From 8b0222b31b4a47d070ec33ee6f74d33104acd415 Mon Sep 17 00:00:00 2001
From: Tim Nunamaker <tnunamak@gmail.com>
Date: Wed, 21 Oct 2026 18:30:37 -0500
Subject: [PATCH 01/87] feat: persist typed local-device run coverage verdicts

Extend DONE with a scoped store inventory verdict. Carry successful verdicts through durable terminal commits and project coverage only after server validation against the current manifest and scope.

Assisted-by: AI
Signed-off-by: Tim Nunamaker <tnunamak@gmail.com>
---
 docs/261021-local-device-coverage-evidence.md |  45 ++++
 .../src/collector-runner.test.ts              |  46 ++++
 .../collector-runtime/src/collector-runner.ts | 164 +++++++++++--
 .../src/local-device-client.ts                |  17 +-
 .../src/local-device-envelope.ts              |  39 +++-
 .../src/local-device-outbox.test.ts           |  46 +++-
 .../src/local-device-outbox.ts                | 116 +++++++++-
 .../src/connector-runtime-protocol.ts         |  19 ++
 packages/connector-protocol/src/index.ts      |   2 +
 .../bin/pdpp-local-collector.ts               | 107 +++++++--
 .../src/managed/artifact-contract.ts          |   2 +-
 packages/local-collector/test/runner.test.ts  | 215 ++++++++++++++----
 .../local-device-terminal-collection.ts       | 107 ++++++++-
 .../server/ref-control.ts                     | 113 ++++++++-
 .../stores/terminal-run-commit-store.ts       |   7 +-
 ...evice-terminal-coverage-projection.test.ts | 201 ++++++++++++++++
 ...vice-terminal-run-commit-operation.test.ts |  93 +++++++-
 17 files changed, 1222 insertions(+), 117 deletions(-)
 create mode 100644 docs/261021-local-device-coverage-evidence.md
 create mode 100644 reference-implementation/test/local-device-terminal-coverage-projection.test.ts

diff --git a/docs/261021-local-device-coverage-evidence.md b/docs/261021-local-device-coverage-evidence.md
new file mode 100644
index 000000000..f46ef143b
--- /dev/null
+++ b/docs/261021-local-device-coverage-evidence.md
@@ -0,0 +1,45 @@
+# Local device terminal coverage contract
+
+Status: decision for linked data-connectors and data-connect PRs. PR #553 cannot restore positive coverage until new signed connector releases are pinned.
+
+## Regression
+
+The five pinned local releases no longer emit coverage_diagnostics. Their PROGRESS lines and stderr run diagnostics are not terminal coverage evidence. In data-connect, collector-runner.ts collects legacy coverage_diagnostics RECORDs but has no typed proof from these releases, so terminalFacts is null and the server's local coverage axis remains unknown. The prior proposal in data-connect-repin-553/docs/261021-local-device-coverage-evidence.md suggested RUN_COVERAGE; this decision supersedes that message choice.
+
+## Step 1: message decision
+
+Extend the existing DONE message with optional typed coverage. DONE is already the required final message. The collector retains one DONE in packages/collector-runtime/src/collector-runner.ts:1676, rejects output after it, and decides whether to send a durable terminal commit at :1035-1058. This allows the verdict to be bound to successful termination without an extra message or duplicate-event state machine. Existing DONE messages without coverage remain valid and yield unknown coverage.
+
+| Candidate | Type and validation | Persistence and terminal fit |
+| --- | --- | --- |
+| DONE | packages/connector-protocol/src/connector-runtime-protocol.ts:879-891 types status, count and error. collector-runner.ts:1829 parses JSONL with a cast, so the new field needs explicit runtime validation. | The collector retains it; the authenticated terminal commit endpoint validates and persists terminal facts in reference-implementation/operations/local-device-terminal-collection.ts:42-141. Its final-message semantics fit. |
+| PROGRESS | connector-runtime-protocol.ts:793-804 types owner-facing text and optional counts. connector-diagnostic.ts:4-77 writes best-effort bounded stderr, outside the protocol. | Neither is retained as terminal proof. A mid-run line can precede failure or truncation. |
+| STATE | connector-runtime-protocol.ts:791 types a stream cursor; collector-runner.ts:1650-1662 buffers only in-scope checkpoint state. | A cursor is a resume position, not enumeration status. Some streams have none. |
+| SKIP_RESULT | connector-runtime-protocol.ts:808-846 types a specific skip with reason, message, optional diagnostics and continuation. | One omission does not enumerate every store; absence of skips does not prove completeness. The collector does not retain it as terminal facts. |
+| STREAM_EVIDENCE | connector-runtime-protocol.ts:842-885 types measured state-stream detail counts. | It is reference-only, can arrive before completion, and does not enumerate local stores or assert a terminal scope. |
+| RUN_COVERAGE | No current protocol message. The earlier proposal adds a pre-DONE event and ordering rules. | The optional DONE field has the needed terminal semantics, so a new message is unnecessary. |
+
+The existing local-device run-coverage summaries and packages/polyfill-connectors/src/connector-diagnostic.ts stderr helper may supply inputs to a verdict, but they do not carry a typed protocol verdict and are not persisted as one. `buildTerminalCollectionFacts` in collector-runner.ts reduces the old record-backed store map to status lists and loses store IDs; the v2 path must retain them. Although DONE has no such field today, its required final-message semantics permit an optional field without another event or ordering rule.
+
+## Typed field
+
+DONE.coverage has version 1, collection_scope, and streams. Each stream has stream, scoped, and stores. Each store has store and status. The closed status enum is collected, partial, unavailable, failed.
+
+- collected: the requested region was fully enumerated and all supported records were handled; an honestly verified empty region counts.
+- partial: a supported item was skipped, deferred, unsupported, or remains pending.
+- unavailable: the source store was absent or inaccessible before enumeration.
+- failed: enumeration or classification began but did not complete.
+
+Only collected can support a positive coverage verdict. START.collection_scope carries the collector's canonical collectorScopeFingerprint; unscoped is an explicit value. DONE.coverage.collection_scope must echo it. The verdict lists exactly every requested stream and every store in each stream's signed manifest coverage inventory, with no duplicates or extras. The server admits a selected-stream subset when each reported stream matches its signed inventory; the read model requires the complete manifest inventory before showing whole-connection coverage. Store IDs are opaque to the app. A stream without inventory cannot prove coverage. scoped is true only if the connector enforced the requested boundary during enumeration.
+
+The collector validates the typed field before accepting it. It carries store IDs and statuses in a version 2 terminal commit only after successful DONE, complete scan, drained outbox, and durable checkpoint. The server validates the commit against authenticated device/source/connector identity, boundary, manifest inventory, status enum and commit ID. Existing version 1 commits remain accepted; an old device or missing field continues to work but does not gain coverage. Malformed, partial, unavailable, failed, missing, duplicate, stale or mixed-boundary evidence stays unknown or a worse gap state. The validated proof must feed both the Collection Report and connection coverage axis. A drained outbox alone is no evidence of coverage.
+
+The collector stores the latest acknowledged v2 receipt in local outbox schema v5, outside prunable outbox rows. A later acknowledged v1 commit removes that receipt. Offline status can describe the receipt's measured boundary; doctor compares it with the active owner boundary. The server read model must make the same boundary comparison before showing positive connection coverage.
+
+## Published PDPP spec impact
+
+This changes the Collection Profile wire contract. The PDPP owner tree remains read-only in this lane. Both /home/tnunamak/code/pdpp/spec-collection-profile.md and its published copy, apps/site/content/docs/spec-collection-profile.mdx, need updates: DONE (root line 514, published line 518) needs the optional field and its validation; START (root around line 198) needs collection_scope; manifest stream declarations (root lines 45-75) need coverage-store inventory. The state machine (root lines 120-155) already defines DONE as final. The restart-abandonment rule at root line 573 uses “DONE-time coverage verdict” for detail-coverage checkpoint eligibility; it does not define this per-store terminal payload. PDPP Core is unaffected. Protocol addition needs owner approval at merge.
+
+## Acceptance and release
+
+Failing-first tests must show absent coverage unknown, a valid fully drained proof covered, partial/unavailable/failed not covered, malformed rejected or unknown, and old devices still working. Verify connector emitters, collector checkpointing, server validation, and both read models. Bump the five connector manifest patch versions and regenerate connector-implementation-index.json. PR #553 then repins the five signed releases and their verified hashes.
diff --git a/packages/collector-runtime/src/collector-runner.test.ts b/packages/collector-runtime/src/collector-runner.test.ts
index 32e38fb1f..f4cb59a90 100644
--- a/packages/collector-runtime/src/collector-runner.test.ts
+++ b/packages/collector-runtime/src/collector-runner.test.ts
@@ -319,6 +319,52 @@ test("runCollectorConnector reports null completeness when no coverage diagnosti
   }
 });
 
+test("runCollectorConnector commits a typed DONE coverage verdict without a diagnostics stream", async () => {
+  const harness = await startCollectorHarness({ priorState: {} });
+  try {
+    const fixture = await writeFixtureConnector({
+      script: `
+        await new Promise((resolve) => {
+          let input = "";
+          process.stdin.on("data", (chunk) => { input += chunk; if (input.includes("\\n")) resolve(); });
+        });
+        process.stdout.write(JSON.stringify({
+          type: "DONE", status: "succeeded", records_emitted: 0,
+          coverage: {
+            version: 1, collection_scope: "unscoped",
+            streams: [{ stream: "messages", scoped: true,
+              stores: [{ store: "messages", status: "collected" }] }],
+          },
+        }) + "\\n");
+      `,
+    });
+    const result = await runCollectorConnector({
+      baseUrl: harness.url,
+      connector: {
+        args: [fixture],
+        command: "node",
+        connector_id: "fixture-typed-coverage",
+        protocol_capabilities: [],
+        runtime_requirements: { bindings: {} },
+        streams: ["messages"],
+      },
+      deviceId: "device-1",
+      deviceToken: "device-token",
+      executionRoot: TEST_EXECUTION_ROOT,
+      queuePath: await tempQueuePath(),
+      sourceInstanceId: "src-typed-coverage",
+    });
+    assert.equal(result.done?.status, "succeeded");
+    assert.equal(harness.terminalCommits.length, 1);
+    assert.equal(harness.terminalCommits[0]?.version, 2);
+    assert.deepEqual(harness.terminalCommits[0]?.terminal_facts, [
+      { scoped: true, stores: [{ status: "collected", store: "messages" }], stream: "messages" },
+    ]);
+  } finally {
+    await harness.close();
+  }
+});
+
 test("runCollectorConnector.onMessage observes every protocol message in emission order without altering the result", async () => {
   const harness = await startCollectorHarness({ priorState: {} });
   try {
diff --git a/packages/collector-runtime/src/collector-runner.ts b/packages/collector-runtime/src/collector-runner.ts
index c9449118a..a0060219a 100644
--- a/packages/collector-runtime/src/collector-runner.ts
+++ b/packages/collector-runtime/src/collector-runner.ts
@@ -28,7 +28,7 @@ import { randomUUID } from "node:crypto";
 import { mkdirSync, writeFileSync } from "node:fs";
 import { delimiter, join } from "node:path";
 import { createInterface } from "node:readline";
-import type { EmittedMessage, StartMessage, StreamScope } from "@pdpp/connector-protocol";
+import type { EmittedMessage, RunCoverageVerdict, StartMessage, StreamScope } from "@pdpp/connector-protocol";
 import { validateHostBlobMessage, validateStreamEvidenceCounts } from "@pdpp/connector-protocol";
 import { buildAgentVersion } from "./collector-build-info.ts";
 import { type BlobUploadPayload, isBlobUploadPayload } from "./local-device-blob-capture.ts";
@@ -42,6 +42,7 @@ import {
   LocalDeviceReceiptValidationError,
   LocalDeviceRequestTimeoutError,
   type TerminalCollectionFact,
+  type TerminalCoverageFact,
   type TerminalRunCommitRequest,
 } from "./local-device-client.ts";
 import {
@@ -1032,7 +1033,7 @@ export async function runCollectorConnector(config: CollectorRunConfig): Promise
     });
     const scopedTimeRanges = resolveScopedStreamTimeRanges(declaredScope, config.connector.timeScopableStreams);
     const scopedRoots = resolveScopedSourceRoots(declaredScope);
-    const terminalFacts =
+    const legacyTerminalFacts =
       done?.status === "succeeded" &&
       !streamResult.scanBudgetExceeded &&
       streamResult.coverageByStore &&
@@ -1045,6 +1046,22 @@ export async function runCollectorConnector(config: CollectorRunConfig): Promise
             config.connector.sourceRootScopableStreams
           )
         : null;
+    const typedTerminalFacts =
+      done?.status === "succeeded" && !streamResult.scanBudgetExceeded && done.coverage
+        ? done.coverage.streams.map(
+            (stream): TerminalCoverageFact => ({
+              scoped: stream.scoped,
+              stores: stream.stores,
+              stream: stream.stream,
+            })
+          )
+        : null;
+    let terminalEvidence: TerminalEvidence | null = null;
+    if (typedTerminalFacts) {
+      terminalEvidence = { facts: typedTerminalFacts, version: 2 };
+    } else if (legacyTerminalFacts) {
+      terminalEvidence = { facts: legacyTerminalFacts, version: 1 };
+    }
     const checkpointResult = await maybeCommitCheckpoint({
       afterRecordsSummary,
       bufferedState,
@@ -1053,11 +1070,14 @@ export async function runCollectorConnector(config: CollectorRunConfig): Promise
       holderId,
       outbox,
       policy,
-      terminalFacts,
+      terminalEvidence,
       terminalRunBoundary: collectorScopeFingerprint(declaredScope),
       terminalRunConnectorInstanceId: priorStateProjection.connectorInstanceId,
     });
 
+    const coverageCheckpointCommitted =
+      checkpointResult.flushedState !== null &&
+      (typedTerminalFacts !== null || Object.hasOwn(checkpointResult.flushedState, COVERAGE_DIAGNOSTICS_STREAM));
     await recoverResolvedLocalCollectorGaps({
       client,
       config,
@@ -1065,9 +1085,7 @@ export async function runCollectorConnector(config: CollectorRunConfig): Promise
       // coverage STATE commit. A scoped success or corrective heartbeat is
       // deliberately insufficient.
       deferRecoveredGapCleanup:
-        streamResult.scanBudgetExceeded ||
-        done?.status !== "succeeded" ||
-        !Object.hasOwn(checkpointResult.flushedState ?? {}, COVERAGE_DIAGNOSTICS_STREAM),
+        streamResult.scanBudgetExceeded || done?.status !== "succeeded" || !coverageCheckpointCommitted,
       outbox,
     });
 
@@ -1422,6 +1440,62 @@ function assertValidStreamEvidence(
   }
 }
 
+/** Parse the optional terminal claim before it can enter a durable outbox row. */
+export function validateRunCoverageVerdict(
+  value: unknown,
+  requestedStreams: readonly string[],
+  collectionScope: string
+): RunCoverageVerdict {
+  if (
+    !isRecord(value) ||
+    value.version !== 1 ||
+    value.collection_scope !== collectionScope ||
+    !Array.isArray(value.streams)
+  ) {
+    throw new Error("DONE coverage version or collection scope is invalid");
+  }
+  const requested = new Set(requestedStreams);
+  const seenStreams = new Set<string>();
+  const streams: RunCoverageVerdict["streams"][number][] = [];
+  for (const rawStream of value.streams) {
+    if (
+      !isRecord(rawStream) ||
+      typeof rawStream.stream !== "string" ||
+      !requested.has(rawStream.stream) ||
+      seenStreams.has(rawStream.stream) ||
+      typeof rawStream.scoped !== "boolean" ||
+      !Array.isArray(rawStream.stores) ||
+      rawStream.stores.length === 0
+    ) {
+      throw new Error("DONE coverage stream set is invalid");
+    }
+    seenStreams.add(rawStream.stream);
+    const seenStores = new Set<string>();
+    const stores: RunCoverageVerdict["streams"][number]["stores"][number][] = [];
+    for (const rawStore of rawStream.stores) {
+      if (
+        !isRecord(rawStore) ||
+        typeof rawStore.store !== "string" ||
+        !rawStore.store.trim() ||
+        seenStores.has(rawStore.store) ||
+        !(["collected", "partial", "unavailable", "failed"] as readonly unknown[]).includes(rawStore.status)
+      ) {
+        throw new Error("DONE coverage store verdict is invalid");
+      }
+      seenStores.add(rawStore.store);
+      stores.push({
+        status: rawStore.status as RunCoverageVerdict["streams"][number]["stores"][number]["status"],
+        store: rawStore.store,
+      });
+    }
+    streams.push({ scoped: rawStream.scoped, stores, stream: rawStream.stream });
+  }
+  if (seenStreams.size !== requested.size) {
+    throw new Error("DONE coverage is missing a requested stream");
+  }
+  return { collection_scope: collectionScope, streams, version: 1 };
+}
+
 /** Local collector has no durable blob transport, even for a declared emitter. */
 function rejectUnsupportedHostBlob(
   message: Extract<EmittedMessage, { type: "BLOB" }>,
@@ -1643,6 +1717,7 @@ async function streamConnectorIntoOutbox(
     }
   };
 
+  // biome-ignore lint/complexity/noExcessiveCognitiveComplexity: one ordered protocol handler keeps terminal and record state transitions together.
   const handleMessage = (message: EmittedMessage): void => {
     notifyOnMessage(message);
     if (done !== null) {
@@ -1674,7 +1749,21 @@ async function streamConnectorIntoOutbox(
       return;
     }
     if (message.type === "DONE") {
-      done = message;
+      if (message.coverage === undefined) {
+        done = message;
+        return;
+      }
+      if (message.status !== "succeeded") {
+        throw new Error(`${input.config.connector.connector_id} emitted coverage on failed DONE`);
+      }
+      done = {
+        ...message,
+        coverage: validateRunCoverageVerdict(
+          message.coverage,
+          input.config.connector.streams,
+          collectorScopeFingerprint(input.config.connector.scope)
+        ),
+      };
     }
   };
 
@@ -1746,7 +1835,8 @@ async function streamConnectorIntoOutbox(
         // ignore while the run still looks bounded.
         input.config.connector.enforcesSourceRoots === true
           ? resolveScopedSourceRoots(input.config.connector.scope)
-          : []
+          : [],
+        collectorScopeFingerprint(input.config.connector.scope)
       )
     )}\n`
   );
@@ -1957,6 +2047,10 @@ function recordConnectorChildFailureGap(input: {
   });
 }
 
+type TerminalEvidence =
+  | { facts: readonly TerminalCollectionFact[]; version: 1 }
+  | { facts: readonly TerminalCoverageFact[]; version: 2 };
+
 async function maybeCommitCheckpoint(input: {
   afterRecordsSummary: LocalDeviceOutboxSummary;
   bufferedState: Readonly<Record<string, unknown>>;
@@ -1968,19 +2062,19 @@ async function maybeCommitCheckpoint(input: {
   holderId: string;
   outbox: LocalDeviceOutbox;
   policy: CollectorOutboxPolicy;
-  terminalFacts: readonly TerminalCollectionFact[] | null;
+  terminalEvidence: TerminalEvidence | null;
   terminalRunBoundary: string;
   terminalRunConnectorInstanceId: string;
 }): Promise<{
   flushedState: Readonly<Record<string, unknown>> | null;
   statePutFailed: boolean;
 }> {
-  if (Object.keys(input.bufferedState).length === 0 && !input.terminalFacts) {
+  if (Object.keys(input.bufferedState).length === 0 && !input.terminalEvidence) {
     return { flushedState: null, statePutFailed: false };
   }
 
   const runId = input.config.runId ?? randomUUID();
-  const terminalCommitIdentity = input.terminalFacts
+  const terminalCommitIdentity = input.terminalEvidence
     ? {
         collection_boundary: input.terminalRunBoundary,
         connector_id: input.config.connector.connector_id,
@@ -1989,8 +2083,9 @@ async function maybeCommitCheckpoint(input: {
         run_id: runId,
         source_instance_id: input.config.sourceInstanceId,
         state_delta: input.bufferedState,
-        terminal_facts: input.terminalFacts,
-        version: 1 as const,
+        ...(input.terminalEvidence.version === 1
+          ? { terminal_facts: input.terminalEvidence.facts, version: 1 as const }
+          : { terminal_facts: input.terminalEvidence.facts, version: 2 as const }),
       }
     : null;
   const commitId = terminalCommitIdentity ? `terminal-commit:${hashCanonicalJson(terminalCommitIdentity)}` : null;
@@ -2225,9 +2320,11 @@ export function buildCollectorStartMessage(
   priorState?: Readonly<Record<string, unknown>> | null,
   resources: Readonly<Record<string, readonly string[]>> = {},
   timeRanges: CollectorStreamTimeRanges = {},
-  sourceRoots: readonly string[] = []
+  sourceRoots: readonly string[] = [],
+  collectionScope?: string
 ): StartMessage {
   const start: StartMessage = {
+    ...(collectionScope ? { collection_scope: collectionScope } : {}),
     scope: {
       streams: streams.map((name): StreamScope => {
         const streamResources = resources[name]?.filter((value) => typeof value === "string" && value.length > 0);
@@ -3117,7 +3214,7 @@ function assertTerminalRunCommitPayload(payload: unknown, id: string): TerminalR
     throw new OutboxPayloadShapeError(`terminal_run_commit payload is not an object: ${id}`);
   }
   if (
-    payload.version !== 1 ||
+    (payload.version !== 1 && payload.version !== 2) ||
     typeof payload.commit_id !== "string" ||
     typeof payload.run_id !== "string" ||
     typeof payload.device_id !== "string" ||
@@ -3128,11 +3225,11 @@ function assertTerminalRunCommitPayload(payload: unknown, id: string): TerminalR
     !isRecord(payload.state_delta) ||
     !Array.isArray(payload.terminal_facts) ||
     payload.terminal_facts.length === 0 ||
-    !payload.terminal_facts.every(isTerminalCollectionFact)
+    !payload.terminal_facts.every(payload.version === 1 ? isTerminalCollectionFact : isTerminalCoverageFact)
   ) {
     throw new OutboxPayloadShapeError(`terminal_run_commit payload missing or invalid fields: ${id}`);
   }
-  return {
+  const common = {
     collection_boundary: payload.collection_boundary,
     commit_id: payload.commit_id,
     connector_id: payload.connector_id,
@@ -3141,11 +3238,44 @@ function assertTerminalRunCommitPayload(payload: unknown, id: string): TerminalR
     run_id: payload.run_id,
     source_instance_id: payload.source_instance_id,
     state_delta: payload.state_delta,
+  };
+  if (payload.version === 2) {
+    const facts = payload.terminal_facts.filter(isTerminalCoverageFact);
+    if (new Set(facts.map((fact) => fact.stream)).size !== facts.length) {
+      throw new OutboxPayloadShapeError(`terminal_run_commit duplicate coverage streams: ${id}`);
+    }
+    return { ...common, terminal_facts: facts, version: 2 };
+  }
+  return {
+    ...common,
     terminal_facts: payload.terminal_facts.filter(isTerminalCollectionFact),
     version: 1,
   };
 }
 
+function isTerminalCoverageFact(value: unknown): value is TerminalCoverageFact {
+  if (
+    !isRecord(value) ||
+    typeof value.stream !== "string" ||
+    !value.stream ||
+    typeof value.scoped !== "boolean" ||
+    !Array.isArray(value.stores) ||
+    value.stores.length === 0
+  ) {
+    return false;
+  }
+  const { stores } = value;
+  return (
+    stores.every(
+      (store) =>
+        isRecord(store) &&
+        typeof store.store === "string" &&
+        Boolean(store.store) &&
+        (["collected", "partial", "unavailable", "failed"] as readonly unknown[]).includes(store.status)
+    ) && new Set(stores.map((store) => store.store)).size === stores.length
+  );
+}
+
 function isTerminalCollectionFact(value: unknown): value is TerminalCollectionFact {
   return (
     isRecord(value) &&
diff --git a/packages/collector-runtime/src/local-device-client.ts b/packages/collector-runtime/src/local-device-client.ts
index 0a801fbba..a80dc9e3a 100644
--- a/packages/collector-runtime/src/local-device-client.ts
+++ b/packages/collector-runtime/src/local-device-client.ts
@@ -173,8 +173,15 @@ export interface TerminalCollectionFact {
   stream: string;
 }
 
+/** Named stores are required for the server to check a signed inventory. */
+export interface TerminalCoverageFact {
+  scoped: boolean;
+  stores: readonly { store: string; status: "collected" | "partial" | "unavailable" | "failed" }[];
+  stream: string;
+}
+
 /** Durable terminal checkpoint and evidence envelope (local outbox schema v3+). */
-export interface TerminalRunCommitRequest {
+interface TerminalRunCommitBase {
   collection_boundary: string;
   commit_id: string;
   connector_id: string;
@@ -183,10 +190,14 @@ export interface TerminalRunCommitRequest {
   run_id: string;
   source_instance_id: string;
   state_delta: Record<string, unknown>;
-  terminal_facts: readonly TerminalCollectionFact[];
-  version: 1;
 }
 
+export type TerminalRunCommitRequest = TerminalRunCommitBase &
+  (
+    | { terminal_facts: readonly TerminalCollectionFact[]; version: 1 }
+    | { terminal_facts: readonly TerminalCoverageFact[]; version: 2 }
+  );
+
 export interface TerminalRunCommitResponse {
   commit_id: string;
   envelope_hash: string;
diff --git a/packages/collector-runtime/src/local-device-envelope.ts b/packages/collector-runtime/src/local-device-envelope.ts
index a3e122c1f..8be5b7ed8 100644
--- a/packages/collector-runtime/src/local-device-envelope.ts
+++ b/packages/collector-runtime/src/local-device-envelope.ts
@@ -59,7 +59,16 @@ export interface CanonicalTerminalFactInput {
   readonly stream: string;
 }
 
-export interface TerminalRunCommitEnvelopeInput {
+export interface CanonicalCoverageFactInput {
+  readonly scoped: boolean;
+  readonly stores: readonly {
+    readonly store: string;
+    readonly status: "collected" | "partial" | "unavailable" | "failed";
+  }[];
+  readonly stream: string;
+}
+
+interface TerminalRunCommitEnvelopeBase {
   readonly collection_boundary: string;
   readonly commit_id: string;
   readonly connector_id: string;
@@ -68,10 +77,14 @@ export interface TerminalRunCommitEnvelopeInput {
   readonly run_id: string;
   readonly source_instance_id: string;
   readonly state_delta: Readonly<Record<string, unknown>>;
-  readonly terminal_facts: readonly CanonicalTerminalFactInput[];
-  readonly version: 1;
 }
 
+export type TerminalRunCommitEnvelopeInput = TerminalRunCommitEnvelopeBase &
+  (
+    | { readonly terminal_facts: readonly CanonicalTerminalFactInput[]; readonly version: 1 }
+    | { readonly terminal_facts: readonly CanonicalCoverageFactInput[]; readonly version: 2 }
+  );
+
 /**
  * The one hash-authority projection shared by collector and reference server
  * (`pdpp/reference-implementation/operations/local-device-terminal-collection.ts`
@@ -81,6 +94,26 @@ export interface TerminalRunCommitEnvelopeInput {
  * identity MUST already be canonical before entry.
  */
 export function canonicalTerminalRunCommitEnvelope(input: TerminalRunCommitEnvelopeInput): unknown {
+  if (input.version === 2) {
+    return toCanonicalValue({
+      collection_boundary: input.collection_boundary,
+      commit_id: input.commit_id,
+      connector_id: input.connector_id,
+      connector_instance_id: input.connector_instance_id,
+      device_id: input.device_id,
+      run_id: input.run_id,
+      source_instance_id: input.source_instance_id,
+      state_delta: input.state_delta,
+      terminal_facts: input.terminal_facts
+        .map((fact) => ({
+          scoped: fact.scoped,
+          stores: [...fact.stores].sort((left, right) => left.store.localeCompare(right.store)),
+          stream: fact.stream,
+        }))
+        .sort((left, right) => left.stream.localeCompare(right.stream)),
+      version: 2,
+    });
+  }
   return toCanonicalValue({
     collection_boundary: input.collection_boundary,
     commit_id: input.commit_id,
diff --git a/packages/collector-runtime/src/local-device-outbox.test.ts b/packages/collector-runtime/src/local-device-outbox.test.ts
index 6ca8c487a..c0aa05850 100644
--- a/packages/collector-runtime/src/local-device-outbox.test.ts
+++ b/packages/collector-runtime/src/local-device-outbox.test.ts
@@ -43,6 +43,44 @@ test("LocalDeviceOutbox persists ready work and reopens from disk", async (t) =>
   }
 });
 
+test("acknowledged v2 terminal coverage survives outbox pruning and reopen", async (t) => {
+  const path = await tempOutboxPath(t);
+  const payload = {
+    collection_boundary: "scope-1",
+    terminal_facts: [{ scoped: true, stores: [{ status: "collected", store: "messages" }], stream: "messages" }],
+    version: 2,
+  };
+  const outbox = new LocalDeviceOutbox({ path });
+  outbox.enqueue({ id: "coverage-1", kind: "terminal_run_commit", payload, sourceInstanceId: "source-1" });
+  const [claimed] = outbox.claimReady({ holder: "worker", leaseMs: 60_000 });
+  assert.ok(claimed);
+  outbox.acknowledge({ holder: "worker", id: claimed.id, leaseEpoch: claimed.lease_epoch });
+  outbox.pruneSent({ dryRun: false, keepCount: 0, sourceInstanceId: "source-1" });
+  outbox.close();
+
+  const reopened = new LocalDeviceOutbox({ path });
+  try {
+    assert.equal(reopened.get("coverage-1"), null);
+    assert.deepEqual(reopened.latestTerminalCoverageReceipt({ sourceInstanceId: "source-1" }), {
+      collectionBoundary: "scope-1",
+      terminalFacts: payload.terminal_facts,
+    });
+    assert.equal(reopened.latestTerminalCoverageReceipt({ sourceInstanceId: "source-2" }), null);
+    reopened.enqueue({
+      id: "legacy-2",
+      kind: "terminal_run_commit",
+      payload: { collection_boundary: "scope-2", terminal_facts: [], version: 1 },
+      sourceInstanceId: "source-1",
+    });
+    const [legacy] = reopened.claimReady({ holder: "worker", leaseMs: 60_000 });
+    assert.ok(legacy);
+    reopened.acknowledge({ holder: "worker", id: legacy.id, leaseEpoch: legacy.lease_epoch });
+    assert.equal(reopened.latestTerminalCoverageReceipt({ sourceInstanceId: "source-1" }), null);
+  } finally {
+    reopened.close();
+  }
+});
+
 test("LocalDeviceOutbox supports deterministic ids and idempotent enqueue", () => {
   const outbox = new LocalDeviceOutbox({ path: ":memory:" });
   try {
@@ -157,7 +195,7 @@ test("schema v3/v4 migration preserves pending v2 work and accepts terminal run
     const version = migrated.prepare("PRAGMA user_version").get() as {
       user_version: number;
     };
-    assert.equal(version.user_version, 4);
+    assert.equal(version.user_version, 5);
   } finally {
     migrated.close();
   }
@@ -185,12 +223,12 @@ test("an old v2 binary uses the production version fence to refuse a v3 outbox",
   }
 });
 
-test("current binary refuses a future v5 outbox before applying schema", async (t) => {
+test("current binary refuses a future v6 outbox before applying schema", async (t) => {
   const path = await tempOutboxPath(t);
   const db = new DatabaseSync(path);
-  db.exec("PRAGMA user_version = 5");
+  db.exec("PRAGMA user_version = 6");
   db.close();
-  assert.throws(() => new LocalDeviceOutbox({ path }), /newer than supported version 4/);
+  assert.throws(() => new LocalDeviceOutbox({ path }), /newer than supported version 5/);
 });
 
 test("schema v3 migration failure rolls back, closes, and reopens with v2 bytes and metadata intact", async (t) => {
diff --git a/packages/collector-runtime/src/local-device-outbox.ts b/packages/collector-runtime/src/local-device-outbox.ts
index ec585e16c..4257d5a36 100644
--- a/packages/collector-runtime/src/local-device-outbox.ts
+++ b/packages/collector-runtime/src/local-device-outbox.ts
@@ -4,9 +4,10 @@
 import { mkdirSync } from "node:fs";
 import { dirname } from "node:path";
 import { DatabaseSync } from "node:sqlite";
+import type { TerminalCoverageFact } from "./local-device-client.ts";
 import { hashCanonicalJson } from "./local-device-envelope.ts";
 
-const CURRENT_SCHEMA_VERSION = 4;
+const CURRENT_SCHEMA_VERSION = 5;
 type OutboxMigrationV3FaultPoint = "after_copy";
 let outboxMigrationV3FaultHook: ((point: OutboxMigrationV3FaultPoint) => void) | null = null;
 
@@ -464,9 +465,11 @@ export class LocalDeviceOutbox {
 
   acknowledge(input: LocalDeviceOutboxLeaseInput): void {
     const now = this.#now();
-    const result = this.#db
-      .prepare(
-        `UPDATE local_device_outbox
+    this.#db.exec("BEGIN IMMEDIATE");
+    try {
+      const result = this.#db
+        .prepare(
+          `UPDATE local_device_outbox
            SET status = 'succeeded',
                acknowledged_at = ?,
                lease_holder = NULL,
@@ -477,9 +480,76 @@ export class LocalDeviceOutbox {
            AND lease_holder = ?
            AND lease_epoch = ?
            AND lease_until > ?`
+        )
+        .run(now, now, input.id, input.holder, input.leaseEpoch, now);
+      assertOneChange(Number(result.changes), `local outbox lease not current for acknowledge: ${input.id}`);
+      const row = this.#db
+        .prepare("SELECT source_instance_id, kind, payload_json FROM local_device_outbox WHERE id = ?")
+        .get(input.id);
+      if (isRecord(row) && row.kind === "terminal_run_commit" && typeof row.source_instance_id === "string") {
+        // The receipt tracks the latest ACK, including a legacy commit without
+        // coverage. Keep this in the ACK transaction so pruning cannot erase proof.
+        this.#db
+          .prepare("DELETE FROM local_device_terminal_coverage_receipts WHERE source_instance_id = ?")
+          .run(row.source_instance_id);
+        const payload = typeof row.payload_json === "string" ? JSON.parse(row.payload_json) : null;
+        if (
+          isRecord(payload) &&
+          payload.version === 2 &&
+          typeof payload.collection_boundary === "string" &&
+          payload.collection_boundary.length > 0 &&
+          Array.isArray(payload.terminal_facts) &&
+          payload.terminal_facts.length > 0 &&
+          payload.terminal_facts.every(isTerminalCoverageFact) &&
+          new Set(payload.terminal_facts.map((fact: TerminalCoverageFact) => fact.stream)).size ===
+            payload.terminal_facts.length &&
+          payload.terminal_facts.every(
+            (fact: TerminalCoverageFact) => new Set(fact.stores.map((store) => store.store)).size === fact.stores.length
+          )
+        ) {
+          this.#db
+            .prepare(`INSERT INTO local_device_terminal_coverage_receipts
+            (source_instance_id, collection_boundary, terminal_facts_json, acknowledged_at)
+            VALUES (?, ?, ?, ?)`)
+            .run(row.source_instance_id, payload.collection_boundary, JSON.stringify(payload.terminal_facts), now);
+        }
+      }
+      this.#db.exec("COMMIT");
+    } catch (error) {
+      this.#db.exec("ROLLBACK");
+      throw error;
+    }
+  }
+
+  latestTerminalCoverageReceipt(input: { sourceInstanceId: string }): {
+    collectionBoundary: string;
+    terminalFacts: readonly TerminalCoverageFact[];
+  } | null {
+    const row = this.#db
+      .prepare(`SELECT collection_boundary, terminal_facts_json
+      FROM local_device_terminal_coverage_receipts WHERE source_instance_id = ?`)
+      .get(input.sourceInstanceId);
+    if (!isRecord(row) || typeof row.collection_boundary !== "string" || typeof row.terminal_facts_json !== "string") {
+      return null;
+    }
+    let facts: unknown;
+    try {
+      facts = JSON.parse(row.terminal_facts_json);
+    } catch {
+      return null;
+    }
+    if (
+      !Array.isArray(facts) ||
+      facts.length === 0 ||
+      !facts.every(isTerminalCoverageFact) ||
+      new Set(facts.map((fact: TerminalCoverageFact) => fact.stream)).size !== facts.length ||
+      facts.some(
+        (fact: TerminalCoverageFact) => new Set(fact.stores.map((store) => store.store)).size !== fact.stores.length
       )
-      .run(now, now, input.id, input.holder, input.leaseEpoch, now);
-    assertOneChange(Number(result.changes), `local outbox lease not current for acknowledge: ${input.id}`);
+    ) {
+      return null;
+    }
+    return { collectionBoundary: row.collection_boundary, terminalFacts: facts };
   }
 
   failRetryable(input: LocalDeviceOutboxFailInput): void {
@@ -1415,6 +1485,7 @@ export class LocalDeviceOutbox {
       this.#applySchemaV3();
     }
     this.#applySchemaV4();
+    this.#applySchemaV5();
     if (version < CURRENT_SCHEMA_VERSION) {
       this.#db.exec(`PRAGMA user_version = ${CURRENT_SCHEMA_VERSION}`);
     }
@@ -1551,6 +1622,18 @@ export class LocalDeviceOutbox {
     `);
   }
 
+  /** Schema v5 — latest acknowledged coverage survives outbox pruning. */
+  #applySchemaV5(): void {
+    this.#db.exec(`
+      CREATE TABLE IF NOT EXISTS local_device_terminal_coverage_receipts (
+        source_instance_id TEXT PRIMARY KEY,
+        collection_boundary TEXT NOT NULL,
+        terminal_facts_json TEXT NOT NULL,
+        acknowledged_at TEXT NOT NULL
+      );
+    `);
+  }
+
   #selectReady(
     sourceInstanceId: string | undefined,
     now: string,
@@ -1607,6 +1690,27 @@ export function buildLocalDeviceOutboxId(input: BuildLocalDeviceOutboxIdInput):
   })}`;
 }
 
+function isTerminalCoverageFact(value: unknown): value is TerminalCoverageFact {
+  return (
+    isRecord(value) &&
+    typeof value.stream === "string" &&
+    value.stream.length > 0 &&
+    typeof value.scoped === "boolean" &&
+    Array.isArray(value.stores) &&
+    value.stores.length > 0 &&
+    value.stores.every(
+      (store: unknown) =>
+        isRecord(store) &&
+        typeof store.store === "string" &&
+        store.store.length > 0 &&
+        (store.status === "collected" ||
+          store.status === "partial" ||
+          store.status === "unavailable" ||
+          store.status === "failed")
+    )
+  );
+}
+
 /**
  * Sentinel stream name marking a `record_batch` row that carries no records,
  * so the observed-stream index covers it (and it is never reparsed as a
diff --git a/packages/connector-protocol/src/connector-runtime-protocol.ts b/packages/connector-protocol/src/connector-runtime-protocol.ts
index ad3803ea7..346e6c93d 100644
--- a/packages/connector-protocol/src/connector-runtime-protocol.ts
+++ b/packages/connector-protocol/src/connector-runtime-protocol.ts
@@ -307,6 +307,8 @@ export interface StartMessage {
    * backward compatibility with connectors/tests that predate this field.
    */
   collection_mode?: "full_refresh" | "incremental";
+  /** Canonical boundary fingerprint that a terminal coverage verdict must echo. */
+  collection_scope?: string;
   detail_gaps?: readonly DetailGapStartEntry[];
   /**
    * The host advertises the protocol capabilities it implements. Absent means
@@ -769,6 +771,21 @@ export interface ProgressExtra {
  */
 export type SkipResultBoundaryClaim = "provider_history_boundary";
 
+/** A terminal claim about one named source store within a requested stream. */
+export type RunCoverageStatus = "collected" | "partial" | "unavailable" | "failed";
+
+export interface RunCoverageVerdict {
+  /** Fingerprint received in START; `unscoped` names a full pass. */
+  collection_scope: string;
+  streams: readonly {
+    /** True only when the requested boundary was enforced during enumeration. */
+    scoped: boolean;
+    stores: readonly { status: RunCoverageStatus; store: string }[];
+    stream: string;
+  }[];
+  version: 1;
+}
+
 export type EmittedMessage =
   | HostBlobMessage
   | {
@@ -892,6 +909,8 @@ export type EmittedMessage =
       type: "DONE";
       status: "succeeded" | "failed";
       records_emitted: number;
+      /** Optional terminal store verdict; absence carries no coverage proof. */
+      coverage?: RunCoverageVerdict;
       error?: {
         code?: string;
         message: string;
diff --git a/packages/connector-protocol/src/index.ts b/packages/connector-protocol/src/index.ts
index 4bc72776d..e3bedc139 100644
--- a/packages/connector-protocol/src/index.ts
+++ b/packages/connector-protocol/src/index.ts
@@ -54,6 +54,8 @@ export type {
   RecordData,
   RetryableDetailGapMessage,
   RetryableDetailGapReason,
+  RunCoverageStatus,
+  RunCoverageVerdict,
   SkipResultBoundaryClaim,
   StartMessage,
   StreamEvidenceOutcomes,
diff --git a/packages/local-collector/bin/pdpp-local-collector.ts b/packages/local-collector/bin/pdpp-local-collector.ts
index 10919584c..c293a9b87 100644
--- a/packages/local-collector/bin/pdpp-local-collector.ts
+++ b/packages/local-collector/bin/pdpp-local-collector.ts
@@ -1681,6 +1681,11 @@ export interface LocalOutboxStatusOutput {
     observed: boolean | null;
     record_batches: number;
   };
+  /** Latest server-acknowledged typed terminal verdict, retained after outbox pruning. */
+  terminal_coverage: {
+    collection_boundary: string | null;
+    verdict: "covered" | "incomplete" | "no_evidence";
+  };
   db: {
     configured: boolean;
     exists: boolean;
@@ -1695,13 +1700,11 @@ export interface LocalOutboxStatusOutput {
    */
   deployment_posture: LocalCollectorDeploymentPosture;
   /**
-   * The single mutually-exclusive lifecycle state for this lane, derived
-   * from the outbox counts plus the coverage observation. One of
-   * healthy_idle, draining, retryable_backlog, dead_letter, stale_lease, or
-   * coverage_missing. This is the honest active/drain/coverage signal an
-   * operator or agent reads instead of inferring from raw counts.
+   * The single lifecycle state for this lane. Open work takes priority;
+   * a drained scoped lane is covered only after a v2 terminal ACK, and
+   * otherwise reports incomplete or no evidence.
    */
-  lifecycle_state: LocalCollectorLifecycleState;
+  lifecycle_state: LocalCollectorLifecycleState | "covered" | "coverage_incomplete" | "no_evidence";
   outbox: {
     counts: {
       dead_letter: number;
@@ -1756,11 +1759,10 @@ export interface LocalCollectorReferenceRouteCheck {
 
 export interface LocalOutboxDoctorOutput extends LocalOutboxStatusOutput {
   checks: {
+    terminal_coverage: "ok" | "warn" | "unknown";
     /**
-     * `warn` once the lane has collected records but never carried a
-     * `coverage_diagnostics` record (the local shape behind a stuck
-     * dashboard `coverage_unknown`). `ok` when coverage was observed, the
-     * lane is empty, or no connection id scoped the scan.
+     * Legacy diagnostic observation retained for older status clients.
+     * It cannot by itself prove typed terminal coverage.
      */
     coverage_diagnostics: "ok" | "warn";
     /**
@@ -1843,13 +1845,22 @@ export function inspectLocalOutboxStatus(
   const exists = existsSync(dbPath);
   const inspection = exists
     ? readOutboxInspection(dbPath, options.sourceInstanceId)
-    : { coverageObserved: null, recordBatchCount: 0, summary: emptyOutboxSummary() };
+    : { coverageObserved: null, recordBatchCount: 0, summary: emptyOutboxSummary(), terminalCoverage: null };
   const { coverageObserved, recordBatchCount, summary } = inspection;
-  const lifecycleState = deriveLocalCollectorLifecycleState({
+  const outboxLifecycleState = deriveLocalCollectorLifecycleState({
     coverageObserved,
     recordBatchCount,
     summary,
   });
+  const terminalVerdict = terminalCoverageVerdict(inspection.terminalCoverage);
+  const lifecycleState =
+    options.sourceInstanceId && (outboxLifecycleState === "healthy_idle" || outboxLifecycleState === "coverage_missing")
+      ? terminalVerdict === "covered"
+        ? "covered"
+        : terminalVerdict === "incomplete"
+          ? "coverage_incomplete"
+          : "no_evidence"
+      : outboxLifecycleState;
   const deploymentPosture = deps.deploymentPosture ?? classifyLocalCollectorDeploymentPosture();
   return {
     collector_protocol_version: COLLECTOR_PROTOCOL_VERSION,
@@ -1861,6 +1872,10 @@ export function inspectLocalOutboxStatus(
       observed: inspection.coverageObserved,
       record_batches: inspection.recordBatchCount,
     },
+    terminal_coverage: {
+      collection_boundary: inspection.terminalCoverage?.collectionBoundary ?? null,
+      verdict: terminalVerdict,
+    },
     db: {
       configured: true,
       exists,
@@ -2002,14 +2017,41 @@ function redactReferenceBaseUrl(raw: string): string {
 }
 
 export function buildLocalOutboxDoctor(
-  status: LocalOutboxStatusOutput,
+  statusInput: LocalOutboxStatusOutput,
   errorSummary?: LocalDeviceOutboxDeadLetterErrorSummary | null,
   referenceRoute?: LocalCollectorReferenceRouteCheck | null
 ): LocalOutboxDoctorOutput {
+  const activeScope = referenceRoute?.status === "ok" ? referenceRoute.scope : undefined;
+  const staleScope = Boolean(
+    activeScope &&
+      statusInput.terminal_coverage.collection_boundary &&
+      statusInput.terminal_coverage.collection_boundary !== activeScope
+  );
+  const status: LocalOutboxStatusOutput = staleScope
+    ? {
+        ...statusInput,
+        lifecycle_state: statusInput.lifecycle_state === "covered" ? "no_evidence" : statusInput.lifecycle_state,
+        terminal_coverage: { ...statusInput.terminal_coverage, verdict: "no_evidence" },
+      }
+    : statusInput;
   const posture = status.deployment_posture;
   const postureDisqualifiesEvidence = posture.kind === "repo_dist_override" || posture.is_placeholder_version;
   const checks: LocalOutboxDoctorOutput["checks"] = {
-    coverage_diagnostics: status.lifecycle_state === "coverage_missing" ? "warn" : "ok",
+    coverage_diagnostics:
+      status.terminal_coverage.verdict !== "covered" &&
+      status.coverage.observed === false &&
+      status.coverage.record_batches > 0 &&
+      status.lifecycle_state === "no_evidence"
+        ? "warn"
+        : "ok",
+    terminal_coverage:
+      staleScope
+        ? "warn"
+        : status.terminal_coverage.verdict === "covered"
+        ? "ok"
+        : status.terminal_coverage.verdict === "incomplete"
+          ? "warn"
+          : "unknown",
     deployment_posture: postureDisqualifiesEvidence ? "warn" : "ok",
     expired_leases: status.outbox.expired_leases > 0 ? "warn" : "ok",
     outbox_db: status.db.exists ? "ok" : "missing",
@@ -2037,13 +2079,16 @@ export function buildLocalOutboxDoctor(
   }
   if (checks.coverage_diagnostics === "warn") {
     remediation.push(
-      `This lane drained ${status.coverage.record_batches} record batch(es) but never carried a ` +
-        "`coverage_diagnostics` record, so the dashboard can only show coverage_unknown. " +
-        "Re-run with a build that emits `coverage_diagnostics` by default and the default stream set (no `--streams`): " +
-        "`npx -y @pdpp/local-collector run …` (or `pdpp-local-collector run …` if already on a current build). " +
-        "Older installs may omit `coverage_diagnostics` from bundled defaults. `npx -y` fetches the latest *published* build, " +
-        "which can still lag the repo build — if the gap persists, confirm the published `latest` carries the fix with " +
-        "`pnpm release:dist-tag-check` (release owner) rather than assuming the published build is current."
+      `This lane drained ${status.coverage.record_batches} record batch(es) without an acknowledged typed terminal ` +
+        "coverage verdict. Coverage remains unknown. Re-run with a connector release that emits DONE.coverage " +
+        "and a collector that accepts its terminal commit."
+    );
+  }
+  if (checks.terminal_coverage === "warn") {
+    remediation.push(
+      staleScope
+        ? "The latest acknowledged terminal verdict belongs to an older collection boundary. Re-run against the active scope before treating this lane as covered."
+        : "The latest acknowledged terminal verdict is incomplete; inspect the connector run diagnostics and re-run after resolving the missing store coverage."
     );
   }
   if (checks.deployment_posture === "warn") {
@@ -2058,6 +2103,7 @@ export function buildLocalOutboxDoctor(
     checks,
     ...(includeSummary && errorSummary ? { dead_letter_error_summary: errorSummary } : {}),
     ...(referenceRoute ? { reference_route: referenceRoute } : {}),
+    ...(activeScope ? { scope: { active: activeScope, unknown: false } } : {}),
     ...(remediation.length > 0 ? { remediation } : {}),
     status: doctorSeverityForChecks(checks),
   };
@@ -2124,6 +2170,7 @@ function doctorSeverityForChecks(checks: LocalOutboxDoctorOutput["checks"]): "ok
     checks.expired_leases === "warn" ||
     checks.outbox_db === "missing" ||
     checks.coverage_diagnostics === "warn" ||
+    checks.terminal_coverage === "warn" ||
     checks.deployment_posture === "warn"
   ) {
     return "warning";
@@ -3560,6 +3607,7 @@ interface LocalOutboxInspection {
   coverageObserved: boolean | null;
   recordBatchCount: number;
   summary: LocalDeviceOutboxSummary;
+  terminalCoverage: { collectionBoundary: string; terminalFacts: readonly { scoped: boolean; stores: readonly { status: string }[] }[] } | null;
 }
 
 function readOutboxInspection(path: string, sourceInstanceId: string | undefined): LocalOutboxInspection {
@@ -3567,18 +3615,33 @@ function readOutboxInspection(path: string, sourceInstanceId: string | undefined
   try {
     const summary = outbox.summary(sourceInstanceId ? { sourceInstanceId } : {});
     if (!sourceInstanceId) {
-      return { coverageObserved: null, recordBatchCount: 0, summary };
+      return { coverageObserved: null, recordBatchCount: 0, summary, terminalCoverage: null };
     }
     return {
       coverageObserved: outbox.hasObservedStream({ sourceInstanceId, stream: COVERAGE_DIAGNOSTICS_STREAM }),
       recordBatchCount: outbox.countRecordBatches({ sourceInstanceId }),
       summary,
+      terminalCoverage: outbox.latestTerminalCoverageReceipt({ sourceInstanceId }),
     };
   } finally {
     outbox.close();
   }
 }
 
+function terminalCoverageVerdict(
+  receipt: LocalOutboxInspection["terminalCoverage"]
+): LocalOutboxStatusOutput["terminal_coverage"]["verdict"] {
+  if (!receipt || !receipt.collectionBoundary.trim()) {
+    return "no_evidence";
+  }
+  return receipt.terminalFacts.length > 0 &&
+    receipt.terminalFacts.every(
+      (fact) => fact.scoped && fact.stores.length > 0 && fact.stores.every((store) => store.status === "collected")
+    )
+    ? "covered"
+    : "incomplete";
+}
+
 function emptyOutboxSummary(): LocalDeviceOutboxSummary {
   return {
     deadLetter: 0,
diff --git a/packages/local-collector/src/managed/artifact-contract.ts b/packages/local-collector/src/managed/artifact-contract.ts
index a21c42c41..f6d7d4fd9 100644
--- a/packages/local-collector/src/managed/artifact-contract.ts
+++ b/packages/local-collector/src/managed/artifact-contract.ts
@@ -162,7 +162,7 @@ export interface CollectionProfile {
   readonly runtime_requirements?: {
     readonly bindings?: Readonly<Record<string, { readonly required: boolean }>>;
   };
-  readonly streams?: readonly { readonly name?: string; readonly id?: string }[];
+  readonly streams?: readonly { readonly name?: string; readonly id?: string; readonly coverage_stores?: readonly string[] }[];
 }
 
 /**
diff --git a/packages/local-collector/test/runner.test.ts b/packages/local-collector/test/runner.test.ts
index 11db9e8aa..bbb9840ca 100644
--- a/packages/local-collector/test/runner.test.ts
+++ b/packages/local-collector/test/runner.test.ts
@@ -231,18 +231,15 @@ test("bundled connector entries declare filesystem binding as required", () => {
   }
 });
 
-test("bundled connector defaults request coverage_diagnostics whenever the connector's manifest declares that stream, so a drained run is never coverage_unknown", async () => {
+test("legacy profiles that declare coverage_diagnostics request it by default", async () => {
   // Reads each connector's pinned Collection Profile (the manifest of the
   // release the collector installs), which the reference server keeps under
   // reference-implementation/server/local-collector-profiles/.
   //
-  // Local-device collectors push records from a device outbox and write no
-  // spine run, so the connection-health rollup can only project a non-`unknown`
-  // coverage axis from durable `coverage_diagnostics` records where that is the
-  // connector's coverage mechanism. If the published default stream set omits
-  // that stream, every `pdpp-local-collector run` emits zero coverage evidence
-  // and the dashboard is stuck at `coverage_unknown` even after a healthy
-  // drain. See openspec/changes/derive-local-collector-coverage-from-diagnostics.
+  // Older profiles used `coverage_diagnostics` records. When a profile still
+  // declares that stream, its default set must request it. Typed terminal
+  // coverage is checked separately below; this legacy stream alone proves
+  // no current coverage verdict.
   //
   // Not every connector uses this mechanism: iMessage declares a per-stream
   // `coverage_strategy` (snapshot_import_receipt) in its manifest instead, and
@@ -471,6 +468,7 @@ test("local collector doctor flags missing db, expired leases, and dead letters"
       expired_leases: "warn",
       outbox_db: "ok",
       outbox_failures: "fail",
+      terminal_coverage: "unknown",
     });
     // Dead letters dominate the lifecycle state even though no coverage
     // diagnostic was observed: a lane that needs recovery is not first
@@ -2532,9 +2530,7 @@ test("inspectLocalOutboxStatus reads connection-scoped counts from the scoped de
   assert.equal(bOnly.outbox.counts.total, 1);
 });
 
-// --- Lifecycle state axis (Target 2/4): status/doctor must distinguish
-// healthy_idle, draining, retryable_backlog, dead_letter, stale_lease, and
-// coverage_missing from the durable outbox alone. ---
+// --- Lifecycle state axis: queue health and acknowledged terminal coverage. ---
 
 function statusFor(path, sourceInstanceId = "src-1") {
   return inspectLocalOutboxStatus(
@@ -2574,12 +2570,166 @@ function drainRow(outbox, id, sourceInstanceId = "src-1") {
   outbox.acknowledge({ holder: "drainer", id: claim.id, leaseEpoch: claim.lease_epoch });
 }
 
-test("lifecycle_state is healthy_idle on an empty outbox (nothing collected, no coverage to miss)", async () => {
+function acknowledgeTerminalCoverage(outbox, { id, sourceInstanceId = "src-1", stores, scoped = true, version = 2 }) {
+  outbox.enqueue({
+    id,
+    kind: "terminal_run_commit",
+    payload: {
+      collection_boundary: "unscoped",
+      commit_id: id,
+      connector_id: "claude_code",
+      connector_instance_id: "connector-1",
+      device_id: "device-1",
+      run_id: id,
+      source_instance_id: sourceInstanceId,
+      state_delta: {},
+      terminal_facts: version === 2
+        ? [{ scoped, stores, stream: "sessions" }]
+        : [{ coverage_statuses: ["collected"], stream: "sessions" }],
+      version,
+    },
+    sourceInstanceId,
+  });
+  drainRow(outbox, id, sourceInstanceId);
+}
+
+test("acknowledged v2 coverage stays covered after sent rows are pruned", async () => {
+  const path = await tempOutboxPath();
+  const outbox = new LocalDeviceOutbox({ path });
+  try {
+    acknowledgeTerminalCoverage(outbox, {
+      id: "terminal-covered",
+      stores: [{ store: "local_files", status: "collected" }],
+    });
+    outbox.pruneSent({ dryRun: false, keepCount: 0, sourceInstanceId: "src-1" });
+  } finally {
+    outbox.close();
+  }
+  const status = statusFor(path);
+  assert.equal(status.outbox.counts.total, 0);
+  assert.equal(status.terminal_coverage.verdict, "covered");
+  assert.equal(status.terminal_coverage.collection_boundary, "unscoped");
+  assert.equal(status.lifecycle_state, "covered");
+  assert.equal(buildLocalOutboxDoctor(status).checks.terminal_coverage, "ok");
+  const matchingDoctor = buildLocalOutboxDoctor(status, null, {
+    base_url: "https://pdpp.example.com/",
+    check: "device_source_state",
+    scope: "unscoped",
+    status: "ok",
+  });
+  assert.equal(matchingDoctor.lifecycle_state, "covered");
+  assert.equal(matchingDoctor.scope.active, "unscoped");
+  const staleDoctor = buildLocalOutboxDoctor(status, null, {
+    base_url: "https://pdpp.example.com/",
+    check: "device_source_state",
+    scope: "new-owner-scope",
+    status: "ok",
+  });
+  assert.equal(staleDoctor.lifecycle_state, "no_evidence");
+  assert.equal(staleDoctor.terminal_coverage.verdict, "no_evidence");
+  assert.equal(staleDoctor.checks.terminal_coverage, "warn");
+  assert.equal(staleDoctor.status, "warning");
+});
+
+test("a later partial terminal receipt replaces a previously covered verdict", async () => {
+  const path = await tempOutboxPath();
+  const outbox = new LocalDeviceOutbox({ path });
+  try {
+    acknowledgeTerminalCoverage(outbox, {
+      id: "terminal-first",
+      stores: [{ store: "local_files", status: "collected" }],
+    });
+    acknowledgeTerminalCoverage(outbox, {
+      id: "terminal-second",
+      stores: [{ store: "local_files", status: "partial" }],
+    });
+  } finally {
+    outbox.close();
+  }
+  const status = statusFor(path);
+  assert.equal(status.terminal_coverage.verdict, "incomplete");
+  assert.equal(status.lifecycle_state, "coverage_incomplete");
+});
+
+test("a later v1 terminal ACK clears prior v2 coverage proof", async () => {
+  const path = await tempOutboxPath();
+  const outbox = new LocalDeviceOutbox({ path });
+  try {
+    acknowledgeTerminalCoverage(outbox, {
+      id: "terminal-v2",
+      stores: [{ store: "local_files", status: "collected" }],
+    });
+    acknowledgeTerminalCoverage(outbox, {
+      id: "terminal-v1",
+      stores: [{ store: "local_files", status: "collected" }],
+      version: 1,
+    });
+  } finally {
+    outbox.close();
+  }
+  const status = statusFor(path);
+  assert.equal(status.terminal_coverage.verdict, "no_evidence");
+  assert.equal(status.lifecycle_state, "no_evidence");
+});
+
+test("partial, failed, unscoped, and v1 terminal commits do not prove coverage", async () => {
+  for (const [statusValue, scoped, version, expected] of [
+    ["partial", true, 2, "incomplete"],
+    ["failed", true, 2, "incomplete"],
+    ["unavailable", true, 2, "incomplete"],
+    ["collected", false, 2, "incomplete"],
+    ["collected", true, 1, "no_evidence"],
+  ]) {
+    const path = await tempOutboxPath();
+    const outbox = new LocalDeviceOutbox({ path });
+    try {
+      acknowledgeTerminalCoverage(outbox, {
+        id: `terminal-${statusValue}-${scoped}-${version}`,
+        stores: [{ store: "local_files", status: statusValue }],
+        scoped,
+        version,
+      });
+      outbox.pruneSent({ dryRun: false, keepCount: 0, sourceInstanceId: "src-1" });
+    } finally {
+      outbox.close();
+    }
+    const observed = statusFor(path);
+    assert.equal(observed.terminal_coverage.verdict, expected);
+    assert.notEqual(observed.lifecycle_state, "covered");
+    assert.equal(buildLocalOutboxDoctor(observed).checks.terminal_coverage, expected === "no_evidence" ? "unknown" : "warn");
+  }
+});
+
+test("a malformed persisted terminal receipt stays unknown without crashing status", async () => {
+  const path = await tempOutboxPath();
+  const outbox = new LocalDeviceOutbox({ path });
+  try {
+    acknowledgeTerminalCoverage(outbox, {
+      id: "terminal-corrupt",
+      stores: [{ store: "local_files", status: "collected" }],
+    });
+  } finally {
+    outbox.close();
+  }
+  const db = new DatabaseSync(path);
+  try {
+    db.prepare("UPDATE local_device_terminal_coverage_receipts SET terminal_facts_json = ? WHERE source_instance_id = ?")
+      .run("{malformed", "src-1");
+  } finally {
+    db.close();
+  }
+  const status = statusFor(path);
+  assert.equal(status.terminal_coverage.verdict, "no_evidence");
+  assert.equal(status.lifecycle_state, "no_evidence");
+});
+
+test("lifecycle_state is no_evidence on an empty scoped outbox", async () => {
   const path = await tempOutboxPath();
   const outbox = new LocalDeviceOutbox({ path });
   outbox.close();
   const status = statusFor(path);
-  assert.equal(status.lifecycle_state, "healthy_idle");
+  assert.equal(status.lifecycle_state, "no_evidence");
+  assert.equal(status.terminal_coverage.verdict, "no_evidence");
   assert.deepEqual(status.coverage, { observed: false, record_batches: 0 });
   assert.equal(buildLocalOutboxDoctor(status).checks.coverage_diagnostics, "ok");
 });
@@ -2654,7 +2804,7 @@ test("lifecycle_state is stale_lease when a lease is past expiry", async () => {
   assert.ok(doctor.remediation.some((line) => /past expiry/.test(line)));
 });
 
-test("lifecycle_state is coverage_missing after a clean drain that never carried a coverage record", async () => {
+test("lifecycle_state is no_evidence after a clean drain without a typed terminal verdict", async () => {
   const path = await tempOutboxPath();
   const outbox = new LocalDeviceOutbox({ path });
   try {
@@ -2669,36 +2819,16 @@ test("lifecycle_state is coverage_missing after a clean drain that never carried
   assert.equal(status.outbox.counts.leased, 0);
   assert.equal(status.coverage.observed, false);
   assert.ok(status.coverage.record_batches >= 1);
-  assert.equal(status.lifecycle_state, "coverage_missing");
+  assert.equal(status.lifecycle_state, "no_evidence");
+  assert.equal(status.terminal_coverage.verdict, "no_evidence");
 
   const doctor = buildLocalOutboxDoctor(status);
   assert.equal(doctor.checks.coverage_diagnostics, "warn");
   assert.equal(doctor.status, "warning");
-  // biome-ignore lint/performance/useTopLevelRegex: inline assertion literal scoped to this test case; hoisting would separate the pattern from the single call site it documents.
-  assert.ok(doctor.remediation.some((line) => /coverage_unknown/.test(line)));
-  // biome-ignore lint/performance/useTopLevelRegex: inline assertion literal scoped to this test case; hoisting would separate the pattern from the single call site it documents.
-  assert.ok(doctor.remediation.some((line) => /default stream set/.test(line)));
-  // The hint must name the npx -y path so an operator with a stale globally-installed
-  // binary (which may predate coverage_diagnostics in bundled defaults) gets the right
-  // recovery: fetch a current published build, not just re-run with the existing install.
-  assert.ok(
-    // biome-ignore lint/performance/useTopLevelRegex: inline assertion literal scoped to this test case; hoisting would separate the pattern from the single call site it documents.
-    doctor.remediation.some((line) => /npx -y @pdpp\/local-collector/.test(line)),
-    "coverage_missing remediation must name the npx -y upgrade path"
-  );
-  // …but it must not promise that the published build is current. When the
-  // coverage fix only exists on the repo build and not yet published, the npx
-  // path alone would not close the gap, so the hint routes verification through
-  // the release owner's dist-tag check instead of asserting the publish is current.
-  // biome-ignore lint/performance/useTopLevelRegex: inline assertion literal scoped to this test case; hoisting would separate the pattern from the single call site it documents.
-  const coverageHint = doctor.remediation.find((line) => /coverage_unknown/.test(line));
-  // biome-ignore lint/performance/useTopLevelRegex: inline assertion literal scoped to this test case; hoisting would separate the pattern from the single call site it documents.
-  assert.match(coverageHint, /can still lag the repo build/);
-  // biome-ignore lint/performance/useTopLevelRegex: inline assertion literal scoped to this test case; hoisting would separate the pattern from the single call site it documents.
-  assert.match(coverageHint, /release:dist-tag-check/);
+  assert.ok(doctor.remediation.some((line) => /Coverage remains unknown/.test(line)));
 });
 
-test("lifecycle_state is healthy_idle once a drained lane has carried a coverage_diagnostics record", async () => {
+test("legacy coverage_diagnostics alone does not prove typed terminal coverage", async () => {
   const path = await tempOutboxPath();
   const outbox = new LocalDeviceOutbox({ path });
   try {
@@ -2711,7 +2841,8 @@ test("lifecycle_state is healthy_idle once a drained lane has carried a coverage
   }
   const status = statusFor(path);
   assert.equal(status.coverage.observed, true);
-  assert.equal(status.lifecycle_state, "healthy_idle");
+  assert.equal(status.lifecycle_state, "no_evidence");
+  assert.equal(status.terminal_coverage.verdict, "no_evidence");
   assert.equal(buildLocalOutboxDoctor(status).checks.coverage_diagnostics, "ok");
 });
 
@@ -2784,10 +2915,10 @@ test("status/doctor stay bounded and report observed:null on a giant legacy (pre
     queuePath: path,
     sourceInstanceId: "src-legacy",
   });
-  // Unknown coverage suppresses the coverage_missing verdict (never guess from
-  // a partial scan); the lane is fully drained otherwise, so it is healthy_idle.
+  // The bounded legacy scan cannot supply typed terminal proof; a fully
+  // drained lane still reports no evidence.
   assert.equal(status.coverage.observed, null);
-  assert.equal(status.lifecycle_state, "healthy_idle");
+  assert.equal(status.lifecycle_state, "no_evidence");
 
   const doctor = buildLocalOutboxDoctor(status);
   assert.equal(doctor.checks.coverage_diagnostics, "ok");
diff --git a/reference-implementation/operations/local-device-terminal-collection.ts b/reference-implementation/operations/local-device-terminal-collection.ts
index 6efe9ab52..2505fb1b1 100644
--- a/reference-implementation/operations/local-device-terminal-collection.ts
+++ b/reference-implementation/operations/local-device-terminal-collection.ts
@@ -3,6 +3,7 @@
 
 import { createHash } from "node:crypto";
 import { canonicalTerminalRunCommitJson } from "@pdpp/reference-contract/common";
+import { canonicalTerminalRunCommitEnvelope } from "@pdpp/collector-runtime/local-device-envelope";
 import { readRuntimeCollectionFact } from "../server/runtime-collection-facts.ts";
 import type { ResolvedTerminalRunCommit, TerminalRunCommitResult } from "../server/stores/terminal-run-commit-store.ts";
 import { TerminalRunCommitConflictError } from "../server/stores/terminal-run-commit-store.ts";
@@ -32,6 +33,7 @@ interface TerminalContext {
 export interface TerminalRunCommitContext extends TerminalContext {
   canonicalConnectorKey: (value: string | null | undefined) => string | null;
   commitTerminalRun: (input: ResolvedTerminalRunCommit) => Promise<TerminalRunCommitResult>;
+  getConnectorManifest?: (connectorId: string) => Promise<unknown> | unknown;
 }
 
 /**
@@ -68,8 +70,9 @@ export async function handleLocalDeviceTerminalRunCommit(input: {
     const runId = body && readRequiredString(body.run_id);
     const collectionBoundary = body && readRequiredString(body.collection_boundary);
     const stateDelta = body && asObject(body.state_delta);
-    const normalizedFacts =
-      body && Array.isArray(body.terminal_facts) ? normalizeTerminalFacts(body.terminal_facts) : null;
+    const version = body?.version;
+    const rawFacts = body && Array.isArray(body.terminal_facts) ? body.terminal_facts : null;
+    const normalizedFacts = version === 1 && rawFacts ? normalizeTerminalFacts(rawFacts) : null;
     const canonicalConnectorId = ctx.canonicalConnectorKey(authorized.sourceInstance.connectorId);
     // Canonicalize BOTH sides before comparing, exactly as `sameConnectorType`
     // in routes/ref-device-exporters.ts already does for the record-batch leg.
@@ -83,7 +86,7 @@ export async function handleLocalDeviceTerminalRunCommit(input: {
       ? (ctx.canonicalConnectorKey(reportedConnectorId) ?? reportedConnectorId)
       : null;
     if (
-      body?.version !== 1 ||
+      (version !== 1 && version !== 2) ||
       !commitId ||
       reportedDeviceId !== deviceId ||
       reportedSourceId !== sourceInstanceId ||
@@ -92,7 +95,8 @@ export async function handleLocalDeviceTerminalRunCommit(input: {
       !runId ||
       !collectionBoundary ||
       !stateDelta ||
-      !normalizedFacts ||
+      !rawFacts ||
+      (version === 1 && !normalizedFacts) ||
       !canonicalConnectorId ||
       reportedConnectorKey !== canonicalConnectorId
     ) {
@@ -100,6 +104,14 @@ export async function handleLocalDeviceTerminalRunCommit(input: {
       return;
     }
 
+    const validatedFacts = version === 2
+      ? normalizeTerminalCoverageFacts(rawFacts, await ctx.getConnectorManifest?.(canonicalConnectorId), collectionBoundary, { allowSubset: true })
+      : normalizedFacts;
+    if (!validatedFacts) {
+      ctx.pdppError(res, 400, "invalid_request", "terminal coverage does not match the manifest inventory");
+      return;
+    }
+
     const canonicalEnvelope = {
       collection_boundary: collectionBoundary,
       commit_id: commitId,
@@ -119,14 +131,13 @@ export async function handleLocalDeviceTerminalRunCommit(input: {
       run_id: runId,
       source_instance_id: sourceInstanceId,
       state_delta: stateDelta,
-      terminal_facts: body.terminal_facts as Array<{
-        coverage_statuses: string[];
-        scoped?: boolean;
-        stream: string;
-      }>,
-      version: 1,
+      terminal_facts: body.terminal_facts,
+      version,
     } as const;
-    const envelopeHash = createHash("sha256").update(canonicalTerminalRunCommitJson(canonicalEnvelope)).digest("hex");
+    const canonicalJson = version === 2
+      ? JSON.stringify(canonicalTerminalRunCommitEnvelope(canonicalEnvelope as Parameters<typeof canonicalTerminalRunCommitEnvelope>[0]))
+      : canonicalTerminalRunCommitJson(canonicalEnvelope as Parameters<typeof canonicalTerminalRunCommitJson>[0]);
+    const envelopeHash = createHash("sha256").update(canonicalJson).digest("hex");
     const result = await ctx.commitTerminalRun({
       collectionBoundary,
       commitId,
@@ -134,7 +145,8 @@ export async function handleLocalDeviceTerminalRunCommit(input: {
       connectorInstanceId: authorized.connectorInstance.connectorInstanceId,
       deviceId,
       envelopeHash,
-      normalizedFacts,
+      normalizedFacts: validatedFacts,
+      version,
       runId,
       sourceInstanceId,
       stateDelta,
@@ -305,6 +317,77 @@ export function normalizeTerminalFacts(rawFacts: readonly unknown[]): readonly R
     : null;
 }
 
+/** Validate a v2 claim against the registered manifest, without source-specific rules. */
+export function normalizeTerminalCoverageFacts(
+  rawFacts: readonly unknown[],
+  rawManifest: unknown,
+  collectionBoundary: string,
+  options: { allowSubset?: boolean } = {}
+): readonly Record<string, unknown>[] | null {
+  const manifest = asObject(rawManifest);
+  const manifestStreams = manifest?.streams;
+  if (!Array.isArray(manifestStreams) || manifestStreams.length === 0) {
+    return null;
+  }
+  const inventory = new Map<string, Set<string>>();
+  for (const rawStream of manifestStreams) {
+    const stream = asObject(rawStream);
+    const name = stream && readRequiredString(stream.name);
+    const stores = stream?.coverage_stores;
+    if (!name || !Array.isArray(stores) || stores.length === 0 ||
+      stores.some((store) => typeof store !== "string" || !store.trim()) ||
+      new Set(stores).size !== stores.length || inventory.has(name)) {
+      return null;
+    }
+    inventory.set(name, new Set(stores));
+  }
+  if (rawFacts.length === 0 || rawFacts.length > inventory.size || (!options.allowSubset && rawFacts.length !== inventory.size)) {
+    return null;
+  }
+  const seen = new Set<string>();
+  const facts: Record<string, unknown>[] = [];
+  for (const raw of rawFacts) {
+    const entry = asObject(raw);
+    const stream = entry && readRequiredString(entry.stream);
+    const expected = stream ? inventory.get(stream) : null;
+    const rawStores = entry?.stores;
+    if (!stream || !expected || seen.has(stream) || typeof entry.scoped !== "boolean" ||
+      !Array.isArray(rawStores) || rawStores.length !== expected.size ||
+      (collectionBoundary !== "unscoped" && entry.scoped !== true)) {
+      return null;
+    }
+    seen.add(stream);
+    const stores: { store: string; status: "collected" | "partial" | "unavailable" | "failed" }[] = [];
+    const seenStores = new Set<string>();
+    for (const rawStore of rawStores) {
+      const store = asObject(rawStore);
+      const name = store && readRequiredString(store.store);
+      const status = store?.status;
+      if (!name || !expected.has(name) || seenStores.has(name) ||
+        (status !== "collected" && status !== "partial" && status !== "unavailable" && status !== "failed")) {
+        return null;
+      }
+      seenStores.add(name);
+      stores.push({ store: name, status });
+    }
+    const statuses = stores.map((store) => store.status);
+    const pendingDetailGaps = statuses.filter((status) => status !== "collected").length;
+    facts.push({
+      checkpoint: "committed",
+      collected: 0,
+      considered: null,
+      covered: null,
+      coverage_statuses: statuses,
+      pending_detail_gaps: pendingDetailGaps,
+      scoped: entry.scoped,
+      skipped: null,
+      stores: stores.sort((left, right) => left.store.localeCompare(right.store)),
+      stream,
+    });
+  }
+  return seen.size === rawFacts.length ? facts.sort((left, right) => String(left.stream).localeCompare(String(right.stream))) : null;
+}
+
 function readCoverageStatuses(value: unknown): readonly string[] | null {
   if (!Array.isArray(value) || value.length === 0 || value.some((status) => typeof status !== "string" || !status)) {
     return null;
diff --git a/reference-implementation/server/ref-control.ts b/reference-implementation/server/ref-control.ts
index e580b7395..a906d3f5c 100644
--- a/reference-implementation/server/ref-control.ts
+++ b/reference-implementation/server/ref-control.ts
@@ -19,6 +19,7 @@ import type { RuntimeContinuationFact } from "@pdpp/connector-protocol/connector
 import { allowUnboundedReadAcknowledged, iterateDynamicSqlAcknowledged, referenceQueries } from "../lib/db.ts";
 import { isNullish } from "../lib/nullish.ts";
 import type { SpineSummary } from "../lib/spine.ts";
+import { normalizeTerminalCoverageFacts } from "../operations/local-device-terminal-collection.ts";
 import type { RefApprovalDetail } from "../operations/ref-approval-detail/index.ts";
 import {
   buildLiveConsentApprovalDetail,
@@ -594,6 +595,12 @@ export interface ConnectorRunSummary {
    * `collection_report`; never final coverage truth.
    */
   readonly collection_facts: RuntimeCollectionFacts | null;
+  /** Authenticated v2 device terminal evidence, kept raw until manifest and current scope are checked on read. */
+  readonly local_terminal_coverage?: {
+    readonly eligibleLocalRun: boolean;
+    readonly collectionScope: unknown;
+    readonly streams: unknown;
+  } | null;
   readonly connector_error?: ConnectorRunErrorSummary | null;
   readonly event_count: number;
   readonly failure_reason: string | null;
@@ -1589,6 +1596,7 @@ function productRunHistoryToConnectorRunSummary(
       : null;
   return {
     collection_facts: readCollectionFactsFromTerminalData(facts),
+    local_terminal_coverage: readLocalTerminalCoverage(facts, history),
     connector_error: projectConnectorRunError(history.connectorError),
     event_count: 0,
     failure_reason: history.failureReason ?? history.error ?? browserSurfaceFailureReason,
@@ -1608,6 +1616,30 @@ function productRunHistoryToConnectorRunSummary(
   };
 }
 
+function recordOrNull(value: unknown): Record<string, unknown> | null {
+  return value && typeof value === "object" && !Array.isArray(value) ? (value as Record<string, unknown>) : null;
+}
+
+function readLocalTerminalCoverage(
+  facts: Record<string, unknown> | null,
+  history: ProductRunHistoryRecord
+): NonNullable<ConnectorRunSummary["local_terminal_coverage"]> | null {
+  const block = recordOrNull(facts?.collection_facts);
+  if (block?.schema_version !== 2) {
+    return null;
+  }
+  return {
+    eligibleLocalRun:
+      history.status === "succeeded" &&
+      history.schedulerManaged === false &&
+      typeof history.connectorInstanceId === "string" &&
+      typeof history.runId === "string" &&
+      block.reference_only === true,
+    collectionScope: block?.collection_scope,
+    streams: block?.streams,
+  };
+}
+
 function runSummaryMatchesConnection(
   summary: SpineSummary,
   connectorInstanceId: string,
@@ -4547,6 +4579,9 @@ function localCoverageConditionForStatus(status: unknown): CoverageAxis | null {
       return "unsupported";
     case "unavailable":
       return "unavailable";
+    case "partial":
+      return "partial";
+    case "failed":
     case "unaccounted":
       return "gaps";
     default:
@@ -4559,7 +4594,7 @@ function localCoverageConditionsByStream(
   manifestByStream: ReadonlyMap<string, ManifestStream>
 ): ReadonlyMap<string, CoverageAxis> {
   const conditions = new Map<string, CoverageAxis>();
-  if (localCoverage?.reliable !== true || localCoverage.axis !== "complete") {
+  if (localCoverage?.reliable !== true || (localCoverage.axis !== "complete" && localCoverage.source !== "terminal_verdict")) {
     return conditions;
   }
   const rows = localCoverage?.rows ?? [];
@@ -4599,6 +4634,8 @@ function localCoverageConditionSeverity(axis: CoverageAxis): number {
       return 1;
     case "unavailable":
       return 2;
+    case "partial":
+      return 2;
     case "gaps":
       return 3;
     default:
@@ -4704,6 +4741,8 @@ interface LocalCoverageDiagnosticRow {
 
 interface LocalCoverageDiagnosticAxis {
   readonly axis: CoverageAxis;
+  /** v2 facts are an authenticated terminal receipt, rather than a diagnostics snapshot. */
+  readonly source?: "terminal_verdict";
   /**
    * Boundary this connection CURRENTLY declares, read off the same
    * connector-state projection this axis is already derived from — so binding
@@ -4937,6 +4976,71 @@ export function deriveLocalCoverageAxis(input: {
   };
 }
 
+/** Recheck committed v2 facts against the currently pinned manifest and scope. */
+function deriveLocalTerminalCoverageAxis(
+  run: ConnectorRunSummary | null,
+  manifest: ConnectorManifest,
+  legacyAxis: LocalCoverageDiagnosticAxis | null
+): LocalCoverageDiagnosticAxis | null {
+  const terminal = run?.local_terminal_coverage;
+  if (!terminal) {
+    return null;
+  }
+  const declaredScope = legacyAxis?.declaredCollectionScope;
+  const unknown: LocalCoverageDiagnosticAxis = {
+    axis: "unknown",
+    declaredCollectionScope: declaredScope ?? "unscoped",
+    evidenceAsOf: null,
+    measuredCollectionScope: null,
+    reliable: false,
+    rows: [],
+    source: "terminal_verdict",
+    unaccountedStores: [],
+  };
+  // A failed scope-state read cannot establish which boundary the connection
+  // currently asks the collector to cover.
+  if (!legacyAxis || typeof declaredScope !== "string" || !terminal.eligibleLocalRun || typeof terminal.collectionScope !== "string" ||
+    terminal.collectionScope !== declaredScope || !Array.isArray(terminal.streams)) {
+    return unknown;
+  }
+  const normalized = normalizeTerminalCoverageFacts(terminal.streams, manifest, terminal.collectionScope);
+  if (!normalized) {
+    return unknown;
+  }
+  const rows: LocalCoverageDiagnosticRow[] = [];
+  const unaccountedStores: string[] = [];
+  let axis: CoverageAxis = "complete";
+  for (const rawFact of normalized) {
+    const stream = rawFact.stream as string;
+    if (rawFact.scoped !== true) {
+      return unknown;
+    }
+    for (const rawStore of rawFact.stores as readonly { store: string; status: string }[]) {
+      rows.push({ collection_scope: terminal.collectionScope, status: rawStore.status, store: rawStore.store, stream });
+      if (rawStore.status !== "collected") {
+        unaccountedStores.push(rawStore.store);
+      }
+      const condition = localCoverageConditionForStatus(rawStore.status);
+      if (!condition) {
+        return unknown;
+      }
+      if (localCoverageConditionSeverity(condition) > localCoverageConditionSeverity(axis)) {
+        axis = condition;
+      }
+    }
+  }
+  return {
+    axis,
+    declaredCollectionScope: declaredScope,
+    evidenceAsOf: run?.last_at ?? null,
+    measuredCollectionScope: terminal.collectionScope,
+    reliable: true,
+    rows,
+    source: "terminal_verdict",
+    unaccountedStores: unaccountedStores.sort((left, right) => left.localeCompare(right)),
+  };
+}
+
 /**
  * Read durable local coverage diagnostics for one connection and project the
  * coverage axis. Returns `null` (axis derivation skipped) when the read throws —
@@ -6955,6 +7059,9 @@ function synthesizeConnectorSummary(input: ConnectorSummarySynthesisInput): Conn
   const authoritativeLastSuccessfulRun = isOwnScopedRun(lastSuccessfulRun) ? lastSuccessfulRun : null;
   const fallbackSettledRun = latestSettledRun ?? fallbackLatestSettledRun(lastRun, lastSuccessfulRun);
   const authoritativeLatestSettledRun = isOwnScopedRun(fallbackSettledRun) ? fallbackSettledRun : null;
+  const effectiveLocalCoverage = localDeviceBacked
+    ? (deriveLocalTerminalCoverageAxis(fallbackSettledRun, manifest, localCoverage) ?? localCoverage)
+    : localCoverage;
   const authoritativeLatestStreamFacts = localDeviceBacked ? null : latestStreamFacts;
   const terminalSetupDisposition =
     instance.status === "draft" && authoritativeLastRun
@@ -7029,7 +7136,7 @@ function synthesizeConnectorSummary(input: ConnectorSummarySynthesisInput): Conn
     lastRun: authoritativeLastRun,
     lastSuccessfulRun: authoritativeLastSuccessfulRun,
     latestSettledRun: authoritativeLatestSettledRun,
-    localCoverage,
+    localCoverage: effectiveLocalCoverage,
     localDeviceBacked,
     manifestStreams: manifest.streams ?? [],
     nowIso,
@@ -7063,7 +7170,7 @@ function synthesizeConnectorSummary(input: ConnectorSummarySynthesisInput): Conn
     lastSuccessfulRun: authoritativeLastSuccessfulRun,
     latestSettledRun: authoritativeLatestSettledRun,
     latestStreamFacts: authoritativeLatestStreamFacts,
-    localCoverage,
+    localCoverage: effectiveLocalCoverage,
     localDeviceBacked,
     manifestStreams: manifest.streams ?? [],
     pendingDetailGaps: detailGaps.gaps,
diff --git a/reference-implementation/server/stores/terminal-run-commit-store.ts b/reference-implementation/server/stores/terminal-run-commit-store.ts
index 56a7dfa46..36df1bcd9 100644
--- a/reference-implementation/server/stores/terminal-run-commit-store.ts
+++ b/reference-implementation/server/stores/terminal-run-commit-store.ts
@@ -23,6 +23,7 @@ export interface ResolvedTerminalRunCommit {
   readonly runId: string;
   readonly sourceInstanceId: string;
   readonly stateDelta: Readonly<Record<string, unknown>>;
+  readonly version?: 1 | 2;
 }
 
 export interface TerminalRunCommitResponse {
@@ -95,7 +96,7 @@ function eventInputFor(
       collection_facts: {
         collection_scope: input.collectionBoundary,
         reference_only: true,
-        schema_version: 1,
+        schema_version: input.version ?? 1,
         streams: input.normalizedFacts,
       },
       connector_instance_id: input.connectorInstanceId,
@@ -110,7 +111,7 @@ function eventInputFor(
         commit_id: input.commitId,
         envelope_hash: input.envelopeHash,
         response,
-        version: 1,
+        version: input.version ?? 1,
       },
     },
     event_id: eventId,
@@ -142,7 +143,7 @@ function parseStoredResponse(dataJson: unknown, input: ResolvedTerminalRunCommit
   const bindings = asRecord(receipt?.bindings);
   const response = asRecord(receipt?.response);
   const exactReceiptFields = [
-    receipt?.version === 1,
+    receipt?.version === (input.version ?? 1),
     receipt?.commit_id === input.commitId,
     receipt?.envelope_hash === input.envelopeHash,
     bindings?.device_id === input.deviceId,
diff --git a/reference-implementation/test/local-device-terminal-coverage-projection.test.ts b/reference-implementation/test/local-device-terminal-coverage-projection.test.ts
new file mode 100644
index 000000000..675db7906
--- /dev/null
+++ b/reference-implementation/test/local-device-terminal-coverage-projection.test.ts
@@ -0,0 +1,201 @@
+// Copyright The PDP-Connect Contributors
+// SPDX-License-Identifier: Apache-2.0
+
+import assert from "node:assert/strict";
+import { mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import test from "node:test";
+import { reconcileDirtyConnectorSummaryEvidence } from "../server/connector-summary-read-model.ts";
+import { closeDb, getDb, initDb } from "../server/db.ts";
+import { buildStoredCollectionScope, COLLECTION_SCOPE_STATE_KEY } from "../server/local-collection-scope.ts";
+import { getConnectorSummaryForRoute, listConnectorSummaries } from "../server/ref-control.ts";
+import { createSqliteConnectorInstanceStore } from "../server/stores/connector-instance-store.ts";
+import { getDefaultDeviceExporterStore } from "../server/stores/device-exporter-store.ts";
+import { commitTerminalRun } from "../server/stores/terminal-run-commit-store.ts";
+
+const connectorId = "claude-code";
+const connectorInstanceId = "cin_terminal_coverage";
+const deviceId = "dev_terminal_coverage";
+const sourceInstanceId = "src_terminal_coverage";
+const ownerSubjectId = "owner_local";
+
+async function withLocalConnection(run: () => Promise<void>): Promise<void> {
+  const directory = mkdtempSync(join(tmpdir(), "pdpp-terminal-coverage-projection-"));
+  initDb(join(directory, "pdpp.sqlite"));
+  try {
+    const now = new Date().toISOString();
+    getDb().prepare("INSERT INTO connectors(connector_id, manifest, created_at) VALUES (?, ?, ?)").run(
+      connectorId,
+      JSON.stringify({
+        capabilities: { public_listing: { tier: "supported" } },
+        connector_id: connectorId,
+        display_name: "Terminal Coverage Fixture",
+        protocol_version: "0.1.0",
+        streams: [
+          { coverage_stores: ["projects"], coverage_strategy: "checkpoint_window", name: "sessions", primary_key: ["id"] },
+          { coverage_stores: ["derived_messages"], coverage_strategy: "checkpoint_window", name: "messages", primary_key: ["id"] },
+        ],
+        version: "1.0.0",
+      }),
+      now
+    );
+    await createSqliteConnectorInstanceStore().upsert({
+      connectorId,
+      connectorInstanceId,
+      createdAt: now,
+      displayName: "laptop",
+      ownerSubjectId,
+      sourceBinding: { device: "laptop", kind: "local_device" },
+      sourceBindingKey: "laptop",
+      sourceKind: "local_device",
+      status: "active",
+      updatedAt: now,
+    });
+    const store = getDefaultDeviceExporterStore();
+    await store.createDevice({ createdAt: now, deviceId, displayName: "laptop", ownerSubjectId, status: "active", updatedAt: now });
+    await store.upsertSourceInstance({
+      connectorId,
+      connectorInstanceId,
+      createdAt: now,
+      deviceId,
+      displayName: "laptop collector",
+      localBindingId: "laptop",
+      sourceInstanceId,
+      status: "active",
+      updatedAt: now,
+    });
+    await store.markSourceInstanceHeartbeat(deviceId, sourceInstanceId, {
+      lastError: null,
+      outboxDiagnostics: { dead_letter: 0, pending: 0, stale_leases: 0, succeeded: 1, total: 1 },
+      receivedAt: now,
+      recordsPending: 0,
+      status: "healthy",
+    });
+    await run();
+  } finally {
+    closeDb();
+    rmSync(directory, { force: true, recursive: true });
+  }
+}
+
+async function projectedCoverage() {
+  await reconcileDirtyConnectorSummaryEvidence(null);
+  const summary = (await listConnectorSummaries()).find((row) => row.connector_instance_id === connectorInstanceId);
+  assert.ok(summary);
+  return {
+    axis: summary.connection_health.axes.coverage,
+    conditions: Object.fromEntries(summary.collection_report.map((entry) => [entry.stream, entry.coverage_condition])),
+  };
+}
+
+async function seedTerminalCoverage(status: "collected" | "partial" | "failed", malformed = false, version: 1 | 2 = 2): Promise<void> {
+  await commitTerminalRun({
+    collectionBoundary: "unscoped",
+    commitId: "commit_terminal_coverage",
+    connectorId,
+    connectorInstanceId,
+    deviceId,
+    envelopeHash: "test-envelope-hash",
+    normalizedFacts: [
+      {
+        checkpoint: "committed", collected: 0, considered: null, covered: null,
+        coverage_statuses: ["collected"], pending_detail_gaps: 0, scoped: true, skipped: null,
+        stores: [{ store: malformed ? "unknown_store" : "projects", status: "collected" }], stream: "sessions",
+      },
+      {
+        checkpoint: "committed", collected: 0, considered: null, covered: null,
+        coverage_statuses: [status], pending_detail_gaps: status === "collected" ? 0 : 1,
+        scoped: true, skipped: null,
+        stores: [{ store: "derived_messages", status }], stream: "messages",
+      },
+    ],
+    runId: "run_terminal_coverage",
+    sourceInstanceId,
+    stateDelta: {},
+    version,
+  });
+}
+
+test("local-device v2 terminal coverage projects per-stream proof; absent proof stays unknown", async () => {
+  await withLocalConnection(async () => {
+    assert.equal((await projectedCoverage()).axis, "unknown");
+    await seedTerminalCoverage("collected");
+    const result = await projectedCoverage();
+    assert.equal(result.axis, "complete");
+    assert.equal(result.conditions.sessions, "complete");
+    assert.equal(result.conditions.messages, "complete");
+    const detail = await getConnectorSummaryForRoute(connectorInstanceId);
+    assert.ok(detail && "connection_health" in detail);
+    assert.equal(detail.connection_health.axes.coverage, "complete", "singleton reader agrees with page projection");
+  });
+});
+
+for (const status of ["partial", "failed"] as const) {
+  test(`local-device v2 ${status} verdict never projects covered`, async () => {
+    await withLocalConnection(async () => {
+      await seedTerminalCoverage(status);
+      const result = await projectedCoverage();
+      assert.notEqual(result.axis, "complete");
+      assert.equal(result.conditions.messages, status === "partial" ? "partial" : "gaps");
+    });
+  });
+}
+
+test("malformed persisted v2 store inventory never projects covered", async () => {
+  await withLocalConnection(async () => {
+    await seedTerminalCoverage("collected", true);
+    assert.notEqual((await projectedCoverage()).axis, "complete");
+  });
+});
+
+test("legacy terminal commit without v2 proof stays unknown", async () => {
+  await withLocalConnection(async () => {
+    await seedTerminalCoverage("collected", false, 1);
+    assert.equal((await projectedCoverage()).axis, "unknown");
+  });
+});
+
+test("selected-stream v2 proof cannot cover omitted manifest streams", async () => {
+  await withLocalConnection(async () => {
+    await seedTerminalCoverage("collected");
+    const row = getDb().prepare("SELECT facts_json FROM run_history WHERE run_id = ?").get("run_terminal_coverage") as { facts_json: string };
+    const facts = JSON.parse(row.facts_json) as { collection_facts: { streams: unknown[] } };
+    facts.collection_facts.streams = facts.collection_facts.streams.slice(0, 1);
+    getDb().prepare("UPDATE run_history SET facts_json = ? WHERE run_id = ?")
+      .run(JSON.stringify(facts), "run_terminal_coverage");
+    assert.equal((await projectedCoverage()).axis, "unknown");
+  });
+});
+
+test("v2 terminal proof for an old collection scope cannot cover the current scope", async () => {
+  await withLocalConnection(async () => {
+    await seedTerminalCoverage("collected");
+    const now = new Date().toISOString();
+    getDb().prepare(
+      "INSERT INTO connector_state(connector_id, connector_instance_id, stream, state_json, updated_at) VALUES (?, ?, ?, ?, ?)"
+    ).run(
+      connectorId,
+      connectorInstanceId,
+      COLLECTION_SCOPE_STATE_KEY,
+      JSON.stringify(buildStoredCollectionScope({ since: "2026-01-01T00:00:00.000Z" }, now)),
+      now
+    );
+    assert.equal((await projectedCoverage()).axis, "unknown");
+  });
+});
+
+test("a newer failed run cannot retain an earlier v2 covered verdict", async () => {
+  await withLocalConnection(async () => {
+    await seedTerminalCoverage("collected");
+    assert.equal((await projectedCoverage()).axis, "complete");
+    const later = new Date(Date.now() + 60_000).toISOString();
+    getDb().prepare(
+      `INSERT INTO run_history (
+         connector_instance_id, connector_id, source_json, status, scheduler_managed,
+         known_gaps_json, run_id, started_at, completed_at, attempt, facts_json
+       ) VALUES (?, ?, '{}', 'failed', 0, '[]', ?, ?, ?, 1, '{}')`
+    ).run(connectorInstanceId, connectorId, "run_terminal_coverage_failed", later, later);
+    assert.equal((await projectedCoverage()).axis, "unknown");
+  });
+});
diff --git a/reference-implementation/test/local-device-terminal-run-commit-operation.test.ts b/reference-implementation/test/local-device-terminal-run-commit-operation.test.ts
index dd94088f4..ac749c328 100644
--- a/reference-implementation/test/local-device-terminal-run-commit-operation.test.ts
+++ b/reference-implementation/test/local-device-terminal-run-commit-operation.test.ts
@@ -5,9 +5,12 @@ import assert from "node:assert/strict";
 import { createHash } from "node:crypto";
 import test from "node:test";
 import { canonicalTerminalRunCommitJson } from "@pdpp/reference-contract/common";
-import { handleLocalDeviceTerminalRunCommit } from "../operations/local-device-terminal-collection.ts";
+import { canonicalTerminalRunCommitEnvelope, hashCanonicalJson } from "@pdpp/collector-runtime/local-device-envelope";
+import { handleLocalDeviceTerminalRunCommit, normalizeTerminalCoverageFacts } from "../operations/local-device-terminal-collection.ts";
 import { canonicalConnectorKey } from "../server/connector-key.ts";
+import { deriveStreamCoverageCondition } from "../server/connector-coverage-policy.ts";
 import { closeDb, getDb, initDb } from "../server/db.ts";
+import { readRuntimeCollectionFact } from "../server/runtime-collection-facts.ts";
 import {
   commitTerminalRun as commitTerminalRunToStore,
   type ResolvedTerminalRunCommit,
@@ -49,6 +52,94 @@ function validBody(overrides: Record<string, unknown> = {}) {
   };
 }
 
+test("version 2 terminal coverage validates named stores against the manifest", async () => {
+  const capture = responseCapture();
+  let committed: ResolvedTerminalRunCommit | null = null;
+  const sentBody = validBody({
+    state_delta: {},
+    terminal_facts: [{
+      stream: "messages", scoped: true,
+      stores: [{ store: "messages", status: "collected" }, { store: "history", status: "partial" }],
+    }],
+    version: 2,
+  });
+  await handleLocalDeviceTerminalRunCommit({
+    ctx: {
+      canonicalConnectorKey: () => "codex",
+      getConnectorManifest: () => Promise.resolve({
+        streams: [{ name: "messages", coverage_stores: ["messages", "history"] }],
+      }),
+      commitTerminalRun: (input) => {
+        committed = input;
+        return Promise.resolve({
+          replayed: false,
+          response: {
+            commit_id: input.commitId,
+            envelope_hash: input.envelopeHash,
+            object: "device_terminal_run_commit",
+            run_id: input.runId,
+            terminal_event_id: "evt-v2",
+          },
+        });
+      },
+      emitSpineEvent: () => Promise.resolve(),
+      handleError: (_res, error) => { throw error; },
+      pdppError: (_res, status) => { capture.response.status(status); },
+    },
+    req: {
+      body: sentBody,
+      deviceExporter: { deviceId: "dev-1" },
+      params: { deviceId: "dev-1", sourceInstanceId: "src-1" },
+    },
+    res: capture.response,
+    resolveAuthorizedSource: () => Promise.resolve({
+      connectorInstance: { connectorInstanceId: "cin-1" },
+      sourceInstance: { connectorId: "codex" },
+    }),
+  });
+  assert.equal(capture.snapshot().status, 201);
+  assert.ok(committed);
+  assert.deepEqual((committed as ResolvedTerminalRunCommit).normalizedFacts[0]?.coverage_statuses, ["collected", "partial"]);
+  assert.equal(
+    (committed as ResolvedTerminalRunCommit).envelopeHash,
+    hashCanonicalJson(canonicalTerminalRunCommitEnvelope(sentBody as Parameters<typeof canonicalTerminalRunCommitEnvelope>[0]))
+  );
+});
+
+test("typed terminal coverage is green only for complete scoped store evidence", () => {
+  const manifest = { streams: [{ name: "messages", coverage_stores: ["messages", "history"] }] };
+  const fact = (statuses: readonly [string, string], scoped = true) => ({
+    stream: "messages", scoped,
+    stores: [{ store: "messages", status: statuses[0] }, { store: "history", status: statuses[1] }],
+  });
+  const axis = (raw: unknown) => {
+    const normalized = normalizeTerminalCoverageFacts([raw], manifest, "unscoped");
+    assert.ok(normalized);
+    const parsed = readRuntimeCollectionFact(normalized[0]);
+    assert.ok(parsed);
+    return deriveStreamCoverageCondition(parsed, { coverage_strategy: "checkpoint_window" });
+  };
+  assert.equal(axis(fact(["collected", "collected"])), "complete");
+  assert.notEqual(axis(fact(["collected", "partial"])), "complete");
+  assert.notEqual(axis(fact(["failed", "collected"])), "complete");
+  assert.notEqual(axis(fact(["collected", "collected"], false)), "complete");
+  assert.equal(normalizeTerminalCoverageFacts([], manifest, "unscoped"), null);
+  assert.equal(normalizeTerminalCoverageFacts([fact(["collected", "collected"])], { streams: [] }, "unscoped"), null);
+  assert.equal(normalizeTerminalCoverageFacts([fact(["collected", "bogus"])], manifest, "unscoped"), null);
+  assert.equal(normalizeTerminalCoverageFacts([{ ...fact(["collected", "collected"]), stores: [{ store: "messages", status: "collected" }] }], manifest, "unscoped"), null);
+  assert.equal(normalizeTerminalCoverageFacts([fact(["collected", "collected"], false)], manifest, "bounded"), null);
+});
+
+test("a selected-stream terminal commit is accepted without proving omitted manifest streams", () => {
+  const manifest = { streams: [
+    { name: "messages", coverage_stores: ["messages"] },
+    { name: "photos", coverage_stores: ["photos"] },
+  ] };
+  const selected = [{ stream: "messages", scoped: true, stores: [{ store: "messages", status: "collected" }] }];
+  assert.equal(normalizeTerminalCoverageFacts(selected, manifest, "unscoped"), null);
+  assert.equal(normalizeTerminalCoverageFacts(selected, manifest, "unscoped", { allowSubset: true })?.length, 1);
+});
+
 test("terminal run commit resolves authorization before receipt lookup and passes canonical binding", async () => {
   const capture = responseCapture();
   let authorized = false;

From 7fbcb76d4a76d349576264d576ffcdfe7341bdd3 Mon Sep 17 00:00:00 2001
From: Tim Nunamaker <tnunamak@gmail.com>
Date: Wed, 21 Oct 2026 18:44:04 -0500
Subject: [PATCH 02/87] build: refresh connector protocol artifact metadata

Regenerate the committed package digest after adding DONE.coverage and START.collection_scope so clean-tree artifact verification matches the protocol source.

Assisted-by: AI
Signed-off-by: Tim Nunamaker <tnunamak@gmail.com>
---
 packages/connector-protocol/artifact.json | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/packages/connector-protocol/artifact.json b/packages/connector-protocol/artifact.json
index 85c467756..92a06e266 100644
--- a/packages/connector-protocol/artifact.json
+++ b/packages/connector-protocol/artifact.json
@@ -1,11 +1,11 @@
 {
   "artifact_filename": "pdpp-connector-protocol-0.0.1.tgz",
-  "artifact_sha1": "8fdbd02c1d9bb718c2d7f5b14b833764085f7aca",
-  "artifact_sha256": "e60111789571bfeaf6ab63ade3a2e23d1ba118614c1751db29981e53fdf3cba6",
-  "artifact_sha512": "ffbd20c0b3b97cf0e6f37feef67ea5e265e178ece897407d2e5be3de9231c5ccbb3b33114f3b8bf2e982c63f1e300a41c1b473e1b055f7e0f860503f74e02063",
-  "declarations_sha256": "01606ac34df3bd026909b48e8c472e38bbff45e17ddcd58f5af07947c70c1c5c",
+  "artifact_sha1": "63f497d89b063bb22c694185817526b00f927b74",
+  "artifact_sha256": "b29c4a0f1bdf2ce7ae07110df78c90f56067bafaaf2385da33ad62d8fed40829",
+  "artifact_sha512": "858a9d025aec14a3d40ed1c1953bd87f79725e5b5854eb961b60694b8cc9da3c9aa509c4209d1a8900414df0ce5be44510969c8275186776ce6ccae838ab3aea",
+  "declarations_sha256": "c1b33258618f33b0ead81133464f276ae75a675038ed780c43ffba2acedd92b5",
   "metadata_version": 1,
   "package_name": "@pdpp/connector-protocol",
   "package_version": "0.0.1",
-  "source_inputs_sha256": "f60610dac0ba85ae04a1fb7c8a9468ee44822d4d1e9b03e9a64be368de07a956"
+  "source_inputs_sha256": "0ca5613c76bd5df7a37e391ca1e7524a12f9c025d5a9a7a191cbaad0bd1724fb"
 }

From a643d8298fb90c7cdc10b597e9c8705b778507d6 Mon Sep 17 00:00:00 2001
From: Tim Nunamaker <tnunamak@gmail.com>
Date: Wed, 21 Oct 2026 18:48:38 -0500
Subject: [PATCH 03/87] chore(collector-runtime): refresh artifact metadata

Regenerate the collector-runtime package artifact after adding terminal run coverage. The package verify gate checks these hashes against the built tarball.

Assisted-by: AI
Signed-off-by: Tim Nunamaker <tnunamak@gmail.com>
---
 packages/collector-runtime/artifact.json | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/packages/collector-runtime/artifact.json b/packages/collector-runtime/artifact.json
index 5647bb41f..2c2c7d850 100644
--- a/packages/collector-runtime/artifact.json
+++ b/packages/collector-runtime/artifact.json
@@ -1,13 +1,13 @@
 {
   "artifact_filename": "pdpp-collector-runtime-0.0.1.tgz",
-  "artifact_sha1": "43d0c0f7e5f793ace12e4d9d374ed6bf068a8ae5",
-  "artifact_sha256": "52bfcd1a9deda2a406323deb83218521d785677f35cbcbc145514b9c3cb14244",
-  "artifact_sha512": "63421939a3d2a74c2f60c573d7575f178a2776ccbd85ab0533246228f26bb597ee127bdc2f47bfac2118fa80c51625cbd94145f16e37e45e7f282e5c4012dceb",
-  "connector_protocol_declarations_sha256": "01606ac34df3bd026909b48e8c472e38bbff45e17ddcd58f5af07947c70c1c5c",
-  "connector_protocol_source_inputs_sha256": "f60610dac0ba85ae04a1fb7c8a9468ee44822d4d1e9b03e9a64be368de07a956",
-  "declarations_sha256": "2105cccee39bbe5e7664d39dba01bc81d21fa24a4449ae65477aa5e5a39056f7",
+  "artifact_sha1": "6cde2e54f5df78b7794040133a33580b9c2fcbf8",
+  "artifact_sha256": "3beca7ecf61502dec3f59ccd37fcb87a7e4483ff8c09a74cb095f987c0f10ed2",
+  "artifact_sha512": "b2059544ed99784afb14abb68922eacc1f0ed32f7c0c7be4789d4bf2bbe227e4b10749370a87e8bf510a2f7233e32f1a0f9d7e68d362538656ee3b36e0cbdf64",
+  "connector_protocol_declarations_sha256": "c1b33258618f33b0ead81133464f276ae75a675038ed780c43ffba2acedd92b5",
+  "connector_protocol_source_inputs_sha256": "0ca5613c76bd5df7a37e391ca1e7524a12f9c025d5a9a7a191cbaad0bd1724fb",
+  "declarations_sha256": "d3596337c48b6260a145e0ff88ec754e3282a7e2bf6c3849c65cf3fa0da4ef04",
   "metadata_version": 1,
   "package_name": "@pdpp/collector-runtime",
   "package_version": "0.0.1",
-  "source_inputs_sha256": "c13428c49e02309a31ddaf39c7534988b38ac2655b2eaf3cb768baea0bc93c62"
+  "source_inputs_sha256": "13e6ae12d7b99f69327a3a03f513a2f2505de930c35bcfae22346bc5de0381d4"
 }

From eb4d266de5163c18c3c710b37dd878cf307226af Mon Sep 17 00:00:00 2001
From: Tim Nunamaker <tnunamak@gmail.com>
Date: Wed, 21 Oct 2026 22:04:03 -0500
Subject: [PATCH 04/87] feat(coverage): reconcile terminal store evidence with
 host accounting

Bind optional terminal evidence to the verified release and durable admission receipt. Keep connector assertions separate from server-derived completeness and checkpoint eligibility.

Assisted-by: AI
Signed-off-by: Tim Nunamaker <tnunamak@gmail.com>
---
 docs/261021-local-device-coverage-evidence.md |   4 +-
 .../src/collector-runner.test.ts              |  99 ++++++-
 .../collector-runtime/src/collector-runner.ts |  48 +++-
 .../src/local-device-client.test.ts           |  42 +++
 .../src/local-device-client.ts                |  23 +-
 .../src/local-device-envelope.ts              |   6 +
 .../src/connector-runtime-protocol.ts         |   2 +
 .../bin/pdpp-local-collector.ts               |  34 ++-
 .../test/collection-profiles.test.ts          |  24 +-
 .../local-device-terminal-collection.ts       | 171 ++++++++++--
 .../server/ref-control.ts                     |  16 +-
 ...evice-terminal-coverage-projection.test.ts | 195 ++++++++++---
 ...vice-terminal-run-commit-operation.test.ts | 264 ++++++++++++++++--
 13 files changed, 831 insertions(+), 97 deletions(-)

diff --git a/docs/261021-local-device-coverage-evidence.md b/docs/261021-local-device-coverage-evidence.md
index f46ef143b..65a0eb8fa 100644
--- a/docs/261021-local-device-coverage-evidence.md
+++ b/docs/261021-local-device-coverage-evidence.md
@@ -36,9 +36,9 @@ The collector validates the typed field before accepting it. It carries store ID
 
 The collector stores the latest acknowledged v2 receipt in local outbox schema v5, outside prunable outbox rows. A later acknowledged v1 commit removes that receipt. Offline status can describe the receipt's measured boundary; doctor compares it with the active owner boundary. The server read model must make the same boundary comparison before showing positive connection coverage.
 
-## Published PDPP spec impact
+## Collection Profile amendment
 
-This changes the Collection Profile wire contract. The PDPP owner tree remains read-only in this lane. Both /home/tnunamak/code/pdpp/spec-collection-profile.md and its published copy, apps/site/content/docs/spec-collection-profile.mdx, need updates: DONE (root line 514, published line 518) needs the optional field and its validation; START (root around line 198) needs collection_scope; manifest stream declarations (root lines 45-75) need coverage-store inventory. The state machine (root lines 120-155) already defines DONE as final. The restart-abandonment rule at root line 573 uses “DONE-time coverage verdict” for detail-coverage checkpoint eligibility; it does not define this per-store terminal payload. PDPP Core is unaffected. Protocol addition needs owner approval at merge.
+The canonical Collection Profile is `data-connectors/docs/spec/collection-profile.md`. [Data-connectors PR #541](https://github.com/PDP-Connect/data-connectors/pull/541), stacked on #516, specifies the optional START capability, stream store declarations, terminal store collection evidence, and its relationship to detail accounting and checkpoint eligibility. Data-connectors #539 and this PR implement the amendment. The owner approves it at merge.
 
 ## Acceptance and release
 
diff --git a/packages/collector-runtime/src/collector-runner.test.ts b/packages/collector-runtime/src/collector-runner.test.ts
index f4cb59a90..270f9f348 100644
--- a/packages/collector-runtime/src/collector-runner.test.ts
+++ b/packages/collector-runtime/src/collector-runner.test.ts
@@ -342,9 +342,12 @@ test("runCollectorConnector commits a typed DONE coverage verdict without a diag
       baseUrl: harness.url,
       connector: {
         args: [fixture],
+        artifactDigest: `sha256:${"b".repeat(64)}`,
         command: "node",
         connector_id: "fixture-typed-coverage",
+        manifestFingerprint: "a".repeat(64),
         protocol_capabilities: [],
+        runCoverageVersion: 1,
         runtime_requirements: { bindings: {} },
         streams: ["messages"],
       },
@@ -358,13 +361,107 @@ test("runCollectorConnector commits a typed DONE coverage verdict without a diag
     assert.equal(harness.terminalCommits.length, 1);
     assert.equal(harness.terminalCommits[0]?.version, 2);
     assert.deepEqual(harness.terminalCommits[0]?.terminal_facts, [
-      { scoped: true, stores: [{ status: "collected", store: "messages" }], stream: "messages" },
+      {
+        artifact_digest: `sha256:${"b".repeat(64)}`,
+        manifest_fingerprint: "a".repeat(64),
+        runtime_accounting: {
+          checkpoint_eligible: true,
+          detail_complete: true,
+          durable_admission: true,
+          outstanding_debt: 0,
+          stream_evidence_consistent: true,
+        },
+        scoped: true,
+        stores: [{ status: "collected", store: "messages" }],
+        stream: "messages",
+      },
     ]);
   } finally {
     await harness.close();
   }
 });
 
+for (const effectType of ["DETAIL_GAP", "DETAIL_COVERAGE"] as const) {
+  test(`runCollectorConnector refuses ${effectType} without durable detail accounting`, async () => {
+    const harness = await startCollectorHarness({ priorState: {} });
+    try {
+      const fixture = await writeFixtureConnector({
+        script: `
+          process.stdout.write(JSON.stringify({ type: ${JSON.stringify(effectType)}, stream: "messages" }) + "\\n");
+          process.stdout.write(JSON.stringify({ type: "DONE", status: "succeeded", records_emitted: 0,
+            coverage: { version: 1, collection_scope: "unscoped", streams: [{ stream: "messages", scoped: true,
+              stores: [{ store: "messages", status: "collected" }] }] } }) + "\\n");
+        `,
+      });
+      await assert.rejects(
+        runCollectorConnector({
+          baseUrl: harness.url,
+          connector: {
+            args: [fixture],
+            command: "node",
+            connector_id: "fixture-detail-no-admission",
+            artifactDigest: `sha256:${"b".repeat(64)}`,
+            manifestFingerprint: "a".repeat(64),
+            protocol_capabilities: [],
+            runCoverageVersion: 1,
+            runtime_requirements: { bindings: {} },
+            streams: ["messages"],
+          },
+          deviceId: "device-1",
+          deviceToken: "device-token",
+          executionRoot: TEST_EXECUTION_ROOT,
+          queuePath: await tempQueuePath(),
+          sourceInstanceId: "src-detail-no-admission",
+        }),
+        new RegExp(`unsupported ${effectType}`)
+      );
+      assert.equal(harness.terminalCommits.length, 0);
+    } finally {
+      await harness.close();
+    }
+  });
+}
+
+test("runCollectorConnector refuses a collected assertion with mismatched emitted count", async () => {
+  const harness = await startCollectorHarness({ priorState: {} });
+  try {
+    const fixture = await writeFixtureConnector({
+      script: `
+      process.stdout.write(JSON.stringify({ type: "RECORD", stream: "messages", key: "m1",
+        data: { id: "m1" }, emitted_at: new Date().toISOString() }) + "\\n");
+      process.stdout.write(JSON.stringify({ type: "DONE", status: "succeeded", records_emitted: 2,
+        coverage: { version: 1, collection_scope: "unscoped", streams: [{ stream: "messages", scoped: true,
+          stores: [{ store: "messages", status: "collected" }] }] } }) + "\\n");
+    `,
+    });
+    await assert.rejects(
+      runCollectorConnector({
+        baseUrl: harness.url,
+        connector: {
+          args: [fixture],
+          command: "node",
+          connector_id: "fixture-count-mismatch",
+          artifactDigest: `sha256:${"b".repeat(64)}`,
+          manifestFingerprint: "a".repeat(64),
+          protocol_capabilities: [],
+          runCoverageVersion: 1,
+          runtime_requirements: { bindings: {} },
+          streams: ["messages"],
+        },
+        deviceId: "device-1",
+        deviceToken: "device-token",
+        executionRoot: TEST_EXECUTION_ROOT,
+        queuePath: await tempQueuePath(),
+        sourceInstanceId: "src-count-mismatch",
+      }),
+      /contradicted emitted record count/
+    );
+    assert.equal(harness.terminalCommits.length, 0);
+  } finally {
+    await harness.close();
+  }
+});
+
 test("runCollectorConnector.onMessage observes every protocol message in emission order without altering the result", async () => {
   const harness = await startCollectorHarness({ priorState: {} });
   try {
diff --git a/packages/collector-runtime/src/collector-runner.ts b/packages/collector-runtime/src/collector-runner.ts
index a0060219a..3d4495e6f 100644
--- a/packages/collector-runtime/src/collector-runner.ts
+++ b/packages/collector-runtime/src/collector-runner.ts
@@ -87,6 +87,8 @@ const COLLECTOR_AGENT_VERSION = buildAgentVersion();
 export const COLLECTOR_STDERR_MAX_BYTES = 256 * 1024;
 
 const COLLECTOR_GAP_DETAILS_MAX_CHARS = 300;
+const MANIFEST_FINGERPRINT_RE = /^[a-f0-9]{64}$/;
+const ARTIFACT_DIGEST_RE = /^sha256:[a-f0-9]{64}$/;
 const KEYED_SECRET_RE =
   /\b(authorization|bearer|token|password|passwd|cookie|secret|otp|api[_-]?key)\b\s*[:=]\s*["']?[^"',\s}]+/gi;
 const OTP_RE = /\b\d{6}\b/g;
@@ -607,6 +609,8 @@ export function readCollectionScopeFromState(
  */
 interface CollectorConnectorSpecExtra {
   readonly args: readonly string[];
+  /** Release identity of the executable used for this run. */
+  readonly artifactDigest?: string;
   /** Argv for the connector entrypoint (typically tsx + connector index.ts). */
   readonly command: string;
   /** Stable connector id used for ingest envelopes. */
@@ -620,8 +624,12 @@ interface CollectorConnectorSpecExtra {
   readonly enforcesSourceRoots?: boolean;
   /** Optional extra env passed to the connector child process. */
   readonly env?: NodeJS.ProcessEnv;
+  /** Fingerprint of the verified manifest used for this run. */
+  readonly manifestFingerprint?: string;
   /** Optional stream resources for scoped connector runs. */
   readonly resources?: Readonly<Record<string, readonly string[]>>;
+  /** Set only when the installed manifest advertises optional store evidence. */
+  readonly runCoverageVersion?: 1;
   /**
    * The owner-declared collection boundary this run must stay inside, as
    * resolved from the durable per-connection scope. `null`/absent is a full
@@ -889,6 +897,15 @@ export class CollectorStateReadError extends Error {
  */
 // biome-ignore lint/complexity/noExcessiveCognitiveComplexity: ordered durable-run lifecycle; splitting it would hide checkpoint and heartbeat ordering.
 export async function runCollectorConnector(config: CollectorRunConfig): Promise<CollectorRunResult> {
+  if (
+    config.connector.runCoverageVersion === 1 &&
+    !(
+      MANIFEST_FINGERPRINT_RE.test(config.connector.manifestFingerprint ?? "") &&
+      ARTIFACT_DIGEST_RE.test(config.connector.artifactDigest ?? "")
+    )
+  ) {
+    throw new Error("optional store evidence requires a bound manifest fingerprint and artifact digest");
+  }
   throwIfAborted(config.abortSignal);
   const satisfiedBindings = assertPlacementOrThrow(config.connector, COLLECTOR_RUNTIME_CAPABILITIES);
 
@@ -1050,6 +1067,19 @@ export async function runCollectorConnector(config: CollectorRunConfig): Promise
       done?.status === "succeeded" && !streamResult.scanBudgetExceeded && done.coverage
         ? done.coverage.streams.map(
             (stream): TerminalCoverageFact => ({
+              artifact_digest: config.connector.artifactDigest as string,
+              manifest_fingerprint: config.connector.manifestFingerprint as string,
+              runtime_accounting: {
+                durable_admission:
+                  recordDrain.failed === 0 &&
+                  afterRecordsSummary.ready === 0 &&
+                  afterRecordsSummary.leased === 0 &&
+                  afterRecordsSummary.deadLetter === 0,
+                detail_complete: true,
+                stream_evidence_consistent: true,
+                outstanding_debt: 0,
+                checkpoint_eligible: true,
+              },
               scoped: stream.scoped,
               stores: stream.stores,
               stream: stream.stream,
@@ -1636,6 +1666,7 @@ async function streamConnectorIntoOutbox(
   let pendingRecords: Extract<EmittedMessage, { type: "RECORD" }>[] = [];
   let bufferHighWaterMark = 0;
   let recordsQueued = 0;
+  let recordsObserved = 0;
   let enqueuedBatches = 0;
   let done: Extract<EmittedMessage, { type: "DONE" }> | null = null;
   let scanBudgetExceeded = false;
@@ -1724,6 +1755,7 @@ async function streamConnectorIntoOutbox(
       throw new Error(`${input.config.connector.connector_id} emitted ${message.type} after terminal DONE`);
     }
     if (message.type === "RECORD") {
+      recordsObserved += 1;
       recordCoverageIfPresent(message);
       pendingRecords.push(message);
       if (pendingRecords.length > bufferHighWaterMark) {
@@ -1748,11 +1780,20 @@ async function streamConnectorIntoOutbox(
       assertValidStreamEvidence(message, input.config.connector);
       return;
     }
+    if (message.type === "DETAIL_GAP" || message.type === "DETAIL_COVERAGE") {
+      throw new Error(`${input.config.connector.connector_id} emitted unsupported ${message.type} to local collector`);
+    }
     if (message.type === "DONE") {
       if (message.coverage === undefined) {
         done = message;
         return;
       }
+      if (input.config.connector.runCoverageVersion !== 1) {
+        throw new Error(`${input.config.connector.connector_id} emitted unrequested DONE coverage`);
+      }
+      if (message.records_emitted !== recordsObserved) {
+        throw new Error(`${input.config.connector.connector_id} DONE coverage contradicted emitted record count`);
+      }
       if (message.status !== "succeeded") {
         throw new Error(`${input.config.connector.connector_id} emitted coverage on failed DONE`);
       }
@@ -1836,7 +1877,8 @@ async function streamConnectorIntoOutbox(
         input.config.connector.enforcesSourceRoots === true
           ? resolveScopedSourceRoots(input.config.connector.scope)
           : [],
-        collectorScopeFingerprint(input.config.connector.scope)
+        collectorScopeFingerprint(input.config.connector.scope),
+        input.config.connector.runCoverageVersion
       )
     )}\n`
   );
@@ -2321,10 +2363,12 @@ export function buildCollectorStartMessage(
   resources: Readonly<Record<string, readonly string[]>> = {},
   timeRanges: CollectorStreamTimeRanges = {},
   sourceRoots: readonly string[] = [],
-  collectionScope?: string
+  collectionScope?: string,
+  runCoverageVersion?: 1
 ): StartMessage {
   const start: StartMessage = {
     ...(collectionScope ? { collection_scope: collectionScope } : {}),
+    ...(runCoverageVersion === 1 ? { run_coverage_version: 1 } : {}),
     scope: {
       streams: streams.map((name): StreamScope => {
         const streamResources = resources[name]?.filter((value) => typeof value === "string" && value.length > 0);
diff --git a/packages/collector-runtime/src/local-device-client.test.ts b/packages/collector-runtime/src/local-device-client.test.ts
index 73676f7ed..337381822 100644
--- a/packages/collector-runtime/src/local-device-client.test.ts
+++ b/packages/collector-runtime/src/local-device-client.test.ts
@@ -55,6 +55,38 @@ test("LocalDeviceClient accepts only the exact canonical terminal receipt", asyn
   assert.equal((await client.commitTerminalRun(request)).envelope_hash, expectedHash);
 });
 
+test("LocalDeviceClient refuses a successful HTTP ingest with rejected records", async () => {
+  const client = new LocalDeviceClient({
+    baseUrl: "http://127.0.0.1:1",
+    deviceId: "device-1",
+    deviceToken: "device-token",
+    fetchImpl: () =>
+      Promise.resolve(
+        new Response(
+          JSON.stringify({
+            accepted_record_count: 0,
+            object: "device_ingest_batch_result",
+            rejected_record_count: 1,
+            status: "accepted",
+          }),
+          { status: 201 }
+        )
+      ),
+  });
+  await assert.rejects(
+    client.ingestBatch({
+      batch_id: "batch-1",
+      batch_seq: 1,
+      body_hash: "hash-1",
+      connector_id: "codex",
+      device_id: "device-1",
+      records: [{ data: {}, emitted_at: "2026-04-30T12:00:00.000Z", record_key: "record-1", stream: "messages" }],
+      source_instance_id: "source-1",
+    }),
+    /rejected records/
+  );
+});
+
 for (const invalid of [
   {
     commit_id: "wrong",
@@ -572,6 +604,16 @@ async function startJsonServer(seen: SeenRequest[]): Promise<{ close: () => Prom
       });
       return;
     }
+    if (path.endsWith("/ingest-batches")) {
+      const request = body ? (JSON.parse(body) as { records?: unknown[] }) : {};
+      sendJson(res, 200, {
+        accepted_record_count: request.records?.length ?? 0,
+        object: "device_ingest_batch_result",
+        rejected_record_count: 0,
+        status: "accepted",
+      });
+      return;
+    }
     sendJson(res, 200, { ok: true });
   });
   await new Promise<void>((resolve) => server.listen(0, "127.0.0.1", resolve));
diff --git a/packages/collector-runtime/src/local-device-client.ts b/packages/collector-runtime/src/local-device-client.ts
index a80dc9e3a..a384cd6d5 100644
--- a/packages/collector-runtime/src/local-device-client.ts
+++ b/packages/collector-runtime/src/local-device-client.ts
@@ -175,6 +175,15 @@ export interface TerminalCollectionFact {
 
 /** Named stores are required for the server to check a signed inventory. */
 export interface TerminalCoverageFact {
+  artifact_digest: string;
+  manifest_fingerprint: string;
+  runtime_accounting: {
+    durable_admission: boolean;
+    detail_complete: boolean;
+    stream_evidence_consistent: boolean;
+    outstanding_debt: number;
+    checkpoint_eligible: boolean;
+  };
   scoped: boolean;
   stores: readonly { store: string; status: "collected" | "partial" | "unavailable" | "failed" }[];
   stream: string;
@@ -438,10 +447,22 @@ export class LocalDeviceClient {
   }
 
   ingestBatch(request: IngestBatchRequest): Promise<{ ok: true }> {
-    return this.#request(LOCAL_DEVICE_ENDPOINTS.ingestBatch(this.#requireDeviceId()), {
+    return this.#request<Record<string, unknown>>(LOCAL_DEVICE_ENDPOINTS.ingestBatch(this.#requireDeviceId()), {
       authenticate: true,
       body: request,
       method: "POST",
+    }).then((response) => {
+      if (
+        response?.object !== "device_ingest_batch_result" ||
+        response.status !== "accepted" ||
+        response.accepted_record_count !== request.records.length ||
+        response.rejected_record_count !== 0
+      ) {
+        throw new LocalDeviceReceiptValidationError(
+          "device ingest batch response rejected records or omitted durable admission counts"
+        );
+      }
+      return { ok: true };
     });
   }
 
diff --git a/packages/collector-runtime/src/local-device-envelope.ts b/packages/collector-runtime/src/local-device-envelope.ts
index 8be5b7ed8..2483759a9 100644
--- a/packages/collector-runtime/src/local-device-envelope.ts
+++ b/packages/collector-runtime/src/local-device-envelope.ts
@@ -60,6 +60,9 @@ export interface CanonicalTerminalFactInput {
 }
 
 export interface CanonicalCoverageFactInput {
+  readonly artifact_digest?: string;
+  readonly manifest_fingerprint?: string;
+  readonly runtime_accounting?: Record<string, unknown>;
   readonly scoped: boolean;
   readonly stores: readonly {
     readonly store: string;
@@ -106,6 +109,9 @@ export function canonicalTerminalRunCommitEnvelope(input: TerminalRunCommitEnvel
       state_delta: input.state_delta,
       terminal_facts: input.terminal_facts
         .map((fact) => ({
+          ...(fact.artifact_digest ? { artifact_digest: fact.artifact_digest } : {}),
+          ...(fact.manifest_fingerprint ? { manifest_fingerprint: fact.manifest_fingerprint } : {}),
+          ...(fact.runtime_accounting ? { runtime_accounting: fact.runtime_accounting } : {}),
           scoped: fact.scoped,
           stores: [...fact.stores].sort((left, right) => left.store.localeCompare(right.store)),
           stream: fact.stream,
diff --git a/packages/connector-protocol/src/connector-runtime-protocol.ts b/packages/connector-protocol/src/connector-runtime-protocol.ts
index 346e6c93d..dc3c7173f 100644
--- a/packages/connector-protocol/src/connector-runtime-protocol.ts
+++ b/packages/connector-protocol/src/connector-runtime-protocol.ts
@@ -324,6 +324,8 @@ export interface StartMessage {
    * new source-touching work. Absent/false = an ordinary full run.
    */
   recovery_only?: boolean;
+  /** Optional negotiated store collection evidence, independent of protocol_version. */
+  run_coverage_version?: 1;
   scope: { streams: readonly StreamScope[] };
   state?: Record<string, unknown>;
   streamsToBackfill?: readonly string[];
diff --git a/packages/local-collector/bin/pdpp-local-collector.ts b/packages/local-collector/bin/pdpp-local-collector.ts
index c293a9b87..85f9f2c93 100644
--- a/packages/local-collector/bin/pdpp-local-collector.ts
+++ b/packages/local-collector/bin/pdpp-local-collector.ts
@@ -51,6 +51,7 @@ import { ALLOW_CUSTOM_COMMAND_ENV, CollectorCustomCommandRefusedError, Collector
 import { COLLECTION_PROFILE_PINS } from "../src/generated/collection-profile-pins.generated.ts";
 import { LOCAL_COLLECTOR_DEFINITIONS } from "../src/generated/collector-definitions.generated.ts";
 import {
+  COLLECTION_PROFILE_MANIFEST,
   type CollectionProfilePin,
   ensureCollectionProfileInstalled,
   installedCollectionProfile,
@@ -70,6 +71,7 @@ import {
   type EnrollmentExchangeResponse,
   enrollCollector,
   getBundledConnectorFrom,
+  hashCanonicalJson,
   isMainModule,
   type LocalCollectorLifecycleState,
   LocalDeviceClient,
@@ -3196,11 +3198,41 @@ export async function prepareConnectorSpec(
   const spec = buildConnectorSpec(options);
   const pin = options.entrypointCommand ? undefined : PINS_BY_CONNECTOR.get(spec.connector_id);
   if (pin) {
-    await install({ pin, installRoot: COLLECTION_PROFILE_ROOT, durableRoot: collectorStateDirectory() });
+    const release = await install({ pin, installRoot: COLLECTION_PROFILE_ROOT, durableRoot: collectorStateDirectory() });
+    const profile = JSON.parse(readFileSync(join(release.directory, COLLECTION_PROFILE_MANIFEST), "utf8")) as unknown;
+    return bindOptionalRunCoverageToRelease(spec, pin, profile);
   }
   return spec;
 }
 
+/** Request the optional terminal assertion only for a verified, fully instrumented selected set. */
+export function bindOptionalRunCoverageToRelease(
+  spec: CollectorConnectorSpec,
+  pin: Pick<CollectionProfilePin, "digest">,
+  rawProfile: unknown
+): CollectorConnectorSpec {
+  if (!rawProfile || typeof rawProfile !== "object" || Array.isArray(rawProfile)) return spec;
+  const profile = rawProfile as { run_coverage?: { version?: unknown }; streams?: unknown };
+  if (profile.run_coverage?.version !== 1 || !Array.isArray(profile.streams)) return spec;
+  const inventory = new Map<string, readonly string[]>();
+  for (const value of profile.streams) {
+    if (!value || typeof value !== "object" || Array.isArray(value)) return spec;
+    const stream = value as { name?: unknown; coverage_stores?: unknown };
+    if (typeof stream.name !== "string" || inventory.has(stream.name)) return spec;
+    if (Array.isArray(stream.coverage_stores) && stream.coverage_stores.length > 0 &&
+      stream.coverage_stores.every((store) => typeof store === "string" && store.trim())) {
+      inventory.set(stream.name, stream.coverage_stores as readonly string[]);
+    }
+  }
+  if (!spec.streams.every((stream) => inventory.has(stream))) return spec;
+  return {
+    ...spec,
+    artifactDigest: pin.digest,
+    manifestFingerprint: hashCanonicalJson(rawProfile),
+    runCoverageVersion: 1,
+  };
+}
+
 export function buildConnectorSpec(options: CliOptions): CollectorConnectorSpec {
   if (!options.connector) {
     throw new CollectorUsageError("connector required");
diff --git a/packages/local-collector/test/collection-profiles.test.ts b/packages/local-collector/test/collection-profiles.test.ts
index 424840d4c..1971a9026 100644
--- a/packages/local-collector/test/collection-profiles.test.ts
+++ b/packages/local-collector/test/collection-profiles.test.ts
@@ -19,7 +19,7 @@ import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { after, test } from "node:test";
 
