cli
zmd2XXi{UDK+Nn5&iO4eRQKB$N{o#n9C@dNPhaTC1t1dc@3oh6MrqL)vNcEiPQ5@{T
zfr9~T%m4z+?xnbHC|=RZE;=WI?9vR8OlZ=rCf$R;Wol1)M=*;^L|;=5L;~SzajPFl
z*@-;v5aZebAX3>1#NV@y+xab&edqjlS(g8s$za=*_~RRf_{e957_C?&F=sNNqiF?k
zxJCPf)bfryFc(;C7Z@|)#osc=FZ|3l{{GA6xaP7s_Eas*q)nS5qBQZe5d^N9WI>l<
z{Ef2&V+$?7Gsd8?IO{Zv>#ncy{1?>Ny=t+3m~iM&1xv)$AYd5bAqk0ONLzPmB-x#n
z(KLju4d6RoxWH*Uypoc0nkk9|-f|j&P8-`x7?}l@8m?ff%#+Y}QO_R%Y^MNCS2R_O
zdmk(CyRTW{^+`$P$fod*c&eeVJNKgGNX57y&9((*n+48Z1AgTDr}(8`*v8-b{sk^O
ztHDy;05b@SSByiSwgjc6MG<Ha<}XH`w*XHWV{UQI-Ud&9R)cT-)&*8Z4UQf*c>M7K
zC>UkcttWNED1~)WAm$}&h-o}_q{Q{t*SPrH8fMn|ab|Q-zRJeONv6al8NqLzI=x#z
zYEsUd1fWmQN#lW29Huk?4558&16b5R6|A((_z1{j$k?_OZv6N~czA1sVo<~FLhHbs
zll+;=4ZH{#)YA<%Tz|!w;scY7$G!;w{=Z&#-tsA2cFprQX4}Vi&nDZ?FvFddDM~o=
z(CB&SlMF)r1|cEAfhk)Y-W=eG!%KMD(+^|M$_zX)PWh8aB}$Uig*Y#a^CoP}V1^~I
zHtrs@(n(69EgGfxBq?=nXUs!+i9G_B^MWLj71`c|(4`*X7c#6VFryxD|3$gq3+0n_
z6&02GRvw{}4uX;k6snsH(5S?{2P*uR-yULpQlJ{Lk2}yRmwd*j&X9+*9U`Kq2+RnC
zwl-)dC7yo80{`?MZ{w%`@f6oT#bU)az|1<=egUEIp%fp9HTpCS$?{NZ=?WxL+^>w<
zqG~Np-`U{V&u(zt(=5ui#eMfzG?^DDDlsVD1I0qwCO}3h>5p%WZGq`_g}?FQ8t0x_
zgXjIZ**gOt2vk_&9iSV33q_C<u0)bDsh6Cn?3aqm5#${yMSj0RxbuM_|Na}6$QnX1
z;FJwAOnlmCA8AfZU~DE4P|pl_Uf?^Qv%oL@>=yp+k4<pV84ZTD1<kTXWuGbj_`Cti
z00@9B@2?Lym0ppWG2j-b?{4v&=hwLQx&;h?eGeDdniMDoZs!1E9W3e&fA>K+Z%~Ll
zYlD)peyl_Zi|_ol1qOAi^rv2;%nCc1j#M`?04``%PP#yd85T$+N$OSql3yQb_iuo#
zO(%bPkR!*N8NiTnbUwm+K7I-I&npyVi*P8g22B~Li*w0BM;I@6K=ovUD{8+oDvJ+p
zeiH!v$*#v9{@VQfi=KLPy1jAjyx|MV;i^f*L>-=Wmr#BXN+-M(jYEQ|EFL|u45|w}
z^ZKJ0u_ZLV4Ec`uUl}Nc0W5<zW}xK}Xl3LR-sA)$Xt&Rm8rqsPbZq;{*AGI37j=t6
zR!&@=NKZwS+OfmZ8gS=WQO=l00CS}P<eIN6zZa-w%CVClo<*VVvJBXz0ls?M5O29*
z02+ubXT%&cfkHM@?%z%VSM3%s4lp#c5^Ln#yZ`c+Ht`+bvcQf4pcw<L^#(q{9abgL
zSZ4KSf=+*%dL7-v!V-?{vH&%1dHC$J7|(q69A}+n@#upU4m~k|DHug*ov;d}=G8>N
z<>%Kjih_W;z;#zIaMe><6bqU7q}zNapIx8BfJM?(Ah)LtVW9K9`Z57R29&z<o++-J
z1hWRya)Emv9MU`AGXh)`y{O$)ly;+ZHCI^jU;wi%gR^%Me)7jB`1zmN#51p6U|2IS
zhng>`Y@^Yk^jSvR!N!OfNoc%0@d5!<_(K|MM%e)8p2c|1b1W{q#Nx;Sg9DGb<Y#5&
zx3O8xbD>S_mqJ32E{jnR%jamBP|OWp@Vpv()*4V_Gve$_OZV#WIwsG71h3iixl28O
znjT@&YnYVA#a-;*01UfjTZ#Cgn}D&!f$b%{_ofT^a9xlw7R-g3u5<#eBUT*^qk%!#
zPf|}eP@4AEYB>17=K8)<1_1m8r8QzY`~0Wey}G*c7FrxT+)Ot?WYCQd6?xmEjg`KY
zlN0mfFhItFMh)Km@$>QFo6kja8mE-c@gh}^i@HgOl_~=)8rTO8fv0nD84p~S4N%Ok
zyXgK?iw?Pqt;0EPY&g9hI~JHbB5Iq}l}FI}Vq@;0NY$jC*X{N}GEz~<I^vLNkAiXx
zs0bRQ%A;`>?h8xF_sdiTHs`=iA7{+wgrfB6ykm2e7#1K)Dj-%*7RFgXvkl<t3+DKh
zf4PBQ{#RSL`oac-i3QC=U{H4CtFS`VunF2@5I8qq<9E8LQs~QdV=#lJ4R#M0Kl(#6
z{D)sVj=%YB6SUg~i@9;x4y9Eh3MN&c8|Tt6<_pF>_m-H~kXlGz3ZQDO8~dq%S{Q^}
zndX#|5h9V|<WzbW<tw2Z08Sor!wlO3%qHz(3%n6%9%6eqke2YA5eEjaeZ0Wc7g_xJ
zFCWLx|Dy>m*=u1Y05u|}Ax?ZZe?#O!!P=a&GO3XhbVMo%4TT%VPvwNMhibg^#dG|p
z|92Dr@W-~X1jcmJ#CjARN-qQV&v&30fG{3g-1D%(C%-uGYv@8I^Z_tAQxdr3b;_)V
z>bIwW;JL7=)Q%}6fr6(ojTZ=5G~m_>+B%8&0|N!&_@u(tq(C^ELwc`tb14(e!a#~n
zW*<jJ#AJvw-0`Hp{(=C&`|y$X{LW&}8Ry-&x-|M^Gda|>ZNo$+JCrXaZV>WH1Plu8
zz#d(L!In{04Gzr;y!vfV!IvM|MYM~-)`-)@^pzAf`?V_u4-4>Q4*TF?m$JAtTHA#T
z7eWqqKmv!fy5evDIi>B*{ZGiWHfKMw2U4?m)gw}rDn3rqGRgY5FFb9-iL}q$S9Pw2
zyTZb^JqjvHLnST3c+f}qF@)*D;LCRwm^LP5_zMmP2DB&^p?K1%;lFlk;s)~#;M<;6
z<K@3L!4Li59J{LpFtKTufCvg@nBGy2inniE)6^!x6Q)lMVMw<digE+tPHVOp&RRV0
z`Z@mH|9t{~_lIY|+@PNN?PU-GR{`UA=B0}{AfRn5*4GUh4iGT1lag`T8qattwmpgH
zH0l)V?ht_5B9JUBJ^2&`dmb{AlHmE7jynK+(5xkt6{9dxh^GWkeL!3|a$p;S#fbvX
zy}riFe{BPQ<GW^9LkpgGASk^(G6KD0oS;XHq&_Ds;L31Y(u7MvfbWP;WU-A!v0dZx
za~Al;pP%91{L(g_a^4*C6Yv&m@??Z0V1RVK$h-j(D>F>Nn6|*94;hyoFUwe&+UDs>
zB_tDg6Nm_19s`~jgdvwJ{7A$y)ggOGbyARxkQppFEwRjM=l;*|rz<ZzxX=K{w+7gp
zmK17_<b*UIZhYKGNiR(T26D39dqq+3U|8W)y8a>n00G|z0CeejS3bUDb?tQp&+cnx
z>(&%TO^EhJWfKs8Q&bf0wkxA$V6eKtU5~Bd58rVG4)Kt%stH@S$|F>{c4!DZD8NUy
zVIMgLz|%n+psq{LrSe5f3mDvqlZz4KJ*inqmBFG-faVrf!@=rbro4MKcw}f|SQWOF
zYqywJUi6U#qa{xBtRlxx0uBjT7%4a?oLOK2DgZVHvqh;Q;HBadBMSgz{8%Kw9#Xd&
zOtuPCHSi;UbB2HaE8BSX)is8b7MR&M*3^aqv&nG7lNofJugqu=B(t?Cr6DKFTa?z{
zvjlG4nE_}Bw8=PsXN_O{xe5OMkI!IcgnDAUMQcIUYDa(@^f){%Gs+S;>$C+53Rw<v
zAfraME8OJg3_*5ssi}7)cuju?8je;d3#%MGMNtpEhA-!gGf!)A*|`nal8*@se48?1
zTI=W6x7QHRE(-8A;k%zV!^?l=1fGBG9L2T;&s&h+))@_2>*hZg44MwR-Z5c6Wc%5J
z@{qWQvtbuVSy<7AEoi&Jj&_b8f9V!}<KJ!KCC{H?ae`qN<nj-|CJR*%pE7hzHfshL
zE)kyCSK`=)JHn#tkzvX5O0LCIH8a;=JSRc$eahs>KJie-!y=uqI-yZK6-mIm&Ujh_
zo)6sEOD`M+{S1)H=DF1ju-z2C4bU{LGMDCjkX(r@@+}a73=s{66^+ItoJ!YU=*b3e
zee18cd(S!Zvui8ExAElAq@HcM1nTTJi1aFJ(!vi8S%)-_fIQd)pz#7Xe*QeX^Ai_g
zv1WnNYacIYf?Fy=<Y-}emN5h_4eVnZXrDOYqE15snB1)?p}&B=0jtMDF#^QSJg2T-
z0e)+tk+ySdrt4ZGU8R%D(`1^8eEc%qval+(Ko<S&!BBmMq;eU{FSzF=G9Y49g|`BV
zWG3a7T@WC-J_|Iky=Aax1pL#VoZw&n(hOIg+km!P7|YQT3VW7?Cq{Qlq(+tM1)5Y4
z4k3Y>AMaVogEGZvqyuC;0187sv)EfL@N+*s$KQL|3^XG&Gj|?=jS9w{g{*-QVbK&A
zjtEbCT8nW>dfIY27jxV3>Vy(0ANw4RXLOtey{XB`aROyPpmRE4c!&^q($0a4&a?Q|
z=gm=1-M)P{&Vu6fuz-vU{wx*-Klt4<{JVd%jq5L}K^qLTp=uAz!f&x29=v1RNAr>(
z<=hKKNW-1R`eZ<&7mO|#qnX8XuAAZC{p(Hqz<1BF*fOZ+28Hp7tTa+}X^S(1++kYR
zn4$zuY!;Zzbl}`K>Q^!>f^j1aA90XXLL>-ES7jN^0}PeHBF0huZPWQ5^Cl|!<P{F>
z*Io}}fbB(zX-j@4B_7sLBcp2H=Un#rMN%RzOkoT2O%K4I^it~RQy=-G&6VYqw-r45
z^lamxWozAWeNw1qic;xXQK)<bAXs9UVU2CW_@6gCg>SiU4`^2#6>KDi$giBZCh`P>
zN|)%xK717R_!Jlx(NxIn)NW6O+et%eVOdDUtTL{!;swcDS^-P2z^UEPGB;XDUJ1mM
zp>a$(V~&96_1@#iY(fA83xwG%!Gtyh>7x!fk%BIMCU6am3&zzKSqx3uU!Mm&C77ot
zJ!Bc2oG5V7o(BK+pKstF{rw5fS#3evHl_}Z|MDrz@D!08<YcumrE?e5yoy$KmdB%K
ziz9uBSSbOz;B%cb_6%$M+)vN&vLBzKnGouEiK1}c08WQm#1Sb92Ncday}>1yGfMW!
zjym#P^eF=ff-~YBR^JQ72E^@c0u4!fx#P1@B&#Phqr3d#$frw#7BBj)IW9e?#bQd4
z6`93R&(2H(6@<1mKwaSb{>B3T>=(9i`8f;F#ER-k&!hANcGj&BCr+Ph&$^um;6@;*
z2(I;|c(v1UUw^}(E#Q)~8vNhCJjdVufjOFq!D3N(S`(*EW`~Q2@+o*5Y(p503JeCh
z)$f%#i*h{Zj7wac{p9TxVuZLe^N7Zs!b=prL+LxgB%ueEfq4TiOge`}rDf+NBYgv=
z^8yR&=|T6jXRIZ8YB`<2N;EaNIO#sfC+GDSezqYI@j1_X<~=)h?*7BlPWIQ+bx=sk
z9^FdrbI15an*Xj5l9bb6WsXOW5AphUUV$g-5opbA_cF>&1x;^WDLM9GaAm+v1N*=c
z@U#Ic6R@CaP^{WQ5xHDOi%iNE;RslyK6Xy4$kD0pXb>>T1*eskTpU2gc#_~lUlP+R
zt5_&-4vBCWDW7;p!E;KOV?~-zi|B4;70txJtifu<_@3{ou{5-(8@Eqewu@zZAsCea
zVuRU6iA&G4_?2JU#1H+g8aoWT?R_1DsEH;R#wr&+D0V3-wYV&htizNjC0Tp9(1Q?4
z)agYgL&A>Oxy9bG#V`Ea3_tY~6JW-urv^j>L+<PXW8kd70;p%e2*8j2ojJ}wy8$ma
zd8?!a%Mv_snr`7m%8fDAJaOMmb@!ppQX4~Tp-gi}sx5AO!&<JY(HCWyK@*E-KcmJ=
zzi*0xwOGtuPJL4nQQ;5nDcqT3(}@Ai4Sw(?GyL<P-^8V7)u6cEFOSXA!k<DXDEyN9
z(*qEUlbzQ0egC5VisP$KC09yH8vxp|7%t-~<t^ZXT@C;1U!3AcesF<yTA*zTz>rT)
znPQGe$gnhq?y$7^q`+C{F?R1_ptTOPvotVR@UZAtj0519v?@5%lzb2#E!{tkh7+j>
zWg){9?Jx%b0)pF;y|B(k%=ij`Fiw2K45O|MS{QLUVNmB1ea8I~;z!Rn#9II}bIZ)9
z%mx4ee?i*-vx^@3>gVlcPksKu>2zz?e6n?|sn!NmmgL+%Qc6qrO=dc%ucBqne)B(5
zY4N~AyJ>0I;Az($MLCBf(j@s~6_FSyF*<=jg#jit&{)uEs|X1)RNWoA%J&C{@}b%u
z2~MOvbr<V$RXZVsg(qT?&uR1=_8;q(h&Hh<ODEFd^qpjARYnr%NeMz4R!G<xig}$7
zVV4(u1-SX<3XdMBFc=Bu&*$3<*syVLcA~`P7chS1-)!N<-@d?b?ky)0mTKPM3<ZP*
zq^JZ%EP}FF#Mo-fE!&>T&|}^)^R&k)LJgnr1Px<lOt|*x?)>@tzh2_Vx`82s0tB)I
z+ZfC?OY9gH_=hi>;iq1<jWudPEhDQqc7il%DEgGI=uBv$jbX_x=B5Z=NlRJuS0t?p
z-j|>d19;NBqbpT^TA(Tk7hch#V8X-q4{+>wfzlY)9Ls1MgV|PrGj|Yv^oJJsr~k(s
zmz+@p+ZK7uLr>2Y`}KXVhf@+Vp=ZF-xQ80mW15yytRQJ8Xqbuyv}2WU?bBKuJ4U$U
z&LOBE6cxJzv!oBkmt#FhF$A=Afh98d(I4K#GcTLMY+JXTP6Cp+#iDCucZY#GG@#@P
zvhIrcRBg>bxh@>;tnHS;kDUO(ph9?Y<wytFKmhGzeD?0W_~b2Ta=BDPyR0}p9P87q
zrL42$7hBr-MmrvuTSnvYhYvk=?<s=<{?ZZ~A9(bx>DlLB^Vni?;+jQWUs#ORlJ`<V
z=jdNUoUm|0P*5UK(Ge&lN-0W<7DNa3t>Gz`Y~aFkx4_#eA%~{+w8e^K26}=cy3ILI
z6)?M&02@*ZXFx@w(o`^F<CO&F$nah668#Mf5*du4iPb+ElHo+FKK-q2HKEj1&7_rG
z9DmYQzUXep9Vo2_Mz+qL#>kCbvRW9xj?)ZQS6keC^AIN{1&Yd@zaD!_k{X;6Tx=O!
zb*aU#{PF}ZeEtIEtOd0kb1FnY!eRXSVNjaro~h`WH-J)tLIg}iT9yd>!chUrL_6BN
zi0<cb&`D#lGy<OX^cI&~)L{2oft3+J)}XKj_U;6}^*J^E;ZM%+6F)M+&Y}SpGKH)L
z$+<!!*|;#K;=cPF&V2xKFe?#kq9myh0R<LG9_*Q?gH>cM+Rlg$N&}E3>|7;W_YA_N
z7d0U3(mKz#h?fS0OU@(uj^{D{=|7m_$N%;mXRa)~C&<RF@~&Kw0z1<KQi*nWMz*W_
zP&Ts(+$2E735fJyhP0NRN>cOIGIp$5TyuSkW5)@1-c_J!31u0SA9ujM0l~Hg^UVt1
z`MhoXlb<?{m9_;fgyI#-zuT-J1JbjU&2=wWkS?P*4tg}>hy|UDSY&ELRf1;??12rC
zNpe5OA0c4M765h<K6~3)`0Q<GP&ur9<zY)V3ArogNzi8Adq=y(?QFv?4b3g%rSV6e
zc<i221_1oI90v6N@uIyKU--a$dg6`i>&LIMv$Zpe@lF>m?KFE5xsi9g5&;W>arb<T
zs9ysmYMEfhH6A>^g#Z4>PsMq^w26yWx6z&;cRqKN;+*L*>63TsNGJgN@G;QJ2xiw9
znAIZMKZrm{OhF-JD}XG7edv?qlTbviTthYC^uKgiP~x4)bVjtFwE*|lX?i}r9NTGy
z2=HYRvi7hLX1RYjtZ687k5Zf233G&#PZo@Fv&MJ6pv5CUR^oSGzlvj<6-H|fs?tVx
zDu`ek!eo;$2I2YF&hT@;Fu@D1Yfx-E%RdfBzFr?Z5t)wCpeMCa(pK~eNKhKqdPREW
zKC3ynPa_afgdpj{Zxyt{yEJXFgMgQQdyVh@_7;z?6COWGm`)5<mKc{@P-EAyLE&@M
zClg4|ZFhBD(rfr6UgEA0?4G%picq-&vbufO;_$>$a;zZ8C<<N9%3=n#TkI_6`2Ozz
zp8uR0_dQhM=y5~CG2zTJ8k~P-jkUrhL*f~Ng7UAEo~FD@o%xkEd{3L>FbQIkU{@+m
zNozS@2U-p7@mbPIEEN(tm%TmF;+%1ffAw<>cI_DBo$ngsiS-hr6-HTluu24L8C)}_
zGlQZvc<xnG{DYs`z~1o!v~I;Xh@*OCTM&!#?a2Uxi!Dr3DaTUMaG)Rd**(<+NU<e6
zaB|KK!1EetTX&YSBD|c!{q6|Ezyc_W7KO2}9YazA%<!93dD^4lQ4cdS5fgp$FrYt^
zYd9)tWQTTT_gM!Pll9Z*)2-{xaA!qD74dJ3sgcqnplWzV@#Q(75OxEIwcNtu(E~fM
zT()@T^@mZ-*;(;M5FkW7sS<6OH5S;cfzy^im2*u=voGJ8!pa)Uk-yl+C?q0L#yS20
zj=cqx)Dq4uSB$VWyi&`;`2=&y_Dcm0XUSX946urE$YPG1Rc}2LvDKNr*a!Dnj@yEW
z0kVnrP+N>D;L@ua>|QfCxWB^V2MreU5`+RxQ)0SVf@cO7p3&eR{O~4z_NTXS?PU$h
zZ3eX=vOn{b2)!hGqqF`AqNMJvG>&T6#Z;%L>Npq4oQ?FLX&}*9@IJ{5sT9zP1!&>Y
z2JafSIDdD8OU|fq&dvr)*1{}UpOLN<PS!{9BlmE#d`Ovq6dfQkIg+~6&FuZ4K{$Vr
z#Q2bSHcXoa5~?~P$GZ!QWomK$-Wpe&-{8`-YMik&$FQkk=6+1V{Ido-KCMee7(GjL
zl-CXIp@{RE#whQ<#70{2vF;;7APVYu(8wb3&)j0ixW)BPU*M{z%&~sF#IYv^IC8ke
zZ0e4s-a28>P6-#BVez-WcN_og|6Ip2u3VtpurBeD3<Q?-2qczbA_dqN_kj?zEBYh4
zDC{*wE|fpxJ5PO<$*=$)n}LsR0|VpbW7??_mu)>!GXZvu@aZp}gD>8{8`W^(y`w^o
zsw7H+mpgJGaiwK~ovt_IVezG<)uoR;zVGgDdI0|ay_!XV2k!q~y!c11InuPh`<D9A
zN1naddi*(~o#!E@@$(a5St~zwK6J|UmP7*tfGwdgE$Xty4IjN2&%5dnzWwrpz|mlx
zNvj~CN$w$L8WgZw6W9lifG$77#Rs%)sxY)oF}yTADOt{xH(WHHbwAXNARAd)<pRi%
zgbS%u8A_*u!w|W++s1G&f&%HwpfC%J7>B6L&R79wuMkB4J;-7Puw}7l$oRW|djrpW
z)&%eWXoUwK7-F(nq8bpEc3NC`-W)Ib))}t6qQ)`<*z7UsIp`e?0@UDkwsca*8xy}`
zxYH$bX(peO(-o*mj)!QXqU116@=?mhvT*C%;Z(w;Clc6Gu@<5gDWOWode^NEaVuiN
zlCTu>_>K1RXQKf4;65o}BdLj0tdjQBE(|eWvWfs6n7}gzbL+k<08)oX1yG%B9gVcB
z$3%f_&rD7haPqtb`ik?J6O5EweF&!Sewu6Io*+@q=mQLFTkI|^zWaF=*IjcQpZ~%P
zU%a)#_SD3UMSFJFc*zTAxaRT&R?vcu!x=GQ4lSUvMrNmPCYwBYxYBA^aM7eG%JGem
z5#j-HJh}j4PHeH5Zb6K*1`&cXVrEAQX%u5k1Q^EDmN;>I3{y}%-L*rgl-k6q&G~e(
z=m#?qT4PQv55Qj<0B8qiqAefb_y6I)!MFX*e|XD@qsLw|T|a!zVzPX0wR9TXzGq>h
zM2SW&F;+HV6eW22ZO9S)U^K@=$5-%%_gsN1es%+AElq%JqxV1rMWi%FU^y3IOrrvP
zcoV!b0-d+Zoy1~=^+u_kuFZ*=!UM`G=zs-e45QU3OJ<8QEbMdls-Ck7)HpE|Q(Cy7
z%V-5~+$$f|Nwf|!w_DtMnW~csK{SW~)Jb#UGTLhA8DZF1Tz6iBtN+OYvu1|vZJ-(e
zODjMLi(&zoiFFFG0N}R|rmTE&>hw*$-J(yKX`$xYP09k2^CRbmRJoB5f@=yX5Yj1J
z7K&a8PtlBUPllMd=7>&l$X4#vPwWCmr6Pk@IV+z+n{`H`q-+8`tFL8rwNR!q$3~{K
zG<Zy7oTfqS{t2ICH>33_tWkpwNeQb`kENi`2#TX2u4$nQ2IPl8YufVVjP4^ZWXgrb
z1ax2-iv=4i>Xev*{hTj=;yB}+!2&<{9W`G1A_6K-?W-B(f<asUXlrJ_8^_O=p#KO?
zbAS?P)FYlq`phx;LZp^Jgb|Et&q1&kVnyNkZ0=YRjs-BSh1H(;FD<Ku77(alY|adx
zI97tFRpn<CD~KYW1cO|dgvALWYE5BIf`Xr%*Iyo-88(FPIfJl!Hy-)ed)mvd`<4TX
z+1B3Kbn6;3T&u{GP%fvG83)pZ8=O0toe)vF&l<)>(bB%hc3{ua0#{#qgsUlBPE6&O
z^43YXrTB!BvN<sat&Bj+1AlU0M6$6w$4jJ{C~KqpQ=?L~457_ebOc9yRh%W{JDzWq
z46mnM@u@r==qEmlt$b0@`>lRt$=?^x$lr_@Fi9ejVz}?N3i^9C2@7fgS}@8Q7_=74
z#$pVMa%N#>44PR`Ym>4GgB_ME;+TjN+ay&;Y$utVkOJR=*3AYwUr>?drtc`xs&El&
zW04Yph9v|E_$a-up{RR8(}-+Cr&%#ZM(NI;E`(IG{ay`GR>VUjhKclW$*~U4v#vY>
zWD$Uw=2PUm?|3}A8vkT7B4@ADwm#2-`pW0ShylV<G3v58FC!HZM=>QjO9QJ~AhHrB
zKJ*~PCyrvpTVB7_3^TPTrWR(KQEUUnCZpJN+b4s|pBOGqrey*2q4_cZB<n3K*%qWZ
zB-IB!PdUI;11y%M(rwl=70_<!#+mnTfZG;Sn%IP#45A@4VC=VJ{PB$!;L!Gfi>jrT
z$t9Z$uE9udX*ozs*u0Hy_U&YSzOp?0^p4YZetQ1{x3@S&uD|d+0P(Vy0$==g#%)Ug
zKvzEV`wy+H?fkugnSXY%^+ZhI*g>Umf5#-C5fPGLUTp_hCNgD<S!waQ4?G2TJbVVx
zX)N}<W&$CkspRxcY(`apn+ENJN5FFnR7I*OO9>iuXmqi1w=2X}SYT4&TXcn;up$Ay
zhu4bwg$FGu@-$v@4{uW7&O(SkEl0OAtpD6HsI}?4*2eqsCp_C^zgqw`yPt-^4ZGmA
z20%;THhl+6?)R((O<Sk*YhSkn99Gm9EF6`eKzcmFt$Y$ZtuSXa<i87^rM|uI^8I{j
zmB%DkLKNF6=^{N&9g<2(P&5tnyA5R9WqY`n1_fKC%#fXDl1C%$?-wxyvb`+EI?n<p
z-TYE>=55WrSDk6=TGydX?(y8Nr!<b)JtbmtZJs6|8|$tGoxbAefr)blPJLHsj5TPM
z{M`D~)fSF_0?)JzY8Wyn2U!bhTF}Dt%ff;h05!l3z%AU~|0eJx1m9Y~I=-fs-8m?d
z{~I_U(Rwi7dY~@yesttdkS)IbWc!jmA;k{)u?YDFU<|mn;CbWEJK!{g`LweGM^pe?
z(*jRyRNnURs@{Xtob0rD<z;GIR!AtoFG;tBF|*-l>6G#S{N(|F>8-$HzX)u73;^)P
z|MU}l&6VGE*V>L<uPxfG#}<=yB4eU;AK66%Np}y>LYo4k6PVqpgBFBxX@Q52kMO2<
zUx}l330USR@S>R-Eb*ueSTi^nG%UcIQ+Hl~&p?(UXod1&!Sr1T)6@2FFDYsXK%$!$
zeR3*U8NDYJ=9Yy_1mc;OnVq0$eRjVVE(d}a4Afe$^pTXkWw*BIg@{Y4?mt`cO!!{j
zZ!A!^K+}S1>;7&SShV1|w_X|s)z)oYnln%%0f!p?JtwT#_6Soz2wunXE{$|ZWhy)o
zYK%0FNWWF$<aG7whA<gP!Rc*OeZV2nNDrlGMU)ePf*1kV1VN{K6!Gcwch^mSa*Uys
zb;`)!^F7iK^wFlH>#%b~pCqW-nZL_jf$qE`VXkG*<dk&fH+McDEiZ(rqR>t`wPL(U
z)<mLx?sM=)r7`yf2eA{AZLw0EY}tY1pr{+i7u;H4VS#xI%o#jqU;$vkiI2ih?VoKp
zdGi8rmLOUIcO=ChJO=U|DdPlf26;l3dyF2A^c@cgl7k+1UyuvDUNqpw!l%L%NK2nJ
z8FmGjVT;+kz=_!~X7AMAVeZn5IuFLTNr5pqc?MWhn#Eu=#Hn=s<pF?B0%_on-}-+w
zd(JxVBjZ8!_ICS;?RGH*Ou-xz_y=?*iwQR}ivh`UVsZe$f`O$O-uuP9c-KwmqFH00
z1XEbhrj(902or|Sww2BiU?Kty4eWsp*aI8jsu0Af-Geb(R;Oj5?Lk;jWDZ?Gcts-R
zAlR~dg195F5dew+AAKK`e}>uvikFPudI1!L5@m{A2o**qAUrS$fS^r4fx=Jglz;m1
zf6py2w@G--{r!c%Cxl$IhJwJ9a*2bO5joI179B;3On-M!g#IkRf;9A^dp<_^2XL6w
zWJpw`G%E>V*ps<1<;d3xPqBcgTL-fGd!p;nks!xF5sGXcbx1JnIj2rb^4GIQs|<S(
z<d@vRtjgrrCsNJqYj3vFpd?1$W(n>2L!yIlE_IAEU^(U5aUAFk1Zgd(^G!t1v72J{
zw949x7c71WoLdQ;Ezq<cD0?26TVTd6??K?1w)H&HYR?-7plr3`m%Q8})fK#Vk>^u8
z*mBGQsL}|B{)sV-Ga<dC!7B+3vOxd}0#9mpv+(g+aV~_9J{Wt%Kxxs;ODt>!F2dOb
zVQwN+5W+zaOlS9r00mB<)I_wkygce6$S3jjmk0p*uUkIxmLofN?*9Ez*?fMn`M6~Z
zmjuF7lj85d_{!3gi(7%H!ddPH)u6_9Ve$44UW%_D*oAU;lcb|4Te=0cEc6^+y0hEu
zBgep-Gk0iE5D_O!qt)?gLc9YZNRVh1!b=ff&C#>OQGuy4l%5t<w51^hfl%zkX(@o>
zb5;liE8g+<qr0D#Yq8hTPy#0VE|wn^J;%>dD7JlV3H37KjtAd&K@r+Jt2CCd+_Eb<
znOF!U>U%WS5nnX&8~?qqp2BP@D>Kx^vb}wv#45UwL47IHA)lnJHdUp}s+6os1>y><
zs{9~1(_|o5R?Xma#zI6+Jx&{8RmZxb2380!<E^mOkh3y`hNt`;!CNdCFy1Fwyl=bM
zQm7_3n}^uczI#y1aM61vc!9iSPQmpbe@mWo{6LM3%XA53OJ1^F<==Ah;>q#?u+C(I
zUi!0|x8+iR?fF{_PaI4cBP5A&dm-iuDP6RhJE0Luf?c>X1Kf6f;rEij(FDI!BzCnm
zR@C9~f(5g!4Y0Xq_Zi;=0Ds=sg_mFXz^>hU-cZ=-fqMHGJhGN%f#P|^gz8Xw?JjjX
z&!8MH@YTmw@w#_kjw4)wMsB^`rvVmmI7#@*I-{T-8KACVA3Wv~juj^EZ;w%@edMBa
zH6`H?D`JmYSPPUWR9xRUXg9$;q`-j?G)T<okUJ-IAJ*2Da^{#boLjdv5MA%lO(-k`
zrTn44YuT?u`rP6j4}w@$@Pdki=b>Ssu@uV>F8>;0J(E+r#QLUNf$>5$UyoK+W+JM-
zwd0^@Q&2MrAx?TeMe%N0LlP81t}9aMsk~HFzCOT_EC3`07utiY{wNoPKobNkgIgtu
zq*Tp<E@g*$kgD=#h@d|AdS}r}C_@rp)|V}KR#}VLyy-vnTo90qJh@)jQO2o%X*d!X
zL7czP^&CA>R+elNN$lYb5J83_A4V+0A}xD0E_$CDB*iV=`quh&c(3p++_MT4TLmI0
zSnGk8TcjmF|671=-zJ-u1_Ezc$?p*NeY>olkBCu~w=ti;#DfG^7H`iZ*is5VJj&ib
z#A)7|i2)hF7$MUk<`5B6q=cp{oERB3M6zMqTFbK?yZ3$*0Q`AhAAHBF7CUyF_P*uu
z;LXkC(4?79IUQlC&o0yJ;z68BUmg@wTLw@t%<3HP|Kd6L%q?fZ?yxEN!%IF#zkanY
z?$6CEC?XdRaC{r=mjc*Gnoe21;<{hY!fGCe>YCnbRwC{77Q$Z$HEHq2NPDDLSSsI+
zD-eRIop4CON8jLiX~9Gb96qqn>i7DV4_fg~40>X*w(oR!04qr#rM6KJJh4rP<>~cR
zM1c$zN{00)hdcst-XNZdN-|r+R5MGuOlie)Qi%)!7RAzmu22@7D^mHrR-_aaEJdZ$
zi$HWUdx{or@+{CbkYhUP7y_th@ErhwI<N-Gn3v<m{-|CO-*+#$2+{w&j3G*3>wooL
z;8j3ov2<<J`)Jba<pY?5p8RjpeA5#+8`u8>c#fVfB;cF_={z{r@e>C?odW$N&%!V5
zA>&UZ#jd;s0#xMQzR+gB)EMFcG#w_I$;`J%2wb<|Srga)qx==XTP9#)0<0m-H%s``
z+d=fEcVi8jYn4Ry|8bBJe*P_U+q690bM8~V2>|{AF8cE4-@d+M_nx<mD*n=9`>3@x
z;5~h5_69-(zgjEe^qD~5mQWN8j?M|c|E{Otp<}BsOP+Xp6auSH?#R`+wrk*01@Ais
zJ~0IbMRM)tdYw~KrQO9U2!*2ilcdRz9(TR&*_*8tlob`rpuC8{r4mPGy(>oNUW+|K
zXYr%f_iSp1tT)`t0f)6QuYv{(fO0#ANM>=5TMG{BoWhGiVkzKcmR}g}wDv3}KDv3k
zs{}nyYXXK;PZ~g+EH6(UvmyPK?44lgD2rs-cTV*S&a!ys0;fia2KIWvrM0YvjKoVh
zB0{87g-6r~h4)F&zfj1*dXJ$&Y7nz=f@iOjq^TC(GCAdGJi~ZskRp5K(=~MXE(DH7
zzS2mpXYP@dodD(?o)Q){`&brf?RNol5AQ0T2?`xx7XT&r(f>&IJ<HD!d>cS>_$(DY
zM8GgduY#-Fs(@UUQ=`3;@+d{uUPD0Lf)^nGP`=mWYym(9XpO=4=D>ju5HTBcV|_HI
z%hM@iP;ejJG1YC;PG0go&-^9;_=~uRh}Tw6zkRec{vW2^c(|S%XEtOh1WT#VY#~g5
z=x%eL{hAQ8?6M4$OAFlk@GiXPrVBA$_DIs|ASTMCJ^&fi1%_MyuUps$k2+;knvBdi
zwkx!X5g03fR79skpLLyhN4T`4A{LAiTw~Gg7nnS}7?rM6m_pIE?pb2DC_<TVkjMSX
z;6ava@GUDL;I;#a_QqWULU8%dWNk_ztYQs<W#I%7%Uucbr?$c^i5Qiv^j93dFqmPx
zrql#L*zT6pb7nsX0H^;UmaA}uT4sbs1QMtquPQ0ZTyv|)0Vmnw=iKUwmU<Gx+A5Q6
zlE%6OouaPrc;}=xRd#mls~k3|gO$rl3WUxF1?=TJogKB|+rS&K37q!3E3^^H5qyNS
zY8(vFPTd4uzXT5Xw%f4e6PDN1Qh)#iYH1E4n3i?Gs}IPFo*t#JlOpG^+eh&Qi{N1D
z2KR=t)s6%K22>DXlFe}&sMP+!E8xXZoDR8DhXBlKS9YQKjS+xwSN_*9II=Yc!^H1n
zevb?(65!7HGvV(D5n~)qJRHk?Xl=ciT(kEZ`Hh}@*I!ux0Dx}(%p02X&prRcJJ&`x
z*y$6KcCnpdz!ZL-%ZC)D%rPY?M|Zw|sIb^BTD;}s7vf8g?19~ZwB{6y6@!kX^4>{h
z)L>-Tu5ZIWb{sq~&NCp|69ohzF*`+0$*j{LNqQt$l(vkpbuZC%+V+wJ13F4L2_ceJ
z2(uR!!Sg^7j09!DQGi4N6uyscdJ!4ye<%o=5Ix*R=9j7x(!z3E5*eIM)bZ~~!4~?&
z@khEPIh=bgBANA;zcjB&?@?FT=>2C>*2}vhL5{GNLvhr3Fj*Q#2%qp6h51a@qZVI1
zmS+Ab&m<&Qi@GleTV1%g185LDK)DZ9ns{;Rm9V5@Q3-H_W4GgCh+YR!%2Xb45nail
zy>X1ChaqgcBPGyNw$FS{W8odeok){22S^SAd&<mr07)K<U_dHscrcIvQUJj*2Zj~O
zHGq26AC5pg83|f3=bnx(FrjYy<PL=}RTe%D!GFhjf2<Fn6FVIc=8u!CjXdSY(GYmM
z_W1xL4asA+1yL|SY<bog>^r&)%V6>WrWw8!*qM_EhDeVtnjh)i5*TPE)9nd$a?n1x
zufNIw008i^fAVu1D{E_S9MJrWixW>Ui_CkH;gee~5RyRT(Etm=0rCB6RO7)ztN7#h
zU5<5>D25iWVxPEwR&McPb=W)*4xFHhz>jT!HfBCS5VW!gOrE;eBYuULm#%#&MY1%1
z0W?R&FSq7M??4bFtyr6n)&rAPsBqbsg%Icj@F~|nD=u^VZWCaT9s;#gkhL@4$8VXG
z+flkXv-WUn<4?a;($`j@e8jZmo&wn@B?E$iLfPL)_t|&Kzb&OpN8#l(Ah(kzfRrn8
z7Ulbg!}#b0a3M?+=x`}B({~&NbD(!$Yiz4rTJxP$D+H=b!kp^yp2+9>ya%Fh3QVg9
zg;yjlMFdTIlDZ(|KzLUyJ*X^_5y6oz%F|BBwixcqrH>SQk?4-tfmD|C86*9z*m)yp
zU9Qiwa2pC<C$=f3MeuT1E(}R_VzQm+Wg_v8*s{vuZ)k#JKrI=_?ZY7lfDIWyld%%z
zjheG;dcqt}YB5s^vS{Sur^Oi1tSRv5kujQ(U);yRkoTPRVYF1Ypkd|7VOX}XZ0)?B
zoic|2h3l_80Qi}ocs|a)=(@XC*VbNF@bqv!JK>bA7g!PD5+H3!k(SzB42AN-H^x}d
zc!BqR?ks%zt9xNrt=bYA0CrGh1ddUz$xY;{bV~sZ>?7+A5sL&tTD|nZa3%btAangn
z@c>FA^eDFQ(+#?dR(e?13$F9P{L;<u1O}!1>9=x;MsESMV38I@C>PQVEcz}qS`Zw;
zC7C=2c{{}C&h7<HyBaKm#eU|nOG9qK69b>D*Vv#m)>3y$JeHRsI)}JUtd@TS9kNtL
z@>QX5a(6?=((G%45bk}iaaJ&Q3(V3e>%1=6I%%IbB6tgw>%a3Jt2#4AftUpMsRIH?
zfViG93cQt99Ur$kwX)PP$}^-Pm!6nR>8klnv`TRF$6*Og(J#8oSh5UHOL12ML-3sR
zh6y=mxwokuur7mAV}N0Jo;m;|wIKsBu`ho4Ewn*Ry_XkW9z^f}>-uEeJ3MW`CQgP*
zY(c~tvonB#v1knrZw}GQWwIET!pS2fc-ql2Y494bfZ!1#z@+u5Q|9`s3IG(R-SqBP
zHs_ps;Y}+`gB#k(;c45t10p!EC<T|lQFI>GO!dSgf`zcYQ;r&(-~w-c|D||zYXw+k
z*tF-XchZyfpphdDiS4m%*h5>upv=q~KnajO1Pm5RCUAOcZ>U=y-I+<PWNG9sydWf^
zn=vqLDk8e-ynspy6DeRuM&dF=l)WFD00<DkLihp#Xoof;ZH0;>E`$t%<CtUJEc%%;
zs&R^Au)<rR)-0g~9*c1d-kqKVLDG~>&E)izTyx2RMc4ue>MELCg9e48)&j)$;s6!`
ziDfQPt|m~(GZ7TIqy@5*a-b&syg~9C4RYNuWZ*?50+4}MdNo1pBJ@0~d&%lMPan~#
zl00>3{{}@5T^dUgJ2|tYNs*6iYMorE%k+QP^`IRDdTV7!cgq<s#+@tCWgmb<e2!DP
za$lje*5eV}8BvCcy%ijH6myyz)nv};RVvvm;5gO|;jJU-HFV?cpNla}@p(%9>5;5#
zh|yZ`yakLAbMELkE#qcnSpscqur)0JYEvM%COe%^EgOqS8xod!8Y{@a6sOinfWTi}
z0FYfwpa0}r501wxzgwBbm+H+!%oal3%UKNsCXVLJWO@|c!pB#RYkc<WXW<<mx)_Tk
zc9H!~xsyH#Pxy$G%=I6P0f^b|I|e&l=mbH4lF`x?n<A4)5vY>s0Vzkz(h2~VKxn_D
zj;O$sbuI)%5IDI@ykk)#qI>mB$9*oPp}ZHyHkH%ib7^jfK03!mhKiyoCZez7*J4S*
z&%5&S#H~zT0Lvu^QBKMg&XFdf+U79sVSN3h$0%wW*IPSE7{c@I6}(CqDWzioe7VOV
zx}w}#qz<HG(f*jJQnkUo+A{~edOv|0P1Xbn@YL941+k)MU0od09!$(ksti?KfGI+6
zq{kCT&ReFVxi#HL>yczRzU>T(%Stk#6<a+H3J>Ii%yJGB9}&azA$(r_#D6NLM``Xr
zf5OuimAo8gPP;`q^K}wqA&dz^a9zghlK+vn1KOyFu>vx{R|Fr6`iM0h1zVeEtxFMZ
zlJy;%n49WMVC&9xYi1?drT_{C!wAzu)}8vmS%NBO00_DcE4|)r+Ok?xIwh_r2>@`{
znHOC2_0_c<Z$^FmiDq^JWD2k1a&yHKGwVC<lCD0A5wwM|n3jxp-gF^uz3(*8?$+ta
z3`NTF13`s^aIu1cAx!6Be^!7ybFpX7c)mSOnGLL}ihYSnnpHW<__P7)3I<jRp0zRz
z!U+(d07{uEKoHFE_&tfWe&1*b2xQQmTn`P?(KAbGw)$cNI+lnlGg@q&cO;m}stRBM
zftpy$i=b_Mjt4FP8UZ{8?9hM*1R4@h8J{~Mol_fv-IUN3=a`c+ODI`jNbMk57PC^8
z@a0R{+5wwcfAg~~B<P8E<$6co6m^tf*ZUxKh+11#Z%7lZJO8m9$v=YTdfOF1wB)A%
zMnimn%myRfECg7%^F4TI(2fYr640y=>@t9%fkgqf2JSRbI(ggWIOnc(Nxy;qB7F+p
z&6Kf9Oe92K#{ng2fdRd==ajdM7YcY(iJ)xyrFT$mmk#dy01CuX0VH5jjg+HKi7pI*
zXAQV*6S$H64P%*u$cnL;6lhxmDlK5exuE$jn~dzb1cwC98DO?RQCOzIDF*<`zw8G5
zudk%WKmXxBm|u47_q=m4-MV(Vb?EQg!Sc`)B{8>gjgGu!&!DcQ5#30LO9;|cIb5FM
z?qe%>!~3qpB|rNG>{@O>6M#$-;yNPPy_lk%Q<*d@z=uwNcQ1j?SOG%(NVHb{Z(p~T
zSX~#Hpxf*#b-av^Q&2a=aqV7`wjiyP5#t(Uq&6u=m7a+tVTpxuixp>fD5ti{NNi$?
zhwa4(VAXcSy!ATwx)dGVfg*BEgk`{_eMS`ahgzRoJODf(xzmGUF>-#`JzoGA0NZSE
zbiKes54qo~E5Icew>WK&#mb0LEXZv`v~8LLNzqx85y!v_c!Sh18$L?fpiCfgDnv9p
zf(pq-(gPL;86x#=c9EKSMGu|H@@+^iSI*v%g|IrAPaXy&gK%OOLf87z?}ipddQD14
z=nygZ@;wQ@;P#*|8_dbz$Z>-^ZY^-z*GtST;qr@WJm;B=y}Md0F<dTw8@9Bh3W9P~
zG#T3A6+c<w(UPuzv7F`{QgR@&rss2()yZ+*g*+iQFJy((h)XECJPtC6Vjy0!y`vao
zJ;)Xy<K?Oqb0&D+$<fp%jz_(d0|3+7(Gh9?Qdshd?x3XNfgxjSTA;NB%Bodkj&P*2
z9L69gIs_kRNbG}QCR0|nEKaQ*0Kk(10H}+8^d-M^^bg<tinq>>9R8Mi`{=d99cMVD
z9xS!sYIVOdI2%?ggUl4#oB<+>a&?Lif8}hv@Jr|5Z+*){DCb64F?}r(LL^qtKuO?+
z(e7JExnl&B?s!Wra9FjMg`^7>ARzh>7Qz$`<?eIx6=_}gMNgd>PjbID0a#aqIB)?W
zvsOeD#y<p33IvdhykG(JIG=)qj12Aum6=lHJ(E`~BotH7pp+`k+iO9HXG#R%l1*yI
zV&?cbOo4V(;E{vCAH98qPkeeAM~@lIW){N%u(pG6^;I=~?1yJ~?$Z|-7zSpF^s=%=
z{>mOOpoz`XjWS#0oNL9ad)6h|l&adzArW<+3lTPMKB!w#u#Wy09-Na|Z9%WO01$~)
z1ej4oMEW_&Lu$!Gzpru=gk>=j%R18ELIf-k4xA|Qo_CM%o)3=k*kdK0SU0fNV%Hku
z!t*U&^c_?D*bgmm-kus}TQrq9DJeA`lK(h*?0UUg{@LJYi%KhkaxqSRX(7eQ_sn>_
zF9Dz6TN3Y5l1)yr2YD5N0=qMIPhvY;50ov^bQwy*G05q#BogP+KjH%bvAqBV=St4v
zioiKepDhUcpIE|tQNoODEHlYb%{!@R1u-<KI65b0Mq!Mt2IiCl08g^0hV$rCpZTvi
z|N4&~UTm$8=97(QQL!{C%5e}^`ck@CTMdyVymc8Yi=wdDo{q47cnL3f)??T)YG7vu
zF_*hn9?>czCqRX`@#O(14D4h9z`&fg?33%b`or2_5<gkHfj&MXrSv-HjVEd8?vt+Y
z5aBCa;c|Ujx%K1V$?rooxo~#(Nb2;gLrIK_B^Y(QC#5<mXUm=eA_4NmLY~f8=PU|J
zkzw%=A9Yxa{2q`_C!Ys~z)KZwzqiE8|KkX6d+!Pk95<MOU<+W@5)K|IamQUl-15Z&
zyH9U%*%d8{Caj~JL|~Hqm3d9F=5@>P!F_S6SkS1VaHYhP(hp@OA*z9c7(@Afrk`aW
z+>o*;NVHkjr@(hl*D^dOr#Ywf2u3@CyvIwBS&rdJhYJW;2JYHd;WuBohBv%zjE9~m
z(F}lUi7^;k)BqkkRN>~E2YBou;OeI~IBk~&FIwG|sL0*e$6Z5Sr;-f772EXEGFBSD
zzM)Bdk;$eYfPlE!M{u3LS<h)cXYBo{0Zn<3LmffIc{LP|OOFI1KO=e9h+X_t%ix12
z+*lNpJcBCOIyE#%j%GLTp)a0|&)jwvoADxvHB!e}rFIKY+u81^(s2{o`4oeq**{*Y
z-hSf9LmN1St|wIt0L~l&)faL5M_)HN>+Eyhy)-hPZ6}8<Giz1}I);>(g!aotRjvNE
zEkL6wzVhHsy#LeZV!nnb1KAT!ax^3%!?I#HYnX^&Dg!)z0yr@P1_i<*oeq}DqHM!`
zrQ8$OMD%_VgUcJQQMrdqU()&vk-Hq%91+K(7f1<(tt^h{5fEkjUrC>mDk~{9(LYWs
zngSR}R3WW;?Yk4QQwiU=^v+OO(&7lJ@$I|epBxw*JZkVe|9yxLe|8MB(qehFMp;@v
zl#KC8jq%O}?ti?*fBLOueC|sX+M&_w|MKcfaL=R+BT2)WHd5P?5ky&09SD^^ODnZA
z*=gKUebg-~)32^A`iuj$`$K4|%(3g-(Grn|L`kfxk>nL=rlZqN0=7i)=`WK4BnO0j
z#|(b!cgDEkLnF*fV0mW^Dtt110Bjhel?KJK#rr-p!mD1hgvTcZXq4ztwJ~mCVM&&P
zKm8a9ppYW(;|!<FbgJyGwq`(_u1IR|l9ZASjR6t;z(H8i5Rb9vPv#Ko;@g=BL3lN!
z!NIY=9Vx@)jsRXXu=B<(#RNZ<3Kk6QGRX)qfHj2uM@N{}snJ9NK)`R~<}NRWL*U}1
ziFhI+VsMK=W$bu7I^|*jo=gCMR<FB+mY?_U33wCj-f`^%J9eJ-2L_Wz>d6s`wsDW(
zOL|X0(*y|P6{66~qQ*A0c-Mz7!^8V`0&A?I?Q^iKjGlPUGjVBvwnh8MF&7<M38zbN
zw*hLs)P0wm_rk}(sU7j_PCkACdN{rrLAUHd-}wh35Ge%_ghV4kp@nRTB-$m*QEZ+W
zYGK1ol>73nu6FKNoocs2{EE=+JG#nB+*GNhvxmq4iwbz_yGQuoCr218TNDN^W1HWX
zZ9Q-V1LIZ3!%vj>gV&9*|4;!8J5#7GX|=PE@==(}feaY~B`AysU3HW5<&!|!cckhU
z3=vYN_5n=D@$P*<)vFHG5j2o{b)-W^(WacQd{E+6VBIzm{-s7GSc`Fgcj#jYoUj&u
z^wuSO=o8CaEn8F-yWJxqV<nhjTMJXPsFs2Eeq@XrJ}}0jD!e2m-RP+2k}`wfAH{cS
zC`FHYSThn!7ZJ&U%4aPNeyoMiT?^|1D3<l)(fqQ-k}Q(vkYnx<5ALY*rk{&~z?0f}
zN-1pLrf75lq(Octwg7BtaBOpoI&9-p7({Y=pqn%rA!|@3N)m`-i>fG^@o4FPLGVw$
z>&XNF@RZpMm&}g?cm@8&|8}uG{p<@qwYs|ck$QS$-Zl#+GM-U|V2@W18<7tk6sLo^
zt*4B^(j0f}-;EnSdNJx{fJWA5l|p<r3M<xi<V?#01AA-&`@{(c073{IA#E#CiYh21
zN`_+i5!>V<JBw(0N?Ih7oWe>*M(H`4aXNsBg=WayzRF7$_wiGDFpq)?-=9?A^;=PL
z7e@afI=*=n895a$Qo-iisib+C^l9`l#?INo;NYPGpZ?SU4H2rL8)Fl;2pQ*+Bonsb
zSrkLYM?N>gYu_}+@fP3#`MeT+vNnBIicC$I7?_|qI%ALlGb9T#pFRj4N#*LmwOq%O
zsw-wT5TK&F1Sjmm_$gV5Va`OmGhiyc0r}A6qb1J}LIzUR^O9GIfeNU{gb&{|#2ena
zgei#1iqj5N0iIzTAhZC=fyJZ-KJu|8tZ$d#LB|!5fK(t}$phh;EQdy#j<g3vv$Ig*
ze*E-K2BF&WTnusUBR!qmTIv9aJngvno)OOqh-YpDS!IP=OU_F!AHuKAxoeE@;wpbZ
z+~4TSu>eY!w`D#X!IUhz2Z^d<H&xeIQ+7UFu3v3yieh`PwERsEz+d9UkKTGKKYsV^
z41A5h_aFWwzwm|Madb2qzo|0qy^HN54#VZ9I8O3+5J=K637&BnkTGbN7I^<>&cz*%
z?1tIpf`sHb0V#iZuEAM-PX&QWf_-cqygdU-L+HRwbQy#4W^-D*4Gb3Dg*g}qWrW7|
zo95v#5V<`sV2SXUOA5kiEj<oEd;&^JsiZHN*`LpaaxY7vu1qK;J6*7$@E(M2$8Pjk
zLS9)biq8VUR8I`K^}~_D*X|wQ?t2Fqj2TQ8FfLNx$qs+inqg4EFw|mDwcr8p2X9%$
zoBntSlL{^f6vpd?tnI-CE|nyJPK-rR29$Y7<iS7U)v*4lhFn^|Jv5hQHF;+Ap}L5%
zVya9Loze^P5~ht_26+%%TzODZIOi(~V{`>9a=*uW@-Vp289%Q8!<H8Hiou6Iv&^sf
ztzCS0VlY~1U||7cJqos9pL>Hs=Y1cBOTfKfukhus0$d3zJJ6cEWb<W56_OT%72_Im
zYa-R5hB=O#JPti?Lb9kqI)0!-04MV%kmQxzIynh`h{g*bL4ayrLGJ92?HQ=>=~PI1
zbA&-B=agLzfW?B)EP!IzAY?Bi%61Y2`GM}3hqx`Bw*#=&g4>#llD3EAaf?&zdNKh3
zJh8FChfZuoYJB;>{waIj`4@a;ZF%X<v^c)m%qL7RR_4lAS*#%E)(gfQAaWwLax}v|
z>&tlC`!B^h4L}2n7(XhE<1W>s%bAq{W;N`-<E{!Lt+tfqPFdNp9%;o%QwJSxi@}L<
zYXB#P3txxO7?lH_wZ+yMIEWJx!n&RtWGD&6K+Iv14MTc9^(fhj92rqe2s+XtoJNz+
zUHDE|=jm`5Apm8kGJz@(1p~~cA{;nmaOk*CKMjiO#!`XFjZ(~v!KlH4fIoP{8b0;e
zk;@mLG;|y)Cye9XYLS7CxYIwUf2>xJksK-A?-;?_l-I&rk7F2HeM~h2Jr<zC6J2Ag
z`$xosL4$QuW#`@|cZI0c{New_6^4<uM}!N49as3sr&sW6uUNyrBZih%{Xtc+VyCE+
zYC{A|3`S8|JaUlm)vr}RQS=eICfz*ug~Y~cuCsy6*iefa4c?N+B7w}f6rwyz2?WZ_
zot=ioT_W;3DF=XlFAZl&c4Fhwg!s0B*~!C21D>^R2NfK&PQ#UCL@x8FAgmuBVQX`M
zqL8^Wh;uP0v5^j%%>b<sn+&!EXk&Ri{^nT#f7Py=-v8RI)AyeLj?ut;wwW9u<`|+6
zKoU>7<o4Sn{{m$gA35%XtXZ1lgI_!sU%cZq*c~FTyEfJ0@8E>sC_g-*6F`*#j%<OC
zO@J~R`rQA@Ie+UDt90KoE5UPRN}}6ikVR#mxlE!^5M^<4iFSumD2d3}LTQsKOy8Ga
zDJo$WE^eW8V)H`MBQeJ$#v;aoNFk>I6HzAAa&yJK<62JMx?t9iMIjkX*Yp~*OMW&S
zx7c^6!tcFyC+>Z;1eVF4pcsni*#fBQ&_f#{86!yRJv}GoKG%ihg^RhTM1SHG1ZX88
z=`d@Y{~e~9q>ENri*j0n2aeDI7JUl710Xpg$PV5`$ITq@m0{RrgPXpvgqOc!36C5k
zTHe7vy#=|YFF}(@4F#nbc$(3`Vmd9rWROK8L@Qg-V-!68fT%c3q}r)!6#UW|8V{lr
zU<xD|b$$xqm+wSb6>qT^v!tvORk7yhKKY51+am%26`LecPlRJGj%a(~4ni`<Jr(*U
z_*Z()JiCJ{#v_MEIJz-J2`i3)h=<1~k)6p6*$p|AX-JvDwgL08<!b4h0N}6Ub<Ras
zKe)8E^KDdb9c*SNh<wiGpokMN55h~p0wqfllQ0aJ3Dt0cCng2n^nuH;jwP5eVvcLX
zT7qjdY&p~Ii;osA`wTy}4sIIvcd#0fF`l$2!8(no)U&z?+RDf!2n(wfCuw8sRtB9i
zYc2|fB;igTumnUaAq40I=@jD(yA42RAY}lC`k;k`eAhvt;PwRAu%?L~?`saUEHi98
z6e`^}>}?EAr}Tv~9Z<0ttTg!aS1SC*Z?EvfM=M~Ngpd_#(S%_V6DLVQ%w_y1@e`%{
z-CXOkL!`(gu6yO%vyhjO{lOWXDxZQpe?tmyJ-tEcB+B>(mqf#o$ihT&;ukqEIqYFW
zsF#6{-#o<s^NJPRx39p`j>gCN17z}n?d!h>6HIP-4<;T?CP~#P-cVLjkbYovnNbc2
z`5~q<doG0n#KrPNxO`G3g!i5$?&yH}lL?17&e`8`JDr!Y3ZI2_nCMxh4#sfB68Oa2
zy-(@v3T32(0Kbg?X#hNUU=2^K4?%?$bgULfHEp;cr#J#}$U`5*XKUNGY3d`RrL}JY
zfWL~@d*AXa&Fapb9~dnSKi*7^G;CXjp?H)$#dWbD=t4%nu<k>eAvnbk+m>L)H9mjm
z>G<fE&Vt?HXxiphw?dO7)~*QB^@xhVTT}4ko8U5Kq|5!NF|Ru(S5;bjl?qe&w1g|z
zGaO}W+p&BkxglPTNx7nxO+qQjD^nWXZ*wno=VH=*R!)QPpFgUWLQ<f(r&!h<09g7e
z9%(CdsZ#o~&5{d(KnrKpGcX<#21Oz8MJON#TO0)}!??UCrp0Kb#`|v?(Et0&6+C#n
z0xy|<g(d{QHvJ@c%Fs#Az{Y^cH~~_bCo3+xafKTq0t<PZcCh5~304irz?sQbi1T%B
zWes|8Mty`LJvGAfA>&%CtXpiQ%U-hu(5x^%`nfTF_1Aaeo<|LaYu@MY0bWqtxl3O8
zQYi6{Ax2TLCcdy;R<uFJRK#UBqgb^A3Y2P6U_V78%eW8~&oAdNpSTWy)})rc7T%=L
zC(2(Hvz*f~5Mwj?ma`%l@%#Vn<^o(unULl$Is;T=J$4-cM~*MyL}S2(_Ao>~&4Ow3
z_*&g8QMWTt+WBIB^z=Qa*Eq$lQvv`0FQuL5oO@(xdGy-CZr`)mIt+sXfdzv*Q1S<P
z#U>GOM-hU+FenO(^?8YRefUB=HW`CfyZPAT)k|3c{rb;^VSfAsur>GF0-f}c`+b8|
znHQak6nl%A)Ty%qlczl0K#XE0JrD@)$-s9mSWAiT^t{q}9sA0CClzFF#FMB$J`bd=
zIY|<!{5-jJ-|0gxz5Hd!{fK_LI>q5R>L40b3sASX@Z1*Xo>{w%119x1&Zh|KQl|-$
z^BxoxW3a+_?*|5W`72iNz@dR#4hU^BtnfsXP`N^kuFa&pV;^Fkhn_X{9_u=RGvV_D
z>(ktXH%XOAx=m_bmZ9He*)BmNf>>Er5|v5ld)$X7>g$e)tV=?Y7#vsu?F#VW&y4V^
zzrKRIA1*Llk>~bN(qWkbk~&nL=*TUwTmh%;ZUNgWz^hMg^gTBK3XTOSupSh+{7H{S
zBSnUJ2myfpOCh*y%mO6w1qoV<N?#Zsp|Vs|8tiyDky8Go|L$F`@<kK`%xYlPxHA|4
zK`W96677U#CN>OffZ0|Flng^|3BYA%W+Ji(J0+wDk*T6WZU6#DdWrMgwqWLVQrE|y
z^|a@F(*y8V^1Av=eD0nv*z?c7;+7q&<3Hxv(dlBbU^WKHmKPQv5`m>W>;89G>m_e-
z!9|%4mKXTkU8mz?UpgDjs@opM#)_QrNx?e>uImf_VFm$3LA+>T_aArPmnI5G9bDtu
zNz$#aBw(=Kv^B_)puJx0WZyzE;FYi=!EEkJl8RN7BSblvO>(oxvGt|Ic7$VF<&nF&
zb|>*mn#CRvFlj;4d6o5jnf<RIpd^?3Qb_bnwj^uNI>Etn#+8@Wxa^`S7BfaPPy|v)
zC#WUp1@fB?h+vsv1}%m=EZ+B#CA|DM)^Oj!3cO;#My4j@o_=uxuSyGPYccIe=^wj1
znUJ!kBt8mdbk0ugxdd+MoTA*BT4~jC7B?o8n6ik45)l2030)%1lGvgaOl$XJiNIsR
zd}#3gn@0H6SM0!p2TLsPY(UgPl$w%#$suIVPZZMprgYM64P1Oyi)UZ602U31{f-bZ
zXpv9S0J|6?LoU=kfK$yZX&~fSNKb+IiQoVkU8t?EeF{EDOWpa+;wXFoy$0IsjVT5G
z^8L~w+h1pF{H~hqIoP&tH-MxYLAT_`h>ZmsPj)3^Q4^-?6^g1wJpMTnxsXOeKB+`l
zM8YUa&qQ(STmaiY@xxbrBW`$7UZ(~Cc<OP&1!vLv-~X}AwOxDOJuDYD*INhOB0gpA
zyZDp-MFEDc+zIq&$`&)jc>DV=#6!oHV3u3x#jGUYm{Nh!S|bk;f=u-Rf%eFD$PJK{
zrImq%7?5%Ti7}#AAS!8Z&nUrxWN}J)0mOEyfr323R+{fZ*%|RdzP1?#Gzy^}9+F^$
z5CyF4Y#3Ljcq+IMEdJ#nOr7TSKgga#I@K?>Ggz67j`yaq*t4s}Ip;IxQ$lM~o0FGA
z1{E?ZVhZiH02LO4wFd9|_z1uH@}0QlYZcc+-%gwCbR82H=2a>|edXKfNYG1?qsb!e
z!x>VEN6aXhK`5elE2kmu)~R&495!Kfs$@hmAAt<2kd2jdCl3J&gB?c&pe4fLZG$)d
z;Szr3*LUIJg9Vm$TBMT!CFa#_XW8#KFYcZ(z<g?O_5}?tyPQFF@*oJGMh7^95L4r_
zKTt5Hr;Z*vRytlFc{R_npUUy1z<oAF+Ezfah1KN5Bs>aFDuX-&C^=h1p3^iGJdiS#
zI+$R$7OYOr6pC3bX$f%2%!C41-yY(L10$5B1azUlo~IN*iM@=Cm&Thm3oJ}YOeM`p
z<{&;rt|!@904KSaf#b*if9$<?yl>Z0ANrlO_ph9Oo37ebua;y>wq;BS1_QyNg%-aQ
zLINa##4iPs@OS|pi3yLCM@hiogc5>n>;P`aMaEsWY)i7OW?5ajy1GTToqPJP?!D&y
zvD(bq`v?)RL+(9GpR04u@3;3Vvu4eFXV$D)ICcCX+_3bbGvkewrO{yZm0ZsDP1*MX
zE#p)OMuS(bLh-n713YkyQIr-ZPc7l{eVe%HrqiI!lz2z6l2n31Vag0;Fy!)HkEWn~
z^PrM|Dnrfk46EpM>?iq4a->l#%`UatlV>6Tn;0;r6s{)IwmcuQxX3$spiYY`5FzU(
zgt4`xa+LvT>UGkKUsyjOPJq4QrvLyt<N_^AIP2fQ?Keu0ux(%cyjlWvfQk%0b9WEJ
z8Yl{iUCk}&WKK9Ml_fY}r#Q+U@c7d`Jn~S7W)~QjTw~EI8L0Dp_MA9@F|`F2`703-
zswRn3^Ci$W=kZyYIZw0`g*P;EMoa%23P-9OYQBSfY}EXf!)>2UU?ADZ&H;}c>EKu1
zu!#Tm`wKWdGMHPijrf_g!UN_=b;s2$_Q1*KWGJcv-}!B0yy_K0bcS^tbA&CD-onag
z>271JB79J<ZPs``$Agig3UK8UFG#HrA#eX3gJBE>k5n6PlFYjhz_%gieG_2Z1x)&N
zSorxown4BgPDjaE5d)6>B7!B*EaR!IdA#kmD|xvt$dv4^Y7SlrF@(r<3Z-PqKjt2A
zLZX@sxx{F5Zm#!-n`fRqgtM%i9Ug#(A9nxV{Q>M*`=-gl(%yIV`^6`!t<#n*Bcu$~
z+0HmFR`(YrOA|<PT)3c$qQ=-T{_w+B;>hwGcrJ?tfER93z=(yI#Ik><TL7CA@bPtU
zStLoDBW_M^E7v!%00sOHNZC09LedZDwJ$AUiPU9qoe;v>g(><Tsia4*^`};_%7GxZ
zL=xm85lt=3nE<eqMI@{<69SDWS^g!Q;3?AB8uXA7R^3MorS*!c#w%Vr#g&&$F&=oS
zE1J*oQxINB0O|V&$kdowsPN#yF8=j@*o8O#_XV6D7r<=r9!WaONywTIomco(d2LyC
zDZLUqlktaOspwWGJ(X!*pm_!@_4^trZ$T-Zma%PXYXxp$RexN&%&=X;s7LtJy(NC~
zUoYWpx6NWmjG4Jwg~UWJL8fXWP>!@<^?@k}qXA*>?i#Q8#wq$-iyMJcX1-=BXLz7W
z@ptu4tx1Y}+hEgtokbcak4RWUag~yAjzpj?_(t-QpYUjryZ(@VM$BVi!St+uUnqVt
zMki~1KMMmM)!=dEFaHUxNRTL+3v0s<#&j5`R{A)6W{#Lb#?5FGARW$>sp6B-lfYV-
zUrM`q1OnIScRSV6?mcH+7C_)^0RXWOf8pS7;iAi~I=Z;H=WSFEj#cAz5QUB3Y_W^2
zs`wc>h^n$>`bA=`ML9FXBZqh41E07I)eJ%JZ30@-`8Ivfu4Hb&BjJ)zA6o-9#^7#&
zh6h3U-AJwdDD+4O|KKtvsT7eEzenU@ACC(N;p06D(O;W{K^#r4*dg3>QcE{1ixy2I
z>QIZ*`;sXKDnd9CnXElZ)_)0SNo1Bs*oRbtg`@*iFaw8PF?a&(T?D@4H5K{<)HOgx
zp6-y=qO8CPD!oxeF7qEO`tuWPOc`(Zjd}dszu$$=Ju-vItZ`Z8;(hUH!Zq%Z*#s$)
zO&FTVif<!*n+$I`$Ehs$glGIOq7n|yAQI=!!}^e!1WDJSxBz;aIR79D|7;K(XiDH&
z!pRBY&41X(PyL%c`1E~UbQUa%5-!P4$fF>DWju<*+9*iJDzj}F26zH|%~wru`GE=;
zvv=zU<)Y9QC*JcP`Ir<c2vorT^kB6J@c~kCy3;R7Aq$Wm+~lHt6+)n%4gD}Nt0@Q6
zkWYY$JEHVm1DHt=$;!Z>xb|fG61<QD0Gm^A&3^ws$qMbo@&=qTLICOjTU%Xhap~&L
zQ(QyNbNZsOdqINr$#`pxnAlRU+uho|d(Q-CVL8hH0Py6YzlPi2{!5d&#oZs9ot?S8
z8m>&Ot&+k+JA>%I!=K@r2zTtyf`FpNps4Zwk6(#Hrxrj94*g38(@dJO{<?oUx}Q1*
zG_7HeuEqsHEWxH;al%H40$vz_>7l4C#F<tSLQN`9lYX*Pra@px>y;4&PV24;LSt>8
z%YP)5ukXLgQb0)%=yeUC-GUMVlgJ6ui2dX-sURdJh4m4OL{CrZ9)MT9YJ|%VOfVjJ
z<)0K_44hXEMRnd^63bO;Ezs>-pjYw#xV_6i_OBN3wm+Q3i7^2S95bRx5a1z+5Lg}v
zaIj)HjZb(}sYP(d(_}FpLq-(OLn<_)#S@Xv+DK(Bm9}(cJ<mCH22^m?c7??CuGX)q
zE@Lv!c;M**|MusX@b7<RHy%G$V0MuKW5H|_E#ZL}`Exfd;93E>z^-5z15AbnyJu^B
z=eLfqd!}a8@&)Z~Ct^}t6(+4kHUu`tEB63k30#O9M`Jt-(pvT21#W1u#OrZB;`b_5
zkNjTei)KLPZb;LbA;#2L1}-SYGWdV_V{uR4NBm=blz@uh7m|idJ0Eau2wSUNP_Kq5
z>jZ+?$MWWE8<VUh*%-#+`j!U67O-{21YVx&&kk@Fma`530DqeS;8kD$&8KGP7yh8&
z;gi#?WsXPw!ts$m(ft^Ze{%N*0pFb&<GyF-@WBT!LAA&DNQ!2CQt@&)AFdXQ|JNbd
z)0^NkTP`>dNo7O<<pogN<uGYI3JuHhZ(pK<WPLnNDvY2!GesSbD#d19KKyM7sQmSb
z?#e@uyUnBJ657`;Mg-TNaNh;1I*zB1){>{U@PIIxMsg@^VKUO8a3Jgl^RU9zmyGc}
z-#!FQ06T@VTB1jqWu-#d2(=@CVdz_J0n@eAU9j}nu@e9Gmlp9eKfj1OALwJ$>wxD9
z*l?FKQAm=WkvnIErjq5xSp6KtfKdH@Q>l1?DLq7@3+dU^my{q$DD|d>6~XG<oD-N7
zEg$B$2)sz(jsY(b&M@Qm-qXjAzkUzD^Mi9dE`i>nb+ls+S({SbF`cAnGj6IUz$-^d
zUaL$t3E%eWAzty~0Wg{*+fi7^X{dtHr3IX?FR$bizmoR`nCy9^^&?LW$TcF?SzwO@
z7TtR)@feApMg%Np^Oo)r$drEUt5@pY3m31lj$07I7y_KEt7`Dp1n7{vP|FA&lSzw0
zyFn&{!3Ahw3miSvM`>!5#>QQ(IA;jUMT2oomjpZ=Wh?+o%#7MrT-DQ+n!7`sh2`uB
z0&FSw-1%O<>ZVtp-daC#;dnT_wdgGtrYI5Zz_>@A7Lk%onV<>_hd?L_i;4+rr|0>V
zFFj5B=SSdSS`;aUjbcoji9jG>@hHa)fu<Hbu0eZe0b>}o^jopEmLd8k7Gq4{5@0>$
z)_$xl8W<9!kT5)A6Tt`%c7l;#AnmwG;S@R-e>M8MIBqy$AtU%b07%bss!Dtw-wVh4
zjCc9RfAF7c0jv9{=h!vT{4RV{b_lb3EbhCngX5<<D7qZup+Xi&xvQ-BC{`qZ5cDQO
zr)M!?!WSRy@n`Sq(bkx7{v|ap?6PD4a24+Nv1sOJ7dD=-_)`2=0wPK=Wm6Je%5ioR
zuSR^-qQo`TvPvZ(vi@xMn%F&XWAVzBnPF>hG0z(eiV}Bxu7_X$jamG+w=Ck=nG)TF
z8b!wm@aBzpab+gV(;#K0v=OF^Fx)C|^@TNl^dE2H+DmGfp@m#E;YP~%TFa>yiWlTj
z)>cxm5$}dMi9941t^$@EjQ7@w$pM{I=E!XY|A*Q-6YCQ4b4mcafD5{n>o5cX7U9{@
zE;IK##H%Cl=>e$clA@6um;}s;JrOQ}rXJ(8De=31bQPXnUIg_jFsA^iG<8xYkrah-
z##(uifyr>SE-?P+rI%j&fu|n1^Q`j%oV5S|0G@m1zVXGE-#8v_uH9OryrAqYfLKI{
z<gx*PFt^i}GM~R+Fs7_=^7tHGG&{o0H=jna<v7M@$rX$G%L@!C!>J@-Fa^p2X4ed%
z&P=#G21iNB@CA!U3AvDErBDSfPJ)C~djz+)OIjzV-&ORX8Yr98U*!VLpB3=}6uJ<-
zHHa?LkO7bkoCWBu4T=Cj2%322p9EkL0}Xg3n*%*jk~y5mgss8e^9@d|67IgI4=N$N
zCV}vj^n0u+#DH*n8$oR_p)7$;pJ{o+@I9aJ(t{5cJhdh5xri~lXsI9@eVgjO`!?W`
zi9m{(-J0_yS*tZEuLPr!HXdw7;HeaneqFJ$KC#~HfqoVMU>R%)mJFy*7<32^J=4Lj
z{q{Wm%Wp04T@Up@eWu<_?eo$EAlyc8_j^NEN<bhLtfw#61R59kfxoqm@BX$4%3<A_
z;4V&yy5A!xZ$Uo^*u`2P%H}lh4<#A~{tUa?Y0p2Kj~q3qfBE(oL$6bDiYlzhn9Bf3
zsmoXf;jz&{#{QonqOyQJx(<vcpiYX@a$9Qh9>3Hd16LO_qnNcgHkie4zUz7{Pdg~O
zHQ2`JZJ*Im%E6F!Rdyufyl@1Q3Cxx!!!y=keEW?rdD+JvzV9PvT_T|Je{~1G)Mf9!
z{r3&Fwm!D9wt8LN-_tM30^npp#dN{Q1)nw#$Zz@v<X#jO<8FmNy5kaj%c~CKn#B#+
zRSG#t8akLowa~4^wx}TRa~t5@bD&-cn$#kmfR&{IsrN&PV*-*pQjE+kJb0L#-U%TG
z;Z`p4b=2^v-2ZLD<uzeo+w><W&1g1?wzA-&aJ8@7X7mC~>_4lm1j<~bMksm`%0K+=
z1tm8&z&XZu0QpHq(lixxB?h`R@Y?U3;O@I7_~gA^^cSmm955*mnR-epOFwXye+N1e
z01NAndG+Tk)t2y?2fF6LFZS@B_x16;-!;Hjf8_v|U0_iREieMOMuhQko&p~rDM40a
zbG#G*0UO9S+zVk);uYTtLGH_PmMWSXJf24B{~v?onx_M_QucQ+FoO$#`iwDk@bFUx
zAO6TJ-u=E=96VZpdZ4)_cU_as!e=-VI09dvbHO`r#PqOI7O4dNHe4(5s+W!M*S>p%
zp7lVC0N6}&kQj@c;xJ1A$PxhS=RpEhGOk0`GiM#vzUSNMyC$_`m6#xOf&~`HZZ(YF
zg!E}z6-jYMepVI$RGRH5S7g9nQ2b%NW`K$d0>(9XW8#b-wcZp$Lh60GXo#7>9bn_w
z3^pfyP{$$<7KlNs!i%8dtJ9{42ChM7vn9hdh-fgg?~=1F4KQ$)djJ67hyL%^PoI47
zq0Q0O#$T$e*;n@Fog(*`Sp#CBWWp8!pjR%ud}oj;87s>(IB#)+m%scpXaj)tK|gXu
zM*%?M?71wyQDcB{<=WmmqjQ}5MclAhV;{wuk(NjHbzIy+hf7N%-!Ie1UAh8%x5e>6
zk}f_$*mzbyYm5D}LCC0xbpl|Fh=>-JL}7r^fJ!5x{gGUd;>c0Dph@&Q3O_+00Bt_u
zL^tn>s2Pj97`@pVpZZi6qbZ^6Amp49Gz`N`Fe6!2x#f`yXXAvnVRZX0J;cGoCGPk{
z9}hp=!Sb5H!d}Mw9>8=we^s(Vt;k4vq*VJYeNwNIz;F#zl>J2O-}2a+JX<fMJR;);
zjm&_xzTqBF&k#0I;8XYY@z%G`;@5v;9=Csd2CG9tZ_c9Vxy4}_LZAz#6_k#uh2Ynz
zOyZQ$BX}wdV>&FcZ-()&esmQtyI~3%)M+V8dWrF6j1c*W)u06-LJ(b4vJkGSG<S0A
zFwJqEwbQ>Ra$O`WO%YtX{+QHV0}zqJ;&E*oEeC=r9x4nVydY5NPdB7B%P<001YYkI
zsMkio=`Bz<#kEAatSCu|aKgH;ml$_HbRquuo=Z{nCZ6qu{6XReK`6oELh_TEMi3cr
zT@g>#tC@cPeXoDtf4=9<zwuuPn_D=W%2^Hoeu3_I?|X3dwexGE;l_D`;qc|AyU;O3
zskfHpE3DT~j9BF$5NvP}kpVE7cCocSgIB)vB=*j^SO8;4>CiT16E^ImDu{6|n-iG%
z9%!x$sx4$sRq`B)utlzEAqbL$B2j-DU*_BQb*8b)?}P;N0)j;!oK-{Fv!NSOFj2A?
zq%xMu-w6*VID+E$LM24@Q@+0#epdlXeqrlPKZJctsq2#PNb?bX1pOHdcVmGIFJ}xk
zfqU=kxB#Yjr9<-nCp%kLsXD`=zu|9x^1=m7xtr#?GZvPBrw(;+=O<_I`TP2K=9t0a
zc|f_q=+9XchK2Pa$Qv>>M$p$XuWg04`=dqaN8Xb$4&r-(?80w8=r1{A{8}T!FmsGS
zhj47YgO7i525<PSdHn8MXYtXyXR$sel(RLuU2n?Uq)8)~jHaS&U$66|S498gy6`aq
zhEY`pc9ZaT{*NuZ_ItL_pIDH!f(mIwiaavCaYGgP*%AGSS@M*ZItSeuj~Xx;P|P_Y
zlzhtUD1-wfKjf}{3ZQ`EyU~+|1nv!I`}=MUlJ~&H3w<1*pj5BecIgzb$2Wn2bN|N+
z)T9eYfu=0FvS5rCf#3h&6}ab-Jt*fUuxv8$K$6z#lN^BND}ji>c4}$5Ia*j)djA{#
z@!!4=fACh|=y9A)<t*O<_<8^Z{n)?xw)LO>(SQ2h{^-QFj0Vdu=`Wn`nA}VB=mgH(
z)hrjaj3Q<K76YBRF&;d$h!5X&A+Gw4Rq(oju{BKe@rkI{XmV$FS_3gHDGCEjE7&8e
zC>A>44gu33C4^NMyA&#ry$p*z3BY*GXcitGg9O9&7&ADyAcHr-!d+rwW1Z?!QF!I)
z$SGW{vMF(%TZzIT2g%Pt2=Fsr5+TH*QHn5*sZ%+gYmP}qg7EfaNYU?7sIbxvA^C^e
z3JAp_S|1er{1af;ti=y}-zJ`T%HV@{&0=oJ!iGRKo8pkt@L9O$rIHM8UBM7>Legi}
zGEA2-+huTV@Zd8gzVPHC{^)j#7vC_(cf4kZtFNqZ^%WLN^9(y+Pz9#iIzIP#rXoE-
zZaxD&Y(P1}J|Z;f5ov~GJ<C_4V#!_*iiUj~{xT$DpSa0%4Ju=B^ti#HgM`oDU*h%;
z&g0<04xia#>drFyOErirtaYA|r1!GDb+tvtaUGKA4zoBK8i&C!{;mP*AFc)kzU8aN
z_@TeCj$OqRJd(;P%xzlRS&B$kxBrZ!3?NP^YU3!>BzeT?U$LpPgmBV>-Kk--{n#~s
zA+Aro4yom3w|z!NtQBC}l-q1lo6>?JIXMKNEP$y6ZH~bOM53hx)B<cym$`YjYlv+q
z7*lKT__0Ndn6Utc^?N29CtEUMLh%_X6x*aP7{oOS;`O=N{u%&aaP}PpILiURB>*nw
zzy1x^^4ER)KYVa&ZTUT;t+nf5_w=dgAspZhD!GwmOL2?eyYz~R{r}6N#-vl@gC9S@
z-~3gF>FT*HU?aH^BIn1&h{Vi5CIGx(>KDNJ2z+W2bnzlkvGZ>RWhD%bsLv$#hU-j2
zyHW8=v=1*(!uUDm^cR?iIPJT+2aRaVgM-kX++>ULM7UJ)BpsAJAIx%<-#-#vpNTHu
zE(9^&7ZHR_yq6&TNLIEm<s&Up)|Lnbg)T{aAl(1}MvMdJTYUfD8R5~VX7KFkg8K^<
z8S4bSbm^1dLuJ;$PX}so>}S#~(xN0-cLy~YW6_@lEEAqvH+b%oGx+$Y`nX`X#j9U6
z#WmMY@sbx!aKm+sUcW|R83i*iW!Q?rE=q+=78?=wqFJ+#>P-%k+vIG-E(rvN`w#*>
zs6#-PQ5TG=FgUY9`0Qsoc>K{mKL7a=_kYn~b5vpiaCf$*xjpV`ZkNMf&u{QV>Amiz
z(XZE|S2Sv_<Mm$%9<AY4iR&+|@%R40Iu2Y=g9qtELV^q#uj$1IIjNfU5)Xt|0YN_o
zNB~d?%n&d-dmzUipoeWkh6k?>9J6({4ts$^a;?j?oAZ9~B*;WYa*fIWzi^~9Oa8;8
zNDg!i?CJ<SngYFK=F54LYe3?IXrz>k!DbIz8*?ao*5zmk9;QsmD`ug@)6w%IIXsTh
zuw@HEeSCI)_Sk1W^qY8H(Zzi@yUJM(0M2)8^YWL{gFpH`TNnNKp$`lPhrVSxTD`S5
zf4=u~xv4h{eP?;jK@{w0?KrX)==CPJ@6aB)=idFe^3_iRTVe+ih^sx%HIpoOO0GYK
z+kYw;_Sh!O?paW$1SU>;a(2Ri8}*5XTa$PA2cp#`m7;$y3LTCDJYCA2WEKZ^H4BU1
zvJfK56j4K0u4ws)3>XR)QoKBcL|_pi?JfEQD&pdX=<%SW65N8%yeT4adhCi6*1;;1
z#nZuTF<$)@Q~c8(*}%X3#YI{hl$hz)!g>qQ{gR!Uj1{L&wVRjdBvneV*S9dUKwT4#
ztd;nkw|5v7)3ujdTyu3rS6ng1H+*G{E3T~2>s6TRS<Li6h8dWExn>|-VwVk3Of<A+
z2ptWUHHGPPaIa1lx0_R^@TtS7i7}WM3??O3jstgn&fwmMI(Y6_4_|n+i{*_1-97`R
zLOEBXPejZ<`(jSFs9Pn`IC-_?csKwty=H_87kub4O^!AT?3)Gt(GRcVl`kEm*tB}0
znp~Z}il7^D`RTw({jTD`VD<ZT$Esf})}u@26fiki_jkG-(bs2PeJLZgxVe-i1rk_^
zl0#ml9j$ukBegPpw*(53YvLZIlR125;5uCtikxx1q~)tu3AwC~++#d-XdcUF`Y3wo
zVyD0mVuhz+QSbn8qmQAD7(fj|T~)-B$#GK_&%N<Y6P!G?4`*9B%K?BdPd$y5Ll5A_
zrCkrKpE>d2mBE=C>i(WtQ<Pw~ZsH|FNdCyZ0fEt(BTpBl#n=Gv{P?B#`ma8U3unf_
zR`#xvNWv@vkiv-r=Q7YWu%ik%vVr2NJ#KF;cmb@eFRYwYe^X@zA4l%y5(5<Df{$UK
zV9iL+AQ-S-;^bCwu>LrUu2p7FB4un^Sr;K4F$GJ=t$i6)tb~y9;6OYp=^VClWTKv^
z*hter_DxM&6wFLa&gDt~YM?g-f7iE8=;(8s_%Cl-KwTS@1%oXZ#PZ;sW+>tqy`654
z^etNvyP(YOh;RIR&N{NSo3h@VMR%5oEATVRh8{iKL+4{%y!$rB{K6Fbch~r;msWVm
zODinxtuQ}pY2WS|ON)$t2cXKOJ+@Zp{92hvae+98h5s-dg)Et108_ZsxE8=*0<3Nl
z&MXtww@REoQR1_o>*C%obaCd4!Kr1!@+P6vH|WnW=5|+124wwte|W{6*qGpRav}h|
zz+)T~6-z3S*aniPSQ0y=^-k`1r2&S60&^wdpZ>!$_|CsFM1Kso{?u#=#1?~a1ws}~
zrMaL57-wu5`|dBxk>d~6J#+d_dJ5z&A4M?})^uiwK=fOHX0>%j>;ja-wpF+SJtmO~
z%2}*US$hcdWp-PfV+&p%yEvXmk>Dl}0EcYscT(W~Y)hYU-!r>$WVMH4Y2c6iMZ2CH
z2Lxc6fLNRd2^gjK!FyGh8Fe)#uBL0l;pWPl-ts>Hya>QYaW<860|2b90e|nu`Idk1
z(}Po|PrPewu>6|oaP6hNh4X}8QhM$@Lx(iD(ZZ1lUdZh@F<>o&`eS_I;6B`a|M~dN
zuY495q-7u0kTTMfyO+Z?_r4@IL&tzmZG!jA0DESEQPqMaQkYrL6>5FUz_9SY82t+=
z1zpfxyi40ZYDJ#VxG;UY94=YP-NQnP<X(^12l1K684#`a7;xmDmezlmi?-mXNOIP)
z4PFp1DHk%a7FfA#q-18g9Y_Mmq_`2DGA;HAfBUab@Z58oc*pzaQOy8F$;8dQ1m)J$
z#0bJIJLwVV!IFFl&;^+caAIY{RCa4DbS;P&r>BI&&z5-PsV?q*04U#LQJNYT?zOn#
zx*AtrU1Qg7i%ze?Oy6Q@!D8QD#_lD?;#`e>4=75J721!>T7z)~Y;F<OHw@0K8LX}o
zHZ}?4F=4W0_{=FoPe0qiqfd8me7OXJFr7MwR%h0t(`PL80HVraw3^7)fc24IBs4&z
zl+vFGm^<rHWVi^{p1LbHn`ku;02RP+U@$|#KmFk~{H^a9Vs>o7lR7H-1jB?;kU0^y
z^Wu0$gwnzxc7(F?d}^TDOm;^IHT!@eE+q<}mmPS9*QX+rru2MB<Qy>)c_rEsC>(w=
zxu8u69#oCNqz|8$27G!5Oe&yj()tu2Ezy}$J)G#yCBqiLvEz#vT3|LDpY_`!(YvXL
z<Nl8Dzy`b&5Fo`iB8sY~Fs2xtK6+{d+y&rHoNeV?005E8-|(A1$G5)fuRpT7F?iql
z*7|ikyKB~%0ycyZ`x5iH`ISJb7HO=xU#ta+qQdHC7w`G#mH7IXAH&|63Op$MUR$$A
zG3YIt{o-rCKurPg*n$tQffoBNb>_5=%qkU}JjtY7khv8rtsfvEZg2JzdG~S<N<rx=
zWge_oN(v!<XVQueZaI>|AdoIt5h5%qDs!X(i6~+ScVvp(ZaL?#a0e&qN-J9i7_w9J
z!iAVXQxujt?ZN{Vm{z!CZ-LkS$Os!7gb#dT4t56ac%Xk&X5<S&a6te?^%jEyJqi@c
zCEu%#LNZstv$sD00Du5VL_t(&!i!*i8wQNI1%@#eTmw~27*_^Qo+$Cu34;BYK~*tq
z&FGel-SZav_SV?5+hTFv1ArocA&&NytqJ3?!R8jQwoX`HHCWjwurV~KYoOC%Dmp&;
zn+&L^QT8fyXBa&q)Rxk5zmSzzI7q_c3xJ3HbELdof-aomSu}=9F*`;$-twSNB49Ky
zm?eXM_V?HE1AlW93zmVYPA;Ic?GcoK&^k=<i`?eZi&d<{JQz<b?r6vdrZR#7On5ed
zlejhGw~RPi*AVXR*h%4DVqwV#Z<H9LSfBC#B!Fm|4!tamizejdE#H6N2XWtsq+M{d
zaTpuB-70h#tAj3199=@E=UyP`;S2Qywh}nXiNzEc8BPs2(ge^&eow)2cXn~gWzPc3
z0G8w;JS)n%002~Z^Kbn2<~M)GxBqcD*m&)9xPEPSey{WCGV2X~Az6YFb4(@DzrqJn
z`{-OVH^t{3-;28*IUnElvcuqEkzA#uDh9L~5sF$k-w2?-0dJ0APj13oya-e_F}IRS
zxmn$2gTxh(ea^y7mli&xEK(PQkO)*_4Gsix$c9Cg2B<FNk@ts-K9fvFBwdOO|4y>z
z;t7FP0OUStf*omL$m!6^UkhqK_iFu<+m5NGz*ddx4gmlB$104cB|dy-7nmoM9cg9h
zJ|??1`(9WqPN@a=YNVV5IPLQt?=?@;U0a_!sl({>7!D!;))we^mohP7iwg`^3=XYW
z*t+X(+T#@70b=Kv@$)2(nuB`4OyBj(_}uQ{%!p;T%&OW=T;OyHJ4(Worxxm{Bd~Gw