-import { parseArgs, prepareConnectorSpec } from "../bin/pdpp-local-collector.ts";
+import { bindOptionalRunCoverageToRelease, buildConnectorSpec, parseArgs, prepareConnectorSpec } from "../bin/pdpp-local-collector.ts";
 import { ALLOW_CUSTOM_COMMAND_ENV } from "../src/errors.ts";
 import { COLLECTION_PROFILE_PINS } from "../src/generated/collection-profile-pins.generated.ts";
 import { LOCAL_COLLECTOR_DEFINITIONS } from "../src/generated/collector-definitions.generated.ts";
@@ -282,7 +282,10 @@ test("prepareConnectorSpec installs the pinned profile before a pinned connector
   const installed: CollectionProfilePin[] = [];
   const spec = await prepareConnectorSpec(parseArgs([...RUN_ARGS, "--connector", "codex"]), async (options) => {
     installed.push(options.pin);
-    return installedCollectionProfile(options.installRoot, options.pin);
+    const directory = join(scratch, "prepared-codex");
+    mkdirSync(join(directory, "profile"), { recursive: true });
+    writeFileSync(join(directory, "profile", "collection-profile.json"), readFileSync(new URL("codex.json", REFERENCE_PROFILE_DIR)));
+    return { ...installedCollectionProfile(options.installRoot, options.pin), directory };
   });
   assert.deepEqual(
     installed.map((pin) => pin.connectorId),
@@ -295,6 +298,23 @@ test("prepareConnectorSpec installs the pinned profile before a pinned connector
   );
 });
 
+test("store evidence negotiation binds the exact selected release and leaves partial instrumentation unknown", () => {
+  const spec = buildConnectorSpec(parseArgs([...RUN_ARGS, "--connector", "codex", "--streams", "messages"]));
+  const pin = { digest: `sha256:${"a".repeat(64)}` };
+  const profile = {
+    run_coverage: { version: 1 },
+    streams: [{ name: "messages", coverage_stores: ["messages"], obligation: "content" }, { name: "sessions" }],
+  };
+  const selected = bindOptionalRunCoverageToRelease(spec, pin, profile);
+  assert.equal(selected.runCoverageVersion, 1);
+  assert.equal(selected.artifactDigest, pin.digest);
+  assert.equal(selected.manifestFingerprint?.length, 64);
+  assert.notEqual(selected.manifestFingerprint,
+    bindOptionalRunCoverageToRelease(spec, pin, { ...profile, streams: [{ ...profile.streams[0], obligation: "metadata" }, profile.streams[1]] }).manifestFingerprint);
+  assert.equal(bindOptionalRunCoverageToRelease({ ...spec, streams: ["messages", "sessions"] }, pin, profile).runCoverageVersion, undefined);
+  assert.equal(bindOptionalRunCoverageToRelease(spec, pin, { ...profile, run_coverage: undefined }).runCoverageVersion, undefined);
+});
+
 test("prepareConnectorSpec installs nothing for a custom --command", async () => {
   const previous = process.env[ALLOW_CUSTOM_COMMAND_ENV];
   process.env[ALLOW_CUSTOM_COMMAND_ENV] = "1";
diff --git a/reference-implementation/operations/local-device-terminal-collection.ts b/reference-implementation/operations/local-device-terminal-collection.ts
index 2505fb1b1..4608e5089 100644
--- a/reference-implementation/operations/local-device-terminal-collection.ts
+++ b/reference-implementation/operations/local-device-terminal-collection.ts
@@ -4,10 +4,13 @@
 import { createHash } from "node:crypto";
 import { canonicalTerminalRunCommitJson } from "@pdpp/reference-contract/common";
 import { canonicalTerminalRunCommitEnvelope } from "@pdpp/collector-runtime/local-device-envelope";
+import { fingerprintDeviceAttemptManifest } from "../server/device-ingest-attempt-context.ts";
 import { readRuntimeCollectionFact } from "../server/runtime-collection-facts.ts";
 import type { ResolvedTerminalRunCommit, TerminalRunCommitResult } from "../server/stores/terminal-run-commit-store.ts";
 import { TerminalRunCommitConflictError } from "../server/stores/terminal-run-commit-store.ts";
 
+const ARTIFACT_DIGEST = /^sha256:[a-f0-9]{64}$/;
+
 interface TerminalRequest {
   readonly body?: unknown;
   readonly deviceExporter?: { readonly deviceId: string };
@@ -21,7 +24,7 @@ interface TerminalResponse {
 
 interface AuthorizedSource {
   readonly connectorInstance: { readonly connectorInstanceId: string };
-  readonly sourceInstance: { readonly connectorId: string };
+  readonly sourceInstance: { readonly connectorId: string; readonly manifestGeneration?: number | null };
 }
 
 interface TerminalContext {
@@ -104,14 +107,32 @@ export async function handleLocalDeviceTerminalRunCommit(input: {
       return;
     }
 
-    const validatedFacts = version === 2
-      ? normalizeTerminalCoverageFacts(rawFacts, await ctx.getConnectorManifest?.(canonicalConnectorId), collectionBoundary, { allowSubset: true })
-      : normalizedFacts;
+    const validatedFacts =
+      version === 2
+        ? normalizeTerminalCoverageFacts(
+            rawFacts,
+            await ctx.getConnectorManifest?.(canonicalConnectorId),
+            collectionBoundary,
+            { allowSubset: true, bindingGeneration: authorized.sourceInstance.manifestGeneration ?? null }
+          )
+        : normalizedFacts;
     if (!validatedFacts) {
       ctx.pdppError(res, 400, "invalid_request", "terminal coverage does not match the manifest inventory");
       return;
     }
 
+    if (
+      version === 2 &&
+      validatedFacts.some(
+        (fact) =>
+          Object.hasOwn(stateDelta, String(fact.stream)) &&
+          asObject(fact.runtime_accounting)?.checkpoint_eligible === false
+      )
+    ) {
+      ctx.pdppError(res, 400, "invalid_request", "withheld checkpoint cannot advance stream state");
+      return;
+    }
+
     const canonicalEnvelope = {
       collection_boundary: collectionBoundary,
       commit_id: commitId,
@@ -134,9 +155,14 @@ export async function handleLocalDeviceTerminalRunCommit(input: {
       terminal_facts: body.terminal_facts,
       version,
     } as const;
-    const canonicalJson = version === 2
-      ? JSON.stringify(canonicalTerminalRunCommitEnvelope(canonicalEnvelope as Parameters<typeof canonicalTerminalRunCommitEnvelope>[0]))
-      : canonicalTerminalRunCommitJson(canonicalEnvelope as Parameters<typeof canonicalTerminalRunCommitJson>[0]);
+    const canonicalJson =
+      version === 2
+        ? JSON.stringify(
+            canonicalTerminalRunCommitEnvelope(
+              canonicalEnvelope as Parameters<typeof canonicalTerminalRunCommitEnvelope>[0]
+            )
+          )
+        : canonicalTerminalRunCommitJson(canonicalEnvelope as Parameters<typeof canonicalTerminalRunCommitJson>[0]);
     const envelopeHash = createHash("sha256").update(canonicalJson).digest("hex");
     const result = await ctx.commitTerminalRun({
       collectionBoundary,
@@ -322,26 +348,46 @@ export function normalizeTerminalCoverageFacts(
   rawFacts: readonly unknown[],
   rawManifest: unknown,
   collectionBoundary: string,
-  options: { allowSubset?: boolean } = {}
+  options: { allowSubset?: boolean; bindingGeneration?: number | null; validateBindingGeneration?: boolean } = {}
 ): readonly Record<string, unknown>[] | null {
   const manifest = asObject(rawManifest);
   const manifestStreams = manifest?.streams;
   if (!Array.isArray(manifestStreams) || manifestStreams.length === 0) {
     return null;
   }
+  const manifestFingerprint = fingerprintDeviceAttemptManifest(rawManifest);
   const inventory = new Map<string, Set<string>>();
+  const metadataOnlyStreams = new Set<string>();
   for (const rawStream of manifestStreams) {
     const stream = asObject(rawStream);
     const name = stream && readRequiredString(stream.name);
     const stores = stream?.coverage_stores;
-    if (!name || !Array.isArray(stores) || stores.length === 0 ||
+    if (!name || inventory.has(name)) {
+      return null;
+    }
+    if (stores === undefined && options.allowSubset) {
+      inventory.set(name, new Set());
+      continue;
+    }
+    if (
+      !Array.isArray(stores) ||
+      stores.length === 0 ||
       stores.some((store) => typeof store !== "string" || !store.trim()) ||
-      new Set(stores).size !== stores.length || inventory.has(name)) {
+      new Set(stores).size !== stores.length ||
+      inventory.has(name)
+    ) {
       return null;
     }
     inventory.set(name, new Set(stores));
+    if (stream?.coverage_policy === "inventory_only") {
+      metadataOnlyStreams.add(name);
+    }
   }
-  if (rawFacts.length === 0 || rawFacts.length > inventory.size || (!options.allowSubset && rawFacts.length !== inventory.size)) {
+  if (
+    rawFacts.length === 0 ||
+    rawFacts.length > inventory.size ||
+    (!options.allowSubset && rawFacts.length !== inventory.size)
+  ) {
     return null;
   }
   const seen = new Set<string>();
@@ -351,9 +397,15 @@ export function normalizeTerminalCoverageFacts(
     const stream = entry && readRequiredString(entry.stream);
     const expected = stream ? inventory.get(stream) : null;
     const rawStores = entry?.stores;
-    if (!stream || !expected || seen.has(stream) || typeof entry.scoped !== "boolean" ||
-      !Array.isArray(rawStores) || rawStores.length !== expected.size ||
-      (collectionBoundary !== "unscoped" && entry.scoped !== true)) {
+    if (
+      !(stream && expected) ||
+      expected.size === 0 ||
+      seen.has(stream) ||
+      typeof entry.scoped !== "boolean" ||
+      !Array.isArray(rawStores) ||
+      rawStores.length !== expected.size ||
+      (collectionBoundary !== "unscoped" && entry.scoped !== true)
+    ) {
       return null;
     }
     seen.add(stream);
@@ -363,29 +415,75 @@ export function normalizeTerminalCoverageFacts(
       const store = asObject(rawStore);
       const name = store && readRequiredString(store.store);
       const status = store?.status;
-      if (!name || !expected.has(name) || seenStores.has(name) ||
-        (status !== "collected" && status !== "partial" && status !== "unavailable" && status !== "failed")) {
+      if (
+        !(name && expected.has(name)) ||
+        seenStores.has(name) ||
+        (status !== "collected" && status !== "partial" && status !== "unavailable" && status !== "failed")
+      ) {
         return null;
       }
       seenStores.add(name);
       stores.push({ store: name, status });
     }
-    const statuses = stores.map((store) => store.status);
-    const pendingDetailGaps = statuses.filter((status) => status !== "collected").length;
+    // Keep assertions separate from the verdict derived from host accounting.
+    // Missing provenance remains unknown; a known contradiction is partial.
+    stores.sort((left, right) => left.store.localeCompare(right.store));
+    const accounting = readTerminalRuntimeAccounting(entry.runtime_accounting);
+    const accountingKnown = accounting !== null;
+    const generationMatches =
+      !options.validateBindingGeneration ||
+      (Number.isSafeInteger(options.bindingGeneration) && entry.binding_generation === options.bindingGeneration);
+    const bound =
+      generationMatches &&
+      entry.manifest_fingerprint === manifestFingerprint &&
+      typeof entry.artifact_digest === "string" &&
+      ARTIFACT_DIGEST.test(entry.artifact_digest);
+    const complete =
+      accountingKnown &&
+      accounting.durable_admission === true &&
+      accounting.detail_complete === true &&
+      accounting.stream_evidence_consistent === true &&
+      accounting.checkpoint_eligible === true &&
+      accounting.outstanding_debt === 0;
+    const statuses = stores.map((store) => {
+      if (store.status !== "collected") {
+        return store.status;
+      }
+      if (!(bound && accountingKnown)) {
+        return "unknown";
+      }
+      if (!complete) {
+        return "partial";
+      }
+      return metadataOnlyStreams.has(stream) ? "inventory_only" : "collected";
+    });
+    const pendingDetailGaps = accountingKnown ? Number(accounting.outstanding_debt) : 0;
     facts.push({
-      checkpoint: "committed",
+      checkpoint: accountingKnown && accounting.checkpoint_eligible === true ? "committed" : "withheld",
       collected: 0,
       considered: null,
       covered: null,
+      manifest_fingerprint: entry.manifest_fingerprint,
+      artifact_digest: entry.artifact_digest,
+      ...(Number.isSafeInteger(options.bindingGeneration)
+        ? {
+            binding_generation: options.validateBindingGeneration
+              ? entry.binding_generation
+              : options.bindingGeneration,
+          }
+        : {}),
+      ...(accountingKnown ? { runtime_accounting: accounting } : {}),
       coverage_statuses: statuses,
       pending_detail_gaps: pendingDetailGaps,
       scoped: entry.scoped,
       skipped: null,
-      stores: stores.sort((left, right) => left.store.localeCompare(right.store)),
+      stores,
       stream,
     });
   }
-  return seen.size === rawFacts.length ? facts.sort((left, right) => String(left.stream).localeCompare(String(right.stream))) : null;
+  return seen.size === rawFacts.length
+    ? facts.sort((left, right) => String(left.stream).localeCompare(String(right.stream)))
+    : null;
 }
 
 function readCoverageStatuses(value: unknown): readonly string[] | null {
@@ -394,3 +492,34 @@ function readCoverageStatuses(value: unknown): readonly string[] | null {
   }
   return [...new Set(value)].sort();
 }
+
+interface TerminalRuntimeAccounting {
+  durable_admission: boolean;
+  detail_complete: boolean;
+  stream_evidence_consistent: boolean;
+  outstanding_debt: number;
+  checkpoint_eligible: boolean;
+}
+
+function readTerminalRuntimeAccounting(value: unknown): TerminalRuntimeAccounting | null {
+  const accounting = asObject(value);
+  if (
+    !accounting ||
+    typeof accounting.durable_admission !== "boolean" ||
+    typeof accounting.detail_complete !== "boolean" ||
+    typeof accounting.stream_evidence_consistent !== "boolean" ||
+    typeof accounting.checkpoint_eligible !== "boolean" ||
+    typeof accounting.outstanding_debt !== "number" ||
+    !Number.isSafeInteger(accounting.outstanding_debt) ||
+    accounting.outstanding_debt < 0
+  ) {
+    return null;
+  }
+  return {
+    durable_admission: accounting.durable_admission,
+    detail_complete: accounting.detail_complete,
+    stream_evidence_consistent: accounting.stream_evidence_consistent,
+    outstanding_debt: accounting.outstanding_debt,
+    checkpoint_eligible: accounting.checkpoint_eligible,
+  };
+}
diff --git a/reference-implementation/server/ref-control.ts b/reference-implementation/server/ref-control.ts
index a906d3f5c..f4ba7bb58 100644
--- a/reference-implementation/server/ref-control.ts
+++ b/reference-implementation/server/ref-control.ts
@@ -4567,6 +4567,8 @@ function pendingDetailGapCountsByStream(
 
 function localCoverageConditionForStatus(status: unknown): CoverageAxis | null {
   switch (status) {
+    case "unknown":
+      return "unknown";
     case "collected":
     case "excluded":
     case "missing":
@@ -4980,7 +4982,8 @@ export function deriveLocalCoverageAxis(input: {
 function deriveLocalTerminalCoverageAxis(
   run: ConnectorRunSummary | null,
   manifest: ConnectorManifest,
-  legacyAxis: LocalCoverageDiagnosticAxis | null
+  legacyAxis: LocalCoverageDiagnosticAxis | null,
+  bindingGeneration: number | null
 ): LocalCoverageDiagnosticAxis | null {
   const terminal = run?.local_terminal_coverage;
   if (!terminal) {
@@ -5003,19 +5006,22 @@ function deriveLocalTerminalCoverageAxis(
     terminal.collectionScope !== declaredScope || !Array.isArray(terminal.streams)) {
     return unknown;
   }
-  const normalized = normalizeTerminalCoverageFacts(terminal.streams, manifest, terminal.collectionScope);
+  const normalized = normalizeTerminalCoverageFacts(terminal.streams, manifest, terminal.collectionScope, { allowSubset: true, bindingGeneration, validateBindingGeneration: true });
   if (!normalized) {
     return unknown;
   }
   const rows: LocalCoverageDiagnosticRow[] = [];
   const unaccountedStores: string[] = [];
-  let axis: CoverageAxis = "complete";
+  let axis: CoverageAxis = normalized.length === manifest.streams?.length ? "complete" : "unknown";
   for (const rawFact of normalized) {
     const stream = rawFact.stream as string;
     if (rawFact.scoped !== true) {
       return unknown;
     }
-    for (const rawStore of rawFact.stores as readonly { store: string; status: string }[]) {
+    let storeIndex = 0;
+    for (const assertion of rawFact.stores as readonly { store: string; status: string }[]) {
+      const status = (rawFact.coverage_statuses as string[])[storeIndex++] ?? "unknown";
+      const rawStore = { ...assertion, status };
       rows.push({ collection_scope: terminal.collectionScope, status: rawStore.status, store: rawStore.store, stream });
       if (rawStore.status !== "collected") {
         unaccountedStores.push(rawStore.store);
@@ -7060,7 +7066,7 @@ function synthesizeConnectorSummary(input: ConnectorSummarySynthesisInput): Conn
   const fallbackSettledRun = latestSettledRun ?? fallbackLatestSettledRun(lastRun, lastSuccessfulRun);
   const authoritativeLatestSettledRun = isOwnScopedRun(fallbackSettledRun) ? fallbackSettledRun : null;
   const effectiveLocalCoverage = localDeviceBacked
-    ? (deriveLocalTerminalCoverageAxis(fallbackSettledRun, manifest, localCoverage) ?? localCoverage)
+    ? (deriveLocalTerminalCoverageAxis(fallbackSettledRun, manifest, localCoverage, evidence?.manifest_generation ?? null) ?? localCoverage)
     : localCoverage;
   const authoritativeLatestStreamFacts = localDeviceBacked ? null : latestStreamFacts;
   const terminalSetupDisposition =
diff --git a/reference-implementation/test/local-device-terminal-coverage-projection.test.ts b/reference-implementation/test/local-device-terminal-coverage-projection.test.ts
index 675db7906..46dbf7bed 100644
--- a/reference-implementation/test/local-device-terminal-coverage-projection.test.ts
+++ b/reference-implementation/test/local-device-terminal-coverage-projection.test.ts
@@ -6,6 +6,7 @@ import { mkdtempSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import test from "node:test";
+import { fingerprintDeviceAttemptManifest } from "../server/device-ingest-attempt-context.ts";
 import { reconcileDirtyConnectorSummaryEvidence } from "../server/connector-summary-read-model.ts";
 import { closeDb, getDb, initDb } from "../server/db.ts";
 import { buildStoredCollectionScope, COLLECTION_SCOPE_STATE_KEY } from "../server/local-collection-scope.ts";
@@ -25,21 +26,33 @@ async function withLocalConnection(run: () => Promise<void>): Promise<void> {
   initDb(join(directory, "pdpp.sqlite"));
   try {
     const now = new Date().toISOString();
-    getDb().prepare("INSERT INTO connectors(connector_id, manifest, created_at) VALUES (?, ?, ?)").run(
-      connectorId,
-      JSON.stringify({
-        capabilities: { public_listing: { tier: "supported" } },
-        connector_id: connectorId,
-        display_name: "Terminal Coverage Fixture",
-        protocol_version: "0.1.0",
-        streams: [
-          { coverage_stores: ["projects"], coverage_strategy: "checkpoint_window", name: "sessions", primary_key: ["id"] },
-          { coverage_stores: ["derived_messages"], coverage_strategy: "checkpoint_window", name: "messages", primary_key: ["id"] },
-        ],
-        version: "1.0.0",
-      }),
-      now
-    );
+    getDb()
+      .prepare("INSERT INTO connectors(connector_id, manifest, created_at) VALUES (?, ?, ?)")
+      .run(
+        connectorId,
+        JSON.stringify({
+          capabilities: { public_listing: { tier: "supported" } },
+          connector_id: connectorId,
+          display_name: "Terminal Coverage Fixture",
+          protocol_version: "0.1.0",
+          streams: [
+            {
+              coverage_stores: ["projects"],
+              coverage_strategy: "checkpoint_window",
+              name: "sessions",
+              primary_key: ["id"],
+            },
+            {
+              coverage_stores: ["derived_messages"],
+              coverage_strategy: "checkpoint_window",
+              name: "messages",
+              primary_key: ["id"],
+            },
+          ],
+          version: "1.0.0",
+        }),
+        now
+      );
     await createSqliteConnectorInstanceStore().upsert({
       connectorId,
       connectorInstanceId,
@@ -53,7 +66,14 @@ async function withLocalConnection(run: () => Promise<void>): Promise<void> {
       updatedAt: now,
     });
     const store = getDefaultDeviceExporterStore();
-    await store.createDevice({ createdAt: now, deviceId, displayName: "laptop", ownerSubjectId, status: "active", updatedAt: now });
+    await store.createDevice({
+      createdAt: now,
+      deviceId,
+      displayName: "laptop",
+      ownerSubjectId,
+      status: "active",
+      updatedAt: now,
+    });
     await store.upsertSourceInstance({
       connectorId,
       connectorInstanceId,
@@ -89,7 +109,29 @@ async function projectedCoverage() {
   };
 }
 
-async function seedTerminalCoverage(status: "collected" | "partial" | "failed", malformed = false, version: 1 | 2 = 2): Promise<void> {
+async function seedTerminalCoverage(
+  status: "collected" | "partial" | "failed",
+  malformed = false,
+  version: 1 | 2 = 2,
+  accountingOverrides: Record<string, unknown> = {}
+): Promise<void> {
+  const manifest = JSON.parse(
+    (getDb().prepare("SELECT manifest FROM connectors WHERE connector_id = ?").get(connectorId) as { manifest: string })
+      .manifest
+  );
+  const bindings = {
+    binding_generation: 0,
+    manifest_fingerprint: fingerprintDeviceAttemptManifest(manifest),
+    artifact_digest: `sha256:${"a".repeat(64)}`,
+    runtime_accounting: {
+      durable_admission: true,
+      detail_complete: true,
+      stream_evidence_consistent: true,
+      outstanding_debt: 0,
+      checkpoint_eligible: true,
+      ...accountingOverrides,
+    },
+  };
   await commitTerminalRun({
     collectionBoundary: "unscoped",
     commitId: "commit_terminal_coverage",
@@ -99,15 +141,30 @@ async function seedTerminalCoverage(status: "collected" | "partial" | "failed",
     envelopeHash: "test-envelope-hash",
     normalizedFacts: [
       {
-        checkpoint: "committed", collected: 0, considered: null, covered: null,
-        coverage_statuses: ["collected"], pending_detail_gaps: 0, scoped: true, skipped: null,
-        stores: [{ store: malformed ? "unknown_store" : "projects", status: "collected" }], stream: "sessions",
+        ...bindings,
+        checkpoint: "committed",
+        collected: 0,
+        considered: null,
+        covered: null,
+        coverage_statuses: ["collected"],
+        pending_detail_gaps: 0,
+        scoped: true,
+        skipped: null,
+        stores: [{ store: malformed ? "unknown_store" : "projects", status: "collected" }],
+        stream: "sessions",
       },
       {
-        checkpoint: "committed", collected: 0, considered: null, covered: null,
-        coverage_statuses: [status], pending_detail_gaps: status === "collected" ? 0 : 1,
-        scoped: true, skipped: null,
-        stores: [{ store: "derived_messages", status }], stream: "messages",
+        ...bindings,
+        checkpoint: "committed",
+        collected: 0,
+        considered: null,
+        covered: null,
+        coverage_statuses: [status],
+        pending_detail_gaps: status === "collected" ? 0 : 1,
+        scoped: true,
+        skipped: null,
+        stores: [{ store: "derived_messages", status }],
+        stream: "messages",
       },
     ],
     runId: "run_terminal_coverage",
@@ -159,12 +216,18 @@ test("legacy terminal commit without v2 proof stays unknown", async () => {
 test("selected-stream v2 proof cannot cover omitted manifest streams", async () => {
   await withLocalConnection(async () => {
     await seedTerminalCoverage("collected");
-    const row = getDb().prepare("SELECT facts_json FROM run_history WHERE run_id = ?").get("run_terminal_coverage") as { facts_json: string };
+    const row = getDb().prepare("SELECT facts_json FROM run_history WHERE run_id = ?").get("run_terminal_coverage") as {
+      facts_json: string;
+    };
     const facts = JSON.parse(row.facts_json) as { collection_facts: { streams: unknown[] } };
     facts.collection_facts.streams = facts.collection_facts.streams.slice(0, 1);
-    getDb().prepare("UPDATE run_history SET facts_json = ? WHERE run_id = ?")
+    getDb()
+      .prepare("UPDATE run_history SET facts_json = ? WHERE run_id = ?")
       .run(JSON.stringify(facts), "run_terminal_coverage");
-    assert.equal((await projectedCoverage()).axis, "unknown");
+    const selected = await projectedCoverage();
+    assert.equal(selected.axis, "unknown");
+    assert.equal(selected.conditions.sessions, "complete");
+    assert.equal(selected.conditions.messages, "unknown");
   });
 });
 
@@ -172,15 +235,17 @@ test("v2 terminal proof for an old collection scope cannot cover the current sco
   await withLocalConnection(async () => {
     await seedTerminalCoverage("collected");
     const now = new Date().toISOString();
-    getDb().prepare(
-      "INSERT INTO connector_state(connector_id, connector_instance_id, stream, state_json, updated_at) VALUES (?, ?, ?, ?, ?)"
-    ).run(
-      connectorId,
-      connectorInstanceId,
-      COLLECTION_SCOPE_STATE_KEY,
-      JSON.stringify(buildStoredCollectionScope({ since: "2026-01-01T00:00:00.000Z" }, now)),
-      now
-    );
+    getDb()
+      .prepare(
+        "INSERT INTO connector_state(connector_id, connector_instance_id, stream, state_json, updated_at) VALUES (?, ?, ?, ?, ?)"
+      )
+      .run(
+        connectorId,
+        connectorInstanceId,
+        COLLECTION_SCOPE_STATE_KEY,
+        JSON.stringify(buildStoredCollectionScope({ since: "2026-01-01T00:00:00.000Z" }, now)),
+        now
+      );
     assert.equal((await projectedCoverage()).axis, "unknown");
   });
 });
@@ -190,12 +255,64 @@ test("a newer failed run cannot retain an earlier v2 covered verdict", async ()
     await seedTerminalCoverage("collected");
     assert.equal((await projectedCoverage()).axis, "complete");
     const later = new Date(Date.now() + 60_000).toISOString();
-    getDb().prepare(
-      `INSERT INTO run_history (
+    getDb()
+      .prepare(
+        `INSERT INTO run_history (
          connector_instance_id, connector_id, source_json, status, scheduler_managed,
          known_gaps_json, run_id, started_at, completed_at, attempt, facts_json
        ) VALUES (?, ?, '{}', 'failed', 0, '[]', ?, ?, ?, 1, '{}')`
-    ).run(connectorInstanceId, connectorId, "run_terminal_coverage_failed", later, later);
+      )
+      .run(connectorInstanceId, connectorId, "run_terminal_coverage_failed", later, later);
     assert.equal((await projectedCoverage()).axis, "unknown");
   });
 });
+
+test("changed release obligations with identical store names invalidate positive coverage", async () => {
+  await withLocalConnection(async () => {
+    await seedTerminalCoverage("collected");
+    assert.equal((await projectedCoverage()).axis, "complete");
+    const row = getDb().prepare("SELECT manifest FROM connectors WHERE connector_id = ?").get(connectorId) as {
+      manifest: string;
+    };
+    const manifest = JSON.parse(row.manifest);
+    manifest.version = "2.0.0";
+    manifest.streams[0].description = "Now includes content and attachments";
+    getDb()
+      .prepare("UPDATE connectors SET manifest = ? WHERE connector_id = ?")
+      .run(JSON.stringify(manifest), connectorId);
+    assert.equal((await projectedCoverage()).axis, "unknown");
+  });
+});
+
+test("persisted terminal coverage cannot cross a source binding generation", async () => {
+  await withLocalConnection(async () => {
+    await seedTerminalCoverage("collected");
+    assert.equal((await projectedCoverage()).axis, "complete");
+    getDb()
+      .prepare(
+        "UPDATE connector_instances SET manifest_generation = manifest_generation + 1 WHERE connector_instance_id = ?"
+      )
+      .run(connectorInstanceId);
+    assert.equal((await projectedCoverage()).axis, "unknown");
+  });
+});
+
+for (const [field, value] of Object.entries({
+  durable_admission: false,
+  detail_complete: false,
+  stream_evidence_consistent: false,
+  outstanding_debt: 1,
+  checkpoint_eligible: false,
+})) {
+  test(`runtime ${field} contradiction prevents both owner projections claiming complete`, async () => {
+    await withLocalConnection(async () => {
+      await seedTerminalCoverage("collected", false, 2, { [field]: value });
+      const result = await projectedCoverage();
+      assert.notEqual(result.axis, "complete");
+      assert.notEqual(result.conditions.messages, "complete");
+      const detail = await getConnectorSummaryForRoute(connectorInstanceId);
+      assert.ok(detail && "connection_health" in detail);
+      assert.notEqual(detail.connection_health.axes.coverage, "complete");
+    });
+  });
+}
diff --git a/reference-implementation/test/local-device-terminal-run-commit-operation.test.ts b/reference-implementation/test/local-device-terminal-run-commit-operation.test.ts
index ac749c328..8aa6c8602 100644
--- a/reference-implementation/test/local-device-terminal-run-commit-operation.test.ts
+++ b/reference-implementation/test/local-device-terminal-run-commit-operation.test.ts
@@ -6,7 +6,11 @@ import { createHash } from "node:crypto";
 import test from "node:test";
 import { canonicalTerminalRunCommitJson } from "@pdpp/reference-contract/common";
 import { canonicalTerminalRunCommitEnvelope, hashCanonicalJson } from "@pdpp/collector-runtime/local-device-envelope";
-import { handleLocalDeviceTerminalRunCommit, normalizeTerminalCoverageFacts } from "../operations/local-device-terminal-collection.ts";
+import {
+  handleLocalDeviceTerminalRunCommit,
+  normalizeTerminalCoverageFacts,
+} from "../operations/local-device-terminal-collection.ts";
+import { fingerprintDeviceAttemptManifest } from "../server/device-ingest-attempt-context.ts";
 import { canonicalConnectorKey } from "../server/connector-key.ts";
 import { deriveStreamCoverageCondition } from "../server/connector-coverage-policy.ts";
 import { closeDb, getDb, initDb } from "../server/db.ts";
@@ -57,18 +61,25 @@ test("version 2 terminal coverage validates named stores against the manifest",
   let committed: ResolvedTerminalRunCommit | null = null;
   const sentBody = validBody({
     state_delta: {},
-    terminal_facts: [{
-      stream: "messages", scoped: true,
-      stores: [{ store: "messages", status: "collected" }, { store: "history", status: "partial" }],
-    }],
+    terminal_facts: [
+      {
+        stream: "messages",
+        scoped: true,
+        stores: [
+          { store: "messages", status: "collected" },
+          { store: "history", status: "partial" },
+        ],
+      },
+    ],
     version: 2,
   });
   await handleLocalDeviceTerminalRunCommit({
     ctx: {
       canonicalConnectorKey: () => "codex",
-      getConnectorManifest: () => Promise.resolve({
-        streams: [{ name: "messages", coverage_stores: ["messages", "history"] }],
-      }),
+      getConnectorManifest: () =>
+        Promise.resolve({
+          streams: [{ name: "messages", coverage_stores: ["messages", "history"] }],
+        }),
       commitTerminalRun: (input) => {
         committed = input;
         return Promise.resolve({
@@ -83,8 +94,12 @@ test("version 2 terminal coverage validates named stores against the manifest",
         });
       },
       emitSpineEvent: () => Promise.resolve(),
-      handleError: (_res, error) => { throw error; },
-      pdppError: (_res, status) => { capture.response.status(status); },
+      handleError: (_res, error) => {
+        throw error;
+      },
+      pdppError: (_res, status) => {
+        capture.response.status(status);
+      },
     },
     req: {
       body: sentBody,
@@ -92,25 +107,44 @@ test("version 2 terminal coverage validates named stores against the manifest",
       params: { deviceId: "dev-1", sourceInstanceId: "src-1" },
     },
     res: capture.response,
-    resolveAuthorizedSource: () => Promise.resolve({
-      connectorInstance: { connectorInstanceId: "cin-1" },
-      sourceInstance: { connectorId: "codex" },
-    }),
+    resolveAuthorizedSource: () =>
+      Promise.resolve({
+        connectorInstance: { connectorInstanceId: "cin-1" },
+        sourceInstance: { connectorId: "codex", manifestGeneration: 7 },
+      }),
   });
   assert.equal(capture.snapshot().status, 201);
   assert.ok(committed);
-  assert.deepEqual((committed as ResolvedTerminalRunCommit).normalizedFacts[0]?.coverage_statuses, ["collected", "partial"]);
+  assert.deepEqual((committed as ResolvedTerminalRunCommit).normalizedFacts[0]?.coverage_statuses, [
+    "partial",
+    "unknown",
+  ]);
   assert.equal(
     (committed as ResolvedTerminalRunCommit).envelopeHash,
-    hashCanonicalJson(canonicalTerminalRunCommitEnvelope(sentBody as Parameters<typeof canonicalTerminalRunCommitEnvelope>[0]))
+    hashCanonicalJson(
+      canonicalTerminalRunCommitEnvelope(sentBody as Parameters<typeof canonicalTerminalRunCommitEnvelope>[0])
+    )
   );
 });
 
 test("typed terminal coverage is green only for complete scoped store evidence", () => {
   const manifest = { streams: [{ name: "messages", coverage_stores: ["messages", "history"] }] };
   const fact = (statuses: readonly [string, string], scoped = true) => ({
-    stream: "messages", scoped,
-    stores: [{ store: "messages", status: statuses[0] }, { store: "history", status: statuses[1] }],
+    stream: "messages",
+    scoped,
+    manifest_fingerprint: fingerprintDeviceAttemptManifest(manifest),
+    artifact_digest: `sha256:${"a".repeat(64)}`,
+    runtime_accounting: {
+      durable_admission: true,
+      detail_complete: true,
+      stream_evidence_consistent: true,
+      outstanding_debt: 0,
+      checkpoint_eligible: true,
+    },
+    stores: [
+      { store: "messages", status: statuses[0] },
+      { store: "history", status: statuses[1] },
+    ],
   });
   const axis = (raw: unknown) => {
     const normalized = normalizeTerminalCoverageFacts([raw], manifest, "unscoped");
@@ -126,15 +160,24 @@ test("typed terminal coverage is green only for complete scoped store evidence",
   assert.equal(normalizeTerminalCoverageFacts([], manifest, "unscoped"), null);
   assert.equal(normalizeTerminalCoverageFacts([fact(["collected", "collected"])], { streams: [] }, "unscoped"), null);
   assert.equal(normalizeTerminalCoverageFacts([fact(["collected", "bogus"])], manifest, "unscoped"), null);
-  assert.equal(normalizeTerminalCoverageFacts([{ ...fact(["collected", "collected"]), stores: [{ store: "messages", status: "collected" }] }], manifest, "unscoped"), null);
+  assert.equal(
+    normalizeTerminalCoverageFacts(
+      [{ ...fact(["collected", "collected"]), stores: [{ store: "messages", status: "collected" }] }],
+      manifest,
+      "unscoped"
+    ),
+    null
+  );
   assert.equal(normalizeTerminalCoverageFacts([fact(["collected", "collected"], false)], manifest, "bounded"), null);
 });
 
 test("a selected-stream terminal commit is accepted without proving omitted manifest streams", () => {
-  const manifest = { streams: [
-    { name: "messages", coverage_stores: ["messages"] },
-    { name: "photos", coverage_stores: ["photos"] },
-  ] };
+  const manifest = {
+    streams: [
+      { name: "messages", coverage_stores: ["messages"] },
+      { name: "photos", coverage_stores: ["photos"] },
+    ],
+  };
   const selected = [{ stream: "messages", scoped: true, stores: [{ store: "messages", status: "collected" }] }];
   assert.equal(normalizeTerminalCoverageFacts(selected, manifest, "unscoped"), null);
   assert.equal(normalizeTerminalCoverageFacts(selected, manifest, "unscoped", { allowSubset: true })?.length, 1);
@@ -568,3 +611,178 @@ test("SQLite route operation composes authorization with 201, exact response-los
     closeDb();
   }
 });
+
+test("selected instrumented stream is accepted beside an uninstrumented stream", () => {
+  const manifest = { streams: [{ name: "messages", coverage_stores: ["messages"] }, { name: "photos" }] };
+  const selected = [{ stream: "messages", scoped: true, stores: [{ store: "messages", status: "collected" }] }];
+  assert.equal(normalizeTerminalCoverageFacts(selected, manifest, "unscoped", { allowSubset: true })?.length, 1);
+  assert.equal(normalizeTerminalCoverageFacts(selected, manifest, "unscoped"), null);
+});
+
+test("connector collected assertions cannot override runtime accounting or absent admission", () => {
+  const manifest = { version: "1", streams: [{ name: "messages", coverage_stores: ["messages"] }] };
+  const raw = {
+    stream: "messages",
+    scoped: true,
+    manifest_fingerprint: fingerprintDeviceAttemptManifest(manifest),
+    artifact_digest: `sha256:${"a".repeat(64)}`,
+    stores: [{ store: "messages", status: "collected" }],
+    runtime_accounting: {
+      durable_admission: true,
+      detail_complete: true,
+      stream_evidence_consistent: true,
+      outstanding_debt: 0,
+      checkpoint_eligible: true,
+    },
+  };
+  for (const override of [
+    { durable_admission: false },
+    { detail_complete: false },
+    { stream_evidence_consistent: false },
+    { outstanding_debt: 1 },
+    { checkpoint_eligible: false },
+  ]) {
+    const normalized = normalizeTerminalCoverageFacts(
+      [{ ...raw, runtime_accounting: { ...raw.runtime_accounting, ...override } }],
+      manifest,
+      "unscoped"
+    );
+    assert.ok(normalized);
+    assert.notEqual((normalized[0]?.coverage_statuses as string[] | undefined)?.[0], "collected");
+    assert.deepEqual(normalized[0]?.stores, raw.stores, "retain the connector assertion");
+  }
+  assert.notEqual(
+    (
+      normalizeTerminalCoverageFacts([{ ...raw, runtime_accounting: undefined }], manifest, "unscoped")?.[0]
+        ?.coverage_statuses as string[] | undefined
+    )?.[0],
+    "collected"
+  );
+  assert.notEqual(
+    (
+      normalizeTerminalCoverageFacts([raw], { ...manifest, version: "2" }, "unscoped")?.[0]?.coverage_statuses as
+        | string[]
+        | undefined
+    )?.[0],
+    "collected"
+  );
+});
+
+test("proven empty content is complete while metadata inventory stays inventory only", () => {
+  for (const coveragePolicy of ["collect", "inventory_only"]) {
+    const manifest = {
+      streams: [{ name: "messages", coverage_policy: coveragePolicy, coverage_stores: ["messages"] }],
+    };
+    const raw = {
+      stream: "messages",
+      scoped: true,
+      manifest_fingerprint: fingerprintDeviceAttemptManifest(manifest),
+      artifact_digest: `sha256:${"a".repeat(64)}`,
+      runtime_accounting: {
+        durable_admission: true,
+        detail_complete: true,
+        stream_evidence_consistent: true,
+        outstanding_debt: 0,
+        checkpoint_eligible: true,
+      },
+      stores: [{ store: "messages", status: "collected" }],
+    };
+    const normalized = normalizeTerminalCoverageFacts([raw], manifest, "unscoped");
+    assert.ok(normalized);
+    assert.equal(normalized[0]?.collected, 0, "no records admitted for proven empty enumeration");
+    assert.deepEqual(normalized[0]?.coverage_statuses, [coveragePolicy === "collect" ? "collected" : "inventory_only"]);
+  }
+});
+
+for (const eligible of [false, true]) {
+  test(`checkpoint eligibility ${eligible} governs state advancement with accounted debt`, async () => {
+    const capture = responseCapture();
+    let committed = false;
+    await handleLocalDeviceTerminalRunCommit({
+      ctx: {
+        canonicalConnectorKey: () => "codex",
+        getConnectorManifest: () => ({ streams: [{ name: "messages", coverage_stores: ["messages"] }] }),
+        commitTerminalRun: (input) => {
+          committed = true;
+          return Promise.resolve({
+            replayed: false,
+            response: {
+              commit_id: input.commitId,
+              envelope_hash: input.envelopeHash,
+              object: "device_terminal_run_commit",
+              run_id: input.runId,
+              terminal_event_id: "evt",
+            },
+          });
+        },
+        emitSpineEvent: () => Promise.resolve(),
+        handleError: (_res, error) => {
+          throw error;
+        },
+        pdppError: (_res, status) => {
+          capture.response.status(status);
+        },
+      },
+      req: {
+        body: validBody({
+          version: 2,
+          state_delta: { messages: { cursor: "new" } },
+          terminal_facts: [
+            {
+              stream: "messages",
+              scoped: true,
+              stores: [{ store: "messages", status: "partial" }],
+              runtime_accounting: {
+                durable_admission: true,
+                detail_complete: false,
+                stream_evidence_consistent: true,
+                outstanding_debt: 1,
+                checkpoint_eligible: eligible,
+              },
+            },
+          ],
+        }),
+        deviceExporter: { deviceId: "dev-1" },
+        params: { deviceId: "dev-1", sourceInstanceId: "src-1" },
+      },
+      res: capture.response,
+      resolveAuthorizedSource: () =>
+        Promise.resolve({
+          connectorInstance: { connectorInstanceId: "cin-1" },
+          sourceInstance: { connectorId: "codex" },
+        }),
+    });
+    assert.equal(capture.snapshot().status, eligible ? 201 : 400);
+    assert.equal(committed, eligible);
+  });
+}
+
+test("v2 envelope identity binds accounting and executed release provenance", () => {
+  const fact = {
+    stream: "messages",
+    scoped: true,
+    manifest_fingerprint: "manifest-a",
+    artifact_digest: `sha256:${"a".repeat(64)}`,
+    runtime_accounting: {
+      durable_admission: true,
+      detail_complete: true,
+      stream_evidence_consistent: true,
+      outstanding_debt: 0,
+      checkpoint_eligible: true,
+    },
+    stores: [{ store: "messages", status: "collected" }],
+  };
+  const hash = (value: Record<string, unknown>) =>
+    hashCanonicalJson(
+      canonicalTerminalRunCommitEnvelope(
+        validBody({ version: 2, terminal_facts: [value] }) as Parameters<typeof canonicalTerminalRunCommitEnvelope>[0]
+      )
+    );
+  const original = hash(fact);
+  assert.notEqual(hash({ ...fact, manifest_fingerprint: "manifest-b" }), original);
+  assert.notEqual(hash({ ...fact, artifact_digest: `sha256:${"b".repeat(64)}` }), original);
+  assert.notEqual(
+    hash({ ...fact, runtime_accounting: { ...fact.runtime_accounting, durable_admission: false } }),
+    original
+  );
+});

From d7b6e89af6ebd50d08245854f41ccfa9730902c6 Mon Sep 17 00:00:00 2001
From: Tim Nunamaker <tnunamak@gmail.com>
Date: Wed, 21 Oct 2026 22:04:16 -0500
Subject: [PATCH 05/87] chore(connector-protocol): refresh artifact metadata

Assisted-by: AI
Signed-off-by: Tim Nunamaker <tnunamak@gmail.com>
---
 packages/connector-protocol/artifact.json | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/packages/connector-protocol/artifact.json b/packages/connector-protocol/artifact.json
index 92a06e266..310fbca53 100644
--- a/packages/connector-protocol/artifact.json
+++ b/packages/connector-protocol/artifact.json
@@ -1,11 +1,11 @@
 {
   "artifact_filename": "pdpp-connector-protocol-0.0.1.tgz",
-  "artifact_sha1": "63f497d89b063bb22c694185817526b00f927b74",
-  "artifact_sha256": "b29c4a0f1bdf2ce7ae07110df78c90f56067bafaaf2385da33ad62d8fed40829",
-  "artifact_sha512": "858a9d025aec14a3d40ed1c1953bd87f79725e5b5854eb961b60694b8cc9da3c9aa509c4209d1a8900414df0ce5be44510969c8275186776ce6ccae838ab3aea",
-  "declarations_sha256": "c1b33258618f33b0ead81133464f276ae75a675038ed780c43ffba2acedd92b5",
+  "artifact_sha1": "b7d0234ebb099add97691f89756ca3e7e58febc7",
+  "artifact_sha256": "5d098bb216f0233527165d847bb073d5beee44370bc59a5e86a0c89fc054d34a",
+  "artifact_sha512": "d66e6412dc1f40924d1460aa34720c1acc783bba24d50ba7b76b2496ef039f98b8a611bf97535f3121a9e5b283b909b28c5cd1a3434df1445fb091414c9b0b2c",
+  "declarations_sha256": "8f1bf78ec644d002bfc8b1ce2399ccb660ea10bb3ee53c49a7995e1bb0e17dcb",
   "metadata_version": 1,
   "package_name": "@pdpp/connector-protocol",
   "package_version": "0.0.1",
-  "source_inputs_sha256": "0ca5613c76bd5df7a37e391ca1e7524a12f9c025d5a9a7a191cbaad0bd1724fb"
+  "source_inputs_sha256": "935e99c7e3307d7e48d748b3ca83b7427f1b91c89e7397de2a3842f08f2393fd"
 }

From dced79b967c157fd6b6d02c72b17b886319aa32a Mon Sep 17 00:00:00 2001
From: Tim Nunamaker <tnunamak@gmail.com>
Date: Wed, 21 Oct 2026 22:04:21 -0500
Subject: [PATCH 06/87] chore(collector-runtime): refresh artifact metadata

Assisted-by: AI
Signed-off-by: Tim Nunamaker <tnunamak@gmail.com>
---
 packages/collector-runtime/artifact.json | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/packages/collector-runtime/artifact.json b/packages/collector-runtime/artifact.json
index 2c2c7d850..83242c3fe 100644
--- a/packages/collector-runtime/artifact.json
+++ b/packages/collector-runtime/artifact.json
@@ -1,13 +1,13 @@
 {
   "artifact_filename": "pdpp-collector-runtime-0.0.1.tgz",
-  "artifact_sha1": "6cde2e54f5df78b7794040133a33580b9c2fcbf8",
-  "artifact_sha256": "3beca7ecf61502dec3f59ccd37fcb87a7e4483ff8c09a74cb095f987c0f10ed2",
-  "artifact_sha512": "b2059544ed99784afb14abb68922eacc1f0ed32f7c0c7be4789d4bf2bbe227e4b10749370a87e8bf510a2f7233e32f1a0f9d7e68d362538656ee3b36e0cbdf64",
-  "connector_protocol_declarations_sha256": "c1b33258618f33b0ead81133464f276ae75a675038ed780c43ffba2acedd92b5",
-  "connector_protocol_source_inputs_sha256": "0ca5613c76bd5df7a37e391ca1e7524a12f9c025d5a9a7a191cbaad0bd1724fb",
-  "declarations_sha256": "d3596337c48b6260a145e0ff88ec754e3282a7e2bf6c3849c65cf3fa0da4ef04",
+  "artifact_sha1": "209f8edd4d95265235624ea2eb12e3098824fde0",
+  "artifact_sha256": "b0abc2fd0d835cee1dc510e79c9265e04f16933f5ab9d02b9a21e0462d00326d",
+  "artifact_sha512": "59e9c77e4d60d96f9392b104e664446bb557ffc169b437da9559f2be0f65a7a06b00109a87ccfc5a69f20ad9c56a764dc62195877cfc99847db982999fe49288",
+  "connector_protocol_declarations_sha256": "8f1bf78ec644d002bfc8b1ce2399ccb660ea10bb3ee53c49a7995e1bb0e17dcb",
+  "connector_protocol_source_inputs_sha256": "935e99c7e3307d7e48d748b3ca83b7427f1b91c89e7397de2a3842f08f2393fd",
+  "declarations_sha256": "bfcbc962b3683dae9ba77b463adea1ecc6cec1df2c18e6d76d37b4a2407ac534",
   "metadata_version": 1,
   "package_name": "@pdpp/collector-runtime",
   "package_version": "0.0.1",
-  "source_inputs_sha256": "13e6ae12d7b99f69327a3a03f513a2f2505de930c35bcfae22346bc5de0381d4"
+  "source_inputs_sha256": "ecc9d0c6cd8ab00c013ca7a0b2e10d2f25f0592ca26e634d8582398de0da665b"
 }

From d282784b43f88560fcf068ca62f7f1ebb8d62163 Mon Sep 17 00:00:00 2001
From: Tim Nunamaker <tnunamak@gmail.com>
Date: Wed, 21 Oct 2026 22:13:40 -0500
Subject: [PATCH 07/87] style(coverage): align touched code with Biome

Assisted-by: AI
Signed-off-by: Tim Nunamaker <tnunamak@gmail.com>
---
 .../src/collector-runner.test.ts              |   4 +-
 .../collector-runtime/src/collector-runner.ts |   6 +-
 .../local-device-terminal-collection.ts       |  20 +--
 .../server/ref-control.ts                     |   3 +-
 ...evice-terminal-coverage-projection.test.ts |  24 ++--
 ...vice-terminal-run-commit-operation.test.ts | 114 +++++++++---------
 6 files changed, 86 insertions(+), 85 deletions(-)

diff --git a/packages/collector-runtime/src/collector-runner.test.ts b/packages/collector-runtime/src/collector-runner.test.ts
index 270f9f348..228fe8196 100644
--- a/packages/collector-runtime/src/collector-runner.test.ts
+++ b/packages/collector-runtime/src/collector-runner.test.ts
@@ -398,9 +398,9 @@ for (const effectType of ["DETAIL_GAP", "DETAIL_COVERAGE"] as const) {
           baseUrl: harness.url,
           connector: {
             args: [fixture],
+            artifactDigest: `sha256:${"b".repeat(64)}`,
             command: "node",
             connector_id: "fixture-detail-no-admission",
-            artifactDigest: `sha256:${"b".repeat(64)}`,
             manifestFingerprint: "a".repeat(64),
             protocol_capabilities: [],
             runCoverageVersion: 1,
@@ -439,9 +439,9 @@ test("runCollectorConnector refuses a collected assertion with mismatched emitte
         baseUrl: harness.url,
         connector: {
           args: [fixture],
+          artifactDigest: `sha256:${"b".repeat(64)}`,
           command: "node",
           connector_id: "fixture-count-mismatch",
-          artifactDigest: `sha256:${"b".repeat(64)}`,
           manifestFingerprint: "a".repeat(64),
           protocol_capabilities: [],
           runCoverageVersion: 1,
diff --git a/packages/collector-runtime/src/collector-runner.ts b/packages/collector-runtime/src/collector-runner.ts
index 3d4495e6f..b0f67226e 100644
--- a/packages/collector-runtime/src/collector-runner.ts
+++ b/packages/collector-runtime/src/collector-runner.ts
@@ -1070,15 +1070,15 @@ export async function runCollectorConnector(config: CollectorRunConfig): Promise
               artifact_digest: config.connector.artifactDigest as string,
               manifest_fingerprint: config.connector.manifestFingerprint as string,
               runtime_accounting: {
+                checkpoint_eligible: true,
+                detail_complete: true,
                 durable_admission:
                   recordDrain.failed === 0 &&
                   afterRecordsSummary.ready === 0 &&
                   afterRecordsSummary.leased === 0 &&
                   afterRecordsSummary.deadLetter === 0,
-                detail_complete: true,
-                stream_evidence_consistent: true,
                 outstanding_debt: 0,
-                checkpoint_eligible: true,
+                stream_evidence_consistent: true,
               },
               scoped: stream.scoped,
               stores: stream.stores,
diff --git a/reference-implementation/operations/local-device-terminal-collection.ts b/reference-implementation/operations/local-device-terminal-collection.ts
index 4608e5089..6bca0445f 100644
--- a/reference-implementation/operations/local-device-terminal-collection.ts
+++ b/reference-implementation/operations/local-device-terminal-collection.ts
@@ -2,8 +2,8 @@
 // SPDX-License-Identifier: Apache-2.0
 
 import { createHash } from "node:crypto";
-import { canonicalTerminalRunCommitJson } from "@pdpp/reference-contract/common";
 import { canonicalTerminalRunCommitEnvelope } from "@pdpp/collector-runtime/local-device-envelope";
+import { canonicalTerminalRunCommitJson } from "@pdpp/reference-contract/common";
 import { fingerprintDeviceAttemptManifest } from "../server/device-ingest-attempt-context.ts";
 import { readRuntimeCollectionFact } from "../server/runtime-collection-facts.ts";
 import type { ResolvedTerminalRunCommit, TerminalRunCommitResult } from "../server/stores/terminal-run-commit-store.ts";
@@ -172,10 +172,10 @@ export async function handleLocalDeviceTerminalRunCommit(input: {
       deviceId,
       envelopeHash,
       normalizedFacts: validatedFacts,
-      version,
       runId,
       sourceInstanceId,
       stateDelta,
+      version,
     });
     res.status(result.replayed ? 200 : 201).json(result.response);
   } catch (error) {
@@ -423,7 +423,7 @@ export function normalizeTerminalCoverageFacts(
         return null;
       }
       seenStores.add(name);
-      stores.push({ store: name, status });
+      stores.push({ status, store: name });
     }
     // Keep assertions separate from the verdict derived from host accounting.
     // Missing provenance remains unknown; a known contradiction is partial.
@@ -459,12 +459,12 @@ export function normalizeTerminalCoverageFacts(
     });
     const pendingDetailGaps = accountingKnown ? Number(accounting.outstanding_debt) : 0;
     facts.push({
+      artifact_digest: entry.artifact_digest,
       checkpoint: accountingKnown && accounting.checkpoint_eligible === true ? "committed" : "withheld",
       collected: 0,
       considered: null,
       covered: null,
       manifest_fingerprint: entry.manifest_fingerprint,
-      artifact_digest: entry.artifact_digest,
       ...(Number.isSafeInteger(options.bindingGeneration)
         ? {
             binding_generation: options.validateBindingGeneration
@@ -494,11 +494,11 @@ function readCoverageStatuses(value: unknown): readonly string[] | null {
 }
 
 interface TerminalRuntimeAccounting {
-  durable_admission: boolean;
+  checkpoint_eligible: boolean;
   detail_complete: boolean;
-  stream_evidence_consistent: boolean;
+  durable_admission: boolean;
   outstanding_debt: number;
-  checkpoint_eligible: boolean;
+  stream_evidence_consistent: boolean;
 }
 
 function readTerminalRuntimeAccounting(value: unknown): TerminalRuntimeAccounting | null {
@@ -516,10 +516,10 @@ function readTerminalRuntimeAccounting(value: unknown): TerminalRuntimeAccountin
     return null;
   }
   return {
-    durable_admission: accounting.durable_admission,
+    checkpoint_eligible: accounting.checkpoint_eligible,
     detail_complete: accounting.detail_complete,
-    stream_evidence_consistent: accounting.stream_evidence_consistent,
+    durable_admission: accounting.durable_admission,
     outstanding_debt: accounting.outstanding_debt,
-    checkpoint_eligible: accounting.checkpoint_eligible,
+    stream_evidence_consistent: accounting.stream_evidence_consistent,
   };
 }
diff --git a/reference-implementation/server/ref-control.ts b/reference-implementation/server/ref-control.ts
index f4ba7bb58..e3dc16767 100644
--- a/reference-implementation/server/ref-control.ts
+++ b/reference-implementation/server/ref-control.ts
@@ -5020,7 +5020,8 @@ function deriveLocalTerminalCoverageAxis(
     }
     let storeIndex = 0;
     for (const assertion of rawFact.stores as readonly { store: string; status: string }[]) {
-      const status = (rawFact.coverage_statuses as string[])[storeIndex++] ?? "unknown";
+      const status = (rawFact.coverage_statuses as string[])[storeIndex] ?? "unknown";
+      storeIndex += 1;
       const rawStore = { ...assertion, status };
       rows.push({ collection_scope: terminal.collectionScope, status: rawStore.status, store: rawStore.store, stream });
       if (rawStore.status !== "collected") {
diff --git a/reference-implementation/test/local-device-terminal-coverage-projection.test.ts b/reference-implementation/test/local-device-terminal-coverage-projection.test.ts
index 46dbf7bed..61d7c5bce 100644
--- a/reference-implementation/test/local-device-terminal-coverage-projection.test.ts
+++ b/reference-implementation/test/local-device-terminal-coverage-projection.test.ts
@@ -6,9 +6,9 @@ import { mkdtempSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import test from "node:test";
-import { fingerprintDeviceAttemptManifest } from "../server/device-ingest-attempt-context.ts";
 import { reconcileDirtyConnectorSummaryEvidence } from "../server/connector-summary-read-model.ts";
 import { closeDb, getDb, initDb } from "../server/db.ts";
+import { fingerprintDeviceAttemptManifest } from "../server/device-ingest-attempt-context.ts";
 import { buildStoredCollectionScope, COLLECTION_SCOPE_STATE_KEY } from "../server/local-collection-scope.ts";
 import { getConnectorSummaryForRoute, listConnectorSummaries } from "../server/ref-control.ts";
 import { createSqliteConnectorInstanceStore } from "../server/stores/connector-instance-store.ts";
@@ -120,15 +120,15 @@ async function seedTerminalCoverage(
       .manifest
   );
   const bindings = {
+    artifact_digest: `sha256:${"a".repeat(64)}`,
     binding_generation: 0,
     manifest_fingerprint: fingerprintDeviceAttemptManifest(manifest),
-    artifact_digest: `sha256:${"a".repeat(64)}`,
     runtime_accounting: {
-      durable_admission: true,
+      checkpoint_eligible: true,
       detail_complete: true,
-      stream_evidence_consistent: true,
+      durable_admission: true,
       outstanding_debt: 0,
-      checkpoint_eligible: true,
+      stream_evidence_consistent: true,
       ...accountingOverrides,
     },
   };
@@ -145,12 +145,12 @@ async function seedTerminalCoverage(
         checkpoint: "committed",
         collected: 0,
         considered: null,
-        covered: null,
         coverage_statuses: ["collected"],
+        covered: null,
         pending_detail_gaps: 0,
         scoped: true,
         skipped: null,
-        stores: [{ store: malformed ? "unknown_store" : "projects", status: "collected" }],
+        stores: [{ status: "collected", store: malformed ? "unknown_store" : "projects" }],
         stream: "sessions",
       },
       {
@@ -158,12 +158,12 @@ async function seedTerminalCoverage(
         checkpoint: "committed",
         collected: 0,
         considered: null,
-        covered: null,
         coverage_statuses: [status],
+        covered: null,
         pending_detail_gaps: status === "collected" ? 0 : 1,
         scoped: true,
         skipped: null,
-        stores: [{ store: "derived_messages", status }],
+        stores: [{ status, store: "derived_messages" }],
         stream: "messages",
       },
     ],
@@ -298,11 +298,11 @@ test("persisted terminal coverage cannot cross a source binding generation", asy
 });
 
 for (const [field, value] of Object.entries({
-  durable_admission: false,
+  checkpoint_eligible: false,
   detail_complete: false,
-  stream_evidence_consistent: false,
+  durable_admission: false,
   outstanding_debt: 1,
-  checkpoint_eligible: false,
+  stream_evidence_consistent: false,
 })) {
   test(`runtime ${field} contradiction prevents both owner projections claiming complete`, async () => {
     await withLocalConnection(async () => {
diff --git a/reference-implementation/test/local-device-terminal-run-commit-operation.test.ts b/reference-implementation/test/local-device-terminal-run-commit-operation.test.ts
index 8aa6c8602..c8bf1aeea 100644
--- a/reference-implementation/test/local-device-terminal-run-commit-operation.test.ts
+++ b/reference-implementation/test/local-device-terminal-run-commit-operation.test.ts
@@ -4,16 +4,16 @@
 import assert from "node:assert/strict";
 import { createHash } from "node:crypto";
 import test from "node:test";
-import { canonicalTerminalRunCommitJson } from "@pdpp/reference-contract/common";
 import { canonicalTerminalRunCommitEnvelope, hashCanonicalJson } from "@pdpp/collector-runtime/local-device-envelope";
+import { canonicalTerminalRunCommitJson } from "@pdpp/reference-contract/common";
 import {
   handleLocalDeviceTerminalRunCommit,
   normalizeTerminalCoverageFacts,
 } from "../operations/local-device-terminal-collection.ts";
-import { fingerprintDeviceAttemptManifest } from "../server/device-ingest-attempt-context.ts";
-import { canonicalConnectorKey } from "../server/connector-key.ts";
 import { deriveStreamCoverageCondition } from "../server/connector-coverage-policy.ts";
+import { canonicalConnectorKey } from "../server/connector-key.ts";
 import { closeDb, getDb, initDb } from "../server/db.ts";
+import { fingerprintDeviceAttemptManifest } from "../server/device-ingest-attempt-context.ts";
 import { readRuntimeCollectionFact } from "../server/runtime-collection-facts.ts";
 import {
   commitTerminalRun as commitTerminalRunToStore,
@@ -63,12 +63,12 @@ test("version 2 terminal coverage validates named stores against the manifest",
     state_delta: {},
     terminal_facts: [
       {
-        stream: "messages",
         scoped: true,
         stores: [
-          { store: "messages", status: "collected" },
-          { store: "history", status: "partial" },
+          { status: "collected", store: "messages" },
+          { status: "partial", store: "history" },
         ],
+        stream: "messages",
       },
     ],
     version: 2,
@@ -76,10 +76,6 @@ test("version 2 terminal coverage validates named stores against the manifest",
   await handleLocalDeviceTerminalRunCommit({
     ctx: {
       canonicalConnectorKey: () => "codex",
-      getConnectorManifest: () =>
-        Promise.resolve({
-          streams: [{ name: "messages", coverage_stores: ["messages", "history"] }],
-        }),
       commitTerminalRun: (input) => {
         committed = input;
         return Promise.resolve({
@@ -94,6 +90,10 @@ test("version 2 terminal coverage validates named stores against the manifest",
         });
       },
       emitSpineEvent: () => Promise.resolve(),
+      getConnectorManifest: () =>
+        Promise.resolve({
+          streams: [{ coverage_stores: ["messages", "history"], name: "messages" }],
+        }),
       handleError: (_res, error) => {
         throw error;
       },
@@ -128,23 +128,23 @@ test("version 2 terminal coverage validates named stores against the manifest",
 });
 
 test("typed terminal coverage is green only for complete scoped store evidence", () => {
-  const manifest = { streams: [{ name: "messages", coverage_stores: ["messages", "history"] }] };
+  const manifest = { streams: [{ coverage_stores: ["messages", "history"], name: "messages" }] };
   const fact = (statuses: readonly [string, string], scoped = true) => ({
-    stream: "messages",
-    scoped,
-    manifest_fingerprint: fingerprintDeviceAttemptManifest(manifest),
     artifact_digest: `sha256:${"a".repeat(64)}`,
+    manifest_fingerprint: fingerprintDeviceAttemptManifest(manifest),
     runtime_accounting: {
-      durable_admission: true,
+      checkpoint_eligible: true,
       detail_complete: true,
-      stream_evidence_consistent: true,
+      durable_admission: true,
       outstanding_debt: 0,
-      checkpoint_eligible: true,
+      stream_evidence_consistent: true,
     },
+    scoped,
     stores: [
-      { store: "messages", status: statuses[0] },
-      { store: "history", status: statuses[1] },
+      { status: statuses[0], store: "messages" },
+      { status: statuses[1], store: "history" },
     ],
+    stream: "messages",
   });
   const axis = (raw: unknown) => {
     const normalized = normalizeTerminalCoverageFacts([raw], manifest, "unscoped");
@@ -162,7 +162,7 @@ test("typed terminal coverage is green only for complete scoped store evidence",
   assert.equal(normalizeTerminalCoverageFacts([fact(["collected", "bogus"])], manifest, "unscoped"), null);
   assert.equal(
     normalizeTerminalCoverageFacts(
-      [{ ...fact(["collected", "collected"]), stores: [{ store: "messages", status: "collected" }] }],
+      [{ ...fact(["collected", "collected"]), stores: [{ status: "collected", store: "messages" }] }],
       manifest,
       "unscoped"
     ),
@@ -174,11 +174,11 @@ test("typed terminal coverage is green only for complete scoped store evidence",
 test("a selected-stream terminal commit is accepted without proving omitted manifest streams", () => {
   const manifest = {
     streams: [
-      { name: "messages", coverage_stores: ["messages"] },
-      { name: "photos", coverage_stores: ["photos"] },
+      { coverage_stores: ["messages"], name: "messages" },
+      { coverage_stores: ["photos"], name: "photos" },
     ],
   };
-  const selected = [{ stream: "messages", scoped: true, stores: [{ store: "messages", status: "collected" }] }];
+  const selected = [{ scoped: true, stores: [{ status: "collected", store: "messages" }], stream: "messages" }];
   assert.equal(normalizeTerminalCoverageFacts(selected, manifest, "unscoped"), null);
   assert.equal(normalizeTerminalCoverageFacts(selected, manifest, "unscoped", { allowSubset: true })?.length, 1);
 });
@@ -613,27 +613,27 @@ test("SQLite route operation composes authorization with 201, exact response-los
 });
 
 test("selected instrumented stream is accepted beside an uninstrumented stream", () => {
-  const manifest = { streams: [{ name: "messages", coverage_stores: ["messages"] }, { name: "photos" }] };
-  const selected = [{ stream: "messages", scoped: true, stores: [{ store: "messages", status: "collected" }] }];
+  const manifest = { streams: [{ coverage_stores: ["messages"], name: "messages" }, { name: "photos" }] };
+  const selected = [{ scoped: true, stores: [{ status: "collected", store: "messages" }], stream: "messages" }];
   assert.equal(normalizeTerminalCoverageFacts(selected, manifest, "unscoped", { allowSubset: true })?.length, 1);
   assert.equal(normalizeTerminalCoverageFacts(selected, manifest, "unscoped"), null);
 });
 
 test("connector collected assertions cannot override runtime accounting or absent admission", () => {
-  const manifest = { version: "1", streams: [{ name: "messages", coverage_stores: ["messages"] }] };
+  const manifest = { streams: [{ coverage_stores: ["messages"], name: "messages" }], version: "1" };
   const raw = {
-    stream: "messages",
-    scoped: true,
-    manifest_fingerprint: fingerprintDeviceAttemptManifest(manifest),
     artifact_digest: `sha256:${"a".repeat(64)}`,
-    stores: [{ store: "messages", status: "collected" }],
+    manifest_fingerprint: fingerprintDeviceAttemptManifest(manifest),
     runtime_accounting: {
-      durable_admission: true,
+      checkpoint_eligible: true,
       detail_complete: true,
-      stream_evidence_consistent: true,
+      durable_admission: true,
       outstanding_debt: 0,
-      checkpoint_eligible: true,
+      stream_evidence_consistent: true,
     },
+    scoped: true,
+    stores: [{ status: "collected", store: "messages" }],
+    stream: "messages",
   };
   for (const override of [
     { durable_admission: false },
@@ -671,21 +671,21 @@ test("connector collected assertions cannot override runtime accounting or absen
 test("proven empty content is complete while metadata inventory stays inventory only", () => {
   for (const coveragePolicy of ["collect", "inventory_only"]) {
     const manifest = {
-      streams: [{ name: "messages", coverage_policy: coveragePolicy, coverage_stores: ["messages"] }],
+      streams: [{ coverage_policy: coveragePolicy, coverage_stores: ["messages"], name: "messages" }],
     };
     const raw = {
-      stream: "messages",
-      scoped: true,
-      manifest_fingerprint: fingerprintDeviceAttemptManifest(manifest),
       artifact_digest: `sha256:${"a".repeat(64)}`,
+      manifest_fingerprint: fingerprintDeviceAttemptManifest(manifest),
       runtime_accounting: {
-        durable_admission: true,
+        checkpoint_eligible: true,
         detail_complete: true,
-        stream_evidence_consistent: true,
+        durable_admission: true,
         outstanding_debt: 0,
-        checkpoint_eligible: true,
+        stream_evidence_consistent: true,
       },
-      stores: [{ store: "messages", status: "collected" }],
+      scoped: true,
+      stores: [{ status: "collected", store: "messages" }],
+      stream: "messages",
     };
     const normalized = normalizeTerminalCoverageFacts([raw], manifest, "unscoped");
     assert.ok(normalized);
@@ -701,7 +701,6 @@ for (const eligible of [false, true]) {
     await handleLocalDeviceTerminalRunCommit({
       ctx: {
         canonicalConnectorKey: () => "codex",
-        getConnectorManifest: () => ({ streams: [{ name: "messages", coverage_stores: ["messages"] }] }),
         commitTerminalRun: (input) => {
           committed = true;
           return Promise.resolve({
@@ -716,6 +715,7 @@ for (const eligible of [false, true]) {
           });
         },
         emitSpineEvent: () => Promise.resolve(),
+        getConnectorManifest: () => ({ streams: [{ coverage_stores: ["messages"], name: "messages" }] }),
         handleError: (_res, error) => {
           throw error;
         },
@@ -725,22 +725,22 @@ for (const eligible of [false, true]) {
       },
       req: {
         body: validBody({
-          version: 2,
           state_delta: { messages: { cursor: "new" } },
           terminal_facts: [
             {
-              stream: "messages",
-              scoped: true,
-              stores: [{ store: "messages", status: "partial" }],
               runtime_accounting: {
-                durable_admission: true,
+                checkpoint_eligible: eligible,
                 detail_complete: false,
-                stream_evidence_consistent: true,
+                durable_admission: true,
                 outstanding_debt: 1,
-                checkpoint_eligible: eligible,
+                stream_evidence_consistent: true,
               },
+              scoped: true,
+              stores: [{ status: "partial", store: "messages" }],
+              stream: "messages",
             },
           ],
+          version: 2,
         }),
         deviceExporter: { deviceId: "dev-1" },
         params: { deviceId: "dev-1", sourceInstanceId: "src-1" },
@@ -759,23 +759,23 @@ for (const eligible of [false, true]) {
 
 test("v2 envelope identity binds accounting and executed release provenance", () => {
   const fact = {
-    stream: "messages",
-    scoped: true,
-    manifest_fingerprint: "manifest-a",
     artifact_digest: `sha256:${"a".repeat(64)}`,
+    manifest_fingerprint: "manifest-a",
     runtime_accounting: {
-      durable_admission: true,
+      checkpoint_eligible: true,
       detail_complete: true,
-      stream_evidence_consistent: true,
+      durable_admission: true,
       outstanding_debt: 0,
-      checkpoint_eligible: true,
+      stream_evidence_consistent: true,
     },
-    stores: [{ store: "messages", status: "collected" }],
+    scoped: true,
+    stores: [{ status: "collected", store: "messages" }],
+    stream: "messages",
   };
   const hash = (value: Record<string, unknown>) =>
     hashCanonicalJson(
       canonicalTerminalRunCommitEnvelope(
-        validBody({ version: 2, terminal_facts: [value] }) as Parameters<typeof canonicalTerminalRunCommitEnvelope>[0]
+        validBody({ terminal_facts: [value], version: 2 }) as Parameters<typeof canonicalTerminalRunCommitEnvelope>[0]
       )
     );
   const original = hash(fact);

From a3846e84ef711ece3db28a1623218dfa777e3c75 Mon Sep 17 00:00:00 2001
From: Tim Nunamaker <tnunamak@gmail.com>
Date: Wed, 21 Oct 2026 22:13:46 -0500
Subject: [PATCH 08/87] chore(collector-runtime): refresh artifact metadata

Assisted-by: AI
Signed-off-by: Tim Nunamaker <tnunamak@gmail.com>
---
 packages/collector-runtime/artifact.json | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/packages/collector-runtime/artifact.json b/packages/collector-runtime/artifact.json
index 83242c3fe..2682ecc29 100644
--- a/packages/collector-runtime/artifact.json
+++ b/packages/collector-runtime/artifact.json
@@ -1,13 +1,13 @@
 {
   "artifact_filename": "pdpp-collector-runtime-0.0.1.tgz",
-  "artifact_sha1": "209f8edd4d95265235624ea2eb12e3098824fde0",
-  "artifact_sha256": "b0abc2fd0d835cee1dc510e79c9265e04f16933f5ab9d02b9a21e0462d00326d",
-  "artifact_sha512": "59e9c77e4d60d96f9392b104e664446bb557ffc169b437da9559f2be0f65a7a06b00109a87ccfc5a69f20ad9c56a764dc62195877cfc99847db982999fe49288",
+  "artifact_sha1": "ca91c2c7dd483bb8fed0c813ecfd5b71c9678446",
+  "artifact_sha256": "4b97780fd7f68b865ba7d64a1138eb57117c0cd16e2a0fc07d2fdcfc2250fed5",
+  "artifact_sha512": "20951549d248c762ff95ce53a39d7a8694d86f1a0aae7e7d31cd0721455931f144faf2ccccf535ded164ef769618d539d5bff7db7a2b3cec64ef6c6f2620f4db",
   "connector_protocol_declarations_sha256": "8f1bf78ec644d002bfc8b1ce2399ccb660ea10bb3ee53c49a7995e1bb0e17dcb",
   "connector_protocol_source_inputs_sha256": "935e99c7e3307d7e48d748b3ca83b7427f1b91c89e7397de2a3842f08f2393fd",
   "declarations_sha256": "bfcbc962b3683dae9ba77b463adea1ecc6cec1df2c18e6d76d37b4a2407ac534",
   "metadata_version": 1,
   "package_name": "@pdpp/collector-runtime",
   "package_version": "0.0.1",
-  "source_inputs_sha256": "ecc9d0c6cd8ab00c013ca7a0b2e10d2f25f0592ca26e634d8582398de0da665b"
+  "source_inputs_sha256": "b76ee37b04bf3c4c27c1298ae58fcaeb6410de43b73a0ae4904cf96144df84c3"
 }

From 449d8f02c77b9ef6dd8d2bc1cd2793fd5a4f817d Mon Sep 17 00:00:00 2001
From: Tim Nunamaker <tnunamak@gmail.com>
Date: Wed, 21 Oct 2026 22:31:03 -0500
Subject: [PATCH 09/87] fix(local-device): bind terminal coverage to the server
 pin

Assisted-by: AI
Signed-off-by: Tim Nunamaker <tnunamak@gmail.com>
---
 .../local-device-terminal-collection.ts       |  34 ++++-
 .../runtime/connection-health.ts              |  19 +++
 reference-implementation/server/index.ts      |   3 +-
 .../server/local-collector-profiles.ts        |  19 ++-
 .../server/ref-control.ts                     |  40 +++++-
 .../server/routes/ref-device-exporters.ts     |   1 +
 .../test/local-collector-profiles.test.ts     |   6 +-
 ...evice-terminal-coverage-projection.test.ts |  61 ++++++--
 ...vice-terminal-run-commit-operation.test.ts | 131 +++++++++++++++++-
 9 files changed, 290 insertions(+), 24 deletions(-)

diff --git a/reference-implementation/operations/local-device-terminal-collection.ts b/reference-implementation/operations/local-device-terminal-collection.ts
index 6bca0445f..1261bdf7a 100644
--- a/reference-implementation/operations/local-device-terminal-collection.ts
+++ b/reference-implementation/operations/local-device-terminal-collection.ts
@@ -37,6 +37,7 @@ export interface TerminalRunCommitContext extends TerminalContext {
   canonicalConnectorKey: (value: string | null | undefined) => string | null;
   commitTerminalRun: (input: ResolvedTerminalRunCommit) => Promise<TerminalRunCommitResult>;
   getConnectorManifest?: (connectorId: string) => Promise<unknown> | unknown;
+  getExpectedArtifactDigest?: (connectorId: string) => string | null;
 }
 
 /**
@@ -113,7 +114,11 @@ export async function handleLocalDeviceTerminalRunCommit(input: {
             rawFacts,
             await ctx.getConnectorManifest?.(canonicalConnectorId),
             collectionBoundary,
-            { allowSubset: true, bindingGeneration: authorized.sourceInstance.manifestGeneration ?? null }
+            {
+              allowSubset: true,
+              bindingGeneration: authorized.sourceInstance.manifestGeneration ?? null,
+              expectedArtifactDigest: ctx.getExpectedArtifactDigest?.(canonicalConnectorId) ?? null,
+            }
           )
         : normalizedFacts;
     if (!validatedFacts) {
@@ -348,7 +353,13 @@ export function normalizeTerminalCoverageFacts(
   rawFacts: readonly unknown[],
   rawManifest: unknown,
   collectionBoundary: string,
-  options: { allowSubset?: boolean; bindingGeneration?: number | null; validateBindingGeneration?: boolean } = {}
+  options: {
+    allowSubset?: boolean;
+    bindingGeneration?: number | null;
+    expectedArtifactDigest?: string | null;
+    validateBindingGeneration?: boolean;
+    validateServerArtifactDigest?: boolean;
+  } = {}
 ): readonly Record<string, unknown>[] | null {
   const manifest = asObject(rawManifest);
   const manifestStreams = manifest?.streams;
@@ -433,11 +444,22 @@ export function normalizeTerminalCoverageFacts(
     const generationMatches =
       !options.validateBindingGeneration ||
       (Number.isSafeInteger(options.bindingGeneration) && entry.binding_generation === options.bindingGeneration);
+    let artifactBindingReason: "artifact_digest_mismatch" | "artifact_digest_unknown" | null = null;
+    if (
+      !ARTIFACT_DIGEST.test(options.expectedArtifactDigest ?? "") ||
+      (options.validateServerArtifactDigest && !ARTIFACT_DIGEST.test(String(entry.server_artifact_digest ?? "")))
+    ) {
+      artifactBindingReason = "artifact_digest_unknown";
+    } else if (
+      entry.artifact_digest !== options.expectedArtifactDigest ||
+      (options.validateServerArtifactDigest && entry.server_artifact_digest !== options.expectedArtifactDigest)
+    ) {
+      artifactBindingReason = "artifact_digest_mismatch";
+    }
     const bound =
       generationMatches &&
       entry.manifest_fingerprint === manifestFingerprint &&
-      typeof entry.artifact_digest === "string" &&
-      ARTIFACT_DIGEST.test(entry.artifact_digest);
+      artifactBindingReason === null;
     const complete =
       accountingKnown &&
       accounting.durable_admission === true &&
@@ -460,11 +482,15 @@ export function normalizeTerminalCoverageFacts(
     const pendingDetailGaps = accountingKnown ? Number(accounting.outstanding_debt) : 0;
     facts.push({
       artifact_digest: entry.artifact_digest,
+      ...(artifactBindingReason ? { artifact_binding_reason: artifactBindingReason } : {}),
       checkpoint: accountingKnown && accounting.checkpoint_eligible === true ? "committed" : "withheld",
       collected: 0,
       considered: null,
       covered: null,
       manifest_fingerprint: entry.manifest_fingerprint,
+      server_artifact_digest: options.validateServerArtifactDigest
+        ? entry.server_artifact_digest
+        : (options.expectedArtifactDigest ?? null),
       ...(Number.isSafeInteger(options.bindingGeneration)
         ? {
             binding_generation: options.validateBindingGeneration
diff --git a/reference-implementation/runtime/connection-health.ts b/reference-implementation/runtime/connection-health.ts
index 09560f7eb..0281f2422 100644
--- a/reference-implementation/runtime/connection-health.ts
+++ b/reference-implementation/runtime/connection-health.ts
@@ -137,6 +137,8 @@ export const CONNECTION_CONDITION_REASONS = Object.freeze({
   COLLECTION_SUCCEEDED_LOCAL_DEVICE: "collection_succeeded_local_device",
   COVERAGE_COMPLETE_UNFILLABLE_ACCOUNTED: "coverage_complete_unfillable_accounted",
   COVERAGE_UNKNOWN: "coverage_unknown",
+  COVERAGE_UNKNOWN_ARTIFACT_MISMATCH: "coverage_unknown_artifact_mismatch",
+  COVERAGE_UNKNOWN_ARTIFACT_UNPINNED: "coverage_unknown_artifact_unpinned",
   COVERAGE_UNKNOWN_STALE_COLLECTOR: "coverage_unknown_stale_collector",
   CREDENTIAL_CONTINUITY_NOT_APPLICABLE: "credential_continuity_not_applicable",
   CREDENTIAL_CONTINUITY_PROVEN: "credential_continuity_proven",
@@ -1100,6 +1102,8 @@ export interface ConnectionCoverageEvidence {
    * other cause.
    */
   readonly unknownStaleCollectorBuild?: boolean;
+  /** Why a local terminal receipt cannot be bound to server-known executable bytes. */
+  readonly unknownArtifactBinding?: "artifact_digest_mismatch" | "artifact_digest_unknown" | undefined;
 }
 
 /** Outbox/work rollup from local collector or other durable executor. */
@@ -3083,6 +3087,21 @@ function localExporterAvailableCondition(
 
 function sourceCoverageCondition(input: ComputeConnectionHealthInput, axes: ConnectionAxes): ConnectionHealthCondition {
   if (axes.coverage === "unknown") {
+    if (input.coverage?.unknownArtifactBinding) {
+      const missingPin = input.coverage.unknownArtifactBinding === "artifact_digest_unknown";
+      return condition({
+        message: missingPin
+          ? "The server has no known artifact digest for this local connector, so its collection result is unverified."
+          : "The local collection result names a different artifact than the server's current pin.",
+        origin: "local_device",
+        reason: missingPin
+          ? CONDITION_REASON.COVERAGE_UNKNOWN_ARTIFACT_UNPINNED
+          : CONDITION_REASON.COVERAGE_UNKNOWN_ARTIFACT_MISMATCH,
+        severity: "warning",
+        status: "unknown",
+        type: "SourceCoverageComplete",
+      });
+    }
     if (input.coverage?.unknownStaleCollectorBuild === true) {
       return condition({
         message: "This local collector build predates coverage evidence the server now requires. Update the collector.",
diff --git a/reference-implementation/server/index.ts b/reference-implementation/server/index.ts
index c1fd9d2c5..5815342e5 100644
--- a/reference-implementation/server/index.ts
+++ b/reference-implementation/server/index.ts
@@ -207,7 +207,7 @@ import {
 } from "./deployment-diagnostics.ts";
 import { composeFleetHealthVerdict } from "./fleet-health.ts";
 import { deriveReferenceFreshness } from "./freshness.ts";
-import { readLocalCollectorProfile } from "./local-collector-profiles.ts";
+import { readLocalCollectorArtifactDigest, readLocalCollectorProfile } from "./local-collector-profiles.ts";
 import {
   encodeHostedMcpSelection,
   encodeHostedMcpStreamSelection,
@@ -7064,6 +7064,7 @@ export function buildAsApp(opts: ServerOpts = {}) {
     ensureReferenceConnectorCatalogEntry,
     generateReferenceSecret,
     generateSpineId,
+    getExpectedArtifactDigest: readLocalCollectorArtifactDigest,
     getConnectorManifest: (connectorId: string) => getConnectorManifest(connectorId),
     getDefaultConnectorDetailGapStore,
     getOwnerSubjectId,
diff --git a/reference-implementation/server/local-collector-profiles.ts b/reference-implementation/server/local-collector-profiles.ts
index 7be336c68..6fa750227 100644
--- a/reference-implementation/server/local-collector-profiles.ts
+++ b/reference-implementation/server/local-collector-profiles.ts
@@ -30,6 +30,7 @@ interface LocalCollectorProfilePin {
 }
 
 const CONNECTOR_KEY = /^[a-z0-9][a-z0-9-]*$/;
+const ARTIFACT_DIGEST = /^sha256:[a-f0-9]{64}$/;
 
 /**
  * The pinned profile for a canonical connector key, or `null` when the local
@@ -37,6 +38,20 @@ const CONNECTOR_KEY = /^[a-z0-9][a-z0-9-]*$/;
  * missing or does not hash to its pin.
  */
 export function readLocalCollectorProfile(connectorKey: string): Record<string, unknown> | null {
+  return readPinnedProfile(connectorKey)?.profile ?? null;
+}
+
+/** The server's current OCI artifact identity for a local-device connector. */
+export function readLocalCollectorArtifactDigest(connectorKey: string): string | null {
+  try {
+    return readPinnedProfile(connectorKey)?.digest ?? null;
+  } catch {
+    // A missing or invalid pin cannot establish executable identity.
+    return null;
+  }
+}
+
+function readPinnedProfile(connectorKey: string): { digest: string; profile: Record<string, unknown> } | null {
   if (!CONNECTOR_KEY.test(connectorKey)) {
     return null;
   }
@@ -47,10 +62,10 @@ export function readLocalCollectorProfile(connectorKey: string): Record<string,
   const pin = JSON.parse(readFileSync(pinUrl, "utf8")) as LocalCollectorProfilePin;
   const bytes = readFileSync(new URL(`./local-collector-profiles/${connectorKey}.json`, import.meta.url));
   const actual = `sha256:${createHash("sha256").update(bytes).digest("hex")}`;
-  if (pin.connector_key !== connectorKey || actual !== pin.profile_sha256) {
+  if (pin.connector_key !== connectorKey || !ARTIFACT_DIGEST.test(pin.digest) || actual !== pin.profile_sha256) {
     throw new Error(
       `local collector profile ${connectorKey}.json hashes to ${actual}, but its pin (${pin.digest}) says ${pin.profile_sha256}`
     );
   }
-  return JSON.parse(bytes.toString("utf8")) as Record<string, unknown>;
+  return { digest: pin.digest, profile: JSON.parse(bytes.toString("utf8")) as Record<string, unknown> };
 }
diff --git a/reference-implementation/server/ref-control.ts b/reference-implementation/server/ref-control.ts
index e3dc16767..52e820792 100644
--- a/reference-implementation/server/ref-control.ts
+++ b/reference-implementation/server/ref-control.ts
@@ -167,6 +167,7 @@ import { filterRunGapsProvenCompleteByReport } from "./continuation-proof.ts";
 import { getSqliteStoreCacheIdentity } from "./db.ts";
 import { deriveReferenceFreshness, type ReferenceFreshness } from "./freshness.ts";
 import { readStoredCollectionScope } from "./local-collection-scope.ts";
+import { readLocalCollectorArtifactDigest } from "./local-collector-profiles.ts";
 import { mapPendingPressureGaps } from "./pending-pressure-gap-map.ts";
 import { isPostgresStorageBackend, postgresQuery } from "./postgres-storage.ts";
 import {
@@ -3178,6 +3179,7 @@ function buildCoverageEvidence(
 ): {
   axis: CoverageAxis;
   requiredButAccepted: boolean;
+  unknownArtifactBinding?: "artifact_digest_mismatch" | "artifact_digest_unknown" | undefined;
   unknownStaleCollectorBuild: boolean;
 } {
   const requiredButAccepted = pickRequiredAcceptedCoverage(manifestStreams) !== null;
@@ -3199,7 +3201,13 @@ function buildCoverageEvidence(
   }
   const unknownStaleCollectorBuild =
     runAxis === "unknown" && localCoverage !== null && localCoverage.unreliableReason === "missing_stores";
-  return { axis: runAxis, requiredButAccepted, unknownStaleCollectorBuild };
+  const unknownArtifactBinding =
+    runAxis === "unknown" &&
+    (localCoverage?.unreliableReason === "artifact_digest_mismatch" ||
+      localCoverage?.unreliableReason === "artifact_digest_unknown")
+      ? localCoverage.unreliableReason
+      : undefined;
+  return { axis: runAxis, requiredButAccepted, unknownArtifactBinding, unknownStaleCollectorBuild };
 }
 
 const DEGRADING_REPORT_COVERAGE_ROLLUP_ORDER = ["terminal_gap", "retryable_gap", "gaps", "partial"] as const;
@@ -3529,6 +3537,7 @@ function applyCoverageOverride(
     axis: CoverageAxis;
     requiredButAccepted: boolean;
     unfillableAccounted?: boolean;
+    unknownArtifactBinding?: "artifact_digest_mismatch" | "artifact_digest_unknown" | undefined;
     unknownStaleCollectorBuild: boolean;
   },
   coverageOverride:
@@ -3543,6 +3552,7 @@ function applyCoverageOverride(
   axis: CoverageAxis;
   requiredButAccepted: boolean;
   unfillableAccounted?: boolean;
+  unknownArtifactBinding?: "artifact_digest_mismatch" | "artifact_digest_unknown" | undefined;
   unknownStaleCollectorBuild: boolean;
 } {
   if (!coverageOverride || coverageOverride.axis === undefined) {
@@ -3558,6 +3568,8 @@ function applyCoverageOverride(
     // PRE-override axis/report pairing. Absent/`false` on the override always
     // means `false` here.
     unfillableAccounted: coverageOverride.unfillableAccounted === true,
+    unknownArtifactBinding:
+      coverageOverride.axis === "unknown" ? undefined : resolvedCoverage.unknownArtifactBinding,
     // A collection-report override supplies its OWN, more specific axis
     // (`refineConnectionHealthWithCollectionReport`'s required-unknown
     // refusal) — it never re-derives `localCoverage.unreliableReason`, so it
@@ -4780,6 +4792,8 @@ interface LocalCoverageDiagnosticAxis {
    * Never widens what counts as reliable -- purely a label on the same gate.
    */
   readonly unreliableReason?:
+    | "artifact_digest_mismatch"
+    | "artifact_digest_unknown"
     | "invalid_cursor"
     | "generation_mismatch"
     | "malformed"
@@ -4983,7 +4997,8 @@ function deriveLocalTerminalCoverageAxis(
   run: ConnectorRunSummary | null,
   manifest: ConnectorManifest,
   legacyAxis: LocalCoverageDiagnosticAxis | null,
-  bindingGeneration: number | null
+  bindingGeneration: number | null,
+  expectedArtifactDigest: string | null
 ): LocalCoverageDiagnosticAxis | null {
   const terminal = run?.local_terminal_coverage;
   if (!terminal) {
@@ -5006,10 +5021,21 @@ function deriveLocalTerminalCoverageAxis(
     terminal.collectionScope !== declaredScope || !Array.isArray(terminal.streams)) {
     return unknown;
   }
-  const normalized = normalizeTerminalCoverageFacts(terminal.streams, manifest, terminal.collectionScope, { allowSubset: true, bindingGeneration, validateBindingGeneration: true });
+  const normalized = normalizeTerminalCoverageFacts(terminal.streams, manifest, terminal.collectionScope, {
+    allowSubset: true,
+    bindingGeneration,
+    expectedArtifactDigest,
+    validateBindingGeneration: true,
+    validateServerArtifactDigest: true,
+  });
   if (!normalized) {
     return unknown;
   }
+  const artifactBindingReason = normalized.find((fact) => typeof fact.artifact_binding_reason === "string")
+    ?.artifact_binding_reason;
+  if (artifactBindingReason === "artifact_digest_unknown" || artifactBindingReason === "artifact_digest_mismatch") {
+    return { ...unknown, unreliableReason: artifactBindingReason };
+  }
   const rows: LocalCoverageDiagnosticRow[] = [];
   const unaccountedStores: string[] = [];
   let axis: CoverageAxis = normalized.length === manifest.streams?.length ? "complete" : "unknown";
@@ -7067,7 +7093,13 @@ function synthesizeConnectorSummary(input: ConnectorSummarySynthesisInput): Conn
   const fallbackSettledRun = latestSettledRun ?? fallbackLatestSettledRun(lastRun, lastSuccessfulRun);
   const authoritativeLatestSettledRun = isOwnScopedRun(fallbackSettledRun) ? fallbackSettledRun : null;
   const effectiveLocalCoverage = localDeviceBacked
-    ? (deriveLocalTerminalCoverageAxis(fallbackSettledRun, manifest, localCoverage, evidence?.manifest_generation ?? null) ?? localCoverage)
+    ? (deriveLocalTerminalCoverageAxis(
+        fallbackSettledRun,
+        manifest,
+        localCoverage,
+        evidence?.manifest_generation ?? null,
+        readLocalCollectorArtifactDigest(connectorId)
+      ) ?? localCoverage)
     : localCoverage;
   const authoritativeLatestStreamFacts = localDeviceBacked ? null : latestStreamFacts;
   const terminalSetupDisposition =
diff --git a/reference-implementation/server/routes/ref-device-exporters.ts b/reference-implementation/server/routes/ref-device-exporters.ts
index 48e837193..fea9f00ab 100644
--- a/reference-implementation/server/routes/ref-device-exporters.ts
+++ b/reference-implementation/server/routes/ref-device-exporters.ts
@@ -530,6 +530,7 @@ export interface MountRefDeviceExportersContext {
   // connector. Used to derive the enrolled source kind from the manifest
   // bindings. Async to match the host's `getConnectorManifest`.
   getConnectorManifest: (connectorId: string) => Promise<SourceKindManifestLike | null> | SourceKindManifestLike | null;
+  getExpectedArtifactDigest?: (connectorId: string) => string | null;
   getDefaultConnectorDetailGapStore: () => ConnectorDetailGapStore;
   getOwnerSubjectId: (req: unknown) => string;
   getSemanticCapabilityIdentity: () => string;
diff --git a/reference-implementation/test/local-collector-profiles.test.ts b/reference-implementation/test/local-collector-profiles.test.ts
index 538ab7d21..9109cac08 100644
--- a/reference-implementation/test/local-collector-profiles.test.ts
+++ b/reference-implementation/test/local-collector-profiles.test.ts
@@ -3,13 +3,16 @@
 
 import assert from "node:assert/strict";
 import test from "node:test";
-import { readLocalCollectorProfile } from "../server/local-collector-profiles.ts";
+import { readLocalCollectorArtifactDigest, readLocalCollectorProfile } from "../server/local-collector-profiles.ts";
+
+const ARTIFACT_DIGEST = /^sha256:[a-f0-9]{64}$/;
 
 test("a pinned local-collector connector resolves to its pinned Collection Profile", () => {
   const profile = readLocalCollectorProfile("claude-code");
   assert.ok(profile);
   assert.equal(profile.connector_key, "claude-code");
   assert.ok(Array.isArray(profile.streams) && profile.streams.length > 0);
+  assert.match(readLocalCollectorArtifactDigest("claude-code") ?? "", ARTIFACT_DIGEST);
 });
 
 test("a connector the local collector does not install has no local-collector profile", () => {
@@ -17,6 +20,7 @@ test("a connector the local collector does not install has no local-collector pr
   // Collection Profile, so the collector cannot run it.
   assert.equal(readLocalCollectorProfile("google-messages"), null);
   assert.equal(readLocalCollectorProfile("gmail"), null);
+  assert.equal(readLocalCollectorArtifactDigest("gmail"), null);
 });
 
 test("a key that is not a connector key never reaches the filesystem", () => {
diff --git a/reference-implementation/test/local-device-terminal-coverage-projection.test.ts b/reference-implementation/test/local-device-terminal-coverage-projection.test.ts
index 61d7c5bce..28532c8d4 100644
--- a/reference-implementation/test/local-device-terminal-coverage-projection.test.ts
+++ b/reference-implementation/test/local-device-terminal-coverage-projection.test.ts
@@ -10,6 +10,7 @@ import { reconcileDirtyConnectorSummaryEvidence } from "../server/connector-summ
 import { closeDb, getDb, initDb } from "../server/db.ts";
 import { fingerprintDeviceAttemptManifest } from "../server/device-ingest-attempt-context.ts";
 import { buildStoredCollectionScope, COLLECTION_SCOPE_STATE_KEY } from "../server/local-collection-scope.ts";
+import { readLocalCollectorArtifactDigest } from "../server/local-collector-profiles.ts";
 import { getConnectorSummaryForRoute, listConnectorSummaries } from "../server/ref-control.ts";
 import { createSqliteConnectorInstanceStore } from "../server/stores/connector-instance-store.ts";
 import { getDefaultDeviceExporterStore } from "../server/stores/device-exporter-store.ts";
@@ -21,7 +22,7 @@ const deviceId = "dev_terminal_coverage";
 const sourceInstanceId = "src_terminal_coverage";
 const ownerSubjectId = "owner_local";
 
-async function withLocalConnection(run: () => Promise<void>): Promise<void> {
+async function withLocalConnection(run: () => Promise<void>, sourceConnectorId = connectorId): Promise<void> {
   const directory = mkdtempSync(join(tmpdir(), "pdpp-terminal-coverage-projection-"));
   initDb(join(directory, "pdpp.sqlite"));
   try {
@@ -29,10 +30,10 @@ async function withLocalConnection(run: () => Promise<void>): Promise<void> {
     getDb()
       .prepare("INSERT INTO connectors(connector_id, manifest, created_at) VALUES (?, ?, ?)")
       .run(
-        connectorId,
+        sourceConnectorId,
         JSON.stringify({
           capabilities: { public_listing: { tier: "supported" } },
-          connector_id: connectorId,
+          connector_id: sourceConnectorId,
           display_name: "Terminal Coverage Fixture",
           protocol_version: "0.1.0",
           streams: [
@@ -54,7 +55,7 @@ async function withLocalConnection(run: () => Promise<void>): Promise<void> {
         now
       );
     await createSqliteConnectorInstanceStore().upsert({
-      connectorId,
+      connectorId: sourceConnectorId,
       connectorInstanceId,
       createdAt: now,
       displayName: "laptop",
@@ -75,7 +76,7 @@ async function withLocalConnection(run: () => Promise<void>): Promise<void> {
       updatedAt: now,
     });
     await store.upsertSourceInstance({
-      connectorId,
+      connectorId: sourceConnectorId,
       connectorInstanceId,
       createdAt: now,
       deviceId,
@@ -106,6 +107,8 @@ async function projectedCoverage() {
   return {
     axis: summary.connection_health.axes.coverage,
     conditions: Object.fromEntries(summary.collection_report.map((entry) => [entry.stream, entry.coverage_condition])),
+    reason: summary.connection_health.conditions.find((condition) => condition.type === "SourceCoverageComplete")
+      ?.reason,
   };
 }
 
@@ -113,14 +116,19 @@ async function seedTerminalCoverage(
   status: "collected" | "partial" | "failed",
   malformed = false,
   version: 1 | 2 = 2,
-  accountingOverrides: Record<string, unknown> = {}
+  accountingOverrides: Record<string, unknown> = {},
+  artifactDigest = readLocalCollectorArtifactDigest(connectorId),
+  sourceConnectorId = connectorId
 ): Promise<void> {
   const manifest = JSON.parse(
-    (getDb().prepare("SELECT manifest FROM connectors WHERE connector_id = ?").get(connectorId) as { manifest: string })
-      .manifest
+    (
+      getDb().prepare("SELECT manifest FROM connectors WHERE connector_id = ?").get(sourceConnectorId) as {
+        manifest: string;
+      }
+    ).manifest
   );
   const bindings = {
-    artifact_digest: `sha256:${"a".repeat(64)}`,
+    artifact_digest: artifactDigest,
     binding_generation: 0,
     manifest_fingerprint: fingerprintDeviceAttemptManifest(manifest),
     runtime_accounting: {
@@ -131,11 +139,12 @@ async function seedTerminalCoverage(
       stream_evidence_consistent: true,
       ...accountingOverrides,
     },
+    server_artifact_digest: readLocalCollectorArtifactDigest(sourceConnectorId),
   };
   await commitTerminalRun({
     collectionBoundary: "unscoped",
     commitId: "commit_terminal_coverage",
-    connectorId,
+    connectorId: sourceConnectorId,
     connectorInstanceId,
     deviceId,
     envelopeHash: "test-envelope-hash",
@@ -188,6 +197,38 @@ test("local-device v2 terminal coverage projects per-stream proof; absent proof
   });
 });
 
+test("unchanged manifest with a different artifact digest projects unknown on list and detail", async () => {
+  await withLocalConnection(async () => {
+    await seedTerminalCoverage("collected", false, 2, {}, `sha256:${"b".repeat(64)}`);
+    const list = await projectedCoverage();
+    assert.equal(list.axis, "unknown");
+    assert.equal(list.reason, "coverage_unknown_artifact_mismatch");
+    const detail = await getConnectorSummaryForRoute(connectorInstanceId);
+    assert.ok(detail && "connection_health" in detail);
+    assert.equal(detail.connection_health.axes.coverage, "unknown");
+    assert.equal(
+      detail.connection_health.conditions.find((condition) => condition.type === "SourceCoverageComplete")?.reason,
+      "coverage_unknown_artifact_mismatch"
+    );
+  });
+});
+
+test("a local source without a server pin projects unknown with an explicit reason", async () => {
+  await withLocalConnection(async () => {
+    await seedTerminalCoverage("collected", false, 2, {}, `sha256:${"b".repeat(64)}`, "gmail");
+    const list = await projectedCoverage();
+    assert.equal(list.axis, "unknown");
+    assert.equal(list.reason, "coverage_unknown_artifact_unpinned");
+    const detail = await getConnectorSummaryForRoute(connectorInstanceId);
+    assert.ok(detail && "connection_health" in detail);
+    assert.equal(detail.connection_health.axes.coverage, "unknown");
+    assert.equal(
+      detail.connection_health.conditions.find((condition) => condition.type === "SourceCoverageComplete")?.reason,
+      "coverage_unknown_artifact_unpinned"
+    );
+  }, "gmail");
+});
+
 for (const status of ["partial", "failed"] as const) {
   test(`local-device v2 ${status} verdict never projects covered`, async () => {
     await withLocalConnection(async () => {
diff --git a/reference-implementation/test/local-device-terminal-run-commit-operation.test.ts b/reference-implementation/test/local-device-terminal-run-commit-operation.test.ts
index c8bf1aeea..f25993a1f 100644
--- a/reference-implementation/test/local-device-terminal-run-commit-operation.test.ts
+++ b/reference-implementation/test/local-device-terminal-run-commit-operation.test.ts
@@ -147,7 +147,9 @@ test("typed terminal coverage is green only for complete scoped store evidence",
     stream: "messages",
   });
   const axis = (raw: unknown) => {
-    const normalized = normalizeTerminalCoverageFacts([raw], manifest, "unscoped");
+    const normalized = normalizeTerminalCoverageFacts([raw], manifest, "unscoped", {
+      expectedArtifactDigest: `sha256:${"a".repeat(64)}`,
+    });
     assert.ok(normalized);
     const parsed = readRuntimeCollectionFact(normalized[0]);
     assert.ok(parsed);
@@ -668,6 +670,129 @@ test("connector collected assertions cannot override runtime accounting or absen
   );
 });
 
+test("terminal collection requires the server's active artifact digest even when the manifest is unchanged", () => {
+  const manifest = { streams: [{ coverage_stores: ["messages"], name: "messages" }] };
+  const knownDigest = `sha256:${"a".repeat(64)}`;
+  const raw = {
+    artifact_digest: knownDigest,
+    manifest_fingerprint: fingerprintDeviceAttemptManifest(manifest),
+    runtime_accounting: {
+      checkpoint_eligible: true,
+      detail_complete: true,
+      durable_admission: true,
+      outstanding_debt: 0,
+      stream_evidence_consistent: true,
+    },
+    scoped: true,
+    stores: [{ status: "collected", store: "messages" }],
+    stream: "messages",
+  };
+  const normalize = (fact: typeof raw, expectedArtifactDigest: string | null) => {
+    const normalized = normalizeTerminalCoverageFacts([fact], manifest, "unscoped", { expectedArtifactDigest });
+    assert.ok(normalized);
+    return normalized[0];
+  };
+  assert.deepEqual(normalize(raw, knownDigest)?.coverage_statuses, ["collected"]);
+  const mismatched = normalize({ ...raw, artifact_digest: `sha256:${"b".repeat(64)}` }, knownDigest);
+  assert.deepEqual(mismatched?.coverage_statuses, ["unknown"]);
+  assert.equal(mismatched?.artifact_binding_reason, "artifact_digest_mismatch");
+  const unpinned = normalize(raw, null);
+  assert.deepEqual(unpinned?.coverage_statuses, ["unknown"]);
+  assert.equal(unpinned?.artifact_binding_reason, "artifact_digest_unknown");
+  assert.equal(unpinned?.server_artifact_digest, null);
+  const afterLaterPin = normalizeTerminalCoverageFacts([unpinned], manifest, "unscoped", {
+    expectedArtifactDigest: knownDigest,
+    validateServerArtifactDigest: true,
+  });
+  assert.deepEqual(afterLaterPin?.[0]?.coverage_statuses, ["unknown"], "a later pin cannot green an unbound run");
+  const matchingAtCommit = normalize(raw, knownDigest);
+  const matchingAtRead = normalizeTerminalCoverageFacts([matchingAtCommit], manifest, "unscoped", {
+    expectedArtifactDigest: knownDigest,
+    validateServerArtifactDigest: true,
+  });
+  assert.deepEqual(matchingAtRead?.[0]?.coverage_statuses, ["collected"]);
+  const afterReplacement = normalizeTerminalCoverageFacts([matchingAtCommit], manifest, "unscoped", {
+    expectedArtifactDigest: `sha256:${"b".repeat(64)}`,
+    validateServerArtifactDigest: true,
+  });
+  assert.deepEqual(afterReplacement?.[0]?.coverage_statuses, ["unknown"]);
+});
+
+test("terminal commit records the server pin at admission and refuses an unbound positive verdict", async () => {
+  const manifest = { streams: [{ coverage_stores: ["messages"], name: "messages" }] };
+  const knownDigest = `sha256:${"a".repeat(64)}`;
+  await Promise.all(
+    [knownDigest, `sha256:${"b".repeat(64)}`, null].map(async (expectedDigest) => {
+      const capture = responseCapture();
+      let committed: ResolvedTerminalRunCommit | null = null;
+      await handleLocalDeviceTerminalRunCommit({
+        ctx: {
+          canonicalConnectorKey: () => "codex",
+          commitTerminalRun: (input) => {
+            committed = input;
+            return Promise.resolve({
+              replayed: false,
+              response: {
+                commit_id: input.commitId,
+                envelope_hash: input.envelopeHash,
+                object: "device_terminal_run_commit",
+                run_id: input.runId,
+                terminal_event_id: "evt-v2",
+              },
+            });
+          },
+          emitSpineEvent: () => Promise.resolve(),
+          getConnectorManifest: () => manifest,
+          getExpectedArtifactDigest: () => expectedDigest,
+          handleError: (_res, error) => {
+            throw error;
+          },
+          pdppError: (_res, status) => {
+            capture.response.status(status);
+          },
+        },
+        req: {
+          body: validBody({
+            state_delta: {},
+            terminal_facts: [
+              {
+                artifact_digest: knownDigest,
+                manifest_fingerprint: fingerprintDeviceAttemptManifest(manifest),
+                runtime_accounting: {
+                  checkpoint_eligible: true,
+                  detail_complete: true,
+                  durable_admission: true,
+                  outstanding_debt: 0,
+                  stream_evidence_consistent: true,
+                },
+                scoped: true,
+                stores: [{ status: "collected", store: "messages" }],
+                stream: "messages",
+              },
+            ],
+            version: 2,
+          }),
+          deviceExporter: { deviceId: "dev-1" },
+          params: { deviceId: "dev-1", sourceInstanceId: "src-1" },
+        },
+        res: capture.response,
+        resolveAuthorizedSource: () =>
+          Promise.resolve({
+            connectorInstance: { connectorInstanceId: "cin-1" },
+            sourceInstance: { connectorId: "codex", manifestGeneration: 7 },
+          }),
+      });
+      assert.equal(capture.snapshot().status, 201);
+      assert.ok(committed);
+      const { normalizedFacts } = committed as ResolvedTerminalRunCommit;
+      assert.equal(normalizedFacts[0]?.server_artifact_digest, expectedDigest);
+      assert.deepEqual(normalizedFacts[0]?.coverage_statuses, [
+        expectedDigest === knownDigest ? "collected" : "unknown",
+      ]);
+    })
+  );
+});
+
 test("proven empty content is complete while metadata inventory stays inventory only", () => {
   for (const coveragePolicy of ["collect", "inventory_only"]) {
     const manifest = {
@@ -687,7 +812,9 @@ test("proven empty content is complete while metadata inventory stays inventory
       stores: [{ status: "collected", store: "messages" }],
       stream: "messages",
     };
-    const normalized = normalizeTerminalCoverageFacts([raw], manifest, "unscoped");
+    const normalized = normalizeTerminalCoverageFacts([raw], manifest, "unscoped", {
+      expectedArtifactDigest: `sha256:${"a".repeat(64)}`,
+    });
     assert.ok(normalized);
     assert.equal(normalized[0]?.collected, 0, "no records admitted for proven empty enumeration");
     assert.deepEqual(normalized[0]?.coverage_statuses, [coveragePolicy === "collect" ? "collected" : "inventory_only"]);

From 2194b9db37cfae2bae7142f5b4b54517a8b25885 Mon Sep 17 00:00:00 2001
From: Tim Nunamaker <tnunamak@gmail.com>
Date: Wed, 21 Oct 2026 22:41:41 -0500
Subject: [PATCH 10/87] test(local-device): make restart receipt match admitted
 batch

The response-loss fixture must report accepted and rejected counts for the actual batch under strict receipt validation.

Assisted-by: AI
Signed-off-by: Tim Nunamaker <tnunamak@gmail.com>
---
 .../test/terminal-run-commit-collector-restart.test.ts     | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/reference-implementation/test/terminal-run-commit-collector-restart.test.ts b/reference-implementation/test/terminal-run-commit-collector-restart.test.ts
index 12efa74b1..cd45b3652 100644
--- a/reference-implementation/test/terminal-run-commit-collector-restart.test.ts
+++ b/reference-implementation/test/terminal-run-commit-collector-restart.test.ts
@@ -153,7 +153,12 @@ async function startHarness(backend: Backend) {
     }
     if (url.includes("/ingest-batches")) {
       ingestCount += Array.isArray(body?.records) ? body.records.length : 0;
-      send(201, { accepted_record_count: 1, object: "device_ingest_batch_result", status: "accepted" });
+      send(201, {
+        accepted_record_count: Array.isArray(body?.records) ? body.records.length : 0,
+        object: "device_ingest_batch_result",
+        rejected_record_count: 0,
+        status: "accepted",
+      });
       return;
     }
     if (url.endsWith("/terminal-run-commits")) {

From aead40fa5f12c19c25755af4904079a14237cd5e Mon Sep 17 00:00:00 2001
From: Tim Nunamaker <tnunamak@gmail.com>
Date: Wed, 21 Oct 2026 23:41:25 -0500
Subject: [PATCH 11/87] fix(coverage): derive terminal verdict from runtime
 evidence

Validate accepted ingest receipts before acknowledging batches, retain skips and stream evidence for coverage accounting, and bind terminal claims to the installed release. Successful negotiated omission now retires prior proof.

Assisted-by: AI
Signed-off-by: Tim Nunamaker <tnunamak@gmail.com>
---
 .../src/collector-runner.test.ts              | 745 +++++++++++++++++-
 .../collector-runtime/src/collector-runner.ts | 161 +++-
 .../src/local-device-client.ts                |  16 +-
 .../local-device-terminal-collection.ts       |  68 +-
 reference-implementation/server/index.ts      |  10 +-
 .../server/local-collector-profiles.ts        |  16 +
 .../server/routes/ref-device-exporters.ts     |   5 +
 .../test/local-collector-profiles.test.ts     |  11 +-
 ...evice-terminal-coverage-projection.test.ts |  52 +-
 ...vice-terminal-run-commit-operation.test.ts | 468 +++++++++++
 10 files changed, 1493 insertions(+), 59 deletions(-)

diff --git a/packages/collector-runtime/src/collector-runner.test.ts b/packages/collector-runtime/src/collector-runner.test.ts
index 228fe8196..1fae3e7d6 100644
--- a/packages/collector-runtime/src/collector-runner.test.ts
+++ b/packages/collector-runtime/src/collector-runner.test.ts
@@ -51,6 +51,54 @@ import {
  */
 const TEST_EXECUTION_ROOT = join(import.meta.dirname, "..");
 
+async function assertCoverageFixtureRejected(input: {
+  coverage: unknown;
+  expectedError?: RegExp;
+  requestedStreams?: readonly string[];
+  scope?: CollectorConnectorSpec["scope"];
+}): Promise<void> {
+  const harness = await startCollectorHarness({ priorState: {} });
+  try {
+    const fixture = await writeFixtureConnector({
+      script: `
+        await new Promise((resolve) => {
+          let input = "";
+          process.stdin.on("data", (chunk) => { input += chunk; if (input.includes("\\n")) resolve(); });
+        });
+        process.stdout.write(JSON.stringify({ type: "DONE", status: "succeeded", records_emitted: 0,
+          coverage: ${JSON.stringify(input.coverage)} }) + "\\n");
+      `,
+    });
+    const requestedStreams = input.requestedStreams ?? ["messages"];
+    await assert.rejects(
+      runCollectorConnector({
+        baseUrl: harness.url,
+        connector: {
+          args: [fixture],
+          artifactDigest: `sha256:${"b".repeat(64)}`,
+          command: "node",
+          connector_id: "fixture-invalid-done-coverage",
+          manifestFingerprint: "a".repeat(64),
+          protocol_capabilities: [],
+          runCoverageVersion: 1,
+          runtime_requirements: { bindings: {} },
+          ...(input.scope ? { scope: input.scope, timeScopableStreams: requestedStreams } : {}),
+          streams: requestedStreams,
+        },
+        deviceId: "device-1",
+        deviceToken: "device-token",
+        executionRoot: TEST_EXECUTION_ROOT,
+        queuePath: await tempQueuePath(),
+        sourceInstanceId: "src-invalid-done-coverage",
+      }),
+      input.expectedError ?? /DONE coverage/
+    );
+    assert.equal(harness.terminalCommits.length, 0, "invalid assertions must not reach terminal persistence");
+  } finally {
+    await harness.close();
+  }
+}
+
 test("buildCollectorStartMessage emits a stream-only START with no owner credentials", () => {
   const start = buildCollectorStartMessage(["sessions", "messages"]);
   assert.deepEqual(start, {
@@ -381,6 +429,545 @@ test("runCollectorConnector commits a typed DONE coverage verdict without a diag
   }
 });
 
+test("runCollectorConnector lets SKIP_RESULT defeat a collected DONE assertion", async () => {
+  const harness = await startCollectorHarness({ priorState: {} });
+  try {
+    const fixture = await writeFixtureConnector({
+      script: `
+        await new Promise((resolve) => {
+          let input = "";
+          process.stdin.on("data", (chunk) => { input += chunk; if (input.includes("\\n")) resolve(); });
+        });
+        process.stdout.write(JSON.stringify({ type: "SKIP_RESULT", stream: "messages", reason: "not_served",
+          message: "the source omitted one required item", boundary_claim: "provider_history_boundary" }) + "\\n");
+        process.stdout.write(JSON.stringify({ type: "STATE", stream: "messages", cursor: "after-skip" }) + "\\n");
+        process.stdout.write(JSON.stringify({ type: "DONE", status: "succeeded", records_emitted: 0,
+          coverage: { version: 1, collection_scope: "unscoped", streams: [{ stream: "messages", scoped: true,
+            stores: [{ store: "messages", status: "collected" }] }] } }) + "\\n");
+      `,
+    });
+    await runCollectorConnector({
+      baseUrl: harness.url,
+      connector: {
+        args: [fixture],
+        artifactDigest: `sha256:${"b".repeat(64)}`,
+        command: "node",
+        connector_id: "fixture-skip-overrides-coverage",
+        manifestFingerprint: "a".repeat(64),
+        protocol_capabilities: [],
+        runCoverageVersion: 1,
+        runtime_requirements: { bindings: {} },
+        streams: ["messages"],
+      },
+      deviceId: "device-1",
+      deviceToken: "device-token",
+      executionRoot: TEST_EXECUTION_ROOT,
+      queuePath: await tempQueuePath(),
+      sourceInstanceId: "src-skip-overrides-coverage",
+    });
+    const fact = (harness.terminalCommits[0]?.terminal_facts as Record<string, unknown>[] | undefined)?.[0];
+    assert.ok(fact, "successful run must leave an inspectable terminal verdict");
+    assert.deepEqual(fact.stores, [{ status: "partial", store: "messages" }]);
+    const accounting = fact.runtime_accounting as Record<string, unknown>;
+    assert.equal(accounting.detail_complete, false);
+    assert.equal(
+      accounting.checkpoint_eligible,
+      true,
+      "a coverage downgrade alone does not make an eligible checkpoint ineligible"
+    );
+    assert.ok(Number(accounting.outstanding_debt) > 0);
+    assert.deepEqual(harness.terminalCommits[0]?.state_delta, { messages: "after-skip" });
+  } finally {
+    await harness.close();
+  }
+});
+
+test("runCollectorConnector keeps a resolved rejected ingest receipt unacknowledged", async () => {
+  const queuePath = await tempQueuePath();
+  const sourceInstanceId = "src-rejected-receipt";
+  const batchId = `${sourceInstanceId}:batch-1`;
+  const records = transformRecordsToCollectorEnvelopes({
+    batchId,
+    batchSeq: 1,
+    connectorId: "fixture-rejected-receipt",
+    deviceId: "device-1",
+    messages: [
+      {
+        data: { id: "m-1" },
+        emitted_at: "2026-10-21T12:00:00.000Z",
+        key: "m-1",
+        stream: "messages",
+        type: "RECORD",
+      },
+    ],
+    sourceInstanceId,
+  });
+  const outbox = new LocalDeviceOutbox({ path: queuePath });
+  try {
+    outbox.enqueue({
+      id: buildLocalDeviceOutboxId({ kind: "record_batch", parts: [batchId], sourceInstanceId }),
+      kind: "record_batch",
+      payload: {
+        batchId,
+        batchSeq: 1,
+        connectorId: "fixture-rejected-receipt",
+        deviceId: "device-1",
+        records,
+        sourceInstanceId,
+      },
+      sourceInstanceId,
+    });
+    const client = {
+      ackLocalCollectorGap: async () => ({ ok: true }),
+      ingestBatch: async () => ({
+        accepted_record_count: 0,
+        object: "device_ingest_batch_result",
+        rejected_record_count: 1,
+        status: "accepted",
+      }),
+      putSourceInstanceState: async () => ({ ok: true }),
+    } as unknown as LocalDeviceClient;
+    const result = await drainCollectorOutbox({
+      client,
+      connectorId: "fixture-rejected-receipt",
+      holderId: "receipt-test",
+      outbox,
+      policy: { ...DEFAULT_COLLECTOR_OUTBOX_POLICY, maxDrainIterations: 1 },
+      sourceInstanceId,
+    });
+    assert.equal(result.sent, 0, "a resolved receipt with rejections is not durable admission");
+    assert.equal(outbox.summary({ sourceInstanceId }).succeeded, 0, "the rejected batch must not be acknowledged");
+    assert.ok(outbox.summary({ sourceInstanceId }).ready + outbox.summary({ sourceInstanceId }).deadLetter > 0);
+  } finally {
+    outbox.close();
+  }
+});
+
+test("runCollectorConnector withholds collected coverage after an HTTP receipt rejects a record", async () => {
+  const harness = await startCollectorHarness({ ingestFailureMode: "rejected-receipt", priorState: {} });
+  const queuePath = await tempQueuePath();
+  try {
+    const fixture = await writeFixtureConnector({
+      script: `
+        await new Promise((resolve) => {
+          let input = "";
+          process.stdin.on("data", (chunk) => { input += chunk; if (input.includes("\\n")) resolve(); });
+        });
+        process.stdout.write(JSON.stringify({ type: "RECORD", stream: "messages", key: "m-1",
+          data: { id: "m-1" }, emitted_at: new Date().toISOString() }) + "\\n");
+        process.stdout.write(JSON.stringify({ type: "STATE", stream: "messages", cursor: "m-1" }) + "\\n");
+        process.stdout.write(JSON.stringify({ type: "DONE", status: "succeeded", records_emitted: 1,
+          coverage: { version: 1, collection_scope: "unscoped", streams: [{ stream: "messages", scoped: true,
+            stores: [{ store: "messages", status: "collected" }] }] } }) + "\\n");
+      `,
+    });
+    await runCollectorConnector({
+      baseUrl: harness.url,
+      connector: {
+        args: [fixture],
+        artifactDigest: `sha256:${"b".repeat(64)}`,
+        command: "node",
+        connector_id: "fixture-rejected-http-receipt",
+        manifestFingerprint: "a".repeat(64),
+        protocol_capabilities: [],
+        runCoverageVersion: 1,
+        runtime_requirements: { bindings: {} },
+        streams: ["messages"],
+      },
+      deviceId: "device-1",
+      deviceToken: "device-token",
+      executionRoot: TEST_EXECUTION_ROOT,
+      outboxPolicy: { ...DEFAULT_COLLECTOR_OUTBOX_POLICY, maxAttempts: 1, retryBackoffMs: 60_000 },
+      queuePath,
+      sourceInstanceId: "src-rejected-http-receipt",
+    });
+    const verify = new LocalDeviceOutbox({ path: queuePath });
+    try {
+      const terminal = verify
+        .list({ sourceInstanceId: "src-rejected-http-receipt" })
+        .find((item) => item.kind === "terminal_run_commit");
+      assert.ok(terminal, "failed admission must retain an inspectable terminal result");
+      const payload = terminal.payload as TerminalRunCommitRequest;
+      const fact = payload.terminal_facts[0] as unknown as Record<string, unknown>;
+      const accounting = fact.runtime_accounting as Record<string, unknown>;
+      assert.equal(accounting.durable_admission, false);
+      assert.equal(accounting.checkpoint_eligible, false);
+      assert.ok(Number(accounting.outstanding_debt) > 0);
+      assert.deepEqual(payload.state_delta, {});
+      assert.equal(harness.terminalCommits.length, 0);
+      assert.equal(harness.stateOps.filter((operation) => operation.method === "PUT").length, 0);
+      assert.equal(harness.ingestedBatches.length, 0);
+      assert.equal(verify.summary({ sourceInstanceId: "src-rejected-http-receipt" }).succeeded, 0);
+    } finally {
+      verify.close();
+    }
+  } finally {
+    await harness.close();
+  }
+});
+
+test("runCollectorConnector records withheld checkpoint accounting before a typed terminal commit", async () => {
+  const harness = await startCollectorHarness({ ingestFailureMode: "always-503", priorState: {} });
+  try {
+    const fixture = await writeFixtureConnector({
+      script: `
+        await new Promise((resolve) => {
+          let input = "";
+          process.stdin.on("data", (chunk) => { input += chunk; if (input.includes("\\n")) resolve(); });
+        });
+        process.stdout.write(JSON.stringify({ type: "RECORD", stream: "messages", key: "m-1",
+          data: { id: "m-1" }, emitted_at: new Date().toISOString() }) + "\\n");
+        process.stdout.write(JSON.stringify({ type: "STATE", stream: "messages", cursor: "m-1" }) + "\\n");
+        process.stdout.write(JSON.stringify({ type: "DONE", status: "succeeded", records_emitted: 1,
+          coverage: { version: 1, collection_scope: "unscoped", streams: [{ stream: "messages", scoped: true,
+            stores: [{ store: "messages", status: "collected" }] }] } }) + "\\n");
+      `,
+    });
+    const queuePath = await tempQueuePath();
+    await runCollectorConnector({
+      baseUrl: harness.url,
+      connector: {
+        args: [fixture],
+        artifactDigest: `sha256:${"b".repeat(64)}`,
+        command: "node",
+        connector_id: "fixture-withheld-coverage-checkpoint",
+        manifestFingerprint: "a".repeat(64),
+        protocol_capabilities: [],
+        runCoverageVersion: 1,
+        runtime_requirements: { bindings: {} },
+        streams: ["messages"],
+      },
+      deviceId: "device-1",
+      deviceToken: "device-token",
+      executionRoot: TEST_EXECUTION_ROOT,
+      outboxPolicy: { ...DEFAULT_COLLECTOR_OUTBOX_POLICY, maxDrainDurationMs: 100, retryBackoffMs: 60_000 },
+      queuePath,
+      sourceInstanceId: "src-withheld-coverage-checkpoint",
+    });
+    const verify = new LocalDeviceOutbox({ path: queuePath });
+    try {
+      const terminal = verify
+        .list({ sourceInstanceId: "src-withheld-coverage-checkpoint" })
+        .find((item) => item.kind === "terminal_run_commit");
+      assert.ok(terminal, "the terminal evidence must remain durable while its predecessor retries");
+      const payload = terminal.payload as TerminalRunCommitRequest;
+      const fact = payload.terminal_facts[0] as unknown as Record<string, unknown>;
+      const accounting = fact.runtime_accounting as Record<string, unknown>;
+      assert.equal(accounting.checkpoint_eligible, false);
+      assert.equal(accounting.durable_admission, false);
+      assert.ok(Number(accounting.outstanding_debt) > 0);
+      assert.deepEqual(payload.state_delta, {}, "withheld stream state must not enter the terminal commit");
+      assert.equal(harness.terminalCommits.length, 0, "an unacknowledged commit is not published proof");
+      assert.equal(harness.stateOps.filter((operation) => operation.method === "PUT").length, 0);
+    } finally {
+      verify.close();
+    }
+  } finally {
+    await harness.close();
+  }
+});
+
+test("runCollectorConnector sends coverage version and exact scope in the actual START", async () => {
+  const harness = await startCollectorHarness({ priorState: {} });
+  try {
+    const startPath = join(await createTempDir("pdpp-coverage-start-"), "start.json");
+    const fixture = await writeFixtureConnector({
+      script: `
+        const fs = await import("node:fs/promises");
+        let input = "";
+        await new Promise((resolve) => process.stdin.on("data", (chunk) => {
+          input += chunk;
+          if (input.includes("\\n")) resolve();
+        }));
+        const start = JSON.parse(input.split("\\n")[0]);
+        await fs.writeFile(${JSON.stringify(startPath)}, JSON.stringify(start));
+        process.stdout.write(JSON.stringify({ type: "DONE", status: "succeeded", records_emitted: 0,
+          coverage: { version: 1, collection_scope: start.collection_scope,
+            streams: [{ stream: "messages", scoped: true, stores: [{ store: "messages", status: "collected" }] }] } }) + "\\n");
+      `,
+    });
+    await runCollectorConnector({
+      baseUrl: harness.url,
+      connector: {
+        args: [fixture],
+        artifactDigest: `sha256:${"b".repeat(64)}`,
+        command: "node",
+        connector_id: "fixture-coverage-negotiation",
+        enforcesSourceRoots: true,
+        manifestFingerprint: "a".repeat(64),
+        protocol_capabilities: [],
+        runCoverageVersion: 1,
+        runtime_requirements: { bindings: {} },
+        scope: { since: "2026-10-01T00:00:00.000Z", source_roots: ["/notes"] },
+        sourceRootScopableStreams: ["messages"],
+        streams: ["messages"],
+        timeScopableStreams: ["messages"],
+      },
+      deviceId: "device-1",
+      deviceToken: "device-token",
+      executionRoot: TEST_EXECUTION_ROOT,
+      queuePath: await tempQueuePath(),
+      sourceInstanceId: "src-coverage-negotiation",
+    });
+    const start = JSON.parse(await readFile(startPath, "utf8")) as Record<string, unknown>;
+    assert.equal(start.run_coverage_version, 1);
+    assert.equal(typeof start.collection_scope, "string");
+    assert.equal(harness.terminalCommits[0]?.collection_boundary, start.collection_scope);
+  } finally {
+    await harness.close();
+  }
+});
+
+test("a connector that does not request coverage cannot submit a positive DONE verdict", async () => {
+  const harness = await startCollectorHarness({ priorState: {} });
+  try {
+    const fixture = await writeFixtureConnector({
+      script: `
+        await new Promise((resolve) => {
+          let input = "";
+          process.stdin.on("data", (chunk) => { input += chunk; if (input.includes("\\n")) resolve(); });
+        });
+        process.stdout.write(JSON.stringify({ type: "DONE", status: "succeeded", records_emitted: 0,
+          coverage: { version: 1, collection_scope: "unscoped", streams: [{ stream: "messages", scoped: true,
+            stores: [{ store: "messages", status: "collected" }] }] } }) + "\\n");
+      `,
+    });
+    await assert.rejects(
+      runCollectorConnector({
+        baseUrl: harness.url,
+        connector: {
+          args: [fixture],
+          command: "node",
+          connector_id: "fixture-unrequested-coverage",
+          protocol_capabilities: [],
+          runtime_requirements: { bindings: {} },
+          streams: ["messages"],
+        },
+        deviceId: "device-1",
+        deviceToken: "device-token",
+        executionRoot: TEST_EXECUTION_ROOT,
+        queuePath: await tempQueuePath(),
+        sourceInstanceId: "src-unrequested-coverage",
+      }),
+      /emitted unrequested DONE coverage/
+    );
+    assert.equal(harness.terminalCommits.length, 0);
+  } finally {
+    await harness.close();
+  }
+});
+
+for (const [versionLabel, coverageVersion] of [
+  ["numeric v2", 2],
+  ["future string", "future"],
+  ["missing", undefined],
+] as const) {
+  test(`runCollectorConnector rejects ${versionLabel} DONE coverage versions`, async () => {
+    const harness = await startCollectorHarness({ priorState: {} });
+    try {
+      const fixture = await writeFixtureConnector({
+        script: `
+          await new Promise((resolve) => {
+            let input = "";
+            process.stdin.on("data", (chunk) => { input += chunk; if (input.includes("\\n")) resolve(); });
+          });
+          const coverage = { ${coverageVersion === undefined ? "" : `version: ${JSON.stringify(coverageVersion)},`}
+            collection_scope: "unscoped", streams: [{ stream: "messages", scoped: true,
+              stores: [{ store: "messages", status: "collected" }] }] };
+          process.stdout.write(JSON.stringify({ type: "DONE", status: "succeeded", records_emitted: 0, coverage }) + "\\n");
+        `,
+      });
+      await assert.rejects(
+        runCollectorConnector({
+          baseUrl: harness.url,
+          connector: {
+            args: [fixture],
+            artifactDigest: `sha256:${"b".repeat(64)}`,
+            command: "node",
+            connector_id: "fixture-unknown-coverage-version",
+            manifestFingerprint: "a".repeat(64),
+            protocol_capabilities: [],
+            runCoverageVersion: 1,
+            runtime_requirements: { bindings: {} },
+            streams: ["messages"],
+          },
+          deviceId: "device-1",
+          deviceToken: "device-token",
+          executionRoot: TEST_EXECUTION_ROOT,
+          queuePath: await tempQueuePath(),
+          sourceInstanceId: "src-unknown-coverage-version",
+        }),
+        /DONE coverage version or collection scope is invalid/
+      );
+      assert.equal(harness.terminalCommits.length, 0);
+    } finally {
+      await harness.close();
+    }
+  });
+}
+
+const validCoverageStream = {
+  scoped: true,
+  stores: [{ status: "collected", store: "messages" }],
+  stream: "messages",
+};
+
+for (const [label, coverage] of [
+  ["null payload", null],
+  ["array payload", []],
+  ["non-array stream list", { collection_scope: "unscoped", streams: "messages", version: 1 }],
+  ["empty store list", { collection_scope: "unscoped", streams: [{ ...validCoverageStream, stores: [] }], version: 1 }],
+  [
+    "unknown store status",
+    {
+      collection_scope: "unscoped",
+      streams: [{ ...validCoverageStream, stores: [{ status: "unknown", store: "messages" }] }],
+      version: 1,
+    },
+  ],
+  [
+    "nonboolean scoped flag",
+    { collection_scope: "unscoped", streams: [{ ...validCoverageStream, scoped: "yes" }], version: 1 },
+  ],
+  [
+    "empty store identifier",
+    {
+      collection_scope: "unscoped",
+      streams: [{ ...validCoverageStream, stores: [{ status: "collected", store: " " }] }],
+      version: 1,
+    },
+  ],
+  [
+    "duplicate stream",
+    { collection_scope: "unscoped", streams: [validCoverageStream, validCoverageStream], version: 1 },
+  ],
+  [
+    "duplicate store",
+    {
+      collection_scope: "unscoped",
+      streams: [{ ...validCoverageStream, stores: [validCoverageStream.stores[0], validCoverageStream.stores[0]] }],
+      version: 1,
+    },
+  ],
+] as const) {
+  test(`runCollectorConnector rejects malformed DONE coverage: ${label}`, async () => {
+    await assertCoverageFixtureRejected({ coverage });
+  });
+}
+
+test("runCollectorConnector rejects a DONE coverage scope echo that differs from actual START scope", async () => {
+  await assertCoverageFixtureRejected({
+    coverage: { collection_scope: "not-the-start-scope", streams: [validCoverageStream], version: 1 },
+    scope: { since: "2026-10-01T00:00:00.000Z" },
+  });
+});
+
+test("runCollectorConnector rejects missing and extra DONE coverage streams", async () => {
+  await assertCoverageFixtureRejected({
+    coverage: { collection_scope: "unscoped", streams: [validCoverageStream], version: 1 },
+    requestedStreams: ["messages", "sessions"],
+  });
+  await assertCoverageFixtureRejected({
+    coverage: {
+      collection_scope: "unscoped",
+      streams: [
+        validCoverageStream,
+        { scoped: true, stores: [{ status: "collected", store: "extra" }], stream: "unexpected" },
+      ],
+      version: 1,
+    },
+    requestedStreams: ["messages"],
+  });
+});
+
+test("a negotiation-aware connector omits DONE coverage when START has no feature request", async () => {
+  const harness = await startCollectorHarness({ priorState: {} });
+  try {
+    const startPath = join(await createTempDir("pdpp-legacy-coverage-start-"), "start.json");
+    const fixture = await writeFixtureConnector({
+      script: `
+        const fs = await import("node:fs/promises");
+        let input = "";
+        await new Promise((resolve) => process.stdin.on("data", (chunk) => {
+          input += chunk;
+          if (input.includes("\\n")) resolve();
+        }));
+        const start = JSON.parse(input.split("\\n")[0]);
+        await fs.writeFile(${JSON.stringify(startPath)}, JSON.stringify(start));
+        process.stdout.write(JSON.stringify({ type: "DONE", status: "succeeded", records_emitted: 0 }) + "\\n");
+      `,
+    });
+    const result = await runCollectorConnector({
+      baseUrl: harness.url,
+      connector: {
+        args: [fixture],
+        command: "node",
+        connector_id: "fixture-legacy-runtime-negotiation",
+        protocol_capabilities: [],
+        runtime_requirements: { bindings: {} },
+        streams: ["messages"],
+      },
+      deviceId: "device-1",
+      deviceToken: "device-token",
+      executionRoot: TEST_EXECUTION_ROOT,
+      queuePath: await tempQueuePath(),
+      sourceInstanceId: "src-legacy-runtime-negotiation",
+    });
+    const start = JSON.parse(await readFile(startPath, "utf8")) as Record<string, unknown>;
+    assert.equal("run_coverage_version" in start, false);
+    assert.equal(result.done?.status, "succeeded", "legacy collection remains usable");
+    const facts = harness.terminalCommits[0]?.terminal_facts;
+    assert.equal(Array.isArray(facts) && facts.length > 0, false, "omission cannot produce positive facts");
+  } finally {
+    await harness.close();
+  }
+});
+
+for (const includeState of [false, true]) {
+  test(`successful DONE without coverage retires earlier proof ${includeState ? "with" : "without"} STATE`, async () => {
+    const harness = await startCollectorHarness({ priorState: {} });
+    try {
+      const fixture = await writeFixtureConnector({
+        script: `
+          await new Promise((resolve) => {
+            let input = "";
+            process.stdin.on("data", (chunk) => { input += chunk; if (input.includes("\\n")) resolve(); });
+          });
+          ${includeState ? 'process.stdout.write(JSON.stringify({ type: "STATE", stream: "messages", cursor: "run-b" }) + "\\n");' : ""}
+          process.stdout.write(JSON.stringify({ type: "DONE", status: "succeeded", records_emitted: 0 }) + "\\n");
+        `,
+      });
+      await runCollectorConnector({
+        baseUrl: harness.url,
+        connector: {
+          args: [fixture],
+          artifactDigest: `sha256:${"b".repeat(64)}`,
+          command: "node",
+          connector_id: "fixture-coverage-retirement",
+          manifestFingerprint: "a".repeat(64),
+          protocol_capabilities: [],
+          runCoverageVersion: 1,
+          runtime_requirements: { bindings: {} },
+          streams: ["messages"],
+        },
+        deviceId: "device-1",
+        deviceToken: "device-token",
+        executionRoot: TEST_EXECUTION_ROOT,
+        queuePath: await tempQueuePath(),
+        runId: "run-b-no-coverage",
+        sourceInstanceId: "src-coverage-retirement",
+      });
+      assert.equal(harness.terminalCommits.length, 1, "successful omission must enqueue an explicit replacement");
+      const replacement = harness.terminalCommits[0] as unknown as TerminalRunCommitRequest;
+      assert.equal(replacement.version, 2);
+      assert.deepEqual(replacement.terminal_facts, []);
+      assert.deepEqual(replacement.state_delta, includeState ? { messages: "run-b" } : {});
+    } finally {
+      await harness.close();
+    }
+  });
+}
+
 for (const effectType of ["DETAIL_GAP", "DETAIL_COVERAGE"] as const) {
   test(`runCollectorConnector refuses ${effectType} without durable detail accounting`, async () => {
     const harness = await startCollectorHarness({ priorState: {} });
@@ -422,6 +1009,119 @@ for (const effectType of ["DETAIL_GAP", "DETAIL_COVERAGE"] as const) {
   });
 }
 