zAt)E|y=Vm*k%d7xuo5}bJq2V4<57VbCj67XyM`b9zI80Yf=3Yh@oDmi^9cU576O1y
zZBxrMWv)6=x0=S#21B|0l`>A&3gQ|Q?Qvq9_#sDPgpb6Lr9ex09dRS4f#`phryzYN
zEpY4ZZ5WQhn`2OEl)jeokfeu##Igkdu2J-BJpSAsJowZiOn2&@4c=MGDX3g$X<mYX
zBRl{x5`qla)?83MSz26J*|Yy5K5=jfXJa`FF9Ul1@}leK`GSiNe6iOt@2`fdm93}j
z+{<p2hIP<N7-5}8n=o3TgrZmB#HhsWpST>$RTtFvPA89!-SIT-D-0KAxHX=v&}hIH
z1}F*k*qXaEqcq;K7FL4jPwZ!O$>k|gI4xij3pDgaJ{+v>#$Dym!FVz6KH^?Ik^iiO
z$O|5xCwJ4G*w<(AoxB|_^&_-NQQ(mG1~lg>2V7C3BoBgDM$#lpSL`|gpN_6a8?L=A
zYXMt>Hfr2(X@#HommBz|uNk2p5UPn`Im1%0MWOC%4<=Zcr=X-_2?1Vy`fL=|tcDjJ
z4MSJq1#pVEt_`Z1P}c;u7Vf4y3o2_+w*qx)n9`!?T9kc@a;8Riu10^pMt{ztH*3-D
zTXcGiqU-;4fWk0{T*!INjJgKu%Kfvo58#3p(#d!eKrT?6B;9i9E^<d88?Uffor8;G
ztcf;y0aE~zQGpp4yzcwg@B`nshDEBu10Nk}^B#+u<#AcTUqJ^d<;!{*sjH5Yf=#g1
z--H+2a%+Uu`V`~V>r$*^aZ6@gqas&7W#4hQ)F-S<DK{dmgKS6yRX0W&0aScYBNu=@
zGjtK1rGX?(!?KP7D^W47iyq_1iFrJ`(qojBxNORsXUPemehCpd$<wEg-$q*pKwVda
zdb~bA*E@LawO83VA!k`R=Kufz{K%XB-Rk_(!W|`zk4}bbAepKPxwu9)??QYy$r1pb
zKw-a`#(+`IOz@F=&c}U^?t@vX!C6?WO!6T-QwRx%)CEQ1p|SwR75L~{QlMdBQBnfR
zorr{V1GsPzPSQsykh@6jnUa8r4mNUoYo)COi@(2I-g(XiflCh-3S>elypQy|5K2+!
z8%}OaG*hbpX;{hlh-ZhDw3M<eF8*L_vA>2ihzjygNS{2i+B|v9n#D^l8{#K^d>!BZ
z>JiL@Xfi2a3UFf^1@iagzUHicWyNK$CU>jg8{s{cu296f#2m+lywbAipS1~?I^f{8
zyJ}0QETQ&Z19{c8WxqA;y$L#@l(6cff==AYEdvbs83<^9mYwlR!IF!vfHcEdQ;E-+
zU<$%`P+|rJ{>cxm;qU+8Dt7l67$EaDkf=a04?=F?_`4bhBZY#BZji_{3N%$qhG9j%
z0&&ZeRLXA5Y8y@F=@-98UXI6UNv-dgWUD2WZ<GZP-$}oHMzWaEzc9e42F?t9!mdoI
zi&YS^W+pr+=u{X?It5NWw*Xrd1ae0Jqr-vY!3OP=5cQ}Guc415XT!iw$EKQ&S1j{m
zw|>nxSY$JPwv=-c0Q~(+FX7#L_utj;m7lQVRcmd{prpt(*Ju+e!;nJZxXVh4-V|rX
zB|dh?0jyC6)Jeucx&chrp`F2uOd7f_bPVk2E%3@9UKt#@Uhee=-VVwy{vo__&~=A9
z##5i<0%0*w@lKSn{tv0RgOYFaB&eS$vtP3I-8(LoXtLnq{pS(*h|a_fV@C@W*w-XY
z`a%szl7P^vtQm-D=aeTlLO1ts6S(;@i=X`QA^z@n4=~FHqpc2^!bwtjL!9haV?ST&
zGo`_Tmm*DnAX12U$fcDu(%iIiz9SNS4$<W-`l7IA3_Wj?iGB_QtFzpMRb$R+ES?KD
z=5fZdYVSGBcj|qkH*GeX|I8R*xYfa2QR1J!ZWVw3?`~jk7od^#Cs7jrDn-<=1xWxe
zk-1L|jkC}EJT~VlE<P2|7_EC@9LV(*6lu0z;~F&_qxNG4(EMz_0{r5$#@~Sek_|Y@
z91%2txXDrwIGp`2Qj)Zc0h7VSVw)n++5%KEPEWh|+@pJ8j76~xC|7INR~$*l`n%}B
ziAa&y)?-*Z*;rjZe)z9`>rH2!<sZs92>|eI-$I@Jm!DqRwd?l64v$So>jW|!a>j=}
zJIC)@c%?!@ex;Q{0MM)P!F$igp%e2k^R+*>E!>elf?j&y<C$t@y?6_P;V#TzcDH9$
z)-58@mDD}qex#)Q<f3fs*)b6FkP4;G0US`?hE(eEdu?s7cl)Ijy+UY7fg<W7@8*xn
zsG+$9SV;>u(zfZWMH0Y3G*`EC<^_v2DfE1Xy}Bp(z@x09aPRZL;;Qp&{OCU(;h+D5
zb?oW_gN@SNU*MmKd-Td@8CyU|p}egQ6Mbz+aCUDB2P&ed_GY5Ik~Zw62Zh0+?Iaw-
zevMH5URTTck+ziepKT{W(?vq!Jr-0~%2y<Mi0>yJVuTYOtXMtLOR+Cuyj5b~9PkrA
zwuT@4zD+E`f`@{oA~UhrE^4VyR@|0ofCFRc7zV|wVcmsq!WKZ}TR9*WzlY}mkf5Pd
z+J>8JQ|^bvSRAoVA^*;Phv0>nN!7zrC0jhR736U9@&F*?f&mfE?gvk*G=k82Cl>&i
z8OHKv5BER4fEpD-MkEn&p(jX)$>c?mNL&8Sk@v_>x!3ED?X(_VcmD2Hv2r$)a}xk;
zY+~hKe~+E%cRw-L@7!MxS1PuC_n&hoY;Zerwpz6-G71`NQ1&VuTkGNWPhE`Rtb05N
zTN6zqX>BpWK5i1M5~cc&dIr2cf<3VXbc%RhUv*WzD-=jBl#mIV@LjMDNYFtE0i@qU
zTR|2y&goMWWDZ~WqdG$Q%eaGxQS!Y}<$drC32P&L+hR^}5-Z6P^;-$~wqBSgPHtNc
zZgDZ&9BIRnJ5+EYtOajPaNgV$Klpb>_^E%ffs6J`F<5u|;H`>DC>%r{REMFG`@Zo~
z{x7|ixI}CViPUOxlSq53d<`Tn9?tYptk#3E2Ac`G%44>iy{<+?v1OHusLgK@1MK3k
zIe9oB*dfIB7@(>Q#%mqicv+2q{eLgx`@VMra}x^;ZOWb}`_%CG2-k}Mlqtq1AaI7v
z<IhaUH#=fHPju;XS`5<4SDwM7v{+dDDF7}(rdC%_1P6&<Nqvr{kq{>%^($Pal;%3q
zkwKPp3-IOyyy0V*h+~^FUqkE%Lm6Q~PFQBxK4bO795%LkK*t^blaW=4GBW8CHAI60
z9#V1;V1w6*8C=y13rib&FSxA6SzOLd0C4gYp7@@>feZE@INj@Y-a+-|nQAgnSMw-q
zH~fq%DhGoO`C1Ta|J(>AK62M(d}3_|SY)K@JcH6p+#MHEbekb9bP9q6K7`xA9$$B^
zw0Mq|(_)E5N^(v^A#P+7Oy8+Dh0P`37lJ`s{~;tI?d4Na9?{YW0e;e=5P?JukRd;p
z8cNbgc3KXIr2vpXBG6l26x#3%>Pn;h)pMnz(2)Ab46+s&PBCYvc<py?;b(tl6<=|~
zknJX5CxjxzL2+>1x~O>~Rv;rO>9E(`VjBsd<NBp--gK>WAT343EQO|IdmSbsgCd2!
zE*vqDngR!<X9R$e3S4}epi9d6E|;Hv9%-v5tf$6&dGu!8i3dZB>Ck|;3Vg@cjPU>d
z^fJEd8#XYzIq^9*gkq2N<gVq6*D@>+!B^y^49K(OLnI{`=0r7=HPY~Jg_t4HlBhdT
zl^T^s(9r-I;akpV&*{0yU#$2gO}78Xi17k^a?^d+N$a2ExP>jwVok_-_vid4CE?+R
zmoTXfI=#xR8S)pfDar_XXQY%TAk<WP8dz9nTTOcX?vv+Tc;OglaXB{uzy%ioS6x9L
zdjEf&%+AeyW~Pe=r-Nl{!_gi9TJ=Q{sC1BWc5-59CPsgLf+r3w&`0jN7+A8Pj@X|=
z62O3DLW$qg-${6rOAa)if)B5{M~bkOzzty;S5vMtV|CmjY{ci(6dd|Fcm?l?(H6BI
zy~dom2ZdWwcmo<hK(y14z)AB6Ef$FCpUI3lO(V+ik<xhC@1pG%1<<q-{V$e*agFY<
z!fU=}gkSi#tMr4f-9*;{qpgCCAuhr(vp^@#+KNmk{t5Fq0T)Nawta8P!IPjz@K77W
ziKcB2>MSeiV`OA{9=1_da;s7kV{gHB4T0?k*Tjp7_l;o~7>w3S-a7;Qqrba~fAiDJ
zc;yX4bO+XLsU^)2>7G3D%FmNgB^-5>p9tbKY=w+)p~l?0mjF~+=m?V~%w?(M+Je<H
zFPE~0a}?+65BW=ynv~#B%B8Go60|3O^lxhdyE+ECMV2cdlRp9|>Qgg*9y`F$cJawa
z_hL}H46IJn*mwz91Vc*6Q~b{b6>|c#NNKeKFs-YpsivdBbTs_zjo05Wz*$_*O#pD$
zJ-|oL0QhdY@g*;Rrd#0MG+EuU(=p<;v?0z3@WLPkUXkB4YvA!98yPS~jSV7v=&s9g
zY-1KQ8`4$#{bw7(RZ}KHM25^x`gqr&v#=S|HL$0)z^4b`ZXsqdSNP(Ou<$7@Y9%IO
z$apS1kO_3wpAo#U$gHM3`$n!<0-c3Wi#jTAld`^uI)JdwGwU}fNaolbH8jqJpn`bm
z=0B-$)kHhN8wF%r<?<L)ZPDFiyyyVqU;fw#|JOfX$JG~2X}DUDtqK%|VB{fY;r>)E
z))2oS1RSMbBhN?-k*u<89;GdwF>?s01d@X_MOVA};<p+PB=Tf*bIXd_`Am5PlJy!r
z0<o{sFCw@&<B?!!mmP+kmKd*>`0AUc^#A_U8T{z$HgWON1hi@4?gMK<$SPA`*1I&V
z$p)6$I3al_RU891g|8#D6~HmIy(`-h)Jf}vTh<2j-6r`~T6j2a$x#-UgT?|$+h%Rg
zprvki)YqOFg4nua!HOj^8S3XP$3g*+@hq^mHH#xBc7aOk4>d_T$_aFx3|&n)n)1rE
z0Y-*xJ!Q7j@y5p5v%mHW|FptcT+U4ZF#1KH`a#~ar;jUkpO`N0zVH(rntr|>t|htJ
zY6)q}E9OLp7PuiKrZYRnXCK{-&pmcNuwcO<H@vY?fHqf<bRPzHS-3@zeI%?i8ST+E
zmr}DdNl0+k-&k#CqRLIxxJq)(8#HJ3T&Pd3+(v}H5ShX}OWuFVKt~o4-R8{zAYG>F
z?6rJm8y9)}$s(DqcsD8(an?R{FO4^{hNNkm5ev@?VavcWu*KL#7C-R4WBkI;t>LeJ
z^8hp^jMhr1EO$}H3!29H$}DG6Gp5HwEioWc@Jb$t?fPS}B<-*?&h$zESj`*wB92pf
zEN@Imd_ZJ#%R3~7omeS}_;}r10M5=OTu%yYt#q-sNBH}HV;w*L`ZM^pSC6nzSzsji
zI!{@>ZAt4sWx4bgCMSC6b&=l79Wc}elEXX;U`)a*>BAE|9<TyvDyB<wA@^<M1LC6?
z0Ggw<@G}DZgsxoG8HkirVz@x%VFfG?K&4jv=`^DTnXwMZdmc>k9O2%__Ta>+S@il-
z<?V{wPYNta2`l+G$qxwwyj)^bBg}Nocy@k%i-=wjXZ-J4ivQIe_+L|&3Ahiv-qU#W
z$#1|#2khGV+KG$ClkqD|cd=`VkRZ_`R-quHk_y*pW{ZymBNm0lXwbzX)p*6rPS8xn
zKxOozCM}3#{h20|)*t~eC4mPO$QaO`S$AoRlDd@SkFF3&bOvxCBFS5U51=ZO`-bX~
zRIiIp7m|$hud$VA`G`{yTHEQDNPiYHr75A76H(AYS?Al8Fg_B`>UjuX#YlQ;>2sS@
zCxB{3Su+k?%((R{r`W%*#>wLy9DmNBW<uFzf8PMa`DDtfO=C>cp5{-?un@Nix5WNO
zQl|6y6t#i6bwF@<(~^|loRm0O&UD}lJ%=HUGYMKJFfA`d3IJ2+$MA7fcm!kIHOZrm
z0y7MJ?X5%n%YU+t*M8Rk2bL<(h?C{Ws(Vn>luJ9;ZoZ$ICB<Af_VN>rWGqGwa??Ef
zStFz?e*<ORT8XCv6W_P2Z}M2d$a(P38vT(HJgr!vWnAp(kj+D6`Az{ou?ar21?n0#
z?}1OF3~=tv2u<@G3{(L1Zo->Bd=2ine-F9~69`JUnQN?l&*+@^MxsaMDT{Mnpc<~&
zxo-8v3ogF&ou9n@Z!Q1o8$b4Z!s37Ha*hIkBLp17Xta!tjVth?8?LJ-)#rvA>nmSv
zP5;8OGl#&OX>CzrBBfBE<bD)i%rIn86XVp$d3^0nCvjl!06a8N$2J#@4C+ZhKi@VC
zw-+)1-kQKH_CYfpm+O^Or$G(D;J%Z`YzQVH{cPbiKu(mr`LnWmN+3iE9aRO3x)ac%
zMumFYKno{oc2~ZZ#3V^|6bYH0k&iu3A^o`eDg@{ON*m@ChOG}UFs(7)wRrK1C%E;i
zCYb9PoIGZ*eA<9PD1z0*P5R5NAyRbC+l<)}DCZ?+*>~TLS1>_k2kX$cDr76U{5#M<
zFWw^&S{A>>UXpY@%C+SGA9z9Xlc2wVGO<5~0Jen5us}UBc=44r{?QMu<8?p0hL>D3
z#q7j_rcr@5Jz#OGMD(LE|C&c+AY?N7TNVc8b;xJ4nF8dQwm3hU&hng+RHy<B7*}6Z
zdU10?@Sp4(=|06#7y%T6Ij*BYh0GK6bPTwvVV_-b+nrq_8j|DIysZo%Ase{QIBmQ5
z!}nZ=r`LKYyHi*;Vq*wt`?g^~WHbuGSDyCp!q~E<>DKbJL(}(Ob^Q&u@4|`UyKjF0
zXKOh}0YE7KhJYnJ_2dD*=#uLPld8UXJh3;Hz4;=<0VEJl4YpMP-@{;O4OlR!U<^0s
zaQ@r~FMZi5F2@A20Z?-icC68?ME7l8JZ3m#Ke52n!t8UP1y&}lYSU)h2)9sw+@5SI
zZgoz%rOx;riARN?NRQ_h5H-dZAISGHGn$9vR}twq7Q3i5ZqH=h7JGt;)J;2Aow1fG
zEyED<EeeyR`p@xqnpzYU<NQ4}UilRh+;r0febhMoOo@&45^N26U54=jUB+j+Y2vi|
zB8SYvBJxt7xMl33^Q7iU1Gb2l(wNhe%4MCAD2`iaD@YDyeNA=JW6mvXR6jyqO((z&
z`J6IL7_61x5#h3Z6a2ty2lywiTgPAi+7Wh94KoNa9h8)qzLh5fml?o^7>qC*Nj!@-
zB^ZEE*hVsmCzQiT0P04|atZjCNPf`<E~xG0@TUL?`Bb;y{6^iun-I4KS+^B(4)nbB
ze|iA)+Ac*Sgp*NPM2J6(<85mJTB>o^!F_nkyRXHhR|Cd^L!M$okRVu|pmv}j$)v=C
z1`Rnz1Y1ur-8wmCJAM1Bzy3S#{OO<hIoo{j>?!AF3_vU?WcHe?uU{|A-aEP4I#o@#
z5YFDIT-*R;5*g(_@_V(>GADL7pc%r5YJBj%130=qOJ>#`HjTn8f&dvE4W$s(?lVcb
zL7<KSuMA+9H-WA}3f>Am<cxiT%N0scHMY9){pMUENTEUUIi+t?f)N>=9;`3cvPw0a
z9|4r0L1+<axXEo5Z9>Vu3c)2WKFMXNNZ%R-W^9*rKN@35W8s|kK8^!5$Lr3>0@$>e
z8BOr2mkjVz|JOR+@E=z2z2CHjy*<YINrTD2fIwW79`GoOH60_AZHBYd>}k$q!5P=8
zSOUfA>0Sgiwvez&C{Y=><uVLrIV7Zb7SHN1)cliBhZTKsj~Ng;1wgjIV55ZHC~@t@
zQ~bm4-@qIH^BMfJA6doC7mrb{*Pv18lkdA_d8-i`C3Q~pMlAU3-fqNRH|dyL42fN`
zTQXHwNUh8Gw7TpkV?07sa=~Jcb(%oDaH&+ryJG#O`O?E^Ft=|f$)}8t9Rj8`?8z;6
z7l;x472rd8Kv_^w@-i4G0Ga_GI=Y1C23?{2Jw4it4N_I7DWMQwAT9+G!{fRJp&FaQ
zocZ-%{09{pLgef!=iF_8+m(0x{x8;7-|(6*%nUXk7!B7hD0>UR`Q?QcYlYQPq=gjs
z*NM=Xo8a-Ii}=Vr7vQRId;(Z6#4Cib*~vk>u-YjE0-NRmdEu__ieZneffjrI%HZJQ
z(mfL|CReop^xDPw0<4Sp4yPufP)I8-+@eQ$S7g<4m9|h-{VoM$Y&zZb?UY^C-B3er
ztx2WlEhKf~jzr7;e^K{lNKl?0$)m%YLkY7@>0Jx(fU&!@c=cC~amy_gK7a2Bw|$_G
z&)(a|(?<*H%mAI9bw{9rE{ph#Qb>mY2;>d+sPn=Nj!09TfC4qaV8g?J7<-}mAIBTE
zCDOdH56cf~U0kOXZ+(=Yjs3ES7xsi*DrVH<5~Hy}$-q~<sKVF2YJhM3mI1D~Xo@+u
zz>vXKgIuMHDYTmdkYL~oK2vFoGjC6x-WU0r3v~4|L9vVH+T4of_P7fHRx_>)?365E
z7W>{&&nb!0oZlEg9OOd&O#EE(F{>`cw@L$hWCIvYL4AXKt0Nc+jf>Hg$H*B-765e_
z>(eej@#tQno&^=wT`ZN8K_Q<u4~4jMAj*dTs9c|{t<Wva={>u5pFZ0I0D*IU3qY4w
zf8!4gj~sq<W;_|cn!58n7Yx{R6Fy(ST(EcCPiMWDg0VR)F>4LJ?kk?d9M_;KR1_{T
zkJ3uYWF>=|R;vGJ2nYdzyJy_drtm`6_t=2?UIPS55*&H~fuotNWS^{9zov~9YW!gJ
zL1v2QR#8J}$Q#9S4fQ+|9pytqa;S$|yuuJ^b)kdWGJ4Q<Rf~i=k%kn#5YZzrVayhc
z%df2Pb+4{*%grNPyq~eUT;TNS5~Bg3t_;d9K!vCW4#7laFS=q{=o<HfN%F1df^ePu
zpD?}<lR_Rv<VlD8*c=4#7N{Yy$s**e3=J{H1@##sR1<^I1_9FoOMSv$`RWnA|8H;L
zNB-UhUh@qjTsSvHZ&U*#7Y9Q{e&Lg5QEi;3%V2W<h*F4(87O{3t?&51<koivVAX+{
z%#$8}5%Z&mkXht8!pY`3oH$5tNyIK=jYMVfLyBNq)!pzASeKlvvaknN0k)t{9#|wM
zI1DWlYD93k6@2r>Jn+QYJl^mJFQS!c3F9*WN{gdK^l<2`ypb^;<4)|IfF~80jyGZI
zwR<kP<l_JF+~G%0<18;b06>&S9{Ol~;bk}RXs~{3#pQvrzd&H?*PsqGAq4%S6@n|`
zH~)N55>B03z;#!z;rdI~zylM$kG7=px=Z1$l5)tSV!lttoh;z3321Q!)bBVKbHEsx
z0+vcAe4di3Wg^lmWr`*ylr@;*6DW=sK-`y;3R5(mo)zd@_cAos1P#px6U`Nd$Q&P1
z@rpM@U8H_W8QM@J)ZPzjJgLYCWr?f#A$7|d0e~eoQ=%?2F1g6!)?26e%CDN@#_MWS
z6UJz(gN@Y^Tbo{476el;OrCH`DcaNqlN?AZfT9G^#JECy0cB*%+F(j}QB5n7K8fm#
z+@8Mi=h8!V%<)!%;d+VPGlVM-jPQNmHNZdm;Vt~N@7}^!y?ly2y$WV%V|0JuyV#gY
z(<{f87FqDz$YZpmx*T{rPMgdah6w6fcvW$~d`8x;ydNQ$G$_FQ_TL5*D~2T5QQ3BI
z!>fD%Em^W6Pf%7D>1SHn2Epz9A9p!Qs8?jwr}jzEI(0PA*<amk{N~Rt#%CY8fPVku
zSE24r{3T)Ogi9`Bk~kLi1-fRaKAnI9m<*;{tDtKAqx<*md&jZEk4|uwmz^zutekh=
zzDHM1AOB=EUcZ&=eH|j>_8~*SncV;7ushjs*d?$4cRO8KR#+Z%`4gYKh`#QoW7yTH
z!IfuF7RpFU$MC~K0A}gl4Ev%CDhPI5qdvBV^6Gtzg2>%tE-=10N)-^W7VkoHW@qW6
z+foMF$-zb;m?L`so;-6CXcq#r8rGMhVj=_y_a>6AVf~1%qA`Yq{8jhW6REz|>b$~8
zeWR9E<QuHV9v)N3LR(~MVi;62um$v}#)~hias4GzyyhDThmQ{N;g1>I|Aj7|c%sV(
zkCtS5F8Ph=FiM|&lC8SQKy`#U3o2_V>3Ct_ADPfb0E(p1K{@rZ>6Fcdd#&o4P>l(;
zCQQe`t{KKn*VVY{$^pLRo5r~D#wqqLRG2LpJYrxCJ|+O7f0CS1Nv7{|7S=H{*_^Pq
zYymmX6t=Yjicwo=0p_Wxj1)(M+1aXQwINOtjtlUTJ|G#;D2#(d=w=3n2)t#*iWi#(
zzVyFolKT2P20XH`$G5<R19Wj~!U*c9?LLY%gtI4#lqIlEB|iGu3ox#LvaC_VWLp}V
zERBSh>Q*$@l*|DV-~`(mR1NBWZ)R;}?c@;WK-mERy3lnO?i((jzTnR1o;&e9^?3d2
z?(8nM)-OS6tTJ?PcU-;VCNoY9O~fesQ+(`!^YJ&2FXAiqpFwp7pcuF3_9V&6oQMNR
z>(1C-i))g)2D~zaT^W)&Zx$HUTDi$=Wpe$+YW(-lmq<sUXEatDN1-VdZDwWXm6Df%
zQp1vbLMqy(MJjbmc*)65A>hPWYK}w{eUL5~X$^DsxBo2PuS~x-QktaSG8(E}N`Tih
z*+UjF5sP7f2Ng=P*k2OPyVBw%SJl|8N<8>*kM6y{i-V6B_~hL^Ja?vqErDsxppwz+
zGs@DUFg2`2Os)dBJ1pWjGlj+Rlz|&32jw4+4Ei1YNWV0v<OfMeAT}7Hh6vUYhC@O<
z0lJ33)}jN(%WoLtmY0ul&2=@t>eeYP*ju5?Kv4lauwct#J3}Zk>pTt#tY-5d?_1^s
zI^)i;#(!y&!kh~pi<g6i#Tt*t39gh|F*Y454q!otY9w%#18mOwAJ=RE8iM{5D@^Uj
zWf<Zf7>c*$BFff^{E9uprgbLL9uorv!JgOzkEWnm6Zxwd5t3*dy)Fa+q8#6G4VVRs
z^<fY9KDir}nfU8}r7R$|?wc}3wCJs}n4yvhZodrx72s-$g6!(<J^Kz_`l4(2$uE8y
zXM5QJ09m<Z|HZg(;kmneXO{09jaIJUnWX|y`aSUzL1gnvB?%T2mjE+RbS$0Rn8l|)
za}i$rf2^Y4Wf#Ro1hNdaVlS0~VDdGp^(rlv%mp^FJ|M8~G6q)MTn~9+^&=BP+bF@z
z-llwclXjCvFGNnMhM7%1ZExmRkrU9ezJ<Q#=&s@XWw3}|i|t9_pF$tp3^wwdiKHUY
z>Ih*G%q^r&W{0LXsn3#ALHaShunPx~gd)a-K_iO}0lPXAeC<s&zV@X<tPKnvJ5=KM
zafACl-^Is2-NW)qiSfu_ZOvd(8x&ojKf~yB7{<6WsVuIlWjMJQb-Kz#$Z_BVieVT5
zP{eyFj6qBX;pdX9!E{6z3;?nQ3p2pp*$NALD!lT=Q@rvkM%aI##uW#qxb%V=W$ngk
zHWA}mV%SHRFDn&ftL>WRSz6WdDQ;UM)cRec<~#+o)TG&;jrtp4nzDE~vA#2<9Oj~F
zOp6MLvSrE*OI`yxIi{2;D0w8P*+!_mG~jU!dtwvlQo5;>#o|P;^d(4U0i5M}a6DsY
z2@l-64=0xwxSW|#?F|J9rlNtQ0GN~?6v?5FFN!CKxUR-z>&cOBw|npR{Ppj)AAS3;
z<7_W~l4>{?3w`}}{gckKkAC3?j-NRFbDdpRomckyPEkuYV(_e~%`A}^Bq(yRz>Hyx
zH+p>Y`5W|GKl2G(HM_-jjff2ZYrs}o^qhoM^aM~Q<g|jMaLj2`gD%>I;_}_VwDzI2
zLeVt@Lkk-aoV4X&o`=uG+4f-V8X<ui-IBhyyeSDLTBl<BKU*9L>QRE<Vvyg<KSb=M
zl2JnN8&SP{Sa^40Tfth2=kHT{ag#{)QyfE1qMdX%;}_Y35JEiVLUp4p2{c3C4q<%&
zoY^R_xl!VY$4cCNKjGlv4hDlR*3K9lKV@)cjWD&0PLI&(GRltIhj*9grDIseE6{ZF
zq{msFj@J4V6qZ2ldKOeQVLD>i%3`iZ*uRHy!Fe@i7cKAEJ*Ahuc#2oNY=V8~)mWOF
zV)vXy0f5H@J7S===^E+WNDq?|aZ-~;`HaW+l)qSgD0FQ?`Eu$LB&5V&+gY5V{<eOQ
znBQn?2LL7BbB|Dq%ShHI6~F({`nX^$;S3;AM{;T?OGi~2WLsPty#n^|I_$AEV8)1U
z`E5{7r~K3d$$29&jbvd<U~(bwlmGP<c+-2XLVwQ|DiGYZte#~}U%%q=HS3#>*(cNU
z3{zsXcAU)Q)JJzME`HzPr$2cd=Rn!<0JN0XzV6>ofB8rM>Zf`o9h#0-&MW#C0Z6uB
zSfkn}Ckjb%0tD8y7AWV&^yG;-eE9B*aOt-`L1rU9!6K!(cnggMO2T~|UlJBAbqx6A
z26)dbXrTv8YA9zXLpRVW!~o@&r}SA|K4Fg{r3v%TkXUb7Slo8jiuSJx5G1XR%>B{=
zg0wfoD`2HO(q~D5y3eGdm(8aNlM7U35zj5i$ROS-ZA-eM`kuLed7JNL6S>Pd#D>-k
z-U65{76{n2#Na&@uD{ISHGdhfrod=qaO5!I(WeU>IcBiAS@3jJ(%K5)*a?H<%O#dq
z34<X}O$k*U6c7M*$i+mOl8@L2`rR5!3l<mdt8w50i+$%=^yVzO{Th3BGp;-^#Whz|
z*s~ARF%~5lU1Ahf4Lbp_k-#l^m$J+~rIkMt|4Go?qKu{Uq7mmHTt`v8E2J76S-Dj&
z|9&3D456N~?j;N<)=#jU{hR8MY+UJw2GTKvC?`i8f8zC&x?HbC4c5iVk$npdl?E70
z!KXGsWwyj4%B9HSDH~xTy{ntzO0*zg#^Ti4ES`C4574W9AM>^3#-6_7<cZ1zLYPPC
zt&BE;wLmqT?%uU@V$a_5Mu(rqIZ<{1K(p}w`OUNRm%jP(ql3Z59iz?l7u)K*UST>2
z3O5BoQ9~%PKPndjUGnX8LlzsB@!`8K#&^8xS?uqR83P|hAcT<0ZIyZdlIu@@5dm*$
zfRTkgyo%!b{VvL?cAKzq(Ms#7;no)dEoRvhgUE%b6s$s^DOiw?LH0qs7lW&$Qp^*d
zv=wO}DWN9>qi8zCDr7F!ws~s^cTR~1WjjK5CsCGY>&O`Bn~$f(d%}_yvL9`(kW^=k
zq9%YR3|OE<jj}L6QDLqC_FfL$d=&#FflH#A3v6r=mREq)b%Tv9!gvZ)6``sMutg?-
zO|%55U=#(T+p(CPvDmW&?AvXzYmw0{t#i}Y04fGq3#tK3$a$-33nuHbT2gY0kQKzt
zu%Din7MFLEGKsfZCN$;P$>KLSyeILs=BMrTzXp~hyO#qze`}>QfrIkY*W?H=+?Lgm
z(_2}5P|6rBcwJ!+VN_7Ck~3N+FNFwz^f&(TiB0fi3YsZY-QH<LafviAuJnI#`knz=
zV0`ZWefZ+RIh5V03rC@}CZd0hDW?(=cnUQ2l%(`sq$d&8)s$^L+UoW9-goJhSC8+%
z8|OsX0RXM#3%K>Gzi<8UGyl&W9UA`4YP@x!ncV}}I#X{5Xj8&UihG{%$sl|PTobze
z3im#~2X{Vn0sh)64uOY$-y3@0O5MOll!Q;?S}`wZI59uE2D~<eJ-z{RU<t5R?5hi9
zFAQ1Ylu0JH##5$UQlCfnztp_hJ@u)uci*wDyzL#Slp#c^5*kUOG~q!Cvf@bpoNnUX
z?eK+qr3G+7NHh}T$on1oq-1v*d!(&&COnT-sk@XOWY*LOMte9l!WH~hkynYvf{9U}
z#x5c(EdsOzlqCaQusg6Xj*CewCX=LE0G45EfGfWpFra9P5&=|mqBU_!8_Pyx&<t$q
zsPX5U3q^Fa1?J@nNWy}~#QC4{bVCC?$ln?_WQz4G8<5B${-Ef6h*=%u7?2O735Xh&
zNLsTL0^f3QB;O&5!Y5`L48Ww#u@X*3lm&QWg8KB9OG+k>7`iPawMiNp2{J}41>w-)
zj={tL4?VOGr^j9NdIMrMDtB#~D$XhjKL`wY!b15Zd?m~v13Mi8TyKm<qkC`q>RZRR
zy$$C?*~tUYT8_|NAO9)7{>HDItgW4X(P&&<U-lQtkkP4glI9?NMmGo*p<tvHQ`FcT
z^sxZomA4+J8D^%5t415e96pkIIssQ-JB8zb@hq^|Gu@bgcK1Our4zuiKCSsE?eDA4
zwXn%`uNt;i<_)Q#>XA|<moQ$C$OJJh2DAP>022u+M57Y7sJUwB&_*7W<}HO`UPbN!
z)v4T+7nkh-B9$*PAt<dO5?cqNu87;Rq)1s0qBITNW%!Iftfz_+jx+3z98wLS0x$yc
z5WoPymIV(P7+PRp!CSS9$RDyxzB9JY+c0IAiecFQ1N*b=!2;vhhvcUg^lu5O)u<?=
znba<Vc4>;G;j69dcEuLxlJ!H8I{6gbSAI;?4n@_(F$ww;!WNoND3zs<&MS?c32G#B
zkNg<PqSsK)>q0PPHyfpEc9P*CiO)bm;L?DfS#>!`x<$G?C{`^PjpYjRa!avz=&^xW
zVm!9KfH%J7ML0R>pwq2AXvl6A)XWg;2&hBJP70Z=!jRp7hzhPo>oil?!?W`XzkA!8
z{@n?jBjp^w3!qUvzq|(ku<yKE56{ldexk#JO`eY8*->r3>Lefp&2%!qzr28~n4R#)
zzOWw;9NY_@tI1kto}|P&oa?|?Pxuk7IwX&T``X(yT?3w0u!mRO`Yk*#X*Fh|V_Ymo
zPQR0sC;nL(tiX+`)EBO+Qju+^{KLm#kkA5G5;rQgKy20mM@=h~>`I;#(MMsxsP0ol
zc&+2*I2?JVUN_xFW986^$}o^QDNCr|Jy)^L>#sC@_|;|~Tbpv>haAGp?j#f^UXE$0
z41>r5#sY=DZ-6NM3xf!X-sLoA5Z6FmJ9j|sqXaGcdk{E94$3~+&~H6AlIN3GMba}(
z7K7a}GIj=@xS1f)wlO!Uj*!t%K`P3gPYE$K_LM+J)i3Mu&^^b=Eb7t7Qa%^aQ?lw4
zkK{{H_M5{NhnPpTbr%`g^I*Uyl3padIQ<g5G6b&--EDu-)8uDCWq1ty1E?#mMSm#L
zhJjrcPd>8?kDprPqCWu}FpBU>wzx9yhoV8YY{R&u4Zv(sSL11?Ti$>Eg%>a594b2i
zVEaPvd&f`I=bg9z69)A|)p#pe4slT_$6ox+<4Od#9!HBdSbv1FW9j79EZ+O^E3jrd
zpbk<%pKBgLktk6pF7x0hdr6$@&Y(!YfL$KKp4<cqqZ1kBXeEwB3P`bRND8(#6p<+)
zp`5qz3AB9DT(QY&NGqN4SCyYwXm0gJp5B*4cXLIND+#HD6Ov##-q<loHbD|<QcL~C
zO-YtKJl?WZrn~e=$Z-k95Us3+YDmM%E%NZwih81Ampr5AE*`V;73YCvY3T@01lrh8
zfJQ~sY%Tath`4QJ8G800B_TR!9%i&xlGmAaAR>VDFZN#Q&Ag8IYJPN7C}lOPp}uw`
zsytN`*<HV{R-xb@wRN!#IFdbN20G-f`#rjjkOLt1K}l*T{*FMK^+iqoG1FzNRvmo!
z6BlD-4Vl8a9V=n#q`Cvpkg`F5n$`)3pEHPHZB1N_rql7(-B;iEk{tkW4wr^}u{?fq
zes<;yRBcu4uWvI!4{};o;TArYl3vIcg-D4&#)3OzeC%@<;mN~`pvBr7PEGSNF79M%
zW_P)B6eI+=2wM0QsKx*VV2`eW2Nh5jh#3NN!%|9jM&lnhs3VfD<^lwe65LxSnV^>M
zM6);>zeO`K5o;;KpkOtol^^hmxMeZ8R#UT9_aj&04KqLMM%!}`a#wB`N#UnVJ#E_h
zKqz_6L-SNbeX6zQ6a?A_VA$d&O?{yJ)8;^Pez1)>$u8GPeRK5S)LdrOCrcBF4*++g
zrc`nsgT&#q0L><9<g7QD7YMpPA$>JBp2^4Mqdz3*k=Akp7whPoi0}k(Pqhm`rU)z*
zs+@YiT@-jLU#ARYu0%aM`T8RHOOQ802oQj>bQ%9PCP2qTk9xc%k~4aHz-oP68N`cn
zge|~}jHAyj;O<Ax2Rc(A&4{B6v#3M16ILF#4MxjR1ZRYSola1iderUro_q7J{IdzJ
zy6So0&)HRW0KoQz0nm*vxn;DtYxnzM$4BeQ5H6BFAm>aM#k~1mO34H+?umGcfEnoY
zCpfm&#ciLw6r(<Y%5cg6(VZ9Ja&(;u9p`yn=Eh0Ui2faBn2rGk73`69urXj`qTo>i
zD+tUcVpe7W=N|*fif9Dx#m@Rywox-d;<W*ZMo(nY5<-i#b!}%ZQK4JZA4F;H6!;-Q
zBW{t4alE92wgd)k7A|KBA$dZBW!AKFTj>=ak(1>u-F)DTcs;QGP}@#QU{Zj10;Hq?
zKyTBCxtIN7f<j$k{-U0sR2NH4F3i}>Wh=E~tM?$bCnrjFE&N|`s8-+&lQ9EcN*U)M
zSkswhHo-`n(5?j09uRPfY*(z1dAu50O6tD`Fj5^<uPDns^Ngf(`hvo}0=zW^KerJB
z{{$6<Ol<miT0<)Wi&*EOo6Z*a&|Mef*qI)>{b>dhIF55WUqeQa=1Pj>c9*i-dQ6=H
z2lriY;0W_iQ5g(_bD-=1fIp%9-f#TJnrZg_+1Z(c^>~fL-mH|RfjN_GXhGFT4+kMY
z1XP9PPki<gJbru$Jnun6e4iV~aRQhp@e9e%f(VmBgWz%loZ5svwFPtwy?-zIMjkY1
zZ=nxP410L-D{6WyL|s|0Awfy9Xo3Povp=z(mJeG2g>(Qk0SPkUE9-Jf-lBCZf}lav
zr2TGIdLi~H?5$_QT`H#39rrwo$Kq4myf{T!d98%c!UH3}WMdbKLg%ze)_NGaa;u74
zaipv#(tt-fIzm0sZI)DVb8lpu@kMQ+8O+C;tMR9SyU&#3iI>DEie?Rpqi&q@l5o*T
z6CevfO^Q_jXKEQ(jH>|R6||JTlOR#%lxRKY9|qRqn2P`tl(B*Ub8&nzuvqnny~4Lg
zHo&7A##{ek9+LNl;%6!jLnv<vJVMYS&jHJ$E<W|Z#n>{QHmqf9+)@?8*7MiWqp-%+
zDIEfs*-p1mSL6F;mUcby+V47y3n%B!;kX?D@ce}V;EJoRIWyDme$Y;~w(4r?tn`MZ
zs@JWwu(a7J1QY|^nK3<bbPl(F`f{#jjSF&RMsOblWht>NxAanr6%QPQ)Z>Bx1K7i>
z;H@#xDH57!)!*qu2?&zWCzK`2Ui?W#+&t*kU!qJd(3Iu5jbhFvcSF%8E!MceCeUg-
zWtt5!#9B0_H-LcLx(Px}D$-18Za0}M^7W^j>M6J_ktSUT6&s87Bn{8RP;OimeJ=*n
zpoIs!f+yQSL<9}2r^O<jbI(9$bXm(jD^^kUN3ev%lWo&Rs;<xzd4GJ^`jL|>CQPm|
z8S~PH>4Rd4wcGela++dOMG6*k?YrM*K!;xx7)gdgd_e+5LW|r;zelx902v+RsSuUK
ze%%6mdJFdSmJ9sLyoE84RL*Poo6<A!y>JvX&~mQEo%ij*1CK6XW@h5~om_^=3<Nti
zPB3CS>BB09gcRS{dJ0nyCo}VlM^>lR+8v*|2B%J6hI6It0Du=ze(mRfanS9WJ9<TR
zq#CYsJSX4K9O3v5Ck+Qc?FIP7Ykj&@6c)Bu<0BtCKu?^Uhgkq%nL{!c@+epuJz;OO
z)%^*?_%Oe2+*&pO^$mDZ!5&(5c>y|M!3xA5YKkU8+=oqF;7p)OD4%J;CQjG%lIACe
zYhd%Yr81YwDmS)-kkJ7P-inY2qs3ZM)_U-UfS|i1BMK1rUiBEY8#UA&Lqp^~z9M0!
zAXN$D4nkGLG>EY}w&Uh50&i2XwD=`x%;_g1y8ZV~HwJHr;G76B1cLJIC~TJ1olbc$
zQj-6WN?DNA^IuYw8FG<xCtYqY2%x4m6`6wP$^(KJg{tV+X7!8lXDpoR&ew$IrnKm?
z{%3p}`B5o(L82C~jjkuFFL=^I^Bte>|L6v&0MI2bUz~A4d2p0;6baBDDwHQ(7=Z0E
zwu%z>+<zgK#|9`X#})oX4xSu_=7+{GG9s(zIC>!o;CeD3)T5)jckTMZYrgJl?WxoM
z506G4exZ!=zkS&O0570ibv^MV2d;dyAp6JlXtidpgbACi9%|zq@~+(Yr~BcBNZFs_
zp<{FS<XsnHJnPTa!Z-xruTRS})8%?HKZ>Y563JyoT?1Yn!XDoQ7bXg`c%vJ(6O)w5
zHmSK3G;g<*q!k0bXXqMr0*);w4~x*9u7^T`aj;T^)uXIOLFD{6m1<hNoadbl$_N>~
zSxU~7w=vBxC##n;p%|?X@p(>j&sza}v^r@boijir+i0Y{rETU%fFcHz)f+pfU(Cs;
z0zB2D)Z~%20edflN?6mjmhzACqo~rm(dKU74g~qR*8BR&+Lm6N#GBmUV|BA&u7@Nx
z6jQ-6{zQUMAYTXBV=Z7>^&gR!INxRwxt*FcMUzJg0ty2@wgwtZKwXn<Zm_S^0G6aj
zL(nA*T*xW^Y|TJ1Z}HgSMcnb(^HI!H>i&SZeL&6ai@d9PPV`(P%t%bez)scyOb;4U
z-}|fo`tRlF{j4uL0N@1`rl0t+-&~nrT)L-2ljUkWgtISL30?oJQo{(pOKU~wEoQ(N
zi>g!M?H|1ihgWA{=DaQD>rKd+{KY8A`j(N`4LuktiF?crsiOeuW9#76G1zYf$o(-r
z^f&^quX0J4jWyewQzcWPafgob>R2@B-we+SrL0#q>v`b3S!vlq%$xX|#otJ}Bw0}w
z?($r5)|-XmLZG+*M^f04pc}Njj@j0vvfR#Mr9>7P;jZQ;)M2$Ht4<K)h*EkD1YlKN
z;8aIq2sIx$!~;ZL_PEiD=A1_*nR#dwTX9s<p$*FBOyZWN#?C!6fgY(NjguYm%zCcQ
z1n<jv^zD!$UfRdcsGfB((^NU_{oKW|E3U{eb}JFHG3Trg{db~0104fi9)M47x!eAN
zQdYE(8&*ihMZ-guSsI=-#xsO_?z;eomgiy0%De78c!7x^M&f=FV+f5jwYNyp6w@UW
zv8@T!Rz1J4aFn??gLAO#0Du=%Ht?F)5bwX};?I^veQ!NlizZ!M=VAr6iETzWJs_=E
z_pW7vnXT~HbMyGXofl&~@3XHWEiWf1lDm~cq7!MANzg0TSY}voX@IImeRvh97+i`-
z@Al67AI$?x4NESwe3T(ArJZ5XDbY!ZmBi!mITcaPh*p@iaGo!SH_P-xO)1rUJ{S=p
z24EW-VOzsf#11GMnnfD{jO5C>ZJQ|?nIv>YJQb~GDfky6O{4VWmbpqGN$FLF&j~<+
zUjDhrg9I6@rA`!ZPA;J+ffQ*jvgDEPYs7z=oZ3?mpO68tlzxg@^2mCfug5(bPD|+E
zN%e$a0s%k;Um;0{CQTbaP|tCj!$bo+j-yGR>b|#uJO#~_hTpC!|6IoalM43my8F8@
zY0atm)^+Ojn|Op21^tPK8Q|FF9B%u}#h98JMQL3s3b3lb*=?Q5J4-(VlE72!9}p4h
z=@?v%SLSBtK6%ZHUOs9g!P#DR0Kf|>KLp@KR8slu(&DarOtraXt0`cNjy_hd;qWuV
z*8&>LeM~ZpO=7(Jj>~cA^a8Meq&<;>0WCpq1u}e0ldxh`AJSI}e|HV+#u)YCb&x3#
z5l0Lv1ER^Dr=)GMmP11!07#}UPl0Pq<?ZT|^@}sVq76yrWKm^OCJ6k1IHEgPNb$Jm
zC@dhgv6%NyqKUBUomp;@1)>7ZOj}`fX&4xkQbTM(H^Bnr=tfnZ1Qwl<Ji?MUgwo2B
z^(cjw!#x&)7K(rK(7(nnVcfwnqLN;DI>dRC)-gdHYm}D+1+Q3aiWGlwqYGIqfp{+*
zca-rN^4+AY<oaUab;&E$+XHIaq{fQND_FZ|X0s0U3zlwR#VCHnsR02<<%tJmw3kPL
zB~JnfDg9v&uY(5@pi3ExNq=W158@Q*ccL5$eI}q@BHZ)9d3f^hJj&TAEbCR0?5oU(
zidZxNO0^l+=ugV#N?eUMP?-A6cry6>ul?rFRyo(63uOlYyrA-S00(gM%m2n?c4p@N
z2Gb|2;kvU3W0ajxKv}4GlviryW=e+%{n;9i99qQfpSTFsEW4Xmt+3`OSdv0nP*Yy3
zEk#I$&Pf0p1L_#qlN+$h?r0#Obu<8S?PtnBNJixe4i&_&b7>}(p{Oj20&kw|Yi8(E
zsz$k`^FE3qyaZBjHFPRBg?Y-xlaV8{4z+d1sy%6G>M#e++@v;*Sh7g~S0dD&Wrw2s
zylHQ11jvmkZ6Q|rHQX%NHh2Z>l6I0A5fvQb1o4{x@>I4SPPMI@1QS)|B+Yv{mIzwK
zd(shSUHnOdK~x(Yfn_?{mYU07Y0xp&rR9TW9#+r9CmMl*A!Tv?PRkgCc!C0gsieI8
z;`;*b$nfbc@To0O*Tj3YrFTT)ZioAG&tMKTgG?Y;w&1?yl}QKhx#IvfCI)54a`F@i
z(4~?fit)z!B>yB@q?=j9ogB=t)6HsTcINTL-TO~nGS?csb=H?10Pup#A-wSyz8&3}
zg(nu~=kBqil?hkVB+6K%q>LCqYljpaAeFlR2?80$uw=aVj!W_AbBi$ZHMr)e<%s|z
zqV?ll0ED<-7TS`&&2S1J_pMV&09)8YD-PXviUh2KvLSIpdLG$>79mc0tgRjpVbQ1z
zZn<kC-|J@<7NC4gdS8-)2<=FLAnk{ww6XyS1t<T@N8Y;GBdt53_E`{CHNlkTj#JI)
zA<r|>stm4QKOW`7Zt0IQy;#+$oI8#8GRw}7OS1r{Dax!`Nrh+;M_2zgpi=!y7ATAl
zf|aQ^Jz@~BtVw}w$L3yAMzQ~;iHj15XH{vw4IoeEa9V?neke^T$<w5x90#|2(BNAy
z2RJ8^-<NM7-3*v|S3#6X{Q^83!yesm^H5SsCE&-LJbgY&-+RG?#~;yx_a{T-{SmM=
zc+S$D_n(K)KYTtglcruKWl9OTIC+cIG-bqyb+k=Ap{mDRSHmq^*YCUT#+RKlm;dBt
z2LQa_@;HDW!40>3!}@H$e1D0-N<H3yF@;bq5LS0G+m!1wed~$<3Jjn#Tj7Btd-1_f
zUXIZ$0Uh>7sna=F4X&lq7j=p(YC&*O3@J}FP_F=wD%1y8++{IkxW*H5s~0hbK^`*-
zus<a12#rT;Neoi@C4-kf%Bs}Y*e{3<WcG6wlJ8${5CCYgM50Z=sycn~UgiMMiDuFm
zIotA)y4L+@v&e+GsD=?Hw`I)o@)U8Rp`qWDfg}_}sLHg^4#JBQe@}B6HLSFb!<0rW
zA=G2kZ^COMn^d4K?>nc8Gu+sC*mX3`Qs6Hcr{TY&WTLX%(qRV3@2M&Fkrp->3?o1G
z#cKMd=Hr{0vs%n^(2ioxV?C69%J;L$&az=Qct9sUV!<=C4daN#4mgkClwl99fk(Bw
zSS&mpcuCHMnCsjLCjkLC^_?w1U0{tm_|RuA#_@5<MYoP_m6oH%k!-C%PcEx?`=GLD
z{I3K%8B(vHm6@4^C*JkDKRdxWT6O@y3oD-A*74T=`j6`i&cEoPg}L6n)p*TXw$Tz#
z*PbG})1uXoG%1oZ%EXl&<XK^A*zOeX`uJsd;`k!Wf_3gm>6*)WCI8lXO4}?>7&i0w
zQ`dl32Czrg0b`Kw$vdg)vy}(|8uOsby=_0vWI2W_hz0B+lHPbIGg5(^T!B*JSS5^e
zi&6?Dt?A=Dh|8H`;83(yWaM|Qu!5o^;Z@1qA{ijaEHOE3jRP`|hZdm#+vJ65VkSk8
z_RpnfAt~%8ox+?1i7hO5vE7ne#qtttRh8;XPE!`3G*g)*pU*X5sv{18vX+CP8QS6o
z#oYVc?#+qdCmiL>=csM#NjwvAIH%#HoA6lk0EtGK#aa^cpDDVew>iDXqSElJ_jV*l
zS&Iio3J>FsAM>F#@X83(BLPC?_yjpansT*%DUCT8A5mubCU+4&e`p^*e*XcKGnN2L
z>|Tg#wRzZ5b63Jkq=!arXu;8|o(@nL{`4i6Uilc#;j#k&UU*^PZ47`exaMWgnzDSq
zsW-Rk$(C5u;lUVdtQG`I_Zp}DL#Zg38D)Qrr%%t~y&t<2!&w6=AubAnaIXnVKGfi)
ziA)))QiHNs6JgOB0!jmWY(1t5P6AFY@-~N>Fxi5XqA0R}U~NZvLk+ppDv+c;k^w<d
z>Bsgmp&EW|coZOnqYz?VQU^z-)*K@89pUd5)@U<TbC-Z1qZHst17zAFGDuQ_ton&o
zZ@LubDWX0+oVuff+Efn_gW{TBHGYp`xb+AhXO4@eT`bU-elN>bs6d(2Xfi8ajCgD5
zd&?M-Qp{aIsV!=zs1*Dny2NO1)wj0GsuiWg{iH?gK>}P$k4l~qM|tNGiAWDcpprEH
zuv&xP104f<dcb^q!=3jpf|o?Z?<?m^P{NFGo=B~wa9Tuq`WT=R*yxwI<Ian4YO{+@
zcM7#N12HziJ@FSK*068CVIT!w2;c|=*c!%eO*<X)&}A3zIgWF<>;QllR)oZQFW&y!
z|7yDLybC{FnEHX~XdTfMBqPNR0hGK0006&VA1)07;tF*xb|(W2Sxk+^`|i8~j~(9y
z-o>!ii(}TxPOgvOMNsb9Xv7PPkF<>okl+7j7Z0%M;{oDmNKqijpR~CFQs!*<IJ-0{
zcB!FpvdXjK+}SR@Y7C@=_69J7rGxZ&Zp4y5;|?kH!rZWylOYbGdEY@2Dj{p2R&PQh
z<Rfj-C5}YWL!yC~%$zPWr%7?w5Sr5161b^xv5_E^%rfi#rcA%cD_@f*LZv>4iZK)9
z633`<OO%#*aq<r4gUz;`6bKKXK`M7iLc#tdUt$(4Ecia3$GEm+Cd8DXK!Y2>RPbv-
z#;xQh31sppF#yOwH@`PhsVBgt$JTxjscl_RVzJN+!v*~frm%-riHU&@$v9*+7eU!e
zqrwVrUNCxOBVo?j0@%fP^yqHf{;2~%XA0vP$`YxG$>115R=~i592X(QIZHgBo_FLj
zu+t$5J9&2Rp8a2V+gtuqg>$&<0DwPr*#N+_v}^C<onHS=JKY-Ey7DP(MXb6M{z3?(
zxFFWwQL+mdgl>O=C!d?)w}0>o9`s6>uFPfcq&l%t8jJJBgbPuXh8xiT>lpBOg8JYY
zaBZD15S5d3?IS4WwE9`LDK$z|?vx~%I-=KV#)_f_nEIgV(27p}CUt-~ML}&%C@V=?
z%}Rg^>pL_Ye&qldGR?vAO)*6}4}3aNVHr7#s7_~dt813lv-lm^_768LQ2^m;WvC8_
z`3(N8xTS89POHcciuV-7MW0fzY~V2xV{2O7O1cM{M)vUaT2{?B2uZ=K<Xj-GJM39B
zD3<K9Cdq^11V8}vLRF`EQCL7+h$Gi=)-NDio~k4!4&Fd@b#Ug+NmofngbYNFMjDIX
zf+3W~@$WOMz;No$|BGUUJ3i1%IwQ1|9_CYYJ>nYzb%Blf67T--<v6l3i|))cT~n^}
zEw`6&5(d%CQY$`qBq9tDH+@#4O#t-8veWq-&hfGX0RGhFZ!!Q}ecd&K{rmQQpv2_q
z>3AIs6Lm{m-@!tN??z0T{-(&T?kD*@_<~{kHGTNbi|N6GyFt6X#Pw0pWGHGjDJ!Bn
z5H}VoS(40mgcAf&f*1h(0(NzX>hP*d6<jo}_$+TuT8S|YydP1#J0|s_A=h$+5&sOG
zcZ1Fxz%7N_KNDLmIYfH?YV^^ero}9kkx;g1dAQLArT)aU!P&6Iw8&QD<tSRCw)Efg
zl&}C(pdUr0m2|N(o3^2(n9j%pQju9O+eGEic04AVL760zg(pnVL?gbWjFoR&TIo%T
zSdNF($3ZDl%eTnro6Q5YaYV5Ag&N9f87H>o-VH_!uZi1tf)SEs%h3wf)aOVF1qPHI
zKrNl|4-^1*2=>@I>XiYwU+A?j**z+APTLgPL8a)V(m5FqgLb*JzaRbdMW{Pdz}R$e
ziI^32*OBOQi2syF5%UL=my^M;01>Kc0y|mT*tKi-ef@>=R&b7&9RTpcN~TANf9qF%
zl6yt>3rlk|U$CQ<irF%`tF1Djqnx{`Hl)2=mTHEQ-Yk0+o;)>&ciw(ER=5Q9ZF(=t
zImzg<UE`LX%)1RC2nZlD5h=$NXUN_7_1p&d_y)LJisgt*Fb4F}R2+>QLCQBTAB<9^
zshuhHEe~8&&*;vn86(JB#Dpu9Nsp`T$d<HP)MhG_MWx)Wu{zdVBkzRI$I&(>5^$;Y
z1?lr`_DzC^7|l*0vN}`7YHpek%hwfyIjC)Zvv(rEK*(H}5w`udA~D{qZpxoY7I35A
zl%A0uaCL59&X+hHqet&O39|3Oe2zqsYDQ0o^oVH|q&RiTQy4%@cCA9FOPLQ=^s&)S
z@MeTc60Or!RwCJy0njVKrw6b{*PZ1bG=q$9iUx;INse$EVCGB{9ubE{#5!RBB{1m}
zc>hN)!!sxQ=*>)F*<X$(0X3x*6zy>{eys7%DH+qE`O9Gy;%c-3!{cM!4nFuT-}Qax
zZ1jI9I{@I%P_DTCmi4mJc{{4%>1w=X<U&Y#Cevuj^3xwPg*@8i1JxO3Zi?IQz6f_e
zv=_W9ZC+;=dWP1-ad_79(EpOw4Mi88k{V2)l0XGupIHS~hcQV|!%E7OX49vRhHlDV
z6&?wS=Zd8=qTI(J+eh>gsI$+FV5;2u45u|(EK*guc9-jOn9}mi#;5up`b46RAPl8B
zl~_UD7N{F+D!kms8oj5f4!!r@L}Afg+BlZr>&m?lx%H?tUvBLS(@=N};&ztO|BS}`
zBG5^8K@(h4P)FgU?g;>vZ$qhA4nc=}2#)?FG~70DDeEjZ$H{VRiv3u+1a(QKd;}~i
zBb0;<a=yc~%JcU=$u0v<`EO2P53T{QZv9IVL6AmvE8sW@f@4S1!j~(F88C|$_dmM_
zANbUzsCx{3T$i&q5U!?3Nj_uqiRaR9>}8wrLyxk6Y+ZxLYt_Q++!ts13kQGpN584f
zBsr(b4gmNwlz0B#&sSx4@!npiyl*-<WBop2mZgI7Rg*#f%ta~$r)5H?SK;KS#G7xw
z1}DcoP~XPDE@j>T(k+mRSewC;;T9!;bnB+;a;E@KYt&Dj0sH+x;&8c)6Cg<nwkZ#4
z4pnw52L{nnmVQiv(j}36xi^5*=M9TE2Mz)4$Xoy{>JG2v4QKs@bZ+`D#CI__!FD>W
zjV!@fkqS>@0~R0T7O|Ap877Exr0ATFODc2mzI;|PNKi7(vy9DAwg4n4<cUK-r5u~?
zV0(JkWM_)~VBLq{u4o(A^AkkVFuy<`XAQOgPV(cXdoF?>N$~t%vn!e!VWEb6_hM+o
z9-|~$B=14;0RRAc1u(I&PpyC_l@I<E;||@=KzZnAYkaJDL9Y)cbb!r%fj|D_rFioA
z42tf=ZT$-`q?<BdKLsyBe%D0;`4Q;JxQGB4!d8hP)YXV!2b)yzd#=9mrOVhUI{@I%
zQg-d#OD}!dR~#)nbQ@QjTlI7p&%CRJ6OYr8L$hija(phaZ`43wW|-LtKK;e>@V?Jn
zjC#piPvWZeP{L7{7`-i&ooq2apL_0=<;OtJpx&CGetN~_BIpz%^_o8QolCjkRgHom
zU?YSeB+;PKA=>2N@Ukl6{UDrUzaR`zp_y{SOjOg@UWo2pBw-C#pR#kKg|Q7#P;T}x
z&%&uonPWHCLDc>;o%Z^Zm#?yum7Yu9h(^{*`Hpx#>On=jI9NU22Dr-RCeDv&ip1Dj
z0@_4<64ol(<i3G$^eb4v=^la%Y_tLxQ6Yy&awC{E=bM}l0(B@(m14s%-soDFLz40%
zBO@VO-~Msq|6=i?bnyup129lJFQ9#D1-v=}y5ah9IRp*xlEXxTZ3%c<-GLEs(>&vg
zhj-z<cOC#{Dwu+ynL>aS7S?^FQNAeBIMWHMz#{&AkBaKa7WaGQq1nY<554Qnub*P4
z>;Qm2OBpRK;j?dk$#l=2eV^?aJTx7wBE!7G1Ih?#ETd~$Rz^VB@gkA3&02R|@OlNj
z{R3Cw$<qs<MGJE2;)TN?$wYNcv9fSvX00Ij<pLBXV3wYNJu`rPX2mVAGWU%JL6zN8
z(5e$D6W=TZX~_GoU(W7<gBI~p@ss|Z^G?Xm#TX>sP&A-qg@`(W(pHL93ZtgZ&%lYW
zzZ(74|5rT{UV(J_Kv>NgFKy>Vj^k&_KqNKUK+aQWE||2zX(js?<4tnQU(mi`{ifq$
zG4Fqiy_zX{6_L@xz0IM-YNTQmO040f$Us2!da%b%oc_h!1L=EBK>tqDMdar}v>%2U
zw<TCf=|&_b@^=MD<?v7NSm=)-cdOr_b@0hepl3ja+IP7aAo8*)ut{=2s3b;ujAErS
zz$LKRGkE78Uy5hX^wF7__)C8@r;=(!OD<_#C4z)!vbrM68JBW+x>c2B`QiN+UHJsQ
z=EgR}d(M>|0PtrhqpdAG^YS0V-aQvR*6El}&~$BF*A=^LdcpGLhH)fM3(Nl}3ne^A
z@mNxKw!*zn@5b+a;A*VSbb-EGBxD$BADGk+?UEBgQ9&S4i{MXbe*r28)FasA8?Z+=
zK)n(uB-;qE!Kq$(^IE>wuEm6uynz;(Wwos-4AqZF$(F#l>{0!GkhOW;lz!3k)h0VK
z<=>cyOesc%kh}{l<~{f@RnWWg*oe^2Am~Hyl=p#}hADJADMhpxpHDrl`vf4I$cS>d
z=~-xXC@4Ti`4<|PC{vhpf*lVuV)CANmx3H~x~xahzHQFruT54&^MTCjRg0_*NNe7g
z?JDm?_D@B<dD`ik^_X?blwxarLum)Y1B#x3J-LPY*ao;uppI}+gbbHP^1Wb03iHhA
zr@&{qr;nMzbq!v!_~MZzeB^TnP?Z)yoy|=?Pu%jGFcvanN{S)17Rj)k4pCtA+}y&#
zUCaOKhu2|C?35h<@MkM0P5{r1as0ylgI#;}e2DDuscN`t0v9Iz!3n4<ixq$pcj<nw
zq|^NwffA^CHQx2HD{#-l=Yf~Rjd9VJ=&O^dHiM#(GAmQ8)Do7E5(WWO8c>&D53j%;
z-*B!%nRP6*E3R^d{w8x*h+#L@xE7Ml-}U|9+T+r$SYoWAN{G^~6jH`8B$~3QpDB~^
zI_ON*PptJu?&|csL14)Q%KXy)Bn^N#T1Y`e=lAK!IZ|3Q>n|q&!Sb?|s6jM;WS$$P
z3)}Qveq>LMDF;ZRkMYJmp>#qY<q+d2DY|<FEj``jWgMg^?)yQaAGtd~l9U11c+6G}
zSsnq5oy)Fv4qb>m6^`smTI3+seU{-O!AU{o%3K4i_(&Pr-2!%XgzA}9u(57EBVFYU
zxHCk7#}o@Ud{p7f9Bhf?<qV(?3_B&>`TnbM=*&EKW+&-5tMFdLLjV#Rqgix5OhMro
zWE;4`ZTD286@ne#yR<NW_v7FAGT@Oz!2J9<?*-Ta0Dso9Fpq;@y@$JV3-`{>&E9QC
z%TuoFm>9?vN((l+1eI1mR0=Gd#1?Lm_(j<1PjPIci#OeN4UUhyWO@wP6tVj}=1cm9
znxDH@vxUvNcU&64FzSQLuxAE9&tx^TkZdh0n3F(AN>*t97%b)Ai&f;-ogar7v&y61
z^yOmv7y>k&R}OwbPHuTt(mG~l%k(cPf$sW3B&;URE<6!tjJlCP4MSYr8m+O!XB?7J
zsQ`3kAF1)TTI`~)>LW3?`lzFzeWsurybvcZ)1c8q)x3dGs+D}3NO|jJyMe4EeNL46
z*vb>nqZ8EhyE@vAyXyNDSXUW{P1#H8XG{o?^@fv$4kQplEj%xNMsj)O&s$U2Cs#mq
z4HMFS%XPvms3H5W>s7d|0TRR9I?9_}gin9*LVWNumw~$#8CayOesW$(%$uIvn3*H4
z`>>@d7izkbfIu*0VCymQbYpFHcK&X*<~Y9PTHx!xj!^D+0d@eupRF(+f0FG7KZFA}
z-Lf%1KX)7K)`@Dk0iuG{LeE@eQt77JlF+aowFl7P&fYSLnIS&)(0TaCJqJ+jC6}kW
z*?{|m(ozj-s!h!0^4hImq4I)!=oCQZgN8OI?s#C9BVP)Fm^#+~kDf=i3P*{57vi#=
z+!B{AKT0xITB7ku3a6g5H7hfWwC$sZfoF<Wb-@3g`oqb4FX@^IXg%#hF|&R^`2eB?
zOrX3Ea?Grxr}j#;;T}$4p)vfNPvgKsQ=+ZdDan9nZCDz*N@GjIJ=E4vf-P0%gCcHL
z6eo)X_IRHA0x}S&9T%B}9!@bx`a^d^PMX`<QL~%oJz|DzqfA}!qX#AdQApXWP6vf*
zdIfmOuurW5!zrj+#AovxG9_b^>{}XL96yoRp(p5Ruz;CiEOQUH-F^k0-Rz*#8#i)i
zHF;EDf2P=2JsX9bU*aOAxBJP}XpM=hXJ%$*KlIXX`nwe#T?S5_YC&)3UMc?URqPau
zru5XuZ?hL(e#>Ao8r(dZOs+QlUCtp%iGj6$Jt|t~ui_xw<9WPry>?t&1V&K+TjLVP
zpPS=bZaz&HE{(uLN>{yRk=1H<Aaf~(AMN+u3&k$(4xoa7VFeycfZa1duLRZYW>9j_
z2@i<qmjX!9k_jCSod-u*NDc(a1HnPhwOg?O$YETS@C~y41dW<?P?F*S#2{Iz4N@9)
z{zK6?3?;vgHF||8wU_^$9(Lnr#TBV0^|!1~fiFr@SFr=NTzW(5d&F@klq1vS%M5ku
zbrusq0xGsy!CCW^^N1jt!W_*WN7^L?m9GVTZvjD&n@m<Aw{#-smGn(Y&qd9lkxXrs
zdu2G$Qne;&D*=|Et5{r(9fh7d7jK{R5&!+dn|~tSM@|>Ado{u*Ik?E?F`XrbyHSt{
z^?8KbKYt1T`n#^hv|phpYGNjzFjTJf!0+VgPf@>1`N^V3Y6eJr>ifaA#&qMvc(&X5
zqusmDduM0m4@OUX?pfgQVa9ljbG__%0RBA6vxnK>V|2xJH=UU2&E00|(b{yl<`gGO
z@gkQKf`HTVKCW1=>ktCLY;=)!XQz1ZnI-yzcVCUQP66}*wlY*$wGv%tP1(-MHLw1O
z;G%}%+$+HA6Yx_jK<)Psv;EJQNF>}M+&K8}OCE`?`U2tMC;hgE`09$?+=2l?-(-?5
zZgGKS=_**xnkDaXX(O3R<twS2Z==YrSV03}g@$URt2L!n(54JY(+0vq4~^uOuK$ev
zJfz0NTuF;d5Fwq-7qp9&aq6@9NKb;WwpAhjmGn9^y)jC8DQjG=C5H5_=%C6_mp&4!
z<|O{$CT-%~01cef0yO1AAvi50^~$CvE=7v8&^sdeIuYwJr>D5;Q3d(I#&IyS%k0O1
zeQE{v^Z@92gF!Sw(sR+cJctB-OT3r@{lxDPbh#5uShP4ip26?E_iC(Fgibjn*Z`r!
zsi!n<rPMim5&&Exl)Q*2g1C_9M1YfOxJFbBPnBhH+bu79#rmlgo4(vBJ05^PuTq%H
z=+OuMt$phs{PAe8xpMPpJiW4<*(Er-&0njmf@o3c=RNyVuw>kI-8D)aJhUHIUb%+r
zt~mp<<t<Fp(nw~BYBMpr_?3eI5DGV1uzrymxAnlA6JTmVdwT8)1IuCoH{1{L<3{we
z#6~&dXjtscVMUvZgcY2n4O6$m<!e7mW@??AV6Soe+xo*G$b;3Z?t-8U2YPz80hgR-
z<T$tM1xc#r<CD*&eo$6boONm1#}h4jPM((zjgCnwaHF0)H3XO<zo#)|mZuyWX+@&W
zspW07Ok}I>Ra25Y2KhtOnAcDjXYa`GIr4|<45yPov`v4~dSNu;TV!<vpfuoc-0%1X
zsBeIHl-JS6E%)Rt3H=Dwn6PL`kz4bKrvVu!9{_+mjOiZ2Ti$aG-f_nP!rX+?_5^9n
zLz=SEdy+4$L|V5hSp-^2>|z-_**wX!o%;P3AGq|bAAHXn){Z@QI-B`(yX<%X{+vo>
zf0l`eFTeQeCue78-dEHc>(lWjIgKm@9%~s7VR%y9C2Yy{ZvxJSwLsaQ;B*E2?jK%*
zr%%s;mXe8)>38u*R^$aNEpB1<h+YcXs2~i09>Jd2fPH$+T^!Q!w}~MfLz3oAyG1B$
zw)BDMvex&kuQ`qt1ZyW)md&~XUE||I2}&zk$Gj!afXZhME&kO&C^W#)JmElVv7MkS
zsytovpP;}w4i;#}F9a?@7J8s59c6Bw{ZKs0k})H4YX`E=U)bN!7r8rGY@|si>kjjo
zk3s3h=n!C^i-Hg~q9d>74aoiUI0uqMVh-eR<9g5&lJH|vnoZA2%k;LLiivfJ`BYjj
z+#T{K%muSE?@E9Vuc1D=?mTrRMSf%>7FfvRAZZY@>?QkKHP*(1KESmGgBBSNKD`_7
z`p9J%m+o}5B5`Bn8MLJ|UfpgsZ{aCrdl<IW2*jh+qSN`%OJ4EH;~B9VzNvGu?05kF
zoXf)xf6`uc?JX<ot7l$3t@z5$>~18u>O~SKR&Uw|$!d_N(8BZb6q+e396zyy4qLqJ
z<tNdZFi=Hv-EBWK3~(V`d?OMg=tE1w$?XM@I*(3p`+RF7=XKmO>pERq(PF59q|R0C
zH;wPy#0-i*3HBzo(dJzAMYJg?X^jSHEeyuyK7D2?QlmK}M{~B{9<1p+HlwvNLL)GV
zvM0#{p*-Dmi>ag)ha50xG#B7RHQOYf?1$jW>>1J)Y(8#I&o#6@>G~QLcg*qHQg!Y|
zZ&UI}05D<)=~<zy4&AlZxUobNM!UVA(KlGvYQ2TwW%KCYZ6T8`(i1{(R(?saM>bGB
zyAG5D(=mvtgJa8jed=}4n1nV*S^C&}0N4W5C9HHi__epa7$17*e01l>5&A{X1H!Us
z0le9O*@sHyjutsrG3_s0#gnbm=-RD2E<A9_Z+__AZ#a#e(kMF~fG<Ir-F4By#l=0h
znd$m+HQa==-XZq1f-$7`uj77pW__g`ElJ6Mfug7}?NxZ^9arI#5AFx==Cq*Xp1U$=
zv|EjYT-631H9U-R|1*03N&>nBdvp!<nKhRrsAC{D6&gA&>GgmlSXT=1d=|AGZNP0j
zpK-{-`=GC92m=tF3GsQbIZ~HMVz=~)v_gb?#C6k%u_TLBjjK^eC@E2Ao5w@VuK*y~
zr8#LT^NoSP41SJ-O)i9K2sGTzP-@-Y_jM{yiyUG6P`GHa7>#zXhUj+ia^>C%Ku9xI
zKjO95HUkEYJ%RS$;%Syv)FD`c1$3c&TulJjq+xypRgaNmb$Nf{1Y4J_vtwY7Zo)pZ
z4l3Z3zi34dgR=Hjil5{_QQjbmzv{K;KCgBIAG!Bpy#KBPD0@?o-`j{e9hjT6ZmfL>
z9wiWGJrBo4$xF#dCxg10fF^63OAGUN?(X*wZqHQbcG&>{UxM-@|Kh(?{keq?cDv^O
z>F^YDIxq!5I5CB<uyNfdoDgnY7#9Qs0c<TgoiUDWbn)hQUeC{L&cZCfCD_W}QLar=
zIzU<v%Ia2@0<ua&Cjcsq+iN_u3j558`@K^jWa^SP;Ys<fve!uh$^<%ys!`L2v@j2P
zGaiEyy##_X+D56RlxbOSsG;ziPl>-I=xVs%Me|unN4}`#Uw8tE7X<l(MbB-7RMI<<
zRufKWF(5{Ut7js6P=lv}Ls~!YL6ae=C&X5W14v5QQIosmjLR*90IbxIb<@eSv+Y(1
zVg^A9*Ud>fK%9*c!I!Nk2K0*_z*CwdLqJFls@58bc}Z==r6p;kh?DWCETsV#1pDl|
zyWOuOcYL?W3YtYILglP(0S^dJz&-+=NN{KUFEO56na6Lu<0>qV4NP|mtAk21p3yFa
zu&y`;LnM$Mf~rY+GQzDt;SwY=s77lrm_9N$zx2LWy!2mI*eR`L2LOBt%J=_e;{BIj
zeWW)#^LDPbR_pP=f(&!U^SSYBD7oeG8&G55T(mNsaAU5}nH%8FFYc$ezVjNabq&z5
zD$h__(n;V(M9<u|jSRN{kpz@@T`txb0bUw#mtc>q!9Km>?ilar(*d#W*bPx(6tJw`
zamK=S<|dNwF;v6id8Pc5HcVp33nH-(uGOyxXPoUqMjWAUdezFS`FErKIEO*UXtWW7
zKb3OPZE7!4avenrIqaia>D@@}aJ)}Ip7{?-ND?q47D_3015c!A{$!@Au_4#Lp??Gk
zK%yezG(Uu(m^7VbLZINWkxrx7ec`E5Yf9$1i2n&7soY<gRV>&mV6eC~qb@{ph%KBr
z3Go9Y+EH_c6yT{GC1P$vz#gf2^gl`$CuE;qgFWQj{^;mUhWt8d3basOhTJcaxS0{=
z+w(v;?#nLf-*$nGeu>|I-xYY|nR)bP$9f60B~MD-QNK!nEt~;*ZN=BpHNy3DjC#1b
zH9I^1f!_SyCx7`@Um+)Rr--rx0KNoeX=#b>yzN)Vdv@>t<b2QETMy6JB&@;$hB|tq
z5P>roAam`-By;{ca(CZA0gypaTGagtZ~yo;_{f8oqT0`((!0G40|kRj3X012Y=I!4
zh4AOhg%3nQ5l?}6V=hXxj$w2RY7YWn7*v9ZZ4?|)lq(RBNo!%Lb7(ho4>r02qbLn%
zCf~1UcQ1$=&1Ahzg&?OUPEin+-a>1*>=6WgY%L1NW|107BZ;7Z68LEIT%>-7-}P{V
zau<p=&_?!9p*zWo5E@P}N^~1pK^_u)V4+kJKgl*2Q1cQMQAYPX{46Jf@`x~JkEKJl
ziH5qb3g`$5M%^sxYSKOcf&}8yTuShi&blU@pMink?SoLTLbbJlJeMle*WCe_EbO6G
z*kc<&m)vo`kabcWmz1RUUc8WhB0u`cAx(7P`>?Luu|Jo7#MfT})qacHK79ah`{326
z`UEc7$$>a7(SwM#@?*FpXy<)QEnrO1C>|dr)T4D69vv+^#Rq=sXMSk_<de5kLfHWT
zUxGqJ_`bjOy>!i$*FHTzGxIJpJ+o$~n-mpWkcrtobP9;c^MHwUFa4e2I1Lku-W10M
z1%CbaZoor_cZ2+00YNc3;gSNKw7?CPi!uWsq+A$T%t#jR3ebLALP74{fTL@$2Uo!c
zgbqc)lKPO^Ny0Wy^U6)7AQhGp{s@XWNE@vn+eARb2+|!ZlmQEQB;3g?rM)L;oUe#U
z(p~0_!{lMi&h3LnU|ZCkl0a>)m~31k2ueYLHgJ^*RKO^~pMH27oU<Wt3ycig5l*9I
z>Ffnqlcu&1<sqwMP+F|>AIE;jiwBzsRV#MIyqVKpWw0c%ZPWs^sO4wGsM(jE_eeI$
zd9@_w7}0YT`@YSc8F7syg1LVsfvtr-xQhDtrc?a!a-Sv;cDY5;2lBY32Cj(fR9~zl
zfJDfb0D{?F<Eb+X_=ERegXL+7qG!W4riUp8?v??`*Kh&EVf2*1TFzg=yAotsn&FU~
z%fQxCu7)d<nSSSw_w2vmiPwJiuVSZcUv^Fbd<jZX6!hei2l2ptAFr;s?v-ns>!)5^
zRn^s<ncZOKm~c%eUJLt;$y(DQD(QaZ{t}D3?9@1ZY7Ta*gIC;o8gu0oJTXjRGu9(`
zDe9ujF|@)?$&>6uPy|8w>z8%1yx_hdfY-)uaqpgS^@)HlfpriiU>tC+t)<1F>{}t%
z#LKPTKJv*+q$0)h|8B%*EC(FAm|3TxkE;1}7k%CYQ&c}q(A6}LGrCagvoeQ+@TF%Z
zS8&4NPA%=XdN2HY#QqL>);uA>Zuo@cls7AltgLiu7-voo2)+cAQjv2PQJyegS%1YD
zPc*zJ)I!4eAhpmZTNv?^7XFiLEt2SHxRQ-ucCu%{RgL=THQ3VwP^SQug#dkN$QmzE
zHc(Fqc@#j+L0VQ$oQS|!OQ1e*X1>6${r-)3-`xjbW=AqHklV3ONlN^?A}}#US|)kd
zvIMjYkbVqeP=V=Sh01#E*<HJL{pz><mG6G=u7CfVfVJCk@Ht<00Kk`^Os7+fFT9Yj
ze?MJv(X|^q8ZK>ZoOvZW3o}JA18}&(r$wkMPH#!;LgM^%E)xpC78Zw|UBr2dQ`~st
z8I%(c*Kk5wS|Ba8C%Mr4tf4nErI<sOVA=BO7??6>*Nn>*V5OGO6*sPcY3L$S#&k}X
z^l8?ohzTe@ssyZ3DBM<i7%;*Sx3-kGI>1iCx0dk)T^n%^H;5f)NqQ#&KqT!x*4<3k
zK5H834#@0j&9RCO=k>>i+vTc^&rHX@((|%!Dg#|k_k=l90AK@TWqaI|k6UDPjOmOM
z*i^%i)0TVN^1`9+yn^SWW&lMR{ikO27KO~|&%s3>`GMTUKEul0&9ORy=^3CfnkU5Z
zxj?P_L<}{0n{ow^_sBTb37Pvm05Adc8C3fi@Bh>#c;h>+$5v6JG_|4?Y4jH-i>0QI
zctuk~K!WscMnizW*4pXTQ9IM)cU^kvRd0FwTYhc;``ZB4uv6O0&KAIzs_fkhy!a;i
z#;^Fg>Ehz9_s`9A@1AZxS6iMUxb2hlAmznw?q$mTOtDqqBdWvVuofsf6;`R{UwQjg
z_|O+Fgx$lS7-F16a;iP^IA-Q>Q^cnuUg|iWUz_PJ8gi!tItF}n1ND>34v2TltXAa{
zj+MpZJ(=<e`-o8yhZ?fTFA8+Zjb;)}BEw&C0NIOi5-19O0NRTV<oF6wtj9e0joh+L
z&wDV2Qs&^WXXGEsE(=n5-z80SubTU-!9yV3=F$}|_B0w)iSF+V9p(mcZt08fIdYTc
zu0#*PYm#Q7-9|zj*%WC5o#b#mP+}H9swL@Ab2~)*qwI5ue8hftNQ@;XmEt#9bCB<*
z_>qKp7;FIU7qFWX*vHO**CwET0hnxUN1&Q`PHioTK**TGz$4=vL`l#YMg>b?OW?f~
zKX`nJfAbyJ;pC`;qO2h!j${(Ee48xJrw4da^~aD%H&2|W+Kvf<86YxTk2k2m<e6Q&
zcfa?h7oC5~J@xF4_5VC&#{=-CDyyr6C!WNeAO1tW^&9`*=H|+CJltCQnwrb`qB9>g
zNU|Z4(u<h@!~P&;!WTl;FvR{n046TW8mpT<oI19PZ@pz1dlyH90VM_I!E-Wl)Fy*$
zMg7PXH9;gM$}FcO8(lI)ULONn6|k%4gjKCNp!$_G870}H#x8+S5TqvSU$d_{fXI&{
zHY~ur9)faOL~%r>u}7{bsXPXm{~5AjsX(Ay_)$TH2Qmva<Pd1dysU53qeNIDpJ1iY
z7rm{~0vW|~VX`CgbM{_P+9K&qWai`<R&!0VZdqqu1TA9|id9oYcwqFljNDluL4#jZ
z%3VoZc}hhAU<nMft(}BT-I|EVM4rM)mT^paBQO~;gMFS2J~c%B<O+B^1$sqF&Fd|8
z#U5habLd}==w$!>7$w^#FBGL|WPs)^PIh|u<=?r9KK#J>+*z0q0H5{GhcdfpWU;=R
zbdKGKj1$Hq+y;uilKl;AJ;rq7*l3|&ynWxE^M3bz@BW=3@Otc&=Px@RfG<@U4&6V1
z-utGXnC?06f{*rRdLOjYjhfl|eA(jkzck-6GfL`6Cx^6vc7ZbnAOnUW%S4^oDL(u7
z9{R1fUrVPtUC^Sh$V8tiLSl}j$g)HvB1%5S-Ew9@2wcI=A(4!Z;I=FY)GxqmL)eE;
z!fsB1*-|HN2`3C7=#awowIQo-pGkcUicVU(g0||G^A-bNSz$r?s%?RmT>{o22cdm6
z4yjW)le*!BJY{lj)wZA2Y>Xidoz#1I7Xx`S4WMD5^jJ`HOi8IKkB+<SHp|5j-&Iyz
zQ2dQer<BDq9qLzenX1mLa!}$=F=76K?aaDuK}=zSsTqXUHZR)C<VPjeg&T9Ys8%pY
z+WXNA7y!LE-pL`-zXZ@B*b`f*pIQN`8t9kqhR!&RGDuQ`&Kz&Y;e?YCnI}t;KL+u-
z^=EAj+qW3+18)1sW%S2)9Y8TZCFA8wtV7~jmW(84UCXoBuw>dSE-KO<PUuWWt5jlm
zXkl*d4_|h}SFU2Gyr8n<0r)bNAN~hFzV*dNzi5Y>8(&#dcX!d9i9Wh$wU7{U4TGFT
z{#QztRs4Sn%<)m!R287dp4yGsxe70N$r*IV7N}()jx^O%d(v17zeY{KNhl~mk)v`F
zi#Aw19dcI*pBVyk9blp7>az%_Cd-T}?n-PpCnPBFgOJt^g#62`JS9bR719VxgCqTV
zZe>Rwynaqv>e8d5lNcpp$~38oz?3={{Itnjdj2s<*HLU&v`uL~8)OPXTFPiOJj%s(
zMsJaQv2_lU+ojd}L}DUHJ|Er@9hR@>^Qp$AL7@)F^8-{SQPwZcKTZH9>%4v;f+#T`
zD%VB2$Vz)xkbpsl07I}xHc=m1b3mqNqGu&$ZWJ_?I52syD0v{_Q>><kAfC(kA_6dD
zVb3Rg=!+NPKm7Jfabi-SoSBA(Qow>=1Hsqnx*%y9K$Gw=Bz{-xO<f`tS<1lH6{^kS
z<AuI?)5Vuu_V(M}{hx-|DKDt(cmTdk<!65C@7TqqrH}Uwf4~k-Ro2#UM`8eFVrgSn
znswPVBp$URZ6Ack;cw$AI~7I+<9FYA1May0eDIRHEzs{r#}ju-p82|^rJKY`x|LA$
z+C8HUwPfrOi{p*}W(%OMVIMsWKE4T*{&q5EEk{LN>Fo?<<Q<O!I{KJ(h0?7buDgvN
zv3gG%wH#$yql-~i2cZ?WVp1Qa??HAgBzMWS548JVS)HWZqw0m`uL21OZw`yVI|fXa
z^FSo%5lt|%v8xPqVYpE$3o9_0klFkMCB>4*MSsKD`8JP;@^=WJk<GgT(xhLr$&(~}
z2Wf=`A2)0hKQvM<H+%(Yywa1__(IN-ydGH;L%>W4t{L@HYp9=HhdXL3v-`>UZ36h%
zc{%>5SScjY({zL2cX>oOJhvNo<n$tb<xMZap|w6bvlDmyudf=xQ<wqCMB#i@ON5zz
zZ>$U5Nx%@Q(JFT^etdRr?tQQOiC<j9PI<v)2LOB-%MGviOY6ILpZ88vZ#_2MIzvna
zu@pKDcPJD#@Q(iMXt5KnGOd2x<71$lnc&z~f!}=Fjd<kvE?{>JatT~0-Qlg9YZqt&
zU}V8K@!Pn5wY$9$2i9{L0__tk;6tlkpc$d_y(=^->Wmzj$6WR=0UFXGmeWfV+`=rr
z6E4^=hTKyNPw#k-1A8Uny)G^nJgLs99Q_o2)ruxP9s1X%><~c#A-BH~bIs@s65`z;
zmEqFMYMKTG-E7zY*T}|@=q<n(TQq|56kU}`p3)q|bN}HHYSy1w`!Z`{$o$xTU9m>g
z8pI{A7avJEdtx1&FOW8*-nMPipig26(Y)h<EZ;W)PWkr=@a7ctV=J&Hx7<4En7miQ
z!Q&ODSRe5@P95QJJEQcJWL=hHiqmKT%rG{(UA*mG*W!VvcB3;l1he(i5{w5!i5msQ
zDFd9L|B`$HILT$6f&#(h7hXM?T01y1?sv=wE;?|<{onts7q<zoow7~Y*#h`7mWS^C
z5H7j;t4>cRTNe(uHeOov7E3BSLKJ2$H-<8+Dcq5+j`iqY!Vw|42TNs*XO8T`>T(~q
z+<F?jdlT@mfH6t9=H5-|sw3YvIBYQp7qt+!GWm?k8=w4-qEB8tuZ)3F1=`gEdSwa@
z%!IBw-!6O}%5$Op(26k0`<W=G$V-5-uETY9!ct0|X+R%ejP6Iwm?w!OESt>3jJ9fJ
zf*`>cF{n}21p)rBP2G)ilscJ{I<3_>Mj_kE=`4Um?k<QA2$xQ3Kvz!k0YZC4x<&aH
z#h>K8$RaL8Y_YMb-FrL`93Y;XB~9}e{oi{1$%UKIJI4^Y&t2x&06WiE5%&96!NUsF
zbNl__SR<?2<eJQ(K^miKI*hsDS4@A1%mr>i^nl@h;LW#RjsN<tYcVQo7$5cT>NIhm
zO4CLVPPhx>Jjm^agl41@O#&R}k0Zi#<1|sV{=mNT_y6+!cfadN?36!M+3^5;nakJz
z^}n^*?e^Z%!Q`Il=E-;vAlPO=)97)YbT1mRFQqp(8nfXMcWjr7g1ML<<2`p@h+qD_
zYjMnUfjR4s<a?2+<WVvml7i$Uq(V;f7-5an2^p%81v4q>!sJ~4J%jq>7V3vjgEz+R
z&hjE-OU?(D+2o;b(#mAfr$`=uxr(xkgo|0Z7KEEOzl$Kd|6KM(<&VwXnl_DrMgJN(
z<a58Lw2U+BQ2`(^_Aq4)WEbtIP_MSff_Fn&i^->=yVNKdaBF&Lgr3Y(T~gL(PIbg|
zv}zvO<|mCQq$zfPYwJ2Ck`2m}p-##+)*+)|qDC)Jnp5)IN_tMxD=96soNvk3?uZ|{
z1=w2D&#bzX+LZ-*#s%<-G0Dqu^;ApdNF4}g?t}6V)DUj7WU;5^p3p)8RC^ikyXzvn
z@ef{vO)!_8DNu*mkdlBKte0?r1{{)g)u$wuH3gD;PmwXGCnHp&Gi&{s*+1$po_9ZX
z%AdOI0Dv!Z`A<Lg?R@PmuXt>JapA2PpE*+v*MJxc;1{Gg%N||Axj`iMq~*<60G#Zz
z?DsiA)`E&o1v^{g9Us0LzxV#Dus(0VJ%H<Yq94Hoatn@xGSf~|_P*?R<5`q9A!m2k
z4AhE4<}Zj<8Ukhu*v&EQ!>7Qf2SBHANrNCou5g2MaJh?%MH-gBECC>}ck!~Ydee<&
zDJ!3r-Yneo8iWw^UjLua4LPDHyGd2oFd~!dB7G1wWmc_-_|K2DH@c<v__aotE?d_;
zD*^1-PpBL}4zbfAKTgV1V6Ch(AP|xcPTVZL<}7>YbLq$akXH_VN*Z`ARVE3hh99E$
z)yaoES&g#V1yuu2Hck()XeQ+Z2qy$ow!ad<OaUHMu#c_49^FJpt({`zd>?(b&FqlG
zb`CJjCV?0twQe*%JlLUd83{4iFt}h~kHr^{?80xq?Rp#^lqhGWl=52`VsdVOEiJ<O
zA=N+1?j}h0Z=@b-M^o~85P=ODTWy`L`km^*UAvdw@!+T4x)b>KKT&o7z?ZiWzWS@_
zLvR13$<nU9w|C0wkEdHF>e^QEL{^OI4c4lH&YAR-GORV|%_(Wi1j|6tpJLDf-u%An
z@qs%p<!aF~b?U}Vv@y-602}fuT5$=e-;&VnD#xs>*Vm<msFxoz1#E3mJ-Lkf*%kL(
zS14mOJZT<^uS}5Ll5XN%%6<Y~5$4N43VTK??c<}uOp16w`+QSgb@&X4(EXEbW`<@%
zg6HmE>GcSoQPu`SS*p@lmQpqEQ&aIGW_V0l>V%Iro1XNC&X}j*h3^b=HgFRCiwY{a
zkX65O7qb|j25mXHDaLSU#>l)nna3&6CeS0jF5VX)J`Wz%b$QU-A#m5gp4dY5@G|WB
z2<RJdhn!bHxW)t4OV<$OH-6^)D)~fAJc$(GaeIWl;t%}bj!&9B7Dwz1zv1^^g!_-|
zLODAH!vKcdc7K@Tuyq!_D-DK7E`4N6#m|ZKY~<_CFhHiDYP>;qw7k;qnK$p>xA&<(
z8F=rMwz2~NzT9R1e!^dR8C`$vb;tJZ+y93h-Z)qdmI<b8*lDb!V5ZeL7grR)1AL}I
zR*MiI3v_!^92s=+hCjH8KK1a0#CzP$f$B_fwDu5_xwPR6Ezmg=fU0w8M9QrwEPKGY
z{|#Uduc3bO40v3DdPO|dpnTh*bGfn3Eg?o(U({<V&`ByYAw1Rl!Z#}X*-g#O!pb2<
zsce$9H@x9)&K^b!ON76JQt%og@{erRwp1PVjx*d8=adm$+tQd$?)GM1+%&OhUwAIm
zJ-tnUle@0NxD?4V@Wf(WC_ZTrAg{Z5^{yI!1I%!2G4hY(4|xnVD%|A9Ak{a34T1Xw
zxMtWVR#88;0!%AV-?+;@Ri{XM!a`bYsoW(1l=G9*FAmA?-p9vCY{R&~R+?j+Ec^JC
zx7<YUz54)c&nkLLN0PoID#;(MXac}ayc1cYWfo+;Yz%74Jl#0XvpxICU3<^}@Tc#1
z+Za3Lf2!;R0e-p5v(Ex2SMlgy+J%ePW{*`{tMjA5=F6zNt8a=<T;MG>WW>iwptPG7
za*>B6m}C^ebSj)!oxxMj?7@p}Jc9!lZUI|HWC-(C8z+&Ypah2~bl1MjvoEuW5r^~5
zl=m*nCBW`N5$8#CKQ|`sGNEn(TIje}^UH+7Z<<iTw8*c=6_jYp%m=Z5t0bi+vM{_L
zy~f&Yzs>wpUcXczax6kf24Lp<)^6=koVR#dK!F3v5Y%{85-@=g%D+}txvoRhA3!6-
zEqn6Zy9lt9B#>v<HTcaGam<?#zRr7?yI92JG~!777^9-hVRd?*khc}OqET&wJTWm6
z>848pcMSN<(4B}`9y)h_*9dxM!Ewl|@t1e0c}O|@y<xy{$0ysi(02nQ9&le1sK?mY
zUE;Uib2a|^A6<)S*TR(PydNS42{RbqY&f_yG>`pE2Y^*3LQ=9Yu5;6|)2(ID@c7fa
zmll5E@)v!>Jx@RSabM@_u~YtZWd{I!xyy7)n2dq$0&e}Ow@${N{phLjVB^K((e#R<
zzeGkTu2k|2ZAh-<yvY3C;bE@;!X7;l(CO7Ua$*5bKf8qMUvdT)?jC^$&H`uh@&4+{
zRAC(`I3V{Y^KOvRX~Dv7beoZqAb|mLfq*=zz-LAv%b>-siw*FBbTXNUbYZqD-Ztsk
z1SOGhxn`2b%Q7zq#mjlJ_Oe7i(Ob^4p_abHkK~Dv*nZHe4Mha;ECWjX%3KAckcu9k
zQeP63C=zXtZYa)Q8goY2z(q+#bEI_ab&3@M;?=r2fmnA%t9&tbPDBsW7x*|S)}+3g
zw_mhmm!yog0<5F}JmE*kdD9Tkbz5Hc*>%`M>)=W4Qe>ATJE|Q~!PPH7pq`%0eoo){
zA%rWRS$(OTBym0nR08$+zz6QW1i$*08?jOWMX!c(^OM})r!;p+OTf*kp0LE<QtQig
zpw|TXtvXvzxY{@}TA1zqj|(on_IL06<2U$}zdOqRf2QmJfG>Y>oc-)EJn?(KfU9o)
znw8Dfjm`03{Z>YIciEi}B0Twym9op+nwh~PE*WZ-<pkl%?OGf<yoBeD^l{V8%h)$N
zfgKueOA3LV9UYT@Mm-<oWR}mzy^}3|MU15ARElFFz!;Ea*p(4@YXZ!4fVt8OaA|r&
zU;pYlf{=e4d8@(#4|S!BP(o)iI#aTBQvEvLdt>Br?vh8v^;Jmr_<ftJx}k6=*4xHa
zQ3(Z=l^cEAyclQ^wtO0vnj%{ITU_9hqO~dM2WAOn84|XMk6E<Qh#x^dg;Fc#6Us4#
zaOe}@@MLn?OPZ(gr+l34qzyBl)LnusNniW1c(AQ~d7fXp1-LY@%R}&!tHAQWrSkRL
zUkyroHV$p6qqaa?n@aVwRM4^yg4$uLFM#RHL&N~=g^bTWvk(8_H*V&~PR~+jX5ua~
zjYo}D)!063XX39UJ48aDI47jXF4><9*fPfJ$IvsA&+plL{(m@d^<@X2eCV!rG`dq>
zP}u<hU;d&P_Q;bD)Ysnpwa-ll8|RG&TQ8&Td})dfqTN7JLJF5^rVEtrLUO$~jIg*Z
z=`FO9@yww;m<+nO`Q;}uU(~SUWbp@KrsQX|o>;8W9HfZn6@bYp5iA1M0ZF0al7NE1
zn^V~3q1z%@>;fGlE);50Oij6v1WVg@+BK}t{s&_CUs?VsLYAa8mBl*9NlL<9TRdq-
zN$S@`k7UfI2{-<a#<jXF&_{VIgn1@`l$tpCc5W(43sr*y0%xgRA$F_;-*T|*TFKm6
z)Sx8cgOa2~yErc2j!3s5wx7g!gd%FA#dc06MW)7fg#Tv%^b7E$M)k}Z_?b0OT?0LL
z;$=JC8RnS$shqSf6F+E(CV(u3{%jY4;@7$Hm-i4ru<j(od5n8c?#JtY?Pd7v!A0sW
zjuE#DVqbMW66wWL=aNWI6>Za-#2*5zgwM#J8m)teCr<C#v+Gx{x$c$^e&FrDJZ-ON
zr@YXz0|5R4l;;jTG`j5a7oQw$F5fhsOfD_@yFiA>De;(E3xF47{!c06l-Ow~A1N&<
zm_$x)78Z5EICy9edTemxjmzkB1)4I*7%03!!W$r0bCB^3w{?=5(rwwgWOHQ~gkBIj
zr2$n8yF3Cmr=YnKG+RPvwWAh9l>U?!Su^&m9W>~15aNYHLTM_+Ery`1Ny_UFTQZbA
zn4VYD$C|8ws4m82q_~Vc$S$2kpp0R(W=j^W-1DX+h!vAj!)V)Xe&cns5+0IBEG4L-
zj<!*IeX8$L(}W>sSVf0=C@rR+Ya2$6TJwdMzaQ!A_sTmiTHc-*xEuUdM{b|LYrHpz
z(&-A5st({TZrc#xPUM6+%~69+Bo^z*G_m9(h6eyKD3O`=F&<jkMgQj4UW!jWvKPIj
z5y)778iCrtu>$$3kw)x8<SPyllR4%J>&f#gJJ)}W$;R=jW5&O~xU}$V_k7~5tJ%!%
zl>dpca|+-uNZEhkiyvOvz4xuA+Bh*CtO77G(uTz1O)fk{VcxK+f}mAr_mV;g`*aMK
z6u9h;u}(F9^S#&O9q+#y!+rtkyF0iM+KMGO?vjgBA^Z40od_haBLz;$J>N7Asndgy
zpuPe13h<dB>MxvzJ+kRIxMz}EU0Pyo_bB_?lMY}fRE=y;{w{uJcmM!tc}YY;RO0vg
zkz(~@n)vu=y3D2R!V+PEXE9jfsAmK(q}y)vJS*BIBVH2{K2#rofvhN=sE`a4PGyTR
z2|N*jg!{bBZWXi<KPfd4`vf!t^Wu?3;dW9Lisz6b$mO%SQwZ67#V_Jf7Y)Qny(}wX
zsFM$|Sb@CR{oNs;XTXCg>|-maA723`6==qQ%fJBwN62*`j^%0U8YIsfL%W1Rw@7tQ
z<q*h8fpApVZ3kdC=+X5h{QPg+j88qh7rmt+$S{~q=CRT&6dH6pXOw>t=PhiFu+MB3
zLB5bx!ZF1J0|sF-SfLI^&+a~N|7~x&|Dz|cqx}C|$_@bd3sOFM`~NqcTiErUxta1k
zcI&xuJsA?nBoP+^zl45?In>2ENLF^1h1&}0%R=z_1>5OOv1}Q?^sXEEogcXp!}$W}
zyOi5W0i-DTc;;8S!?Wcm1#@ouiXfmyKz>Td6B<iV(Nq#>wg7C6`sr2JN6vsZrY=CR
zEK<9&Q6+~6I^7&6g(DQT&Q_LElr%E`sqGG*<zMQENM}wL&}4*?nHN)kkdQ{EaN_v#
z`BWwA8|UBYc?$dja5P*K%=7<`U6Xa^jR#?_yO4$<lzO;~M_#m)2p#!7%O;;_)HWiM
z9*Oua&S%IdC_l?;kZcfl+%piMiIIK+j&_ECehIcf{p<#+hfbqj9y*}fD?E)tRjfEj
z(mIhg0Z%toS>i9r6A`ddJO4wzmY!iYpj{SEPiOJ}{r8*cqxW8n&ioWqSaE4X(7H_u
zX?7E9C(B6HhMm%@sl$#1oXfEq56KQsugvy(Z`ytSMR$Bvx$QaGo${wFI{@G>NFgG8
z<3IctCwA@K_dEU0^#1AQ39?l!R%m<@cpinT_HJ|cB<Y0=5?i&f=*<jq(lY(WcfOe4
z{h2E;*$bc#unkI6uG6ObQ5jL0do<TSA)qN!B}r<BG^-64s}~Nv0@O3$)e-DNr%^w(
z3R_#Z&su~FZ&JoMMLDT_WM8ElUA)kiN2cLk=1fU6WK>Wv+9fKYEwaLC&ip>E*o6>v
z#<@{rO#d=-JA$mF@L2v7tfQ<^)j`TUAnB!;mbvNvkd14DHCUg)`#_`>AE?1UN_mNj
zNLk^C?>9XwDJKQVIU@ym)Rd-q%VsN7T^OKW0LH)`AE16{8TFwJSM^Ncz$*fc(hy>=
zIPpR}DjBh$hS2$%$&&&F!yzf?d@jTdeGJeZi)VNqzx2B=!3XZTkZEqrrl^(GPe#-s
zmA&$6wN9~SmB=gpuWUYJnqwknTXQ`)QO|bmr<V5a`5!<1(YI`1r~J8<ofv?>D5dk2
zbQeEPH!fUoYHNLkM}yT{YbqCt&V0K2$7ke=i95XD&8-3VRZtG14JoJrkXV5sM|s(?
zSQ~Y5|HJ#SdwxjQT)&30B2Z;q#^Ov7G^$s>adN|_j%9CfqkDiBBx+#Mdh>4og51%-
zl`-4Z5uqf|d>2&syaw`ox9V&Vwkftc9)~0UJ2g6-4UcpmX}f1KHLrfOD9ES;;A0ac
zt=ou6E$=76pP#OfHOZSJ-PeJ8#D_7mo<$vkj3A*0So)k1zaZHwuhkkc5!<N^K~&+1
z@;oetF6PhAp$1DC-34#P)>S>txzSnbd@%qzF1nvrhOkerfRAi|tJ>XsSsFd6fR*Fv
zd=Ew_9r{t1d5Pc|d9)4;sL1=!wOk=9l#u`(h1A%4foIJu{?nUYjCXzPGT7dfilTP-
z*pQ;LvO^m4mH0{pup;q;^Zp5*$oPcBI6(zZ2g{7n^5gUKb3ecT%1b}{OMm-&EOyGD
zTiF2se^Cnk6wO?4lwR}AbJg)DCkMxajoqWc#*0mNscVW31;4Dc^2KuVzv+dh1R^Kb
zU0P(hCFdMMMYpDvVHfv*VK42Ot#IuPD<~}kRk9jVaFI~eLdU9%za;v`qVtr3*tK%h
zX9|?;LK2QKOK?d*NrZ6)J~ebfg7Y0<zUyA7ZH_gxf{LI*w5JSs`Emv%w!sM7OtJtu
zGU<>Ymb5hEYkIu$bL}3Nb);(Y;7h3!wfA0dh;-MdE;r8hQ`TNn-%59|N;8z+i6BCF
z2;>2GY3@oq*@hAWXhK>QYI`M)P1euq{iIBT*M;<Vq4@X{?iyfo>Td0OW;JE7?3tLJ
zI$FF*A13JG6~2lSr4%0!Ifo$TJ1Fty_|wD+@aNkng5ObN)BtD?aHO2a8{YI{yyGL6
zV%ndeC~D_#in#!hKyJTA2wIVgy7ORFNxsnUFplgVjU121;8`-TAlS(e_2!AK#kt;Z
zU3SH_zkk<<-aNui`ExBVSaj`_FLhZV-~#~uCVu|cpTh6H@pZSHIC1QkCN%e|-qK~p
z7y_|R!Rdu_x`LC1i%(zfNkSm77idB86S3Hr^@~{;%%edM7j`WE#cLnJYrpv^%#S9Z
z0fSMxhn3=l>YEEL;v@uua0qvN6E&GH$_E`<?yB_STsRd%*JU6*RqT?g^h(f$3oz%;
z0$l@|TA-4G-XyXK#pdeFz(^!-wo|FDV)P0uf(TCZ$c^?!UI&@twM9$E&$aT5Cqja!
zMG{g<;aH8fv>2Ligd0FBMJ7#S*-ikK4O9`-6f1qJudjrbKsn%&rf#Gkh56Fdj)@2)
z{Uxyk!$gM7ffu5Z&HV)~n_t*sFfOvcAn?`{^~o*Z!~i_0KwSct;ieuv$88rlHIhHZ
z57>J!I8G<~IwXwO#0#H!V}VK0-Vgv|(-y}r;Hk+X{?l7-#(O?-F-Dy+if-+<{G>dg
zMtef~c=AZNMVj~g&>MUZJdYI5*7&UB1y^;2$?7w8mp5<Qw}1anKK1a&9w(B_uv7j#
z%1#WxUzoBBz~2A>{>j%}g_*_u56#Wb{HmFrd1|_O3P8dBDvXvC_<)S&)<zn~?_**C
zv3=mbL{N0;HAZ)4h+`9j|M>ei<M-Zo9o9P?&@8h3Vxb&jq?Z;vnQ@;<JaNjAQ=esY
zz;-BAT0i99<C1{c5^OE(Gb^aSa0+~U%jun-5k4;#!qkUiIb@Q)hwK=)5S{gN(Ogpr
zaFBd2qMkgsFA7V}>J{}g<#4j}!cKW~i;x}y7$Uka6Y8QZ#a!YU&YEm=D02gd>!URQ
z5}&t`k=lnDn@dJ~>?k)n7wDY$hgv33<pat_M;0mUCFpMg&@J30J(CLdsa4buo&+D>
zfMpAsDI74!`6qTDEr^sAlhWVn6+w65$q7;W+z<lVXC}Q3X=EG^D_{wDa&rN{_}^ZF
zcYf>=jJp#Q-5Rj|4sppRoTwMpc_Z*QB=X7FH~pz+l=PhWP#pr3VP@v(=1Ca4^~I&d
zr8i!A*|$7Fv=jLEr6@aF0Doc1>jAtzF4^OUAFQvt`D>00*0;=PuyzZInK{#$0g>9M
zPC|sE-L2ex+VaXxQTfvqN&*(djG|j(ZPLYqkDZ622Clqr4fEY8Xc{&Q0(i(>gt2?t
z+Zx*u0*it}q3Q0Ak>JrA8J_ZjI!hTEe<{eNRUOyB@(9?NxFD^$E~qphYuj}?!Z3sj
zHXnqbQ{zQhA&Up)-fR34ZIwW3IW_of3nOi-JP%tDx3<u1Us(TY0^E0PL)BKTu17mM
zNL8(xS5>m$<uLZ>Hi2fS=b@jNFG?3lh42Q?KQ<eqXis9fp!vInyRmOvfsbyYetOlV
zsV?C5`3s8f@Tlgg*~0+Bb>Le_oI@FJWcW!W15)+nTRx3i($`D`>|#7RoWsBSom=p}
zPhAQ-Ge*&=!EBIGTP!?TGbQ%)EReP@NcDq!9r-d6&xDN@FbokHnhaKnhbK-g&CUGU
z#TQ-rM|XbwKTq6by&gN|&$sLVfWKHpiKAoBd~tH=4c~BNGCXtPc(`$c=`NI1bo_&I
zk&{@cIz4TBD-?qXTLn7>#p<AWQBJXC2@gDR9tOh>uDWiOcFkA7$f#}Gl)8{yykJxE
zHTq8Sdy<b5WKf<GN&$2<689u=Ng%h&P#C8Kh867c5ZIc6x&<)Tap})2=N%DBBA*%3
zEk&R}4dvV%H>s4aYR;6_K-{KLT9ljJ5M6HGz7oBqIv`Lgb?se<bkjr4_H9Ew&Kn<;
zGKq0&w@eDE6K&_NeN}&!mYIBtCb{n;6<w$z=5c5n6QZ_C-l~M;Wcpx5laQjfFyP??
z_Q(e8!8ND&37~%IzEg>L(i}!URp08#bJ^}P5SG(B@_XP55tOOcYlC6k*U?KvpuHB4
z3>NTnzwuIh@a_Y^>=dS~n8P4^%mT}PvKT>N0kk&P%y$(()C>zh2Pstt5s^VX8DX+^
zWY{&+-<g|R{Pjn^aQmuzct`nvDasB2_zPZM^}YXY{lqh$KUj@7uBoPzD~jHtArm!8
zw1!FT4dxm7Leat`cM(R<f&YR5mxhBGWm#j)1`j>H564f>;L00Tao(N@c<2sZt88xZ
zvL30`(od<YIP^ts&u3b$nV>HdxVdt4k?(H1HtZXh#`S4)0zN$iZ`DA*1I%|oB>>Cf
z%yI%AI$N&>01=GHy=BVfT&DcQ+c6h{{3bUaGdG2twwOSPp{{F?S~6YG;y-UuygGPP
z#BF32cpjjp_$zH2B>TBRixyUFn^WzzNS1r1b#z8L4QTS@MQweMpf%<R0DNx#(j6yV
z8>4<^4ffzVc+D&RUI8kNu1E}uvT<o|oFGbAzoa1%0ct|kj-4E4Jjo*YR0HjJn8gBo
zKI5UyMf~g=Uxtr;?jjVkV^HbN`IGU7f>OkykS}dK+?cu)QK38%VLOoJ45!~?o-+em
zTN<xDXFC{va`(RT{^PSx-tjbc%9ph40D!;X<&nGJifdo;HK(d+b$l{hzr|Md`DK40
z>YBJ_gQ8OwhJXZOKUUdvnIRh2aQITxTXZa@AUyW;E<Al`7p}TtoiEtGMHmyPcF!5%
zK8?XZx%E#;&#KG7m=TX1v3ON%YsY>gAFKb>XXQ&43`ZqML~f6k7+4!SAh0<FcMNEz
zbZ%Y%@Y@6WHkmwvUnrhTnZ^Fa{dh5<BE>NR{o4`^WLekruj$emt>p3mF@nDAzR4TX
z^475cS;Ju*u36nswzVGr?}1U%I*pSh{z<pD3xJC~3w!yBmstOd>QewYVU-HR7U69S
z91N<f>x27X!DmLW2iIYrT?018!2jRgd&hfrRrjIawa+=fcKf~4G@2Rpf+U1MMqsKi
z5U`C4#t>u2#LmNUh@VrPIB`iJ&o4304%o&#8;p%1*x=A&N^o!hA<42pNJ71gBu1J(
zcV=$=-CsLrul#X#S$qF}lQ^Mi#9kl7{O&2cpS{-luCj9gtvZ%JVC0e+OC~JMJ+Yu8
z?Q9kUZ~~YdM&DpNsAKLs(%5ca$-Gd&sB?f}yT%=>+wkUhJPSA7y&c)~5ULLKs}Ztz
zlH_*@Z?PYb0&xNlIWwU1^_UPY>RuJf01+{RhnvfsS8My{=4O9$=cSk3bY%Y>Ddg{)
zOi2JZ3+U*9d-%HRUw5Lnb~5X4ZCqPYV@ee*5>8I+#C_*o8}r`qxSK#Ja^B=p>xgpR
zD*#YX8G|$6k%NnP=-~yraNipC?A?MYnR!G+nRh@U)Va+O@IkNEI3D8|yyP813zu!>
z82T65Nx&%mwGdK=fp%+Mmp6vs<u0&3s2^<SKr64?t=ap{*^nq>gLQG*EO;TCQMQ`d
z1ohq&;hJul-5Iqj%a^S}F2~UKG(;oD7`z{Sch8j>*G*yF?sDMJVbUi|bcBfBAB*l6
z@Pr%;>3rhbY}cn;tInmIB&^Osc|lWc3S8L`1^`{J>qhOor~4(UV_op$Yv3cB;6ce~
z5V>P|l?k1->zfRUt-?;)`T~?qd}9&~@IsAb_!D?Bg)?pR`%rjy5<UC>8Vugaxa-Iw
z{_Q)j#Vz-3Lu0O2YyO~`1CY=1ASZ`K=${pug0^wgB3FO7HYI#PqElu*nMl!S>lAqN
z=#jbU&RgdfmOgyfO&=N{(Knrv0B|<YMHkXzw|siI@BFI|4Ex=ML2u*fly`EKH^|yx
zNp7kTA2GZZEuE5Lz(Bqm{jC4?YCVHAWsMR~9Gk%d_b*}h_8#_KvVj~R9)()@n3Epa
zgKGp+mUd$CaNx~s?}|h=6DiW1gAK?2?G$?g73LV$ZV8<10jCGxQd>cQDKoK=+Ip2w
zVwi43!@8YzPwv#8fQf|zj6l?p-dG|wlT3luBixrKo*VOzlW<COf1<Ep%kqqFjE$c`
zXmE@o?pm;rIDE~+K>>0gmW;3iM8oF(&kJ6`kbok_Z=Ne^ZJ!mu8$(nF*P#!r*K43+
z>-0yIDYtg~c!)GfWbquqn8^yMp{VW58%|#N-}(T@2Qva4q{PNxPzx9>5#M~@Zu+%%
zJrlP+I*;aD4^S+Q4G#tAuy~Tq_Y$D}1_N^eMa@uSHZGsF!aqxt(Qwd3x$*eMbW8pI
zIlK1!;oWz9a$~{>B>E;$8sxK#F1Yx`7oA!;^_C&puW8KhZ553MSZl`=T{xTBwB6C*
zY$18i$bx8lsessWOo{Spy#>@B)LJWywwkzXzK1vc=>2%rOTLE1VFg~#;5KBVR@BNS
z8?-fCcHUW@5GI2OTOi-8TOR5xW6txooLK3!|GGQ{hBN~s4K4w0WXP7<P&+%I*(N{=
z7-^tllgq#(0<Q8XsN2nm_dFA^`}Vb17?7PnAQ(_IGhv?$b79e>SYwL^NX&h}ckP&Q
zRO3X)`?&nzby2MpaK>g|l*0h~^&C!+97|a{N9!b<c6Z=XRy*{803KH0(|z!XF7(C_
ztht8w3+0(T>V@gu8@%ueo7BkixC!!{Z&fU{un+)Pj#@B|?#S+-k23L&7ewlB$b1z9
z&@^LxCc|HTX)k`~16Sjo<88ENda%cCN5ksZGs5v@iw#(N0@)>7=P0mik4&HHH5ARM
z@abSD>;Xg>xEk_s<v=;r7<}s7z32VX?YDm7AtIWzP!fF;C?No68U6S_f7j}v{a-yW
z>}^~!>i5rAjTxn~n&HM@jdMP7JeA-z$4RP`Wz-0vJZG=7<<_++0`g{s6Wu26xMv4e
z*PFQH@^#G541qrR@F1a;1(ik4YI4t)8%V561wIAhw><n$I`9RSRVNSyfQi?n^E%v%
zDh*y8f|s|zYeS#{sF?#D0|!H*0&sBbxJDO5diwzmff7F!HqnhJ!j}?ltYThd2w4~f
z5(_F3(h#hHz{3n7Cx{o9_#K%M#4v=C*Mw(-zPfP=M`e7hWK9zcTaE#7?X1_x>cgTm
zgV*}tLmSWs)}T*p0mBMZC{RPyx%y+dgJkIxEUelxCR*h}J!1hbZo6r#3xE^MUW8Q=
z1s{m}F5{_n7C^(D)jZ?mRDt(?=2HCbpI(JW)*2`}1Lq$T_DG^8ll4Jzh*k6siFGYz
zLYne?8|6R}h!mJLM(YRB;*GCtTiX8r?t0d>cf8?;UzV8vw~&$maF)?+pZ@^9=M}F%
zx!K*=9QHS#IT-Ypvc@!#qOncJeRw1{v@;ywJ^^8@Nu0zd53m=^Hg9NbRypo^U^|W+
z>EMz}*08jF02&g=oM&V`)(Mf8KLOI0HhZ~wNRzV@VhnS0(FB$zn^T>p;&mxu$7DDk
z15yf9)SEeXN5JwH^r;@WI|O9}Zs&D4p)!N3L*c{!#h4&$d5lJEqHb%Y;PrqJImE!)
z*Bt<D1QB;|kSsuoPZ2{3egvcK;qpmave@;bY|!IR1@Z_%o-IIfK4rgSIfTUcL@V6S
zxp7J};d^YIIyZ-`k8Y5DVjX;B1H3V;3u$DaB6BhP;=}NPfl|Xa6XCL0l3$nd@9^`H
z<^Vgc{+qB^+#~@Zz;DP$dd6A!K;#Z2q-~5tMH|2QCs*Q+KYj^LkAOyV;MWkz(TmI~
zLNI3Yt;h(Gh@%HTUBVzSOF^EBKz=2F6c5&qlNy|QXnLmo|19pf=yNxH?pTG<1CynY
zMBfxj0>Ifv^uRqgRp(#%{DYOQwuar+XN*ccSF~o>$=)=+MJl&>**mhtNwt{wt<929
zN7lpC!eqU{iI|XO44n}kJTQm-k1Sw*+Yq}i*g!!H9@z~uJpVkd*unZ%vz42!WR8&g
ziGg9AmMa7fCv^A<Y+uF_sxks0!YQgY7Cf&}0jv#bRNz#vHWw5*(9UZO(lAZdKwx`u
zyQGcR6WGM~v3jOCv6e32dyxd!aVO_+$3DHWD31beB4iK<ejBd?7g|6u=Z&5l!{mj~
zAlew-2yVxkzW<wD1Dyk&gW=gP?gH+(T_&odI}UF`Kd}ZrvO!qu*S7s!)q-0lg<iu}
zovdu64aLG8K?nnO?qnb2_?T-BkrJ|nn+KANGPogxAb%D?2>pAsfNh@YoKY?T4|Qkp
z8-H{)KJwqs!>}lkH!3Ggvy`w%Hqr_}<foGW2=7KI^aMDR-3uT(XnPf(1#X5FD#u{s
zG+}G`@Z!?q+s?iGvX6fG^Y8Ctbc}$M?*Cg!NdP!IiH;t)Yq<B4>mC{PH>uoOdpfIp
zS`{6T&2T0dkNZ%?MjXThNUrK?7}rTye8}v+X1~iRRUvC?95^|P+wR(hN@ckGnpLzK
zBcRVr3{uu}Srl)zARyq4LC*h4%9YQf?;`_Pg^;l1S#C3x%u`4eWTG8vAExMDMs+Bd
zVIDjzYa8<ME_l5Ul)6R?ni<fbn!%tx4}loIT*uUWKi%FN_fgv8<GwqAN2*tL&y9Tw
z;<DrU4*!m_98OS9g-?KE_=1txWkKOA)B$f`6POk*KZ?rpQy7g2d)s@F)#GhKJN4G6
zK8E+eTAj3KZ2)3zgo6wy6eAOgse%Q#oNEf%3|2NfkmTZs+6voc3WkH-^<aPy6cF^y
zd;xN7<uV~-V|PNi9nA{N6{yV^>>zyZ(cSosKX@ko@+-TbrbcyMe^MdiADdPG3H$ch
zj!eic<v#n#f}9nteIN&0;jM0l$}#G7p*N4LFU+?7c+Yv4{Nb&C`Nu2u!~LZFe~T#%
z_*qLe7JTV7Ke%J%*nxlAAM!uQ=FXqbThri5OEl9w@6`3EnEKwN585WusrLe}Glxz`
za?jAPyVj`JLT8lWC%^X*yzxgLz@FA7veN)6FgfpFs<q__@ThFLZxR^>fKYR^(5Qv>
zV?R2p8OK$b9~6vK>_I1VFAWIChWhW3hAvGq^IQSb4XC*SwAcnsHvm%gv1?UT508b`
zr4|-DGP)lT^ANrqatr`_^pJp;{h-AM6O2<J-EnwHT$hDRN?l-`<boUw#;n5L8`S%6
z#v1<^u^R>=0%rtdMw8VH3@hff0rA=p+#P|tB~WQ_MxX+yvp@#xoI#pAxA(Q%YpmG%
z{kgP(fnTIu@A5Z^wFffxd`7f7#~c_1hGph5Wd8ENEay+lweJlyph*Ms8XKJgfBLx#
z@t%)ffdeZ|6s-YBF?^0gj}QglfLs91?~tM|M^1xZ`)tEsB^)4t88@nCplipz4CScL
z<@)2JnKu3BZ9Dh8<(@Bp?6KtZ_wA!306Ycg>SzD(1;-D5?U%bF`tf4^{I)9EfUXd3
zt&`NOI>_B7m601z{G?=-l2L|!V{A?=1V|C8UV*Gv;APhy<DdT9_tW#vJC4R0fWGpY
zua=M`0vRBTm-obmslaGi405Lo%C_64DYs#BxO=l@SC(l8Z#tPr@Kj<pi2+Ese=%w=
z@`}Nl>*I%22Gz-HL14ZGbaGIUn_<@`$AI<PpX_00Hc>w)fl1!<UqmFh*$%7+W73cq
z$nbB^^x>j1I2cKcm*f8SXEg8x$cC)uK2Zy`ZS-1l&F~o@lV_g+9#%ki1YYYyuMfe!
z5*SwX>zM*_fHHtZ@(Gu&Sdv|1<Qu{49pnh?PkJQ7h@<2}p_u5iCrXwdAT%O>0T~85
z2DA`hq)abeh}W$&SN9j-C5<O~ZM^>z7va61z8sri<n4iQE)XV@dcCuaA7#_WIPA}z
z4jOR=cbSC0$%KVae<Z$2yX`0{xT;1Nt$nR(XT85zSX}y758rpgeMt0erDOtl3efZZ
z{y$kSkDod`?5&;O-|C*P8Z((vIS_2QV_=^99YA~HYPfY;{W4O~g%;-^K(hg4xrQz(
zJbZAP?!0pwPfb;H{>AHPH8p6U03F8p+ub8f7K$KrT(|{<l}Ejlnp3#{i&$jWXU{+#
z$9H>faOkodFP|4d7%&t;6{^lHzzp;&=#>HV@gDeek9mDaJgDk1DvWn}BQv3CrlAHz
z@q4hZ)oWmO%tG5cjWK#L`y@8|N%BT;=#FJlVi4VJuicA^1;!HEs>dpnz5&jL4^U>Z
z@L7+2rN9+~w?@#X`p}0rz)!40AKe764(dami0Y%Bn_-4Nmp{VIQ?&LeT0@Sp8B{9_
zor&@oKyWrc#uRJ!2DR{GE9cU*Q$h%GSc2g*!ns2-2;2hn_6j#2*oL>g=NkOy8!tq^
z7@^S~n4^4Qgf}ImIs#Paacd(7;^-VHP`V`^41_=i$d8|W*nK_r)1nN-6-Mii>n5+?
zFgrW<Z|Bdu^zI{%-kCK2Z!;wU;Or&4bI^k)K81@e`&%byFg!BsZ(Y(K49-=JDMeWp
zDSU!G3g^E1&q&QiC=l4ULY+nICxOb&PI)9^${Qt4t~cnmukPg4wGMWk*TuFSeWIZP
zm*km`$nfSiA)&yGbwBh*0)$2r@Ii{V-Y_qD{nJVqLi`XJ<lL5Llqjd43n9X3zKr^y
zp`uPSL>U2P1>P7EpXve2UGQ=rSRK?61|`>#1q}r>>yR|*qz2!mFqNR)g(;dTxzA5Z
zUKB7TgiOewD*kT)2TR83ly%!AVWU11CJfYYOh!PiYUfHT0D-~%3OL;dAM2tz(gh#d
zsJ-@2ZUMa#fbp{^RDGgjcBUA7f;0t1Bk1}pA$Hr`(Cb}_wSI|)y(G6rB$KqpBflnD
z$V2ilrLc{j`Fp|C-e4kNp~7k-$H%{TKK}h5Jp;Eswg5~GP&7)wq~rFQ|M<EP3jkK4
z3?fEEofNf4%9NoTWXp1X!u~6x41mU9{U8^*d*{O9j$eD`^Iv((=RWeA6%u{hiN5|K
z5`CK}o;!a2%id5tapcI$S5L3}dyURBnsdAB57)r*fU&vzZ(ks|Vt12OSSKD16`xQ$
z0Ib?tU#|~ScPAHfeOS?Om_zkD{H%Q|^rqL|hv!{=981Fy^p>hK4VxW?t!CoP48{WK
z7&(UyN=`_qZLeMqkuWe!s1!q4uWze`xpJH#R5;lQ9o!k&5iuPavx!?x(wk0DZ@?P0
zsi3OO09@&MlPt3OSlQ_UG*f`48lYBQUsI++joNfju}@KK(So3@fIqC6J*;b4mK$gL
ztY82Rq7KJ4DBRh%jfL3?k5b`uNCJbEa;Nn%13ao~4Zc^~?Rj$q^eXV60!j_AHc5M^
zKB!44FX-8ID6~#?f|zZx=ztIq?W{X{xC()kFucwrZE|v<JoRy$3$pk?T<T$O(GcHE
z4ZX7!v?L<pOjQ1xVxUHrniY6n<KE>3{K<ze#m8^jgJqqgm>$#zcDXM`g}xhN%p{fs
znUu@*gQIo`SU*OW?0SpF)|vp=u0aM5)(;`)wf)<7?EUrK7hd|IoBsUmJtTTkP!a&n
zUYexa@b>4vrpS&x@k3i1TmMcswqM?y-3ev9Y_#?pe5`fQq@shb8Ezw$Sb}{nU_Sz(
z_J(wAZ2lR_tpeNI8sGoogZP<O--nB4yHKZyX#`S=>rITk_g2hI*%+#s1uQ;6+Y2^y
zrx06>S-=O5dCK5G(P?X<wnhM!&qSY)GZp(Y13a`GmS-PkMxAJ=)X*k`kd%S9TUmYV
z>~s!l<xqt&8{`5dU@s6jZJbTNIN1FWH&#YaOk7&Z*^hl>gfbGLGROyDHhW!r-D?Jq
zG<aZ{I%>a&ehJ<hf%_%6wB`<TlBFVZv@Rm}9Bz!95EY75Vim(NZHM3pq{8vINYj<;
z#Z@83!J-><hL6Tcgk%NmXkC!3Bt}*QNaGw#$;}%BP}@puG&9_I`)<7RgID2>ug#-s
z4v{x1vwX*4d|9^rVx7eyx)+Xv|GrtO{DIsXCjSXgH+Jrjq?vfMew4HF<l%F6@BEG3
z=U?&u8$S8FYe@8@p(Fr21?jRY{#Ik<^pRI@4a&Eu&aTTEv*!SSiw+1jE}_}`tu^%K
zuAk%o^=g^u8V=a}v;@1qX_UhP)NA5JSDwJn{^<R9&ebP)rdI*0M9`{s<YI{`cqjVt
zdP7abww0xA(mrUlMW(n2R~MU?Mepmo9_jS;!lNm{HDL>lbn{@$?eKtVG{VU?tO*s@
z%+ux-0BS~AWT0jp0>=#nYA8mbh#CZy)xtsTF;9Rp&WcKSfLkkt?UX{mo7@9zwNw_q
z2@KX6C^fj$HKXrqV5n=YepJ;dlSdVJRMk$ARztMmY_@Hgf{PS@=hrM&p<RfMZ%z^b
zB29a2`N=u9>sSb5Vd`WHR(N#G3yuGCatMQOy{}h(Y*uJ<u!TvhD<f?fpaxLQX&l(>
z;EzA?G<@QV=ix{{N6{Vt(9mu&&8jtKhcV4Sd>@e215v2rc!!wT$biz+5g10|d0-Hr
zK^SZ-BOe}LURa!c=k{Iaz4P`PKX?j>o>Y_sfTt*3`mC3>P9Ht~x_)o;tE#i>;$rq(
zfVJ45*lDsZk38VLz)|1x_-Js$?<~=i7Gf1(f!V`D?TSogdb5Q+Gb8-aOZVgNeE*}^
zH`_zLM&O>%z5oy_xSZ}2;C6PcAk;Yfq>P6Fl;PWLxo#j4`7PX+Bei%Ib=dH)cow4i
zjBdoieUVkp-KS7N6<T~9Wnd5mT}K^A0gg!3%wE;Z-yJ_}V&0(uR>FcUF!0ctBbYww
zI@y>Xh#6e5IX0Qi9FaX%wysm5MhKLE$Au%JcTHf#aCPuoqV6hOes&&QT>8W;R~!~R
zwgf1!7Fb4YB@Pzti09U7-X3X^HVQbc-Xjm<8{)bSwsTJ~-=KMUhOyqxal@Uv@V@_Y
z8E$!a2e>^z))=|aS@(3X?&2{JCJig_1Zy}Psu(4Z(khFlPQuLU@gimr4>wN`^-i3g
zouB%>#a-w8&b@#2@ns}>(ou2(eCiPaKS8Iieqpt5rvFH_d3t5oU46RNYC$!oAuXj4
z+m_YPq$3>y^xAyr6jddE3Jw_Vo4!ErKv$y-c~N1lU+|p|?4Y|J*oMYTg}oPUqSY#a
zAps?M#vz&>YFFZjR@VRt^ZQnfr;kO@N{JX)zlbo)epuevIJm!fjQ98kl1Q#ca4z1=
z0?CllfM8ArDyO`5Fmw)ad7Z5gnU6syt!pM-)|xpDt?j)8^~)NP?-^LWXMXo9U{C`6
z3g}mL=$+B%jeVk?iwvd>8K{vNPy9Lpg7P|MpOkW%GZBrum;~ePaBw(I@6Z!JUUnYr
zC<SXu@L<0Pg~S;rD-vtcp;KZ8Lmuk6Ba1cT=2Lb`AuK=aaCluH5deS|ptor}yfKG&
z{g=!6w?B9V-G5>V+0+0ktHc<}qp;*!3cpD=R;<hcJ`{Zt6V`5=I7s*kLDUgAy;3cF
z5-SY1P7-=YSEr|&e=sw@{kI?d@+TAXf09xX0G@h8z&vn#1}FFb;^=7~zw42$jn&m*
zf9*<5jRjRq1(r+-b|?=enlD;xZ;`ej(MP9!g`UxFGqHQGx$1oIOwJXRm*B>T4xX68
zUw`Es9636L&f)+&_6(2{gNI~ItYcaH0$pA*T3a_5<c!zwwoJ*>-CYi{riGDRb|VGk
z8{v@fWUVZKuS4{~HA~pIUFue!ZZR$@a$Yp=*=RyVby%H+*>f^J172A0LW8O^>J=GN
zk&(Mz)bFXxc-!aR^WK^k94`n%0~u`CHOYY(PeMb%-y$|65cI+z%;40zfP|xEP(fsG
zk#9(0kEE+al>c7{66`+<1YHlFk25a`hAISL$7nT!Gk~`NtIZsrymc?$_D4_0r~Y~m
zb(KajHLM*6*^CAgG}nTXUEy`P{v<;m;Shd{KK}vSH)Y$ycI}N@&)hAakH8OH9d=op
z?aKZs*4?9P?Pl?wshPRAJ$BDuo<O1}Ez#FsM4~4dg(xY2XJ7YYvj?7d;PsnB`o(N|
z_XS034mN9_+ZZ@5z-$%{tM$;P4H$5H2itTp5(pK*xjh3w*d3i`x-k(bFfs)ml?4qq
z3ch69I=${?PvBKAIfM(gZJ^iybT=~zTi9i5wFd!7G}GDTZMy}RwZ76WkD17S6hyMS
z!a_S|_`#T(1cc0DOyq#NhzMe1yA@1AFepE6(GjY`EaRQhe5DfWU~xlc?Um({D94xK
zY6!{=`fVK5*d`{j>%rGzj6-2!DSKO{lcs<%bND+D%fxcF%-7oP1+xum6oXf%APxmU
zyDn{6b)SR~5erz-WG|ZQ#!%+NmsmPQmrR8W<1nZgYPv#yCdVC5EaFf8%LVxFUp^P7
zhYF490gwS&lV6vn502@R{ac!oB=kfRCJ|x3gDH}$fa78JPl!XO2nw1RgUw~|;Kb=x
zBY#hOYWD4iAGzTe5<RIYAplQ#Vmfm8wS!Ba{(}Aet<8;5Z|y40n5RbDIXjJMnSv>d
zDO+~ajJ05)8HoqRB+QTn*>vl*HlsmAIU{RTwA^dp_WO6@j{9~1Esb3lZ((Y_1o{kB
z!D-24GPtQg!Q!ATWS!4Mdz=nN76LXKs8H)HJmTIAPzPb)5X@LAc(qop{8sF=#mJOk
zpI0KukU#<gRG=QJ+G-FemSk-1VnVEz4g@{`^}EsYcK#HME#E#<KX2<}+crCwnU{V{
zxg>4<b{y@YlB6g^;mv<8A&q%9Sa@Vd4KAUcSYiRv6iTLIY}~|qv?4@SB2Rjm^4a;X
zj5AYdJ{U_NWczHt1qFaKG*z`wJj>8K2#;;d;-mlVVt(6yx|(i&a0!D}g}hxlLCcT1
z*VKdlkgtEtL^o!3q2M2zDbN)c`&|Smh(8y~dbtuQXjT|(ECaoxtDRQy?#|4@+Yjyk
z!f_;e(o+%up7Qh-0Kl<B4-Brj<|U5|x@(*L?x`z4YCdaB!N+uaF<?S|5_dsrr9tLE
zss2X1El}>xggM!b+Qdi~jSAeX_~5B2y5&pf^1-jop|fp3=bX2RM$Vv-;#y+x8hYf)
z7B?)Yo&?tp7>IjHh7g9Q1%%y*I;*7TgX65`Z=sHpe+uwgdl3F6%a_cae7O$N71u*E
zFMCHoSt23k1!64N*(7Ygoqd_a$jE{yD8UtMeKg|dBTEWgY<k=#H!gnAY@dU4z7+DR
z@j50+X)*Km8atUfWj4M^Yc`meV7{bKTAOE>0L=`v7`&aZj1E3_)A@ME`>w(VZ`?=A
z70{R(+C2UU69%cM9(FK)&@GU+^^0zW-(4siyA?0|fBg6h!8j^{C_|-*2W!WX4UVnM
zPB-5(Jv0CI#~)72|7@Wo0DR{V?cFgyoZofH{;iGW&B5mBrvbE(71Ksl2}7MGqK1Kj
zA2QacDp88nG6hH(?$qP*fi0Rrd2@sjf$n>Jo^JihIapb1U}^UNv*!#c&opC5GDDE3
zGr*p~ejV}Fut835H(M`9&&C7de|RO7A_#RNcXPY66_%{&Md*BvsoMiu<8gx%$k<<q
z>XwdlfbfY61|B|U-U=iRdSFo&B3Y08RC`e}5Ue~8pTL!bAYj)>$k>9(v)&QDNAfv)
zPJ|uRK=`4c=Fm-4_<ax|6lO#c>=<Q;*Oe8*4AR2ZOqBz)sIlHDaKqiZ@s9Uhh4+8v
zVmz|m0Z-L&{aT0ieLEkM7qYk<Xa1wGkMS~<!jW6)@y$tss2$ZTBhA2I{WxXi$<woQ
z?RU>EF8tOb_kAug|Feja0Pvkdv}5Nyz32s3_fBuMAMUOlUmI?%Udd1ksxe!i(8uw1
z$RRdBa9)2TxPZ?mK1sc|yNC~!3lfLGGMw1it>%EF2`bZ2jS{Pa0$;s<8*csTc8sc=
z=P&4Ce%pYQMjbIAP+J<)=woke&kUq}JPy}#;b87PryojP3~p3{(et&tjyncuJ^y8U
z%)bm_aFz&xoeO^wn*&{>7Hc)xAiPZq8wePz@0xwd_s<{HMnOYse-3YVc4IC_#dwl=
zMl9D-q%k|mhsLTC4RkGVUWQ{StmF6NH5~xn6H{PEv2H?6QzA-(Ae-R*E&SSX(u87Q
zmeHFf+<s^g@BYx!@UD+sjysObvhIv1Z;p(>8#+n`rVIO>xrT)Tf_LX&2kZMjj(-7h
zf-IYCG7xjc8Vc7$2561`+9ArzQ_BnUv+tf;*#6rO-uap2@OPFGef>owI!lNejRy3n
z#1${7z{4MzJ9^;ZAKe;MznD$$xwx3xQL`-8kyhkh$HYtS#4~dtP%#nw5$vZifDq)8
zXV|lMNkr!pF_8vFy$lWHc-BRy@#>czz)P<^f;}^RsC5Ew)`?M7W<B!7#!QASv-bd(
zj0}j{F1Rd{-$?ywg~lPyFfYMYYOQaAn(3VrC)EYlCU;7*_s2uvr+_*uaBY|M6Ec>P
zSb70ke(3~^nx&ZR(54>YKo;bFprE<(N6mC3g9+R)&#)SW&z%((#JD)aj$0=rN|rxl
ztL3c72jL_rJAc;3?d2P}I%TH2NT_q@jQyL(+r=hFK%qc$C5A1=Jx6Ep=`UQspZdZc
zI=I#Ww?=h(UuF=i+QDCR-lp^Q=^><pqloEuOPiu*@Pu)SCNS!=T@$j;F2%H63Y39a
zW3YCZ^K$Lr!qWV^XO_0T`<}o4*s`ePOweGWCmAIK;5&$_s)F9Pi&l2tMf)0i2eYm0
zq0R2<@}ReV6+<oMMV%+Wrmc;&a&H3$?A9o~likT+z=X{|a(y!zQcwr^a!j6n@^Ey$
z`!Y1LW(A#9cw%`5H{W&+?tN$h8)b&=7xvJZuaH*^t_WJ!T9PtOfHh+lS}MtSe3)Jd
zCeOj6{)h9Bk~hXMhLGupv2A|jL~2;}gDVhNi5w_Q8d>Yp7iO)oCLIzyP_T)heM+!S
zQE*@*FfXtbD#$6MZv0Fed{~+n1IAiyC)mB~k7l0egW`rex;bGQLQzG`u9LmY*aRp6
zyrAdU`&cW+uS{qT<qTS2Y|doZe`*$g_^Au=`+s%?{_Cyh&|0OCO^-l%WrRir0ulQd
zPWSEkX|Sk|L{r!avBBVrws=I!f45`bGYbdIV14?(9k`@&=yHVq>LFe5)<fHNo%1_O
zJNEt2SO3ao_)7}qSw=|!_)eqFG*t^Zsw4Mc|J`34?%sRV{(gVsL^bSQshPG>-iA^X
z@qP;odX>q+)%KA9-WB?os9J*J?zFPlrQ3-V<Tpb1EP+XZp+H2)8x^XI@W}BweCe(|
z`0~BypwtR8=L|8wdkD%IJTOIOuny|3ZMF|yqh(?LmYTKepm>R#)@!}mee5*{_xy`K
zYaIch$v`3u@tnzID`GZWxSs8kml}MVTyp&g2)7cEWph>+r%)jCsbY=FPND=kk_4X^
zW{eF;=-Q3Yc*s6E*N?#T5JU(#$leMTJ}SkHJ`47#!X#26C#85B!aqS?Fz=Z9NHJ`(
zLjr(|!O-Tv+PM!)jE$)rcb-_pyZ`(${O*UY#OH3`h2w(;vQ7zVYA|Y#K$|&{L4k=U
zvIAf|!H@UXnH2mW1=_Kt%i#^NJX|4U*OvJvK+L2F)o8@SwIjNq?w5A#*#7H#FS-1q
zw|w?pt4MU#Qj*vb;o_&iw0-i};U651=$Fu3ys9y?n^cyO&xaqv_l~_!fVhS4nKw5F
zjE#ePUTd`og4GIbN?ae8WZ__!5*Pxyt_WqnK#K`i?cT%>zw7{B@`3}nV5y6IgMdxN
zTq;sFzb$8`R*hI(slA~E19EsVIUyn790EFZxo{vDlIy8GQ%*8MAjroaz`E?bvnCz0
z;7X{QWfetv(`)1rm<=n9IQ-uqvgBT$Fh{|_OC&_JDt0=PxfFvnFiG5Tt^kw!?E7Jb
zqVf8J#0*NzRkSvJnrT>>E?j%|6iR!ItPojW(RO;;6?g{dsvLJbx*earaWDSjOXuM5
z=@zQILZdST2*$b3&a)6?0zZU$OoB8Lavs!#Q!L|Yh`vkVegeQBB<X}oISpgqGBYSc
zIqad_I8qkqePL<G&fmD|%Byew#E0M3N20Tu5(4lYPP=wJlNyUxReE8xUv;|&Rn@y>
zIOy%-tfR8L0FjO`-jK1m%{W9^17<@Lm;{aSl-Q9l{&#{_;{*!^kw(!dF;a}fs~y~Q
z$1dD+?>0WV(WbfWBTVfaQqk1VC4oy7XoW$z7e|^k`K~)C6y}Gu|GKvLHcNXrx!#%o
z(S$ycd_NdcH{w#9h!AkwqBBqk=-AT(oG3!RmT>MU<_BI7gYUm*n}i^>@1(FY%fMy$
znf=AS1r!J@<G*CcTCfh|g%T}Bhgw8T(zeNI(=x!{YW>P041gwrY7?qO@Tt5(pSyP#
z-t)05@SYD}fiK*<9UBbfQ$u8p$|OxvBIHi4e*xLpF=s1{_*@xL>&0mL*^hG(c!PkQ
z7vT>fh9F)yP5@O3pd6#Eb?A+QgLc;Y%>2UKo1c5#58e9F559SbL}xuE1mHWK?jfA_
zX5e3*k7vLCKz@4V*h|;fH-4cz%AVJl+1<{YGtl+vBat>2QKaq1w`#|$kST;3oK^29
zs3R<y4ItT`LnNFtBGqx!mBO&!L}Ns_XxAoQ^4!DtftMe|#XHxrSe3v!0Rz;YbY|mZ
zPzWC*REPrngW(;(%#P`V5%+F@mzW~FhUfNY@kgw{hg}w$t&2{O+O&L}CzoT}D+LZW
z50WXfXulW;_UpiEuw<cR;UsA*p$To0qZJOsL{>EUx|3Yar258}*^QZ8fG*1-MY9%|
zKFm7F02B<G(kQ1D4sCRB>sNQ;<DcJ)d-gBjc(;kXT_S6gZsZ&m6iKfEctQ@f5Hq3N
zfLioH=C79hlxx&g6G(34*O{1$I1<2@XcJf|9&Ijj**&^B)5$*B?zH~H554{s_y5*g
z-pms|%0y=&B>^B2;hLuddoLh-@)P`$@BgX%#F1mqJbCQ!8@qkHCY#y2n78Ku)?n7K
z#${(ujP?+1nW2yb?EbFBejfAvFkFj3tes6+q6+K)Os}akThoEDAiH81x}rL2K<C&s
zH^lW<AH$2j`xu`6v=caYst4Lo;I0B`1A!~sJ`eu}o@N{|r2r-lNlPuut7@>UL6*Z#
zwYE%Ha9qzDJnCTI<)Ag<p7d0Qh<1Pw!Yu4>%n*DAhTtUz*ME0nq400?(-_;?BNaSo
zvxvcP;~RL31a<wdDDJz9(y+p(YzM5rK-50lXKm#S0(St+R@llE?mj$+yYAk>pSoc$
z-G6W%8zY6RRYK)u-FH?dW!@R^nZQOS$30w2W2PJNJ&Y9=`!EFWh)*?Ms75$ou`HF!
zpurez90mHzN9N|HKeV{G{rCRvkNu-Z|M@SxT=pQ*Sx!j+NK|u!RtwbcgBKVt`jNNN
zsjqzQ+~Y@&{JnljZ=&`&JBrRC5ivt+a(Q8c5HrE1`ON!+w{OEMa=`dX<an==js#-|
zu=+S?rE8{PLb2)_nhAtzn3Enf(aC}5UwN3Hf9+9v$u-M3@0=}64@;<Z!f2=j)E{Y>
z6!lFo^-v-8q6!JV8T3;y^$AvNKde$<knk=8AmzfeLKHzV4GMz;ght97F-1|i4;Pfe
zi9A9Y!g*Y3<kq%M5yuI@{-B3J+X#S`PI2KP3ECPU+8(!XE+Qgog;>0Raia*KKEvMT
z)hB3VO+ZgEdd&>0TTR@2?;`&Cu3dcd?K|m-lO0eCpvDL)tB*x?0xnd29JBKq2|ye7
zjkufwlRg&;M@#yaj7wbdwaF-o3o8`wH~}#LM>6PggyF^!R>QRi=NIRGfBUWrK79Ml
z?>{C?S4jYPick^&62(NoKLzl1zTnE2E)KRff2!B3{_i2T&nsrnA(iC>T{-OylDV+m
zgzI7gZR-qN&iQMNX(baFtvg#i(u{<rOxB2NIFva&9Uz8M4Au%&S)dvMtqQngcMs3J
zav86={%g2!-#WH+`e<x1bT<P=1Z7MFE<DU>zydILJc<p&HP^&OD^L3iIwgRBSmSff
zUL+qBV<ZX)ecHzdTDxBy2qoj#0WpY)tzcjoRWK!fo@qi|A=D4Rg)c^PYReVtz?I>U
z1#d2ij;@?go)sv>>?pq;>c{GlU{d~l_VdO~W;Mf9wh1TuO+5DKEIxDVUflK2c06*h
zjZ-C{asp+HyrH4FKCH(%Y??kue?RLV;)k0>lgKweUe4qN6_>w4+?UJAAB<$57J?8k
zmh<1YK^eHK9`S0}!)WtZmFw;uo%Zy<zu@AlK7Y#%f4Bj>gn%zhScr+vW=aA;qW>vf
zd;L$$Y%DLo_T<SEKiAjItBSdOMV>bZT$!C&=$GPDG7F<mvP6$7*TR4dcwRyAbAa_$
zm&%Asyd&V~`q|o)V4t!%?(68Q+WUVvY=HVrY-?AzZ0|B&`JzL(>arDFv1bJf&7m_9
z=z#)(p_FEKijsBKGFq~Y#Sa;l?~+%W&&;SpCkhEov*hCNj853v$=4H%pS5FKCQgER
zTg`pUtS%xzg4B%yg^2sY;XDRS5X{R8ab)}D%8t-*fe-}YYGcD!hcgIqD|n9-`|&Z7
zhPLyh0BUHU4WJ3ElsO(eI*<Dv*pC19rQLYozyeNh6&R@s&Grybl@ah%5cXILG3+PZ
z0XNYih@x5oi<0fLi-2I*@K7gUlJ_5|*H|qkGMfNaX*Gf`!=oZD_CeZNG?;m`wW`YQ
z(e>$eabu@5^&h8~X8-EGFMYa1qNgk+0U*&CXq{@Wrzw8%D}JVR{OIG?A3u8ZO?_Rw
zyfM3{l{Ke{m<`KkfSJ5w7+`JkBGro_&m_)h(-ll#?vDYFlmY<NN2@yMJ6hGA$9U_i
zQW`eynYF@bn1lNna#q;Y8R7ZQIEgE-K8ojEei9e&-au1nZuB)_lc7t$fd`wsI1<)w
z;5M%S$xS&j6$E{hsvw6@_{5LZadtUqMi6t;LE=$wA9sEMBF}(FGR9cFpAQH8hsO<%
zd*!>-J{afPQd)`TI*^4T<F=nd+f^ZR@L2gwexlgURR*Xgz-^6DLFf-NJa}{tw>`9-
z@4tT$x7@dlPIRYGDu9b2@<!=LB0?%;<cgG8>;*esUM2|J7#zVY=F>V-TGYrHy~I4l
z0)?4XUrQiA+JRzIi)lG!&{|ic&Eu$g$BuQ{jrZ@}bHN9e&b#cv&wco<8kjhFiJl^q
z1b{?mpdd>P|Lq@tOMcrOH(b8Fy!`Ve7q89ROY_C_HYm!#s8F9<im~l&+y?D#1`m71
z)~4^ZnotCbk7=l|!UVJNJyf=wKvfD=Ev0HTnXRdS07VR{2%|v*<)A=Am$-Px02f}c
zhUZ>+3@?1<32fiKiTPrP_DDl_bLd`eCQytTR#xE_&vE}uW4$ds(xy3lQRa20m_r5+
zdOq&#*s)m!R%5ioBH5->5yOdbW9{<^goEyWijMlRC({QKz7syOUWypO>wy;Q1Qx;A
zn8O7Xpb5IJnYHP+VxXy!wHTNpY&H~Ddj*ak?%;;IcHxfucHwIW=keHb3#F<!YnPN2
z6%^HWeO+0tetb4%k6d7-fc$NHtvMy|;}G_JkES>gOvn*NbY(wd<Km!2f`obIOsw0=
z5u~6;0}M8f46|zU;YK6--Q9cle&n7nf9ezxeMe9d01};nqySI>$Qc06z2v3mR%P|~
zx*O}S=e%=SF}+i%yvblqEV1vvmOV~_ts#Uu*@a}Wa}e+a1!WqBX=9unzYh|t2o5F6
zBPSGChG^N0_B@!4FwieBn^jnv@8N=T*YQ2iJccW;Si!kFw{YI<7TTo-cL};jz=*)c
zPm(j=FFB%4QnIOm0$4vBAC`Tv8ljSqyc|<@QH-7eNUJZzI8el9Ah<8!n2goJg<9_B
zO<?>E=C@fOok_uSav5k~-8}qCG4BzJ@sFAnphC7yrX9v>-#t+P++t*H03F6@UEpgc
z+c<t~8h6~agq!bK!qMe9oZ9H1tAR#q1XYYcSsi_%wGx74Y<n29OSv(Tf~*}Y@Ae_k
z8ur4B69y#&WXH`Z`0UrUlqzJjjrHgUyud{eZL`6hbrP(qzl!17vCT$aes*DL=?~gd
zOJBVI(=Y1NIsf=fpKYS27$pH9(HTez0AB>~s{n2S0DjiX{^9J&!;fCSwSM~N2PM4-
zjipA>o?~)GaId3yMi%7SGkaIes3Ro6?YI8zi5b%D+d^9nAqN6TOZ+ylb=S8&QsCnH
zm4-4Y+I2}7_A}@~frbJ)d5Nd(*}!$zp1_3{ukf?>Zs5GdEi|%{)QF+_1nvS{`D8Bc
zu)CO<ki-IlQ81kgHFEEM&tuQl{#-Eb3EuV_;1Vo^EL+_KG{(&c`Ej*ESrCQcxj!Vk
zaUqLdZTIsir{3zd<XNe-4g?{Jw%3+F8YW3OL$x$?n=on+G!ag%G;rs^S$yrtEcQRT
zfLrffz_FDnR656i8EB1A6uM4!Wsx8!T#2+u7R8bpx)W@C;@mR{yk6L}<4I$}t?#0o
z442<gm<D9JM?0>5?1J15reNo*0P_j4rs3u?XM@wr8T9)XcJ6x5HP88hM?Ut)|EN0e
z{0r##v7_ks`$+)!4xl6eB>J1s80P%KpZb;j^nG_feeKkVpI=*9|9)<6TWZYiB2u}6
z){xtd)Ltf~$+3mHt<=Uti%s7;n}zmrk2v_8@FcV%>o8^ERULMP;WbXj|AinzQtM&^
zu`{#=xGaDwLsbH8s`&C<eeB-7g+1qP(DR>p98bIW6sC&`GirqPsDkbhs$K@J2+BC6
zS)m|Ej^x@VH*zs*j_a8MVv~r7<+s+}Ada5KJ<vTvCa<MNvrins&Q_5He4qu$oMjWJ
z>K2eT&1G?&yinx%DeUQhUX$fIG*A<C#^4;t3P80OXfTFE*i<>T`VBn(#4K*SZyO#x
zFppD*I(X>l6pn8xWG${U`DKi(QGrO;S^SN6VQ^xk)UuuF#4noAqd)pI%&M0Hj2k~Y
z#?kYE?~E%^ipq9?3|``aq8ee+#z^3#OKoSvnb4RNn2GgZgUjCOLBYM-7N(~@&~8tE
z{DJ#Fa}tTZBPj_0iM}p+_6uLL_xPcMKe)EO@iV2Gx-y^Mon_5w<7~{zI0)7c2Y4vX
z=w1}tE<J*7e4c~N7+_ZLPHz%4x26QUH<}ICwnHAJE1Sru?Z!??vtd=H4&g{=3)EGH
zLBBvg%CTd1g!%a%&fl?#7hQP@mtA%mGuyVXbFPOStpOUk0uKp1Qb0-I0YDW2TG>9;
zTt?N6kCW{<hA0QiM(?q)L_01Y*~-aJherp-;bb}Z4sBoxQEV}G_BdZs7RI+4e*}ZO
zdIS@#Wi!^GS|ZSFocA<HG0*@gSD+??rz##$M$20*oLFsR{X`oF4$R_~hZgYgp*gIs
zb+Eiv@D^)owo4R+29pLW`1T7HE3+61JBCon{Y<-4BO=pEki;sGCJ`c8rXVN0I&4M=
znL-!{5FxWLgV}WJ)B6p?H|m446j)a@+Fa2XuAFEU`qR_Xv+sP)bFRDp&pz<h!QbFB
zPxKU}BmgA(y6M?3{)yI!qmR94t2=np)&SS5_R?I@T7=3nV%EZL>`C%?I)fy@(bF-o
z?>0&vzvfGjc5MH=u#`uYIXpFRwel>(azMC4gX%D|T5DBMs49g~KZ6=6G$}`(Y0P$d
zxcb6XTz%OJFYfBnwxu2}-r41S3q5M*qnf*viqwcfBMll7>k+`UP~g(MTNENtosIFE
z48t;TH4_tQb`kyd|E%-AL6aG5j-U+=U}A=k-}htVO0$KrL$qrEK%x?+9DlfyaExQ1
zVu1<}LlpoQfNlcF0M2Tyxj)MJiIpjO`1lM?pKM|I&@}FSYytNkoWc553l%H$wMMBb
z6wQ+JymF2gY*IUFEi+0+!iW7SkO&g99^AJhA=Vt*P{4Q%$u%g~G>PR02nfU@JAtXo
zmExm2e9`6(hvnD*C;%Cc`m0p+PFA_@-7`Bg{oeWcxsTrcv3DGy3oc49|93bg0U*&g
zgnr-+zod>l^2Ei54t?#%di|}RF1fY0F||Ww&5jWOIONeR&ohtg!=l{y3=_FwPw>Tx
z{?P74B9TxA)tyyWoK28`2Y2_uT>}Jn*I*&R-QC>>*I>cjf(G~C4#5d9xWnKYT$g-z
zd$B)Y&*^jC_on-%yQ;dLF1cvuX5N5>Qpw6v)mI%c$e-_90{^zDQ7jupZKFA0l7)xU
zhw}OHapO;`(*nTP)6Uo?AkbccxYgwxSiRT~^lK0*GY8A1qE-A`I5;_$u)-{#Mh#Cq
z4OtI}Za0Cye5>9VD@@%ek-$--MGl4F+mDtO2<#xvV2-Q&RT2=oMEo^4ke3qzgdGK>
zSer!$1qac6#tY^6Dr8icSdy7|ha%!rp%hP^+ZPgH;p}1#TuZ@6C(9b59@fz!Hp|aW
z*aOs4s;P?a0TtEP(CsaU5G5)24?p9U{J2%1)bllE7i|#Z5wfA$@_C|*G2~9irSae~
zWeNMr>=VZSCN1wU_lrzv_6HIKNXSWOUg;h-1Cc*iznot>gb<Wk5(GF-tqb#RTo9bE
zJrW0iqjI<ZUEd7Z;3yusr=IG5HO(j0=;`yn%!W|r=6QN3;+=X2e=$03Qojo~DrB8p
z(!K5^__eQ&Zos1gTNRmuF&qSkBCp`C!XDN0&Vwuxt-w}3;t<oAKHcQt&;5%KeyVEw
z9SFbvJce~n5eb9=fgh-2YHbraxP)C*j%Bg$v)E#al6Jn<(?zPQrFT%o&n*R>W<Z{(
zQk+%OFsV>2%+Vat4q;+Xk<!C%<gs5Un}AcC1`p&P9ou~;jLmDn&4l&)A%VMGvN?_M
zWgz)uBGu=~O+^^wvi#{9+&1&@>d9K}adr|jJ#<&QD&B*OOCljJEBN^L{Fpf%oR<KU
zHHV;^Sk%&Xewj~{j%p*sz~q$bI@qa%jPmdYv>i2ZWq<7MW8NHk#0Pq+mN2=oxO{3#
zBW+QXpXoTNIbRm%c7@;zlgHkh7q|IO_G0!nm`1RK1uxu}%E3~FxlHfPKveaoHxm!b
zC!aiW8lH*>I*tb8{dUs=45(G9B;S$5_08wj0D}wUO~_mLvEd6_v}F7$=yJ4tuUnAt
zn?cpza+JT5&6QSefdYq%L<-c0(*&dVCbMYVG%c~59c+Pf`lQ1qo+DHDqXY(4eQ{%E
z1@5+>6!zdi^B~|*>L6SRd{2o|Fc_W|fIE^yT$J$<$f#C?T6Xk9YC^9-RSjN(P1Ovq
zBn!A=8NS%LIG9VSZ)XTB6y}yH(k`^pu=4oCMU1x`i(HjG^W~dGNkL@dKG3^B6_eUh
zM&{eMAeLEfNdi>((W_>G5`$wMUoZtKzhsTtA`@OSJW*Q+>Y8!5cuEnF2~~z@)HqzV
zrRVS~8j0}QKyQ*g3IF`SkOmIk{tZY#5+p^ahFZn68zz%_{HTZ!v&@hOD@)9mXEcsx
z;ik<Wr8w@<8ppT2)7-L6A)-YuXt{xj!sce2X!}*{^`i+ME0i@aA{A0L0muj+a5SPk
ztCLxKtKWhYin>=DKLfTdaWQY29~bSeZM}XSe8@4pzfwBixEFmL#Su3D&upqndClKJ
z$E(2H`K3c`Mq74z1lZr)-w+d*f^5|G*nSHNT1J;kH)Ls`YgHMhA+2@_>+Xu*s4Q8I
zt6<DE7(vO5Ave;)a>FwOz55P3ZbJQcs68uo!@>2H5S9TPZ>1IG+OQq}$PAdO;?8XK
zs!mPr>-aAjq3p2I#kLLA05x}_DvL0Uk{L$Aoa`AU!m8{<bG)lc2~{iH44FhIA}kJd
zsxc<I!5<@DW1N65?k}0Pvtc&_mSN%<MS?VL2%!_=aqlBmHT+dhoKq4fNDaQYtXb)^
zI;W!`9T5x><rsIe{1~cC&df)?uYD`0Fj*aAXY`=}js??$h*0O>90uC;SR`<4+zNv=
zjFw+8osi(@=^o&S5X1f~1r`>=-+!eq+QVO_*CPqLP^I|Gfs<qc-mGXTk;xiHkml*|
zd{3h)2($MU^_Y3@mh>7W`nq>SeBn>;gZv)8gzf+JFb(vwFdwmg7ZuZ<Rix?YfMytP
z0=eqw>@2^ci(Dk*Hoa8Y+eogqeT{DZ?VD|xT-)cfZ|QY9xpjf<ipI?mgMV?4U>t^!
z<ScxFACuD5rg!+;sB&8wj%J^E6FE;R$ZRJO;R{WA2zM!A$&l0d^v?CD_x{T5f`^5#
z2Xt@wL-XKrgOGXCmtv(Bw0@eH&`?FNN0rC7P*<Hw`F0n7vpnP4;HduCv|BxWRE`-w
zPE^W_9u1oGddVaDP`%~yn4C|WL@o@{ZLdsTTfL@eR5mo2IvuuQS+bYklxB-obsCjH
z0+`6-!o;i+^Hw9~cT&<tDb!USPn@%y4d;TOjrE%Ki>14p1csTn(C>hRgDmB@i#WEK
zQ_;7T*)e)_(83VpQN;o6nz^jWOL^VEOr6V)3Iv;9&N)V$-J^%@P49ck8m^BvwU9U}
z%?cH8&_^5h(PbeJ@roNdbS?Y%Q3xg2^%h&%)wEkJ(sw`vrSL;yfp&VmzCG3E<b8m+
zfT~V|?8Itv5-NjT%A8G@hW!Mosm@P6A-P9XEtzV5_P%xkZNkQW-K2OLeC)7phFRLA
zn&2N_%NN?h5=GD20^Ox_`T}1RPV_&0V<Gfrc&XF<2nI=v7f5>0xX^spgM+Rb2g}vV
zYamir%TSZuXds2m9-{$Q1%!E@)-#IN3|rsE$c2NXqF&*X{o9EX4j5JD0uCq@c|Ynb
z-iFgp^SK<?ZV2n$@<I^S=IxDa$|{jk_I}WC9WORSK4DA)(n<b8+qD2Id^IW@uN;5F
zTUFY{^AN|h2Bv6t$!@D&vd-L>pY$f-Y7+FWIG5*sB%)KHNF(fmuj(XJeJhOx8=}y5
z3E8I?h08aZDSfzAlcWnw*^)I=#029S898Y{xP<otk{IK)iI}5De#nA}4LMx#uJIGT
zeB%r!gi`s0ibaL#d&(c68~=sE_WsgktQSCQnaxI?rm_<pEsFnVo&b!aeg;m=HWrKx
z_$D_eX*QVEMkz()rfxDP9J@7?7+_GnzG6Ldekx#jC)lj-aya1`@Cx%AoOj@;hy*2f
z{h^Q-^FjnLu+V+A4@4mI-HbMH{3{zS`I2dzqMzMFK<w?Sku-{{g`nXDSSQsvYTdrT
zOA9fu8~&JmY@~zYElAgAM6d&QsUB&cGkk@p%uekzXYg~bu67N4YC+iw>yA7TKlOPY
zHh<aB3<OQ7`$N2M>x5h1L@>MyeV^uVh~DK#3~-lgcch*wk%-zSk|=hxUb7NfNo|FS
z&WL)l3yVTDw5<M;zqT71Cy0QgI7LRsR_|$m8+)&TGYl~ahvn0@FbZNIUAKfkDH*t8
zUn!ylo|z953aEz;wr+H{N&o7ezowRF*HRzP_Ti-SC64V)n>-5p#qmG&z#J7g1|>8C
zxCrjP8Ty42fnnIt+<fKP?DLYQF}IxNp32}jkw7IaGR&edxov!F)X*HKHR(hlZqy57
z7tPxYZ%*WYpoA7^UUH`Ijapabh}vcW+ITElVF~^7<i`@OfD8zFYW*<f5lfE(sD8xU
z_Oy2{qLQ6?#cGmWR$KLkrb(xY5b{P9q<^rP(=6~;;EXpuSug*?sjm4G=l)0SevCT=
z@X>0Lv@b3%{bUmr##ST|T3U#N43&LPmmDX^6j7X=hh7XZ+tl@}O@3w-EFr@U%wN@+
zQL84m;r=@{#pdv~dGhCM<*aoJLnF%SkBeOL0q8xwQSQ2m23iDVlOF&f1Oz;!t=EY7
z_ZzZ0RI_$_xxUP)IM|^Xl>MEQC~A<Bb{*2W(ucA;JsAkznwQq)4eoJZ@^Glx(~eyo
zg}q%`Ru&l=3-vhW_PT3k+~9QBCpn8BASOq`Kc!w6n675^CGc(;wp)*qPSurnI9Qgr
z`rX4}!W5Owasnkb6S!E10h{SnBE1DZmFRmAE7Mr99KI4u@&eyQjO#@5U8Q5PtL7q4
zJOm)G`PALXX%I=Jc{PN}dWxy0nf)?x2vcPABakQvn$SxLVXdf|71&w-)KK7Xq&W4u
zw0d%~Z}3>3miJg?`1T8THt*oL@Sg+a@qOhX;F>-_nw0NiGfXy~#P4^$sFy!TOTP&C
z*Hzm$vAzSY7!lQeQrNk@X=Ao(M+bK6%Q)i;$}9W>hY5m6RBpQqEw)%62MZkBcfDR>
zwr6ti*HsbhqfP@hI)q~dnXgGfzqLi!Dr#R)`4XDUT?eqJb%SD>F;AsFdj~d4QT|0t
zub;2o3vn?>4{naQg+>0wAExN-XHfKjZpMyp8%83V=1jbmu8n4>6%Nfu+2{*fO0?|s
zg_#BMP`Ngs6`qi<FI4`@YEiby{ge6pQ2B$hv#%;HsM&Vmmtn_6pFhIuu4t!l*bVJt
z_&<y%Tz(K?_%s%aK;E?zY~cC#X@M6Ea#Aa|O_-X5<amz)?dcc-nR^+P?sY05mox@u
z+&3d#%w*ZgKje<mF0CC{PBw1(Pd1RII&LDx5{3<Zc(lf(>}+KggL_c1kQi}OOn*>d
zU_XT<Nx7n7laV#TK5(*s&mybG3*1duj4rNVMaY0j=tU6<;F6ovWJkhLJ2lGfc+Wqd
zkp^8?m%E-MPGeAuA&_*-Y~HGlDG9L>6V8Sy7O~`(HPF{flr!t2`&1lNSplnZ9Pl5j
ze}(;uKiATEK53frdkuPf%X#w&m5S;L`sYWeP`PaKSNlFpHEPC@3ON33e}K_lyU|2<
z_aLo5EHC7q@^+1micIH*Qv7Zy7(S4c>M@X9Nt!;~0&;vxZFc3!{Oh&ElFk+Sl}Iu?
zx^DIMh1+r>_0~B^h7XYx6Kt_BC+9Q_#ZMVRGwU%v$u7qan~(*7<2`C#5$$juK-1=`
zuNJg;PG1^moaJNloT|4Ra<QrkV3}eDWGN<I$bFMiu+jrKjq~9H`U-QHdqU?q9Dq*7
z-?y?6jspv!bNqlv_&<7dT>0M{-=4c={55LI-}=z-wE@J>$$OLWOE`_J?cwXWBK<Ax
zW66Kpic~J&qq6PIre^cA+W_?!=y0@rXW`Dbh#ZJ|GoS1UX}Fb0<y}_PhQ!WQ`nxoz
zXGCqV)^xgVA}ej+)VH<a4pN>IU_I57{bl_)zQl!iUmKbtNxEoQzX=tTPwLW>NSy`h
z4Htt(jV67B#ktP+oP$5c*-E@@)2k(98@qp=QFae5NGFn+wWbS`E~@13X=lE7YJDX2
z__ki+P)nJhqp^ejJy;Y0@l{$7zt5iv5UQ7yGhx_xg$kjrGDi2W$cuZC`Ekf_OGY!t
z_>CL4f%W5&<L7x@Vn#BS7GUeIH3$F4Y}d&bX0kKi=VrFIaQPcAHYiOcSRQQJM<0g0
zciUw~)nDBOUr70=J6z|7JHG`(F5q!`BkHm5wAf8MH7{BA=)Gi^#T21Cn?jc`DqoID
zaooU0X<`iWP!ENe?;Faz+IhK<>AsR8!ZYG}lP6#@`z6BlSO;-YqOX#Qv*gD3;fn2k
zKV3ZT+cX+At66(|j6KdE!Jw3iO!ntUi({VO)pa^w8a;9D+GQdDNs)S*Ct$LhwIi|C
zsqAX2Sd4dkSnn{-YZ<=mvt6tYucHX<nfsXWpkUl9gOcDXhW8gsB(829XGtr7m#2;7
zvbN>Z-q7WDc;<MOminp5si_YCr|PxymoCjtNNW7+A&Ad?_o9ZAU9u++$H~~_HL8m-
z8T0+r({UVMrT|1jGUt`CrlFmpp*Htwo)%*1$vPbc)AnL`l=EJL){U+^D0w}87A6s#
zzDxXvqMP~rR*Rp`D6UO6B(<{p${e1<RohNU@&3JDeS%O)+&VsX3S^d~Bu7c&ao+f7
zTvN-HE^$!HGy`46uydtkD+j|yjsEfdoM)X%Ygy|%Vtq&ud}QC<E!5i*G>dQTcArU3
z56>45!Vq(uPAOJQ4?i7Fz>si{lJc2H@W?Pg|Bx#bOY#TkN0v%{ge{SXP99aYo-hX`
zjlO0=wjj0Qdm*P9$Egp+_IV$!PErXv?!B42?`}crV8?T~T9}>yfFtw;_@6TWPZV-e
zt~2ujTs^KXWj#rR15VoCHJl+I$u|QL2IpKGMb9$+pTJng&#845@V3N4Bcs5i4DIY=
zoFiw`hrn_5VKtaZib=~Nr0>u|)K>&B1YVYdsrYuOw+_Qvp#*~7&b@PI`naY~4Q8#0
zriF@X)Zt=0Y<A6of)d7zo0BubhaCj?#A0X7j=hV&SOI3P=MgDdWx~_DOGS8nuDwWx
zrctrGX2cuOm@ncKl-8IWAII%zJ_c8~$|lJ37Ar6z5SKNB75==$YH<2S=8HBpwz|#s
zo!r(KIG>`lgYE@Iv-%#e{dF1M3G1X!+bf=<o{-n(jKWWsd*QWpFmv0>6;;_S|6IDd
zw{KiSWkCuRbmJAe(+Md!XNaB<4|8#QA`h$RLNTpxVRL)`H>bM_)(K#Qp#P~l1J^1u
zpYN0K^Momh9>eo3#_zc>q~OBs5lT9zzIgvh4m~*6pvoG+@C#;af}|A!Bd$)io`oby
z4ghAWSF}8BhMoGm?&jCiWzP;!<co2GB+{^gYNUOdbxaDPws|xFPG4Ow_L1S~cyq=l
z-pk9%$L8qFqUh4l(qjL7(e=<A<82UOBNP2d{@T9ueJg!Nr<uFn@{~#W?t9{lwM885
z?N9NFdJi%`?GreIZFWz!-(N@N%){!QGzU~KeEdqXI`OmV$#ZpBt}W3YTKo+k1EGR{
zOY*G`7PvWC1&?f)rpG1d&}_0}*(Yp^<=@6QM3fSIauu8KqK2?6Pq9#uz}lU0o#p>c
z8Ygonn)IW@VO%POh7vO&D>#R*G&M0hx4bRVmK1&E>NiT3va(1Z`&06eVih7uh$}V<
zWGf><V?T0q;?|nymto#Knmjx#7c8~35Scw07jZh|p5lLpif=KvqiF~7|B)6o3h1-2
zo8*9{_&1vXyEn<%HlT>>-g`wFbACT(kd}yTS;MbN{@HP0LpHCj)F&+Kv3ns)@-YAb
z#ZywF_hlnjgo?>UpYQa3SHuE)71R<0hh1?b2bzFk8`Zln*VD<!vi~mC*~M?Nm>qp}
zwTUkn+?cmpcK<5i{M#6(;E+0*t;0!r$8#_pd0!0sTfq0P;g`OV^dpZ1_XTus9d0n`
z)5;lE&R<aaIdjS_UIChWi0Yt_iW!-~z5Er{xn7ojrPK0BO^bbehq<y`uVY7$(S61K
z#87qQ@9MmRm4ERq*K>vEUEiJ7rF$YodI1;Ij?Ya)1uqx|PS+PWY3k|^!2vaI+v}gt
z3rs8`Y!vskXT(zp==Me1XCbr>C%7QVI{oE+RQ3}^4pVvYaDH78q}cU5^37r_bPAjE
zp8a2h3hTQ^S0EXPeW;zmI=e;S=Dm4M5JDGL&@fqHGav}pc#sKQmngzO-~;KE_hrE6
z3`_wUzOB!GTZ^S|A)bGUt~RF)U9&|OmIHF!gWRKR7A5Bm5k{-fAX|0i%EtvlQ=<H$
zEvLC_`v$e$Piq^lkKmsw903=lI7KSgKmMV2ADfxkT$%J-c!ze<K*+iOCEj%g+xpbF
zBHR5sh~4u!O4ft@zFlJhY{)~RmS$t4SFOroAstiSF__GofTx6s)d;3Y(iIE$8)ScN
z9nOAG!jkleujnZl&${6^G3m0}H?Ni$BJQ~;sZIFpn;f*3SC<jEi9v)NWi#@~p(Q@j
z&iKd^{yp5RklXZ*G_gqPqLf(&1tzCJ*uyUL8V1U;wF?eH(EN(%gb3I@-s*|IRp65R
z)fnJ2N3V~jitd}OuG{|&A>Lg3b^4^QZ;f_tU+3%TaCPf-1rF%7w40|A<>@@s^&A@g
z4K;9y2KGIj_n(U-Tx`A4>`gU4a22)VfD^Fxc9Z&Cz2aa;@G$pKs;QCJ@+;u6La}@w
zU1kq1GumS&+xm;CPPs{RLuD=HQ7x+>SxC4ui{=oiVp(IHY`FkN?q`kR=dInpk%LJ1
zK-*BMew*VzXP8UtYsQigKv8S3vsaHVXZoE!Ur};k=;qF{Jk2hYqmI)ly>$Y+BU00<
z<uHMAXks^v>f*r#?B+D=j?K=cOavCRhJ<R<T^HD>x)q2fhtW2$rx8`p%YZDPJPqQW
zw|*}ovVXfGn|YR=u~GNHOzu6k`DC%vkRMVM@{ftg|K}2sDs9|FlWXedX6lPL-~ZV&
zMYzMOx>ax6PP4P~xU08et?=`KAH<E;K+s-?l}q$w`q{J0p9!U*f`1rU)hy%zUCC*z
zK+o$MQv8>)9k)gKt4NZm|M+-ObeM{+)Cnmz5yjqzTe1;M=ePAlO2i^+C;!Y?g#hXf
zIx0&!deo&N|6<buwrSg4oRKJ`I%h*v8Mov_PgNSYnk{B<8}#w_pELOC{Yv>KXsslb
zjnOC9YNa>xGqs@pxs!3z{S%S9piV(c6~7A=kZ9N$t-$d=xQLD9bEDGXZSe-vVsB_D
z*qK#76vNBQlP655{v`GQhquqEZTiVP7F`t_IEs=mYEwO|)7DL0yMsd96;ioY<m_WS
z#y*G?xINb<53CV-9yZ9`Z0Chc6Vz%zg)z^`d(u>r(IH*=v@Pr%M-TfEV%9r)>zMkp
zIn{XH1}-wHB-+)?t<XOSFJ4yIPP_M-B_S<rYpbhQj)_!=W6T@j`~sqBrN!f@tBg-g
zoU+wF$7DVP`R^MBTs^S)o&J8ia5T^eKuI+!l-l6<7m*}|<AujL``7Swwra0vxCD4Q
zNqhX0c}m+*ze|hJU48JVURAnbWW`&f(PcFA)7}RSZK&esOD;tUtF40bdwe8%0qoi?
z*kSYj0VL2>xT~()Z)e+;Hbh67jBHD2%~a!%UL?=n@+g{R)0|_8_Aa|}=8ZzU)C}Sx
zkbNRM(X*RdVPQi0b0U&+oTx491wWw;3~GBR5^UKrz=(u3gIQ_b3Q>4DnC#}0+DpCa
zL6zd+%bt_h)b(>SJ!HSd-+X$b!_uar;dYzA&+*Okb!S6GQFP{O>iYp?NTeQv2I2O|
zLiIbo-fpy~-HJXx*;F*mAKv&9u;%f3ybeA7&WV+IB1!>Ioq8Y$auLjG8;n!fn#~<h
zFbibkDOI>GAVmm`?JniAAS%WoC*_q?!y)q^Ohx)VZSzqLL^<_;37uF&Cb8q#$B}hD
zlZfCg335*ElQ=|#Bff2lr&Zm)z@+j(leky5)4@~@X62jSRmX=0=tYymr*k(}=Z}eK
z_LH>&lNp|L_0V{;VuwDJ&bF2UZ@O1AGWZ)^@48@OA*<9`$9qHWQzB{SU5%T%uUl+G
zti(~+!h8SjF4+7)902MIG2o5W2)6s`Hr|XEv^6yNE@S75dWI`A3?<b>XtGl)T83+?
z8vVa2t#W><vZ&AfsI;P<LJ?yOXA-LbsKPTG|0p>Q<VIs}6uO)$8L81l5UZO5Gb-mt
zJXW-TeFuamqt27oY99nQ+rm|SMJ1xvVrT?taxjY#gcTP_5G10VCjJ%x3Uyr4l$gw*
zmKP$sV~NWY_9{Zb)U{-Z7HHL6pV15490z<_g_sazdmBY~IbB_RDjrhap;%m@Ro<fS
z>tJcM-;itS#tk{hgJJlrJ-04~EUz1OOg0Yc>2AeXCHa8ypEgNmpeP}PLOj=p+6>wx
z<DA9l-uf^xOzx9Et1q~oo13#<<bI=X`_ne9(%xYL%Zj{*08MsYBCMm}s^p6|rzDuh
z>_cH?uXZZs*HP`E4?9&U`jM4ki0K8276(a4(rBK3D?ntzFD|u?iwp7{xR#qSt_M$_
zMeD<0o8O`IZvi^Qs6lp5*fhJ5FdhxS&l%2q?jYGs8$>X*g}%nT)n}}DzEYQbTxGT5
zfY0LO+UeF+jg}?kB$VC0H*=7>hlj9Nb4~r3w}FU&1{EnB$b77W$$eCp>3=)v9}<;u
z=q~zzaukF>KBmi=qoHgw^*A~jR;of~2)u29#K^cBCK4=MNBC@LfaYctrBnCqQ}#Z5
zE=Xv~zrrssEWk5w(lp3nAKBhFOR>#5!k;Yaky^LyvFLH;9q!n(w-CSOe<00@@A&&d
z+`Ey#Nj?kWOE+9XgigzuM#dSS+vwty0|bKcT7f~=h;1YVOi!rQgwwRgHe&Nu3Fd@N
zx`RHcKV@b5d)HtE{#bj0E%8&86;-Cr&THJ`3qU4ZuJd7!MBNwhH-go^8YV|k*h>H6
zL_S?By%*(r-lpx*1+9F{2fduHXKlD|NH*Ax$u_^spq+=gxp&2^!-;jHz*Lz`(OCQ1
z`l^NJ;-AVDZB<1}raaTKa%3h;8$fc>sLL1c$!J_j#)MJCAL)@|KO!^yIw-Ib$A%Dk
zD)!x%^-7x&n!SiD7+f$EE_<GsGHZP-Jt)9DJD*?Jg0yw%0T$t4S~u?C>QCD)uqJ5R
zpCr>#3SD|C7nt>{F{f?0VtU<5JC|%)&~3pOx9wR^O^_rMlog+b6_3jCi4PwPZ^9Sc
zH*SyizeVhII$;zD!mVEZLk6^&V*gI&L6)?j*rGR_)BVRyH}W3hAc8gcRWH&&Q76Si
z%YcXY=o;bs`N^X?)2jCeg8Bf*X&WW?RGrgFgQ|z%bujpBV&dj7pnJhg-@U$4Ya|8|
z$1-L~B&4st%EZlK!C)cXG@pYQjjJm28Tm%uUHjBmEc)0FUK!LP5j553NP-}z>hH#}
z66u4Mv^tFNTt^26W^!}dLMotL2X$=eOc>a4+=_by#@MO0SsO(LGgUN;4G=W5yi1ya
zryh<zJ~qYkM?yLpJ|It9*9^Ry<_Wgcm=(`BNUFze_c6aC$@9_F`OiuA?cdgHs)cW8
z|JjWVV02d#Nslpr7vM#DL7>pXtisvj_8Jd0<+U_y^$13oGgYZ9yQwOg6ZXKI&?vH+
zn(_or97<cQhq-Wx9$;9sWo4aCoLMw%obOGqs)m+~TJf+&lQNAFh}(n{xfa#iq!hEd
z75}aHlL5xF)@PiER!W9~%1kF3AJ8tz$6X=;eU<`7D^?UPgY!9xT~pMVio{cYe*JMD
zT0N@HI(Ab5v{xHnV_^>0PQ1&Cg_JFwp|0di`utqdnQVB*Rrhgs{n=gz7UmggE%wZI
zr8M;08k}dYexrT)3gT@Z-iLh#0bYq<c(E^_IV*oV<h?)jAic*is1`aB`-cTm0}K$2
zdiC02)A=#(tG`3|hL>Y&Or8gddO$w16T1PocZlacvr^%AB^Z8Eq^~EP-ZI&)+C085
zHa=?TD<Q_++>1v|JiH56uNs<YPn~vLB!8^9)YQ2Pqs5Khi#T!F{>jwV1WG5Ws_w#R
zRz_(tO9Qnv#P>22IOPgvtXvwF{={1RJW*6~bcaBAiKS;8cPlo=fgu)&@j8Qg?rTr4
z+BYgx`|aKDCK0Lg38tI2+CL$1A#0->Wpf{skHu?yw>6DHwNNT*(xo2W7a)Qh=X6LL
z%3M<%I3xTHjcGTOdb+t5-Y&ISdfxc-T`oDToO?NL_pvWTHr~1~TQ9YR;G?i<KPCUS
z#{b8kF3M|BfGW5QiLPU}0{{Tfx=CxfnHjs83z)i?zkdK6>>NBF*xv`Q8atl=7mol3
qH#0lC06Y6(BCo~&nqco}W^Lj9e@{psk6(VD0Fakfma3L83jQA*WVSy5