+for (const effectType of ["DETAIL_GAP", "DETAIL_COVERAGE"] as const) {
+  test(`runCollectorConnector rejects a valid concrete ${effectType} before terminal coverage`, async () => {
+    const harness = await startCollectorHarness({ priorState: {} });
+    try {
+      const detailMessage =
+        effectType === "DETAIL_GAP"
+          ? {
+              detail_locator: { id: "m-1", kind: "message" },
+              reason: "rate_limited",
+              record_key: "m-1",
+              reference_only: true,
+              retryable: true,
+              status: "pending",
+              stream: "messages",
+              type: effectType,
+            }
+          : {
+              empty_keys: [],
+              gap_keys: ["b"],
+              hydrated_keys: ["a"],
+              reference_only: true,
+              required_keys: ["a", "b"],
+              state_stream: "messages",
+              stream: "message_details",
+              type: effectType,
+            };
+      const fixture = await writeFixtureConnector({
+        script: `
+          process.stdout.write(JSON.stringify(${JSON.stringify(detailMessage)}) + "\\n");
+          process.stdout.write(JSON.stringify({ type: "DONE", status: "succeeded", records_emitted: 0,
+            coverage: { version: 1, collection_scope: "unscoped", streams: [{ stream: "messages", scoped: true,
+              stores: [{ store: "messages", status: "collected" }] }] } }) + "\\n");
+        `,
+      });
+      await assert.rejects(
+        runCollectorConnector({
+          baseUrl: harness.url,
+          connector: {
+            args: [fixture],
+            artifactDigest: `sha256:${"b".repeat(64)}`,
+            command: "node",
+            connector_id: `fixture-concrete-${effectType.toLowerCase()}`,
+            manifestFingerprint: "a".repeat(64),
+            protocol_capabilities: [],
+            runCoverageVersion: 1,
+            runtime_requirements: { bindings: {} },
+            streams: ["messages"],
+          },
+          deviceId: "device-1",
+          deviceToken: "device-token",
+          executionRoot: TEST_EXECUTION_ROOT,
+          queuePath: await tempQueuePath(),
+          sourceInstanceId: `src-concrete-${effectType.toLowerCase()}`,
+        }),
+        new RegExp(`unsupported ${effectType}`)
+      );
+      assert.equal(harness.terminalCommits.length, 0);
+    } finally {
+      await harness.close();
+    }
+  });
+}
+
+for (const debtOutcome of ["gapped", "unaccounted"] as const) {
+  test(`runCollectorConnector fails closed for STREAM_EVIDENCE ${debtOutcome} counts`, async () => {
+    const harness = await startCollectorHarness({ priorState: {} });
+    try {
+      const fixture = await writeFixtureConnector({
+        script: `
+          await new Promise((resolve) => {
+            let input = "";
+            process.stdin.on("data", (chunk) => { input += chunk; if (input.includes("\\n")) resolve(); });
+          });
+          process.stdout.write(JSON.stringify({ type: "STREAM_EVIDENCE", stream: "messages", considered: 1,
+            outcomes: { emitted: 0, unchanged: 0, gapped: ${debtOutcome === "gapped" ? 1 : 0},
+              unaccounted: ${debtOutcome === "unaccounted" ? 1 : 0} }, reference_only: true }) + "\\n");
+          process.stdout.write(JSON.stringify({ type: "DONE", status: "succeeded", records_emitted: 0,
+            coverage: { version: 1, collection_scope: "unscoped", streams: [{ stream: "messages", scoped: true,
+              stores: [{ store: "messages", status: "collected" }] }] } }) + "\\n");
+        `,
+      });
+      const markerPath = join(await createTempDir("pdpp-stream-evidence-blocked-"), "spawned");
+      await assert.rejects(
+        runCollectorConnector({
+          baseUrl: harness.url,
+          connector: {
+            args: [fixture],
+            command: "node",
+            connector_id: `fixture-stream-evidence-${debtOutcome}`,
+            protocol_capabilities: ["STREAM_EVIDENCE"],
+            runtime_requirements: { bindings: {} },
+            streams: ["messages"],
+          },
+          deviceId: "device-1",
+          deviceToken: "device-token",
+          executionRoot: TEST_EXECUTION_ROOT,
+          queuePath: await tempQueuePath(),
+          sourceInstanceId: `src-stream-evidence-${debtOutcome}`,
+        }),
+        (error: unknown) => {
+          assert.ok(error instanceof RuntimeCapabilityMismatchError);
+          assert.deepEqual((error as RuntimeCapabilityMismatchError).missing, ["STREAM_EVIDENCE"]);
+          return true;
+        }
+      );
+      await assert.rejects(() => readFile(markerPath));
+      assert.equal(harness.terminalCommits.length, 0);
+    } finally {
+      await harness.close();
+    }
+  });
+}
+
 test("runCollectorConnector refuses a collected assertion with mismatched emitted count", async () => {
   const harness = await startCollectorHarness({ priorState: {} });
   try {
@@ -1007,13 +1707,18 @@ test("drainCollectorQueue marks sent and preserves retryable failures", async ()
 
   const sent: IngestBatchRequest[] = [];
   const client = {
-    async ingestBatch(request: IngestBatchRequest): Promise<{ ok: true }> {
+    async ingestBatch(request: IngestBatchRequest) {
       await Promise.resolve();
       sent.push(request);
       if (request.batch_id === "batch-2") {
         throw new Error("temporary 503");
       }
-      return { ok: true };
+      return {
+        accepted_record_count: request.records.length,
+        object: "device_ingest_batch_result" as const,
+        rejected_record_count: 0,
+        status: "accepted" as const,
+      };
     },
   };
 
@@ -2582,7 +3287,7 @@ interface CollectorHarnessOptions {
   heartbeatStatus?: number;
   /** Per-heartbeat status overrides. Entries are consumed in request order. */
   heartbeatStatuses?: number[];
-  ingestFailureMode?: "always-400" | "always-503";
+  ingestFailureMode?: "always-400" | "always-503" | "rejected-receipt";
   priorState?: Record<string, unknown> | null;
   /** When set, the GET state endpoint returns this status instead of 200. */
   stateReadStatus?: number;
@@ -2789,6 +3494,15 @@ async function startCollectorHarness(options: CollectorHarnessOptions): Promise<
         res.end(JSON.stringify({ error: { code: "synthetic_bad_request" } }));
         return;
       }
+      if (options.ingestFailureMode === "rejected-receipt") {
+        sendJson(res, 200, {
+          accepted_record_count: 0,
+          object: "device_ingest_batch_result",
+          rejected_record_count: (parsed as { records?: unknown[] }).records?.length ?? 0,
+          status: "accepted",
+        });
+        return;
+      }
       ingestedBatches.push(parsed as { records?: Array<{ data?: Record<string, unknown> }> });
       sendJson(res, 201, {
         accepted_record_count: (parsed as { records?: unknown[] }).records?.length ?? 0,
@@ -4432,9 +5146,14 @@ test("drainCollectorOutbox stops between iterations when the duration budget is
       ackLocalCollectorGap() {
         return Promise.reject(new Error("duration drain test must not ack gaps"));
       },
-      async ingestBatch() {
+      async ingestBatch(request) {
         await new Promise((resolve) => setTimeout(resolve, 40));
-        return { ok: true };
+        return {
+          accepted_record_count: request.records.length,
+          object: "device_ingest_batch_result" as const,
+          rejected_record_count: 0,
+          status: "accepted" as const,
+        };
       },
       putSourceInstanceState() {
         return Promise.reject(new Error("duration drain test must not send checkpoints"));
@@ -4515,9 +5234,14 @@ test("drainCollectorOutbox does not crash when batch-claimed work expires before
       ackLocalCollectorGap() {
         return Promise.reject(new Error("lease test must not ack gaps"));
       },
-      ingestBatch() {
+      ingestBatch(request) {
         now = new Date(now.getTime() + 40);
-        return Promise.resolve({ ok: true });
+        return Promise.resolve({
+          accepted_record_count: request.records.length,
+          object: "device_ingest_batch_result" as const,
+          rejected_record_count: 0,
+          status: "accepted" as const,
+        });
       },
       putSourceInstanceState() {
         return Promise.reject(new Error("lease test must not send checkpoints"));
@@ -5527,7 +6251,12 @@ function createTestClient(): Pick<
       stream: request.stream ?? "unknown",
       updated_at: new Date().toISOString(),
     }),
-    ingestBatch: async (_request: IngestBatchRequest) => ({ ok: true }),
+    ingestBatch: async (request: IngestBatchRequest) => ({
+      accepted_record_count: request.records.length,
+      object: "device_ingest_batch_result" as const,
+      rejected_record_count: 0,
+      status: "accepted" as const,
+    }),
     putSourceInstanceState: async (request: PutSourceInstanceStateRequest): Promise<SourceInstanceStateResponse> => ({
       connector_instance_id: "test-instance",
       device_id: "test-device",
diff --git a/packages/collector-runtime/src/collector-runner.ts b/packages/collector-runtime/src/collector-runner.ts
index b0f67226e..1e77b06bd 100644
--- a/packages/collector-runtime/src/collector-runner.ts
+++ b/packages/collector-runtime/src/collector-runner.ts
@@ -37,6 +37,7 @@ import {
   type EnrollmentExchangeResponse,
   type HeartbeatLastError,
   type HeartbeatOutboxDiagnostics,
+  type IngestBatchReceipt,
   LocalDeviceClient,
   LocalDeviceHttpError,
   LocalDeviceReceiptValidationError,
@@ -1063,29 +1064,24 @@ export async function runCollectorConnector(config: CollectorRunConfig): Promise
             config.connector.sourceRootScopableStreams
           )
         : null;
-    const typedTerminalFacts =
-      done?.status === "succeeded" && !streamResult.scanBudgetExceeded && done.coverage
-        ? done.coverage.streams.map(
-            (stream): TerminalCoverageFact => ({
-              artifact_digest: config.connector.artifactDigest as string,
-              manifest_fingerprint: config.connector.manifestFingerprint as string,
-              runtime_accounting: {
-                checkpoint_eligible: true,
-                detail_complete: true,
-                durable_admission:
-                  recordDrain.failed === 0 &&
-                  afterRecordsSummary.ready === 0 &&
-                  afterRecordsSummary.leased === 0 &&
-                  afterRecordsSummary.deadLetter === 0,
-                outstanding_debt: 0,
-                stream_evidence_consistent: true,
-              },
-              scoped: stream.scoped,
-              stores: stream.stores,
-              stream: stream.stream,
-            })
-          )
-        : null;
+    const durableAdmission =
+      recordDrain.failed === 0 &&
+      afterRecordsSummary.ready === 0 &&
+      afterRecordsSummary.leased === 0 &&
+      afterRecordsSummary.deadLetter === 0;
+    const durableDebt = afterRecordsSummary.ready + afterRecordsSummary.leased + afterRecordsSummary.deadLetter;
+    const typedTerminalFacts = buildTypedTerminalCoverageFacts({
+      connector: config.connector,
+      done,
+      durableAdmission,
+      durableDebt,
+      streamResult,
+    });
+    const hasTypedTerminalEvidence = typedTerminalFacts !== null;
+    // A typed terminal commit carries both evidence and state. Keep state out
+    // of that commit when an effect was not durably admitted; a coverage
+    // downgrade alone does not change the normal checkpoint policy.
+    const checkpointState = Object.freeze(hasTypedTerminalEvidence && !durableAdmission ? {} : { ...bufferedState });
     let terminalEvidence: TerminalEvidence | null = null;
     if (typedTerminalFacts) {
       terminalEvidence = { facts: typedTerminalFacts, version: 2 };
@@ -1094,7 +1090,7 @@ export async function runCollectorConnector(config: CollectorRunConfig): Promise
     }
     const checkpointResult = await maybeCommitCheckpoint({
       afterRecordsSummary,
-      bufferedState,
+      bufferedState: checkpointState,
       client,
       config,
       holderId,
@@ -1397,9 +1393,13 @@ interface StreamConnectorIntoOutboxResult {
    */
   coverageByStore: Map<string, { status: CollectorCoverageStatus; stream: string | null }> | null;
   done: Extract<EmittedMessage, { type: "DONE" }> | null;
+  duplicateStreamEvidence: ReadonlySet<string>;
   enqueuedBatches: number;
+  recordsObservedByStream: ReadonlyMap<string, number>;
   recordsQueued: number;
   scanBudgetExceeded: boolean;
+  skipCountByStream: ReadonlyMap<string, number>;
+  streamEvidenceByStream: ReadonlyMap<string, Extract<EmittedMessage, { type: "STREAM_EVIDENCE" }>>;
 }
 
 /**
@@ -1462,6 +1462,9 @@ function assertValidStreamEvidence(
   }
   try {
     validateStreamEvidenceCounts(message);
+    if (message.reference_only !== true) {
+      throw new Error("STREAM_EVIDENCE must be reference-only");
+    }
   } catch (error) {
     throw new Error(
       `${connector.connector_id} emitted STREAM_EVIDENCE with invalid outcome counts for stream '${message.stream}'`,
@@ -1470,6 +1473,57 @@ function assertValidStreamEvidence(
   }
 }
 
+function buildTypedTerminalCoverageFacts(input: {
+  connector: CollectorRunConfig["connector"];
+  done: Extract<EmittedMessage, { type: "DONE" }> | null;
+  durableAdmission: boolean;
+  durableDebt: number;
+  streamResult: StreamConnectorIntoOutboxResult;
+}): readonly TerminalCoverageFact[] | null {
+  if (input.done?.status !== "succeeded" || input.streamResult.scanBudgetExceeded) {
+    return null;
+  }
+  if (!input.done.coverage) {
+    return input.connector.runCoverageVersion === 1 ? [] : null;
+  }
+
+  const evidenceRequired = input.connector.protocol_capabilities.includes("STREAM_EVIDENCE");
+  return input.done.coverage.streams.map((stream): TerminalCoverageFact => {
+    const evidence = input.streamResult.streamEvidenceByStream.get(stream.stream);
+    const skipCount = input.streamResult.skipCountByStream.get(stream.stream) ?? 0;
+    const recordCount = input.streamResult.recordsObservedByStream.get(stream.stream) ?? 0;
+    const evidenceConsistent =
+      !input.streamResult.duplicateStreamEvidence.has(stream.stream) &&
+      (evidence ? evidence.outcomes.emitted === recordCount : !evidenceRequired);
+    let evidenceDebt = 0;
+    if (evidence) {
+      evidenceDebt = evidence.outcomes.gapped + evidence.outcomes.unaccounted + (evidenceConsistent ? 0 : 1);
+    } else if (evidenceRequired) {
+      evidenceDebt = 1;
+    }
+    const detailComplete = skipCount === 0 && evidenceDebt === 0;
+    // Completeness and checkpoint eligibility are separate: this signal only
+    // reflects whether the runtime admitted this run's durable effects.
+    const checkpointEligible = input.durableAdmission;
+    return {
+      artifact_digest: input.connector.artifactDigest as string,
+      manifest_fingerprint: input.connector.manifestFingerprint as string,
+      runtime_accounting: {
+        checkpoint_eligible: checkpointEligible,
+        detail_complete: detailComplete,
+        durable_admission: input.durableAdmission,
+        outstanding_debt: Math.min(Number.MAX_SAFE_INTEGER, input.durableDebt + skipCount + evidenceDebt),
+        stream_evidence_consistent: evidenceConsistent,
+      },
+      scoped: stream.scoped,
+      stores: stream.stores.map((store) =>
+        skipCount > 0 && store.status === "collected" ? { ...store, status: "partial" as const } : store
+      ),
+      stream: stream.stream,
+    };
+  });
+}
+
 /** Parse the optional terminal claim before it can enter a durable outbox row. */
 export function validateRunCoverageVerdict(
   value: unknown,
@@ -1664,6 +1718,10 @@ async function streamConnectorIntoOutbox(
   const bufferedState: Record<string, unknown> = {};
   let batchSeq = nextOutboxBatchSeq(input.outbox, input.config.sourceInstanceId);
   let pendingRecords: Extract<EmittedMessage, { type: "RECORD" }>[] = [];
+  const recordsObservedByStream = new Map<string, number>();
+  const skipCountByStream = new Map<string, number>();
+  const streamEvidenceByStream = new Map<string, Extract<EmittedMessage, { type: "STREAM_EVIDENCE" }>>();
+  const duplicateStreamEvidence = new Set<string>();
   let bufferHighWaterMark = 0;
   let recordsQueued = 0;
   let recordsObserved = 0;
@@ -1756,6 +1814,7 @@ async function streamConnectorIntoOutbox(
     }
     if (message.type === "RECORD") {
       recordsObserved += 1;
+      recordsObservedByStream.set(message.stream, (recordsObservedByStream.get(message.stream) ?? 0) + 1);
       recordCoverageIfPresent(message);
       pendingRecords.push(message);
       if (pendingRecords.length > bufferHighWaterMark) {
@@ -1778,6 +1837,21 @@ async function streamConnectorIntoOutbox(
     }
     if (message.type === "STREAM_EVIDENCE") {
       assertValidStreamEvidence(message, input.config.connector);
+      if (!inScopeStreams.has(message.stream)) {
+        throw new Error(`${input.config.connector.connector_id} emitted STREAM_EVIDENCE outside its requested streams`);
+      }
+      if (streamEvidenceByStream.has(message.stream)) {
+        duplicateStreamEvidence.add(message.stream);
+      } else {
+        streamEvidenceByStream.set(message.stream, message);
+      }
+      return;
+    }
+    if (message.type === "SKIP_RESULT") {
+      if (!inScopeStreams.has(message.stream)) {
+        throw new Error(`${input.config.connector.connector_id} emitted SKIP_RESULT outside its requested streams`);
+      }
+      skipCountByStream.set(message.stream, (skipCountByStream.get(message.stream) ?? 0) + 1);
       return;
     }
     if (message.type === "DETAIL_GAP" || message.type === "DETAIL_COVERAGE") {
@@ -1952,9 +2026,13 @@ async function streamConnectorIntoOutbox(
     // run short — an honest partial coverage beats none.
     coverageByStore,
     done: scanBudgetExceeded ? null : done,
+    duplicateStreamEvidence,
     enqueuedBatches,
+    recordsObservedByStream,
     recordsQueued,
     scanBudgetExceeded,
+    skipCountByStream,
+    streamEvidenceByStream,
   };
 }
 
@@ -3025,16 +3103,16 @@ async function sendOutboxItem(
     if (payload.records.length === 0) {
       throw new OutboxPayloadShapeError(`record_batch payload has no records: ${item.id}`);
     }
-    await client.ingestBatch(
-      buildLocalDeviceIngestBatchRequest({
-        batchId: payload.batchId,
-        batchSeq: payload.batchSeq,
-        connectorId: payload.connectorId,
-        deviceId: payload.deviceId,
-        records: payload.records,
-        sourceInstanceId: payload.sourceInstanceId,
-      })
-    );
+    const request = buildLocalDeviceIngestBatchRequest({
+      batchId: payload.batchId,
+      batchSeq: payload.batchSeq,
+      connectorId: payload.connectorId,
+      deviceId: payload.deviceId,
+      records: payload.records,
+      sourceInstanceId: payload.sourceInstanceId,
+    });
+    const receipt = await client.ingestBatch(request);
+    assertAcceptedIngestBatchReceipt(receipt, request.records.length);
     return;
   }
   if (item.kind === "checkpoint") {
@@ -3078,6 +3156,19 @@ async function sendOutboxItem(
   throw new OutboxPayloadShapeError(`unsupported outbox kind ${item.kind} for id ${item.id}`);
 }
 
+function assertAcceptedIngestBatchReceipt(receipt: IngestBatchReceipt, submittedRecordCount: number): void {
+  if (
+    receipt?.object !== "device_ingest_batch_result" ||
+    receipt.status !== "accepted" ||
+    receipt.accepted_record_count !== submittedRecordCount ||
+    receipt.rejected_record_count !== 0
+  ) {
+    throw new LocalDeviceReceiptValidationError(
+      "device ingest batch response rejected records or omitted durable admission counts"
+    );
+  }
+}
+
 /**
  * Deliver one spooled artifact body. Deliberately deletes nothing.
  *
@@ -3268,7 +3359,7 @@ function assertTerminalRunCommitPayload(payload: unknown, id: string): TerminalR
     typeof payload.collection_boundary !== "string" ||
     !isRecord(payload.state_delta) ||
     !Array.isArray(payload.terminal_facts) ||
-    payload.terminal_facts.length === 0 ||
+    (payload.version === 1 && payload.terminal_facts.length === 0) ||
     !payload.terminal_facts.every(payload.version === 1 ? isTerminalCollectionFact : isTerminalCoverageFact)
   ) {
     throw new OutboxPayloadShapeError(`terminal_run_commit payload missing or invalid fields: ${id}`);
diff --git a/packages/collector-runtime/src/local-device-client.ts b/packages/collector-runtime/src/local-device-client.ts
index a384cd6d5..dcfaff3d0 100644
--- a/packages/collector-runtime/src/local-device-client.ts
+++ b/packages/collector-runtime/src/local-device-client.ts
@@ -145,6 +145,13 @@ export interface HeartbeatRequest {
 
 export type IngestBatchRequest = LocalDeviceIngestBatchRequest;
 
+export interface IngestBatchReceipt {
+  accepted_record_count: number;
+  object: "device_ingest_batch_result";
+  rejected_record_count: number;
+  status: "accepted";
+}
+
 /** Safe, terminal per-stream evidence. Deliberately excludes paths, payloads, and reasons. */
 export interface TerminalCollectionRequest {
   /**
@@ -446,7 +453,7 @@ export class LocalDeviceClient {
     });
   }
 
-  ingestBatch(request: IngestBatchRequest): Promise<{ ok: true }> {
+  ingestBatch(request: IngestBatchRequest): Promise<IngestBatchReceipt> {
     return this.#request<Record<string, unknown>>(LOCAL_DEVICE_ENDPOINTS.ingestBatch(this.#requireDeviceId()), {
       authenticate: true,
       body: request,
@@ -462,7 +469,12 @@ export class LocalDeviceClient {
           "device ingest batch response rejected records or omitted durable admission counts"
         );
       }
-      return { ok: true };
+      return {
+        accepted_record_count: response.accepted_record_count as number,
+        object: "device_ingest_batch_result",
+        rejected_record_count: response.rejected_record_count as number,
+        status: "accepted",
+      };
     });
   }
 
diff --git a/reference-implementation/operations/local-device-terminal-collection.ts b/reference-implementation/operations/local-device-terminal-collection.ts
index 1261bdf7a..d1bec788c 100644
--- a/reference-implementation/operations/local-device-terminal-collection.ts
+++ b/reference-implementation/operations/local-device-terminal-collection.ts
@@ -38,6 +38,15 @@ export interface TerminalRunCommitContext extends TerminalContext {
   commitTerminalRun: (input: ResolvedTerminalRunCommit) => Promise<TerminalRunCommitResult>;
   getConnectorManifest?: (connectorId: string) => Promise<unknown> | unknown;
   getExpectedArtifactDigest?: (connectorId: string) => string | null;
+  getRegisteredCollectionProfileRelease?: (
+    connectorId: string,
+    connectorInstanceId: string
+  ) => Promise<RegisteredCollectionProfileRelease | null> | RegisteredCollectionProfileRelease | null;
+}
+
+export interface RegisteredCollectionProfileRelease {
+  artifactDigest: string;
+  manifest: unknown;
 }
 
 /**
@@ -108,18 +117,27 @@ export async function handleLocalDeviceTerminalRunCommit(input: {
       return;
     }
 
+    const registeredReleaseResolver = ctx.getRegisteredCollectionProfileRelease;
+    const registeredRelease = registeredReleaseResolver
+      ? await registeredReleaseResolver(canonicalConnectorId, authorized.connectorInstance.connectorInstanceId)
+      : null;
+    const registeredManifest = registeredReleaseResolver
+      ? (registeredRelease?.manifest ?? (await ctx.getConnectorManifest?.(canonicalConnectorId)))
+      : await ctx.getConnectorManifest?.(canonicalConnectorId);
+    const expectedArtifactDigest = registeredReleaseResolver
+      ? (registeredRelease?.artifactDigest ?? null)
+      : (ctx.getExpectedArtifactDigest?.(canonicalConnectorId) ?? null);
+    const expectedManifestFingerprint = registeredReleaseResolver
+      ? (registeredRelease ? fingerprintDeviceAttemptManifest(registeredRelease.manifest) : null)
+      : undefined;
     const validatedFacts =
       version === 2
-        ? normalizeTerminalCoverageFacts(
-            rawFacts,
-            await ctx.getConnectorManifest?.(canonicalConnectorId),
-            collectionBoundary,
-            {
-              allowSubset: true,
-              bindingGeneration: authorized.sourceInstance.manifestGeneration ?? null,
-              expectedArtifactDigest: ctx.getExpectedArtifactDigest?.(canonicalConnectorId) ?? null,
-            }
-          )
+        ? normalizeTerminalCoverageFacts(rawFacts, registeredManifest, collectionBoundary, {
+            allowSubset: true,
+            bindingGeneration: authorized.sourceInstance.manifestGeneration ?? null,
+            expectedArtifactDigest,
+            ...(expectedManifestFingerprint !== undefined ? { expectedManifestFingerprint } : {}),
+          })
         : normalizedFacts;
     if (!validatedFacts) {
       ctx.pdppError(res, 400, "invalid_request", "terminal coverage does not match the manifest inventory");
@@ -357,6 +375,7 @@ export function normalizeTerminalCoverageFacts(
     allowSubset?: boolean;
     bindingGeneration?: number | null;
     expectedArtifactDigest?: string | null;
+    expectedManifestFingerprint?: string | null;
     validateBindingGeneration?: boolean;
     validateServerArtifactDigest?: boolean;
   } = {}
@@ -395,12 +414,36 @@ export function normalizeTerminalCoverageFacts(
     }
   }
   if (
-    rawFacts.length === 0 ||
+    (rawFacts.length === 0 && !options.allowSubset) ||
     rawFacts.length > inventory.size ||
     (!options.allowSubset && rawFacts.length !== inventory.size)
   ) {
     return null;
   }
+  if (rawFacts.length === 0) {
+    const expectedArtifactDigest = ARTIFACT_DIGEST.test(options.expectedArtifactDigest ?? "")
+      ? options.expectedArtifactDigest
+      : null;
+    return [...inventory.entries()]
+      .filter(([, stores]) => stores.size > 0)
+      .sort(([left], [right]) => left.localeCompare(right))
+      .map(([stream, stores]) => ({
+        ...(expectedArtifactDigest ? { artifact_digest: expectedArtifactDigest } : {}),
+        ...(!expectedArtifactDigest ? { artifact_binding_reason: "artifact_digest_unknown" } : {}),
+        checkpoint: "withheld",
+        collected: 0,
+        considered: null,
+        covered: null,
+        manifest_fingerprint: manifestFingerprint,
+        server_artifact_digest: expectedArtifactDigest,
+        ...(Number.isSafeInteger(options.bindingGeneration) ? { binding_generation: options.bindingGeneration } : {}),
+        coverage_statuses: ["unknown"],
+        pending_detail_gaps: 0,
+        scoped: false,
+        stores: [...stores].sort().map((store) => ({ status: "unknown", store })),
+        stream,
+      }));
+  }
   const seen = new Set<string>();
   const facts: Record<string, unknown>[] = [];
   for (const raw of rawFacts) {
@@ -459,6 +502,9 @@ export function normalizeTerminalCoverageFacts(
     const bound =
       generationMatches &&
       entry.manifest_fingerprint === manifestFingerprint &&
+      (options.expectedManifestFingerprint === undefined ||
+        (typeof options.expectedManifestFingerprint === "string" &&
+          entry.manifest_fingerprint === options.expectedManifestFingerprint)) &&
       artifactBindingReason === null;
     const complete =
       accountingKnown &&
diff --git a/reference-implementation/server/index.ts b/reference-implementation/server/index.ts
index 5815342e5..005125cb3 100644
--- a/reference-implementation/server/index.ts
+++ b/reference-implementation/server/index.ts
@@ -207,7 +207,11 @@ import {
 } from "./deployment-diagnostics.ts";
 import { composeFleetHealthVerdict } from "./fleet-health.ts";
 import { deriveReferenceFreshness } from "./freshness.ts";
-import { readLocalCollectorArtifactDigest, readLocalCollectorProfile } from "./local-collector-profiles.ts";
+import {
+  readLocalCollectorArtifactDigest,
+  readLocalCollectorProfile,
+  readLocalCollectorRelease,
+} from "./local-collector-profiles.ts";
 import {
   encodeHostedMcpSelection,
   encodeHostedMcpStreamSelection,
@@ -7066,6 +7070,10 @@ export function buildAsApp(opts: ServerOpts = {}) {
     generateSpineId,
     getExpectedArtifactDigest: readLocalCollectorArtifactDigest,
     getConnectorManifest: (connectorId: string) => getConnectorManifest(connectorId),
+    // The local server executes the installed, signature-verified release.
+    // Resolve its profile and artifact digest together for the authorized
+    // connector instance so a catalog refresh cannot splice two releases.
+    getRegisteredCollectionProfileRelease: (connectorId: string) => readLocalCollectorRelease(connectorId),
     getDefaultConnectorDetailGapStore,
     getOwnerSubjectId,
     getSemanticCapabilityIdentity,
diff --git a/reference-implementation/server/local-collector-profiles.ts b/reference-implementation/server/local-collector-profiles.ts
index 6fa750227..a1c5828fa 100644
--- a/reference-implementation/server/local-collector-profiles.ts
+++ b/reference-implementation/server/local-collector-profiles.ts
@@ -29,6 +29,11 @@ interface LocalCollectorProfilePin {
   readonly version: string;
 }
 
+export interface LocalCollectorRelease {
+  readonly artifactDigest: string;
+  readonly manifest: Record<string, unknown>;
+}
+
 const CONNECTOR_KEY = /^[a-z0-9][a-z0-9-]*$/;
 const ARTIFACT_DIGEST = /^sha256:[a-f0-9]{64}$/;
 
@@ -51,6 +56,17 @@ export function readLocalCollectorArtifactDigest(connectorKey: string): string |
   }
 }
 
+/** The installed execution release as one atomically read, pin-verified pair. */
+export function readLocalCollectorRelease(connectorKey: string): LocalCollectorRelease | null {
+  try {
+    const pinned = readPinnedProfile(connectorKey);
+    return pinned ? { artifactDigest: pinned.digest, manifest: pinned.profile } : null;
+  } catch {
+    // A missing or invalid pair cannot establish which release was executed.
+    return null;
+  }
+}
+
 function readPinnedProfile(connectorKey: string): { digest: string; profile: Record<string, unknown> } | null {
   if (!CONNECTOR_KEY.test(connectorKey)) {
     return null;
diff --git a/reference-implementation/server/routes/ref-device-exporters.ts b/reference-implementation/server/routes/ref-device-exporters.ts
index fea9f00ab..11498d360 100644
--- a/reference-implementation/server/routes/ref-device-exporters.ts
+++ b/reference-implementation/server/routes/ref-device-exporters.ts
@@ -30,6 +30,7 @@ import type { CollectionScope } from "@pdpp/reference-contract/evidence";
 import {
   handleLocalDeviceTerminalCollection,
   handleLocalDeviceTerminalRunCommit,
+  type RegisteredCollectionProfileRelease,
 } from "../../operations/local-device-terminal-collection.ts";
 import { mapWithConcurrency } from "../concurrency.ts";
 import { type DeviceAttemptContext, fingerprintDeviceAttemptManifest } from "../device-ingest-attempt-context.ts";
@@ -531,6 +532,10 @@ export interface MountRefDeviceExportersContext {
   // bindings. Async to match the host's `getConnectorManifest`.
   getConnectorManifest: (connectorId: string) => Promise<SourceKindManifestLike | null> | SourceKindManifestLike | null;
   getExpectedArtifactDigest?: (connectorId: string) => string | null;
+  getRegisteredCollectionProfileRelease?: (
+    connectorId: string,
+    connectorInstanceId: string
+  ) => RegisteredCollectionProfileRelease | null;
   getDefaultConnectorDetailGapStore: () => ConnectorDetailGapStore;
   getOwnerSubjectId: (req: unknown) => string;
   getSemanticCapabilityIdentity: () => string;
diff --git a/reference-implementation/test/local-collector-profiles.test.ts b/reference-implementation/test/local-collector-profiles.test.ts
index 9109cac08..ee0661f4d 100644
--- a/reference-implementation/test/local-collector-profiles.test.ts
+++ b/reference-implementation/test/local-collector-profiles.test.ts
@@ -3,7 +3,11 @@
 
 import assert from "node:assert/strict";
 import test from "node:test";
-import { readLocalCollectorArtifactDigest, readLocalCollectorProfile } from "../server/local-collector-profiles.ts";
+import {
+  readLocalCollectorArtifactDigest,
+  readLocalCollectorProfile,
+  readLocalCollectorRelease,
+} from "../server/local-collector-profiles.ts";
 
 const ARTIFACT_DIGEST = /^sha256:[a-f0-9]{64}$/;
 
@@ -13,6 +17,10 @@ test("a pinned local-collector connector resolves to its pinned Collection Profi
   assert.equal(profile.connector_key, "claude-code");
   assert.ok(Array.isArray(profile.streams) && profile.streams.length > 0);
   assert.match(readLocalCollectorArtifactDigest("claude-code") ?? "", ARTIFACT_DIGEST);
+  const release = readLocalCollectorRelease("claude-code");
+  assert.ok(release);
+  assert.equal(release.artifactDigest, readLocalCollectorArtifactDigest("claude-code"));
+  assert.deepEqual(release.manifest, profile);
 });
 
 test("a connector the local collector does not install has no local-collector profile", () => {
@@ -21,6 +29,7 @@ test("a connector the local collector does not install has no local-collector pr
   assert.equal(readLocalCollectorProfile("google-messages"), null);
   assert.equal(readLocalCollectorProfile("gmail"), null);
   assert.equal(readLocalCollectorArtifactDigest("gmail"), null);
+  assert.equal(readLocalCollectorRelease("gmail"), null);
 });
 
 test("a key that is not a connector key never reaches the filesystem", () => {
diff --git a/reference-implementation/test/local-device-terminal-coverage-projection.test.ts b/reference-implementation/test/local-device-terminal-coverage-projection.test.ts
index 28532c8d4..e293dd4e9 100644
--- a/reference-implementation/test/local-device-terminal-coverage-projection.test.ts
+++ b/reference-implementation/test/local-device-terminal-coverage-projection.test.ts
@@ -6,6 +6,7 @@ import { mkdtempSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import test from "node:test";
+import { normalizeTerminalCoverageFacts } from "../operations/local-device-terminal-collection.ts";
 import { reconcileDirtyConnectorSummaryEvidence } from "../server/connector-summary-read-model.ts";
 import { closeDb, getDb, initDb } from "../server/db.ts";
 import { fingerprintDeviceAttemptManifest } from "../server/device-ingest-attempt-context.ts";
@@ -113,7 +114,7 @@ async function projectedCoverage() {
 }
 
 async function seedTerminalCoverage(
-  status: "collected" | "partial" | "failed",
+  status: "collected" | "partial" | "failed" | "unavailable",
   malformed = false,
   version: 1 | 2 = 2,
   accountingOverrides: Record<string, unknown> = {},
@@ -229,6 +230,17 @@ test("a local source without a server pin projects unknown with an explicit reas
   }, "gmail");
 });
 
+test("an unavailable store verdict never projects complete on list or detail", async () => {
+  await withLocalConnection(async () => {
+    await seedTerminalCoverage("unavailable");
+    const list = await projectedCoverage();
+    assert.notEqual(list.axis, "complete");
+    const detail = await getConnectorSummaryForRoute(connectorInstanceId);
+    assert.ok(detail && "connection_health" in detail);
+    assert.notEqual(detail.connection_health.axes.coverage, "complete");
+  });
+});
+
 for (const status of ["partial", "failed"] as const) {
   test(`local-device v2 ${status} verdict never projects covered`, async () => {
     await withLocalConnection(async () => {
@@ -308,6 +320,44 @@ test("a newer failed run cannot retain an earlier v2 covered verdict", async ()
   });
 });
 
+for (const includeState of [false, true]) {
+  test(`successful empty v2 terminal replacement retires earlier proof ${includeState ? "with" : "without"} state`, async () => {
+    await withLocalConnection(async () => {
+      await seedTerminalCoverage("collected");
+      assert.equal((await projectedCoverage()).axis, "complete");
+      const manifestRow = getDb().prepare("SELECT manifest FROM connectors WHERE connector_id = ?").get(connectorId) as {
+        manifest: string;
+      };
+      const manifest = JSON.parse(manifestRow.manifest) as unknown;
+      const artifactDigest = readLocalCollectorArtifactDigest(connectorId);
+      const unknownFacts = normalizeTerminalCoverageFacts([], manifest, "unscoped", {
+        allowSubset: true,
+        bindingGeneration: 0,
+        expectedArtifactDigest: artifactDigest,
+        validateServerArtifactDigest: true,
+      });
+      assert.ok(unknownFacts, "the empty successful result must expand to explicit unknown inventory");
+      await commitTerminalRun({
+        collectionBoundary: "unscoped",
+        commitId: `commit_terminal_coverage_omission_${includeState}`,
+        connectorId,
+        connectorInstanceId,
+        deviceId,
+        envelopeHash: `empty-terminal-envelope-${includeState}`,
+        normalizedFacts: unknownFacts,
+        runId: `run_terminal_coverage_omission_${includeState}`,
+        sourceInstanceId,
+        stateDelta: includeState ? { sessions: { cursor: "later" } } : {},
+        version: 2,
+      });
+      assert.equal((await projectedCoverage()).axis, "unknown");
+      const detail = await getConnectorSummaryForRoute(connectorInstanceId);
+      assert.ok(detail && "connection_health" in detail);
+      assert.equal(detail.connection_health.axes.coverage, "unknown");
+    });
+  });
+}
+
 test("changed release obligations with identical store names invalidate positive coverage", async () => {
   await withLocalConnection(async () => {
     await seedTerminalCoverage("collected");
diff --git a/reference-implementation/test/local-device-terminal-run-commit-operation.test.ts b/reference-implementation/test/local-device-terminal-run-commit-operation.test.ts
index f25993a1f..c343a9336 100644
--- a/reference-implementation/test/local-device-terminal-run-commit-operation.test.ts
+++ b/reference-implementation/test/local-device-terminal-run-commit-operation.test.ts
@@ -56,6 +56,76 @@ function validBody(overrides: Record<string, unknown> = {}) {
   };
 }
 
+async function invokeBoundCoverageCommit(input: {
+  claimDigest: string;
+  claimManifest: Record<string, unknown>;
+  claimStores: readonly string[];
+  currentManifest: Record<string, unknown>;
+  registeredRelease: { artifactDigest: string; manifest: Record<string, unknown> } | null;
+}): Promise<{ committed: ResolvedTerminalRunCommit | null; status: number }> {
+  const capture = responseCapture();
+  let committed: ResolvedTerminalRunCommit | null = null;
+  await handleLocalDeviceTerminalRunCommit({
+    ctx: {
+      canonicalConnectorKey: () => "codex",
+      commitTerminalRun: (value) => {
+        committed = value;
+        return Promise.resolve({
+          replayed: false,
+          response: {
+            commit_id: value.commitId,
+            envelope_hash: value.envelopeHash,
+            object: "device_terminal_run_commit",
+            run_id: value.runId,
+            terminal_event_id: "evt-bound-coverage",
+          },
+        });
+      },
+      emitSpineEvent: () => Promise.resolve(),
+      getConnectorManifest: () => input.currentManifest,
+      getExpectedArtifactDigest: () => input.registeredRelease?.artifactDigest ?? null,
+      getRegisteredCollectionProfileRelease: () => input.registeredRelease,
+      handleError: (_res, error) => {
+        throw error;
+      },
+      pdppError: (_res, status) => {
+        capture.response.status(status);
+      },
+    },
+    req: {
+      body: validBody({
+        state_delta: {},
+        terminal_facts: [
+          {
+            artifact_digest: input.claimDigest,
+            manifest_fingerprint: fingerprintDeviceAttemptManifest(input.claimManifest),
+            runtime_accounting: {
+              checkpoint_eligible: true,
+              detail_complete: true,
+              durable_admission: true,
+              outstanding_debt: 0,
+              stream_evidence_consistent: true,
+            },
+            scoped: true,
+            stores: input.claimStores.map((store) => ({ status: "collected", store })),
+            stream: "messages",
+          },
+        ],
+        version: 2,
+      }),
+      deviceExporter: { deviceId: "dev-1" },
+      params: { deviceId: "dev-1", sourceInstanceId: "src-1" },
+    },
+    res: capture.response,
+    resolveAuthorizedSource: () =>
+      Promise.resolve({
+        connectorInstance: { connectorInstanceId: "cin-1" },
+        sourceInstance: { connectorId: "codex", manifestGeneration: 7 },
+      }),
+  });
+  return { committed, status: capture.snapshot().status };
+}
+
 test("version 2 terminal coverage validates named stores against the manifest", async () => {
   const capture = responseCapture();
   let committed: ResolvedTerminalRunCommit | null = null;
@@ -793,6 +863,404 @@ test("terminal commit records the server pin at admission and refuses an unbound
   );
 });
 
+test("terminal coverage requires the release registered for the authorized connector instance", async () => {
+  const capture = responseCapture();
+  let committed: ResolvedTerminalRunCommit | null = null;
+  const registeredManifest = {
+    streams: [{ coverage_stores: ["messages"], name: "messages" }],
+    version: "1.0.0",
+  };
+  const currentManifest = {
+    streams: [{ coverage_stores: ["messages"], name: "messages" }],
+    version: "2.0.0",
+  };
+  const registeredDigest = `sha256:${"a".repeat(64)}`;
+  const currentDigest = `sha256:${"b".repeat(64)}`;
+  const body = validBody({
+    state_delta: {},
+    terminal_facts: [
+      {
+        artifact_digest: currentDigest,
+        manifest_fingerprint: fingerprintDeviceAttemptManifest(currentManifest),
+        runtime_accounting: {
+          checkpoint_eligible: true,
+          detail_complete: true,
+          durable_admission: true,
+          outstanding_debt: 0,
+          stream_evidence_consistent: true,
+        },
+        scoped: true,
+        stores: [{ status: "collected", store: "messages" }],
+        stream: "messages",
+      },
+    ],
+    version: 2,
+  });
+  const ctx = {
+    canonicalConnectorKey: () => "codex",
+    commitTerminalRun: (input: ResolvedTerminalRunCommit) => {
+      committed = input;
+      return Promise.resolve({
+        replayed: false,
+        response: {
+          commit_id: input.commitId,
+          envelope_hash: input.envelopeHash,
+          object: "device_terminal_run_commit" as const,
+          run_id: input.runId,
+          terminal_event_id: "evt-release-binding",
+        },
+      });
+    },
+    emitSpineEvent: () => Promise.resolve(),
+    getConnectorManifest: () => currentManifest,
+    getExpectedArtifactDigest: () => currentDigest,
+    getRegisteredCollectionProfileRelease: (connectorId: string, connectorInstanceId: string) => {
+      assert.equal(connectorId, "codex");
+      assert.equal(connectorInstanceId, "cin-1");
+      return { artifactDigest: registeredDigest, manifest: registeredManifest };
+    },
+    handleError: (_res: unknown, error: unknown) => {
+      throw error;
+    },
+    pdppError: (_res: unknown, status: number) => {
+      capture.response.status(status);
+    },
+  };
+  await handleLocalDeviceTerminalRunCommit({
+    ctx,
+    req: {
+      body,
+      deviceExporter: { deviceId: "dev-1" },
+      params: { deviceId: "dev-1", sourceInstanceId: "src-1" },
+    },
+    res: capture.response,
+    resolveAuthorizedSource: () =>
+      Promise.resolve({
+        connectorInstance: { connectorInstanceId: "cin-1" },
+        sourceInstance: { connectorId: "codex", manifestGeneration: 7 },
+      }),
+  });
+
+  assert.equal(capture.snapshot().status, 201);
+  assert.ok(committed);
+  const fact = (committed as ResolvedTerminalRunCommit).normalizedFacts[0];
+  assert.deepEqual(fact?.coverage_statuses, ["unknown"], "current release B cannot authorize an A-instance claim");
+  assert.equal(fact?.server_artifact_digest, registeredDigest);
+});
+
+test("a run bound to its registered release remains valid after the connector catalog advances", async () => {
+  const capture = responseCapture();
+  let committed: ResolvedTerminalRunCommit | null = null;
+  const registeredManifest = {
+    streams: [{ coverage_stores: ["messages"], name: "messages" }],
+    version: "1.0.0",
+  };
+  const currentManifest = {
+    streams: [{ coverage_stores: ["messages"], name: "messages" }],
+    version: "2.0.0",
+  };
+  const registeredDigest = `sha256:${"a".repeat(64)}`;
+  const currentDigest = `sha256:${"b".repeat(64)}`;
+  const body = validBody({
+    state_delta: {},
+    terminal_facts: [
+      {
+        artifact_digest: registeredDigest,
+        manifest_fingerprint: fingerprintDeviceAttemptManifest(registeredManifest),
+        runtime_accounting: {
+          checkpoint_eligible: true,
+          detail_complete: true,
+          durable_admission: true,
+          outstanding_debt: 0,
+          stream_evidence_consistent: true,
+        },
+        scoped: true,
+        stores: [{ status: "collected", store: "messages" }],
+        stream: "messages",
+      },
+    ],
+    version: 2,
+  });
+  const ctx = {
+    canonicalConnectorKey: () => "codex",
+    commitTerminalRun: (input: ResolvedTerminalRunCommit) => {
+      committed = input;
+      return Promise.resolve({
+        replayed: false,
+        response: {
+          commit_id: input.commitId,
+          envelope_hash: input.envelopeHash,
+          object: "device_terminal_run_commit" as const,
+          run_id: input.runId,
+          terminal_event_id: "evt-release-race",
+        },
+      });
+    },
+    emitSpineEvent: () => Promise.resolve(),
+    getConnectorManifest: () => currentManifest,
+    getExpectedArtifactDigest: () => currentDigest,
+    getRegisteredCollectionProfileRelease: () => ({ artifactDigest: registeredDigest, manifest: registeredManifest }),
+    handleError: (_res: unknown, error: unknown) => {
+      throw error;
+    },
+    pdppError: (_res: unknown, status: number) => {
+      capture.response.status(status);
+    },
+  };
+  await handleLocalDeviceTerminalRunCommit({
+    ctx,
+    req: {
+      body,
+      deviceExporter: { deviceId: "dev-1" },
+      params: { deviceId: "dev-1", sourceInstanceId: "src-1" },
+    },
+    res: capture.response,
+    resolveAuthorizedSource: () =>
+      Promise.resolve({
+        connectorInstance: { connectorInstanceId: "cin-1" },
+        sourceInstance: { connectorId: "codex", manifestGeneration: 7 },
+      }),
+  });
+
+  assert.equal(capture.snapshot().status, 201);
+  assert.ok(committed);
+  const fact = (committed as ResolvedTerminalRunCommit).normalizedFacts[0];
+  assert.deepEqual(fact?.coverage_statuses, ["collected"]);
+  assert.equal(fact?.server_artifact_digest, registeredDigest);
+});
+
+test("a v2 claim cannot pair a registered digest with another manifest fingerprint", () => {
+  const registeredManifest = {
+    streams: [{ coverage_stores: ["messages"], name: "messages" }],
+    version: "1.0.0",
+  };
+  const currentManifest = {
+    streams: [{ coverage_stores: ["messages"], name: "messages" }],
+    version: "2.0.0",
+  };
+  const registeredDigest = `sha256:${"a".repeat(64)}`;
+  const fact = {
+    artifact_digest: registeredDigest,
+    manifest_fingerprint: fingerprintDeviceAttemptManifest(currentManifest),
+    runtime_accounting: {
+      checkpoint_eligible: true,
+      detail_complete: true,
+      durable_admission: true,
+      outstanding_debt: 0,
+      stream_evidence_consistent: true,
+    },
+    scoped: true,
+    stores: [{ status: "collected", store: "messages" }],
+    stream: "messages",
+  };
+  const options = {
+    expectedArtifactDigest: registeredDigest,
+    expectedManifestFingerprint: fingerprintDeviceAttemptManifest(registeredManifest),
+  };
+  const normalized = normalizeTerminalCoverageFacts([fact], currentManifest, "unscoped", options);
+  assert.ok(normalized);
+  assert.deepEqual(normalized[0]?.coverage_statuses, ["unknown"]);
+});
+
+test("the terminal endpoint makes a registered digest mismatch unknown with the registered inventory", async () => {
+  const registeredManifest = { streams: [{ coverage_stores: ["messages"], name: "messages" }] };
+  const registeredDigest = `sha256:${"a".repeat(64)}`;
+  const result = await invokeBoundCoverageCommit({
+    claimDigest: `sha256:${"b".repeat(64)}`,
+    claimManifest: registeredManifest,
+    claimStores: ["messages"],
+    currentManifest: registeredManifest,
+    registeredRelease: { artifactDigest: registeredDigest, manifest: registeredManifest },
+  });
+
+  assert.equal(result.status, 201);
+  assert.ok(result.committed);
+  assert.deepEqual(result.committed.normalizedFacts[0]?.coverage_statuses, ["unknown"]);
+  assert.equal(result.committed.normalizedFacts[0]?.artifact_binding_reason, "artifact_digest_mismatch");
+});
+
+test("the terminal endpoint keeps an unregistered digest unknown", async () => {
+  const manifest = { streams: [{ coverage_stores: ["messages"], name: "messages" }] };
+  const result = await invokeBoundCoverageCommit({
+    claimDigest: `sha256:${"c".repeat(64)}`,
+    claimManifest: manifest,
+    claimStores: ["messages"],
+    currentManifest: manifest,
+    registeredRelease: null,
+  });
+
+  assert.equal(result.status, 201);
+  assert.ok(result.committed);
+  assert.deepEqual(result.committed.normalizedFacts[0]?.coverage_statuses, ["unknown"]);
+  assert.equal(result.committed.normalizedFacts[0]?.artifact_binding_reason, "artifact_digest_unknown");
+});
+
+test("the terminal endpoint rejects a store outside the registered inventory", async () => {
+  const registeredManifest = { streams: [{ coverage_stores: ["messages", "history"], name: "messages" }] };
+  const digest = `sha256:${"a".repeat(64)}`;
+  const result = await invokeBoundCoverageCommit({
+    claimDigest: digest,
+    claimManifest: registeredManifest,
+    claimStores: ["history", "messages", "unexpected"],
+    currentManifest: registeredManifest,
+    registeredRelease: { artifactDigest: digest, manifest: registeredManifest },
+  });
+
+  assert.equal(result.status, 400);
+  assert.equal(result.committed, null);
+});
+
+test("an instance registered to release A cannot claim a larger release B inventory", async () => {
+  const registeredManifest = { streams: [{ coverage_stores: ["messages"], name: "messages" }] };
+  const currentManifest = {
+    streams: [{ coverage_stores: ["messages", "history"], name: "messages" }],
+  };
+  const registeredDigest = `sha256:${"a".repeat(64)}`;
+  const currentDigest = `sha256:${"b".repeat(64)}`;
+  const result = await invokeBoundCoverageCommit({
+    claimDigest: currentDigest,
+    claimManifest: currentManifest,
+    claimStores: ["history", "messages"],
+    currentManifest,
+    registeredRelease: { artifactDigest: registeredDigest, manifest: registeredManifest },
+  });
+
+  assert.equal(result.status, 400);
+  assert.equal(result.committed, null);
+});
+
+test("unregistered well-formed artifact digests remain unknown", () => {
+  const manifest = { streams: [{ coverage_stores: ["messages"], name: "messages" }] };
+  const fact = {
+    artifact_digest: `sha256:${"a".repeat(64)}`,
+    manifest_fingerprint: fingerprintDeviceAttemptManifest(manifest),
+    runtime_accounting: {
+      checkpoint_eligible: true,
+      detail_complete: true,
+      durable_admission: true,
+      outstanding_debt: 0,
+      stream_evidence_consistent: true,
+    },
+    scoped: true,
+    stores: [{ status: "collected", store: "messages" }],
+    stream: "messages",
+  };
+  const normalized = normalizeTerminalCoverageFacts([fact], manifest, "unscoped", { expectedArtifactDigest: null });
+  assert.ok(normalized);
+  assert.deepEqual(normalized[0]?.coverage_statuses, ["unknown"]);
+  assert.equal(normalized[0]?.artifact_binding_reason, "artifact_digest_unknown");
+});
+
+test("v2 claims with an extra store outside the registered inventory are rejected", () => {
+  const manifest = { streams: [{ coverage_stores: ["messages", "history"], name: "messages" }] };
+  const fact = {
+    artifact_digest: `sha256:${"a".repeat(64)}`,
+    manifest_fingerprint: fingerprintDeviceAttemptManifest(manifest),
+    runtime_accounting: {
+      checkpoint_eligible: true,
+      detail_complete: true,
+      durable_admission: true,
+      outstanding_debt: 0,
+      stream_evidence_consistent: true,
+    },
+    scoped: true,
+    stores: [
+      { status: "collected", store: "history" },
+      { status: "collected", store: "messages" },
+      { status: "collected", store: "unexpected" },
+    ],
+    stream: "messages",
+  };
+  assert.equal(normalizeTerminalCoverageFacts([fact], manifest, "unscoped"), null);
+});
+
+test("v2 normalization rejects duplicate streams and duplicate stores", () => {
+  const manifest = { streams: [{ coverage_stores: ["messages"], name: "messages" }] };
+  const fact = {
+    artifact_digest: `sha256:${"a".repeat(64)}`,
+    manifest_fingerprint: fingerprintDeviceAttemptManifest(manifest),
+    runtime_accounting: {
+      checkpoint_eligible: true,
+      detail_complete: true,
+      durable_admission: true,
+      outstanding_debt: 0,
+      stream_evidence_consistent: true,
+    },
+    scoped: true,
+    stores: [{ status: "collected", store: "messages" }],
+    stream: "messages",
+  };
+  assert.equal(normalizeTerminalCoverageFacts([fact, fact], manifest, "unscoped"), null);
+  assert.equal(
+    normalizeTerminalCoverageFacts(
+      [{ ...fact, stores: [fact.stores[0], fact.stores[0]] }],
+      manifest,
+      "unscoped"
+    ),
+    null
+  );
+});
+
+test("a successful empty v2 terminal commit replaces every store with unknown evidence", async () => {
+  const capture = responseCapture();
+  let committed: ResolvedTerminalRunCommit | null = null;
+  const manifest = {
+    streams: [
+      { coverage_stores: ["messages", "history"], name: "messages" },
+      { coverage_stores: ["sessions"], name: "sessions" },
+    ],
+  };
+  await handleLocalDeviceTerminalRunCommit({
+    ctx: {
+      canonicalConnectorKey: () => "codex",
+      commitTerminalRun: (input) => {
+        committed = input;
+        return Promise.resolve({
+          replayed: false,
+          response: {
+            commit_id: input.commitId,
+            envelope_hash: input.envelopeHash,
+            object: "device_terminal_run_commit",
+            run_id: input.runId,
+            terminal_event_id: "evt-unknown-replacement",
+          },
+        });
+      },
+      emitSpineEvent: () => Promise.resolve(),
+      getConnectorManifest: () => manifest,
+      getExpectedArtifactDigest: () => `sha256:${"a".repeat(64)}`,
+      handleError: (_res, error) => {
+        throw error;
+      },
+      pdppError: (_res, status) => {
+        capture.response.status(status);
+      },
+    },
+    req: {
+      body: validBody({ state_delta: {}, terminal_facts: [], version: 2 }),
+      deviceExporter: { deviceId: "dev-1" },
+      params: { deviceId: "dev-1", sourceInstanceId: "src-1" },
+    },
+    res: capture.response,
+    resolveAuthorizedSource: () =>
+      Promise.resolve({
+        connectorInstance: { connectorInstanceId: "cin-1" },
+        sourceInstance: { connectorId: "codex", manifestGeneration: 7 },
+      }),
+  });
+
+  assert.equal(capture.snapshot().status, 201);
+  assert.ok(committed);
+  const facts = (committed as ResolvedTerminalRunCommit).normalizedFacts;
+  assert.deepEqual(
+    facts.map((fact) => [fact.stream, fact.stores]),
+    [
+      ["messages", [{ store: "history", status: "unknown" }, { store: "messages", status: "unknown" }]],
+      ["sessions", [{ store: "sessions", status: "unknown" }]],
+    ]
+  );
+});
+
 test("proven empty content is complete while metadata inventory stays inventory only", () => {
   for (const coveragePolicy of ["collect", "inventory_only"]) {
     const manifest = {

From 963237536407010caeb33c017c0f06647b1a1172 Mon Sep 17 00:00:00 2001
From: Tim Nunamaker <tnunamak@gmail.com>
Date: Wed, 21 Oct 2026 23:41:55 -0500
Subject: [PATCH 12/87] chore(collector-runtime): refresh artifact metadata

Regenerate the packaged runtime receipt after the coverage accounting change.

Assisted-by: AI
Signed-off-by: Tim Nunamaker <tnunamak@gmail.com>
---
 packages/collector-runtime/artifact.json | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/packages/collector-runtime/artifact.json b/packages/collector-runtime/artifact.json
index 2682ecc29..8c217522d 100644
--- a/packages/collector-runtime/artifact.json
+++ b/packages/collector-runtime/artifact.json
@@ -1,13 +1,13 @@
 {
   "artifact_filename": "pdpp-collector-runtime-0.0.1.tgz",
-  "artifact_sha1": "ca91c2c7dd483bb8fed0c813ecfd5b71c9678446",
-  "artifact_sha256": "4b97780fd7f68b865ba7d64a1138eb57117c0cd16e2a0fc07d2fdcfc2250fed5",
-  "artifact_sha512": "20951549d248c762ff95ce53a39d7a8694d86f1a0aae7e7d31cd0721455931f144faf2ccccf535ded164ef769618d539d5bff7db7a2b3cec64ef6c6f2620f4db",
+  "artifact_sha1": "b3b64b86a2d621e24b999f427848c870fdcc10ee",
+  "artifact_sha256": "7e2b767a0a1eb4a12249afc962d8f51ac28faf4f6ddd4d4325d0b7fefeb49feb",
+  "artifact_sha512": "ee9083f44d51b3783725d695289263258d3fb6aa86168135b2e564d1aa9f645b027b6256fbccb03c6a52aa9efd32d75f1d95d958741057295e37f93c42348044",
   "connector_protocol_declarations_sha256": "8f1bf78ec644d002bfc8b1ce2399ccb660ea10bb3ee53c49a7995e1bb0e17dcb",
   "connector_protocol_source_inputs_sha256": "935e99c7e3307d7e48d748b3ca83b7427f1b91c89e7397de2a3842f08f2393fd",
-  "declarations_sha256": "bfcbc962b3683dae9ba77b463adea1ecc6cec1df2c18e6d76d37b4a2407ac534",
+  "declarations_sha256": "8453b87e2260d22f8c421b9858a0e5dbdd18cc16a61c20d1960dcce3b82b365e",
   "metadata_version": 1,
   "package_name": "@pdpp/collector-runtime",
   "package_version": "0.0.1",
-  "source_inputs_sha256": "b76ee37b04bf3c4c27c1298ae58fcaeb6410de43b73a0ae4904cf96144df84c3"
+  "source_inputs_sha256": "c092946a07396234c17f67f9dfd28459715bf15187a265adb48c2672ade96c61"
 }

From b0b78eee1824d59b99e54d7cc0dca09ce214d8b8 Mon Sep 17 00:00:00 2001
From: Tim Nunamaker <tnunamak@gmail.com>
Date: Thu, 22 Oct 2026 00:40:57 -0500
Subject: [PATCH 13/87] Bind coverage projection to the pinned release

The catalog rewrites connector IDs, so its manifest fingerprint can differ from the raw release fingerprint carried by a terminal claim. Project against the verified release pin. Keep coverage fields inside version-1 START negotiation, and test bounded, unscoped, and legacy producer behavior.

Assisted-by: AI
Signed-off-by: Tim Nunamaker <tnunamak@gmail.com>
---
 packages/collector-runtime/artifact.json      |   2 +-
 .../src/collector-runner.test.ts              | 126 ++++++++++--------
 .../collector-runtime/src/collector-runner.ts |   2 +-
 .../local-device-terminal-collection.ts       |  14 +-
 .../server/ref-control.ts                     |  11 +-
 ...evice-terminal-coverage-projection.test.ts |  34 ++++-
 6 files changed, 122 insertions(+), 67 deletions(-)

diff --git a/packages/collector-runtime/artifact.json b/packages/collector-runtime/artifact.json
index 8c217522d..c7cb2a307 100644
--- a/packages/collector-runtime/artifact.json
+++ b/packages/collector-runtime/artifact.json
@@ -9,5 +9,5 @@
   "metadata_version": 1,
   "package_name": "@pdpp/collector-runtime",
   "package_version": "0.0.1",
-  "source_inputs_sha256": "c092946a07396234c17f67f9dfd28459715bf15187a265adb48c2672ade96c61"
+  "source_inputs_sha256": "06d1abdc139784219a34f03e86ac03575e9c4c5b28563233dec234b54e7059a1"
 }
diff --git a/packages/collector-runtime/src/collector-runner.test.ts b/packages/collector-runtime/src/collector-runner.test.ts
index 1fae3e7d6..c2d203b6a 100644
--- a/packages/collector-runtime/src/collector-runner.test.ts
+++ b/packages/collector-runtime/src/collector-runner.test.ts
@@ -667,56 +667,68 @@ test("runCollectorConnector records withheld checkpoint accounting before a type
   }
 });
 
-test("runCollectorConnector sends coverage version and exact scope in the actual START", async () => {
-  const harness = await startCollectorHarness({ priorState: {} });
-  try {
-    const startPath = join(await createTempDir("pdpp-coverage-start-"), "start.json");
-    const fixture = await writeFixtureConnector({
-      script: `
-        const fs = await import("node:fs/promises");
-        let input = "";
-        await new Promise((resolve) => process.stdin.on("data", (chunk) => {
-          input += chunk;
-          if (input.includes("\\n")) resolve();
-        }));
-        const start = JSON.parse(input.split("\\n")[0]);
-        await fs.writeFile(${JSON.stringify(startPath)}, JSON.stringify(start));
-        process.stdout.write(JSON.stringify({ type: "DONE", status: "succeeded", records_emitted: 0,
-          coverage: { version: 1, collection_scope: start.collection_scope,
-            streams: [{ stream: "messages", scoped: true, stores: [{ store: "messages", status: "collected" }] }] } }) + "\\n");
-      `,
-    });
-    await runCollectorConnector({
-      baseUrl: harness.url,
-      connector: {
-        args: [fixture],
-        artifactDigest: `sha256:${"b".repeat(64)}`,
-        command: "node",
-        connector_id: "fixture-coverage-negotiation",
-        enforcesSourceRoots: true,
-        manifestFingerprint: "a".repeat(64),
-        protocol_capabilities: [],
-        runCoverageVersion: 1,
-        runtime_requirements: { bindings: {} },
-        scope: { since: "2026-10-01T00:00:00.000Z", source_roots: ["/notes"] },
-        sourceRootScopableStreams: ["messages"],
-        streams: ["messages"],
-        timeScopableStreams: ["messages"],
-      },
-      deviceId: "device-1",
-      deviceToken: "device-token",
-      executionRoot: TEST_EXECUTION_ROOT,
-      queuePath: await tempQueuePath(),
-      sourceInstanceId: "src-coverage-negotiation",
-    });
-    const start = JSON.parse(await readFile(startPath, "utf8")) as Record<string, unknown>;
-    assert.equal(start.run_coverage_version, 1);
-    assert.equal(typeof start.collection_scope, "string");
-    assert.equal(harness.terminalCommits[0]?.collection_boundary, start.collection_scope);
-  } finally {
-    await harness.close();
-  }
-});
+for (const [label, scope, expectedScope] of [
+  [
+    "bounded",
+    { since: "2026-10-01T00:00:00.000Z", source_roots: ["/notes"] },
+    "since=2026-10-01T00:00:00.000Z;roots=/notes",
+  ],
+  ["unscoped", undefined, "unscoped"],
+] as const) {
+  test(`runCollectorConnector sends version 1 and exact ${label} scope in the actual START`, async () => {
+    const harness = await startCollectorHarness({ priorState: {} });
+    try {
+      const startPath = join(await createTempDir("pdpp-coverage-start-"), "start.json");
+      const fixture = await writeFixtureConnector({
+        script: `
+          const fs = await import("node:fs/promises");
+          let input = "";
+          await new Promise((resolve) => process.stdin.on("data", (chunk) => {
+            input += chunk;
+            if (input.includes("\\n")) resolve();
+          }));
+          const start = JSON.parse(input.split("\\n")[0]);
+          await fs.writeFile(${JSON.stringify(startPath)}, JSON.stringify(start));
+          const done = { type: "DONE", status: "succeeded", records_emitted: 0 };
+          if (start.run_coverage_version === 1) {
+            done.coverage = { version: 1, collection_scope: start.collection_scope,
+              streams: [{ stream: "messages", scoped: true, stores: [{ store: "messages", status: "collected" }] }] };
+          }
+          process.stdout.write(JSON.stringify(done) + "\\n");
+        `,
+      });
+      await runCollectorConnector({
+        baseUrl: harness.url,
+        connector: {
+          args: [fixture],
+          artifactDigest: `sha256:${"b".repeat(64)}`,
+          command: "node",
+          connector_id: "fixture-coverage-negotiation",
+          enforcesSourceRoots: true,
+          manifestFingerprint: "a".repeat(64),
+          protocol_capabilities: [],
+          runCoverageVersion: 1,
+          runtime_requirements: { bindings: {} },
+          ...(scope ? { scope } : {}),
+          sourceRootScopableStreams: ["messages"],
+          streams: ["messages"],
+          timeScopableStreams: ["messages"],
+        },
+        deviceId: "device-1",
+        deviceToken: "device-token",
+        executionRoot: TEST_EXECUTION_ROOT,
+        queuePath: await tempQueuePath(),
+        sourceInstanceId: `src-coverage-negotiation-${label}`,
+      });
+      const start = JSON.parse(await readFile(startPath, "utf8")) as Record<string, unknown>;
+      assert.equal(start.run_coverage_version, 1);
+      assert.equal(start.collection_scope, expectedScope);
+      assert.equal(harness.terminalCommits[0]?.collection_boundary, expectedScope);
+    } finally {
+      await harness.close();
+    }
+  });
+}
 
 test("a connector that does not request coverage cannot submit a positive DONE verdict", async () => {
   const harness = await startCollectorHarness({ priorState: {} });
@@ -894,7 +906,12 @@ test("a negotiation-aware connector omits DONE coverage when START has no featur
         }));
         const start = JSON.parse(input.split("\\n")[0]);
         await fs.writeFile(${JSON.stringify(startPath)}, JSON.stringify(start));
-        process.stdout.write(JSON.stringify({ type: "DONE", status: "succeeded", records_emitted: 0 }) + "\\n");
+        const done = { type: "DONE", status: "succeeded", records_emitted: 0 };
+        if (start.run_coverage_version === 1) {
+          done.coverage = { version: 1, collection_scope: start.collection_scope,
+            streams: [{ stream: "messages", scoped: true, stores: [{ store: "messages", status: "collected" }] }] };
+        }
+        process.stdout.write(JSON.stringify(done) + "\\n");
       `,
     });
     const result = await runCollectorConnector({
@@ -915,6 +932,7 @@ test("a negotiation-aware connector omits DONE coverage when START has no featur
     });
     const start = JSON.parse(await readFile(startPath, "utf8")) as Record<string, unknown>;
     assert.equal("run_coverage_version" in start, false);
+    assert.equal("collection_scope" in start, false, "legacy START shape must not add an unnegotiated field");
     assert.equal(result.done?.status, "succeeded", "legacy collection remains usable");
     const facts = harness.terminalCommits[0]?.terminal_facts;
     assert.equal(Array.isArray(facts) && facts.length > 0, false, "omission cannot produce positive facts");
@@ -1076,8 +1094,11 @@ for (const debtOutcome of ["gapped", "unaccounted"] as const) {
   test(`runCollectorConnector fails closed for STREAM_EVIDENCE ${debtOutcome} counts`, async () => {
     const harness = await startCollectorHarness({ priorState: {} });
     try {
+      const markerPath = join(await createTempDir("pdpp-stream-evidence-blocked-"), "spawned");
       const fixture = await writeFixtureConnector({
         script: `
+          const fs = await import("node:fs/promises");
+          await fs.writeFile(${JSON.stringify(markerPath)}, "spawned");
           await new Promise((resolve) => {
             let input = "";
             process.stdin.on("data", (chunk) => { input += chunk; if (input.includes("\\n")) resolve(); });
@@ -1090,7 +1111,6 @@ for (const debtOutcome of ["gapped", "unaccounted"] as const) {
               stores: [{ store: "messages", status: "collected" }] }] } }) + "\\n");
         `,
       });
-      const markerPath = join(await createTempDir("pdpp-stream-evidence-blocked-"), "spawned");
       await assert.rejects(
         runCollectorConnector({
           baseUrl: harness.url,
@@ -1114,7 +1134,7 @@ for (const debtOutcome of ["gapped", "unaccounted"] as const) {
           return true;
         }
       );
-      await assert.rejects(() => readFile(markerPath));
+      await assert.rejects(() => readFile(markerPath), /ENOENT/);
       assert.equal(harness.terminalCommits.length, 0);
     } finally {
       await harness.close();
diff --git a/packages/collector-runtime/src/collector-runner.ts b/packages/collector-runtime/src/collector-runner.ts
index 1e77b06bd..4c5cfb6f6 100644
--- a/packages/collector-runtime/src/collector-runner.ts
+++ b/packages/collector-runtime/src/collector-runner.ts
@@ -2445,7 +2445,7 @@ export function buildCollectorStartMessage(
   runCoverageVersion?: 1
 ): StartMessage {
   const start: StartMessage = {
-    ...(collectionScope ? { collection_scope: collectionScope } : {}),
+    ...(runCoverageVersion === 1 && collectionScope ? { collection_scope: collectionScope } : {}),
     ...(runCoverageVersion === 1 ? { run_coverage_version: 1 } : {}),
     scope: {
       streams: streams.map((name): StreamScope => {
diff --git a/reference-implementation/operations/local-device-terminal-collection.ts b/reference-implementation/operations/local-device-terminal-collection.ts
index d1bec788c..1368d318e 100644
--- a/reference-implementation/operations/local-device-terminal-collection.ts
+++ b/reference-implementation/operations/local-device-terminal-collection.ts
@@ -127,16 +127,19 @@ export async function handleLocalDeviceTerminalRunCommit(input: {
     const expectedArtifactDigest = registeredReleaseResolver
       ? (registeredRelease?.artifactDigest ?? null)
       : (ctx.getExpectedArtifactDigest?.(canonicalConnectorId) ?? null);
-    const expectedManifestFingerprint = registeredReleaseResolver
-      ? (registeredRelease ? fingerprintDeviceAttemptManifest(registeredRelease.manifest) : null)
-      : undefined;
+    let expectedManifestFingerprint: string | null | undefined;
+    if (registeredReleaseResolver) {
+      expectedManifestFingerprint = registeredRelease
+        ? fingerprintDeviceAttemptManifest(registeredRelease.manifest)
+        : null;
+    }
     const validatedFacts =
       version === 2
         ? normalizeTerminalCoverageFacts(rawFacts, registeredManifest, collectionBoundary, {
             allowSubset: true,
             bindingGeneration: authorized.sourceInstance.manifestGeneration ?? null,
             expectedArtifactDigest,
-            ...(expectedManifestFingerprint !== undefined ? { expectedManifestFingerprint } : {}),
+            ...(expectedManifestFingerprint === undefined ? {} : { expectedManifestFingerprint }),
           })
         : normalizedFacts;
     if (!validatedFacts) {
@@ -385,7 +388,8 @@ export function normalizeTerminalCoverageFacts(
   if (!Array.isArray(manifestStreams) || manifestStreams.length === 0) {
     return null;
   }
-  const manifestFingerprint = fingerprintDeviceAttemptManifest(rawManifest);
+  const manifestFingerprint =
+    options.expectedManifestFingerprint ?? fingerprintDeviceAttemptManifest(rawManifest);
   const inventory = new Map<string, Set<string>>();
   const metadataOnlyStreams = new Set<string>();
   for (const rawStream of manifestStreams) {
diff --git a/reference-implementation/server/ref-control.ts b/reference-implementation/server/ref-control.ts
index 52e820792..c046c9178 100644
--- a/reference-implementation/server/ref-control.ts
+++ b/reference-implementation/server/ref-control.ts
@@ -165,9 +165,10 @@ import {
 import { listConnectorSummaryEvidence } from "./connector-summary-read-model.ts";
 import { filterRunGapsProvenCompleteByReport } from "./continuation-proof.ts";
 import { getSqliteStoreCacheIdentity } from "./db.ts";
+import { fingerprintDeviceAttemptManifest } from "./device-ingest-attempt-context.ts";
 import { deriveReferenceFreshness, type ReferenceFreshness } from "./freshness.ts";
 import { readStoredCollectionScope } from "./local-collection-scope.ts";
-import { readLocalCollectorArtifactDigest } from "./local-collector-profiles.ts";
+import { readLocalCollectorRelease } from "./local-collector-profiles.ts";
 import { mapPendingPressureGaps } from "./pending-pressure-gap-map.ts";
 import { isPostgresStorageBackend, postgresQuery } from "./postgres-storage.ts";
 import {
@@ -4998,7 +4999,8 @@ function deriveLocalTerminalCoverageAxis(
   manifest: ConnectorManifest,
   legacyAxis: LocalCoverageDiagnosticAxis | null,
   bindingGeneration: number | null,
-  expectedArtifactDigest: string | null
+  expectedArtifactDigest: string | null,
+  expectedManifestFingerprint: string | null
 ): LocalCoverageDiagnosticAxis | null {
   const terminal = run?.local_terminal_coverage;
   if (!terminal) {
@@ -5025,6 +5027,7 @@ function deriveLocalTerminalCoverageAxis(
     allowSubset: true,
     bindingGeneration,
     expectedArtifactDigest,
+    expectedManifestFingerprint,
     validateBindingGeneration: true,
     validateServerArtifactDigest: true,
   });
@@ -7092,13 +7095,15 @@ function synthesizeConnectorSummary(input: ConnectorSummarySynthesisInput): Conn
   const authoritativeLastSuccessfulRun = isOwnScopedRun(lastSuccessfulRun) ? lastSuccessfulRun : null;
   const fallbackSettledRun = latestSettledRun ?? fallbackLatestSettledRun(lastRun, lastSuccessfulRun);
   const authoritativeLatestSettledRun = isOwnScopedRun(fallbackSettledRun) ? fallbackSettledRun : null;
+  const localCollectorRelease = localDeviceBacked ? readLocalCollectorRelease(connectorId) : null;
   const effectiveLocalCoverage = localDeviceBacked
     ? (deriveLocalTerminalCoverageAxis(
         fallbackSettledRun,
         manifest,
         localCoverage,
         evidence?.manifest_generation ?? null,
-        readLocalCollectorArtifactDigest(connectorId)
+        localCollectorRelease?.artifactDigest ?? null,
+        localCollectorRelease ? fingerprintDeviceAttemptManifest(localCollectorRelease.manifest) : null
       ) ?? localCoverage)
     : localCoverage;
   const authoritativeLatestStreamFacts = localDeviceBacked ? null : latestStreamFacts;
diff --git a/reference-implementation/test/local-device-terminal-coverage-projection.test.ts b/reference-implementation/test/local-device-terminal-coverage-projection.test.ts
index e293dd4e9..a4ef792c0 100644
--- a/reference-implementation/test/local-device-terminal-coverage-projection.test.ts
+++ b/reference-implementation/test/local-device-terminal-coverage-projection.test.ts
@@ -11,7 +11,7 @@ import { reconcileDirtyConnectorSummaryEvidence } from "../server/connector-summ
 import { closeDb, getDb, initDb } from "../server/db.ts";
 import { fingerprintDeviceAttemptManifest } from "../server/device-ingest-attempt-context.ts";
 import { buildStoredCollectionScope, COLLECTION_SCOPE_STATE_KEY } from "../server/local-collection-scope.ts";
-import { readLocalCollectorArtifactDigest } from "../server/local-collector-profiles.ts";
+import { readLocalCollectorArtifactDigest, readLocalCollectorRelease } from "../server/local-collector-profiles.ts";
 import { getConnectorSummaryForRoute, listConnectorSummaries } from "../server/ref-control.ts";
 import { createSqliteConnectorInstanceStore } from "../server/stores/connector-instance-store.ts";
 import { getDefaultDeviceExporterStore } from "../server/stores/device-exporter-store.ts";
@@ -119,7 +119,8 @@ async function seedTerminalCoverage(
   version: 1 | 2 = 2,
   accountingOverrides: Record<string, unknown> = {},
   artifactDigest = readLocalCollectorArtifactDigest(connectorId),
-  sourceConnectorId = connectorId
+  sourceConnectorId = connectorId,
+  claimedManifestFingerprint?: string
 ): Promise<void> {
   const manifest = JSON.parse(
     (
@@ -128,10 +129,15 @@ async function seedTerminalCoverage(
       }
     ).manifest
   );
+  const registeredRelease = readLocalCollectorRelease(sourceConnectorId);
   const bindings = {
     artifact_digest: artifactDigest,
     binding_generation: 0,
-    manifest_fingerprint: fingerprintDeviceAttemptManifest(manifest),
+    manifest_fingerprint:
+      claimedManifestFingerprint ??
+      (registeredRelease
+        ? fingerprintDeviceAttemptManifest(registeredRelease.manifest)
+        : fingerprintDeviceAttemptManifest(manifest)),
     runtime_accounting: {
       checkpoint_eligible: true,
       detail_complete: true,
@@ -184,6 +190,23 @@ async function seedTerminalCoverage(
   });
 }
 
+test("registered release fingerprint survives catalog connector-key normalization", async () => {
+  const release = readLocalCollectorRelease(connectorId);
+  assert.ok(release, "the reference server must have a verified local-collector release pin");
+  await withLocalConnection(async () => {
+    await seedTerminalCoverage(
+      "collected",
+      false,
+      2,
+      {},
+      release.artifactDigest,
+      connectorId,
+      fingerprintDeviceAttemptManifest(release.manifest)
+    );
+    assert.equal((await projectedCoverage()).axis, "complete");
+  });
+});
+
 test("local-device v2 terminal coverage projects per-stream proof; absent proof stays unknown", async () => {
   await withLocalConnection(async () => {
     assert.equal((await projectedCoverage()).axis, "unknown");
@@ -358,7 +381,7 @@ for (const includeState of [false, true]) {
   });
 }
 
-test("changed release obligations with identical store names invalidate positive coverage", async () => {
+test("catalog obligation changes invalidate proof when the binding generation advances", async () => {
   await withLocalConnection(async () => {
     await seedTerminalCoverage("collected");
     assert.equal((await projectedCoverage()).axis, "complete");
@@ -371,6 +394,9 @@ test("changed release obligations with identical store names invalidate positive
     getDb()
       .prepare("UPDATE connectors SET manifest = ? WHERE connector_id = ?")
       .run(JSON.stringify(manifest), connectorId);
+    getDb()
+      .prepare("UPDATE connector_instances SET manifest_generation = manifest_generation + 1 WHERE connector_instance_id = ?")
+      .run(connectorInstanceId);
     assert.equal((await projectedCoverage()).axis, "unknown");
   });
 });

From 871fca5eba6d73af2b43f2407aa855d97c422e84 Mon Sep 17 00:00:00 2001
From: Tim Nunamaker <tnunamak@gmail.com>
Date: Thu, 22 Oct 2026 01:42:34 -0500
Subject: [PATCH 14/87] fix(collector-runtime): regenerate artifact metadata
 for the release binding

The last collector-runtime change left artifact.json stale, so package-verify
reported drift in artifact_sha1. Regenerated with `npm run artifact:generate`;
`artifact:verify` passes.

Signed-off-by: Tim Nunamaker <tnunamak@gmail.com>
Assisted-by: AI
---
 packages/collector-runtime/artifact.json | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/packages/collector-runtime/artifact.json b/packages/collector-runtime/artifact.json
index c7cb2a307..a3e815457 100644
--- a/packages/collector-runtime/artifact.json
+++ b/packages/collector-runtime/artifact.json
@@ -1,8 +1,8 @@
 {
   "artifact_filename": "pdpp-collector-runtime-0.0.1.tgz",
-  "artifact_sha1": "b3b64b86a2d621e24b999f427848c870fdcc10ee",
-  "artifact_sha256": "7e2b767a0a1eb4a12249afc962d8f51ac28faf4f6ddd4d4325d0b7fefeb49feb",
-  "artifact_sha512": "ee9083f44d51b3783725d695289263258d3fb6aa86168135b2e564d1aa9f645b027b6256fbccb03c6a52aa9efd32d75f1d95d958741057295e37f93c42348044",
+  "artifact_sha1": "ddcac5b599922952d686ab609d565365de401432",
+  "artifact_sha256": "ce1403368b83d2d0da11f2b8118c127dd307d3f4fc7c6821653c801835b2cb9b",
+  "artifact_sha512": "a10ca0f51bea392b75a1ffcb5ca80e2df46b6f27f5a33fa4e2af949762d0a6018cc024881a4c83b8c4dd1109b660c5e7c194d155bb8310b0bd47e8c4410e84d3",
   "connector_protocol_declarations_sha256": "8f1bf78ec644d002bfc8b1ce2399ccb660ea10bb3ee53c49a7995e1bb0e17dcb",
   "connector_protocol_source_inputs_sha256": "935e99c7e3307d7e48d748b3ca83b7427f1b91c89e7397de2a3842f08f2393fd",
   "declarations_sha256": "8453b87e2260d22f8c421b9858a0e5dbdd18cc16a61c20d1960dcce3b82b365e",

From 25c9a226dabaa909c45381d883a2e07047879d41 Mon Sep 17 00:00:00 2001
From: Tim Nunamaker <tnunamak@gmail.com>
Date: Thu, 22 Oct 2026 02:38:26 -0500
Subject: [PATCH 15/87] test(local-collector): pin v2 receipts to the selected
 release

A v2 receipt acknowledged for a superseded artifact digest, for another
manifest fingerprint, or with no release binding still reads as covered
when every store is collected. These cases pin the verdict to the
release the device selects, and fail on the current verdict.

Assisted-by: AI
Signed-off-by: Tim Nunamaker <tnunamak@gmail.com>
---
 packages/local-collector/test/runner.test.ts | 60 ++++++++++++++++++--
 1 file changed, 56 insertions(+), 4 deletions(-)

diff --git a/packages/local-collector/test/runner.test.ts b/packages/local-collector/test/runner.test.ts
index bbb9840ca..a1942d980 100644
--- a/packages/local-collector/test/runner.test.ts
+++ b/packages/local-collector/test/runner.test.ts
@@ -2532,7 +2532,7 @@ test("inspectLocalOutboxStatus reads connection-scoped counts from the scoped de
 
 // --- Lifecycle state axis: queue health and acknowledged terminal coverage. ---
 
-function statusFor(path, sourceInstanceId = "src-1") {
+function statusFor(path, sourceInstanceId = "src-1", selectedRelease = SELECTED_RELEASE) {
   return inspectLocalOutboxStatus(
     {
       baseUrl: "http://127.0.0.1:7662",
@@ -2540,7 +2540,7 @@ function statusFor(path, sourceInstanceId = "src-1") {
       queuePath: path,
       sourceInstanceId,
     },
-    { deploymentPosture: PUBLISHED_POSTURE }
+    { deploymentPosture: PUBLISHED_POSTURE, selectedRelease }
   );
 }
 
@@ -2570,7 +2570,26 @@ function drainRow(outbox, id, sourceInstanceId = "src-1") {
   outbox.acknowledge({ holder: "drainer", id: claim.id, leaseEpoch: claim.lease_epoch });
 }
 
-function acknowledgeTerminalCoverage(outbox, { id, sourceInstanceId = "src-1", stores, scoped = true, version = 2 }) {
+// The release this device selects for the connector, and one it has since
+// replaced. A v2 receipt is current only when its facts name the selected one.
+const SELECTED_RELEASE = Object.freeze({
+  artifactDigest: `sha256:${"a".repeat(64)}`,
+  manifestFingerprint: "b".repeat(64),
+});
+const SUPERSEDED_RELEASE = Object.freeze({
+  artifactDigest: `sha256:${"c".repeat(64)}`,
+  manifestFingerprint: "d".repeat(64),
+});
+
+/** The release fields a v2 terminal fact carries; `null` models a receipt with no binding. */
+function releaseBinding(release) {
+  return release ? { artifact_digest: release.artifactDigest, manifest_fingerprint: release.manifestFingerprint } : {};
+}
+
+function acknowledgeTerminalCoverage(
+  outbox,
+  { id, sourceInstanceId = "src-1", stores, scoped = true, version = 2, release = SELECTED_RELEASE }
+) {
   outbox.enqueue({
     id,
     kind: "terminal_run_commit",
@@ -2584,7 +2603,7 @@ function acknowledgeTerminalCoverage(outbox, { id, sourceInstanceId = "src-1", s
       source_instance_id: sourceInstanceId,
       state_delta: {},
       terminal_facts: version === 2
-        ? [{ scoped, stores, stream: "sessions" }]
+        ? [{ ...releaseBinding(release), scoped, stores, stream: "sessions" }]
         : [{ coverage_statuses: ["collected"], stream: "sessions" }],
       version,
     },
@@ -2672,6 +2691,39 @@ test("a later v1 terminal ACK clears prior v2 coverage proof", async () => {
   assert.equal(status.lifecycle_state, "no_evidence");
 });
 
+// A receipt is current only for the release this device selects. Each case is
+// a receipt acknowledged for another release, or for none, while every store
+// reads collected: it must not be reported as covered.
+for (const [label, receiptRelease, selectedRelease] of [
+  ["a superseded artifact digest", SUPERSEDED_RELEASE, SELECTED_RELEASE],
+  [
+    "a matching artifact digest and a different manifest fingerprint",
+    { artifactDigest: SELECTED_RELEASE.artifactDigest, manifestFingerprint: "e".repeat(64) },
+    SELECTED_RELEASE,
+  ],
+  ["no release binding on the receipt", null, SELECTED_RELEASE],
+  ["no selected release on this device", SELECTED_RELEASE, null],
+]) {
+  test(`v2 receipt with ${label} is not current, even when every store is collected`, async () => {
+    const path = await tempOutboxPath();
+    const outbox = new LocalDeviceOutbox({ path });
+    try {
+      acknowledgeTerminalCoverage(outbox, {
+        id: "terminal-not-current",
+        release: receiptRelease,
+        stores: [{ store: "local_files", status: "collected" }],
+      });
+      outbox.pruneSent({ dryRun: false, keepCount: 0, sourceInstanceId: "src-1" });
+    } finally {
+      outbox.close();
+    }
+    const status = statusFor(path, "src-1", selectedRelease);
+    assert.equal(status.terminal_coverage.verdict, "not_current");
+    assert.equal(status.lifecycle_state, "coverage_not_current");
+    assert.equal(buildLocalOutboxDoctor(status).checks.terminal_coverage, "warn");
+  });
+}
+
 test("partial, failed, unscoped, and v1 terminal commits do not prove coverage", async () => {
   for (const [statusValue, scoped, version, expected] of [
     ["partial", true, 2, "incomplete"],

From 324c6b47ffb1c35dc67220bbcd0de5ba4913ef0e Mon Sep 17 00:00:00 2001
From: Tim Nunamaker <tnunamak@gmail.com>
Date: Thu, 22 Oct 2026 02:49:38 -0500
Subject: [PATCH 16/87] fix(local-collector): mark receipts for another release
 not current

The terminal verdict counted a v2 receipt as covered from its store
statuses alone. After a release swap, a receipt acknowledged for the
previous release still read as covered on this device.

A receipt now counts only when every fact names the release this device
selects: the pinned artifact digest and the fingerprint of the installed
profile. Any other receipt, or a device that selects no release, reports
`not_current`. The lifecycle carries it as `coverage_not_current`, and
the doctor reports it as a warning.

Assisted-by: AI
Signed-off-by: Tim Nunamaker <tnunamak@gmail.com>
---
 .../bin/pdpp-local-collector.ts               | 125 ++++++++++++++++--
 .../test/selected-collection-release.test.ts  |  90 +++++++++++++
 2 files changed, 204 insertions(+), 11 deletions(-)
 create mode 100644 packages/local-collector/test/selected-collection-release.test.ts

diff --git a/packages/local-collector/bin/pdpp-local-collector.ts b/packages/local-collector/bin/pdpp-local-collector.ts
index 85f9f2c93..9a3ab6fd9 100644
--- a/packages/local-collector/bin/pdpp-local-collector.ts
+++ b/packages/local-collector/bin/pdpp-local-collector.ts
@@ -52,6 +52,7 @@ import { COLLECTION_PROFILE_PINS } from "../src/generated/collection-profile-pin
 import { LOCAL_COLLECTOR_DEFINITIONS } from "../src/generated/collector-definitions.generated.ts";
 import {
   COLLECTION_PROFILE_MANIFEST,
+  collectionProfileMismatch,
   type CollectionProfilePin,
   ensureCollectionProfileInstalled,
   installedCollectionProfile,
@@ -1683,10 +1684,21 @@ export interface LocalOutboxStatusOutput {
     observed: boolean | null;
     record_batches: number;
   };
-  /** Latest server-acknowledged typed terminal verdict, retained after outbox pruning. */
+  /**
+   * Latest server-acknowledged typed terminal verdict, retained after outbox
+   * pruning.
+   *
+   * - `covered`: every requested store collected, bound to the release this
+   *   device selects.
+   * - `incomplete`: bound to the selected release, but a store fell short.
+   * - `not_current`: acknowledged for another release, or with no release
+   *   binding, or this device selects no release. Says nothing about
+   *   completeness, so it is never read as `incomplete`.
+   * - `no_evidence`: no acknowledged typed verdict.
+   */
   terminal_coverage: {
     collection_boundary: string | null;
-    verdict: "covered" | "incomplete" | "no_evidence";
+    verdict: "covered" | "incomplete" | "not_current" | "no_evidence";
   };
   db: {
     configured: boolean;
@@ -1703,10 +1715,16 @@ export interface LocalOutboxStatusOutput {
   deployment_posture: LocalCollectorDeploymentPosture;
   /**
    * The single lifecycle state for this lane. Open work takes priority;
-   * a drained scoped lane is covered only after a v2 terminal ACK, and
-   * otherwise reports incomplete or no evidence.
+   * a drained scoped lane is covered only after a v2 terminal ACK for the
+   * selected release, and otherwise reports incomplete, not current, or no
+   * evidence.
    */
-  lifecycle_state: LocalCollectorLifecycleState | "covered" | "coverage_incomplete" | "no_evidence";
+  lifecycle_state:
+    | LocalCollectorLifecycleState
+    | "covered"
+    | "coverage_incomplete"
+    | "coverage_not_current"
+    | "no_evidence";
   outbox: {
     counts: {
       dead_letter: number;
@@ -1837,6 +1855,12 @@ export interface InspectLocalOutboxStatusDeps {
    * deterministic regardless of where the test process itself resolves from.
    */
   deploymentPosture?: LocalCollectorDeploymentPosture;
+  /**
+   * The release this device selects for the lane's connector. Defaults to the
+   * pinned release installed on this device (see {@link selectedCollectionRelease}).
+   * `null` means the device selects none, so no receipt can be current.
+   */
+  selectedRelease?: SelectedCollectionRelease | null;
 }
 
 export function inspectLocalOutboxStatus(
@@ -1854,14 +1878,22 @@ export function inspectLocalOutboxStatus(
     recordBatchCount,
     summary,
   });
-  const terminalVerdict = terminalCoverageVerdict(inspection.terminalCoverage);
+  const selectedRelease =
+    inspection.terminalCoverage === null
+      ? null
+      : deps.selectedRelease !== undefined
+        ? deps.selectedRelease
+        : selectedCollectionRelease(options.connector);
+  const terminalVerdict = terminalCoverageVerdict(inspection.terminalCoverage, selectedRelease);
   const lifecycleState =
     options.sourceInstanceId && (outboxLifecycleState === "healthy_idle" || outboxLifecycleState === "coverage_missing")
       ? terminalVerdict === "covered"
         ? "covered"
         : terminalVerdict === "incomplete"
           ? "coverage_incomplete"
-          : "no_evidence"
+          : terminalVerdict === "not_current"
+            ? "coverage_not_current"
+            : "no_evidence"
       : outboxLifecycleState;
   const deploymentPosture = deps.deploymentPosture ?? classifyLocalCollectorDeploymentPosture();
   return {
@@ -2051,7 +2083,7 @@ export function buildLocalOutboxDoctor(
         ? "warn"
         : status.terminal_coverage.verdict === "covered"
         ? "ok"
-        : status.terminal_coverage.verdict === "incomplete"
+        : status.terminal_coverage.verdict === "incomplete" || status.terminal_coverage.verdict === "not_current"
           ? "warn"
           : "unknown",
     deployment_posture: postureDisqualifiesEvidence ? "warn" : "ok",
@@ -2090,7 +2122,9 @@ export function buildLocalOutboxDoctor(
     remediation.push(
       staleScope
         ? "The latest acknowledged terminal verdict belongs to an older collection boundary. Re-run against the active scope before treating this lane as covered."
-        : "The latest acknowledged terminal verdict is incomplete; inspect the connector run diagnostics and re-run after resolving the missing store coverage."
+        : status.terminal_coverage.verdict === "not_current"
+          ? "The latest acknowledged terminal verdict was produced for a connector release other than the one this device selects, or for none. Re-run the collector on the selected release before treating this lane as covered."
+          : "The latest acknowledged terminal verdict is incomplete; inspect the connector run diagnostics and re-run after resolving the missing store coverage."
     );
   }
   if (checks.deployment_posture === "warn") {
@@ -3639,7 +3673,19 @@ interface LocalOutboxInspection {
   coverageObserved: boolean | null;
   recordBatchCount: number;
   summary: LocalDeviceOutboxSummary;
-  terminalCoverage: { collectionBoundary: string; terminalFacts: readonly { scoped: boolean; stores: readonly { status: string }[] }[] } | null;
+  terminalCoverage: { collectionBoundary: string; terminalFacts: readonly StoredTerminalFact[] } | null;
+}
+
+/**
+ * One terminal fact as the outbox returns it. The release fields are absent on
+ * a receipt acknowledged before the release binding existed, which then can
+ * never be current.
+ */
+interface StoredTerminalFact {
+  artifact_digest?: string;
+  manifest_fingerprint?: string;
+  scoped: boolean;
+  stores: readonly { status: string }[];
 }
 
 function readOutboxInspection(path: string, sourceInstanceId: string | undefined): LocalOutboxInspection {
@@ -3660,12 +3706,69 @@ function readOutboxInspection(path: string, sourceInstanceId: string | undefined
   }
 }
 
+/**
+ * The release this device selects for a connector: the digest pinned into this
+ * package, and the manifest fingerprint of the profile installed under that
+ * pin. A receipt counts as current only when its facts name exactly these.
+ */
+export interface SelectedCollectionRelease {
+  readonly artifactDigest: string;
+  readonly manifestFingerprint: string;
+}
+
+/**
+ * The release {@link prepareConnectorSpec} would run for `connector`, read
+ * without installing or fetching anything. Null when the connector is unpinned,
+ * or the installed profile is not the pinned one: no release can then be named
+ * as selected.
+ */
+export function selectedCollectionRelease(
+  connector: string | null | undefined,
+  installRoot: string = COLLECTION_PROFILE_ROOT
+): SelectedCollectionRelease | null {
+  const pin = connector ? PINS_BY_CONNECTOR.get(normalizeConnectorId(connector)) : undefined;
+  return pin ? selectedReleaseForPin(pin, installRoot) : null;
+}
+
+/**
+ * The release a pin selects, when its installed profile still passes the same
+ * check a run makes before using it. Reads local files only.
+ */
+export function selectedReleaseForPin(
+  pin: CollectionProfilePin,
+  installRoot: string
+): SelectedCollectionRelease | null {
+  const { directory } = installedCollectionProfile(installRoot, pin);
+  try {
+    if (collectionProfileMismatch(directory, pin) !== null) {
+      return null;
+    }
+    const profile = JSON.parse(readFileSync(join(directory, COLLECTION_PROFILE_MANIFEST), "utf8")) as unknown;
+    return { artifactDigest: pin.digest, manifestFingerprint: hashCanonicalJson(profile) };
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Covered is a claim about one release, so the release is checked before the
+ * stores. A receipt for another digest or fingerprint, or on a device that
+ * selects no release, is `not_current` whatever its stores say.
+ */
 function terminalCoverageVerdict(
-  receipt: LocalOutboxInspection["terminalCoverage"]
+  receipt: LocalOutboxInspection["terminalCoverage"],
+  release: SelectedCollectionRelease | null
 ): LocalOutboxStatusOutput["terminal_coverage"]["verdict"] {
   if (!receipt || !receipt.collectionBoundary.trim()) {
     return "no_evidence";
   }
+  const isSelectedRelease = (fact: StoredTerminalFact) =>
+    release !== null &&
+    fact.artifact_digest === release.artifactDigest &&
+    fact.manifest_fingerprint === release.manifestFingerprint;
+  if (!receipt.terminalFacts.every(isSelectedRelease)) {
+    return "not_current";
+  }
   return receipt.terminalFacts.length > 0 &&
     receipt.terminalFacts.every(
       (fact) => fact.scoped && fact.stores.length > 0 && fact.stores.every((store) => store.status === "collected")
diff --git a/packages/local-collector/test/selected-collection-release.test.ts b/packages/local-collector/test/selected-collection-release.test.ts
new file mode 100644
index 000000000..06072cb98
--- /dev/null
+++ b/packages/local-collector/test/selected-collection-release.test.ts
@@ -0,0 +1,90 @@
+// Copyright The PDP-Connect Contributors
+// SPDX-License-Identifier: Apache-2.0
+
+import assert from "node:assert/strict";
+import { createHash } from "node:crypto";
+import { mkdir, mkdtemp, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { after, test } from "node:test";
+
+import { hashCanonicalJson } from "@pdpp/collector-runtime";
+
+import { selectedCollectionRelease, selectedReleaseForPin } from "../bin/pdpp-local-collector.ts";
+import {
+  COLLECTION_PROFILE_ENTRYPOINT,
+  COLLECTION_PROFILE_MANIFEST,
+  type CollectionProfilePin,
+  installedCollectionProfile,
+} from "../src/managed/collection-profiles.ts";
+
+const createdRoots: string[] = [];
+after(async () => {
+  await Promise.all(createdRoots.map((root) => rm(root, { force: true, recursive: true })));
+});
+
+function sha256(bytes: Buffer): string {
+  return `sha256:${createHash("sha256").update(bytes).digest("hex")}`;
+}
+
+const PROFILE = {
+  connector_id: "fixture_connector",
+  run_coverage: { version: 1 },
+  streams: [{ coverage_stores: ["messages_store"], name: "messages" }],
+};
+const ENTRYPOINT = Buffer.from("export {};\n");
+
+/** A pin whose two sha256 values match the bytes {@link installFixtureRelease} writes. */
+function fixturePin(profileBytes: Buffer): CollectionProfilePin {
+  return {
+    connectorId: "fixture_connector",
+    connectorKey: "fixture-connector",
+    digest: `sha256:${"f".repeat(64)}`,
+    entrypointSha256: sha256(ENTRYPOINT),
+    profileSha256: sha256(profileBytes),
+    version: "0.0.0-test",
+  };
+}
+
+async function emptyInstallRoot(): Promise<string> {
+  const root = await mkdtemp(join(tmpdir(), "pdpp-selected-release-"));
+  createdRoots.push(root);
+  return root;
+}
+
+async function installFixtureRelease(profileBytes: Buffer): Promise<{ installRoot: string; pin: CollectionProfilePin }> {
+  const installRoot = await emptyInstallRoot();
+  const pin = fixturePin(Buffer.from(JSON.stringify(PROFILE)));
+  const { directory } = installedCollectionProfile(installRoot, pin);
+  await mkdir(join(directory, "profile"), { recursive: true });
+  await mkdir(join(directory, "dist"), { recursive: true });
+  await writeFile(join(directory, COLLECTION_PROFILE_MANIFEST), profileBytes);
+  await writeFile(join(directory, COLLECTION_PROFILE_ENTRYPOINT), ENTRYPOINT);
+  return { installRoot, pin };
+}
+
+test("an installed release that matches its pin is selected, bound to the pin digest and profile fingerprint", async () => {
+  const profileBytes = Buffer.from(JSON.stringify(PROFILE));
+  const { installRoot, pin } = await installFixtureRelease(profileBytes);
+  assert.deepEqual(selectedReleaseForPin(pin, installRoot), {
+    artifactDigest: pin.digest,
+    manifestFingerprint: hashCanonicalJson(PROFILE),
+  });
+});
+
+test("an installed profile that no longer hashes to its pin selects no release", async () => {
+  const { installRoot, pin } = await installFixtureRelease(Buffer.from(JSON.stringify({ ...PROFILE, streams: [] })));
+  assert.equal(selectedReleaseForPin(pin, installRoot), null);
+});
+
+test("a pin that is not installed selects no release", async () => {
+  const pin = fixturePin(Buffer.from(JSON.stringify(PROFILE)));
+  assert.equal(selectedReleaseForPin(pin, await emptyInstallRoot()), null);
+});
+
+test("an unpinned, absent, or uninstalled connector selects no release", async () => {
+  const installRoot = await emptyInstallRoot();
+  assert.equal(selectedCollectionRelease("gmail", installRoot), null);
+  assert.equal(selectedCollectionRelease(undefined, installRoot), null);
+  assert.equal(selectedCollectionRelease("claude-code", installRoot), null, "pinned but not installed");
+});

From ed9557601e61ff8c7c5686e99762a300226ae533 Mon Sep 17 00:00:00 2001
From: Tim Nunamaker <tnunamak@gmail.com>
Date: Thu, 22 Oct 2026 03:00:45 -0500
Subject: [PATCH 17/87] test(local-device): run coverage end to end through the
 real server

A fixture connector runs as a child process through the collector runner
into a reference server started with startServer. The owner reads the
projections over HTTP, and the device reads its outbox. The journey covers
a complete run, a run with one skipped item, a restored complete run, an
empty run, and a run the server rejects.

The checked-in release pins declare no run_coverage, so the journey
registers a fixture claude-code release through
__setLocalCollectorReleaseForTest, a test-only seam in the release registry.

Assisted-by: AI
Signed-off-by: Tim Nunamaker <tnunamak@gmail.com>
---
 .../server/local-collector-profiles.ts        |  24 +
 .../local-device-coverage-journey.test.ts     | 533 ++++++++++++++++++
 2 files changed, 557 insertions(+)
 create mode 100644 reference-implementation/test/local-device-coverage-journey.test.ts

diff --git a/reference-implementation/server/local-collector-profiles.ts b/reference-implementation/server/local-collector-profiles.ts
index a1c5828fa..fed99dcb7 100644
--- a/reference-implementation/server/local-collector-profiles.ts
+++ b/reference-implementation/server/local-collector-profiles.ts
@@ -37,6 +37,22 @@ export interface LocalCollectorRelease {
 const CONNECTOR_KEY = /^[a-z0-9][a-z0-9-]*$/;
 const ARTIFACT_DIGEST = /^sha256:[a-f0-9]{64}$/;
 
+const releaseOverrides = new Map<string, LocalCollectorRelease>();
+
+/**
+ * Test seam: serve `release` for `connectorKey` in place of its checked-in pin,
+ * or restore the pin when `release` is null. Production never calls it. The
+ * checked-in pins are the signed releases, so a test needs this to register a
+ * release that declares terminal coverage before any such pin exists.
+ */
+export function __setLocalCollectorReleaseForTest(connectorKey: string, release: LocalCollectorRelease | null): void {
+  if (release) {
+    releaseOverrides.set(connectorKey, release);
+  } else {
+    releaseOverrides.delete(connectorKey);
+  }
+}
+
 /**
  * The pinned profile for a canonical connector key, or `null` when the local
  * collector does not install that connector. Throws when the pinned file is
@@ -48,6 +64,10 @@ export function readLocalCollectorProfile(connectorKey: string): Record<string,
 
 /** The server's current OCI artifact identity for a local-device connector. */
 export function readLocalCollectorArtifactDigest(connectorKey: string): string | null {
+  const override = releaseOverrides.get(connectorKey);
+  if (override) {
+    return override.artifactDigest;
+  }
   try {
     return readPinnedProfile(connectorKey)?.digest ?? null;
   } catch {
@@ -58,6 +78,10 @@ export function readLocalCollectorArtifactDigest(connectorKey: string): string |
 
 /** The installed execution release as one atomically read, pin-verified pair. */
 export function readLocalCollectorRelease(connectorKey: string): LocalCollectorRelease | null {
+  const override = releaseOverrides.get(connectorKey);
+  if (override) {
+    return override;
+  }
   try {
     const pinned = readPinnedProfile(connectorKey);
     return pinned ? { artifactDigest: pinned.digest, manifest: pinned.profile } : null;
diff --git a/reference-implementation/test/local-device-coverage-journey.test.ts b/reference-implementation/test/local-device-coverage-journey.test.ts
new file mode 100644
index 000000000..e77ff32c5
--- /dev/null
+++ b/reference-implementation/test/local-device-coverage-journey.test.ts
@@ -0,0 +1,533 @@
+// Copyright The PDP-Connect Contributors
+// SPDX-License-Identifier: Apache-2.0
+
+// Journey J1 for local-device run coverage. It crosses real process and HTTP
+// boundaries:
+//
+//   fixture connector (child process, collector JSONL protocol)
+//     -> collector runner (runCollectorConnector)
+//     -> reference server (startServer: production routes, file SQLite,
+//        enrollment over HTTP, owner session login)
+//     -> owner projections read over HTTP, and the device outbox read with
+//        the device status command.
+//
+// Three substitutions, all about the release the lane runs. None changes what
+// the lane does with it:
+//
+//   - The checked-in claude-code pin declares no run_coverage, so no real
+//     release can emit a v2 proof yet. The test registers a fixture release
+//     that declares it: on the server through __setLocalCollectorReleaseForTest,
+//     and on the device through bindOptionalRunCoverageToRelease, as
+//     prepareConnectorSpec binds a pinned release.
+//   - Enrolment registers the eleven-stream claude-code catalog manifest. The
+//     journey narrows that entry to the release's two streams.
+//   - The owner routes read a summary read model that the server refreshes in
+//     the background. The journey refreshes it before each owner read, as the
+//     projection oracle does.
+//
+// Records, cursors and the terminal verdict all come from the child, through
+// the runner. The test seeds none of them.
+
+// The local-collector bin reaches the untyped installer core. This names the
+// local collector's own shim for it, which the reference-implementation program
+// does not otherwise include.
+/// <reference path="../../packages/local-collector/src/managed/installer-core.d.ts" />
+
+import assert from "node:assert/strict";
+import { createHash } from "node:crypto";
+import { mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { dirname, join } from "node:path";
+import { DatabaseSync } from "node:sqlite";
+import test from "node:test";
+
+import { hashCanonicalJson } from "@pdpp/collector-runtime";
+
+import {
+  bindOptionalRunCoverageToRelease,
+  inspectLocalOutboxStatus,
+  type LocalOutboxStatusOutput,
+  parseArgs,
+} from "../../packages/local-collector/bin/pdpp-local-collector.ts";
+import {
+  type CollectorConnectorSpec,
+  type CollectorRunResult,
+  runCollectorConnector,
+} from "../../packages/local-collector/src/runner.ts";
+import { COLLECTOR_PROTOCOL_VERSION } from "../server/collector-protocol.ts";
+import { reconcileDirtyConnectorSummaryEvidence } from "../server/connector-summary-read-model.ts";
+import { closeDb, getDb } from "../server/db.ts";
+import { startServer } from "../server/index.ts";
+import { __setLocalCollectorReleaseForTest } from "../server/local-collector-profiles.ts";
+
+const CONNECTOR_ID = "claude-code";
+const LOCAL_BINDING_NAME = "journey-laptop";
+const OWNER_PASSWORD = "local-coverage-journey-password";
+const STREAMS = ["sessions", "messages"];
+const PROTOCOL_HEADERS = { "X-PDPP-Collector-Protocol": COLLECTOR_PROTOCOL_VERSION };
+const CSRF_FIELD_PATTERN = /<input type="hidden" name="_csrf" value="([^"]+)"\s*\/>/;
+
+// The fixture release: a claude-code profile that declares run coverage for
+// both streams. The server registers it, and the device binds to it.
+const PROFILE = {
+  connector_id: CONNECTOR_ID,
+  run_coverage: { version: 1 },
+  streams: [
+    { coverage_stores: ["projects"], name: "sessions", primary_key: ["id"] },
+    { coverage_stores: ["derived_messages"], name: "messages", primary_key: ["id"] },
+  ],
+  version: "0.0.0-journey",
+};
+const ARTIFACT_DIGEST = `sha256:${createHash("sha256").update(JSON.stringify(PROFILE)).digest("hex")}`;
+const SERVER_RELEASE = { artifactDigest: ARTIFACT_DIGEST, manifest: PROFILE };
+const DEVICE_RELEASE = { artifactDigest: ARTIFACT_DIGEST, manifestFingerprint: hashCanonicalJson(PROFILE) };
+const PUBLISHED_POSTURE = Object.freeze({
+  is_placeholder_version: false,
+  kind: "published_package",
+  location_hint: "node_modules/@pdpp/local-collector",
+  module_basename: "pdpp-local-collector.js",
+  version: "0.1.0-beta.7",
+});
+
+// Offline fixture connector. It reads START, records what it was asked for, and
+// answers with protocol messages chosen by its mode. Written with no template
+// interpolation so it can sit inside this file as a plain string.
+const FIXTURE_CONNECTOR_SOURCE = `
+import { writeFileSync } from "node:fs";
+
+const [mode, observePath, tag] = process.argv.slice(2);
+let input = "";
+process.stdin.setEncoding("utf8");
+process.stdin.on("data", (chunk) => {
+  input += chunk;
+});
+process.stdin.on("end", () => {
+  const start = JSON.parse(input.split("\\n")[0]);
+  writeFileSync(observePath, JSON.stringify(start));
+  const emit = (message) => process.stdout.write(JSON.stringify(message) + "\\n");
+  const emittedAt = "2026-10-22T12:00:00.000Z";
+  const record = (stream, id) => emit({ data: { id }, emitted_at: emittedAt, key: id, stream, type: "RECORD" });
+  const coverage = {
+    collection_scope: start.collection_scope,
+    streams: [
+      { scoped: true, stores: [{ status: "collected", store: "projects" }], stream: "sessions" },
+      { scoped: true, stores: [{ status: "collected", store: "derived_messages" }], stream: "messages" },
+    ],
+    version: 1,
+  };
+  if (mode === "empty") {
+    emit({ records_emitted: 0, status: "succeeded", type: "DONE" });
+    return;
+  }
+  if (mode === "reject") {
+    // A stream the connector manifest does not declare: the server refuses the batch.
+    record("sessions", "s-1");
+    record("undeclared_stream", "u-1");
+    emit({ cursor: { cursor: tag + "-sessions" }, stream: "sessions", type: "STATE" });
+    emit({ coverage, records_emitted: 2, status: "succeeded", type: "DONE" });
+    return;
+  }
+  record("sessions", "s-1");
+  record("sessions", "s-2");
+  record("messages", "m-1");
+  emit({ cursor: { cursor: tag + "-sessions" }, stream: "sessions", type: "STATE" });
+  emit({ cursor: { cursor: tag + "-messages" }, stream: "messages", type: "STATE" });
+  if (mode === "skip") {
+    emit({ message: "one message could not be read", reason: "source_unreadable", stream: "messages", type: "SKIP_RESULT" });
+  }
+  emit({ coverage, records_emitted: 3, status: "succeeded", type: "DONE" });
+});
+`;
+
+interface JsonResponse {
+  readonly body: Record<string, unknown> | null;
+  readonly status: number;
+}
+
+interface Enrolled {
+  readonly connector_instance_id: string;
+  readonly device_id: string;
+  readonly device_token: string;
+  readonly source_instance_id: string;
+}
+
+interface Journey {
+  readonly asUrl: string;
+  readonly childPath: string;
+  readonly cookie: string;
+  readonly dir: string;
+  readonly enrolled: Enrolled;
+  readonly queuePath: string;
+}
+
+interface RunOutcome {
+  readonly observed: Record<string, unknown>;
+  readonly result: CollectorRunResult;
+}
+
+interface ProjectedStream {
+  readonly coverage_condition: string;
+  readonly stream: string;
+}
+
+interface OwnerConnectionRow {
+  readonly collection_report: readonly ProjectedStream[];
+  readonly connection_health: { readonly axes: { readonly coverage: string } };
+}
+
+async function requestJson(url: string, init: RequestInit = {}): Promise<JsonResponse> {
+  const resp = await fetch(url, { ...init, headers: { Accept: "application/json", ...init.headers } });
+  const text = await resp.text();
+  let body: Record<string, unknown> | null = null;
+  try {
+    body = JSON.parse(text) as Record<string, unknown>;
+  } catch {
+    // A non-JSON response keeps a null body; the status assertion reports it.
+  }
+  return { body, status: resp.status };
+}
+
+function postJson(url: string, body: unknown, headers: Record<string, string> = {}): Promise<JsonResponse> {
+  return requestJson(url, {
+    body: JSON.stringify(body),
+    headers: { "Content-Type": "application/json", ...headers },
+    method: "POST",
+  });
+}
+
+function setCookiePair(resp: Response, name: string): string | null {
+  for (const header of resp.headers.getSetCookie()) {
+    const [pair] = header.split(";");
+    if (pair?.startsWith(`${name}=`)) {
+      return pair;
+    }
+  }
+  return null;
+}
+
+async function ownerSessionCookie(asUrl: string): Promise<string> {
+  const page = await fetch(`${asUrl}/owner/login`, { headers: { Accept: "text/html" }, redirect: "manual" });
+  const csrfCookie = setCookiePair(page, "pdpp_owner_csrf") ?? "";
+  const csrfField = CSRF_FIELD_PATTERN.exec(await page.text())?.[1] ?? "";
+  const login = await fetch(`${asUrl}/owner/login`, {
+    body: new URLSearchParams({ _csrf: csrfField, password: OWNER_PASSWORD, return_to: "/" }).toString(),
+    headers: { Accept: "text/html", "Content-Type": "application/x-www-form-urlencoded", Cookie: csrfCookie },
+    method: "POST",
+    redirect: "manual",
+  });
+  const session = setCookiePair(login, "pdpp_owner_session");
+  assert.ok(session, `owner login should set pdpp_owner_session (status ${login.status})`);
+  return session;
+}
+
+async function enrollLaptop(asUrl: string, cookie: string): Promise<Enrolled> {
+  const code = await postJson(
+    `${asUrl}/_ref/device-exporters/enrollment-codes`,
+    { connector_id: CONNECTOR_ID, local_binding_name: LOCAL_BINDING_NAME },
+    { Cookie: cookie }
+  );
+  assert.equal(code.status, 201, JSON.stringify(code.body));
+  const enrolled = await postJson(
+    `${asUrl}/_ref/device-exporters/enroll`,
+    { enrollment_code: String(code.body?.enrollment_code) },
+    PROTOCOL_HEADERS
+  );
+  assert.equal(enrolled.status, 201, JSON.stringify(enrolled.body));
+  const body = enrolled.body ?? {};
+  return {
+    connector_instance_id: String(body.connector_instance_id),
+    device_id: String(body.device_id),
+    device_token: String(body.device_token),
+    source_instance_id: String(body.source_instance_id),
+  };
+}
+
+/**
+ * Enrolment registers the checked-in claude-code catalog manifest, which
+ * declares eleven streams. The journey's lane covers two. So the catalog entry
+ * is narrowed to the release's streams, keeping each declared stream as the
+ * catalog wrote it and taking the release's coverage stores. As a catalog
+ * update does, the manifest generation advances, so no earlier binding carries
+ * over.
+ */
+function registerFixtureManifest(connectorInstanceId: string): void {
+  const row = getDb().prepare("SELECT manifest FROM connectors WHERE connector_id = ?").get(CONNECTOR_ID) as
+    | { manifest: string }
+    | undefined;
+  assert.ok(row, "enrolment registers the claude-code catalog manifest");
+  const catalog = JSON.parse(row.manifest) as Record<string, unknown> & { streams: Record<string, unknown>[] };
+  const streams = PROFILE.streams.map((release) => {
+    const declared = catalog.streams.find((stream) => stream.name === release.name);
+    assert.ok(declared, `the catalog declares ${release.name}`);
+    return { ...declared, coverage_stores: release.coverage_stores };
+  });
+  getDb()
+    .prepare("UPDATE connectors SET manifest = ? WHERE connector_id = ?")
+    .run(JSON.stringify({ ...catalog, streams }), CONNECTOR_ID);
+  getDb()
+    .prepare(
+      "UPDATE connector_instances SET manifest_generation = manifest_generation + 1 WHERE connector_instance_id = ?"
+    )
+    .run(connectorInstanceId);
+}
+
+async function closeServer(server: Awaited<ReturnType<typeof startServer>>): Promise<void> {
+  const closeOne = (srv: { close: (callback: () => void) => void; closeAllConnections?: () => void }) =>
+    new Promise<void>((resolve) => {
+      srv.closeAllConnections?.();
+      const timer = setTimeout(resolve, 2000);
+      srv.close(() => {
+        clearTimeout(timer);
+        resolve();
+      });
+    });
+  await Promise.allSettled([closeOne(server.asServer), closeOne(server.rsServer)]);
+}
+
+async function withJourney(run: (journey: Journey) => Promise<void>): Promise<void> {
+  const dir = await mkdtemp(join(tmpdir(), "pdpp-local-coverage-journey-"));
+  const childPath = join(dir, "fixture-connector.mjs");
+  await writeFile(childPath, FIXTURE_CONNECTOR_SOURCE);
+  const server = await startServer({
+    asPort: 0,
+    dbPath: join(dir, "pdpp.sqlite"),
+    ownerAuthPassword: OWNER_PASSWORD,
+    quiet: true,
+    rsPort: 0,
+  });
+  const asUrl = `http://localhost:${server.asPort}`;
+  __setLocalCollectorReleaseForTest(CONNECTOR_ID, SERVER_RELEASE);
+  try {
+    const cookie = await ownerSessionCookie(asUrl);
+    const enrolled = await enrollLaptop(asUrl, cookie);
+    registerFixtureManifest(enrolled.connector_instance_id);
+    await run({ asUrl, childPath, cookie, dir, enrolled, queuePath: join(dir, "outbox.sqlite") });
+  } finally {
+    __setLocalCollectorReleaseForTest(CONNECTOR_ID, null);
+    await closeServer(server);
+    closeDb();
+    await rm(dir, { force: true, recursive: true });
+  }
+}
+
+async function runOnce(journey: Journey, mode: string, tag: string): Promise<RunOutcome> {
+  const observePath = join(journey.dir, `start-${tag}.json`);
+  const connector: CollectorConnectorSpec = bindOptionalRunCoverageToRelease(
+    {
+      args: [journey.childPath, mode, observePath, tag],
+      command: process.execPath,
+      connector_id: CONNECTOR_ID,
+      protocol_capabilities: [],
+      runtime_requirements: { bindings: {} },
+      streams: STREAMS,
+    },
+    { digest: ARTIFACT_DIGEST },
+    PROFILE
+  );
+  const result = await runCollectorConnector({
+    baseUrl: journey.asUrl,
+    connector,
+    deviceId: journey.enrolled.device_id,
+    deviceToken: journey.enrolled.device_token,
+    executionRoot: dirname(journey.childPath),
+    outboxPolicy: { maxDrainIterations: 1, retryBackoffMs: 1 },
+    queuePath: journey.queuePath,
+    runId: tag,
+    sourceInstanceId: journey.enrolled.source_instance_id,
+  });
+  return { observed: JSON.parse(await readFile(observePath, "utf8")) as Record<string, unknown>, result };
+}
+
+function deviceStatus(journey: Journey): LocalOutboxStatusOutput {
+  return inspectLocalOutboxStatus(
+    parseArgs([
+      "status",
+      "--queue",
+      journey.queuePath,
+      "--source-instance-id",
+      journey.enrolled.source_instance_id,
+      "--connector",
+      CONNECTOR_ID,
+    ]),
+    { deploymentPosture: PUBLISHED_POSTURE, selectedRelease: DEVICE_RELEASE }
+  );
+}
+
+/** The terminal facts the device acknowledged and stored as its current receipt. */
+function deviceReceiptFacts(journey: Journey): Record<string, unknown>[] {
+  const db = new DatabaseSync(journey.queuePath);
+  try {
+    const row = db
+      .prepare("SELECT terminal_facts_json FROM local_device_terminal_coverage_receipts WHERE source_instance_id = ?")
+      .get(journey.enrolled.source_instance_id) as { terminal_facts_json: string } | undefined;
+    return row ? (JSON.parse(row.terminal_facts_json) as Record<string, unknown>[]) : [];
+  } finally {
+    db.close();
+  }
+}
+
+/** The per-stream facts the server stored for one terminal commit, or null when none was committed. */
+function serverRunStreams(runId: string): Record<string, unknown>[] | null {
+  const row = getDb().prepare("SELECT facts_json FROM run_history WHERE run_id = ?").get(runId) as
+    | { facts_json: string }
+    | undefined;
+  if (!row) {
+    return null;
+  }
+  const facts = JSON.parse(row.facts_json) as { collection_facts?: { streams?: Record<string, unknown>[] } };
+  return facts.collection_facts?.streams ?? [];
+}
+
+/** The source generation terminal commits bind to, as the server stores it for this lane. */
+function sourceGeneration(journey: Journey): number {
+  const row = getDb()
+    .prepare("SELECT manifest_generation FROM device_source_instances WHERE source_instance_id = ?")
+    .get(journey.enrolled.source_instance_id) as { manifest_generation: number | null } | undefined;
+  assert.ok(row && row.manifest_generation !== null, "the source instance carries a manifest generation");
+  return Number(row.manifest_generation);
+}
+
+function serverRecordCount(journey: Journey, stream: string): number {
+  const row = getDb()
+    .prepare("SELECT COUNT(*) AS n FROM records WHERE connector_instance_id = ? AND stream = ?")
+    .get(journey.enrolled.connector_instance_id, stream) as { n: number };
+  return row.n;
+}
+
+/** Stream cursors only. The `$`-prefixed rows are the server's own collection-scope state, not connector cursors. */
+function serverCursors(journey: Journey): Record<string, unknown> {
+  const rows = getDb()
+    .prepare("SELECT stream, state_json FROM connector_state WHERE connector_instance_id = ? ORDER BY stream")
+    .all(journey.enrolled.connector_instance_id) as Array<{ state_json: string; stream: string }>;
+  return Object.fromEntries(
+    rows.filter((row) => !row.stream.startsWith("$")).map((row) => [row.stream, JSON.parse(row.state_json) as unknown])
+  );
+}
+
+async function ownerConnectionRow(journey: Journey): Promise<OwnerConnectionRow> {
+  // The owner routes read a summary read model that the server refreshes from
+  // dirty evidence in the background. Refresh it here, as the projection oracle
+  // does, so the read reflects the terminal commit just made.
+  await reconcileDirtyConnectorSummaryEvidence(null);
+  const list = await requestJson(`${journey.asUrl}/_ref/connectors?limit=100`, { headers: { Cookie: journey.cookie } });
+  assert.equal(list.status, 200, JSON.stringify(list.body));
+  const rows = (list.body?.data ?? []) as Record<string, unknown>[];
+  const row = rows.find((candidate) => candidate.connection_id === journey.enrolled.connector_instance_id);
+  assert.ok(row, "the owner list projects the enrolled connection");
+  // The detail route is keyed by connector; each lane here holds one connection.
+  const detail = await requestJson(`${journey.asUrl}/_ref/connectors/${CONNECTOR_ID}`, {
+    headers: { Cookie: journey.cookie },
+  });
+  assert.equal(detail.status, 200, JSON.stringify(detail.body));
+  assert.deepEqual(detail.body?.collection_report, row.collection_report, "list and detail agree");
+  return row as unknown as OwnerConnectionRow;
+}
+
+function conditions(row: OwnerConnectionRow): Record<string, string> {
+  return Object.fromEntries(row.collection_report.map((entry) => [entry.stream, entry.coverage_condition]));
+}
+
+test("J1: a registered release's run coverage crosses child, runner, server and device intact", async () => {
+  await withJourney(async (journey) => {
+    // Run A: every requested store collected, and the start asks for coverage.
+    const a = await runOnce(journey, "complete", "a-complete");
+    assert.equal(a.observed.run_coverage_version, 1, "START asked the child for run coverage");
+    assert.equal(a.result.done?.status, "succeeded");
+    assert.equal(a.result.statePutFailed, false);
+    assert.equal(serverRecordCount(journey, "sessions"), 2);
+    assert.equal(serverRecordCount(journey, "messages"), 1);
+    assert.deepEqual(serverCursors(journey), {
+      messages: { cursor: "a-complete-messages" },
+      sessions: { cursor: "a-complete-sessions" },
+    });
+    const aStreams = serverRunStreams("a-complete");
+    assert.ok(aStreams, "the server committed the terminal run");
+    assert.deepEqual(
+      aStreams.map((stream) => stream.stream),
+      ["messages", "sessions"],
+      "every requested stream is in the committed facts"
+    );
+    for (const stream of aStreams) {
+      assert.equal(stream.artifact_digest, ARTIFACT_DIGEST);
+      assert.equal(stream.manifest_fingerprint, DEVICE_RELEASE.manifestFingerprint);
+      assert.equal(stream.binding_generation, sourceGeneration(journey), "bound to the source generation");
+    }
+    const aOwner = await ownerConnectionRow(journey);
+    assert.equal(aOwner.connection_health.axes.coverage, "complete");
+    assert.deepEqual(conditions(aOwner), { messages: "complete", sessions: "complete" });
+    const aDevice = deviceStatus(journey);
+    assert.equal(aDevice.terminal_coverage.verdict, "covered");
+    assert.equal(aDevice.lifecycle_state, "covered");
+    const aReceipt = deviceReceiptFacts(journey);
+    assert.equal(aReceipt.length, 2, "the device holds a receipt for both streams");
+    assert.ok(
+      aReceipt.every(
+        (fact) =>
+          fact.artifact_digest === ARTIFACT_DIGEST && fact.manifest_fingerprint === DEVICE_RELEASE.manifestFingerprint
+      ),
+      "the device receipt names the release it selects"
+    );
+
+    // Run B: one SKIP_RESULT, and a DONE that still claims every store collected.
+    const b = await runOnce(journey, "skip", "b-skip");
+    assert.equal(b.result.done?.status, "succeeded");
+    const bStreams = serverRunStreams("b-skip");
+    assert.ok(bStreams, "the skipped run still commits its terminal evidence");
+    const messages = bStreams.find((stream) => stream.stream === "messages");
+    assert.ok(messages, "the server reports the messages stream");
+    const bAccounting = messages.runtime_accounting as Record<string, unknown>;
+    assert.equal(bAccounting.detail_complete, false);
+    assert.ok(Number(bAccounting.outstanding_debt) >= 1, "the skip is outstanding debt");
+    assert.deepEqual(messages.stores, [{ status: "partial", store: "derived_messages" }]);
+    const bOwner = await ownerConnectionRow(journey);
+    assert.notEqual(conditions(bOwner).messages, "complete", "the skipped stream is not complete on the server");
+    assert.equal(conditions(bOwner).sessions, "complete", "the stream without a skip stays complete");
+    const bDevice = deviceStatus(journey);
+    assert.equal(bDevice.terminal_coverage.verdict, "incomplete");
+    assert.equal(bDevice.lifecycle_state, "coverage_incomplete");
+    const bReceipt = deviceReceiptFacts(journey).find((fact) => fact.stream === "messages");
+    assert.deepEqual(bReceipt?.stores, [{ status: "partial", store: "derived_messages" }]);
+
+    // Run A again: a clean run restores complete coverage on both sides.
+    const restored = await runOnce(journey, "complete", "a-restored");
+    assert.equal(restored.result.done?.status, "succeeded");
+    assert.equal((await ownerConnectionRow(journey)).connection_health.axes.coverage, "complete");
+    assert.equal(deviceStatus(journey).lifecycle_state, "covered");
+
+    // Run C: a negotiated success with no coverage claim and no records.
+    const c = await runOnce(journey, "empty", "c-empty");
+    assert.equal(c.observed.run_coverage_version, 1);
+    assert.equal(c.result.done?.status, "succeeded");
+    const cStreams = serverRunStreams("c-empty");
+    assert.ok(cStreams, "the empty v2 report is acknowledged by the server");
+    assert.ok(
+      cStreams.every((stream) => JSON.stringify(stream.coverage_statuses) === '["unknown"]'),
+      "the empty report commits unknown inventory, not collected stores"
+    );
+    const cOwner = await ownerConnectionRow(journey);
+    assert.equal(cOwner.connection_health.axes.coverage, "unknown", "the empty report retires the earlier proof");
+    assert.deepEqual(conditions(cOwner), { messages: "unknown", sessions: "unknown" });
+    const cDevice = deviceStatus(journey);
+    assert.equal(cDevice.terminal_coverage.verdict, "no_evidence");
+    assert.equal(cDevice.lifecycle_state, "no_evidence");
+    assert.deepEqual(deviceReceiptFacts(journey), []);
+  });
+});
+
+test("B2: a server-rejected record stays unadmitted, moves no cursor, and leaves the lane not covered", async () => {
+  await withJourney(async (journey) => {
+    const outcome = await runOnce(journey, "reject", "reject-1");
+    const summary = outcome.result.outboxSummary;
+    assert.ok(
+      summary.ready + summary.retrying + summary.leased + summary.deadLetter > 0,
+      "the record batch was not durably admitted"
+    );
+    assert.equal(serverRecordCount(journey, "sessions"), 0, "the rejected batch wrote no record");
+    assert.deepEqual(serverCursors(journey), {}, "no cursor advanced");
+    assert.equal(serverRunStreams("reject-1"), null, "no terminal commit was acknowledged");
+    const status = deviceStatus(journey);
+    assert.equal(status.terminal_coverage.verdict, "no_evidence");
+    assert.notEqual(status.lifecycle_state, "covered");
+    assert.deepEqual(deviceReceiptFacts(journey), []);
+  });
+});

From f80388df48e7986ed370252b30661cfbf8199d01 Mon Sep 17 00:00:00 2001
From: Tim Nunamaker <tnunamak@gmail.com>
Date: Thu, 22 Oct 2026 03:31:33 -0500
Subject: [PATCH 18/87] test(local-collector): cover unadmitted runs and
 unclean accounting in the device verdict

The device verdict read only the latest acknowledged receipt. Two gaps:

- After a covered run, a later run whose record batch the server refuses
  still read covered while the lane was draining. The later run's terminal
  commit waits behind that batch and is never admitted.
- A receipt whose stores all read collected was covered even when its runtime
  accounting showed debt or a refused checkpoint. The server withholds
  collected for the same facts.