literal 0
HcmV?d00001

diff --git a/packages/client/svelte.config.js b/packages/client/svelte.config.js
index 564d40675..0aa0da701 100644
--- a/packages/client/svelte.config.js
+++ b/packages/client/svelte.config.js
@@ -15,7 +15,24 @@ const config = {
       assets: "build",
       fallback: "index.html",
     }),
+    serviceWorker: {
+      register: false,
+    },
     version: { name: pkg.version },
+    csp: {
+      mode: 'hash',
+      directives: {
+        'default-src': ['self'],
+        'script-src': ['self'],
+        'style-src': ['self', 'unsafe-inline', 'https://fonts.googleapis.com'],
+        'font-src': ['self', 'https://fonts.gstatic.com'],
+        'img-src': ['self', 'data:'],
+        'connect-src': ['self', 'http:', 'https:'],
+        'object-src': ['none'],
+        'base-uri': ['none'],
+        'frame-ancestors': ['none'],
+      },
+    },
   },
 };
 
diff --git a/packages/client/tests/boot.test.ts b/packages/client/tests/boot.test.ts
new file mode 100644
index 000000000..85a5bf9c4
--- /dev/null
+++ b/packages/client/tests/boot.test.ts
@@ -0,0 +1,87 @@
+import { afterEach, beforeEach, describe, expect, test } from 'bun:test';
+
+type MutableGlobals = typeof globalThis & {
+  fetch?: typeof globalThis.fetch;
+  indexedDB?: IDBFactory;
+};
+
+function seededConfigResponse(): Response {
+  return Response.json({
+    connections: [
+      {
+        id: 'seed-local-opencode',
+        label: 'This assistant',
+        kind: 'local-opencode',
+        url: 'http://127.0.0.1:4096',
+        auth: { mode: 'none' },
+        isDefault: true,
+        locked: true,
+      },
+    ],
+  });
+}
+
+function createRejectingIndexedDbFactory(): IDBFactory {
+  return {
+    open() {
+      const request: Partial<IDBOpenDBRequest> & { error: Error | null } = {
+        error: null,
+        onerror: null,
+        onsuccess: null,
+        onupgradeneeded: null,
+      };
+      queueMicrotask(() => {
+        request.error = new Error('IndexedDB open failed');
+        request.onerror?.call(request as IDBOpenDBRequest, new Event('error'));
+      });
+      return request as IDBOpenDBRequest;
+    },
+    cmp() {
+      return 0;
+    },
+    deleteDatabase() {
+      throw new Error('not implemented');
+    },
+    databases: async () => [],
+  } as IDBFactory;
+}
+
+describe('getClientBoot', () => {
+  const originalFetch = globalThis.fetch;
+  const originalIndexedDb = globalThis.indexedDB;
+
+  beforeEach(() => {
+    (globalThis as MutableGlobals).fetch = async () => seededConfigResponse();
+    (globalThis as MutableGlobals).indexedDB = createRejectingIndexedDbFactory();
+  });
+
+  afterEach(() => {
+    const globals = globalThis as MutableGlobals;
+    if (originalFetch === undefined) delete globals.fetch;
+    else globals.fetch = originalFetch;
+    if (originalIndexedDb === undefined) delete globals.indexedDB;
+    else globals.indexedDB = originalIndexedDb;
+  });
+
+  test('falls back to memory storage when IndexedDB open rejects, and a later call still resolves', async () => {
+    const { getClientBoot } = await import('../src/lib/boot.ts');
+
+    const first = await getClientBoot();
+    expect(await first.store.list()).toEqual([
+      {
+        id: 'seed-local-opencode',
+        label: 'This assistant',
+        kind: 'local-opencode',
+        url: 'http://127.0.0.1:4096',
+        auth: { mode: 'none' },
+        isDefault: true,
+        locked: true,
+      },
+    ]);
+    expect(await first.store.getActiveId()).toBe('seed-local-opencode');
+
+    const second = await getClientBoot();
+    expect(await second.store.list()).toEqual(await first.store.list());
+    expect(await second.store.getActiveId()).toBe('seed-local-opencode');
+  });
+});
diff --git a/packages/client/tests/connections-seed.test.ts b/packages/client/tests/connections-seed.test.ts
index faa4cab1b..032ef17fb 100644
--- a/packages/client/tests/connections-seed.test.ts
+++ b/packages/client/tests/connections-seed.test.ts
@@ -31,6 +31,22 @@ import {
 } from './helpers/contract.ts';
 import { jsonResponse, recordingFetch, rejectingFetch } from './helpers/mocks.ts';
 
+async function withLocationHost<T>(hostname: string, run: () => Promise<T>): Promise<T> {
+  const originalLocation = globalThis.location;
+  Object.defineProperty(globalThis, 'location', {
+    configurable: true,
+    value: { hostname }
+  });
+  try {
+    return await run();
+  } finally {
+    Object.defineProperty(globalThis, 'location', {
+      configurable: true,
+      value: originalLocation
+    });
+  }
+}
+
 function seededEntry(overrides: Partial<ConnectionEntry> = {}): ConnectionEntry {
   return {
     id: 'seed-local-opencode',
@@ -61,6 +77,7 @@ describe('loadRuntimeConfig (P5b item 2)', () => {
     // connection URL — the client holds no other trusted origin at boot.
     expect(calls[0].url).toBe('/runtime-config.json');
     expect(calls[0].method).toBe('GET');
+    expect(calls[0].credentials).toBe('omit');
     expect(loaded).toEqual(config);
   });
 
@@ -88,6 +105,32 @@ describe('loadRuntimeConfig (P5b item 2)', () => {
     const { fetch } = recordingFetch(() => jsonResponse({ unexpected: true }));
     expect(await loadRuntimeConfig(fetch)).toBeNull();
   });
+
+  test('rewrites locked loopback default URLs to the current LAN browser host', async () => {
+    const { loadRuntimeConfig } = await loadConnectionsModule();
+    const config: RuntimeConfig = {
+      connections: [
+        seededEntry({ url: 'http://127.0.0.1:3800' }),
+        seededEntry({ id: 'remote', locked: false, url: 'http://127.0.0.1:4900' })
+      ]
+    };
+    const { fetch } = recordingFetch(() => jsonResponse(config));
+
+    const loaded = await withLocationHost('192.168.1.10', () => loadRuntimeConfig(fetch));
+
+    expect(loaded?.connections[0]?.url).toBe('http://192.168.1.10:3800/');
+    expect(loaded?.connections[1]?.url).toBe('http://127.0.0.1:4900');
+  });
+
+  test('keeps locked loopback default URLs unchanged on localhost clients', async () => {
+    const { loadRuntimeConfig } = await loadConnectionsModule();
+    const config: RuntimeConfig = { connections: [seededEntry({ url: 'http://127.0.0.1:3800' })] };
+    const { fetch } = recordingFetch(() => jsonResponse(config));
+
+    const loaded = await withLocationHost('127.0.0.1', () => loadRuntimeConfig(fetch));
+
+    expect(loaded?.connections[0]?.url).toBe('http://127.0.0.1:3800');
+  });
 });
 
 describe('seedFromRuntimeConfig (P5b item 2 — locked default)', () => {
@@ -154,6 +197,31 @@ describe('seedFromRuntimeConfig (P5b item 2 — locked default)', () => {
     expect((await store.list()).length).toBe(2);
   });
 
+  test('re-seeding prunes locked entries that disappeared from runtime-config.json', async () => {
+    const { store } = await storeWithBackend();
+    await store.seedFromRuntimeConfig({
+      connections: [seededEntry(), seededEntry({ id: 'seed-removed', label: 'Old lock' })]
+    });
+
+    await store.seedFromRuntimeConfig({ connections: [seededEntry()] });
+
+    expect(await store.get('seed-local-opencode')).toEqual(seededEntry());
+    expect(await store.get('seed-removed')).toBeNull();
+    expect(await store.list()).toEqual([seededEntry()]);
+  });
+
+  test('re-seeding prunes a removed locked active entry and clears the active selection', async () => {
+    const { store } = await storeWithBackend();
+    const removed = seededEntry({ id: 'seed-removed', label: 'Old lock', isDefault: false });
+    await store.seedFromRuntimeConfig({ connections: [removed] });
+    await store.setActive(removed.id);
+
+    await store.seedFromRuntimeConfig({ connections: [seededEntry({ isDefault: false })] });
+
+    expect(await store.get(removed.id)).toBeNull();
+    expect(await store.getActiveId()).toBeNull();
+  });
+
   test('seeded locked entries stay immutable through the store API', async () => {
     const { store } = await storeWithBackend();
     await store.seedFromRuntimeConfig({ connections: [seededEntry()] });
diff --git a/packages/client/tests/helpers/contract.ts b/packages/client/tests/helpers/contract.ts
index 948dd1cb0..d2b00bd0f 100644
--- a/packages/client/tests/helpers/contract.ts
+++ b/packages/client/tests/helpers/contract.ts
@@ -131,10 +131,19 @@ export type ConnectionStore = {
   seedFromRuntimeConfig(config: RuntimeConfig | null): Promise<void>;
 };
 
+export type ConnectionStorage = {
+  getAll(): Promise<ConnectionEntry[]>;
+  get(id: string): Promise<ConnectionEntry | null>;
+  put(entry: ConnectionEntry): Promise<void>;
+  delete(id: string): Promise<void>;
+  getMeta(key: string): Promise<string | null>;
+  setMeta(key: string, value: string | null): Promise<void>;
+};
+
 export type ConnectionsModule = {
   /** In-memory storage backend (same semantics as the IndexedDB one). */
-  createMemoryStorage(): unknown;
-  createConnectionStore(options: { storage: unknown }): ConnectionStore;
+  createMemoryStorage(): ConnectionStorage;
+  createConnectionStore(options: { storage: ConnectionStorage }): ConnectionStore;
   /**
    * Fetch '/runtime-config.json' from the app's own origin. Absent (404),
    * unreachable, or malformed file -> null (no default connection; offline
diff --git a/packages/client/tests/pwa-config.test.ts b/packages/client/tests/pwa-config.test.ts
new file mode 100644
index 000000000..a346143d7
--- /dev/null
+++ b/packages/client/tests/pwa-config.test.ts
@@ -0,0 +1,228 @@
+import { describe, expect, test } from 'bun:test';
+import { existsSync, readFileSync, readdirSync } from 'node:fs';
+import { join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const PKG_ROOT = fileURLToPath(new URL('..', import.meta.url));
+const BUILD_DIR = join(PKG_ROOT, 'build');
+const STATIC_DIR = join(PKG_ROOT, 'static');
+const APP_HTML_PATH = join(PKG_ROOT, 'src', 'app.html');
+
+function walk(dir: string): string[] {
+  const files: string[] = [];
+  for (const entry of readdirSync(dir, { withFileTypes: true })) {
+    const path = join(dir, entry.name);
+    if (entry.isDirectory()) files.push(...walk(path));
+    else if (entry.isFile()) files.push(path);
+  }
+  return files;
+}
+
+async function loadViteConfig() {
+  const mod = await import('../vite.config.ts');
+  return typeof mod.default === 'function' ? mod.default({ command: 'build', mode: 'test' }) : mod.default;
+}
+
+async function loadPwaModule() {
+  return import('../vite.config.ts');
+}
+
+async function loadSvelteConfig() {
+  const mod = await import('../svelte.config.js');
+  return mod.default;
+}
+
+function builtFiles(): string[] {
+  if (!existsSync(BUILD_DIR)) {
+    throw new Error(`client build output missing at ${BUILD_DIR} — run \`bun run client:build\` first`);
+  }
+  return walk(BUILD_DIR);
+}
+
+function withLocationOrigin<T>(origin: string, run: () => T): T {
+  const originalLocation = globalThis.location;
+  Object.defineProperty(globalThis, 'location', {
+    configurable: true,
+    value: { origin }
+  });
+
+  try {
+    return run();
+  } finally {
+    Object.defineProperty(globalThis, 'location', {
+      configurable: true,
+      value: originalLocation
+    });
+  }
+}
+
+function makeRequest(init: {
+  method?: string;
+  authorization?: string;
+  cookie?: string;
+  credentials?: RequestCredentials;
+}): Request {
+  const headers = new Headers();
+  if (init.authorization) headers.set('authorization', init.authorization);
+  if (init.cookie) headers.set('cookie', init.cookie);
+
+  return {
+    method: init.method ?? 'GET',
+    headers,
+    credentials: init.credentials ?? 'omit'
+  } as Request;
+}
+
+describe('PWA source config', () => {
+  test('SvelteKit CSP allows the app shell and its declared external font origins without opening script execution', async () => {
+    const config = await loadSvelteConfig();
+    expect(config.kit?.csp?.mode).toBe('hash');
+    expect(config.kit?.csp?.directives?.['default-src']).toEqual(['self']);
+    expect(config.kit?.csp?.directives?.['script-src']).toEqual(['self']);
+    expect(config.kit?.csp?.directives?.['style-src']).toEqual([
+      'self',
+      'unsafe-inline',
+      'https://fonts.googleapis.com'
+    ]);
+    expect(config.kit?.csp?.directives?.['font-src']).toEqual(['self', 'https://fonts.gstatic.com']);
+    expect(config.kit?.csp?.directives?.['connect-src']).toEqual(['self', 'http:', 'https:']);
+    expect(config.kit?.csp?.directives?.['object-src']).toEqual(['none']);
+    expect(config.kit?.csp?.directives?.['base-uri']).toEqual(['none']);
+  });
+
+  test('app shell explicitly wires the generated PWA registration script', () => {
+    const appHtml = readFileSync(APP_HTML_PATH, 'utf8');
+    expect(appHtml).toContain('/registerSW.js');
+  });
+
+  test('@vite-pwa/sveltekit is configured with the required manifest and cache rules', async () => {
+    const config = await loadViteConfig();
+    const pluginModule = await loadPwaModule();
+    const options = pluginModule.pwaOptions;
+    expect((config as { plugins?: unknown[] }).plugins?.length).toBeGreaterThan(1);
+    expect(options).toBeTruthy();
+
+    expect(options?.manifest?.name).toBe('OpenPalm');
+    expect(options?.manifest?.short_name).toBe('OpenPalm');
+    expect(options?.manifest?.display).toBe('standalone');
+    expect(options?.manifest?.theme_color).toBeTruthy();
+    expect(options?.manifest?.background_color).toBeTruthy();
+
+    expect(options?.manifest?.icons).toEqual(
+      expect.arrayContaining([
+        expect.objectContaining({ src: 'pwa-192x192.png', sizes: '192x192', type: 'image/png' }),
+        expect.objectContaining({ src: 'pwa-512x512.png', sizes: '512x512', type: 'image/png' }),
+        expect.objectContaining({
+          src: 'maskable-512x512.png',
+          sizes: '512x512',
+          type: 'image/png',
+          purpose: 'maskable'
+        })
+      ])
+    );
+
+    expect(existsSync(join(STATIC_DIR, 'pwa-192x192.png'))).toBe(true);
+    expect(existsSync(join(STATIC_DIR, 'pwa-512x512.png'))).toBe(true);
+    expect(existsSync(join(STATIC_DIR, 'maskable-512x512.png'))).toBe(true);
+
+    expect(options?.strategies).toBe('generateSW');
+    expect(options?.workbox?.globPatterns).toEqual(
+      expect.arrayContaining(['**/*.{js,css,html,ico,png,svg,webmanifest}'])
+    );
+    expect(options?.workbox?.globIgnores).toEqual(
+      expect.arrayContaining(['**/runtime-config.json'])
+    );
+    expect(options?.workbox?.navigateFallback).toBe('/index.html');
+
+    const runtimeConfigRule = options?.workbox?.runtimeCaching?.find((rule) => rule.options?.cacheName === 'runtime-config');
+    expect(runtimeConfigRule?.handler).toBe('NetworkFirst');
+    expect(runtimeConfigRule?.urlPattern?.({
+      request: makeRequest({}),
+      url: new URL('https://app.openpalm.dev/runtime-config.json')
+    })).toBe(true);
+    expect(runtimeConfigRule?.urlPattern?.({
+      request: makeRequest({ credentials: 'include' }),
+      url: new URL('https://app.openpalm.dev/runtime-config.json')
+    })).toBe(false);
+    expect(runtimeConfigRule?.urlPattern?.({
+      request: makeRequest({ method: 'POST', credentials: 'omit' }),
+      url: new URL('https://app.openpalm.dev/runtime-config.json')
+    })).toBe(false);
+    expect(runtimeConfigRule?.urlPattern?.({
+      request: makeRequest({}),
+      url: new URL('https://app.openpalm.dev/other.json')
+    })).toBe(false);
+
+    const apiRule = options?.workbox?.runtimeCaching?.find((rule) => rule.options?.cacheName === 'openpalm-public-get');
+    expect(apiRule?.handler).toBe('NetworkFirst');
+    expect(apiRule?.options?.cacheableResponse?.statuses).toEqual([200]);
+
+    const sameOrigin = new URL('https://app.openpalm.dev/oc/v1/sessions');
+    const crossOrigin = new URL('https://guardian.example.test/oc/v1/sessions');
+    const credentialed = makeRequest({
+      authorization: 'Basic abc',
+      cookie: 'a=b',
+      credentials: 'include'
+    });
+    const sameOriginCredentialed = makeRequest({ credentials: 'same-origin' });
+    const anonymous = makeRequest({ credentials: 'omit' });
+    const nonGet = makeRequest({ method: 'POST' });
+    expect(apiRule?.urlPattern?.({ request: credentialed, url: crossOrigin })).toBe(false);
+    expect(withLocationOrigin('https://app.openpalm.dev', () => (
+      apiRule?.urlPattern?.({ request: sameOriginCredentialed, url: sameOrigin })
+    ))).toBe(false);
+    expect(apiRule?.urlPattern?.({ request: anonymous, url: sameOrigin })).toBe(true);
+    expect(apiRule?.urlPattern?.({ request: nonGet, url: sameOrigin })).toBe(false);
+  });
+});
+
+describe('PWA build output', () => {
+  test('build emits manifest, service worker, and icon assets', () => {
+    const files = builtFiles();
+    expect(files.some((file) => file.endsWith('manifest.webmanifest'))).toBe(true);
+    expect(files.some((file) => file.endsWith('sw.js'))).toBe(true);
+    expect(files.some((file) => file.endsWith('workbox-') || file.includes('/workbox-'))).toBe(true);
+    expect(files.some((file) => file.endsWith('pwa-192x192.png'))).toBe(true);
+    expect(files.some((file) => file.endsWith('pwa-512x512.png'))).toBe(true);
+    expect(files.some((file) => file.endsWith('maskable-512x512.png'))).toBe(true);
+    expect(readFileSync(join(BUILD_DIR, 'index.html'), 'utf8')).toContain('/registerSW.js');
+  });
+
+  test('built manifest advertises standalone installability with maskable icon support', () => {
+    const manifestPath = join(BUILD_DIR, 'manifest.webmanifest');
+    const manifest = JSON.parse(readFileSync(manifestPath, 'utf8')) as {
+      name?: string;
+      short_name?: string;
+      display?: string;
+      icons?: Array<{ src?: string; sizes?: string; purpose?: string }>;
+    };
+    expect(manifest.name).toBe('OpenPalm');
+    expect(manifest.short_name).toBe('OpenPalm');
+    expect(manifest.display).toBe('standalone');
+    expect(manifest.icons).toEqual(
+      expect.arrayContaining([
+        expect.objectContaining({ src: 'pwa-192x192.png', sizes: '192x192' }),
+        expect.objectContaining({ src: 'pwa-512x512.png', sizes: '512x512' }),
+        expect.objectContaining({ src: 'maskable-512x512.png', sizes: '512x512', purpose: 'maskable' })
+      ])
+    );
+  });
+
+  test('service worker preserves runtime-config freshness and avoids caching credentialed guardian/OpenCode traffic', () => {
+    const serviceWorker = readFileSync(join(BUILD_DIR, 'sw.js'), 'utf8');
+    expect(serviceWorker).toContain('runtime-config');
+    expect(serviceWorker).toContain('NetworkFirst');
+    expect(serviceWorker).toContain('runtime-config.json');
+    expect(serviceWorker).toContain('openpalm-public-get');
+    expect(serviceWorker).not.toContain('isCredentialedRequest');
+    expect(serviceWorker).not.toContain('isSameOrigin');
+    expect(serviceWorker).not.toContain('isCacheablePublicGet');
+    expect(serviceWorker).not.toContain('isRuntimeConfigRequest');
+    expect(serviceWorker).toContain('"GET"!==');
+    expect(serviceWorker).toContain('headers.get("authorization")');
+    expect(serviceWorker).toContain('headers.has("cookie")');
+    expect(serviceWorker).toContain('"omit"===');
+    expect(serviceWorker).toContain('"same-origin"!==');
+    expect(serviceWorker).toContain('origin!==location.origin');
+  });
+});
diff --git a/packages/client/tests/serve.test.ts b/packages/client/tests/serve.test.ts
index e892d0dc6..4dd5e7816 100644
--- a/packages/client/tests/serve.test.ts
+++ b/packages/client/tests/serve.test.ts
@@ -1,5 +1,5 @@
 import { afterAll, beforeAll, describe, expect, it } from 'bun:test';
-import { mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import { mkdtempSync, mkdirSync, rmSync, writeFileSync, unlinkSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { fileURLToPath } from 'node:url';
@@ -12,13 +12,23 @@ const SERVE = fileURLToPath(new URL('../bin/serve.mjs', import.meta.url));
 const PORT = 41000 + Math.floor(Math.random() * 1000);
 const BASE = `http://127.0.0.1:${PORT}`;
 
+let rootDir: string;
 let dir: string;
+let runtimeConfigDir: string;
+let explicitRuntimeConfig: string;
 let child: ReturnType<typeof Bun.spawn>;
 
 beforeAll(async () => {
-  dir = mkdtempSync(join(tmpdir(), 'op-client-serve-'));
+  rootDir = mkdtempSync(join(tmpdir(), 'op-client-serve-'));
+  dir = join(rootDir, 'build');
+  runtimeConfigDir = rootDir;
+  explicitRuntimeConfig = join(rootDir, 'explicit-runtime-config.json');
+  mkdirSync(dir, { recursive: true });
   writeFileSync(join(dir, 'index.html'), '<!doctype html><title>ok</title>');
+  writeFileSync(join(runtimeConfigDir, 'runtime-config.json'), '{"connections":[]}');
+  writeFileSync(explicitRuntimeConfig, '{"connections":[{"id":"explicit"}]}');
   child = Bun.spawn(['node', SERVE, '--port', String(PORT), '--dir', dir], {
+    env: { ...process.env, OP_CLIENT_RUNTIME_CONFIG: explicitRuntimeConfig },
     stdout: 'pipe',
     stderr: 'pipe',
   });
@@ -37,7 +47,7 @@ beforeAll(async () => {
 
 afterAll(() => {
   child?.kill();
-  rmSync(dir, { recursive: true, force: true });
+  rmSync(rootDir, { recursive: true, force: true });
 });
 
 describe('serve.mjs resilience', () => {
@@ -58,4 +68,24 @@ describe('serve.mjs resilience', () => {
     expect(res.status).toBe(200);
     expect(res.headers.get('content-type')).toContain('text/html');
   });
+
+  it('serves runtime-config.json with no-store caching', async () => {
+    const res = await fetch(`${BASE}/runtime-config.json`);
+    expect(res.status).toBe(200);
+    expect(res.headers.get('content-type')).toContain('application/json');
+    expect(res.headers.get('cache-control')).toBe('no-store');
+    expect(await res.text()).toContain('explicit');
+  });
+
+  it('also serves runtime-config.json from the build dir with no-store caching', async () => {
+    unlinkSync(join(runtimeConfigDir, 'runtime-config.json'));
+    unlinkSync(explicitRuntimeConfig);
+    writeFileSync(join(dir, 'runtime-config.json'), '{"connections":[{"id":"build"}]}');
+
+    const res = await fetch(`${BASE}/runtime-config.json`);
+
+    expect(res.status).toBe(200);
+    expect(res.headers.get('cache-control')).toBe('no-store');
+    expect(await res.text()).toContain('build');
+  });
 });
diff --git a/packages/client/vite.config.ts b/packages/client/vite.config.ts
index ecaec1173..3af10e8af 100644
--- a/packages/client/vite.config.ts
+++ b/packages/client/vite.config.ts
@@ -1,12 +1,99 @@
-import { sveltekit } from "@sveltejs/kit/vite";
-import { defineConfig } from "vite";
+import { sveltekit } from '@sveltejs/kit/vite';
+import { SvelteKitPWA, type SvelteKitPWAOptions } from '@vite-pwa/sveltekit';
+import { defineConfig } from 'vite';
+
+export const PWA_ICON_ENTRIES = [
+  {
+    src: 'pwa-192x192.png',
+    sizes: '192x192',
+    type: 'image/png',
+  },
+  {
+    src: 'pwa-512x512.png',
+    sizes: '512x512',
+    type: 'image/png',
+  },
+  {
+    src: 'maskable-512x512.png',
+    sizes: '512x512',
+    type: 'image/png',
+    purpose: 'maskable',
+  },
+];
+
+export const pwaOptions: Partial<SvelteKitPWAOptions> = {
+  strategies: 'generateSW',
+  injectRegister: 'auto',
+  registerType: 'autoUpdate',
+  includeAssets: ['pwa-192x192.png', 'pwa-512x512.png', 'maskable-512x512.png'],
+  manifest: {
+    name: 'OpenPalm',
+    short_name: 'OpenPalm',
+    description: 'OpenPalm client app for chat and connection switching.',
+    display: 'standalone',
+    start_url: '/',
+    scope: '/',
+    background_color: '#f9fafb',
+    theme_color: '#f9fafb',
+    icons: [...PWA_ICON_ENTRIES],
+  },
+  workbox: {
+    globPatterns: ['**/*.{js,css,html,ico,png,svg,webmanifest}'],
+    globIgnores: ['**/runtime-config.json'],
+    navigateFallback: '/index.html',
+    runtimeCaching: [
+      {
+        urlPattern: ({ request, url }) => {
+          if (request.method !== 'GET') return false;
+          if (request.headers.get('authorization') || request.headers.has('cookie')) return false;
+          if (request.credentials !== 'omit') return false;
+          return url.pathname === '/runtime-config.json';
+        },
+        handler: 'NetworkFirst',
+        options: {
+          cacheName: 'runtime-config',
+          cacheableResponse: { statuses: [200] },
+        },
+      },
+      {
+        urlPattern: ({ request, url }) => {
+          if (request.method !== 'GET') return false;
+
+          const authorization = request.headers.get('authorization');
+          const hasCookieHeader = request.headers.has('cookie');
+          if (authorization || hasCookieHeader || request.credentials === 'include') {
+            return false;
+          }
+
+          if (
+            request.credentials === 'same-origin' &&
+            typeof location !== 'undefined' &&
+            url.origin === location.origin
+          ) {
+            return false;
+          }
+
+          return url.protocol === 'http:' || url.protocol === 'https:';
+        },
+        handler: 'NetworkFirst',
+        options: {
+          cacheName: 'openpalm-public-get',
+          cacheableResponse: { statuses: [200] },
+        },
+      },
+    ],
+  },
+};
 
 export default defineConfig({
-  plugins: [sveltekit()],
+  plugins: [
+    sveltekit(),
+    SvelteKitPWA(pwaOptions),
+  ],
   optimizeDeps: {
     // Raw-source Svelte package — esbuild cannot prebundle .svelte files;
     // vite-plugin-svelte compiles it as part of the app instead (same
     // arrangement as packages/ui).
-    exclude: ["@openpalm/ui-kit"],
+    exclude: ['@openpalm/ui-kit'],
   },
 });
diff --git a/packages/electron/src/harness-contract.ts b/packages/electron/src/harness-contract.ts
index af5335142..c8eda72ce 100644
--- a/packages/electron/src/harness-contract.ts
+++ b/packages/electron/src/harness-contract.ts
@@ -22,7 +22,7 @@
  * update the `HARNESS_CONTRACT` description in the same commit. A snapshot test
  * fails CI until the bump is intentional.
  */
-export const HARNESS_CONTRACT_VERSION = 1;
+export const HARNESS_CONTRACT_VERSION = 2;
 
 /**
  * Enumerated description of the §5.1 native contract surface. Kept as data (not
@@ -52,6 +52,7 @@ export const HARNESS_CONTRACT = {
     invoke: [
       'restart',
       'restartUiServer',
+      'openLocalApp',
       'launchOnLoginStatus',
       'setLaunchOnLogin',
       'setTrayMicRecording',
diff --git a/packages/electron/src/main.ts b/packages/electron/src/main.ts
index d86e3f261..338f7cd92 100644
--- a/packages/electron/src/main.ts
+++ b/packages/electron/src/main.ts
@@ -16,6 +16,9 @@ import {
   uiUpdateChannel,
   parseEnvFile,
   PLATFORM_VERSION,
+  resolveClientAppPort,
+  resolveClientAppUrl,
+  writeClientRuntimeConfig,
   waitForReady as libWaitForReady,
   restoreUiBackup,
   UiSupervisor,
@@ -130,12 +133,8 @@ function resolveAdminToolsPluginPath(): string {
 // URL and OP_ASSISTANT_PORT is read as an env string.
 const DEFAULT_UI_PORT = 3880;
 const DEFAULT_ASSISTANT_PORT = '3800';
-// The @openpalm/client static app's STABLE loopback port (P5c, #555): the
-// localhost PWA identity is origin-including-port (plan §6.10), so this number
-// must not drift between releases. Mirrors the CLI's DEFAULT_CLIENT_PORT.
-const DEFAULT_CLIENT_PORT = 3890;
 const UI_PORT = Number(process.env.OP_HOST_UI_PORT) || DEFAULT_UI_PORT;
-const CLIENT_PORT = Number(process.env.OP_CLIENT_PORT) || DEFAULT_CLIENT_PORT;
+const CLIENT_PORT = resolveClientAppPort(process.env);
 const READY_TIMEOUT_MS = 60_000;
 // Bound on the client-health probe in resolveInitialUrl — a dead client must
 // not stall window creation (the fallback to the host UI chat covers it).
@@ -649,6 +648,8 @@ function startClientAppServer(): void {
       console.log(`Client app build not found at ${buildDir} — skipping the client server (chat falls back to the host UI).`);
       return;
     }
+    const runtimeConfigPath = join(resolveDataDir(), 'client', 'runtime-config.json');
+    writeClientRuntimeConfig(runtimeConfigPath, resolveAssistantUrl(resolveOpenPalmHome()));
     // Same bundled-Node spawn as the UI child (no system `node` required).
     // serve.mjs reads PORT / HOST / OP_CLIENT_DIR from the environment; HOST is
     // pinned to loopback unconditionally — the client server has no remote
@@ -660,6 +661,7 @@ function startClientAppServer(): void {
         PORT: String(CLIENT_PORT),
         HOST: '127.0.0.1',
         OP_CLIENT_DIR: buildDir,
+        OP_CLIENT_RUNTIME_CONFIG: runtimeConfigPath,
       },
       stdio: ['ignore', 'pipe', 'pipe'],
     });
@@ -792,6 +794,10 @@ function showWindow(): void {
   }
 }
 
+function openLocalApp(): void {
+  void shell.openExternal(resolveClientAppUrl(process.env));
+}
+
 // ── Docker preflight (deployment-review P0 #493) ──────────────────────────────
 // Thin wrapper around the extracted DockerPreflight so existing importers/tests
 // keep calling `ensureDockerReady()` from main.ts.
@@ -870,6 +876,7 @@ async function setCheckPrerelease(enabled: boolean): Promise<void> {
 function createTray(): void {
   trayController.create({
     onOpen: showWindow,
+    onOpenLocalApp: openLocalApp,
     onShowLogs: () => { void shell.openPath(app.getPath('logs')); },
     getLaunchOnLoginStatus: () => getLaunchOnLoginStatus(),
     onSetLaunchOnLogin: (enabled) => { setLaunchOnLogin(enabled); },
@@ -955,6 +962,10 @@ ipcMain.handle('restart-ui-server', async (): Promise<boolean> => {
   return restartUIServer();
 });
 
+ipcMain.handle('open-local-app', async (): Promise<void> => {
+  openLocalApp();
+});
+
 // The UI child (admin "install UI version" route) sends SIGUSR2 to this parent
 // after seeding a newer data/ui. Same effect as the IPC path: respawn the UI
 // server child so the new lib loads (design §6.2).
diff --git a/packages/electron/src/preload.ts b/packages/electron/src/preload.ts
index a11583320..10602e6de 100644
--- a/packages/electron/src/preload.ts
+++ b/packages/electron/src/preload.ts
@@ -69,6 +69,10 @@ contextBridge.exposeInMainWorld('openpalm', {
     return ipcRenderer.invoke('restart-ui-server');
   },
 
+  openLocalApp(): Promise<void> {
+    return ipcRenderer.invoke('open-local-app');
+  },
+
   launchOnLoginStatus(): Promise<LaunchOnLoginStatus> {
     return ipcRenderer.invoke('launch-on-login-status');
   },
diff --git a/packages/electron/src/tray.ts b/packages/electron/src/tray.ts
index 855679e2b..b745a48f0 100644
--- a/packages/electron/src/tray.ts
+++ b/packages/electron/src/tray.ts
@@ -12,6 +12,8 @@ const RECORDING_ALPHAS = [1, 0.72, 0.42, 0.72];
 export interface TrayCallbacks {
   /** "Open OpenPalm" — show/focus the main window. */
   onOpen: () => void;
+  /** "Open Local App" — open the localhost client app in the system browser. */
+  onOpenLocalApp: () => void;
   /** "Show Logs" — reveal the log directory. */
   onShowLogs: () => void;
   /** Current launch-on-login status (drives the checkbox state + enablement). */
@@ -108,6 +110,7 @@ export class TrayController {
     const loginSettings = cb.getLaunchOnLoginStatus();
     const contextMenu = Menu.buildFromTemplate([
       { label: 'Open OpenPalm', click: () => cb.onOpen() },
+      { label: 'Open Local App', click: () => cb.onOpenLocalApp() },
       { label: 'Show Logs', click: () => cb.onShowLogs() },
       { type: 'separator' },
       {
diff --git a/packages/electron/test/initial-url.test.ts b/packages/electron/test/initial-url.test.ts
index b152cfe1a..db5d30119 100644
--- a/packages/electron/test/initial-url.test.ts
+++ b/packages/electron/test/initial-url.test.ts
@@ -131,6 +131,9 @@ vi.mock('@openpalm/lib', () => ({
   uiUpdateChannel: vi.fn((v: string) => (v.includes('-') ? 'next' : 'latest')),
   parseEnvFile: vi.fn(() => ({})),
   PLATFORM_VERSION: 'v0.12.0',
+  resolveClientAppPort: vi.fn(() => 3890),
+  resolveClientAppUrl: vi.fn(() => 'http://127.0.0.1:3890/chat'),
+  writeClientRuntimeConfig: vi.fn(),
   checkDocker: vi.fn(() => new Promise(() => { /* hang: freeze the boot flow */ })),
   checkDockerCompose: vi.fn(() => Promise.resolve({ ok: true, stdout: '', stderr: '', code: 0 })),
   // Faithful reimplementation of lib's waitForReady (poll /health; 200 or 401 ==
@@ -264,13 +267,10 @@ describe('resolveInitialUrl — prefers the client app, falls back to the host a
   });
 });
 
-// ── characterization: harness contract untouched by P5c ──────────────────────
+// ── characterization: harness contract version ───────────────────────────────
 
-describe('harness contract stays untouched by P5c (characterization — already green)', () => {
-  it('HARNESS_CONTRACT_VERSION remains 1 — client-child work is spawn-env only, not bridge surface', () => {
-    // The client server child and the initial-URL preference add NO IPC methods
-    // and NO renderer-facing env keys; the derived-surface drift tests
-    // (harness-contract-drift.test.ts) enforce the same invariant structurally.
-    expect(HARNESS_CONTRACT_VERSION).toBe(1);
+describe('harness contract version', () => {
+  it('HARNESS_CONTRACT_VERSION is 2 after adding the open-local-app bridge surface', () => {
+    expect(HARNESS_CONTRACT_VERSION).toBe(2);
   });
 });
diff --git a/packages/electron/test/main.test.ts b/packages/electron/test/main.test.ts
index 41e1664f0..ed89d9f8c 100644
--- a/packages/electron/test/main.test.ts
+++ b/packages/electron/test/main.test.ts
@@ -139,6 +139,9 @@ vi.mock('@openpalm/lib', () => ({
   uiUpdateChannel: vi.fn((v: string) => (v.includes('-') ? 'next' : 'latest')),
   parseEnvFile: vi.fn(() => ({})),
   PLATFORM_VERSION: 'v0.11.0',
+  resolveClientAppPort: vi.fn(() => 3890),
+  resolveClientAppUrl: vi.fn(() => 'http://127.0.0.1:3890/chat'),
+  writeClientRuntimeConfig: vi.fn(),
   checkDocker: vi.fn(() => Promise.resolve({ ok: true, stdout: '', stderr: '', code: 0 })),
   checkDockerCompose: vi.fn(() => Promise.resolve({ ok: true, stdout: '', stderr: '', code: 0 })),
   // Faithful reimplementation of lib's waitForReady (poll /health; 200 or 401 ==
@@ -272,7 +275,7 @@ describe('buildUIServerEnv', () => {
 
 describe('harness contract', () => {
   it('is at the expected version', () => {
-    expect(HARNESS_CONTRACT_VERSION).toBe(1);
+    expect(HARNESS_CONTRACT_VERSION).toBe(2);
     expect(HARNESS_CONTRACT.version).toBe(HARNESS_CONTRACT_VERSION);
   });
 
@@ -282,6 +285,7 @@ describe('harness contract', () => {
     expect(HARNESS_CONTRACT.ipc.invoke).toEqual([
       'restart',
       'restartUiServer',
+      'openLocalApp',
       'launchOnLoginStatus',
       'setLaunchOnLogin',
       'setTrayMicRecording',
@@ -634,6 +638,21 @@ describe('Docker preflight', () => {
   });
 });
 
+describe('localhost client app affordance', () => {
+  beforeEach(() => {
+    vi.mocked(shell.openExternal).mockClear();
+  });
+
+  it('registers an open-local-app handler that opens the stable loopback client origin', async () => {
+    const handler = ipcMainHandleHandlers.get('open-local-app');
+    expect(handler).toBeDefined();
+
+    await handler?.();
+
+    expect(shell.openExternal).toHaveBeenCalledWith('http://127.0.0.1:3890/chat');
+  });
+});
+
 // ── before-quit handler (double-quit fix) ─────────────────────────────────────
 // The handler must be synchronous — Electron doesn't await async event handlers.
 // First call: preventDefault + cleanup + app.quit().
diff --git a/packages/guardian/src/config.ts b/packages/guardian/src/config.ts
index 01589ead1..8edfb218c 100644
--- a/packages/guardian/src/config.ts
+++ b/packages/guardian/src/config.ts
@@ -27,6 +27,41 @@ export const SESSION_TTL_MS = Number(Bun.env.GUARDIAN_SESSION_TTL_MS ?? 15 * 60_
 /** Guardian direct-ingress port. Read once at module load. */
 export const DIRECT_PORT = Number(Bun.env.GUARDIAN_DIRECT_PORT ?? 3830);
 
+function normalizeExactOrigin(value: string): string {
+  if (value === '*') throw new Error('GUARDIAN_CORS_ALLOWED_ORIGINS must not contain wildcard origins');
+  const url = new URL(value);
+  if (url.protocol !== 'http:' && url.protocol !== 'https:') {
+    throw new Error(`GUARDIAN_CORS_ALLOWED_ORIGINS entry must use http or https: ${value}`);
+  }
+  if (url.username || url.password || url.pathname !== '/' || url.search || url.hash) {
+    throw new Error(`GUARDIAN_CORS_ALLOWED_ORIGINS entry must be an exact origin with no path/query/hash: ${value}`);
+  }
+  return url.origin;
+}
+
+function parseAllowedOrigins(value: string): ReadonlySet<string> {
+  const origins = value
+    .split(',')
+    .map((entry) => entry.trim())
+    .filter(Boolean)
+    .map(normalizeExactOrigin);
+  return new Set(origins);
+}
+
+/** Exact browser origins allowed to receive CORS headers on direct ingress. */
+export const CORS_ALLOWED_ORIGINS = parseAllowedOrigins(Bun.env.GUARDIAN_CORS_ALLOWED_ORIGINS ?? '');
+
+export function resolveCorsAllowedOrigin(origin: string | null): string | null {
+  if (!origin || origin === 'null') return null;
+  let normalized: string;
+  try {
+    normalized = normalizeExactOrigin(origin);
+  } catch {
+    return null;
+  }
+  return CORS_ALLOWED_ORIGINS.has(normalized) ? normalized : null;
+}
+
 /**
  * Guardian's own base URL as seen by API clients. Read lazily to preserve the
  * per-instance read semantics of `GuardianOpenAiApi.guardianUrl`.
diff --git a/packages/guardian/src/cors.test.ts b/packages/guardian/src/cors.test.ts
new file mode 100644
index 000000000..5d7d26731
--- /dev/null
+++ b/packages/guardian/src/cors.test.ts
@@ -0,0 +1,288 @@
+import { afterAll, beforeAll, describe, expect, it } from 'bun:test';
+import type { Subprocess } from 'bun';
+import { mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import { createServer } from 'node:net';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+
+import { OC_DOC_FIXTURE } from './oc-doc-fixture.ts';
+
+const TEST_SECRET = 'cors-secret-1234';
+const TEST_PRINCIPAL = 'cors-direct';
+const TEST_ADMIN_TOKEN = 'cors-admin-token-1234';
+const ALLOWED_ORIGIN = 'https://app.openpalm.dev';
+const DENIED_ORIGIN = 'https://evil.example';
+
+let guardianProc: Subprocess;
+let mockAssistantServer: ReturnType<typeof Bun.serve>;
+let tmpDir: string;
+let assistantPort = 0;
+let internalPort = 0;
+let directPort = 0;
+let adminPort = 0;
+let directUrl: string;
+let adminUrl: string;
+
+function getAvailablePort(): Promise<number> {
+  return new Promise((resolve, reject) => {
+    const server = createServer();
+    server.unref();
+    server.once('error', reject);
+    server.listen(0, '127.0.0.1', () => {
+      const address = server.address();
+      if (!address || typeof address === 'string') {
+        server.close();
+        reject(new Error('Failed to resolve test port'));
+        return;
+      }
+      const { port } = address;
+      server.close((err) => (err ? reject(err) : resolve(port)));
+    });
+  });
+}
+
+function authorization(secret = TEST_SECRET, principalId = TEST_PRINCIPAL): string {
+  return `Basic ${Buffer.from(`${principalId}:${secret}`, 'utf-8').toString('base64')}`;
+}
+
+function directOcCall(
+  path: string,
+  init: RequestInit = {},
+  opts: { origin?: string; userId?: string; withAuth?: boolean } = {},
+): Promise<Response> {
+  const headers = new Headers(init.headers);
+  if (opts.withAuth !== false) headers.set('authorization', authorization());
+  if (opts.userId) headers.set('x-openpalm-user', opts.userId);
+  if (opts.origin) headers.set('origin', opts.origin);
+  return fetch(`${directUrl}/oc${path}`, { ...init, headers });
+}
+
+function adminRequest(origin?: string): Promise<Response> {
+  const headers = new Headers({ authorization: `Bearer ${TEST_ADMIN_TOKEN}` });
+  if (origin) headers.set('origin', origin);
+  return fetch(`${adminUrl}/admin/principals`, { headers });
+}
+
+async function seedDirectPrincipal(): Promise<void> {
+  const resp = await fetch(`${adminUrl}/admin/principals`, {
+    method: 'POST',
+    headers: {
+      authorization: `Bearer ${TEST_ADMIN_TOKEN}`,
+      'content-type': 'application/json',
+    },
+    body: JSON.stringify({
+      id: TEST_PRINCIPAL,
+      kind: 'direct',
+      token: TEST_SECRET,
+      label: 'CORS direct test client',
+    }),
+  });
+  if (!resp.ok) throw new Error(`failed to seed direct principal: ${resp.status} ${await resp.text()}`);
+}
+
+async function waitForGuardianReady(): Promise<void> {
+  let ready = false;
+  for (let i = 0; i < 50; i++) {
+    if (guardianProc.exitCode !== null) {
+      throw new Error(`guardian exited before ready with code ${guardianProc.exitCode}`);
+    }
+    try {
+      const resp = await fetch(`${directUrl}/health`);
+      if (resp.ok) {
+        ready = true;
+        break;
+      }
+    } catch {
+      // not ready yet
+    }
+    await Bun.sleep(100);
+  }
+  if (!ready) throw new Error('guardian did not become ready');
+
+  for (let i = 0; i < 50; i++) {
+    const resp = await fetch(`http://127.0.0.1:${internalPort}/stats`, {
+      headers: { authorization: `Bearer ${TEST_ADMIN_TOKEN}` },
+    });
+    if (resp.ok && (await resp.json()).oc_proxy?.enabled === true) return;
+    await Bun.sleep(100);
+  }
+  throw new Error('guardian /oc proxy did not enable');
+}
+
+function startMockAssistant(): ReturnType<typeof Bun.serve> {
+  return Bun.serve({
+    port: assistantPort,
+    hostname: '127.0.0.1',
+    async fetch(req) {
+      const url = new URL(req.url);
+      if (url.pathname === '/doc' && req.method === 'GET') return Response.json(OC_DOC_FIXTURE);
+      if (url.pathname === '/session' && req.method === 'GET') return Response.json([]);
+      if (url.pathname === '/session' && req.method === 'POST') return Response.json({ id: 'cors-session-1' });
+      if (url.pathname.startsWith('/session/') && req.method === 'GET') return Response.json({ id: 'cors-session-1' });
+      if (url.pathname.startsWith('/session/') && url.pathname.endsWith('/message') && req.method === 'POST') {
+        return Response.json({ parts: [{ type: 'text', text: 'ok' }] });
+      }
+      return new Response('not found', { status: 404 });
+    },
+  });
+}
+
+beforeAll(async () => {
+  assistantPort = await getAvailablePort();
+  internalPort = await getAvailablePort();
+  directPort = await getAvailablePort();
+  adminPort = await getAvailablePort();
+
+  tmpDir = mkdtempSync(join(tmpdir(), 'guardian-cors-test-'));
+  const secretPath = join(tmpDir, 'test-secret');
+  const adminTokenPath = join(tmpDir, 'admin-token');
+  writeFileSync(secretPath, `${TEST_SECRET}\n`);
+  writeFileSync(adminTokenPath, `${TEST_ADMIN_TOKEN}\n`);
+
+  mockAssistantServer = startMockAssistant();
+  guardianProc = Bun.spawn(['bun', 'run', 'src/server.ts'], {
+    cwd: join(import.meta.dir, '..'),
+    env: {
+      ...process.env,
+      PORT: String(internalPort),
+      GUARDIAN_DIRECT_PORT: String(directPort),
+      GUARDIAN_ADMIN_PORT: String(adminPort),
+      GUARDIAN_DIRECT_INGRESS: 'true',
+      GUARDIAN_CORS_ALLOWED_ORIGINS: ALLOWED_ORIGIN,
+      GUARDIAN_STATE_DB_PATH: join(tmpDir, 'state.db'),
+      GUARDIAN_ADMIN_TOKEN_FILE: adminTokenPath,
+      GUARDIAN_INTERNAL_HOST: '127.0.0.1',
+      OP_ASSISTANT_URL: `http://127.0.0.1:${assistantPort}`,
+      GUARDIAN_AUDIT_PATH: join(tmpDir, 'audit.log'),
+    },
+    stdout: 'pipe',
+    stderr: 'pipe',
+  });
+
+  directUrl = `http://127.0.0.1:${directPort}`;
+  adminUrl = `http://127.0.0.1:${adminPort}`;
+  await waitForGuardianReady();
+  await seedDirectPrincipal();
+});
+
+afterAll(() => {
+  guardianProc?.kill();
+  mockAssistantServer?.stop(true);
+  try {
+    rmSync(tmpDir, { recursive: true, force: true });
+  } catch {
+    // best effort
+  }
+});
+
+describe('Guardian direct-ingress CORS', () => {
+  it('answers allowed-origin preflight requests on /oc routes', async () => {
+    const resp = await fetch(`${directUrl}/oc/session`, {
+      method: 'OPTIONS',
+      headers: {
+        origin: ALLOWED_ORIGIN,
+        'access-control-request-method': 'POST',
+        'access-control-request-headers': 'authorization, content-type, x-openpalm-user',
+      },
+    });
+
+    expect(resp.status).toBe(204);
+    expect(resp.headers.get('access-control-allow-origin')).toBe(ALLOWED_ORIGIN);
+    expect(resp.headers.get('access-control-allow-credentials')).toBe('true');
+    expect(resp.headers.get('access-control-allow-methods')).toContain('POST');
+    expect(resp.headers.get('access-control-allow-headers')).toBe('authorization, content-type, x-openpalm-user');
+    expect(resp.headers.get('vary')).toContain('Origin');
+    expect(resp.headers.get('vary')).toContain('Access-Control-Request-Headers');
+  });
+
+  it('adds CORS headers to allowed-origin success responses', async () => {
+    const resp = await directOcCall('/session', { method: 'GET' }, { origin: ALLOWED_ORIGIN, userId: 'allowed-user' });
+
+    expect(resp.status).toBe(200);
+    expect(resp.headers.get('access-control-allow-origin')).toBe(ALLOWED_ORIGIN);
+    expect(resp.headers.get('access-control-allow-credentials')).toBe('true');
+  });
+
+  it('adds CORS headers to allowed-origin error responses', async () => {
+    const resp = await directOcCall('/session', { method: 'GET' }, { origin: ALLOWED_ORIGIN, withAuth: false });
+
+    expect(resp.status).toBe(401);
+    expect((await resp.json()).error).toBe('unauthorized');
+    expect(resp.headers.get('access-control-allow-origin')).toBe(ALLOWED_ORIGIN);
+    expect(resp.headers.get('access-control-allow-credentials')).toBe('true');
+  });
+
+  it('denies preflight for origins outside the allowlist', async () => {
+    const resp = await fetch(`${directUrl}/oc/session`, {
+      method: 'OPTIONS',
+      headers: {
+        origin: DENIED_ORIGIN,
+        'access-control-request-method': 'POST',
+        'access-control-request-headers': 'authorization, content-type, x-openpalm-user',
+      },
+    });
+
+    expect(resp.status).toBe(403);
+    expect((await resp.json()).error).toBe('cors_origin_denied');
+    expect(resp.headers.get('access-control-allow-origin')).toBeNull();
+    expect(resp.headers.get('vary')).toContain('Origin');
+    expect(resp.headers.get('vary')).toContain('Access-Control-Request-Headers');
+  });
+
+  it('does not add CORS headers to denied-origin actual responses', async () => {
+    const resp = await directOcCall('/session', { method: 'GET' }, { origin: DENIED_ORIGIN, userId: 'denied-user' });
+
+    expect(resp.status).toBe(200);
+    expect(resp.headers.get('access-control-allow-origin')).toBeNull();
+    expect(resp.headers.get('access-control-allow-credentials')).toBeNull();
+  });
+
+  it('keeps allowed-origin /mcp disabled responses out of browser-side CORS failure', async () => {
+    const preflight = await fetch(`${directUrl}/mcp`, {
+      method: 'OPTIONS',
+      headers: {
+        origin: ALLOWED_ORIGIN,
+        'access-control-request-method': 'POST',
+        'access-control-request-headers': 'authorization, content-type',
+      },
+    });
+
+    expect(preflight.status).toBe(204);
+    expect(preflight.headers.get('access-control-allow-origin')).toBe(ALLOWED_ORIGIN);
+
+    const resp = await fetch(`${directUrl}/mcp`, {
+      method: 'POST',
+      headers: {
+        authorization: authorization(),
+        origin: ALLOWED_ORIGIN,
+        'content-type': 'application/json',
+      },
+      body: JSON.stringify({ jsonrpc: '2.0', id: '1', method: 'ping' }),
+    });
+
+    expect(resp.status).toBe(404);
+    expect((await resp.json()).error).toBe('not_found');
+    expect(resp.headers.get('access-control-allow-origin')).toBe(ALLOWED_ORIGIN);
+    expect(resp.headers.get('access-control-allow-credentials')).toBe('true');
+  });
+
+  it('keeps the admin listener out of CORS', async () => {
+    const resp = await adminRequest(ALLOWED_ORIGIN);
+
+    expect(resp.status).toBe(200);
+    expect(resp.headers.get('access-control-allow-origin')).toBeNull();
+    expect(resp.headers.get('access-control-allow-credentials')).toBeNull();
+  });
+
+  it('does not treat non-browser OPTIONS without an Origin as CORS preflight', async () => {
+    const resp = await fetch(`${directUrl}/oc/session`, {
+      method: 'OPTIONS',
+      headers: {
+        authorization: authorization(),
+      },
+    });
+
+    expect(resp.status).not.toBe(204);
+    expect(resp.headers.get('access-control-allow-origin')).toBeNull();
+  });
+});
diff --git a/packages/guardian/src/server.ts b/packages/guardian/src/server.ts
index bdbf7c995..92c047119 100644
--- a/packages/guardian/src/server.ts
+++ b/packages/guardian/src/server.ts
@@ -23,7 +23,7 @@ import { activeRateLimiters, PORTAL_RATE_LIMIT, PORTAL_RATE_WINDOW_MS, USER_RATE
 import { runDriftCheckWithRetry, startProxyRecovery, stopProxyRecovery, isProxyEnabled } from './drift';
 import { initializePrincipalStore, listPrincipals, seedPortalPrincipalsFromEnv } from './state-db';
 import { matchTransport, registerTransport, type Transport } from './transport';
-import { DIRECT_PORT } from './config';
+import { DIRECT_PORT, resolveCorsAllowedOrigin } from './config';
 
 const logger = createLogger('guardian');
 
@@ -46,11 +46,69 @@ const requestCounters = {
   byStatus: new Map<string, number>(),
 };
 
+const CORS_ALLOW_METHODS = 'GET, POST, DELETE, PATCH, OPTIONS';
+const CORS_ALLOW_HEADERS = 'authorization, content-type, x-openpalm-user, x-openpalm-session-key, last-event-id';
+
 function countRequest(status: string) {
   requestCounters.total += 1;
   requestCounters.byStatus.set(status, (requestCounters.byStatus.get(status) ?? 0) + 1);
 }
 
+function appendVary(headers: Headers, value: string): void {
+  const current = headers.get('vary');
+  if (!current) {
+    headers.set('vary', value);
+    return;
+  }
+  const values = current.split(',').map((entry) => entry.trim().toLowerCase());
+  if (!values.includes(value.toLowerCase())) headers.set('vary', `${current}, ${value}`);
+}
+
+function isCorsPreflight(req: Request): boolean {
+  return req.method === 'OPTIONS' && req.headers.has('origin') && req.headers.has('access-control-request-method');
+}
+
+function isDirectBrowserSurface(url: URL): boolean {
+  return url.pathname === '/mcp' || url.pathname === OC_PREFIX || url.pathname.startsWith(`${OC_PREFIX}/`);
+}
+
+function applyCorsHeaders(response: Response, origin: string | null): Response {
+  if (!origin) return response;
+  const headers = new Headers(response.headers);
+  headers.set('access-control-allow-origin', origin);
+  headers.set('access-control-allow-credentials', 'true');
+  appendVary(headers, 'Origin');
+  return new Response(response.body, {
+    status: response.status,
+    statusText: response.statusText,
+    headers,
+  });
+}
+
+function corsPreflightResponse(req: Request, requestId: string, origin: string | null): Response {
+  if (!origin) {
+    const response = json(403, { error: 'cors_origin_denied', requestId });
+    const headers = new Headers(response.headers);
+    appendVary(headers, 'Origin');
+    if (req.headers.has('access-control-request-headers')) appendVary(headers, 'Access-Control-Request-Headers');
+    return new Response(response.body, {
+      status: response.status,
+      statusText: response.statusText,
+      headers,
+    });
+  }
+  const headers = new Headers({
+    'access-control-allow-origin': origin,
+    'access-control-allow-credentials': 'true',
+    'access-control-allow-methods': CORS_ALLOW_METHODS,
+    'access-control-allow-headers': req.headers.get('access-control-request-headers')?.trim() || CORS_ALLOW_HEADERS,
+    'access-control-max-age': '600',
+  });
+  appendVary(headers, 'Origin');
+  if (req.headers.has('access-control-request-headers')) appendVary(headers, 'Access-Control-Request-Headers');
+  return new Response(null, { status: 204, headers });
+}
+
 function statsResponse(): Response {
   const { activeUserLimiters, activePortalLimiters } = activeRateLimiters();
   return json(200, {
@@ -132,23 +190,29 @@ async function handleInternalRequest(req: Request, clientIp = ''): Promise<Respo
 async function handleDirectRequest(req: Request, clientIp = ''): Promise<Response> {
   const url = new URL(req.url);
   const requestId = req.headers.get('x-request-id') ?? crypto.randomUUID();
+  const corsOrigin = resolveCorsAllowedOrigin(req.headers.get('origin'));
+  const browserSurface = isDirectBrowserSurface(url);
 
   if (url.pathname === '/health' && req.method === 'GET') return handleHealth(requestId);
-  if (!DIRECT_INGRESS_ENABLED) return json(404, { error: 'not_found', requestId });
+  if (!DIRECT_INGRESS_ENABLED) {
+    return browserSurface ? applyCorsHeaders(json(404, { error: 'not_found', requestId }), corsOrigin) : json(404, { error: 'not_found', requestId });
+  }
+  if (browserSurface && isCorsPreflight(req)) return corsPreflightResponse(req, requestId, corsOrigin);
   if (url.pathname === '/mcp') {
-    if (!MCP_ENABLED) return json(404, { error: 'not_found', requestId });
+    if (!MCP_ENABLED) return applyCorsHeaders(json(404, { error: 'not_found', requestId }), corsOrigin);
     const response = await handleMcpRequest(req, requestId);
     countRequest(`mcp:${response.status}`);
-    return response;
+    return applyCorsHeaders(response, corsOrigin);
   }
   if (url.pathname === OC_PREFIX || url.pathname.startsWith(`${OC_PREFIX}/`)) {
-    return handleOcRequest(req, requestId, 'direct', clientIp);
+    const response = await handleOcRequest(req, requestId, 'direct', clientIp);
+    return applyCorsHeaders(response, corsOrigin);
   }
   const transport = matchTransport(url, req);
   if (transport) {
     const response = await transport.handle(req, requestId);
     countRequest(`${transport.name}:${response.status}`);
-    return response;
+    return applyCorsHeaders(response, corsOrigin);
   }
   return json(404, { error: 'not_found', requestId });
 }
diff --git a/packages/lib/src/control-plane/assistant-client-compose.test.ts b/packages/lib/src/control-plane/assistant-client-compose.test.ts
index fbeca3049..28fea000c 100644
--- a/packages/lib/src/control-plane/assistant-client-compose.test.ts
+++ b/packages/lib/src/control-plane/assistant-client-compose.test.ts
@@ -82,6 +82,12 @@ describe('P5d compose — stack env plumbing for the exact-pin client artifact',
     expect(environmentHas(assistant, 'OP_CLIENT_VERSION')).toBe(true);
   });
 
+  test('assistant receives host client ports for OpenCode CORS origin defaults', () => {
+    expect(environmentHas(assistant, 'OP_CLIENT_HOST_PORT')).toBe(true);
+    expect(environmentHas(assistant, 'OP_HOST_CLIENT_PORT')).toBe(true);
+    expect(environmentHas(assistant, 'OP_CLIENT_CORS_ALLOWED_ORIGINS')).toBe(true);
+  });
+
   // CHARACTERIZATION (green today): the client artifact installs under
   // /opt/openpalm, which is the persistent assistant-artifacts named volume —
   // warm restarts must keep reusing the installed client.
diff --git a/packages/lib/src/control-plane/assistant-client-entrypoint.test.ts b/packages/lib/src/control-plane/assistant-client-entrypoint.test.ts
index 261bab06e..9db62fb7e 100644
--- a/packages/lib/src/control-plane/assistant-client-entrypoint.test.ts
+++ b/packages/lib/src/control-plane/assistant-client-entrypoint.test.ts
@@ -234,6 +234,17 @@ describe('P5d entrypoint — client co-process (static-only)', () => {
     expect(entrypoint).toContain('OP_CLIENT_DEFAULT_ASSISTANT_URL');
   });
 
+  test('OpenCode is launched with CORS for the shipped browser client origins', () => {
+    const startOpencode = extractFunction(entrypoint, 'start_opencode') ?? '';
+    expect(startOpencode, 'expected start_opencode() to be defined').not.toBe('');
+    expect(startOpencode).toContain('OP_CLIENT_HOST_PORT');
+    expect(startOpencode).toContain('OP_HOST_CLIENT_PORT');
+    expect(startOpencode).toContain('OP_CLIENT_CORS_ALLOWED_ORIGINS');
+    expect(startOpencode).toContain('http://127.0.0.1:${client_host_port}');
+    expect(startOpencode).toContain('http://127.0.0.1:${host_client_port}');
+    expect(startOpencode).toContain('cmd+=(--cors "$origin")');
+  });
+
   // CHARACTERIZATION (green today): syntax gate. shellcheck is unavailable in
   // this environment (documented limitation) — bash -n is the floor.
   test('entrypoint stays bash -n clean (characterization)', () => {
diff --git a/packages/lib/src/control-plane/client-app-url.test.ts b/packages/lib/src/control-plane/client-app-url.test.ts
new file mode 100644
index 000000000..f3427aa3d
--- /dev/null
+++ b/packages/lib/src/control-plane/client-app-url.test.ts
@@ -0,0 +1,23 @@
+import { describe, expect, it } from 'bun:test';
+import { DEFAULT_CLIENT_PORT, resolveClientAppPort, resolveClientAppUrl } from './client-app-url.ts';
+
+describe('resolveClientAppPort', () => {
+  it('defaults to the stable localhost app port', () => {
+    expect(resolveClientAppPort({})).toBe(DEFAULT_CLIENT_PORT);
+    expect(resolveClientAppUrl({})).toBe('http://127.0.0.1:3890/chat');
+  });
+
+  it('ignores the assistant container OP_CLIENT_PORT and only honors OP_HOST_CLIENT_PORT', () => {
+    const env = {
+      OP_CLIENT_PORT: '4810',
+      OP_HOST_CLIENT_PORT: '4890',
+    } satisfies NodeJS.ProcessEnv;
+    expect(resolveClientAppPort(env)).toBe(4890);
+    expect(resolveClientAppUrl(env)).toBe('http://127.0.0.1:4890/chat');
+  });
+
+  it('keeps the stable localhost app origin when only OP_CLIENT_PORT is set', () => {
+    expect(resolveClientAppPort({ OP_CLIENT_PORT: '4810' })).toBe(DEFAULT_CLIENT_PORT);
+    expect(resolveClientAppUrl({ OP_CLIENT_PORT: '4810' })).toBe('http://127.0.0.1:3890/chat');
+  });
+});
diff --git a/packages/lib/src/control-plane/client-app-url.ts b/packages/lib/src/control-plane/client-app-url.ts
new file mode 100644
index 000000000..4f1c117a8
--- /dev/null
+++ b/packages/lib/src/control-plane/client-app-url.ts
@@ -0,0 +1,9 @@
+export const DEFAULT_CLIENT_PORT = 3890;
+
+export function resolveClientAppPort(env: NodeJS.ProcessEnv = process.env): number {
+  return Number(env.OP_HOST_CLIENT_PORT) || DEFAULT_CLIENT_PORT;
+}
+
+export function resolveClientAppUrl(env: NodeJS.ProcessEnv = process.env): string {
+  return `http://127.0.0.1:${resolveClientAppPort(env)}/chat`;
+}
diff --git a/packages/lib/src/control-plane/client-assets.test.ts b/packages/lib/src/control-plane/client-assets.test.ts
index 70f3b60a0..ab96be163 100644
--- a/packages/lib/src/control-plane/client-assets.test.ts
+++ b/packages/lib/src/control-plane/client-assets.test.ts
@@ -33,10 +33,11 @@
 // Test patterns follow ui-assets.test.ts (env pinning, makeBuild, mocked fetch,
 // real tarball for the happy path).
 import { describe, it, expect, beforeEach, afterEach } from "bun:test";
-import { mkdtempSync, rmSync, mkdirSync, writeFileSync, existsSync, readFileSync } from "node:fs";
+import { mkdtempSync, rmSync, mkdirSync, writeFileSync, existsSync, readFileSync, readdirSync, cpSync } from "node:fs";
 import { tmpdir } from "node:os";
-import { join } from "node:path";
+import { dirname, join } from "node:path";
 import { createHash } from "node:crypto";
+import { fileURLToPath } from 'node:url';
 import {
   CLIENT_VERSION_STAMP,
   readClientBuildVersion,
@@ -57,6 +58,14 @@ let dataClientRoot = "";
 let bundledClient = "";
 const saved: Record<string, string | undefined> = {};
 
+function walk(dir: string): string[] {
+  return (existsSync(dir) ? readdirSync(dir, { withFileTypes: true }) : [])
+    .flatMap((entry) => {
+      const path = join(dir, entry.name);
+      return entry.isDirectory() ? walk(path) : [path];
+    });
+}
+
 /** Materialize a static client build: index.html + optional version stamp. */
 function makeBuild(dir: string, version: string | null): void {
   mkdirSync(dir, { recursive: true });
@@ -363,4 +372,42 @@ describe("checkAndUpdateClientBuild", () => {
     expect(backedUpIndex, "backup must contain the old index.html").toBeDefined();
     if (backedUpIndex) expect(readFileSync(backedUpIndex, "utf8")).toContain("old");
   });
+
+  it("container-pulled artifact path preserves client purity markers after the npm swap", async () => {
+    const repoClientBuild = join(dirname(fileURLToPath(import.meta.url)), '..', '..', '..', 'client', 'build');
+    expect(existsSync(join(repoClientBuild, 'index.html'))).toBe(true);
+
+    const pkgRoot = mkdtempSync(join(tmpdir(), 'client-purity-pkg-'));
+    mkdirSync(join(pkgRoot, 'package', 'build'), { recursive: true });
+    mkdirSync(join(pkgRoot, 'package', 'bin'), { recursive: true });
+    cpSync(repoClientBuild, join(pkgRoot, 'package', 'build'), { recursive: true });
+    writeFileSync(join(pkgRoot, 'package', 'bin', 'serve.mjs'), '// new serve\n');
+    const tarPath = join(pkgRoot, 'client.tgz');
+    const { exited } = Bun.spawn(['tar', '-czf', tarPath, '-C', pkgRoot, 'package'], { stdout: 'pipe', stderr: 'pipe' });
+    await exited;
+    const tarBytes = new Uint8Array(await Bun.file(tarPath).arrayBuffer());
+    const integrity = `sha512-${createHash('sha512').update(tarBytes).digest('base64')}`;
+    rmSync(pkgRoot, { recursive: true, force: true });
+
+    globalThis.fetch = (async (_url: string | URL | Request) => {
+      const url = String(typeof _url === 'string' ? _url : (_url as Request).url ?? _url);
+      if (url.includes('registry.npmjs.org')) {
+        return new Response(
+          JSON.stringify({ version: '0.13.0', dist: { tarball: 'https://r.npm/client.tgz', integrity } }),
+          { status: 200, headers: { 'Content-Type': 'application/json' } },
+        );
+      }
+      return new Response(tarBytes, { status: 200 });
+    }) as typeof globalThis.fetch;
+
+    const result = await checkAndUpdateClientBuild('0.12.0', dataDir);
+
+    expect(result.updated).toBe(true);
+    const installedFiles = walk(dataClient);
+    const forbiddenMarkers = ['@openpalm/lib', '/api/host'];
+    for (const marker of forbiddenMarkers) {
+      const offenders = installedFiles.filter((file) => readFileSync(file).toString('latin1').includes(marker));
+      expect(offenders, `installed artifact must not contain ${marker}`).toEqual([]);
+    }
+  });
 });
diff --git a/packages/lib/src/control-plane/client-runtime-config.test.ts b/packages/lib/src/control-plane/client-runtime-config.test.ts
new file mode 100644
index 000000000..3d374134b
--- /dev/null
+++ b/packages/lib/src/control-plane/client-runtime-config.test.ts
@@ -0,0 +1,36 @@
+import { describe, expect, test } from 'bun:test';
+import { mkdtempSync, readFileSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { buildLockedAssistantRuntimeConfig, writeClientRuntimeConfig } from './client-runtime-config.js';
+
+describe('client runtime config', () => {
+  test('builds one locked default local-opencode connection', () => {
+    expect(buildLockedAssistantRuntimeConfig('http://127.0.0.1:3800')).toEqual({
+      connections: [
+        {
+          id: 'openpalm-assistant-opencode',
+          label: 'This assistant',
+          kind: 'local-opencode',
+          url: 'http://127.0.0.1:3800',
+          auth: { mode: 'none' },
+          isDefault: true,
+          locked: true,
+        },
+      ],
+    });
+  });
+
+  test('writes the runtime config JSON file', () => {
+    const dir = mkdtempSync(join(tmpdir(), 'client-runtime-config-'));
+    try {
+      const path = join(dir, 'nested', 'runtime-config.json');
+      writeClientRuntimeConfig(path, 'https://assistant.example');
+      expect(JSON.parse(readFileSync(path, 'utf8'))).toEqual(
+        buildLockedAssistantRuntimeConfig('https://assistant.example')
+      );
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  });
+});
diff --git a/packages/lib/src/control-plane/client-runtime-config.ts b/packages/lib/src/control-plane/client-runtime-config.ts
new file mode 100644
index 000000000..ec307c1d6
--- /dev/null
+++ b/packages/lib/src/control-plane/client-runtime-config.ts
@@ -0,0 +1,37 @@
+import { mkdirSync, writeFileSync } from 'node:fs';
+import { dirname } from 'node:path';
+
+export type ClientRuntimeConnection = {
+  id: string;
+  label: string;
+  kind: 'local-opencode';
+  url: string;
+  auth: { mode: 'none' };
+  isDefault: true;
+  locked: true;
+};
+
+export type ClientRuntimeConfig = {
+  connections: ClientRuntimeConnection[];
+};
+
+export function buildLockedAssistantRuntimeConfig(url: string): ClientRuntimeConfig {
+  return {
+    connections: [
+      {
+        id: 'openpalm-assistant-opencode',
+        label: 'This assistant',
+        kind: 'local-opencode',
+        url,
+        auth: { mode: 'none' },
+        isDefault: true,
+        locked: true,
+      },
+    ],
+  };
+}
+
+export function writeClientRuntimeConfig(path: string, assistantUrl: string): void {
+  mkdirSync(dirname(path), { recursive: true });
+  writeFileSync(path, `${JSON.stringify(buildLockedAssistantRuntimeConfig(assistantUrl), null, 2)}\n`);
+}
diff --git a/packages/lib/src/index.ts b/packages/lib/src/index.ts
index 213baf9d0..dc6c029e0 100644
--- a/packages/lib/src/index.ts
+++ b/packages/lib/src/index.ts
@@ -554,6 +554,17 @@ export {
   seedClientBuild,
   checkAndUpdateClientBuild,
 } from "./control-plane/client-assets.js";
+export {
+  DEFAULT_CLIENT_PORT,
+  resolveClientAppPort,
+  resolveClientAppUrl,
+} from './control-plane/client-app-url.js';
+export {
+  buildLockedAssistantRuntimeConfig,
+  writeClientRuntimeConfig,
+  type ClientRuntimeConfig,
+  type ClientRuntimeConnection,
+} from './control-plane/client-runtime-config.js';
 
 // ── UI-server supervisor primitives (shared by CLI + Electron) ───────────────
 export type {
diff --git a/packages/skeleton/system/stack/core.compose.yml b/packages/skeleton/system/stack/core.compose.yml
index b1a047caa..736d54e03 100644
--- a/packages/skeleton/system/stack/core.compose.yml
+++ b/packages/skeleton/system/stack/core.compose.yml
@@ -76,6 +76,13 @@ services:
       # non-default topologies (e.g. a reverse proxy in front of the stack).
       OP_ASSISTANT_PORT: ${OP_ASSISTANT_PORT:-3800}
       OP_CLIENT_DEFAULT_ASSISTANT_URL: ${OP_CLIENT_DEFAULT_ASSISTANT_URL:-}
+      # Browser clients are separate origins from OpenCode. These host-side
+      # ports are passed only so the entrypoint can add exact CORS origins when
+      # launching OpenCode; OP_CLIENT_PORT inside the container remains the
+      # static client's in-container listen port default (3000).
+      OP_CLIENT_HOST_PORT: ${OP_CLIENT_PORT:-3810}
+      OP_HOST_CLIENT_PORT: ${OP_HOST_CLIENT_PORT:-3890}
+      OP_CLIENT_CORS_ALLOWED_ORIGINS: ${OP_CLIENT_CORS_ALLOWED_ORIGINS:-}
       # Provider credentials live in OpenCode's auth.json (bind-mounted
       # below) — NOT in this env block. The Connections tab and the setup
       # wizard both call OpenCode's PUT /auth/{providerID}; ai-sdk picks
diff --git a/packages/skeleton/system/stack/portals.compose.yml b/packages/skeleton/system/stack/portals.compose.yml
index b75d99773..c707675ad 100644
--- a/packages/skeleton/system/stack/portals.compose.yml
+++ b/packages/skeleton/system/stack/portals.compose.yml
@@ -112,6 +112,7 @@ services:
       GUARDIAN_MODERATION_THRESHOLD: ${GUARDIAN_MODERATION_THRESHOLD:-3}
       GUARDIAN_AUDIT_PATH: /opt/openpalm/logs/guardian-audit.log
       GUARDIAN_DIRECT_INGRESS: ${GUARDIAN_DIRECT_INGRESS:-false}
+      GUARDIAN_CORS_ALLOWED_ORIGINS: ${GUARDIAN_CORS_ALLOWED_ORIGINS:-}
       GUARDIAN_MCP: ${GUARDIAN_MCP:-false}
       GUARDIAN_ADMIN_TOKEN_FILE: /run/secrets/op_guardian_admin_token
       GUARDIAN_MCP_TOKEN_FILE: /run/secrets/op_guardian_mcp_token
diff --git a/packages/ui/src/app.d.ts b/packages/ui/src/app.d.ts
index ff5bd33d2..1112dfd73 100644
--- a/packages/ui/src/app.d.ts
+++ b/packages/ui/src/app.d.ts
@@ -26,6 +26,7 @@ declare global {
       notify?: (title: string, body: string) => void;
       restart?: () => Promise<void>;
       restartUiServer?: () => Promise<boolean>;
+      openLocalApp?: () => Promise<void>;
       launchOnLoginStatus?: () => Promise<{
         supported: boolean;
         enabled: boolean;
diff --git a/packages/ui/src/hooks.server.ts b/packages/ui/src/hooks.server.ts
index 7499d57eb..eea040363 100644
--- a/packages/ui/src/hooks.server.ts
+++ b/packages/ui/src/hooks.server.ts
@@ -106,9 +106,10 @@ function isLocalhostAddress(ip: string): boolean {
 }
 
 export const handle: Handle = async ({ event, resolve }) => {
+  const runtimeContext = computeServerRuntimeContext(event);
   const hostError = checkHostHeader(event.request);
   if (hostError) return hostError;
-  const originError = checkOriginHeader(event.request);
+  const originError = checkOriginHeader(event.request, runtimeContext.security.csrfMode);
   if (originError) return originError;
 
   const path = event.url.pathname;
@@ -122,7 +123,7 @@ export const handle: Handle = async ({ event, resolve }) => {
   // requests fall through to the router's 404 (plan §6.4 "No /admin alias").
   if (
     (path === '/host' || path.startsWith('/host/')) &&
-    !computeServerRuntimeContext(event).serverCapabilities.includes('host:stack:read')
+    !runtimeContext.serverCapabilities.includes('host:stack:read')
   ) {
     redirect(302, '/chat');
   }
diff --git a/packages/ui/src/lib/local-client-app.ts b/packages/ui/src/lib/local-client-app.ts
new file mode 100644
index 000000000..e8ce2be13
--- /dev/null
+++ b/packages/ui/src/lib/local-client-app.ts
@@ -0,0 +1,18 @@
+type OpenPalmBridge = {
+  openLocalApp?: () => Promise<void>;
+};
+
+type BrowserOpener = (url?: string | URL, target?: string, features?: string) => Window | null;
+
+export function openLocalClientApp(
+  localClientAppUrl: string,
+  bridge: OpenPalmBridge | undefined,
+  opener: BrowserOpener,
+): 'bridge' | 'window' {
+  if (typeof bridge?.openLocalApp === 'function') {
+    void bridge.openLocalApp();
+    return 'bridge';
+  }
+  opener(localClientAppUrl, '_blank', 'noopener');
+  return 'window';
+}
diff --git a/packages/ui/src/lib/local-client-app.vitest.ts b/packages/ui/src/lib/local-client-app.vitest.ts
new file mode 100644
index 000000000..21673a55e
--- /dev/null
+++ b/packages/ui/src/lib/local-client-app.vitest.ts
@@ -0,0 +1,24 @@
+import { describe, expect, test, vi } from 'vitest';
+import { openLocalClientApp } from './local-client-app.js';
+
+describe('openLocalClientApp', () => {
+  test('uses the Electron bridge when available', () => {
+    const openLocalApp = vi.fn().mockResolvedValue(undefined);
+    const opener = vi.fn();
+
+    const result = openLocalClientApp('http://127.0.0.1:3890/chat', { openLocalApp }, opener);
+
+    expect(result).toBe('bridge');
+    expect(openLocalApp).toHaveBeenCalledTimes(1);
+    expect(opener).not.toHaveBeenCalled();
+  });
+
+  test('falls back to opening the stable localhost client URL in a new tab', () => {
+    const opener = vi.fn();
+
+    const result = openLocalClientApp('http://127.0.0.1:3890/chat', undefined, opener);
+
+    expect(result).toBe('window');
+    expect(opener).toHaveBeenCalledWith('http://127.0.0.1:3890/chat', '_blank', 'noopener');
+  });
+});
diff --git a/packages/ui/src/lib/server/helpers.ts b/packages/ui/src/lib/server/helpers.ts
index 7dccfdd95..4304e9642 100644
--- a/packages/ui/src/lib/server/helpers.ts
+++ b/packages/ui/src/lib/server/helpers.ts
@@ -7,7 +7,7 @@ import { getActiveEndpoint } from "./endpoints.js";
 import { createOpenCodeClient, isRemoteSetupAllowed } from "@openpalm/lib";
 import { validateSession, getUiLoginPassword } from "./session-store.js";
 import { computeServerRuntimeContext } from "./features.js";
-import type { Capability } from "$lib/types.js";
+import type { Capability, ServerRuntimeContext } from "$lib/types.js";
 
 /**
  * Lazy OpenCode client bound to the currently active endpoint. The client is
@@ -206,7 +206,8 @@ export async function withAdminBody(
   handler: (ctx: { requestId: string; body: Record<string, unknown> }) => Promise<Response>
 ): Promise<Response> {
   const requestId = getRequestId(event);
-  const originError = checkOriginHeader(event.request);
+  const { security } = computeServerRuntimeContext(event);
+  const originError = checkOriginHeader(event.request, security.csrfMode);
   if (originError) return originError;
   const authError = requireAdmin(event, requestId);
   if (authError) return authError;
@@ -230,17 +231,30 @@ export async function withAdminBody(
  * differs from the server's port when reached through an SSH tunnel
  * (`ssh -L 5880:localhost:3880` → Host: localhost:5880).
  */
-function isLoopbackHost(hostHeader: string): boolean {
+type CsrfMode = ServerRuntimeContext['security']['csrfMode'];
+
+function hostNameFromHeader(hostHeader: string): string | null {
   const normalized = hostHeader.trim().replace(/\.$/, "");
-  let hostname: string;
   try {
-    hostname = new URL(`http://${normalized}`).hostname.toLowerCase().replace(/^\[|\]$/g, "");
+    return new URL(`http://${normalized}`).hostname.toLowerCase().replace(/^\[|\]$/g, "");
   } catch {
-    return false;
+    return null;
   }
+}
+
+function isLoopbackHost(hostHeader: string): boolean {
+  const hostname = hostNameFromHeader(hostHeader);
+  if (!hostname) return false;
   return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "::1";
 }
 
+function isSameSite(request: Request, origin: URL): boolean {
+  const host = request.headers.get("host") ?? "";
+  const requestHost = hostNameFromHeader(host);
+  if (!requestHost) return false;
+  return requestHost === origin.hostname.toLowerCase();
+}
+
 export function checkHostHeader(request: Request): Response | null {
   const host = request.headers.get("host") ?? "";
   // Allow any loopback host (any port, e.g. via SSH tunnel), or any host when
@@ -265,7 +279,7 @@ export function checkHostHeader(request: Request): Response | null {
  * @param request  Incoming Request
  * @returns        A 403 Response if the origin is rejected; null if allowed
  */
-export function checkOriginHeader(request: Request): Response | null {
+export function checkOriginHeader(request: Request, csrfMode: CsrfMode = 'loopback-origin'): Response | null {
   const method = request.method.toUpperCase();
   if (method === "GET" || method === "HEAD" || method === "OPTIONS") return null;
 
@@ -274,11 +288,25 @@ export function checkOriginHeader(request: Request): Response | null {
 
   try {
     const u = new URL(origin);
-    // Loopback origin on any port (e.g. via SSH tunnel) is always allowed.
-    if (isLoopbackHost(u.host)) return null;
-    // With remote access opted in, accept same-origin requests — the Origin's
-    // host matches the Host the request was served on (standard CSRF defense).
-    if (isRemoteSetupAllowed() && u.host === (request.headers.get("host") ?? "").trim()) return null;
+    switch (csrfMode) {
+      case 'loopback-origin': {
+        // Loopback origin on any port (e.g. via SSH tunnel) is always allowed.
+        if (isLoopbackHost(u.host)) return null;
+        // With remote access opted in, accept same-origin requests — the Origin's
+        // host matches the Host the request was served on (standard CSRF defense).
+        if (isRemoteSetupAllowed() && u.host === (request.headers.get("host") ?? "").trim()) return null;
+        break;
+      }
+      case 'same-site':
+        if (isSameSite(request, u)) return null;
+        break;
+      case 'bearer-token':
+        // In bearer-mode, allow requests carrying explicit auth headers
+        // in addition to same-site traffic.
+        if (request.headers.get('authorization')) return null;
+        if (isSameSite(request, u)) return null;
+        break;
+    }
   } catch {
     // Unparseable Origin is treated as hostile
   }
diff --git a/packages/ui/src/lib/server/host-origin-checks.vitest.ts b/packages/ui/src/lib/server/host-origin-checks.vitest.ts
index 2f866375b..1f7b16646 100644
--- a/packages/ui/src/lib/server/host-origin-checks.vitest.ts
+++ b/packages/ui/src/lib/server/host-origin-checks.vitest.ts
@@ -1,9 +1,10 @@
 import { describe, it, expect, afterEach } from 'vitest';
 import { checkHostHeader, checkOriginHeader, UI_PORT } from './helpers.js';
 
-function req(host: string, init: { origin?: string; method?: string } = {}): Request {
+function req(host: string, init: { origin?: string; method?: string; authorization?: string } = {}): Request {
   const headers: Record<string, string> = { host };
   if (init.origin) headers.origin = init.origin;
+  if (init.authorization) headers.authorization = init.authorization;
   return new Request('http://internal/admin/x', { method: init.method ?? 'GET', headers });
 }
 
@@ -38,23 +39,52 @@ describe('checkOriginHeader', () => {
     expect(checkOriginHeader(req('192.168.1.10:3880', { method: 'GET' }))).toBeNull();
   });
 
-  it('allows loopback origin on any port (tunnel)', () => {
+  it('loopback-origin mode allows loopback origin on any port (tunnel)', () => {
     expect(
-      checkOriginHeader(req('localhost:5880', { method: 'POST', origin: 'http://localhost:5880' })),
+      checkOriginHeader(req('localhost:5880', { method: 'POST', origin: 'http://localhost:5880' }), 'loopback-origin'),
     ).toBeNull();
   });
 
-  it('rejects a non-loopback POST origin by default', () => {
+  it('loopback-origin mode rejects non-loopback POST origin by default', () => {
     const res = checkOriginHeader(
       req('192.168.1.10:3880', { method: 'POST', origin: 'http://192.168.1.10:3880' }),
+      'loopback-origin',
     );
     expect(res?.status).toBe(403);
   });
 
-  it('allows same-origin POST when OP_ALLOW_REMOTE_SETUP is set', () => {
+  it('same-site mode allows matching host for non-loopback origin', () => {
+    expect(
+      checkOriginHeader(
+        req('192.168.1.10:3880', { method: 'POST', origin: 'http://192.168.1.10:3880' }),
+        'same-site',
+      ),
+    ).toBeNull();
+  });
+
+  it('same-site mode rejects mismatched host origin', () => {
+    const res = checkOriginHeader(
+      req('192.168.1.10:3880', { method: 'POST', origin: 'http://evil.example:3880' }),
+      'same-site',
+    );
+    expect(res?.status).toBe(403);
+  });
+
+  it('allows same-origin POST when OP_ALLOW_REMOTE_SETUP is set (loopback-origin mode)', () => {
     process.env.OP_ALLOW_REMOTE_SETUP = '1';
     expect(
-      checkOriginHeader(req('192.168.1.10:3880', { method: 'POST', origin: 'http://192.168.1.10:3880' })),
+      checkOriginHeader(req('192.168.1.10:3880', { method: 'POST', origin: 'http://192.168.1.10:3880' }),
+        'loopback-origin',
+      ),
     ).toBeNull();
   });
+
+  it('bearer-token mode allows Authorization-bearing requests across sites', () => {
+    const request = req('192.168.1.10:3880', {
+      method: 'POST',
+      origin: 'http://evil.example:3880',
+      authorization: 'Bearer test-token',
+    });
+    expect(checkOriginHeader(request, 'bearer-token')).toBeNull();
+  });
 });
diff --git a/packages/ui/src/routes/host/+page.server.ts b/packages/ui/src/routes/host/+page.server.ts
new file mode 100644
index 000000000..b02780922
--- /dev/null
+++ b/packages/ui/src/routes/host/+page.server.ts
@@ -0,0 +1,8 @@
+import type { PageServerLoad } from './$types';
+import { resolveClientAppUrl } from '@openpalm/lib';
+
+export const load: PageServerLoad = async () => {
+  return {
+    localClientAppUrl: resolveClientAppUrl(),
+  };
+};
diff --git a/packages/ui/src/routes/host/+page.svelte b/packages/ui/src/routes/host/+page.svelte
index 3a950473e..bcbf3177d 100644
--- a/packages/ui/src/routes/host/+page.svelte
+++ b/packages/ui/src/routes/host/+page.svelte
@@ -20,6 +20,7 @@
   import AkmTab from '$lib/components/akm/AkmTab.svelte';
   import HostSharingSection from '$lib/components/akm/HostSharingSection.svelte';
   import VoiceTab from '$lib/components/voice/VoiceTab.svelte';
+  import { openLocalClientApp } from '$lib/local-client-app.js';
 
   import {
     fetchHealth,
@@ -30,6 +31,12 @@
   } from '$lib/api.js';
   import type { ContainerListResponse, AutomationsResponse, ServiceEntry } from '$lib/types.js';
 
+  interface Props {
+    data: import('./$types').PageData;
+  }
+
+  let { data }: Props = $props();
+
   // Auth is enforced server-side in hooks.server.ts; this page only renders for
   // an authenticated admin. A session that expires mid-operation surfaces as a
   // 401 on an in-page API call, handled by redirecting to /login.
@@ -263,6 +270,10 @@
     applyInvalidTokenState();
   }
 
+  function openLocalApp(): void {
+    openLocalClientApp(data.localClientAppUrl, window.openpalm, window.open);
+  }
+
   // ── Mount ────────────────────────────────────────────────────────────────────
 
   onMount(() => {
@@ -289,7 +300,14 @@
 
 <TabBar active={activeTab} onSelect={handleTabSelect} />
 
-<main>
+  <main>
+    <section class="app-install-banner" aria-label="Open localhost app">
+      <div>
+        <h2>Open the localhost app</h2>
+        <p>Install or open the loopback-only OpenPalm app from its stable localhost origin.</p>
+      </div>
+      <button type="button" class="btn btn-primary" onclick={openLocalApp}>Install OpenPalm app</button>
+    </section>
     {#if activeTab === 'overview'}
       <OverviewTab
         {healthLoading}
@@ -365,9 +383,36 @@
     min-height: calc(100vh - 52px - 36px);
   }
 
+  .app-install-banner {
+    display: flex;
+    align-items: center;
+    justify-content: space-between;
+    gap: var(--s-sp-4);
+    padding: var(--s-sp-4);
+    margin-bottom: var(--s-sp-5);
+    border: var(--s-hair) solid var(--s-line);
+    border-radius: 2px;
+    background: var(--s-paper-deep);
+  }
+
+  .app-install-banner h2,
+  .app-install-banner p {
+    margin: 0;
+  }
+
+  .app-install-banner p {
+    color: var(--s-ink-3);
+    margin-top: var(--s-sp-1);
+  }
+
   @media (max-width: 768px) {
     main {
       padding: var(--s-sp-4) var(--s-sp-4) var(--s-sp-6);
     }
+
+    .app-install-banner {
+      align-items: stretch;
+      flex-direction: column;
+    }
   }
 </style>
diff --git a/scripts/set-version.mjs b/scripts/set-version.mjs
index 47d537dbf..29c210a6e 100644
--- a/scripts/set-version.mjs
+++ b/scripts/set-version.mjs
@@ -3,10 +3,11 @@
 //
 // Sets `version` and keeps any internal `@openpalm/lib` *floor range* dependency
 // (e.g. ">=X <N.0.0") in lockstep so the floor never goes stale (CI enforces
-// this; the test suite covers it). Also stamps any `@openpalm/skeleton` range
-// dependency (e.g. ">=X.Y.0 <N.0.0") to an exact pin matching the new version
-// so the CLI and skeleton are always shipped in lockstep. `workspace:*` and
-// exact/non-range refs for other packages are left untouched. Used by
+// this; the test suite covers it). Also stamps any `@openpalm/skeleton`
+// dependency except `workspace:*` to an exact pin matching the new version so
+// the CLI and skeleton are always shipped in lockstep. Exact refs are rewritten
+// too because the published CLI intentionally carries an exact skeleton pin.
+// Exact/non-range refs for other packages are left untouched. Used by
 // scripts/bump-platform.sh and the release workflows so there is exactly one
 // place that understands how a version is written.
 //
@@ -31,10 +32,10 @@ export function setVersion(file, version) {
     if (typeof libDep === 'string' && libDep.startsWith('>=')) {
       pkg[field]['@openpalm/lib'] = `>=${version} <${major + 1}.0.0`;
     }
-    // Stamp @openpalm/skeleton range to an exact pin matching this version so
-    // the CLI and skeleton are always published and consumed in lockstep.
+    // Stamp @openpalm/skeleton to an exact pin matching this version so the
+    // CLI and skeleton are always published and consumed in lockstep.
     const skeletonDep = pkg[field]?.['@openpalm/skeleton'];
-    if (typeof skeletonDep === 'string' && skeletonDep.startsWith('>=')) {
+    if (typeof skeletonDep === 'string' && skeletonDep !== 'workspace:*') {
       pkg[field]['@openpalm/skeleton'] = version;
     }
   }
diff --git a/scripts/set-version.test.ts b/scripts/set-version.test.ts
index 316780e17..982177295 100644
--- a/scripts/set-version.test.ts
+++ b/scripts/set-version.test.ts
@@ -79,6 +79,26 @@ describe("set-version", () => {
     expect(read(f).dependencies["@openpalm/lib"]).toBe(">=2.3.4 <3.0.0");
   });
 
+  it("rewrites an exact @openpalm/skeleton pin in lockstep", () => {
+    const f = write({
+      name: "x",
+      version: "0.10.0",
+      dependencies: { "@openpalm/skeleton": "0.10.0" },
+    });
+    setVersion(f, "0.11.0");
+    expect(read(f).dependencies["@openpalm/skeleton"]).toBe("0.11.0");
+  });
+
+  it("leaves workspace @openpalm/skeleton refs untouched", () => {
+    const f = write({
+      name: "x",
+      version: "0.10.0",
+      dependencies: { "@openpalm/skeleton": "workspace:*" },
+    });
+    setVersion(f, "0.11.0");
+    expect(read(f).dependencies["@openpalm/skeleton"]).toBe("workspace:*");
+  });
+
   it("SEMVER_RE matches stable + prerelease, rejects junk", () => {
     expect(SEMVER_RE.test("0.11.0")).toBe(true);
     expect(SEMVER_RE.test("0.11.0-rc.17")).toBe(true);

From 3bd0a372a1405b9fc2d0a8a4ed2789281217b492 Mon Sep 17 00:00:00 2001
From: itlackey <itlackey@gmail.com>
Date: Tue, 7 Jul 2026 11:50:00 -0500
Subject: [PATCH 48/61] fix(ci): isolate admin tests and allow client bootstrap

---
 packages/cli/src/commands/admin.test.ts   | 18 ++++++++++++++++--
 scripts/validate-thin-harness-boundary.sh |  8 ++++++++
 2 files changed, 24 insertions(+), 2 deletions(-)

diff --git a/packages/cli/src/commands/admin.test.ts b/packages/cli/src/commands/admin.test.ts
index 185cb8f3f..1b0afb1fc 100644
--- a/packages/cli/src/commands/admin.test.ts
+++ b/packages/cli/src/commands/admin.test.ts
@@ -33,7 +33,8 @@
 import { afterEach, describe, expect, it } from 'bun:test';
 import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
-import { join } from 'node:path';
+import { dirname, join, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
 import { renderUsage, runCommand, type CommandDef } from 'citty';
 import { isRemoteSetupAllowed } from '@openpalm/lib';
 import { mainCommand } from '../main.ts';
@@ -43,6 +44,7 @@ import { startUIServer, type UIServerOptions } from '../lib/ui-server.ts';
 // module") instead of at typecheck time — src/commands/admin.ts does not
 // exist until the implementation lands.
 const adminModuleUrl = new URL('./admin.ts', import.meta.url).href;
+const repoRoot = resolve(dirname(fileURLToPath(import.meta.url)), '../../../..');
 
 const ESC = String.fromCharCode(27);
 /** Strip ANSI color codes from citty usage output. */
@@ -66,7 +68,13 @@ const SAVED_ENV_KEYS = [
   'OP_ENABLE_ADMIN',
   'OP_UI_HOST_MODE',
   'OP_ALLOW_REMOTE_SETUP',
-  'OP_HOST_UI_PORT'
+  'OP_HOST_UI_PORT',
+  'OPENPALM_REPO_ROOT',
+  'OPENPALM_SKELETON_DIR',
+  'OP_CLIENT_PORT',
+  'OP_HOST_CLIENT_PORT',
+  'OP_CLIENT_DEFAULT_ASSISTANT_URL',
+  'OP_ASSISTANT_PORT'
 ] as const;
 const savedEnv: Record<string, string | undefined> = {};
 for (const key of SAVED_ENV_KEYS) savedEnv[key] = process.env[key];
@@ -151,6 +159,12 @@ function seedServeHome(opts: { installed: boolean }): string {
   delete process.env.OP_UI_HOST_MODE;
   delete process.env.OP_ALLOW_REMOTE_SETUP;
   delete process.env.OP_HOST_UI_PORT;
+  delete process.env.OPENPALM_SKELETON_DIR;
+  delete process.env.OP_CLIENT_PORT;
+  delete process.env.OP_HOST_CLIENT_PORT;
+  delete process.env.OP_CLIENT_DEFAULT_ASSISTANT_URL;
+  delete process.env.OP_ASSISTANT_PORT;
+  process.env.OPENPALM_REPO_ROOT = repoRoot;
   globalThis.fetch = (async (input: string | URL | Request) => {
     const url = String(input instanceof Request ? input.url : input);
     if (url.endsWith('/health')) return new Response('ok', { status: 200 });
diff --git a/scripts/validate-thin-harness-boundary.sh b/scripts/validate-thin-harness-boundary.sh
index e753f888f..cb0e9989b 100755
--- a/scripts/validate-thin-harness-boundary.sh
+++ b/scripts/validate-thin-harness-boundary.sh
@@ -81,6 +81,14 @@ ALLOWED_IMPORTS=(
   waitForReady
   restoreUiBackup
   UiSupervisor
+  # Client static-app bootstrap (P5c): resolve the already-seeded client build,
+  # write the browser runtime config, and compute the stable localhost client
+  # origin/port. These support the Electron-spawned client child only; they do
+  # not run install/update/uninstall lifecycle operations.
+  resolveClientBuildDir
+  resolveClientAppPort
+  resolveClientAppUrl
+  writeClientRuntimeConfig
   # Pure version-compare helpers (update-check.ts's notify-only GitHub update
   # poll): no state mutation, no migration — just string comparison.
   normalizeVersion

From 76b1d6fda9b4409c42645b6986ec3494402d9aa9 Mon Sep 17 00:00:00 2001
From: itlackey <itlackey@gmail.com>
Date: Tue, 7 Jul 2026 11:55:21 -0500
Subject: [PATCH 49/61] fix(ci): prevent lib mock leakage in admin tests

---
 packages/cli/src/commands/admin.test.ts | 45 +++++++++++++++++++------
 1 file changed, 34 insertions(+), 11 deletions(-)

diff --git a/packages/cli/src/commands/admin.test.ts b/packages/cli/src/commands/admin.test.ts
index 1b0afb1fc..f1b75dc95 100644
--- a/packages/cli/src/commands/admin.test.ts
+++ b/packages/cli/src/commands/admin.test.ts
@@ -20,30 +20,33 @@
  *  - On a machine with no install it still serves — the UI's existing setup
  *    guard lands on /setup; the CLI does NOT reimplement wizard logic.
  *
- * Harness: no module mocks. Real @openpalm/lib + cli-state against a seeded
- * temp OP_HOME; global fetch answers /health (ready) and fails registry
- * fetches (checkAndUpdate* degrade non-fatally by design); Bun.spawn is
- * captured so no real process is launched. The serve promise intentionally
- * never resolves (foreground supervisor) — tests poll the spawn capture.
+ * Harness: real @openpalm/lib + cli-state against a seeded temp OP_HOME;
+ * global fetch answers /health (ready) and fails registry fetches
+ * (checkAndUpdate* degrade non-fatally by design); Bun.spawn is captured so no
+ * real process is launched. The serve promise intentionally never resolves
+ * (foreground supervisor) — tests poll the spawn capture. The package import is
+ * explicitly restored before dynamic imports because other aggregate CLI tests
+ * use mock.module('@openpalm/lib') and Bun module mocks can leak across files.
  *
  * The two "parity" tests at the bottom are CHARACTERIZATION tests: they pass
  * before the Phase 1.5 change and pin the existing bare-serve spawn env so
  * loopback-always is scoped to admin mode only.
  */
-import { afterEach, describe, expect, it } from 'bun:test';
+import { afterEach, describe, expect, it, mock } from 'bun:test';
 import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { renderUsage, runCommand, type CommandDef } from 'citty';
-import { isRemoteSetupAllowed } from '@openpalm/lib';
-import { mainCommand } from '../main.ts';
-import { startUIServer, type UIServerOptions } from '../lib/ui-server.ts';
+import * as realLib from '../../../lib/src/index.ts';
+import type { UIServerOptions } from '../lib/ui-server.ts';
 