Add failing unit tests for both. Add a journey in which the server refuses a
run after a covered run. It asserts the device verdict is unadmitted. It also
pins the owner projection: the server holds no run record for the refused run,
so it keeps the earlier admitted coverage and shows the outbox as active.

The next commit makes these pass.

Assisted-by: AI
Signed-off-by: Tim Nunamaker <tnunamak@gmail.com>
---
 packages/local-collector/test/runner.test.ts  | 166 +++++++++++++++++-
 .../local-device-coverage-journey.test.ts     |  34 +++-
 2 files changed, 192 insertions(+), 8 deletions(-)

diff --git a/packages/local-collector/test/runner.test.ts b/packages/local-collector/test/runner.test.ts
index a1942d980..f36e50e88 100644
--- a/packages/local-collector/test/runner.test.ts
+++ b/packages/local-collector/test/runner.test.ts
@@ -2563,10 +2563,10 @@ function enqueueRecordBatch(outbox, { id, sourceInstanceId = "src-1", streams })
   });
 }
 
-/** Claim + acknowledge a row so it reaches status 'succeeded' (drained). */
+/** Claim + acknowledge the next ready row, which must be `id`, so it reaches status 'succeeded' (drained). */
 function drainRow(outbox, id, sourceInstanceId = "src-1") {
-  const [claim] = outbox.claimReady({ holder: "drainer", leaseMs: 60_000, sourceInstanceId });
-  assert.ok(claim, `expected to claim a ready row for ${id}`);
+  const [claim] = outbox.claimReady({ holder: "drainer", leaseMs: 60_000, limit: 1, sourceInstanceId });
+  assert.equal(claim?.id, id, `expected ${id} to be the next ready row`);
   outbox.acknowledge({ holder: "drainer", id: claim.id, leaseEpoch: claim.lease_epoch });
 }
 
@@ -2586,9 +2586,27 @@ function releaseBinding(release) {
   return release ? { artifact_digest: release.artifactDigest, manifest_fingerprint: release.manifestFingerprint } : {};
 }
 
-function acknowledgeTerminalCoverage(
+/** The runtime accounting the collector attaches to a v2 fact for a run that ran clean. */
+const CLEAN_ACCOUNTING = Object.freeze({
+  checkpoint_eligible: true,
+  detail_complete: true,
+  durable_admission: true,
+  outstanding_debt: 0,
+  stream_evidence_consistent: true,
+});
+
+/** Enqueue a terminal run commit without draining it. `accounting: null` models a v2 fact with none. */
+function enqueueTerminalCoverage(
   outbox,
-  { id, sourceInstanceId = "src-1", stores, scoped = true, version = 2, release = SELECTED_RELEASE }
+  {
+    id,
+    sourceInstanceId = "src-1",
+    stores,
+    scoped = true,
+    version = 2,
+    release = SELECTED_RELEASE,
+    accounting = CLEAN_ACCOUNTING,
+  }
 ) {
   outbox.enqueue({
     id,
@@ -2603,13 +2621,25 @@ function acknowledgeTerminalCoverage(
       source_instance_id: sourceInstanceId,
       state_delta: {},
       terminal_facts: version === 2
-        ? [{ ...releaseBinding(release), scoped, stores, stream: "sessions" }]
+        ? [
+            {
+              ...releaseBinding(release),
+              ...(accounting ? { runtime_accounting: accounting } : {}),
+              scoped,
+              stores,
+              stream: "sessions",
+            },
+          ]
         : [{ coverage_statuses: ["collected"], stream: "sessions" }],
       version,
     },
     sourceInstanceId,
   });
-  drainRow(outbox, id, sourceInstanceId);
+}
+
+function acknowledgeTerminalCoverage(outbox, options) {
+  enqueueTerminalCoverage(outbox, options);
+  drainRow(outbox, options.id, options.sourceInstanceId ?? "src-1");
 }
 
 test("acknowledged v2 coverage stays covered after sent rows are pruned", async () => {
@@ -2691,6 +2721,128 @@ test("a later v1 terminal ACK clears prior v2 coverage proof", async () => {
   assert.equal(status.lifecycle_state, "no_evidence");
 });
 
+// The collector's own accounting can contradict a store that reads collected:
+// the server withholds collected for these facts, so the device must not read
+// the receipt as covered either.
+for (const [field, value] of [
+  ["durable_admission", false],
+  ["detail_complete", false],
+  ["stream_evidence_consistent", false],
+  ["checkpoint_eligible", false],
+  ["outstanding_debt", 1],
+]) {
+  test(`v2 receipt with runtime ${field} ${value} is incomplete, even when every store is collected`, async () => {
+    const path = await tempOutboxPath();
+    const outbox = new LocalDeviceOutbox({ path });
+    try {
+      acknowledgeTerminalCoverage(outbox, {
+        id: `terminal-unclean-${field}`,
+        accounting: { ...CLEAN_ACCOUNTING, [field]: value },
+        stores: [{ store: "local_files", status: "collected" }],
+      });
+      outbox.pruneSent({ dryRun: false, keepCount: 0, sourceInstanceId: "src-1" });
+    } finally {
+      outbox.close();
+    }
+    const status = statusFor(path);
+    assert.equal(status.terminal_coverage.verdict, "incomplete");
+    assert.equal(status.lifecycle_state, "coverage_incomplete");
+    assert.equal(buildLocalOutboxDoctor(status).checks.terminal_coverage, "warn");
+  });
+}
+
+test("v2 receipt without runtime accounting reads no_evidence, even when every store is collected", async () => {
+  const path = await tempOutboxPath();
+  const outbox = new LocalDeviceOutbox({ path });
+  try {
+    acknowledgeTerminalCoverage(outbox, {
+      id: "terminal-no-accounting",
+      accounting: null,
+      stores: [{ store: "local_files", status: "collected" }],
+    });
+    outbox.pruneSent({ dryRun: false, keepCount: 0, sourceInstanceId: "src-1" });
+  } finally {
+    outbox.close();
+  }
+  const status = statusFor(path);
+  assert.equal(status.terminal_coverage.verdict, "no_evidence");
+  assert.equal(status.lifecycle_state, "no_evidence");
+});
+
+// A covered receipt is proof for the run that wrote it. A later run whose record
+// batch the server refuses is not admitted, and its terminal commit waits behind
+// that batch, so the device must not keep reporting the older run's proof.
+test("a later run whose record batch stays ready makes an earlier covered receipt unadmitted", async () => {
+  const path = await tempOutboxPath();
+  const outbox = new LocalDeviceOutbox({ path });
+  try {
+    acknowledgeTerminalCoverage(outbox, {
+      id: "terminal-run-a",
+      stores: [{ store: "local_files", status: "collected" }],
+    });
+    enqueueRecordBatch(outbox, { id: "rb-run-b", streams: ["sessions"] });
+    enqueueTerminalCoverage(outbox, { id: "terminal-run-b", stores: [{ store: "local_files", status: "collected" }] });
+  } finally {
+    outbox.close();
+  }
+  const status = statusFor(path);
+  assert.equal(status.terminal_coverage.verdict, "unadmitted");
+  assert.equal(status.lifecycle_state, "draining");
+  assert.equal(buildLocalOutboxDoctor(status).checks.terminal_coverage, "warn");
+});
+
+test("a later run whose record batch is dead-lettered makes an earlier covered receipt unadmitted", async () => {
+  const path = await tempOutboxPath();
+  const outbox = new LocalDeviceOutbox({ path });
+  try {
+    acknowledgeTerminalCoverage(outbox, {
+      id: "terminal-run-a",
+      stores: [{ store: "local_files", status: "collected" }],
+    });
+    enqueueRecordBatch(outbox, { id: "rb-run-b", streams: ["sessions"] });
+    const [claim] = outbox.claimReady({ holder: "drainer", leaseMs: 60_000, limit: 1, sourceInstanceId: "src-1" });
+    outbox.deadLetter({ error: "refused", holder: "drainer", id: claim.id, leaseEpoch: claim.lease_epoch });
+  } finally {
+    outbox.close();
+  }
+  const status = statusFor(path);
+  assert.equal(status.terminal_coverage.verdict, "unadmitted");
+  assert.equal(status.lifecycle_state, "dead_letter");
+});
+
+test("open record work without an acknowledged receipt stays no_evidence", async () => {
+  const path = await tempOutboxPath();
+  const outbox = new LocalDeviceOutbox({ path });
+  try {
+    enqueueRecordBatch(outbox, { id: "rb-first-run", streams: ["sessions"] });
+  } finally {
+    outbox.close();
+  }
+  const status = statusFor(path);
+  assert.equal(status.terminal_coverage.verdict, "no_evidence");
+  assert.equal(status.lifecycle_state, "draining");
+});
+
+test("a covered verdict returns once the later run's commit is acknowledged clean", async () => {
+  const path = await tempOutboxPath();
+  const outbox = new LocalDeviceOutbox({ path });
+  try {
+    acknowledgeTerminalCoverage(outbox, {
+      id: "terminal-run-a",
+      stores: [{ store: "local_files", status: "collected" }],
+    });
+    enqueueRecordBatch(outbox, { id: "rb-run-b", streams: ["sessions"] });
+    enqueueTerminalCoverage(outbox, { id: "terminal-run-b", stores: [{ store: "local_files", status: "collected" }] });
+    drainRow(outbox, "rb-run-b");
+    drainRow(outbox, "terminal-run-b");
+  } finally {
+    outbox.close();
+  }
+  const status = statusFor(path);
+  assert.equal(status.terminal_coverage.verdict, "covered");
+  assert.equal(status.lifecycle_state, "covered");
+});
+
 // A receipt is current only for the release this device selects. Each case is
 // a receipt acknowledged for another release, or for none, while every store
 // reads collected: it must not be reported as covered.
diff --git a/reference-implementation/test/local-device-coverage-journey.test.ts b/reference-implementation/test/local-device-coverage-journey.test.ts
index e77ff32c5..ed4bc51b8 100644
--- a/reference-implementation/test/local-device-coverage-journey.test.ts
+++ b/reference-implementation/test/local-device-coverage-journey.test.ts
@@ -172,7 +172,7 @@ interface ProjectedStream {
 
 interface OwnerConnectionRow {
   readonly collection_report: readonly ProjectedStream[];
-  readonly connection_health: { readonly axes: { readonly coverage: string } };
+  readonly connection_health: { readonly axes: { readonly coverage: string; readonly outbox: string } };
 }
 
 async function requestJson(url: string, init: RequestInit = {}): Promise<JsonResponse> {
@@ -531,3 +531,35 @@ test("B2: a server-rejected record stays unadmitted, moves no cursor, and leaves
     assert.deepEqual(deviceReceiptFacts(journey), []);
   });
 });
+
+test("J2: a run the server rejects after a covered run leaves the lane not covered", async () => {
+  await withJourney(async (journey) => {
+    // Run A: a clean complete run. The device holds a covered receipt and the server projects complete.
+    const a = await runOnce(journey, "complete", "a-complete");
+    assert.equal(a.result.done?.status, "succeeded");
+    assert.equal(deviceStatus(journey).terminal_coverage.verdict, "covered");
+    assert.equal((await ownerConnectionRow(journey)).connection_health.axes.coverage, "complete");
+
+    // Run B: the server refuses its record batch (an undeclared stream), so nothing from B is admitted.
+    // The batch stays ready for retry and run B's terminal commit waits behind it, so the server never
+    // receives a terminal commit for run B.
+    const b = await runOnce(journey, "reject", "b-reject");
+    assert.equal(b.result.done?.status, "succeeded", "the child finished; the server refused its batch");
+    assert.equal(serverRunStreams("b-reject"), null, "the server acknowledged no terminal commit for run B");
+    assert.equal(serverRecordCount(journey, "sessions"), 2, "the rejected batch wrote no record; run A's remain");
+
+    // The device no longer stands behind run A's receipt for the lane: its latest run is unadmitted.
+    const status = deviceStatus(journey);
+    assert.equal(status.terminal_coverage.verdict, "unadmitted");
+    assert.equal(status.lifecycle_state, "draining");
+
+    // The server never learns of run B as a run: nothing from B was admitted and its terminal commit never
+    // arrived, so the server holds no run-level record for B. Its coverage still reflects run A's admitted
+    // terminal commit, and its outbox axis shows the lane has not drained. Only the device reports run B as
+    // unadmitted.
+    const owner = await ownerConnectionRow(journey);
+    assert.equal(owner.connection_health.axes.coverage, "complete");
+    assert.deepEqual(conditions(owner), { messages: "complete", sessions: "complete" });
+    assert.equal(owner.connection_health.axes.outbox, "active");
+  });
+});

From db3d295c1811c00b71fc7cc867813021b47a7025 Mon Sep 17 00:00:00 2001
From: Tim Nunamaker <tnunamak@gmail.com>
Date: Thu, 22 Oct 2026 03:31:40 -0500
Subject: [PATCH 19/87] fix(local-collector): read unadmitted runs and unclean
 accounting as not covered

terminal_coverage.verdict now reads `unadmitted` while the lane holds open
outbox work (queued, leased or dead-lettered) after the acknowledged receipt.
That work belongs to a later run whose terminal commit has not been admitted,
so the receipt no longer stands for the lane.

`covered` also requires the receipt's runtime accounting to be clean: durable
admission, complete detail, consistent stream evidence, checkpoint eligibility
and zero outstanding debt. These are the facts the server checks before it
withholds `collected`. A measured gap reads `incomplete`. Missing or malformed
accounting reads `no_evidence`, as the server treats it as unknown.

Lifecycle states do not change for open work: the outbox state already shows
there. The coverage evidence note now states the device verdict rules.

Assisted-by: AI
Signed-off-by: Tim Nunamaker <tnunamak@gmail.com>
---
 docs/261021-local-device-coverage-evidence.md |  2 +
 .../bin/pdpp-local-collector.ts               | 96 ++++++++++++++++---
 2 files changed, 83 insertions(+), 15 deletions(-)

diff --git a/docs/261021-local-device-coverage-evidence.md b/docs/261021-local-device-coverage-evidence.md
index 65a0eb8fa..2469cb669 100644
--- a/docs/261021-local-device-coverage-evidence.md
+++ b/docs/261021-local-device-coverage-evidence.md
@@ -36,6 +36,8 @@ The collector validates the typed field before accepting it. It carries store ID
 
 The collector stores the latest acknowledged v2 receipt in local outbox schema v5, outside prunable outbox rows. A later acknowledged v1 commit removes that receipt. Offline status can describe the receipt's measured boundary; doctor compares it with the active owner boundary. The server read model must make the same boundary comparison before showing positive connection coverage.
 
+The device verdict (`pdpp-local-collector status`, `terminal_coverage.verdict`) is `covered` only when the receipt names the selected release, every store is `collected`, and the run's runtime accounting is clean: durable admission, complete detail, consistent stream evidence, checkpoint eligibility, and zero outstanding debt. Clean accounting is the same test the server applies before it withholds `collected`. Missing or malformed accounting reads `no_evidence`; a measured gap reads `incomplete`. Open outbox work for the lane (queued, leased or dead-lettered) reads `unadmitted`, because the latest run has not reached a durable terminal commit and the receipt no longer stands for it.
+
 ## Collection Profile amendment
 
 The canonical Collection Profile is `data-connectors/docs/spec/collection-profile.md`. [Data-connectors PR #541](https://github.com/PDP-Connect/data-connectors/pull/541), stacked on #516, specifies the optional START capability, stream store declarations, terminal store collection evidence, and its relationship to detail accounting and checkpoint eligibility. Data-connectors #539 and this PR implement the amendment. The owner approves it at merge.
diff --git a/packages/local-collector/bin/pdpp-local-collector.ts b/packages/local-collector/bin/pdpp-local-collector.ts
index 9a3ab6fd9..5a6793531 100644
--- a/packages/local-collector/bin/pdpp-local-collector.ts
+++ b/packages/local-collector/bin/pdpp-local-collector.ts
@@ -1689,16 +1689,21 @@ export interface LocalOutboxStatusOutput {
    * pruning.
    *
    * - `covered`: every requested store collected, bound to the release this
-   *   device selects.
-   * - `incomplete`: bound to the selected release, but a store fell short.
+   *   device selects, and the run's runtime accounting is clean.
+   * - `incomplete`: bound to the selected release, but a store fell short or
+   *   the runtime accounting shows outstanding debt.
+   * - `unadmitted`: the lane holds open outbox work (queued, leased or
+   *   dead-lettered), so the latest run has not reached a durable terminal
+   *   commit. The acknowledged verdict above does not stand for that run.
    * - `not_current`: acknowledged for another release, or with no release
    *   binding, or this device selects no release. Says nothing about
    *   completeness, so it is never read as `incomplete`.
-   * - `no_evidence`: no acknowledged typed verdict.
+   * - `no_evidence`: no acknowledged typed verdict, or one whose runtime
+   *   accounting is missing or malformed.
    */
   terminal_coverage: {
     collection_boundary: string | null;
-    verdict: "covered" | "incomplete" | "not_current" | "no_evidence";
+    verdict: "covered" | "incomplete" | "unadmitted" | "not_current" | "no_evidence";
   };
   db: {
     configured: boolean;
@@ -1884,7 +1889,12 @@ export function inspectLocalOutboxStatus(
       : deps.selectedRelease !== undefined
         ? deps.selectedRelease
         : selectedCollectionRelease(options.connector);
-  const terminalVerdict = terminalCoverageVerdict(inspection.terminalCoverage, selectedRelease);
+  // Any open work for the lane (queued, leased or dead-lettered) is work the
+  // acknowledged receipt does not account for: the latest run has not reached
+  // a durable terminal commit. Open work also keeps the outbox lifecycle
+  // non-idle, so `unadmitted` never reaches the lifecycle mapping below.
+  const latestRunOpen = summary.ready + summary.leased + summary.deadLetter > 0;
+  const terminalVerdict = terminalCoverageVerdict(inspection.terminalCoverage, selectedRelease, latestRunOpen);
   const lifecycleState =
     options.sourceInstanceId && (outboxLifecycleState === "healthy_idle" || outboxLifecycleState === "coverage_missing")
       ? terminalVerdict === "covered"
@@ -2083,7 +2093,9 @@ export function buildLocalOutboxDoctor(
         ? "warn"
         : status.terminal_coverage.verdict === "covered"
         ? "ok"
-        : status.terminal_coverage.verdict === "incomplete" || status.terminal_coverage.verdict === "not_current"
+        : status.terminal_coverage.verdict === "incomplete" ||
+            status.terminal_coverage.verdict === "unadmitted" ||
+            status.terminal_coverage.verdict === "not_current"
           ? "warn"
           : "unknown",
     deployment_posture: postureDisqualifiesEvidence ? "warn" : "ok",
@@ -2122,9 +2134,11 @@ export function buildLocalOutboxDoctor(
     remediation.push(
       staleScope
         ? "The latest acknowledged terminal verdict belongs to an older collection boundary. Re-run against the active scope before treating this lane as covered."
-        : status.terminal_coverage.verdict === "not_current"
-          ? "The latest acknowledged terminal verdict was produced for a connector release other than the one this device selects, or for none. Re-run the collector on the selected release before treating this lane as covered."
-          : "The latest acknowledged terminal verdict is incomplete; inspect the connector run diagnostics and re-run after resolving the missing store coverage."
+        : status.terminal_coverage.verdict === "unadmitted"
+          ? "The latest run has not reached the server: its queued, retrying or dead-lettered work is still open, so the last acknowledged verdict does not stand for it. Let the next run drain the queue, or resolve dead-letter rows with `pdpp-local-collector recover`."
+          : status.terminal_coverage.verdict === "not_current"
+            ? "The latest acknowledged terminal verdict was produced for a connector release other than the one this device selects, or for none. Re-run the collector on the selected release before treating this lane as covered."
+            : "The latest acknowledged terminal verdict is incomplete; inspect the connector run diagnostics and re-run after resolving the missing store coverage."
     );
   }
   if (checks.deployment_posture === "warn") {
@@ -3679,15 +3693,52 @@ interface LocalOutboxInspection {
 /**
  * One terminal fact as the outbox returns it. The release fields are absent on
  * a receipt acknowledged before the release binding existed, which then can
- * never be current.
+ * never be current. `runtime_accounting` is the collector's measurement of the
+ * run that wrote the fact. It is read back from JSON, so it is typed `unknown`
+ * until {@link accountingOf} checks its shape.
  */
 interface StoredTerminalFact {
   artifact_digest?: string;
   manifest_fingerprint?: string;
+  runtime_accounting?: unknown;
   scoped: boolean;
   stores: readonly { status: string }[];
 }
 
+/**
+ * How a stored fact's runtime accounting reads. `unknown`: missing or malformed,
+ * so the fact is no proof. `owed`: the run measured a gap (detail skipped, debt
+ * outstanding, admission or checkpoint refused, or stream evidence inconsistent),
+ * and the server withholds `collected` for the same facts. `clean`: nothing owed.
+ */
+function accountingOf(fact: StoredTerminalFact): "clean" | "owed" | "unknown" {
+  const accounting = fact.runtime_accounting;
+  if (typeof accounting !== "object" || accounting === null) {
+    return "unknown";
+  }
+  const {
+    checkpoint_eligible: checkpointEligible,
+    detail_complete: detailComplete,
+    durable_admission: durableAdmission,
+    outstanding_debt: outstandingDebt,
+    stream_evidence_consistent: streamEvidenceConsistent,
+  } = accounting as Record<string, unknown>;
+  if (
+    typeof checkpointEligible !== "boolean" ||
+    typeof detailComplete !== "boolean" ||
+    typeof durableAdmission !== "boolean" ||
+    typeof streamEvidenceConsistent !== "boolean" ||
+    typeof outstandingDebt !== "number" ||
+    !Number.isSafeInteger(outstandingDebt) ||
+    outstandingDebt < 0
+  ) {
+    return "unknown";
+  }
+  return checkpointEligible && detailComplete && durableAdmission && streamEvidenceConsistent && outstandingDebt === 0
+    ? "clean"
+    : "owed";
+}
+
 function readOutboxInspection(path: string, sourceInstanceId: string | undefined): LocalOutboxInspection {
   const outbox = new LocalDeviceOutbox({ path });
   try {
@@ -3751,17 +3802,24 @@ export function selectedReleaseForPin(
 }
 
 /**
- * Covered is a claim about one release, so the release is checked before the
- * stores. A receipt for another digest or fingerprint, or on a device that
- * selects no release, is `not_current` whatever its stores say.
+ * Covered is a claim about one run on one release. Open work for the lane means
+ * the latest run is unadmitted, so the receipt cannot speak for the lane. A
+ * receipt for another digest or fingerprint, or on a device that selects no
+ * release, is `not_current` whatever its stores say. The run's own runtime
+ * accounting must be present and clean: a store reads `collected` only as the
+ * collector measured it.
  */
 function terminalCoverageVerdict(
   receipt: LocalOutboxInspection["terminalCoverage"],
-  release: SelectedCollectionRelease | null
+  release: SelectedCollectionRelease | null,
+  latestRunOpen: boolean
 ): LocalOutboxStatusOutput["terminal_coverage"]["verdict"] {
   if (!receipt || !receipt.collectionBoundary.trim()) {
     return "no_evidence";
   }
+  if (latestRunOpen) {
+    return "unadmitted";
+  }
   const isSelectedRelease = (fact: StoredTerminalFact) =>
     release !== null &&
     fact.artifact_digest === release.artifactDigest &&
@@ -3769,9 +3827,17 @@ function terminalCoverageVerdict(
   if (!receipt.terminalFacts.every(isSelectedRelease)) {
     return "not_current";
   }
+  const accounting = receipt.terminalFacts.map(accountingOf);
+  if (accounting.includes("unknown")) {
+    return "no_evidence";
+  }
   return receipt.terminalFacts.length > 0 &&
     receipt.terminalFacts.every(
-      (fact) => fact.scoped && fact.stores.length > 0 && fact.stores.every((store) => store.status === "collected")
+      (fact, index) =>
+        fact.scoped &&
+        fact.stores.length > 0 &&
+        fact.stores.every((store) => store.status === "collected") &&
+        accounting[index] === "clean"
     )
     ? "covered"
     : "incomplete";

From cfa376963b533b869d47c8251b77b97d6be21f69 Mon Sep 17 00:00:00 2001
From: Tim Nunamaker <tnunamak@gmail.com>
Date: Thu, 22 Oct 2026 03:47:33 -0500
Subject: [PATCH 20/87] test(local-device): close the journey servers with
 closeTestServer

The journey's own teardown added a 2 s real wait and a hand-rolled server
close, which the real-wait and teardown ratchets count. Use the shared
helper instead.

Assisted-by: AI
Signed-off-by: Tim Nunamaker <tnunamak@gmail.com>
---
 .../test/local-device-coverage-journey.test.ts   | 16 ++--------------
 1 file changed, 2 insertions(+), 14 deletions(-)

diff --git a/reference-implementation/test/local-device-coverage-journey.test.ts b/reference-implementation/test/local-device-coverage-journey.test.ts
index ed4bc51b8..2b6c61f0f 100644
--- a/reference-implementation/test/local-device-coverage-journey.test.ts
+++ b/reference-implementation/test/local-device-coverage-journey.test.ts
@@ -59,6 +59,7 @@ import { reconcileDirtyConnectorSummaryEvidence } from "../server/connector-summ
 import { closeDb, getDb } from "../server/db.ts";
 import { startServer } from "../server/index.ts";
 import { __setLocalCollectorReleaseForTest } from "../server/local-collector-profiles.ts";
+import { closeTestServer } from "./helpers/close-test-server.ts";
 
 const CONNECTOR_ID = "claude-code";
 const LOCAL_BINDING_NAME = "journey-laptop";
@@ -271,19 +272,6 @@ function registerFixtureManifest(connectorInstanceId: string): void {
     .run(connectorInstanceId);
 }
 
-async function closeServer(server: Awaited<ReturnType<typeof startServer>>): Promise<void> {
-  const closeOne = (srv: { close: (callback: () => void) => void; closeAllConnections?: () => void }) =>
-    new Promise<void>((resolve) => {
-      srv.closeAllConnections?.();
-      const timer = setTimeout(resolve, 2000);
-      srv.close(() => {
-        clearTimeout(timer);
-        resolve();
-      });
-    });
-  await Promise.allSettled([closeOne(server.asServer), closeOne(server.rsServer)]);
-}
-
 async function withJourney(run: (journey: Journey) => Promise<void>): Promise<void> {
   const dir = await mkdtemp(join(tmpdir(), "pdpp-local-coverage-journey-"));
   const childPath = join(dir, "fixture-connector.mjs");
@@ -304,7 +292,7 @@ async function withJourney(run: (journey: Journey) => Promise<void>): Promise<vo
     await run({ asUrl, childPath, cookie, dir, enrolled, queuePath: join(dir, "outbox.sqlite") });
   } finally {
     __setLocalCollectorReleaseForTest(CONNECTOR_ID, null);
-    await closeServer(server);
+    await closeTestServer(server);
     closeDb();
     await rm(dir, { force: true, recursive: true });
   }

From d55a6ca0a2b7829556798626fea2ca97815da81d Mon Sep 17 00:00:00 2001
From: Tim Nunamaker <tnunamak@gmail.com>
Date: Thu, 22 Oct 2026 04:11:39 -0500
Subject: [PATCH 21/87] fix(collector-runtime): leave an open failure gap for
 every failed run

Two failure shapes left the lane reading covered. A run that failed before
its scan recorded no gap. A run whose pre-scan drain had delivered the earlier
gap, then failed at the state read or the starting heartbeat, found that gap
already succeeded and left no open row. The device verdict counts open rows
only.

Every failed run now ensures an open connector_child_failure gap. A gap that
is already delivered is reopened (status back to ready), so the verdict reads
unadmitted until a later complete run recovers it through the existing
recovery rule. No schema change: this is a status update on the existing gap
row.

A refused first heartbeat also records the gap. The gap is local evidence, so
it does not need the server.

Two existing expectations change, because a failed run now leaves its gap: a
refused preflight leaves one open gap beside the seeded batch, and a refused
backlog-pass heartbeat reports blocked (open gap) rather than retrying.

Assisted-by: AI
Signed-off-by: Tim Nunamaker <tnunamak@gmail.com>
---
 docs/261021-local-device-coverage-evidence.md |   2 +
 .../src/collector-runner.test.ts              | 382 +++++++++++++++++-
 .../collector-runtime/src/collector-runner.ts |  47 ++-
 .../src/local-device-outbox.test.ts           |  39 ++
 .../src/local-device-outbox.ts                |  25 ++
 packages/local-collector/test/runner.test.ts  | 157 +++++++
 .../local-device-coverage-journey.test.ts     |  48 ++-
 7 files changed, 676 insertions(+), 24 deletions(-)

diff --git a/docs/261021-local-device-coverage-evidence.md b/docs/261021-local-device-coverage-evidence.md
index 2469cb669..8ee88d7ab 100644
--- a/docs/261021-local-device-coverage-evidence.md
+++ b/docs/261021-local-device-coverage-evidence.md
@@ -38,6 +38,8 @@ The collector stores the latest acknowledged v2 receipt in local outbox schema v
 
 The device verdict (`pdpp-local-collector status`, `terminal_coverage.verdict`) is `covered` only when the receipt names the selected release, every store is `collected`, and the run's runtime accounting is clean: durable admission, complete detail, consistent stream evidence, checkpoint eligibility, and zero outstanding debt. Clean accounting is the same test the server applies before it withholds `collected`. Missing or malformed accounting reads `no_evidence`; a measured gap reads `incomplete`. Open outbox work for the lane (queued, leased or dead-lettered) reads `unadmitted`, because the latest run has not reached a durable terminal commit and the receipt no longer stands for it.
 
+The server's owner coverage is "as of the last admitted run". A later run the server never admitted cannot change it. Every failed run, including one that fails before its scan, leaves an open `connector_child_failure` gap on the device, so the device shows that run as `unadmitted` until a later complete run is admitted and recovers the gap. Until then the owner projection keeps the last admitted coverage.
+
 ## Collection Profile amendment
 
 The canonical Collection Profile is `data-connectors/docs/spec/collection-profile.md`. [Data-connectors PR #541](https://github.com/PDP-Connect/data-connectors/pull/541), stacked on #516, specifies the optional START capability, stream store declarations, terminal store collection evidence, and its relationship to detail accounting and checkpoint eligibility. Data-connectors #539 and this PR implement the amendment. The owner approves it at merge.
diff --git a/packages/collector-runtime/src/collector-runner.test.ts b/packages/collector-runtime/src/collector-runner.test.ts
index c2d203b6a..82b4060a5 100644
--- a/packages/collector-runtime/src/collector-runner.test.ts
+++ b/packages/collector-runtime/src/collector-runner.test.ts
@@ -2892,7 +2892,7 @@ test("runCollectorConnector: restored server cursor is not advanced by an older
   }
 });
 
-test("runCollectorConnector validates the reference route before mutating durable outbox work", async () => {
+test("runCollectorConnector validates the reference route before draining or leasing pending outbox work", async () => {
   const harness = await startCollectorHarness({
     heartbeatStatus: 502,
     priorState: {},
@@ -2943,10 +2943,20 @@ test("runCollectorConnector validates the reference route before mutating durabl
     const outbox = new LocalDeviceOutbox({ path: queuePath });
     try {
       const summary = outbox.summary({ sourceInstanceId: "src-1" });
-      assert.equal(summary.ready, 1, "pending work must remain ready");
       assert.equal(summary.leased, 0, "pending work must not be leased");
       assert.equal(summary.retrying, 0, "pending work must not be marked retryable");
       assert.equal(summary.deadLetter, 0, "pending work must not be dead-lettered");
+      // The failed run adds one open failure gap. The seeded batch itself must stay ready.
+      assert.deepEqual(
+        outbox.listByKind({ kind: "record_batch", sourceInstanceId: "src-1" }).map((item) => item.status),
+        ["ready"],
+        "pending work must remain ready"
+      );
+      assert.deepEqual(
+        outbox.listByKind({ kind: "gap", sourceInstanceId: "src-1" }).map((item) => item.status),
+        ["ready"],
+        "the failed run leaves one open failure gap"
+      );
     } finally {
       outbox.close();
     }
@@ -3044,8 +3054,10 @@ test("runCollectorConnector fails backlog-skip pass when terminal heartbeat is r
         }),
       /local device request failed: 503/
     );
-    assert.equal(harness.heartbeats.at(-1)?.status, "retrying");
-    assert.equal(harness.heartbeats.at(-1)?.records_pending, 1);
+    // The refused pass leaves its open failure gap, so the corrective heartbeat reports blocked, and the
+    // gap counts beside the pending batch in records_pending.
+    assert.equal(harness.heartbeats.at(-1)?.status, "blocked");
+    assert.equal(harness.heartbeats.at(-1)?.records_pending, 2);
   } finally {
     await harness.close();
   }
@@ -4486,6 +4498,368 @@ test("runCollectorConnector leaves a failure gap when prior backlog drains but t
   }
 });
 
+/** Durable gap rows for one source instance, read back from the outbox file. */
+function readGapRows(queuePath: string, sourceInstanceId = "src-1") {
+  const outbox = new LocalDeviceOutbox({ path: queuePath });
+  try {
+    return outbox.listByKind({ kind: "gap", sourceInstanceId });
+  } finally {
+    outbox.close();
+  }
+}
+
+/** One pass of source `src-1`. The fixture is spawned only if the pass reaches its scan. */
+function failureGapPassConfig(input: {
+  baseUrl: string;
+  connectorId: string;
+  fixture: string;
+  queuePath: string;
+  runId: string;
+}) {
+  return {
+    baseUrl: input.baseUrl,
+    connector: {
+      args: [input.fixture],
+      command: "node",
+      connector_id: input.connectorId,
+      protocol_capabilities: [],
+      runtime_requirements: { bindings: {} },
+      streams: ["sessions", "coverage_diagnostics"],
+    },
+    deviceId: "device-1",
+    deviceToken: "device-token",
+    executionRoot: TEST_EXECUTION_ROOT,
+    queuePath: input.queuePath,
+    runId: input.runId,
+    sourceInstanceId: "src-1",
+  };
+}
+
+// Reads START, then exits without a record or DONE: the child fails mid-scan.
+const CHILD_FAILS_MID_SCAN_SCRIPT = `
+        let buf = "";
+        await new Promise((r) => process.stdin.on("data", (c) => {
+          buf += c;
+          if (buf.includes("\\n")) r();
+        }));
+        process.exit(7);
+      `;
+
+// A complete successful pass. It commits its coverage checkpoint, which is what recovers a failure gap.
+const COMPLETE_PASS_SCRIPT = `
+        let buf = "";
+        await new Promise((r) => process.stdin.on("data", (c) => {
+          buf += c;
+          if (buf.includes("\\n")) r();
+        }));
+        process.stdout.write(JSON.stringify({
+          type: "STATE",
+          stream: "coverage_diagnostics",
+          cursor: { fetched_at: new Date().toISOString() },
+        }) + "\\n");
+        process.stdout.write(JSON.stringify({
+          type: "DONE",
+          status: "succeeded",
+          records_emitted: 0,
+        }) + "\\n");
+      `;
+
+test("runCollectorConnector leaves an open failure gap when the state read fails before the scan, and a complete pass recovers it", async () => {
+  // The state read is refused before the child spawns, so this pass fails before
+  // its scan starts. The device verdict counts only open outbox rows, so the
+  // failed pass must leave one, and the next complete pass must clear it.
+  const queuePath = await tempQueuePath();
+  const neverSpawned = await writeFixtureConnector({ script: "process.exit(99);" });
+  const failing = await startCollectorHarness({ priorState: {}, stateReadStatus: 500 });
+  try {
+    await assert.rejects(
+      () =>
+        runCollectorConnector(
+          failureGapPassConfig({
+            baseUrl: failing.url,
+            connectorId: "fixture-state-read-gap",
+            fixture: neverSpawned,
+            queuePath,
+            runId: "run-state-read-failed",
+          })
+        ),
+      /failed to read prior state/
+    );
+  } finally {
+    await failing.close();
+  }
+  const open = readGapRows(queuePath);
+  assert.deepEqual(
+    open.map((item) => item.status),
+    ["ready"],
+    "the failed pass leaves one open failure gap"
+  );
+  assert.deepEqual(
+    open.map((item) => (item.payload as Record<string, unknown>).reason),
+    ["connector_child_failure"]
+  );
+
+  const complete = await startCollectorHarness({ priorState: {} });
+  try {
+    const completeFixture = await writeFixtureConnector({ script: COMPLETE_PASS_SCRIPT });
+    const result = await runCollectorConnector(
+      failureGapPassConfig({
+        baseUrl: complete.url,
+        connectorId: "fixture-state-read-gap",
+        fixture: completeFixture,
+        queuePath,
+        runId: "run-complete",
+      })
+    );
+    assert.equal(result.done?.status, "succeeded");
+    assert.equal(complete.gapAcks.length, 1, "the pre-scan drain delivers the open gap");
+    assert.equal(complete.gapRecoveries.length, 1, "the complete pass recovers the gap");
+    assert.equal(complete.gapRecoveries[0]?.reason, "connector_child_failure");
+  } finally {
+    await complete.close();
+  }
+  assert.deepEqual(readGapRows(queuePath), [], "recovery removes the gap row");
+});
+
+test("runCollectorConnector leaves an open failure gap when the second starting heartbeat fails before the scan", async () => {
+  // The first heartbeat and the state read succeed, so the pass has drained but
+  // has not spawned the child when the second starting heartbeat is refused. The
+  // corrective heartbeat must not report the lane healthy while the gap is open.
+  const queuePath = await tempQueuePath();
+  const neverSpawned = await writeFixtureConnector({ script: "process.exit(99);" });
+  const harness = await startCollectorHarness({ heartbeatStatuses: [200, 500], priorState: {} });
+  try {
+    await assert.rejects(() =>
+      runCollectorConnector(
+        failureGapPassConfig({
+          baseUrl: harness.url,
+          connectorId: "fixture-second-heartbeat-gap",
+          fixture: neverSpawned,
+          queuePath,
+          runId: "run-second-heartbeat-failed",
+        })
+      )
+    );
+  } finally {
+    await harness.close();
+  }
+  assert.deepEqual(
+    readGapRows(queuePath).map((item) => item.status),
+    ["ready"]
+  );
+  assert.equal(
+    harness.heartbeats.at(-1)?.status,
+    "blocked",
+    `the corrective heartbeat must be blocked; saw ${harness.heartbeats.map((h) => h.status).join(",")}`
+  );
+});
+
+test("runCollectorConnector leaves an open failure gap when the first heartbeat is refused", async () => {
+  // Nothing has been read or delivered yet. The gap is durable local evidence, so
+  // the failed pass records it even though no corrective heartbeat follows the
+  // refused one.
+  const queuePath = await tempQueuePath();
+  const neverSpawned = await writeFixtureConnector({ script: "process.exit(99);" });
+  const harness = await startCollectorHarness({ heartbeatStatuses: [500], priorState: {} });
+  try {
+    await assert.rejects(() =>
+      runCollectorConnector(
+        failureGapPassConfig({
+          baseUrl: harness.url,
+          connectorId: "fixture-first-heartbeat-gap",
+          fixture: neverSpawned,
+          queuePath,
+          runId: "run-first-heartbeat-failed",
+        })
+      )
+    );
+  } finally {
+    await harness.close();
+  }
+  assert.equal(harness.heartbeats.length, 1, "no corrective heartbeat follows a refused first heartbeat");
+  assert.deepEqual(
+    readGapRows(queuePath).map((item) => item.status),
+    ["ready"]
+  );
+});
+
+test("runCollectorConnector reopens a delivered failure gap when the state read fails after the pre-scan drain, and a complete pass recovers it", async () => {
+  // Pass 1's child fails mid-scan and leaves an undelivered failure gap. Pass 2's
+  // pre-scan drain delivers that gap, so the server admits it and the local row
+  // is delivered. Pass 2 then fails at the state read. The failure is still open
+  // for the lane, so the delivered row must become open again. Otherwise the
+  // device reads the lane covered while the server still holds the gap open.
+  const queuePath = await tempQueuePath();
+  const childFails = await writeFixtureConnector({ script: CHILD_FAILS_MID_SCAN_SCRIPT });
+  const first = await startCollectorHarness({ priorState: {} });
+  try {
+    await assert.rejects(
+      () =>
+        runCollectorConnector(
+          failureGapPassConfig({
+            baseUrl: first.url,
+            connectorId: "fixture-reopen-gap",
+            fixture: childFails,
+            queuePath,
+            runId: "run-child-failed",
+          })
+        ),
+      /connector exited 7/
+    );
+  } finally {
+    await first.close();
+  }
+  assert.deepEqual(
+    readGapRows(queuePath).map((item) => item.status),
+    ["ready"]
+  );
+
+  const neverSpawned = await writeFixtureConnector({ script: "process.exit(99);" });
+  const second = await startCollectorHarness({ priorState: {}, stateReadStatus: 500 });
+  try {
+    await assert.rejects(
+      () =>
+        runCollectorConnector(
+          failureGapPassConfig({
+            baseUrl: second.url,
+            connectorId: "fixture-reopen-gap",
+            fixture: neverSpawned,
+            queuePath,
+            runId: "run-state-read-failed",
+          })
+        ),
+      /failed to read prior state/
+    );
+    assert.equal(second.gapAcks.length, 1, "the pre-scan drain delivered the earlier gap");
+  } finally {
+    await second.close();
+  }
+  assert.deepEqual(
+    readGapRows(queuePath).map((item) => item.status),
+    ["ready"],
+    "the delivered gap is open again"
+  );
+
+  const complete = await startCollectorHarness({ priorState: {} });
+  try {
+    const completeFixture = await writeFixtureConnector({ script: COMPLETE_PASS_SCRIPT });
+    const result = await runCollectorConnector(
+      failureGapPassConfig({
+        baseUrl: complete.url,
+        connectorId: "fixture-reopen-gap",
+        fixture: completeFixture,
+        queuePath,
+        runId: "run-complete-after-reopen",
+      })
+    );
+    assert.equal(result.done?.status, "succeeded");
+    assert.equal(complete.gapRecoveries.length, 1, "the complete pass recovers the reopened gap");
+  } finally {
+    await complete.close();
+  }
+  assert.deepEqual(readGapRows(queuePath), [], "recovery removes the gap row");
+});
+
+test("runCollectorConnector reopens a delivered failure gap when the second starting heartbeat fails after the pre-scan drain", async () => {
+  // Same history as the state-read case above, but pass 2 fails at its second
+  // starting heartbeat, after its pre-scan drain delivered the earlier gap.
+  const queuePath = await tempQueuePath();
+  const childFails = await writeFixtureConnector({ script: CHILD_FAILS_MID_SCAN_SCRIPT });
+  const first = await startCollectorHarness({ priorState: {} });
+  try {
+    await assert.rejects(
+      () =>
+        runCollectorConnector(
+          failureGapPassConfig({
+            baseUrl: first.url,
+            connectorId: "fixture-reopen-heartbeat-gap",
+            fixture: childFails,
+            queuePath,
+            runId: "run-child-failed",
+          })
+        ),
+      /connector exited 7/
+    );
+  } finally {
+    await first.close();
+  }
+
+  const neverSpawned = await writeFixtureConnector({ script: "process.exit(99);" });
+  const second = await startCollectorHarness({ heartbeatStatuses: [200, 500], priorState: {} });
+  try {
+    await assert.rejects(() =>
+      runCollectorConnector(
+        failureGapPassConfig({
+          baseUrl: second.url,
+          connectorId: "fixture-reopen-heartbeat-gap",
+          fixture: neverSpawned,
+          queuePath,
+          runId: "run-second-heartbeat-failed",
+        })
+      )
+    );
+    assert.equal(second.gapAcks.length, 1, "the pre-scan drain delivered the earlier gap");
+  } finally {
+    await second.close();
+  }
+  assert.deepEqual(
+    readGapRows(queuePath).map((item) => item.status),
+    ["ready"],
+    "the delivered gap is open again"
+  );
+  assert.equal(second.heartbeats.at(-1)?.status, "blocked");
+});
+
+test("runCollectorConnector reopens a delivered failure gap when the child fails again mid-scan", async () => {
+  // Pass 2's pre-scan drain delivers pass 1's gap, and then its child fails mid-scan
+  // again. The second failure is the same lane failing, so it must reopen the gap.
+  const queuePath = await tempQueuePath();
+  const childFails = await writeFixtureConnector({ script: CHILD_FAILS_MID_SCAN_SCRIPT });
+  const first = await startCollectorHarness({ priorState: {} });
+  try {
+    await assert.rejects(
+      () =>
+        runCollectorConnector(
+          failureGapPassConfig({
+            baseUrl: first.url,
+            connectorId: "fixture-reopen-scan-gap",
+            fixture: childFails,
+            queuePath,
+            runId: "run-child-failed-once",
+          })
+        ),
+      /connector exited 7/
+    );
+  } finally {
+    await first.close();
+  }
+
+  const second = await startCollectorHarness({ priorState: {} });
+  try {
+    await assert.rejects(
+      () =>
+        runCollectorConnector(
+          failureGapPassConfig({
+            baseUrl: second.url,
+            connectorId: "fixture-reopen-scan-gap",
+            fixture: childFails,
+            queuePath,
+            runId: "run-child-failed-twice",
+          })
+        ),
+      /connector exited 7/
+    );
+    assert.equal(second.gapAcks.length, 1, "the pre-scan drain delivered the earlier gap");
+  } finally {
+    await second.close();
+  }
+  assert.deepEqual(
+    readGapRows(queuePath).map((item) => item.status),
+    ["ready"],
+    "the second failure reopens the delivered gap"
+  );
+});
+
 test("runCollectorConnector flushes a partial trailing batch when the child fails mid-stream and still does not advance the checkpoint", async () => {
   // Emit one full batch plus a partial trailing batch (less than batchSize),
   // then exit non-zero before emitting STATE or DONE. The runner must throw,
diff --git a/packages/collector-runtime/src/collector-runner.ts b/packages/collector-runtime/src/collector-runner.ts
index 4c5cfb6f6..60aea2481 100644
--- a/packages/collector-runtime/src/collector-runner.ts
+++ b/packages/collector-runtime/src/collector-runner.ts
@@ -934,10 +934,6 @@ export async function runCollectorConnector(config: CollectorRunConfig): Promise
   // A failed state read emits the definitive terminal heartbeat for this pass.
   // Never replace it with a generic corrective status in the outer catch.
   let definitiveBlockedHeartbeatSent = false;
-  // Distinguishes a failure while only draining/heartbeating old backlog from
-  // a failure after a new local scan began. Only the latter invalidates the
-  // scan's coverage proof with a new child-failure barrier.
-  let scanStarted = false;
   try {
     const initialSummary = outbox.summary({
       sourceInstanceId: config.sourceInstanceId,
@@ -1012,7 +1008,6 @@ export async function runCollectorConnector(config: CollectorRunConfig): Promise
     });
     startingHeartbeatSent = true;
 
-    scanStarted = true;
     // The SERVER is the authority on the declared boundary: it is persisted with
     // the connection and delivered on the state read, so it cannot be widened by
     // a local flag or lost when the CLI process goes away. A caller-supplied
@@ -1177,6 +1172,20 @@ export async function runCollectorConnector(config: CollectorRunConfig): Promise
       streamingBufferHighWaterMark: streamResult.bufferHighWaterMark,
     };
   } catch (error) {
+    // Every failed run leaves an open connector_child_failure gap, whether it
+    // failed before its scan (state read, starting heartbeat, pre-scan drain) or
+    // during it. The device verdict reads open outbox rows as unadmitted, so the
+    // lane stops reading covered until a later complete run recovers the gap.
+    ensureOpenFailureGapRow({
+      clock: () => new Date(),
+      connectorId: config.connector.connector_id,
+      details: "collector run failed before a committed coverage checkpoint",
+      outbox,
+      reason: "connector_child_failure",
+      retryable: true,
+      ...(config.runId ? { runId: config.runId } : {}),
+      sourceInstanceId: config.sourceInstanceId,
+    });
     // A throw after the "starting" heartbeat (connector child failure, unclean
     // exit, abort, protocol-parse error, drain transition error, …) would
     // otherwise leave "starting" as the last status the server ever saw — even
@@ -1186,18 +1195,6 @@ export async function runCollectorConnector(config: CollectorRunConfig): Promise
     // was never sent, preserving the honest "blocked" the state-read block
     // emits on its own.
     if (startingHeartbeatSent && !definitiveBlockedHeartbeatSent) {
-      if (scanStarted) {
-        ensureCollectorGapRow({
-          clock: () => new Date(),
-          connectorId: config.connector.connector_id,
-          details: "collector run failed before a committed coverage checkpoint",
-          outbox,
-          reason: "connector_child_failure",
-          retryable: true,
-          ...(config.runId ? { runId: config.runId } : {}),
-          sourceInstanceId: config.sourceInstanceId,
-        });
-      }
       await emitCorrectiveHeartbeatFromOutbox({
         client,
         config,
@@ -2155,7 +2152,7 @@ function recordConnectorChildFailureGap(input: {
   enqueuedBatches: number;
   input: StreamConnectorIntoOutboxInput;
 }): void {
-  ensureCollectorGapRow({
+  ensureOpenFailureGapRow({
     clock: () => new Date(),
     connectorId: input.input.config.connector.connector_id,
     details: input.details,
@@ -2665,6 +2662,20 @@ function ensureCollectorGapRow(input: EnsureGapInput): LocalDeviceOutboxItem {
   });
 }
 
+/**
+ * Make a `connector_child_failure` gap open for its lane. A gap the server already
+ * acknowledged is `succeeded` here, and {@link ensureCollectorGapRow} returns it
+ * unchanged. It stays open until a complete successful run recovers it, so reopen
+ * it. Left delivered, the device verdict would count no open work and read the
+ * lane covered while the server still holds the gap open.
+ */
+function ensureOpenFailureGapRow(input: EnsureGapInput): void {
+  const gap = ensureCollectorGapRow(input);
+  if (gap.status === "succeeded") {
+    input.outbox.reopenSucceeded(gap.id);
+  }
+}
+
 function sanitizeCollectorGapDetails(value: string): string {
   let next = String(value)
     .replace(KEYED_SECRET_RE, (_match, marker: string) => `${marker}=[REDACTED]`)
diff --git a/packages/collector-runtime/src/local-device-outbox.test.ts b/packages/collector-runtime/src/local-device-outbox.test.ts
index c0aa05850..13d169440 100644
--- a/packages/collector-runtime/src/local-device-outbox.test.ts
+++ b/packages/collector-runtime/src/local-device-outbox.test.ts
@@ -707,6 +707,45 @@ test("LocalDeviceOutbox requeues dead letters by redacted error class", () => {
   }
 });
 
+test("LocalDeviceOutbox reopens only a succeeded row, as ready, and leaves other rows alone", () => {
+  const outbox = new LocalDeviceOutbox({ path: ":memory:" });
+  try {
+    outbox.enqueue({
+      id: "src-1:gap:first",
+      kind: "gap",
+      payload: { reason: "connector_child_failure" },
+      sourceInstanceId: "src-1",
+    });
+    outbox.enqueue({
+      id: "src-1:gap:second",
+      kind: "gap",
+      payload: { reason: "connector_child_failure" },
+      sourceInstanceId: "src-1",
+    });
+    const [claim] = outbox.claimReady({
+      holder: "worker-a",
+      leaseMs: 60_000,
+      limit: 1,
+      sourceInstanceId: "src-1",
+    });
+    assert.ok(claim);
+    outbox.acknowledge({
+      holder: "worker-a",
+      id: claim.id,
+      leaseEpoch: claim.lease_epoch,
+    });
+    const otherId = claim.id === "src-1:gap:first" ? "src-1:gap:second" : "src-1:gap:first";
+
+    assert.equal(outbox.reopenSucceeded(otherId), false, "a ready row is not reopened");
+    assert.equal(outbox.get(otherId)?.status, "ready");
+    assert.equal(outbox.reopenSucceeded(claim.id), true);
+    assert.equal(outbox.get(claim.id)?.status, "ready");
+    assert.equal(outbox.summary({ sourceInstanceId: "src-1" }).ready, 2);
+  } finally {
+    outbox.close();
+  }
+});
+
 test("LocalDeviceOutbox deletes only succeeded rows by id", () => {
   const outbox = new LocalDeviceOutbox({ path: ":memory:" });
   try {
diff --git a/packages/collector-runtime/src/local-device-outbox.ts b/packages/collector-runtime/src/local-device-outbox.ts
index 4257d5a36..a05707a25 100644
--- a/packages/collector-runtime/src/local-device-outbox.ts
+++ b/packages/collector-runtime/src/local-device-outbox.ts
@@ -646,6 +646,31 @@ export class LocalDeviceOutbox {
     return Number(result.changes) === 1;
   }
 
+  /**
+   * Return one acknowledged row to `ready`, so the next drain delivers it again.
+   * Only `succeeded` rows reopen. A delivered gap stays open for its lane until a
+   * complete successful run recovers it, so a failure that re-observes the gap
+   * reopens the row instead of leaving it looking closed.
+   */
+  reopenSucceeded(id: string): boolean {
+    const now = this.#now();
+    const result = this.#db
+      .prepare(
+        `UPDATE local_device_outbox
+            SET status = 'ready',
+                attempt_count = 0,
+                next_attempt_at = ?,
+                acknowledged_at = NULL,
+                lease_holder = NULL,
+                lease_until = NULL,
+                last_error = NULL,
+                updated_at = ?
+          WHERE id = ? AND status = 'succeeded'`
+      )
+      .run(now, now, id);
+    return Number(result.changes) === 1;
+  }
+
   /**
    * Record that an accepted replacement terminal commit supersedes older
    * rejected terminal evidence. The old row is intentionally retained; the
diff --git a/packages/local-collector/test/runner.test.ts b/packages/local-collector/test/runner.test.ts
index f36e50e88..d1769beff 100644
--- a/packages/local-collector/test/runner.test.ts
+++ b/packages/local-collector/test/runner.test.ts
@@ -66,6 +66,7 @@ import {
   COLLECTOR_RUNTIME_CAPABILITIES,
   LocalDeviceHttpError,
   LocalDeviceOutbox,
+  runCollectorConnector,
 } from "../src/runner.ts";
 
 /**
@@ -2810,6 +2811,162 @@ test("a later run whose record batch is dead-lettered makes an earlier covered r
   assert.equal(status.lifecycle_state, "dead_letter");
 });
 
+/**
+ * A reference stand-in for a server that refuses one pass's state read. Heartbeats
+ * and gap acknowledgements succeed, so a failed pass can still deliver its gap.
+ * Records each gap acknowledgement it receives.
+ */
+async function startStateReadRefusingServer() {
+  const gapAcks = [];
+  const server = createServer((req, res) => {
+    let body = "";
+    req.on("data", (chunk) => {
+      body += chunk;
+    });
+    req.on("end", () => {
+      const url = req.url ?? "";
+      if (url.endsWith("/state") && req.method === "GET") {
+        res.writeHead(500, { "content-type": "application/json" });
+        res.end(JSON.stringify({ error: { code: "synthetic_state_read_failure" } }));
+        return;
+      }
+      if (url.includes("/heartbeat")) {
+        res.writeHead(200, { "content-type": "application/json" });
+        res.end(JSON.stringify({ object: "device_exporter_heartbeat", status: "accepted" }));
+        return;
+      }
+      if (url.includes("/local-collector-gaps")) {
+        gapAcks.push(JSON.parse(body));
+        res.writeHead(201, { "content-type": "application/json" });
+        res.end(
+          JSON.stringify({
+            attempt_count: 0,
+            connector_id: "claude_code",
+            connector_instance_id: "cin_fake",
+            device_id: "device-1",
+            first_seen_at: null,
+            first_seen_run_id: null,
+            gap_id: "gap_fake",
+            last_run_id: null,
+            object: "device_local_collector_gap",
+            reason: "connector_child_failure",
+            retryable: true,
+            source_instance_id: "src-1",
+            status: "pending",
+            stream: "local-collector/connector_child_failure",
+            updated_at: new Date().toISOString(),
+          })
+        );
+        return;
+      }
+      res.writeHead(404, { "content-type": "application/json" });
+      res.end(JSON.stringify({ error: { code: "not_found" } }));
+    });
+  });
+  await new Promise((resolve) => server.listen(0, "127.0.0.1", resolve));
+  const address = server.address();
+  assert.ok(address && typeof address === "object");
+  return {
+    close: () => new Promise((resolve) => server.close(() => resolve())),
+    gapAcks,
+    url: `http://127.0.0.1:${address.port}`,
+  };
+}
+
+/** One pass of `src-1` for `claude_code`. Its child is never spawned when the state read is refused. */
+function refusedStatePassConfig(baseUrl, queuePath, runId) {
+  return {
+    baseUrl,
+    connector: {
+      args: [],
+      command: process.execPath,
+      connector_id: "claude_code",
+      protocol_capabilities: [],
+      runtime_requirements: { bindings: {} },
+      streams: ["sessions"],
+    },
+    deviceId: "device-1",
+    deviceToken: "device-token",
+    executionRoot: dirname(queuePath),
+    queuePath,
+    runId,
+    sourceInstanceId: "src-1",
+  };
+}
+
+// A failed pass must not leave an earlier covered receipt standing for its lane. Both
+// tests fail the pass at the state read, which is before the scan starts.
+test("a pass that fails before its scan leaves an earlier covered receipt unadmitted", async () => {
+  const path = await tempOutboxPath();
+  const outbox = new LocalDeviceOutbox({ path });
+  try {
+    acknowledgeTerminalCoverage(outbox, {
+      id: "terminal-run-a",
+      stores: [{ store: "local_files", status: "collected" }],
+    });
+  } finally {
+    outbox.close();
+  }
+  assert.equal(statusFor(path).terminal_coverage.verdict, "covered");
+
+  const server = await startStateReadRefusingServer();
+  try {
+    await assert.rejects(
+      runCollectorConnector(refusedStatePassConfig(server.url, path, "run-state-read-failed")),
+      /failed to read prior state/
+    );
+  } finally {
+    await server.close();
+  }
+  const status = statusFor(path);
+  assert.equal(status.terminal_coverage.verdict, "unadmitted");
+  assert.notEqual(status.lifecycle_state, "covered");
+});
+
+test("a pass that fails after its pre-scan drain delivered an earlier gap leaves the lane unadmitted", async () => {
+  const path = await tempOutboxPath();
+  const outbox = new LocalDeviceOutbox({ path });
+  try {
+    acknowledgeTerminalCoverage(outbox, {
+      id: "terminal-run-a",
+      stores: [{ store: "local_files", status: "collected" }],
+    });
+    // An earlier pass's failure gap, not yet delivered. The id is the one the
+    // runner derives for this lane's connector_child_failure gap.
+    outbox.enqueue({
+      id: buildLocalDeviceOutboxId({
+        kind: "gap",
+        parts: ["claude_code", "src-1", "connector_child_failure", null, null],
+        sourceInstanceId: "src-1",
+      }),
+      kind: "gap",
+      payload: {
+        connectorId: "claude_code",
+        firstSeenAt: "2026-10-22T11:00:00.000Z",
+        nextAttemptBackoffMs: 60_000,
+        reason: "connector_child_failure",
+        retryable: true,
+        sourceInstanceId: "src-1",
+      },
+      sourceInstanceId: "src-1",
+    });
+  } finally {
+    outbox.close();
+  }
+
+  const server = await startStateReadRefusingServer();
+  try {
+    await assert.rejects(
+      runCollectorConnector(refusedStatePassConfig(server.url, path, "run-after-pre-scan-drain")),
+      /failed to read prior state/
+    );
+    assert.equal(server.gapAcks.length, 1, "the pre-scan drain delivered the earlier gap");
+  } finally {
+    await server.close();
+  }
+  assert.equal(statusFor(path).terminal_coverage.verdict, "unadmitted");
+});
+
 test("open record work without an acknowledged receipt stays no_evidence", async () => {
   const path = await tempOutboxPath();
   const outbox = new LocalDeviceOutbox({ path });
diff --git a/reference-implementation/test/local-device-coverage-journey.test.ts b/reference-implementation/test/local-device-coverage-journey.test.ts
index 2b6c61f0f..4b7c24bf4 100644
--- a/reference-implementation/test/local-device-coverage-journey.test.ts
+++ b/reference-implementation/test/local-device-coverage-journey.test.ts
@@ -52,6 +52,7 @@ import {
 import {
   type CollectorConnectorSpec,
   type CollectorRunResult,
+  LocalDeviceHttpError,
   runCollectorConnector,
 } from "../../packages/local-collector/src/runner.ts";
 import { COLLECTOR_PROTOCOL_VERSION } from "../server/collector-protocol.ts";
@@ -298,7 +299,12 @@ async function withJourney(run: (journey: Journey) => Promise<void>): Promise<vo
   }
 }
 
-async function runOnce(journey: Journey, mode: string, tag: string): Promise<RunOutcome> {
+async function runOnce(
+  journey: Journey,
+  mode: string,
+  tag: string,
+  options: { deviceToken?: string } = {}
+): Promise<RunOutcome> {
   const observePath = join(journey.dir, `start-${tag}.json`);
   const connector: CollectorConnectorSpec = bindOptionalRunCoverageToRelease(
     {
@@ -316,7 +322,7 @@ async function runOnce(journey: Journey, mode: string, tag: string): Promise<Run
     baseUrl: journey.asUrl,
     connector,
     deviceId: journey.enrolled.device_id,
-    deviceToken: journey.enrolled.device_token,
+    deviceToken: options.deviceToken ?? journey.enrolled.device_token,
     executionRoot: dirname(journey.childPath),
     outboxPolicy: { maxDrainIterations: 1, retryBackoffMs: 1 },
     queuePath: journey.queuePath,
@@ -551,3 +557,41 @@ test("J2: a run the server rejects after a covered run leaves the lane not cover
     assert.equal(owner.connection_health.axes.outbox, "active");
   });
 });
+
+test("J3: a run that fails before its scan leaves the lane not covered; the server keeps run A's coverage until a later run recovers the gap", async () => {
+  await withJourney(async (journey) => {
+    // Run A: a clean complete run. The device holds a covered receipt and the server projects complete.
+    const a = await runOnce(journey, "complete", "a-complete");
+    assert.equal(a.result.done?.status, "succeeded");
+    assert.equal(deviceStatus(journey).terminal_coverage.verdict, "covered");
+    assert.equal((await ownerConnectionRow(journey)).connection_health.axes.coverage, "complete");
+
+    // Run B: the server refuses the run's first heartbeat, so the run fails before its state read and scan.
+    // The child never starts, and the server admits nothing from the run.
+    await assert.rejects(
+      runOnce(journey, "complete", "b-refused", { deviceToken: "refused-device-token" }),
+      (error: unknown) => error instanceof LocalDeviceHttpError && error.status === 401
+    );
+    await assert.rejects(readFile(join(journey.dir, "start-b-refused.json"), "utf8"), { code: "ENOENT" });
+    assert.equal(serverRunStreams("b-refused"), null, "the server acknowledged no terminal commit for run B");
+
+    // The device no longer stands behind run A's receipt: run B's failure gap is open.
+    const status = deviceStatus(journey);
+    assert.equal(status.terminal_coverage.verdict, "unadmitted");
+    assert.equal(status.lifecycle_state, "draining");
+
+    // The server never admitted run B, so its projection still reflects run A's admitted terminal commit.
+    // Its outbox axis shows run A's last healthy heartbeat, because the refusal left the server nothing to
+    // record. The owner projection and the device verdict disagree until a later run reaches the server.
+    const owner = await ownerConnectionRow(journey);
+    assert.equal(owner.connection_health.axes.coverage, "complete");
+    assert.equal(owner.connection_health.axes.outbox, "idle");
+    assert.deepEqual(conditions(owner), { messages: "complete", sessions: "complete" });
+
+    // Run C: a clean run. Its pre-scan drain delivers run B's gap, and its complete pass recovers it.
+    const c = await runOnce(journey, "complete", "c-complete");
+    assert.equal(c.result.done?.status, "succeeded");
+    assert.equal(deviceStatus(journey).terminal_coverage.verdict, "covered");
+    assert.equal((await ownerConnectionRow(journey)).connection_health.axes.coverage, "complete");
+  });
+});

From ee4e40d18fa4a2b3e3f89da4bb1cdd2d697e02b7 Mon Sep 17 00:00:00 2001
From: Tim Nunamaker <tnunamak@gmail.com>
Date: Thu, 22 Oct 2026 04:12:10 -0500
Subject: [PATCH 22/87] chore(collector-runtime): regenerate artifact metadata
 for the failure-gap fix

Generated from the fix commit with `npm run artifact:generate`. `artifact:verify`
passes.

Assisted-by: AI
Signed-off-by: Tim Nunamaker <tnunamak@gmail.com>
---
 packages/collector-runtime/artifact.json | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/packages/collector-runtime/artifact.json b/packages/collector-runtime/artifact.json
index a3e815457..a004fbc3b 100644
--- a/packages/collector-runtime/artifact.json
+++ b/packages/collector-runtime/artifact.json
@@ -1,13 +1,13 @@
 {
   "artifact_filename": "pdpp-collector-runtime-0.0.1.tgz",
-  "artifact_sha1": "ddcac5b599922952d686ab609d565365de401432",
-  "artifact_sha256": "ce1403368b83d2d0da11f2b8118c127dd307d3f4fc7c6821653c801835b2cb9b",
-  "artifact_sha512": "a10ca0f51bea392b75a1ffcb5ca80e2df46b6f27f5a33fa4e2af949762d0a6018cc024881a4c83b8c4dd1109b660c5e7c194d155bb8310b0bd47e8c4410e84d3",
+  "artifact_sha1": "b195f49bf9f6db9664d4c88348072bf41e1d2348",
+  "artifact_sha256": "894c9695a6aa0de8c03e43fbfb4312583ccc27db113ca152efdb06876bb3f289",
+  "artifact_sha512": "01341b34745e0f34bbb29641dd142abfae69c670a0fa5a462cce4fc506d76bd4f6cb89ed8d06b9a81692d17caa24ff129f562b9182e54ca55078f6fc9f156c64",
   "connector_protocol_declarations_sha256": "8f1bf78ec644d002bfc8b1ce2399ccb660ea10bb3ee53c49a7995e1bb0e17dcb",
   "connector_protocol_source_inputs_sha256": "935e99c7e3307d7e48d748b3ca83b7427f1b91c89e7397de2a3842f08f2393fd",
-  "declarations_sha256": "8453b87e2260d22f8c421b9858a0e5dbdd18cc16a61c20d1960dcce3b82b365e",
+  "declarations_sha256": "143e48acd5b12670e354da3fd5ff1a265f93d2731d31e2d711d1cb1ef65a8b0e",
   "metadata_version": 1,
   "package_name": "@pdpp/collector-runtime",
   "package_version": "0.0.1",
-  "source_inputs_sha256": "06d1abdc139784219a34f03e86ac03575e9c4c5b28563233dec234b54e7059a1"
+  "source_inputs_sha256": "1d726bc6fde814b383d409a44f2af5fab3ad74aae8efb05869a0ef3a1bf43554"
 }

From 417f11b1a031cad529021f7380dadc3b601e1707 Mon Sep 17 00:00:00 2001
From: Tim Nunamaker <tnunamak@gmail.com>
Date: Thu, 22 Oct 2026 04:59:20 -0500
Subject: [PATCH 23/87] test(local-collector): share the live-registry
 transport

Two copies of the HTTP registry client could fetch the same artifact differently, and neither test would fail. The live-registry test and the install-path journey (J2-install, which installs a connector release from an OCI registry and runs it) both need that client and a stub signature verifier.

Both now import them from packages/local-collector/test/helpers/live-registry-client.ts. The client's behavior is unchanged. The stub verifier reports the signing identity that the publish workflow in PDP-Connect/data-connectors carries. It does not check a Sigstore signature.

Checked locally: the live test passes against a real oura artifact, packaged by the producer's builder (scripts/build-connector-oci-artifact.mjs in data-connectors) and pushed to registry:3.1.1. Both negative probes in the job still fail for the expected reasons. A tampered code layer fails at unpack, and a proxy that corrupts blobs fails the per-layer digest check.

Signed-off-by: Tim Nunamaker <tnunamak@gmail.com>
Assisted-by: AI
---
 .../test/helpers/live-registry-client.ts      | 57 +++++++++++++++++++
 .../managed-connectors-live-registry.test.ts  | 49 +---------------
 2 files changed, 59 insertions(+), 47 deletions(-)
 create mode 100644 packages/local-collector/test/helpers/live-registry-client.ts

diff --git a/packages/local-collector/test/helpers/live-registry-client.ts b/packages/local-collector/test/helpers/live-registry-client.ts
new file mode 100644
index 000000000..3f0956c14
--- /dev/null
+++ b/packages/local-collector/test/helpers/live-registry-client.ts
@@ -0,0 +1,57 @@
+// Copyright The PDP-Connect Contributors
+// SPDX-License-Identifier: Apache-2.0
+
+/**
+ * The transport and verifier the live-registry tests share.
+ *
+ * Both tests pull real artifacts from a real registry service, through the
+ * consumer's own verification path. They must agree on how bytes are fetched,
+ * so the client lives here once rather than in each test.
+ */
+
+import type { RegistryClient, SignatureVerifier } from "../../src/managed/index.ts";
+
+/**
+ * A real registry client, speaking the OCI distribution API over HTTP.
+ *
+ * Small enough to live in a test, and deliberately so: a host supplies its own
+ * transport, and this one exists to prove the consumer's expectations match a
+ * real registry's responses rather than to be the transport anyone ships.
+ */
+export function httpRegistryClient(baseUrl: string, repositoryPath: string): RegistryClient {
+  const manifestAccept = ["application/vnd.oci.image.manifest.v1+json", "application/vnd.oci.image.index.v1+json"].join(
+    ", "
+  );
+
+  return {
+    fetchBlob: async (_reference, requestedDigest) => {
+      const response = await fetch(`${baseUrl}/v2/${repositoryPath}/blobs/${requestedDigest}`);
+      if (!response.ok) {
+        throw new Error(`registry returned ${response.status} for blob ${requestedDigest}`);
+      }
+      return new Uint8Array(await response.arrayBuffer());
+    },
+    fetchManifest: async (_reference, requestedDigest) => {
+      const response = await fetch(`${baseUrl}/v2/${repositoryPath}/manifests/${requestedDigest}`, {
+        headers: { accept: manifestAccept },
+      });
+      if (!response.ok) {
+        throw new Error(`registry returned ${response.status} for manifest ${requestedDigest}`);
+      }
+      return new Uint8Array(await response.arrayBuffer());
+    },
+  };
+}
+
+/**
+ * Stands in for Cosign, reporting the identity the real publish workflow
+ * carries. It cannot prove Sigstore works; it isolates everything else so that
+ * the one unproven step is exactly one step.
+ */
+export const stubVerifier: SignatureVerifier = {
+  verify: async () => ({
+    certificateIdentity:
+      "https://github.com/PDP-Connect/data-connectors/.github/workflows/publish-polyfill-connectors.yml@refs/heads/main",
+    certificateIssuer: "https://token.actions.githubusercontent.com",
+  }),
+};
diff --git a/packages/local-collector/test/managed-connectors-live-registry.test.ts b/packages/local-collector/test/managed-connectors-live-registry.test.ts
index b4e9831b8..aa6ded3e2 100644
--- a/packages/local-collector/test/managed-connectors-live-registry.test.ts
+++ b/packages/local-collector/test/managed-connectors-live-registry.test.ts
@@ -39,58 +39,13 @@ import { join } from "node:path";
 import test from "node:test";
 import { pathToFileURL } from "node:url";
 
-import {
-  obtainManagedConnectors,
-  type RegistryClient,
-  type SignatureVerifier,
-} from "../src/managed/index.ts";
+import { obtainManagedConnectors } from "../src/managed/index.ts";
+import { httpRegistryClient, stubVerifier } from "./helpers/live-registry-client.ts";
 
 const registry = process.env.PDPP_TEST_OCI_REGISTRY;
 const digest = process.env.PDPP_TEST_OCI_DIGEST;
 const repository = process.env.PDPP_TEST_OCI_REPOSITORY ?? "pdp-connect/connector/oura";
 
-/**
- * A real registry client, speaking the OCI distribution API over HTTP.
- *
- * Small enough to live in a test, and deliberately so: a host supplies its own
- * transport, and this one exists to prove the consumer's expectations match a
- * real registry's responses rather than to be the transport anyone ships.
- */
-function httpRegistryClient(baseUrl: string, repositoryPath: string): RegistryClient {
-  const manifestAccept = [
-    "application/vnd.oci.image.manifest.v1+json",
-    "application/vnd.oci.image.index.v1+json",
-  ].join(", ");
-
-  return {
-    fetchManifest: async (_reference, requestedDigest) => {
-      const response = await fetch(`${baseUrl}/v2/${repositoryPath}/manifests/${requestedDigest}`, {
-        headers: { accept: manifestAccept },
-      });
-      if (!response.ok) throw new Error(`registry returned ${response.status} for manifest ${requestedDigest}`);
-      return new Uint8Array(await response.arrayBuffer());
-    },
-    fetchBlob: async (_reference, requestedDigest) => {
-      const response = await fetch(`${baseUrl}/v2/${repositoryPath}/blobs/${requestedDigest}`);
-      if (!response.ok) throw new Error(`registry returned ${response.status} for blob ${requestedDigest}`);
-      return new Uint8Array(await response.arrayBuffer());
-    },
-  };
-}
-
-/**
- * Stands in for Cosign, reporting the identity the real publish workflow
- * carries. It cannot prove Sigstore works; it isolates everything else so that
- * the one unproven step is exactly one step.
- */
-const stubVerifier: SignatureVerifier = {
-  verify: async () => ({
-    certificateIdentity:
-      "https://github.com/PDP-Connect/data-connectors/.github/workflows/publish-polyfill-connectors.yml@refs/heads/main",
-    certificateIssuer: "https://token.actions.githubusercontent.com",
-  }),
-};
-
 test(
   "a real artifact pulled from a real registry installs and its entrypoint imports",
   { skip: registry === undefined || digest === undefined ? "set PDPP_TEST_OCI_REGISTRY and PDPP_TEST_OCI_DIGEST" : false },

From a70f67efd2d2e300a0d34a1cfed8b09b6e0e2977 Mon Sep 17 00:00:00 2001
From: Tim Nunamaker <tnunamak@gmail.com>
Date: Thu, 22 Oct 2026 04:59:37 -0500
Subject: [PATCH 24/87] test(local-device): add the install-path journey
 (J2-install)

Coverage from one release could be credited to another, and no test would catch it. Journey J1 proves coverage from a connector that the test runs from source. Nothing yet proves that a connector installed from an OCI artifact (a container-image-style package) produces coverage the server and device accept, or that a republished artifact stops counting the old proof.

J2-install closes that gap. It pulls release A from an OCI registry and installs it with obtainManagedConnectors, the consumer in packages/local-collector/src/managed that verifies a pinned release and installs it. The runner executes the installed entrypoint as the child process. The reference server (the one the test starts in-process) and the device both report the connection as covered. The device's receipts, which are its stored proof for the latest run, name A's artifact digest. That digest is the OCI manifest digest, which names the exact bytes.

The test then installs release B for the same source. B has the same repository, the same version and a byte-identical manifest, so only its code layer, and therefore its digest, differs. Before B runs, the server reports coverage unknown with the reason coverage_unknown_artifact_mismatch, and the device reports not_current, while its receipts still name A. After B runs, both report covered and name B.

The fixture connector moved to install-path-fixture.ts so that J1 and the packager run one protocol, and J1's assertions are unchanged. Its child now also writes a build label that J1 does not check. scripts/build-install-path-releases.ts builds A and B with the producer's builder, read from a pinned revision with git show. It runs that builder inside a fixture tree that holds the fixture connector, its manifest, and the producer's LICENSE, NOTICE and package.json. It pushes both releases with oras, the OCI artifact push tool, and prints the digests as JSON.

Not exercised: signature verification (the stub verifier, as in the live-registry test), ghcr.io, and the real oura connector. The test sets the server's pinned release through a test-only setter, __setLocalCollectorReleaseForTest, as J1 does. The shipped pins, which are checked-in files, are not touched.

Checked locally against registry:3.1.1: the journey passes. Two falsifications, each a one-line change in a temporary copy, each failed the matching assertion. Leaving the server on A failed the unknown-coverage check, and selecting A on the device failed the not_current check.

Signed-off-by: Tim Nunamaker <tnunamak@gmail.com>
Assisted-by: AI
---
 .../scripts/build-install-path-releases.ts    | 204 +++++++++
 .../test/helpers/install-path-fixture.ts      |  91 ++++
 .../local-device-coverage-journey.test.ts     | 420 +++++++++++++++---
 3 files changed, 654 insertions(+), 61 deletions(-)
 create mode 100644 reference-implementation/scripts/build-install-path-releases.ts
 create mode 100644 reference-implementation/test/helpers/install-path-fixture.ts

diff --git a/reference-implementation/scripts/build-install-path-releases.ts b/reference-implementation/scripts/build-install-path-releases.ts
new file mode 100644
index 000000000..1753ef65b
--- /dev/null
+++ b/reference-implementation/scripts/build-install-path-releases.ts
@@ -0,0 +1,204 @@
+// Copyright The PDP-Connect Contributors
+// SPDX-License-Identifier: Apache-2.0
+
+/**
+ * Package and push the two install-path releases, A and B, for journey J2-install.
+ *
+ * Both releases are built by data-connectors' own OCI builder, taken from the
+ * revision the managed-connector pin names (`git show <sha>:<path>`), so this
+ * never runs an unpinned copy. The builder packages only a connector that lives
+ * in its own `packages/polyfill-connectors` tree. So the connector here lives in
+ * a fixture tree with the same layout: the real builder, the real host-runtime
+ * contract, the real LICENSE, NOTICE and package.json, and the install-path
+ * manifest and connector.
+ *
+ * Release B differs from A only in one constant in the connector. Their code
+ * layers differ, so their digests differ, while the manifest stays byte-identical.
+ * Both are pushed under the same repository and version.
+ *
+ * Run from reference-implementation/:
+ *
+ *   node --import tsx scripts/build-install-path-releases.ts \
+ *     --producer-git <data-connectors checkout> --producer-sha <40-hex> \
+ *     --registry <host:port> --work <directory that does not exist> \
+ *     --modules <directory whose node_modules/esbuild resolves> [--oras <path>]
+ *
+ * Prints {"repository", "a": {"digest"}, "b": {"digest"}} as JSON on stdout.
+ */
+
+import { execFileSync } from "node:child_process";
+import { existsSync, mkdirSync, readFileSync, symlinkSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { parseArgs } from "node:util";
+
+import {
+  fixtureConnectorSource,
+  INSTALL_PATH_PROFILE,
+  INSTALL_PATH_REPOSITORY,
+} from "../test/helpers/install-path-fixture.ts";
+
+/** The files the builder and its gates read from the producer, at the pinned revision. */
+const PRODUCER_FILES = [
+  "scripts/build-connector-oci-artifact.mjs",
+  "scripts/connector-host-runtime-contract.mjs",
+  "LICENSE",
+  "NOTICE",
+  "packages/polyfill-connectors/package.json",
+] as const;
+
+const DIGEST = /^sha256:[0-9a-f]{64}$/;
+
+const IDENTITY = ["-c", "user.name=pdpp install-path journey", "-c", "user.email=install-path-journey@pdpp.invalid"];
+
+interface LayerSpec {
+  readonly artifactType: string;
+  readonly config: { readonly file: string; readonly mediaType: string };
+  readonly layers: readonly { readonly file: string; readonly mediaType: string }[];
+}
+
+const { values } = parseArgs({
+  options: {
+    modules: { type: "string" },
+    oras: { default: "oras", type: "string" },
+    "producer-git": { type: "string" },
+    "producer-sha": { type: "string" },
+    registry: { type: "string" },
+    work: { type: "string" },
+  },
+  strict: true,
+});
+
+function required(name: "modules" | "producer-git" | "producer-sha" | "registry" | "work"): string {
+  const value = values[name];
+  if (value === undefined || value === "") {
+    throw new Error(`--${name} is required`);
+  }
+  return value;
+}
+
+const producerGit = required("producer-git");
+const producerSha = required("producer-sha");
+const registry = required("registry");
+const work = required("work");
+const modules = required("modules");
+const oras = values.oras ?? "oras";
+
+if (!/^[0-9a-f]{40}$/.test(producerSha)) {
+  throw new Error(`--producer-sha must be a full 40-hex commit, got ${producerSha}`);
+}
+if (!/^[A-Za-z0-9.-]+:\d+$/.test(registry)) {
+  throw new Error(`--registry must be host:port, got ${registry}`);
+}
+if (existsSync(work)) {
+  throw new Error(`--work ${work} already exists; pass a new directory`);
+}
+
+function gitShow(path: string): Buffer {
+  return execFileSync("git", ["-C", producerGit, "show", `${producerSha}:${path}`], {
+    maxBuffer: 64 * 1024 * 1024,
+  });
+}
+
+function git(cwd: string, args: string[]): string {
+  return execFileSync("git", ["-c", "core.hooksPath=/dev/null", "-c", "commit.gpgsign=false", ...args], {
+    cwd,
+    encoding: "utf8",
+  }).trim();
+}
+
+function commit(root: string, message: string): void {
+  git(root, [...IDENTITY, "commit", "-q", "--allow-empty-message", "-m", message]);
+}
+
+function writeFixtureTree(root: string): void {
+  for (const path of PRODUCER_FILES) {
+    mkdirSync(dirname(join(root, path)), { recursive: true });
+    writeFileSync(join(root, path), gitShow(path));
+  }
+  mkdirSync(join(root, "packages/polyfill-connectors/manifests"), { recursive: true });
+  writeFileSync(
+    join(root, "packages/polyfill-connectors/manifests/claude_code.json"),
+    `${JSON.stringify(INSTALL_PATH_PROFILE, null, 2)}\n`
+  );
+  mkdirSync(join(root, "packages/polyfill-connectors/connectors/claude_code"), { recursive: true });
+  writeFileSync(
+    join(root, "packages/polyfill-connectors/connectors/claude_code/index.ts"),
+    fixtureConnectorSource("release-a")
+  );
+  writeFileSync(join(root, ".gitignore"), "node_modules\n");
+  // The builder imports esbuild from scripts/, so node_modules must resolve it.
+  symlinkSync(modules, join(root, "node_modules"), "dir");
+  git(root, ["init", "-q"]);
+  git(root, ["add", "-A"]);
+  commit(root, "fixture: install-path release A");
+}
+
+function build(root: string, out: string): LayerSpec {
+  execFileSync(
+    process.execPath,
+    [join(root, "scripts/build-connector-oci-artifact.mjs"), "--connector", "claude_code", "--out", out],
+    {
+      cwd: root,
+      // The builder logs to stdout. Stdout here carries only the digests, so the builder's log goes to stderr.
+      stdio: ["ignore", 2, 2],
+    }
+  );
+  return JSON.parse(readFileSync(join(out, "layers.json"), "utf8")) as LayerSpec;
+}
+
+function push(out: string, spec: LayerSpec, tag: string): string {
+  const reference = `${registry}/${INSTALL_PATH_REPOSITORY}:${tag}`;
+  const stdout = execFileSync(
+    oras,
+    [
+      "push",
+      "--plain-http",
+      reference,
+      "--artifact-type",
+      spec.artifactType,
+      "--config",
+      `${spec.config.file}:${spec.config.mediaType}`,
+      "--format",
+      "json",
+      ...spec.layers.map((layer) => `${layer.file}:${layer.mediaType}`),
+    ],
+    { cwd: out, encoding: "utf8", maxBuffer: 16 * 1024 * 1024 }
+  );
+  // The digest the registry stored, read from oras's own output. Recomputing it here would
+  // check this script's arithmetic against itself.
+  const { digest } = JSON.parse(stdout) as { digest?: unknown };
+  if (typeof digest !== "string" || !DIGEST.test(digest)) {
+    throw new Error(`oras push ${reference} did not report a usable digest: ${JSON.stringify(digest)}`);
+  }
+  return digest;
+}
+
+mkdirSync(work, { recursive: true });
+const fixtureRoot = join(work, "fixture");
+mkdirSync(fixtureRoot);
+writeFixtureTree(fixtureRoot);
+
+const outA = join(work, "release-a");
+const specA = build(fixtureRoot, outA);
+
+writeFileSync(
+  join(fixtureRoot, "packages/polyfill-connectors/connectors/claude_code/index.ts"),
+  fixtureConnectorSource("release-b")
+);
+git(fixtureRoot, ["add", "-A"]);
+commit(fixtureRoot, "fixture: install-path release B (one build constant changed)");
+
+const outB = join(work, "release-b");
+const specB = build(fixtureRoot, outB);
+
+const digestA = push(outA, specA, "journey-a");
+const digestB = push(outB, specB, "journey-b");
+if (digestA === digestB) {
+  throw new Error(
+    "releases A and B pushed with the same digest; the install-path journey needs two different artifacts"
+  );
+}
+
+process.stdout.write(
+  `${JSON.stringify({ a: { digest: digestA }, b: { digest: digestB }, repository: INSTALL_PATH_REPOSITORY }, null, 2)}\n`
+);
diff --git a/reference-implementation/test/helpers/install-path-fixture.ts b/reference-implementation/test/helpers/install-path-fixture.ts
new file mode 100644
index 000000000..65b6e9761
--- /dev/null
+++ b/reference-implementation/test/helpers/install-path-fixture.ts
@@ -0,0 +1,91 @@
+// Copyright The PDP-Connect Contributors
+// SPDX-License-Identifier: Apache-2.0
+
+/**
+ * The fixture connector and release profile for the install-path journey.
+ *
+ * One connector protocol serves two consumers: the local-device journeys run it
+ * as a source file, and the managed-install journey packages it as an OCI
+ * artifact with `scripts/build-install-path-releases.ts`. Both must behave the
+ * same, so the protocol body lives here once.
+ */
+
+export const INSTALL_PATH_CONNECTOR_KEY = "claude-code";
+export const INSTALL_PATH_CONNECTOR_ID = `https://registry.pdpp.dev/connectors/${INSTALL_PATH_CONNECTOR_KEY}`;
+export const INSTALL_PATH_REPOSITORY = `pdp-connect/connector/${INSTALL_PATH_CONNECTOR_KEY}`;
+export const INSTALL_PATH_VERSION = "0.1.0";
+
+/**
+ * The collection profile both releases carry. The two releases differ only in
+ * their code layer, so this manifest is byte-identical across them: a
+ * republished version with new bytes is the case the artifact digest, not the
+ * version, has to catch.
+ */
+export const INSTALL_PATH_PROFILE = {
+  connector_id: INSTALL_PATH_CONNECTOR_ID,
+  connector_key: INSTALL_PATH_CONNECTOR_KEY,
+  display_name: "Claude Code (install-path journey fixture)",
+  protocol_version: "0.1.0",
+  run_coverage: { version: 1 },
+  streams: [
+    { coverage_stores: ["projects"], name: "sessions", primary_key: ["id"] },
+    { coverage_stores: ["derived_messages"], name: "messages", primary_key: ["id"] },
+  ],
+  version: INSTALL_PATH_VERSION,
+};
+
+/**
+ * The connector's source. `build` names the release it was built as, and the
+ * connector reports it in the observation file, so a test can tell which bytes
+ * ran. The body has no template interpolation, so it sits here as a plain
+ * string.
+ */
+export function fixtureConnectorSource(build: string): string {
+  return `const BUILD = ${JSON.stringify(build)};\n${CONNECTOR_BODY}`;
+}
+
+const CONNECTOR_BODY = `import { writeFileSync } from "node:fs";
+
+const [mode, observePath, tag] = process.argv.slice(2);
+let input = "";
+process.stdin.setEncoding("utf8");
+process.stdin.on("data", (chunk) => {
+  input += chunk;
+});
+process.stdin.on("end", () => {
+  const start = JSON.parse(input.split("\\n")[0]);
+  writeFileSync(observePath, JSON.stringify({ ...start, build: BUILD }));
+  const emit = (message) => process.stdout.write(JSON.stringify(message) + "\\n");
+  const emittedAt = "2026-10-22T12:00:00.000Z";
+  const record = (stream, id) => emit({ data: { id }, emitted_at: emittedAt, key: id, stream, type: "RECORD" });
+  const coverage = {
+    collection_scope: start.collection_scope,
+    streams: [
+      { scoped: true, stores: [{ status: "collected", store: "projects" }], stream: "sessions" },
+      { scoped: true, stores: [{ status: "collected", store: "derived_messages" }], stream: "messages" },
+    ],
+    version: 1,
+  };
+  if (mode === "empty") {
+    emit({ records_emitted: 0, status: "succeeded", type: "DONE" });
+    return;
+  }
+  if (mode === "reject") {
+    // A stream the connector manifest does not declare: the server refuses the batch.
+    record("sessions", "s-1");
+    record("undeclared_stream", "u-1");
+    emit({ cursor: { cursor: tag + "-sessions" }, stream: "sessions", type: "STATE" });
+    emit({ coverage, records_emitted: 2, status: "succeeded", type: "DONE" });
+    return;
+  }
+  record("sessions", "s-1");
+  record("sessions", "s-2");
+  record("messages", "m-1");
+  emit({ cursor: { cursor: tag + "-sessions" }, stream: "sessions", type: "STATE" });
+  emit({ cursor: { cursor: tag + "-messages" }, stream: "messages", type: "STATE" });
+  if (mode === "skip") {
+    emit({ message: "one message could not be read", reason: "source_unreadable", stream: "messages", type: "SKIP_RESULT" });
+  }
+  emit({ coverage, records_emitted: 3, status: "succeeded", type: "DONE" });
+});
+`;
diff --git a/reference-implementation/test/local-device-coverage-journey.test.ts b/reference-implementation/test/local-device-coverage-journey.test.ts
index 4b7c24bf4..e46e0a4d1 100644
--- a/reference-implementation/test/local-device-coverage-journey.test.ts
+++ b/reference-implementation/test/local-device-coverage-journey.test.ts
@@ -35,6 +35,7 @@
 
 import assert from "node:assert/strict";
 import { createHash } from "node:crypto";
+import { existsSync } from "node:fs";
 import { mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { dirname, join } from "node:path";
@@ -48,19 +49,29 @@ import {
   inspectLocalOutboxStatus,
   type LocalOutboxStatusOutput,
   parseArgs,
+  resolveExecutionRoot,
+  type SelectedCollectionRelease,
 } from "../../packages/local-collector/bin/pdpp-local-collector.ts";
+import { managedConnectorCommand, obtainManagedConnectors } from "../../packages/local-collector/src/managed/index.ts";
 import {
   type CollectorConnectorSpec,
   type CollectorRunResult,
   LocalDeviceHttpError,
   runCollectorConnector,
 } from "../../packages/local-collector/src/runner.ts";
+import { httpRegistryClient, stubVerifier } from "../../packages/local-collector/test/helpers/live-registry-client.ts";
 import { COLLECTOR_PROTOCOL_VERSION } from "../server/collector-protocol.ts";
 import { reconcileDirtyConnectorSummaryEvidence } from "../server/connector-summary-read-model.ts";
 import { closeDb, getDb } from "../server/db.ts";
 import { startServer } from "../server/index.ts";
 import { __setLocalCollectorReleaseForTest } from "../server/local-collector-profiles.ts";
 import { closeTestServer } from "./helpers/close-test-server.ts";
+import {
+  fixtureConnectorSource,
+  INSTALL_PATH_CONNECTOR_ID,
+  INSTALL_PATH_REPOSITORY,
+  INSTALL_PATH_VERSION,
+} from "./helpers/install-path-fixture.ts";
 
 const CONNECTOR_ID = "claude-code";
 const LOCAL_BINDING_NAME = "journey-laptop";
@@ -91,55 +102,10 @@ const PUBLISHED_POSTURE = Object.freeze({
   version: "0.1.0-beta.7",
 });
 
-// Offline fixture connector. It reads START, records what it was asked for, and
-// answers with protocol messages chosen by its mode. Written with no template
-// interpolation so it can sit inside this file as a plain string.
-const FIXTURE_CONNECTOR_SOURCE = `
-import { writeFileSync } from "node:fs";
-
-const [mode, observePath, tag] = process.argv.slice(2);
-let input = "";
-process.stdin.setEncoding("utf8");
-process.stdin.on("data", (chunk) => {
-  input += chunk;
-});
-process.stdin.on("end", () => {
-  const start = JSON.parse(input.split("\\n")[0]);
-  writeFileSync(observePath, JSON.stringify(start));
-  const emit = (message) => process.stdout.write(JSON.stringify(message) + "\\n");
-  const emittedAt = "2026-10-22T12:00:00.000Z";
-  const record = (stream, id) => emit({ data: { id }, emitted_at: emittedAt, key: id, stream, type: "RECORD" });
-  const coverage = {
-    collection_scope: start.collection_scope,
-    streams: [
-      { scoped: true, stores: [{ status: "collected", store: "projects" }], stream: "sessions" },
-      { scoped: true, stores: [{ status: "collected", store: "derived_messages" }], stream: "messages" },
-    ],
-    version: 1,
-  };
-  if (mode === "empty") {
-    emit({ records_emitted: 0, status: "succeeded", type: "DONE" });
-    return;
-  }
-  if (mode === "reject") {
-    // A stream the connector manifest does not declare: the server refuses the batch.
-    record("sessions", "s-1");
-    record("undeclared_stream", "u-1");
-    emit({ cursor: { cursor: tag + "-sessions" }, stream: "sessions", type: "STATE" });
-    emit({ coverage, records_emitted: 2, status: "succeeded", type: "DONE" });
-    return;
-  }
-  record("sessions", "s-1");
-  record("sessions", "s-2");
-  record("messages", "m-1");
-  emit({ cursor: { cursor: tag + "-sessions" }, stream: "sessions", type: "STATE" });
-  emit({ cursor: { cursor: tag + "-messages" }, stream: "messages", type: "STATE" });
-  if (mode === "skip") {
-    emit({ message: "one message could not be read", reason: "source_unreadable", stream: "messages", type: "SKIP_RESULT" });
-  }
-  emit({ coverage, records_emitted: 3, status: "succeeded", type: "DONE" });
-});
-`;
+// The offline fixture connector (see install-path-fixture.ts): it reads START,
+// records what it was asked for, and answers with protocol messages chosen by its
+// mode. The journey's child runs this source as a file, labelled "source".
+const FIXTURE_CONNECTOR_SOURCE = fixtureConnectorSource("source");
 
 interface JsonResponse {
   readonly body: Record<string, unknown> | null;
@@ -153,15 +119,26 @@ interface Enrolled {
   readonly source_instance_id: string;
 }
 
-interface Journey {
+/** A lane's server and device identity: what the owner reads and the device reports on. */
+interface Lane {
   readonly asUrl: string;
-  readonly childPath: string;
   readonly cookie: string;
   readonly dir: string;
   readonly enrolled: Enrolled;
   readonly queuePath: string;
 }
 
+/** J1's lane, which also names the fixture child it runs. */
+interface Journey extends Lane {
+  readonly childPath: string;
+}
+
+/** The fields of a collection profile the lane reads. */
+interface ReleaseProfile {
+  readonly streams: readonly { readonly coverage_stores: readonly string[]; readonly name: string }[];
+  readonly [key: string]: unknown;
+}
+
 interface RunOutcome {
   readonly observed: Record<string, unknown>;
   readonly result: CollectorRunResult;
@@ -252,13 +229,13 @@ async function enrollLaptop(asUrl: string, cookie: string): Promise<Enrolled> {
  * update does, the manifest generation advances, so no earlier binding carries
  * over.
  */
-function registerFixtureManifest(connectorInstanceId: string): void {
+function registerFixtureManifest(connectorInstanceId: string, profile: ReleaseProfile): void {
   const row = getDb().prepare("SELECT manifest FROM connectors WHERE connector_id = ?").get(CONNECTOR_ID) as
     | { manifest: string }
     | undefined;
   assert.ok(row, "enrolment registers the claude-code catalog manifest");
   const catalog = JSON.parse(row.manifest) as Record<string, unknown> & { streams: Record<string, unknown>[] };
-  const streams = PROFILE.streams.map((release) => {
+  const streams = profile.streams.map((release) => {
     const declared = catalog.streams.find((stream) => stream.name === release.name);
     assert.ok(declared, `the catalog declares ${release.name}`);
     return { ...declared, coverage_stores: release.coverage_stores };
@@ -289,7 +266,7 @@ async function withJourney(run: (journey: Journey) => Promise<void>): Promise<vo
   try {
     const cookie = await ownerSessionCookie(asUrl);
     const enrolled = await enrollLaptop(asUrl, cookie);
-    registerFixtureManifest(enrolled.connector_instance_id);
+    registerFixtureManifest(enrolled.connector_instance_id, PROFILE);
     await run({ asUrl, childPath, cookie, dir, enrolled, queuePath: join(dir, "outbox.sqlite") });
   } finally {
     __setLocalCollectorReleaseForTest(CONNECTOR_ID, null);
@@ -332,7 +309,10 @@ async function runOnce(
   return { observed: JSON.parse(await readFile(observePath, "utf8")) as Record<string, unknown>, result };
 }
 
-function deviceStatus(journey: Journey): LocalOutboxStatusOutput {
+function deviceStatus(
+  journey: Lane,
+  selectedRelease: SelectedCollectionRelease = DEVICE_RELEASE
+): LocalOutboxStatusOutput {
   return inspectLocalOutboxStatus(
     parseArgs([
       "status",
@@ -343,12 +323,12 @@ function deviceStatus(journey: Journey): LocalOutboxStatusOutput {
       "--connector",
       CONNECTOR_ID,
     ]),
-    { deploymentPosture: PUBLISHED_POSTURE, selectedRelease: DEVICE_RELEASE }
+    { deploymentPosture: PUBLISHED_POSTURE, selectedRelease }
   );
 }
 
 /** The terminal facts the device acknowledged and stored as its current receipt. */
-function deviceReceiptFacts(journey: Journey): Record<string, unknown>[] {
+function deviceReceiptFacts(journey: Lane): Record<string, unknown>[] {
   const db = new DatabaseSync(journey.queuePath);
   try {
     const row = db
@@ -373,7 +353,7 @@ function serverRunStreams(runId: string): Record<string, unknown>[] | null {
 }
 
 /** The source generation terminal commits bind to, as the server stores it for this lane. */
-function sourceGeneration(journey: Journey): number {
+function sourceGeneration(journey: Lane): number {
   const row = getDb()
     .prepare("SELECT manifest_generation FROM device_source_instances WHERE source_instance_id = ?")
     .get(journey.enrolled.source_instance_id) as { manifest_generation: number | null } | undefined;
@@ -381,7 +361,7 @@ function sourceGeneration(journey: Journey): number {
   return Number(row.manifest_generation);
 }
 
-function serverRecordCount(journey: Journey, stream: string): number {
+function serverRecordCount(journey: Lane, stream: string): number {
   const row = getDb()
     .prepare("SELECT COUNT(*) AS n FROM records WHERE connector_instance_id = ? AND stream = ?")
     .get(journey.enrolled.connector_instance_id, stream) as { n: number };
@@ -389,7 +369,7 @@ function serverRecordCount(journey: Journey, stream: string): number {
 }
 
 /** Stream cursors only. The `$`-prefixed rows are the server's own collection-scope state, not connector cursors. */
-function serverCursors(journey: Journey): Record<string, unknown> {
+function serverCursors(journey: Lane): Record<string, unknown> {
   const rows = getDb()
     .prepare("SELECT stream, state_json FROM connector_state WHERE connector_instance_id = ? ORDER BY stream")
     .all(journey.enrolled.connector_instance_id) as Array<{ state_json: string; stream: string }>;
@@ -398,7 +378,7 @@ function serverCursors(journey: Journey): Record<string, unknown> {
   );
 }
 
-async function ownerConnectionRow(journey: Journey): Promise<OwnerConnectionRow> {
+async function ownerConnectionRow(journey: Lane): Promise<OwnerConnectionRow> {
   // The owner routes read a summary read model that the server refreshes from
   // dirty evidence in the background. Refresh it here, as the projection oracle
   // does, so the read reflects the terminal commit just made.
@@ -595,3 +575,321 @@ test("J3: a run that fails before its scan leaves the lane not covered; the serv
     assert.equal((await ownerConnectionRow(journey)).connection_health.axes.coverage, "complete");
   });
 });
+
+// ---- J2-install: the same lane, with its child installed through the managed path -----------
+//
+// The lane is J1's, but the child is the installed entrypoint of a release pulled from a real OCI
+// registry, verified, and installed by the managed consumer path. Release A and release B share a
+// repository, a version and a byte-identical manifest. Only their code layers differ, so only their
+// artifact digests differ. Nothing but the digest can tell them apart, and the second half of the
+// journey tests exactly that.
+//
+// The registry is the one the managed-connector OCI job starts. The signature verifier is the stub
+// that job uses, so signature verification is the one step this journey does not prove. To run it
+// locally, push the two releases with scripts/build-install-path-releases.ts and export the three
+// variables below.
+
+const INSTALL_REGISTRY = process.env.PDPP_TEST_OCI_REGISTRY;
+const INSTALL_DIGEST_A = process.env.PDPP_TEST_INSTALL_PATH_DIGEST_A;
+const INSTALL_DIGEST_B = process.env.PDPP_TEST_INSTALL_PATH_DIGEST_B;
+const INSTALL_SKIP =
+  INSTALL_REGISTRY === undefined || INSTALL_DIGEST_A === undefined || INSTALL_DIGEST_B === undefined
+    ? "set PDPP_TEST_OCI_REGISTRY, PDPP_TEST_INSTALL_PATH_DIGEST_A and PDPP_TEST_INSTALL_PATH_DIGEST_B (scripts/build-install-path-releases.ts pushes both releases)"
+    : false;
+
+/** A release as the managed consumer installed it, read back from the installed files. */
+interface InstalledRelease {
+  readonly digest: string;
+  /** The installed bundle the child runs. */
+  readonly entrypoint: string;
+  /** The manifest fingerprint a receipt must carry to count as this release's. */
+  readonly fingerprint: string;
+  readonly profile: ReleaseProfile;
+  readonly profileBytes: Buffer;
+  readonly releaseRoot: string;
+}
+
+/** Owner-visible coverage for one connection, as the list and the detail both report it. */
+interface CoverageView {
+  readonly axis: string;
+  readonly conditions: Record<string, string>;
+  readonly reason: string | null;
+}
+
+/**
+ * The SourceCoverageComplete reason a covered lane carries: the condition's reason mirrors its
+ * coverage axis, so a complete lane reads "complete". A mismatch has its own reason.
+ */
+const COVERED_REASON = "complete";
+
+/**
+ * Install one pinned release through the managed consumer path. `activate` moves the install
+ * store's pointer to it, as an update applied between runs would.
+ */
+async function installRelease(input: {
+  readonly activate: boolean;
+  readonly digest: string;
+  readonly durableRoot: string;
+  readonly installRoot: string;
+}): Promise<InstalledRelease> {
+  const registry = INSTALL_REGISTRY as string;
+  const [managed] = await obtainManagedConnectors({
+    activate: input.activate,
+    client: httpRegistryClient(`http://${registry}`, INSTALL_PATH_REPOSITORY),
+    durableRoot: input.durableRoot,
+    installRoot: input.installRoot,
+    lock: {
+      connectors: [
+        {
+          connectorId: INSTALL_PATH_CONNECTOR_ID,
+          connectorKey: CONNECTOR_ID,
+          digest: input.digest,
+          reference: `${registry}/${INSTALL_PATH_REPOSITORY}`,
+          version: INSTALL_PATH_VERSION,
+        },
+      ],
+      lockVersion: "2.0",
+    },
+    verifier: stubVerifier,
+  });
+  assert.ok(managed, "one connector should have been installed");
+  const releaseRoot = dirname(dirname(managed.entrypoint));
+  const profileBytes = await readFile(join(releaseRoot, "collection-profile.json"));
+  const profile = JSON.parse(profileBytes.toString("utf8")) as ReleaseProfile;
+  return {
+    digest: managed.digest,
+    entrypoint: managed.entrypoint,
+    fingerprint: hashCanonicalJson(profile),
+    profile,
+    profileBytes,
+    releaseRoot,
+  };
+}
+
+/** The device's selected release, derived from the installed bytes rather than from a constant. */
+function selectedFrom(release: InstalledRelease): SelectedCollectionRelease {
+  return { artifactDigest: release.digest, manifestFingerprint: release.fingerprint };
+}
+
+/** The digest the install store's pointer names for the connector. */
+async function activeDigest(installRoot: string): Promise<string> {
+  const pointer = JSON.parse(await readFile(join(installRoot, "connectors", CONNECTOR_ID, "current.json"), "utf8")) as {
+    digest: string;
+  };
+  return pointer.digest;
+}
+
+/**
+ * The lane J1 builds (a server, an owner session, an enrolled device, and the catalog entry
+ * narrowed to the release's streams), with the server pinned to `release`.
+ */
+async function withInstallLane(
+  dir: string,
+  release: InstalledRelease,
+  run: (lane: Lane) => Promise<void>
+): Promise<void> {
+  const server = await startServer({
+    asPort: 0,
+    dbPath: join(dir, "pdpp.sqlite"),
+    ownerAuthPassword: OWNER_PASSWORD,
+    quiet: true,
+    rsPort: 0,
+  });
+  const asUrl = `http://localhost:${server.asPort}`;
+  __setLocalCollectorReleaseForTest(CONNECTOR_ID, { artifactDigest: release.digest, manifest: release.profile });
+  try {
+    const cookie = await ownerSessionCookie(asUrl);
+    const enrolled = await enrollLaptop(asUrl, cookie);
+    registerFixtureManifest(enrolled.connector_instance_id, release.profile);
+    await run({ asUrl, cookie, dir, enrolled, queuePath: join(dir, "outbox.sqlite") });
+  } finally {
+    __setLocalCollectorReleaseForTest(CONNECTOR_ID, null);
+    await closeTestServer(server);
+    closeDb();
+  }
+}
+
+/** Run an installed entrypoint through the runner, with the same spec the lane's own binding produces. */
+async function runInstalled(lane: Lane, release: InstalledRelease, mode: string, tag: string): Promise<RunOutcome> {
+  const observePath = join(lane.dir, `start-${tag}.json`);
+  const connector = bindOptionalRunCoverageToRelease(
+    {
+      args: [release.entrypoint, mode, observePath, tag],
+      command: managedConnectorCommand(release.entrypoint),
+      connector_id: CONNECTOR_ID,
+      protocol_capabilities: [],
+      runtime_requirements: { bindings: {} },
+      streams: STREAMS,
+    },
+    { digest: release.digest },
+    release.profile
+  );
+  const result = await runCollectorConnector({
+    baseUrl: lane.asUrl,
+    connector,
+    deviceId: lane.enrolled.device_id,
+    deviceToken: lane.enrolled.device_token,
+    executionRoot: resolveExecutionRoot({ args: [release.entrypoint] }),
+    outboxPolicy: { maxDrainIterations: 1, retryBackoffMs: 1 },
+    queuePath: lane.queuePath,
+    runId: tag,
+    sourceInstanceId: lane.enrolled.source_instance_id,
+  });
+  return { observed: JSON.parse(await readFile(observePath, "utf8")) as Record<string, unknown>, result };
+}
+
+function coverageView(body: Record<string, unknown>): CoverageView {
+  const health = body.connection_health as {
+    axes: { coverage: string };
+    conditions: { reason?: string | null; type: string }[];
+  };
+  const report = body.collection_report as ProjectedStream[];
+  return {
+    axis: health.axes.coverage,
+    conditions: Object.fromEntries(report.map((entry) => [entry.stream, entry.coverage_condition])),
+    reason: health.conditions.find((condition) => condition.type === "SourceCoverageComplete")?.reason ?? null,
+  };
+}
+
+/** The owner's view of the connection, read from the list and the detail. The two must agree. */
+async function ownerCoverage(lane: Lane): Promise<CoverageView> {
+  await reconcileDirtyConnectorSummaryEvidence(null);
+  const list = await requestJson(`${lane.asUrl}/_ref/connectors?limit=100`, { headers: { Cookie: lane.cookie } });
+  assert.equal(list.status, 200, JSON.stringify(list.body));
+  const row = ((list.body?.data ?? []) as Record<string, unknown>[]).find(
+    (candidate) => candidate.connection_id === lane.enrolled.connector_instance_id
+  );
+  assert.ok(row, "the owner list projects the enrolled connection");
+  const detail = await requestJson(`${lane.asUrl}/_ref/connectors/${CONNECTOR_ID}`, {
+    headers: { Cookie: lane.cookie },
+  });
+  assert.equal(detail.status, 200, JSON.stringify(detail.body));
+  const fromList = coverageView(row);
+  assert.deepEqual(coverageView(detail.body ?? {}), fromList, "list and detail agree on coverage and its reason");
+  return fromList;
+}
+
+/** The stream facts the server stored for one terminal commit. The commit must exist. */
+function requireRunStreams(runId: string): Record<string, unknown>[] {
+  const streams = serverRunStreams(runId);
+  assert.ok(streams, `the server committed run ${runId}`);
+  return streams;
+}
+
+test("J2-install: a release installed through the managed path is covered; a replaced digest stops counting until its own run proves it", {
+  skip: INSTALL_SKIP,
+}, async () => {
+  const base = await mkdtemp(join(tmpdir(), "pdpp-install-path-journey-"));
+  const installRoot = join(base, "connector-releases");
+  const durableRoot = join(base, "connector-artifacts");
+  const digestA = INSTALL_DIGEST_A as string;
+  const digestB = INSTALL_DIGEST_B as string;
+  try {
+    // Install release A and check what the consumer made of it before anything runs.
+    const releaseA = await installRelease({ activate: true, digest: digestA, durableRoot, installRoot });
+    assert.equal(releaseA.digest, digestA);
+    assert.equal(releaseA.profile.connector_id, INSTALL_PATH_CONNECTOR_ID);
+    assert.deepEqual(
+      releaseA.profile.streams.map((stream) => stream.name),
+      STREAMS,
+      "the installed profile declares the lane's two streams"
+    );
+    assert.equal(releaseA.entrypoint, join(releaseA.releaseRoot, "code", "collection-profile.mjs"));
+    assert.ok(releaseA.entrypoint.startsWith(installRoot), "the entrypoint lies inside the install store");
+
+    await withInstallLane(base, releaseA, async (lane) => {
+      // Phase 1: release A runs through its installed entrypoint, and the server and the device accept it.
+      const a = await runInstalled(lane, releaseA, "complete", "a-install");
+      assert.equal(a.observed.build, "release-a", "the installed release A's bytes ran");
+      assert.equal(a.observed.run_coverage_version, 1, "START asked the installed connector for run coverage");
+      assert.equal(a.result.done?.status, "succeeded");
+      assert.equal(serverRecordCount(lane, "sessions"), 2);
+      assert.equal(serverRecordCount(lane, "messages"), 1);
+      for (const stream of requireRunStreams("a-install")) {
+        assert.equal(stream.artifact_digest, digestA, "the server stores run A under digest A");
+        assert.equal(stream.manifest_fingerprint, releaseA.fingerprint);
+        assert.equal(stream.binding_generation, sourceGeneration(lane), "bound to the source generation");
+      }
+      assert.deepEqual(await ownerCoverage(lane), {
+        axis: "complete",
+        conditions: { messages: "complete", sessions: "complete" },
+        reason: COVERED_REASON,
+      });
+      const aDevice = deviceStatus(lane, selectedFrom(releaseA));
+      assert.equal(aDevice.terminal_coverage.verdict, "covered");
+      assert.equal(aDevice.lifecycle_state, "covered");
+      const aReceipts = deviceReceiptFacts(lane);
+      assert.equal(aReceipts.length, 2, "the device holds a receipt for both streams");
+      assert.ok(
+        aReceipts.every(
+          (fact) => fact.artifact_digest === digestA && fact.manifest_fingerprint === releaseA.fingerprint
+        ),
+        "the device receipt names release A"
+      );
+
+      // Phase 2: install release B for the same source and select it. B does not run yet.
+      const releaseB = await installRelease({ activate: true, digest: digestB, durableRoot, installRoot });
+      assert.equal(releaseB.digest, digestB);
+      assert.notEqual(releaseB.releaseRoot, releaseA.releaseRoot, "B installs beside A");
+      assert.deepEqual(
+        releaseB.profileBytes,
+        releaseA.profileBytes,
+        "the manifest is byte-identical, so the digest is the only difference"
+      );
+      assert.ok(existsSync(releaseA.entrypoint), "installing B left release A in place");
+      assert.equal(await activeDigest(installRoot), digestB, "the install store points at B");
+      __setLocalCollectorReleaseForTest(CONNECTOR_ID, { artifactDigest: releaseB.digest, manifest: releaseB.profile });
+
+      // Before any B run, neither side counts A's proof for B.
+      assert.deepEqual(await ownerCoverage(lane), {
+        axis: "unknown",
+        conditions: { messages: "unknown", sessions: "unknown" },
+        reason: "coverage_unknown_artifact_mismatch",
+      });
+      const bBefore = deviceStatus(lane, selectedFrom(releaseB));
+      assert.equal(bBefore.terminal_coverage.verdict, "not_current");
+      assert.equal(bBefore.lifecycle_state, "coverage_not_current");
+      // No A proof is relabelled as B: the device still holds only A's receipt, and the server still
+      // records run A as A.
+      assert.ok(
+        deviceReceiptFacts(lane).every((fact) => fact.artifact_digest === digestA),
+        "the device receipt still names release A"
+      );
+      assert.ok(
+        requireRunStreams("a-install").every((stream) => stream.artifact_digest === digestA),
+        "the server still records run A as release A"
+      );
+
+      // Phase 3: release B runs through its installed entrypoint, and proves itself.
+      const b = await runInstalled(lane, releaseB, "complete", "b-install");
+      assert.equal(b.observed.build, "release-b", "the installed release B's bytes ran");
+      assert.equal(b.result.done?.status, "succeeded");
+      assert.ok(
+        requireRunStreams("b-install").every((stream) => stream.artifact_digest === digestB),
+        "the server stores run B under digest B"
+      );
+      assert.deepEqual(await ownerCoverage(lane), {
+        axis: "complete",
+        conditions: { messages: "complete", sessions: "complete" },
+        reason: COVERED_REASON,
+      });
+      const bDevice = deviceStatus(lane, selectedFrom(releaseB));
+      assert.equal(bDevice.terminal_coverage.verdict, "covered");
+      assert.equal(bDevice.lifecycle_state, "covered");
+      const bReceipts = deviceReceiptFacts(lane);
+      assert.equal(bReceipts.length, 2, "the device holds a receipt for both streams");
+      assert.ok(
+        bReceipts.every(
+          (fact) => fact.artifact_digest === digestB && fact.manifest_fingerprint === releaseB.fingerprint
+        ),
+        "the device receipt names release B"
+      );
+      assert.ok(
+        requireRunStreams("a-install").every((stream) => stream.artifact_digest === digestA),
+        "run A is still recorded as release A after B is covered"
+      );
+    });
+  } finally {
+    await rm(base, { force: true, recursive: true });
+  }
+});

From 90d0db7003235b979dd20eae238744d9b9d97440 Mon Sep 17 00:00:00 2001
From: Tim Nunamaker <tnunamak@gmail.com>
Date: Thu, 22 Oct 2026 05:00:20 -0500
Subject: [PATCH 25/87] ci(managed-connector-oci): run the install-path journey
 in the job

Without this step, the install-path journey never runs in CI. Its test skips when the registry variables are unset, and the reference-implementation job does not set them, so the test reports as skipped there. The managed-connector OCI job (.github/workflows/managed-connector-oci-e2e.yml) already starts a registry, so it is the job that can run the journey.

The journey starts the reference server, which loads the dist/ output of several workspace packages. The job runs npm ci with --ignore-scripts and builds none of them. The new build step builds the five packages the reference-implementation job builds, minus that job's postinstall step, which fetches connector packages that this journey does not use. The next step pushes releases A and B to the job's registry. The last step runs J2-install and requires exactly one passing test and no skips, the same guard the live-registry step uses, because node --test exits 0 on a skipped test.

The job moves from Node 22.23.2 to 24.21.0, the version the reference-implementation job runs its tests on. The path filters now include the journey's files and the shared client helper.

Not verified: the new steps have not run on a GitHub runner. Locally, each command ran on Node 24.21.0 against registry:3.1.1. The packager's esbuild came from this worktree's node_modules rather than from the producer's own npm ci. Both are version 0.28.2.

Signed-off-by: Tim Nunamaker <tnunamak@gmail.com>
Assisted-by: AI
---
 .../workflows/managed-connector-oci-e2e.yml   | 74 ++++++++++++++++++-
 1 file changed, 73 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/managed-connector-oci-e2e.yml b/.github/workflows/managed-connector-oci-e2e.yml
index 66bcefd02..56a5baaac 100644
--- a/.github/workflows/managed-connector-oci-e2e.yml
+++ b/.github/workflows/managed-connector-oci-e2e.yml
@@ -45,6 +45,12 @@ name: managed-connector OCI end-to-end (local registry; NOT GHCR, NOT Sigstore)
 # fetch. (There is no cross-repo-pins.json in THIS repo; see the pin file if that surprises you.)
 # The reasoning, the weakness of pinning an unmerged PR head, and why the connector stays `oura`
 # while data-connectors' publish pilot moved to `ynab` are all written down in the pin file.
+#
+# THE INSTALL-PATH JOURNEY (J2-install, the last three steps). The live-registry test above proves an
+# artifact installs and its entrypoint imports. The journey proves what follows: the installed entrypoint
+# runs as the child, the server and the device both accept its coverage, and a replaced digest stops counting
+# until its own run proves it. It runs against this job's registry with the same stub verifier, so (1) and (2)
+# above apply to it, and it proves nothing about signatures or ghcr.io.
 
 on:
   pull_request:
@@ -56,6 +62,11 @@ on:
       - "packages/local-collector/src/managed/**"
       - "packages/local-collector/test/managed-connectors.test.ts"
       - "packages/local-collector/test/managed-connectors-live-registry.test.ts"
+      - "packages/local-collector/test/helpers/live-registry-client.ts"
+      # The install-path journey (J2-install) and the fixture it packages.
+      - "reference-implementation/test/local-device-coverage-journey.test.ts"
+      - "reference-implementation/test/helpers/install-path-fixture.ts"
+      - "reference-implementation/scripts/build-install-path-releases.ts"
       # This job's own control files: a PR that only edits the workflow or moves the producer pin
       # would otherwise not run the thing it changed. Same reasoning as consumer-drift-signal.yml's
       # "Producer workflows should include their own control files in triggers".
@@ -67,6 +78,10 @@ on:
       - "packages/local-collector/src/managed/**"
       - "packages/local-collector/test/managed-connectors.test.ts"
       - "packages/local-collector/test/managed-connectors-live-registry.test.ts"
+      - "packages/local-collector/test/helpers/live-registry-client.ts"
+      - "reference-implementation/test/local-device-coverage-journey.test.ts"
+      - "reference-implementation/test/helpers/install-path-fixture.ts"
+      - "reference-implementation/scripts/build-install-path-releases.ts"
       - ".github/workflows/managed-connector-oci-e2e.yml"
       - ".github/managed-connector-e2e-pin.json"
   workflow_dispatch:
@@ -162,7 +177,9 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
-          node-version: "22.23.2"
+          # 24.21.0 is the version the reference-implementation job runs its tests on, and the
+          # install-path journey below is one of those tests. The producer's engines pin node 24 too.
+          node-version: "24.21.0"
 
       - name: Install this repository's dependencies
         run: npm ci --ignore-scripts
@@ -447,3 +464,58 @@ jobs:
 
           echo "OK: the consumer rejected blobs that did not hash to their pinned digests."
           rm -f proxied.txt
+
+      - name: Build the workspace packages the reference server loads
+        # The reference-implementation job builds these after `npm ci` (reference-implementation.yml). The
+        # install-path journey imports the server, which loads their dist/ output. This job runs
+        # `npm ci --ignore-scripts`, so nothing has built them yet. The root postinstall is not needed here:
+        # it fetches connector packages, and this journey runs none.
+        run: |
+          set -euo pipefail
+          npm --prefix packages/connector-protocol run build
+          npm --prefix packages/collector-runtime run build
+          npm --prefix reference-implementation/vendor/read-core run build
+          npm --prefix reference-implementation/vendor/cli run build
+          npm --prefix reference-implementation/vendor/mcp-server run build
+
+      - name: Build and push the install-path releases A and B with the producer's builder
+        # Two releases of one connector (install-path-fixture.ts): the same manifest and different code layers,
+        # so different digests. The builder is the producer's own script at the pinned revision. The packaging
+        # tree around it is the fixture's. Both releases are pushed to this job's registry. The digests reach
+        # the journey step through a file, not through the log.
+        working-directory: reference-implementation
+        env:
+          PRODUCER_GIT: ${{ github.workspace }}/data-connectors
+          PRODUCER_SHA: ${{ steps.pin.outputs.sha }}
+          RELEASES_JSON: ${{ runner.temp }}/install-path-releases.json
+        run: |
+          set -euo pipefail
+          node --import tsx scripts/build-install-path-releases.ts \
+            --producer-git "$PRODUCER_GIT" \
+            --producer-sha "$PRODUCER_SHA" \
+            --registry localhost:5000 \
+            --work "${RUNNER_TEMP}/install-path" \
+            --modules "$PRODUCER_GIT/node_modules" > "$RELEASES_JSON"
+
+      - name: Run the install-path journey (J2-install) through the managed path
+        working-directory: reference-implementation
+        env:
+          PDPP_TEST_OCI_REGISTRY: localhost:5000
+          RELEASES_JSON: ${{ runner.temp }}/install-path-releases.json
+        run: |
+          set -euo pipefail
+          digest_a="$(node -e 'process.stdout.write(require(process.env.RELEASES_JSON).a.digest)')"
+          digest_b="$(node -e 'process.stdout.write(require(process.env.RELEASES_JSON).b.digest)')"
+          export PDPP_TEST_INSTALL_PATH_DIGEST_A="$digest_a" PDPP_TEST_INSTALL_PATH_DIGEST_B="$digest_b"
+          node --test --import tsx --test-name-pattern=J2-install test/local-device-coverage-journey.test.ts | tee result.txt
+          # The same guard as the live-registry step above: node --test exits 0 on a skipped test, so require
+          # exactly one passing test and no skips. A typo in an env var name must not turn this job green.
+          if ! grep -qE 'pass 1$' result.txt; then
+            echo "::error::the install-path journey did not report exactly one passing test" >&2
+            exit 1
+          fi
+          if ! grep -qE 'skipped 0$' result.txt; then
+            echo "::error::the install-path journey SKIPPED; its env vars did not reach it" >&2
+            exit 1
+          fi
+          rm -f result.txt

From 43f223325e2fceb805103595c2ef47e27cf84165 Mon Sep 17 00:00:00 2001
From: Tim Nunamaker <tnunamak@gmail.com>
Date: Thu, 22 Oct 2026 05:20:57 -0500
Subject: [PATCH 26/87] fix(local-device): retire a terminal proof superseded
 by a later state commit

A local source's v2 terminal proof stayed covered after a later successful
run committed STATE with no terminal replacement. The projection read the
settled run's verdict and the legacy diagnostics as current, although the
source's newest state commit was covered by neither.

The proof is now retired when the connection's newest state commit is
strictly later than the proof's own instant. A terminal commit stamps its
state rows and its run completion with one instant, so its own commit and
any earlier commit never retire it. Server-owned `$` state (declared and
measured scope) is not a commit. Ordering uses the server's wall clock:
connector state has no durable sequence, and the source-revision counter
does not advance on state writes.

The runtime is unchanged. Emitting a terminal replacement for every
unnegotiated success would add a run-history row and an outbox commit per
legacy run. An unnegotiated run that commits neither STATE nor a terminal
record is not observable to the server, so the last proof still stands for
it. Closing that case needs a runtime boundary.