 // Resolved as a plain string so the red state fails at runtime ("Cannot find
 // module") instead of at typecheck time — src/commands/admin.ts does not
 // exist until the implementation lands.
 const adminModuleUrl = new URL('./admin.ts', import.meta.url).href;
+const mainModuleUrl = new URL('../main.ts', import.meta.url).href;
+const uiServerModuleUrl = new URL('../lib/ui-server.ts', import.meta.url).href;
 const repoRoot = resolve(dirname(fileURLToPath(import.meta.url)), '../../../..');
 
 const ESC = String.fromCharCode(27);
@@ -81,6 +84,8 @@ for (const key of SAVED_ENV_KEYS) savedEnv[key] = process.env[key];
 const tmpDirs: string[] = [];
 
 afterEach(() => {
+  mock.restore();
+  mock.module('@openpalm/lib', () => ({ ...realLib }));
   Bun.spawn = originalBunSpawn;
   globalThis.fetch = originalFetch;
   console.log = originalLog;
@@ -92,6 +97,11 @@ afterEach(() => {
   for (const dir of tmpDirs.splice(0)) rmSync(dir, { recursive: true, force: true });
 });
 
+function restoreOpenPalmLib(): void {
+  mock.restore();
+  mock.module('@openpalm/lib', () => ({ ...realLib }));
+}
+
 /** Capture every Bun.spawn call; no real process is ever launched. */
 function captureSpawns(): CapturedSpawn[] {
   const calls: CapturedSpawn[] = [];
@@ -212,8 +222,9 @@ function browserSpawn(calls: CapturedSpawn[], port: number): CapturedSpawn | und
  * until SIGINT/SIGTERM, so the returned promise never resolves on success.
  */
 async function runAdmin(rawArgs: string[]): Promise<{ error?: unknown }> {
+  restoreOpenPalmLib();
   const state: { error?: unknown } = {};
-  const mod = (await import(adminModuleUrl)) as { default: CommandDef };
+  const mod = (await import(`${adminModuleUrl}?t=${Math.random()}`)) as { default: CommandDef };
   void runCommand(mod.default, { rawArgs }).catch((e: unknown) => {
     state.error = e ?? new Error('admin command rejected');
   });
@@ -224,6 +235,8 @@ async function runAdmin(rawArgs: string[]): Promise<{ error?: unknown }> {
 
 describe('admin subcommand registration (#556)', () => {
   it('registers `admin` in the main subCommands map', async () => {
+    restoreOpenPalmLib();
+    const { mainCommand } = await import(`${mainModuleUrl}?t=${Math.random()}`) as { mainCommand: CommandDef };
     const sub = (mainCommand.subCommands as Record<string, () => Promise<unknown>>).admin;
     expect(typeof sub).toBe('function');
     const cmd = (await sub()) as { meta?: { name?: string; description?: string } };
@@ -233,6 +246,8 @@ describe('admin subcommand registration (#556)', () => {
   });
 
   it('lists `admin` in the CLI help output', async () => {
+    restoreOpenPalmLib();
+    const { mainCommand } = await import(`${mainModuleUrl}?t=${Math.random()}`) as { mainCommand: CommandDef };
     const usage = stripAnsi(await renderUsage(mainCommand));
     // The COMMANDS table renders each entry as "  <name>  <description>".
     expect(usage).toMatch(/^\s*admin\b/m);
@@ -309,7 +324,7 @@ describe('openpalm admin serve mode (#556)', () => {
       // The flag itself must be neutralized in the child env: the `openpalm ui`
       // respawn and the UI server's own OP_ALLOW_REMOTE_SETUP relaxations
       // (Host/Origin allowlist, setup gate) must not see it enabled.
-      expect(isRemoteSetupAllowed(child.env ?? {})).toBe(false);
+      expect(realLib.isRemoteSetupAllowed(child.env ?? {})).toBe(false);
 
       // --no-open: URL is printed but no browser opener is spawned.
       await waitFor(
@@ -363,6 +378,10 @@ describe('bare serve path spawn env (characterization — green pre-change)', ()
       captureLogs();
 
       const failure: { error?: unknown } = {};
+      restoreOpenPalmLib();
+      const { startUIServer } = await import(`${uiServerModuleUrl}?t=${Math.random()}`) as {
+        startUIServer: (opts?: UIServerOptions) => Promise<void>;
+      };
       void startUIServer({ port: 4614, open: false } satisfies UIServerOptions).catch(
         (e: unknown) => {
           failure.error = e ?? new Error('startUIServer rejected');
@@ -393,6 +412,10 @@ describe('bare serve path spawn env (characterization — green pre-change)', ()
       captureLogs();
 
       const failure: { error?: unknown } = {};
+      restoreOpenPalmLib();
+      const { startUIServer } = await import(`${uiServerModuleUrl}?t=${Math.random()}`) as {
+        startUIServer: (opts?: UIServerOptions) => Promise<void>;
+      };
       void startUIServer({ port: 4615, open: false } satisfies UIServerOptions).catch(
         (e: unknown) => {
           failure.error = e ?? new Error('startUIServer rejected');

From 4e1d6471e612abc41ecfac8767dc9aaada443b2a Mon Sep 17 00:00:00 2001
From: itlackey <itlackey@gmail.com>
Date: Tue, 7 Jul 2026 12:01:04 -0500
Subject: [PATCH 50/61] fix(ci): reset cli-state in admin tests

---
 packages/cli/src/commands/admin.test.ts | 19 ++++++++++++++++++-
 1 file changed, 18 insertions(+), 1 deletion(-)

diff --git a/packages/cli/src/commands/admin.test.ts b/packages/cli/src/commands/admin.test.ts
index f1b75dc95..058fbc646 100644
--- a/packages/cli/src/commands/admin.test.ts
+++ b/packages/cli/src/commands/admin.test.ts
@@ -47,6 +47,7 @@ import type { UIServerOptions } from '../lib/ui-server.ts';
 const adminModuleUrl = new URL('./admin.ts', import.meta.url).href;
 const mainModuleUrl = new URL('../main.ts', import.meta.url).href;
 const uiServerModuleUrl = new URL('../lib/ui-server.ts', import.meta.url).href;
+const cliStateModuleUrl = new URL('../lib/cli-state.ts', import.meta.url).href;
 const repoRoot = resolve(dirname(fileURLToPath(import.meta.url)), '../../../..');
 
 const ESC = String.fromCharCode(27);
@@ -85,7 +86,7 @@ const tmpDirs: string[] = [];
 
 afterEach(() => {
   mock.restore();
-  mock.module('@openpalm/lib', () => ({ ...realLib }));
+  restoreOpenPalmLib();
   Bun.spawn = originalBunSpawn;
   globalThis.fetch = originalFetch;
   console.log = originalLog;
@@ -100,6 +101,22 @@ afterEach(() => {
 function restoreOpenPalmLib(): void {
   mock.restore();
   mock.module('@openpalm/lib', () => ({ ...realLib }));
+  mock.module(cliStateModuleUrl, () => ({
+    ensureValidState: () => {
+      const state = realLib.createState();
+      if (realLib.classifyLocalInstall(state.stackDir, state.homeDir) === 'not_installed') {
+        throw new Error('OpenPalm is not installed in this OP_HOME yet. Run `openpalm install` first.');
+      }
+      state.artifacts = realLib.resolveRuntimeFiles();
+      return state;
+    },
+    resolveServeState: () => {
+      const state = realLib.createState();
+      if (realLib.classifyLocalInstall(state.stackDir, state.homeDir) === 'not_installed') return state;
+      state.artifacts = realLib.resolveRuntimeFiles();
+      return state;
+    },
+  }));
 }
 
 /** Capture every Bun.spawn call; no real process is ever launched. */

From f9f0158de8ff53e3854b9774a57726a682ee2fca Mon Sep 17 00:00:00 2001
From: itlackey <itlackey@gmail.com>
Date: Tue, 7 Jul 2026 12:05:53 -0500
Subject: [PATCH 51/61] fix(ci): avoid toxic status test lib mock

---
 packages/cli/src/commands/status.test.ts | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/packages/cli/src/commands/status.test.ts b/packages/cli/src/commands/status.test.ts
index a3c296590..304288156 100644
--- a/packages/cli/src/commands/status.test.ts
+++ b/packages/cli/src/commands/status.test.ts
@@ -44,7 +44,7 @@ async function runStatusCommand(): Promise<{ stdout: string; stderr: string }> {
 describe('openpalm status — deriveLaunchStatus snapshot', () => {
   test('prints a valid LaunchStatus JSON when the stack is running', async () => {
     mock.module(libUrl, () => ({
-      createState: () => ({ stackDir: '/fake/config/stack', homeDir: '/fake', configDir: '/fake/config', stashDir: '/fake/knowledge', dataDir: '/fake/data', workspaceDir: '/fake/workspace', services: {}, artifacts: { compose: '' }, artifactMeta: [] }),
+      ...realLib,
       classifyLocalInstall: () => 'installed',
       composePs: async () => ({
         ok: true,
@@ -81,7 +81,7 @@ describe('openpalm status — deriveLaunchStatus snapshot', () => {
 
   test('prints splash route when stack is not installed', async () => {
     mock.module(libUrl, () => ({
-      createState: () => ({ stackDir: '/fake/config/stack', homeDir: '/fake', configDir: '/fake/config', stashDir: '/fake/knowledge', dataDir: '/fake/data', workspaceDir: '/fake/workspace', services: {}, artifacts: { compose: '' }, artifactMeta: [] }),
+      ...realLib,
       classifyLocalInstall: () => 'not_installed',
       composePs: async () => ({ ok: false, stdout: '', stderr: '', exitCode: 1 }),
       buildComposeOptions: () => ({}),
@@ -113,7 +113,7 @@ describe('openpalm status — deriveLaunchStatus snapshot', () => {
 
   test('prints splash with localInstalledButUnhealthy when stack is offline', async () => {
     mock.module(libUrl, () => ({
-      createState: () => ({ stackDir: '/fake/config/stack', homeDir: '/fake', configDir: '/fake/config', stashDir: '/fake/knowledge', dataDir: '/fake/data', workspaceDir: '/fake/workspace', services: {}, artifacts: { compose: '' }, artifactMeta: [] }),
+      ...realLib,
       classifyLocalInstall: () => 'installed',
       composePs: async () => ({ ok: true, stdout: '', stderr: '', exitCode: 0 }),
       buildComposeOptions: () => ({}),

From bcc8d8844e616dbc83ba01fce9dca0083745f594 Mon Sep 17 00:00:00 2001
From: itlackey <itlackey@gmail.com>
Date: Tue, 7 Jul 2026 15:46:38 -0500
Subject: [PATCH 52/61] fix(runtime): cover client artifact upgrade paths

---
 containers/assistant/entrypoint.sh            | 18 +++++++++++++++
 docs/technical/environment-and-mounts.md      |  2 ++
 package.json                                  |  4 ++--
 packages/electron/src/main.ts                 | 15 ++++++++++++
 packages/electron/test/initial-url.test.ts    |  1 +
 packages/electron/test/main.test.ts           |  2 ++
 packages/electron/test/repo-hygiene.test.ts   | 13 +++++++++++
 .../assistant-client-compose.test.ts          |  3 +++
 .../assistant-client-entrypoint.test.ts       | 23 +++++++++++++++++++
 .../skeleton/system/stack/core.compose.yml    |  3 +++
 10 files changed, 82 insertions(+), 2 deletions(-)

diff --git a/containers/assistant/entrypoint.sh b/containers/assistant/entrypoint.sh
index 490cc2b74..59c033ee2 100644
--- a/containers/assistant/entrypoint.sh
+++ b/containers/assistant/entrypoint.sh
@@ -85,6 +85,11 @@ install_runtime_artifacts() {
   local npm_cache_dir="/home/opencode/.cache/openpalm-npm"
   local bun_cache_dir="/home/opencode/.cache/bun/install"
 
+  # Existing assistant-artifacts named volumes shadow Dockerfile-created paths.
+  # Older images only created /opt/openpalm/{ui,skeleton}; create the current
+  # prefixes here so upgrades can install @openpalm/client as the node user.
+  mkdir -p /opt/openpalm/client /opt/openpalm/skeleton
+
   # `grep -v` exits 1 when npm produced only warnings (or nothing), so the
   # pipeline's own exit code can't distinguish "npm failed" from "no output".
   # Capture npm's exit via PIPESTATUS and surface real failures — a silent
@@ -389,12 +394,25 @@ start_opencode() {
   # comma-separated origins for custom reverse-proxy/client deployments.
   local client_host_port="${OP_CLIENT_HOST_PORT:-${OP_CLIENT_PORT:-3810}}"
   local host_client_port="${OP_HOST_CLIENT_PORT:-3890}"
+  local client_bind_address="${OP_CLIENT_BIND_ADDRESS:-${OP_BIND_ADDRESS:-127.0.0.1}}"
+  local assistant_bind_address="${OP_ASSISTANT_BIND_ADDRESS:-${OP_BIND_ADDRESS:-127.0.0.1}}"
   local cors_origins=(
     "http://127.0.0.1:${client_host_port}"
     "http://localhost:${client_host_port}"
     "http://127.0.0.1:${host_client_port}"
     "http://localhost:${host_client_port}"
   )
+  if [ "$client_bind_address" != "127.0.0.1" ] && [ "$client_bind_address" != "localhost" ] \
+     && [ "$assistant_bind_address" != "127.0.0.1" ] && [ "$assistant_bind_address" != "localhost" ]; then
+    if [ "$client_bind_address" = "0.0.0.0" ] || [ "$client_bind_address" = "::" ]; then
+      # With wildcard binds the real browser Origin is the operator-chosen LAN
+      # hostname/IP, which the container cannot know. The assistant itself is
+      # already explicitly LAN-exposed in this mode, so allow browser origins.
+      cors_origins+=("*")
+    else
+      cors_origins+=("http://${client_bind_address}:${client_host_port}")
+    fi
+  fi
   if [ -n "${OP_CLIENT_CORS_ALLOWED_ORIGINS:-}" ]; then
     local old_ifs="$IFS"
     IFS=','
diff --git a/docs/technical/environment-and-mounts.md b/docs/technical/environment-and-mounts.md
index 0a35d2dbf..2d31a818a 100644
--- a/docs/technical/environment-and-mounts.md
+++ b/docs/technical/environment-and-mounts.md
@@ -128,11 +128,13 @@ Key env:
 | `OP_CLIENT_HOST_PORT` | compose-derived from `OP_CLIENT_PORT` | Host-published assistant-container client port used to add OpenCode CORS origins |
 | `OP_HOST_CLIENT_PORT` | `stack.env`/host env (default `3890`) | Host-local client app/PWA port used by `openpalm app` and Electron; also added to OpenCode CORS origins |
 | `OP_CLIENT_CORS_ALLOWED_ORIGINS` | `stack.env` (optional) | Extra comma-separated exact origins passed to OpenCode `--cors` for custom client deployments |
+| `OP_BIND_ADDRESS` / `OP_ASSISTANT_BIND_ADDRESS` / `OP_CLIENT_BIND_ADDRESS` | compose env interpolation | Passed through so the entrypoint can detect explicit LAN exposure and widen OpenCode CORS only for that opt-in path |
 
 Notes:
 
 - The assistant has no Docker socket mount.
 - The assistant reads user secrets via `akm env:user` — there is no `/etc/vault/` container mount.
+- If both the assistant and assistant-container client are explicitly bound off loopback, the entrypoint allows browser client origins for the LAN path. Wildcard host binds (`0.0.0.0`/`::`) cannot reveal the operator's chosen LAN hostname to the container, so the entrypoint adds OpenCode `--cors "*"` only in that already-LAN-exposed mode.
 - The entrypoint starts as root only long enough to normalize permissions and optional SSH setup, then drops privileges.
 
 ### Guardian
diff --git a/package.json b/package.json
index 70f440ab0..fdcdf7b9c 100644
--- a/package.json
+++ b/package.json
@@ -59,8 +59,8 @@
     "dev:build": "./scripts/dev-setup.sh --seed-env && docker compose --project-name openpalm-dev --project-directory . -f .dev/system/stack/core.compose.yml -f .dev/system/stack/services.compose.yml -f .dev/system/stack/portals.compose.yml -f .dev/config/stack/custom.compose.yml -f compose.dev.yml --env-file .dev/knowledge/env/stack.env up --build -d",
     "_dev:stack:note": "Intentional dev shortcut: 4-file compose list mirrors the CLI overlay discovery for the dev layout — MANAGED core/services/portals from .dev/system/stack/, USER custom from .dev/config/stack/. --project-name openpalm-dev is required to avoid colliding with a production stack under ~/.openpalm/.",
     "electron:test": "bun run --cwd packages/electron test",
-    "test": "bun test --cwd packages/client && bun test --no-orphans portals/discord portals/slack packages/portal-sdk packages/cli packages/lib packages/ui-kit packages/electron/admin-tools packages/guardian/ scripts/",
-    "_test:note": "packages/client runs as a separate `bun test --cwd` invocation (first, so the purity gate always executes): bun 1.3.11 silently drops any packages/client path filter whenever packages/cli is also in the same arg list (string-prefix collision in filter handling — verified empirically; order/trailing-slash/explicit-file forms all collide). The client purity test requires `bun run client:build` first — it fails loudly on a missing build.",
+    "test": "bun test --cwd packages/client && bun test --no-orphans portals/discord portals/slack packages/portal-sdk packages/cli/src packages/lib packages/ui-kit packages/electron/admin-tools packages/guardian/ scripts/",
+    "_test:note": "packages/client runs as a separate `bun test --cwd` invocation (first, so the purity gate always executes): Bun path filtering treats packages/cli as a string prefix of packages/client, so the aggregate command targets packages/cli/src to avoid re-running the client suite in the second process. The client purity test requires `bun run client:build` first — it fails loudly on a missing build.",
     "analysis:fta": "npx -y fta-cli . -c .fta.json --json | python3 -c \"import json,sys;d=sorted(json.load(sys.stdin),key=lambda x:x['fta_score'],reverse=True);c={};[c.__setitem__(f['assessment'],c.get(f['assessment'],0)+1) for f in d];s=[f['fta_score'] for f in d];print(f'\\n=== FTA Code Complexity Report ({len(d)} files) ===');print(f'Mean: {sum(s)/len(s):.1f} | Median: {sorted(s)[len(s)//2]:.1f} | Max: {max(s):.1f}');print();[print(f'  {a}: {n}') for a,n in sorted(c.items(),key=lambda x:-x[1])];print(f'\\n=== Top 20 Most Complex Files ===');print(f\\\"{'Score':>7}  {'Cyclo':>5}  {'Lines':>5}  {'Assessment':<20}  File\\\");print('-'*100);[print(f\\\"{f['fta_score']:7.1f}  {f['cyclo']:5d}  {f['line_count']:5d}  {f['assessment']:<20}  {f['file_name']}\\\") for f in d[:20]];ni=[f for f in d if f['fta_score']>60];print(f'\\n=== Needs Improvement ({len(ni)} files) ===');[print(f\\\"  {f['fta_score']:6.1f}  {f['file_name']}\\\") for f in ni]\"",
     "analysis:fta:json": "npx -y fta-cli . -c fta.json --json",
     "check": "bun run ui:check && bun run ui-kit:check && bun run client:check",
diff --git a/packages/electron/src/main.ts b/packages/electron/src/main.ts
index 338f7cd92..3225cf6e6 100644
--- a/packages/electron/src/main.ts
+++ b/packages/electron/src/main.ts
@@ -12,6 +12,7 @@ import {
   seedUiBuild,
   ensureHomeDirs,
   checkAndUpdateUiBuild,
+  checkAndUpdateClientBuild,
   checkAndUpdateSkeleton,
   uiUpdateChannel,
   parseEnvFile,
@@ -640,6 +641,19 @@ function stopUIServer(): void {
 // HARNESS_CONTRACT_VERSION is untouched. Non-fatal when the build is absent:
 // log + skip, and resolveInitialUrl falls back to the host UI chat on 3880.
 
+async function ensureClientAppBuild(): Promise<void> {
+  try {
+    const result = await checkAndUpdateClientBuild(PLATFORM_VERSION, resolveDataDir());
+    if (result.updated) {
+      console.log(`Client app updated to v${result.latestVersion}`);
+    } else if (result.error) {
+      console.log(`Client app update check skipped: ${result.error}`);
+    }
+  } catch (err) {
+    console.log('Client app update check skipped:', err instanceof Error ? err.message : String(err));
+  }
+}
+
 function startClientAppServer(): void {
   try {
     const buildDir = resolveClientBuildDir();
@@ -916,6 +930,7 @@ app.whenReady().then(async () => {
   // Start the @openpalm/client static server child after the UI server (P5c,
   // #555). Non-fatal by design: absent build or spawn failure → log + skip,
   // and resolveInitialUrl lands the window on the host UI chat instead.
+  await ensureClientAppBuild();
   startClientAppServer();
 
   // Spawn the ephemeral local OpenCode (Phase 3). Non-fatal: if the binary
diff --git a/packages/electron/test/initial-url.test.ts b/packages/electron/test/initial-url.test.ts
index db5d30119..787226d21 100644
--- a/packages/electron/test/initial-url.test.ts
+++ b/packages/electron/test/initial-url.test.ts
@@ -127,6 +127,7 @@ vi.mock('@openpalm/lib', () => ({
   seedUiBuild: vi.fn(() => Promise.resolve()),
   ensureHomeDirs: vi.fn(),
   checkAndUpdateUiBuild: vi.fn(() => Promise.resolve({ updated: false, latestVersion: '0.12.0' })),
+  checkAndUpdateClientBuild: vi.fn(() => Promise.resolve({ updated: false, latestVersion: '0.12.0' })),
   checkAndUpdateSkeleton: vi.fn(() => Promise.resolve({ updated: false, latestVersion: '0.12.0' })),
   uiUpdateChannel: vi.fn((v: string) => (v.includes('-') ? 'next' : 'latest')),
   parseEnvFile: vi.fn(() => ({})),
diff --git a/packages/electron/test/main.test.ts b/packages/electron/test/main.test.ts
index ed89d9f8c..35c1b8544 100644
--- a/packages/electron/test/main.test.ts
+++ b/packages/electron/test/main.test.ts
@@ -136,6 +136,8 @@ vi.mock('@openpalm/lib', () => ({
   seedUiBuild: vi.fn(() => Promise.resolve()),
   ensureHomeDirs: vi.fn(),
   checkAndUpdateUiBuild: vi.fn(() => Promise.resolve({ updated: false, latestVersion: '0.11.0' })),
+  checkAndUpdateClientBuild: vi.fn(() => Promise.resolve({ updated: false, latestVersion: '0.11.0' })),
+  checkAndUpdateSkeleton: vi.fn(() => Promise.resolve({ updated: false, latestVersion: '0.11.0' })),
   uiUpdateChannel: vi.fn((v: string) => (v.includes('-') ? 'next' : 'latest')),
   parseEnvFile: vi.fn(() => ({})),
   PLATFORM_VERSION: 'v0.11.0',
diff --git a/packages/electron/test/repo-hygiene.test.ts b/packages/electron/test/repo-hygiene.test.ts
index e022a6cc5..f002af304 100644
--- a/packages/electron/test/repo-hygiene.test.ts
+++ b/packages/electron/test/repo-hygiene.test.ts
@@ -29,3 +29,16 @@ describe('packages/electron/dist is not git-tracked', () => {
     expect(tracked).toBe('');
   });
 });
+
+describe('Electron client app artifact bootstrap', () => {
+  it('updates/seeds the client artifact before probing the resolved build dir', () => {
+    const mainSource = readFileSync(resolve(REPO_ROOT, 'packages/electron/src/main.ts'), 'utf-8');
+    const updateIndex = mainSource.indexOf('await ensureClientAppBuild();');
+    const startIndex = mainSource.indexOf('startClientAppServer();');
+
+    expect(mainSource).toContain('checkAndUpdateClientBuild');
+    expect(mainSource).toContain('const buildDir = resolveClientBuildDir();');
+    expect(updateIndex).toBeGreaterThanOrEqual(0);
+    expect(startIndex).toBeGreaterThan(updateIndex);
+  });
+});
diff --git a/packages/lib/src/control-plane/assistant-client-compose.test.ts b/packages/lib/src/control-plane/assistant-client-compose.test.ts
index 28fea000c..3f760bae8 100644
--- a/packages/lib/src/control-plane/assistant-client-compose.test.ts
+++ b/packages/lib/src/control-plane/assistant-client-compose.test.ts
@@ -86,6 +86,9 @@ describe('P5d compose — stack env plumbing for the exact-pin client artifact',
     expect(environmentHas(assistant, 'OP_CLIENT_HOST_PORT')).toBe(true);
     expect(environmentHas(assistant, 'OP_HOST_CLIENT_PORT')).toBe(true);
     expect(environmentHas(assistant, 'OP_CLIENT_CORS_ALLOWED_ORIGINS')).toBe(true);
+    expect(environmentHas(assistant, 'OP_BIND_ADDRESS')).toBe(true);
+    expect(environmentHas(assistant, 'OP_ASSISTANT_BIND_ADDRESS')).toBe(true);
+    expect(environmentHas(assistant, 'OP_CLIENT_BIND_ADDRESS')).toBe(true);
   });
 
   // CHARACTERIZATION (green today): the client artifact installs under
diff --git a/packages/lib/src/control-plane/assistant-client-entrypoint.test.ts b/packages/lib/src/control-plane/assistant-client-entrypoint.test.ts
index 9db62fb7e..203f75781 100644
--- a/packages/lib/src/control-plane/assistant-client-entrypoint.test.ts
+++ b/packages/lib/src/control-plane/assistant-client-entrypoint.test.ts
@@ -49,6 +49,14 @@ mkdir -p "$WORK/bin"
 cat > "$WORK/bin/npm" <<'STUB'
 #!/usr/bin/env bash
 printf 'npm %s\\n' "$*" >> "$NPM_LOG"
+prev=""
+for arg in "$@"; do
+  if [ "$prev" = "--prefix" ] && [ ! -d "$arg" ]; then
+    echo "npm error missing prefix directory: $arg" >&2
+    exit 13
+  fi
+  prev="$arg"
+done
 if [ -n "\${STUB_NPM_FAIL_PATTERN:-}" ] && [[ "$*" == *"\${STUB_NPM_FAIL_PATTERN}"* ]]; then
   echo "npm error simulated registry failure" >&2
   exit 1
@@ -78,6 +86,7 @@ export PATH="$WORK/bin:$PATH"
 # Strip the top-level boot-sequence invocations (bare function-name lines at
 # column 0); keep unindented bash keywords so syntax cannot break.
 awk '!/^[a-z_][a-z0-9_]*$/ || /^(fi|done|esac|then|else|do)$/' "$ENTRYPOINT" > "$WORK/functions.sh"
+sed -i "s#/opt/openpalm#$WORK/artifacts#g" "$WORK/functions.sh"
 
 # shellcheck disable=SC1091
 source "$WORK/functions.sh"
@@ -162,6 +171,17 @@ describe('P5d install_runtime_artifacts — @openpalm/client version resolution
     expect(result.stderr).toMatch(/@openpalm\/client@9\.9\.9-test install failed/);
   });
 
+  test('creates current artifact prefixes before npm install so old named volumes can upgrade', () => {
+    const result = runInstallScenario({
+      OP_CLIENT_VERSION: '9.9.9-test',
+      OP_SKELETON_VERSION: '2.2.2-test',
+      PLATFORM_VERSION: '1.1.1-platform',
+    });
+    expect(result.exitCode, result.stderr).toBe(0);
+    expect(result.npmLog).toContain('--prefix');
+    expect(result.stderr).not.toContain('missing prefix directory');
+  });
+
   // CHARACTERIZATION (green before AND after P5d): the skeleton pull is
   // untouched by this phase. OP_UI_VERSION is supplied only so the pre-P5d
   // entrypoint gets past its (to-be-removed) UI version gate; after P5d it is
@@ -242,6 +262,9 @@ describe('P5d entrypoint — client co-process (static-only)', () => {
     expect(startOpencode).toContain('OP_CLIENT_CORS_ALLOWED_ORIGINS');
     expect(startOpencode).toContain('http://127.0.0.1:${client_host_port}');
     expect(startOpencode).toContain('http://127.0.0.1:${host_client_port}');
+    expect(startOpencode).toContain('OP_CLIENT_BIND_ADDRESS');
+    expect(startOpencode).toContain('OP_ASSISTANT_BIND_ADDRESS');
+    expect(startOpencode).toContain('cors_origins+=("*")');
     expect(startOpencode).toContain('cmd+=(--cors "$origin")');
   });
 
diff --git a/packages/skeleton/system/stack/core.compose.yml b/packages/skeleton/system/stack/core.compose.yml
index 736d54e03..4f07b34e7 100644
--- a/packages/skeleton/system/stack/core.compose.yml
+++ b/packages/skeleton/system/stack/core.compose.yml
@@ -83,6 +83,9 @@ services:
       OP_CLIENT_HOST_PORT: ${OP_CLIENT_PORT:-3810}
       OP_HOST_CLIENT_PORT: ${OP_HOST_CLIENT_PORT:-3890}
       OP_CLIENT_CORS_ALLOWED_ORIGINS: ${OP_CLIENT_CORS_ALLOWED_ORIGINS:-}
+      OP_BIND_ADDRESS: ${OP_BIND_ADDRESS:-127.0.0.1}
+      OP_ASSISTANT_BIND_ADDRESS: ${OP_ASSISTANT_BIND_ADDRESS:-${OP_BIND_ADDRESS:-127.0.0.1}}
+      OP_CLIENT_BIND_ADDRESS: ${OP_CLIENT_BIND_ADDRESS:-${OP_BIND_ADDRESS:-127.0.0.1}}
       # Provider credentials live in OpenCode's auth.json (bind-mounted
       # below) — NOT in this env block. The Connections tab and the setup
       # wizard both call OpenCode's PUT /auth/{providerID}; ai-sdk picks

From ed02f798a11f1b878c42575ed7e7ad20e263209c Mon Sep 17 00:00:00 2001
From: itlackey <itlackey@gmail.com>
Date: Tue, 7 Jul 2026 15:54:14 -0500
Subject: [PATCH 53/61] fix(ci): allow electron client bootstrap import

---
 scripts/validate-thin-harness-boundary.sh | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/scripts/validate-thin-harness-boundary.sh b/scripts/validate-thin-harness-boundary.sh
index cb0e9989b..e80f01eb4 100755
--- a/scripts/validate-thin-harness-boundary.sh
+++ b/scripts/validate-thin-harness-boundary.sh
@@ -54,7 +54,8 @@ MUTATION_SENTINEL="reconcileStack"
 # The ONLY @openpalm/lib symbols packages/electron/src may import (design §2.1
 # bootstrap allowlist, extended in 0.12.0 with PLATFORM_VERSION + the Docker
 # preflight probes §6.5/§5, in Phase 4 with checkAndUpdateSkeleton for skeleton
-# self-update bootstrap, and covering update-check.ts's pure version-compare
+# self-update bootstrap, in Phase 5 with checkAndUpdateClientBuild for the
+# static client artifact, and covering update-check.ts's pure version-compare
 # helpers now that the scan is repo-wide instead of main.ts-only).
 # waitForReady + restoreUiBackup are the shared UI-supervisor primitives (§6.2/§6.3):
 # waiting on the spawned UI's /health, and rolling back a failed checkAndUpdateUiBuild
@@ -67,6 +68,7 @@ ALLOWED_IMPORTS=(
   seedUiBuild
   ensureHomeDirs
   checkAndUpdateUiBuild
+  checkAndUpdateClientBuild
   checkAndUpdateSkeleton
   uiUpdateChannel
   parseEnvFile

From 052666169b8944b2361ae1853577ee91df7b57a4 Mon Sep 17 00:00:00 2001
From: itlackey <itlackey@gmail.com>
Date: Tue, 7 Jul 2026 23:16:55 -0500
Subject: [PATCH 54/61] fix(runtime): address PR #559 follow-ups

---
 packages/client/bin/serve.mjs                 | 14 +++--
 packages/client/src/lib/transport/index.ts    | 28 +++++++++
 .../src/routes/connections/+page.svelte       |  6 +-
 packages/client/tests/serve.test.ts           |  7 +++
 .../client/tests/transport-request.test.ts    | 15 ++++-
 packages/guardian/src/cors.test.ts            | 60 +++++++++++++++++++
 packages/guardian/src/server.ts               |  1 +
 .../lib/src/control-plane/client-assets.ts    |  2 +-
 8 files changed, 123 insertions(+), 10 deletions(-)

diff --git a/packages/client/bin/serve.mjs b/packages/client/bin/serve.mjs
index 9eab6a4f3..879a2bb3a 100644
--- a/packages/client/bin/serve.mjs
+++ b/packages/client/bin/serve.mjs
@@ -45,11 +45,12 @@ const MIME = {
   '.txt': 'text/plain; charset=utf-8',
 };
 
-function send(res, path, status = 200, extraHeaders = {}) {
+function send(res, path, status = 200, extraHeaders = {}, includeBody = true) {
   res.writeHead(status, {
     'content-type': MIME[extname(path)] ?? 'application/octet-stream',
     ...extraHeaders,
   });
+  if (!includeBody) return res.end();
   createReadStream(path).pipe(res);
 }
 
@@ -58,6 +59,9 @@ function runtimeConfigHeaders() {
 }
 
 const server = createServer((req, res) => {
+  const method = req.method ?? 'GET';
+  const supportsBody = method !== 'HEAD';
+
   let pathname;
   try {
     pathname = decodeURIComponent(new URL(req.url ?? '/', 'http://x').pathname);
@@ -71,9 +75,9 @@ const server = createServer((req, res) => {
   const candidate = join(dir, normalize(join('/', pathname)));
   if (existsSync(candidate) && statSync(candidate).isFile()) {
     if (pathname === '/runtime-config.json') {
-      return send(res, candidate, 200, runtimeConfigHeaders());
+      return send(res, candidate, 200, runtimeConfigHeaders(), supportsBody);
     }
-    return send(res, candidate);
+    return send(res, candidate, 200, {}, supportsBody);
   }
   // runtime-config.json may live beside the build dir instead of inside it
   // (the assistant container writes it next to the extracted bundle, P5d).
@@ -81,7 +85,7 @@ const server = createServer((req, res) => {
     const candidates = [runtimeConfigPath, join(dir, '..', 'runtime-config.json')].filter(Boolean);
     for (const path of candidates) {
       if (existsSync(path) && statSync(path).isFile()) {
-        return send(res, path, 200, runtimeConfigHeaders());
+        return send(res, path, 200, runtimeConfigHeaders(), supportsBody);
       }
     }
     res.writeHead(404, {
@@ -92,7 +96,7 @@ const server = createServer((req, res) => {
   }
   // SPA fallback: every route is client-rendered from index.html.
   const fallback = join(dir, 'index.html');
-  if (existsSync(fallback)) return send(res, fallback);
+  if (existsSync(fallback)) return send(res, fallback, 200, {}, supportsBody);
   res.writeHead(404, { 'content-type': 'text/plain; charset=utf-8' });
   res.end('client build not found — run `bun run client:build`');
 });
diff --git a/packages/client/src/lib/transport/index.ts b/packages/client/src/lib/transport/index.ts
index c6ecd4d80..27682b887 100644
--- a/packages/client/src/lib/transport/index.ts
+++ b/packages/client/src/lib/transport/index.ts
@@ -106,6 +106,30 @@ export function createTransport(options: TransportOptions): Transport {
     return response;
   }
 
+  async function parseSseMessage(response: Response): Promise<unknown> {
+    if (!response.body) return null;
+    let lastPayload: unknown = null;
+    try {
+      for await (const frame of parseSseStream(response.body)) {
+        if (!frame.data) continue;
+        try {
+          const payload = JSON.parse(frame.data) as unknown;
+          lastPayload = payload;
+          if (typeof payload === 'object' && payload !== null && 'parts' in payload) {
+            return payload;
+          }
+        } catch {
+          continue;
+        }
+      }
+    } catch (error) {
+      throw error instanceof Error
+        ? error
+        : Object.assign(new Error(String(error)), { status: 502 });
+    }
+    return lastPayload;
+  }
+
   return {
     /**
      * List sessions on the connection. OpenCode returns `Array<Session>`
@@ -142,6 +166,10 @@ export function createTransport(options: TransportOptions): Transport {
         { parts: [{ type: 'text', text }] },
         AbortSignal.timeout(MESSAGE_TIMEOUT_MS)
       );
+      const contentType = res.headers.get('content-type')?.toLowerCase() ?? '';
+      if (contentType.startsWith('text/event-stream')) {
+        return parseSseMessage(res);
+      }
       return (await res.json()) as unknown;
     },
 
diff --git a/packages/client/src/routes/connections/+page.svelte b/packages/client/src/routes/connections/+page.svelte
index 4665a5eca..c43531486 100644
--- a/packages/client/src/routes/connections/+page.svelte
+++ b/packages/client/src/routes/connections/+page.svelte
@@ -49,16 +49,16 @@
   async function probeAll(entries: ConnectionEntry[]): Promise<void> {
     if (!boot) return;
     const { secrets } = boot;
-    await Promise.all(
+    const updates = await Promise.all(
       entries.map(async (entry) => {
         const transport = createTransport({
           baseUrl: entry.url,
           auth: await secrets.resolveAuth(entry),
         });
-        const result = await transport.probeHealth();
-        health = { ...health, [entry.id]: result };
+        return { id: entry.id, result: await transport.probeHealth() };
       })
     );
+    health = Object.fromEntries(updates.map((u) => [u.id, u.result]));
   }
 
   function healthLabel(id: string): { text: string; tone: 'ok' | 'warn' | 'bad' | 'idle' } {
diff --git a/packages/client/tests/serve.test.ts b/packages/client/tests/serve.test.ts
index 4dd5e7816..c96f11dff 100644
--- a/packages/client/tests/serve.test.ts
+++ b/packages/client/tests/serve.test.ts
@@ -69,6 +69,13 @@ describe('serve.mjs resilience', () => {
     expect(res.headers.get('content-type')).toContain('text/html');
   });
 
+  it('supports HEAD requests with no response body', async () => {
+    const res = await fetch(`${BASE}/`, { method: 'HEAD' });
+    expect(res.status).toBe(200);
+    expect(res.headers.get('content-type')).toContain('text/html');
+    expect(await res.text()).toBe('');
+  });
+
   it('serves runtime-config.json with no-store caching', async () => {
     const res = await fetch(`${BASE}/runtime-config.json`);
     expect(res.status).toBe(200);
diff --git a/packages/client/tests/transport-request.test.ts b/packages/client/tests/transport-request.test.ts
index 69e926d87..b305f8157 100644
--- a/packages/client/tests/transport-request.test.ts
+++ b/packages/client/tests/transport-request.test.ts
@@ -19,7 +19,7 @@
  */
 import { describe, expect, test } from 'bun:test';
 import { loadTransportModule } from './helpers/contract.ts';
-import { jsonResponse, recordingFetch } from './helpers/mocks.ts';
+import { byteStream, jsonResponse, recordingFetch } from './helpers/mocks.ts';
 
 const BASE = 'http://gw.example:8443';
 
@@ -148,6 +148,19 @@ describe('transport request shaping (P5b item 1)', () => {
     expect(calls[0].url).toBe(`${BASE}/session/${encodeURIComponent('ses/../etc')}/message`);
   });
 
+  test('sendMessage parses text/event-stream responses', async () => {
+    const { createTransport } = await loadTransportModule();
+    const { fetch, calls } = recordingFetch((request) =>
+      new Response(byteStream(['event: message\ndata: {"parts":[{"type":"text","text":"via sse"}]}\n\n']), {
+        headers: { 'content-type': 'text/event-stream' },
+      })
+    );
+    const transport = createTransport({ baseUrl: BASE, fetch });
+    const response = await transport.sendMessage('ses_abc', 'hi there');
+    expect(calls[0].headers.get('content-type')).toContain('application/json');
+    expect(response).toEqual({ parts: [{ type: 'text', text: 'via sse' }] });
+  });
+
   test('listSessions maps OpenCode sessions and sorts desc by updatedAt (title fallback "")', async () => {
     // Ported contract from packages/ui listSessions(): OpenCode returns
     // Array<Session> with no ordering guarantee; consumers rely on desc
diff --git a/packages/guardian/src/cors.test.ts b/packages/guardian/src/cors.test.ts
index 5d7d26731..bcf227b24 100644
--- a/packages/guardian/src/cors.test.ts
+++ b/packages/guardian/src/cors.test.ts
@@ -127,6 +127,48 @@ function startMockAssistant(): ReturnType<typeof Bun.serve> {
   });
 }
 
+async function withDirectIngressDisabled<T>(run: (directUrl: string) => Promise<T>): Promise<T> {
+  const disabledInternalPort = await getAvailablePort();
+  const disabledDirectPort = await getAvailablePort();
+  const disabledAdminPort = await getAvailablePort();
+  const disabledProc = Bun.spawn(['bun', 'run', 'src/server.ts'], {
+    cwd: join(import.meta.dir, '..'),
+    env: {
+      ...process.env,
+      PORT: String(disabledInternalPort),
+      GUARDIAN_DIRECT_PORT: String(disabledDirectPort),
+      GUARDIAN_ADMIN_PORT: String(disabledAdminPort),
+      GUARDIAN_DIRECT_INGRESS: 'false',
+      GUARDIAN_CORS_ALLOWED_ORIGINS: ALLOWED_ORIGIN,
+      GUARDIAN_STATE_DB_PATH: join(tmpDir, `state-disabled-${disabledDirectPort}.db`),
+      GUARDIAN_ADMIN_TOKEN_FILE: join(tmpDir, 'admin-token'),
+      GUARDIAN_INTERNAL_HOST: '127.0.0.1',
+      OP_ASSISTANT_URL: `http://127.0.0.1:${assistantPort}`,
+      GUARDIAN_AUDIT_PATH: join(tmpDir, `audit-disabled-${disabledDirectPort}.log`),
+    },
+    stdout: 'pipe',
+    stderr: 'pipe',
+  });
+  const disabledUrl = `http://127.0.0.1:${disabledDirectPort}`;
+  try {
+    for (let i = 0; i < 50; i++) {
+      if (disabledProc.exitCode !== null) {
+        throw new Error(`guardian (direct disabled) exited before ready with code ${disabledProc.exitCode}`);
+      }
+      try {
+        const resp = await fetch(`${disabledUrl}/health`);
+        if (resp.ok) break;
+      } catch {
+        // not ready yet
+      }
+      await Bun.sleep(100);
+    }
+    return await run(disabledUrl);
+  } finally {
+    disabledProc.kill();
+  }
+}
+
 beforeAll(async () => {
   assistantPort = await getAvailablePort();
   internalPort = await getAvailablePort();
@@ -285,4 +327,22 @@ describe('Guardian direct-ingress CORS', () => {
     expect(resp.status).not.toBe(204);
     expect(resp.headers.get('access-control-allow-origin')).toBeNull();
   });
+
+  it('does not answer browser preflight when direct ingress is disabled', async () => {
+    await withDirectIngressDisabled(async (disabledUrl) => {
+      const resp = await fetch(`${disabledUrl}/oc/session`, {
+        method: 'OPTIONS',
+        headers: {
+          origin: ALLOWED_ORIGIN,
+          'access-control-request-method': 'POST',
+          'access-control-request-headers': 'authorization, content-type, x-openpalm-user',
+        },
+      });
+
+      expect(resp.status).toBe(404);
+      expect((await resp.json()).error).toBe('not_found');
+      expect(resp.headers.get('access-control-allow-origin')).toBe(ALLOWED_ORIGIN);
+      expect(resp.headers.get('access-control-allow-credentials')).toBe('true');
+    });
+  });
 });
diff --git a/packages/guardian/src/server.ts b/packages/guardian/src/server.ts
index 92c047119..73145cc07 100644
--- a/packages/guardian/src/server.ts
+++ b/packages/guardian/src/server.ts
@@ -198,6 +198,7 @@ async function handleDirectRequest(req: Request, clientIp = ''): Promise<Respons
     return browserSurface ? applyCorsHeaders(json(404, { error: 'not_found', requestId }), corsOrigin) : json(404, { error: 'not_found', requestId });
   }
   if (browserSurface && isCorsPreflight(req)) return corsPreflightResponse(req, requestId, corsOrigin);
+
   if (url.pathname === '/mcp') {
     if (!MCP_ENABLED) return applyCorsHeaders(json(404, { error: 'not_found', requestId }), corsOrigin);
     const response = await handleMcpRequest(req, requestId);
diff --git a/packages/lib/src/control-plane/client-assets.ts b/packages/lib/src/control-plane/client-assets.ts
index ab5b32ee5..05b4e05ba 100644
--- a/packages/lib/src/control-plane/client-assets.ts
+++ b/packages/lib/src/control-plane/client-assets.ts
@@ -285,6 +285,6 @@ export async function checkAndUpdateClientBuild(
     onBlockedMajor: (latestVersion) => ({ updated: false, latestVersion }),
     onUpToDate: (latestVersion) => ({ updated: false, latestVersion }),
     onSuccess: (latestVersion, backupDir) => ({ updated: true, latestVersion, backupDir }),
-    onError: (error) => ({ updated: false, latestVersion: null, error }),
+    onError: (error, backupDir) => ({ updated: false, latestVersion: null, error, backupDir }),
   });
 }

From 28c294b157bee2bb1226b519f53a5422b47df860 Mon Sep 17 00:00:00 2001
From: itlackey <itlackey@gmail.com>
Date: Tue, 7 Jul 2026 23:20:10 -0500
Subject: [PATCH 55/61] fix(stack): pass skeleton version to assistant

---
 .../lib/src/control-plane/assistant-client-compose.test.ts | 7 +++++++
 packages/skeleton/system/stack/core.compose.yml            | 3 +++
 2 files changed, 10 insertions(+)

diff --git a/packages/lib/src/control-plane/assistant-client-compose.test.ts b/packages/lib/src/control-plane/assistant-client-compose.test.ts
index 3f760bae8..f56e922ff 100644
--- a/packages/lib/src/control-plane/assistant-client-compose.test.ts
+++ b/packages/lib/src/control-plane/assistant-client-compose.test.ts
@@ -82,6 +82,13 @@ describe('P5d compose — stack env plumbing for the exact-pin client artifact',
     expect(environmentHas(assistant, 'OP_CLIENT_VERSION')).toBe(true);
   });
 
+  test('OP_SKELETON_VERSION also passes through to the assistant container', () => {
+    // The assistant entrypoint installs both @openpalm/client and
+    // @openpalm/skeleton. A stack env override must reach the runtime
+    // environment or the container hard-fails before OpenCode starts.
+    expect(environmentHas(assistant, 'OP_SKELETON_VERSION')).toBe(true);
+  });
+
   test('assistant receives host client ports for OpenCode CORS origin defaults', () => {
     expect(environmentHas(assistant, 'OP_CLIENT_HOST_PORT')).toBe(true);
     expect(environmentHas(assistant, 'OP_HOST_CLIENT_PORT')).toBe(true);
diff --git a/packages/skeleton/system/stack/core.compose.yml b/packages/skeleton/system/stack/core.compose.yml
index 4f07b34e7..2ac3a9b53 100644
--- a/packages/skeleton/system/stack/core.compose.yml
+++ b/packages/skeleton/system/stack/core.compose.yml
@@ -69,6 +69,9 @@ services:
       # the container ENVIRONMENT (not just compose interpolation) so a
       # restart with a new pin picks up the new client.
       OP_CLIENT_VERSION: ${OP_CLIENT_VERSION:-}
+      # The assistant entrypoint installs @openpalm/skeleton alongside the
+      # client artifact using the same exact-pin override/fallback chain.
+      OP_SKELETON_VERSION: ${OP_SKELETON_VERSION:-}
       # The entrypoint writes the client's runtime-config.json pointing the
       # BROWSER at the host-published OpenCode URL — that is the assistant
       # port mapping below, NOT the in-container :4096 (unreachable from a

From c3cecf3bdf5ad2588cec96a15ddabe6571152ff7 Mon Sep 17 00:00:00 2001
From: itlackey <itlackey@gmail.com>
Date: Wed, 8 Jul 2026 00:26:32 -0500
Subject: [PATCH 56/61] docs(release): add unit=all rc checklist

---
 compose.dev.yml                               |   9 +-
 docs/README.md                                |   1 +
 docs/operations/manual-compose-runbook.md     | 254 +++++++-
 docs/operations/release-management.md         |   6 +
 docs/operations/unit-all-rc-checklist.md      | 566 ++++++++++++++++++
 docs/technical/testing-stack-in-isolation.md  |   8 +-
 packages/skeleton/system/stack/README.md      |  50 +-
 .../skeleton/system/stack/core.compose.yml    |   7 +-
 8 files changed, 842 insertions(+), 59 deletions(-)
 create mode 100644 docs/operations/unit-all-rc-checklist.md

diff --git a/compose.dev.yml b/compose.dev.yml
index 5aa6839f7..a6a80d767 100644
--- a/compose.dev.yml
+++ b/compose.dev.yml
@@ -5,13 +5,16 @@
 #
 # Manual equivalent (from project root):
 #   docker compose --project-directory . \
-#     -f .openpalm/config/stack/core.compose.yml \
+#     -f .dev/system/stack/core.compose.yml \
+#     -f .dev/system/stack/services.compose.yml \
+#     -f .dev/system/stack/portals.compose.yml \
+#     -f .dev/config/stack/custom.compose.yml \
 #     -f compose.dev.yml \
 #     --env-file .dev/knowledge/env/stack.env \
 #     up --build -d
 #
-# The --project-directory . flag is REQUIRED when the core compose file lives
-# in a different directory (.openpalm/config/stack/ or .dev/config/stack/).
+# The --project-directory . flag is REQUIRED when the managed compose files live
+# in a different directory (.openpalm/system/stack/ or .dev/system/stack/).
 # Without it, Docker Compose resolves build contexts relative to the first -f
 # file's directory, which breaks builds.
 
diff --git a/docs/README.md b/docs/README.md
index ce50ba348..13589e3d7 100644
--- a/docs/README.md
+++ b/docs/README.md
@@ -32,6 +32,7 @@ Repo layout convention:
 | Document | Description |
 |---|---|
 | [release-management.md](operations/release-management.md) | Authoritative release guide: platform release boundaries, image/package versioning, and beta→stable cutover |
+| [unit-all-rc-checklist.md](operations/unit-all-rc-checklist.md) | Coordinated `unit=all` release-candidate worksheet with commands, pass criteria, and evidence capture |
 | [manual-compose-runbook.md](operations/manual-compose-runbook.md) | Step-by-step manual host configuration (no scripts) |
 | [manual-headless-install.md](operations/manual-headless-install.md) | Hand-built install disk contract (tokens, auth.json, setup stamp) + scripted `openpalm install --file` |
 | [diagnostic-playbook.md](operations/diagnostic-playbook.md) | Layer-by-layer debugging workflow for UI, admin API, OpenCode, and container/config issues |
diff --git a/docs/operations/manual-compose-runbook.md b/docs/operations/manual-compose-runbook.md
index 635a480b9..4a38b9fd7 100644
--- a/docs/operations/manual-compose-runbook.md
+++ b/docs/operations/manual-compose-runbook.md
@@ -1,9 +1,9 @@
 # Manual Compose Runbook
 
 This runbook is for operators who want to manage their OpenPalm stack directly
-using `docker compose` without the CLI or admin tooling. The generated
-`$OP_HOME/run.sh` is the operator-facing entrypoint; it reproduces the live
-compose invocation used by the stack.
+using `docker compose` without the CLI or admin tooling. The live compose
+assembly is the managed file set under `$OP_HOME/system/stack/` plus the
+user-owned overlay at `$OP_HOME/config/stack/custom.compose.yml`.
 
 ---
 
@@ -27,9 +27,9 @@ variable). The relevant files for running the stack are:
 
 | Path | Purpose |
 |---|---|
-| `~/.openpalm/config/stack/core.compose.yml` | Core assistant runtime services; assistant also runs the scheduler co-process |
-| `~/.openpalm/config/stack/services.compose.yml` | First-party optional services, profile-gated |
-| `~/.openpalm/config/stack/portals.compose.yml` | First-party optional portals, profile-gated |
+| `~/.openpalm/system/stack/core.compose.yml` | Core assistant runtime services; assistant also runs the scheduler co-process |
+| `~/.openpalm/system/stack/services.compose.yml` | First-party optional services, profile-gated |
+| `~/.openpalm/system/stack/portals.compose.yml` | First-party optional portals, profile-gated |
 | `~/.openpalm/config/stack/custom.compose.yml` | User custom services and overlays |
 | `~/.openpalm/knowledge/env/stack.env` | System-managed non-secret values: ports, UID/GID, image tags, paths, hardware profile selections |
 | `~/.openpalm/knowledge/secrets/` | System-managed secret files; directory mode `0700`, file mode `0600` |
@@ -47,15 +47,14 @@ grep '^OP_ENABLED_ADDONS=' ~/.openpalm/knowledge/env/stack.env
 
 ## Building the Compose Command
 
-Use the generated `run.sh` for the exact live stack command. It already
-includes the correct compose files, non-secret env file, and profile selection.
+Use the same managed/user compose file list for every command. First-party
+addons are enabled with Compose profiles such as `addon.chat`.
 
 ### Helper: `op` shell function
 
 Typing the full command every time is tedious. Add this shell function to your
-`~/.bashrc` or `~/.zshrc` for ad hoc compose operations with core plus custom
-overlays. Use generated `run.sh` when you need the exact first-party addon list
-and profiles selected by OpenPalm tooling:
+`~/.bashrc` or `~/.zshrc` for ad hoc compose operations with the managed stack
+files plus your custom overlay:
 
 ```bash
 op() {
@@ -72,9 +71,9 @@ op() {
   docker compose \
     --project-name "$PROJECT_NAME" \
     --env-file "$OP_HOME/knowledge/env/stack.env" \
-    -f "$OP_HOME/config/stack/core.compose.yml" \
-    -f "$OP_HOME/config/stack/services.compose.yml" \
-    -f "$OP_HOME/config/stack/portals.compose.yml" \
+    -f "$OP_HOME/system/stack/core.compose.yml" \
+    -f "$OP_HOME/system/stack/services.compose.yml" \
+    -f "$OP_HOME/system/stack/portals.compose.yml" \
     -f "$OP_HOME/config/stack/custom.compose.yml" \
     "$@"
 }
@@ -82,9 +81,10 @@ op() {
 
 Pass manual profile flags before the compose subcommand when needed, for example `op --profile addon.chat config`.
 
-The generated `run.sh` remains the primary operator-facing entrypoint for
-starting/restarting the stack. It records the fixed compose file list and the
-profile selection derived from `OP_ENABLED_ADDONS` in one place.
+When bypassing the CLI/admin tooling, pass the active addon profiles yourself.
+`OP_ENABLED_ADDONS` is an OpenPalm state record; Docker Compose only sees it if
+the command also passes matching `--profile addon.<name>` flags or a
+`COMPOSE_PROFILES` value.
 
 ### Manual command (without the helper)
 
@@ -97,9 +97,9 @@ PROJECT_NAME="${OP_PROJECT_NAME:-openpalm}"
 docker compose \
   --project-name "$PROJECT_NAME" \
   --env-file "$OP_HOME/knowledge/env/stack.env" \
-  -f "$OP_HOME/config/stack/core.compose.yml" \
-  -f "$OP_HOME/config/stack/services.compose.yml" \
-  -f "$OP_HOME/config/stack/portals.compose.yml" \
+  -f "$OP_HOME/system/stack/core.compose.yml" \
+  -f "$OP_HOME/system/stack/services.compose.yml" \
+  -f "$OP_HOME/system/stack/portals.compose.yml" \
   -f "$OP_HOME/config/stack/custom.compose.yml" \
   --profile addon.chat \
   <command>
@@ -119,9 +119,9 @@ misconfiguration early — before containers are affected.
 docker compose \
   --project-name "$PROJECT_NAME" \
   --env-file "$OP_HOME/knowledge/env/stack.env" \
-  -f "$OP_HOME/config/stack/core.compose.yml" \
-  -f "$OP_HOME/config/stack/services.compose.yml" \
-  -f "$OP_HOME/config/stack/portals.compose.yml" \
+  -f "$OP_HOME/system/stack/core.compose.yml" \
+  -f "$OP_HOME/system/stack/services.compose.yml" \
+  -f "$OP_HOME/system/stack/portals.compose.yml" \
   -f "$OP_HOME/config/stack/custom.compose.yml" \
   --profile addon.chat \
   config --quiet
@@ -130,9 +130,9 @@ docker compose \
 docker compose \
   --project-name "$PROJECT_NAME" \
   --env-file "$OP_HOME/knowledge/env/stack.env" \
-  -f "$OP_HOME/config/stack/core.compose.yml" \
-  -f "$OP_HOME/config/stack/services.compose.yml" \
-  -f "$OP_HOME/config/stack/portals.compose.yml" \
+  -f "$OP_HOME/system/stack/core.compose.yml" \
+  -f "$OP_HOME/system/stack/services.compose.yml" \
+  -f "$OP_HOME/system/stack/portals.compose.yml" \
   -f "$OP_HOME/config/stack/custom.compose.yml" \
   --profile addon.chat \
   config --services
@@ -145,9 +145,9 @@ docker compose \
 docker compose \
   --project-name "$PROJECT_NAME" \
   --env-file "$OP_HOME/knowledge/env/stack.env" \
-  -f "$OP_HOME/config/stack/core.compose.yml" \
-  -f "$OP_HOME/config/stack/services.compose.yml" \
-  -f "$OP_HOME/config/stack/portals.compose.yml" \
+  -f "$OP_HOME/system/stack/core.compose.yml" \
+  -f "$OP_HOME/system/stack/services.compose.yml" \
+  -f "$OP_HOME/system/stack/portals.compose.yml" \
   -f "$OP_HOME/config/stack/custom.compose.yml" \
   --profile "$OP_VOICE_PROFILE" \
   --profile "$OP_OLLAMA_PROFILE" \
@@ -256,6 +256,200 @@ Containers from addons no longer in the file list are stopped and removed.
 
 ---
 
+## Temporary Isolated Stack Verification
+
+Use this flow before a release or after stack/entrypoint changes. It exercises a
+real Compose stack without touching `~/.openpalm`, production ports, or the
+default `openpalm` project name. It does not require live LLM provider
+credentials; chat/model calls may fail, but health, client artifact
+installation, static client serving, runtime config, CORS/preflight, and common
+operator mistakes are covered.
+
+Important host caveat: some Docker daemons cannot bind source files from
+`/tmp` because the daemon runs in a private mount namespace. If Docker reports a
+secret file under `/tmp` as missing, use `/var/tmp` or a repo-local temporary
+directory instead. The stack is still temporary; the key safety requirement is a
+unique `OP_HOME`, `OP_PROJECT_NAME`, and non-production ports.
+
+Artifact boundary: this tarball path verifies an unpublished `@openpalm/client`
+because the assistant mounts `knowledge/` at `/stash`. The guardian and skeleton
+entrypoints still resolve `@openpalm/guardian` and `@openpalm/skeleton` from npm
+by version. If local guardian or skeleton source differs from the npm artifact at
+the same semver, this stack follows the npm artifact, not your working tree.
+
+### 1. Choose an isolated home and build the unpublished client tarball
+
+For a feature branch where `@openpalm/client@<version>` is not on npm yet, build
+and pack it locally, then install that tarball through the same assistant
+entrypoint path by using a `file:/stash/...` version spec.
+
+```bash
+REPO="$PWD"
+VERIFY_ROOT="${VERIFY_ROOT:-$REPO/.tmp-openpalm-verify}"
+VERIFY_HOME="$VERIFY_ROOT/home"
+VERIFY_PROJECT="openpalm-verify"
+VERIFY_VERSION="$(node -p "require('./package.json').version")"
+
+rm -rf "$VERIFY_ROOT"
+mkdir -p "$VERIFY_HOME"
+
+bun run client:build
+bun pm pack --cwd packages/client --destination "$VERIFY_ROOT" --quiet
+CLIENT_TARBALL="$(ls "$VERIFY_ROOT"/openpalm-client-*.tgz | tail -1)"
+```
+
+Expected: the tarball contains at least `package/build/index.html`,
+`package/build/.openpalm-client-version`, and `package/bin/serve.mjs`.
+
+```bash
+tar -tf "$CLIENT_TARBALL" | grep -E 'package/(build/index.html|build/.openpalm-client-version|bin/serve.mjs)'
+```
+
+### 2. Seed the isolated OP_HOME
+
+```bash
+rsync -a \
+  --exclude=/package.json \
+  --exclude=/manifest.json \
+  --exclude=/tools.json \
+  --exclude=/README.md \
+  "$REPO/packages/skeleton/" "$VERIFY_HOME/"
+
+OP_HOME="$VERIFY_HOME" bun -e "import { ensureHomeDirs } from './packages/lib/src/index.ts'; ensureHomeDirs();"
+mkdir -p "$VERIFY_HOME/knowledge/env" "$VERIFY_HOME/knowledge/secrets"
+cp "$CLIENT_TARBALL" "$VERIFY_HOME/knowledge/$(basename "$CLIENT_TARBALL")"
+printf '{}\n' > "$VERIFY_HOME/knowledge/secrets/auth.json"
+chmod 600 "$VERIFY_HOME/knowledge/secrets/auth.json"
+
+for name in portal_chat_secret portal_api_secret portal_discord_secret portal_slack_secret op_guardian_admin_token op_guardian_mcp_token op_api_key; do
+  openssl rand -hex 16 > "$VERIFY_HOME/knowledge/secrets/$name"
+  chmod 600 "$VERIFY_HOME/knowledge/secrets/$name"
+done
+```
+
+### 3. Write an isolated `stack.env`
+
+```bash
+cat > "$VERIFY_HOME/knowledge/env/stack.env" <<EOF
+OP_HOME=$VERIFY_HOME
+OP_UID=$(id -u)
+OP_GID=$(id -g)
+OP_IMAGE_NAMESPACE=openpalm
+OP_IMAGE_TAG=dev
+OP_ASSISTANT_VERSION=dev
+OP_GUARDIAN_VERSION=dev
+OP_PORTAL_VERSION=dev
+OP_GUARDIAN_NPM_VERSION=$VERIFY_VERSION
+OP_CLIENT_VERSION=file:/stash/$(basename "$CLIENT_TARBALL")
+OP_SKELETON_VERSION=$VERIFY_VERSION
+OP_PROJECT_NAME=$VERIFY_PROJECT
+OP_SETUP_COMPLETE=true
+OP_ASSISTANT_PORT=4820
+OP_GUARDIAN_PORT=9190
+OP_GUARDIAN_ADMIN_PORT=9181
+OP_CHAT_PORT=9220
+OP_API_PORT=9221
+OP_CLIENT_PORT=3840
+OP_ENABLED_ADDONS=chat
+COMPOSE_PROFILES=addon.chat
+GUARDIAN_DIRECT_INGRESS=true
+GUARDIAN_CORS_ALLOWED_ORIGINS=http://127.0.0.1:3840
+EOF
+chmod 600 "$VERIFY_HOME/knowledge/env/stack.env"
+```
+
+Common user error: setting `OP_CLIENT_VERSION=$VERIFY_VERSION` before the client
+package is published makes the assistant try npm and skip the client co-process
+when npm returns 404. Use the `file:/stash/...` tarball spec for unpublished
+feature-branch verification, then use the plain semver after release.
+
+The same npm availability rule applies to `OP_GUARDIAN_NPM_VERSION` and
+`OP_SKELETON_VERSION`. This runbook only provides local-tarball plumbing for the
+client artifact; do not trust it to validate unpublished guardian or skeleton
+package code unless you add equivalent local artifact plumbing first.
+
+### 4. Validate and start
+
+```bash
+compose_verify() {
+  docker compose \
+    --project-name "$VERIFY_PROJECT" \
+    --project-directory "$REPO" \
+    -f "$VERIFY_HOME/system/stack/core.compose.yml" \
+    -f "$VERIFY_HOME/system/stack/services.compose.yml" \
+    -f "$VERIFY_HOME/system/stack/portals.compose.yml" \
+    -f "$VERIFY_HOME/config/stack/custom.compose.yml" \
+    -f "$REPO/compose.dev.yml" \
+    --env-file "$VERIFY_HOME/knowledge/env/stack.env" \
+    "$@"
+}
+
+compose_verify config --quiet
+compose_verify config --services
+compose_verify up -d --build
+compose_verify ps -a
+```
+
+Expected: `assistant` becomes healthy, `guardian` becomes healthy when the chat
+profile is enabled, and the client port is published on `127.0.0.1:3840`.
+
+### 5. Manual assertions
+
+```bash
+# Assistant OpenCode health
+curl -fsS http://127.0.0.1:4820/health >/dev/null
+
+# Static client: HEAD must return headers and no body
+curl -sS -o /dev/null -D - -X HEAD http://127.0.0.1:3840/
+
+# Static client: SPA fallback
+curl -fsS http://127.0.0.1:3840/connections/new | grep '<!doctype html>'
+
+# Static client: runtime config is no-store and points at the host-published assistant URL
+curl -fsS -D - http://127.0.0.1:3840/runtime-config.json
+
+# Guardian direct listener health
+curl -fsS http://127.0.0.1:9190/health
+
+# Allowed-origin browser preflight reaches the direct listener path.
+# Expected: HTTP 204 with access-control-allow-origin: http://127.0.0.1:3840.
+# A 401 without CORS headers usually means the runtime installed a stale
+# published guardian package instead of the local source you expected.
+curl -i -sS -X OPTIONS http://127.0.0.1:9190/oc/session \
+  -H 'Origin: http://127.0.0.1:3840' \
+  -H 'Access-Control-Request-Method: POST' \
+  -H 'Access-Control-Request-Headers: authorization, content-type, x-openpalm-user'
+```
+
+### 6. Edge cases to deliberately check
+
+| Case | How to test | Expected result |
+|---|---|---|
+| Production collision | Run `docker compose ls` and inspect ports before start | No `openpalm-verify` command uses project `openpalm` or production ports |
+| Wrong compose tree | Replace `system/stack/core.compose.yml` with `config/stack/core.compose.yml` in a dry command | Command fails because managed compose files live under `system/stack` |
+| Missing secret file | Move one `portal_*_secret` aside, run `compose_verify config --quiet` or `up -d` | Compose fails before guardian starts; restore the file and rerun |
+| `/tmp` bind-source trap | Put `VERIFY_HOME` under `/tmp` on a snap/private-tmp Docker host | Docker may report existing secret files as missing; move to `/var/tmp` or repo-local tmp |
+| Unpublished client package | Set `OP_CLIENT_VERSION=$VERIFY_VERSION` before npm publish | Assistant logs npm 404 and skips client co-process; use `file:/stash/<tarball>.tgz` |
+| Published package drift | Set `OP_GUARDIAN_NPM_VERSION` or `OP_SKELETON_VERSION` to a semver that exists on npm while local source has newer same-version commits | Stack boots from the npm artifact; behavior may differ from local source, such as stale CORS/preflight handling |
+| Port already allocated | Pre-bind `3840`/`4820`/`9190` or reuse an old project | Docker fails port programming; choose new ports and rerun `compose_verify up -d` |
+| Direct ingress disabled | Set `GUARDIAN_DIRECT_INGRESS=false`, recreate guardian, retry browser preflight | `/oc/*` preflight returns `404 not_found`, not `204`; current guardian code also keeps allowed-origin CORS headers on the error |
+
+### 7. Teardown
+
+```bash
+compose_verify down --volumes --remove-orphans
+
+# Container-created files may be root-owned. Use Docker to repair ownership
+# before deleting the temporary tree.
+docker run --rm -v "$VERIFY_ROOT:/cleanup" alpine sh -c "chown -R $(id -u):$(id -g) /cleanup && rm -rf /cleanup/* /cleanup/.[!.]* /cleanup/..?*"
+rmdir "$VERIFY_ROOT"
+```
+
+Record all failures with: command, exit code, relevant `compose_verify ps -a`,
+and the shortest useful `compose_verify logs --tail 100 <service>` excerpt.
+
+---
+
 ## Environment Variable Precedence
 
 Docker Compose resolves variables at two distinct stages, and mixing them up is
@@ -387,4 +581,4 @@ directly — extract and start.
 | [troubleshooting.md](../troubleshooting.md) | Common problems and fixes |
 | [core-principles.md](../technical/core-principles.md) | Architectural rules and filesystem contract |
 | [environment-and-mounts.md](../technical/environment-and-mounts.md) | Per-service mount and env details |
-| `.openpalm/config/stack/README.md` | Stack directory quick reference |
+| `$OP_HOME/system/stack/` and `$OP_HOME/config/stack/custom.compose.yml` | Managed compose files plus user overlay |
diff --git a/docs/operations/release-management.md b/docs/operations/release-management.md
index 58d8f5710..847fabf04 100644
--- a/docs/operations/release-management.md
+++ b/docs/operations/release-management.md
@@ -178,6 +178,12 @@ These non-secret `stack.env` vars control the exact npm artifacts the running pl
 
 ## Release Smoke Checklist
 
+For a full coordinated release candidate, use the dedicated
+[`unit=all` RC checklist](unit-all-rc-checklist.md). It expands this smoke list
+into a pre-publish and post-publish worksheet covering packaging, deployment,
+permissions, upgrade, rootless ownership, browser-backed flows, and shipped
+artifact verification.
+
 - [ ] `electron-host`: launch Electron against a seeded install; verify the window lands on the client chat at `http://127.0.0.1:3890/chat`, and host routes remain available.
 - [ ] `host-ui`: run `openpalm admin`; verify the browser opens on the loopback host UI and `/host`, `/connections`, and `/chat` all load.
 - [ ] `assistant-container`: boot the assistant with `OP_CLIENT_VERSION` and `OP_SKELETON_VERSION` overrides; verify the container installs those exact versions, serves the static client on the assistant's published client port, and chat reaches the locked default assistant connection.
diff --git a/docs/operations/unit-all-rc-checklist.md b/docs/operations/unit-all-rc-checklist.md
new file mode 100644
index 000000000..1735f4a2d
--- /dev/null
+++ b/docs/operations/unit-all-rc-checklist.md
@@ -0,0 +1,566 @@
+# Unit=All RC Checklist
+
+Operator worksheet for a coordinated `unit=all` release candidate. Use this when
+the release contains foundational churn across packaging, deployment,
+permissions, runtime artifact resolution, and install/upgrade behavior.
+
+This checklist is intentionally stricter than the workflow preflight. The goal
+is to prove that the release works as shipped across the major runtime surfaces,
+not just that the source tree is green.
+
+---
+
+## Scope
+
+`unit=all` publishes all coordinated release artifacts at one version:
+
+- npm: `@openpalm/{lib,ui,client,guardian,skeleton}`, `openpalm`, `@openpalm/{discord,slack}-portal`
+- Docker: `openpalm/{assistant,guardian,portal}`
+- Electron installers
+- CLI binaries
+- Git tags and GitHub release metadata
+
+It does **not** build the voice image.
+
+---
+
+## Evidence
+
+For every checklist item, capture:
+
+- command run
+- exit code
+- key output or log excerpt
+- screenshot for browser/Electron/installability checks
+- pass/fail note and any follow-up issue
+
+If a step is skipped, record the reason explicitly.
+
+---
+
+## Setup
+
+Set shared variables once:
+
+```bash
+export RC_VERSION="0.12.53-rc.1"
+export REPO="$PWD"
+export VERIFY_ROOT="$REPO/.tmp-openpalm-rc"
+export VERIFY_HOME="$VERIFY_ROOT/home"
+export VERIFY_PROJECT="openpalm-rc"
+```
+
+Important artifact note:
+
+- pre-publish checks validate source, local builds, and release orchestration
+- post-publish checks validate the actual published npm packages, container images, installers, and tags
+- if there is no private staging registry, the public RC is the first true shipped-artifact test for guardian, skeleton, client, UI, CLI, and images
+
+---
+
+## Exit Criteria
+
+Do not publish or announce the RC unless every required item below is marked
+pass or has an explicit, reviewed waiver.
+
+- [ ] `unit=all` workflow dry run passed for the exact RC version
+- [ ] local preflight parity passed
+- [ ] fresh install passed
+- [ ] upgrade test passed
+- [ ] failure/rollback test passed
+- [ ] assistant/client isolated runtime test passed
+- [ ] guardian direct-ingress/auth/CORS test passed
+- [ ] browser-backed live stack test passed
+- [ ] host UI smoke passed
+- [ ] PWA smoke passed
+- [ ] at least one real credentialed ingress path passed
+- [ ] security-boundary verification passed
+- [ ] rootless/ownership verification passed
+- [ ] CLI binary smoke passed
+- [ ] Electron installer smoke passed
+- [ ] post-publish npm verification passed
+- [ ] post-publish Docker verification passed
+- [ ] post-publish GitHub tag/release verification passed
+- [ ] post-publish shipped-artifact boot test passed
+
+---
+
+## 1. Release Orchestrator Dry Run
+
+- [ ] Run the real release workflow for the exact RC version.
+
+```bash
+gh workflow run release.yml -f unit=all -f version="$RC_VERSION" -f dry_run=true
+```
+
+Pass criteria:
+
+- [ ] the run starts successfully
+- [ ] the computed version matches `RC_VERSION`
+- [ ] no npm regression guard failure appears
+- [ ] expected `unit=all` jobs are present: platform npm, portal npm, assistant image, guardian image, portal image, Electron, CLI binaries, tags/release staging
+- [ ] no unexpected job skip appears
+
+Evidence:
+
+- workflow URL
+- screenshots or copied logs for compute-version, regression guard, preflight, and dry-run preview
+
+---
+
+## 2. Local Preflight Parity
+
+- [ ] Run the local equivalent of the release preflight.
+
+```bash
+bun install --frozen-lockfile
+bun run client:build
+bun run test
+bun run ui:check
+bun run ui-kit:check
+bun run client:check
+bun run --cwd packages/ui test:browsers
+bun run ui:test:unit
+bun run electron:test
+bun run guardian:test
+bun run cli:test
+```
+
+Pass criteria:
+
+- [ ] every command exits 0
+- [ ] any warning is understood and non-blocking
+- [ ] no test was skipped unexpectedly
+
+---
+
+## 3. Fresh Install From Empty OP_HOME
+
+- [ ] Test the supported install path against a brand-new `OP_HOME`.
+- [ ] Use isolated ports and project name.
+
+Pass criteria:
+
+- [ ] install seeds `system/stack/{core,services,portals}.compose.yml`
+- [ ] install seeds `config/stack/custom.compose.yml`
+- [ ] install creates expected `knowledge/`, `data/`, and `workspace/` trees
+- [ ] assistant boots successfully
+- [ ] host UI is reachable
+- [ ] no manual repair is needed
+
+Evidence:
+
+- resulting directory tree summary
+- health output
+- screenshot of first successful UI load
+
+---
+
+## 4. Upgrade Existing OP_HOME
+
+- [ ] Test against a realistic pre-existing install.
+- [ ] Prefer a real preserved fixture over a synthetic minimal tree.
+
+Pass criteria:
+
+- [ ] existing user-owned files in `config/` survive untouched unless explicitly intended
+- [ ] managed `system/` files update correctly
+- [ ] addon activation state still resolves correctly
+- [ ] `knowledge/secrets/auth.json`, tasks, AKM data, and workspace remain intact
+- [ ] upgraded stack boots cleanly
+
+Evidence:
+
+- before/after file diff summary for `config/`, `system/`, and `state/`
+- health output after upgrade
+
+---
+
+## 5. Failure And Rollback Test
+
+- [ ] Induce a controlled deployment failure.
+- [ ] Good options: missing required secret, bad image tag, invalid compose substitution.
+
+Pass criteria:
+
+- [ ] apply fails closed
+- [ ] previous known-good configuration remains recoverable
+- [ ] rollback snapshot behavior matches the documented contract
+- [ ] no user-owned config is clobbered during the failed attempt
+
+Evidence:
+
+- failing command
+- failure output
+- rollback snapshot path
+- post-failure stack status
+
+---
+
+## 6. Assistant And Client Isolated Runtime Test
+
+- [ ] Run the isolated compose flow from `manual-compose-runbook.md`.
+- [ ] Build and pack a local client tarball.
+- [ ] Boot assistant with `OP_CLIENT_VERSION=file:/stash/...`.
+
+Verify:
+
+```bash
+curl -fsS http://127.0.0.1:4820/health
+curl -sS -o /dev/null -D - -X HEAD http://127.0.0.1:3840/
+curl -fsS http://127.0.0.1:3840/connections/new | grep '<!doctype html>'
+curl -fsS -D - http://127.0.0.1:3840/runtime-config.json
+```
+
+Pass criteria:
+
+- [ ] assistant health returns 200
+- [ ] client `HEAD /` succeeds
+- [ ] SPA fallback serves the app shell
+- [ ] `runtime-config.json` is `cache-control: no-store`
+- [ ] the locked default connection points at the host-published assistant URL
+
+---
+
+## 7. Guardian Direct Ingress, Auth, And CORS
+
+- [ ] Boot guardian in the isolated stack with direct ingress enabled.
+
+Verify:
+
+```bash
+curl -fsS http://127.0.0.1:9190/health
+curl -i -sS -X OPTIONS http://127.0.0.1:9190/oc/session \
+  -H 'Origin: http://127.0.0.1:3840' \
+  -H 'Access-Control-Request-Method: POST' \
+  -H 'Access-Control-Request-Headers: authorization, content-type, x-openpalm-user'
+```
+
+- [ ] Re-run with `GUARDIAN_DIRECT_INGRESS=false`.
+
+Pass criteria:
+
+- [ ] guardian health returns 200
+- [ ] allowed-origin preflight returns `204` with expected CORS headers
+- [ ] disabled direct ingress returns `404 not_found`
+- [ ] unauthenticated direct `/oc/*` traffic is rejected explicitly
+- [ ] behavior matches current source expectations, not stale published package behavior
+
+Evidence:
+
+- guardian logs
+- preflight response headers
+
+---
+
+## 8. Browser-Backed Live Stack Test
+
+- [ ] Run stack-backed UI tests.
+
+```bash
+bun run ui:test:stack
+```
+
+- [ ] If the RC is meant to represent the full browser experience, also run:
+
+```bash
+bun run ui:test:e2e
+```
+
+Pass criteria:
+
+- [ ] login succeeds
+- [ ] connections UI works
+- [ ] chat UI works
+- [ ] runtime-config-driven routing works
+- [ ] no assistant/client/UI artifact mismatch appears
+
+---
+
+## 9. Host UI Smoke
+
+- [ ] Launch the host-served UI the way users actually do.
+
+Pass criteria:
+
+- [ ] `/host` loads
+- [ ] `/connections` loads
+- [ ] `/chat` loads
+- [ ] admin login succeeds
+- [ ] provider/auth state looks correct
+- [ ] host UI and assistant-container client do not conflict or drift
+
+Evidence:
+
+- screenshots of `/host`, `/connections`, `/chat`
+
+---
+
+## 10. PWA Smoke
+
+- [ ] Test localhost PWA installability from the host-served client origin.
+- [ ] Test hosted PWA installability if applicable to this RC.
+
+Pass criteria:
+
+- [ ] installability is present on localhost
+- [ ] installed localhost app reopens on the same origin and still works
+- [ ] hosted origin works with expected runtime config behavior
+- [ ] remote connection behavior matches HTTPS and guardian CORS requirements
+
+Evidence:
+
+- screenshots of install prompt or installed app
+
+---
+
+## 11. Real Credentialed Ingress Path
+
+- [ ] Test at least one real credentialed ingress path.
+- [ ] Minimum acceptable: guardian-hosted `chat` or `api`.
+- [ ] Better: one baked portal adapter as well.
+
+Pass criteria:
+
+- [ ] authenticated request reaches guardian
+- [ ] session is created successfully
+- [ ] message flow completes successfully
+- [ ] audit logging is present
+- [ ] unauthenticated request is rejected correctly
+
+---
+
+## 12. Security Boundary Verification
+
+- [ ] Inspect effective compose config and running containers.
+
+Suggested checks:
+
+```bash
+docker inspect <assistant-container>
+docker inspect <guardian-container>
+docker compose ... config
+```
+
+Pass criteria:
+
+- [ ] assistant has no Docker socket mount
+- [ ] assistant has no default path to the host admin process
+- [ ] guardian remains the only intended ingress bridge
+- [ ] admin remains loopback-only by default
+- [ ] no raw secret env values appear in inspect output
+- [ ] secrets are granted as files, not broad env files
+
+---
+
+## 13. Rootless, Ownership, And Host Accessibility
+
+- [ ] Run the guardrails already used in CI.
+
+```bash
+./scripts/validate-rootless-guardrails.sh
+source scripts/rootless-smoke-fixture.sh && smoke_build_images assistant guardian portal
+OP_ROOTLESS_SMOKE_SKIP_BUILD=1 ./scripts/rootless-ownership-smoke.sh stack
+OP_ROOTLESS_SMOKE_SKIP_BUILD=1 ./scripts/rootless-ownership-smoke.sh portal-discord
+OP_ROOTLESS_SMOKE_SKIP_BUILD=1 ./scripts/rootless-host-swap-smoke.sh
+```
+
+Pass criteria:
+
+- [ ] no root-owned files appear under bind-mounted `OP_HOME`
+- [ ] host user can still read and write expected files after boot
+- [ ] secrets keep strict file modes
+- [ ] no ownership-repair surprise appears during host swap
+
+---
+
+## 14. Cross-Environment Manual Checks
+
+- [ ] Validate on native Linux.
+- [ ] Validate on at least one Docker Desktop-style environment if that platform is supported.
+
+Pass criteria:
+
+- [ ] install/start/upgrade works without ownership or mount surprises
+- [ ] any unsupported environment is explicitly waived with noted risk
+
+Evidence:
+
+- platform tested
+- filesystem/runtime notes
+- any deviations or waivers
+
+---
+
+## 15. Addon And Overlay Scenario Matrix
+
+- [ ] Test no addons enabled.
+- [ ] Test `chat` only.
+- [ ] Test `api` only.
+- [ ] Test a representative `custom.compose.yml` overlay.
+- [ ] Test addon enable and disable round trip.
+
+Pass criteria:
+
+- [ ] compose profile resolution matches enabled addon state
+- [ ] expected services appear and unexpected services do not
+- [ ] no stale service lingers after disable
+- [ ] user overlay still composes cleanly with the managed file set
+
+---
+
+## 16. CLI Binary Smoke
+
+- [ ] Test at least one produced CLI binary artifact.
+
+Verify:
+
+```bash
+openpalm --version
+openpalm ui serve --help
+openpalm install --help
+```
+
+Pass criteria:
+
+- [ ] reported version matches `RC_VERSION`
+- [ ] binary starts and prints expected help/version text
+- [ ] install/start flow works from the built artifact, not just repo source
+
+---
+
+## 17. Electron Installer Smoke
+
+- [ ] Install and launch the Electron build that `unit=all` will ship.
+
+Pass criteria:
+
+- [ ] app launches successfully
+- [ ] packaged skeleton resolution works
+- [ ] expected client/host UI routing works
+- [ ] no packaged/runtime asset mismatch appears
+- [ ] no repo checkout is required for normal operation
+
+Evidence:
+
+- installer artifact name
+- screenshots of first successful launch
+
+---
+
+## 18. Auth, Permissions, And Policy Paths
+
+- [ ] Verify admin auth success and failure.
+- [ ] Verify guardian auth success and failure.
+- [ ] Verify denied-origin and allowed-origin direct-ingress behavior.
+- [ ] Verify content-validation fail-closed behavior if this release touched it materially.
+
+Pass criteria:
+
+- [ ] every failure path is explicit and safe
+- [ ] no bypassable permission/auth path is found
+- [ ] no unexpected leniency appears on direct ingress or browser-facing surfaces
+
+---
+
+## 19. Post-Publish npm Verification
+
+- [ ] Verify each published npm artifact from the registry.
+
+```bash
+npm view @openpalm/lib@"$RC_VERSION" version
+npm view openpalm@"$RC_VERSION" version
+npm view @openpalm/ui@"$RC_VERSION" version
+npm view @openpalm/client@"$RC_VERSION" version
+npm view @openpalm/guardian@"$RC_VERSION" version
+npm view @openpalm/skeleton@"$RC_VERSION" version
+npm view @openpalm/discord-portal@"$RC_VERSION" version
+npm view @openpalm/slack-portal@"$RC_VERSION" version
+```
+
+- [ ] Record dist-tags for key artifacts.
+
+```bash
+npm view @openpalm/client dist-tags --json
+npm view @openpalm/guardian dist-tags --json
+npm view @openpalm/skeleton dist-tags --json
+```
+
+Pass criteria:
+
+- [ ] every expected package exists at the exact RC version
+- [ ] dist-tags match prerelease expectations
+
+---
+
+## 20. Post-Publish Docker Verification
+
+- [ ] Verify each image tag from the registry.
+
+```bash
+docker buildx imagetools inspect openpalm/assistant:"$RC_VERSION"
+docker buildx imagetools inspect openpalm/guardian:"$RC_VERSION"
+docker buildx imagetools inspect openpalm/portal:"$RC_VERSION"
+```
+
+Pass criteria:
+
+- [ ] each tag resolves successfully
+- [ ] manifest metadata looks correct
+- [ ] no `latest` tag was created for the prerelease
+
+---
+
+## 21. Post-Publish GitHub Tag And Release Verification
+
+- [ ] Verify expected tags exist.
+- [ ] For `unit=all`, verify:
+  - `platform-$RC_VERSION`
+  - `portals-$RC_VERSION`
+  - `assistant-$RC_VERSION`
+  - `guardian-$RC_VERSION`
+  - `electron-$RC_VERSION`
+  - `$RC_VERSION`
+- [ ] Verify the GitHub release exists and expected assets are attached.
+
+Pass criteria:
+
+- [ ] every expected tag exists
+- [ ] tags point at the intended commit
+- [ ] release assets are present and downloadable
+
+---
+
+## 22. Post-Publish Shipped-Artifact Boot Test
+
+- [ ] Re-run the isolated stack against the actual published RC artifacts.
+- [ ] Use the published npm packages and published images, not local source.
+
+Pass criteria:
+
+- [ ] runtime behavior matches pre-publish expectations
+- [ ] no guardian/skeleton/client artifact drift appears
+- [ ] health, client serving, auth, and direct-ingress checks still pass
+
+---
+
+## Risk Focus
+
+If time is limited, prioritize these in order:
+
+1. shipped guardian/skeleton/client artifact behavior
+2. upgrade plus rollback behavior
+3. rootless ownership and host accessibility
+4. browser-backed live stack flow
+5. real ingress auth/CORS/permission behavior
+6. Electron and CLI packaged artifact sanity
+
+---
+
+## Related Documents
+
+- [Release Management](release-management.md)
+- [Manual Compose Runbook](manual-compose-runbook.md)
+- [Core Principles](../technical/core-principles.md)
+- [Environment Variables, Mounts, and Network Wiring](../technical/environment-and-mounts.md)
+- [Release Architecture](../technical/release-architecture.md)
diff --git a/docs/technical/testing-stack-in-isolation.md b/docs/technical/testing-stack-in-isolation.md
index 4d3fe9152..c90f531d9 100644
--- a/docs/technical/testing-stack-in-isolation.md
+++ b/docs/technical/testing-stack-in-isolation.md
@@ -58,12 +58,18 @@ Or use the dev-setup script (which seeds `.dev/` with dev ports) and manually ad
 
 ### 2. Start the Docker stack (assistant + guardian)
 
+Managed compose files live under `.dev/system/stack/`; `.dev/config/stack/`
+contains only the user-owned `custom.compose.yml` overlay.
+
 ```bash
 bun run dev:build
 # or with test ports:
 OP_ASSISTANT_PORT=4800 \
 docker compose --project-directory . \
-  -f .dev/config/stack/core.compose.yml \
+  -f .dev/system/stack/core.compose.yml \
+  -f .dev/system/stack/services.compose.yml \
+  -f .dev/system/stack/portals.compose.yml \
+  -f .dev/config/stack/custom.compose.yml \
   -f compose.dev.yml \
   --env-file .dev/knowledge/env/stack.env \
   --project-name openpalm-test \
diff --git a/packages/skeleton/system/stack/README.md b/packages/skeleton/system/stack/README.md
index 3b8e54085..017cbeb75 100644
--- a/packages/skeleton/system/stack/README.md
+++ b/packages/skeleton/system/stack/README.md
@@ -1,42 +1,47 @@
-# config/stack/
+# system/stack/
 
-This directory contains the runtime stack composition and configuration. OpenPalm runs from the fixed compose file set: `core.compose.yml`, `services.compose.yml`, `portals.compose.yml`, and `custom.compose.yml`.
+This directory contains the managed runtime stack composition. OpenPalm runs
+from the fixed managed file set here plus the user-owned overlay at
+`$OP_HOME/config/stack/custom.compose.yml`.
 
 ## Quick start
 
 ```bash
 # Run the core stack by hand
-cd ~/.openpalm/config/stack
+OP_HOME="${OP_HOME:-$HOME/.openpalm}"
 docker compose \
   --project-name openpalm \
-  --env-file ../../knowledge/env/stack.env \
-  -f core.compose.yml \
-  -f services.compose.yml \
-  -f portals.compose.yml \
-  -f custom.compose.yml \
+  --env-file "$OP_HOME/knowledge/env/stack.env" \
+  -f "$OP_HOME/system/stack/core.compose.yml" \
+  -f "$OP_HOME/system/stack/services.compose.yml" \
+  -f "$OP_HOME/system/stack/portals.compose.yml" \
+  -f "$OP_HOME/config/stack/custom.compose.yml" \
   up -d
 
 # Enable built-in optional services with profiles
 docker compose \
   --project-name openpalm \
-  --env-file ../../knowledge/env/stack.env \
-  -f core.compose.yml \
-  -f services.compose.yml \
-  -f portals.compose.yml \
-  -f custom.compose.yml \
+  --env-file "$OP_HOME/knowledge/env/stack.env" \
+  -f "$OP_HOME/system/stack/core.compose.yml" \
+  -f "$OP_HOME/system/stack/services.compose.yml" \
+  -f "$OP_HOME/system/stack/portals.compose.yml" \
+  -f "$OP_HOME/config/stack/custom.compose.yml" \
   --profile addon.chat \
   up -d
 ```
 
-See the [Manual Compose Runbook](../../docs/operations/manual-compose-runbook.md) for preflight,
+See the [Manual Compose Runbook](../../../../docs/operations/manual-compose-runbook.md) for preflight,
 status, logs, and all other operations.
 
-## Core services
+## Common services
 
-| Service | Host port | Purpose |
-|---------|-----------|---------|
-| `assistant` | `3800 -> 4096` | OpenCode runtime without Docker socket; also hosts the automation scheduler co-process (no port) |
-| `guardian` | `3830 -> 3830` and `3831 -> 3831` (localhost by default) | Principal-authenticated ingress, direct listener, and admin listener |
+The assistant is the only always-on core container. The guardian is enabled by
+portal-style addon profiles such as `addon.chat` or `addon.api`.
+
+| Service | Activation | Host port | Purpose |
+|---------|------------|-----------|---------|
+| `assistant` | Always on | `3800 -> 4096` | OpenCode runtime without Docker socket; also hosts the automation scheduler co-process (no port) |
+| `guardian` | Portal/addon profiles | `3830 -> 3830` and `3831 -> 3831` (localhost by default) | Principal-authenticated ingress, direct listener, and admin listener |
 
 ## Addons
 
@@ -69,14 +74,15 @@ overlays.
 | `core.compose.yml` | Core service definition (always used) | System (managed via CLI/admin) |
 | `services.compose.yml` | Optional first-party services | System (managed via CLI/admin) |
 | `portals.compose.yml` | Optional first-party portals | System (managed via CLI/admin) |
-| `custom.compose.yml` | User custom services and overlays | User |
+| `$OP_HOME/config/stack/custom.compose.yml` | User custom services and overlays | User |
 
-This directory holds compose assembly only — **no secrets and no env files**.
+This directory holds managed compose assembly only — **no secrets, no env files,
+and no user-owned overlays**.
 
 ## Env files
 
 Compose receives **only one env file**, from outside this directory:
-- `../../knowledge/env/stack.env` (akm `env:stack`) — Non-secret runtime configuration only
+- `$OP_HOME/knowledge/env/stack.env` (akm `env:stack`) — Non-secret runtime configuration only
 
 Secrets live in `knowledge/secrets/` (including OpenCode `auth.json`) and are
 granted to services through Compose `secrets:` entries or direct bind mounts. Do
diff --git a/packages/skeleton/system/stack/core.compose.yml b/packages/skeleton/system/stack/core.compose.yml
index 2ac3a9b53..550c890c9 100644
--- a/packages/skeleton/system/stack/core.compose.yml
+++ b/packages/skeleton/system/stack/core.compose.yml
@@ -16,9 +16,10 @@
 # (bind-mounted into the assistant + guardian).
 #
 # Directory model:
-#   ~/.openpalm/config/       — user-editable + system config (akm/)
-#   ~/.openpalm/config/stack/ — compose assembly only (core/services/portals/custom
-#                               compose files) — no secrets, no env
+#   ~/.openpalm/system/       — managed release assets, including system/stack/
+#                               core/services/portals compose files
+#   ~/.openpalm/config/       — user-editable config, including only the
+#                               config/stack/custom.compose.yml stack overlay
 #   ~/.openpalm/data/         — persistent service data, logs, backups, rollback
 #   ~/.openpalm/knowledge/    — akm knowledge (skills, env, secrets, agents);
 #                               env:user, env:stack, and auth.json live here

From efe9697af96b1775ae0c17e71d20bab50923d9b1 Mon Sep 17 00:00:00 2001
From: itlackey <itlackey@gmail.com>
Date: Wed, 8 Jul 2026 01:50:20 -0500
Subject: [PATCH 57/61] fix(release): support guardian dry-run and smoke builds

---
 .github/workflows/release.yml                 | 12 ++++++++
 compose.dev.yml                               |  2 ++
 containers/guardian/Dockerfile                | 28 ++++++++++++++++---
 .../guardian-rootless-entrypoint.test.ts      |  2 +-
 .../control-plane/guardian-rootless.test.ts   |  2 +-
 .../rootless-guardrail-script.test.ts         | 11 ++++++++
 scripts/release-publish-dag.test.ts           | 28 ++++++++++++++++++-
 scripts/rootless-host-swap-smoke.sh           |  6 ++--
 scripts/rootless-ownership-smoke.sh           | 13 +++++++--
 scripts/rootless-smoke-fixture.sh             |  8 +++++-
 10 files changed, 99 insertions(+), 13 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index c0ffd341b..87535d920 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -537,6 +537,11 @@ jobs:
       - uses: actions/checkout@v6
         with:
           ref: ${{ github.ref_name }}
+      - name: Stamp local guardian/skeleton sources for dry-run image build
+        if: ${{ inputs.dry_run }}
+        run: |
+          node scripts/set-version.mjs packages/guardian/package.json "${{ needs.compute-version.outputs.new_version }}"
+          node scripts/set-version.mjs packages/skeleton/package.json "${{ needs.compute-version.outputs.new_version }}"
       - uses: docker/setup-qemu-action@v3
       - uses: docker/setup-buildx-action@v3
       - name: Login to Docker Hub
@@ -592,6 +597,11 @@ jobs:
       - uses: actions/checkout@v6
         with:
           ref: ${{ github.ref_name }}
+      - name: Stamp local guardian/skeleton sources for dry-run image build
+        if: ${{ inputs.dry_run }}
+        run: |
+          node scripts/set-version.mjs packages/guardian/package.json "${{ needs.compute-version.outputs.new_version }}"
+          node scripts/set-version.mjs packages/skeleton/package.json "${{ needs.compute-version.outputs.new_version }}"
       - uses: docker/setup-qemu-action@v3
       - uses: docker/setup-buildx-action@v3
       - name: Login to Docker Hub
@@ -622,6 +632,8 @@ jobs:
           file: containers/guardian/Dockerfile
           build-args: |
             GUARDIAN_VERSION=${{ needs.compute-version.outputs.new_version }}
+            GUARDIAN_USE_LOCAL_SOURCE=${{ inputs.dry_run && 'true' || 'false' }}
+            SKELETON_USE_LOCAL_SOURCE=${{ inputs.dry_run && 'true' || 'false' }}
           platforms: ${{ inputs.dry_run && 'linux/amd64' || 'linux/amd64,linux/arm64' }}
           push: ${{ !inputs.dry_run }}
           # Provenance/SBOM attestations add extra manifests + blobs that make
diff --git a/compose.dev.yml b/compose.dev.yml
index a6a80d767..f3b26252b 100644
--- a/compose.dev.yml
+++ b/compose.dev.yml
@@ -31,6 +31,8 @@ services:
         # GUARDIAN_VERSION; a bare `bun run dev:build` falls back to the latest
         # published guardian, which keeps the guard satisfied.
         GUARDIAN_VERSION: ${GUARDIAN_VERSION:-latest}
+        GUARDIAN_USE_LOCAL_SOURCE: ${GUARDIAN_USE_LOCAL_SOURCE:-false}
+        SKELETON_USE_LOCAL_SOURCE: ${SKELETON_USE_LOCAL_SOURCE:-false}
     image: ${OP_IMAGE_NAMESPACE:-openpalm}/guardian:dev
     # Guardian is intentionally NOT host-published. It is reachable only on
     # the portal_net / assistant_net networks as `http://guardian:8080`.
diff --git a/containers/guardian/Dockerfile b/containers/guardian/Dockerfile
index 979f77fe4..2c06b7b17 100644
--- a/containers/guardian/Dockerfile
+++ b/containers/guardian/Dockerfile
@@ -27,12 +27,20 @@ RUN chmod +x /entrypoint.sh
 # so the baked install actually survives under the real stack.
 ARG GUARDIAN_VERSION
 ENV GUARDIAN_VERSION=${GUARDIAN_VERSION}
+ARG GUARDIAN_USE_LOCAL_SOURCE=false
+ARG SKELETON_USE_LOCAL_SOURCE=false
 
 ENV HOME=/opt/openpalm/guardian \
     PORT=8080 \
     OPENCODE_CONFIG_DIR=/etc/opencode \
     PATH="/opt/openpalm/tools/node_modules/.bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
 
+# Optional dry-run/smoke path: copy the local guardian/skeleton workspaces into
+# the build context so callers can bake unpublished source at the target version
+# without needing it to exist on npm yet.
+COPY packages/guardian /opt/openpalm/local-src/guardian
+COPY packages/skeleton /opt/openpalm/local-src/skeleton
+
 # Bake default tool packages at /opt/openpalm/tools. In compose,
 # OP_HOME/data/guardian/tools is bind-mounted over this path so operators
 # can edit package.json directly.
@@ -47,11 +55,23 @@ COPY containers/guardian/tools/package.json /opt/openpalm/tools/package.json
 # uid. This applies ONLY to these app/cache trees; the secret tree
 # (knowledge/secrets, 0600) is a bind mount and is never touched here.
 RUN test -n "$GUARDIAN_VERSION" \
-    && mkdir -p /opt/openpalm/guardian/.local/share/opencode /opt/openpalm/guardian/.local/state/opencode /opt/openpalm/guardian-pkg /opt/openpalm/skeleton \
-    && (cd /opt/openpalm/guardian-pkg && bun add "@openpalm/guardian@${GUARDIAN_VERSION}" --production) \
-    && (cd /opt/openpalm/skeleton && bun add "@openpalm/skeleton@${GUARDIAN_VERSION}" --production) \
+    && guardian_spec="@openpalm/guardian@${GUARDIAN_VERSION}" \
+    && skeleton_spec="@openpalm/skeleton@${GUARDIAN_VERSION}" \
+    && mkdir -p /opt/openpalm/local-artifacts \
+    && if [ "$GUARDIAN_USE_LOCAL_SOURCE" = "true" ]; then \
+         (cd /opt/openpalm/local-src/guardian && bun pm pack --destination /opt/openpalm/local-artifacts --quiet); \
+         guardian_spec="$(find /opt/openpalm/local-artifacts -maxdepth 1 -name 'openpalm-guardian-*.tgz' | head -n 1)"; \
+       fi \
+    && if [ "$SKELETON_USE_LOCAL_SOURCE" = "true" ]; then \
+         (cd /opt/openpalm/local-src/skeleton && bun pm pack --destination /opt/openpalm/local-artifacts --quiet); \
+         skeleton_spec="$(find /opt/openpalm/local-artifacts -maxdepth 1 -name 'openpalm-skeleton-*.tgz' | head -n 1)"; \
+       fi \
+    && mkdir -p /opt/openpalm /opt/openpalm/guardian/.local/share/opencode /opt/openpalm/guardian/.local/state/opencode /opt/openpalm/guardian-pkg /opt/openpalm/skeleton \
+    && (cd /opt/openpalm/guardian-pkg && bun add "$guardian_spec" --production) \
+    && (cd /opt/openpalm/skeleton && bun add "$skeleton_spec" --production) \
     && bun install --cwd /opt/openpalm/tools --production \
-    && chmod -R a+rwX /opt/openpalm/guardian /opt/openpalm/guardian-pkg /opt/openpalm/skeleton /opt/openpalm/tools
+    && rm -rf /opt/openpalm/local-src /opt/openpalm/local-artifacts \
+    && chmod -R a+rwX /opt/openpalm /opt/openpalm/guardian /opt/openpalm/guardian-pkg /opt/openpalm/skeleton /opt/openpalm/tools
 
 EXPOSE 8080
 HEALTHCHECK --interval=30s --timeout=5s --start-period=120s --retries=3 \
diff --git a/packages/lib/src/control-plane/guardian-rootless-entrypoint.test.ts b/packages/lib/src/control-plane/guardian-rootless-entrypoint.test.ts
index 6fe31d94b..85094d4e6 100644
--- a/packages/lib/src/control-plane/guardian-rootless-entrypoint.test.ts
+++ b/packages/lib/src/control-plane/guardian-rootless-entrypoint.test.ts
@@ -38,7 +38,7 @@ describe('guardian rootless entrypoint regressions', () => {
     const installPrefix = installMatch![1];
 
     const bakeMatch = guardianDockerfile.match(
-      /\(cd (\S+) && bun add "@openpalm\/guardian@\$\{GUARDIAN_VERSION\}"/,
+      /\(cd (\S+) && bun add "\$guardian_spec"/,
     );
     expect(bakeMatch).not.toBeNull();
     const bakePrefix = bakeMatch![1];
diff --git a/packages/lib/src/control-plane/guardian-rootless.test.ts b/packages/lib/src/control-plane/guardian-rootless.test.ts
index 628292704..037608d1a 100644
--- a/packages/lib/src/control-plane/guardian-rootless.test.ts
+++ b/packages/lib/src/control-plane/guardian-rootless.test.ts
@@ -29,7 +29,7 @@ describe('guardian rootless conversion', () => {
     // g=u would only grant write when OP_GID == 1000; world-writable is required so
     // the arbitrary uid can `bun add` guardian/skeleton into /opt/openpalm on first
     // boot. Secrets live in a separate 0600 bind-mount tree.
-    expect(guardianDockerfile).toContain('chmod -R a+rwX /opt/openpalm/guardian /opt/openpalm/guardian-pkg /opt/openpalm/skeleton /opt/openpalm/tools');
+    expect(guardianDockerfile).toContain('chmod -R a+rwX /opt/openpalm /opt/openpalm/guardian /opt/openpalm/guardian-pkg /opt/openpalm/skeleton /opt/openpalm/tools');
     expect(guardianDockerfile).not.toContain('chmod -R g=u');
   });
 });
diff --git a/packages/lib/src/control-plane/rootless-guardrail-script.test.ts b/packages/lib/src/control-plane/rootless-guardrail-script.test.ts
index 0827475e2..c802d6cf7 100644
--- a/packages/lib/src/control-plane/rootless-guardrail-script.test.ts
+++ b/packages/lib/src/control-plane/rootless-guardrail-script.test.ts
@@ -69,4 +69,15 @@ describe('rootless phase-0 script guardrails', () => {
     expect(fixtureHelper).toContain('smoke_write_stack_env');
     expect(fixtureHelper).toContain('smoke_ensure_home_dirs');
   });
+
+  test('rootless smoke fixtures assign an isolated assistant-container client port', () => {
+    expect(fixtureHelper).toContain('OP_CLIENT_PORT=${client_port}');
+    expect(smokeScript).toContain('OP_ROOTLESS_SMOKE_CLIENT_PORT');
+    expect(hostSwapSmokeScript).toContain('3994');
+  });
+
+  test('rootless smokes only run compose down when the prior stack env still exists', () => {
+    expect(smokeScript).toContain('if [[ -f "$SMOKE_HOME/knowledge/env/stack.env" ]]');
+    expect(hostSwapSmokeScript).toContain('if [[ -f "$SWAP_HOME/knowledge/env/stack.env" ]]');
+  });
 });
diff --git a/scripts/release-publish-dag.test.ts b/scripts/release-publish-dag.test.ts
index e12cf54a6..69fc41434 100644
--- a/scripts/release-publish-dag.test.ts
+++ b/scripts/release-publish-dag.test.ts
@@ -23,7 +23,7 @@ const RELEASE_WORKFLOW = join(WORKFLOWS_DIR, "release.yml");
 const CI_WORKFLOW = join(WORKFLOWS_DIR, "ci.yml");
 const PUBLISH_REUSABLE = "publish-npm-package.yml";
 
-type Step = { name?: string; run?: string };
+type Step = { name?: string; run?: string; with?: Record<string, unknown> };
 type Job = {
 	uses?: string;
 	needs?: string | string[];
@@ -184,3 +184,29 @@ describe("P5e — client-bundle purity gate wired into CI (RED until P5e item 3)
 		expect(gated).toBe(true);
 	});
 });
+
+describe("guardian image dry-run stays buildable before npm publish", () => {
+	const release = parseWorkflow(RELEASE_WORKFLOW);
+	const jobs = jobsOf(release);
+	const guardianJob = jobs["docker-guardian"];
+
+	test("dry-run stamps local guardian and skeleton sources before the image build", () => {
+		const stampStep = (guardianJob?.steps ?? []).find((s) =>
+			s.name?.includes("Stamp local guardian/skeleton sources for dry-run image build"),
+		);
+		expect(stampStep).toBeDefined();
+		expect(stampStep?.run ?? "").toContain("packages/guardian/package.json");
+		expect(stampStep?.run ?? "").toContain("packages/skeleton/package.json");
+	});
+
+	test("guardian image build switches to local source packages in dry-run mode", () => {
+		const buildStep = (guardianJob?.steps ?? []).find((s) => s.name === "Build and push");
+		expect(buildStep).toBeDefined();
+		expect(String(buildStep?.with?.["build-args"] ?? buildStep?.run ?? "")).toContain(
+			"GUARDIAN_USE_LOCAL_SOURCE",
+		);
+		expect(String(buildStep?.with?.["build-args"] ?? buildStep?.run ?? "")).toContain(
+			"SKELETON_USE_LOCAL_SOURCE",
+		);
+	});
+});
diff --git a/scripts/rootless-host-swap-smoke.sh b/scripts/rootless-host-swap-smoke.sh
index 881ac0321..002606593 100755
--- a/scripts/rootless-host-swap-smoke.sh
+++ b/scripts/rootless-host-swap-smoke.sh
@@ -30,7 +30,9 @@ dev_compose() {
 }
 
 cleanup() {
-  dev_compose down --remove-orphans --volumes >/dev/null 2>&1 || true
+  if [[ -f "$SWAP_HOME/knowledge/env/stack.env" ]]; then
+    dev_compose down --remove-orphans --volumes >/dev/null 2>&1 || true
+  fi
   docker run --rm -v "$(dirname "$SWAP_HOME"):/smoke-parent" alpine sh -c 'rm -rf "/smoke-parent/$1"' _ "$(basename "$SWAP_HOME")" >/dev/null 2>&1 || true
 }
 trap cleanup EXIT
@@ -53,7 +55,7 @@ PLATFORM_VERSION="$(smoke_platform_version)"
 
 smoke_copy_skeleton "$SWAP_HOME"
 smoke_write_stack_env "$SWAP_HOME" "$PLATFORM_VERSION" \
-  3996 3990 3991 3992 3993
+  3996 3990 3991 3992 3993 3994
 printf 'OP_ENABLED_ADDONS=%s\n' 'chat' >> "$SWAP_HOME/knowledge/env/stack.env"
 smoke_seed_secrets "$SWAP_HOME" 'swap-smoke-password'
 
diff --git a/scripts/rootless-ownership-smoke.sh b/scripts/rootless-ownership-smoke.sh
index ffacd392e..053e9e23e 100755
--- a/scripts/rootless-ownership-smoke.sh
+++ b/scripts/rootless-ownership-smoke.sh
@@ -31,11 +31,13 @@ guardian_port_default=3930
 guardian_admin_port_default=3931
 chat_port_default=3920
 api_port_default=3921
+client_port_default=3910
 if [[ "$TARGET" == "portal-discord" ]]; then
   guardian_port_default=3940
   guardian_admin_port_default=3941
   chat_port_default=3942
   api_port_default=3943
+  client_port_default=3911
 fi
 
 usage() {
@@ -89,13 +91,17 @@ cleanup() {
     return
   fi
 
-  dev_compose down --remove-orphans --volumes >/dev/null 2>&1 || true
+  if [[ -f "$SMOKE_HOME/knowledge/env/stack.env" ]]; then
+    dev_compose down --remove-orphans --volumes >/dev/null 2>&1 || true
+  fi
   docker run --rm -v "$(dirname "$SMOKE_HOME"):/smoke-parent" alpine sh -c 'rm -rf "/smoke-parent/$1"' _ "$(basename "$SMOKE_HOME")" >/dev/null 2>&1 || true
 }
 trap cleanup EXIT
 
 echo "Preparing isolated smoke OP_HOME at ${SMOKE_HOME}..."
-dev_compose down --remove-orphans --volumes >/dev/null 2>&1 || true
+if [[ -f "$SMOKE_HOME/knowledge/env/stack.env" ]]; then
+  dev_compose down --remove-orphans --volumes >/dev/null 2>&1 || true
+fi
 docker run --rm -v "$(dirname "$SMOKE_HOME"):/smoke-parent" alpine sh -c "rm -rf /smoke-parent/$(basename "$SMOKE_HOME")" >/dev/null 2>&1 || true
 smoke_copy_skeleton "$SMOKE_HOME"
 smoke_write_stack_env "$SMOKE_HOME" "$PLATFORM_VERSION" \
@@ -103,7 +109,8 @@ smoke_write_stack_env "$SMOKE_HOME" "$PLATFORM_VERSION" \
   "${OP_ROOTLESS_SMOKE_GUARDIAN_PORT:-${guardian_port_default}}" \
   "${OP_ROOTLESS_SMOKE_GUARDIAN_ADMIN_PORT:-${guardian_admin_port_default}}" \
   "${OP_ROOTLESS_SMOKE_CHAT_PORT:-${chat_port_default}}" \
-  "${OP_ROOTLESS_SMOKE_API_PORT:-${api_port_default}}"
+  "${OP_ROOTLESS_SMOKE_API_PORT:-${api_port_default}}" \
+  "${OP_ROOTLESS_SMOKE_CLIENT_PORT:-${client_port_default}}"
 printf 'OP_HOST_UI_PORT=%s\n' "$UI_PORT" >> "$SMOKE_HOME/knowledge/env/stack.env"
 smoke_seed_secrets "$SMOKE_HOME" 'rootless-smoke-password'
 
diff --git a/scripts/rootless-smoke-fixture.sh b/scripts/rootless-smoke-fixture.sh
index 491582303..a17e103a5 100644
--- a/scripts/rootless-smoke-fixture.sh
+++ b/scripts/rootless-smoke-fixture.sh
@@ -58,7 +58,7 @@ smoke_seed_secrets() {
 # OP_HOST_UI_PORT, OP_ENABLED_ADDONS) after this returns.
 # Usage: smoke_write_stack_env <home> <platform_version> \
 #          <assistant_port> <guardian_port> <guardian_admin_port> \
-#          <chat_port> <api_port>
+#          <chat_port> <api_port> <client_port>
 smoke_write_stack_env() {
   local home="$1"
   local platform_version="$2"
@@ -67,6 +67,7 @@ smoke_write_stack_env() {
   local guardian_admin_port="$5"
   local chat_port="$6"
   local api_port="$7"
+  local client_port="$8"
 
   cat >"$home/knowledge/env/stack.env" <<EOF
 OP_HOME=${home}
@@ -84,6 +85,7 @@ OP_GUARDIAN_PORT=${guardian_port}
 OP_GUARDIAN_ADMIN_PORT=${guardian_admin_port}
 OP_CHAT_PORT=${chat_port}
 OP_API_PORT=${api_port}
+OP_CLIENT_PORT=${client_port}
 OP_SETUP_COMPLETE=true
 EOF
   chmod 600 "$home/knowledge/env/stack.env"
@@ -134,7 +136,11 @@ smoke_build_images() {
   # build time and fails if it is unset (see compose.dev.yml guardian args).
   # Bake the repo's exact version so the smoke image matches the source tree.
   GUARDIAN_VERSION="$(node -p "require('./packages/guardian/package.json').version")"
+  GUARDIAN_USE_LOCAL_SOURCE=true
+  SKELETON_USE_LOCAL_SOURCE=true
   export GUARDIAN_VERSION
+  export GUARDIAN_USE_LOCAL_SOURCE
+  export SKELETON_USE_LOCAL_SOURCE
   echo "Building images: $* (GUARDIAN_VERSION=${GUARDIAN_VERSION}) ..." >&2
   # --profile addon.chat makes the profiled guardian visible; addon.discord makes
   # the portal build target visible. compose.dev.yml supplies the build contexts.

From 210d3dd71d8493109e7b6e59dc840d08abb9a239 Mon Sep 17 00:00:00 2001
From: itlackey <itlackey@gmail.com>
Date: Wed, 8 Jul 2026 10:19:11 -0500
Subject: [PATCH 58/61] docs(release): add rc runbook

---
 docs/README.md                        |   1 +
 docs/operations/release-management.md |   7 +
 docs/operations/release-rc-runbook.md | 422 ++++++++++++++++++++++++++
 3 files changed, 430 insertions(+)
 create mode 100644 docs/operations/release-rc-runbook.md

diff --git a/docs/README.md b/docs/README.md
index 13589e3d7..f02a61d3c 100644
--- a/docs/README.md
+++ b/docs/README.md
@@ -32,6 +32,7 @@ Repo layout convention:
 | Document | Description |
 |---|---|
 | [release-management.md](operations/release-management.md) | Authoritative release guide: platform release boundaries, image/package versioning, and beta→stable cutover |
+| [release-rc-runbook.md](operations/release-rc-runbook.md) | Ordered RC release procedure with merge gates, commands, evidence capture, and post-publish verification |
 | [unit-all-rc-checklist.md](operations/unit-all-rc-checklist.md) | Coordinated `unit=all` release-candidate worksheet with commands, pass criteria, and evidence capture |
 | [manual-compose-runbook.md](operations/manual-compose-runbook.md) | Step-by-step manual host configuration (no scripts) |
 | [manual-headless-install.md](operations/manual-headless-install.md) | Hand-built install disk contract (tokens, auth.json, setup stamp) + scripted `openpalm install --file` |
diff --git a/docs/operations/release-management.md b/docs/operations/release-management.md
index 847fabf04..1fd97c296 100644
--- a/docs/operations/release-management.md
+++ b/docs/operations/release-management.md
@@ -8,6 +8,10 @@
 
 All releases run through `.github/workflows/release.yml` (manual `workflow_dispatch` only). Version computation and file stamping are handled by `scripts/bump-unit.mjs`. npm publishing flows through the reusable `.github/workflows/publish-npm-package.yml` (OIDC provenance, single trusted publisher).
 
+For an operator-grade, repeatable RC procedure with merge gates, exact commands,
+evidence capture, and post-publish verification, use the
+[RC release runbook](release-rc-runbook.md).
+
 **TAG-LAST:** The git tag and GitHub release are created as the very last step. "Tag exists = fully published." This makes releases safe to retry — re-running a failed release replays only the failed jobs.
 
 **Always dry-run first:** `dry_run=true` (the default) validates the entire plan, builds every artifact, and runs the test gate without publishing, committing, or tagging.
@@ -184,6 +188,9 @@ into a pre-publish and post-publish worksheet covering packaging, deployment,
 permissions, upgrade, rootless ownership, browser-backed flows, and shipped
 artifact verification.
 
+For the ordered execution procedure that drives that checklist, use the
+[RC release runbook](release-rc-runbook.md).
+
 - [ ] `electron-host`: launch Electron against a seeded install; verify the window lands on the client chat at `http://127.0.0.1:3890/chat`, and host routes remain available.
 - [ ] `host-ui`: run `openpalm admin`; verify the browser opens on the loopback host UI and `/host`, `/connections`, and `/chat` all load.
 - [ ] `assistant-container`: boot the assistant with `OP_CLIENT_VERSION` and `OP_SKELETON_VERSION` overrides; verify the container installs those exact versions, serves the static client on the assistant's published client port, and chat reaches the locked default assistant connection.
diff --git a/docs/operations/release-rc-runbook.md b/docs/operations/release-rc-runbook.md
new file mode 100644
index 000000000..78091b6ed
--- /dev/null
+++ b/docs/operations/release-rc-runbook.md
@@ -0,0 +1,422 @@
+# RC Release Runbook
+
+Repeatable operator runbook for cutting an OpenPalm release candidate with the
+single orchestrator at `.github/workflows/release.yml`.
+
+Use this alongside:
+
+- [Release Management](release-management.md)
+- [Unit=All RC Checklist](unit-all-rc-checklist.md)
+
+This runbook focuses on **how** to execute the checklist in a repeatable way:
+ordered steps, exact commands, evidence to capture, and go/no-go gates.
+
+---
+
+## Audience
+
+This is for the maintainer or operator preparing a coordinated release such as
+`0.13.0-rc.1`.
+
+---
+
+## Scope
+
+This runbook assumes a coordinated `unit=all` RC release and covers:
+
+- merge readiness
+- npm trusted-publisher readiness
+- workflow dry run
+- local/runtime validation
+- post-publish verification
+
+It does not replace the checklist; it tells you how to drive it.
+
+---
+
+## Release Variables
+
+Set these once in your shell before running the procedure.
+
+```bash
+export RELEASE_REF="main"
+export RC_VERSION="0.13.0-rc.1"
+export RC_UNIT="all"
+export REPO="$PWD"
+export RC_EVIDENCE_DIR="$REPO/.release-evidence/$RC_VERSION"
+mkdir -p "$RC_EVIDENCE_DIR"
+```
+
+Recommended convention:
+
+- `RELEASE_REF` should be the branch that actually contains the release workflow
+  changes you intend to use
+- for the final RC cut, that should normally be `main` after merge
+
+---
+
+## Go / No-Go Gates
+
+Do not merge and do not cut `0.13.0-rc.1` until every gate here is green.
+
+### Merge gates
+
+- [ ] release workflow changes required for the RC are merged
+- [ ] `git status --short` is clean on the merge target
+- [ ] `@openpalm/client` first-publish readiness is confirmed
+- [ ] all local blocker fixes are committed and pushed
+
+### RC cut gates
+
+- [ ] branch-correct `release.yml` dry run passes for `unit=all`
+- [ ] checklist items marked required in `unit-all-rc-checklist.md` pass
+- [ ] no unresolved security-boundary regressions remain
+- [ ] no unresolved rootless/ownership regressions remain
+- [ ] no unresolved guardian/client/skeleton artifact drift remains
+
+---
+
+## Step 1: Confirm Registry And Publisher Readiness
+
+### 1.1 Check which packages already exist
+
+```bash
+npm view @openpalm/client versions --json
+npm view @openpalm/guardian versions --json
+npm view @openpalm/skeleton versions --json
+npm view @openpalm/ui versions --json
+npm view openpalm versions --json
+```
+
+Expected at time of writing:
+
+- `@openpalm/client` may 404 if it has never been published
+- `@openpalm/guardian`, `@openpalm/skeleton`, `@openpalm/ui`, and `openpalm`
+  should already exist
+
+Record:
+
+- command output
+- whether `@openpalm/client` still needs first publish
+
+### 1.2 Confirm npm trusted publisher configuration
+
+Required packages:
+
+- `@openpalm/lib`
+- `openpalm`
+- `@openpalm/ui`
+- `@openpalm/client`
+- `@openpalm/skeleton`
+- `@openpalm/guardian`
+
+Required trusted publisher values:
+
+- Repository: `itlackey/openpalm`
+- Workflow: `release.yml`
+- Environment: none
+
+If `@openpalm/client` is new, this is the one package most likely to still need
+explicit npm-side setup.
+
+Pass criteria:
+
+- [ ] every required package has a matching trusted publisher entry
+- [ ] the maintainer account has publish rights to `@openpalm/client`
+
+---
+
+## Step 2: Confirm Merge Target Is Ready
+
+Run this on the branch you intend to merge.
+
+```bash
+git status --short
+git log --oneline -10
+```
+
+Pass criteria:
+
+- [ ] no uncommitted changes
+- [ ] intended release fixes are present
+
+If the release workflow or release-critical Docker/runtime fixes are not yet on
+the merge target, stop here and merge first.
+
+---
+
+## Step 3: Merge The Release Fixes
+
+Example sequence from a feature branch:
+
+```bash
+git checkout main
+git pull origin main
+git merge --ff-only <release-fix-branch>
+git push origin main
+```
+
+If fast-forward is not possible, use your normal reviewed merge process.
+
+Pass criteria:
+
+- [ ] merge target now contains the release workflow fixes
+- [ ] remote `main` is updated
+
+Important:
+
+- if you dispatch `gh workflow run release.yml` without `--ref`, GitHub uses the
+  workflow definition on the default branch
+- for final RC validation, this is desirable only after merge
+
+---
+
+## Step 4: Run The Coordinated Dry Run
+
+Dispatch the dry run from the merge target:
+
+```bash
+gh workflow run release.yml \
+  --ref "$RELEASE_REF" \
+  -f unit="$RC_UNIT" \
+  -f version="$RC_VERSION" \
+  -f dry_run=true
+```
+
+Then inspect the latest run:
+
+```bash
+gh run list --workflow release.yml --branch "$RELEASE_REF" --limit 5
+gh run view <run-id> --json status,conclusion,url,jobs
+```
+
+What to look for:
+
+- `Compute version (all)` success
+- `Preflight (test gate)` success
+- `Stamp <version>` success
+- `Docker openpalm/portal` success
+- `Docker openpalm/assistant` success
+- `Docker openpalm/guardian` success
+- npm dry-run jobs success
+- CLI binary jobs success
+- Electron jobs success
+
+Pass criteria:
+
+- [ ] entire dry run succeeds
+- [ ] no guardian Docker dry-run failure
+- [ ] no regression guard failure
+
+If a single job fails:
+
+```bash
+gh run view <run-id> --job <job-id> --log-failed
+```
+
+Capture the failing step and exact command/output.
+
+---
+
+## Step 5: Run Local Preflight Parity
+
+```bash
+bun install --frozen-lockfile
+bun run client:build
+bun run test
+bun run ui:check
+bun run ui-kit:check
+bun run client:check
+bun run --cwd packages/ui test:browsers
+bun run ui:test:unit
+bun run electron:test
+bun run guardian:test
+bun run cli:test
+```
+
+Guidance:
+
+- if `packages/ui test:browsers` fails only because Playwright tries to install
+  system packages with `sudo`, record it as an environment blocker rather than a
+  product regression
+- any real test failure in product code is a no-go
+
+Pass criteria:
+
+- [ ] all product tests/checks pass
+- [ ] any env-only limitation is understood and documented
+
+---
+
+## Step 6: Run Runtime Validation
+
+Use the dedicated checklist for exact items.
+
+Minimum required runtime validations before RC publish:
+
+- [ ] isolated assistant/client runtime
+- [ ] guardian direct-ingress/CORS/auth
+- [ ] browser-backed stack test
+- [ ] rootless ownership stack smoke
+- [ ] rootless portal-discord smoke
+- [ ] rootless host-swap smoke
+- [ ] fresh install smoke
+- [ ] upgrade smoke
+
+Reference commands and detailed pass criteria live in:
+
+- [Unit=All RC Checklist](unit-all-rc-checklist.md)
+- [Manual Compose Runbook](manual-compose-runbook.md)
+
+Guidance:
+
+- use unique ports/project names for every isolated stack run
+- collect guardian logs whenever a direct-ingress or auth path fails
+- when validating guardian behavior, prefer the actual built image/runtime over
+  source-only reasoning
+
+---
+
+## Step 7: Make The Merge Decision
+
+### Merge if all of these are true
+
+- [ ] workflow dry run is green on the merge target
+- [ ] no unresolved release blockers remain
+- [ ] any waivers are explicit and low risk
+
+### Do not merge if any of these are true
+
+- [ ] guardian Docker dry run still fails
+- [ ] `@openpalm/client` publish readiness is unknown
+- [ ] rootless ownership is still red
+- [ ] guardian direct-ingress behavior differs between source and built artifact
+- [ ] upgrade/rollback behavior has not been validated
+
+---
+
+## Step 8: Cut `0.13.0-rc.1`
+
+Only after merge and dry-run success:
+
+```bash
+gh workflow run release.yml \
+  --ref "$RELEASE_REF" \
+  -f unit="$RC_UNIT" \
+  -f version="$RC_VERSION" \
+  -f dry_run=false
+```
+
+Then monitor:
+
+```bash
+gh run list --workflow release.yml --branch "$RELEASE_REF" --limit 5
+gh run view <run-id> --json status,conclusion,url,jobs
+```
+
+If the live release fails partway through:
+
+```bash
+gh run rerun <run-id> --failed
+```
+
+Do not start a fresh release for the same version unless you have a specific,
+reviewed reason.
+
+---
+
+## Step 9: Post-Publish Verification
+
+Immediately verify the real artifacts.
+
+### npm
+
+```bash
+npm view @openpalm/lib@"$RC_VERSION" version
+npm view openpalm@"$RC_VERSION" version
+npm view @openpalm/ui@"$RC_VERSION" version
+npm view @openpalm/client@"$RC_VERSION" version
+npm view @openpalm/guardian@"$RC_VERSION" version
+npm view @openpalm/skeleton@"$RC_VERSION" version
+npm view @openpalm/discord-portal@"$RC_VERSION" version
+npm view @openpalm/slack-portal@"$RC_VERSION" version
+```
+
+### dist-tags
+
+```bash
+npm view @openpalm/client dist-tags --json
+npm view @openpalm/guardian dist-tags --json
+npm view @openpalm/skeleton dist-tags --json
+```
+
+### Docker
+
+```bash
+docker buildx imagetools inspect openpalm/assistant:"$RC_VERSION"
+docker buildx imagetools inspect openpalm/guardian:"$RC_VERSION"
+docker buildx imagetools inspect openpalm/portal:"$RC_VERSION"
+```
+
+### GitHub release and tags
+
+Verify:
+
+- `platform-$RC_VERSION`
+- `portals-$RC_VERSION`
+- `assistant-$RC_VERSION`
+- `guardian-$RC_VERSION`
+- `electron-$RC_VERSION`
+- `$RC_VERSION`
+
+Pass criteria:
+
+- [ ] all expected npm versions resolve
+- [ ] all expected Docker tags resolve
+- [ ] all expected tags/releases exist
+
+---
+
+## Step 10: Final RC Signoff
+
+Create a release note or signoff comment that includes:
+
+- RC version
+- release run URL
+- checklist status
+- any waivers
+- known issues still accepted into RC
+
+Recommended signoff template:
+
+```text
+OpenPalm 0.13.0-rc.1 signoff
+
+- Merge target: main
+- Release workflow run: <url>
+- Checklist: pass / fail / waived items listed below
+- npm verification: pass
+- Docker verification: pass
+- GitHub tags/release verification: pass
+- Known accepted RC limitations: <none or list>
+```
+
+---
+
+## Maintainer Notes
+
+- Prefer `--ref "$RELEASE_REF"` for all release workflow dispatches so the
+  intended workflow definition is used
+- Treat a new package like `@openpalm/client` as an npm-configuration task as
+  well as a code/release task
+- Keep the checklist and this runbook updated together; the checklist is the
+  gate list, this runbook is the operating procedure
+
+---
+
+## Related Docs
+
+- [Release Management](release-management.md)
+- [Unit=All RC Checklist](unit-all-rc-checklist.md)
+- [Manual Compose Runbook](manual-compose-runbook.md)
+- [Core Principles](../technical/core-principles.md)

From f1e485064b5e95d353d9b8d0f85f82eb558faf82 Mon Sep 17 00:00:00 2001
From: itlackey <itlackey@gmail.com>
Date: Wed, 8 Jul 2026 11:19:46 -0500
Subject: [PATCH 59/61] fix(cli): normalize install file setup UX

---
 docs/operations/manual-headless-install.md   |  50 ++++++++-
 packages/cli/src/commands/install.ts         |  34 +++---
 packages/cli/src/main.test.ts                | 108 +++++++++++++++++--
 packages/ui/e2e/admin-health.stack.ts        |  29 ++---
 packages/ui/e2e/admin-panel-browser.stack.ts |  30 +++---
 packages/ui/e2e/auth-boundary.stack.ts       |  11 +-
 packages/ui/e2e/auth-helpers.ts              |  56 ++++++++++
 packages/ui/e2e/secrets.stack.ts             |  33 +++---
 packages/ui/e2e/wizard-reset.ts              |  12 ++-
 9 files changed, 272 insertions(+), 91 deletions(-)
 create mode 100644 packages/ui/e2e/auth-helpers.ts

diff --git a/docs/operations/manual-headless-install.md b/docs/operations/manual-headless-install.md
index cf60e25cc..3747fee6e 100644
--- a/docs/operations/manual-headless-install.md
+++ b/docs/operations/manual-headless-install.md
@@ -147,12 +147,26 @@ wizard drives.
 
 ```yaml
 version: 2
+llm:
+  provider: openai
+  model: gpt-4o
+  baseUrl: https://api.openai.com/v1
+embedding:
+  provider: openai
+  model: text-embedding-3-small
+  dims: 1536
+  baseUrl: https://api.openai.com/v1
 security:
   uiLoginPassword: change-me-please # min 8 characters
-connections: []
+connections:
+  - id: openai
+    name: OpenAI
+    provider: openai
+    baseUrl: https://api.openai.com/v1
+    apiKey: sk-...
 ```
 