Signed-off-by: Tim Nunamaker <tnunamak@gmail.com>
Assisted-by: AI
---
 PG-PROFILE-51-REPORT.md                       |   2 +-
 .../scripts/postgres-template-eligibility.ts  |   2 +
 reference-implementation/server/records.ts    |  67 ++
 .../server/ref-control.ts                     |  75 +-
 .../local-device-coverage-stale-proof.test.ts | 678 ++++++++++++++++++
 ...ice-coverage-state-commit-postgres.test.ts | 109 +++
 6 files changed, 923 insertions(+), 10 deletions(-)
 create mode 100644 reference-implementation/test/local-device-coverage-stale-proof.test.ts
 create mode 100644 reference-implementation/test/local-device-coverage-state-commit-postgres.test.ts

diff --git a/PG-PROFILE-51-REPORT.md b/PG-PROFILE-51-REPORT.md
index ec4534cf9..d0209d32d 100644
--- a/PG-PROFILE-51-REPORT.md
+++ b/PG-PROFILE-51-REPORT.md
@@ -168,7 +168,7 @@ tail:
 
 The completed profile receipt recorded 1,034 files; that historical receipt
 is unchanged. The template equivalence registry is a different measure:
-156 eligible plus 37 cold-required files, for **193** total. The
+157 eligible plus 37 cold-required files, for **194** total. The
 handle-generation, issuance-cutover, opaque-cursor and search-index repair
 tests remain registered. These counts are recomputed from the merged registry arrays.
 
diff --git a/reference-implementation/scripts/postgres-template-eligibility.ts b/reference-implementation/scripts/postgres-template-eligibility.ts
index 3e82b9010..d17287549 100644
--- a/reference-implementation/scripts/postgres-template-eligibility.ts
+++ b/reference-implementation/scripts/postgres-template-eligibility.ts
@@ -103,6 +103,8 @@ export const POSTGRES_TEMPLATE_ELIGIBLE_FILES: readonly string[] = [
   "test/lexical-index-skip-unchanged-postgres.test.ts",
   "test/live-shadow-comparison.test.ts",
   "test/local-coverage-state-parser-postgres.test.ts",
+  // Postgres is a fixture for the newest state-commit read, not the schema bootstrap under test.
+  "test/local-device-coverage-state-commit-postgres.test.ts",
   "test/manual-upload-artifact-store-postgres.test.ts",
   "test/oauth-code-delivery-atomicity.test.ts",
   "test/owner-connection-delete-orphans.test.ts",
diff --git a/reference-implementation/server/records.ts b/reference-implementation/server/records.ts
index 5b7e15dae..9088edfe5 100644
--- a/reference-implementation/server/records.ts
+++ b/reference-implementation/server/records.ts
@@ -4863,6 +4863,68 @@ export async function listLocalCoverageDiagnostics(storageTarget: RecordStorageT
   return [...byStore.values()].sort((a, b) => a.store.localeCompare(b.store));
 }
 
+/**
+ * The newest state-commit instant for one connection: the max `updated_at`
+ * over its connector-state rows, skipping the server's own `$`-prefixed rows
+ * (declared and measured scope). A state write stamps this column, and a
+ * terminal commit stamps its state and its run completion with one instant, so
+ * the projection can tell a later commit from a proof's own transaction. There
+ * is no durable sequence on state writes; this is the only ordering they carry.
+ */
+async function readLatestStateCommitAt(connectorInstanceId: string): Promise<string | null> {
+  if (isPostgresStorageBackend()) {
+    const result = await postgresQuery<{ latest: string | null }>(
+      "SELECT MAX(updated_at) AS latest FROM connector_state WHERE connector_instance_id = $1 AND substr(stream, 1, 1) <> '$'",
+      [connectorInstanceId]
+    );
+    return result.rows[0]?.latest ?? null;
+  }
+  const row = getDb()
+    .prepare(
+      "SELECT MAX(updated_at) AS latest FROM connector_state WHERE connector_instance_id = ? AND substr(stream, 1, 1) <> '$'"
+    )
+    .get<{ latest: string | null }>(connectorInstanceId);
+  return row?.latest ?? null;
+}
+
+/** Batched {@link readLatestStateCommitAt} for one page of connection ids, keyed by connector instance. */
+async function readLatestStateCommitAtByConnectionIds(ids: readonly string[]): Promise<Map<string, string>> {
+  const latest = new Map<string, string>();
+  interface Row {
+    connector_instance_id: string;
+    latest: string | null;
+  }
+  const rows: Row[] = [];
+  if (isPostgresStorageBackend()) {
+    const query = await postgresQuery<Row>(
+      `SELECT connector_instance_id, MAX(updated_at) AS latest FROM connector_state
+        WHERE connector_instance_id = ANY($1::text[]) AND substr(stream, 1, 1) <> '$'
+        GROUP BY connector_instance_id`,
+      [ids]
+    );
+    rows.push(...query.rows);
+  } else {
+    for (let start = 0; start < ids.length; start += 900) {
+      const chunk = ids.slice(start, start + 900);
+      rows.push(
+        ...(getDb()
+          .prepare(
+            `SELECT connector_instance_id, MAX(updated_at) AS latest FROM connector_state
+              WHERE connector_instance_id IN (${chunk.map(() => "?").join(", ")}) AND substr(stream, 1, 1) <> '$'
+              GROUP BY connector_instance_id`
+          )
+          .all(...chunk) as Row[])
+      );
+    }
+  }
+  for (const row of rows) {
+    if (row.latest) {
+      latest.set(row.connector_instance_id, row.latest);
+    }
+  }
+  return latest;
+}
+
 /**
  * Read the local coverage proof without laundering malformed or duplicate
  * diagnostic rows into a healthy projection. This is intentionally separate
@@ -4881,6 +4943,7 @@ export async function readCommittedLocalCoverageDiagnostics(storageTarget: Recor
       missingStores: [],
       rows: [],
       state: null,
+      stateCommittedAt: null,
       unexpectedStores: [],
       updatedAt: null,
     };
@@ -4928,6 +4991,7 @@ export async function readCommittedLocalCoverageDiagnostics(storageTarget: Recor
     declaredCollectionScope,
     manifestGeneration: currentGeneration === null ? null : Number(currentGeneration),
     state,
+    stateCommittedAt: await readLatestStateCommitAt(connectorInstanceId),
     stateManifestGeneration: stateGeneration === null ? null : Number(stateGeneration),
     updatedAt: stateProjection.updated_at ?? null,
   };
@@ -4946,6 +5010,7 @@ export async function readCommittedLocalCoverageDiagnosticsByConnectionIds(conne
       declaredCollectionScope: string;
       manifestGeneration: number | null;
       state: unknown;
+      stateCommittedAt: string | null;
       stateManifestGeneration: number | null;
       updatedAt: string | null;
     }
@@ -4992,6 +5057,7 @@ export async function readCommittedLocalCoverageDiagnosticsByConnectionIds(conne
       );
     }
   }
+  const latestStateCommitAt = await readLatestStateCommitAtByConnectionIds(ids);
   for (const row of rows) {
     // `row.state_json` is already the `coverage_diagnostics` stream's own
     // payload — the JOIN's `ON` clause already narrows `cs.stream =
@@ -5010,6 +5076,7 @@ export async function readCommittedLocalCoverageDiagnosticsByConnectionIds(conne
       declaredCollectionScope: declaredCollectionScopeFingerprint(row.scope_state_json ?? null),
       manifestGeneration: row.current_generation === null ? null : Number(row.current_generation),
       state: parsedState,
+      stateCommittedAt: latestStateCommitAt.get(row.connector_instance_id) ?? null,
       stateManifestGeneration: row.state_generation === null ? null : Number(row.state_generation),
       updatedAt: row.updated_at ?? null,
     });
diff --git a/reference-implementation/server/ref-control.ts b/reference-implementation/server/ref-control.ts
index c046c9178..198f013f9 100644
--- a/reference-implementation/server/ref-control.ts
+++ b/reference-implementation/server/ref-control.ts
@@ -4803,6 +4803,12 @@ interface LocalCoverageDiagnosticAxis {
     | "duplicate_stores"
     | "missing_stores"
     | "unexpected_stores";
+  /**
+   * The newest state-commit instant for this connection (see
+   * `readLatestStateCommitAt` in `server/records.ts`). Carried so the projection
+   * can retire a proof that a later, unaccounted state commit has superseded.
+   */
+  readonly stateCommittedAt?: string | null;
 }
 
 const LOCAL_COVERAGE_ACCOUNTED_STATUSES = new Set([
@@ -4898,6 +4904,8 @@ export function deriveLocalCoverageAxis(input: {
    * that hold no boundary omit it and keep the honest `unscoped` default.
    */
   readonly declaredCollectionScope?: string | null;
+  /** The connection's newest state-commit instant (`readLatestStateCommitAt`); omitted by callers with no state read. */
+  readonly stateCommittedAt?: string | null;
 }): LocalCoverageDiagnosticAxis {
   const declaredScope = resolveDeclaredCoverageScope(input.declaredCollectionScope, input.state);
   const { rows } = input;
@@ -4915,7 +4923,11 @@ export function deriveLocalCoverageAxis(input: {
     rows.map((row) => readRowCollectionScope(row)).filter((value): value is string => value !== null)
   );
   const measuredScope: string | null = measuredScopes.size === 1 ? ([...measuredScopes][0] ?? null) : null;
-  const scopeField = { declaredCollectionScope: declaredScope, measuredCollectionScope: measuredScope };
+  const scopeField = {
+    declaredCollectionScope: declaredScope,
+    measuredCollectionScope: measuredScope,
+    stateCommittedAt: input.stateCommittedAt ?? null,
+  };
   const stateCursor =
     input.state && typeof input.state === "object" && !Array.isArray(input.state)
       ? (input.state as Record<string, unknown>).fetched_at
@@ -5077,6 +5089,44 @@ function deriveLocalTerminalCoverageAxis(
   };
 }
 
+/**
+ * Retire a local coverage proof that a later, unaccounted state commit has
+ * superseded.
+ *
+ * A terminal commit writes its state rows and its run completion with one
+ * instant, so `evidenceAsOf` is the proof's own instant: a v2 proof's run
+ * `completed_at`, or a legacy proof's diagnostics `updated_at`. A state commit
+ * strictly after that instant came from a later run or checkpoint. That commit
+ * carried no terminal replacement, so the proof no longer describes the source's
+ * latest collection, and coverage is unknown until a later run proves it again.
+ * A commit at the same instant is the proof's own transaction, and an earlier
+ * one predates it. Neither retires the proof.
+ *
+ * The server decides this from what it stored. It never reads the device outbox.
+ * An unparseable instant keeps the proof, because it cannot establish that a
+ * later commit exists.
+ */
+function retireLocalCoverageSupersededByLaterCommit(
+  axis: LocalCoverageDiagnosticAxis | null,
+  stateCommittedAt: string | null | undefined
+): LocalCoverageDiagnosticAxis | null {
+  if (axis === null || axis.axis === "unknown" || !axis.evidenceAsOf || !stateCommittedAt) {
+    return axis;
+  }
+  if (!(Date.parse(stateCommittedAt) > Date.parse(axis.evidenceAsOf))) {
+    return axis;
+  }
+  return {
+    ...axis,
+    axis: "unknown",
+    evidenceAsOf: null,
+    measuredCollectionScope: null,
+    reliable: false,
+    rows: [],
+    unaccountedStores: [],
+  };
+}
+
 /**
  * Read durable local coverage diagnostics for one connection and project the
  * coverage axis. Returns `null` (axis derivation skipped) when the read throws —
@@ -7096,15 +7146,22 @@ function synthesizeConnectorSummary(input: ConnectorSummarySynthesisInput): Conn
   const fallbackSettledRun = latestSettledRun ?? fallbackLatestSettledRun(lastRun, lastSuccessfulRun);
   const authoritativeLatestSettledRun = isOwnScopedRun(fallbackSettledRun) ? fallbackSettledRun : null;
   const localCollectorRelease = localDeviceBacked ? readLocalCollectorRelease(connectorId) : null;
+  // Whichever proof this reads (the settled run's v2 verdict, else the legacy
+  // diagnostics), a later state commit it does not account for retires it. The
+  // downstream readers below all take `effectiveLocalCoverage`, so the
+  // retirement reaches every consumer, not only this branch.
   const effectiveLocalCoverage = localDeviceBacked
-    ? (deriveLocalTerminalCoverageAxis(
-        fallbackSettledRun,
-        manifest,
-        localCoverage,
-        evidence?.manifest_generation ?? null,
-        localCollectorRelease?.artifactDigest ?? null,
-        localCollectorRelease ? fingerprintDeviceAttemptManifest(localCollectorRelease.manifest) : null
-      ) ?? localCoverage)
+    ? retireLocalCoverageSupersededByLaterCommit(
+        deriveLocalTerminalCoverageAxis(
+          fallbackSettledRun,
+          manifest,
+          localCoverage,
+          evidence?.manifest_generation ?? null,
+          localCollectorRelease?.artifactDigest ?? null,
+          localCollectorRelease ? fingerprintDeviceAttemptManifest(localCollectorRelease.manifest) : null
+        ) ?? localCoverage,
+        localCoverage?.stateCommittedAt
+      )
     : localCoverage;
   const authoritativeLatestStreamFacts = localDeviceBacked ? null : latestStreamFacts;
   const terminalSetupDisposition =
diff --git a/reference-implementation/test/local-device-coverage-stale-proof.test.ts b/reference-implementation/test/local-device-coverage-stale-proof.test.ts
new file mode 100644
index 000000000..8aeed1400
--- /dev/null
+++ b/reference-implementation/test/local-device-coverage-stale-proof.test.ts
@@ -0,0 +1,678 @@
+// Copyright The PDP-Connect Contributors
+// SPDX-License-Identifier: Apache-2.0
+
+// Stale terminal proof. A negotiated run commits a v2 terminal proof for every
+// requested stream. A later successful run that did not negotiate run coverage
+// then reaches the server with no terminal evidence. The server must not keep
+// projecting the older proof as covered once a later state commit exists that
+// the proof does not account for.
+//
+// Two layers:
+//
+//   - Store-level boundary tests with an injected clock. They pin the ordering
+//     rule: a state commit strictly after the proof retires it; one at the same
+//     instant (the proof's own transaction) or before it does not.
+//   - End-to-end journey through the real collector runner, the reference
+//     server, and the HTTP owner list and detail routes, as in
+//     local-device-coverage-journey.test.ts. Run B is unnegotiated and runs on a
+//     fresh device outbox, so the device holds no local receipt for it. The
+//     server projection must not depend on that device state.
+//
+// The journey has one limit that the server cannot close on its own. An
+// unnegotiated run that commits no state and no terminal record leaves nothing
+// the server can order against the proof. That case is pinned below as a
+// known limit, not a fix.
+
+// The local-collector bin reaches the untyped installer core. This names the
+// local collector's own shim for it, which the reference-implementation program
+// does not otherwise include.
+/// <reference path="../../packages/local-collector/src/managed/installer-core.d.ts" />
+
+import assert from "node:assert/strict";
+import { createHash } from "node:crypto";
+import { mkdtempSync, rmSync } from "node:fs";
+import { mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { dirname, join } from "node:path";
+import { DatabaseSync } from "node:sqlite";
+import test from "node:test";
+
+import { bindOptionalRunCoverageToRelease } from "../../packages/local-collector/bin/pdpp-local-collector.ts";
+import {
+  type CollectorConnectorSpec,
+  type CollectorRunResult,
+  runCollectorConnector,
+} from "../../packages/local-collector/src/runner.ts";
+import { COLLECTOR_PROTOCOL_VERSION } from "../server/collector-protocol.ts";
+import { reconcileDirtyConnectorSummaryEvidence } from "../server/connector-summary-read-model.ts";
+import { closeDb, getDb, initDb } from "../server/db.ts";
+import { fingerprintDeviceAttemptManifest } from "../server/device-ingest-attempt-context.ts";
+import { startServer } from "../server/index.ts";
+import { buildStoredCollectionScope, COLLECTION_SCOPE_STATE_KEY } from "../server/local-collection-scope.ts";
+import { __setLocalCollectorReleaseForTest, readLocalCollectorRelease } from "../server/local-collector-profiles.ts";
+import { putSyncState } from "../server/records.ts";
+import { listConnectorSummaries } from "../server/ref-control.ts";
+import { createSqliteConnectorInstanceStore } from "../server/stores/connector-instance-store.ts";
+import { getDefaultDeviceExporterStore } from "../server/stores/device-exporter-store.ts";
+import { commitTerminalRun } from "../server/stores/terminal-run-commit-store.ts";
+import { closeTestServer } from "./helpers/close-test-server.ts";
+
+const CONNECTOR_ID = "claude-code";
+const LOCAL_BINDING_NAME = "stale-proof-laptop";
+const OWNER_PASSWORD = "local-coverage-stale-proof-password";
+const STREAMS = ["sessions", "messages"];
+const PROTOCOL_HEADERS = { "X-PDPP-Collector-Protocol": COLLECTOR_PROTOCOL_VERSION };
+const CSRF_FIELD_PATTERN = /<input type="hidden" name="_csrf" value="([^"]+)"\s*\/>/;
+
+// The fixture release declares run coverage for both streams. A negotiated run
+// binds to it; an unnegotiated run leaves the spec unbound.
+const PROFILE = {
+  connector_id: CONNECTOR_ID,
+  run_coverage: { version: 1 },
+  streams: [
+    { coverage_stores: ["projects"], name: "sessions", primary_key: ["id"] },
+    { coverage_stores: ["derived_messages"], name: "messages", primary_key: ["id"] },
+  ],
+  version: "0.0.0-stale-proof",
+};
+const ARTIFACT_DIGEST = `sha256:${createHash("sha256").update(JSON.stringify(PROFILE)).digest("hex")}`;
+const SERVER_RELEASE = { artifactDigest: ARTIFACT_DIGEST, manifest: PROFILE };
+
+// Offline fixture connector. It sends the same records in every mode. Its DONE
+// carries a coverage claim only when START negotiated run coverage, as a real
+// connector does. Mode "complete" also commits STATE; "records-only" does not.
+// Written with no template interpolation so it can sit inside this file.
+const FIXTURE_CONNECTOR_SOURCE = `
+import { writeFileSync } from "node:fs";
+
+const [mode, observePath, tag] = process.argv.slice(2);
+let input = "";
+process.stdin.setEncoding("utf8");
+process.stdin.on("data", (chunk) => {
+  input += chunk;
+});
+process.stdin.on("end", () => {
+  const start = JSON.parse(input.split("\\n")[0]);
+  writeFileSync(observePath, JSON.stringify(start));
+  const emit = (message) => process.stdout.write(JSON.stringify(message) + "\\n");
+  const emittedAt = "2026-10-22T12:00:00.000Z";
+  const record = (stream, id) => emit({ data: { id }, emitted_at: emittedAt, key: id, stream, type: "RECORD" });
+  const coverage = {
+    collection_scope: start.collection_scope,
+    streams: [
+      { scoped: true, stores: [{ status: "collected", store: "projects" }], stream: "sessions" },
+      { scoped: true, stores: [{ status: "collected", store: "derived_messages" }], stream: "messages" },
+    ],
+    version: 1,
+  };
+  record("sessions", "s-1");
+  record("sessions", "s-2");
+  record("messages", "m-1");
+  if (mode === "complete") {
+    emit({ cursor: { cursor: tag + "-sessions" }, stream: "sessions", type: "STATE" });
+    emit({ cursor: { cursor: tag + "-messages" }, stream: "messages", type: "STATE" });
+  }
+  emit({
+    ...(start.run_coverage_version === 1 ? { coverage } : {}),
+    records_emitted: 3,
+    status: "succeeded",
+    type: "DONE",
+  });
+});
+`;
+
+interface JsonResponse {
+  readonly body: Record<string, unknown> | null;
+  readonly status: number;
+}
+
+interface Enrolled {
+  readonly connector_instance_id: string;
+  readonly device_id: string;
+  readonly device_token: string;
+  readonly source_instance_id: string;
+}
+
+interface Journey {
+  readonly asUrl: string;
+  readonly childPath: string;
+  readonly cookie: string;
+  readonly dir: string;
+  readonly enrolled: Enrolled;
+  readonly queuePath: string;
+}
+
+interface RunOptions {
+  readonly mode: "complete" | "records-only";
+  readonly negotiated: boolean;
+  readonly queuePath?: string;
+  readonly tag: string;
+}
+
+interface RunOutcome {
+  readonly observed: Record<string, unknown>;
+  readonly result: CollectorRunResult;
+}
+
+interface ProjectedStream {
+  readonly coverage_condition: string;
+  readonly stream: string;
+}
+
+interface OwnerConnectionRow {
+  readonly collection_report: readonly ProjectedStream[];
+  readonly connection_health: { readonly axes: { readonly coverage: string; readonly outbox: string } };
+}
+
+async function requestJson(url: string, init: RequestInit = {}): Promise<JsonResponse> {
+  const resp = await fetch(url, { ...init, headers: { Accept: "application/json", ...init.headers } });
+  const text = await resp.text();
+  let body: Record<string, unknown> | null = null;
+  try {
+    body = JSON.parse(text) as Record<string, unknown>;
+  } catch {
+    // A non-JSON response keeps a null body; the status assertion reports it.
+  }
+  return { body, status: resp.status };
+}
+
+function postJson(url: string, body: unknown, headers: Record<string, string> = {}): Promise<JsonResponse> {
+  return requestJson(url, {
+    body: JSON.stringify(body),
+    headers: { "Content-Type": "application/json", ...headers },
+    method: "POST",
+  });
+}
+
+function setCookiePair(resp: Response, name: string): string | null {
+  for (const header of resp.headers.getSetCookie()) {
+    const [pair] = header.split(";");
+    if (pair?.startsWith(`${name}=`)) {
+      return pair;
+    }
+  }
+  return null;
+}
+
+async function ownerSessionCookie(asUrl: string): Promise<string> {
+  const page = await fetch(`${asUrl}/owner/login`, { headers: { Accept: "text/html" }, redirect: "manual" });
+  const csrfCookie = setCookiePair(page, "pdpp_owner_csrf") ?? "";
+  const csrfField = CSRF_FIELD_PATTERN.exec(await page.text())?.[1] ?? "";
+  const login = await fetch(`${asUrl}/owner/login`, {
+    body: new URLSearchParams({ _csrf: csrfField, password: OWNER_PASSWORD, return_to: "/" }).toString(),
+    headers: { Accept: "text/html", "Content-Type": "application/x-www-form-urlencoded", Cookie: csrfCookie },
+    method: "POST",
+    redirect: "manual",
+  });
+  const session = setCookiePair(login, "pdpp_owner_session");
+  assert.ok(session, `owner login should set pdpp_owner_session (status ${login.status})`);
+  return session;
+}
+
+async function enrollLaptop(asUrl: string, cookie: string): Promise<Enrolled> {
+  const code = await postJson(
+    `${asUrl}/_ref/device-exporters/enrollment-codes`,
+    { connector_id: CONNECTOR_ID, local_binding_name: LOCAL_BINDING_NAME },
+    { Cookie: cookie }
+  );
+  assert.equal(code.status, 201, JSON.stringify(code.body));
+  const enrolled = await postJson(
+    `${asUrl}/_ref/device-exporters/enroll`,
+    { enrollment_code: String(code.body?.enrollment_code) },
+    PROTOCOL_HEADERS
+  );
+  assert.equal(enrolled.status, 201, JSON.stringify(enrolled.body));
+  const body = enrolled.body ?? {};
+  return {
+    connector_instance_id: String(body.connector_instance_id),
+    device_id: String(body.device_id),
+    device_token: String(body.device_token),
+    source_instance_id: String(body.source_instance_id),
+  };
+}
+
+/**
+ * Enrolment registers the checked-in claude-code catalog manifest. The lane
+ * covers two streams, so the catalog entry is narrowed to the release's streams
+ * and its manifest generation advances, as a catalog update does.
+ */
+function registerFixtureManifest(connectorInstanceId: string): void {
+  const row = getDb().prepare("SELECT manifest FROM connectors WHERE connector_id = ?").get(CONNECTOR_ID) as
+    | { manifest: string }
+    | undefined;
+  assert.ok(row, "enrolment registers the claude-code catalog manifest");
+  const catalog = JSON.parse(row.manifest) as Record<string, unknown> & { streams: Record<string, unknown>[] };
+  const streams = PROFILE.streams.map((release) => {
+    const declared = catalog.streams.find((stream) => stream.name === release.name);
+    assert.ok(declared, `the catalog declares ${release.name}`);
+    return { ...declared, coverage_stores: release.coverage_stores };
+  });
+  getDb()
+    .prepare("UPDATE connectors SET manifest = ? WHERE connector_id = ?")
+    .run(JSON.stringify({ ...catalog, streams }), CONNECTOR_ID);
+  getDb()
+    .prepare(
+      "UPDATE connector_instances SET manifest_generation = manifest_generation + 1 WHERE connector_instance_id = ?"
+    )
+    .run(connectorInstanceId);
+}
+
+async function withJourney(run: (journey: Journey) => Promise<void>): Promise<void> {
+  const dir = await mkdtemp(join(tmpdir(), "pdpp-local-coverage-stale-proof-"));
+  const childPath = join(dir, "fixture-connector.mjs");
+  await writeFile(childPath, FIXTURE_CONNECTOR_SOURCE);
+  const server = await startServer({
+    asPort: 0,
+    dbPath: join(dir, "pdpp.sqlite"),
+    ownerAuthPassword: OWNER_PASSWORD,
+    quiet: true,
+    rsPort: 0,
+  });
+  const asUrl = `http://localhost:${server.asPort}`;
+  __setLocalCollectorReleaseForTest(CONNECTOR_ID, SERVER_RELEASE);
+  try {
+    const cookie = await ownerSessionCookie(asUrl);
+    const enrolled = await enrollLaptop(asUrl, cookie);
+    registerFixtureManifest(enrolled.connector_instance_id);
+    await run({ asUrl, childPath, cookie, dir, enrolled, queuePath: join(dir, "outbox.sqlite") });
+  } finally {
+    __setLocalCollectorReleaseForTest(CONNECTOR_ID, null);
+    await closeTestServer(server);
+    closeDb();
+    await rm(dir, { force: true, recursive: true });
+  }
+}
+
+async function runOnce(journey: Journey, options: RunOptions): Promise<RunOutcome> {
+  const observePath = join(journey.dir, `start-${options.tag}.json`);
+  const base: CollectorConnectorSpec = {
+    args: [journey.childPath, options.mode, observePath, options.tag],
+    command: process.execPath,
+    connector_id: CONNECTOR_ID,
+    protocol_capabilities: [],
+    runtime_requirements: { bindings: {} },
+    streams: STREAMS,
+  };
+  const connector = options.negotiated
+    ? bindOptionalRunCoverageToRelease(base, { digest: ARTIFACT_DIGEST }, PROFILE)
+    : base;
+  const result = await runCollectorConnector({
+    baseUrl: journey.asUrl,
+    connector,
+    deviceId: journey.enrolled.device_id,
+    deviceToken: journey.enrolled.device_token,
+    executionRoot: dirname(journey.childPath),
+    outboxPolicy: { maxDrainIterations: 1, retryBackoffMs: 1 },
+    queuePath: options.queuePath ?? journey.queuePath,
+    runId: options.tag,
+    sourceInstanceId: journey.enrolled.source_instance_id,
+  });
+  return { observed: JSON.parse(await readFile(observePath, "utf8")) as Record<string, unknown>, result };
+}
+
+/** The terminal facts a device outbox holds as its current receipt, or none for a fresh outbox. */
+function deviceReceiptFacts(queuePath: string, sourceInstanceId: string): Record<string, unknown>[] {
+  const db = new DatabaseSync(queuePath);
+  try {
+    const row = db
+      .prepare("SELECT terminal_facts_json FROM local_device_terminal_coverage_receipts WHERE source_instance_id = ?")
+      .get(sourceInstanceId) as { terminal_facts_json: string } | undefined;
+    return row ? (JSON.parse(row.terminal_facts_json) as Record<string, unknown>[]) : [];
+  } finally {
+    db.close();
+  }
+}
+
+/** The per-stream facts the server stored for one terminal commit, or null when none was committed. */
+function serverRunStreams(runId: string): Record<string, unknown>[] | null {
+  const row = getDb().prepare("SELECT facts_json FROM run_history WHERE run_id = ?").get(runId) as
+    | { facts_json: string }
+    | undefined;
+  if (!row) {
+    return null;
+  }
+  const facts = JSON.parse(row.facts_json) as { collection_facts?: { streams?: Record<string, unknown>[] } };
+  return facts.collection_facts?.streams ?? [];
+}
+
+/** Stream cursors only. The `$`-prefixed rows are the server's own collection-scope state, not connector cursors. */
+function serverCursors(journey: Journey): Record<string, unknown> {
+  const rows = getDb()
+    .prepare("SELECT stream, state_json FROM connector_state WHERE connector_instance_id = ? ORDER BY stream")
+    .all(journey.enrolled.connector_instance_id) as Array<{ state_json: string; stream: string }>;
+  return Object.fromEntries(
+    rows.filter((row) => !row.stream.startsWith("$")).map((row) => [row.stream, JSON.parse(row.state_json) as unknown])
+  );
+}
+
+/**
+ * The owner list row and the owner detail for the connection. Both read the
+ * same projection; the test asserts they agree before it looks at the value.
+ */
+async function ownerConnectionRow(journey: Journey): Promise<OwnerConnectionRow> {
+  // The owner routes read a summary read model that the server refreshes from
+  // dirty evidence in the background. Refresh it here, as the projection oracle
+  // does, so the read reflects the run just made.
+  await reconcileDirtyConnectorSummaryEvidence(null);
+  const list = await requestJson(`${journey.asUrl}/_ref/connectors?limit=100`, { headers: { Cookie: journey.cookie } });
+  assert.equal(list.status, 200, JSON.stringify(list.body));
+  const rows = (list.body?.data ?? []) as Record<string, unknown>[];
+  const row = rows.find((candidate) => candidate.connection_id === journey.enrolled.connector_instance_id);
+  assert.ok(row, "the owner list projects the enrolled connection");
+  // The detail route is keyed by connector; each lane here holds one connection.
+  const detail = await requestJson(`${journey.asUrl}/_ref/connectors/${CONNECTOR_ID}`, {
+    headers: { Cookie: journey.cookie },
+  });
+  assert.equal(detail.status, 200, JSON.stringify(detail.body));
+  assert.deepEqual(detail.body?.collection_report, row.collection_report, "list and detail agree");
+  const detailHealth = detail.body?.connection_health as OwnerConnectionRow["connection_health"] | undefined;
+  assert.equal(
+    detailHealth?.axes.coverage,
+    (row as unknown as OwnerConnectionRow).connection_health.axes.coverage,
+    "list and detail agree on the coverage axis"
+  );
+  return row as unknown as OwnerConnectionRow;
+}
+
+function conditions(row: OwnerConnectionRow): Record<string, string> {
+  return Object.fromEntries(row.collection_report.map((entry) => [entry.stream, entry.coverage_condition]));
+}
+
+// ---------------------------------------------------------------------------
+// Store-level ordering boundary. The clock is injected, so "the same instant as
+// the proof" and "strictly later" are exact, not timing-dependent.
+// ---------------------------------------------------------------------------
+
+const connectorId = "claude-code";
+const connectorInstanceId = "cin_stale_proof_boundary";
+const deviceId = "dev_stale_proof_boundary";
+const sourceInstanceId = "src_stale_proof_boundary";
+const ownerSubjectId = "owner_local";
+const PROOF_AT = "2026-10-22T10:00:00.000Z";
+
+async function withBoundaryConnection(run: () => Promise<void>): Promise<void> {
+  const directory = mkdtempSync(join(tmpdir(), "pdpp-stale-proof-boundary-"));
+  initDb(join(directory, "pdpp.sqlite"));
+  try {
+    const now = "2026-10-22T09:00:00.000Z";
+    getDb()
+      .prepare("INSERT INTO connectors(connector_id, manifest, created_at) VALUES (?, ?, ?)")
+      .run(
+        connectorId,
+        JSON.stringify({
+          capabilities: { public_listing: { tier: "supported" } },
+          connector_id: connectorId,
+          display_name: "Stale Proof Fixture",
+          protocol_version: "0.1.0",
+          streams: [
+            {
+              coverage_stores: ["projects"],
+              coverage_strategy: "checkpoint_window",
+              name: "sessions",
+              primary_key: ["id"],
+            },
+            {
+              coverage_stores: ["derived_messages"],
+              coverage_strategy: "checkpoint_window",
+              name: "messages",
+              primary_key: ["id"],
+            },
+          ],
+          version: "1.0.0",
+        }),
+        now
+      );
+    await createSqliteConnectorInstanceStore().upsert({
+      connectorId,
+      connectorInstanceId,
+      createdAt: now,
+      displayName: "laptop",
+      ownerSubjectId,
+      sourceBinding: { device: "laptop", kind: "local_device" },
+      sourceBindingKey: "laptop",
+      sourceKind: "local_device",
+      status: "active",
+      updatedAt: now,
+    });
+    const store = getDefaultDeviceExporterStore();
+    await store.createDevice({
+      createdAt: now,
+      deviceId,
+      displayName: "laptop",
+      ownerSubjectId,
+      status: "active",
+      updatedAt: now,
+    });
+    await store.upsertSourceInstance({
+      connectorId,
+      connectorInstanceId,
+      createdAt: now,
+      deviceId,
+      displayName: "laptop collector",
+      localBindingId: "laptop",
+      sourceInstanceId,
+      status: "active",
+      updatedAt: now,
+    });
+    await run();
+  } finally {
+    closeDb();
+    rmSync(directory, { force: true, recursive: true });
+  }
+}
+
+/**
+ * Commit a v2 terminal proof for both streams with the given run id. The source
+ * heartbeat is recorded at the same instant, so the outbox axis is fresh against
+ * the injected clock; its state rows and the run's completion carry that instant.
+ */
+async function seedV2Proof(runId: string): Promise<void> {
+  const release = readLocalCollectorRelease(connectorId);
+  assert.ok(release, "the reference server must have a verified local-collector release pin");
+  await getDefaultDeviceExporterStore().markSourceInstanceHeartbeat(deviceId, sourceInstanceId, {
+    lastError: null,
+    outboxDiagnostics: { dead_letter: 0, pending: 0, stale_leases: 0, succeeded: 1, total: 1 },
+    receivedAt: new Date().toISOString(),
+    recordsPending: 0,
+    status: "healthy",
+  });
+  const bindings = {
+    artifact_digest: release.artifactDigest,
+    binding_generation: 0,
+    manifest_fingerprint: fingerprintDeviceAttemptManifest(release.manifest),
+    runtime_accounting: {
+      checkpoint_eligible: true,
+      detail_complete: true,
+      durable_admission: true,
+      outstanding_debt: 0,
+      stream_evidence_consistent: true,
+    },
+    server_artifact_digest: release.artifactDigest,
+  };
+  await commitTerminalRun({
+    collectionBoundary: "unscoped",
+    commitId: `commit_${runId}`,
+    connectorId,
+    connectorInstanceId,
+    deviceId,
+    envelopeHash: `envelope_${runId}`,
+    normalizedFacts: [
+      {
+        ...bindings,
+        checkpoint: "committed",
+        collected: 0,
+        considered: null,
+        coverage_statuses: ["collected"],
+        covered: null,
+        pending_detail_gaps: 0,
+        scoped: true,
+        skipped: null,
+        stores: [{ status: "collected", store: "projects" }],
+        stream: "sessions",
+      },
+      {
+        ...bindings,
+        checkpoint: "committed",
+        collected: 0,
+        considered: null,
+        coverage_statuses: ["collected"],
+        covered: null,
+        pending_detail_gaps: 0,
+        scoped: true,
+        skipped: null,
+        stores: [{ status: "collected", store: "derived_messages" }],
+        stream: "messages",
+      },
+    ],
+    runId,
+    sourceInstanceId,
+    stateDelta: {},
+    version: 2,
+  });
+}
+
+async function boundaryProjection(): Promise<{ axis: string; conditions: Record<string, string> }> {
+  await reconcileDirtyConnectorSummaryEvidence(null);
+  const summary = (await listConnectorSummaries()).find((row) => row.connector_instance_id === connectorInstanceId);
+  assert.ok(summary, "the boundary connection is projected");
+  return {
+    axis: summary.connection_health.axes.coverage,
+    conditions: Object.fromEntries(summary.collection_report.map((entry) => [entry.stream, entry.coverage_condition])),
+  };
+}
+
+const BOUNDARY_TARGET = { connector_id: connectorId, connector_instance_id: connectorInstanceId };
+
+test("store: a state commit at the proof's own instant does not retire it; a strictly later one does", async (t) => {
+  await withBoundaryConnection(async () => {
+    t.mock.timers.enable({ apis: ["Date"], now: Date.parse(PROOF_AT) });
+    await seedV2Proof("run_boundary_proof");
+    assert.deepEqual(await boundaryProjection(), {
+      axis: "complete",
+      conditions: { messages: "complete", sessions: "complete" },
+    });
+
+    // The same instant as the proof: nothing is later than the proof's own commit.
+    await putSyncState(BOUNDARY_TARGET, { messages: { cursor: "same-instant" } });
+    assert.equal((await boundaryProjection()).axis, "complete", "a same-instant state commit is not later");
+
+    // One millisecond later: a state commit the proof does not account for.
+    t.mock.timers.setTime(Date.parse(PROOF_AT) + 1);
+    await putSyncState(BOUNDARY_TARGET, { messages: { cursor: "later" } });
+    assert.deepEqual(await boundaryProjection(), {
+      axis: "unknown",
+      conditions: { messages: "unknown", sessions: "unknown" },
+    });
+  });
+});
+
+test("store: a state commit before the proof does not retire it", async (t) => {
+  await withBoundaryConnection(async () => {
+    t.mock.timers.enable({ apis: ["Date"], now: Date.parse("2026-10-22T09:30:00.000Z") });
+    await putSyncState(BOUNDARY_TARGET, { messages: { cursor: "earlier" } });
+    t.mock.timers.setTime(Date.parse(PROOF_AT));
+    await seedV2Proof("run_boundary_after_earlier_state");
+    assert.equal((await boundaryProjection()).axis, "complete");
+  });
+});
+
+test("store: a later server-owned scope write is not a state commit and does not retire the proof", async (t) => {
+  await withBoundaryConnection(async () => {
+    t.mock.timers.enable({ apis: ["Date"], now: Date.parse(PROOF_AT) });
+    await seedV2Proof("run_boundary_scope_proof");
+    t.mock.timers.setTime(Date.parse(PROOF_AT) + 1);
+    await putSyncState(BOUNDARY_TARGET, {
+      [COLLECTION_SCOPE_STATE_KEY]: buildStoredCollectionScope(null, new Date().toISOString()),
+    });
+    assert.equal(
+      (await boundaryProjection()).axis,
+      "complete",
+      "the `$`-prefixed scope row is server state, not a commit"
+    );
+  });
+});
+
+// ---------------------------------------------------------------------------
+// End-to-end journey through the real runner and the HTTP owner routes.
+// ---------------------------------------------------------------------------
+
+test("journey: a later unnegotiated run that commits state retires the earlier v2 proof on list and detail", async () => {
+  await withJourney(async (journey) => {
+    // Run A: negotiated and complete. The server holds a v2 terminal proof for both streams.
+    const a = await runOnce(journey, { mode: "complete", negotiated: true, tag: "a-complete" });
+    assert.equal(a.observed.run_coverage_version, 1, "START negotiated run coverage");
+    assert.ok(serverRunStreams("a-complete"), "the server committed run A's terminal proof");
+    assert.equal((await ownerConnectionRow(journey)).connection_health.axes.coverage, "complete");
+
+    // Run B: unnegotiated and successful, on a fresh device outbox. It commits state and no terminal evidence.
+    const freshQueue = join(journey.dir, "outbox-fresh.sqlite");
+    const b = await runOnce(journey, { mode: "complete", negotiated: false, queuePath: freshQueue, tag: "b-state" });
+    assert.equal(b.observed.run_coverage_version, undefined, "START did not negotiate run coverage");
+    assert.equal(b.result.done?.status, "succeeded");
+    assert.deepEqual(
+      deviceReceiptFacts(freshQueue, journey.enrolled.source_instance_id),
+      [],
+      "the fresh outbox holds no receipt"
+    );
+    assert.equal(serverRunStreams("b-state"), null, "the server committed no terminal evidence for run B");
+    assert.deepEqual(
+      serverCursors(journey).messages,
+      { cursor: "b-state-messages" },
+      "run B's state reached the server"
+    );
+
+    // Run B's state is a later commit the proof does not cover. Neither list nor detail may keep it complete.
+    const owner = await ownerConnectionRow(journey);
+    assert.equal(owner.connection_health.axes.coverage, "unknown");
+    assert.deepEqual(conditions(owner), { messages: "unknown", sessions: "unknown" });
+  });
+});
+
+test("journey: a later negotiated run with valid evidence projects covered again after an unnegotiated state commit", async () => {
+  await withJourney(async (journey) => {
+    await runOnce(journey, { mode: "complete", negotiated: true, tag: "a-complete" });
+    const freshQueue = join(journey.dir, "outbox-fresh.sqlite");
+    await runOnce(journey, { mode: "complete", negotiated: false, queuePath: freshQueue, tag: "b-state" });
+    assert.equal((await ownerConnectionRow(journey)).connection_health.axes.coverage, "unknown");
+
+    // Run C: negotiated and complete. Its own terminal commit is the newest proof, so coverage is covered again.
+    const c = await runOnce(journey, { mode: "complete", negotiated: true, tag: "c-complete" });
+    assert.equal(c.result.done?.status, "succeeded");
+    assert.ok(serverRunStreams("c-complete"), "the server committed run C's terminal proof");
+    const owner = await ownerConnectionRow(journey);
+    assert.equal(owner.connection_health.axes.coverage, "complete");
+    assert.deepEqual(conditions(owner), { messages: "complete", sessions: "complete" });
+  });
+});
+
+test("journey: an unnegotiated state commit before a negotiated proof does not retire that proof", async () => {
+  await withJourney(async (journey) => {
+    const earlier = await runOnce(journey, { mode: "complete", negotiated: false, tag: "a-earlier-state" });
+    assert.equal(earlier.result.done?.status, "succeeded");
+    // Run B: negotiated and complete, after the unnegotiated commit. Its proof is the newest settled evidence.
+    await runOnce(journey, { mode: "complete", negotiated: true, tag: "b-complete" });
+    const owner = await ownerConnectionRow(journey);
+    assert.equal(owner.connection_health.axes.coverage, "complete");
+    assert.deepEqual(conditions(owner), { messages: "complete", sessions: "complete" });
+  });
+});
+
+test("journey, known limit: an unnegotiated run that commits no state leaves no server record, so the last proof stands", async () => {
+  await withJourney(async (journey) => {
+    await runOnce(journey, { mode: "complete", negotiated: true, tag: "a-complete" });
+    // Run B: unnegotiated, records only, no STATE, fresh outbox. The server gets
+    // records but no commit it can order against the proof.
+    const freshQueue = join(journey.dir, "outbox-fresh.sqlite");
+    const b = await runOnce(journey, {
+      mode: "records-only",
+      negotiated: false,
+      queuePath: freshQueue,
+      tag: "b-silent",
+    });
+    assert.equal(b.result.done?.status, "succeeded");
+    assert.equal(serverRunStreams("b-silent"), null, "the server committed no terminal evidence for run B");
+    assert.deepEqual(serverCursors(journey).messages, { cursor: "a-complete-messages" }, "no cursor moved");
+    // This pins what the server can observe today. Closing it needs a run boundary from the runtime.
+    assert.equal((await ownerConnectionRow(journey)).connection_health.axes.coverage, "complete");
+  });
+});
diff --git a/reference-implementation/test/local-device-coverage-state-commit-postgres.test.ts b/reference-implementation/test/local-device-coverage-state-commit-postgres.test.ts
new file mode 100644
index 000000000..3d27b4f6f
--- /dev/null
+++ b/reference-implementation/test/local-device-coverage-state-commit-postgres.test.ts
@@ -0,0 +1,109 @@
+// Copyright The PDP-Connect Contributors
+// SPDX-License-Identifier: Apache-2.0
+
+/**
+ * Real-PostgreSQL proof for the newest state-commit instant the stale-proof
+ * projection compares against a terminal proof (`stateCommittedAt`). The SQL
+ * runs in both the singleton and the page-batched readers, and the batched one
+ * is the list path, which swallows its own failures. So this test reads it
+ * back directly rather than trusting a projection that would silently degrade.
+ */
+
+import assert from "node:assert/strict";
+import test from "node:test";
+
+import { closePostgresStorage, initPostgresStorage, postgresQuery } from "../server/postgres-storage.ts";
+import {
+  readCommittedLocalCoverageDiagnostics,
+  readCommittedLocalCoverageDiagnosticsByConnectionIds,
+} from "../server/records.ts";
+import { dedicatedPostgresTestUrl } from "./helpers/dedicated-postgres-test-url.ts";
+
+const POSTGRES_URL = dedicatedPostgresTestUrl(process.env.PDPP_TEST_POSTGRES_URL);
+const CONNECTOR_ID = "claude-code";
+const WITH_STATE = "cin_stale_proof_state_commit_pg";
+const SCOPE_ONLY = "cin_stale_proof_scope_only_pg";
+const EARLIER = "2026-10-22T10:00:00.000Z";
+const LATER = "2026-10-22T10:05:00.000Z";
+const SCOPE_WRITE = "2026-10-22T11:00:00.000Z";
+const NOW = "2026-10-22T09:00:00.000Z";
+
+function postgresStorageConfig(): { backend: "postgres"; databaseUrl: string } {
+  assert.ok(POSTGRES_URL, "Postgres test requires PDPP_TEST_POSTGRES_URL");
+  return { backend: "postgres", databaseUrl: POSTGRES_URL };
+}
+
+async function cleanup(): Promise<void> {
+  await postgresQuery("DELETE FROM connector_state WHERE connector_instance_id = ANY($1::text[])", [
+    [WITH_STATE, SCOPE_ONLY],
+  ]);
+  await postgresQuery("DELETE FROM connector_instances WHERE connector_instance_id = ANY($1::text[])", [
+    [WITH_STATE, SCOPE_ONLY],
+  ]);
+  await postgresQuery("DELETE FROM connectors WHERE connector_id = $1", [CONNECTOR_ID]);
+}
+
+async function seed(): Promise<void> {
+  await postgresQuery("INSERT INTO connectors(connector_id, manifest, created_at) VALUES ($1, $2::jsonb, $3)", [
+    CONNECTOR_ID,
+    JSON.stringify({ connector_id: CONNECTOR_ID }),
+    NOW,
+  ]);
+  for (const instance of [WITH_STATE, SCOPE_ONLY]) {
+    await postgresQuery(
+      `INSERT INTO connector_instances(
+         connector_instance_id, owner_subject_id, connector_id, display_name, status,
+         source_kind, source_binding_key, source_binding_json, created_at, updated_at
+       ) VALUES ($1, 'owner_local', $2, 'laptop', 'active',
+         'local_device', $1, '{}'::jsonb, $3, $3)`,
+      [instance, CONNECTOR_ID, NOW]
+    );
+  }
+  // WITH_STATE: two stream commits, the newer of which decides the instant. Its
+  // `$`-prefixed scope row is written last, and must not count as a state commit.
+  const rows: Array<[string, string, string, string]> = [
+    [WITH_STATE, "messages", LATER, '{"cursor":"later"}'],
+    [WITH_STATE, "sessions", EARLIER, '{"cursor":"earlier"}'],
+    [WITH_STATE, "$collection_scope", SCOPE_WRITE, '"unscoped"'],
+    [SCOPE_ONLY, "$collection_scope", SCOPE_WRITE, '"unscoped"'],
+  ];
+  for (const [instance, stream, updatedAt, stateJson] of rows) {
+    await postgresQuery(
+      `INSERT INTO connector_state(
+         connector_id, connector_instance_id, stream, state_json, updated_at, manifest_generation
+       ) VALUES ($1, $2, $3, $4::jsonb, $5, 0)`,
+      [CONNECTOR_ID, instance, stream, stateJson, updatedAt]
+    );
+  }
+}
+
+test("real PostgreSQL: stateCommittedAt is the newest non-scope state commit, from both coverage readers (skipped: PDPP_TEST_POSTGRES_URL unset)", {
+  skip: !POSTGRES_URL,
+}, async () => {
+  await initPostgresStorage(postgresStorageConfig());
+  try {
+    await cleanup();
+    await seed();
+
+    const batch = await readCommittedLocalCoverageDiagnosticsByConnectionIds([WITH_STATE, SCOPE_ONLY]);
+    assert.equal(
+      batch.get(WITH_STATE)?.stateCommittedAt,
+      LATER,
+      "the newest stream commit wins, and the later scope row is not a state commit"
+    );
+    assert.equal(
+      batch.get(SCOPE_ONLY)?.stateCommittedAt,
+      null,
+      "a connection with only server scope state has no state commit"
+    );
+
+    const single = await readCommittedLocalCoverageDiagnostics({
+      connector_id: CONNECTOR_ID,
+      connector_instance_id: WITH_STATE,
+    });
+    assert.equal(single.stateCommittedAt, LATER, "the singleton reader agrees with the batched one");
+  } finally {
+    await cleanup();
+    await closePostgresStorage();
+  }
+});

From 2c8ee6d5f1fd2790c6b1a5d2ab88327d9cc15898 Mon Sep 17 00:00:00 2001
From: Tim Nunamaker <tnunamak@gmail.com>
Date: Thu, 22 Oct 2026 05:29:27 -0500
Subject: [PATCH 27/87] test(local-device): install-path journey uses the
 shipped collector path

J2-install installed its releases with obtainManagedConnectors and read the device's selected release from the managed install's profile. The published collector uses neither. It installs through ensureCollectionProfileInstalled and selects through selectedReleaseForPin. The journey now calls those two functions, with a pin for each release. Its three phases and their assertions are unchanged.

The installer core refuses an artifact that has no signature object before it calls the signature verifier. Each release therefore carries a fabricated cosign-shaped bundle, which the journey's stub accepts. The stub reports the identity that the live-registry test's stubVerifier reports. Sigstore verification is still the one unproven step.

scripts/build-install-path-releases.ts writes the pins and the bundles to the job's temp directory. The checked-in pins are unchanged. The workflow passes the pins path to the journey, and the shipped CLI file is now in the job's path filters.

Verified locally against registry:3.1.1 at the digest CI pins. The journey file passes (five tests, none skipped). managed-connectors.test.ts passes (43 tests), and so does the live-registry test against an oura artifact built with the producer's builder. Both ratchet files and the reference-implementation typecheck pass. The Postgres inventory and template-eligibility tests pass inside the repo's test sandbox. The workflow step has not run on a GitHub runner.

Assisted-by: AI
Signed-off-by: Tim Nunamaker <tnunamak@gmail.com>
---
 .../workflows/managed-connector-oci-e2e.yml   |  26 +-
 .../scripts/build-install-path-releases.ts    | 118 ++++-
 .../test/helpers/install-path-fixture.ts      |  10 +-
 .../local-device-coverage-journey.test.ts     | 497 +++++++++++++-----
 4 files changed, 498 insertions(+), 153 deletions(-)

diff --git a/.github/workflows/managed-connector-oci-e2e.yml b/.github/workflows/managed-connector-oci-e2e.yml
index 56a5baaac..1c3e25bc1 100644
--- a/.github/workflows/managed-connector-oci-e2e.yml
+++ b/.github/workflows/managed-connector-oci-e2e.yml
@@ -47,10 +47,12 @@ name: managed-connector OCI end-to-end (local registry; NOT GHCR, NOT Sigstore)
 # while data-connectors' publish pilot moved to `ynab` are all written down in the pin file.
 #
 # THE INSTALL-PATH JOURNEY (J2-install, the last three steps). The live-registry test above proves an
-# artifact installs and its entrypoint imports. The journey proves what follows: the installed entrypoint
-# runs as the child, the server and the device both accept its coverage, and a replaced digest stops counting
-# until its own run proves it. It runs against this job's registry with the same stub verifier, so (1) and (2)
-# above apply to it, and it proves nothing about signatures or ghcr.io.
+# artifact installs and its entrypoint imports. The journey installs two releases through the shipped
+# collector's own function (ensureCollectionProfileInstalled), against pins the builder writes into the job's
+# temp directory. It runs each installed entrypoint and checks what the server and the device make of it. A
+# replaced digest stops counting until its own run proves it. It runs against this job's registry. Its signature
+# check is the same stub verifier, and its releases carry a fabricated signature bundle, so (1) and (2) above
+# apply to it, and it proves nothing about signatures or ghcr.io.
 
 on:
   pull_request:
@@ -67,6 +69,8 @@ on:
       - "reference-implementation/test/local-device-coverage-journey.test.ts"
       - "reference-implementation/test/helpers/install-path-fixture.ts"
       - "reference-implementation/scripts/build-install-path-releases.ts"
+      # The shipped selection and binding the journey calls (selectedReleaseForPin, bindOptionalRunCoverageToRelease).
+      - "packages/local-collector/bin/pdpp-local-collector.ts"
       # This job's own control files: a PR that only edits the workflow or moves the producer pin
       # would otherwise not run the thing it changed. Same reasoning as consumer-drift-signal.yml's
       # "Producer workflows should include their own control files in triggers".
@@ -82,6 +86,7 @@ on:
       - "reference-implementation/test/local-device-coverage-journey.test.ts"
       - "reference-implementation/test/helpers/install-path-fixture.ts"
       - "reference-implementation/scripts/build-install-path-releases.ts"
+      - "packages/local-collector/bin/pdpp-local-collector.ts"
       - ".github/workflows/managed-connector-oci-e2e.yml"
       - ".github/managed-connector-e2e-pin.json"
   workflow_dispatch:
@@ -481,8 +486,9 @@ jobs:
       - name: Build and push the install-path releases A and B with the producer's builder
         # Two releases of one connector (install-path-fixture.ts): the same manifest and different code layers,
         # so different digests. The builder is the producer's own script at the pinned revision. The packaging
-        # tree around it is the fixture's. Both releases are pushed to this job's registry. The digests reach
-        # the journey step through a file, not through the log.
+        # tree around it is the fixture's. Both releases are pushed to this job's registry, each with a signature
+        # stand-in. The pins the journey checks against are written into the work directory. The journey step
+        # reads their path from the releases file, not from the log.
         working-directory: reference-implementation
         env:
           PRODUCER_GIT: ${{ github.workspace }}/data-connectors
@@ -497,16 +503,16 @@ jobs:
             --work "${RUNNER_TEMP}/install-path" \
             --modules "$PRODUCER_GIT/node_modules" > "$RELEASES_JSON"
 
-      - name: Run the install-path journey (J2-install) through the managed path
+      - name: Run the install-path journey (J2-install) through the shipped collector path
         working-directory: reference-implementation
         env:
           PDPP_TEST_OCI_REGISTRY: localhost:5000
           RELEASES_JSON: ${{ runner.temp }}/install-path-releases.json
         run: |
           set -euo pipefail
-          digest_a="$(node -e 'process.stdout.write(require(process.env.RELEASES_JSON).a.digest)')"
-          digest_b="$(node -e 'process.stdout.write(require(process.env.RELEASES_JSON).b.digest)')"
-          export PDPP_TEST_INSTALL_PATH_DIGEST_A="$digest_a" PDPP_TEST_INSTALL_PATH_DIGEST_B="$digest_b"
+          pins_path="$(node -e 'process.stdout.write(require(process.env.RELEASES_JSON).pins)')"
+          test -s "$pins_path"
+          export PDPP_TEST_INSTALL_PATH_PINS="$pins_path"
           node --test --import tsx --test-name-pattern=J2-install test/local-device-coverage-journey.test.ts | tee result.txt
           # The same guard as the live-registry step above: node --test exits 0 on a skipped test, so require
           # exactly one passing test and no skips. A typo in an env var name must not turn this job green.
diff --git a/reference-implementation/scripts/build-install-path-releases.ts b/reference-implementation/scripts/build-install-path-releases.ts
index 1753ef65b..a2bd82376 100644
--- a/reference-implementation/scripts/build-install-path-releases.ts
+++ b/reference-implementation/scripts/build-install-path-releases.ts
@@ -16,6 +16,17 @@
  * layers differ, so their digests differ, while the manifest stays byte-identical.
  * Both are pushed under the same repository and version.
  *
+ * Two more files go into the --work directory, and the journey reads them:
+ *
+ *  - `pins.json`: a shipped-shape `CollectionProfilePin` for each release. Its two
+ *    sha256 values come from the built layers (the profile file, and the entrypoint
+ *    inside the code layer), not from the installer. The journey therefore checks
+ *    what the installer wrote against bytes this script produced.
+ *  - A signature stand-in per release. The installer core refuses an artifact with
+ *    no signature object before it calls the signature verifier, so each release
+ *    gets a cosign-bundle-shaped referrer under the `sha256-<hex>` tag. Nothing
+ *    signed it. The journey's verifier stub accepts it. It is not a Sigstore bundle.
+ *
  * Run from reference-implementation/:
  *
  *   node --import tsx scripts/build-install-path-releases.ts \
@@ -23,18 +34,23 @@
  *     --registry <host:port> --work <directory that does not exist> \
  *     --modules <directory whose node_modules/esbuild resolves> [--oras <path>]
  *
- * Prints {"repository", "a": {"digest"}, "b": {"digest"}} as JSON on stdout.
+ * Prints {"pins", "repository", "a": {"digest"}, "b": {"digest"}} as JSON on stdout.
  */
 
 import { execFileSync } from "node:child_process";
+import { createHash } from "node:crypto";
 import { existsSync, mkdirSync, readFileSync, symlinkSync, writeFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { parseArgs } from "node:util";
 
+import type { CollectionProfilePin } from "../../packages/local-collector/src/managed/collection-profiles.ts";
 import {
   fixtureConnectorSource,
+  INSTALL_PATH_COLLECTOR_ID,
+  INSTALL_PATH_CONNECTOR_KEY,
   INSTALL_PATH_PROFILE,
   INSTALL_PATH_REPOSITORY,
+  INSTALL_PATH_VERSION,
 } from "../test/helpers/install-path-fixture.ts";
 
 /** The files the builder and its gates read from the producer, at the pinned revision. */
@@ -173,6 +189,96 @@ function push(out: string, spec: LayerSpec, tag: string): string {
   return digest;
 }
 
+const BUNDLE_MEDIA_TYPE = "application/vnd.dev.sigstore.bundle.v0.3+json";
+
+function sha256Digest(bytes: Buffer): string {
+  return `sha256:${createHash("sha256").update(bytes).digest("hex")}`;
+}
+
+/**
+ * The two sha256 values a pin records, read from one built release: the profile
+ * file, and the entrypoint inside the code tarball. The member is named as the
+ * artifact's config.entrypoint names it, relative to the code layer.
+ */
+function pinHashes(
+  out: string,
+): Pick<CollectionProfilePin, "entrypointSha256" | "profileSha256"> {
+  const profile = readFileSync(join(out, "collection-profile.json"));
+  const entrypoint = execFileSync(
+    "tar",
+    ["-xzOf", join(out, "code.tar.gz"), "collection-profile.mjs"],
+    {
+      maxBuffer: 64 * 1024 * 1024,
+    },
+  );
+  return {
+    entrypointSha256: sha256Digest(entrypoint),
+    profileSha256: sha256Digest(profile),
+  };
+}
+
+/**
+ * The signature stand-in. Shaped as cosign v3 writes a bundle, with the one part
+ * the installer reads before it calls the verifier: the DSSE payload, an in-toto
+ * statement whose subject names the release digest. The signature and the
+ * verification material are empty. Nothing signed this.
+ */
+function fabricatedBundle(digest: string): string {
+  const statement = {
+    _type: "https://in-toto.io/Statement/v1",
+    predicate: {},
+    predicateType: "https://cosign.sigstore.dev/attestation/v1",
+    subject: [
+      {
+        digest: { sha256: digest.slice("sha256:".length) },
+        name: `ghcr.io/${INSTALL_PATH_REPOSITORY}`,
+      },
+    ],
+  };
+  return `${JSON.stringify(
+    {
+      dsseEnvelope: {
+        payload: Buffer.from(JSON.stringify(statement)).toString("base64"),
+        payloadType: "application/vnd.in-toto+json",
+        signatures: [{ keyid: "", sig: "" }],
+      },
+      mediaType: BUNDLE_MEDIA_TYPE,
+      verificationMaterial: {},
+    },
+    null,
+    2,
+  )}\n`;
+}
+
+/** Attach the signature stand-in to a pushed release, by digest, under the referrers tag the installer reads. */
+function attachSignature(out: string, digest: string): void {
+  writeFileSync(join(out, "signature.bundle.json"), fabricatedBundle(digest));
+  execFileSync(
+    oras,
+    [
+      "attach",
+      "--plain-http",
+      "--distribution-spec",
+      "v1.1-referrers-tag",
+      "--artifact-type",
+      BUNDLE_MEDIA_TYPE,
+      `${registry}/${INSTALL_PATH_REPOSITORY}@${digest}`,
+      `signature.bundle.json:${BUNDLE_MEDIA_TYPE}`,
+    ],
+    { cwd: out, stdio: ["ignore", 2, 2] },
+  );
+}
+
+function pinFor(digest: string, out: string): CollectionProfilePin {
+  return {
+    connectorId: INSTALL_PATH_COLLECTOR_ID,
+    connectorKey: INSTALL_PATH_CONNECTOR_KEY,
+    digest,
+    version: INSTALL_PATH_VERSION,
+    ...pinHashes(out),
+  };
+}
+
 mkdirSync(work, { recursive: true });
 const fixtureRoot = join(work, "fixture");
 mkdirSync(fixtureRoot);
@@ -199,6 +305,14 @@ if (digestA === digestB) {
   );
 }
 
+attachSignature(outA, digestA);
+attachSignature(outB, digestB);
+const pinsPath = join(work, "pins.json");
+writeFileSync(
+  pinsPath,
+  `${JSON.stringify({ a: pinFor(digestA, outA), b: pinFor(digestB, outB) }, null, 2)}\n`,
+);
+
 process.stdout.write(
-  `${JSON.stringify({ a: { digest: digestA }, b: { digest: digestB }, repository: INSTALL_PATH_REPOSITORY }, null, 2)}\n`
+  `${JSON.stringify({ a: { digest: digestA }, b: { digest: digestB }, pins: pinsPath, repository: INSTALL_PATH_REPOSITORY }, null, 2)}\n`,
 );
diff --git a/reference-implementation/test/helpers/install-path-fixture.ts b/reference-implementation/test/helpers/install-path-fixture.ts
index 65b6e9761..1982bb505 100644
--- a/reference-implementation/test/helpers/install-path-fixture.ts
+++ b/reference-implementation/test/helpers/install-path-fixture.ts
@@ -5,13 +5,15 @@
  * The fixture connector and release profile for the install-path journey.
  *
  * One connector protocol serves two consumers: the local-device journeys run it
- * as a source file, and the managed-install journey packages it as an OCI
- * artifact with `scripts/build-install-path-releases.ts`. Both must behave the
- * same, so the protocol body lives here once.
+ * as a source file, and the install-path journey packages it as an OCI artifact
+ * with `scripts/build-install-path-releases.ts`. Both must behave the same, so
+ * the protocol body lives here once.
  */
 
 export const INSTALL_PATH_CONNECTOR_KEY = "claude-code";
-export const INSTALL_PATH_CONNECTOR_ID = `https://registry.pdpp.dev/connectors/${INSTALL_PATH_CONNECTOR_KEY}`;
+const INSTALL_PATH_CONNECTOR_ID = `https://registry.pdpp.dev/connectors/${INSTALL_PATH_CONNECTOR_KEY}`;
+/** The local collector's id for this connector. A collection-profile pin is keyed by this. */
+export const INSTALL_PATH_COLLECTOR_ID = "claude_code";
 export const INSTALL_PATH_REPOSITORY = `pdp-connect/connector/${INSTALL_PATH_CONNECTOR_KEY}`;
 export const INSTALL_PATH_VERSION = "0.1.0";
 
diff --git a/reference-implementation/test/local-device-coverage-journey.test.ts b/reference-implementation/test/local-device-coverage-journey.test.ts
index e46e0a4d1..e49554f3d 100644
--- a/reference-implementation/test/local-device-coverage-journey.test.ts
+++ b/reference-implementation/test/local-device-coverage-journey.test.ts
@@ -37,10 +37,12 @@ import assert from "node:assert/strict";
 import { createHash } from "node:crypto";
 import { existsSync } from "node:fs";
 import { mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
+import { createRequire } from "node:module";
 import { tmpdir } from "node:os";
 import { dirname, join } from "node:path";
 import { DatabaseSync } from "node:sqlite";
 import test from "node:test";
+import { pathToFileURL } from "node:url";
 
 import { hashCanonicalJson } from "@pdpp/collector-runtime";
 
@@ -51,27 +53,31 @@ import {
   parseArgs,
   resolveExecutionRoot,
   type SelectedCollectionRelease,
+  selectedReleaseForPin,
 } from "../../packages/local-collector/bin/pdpp-local-collector.ts";
-import { managedConnectorCommand, obtainManagedConnectors } from "../../packages/local-collector/src/managed/index.ts";
+import {
+  COLLECTION_PROFILE_MANIFEST,
+  type CollectionProfileInstallerCore,
+  type CollectionProfilePin,
+  ensureCollectionProfileInstalled,
+  installedCollectionProfile,
+} from "../../packages/local-collector/src/managed/collection-profiles.ts";
+import { managedConnectorCommand } from "../../packages/local-collector/src/managed/index.ts";
+import type { InstalledRelease } from "../../packages/local-collector/src/managed/install-store.ts";
 import {
   type CollectorConnectorSpec,
   type CollectorRunResult,
   LocalDeviceHttpError,
   runCollectorConnector,
 } from "../../packages/local-collector/src/runner.ts";
-import { httpRegistryClient, stubVerifier } from "../../packages/local-collector/test/helpers/live-registry-client.ts";
+import { stubVerifier } from "../../packages/local-collector/test/helpers/live-registry-client.ts";
 import { COLLECTOR_PROTOCOL_VERSION } from "../server/collector-protocol.ts";
 import { reconcileDirtyConnectorSummaryEvidence } from "../server/connector-summary-read-model.ts";
 import { closeDb, getDb } from "../server/db.ts";
 import { startServer } from "../server/index.ts";
 import { __setLocalCollectorReleaseForTest } from "../server/local-collector-profiles.ts";
 import { closeTestServer } from "./helpers/close-test-server.ts";
-import {
-  fixtureConnectorSource,
-  INSTALL_PATH_CONNECTOR_ID,
-  INSTALL_PATH_REPOSITORY,
-  INSTALL_PATH_VERSION,
-} from "./helpers/install-path-fixture.ts";
+import { fixtureConnectorSource } from "./helpers/install-path-fixture.ts";
 
 const CONNECTOR_ID = "claude-code";
 const LOCAL_BINDING_NAME = "journey-laptop";
@@ -576,39 +582,39 @@ test("J3: a run that fails before its scan leaves the lane not covered; the serv
   });
 });
 
-// ---- J2-install: the same lane, with its child installed through the managed path -----------
+// ---- J2-install: the same lane, with its child installed through the shipped path ---------------
 //
 // The lane is J1's, but the child is the installed entrypoint of a release pulled from a real OCI
-// registry, verified, and installed by the managed consumer path. Release A and release B share a
-// repository, a version and a byte-identical manifest. Only their code layers differ, so only their
-// artifact digests differ. Nothing but the digest can tell them apart, and the second half of the
-// journey tests exactly that.
+// registry and installed by the shipped collector's own function, ensureCollectionProfileInstalled.
+// Release A and release B share a repository, a version and a byte-identical manifest. Only their
+// code layers differ, so only their artifact digests differ. Nothing but the digest can tell them
+// apart, and the second half of the journey tests exactly that.
+//
+// Real: the registry (registry:3.1.1 over plain HTTP); the installer core's OCI fetch, digest and
+// blob checks, its config, profile, key and version checks, and its referrer lookup; the pin check
+// ensureCollectionProfileInstalled makes on the installed files; the device's selection
+// (selectedReleaseForPin); the run's binding (bindOptionalRunCoverageToRelease); the runner; the
+// server; the device outbox and status.
 //
-// The registry is the one the managed-connector OCI job starts. The signature verifier is the stub
-// that job uses, so signature verification is the one step this journey does not prove. To run it
-// locally, push the two releases with scripts/build-install-path-releases.ts and export the three
-// variables below.
+// Stubbed, and only these: (1) the signature check, see stubSignatureCheck. (2) The signature
+// object. The installer refuses an artifact that has none before it reaches the check, so the
+// builder pushes a fabricated bundle per release. (3) The transport. The signed lock names ghcr.io,
+// and the job's registry answers for it over plain HTTP; any other host is refused. (4) The pins.
+// scripts/build-install-path-releases.ts computes them from the built bytes, not from the signed
+// catalog. (5) The server's release, which each phase sets with __setLocalCollectorReleaseForTest,
+// as J1 does. (6) The CLI's main() and its checked-in pin map: the journey passes the fixture pins
+// to the same functions that map feeds.
+//
+// The registry is the one the managed-connector OCI job starts. To run it locally, push the two
+// releases with scripts/build-install-path-releases.ts and export the two variables below.
 
 const INSTALL_REGISTRY = process.env.PDPP_TEST_OCI_REGISTRY;
-const INSTALL_DIGEST_A = process.env.PDPP_TEST_INSTALL_PATH_DIGEST_A;
-const INSTALL_DIGEST_B = process.env.PDPP_TEST_INSTALL_PATH_DIGEST_B;
+const INSTALL_PINS = process.env.PDPP_TEST_INSTALL_PATH_PINS;
 const INSTALL_SKIP =
-  INSTALL_REGISTRY === undefined || INSTALL_DIGEST_A === undefined || INSTALL_DIGEST_B === undefined
-    ? "set PDPP_TEST_OCI_REGISTRY, PDPP_TEST_INSTALL_PATH_DIGEST_A and PDPP_TEST_INSTALL_PATH_DIGEST_B (scripts/build-install-path-releases.ts pushes both releases)"
+  INSTALL_REGISTRY === undefined || INSTALL_PINS === undefined
+    ? "set PDPP_TEST_OCI_REGISTRY and PDPP_TEST_INSTALL_PATH_PINS (scripts/build-install-path-releases.ts writes the pins)"
     : false;
 
-/** A release as the managed consumer installed it, read back from the installed files. */
-interface InstalledRelease {
-  readonly digest: string;
-  /** The installed bundle the child runs. */
-  readonly entrypoint: string;
-  /** The manifest fingerprint a receipt must carry to count as this release's. */
-  readonly fingerprint: string;
-  readonly profile: ReleaseProfile;
-  readonly profileBytes: Buffer;
-  readonly releaseRoot: string;
-}
-
 /** Owner-visible coverage for one connection, as the list and the detail both report it. */
 interface CoverageView {
   readonly axis: string;
@@ -616,6 +622,13 @@ interface CoverageView {
   readonly reason: string | null;
 }
 
+/** A release the shipped path installed: its pin, its entrypoint, and the profile it carries. */
+interface ShippedRelease {
+  readonly entrypoint: string;
+  readonly pin: CollectionProfilePin;
+  readonly profile: ReleaseProfile;
+}
+
 /**
  * The SourceCoverageComplete reason a covered lane carries: the condition's reason mirrors its
  * coverage axis, so a complete lane reads "complete". A mismatch has its own reason.
@@ -623,60 +636,132 @@ interface CoverageView {
 const COVERED_REASON = "complete";
 
 /**
- * Install one pinned release through the managed consumer path. `activate` moves the install
- * store's pointer to it, as an update applied between runs would.
+ * The installer core the shipped loader uses. ensureCollectionProfileInstalled resolves it from
+ * packages/local-collector, so this resolves it from the same place, not from whichever copy this
+ * test file happens to reach.
+ */
+async function loadShippedInstallerCore(): Promise<CollectionProfileInstallerCore> {
+  const fromCollector = createRequire(
+    new URL("../../packages/local-collector/package.json", import.meta.url),
+  );
+  const entry = fromCollector.resolve(
+    "@opendatalabs/data-connectors-tools/installer-core",
+  );
+  return (await import(
+    pathToFileURL(entry).href
+  )) as CollectionProfileInstallerCore;
+}
+
+/**
+ * Answers the installer's requests for ghcr.io, the registry the signed lock names, from the job's
+ * registry over plain HTTP. Any other host is refused, so the journey cannot reach the network.
+ */
+function localRegistryFetch(
+  registry: string,
+): (input: string | URL | Request, init?: RequestInit) => Promise<Response> {
+  return async (input, init) => {
+    const url = new URL(
+      typeof input === "string"
+        ? input
+        : input instanceof URL
+          ? input.href
+          : input.url,
+    );
+    if (url.hostname !== "ghcr.io") {
+      throw new Error(
+        `the install-path journey refuses to contact ${url.host}`,
+      );
+    }
+    return fetch(`http://${registry}${url.pathname}${url.search}`, init);
+  };
+}
+
+/**
+ * The signature check, stubbed as the live-registry test stubs its verifier: it reports the identity
+ * and issuer that stubVerifier reports, the publish workflow's, and it refuses any identity the
+ * installer did not ask for. It does not check the bundle's signature, its certificate chain or its
+ * transparency-log entry. That is the one step this journey does not prove, and the same step the
+ * live-registry test does not prove either. `reported` collects each identity the check accepted.
+ */
+function stubSignatureCheck(
+  reported: string[],
+): (
+  bundle: unknown,
+  expected: { certificateIdentityURI: string; certificateIssuer: string },
+) => Promise<void> {
+  return async (_bundle, expected) => {
+    // The stub ignores its input, as it does in the live-registry test.
+    const verdict = await stubVerifier.verify({ digest: "", reference: "" });
+    if (
+      !new RegExp(expected.certificateIdentityURI).test(
+        verdict.certificateIdentity,
+      ) ||
+      verdict.certificateIssuer !== expected.certificateIssuer
+    ) {
+      throw new Error(
+        `the stub reports ${verdict.certificateIdentity} (${verdict.certificateIssuer}), which the installer does not accept`,
+      );
+    }
+    reported.push(verdict.certificateIdentity);
+  };
+}
+
+/**
+ * Install one pinned release through the shipped path, calling ensureCollectionProfileInstalled as
+ * the collector does. Only the installer core it loads is wrapped: its fetch goes to the job's
+ * registry, its scheme is plain HTTP, and its signature check is the stub above.
  */
-async function installRelease(input: {
-  readonly activate: boolean;
-  readonly digest: string;
+function installShipped(input: {
   readonly durableRoot: string;
   readonly installRoot: string;
+  readonly pin: CollectionProfilePin;
+  readonly reported: string[];
 }): Promise<InstalledRelease> {
   const registry = INSTALL_REGISTRY as string;
-  const [managed] = await obtainManagedConnectors({
-    activate: input.activate,
-    client: httpRegistryClient(`http://${registry}`, INSTALL_PATH_REPOSITORY),
+  return ensureCollectionProfileInstalled({
     durableRoot: input.durableRoot,
     installRoot: input.installRoot,
-    lock: {
-      connectors: [
-        {
-          connectorId: INSTALL_PATH_CONNECTOR_ID,
-          connectorKey: CONNECTOR_ID,
-          digest: input.digest,
-          reference: `${registry}/${INSTALL_PATH_REPOSITORY}`,
-          version: INSTALL_PATH_VERSION,
-        },
-      ],
-      lockVersion: "2.0",
+    loadCore: async () => {
+      const core = await loadShippedInstallerCore();
+      return {
+        ...core,
+        installFromLock: (options) =>
+          core.installFromLock({
+            ...options,
+            fetchImpl: localRegistryFetch(registry),
+            ociScheme: "http",
+            sigstoreVerifier: stubSignatureCheck(input.reported),
+          }),
+      };
     },
-    verifier: stubVerifier,
+    pin: input.pin,
   });
-  assert.ok(managed, "one connector should have been installed");
-  const releaseRoot = dirname(dirname(managed.entrypoint));
-  const profileBytes = await readFile(join(releaseRoot, "collection-profile.json"));
-  const profile = JSON.parse(profileBytes.toString("utf8")) as ReleaseProfile;
-  return {
-    digest: managed.digest,
-    entrypoint: managed.entrypoint,
-    fingerprint: hashCanonicalJson(profile),
-    profile,
-    profileBytes,
-    releaseRoot,
-  };
 }
 
-/** The device's selected release, derived from the installed bytes rather than from a constant. */
-function selectedFrom(release: InstalledRelease): SelectedCollectionRelease {
-  return { artifactDigest: release.digest, manifestFingerprint: release.fingerprint };
+/** The release the device selects for `pin`, read through the function the shipped collector reads it with. */
+function selectedShipped(
+  installRoot: string,
+  pin: CollectionProfilePin,
+): SelectedCollectionRelease {
+  const selected = selectedReleaseForPin(pin, installRoot);
+  assert.ok(
+    selected,
+    `the installed release ${pin.digest} passes its own pin check`,
+  );
+  return selected;
 }
 
-/** The digest the install store's pointer names for the connector. */
-async function activeDigest(installRoot: string): Promise<string> {
-  const pointer = JSON.parse(await readFile(join(installRoot, "connectors", CONNECTOR_ID, "current.json"), "utf8")) as {
-    digest: string;
-  };
-  return pointer.digest;
+async function readShippedRelease(
+  installed: InstalledRelease,
+  pin: CollectionProfilePin,
+): Promise<ShippedRelease> {
+  const profile = JSON.parse(
+    await readFile(
+      join(installed.directory, COLLECTION_PROFILE_MANIFEST),
+      "utf8",
+    ),
+  ) as ReleaseProfile;
+  return { entrypoint: installed.entrypoint, pin, profile };
 }
 
 /**
@@ -685,8 +770,8 @@ async function activeDigest(installRoot: string): Promise<string> {
  */
 async function withInstallLane(
   dir: string,
-  release: InstalledRelease,
-  run: (lane: Lane) => Promise<void>
+  release: ShippedRelease,
+  run: (lane: Lane) => Promise<void>,
 ): Promise<void> {
   const server = await startServer({
     asPort: 0,
@@ -696,12 +781,21 @@ async function withInstallLane(
     rsPort: 0,
   });
   const asUrl = `http://localhost:${server.asPort}`;
-  __setLocalCollectorReleaseForTest(CONNECTOR_ID, { artifactDigest: release.digest, manifest: release.profile });
+  __setLocalCollectorReleaseForTest(CONNECTOR_ID, {
+    artifactDigest: release.pin.digest,
+    manifest: release.profile,
+  });
   try {
     const cookie = await ownerSessionCookie(asUrl);
     const enrolled = await enrollLaptop(asUrl, cookie);
     registerFixtureManifest(enrolled.connector_instance_id, release.profile);
-    await run({ asUrl, cookie, dir, enrolled, queuePath: join(dir, "outbox.sqlite") });
+    await run({
+      asUrl,
+      cookie,
+      dir,
+      enrolled,
+      queuePath: join(dir, "outbox.sqlite"),
+    });
   } finally {
     __setLocalCollectorReleaseForTest(CONNECTOR_ID, null);
     await closeTestServer(server);
@@ -709,8 +803,17 @@ async function withInstallLane(
   }
 }
 
-/** Run an installed entrypoint through the runner, with the same spec the lane's own binding produces. */
-async function runInstalled(lane: Lane, release: InstalledRelease, mode: string, tag: string): Promise<RunOutcome> {
+/**
+ * Run an installed entrypoint through the runner. The spec binds the release the way J1 does, and
+ * carries the server's connector key as connector_id. The runner does not send connector_id to the
+ * server, so the shipped collector's own id ("claude_code") would not change what the server sees.
+ */
+async function runInstalled(
+  lane: Lane,
+  release: ShippedRelease,
+  mode: string,
+  tag: string,
+): Promise<RunOutcome> {
   const observePath = join(lane.dir, `start-${tag}.json`);
   const connector = bindOptionalRunCoverageToRelease(
     {
@@ -721,8 +824,8 @@ async function runInstalled(lane: Lane, release: InstalledRelease, mode: string,
       runtime_requirements: { bindings: {} },
       streams: STREAMS,
     },
-    { digest: release.digest },
-    release.profile
+    release.pin,
+    release.profile,
   );
   const result = await runCollectorConnector({
     baseUrl: lane.asUrl,
@@ -735,7 +838,13 @@ async function runInstalled(lane: Lane, release: InstalledRelease, mode: string,
     runId: tag,
     sourceInstanceId: lane.enrolled.source_instance_id,
   });
-  return { observed: JSON.parse(await readFile(observePath, "utf8")) as Record<string, unknown>, result };
+  return {
+    observed: JSON.parse(await readFile(observePath, "utf8")) as Record<
+      string,
+      unknown
+    >,
+    result,
+  };
 }
 
 function coverageView(body: Record<string, unknown>): CoverageView {
@@ -746,26 +855,41 @@ function coverageView(body: Record<string, unknown>): CoverageView {
   const report = body.collection_report as ProjectedStream[];
   return {
     axis: health.axes.coverage,
-    conditions: Object.fromEntries(report.map((entry) => [entry.stream, entry.coverage_condition])),
-    reason: health.conditions.find((condition) => condition.type === "SourceCoverageComplete")?.reason ?? null,
+    conditions: Object.fromEntries(
+      report.map((entry) => [entry.stream, entry.coverage_condition]),
+    ),
+    reason:
+      health.conditions.find(
+        (condition) => condition.type === "SourceCoverageComplete",
+      )?.reason ?? null,
   };
 }
 
 /** The owner's view of the connection, read from the list and the detail. The two must agree. */
 async function ownerCoverage(lane: Lane): Promise<CoverageView> {
   await reconcileDirtyConnectorSummaryEvidence(null);
-  const list = await requestJson(`${lane.asUrl}/_ref/connectors?limit=100`, { headers: { Cookie: lane.cookie } });
+  const list = await requestJson(`${lane.asUrl}/_ref/connectors?limit=100`, {
+    headers: { Cookie: lane.cookie },
+  });
   assert.equal(list.status, 200, JSON.stringify(list.body));
   const row = ((list.body?.data ?? []) as Record<string, unknown>[]).find(
-    (candidate) => candidate.connection_id === lane.enrolled.connector_instance_id
+    (candidate) =>
+      candidate.connection_id === lane.enrolled.connector_instance_id,
   );
   assert.ok(row, "the owner list projects the enrolled connection");
-  const detail = await requestJson(`${lane.asUrl}/_ref/connectors/${CONNECTOR_ID}`, {
-    headers: { Cookie: lane.cookie },
-  });
+  const detail = await requestJson(
+    `${lane.asUrl}/_ref/connectors/${CONNECTOR_ID}`,
+    {
+      headers: { Cookie: lane.cookie },
+    },
+  );
   assert.equal(detail.status, 200, JSON.stringify(detail.body));
   const fromList = coverageView(row);
-  assert.deepEqual(coverageView(detail.body ?? {}), fromList, "list and detail agree on coverage and its reason");
+  assert.deepEqual(
+    coverageView(detail.body ?? {}),
+    fromList,
+    "list and detail agree on coverage and its reason",
+  );
   return fromList;
 }
 
@@ -776,69 +900,150 @@ function requireRunStreams(runId: string): Record<string, unknown>[] {
   return streams;
 }
 
-test("J2-install: a release installed through the managed path is covered; a replaced digest stops counting until its own run proves it", {
+test("J2-install: a release installed through the shipped collection-profile path is covered; a replaced digest stops counting until its own run proves it", {
   skip: INSTALL_SKIP,
 }, async () => {
   const base = await mkdtemp(join(tmpdir(), "pdpp-install-path-journey-"));
-  const installRoot = join(base, "connector-releases");
-  const durableRoot = join(base, "connector-artifacts");
-  const digestA = INSTALL_DIGEST_A as string;
-  const digestB = INSTALL_DIGEST_B as string;
+  const installRoot = join(base, "collection-profiles");
+  const durableRoot = join(base, "collector-state");
+  const reported: string[] = [];
   try {
-    // Install release A and check what the consumer made of it before anything runs.
-    const releaseA = await installRelease({ activate: true, digest: digestA, durableRoot, installRoot });
-    assert.equal(releaseA.digest, digestA);
-    assert.equal(releaseA.profile.connector_id, INSTALL_PATH_CONNECTOR_ID);
+    const pins = JSON.parse(await readFile(INSTALL_PINS as string, "utf8")) as {
+      a: CollectionProfilePin;
+      b: CollectionProfilePin;
+    };
+    const { a: pinA, b: pinB } = pins;
+    const publishIdentity = (await loadShippedInstallerCore())
+      .DEFAULT_OCI_SIGSTORE_CERTIFICATE_IDENTITY;
+
+    // Install release A through the shipped path, and check what the device selects for its pin.
+    const installedA = await installShipped({
+      durableRoot,
+      installRoot,
+      pin: pinA,
+      reported,
+    });
+    assert.equal(
+      installedA.entrypoint,
+      installedCollectionProfile(installRoot, pinA).entrypoint,
+    );
+    assert.ok(
+      installedA.entrypoint.startsWith(installRoot),
+      "the entrypoint lies inside the install store",
+    );
     assert.deepEqual(
-      releaseA.profile.streams.map((stream) => stream.name),
-      STREAMS,
-      "the installed profile declares the lane's two streams"
+      reported,
+      [publishIdentity],
+      "the signature check ran once, for the publish identity",
+    );
+    const releaseA = await readShippedRelease(installedA, pinA);
+    const selectedA = selectedShipped(installRoot, pinA);
+    assert.deepEqual(
+      selectedA,
+      {
+        artifactDigest: pinA.digest,
+        manifestFingerprint: hashCanonicalJson(releaseA.profile),
+      },
+      "the device selects A by its pin, from the installed profile",
     );
-    assert.equal(releaseA.entrypoint, join(releaseA.releaseRoot, "code", "collection-profile.mjs"));
-    assert.ok(releaseA.entrypoint.startsWith(installRoot), "the entrypoint lies inside the install store");
 
     await withInstallLane(base, releaseA, async (lane) => {
       // Phase 1: release A runs through its installed entrypoint, and the server and the device accept it.
       const a = await runInstalled(lane, releaseA, "complete", "a-install");
-      assert.equal(a.observed.build, "release-a", "the installed release A's bytes ran");
-      assert.equal(a.observed.run_coverage_version, 1, "START asked the installed connector for run coverage");
+      assert.equal(
+        a.observed.build,
+        "release-a",
+        "the installed release A's bytes ran",
+      );
+      assert.equal(
+        a.observed.run_coverage_version,
+        1,
+        "START asked the installed connector for run coverage",
+      );
       assert.equal(a.result.done?.status, "succeeded");
       assert.equal(serverRecordCount(lane, "sessions"), 2);
       assert.equal(serverRecordCount(lane, "messages"), 1);
       for (const stream of requireRunStreams("a-install")) {
-        assert.equal(stream.artifact_digest, digestA, "the server stores run A under digest A");
-        assert.equal(stream.manifest_fingerprint, releaseA.fingerprint);
-        assert.equal(stream.binding_generation, sourceGeneration(lane), "bound to the source generation");
+        assert.equal(
+          stream.artifact_digest,
+          pinA.digest,
+          "the server stores run A under digest A",
+        );
+        assert.equal(
+          stream.manifest_fingerprint,
+          selectedA.manifestFingerprint,
+        );
+        assert.equal(
+          stream.binding_generation,
+          sourceGeneration(lane),
+          "bound to the source generation",
+        );
       }
       assert.deepEqual(await ownerCoverage(lane), {
         axis: "complete",
         conditions: { messages: "complete", sessions: "complete" },
         reason: COVERED_REASON,
       });
-      const aDevice = deviceStatus(lane, selectedFrom(releaseA));
+      const aDevice = deviceStatus(lane, selectedA);
       assert.equal(aDevice.terminal_coverage.verdict, "covered");
       assert.equal(aDevice.lifecycle_state, "covered");
       const aReceipts = deviceReceiptFacts(lane);
-      assert.equal(aReceipts.length, 2, "the device holds a receipt for both streams");
+      assert.equal(
+        aReceipts.length,
+        2,
+        "the device holds a receipt for both streams",
+      );
       assert.ok(
         aReceipts.every(
-          (fact) => fact.artifact_digest === digestA && fact.manifest_fingerprint === releaseA.fingerprint
+          (fact) =>
+            fact.artifact_digest === pinA.digest &&
+            fact.manifest_fingerprint === selectedA.manifestFingerprint,
         ),
-        "the device receipt names release A"
+        "the device receipt names release A",
       );
 
       // Phase 2: install release B for the same source and select it. B does not run yet.
-      const releaseB = await installRelease({ activate: true, digest: digestB, durableRoot, installRoot });
-      assert.equal(releaseB.digest, digestB);
-      assert.notEqual(releaseB.releaseRoot, releaseA.releaseRoot, "B installs beside A");
+      const installedB = await installShipped({
+        durableRoot,
+        installRoot,
+        pin: pinB,
+        reported,
+      });
+      const releaseB = await readShippedRelease(installedB, pinB);
+      assert.notEqual(
+        installedB.directory,
+        installedA.directory,
+        "B installs beside A",
+      );
+      assert.equal(
+        pinB.profileSha256,
+        pinA.profileSha256,
+        "the pins name one manifest, so the digest is the only difference",
+      );
       assert.deepEqual(
-        releaseB.profileBytes,
-        releaseA.profileBytes,
-        "the manifest is byte-identical, so the digest is the only difference"
+        await readFile(join(installedB.directory, COLLECTION_PROFILE_MANIFEST)),
+        await readFile(join(installedA.directory, COLLECTION_PROFILE_MANIFEST)),
+        "the installed manifests are byte-identical",
       );
-      assert.ok(existsSync(releaseA.entrypoint), "installing B left release A in place");
-      assert.equal(await activeDigest(installRoot), digestB, "the install store points at B");
-      __setLocalCollectorReleaseForTest(CONNECTOR_ID, { artifactDigest: releaseB.digest, manifest: releaseB.profile });
+      assert.ok(
+        existsSync(installedA.entrypoint),
+        "installing B left release A in place",
+      );
+      assert.deepEqual(
+        reported,
+        [publishIdentity, publishIdentity],
+        "B's signature check ran too",
+      );
+      const selectedB = selectedShipped(installRoot, pinB);
+      assert.equal(
+        selectedB.artifactDigest,
+        pinB.digest,
+        "the device now selects B by its pin",
+      );
+      __setLocalCollectorReleaseForTest(CONNECTOR_ID, {
+        artifactDigest: pinB.digest,
+        manifest: releaseB.profile,
+      });
 
       // Before any B run, neither side counts A's proof for B.
       assert.deepEqual(await ownerCoverage(lane), {
@@ -846,47 +1051,65 @@ test("J2-install: a release installed through the managed path is covered; a rep
         conditions: { messages: "unknown", sessions: "unknown" },
         reason: "coverage_unknown_artifact_mismatch",
       });
-      const bBefore = deviceStatus(lane, selectedFrom(releaseB));
+      const bBefore = deviceStatus(lane, selectedB);
       assert.equal(bBefore.terminal_coverage.verdict, "not_current");
       assert.equal(bBefore.lifecycle_state, "coverage_not_current");
       // No A proof is relabelled as B: the device still holds only A's receipt, and the server still
       // records run A as A.
       assert.ok(
-        deviceReceiptFacts(lane).every((fact) => fact.artifact_digest === digestA),
-        "the device receipt still names release A"
+        deviceReceiptFacts(lane).every(
+          (fact) => fact.artifact_digest === pinA.digest,
+        ),
+        "the device receipt still names release A",
       );
       assert.ok(
-        requireRunStreams("a-install").every((stream) => stream.artifact_digest === digestA),
-        "the server still records run A as release A"
+        requireRunStreams("a-install").every(
+          (stream) => stream.artifact_digest === pinA.digest,
+        ),
+        "the server still records run A as release A",
       );
 
       // Phase 3: release B runs through its installed entrypoint, and proves itself.
       const b = await runInstalled(lane, releaseB, "complete", "b-install");
-      assert.equal(b.observed.build, "release-b", "the installed release B's bytes ran");
+      assert.equal(
+        b.observed.build,
+        "release-b",
+        "the installed release B's bytes ran",
+      );
       assert.equal(b.result.done?.status, "succeeded");
       assert.ok(
-        requireRunStreams("b-install").every((stream) => stream.artifact_digest === digestB),
-        "the server stores run B under digest B"
+        requireRunStreams("b-install").every(
+          (stream) => stream.artifact_digest === pinB.digest,
+        ),
+        "the server stores run B under digest B",
       );
       assert.deepEqual(await ownerCoverage(lane), {
         axis: "complete",
         conditions: { messages: "complete", sessions: "complete" },
         reason: COVERED_REASON,
       });
-      const bDevice = deviceStatus(lane, selectedFrom(releaseB));
+      const bDevice = deviceStatus(lane, selectedB);
       assert.equal(bDevice.terminal_coverage.verdict, "covered");
       assert.equal(bDevice.lifecycle_state, "covered");
       const bReceipts = deviceReceiptFacts(lane);
-      assert.equal(bReceipts.length, 2, "the device holds a receipt for both streams");
+      assert.equal(
+        bReceipts.length,
+        2,
+        "the device holds a receipt for both streams",
+      );
       assert.ok(
         bReceipts.every(
-          (fact) => fact.artifact_digest === digestB && fact.manifest_fingerprint === releaseB.fingerprint
+          (fact) =>
+            fact.artifact_digest === pinB.digest &&
+            fact.manifest_fingerprint === selectedB.manifestFingerprint,
         ),
-        "the device receipt names release B"
+        "the device receipt names release B",
       );
       assert.ok(
-        requireRunStreams("a-install").every((stream) => stream.artifact_digest === digestA),
-        "run A is still recorded as release A after B is covered"
+        requireRunStreams("a-install").every(
+          (stream) => stream.artifact_digest === pinA.digest,
+        ),
+        "run A is still recorded as release A after B is covered",
       );
     });
   } finally {

From c19b6c2ec2adc3bd39e3c79d7eff13278c9883db Mon Sep 17 00:00:00 2001
From: Tim Nunamaker <tnunamak@gmail.com>
Date: Thu, 22 Oct 2026 05:30:03 -0500
Subject: [PATCH 28/87] test(local-device): cover the legacy diagnostics proof
 under the stale-proof rule

The retirement applies to the legacy coverage_diagnostics proof as well as
the v2 run verdict, but no test exercised that path. This store-level test
commits a reliable diagnostics snapshot at an instant. A state write at that
same instant keeps it complete; a later unaccounted write retires it.

The inventory comes from @pdpp/polyfill-connectors, the same specifier the
reference server loads at runtime, so the test and the server agree on the
expected stores.

Signed-off-by: Tim Nunamaker <tnunamak@gmail.com>
Assisted-by: AI
---
 .../local-device-coverage-stale-proof.test.ts | 31 +++++++++++++++++++
 1 file changed, 31 insertions(+)

diff --git a/reference-implementation/test/local-device-coverage-stale-proof.test.ts b/reference-implementation/test/local-device-coverage-stale-proof.test.ts
index 8aeed1400..8a21b0986 100644
--- a/reference-implementation/test/local-device-coverage-stale-proof.test.ts
+++ b/reference-implementation/test/local-device-coverage-stale-proof.test.ts
@@ -37,6 +37,8 @@ import { dirname, join } from "node:path";
 import { DatabaseSync } from "node:sqlite";
 import test from "node:test";
 
+import { expectedLocalCoverageStoreDescriptors } from "@pdpp/polyfill-connectors/local-source-inventory";
+
 import { bindOptionalRunCoverageToRelease } from "../../packages/local-collector/bin/pdpp-local-collector.ts";
 import {
   type CollectorConnectorSpec,
@@ -576,6 +578,35 @@ test("store: a state commit before the proof does not retire it", async (t) => {
   });
 });
 
+// Legacy path: no v2 run exists, so the projection reads the committed
+// `coverage_diagnostics` snapshot. Its `updated_at` is the proof's instant.
+const LEGACY_DIAGNOSTICS_STREAM = "coverage_diagnostics";
+
+test("store: a legacy diagnostics proof is retired by a later state commit, not by one at its own instant", async (t) => {
+  await withBoundaryConnection(async () => {
+    const stores = expectedLocalCoverageStoreDescriptors(connectorId);
+    assert.ok(stores, "the claude-code inventory declares its coverage stores");
+    const snapshot = {
+      fetched_at: PROOF_AT,
+      stores: stores.map(({ store, stream }) => ({ status: "collected", store, stream })),
+    };
+    t.mock.timers.enable({ apis: ["Date"], now: Date.parse(PROOF_AT) });
+    await putSyncState(BOUNDARY_TARGET, { [LEGACY_DIAGNOSTICS_STREAM]: snapshot });
+    assert.equal((await boundaryProjection()).axis, "complete", "the legacy snapshot is a reliable complete proof");
+
+    await putSyncState(BOUNDARY_TARGET, { messages: { cursor: "same-instant" } });
+    assert.equal((await boundaryProjection()).axis, "complete", "a same-instant state write is not later");
+
+    t.mock.timers.setTime(Date.parse(PROOF_AT) + 1);
+    await putSyncState(BOUNDARY_TARGET, { messages: { cursor: "later" } });
+    assert.equal(
+      (await boundaryProjection()).axis,
+      "unknown",
+      "a later unaccounted state write retires the legacy proof"
+    );
+  });
+});
+
 test("store: a later server-owned scope write is not a state commit and does not retire the proof", async (t) => {
   await withBoundaryConnection(async () => {
     t.mock.timers.enable({ apis: ["Date"], now: Date.parse(PROOF_AT) });

From 283f4f996df798a40bc0024df1cdd1f7671f9ffc Mon Sep 17 00:00:00 2001
From: Tim Nunamaker <tnunamak@gmail.com>
Date: Thu, 22 Oct 2026 05:35:27 -0500
Subject: [PATCH 29/87] test(local-device): move the install-path packager into
 test helpers

The release packager is test-only tooling. Under reference-implementation/
scripts the zero-connector-knowledge scanner treats it as production code and
rejects its fixture reads. Move it to test/helpers and update the workflow
and comments that name it.

Assisted-by: AI
Signed-off-by: Tim Nunamaker <tnunamak@gmail.com>
---
 .github/workflows/managed-connector-oci-e2e.yml             | 6 +++---
 .../helpers}/build-install-path-releases.ts                 | 6 +++---
 .../test/helpers/install-path-fixture.ts                    | 2 +-
 .../test/local-device-coverage-journey.test.ts              | 6 +++---
 4 files changed, 10 insertions(+), 10 deletions(-)
 rename reference-implementation/{scripts => test/helpers}/build-install-path-releases.ts (98%)

diff --git a/.github/workflows/managed-connector-oci-e2e.yml b/.github/workflows/managed-connector-oci-e2e.yml
index 1c3e25bc1..0748e6f7f 100644
--- a/.github/workflows/managed-connector-oci-e2e.yml
+++ b/.github/workflows/managed-connector-oci-e2e.yml
@@ -68,7 +68,7 @@ on:
       # The install-path journey (J2-install) and the fixture it packages.
       - "reference-implementation/test/local-device-coverage-journey.test.ts"
       - "reference-implementation/test/helpers/install-path-fixture.ts"
-      - "reference-implementation/scripts/build-install-path-releases.ts"
+      - "reference-implementation/test/helpers/build-install-path-releases.ts"
       # The shipped selection and binding the journey calls (selectedReleaseForPin, bindOptionalRunCoverageToRelease).
       - "packages/local-collector/bin/pdpp-local-collector.ts"
       # This job's own control files: a PR that only edits the workflow or moves the producer pin
@@ -85,7 +85,7 @@ on:
       - "packages/local-collector/test/helpers/live-registry-client.ts"
       - "reference-implementation/test/local-device-coverage-journey.test.ts"
       - "reference-implementation/test/helpers/install-path-fixture.ts"
-      - "reference-implementation/scripts/build-install-path-releases.ts"
+      - "reference-implementation/test/helpers/build-install-path-releases.ts"
       - "packages/local-collector/bin/pdpp-local-collector.ts"
       - ".github/workflows/managed-connector-oci-e2e.yml"
       - ".github/managed-connector-e2e-pin.json"
@@ -496,7 +496,7 @@ jobs:
           RELEASES_JSON: ${{ runner.temp }}/install-path-releases.json
         run: |
           set -euo pipefail
-          node --import tsx scripts/build-install-path-releases.ts \
+          node --import tsx test/helpers/build-install-path-releases.ts \
             --producer-git "$PRODUCER_GIT" \
             --producer-sha "$PRODUCER_SHA" \
             --registry localhost:5000 \
diff --git a/reference-implementation/scripts/build-install-path-releases.ts b/reference-implementation/test/helpers/build-install-path-releases.ts
similarity index 98%
rename from reference-implementation/scripts/build-install-path-releases.ts
rename to reference-implementation/test/helpers/build-install-path-releases.ts
index a2bd82376..282843cf5 100644
--- a/reference-implementation/scripts/build-install-path-releases.ts
+++ b/reference-implementation/test/helpers/build-install-path-releases.ts
@@ -29,7 +29,7 @@
  *
  * Run from reference-implementation/:
  *
- *   node --import tsx scripts/build-install-path-releases.ts \
+ *   node --import tsx test/helpers/build-install-path-releases.ts \
  *     --producer-git <data-connectors checkout> --producer-sha <40-hex> \
  *     --registry <host:port> --work <directory that does not exist> \
  *     --modules <directory whose node_modules/esbuild resolves> [--oras <path>]
@@ -43,7 +43,7 @@ import { existsSync, mkdirSync, readFileSync, symlinkSync, writeFileSync } from
 import { dirname, join } from "node:path";
 import { parseArgs } from "node:util";
 
-import type { CollectionProfilePin } from "../../packages/local-collector/src/managed/collection-profiles.ts";
+import type { CollectionProfilePin } from "../../../packages/local-collector/src/managed/collection-profiles.ts";
 import {
   fixtureConnectorSource,
   INSTALL_PATH_COLLECTOR_ID,
@@ -51,7 +51,7 @@ import {
   INSTALL_PATH_PROFILE,
   INSTALL_PATH_REPOSITORY,
   INSTALL_PATH_VERSION,
-} from "../test/helpers/install-path-fixture.ts";
+} from "./install-path-fixture.ts";
 
 /** The files the builder and its gates read from the producer, at the pinned revision. */
 const PRODUCER_FILES = [
diff --git a/reference-implementation/test/helpers/install-path-fixture.ts b/reference-implementation/test/helpers/install-path-fixture.ts
index 1982bb505..d78155edd 100644
--- a/reference-implementation/test/helpers/install-path-fixture.ts
+++ b/reference-implementation/test/helpers/install-path-fixture.ts
@@ -6,7 +6,7 @@
  *
  * One connector protocol serves two consumers: the local-device journeys run it
  * as a source file, and the install-path journey packages it as an OCI artifact
- * with `scripts/build-install-path-releases.ts`. Both must behave the same, so
+ * with `test/helpers/build-install-path-releases.ts`. Both must behave the same, so
  * the protocol body lives here once.
  */
 
diff --git a/reference-implementation/test/local-device-coverage-journey.test.ts b/reference-implementation/test/local-device-coverage-journey.test.ts
index e49554f3d..9ff65e3df 100644
--- a/reference-implementation/test/local-device-coverage-journey.test.ts
+++ b/reference-implementation/test/local-device-coverage-journey.test.ts
@@ -600,19 +600,19 @@ test("J3: a run that fails before its scan leaves the lane not covered; the serv
 // object. The installer refuses an artifact that has none before it reaches the check, so the
 // builder pushes a fabricated bundle per release. (3) The transport. The signed lock names ghcr.io,
 // and the job's registry answers for it over plain HTTP; any other host is refused. (4) The pins.
-// scripts/build-install-path-releases.ts computes them from the built bytes, not from the signed
+// test/helpers/build-install-path-releases.ts computes them from the built bytes, not from the signed
 // catalog. (5) The server's release, which each phase sets with __setLocalCollectorReleaseForTest,
 // as J1 does. (6) The CLI's main() and its checked-in pin map: the journey passes the fixture pins
 // to the same functions that map feeds.
 //
 // The registry is the one the managed-connector OCI job starts. To run it locally, push the two
-// releases with scripts/build-install-path-releases.ts and export the two variables below.
+// releases with test/helpers/build-install-path-releases.ts and export the two variables below.
 
 const INSTALL_REGISTRY = process.env.PDPP_TEST_OCI_REGISTRY;
 const INSTALL_PINS = process.env.PDPP_TEST_INSTALL_PATH_PINS;
 const INSTALL_SKIP =
   INSTALL_REGISTRY === undefined || INSTALL_PINS === undefined
-    ? "set PDPP_TEST_OCI_REGISTRY and PDPP_TEST_INSTALL_PATH_PINS (scripts/build-install-path-releases.ts writes the pins)"
+    ? "set PDPP_TEST_OCI_REGISTRY and PDPP_TEST_INSTALL_PATH_PINS (test/helpers/build-install-path-releases.ts writes the pins)"
     : false;
 
 /** Owner-visible coverage for one connection, as the list and the detail both report it. */

From 2a1fe6fd08b4990ae4efeb3aa8b905efec4794a6 Mon Sep 17 00:00:00 2001
From: Tim Nunamaker <tnunamak@gmail.com>
Date: Thu, 22 Oct 2026 06:26:10 -0500
Subject: [PATCH 30/87] fix(collector): refused runs open the failure barrier

A run refused before it starts (aborted signal, invalid provenance, placement
or capability mismatch) is an attempt for its lane. Its preflight checks ran
before the try block whose catch opens the connector_child_failure gap, so the
refusal left no barrier and an earlier covered receipt could keep standing for
the lane.

Move the three checks inside the try. The catch opens the gap for any throw
after the attempt starts. A refusal never reaches the starting heartbeat, so no
heartbeat is sent, as before.

The three runner tests fail before this change (no gap row) and pass after.

Assisted-by: AI
Signed-off-by: Tim Nunamaker <tnunamak@gmail.com>
---
 .../src/collector-runner.test.ts              | 122 ++++++++++++++++++
 .../collector-runtime/src/collector-runner.ts |  35 ++---
 2 files changed, 141 insertions(+), 16 deletions(-)

diff --git a/packages/collector-runtime/src/collector-runner.test.ts b/packages/collector-runtime/src/collector-runner.test.ts
index 82b4060a5..ae375a4e7 100644
--- a/packages/collector-runtime/src/collector-runner.test.ts
+++ b/packages/collector-runtime/src/collector-runner.test.ts
@@ -3684,6 +3684,128 @@ test("runCollectorConnector honors AbortSignal at the pre-spawn gate", async ()
   }
 });
 
+/**
+ * A refusal before any work is still an attempt for its lane. Each one must
+ * leave the lane's connector_child_failure barrier open, or an earlier covered
+ * receipt would keep standing for the lane.
+ */
+function assertPreflightRefusalOpensBarrier(queuePath: string, runId: string) {
+  const gaps = readGapRows(queuePath);
+  assert.deepEqual(
+    gaps.map((item) => item.status),
+    ["ready"],
+    "the refused attempt leaves one open failure gap"
+  );
+  assert.deepEqual(
+    gaps.map((item) => (item.payload as Record<string, unknown>).reason),
+    ["connector_child_failure"]
+  );
+  assert.deepEqual(
+    gaps.map((item) => (item.payload as Record<string, unknown>).firstSeenRunId),
+    [runId]
+  );
+}
+
+test("a run aborted before start leaves a failure gap for its lane", async () => {
+  const harness = await startCollectorHarness({ priorState: {} });
+  try {
+    const queuePath = await tempQueuePath();
+    const controller = new AbortController();
+    controller.abort(new Error("operator cancelled run"));
+
+    await assert.rejects(
+      () =>
+        runCollectorConnector({
+          abortSignal: controller.signal,
+          baseUrl: harness.url,
+          connector: {
+            args: ["unused.ts"],
+            command: "node",
+            connector_id: "fixture-aborted-barrier",
+            protocol_capabilities: [],
+            runtime_requirements: { bindings: {} },
+            streams: ["messages"],
+          },
+          deviceId: "device-1",
+          deviceToken: "device-token",
+          executionRoot: TEST_EXECUTION_ROOT,
+          queuePath,
+          runId: "run-aborted-before-start",
+          sourceInstanceId: "src-1",
+        }),
+      /operator cancelled run/
+    );
+    assertPreflightRefusalOpensBarrier(queuePath, "run-aborted-before-start");
+  } finally {
+    await harness.close();
+  }
+});
+
+test("a run with invalid provenance leaves a failure gap for its lane", async () => {
+  const harness = await startCollectorHarness({ priorState: {} });
+  try {
+    const queuePath = await tempQueuePath();
+
+    await assert.rejects(
+      () =>
+        runCollectorConnector({
+          baseUrl: harness.url,
+          connector: {
+            args: ["unused.ts"],
+            command: "node",
+            connector_id: "fixture-provenance-barrier",
+            protocol_capabilities: [],
+            runCoverageVersion: 1,
+            runtime_requirements: { bindings: {} },
+            streams: ["messages"],
+          },
+          deviceId: "device-1",
+          deviceToken: "device-token",
+          executionRoot: TEST_EXECUTION_ROOT,
+          queuePath,
+          runId: "run-invalid-provenance",
+          sourceInstanceId: "src-1",
+        }),
+      /optional store evidence requires a bound manifest fingerprint and artifact digest/
+    );
+    assertPreflightRefusalOpensBarrier(queuePath, "run-invalid-provenance");
+  } finally {
+    await harness.close();
+  }
+});
+
+test("a run refused at placement leaves a failure gap for its lane", async () => {
+  const harness = await startCollectorHarness({ priorState: {} });
+  try {
+    const queuePath = await tempQueuePath();
+
+    await assert.rejects(
+      () =>
+        runCollectorConnector({
+          baseUrl: harness.url,
+          connector: {
+            args: ["unused.ts"],
+            command: "node",
+            connector_id: "fixture-placement-barrier",
+            protocol_capabilities: ["STREAM_EVIDENCE"],
+            runtime_requirements: { bindings: {} },
+            streams: ["messages"],
+          },
+          deviceId: "device-1",
+          deviceToken: "device-token",
+          executionRoot: TEST_EXECUTION_ROOT,
+          queuePath,
+          runId: "run-placement-refused",
+          sourceInstanceId: "src-1",
+        }),
+      RuntimeCapabilityMismatchError
+    );
+    assertPreflightRefusalOpensBarrier(queuePath, "run-placement-refused");
+  } finally {
+    await harness.close();
+  }
+});
+
 test("recoverAndSummarizeOutbox recovers expired leases and returns a fast summary", async () => {
   let now = new Date("2026-05-19T12:00:00.000Z");
   const dir = await createTempDir("pdpp-recover-summary-");
diff --git a/packages/collector-runtime/src/collector-runner.ts b/packages/collector-runtime/src/collector-runner.ts
index 60aea2481..b40db402c 100644
--- a/packages/collector-runtime/src/collector-runner.ts
+++ b/packages/collector-runtime/src/collector-runner.ts
@@ -898,18 +898,6 @@ export class CollectorStateReadError extends Error {
  */
 // biome-ignore lint/complexity/noExcessiveCognitiveComplexity: ordered durable-run lifecycle; splitting it would hide checkpoint and heartbeat ordering.
 export async function runCollectorConnector(config: CollectorRunConfig): Promise<CollectorRunResult> {
-  if (
-    config.connector.runCoverageVersion === 1 &&
-    !(
-      MANIFEST_FINGERPRINT_RE.test(config.connector.manifestFingerprint ?? "") &&
-      ARTIFACT_DIGEST_RE.test(config.connector.artifactDigest ?? "")
-    )
-  ) {
-    throw new Error("optional store evidence requires a bound manifest fingerprint and artifact digest");
-  }
-  throwIfAborted(config.abortSignal);
-  const satisfiedBindings = assertPlacementOrThrow(config.connector, COLLECTOR_RUNTIME_CAPABILITIES);
-
   const policy: CollectorOutboxPolicy = {
     ...DEFAULT_COLLECTOR_OUTBOX_POLICY,
     ...(config.outboxPolicy ?? {}),
@@ -935,6 +923,20 @@ export async function runCollectorConnector(config: CollectorRunConfig): Promise
   // Never replace it with a generic corrective status in the outer catch.
   let definitiveBlockedHeartbeatSent = false;
   try {
+    // Preflight refusals are attempts for this lane too. They run inside the try
+    // so the catch below opens the failure barrier for each of them.
+    if (
+      config.connector.runCoverageVersion === 1 &&
+      !(
+        MANIFEST_FINGERPRINT_RE.test(config.connector.manifestFingerprint ?? "") &&
+        ARTIFACT_DIGEST_RE.test(config.connector.artifactDigest ?? "")
+      )
+    ) {
+      throw new Error("optional store evidence requires a bound manifest fingerprint and artifact digest");
+    }
+    throwIfAborted(config.abortSignal);
+    const satisfiedBindings = assertPlacementOrThrow(config.connector, COLLECTOR_RUNTIME_CAPABILITIES);
+
     const initialSummary = outbox.summary({
       sourceInstanceId: config.sourceInstanceId,
     });
@@ -1172,10 +1174,11 @@ export async function runCollectorConnector(config: CollectorRunConfig): Promise
       streamingBufferHighWaterMark: streamResult.bufferHighWaterMark,
     };
   } catch (error) {
-    // Every failed run leaves an open connector_child_failure gap, whether it
-    // failed before its scan (state read, starting heartbeat, pre-scan drain) or
-    // during it. The device verdict reads open outbox rows as unadmitted, so the
-    // lane stops reading covered until a later complete run recovers the gap.
+    // Every failed run leaves an open connector_child_failure gap, whether it was
+    // refused before any work (provenance, abort, placement), failed before its
+    // scan (state read, starting heartbeat, pre-scan drain), or failed during it.
+    // The device verdict reads open outbox rows as unadmitted, so the lane stops
+    // reading covered until a later complete run recovers the gap.
     ensureOpenFailureGapRow({
       clock: () => new Date(),
       connectorId: config.connector.connector_id,

From 90484672ff7df2cdc6fbb6e4385ce8e300c8b561 Mon Sep 17 00:00:00 2001
From: Tim Nunamaker <tnunamak@gmail.com>
Date: Thu, 22 Oct 2026 06:26:15 -0500
Subject: [PATCH 31/87] fix(local-device): a delivered failure gap keeps the
 lane unadmitted

A failure gap is delivered (outbox status succeeded) before a complete run
recovers it. The device verdict counted only ready, leased and dead-lettered
rows, so a delivered gap read the lane as covered while the server still held
the gap open. Pruning could also delete the delivered row, which closed the
barrier outright.

Count open gap rows in the verdict. An unadmitted verdict on a drained lane
maps to coverage_incomplete, not no_evidence. Exclude gap rows from pruneSent:
only recovery (deleteSucceeded) resolves a gap.

No schema change. Delivery is status succeeded; resolution is the row's removal
after the server recovers it. The durable state already separates the two. The
consumers treated delivery as resolution.

New tests fail before this change: a delivered gap survives pruneSent; an
independent drain leaves the lane unadmitted; a following pass without
coverage evidence leaves it unadmitted; an aborted run after a covered receipt
leaves it unadmitted (device view of the refusal fix in the previous commit).

Assisted-by: AI
Signed-off-by: Tim Nunamaker <tnunamak@gmail.com>
---
 .../src/local-device-outbox.test.ts           |  41 +++
 .../src/local-device-outbox.ts                |   7 +-
 .../bin/pdpp-local-collector.ts               |  50 ++--
 packages/local-collector/test/runner.test.ts  | 241 ++++++++++++++++++
 4 files changed, 320 insertions(+), 19 deletions(-)

diff --git a/packages/collector-runtime/src/local-device-outbox.test.ts b/packages/collector-runtime/src/local-device-outbox.test.ts
index 13d169440..0622267b8 100644
--- a/packages/collector-runtime/src/local-device-outbox.test.ts
+++ b/packages/collector-runtime/src/local-device-outbox.test.ts
@@ -2008,6 +2008,47 @@ function seedSucceededRows(path: string, sourceInstanceId: string, count: number
   }
 }
 
+test("pruneSent keeps a delivered failure gap until recovery deletes it", async (t) => {
+  // Delivery marks a gap succeeded; only recovery removes it. Pruning the
+  // acknowledged tail must not close a barrier the server still holds open.
+  const path = await tempOutboxPath(t);
+  const outbox = new LocalDeviceOutbox({ path });
+  try {
+    outbox.enqueue({
+      id: "gap-1",
+      kind: "gap",
+      payload: {
+        connectorId: "connector-1",
+        firstSeenAt: "2026-10-22T11:00:00.000Z",
+        nextAttemptBackoffMs: 60_000,
+        reason: "connector_child_failure",
+        retryable: true,
+        sourceInstanceId: "source-1",
+      },
+      sourceInstanceId: "source-1",
+    });
+    outbox.enqueue({
+      id: "batch-1",
+      kind: "record_batch",
+      payload: { batchSeq: 1, records: [{ key: "m-1" }] },
+      sourceInstanceId: "source-1",
+    });
+    for (let claims = 0; claims < 2; claims += 1) {
+      const [claimed] = outbox.claimReady({ holder: "worker", leaseMs: 60_000, sourceInstanceId: "source-1" });
+      assert.ok(claimed);
+      outbox.acknowledge({ holder: "worker", id: claimed.id, leaseEpoch: claimed.lease_epoch });
+    }
+    assert.equal(outbox.get("gap-1")?.status, "succeeded");
+
+    const result = outbox.pruneSent({ dryRun: false, keepCount: 0, sourceInstanceId: "source-1" });
+    assert.equal(result.pruned, 1, "only the acknowledged record batch is prunable");
+    assert.equal(outbox.get("gap-1")?.status, "succeeded", "a delivered gap survives pruning");
+    assert.equal(outbox.countOpenGaps({ sourceInstanceId: "source-1" }), 1);
+  } finally {
+    outbox.close();
+  }
+});
+
 test("pruneSent deletes a backlog larger than SQLite's per-statement variable limit", async (t) => {
   // The live incident shape: ~170k succeeded rows. A single
   // `DELETE ... WHERE id IN (...)` over that set throws "too many SQL
diff --git a/packages/collector-runtime/src/local-device-outbox.ts b/packages/collector-runtime/src/local-device-outbox.ts
index a05707a25..32d852bbe 100644
--- a/packages/collector-runtime/src/local-device-outbox.ts
+++ b/packages/collector-runtime/src/local-device-outbox.ts
@@ -838,7 +838,7 @@ export class LocalDeviceOutbox {
    * `retrying`, or `dead_letter` rows.
    *
    * Safety invariants:
-   * - Only rows with `status = 'succeeded'` are ever considered.
+   * - Only rows with `status = 'succeeded'` and a non-gap kind are ever considered.
    * - `olderThanIso` uses `COALESCE(acknowledged_at, updated_at)` so rows
    *   without an explicit acknowledged timestamp still age out correctly.
    * - `keepCount` uses a `NOT IN (SELECT id … ORDER BY rowid DESC LIMIT n)`
@@ -856,7 +856,10 @@ export class LocalDeviceOutbox {
       throw new Error("pruneSent keepCount must be a non-negative safe integer");
     }
 
-    const clauses: string[] = ["status = 'succeeded'"];
+    // A delivered gap is still open for its lane until recovery deletes it (see
+    // `deleteSucceeded`). Pruning it would close a failure barrier the server
+    // still holds open, so gap rows are never prune candidates.
+    const clauses: string[] = ["status = 'succeeded'", "kind != 'gap'"];
     const params: (string | number)[] = [];
 
     if (input.sourceInstanceId) {
diff --git a/packages/local-collector/bin/pdpp-local-collector.ts b/packages/local-collector/bin/pdpp-local-collector.ts
index 5a6793531..56844bafd 100644
--- a/packages/local-collector/bin/pdpp-local-collector.ts
+++ b/packages/local-collector/bin/pdpp-local-collector.ts
@@ -1693,8 +1693,9 @@ export interface LocalOutboxStatusOutput {
    * - `incomplete`: bound to the selected release, but a store fell short or
    *   the runtime accounting shows outstanding debt.
    * - `unadmitted`: the lane holds open outbox work (queued, leased or
-   *   dead-lettered), so the latest run has not reached a durable terminal
-   *   commit. The acknowledged verdict above does not stand for that run.
+   *   dead-lettered), or a failure gap no complete run has recovered, so the
+   *   latest run has not reached a durable terminal commit. The acknowledged
+   *   verdict above does not stand for that run.
    * - `not_current`: acknowledged for another release, or with no release
    *   binding, or this device selects no release. Says nothing about
    *   completeness, so it is never read as `incomplete`.
@@ -1876,7 +1877,13 @@ export function inspectLocalOutboxStatus(
   const exists = existsSync(dbPath);
   const inspection = exists
     ? readOutboxInspection(dbPath, options.sourceInstanceId)
-    : { coverageObserved: null, recordBatchCount: 0, summary: emptyOutboxSummary(), terminalCoverage: null };
+    : {
+        coverageObserved: null,
+        openGaps: 0,
+        recordBatchCount: 0,
+        summary: emptyOutboxSummary(),
+        terminalCoverage: null,
+      };
   const { coverageObserved, recordBatchCount, summary } = inspection;
   const outboxLifecycleState = deriveLocalCollectorLifecycleState({
     coverageObserved,
@@ -1889,17 +1896,19 @@ export function inspectLocalOutboxStatus(
       : deps.selectedRelease !== undefined
         ? deps.selectedRelease
         : selectedCollectionRelease(options.connector);
-  // Any open work for the lane (queued, leased or dead-lettered) is work the
-  // acknowledged receipt does not account for: the latest run has not reached
-  // a durable terminal commit. Open work also keeps the outbox lifecycle
-  // non-idle, so `unadmitted` never reaches the lifecycle mapping below.
-  const latestRunOpen = summary.ready + summary.leased + summary.deadLetter > 0;
+  // Open work for the lane (queued, leased or dead-lettered), and any gap still
+  // open for it, is work the acknowledged receipt does not account for: the
+  // latest run has not reached a durable terminal commit that recovered its
+  // failures. A delivered gap counts, because only a complete run's recovery
+  // closes it. Open work keeps the outbox lifecycle non-idle; on a drained lane,
+  // an unrecovered gap maps to `coverage_incomplete` below.
+  const latestRunOpen = summary.ready + summary.leased + summary.deadLetter > 0 || inspection.openGaps > 0;
   const terminalVerdict = terminalCoverageVerdict(inspection.terminalCoverage, selectedRelease, latestRunOpen);
   const lifecycleState =
     options.sourceInstanceId && (outboxLifecycleState === "healthy_idle" || outboxLifecycleState === "coverage_missing")
       ? terminalVerdict === "covered"
         ? "covered"
-        : terminalVerdict === "incomplete"
+        : terminalVerdict === "incomplete" || terminalVerdict === "unadmitted"
           ? "coverage_incomplete"
           : terminalVerdict === "not_current"
             ? "coverage_not_current"
@@ -2135,7 +2144,7 @@ export function buildLocalOutboxDoctor(
       staleScope
         ? "The latest acknowledged terminal verdict belongs to an older collection boundary. Re-run against the active scope before treating this lane as covered."
         : status.terminal_coverage.verdict === "unadmitted"
-          ? "The latest run has not reached the server: its queued, retrying or dead-lettered work is still open, so the last acknowledged verdict does not stand for it. Let the next run drain the queue, or resolve dead-letter rows with `pdpp-local-collector recover`."
+          ? "The latest run has not reached the server: its queued, retrying or dead-lettered work is still open, or a failure gap is not yet recovered, so the last acknowledged verdict does not stand for it. Let the next complete run drain the queue and recover the gap, or resolve dead-letter rows with `pdpp-local-collector recover`."
           : status.terminal_coverage.verdict === "not_current"
             ? "The latest acknowledged terminal verdict was produced for a connector release other than the one this device selects, or for none. Re-run the collector on the selected release before treating this lane as covered."
             : "The latest acknowledged terminal verdict is incomplete; inspect the connector run diagnostics and re-run after resolving the missing store coverage."
@@ -3685,6 +3694,12 @@ interface LocalOutboxInspection {
    * refuses an unbounded payload scan).
    */
   coverageObserved: boolean | null;
+  /**
+   * Gap rows still open for the lane: queued, leased, or delivered but not yet
+   * recovered. Delivery is not recovery, so a delivered gap keeps the lane
+   * unadmitted until a complete run recovers it.
+   */
+  openGaps: number;
   recordBatchCount: number;
   summary: LocalDeviceOutboxSummary;
   terminalCoverage: { collectionBoundary: string; terminalFacts: readonly StoredTerminalFact[] } | null;
@@ -3744,10 +3759,11 @@ function readOutboxInspection(path: string, sourceInstanceId: string | undefined
   try {
     const summary = outbox.summary(sourceInstanceId ? { sourceInstanceId } : {});
     if (!sourceInstanceId) {
-      return { coverageObserved: null, recordBatchCount: 0, summary, terminalCoverage: null };
+      return { coverageObserved: null, openGaps: 0, recordBatchCount: 0, summary, terminalCoverage: null };
     }
     return {
       coverageObserved: outbox.hasObservedStream({ sourceInstanceId, stream: COVERAGE_DIAGNOSTICS_STREAM }),
+      openGaps: outbox.countOpenGaps({ sourceInstanceId }),
       recordBatchCount: outbox.countRecordBatches({ sourceInstanceId }),
       summary,
       terminalCoverage: outbox.latestTerminalCoverageReceipt({ sourceInstanceId }),
@@ -3802,12 +3818,12 @@ export function selectedReleaseForPin(
 }
 
 /**
- * Covered is a claim about one run on one release. Open work for the lane means
- * the latest run is unadmitted, so the receipt cannot speak for the lane. A
- * receipt for another digest or fingerprint, or on a device that selects no
- * release, is `not_current` whatever its stores say. The run's own runtime
- * accounting must be present and clean: a store reads `collected` only as the
- * collector measured it.
+ * Covered is a claim about one run on one release. Open work, or an unrecovered
+ * gap, for the lane means the latest run is unadmitted, so the receipt cannot
+ * speak for the lane. A receipt for another digest or fingerprint, or on a device
+ * that selects no release, is `not_current` whatever its stores say. The run's own
+ * runtime accounting must be present and clean: a store reads `collected` only as
+ * the collector measured it.
  */
 function terminalCoverageVerdict(
   receipt: LocalOutboxInspection["terminalCoverage"],
diff --git a/packages/local-collector/test/runner.test.ts b/packages/local-collector/test/runner.test.ts
index d1769beff..677cfdb9c 100644
--- a/packages/local-collector/test/runner.test.ts
+++ b/packages/local-collector/test/runner.test.ts
@@ -10,6 +10,8 @@ import { dirname, join } from "node:path";
 // biome-ignore lint/correctness/noUnresolvedImports: Biome 2.5.5's built-in Node module registry does not yet recognize node:sqlite; Node's own resolver and tsc both resolve it (same pre-existing gap as packages/collector-runtime/src/local-device-outbox.ts and its sibling test files).
 import { DatabaseSync } from "node:sqlite";
 import { after, test } from "node:test";
+import { DEFAULT_COLLECTOR_OUTBOX_POLICY, drainCollectorOutbox } from "@pdpp/collector-runtime/collector-runner";
+import { LocalDeviceClient } from "@pdpp/collector-runtime/local-device-client";
 import {
   // The concrete bundled-connector registry is assembled at the composition
   // root (the bin) from connector-owned definitions; the src runtime is
@@ -2967,6 +2969,192 @@ test("a pass that fails after its pre-scan drain delivered an earlier gap leaves
   assert.equal(statusFor(path).terminal_coverage.verdict, "unadmitted");
 });
 
+/**
+ * Enqueues the connector_child_failure gap a failed pass leaves for `src-1`,
+ * under the id the runner derives for it. Returns that id.
+ */
+function enqueueFailureGap(outbox: LocalDeviceOutbox, connectorId: string): string {
+  const id = buildLocalDeviceOutboxId({
+    kind: "gap",
+    parts: [connectorId, "src-1", "connector_child_failure", null, null],
+    sourceInstanceId: "src-1",
+  });
+  outbox.enqueue({
+    id,
+    kind: "gap",
+    payload: {
+      connectorId,
+      firstSeenAt: "2026-10-22T11:00:00.000Z",
+      nextAttemptBackoffMs: 60_000,
+      reason: "connector_child_failure",
+      retryable: true,
+      sourceInstanceId: "src-1",
+    },
+    sourceInstanceId: "src-1",
+  });
+  return id;
+}
+
+/** One independent drain of `src-1`'s ready rows, outside any collector run. */
+async function drainLaneOnce(path: string, baseUrl: string, connectorId: string): Promise<void> {
+  const outbox = new LocalDeviceOutbox({ path });
+  try {
+    await drainCollectorOutbox({
+      client: new LocalDeviceClient({ baseUrl, deviceId: "device-1", deviceToken: "device-token" }),
+      connectorId,
+      holderId: "independent-drain",
+      outbox,
+      policy: DEFAULT_COLLECTOR_OUTBOX_POLICY,
+      sourceInstanceId: "src-1",
+    });
+  } finally {
+    outbox.close();
+  }
+}
+
+test("a run aborted before start leaves an earlier covered receipt unadmitted", async () => {
+  const path = await tempOutboxPath();
+  const outbox = new LocalDeviceOutbox({ path });
+  try {
+    acknowledgeTerminalCoverage(outbox, {
+      id: "terminal-run-a",
+      stores: [{ store: "local_files", status: "collected" }],
+    });
+  } finally {
+    outbox.close();
+  }
+  assert.equal(statusFor(path).terminal_coverage.verdict, "covered");
+
+  const controller = new AbortController();
+  controller.abort(new Error("operator cancelled run"));
+  await assert.rejects(
+    runCollectorConnector({
+      abortSignal: controller.signal,
+      baseUrl: "http://127.0.0.1:9",
+      connector: {
+        args: [],
+        command: process.execPath,
+        connector_id: "claude_code",
+        protocol_capabilities: [],
+        runtime_requirements: { bindings: {} },
+        streams: ["sessions"],
+      },
+      deviceId: "device-1",
+      deviceToken: "device-token",
+      executionRoot: dirname(path),
+      queuePath: path,
+      runId: "run-aborted-before-start",
+      sourceInstanceId: "src-1",
+    }),
+    /operator cancelled run/
+  );
+  const status = statusFor(path);
+  assert.equal(status.terminal_coverage.verdict, "unadmitted");
+  assert.notEqual(status.lifecycle_state, "covered");
+});
+
+test("an unrecovered failure gap delivered by an independent drain leaves the lane unadmitted", async () => {
+  const path = await tempOutboxPath();
+  const outbox = new LocalDeviceOutbox({ path });
+  try {
+    acknowledgeTerminalCoverage(outbox, {
+      id: "terminal-run-a",
+      stores: [{ store: "local_files", status: "collected" }],
+    });
+  } finally {
+    outbox.close();
+  }
+  assert.equal(statusFor(path).terminal_coverage.verdict, "covered");
+
+  // A failed pass leaves its gap open, then an independent drain delivers it.
+  // Delivery is not recovery: no complete run has resolved the barrier.
+  const seeded = new LocalDeviceOutbox({ path });
+  try {
+    enqueueFailureGap(seeded, "claude_code");
+  } finally {
+    seeded.close();
+  }
+  const server = await startStateReadRefusingServer();
+  try {
+    await drainLaneOnce(path, server.url, "claude_code");
+    assert.equal(server.gapAcks.length, 1, "the independent drain delivered the gap");
+  } finally {
+    await server.close();
+  }
+  const status = statusFor(path);
+  assert.equal(status.terminal_coverage.verdict, "unadmitted");
+  assert.notEqual(status.lifecycle_state, "covered");
+});
+
+test("a following successful pass without coverage evidence leaves a delivered failure gap unadmitted", async () => {
+  const path = await tempOutboxPath();
+  const outbox = new LocalDeviceOutbox({ path });
+  let gapId = "";
+  try {
+    acknowledgeTerminalCoverage(outbox, {
+      id: "terminal-run-a",
+      stores: [{ store: "local_files", status: "collected" }],
+    });
+    gapId = enqueueFailureGap(outbox, "custom");
+  } finally {
+    outbox.close();
+  }
+
+  const gapServer = await startStateReadRefusingServer();
+  try {
+    await drainLaneOnce(path, gapServer.url, "custom");
+    assert.equal(gapServer.gapAcks.length, 1, "the independent drain delivered the gap");
+  } finally {
+    await gapServer.close();
+  }
+
+  // A pass that succeeds without negotiating coverage commits no terminal
+  // evidence, so it neither replaces the receipt nor recovers the gap.
+  const previous = process.env[ALLOW_CUSTOM_COMMAND_ENV];
+  process.env[ALLOW_CUSTOM_COMMAND_ENV] = "1";
+  const server = await startAcceptingDeviceServer();
+  try {
+    const fixture = await writeCountingFixtureConnector(1);
+    const result = await runCollectorOnce({
+      args: [fixture],
+      baseUrl: server.url,
+      command: "run",
+      connector: "custom",
+      deviceId: "device-1",
+      deviceToken: "token-1",
+      entrypointCommand: "node",
+      quiet: true,
+      queuePath: path,
+      sourceInstanceId: "src-1",
+      streams: ["messages"],
+    });
+    assert.equal(result.done?.status, "succeeded");
+    assert.equal(result.statePutFailed, false);
+    assert.equal(
+      result.outboxSummary.ready + result.outboxSummary.leased + result.outboxSummary.deadLetter,
+      0,
+      "the pass drained all of its own work, so any unadmitted verdict comes from the gap"
+    );
+  } finally {
+    await server.close();
+    if (previous === undefined) {
+      delete process.env[ALLOW_CUSTOM_COMMAND_ENV];
+    } else {
+      process.env[ALLOW_CUSTOM_COMMAND_ENV] = previous;
+    }
+  }
+
+  const after = new LocalDeviceOutbox({ path });
+  try {
+    assert.equal(after.get(gapId)?.status, "succeeded", "the successful pass left the delivered gap unrecovered");
+  } finally {
+    after.close();
+  }
+  const status = statusFor(path);
+  assert.equal(status.terminal_coverage.verdict, "unadmitted");
+  assert.notEqual(status.lifecycle_state, "covered");
+});
+
 test("open record work without an acknowledged receipt stays no_evidence", async () => {
   const path = await tempOutboxPath();
   const outbox = new LocalDeviceOutbox({ path });
@@ -3824,6 +4012,59 @@ function tempDirSync(prefix = "pdpp-local-collector-test-"): string {
  * two routes a sample run actually hits. Not a general harness — keep it
  * this small; `collector-runner.test.ts` already owns the full route set.
  */
+/**
+ * A reference stand-in that accepts a whole pass: prior state, state writes, and
+ * ingest batches echoing the accepted count the client requires. Unlike
+ * {@link startSampleTestServer}, a batch it accepts is actually drained, so a
+ * pass that uses it leaves no open work of its own.
+ */
+async function startAcceptingDeviceServer(): Promise<{ close: () => Promise<void>; url: string }> {
+  const server = createServer((req, res) => {
+    let body = "";
+    req.on("data", (chunk) => {
+      body += chunk;
+    });
+    req.on("end", () => {
+      const url = req.url ?? "";
+      if (url.endsWith("/state")) {
+        res.writeHead(200, { "content-type": "application/json" });
+        res.end(
+          JSON.stringify({
+            device_id: "device-1",
+            object: "device_source_instance_state",
+            source_instance_id: "src-1",
+            state: {},
+            updated_at: null,
+          })
+        );
+        return;
+      }
+      if (url.includes("/ingest-batches")) {
+        const records = (JSON.parse(body || "{}").records ?? []) as unknown[];
+        res.writeHead(201, { "content-type": "application/json" });
+        res.end(
+          JSON.stringify({
+            accepted_record_count: records.length,
+            object: "device_ingest_batch_result",
+            rejected_record_count: 0,
+            status: "accepted",
+          })
+        );
+        return;
+      }
+      res.writeHead(200, { "content-type": "application/json" });
+      res.end(JSON.stringify({ ok: true }));
+    });
+  });
+  await new Promise<void>((resolve) => server.listen(0, "127.0.0.1", resolve));
+  const address = server.address();
+  assert.ok(address && typeof address === "object");
+  return {
+    close: () => new Promise<void>((resolve) => server.close(() => resolve())),
+    url: `http://127.0.0.1:${address.port}`,
+  };
+}
+
 async function startSampleTestServer(): Promise<{ close: () => Promise<void>; url: string }> {
   const server = createServer((req, res) => {
     if (req.url?.endsWith("/state")) {

From 62706471b11a2d5ba74d78f7d1b5a8d0a4f963b7 Mon Sep 17 00:00:00 2001
From: Tim Nunamaker <tnunamak@gmail.com>
Date: Thu, 22 Oct 2026 06:27:57 -0500
Subject: [PATCH 32/87] chore(collector-runtime): regenerate artifact for the
 local-device fixes

Regenerated with artifact:generate and checked with artifact:verify. The
artifact packs the committed tree, so this follows the two source commits
that change collector-runtime.

Assisted-by: AI
Signed-off-by: Tim Nunamaker <tnunamak@gmail.com>
---
 packages/collector-runtime/artifact.json | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/packages/collector-runtime/artifact.json b/packages/collector-runtime/artifact.json
index a004fbc3b..f22eda75f 100644
--- a/packages/collector-runtime/artifact.json
+++ b/packages/collector-runtime/artifact.json
@@ -1,13 +1,13 @@
 {
   "artifact_filename": "pdpp-collector-runtime-0.0.1.tgz",
-  "artifact_sha1": "b195f49bf9f6db9664d4c88348072bf41e1d2348",
-  "artifact_sha256": "894c9695a6aa0de8c03e43fbfb4312583ccc27db113ca152efdb06876bb3f289",
-  "artifact_sha512": "01341b34745e0f34bbb29641dd142abfae69c670a0fa5a462cce4fc506d76bd4f6cb89ed8d06b9a81692d17caa24ff129f562b9182e54ca55078f6fc9f156c64",
+  "artifact_sha1": "99bb1c94b308702167a34b14f8fd1a71defad5c2",
+  "artifact_sha256": "d689fea0cdf0ef045683dfb2c931fb2e50cab9c4e3c705c14a5cb66e116d1c9b",
+  "artifact_sha512": "bc94e8def4f5b23d6c70d05b104e00c6f31c1a29579552ba2ebcb40755d41693a3c8e2075ffa0b6a8f757247b051acbf4237fc7bbc2aa587c816bb9a07215f95",
   "connector_protocol_declarations_sha256": "8f1bf78ec644d002bfc8b1ce2399ccb660ea10bb3ee53c49a7995e1bb0e17dcb",
   "connector_protocol_source_inputs_sha256": "935e99c7e3307d7e48d748b3ca83b7427f1b91c89e7397de2a3842f08f2393fd",
   "declarations_sha256": "143e48acd5b12670e354da3fd5ff1a265f93d2731d31e2d711d1cb1ef65a8b0e",
   "metadata_version": 1,
   "package_name": "@pdpp/collector-runtime",
   "package_version": "0.0.1",
-  "source_inputs_sha256": "1d726bc6fde814b383d409a44f2af5fab3ad74aae8efb05869a0ef3a1bf43554"
+  "source_inputs_sha256": "899b5d7b2bde9389366b32ebd1de57d5ce7d45d3af5e6c1a02a7cb6f3bbdbd97"
 }

From 07edf3dff9f54744ddccb15ec56db93870f75f28 Mon Sep 17 00:00:00 2001
From: Tim Nunamaker <tnunamak@gmail.com>
Date: Thu, 22 Oct 2026 06:33:02 -0500
Subject: [PATCH 33/87] test(local-device): require exact stream identities in
 coverage journey

Several journey assertions passed on an empty array or an absent receipt.
Absent stream facts were read as [], and the install-binding and device-receipt
checks used every() over arrays that could be empty.

Add assertJourneyStreams, which requires exactly the two requested streams with
their identities, before each such read. Check that the owner list and detail
agree on the coverage axis. Add an absent-negotiation START case: a run that
does not negotiate must yield no positive coverage at the owner and device
views. B2 also reads the owner views now.

Mutation checks against the journey: emptying one run's stream facts fails J1
at the new check; a duplicated device receipt identity fails the identity
check; empty owner conditions, a detail/list coverage mismatch, an owner row
reading complete, and an ignored negotiation option each fail the tests that
read them. The install-path checks in J2-install skip without an OCI registry
and were not executed.

Assisted-by: AI
Signed-off-by: Tim Nunamaker <tnunamak@gmail.com>
---
 .../local-device-coverage-journey.test.ts     | 67 +++++++++++++++----
 1 file changed, 53 insertions(+), 14 deletions(-)

diff --git a/reference-implementation/test/local-device-coverage-journey.test.ts b/reference-implementation/test/local-device-coverage-journey.test.ts
index 9ff65e3df..af5dea9bd 100644
--- a/reference-implementation/test/local-device-coverage-journey.test.ts
+++ b/reference-implementation/test/local-device-coverage-journey.test.ts
@@ -286,21 +286,20 @@ async function runOnce(
   journey: Journey,
   mode: string,
   tag: string,
-  options: { deviceToken?: string } = {}
+  options: { deviceToken?: string; negotiateCoverage?: boolean } = {}
 ): Promise<RunOutcome> {
   const observePath = join(journey.dir, `start-${tag}.json`);
-  const connector: CollectorConnectorSpec = bindOptionalRunCoverageToRelease(
-    {
-      args: [journey.childPath, mode, observePath, tag],
-      command: process.execPath,
-      connector_id: CONNECTOR_ID,
-      protocol_capabilities: [],
-      runtime_requirements: { bindings: {} },
-      streams: STREAMS,
-    },
-    { digest: ARTIFACT_DIGEST },
-    PROFILE
-  );
+  const unbound: CollectorConnectorSpec = {
+    args: [journey.childPath, mode, observePath, tag],
+    command: process.execPath,
+    connector_id: CONNECTOR_ID,
+    protocol_capabilities: [],
+    runtime_requirements: { bindings: {} },
+    streams: STREAMS,
+  };
+  const connector = options.negotiateCoverage === false
+    ? unbound
+    : bindOptionalRunCoverageToRelease(unbound, { digest: ARTIFACT_DIGEST }, PROFILE);
   const result = await runCollectorConnector({
     baseUrl: journey.asUrl,
     connector,
@@ -400,6 +399,11 @@ async function ownerConnectionRow(journey: Lane): Promise<OwnerConnectionRow> {
   });
   assert.equal(detail.status, 200, JSON.stringify(detail.body));
   assert.deepEqual(detail.body?.collection_report, row.collection_report, "list and detail agree");
+  assert.equal(
+    (detail.body as unknown as OwnerConnectionRow).connection_health.axes.coverage,
+    (row as unknown as OwnerConnectionRow).connection_health.axes.coverage,
+    "list and detail agree on coverage"
+  );
   return row as unknown as OwnerConnectionRow;
 }
 
@@ -440,6 +444,7 @@ test("J1: a registered release's run coverage crosses child, runner, server and
     assert.equal(aDevice.lifecycle_state, "covered");
     const aReceipt = deviceReceiptFacts(journey);
     assert.equal(aReceipt.length, 2, "the device holds a receipt for both streams");
+    assertJourneyStreams(aReceipt);
     assert.ok(
       aReceipt.every(
         (fact) =>
@@ -480,6 +485,7 @@ test("J1: a registered release's run coverage crosses child, runner, server and
     assert.equal(c.result.done?.status, "succeeded");
     const cStreams = serverRunStreams("c-empty");
     assert.ok(cStreams, "the empty v2 report is acknowledged by the server");
+    assertJourneyStreams(cStreams);
     assert.ok(
       cStreams.every((stream) => JSON.stringify(stream.coverage_statuses) === '["unknown"]'),
       "the empty report commits unknown inventory, not collected stores"
@@ -494,6 +500,21 @@ test("J1: a registered release's run coverage crosses child, runner, server and
   });
 });
 
+test("A: without START coverage negotiation, a successful run supplies no positive coverage", async () => {
+  await withJourney(async (journey) => {
+    const outcome = await runOnce(journey, "empty", "unnegotiated", { negotiateCoverage: false });
+    assert.equal(outcome.observed.run_coverage_version, undefined, "START did not negotiate coverage");
+    assert.equal(outcome.result.done?.status, "succeeded");
+    const owner = await ownerConnectionRow(journey);
+    assert.equal(owner.connection_health.axes.coverage, "unknown");
+    assert.deepEqual(conditions(owner), { messages: "unknown", sessions: "unknown" });
+    const status = deviceStatus(journey);
+    assert.equal(status.terminal_coverage.verdict, "no_evidence");
+    assert.equal(status.lifecycle_state, "no_evidence");
+    assert.deepEqual(deviceReceiptFacts(journey), []);
+  });
+});
+
 test("B2: a server-rejected record stays unadmitted, moves no cursor, and leaves the lane not covered", async () => {
   await withJourney(async (journey) => {
     const outcome = await runOnce(journey, "reject", "reject-1");
@@ -505,6 +526,9 @@ test("B2: a server-rejected record stays unadmitted, moves no cursor, and leaves
     assert.equal(serverRecordCount(journey, "sessions"), 0, "the rejected batch wrote no record");
     assert.deepEqual(serverCursors(journey), {}, "no cursor advanced");
     assert.equal(serverRunStreams("reject-1"), null, "no terminal commit was acknowledged");
+    const owner = await ownerConnectionRow(journey);
+    assert.equal(owner.connection_health.axes.coverage, "unknown");
+    assert.deepEqual(conditions(owner), { messages: "unknown", sessions: "unknown" });
     const status = deviceStatus(journey);
     assert.equal(status.terminal_coverage.verdict, "no_evidence");
     assert.notEqual(status.lifecycle_state, "covered");
@@ -893,10 +917,21 @@ async function ownerCoverage(lane: Lane): Promise<CoverageView> {
   return fromList;
 }
 
+/** Every journey fact set contains exactly one fact for each requested stream. */
+function assertJourneyStreams(streams: readonly Record<string, unknown>[]): void {
+  assert.equal(streams.length, 2, "facts exist for exactly two streams");
+  assert.deepEqual(
+    streams.map((stream) => stream.stream).sort(),
+    ["messages", "sessions"],
+    "facts name each requested stream exactly once"
+  );
+}
+
 /** The stream facts the server stored for one terminal commit. The commit must exist. */
 function requireRunStreams(runId: string): Record<string, unknown>[] {
   const streams = serverRunStreams(runId);
   assert.ok(streams, `the server committed run ${runId}`);
+  assertJourneyStreams(streams);
   return streams;
 }
 
@@ -988,6 +1023,7 @@ test("J2-install: a release installed through the shipped collection-profile pat
       assert.equal(aDevice.terminal_coverage.verdict, "covered");
       assert.equal(aDevice.lifecycle_state, "covered");
       const aReceipts = deviceReceiptFacts(lane);
+      assertJourneyStreams(aReceipts);
       assert.equal(
         aReceipts.length,
         2,
@@ -1056,8 +1092,10 @@ test("J2-install: a release installed through the shipped collection-profile pat
       assert.equal(bBefore.lifecycle_state, "coverage_not_current");
       // No A proof is relabelled as B: the device still holds only A's receipt, and the server still
       // records run A as A.
+      const unchangedReceipts = deviceReceiptFacts(lane);
+      assertJourneyStreams(unchangedReceipts);
       assert.ok(
-        deviceReceiptFacts(lane).every(
+        unchangedReceipts.every(
           (fact) => fact.artifact_digest === pinA.digest,
         ),
         "the device receipt still names release A",
@@ -1092,6 +1130,7 @@ test("J2-install: a release installed through the shipped collection-profile pat
       assert.equal(bDevice.terminal_coverage.verdict, "covered");
       assert.equal(bDevice.lifecycle_state, "covered");
       const bReceipts = deviceReceiptFacts(lane);
+      assertJourneyStreams(bReceipts);
       assert.equal(
         bReceipts.length,
         2,

From 681291d4be474ef712aaa3d53b93284d0b635272 Mon Sep 17 00:00:00 2001
From: Tim Nunamaker <tnunamak@gmail.com>
Date: Thu, 22 Oct 2026 07:57:06 -0500
Subject: [PATCH 34/87] feat(collector): commit a terminal run record for every
 successful run

A runtime that implements the collection profile's store-evidence version
now commits an orderable terminal run record for every run whose DONE
succeeded. Before, a run that negotiated no coverage and changed no STATE
sent nothing, and a run with only STATE sent a plain checkpoint. The
server could not order either against an earlier coverage proof.

Without coverage evidence the record is a version 2 commit with empty
terminal_facts that carries the run's STATE delta. The server stores
unknown coverage for it, and the device clears its receipt. Two cases
keep the plain checkpoint: a server that names no connection on its state
read, and a run id whose terminal record is already in the outbox (one
run identity carries one record).

The fake device servers in the runtime and local-collector tests now
acknowledge terminal records and apply their state delta, as the reference
server does.

Assisted-by: AI
Signed-off-by: Tim Nunamaker <tnunamak@gmail.com>
---
 .../src/collector-runner.test.ts              | 239 ++++++++++++++----
 .../collector-runtime/src/collector-runner.ts |  28 ++
 packages/local-collector/test/runner.test.ts  |  29 ++-
 3 files changed, 237 insertions(+), 59 deletions(-)

diff --git a/packages/collector-runtime/src/collector-runner.test.ts b/packages/collector-runtime/src/collector-runner.test.ts
index ae375a4e7..56f21f91d 100644
--- a/packages/collector-runtime/src/collector-runner.test.ts
+++ b/packages/collector-runtime/src/collector-runner.test.ts
@@ -986,6 +986,105 @@ for (const includeState of [false, true]) {
   });
 }
 
+// A runtime implementing this profile version commits an orderable terminal
+// run record for every successful run, negotiated or not, with or without
+// STATE. Without negotiated coverage it carries no evidence (version 2, empty
+// facts), which the server stores as unknown and which retires earlier proof.
+for (const includeState of [false, true]) {
+  test(`an unnegotiated successful run commits a no-evidence terminal record ${includeState ? "with" : "without"} STATE`, async () => {
+    const harness = await startCollectorHarness({ priorState: {} });
+    try {
+      const fixture = await writeFixtureConnector({
+        script: `
+          await new Promise((resolve) => {
+            let input = "";
+            process.stdin.on("data", (chunk) => { input += chunk; if (input.includes("\\n")) resolve(); });
+          });
+          ${includeState ? 'process.stdout.write(JSON.stringify({ type: "STATE", stream: "messages", cursor: "run-b" }) + "\\n");' : ""}
+          process.stdout.write(JSON.stringify({ type: "DONE", status: "succeeded", records_emitted: 0 }) + "\\n");
+        `,
+      });
+      const result = await runCollectorConnector({
+        baseUrl: harness.url,
+        connector: {
+          args: [fixture],
+          command: "node",
+          connector_id: "fixture-unnegotiated-terminal-record",
+          protocol_capabilities: [],
+          runtime_requirements: { bindings: {} },
+          streams: ["messages"],
+        },
+        deviceId: "device-1",
+        deviceToken: "device-token",
+        executionRoot: TEST_EXECUTION_ROOT,
+        queuePath: await tempQueuePath(),
+        runId: "run-b-unnegotiated",
+        sourceInstanceId: "src-unnegotiated-terminal-record",
+      });
+      assert.equal(result.done?.status, "succeeded");
+      assert.equal(harness.terminalCommits.length, 1, "every successful run commits one terminal run record");
+      const record = harness.terminalCommits[0] as unknown as TerminalRunCommitRequest;
+      assert.equal(record.run_id, "run-b-unnegotiated");
+      assert.equal(record.version, 2);
+      assert.deepEqual(record.terminal_facts, [], "an unnegotiated run carries no coverage evidence");
+      assert.deepEqual(record.state_delta, includeState ? { messages: "run-b" } : {});
+      assert.deepEqual(
+        harness.stateOps.filter((op) => op.method === "PUT"),
+        [],
+        "STATE travels in the terminal record, not a separate checkpoint"
+      );
+    } finally {
+      await harness.close();
+    }
+  });
+}
+
+// A caller may reuse one run id across passes (for example a fixed
+// PDPP_RUN_ID). The server binds one terminal record to one run identity, so a
+// second pass of the same run must not send a second, different record.
+test("a pass that reuses an acknowledged run id commits no second terminal record", async () => {
+  const harness = await startCollectorHarness({ priorState: {} });
+  try {
+    const passScript = (emitState: boolean) => `
+      await new Promise((resolve) => {
+        let input = "";
+        process.stdin.on("data", (chunk) => { input += chunk; if (input.includes("\\n")) resolve(); });
+      });
+      ${emitState ? 'process.stdout.write(JSON.stringify({ type: "STATE", stream: "messages", cursor: "pass-1" }) + "\\n");' : ""}
+      process.stdout.write(JSON.stringify({ type: "DONE", status: "succeeded", records_emitted: 0 }) + "\\n");
+    `;
+    const withState = await writeFixtureConnector({ script: passScript(true) });
+    const withoutState = await writeFixtureConnector({ script: passScript(false) });
+    const queuePath = await tempQueuePath();
+    const config = (fixture: string) => ({
+      baseUrl: harness.url,
+      connector: {
+        args: [fixture],
+        command: "node",
+        connector_id: "fixture-reused-run-id",
+        protocol_capabilities: [],
+        runtime_requirements: { bindings: {} },
+        streams: ["messages"],
+      },
+      deviceId: "device-1",
+      deviceToken: "device-token",
+      executionRoot: TEST_EXECUTION_ROOT,
+      queuePath,
+      runId: "run-reused",
+      sourceInstanceId: "src-reused-run-id",
+    });
+    const first = await runCollectorConnector(config(withState));
+    assert.equal(first.statePutFailed, false);
+    // The second pass of the same run differs from the first, so its record
+    // would be a second, conflicting record for one run identity.
+    const second = await runCollectorConnector(config(withoutState));
+    assert.equal(second.statePutFailed, false);
+    assert.equal(harness.terminalCommits.length, 1, "one run identity carries one terminal record");
+  } finally {
+    await harness.close();
+  }
+});
+
 for (const effectType of ["DETAIL_GAP", "DETAIL_COVERAGE"] as const) {
   test(`runCollectorConnector refuses ${effectType} without durable detail accounting`, async () => {
     const harness = await startCollectorHarness({ priorState: {} });
@@ -1301,7 +1400,7 @@ test("runCollectorConnector rejects failed terminal DONE, preserves records, and
     try {
       const items = outbox.list({ sourceInstanceId: "src-failed-done" });
       assert.equal(items.filter((item) => item.kind === "record_batch").length, 1);
-      assert.equal(items.filter((item) => item.kind === "checkpoint").length, 0);
+      assert.equal(items.filter((item) => item.kind === "checkpoint" || item.kind === "terminal_run_commit").length, 0);
       assert.equal(items.filter((item) => item.kind === "gap").length, 1);
     } finally {
       outbox.close();
@@ -1347,7 +1446,9 @@ test("runCollectorConnector rejects a zero-exit child without DONE and never che
     const outbox = new LocalDeviceOutbox({ path: queuePath });
     try {
       assert.equal(
-        outbox.list({ sourceInstanceId: "src-missing-done" }).filter((item) => item.kind === "checkpoint").length,
+        outbox
+          .list({ sourceInstanceId: "src-missing-done" })
+          .filter((item) => item.kind === "checkpoint" || item.kind === "terminal_run_commit").length,
         0
       );
       assert.equal(
@@ -1396,7 +1497,7 @@ test("checkpoint PUT failure keeps the committed-run cursor durable and a later
     });
     assert.equal(failed.statePutFailed, true);
     assert.equal(failed.flushedState, null);
-    assert.ok(failedHarness.stateOps.filter((operation) => operation.method === "PUT").length >= 1);
+    assert.equal(failedHarness.terminalCommits.length, 0, "the state write failed, so no terminal record committed");
   } finally {
     await failedHarness.close();
   }
@@ -1421,11 +1522,9 @@ test("checkpoint PUT failure keeps the committed-run cursor durable and a later
       sourceInstanceId: "src-checkpoint-put-failure",
     });
     assert.equal(recovered.statePutFailed, false);
-    const puts = recoveredHarness.stateOps.filter((operation) => operation.method === "PUT");
-    assert.ok(puts.length >= 1, "the later runner must commit the durable predecessor checkpoint");
-    assert.deepEqual(puts[0]?.body, {
-      state: { messages: "cursor-after-put-failure" },
-    });
+    const commits = recoveredHarness.terminalCommits as unknown as TerminalRunCommitRequest[];
+    assert.ok(commits.length >= 1, "the later runner must commit the durable predecessor checkpoint");
+    assert.deepEqual(commits[0]?.state_delta, { messages: "cursor-after-put-failure" });
   } finally {
     await recoveredHarness.close();
   }
@@ -1451,12 +1550,13 @@ test("runCollectorConnector auto-prunes over-retention succeeded rows after a cl
       script: ONE_RECORD_CONNECTOR_SCRIPT,
     });
     const baseConfig = {
-      // Keep only the single most-recent succeeded row. The bound is count-only
-      // — no age floor — so even the second pass's freshly-acknowledged batch
-      // makes pass 1's batch eligible the instant it falls outside the recent
-      // set. (v1 needed a `keepWithinDays: 0` age trick here; the corrected
-      // count-only bound does not.)
-      autoPrune: { keepRecentCount: 1 },
+      // Keep only the two most-recent succeeded rows: one pass's batch and its
+      // terminal run record. The bound is count-only — no age floor — so the
+      // second pass's freshly-acknowledged rows make pass 1's rows eligible the
+      // instant they fall outside the recent set. (v1 needed a
+      // `keepWithinDays: 0` age trick here; the corrected count-only bound does
+      // not.)
+      autoPrune: { keepRecentCount: 2 },
       baseUrl: harness.url,
       connector: {
         args: [fixture],
@@ -1476,31 +1576,31 @@ test("runCollectorConnector auto-prunes over-retention succeeded rows after a cl
     const pass1 = await runCollectorConnector(baseConfig);
     assert.equal(pass1.done?.status, "succeeded");
     assert.equal(pass1.prunedSent.enabled, true);
-    // Pass 1 left exactly one acknowledged batch, which is inside keepRecentCount.
+    // Pass 1 left one acknowledged batch and its terminal run record, inside keepRecentCount.
     assert.equal(pass1.prunedSent.pruned, 0);
     // The returned summary reflects the post-prune state.
-    assert.equal(pass1.outboxSummary.succeeded, 1);
+    assert.equal(pass1.outboxSummary.succeeded, 2);
 
     const pass2 = await runCollectorConnector(baseConfig);
     assert.equal(pass2.done?.status, "succeeded");
     assert.equal(pass2.prunedSent.enabled, true);
-    // Pass 2 acknowledges a second batch; keepRecentCount=1 keeps it and prunes
-    // pass 1's batch — regardless of how recently pass 1 was acknowledged.
-    assert.equal(pass2.prunedSent.pruned, 1);
-    // The returned summary is post-prune: one row retained, not two.
-    assert.equal(pass2.outboxSummary.succeeded, 1);
+    // Pass 2 acknowledges a second batch and record; keepRecentCount=2 keeps them
+    // and prunes pass 1's rows — regardless of how recently pass 1 was acknowledged.
+    assert.equal(pass2.prunedSent.pruned, 2);
+    // The returned summary is post-prune: two rows retained, not four.
+    assert.equal(pass2.outboxSummary.succeeded, 2);
 
     // The final heartbeat the server received must also carry the post-prune
     // succeeded count, not the stale pre-prune tail.
     const lastHeartbeat = harness.heartbeats.at(-1);
-    assert.equal((lastHeartbeat?.outbox as { succeeded?: number } | undefined)?.succeeded, 1);
+    assert.equal((lastHeartbeat?.outbox as { succeeded?: number } | undefined)?.succeeded, 2);
 
     const outbox = new LocalDeviceOutbox({ path: queuePath });
     try {
       assert.equal(
         outbox.summary({ sourceInstanceId: "src-auto-prune" }).succeeded,
-        1,
-        "exactly the most-recent succeeded row is retained"
+        2,
+        "exactly the most-recent pass's succeeded rows are retained"
       );
     } finally {
       outbox.close();
@@ -1595,8 +1695,8 @@ test("runCollectorConnector leaves succeeded rows intact when auto-prune is disa
     try {
       assert.equal(
         outbox.summary({ sourceInstanceId: "src-prune-disabled" }).succeeded,
-        2,
-        "both acknowledged batches are retained when prune is disabled"
+        4,
+        "both passes' acknowledged batches and terminal records are retained when prune is disabled"
       );
     } finally {
       outbox.close();
@@ -1614,7 +1714,7 @@ test("runCollectorConnector under the default policy retains a clean run's ackno
       script: ONE_RECORD_CONNECTOR_SCRIPT,
     });
     // No autoPrune override → default policy (keep the most-recent 10,000).
-    // A single clean run's one acknowledged batch is well inside the cap.
+    // A single clean run's acknowledged batch and terminal record are well inside the cap.
     const result = await runCollectorConnector({
       baseUrl: harness.url,
       connector: {
@@ -1636,7 +1736,7 @@ test("runCollectorConnector under the default policy retains a clean run's ackno
 
     const outbox = new LocalDeviceOutbox({ path: queuePath });
     try {
-      assert.equal(outbox.summary({ sourceInstanceId: "src-default-prune" }).succeeded, 1);
+      assert.equal(outbox.summary({ sourceInstanceId: "src-default-prune" }).succeeded, 2);
     } finally {
       outbox.close();
     }
@@ -2316,14 +2416,16 @@ test("runCollectorConnector replays prior STATE into the connector's START.state
     const [ingest] = harness.ingestedBatches;
     assert.equal(ingest?.records?.[0]?.data?.prior_cursor, "m-prior");
 
-    // State was GET before ingest and PUT after.
+    // State was read before ingest and committed after, inside the run's terminal record.
     const { stateOps } = harness;
     assert.equal(stateOps[0]?.method, "GET");
-    const lastOp = stateOps.at(-1);
-    assert.equal(lastOp?.method, "PUT");
-    assert.deepEqual(lastOp?.body, {
-      state: { messages: "m-next" },
-    });
+    assert.deepEqual(
+      stateOps.filter((op) => op.method === "PUT"),
+      [],
+      "no separate checkpoint PUT"
+    );
+    const [commit] = harness.terminalCommits as unknown as TerminalRunCommitRequest[];
+    assert.deepEqual(commit?.state_delta, { messages: "m-next" });
   } finally {
     await harness.close();
   }
@@ -2452,6 +2554,7 @@ test("runCollectorConnector does not checkpoint when record work dead-letters",
     assert.equal(result.flushedState, null);
     assert.equal(result.outboxSummary.deadLetter, 1);
     assert.equal(harness.stateOps.filter((op) => op.method === "PUT").length, 0);
+    assert.equal(harness.terminalCommits.length, 0);
     const blockedHeartbeat = harness.heartbeats.at(-1);
     assert.equal(blockedHeartbeat?.status, "blocked");
     const lastError = heartbeatLastError(blockedHeartbeat?.last_error);
@@ -2510,10 +2613,10 @@ test("runCollectorConnector drops out-of-scope STATE messages with a warning and
     });
 
     assert.deepEqual(result.flushedState, { messages: "m-1" });
-    const putOps = harness.stateOps.filter((op) => op.method === "PUT");
-    assert.equal(putOps.length, 1);
-    // The persisted body must not include the rogue stream.
-    assert.deepEqual(putOps[0]?.body, { state: { messages: "m-1" } });
+    const commits = harness.terminalCommits as unknown as TerminalRunCommitRequest[];
+    assert.equal(commits.length, 1);
+    // The persisted state must not include the rogue stream.
+    assert.deepEqual(commits[0]?.state_delta, { messages: "m-1" });
   } finally {
     await harness.close();
   }
@@ -3450,8 +3553,17 @@ async function startCollectorHarness(options: CollectorHarnessOptions): Promise<
     }
     if (url.includes("/terminal-run-commits")) {
       const commit = (parsed && typeof parsed === "object" ? parsed : {}) as Record<string, unknown>;
-      terminalCommits.push(commit);
       const request = commit as unknown as TerminalRunCommitRequest;
+      const stateDelta = isPlainObject(request.state_delta) ? request.state_delta : {};
+      // A terminal run commit writes its state delta in the same transaction,
+      // as the reference server does, so a failing state write fails it.
+      if (Object.keys(stateDelta).length > 0 && options.stateWriteStatus && options.stateWriteStatus >= 400) {
+        res.writeHead(options.stateWriteStatus, { "content-type": "application/json" });
+        res.end(JSON.stringify({ error: { code: "synthetic_state_write_failure" } }));
+        return;
+      }
+      terminalCommits.push(commit);
+      persistedState = { ...persistedState, ...stateDelta };
       sendJson(res, 200, {
         commit_id: request.commit_id,
         envelope_hash: hashCanonicalJson(canonicalTerminalRunCommitEnvelope(request)),
@@ -4120,23 +4232,26 @@ test("runCollectorConnector defers checkpoint until every streamed record batch
     assert.equal(result.sentBatches, 0);
     assert.equal(result.flushedState, null);
     assert.equal(result.statePutFailed, false);
-    // Three durable record_batch rows plus one deferred checkpoint must
-    // remain in the outbox. With the backoff override, only the record
-    // rows are in the retrying subset.
+    // Three durable record_batch rows plus one deferred terminal run record
+    // (carrying the checkpoint) must remain in the outbox. With the backoff
+    // override, only the record rows are in the retrying subset.
     assert.equal(result.outboxSummary.ready, 4);
     assert.equal(result.outboxSummary.retrying, 3);
     assert.equal(result.outboxSummary.deadLetter, 0);
     const verify = new LocalDeviceOutbox({ path: queuePath });
     try {
-      const checkpointRows = verify.list({ sourceInstanceId: "src-1" }).filter((item) => item.kind === "checkpoint");
+      const checkpointRows = verify
+        .list({ sourceInstanceId: "src-1" })
+        .filter((item) => item.kind === "terminal_run_commit");
       assert.equal(checkpointRows.length, 1, "completed scan checkpoint must be durable even while records retry");
       assert.equal(checkpointRows[0]?.status, "ready");
     } finally {
       verify.close();
     }
-    // Server saw no checkpoint PUT — the durable checkpoint must not be
-    // sent before the record batches it summarizes are acknowledged.
+    // Server saw no checkpoint — the durable checkpoint must not be sent
+    // before the record batches it summarizes are acknowledged.
     assert.equal(harness.stateOps.filter((op) => op.method === "PUT").length, 0);
+    assert.equal(harness.terminalCommits.length, 0);
   } finally {
     await harness.close();
   }
@@ -4302,15 +4417,18 @@ test("runCollectorConnector persists complete-scan checkpoint across undrained b
     assert.equal(pass1.enqueuedBatches, 3);
     assert.equal(pass1.flushedState, null);
     assert.equal(harness.stateOps.filter((op) => op.method === "PUT").length, 0);
+    assert.equal(harness.terminalCommits.length, 0);
 
     const afterPass1 = new LocalDeviceOutbox({ path: queuePath });
     try {
       const items = afterPass1.list({ sourceInstanceId: "src-1" });
       assert.equal(items.filter((item) => item.kind === "record_batch").length, 3);
-      const checkpoints = items.filter((item) => item.kind === "checkpoint");
+      const checkpoints = items.filter((item) => item.kind === "terminal_run_commit");
       assert.equal(checkpoints.length, 1);
       assert.equal(checkpoints[0]?.status, "ready");
-      assert.deepEqual((checkpoints[0]?.payload as { state?: unknown } | undefined)?.state, { messages: "m-30" });
+      assert.deepEqual((checkpoints[0]?.payload as { state_delta?: unknown } | undefined)?.state_delta, {
+        messages: "m-30",
+      });
     } finally {
       afterPass1.close();
     }
@@ -4352,7 +4470,7 @@ test("runCollectorConnector persists complete-scan checkpoint across undrained b
     const pass2DataEvents = pass2Events.filter((event) => event !== "heartbeat");
     assert.deepEqual(
       pass2DataEvents.slice(0, 5),
-      ["ingest:ok", "ingest:ok", "ingest:ok", "state:PUT", "state:GET"],
+      ["ingest:ok", "ingest:ok", "ingest:ok", "terminal:commit", "state:GET"],
       `expected pass 2 to drain records, then checkpoint, then read state; saw ${pass2Events.join(",")}`
     );
   } finally {
@@ -4421,7 +4539,7 @@ test("runCollectorConnector leaves streamed batches durable when the child fails
       const items = outbox.list({ sourceInstanceId: "src-1" });
       // No checkpoint row was enqueued because STATE never reached the runner.
       assert.equal(
-        items.filter((item) => item.kind === "checkpoint").length,
+        items.filter((item) => item.kind === "checkpoint" || item.kind === "terminal_run_commit").length,
         0,
         "checkpoint must not be enqueued when child fails mid-stream"
       );
@@ -4436,6 +4554,7 @@ test("runCollectorConnector leaves streamed batches durable when the child fails
       outbox.close();
     }
     assert.equal(harness.stateOps.filter((op) => op.method === "PUT").length, 0);
+    assert.equal(harness.terminalCommits.length, 0);
   } finally {
     await harness.close();
   }
@@ -5053,7 +5172,7 @@ test("runCollectorConnector flushes a partial trailing batch when the child fail
       assert.equal(totalRecords, 27, `expected all 27 parsed records durable, got ${totalRecords}`);
       // No checkpoint row was enqueued because STATE never reached the runner.
       assert.equal(
-        items.filter((item) => item.kind === "checkpoint").length,
+        items.filter((item) => item.kind === "checkpoint" || item.kind === "terminal_run_commit").length,
         0,
         "checkpoint must not be enqueued when child fails mid-stream"
       );
@@ -5061,6 +5180,7 @@ test("runCollectorConnector flushes a partial trailing batch when the child fail
       outbox.close();
     }
     assert.equal(harness.stateOps.filter((op) => op.method === "PUT").length, 0);
+    assert.equal(harness.terminalCommits.length, 0);
   } finally {
     await harness.close();
   }
@@ -5189,6 +5309,10 @@ test("runCollectorConnector recovers a stale-leased record batch and drains it w
       const recovered = items.find((item) => item.id === staleBatchId);
       assert.equal(recovered?.status, "succeeded", "the recovered batch must be marked succeeded");
       assert.equal(items.filter((item) => item.kind === "checkpoint").length, 0);
+      // The pass still commits its own terminal run record, with no state on top of the recovered batch.
+      const terminalRecords = items.filter((item) => item.kind === "terminal_run_commit");
+      assert.equal(terminalRecords.length, 1);
+      assert.deepEqual((terminalRecords[0]?.payload as { state_delta?: unknown } | undefined)?.state_delta, {});
     } finally {
       after.close();
     }
@@ -5499,13 +5623,17 @@ test("runCollectorConnector drains a prior pass's enqueued backlog before scanni
     const pass2DataEvents = pass2Events.filter((event) => event !== "heartbeat");
     assert.deepEqual(
       pass2DataEvents.slice(0, 5),
-      ["ingest:ok", "ingest:ok", "ingest:ok", "state:PUT", "state:GET"],
+      ["ingest:ok", "ingest:ok", "ingest:ok", "terminal:commit", "state:GET"],
       `expected pass 2 to drain backlog and checkpoint before state read; saw ${pass2Events.join(",")}`
     );
     assert.deepEqual(pass2.priorState, { messages: "m-30" });
-    // Pass-2 child emitted no STATE of its own, so no new checkpoint
-    // PUT happens after the pre-scan durable checkpoint is flushed.
-    assert.equal(pass2.flushedState, null);
+    // Pass-2 child emitted no STATE of its own, so its own terminal record
+    // carries an empty state delta after the pre-scan checkpoint is flushed.
+    assert.deepEqual(pass2.flushedState, {});
+    assert.deepEqual(
+      (harness.terminalCommits.at(-1) as unknown as TerminalRunCommitRequest | undefined)?.state_delta,
+      {}
+    );
   } finally {
     await harness.close();
   }
@@ -5850,9 +5978,12 @@ async function startTogglableHarness(options: {
       return;
     }
     if (url.includes("/terminal-run-commits")) {
+      events.push({ label: "terminal:commit" });
       const commit = (parsed && typeof parsed === "object" ? parsed : {}) as Record<string, unknown>;
       terminalCommits.push(commit);
       const request = commit as unknown as TerminalRunCommitRequest;
+      // The commit writes its state delta, as the reference server does.
+      persistedState = { ...persistedState, ...(isPlainObject(request.state_delta) ? request.state_delta : {}) };
       sendJson(res, 200, {
         commit_id: request.commit_id,
         envelope_hash: hashCanonicalJson(canonicalTerminalRunCommitEnvelope(request)),
diff --git a/packages/collector-runtime/src/collector-runner.ts b/packages/collector-runtime/src/collector-runner.ts
index b40db402c..889eaf16b 100644
--- a/packages/collector-runtime/src/collector-runner.ts
+++ b/packages/collector-runtime/src/collector-runner.ts
@@ -1084,6 +1084,20 @@ export async function runCollectorConnector(config: CollectorRunConfig): Promise
       terminalEvidence = { facts: typedTerminalFacts, version: 2 };
     } else if (legacyTerminalFacts) {
       terminalEvidence = { facts: legacyTerminalFacts, version: 1 };
+    } else if (
+      done?.status === "succeeded" &&
+      priorStateProjection.connectorInstanceId &&
+      !hasTerminalRecordForRun(outbox, config)
+    ) {
+      // This profile version commits an orderable terminal run record for every
+      // successful run, whether or not coverage was negotiated and whether or
+      // not STATE changed. Without evidence the record carries no facts: the
+      // server stores unknown coverage for the run and retires any earlier
+      // proof, and the device clears its receipt. A server that names no
+      // connection on its state read cannot bind a terminal record, and a run
+      // id that already has one is a continuation of that run; both keep the
+      // plain state checkpoint.
+      terminalEvidence = { facts: [], version: 2 };
     }
     const checkpointResult = await maybeCommitCheckpoint({
       afterRecordsSummary,
@@ -2171,6 +2185,20 @@ type TerminalEvidence =
   | { facts: readonly TerminalCollectionFact[]; version: 1 }
   | { facts: readonly TerminalCoverageFact[]; version: 2 };
 
+/**
+ * The server binds one terminal record to one run identity. A caller that
+ * reuses a run id across passes already has that record in the outbox, so a
+ * later pass of the same run must not send a second, different one.
+ */
+function hasTerminalRecordForRun(outbox: LocalDeviceOutbox, config: CollectorRunConfig): boolean {
+  if (!config.runId) {
+    return false;
+  }
+  return outbox
+    .listByKind({ kind: "terminal_run_commit", sourceInstanceId: config.sourceInstanceId })
+    .some((item) => isRecord(item.payload) && item.payload.run_id === config.runId);
+}
+
 async function maybeCommitCheckpoint(input: {
   afterRecordsSummary: LocalDeviceOutboxSummary;
   bufferedState: Readonly<Record<string, unknown>>;
diff --git a/packages/local-collector/test/runner.test.ts b/packages/local-collector/test/runner.test.ts
index 677cfdb9c..970f1d620 100644
--- a/packages/local-collector/test/runner.test.ts
+++ b/packages/local-collector/test/runner.test.ts
@@ -11,7 +11,9 @@ import { dirname, join } from "node:path";
 import { DatabaseSync } from "node:sqlite";
 import { after, test } from "node:test";
 import { DEFAULT_COLLECTOR_OUTBOX_POLICY, drainCollectorOutbox } from "@pdpp/collector-runtime/collector-runner";
-import { LocalDeviceClient } from "@pdpp/collector-runtime/local-device-client";
+import { hashCanonicalJson } from "@pdpp/collector-runtime";
+import { LocalDeviceClient, type TerminalRunCommitRequest } from "@pdpp/collector-runtime/local-device-client";
+import { canonicalTerminalRunCommitEnvelope } from "@pdpp/collector-runtime/local-device-envelope";
 import {
   // The concrete bundled-connector registry is assembled at the composition
   // root (the bin) from connector-owned definitions; the src runtime is
@@ -3086,7 +3088,7 @@ test("an unrecovered failure gap delivered by an independent drain leaves the la
   assert.notEqual(status.lifecycle_state, "covered");
 });
 
-test("a following successful pass without coverage evidence leaves a delivered failure gap unadmitted", async () => {
+test("a following successful pass without coverage evidence leaves a delivered failure gap unrecovered and the lane not covered", async () => {
   const path = await tempOutboxPath();
   const outbox = new LocalDeviceOutbox({ path });
   let gapId = "";
@@ -3108,8 +3110,8 @@ test("a following successful pass without coverage evidence leaves a delivered f
     await gapServer.close();
   }
 
-  // A pass that succeeds without negotiating coverage commits no terminal
-  // evidence, so it neither replaces the receipt nor recovers the gap.
+  // A pass that succeeds without negotiating coverage commits a terminal run
+  // record with no evidence. It clears the receipt but recovers no gap.
   const previous = process.env[ALLOW_CUSTOM_COMMAND_ENV];
   process.env[ALLOW_CUSTOM_COMMAND_ENV] = "1";
   const server = await startAcceptingDeviceServer();
@@ -3150,8 +3152,9 @@ test("a following successful pass without coverage evidence leaves a delivered f
   } finally {
     after.close();
   }
+  // The pass's own no-evidence terminal record replaced run A's covered receipt.
   const status = statusFor(path);
-  assert.equal(status.terminal_coverage.verdict, "unadmitted");
+  assert.equal(status.terminal_coverage.verdict, "no_evidence");
   assert.notEqual(status.lifecycle_state, "covered");
 });
 
@@ -4030,6 +4033,7 @@ async function startAcceptingDeviceServer(): Promise<{ close: () => Promise<void
         res.writeHead(200, { "content-type": "application/json" });
         res.end(
           JSON.stringify({
+            connector_instance_id: "cin-1",
             device_id: "device-1",
             object: "device_source_instance_state",
             source_instance_id: "src-1",
@@ -4052,6 +4056,21 @@ async function startAcceptingDeviceServer(): Promise<{ close: () => Promise<void
         );
         return;
       }
+      if (url.includes("/terminal-run-commits")) {
+        // Every successful pass commits a terminal run record; acknowledge it as the server does.
+        const request = JSON.parse(body || "{}") as TerminalRunCommitRequest;
+        res.writeHead(201, { "content-type": "application/json" });
+        res.end(
+          JSON.stringify({
+            commit_id: request.commit_id,
+            envelope_hash: hashCanonicalJson(canonicalTerminalRunCommitEnvelope(request)),
+            object: "device_terminal_run_commit",
+            run_id: request.run_id,
+            terminal_event_id: `evt-${request.run_id}`,
+          })
+        );
+        return;
+      }
       res.writeHead(200, { "content-type": "application/json" });
       res.end(JSON.stringify({ ok: true }));
     });

From 4f25632d50c5cbcdff7f1c63227e51afb8856ce5 Mon Sep 17 00:00:00 2001
From: Tim Nunamaker <tnunamak@gmail.com>
Date: Thu, 22 Oct 2026 07:57:15 -0500
Subject: [PATCH 35/87] feat(coverage): fence local coverage proofs with a
 collection revision

The server decided whether a local coverage proof was still current by
comparing the newest connector_state updated_at with the proof's commit
time. Equal timestamps do not identify a transaction, and a skewed clock
orders a later commit before an earlier one. A refused batch or a
delivered failure report did not retire the proof at all.

The server now assigns a monotonic per-connection revision at commit to
every event it observes that can establish or retire proof: a state
commit, a terminal run record, an admitted batch, a refused batch, and a
delivered failure report. connector_instances holds the high-water mark
(revision, event kind, run id, time). connector_state rows record the
revision of the commit that wrote them, and the terminal run record
carries its own. A proof is current only while its revision is the
high-water mark; the projection reads the proof run by the run id that the
mark names, not by completion time. A missing, NULL or ambiguous revision
is unknown, including a newer settled run record that carries none.
Columns are added for SQLite and Postgres.

Every owner list and detail row that shows local coverage now carries
coverage_as_of: run id, release digest, revision and commit time.

A version 2 record with no facts is accepted without a registered
manifest, because it makes no claim.

Tests: rewritten stale-proof suite (equal-timestamp, clock rollback,
skewed-ahead, newer-proof-earlier-clock, fail-closed, as-of), journey cases
for a refused batch, a delivered failure report and unnegotiated runs with
and without STATE, and a Postgres fence test. Legacy fixtures that insert
coverage_diagnostics rows now stamp a revision.

Assisted-by: AI
Signed-off-by: Tim Nunamaker <tnunamak@gmail.com>
---
 docs/261021-local-device-coverage-evidence.md |  32 +-
 .../local-device-terminal-collection.ts       |  35 ++-
 .../scripts/postgres-template-eligibility.ts  |   2 +-
 reference-implementation/server/db.ts         |  15 +
 .../server/postgres-storage.ts                |  12 +
 ...upsert-connector-state-with-generation.sql |   7 +-
 reference-implementation/server/records.ts    |  79 +----
 .../server/ref-control.ts                     | 220 ++++++++++---
 .../server/routes/ref-device-exporters.ts     |  49 +++
 .../stores/collection-revision-store.ts       | 292 ++++++++++++++++++
 .../server/stores/connector-state-store.ts    | 101 ++++--
 .../server/stores/run-history-writer.ts       |   4 +
 .../stores/terminal-run-commit-store.ts       |  39 ++-
 .../test/helpers/install-path-fixture.ts      |  12 +
 .../local-device-coverage-journey.test.ts     | 194 ++++++++++--
 .../local-device-coverage-stale-proof.test.ts | 263 ++++++++++++----
 ...ice-coverage-state-commit-postgres.test.ts | 160 +++++++---
 ...device-required-stream-proof-scope.test.ts |  14 +-
 ...ef-connectors-local-coverage-green.test.ts |  14 +-
 19 files changed, 1268 insertions(+), 276 deletions(-)
 create mode 100644 reference-implementation/server/stores/collection-revision-store.ts

diff --git a/docs/261021-local-device-coverage-evidence.md b/docs/261021-local-device-coverage-evidence.md
index 8ee88d7ab..e2a2e082e 100644
--- a/docs/261021-local-device-coverage-evidence.md
+++ b/docs/261021-local-device-coverage-evidence.md
@@ -38,7 +38,7 @@ The collector stores the latest acknowledged v2 receipt in local outbox schema v
 
 The device verdict (`pdpp-local-collector status`, `terminal_coverage.verdict`) is `covered` only when the receipt names the selected release, every store is `collected`, and the run's runtime accounting is clean: durable admission, complete detail, consistent stream evidence, checkpoint eligibility, and zero outstanding debt. Clean accounting is the same test the server applies before it withholds `collected`. Missing or malformed accounting reads `no_evidence`; a measured gap reads `incomplete`. Open outbox work for the lane (queued, leased or dead-lettered) reads `unadmitted`, because the latest run has not reached a durable terminal commit and the receipt no longer stands for it.
 
-The server's owner coverage is "as of the last admitted run". A later run the server never admitted cannot change it. Every failed run, including one that fails before its scan, leaves an open `connector_child_failure` gap on the device, so the device shows that run as `unadmitted` until a later complete run is admitted and recovers the gap. Until then the owner projection keeps the last admitted coverage.
+The server's owner coverage is a fact about one admitted run, shown with its as-of. Any later attempt the server observes (a state commit, a terminal run record, an admitted or refused batch, a delivered failure report) retires it to unknown; see "Revision fencing" below. Only an attempt the server never hears about leaves the last admitted coverage in place. Every failed run, including one that fails before its scan, leaves an open `connector_child_failure` gap on the device, so the device shows that run as `unadmitted` until a later complete run is admitted and recovers the gap.
 
 ## Collection Profile amendment
 
@@ -47,3 +47,33 @@ The canonical Collection Profile is `data-connectors/docs/spec/collection-profil
 ## Acceptance and release
 
 Failing-first tests must show absent coverage unknown, a valid fully drained proof covered, partial/unavailable/failed not covered, malformed rejected or unknown, and old devices still working. Verify connector emitters, collector checkpointing, server validation, and both read models. Bump the five connector manifest patch versions and regenerate connector-implementation-index.json. PR #553 then repins the five signed releases and their verified hashes.
+
+## Revision fencing (replaces the wall-clock stale-proof rule)
+
+The spec gate replaced the server's wall-clock rule (MAX `connector_state.updated_at` compared with the proof instant) with a monotonic per-connection revision. Equal timestamps do not identify a transaction, and a skewed clock can order a later commit before an earlier one. The revision follows the Core restore-safety fencing principle: retire by revision comparison only.
+
+Events that get a revision. The server assigns the next revision inside the transaction of each event it can observe for an authorized connection:
+
+| Event | Kind | Where |
+| --- | --- | --- |
+| Owner-scoped state write that touches a non-`$` stream | `state_commit` | connector-state store, PUT state route |
+| Terminal run commit (v1 or v2), with its own state delta | `terminal_run` | terminal-run-commit store |
+| New ingest batch admitted (not a replay of an admitted batch) | `batch_accepted` | device ingest route |
+| Ingest batch received and refused (4xx after device authorization) | `batch_rejected` | device ingest route |
+| Failure report received (`connector_child_failure` or `policy_budget` gap) | `failure_report` | local-collector-gaps route |
+
+Server-owned `$` scope rows, heartbeats, gap recoveries, grant-scoped state, and the legacy split `terminal-collection` report get no revision. They neither establish nor retire proof. The legacy split report follows its own state commit, which already has a revision; its run record is labelled with the current revision so that the projection can order it.
+
+Storage. `connector_instances` holds the high-water mark: `collection_revision` (0 before any event), `collection_revision_event`, `collection_revision_run_id`, and `collection_revision_at` (wall-clock, display only). `connector_state.collection_revision` records the revision of the commit that last wrote each row. The terminal run event, and so `run_history.facts_json`, carries `collection_revision`. SQLite adds the columns with `addColumnIfMissing`; Postgres uses `ALTER TABLE ... ADD COLUMN IF NOT EXISTS`. Rows that predate the migration read NULL and fail closed.
+
+Proof binding. A v2 proof is the terminal run record at revision R; its own state rows carry R. A legacy `coverage_diagnostics` proof is that state row, at the revision of the commit that wrote it.
+
+Retirement. A proof is current only when its revision equals the connection's high-water revision. For a v2 proof, the high-water event must also be `terminal_run` with the same run id. The server reads the proof run by that run id, not by the newest `completed_at`. Any later observable event raises the high-water revision and retires the proof to unknown. No wall clock takes part.
+
+Fail closed. Coverage is unknown when the high-water row or the proof revision is missing, NULL, not a safe integer, or unequal; when the high-water run id differs from the proof run; or when the revision read fails. A v2 proof is also unknown when the newest settled device run is a different run that carries no revision (a pre-migration row or a writer that assigns none), because its order against the proof is ambiguous.
+
+Terminal record for every successful run. A runtime that implements this profile version commits a terminal run record for every run whose DONE succeeded, even when coverage was not negotiated and no STATE changed. Without coverage evidence it sends a version 2 commit with empty `terminal_facts`, carrying the run's STATE delta. The server stores unknown inventory for it, and the device clears its receipt (`no_evidence`). A server that names no connection on its state read cannot bind a terminal record, so against such a server the runtime keeps the plain state checkpoint.
+
+As-of. Every owner projection that shows local coverage carries `coverage_as_of`: run id, release digest, collection revision, and commit time. Owner UI copy reads "complete as of <time>". A legacy proof has no release digest, so its `artifact_digest` is null.
+
+Limits. The server cannot order an attempt it never hears about. Examples are a run refused before authorization, a device that goes offline before it delivers its failure barrier, and a runner that predates this version and sends neither state nor records. In those cases the projection keeps the last admitted proof, labelled with its as-of. The device keeps its stricter local verdict. There is no heartbeat or lease machinery.
diff --git a/reference-implementation/operations/local-device-terminal-collection.ts b/reference-implementation/operations/local-device-terminal-collection.ts
index 1368d318e..0fe9cdaca 100644
--- a/reference-implementation/operations/local-device-terminal-collection.ts
+++ b/reference-implementation/operations/local-device-terminal-collection.ts
@@ -6,6 +6,7 @@ import { canonicalTerminalRunCommitEnvelope } from "@pdpp/collector-runtime/loca
 import { canonicalTerminalRunCommitJson } from "@pdpp/reference-contract/common";
 import { fingerprintDeviceAttemptManifest } from "../server/device-ingest-attempt-context.ts";
 import { readRuntimeCollectionFact } from "../server/runtime-collection-facts.ts";
+import { readCollectionRevisionHighWaters } from "../server/stores/collection-revision-store.ts";
 import type { ResolvedTerminalRunCommit, TerminalRunCommitResult } from "../server/stores/terminal-run-commit-store.ts";
 import { TerminalRunCommitConflictError } from "../server/stores/terminal-run-commit-store.ts";
 
@@ -24,7 +25,10 @@ interface TerminalResponse {
 
 interface AuthorizedSource {
   readonly connectorInstance: { readonly connectorInstanceId: string };
-  readonly sourceInstance: { readonly connectorId: string; readonly manifestGeneration?: number | null };
+  readonly sourceInstance: {
+    readonly connectorId: string;
+    readonly manifestGeneration?: number | null;
+  };
 }
 
 interface TerminalContext {
@@ -135,7 +139,7 @@ export async function handleLocalDeviceTerminalRunCommit(input: {
     }
     const validatedFacts =
       version === 2
-        ? normalizeTerminalCoverageFacts(rawFacts, registeredManifest, collectionBoundary, {
+        ? normalizeTerminalRunRecordFacts(rawFacts, registeredManifest, collectionBoundary, {
             allowSubset: true,
             bindingGeneration: authorized.sourceInstance.manifestGeneration ?? null,
             expectedArtifactDigest,
@@ -272,10 +276,16 @@ export async function handleLocalDeviceTerminalCollection(input: {
       );
       return;
     }
+    // The split report follows its own state commit, which already took a
+    // collection revision. It takes none itself; it is labelled with the
+    // current revision so the projection can order it against a proof.
+    const { connectorInstanceId } = authorized.connectorInstance;
+    const highWater = (await readCollectionRevisionHighWaters([connectorInstanceId])).get(connectorInstanceId);
     await ctx.emitSpineEvent({
       actor_id: deviceId,
       actor_type: "local_device",
       data: {
+        collection_revision: highWater?.revision ?? null,
         collection_facts: {
           // The boundary this evidence was measured against travels WITH it, so
           // a later scope change is detectable by comparison and stale proof can
@@ -369,6 +379,22 @@ export function normalizeTerminalFacts(rawFacts: readonly unknown[]): readonly R
     : null;
 }
 
+/**
+ * A version 2 record with no facts makes no coverage claim: it is the terminal
+ * run record every successful run commits. Without a registered manifest
+ * there is no inventory to expand to unknown, so it stays empty. Any other
+ * version 2 record is validated as a coverage claim.
+ */
+function normalizeTerminalRunRecordFacts(
+  ...args: Parameters<typeof normalizeTerminalCoverageFacts>
+): ReturnType<typeof normalizeTerminalCoverageFacts> {
+  const [rawFacts, rawManifest] = args;
+  if (rawFacts.length === 0 && !Array.isArray(asObject(rawManifest)?.streams)) {
+    return [];
+  }
+  return normalizeTerminalCoverageFacts(...args);
+}
+
 /** Validate a v2 claim against the registered manifest, without source-specific rules. */
 export function normalizeTerminalCoverageFacts(
   rawFacts: readonly unknown[],
@@ -467,7 +493,10 @@ export function normalizeTerminalCoverageFacts(
       return null;
     }
     seen.add(stream);
-    const stores: { store: string; status: "collected" | "partial" | "unavailable" | "failed" }[] = [];
+    const stores: {
+      store: string;
+      status: "collected" | "partial" | "unavailable" | "failed";
+    }[] = [];
     const seenStores = new Set<string>();
     for (const rawStore of rawStores) {
       const store = asObject(rawStore);
diff --git a/reference-implementation/scripts/postgres-template-eligibility.ts b/reference-implementation/scripts/postgres-template-eligibility.ts
index d17287549..6869417cc 100644
--- a/reference-implementation/scripts/postgres-template-eligibility.ts
+++ b/reference-implementation/scripts/postgres-template-eligibility.ts
@@ -103,7 +103,7 @@ export const POSTGRES_TEMPLATE_ELIGIBLE_FILES: readonly string[] = [
   "test/lexical-index-skip-unchanged-postgres.test.ts",
   "test/live-shadow-comparison.test.ts",
   "test/local-coverage-state-parser-postgres.test.ts",
-  // Postgres is a fixture for the newest state-commit read, not the schema bootstrap under test.
+  // Postgres is a fixture for the collection-revision fence read, not the schema bootstrap under test.
   "test/local-device-coverage-state-commit-postgres.test.ts",
   "test/manual-upload-artifact-store-postgres.test.ts",
   "test/oauth-code-delivery-atomicity.test.ts",
diff --git a/reference-implementation/server/db.ts b/reference-implementation/server/db.ts
index 4621a8944..cb01adf1a 100644
--- a/reference-implementation/server/db.ts
+++ b/reference-implementation/server/db.ts
@@ -2998,6 +2998,20 @@ function ensureRecordIdentityGenerationColumn(raw: SqliteDatabase): void {
   addColumnIfMissing(raw, "connector_instances", "record_identity_generation", "INTEGER NOT NULL DEFAULT 0");
 }
 
+// Per-connection collection revision (server/stores/collection-revision-store.ts):
+// a monotonic counter the server assigns at commit to every observed event that
+// can establish or retire a local coverage proof. `connector_instances` holds
+// the high-water mark; `connector_state.collection_revision` is the revision of
+// the commit that last wrote the row. Rows that predate the columns read NULL,
+// and a NULL proof revision is unknown coverage.
+function ensureCollectionRevisionColumns(raw: SqliteDatabase): void {
+  addColumnIfMissing(raw, "connector_instances", "collection_revision", "INTEGER NOT NULL DEFAULT 0");
+  addColumnIfMissing(raw, "connector_instances", "collection_revision_event", "TEXT");
+  addColumnIfMissing(raw, "connector_instances", "collection_revision_run_id", "TEXT");
+  addColumnIfMissing(raw, "connector_instances", "collection_revision_at", "TEXT");
+  addColumnIfMissing(raw, "connector_state", "collection_revision", "INTEGER");
+}
+
 function ensureConnectorSummaryEvidenceColumns(raw: SqliteDatabase): void {
   addColumnIfMissing(raw, "connector_summary_evidence", "last_record_updated_at", "TEXT");
   addColumnIfMissing(raw, "connector_summary_evidence", "stream_records_json", "TEXT NOT NULL DEFAULT '[]'");
@@ -6554,6 +6568,7 @@ function buildSqliteSchema(raw: SqliteDatabase, opts: InitDbOptions): void {
   );
   runWithSqliteBusyRetrySync(() => ensureRecordResetGenerationColumn(raw));
   runWithSqliteBusyRetrySync(() => ensureRecordIdentityGenerationColumn(raw));
+  runWithSqliteBusyRetrySync(() => ensureCollectionRevisionColumns(raw));
   // Incremental add-source linkage: a later same-client ceremony records the
   // prior package it extends via `parent_package_id`. Pre-existing reference
   // DBs predate the column; add it non-destructively (NULL = a root package
diff --git a/reference-implementation/server/postgres-storage.ts b/reference-implementation/server/postgres-storage.ts
index 1d6251036..e3d4d93cf 100644
--- a/reference-implementation/server/postgres-storage.ts
+++ b/reference-implementation/server/postgres-storage.ts
@@ -1842,6 +1842,16 @@ async function bootstrapPostgresSchemaOnce({
       -- capabilities.record_identity.generation at reconcile time).
       ALTER TABLE connector_instances
         ADD COLUMN IF NOT EXISTS record_identity_generation BIGINT NOT NULL DEFAULT 0;
+      -- Per-connection collection revision: see ensureCollectionRevisionColumns
+      -- in db.ts and server/stores/collection-revision-store.ts.
+      ALTER TABLE connector_instances
+        ADD COLUMN IF NOT EXISTS collection_revision BIGINT NOT NULL DEFAULT 0;
+      ALTER TABLE connector_instances
+        ADD COLUMN IF NOT EXISTS collection_revision_event TEXT;
+      ALTER TABLE connector_instances
+        ADD COLUMN IF NOT EXISTS collection_revision_run_id TEXT;
+      ALTER TABLE connector_instances
+        ADD COLUMN IF NOT EXISTS collection_revision_at TEXT;
 
       -- Existing Postgres deployments may have been bootstrapped before the
       -- static-secret draft lifecycle existed. Widen the status CHECK in place
@@ -3706,6 +3716,8 @@ async function bootstrapPostgresSchemaOnce({
         ADD COLUMN IF NOT EXISTS lease_expires_at TEXT;
       ALTER TABLE connector_state
         ADD COLUMN IF NOT EXISTS manifest_generation BIGINT NOT NULL DEFAULT 0;
+      ALTER TABLE connector_state
+        ADD COLUMN IF NOT EXISTS collection_revision BIGINT;
       ALTER TABLE grant_connector_state
         ADD COLUMN IF NOT EXISTS manifest_generation BIGINT NOT NULL DEFAULT 0;
       -- Terminal-run events are the fold source for per-stream evidence; the
diff --git a/reference-implementation/server/queries/records/sync-state/upsert-connector-state-with-generation.sql b/reference-implementation/server/queries/records/sync-state/upsert-connector-state-with-generation.sql
index 38a133bc3..c3be2c8d6 100644
--- a/reference-implementation/server/queries/records/sync-state/upsert-connector-state-with-generation.sql
+++ b/reference-implementation/server/queries/records/sync-state/upsert-connector-state-with-generation.sql
@@ -1,10 +1,11 @@
 -- @terminator: exec
 INSERT INTO connector_state(
-  connector_id, connector_instance_id, stream, state_json, updated_at, manifest_generation
+  connector_id, connector_instance_id, stream, state_json, updated_at, manifest_generation, collection_revision
 )
-VALUES(?, ?, ?, ?, ?, ?)
+VALUES(?, ?, ?, ?, ?, ?, ?)
 ON CONFLICT(connector_instance_id, stream) DO UPDATE SET
   connector_id = excluded.connector_id,
   state_json = excluded.state_json,
   updated_at = excluded.updated_at,
-  manifest_generation = excluded.manifest_generation;
+  manifest_generation = excluded.manifest_generation,
+  collection_revision = excluded.collection_revision;
diff --git a/reference-implementation/server/records.ts b/reference-implementation/server/records.ts
index 9088edfe5..aea631ad7 100644
--- a/reference-implementation/server/records.ts
+++ b/reference-implementation/server/records.ts
@@ -141,6 +141,10 @@ import {
   resolveStorageConnectorId,
   resolveStorageConnectorInstanceId,
 } from "./storage-utils.ts";
+import {
+  type LocalCoverageRevisionFence,
+  readLocalCoverageRevisionFences,
+} from "./stores/collection-revision-store.ts";
 import {
   ConnectorInstanceResolutionError,
   makeDefaultAccountConnectorInstanceId,
@@ -4863,68 +4867,6 @@ export async function listLocalCoverageDiagnostics(storageTarget: RecordStorageT
   return [...byStore.values()].sort((a, b) => a.store.localeCompare(b.store));
 }
 
-/**
- * The newest state-commit instant for one connection: the max `updated_at`
- * over its connector-state rows, skipping the server's own `$`-prefixed rows
- * (declared and measured scope). A state write stamps this column, and a
- * terminal commit stamps its state and its run completion with one instant, so
- * the projection can tell a later commit from a proof's own transaction. There
- * is no durable sequence on state writes; this is the only ordering they carry.
- */
-async function readLatestStateCommitAt(connectorInstanceId: string): Promise<string | null> {
-  if (isPostgresStorageBackend()) {
-    const result = await postgresQuery<{ latest: string | null }>(
-      "SELECT MAX(updated_at) AS latest FROM connector_state WHERE connector_instance_id = $1 AND substr(stream, 1, 1) <> '$'",
-      [connectorInstanceId]
-    );
-    return result.rows[0]?.latest ?? null;
-  }
-  const row = getDb()
-    .prepare(
-      "SELECT MAX(updated_at) AS latest FROM connector_state WHERE connector_instance_id = ? AND substr(stream, 1, 1) <> '$'"
-    )
-    .get<{ latest: string | null }>(connectorInstanceId);
-  return row?.latest ?? null;
-}
-
-/** Batched {@link readLatestStateCommitAt} for one page of connection ids, keyed by connector instance. */
-async function readLatestStateCommitAtByConnectionIds(ids: readonly string[]): Promise<Map<string, string>> {
-  const latest = new Map<string, string>();
-  interface Row {
-    connector_instance_id: string;
-    latest: string | null;
-  }
-  const rows: Row[] = [];
-  if (isPostgresStorageBackend()) {
-    const query = await postgresQuery<Row>(
-      `SELECT connector_instance_id, MAX(updated_at) AS latest FROM connector_state
-        WHERE connector_instance_id = ANY($1::text[]) AND substr(stream, 1, 1) <> '$'
-        GROUP BY connector_instance_id`,
-      [ids]
-    );
-    rows.push(...query.rows);
-  } else {
-    for (let start = 0; start < ids.length; start += 900) {
-      const chunk = ids.slice(start, start + 900);
-      rows.push(
-        ...(getDb()
-          .prepare(
-            `SELECT connector_instance_id, MAX(updated_at) AS latest FROM connector_state
-              WHERE connector_instance_id IN (${chunk.map(() => "?").join(", ")}) AND substr(stream, 1, 1) <> '$'
-              GROUP BY connector_instance_id`
-          )
-          .all(...chunk) as Row[])
-      );
-    }
-  }
-  for (const row of rows) {
-    if (row.latest) {
-      latest.set(row.connector_instance_id, row.latest);
-    }
-  }
-  return latest;
-}
-
 /**
  * Read the local coverage proof without laundering malformed or duplicate
  * diagnostic rows into a healthy projection. This is intentionally separate
@@ -4941,9 +4883,9 @@ export async function readCommittedLocalCoverageDiagnostics(storageTarget: Recor
       hasCommittedSnapshot: false,
       malformed: false,
       missingStores: [],
+      revisionFence: null,
       rows: [],
       state: null,
-      stateCommittedAt: null,
       unexpectedStores: [],
       updatedAt: null,
     };
@@ -4990,8 +4932,11 @@ export async function readCommittedLocalCoverageDiagnostics(storageTarget: Recor
     ...parseCoverageDiagnosticsStateSnapshot(connectorId, state),
     declaredCollectionScope,
     manifestGeneration: currentGeneration === null ? null : Number(currentGeneration),
+    revisionFence:
+      (await readLocalCoverageRevisionFences([connectorInstanceId], LOCAL_COVERAGE_DIAGNOSTICS_STREAM)).get(
+        connectorInstanceId
+      ) ?? null,
     state,
-    stateCommittedAt: await readLatestStateCommitAt(connectorInstanceId),
     stateManifestGeneration: stateGeneration === null ? null : Number(stateGeneration),
     updatedAt: stateProjection.updated_at ?? null,
   };
@@ -5009,8 +4954,8 @@ export async function readCommittedLocalCoverageDiagnosticsByConnectionIds(conne
     ReturnType<typeof parseCoverageDiagnosticsStateSnapshot> & {
       declaredCollectionScope: string;
       manifestGeneration: number | null;
+      revisionFence: LocalCoverageRevisionFence | null;
       state: unknown;
-      stateCommittedAt: string | null;
       stateManifestGeneration: number | null;
       updatedAt: string | null;
     }
@@ -5057,7 +5002,7 @@ export async function readCommittedLocalCoverageDiagnosticsByConnectionIds(conne
       );
     }
   }
-  const latestStateCommitAt = await readLatestStateCommitAtByConnectionIds(ids);
+  const revisionFences = await readLocalCoverageRevisionFences(ids, LOCAL_COVERAGE_DIAGNOSTICS_STREAM);
   for (const row of rows) {
     // `row.state_json` is already the `coverage_diagnostics` stream's own
     // payload — the JOIN's `ON` clause already narrows `cs.stream =
@@ -5075,8 +5020,8 @@ export async function readCommittedLocalCoverageDiagnosticsByConnectionIds(conne
       ...parseCoverageDiagnosticsStateSnapshot(row.connector_id, parsedState),
       declaredCollectionScope: declaredCollectionScopeFingerprint(row.scope_state_json ?? null),
       manifestGeneration: row.current_generation === null ? null : Number(row.current_generation),
+      revisionFence: revisionFences.get(row.connector_instance_id) ?? null,
       state: parsedState,
-      stateCommittedAt: latestStateCommitAt.get(row.connector_instance_id) ?? null,
       stateManifestGeneration: row.state_generation === null ? null : Number(row.state_generation),
       updatedAt: row.updated_at ?? null,
     });
diff --git a/reference-implementation/server/ref-control.ts b/reference-implementation/server/ref-control.ts
index 198f013f9..fd36765f0 100644
--- a/reference-implementation/server/ref-control.ts
+++ b/reference-implementation/server/ref-control.ts
@@ -206,6 +206,7 @@ import {
   createSqliteAcquisitionBatchStore,
 } from "./stores/acquisition-batch-store.ts";
 import { getDefaultBrowserSurfaceLeaseStore } from "./stores/browser-surface-lease-store.ts";
+import { type LocalCoverageRevisionFence, readCollectionRevision } from "./stores/collection-revision-store.ts";
 import { getDefaultConnectorAttentionStore } from "./stores/connector-attention-store.ts";
 import { getDefaultConnectorCoverageHorizonStore } from "./stores/connector-coverage-horizon-store.ts";
 import { getDefaultConnectorDetailGapStore } from "./stores/connector-detail-gap-store.ts";
@@ -597,6 +598,8 @@ export interface ConnectorRunSummary {
    * `collection_report`; never final coverage truth.
    */
   readonly collection_facts: RuntimeCollectionFacts | null;
+  /** The per-connection collection revision this run was committed at; `null` when the run carries none. */
+  readonly collection_revision?: number | null;
   /** Authenticated v2 device terminal evidence, kept raw until manifest and current scope are checked on read. */
   readonly local_terminal_coverage?: {
     readonly eligibleLocalRun: boolean;
@@ -926,6 +929,12 @@ export interface ConnectorSummary {
    * here means "not read," never "confirmed absent."
    */
   readonly coverage_horizons: readonly ConnectionCoverageHorizon[];
+  /**
+   * What the local coverage on this row is a fact about: the run, its release
+   * digest, and the collection revision and time it was committed at. `null`
+   * when no current local proof backs the coverage shown.
+   */
+  readonly coverage_as_of: LocalCoverageAsOf | null;
   readonly display_name: string;
   readonly freshness: Freshness;
   readonly last_run: ConnectorRunSummary | null;
@@ -1164,6 +1173,8 @@ export interface ConnectorDetail {
    */
   readonly connection_health: ConnectionHealthSnapshot | null;
   readonly connection_id: string;
+  /** See {@link ConnectorSummary.coverage_as_of}; `null` when no single connection resolved. */
+  readonly coverage_as_of: LocalCoverageAsOf | null;
   /**
    * How this connector-keyed detail resolved to an owner connection
    * (design.md "Central consumer and cache boundary"): `resolved` when
@@ -1598,6 +1609,7 @@ function productRunHistoryToConnectorRunSummary(
       : null;
   return {
     collection_facts: readCollectionFactsFromTerminalData(facts),
+    collection_revision: readCollectionRevision(facts?.collection_revision),
     local_terminal_coverage: readLocalTerminalCoverage(facts, history),
     connector_error: projectConnectorRunError(history.connectorError),
     event_count: 0,
@@ -1624,7 +1636,12 @@ function recordOrNull(value: unknown): Record<string, unknown> | null {
 
 function readLocalTerminalCoverage(
   facts: Record<string, unknown> | null,
-  history: ProductRunHistoryRecord
+  history: {
+    readonly connectorInstanceId?: string | null;
+    readonly runId?: string | null;
+    readonly schedulerManaged?: boolean | null;
+    readonly status: string;
+  }
 ): NonNullable<ConnectorRunSummary["local_terminal_coverage"]> | null {
   const block = recordOrNull(facts?.collection_facts);
   if (block?.schema_version !== 2) {
@@ -4804,11 +4821,27 @@ interface LocalCoverageDiagnosticAxis {
     | "missing_stores"
     | "unexpected_stores";
   /**
-   * The newest state-commit instant for this connection (see
-   * `readLatestStateCommitAt` in `server/records.ts`). Carried so the projection
-   * can retire a proof that a later, unaccounted state commit has superseded.
+   * The connection's collection-revision fence (see
+   * `server/stores/collection-revision-store.ts`). Carried so the projection
+   * can retire a proof that any later observed event has superseded.
    */
-  readonly stateCommittedAt?: string | null;
+  readonly revisionFence?: LocalCoverageRevisionFence | null;
+  /** What the shown coverage is a fact about. Set only on a proof the revision fence admits. */
+  readonly asOf?: LocalCoverageAsOf | null;
+}
+
+/**
+ * The run a local coverage verdict describes. Coverage is a fact about one
+ * run, never a present-tense claim, so every projection that shows coverage
+ * carries this. A legacy diagnostics proof has no release binding, so its
+ * `artifact_digest` is null; its `run_id` is null when no run committed it.
+ */
+export interface LocalCoverageAsOf {
+  readonly artifact_digest: string | null;
+  readonly collection_revision: number;
+  readonly committed_at: string | null;
+  readonly evidence: "legacy_diagnostics" | "terminal_run";
+  readonly run_id: string | null;
 }
 
 const LOCAL_COVERAGE_ACCOUNTED_STATUSES = new Set([
@@ -4904,8 +4937,8 @@ export function deriveLocalCoverageAxis(input: {
    * that hold no boundary omit it and keep the honest `unscoped` default.
    */
   readonly declaredCollectionScope?: string | null;
-  /** The connection's newest state-commit instant (`readLatestStateCommitAt`); omitted by callers with no state read. */
-  readonly stateCommittedAt?: string | null;
+  /** The connection's collection-revision fence; omitted by callers with no revision read, which fail closed. */
+  readonly revisionFence?: LocalCoverageRevisionFence | null;
 }): LocalCoverageDiagnosticAxis {
   const declaredScope = resolveDeclaredCoverageScope(input.declaredCollectionScope, input.state);
   const { rows } = input;
@@ -4926,7 +4959,7 @@ export function deriveLocalCoverageAxis(input: {
   const scopeField = {
     declaredCollectionScope: declaredScope,
     measuredCollectionScope: measuredScope,
-    stateCommittedAt: input.stateCommittedAt ?? null,
+    revisionFence: input.revisionFence ?? null,
   };
   const stateCursor =
     input.state && typeof input.state === "object" && !Array.isArray(input.state)
@@ -5007,7 +5040,7 @@ export function deriveLocalCoverageAxis(input: {
 
 /** Recheck committed v2 facts against the currently pinned manifest and scope. */
 function deriveLocalTerminalCoverageAxis(
-  run: ConnectorRunSummary | null,
+  run: Pick<ConnectorRunSummary, "last_at" | "local_terminal_coverage"> | null,
   manifest: ConnectorManifest,
   legacyAxis: LocalCoverageDiagnosticAxis | null,
   bindingGeneration: number | null,
@@ -5060,7 +5093,10 @@ function deriveLocalTerminalCoverageAxis(
       return unknown;
     }
     let storeIndex = 0;
-    for (const assertion of rawFact.stores as readonly { store: string; status: string }[]) {
+    for (const assertion of rawFact.stores as readonly {
+      store: string;
+      status: string;
+    }[]) {
       const status = (rawFact.coverage_statuses as string[])[storeIndex] ?? "unknown";
       storeIndex += 1;
       const rawStore = { ...assertion, status };
@@ -5090,41 +5126,131 @@ function deriveLocalTerminalCoverageAxis(
 }
 
 /**
- * Retire a local coverage proof that a later, unaccounted state commit has
- * superseded.
+ * The terminal run the revision fence names, shaped for
+ * `deriveLocalTerminalCoverageAxis`. The fence reads it by run id, so a
+ * skewed `completed_at` cannot hide a newer proof behind an older one.
+ */
+function localProofRunCoverage(
+  fence: LocalCoverageRevisionFence | null | undefined,
+  connectorInstanceId: string
+): {
+  readonly artifactDigest: string | null;
+  readonly collectionRevision: number | null;
+  readonly run: Pick<ConnectorRunSummary, "last_at" | "local_terminal_coverage">;
+  readonly runId: string;
+} | null {
+  const proofRun = fence?.proofRun;
+  // A terminal run record always has a completion time; one without it is not a proof.
+  if (!proofRun?.completedAt) {
+    return null;
+  }
+  const terminal = readLocalTerminalCoverage(proofRun.facts, {
+    connectorInstanceId,
+    runId: proofRun.runId,
+    schedulerManaged: proofRun.schedulerManaged,
+    status: proofRun.status,
+  });
+  if (!terminal) {
+    return null;
+  }
+  const digests = new Set(
+    (Array.isArray(terminal.streams) ? terminal.streams : []).map((fact) => recordOrNull(fact)?.artifact_digest)
+  );
+  const [digest] = digests;
+  return {
+    artifactDigest: digests.size === 1 && typeof digest === "string" ? digest : null,
+    collectionRevision: readCollectionRevision(proofRun.facts?.collection_revision),
+    run: { last_at: proofRun.completedAt, local_terminal_coverage: terminal },
+    runId: proofRun.runId,
+  };
+}
+
+/**
+ * Keep a local coverage proof only while it is the connection's newest
+ * observed collection event.
  *
- * A terminal commit writes its state rows and its run completion with one
- * instant, so `evidenceAsOf` is the proof's own instant: a v2 proof's run
- * `completed_at`, or a legacy proof's diagnostics `updated_at`. A state commit
- * strictly after that instant came from a later run or checkpoint. That commit
- * carried no terminal replacement, so the proof no longer describes the source's
- * latest collection, and coverage is unknown until a later run proves it again.
- * A commit at the same instant is the proof's own transaction, and an earlier
- * one predates it. Neither retires the proof.
+ * The server assigns each event that can establish or retire proof a
+ * monotonic per-connection revision at commit (state commits, terminal runs,
+ * admitted and refused batches, delivered failure reports). A proof binds to
+ * the revision it was committed at. It is current only when that revision is
+ * the high-water mark; any later event retires it to unknown. No wall clock is
+ * compared. A v2 proof must also be the terminal run the high-water mark names.
+ * A legacy diagnostics proof is the `coverage_diagnostics` row, at the revision
+ * of the commit that wrote it.
  *
- * The server decides this from what it stored. It never reads the device outbox.
- * An unparseable instant keeps the proof, because it cannot establish that a
- * later commit exists.
+ * Fails closed: a missing fence, an unreadable or NULL revision, any
+ * mismatch, or (for a terminal proof) a newest settled device run that is not
+ * the proof and carries no revision, whose order is ambiguous, is unknown
+ * coverage.
  */
-function retireLocalCoverageSupersededByLaterCommit(
+function fenceLocalCoverageProof(
   axis: LocalCoverageDiagnosticAxis | null,
-  stateCommittedAt: string | null | undefined
+  fence: LocalCoverageRevisionFence | null | undefined,
+  terminal: ReturnType<typeof localProofRunCoverage>,
+  latestSettledRun: Pick<ConnectorRunSummary, "collection_revision" | "run_id" | "scheduler_managed"> | null
 ): LocalCoverageDiagnosticAxis | null {
-  if (axis === null || axis.axis === "unknown" || !axis.evidenceAsOf || !stateCommittedAt) {
+  if (axis === null || axis.axis === "unknown") {
     return axis;
   }
-  if (!(Date.parse(stateCommittedAt) > Date.parse(axis.evidenceAsOf))) {
-    return axis;
+  const highWater = fence?.highWater ?? null;
+  // A settled device run record with no revision cannot be ordered against a
+  // terminal proof (a pre-revision row, or a writer that assigns none). If it
+  // is the newest settled run and not the proof itself, the order is
+  // ambiguous. A scheduler-managed run is not a device collection attempt. A
+  // legacy diagnostics proof binds to a state row, not to a run record, so
+  // this check does not apply to it.
+  const unorderedLaterRun =
+    terminal !== null &&
+    latestSettledRun !== null &&
+    latestSettledRun.scheduler_managed !== true &&
+    latestSettledRun.run_id !== terminal?.runId &&
+    (latestSettledRun.collection_revision === null || latestSettledRun.collection_revision === undefined);
+  let asOf: LocalCoverageAsOf | null = null;
+  if (unorderedLaterRun) {
+    asOf = null;
+  } else if (terminal) {
+    if (
+      highWater?.event === "terminal_run" &&
+      highWater.runId === terminal.runId &&
+      terminal.collectionRevision !== null &&
+      terminal.collectionRevision === highWater.revision
+    ) {
+      asOf = {
+        artifact_digest: terminal.artifactDigest,
+        collection_revision: highWater.revision,
+        committed_at: terminal.run.last_at ?? null,
+        evidence: "terminal_run",
+        run_id: terminal.runId,
+      };
+    }
+  } else if (
+    highWater &&
+    (highWater.event === "state_commit" || highWater.event === "terminal_run") &&
+    fence?.legacyProofRevision !== null &&
+    fence?.legacyProofRevision !== undefined &&
+    fence.legacyProofRevision === highWater.revision
+  ) {
+    asOf = {
+      artifact_digest: null,
+      collection_revision: highWater.revision,
+      committed_at: highWater.at,
+      evidence: "legacy_diagnostics",
+      run_id: highWater.event === "terminal_run" ? highWater.runId : null,
+    };
   }
-  return {
-    ...axis,
-    axis: "unknown",
-    evidenceAsOf: null,
-    measuredCollectionScope: null,
-    reliable: false,
-    rows: [],
-    unaccountedStores: [],
-  };
+  if (!asOf) {
+    return {
+      ...axis,
+      asOf: null,
+      axis: "unknown",
+      evidenceAsOf: null,
+      measuredCollectionScope: null,
+      reliable: false,
+      rows: [],
+      unaccountedStores: [],
+    };
+  }
+  return { ...axis, asOf };
 }
 
 /**
@@ -7146,21 +7272,26 @@ function synthesizeConnectorSummary(input: ConnectorSummarySynthesisInput): Conn
   const fallbackSettledRun = latestSettledRun ?? fallbackLatestSettledRun(lastRun, lastSuccessfulRun);
   const authoritativeLatestSettledRun = isOwnScopedRun(fallbackSettledRun) ? fallbackSettledRun : null;
   const localCollectorRelease = localDeviceBacked ? readLocalCollectorRelease(connectorId) : null;
-  // Whichever proof this reads (the settled run's v2 verdict, else the legacy
-  // diagnostics), a later state commit it does not account for retires it. The
-  // downstream readers below all take `effectiveLocalCoverage`, so the
+  // The proof is the terminal run the connection's revision high-water mark
+  // names (else the legacy diagnostics row). Any later observed event retires
+  // it. The downstream readers below all take `effectiveLocalCoverage`, so the
   // retirement reaches every consumer, not only this branch.
+  const proofRunCoverage = localDeviceBacked
+    ? localProofRunCoverage(localCoverage?.revisionFence, connectorInstanceId)
+    : null;
   const effectiveLocalCoverage = localDeviceBacked
-    ? retireLocalCoverageSupersededByLaterCommit(
+    ? fenceLocalCoverageProof(
         deriveLocalTerminalCoverageAxis(
-          fallbackSettledRun,
+          proofRunCoverage?.run ?? null,
           manifest,
           localCoverage,
           evidence?.manifest_generation ?? null,
           localCollectorRelease?.artifactDigest ?? null,
           localCollectorRelease ? fingerprintDeviceAttemptManifest(localCollectorRelease.manifest) : null
         ) ?? localCoverage,
-        localCoverage?.stateCommittedAt
+        localCoverage?.revisionFence,
+        proofRunCoverage,
+        fallbackSettledRun
       )
     : localCoverage;
   const authoritativeLatestStreamFacts = localDeviceBacked ? null : latestStreamFacts;
@@ -7486,6 +7617,7 @@ function synthesizeConnectorSummary(input: ConnectorSummarySynthesisInput): Conn
     connection_health: connectionHealth,
     connection_id: connectorInstanceId,
     connector_display_name: connectorDisplayName,
+    coverage_as_of: effectiveLocalCoverage?.asOf ?? null,
     connector_id: connectorId,
     connector_implementation: input.connectorImplementation,
     connector_instance_id: connectorInstanceId,
@@ -9624,6 +9756,7 @@ function buildUnresolvedConnectorDetail(
     connection_health: null,
     connection_id: connectorId,
     connection_resolution: resolution,
+    coverage_as_of: null,
     connector_id: connectorId,
     display_name: manifest.display_name || connectorId,
     freshness: { status: "unknown" },
@@ -9694,6 +9827,7 @@ export async function getConnectorDetail(
     connection_id: summary.connector_instance_id,
     connection_resolution: "resolved",
     connector_id: summary.connector_id,
+    coverage_as_of: summary.coverage_as_of,
     display_name: summary.display_name,
     freshness: summary.freshness,
     last_run: summary.last_run,
diff --git a/reference-implementation/server/routes/ref-device-exporters.ts b/reference-implementation/server/routes/ref-device-exporters.ts
index 11498d360..7e2de5cb5 100644
--- a/reference-implementation/server/routes/ref-device-exporters.ts
+++ b/reference-implementation/server/routes/ref-device-exporters.ts
@@ -39,6 +39,7 @@ import { deriveReferenceFreshness } from "../freshness.ts";
 import { presentHeartbeatHealth } from "../heartbeat-lease.ts";
 import { buildStoredCollectionScope, COLLECTION_SCOPE_STATE_KEY } from "../local-collection-scope.ts";
 import { assertRecordIdentity, normalizePrimaryKey } from "../record-expand-helpers.ts";
+import { type CollectionRevisionEvent, recordCollectionRevisionEvent } from "../stores/collection-revision-store.ts";
 import { commitTerminalRun } from "../stores/terminal-run-commit-store.ts";
 import type { MiddlewareHandler, PdppErrorFn, RouteArg } from "./_route-contract.ts";
 import {
@@ -2529,6 +2530,9 @@ export function mountRefDeviceExporterIngestBatches(app: AppLike, ctx: MountRefD
     ctx.requireDeviceExporterCredential,
     // biome-ignore lint/complexity/noExcessiveCognitiveComplexity: this boundary deliberately keeps credential, identity, hash, and response precedence visible together.
     async (req: RouteRequest, res: RouteResponse) => {
+      // Set once the device and source are authorized. Every later refusal is a
+      // batch the server received for this connection and did not admit.
+      let observedConnectorInstanceId: string | null = null;
       try {
         const deviceId = decodeURIComponent(req.params.deviceId as string);
         if (deviceId !== req.deviceExporter?.deviceId) {
@@ -2554,6 +2558,7 @@ export function mountRefDeviceExporterIngestBatches(app: AppLike, ctx: MountRefD
           return;
         }
         const { sourceInstance, connectorInstance } = authorized;
+        observedConnectorInstanceId = connectorInstance.connectorInstanceId;
         const sourceConnectorMatches = sameConnectorType(ctx, sourceInstance.connectorId, requestConnectorId);
         // Reservation identity and attempt facts use the canonical connector
         // key, not the URL/legacy alias supplied by the collector. This keeps
@@ -2569,6 +2574,7 @@ export function mountRefDeviceExporterIngestBatches(app: AppLike, ctx: MountRefD
           sourceInstanceId,
         });
         if (!SHA256_HEX.test(bodyHash) || (bodyHash !== canonical.hash && bodyHash !== collectorEnvelopeHash)) {
+          await observeCollectionAttempt(connectorInstance.connectorInstanceId, "batch_rejected");
           ctx.pdppError(
             res,
             400,
@@ -2591,6 +2597,9 @@ export function mountRefDeviceExporterIngestBatches(app: AppLike, ctx: MountRefD
           sourceInstanceId,
         });
       } catch (err) {
+        if (observedConnectorInstanceId) {
+          await observeCollectionAttempt(observedConnectorInstanceId, "batch_rejected");
+        }
         if (err instanceof ctx.DeviceBatchConflictError) {
           ctx.pdppError(
             res,
@@ -2637,6 +2646,30 @@ export function mountRefDeviceExporterIngestBatches(app: AppLike, ctx: MountRefD
   );
 }
 
+/**
+ * Record an observed collection attempt for an authorized connection, so it
+ * retires any earlier local coverage proof (see collection-revision-store.ts).
+ * The caller awaits this before it answers the device, so the device cannot
+ * send a later terminal commit that the server orders before this event.
+ */
+async function observeCollectionAttempt(
+  connectorInstanceId: string,
+  event: CollectionRevisionEvent,
+  runId: string | null = null
+): Promise<void> {
+  try {
+    await recordCollectionRevisionEvent(connectorInstanceId, {
+      at: new Date().toISOString(),
+      event,
+      runId,
+    });
+  } catch (error) {
+    console.warn(
+      `[device-exporters] collection revision not recorded connector_instance_id=${connectorInstanceId} event=${event} code=${String((error as { code?: unknown } | null)?.code ?? "unknown")}`
+    );
+  }
+}
+
 async function processDeviceIngestBatch(
   ctx: MountRefDeviceExportersContext,
   res: RouteResponse,
@@ -2681,6 +2714,7 @@ async function processDeviceIngestBatch(
     const existing = await ctx.deviceExporterStore.getBatchOutcome(deviceId, batchId);
     if (existing) {
       if (!deviceBatchIdentityMatches(existing, identity)) {
+        await observeCollectionAttempt(connectorInstanceId, "batch_rejected");
         ctx.pdppError(
           res,
           409,
@@ -2698,6 +2732,7 @@ async function processDeviceIngestBatch(
     // New malformed candidates retain the historical 400, but an existing
     // device/batch reservation owns conflict precedence.
     if (!sourceConnectorMatches) {
+      await observeCollectionAttempt(connectorInstanceId, "batch_rejected");
       ctx.pdppError(res, 400, "invalid_request", "connector_id does not match source_instance_id", "connector_id");
       return;
     }
@@ -2872,6 +2907,13 @@ async function processDeviceIngestBatch(
         source_instance_id: sourceInstanceId,
         status: "accepted",
       };
+      // A newly admitted batch is an observed attempt. Record it before the
+      // acknowledgement: the device sends its terminal commit only after this
+      // response, so the commit always gets the later revision.
+      await recordCollectionRevisionEvent(connectorInstanceId, {
+        at: new Date().toISOString(),
+        event: "batch_accepted",
+      });
       maybeDeviceIngestStoreFault("before-complete-processing-batch");
       await ctx.deviceExporterStore.completeProcessingBatch({
         acceptedAt: new Date().toISOString(),
@@ -3218,6 +3260,13 @@ async function reportLocalCollectorGap(
     ...(firstSeenRunId ? { discoveredRunId: firstSeenRunId } : {}),
     ...(lastRunId ? { lastRunId } : {}),
   });
+  // A delivered failure report is an observed attempt: it retires any earlier
+  // coverage proof for this connection.
+  await recordCollectionRevisionEvent(connectorInstanceId, {
+    at: new Date().toISOString(),
+    event: "failure_report",
+    runId: lastRunId,
+  });
   res.status(201).json({
     attempt_count: gap.attempt_count,
     connector_id: connectorId,
diff --git a/reference-implementation/server/stores/collection-revision-store.ts b/reference-implementation/server/stores/collection-revision-store.ts
new file mode 100644
index 000000000..c93e7c53f
--- /dev/null
+++ b/reference-implementation/server/stores/collection-revision-store.ts
@@ -0,0 +1,292 @@
+// Copyright The PDP-Connect Contributors
+// SPDX-License-Identifier: Apache-2.0
+
+// Per-connection collection revision: a monotonic counter the server assigns,
+// at commit, to every event it can observe that can establish or retire a
+// local coverage proof. A proof binds to the revision it was committed at and
+// is current only while no later event exists. Ordering is by this counter
+// alone; the wall-clock `collection_revision_at` is display data.
+//
+// The high-water mark lives on `connector_instances`. A connection with no row
+// gets no revision (`null`), and the reader treats that as unknown.
+
+import { getDb } from "../db.ts";
+import { isPostgresStorageBackend, postgresQuery, withPostgresTransaction } from "../postgres-storage.ts";
+
+export type CollectionRevisionEvent =
+  | "batch_accepted"
+  | "batch_rejected"
+  | "failure_report"
+  | "state_commit"
+  | "terminal_run";
+
+export interface CollectionRevisionEventInput {
+  readonly at: string;
+  readonly event: CollectionRevisionEvent;
+  readonly runId?: string | null;
+}
+
+/** The newest observed collection event for one connection. */
+export interface CollectionRevisionHighWater {
+  readonly at: string | null;
+  readonly event: string | null;
+  readonly revision: number;
+  readonly runId: string | null;
+}
+
+interface SqliteHandle {
+  prepare: (sql: string) => { get: (...params: unknown[]) => unknown };
+}
+
+interface PostgresHandle {
+  query: (sql: string, params: readonly unknown[]) => Promise<{ readonly rows: readonly unknown[] }>;
+}
+
+const ADVANCE_SET = `collection_revision = collection_revision + 1,
+         collection_revision_event = ?,
+         collection_revision_run_id = ?,
+         collection_revision_at = ?`;
+
+const DECIMAL_DIGITS = /^\d+$/;
+
+/** Parse a stored revision. Anything other than a non-negative safe integer is unreadable. */
+export function readCollectionRevision(value: unknown): number | null {
+  const revision = typeof value === "string" && DECIMAL_DIGITS.test(value) ? Number(value) : value;
+  return typeof revision === "number" && Number.isSafeInteger(revision) && revision >= 0 ? revision : null;
+}
+
+/**
+ * Advance the revision on an open SQLite transaction. Returns the new revision
+ * and the connection's manifest generation, or `null` when no connection row
+ * exists.
+ */
+export function advanceSqliteCollectionRevisionInTransaction(
+  db: SqliteHandle,
+  connectorInstanceId: string,
+  input: CollectionRevisionEventInput
+): { readonly manifestGeneration: number; readonly revision: number } | null {
+  const row = db
+    .prepare(
+      `UPDATE connector_instances SET ${ADVANCE_SET}
+        WHERE connector_instance_id = ?
+        RETURNING collection_revision, manifest_generation`
+    )
+    .get(input.event, input.runId ?? null, input.at, connectorInstanceId) as
+    | { collection_revision: unknown; manifest_generation: unknown }
+    | undefined;
+  const revision = readCollectionRevision(row?.collection_revision);
+  return row && revision !== null ? { manifestGeneration: Number(row.manifest_generation ?? 0), revision } : null;
+}
+
+/**
+ * Advance the revision on an open Postgres transaction. The UPDATE takes the
+ * connection row lock first, so a caller that also needs the manifest
+ * generation reads it from here and never upgrades a FOR SHARE lock.
+ */
+export async function advancePostgresCollectionRevisionInTransaction(
+  client: PostgresHandle,
+  connectorInstanceId: string,
+  input: CollectionRevisionEventInput
+): Promise<{
+  readonly manifestGeneration: number;
+  readonly revision: number;
+} | null> {
+  const result = await client.query(
+    `UPDATE connector_instances
+        SET collection_revision = collection_revision + 1,
+            collection_revision_event = $1,
+            collection_revision_run_id = $2,
+            collection_revision_at = $3
+      WHERE connector_instance_id = $4
+      RETURNING collection_revision::text AS collection_revision, manifest_generation`,
+    [input.event, input.runId ?? null, input.at, connectorInstanceId]
+  );
+  const row = result.rows[0] as { collection_revision: unknown; manifest_generation: unknown } | undefined;
+  const revision = readCollectionRevision(row?.collection_revision);
+  return row && revision !== null ? { manifestGeneration: Number(row.manifest_generation ?? 0), revision } : null;
+}
+
+/** Record one observed event in its own transaction. */
+export async function recordCollectionRevisionEvent(
+  connectorInstanceId: string,
+  input: CollectionRevisionEventInput
+): Promise<number | null> {
+  if (isPostgresStorageBackend()) {
+    return await withPostgresTransaction(
+      async (client) =>
+        (await advancePostgresCollectionRevisionInTransaction(client as PostgresHandle, connectorInstanceId, input))
+          ?.revision ?? null
+    );
+  }
+  return advanceSqliteCollectionRevisionInTransaction(getDb(), connectorInstanceId, input)?.revision ?? null;
+}
+
+/** Batched high-water read, keyed by connector instance. Missing connections are absent from the map. */
+export async function readCollectionRevisionHighWaters(
+  connectorInstanceIds: readonly string[]
+): Promise<Map<string, CollectionRevisionHighWater>> {
+  interface Row {
+    collection_revision: unknown;
+    collection_revision_at: string | null;
+    collection_revision_event: string | null;
+    collection_revision_run_id: string | null;
+    connector_instance_id: string;
+  }
+  const rows: Row[] = [];
+  const ids = [...new Set(connectorInstanceIds)];
+  if (isPostgresStorageBackend()) {
+    const result = await postgresQuery<Row>(
+      `SELECT connector_instance_id, collection_revision::text AS collection_revision, collection_revision_event,
+              collection_revision_run_id, collection_revision_at
+         FROM connector_instances WHERE connector_instance_id = ANY($1::text[])`,
+      [ids]
+    );
+    rows.push(...result.rows);
+  } else {
+    for (let start = 0; start < ids.length; start += 900) {
+      const chunk = ids.slice(start, start + 900);
+      rows.push(
+        ...(getDb()
+          .prepare(
+            `SELECT connector_instance_id, collection_revision, collection_revision_event,
+                    collection_revision_run_id, collection_revision_at
+               FROM connector_instances WHERE connector_instance_id IN (${chunk.map(() => "?").join(", ")})`
+          )
+          .all(...chunk) as Row[])
+      );
+    }
+  }
+  const byId = new Map<string, CollectionRevisionHighWater>();
+  for (const row of rows) {
+    const revision = readCollectionRevision(row.collection_revision);
+    if (revision === null) {
+      continue;
+    }
+    byId.set(row.connector_instance_id, {
+      at: row.collection_revision_at ?? null,
+      event: row.collection_revision_event ?? null,
+      revision,
+      runId: row.collection_revision_run_id ?? null,
+    });
+  }
+  return byId;
+}
+
+/** The terminal run record the high-water mark names, read by run id rather than by completion time. */
+export interface LocalCoverageProofRun {
+  readonly completedAt: string | null;
+  readonly facts: Record<string, unknown> | null;
+  readonly runId: string;
+  readonly schedulerManaged: boolean;
+  readonly status: string;
+}
+
+/**
+ * Everything the projection needs to decide whether a local coverage proof is
+ * current. `highWater` is null when the connection has no readable revision.
+ * `legacyProofRevision` is the revision stamped on the `coverage_diagnostics`
+ * state row. `proofRun` is present only when the newest event is a terminal run.
+ */
+export interface LocalCoverageRevisionFence {
+  readonly highWater: CollectionRevisionHighWater | null;
+  readonly legacyProofRevision: number | null;
+  readonly proofRun: LocalCoverageProofRun | null;
+}
+
+function parseFacts(value: unknown): Record<string, unknown> | null {
+  let parsed = value;
+  if (typeof value === "string") {
+    try {
+      parsed = JSON.parse(value) as unknown;
+    } catch {
+      return null;
+    }
+  }
+  return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? (parsed as Record<string, unknown>) : null;
+}
+
+/** Batched fence read for one page of connections, keyed by connector instance. */
+export async function readLocalCoverageRevisionFences(
+  connectorInstanceIds: readonly string[],
+  legacyProofStream: string
+): Promise<Map<string, LocalCoverageRevisionFence>> {
+  interface Row {
+    collection_revision: unknown;
+    collection_revision_at: string | null;
+    collection_revision_event: string | null;
+    collection_revision_run_id: string | null;
+    connector_instance_id: string;
+    legacy_proof_revision: unknown;
+    proof_completed_at: string | null;
+    proof_facts_json: unknown;
+    proof_run_id: string | null;
+    proof_scheduler_managed: unknown;
+    proof_status: string | null;
+  }
+  const ids = [...new Set(connectorInstanceIds.filter((id) => typeof id === "string" && id.length > 0))];
+  const rows: Row[] = [];
+  if (ids.length === 0) {
+    return new Map();
+  }
+  const select = (revisionColumn: string, legacyColumn: string, stream: string, runTerminal: string) =>
+    `SELECT ci.connector_instance_id, ${revisionColumn} AS collection_revision, ci.collection_revision_event,
+            ci.collection_revision_run_id, ci.collection_revision_at,
+            ${legacyColumn} AS legacy_proof_revision,
+            rh.run_id AS proof_run_id, rh.status AS proof_status, rh.scheduler_managed AS proof_scheduler_managed,
+            rh.completed_at AS proof_completed_at, rh.facts_json AS proof_facts_json
+       FROM connector_instances ci
+       LEFT JOIN connector_state cs
+         ON cs.connector_instance_id = ci.connector_instance_id AND cs.stream = ${stream}
+       LEFT JOIN run_history rh
+         ON rh.connector_instance_id = ci.connector_instance_id
+        AND rh.run_id = ci.collection_revision_run_id
+        AND ci.collection_revision_event = ${runTerminal}`;
+  if (isPostgresStorageBackend()) {
+    const result = await postgresQuery<Row>(
+      `${select("ci.collection_revision::text", "cs.collection_revision::text", "$2", "$3")}
+        WHERE ci.connector_instance_id = ANY($1::text[])`,
+      [ids, legacyProofStream, "terminal_run"]
+    );
+    rows.push(...result.rows);
+  } else {
+    for (let start = 0; start < ids.length; start += 900) {
+      const chunk = ids.slice(start, start + 900);
+      rows.push(
+        ...(getDb()
+          .prepare(
+            `${select("ci.collection_revision", "cs.collection_revision", "?", "?")}
+              WHERE ci.connector_instance_id IN (${chunk.map(() => "?").join(", ")})`
+          )
+          .all(legacyProofStream, "terminal_run", ...chunk) as Row[])
+      );
+    }
+  }
+  const fences = new Map<string, LocalCoverageRevisionFence>();
+  for (const row of rows) {
+    const revision = readCollectionRevision(row.collection_revision);
+    fences.set(row.connector_instance_id, {
+      highWater:
+        revision === null
+          ? null
+          : {
+              at: row.collection_revision_at ?? null,
+              event: row.collection_revision_event ?? null,
+              revision,
+              runId: row.collection_revision_run_id ?? null,
+            },
+      legacyProofRevision:
+        row.legacy_proof_revision === null ? null : readCollectionRevision(row.legacy_proof_revision),
+      proofRun:
+        typeof row.proof_run_id === "string" && typeof row.proof_status === "string"
+          ? {
+              completedAt: row.proof_completed_at ?? null,
+              facts: parseFacts(row.proof_facts_json),
+              runId: row.proof_run_id,
+              schedulerManaged: row.proof_scheduler_managed === true || Number(row.proof_scheduler_managed) === 1,
+              status: row.proof_status,
+            }
+          : null,
+    });
+  }
+  return fences;
+}
diff --git a/reference-implementation/server/stores/connector-state-store.ts b/reference-implementation/server/stores/connector-state-store.ts
index 104909584..994ac1738 100644
--- a/reference-implementation/server/stores/connector-state-store.ts
+++ b/reference-implementation/server/stores/connector-state-store.ts
@@ -29,6 +29,10 @@ import {
   postgresQuery,
   withPostgresTransaction,
 } from "../postgres-storage.ts";
+import {
+  advancePostgresCollectionRevisionInTransaction,
+  advanceSqliteCollectionRevisionInTransaction,
+} from "./collection-revision-store.ts";
 
 export interface ConnectorStateScope {
   readonly connectorId: string;
@@ -79,6 +83,17 @@ interface SqliteTransactionHandle {
 
 export interface ConnectorStateDeltaTransactionHooks {
   readonly afterStateWrite?: (stream: string) => Promise<void> | void;
+  /** Collection revision the caller assigned to this transaction; stamped on every row it writes. */
+  readonly collectionRevision?: number | null;
+}
+
+/**
+ * A write that touches a connector stream is a state commit and gets a
+ * collection revision. The server's own `$`-prefixed rows (declared and
+ * measured scope) are not connector state and do not.
+ */
+function isCollectionStateCommit(stateByStream: ConnectorStateMap): boolean {
+  return Object.keys(stateByStream).some((stream) => !stream.startsWith("$"));
 }
 
 /** Write an owner-scoped state delta on an existing SQLite transaction. */
@@ -104,6 +119,7 @@ export function putSqliteConnectorStateDeltaInTransaction(
       JSON.stringify(cursor),
       updatedAt,
       generation,
+      hooks.collectionRevision ?? null,
     ]);
     const hookResult = hooks.afterStateWrite?.(stream);
     if (hookResult instanceof Promise) {
@@ -129,14 +145,23 @@ export async function putPostgresConnectorStateDeltaInTransaction(
   for (const [stream, cursor] of Object.entries(stateByStream)) {
     // biome-ignore lint/performance/noAwaitInLoops: writes and fault hooks must be ordered on one transaction client.
     await client.query(
-      `INSERT INTO connector_state(connector_id, connector_instance_id, stream, state_json, updated_at, manifest_generation)
-       VALUES($1, $2, $3, $4::jsonb, $5, $6)
+      `INSERT INTO connector_state(connector_id, connector_instance_id, stream, state_json, updated_at, manifest_generation, collection_revision)
+       VALUES($1, $2, $3, $4::jsonb, $5, $6, $7)
        ON CONFLICT (connector_instance_id, stream) DO UPDATE
          SET connector_id = EXCLUDED.connector_id,
              state_json = EXCLUDED.state_json,
              updated_at = EXCLUDED.updated_at,
-             manifest_generation = EXCLUDED.manifest_generation`,
-      [scope.connectorId, connectorInstanceId, stream, JSON.stringify(cursor), updatedAt, generation]
+             manifest_generation = EXCLUDED.manifest_generation,
+             collection_revision = EXCLUDED.collection_revision`,
+      [
+        scope.connectorId,
+        connectorInstanceId,
+        stream,
+        JSON.stringify(cursor),
+        updatedAt,
+        generation,
+        hooks.collectionRevision ?? null,
+      ]
     );
     await hooks.afterStateWrite?.(stream);
   }
@@ -208,9 +233,18 @@ export function createSqliteConnectorStateStore(): ConnectorStateStore {
     const grantId = scope.grantId ?? null;
     const now = new Date().toISOString();
     writeTransaction(() => {
-      const current = getDb()
-        .prepare("SELECT manifest_generation FROM connector_instances WHERE connector_instance_id = ?")
-        .get(connectorInstanceId) as { manifest_generation?: number } | undefined;
+      const advanced =
+        !grantId && isCollectionStateCommit(stateByStream)
+          ? advanceSqliteCollectionRevisionInTransaction(getDb(), connectorInstanceId, {
+              at: now,
+              event: "state_commit",
+            })
+          : null;
+      const current = advanced
+        ? { manifest_generation: advanced.manifestGeneration }
+        : (getDb()
+            .prepare("SELECT manifest_generation FROM connector_instances WHERE connector_instance_id = ?")
+            .get(connectorInstanceId) as { manifest_generation?: number } | undefined);
       // Legacy connector-keyed callers materialize state before their
       // compatibility connection exists. They are generation 0; a real
       // connection write always captures its durable current generation.
@@ -230,13 +264,22 @@ export function createSqliteConnectorStateStore(): ConnectorStateStore {
         }
         getDb()
           .prepare(
-            `INSERT INTO connector_state(connector_id, connector_instance_id, stream, state_json, updated_at, manifest_generation)
-           VALUES(?, ?, ?, ?, ?, ?)
+            `INSERT INTO connector_state(connector_id, connector_instance_id, stream, state_json, updated_at, manifest_generation, collection_revision)
+           VALUES(?, ?, ?, ?, ?, ?, ?)
            ON CONFLICT(connector_instance_id, stream) DO UPDATE SET
              connector_id = excluded.connector_id, state_json = excluded.state_json,
-             updated_at = excluded.updated_at, manifest_generation = excluded.manifest_generation`
+             updated_at = excluded.updated_at, manifest_generation = excluded.manifest_generation,
+             collection_revision = excluded.collection_revision`
           )
-          .run(connectorId, connectorInstanceId, stream, JSON.stringify(cursor), now, generation);
+          .run(
+            connectorId,
+            connectorInstanceId,
+            stream,
+            JSON.stringify(cursor),
+            now,
+            generation,
+            advanced?.revision ?? null
+          );
       }
     });
 
@@ -304,10 +347,21 @@ export function createPostgresConnectorStateStore(): ConnectorStateStore {
       const grantId = scope.grantId ?? null;
       const now = new Date().toISOString();
       await withPostgresTransaction(async (client: PostgresTransactionClient) => {
-        const current = await client.query(
-          "SELECT manifest_generation FROM connector_instances WHERE connector_instance_id = $1 FOR SHARE",
-          [connectorInstanceId]
-        );
+        // The revision UPDATE takes the connection row lock itself, so this
+        // transaction never upgrades a FOR SHARE lock to a write lock.
+        const advanced =
+          !grantId && isCollectionStateCommit(stateByStream)
+            ? await advancePostgresCollectionRevisionInTransaction(client, connectorInstanceId, {
+                at: now,
+                event: "state_commit",
+              })
+            : null;
+        const current = advanced
+          ? { rows: [{ manifest_generation: advanced.manifestGeneration }] }
+          : await client.query(
+              "SELECT manifest_generation FROM connector_instances WHERE connector_instance_id = $1 FOR SHARE",
+              [connectorInstanceId]
+            );
         const generation = Number(current.rows[0]?.manifest_generation ?? 0);
         for (const [stream, cursor] of Object.entries(stateByStream)) {
           if (grantId) {
@@ -324,13 +378,22 @@ export function createPostgresConnectorStateStore(): ConnectorStateStore {
             continue;
           }
           await client.query(
-            `INSERT INTO connector_state(connector_id, connector_instance_id, stream, state_json, updated_at, manifest_generation)
-           VALUES($1, $2, $3, $4::jsonb, $5, $6)
+            `INSERT INTO connector_state(connector_id, connector_instance_id, stream, state_json, updated_at, manifest_generation, collection_revision)
+           VALUES($1, $2, $3, $4::jsonb, $5, $6, $7)
            ON CONFLICT (connector_instance_id, stream) DO UPDATE
              SET connector_id = EXCLUDED.connector_id,
                  state_json = EXCLUDED.state_json,
-                 updated_at = EXCLUDED.updated_at, manifest_generation = EXCLUDED.manifest_generation`,
-            [connectorId, connectorInstanceId, stream, JSON.stringify(cursor), now, generation]
+                 updated_at = EXCLUDED.updated_at, manifest_generation = EXCLUDED.manifest_generation,
+                 collection_revision = EXCLUDED.collection_revision`,
+            [
+              connectorId,
+              connectorInstanceId,
+              stream,
+              JSON.stringify(cursor),
+              now,
+              generation,
+              advanced?.revision ?? null,
+            ]
           );
         }
       });
diff --git a/reference-implementation/server/stores/run-history-writer.ts b/reference-implementation/server/stores/run-history-writer.ts
index c0fc25949..e2f9e3b09 100644
--- a/reference-implementation/server/stores/run-history-writer.ts
+++ b/reference-implementation/server/stores/run-history-writer.ts
@@ -125,6 +125,10 @@ function toTerminalStatus(eventType: string, status: string): string {
 // `readRunTerminalEventData` spine read on GET (G1).
 const FACTS_JSON_KEYS = [
   "collection_facts",
+  // The per-connection collection revision a local terminal run committed at
+  // (server/stores/collection-revision-store.ts). The coverage projection
+  // binds the run's proof to it.
+  "collection_revision",
   "needs_input",
   // Preserve presence separately from the schema's records_emitted DEFAULT 0.
   // A missing runtime field is not evidence of zero yield.
diff --git a/reference-implementation/server/stores/terminal-run-commit-store.ts b/reference-implementation/server/stores/terminal-run-commit-store.ts
index 36df1bcd9..fc0b48bef 100644
--- a/reference-implementation/server/stores/terminal-run-commit-store.ts
+++ b/reference-implementation/server/stores/terminal-run-commit-store.ts
@@ -7,6 +7,10 @@ import { appendPostgresSpineEventInTransaction, type PostgresSpineEventInput } f
 import { appendSqliteSpineEventInTransaction, type SpineDatabase, type SpineEventInput } from "../../lib/spine.ts";
 import { getDb } from "../db.ts";
 import { isPostgresStorageBackend, withPostgresTransaction } from "../postgres-storage.ts";
+import {
+  advancePostgresCollectionRevisionInTransaction,
+  advanceSqliteCollectionRevisionInTransaction,
+} from "./collection-revision-store.ts";
 import {
   putPostgresConnectorStateDeltaInTransaction,
   putSqliteConnectorStateDeltaInTransaction,
@@ -87,12 +91,16 @@ function eventInputFor(
   input: ResolvedTerminalRunCommit,
   eventId: string,
   response: TerminalRunCommitResponse,
-  occurredAt: string
+  occurredAt: string,
+  collectionRevision: number | null
 ): SpineEventInput & PostgresSpineEventInput {
   return {
     actor_id: input.deviceId,
     actor_type: "local_device",
     data: {
+      // The connection revision this run, and the state it wrote, were
+      // committed at. A proof is current only while it is the high-water mark.
+      collection_revision: collectionRevision,
       collection_facts: {
         collection_scope: input.collectionBoundary,
         reference_only: true,
@@ -188,15 +196,24 @@ function commitSqlite(input: ResolvedTerminalRunCommit): TerminalRunCommitResult
 
     const occurredAt = new Date().toISOString();
     const response = responseFor(input, eventId);
+    const collectionRevision =
+      advanceSqliteCollectionRevisionInTransaction(db, input.connectorInstanceId, {
+        at: occurredAt,
+        event: "terminal_run",
+        runId: input.runId,
+      })?.revision ?? null;
     putSqliteConnectorStateDeltaInTransaction(
       db,
       { connectorId: input.connectorId, connectorInstanceId: input.connectorInstanceId },
       input.stateDelta,
       occurredAt,
-      { afterStateWrite: (stream) => maybeFault(`after_state_write:${stream}`) }
+      {
+        afterStateWrite: (stream) => maybeFault(`after_state_write:${stream}`),
+        collectionRevision,
+      }
     );
     appendSqliteSpineEventInTransaction(
-      eventInputFor(input, eventId, response, occurredAt),
+      eventInputFor(input, eventId, response, occurredAt, collectionRevision),
       db as unknown as SpineDatabase,
       {
         afterEventInsert: () => maybeFault("after_event_insert"),
@@ -254,14 +271,26 @@ async function commitPostgres(input: ResolvedTerminalRunCommit): Promise<Termina
 
       const occurredAt = new Date().toISOString();
       const response = responseFor(input, eventId);
+      const collectionRevision =
+        (
+          await advancePostgresCollectionRevisionInTransaction(client, input.connectorInstanceId, {
+            at: occurredAt,
+            event: "terminal_run",
+            runId: input.runId,
+          })
+        )?.revision ?? null;
       await putPostgresConnectorStateDeltaInTransaction(
         client,
         { connectorId: input.connectorId, connectorInstanceId: input.connectorInstanceId },
         input.stateDelta,
         occurredAt,
-        { afterStateWrite: (stream) => maybeFault(`after_state_write:${stream}`) }
+        {
+          afterStateWrite: (stream) => maybeFault(`after_state_write:${stream}`),
+          collectionRevision,
+        }
       );
-      await appendPostgresSpineEventInTransaction(client, eventInputFor(input, eventId, response, occurredAt), {
+      const event = eventInputFor(input, eventId, response, occurredAt, collectionRevision);
+      await appendPostgresSpineEventInTransaction(client, event, {
         afterEventInsert: () => maybeFault("after_event_insert"),
         afterRunHistoryWrite: () => maybeFault("after_run_history_write"),
       });
diff --git a/reference-implementation/test/helpers/install-path-fixture.ts b/reference-implementation/test/helpers/install-path-fixture.ts
index d78155edd..5ec05fecb 100644
--- a/reference-implementation/test/helpers/install-path-fixture.ts
+++ b/reference-implementation/test/helpers/install-path-fixture.ts
@@ -72,6 +72,18 @@ process.stdin.on("end", () => {
     emit({ records_emitted: 0, status: "succeeded", type: "DONE" });
     return;
   }
+  if (mode === "crash") {
+    // The child dies mid-scan, before STATE or DONE.
+    record("sessions", "s-crash");
+    process.exit(3);
+  }
+  if (mode === "state") {
+    // A successful run that commits STATE and makes no coverage claim.
+    record("sessions", "s-1");
+    emit({ cursor: { cursor: tag + "-sessions" }, stream: "sessions", type: "STATE" });
+    emit({ records_emitted: 1, status: "succeeded", type: "DONE" });
+    return;
+  }
   if (mode === "reject") {
     // A stream the connector manifest does not declare: the server refuses the batch.
     record("sessions", "s-1");
diff --git a/reference-implementation/test/local-device-coverage-journey.test.ts b/reference-implementation/test/local-device-coverage-journey.test.ts
index af5dea9bd..67c047ea8 100644
--- a/reference-implementation/test/local-device-coverage-journey.test.ts
+++ b/reference-implementation/test/local-device-coverage-journey.test.ts
@@ -141,7 +141,10 @@ interface Journey extends Lane {
 
 /** The fields of a collection profile the lane reads. */
 interface ReleaseProfile {
-  readonly streams: readonly { readonly coverage_stores: readonly string[]; readonly name: string }[];
+  readonly streams: readonly {
+    readonly coverage_stores: readonly string[];
+    readonly name: string;
+  }[];
   readonly [key: string]: unknown;
 }
 
@@ -155,9 +158,20 @@ interface ProjectedStream {
   readonly stream: string;
 }
 
+interface CoverageAsOf {
+  readonly artifact_digest: string | null;
+  readonly collection_revision: number;
+  readonly committed_at: string | null;
+  readonly evidence: string;
+  readonly run_id: string | null;
+}
+
 interface OwnerConnectionRow {
   readonly collection_report: readonly ProjectedStream[];
-  readonly connection_health: { readonly axes: { readonly coverage: string; readonly outbox: string } };
+  readonly connection_health: {
+    readonly axes: { readonly coverage: string; readonly outbox: string };
+  };
+  readonly coverage_as_of: CoverageAsOf | null;
 }
 
 async function requestJson(url: string, init: RequestInit = {}): Promise<JsonResponse> {
@@ -240,7 +254,9 @@ function registerFixtureManifest(connectorInstanceId: string, profile: ReleasePr
     | { manifest: string }
     | undefined;
   assert.ok(row, "enrolment registers the claude-code catalog manifest");
-  const catalog = JSON.parse(row.manifest) as Record<string, unknown> & { streams: Record<string, unknown>[] };
+  const catalog = JSON.parse(row.manifest) as Record<string, unknown> & {
+    streams: Record<string, unknown>[];
+  };
   const streams = profile.streams.map((release) => {
     const declared = catalog.streams.find((stream) => stream.name === release.name);
     assert.ok(declared, `the catalog declares ${release.name}`);
@@ -353,7 +369,9 @@ function serverRunStreams(runId: string): Record<string, unknown>[] | null {
   if (!row) {
     return null;
   }
-  const facts = JSON.parse(row.facts_json) as { collection_facts?: { streams?: Record<string, unknown>[] } };
+  const facts = JSON.parse(row.facts_json) as {
+    collection_facts?: { streams?: Record<string, unknown>[] };
+  };
   return facts.collection_facts?.streams ?? [];
 }
 
@@ -377,7 +395,10 @@ function serverRecordCount(journey: Lane, stream: string): number {
 function serverCursors(journey: Lane): Record<string, unknown> {
   const rows = getDb()
     .prepare("SELECT stream, state_json FROM connector_state WHERE connector_instance_id = ? ORDER BY stream")
-    .all(journey.enrolled.connector_instance_id) as Array<{ state_json: string; stream: string }>;
+    .all(journey.enrolled.connector_instance_id) as Array<{
+    state_json: string;
+    stream: string;
+  }>;
   return Object.fromEntries(
     rows.filter((row) => !row.stream.startsWith("$")).map((row) => [row.stream, JSON.parse(row.state_json) as unknown])
   );
@@ -404,9 +425,48 @@ async function ownerConnectionRow(journey: Lane): Promise<OwnerConnectionRow> {
     (row as unknown as OwnerConnectionRow).connection_health.axes.coverage,
     "list and detail agree on coverage"
   );
+  assert.deepEqual(detail.body?.coverage_as_of, row.coverage_as_of, "list and detail carry the same as-of");
   return row as unknown as OwnerConnectionRow;
 }
 
+/** The connection's collection revision high-water mark, as the server stored it. */
+function serverRevision(journey: Lane): number {
+  const row = getDb()
+    .prepare("SELECT collection_revision FROM connector_instances WHERE connector_instance_id = ?")
+    .get(journey.enrolled.connector_instance_id) as { collection_revision: number } | undefined;
+  assert.ok(row, "the connection carries a collection revision");
+  return Number(row.collection_revision);
+}
+
+/** The kind of the newest collection event the server observed for the lane. */
+function lastCollectionEvent(journey: Lane): string | null {
+  const row = getDb()
+    .prepare("SELECT collection_revision_event AS event FROM connector_instances WHERE connector_instance_id = ?")
+    .get(journey.enrolled.connector_instance_id) as { event: string | null } | undefined;
+  return row?.event ?? null;
+}
+
+/** The terminal commit time the server stored for one run. */
+function serverRunCommittedAt(runId: string): string {
+  const row = getDb().prepare("SELECT completed_at FROM run_history WHERE run_id = ?").get(runId) as
+    | { completed_at: string | null }
+    | undefined;
+  assert.ok(row?.completed_at, `the server stored a completion time for ${runId}`);
+  return row.completed_at;
+}
+
+/** Shown coverage is a fact about one run: its id, release digest, revision and commit time. */
+function assertCoverageAsOf(journey: Lane, owner: OwnerConnectionRow, runId: string): void {
+  assert.equal(owner.coverage_as_of?.run_id, runId, "the shown coverage names the run it is a fact about");
+  assert.deepEqual(owner.coverage_as_of, {
+    artifact_digest: ARTIFACT_DIGEST,
+    collection_revision: serverRevision(journey),
+    committed_at: serverRunCommittedAt(runId),
+    evidence: "terminal_run",
+    run_id: runId,
+  });
+}
+
 function conditions(row: OwnerConnectionRow): Record<string, string> {
   return Object.fromEntries(row.collection_report.map((entry) => [entry.stream, entry.coverage_condition]));
 }
@@ -438,7 +498,11 @@ test("J1: a registered release's run coverage crosses child, runner, server and
     }
     const aOwner = await ownerConnectionRow(journey);
     assert.equal(aOwner.connection_health.axes.coverage, "complete");
-    assert.deepEqual(conditions(aOwner), { messages: "complete", sessions: "complete" });
+    assert.deepEqual(conditions(aOwner), {
+      messages: "complete",
+      sessions: "complete",
+    });
+    assertCoverageAsOf(journey, aOwner, "a-complete");
     const aDevice = deviceStatus(journey);
     assert.equal(aDevice.terminal_coverage.verdict, "covered");
     assert.equal(aDevice.lifecycle_state, "covered");
@@ -467,6 +531,7 @@ test("J1: a registered release's run coverage crosses child, runner, server and
     const bOwner = await ownerConnectionRow(journey);
     assert.notEqual(conditions(bOwner).messages, "complete", "the skipped stream is not complete on the server");
     assert.equal(conditions(bOwner).sessions, "complete", "the stream without a skip stays complete");
+    assertCoverageAsOf(journey, bOwner, "b-skip");
     const bDevice = deviceStatus(journey);
     assert.equal(bDevice.terminal_coverage.verdict, "incomplete");
     assert.equal(bDevice.lifecycle_state, "coverage_incomplete");
@@ -476,7 +541,9 @@ test("J1: a registered release's run coverage crosses child, runner, server and
     // Run A again: a clean run restores complete coverage on both sides.
     const restored = await runOnce(journey, "complete", "a-restored");
     assert.equal(restored.result.done?.status, "succeeded");
-    assert.equal((await ownerConnectionRow(journey)).connection_health.axes.coverage, "complete");
+    const restoredOwner = await ownerConnectionRow(journey);
+    assert.equal(restoredOwner.connection_health.axes.coverage, "complete");
+    assertCoverageAsOf(journey, restoredOwner, "a-restored");
     assert.equal(deviceStatus(journey).lifecycle_state, "covered");
 
     // Run C: a negotiated success with no coverage claim and no records.
@@ -492,7 +559,11 @@ test("J1: a registered release's run coverage crosses child, runner, server and
     );
     const cOwner = await ownerConnectionRow(journey);
     assert.equal(cOwner.connection_health.axes.coverage, "unknown", "the empty report retires the earlier proof");
-    assert.deepEqual(conditions(cOwner), { messages: "unknown", sessions: "unknown" });
+    assert.deepEqual(conditions(cOwner), {
+      messages: "unknown",
+      sessions: "unknown",
+    });
+    assert.equal(cOwner.coverage_as_of, null, "unknown coverage carries no as-of");
     const cDevice = deviceStatus(journey);
     assert.equal(cDevice.terminal_coverage.verdict, "no_evidence");
     assert.equal(cDevice.lifecycle_state, "no_evidence");
@@ -536,7 +607,7 @@ test("B2: a server-rejected record stays unadmitted, moves no cursor, and leaves
   });
 });
 
-test("J2: a run the server rejects after a covered run leaves the lane not covered", async () => {
+test("J2: a batch the server receives and rejects after a covered run retires the proof on server and device", async () => {
   await withJourney(async (journey) => {
     // Run A: a clean complete run. The device holds a covered receipt and the server projects complete.
     const a = await runOnce(journey, "complete", "a-complete");
@@ -545,8 +616,7 @@ test("J2: a run the server rejects after a covered run leaves the lane not cover
     assert.equal((await ownerConnectionRow(journey)).connection_health.axes.coverage, "complete");
 
     // Run B: the server refuses its record batch (an undeclared stream), so nothing from B is admitted.
-    // The batch stays ready for retry and run B's terminal commit waits behind it, so the server never
-    // receives a terminal commit for run B.
+    // The batch stays ready for retry and run B's terminal commit waits behind it.
     const b = await runOnce(journey, "reject", "b-reject");
     assert.equal(b.result.done?.status, "succeeded", "the child finished; the server refused its batch");
     assert.equal(serverRunStreams("b-reject"), null, "the server acknowledged no terminal commit for run B");
@@ -557,14 +627,17 @@ test("J2: a run the server rejects after a covered run leaves the lane not cover
     assert.equal(status.terminal_coverage.verdict, "unadmitted");
     assert.equal(status.lifecycle_state, "draining");
 
-    // The server never learns of run B as a run: nothing from B was admitted and its terminal commit never
-    // arrived, so the server holds no run-level record for B. Its coverage still reflects run A's admitted
-    // terminal commit, and its outbox axis shows the lane has not drained. Only the device reports run B as
-    // unadmitted.
+    // The server received run B's batch and refused it. That observed attempt is a later revision than
+    // run A's proof, so run A's coverage is no longer current: the server projects unknown.
     const owner = await ownerConnectionRow(journey);
-    assert.equal(owner.connection_health.axes.coverage, "complete");
-    assert.deepEqual(conditions(owner), { messages: "complete", sessions: "complete" });
+    assert.equal(owner.connection_health.axes.coverage, "unknown");
+    assert.deepEqual(conditions(owner), {
+      messages: "unknown",
+      sessions: "unknown",
+    });
+    assert.equal(owner.coverage_as_of, null);
     assert.equal(owner.connection_health.axes.outbox, "active");
+    assert.equal(lastCollectionEvent(journey), "batch_rejected", "the newest observed event is the refused batch");
   });
 });
 
@@ -593,19 +666,104 @@ test("J3: a run that fails before its scan leaves the lane not covered; the serv
     // The server never admitted run B, so its projection still reflects run A's admitted terminal commit.
     // Its outbox axis shows run A's last healthy heartbeat, because the refusal left the server nothing to
     // record. The owner projection and the device verdict disagree until a later run reaches the server.
+    // This is the documented limit: the owner sees run A's coverage, labelled as a fact about run A.
     const owner = await ownerConnectionRow(journey);
     assert.equal(owner.connection_health.axes.coverage, "complete");
     assert.equal(owner.connection_health.axes.outbox, "idle");
-    assert.deepEqual(conditions(owner), { messages: "complete", sessions: "complete" });
+    assert.deepEqual(conditions(owner), {
+      messages: "complete",
+      sessions: "complete",
+    });
+    assertCoverageAsOf(journey, owner, "a-complete");
 
     // Run C: a clean run. Its pre-scan drain delivers run B's gap, and its complete pass recovers it.
     const c = await runOnce(journey, "complete", "c-complete");
     assert.equal(c.result.done?.status, "succeeded");
     assert.equal(deviceStatus(journey).terminal_coverage.verdict, "covered");
+    const cOwner = await ownerConnectionRow(journey);
+    assert.equal(cOwner.connection_health.axes.coverage, "complete");
+    assertCoverageAsOf(journey, cOwner, "c-complete");
+  });
+});
+
+test("J4: a failure report the server receives after a covered run retires the proof", async () => {
+  await withJourney(async (journey) => {
+    const a = await runOnce(journey, "complete", "a-complete");
+    assert.equal(a.result.done?.status, "succeeded");
     assert.equal((await ownerConnectionRow(journey)).connection_health.axes.coverage, "complete");
+
+    // Run B: refused before its scan. The server hears nothing, and the device holds B's failure gap.
+    await assert.rejects(
+      runOnce(journey, "complete", "b-refused", {
+        deviceToken: "refused-device-token",
+      }),
+      (error: unknown) => error instanceof LocalDeviceHttpError && error.status === 401
+    );
+    assert.equal((await ownerConnectionRow(journey)).connection_health.axes.coverage, "complete");
+
+    // Run C: its pre-scan drain delivers run B's failure gap to the server, then its child crashes.
+    // Nothing later than the failure report reaches the server.
+    await assert.rejects(runOnce(journey, "crash", "c-crash"));
+    const gaps = getDb()
+      .prepare(
+        "SELECT COUNT(*) AS n FROM connector_detail_gaps WHERE connector_instance_id = ? AND stream LIKE 'local-collector/connector_child_failure%'"
+      )
+      .get(journey.enrolled.connector_instance_id) as { n: number };
+    assert.ok(gaps.n >= 1, "the server received the failure report");
+
+    // Run A's proof is retired: every stream reads unknown and no as-of backs the row. The delivered
+    // report is also a known retryable gap, which the connection axis ranks worse than unknown.
+    const owner = await ownerConnectionRow(journey);
+    assert.deepEqual(conditions(owner), {
+      messages: "unknown",
+      sessions: "unknown",
+    });
+    assert.equal(owner.coverage_as_of, null, "run A's proof no longer backs the shown coverage");
+    assert.equal(owner.connection_health.axes.coverage, "retryable_gap");
+    assert.notEqual(deviceStatus(journey).terminal_coverage.verdict, "covered");
+    assert.equal(lastCollectionEvent(journey), "failure_report", "the newest observed event is the failure report");
   });
 });
 
+for (const mode of ["empty", "state"] as const) {
+  test(`U: after a covered run, an unnegotiated success ${mode === "state" ? "with" : "without"} STATE retires the proof on server and device`, async () => {
+    await withJourney(async (journey) => {
+      const a = await runOnce(journey, "complete", "a-complete");
+      assert.equal(a.result.done?.status, "succeeded");
+      assert.equal(deviceStatus(journey).terminal_coverage.verdict, "covered");
+      assert.equal((await ownerConnectionRow(journey)).connection_health.axes.coverage, "complete");
+
+      // Run B: coverage is not negotiated. The runtime still commits B's terminal run record.
+      const b = await runOnce(journey, mode, `b-${mode}`, {
+        negotiateCoverage: false,
+      });
+      assert.equal(b.observed.run_coverage_version, undefined, "START did not negotiate coverage");
+      assert.equal(b.result.done?.status, "succeeded");
+      const bStreams = serverRunStreams(`b-${mode}`);
+      assert.ok(bStreams, "the server committed run B's terminal run record");
+      assertJourneyStreams(bStreams);
+      assert.ok(
+        bStreams.every((stream) => JSON.stringify(stream.coverage_statuses) === '["unknown"]'),
+        "run B's record carries no coverage evidence"
+      );
+      if (mode === "state") {
+        assert.deepEqual(serverCursors(journey).sessions, { cursor: "b-state-sessions" }, "run B's STATE committed");
+      }
+
+      const owner = await ownerConnectionRow(journey);
+      assert.equal(owner.connection_health.axes.coverage, "unknown");
+      assert.deepEqual(conditions(owner), {
+        messages: "unknown",
+        sessions: "unknown",
+      });
+      assert.equal(owner.coverage_as_of, null);
+      const status = deviceStatus(journey);
+      assert.equal(status.terminal_coverage.verdict, "no_evidence");
+      assert.deepEqual(deviceReceiptFacts(journey), []);
+    });
+  });
+}
+
 // ---- J2-install: the same lane, with its child installed through the shipped path ---------------
 //
 // The lane is J1's, but the child is the installed entrypoint of a release pulled from a real OCI
diff --git a/reference-implementation/test/local-device-coverage-stale-proof.test.ts b/reference-implementation/test/local-device-coverage-stale-proof.test.ts
index 8a21b0986..a7d0e48a7 100644
--- a/reference-implementation/test/local-device-coverage-stale-proof.test.ts
+++ b/reference-implementation/test/local-device-coverage-stale-proof.test.ts
@@ -1,27 +1,26 @@
 // Copyright The PDP-Connect Contributors
 // SPDX-License-Identifier: Apache-2.0
 
-// Stale terminal proof. A negotiated run commits a v2 terminal proof for every
-// requested stream. A later successful run that did not negotiate run coverage
-// then reaches the server with no terminal evidence. The server must not keep
-// projecting the older proof as covered once a later state commit exists that
-// the proof does not account for.
+// Stale terminal proof, fenced by the per-connection collection revision. The
+// server assigns every event that can establish or retire a local coverage
+// proof a monotonic revision at commit. A proof is current only while its
+// revision is the connection's high-water mark. No wall clock takes part.
 //
 // Two layers:
 //
-//   - Store-level boundary tests with an injected clock. They pin the ordering
-//     rule: a state commit strictly after the proof retires it; one at the same
-//     instant (the proof's own transaction) or before it does not.
+//   - Store-level tests with an injected clock. They pin that ordering follows
+//     the revision, not the timestamp: a distinct commit at the proof's own
+//     instant retires it, a commit after a clock rollback retires it, a commit
+//     before the proof does not retire it even when the clock had run ahead,
+//     and a newer proof wins even when its clock reads earlier. They also pin
+//     the as-of the projection carries and the fail-closed cases.
 //   - End-to-end journey through the real collector runner, the reference
 //     server, and the HTTP owner list and detail routes, as in
 //     local-device-coverage-journey.test.ts. Run B is unnegotiated and runs on a
 //     fresh device outbox, so the device holds no local receipt for it. The
-//     server projection must not depend on that device state.
-//
-// The journey has one limit that the server cannot close on its own. An
-// unnegotiated run that commits no state and no terminal record leaves nothing
-// the server can order against the proof. That case is pinned below as a
-// known limit, not a fix.
+//     server projection must not depend on that device state. A runtime that
+//     implements this profile version commits a terminal run record for every
+//     successful run, so run B retires run A's proof with or without STATE.
 