-`connections` is required (may be empty). Everything else is optional:
+Everything else is optional:
 
 ```yaml
 version: 2
@@ -193,6 +207,38 @@ openpalm install --file ./setup-spec.yaml               # write config and start
 you want to assert the config was assembled correctly without needing a
 Docker daemon to bring services up.
 
+### Persisting isolated runtime overrides
+
+When scripting an isolated install, set runtime overrides in the install shell.
+The CLI now persists the following non-secret overrides into
+`knowledge/env/stack.env` so a later `openpalm start` reuses the same isolated
+project and port layout automatically:
+
+- `OP_PROJECT_NAME`
+- `OP_ASSISTANT_PORT`
+- `OP_HOST_UI_PORT`
+- `OP_HOST_CLIENT_PORT`
+- `OP_CLIENT_PORT`
+
+Example:
+
+```bash
+OP_HOME="$PWD/.tmp-openpalm-install/home" \
+OP_PROJECT_NAME=openpalm-test-install \
+OP_ASSISTANT_PORT=4802 \
+OP_HOST_UI_PORT=9302 \
+OP_HOST_CLIENT_PORT=9392 \
+OP_CLIENT_PORT=3842 \
+openpalm install --file ./setup-spec.yaml --no-start
+
+# Later, the same install can be started without re-specifying those overrides:
+OP_HOME="$PWD/.tmp-openpalm-install/home" openpalm start
+```
+
+Without those persisted overrides, a later `openpalm start` falls back to the
+default project name and default ports, which can collide with a live local
+stack.
+
 ### Test coverage (the CI exercise)
 
 `packages/cli/src/main.test.ts` exercises `install --no-start --file <spec>`
diff --git a/packages/cli/src/commands/install.ts b/packages/cli/src/commands/install.ts
index 313f1de8b..d3ee7bde5 100644
--- a/packages/cli/src/commands/install.ts
+++ b/packages/cli/src/commands/install.ts
@@ -23,6 +23,7 @@ import {
   PLATFORM_VERSION,
   runDeploy,
   writeSystemEnv,
+  patchSecretsEnvFile,
   collectBindAddressWarnings,
   type SetupSpec,
 } from '@openpalm/lib';
@@ -308,20 +309,9 @@ async function runFileInstall(filePath: string, noStart: boolean, explicitImageT
   }
   const config = await parseConfigFile(filePath, await Bun.file(filePath).text());
 
-  // Normalize old wrapped format: { spec: { version, capabilities }, capabilities: [...] }
-  // into flat format:              { version, capabilities: {...}, connections: [...] }
-  if (config.spec && typeof config.spec === 'object') {
-    const spec = config.spec as Record<string, unknown>;
-    // Old format had connections array as top-level "capabilities"
-    if (Array.isArray(config.capabilities)) config.connections = config.capabilities;
-    config.version = spec.version;
-    config.capabilities = spec.capabilities;
-    delete config.spec;
-  }
-
   if (config.version !== 2) throw new Error('Setup config must be version 2. See example.spec.yaml for the format.');
-  if (!config.capabilities || typeof config.capabilities !== 'object' || Array.isArray(config.capabilities)) {
-    throw new Error('Setup config must contain a "capabilities" object (llm, embeddings).');
+  if ('spec' in config || 'capabilities' in config) {
+    throw new Error('Setup config must use the modern flat shape (`llm`, `embedding`, `security`, `connections`) — legacy `spec`/`capabilities` forms are no longer supported.');
   }
 
   // A deliberate --version pins the image tag; thread it into the spec so
@@ -342,6 +332,24 @@ async function runFileInstall(filePath: string, noStart: boolean, explicitImageT
 
   const result = await performSetup(config as unknown as SetupSpec);
   if (!result.ok) throw new Error(`Setup failed: ${result.error}`);
+
+  // Persist intentional non-secret runtime overrides from the install shell so
+  // a later `openpalm start` reuses the same isolated project/port shape instead
+  // of falling back to the live-stack defaults.
+  const runtimeOverrides = Object.fromEntries(
+    [
+      'OP_PROJECT_NAME',
+      'OP_ASSISTANT_PORT',
+      'OP_HOST_UI_PORT',
+      'OP_HOST_CLIENT_PORT',
+      'OP_CLIENT_PORT',
+    ].flatMap((key) => {
+      const value = process.env[key]?.trim();
+      return value ? [[key, value]] : [];
+    }),
+  );
+  patchSecretsEnvFile(process.env.OP_HOME ?? resolveOpenPalmHome(), runtimeOverrides);
+
   console.log('Setup complete.');
   if (noStart) { console.log('Config written. Run `openpalm start` to start services.'); return; }
   await requireDocker();
diff --git a/packages/cli/src/main.test.ts b/packages/cli/src/main.test.ts
index 7c60623f2..f345a87ca 100644
--- a/packages/cli/src/main.test.ts
+++ b/packages/cli/src/main.test.ts
@@ -14,12 +14,15 @@ function writeMinimalSetupSpec(dir: string): string {
   const specPath = join(dir, 'setup-spec.yaml');
   const yaml = [
     'version: 2',
-    'capabilities:',
-    '  llm: openai/gpt-4o',
-    '  embeddings:',
-    '    provider: openai',
-    '    model: text-embedding-3-small',
-    '    dims: 1536',
+    'llm:',
+    '  provider: openai',
+    '  model: gpt-4o',
+    '  baseUrl: https://api.openai.com/v1',
+    'embedding:',
+    '  provider: openai',
+    '  model: text-embedding-3-small',
+    '  dims: 1536',
+    '  baseUrl: https://api.openai.com/v1',
     'security:',
     '  uiLoginPassword: test-admin-token-12345',
     'owner:',
@@ -342,6 +345,99 @@ describe('cli main', () => {
     }
   });
 
+  it('persists install-time project and port overrides into stack.env for later start', async () => {
+    const base = mkdtempSync(join(tmpdir(), 'openpalm-install-overrides-'));
+    const workDir = join(base, 'work');
+    const specFile = writeMinimalSetupSpec(base);
+    const originalProject = process.env.OP_PROJECT_NAME;
+    const originalAssistantPort = process.env.OP_ASSISTANT_PORT;
+    const originalHostUiPort = process.env.OP_HOST_UI_PORT;
+    const originalHostClientPort = process.env.OP_HOST_CLIENT_PORT;
+    const originalClientPort = process.env.OP_CLIENT_PORT;
+
+    process.env.OP_HOME = base;
+    process.env.OP_WORK_DIR = workDir;
+    process.env.OP_PROJECT_NAME = 'openpalm-test-install';
+    process.env.OP_ASSISTANT_PORT = '4802';
+    process.env.OP_HOST_UI_PORT = '9300';
+    process.env.OP_HOST_CLIENT_PORT = '9390';
+    process.env.OP_CLIENT_PORT = '3842';
+
+    mockDockerCli();
+    globalThis.fetch = mock(async (input: string | URL) => {
+      const url = String(input);
+      if (url.endsWith('/health')) return new Response('ok', { status: 200 });
+      if (url.includes('/core.compose.yml') || url.includes('/compose.yml')) return new Response('services: {}\n', { status: 200 });
+      if (url.includes('/AGENTS.md')) return new Response('# Agents\n', { status: 200 });
+      if (url.includes('/opencode.jsonc')) return new Response('{"$schema":"https://opencode.ai/config.json"}\n', { status: 200 });
+      if (url.endsWith('.yml')) return new Response('name: test\nschedule: daily\n', { status: 200 });
+      return new Response('', { status: 503 });
+    }) as unknown as typeof fetch;
+    console.log = mock(() => {}) as typeof console.log;
+    console.warn = mock(() => {}) as typeof console.warn;
+
+    try {
+      await main(['install', '--no-start', '--file', specFile]);
+      const stackEnv = readFileSync(join(base, 'knowledge', 'env', 'stack.env'), 'utf-8');
+      expect(stackEnv).toContain('OP_PROJECT_NAME=openpalm-test-install');
+      expect(stackEnv).toContain('OP_ASSISTANT_PORT=4802');
+      expect(stackEnv).toContain('OP_HOST_UI_PORT=9300');
+      expect(stackEnv).toContain('OP_HOST_CLIENT_PORT=9390');
+      expect(stackEnv).toContain('OP_CLIENT_PORT=3842');
+    } finally {
+      if (originalProject === undefined) delete process.env.OP_PROJECT_NAME;
+      else process.env.OP_PROJECT_NAME = originalProject;
+      if (originalAssistantPort === undefined) delete process.env.OP_ASSISTANT_PORT;
+      else process.env.OP_ASSISTANT_PORT = originalAssistantPort;
+      if (originalHostUiPort === undefined) delete process.env.OP_HOST_UI_PORT;
+      else process.env.OP_HOST_UI_PORT = originalHostUiPort;
+      if (originalHostClientPort === undefined) delete process.env.OP_HOST_CLIENT_PORT;
+      else process.env.OP_HOST_CLIENT_PORT = originalHostClientPort;
+      if (originalClientPort === undefined) delete process.env.OP_CLIENT_PORT;
+      else process.env.OP_CLIENT_PORT = originalClientPort;
+      rmSync(base, { recursive: true, force: true });
+    }
+  });
+
+  it('rejects the legacy capabilities wrapper for install --file', async () => {
+    const base = mkdtempSync(join(tmpdir(), 'openpalm-install-legacy-'));
+    const workDir = join(base, 'work');
+    const specFile = join(base, 'setup-spec-legacy.yaml');
+    const mainPath = join(fileURLToPath(new URL('./', import.meta.url)), 'main.ts');
+    const yaml = [
+      'version: 2',
+      'capabilities:',
+      '  llm: openai/gpt-4o',
+      '  embeddings:',
+      '    provider: openai',
+      '    model: text-embedding-3-small',
+      '    dims: 1536',
+      'security:',
+      '  uiLoginPassword: test-admin-token-12345',
+      'connections: []',
+      '',
+    ].join('\n');
+    writeFileSync(specFile, yaml);
+
+    process.env.OP_HOME = base;
+    process.env.OP_WORK_DIR = workDir;
+
+    try {
+      const proc = Bun.spawn(['bun', mainPath, 'install', '--no-start', '--file', specFile], {
+        stdout: 'pipe',
+        stderr: 'pipe',
+        env: { ...process.env, OP_HOME: base, OP_WORK_DIR: workDir },
+      });
+      const stdout = await new Response(proc.stdout).text();
+      const stderr = await new Response(proc.stderr).text();
+      const code = await proc.exited;
+      expect(code).not.toBe(0);
+      expect(stdout + stderr).toContain('modern flat shape');
+    } finally {
+      rmSync(base, { recursive: true, force: true });
+    }
+  });
+
   it('supports addon enable/disable commands', async () => {
     const base = mkdtempSync(join(tmpdir(), 'openpalm-addon-cli-'));
     const coreCompose = join(base, 'system', 'stack', 'core.compose.yml');
diff --git a/packages/ui/e2e/admin-health.stack.ts b/packages/ui/e2e/admin-health.stack.ts
index def5628e0..1f6433045 100644
--- a/packages/ui/e2e/admin-health.stack.ts
+++ b/packages/ui/e2e/admin-health.stack.ts
@@ -10,24 +10,11 @@
  */
 
 import { expect, test } from '@playwright/test';
+import { loginHeaders } from './auth-helpers';
 
 const ADMIN_URL = process.env.ADMIN_URL ?? 'http://127.0.0.1:9100';
 const OP_UI_LOGIN_PASSWORD = process.env.OP_UI_LOGIN_PASSWORD ?? '';
 
-// Phase 2 (auth/proxy refactor): x-admin-token header fallback removed.
-// E2E tests authenticate via the op_session cookie. The cookie value is the
-// admin secret (same value the operator types into the wizard); the host UI
-// server treats a request bearing the correct cookie as an authenticated
-// admin session.
-function headers(): Record<string, string> {
-  return {
-    cookie: `op_session=${OP_UI_LOGIN_PASSWORD}`,
-    'x-requested-by': 'e2e-test',
-    'x-request-id': crypto.randomUUID(),
-    'content-type': 'application/json',
-  };
-}
-
 const SKIP = !process.env.RUN_DOCKER_STACK_TESTS;
 
 test.describe('Admin Health Endpoint', () => {
@@ -41,21 +28,21 @@ test.describe('Admin Health Endpoint', () => {
   });
 
   test('GET /api/host/health returns 200 with valid token', async ({ request }) => {
-    const res = await request.get(`${ADMIN_URL}/api/host/health`, { headers: headers() });
+    const res = await request.get(`${ADMIN_URL}/api/host/health`, { headers: await loginHeaders(request, ADMIN_URL, OP_UI_LOGIN_PASSWORD) });
     expect(res.ok()).toBeTruthy();
     const body = await res.json();
     expect(body.ok).toBe(true);
   });
 
   test('GET /api/host/health includes opencode availability flag', async ({ request }) => {
-    const res = await request.get(`${ADMIN_URL}/api/host/health`, { headers: headers() });
+    const res = await request.get(`${ADMIN_URL}/api/host/health`, { headers: await loginHeaders(request, ADMIN_URL, OP_UI_LOGIN_PASSWORD) });
     expect(res.ok()).toBeTruthy();
     const body = await res.json();
     expect(typeof body.opencode).toBe('boolean');
   });
 
   test('GET /api/host/health reports opencode reachable when assistant is running', async ({ request }) => {
-    const res = await request.get(`${ADMIN_URL}/api/host/health`, { headers: headers() });
+    const res = await request.get(`${ADMIN_URL}/api/host/health`, { headers: await loginHeaders(request, ADMIN_URL, OP_UI_LOGIN_PASSWORD) });
     expect(res.ok()).toBeTruthy();
     const body = await res.json();
     // Assistant container is running — opencode should be true
@@ -74,7 +61,7 @@ test.describe('Connections Tab — Providers', () => {
   });
 
   test('GET /api/host/providers returns available:true when assistant is running', async ({ request }) => {
-    const res = await request.get(`${ADMIN_URL}/api/host/providers`, { headers: headers() });
+    const res = await request.get(`${ADMIN_URL}/api/host/providers`, { headers: await loginHeaders(request, ADMIN_URL, OP_UI_LOGIN_PASSWORD) });
     expect(res.ok()).toBeTruthy();
     const body = await res.json();
     // Assistant is running so providers page should be available
@@ -82,7 +69,7 @@ test.describe('Connections Tab — Providers', () => {
   });
 
   test('GET /api/host/providers returns providers array', async ({ request }) => {
-    const res = await request.get(`${ADMIN_URL}/api/host/providers`, { headers: headers() });
+    const res = await request.get(`${ADMIN_URL}/api/host/providers`, { headers: await loginHeaders(request, ADMIN_URL, OP_UI_LOGIN_PASSWORD) });
     expect(res.ok()).toBeTruthy();
     const body = await res.json();
     expect(Array.isArray(body.providers)).toBe(true);
@@ -90,7 +77,7 @@ test.describe('Connections Tab — Providers', () => {
   });
 
   test('GET /api/host/providers includes stats', async ({ request }) => {
-    const res = await request.get(`${ADMIN_URL}/api/host/providers`, { headers: headers() });
+    const res = await request.get(`${ADMIN_URL}/api/host/providers`, { headers: await loginHeaders(request, ADMIN_URL, OP_UI_LOGIN_PASSWORD) });
     const body = await res.json();
     expect(typeof body.stats?.total).toBe('number');
     expect(typeof body.stats?.connected).toBe('number');
@@ -121,7 +108,7 @@ test.describe('Guardian liveness', () => {
   test('GET /api/host/health includes opencode field (guardian has no separate health field)', async ({ request }) => {
     // Admin health covers the OpenCode assistant. Guardian liveness is separate
     // (proxied above). Verify the admin health response shape hasn't regressed.
-    const res = await request.get(`${ADMIN_URL}/api/host/health`, { headers: headers() });
+    const res = await request.get(`${ADMIN_URL}/api/host/health`, { headers: await loginHeaders(request, ADMIN_URL, OP_UI_LOGIN_PASSWORD) });
     expect(res.ok()).toBeTruthy();
     const body = await res.json();
     expect(body.ok).toBe(true);
diff --git a/packages/ui/e2e/admin-panel-browser.stack.ts b/packages/ui/e2e/admin-panel-browser.stack.ts
index 910de49c8..dd6a1a41f 100644
--- a/packages/ui/e2e/admin-panel-browser.stack.ts
+++ b/packages/ui/e2e/admin-panel-browser.stack.ts
@@ -12,34 +12,30 @@
  */
 
 import { test, expect } from '@playwright/test';
+import { loginBrowserContext } from './auth-helpers';
 
 const ADMIN_URL = process.env.ADMIN_URL ?? 'http://127.0.0.1:9100';
 const PASSWORD = process.env.OP_UI_LOGIN_PASSWORD ?? '';
 const SKIP = !process.env.RUN_DOCKER_STACK_TESTS;
 
-async function withAuth(page: import('@playwright/test').Page) {
-  await page.context().addCookies([{
-    name: 'op_session',
-    value: PASSWORD,
-    domain: new URL(ADMIN_URL).hostname,
-    path: '/',
-  }]);
+async function withAuth(page: import('@playwright/test').Page, request: import('@playwright/test').APIRequestContext) {
+  await loginBrowserContext(request, page.context(), ADMIN_URL, PASSWORD);
 }
 
 test.describe('Admin panel browser smoke', () => {
   test.skip(!!SKIP, 'Requires RUN_DOCKER_STACK_TESTS=1 and running compose stack');
   test.setTimeout(45_000);
 
-  test('admin panel loads and shows the Overview tab by default', async ({ page }) => {
-    await withAuth(page);
+  test('admin panel loads and shows the Overview tab by default', async ({ page, request }) => {
+    await withAuth(page, request);
     await page.goto(ADMIN_URL, { waitUntil: 'networkidle' });
 
     // Overview / containers section is the default landing tab
     await expect(page.locator('[data-testid="containers-overview"]')).toBeVisible({ timeout: 15_000 });
   });
 
-  test('Overview tab shows at least one running container', async ({ page }) => {
-    await withAuth(page);
+  test('Overview tab shows at least one running container', async ({ page, request }) => {
+    await withAuth(page, request);
     await page.goto(ADMIN_URL, { waitUntil: 'networkidle' });
 
     await expect(page.locator('[data-testid="containers-overview"]')).toBeVisible({ timeout: 15_000 });
@@ -49,8 +45,8 @@ test.describe('Admin panel browser smoke', () => {
     await expect(containers.first()).toBeVisible({ timeout: 10_000 });
   });
 
-  test('Logs tab shows output after Load Logs — not raw error text', async ({ page }) => {
-    await withAuth(page);
+  test('Logs tab shows output after Load Logs — not raw error text', async ({ page, request }) => {
+    await withAuth(page, request);
     await page.goto(ADMIN_URL, { waitUntil: 'networkidle' });
 
     // Navigate to the Logs tab
@@ -77,8 +73,8 @@ test.describe('Admin panel browser smoke', () => {
     await expect(page.locator('[data-testid="log-output"], .log-output, pre')).toBeVisible({ timeout: 10_000 });
   });
 
-  test('Connections tab renders provider list — not raw error text', async ({ page }) => {
-    await withAuth(page);
+  test('Connections tab renders provider list — not raw error text', async ({ page, request }) => {
+    await withAuth(page, request);
     await page.goto(ADMIN_URL, { waitUntil: 'networkidle' });
 
     const connectionsTab = page.getByRole('tab', { name: /connections/i });
@@ -94,8 +90,8 @@ test.describe('Admin panel browser smoke', () => {
     await expect(providersOrMessage).toBeVisible({ timeout: 15_000 });
   });
 
-  test('Secrets tab renders the vault key list', async ({ page }) => {
-    await withAuth(page);
+  test('Secrets tab renders the vault key list', async ({ page, request }) => {
+    await withAuth(page, request);
     await page.goto(ADMIN_URL, { waitUntil: 'networkidle' });
 
     const secretsTab = page.getByRole('tab', { name: /secrets/i });
diff --git a/packages/ui/e2e/auth-boundary.stack.ts b/packages/ui/e2e/auth-boundary.stack.ts
index a470bbf60..b3888a04a 100644
--- a/packages/ui/e2e/auth-boundary.stack.ts
+++ b/packages/ui/e2e/auth-boundary.stack.ts
@@ -13,19 +13,12 @@
  */
 
 import { test, expect } from '@playwright/test';
+import { loginHeaders } from './auth-helpers';
 
 const ADMIN_URL = process.env.ADMIN_URL ?? 'http://127.0.0.1:9100';
 const PASSWORD = process.env.OP_UI_LOGIN_PASSWORD ?? '';
 const SKIP = !process.env.RUN_DOCKER_STACK_TESTS;
 
-function authCookie(): Record<string, string> {
-  return {
-    cookie: `op_session=${PASSWORD}`,
-    'x-requested-by': 'e2e-test',
-    'x-request-id': crypto.randomUUID(),
-  };
-}
-
 function wrongCookie(): Record<string, string> {
   return {
     cookie: 'op_session=definitely-wrong-token',
@@ -65,7 +58,7 @@ test.describe('Auth boundary — protected endpoints', () => {
     });
 
     test(`GET ${endpoint} returns 200 with valid cookie`, async ({ request }) => {
-      const res = await request.get(`${ADMIN_URL}${endpoint}`, { headers: authCookie() });
+      const res = await request.get(`${ADMIN_URL}${endpoint}`, { headers: await loginHeaders(request, ADMIN_URL, PASSWORD) });
       // Allow 200 or 503 (service unavailable is OK — just not an auth failure)
       expect(res.status()).not.toBe(401);
       expect(res.status()).not.toBe(403);
diff --git a/packages/ui/e2e/auth-helpers.ts b/packages/ui/e2e/auth-helpers.ts
new file mode 100644
index 000000000..64529ec91
--- /dev/null
+++ b/packages/ui/e2e/auth-helpers.ts
@@ -0,0 +1,56 @@
+import type { APIRequestContext, BrowserContext } from '@playwright/test';
+
+function extractSessionCookie(setCookie: string | undefined): string {
+  if (!setCookie) throw new Error('Login response did not include Set-Cookie');
+  const match = setCookie.match(/(?:^|,\s*)op_session=([^;]+)/);
+  if (!match) throw new Error(`Could not parse op_session from Set-Cookie: ${setCookie}`);
+  return match[1];
+}
+
+export async function loginAndGetSessionCookie(
+  request: APIRequestContext,
+  adminUrl: string,
+  password: string,
+): Promise<string> {
+  const res = await request.post(`${adminUrl}/api/auth/login`, {
+    data: { password },
+  });
+  if (!res.ok()) {
+    throw new Error(`Login failed: ${res.status()} ${await res.text()}`);
+  }
+  return extractSessionCookie(res.headers()['set-cookie']);
+}
+
+export async function loginHeaders(
+  request: APIRequestContext,
+  adminUrl: string,
+  password: string,
+): Promise<Record<string, string>> {
+  const cookie = await loginAndGetSessionCookie(request, adminUrl, password);
+  return {
+    cookie: `op_session=${cookie}`,
+    'x-requested-by': 'e2e-test',
+    'x-request-id': crypto.randomUUID(),
+    'content-type': 'application/json',
+  };
+}
+
+export async function loginBrowserContext(
+  request: APIRequestContext,
+  context: BrowserContext,
+  adminUrl: string,
+  password: string,
+): Promise<void> {
+  const cookie = await loginAndGetSessionCookie(request, adminUrl, password);
+  const url = new URL(adminUrl);
+  await context.addCookies([
+    {
+      name: 'op_session',
+      value: cookie,
+      domain: url.hostname,
+      path: '/',
+      httpOnly: true,
+      sameSite: 'Lax',
+    },
+  ]);
+}
diff --git a/packages/ui/e2e/secrets.stack.ts b/packages/ui/e2e/secrets.stack.ts
index 6a6c1a25f..2589c46f5 100644
--- a/packages/ui/e2e/secrets.stack.ts
+++ b/packages/ui/e2e/secrets.stack.ts
@@ -16,6 +16,7 @@
  */
 
 import { test, expect } from '@playwright/test';
+import { loginHeaders } from './auth-helpers';
 
 const ADMIN_URL = process.env.ADMIN_URL ?? 'http://127.0.0.1:9100';
 const PASSWORD = process.env.OP_UI_LOGIN_PASSWORD ?? '';
@@ -24,14 +25,8 @@ const SKIP = !process.env.RUN_DOCKER_STACK_TESTS;
 const TEST_KEY = 'E2E_SECRETS_TEST_KEY';
 const VAULT_URL = `${ADMIN_URL}/api/host/secrets/user-env`;
 
-function headers(extra: Record<string, string> = {}): Record<string, string> {
-  return {
-    cookie: `op_session=${PASSWORD}`,
-    'x-requested-by': 'e2e-test',
-    'x-request-id': crypto.randomUUID(),
-    'content-type': 'application/json',
-    ...extra,
-  };
+async function headers(request: import('@playwright/test').APIRequestContext, extra: Record<string, string> = {}): Promise<Record<string, string>> {
+  return { ...(await loginHeaders(request, ADMIN_URL, PASSWORD)), ...extra };
 }
 
 test.describe('Secrets CRUD', () => {
@@ -40,11 +35,11 @@ test.describe('Secrets CRUD', () => {
 
   test.afterAll(async ({ request }) => {
     // Best-effort cleanup in case a test failed mid-way.
-    await request.delete(`${VAULT_URL}?key=${TEST_KEY}`, { headers: headers() }).catch(() => {});
+    await request.delete(`${VAULT_URL}?key=${TEST_KEY}`, { headers: await headers(request) }).catch(() => {});
   });
 
   test('GET /api/host/secrets/user-env returns env metadata', async ({ request }) => {
-    const res = await request.get(VAULT_URL, { headers: headers() });
+    const res = await request.get(VAULT_URL, { headers: await headers(request) });
     expect(res.ok()).toBeTruthy();
     const body = await res.json();
     expect(body.provider).toBe('akm');
@@ -54,7 +49,7 @@ test.describe('Secrets CRUD', () => {
 
   test('POST writes a key and returns ok:true', async ({ request }) => {
     const res = await request.post(VAULT_URL, {
-      headers: headers(),
+      headers: await headers(request),
       data: { key: TEST_KEY, value: 'e2e-test-value' },
     });
     expect(res.ok(), `POST failed: ${res.status()}`).toBeTruthy();
@@ -64,14 +59,14 @@ test.describe('Secrets CRUD', () => {
   });
 
   test('GET after POST includes the new key in the list', async ({ request }) => {
-    const res = await request.get(VAULT_URL, { headers: headers() });
+    const res = await request.get(VAULT_URL, { headers: await headers(request) });
     expect(res.ok()).toBeTruthy();
     const body = await res.json();
     expect(body.keys).toContain(TEST_KEY);
   });
 
   test('GET never returns secret values — only key names', async ({ request }) => {
-    const res = await request.get(VAULT_URL, { headers: headers() });
+    const res = await request.get(VAULT_URL, { headers: await headers(request) });
     expect(res.ok()).toBeTruthy();
     const body = await res.json();
     // The response shape must only have: provider, envRef, keys
@@ -83,7 +78,7 @@ test.describe('Secrets CRUD', () => {
   });
 
   test('DELETE removes the key and returns ok:true', async ({ request }) => {
-    const res = await request.delete(`${VAULT_URL}?key=${TEST_KEY}`, { headers: headers() });
+    const res = await request.delete(`${VAULT_URL}?key=${TEST_KEY}`, { headers: await headers(request) });
     expect(res.ok(), `DELETE failed: ${res.status()}`).toBeTruthy();
     const body = await res.json();
     expect(body.ok).toBe(true);
@@ -91,7 +86,7 @@ test.describe('Secrets CRUD', () => {
   });
 
   test('GET after DELETE does not include the key', async ({ request }) => {
-    const res = await request.get(VAULT_URL, { headers: headers() });
+    const res = await request.get(VAULT_URL, { headers: await headers(request) });
     expect(res.ok()).toBeTruthy();
     const body = await res.json();
     expect(body.keys).not.toContain(TEST_KEY);
@@ -104,7 +99,7 @@ test.describe('Secrets — input validation', () => {
 
   test('POST returns 400 for key with invalid characters', async ({ request }) => {
     const res = await request.post(VAULT_URL, {
-      headers: headers(),
+      headers: await headers(request),
       data: { key: 'invalid-key-with-dashes', value: 'somevalue' },
     });
     expect(res.status()).toBe(400);
@@ -112,7 +107,7 @@ test.describe('Secrets — input validation', () => {
 
   test('POST returns 400 for key starting with a digit', async ({ request }) => {
     const res = await request.post(VAULT_URL, {
-      headers: headers(),
+      headers: await headers(request),
       data: { key: '1_STARTS_WITH_DIGIT', value: 'somevalue' },
     });
     expect(res.status()).toBe(400);
@@ -120,14 +115,14 @@ test.describe('Secrets — input validation', () => {
 
   test('POST returns 400 for empty value', async ({ request }) => {
     const res = await request.post(VAULT_URL, {
-      headers: headers(),
+      headers: await headers(request),
       data: { key: 'VALID_KEY', value: '' },
     });
     expect(res.status()).toBe(400);
   });
 
   test('DELETE returns 400 for missing key parameter', async ({ request }) => {
-    const res = await request.delete(VAULT_URL, { headers: headers() });
+    const res = await request.delete(VAULT_URL, { headers: await headers(request) });
     expect(res.status()).toBe(400);
   });
 });
diff --git a/packages/ui/e2e/wizard-reset.ts b/packages/ui/e2e/wizard-reset.ts
index 97242c3ef..ad1406f00 100644
--- a/packages/ui/e2e/wizard-reset.ts
+++ b/packages/ui/e2e/wizard-reset.ts
@@ -34,8 +34,12 @@ function stackEnvPath(homeDir: string): string {
 	return resolve(homeDir, 'knowledge/env/stack.env');
 }
 
+function stateEnvPath(homeDir: string): string {
+	return resolve(homeDir, 'state/stack.state.env');
+}
+
 function backupPath(homeDir: string): string {
-	return resolve(homeDir, 'knowledge/env/stack.env.wizard-test-backup');
+	return resolve(homeDir, 'state/stack.state.env.wizard-test-backup');
 }
 
 function assertSafeHome(homeDir: string): void {
@@ -55,10 +59,10 @@ function assertSafeHome(homeDir: string): void {
  */
 export function resetWizardState(homeDir: string = resolveOpHome()): void {
 	assertSafeHome(homeDir);
-	const envPath = stackEnvPath(homeDir);
+	const envPath = stateEnvPath(homeDir);
 	const bak = backupPath(homeDir);
 	if (!existsSync(envPath)) {
-		throw new Error(`stack.env not found at ${envPath}; the dev stack must be set up first.`);
+		throw new Error(`state env not found at ${envPath}; the dev stack must be set up first.`);
 	}
 
 	// First reset wins: backup only if no backup yet.
@@ -87,7 +91,7 @@ export function resetWizardState(homeDir: string = resolveOpHome()): void {
  */
 export function restoreWizardState(homeDir: string = resolveOpHome()): void {
 	assertSafeHome(homeDir);
-	const envPath = stackEnvPath(homeDir);
+	const envPath = stateEnvPath(homeDir);
 	const bak = backupPath(homeDir);
 	if (!existsSync(bak)) return;
 	copyFileSync(bak, envPath);

From 8813d9b22f18fea58f4b4306f918661c0553e49d Mon Sep 17 00:00:00 2001
From: itlackey <itlackey@gmail.com>
Date: Wed, 8 Jul 2026 11:49:04 -0500
Subject: [PATCH 60/61] fix(ui): read persisted assistant port for default
 endpoint

---
 packages/ui/src/lib/server/endpoints.ts | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/packages/ui/src/lib/server/endpoints.ts b/packages/ui/src/lib/server/endpoints.ts
index a6775e49f..5483f2d72 100644
--- a/packages/ui/src/lib/server/endpoints.ts
+++ b/packages/ui/src/lib/server/endpoints.ts
@@ -23,7 +23,7 @@ import { readFileSync, writeFileSync, mkdirSync, existsSync, chmodSync, unlinkSy
 import { dirname } from 'node:path';
 import { randomUUID } from 'node:crypto';
 import { getState } from './state.js';
-import type { RemoteStatus } from '@openpalm/lib';
+import { readStackEnv, type RemoteStatus } from '@openpalm/lib';
 import type { ConnectionKind } from '$lib/types.js';
 
 export type ConnectionEntry = {
@@ -249,10 +249,11 @@ function writeFile(data: EndpointsFile): void {
 }
 
 function defaultEndpoint(): ActiveConnection {
+  const persisted = readStackEnv(getState().homeDir);
   const url =
     process.env.OP_OPENCODE_URL ??
     process.env.OP_ASSISTANT_URL ??
-    `http://127.0.0.1:${process.env.OP_ASSISTANT_PORT ?? '3800'}`;
+    `http://127.0.0.1:${process.env.OP_ASSISTANT_PORT ?? persisted.OP_ASSISTANT_PORT ?? '3800'}`;
   const username = process.env.OPENCODE_SERVER_USERNAME || 'openpalm';
   const password = process.env.OPENCODE_SERVER_PASSWORD || undefined;
   return {

From b629dc566317360c308a3d4d3e3769cc41667a7c Mon Sep 17 00:00:00 2001
From: itlackey <itlackey@gmail.com>
Date: Wed, 8 Jul 2026 14:03:55 -0500
Subject: [PATCH 61/61] fix(ui): stabilize release candidate test gates

---
 packages/cli/src/lib/client-server.ts         |  4 +-
 packages/client/src/lib/transport/index.ts    |  4 +-
 .../client/tests/transport-request.test.ts    |  2 +-
 .../test/harness-contract-drift.test.ts       |  5 +-
 .../guardian/src/proxy-moderation.test.ts     |  4 +-
 .../src/control-plane/apply-stack-di.test.ts  |  2 -
 .../control-plane/apply-validation.test.ts    |  6 +-
 .../src/control-plane/config-persistence.ts   |  2 +-
 .../guardian-rootless-entrypoint.test.ts      |  9 +-
 .../moderation-doc-contract.test.ts           |  3 +-
 .../portal-secret-contract.test.ts            |  2 +-
 .../control-plane/volume-ownership.test.ts    |  3 +-
 packages/ui/e2e/admin-panel-browser.stack.ts  | 49 +++++------
 packages/ui/e2e/auth-flow.pw.ts               |  2 +-
 packages/ui/e2e/chat-ui.stack.ts              | 39 +++------
 packages/ui/e2e/global-setup.ts               | 24 +++++-
 packages/ui/e2e/global-teardown.ts            | 22 +++--
 packages/ui/e2e/install-flow.stack.ts         | 59 +++++--------
 packages/ui/e2e/setup-wizard-api.stack.ts     | 82 +++----------------
 packages/ui/e2e/setup-wizard-browser.stack.ts | 10 +--
 packages/ui/e2e/wizard-reset.ts               | 18 ++--
 packages/ui/playwright.config.ts              |  3 +-
 packages/ui/src/hooks.server.ts               | 27 ++++--
 packages/ui/src/lib/actions/focus-trap.ts     |  7 +-
 .../chat/ChatInput.svelte.vitest.ts           |  4 +-
 .../chat/QuestionCard.svelte.vitest.ts        |  4 +-
 .../voice-state-conversation.svelte.vitest.ts | 35 ++++----
 .../ui/src/routes/guardian/health/+server.ts  | 31 ++++++-
 28 files changed, 230 insertions(+), 232 deletions(-)

diff --git a/packages/cli/src/lib/client-server.ts b/packages/cli/src/lib/client-server.ts
index 37e7c16bd..fccbb706a 100644
--- a/packages/cli/src/lib/client-server.ts
+++ b/packages/cli/src/lib/client-server.ts
@@ -25,7 +25,6 @@ import {
   resolveOpenPalmHome,
   writeClientRuntimeConfig,
 } from '@openpalm/lib';
-import { DEFAULT_CLIENT_PORT } from './ports.ts';
 
 const STOP_TIMEOUT_MS = 5_000;
 const RESPAWN_DELAY_MS = 1_000;
@@ -96,7 +95,8 @@ export interface ClientServerDeps {
  * client app.
  */
 export async function startClientServer(deps: ClientServerDeps = {}): Promise<ClientServerHandle | null> {
-  const port = deps.port ?? resolveClientAppPort(process.env);
+  const persistedEnv = readPersistedStackEnv();
+  const port = deps.port ?? resolveClientAppPort({ ...persistedEnv, ...process.env });
   const resolveBuildDir = deps.resolveBuildDir ?? resolveClientBuildDir;
   const exists = deps.existsSync ?? nodeExistsSync;
   const spawnFn = deps.spawnFn
diff --git a/packages/client/src/lib/transport/index.ts b/packages/client/src/lib/transport/index.ts
index 27682b887..6d8b3c33a 100644
--- a/packages/client/src/lib/transport/index.ts
+++ b/packages/client/src/lib/transport/index.ts
@@ -118,9 +118,7 @@ export function createTransport(options: TransportOptions): Transport {
           if (typeof payload === 'object' && payload !== null && 'parts' in payload) {
             return payload;
           }
-        } catch {
-          continue;
-        }
+        } catch {}
       }
     } catch (error) {
       throw error instanceof Error
diff --git a/packages/client/tests/transport-request.test.ts b/packages/client/tests/transport-request.test.ts
index b305f8157..18427a7a0 100644
--- a/packages/client/tests/transport-request.test.ts
+++ b/packages/client/tests/transport-request.test.ts
@@ -150,7 +150,7 @@ describe('transport request shaping (P5b item 1)', () => {
 
   test('sendMessage parses text/event-stream responses', async () => {
     const { createTransport } = await loadTransportModule();
-    const { fetch, calls } = recordingFetch((request) =>
+    const { fetch, calls } = recordingFetch(() =>
       new Response(byteStream(['event: message\ndata: {"parts":[{"type":"text","text":"via sse"}]}\n\n']), {
         headers: { 'content-type': 'text/event-stream' },
       })
diff --git a/packages/electron/test/harness-contract-drift.test.ts b/packages/electron/test/harness-contract-drift.test.ts
index 138d15561..036bfe449 100644
--- a/packages/electron/test/harness-contract-drift.test.ts
+++ b/packages/electron/test/harness-contract-drift.test.ts
@@ -39,9 +39,10 @@ interface Member {
 function extractMembers(objSrc: string): Member[] {
   const memberStartRe = /^ {2}(\w+)\(/gm;
   const starts: Array<{ name: string; idx: number }> = [];
-  let m: RegExpExecArray | null;
-  while ((m = memberStartRe.exec(objSrc))) {
+  let m = memberStartRe.exec(objSrc);
+  while (m) {
     starts.push({ name: m[1], idx: m.index });
+    m = memberStartRe.exec(objSrc);
   }
   return starts.map(({ name, idx }) => {
     const endMarker = objSrc.indexOf('\n  },', idx);
diff --git a/packages/guardian/src/proxy-moderation.test.ts b/packages/guardian/src/proxy-moderation.test.ts
index 22987c9ec..ba8ea205e 100644
--- a/packages/guardian/src/proxy-moderation.test.ts
+++ b/packages/guardian/src/proxy-moderation.test.ts
@@ -251,8 +251,8 @@ describe("/oc proxy — content moderation (§3.5, write-path only, fail-closed)
       await Bun.sleep(50);
     }
     expect(line).toBeDefined();
-    expect(line!.extra.error).toBe("content_blocked");
-    expect(line!.extra.reason).toBeTruthy();
+    expect(line?.extra.error).toBe("content_blocked");
+    expect(line?.extra.reason).toBeTruthy();
   });
 
   test("malicious /prompt_async body → 403 content_blocked (fail-closed)", async () => {
diff --git a/packages/lib/src/control-plane/apply-stack-di.test.ts b/packages/lib/src/control-plane/apply-stack-di.test.ts
index 30e834628..87df182d5 100644
--- a/packages/lib/src/control-plane/apply-stack-di.test.ts
+++ b/packages/lib/src/control-plane/apply-stack-di.test.ts
@@ -51,8 +51,6 @@ class FakeDocker implements DockerClient {
   }
 }
 
-/** `compose ps --format json` row: running, no healthcheck ⇒ healthy. */
-const HEALTHY_PS_ROW = JSON.stringify({ Service: "assistant", State: "running", Health: "" });
 /** Running but explicitly unhealthy. */
 const UNHEALTHY_PS_ROW = JSON.stringify({ Service: "assistant", State: "running", Health: "unhealthy" });
 
diff --git a/packages/lib/src/control-plane/apply-validation.test.ts b/packages/lib/src/control-plane/apply-validation.test.ts
index 74d3c9b1e..2040f5507 100644
--- a/packages/lib/src/control-plane/apply-validation.test.ts
+++ b/packages/lib/src/control-plane/apply-validation.test.ts
@@ -24,7 +24,11 @@ const SHIPPED_STACK_DIR = join(dirname(fileURLToPath(import.meta.url)), '..', '.
 const homes: string[] = [];
 
 afterEach(() => {
-  while (homes.length) rmSync(homes.pop()!, { recursive: true, force: true });
+  let home = homes.pop();
+  while (home) {
+    rmSync(home, { recursive: true, force: true });
+    home = homes.pop();
+  }
 });
 
 /** A temp OP_HOME seeded with the shipped compose overlays + a valid stack env. */
diff --git a/packages/lib/src/control-plane/config-persistence.ts b/packages/lib/src/control-plane/config-persistence.ts
index 729221516..aee4f566c 100644
--- a/packages/lib/src/control-plane/config-persistence.ts
+++ b/packages/lib/src/control-plane/config-persistence.ts
@@ -383,7 +383,7 @@ export function discoverHomeBindMountSources(
       // volume`) carry a volume name, not a path.
       if (vol.type && vol.type !== 'bind') continue;
       const source = vol.source;
-      if (!source || !source.startsWith('/')) continue;
+      if (!source?.startsWith('/')) continue;
       const resolvedHostPath = resolvePath(source);
       if (!resolvedHostPath.startsWith(`${homeRoot}/`) && resolvedHostPath !== homeRoot) continue;
 
diff --git a/packages/lib/src/control-plane/guardian-rootless-entrypoint.test.ts b/packages/lib/src/control-plane/guardian-rootless-entrypoint.test.ts
index 85094d4e6..33b675a31 100644
--- a/packages/lib/src/control-plane/guardian-rootless-entrypoint.test.ts
+++ b/packages/lib/src/control-plane/guardian-rootless-entrypoint.test.ts
@@ -35,13 +35,15 @@ describe('guardian rootless entrypoint regressions', () => {
       /install_artifact "\$OP_GUARDIAN_PACKAGE" "\$VERSION" (\S+)/,
     );
     expect(installMatch).not.toBeNull();
-    const installPrefix = installMatch![1];
+    if (!installMatch) throw new Error('guardian entrypoint install prefix not found');
+    const installPrefix = installMatch[1];
 
     const bakeMatch = guardianDockerfile.match(
       /\(cd (\S+) && bun add "\$guardian_spec"/,
     );
     expect(bakeMatch).not.toBeNull();
-    const bakePrefix = bakeMatch![1];
+    if (!bakeMatch) throw new Error('guardian Dockerfile bake prefix not found');
+    const bakePrefix = bakeMatch[1];
 
     // Both build-time bake and boot-time install/skip-check must agree on
     // the same prefix, or the already-at-version check in install_artifact()
@@ -53,7 +55,8 @@ describe('guardian rootless entrypoint regressions', () => {
     // top-level `secrets:`/`volumes:` key).
     const guardianServiceMatch = portalsCompose.match(/\n {2}guardian:\n([\s\S]*?)\n(?=\S)/);
     expect(guardianServiceMatch).not.toBeNull();
-    const guardianServiceBlock = guardianServiceMatch![1];
+    if (!guardianServiceMatch) throw new Error('guardian service block not found');
+    const guardianServiceBlock = guardianServiceMatch[1];
     const mountTargets = [...guardianServiceBlock.matchAll(/- \S+:(\/opt\/openpalm\S*)/g)].map(
       (m) => m[1],
     );
diff --git a/packages/lib/src/control-plane/moderation-doc-contract.test.ts b/packages/lib/src/control-plane/moderation-doc-contract.test.ts
index a3ecfb2dd..676613771 100644
--- a/packages/lib/src/control-plane/moderation-doc-contract.test.ts
+++ b/packages/lib/src/control-plane/moderation-doc-contract.test.ts
@@ -52,7 +52,8 @@ describe("guardian moderation.md doc contract (fable 1.2)", () => {
   test("core-principles.md's config/ guardian/ subtree bullet does not claim to hold moderation.md", () => {
     const configSectionMatch = doc.match(/### 1\) Config[\s\S]*?### 1b\)/);
     expect(configSectionMatch).not.toBeNull();
-    const configSection = configSectionMatch![0];
+    if (!configSectionMatch) throw new Error('Config section not found');
+    const configSection = configSectionMatch[0];
     const guardianBullet = configSection.split("\n").find((line) => line.startsWith("- `guardian/`"));
     expect(guardianBullet).toBeDefined();
     expect(guardianBullet).not.toContain("instructions/moderation.md");
diff --git a/packages/lib/src/control-plane/portal-secret-contract.test.ts b/packages/lib/src/control-plane/portal-secret-contract.test.ts
index e10783f74..c5d806e5b 100644
--- a/packages/lib/src/control-plane/portal-secret-contract.test.ts
+++ b/packages/lib/src/control-plane/portal-secret-contract.test.ts
@@ -113,7 +113,7 @@ describe("portal verification-secret contract (compose ↔ portalSecretName ↔
     });
 
     it("declares op_api_key at the top level, file-backed under knowledge/secrets/", () => {
-      const decl = topLevelSecrets["op_api_key"];
+      const decl = topLevelSecrets.op_api_key;
       expect(decl, "top-level secrets: must declare op_api_key").toBeDefined();
       expect(basename(decl?.file ?? "")).toBe("op_api_key");
       expect(decl?.file).toContain("/knowledge/secrets/");
diff --git a/packages/lib/src/control-plane/volume-ownership.test.ts b/packages/lib/src/control-plane/volume-ownership.test.ts
index d2eb01be8..b613f79bd 100644
--- a/packages/lib/src/control-plane/volume-ownership.test.ts
+++ b/packages/lib/src/control-plane/volume-ownership.test.ts
@@ -13,10 +13,9 @@
  * in a fresh subprocess.
  */
 import { describe, test, expect } from 'bun:test';
-import { mkdtempSync, mkdirSync, rmSync, writeFileSync } from 'node:fs';
+import { mkdtempSync, rmSync, writeFileSync } from 'node:fs';
 import { spawnSync } from 'node:child_process';
 import { join } from 'node:path';
-import { tmpdir } from 'node:os';
 import { fileURLToPath } from 'node:url';
 
 const dockerUrl = new URL('./docker.js', import.meta.url).href;
diff --git a/packages/ui/e2e/admin-panel-browser.stack.ts b/packages/ui/e2e/admin-panel-browser.stack.ts
index dd6a1a41f..96a14af88 100644
--- a/packages/ui/e2e/admin-panel-browser.stack.ts
+++ b/packages/ui/e2e/admin-panel-browser.stack.ts
@@ -15,6 +15,7 @@ import { test, expect } from '@playwright/test';
 import { loginBrowserContext } from './auth-helpers';
 
 const ADMIN_URL = process.env.ADMIN_URL ?? 'http://127.0.0.1:9100';
+const HOST_URL = `${ADMIN_URL}/host`;
 const PASSWORD = process.env.OP_UI_LOGIN_PASSWORD ?? '';
 const SKIP = !process.env.RUN_DOCKER_STACK_TESTS;
 
@@ -28,39 +29,41 @@ test.describe('Admin panel browser smoke', () => {
 
   test('admin panel loads and shows the Overview tab by default', async ({ page, request }) => {
     await withAuth(page, request);
-    await page.goto(ADMIN_URL, { waitUntil: 'networkidle' });
+    await page.goto(HOST_URL, { waitUntil: 'networkidle' });
 
-    // Overview / containers section is the default landing tab
-    await expect(page.locator('[data-testid="containers-overview"]')).toBeVisible({ timeout: 15_000 });
+    // Overview status is the default host-console landing view.
+    const statusCard = page.getByRole('status');
+    await expect(statusCard).toBeVisible({ timeout: 15_000 });
+    await expect(statusCard.getByRole('button', { name: /check for updates/i })).toBeVisible();
   });
 
   test('Overview tab shows at least one running container', async ({ page, request }) => {
     await withAuth(page, request);
-    await page.goto(ADMIN_URL, { waitUntil: 'networkidle' });
+    await page.goto(HOST_URL, { waitUntil: 'networkidle' });
 
-    await expect(page.locator('[data-testid="containers-overview"]')).toBeVisible({ timeout: 15_000 });
+    await page.getByRole('tab', { name: /systems/i }).click();
+    await expect(page.getByRole('heading', { name: /container status/i })).toBeVisible({ timeout: 15_000 });
 
-    // At least one container card or row must be visible
-    const containers = page.locator('[data-testid^="container-"]');
-    await expect(containers.first()).toBeVisible({ timeout: 10_000 });
+    // At least the core assistant row must be visible in a running stack.
+    await expect(page.getByRole('button', { name: /assistant/i })).toBeVisible({ timeout: 10_000 });
   });
 
   test('Logs tab shows output after Load Logs — not raw error text', async ({ page, request }) => {
     await withAuth(page, request);
-    await page.goto(ADMIN_URL, { waitUntil: 'networkidle' });
+    await page.goto(HOST_URL, { waitUntil: 'networkidle' });
 
-    // Navigate to the Logs tab
-    const logsTab = page.getByRole('tab', { name: /logs/i });
+    // Navigate to the Journal tab
+    const logsTab = page.getByRole('tab', { name: /journal/i });
     await expect(logsTab).toBeVisible({ timeout: 10_000 });
     await logsTab.click();
 
     // Pick any service from the selector
-    const serviceSelect = page.locator('select[name="service"], [data-testid="log-service-select"]');
+    const serviceSelect = page.locator('#log-service');
     await expect(serviceSelect).toBeVisible({ timeout: 5_000 });
     await serviceSelect.selectOption({ index: 1 });
 
     // Click Load Logs
-    const loadBtn = page.getByRole('button', { name: /load logs/i });
+    const loadBtn = page.getByRole('button', { name: /load service logs/i });
     await expect(loadBtn).toBeVisible();
     await loadBtn.click();
 
@@ -75,9 +78,9 @@ test.describe('Admin panel browser smoke', () => {
 
   test('Connections tab renders provider list — not raw error text', async ({ page, request }) => {
     await withAuth(page, request);
-    await page.goto(ADMIN_URL, { waitUntil: 'networkidle' });
+    await page.goto(HOST_URL, { waitUntil: 'networkidle' });
 
-    const connectionsTab = page.getByRole('tab', { name: /connections/i });
+    const connectionsTab = page.getByRole('tab', { name: /mind/i });
     await expect(connectionsTab).toBeVisible({ timeout: 10_000 });
     await connectionsTab.click();
 
@@ -86,29 +89,29 @@ test.describe('Admin panel browser smoke', () => {
     await expect(page.locator('text=fetch failed')).not.toBeVisible({ timeout: 5_000 });
     await expect(page.locator('text=[object Object]')).not.toBeVisible();
 
-    const providersOrMessage = page.locator('[data-testid="providers-panel"], [data-testid="providers-unavailable"]');
-    await expect(providersOrMessage).toBeVisible({ timeout: 15_000 });
+    await expect(page.getByRole('heading', { name: /connections/i })).toBeVisible({ timeout: 15_000 });
+    await expect(page.getByRole('button', { name: /add provider/i })).toBeVisible();
   });
 
   test('Secrets tab renders the vault key list', async ({ page, request }) => {
     await withAuth(page, request);
-    await page.goto(ADMIN_URL, { waitUntil: 'networkidle' });
+    await page.goto(HOST_URL, { waitUntil: 'networkidle' });
 
+    await page.getByRole('tab', { name: /knowledge/i }).click();
     const secretsTab = page.getByRole('tab', { name: /secrets/i });
     await expect(secretsTab).toBeVisible({ timeout: 10_000 });
     await secretsTab.click();
 
-    // The secrets panel or an "add your first secret" empty state must render
-    const secretsPanel = page.locator('[data-testid="secrets-panel"], [data-testid="secrets-empty"]');
-    await expect(secretsPanel).toBeVisible({ timeout: 10_000 });
+    await expect(page.getByRole('heading', { name: /secrets/i })).toBeVisible({ timeout: 10_000 });
+    await expect(page.getByRole('button', { name: /refresh/i })).toBeVisible();
   });
 
   test('unauthenticated request to admin panel is redirected to auth gate', async ({ page }) => {
     // No cookie set
-    await page.goto(ADMIN_URL);
+    await page.goto(HOST_URL);
     // Should land on a login/auth page, not show admin content
     await expect(page).not.toHaveURL(/\/setup/);
     // The message input or containers overview must NOT be visible without auth
-    await expect(page.locator('[data-testid="containers-overview"]')).not.toBeVisible({ timeout: 5_000 });
+    await expect(page.getByRole('heading', { name: /container status/i })).not.toBeVisible({ timeout: 5_000 });
   });
 });
diff --git a/packages/ui/e2e/auth-flow.pw.ts b/packages/ui/e2e/auth-flow.pw.ts
index 882d24c7c..42372cf97 100644
--- a/packages/ui/e2e/auth-flow.pw.ts
+++ b/packages/ui/e2e/auth-flow.pw.ts
@@ -18,7 +18,7 @@
  */
 import { test, expect } from '@playwright/test';
 
-const PASSWORD = 'e2e-mocked-password'; // must match playwright.config.ts's MOCKED_ENV
+const PASSWORD = process.env.OP_UI_LOGIN_PASSWORD ?? 'e2e-mocked-password';
 
 test.describe('Auth flow — login / session / logout (mocked-lib)', () => {
   test('wrong password is rejected with 401 and no cookie', async ({ request }) => {
diff --git a/packages/ui/e2e/chat-ui.stack.ts b/packages/ui/e2e/chat-ui.stack.ts
index 05aa8cad7..b19203218 100644
--- a/packages/ui/e2e/chat-ui.stack.ts
+++ b/packages/ui/e2e/chat-ui.stack.ts
@@ -10,6 +10,7 @@
  */
 
 import { test, expect } from '@playwright/test';
+import { loginBrowserContext } from './auth-helpers';
 
 const ADMIN_URL = process.env.ADMIN_URL ?? 'http://127.0.0.1:9100';
 const PASSWORD = process.env.OP_UI_LOGIN_PASSWORD ?? '';
@@ -27,30 +28,19 @@ test.describe('Chat UI', () => {
     expect(status).toBe('complete');
   });
 
-  test('chat page renders message input after auth', async ({ page }) => {
-    // Set session cookie directly so we skip the auth gate form.
-    await page.context().addCookies([{
-      name: 'op_session',
-      value: PASSWORD,
-      domain: new URL(ADMIN_URL).hostname,
-      path: '/',
-    }]);
+  test('chat page renders message input after auth', async ({ page, request }) => {
+    await loginBrowserContext(request, page.context(), ADMIN_URL, PASSWORD);
 
-    await page.goto(`${ADMIN_URL}/chat`, { waitUntil: 'networkidle' });
+    await page.goto(`${ADMIN_URL}/chat`, { waitUntil: 'domcontentloaded' });
 
     // The message input is always rendered (even with no sessions).
     await expect(page.locator('[aria-label="Message input"]')).toBeVisible({ timeout: 10_000 });
   });
 
-  test('message input accepts text and enables send button', async ({ page }) => {
-    await page.context().addCookies([{
-      name: 'op_session',
-      value: PASSWORD,
-      domain: new URL(ADMIN_URL).hostname,
-      path: '/',
-    }]);
+  test('message input accepts text and enables send button', async ({ page, request }) => {
+    await loginBrowserContext(request, page.context(), ADMIN_URL, PASSWORD);
 
-    await page.goto(`${ADMIN_URL}/chat`, { waitUntil: 'networkidle' });
+    await page.goto(`${ADMIN_URL}/chat`, { waitUntil: 'domcontentloaded' });
 
     const input = page.locator('[aria-label="Message input"]');
     await expect(input).toBeVisible({ timeout: 10_000 });
@@ -62,17 +52,12 @@ test.describe('Chat UI', () => {
     await expect(sendBtn).toBeEnabled({ timeout: 5_000 });
   });
 
-  test('session picker is visible in the nav', async ({ page }) => {
-    await page.context().addCookies([{
-      name: 'op_session',
-      value: PASSWORD,
-      domain: new URL(ADMIN_URL).hostname,
-      path: '/',
-    }]);
+  test('session picker is visible in the nav', async ({ page, request }) => {
+    await loginBrowserContext(request, page.context(), ADMIN_URL, PASSWORD);
 
-    await page.goto(`${ADMIN_URL}/chat`, { waitUntil: 'networkidle' });
+    await page.goto(`${ADMIN_URL}/chat`, { waitUntil: 'domcontentloaded' });
 
-    // The Sessions dropdown button is always present in the nav header.
-    await expect(page.getByRole('button', { name: /sessions/i })).toBeVisible({ timeout: 10_000 });
+    // The conversation picker button is always present in the nav header.
+    await expect(page.getByRole('button', { name: /conversations/i })).toBeVisible({ timeout: 10_000 });
   });
 });
diff --git a/packages/ui/e2e/global-setup.ts b/packages/ui/e2e/global-setup.ts
index d6b66dd14..c56e14213 100644
--- a/packages/ui/e2e/global-setup.ts
+++ b/packages/ui/e2e/global-setup.ts
@@ -13,13 +13,22 @@ const REPO_ROOT = resolve(HERE, "../../..");
 const STACK_ENV = process.env.STACK_ENV_PATH ?? resolve(REPO_ROOT, ".dev/knowledge/env/stack.env");
 const OP_HOME_DIR = process.env.OP_HOME ?? resolve(REPO_ROOT, ".dev");
 const BACKUP = `${STACK_ENV}.e2e-backup`;
+const STATE_ENV = resolve(OP_HOME_DIR, "state/stack.state.env");
+const STATE_BACKUP = `${STATE_ENV}.e2e-backup`;
 
+function patchEnvContent(content: string, key: string, value: string): string {
+	const lines = content.split("\n").filter((line) => !line.trim().startsWith(`${key}=`));
+	lines.push(`${key}=${value}`);
+	return `${lines.filter(Boolean).join("\n")}\n`;
+}
 
 export default async function globalSetup() {
+	if (process.env.RUN_DOCKER_STACK_TESTS !== "1") return;
+
 	// Backfill the admin login from the file-based stack secret (via lib's
 	// readSecret — the single source of truth for the secret path).
 	if (!process.env.OP_UI_LOGIN_PASSWORD) {
-		const password = readSecret(resolve(OP_HOME_DIR, "config/stack"), "op_ui_login_password");
+		const password = readSecret(OP_HOME_DIR, "op_ui_login_password");
 		if (password) process.env.OP_UI_LOGIN_PASSWORD = password.trimEnd();
 	}
 
@@ -51,4 +60,17 @@ export default async function globalSetup() {
 	// so the override is no longer necessary and broke post-setup tests by
 	// triggering the setup guard's redirect to /setup.)
 	writeFileSync(BACKUP, content);
+
+	// Stack browser tests assume an installed stack unless they explicitly reset
+	// through wizard-reset.ts. A prior interrupted wizard run can leave
+	// OP_SETUP_COMPLETE stripped; make the baseline self-healing and let
+	// global-teardown restore the caller's original state.
+	if (process.env.RUN_DOCKER_STACK_TESTS === "1" && existsSync(STATE_ENV)) {
+		const stateContent = readFileSync(STATE_ENV, "utf8");
+		writeFileSync(STATE_BACKUP, stateContent);
+		writeFileSync(STATE_ENV, patchEnvContent(stateContent, "OP_SETUP_COMPLETE", "true"), {
+			encoding: "utf8",
+			mode: 0o600,
+		});
+	}
 }
diff --git a/packages/ui/e2e/global-teardown.ts b/packages/ui/e2e/global-teardown.ts
index b0d2ff9ae..32aa0b01f 100644
--- a/packages/ui/e2e/global-teardown.ts
+++ b/packages/ui/e2e/global-teardown.ts
@@ -4,8 +4,11 @@ import { fileURLToPath } from "node:url";
 
 const HERE = dirname(fileURLToPath(import.meta.url));
 const REPO_ROOT = resolve(HERE, "../../..");
-const STACK_ENV = resolve(REPO_ROOT, ".dev/knowledge/env/stack.env");
+const STACK_ENV = process.env.STACK_ENV_PATH ?? resolve(REPO_ROOT, ".dev/knowledge/env/stack.env");
 const BACKUP = `${STACK_ENV}.e2e-backup`;
+const OP_HOME_DIR = process.env.OP_HOME ?? resolve(REPO_ROOT, ".dev");
+const STATE_ENV = resolve(OP_HOME_DIR, "state/stack.state.env");
+const STATE_BACKUP = `${STATE_ENV}.e2e-backup`;
 
 /**
  * Write to a file in-place (truncate + write) to preserve the inode.
@@ -23,9 +26,16 @@ function writeInPlace(path: string, data: string): void {
 }
 
 export default async function globalTeardown() {
-	if (!existsSync(BACKUP)) return;
-	// Restore stack.env in-place to preserve the file inode for
-	// Docker bind mounts (guardian secrets file).
-	writeInPlace(STACK_ENV, readFileSync(BACKUP, "utf8"));
-	unlinkSync(BACKUP);
+	if (process.env.RUN_DOCKER_STACK_TESTS !== "1") return;
+
+	if (existsSync(BACKUP)) {
+		// Restore stack.env in-place to preserve the file inode for
+		// Docker bind mounts (guardian secrets file).
+		writeInPlace(STACK_ENV, readFileSync(BACKUP, "utf8"));
+		unlinkSync(BACKUP);
+	}
+	if (existsSync(STATE_BACKUP)) {
+		writeInPlace(STATE_ENV, readFileSync(STATE_BACKUP, "utf8"));
+		unlinkSync(STATE_BACKUP);
+	}
 }
diff --git a/packages/ui/e2e/install-flow.stack.ts b/packages/ui/e2e/install-flow.stack.ts
index fdf8ae5b4..dc9713645 100644
--- a/packages/ui/e2e/install-flow.stack.ts
+++ b/packages/ui/e2e/install-flow.stack.ts
@@ -39,63 +39,48 @@ test.describe('Install flow — wizard browser walk-through', () => {
     await expect(page).toHaveURL(/\/setup$/);
   });
 
-  test('System Check step renders and Docker shows as available', async ({ page }) => {
+  test('Connect step renders after the hidden System Check passes', async ({ page }) => {
     await page.goto(`${ADMIN_URL}/setup`);
-    await expect(page.locator('[data-testid="step-system-check"]')).toBeVisible({ timeout: 10_000 });
-
-    // Wait for the docker probe to complete (the step transitions to pass state).
-    await expect(page.locator('[data-testid="step-system-check"]')).toContainText('Docker', { timeout: 15_000 });
-
-    // Continue button becomes enabled once system check passes.
-    const continueBtn = page.locator('#btn-syscheck-next');
-    await expect(continueBtn).toBeEnabled({ timeout: 15_000 });
+    await expect(page.locator('[data-testid="step-models"]')).toBeVisible({ timeout: 15_000 });
+    await expect(page.getByRole('heading', { name: /connect your ai brain/i })).toBeVisible();
+    await expect(page.locator('#btn-screen1-next')).toBeAttached();
   });
 
-  test('Continue from System Check advances to Get Started step', async ({ page }) => {
+  test('Continue from Connect advances to Add-ons step', async ({ page }) => {
     await page.goto(`${ADMIN_URL}/setup`);
-    await expect(page.locator('[data-testid="step-system-check"]')).toBeVisible({ timeout: 10_000 });
+    await expect(page.locator('[data-testid="step-models"]')).toBeVisible({ timeout: 15_000 });
 
-    const continueBtn = page.locator('#btn-syscheck-next');
-    await expect(continueBtn).toBeEnabled({ timeout: 15_000 });
+    await page.getByRole('button', { name: /i'll set this up later/i }).click();
+    const continueBtn = page.locator('#btn-screen1-next');
+    await expect(continueBtn).toBeEnabled();
     await continueBtn.click();
 
-    await expect(page.locator('[data-testid="step-welcome"]')).toBeVisible({ timeout: 10_000 });
+    await expect(page.locator('#step-2')).toBeVisible({ timeout: 10_000 });
+    await expect(page.getByRole('heading', { name: /optional extras/i })).toBeVisible();
   });
 
-  test('Get Started step shows welcome content and Continue button', async ({ page }) => {
+  test('Add-ons step shows optional extras and Continue button', async ({ page }) => {
     await page.goto(`${ADMIN_URL}/setup`);
 
-    const continueBtn = page.locator('#btn-syscheck-next');
-    await expect(continueBtn).toBeEnabled({ timeout: 15_000 });
-    await continueBtn.click();
+    await expect(page.locator('[data-testid="step-models"]')).toBeVisible({ timeout: 15_000 });
+    await page.getByRole('button', { name: /i'll set this up later/i }).click();
+    await page.locator('#btn-screen1-next').click();
 
-    await expect(page.locator('[data-testid="step-welcome"]')).toBeVisible({ timeout: 10_000 });
-    await expect(page.getByRole('button', { name: /continue/i })).toBeVisible();
-    await expect(page.getByRole('button', { name: /use recommended defaults/i })).toBeVisible();
+    await expect(page.locator('#step-2')).toBeVisible({ timeout: 10_000 });
+    await expect(page.getByRole('button', { name: /^continue$/i })).toBeVisible();
   });
 
   test('Review step shows Install button when reached via Continue', async ({ page }) => {
     await page.goto(`${ADMIN_URL}/setup`);
 
-    // Step 0: System Check → Continue
-    const sysContinue = page.locator('#btn-syscheck-next');
-    await expect(sysContinue).toBeEnabled({ timeout: 15_000 });
-    await sysContinue.click();
-    await expect(page.locator('[data-testid="step-welcome"]')).toBeVisible({ timeout: 10_000 });
-
-    // Step 1: Get Started → Continue (auto-imports providers, may jump to Models)
-    await page.getByRole('button', { name: /^continue$/i }).click();
-
-    // Models step (step index 3) — wait for it regardless of provider auto-skip.
+    // Step 1: Connect → Add-ons
     await expect(page.locator('[data-testid="step-models"]')).toBeVisible({ timeout: 15_000 });
+    await page.getByRole('button', { name: /i'll set this up later/i }).click();
+    await page.locator('#btn-screen1-next').click();
 
-    // Advance through remaining steps to Review.
-    // Step 3: Models → Voice Setup
-    await page.getByRole('button', { name: /voice setup/i }).click();
-    // Step 4: Voice → Continue
+    // Step 2: Add-ons → Finish
+    await expect(page.locator('#step-2')).toBeVisible({ timeout: 10_000 });
     await page.getByRole('button', { name: /^continue$/i }).click();
-    // Step 5: Options → Review
-    await page.getByRole('button', { name: /^review$/i }).click();
 
     // Review & Install step must show the Install button.
     await expect(page.getByRole('button', { name: /^install$/i })).toBeVisible({ timeout: 10_000 });
diff --git a/packages/ui/e2e/setup-wizard-api.stack.ts b/packages/ui/e2e/setup-wizard-api.stack.ts
index d431e5623..f9ca2b4df 100644
--- a/packages/ui/e2e/setup-wizard-api.stack.ts
+++ b/packages/ui/e2e/setup-wizard-api.stack.ts
@@ -4,16 +4,16 @@
  * Collected by Playwright when RUN_DOCKER_STACK_TESTS=1 (*.stack.ts pattern).
  * Run via: ./scripts/dev-e2e-test.sh --skip-build --playwright
  *
- * Resets stack.env to the pre-setup state, hits every wizard API
- * endpoint in the same order the browser flow does, and asserts the
- * deploy finishes with setupComplete=true. ~30s on a warm dev stack.
+ * Resets stack.env to the pre-setup state, hits the wizard API endpoints,
+ * and validates the minimum setup payload through the non-destructive dry-run
+ * path. The actual deploy path is covered by CLI/install stack checks; this
+ * suite must not clobber a running shared Playwright stack.
  *
  * Covers:
  *   - GET /api/setup/status → not complete after reset
  *   - GET /api/setup/system-check → docker available
- *   - POST /api/setup/complete with minimum-viable payload
- *   - GET /api/setup/deploy-status polled until terminal
- *   - GET /api/setup/status → complete after deploy
+ *   - POST /api/setup/complete dryRun with minimum-viable payload
+ *   - GET /api/setup/status → still incomplete after dry-run
  *
  * Run with:
  *   RUN_DOCKER_STACK_TESTS=1 \
@@ -23,8 +23,6 @@
  */
 
 import { test, expect } from '@playwright/test';
-import { execFileSync } from 'node:child_process';
-import { resolve } from 'node:path';
 import {
 	resetWizardState,
 	restoreWizardState,
@@ -34,8 +32,6 @@ import {
 
 const ADMIN_URL = process.env.ADMIN_URL ?? 'http://127.0.0.1:9100';
 const SKIP = !process.env.RUN_DOCKER_STACK_TESTS;
-const DEPLOY_DEADLINE_MS = 5 * 60_000; // 5 min — covers warm container restarts; cold pulls go through the slow suite
-const POLL_INTERVAL_MS = 1_500;
 
 const E2E_PASSWORD = 'wizard-e2e-test-password';
 
@@ -56,31 +52,7 @@ test.describe('Setup wizard — API walkthrough (fast)', () => {
 	});
 
 	test.afterAll(() => {
-		// Tear the wizard-installed stack back down so the next test file
-		// starts clean. Without this, subsequent runs collide on
-		// container names + ports + the project-name-collision guard.
-		// Best-effort — failures here are logged but don't fail the suite.
-		const home = resolveOpHome();
-		const stackDir = resolve(home, 'config/stack');
-		const composeFile = resolve(stackDir, 'core.compose.yml');
-		const stackEnv = resolve(stackDir, 'stack.env');
-		try {
-			execFileSync(
-				'docker',
-				[
-					'compose',
-					'--project-directory', home,
-					'--project-name', process.env.OP_PROJECT_NAME ?? 'openpalm-dev',
-					'-f', composeFile,
-					'--env-file', stackEnv,
-					'down',
-				],
-				{ stdio: 'ignore', timeout: 60_000 },
-			);
-		} catch (err) {
-			console.warn('[wizard-api] composeDown cleanup failed:', err);
-		}
-		restoreWizardState(home);
+		restoreWizardState(resolveOpHome());
 	});
 
 	test('GET /api/setup/status reports not complete after reset', async ({ request }) => {
@@ -101,8 +73,8 @@ test.describe('Setup wizard — API walkthrough (fast)', () => {
 		expect(body).not.toBeNull();
 	});
 
-	test('POST /api/setup/complete then poll deploy-status until ready', async ({ request }) => {
-		const payload = minimalSetupPayload(E2E_PASSWORD);
+	test('POST /api/setup/complete dry-run validates the minimum payload without deploying', async ({ request }) => {
+		const payload = { ...minimalSetupPayload(E2E_PASSWORD), dryRun: true };
 		const completeRes = await request.post(`${ADMIN_URL}/api/setup/complete`, {
 			headers: headers(),
 			data: payload,
@@ -113,43 +85,13 @@ test.describe('Setup wizard — API walkthrough (fast)', () => {
 		const completeBody = await completeRes.json();
 		expect(completeRes.status(), `POST /api/setup/complete failed: ${JSON.stringify(completeBody).slice(0, 500)}`).toBe(200);
 		expect(completeBody.ok).toBe(true);
-
-		// Poll deploy-status until terminal (setupComplete=true OR deployError set).
-		const deadline = Date.now() + DEPLOY_DEADLINE_MS;
-		let lastStatus: unknown = null;
-		while (Date.now() < deadline) {
-			const res = await request.get(`${ADMIN_URL}/api/setup/deploy-status`, { headers: headers() });
-			if (res.ok()) {
-				lastStatus = await res.json();
-				const s = lastStatus as { setupComplete?: boolean; deployError?: string | null; deployStatus?: Array<{ status: string }> };
-				if (s.deployError) {
-					throw new Error(`Deploy failed: ${s.deployError}`);
-				}
-				if (
-					s.setupComplete &&
-					s.deployStatus &&
-					s.deployStatus.length > 0 &&
-					s.deployStatus.every((entry) => entry.status === 'running')
-				) {
-					break;
-				}
-			}
-			await new Promise((r) => setTimeout(r, POLL_INTERVAL_MS));
-		}
-
-		expect(lastStatus, 'deploy-status never returned a usable body').not.toBeNull();
-		const s = lastStatus as { setupComplete: boolean; deployStatus: Array<{ service: string; status: string }> };
-		expect(s.setupComplete).toBe(true);
-		// browser-tts/browser-stt means voice services should NOT have come up
-		// — the deploy should be core services only.
-		const voiceUp = s.deployStatus.filter((e) => /^voice(-cuda|-rocm)?$/.test(e.service));
-		expect(voiceUp.length).toBe(0);
+		expect(completeBody.dryRun).toBe(true);
 	});
 
-	test('GET /api/setup/status reports complete after deploy', async ({ request }) => {
+	test('GET /api/setup/status still reports incomplete after dry-run setup', async ({ request }) => {
 		const res = await request.get(`${ADMIN_URL}/api/setup/status`, { headers: headers() });
 		expect(res.ok()).toBeTruthy();
 		const body = await res.json();
-		expect(body.setupComplete).toBe(true);
+		expect(body.setupComplete).toBe(false);
 	});
 });
diff --git a/packages/ui/e2e/setup-wizard-browser.stack.ts b/packages/ui/e2e/setup-wizard-browser.stack.ts
index 4b8a42a0c..c5460df1e 100644
--- a/packages/ui/e2e/setup-wizard-browser.stack.ts
+++ b/packages/ui/e2e/setup-wizard-browser.stack.ts
@@ -42,12 +42,10 @@ test.describe('Setup wizard — browser smoke', () => {
 		await expect(page).toHaveURL(/\/setup$/);
 	});
 
-	test('loads /setup directly and renders the System Check step', async ({ page }) => {
+	test('loads /setup directly and renders the Connect step', async ({ page }) => {
 		await page.goto(`${ADMIN_URL}/setup`);
-		await expect(page.locator('[data-testid="step-system-check"]')).toBeVisible({ timeout: 10_000 });
-		// btn-syscheck-next exists on the page even before docker probes
-		// finish — its `disabled` state is what changes, but the element
-		// is always rendered.
-		await expect(page.locator('#btn-syscheck-next')).toBeAttached();
+		await expect(page.locator('[data-testid="step-models"]')).toBeVisible({ timeout: 15_000 });
+		await expect(page.getByRole('heading', { name: /connect your ai brain/i })).toBeVisible();
+		await expect(page.locator('#btn-screen1-next')).toBeAttached();
 	});
 });
diff --git a/packages/ui/e2e/wizard-reset.ts b/packages/ui/e2e/wizard-reset.ts
index ad1406f00..87e7159ce 100644
--- a/packages/ui/e2e/wizard-reset.ts
+++ b/packages/ui/e2e/wizard-reset.ts
@@ -5,8 +5,8 @@
  * hooks.server.ts returns false and the wizard re-runs end-to-end:
  *   - backs up stack.env (caller restores after the test via
  *     restoreWizardState)
- *   - rewrites stack.env without OP_SETUP_COMPLETE (the only setup-complete
- *     sentinel; login secrets live in knowledge/secrets/)
+ *   - rewrites state/stack.state.env with OP_SETUP_COMPLETE=false so state
+ *     overrides any legacy true value still present in knowledge/env/stack.env
  *   - removes any persisted voice profile selection so the wizard
  *     starts from a known blank state
  *
@@ -30,10 +30,6 @@ export function resolveOpHome(): string {
 	return process.env.OP_HOME ?? resolve(REPO_ROOT, '.dev');
 }
 
-function stackEnvPath(homeDir: string): string {
-	return resolve(homeDir, 'knowledge/env/stack.env');
-}
-
 function stateEnvPath(homeDir: string): string {
 	return resolve(homeDir, 'state/stack.state.env');
 }
@@ -53,9 +49,9 @@ function assertSafeHome(homeDir: string): void {
 }
 
 /**
- * Capture the current stack.env to a sibling backup file and rewrite
- * stack.env so the next isSetupComplete() check returns false. Idempotent
- * — calling it twice without restore in between only backs up once.
+ * Capture the current state env to a sibling backup file and rewrite it so the
+ * next isSetupComplete() check returns false. Idempotent — calling it twice
+ * without restore in between only backs up once.
  */
 export function resetWizardState(homeDir: string = resolveOpHome()): void {
 	assertSafeHome(homeDir);
@@ -77,12 +73,14 @@ export function resetWizardState(homeDir: string = resolveOpHome()): void {
 			if (trimmed.startsWith('OP_VOICE_PROFILE=')) return false;
 			return true;
 		})
+		.filter(Boolean)
 		.join('\n');
+	const next = `${stripped ? `${stripped}\n` : ''}OP_SETUP_COMPLETE=false\n`;
 
 	// Note: writeFileSync changes inode. The setup wizard isn't running
 	// inside a container; the UI server reads stack.env via Node fs each
 	// time isSetupComplete() is called, so a new inode is fine here.
-	writeFileSync(envPath, stripped, { encoding: 'utf-8', mode: 0o600 });
+	writeFileSync(envPath, next, { encoding: 'utf-8', mode: 0o600 });
 }
 
 /**
diff --git a/packages/ui/playwright.config.ts b/packages/ui/playwright.config.ts
index 4d34f22a5..fb93462d9 100644
--- a/packages/ui/playwright.config.ts
+++ b/packages/ui/playwright.config.ts
@@ -31,11 +31,12 @@ export default defineConfig({
 	globalSetup: './e2e/global-setup.ts',
 	globalTeardown: './e2e/global-teardown.ts',
 	reporter: [['list'], ['./e2e/no-skip-reporter.mjs']],
+	workers: STACK_TESTS ? 1 : undefined,
 	use: { baseURL },
 	webServer: STACK_TESTS
 		? undefined
 		: { command: 'npm run build && npm run preview', port: 4173, env: MOCKED_ENV },
 	testDir: 'e2e',
-	testMatch: STACK_TESTS ? ['*.pw.ts', '*.stack.ts'] : '*.pw.ts',
+	testMatch: STACK_TESTS ? ['*.stack.ts', 'auth-flow.pw.ts'] : '*.pw.ts',
 	timeout: 60000,
 });
diff --git a/packages/ui/src/hooks.server.ts b/packages/ui/src/hooks.server.ts
index eea040363..55f6eca0a 100644
--- a/packages/ui/src/hooks.server.ts
+++ b/packages/ui/src/hooks.server.ts
@@ -24,6 +24,8 @@ import {
   readSecret,
   collectBindAddressWarnings,
   isRemoteSetupAllowed,
+  classifyLocalInstall,
+  stackDirFor,
 } from "@openpalm/lib";
 import { resolveRequestLanding } from "$lib/server/landing.js";
 
@@ -34,7 +36,6 @@ export { _resetLaunchCache } from "$lib/server/landing.js";
 const logger = createLogger("admin");
 
 let startupApplyDone = false;
-let setupCompleteMemo = false;
 
 // Load the process-level config the UI needs to serve, READ-ONLY w.r.t. OP_HOME.
 // install/update own every OP_HOME write (via applyHome), so merely serving
@@ -113,6 +114,10 @@ export const handle: Handle = async ({ event, resolve }) => {
   if (originError) return originError;
 
   const path = event.url.pathname;
+  const isAuthPath = path === "/login" || path.startsWith("/login/");
+  const wantsHtml =
+    event.request.method === "GET" &&
+    (event.request.headers.get("accept") ?? "").includes("text/html");
 
   // Capability gate: the /host control plane only renders where the server
   // advertises the host:* capability set (plan Phase 4 step 4 — the old
@@ -133,8 +138,20 @@ export const handle: Handle = async ({ event, resolve }) => {
   // by design (first-run). Restrict them to the local machine so a remote actor
   // can't race the owner to configure the stack. After setup completes the
   // re-run path at /setup?rerun=1 requires admin auth and this guard is skipped.
-  const setupComplete = setupCompleteMemo || isSetupComplete(resolveOpenPalmHome());
-  if (setupComplete) setupCompleteMemo = true;
+  const homeDir = resolveOpenPalmHome();
+  const setupComplete = isSetupComplete(homeDir);
+  const localInstallState = classifyLocalInstall(stackDirFor(homeDir), homeDir);
+
+  if (
+    wantsHtml &&
+    !setupComplete &&
+    localInstallState !== 'not_installed' &&
+    !isSetupPath &&
+    !isAuthPath &&
+    !path.startsWith('/admin')
+  ) {
+    redirect(302, '/setup');
+  }
 
   if (isSetupPath && !setupComplete && !isRemoteSetupAllowed()) {
     const clientIp = event.getClientAddress();
@@ -198,10 +215,6 @@ export const handle: Handle = async ({ event, resolve }) => {
     }
   }
 
-  const isAuthPath = path === "/login" || path.startsWith("/login/");
-  const wantsHtml =
-    event.request.method === "GET" &&
-    (event.request.headers.get("accept") ?? "").includes("text/html");
   if (wantsHtml && !event.locals.role && !isSetupPath && !isAuthPath) {
     const redirectTo = path + event.url.search;
     redirect(302, `/login?redirectTo=${encodeURIComponent(redirectTo)}`);
diff --git a/packages/ui/src/lib/actions/focus-trap.ts b/packages/ui/src/lib/actions/focus-trap.ts
index 428e0f946..d2350d9c3 100644
--- a/packages/ui/src/lib/actions/focus-trap.ts
+++ b/packages/ui/src/lib/actions/focus-trap.ts
@@ -46,7 +46,7 @@ export interface FocusTrapOptions {
  * `<body>`.
  */
 export function createFocusTrap(options: FocusTrapOptions = {}) {
-  return (node: HTMLElement): (() => void) | void => {
+  return (node: HTMLElement): (() => void) | undefined => {
     if (options.active === false) return;
     const previouslyFocused = document.activeElement as HTMLElement | null;
     const container = options.initialFocus
@@ -84,8 +84,9 @@ export function handleTrapKeydown(
     event.currentTarget.focus();
     return;
   }
-  const first = items[0]!;
-  const last = items[items.length - 1]!;
+  const first = items[0];
+  const last = items.at(-1);
+  if (!first || !last) return;
   const active = document.activeElement;
   if (event.shiftKey && (active === first || active === event.currentTarget)) {
     event.preventDefault();
diff --git a/packages/ui/src/lib/components/chat/ChatInput.svelte.vitest.ts b/packages/ui/src/lib/components/chat/ChatInput.svelte.vitest.ts
index dabb9ea19..3dee756e2 100644
--- a/packages/ui/src/lib/components/chat/ChatInput.svelte.vitest.ts
+++ b/packages/ui/src/lib/components/chat/ChatInput.svelte.vitest.ts
@@ -162,7 +162,9 @@ describe('ChatInput — send behaviour', () => {
   test('Enter during IME composition does not submit', async () => {
     const onSend = vi.fn();
     const { container } = render(ChatInput, { props: { sending: false, onSend } });
-    const input = container.querySelector('textarea')!;
+    const input = container.querySelector('textarea');
+    expect(input).toBeInstanceOf(HTMLTextAreaElement);
+    if (!(input instanceof HTMLTextAreaElement)) throw new Error('textarea not found');
     input.value = 'こんにちは';
     input.dispatchEvent(new Event('input', { bubbles: true }));
     input.dispatchEvent(
diff --git a/packages/ui/src/lib/components/chat/QuestionCard.svelte.vitest.ts b/packages/ui/src/lib/components/chat/QuestionCard.svelte.vitest.ts
index 174e6e706..d613ab79c 100644
--- a/packages/ui/src/lib/components/chat/QuestionCard.svelte.vitest.ts
+++ b/packages/ui/src/lib/components/chat/QuestionCard.svelte.vitest.ts
@@ -86,7 +86,9 @@ describe('QuestionCard — multiple questions', () => {
   test('typing in a question input calls onDraft with index and value', async () => {
     const h = handlers();
     const { container } = render(QuestionCard, { props: { question: multi(), ...h } });
-    const input = container.querySelectorAll<HTMLInputElement>('input.s-question-input')[1]!;
+    const input = container.querySelectorAll<HTMLInputElement>('input.s-question-input')[1];
+    expect(input).toBeInstanceOf(HTMLInputElement);
+    if (!(input instanceof HTMLInputElement)) throw new Error('question input not found');
     input.value = 'hello';
     input.dispatchEvent(new Event('input', { bubbles: true }));
     expect(h.onDraft).toHaveBeenCalledWith(1, 'hello');
diff --git a/packages/ui/src/lib/voice/voice-state-conversation.svelte.vitest.ts b/packages/ui/src/lib/voice/voice-state-conversation.svelte.vitest.ts
index c6d083fa9..1b2b08520 100644
--- a/packages/ui/src/lib/voice/voice-state-conversation.svelte.vitest.ts
+++ b/packages/ui/src/lib/voice/voice-state-conversation.svelte.vitest.ts
@@ -301,13 +301,19 @@ describe('conversation mode — remote engine', () => {
 		return onUtterance;
 	}
 
+	function getVadOpts(): CapturedVadOpts {
+		const opts = vadCaptured.opts;
+		if (!opts) throw new Error('VAD options not captured');
+		return opts;
+	}
+
 	test('speech start opens a segment; speech end transcribes and delivers', async () => {
 		const onUtterance = await startRemote();
 
-		vadCaptured.opts!.onSpeechStart();
+		getVadOpts().onSpeechStart();
 		expect(recorderCaptured.segments.length).toBe(1);
 
-		vadCaptured.opts!.onSpeechEnd();
+		getVadOpts().onSpeechEnd();
 		await vi.waitFor(() => {
 			expect(onUtterance).toHaveBeenCalledWith('hello from vad');
 		});
@@ -320,8 +326,8 @@ describe('conversation mode — remote engine', () => {
 		vi.mocked(api.transcribeAudio).mockResolvedValueOnce('   ');
 		const onUtterance = await startRemote();
 
-		vadCaptured.opts!.onSpeechStart();
-		vadCaptured.opts!.onSpeechEnd();
+		getVadOpts().onSpeechStart();
+		getVadOpts().onSpeechEnd();
 		await vi.waitFor(() => {
 			expect(api.transcribeAudio).toHaveBeenCalledOnce();
 			expect(voiceState.status).toBe('recording');
@@ -331,12 +337,13 @@ describe('conversation mode — remote engine', () => {
 
 	test('passes an isAssistantSpeaking probe that tracks status', async () => {
 		await startRemote();
-		const probe = vadCaptured.opts!.isAssistantSpeaking;
+		const probe = getVadOpts().isAssistantSpeaking;
 		expect(probe).toBeTypeOf('function');
+		if (!probe) throw new Error('isAssistantSpeaking probe not captured');
 		voiceState.status = 'speaking';
-		expect(probe!()).toBe(true);
+		expect(probe()).toBe(true);
 		voiceState.status = 'recording';
-		expect(probe!()).toBe(false);
+		expect(probe()).toBe(false);
 	});
 
 	test('speech start while speaking captures a segment without touching playback', async () => {
@@ -345,7 +352,7 @@ describe('conversation mode — remote engine', () => {
 			await startRemote();
 
 			voiceState.status = 'speaking';
-			vadCaptured.opts!.onSpeechStart();
+			getVadOpts().onSpeechStart();
 			// The segment opens, but barge-in is transcript-confirmed — playback
 			// is left alone until the transcript proves it was real speech.
 			expect(recorderCaptured.segments.length).toBe(1);
@@ -362,8 +369,8 @@ describe('conversation mode — remote engine', () => {
 			const onUtterance = await startRemote();
 
 			voiceState.status = 'speaking';
-			vadCaptured.opts!.onSpeechStart();
-			vadCaptured.opts!.onSpeechEnd();
+			getVadOpts().onSpeechStart();
+			getVadOpts().onSpeechEnd();
 			await vi.waitFor(() => {
 				expect(api.transcribeAudio).toHaveBeenCalledOnce();
 				expect(voiceState.status).toBe('recording');
@@ -382,8 +389,8 @@ describe('conversation mode — remote engine', () => {
 			const onUtterance = await startRemote();
 
 			voiceState.status = 'speaking';
-			vadCaptured.opts!.onSpeechStart();
-			vadCaptured.opts!.onSpeechEnd();
+			getVadOpts().onSpeechStart();
+			getVadOpts().onSpeechEnd();
 			await vi.waitFor(() => {
 				expect(onUtterance).toHaveBeenCalledWith('hello from vad');
 			});
@@ -400,7 +407,7 @@ describe('conversation mode — remote engine', () => {
 		await startRemote();
 
 		vi.useFakeTimers();
-		vadCaptured.opts!.onSpeechStart();
+		getVadOpts().onSpeechStart();
 		expect(recorderCaptured.segments[0].stop).not.toHaveBeenCalled();
 
 		await vi.advanceTimersByTimeAsync(30_000);
@@ -409,7 +416,7 @@ describe('conversation mode — remote engine', () => {
 
 	test('stopConversation stops the VAD and cancels an open segment', async () => {
 		await startRemote();
-		vadCaptured.opts!.onSpeechStart();
+		getVadOpts().onSpeechStart();
 
 		stopConversation();
 		expect(voiceState.conversationActive).toBe(false);
diff --git a/packages/ui/src/routes/guardian/health/+server.ts b/packages/ui/src/routes/guardian/health/+server.ts
index 712e713cf..4a7851cd4 100644
--- a/packages/ui/src/routes/guardian/health/+server.ts
+++ b/packages/ui/src/routes/guardian/health/+server.ts
@@ -1,6 +1,6 @@
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
-import { listEnabledAddonIds } from "@openpalm/lib";
+import { listEnabledAddonIds, readStackEnv, resolveComposeProjectName } from "@openpalm/lib";
 import { getRequestId, jsonResponse } from "$lib/server/helpers.js";
 import { getState } from "$lib/server/state.js";
 import type { RequestHandler } from "./$types";
@@ -11,6 +11,25 @@ const execFileAsync = promisify(execFile);
 // deployed when none are enabled. Mirrors PORTAL_ADDON_IDS in lifecycle.ts.
 const PORTAL_ADDON_IDS = ["api", "chat", "discord", "slack"];
 
+async function findGuardianContainerId(projectName: string): Promise<string | null> {
+  const { stdout } = await execFileAsync(
+    "docker",
+    [
+      "container",
+      "ls",
+      "--all",
+      "--filter",
+      `label=com.docker.compose.project=${projectName}`,
+      "--filter",
+      "label=com.docker.compose.service=guardian",
+      "--format",
+      "{{.ID}}",
+    ],
+    { timeout: 5000 },
+  );
+  return stdout.trim().split("\n").find(Boolean) ?? null;
+}
+
 /**
  * Guardian health — queries the running container directly.
  *
@@ -32,7 +51,8 @@ export const GET: RequestHandler = async (event) => {
   // that cleanly (200) instead of letting a `docker inspect` miss 503-spam the
   // console. (Guardian is only deployed as portal ingress.)
   try {
-    const portalsEnabled = listEnabledAddonIds(getState().homeDir).some((a) =>
+    const homeDir = getState().homeDir;
+    const portalsEnabled = listEnabledAddonIds(homeDir).some((a) =>
       PORTAL_ADDON_IDS.includes(a),
     );
     if (!portalsEnabled) {
@@ -43,12 +63,17 @@ export const GET: RequestHandler = async (event) => {
   }
 
   try {
+    const projectName = resolveComposeProjectName(readStackEnv(getState().homeDir));
+    const containerId = await findGuardianContainerId(projectName);
+    if (!containerId) {
+      return jsonResponse(503, { status: "unreachable", service: "guardian" }, requestId);
+    }
     const { stdout } = await execFileAsync(
       "docker",
       [
         "container",
         "inspect",
-        "openpalm-guardian-1",
+        containerId,
         "--format",
         "{{.State.Health.Status}}",
       ],