 // The local-collector bin reaches the untyped installer core. This names the
 // local collector's own shim for it, which the reference-implementation program
@@ -163,7 +162,9 @@ interface ProjectedStream {
 
 interface OwnerConnectionRow {
   readonly collection_report: readonly ProjectedStream[];
-  readonly connection_health: { readonly axes: { readonly coverage: string; readonly outbox: string } };
+  readonly connection_health: {
+    readonly axes: { readonly coverage: string; readonly outbox: string };
+  };
 }
 
 async function requestJson(url: string, init: RequestInit = {}): Promise<JsonResponse> {
@@ -243,7 +244,9 @@ function registerFixtureManifest(connectorInstanceId: string): void {
     | { manifest: string }
     | undefined;
   assert.ok(row, "enrolment registers the claude-code catalog manifest");
-  const catalog = JSON.parse(row.manifest) as Record<string, unknown> & { streams: Record<string, unknown>[] };
+  const catalog = JSON.parse(row.manifest) as Record<string, unknown> & {
+    streams: Record<string, unknown>[];
+  };
   const streams = PROFILE.streams.map((release) => {
     const declared = catalog.streams.find((stream) => stream.name === release.name);
     assert.ok(declared, `the catalog declares ${release.name}`);
@@ -333,15 +336,34 @@ function serverRunStreams(runId: string): Record<string, unknown>[] | null {
   if (!row) {
     return null;
   }
-  const facts = JSON.parse(row.facts_json) as { collection_facts?: { streams?: Record<string, unknown>[] } };
+  const facts = JSON.parse(row.facts_json) as {
+    collection_facts?: { streams?: Record<string, unknown>[] };
+  };
   return facts.collection_facts?.streams ?? [];
 }
 
+/** A successful run without coverage evidence commits a terminal record whose every stream is unknown. */
+function assertNoEvidenceTerminalRecord(runId: string): void {
+  const streams = serverRunStreams(runId);
+  assert.ok(streams, `the server committed a terminal record for ${runId}`);
+  assert.deepEqual(
+    streams.map((stream) => [stream.stream, stream.coverage_statuses]),
+    [
+      ["messages", ["unknown"]],
+      ["sessions", ["unknown"]],
+    ],
+    "the record carries no coverage evidence"
+  );
+}
+
 /** Stream cursors only. The `$`-prefixed rows are the server's own collection-scope state, not connector cursors. */
 function serverCursors(journey: Journey): Record<string, unknown> {
   const rows = getDb()
     .prepare("SELECT stream, state_json FROM connector_state WHERE connector_instance_id = ? ORDER BY stream")
-    .all(journey.enrolled.connector_instance_id) as Array<{ state_json: string; stream: string }>;
+    .all(journey.enrolled.connector_instance_id) as Array<{
+    state_json: string;
+    stream: string;
+  }>;
   return Object.fromEntries(
     rows.filter((row) => !row.stream.startsWith("$")).map((row) => [row.stream, JSON.parse(row.state_json) as unknown])
   );
@@ -533,56 +555,153 @@ async function seedV2Proof(runId: string): Promise<void> {
   });
 }
 
-async function boundaryProjection(): Promise<{ axis: string; conditions: Record<string, string> }> {
+async function boundaryProjection(): Promise<{
+  asOf: Record<string, unknown> | null;
+  axis: string;
+  conditions: Record<string, string>;
+}> {
   await reconcileDirtyConnectorSummaryEvidence(null);
   const summary = (await listConnectorSummaries()).find((row) => row.connector_instance_id === connectorInstanceId);
   assert.ok(summary, "the boundary connection is projected");
   return {
+    asOf: (summary.coverage_as_of as Record<string, unknown> | null) ?? null,
     axis: summary.connection_health.axes.coverage,
     conditions: Object.fromEntries(summary.collection_report.map((entry) => [entry.stream, entry.coverage_condition])),
   };
 }
 
-const BOUNDARY_TARGET = { connector_id: connectorId, connector_instance_id: connectorInstanceId };
+/** The connection's collection revision high-water mark, as the server stored it. */
+function highWaterRevision(): number {
+  const row = getDb()
+    .prepare("SELECT collection_revision FROM connector_instances WHERE connector_instance_id = ?")
+    .get(connectorInstanceId) as { collection_revision: number } | undefined;
+  assert.ok(row, "the boundary connection has a revision row");
+  return Number(row.collection_revision);
+}
+
+const BOUNDARY_TARGET = {
+  connector_id: connectorId,
+  connector_instance_id: connectorInstanceId,
+};
+const COMPLETE = { messages: "complete", sessions: "complete" };
+const UNKNOWN = { messages: "unknown", sessions: "unknown" };
 
-test("store: a state commit at the proof's own instant does not retire it; a strictly later one does", async (t) => {
+test("revision: a distinct state commit at the proof's own instant retires it", async (t) => {
   await withBoundaryConnection(async () => {
     t.mock.timers.enable({ apis: ["Date"], now: Date.parse(PROOF_AT) });
     await seedV2Proof("run_boundary_proof");
-    assert.deepEqual(await boundaryProjection(), {
-      axis: "complete",
-      conditions: { messages: "complete", sessions: "complete" },
-    });
+    assert.deepEqual((await boundaryProjection()).conditions, COMPLETE);
 
-    // The same instant as the proof: nothing is later than the proof's own commit.
-    await putSyncState(BOUNDARY_TARGET, { messages: { cursor: "same-instant" } });
-    assert.equal((await boundaryProjection()).axis, "complete", "a same-instant state commit is not later");
+    // The same wall-clock instant, but a separate commit: the proof does not account for it.
+    await putSyncState(BOUNDARY_TARGET, {
+      messages: { cursor: "same-instant" },
+    });
+    const projected = await boundaryProjection();
+    assert.equal(projected.axis, "unknown", "an equal timestamp is not the proof's own transaction");
+    assert.deepEqual(projected.conditions, UNKNOWN);
+    assert.equal(projected.asOf, null, "retired coverage carries no as-of");
+  });
+});
 
-    // One millisecond later: a state commit the proof does not account for.
-    t.mock.timers.setTime(Date.parse(PROOF_AT) + 1);
-    await putSyncState(BOUNDARY_TARGET, { messages: { cursor: "later" } });
-    assert.deepEqual(await boundaryProjection(), {
-      axis: "unknown",
-      conditions: { messages: "unknown", sessions: "unknown" },
+test("revision: a later state commit retires the proof when the server clock has gone back", async (t) => {
+  await withBoundaryConnection(async () => {
+    t.mock.timers.enable({ apis: ["Date"], now: Date.parse(PROOF_AT) });
+    await seedV2Proof("run_boundary_proof");
+    t.mock.timers.setTime(Date.parse(PROOF_AT) - 3_600_000);
+    await putSyncState(BOUNDARY_TARGET, {
+      messages: { cursor: "after-clock-rollback" },
     });
+    assert.deepEqual((await boundaryProjection()).conditions, UNKNOWN);
   });
 });
 
-test("store: a state commit before the proof does not retire it", async (t) => {
+test("revision: a state commit before the proof does not retire it when the clock had run ahead", async (t) => {
   await withBoundaryConnection(async () => {
-    t.mock.timers.enable({ apis: ["Date"], now: Date.parse("2026-10-22T09:30:00.000Z") });
-    await putSyncState(BOUNDARY_TARGET, { messages: { cursor: "earlier" } });
+    t.mock.timers.enable({
+      apis: ["Date"],
+      now: Date.parse(PROOF_AT) + 3_600_000,
+    });
+    await putSyncState(BOUNDARY_TARGET, {
+      messages: { cursor: "before-proof-skewed-ahead" },
+    });
     t.mock.timers.setTime(Date.parse(PROOF_AT));
-    await seedV2Proof("run_boundary_after_earlier_state");
-    assert.equal((await boundaryProjection()).axis, "complete");
+    await seedV2Proof("run_boundary_after_skewed_state");
+    const projected = await boundaryProjection();
+    assert.deepEqual(projected.conditions, COMPLETE);
+    assert.equal(projected.asOf?.run_id, "run_boundary_after_skewed_state");
+  });
+});
+
+test("revision: a newer proof committed with the clock set back is the current proof", async (t) => {
+  await withBoundaryConnection(async () => {
+    t.mock.timers.enable({ apis: ["Date"], now: Date.parse(PROOF_AT) });
+    await seedV2Proof("run_a_before_rollback");
+    t.mock.timers.setTime(Date.parse(PROOF_AT) - 3_600_000);
+    await seedV2Proof("run_b_after_rollback");
+    const projected = await boundaryProjection();
+    assert.deepEqual(projected.conditions, COMPLETE);
+    assert.equal(projected.asOf?.run_id, "run_b_after_rollback", "the newest revision wins, not the newest clock");
+    assert.equal(projected.asOf?.committed_at, new Date(Date.parse(PROOF_AT) - 3_600_000).toISOString());
+  });
+});
+
+test("as-of: a shown proof carries its run id, release digest, revision and commit time", async (t) => {
+  await withBoundaryConnection(async () => {
+    t.mock.timers.enable({ apis: ["Date"], now: Date.parse(PROOF_AT) });
+    await seedV2Proof("run_as_of");
+    const release = readLocalCollectorRelease(connectorId);
+    assert.ok(release);
+    const projected = await boundaryProjection();
+    assert.equal(projected.axis, "complete");
+    assert.equal(projected.asOf?.run_id, "run_as_of", "the shown coverage names its run");
+    assert.deepEqual(projected.asOf, {
+      artifact_digest: release.artifactDigest,
+      collection_revision: highWaterRevision(),
+      committed_at: PROOF_AT,
+      evidence: "terminal_run",
+      run_id: "run_as_of",
+    });
   });
 });
 
+test("revision: an unreadable or mismatched revision fails closed", async (t) => {
+  for (const tamper of ["drop proof revision", "high-water below proof", "high-water names another run"] as const) {
+    // biome-ignore lint/performance/noAwaitInLoops: each case needs its own fresh database, one after another.
+    await withBoundaryConnection(async () => {
+      t.mock.timers.enable({ apis: ["Date"], now: Date.parse(PROOF_AT) });
+      await seedV2Proof("run_fail_closed");
+      assert.equal((await boundaryProjection()).axis, "complete", tamper);
+      if (tamper === "drop proof revision") {
+        getDb()
+          .prepare(
+            "UPDATE run_history SET facts_json = json_remove(facts_json, '$.collection_revision') WHERE run_id = ?"
+          )
+          .run("run_fail_closed");
+      } else if (tamper === "high-water below proof") {
+        getDb()
+          .prepare(
+            "UPDATE connector_instances SET collection_revision = collection_revision - 1 WHERE connector_instance_id = ?"
+          )
+          .run(connectorInstanceId);
+      } else {
+        getDb()
+          .prepare("UPDATE connector_instances SET collection_revision_run_id = ? WHERE connector_instance_id = ?")
+          .run("run_other", connectorInstanceId);
+      }
+      const projected = await boundaryProjection();
+      assert.deepEqual(projected.conditions, UNKNOWN, tamper);
+      assert.equal(projected.asOf, null, tamper);
+      t.mock.timers.reset();
+    });
+  }
+});
+
 // Legacy path: no v2 run exists, so the projection reads the committed
-// `coverage_diagnostics` snapshot. Its `updated_at` is the proof's instant.
+// `coverage_diagnostics` snapshot. It binds to the revision of the state commit
+// that wrote it.
 const LEGACY_DIAGNOSTICS_STREAM = "coverage_diagnostics";
 
-test("store: a legacy diagnostics proof is retired by a later state commit, not by one at its own instant", async (t) => {
+test("revision: a legacy diagnostics proof stands while its commit is newest; any later commit retires it", async (t) => {
   await withBoundaryConnection(async () => {
     const stores = expectedLocalCoverageStoreDescriptors(connectorId);
     assert.ok(stores, "the claude-code inventory declares its coverage stores");
@@ -591,35 +710,44 @@ test("store: a legacy diagnostics proof is retired by a later state commit, not
       stores: stores.map(({ store, stream }) => ({ status: "collected", store, stream })),
     };
     t.mock.timers.enable({ apis: ["Date"], now: Date.parse(PROOF_AT) });
-    await putSyncState(BOUNDARY_TARGET, { [LEGACY_DIAGNOSTICS_STREAM]: snapshot });
-    assert.equal((await boundaryProjection()).axis, "complete", "the legacy snapshot is a reliable complete proof");
-
-    await putSyncState(BOUNDARY_TARGET, { messages: { cursor: "same-instant" } });
-    assert.equal((await boundaryProjection()).axis, "complete", "a same-instant state write is not later");
+    // One commit carries the diagnostics and a cursor: both rows share its revision.
+    await putSyncState(BOUNDARY_TARGET, {
+      [LEGACY_DIAGNOSTICS_STREAM]: snapshot,
+      messages: { cursor: "own" },
+    });
+    const projected = await boundaryProjection();
+    assert.equal(projected.axis, "complete", "the legacy snapshot is a reliable complete proof");
+    assert.equal(projected.asOf?.evidence, "legacy_diagnostics", "the legacy proof carries its as-of");
+    assert.deepEqual(projected.asOf, {
+      artifact_digest: null,
+      collection_revision: highWaterRevision(),
+      committed_at: PROOF_AT,
+      evidence: "legacy_diagnostics",
+      run_id: null,
+    });
 
-    t.mock.timers.setTime(Date.parse(PROOF_AT) + 1);
-    await putSyncState(BOUNDARY_TARGET, { messages: { cursor: "later" } });
+    await putSyncState(BOUNDARY_TARGET, {
+      messages: { cursor: "same-instant" },
+    });
     assert.equal(
       (await boundaryProjection()).axis,
       "unknown",
-      "a later unaccounted state write retires the legacy proof"
+      "a separate commit at the same instant retires the legacy proof"
     );
   });
 });
 
-test("store: a later server-owned scope write is not a state commit and does not retire the proof", async (t) => {
+test("revision: a later server-owned scope write is not an event and does not retire the proof", async (t) => {
   await withBoundaryConnection(async () => {
     t.mock.timers.enable({ apis: ["Date"], now: Date.parse(PROOF_AT) });
     await seedV2Proof("run_boundary_scope_proof");
+    const revision = highWaterRevision();
     t.mock.timers.setTime(Date.parse(PROOF_AT) + 1);
     await putSyncState(BOUNDARY_TARGET, {
       [COLLECTION_SCOPE_STATE_KEY]: buildStoredCollectionScope(null, new Date().toISOString()),
     });
-    assert.equal(
-      (await boundaryProjection()).axis,
-      "complete",
-      "the `$`-prefixed scope row is server state, not a commit"
-    );
+    assert.equal(highWaterRevision(), revision, "the `$`-prefixed scope row gets no revision");
+    assert.equal((await boundaryProjection()).axis, "complete");
   });
 });
 
@@ -645,7 +773,7 @@ test("journey: a later unnegotiated run that commits state retires the earlier v
       [],
       "the fresh outbox holds no receipt"
     );
-    assert.equal(serverRunStreams("b-state"), null, "the server committed no terminal evidence for run B");
+    assertNoEvidenceTerminalRecord("b-state");
     assert.deepEqual(
       serverCursors(journey).messages,
       { cursor: "b-state-messages" },
@@ -688,11 +816,16 @@ test("journey: an unnegotiated state commit before a negotiated proof does not r
   });
 });
 
-test("journey, known limit: an unnegotiated run that commits no state leaves no server record, so the last proof stands", async () => {
+test("journey: a later unnegotiated run with no STATE commits a terminal record that retires the proof", async () => {
   await withJourney(async (journey) => {
-    await runOnce(journey, { mode: "complete", negotiated: true, tag: "a-complete" });
-    // Run B: unnegotiated, records only, no STATE, fresh outbox. The server gets
-    // records but no commit it can order against the proof.
+    await runOnce(journey, {
+      mode: "complete",
+      negotiated: true,
+      tag: "a-complete",
+    });
+    assert.equal((await ownerConnectionRow(journey)).connection_health.axes.coverage, "complete");
+    // Run B: unnegotiated, records only, no STATE, fresh outbox. A runtime that
+    // implements this profile version still commits its terminal run record.
     const freshQueue = join(journey.dir, "outbox-fresh.sqlite");
     const b = await runOnce(journey, {
       mode: "records-only",
@@ -701,9 +834,13 @@ test("journey, known limit: an unnegotiated run that commits no state leaves no
       tag: "b-silent",
     });
     assert.equal(b.result.done?.status, "succeeded");
-    assert.equal(serverRunStreams("b-silent"), null, "the server committed no terminal evidence for run B");
+    assertNoEvidenceTerminalRecord("b-silent");
     assert.deepEqual(serverCursors(journey).messages, { cursor: "a-complete-messages" }, "no cursor moved");
-    // This pins what the server can observe today. Closing it needs a run boundary from the runtime.
-    assert.equal((await ownerConnectionRow(journey)).connection_health.axes.coverage, "complete");
+    const owner = await ownerConnectionRow(journey);
+    assert.equal(owner.connection_health.axes.coverage, "unknown");
+    assert.deepEqual(conditions(owner), {
+      messages: "unknown",
+      sessions: "unknown",
+    });
   });
 });
diff --git a/reference-implementation/test/local-device-coverage-state-commit-postgres.test.ts b/reference-implementation/test/local-device-coverage-state-commit-postgres.test.ts
index 3d27b4f6f..b02c5fb7f 100644
--- a/reference-implementation/test/local-device-coverage-state-commit-postgres.test.ts
+++ b/reference-implementation/test/local-device-coverage-state-commit-postgres.test.ts
@@ -2,11 +2,13 @@
 // SPDX-License-Identifier: Apache-2.0
 
 /**
- * Real-PostgreSQL proof for the newest state-commit instant the stale-proof
- * projection compares against a terminal proof (`stateCommittedAt`). The SQL
- * runs in both the singleton and the page-batched readers, and the batched one
- * is the list path, which swallows its own failures. So this test reads it
- * back directly rather than trusting a projection that would silently degrade.
+ * Real-PostgreSQL proof for the collection-revision fence the local coverage
+ * projection reads (`revisionFence`). State commits, terminal runs and
+ * observed attempts each take the next per-connection revision at commit, and
+ * the server's own `$` scope rows take none. The fence SQL runs in both the
+ * singleton and the page-batched readers, and the batched one is the list
+ * path, which swallows its own failures. So this test reads it back directly
+ * rather than trusting a projection that would silently degrade.
  */
 
 import assert from "node:assert/strict";
@@ -17,15 +19,16 @@ import {
   readCommittedLocalCoverageDiagnostics,
   readCommittedLocalCoverageDiagnosticsByConnectionIds,
 } from "../server/records.ts";
+import { recordCollectionRevisionEvent } from "../server/stores/collection-revision-store.ts";
+import { createPostgresConnectorStateStore } from "../server/stores/connector-state-store.ts";
+import { commitTerminalRun } from "../server/stores/terminal-run-commit-store.ts";
 import { dedicatedPostgresTestUrl } from "./helpers/dedicated-postgres-test-url.ts";
 
 const POSTGRES_URL = dedicatedPostgresTestUrl(process.env.PDPP_TEST_POSTGRES_URL);
 const CONNECTOR_ID = "claude-code";
-const WITH_STATE = "cin_stale_proof_state_commit_pg";
-const SCOPE_ONLY = "cin_stale_proof_scope_only_pg";
-const EARLIER = "2026-10-22T10:00:00.000Z";
-const LATER = "2026-10-22T10:05:00.000Z";
-const SCOPE_WRITE = "2026-10-22T11:00:00.000Z";
+const WITH_STATE = "cin_revision_fence_pg";
+const SCOPE_ONLY = "cin_revision_fence_scope_only_pg";
+const PROOF_RUN = "run_revision_fence_pg";
 const NOW = "2026-10-22T09:00:00.000Z";
 
 function postgresStorageConfig(): { backend: "postgres"; databaseUrl: string } {
@@ -34,12 +37,11 @@ function postgresStorageConfig(): { backend: "postgres"; databaseUrl: string } {
 }
 
 async function cleanup(): Promise<void> {
-  await postgresQuery("DELETE FROM connector_state WHERE connector_instance_id = ANY($1::text[])", [
-    [WITH_STATE, SCOPE_ONLY],
-  ]);
-  await postgresQuery("DELETE FROM connector_instances WHERE connector_instance_id = ANY($1::text[])", [
-    [WITH_STATE, SCOPE_ONLY],
-  ]);
+  const ids = [WITH_STATE, SCOPE_ONLY];
+  await postgresQuery("DELETE FROM run_history WHERE connector_instance_id = ANY($1::text[])", [ids]);
+  await postgresQuery("DELETE FROM spine_events WHERE run_id = $1", [PROOF_RUN]);
+  await postgresQuery("DELETE FROM connector_state WHERE connector_instance_id = ANY($1::text[])", [ids]);
+  await postgresQuery("DELETE FROM connector_instances WHERE connector_instance_id = ANY($1::text[])", [ids]);
   await postgresQuery("DELETE FROM connectors WHERE connector_id = $1", [CONNECTOR_ID]);
 }
 
@@ -59,49 +61,113 @@ async function seed(): Promise<void> {
       [instance, CONNECTOR_ID, NOW]
     );
   }
-  // WITH_STATE: two stream commits, the newer of which decides the instant. Its
-  // `$`-prefixed scope row is written last, and must not count as a state commit.
-  const rows: Array<[string, string, string, string]> = [
-    [WITH_STATE, "messages", LATER, '{"cursor":"later"}'],
-    [WITH_STATE, "sessions", EARLIER, '{"cursor":"earlier"}'],
-    [WITH_STATE, "$collection_scope", SCOPE_WRITE, '"unscoped"'],
-    [SCOPE_ONLY, "$collection_scope", SCOPE_WRITE, '"unscoped"'],
-  ];
-  for (const [instance, stream, updatedAt, stateJson] of rows) {
-    await postgresQuery(
-      `INSERT INTO connector_state(
-         connector_id, connector_instance_id, stream, state_json, updated_at, manifest_generation
-       ) VALUES ($1, $2, $3, $4::jsonb, $5, 0)`,
-      [CONNECTOR_ID, instance, stream, stateJson, updatedAt]
-    );
-  }
 }
 
-test("real PostgreSQL: stateCommittedAt is the newest non-scope state commit, from both coverage readers (skipped: PDPP_TEST_POSTGRES_URL unset)", {
+async function stateRowRevisions(connectorInstanceId: string): Promise<Record<string, string | null>> {
+  const result = await postgresQuery<{
+    collection_revision: string | null;
+    stream: string;
+  }>(
+    "SELECT stream, collection_revision::text AS collection_revision FROM connector_state WHERE connector_instance_id = $1",
+    [connectorInstanceId]
+  );
+  return Object.fromEntries(result.rows.map((row) => [row.stream, row.collection_revision]));
+}
+
+async function fences() {
+  const batch = await readCommittedLocalCoverageDiagnosticsByConnectionIds([WITH_STATE, SCOPE_ONLY]);
+  const single = await readCommittedLocalCoverageDiagnostics({
+    connector_id: CONNECTOR_ID,
+    connector_instance_id: WITH_STATE,
+  });
+  assert.deepEqual(single.revisionFence, batch.get(WITH_STATE)?.revisionFence, "the singleton reader agrees");
+  return {
+    scopeOnly: batch.get(SCOPE_ONLY)?.revisionFence,
+    withState: batch.get(WITH_STATE)?.revisionFence,
+  };
+}
+
+test("real PostgreSQL: the collection revision orders commits and observed events, and both coverage readers return the same fence (skipped: PDPP_TEST_POSTGRES_URL unset)", {
   skip: !POSTGRES_URL,
 }, async () => {
   await initPostgresStorage(postgresStorageConfig());
   try {
     await cleanup();
     await seed();
+    const store = createPostgresConnectorStateStore();
+    const scope = {
+      connectorId: CONNECTOR_ID,
+      connectorInstanceId: WITH_STATE,
+    };
 
-    const batch = await readCommittedLocalCoverageDiagnosticsByConnectionIds([WITH_STATE, SCOPE_ONLY]);
-    assert.equal(
-      batch.get(WITH_STATE)?.stateCommittedAt,
-      LATER,
-      "the newest stream commit wins, and the later scope row is not a state commit"
+    // A state commit takes revision 1 and stamps every row it writes.
+    await store.putState(scope, {
+      messages: { cursor: "m-1" },
+      sessions: { cursor: "s-1" },
+    });
+    // The server's own scope row is not a collection event.
+    await store.putState(scope, { $collection_scope: "unscoped" });
+    assert.deepEqual(await stateRowRevisions(WITH_STATE), {
+      $collection_scope: null,
+      messages: "1",
+      sessions: "1",
+    });
+
+    // A terminal run takes revision 2; its own state rows and its run record carry it.
+    await commitTerminalRun({
+      collectionBoundary: "unscoped",
+      commitId: `commit_${PROOF_RUN}`,
+      connectorId: CONNECTOR_ID,
+      connectorInstanceId: WITH_STATE,
+      deviceId: "dev_revision_fence_pg",
+      envelopeHash: `envelope_${PROOF_RUN}`,
+      normalizedFacts: [],
+      runId: PROOF_RUN,
+      sourceInstanceId: "src_revision_fence_pg",
+      stateDelta: { messages: { cursor: "m-2" } },
+      version: 2,
+    });
+    assert.deepEqual(await stateRowRevisions(WITH_STATE), {
+      $collection_scope: null,
+      messages: "2",
+      sessions: "1",
+    });
+    const afterRun = await fences();
+    assert.deepEqual(
+      afterRun.withState?.highWater && {
+        ...afterRun.withState.highWater,
+        at: null,
+      },
+      {
+        at: null,
+        event: "terminal_run",
+        revision: 2,
+        runId: PROOF_RUN,
+      }
     );
+    assert.equal(afterRun.withState?.proofRun?.runId, PROOF_RUN, "the fence reads the run the high-water mark names");
+    assert.equal(afterRun.withState?.proofRun?.facts?.collection_revision, 2, "the run record carries its revision");
+    assert.equal(afterRun.withState?.legacyProofRevision, null, "no diagnostics row exists");
+    assert.deepEqual(afterRun.scopeOnly?.highWater, {
+      at: null,
+      event: null,
+      revision: 0,
+      runId: null,
+    });
+    assert.equal(afterRun.scopeOnly?.proofRun, null);
+
+    // A later observed attempt takes revision 3. The high-water mark no longer names a terminal run.
     assert.equal(
-      batch.get(SCOPE_ONLY)?.stateCommittedAt,
-      null,
-      "a connection with only server scope state has no state commit"
+      await recordCollectionRevisionEvent(WITH_STATE, {
+        at: NOW,
+        event: "batch_rejected",
+      }),
+      3
     );
-
-    const single = await readCommittedLocalCoverageDiagnostics({
-      connector_id: CONNECTOR_ID,
-      connector_instance_id: WITH_STATE,
-    });
-    assert.equal(single.stateCommittedAt, LATER, "the singleton reader agrees with the batched one");
+    const afterRejection = await fences();
+    assert.equal(afterRejection.withState?.highWater?.revision, 3);
+    assert.equal(afterRejection.withState?.highWater?.event, "batch_rejected");
+    assert.equal(afterRejection.withState?.proofRun, null);
   } finally {
     await cleanup();
     await closePostgresStorage();
diff --git a/reference-implementation/test/local-device-required-stream-proof-scope.test.ts b/reference-implementation/test/local-device-required-stream-proof-scope.test.ts
index 230521c71..057de304b 100644
--- a/reference-implementation/test/local-device-required-stream-proof-scope.test.ts
+++ b/reference-implementation/test/local-device-required-stream-proof-scope.test.ts
@@ -31,6 +31,7 @@ import { COLLECTION_SCOPE_STATE_KEY } from "../server/local-collection-scope.ts"
 import { putSyncState, readCommittedLocalCoverageDiagnostics } from "../server/records.ts";
 import { deriveLocalCoverageAxis, listConnectorSummaries } from "../server/ref-control.ts";
 import { rebuildRetainedSize } from "../server/retained-size-read-model.ts";
+import { recordCollectionRevisionEvent } from "../server/stores/collection-revision-store.ts";
 import { createSqliteConnectorInstanceStore } from "../server/stores/connector-instance-store.ts";
 import { getDefaultDeviceExporterStore } from "../server/stores/device-exporter-store.ts";
 
@@ -160,10 +161,16 @@ async function seedLocalRun({
   });
 
   if (commitSnapshot) {
+    // A committed snapshot is a state commit: it takes the connection's next
+    // collection revision, which the projection binds the proof to.
+    const revision = await recordCollectionRevisionEvent(CONNECTOR_INSTANCE_ID, {
+      at: "2026-06-03T11:58:31.000Z",
+      event: "state_commit",
+    });
     getDb()
       .prepare(
-        `INSERT INTO connector_state(connector_id, connector_instance_id, stream, state_json, updated_at)
-         VALUES (?, ?, 'coverage_diagnostics', ?, ?)`
+        `INSERT INTO connector_state(connector_id, connector_instance_id, stream, state_json, updated_at, collection_revision)
+         VALUES (?, ?, 'coverage_diagnostics', ?, ?, ?)`
       )
       .run(
         connectorId,
@@ -177,7 +184,8 @@ async function seedLocalRun({
             stream: descriptor.stream ?? null,
           })),
         }),
-        "2026-06-03T11:58:31.000Z"
+        "2026-06-03T11:58:31.000Z",
+        revision
       );
   }
 
diff --git a/reference-implementation/test/ref-connectors-local-coverage-green.test.ts b/reference-implementation/test/ref-connectors-local-coverage-green.test.ts
index 6e5f73d1c..5f562e1c7 100644
--- a/reference-implementation/test/ref-connectors-local-coverage-green.test.ts
+++ b/reference-implementation/test/ref-connectors-local-coverage-green.test.ts
@@ -35,6 +35,7 @@ import {
   projectConnectorSummaryConnectionHealth,
 } from "../server/ref-control.ts";
 import { rebuildRetainedSize } from "../server/retained-size-read-model.ts";
+import { advanceSqliteCollectionRevisionInTransaction } from "../server/stores/collection-revision-store.ts";
 import { createSqliteConnectorInstanceStore } from "../server/stores/connector-instance-store.ts";
 import { getDefaultConnectorStateStore } from "../server/stores/connector-state-store.ts";
 import { getDefaultDeviceExporterStore } from "../server/stores/device-exporter-store.ts";
@@ -252,10 +253,16 @@ function seedCoverage(rows: readonly TestCoverageRow[], { includeExpected = true
       stream: "coverage_diagnostics",
     });
   });
+  // A committed snapshot is a state commit: it takes the connection's next
+  // collection revision, which the projection binds the proof to.
+  const revision = advanceSqliteCollectionRevisionInTransaction(getDb(), CONNECTOR_INSTANCE_ID, {
+    at: "2026-06-03T11:58:31.000Z",
+    event: "state_commit",
+  })?.revision;
   getDb()
     .prepare(
-      `INSERT INTO connector_state(connector_id, connector_instance_id, stream, state_json, updated_at)
-       VALUES (?, ?, 'coverage_diagnostics', ?, ?)`
+      `INSERT INTO connector_state(connector_id, connector_instance_id, stream, state_json, updated_at, collection_revision)
+       VALUES (?, ?, 'coverage_diagnostics', ?, ?, ?)`
     )
     .run(
       STATE_CONNECTOR_ID,
@@ -268,7 +275,8 @@ function seedCoverage(rows: readonly TestCoverageRow[], { includeExpected = true
           stream: stream ?? null,
         })),
       }),
-      "2026-06-03T11:58:31.000Z"
+      "2026-06-03T11:58:31.000Z",
+      revision ?? null
     );
 }
 

From 196b383b2a89c491ff8b49580763aff0369d112e Mon Sep 17 00:00:00 2001
From: Tim Nunamaker <tnunamak@gmail.com>
Date: Thu, 22 Oct 2026 07:57:28 -0500
Subject: [PATCH 36/87] feat(console): show local coverage as of its run

Coverage is a fact about one run, not a present-tense claim. When the
reference sends coverage_as_of, the connection coverage chip and the
per-stream coverage lines read "complete as of <time>" (UTC to the
second), and the chip title names the run, release digest and collection
revision. Unknown coverage, and rows without an as-of, render as before.

The detail page passes the as-of to its diagnostics chips and stream
facts; the sources list passes it to stream facts. The not-installed
invariant now accepts the extra stream-facts option.

Assisted-by: AI
Signed-off-by: Tim Nunamaker <tnunamak@gmail.com>
---
 .../app/(console)/lib/collection-report.ts    | 12 +++-
 .../(console)/lib/connection-evidence.test.ts | 62 +++++++++++++++++++
 .../app/(console)/lib/connection-evidence.ts  | 46 +++++++++++++-
 .../src/app/(console)/lib/ref-client.ts       | 16 +++++
 .../[connector]/connection-diagnostics.tsx    |  8 +++
 ...connector-not-installed.invariants.test.ts |  2 +-
 .../(console)/sources/[connector]/page.tsx    | 14 ++++-
 .../[connector]/source-detail-demo-data.ts    |  1 +
 .../(console)/sources/sources-view-model.ts   |  5 +-
 9 files changed, 158 insertions(+), 8 deletions(-)

diff --git a/apps/console/src/app/(console)/lib/collection-report.ts b/apps/console/src/app/(console)/lib/collection-report.ts
index a69ddbd7c..4096bcdee 100644
--- a/apps/console/src/app/(console)/lib/collection-report.ts
+++ b/apps/console/src/app/(console)/lib/collection-report.ts
@@ -30,9 +30,9 @@
 import type { AxisChip, EvidenceTone } from "@pdpp/display";
 import { formatCoverageAxis } from "@pdpp/display";
 import type { ForwardDispositionSummary } from "./connection-evidence.ts";
-import { formatForwardDisposition } from "./connection-evidence.ts";
+import { formatForwardDisposition, withCoverageAsOf } from "./connection-evidence.ts";
 import { dispositionForInstallState } from "./connector-implementation.ts";
-import type { RefCollectionReportEntry } from "./ref-client.ts";
+import type { RefCollectionReportEntry, RefCoverageAsOf } from "./ref-client.ts";
 
 export interface StreamCollectionFacts {
   /**
@@ -292,9 +292,15 @@ export function formatStreamCollectionFacts(
      * happen, so the reference's disposition is replaced by the install blocker.
      */
     readonly connectorNotInstalled?: boolean;
+    /** The run the connection's local coverage describes (`coverage_as_of`). */
+    readonly coverageAsOf?: RefCoverageAsOf | null;
   } = {}
 ): StreamCollectionFacts {
-  const coverage = formatCoverageAxis(entry.coverage_condition);
+  const coverage = withCoverageAsOf(
+    formatCoverageAxis(entry.coverage_condition),
+    entry.coverage_condition,
+    options.coverageAsOf
+  );
   const disposition = dispositionForInstallState(
     formatForwardDisposition(entry.forward_disposition),
     options.connectorNotInstalled === true
diff --git a/apps/console/src/app/(console)/lib/connection-evidence.test.ts b/apps/console/src/app/(console)/lib/connection-evidence.test.ts
index 246cb3201..126e4385a 100644
--- a/apps/console/src/app/(console)/lib/connection-evidence.test.ts
+++ b/apps/console/src/app/(console)/lib/connection-evidence.test.ts
@@ -15,6 +15,7 @@
 import assert from "node:assert/strict";
 import test from "node:test";
 import { formatCoverageAxis, formatFreshnessAxis, formatOutboxAxis } from "@pdpp/display";
+import { formatStreamCollectionFacts } from "./collection-report.ts";
 import {
   deriveAutoPausedBanner,
   deriveConnectionNextStep,
@@ -2348,3 +2349,64 @@ test("formatSourceHeartbeat reports unknown when the server derived no health",
   assert.equal(chip.value, "unknown");
   assert.doesNotMatch(chip.label, /starting/, "an underived status is not evidence of life");
 });
+
+// Local coverage is a fact about one run, never a present-tense claim: the
+// owner sees "complete as of <time>", and the chip names the run, release and
+// revision it describes.
+const COVERAGE_AS_OF = {
+  artifact_digest: `sha256:${"a".repeat(64)}`,
+  collection_revision: 7,
+  committed_at: "2026-10-22T10:00:00.000Z",
+  evidence: "terminal_run",
+  run_id: "run-a",
+} as const;
+
+test("coverage chip reads 'complete as of <time>' when the reference names the run it describes", () => {
+  const axes = {
+    attention: null,
+    coverage: "complete",
+    freshness: "fresh",
+    outbox: "idle",
+  } as const;
+  const [coverage] = summarizeAxisChips(axes as never, {
+    coverageAsOf: COVERAGE_AS_OF,
+    isLocalDeviceBacked: true,
+  });
+  assert.equal(coverage?.label, "Coverage · complete as of 2026-10-22 10:00:00Z");
+  assert.equal(coverage?.value, "complete as of 2026-10-22 10:00:00Z");
+  assert.match(coverage?.title ?? "", /run run-a/);
+  assert.match(coverage?.title ?? "", /sha256:a{12}/);
+  assert.match(coverage?.title ?? "", /revision 7/);
+});
+
+test("coverage chip adds no as-of to unknown coverage or when the reference sends none", () => {
+  const unknown = {
+    attention: null,
+    coverage: "unknown",
+    freshness: "fresh",
+    outbox: "idle",
+  } as const;
+  const [unknownChip] = summarizeAxisChips(unknown as never, {
+    coverageAsOf: COVERAGE_AS_OF,
+    isLocalDeviceBacked: true,
+  });
+  assert.equal(unknownChip?.label, formatCoverageAxis("unknown").label);
+  const complete = {
+    attention: null,
+    coverage: "complete",
+    freshness: "fresh",
+    outbox: "idle",
+  } as const;
+  const [plain] = summarizeAxisChips(complete as never, {
+    coverageAsOf: null,
+    isLocalDeviceBacked: true,
+  });
+  assert.equal(plain?.label, formatCoverageAxis("complete").label);
+});
+
+test("per-stream coverage reads 'complete as of <time>' with the connection's as-of", () => {
+  const facts = formatStreamCollectionFacts({ coverage_condition: "complete", stream: "messages" } as never, {
+    coverageAsOf: COVERAGE_AS_OF,
+  });
+  assert.equal(facts.coverage.label, "Coverage · complete as of 2026-10-22 10:00:00Z");
+});
diff --git a/apps/console/src/app/(console)/lib/connection-evidence.ts b/apps/console/src/app/(console)/lib/connection-evidence.ts
index dd38bd121..fc5e608b9 100644
--- a/apps/console/src/app/(console)/lib/connection-evidence.ts
+++ b/apps/console/src/app/(console)/lib/connection-evidence.ts
@@ -24,6 +24,7 @@ import type {
   DeviceSourceInstance,
   RefCollectionRateSnapshot,
   RefConnectionHealthSnapshot,
+  RefCoverageAsOf,
   RefDetailGapBacklog,
   RefForwardDisposition,
   RefLocalDeviceProgress,
@@ -87,12 +88,18 @@ export function outboxAxisIsApplicable(
  */
 export function summarizeAxisChips(
   axes: RefConnectionHealthSnapshot["axes"] | undefined | null,
-  options: { isLocalDeviceBacked?: boolean } = {}
+  options: {
+    coverageAsOf?: RefCoverageAsOf | null;
+    isLocalDeviceBacked?: boolean;
+  } = {}
 ): AxisChip[] {
   if (!axes) {
     return [];
   }
-  const out: AxisChip[] = [formatCoverageAxis(axes.coverage), formatFreshnessAxis(axes.freshness)];
+  const out: AxisChip[] = [
+    withCoverageAsOf(formatCoverageAxis(axes.coverage), axes.coverage, options.coverageAsOf),
+    formatFreshnessAxis(axes.freshness),
+  ];
   const attention = formatAttentionAxis(axes.attention);
   if (attention) {
     out.push(attention);
@@ -122,6 +129,41 @@ export function summarizeAxisChips(
   return out;
 }
 
+const FRACTIONAL_SECONDS = /\.\d+Z$/;
+
+/** UTC, to the second: "2026-10-22 10:00:00Z". Empty for a missing or unparseable time. */
+function formatCoverageAsOfTime(iso: string | null | undefined): string {
+  const parsed = iso ? Date.parse(iso) : Number.NaN;
+  return Number.isFinite(parsed)
+    ? new Date(parsed).toISOString().replace("T", " ").replace(FRACTIONAL_SECONDS, "Z")
+    : "";
+}
+
+/**
+ * Coverage is a fact about one run, never a present-tense claim. When the
+ * reference names the run a coverage verdict describes, the chip reads
+ * "complete as of <time>" and its title names the run, release and collection
+ * revision. Unknown coverage has no run behind it, so it is left unchanged.
+ */
+export function withCoverageAsOf(
+  chip: AxisChip,
+  axis: string | null | undefined,
+  asOf: RefCoverageAsOf | null | undefined
+): AxisChip {
+  const committedAt = formatCoverageAsOfTime(asOf?.committed_at);
+  if (!(asOf && committedAt) || axis === "unknown" || axis === null || axis === undefined) {
+    return chip;
+  }
+  const release = asOf.artifact_digest ? `release ${asOf.artifact_digest}` : "an unrecorded release";
+  const run = asOf.run_id ? `run ${asOf.run_id}` : "a state commit";
+  return {
+    ...chip,
+    label: `${chip.label} as of ${committedAt}`,
+    title: `${chip.title} This is a fact about ${run} (${release}), committed at ${committedAt} as collection revision ${asOf.collection_revision}. A later run the reference has not heard about is not reflected.`,
+    value: `${chip.value} as of ${committedAt}`,
+  };
+}
+
 /**
  * Owner-facing copy for the connection-level forward disposition — the
  * reference's single answer to "what is the next run expected to do?". This is
diff --git a/apps/console/src/app/(console)/lib/ref-client.ts b/apps/console/src/app/(console)/lib/ref-client.ts
index f74d8c571..6fef097d2 100644
--- a/apps/console/src/app/(console)/lib/ref-client.ts
+++ b/apps/console/src/app/(console)/lib/ref-client.ts
@@ -632,6 +632,15 @@ export interface RefConnectorImplementation {
   state: "built_in" | "installed" | "local_source" | "not_installed" | "unknown";
 }
 
+/** See {@link RefConnectorSummary.coverage_as_of}. */
+export interface RefCoverageAsOf {
+  readonly artifact_digest: string | null;
+  readonly collection_revision: number;
+  readonly committed_at: string | null;
+  readonly evidence: string;
+  readonly run_id: string | null;
+}
+
 export interface RefConnectorSummary {
   /**
    * Owner/control-plane acquisition provenance for manual imports, device
@@ -669,6 +678,13 @@ export interface RefConnectorSummary {
    * renders no horizons rather than inventing a state. Pass-through from
    * `server/ref-control.ts#projectConnectorSummaryConnectionHealth`.
    */
+  /**
+   * What the local coverage on this row is a fact about (`LocalCoverageAsOf`
+   * in reference `server/ref-control.ts`): the run, its release digest, and the
+   * collection revision and time it was committed at. `null` or absent when no
+   * current local proof backs the coverage shown.
+   */
+  coverage_as_of?: RefCoverageAsOf | null;
   coverage_horizons?: readonly RefCoverageHorizon[];
   display_name: string;
   freshness: Record<string, unknown>;
diff --git a/apps/console/src/app/(console)/sources/[connector]/connection-diagnostics.tsx b/apps/console/src/app/(console)/sources/[connector]/connection-diagnostics.tsx
index 149c5ec3c..16821c544 100644
--- a/apps/console/src/app/(console)/sources/[connector]/connection-diagnostics.tsx
+++ b/apps/console/src/app/(console)/sources/[connector]/connection-diagnostics.tsx
@@ -28,6 +28,7 @@ import type {
   DeviceSourceInstance,
   RefActionRemediation,
   RefConnectionHealthSnapshot,
+  RefCoverageAsOf,
   RefLocalDeviceProgress,
   RefRenderedVerdict,
   RefSchedule,
@@ -71,6 +72,8 @@ export interface ConnectionDiagnosticsProps {
    * coverage-derived value, matching the per-stream lines.
    */
   connectorNotInstalled?: boolean;
+  /** The run the local coverage describes; the coverage chip reads "as of" its commit time. */
+  coverageAsOf?: RefCoverageAsOf | null;
   /**
    * Connection-summary local-device progress, including the count-backed
    * `outbox_counts` rollup. Used to show the scale of stuck work in the
@@ -105,6 +108,7 @@ export function ConnectionDiagnostics({
   connectionId,
   connectorId,
   connectorNotInstalled = false,
+  coverageAsOf = null,
   localDeviceProgress,
   now,
   providerOrigin,
@@ -163,6 +167,7 @@ export function ConnectionDiagnostics({
               connectionId={connectionId}
               connectorId={connectorId}
               connectorNotInstalled={connectorNotInstalled}
+              coverageAsOf={coverageAsOf}
               localDeviceProgress={localDeviceProgress}
               providerOrigin={providerOrigin}
               renderedVerdict={renderedVerdict}
@@ -455,6 +460,7 @@ function ProjectedStateDiagnostics({
   connectionId,
   connectorId,
   connectorNotInstalled,
+  coverageAsOf,
   localDeviceProgress,
   providerOrigin,
   renderedVerdict,
@@ -464,6 +470,7 @@ function ProjectedStateDiagnostics({
   connectionId: string | null;
   connectorId: string | null;
   connectorNotInstalled: boolean;
+  coverageAsOf: RefCoverageAsOf | null;
   localDeviceProgress: RefLocalDeviceProgress | null;
   providerOrigin: string | null;
   renderedVerdict: RefRenderedVerdict | null;
@@ -487,6 +494,7 @@ function ProjectedStateDiagnostics({
   // The diagnostics block already receives the connection's local-device
   // progress, so reuse it as the local-backing signal.
   const axisChips = summarizeAxisChips(connectionHealth.axes, {
+    coverageAsOf,
     isLocalDeviceBacked: Boolean(localDeviceProgress),
   });
   const outboxRemediation = summarizeOutboxStallRemediation(connectionHealth, localDeviceProgress);
diff --git a/apps/console/src/app/(console)/sources/[connector]/connector-not-installed.invariants.test.ts b/apps/console/src/app/(console)/sources/[connector]/connector-not-installed.invariants.test.ts
index 59d5eaeb0..aa8f4d206 100644
--- a/apps/console/src/app/(console)/sources/[connector]/connector-not-installed.invariants.test.ts
+++ b/apps/console/src/app/(console)/sources/[connector]/connector-not-installed.invariants.test.ts
@@ -20,7 +20,7 @@ const HERE = fileURLToPath(new URL(".", import.meta.url));
 const PAGE_FILE = `${HERE}page.tsx`;
 
 const READS_SERVER_FACT = /const connectorNotInstalled = isConnectorNotInstalled\(summary\);/;
-const STREAM_FACTS_GET_FACT = /formatStreamCollectionFacts\(entry, \{ connectorNotInstalled \}\)/;
+const STREAM_FACTS_GET_FACT = /formatStreamCollectionFacts\(entry, \{\s*connectorNotInstalled[,\s}]/;
 const PROMPT_GATED = /const installPromptShown = connectorNotInstalled && !revoked && !setupFailed;/;
 const NOTICE_RENDERED =
   /\{installPromptShown \? \(\s*<ConnectorInstallPrompt[\s\S]{0,200}variant="notice"[\s\S]{0,40}\/>\s*\) : null\}/;
diff --git a/apps/console/src/app/(console)/sources/[connector]/page.tsx b/apps/console/src/app/(console)/sources/[connector]/page.tsx
index b653295bc..0890dff98 100644
--- a/apps/console/src/app/(console)/sources/[connector]/page.tsx
+++ b/apps/console/src/app/(console)/sources/[connector]/page.tsx
@@ -56,6 +56,7 @@ import {
   type RefConnectionHealthSnapshot,
   type RefConnectorRunSummary,
   type RefConnectorSummary,
+  type RefCoverageAsOf,
   type RefCoverageHorizon,
   type RefRenderedVerdict,
   type RefRequiredAction,
@@ -176,6 +177,8 @@ export interface ConnectorPageModel {
    * up front and offers Install, instead of letting Sync fail.
    */
   connectorNotInstalled: boolean;
+  /** The run the connection's local coverage describes; `null` when none backs it. */
+  coverageAsOf: RefCoverageAsOf | null;
   /** Current durable horizon disclosures from the reference owner projection. */
   coverageHorizons: readonly RefCoverageHorizon[];
   deviceLabels: string[];
@@ -505,7 +508,13 @@ async function loadConnectorPageModel(
   const connectorNotInstalled = isConnectorNotInstalled(summary);
   const collectionFactsByStream = new Map<string, StreamCollectionFacts>();
   for (const [stream, entry] of indexCollectionReportByStream(summary.collection_report)) {
-    collectionFactsByStream.set(stream, formatStreamCollectionFacts(entry, { connectorNotInstalled }));
+    collectionFactsByStream.set(
+      stream,
+      formatStreamCollectionFacts(entry, {
+        connectorNotInstalled,
+        coverageAsOf: summary.coverage_as_of ?? null,
+      })
+    );
   }
   const actionability = projectSourceActionability(summary);
   const collectionOwnerActionByStream = actionability.ownerActionByStream;
@@ -562,6 +571,7 @@ async function loadConnectorPageModel(
     connectorInstallKey: connectorInstallKey(summary),
     connectorInstanceId,
     connectorNotInstalled,
+    coverageAsOf: summary.coverage_as_of ?? null,
     coverageHorizons: summary.coverage_horizons ?? [],
     deviceLabels,
     displayName,
@@ -704,6 +714,7 @@ function ConnectorPageView({
     connectorInstanceId,
     connectorNotInstalled,
     connectionLabelSeed,
+    coverageAsOf,
     coverageHorizons,
     deviceLabels,
     displayName,
@@ -977,6 +988,7 @@ function ConnectorPageView({
         connectionId={connectorInstanceId ?? connectionId}
         connectorId={connectorId}
         connectorNotInstalled={connectorNotInstalled}
+        coverageAsOf={coverageAsOf}
         localDeviceProgress={overview.localDeviceProgress ?? null}
         now={now}
         providerOrigin={providerOrigin}
diff --git a/apps/console/src/app/(console)/sources/[connector]/source-detail-demo-data.ts b/apps/console/src/app/(console)/sources/[connector]/source-detail-demo-data.ts
index 099e1c31b..079767b9e 100644
--- a/apps/console/src/app/(console)/sources/[connector]/source-detail-demo-data.ts
+++ b/apps/console/src/app/(console)/sources/[connector]/source-detail-demo-data.ts
@@ -267,6 +267,7 @@ export function buildRecoveryDemoModel(): ConnectorPageModel {
     connectorInstanceId: connectionId,
     // A local-device source: the reference reports no install state for it.
     connectorNotInstalled: false,
+    coverageAsOf: null,
     coverageHorizons: [],
     deviceLabels: ["workstation"],
     displayName: "Claude Code workstation",
diff --git a/apps/console/src/app/(console)/sources/sources-view-model.ts b/apps/console/src/app/(console)/sources/sources-view-model.ts
index 548cf568d..fd8134d92 100644
--- a/apps/console/src/app/(console)/sources/sources-view-model.ts
+++ b/apps/console/src/app/(console)/sources/sources-view-model.ts
@@ -617,7 +617,10 @@ export function toSourceInstanceView(
   const collectionFactsByStream = new Map(
     [...indexCollectionReportByStream(summary.collection_report)].map(([stream, entry]) => [
       stream,
-      formatStreamCollectionFacts(entry, { connectorNotInstalled }),
+      formatStreamCollectionFacts(entry, {
+        connectorNotInstalled,
+        coverageAsOf: summary.coverage_as_of ?? null,
+      }),
     ])
   );
   const streamRecordsByStream = new Map((summary.stream_records ?? []).map((entry) => [entry.stream, entry]));

From 6a77ccf0c006c8ff1ebfdb869c46e329b93cfda8 Mon Sep 17 00:00:00 2001
From: Tim Nunamaker <tnunamak@gmail.com>
Date: Thu, 22 Oct 2026 07:57:44 -0500
Subject: [PATCH 37/87] chore(collector-runtime): regenerate artifact for the
 terminal run record

Regenerated with artifact:generate and checked with artifact:verify. The
artifact packs the committed tree, so this follows the collector commit
that changes collector-runtime.

Assisted-by: AI
Signed-off-by: Tim Nunamaker <tnunamak@gmail.com>
---
 packages/collector-runtime/artifact.json | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/packages/collector-runtime/artifact.json b/packages/collector-runtime/artifact.json
index f22eda75f..f4654c5bd 100644
--- a/packages/collector-runtime/artifact.json
+++ b/packages/collector-runtime/artifact.json
@@ -1,13 +1,13 @@
 {
   "artifact_filename": "pdpp-collector-runtime-0.0.1.tgz",
-  "artifact_sha1": "99bb1c94b308702167a34b14f8fd1a71defad5c2",
-  "artifact_sha256": "d689fea0cdf0ef045683dfb2c931fb2e50cab9c4e3c705c14a5cb66e116d1c9b",
-  "artifact_sha512": "bc94e8def4f5b23d6c70d05b104e00c6f31c1a29579552ba2ebcb40755d41693a3c8e2075ffa0b6a8f757247b051acbf4237fc7bbc2aa587c816bb9a07215f95",
+  "artifact_sha1": "d7019724607a7b49531138d4ecc6d8ef20bc045c",
+  "artifact_sha256": "9abeb28a2307e7a528cef4830db3e6627bc26502b56146cda52eab5088a34f5d",
+  "artifact_sha512": "868a92a83e81286d53e74ce5f8667f57863ea9ba2bad0ca84904f974cdb5b6fdc367c6505e464becd0cabf1604530d27b4d459b99e9042919ee17ca86b841c26",
   "connector_protocol_declarations_sha256": "8f1bf78ec644d002bfc8b1ce2399ccb660ea10bb3ee53c49a7995e1bb0e17dcb",
   "connector_protocol_source_inputs_sha256": "935e99c7e3307d7e48d748b3ca83b7427f1b91c89e7397de2a3842f08f2393fd",
   "declarations_sha256": "143e48acd5b12670e354da3fd5ff1a265f93d2731d31e2d711d1cb1ef65a8b0e",
   "metadata_version": 1,
   "package_name": "@pdpp/collector-runtime",
   "package_version": "0.0.1",
-  "source_inputs_sha256": "899b5d7b2bde9389366b32ebd1de57d5ce7d45d3af5e6c1a02a7cb6f3bbdbd97"
+  "source_inputs_sha256": "7d2cd1fee2fd45d1765efe285c57b85c028ae12b0c7ccfd30664c958abeb6cd4"
 }

From 67db12d482a473dd2ff7ad25753e148cf30941ad Mon Sep 17 00:00:00 2001
From: Tim Nunamaker <tnunamak@gmail.com>
Date: Thu, 22 Oct 2026 08:55:19 -0500
Subject: [PATCH 38/87] fix(coverage): show positive local coverage only with
 run provenance

A legacy coverage_diagnostics state row projected complete coverage with
a null run_id and a null artifact_digest, so the owner saw "complete as
of" a commit that named no run and no release. Its payload and its
revision fence were also read in separate snapshots. It now never shows
positive coverage: the fence admits only a v2 terminal run record that
names its run and exactly one release digest, and everything else is
unknown. The fence read drops the connector_state join it needed only for
that path. LocalCoverageAsOf now has a non-null run_id and
artifact_digest, and the console drops its fallback copy for them.

Owner connection diagnostics showed the coverage axis and rendered verdict
without coverage_as_of. It now carries the summary's as-of, like the list
and detail rows.

Tests that seeded a complete legacy snapshot now expect unknown, with the
reason in each assertion. They also check that the snapshot itself still
classifies against the declared boundary, so the scope cases keep their
meaning.

Assisted-by: AI
Signed-off-by: Tim Nunamaker <tnunamak@gmail.com>
---
 .../app/(console)/lib/connection-evidence.ts  |  4 +-
 .../src/app/(console)/lib/ref-client.ts       |  6 +-
 reference-implementation/server/records.ts    |  7 +-
 .../server/ref-control.ts                     | 91 ++++++++----------
 .../stores/collection-revision-store.ts       | 26 ++---
 .../local-device-coverage-stale-proof.test.ts | 37 ++++---
 ...ice-coverage-state-commit-postgres.test.ts |  1 -
 ...device-required-stream-proof-scope.test.ts | 73 +++++++++-----
 ...ef-connectors-local-coverage-green.test.ts | 96 ++++++++++---------
 9 files changed, 174 insertions(+), 167 deletions(-)

diff --git a/apps/console/src/app/(console)/lib/connection-evidence.ts b/apps/console/src/app/(console)/lib/connection-evidence.ts
index fc5e608b9..0b9235226 100644
--- a/apps/console/src/app/(console)/lib/connection-evidence.ts
+++ b/apps/console/src/app/(console)/lib/connection-evidence.ts
@@ -154,12 +154,10 @@ export function withCoverageAsOf(
   if (!(asOf && committedAt) || axis === "unknown" || axis === null || axis === undefined) {
     return chip;
   }
-  const release = asOf.artifact_digest ? `release ${asOf.artifact_digest}` : "an unrecorded release";
-  const run = asOf.run_id ? `run ${asOf.run_id}` : "a state commit";
   return {
     ...chip,
     label: `${chip.label} as of ${committedAt}`,
-    title: `${chip.title} This is a fact about ${run} (${release}), committed at ${committedAt} as collection revision ${asOf.collection_revision}. A later run the reference has not heard about is not reflected.`,
+    title: `${chip.title} This is a fact about run ${asOf.run_id} (release ${asOf.artifact_digest}), committed at ${committedAt} as collection revision ${asOf.collection_revision}. A later run the reference has not heard about is not reflected.`,
     value: `${chip.value} as of ${committedAt}`,
   };
 }
diff --git a/apps/console/src/app/(console)/lib/ref-client.ts b/apps/console/src/app/(console)/lib/ref-client.ts
index 6fef097d2..b17c8c61e 100644
--- a/apps/console/src/app/(console)/lib/ref-client.ts
+++ b/apps/console/src/app/(console)/lib/ref-client.ts
@@ -634,11 +634,11 @@ export interface RefConnectorImplementation {
 
 /** See {@link RefConnectorSummary.coverage_as_of}. */
 export interface RefCoverageAsOf {
-  readonly artifact_digest: string | null;
+  readonly artifact_digest: string;
   readonly collection_revision: number;
   readonly committed_at: string | null;
-  readonly evidence: string;
-  readonly run_id: string | null;
+  readonly evidence: "terminal_run";
+  readonly run_id: string;
 }
 
 export interface RefConnectorSummary {
diff --git a/reference-implementation/server/records.ts b/reference-implementation/server/records.ts
index aea631ad7..aed7f16bc 100644
--- a/reference-implementation/server/records.ts
+++ b/reference-implementation/server/records.ts
@@ -4932,10 +4932,7 @@ export async function readCommittedLocalCoverageDiagnostics(storageTarget: Recor
     ...parseCoverageDiagnosticsStateSnapshot(connectorId, state),
     declaredCollectionScope,
     manifestGeneration: currentGeneration === null ? null : Number(currentGeneration),
-    revisionFence:
-      (await readLocalCoverageRevisionFences([connectorInstanceId], LOCAL_COVERAGE_DIAGNOSTICS_STREAM)).get(
-        connectorInstanceId
-      ) ?? null,
+    revisionFence: (await readLocalCoverageRevisionFences([connectorInstanceId])).get(connectorInstanceId) ?? null,
     state,
     stateManifestGeneration: stateGeneration === null ? null : Number(stateGeneration),
     updatedAt: stateProjection.updated_at ?? null,
@@ -5002,7 +4999,7 @@ export async function readCommittedLocalCoverageDiagnosticsByConnectionIds(conne
       );
     }
   }
-  const revisionFences = await readLocalCoverageRevisionFences(ids, LOCAL_COVERAGE_DIAGNOSTICS_STREAM);
+  const revisionFences = await readLocalCoverageRevisionFences(ids);
   for (const row of rows) {
     // `row.state_json` is already the `coverage_diagnostics` stream's own
     // payload — the JOIN's `ON` clause already narrows `cs.stream =
diff --git a/reference-implementation/server/ref-control.ts b/reference-implementation/server/ref-control.ts
index fd36765f0..5c958aab8 100644
--- a/reference-implementation/server/ref-control.ts
+++ b/reference-implementation/server/ref-control.ts
@@ -4833,15 +4833,16 @@ interface LocalCoverageDiagnosticAxis {
 /**
  * The run a local coverage verdict describes. Coverage is a fact about one
  * run, never a present-tense claim, so every projection that shows coverage
- * carries this. A legacy diagnostics proof has no release binding, so its
- * `artifact_digest` is null; its `run_id` is null when no run committed it.
+ * carries this: the run, the release digest it ran, and the collection
+ * revision and time it was committed at. Only a v2 terminal run record
+ * carries all of them, so it is the only positive proof.
  */
 export interface LocalCoverageAsOf {
-  readonly artifact_digest: string | null;
+  readonly artifact_digest: string;
   readonly collection_revision: number;
   readonly committed_at: string | null;
-  readonly evidence: "legacy_diagnostics" | "terminal_run";
-  readonly run_id: string | null;
+  readonly evidence: "terminal_run";
+  readonly run_id: string;
 }
 
 const LOCAL_COVERAGE_ACCOUNTED_STATUSES = new Set([
@@ -5174,14 +5175,17 @@ function localProofRunCoverage(
  * admitted and refused batches, delivered failure reports). A proof binds to
  * the revision it was committed at. It is current only when that revision is
  * the high-water mark; any later event retires it to unknown. No wall clock is
- * compared. A v2 proof must also be the terminal run the high-water mark names.
- * A legacy diagnostics proof is the `coverage_diagnostics` row, at the revision
- * of the commit that wrote it.
+ * compared. The proof must also be the terminal run the high-water mark names,
+ * and it must name its release digest.
+ *
+ * Only a v2 terminal run record is a positive proof. A legacy
+ * `coverage_diagnostics` state row names no run and no release, so it never
+ * shows positive coverage: the projection is unknown.
  *
  * Fails closed: a missing fence, an unreadable or NULL revision, any
- * mismatch, or (for a terminal proof) a newest settled device run that is not
- * the proof and carries no revision, whose order is ambiguous, is unknown
- * coverage.
+ * mismatch, a proof without a single release digest, or a newest settled
+ * device run that is not the proof and carries no revision, whose order is
+ * ambiguous, is unknown coverage.
  */
 function fenceLocalCoverageProof(
   axis: LocalCoverageDiagnosticAxis | null,
@@ -5196,48 +5200,29 @@ function fenceLocalCoverageProof(
   // A settled device run record with no revision cannot be ordered against a
   // terminal proof (a pre-revision row, or a writer that assigns none). If it
   // is the newest settled run and not the proof itself, the order is
-  // ambiguous. A scheduler-managed run is not a device collection attempt. A
-  // legacy diagnostics proof binds to a state row, not to a run record, so
-  // this check does not apply to it.
+  // ambiguous. A scheduler-managed run is not a device collection attempt.
   const unorderedLaterRun =
     terminal !== null &&
     latestSettledRun !== null &&
     latestSettledRun.scheduler_managed !== true &&
-    latestSettledRun.run_id !== terminal?.runId &&
+    latestSettledRun.run_id !== terminal.runId &&
     (latestSettledRun.collection_revision === null || latestSettledRun.collection_revision === undefined);
-  let asOf: LocalCoverageAsOf | null = null;
-  if (unorderedLaterRun) {
-    asOf = null;
-  } else if (terminal) {
-    if (
-      highWater?.event === "terminal_run" &&
-      highWater.runId === terminal.runId &&
-      terminal.collectionRevision !== null &&
-      terminal.collectionRevision === highWater.revision
-    ) {
-      asOf = {
-        artifact_digest: terminal.artifactDigest,
-        collection_revision: highWater.revision,
-        committed_at: terminal.run.last_at ?? null,
-        evidence: "terminal_run",
-        run_id: terminal.runId,
-      };
-    }
-  } else if (
-    highWater &&
-    (highWater.event === "state_commit" || highWater.event === "terminal_run") &&
-    fence?.legacyProofRevision !== null &&
-    fence?.legacyProofRevision !== undefined &&
-    fence.legacyProofRevision === highWater.revision
-  ) {
-    asOf = {
-      artifact_digest: null,
-      collection_revision: highWater.revision,
-      committed_at: highWater.at,
-      evidence: "legacy_diagnostics",
-      run_id: highWater.event === "terminal_run" ? highWater.runId : null,
-    };
-  }
+  const asOf: LocalCoverageAsOf | null =
+    terminal &&
+    !unorderedLaterRun &&
+    terminal.artifactDigest !== null &&
+    highWater?.event === "terminal_run" &&
+    highWater.runId === terminal.runId &&
+    terminal.collectionRevision !== null &&
+    terminal.collectionRevision === highWater.revision
+      ? {
+          artifact_digest: terminal.artifactDigest,
+          collection_revision: highWater.revision,
+          committed_at: terminal.run.last_at ?? null,
+          evidence: "terminal_run",
+          run_id: terminal.runId,
+        }
+      : null;
   if (!asOf) {
     return {
       ...axis,
@@ -7273,8 +7258,8 @@ function synthesizeConnectorSummary(input: ConnectorSummarySynthesisInput): Conn
   const authoritativeLatestSettledRun = isOwnScopedRun(fallbackSettledRun) ? fallbackSettledRun : null;
   const localCollectorRelease = localDeviceBacked ? readLocalCollectorRelease(connectorId) : null;
   // The proof is the terminal run the connection's revision high-water mark
-  // names (else the legacy diagnostics row). Any later observed event retires
-  // it. The downstream readers below all take `effectiveLocalCoverage`, so the
+  // names; a legacy diagnostics row is never one. Any later observed event
+  // retires it. The downstream readers below all take `effectiveLocalCoverage`, so the
   // retirement reaches every consumer, not only this branch.
   const proofRunCoverage = localDeviceBacked
     ? localProofRunCoverage(localCoverage?.revisionFence, connectorInstanceId)
@@ -9919,6 +9904,11 @@ export interface OwnerConnectionDiagnostics {
   readonly connection_id: string;
   readonly connector_id: string;
   readonly connector_key: string;
+  /**
+   * What the coverage in `health.axes` and `rendered_verdict` is a fact
+   * about. See {@link ConnectorSummary.coverage_as_of}.
+   */
+  readonly coverage_as_of: LocalCoverageAsOf | null;
   readonly display_name: string | null;
   readonly freshness: Freshness;
   readonly health: OwnerConnectionDiagnosticsHealth;
@@ -10053,6 +10043,7 @@ export async function getOwnerConnectionDiagnostics(
     connection_id: summary.connection_id,
     connector_id: summary.connector_id,
     connector_key: summary.connector_id,
+    coverage_as_of: summary.coverage_as_of,
     display_name: summary.display_name,
     freshness: summary.freshness,
     health: {
diff --git a/reference-implementation/server/stores/collection-revision-store.ts b/reference-implementation/server/stores/collection-revision-store.ts
index c93e7c53f..a68259c11 100644
--- a/reference-implementation/server/stores/collection-revision-store.ts
+++ b/reference-implementation/server/stores/collection-revision-store.ts
@@ -183,13 +183,12 @@ export interface LocalCoverageProofRun {
 
 /**
  * Everything the projection needs to decide whether a local coverage proof is
- * current. `highWater` is null when the connection has no readable revision.
- * `legacyProofRevision` is the revision stamped on the `coverage_diagnostics`
- * state row. `proofRun` is present only when the newest event is a terminal run.
+ * current, read in one snapshot. `highWater` is null when the connection has
+ * no readable revision. `proofRun` is present only when the newest event is a
+ * terminal run.
  */
 export interface LocalCoverageRevisionFence {
   readonly highWater: CollectionRevisionHighWater | null;
-  readonly legacyProofRevision: number | null;
   readonly proofRun: LocalCoverageProofRun | null;
 }
 
@@ -207,8 +206,7 @@ function parseFacts(value: unknown): Record<string, unknown> | null {
 
 /** Batched fence read for one page of connections, keyed by connector instance. */
 export async function readLocalCoverageRevisionFences(
-  connectorInstanceIds: readonly string[],
-  legacyProofStream: string
+  connectorInstanceIds: readonly string[]
 ): Promise<Map<string, LocalCoverageRevisionFence>> {
   interface Row {
     collection_revision: unknown;
@@ -216,7 +214,6 @@ export async function readLocalCoverageRevisionFences(
     collection_revision_event: string | null;
     collection_revision_run_id: string | null;
     connector_instance_id: string;
-    legacy_proof_revision: unknown;
     proof_completed_at: string | null;
     proof_facts_json: unknown;
     proof_run_id: string | null;
@@ -228,24 +225,21 @@ export async function readLocalCoverageRevisionFences(
   if (ids.length === 0) {
     return new Map();
   }
-  const select = (revisionColumn: string, legacyColumn: string, stream: string, runTerminal: string) =>
+  const select = (revisionColumn: string, runTerminal: string) =>
     `SELECT ci.connector_instance_id, ${revisionColumn} AS collection_revision, ci.collection_revision_event,
             ci.collection_revision_run_id, ci.collection_revision_at,
-            ${legacyColumn} AS legacy_proof_revision,
             rh.run_id AS proof_run_id, rh.status AS proof_status, rh.scheduler_managed AS proof_scheduler_managed,
             rh.completed_at AS proof_completed_at, rh.facts_json AS proof_facts_json
        FROM connector_instances ci
-       LEFT JOIN connector_state cs
-         ON cs.connector_instance_id = ci.connector_instance_id AND cs.stream = ${stream}
        LEFT JOIN run_history rh
          ON rh.connector_instance_id = ci.connector_instance_id
         AND rh.run_id = ci.collection_revision_run_id
         AND ci.collection_revision_event = ${runTerminal}`;
   if (isPostgresStorageBackend()) {
     const result = await postgresQuery<Row>(
-      `${select("ci.collection_revision::text", "cs.collection_revision::text", "$2", "$3")}
+      `${select("ci.collection_revision::text", "$2")}
         WHERE ci.connector_instance_id = ANY($1::text[])`,
-      [ids, legacyProofStream, "terminal_run"]
+      [ids, "terminal_run"]
     );
     rows.push(...result.rows);
   } else {
@@ -254,10 +248,10 @@ export async function readLocalCoverageRevisionFences(
       rows.push(
         ...(getDb()
           .prepare(
-            `${select("ci.collection_revision", "cs.collection_revision", "?", "?")}
+            `${select("ci.collection_revision", "?")}
               WHERE ci.connector_instance_id IN (${chunk.map(() => "?").join(", ")})`
           )
-          .all(legacyProofStream, "terminal_run", ...chunk) as Row[])
+          .all("terminal_run", ...chunk) as Row[])
       );
     }
   }
@@ -274,8 +268,6 @@ export async function readLocalCoverageRevisionFences(
               revision,
               runId: row.collection_revision_run_id ?? null,
             },
-      legacyProofRevision:
-        row.legacy_proof_revision === null ? null : readCollectionRevision(row.legacy_proof_revision),
       proofRun:
         typeof row.proof_run_id === "string" && typeof row.proof_status === "string"
           ? {
diff --git a/reference-implementation/test/local-device-coverage-stale-proof.test.ts b/reference-implementation/test/local-device-coverage-stale-proof.test.ts
index a7d0e48a7..cc837b25d 100644
--- a/reference-implementation/test/local-device-coverage-stale-proof.test.ts
+++ b/reference-implementation/test/local-device-coverage-stale-proof.test.ts
@@ -696,12 +696,13 @@ test("revision: an unreadable or mismatched revision fails closed", async (t) =>
   }
 });
 
-// Legacy path: no v2 run exists, so the projection reads the committed
-// `coverage_diagnostics` snapshot. It binds to the revision of the state commit
-// that wrote it.
+// Legacy path: no v2 run exists, only a committed `coverage_diagnostics`
+// snapshot. That snapshot names no run and no release digest, so it is never a
+// positive proof: the projection is unknown even while its commit is the
+// newest event.
 const LEGACY_DIAGNOSTICS_STREAM = "coverage_diagnostics";
 
-test("revision: a legacy diagnostics proof stands while its commit is newest; any later commit retires it", async (t) => {
+test("revision: a legacy diagnostics snapshot never shows positive coverage, even as the newest commit", async (t) => {
   await withBoundaryConnection(async () => {
     const stores = expectedLocalCoverageStoreDescriptors(connectorId);
     assert.ok(stores, "the claude-code inventory declares its coverage stores");
@@ -715,25 +716,19 @@ test("revision: a legacy diagnostics proof stands while its commit is newest; an
       [LEGACY_DIAGNOSTICS_STREAM]: snapshot,
       messages: { cursor: "own" },
     });
+    const revision = highWaterRevision();
+    assert.ok(revision > 0, "the commit took a revision");
     const projected = await boundaryProjection();
-    assert.equal(projected.axis, "complete", "the legacy snapshot is a reliable complete proof");
-    assert.equal(projected.asOf?.evidence, "legacy_diagnostics", "the legacy proof carries its as-of");
-    assert.deepEqual(projected.asOf, {
-      artifact_digest: null,
-      collection_revision: highWaterRevision(),
-      committed_at: PROOF_AT,
-      evidence: "legacy_diagnostics",
-      run_id: null,
-    });
+    // Without a run id and release digest there is nothing for the owner's "complete as of" to name.
+    assert.equal(projected.axis, "unknown", "a fully collected legacy snapshot without run provenance is unknown");
+    assert.deepEqual(projected.conditions, UNKNOWN);
+    assert.equal(projected.asOf, null, "unknown coverage carries no as-of");
 
-    await putSyncState(BOUNDARY_TARGET, {
-      messages: { cursor: "same-instant" },
-    });
-    assert.equal(
-      (await boundaryProjection()).axis,
-      "unknown",
-      "a separate commit at the same instant retires the legacy proof"
-    );
+    // A v2 proof after the snapshot is the current proof, and it names its run.
+    await seedV2Proof("run_after_legacy_snapshot");
+    const proof = await boundaryProjection();
+    assert.equal(proof.axis, "complete");
+    assert.equal(proof.asOf?.run_id, "run_after_legacy_snapshot");
   });
 });
 
diff --git a/reference-implementation/test/local-device-coverage-state-commit-postgres.test.ts b/reference-implementation/test/local-device-coverage-state-commit-postgres.test.ts
index b02c5fb7f..636c8b0f5 100644
--- a/reference-implementation/test/local-device-coverage-state-commit-postgres.test.ts
+++ b/reference-implementation/test/local-device-coverage-state-commit-postgres.test.ts
@@ -147,7 +147,6 @@ test("real PostgreSQL: the collection revision orders commits and observed event
     );
     assert.equal(afterRun.withState?.proofRun?.runId, PROOF_RUN, "the fence reads the run the high-water mark names");
     assert.equal(afterRun.withState?.proofRun?.facts?.collection_revision, 2, "the run record carries its revision");
-    assert.equal(afterRun.withState?.legacyProofRevision, null, "no diagnostics row exists");
     assert.deepEqual(afterRun.scopeOnly?.highWater, {
       at: null,
       event: null,
diff --git a/reference-implementation/test/local-device-required-stream-proof-scope.test.ts b/reference-implementation/test/local-device-required-stream-proof-scope.test.ts
index 057de304b..bf6973635 100644
--- a/reference-implementation/test/local-device-required-stream-proof-scope.test.ts
+++ b/reference-implementation/test/local-device-required-stream-proof-scope.test.ts
@@ -28,7 +28,11 @@ import { readPolyfillManifests } from "@pdpp/polyfill-connectors/manifests";
 import { reconcileDirtyConnectorSummaryEvidence } from "../server/connector-summary-read-model.ts";
 import { closeDb, getDb, initDb } from "../server/db.ts";
 import { COLLECTION_SCOPE_STATE_KEY } from "../server/local-collection-scope.ts";
-import { putSyncState, readCommittedLocalCoverageDiagnostics } from "../server/records.ts";
+import {
+  putSyncState,
+  readCommittedLocalCoverageDiagnostics,
+  readCommittedLocalCoverageDiagnosticsByConnectionIds,
+} from "../server/records.ts";
 import { deriveLocalCoverageAxis, listConnectorSummaries } from "../server/ref-control.ts";
 import { rebuildRetainedSize } from "../server/retained-size-read-model.ts";
 import { recordCollectionRevisionEvent } from "../server/stores/collection-revision-store.ts";
@@ -240,6 +244,38 @@ async function seedLocalRun({
   await rebuildRetainedSize();
 }
 
+/**
+ * The legacy snapshot's own classification against the declared boundary,
+ * before the owner projection decides whether it may show it. A legacy
+ * `coverage_diagnostics` snapshot names no run and no release digest, so the
+ * owner projection never shows it as positive coverage; these tests still pin
+ * that the boundary comparison classifies it correctly.
+ */
+async function legacySnapshotAxis() {
+  // The connection-keyed reader is the one the owner rollup uses.
+  const proof = (await readCommittedLocalCoverageDiagnosticsByConnectionIds([CONNECTOR_INSTANCE_ID])).get(
+    CONNECTOR_INSTANCE_ID
+  );
+  assert.ok(proof, "the connection has a committed coverage snapshot");
+  return deriveLocalCoverageAxis({ ...proof, nowIso: new Date().toISOString() });
+}
+
+/** A complete legacy snapshot is unknown to the owner: it carries no run id or release digest for its as-of. */
+function assertLegacyCompleteIsWithheld(
+  manifest: TestManifest,
+  report: Awaited<ReturnType<typeof projectReport>>,
+  why: string
+): void {
+  assert.equal(report.coverageAxis, "unknown", `${why}, but without run provenance it is not shown`);
+  for (const stream of requiredStreams(manifest)) {
+    assert.equal(
+      report.entryFor(stream)?.coverage_condition,
+      "unknown",
+      `${stream}: ${why}, but a legacy snapshot cannot back "complete as of" a run`
+    );
+  }
+}
+
 interface TestReportEntry {
   readonly coverage_condition?: unknown;
   readonly forward_disposition?: unknown;
@@ -320,15 +356,10 @@ for (const name of LOCAL_COLLECTORS) {
       const manifest = readManifest(name);
       await seedLocalRun({ declaredScope: SAMPLE_SCOPE, manifest, measuredScope: SAMPLE_FINGERPRINT });
 
-      const { coverageAxis, entryFor } = await projectReport();
-      assert.equal(coverageAxis, "complete");
-      for (const stream of requiredStreams(manifest)) {
-        assert.equal(
-          entryFor(stream)?.coverage_condition,
-          "complete",
-          `${stream}: a sample run that enforced the declared bound proves that region`
-        );
-      }
+      const snapshot = await legacySnapshotAxis();
+      assert.equal(snapshot.axis, "complete", "a sample run that enforced the declared bound classifies that region");
+      assert.equal(snapshot.measuredCollectionScope, SAMPLE_FINGERPRINT);
+      assertLegacyCompleteIsWithheld(manifest, await projectReport(), "the sample run measured the declared region");
     })
   );
 
@@ -342,13 +373,10 @@ for (const name of LOCAL_COLLECTORS) {
       const manifest = readManifest(name);
       await seedLocalRun({ manifest });
 
-      const { coverageAxis, entryFor } = await projectReport();
-      assert.equal(coverageAxis, "complete");
+      assert.equal((await legacySnapshotAxis()).axis, "complete", "every expected store was collected");
       const required = requiredStreams(manifest);
       assert.ok(required.length > 0, "the shipped manifest must declare required streams");
-      for (const stream of required) {
-        assert.equal(entryFor(stream)?.coverage_condition, "complete", `${stream} must prove complete`);
-      }
+      assertLegacyCompleteIsWithheld(manifest, await projectReport(), "the full pass collected every store");
     })
   );
 
@@ -362,15 +390,12 @@ for (const name of LOCAL_COLLECTORS) {
       const manifest = readManifest(name);
       await seedLocalRun({ emitRecords: false, manifest });
 
-      const { coverageAxis, entryFor } = await projectReport();
-      assert.equal(coverageAxis, "complete");
-      for (const stream of requiredStreams(manifest)) {
-        assert.equal(
-          entryFor(stream)?.coverage_condition,
-          "complete",
-          `${stream}: a measured empty pass is proven coverage, not a gap`
-        );
-      }
+      assert.equal(
+        (await legacySnapshotAxis()).axis,
+        "complete",
+        "a measured empty pass classifies as coverage, not a gap"
+      );
+      assertLegacyCompleteIsWithheld(manifest, await projectReport(), "the empty pass measured every store");
     })
   );
 
diff --git a/reference-implementation/test/ref-connectors-local-coverage-green.test.ts b/reference-implementation/test/ref-connectors-local-coverage-green.test.ts
index 5f562e1c7..365b3b5d0 100644
--- a/reference-implementation/test/ref-connectors-local-coverage-green.test.ts
+++ b/reference-implementation/test/ref-connectors-local-coverage-green.test.ts
@@ -407,8 +407,23 @@ async function projectConnection() {
   return row;
 }
 
+// A legacy `coverage_diagnostics` snapshot names no run and no release digest,
+// so the owner projection cannot say what "complete as of" it would describe.
+// It never shows positive coverage: these tests pin that the snapshot still
+// classifies (via `deriveLocalCoverageAxis`) while the projection is unknown.
+const LEGACY_WITHHELD = "a legacy diagnostics snapshot has no run id or release digest, so it never shows as complete";
+
+async function legacySnapshotAxis() {
+  return deriveLocalCoverageAxis(
+    (await readCommittedLocalCoverageDiagnostics({
+      connector_id: CONNECTOR_ID,
+      connector_instance_id: CONNECTOR_INSTANCE_ID,
+    })) as Parameters<typeof deriveLocalCoverageAxis>[0]
+  ).axis;
+}
+
 test(
-  "healthy drained local collector with full coverage diagnostics projects coverage=complete (no longer unknown)",
+  "healthy drained local collector with full legacy coverage diagnostics projects coverage=unknown (no run provenance)",
   withTmpDb(async () => {
     seedConnector();
     await seedInstance();
@@ -442,40 +457,30 @@ test(
     const row = await projectConnection();
     const health = row.connection_health;
 
-    // The durable coverage evidence proves complete coverage, so the projection
-    // must NOT remain coverage_unknown. This is the core fix: the live symptom
-    // was `SourceCoverageComplete:coverage_unknown` on a drained collector.
-    assert.equal(health.axes.coverage, "complete");
+    // The snapshot accounts for every store, but it names no run and no
+    // release, so the projection withholds it: coverage is unknown.
+    assert.equal(await legacySnapshotAxis(), "complete", "the snapshot itself classifies as complete");
+    assert.equal(health.axes.coverage, "unknown", LEGACY_WITHHELD);
+    assert.equal(row.coverage_as_of, null, "unknown coverage carries no as-of");
     assert.equal(health.axes.outbox, "idle");
 
     const reportByStream = Object.fromEntries(row.collection_report.map((entry) => [entry.stream, entry]));
-    assert.equal(
-      reportByStream.messages?.coverage_condition,
-      "complete",
-      "local coverage diagnostics prove messages complete directly, and it also agrees with state_stream parent inheritance"
-    );
-    assert.equal(
-      reportByStream.attachments?.coverage_condition,
-      "complete",
-      "local coverage diagnostics prove attachments complete directly, and it also agrees with state_stream parent inheritance"
-    );
+    assert.equal(reportByStream.messages?.coverage_condition, "unknown", `messages: ${LEGACY_WITHHELD}`);
+    assert.equal(reportByStream.attachments?.coverage_condition, "unknown", `attachments: ${LEGACY_WITHHELD}`);
     assert.equal(
       reportByStream.coverage_diagnostics?.coverage_condition,
-      "complete",
-      "coverage_diagnostics proves itself complete once durable diagnostic rows exist"
+      "unknown",
+      `coverage_diagnostics: ${LEGACY_WITHHELD}`
     );
-    assert.equal(
-      reportByStream.sessions?.coverage_condition,
-      "complete",
-      "local coverage diagnostics should prove per-stream coverage even when the stream emitted no retained records"
-    );
-    assert.notEqual(reportByStream.messages?.forward_disposition, "unmeasured");
-    assert.notEqual(reportByStream.sessions?.forward_disposition, "unmeasured");
+    assert.equal(reportByStream.sessions?.coverage_condition, "unknown", `sessions: ${LEGACY_WITHHELD}`);
+    // Without a current proof the next run's effect is not measured either.
+    assert.equal(reportByStream.messages?.forward_disposition, "unmeasured", LEGACY_WITHHELD);
+    assert.equal(reportByStream.sessions?.forward_disposition, "unmeasured", LEGACY_WITHHELD);
 
     const coverageCondition = health.conditions.find((c) => c.type === "SourceCoverageComplete");
     assert.ok(coverageCondition);
-    assert.equal(coverageCondition.status, "true");
-    assert.notEqual(coverageCondition.reason, "coverage_unknown");
+    assert.equal(coverageCondition.status, "unknown", LEGACY_WITHHELD);
+    assert.equal(coverageCondition.reason, "coverage_unknown");
 
     // Headline: this connector declares NO refresh policy, so freshness is
     // `unknown` and the local-device collection verdict is not established. The
@@ -912,7 +917,7 @@ test(
 const ALWAYS_FRESH_REFRESH_POLICY = { maximum_staleness_seconds: 100 * 365 * 24 * 60 * 60 };
 
 test(
-  "local committed coverage supports a healthy local-device verdict",
+  "local committed legacy coverage does not support a healthy local-device verdict without run provenance",
   withTmpDb(async () => {
     // Same fully-green device evidence as the idle case above, but the manifest
     // now declares a refresh policy that the recent healthy heartbeat satisfies.
@@ -938,15 +943,21 @@ test(
     const row = await projectConnection();
     const health = row.connection_health;
 
-    assert.equal(health.axes.coverage, "complete");
+    assert.equal(await legacySnapshotAxis(), "complete", "the snapshot itself classifies as complete");
+    assert.equal(health.axes.coverage, "unknown", LEGACY_WITHHELD);
     assert.equal(health.axes.outbox, "idle");
     assert.equal(health.axes.freshness, "fresh");
-    assert.equal(health.state, "healthy");
+    assert.notEqual(health.state, "healthy", `${LEGACY_WITHHELD}, so it cannot make the verdict healthy`);
 
+    // A clean local collection is "drained with complete coverage"; without a current proof it is not established.
     const collection = health.conditions.find((c) => c.type === "CollectionSucceeded");
     assert.ok(collection);
-    assert.equal(collection.status, "true");
-    assert.equal(collection.origin, "local_device");
+    assert.equal(collection.status, "unknown", LEGACY_WITHHELD);
+    assert.equal(
+      collection.origin,
+      "connector",
+      "no local-device collection is established, so the generic condition applies"
+    );
   })
 );
 
@@ -981,9 +992,9 @@ test(
     assert.equal(row.freshness.status, "current");
     assert.equal(row.freshness.captured_at, HEARTBEAT_AT);
     assert.equal(health.axes.freshness, "fresh");
-    assert.equal(health.axes.coverage, "complete");
+    assert.equal(health.axes.coverage, "unknown", LEGACY_WITHHELD);
     assert.equal(health.axes.outbox, "idle");
-    assert.equal(health.state, "healthy");
+    assert.notEqual(health.state, "healthy", `${LEGACY_WITHHELD}, so it cannot make the verdict healthy`);
   })
 );
 
@@ -1305,7 +1316,7 @@ test("SourceCoverageComplete names a stale collector build, not a generic 'evide
 });
 
 test(
-  "local collector with unaccounted stores projects coverage gaps with actionable reason, not unknown",
+  "local collector with unaccounted stores in a legacy snapshot projects unknown, never complete",
   withTmpDb(async () => {
     seedConnector();
     await seedInstance();
@@ -1323,20 +1334,19 @@ test(
     const row = await projectConnection();
     const health = row.connection_health;
 
-    // Coverage must surface the gap honestly rather than hiding it behind green
-    // or behind a generic unknown.
-    assert.notEqual(health.axes.coverage, "unknown");
+    // The snapshot itself still names the shortfall, but a legacy snapshot is
+    // not current evidence about a run, so the projection is unknown, never green.
+    assert.equal(await legacySnapshotAxis(), "gaps", "the snapshot itself names the unaccounted store");
+    assert.equal(health.axes.coverage, "unknown", LEGACY_WITHHELD);
     assert.notEqual(health.axes.coverage, "complete");
 
     const coverageCondition = health.conditions.find((c) => c.type === "SourceCoverageComplete");
     assert.ok(coverageCondition);
-    assert.equal(coverageCondition.status, "false");
-    // Reason/remediation must be actionable and name the coverage shortfall.
-    assert.ok(coverageCondition.remediation);
-    assert.notEqual(coverageCondition.reason, "coverage_unknown");
+    assert.equal(coverageCondition.status, "unknown", LEGACY_WITHHELD);
+    assert.equal(coverageCondition.reason, "coverage_unknown");
 
-    // Degraded, not silently healthy.
-    assert.equal(health.state, "degraded");
+    // Never silently healthy.
+    assert.notEqual(health.state, "healthy");
   })
 );
 

From d466110ccc93ffd871e9f34145939c2ad0e04df7 Mon Sep 17 00:00:00 2001
From: Tim Nunamaker <tnunamak@gmail.com>
Date: Thu, 22 Oct 2026 08:55:31 -0500
Subject: [PATCH 39/87] fix(coverage): commit each collection revision with its
 event

The collection revision that retires a local coverage proof was written
in its own transaction, apart from the event it ordered. An admitted
batch took its revision before a separate completeProcessingBatch, and
its records committed before either. A failure report stored its gap
before a separate revision write. A refused batch caught a failed
revision write and still answered the refusal. Each gap left a durable
state in which an earlier proof stayed current. The legacy split
terminal-collection report took no revision and copied the current one,
so a delayed report for an older run could not retire a newer proof.

Each event now allocates its revision inside the transaction that
persists it, on SQLite and Postgres:

- every durable device batch record (new event batch_record), with its
  write and durable-prefix advance;
- the batch acceptance, with the processing-to-accepted transition that
  decides replays;
- a failure report, with its gap upsert;
- the legacy split report (new event legacy_terminal), with its run
  event and run record.

If the revision cannot be recorded, the event rolls back. A refusal
whose revision cannot be recorded is answered 503
device_ingest_retryable instead of the refusal. On Postgres the
acceptance and the gap upsert lock the connection row first, the order
a device record transaction already uses.

The new suite runs on SQLite and a real PostgreSQL. A database trigger
makes revision writes fail, and the ingest phase hook interleaves a
terminal commit inside a batch and two batches around a proof. It also
covers terminal replay, a refused resend from the proof's own run, a
delayed legacy report, as-of on every owner surface, and the upgrade
from a database without revision columns. Fixtures that drive the
device store directly now create the connection row the revision needs.

Assisted-by: AI
Signed-off-by: Tim Nunamaker <tnunamak@gmail.com>
---
 PG-PROFILE-51-REPORT.md                       |   2 +-
 docs/261021-local-device-coverage-evidence.md |  38 +-
 .../local-device-terminal-collection.ts       |  18 +-
 .../scripts/postgres-template-eligibility.ts  |   2 +
 .../server/routes/ref-device-exporters.ts     | 142 +--
 .../stores/collection-revision-store.ts       | 114 +--
 .../stores/connector-detail-gap-store.ts      | 519 ++++++-----
 .../server/stores/device-exporter-store.ts    |  36 +
 .../stores/terminal-run-commit-store.ts       |  45 +
 .../device-exporter-postgres-proof.test.ts    |   9 +
 ...evice-ingest-attempt-context-store.test.ts |  38 +
 ...device-coverage-revision-atomicity.test.ts | 849 ++++++++++++++++++
 12 files changed, 1441 insertions(+), 371 deletions(-)
 create mode 100644 reference-implementation/test/local-device-coverage-revision-atomicity.test.ts

diff --git a/PG-PROFILE-51-REPORT.md b/PG-PROFILE-51-REPORT.md
index d0209d32d..293619b67 100644
--- a/PG-PROFILE-51-REPORT.md
+++ b/PG-PROFILE-51-REPORT.md
@@ -168,7 +168,7 @@ tail:
 
 The completed profile receipt recorded 1,034 files; that historical receipt
 is unchanged. The template equivalence registry is a different measure:
-157 eligible plus 37 cold-required files, for **194** total. The
+157 eligible plus 38 cold-required files, for **195** total. The
 handle-generation, issuance-cutover, opaque-cursor and search-index repair
 tests remain registered. These counts are recomputed from the merged registry arrays.
 
diff --git a/docs/261021-local-device-coverage-evidence.md b/docs/261021-local-device-coverage-evidence.md
index e2a2e082e..9d3a3da65 100644
--- a/docs/261021-local-device-coverage-evidence.md
+++ b/docs/261021-local-device-coverage-evidence.md
@@ -38,7 +38,7 @@ The collector stores the latest acknowledged v2 receipt in local outbox schema v
 
 The device verdict (`pdpp-local-collector status`, `terminal_coverage.verdict`) is `covered` only when the receipt names the selected release, every store is `collected`, and the run's runtime accounting is clean: durable admission, complete detail, consistent stream evidence, checkpoint eligibility, and zero outstanding debt. Clean accounting is the same test the server applies before it withholds `collected`. Missing or malformed accounting reads `no_evidence`; a measured gap reads `incomplete`. Open outbox work for the lane (queued, leased or dead-lettered) reads `unadmitted`, because the latest run has not reached a durable terminal commit and the receipt no longer stands for it.
 
-The server's owner coverage is a fact about one admitted run, shown with its as-of. Any later attempt the server observes (a state commit, a terminal run record, an admitted or refused batch, a delivered failure report) retires it to unknown; see "Revision fencing" below. Only an attempt the server never hears about leaves the last admitted coverage in place. Every failed run, including one that fails before its scan, leaves an open `connector_child_failure` gap on the device, so the device shows that run as `unadmitted` until a later complete run is admitted and recovers the gap.
+The server's owner coverage is a fact about one admitted run, shown with its as-of. Any later attempt the server observes (a state commit, a terminal run record, a durable batch record, an admitted or refused batch, a delivered failure report, a legacy split terminal report) retires it to unknown; see "Revision fencing" below. Only an attempt the server never hears about leaves the last admitted coverage in place. Every failed run, including one that fails before its scan, leaves an open `connector_child_failure` gap on the device, so the device shows that run as `unadmitted` until a later complete run is admitted and recovers the gap.
 
 ## Collection Profile amendment
 
@@ -52,28 +52,38 @@ Failing-first tests must show absent coverage unknown, a valid fully drained pro
 
 The spec gate replaced the server's wall-clock rule (MAX `connector_state.updated_at` compared with the proof instant) with a monotonic per-connection revision. Equal timestamps do not identify a transaction, and a skewed clock can order a later commit before an earlier one. The revision follows the Core restore-safety fencing principle: retire by revision comparison only.
 
-Events that get a revision. The server assigns the next revision inside the transaction of each event it can observe for an authorized connection:
+Events that get a revision. The server assigns the next revision inside the transaction that persists each event it can observe for an authorized connection. The event and its revision commit together or not at all:
 
-| Event | Kind | Where |
+| Event | Kind | Transaction it shares |
 | --- | --- | --- |
-| Owner-scoped state write that touches a non-`$` stream | `state_commit` | connector-state store, PUT state route |
-| Terminal run commit (v1 or v2), with its own state delta | `terminal_run` | terminal-run-commit store |
-| New ingest batch admitted (not a replay of an admitted batch) | `batch_accepted` | device ingest route |
-| Ingest batch received and refused (4xx after device authorization) | `batch_rejected` | device ingest route |
-| Failure report received (`connector_child_failure` or `policy_budget` gap) | `failure_report` | local-collector-gaps route |
+| Owner-scoped state write that touches a non-`$` stream | `state_commit` | the state write (connector-state store, PUT state route) |
+| Terminal run commit (v1 or v2), with its own state delta | `terminal_run` | the terminal event, its state rows and run record (terminal-run-commit store) |
+| Device batch record made durable | `batch_record` | that record's write and its durable-prefix advance (device ingest, `advance*DeviceIngestPrefix`) |
+| Device batch accepted | `batch_accepted` | the `processing` to `accepted` transition, which is the replay decision (`completeProcessingBatch`) |
+| Device batch refused after authorization (4xx, or a 503 after a received attempt) | `batch_rejected` | its own transaction; the revision is the refusal's only durable effect |
+| Failure report (`connector_child_failure` or `policy_budget` gap) | `failure_report` | the gap upsert (`upsertPendingGap` with `collectionRevision`) |
+| Legacy split `terminal-collection` report | `legacy_terminal` | its run event and run record (`commitLegacyTerminalCollection`) |
 
-Server-owned `$` scope rows, heartbeats, gap recoveries, grant-scoped state, and the legacy split `terminal-collection` report get no revision. They neither establish nor retire proof. The legacy split report follows its own state commit, which already has a revision; its run record is labelled with the current revision so that the projection can order it.
+Server-owned `$` scope rows, heartbeats, gap recoveries, grant-scoped state, and replays of an accepted batch or a stored terminal response get no revision. They neither establish nor retire proof.
 
-Storage. `connector_instances` holds the high-water mark: `collection_revision` (0 before any event), `collection_revision_event`, `collection_revision_run_id`, and `collection_revision_at` (wall-clock, display only). `connector_state.collection_revision` records the revision of the commit that last wrote each row. The terminal run event, and so `run_history.facts_json`, carries `collection_revision`. SQLite adds the columns with `addColumnIfMissing`; Postgres uses `ALTER TABLE ... ADD COLUMN IF NOT EXISTS`. Rows that predate the migration read NULL and fail closed.
+Atomicity. No event commits without its revision, and no revision is allocated in a separate transaction before or after its event:
 
-Proof binding. A v2 proof is the terminal run record at revision R; its own state rows carry R. A legacy `coverage_diagnostics` proof is that state row, at the revision of the commit that wrote it.
+- SQLite. Each event runs in one `BEGIN IMMEDIATE` transaction (the record write, `completeProcessingBatch`, the gap upsert, the terminal commits). The revision `UPDATE ... RETURNING` runs inside it. The write lock serializes events per database, so revisions follow commit order.
+- Postgres. Each event runs in one `withPostgresTransaction` and locks the `connector_instances` row before the batch outcome or gap row. `completeProcessingBatch` and the gap upsert take the lock with the revision `UPDATE` as their first statement. A device record transaction already holds it from its admission check (`FOR UPDATE`). Terminal commits take the connector-instance advisory lock, then the row. Concurrent events for a connection therefore serialize on the row, and revisions follow commit order.
+- Failure. If the revision cannot be recorded (no connection row, or a storage error), the store throws and the event rolls back. A device record or acceptance is not stored, a failure report stores no gap, and a terminal report stores no run. A refusal whose revision cannot be recorded is answered `503 device_ingest_retryable`, not with the refusal, so the device retries rather than trusting an answer the server cannot order. No catch turns an unrecorded revision into success.
 
-Retirement. A proof is current only when its revision equals the connection's high-water revision. For a v2 proof, the high-water event must also be `terminal_run` with the same run id. The server reads the proof run by that run id, not by the newest `completed_at`. Any later observable event raises the high-water revision and retires the proof to unknown. No wall clock takes part.
+Each durable batch record takes its own revision, so a crash after any record commits, before the acceptance, leaves the earlier proof retired. A terminal commit that lands between two records of a batch is retired by the next record.
 
-Fail closed. Coverage is unknown when the high-water row or the proof revision is missing, NULL, not a safe integer, or unequal; when the high-water run id differs from the proof run; or when the revision read fails. A v2 proof is also unknown when the newest settled device run is a different run that carries no revision (a pre-migration row or a writer that assigns none), because its order against the proof is ambiguous.
+Storage. `connector_instances` holds the high-water mark: `collection_revision` (0 before any event), `collection_revision_event`, `collection_revision_run_id`, and `collection_revision_at` (wall-clock, display only). `connector_state.collection_revision` records the revision of the commit that last wrote each row; the projection no longer reads it. The terminal run event, and so `run_history.facts_json`, carries `collection_revision`, for v2, v1 and legacy split reports. SQLite adds the columns with `addColumnIfMissing`; Postgres uses `ALTER TABLE ... ADD COLUMN IF NOT EXISTS`. Rows that predate the migration read 0 or NULL and fail closed until the next event.
+
+Proof binding. A proof is a v2 terminal run record at revision R; its own state rows carry R. The projection reads the high-water mark and the run it names in one joined query, so the proof payload and its fence come from one snapshot. A legacy `coverage_diagnostics` state row is never a proof: it names no run and no release digest, so it cannot back "complete as of" anything, and the projection shows unknown for it (PR #553 retires the legacy path).
+
+Retirement. A proof is current only when its revision equals the connection's high-water revision, the high-water event is `terminal_run`, and its run id is the proof run. The server reads the proof run by that run id, not by the newest `completed_at`. Any later observable event raises the high-water revision and retires the proof to unknown. A legacy split report is its own `legacy_terminal` event, so one delayed past a newer proof retires that proof. No wall clock takes part.
+
+Fail closed. Coverage is unknown when the high-water row or the proof revision is missing, NULL, not a safe integer, or unequal; when the high-water event or run id differs from the proof; when the proof does not name exactly one release digest; or when the revision read fails. A proof is also unknown when the newest settled device run is a different run that carries no revision (a pre-migration row), because its order against the proof is ambiguous.
 
 Terminal record for every successful run. A runtime that implements this profile version commits a terminal run record for every run whose DONE succeeded, even when coverage was not negotiated and no STATE changed. Without coverage evidence it sends a version 2 commit with empty `terminal_facts`, carrying the run's STATE delta. The server stores unknown inventory for it, and the device clears its receipt (`no_evidence`). A server that names no connection on its state read cannot bind a terminal record, so against such a server the runtime keeps the plain state checkpoint.
 
-As-of. Every owner projection that shows local coverage carries `coverage_as_of`: run id, release digest, collection revision, and commit time. Owner UI copy reads "complete as of <time>". A legacy proof has no release digest, so its `artifact_digest` is null.
+As-of. Every owner projection that can show positive local coverage carries `coverage_as_of`: run id, release digest, collection revision, and commit time. That is the connector summary (list), the connector detail, the owner connection diagnostics (`health.axes` and `rendered_verdict`), and the connection health embedded in each. All of them read the same summary projection. Owner UI copy reads "complete as of <time>".
 
 Limits. The server cannot order an attempt it never hears about. Examples are a run refused before authorization, a device that goes offline before it delivers its failure barrier, and a runner that predates this version and sends neither state nor records. In those cases the projection keeps the last admitted proof, labelled with its as-of. The device keeps its stricter local verdict. There is no heartbeat or lease machinery.
diff --git a/reference-implementation/operations/local-device-terminal-collection.ts b/reference-implementation/operations/local-device-terminal-collection.ts
index 0fe9cdaca..abbf4220b 100644
--- a/reference-implementation/operations/local-device-terminal-collection.ts
+++ b/reference-implementation/operations/local-device-terminal-collection.ts
@@ -6,9 +6,11 @@ import { canonicalTerminalRunCommitEnvelope } from "@pdpp/collector-runtime/loca
 import { canonicalTerminalRunCommitJson } from "@pdpp/reference-contract/common";
 import { fingerprintDeviceAttemptManifest } from "../server/device-ingest-attempt-context.ts";
 import { readRuntimeCollectionFact } from "../server/runtime-collection-facts.ts";
-import { readCollectionRevisionHighWaters } from "../server/stores/collection-revision-store.ts";
 import type { ResolvedTerminalRunCommit, TerminalRunCommitResult } from "../server/stores/terminal-run-commit-store.ts";
-import { TerminalRunCommitConflictError } from "../server/stores/terminal-run-commit-store.ts";
+import {
+  commitLegacyTerminalCollection,
+  TerminalRunCommitConflictError,
+} from "../server/stores/terminal-run-commit-store.ts";
 
 const ARTIFACT_DIGEST = /^sha256:[a-f0-9]{64}$/;
 
@@ -276,16 +278,15 @@ export async function handleLocalDeviceTerminalCollection(input: {
       );
       return;
     }
-    // The split report follows its own state commit, which already took a
-    // collection revision. It takes none itself; it is labelled with the
-    // current revision so the projection can order it against a proof.
+    // The split report is an observed collection event of its own. Its run
+    // record takes the next collection revision in the same transaction, so a
+    // report delayed past a newer proof retires that proof.
     const { connectorInstanceId } = authorized.connectorInstance;
-    const highWater = (await readCollectionRevisionHighWaters([connectorInstanceId])).get(connectorInstanceId);
-    await ctx.emitSpineEvent({
+    const event = (collectionRevision: number) => ({
       actor_id: deviceId,
       actor_type: "local_device",
       data: {
-        collection_revision: highWater?.revision ?? null,
+        collection_revision: collectionRevision,
         collection_facts: {
           // The boundary this evidence was measured against travels WITH it, so
           // a later scope change is detectable by comparison and stale proof can
@@ -314,6 +315,7 @@ export async function handleLocalDeviceTerminalCollection(input: {
       source_kind: "connector",
       status: "succeeded",
     });
+    await commitLegacyTerminalCollection({ buildEvent: event, connectorInstanceId, runId });
     res.status(201).json({ ok: true });
   } catch (error) {
     ctx.handleError(res, error);
diff --git a/reference-implementation/scripts/postgres-template-eligibility.ts b/reference-implementation/scripts/postgres-template-eligibility.ts
index 6869417cc..4747a21ed 100644
--- a/reference-implementation/scripts/postgres-template-eligibility.ts
+++ b/reference-implementation/scripts/postgres-template-eligibility.ts
@@ -220,6 +220,8 @@ export const POSTGRES_TEMPLATE_COLD_REQUIRED_FILES: readonly string[] = [
   "test/device-ingest-reservation-migration.test.ts",
   // Fences issuance writers while the cutover migration snapshots source tables.
   "test/issuance-cutover.test.ts",
+  // Drops the collection-revision columns and re-runs the bootstrap migration.
+  "test/local-device-coverage-revision-atomicity.test.ts",
   // Reopens old identity schemas and exercises migration rollback and recovery.
   "test/pairwise-grant-generation.test.ts",
   // Builds a prototype-shaped identity ledger before the real schema bootstrap.
diff --git a/reference-implementation/server/routes/ref-device-exporters.ts b/reference-implementation/server/routes/ref-device-exporters.ts
index 7e2de5cb5..307b2f40a 100644
--- a/reference-implementation/server/routes/ref-device-exporters.ts
+++ b/reference-implementation/server/routes/ref-device-exporters.ts
@@ -39,7 +39,11 @@ import { deriveReferenceFreshness } from "../freshness.ts";
 import { presentHeartbeatHealth } from "../heartbeat-lease.ts";
 import { buildStoredCollectionScope, COLLECTION_SCOPE_STATE_KEY } from "../local-collection-scope.ts";
 import { assertRecordIdentity, normalizePrimaryKey } from "../record-expand-helpers.ts";
-import { type CollectionRevisionEvent, recordCollectionRevisionEvent } from "../stores/collection-revision-store.ts";
+import {
+  type CollectionRevisionEventInput,
+  isCollectionRevisionUnavailable,
+  recordCollectionRevisionEvent,
+} from "../stores/collection-revision-store.ts";
 import { commitTerminalRun } from "../stores/terminal-run-commit-store.ts";
 import type { MiddlewareHandler, PdppErrorFn, RouteArg } from "./_route-contract.ts";
 import {
@@ -479,18 +483,21 @@ interface ConnectorDetailGapStore {
   }) => Promise<GapRow[]>;
   listPendingGapsForConnector?: (connectorId: string, options: { limit: number }) => Promise<GapRow[]>;
   markGapStatus: (gapId: string, status: string, options: { runId?: string }) => Promise<GapRow>;
-  upsertPendingGap: (params: {
-    connectorId: string;
-    connectorInstanceId: string;
-    stream: string;
-    source: unknown;
-    detailLocator: unknown;
-    reason: string;
-    lastError: unknown;
-    discoveredRunId?: string;
-    lastRunId?: string;
-    retryable?: boolean;
-  }) => Promise<GapRow>;
+  upsertPendingGap: (
+    params: {
+      connectorId: string;
+      connectorInstanceId: string;
+      stream: string;
+      source: unknown;
+      detailLocator: unknown;
+      reason: string;
+      lastError: unknown;
+      discoveredRunId?: string;
+      lastRunId?: string;
+      retryable?: boolean;
+    },
+    options?: { readonly collectionRevision?: CollectionRevisionEventInput }
+  ) => Promise<GapRow>;
 }
 
 export interface MountRefDeviceExportersContext {
@@ -2574,7 +2581,7 @@ export function mountRefDeviceExporterIngestBatches(app: AppLike, ctx: MountRefD
           sourceInstanceId,
         });
         if (!SHA256_HEX.test(bodyHash) || (bodyHash !== canonical.hash && bodyHash !== collectorEnvelopeHash)) {
-          await observeCollectionAttempt(connectorInstance.connectorInstanceId, "batch_rejected");
+          await observeRefusedBatch(connectorInstance.connectorInstanceId);
           ctx.pdppError(
             res,
             400,
@@ -2597,8 +2604,22 @@ export function mountRefDeviceExporterIngestBatches(app: AppLike, ctx: MountRefD
           sourceInstanceId,
         });
       } catch (err) {
-        if (observedConnectorInstanceId) {
-          await observeCollectionAttempt(observedConnectorInstanceId, "batch_rejected");
+        // A batch refused after authorization is an observed attempt, and its
+        // revision is its only durable effect. When that revision cannot be
+        // recorded (or an earlier one in this request failed), the device gets
+        // the retryable 503, never a definitive refusal the server cannot order.
+        if (
+          observedConnectorInstanceId &&
+          (isCollectionRevisionUnavailable(err) || !(await recordedRefusal(observedConnectorInstanceId)))
+        ) {
+          res.setHeader("Retry-After", "1");
+          ctx.pdppError(
+            res,
+            503,
+            "device_ingest_retryable",
+            "Device ingest is temporarily unavailable; retry the same batch"
+          );
+          return;
         }
         if (err instanceof ctx.DeviceBatchConflictError) {
           ctx.pdppError(
@@ -2647,26 +2668,30 @@ export function mountRefDeviceExporterIngestBatches(app: AppLike, ctx: MountRefD
 }
 
 /**
- * Record an observed collection attempt for an authorized connection, so it
- * retires any earlier local coverage proof (see collection-revision-store.ts).
- * The caller awaits this before it answers the device, so the device cannot
- * send a later terminal commit that the server orders before this event.
+ * Record a refused batch for an authorized connection, so it retires any
+ * earlier local coverage proof (see collection-revision-store.ts). The caller
+ * awaits this before it answers the device, so the device cannot send a later
+ * terminal commit that the server orders before this event. Throws
+ * `CollectionRevisionUnavailableError` when the revision is not recorded; the
+ * route's catch then answers 503 instead of the refusal.
  */
-async function observeCollectionAttempt(
-  connectorInstanceId: string,
-  event: CollectionRevisionEvent,
-  runId: string | null = null
-): Promise<void> {
+async function observeRefusedBatch(connectorInstanceId: string): Promise<void> {
+  await recordCollectionRevisionEvent(connectorInstanceId, {
+    at: new Date().toISOString(),
+    event: "batch_rejected",
+  });
+}
+
+/** `observeRefusedBatch` for the route's catch: false (and a server log line) when the revision is not recorded. */
+async function recordedRefusal(connectorInstanceId: string): Promise<boolean> {
   try {
-    await recordCollectionRevisionEvent(connectorInstanceId, {
-      at: new Date().toISOString(),
-      event,
-      runId,
-    });
+    await observeRefusedBatch(connectorInstanceId);
+    return true;
   } catch (error) {
     console.warn(
-      `[device-exporters] collection revision not recorded connector_instance_id=${connectorInstanceId} event=${event} code=${String((error as { code?: unknown } | null)?.code ?? "unknown")}`
+      `[device-exporters] refused batch not recorded; answering 503 connector_instance_id=${connectorInstanceId} code=${String((error as { code?: unknown } | null)?.code ?? "unknown")}`
     );
+    return false;
   }
 }
 
@@ -2714,7 +2739,7 @@ async function processDeviceIngestBatch(
     const existing = await ctx.deviceExporterStore.getBatchOutcome(deviceId, batchId);
     if (existing) {
       if (!deviceBatchIdentityMatches(existing, identity)) {
-        await observeCollectionAttempt(connectorInstanceId, "batch_rejected");
+        await observeRefusedBatch(connectorInstanceId);
         ctx.pdppError(
           res,
           409,
@@ -2732,7 +2757,7 @@ async function processDeviceIngestBatch(
     // New malformed candidates retain the historical 400, but an existing
     // device/batch reservation owns conflict precedence.
     if (!sourceConnectorMatches) {
-      await observeCollectionAttempt(connectorInstanceId, "batch_rejected");
+      await observeRefusedBatch(connectorInstanceId);
       ctx.pdppError(res, 400, "invalid_request", "connector_id does not match source_instance_id", "connector_id");
       return;
     }
@@ -2907,13 +2932,11 @@ async function processDeviceIngestBatch(
         source_instance_id: sourceInstanceId,
         status: "accepted",
       };
-      // A newly admitted batch is an observed attempt. Record it before the
-      // acknowledgement: the device sends its terminal commit only after this
-      // response, so the commit always gets the later revision.
-      await recordCollectionRevisionEvent(connectorInstanceId, {
-        at: new Date().toISOString(),
-        event: "batch_accepted",
-      });
+      // The accepted transition takes the batch's `batch_accepted` collection
+      // revision in its own transaction, as each record write above took its
+      // `batch_record` revision. It commits before the acknowledgement, and
+      // the device sends its terminal commit only after this response, so the
+      // commit always gets the later revision.
       maybeDeviceIngestStoreFault("before-complete-processing-batch");
       await ctx.deviceExporterStore.completeProcessingBatch({
         acceptedAt: new Date().toISOString(),
@@ -3246,27 +3269,26 @@ async function reportLocalCollectorGap(
     ...(details ? { details } : {}),
   };
   const store = ctx.getDefaultConnectorDetailGapStore();
-  const gap = await store.upsertPendingGap({
-    connectorId,
-    connectorInstanceId,
-    detailLocator,
-    lastError,
-    reason,
-    // The route requires a boolean (validateGapReportFields); an explicit false is
-    // kept in storage, never converted to a recoverable legacy NULL.
-    ...(typeof body.retryable === "boolean" ? { retryable: body.retryable } : {}),
-    source,
-    stream: syntheticStream,
-    ...(firstSeenRunId ? { discoveredRunId: firstSeenRunId } : {}),
-    ...(lastRunId ? { lastRunId } : {}),
-  });
   // A delivered failure report is an observed attempt: it retires any earlier
-  // coverage proof for this connection.
-  await recordCollectionRevisionEvent(connectorInstanceId, {
-    at: new Date().toISOString(),
-    event: "failure_report",
-    runId: lastRunId,
-  });
+  // coverage proof for this connection. The gap and its revision commit in one
+  // transaction; if the revision cannot be recorded, no gap is stored.
+  const gap = await store.upsertPendingGap(
+    {
+      connectorId,
+      connectorInstanceId,
+      detailLocator,
+      lastError,
+      reason,
+      // The route requires a boolean (validateGapReportFields); an explicit false is
+      // kept in storage, never converted to a recoverable legacy NULL.
+      ...(typeof body.retryable === "boolean" ? { retryable: body.retryable } : {}),
+      source,
+      stream: syntheticStream,
+      ...(firstSeenRunId ? { discoveredRunId: firstSeenRunId } : {}),
+      ...(lastRunId ? { lastRunId } : {}),
+    },
+    { collectionRevision: { at: new Date().toISOString(), event: "failure_report", runId: lastRunId } }
+  );
   res.status(201).json({
     attempt_count: gap.attempt_count,
     connector_id: connectorId,
diff --git a/reference-implementation/server/stores/collection-revision-store.ts b/reference-implementation/server/stores/collection-revision-store.ts
index a68259c11..a974b07f2 100644
--- a/reference-implementation/server/stores/collection-revision-store.ts
+++ b/reference-implementation/server/stores/collection-revision-store.ts
@@ -9,14 +9,21 @@
 //
 // The high-water mark lives on `connector_instances`. A connection with no row
 // gets no revision (`null`), and the reader treats that as unknown.
+//
+// A caller allocates the revision inside the transaction of the durable event
+// it orders (a record write, a batch acceptance, a stored failure report, a
+// terminal run), so the event and its revision commit or roll back together.
+// A refusal has no other durable effect: its revision is its only write.
 
 import { getDb } from "../db.ts";
 import { isPostgresStorageBackend, postgresQuery, withPostgresTransaction } from "../postgres-storage.ts";
 
 export type CollectionRevisionEvent =
   | "batch_accepted"
+  | "batch_record"
   | "batch_rejected"
   | "failure_report"
+  | "legacy_terminal"
   | "state_commit"
   | "terminal_run";
 
@@ -42,6 +49,25 @@ interface PostgresHandle {
   query: (sql: string, params: readonly unknown[]) => Promise<{ readonly rows: readonly unknown[] }>;
 }
 
+/**
+ * The revision for an observed event could not be recorded, so the event
+ * itself must not commit or be acknowledged. Device routes answer it with
+ * their retryable 503, so the device retries instead of trusting an answer
+ * the server cannot order.
+ */
+export class CollectionRevisionUnavailableError extends Error {
+  readonly code = "collection_revision_unavailable";
+
+  constructor(connectorInstanceId: string, event: CollectionRevisionEvent) {
+    super(`collection revision not recorded connector_instance_id=${connectorInstanceId} event=${event}`);
+    this.name = "CollectionRevisionUnavailableError";
+  }
+}
+
+export function isCollectionRevisionUnavailable(error: unknown): boolean {
+  return (error as { code?: unknown } | null)?.code === "collection_revision_unavailable";
+}
+
 const ADVANCE_SET = `collection_revision = collection_revision + 1,
          collection_revision_event = ?,
          collection_revision_run_id = ?,
@@ -106,70 +132,48 @@ export async function advancePostgresCollectionRevisionInTransaction(
   return row && revision !== null ? { manifestGeneration: Number(row.manifest_generation ?? 0), revision } : null;
 }
 
-/** Record one observed event in its own transaction. */
-export async function recordCollectionRevisionEvent(
+/** Advance on an open SQLite transaction, or throw so the caller's event rolls back with it. */
+export function requireSqliteCollectionRevisionInTransaction(
+  db: SqliteHandle,
   connectorInstanceId: string,
   input: CollectionRevisionEventInput
-): Promise<number | null> {
-  if (isPostgresStorageBackend()) {
-    return await withPostgresTransaction(
-      async (client) =>
-        (await advancePostgresCollectionRevisionInTransaction(client as PostgresHandle, connectorInstanceId, input))
-          ?.revision ?? null
-    );
+): number {
+  const advanced = advanceSqliteCollectionRevisionInTransaction(db, connectorInstanceId, input);
+  if (!advanced) {
+    throw new CollectionRevisionUnavailableError(connectorInstanceId, input.event);
   }
-  return advanceSqliteCollectionRevisionInTransaction(getDb(), connectorInstanceId, input)?.revision ?? null;
+  return advanced.revision;
 }
 
-/** Batched high-water read, keyed by connector instance. Missing connections are absent from the map. */
-export async function readCollectionRevisionHighWaters(
-  connectorInstanceIds: readonly string[]
-): Promise<Map<string, CollectionRevisionHighWater>> {
-  interface Row {
-    collection_revision: unknown;
-    collection_revision_at: string | null;
-    collection_revision_event: string | null;
-    collection_revision_run_id: string | null;
-    connector_instance_id: string;
+/** Advance on an open Postgres transaction, or throw so the caller's event rolls back with it. */
+export async function requirePostgresCollectionRevisionInTransaction(
+  client: PostgresHandle,
+  connectorInstanceId: string,
+  input: CollectionRevisionEventInput
+): Promise<number> {
+  const advanced = await advancePostgresCollectionRevisionInTransaction(client, connectorInstanceId, input);
+  if (!advanced) {
+    throw new CollectionRevisionUnavailableError(connectorInstanceId, input.event);
   }
-  const rows: Row[] = [];
-  const ids = [...new Set(connectorInstanceIds)];
+  return advanced.revision;
+}
+
+/**
+ * Record an observed event that has no other durable effect (a refused
+ * batch). Throws when the revision is not recorded; the caller must then not
+ * answer the event as if the server had observed it.
+ */
+export async function recordCollectionRevisionEvent(
+  connectorInstanceId: string,
+  input: CollectionRevisionEventInput
+): Promise<number> {
   if (isPostgresStorageBackend()) {
-    const result = await postgresQuery<Row>(
-      `SELECT connector_instance_id, collection_revision::text AS collection_revision, collection_revision_event,
-              collection_revision_run_id, collection_revision_at
-         FROM connector_instances WHERE connector_instance_id = ANY($1::text[])`,
-      [ids]
+    return await withPostgresTransaction(
+      async (client) =>
+        await requirePostgresCollectionRevisionInTransaction(client as PostgresHandle, connectorInstanceId, input)
     );
-    rows.push(...result.rows);
-  } else {
-    for (let start = 0; start < ids.length; start += 900) {
-      const chunk = ids.slice(start, start + 900);
-      rows.push(
-        ...(getDb()
-          .prepare(
-            `SELECT connector_instance_id, collection_revision, collection_revision_event,
-                    collection_revision_run_id, collection_revision_at
-               FROM connector_instances WHERE connector_instance_id IN (${chunk.map(() => "?").join(", ")})`
-          )
-          .all(...chunk) as Row[])
-      );
-    }
-  }
-  const byId = new Map<string, CollectionRevisionHighWater>();
-  for (const row of rows) {
-    const revision = readCollectionRevision(row.collection_revision);
-    if (revision === null) {
-      continue;
-    }
-    byId.set(row.connector_instance_id, {
-      at: row.collection_revision_at ?? null,
-      event: row.collection_revision_event ?? null,
-      revision,
-      runId: row.collection_revision_run_id ?? null,
-    });
   }
-  return byId;
+  return requireSqliteCollectionRevisionInTransaction(getDb(), connectorInstanceId, input);
 }
 
 /** The terminal run record the high-water mark names, read by run id rather than by completion time. */
diff --git a/reference-implementation/server/stores/connector-detail-gap-store.ts b/reference-implementation/server/stores/connector-detail-gap-store.ts
index 00a3c9dde..f521796bd 100644
--- a/reference-implementation/server/stores/connector-detail-gap-store.ts
+++ b/reference-implementation/server/stores/connector-detail-gap-store.ts
@@ -103,6 +103,11 @@ interface UpsertGapInput {
   stream?: string | null;
 }
 
+interface UpsertGapOptions {
+  /** Record this upsert as an observed collection event, in the same transaction. */
+  readonly collectionRevision?: CollectionRevisionEventInput;
+}
+
 // Normalized/derived shape produced by `normalizeGapInput`, consumed by both
 // backend `upsertPendingGap` implementations.
 interface NormalizedGapInput {
@@ -182,10 +187,21 @@ interface CountByStream {
   stream: string;
 }
 
-import { execDynamicSqlAcknowledged, iterateDynamicSqlAcknowledged } from "../../lib/db.ts";
+import { execDynamicSqlAcknowledged, iterateDynamicSqlAcknowledged, writeTransaction } from "../../lib/db.ts";
 import { DEFAULT_QUARANTINE_POLICY } from "../../runtime/recovery-quarantine.ts";
+import { getDb } from "../db.ts";
 import { OWNER_AUTH_DEFAULT_SUBJECT_ID } from "../owner-auth.ts";
-import { getStorageBackendKind, isPostgresStorageBackend, postgresQuery } from "../postgres-storage.ts";
+import {
+  getStorageBackendKind,
+  isPostgresStorageBackend,
+  postgresQuery,
+  withPostgresTransaction,
+} from "../postgres-storage.ts";
+import {
+  type CollectionRevisionEventInput,
+  requirePostgresCollectionRevisionInTransaction,
+  requireSqliteCollectionRevisionInTransaction,
+} from "./collection-revision-store.ts";
 import { makeDefaultAccountConnectorInstanceId } from "./connector-instance-store.ts";
 
 const VALID_STATUSES = new Set(["pending", "in_progress", "recovered", "terminal"]);
@@ -1235,6 +1251,155 @@ function postgresPendingReadFilter(
   return { params, sql: parts.join("\n          ") };
 }
 
+/** The SQLite upsert. Runs on the caller's transaction when there is one. */
+function upsertSqlitePendingGap(input: UpsertGapInput): DetailGap | null {
+  const gap = normalizeGapInput(input);
+  const detailLocatorJson = encodeJson(gap.detailLocator);
+  // REVIEWED-DYNAMIC: connector_detail_gaps is owned by this store and
+  // not yet represented in the static query registry.
+  execDynamicSqlAcknowledged(
+    `
+    INSERT INTO connector_detail_gaps(
+      gap_id, connector_id, connector_instance_id, grant_id, source_json, stream, parent_stream, record_key,
+      detail_locator_json, list_cursor_json, scope_json, reason, status, attempt_count,
+      next_attempt_after, last_error_json, discovered_run_id, last_run_id, created_at, updated_at, retryable
+    ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 'pending', 0, ?, ?, ?, ?, ?, ?, ?)
+    ON CONFLICT(gap_id) DO UPDATE SET
+      source_json = excluded.source_json,
+      detail_locator_json = excluded.detail_locator_json,
+      list_cursor_json = excluded.list_cursor_json,
+      scope_json = excluded.scope_json,
+      -- retryable: a NULL (absent) observation is NOT a fresh classification.
+      -- On a row that already carries a known value it preserves BOTH the stored
+      -- boolean and its paired reason; a fresh explicit boolean replaces the
+      -- pair atomically (latest valid observation wins, like every other column).
+      reason = CASE WHEN excluded.retryable IS NULL AND connector_detail_gaps.retryable IS NOT NULL
+                    THEN connector_detail_gaps.reason ELSE excluded.reason END,
+      retryable = COALESCE(excluded.retryable, connector_detail_gaps.retryable),
+      -- §10-A: 'terminal' is always sticky — a terminalized gap must not be
+      -- silently resurrected into the fillable-pending set by a re-upsert.
+      -- 'recovered' is sticky ONLY against a re-upsert from the SAME run
+      -- that recovered it (an ordinary-forward-pass re-defer with no new
+      -- attempt evidence, per the original §10-A regression) — i.e. a
+      -- NON-NULL 'recovered_run_id' that matches 'excluded.last_run_id'
+      -- exactly. A NULL 'recovered_run_id' (a run-id-less recovery, e.g.
+      -- the local-collector policy-budget path in
+      -- 'ref-device-exporters.ts:recoverLocalCollectorGap', which marks a
+      -- gap recovered with '{}' — no spine run backs it) carries no
+      -- same-attempt context to compare against, so SQL's 'NULL = x'
+      -- already evaluates false/unmatched for every 'x' here — the row is
+      -- NEVER treated as a same-attempt re-defer and always reopens on the
+      -- next re-upsert. Do not special-case NULL as a stickiness
+      -- wildcard: an earlier revision did 'recovered_run_id IS NULL OR
+      -- ...', which made every run-id-less recovery sticky FOREVER
+      -- (P1 review finding, reproduced locally: a gap recovered via
+      -- 'markGapStatus(id, 'recovered', {})' never reopened on a later
+      -- 'upsertPendingGap' with a real 'lastRunId') — the exact opposite
+      -- of the reopen-on-later-evidence rule this fix exists to enforce.
+      -- A re-upsert from a LATER run (or ANY re-upsert of a null-run-id
+      -- recovery) reopens the row to 'pending': the connector is
+      -- reporting, with fresh attempt evidence, that a previously-closed
+      -- record is missing again — treating that as permanently satisfied
+      -- silently strands it outside both the pending-retry queue and the
+      -- quarantine escalation path forever (live Amazon order_items
+      -- evidence: 12 order ids stuck 'recovered' while DETAIL_COVERAGE
+      -- reported them uncovered on every run for weeks).
+      status = CASE
+        WHEN connector_detail_gaps.status = 'terminal' THEN 'terminal'
+        WHEN connector_detail_gaps.status = 'recovered'
+          AND connector_detail_gaps.recovered_run_id = excluded.last_run_id
+          THEN 'recovered'
+        ELSE 'pending'
+      END,
+      next_attempt_after = excluded.next_attempt_after,
+      -- Explanatory metadata is never written over a stored permanent
+      -- classification by an unclassified observation.
+      last_error_json = CASE WHEN excluded.retryable IS NULL AND connector_detail_gaps.retryable = 0
+                             THEN connector_detail_gaps.last_error_json ELSE excluded.last_error_json END,
+      last_run_id = excluded.last_run_id,
+      updated_at = excluded.updated_at
+    -- Identity conflict target = the natural key, with the volatile locator
+    -- dropped when a record_key exists (see detailGapIdentityKey). This is
+    -- what closes the locator-drift orphan class: a re-discovery under a new
+    -- locator shape re-upserts the SAME row instead of inserting a duplicate.
+    ON CONFLICT(connector_instance_id, ifnull(grant_id, ''), stream, ifnull(parent_stream, ''), CASE WHEN nullif(record_key, '') IS NOT NULL THEN 'key:' || record_key ELSE 'loc:' || ifnull(detail_locator_json, '') END) DO UPDATE SET
+      source_json = excluded.source_json,
+      detail_locator_json = excluded.detail_locator_json,
+      list_cursor_json = excluded.list_cursor_json,
+      scope_json = excluded.scope_json,
+      -- retryable: a NULL (absent) observation is NOT a fresh classification.
+      -- On a row that already carries a known value it preserves BOTH the stored
+      -- boolean and its paired reason; a fresh explicit boolean replaces the
+      -- pair atomically (latest valid observation wins, like every other column).
+      reason = CASE WHEN excluded.retryable IS NULL AND connector_detail_gaps.retryable IS NOT NULL
+                    THEN connector_detail_gaps.reason ELSE excluded.reason END,
+      retryable = COALESCE(excluded.retryable, connector_detail_gaps.retryable),
+      -- §10-A: see the mirrored ON CONFLICT(gap_id) branch above for the
+      -- reopen-on-later-run rationale and the NULL-recovered_run_id
+      -- non-wildcard rule (a run-id-less recovery is never same-attempt).
+      status = CASE
+        WHEN connector_detail_gaps.status = 'terminal' THEN 'terminal'
+        WHEN connector_detail_gaps.status = 'recovered'
+          AND connector_detail_gaps.recovered_run_id = excluded.last_run_id
+          THEN 'recovered'
+        ELSE 'pending'
+      END,
+      next_attempt_after = excluded.next_attempt_after,
+      -- Explanatory metadata is never written over a stored permanent
+      -- classification by an unclassified observation.
+      last_error_json = CASE WHEN excluded.retryable IS NULL AND connector_detail_gaps.retryable = 0
+                             THEN connector_detail_gaps.last_error_json ELSE excluded.last_error_json END,
+      last_run_id = excluded.last_run_id,
+      updated_at = excluded.updated_at
+  `,
+    [
+      gap.gapId,
+      gap.connectorId,
+      gap.connectorInstanceId,
+      gap.grantId,
+      encodeJson(gap.source),
+      gap.stream,
+      gap.parentStream,
+      gap.recordKey,
+      detailLocatorJson,
+      encodeJson(gap.listCursor),
+      encodeJson(gap.scope),
+      gap.reason,
+      gap.nextAttemptAfter,
+      encodeJson(gap.lastError),
+      gap.discoveredRunId,
+      gap.lastRunId,
+      gap.now,
+      gap.now,
+      gap.retryable,
+    ]
+  );
+  // REVIEWED-DYNAMIC: single-row lookup for the store-owned detail-gap table.
+  // Look up by the identity expression (NOT the locator): on a locator-drift
+  // re-upsert the stored row updates to the newer locator shape, so a
+  // locator-based lookup against the old shape would miss.
+  return rowToGap(
+    firstSqliteRow(
+      `
+    SELECT * FROM connector_detail_gaps
+    WHERE connector_instance_id = ?
+      AND ifnull(grant_id, '') = ?
+      AND stream = ?
+      AND ifnull(parent_stream, '') = ?
+      AND CASE WHEN nullif(record_key, '') IS NOT NULL THEN 'key:' || record_key ELSE 'loc:' || ifnull(detail_locator_json, '') END = ?
+    LIMIT 1
+  `,
+      [
+        gap.connectorInstanceId,
+        gap.grantId || "",
+        gap.stream,
+        gap.parentStream || "",
+        detailGapIdentityKey(gap.recordKey, detailLocatorJson),
+      ]
+    )
+  );
+}
+
 export function createSqliteConnectorDetailGapStore() {
   return {
     // Leasing is not an attempt. Every claimed gap moves pending → in_progress
@@ -1884,157 +2049,114 @@ export function createSqliteConnectorDetailGapStore() {
       }
       return rowToGap(firstSqliteRow("SELECT * FROM connector_detail_gaps WHERE gap_id = ? LIMIT 1", [owner.gapId]));
     },
+    // A delivered failure report is an observed collection event: with
+    // `collectionRevision`, the gap and the connection's next collection
+    // revision commit in one transaction, or neither does.
     // biome-ignore lint/suspicious/useAwait: The async signature is part of this caller-facing contract.
-    async upsertPendingGap(input: UpsertGapInput): Promise<DetailGap | null> {
-      const gap = normalizeGapInput(input);
-      const detailLocatorJson = encodeJson(gap.detailLocator);
-      // REVIEWED-DYNAMIC: connector_detail_gaps is owned by this store and
-      // not yet represented in the static query registry.
-      execDynamicSqlAcknowledged(
-        `
-        INSERT INTO connector_detail_gaps(
-          gap_id, connector_id, connector_instance_id, grant_id, source_json, stream, parent_stream, record_key,
-          detail_locator_json, list_cursor_json, scope_json, reason, status, attempt_count,
-          next_attempt_after, last_error_json, discovered_run_id, last_run_id, created_at, updated_at, retryable
-        ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 'pending', 0, ?, ?, ?, ?, ?, ?, ?)
-        ON CONFLICT(gap_id) DO UPDATE SET
-          source_json = excluded.source_json,
-          detail_locator_json = excluded.detail_locator_json,
-          list_cursor_json = excluded.list_cursor_json,
-          scope_json = excluded.scope_json,
-          -- retryable: a NULL (absent) observation is NOT a fresh classification.
-          -- On a row that already carries a known value it preserves BOTH the stored
-          -- boolean and its paired reason; a fresh explicit boolean replaces the
-          -- pair atomically (latest valid observation wins, like every other column).
-          reason = CASE WHEN excluded.retryable IS NULL AND connector_detail_gaps.retryable IS NOT NULL
-                        THEN connector_detail_gaps.reason ELSE excluded.reason END,
-          retryable = COALESCE(excluded.retryable, connector_detail_gaps.retryable),
-          -- §10-A: 'terminal' is always sticky — a terminalized gap must not be
-          -- silently resurrected into the fillable-pending set by a re-upsert.
-          -- 'recovered' is sticky ONLY against a re-upsert from the SAME run
-          -- that recovered it (an ordinary-forward-pass re-defer with no new
-          -- attempt evidence, per the original §10-A regression) — i.e. a
-          -- NON-NULL 'recovered_run_id' that matches 'excluded.last_run_id'
-          -- exactly. A NULL 'recovered_run_id' (a run-id-less recovery, e.g.
-          -- the local-collector policy-budget path in
-          -- 'ref-device-exporters.ts:recoverLocalCollectorGap', which marks a
-          -- gap recovered with '{}' — no spine run backs it) carries no
-          -- same-attempt context to compare against, so SQL's 'NULL = x'
-          -- already evaluates false/unmatched for every 'x' here — the row is
-          -- NEVER treated as a same-attempt re-defer and always reopens on the
-          -- next re-upsert. Do not special-case NULL as a stickiness
-          -- wildcard: an earlier revision did 'recovered_run_id IS NULL OR
-          -- ...', which made every run-id-less recovery sticky FOREVER
-          -- (P1 review finding, reproduced locally: a gap recovered via
-          -- 'markGapStatus(id, 'recovered', {})' never reopened on a later
-          -- 'upsertPendingGap' with a real 'lastRunId') — the exact opposite
-          -- of the reopen-on-later-evidence rule this fix exists to enforce.
-          -- A re-upsert from a LATER run (or ANY re-upsert of a null-run-id
-          -- recovery) reopens the row to 'pending': the connector is
-          -- reporting, with fresh attempt evidence, that a previously-closed
-          -- record is missing again — treating that as permanently satisfied
-          -- silently strands it outside both the pending-retry queue and the
-          -- quarantine escalation path forever (live Amazon order_items
-          -- evidence: 12 order ids stuck 'recovered' while DETAIL_COVERAGE
-          -- reported them uncovered on every run for weeks).
-          status = CASE
-            WHEN connector_detail_gaps.status = 'terminal' THEN 'terminal'
-            WHEN connector_detail_gaps.status = 'recovered'
-              AND connector_detail_gaps.recovered_run_id = excluded.last_run_id
-              THEN 'recovered'
-            ELSE 'pending'
-          END,
-          next_attempt_after = excluded.next_attempt_after,
-          -- Explanatory metadata is never written over a stored permanent
-          -- classification by an unclassified observation.
-          last_error_json = CASE WHEN excluded.retryable IS NULL AND connector_detail_gaps.retryable = 0
-                                 THEN connector_detail_gaps.last_error_json ELSE excluded.last_error_json END,
-          last_run_id = excluded.last_run_id,
-          updated_at = excluded.updated_at
-        -- Identity conflict target = the natural key, with the volatile locator
-        -- dropped when a record_key exists (see detailGapIdentityKey). This is
-        -- what closes the locator-drift orphan class: a re-discovery under a new
-        -- locator shape re-upserts the SAME row instead of inserting a duplicate.
-        ON CONFLICT(connector_instance_id, ifnull(grant_id, ''), stream, ifnull(parent_stream, ''), CASE WHEN nullif(record_key, '') IS NOT NULL THEN 'key:' || record_key ELSE 'loc:' || ifnull(detail_locator_json, '') END) DO UPDATE SET
-          source_json = excluded.source_json,
-          detail_locator_json = excluded.detail_locator_json,
-          list_cursor_json = excluded.list_cursor_json,
-          scope_json = excluded.scope_json,
-          -- retryable: a NULL (absent) observation is NOT a fresh classification.
-          -- On a row that already carries a known value it preserves BOTH the stored
-          -- boolean and its paired reason; a fresh explicit boolean replaces the
-          -- pair atomically (latest valid observation wins, like every other column).
-          reason = CASE WHEN excluded.retryable IS NULL AND connector_detail_gaps.retryable IS NOT NULL
-                        THEN connector_detail_gaps.reason ELSE excluded.reason END,
-          retryable = COALESCE(excluded.retryable, connector_detail_gaps.retryable),
-          -- §10-A: see the mirrored ON CONFLICT(gap_id) branch above for the
-          -- reopen-on-later-run rationale and the NULL-recovered_run_id
-          -- non-wildcard rule (a run-id-less recovery is never same-attempt).
-          status = CASE
-            WHEN connector_detail_gaps.status = 'terminal' THEN 'terminal'
-            WHEN connector_detail_gaps.status = 'recovered'
-              AND connector_detail_gaps.recovered_run_id = excluded.last_run_id
-              THEN 'recovered'
-            ELSE 'pending'
-          END,
-          next_attempt_after = excluded.next_attempt_after,
-          -- Explanatory metadata is never written over a stored permanent
-          -- classification by an unclassified observation.
-          last_error_json = CASE WHEN excluded.retryable IS NULL AND connector_detail_gaps.retryable = 0
-                                 THEN connector_detail_gaps.last_error_json ELSE excluded.last_error_json END,
-          last_run_id = excluded.last_run_id,
-          updated_at = excluded.updated_at
-      `,
-        [
-          gap.gapId,
-          gap.connectorId,
-          gap.connectorInstanceId,
-          gap.grantId,
-          encodeJson(gap.source),
-          gap.stream,
-          gap.parentStream,
-          gap.recordKey,
-          detailLocatorJson,
-          encodeJson(gap.listCursor),
-          encodeJson(gap.scope),
-          gap.reason,
-          gap.nextAttemptAfter,
-          encodeJson(gap.lastError),
-          gap.discoveredRunId,
-          gap.lastRunId,
-          gap.now,
-          gap.now,
-          gap.retryable,
-        ]
-      );
-      // REVIEWED-DYNAMIC: single-row lookup for the store-owned detail-gap table.
-      // Look up by the identity expression (NOT the locator): on a locator-drift
-      // re-upsert the stored row updates to the newer locator shape, so a
-      // locator-based lookup against the old shape would miss.
-      return rowToGap(
-        firstSqliteRow(
-          `
-        SELECT * FROM connector_detail_gaps
-        WHERE connector_instance_id = ?
-          AND ifnull(grant_id, '') = ?
-          AND stream = ?
-          AND ifnull(parent_stream, '') = ?
-          AND CASE WHEN nullif(record_key, '') IS NOT NULL THEN 'key:' || record_key ELSE 'loc:' || ifnull(detail_locator_json, '') END = ?
-        LIMIT 1
-      `,
-          [
-            gap.connectorInstanceId,
-            gap.grantId || "",
-            gap.stream,
-            gap.parentStream || "",
-            detailGapIdentityKey(gap.recordKey, detailLocatorJson),
-          ]
-        )
-      );
+    async upsertPendingGap(input: UpsertGapInput, options: UpsertGapOptions = {}): Promise<DetailGap | null> {
+      const revision = options.collectionRevision;
+      if (!revision) {
+        return upsertSqlitePendingGap(input);
+      }
+      return writeTransaction(() => {
+        requireSqliteCollectionRevisionInTransaction(getDb(), normalizeGapInput(input).connectorInstanceId, revision);
+        return upsertSqlitePendingGap(input);
+      });
     },
   };
 }
 
+/** The Postgres upsert, on the pool or on the caller's transaction client. */
+async function upsertPostgresPendingGap(
+  query: (sql: string, params: unknown[]) => Promise<{ rows: DetailGapRow[] }>,
+  input: UpsertGapInput
+): Promise<DetailGap | null> {
+  const gap = normalizeGapInput(input);
+  const result = await query(
+    `
+    INSERT INTO connector_detail_gaps(
+      gap_id, connector_id, connector_instance_id, grant_id, source_json, stream, parent_stream, record_key,
+      detail_locator_json, list_cursor_json, scope_json, reason, status, attempt_count,
+      next_attempt_after, last_error_json, discovered_run_id, last_run_id, created_at, updated_at, retryable
+    ) VALUES($1, $2, $3, $4, $5::jsonb, $6, $7, $8, $9::jsonb, $10::jsonb, $11::jsonb, $12, 'pending', 0, $13, $14::jsonb, $15, $16, $17, $17, $18::integer)
+    -- Identity conflict target = the natural key, with the volatile locator
+    -- dropped when a record_key exists (see detailGapIdentityKey). Closes the
+    -- locator-drift orphan class: a re-discovery under a new locator shape
+    -- re-upserts the SAME row instead of inserting a duplicate.
+    ON CONFLICT (connector_instance_id, COALESCE(grant_id, ''), stream, COALESCE(parent_stream, ''), (CASE WHEN NULLIF(record_key, '') IS NOT NULL THEN 'key:' || record_key ELSE 'loc:' || COALESCE(detail_locator_json::text, '') END)) DO UPDATE SET
+      source_json = EXCLUDED.source_json,
+      detail_locator_json = EXCLUDED.detail_locator_json,
+      list_cursor_json = EXCLUDED.list_cursor_json,
+      scope_json = EXCLUDED.scope_json,
+      -- retryable: see the SQLite upsert. A NULL observation preserves BOTH the stored
+      -- boolean and its paired reason; a fresh explicit boolean replaces the pair.
+      reason = CASE WHEN EXCLUDED.retryable IS NULL AND connector_detail_gaps.retryable IS NOT NULL
+                    THEN connector_detail_gaps.reason ELSE EXCLUDED.reason END,
+      retryable = COALESCE(EXCLUDED.retryable, connector_detail_gaps.retryable),
+      -- §10-A: 'terminal' is always sticky — a terminalized gap must not be
+      -- silently resurrected into the fillable-pending set by a re-upsert.
+      -- 'recovered' is sticky ONLY against a re-upsert from the SAME run
+      -- that recovered it (an ordinary-forward-pass re-defer with no new
+      -- attempt evidence, per the original §10-A regression) — i.e. a
+      -- NON-NULL 'recovered_run_id' that matches 'EXCLUDED.last_run_id'
+      -- exactly. A NULL 'recovered_run_id' (a run-id-less recovery, e.g.
+      -- the local-collector policy-budget path in
+      -- 'ref-device-exporters.ts:recoverLocalCollectorGap', which marks a
+      -- gap recovered with '{}' — no spine run backs it) carries no
+      -- same-attempt context to compare against, so SQL's 'NULL = x'
+      -- already evaluates false/unmatched for every 'x' here — the row is
+      -- NEVER treated as a same-attempt re-defer and always reopens on the
+      -- next re-upsert. Do not special-case NULL as a stickiness
+      -- wildcard: an earlier revision did 'recovered_run_id IS NULL OR
+      -- ...', which made every run-id-less recovery sticky FOREVER
+      -- (P1 review finding) — the exact opposite of the reopen-on-later-
+      -- evidence rule this fix exists to enforce. A re-upsert from a
+      -- LATER run (or ANY re-upsert of a null-run-id recovery) reopens
+      -- the row to 'pending': the connector is reporting, with fresh
+      -- attempt evidence, that a previously-closed record is missing
+      -- again — treating that as permanently satisfied silently strands
+      -- it outside both the pending-retry queue and the quarantine
+      -- escalation path forever (live Amazon order_items evidence: 12
+      -- order ids stuck 'recovered' while DETAIL_COVERAGE reported them
+      -- uncovered on every run for weeks).
+      status = CASE
+        WHEN connector_detail_gaps.status = 'terminal' THEN 'terminal'
+        WHEN connector_detail_gaps.status = 'recovered'
+          AND connector_detail_gaps.recovered_run_id = EXCLUDED.last_run_id
+          THEN 'recovered'
+        ELSE 'pending'
+      END,
+      next_attempt_after = EXCLUDED.next_attempt_after,
+      last_error_json = CASE WHEN EXCLUDED.retryable IS NULL AND connector_detail_gaps.retryable = 0
+                             THEN connector_detail_gaps.last_error_json ELSE EXCLUDED.last_error_json END,
+      last_run_id = EXCLUDED.last_run_id,
+      updated_at = EXCLUDED.updated_at
+    RETURNING *
+  `,
+    [
+      gap.gapId,
+      gap.connectorId,
+      gap.connectorInstanceId,
+      gap.grantId,
+      JSON.stringify(gap.source),
+      gap.stream,
+      gap.parentStream,
+      gap.recordKey,
+      encodeJson(gap.detailLocator),
+      encodeJson(gap.listCursor),
+      encodeJson(gap.scope),
+      gap.reason,
+      gap.nextAttemptAfter,
+      encodeJson(gap.lastError),
+      gap.discoveredRunId,
+      gap.lastRunId,
+      gap.now,
+      gap.retryable,
+    ]
+  );
+  return rowToGap(result.rows[0] ?? null);
+}
+
 export function createPostgresConnectorDetailGapStore() {
   return {
     // Leasing is not an attempt. Every claimed gap moves pending → in_progress
@@ -2637,91 +2759,22 @@ export function createPostgresConnectorDetailGapStore() {
       );
       return result.rows[0] ? rowToGap(result.rows[0]) : null;
     },
-    async upsertPendingGap(input: UpsertGapInput): Promise<DetailGap | null> {
-      const gap = normalizeGapInput(input);
-      const result = await postgresQuery<DetailGapRow>(
-        `
-        INSERT INTO connector_detail_gaps(
-          gap_id, connector_id, connector_instance_id, grant_id, source_json, stream, parent_stream, record_key,
-          detail_locator_json, list_cursor_json, scope_json, reason, status, attempt_count,
-          next_attempt_after, last_error_json, discovered_run_id, last_run_id, created_at, updated_at, retryable
-        ) VALUES($1, $2, $3, $4, $5::jsonb, $6, $7, $8, $9::jsonb, $10::jsonb, $11::jsonb, $12, 'pending', 0, $13, $14::jsonb, $15, $16, $17, $17, $18::integer)
-        -- Identity conflict target = the natural key, with the volatile locator
-        -- dropped when a record_key exists (see detailGapIdentityKey). Closes the
-        -- locator-drift orphan class: a re-discovery under a new locator shape
-        -- re-upserts the SAME row instead of inserting a duplicate.
-        ON CONFLICT (connector_instance_id, COALESCE(grant_id, ''), stream, COALESCE(parent_stream, ''), (CASE WHEN NULLIF(record_key, '') IS NOT NULL THEN 'key:' || record_key ELSE 'loc:' || COALESCE(detail_locator_json::text, '') END)) DO UPDATE SET
-          source_json = EXCLUDED.source_json,
-          detail_locator_json = EXCLUDED.detail_locator_json,
-          list_cursor_json = EXCLUDED.list_cursor_json,
-          scope_json = EXCLUDED.scope_json,
-          -- retryable: see the SQLite upsert. A NULL observation preserves BOTH the stored
-          -- boolean and its paired reason; a fresh explicit boolean replaces the pair.
-          reason = CASE WHEN EXCLUDED.retryable IS NULL AND connector_detail_gaps.retryable IS NOT NULL
-                        THEN connector_detail_gaps.reason ELSE EXCLUDED.reason END,
-          retryable = COALESCE(EXCLUDED.retryable, connector_detail_gaps.retryable),
-          -- §10-A: 'terminal' is always sticky — a terminalized gap must not be
-          -- silently resurrected into the fillable-pending set by a re-upsert.
-          -- 'recovered' is sticky ONLY against a re-upsert from the SAME run
-          -- that recovered it (an ordinary-forward-pass re-defer with no new
-          -- attempt evidence, per the original §10-A regression) — i.e. a
-          -- NON-NULL 'recovered_run_id' that matches 'EXCLUDED.last_run_id'
-          -- exactly. A NULL 'recovered_run_id' (a run-id-less recovery, e.g.
-          -- the local-collector policy-budget path in
-          -- 'ref-device-exporters.ts:recoverLocalCollectorGap', which marks a
-          -- gap recovered with '{}' — no spine run backs it) carries no
-          -- same-attempt context to compare against, so SQL's 'NULL = x'
-          -- already evaluates false/unmatched for every 'x' here — the row is
-          -- NEVER treated as a same-attempt re-defer and always reopens on the
-          -- next re-upsert. Do not special-case NULL as a stickiness
-          -- wildcard: an earlier revision did 'recovered_run_id IS NULL OR
-          -- ...', which made every run-id-less recovery sticky FOREVER
-          -- (P1 review finding) — the exact opposite of the reopen-on-later-
-          -- evidence rule this fix exists to enforce. A re-upsert from a
-          -- LATER run (or ANY re-upsert of a null-run-id recovery) reopens
-          -- the row to 'pending': the connector is reporting, with fresh
-          -- attempt evidence, that a previously-closed record is missing
-          -- again — treating that as permanently satisfied silently strands
-          -- it outside both the pending-retry queue and the quarantine
-          -- escalation path forever (live Amazon order_items evidence: 12
-          -- order ids stuck 'recovered' while DETAIL_COVERAGE reported them
-          -- uncovered on every run for weeks).
-          status = CASE
-            WHEN connector_detail_gaps.status = 'terminal' THEN 'terminal'
-            WHEN connector_detail_gaps.status = 'recovered'
-              AND connector_detail_gaps.recovered_run_id = EXCLUDED.last_run_id
-              THEN 'recovered'
-            ELSE 'pending'
-          END,
-          next_attempt_after = EXCLUDED.next_attempt_after,
-          last_error_json = CASE WHEN EXCLUDED.retryable IS NULL AND connector_detail_gaps.retryable = 0
-                                 THEN connector_detail_gaps.last_error_json ELSE EXCLUDED.last_error_json END,
-          last_run_id = EXCLUDED.last_run_id,
-          updated_at = EXCLUDED.updated_at
-        RETURNING *
-      `,
-        [
-          gap.gapId,
-          gap.connectorId,
-          gap.connectorInstanceId,
-          gap.grantId,
-          JSON.stringify(gap.source),
-          gap.stream,
-          gap.parentStream,
-          gap.recordKey,
-          encodeJson(gap.detailLocator),
-          encodeJson(gap.listCursor),
-          encodeJson(gap.scope),
-          gap.reason,
-          gap.nextAttemptAfter,
-          encodeJson(gap.lastError),
-          gap.discoveredRunId,
-          gap.lastRunId,
-          gap.now,
-          gap.retryable,
-        ]
-      );
-      return rowToGap(result.rows[0] ?? null);
+    // See the SQLite store: with `collectionRevision`, the gap and its
+    // revision commit in one transaction. The revision is taken first, so the
+    // connection row is locked before the gap row.
+    async upsertPendingGap(input: UpsertGapInput, options: UpsertGapOptions = {}): Promise<DetailGap | null> {
+      const revision = options.collectionRevision;
+      if (!revision) {
+        return await upsertPostgresPendingGap(postgresQuery, input);
+      }
+      return await withPostgresTransaction(async (client) => {
+        await requirePostgresCollectionRevisionInTransaction(
+          client,
+          normalizeGapInput(input).connectorInstanceId,
+          revision
+        );
+        return await upsertPostgresPendingGap((sql, params) => client.query<DetailGapRow>(sql, params), input);
+      });
     },
   };
 }
diff --git a/reference-implementation/server/stores/device-exporter-store.ts b/reference-implementation/server/stores/device-exporter-store.ts
index bcae9364d..d464c6f8e 100644
--- a/reference-implementation/server/stores/device-exporter-store.ts
+++ b/reference-implementation/server/stores/device-exporter-store.ts
@@ -20,6 +20,11 @@ import {
   postgresQuery,
   withPostgresTransaction,
 } from "../postgres-storage.ts";
+import {
+  type CollectionRevisionEventInput,
+  requirePostgresCollectionRevisionInTransaction,
+  requireSqliteCollectionRevisionInTransaction,
+} from "./collection-revision-store.ts";
 
 /** A raw database row (column-keyed) crossing the untyped storage boundary. */
 // biome-ignore lint/suspicious/noExplicitAny: raw db.js/postgres rows are untyped at this boundary.
@@ -524,6 +529,20 @@ function retryableReservationError(message = "device ingest reservation cannot b
   return err;
 }
 
+// A durable batch record is an observed collection event: it takes the next
+// collection revision in the record's own transaction, so no committed record
+// can sit behind a coverage proof it postdates.
+function batchRecordRevision(): CollectionRevisionEventInput {
+  return { at: new Date().toISOString(), event: "batch_record" };
+}
+
+// The accepted transition is the batch's replay decision. It takes its
+// revision in the same transaction.
+function batchAcceptedRevision(record: Row): CollectionRevisionEventInput {
+  return { at: record.acceptedAt ?? new Date().toISOString(), event: "batch_accepted" };
+}
+
+/** Advance the durable prefix and take the record's collection revision. Call on the record's open transaction. */
 export function advanceSqliteDeviceIngestPrefix(record: Row, inputIndex: number): void {
   const result = exec(referenceQueries.deviceExportersAdvanceProcessingPrefix, [
     ...reservationIdentityBinds(record),
@@ -534,6 +553,7 @@ export function advanceSqliteDeviceIngestPrefix(record: Row, inputIndex: number)
     (err as Error & { code?: string }).code = "device_ingest_retryable";
     throw err;
   }
+  requireSqliteCollectionRevisionInTransaction(getDb(), record.connectorInstanceId, batchRecordRevision());
 }
 
 interface PostgresTransactionClient {
@@ -559,6 +579,9 @@ export async function advancePostgresDeviceIngestPrefix(
     (err as Error & { code?: string }).code = "device_ingest_retryable";
     throw err;
   }
+  // The record transaction already holds the connection row lock (its
+  // admission check reads it FOR UPDATE), so this takes no new lock.
+  await requirePostgresCollectionRevisionInTransaction(client, record.connectorInstanceId, batchRecordRevision());
 }
 
 export function createSqliteDeviceExporterStore() {
@@ -584,6 +607,11 @@ export function createSqliteDeviceExporterStore() {
         if (result.changes !== 1) {
           throw retryableReservationError();
         }
+        requireSqliteCollectionRevisionInTransaction(
+          getDb(),
+          record.connectorInstanceId,
+          batchAcceptedRevision(record)
+        );
         return mapOutcome(sqliteOutcomeRow(record.deviceId, record.batchId));
       });
     },
@@ -949,6 +977,14 @@ export function createPostgresDeviceExporterStore() {
   return {
     completeProcessingBatch(record: Row) {
       return withPostgresTransaction(async (client: PostgresTransactionClient) => {
+        // The acceptance takes its collection revision first. That locks the
+        // connection row before the reservation row, the order every device
+        // record transaction already uses.
+        await requirePostgresCollectionRevisionInTransaction(
+          client,
+          record.connectorInstanceId,
+          batchAcceptedRevision(record)
+        );
         const reservation = await client.query(
           `SELECT manifest_fingerprint, semantic_capability_identity
              FROM device_ingest_batch_outcomes
diff --git a/reference-implementation/server/stores/terminal-run-commit-store.ts b/reference-implementation/server/stores/terminal-run-commit-store.ts
index fc0b48bef..621e5b1a6 100644
--- a/reference-implementation/server/stores/terminal-run-commit-store.ts
+++ b/reference-implementation/server/stores/terminal-run-commit-store.ts
@@ -10,6 +10,8 @@ import { isPostgresStorageBackend, withPostgresTransaction } from "../postgres-s
 import {
   advancePostgresCollectionRevisionInTransaction,
   advanceSqliteCollectionRevisionInTransaction,
+  requirePostgresCollectionRevisionInTransaction,
+  requireSqliteCollectionRevisionInTransaction,
 } from "./collection-revision-store.ts";
 import {
   putPostgresConnectorStateDeltaInTransaction,
@@ -311,3 +313,46 @@ async function commitPostgres(input: ResolvedTerminalRunCommit): Promise<Termina
 export async function commitTerminalRun(input: ResolvedTerminalRunCommit): Promise<TerminalRunCommitResult> {
   return isPostgresStorageBackend() ? await commitPostgres(input) : commitSqlite(input);
 }
+
+/**
+ * Commit a legacy split `terminal-collection` report. It is an observed
+ * collection event of its own (`legacy_terminal`): its run record takes the
+ * next revision in the same transaction, so a report that arrives after a
+ * newer proof retires that proof instead of copying its revision. The event
+ * is built from the allocated revision. It is never a v2 proof.
+ */
+export async function commitLegacyTerminalCollection(input: {
+  readonly buildEvent: (collectionRevision: number) => SpineEventInput & PostgresSpineEventInput;
+  readonly connectorInstanceId: string;
+  readonly runId: string;
+}): Promise<void> {
+  const revisionEvent = {
+    at: new Date().toISOString(),
+    event: "legacy_terminal",
+    runId: input.runId,
+  } as const;
+  if (isPostgresStorageBackend()) {
+    await withPostgresTransaction(
+      async (client) => {
+        const revision = await requirePostgresCollectionRevisionInTransaction(
+          client,
+          input.connectorInstanceId,
+          revisionEvent
+        );
+        await appendPostgresSpineEventInTransaction(client, input.buildEvent(revision));
+      },
+      { lockConnectorInstanceId: input.connectorInstanceId }
+    );
+    return;
+  }
+  const db = getDb();
+  db.exec("BEGIN IMMEDIATE");
+  try {
+    const revision = requireSqliteCollectionRevisionInTransaction(db, input.connectorInstanceId, revisionEvent);
+    appendSqliteSpineEventInTransaction(input.buildEvent(revision), db as unknown as SpineDatabase);
+    db.exec("COMMIT");
+  } catch (error) {
+    rollbackSqlite(db);
+    throw error;
+  }
+}
diff --git a/reference-implementation/test/device-exporter-postgres-proof.test.ts b/reference-implementation/test/device-exporter-postgres-proof.test.ts
index d996ca855..37219a2dc 100644
--- a/reference-implementation/test/device-exporter-postgres-proof.test.ts
+++ b/reference-implementation/test/device-exporter-postgres-proof.test.ts
@@ -662,6 +662,15 @@ if (DEDICATED_POSTGRES_URL) {
         connectorId,
         JSON.stringify(manifest),
       ]);
+      // The connection the batch belongs to: each durable record and the
+      // acceptance take its next collection revision.
+      await postgresQuery(
+        `INSERT INTO connector_instances(
+           connector_instance_id, owner_subject_id, connector_id, display_name, status,
+           source_kind, source_binding_key, source_binding_json, created_at, updated_at
+         ) VALUES($1, $2, $3, 'migration-proof', 'active', 'local_device', $1, '{}'::jsonb, $4, $4)`,
+        [identity.connectorInstanceId, `owner_${suffix}`, connectorId, "2026-07-16T00:00:00.000Z"]
+      );
       await postgresQuery(
         `INSERT INTO device_ingest_batch_outcomes(
            device_id, batch_id, body_hash, source_instance_id, connector_instance_id,
diff --git a/reference-implementation/test/device-ingest-attempt-context-store.test.ts b/reference-implementation/test/device-ingest-attempt-context-store.test.ts
index 4a02cb4fb..8367b02dd 100644
--- a/reference-implementation/test/device-ingest-attempt-context-store.test.ts
+++ b/reference-implementation/test/device-ingest-attempt-context-store.test.ts
@@ -160,6 +160,16 @@ test("SQLite processing reservation acceptance is fenced by current manifest and
       VALUES('dev_attempt_context', 'owner_attempt_context', 'Attempt context', ?, ?)
     `)
       .run(NOW, NOW);
+    // Each durable record and the acceptance take the connection's next collection revision.
+    getDb()
+      .prepare(`
+      INSERT INTO connector_instances(
+        connector_instance_id, owner_subject_id, connector_id, display_name, status,
+        source_kind, source_binding_key, source_binding_json, created_at, updated_at
+      ) VALUES('cin_attempt_context', 'owner_attempt_context', 'attempt-context-test', 'Attempt context', 'active',
+        'local_device', 'cin_attempt_context', '{}', ?, ?)
+    `)
+      .run(NOW, NOW);
     await proveAttemptFences({
       advancePrefix: async (record) => advanceSqliteDeviceIngestPrefix(record, 0),
       replaceManifest: (manifest) => {
@@ -170,6 +180,15 @@ test("SQLite processing reservation acceptance is fenced by current manifest and
       },
       store: createSqliteDeviceExporterStore(),
     });
+    assert.equal(
+      (
+        getDb()
+          .prepare("SELECT collection_revision_event FROM connector_instances WHERE connector_instance_id = ?")
+          .get("cin_attempt_context") as { collection_revision_event: string | null }
+      ).collection_revision_event,
+      "batch_accepted",
+      "the acceptance took the newest collection revision"
+    );
   } finally {
     closeDb();
   }
@@ -182,6 +201,7 @@ test("dedicated Postgres processing reservation acceptance locks and fences curr
   try {
     await postgresQuery("DELETE FROM device_ingest_batch_outcomes WHERE device_id = 'dev_attempt_context'");
     await postgresQuery("DELETE FROM device_exporters WHERE device_id = 'dev_attempt_context'");
+    await postgresQuery("DELETE FROM connector_instances WHERE connector_instance_id = 'cin_attempt_context'");
     await postgresQuery("DELETE FROM connectors WHERE connector_id = 'attempt-context-test'");
     await postgresQuery("INSERT INTO connectors(connector_id, manifest, created_at) VALUES($1, $2::jsonb, $3)", [
       "attempt-context-test",
@@ -193,6 +213,15 @@ test("dedicated Postgres processing reservation acceptance locks and fences curr
          VALUES($1, $2, $3, $4, $5)`,
       ["dev_attempt_context", "owner_attempt_context", "Attempt context", NOW, NOW]
     );
+    // Each durable record and the acceptance take the connection's next collection revision.
+    await postgresQuery(
+      `INSERT INTO connector_instances(
+         connector_instance_id, owner_subject_id, connector_id, display_name, status,
+         source_kind, source_binding_key, source_binding_json, created_at, updated_at
+       ) VALUES('cin_attempt_context', 'owner_attempt_context', 'attempt-context-test', 'Attempt context', 'active',
+         'local_device', 'cin_attempt_context', '{}'::jsonb, $1, $1)`,
+      [NOW]
+    );
     await proveAttemptFences({
       advancePrefix: async (record) =>
         withPostgresTransaction((client: Parameters<typeof advancePostgresDeviceIngestPrefix>[0]) =>
@@ -206,9 +235,18 @@ test("dedicated Postgres processing reservation acceptance locks and fences curr
       },
       store: createPostgresDeviceExporterStore(),
     });
+    const highWater = await postgresQuery<{ collection_revision_event: string | null }>(
+      "SELECT collection_revision_event FROM connector_instances WHERE connector_instance_id = 'cin_attempt_context'"
+    );
+    assert.equal(
+      highWater.rows[0]?.collection_revision_event,
+      "batch_accepted",
+      "the acceptance took the newest collection revision"
+    );
   } finally {
     await postgresQuery("DELETE FROM device_ingest_batch_outcomes WHERE device_id = 'dev_attempt_context'");
     await postgresQuery("DELETE FROM device_exporters WHERE device_id = 'dev_attempt_context'");
+    await postgresQuery("DELETE FROM connector_instances WHERE connector_instance_id = 'cin_attempt_context'");
     await postgresQuery("DELETE FROM connectors WHERE connector_id = 'attempt-context-test'");
     await closePostgresStorage();
   }
diff --git a/reference-implementation/test/local-device-coverage-revision-atomicity.test.ts b/reference-implementation/test/local-device-coverage-revision-atomicity.test.ts
new file mode 100644
index 000000000..4798bebe8
--- /dev/null
+++ b/reference-implementation/test/local-device-coverage-revision-atomicity.test.ts
@@ -0,0 +1,849 @@
+// Copyright The PDP-Connect Contributors
+// SPDX-License-Identifier: Apache-2.0
+
+// Atomicity of the per-connection collection revision. The server allocates
+// the next revision inside the same transaction as the durable event it
+// orders: each device batch record write, the batch acceptance (the replay
+// decision), a delivered failure report, a terminal run commit and the legacy
+// split terminal report. A refusal has no other durable effect, so its
+// revision is its only write. If the revision cannot be recorded, the request
+// fails and nothing is admitted; no catch turns that into a definitive answer.
+//
+// Interleavings are deterministic: the device ingest phase hook pauses a batch
+// between its committed boundaries, and a database trigger makes every
+// revision write fail. Every test runs on SQLite, and on a real PostgreSQL
+// database when PDPP_TEST_POSTGRES_URL names one.
+
+import assert from "node:assert/strict";
+import { createHash } from "node:crypto";
+import { mkdtemp, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { DatabaseSync } from "node:sqlite";
+import test from "node:test";
+
+import { COLLECTOR_PROTOCOL_VERSION } from "../server/collector-protocol.ts";
+import { reconcileDirtyConnectorSummaryEvidence } from "../server/connector-summary-read-model.ts";
+import { closeDb, getDb, initDb } from "../server/db.ts";
+import { fingerprintDeviceAttemptManifest } from "../server/device-ingest-attempt-context.ts";
+import { startServer } from "../server/index.ts";
+import { __setLocalCollectorReleaseForTest } from "../server/local-collector-profiles.ts";
+import { bootstrapPostgresSchema, closePostgresStorage, postgresQuery } from "../server/postgres-storage.ts";
+import { readCommittedLocalCoverageDiagnostics } from "../server/records.ts";
+import { getConnectorDetail, getOwnerConnectionDiagnostics, listConnectorSummaries } from "../server/ref-control.ts";
+import { __setDeviceIngestPhaseFaultHookForTest } from "../server/routes/ref-device-exporters.ts";
+import { getDefaultDeviceExporterStore } from "../server/stores/device-exporter-store.ts";
+import { commitTerminalRun } from "../server/stores/terminal-run-commit-store.ts";
+import { closeTestServer } from "./helpers/close-test-server.ts";
+import { dedicatedPostgresTestUrl } from "./helpers/dedicated-postgres-test-url.ts";
+import { withTemporaryPostgresDatabase } from "./helpers/postgres-temp-database.ts";
+
+type Backend = "postgres" | "sqlite";
+
+const POSTGRES_URL = dedicatedPostgresTestUrl(process.env.PDPP_TEST_POSTGRES_URL);
+const BACKENDS: readonly Backend[] = ["sqlite", "postgres"];
+const CONNECTOR_ID = "claude-code";
+const OWNER_PASSWORD = "local-coverage-revision-atomicity-password";
+const PROTOCOL_HEADERS = { "X-PDPP-Collector-Protocol": COLLECTOR_PROTOCOL_VERSION };
+const CSRF_FIELD_PATTERN = /<input type="hidden" name="_csrf" value="([^"]+)"\s*\/>/;
+const PROFILE = {
+  connector_id: CONNECTOR_ID,
+  run_coverage: { version: 1 },
+  streams: [
+    { coverage_stores: ["projects"], name: "sessions", primary_key: ["id"] },
+    { coverage_stores: ["derived_messages"], name: "messages", primary_key: ["id"] },
+  ],
+  version: "0.0.0-revision-atomicity",
+};
+const ARTIFACT_DIGEST = `sha256:${createHash("sha256").update(JSON.stringify(PROFILE)).digest("hex")}`;
+const SERVER_RELEASE = { artifactDigest: ARTIFACT_DIGEST, manifest: PROFILE };
+const EMITTED_AT = "2026-10-22T12:00:00.000Z";
+
+interface Enrolled {
+  readonly connector_instance_id: string;
+  readonly device_id: string;
+  readonly device_token: string;
+  readonly source_instance_id: string;
+}
+
+interface Lane {
+  readonly asUrl: string;
+  readonly backend: Backend;
+  readonly enrolled: Enrolled;
+}
+
+interface JsonResponse {
+  readonly body: Record<string, unknown> | null;
+  readonly status: number;
+}
+
+interface Projection {
+  readonly asOf: Record<string, unknown> | null;
+  readonly axis: string;
+}
+
+interface HighWater {
+  readonly event: string | null;
+  readonly revision: number;
+  readonly runId: string | null;
+}
+
+type TerminalCommit = Parameters<typeof commitTerminalRun>[0];
+
+function testName(backend: Backend, name: string): string {
+  return backend === "postgres" ? `${name} [real PostgreSQL]` : name;
+}
+
+const POSTGRES_SKIP = POSTGRES_URL ? false : "PDPP_TEST_POSTGRES_URL unset";
+
+const READS = /^\s*SELECT\b/i;
+
+/** Run a statement on the lane's backend. Postgres takes `$n` placeholders; SQLite takes `?`. */
+async function sql(lane: Pick<Lane, "backend">, sqlite: string, postgres: string, params: unknown[] = []) {
+  if (lane.backend === "postgres") {
+    return (await postgresQuery(postgres, params)).rows as Record<string, unknown>[];
+  }
+  const statement = getDb().prepare(sqlite);
+  if (READS.test(sqlite)) {
+    return statement.all(...params) as Record<string, unknown>[];
+  }
+  statement.run(...params);
+  return [];
+}
+
+async function requestJson(url: string, init: RequestInit = {}): Promise<JsonResponse> {
+  const resp = await fetch(url, { ...init, headers: { Accept: "application/json", ...init.headers } });
+  const text = await resp.text();
+  let body: Record<string, unknown> | null = null;
+  try {
+    body = JSON.parse(text) as Record<string, unknown>;
+  } catch {
+    // A non-JSON response keeps a null body; the status assertion reports it.
+  }
+  return { body, status: resp.status };
+}
+
+function postJson(url: string, body: unknown, headers: Record<string, string> = {}): Promise<JsonResponse> {
+  return requestJson(url, {
+    body: JSON.stringify(body),
+    headers: { "Content-Type": "application/json", ...headers },
+    method: "POST",
+  });
+}
+
+function setCookiePair(resp: Response, name: string): string | null {
+  for (const header of resp.headers.getSetCookie()) {
+    const [pair] = header.split(";");
+    if (pair?.startsWith(`${name}=`)) {
+      return pair;
+    }
+  }
+  return null;
+}
+
+async function ownerSessionCookie(asUrl: string): Promise<string> {
+  const page = await fetch(`${asUrl}/owner/login`, { headers: { Accept: "text/html" }, redirect: "manual" });
+  const csrfCookie = setCookiePair(page, "pdpp_owner_csrf") ?? "";
+  const csrfField = CSRF_FIELD_PATTERN.exec(await page.text())?.[1] ?? "";
+  const login = await fetch(`${asUrl}/owner/login`, {
+    body: new URLSearchParams({ _csrf: csrfField, password: OWNER_PASSWORD, return_to: "/" }).toString(),
+    headers: { Accept: "text/html", "Content-Type": "application/x-www-form-urlencoded", Cookie: csrfCookie },
+    method: "POST",
+    redirect: "manual",
+  });
+  const session = setCookiePair(login, "pdpp_owner_session");
+  assert.ok(session, `owner login should set pdpp_owner_session (status ${login.status})`);
+  return session;
+}
+
+async function enroll(asUrl: string, cookie: string): Promise<Enrolled> {
+  const code = await postJson(
+    `${asUrl}/_ref/device-exporters/enrollment-codes`,
+    { connector_id: CONNECTOR_ID, local_binding_name: "revision-atomicity-laptop" },
+    { Cookie: cookie }
+  );
+  assert.equal(code.status, 201, JSON.stringify(code.body));
+  const enrolled = await postJson(
+    `${asUrl}/_ref/device-exporters/enroll`,
+    { enrollment_code: String(code.body?.enrollment_code) },
+    PROTOCOL_HEADERS
+  );
+  assert.equal(enrolled.status, 201, JSON.stringify(enrolled.body));
+  const body = enrolled.body ?? {};
+  return {
+    connector_instance_id: String(body.connector_instance_id),
+    device_id: String(body.device_id),
+    device_token: String(body.device_token),
+    source_instance_id: String(body.source_instance_id),
+  };
+}
+
+/** Narrow the enrolled catalog manifest to the release's two streams, as a catalog update does. */
+async function registerFixtureManifest(lane: Lane): Promise<void> {
+  const [row] = await sql(
+    lane,
+    "SELECT manifest FROM connectors WHERE connector_id = ?",
+    "SELECT manifest::text AS manifest FROM connectors WHERE connector_id = $1",
+    [CONNECTOR_ID]
+  );
+  assert.ok(row, "enrolment registers the claude-code catalog manifest");
+  const catalog = JSON.parse(String(row.manifest)) as Record<string, unknown> & { streams: Record<string, unknown>[] };
+  const streams = PROFILE.streams.map((release) => {
+    const declared = catalog.streams.find((stream) => stream.name === release.name);
+    assert.ok(declared, `the catalog declares ${release.name}`);
+    return { ...declared, coverage_stores: release.coverage_stores };
+  });
+  await sql(
+    lane,
+    "UPDATE connectors SET manifest = ? WHERE connector_id = ?",
+    "UPDATE connectors SET manifest = $1::jsonb WHERE connector_id = $2",
+    [JSON.stringify({ ...catalog, streams }), CONNECTOR_ID]
+  );
+  await sql(
+    lane,
+    "UPDATE connector_instances SET manifest_generation = manifest_generation + 1 WHERE connector_instance_id = ?",
+    "UPDATE connector_instances SET manifest_generation = manifest_generation + 1 WHERE connector_instance_id = $1",
+    [lane.enrolled.connector_instance_id]
+  );
+}
+
+async function withServerLane(
+  backend: Backend,
+  options: { readonly dbPath: string; readonly postgresUrl?: string },
+  run: (lane: Lane) => Promise<void>
+): Promise<void> {
+  const previousDatabaseUrl = process.env.PDPP_DATABASE_URL;
+  if (options.postgresUrl) {
+    initDb(":memory:");
+    process.env.PDPP_DATABASE_URL = options.postgresUrl;
+  }
+  let server: Awaited<ReturnType<typeof startServer>>;
+  try {
+    server = await startServer({
+      asPort: 0,
+      dbPath: options.dbPath,
+      ownerAuthPassword: OWNER_PASSWORD,
+      quiet: true,
+      rsPort: 0,
+    });
+  } finally {
+    if (previousDatabaseUrl === undefined) {
+      delete process.env.PDPP_DATABASE_URL;
+    } else {
+      process.env.PDPP_DATABASE_URL = previousDatabaseUrl;
+    }
+  }
+  await server.startupBackfillDone?.catch(() => undefined);
+  const asUrl = `http://localhost:${server.asPort}`;
+  __setLocalCollectorReleaseForTest(CONNECTOR_ID, SERVER_RELEASE);
+  try {
+    const cookie = await ownerSessionCookie(asUrl);
+    const enrolled = await enroll(asUrl, cookie);
+    const lane = { asUrl, backend, enrolled };
+    await registerFixtureManifest(lane);
+    await run(lane);
+  } finally {
+    __setDeviceIngestPhaseFaultHookForTest(null);
+    __setLocalCollectorReleaseForTest(CONNECTOR_ID, null);
+    await closeTestServer(server);
+    if (options.postgresUrl) {
+      await closePostgresStorage().catch(() => undefined);
+    }
+    closeDb();
+  }
+}
+
+let databaseCounter = 0;
+
+async function withLane(backend: Backend, run: (lane: Lane) => Promise<void>): Promise<void> {
+  const dir = await mkdtemp(join(tmpdir(), "pdpp-revision-atomicity-"));
+  try {
+    if (backend === "sqlite") {
+      await withServerLane(backend, { dbPath: join(dir, "pdpp.sqlite") }, run);
+      return;
+    }
+    assert.ok(POSTGRES_URL, "the Postgres lane requires PDPP_TEST_POSTGRES_URL");
+    databaseCounter += 1;
+    await withTemporaryPostgresDatabase(
+      {
+        closeConnections: closePostgresStorage,
+        connectionString: POSTGRES_URL,
+        databaseName: `pdpp_revision_atomicity_${process.pid}_${databaseCounter}`,
+      },
+      (url) => withServerLane(backend, { dbPath: ":memory:", postgresUrl: url }, run)
+    );
+  } finally {
+    await rm(dir, { force: true, recursive: true });
+  }
+}
+
+function deviceUrl(lane: Lane, suffix: string): string {
+  return `${lane.asUrl}/_ref/device-exporters/${encodeURIComponent(lane.enrolled.device_id)}${suffix}`;
+}
+
+function sourceUrl(lane: Lane, suffix: string): string {
+  return deviceUrl(lane, `/source-instances/${encodeURIComponent(lane.enrolled.source_instance_id)}${suffix}`);
+}
+
+function authHeaders(lane: Lane): Record<string, string> {
+  return { Authorization: `Bearer ${lane.enrolled.device_token}`, ...PROTOCOL_HEADERS };
+}
+
+function canonical(value: unknown): unknown {
+  if (value === null || typeof value !== "object") {
+    return value;
+  }
+  if (Array.isArray(value)) {
+    return value.map(canonical);
+  }
+  const object = value as Record<string, unknown>;
+  return Object.fromEntries(
+    Object.keys(object)
+      .sort()
+      .filter((key) => object[key] !== undefined)
+      .map((key) => [key, canonical(object[key])])
+  );
+}
+
+function sessionRecords(...ids: string[]): Record<string, unknown>[] {
+  return ids.map((id) => ({ data: { id }, emitted_at: EMITTED_AT, record_key: id, stream: "sessions" }));
+}
+
+function batchBody(lane: Lane, batchId: string, records: Record<string, unknown>[]): Record<string, unknown> {
+  return {
+    batch_id: batchId,
+    batch_seq: 0,
+    body_hash: createHash("sha256")
+      .update(JSON.stringify(canonical(records)))
+      .digest("hex"),
+    connector_id: CONNECTOR_ID,
+    device_id: lane.enrolled.device_id,
+    records,
+    source_instance_id: lane.enrolled.source_instance_id,
+  };
+}
+
+function postBatch(lane: Lane, body: Record<string, unknown>): Promise<JsonResponse> {
+  return postJson(deviceUrl(lane, "/ingest-batches"), body, authHeaders(lane));
+}
+
+function postFailureReport(lane: Lane, runId: string): Promise<JsonResponse> {
+  return postJson(
+    sourceUrl(lane, "/local-collector-gaps"),
+    {
+      connector_id: CONNECTOR_ID,
+      first_seen_at: EMITTED_AT,
+      last_run_id: runId,
+      next_attempt_backoff_ms: 0,
+      reason: "connector_child_failure",
+      retryable: true,
+      source_instance_id: lane.enrolled.source_instance_id,
+    },
+    authHeaders(lane)
+  );
+}
+
+/** A v2 terminal proof for both streams, bound to the server's release. Returns the commit so a test can replay it. */
+async function commitProof(lane: Lane, runId: string): Promise<TerminalCommit> {
+  const { connector_instance_id: connectorInstanceId, device_id: deviceId } = lane.enrolled;
+  const sourceInstanceId = lane.enrolled.source_instance_id;
+  await getDefaultDeviceExporterStore().markSourceInstanceHeartbeat(deviceId, sourceInstanceId, {
+    lastError: null,
+    outboxDiagnostics: { dead_letter: 0, pending: 0, stale_leases: 0, succeeded: 1, total: 1 },
+    receivedAt: new Date().toISOString(),
+    recordsPending: 0,
+    status: "healthy",
+  });
+  const [instance] = await sql(
+    lane,
+    "SELECT manifest_generation FROM connector_instances WHERE connector_instance_id = ?",
+    "SELECT manifest_generation::integer AS manifest_generation FROM connector_instances WHERE connector_instance_id = $1",
+    [connectorInstanceId]
+  );
+  const bindings = {
+    artifact_digest: ARTIFACT_DIGEST,
+    binding_generation: Number(instance?.manifest_generation),
+    manifest_fingerprint: fingerprintDeviceAttemptManifest(PROFILE),
+    runtime_accounting: {
+      checkpoint_eligible: true,
+      detail_complete: true,
+      durable_admission: true,
+      outstanding_debt: 0,
+      stream_evidence_consistent: true,
+    },
+    server_artifact_digest: ARTIFACT_DIGEST,
+  };
+  const stream = (name: string, store: string) => ({
+    ...bindings,
+    checkpoint: "committed",
+    collected: 0,
+    considered: null,
+    coverage_statuses: ["collected"],
+    covered: null,
+    pending_detail_gaps: 0,
+    scoped: true,
+    skipped: null,
+    stores: [{ status: "collected", store }],
+    stream: name,
+  });
+  // The proof measures the collection boundary the connection declares (enrolment sets a window).
+  const diagnostics = await readCommittedLocalCoverageDiagnostics({
+    connector_id: CONNECTOR_ID,
+    connector_instance_id: connectorInstanceId,
+  });
+  assert.ok("declaredCollectionScope" in diagnostics, "the connection declares its collection boundary");
+  const commit: TerminalCommit = {
+    collectionBoundary: diagnostics.declaredCollectionScope,
+    commitId: `commit_${runId}`,
+    connectorId: CONNECTOR_ID,
+    connectorInstanceId,
+    deviceId,
+    envelopeHash: `envelope_${runId}`,
+    normalizedFacts: [stream("sessions", "projects"), stream("messages", "derived_messages")],
+    runId,
+    sourceInstanceId,
+    stateDelta: {},
+    version: 2,
+  };
+  const result = await commitTerminalRun(commit);
+  assert.equal(result.replayed, false, `run ${runId} commits a new terminal proof`);
+  return commit;
+}
+
+async function projection(lane: Lane): Promise<Projection> {
+  await reconcileDirtyConnectorSummaryEvidence(null);
+  const summary = (await listConnectorSummaries()).find(
+    (row) => row.connector_instance_id === lane.enrolled.connector_instance_id
+  );
+  assert.ok(summary, "the lane's connection is projected");
+  return {
+    asOf: (summary.coverage_as_of as Record<string, unknown> | null) ?? null,
+    axis: summary.connection_health.axes.coverage,
+  };
+}
+
+async function assertCovered(lane: Lane, runId: string, message: string): Promise<void> {
+  const projected = await projection(lane);
+  assert.equal(projected.axis, "complete", message);
+  assert.equal(projected.asOf?.run_id, runId, `${message}: the coverage names its run`);
+}
+
+async function assertRetired(lane: Lane, message: string): Promise<void> {
+  const projected = await projection(lane);
+  assert.equal(projected.axis, "unknown", message);
+  assert.equal(projected.asOf, null, `${message}: retired coverage carries no as-of`);
+}
+
+async function highWater(lane: Lane): Promise<HighWater> {
+  const [row] = await sql(
+    lane,
+    `SELECT collection_revision AS revision, collection_revision_event AS event, collection_revision_run_id AS run_id
+       FROM connector_instances WHERE connector_instance_id = ?`,
+    `SELECT collection_revision::text AS revision, collection_revision_event AS event,
+            collection_revision_run_id AS run_id
+       FROM connector_instances WHERE connector_instance_id = $1`,
+    [lane.enrolled.connector_instance_id]
+  );
+  assert.ok(row, "the connection has a revision row");
+  return {
+    event: (row.event as string | null) ?? null,
+    revision: Number(row.revision),
+    runId: (row.run_id as string | null) ?? null,
+  };
+}
+
+async function sessionRecordCount(lane: Lane): Promise<number> {
+  const [row] = await sql(
+    lane,
+    "SELECT COUNT(*) AS n FROM records WHERE connector_instance_id = ? AND stream = 'sessions'",
+    "SELECT COUNT(*)::integer AS n FROM records WHERE connector_instance_id = $1 AND stream = 'sessions'",
+    [lane.enrolled.connector_instance_id]
+  );
+  return Number(row?.n ?? 0);
+}
+
+async function openGapCount(lane: Lane): Promise<number> {
+  const [row] = await sql(
+    lane,
+    "SELECT COUNT(*) AS n FROM connector_detail_gaps WHERE connector_instance_id = ?",
+    "SELECT COUNT(*)::integer AS n FROM connector_detail_gaps WHERE connector_instance_id = $1",
+    [lane.enrolled.connector_instance_id]
+  );
+  return Number(row?.n ?? 0);
+}
+
+/** Make every write that advances a collection revision fail, as a storage fault would. */
+async function failRevisionWrites(lane: Lane): Promise<() => Promise<void>> {
+  if (lane.backend === "postgres") {
+    await postgresQuery(`CREATE FUNCTION pdpp_test_fail_collection_revision() RETURNS trigger
+      LANGUAGE plpgsql AS $$ BEGIN RAISE EXCEPTION 'injected collection revision failure'; END $$`);
+    await postgresQuery(`CREATE TRIGGER pdpp_test_fail_collection_revision
+      BEFORE UPDATE OF collection_revision ON connector_instances FOR EACH ROW
+      WHEN (NEW.collection_revision IS DISTINCT FROM OLD.collection_revision)
+      EXECUTE FUNCTION pdpp_test_fail_collection_revision()`);
+    return async () => {
+      await postgresQuery("DROP TRIGGER pdpp_test_fail_collection_revision ON connector_instances");
+      await postgresQuery("DROP FUNCTION pdpp_test_fail_collection_revision()");
+    };
+  }
+  getDb().exec(`CREATE TRIGGER pdpp_test_fail_collection_revision
+    BEFORE UPDATE OF collection_revision ON connector_instances
+    WHEN NEW.collection_revision IS NOT OLD.collection_revision
+    BEGIN SELECT RAISE(ABORT, 'injected collection revision failure'); END`);
+  return () => {
+    getDb().exec("DROP TRIGGER pdpp_test_fail_collection_revision");
+    return Promise.resolve();
+  };
+}
+
+/** A promise the test resolves to release a paused batch. */
+function gate(): { readonly open: () => void; readonly wait: Promise<void> } {
+  let open: () => void = () => undefined;
+  const wait = new Promise<void>((resolve) => {
+    open = resolve;
+  });
+  return { open, wait };
+}
+
+/** Register one test per backend. The Postgres one skips without a dedicated test database. */
+function laneTest(name: string, body: (lane: Lane) => Promise<void>): void {
+  for (const backend of BACKENDS) {
+    test(testName(backend, name), { skip: backend === "postgres" ? POSTGRES_SKIP : false }, () =>
+      withLane(backend, body)
+    );
+  }
+}
+
+laneTest("a refused batch whose revision cannot be recorded fails the request", async (lane) => {
+  await commitProof(lane, "run-a");
+  await assertCovered(lane, "run-a", "run A's proof is current");
+  const refused = { ...batchBody(lane, "batch-bad-hash", sessionRecords("s-1")), body_hash: "0".repeat(64) };
+
+  const restore = await failRevisionWrites(lane);
+  const failed = await postBatch(lane, refused);
+  await restore();
+  assert.equal(failed.status, 503, `an unrecorded refusal is not a definitive answer: ${JSON.stringify(failed.body)}`);
+  assert.equal((failed.body?.error as Record<string, unknown> | undefined)?.code, "device_ingest_retryable");
+
+  const answered = await postBatch(lane, refused);
+  assert.equal(answered.status, 400, JSON.stringify(answered.body));
+  await assertRetired(lane, "the recorded refusal retires run A's proof");
+  assert.equal((await highWater(lane)).event, "batch_rejected");
+});
+
+laneTest("a batch whose revision cannot be recorded admits no record", async (lane) => {
+  await commitProof(lane, "run-a");
+  const batch = batchBody(lane, "batch-unrecorded", sessionRecords("s-1", "s-2"));
+  const before = await highWater(lane);
+
+  const restore = await failRevisionWrites(lane);
+  const failed = await postBatch(lane, batch);
+  await restore();
+  assert.equal(failed.status, 503, JSON.stringify(failed.body));
+  assert.equal(await sessionRecordCount(lane), 0, "no record is durable without its revision");
+  assert.deepEqual(await highWater(lane), before, "nothing advanced the revision");
+  await assertCovered(lane, "run-a", "the server admitted nothing after run A");
+
+  const retried = await postBatch(lane, batch);
+  assert.equal(retried.status, 201, JSON.stringify(retried.body));
+  assert.equal(await sessionRecordCount(lane), 2);
+  await assertRetired(lane, "the admitted batch retires run A's proof");
+  assert.equal((await highWater(lane)).event, "batch_accepted");
+});
+
+laneTest("a crash after a batch record is durable cannot leave the earlier proof current", async (lane) => {
+  await commitProof(lane, "run-a");
+  const observed: Array<[string, string]> = [];
+  __setDeviceIngestPhaseFaultHookForTest(async (point, inputIndex) => {
+    if (point === "after-durable-record" || point === "after-durable-phase") {
+      // The process could die here. What the owner would see is what is durable now.
+      observed.push([`${point}${inputIndex === undefined ? "" : `:${inputIndex}`}`, (await projection(lane)).axis]);
+    }
+  });
+  const accepted = await postBatch(lane, batchBody(lane, "batch-crash-window", sessionRecords("s-1", "s-2")));
+  __setDeviceIngestPhaseFaultHookForTest(null);
+  assert.equal(accepted.status, 201, JSON.stringify(accepted.body));
+  assert.deepEqual(observed, [
+    ["after-durable-record:0", "unknown"],
+    ["after-durable-record:1", "unknown"],
+    ["after-durable-phase", "unknown"],
+  ]);
+  await assertRetired(lane, "the accepted batch retires run A's proof");
+});
+
+laneTest(
+  "a terminal proof committed inside a batch is retired by the batch's later record and acceptance",
+  async (lane) => {
+    const observed: Array<[string, string, unknown]> = [];
+    __setDeviceIngestPhaseFaultHookForTest(async (point, inputIndex) => {
+      if (point === "after-durable-record" && inputIndex === 0) {
+        await commitProof(lane, "run-b");
+        const projected = await projection(lane);
+        observed.push(["proof", projected.axis, projected.asOf?.run_id]);
+      } else if (point === "after-durable-record" && inputIndex === 1) {
+        const projected = await projection(lane);
+        observed.push(["record after proof", projected.axis, projected.asOf?.run_id ?? null]);
+      }
+    });
+    const accepted = await postBatch(lane, batchBody(lane, "batch-straddles-proof", sessionRecords("s-1", "s-2")));
+    __setDeviceIngestPhaseFaultHookForTest(null);
+    assert.equal(accepted.status, 201, JSON.stringify(accepted.body));
+    assert.deepEqual(observed, [
+      ["proof", "complete", "run-b"],
+      ["record after proof", "unknown", null],
+    ]);
+    await assertRetired(lane, "the acceptance is later than run B's proof");
+    assert.equal((await highWater(lane)).event, "batch_accepted");
+  }
+);
+
+laneTest("two interleaved batches and a terminal commit: the newest event decides", async (lane) => {
+  const paused = gate();
+  const reachedPause = gate();
+  __setDeviceIngestPhaseFaultHookForTest(async (point, _inputIndex, identity) => {
+    if (point === "after-durable-phase" && identity?.batchId === "batch-x") {
+      reachedPause.open();
+      await paused.wait;
+    }
+  });
+  const x = postBatch(lane, batchBody(lane, "batch-x", sessionRecords("x-1")));
+  await reachedPause.wait;
+  const y = await postBatch(lane, batchBody(lane, "batch-y", sessionRecords("y-1")));
+  assert.equal(y.status, 201, JSON.stringify(y.body));
+  await commitProof(lane, "run-b");
+  await assertCovered(lane, "run-b", "run B's proof is newer than batch Y");
+
+  paused.open();
+  const xResult = await x;
+  __setDeviceIngestPhaseFaultHookForTest(null);
+  assert.equal(xResult.status, 201, JSON.stringify(xResult.body));
+  await assertRetired(lane, "batch X's acceptance is newer than run B's proof");
+
+  await commitProof(lane, "run-c");
+  await assertCovered(lane, "run-c", "run C's proof is the newest event");
+});
+
+laneTest(
+  "replaying a stored terminal response allocates no revision and does not restore a retired proof",
+  async (lane) => {
+    const proof = await commitProof(lane, "run-b");
+    await assertCovered(lane, "run-b", "run B's proof is current");
+    const accepted = await postBatch(lane, batchBody(lane, "batch-after-b", sessionRecords("s-1")));
+    assert.equal(accepted.status, 201, JSON.stringify(accepted.body));
+    const retired = await highWater(lane);
+
+    const replay = await commitTerminalRun(proof);
+    assert.equal(replay.replayed, true, "the exact commit replays its stored response");
+    assert.deepEqual(await highWater(lane), retired, "a replay is not a new event");
+    await assertRetired(lane, "the replay does not restore run B's proof");
+  }
+);
+
+laneTest("a refused resend of a batch from the proof's own run retires the proof", async (lane) => {
+  const batch = batchBody(lane, "batch-run-a", sessionRecords("s-1"));
+  assert.equal((await postBatch(lane, batch)).status, 201);
+  await commitProof(lane, "run-a");
+  await assertCovered(lane, "run-a", "run A's proof follows its own batch");
+
+  const conflicting = batchBody(lane, "batch-run-a", sessionRecords("s-1", "s-2"));
+  const refused = await postBatch(lane, conflicting);
+  assert.equal(refused.status, 409, JSON.stringify(refused.body));
+  await assertRetired(lane, "the refused resend is a later observed attempt");
+  assert.equal((await highWater(lane)).event, "batch_rejected");
+});
+
+laneTest("a failure report whose revision cannot be recorded stores no gap", async (lane) => {
+  await commitProof(lane, "run-a");
+  const restore = await failRevisionWrites(lane);
+  const failed = await postFailureReport(lane, "run-b");
+  await restore();
+  assert.ok(failed.status >= 500, `the report is not acknowledged: ${failed.status} ${JSON.stringify(failed.body)}`);
+  assert.equal(await openGapCount(lane), 0, "the gap is not stored without its revision");
+  await assertCovered(lane, "run-a", "nothing was recorded after run A");
+
+  const delivered = await postFailureReport(lane, "run-b");
+  assert.equal(delivered.status, 201, JSON.stringify(delivered.body));
+  assert.equal(await openGapCount(lane), 1);
+  // The open failure gap is a coverage shortfall of its own; run A's proof no longer stands behind the axis.
+  const projected = await projection(lane);
+  assert.equal(projected.axis, "retryable_gap", "the delivered failure report retires run A's proof");
+  assert.equal(projected.asOf, null, "retired coverage carries no as-of");
+  assert.deepEqual(
+    { ...(await highWater(lane)), revision: 0 },
+    {
+      event: "failure_report",
+      revision: 0,
+      runId: "run-b",
+    }
+  );
+});
+
+laneTest("a delayed legacy split terminal for an older run retires a newer proof", async (lane) => {
+  // Run A (legacy split protocol): its state commit reaches the server.
+  const state = await requestJson(sourceUrl(lane, "/state"), {
+    body: JSON.stringify({ state: { sessions: { cursor: "a" } } }),
+    headers: { "Content-Type": "application/json", ...authHeaders(lane) },
+    method: "PUT",
+  });
+  assert.equal(state.status, 200, JSON.stringify(state.body));
+  // Run B commits a v2 proof.
+  await commitProof(lane, "run-b");
+  await assertCovered(lane, "run-b", "run B's proof is current");
+
+  // Run A's split terminal report arrives late. The server observes it after run B's proof.
+  const report = await postJson(
+    sourceUrl(lane, "/terminal-collection"),
+    {
+      connector_id: CONNECTOR_ID,
+      run_id: "run-a",
+      source_instance_id: lane.enrolled.source_instance_id,
+      streams: [
+        { coverage_statuses: ["collected"], stream: "sessions" },
+        { coverage_statuses: ["collected"], stream: "messages" },
+      ],
+    },
+    authHeaders(lane)
+  );
+  assert.equal(report.status, 201, JSON.stringify(report.body));
+  await assertRetired(lane, "the later legacy terminal retires run B's proof");
+  const after = await highWater(lane);
+  assert.equal(after.runId, "run-a", "the high-water mark names the newest observed event");
+  assert.notEqual(after.event, "terminal_run", "a legacy terminal is not a v2 proof");
+  const [run] = await sql(
+    lane,
+    "SELECT facts_json FROM run_history WHERE run_id = ?",
+    "SELECT facts_json::text AS facts_json FROM run_history WHERE run_id = $1",
+    ["run-a"]
+  );
+  assert.equal(
+    (JSON.parse(String(run?.facts_json)) as { collection_revision?: unknown }).collection_revision,
+    after.revision,
+    "the legacy run record carries its own revision"
+  );
+});
+
+laneTest("every projection that shows complete coverage carries its as-of", async (lane) => {
+  await commitProof(lane, "run-a");
+  await reconcileDirtyConnectorSummaryEvidence(null);
+  const { revision } = await highWater(lane);
+  const expected = { artifact_digest: ARTIFACT_DIGEST, collection_revision: revision, run_id: "run-a" };
+  const pick = (asOf: unknown) => {
+    const value = (asOf ?? {}) as Record<string, unknown>;
+    assert.equal(typeof value.committed_at, "string", "the as-of names its commit time");
+    return {
+      artifact_digest: value.artifact_digest,
+      collection_revision: value.collection_revision,
+      run_id: value.run_id,
+    };
+  };
+
+  const summary = (await listConnectorSummaries()).find(
+    (row) => row.connector_instance_id === lane.enrolled.connector_instance_id
+  );
+  assert.equal(summary?.connection_health.axes.coverage, "complete", "summary connection health");
+  assert.deepEqual(pick(summary?.coverage_as_of), expected, "summary");
+
+  const detail = await getConnectorDetail(CONNECTOR_ID);
+  const detailRecord = detail as unknown as Record<string, unknown>;
+  assert.equal(
+    (detailRecord.connection_health as { axes: { coverage: string } }).axes.coverage,
+    "complete",
+    "detail connection health"
+  );
+  assert.deepEqual(pick(detailRecord.coverage_as_of), expected, "detail");
+
+  const diagnostics = await getOwnerConnectionDiagnostics(lane.enrolled.connector_instance_id);
+  assert.ok(diagnostics, "diagnostics resolve the connection");
+  assert.equal(diagnostics.health.axes.coverage, "complete", "diagnostics health");
+  assert.deepEqual(pick((diagnostics as unknown as Record<string, unknown>).coverage_as_of), expected, "diagnostics");
+});
+
+// ---------------------------------------------------------------------------
+// Upgrade from a database that predates the collection revision.
+// ---------------------------------------------------------------------------
+
+async function dropRevisionColumns(lane: Pick<Lane, "backend">, dbPath: string): Promise<void> {
+  const statements = [
+    "ALTER TABLE connector_instances DROP COLUMN collection_revision",
+    "ALTER TABLE connector_instances DROP COLUMN collection_revision_event",
+    "ALTER TABLE connector_instances DROP COLUMN collection_revision_run_id",
+    "ALTER TABLE connector_instances DROP COLUMN collection_revision_at",
+    "ALTER TABLE connector_state DROP COLUMN collection_revision",
+  ];
+  if (lane.backend === "postgres") {
+    for (const statement of statements) {
+      await postgresQuery(statement);
+    }
+    await postgresQuery("UPDATE run_history SET facts_json = (facts_json::jsonb - 'collection_revision')::jsonb");
+    return;
+  }
+  const raw = new DatabaseSync(dbPath);
+  try {
+    for (const statement of statements) {
+      raw.exec(statement);
+    }
+    raw.exec("UPDATE run_history SET facts_json = json_remove(facts_json, '$.collection_revision')");
+  } finally {
+    raw.close();
+  }
+}
+
+test("upgrade: rows from before the collection revision fail closed, and the next proof is current", async () => {
+  const dir = await mkdtemp(join(tmpdir(), "pdpp-revision-upgrade-"));
+  const dbPath = join(dir, "pdpp.sqlite");
+  try {
+    let enrolled: Enrolled | null = null;
+    await withServerLane("sqlite", { dbPath }, async (lane) => {
+      await commitProof(lane, "run-before-upgrade");
+      await assertCovered(lane, "run-before-upgrade", "the proof is current before the downgrade");
+      enrolled = lane.enrolled;
+    });
+    // The same rows, as a server that predates the revision columns wrote them.
+    await dropRevisionColumns({ backend: "sqlite" }, dbPath);
+    initDb(dbPath);
+    try {
+      const raw = getDb()
+        .prepare(
+          "SELECT collection_revision, collection_revision_event FROM connector_instances WHERE connector_instance_id = ?"
+        )
+        .get((enrolled as Enrolled | null)?.connector_instance_id) as
+        | { collection_revision: number; collection_revision_event: string | null }
+        | undefined;
+      assert.deepEqual(
+        { ...raw },
+        { collection_revision: 0, collection_revision_event: null },
+        "the migration adds a zero high-water mark and invents no event"
+      );
+      const lane = { asUrl: "", backend: "sqlite" as const, enrolled: enrolled as unknown as Enrolled };
+      __setLocalCollectorReleaseForTest(CONNECTOR_ID, SERVER_RELEASE);
+      await assertRetired(lane, "a proof without a revision is unknown after the upgrade");
+      await commitProof(lane, "run-after-upgrade");
+      await assertCovered(lane, "run-after-upgrade", "the first proof after the upgrade is current");
+    } finally {
+      __setLocalCollectorReleaseForTest(CONNECTOR_ID, null);
+      closeDb();
+    }
+  } finally {
+    await rm(dir, { force: true, recursive: true });
+  }
+});
+
+test("upgrade [real PostgreSQL]: rows from before the collection revision fail closed, and the next proof is current", {
+  skip: POSTGRES_SKIP,
+}, async () => {
+  await withLane("postgres", async (lane) => {
+    await commitProof(lane, "run-before-upgrade");
+    await assertCovered(lane, "run-before-upgrade", "the proof is current before the downgrade");
+    await dropRevisionColumns(lane, "");
+    await bootstrapPostgresSchema();
+    const [row] = await postgresQuery<{ event: string | null; revision: string }>(
+      `SELECT collection_revision::text AS revision, collection_revision_event AS event
+         FROM connector_instances WHERE connector_instance_id = $1`,
+      [lane.enrolled.connector_instance_id]
+    ).then((result) => result.rows);
+    assert.deepEqual({ ...row }, { event: null, revision: "0" }, "the migration invents no event");
+    await assertRetired(lane, "a proof without a revision is unknown after the upgrade");
+    await commitProof(lane, "run-after-upgrade");
+    await assertCovered(lane, "run-after-upgrade", "the first proof after the upgrade is current");
+  });
+});

From ab3dacb956d3584ff905e7df6cf0a9642d0cdb1c Mon Sep 17 00:00:00 2001
From: Tim Nunamaker <tnunamak@gmail.com>
Date: Thu, 22 Oct 2026 09:08:39 -0500
Subject: [PATCH 40/87] test(reference): count the new cold-required Postgres
 test

The revision atomicity suite is classified cold-required, so there are now 38.

Assisted-by: AI
Signed-off-by: Tim Nunamaker <tnunamak@gmail.com>
---
 .../scripts/run-tests-resource-policy.test.ts                 | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/reference-implementation/scripts/run-tests-resource-policy.test.ts b/reference-implementation/scripts/run-tests-resource-policy.test.ts
index 766f1428c..55bb1b41c 100644
--- a/reference-implementation/scripts/run-tests-resource-policy.test.ts
+++ b/reference-implementation/scripts/run-tests-resource-policy.test.ts
@@ -33,8 +33,8 @@ test("only reviewed files bypass outer allocation; restore remains separate", ()
   assert.equal(isDedicatedPostgresTestDatabaseName(restoreName), true);
 });
 
-test("all 37 cold-required entries remain cold, including helper-owned bootstrap", () => {
-  assert.equal(POSTGRES_TEMPLATE_COLD_REQUIRED_FILES.length, 37);
+test("all 38 cold-required entries remain cold, including helper-owned bootstrap", () => {
+  assert.equal(POSTGRES_TEMPLATE_COLD_REQUIRED_FILES.length, 38);
   for (const file of POSTGRES_TEMPLATE_COLD_REQUIRED_FILES) {
     assert.equal(isPostgresTemplateEligibleFilePath(file), false, file);
   }

From f3d8beb046be491e24939618730e608c64936033 Mon Sep 17 00:00:00 2001
From: Tim Nunamaker <tnunamak@gmail.com>
Date: Thu, 22 Oct 2026 10:10:06 -0500
Subject: [PATCH 41/87] fix(coverage): close the remaining revision and
 snapshot gaps

A terminal commit treated a revision it could not advance as null and
still wrote its state, event and run record. It now requires the
revision and rolls back whole, like the batch and legacy paths.

The advance incremented the stored value before validating it. Both
schemas accept a negative revision, and SQLite also keeps text and
reals, so 'abc' + 1 became 1 and -1 + 1 became 0. The UPDATE now matches
only a non-negative integer whose successor is a safe integer; any other
stored value throws. A state commit still writes without a revision
only when no connection row exists (connector-keyed legacy callers).

A retried legacy split terminal report reused its run's event id, so
the insert threw a primary-key error and the device got a 500 carrying
the database message. The commit now reads the stored event under the
same lock first: an identical retry answers 200 with no new revision, a
different report for the run answers 409 terminal_collection_conflict.

Embedded health objects (summary and detail connection_health,
diagnostics health) now carry the same coverage_as_of as their
projection.

Device-exporter diagnostics set fully_accounted from raw
coverage_diagnostics rows, so it stayed true after a later refusal
retired the owner coverage. It now comes from the owner summary's
fenced verdict, with its coverage_as_of; the raw statuses stay as
historical inventory.

The projection read the declared scope and manifest generation apart
from the proof fence, so a proof committed and a boundary changed
between those reads produced a positive for a boundary that was no
longer current. The fence query now reads the scope, the generation
and the manifest with the proof in one statement, and a positive also
needs them to equal the projection's own reads.

Tests run on SQLite and real PostgreSQL. Six fail on ab3dacb956: the
unreadable revision, the legacy retry, nested as-of, device positive,
and the scope and manifest changes mid-projection. Added guards cover a
selective terminal_run trigger, an acceptance that fails after its
records commit, a failing state commit, and a record transaction and a
terminal commit for one connection serializing on PostgreSQL without
deadlock.

Assisted-by: AI
Signed-off-by: Tim Nunamaker <tnunamak@gmail.com>
---
 .../src/app/(console)/lib/ref-client.ts       |   6 +
 .../local-device-terminal-collection.ts       |  19 +-
 reference-implementation/server/index.ts      |   9 +
 .../server/ref-control.ts                     |  68 ++-
 .../server/routes/ref-device-exporters.ts     |  42 +-
 .../stores/collection-revision-store.ts       | 153 +++++-
 .../stores/terminal-run-commit-store.ts       | 118 ++++-
 .../cadence-lateness-cross-surface.test.ts    |   2 +-
 .../test/device-exporter-routes.test.ts       |   6 +-
 .../health-authority-cross-surface.test.ts    |   2 +-
 ...device-coverage-revision-atomicity.test.ts | 456 +++++++++++++++++-
 11 files changed, 803 insertions(+), 78 deletions(-)

diff --git a/apps/console/src/app/(console)/lib/ref-client.ts b/apps/console/src/app/(console)/lib/ref-client.ts
index b17c8c61e..a1243a963 100644
--- a/apps/console/src/app/(console)/lib/ref-client.ts
+++ b/apps/console/src/app/(console)/lib/ref-client.ts
@@ -1330,6 +1330,12 @@ export interface RefConnectionHealthSnapshot {
    */
   collection_rate?: RefCollectionRateSnapshot | null;
   conditions?: readonly RefConnectionHealthCondition[];
+  /**
+   * What `axes.coverage` is a fact about: the same value as the summary's
+   * top-level `coverage_as_of`. Optional on the mirror because a reference
+   * predating the field omits it.
+   */
+  coverage_as_of?: RefCoverageAsOf | null;
   /**
    * Additive, nullable source-pressure detail-gap backlog rollup
    * ({@link RefDetailGapBacklog}). `null` when no backlog evidence was supplied
diff --git a/reference-implementation/operations/local-device-terminal-collection.ts b/reference-implementation/operations/local-device-terminal-collection.ts
index abbf4220b..fe1ea5fac 100644
--- a/reference-implementation/operations/local-device-terminal-collection.ts
+++ b/reference-implementation/operations/local-device-terminal-collection.ts
@@ -282,11 +282,10 @@ export async function handleLocalDeviceTerminalCollection(input: {
     // record takes the next collection revision in the same transaction, so a
     // report delayed past a newer proof retires that proof.
     const { connectorInstanceId } = authorized.connectorInstance;
-    const event = (collectionRevision: number) => ({
+    const event = {
       actor_id: deviceId,
       actor_type: "local_device",
       data: {
-        collection_revision: collectionRevision,
         collection_facts: {
           // The boundary this evidence was measured against travels WITH it, so
           // a later scope change is detectable by comparison and stale proof can
@@ -314,10 +313,20 @@ export async function handleLocalDeviceTerminalCollection(input: {
       source_id: authorized.sourceInstance.connectorId,
       source_kind: "connector",
       status: "succeeded",
-    });
-    await commitLegacyTerminalCollection({ buildEvent: event, connectorInstanceId, runId });
-    res.status(201).json({ ok: true });
+    };
+    // An identical retry of a stored report is acknowledged without a new revision.
+    const { replayed } = await commitLegacyTerminalCollection({ connectorInstanceId, event, runId });
+    res.status(replayed ? 200 : 201).json({ ok: true });
   } catch (error) {
+    if (error instanceof TerminalRunCommitConflictError) {
+      ctx.pdppError(
+        res,
+        409,
+        "terminal_collection_conflict",
+        "A different terminal collection report is already stored for this run."
+      );
+      return;
+    }
     ctx.handleError(res, error);
   }
 }
diff --git a/reference-implementation/server/index.ts b/reference-implementation/server/index.ts
index 005125cb3..da7d876d5 100644
--- a/reference-implementation/server/index.ts
+++ b/reference-implementation/server/index.ts
@@ -7089,6 +7089,15 @@ export function buildAsApp(opts: ServerOpts = {}) {
     prepareDeviceFinalRecords,
     putSyncState,
     readCollectorProtocolHeader,
+    // The same fenced verdict the connector summary shows, so device
+    // diagnostics never claim coverage the owner projection has retired.
+    readCurrentLocalCoverage: async (connectorInstanceId: string) => {
+      const summary = await getConnectorSummaryForRoute(connectorInstanceId, controller);
+      if (!(summary && "coverage_as_of" in summary && summary.connection_health)) {
+        return null;
+      }
+      return { asOf: summary.coverage_as_of, axis: summary.connection_health.axes.coverage };
+    },
     readReferenceLocalConnectorCatalogManifest,
     requireDeviceExporterCredential,
     requireOwnerSession: ownerAuth.requireOwnerSession,
diff --git a/reference-implementation/server/ref-control.ts b/reference-implementation/server/ref-control.ts
index 5c958aab8..2ae61b7e2 100644
--- a/reference-implementation/server/ref-control.ts
+++ b/reference-implementation/server/ref-control.ts
@@ -902,7 +902,7 @@ export interface ConnectorSummary {
    * `complete`. Empty when no in-scope stream universe exists.
    */
   readonly collection_report: readonly CollectionReportEntry[];
-  readonly connection_health: ConnectionHealthSnapshot;
+  readonly connection_health: ConnectorConnectionHealth;
   readonly connection_id: string;
   readonly connector_display_name: string;
   readonly connector_id: string;
@@ -1171,7 +1171,7 @@ export interface ConnectorDetail {
    * wide or zeroed snapshot. A consumer must treat `null` here as "no single
    * connection's health is resolvable," not as an absence of any problem.
    */
-  readonly connection_health: ConnectionHealthSnapshot | null;
+  readonly connection_health: ConnectorConnectionHealth | null;
   readonly connection_id: string;
   /** See {@link ConnectorSummary.coverage_as_of}; `null` when no single connection resolved. */
   readonly coverage_as_of: LocalCoverageAsOf | null;
@@ -4830,6 +4830,15 @@ interface LocalCoverageDiagnosticAxis {
   readonly asOf?: LocalCoverageAsOf | null;
 }
 
+/**
+ * A connection's health as the owner projections embed it. It carries the
+ * coverage as-of itself, so a health object read on its own still names what
+ * its coverage axis is a fact about.
+ */
+export type ConnectorConnectionHealth = ConnectionHealthSnapshot & {
+  readonly coverage_as_of: LocalCoverageAsOf | null;
+};
+
 /**
  * The run a local coverage verdict describes. Coverage is a fact about one
  * run, never a present-tense claim, so every projection that shows coverage
@@ -5126,6 +5135,37 @@ function deriveLocalTerminalCoverageAxis(
   };
 }
 
+/**
+ * Whether the boundary read with the proof and its fence (one statement) is
+ * the boundary the rest of this projection was built from: the declared scope
+ * of the coverage read, the manifest generation of the summary evidence, and
+ * the manifest itself. A difference means a scope or manifest change landed
+ * between those reads. The projection then composes no positive from the two
+ * moments; the coverage is unknown.
+ */
+function proofBoundaryIsCoherent(
+  fence: LocalCoverageRevisionFence | null | undefined,
+  declaredCollectionScope: string | undefined,
+  manifestGeneration: number | null,
+  manifest: ConnectorManifest
+): boolean {
+  const boundary = fence?.boundary;
+  if (!boundary?.manifestJson || boundary.manifestGeneration === null) {
+    return false;
+  }
+  let proofManifest: unknown;
+  try {
+    proofManifest = JSON.parse(boundary.manifestJson) as unknown;
+  } catch {
+    return false;
+  }
+  return (
+    boundary.declaredCollectionScope === declaredCollectionScope &&
+    boundary.manifestGeneration === manifestGeneration &&
+    JSON.stringify(proofManifest) === JSON.stringify(manifest)
+  );
+}
+
 /**
  * The terminal run the revision fence names, shaped for
  * `deriveLocalTerminalCoverageAxis`. The fence reads it by run id, so a
@@ -7261,16 +7301,23 @@ function synthesizeConnectorSummary(input: ConnectorSummarySynthesisInput): Conn
   // names; a legacy diagnostics row is never one. Any later observed event
   // retires it. The downstream readers below all take `effectiveLocalCoverage`, so the
   // retirement reaches every consumer, not only this branch.
-  const proofRunCoverage = localDeviceBacked
-    ? localProofRunCoverage(localCoverage?.revisionFence, connectorInstanceId)
-    : null;
+  const proofRunCoverage =
+    localDeviceBacked &&
+    proofBoundaryIsCoherent(
+      localCoverage?.revisionFence,
+      localCoverage?.declaredCollectionScope,
+      evidence?.manifest_generation ?? null,
+      manifest
+    )
+      ? localProofRunCoverage(localCoverage?.revisionFence, connectorInstanceId)
+      : null;
   const effectiveLocalCoverage = localDeviceBacked
     ? fenceLocalCoverageProof(
         deriveLocalTerminalCoverageAxis(
           proofRunCoverage?.run ?? null,
           manifest,
           localCoverage,
-          evidence?.manifest_generation ?? null,
+          localCoverage?.revisionFence?.boundary.manifestGeneration ?? null,
           localCollectorRelease?.artifactDigest ?? null,
           localCollectorRelease ? fingerprintDeviceAttemptManifest(localCollectorRelease.manifest) : null
         ) ?? localCoverage,
@@ -7411,6 +7458,8 @@ function synthesizeConnectorSummary(input: ConnectorSummarySynthesisInput): Conn
     initialConnectionHealth,
     collectionReport
   );
+  // One as-of for every projection of this coverage: the summary, its embedded health, and what reads them.
+  const coverageAsOf = effectiveLocalCoverage?.asOf ?? null;
   const recoveredCount = detailGaps.recovered;
   // A non-current `record_snapshot` means the stored counts predate a failure,
   // so they must never read as an authoritative exact count. Resolved here
@@ -7599,10 +7648,10 @@ function synthesizeConnectorSummary(input: ConnectorSummarySynthesisInput): Conn
     acquisition_coverage: acquisitionCoverage,
     auto_enroll_skip_reason: recordedAutoEnrollSkipReason(instance),
     collection_report: collectionReport,
-    connection_health: connectionHealth,
+    connection_health: { ...connectionHealth, coverage_as_of: coverageAsOf },
     connection_id: connectorInstanceId,
     connector_display_name: connectorDisplayName,
-    coverage_as_of: effectiveLocalCoverage?.asOf ?? null,
+    coverage_as_of: coverageAsOf,
     connector_id: connectorId,
     connector_implementation: input.connectorImplementation,
     connector_instance_id: connectorInstanceId,
@@ -9882,6 +9931,8 @@ export interface OwnerConnectionDiagnosticsRun {
 export interface OwnerConnectionDiagnosticsHealth {
   readonly axes: ConnectionHealthSnapshot["axes"];
   readonly badges: ConnectionHealthSnapshot["badges"];
+  /** What `axes.coverage` is a fact about; the same value as the top-level `coverage_as_of`. */
+  readonly coverage_as_of: LocalCoverageAsOf | null;
   readonly last_success_at: string | null;
   readonly next_attempt_at: string | null;
   readonly reason_code: string | null;
@@ -10049,6 +10100,7 @@ export async function getOwnerConnectionDiagnostics(
     health: {
       axes: health.axes,
       badges: health.badges,
+      coverage_as_of: health.coverage_as_of,
       last_success_at: health.last_success_at,
       next_attempt_at: health.next_attempt_at,
       reason_code: health.reason_code,
diff --git a/reference-implementation/server/routes/ref-device-exporters.ts b/reference-implementation/server/routes/ref-device-exporters.ts
index 307b2f40a..53d4505d9 100644
--- a/reference-implementation/server/routes/ref-device-exporters.ts
+++ b/reference-implementation/server/routes/ref-device-exporters.ts
@@ -39,6 +39,7 @@ import { deriveReferenceFreshness } from "../freshness.ts";
 import { presentHeartbeatHealth } from "../heartbeat-lease.ts";
 import { buildStoredCollectionScope, COLLECTION_SCOPE_STATE_KEY } from "../local-collection-scope.ts";
 import { assertRecordIdentity, normalizePrimaryKey } from "../record-expand-helpers.ts";
+import type { LocalCoverageAsOf } from "../ref-control.ts";
 import {
   type CollectionRevisionEventInput,
   isCollectionRevisionUnavailable,
@@ -559,6 +560,10 @@ export interface MountRefDeviceExportersContext {
   // `{ store, stream, status }` triple per store — never paths, payloads,
   // the coverage `reason` text, or secrets.
   listLocalCoverageDiagnostics: (storageTarget: StorageTarget) => Promise<LocalCoverageRow[]>;
+  // The owner projection's fenced local coverage verdict for one connection
+  // (the connector summary's coverage axis and `coverage_as_of`), or `null`
+  // when the connection does not resolve.
+  readCurrentLocalCoverage: (connectorInstanceId: string) => Promise<CurrentLocalCoverage | null>;
   maintainRecordIndexes: (
     storageTarget: StorageTarget,
     record: unknown,
@@ -1534,18 +1539,33 @@ export interface LocalCoverageRow {
  * Per-source-instance local-completeness projection surfaced in the
  * device-exporter diagnostics (Section 5.3). Carries only safe coverage
  * statuses and counts; never raw paths, payloads, reasons, or secrets.
- * `observed` is false when the instance has no coverage records yet (no run
- * has requested `coverage_diagnostics`), so absence reads as absence.
+ *
+ * `by_store`, `counts_by_status`, `store_count` and `unaccounted_stores` are
+ * historical inventory: the latest live `coverage_diagnostics` records, with
+ * no run, release, generation, revision or scope behind them. They never
+ * claim current completeness. `observed` is false when the instance has no
+ * such records, so absence reads as absence.
+ *
+ * `fully_accounted` and `coverage_as_of` are the owner projection's fenced
+ * verdict for the connection: true only while a v2 terminal proof is current
+ * and the coverage axis is `complete`, with the as-of that proof carries.
  */
 interface LocalCoverageProjection {
   by_store: Record<string, string>;
   counts_by_status: Record<string, number>;
+  coverage_as_of: LocalCoverageAsOf | null;
   fully_accounted: boolean;
   observed: boolean;
   store_count: number;
   unaccounted_stores: string[];
 }
 
+/** The owner projection's coverage verdict for one connection. */
+export interface CurrentLocalCoverage {
+  readonly asOf: LocalCoverageAsOf | null;
+  readonly axis: string;
+}
+
 const COVERAGE_STATUSES = [
   "collected",
   "inventory_only",
@@ -1556,7 +1576,11 @@ const COVERAGE_STATUSES = [
   "unaccounted",
 ] as const;
 
-function summarizeLocalCoverage(rows: readonly LocalCoverageRow[]): LocalCoverageProjection {
+function summarizeLocalCoverage(
+  rows: readonly LocalCoverageRow[],
+  current: CurrentLocalCoverage | null
+): LocalCoverageProjection {
+  const fullyAccounted = current?.axis === "complete" && current.asOf !== null;
   const countsByStatus: Record<string, number> = {};
   for (const status of COVERAGE_STATUSES) {
     countsByStatus[status] = 0;
@@ -1574,9 +1598,10 @@ function summarizeLocalCoverage(rows: readonly LocalCoverageRow[]): LocalCoverag
   return {
     by_store: byStore,
     counts_by_status: countsByStatus,
-    // `fully_accounted` requires actually observing coverage. An empty
-    // coverage set is "nothing seen", not "everything accounted for".
-    fully_accounted: rows.length > 0 && unaccountedStores.length === 0,
+    coverage_as_of: fullyAccounted ? (current?.asOf ?? null) : null,
+    // Never derived from the inventory above: those rows can outlive the
+    // owner coverage a later refused or failed run retired.
+    fully_accounted: fullyAccounted,
     observed: rows.length > 0,
     store_count: rows.length,
     // biome-ignore lint/suspicious/useArraySortCompare: Input ordering is intentionally the runtime’s established default string order.
@@ -1707,7 +1732,9 @@ async function aggregateLocalCoverage(
       const rows = await ctx.listLocalCoverageDiagnostics(
         referenceLocalDeviceStorageTarget(ctx, connectorId, connectorInstanceId)
       );
-      coverage.set(connectorInstanceId, summarizeLocalCoverage(rows));
+      // A failed verdict read shows no positive; the inventory still shows.
+      const current = await ctx.readCurrentLocalCoverage(connectorInstanceId).catch(() => null);
+      coverage.set(connectorInstanceId, summarizeLocalCoverage(rows, current));
     } catch {
       // Leave unset → EMPTY_LOCAL_COVERAGE (observed=false) in projection.
     }
@@ -1822,6 +1849,7 @@ const EMPTY_LOCAL_COVERAGE: LocalCoverageProjection = Object.freeze({
     string,
     number
   >,
+  coverage_as_of: null,
   fully_accounted: false,
   observed: false,
   store_count: 0,
diff --git a/reference-implementation/server/stores/collection-revision-store.ts b/reference-implementation/server/stores/collection-revision-store.ts
index a974b07f2..2a54fa7c7 100644
--- a/reference-implementation/server/stores/collection-revision-store.ts
+++ b/reference-implementation/server/stores/collection-revision-store.ts
@@ -16,6 +16,7 @@
 // A refusal has no other durable effect: its revision is its only write.
 
 import { getDb } from "../db.ts";
+import { COLLECTION_SCOPE_STATE_KEY, readStoredCollectionScope } from "../local-collection-scope.ts";
 import { isPostgresStorageBackend, postgresQuery, withPostgresTransaction } from "../postgres-storage.ts";
 
 export type CollectionRevisionEvent =
@@ -75,48 +76,93 @@ const ADVANCE_SET = `collection_revision = collection_revision + 1,
 
 const DECIMAL_DIGITS = /^\d+$/;
 
+// The schema does not keep the stored revision readable: both backends accept
+// a negative value, and SQLite's INTEGER affinity also keeps text or a real.
+// The advance therefore matches only a stored non-negative integer whose
+// successor is still a safe integer. Any other stored value matches no row, so
+// the event fails closed instead of incrementing a value it cannot order by
+// (SQLite would turn 'abc' + 1 into 1, and -1 + 1 into 0).
+const MAX_ADVANCEABLE_REVISION = Number.MAX_SAFE_INTEGER - 1;
+const SQLITE_ADVANCEABLE = `typeof(collection_revision) = 'integer'
+        AND collection_revision BETWEEN 0 AND ${MAX_ADVANCEABLE_REVISION}`;
+const POSTGRES_ADVANCEABLE = `collection_revision BETWEEN 0 AND ${MAX_ADVANCEABLE_REVISION}`;
+
 /** Parse a stored revision. Anything other than a non-negative safe integer is unreadable. */
 export function readCollectionRevision(value: unknown): number | null {
   const revision = typeof value === "string" && DECIMAL_DIGITS.test(value) ? Number(value) : value;
   return typeof revision === "number" && Number.isSafeInteger(revision) && revision >= 0 ? revision : null;
 }
 
+type AdvancedRevision = { readonly manifestGeneration: number; readonly revision: number };
+
+/**
+ * Read the result of a guarded advance. No returned row means either no
+ * connection row exists (`null`) or its stored revision is not advanceable,
+ * which throws: an event must not commit against a revision the server cannot
+ * order by.
+ */
+function advancedRevision(
+  row: { collection_revision: unknown; manifest_generation: unknown } | undefined,
+  connectionExists: () => boolean,
+  connectorInstanceId: string,
+  event: CollectionRevisionEvent
+): AdvancedRevision | null {
+  if (!row) {
+    if (connectionExists()) {
+      throw new CollectionRevisionUnavailableError(connectorInstanceId, event);
+    }
+    return null;
+  }
+  const revision = readCollectionRevision(row.collection_revision);
+  if (revision === null) {
+    throw new CollectionRevisionUnavailableError(connectorInstanceId, event);
+  }
+  return { manifestGeneration: Number(row.manifest_generation ?? 0), revision };
+}
+
 /**
  * Advance the revision on an open SQLite transaction. Returns the new revision
  * and the connection's manifest generation, or `null` when no connection row
- * exists.
+ * exists. Throws when the stored revision is not advanceable.
  */
 export function advanceSqliteCollectionRevisionInTransaction(
   db: SqliteHandle,
   connectorInstanceId: string,
   input: CollectionRevisionEventInput
-): { readonly manifestGeneration: number; readonly revision: number } | null {
+): AdvancedRevision | null {
   const row = db
     .prepare(
       `UPDATE connector_instances SET ${ADVANCE_SET}
         WHERE connector_instance_id = ?
+          AND ${SQLITE_ADVANCEABLE}
         RETURNING collection_revision, manifest_generation`
     )
     .get(input.event, input.runId ?? null, input.at, connectorInstanceId) as
     | { collection_revision: unknown; manifest_generation: unknown }
     | undefined;
-  const revision = readCollectionRevision(row?.collection_revision);
-  return row && revision !== null ? { manifestGeneration: Number(row.manifest_generation ?? 0), revision } : null;
+  return advancedRevision(
+    row,
+    () =>
+      db
+        .prepare("SELECT 1 AS present FROM connector_instances WHERE connector_instance_id = ?")
+        .get(connectorInstanceId) !== undefined,
+    connectorInstanceId,
+    input.event
+  );
 }
 
 /**
- * Advance the revision on an open Postgres transaction. The UPDATE takes the
- * connection row lock first, so a caller that also needs the manifest
- * generation reads it from here and never upgrades a FOR SHARE lock.
+ * Advance the revision on an open Postgres transaction. Returns `null` when no
+ * connection row exists, and throws when the stored revision is not
+ * advanceable. The UPDATE takes the connection row lock first, so a caller
+ * that also needs the manifest generation reads it from here and never
+ * upgrades a FOR SHARE lock.
  */
 export async function advancePostgresCollectionRevisionInTransaction(
   client: PostgresHandle,
   connectorInstanceId: string,
   input: CollectionRevisionEventInput
-): Promise<{
-  readonly manifestGeneration: number;
-  readonly revision: number;
-} | null> {
+): Promise<AdvancedRevision | null> {
   const result = await client.query(
     `UPDATE connector_instances
         SET collection_revision = collection_revision + 1,
@@ -124,15 +170,22 @@ export async function advancePostgresCollectionRevisionInTransaction(
             collection_revision_run_id = $2,
             collection_revision_at = $3
       WHERE connector_instance_id = $4
+        AND ${POSTGRES_ADVANCEABLE}
       RETURNING collection_revision::text AS collection_revision, manifest_generation`,
     [input.event, input.runId ?? null, input.at, connectorInstanceId]
   );
   const row = result.rows[0] as { collection_revision: unknown; manifest_generation: unknown } | undefined;
-  const revision = readCollectionRevision(row?.collection_revision);
-  return row && revision !== null ? { manifestGeneration: Number(row.manifest_generation ?? 0), revision } : null;
+  const exists = row
+    ? true
+    : (
+        await client.query("SELECT 1 AS present FROM connector_instances WHERE connector_instance_id = $1", [
+          connectorInstanceId,
+        ])
+      ).rows.length > 0;
+  return advancedRevision(row, () => exists, connectorInstanceId, input.event);
 }
 
-/** Advance on an open SQLite transaction, or throw so the caller's event rolls back with it. */
+/** Advance on an open SQLite transaction, or throw (also when no connection row exists) so the caller's event rolls back with it. */
 export function requireSqliteCollectionRevisionInTransaction(
   db: SqliteHandle,
   connectorInstanceId: string,
@@ -145,7 +198,7 @@ export function requireSqliteCollectionRevisionInTransaction(
   return advanced.revision;
 }
 
-/** Advance on an open Postgres transaction, or throw so the caller's event rolls back with it. */
+/** Advance on an open Postgres transaction, or throw (also when no connection row exists) so the caller's event rolls back with it. */
 export async function requirePostgresCollectionRevisionInTransaction(
   client: PostgresHandle,
   connectorInstanceId: string,
@@ -185,17 +238,41 @@ export interface LocalCoverageProofRun {
   readonly status: string;
 }
 
+/**
+ * The boundary a proof is judged against, read in the same statement as the
+ * proof and its fence: the scope the connection declares, its manifest
+ * generation, and (only when the newest event is a terminal run) the
+ * connector manifest at that generation.
+ */
+export interface LocalCoverageProofBoundary {
+  readonly declaredCollectionScope: string;
+  readonly manifestGeneration: number | null;
+  /** The stored manifest JSON text; `null` unless the high-water event is a terminal run. */
+  readonly manifestJson: string | null;
+}
+
 /**
  * Everything the projection needs to decide whether a local coverage proof is
  * current, read in one snapshot. `highWater` is null when the connection has
  * no readable revision. `proofRun` is present only when the newest event is a
- * terminal run.
+ * terminal run. `boundary` comes from the same statement, so a proof is never
+ * judged against a scope or manifest from another moment.
  */
 export interface LocalCoverageRevisionFence {
+  readonly boundary: LocalCoverageProofBoundary;
   readonly highWater: CollectionRevisionHighWater | null;
   readonly proofRun: LocalCoverageProofRun | null;
 }
 
+let fenceReadHook: ((connectorInstanceIds: readonly string[]) => Promise<void> | void) | null = null;
+
+/** Run `hook` just before each fence read, after the caller's own boundary reads. Tests only. */
+export function __setLocalCoverageFenceReadHookForTest(
+  hook: ((connectorInstanceIds: readonly string[]) => Promise<void> | void) | null
+): void {
+  fenceReadHook = hook;
+}
+
 function parseFacts(value: unknown): Record<string, unknown> | null {
   let parsed = value;
   if (typeof value === "string") {
@@ -208,6 +285,19 @@ function parseFacts(value: unknown): Record<string, unknown> | null {
   return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? (parsed as Record<string, unknown>) : null;
 }
 
+/** The fingerprint of a stored `$collection_scope` row, as the coverage readers compute it. */
+function declaredScopeFingerprint(stateJson: unknown): string {
+  let parsed: unknown = stateJson;
+  if (typeof stateJson === "string") {
+    try {
+      parsed = JSON.parse(stateJson) as unknown;
+    } catch {
+      parsed = null;
+    }
+  }
+  return readStoredCollectionScope({ [COLLECTION_SCOPE_STATE_KEY]: parsed ?? null }).fingerprint;
+}
+
 /** Batched fence read for one page of connections, keyed by connector instance. */
 export async function readLocalCoverageRevisionFences(
   connectorInstanceIds: readonly string[]
@@ -218,30 +308,43 @@ export async function readLocalCoverageRevisionFences(
     collection_revision_event: string | null;
     collection_revision_run_id: string | null;
     connector_instance_id: string;
+    manifest_generation: unknown;
+    proof_manifest: string | null;
     proof_completed_at: string | null;
     proof_facts_json: unknown;
     proof_run_id: string | null;
     proof_scheduler_managed: unknown;
     proof_status: string | null;
+    scope_state_json: unknown;
   }
   const ids = [...new Set(connectorInstanceIds.filter((id) => typeof id === "string" && id.length > 0))];
   const rows: Row[] = [];
   if (ids.length === 0) {
     return new Map();
   }
-  const select = (revisionColumn: string, runTerminal: string) =>
-    `SELECT ci.connector_instance_id, ${revisionColumn} AS collection_revision, ci.collection_revision_event,
-            ci.collection_revision_run_id, ci.collection_revision_at,
+  await fenceReadHook?.(ids);
+  // One statement per backend, so the fence, the proof run, and the boundary
+  // the proof is judged against come from one snapshot. The manifest is read
+  // only for a connection whose newest event is a terminal run.
+  const select = (casts: { readonly json: string; readonly revision: string }, runTerminal: string) =>
+    `SELECT ci.connector_instance_id, ci.collection_revision${casts.revision} AS collection_revision,
+            ci.collection_revision_event, ci.collection_revision_run_id, ci.collection_revision_at,
+            ci.manifest_generation, scope.state_json${casts.json} AS scope_state_json,
+            CASE WHEN ci.collection_revision_event = ${runTerminal} THEN c.manifest${casts.json} END AS proof_manifest,
             rh.run_id AS proof_run_id, rh.status AS proof_status, rh.scheduler_managed AS proof_scheduler_managed,
             rh.completed_at AS proof_completed_at, rh.facts_json AS proof_facts_json
        FROM connector_instances ci
+       LEFT JOIN connectors c ON c.connector_id = ci.connector_id
+       LEFT JOIN connector_state scope
+         ON scope.connector_instance_id = ci.connector_instance_id
+        AND scope.stream = '${COLLECTION_SCOPE_STATE_KEY}'
        LEFT JOIN run_history rh
          ON rh.connector_instance_id = ci.connector_instance_id
         AND rh.run_id = ci.collection_revision_run_id
         AND ci.collection_revision_event = ${runTerminal}`;
   if (isPostgresStorageBackend()) {
     const result = await postgresQuery<Row>(
-      `${select("ci.collection_revision::text", "$2")}
+      `${select({ json: "::text", revision: "::text" }, "$2")}
         WHERE ci.connector_instance_id = ANY($1::text[])`,
       [ids, "terminal_run"]
     );
@@ -252,17 +355,23 @@ export async function readLocalCoverageRevisionFences(
       rows.push(
         ...(getDb()
           .prepare(
-            `${select("ci.collection_revision", "?")}
+            `${select({ json: "", revision: "" }, "?")}
               WHERE ci.connector_instance_id IN (${chunk.map(() => "?").join(", ")})`
           )
-          .all("terminal_run", ...chunk) as Row[])
+          .all("terminal_run", "terminal_run", ...chunk) as Row[])
       );
     }
   }
   const fences = new Map<string, LocalCoverageRevisionFence>();
   for (const row of rows) {
     const revision = readCollectionRevision(row.collection_revision);
+    const generation = readCollectionRevision(row.manifest_generation);
     fences.set(row.connector_instance_id, {
+      boundary: {
+        declaredCollectionScope: declaredScopeFingerprint(row.scope_state_json),
+        manifestGeneration: generation,
+        manifestJson: typeof row.proof_manifest === "string" ? row.proof_manifest : null,
+      },
       highWater:
         revision === null
           ? null
diff --git a/reference-implementation/server/stores/terminal-run-commit-store.ts b/reference-implementation/server/stores/terminal-run-commit-store.ts
index 621e5b1a6..29d0161fe 100644
--- a/reference-implementation/server/stores/terminal-run-commit-store.ts
+++ b/reference-implementation/server/stores/terminal-run-commit-store.ts
@@ -8,8 +8,6 @@ import { appendSqliteSpineEventInTransaction, type SpineDatabase, type SpineEven
 import { getDb } from "../db.ts";
 import { isPostgresStorageBackend, withPostgresTransaction } from "../postgres-storage.ts";
 import {
-  advancePostgresCollectionRevisionInTransaction,
-  advanceSqliteCollectionRevisionInTransaction,
   requirePostgresCollectionRevisionInTransaction,
   requireSqliteCollectionRevisionInTransaction,
 } from "./collection-revision-store.ts";
@@ -94,7 +92,7 @@ function eventInputFor(
   eventId: string,
   response: TerminalRunCommitResponse,
   occurredAt: string,
-  collectionRevision: number | null
+  collectionRevision: number
 ): SpineEventInput & PostgresSpineEventInput {
   return {
     actor_id: input.deviceId,
@@ -198,12 +196,12 @@ function commitSqlite(input: ResolvedTerminalRunCommit): TerminalRunCommitResult
 
     const occurredAt = new Date().toISOString();
     const response = responseFor(input, eventId);
-    const collectionRevision =
-      advanceSqliteCollectionRevisionInTransaction(db, input.connectorInstanceId, {
-        at: occurredAt,
-        event: "terminal_run",
-        runId: input.runId,
-      })?.revision ?? null;
+    // Required: a terminal run without its revision rolls back whole.
+    const collectionRevision = requireSqliteCollectionRevisionInTransaction(db, input.connectorInstanceId, {
+      at: occurredAt,
+      event: "terminal_run",
+      runId: input.runId,
+    });
     putSqliteConnectorStateDeltaInTransaction(
       db,
       { connectorId: input.connectorId, connectorInstanceId: input.connectorInstanceId },
@@ -273,14 +271,12 @@ async function commitPostgres(input: ResolvedTerminalRunCommit): Promise<Termina
 
       const occurredAt = new Date().toISOString();
       const response = responseFor(input, eventId);
-      const collectionRevision =
-        (
-          await advancePostgresCollectionRevisionInTransaction(client, input.connectorInstanceId, {
-            at: occurredAt,
-            event: "terminal_run",
-            runId: input.runId,
-          })
-        )?.revision ?? null;
+      // Required: a terminal run without its revision rolls back whole.
+      const collectionRevision = await requirePostgresCollectionRevisionInTransaction(
+        client,
+        input.connectorInstanceId,
+        { at: occurredAt, event: "terminal_run", runId: input.runId }
+      );
       await putPostgresConnectorStateDeltaInTransaction(
         client,
         { connectorId: input.connectorId, connectorInstanceId: input.connectorInstanceId },
@@ -314,43 +310,115 @@ export async function commitTerminalRun(input: ResolvedTerminalRunCommit): Promi
   return isPostgresStorageBackend() ? await commitPostgres(input) : commitSqlite(input);
 }
 
+/** JSON with sorted keys and without undefined members, as stored JSON reads back. */
+function canonicalJson(value: unknown): string {
+  return JSON.stringify(value, (_key, member: unknown) =>
+    member && typeof member === "object" && !Array.isArray(member)
+      ? Object.fromEntries(
+          Object.keys(member)
+            .sort()
+            .map((key) => [key, (member as Record<string, unknown>)[key]])
+        )
+      : member
+  );
+}
+
+/**
+ * What identifies a legacy report: the connection and the facts it reported.
+ * The spine adds its own fields to stored data (`source`), so a retry is
+ * compared on these alone.
+ */
+function legacyReportIdentity(data: unknown): string | null {
+  let parsed: unknown = data;
+  if (typeof data === "string") {
+    try {
+      parsed = JSON.parse(data) as unknown;
+    } catch {
+      return null;
+    }
+  }
+  const record = asRecord(parsed);
+  return record
+    ? canonicalJson({
+        collection_facts: record.collection_facts,
+        connector_instance_id: record.connector_instance_id,
+      })
+    : null;
+}
+
 /**
  * Commit a legacy split `terminal-collection` report. It is an observed
  * collection event of its own (`legacy_terminal`): its run record takes the
  * next revision in the same transaction, so a report that arrives after a
- * newer proof retires that proof instead of copying its revision. The event
- * is built from the allocated revision. It is never a v2 proof.
+ * newer proof retires that proof instead of copying its revision. It is never
+ * a v2 proof.
+ *
+ * The event id is the run's, so a retried report finds the stored one under
+ * the same lock, before any revision is allocated. An identical retry is a
+ * replay: it allocates no revision and so retires nothing. A different report
+ * for the same run is a conflict. Neither writes anything.
  */
 export async function commitLegacyTerminalCollection(input: {
-  readonly buildEvent: (collectionRevision: number) => SpineEventInput & PostgresSpineEventInput;
   readonly connectorInstanceId: string;
+  /** The run event, without `data.collection_revision`; the store adds the allocated revision. */
+  readonly event: SpineEventInput &
+    PostgresSpineEventInput & { readonly data: Readonly<Record<string, unknown>>; readonly event_id: string };
   readonly runId: string;
-}): Promise<void> {
+}): Promise<{ readonly replayed: boolean }> {
   const revisionEvent = {
     at: new Date().toISOString(),
     event: "legacy_terminal",
     runId: input.runId,
   } as const;
+  const report = legacyReportIdentity(input.event.data);
+  const withRevision = (collectionRevision: number) => ({
+    ...input.event,
+    data: { ...input.event.data, collection_revision: collectionRevision },
+  });
+  const replayed = (existing: { data_json: unknown } | undefined): boolean => {
+    if (!existing) {
+      return false;
+    }
+    if (report === null || legacyReportIdentity(existing.data_json) !== report) {
+      throw new TerminalRunCommitConflictError();
+    }
+    return true;
+  };
   if (isPostgresStorageBackend()) {
-    await withPostgresTransaction(
+    return await withPostgresTransaction(
       async (client) => {
+        const existing = await client.query<{ data_json: unknown }>(
+          "SELECT data_json FROM spine_events WHERE event_id = $1",
+          [input.event.event_id]
+        );
+        if (replayed(existing.rows[0])) {
+          return { replayed: true };
+        }
         const revision = await requirePostgresCollectionRevisionInTransaction(
           client,
           input.connectorInstanceId,
           revisionEvent
         );
-        await appendPostgresSpineEventInTransaction(client, input.buildEvent(revision));
+        await appendPostgresSpineEventInTransaction(client, withRevision(revision));
+        return { replayed: false };
       },
       { lockConnectorInstanceId: input.connectorInstanceId }
     );
-    return;
   }
   const db = getDb();
   db.exec("BEGIN IMMEDIATE");
   try {
+    const existing = db.prepare("SELECT data_json FROM spine_events WHERE event_id = ?").get(input.event.event_id) as
+      | { data_json: unknown }
+      | undefined;
+    if (replayed(existing)) {
+      db.exec("COMMIT");
+      return { replayed: true };
+    }
     const revision = requireSqliteCollectionRevisionInTransaction(db, input.connectorInstanceId, revisionEvent);
-    appendSqliteSpineEventInTransaction(input.buildEvent(revision), db as unknown as SpineDatabase);
+    appendSqliteSpineEventInTransaction(withRevision(revision), db as unknown as SpineDatabase);
     db.exec("COMMIT");
+    return { replayed: false };
   } catch (error) {
     rollbackSqlite(db);
     throw error;
diff --git a/reference-implementation/test/cadence-lateness-cross-surface.test.ts b/reference-implementation/test/cadence-lateness-cross-surface.test.ts
index c10afab31..b213c713c 100644
--- a/reference-implementation/test/cadence-lateness-cross-surface.test.ts
+++ b/reference-implementation/test/cadence-lateness-cross-surface.test.ts
@@ -110,7 +110,7 @@ function fleetFor(snapshot: ConnectionHealthSnapshot, connectionId: string) {
     streamHealth: { status: "pass" },
     summaries: [
       {
-        connection_health: snapshot,
+        connection_health: { ...snapshot, coverage_as_of: null },
         connection_id: connectionId,
         connector_id: "test-connector",
         connector_instance_id: connectionId,
diff --git a/reference-implementation/test/device-exporter-routes.test.ts b/reference-implementation/test/device-exporter-routes.test.ts
index f13318926..e1c408e1a 100644
--- a/reference-implementation/test/device-exporter-routes.test.ts
+++ b/reference-implementation/test/device-exporter-routes.test.ts
@@ -2847,7 +2847,10 @@ test("device-exporter diagnostics scope heartbeat, ingest, and local-collector g
     assert.ok(firstSource.local_collector_coverage);
     assert.equal(firstSource.local_collector_coverage.observed, true);
     assert.equal(firstSource.local_collector_coverage.store_count, 3);
-    assert.equal(firstSource.local_collector_coverage.fully_accounted, true);
+    // Raw coverage records are historical inventory: with no v2 terminal
+    // proof behind them, the owner projection has no current positive.
+    assert.equal(firstSource.local_collector_coverage.fully_accounted, false);
+    assert.equal(firstSource.local_collector_coverage.coverage_as_of, null);
     assert.deepEqual(firstSource.local_collector_coverage.unaccounted_stores, []);
     assert.equal(firstSource.local_collector_coverage.counts_by_status.collected, 1);
     assert.equal(firstSource.local_collector_coverage.counts_by_status.excluded, 1);
@@ -3088,6 +3091,7 @@ interface DiagnosticsSourceInstance extends Row {
   last_ingest_at: string | null;
   local_binding_name: string;
   local_collector_coverage: {
+    coverage_as_of: Record<string, unknown> | null;
     observed: boolean;
     store_count: number;
     fully_accounted: boolean;
diff --git a/reference-implementation/test/health-authority-cross-surface.test.ts b/reference-implementation/test/health-authority-cross-surface.test.ts
index 831b357c6..b75c32b1a 100644
--- a/reference-implementation/test/health-authority-cross-surface.test.ts
+++ b/reference-implementation/test/health-authority-cross-surface.test.ts
@@ -92,7 +92,7 @@ function fleetSummary(
   ownerState: OwnerState
 ): FleetSummary {
   return {
-    connection_health: snapshot,
+    connection_health: { ...snapshot, coverage_as_of: null },
     connection_id: id,
     connector_id: "test-connector",
     connector_instance_id: id,
diff --git a/reference-implementation/test/local-device-coverage-revision-atomicity.test.ts b/reference-implementation/test/local-device-coverage-revision-atomicity.test.ts
index 4798bebe8..1ed36c8ab 100644
--- a/reference-implementation/test/local-device-coverage-revision-atomicity.test.ts
+++ b/reference-implementation/test/local-device-coverage-revision-atomicity.test.ts
@@ -27,11 +27,17 @@ import { reconcileDirtyConnectorSummaryEvidence } from "../server/connector-summ
 import { closeDb, getDb, initDb } from "../server/db.ts";
 import { fingerprintDeviceAttemptManifest } from "../server/device-ingest-attempt-context.ts";
 import { startServer } from "../server/index.ts";
+import { buildStoredCollectionScope, COLLECTION_SCOPE_STATE_KEY } from "../server/local-collection-scope.ts";
 import { __setLocalCollectorReleaseForTest } from "../server/local-collector-profiles.ts";
+import { __setPostgresAdmissionLockedPhaseHookForTest } from "../server/postgres-records.ts";
 import { bootstrapPostgresSchema, closePostgresStorage, postgresQuery } from "../server/postgres-storage.ts";
-import { readCommittedLocalCoverageDiagnostics } from "../server/records.ts";
+import { putSyncState, readCommittedLocalCoverageDiagnostics } from "../server/records.ts";
 import { getConnectorDetail, getOwnerConnectionDiagnostics, listConnectorSummaries } from "../server/ref-control.ts";
 import { __setDeviceIngestPhaseFaultHookForTest } from "../server/routes/ref-device-exporters.ts";
+import {
+  __setLocalCoverageFenceReadHookForTest,
+  isCollectionRevisionUnavailable,
+} from "../server/stores/collection-revision-store.ts";
 import { getDefaultDeviceExporterStore } from "../server/stores/device-exporter-store.ts";
 import { commitTerminalRun } from "../server/stores/terminal-run-commit-store.ts";
 import { closeTestServer } from "./helpers/close-test-server.ts";
@@ -345,6 +351,18 @@ function postFailureReport(lane: Lane, runId: string): Promise<JsonResponse> {
 
 /** A v2 terminal proof for both streams, bound to the server's release. Returns the commit so a test can replay it. */
 async function commitProof(lane: Lane, runId: string): Promise<TerminalCommit> {
+  const commit = await buildProof(lane, runId);
+  const result = await commitTerminalRun(commit);
+  assert.equal(result.replayed, false, `run ${runId} commits a new terminal proof`);
+  return commit;
+}
+
+/** The v2 terminal commit `commitProof` sends, not yet committed. */
+async function buildProof(
+  lane: Lane,
+  runId: string,
+  stateDelta: TerminalCommit["stateDelta"] = {}
+): Promise<TerminalCommit> {
   const { connector_instance_id: connectorInstanceId, device_id: deviceId } = lane.enrolled;
   const sourceInstanceId = lane.enrolled.source_instance_id;
   await getDefaultDeviceExporterStore().markSourceInstanceHeartbeat(deviceId, sourceInstanceId, {
@@ -402,11 +420,9 @@ async function commitProof(lane: Lane, runId: string): Promise<TerminalCommit> {
     normalizedFacts: [stream("sessions", "projects"), stream("messages", "derived_messages")],
     runId,
     sourceInstanceId,
-    stateDelta: {},
+    stateDelta,
     version: 2,
   };
-  const result = await commitTerminalRun(commit);
-  assert.equal(result.replayed, false, `run ${runId} commits a new terminal proof`);
   return commit;
 }
 
@@ -472,14 +488,20 @@ async function openGapCount(lane: Lane): Promise<number> {
   return Number(row?.n ?? 0);
 }
 
-/** Make every write that advances a collection revision fail, as a storage fault would. */
-async function failRevisionWrites(lane: Lane): Promise<() => Promise<void>> {
+/**
+ * Make every write that advances a collection revision fail, as a storage
+ * fault would. With `event`, only the advance for that event kind fails, so
+ * a test can fail one step of a multi-step request after earlier steps
+ * committed.
+ */
+async function failRevisionWrites(lane: Lane, event?: string): Promise<() => Promise<void>> {
+  const only = (column: string) => (event ? ` AND ${column} = '${event}'` : "");
   if (lane.backend === "postgres") {
     await postgresQuery(`CREATE FUNCTION pdpp_test_fail_collection_revision() RETURNS trigger
       LANGUAGE plpgsql AS $$ BEGIN RAISE EXCEPTION 'injected collection revision failure'; END $$`);
     await postgresQuery(`CREATE TRIGGER pdpp_test_fail_collection_revision
       BEFORE UPDATE OF collection_revision ON connector_instances FOR EACH ROW
-      WHEN (NEW.collection_revision IS DISTINCT FROM OLD.collection_revision)
+      WHEN (NEW.collection_revision IS DISTINCT FROM OLD.collection_revision${only("NEW.collection_revision_event")})
       EXECUTE FUNCTION pdpp_test_fail_collection_revision()`);
     return async () => {
       await postgresQuery("DROP TRIGGER pdpp_test_fail_collection_revision ON connector_instances");
@@ -488,7 +510,7 @@ async function failRevisionWrites(lane: Lane): Promise<() => Promise<void>> {
   }
   getDb().exec(`CREATE TRIGGER pdpp_test_fail_collection_revision
     BEFORE UPDATE OF collection_revision ON connector_instances
-    WHEN NEW.collection_revision IS NOT OLD.collection_revision
+    WHEN NEW.collection_revision IS NOT OLD.collection_revision${only("NEW.collection_revision_event")}
     BEGIN SELECT RAISE(ABORT, 'injected collection revision failure'); END`);
   return () => {
     getDb().exec("DROP TRIGGER pdpp_test_fail_collection_revision");
@@ -756,6 +778,424 @@ laneTest("every projection that shows complete coverage carries its as-of", asyn
   assert.ok(diagnostics, "diagnostics resolve the connection");
   assert.equal(diagnostics.health.axes.coverage, "complete", "diagnostics health");
   assert.deepEqual(pick((diagnostics as unknown as Record<string, unknown>).coverage_as_of), expected, "diagnostics");
+
+  // A health object read on its own still names what its coverage is a fact about.
+  const detailHealth = detailRecord.connection_health as Record<string, unknown>;
+  const healthAsOf = (health: unknown) => (health as Record<string, unknown> | undefined)?.coverage_as_of;
+  assert.deepEqual(
+    {
+      detailHealth: healthAsOf(detailHealth),
+      diagnosticsHealth: healthAsOf(diagnostics.health),
+      summaryHealth: healthAsOf(summary?.connection_health),
+    },
+    {
+      detailHealth: detailRecord.coverage_as_of,
+      diagnosticsHealth: diagnostics.coverage_as_of,
+      summaryHealth: summary?.coverage_as_of,
+    },
+    "every embedded health carries its projection's as-of"
+  );
+  assert.deepEqual(diagnostics.health.coverage_as_of, summary?.coverage_as_of, "one as-of across the projections");
+});
+
+// ---------------------------------------------------------------------------
+// Round 3: required terminal allocation, guarded advance, legacy replay,
+// device diagnostics, boundary snapshot, selective failures and lock order.
+// ---------------------------------------------------------------------------
+
+async function rawRevision(lane: Lane): Promise<string> {
+  const [row] = await sql(
+    lane,
+    "SELECT CAST(collection_revision AS TEXT) AS revision FROM connector_instances WHERE connector_instance_id = ?",
+    "SELECT collection_revision::text AS revision FROM connector_instances WHERE connector_instance_id = $1",
+    [lane.enrolled.connector_instance_id]
+  );
+  return String(row?.revision);
+}
+
+/** Store a revision value as a storage fault or a hand edit could leave it. */
+async function storeRevision(lane: Lane, value: unknown): Promise<void> {
+  await sql(
+    lane,
+    "UPDATE connector_instances SET collection_revision = ? WHERE connector_instance_id = ?",
+    "UPDATE connector_instances SET collection_revision = $1::bigint WHERE connector_instance_id = $2",
+    [value, lane.enrolled.connector_instance_id]
+  );
+}
+
+async function runRows(lane: Lane, runId: string): Promise<{ readonly events: number; readonly runs: number }> {
+  const [runs] = await sql(
+    lane,
+    "SELECT COUNT(*) AS n FROM run_history WHERE run_id = ?",
+    "SELECT COUNT(*)::integer AS n FROM run_history WHERE run_id = $1",
+    [runId]
+  );
+  const [events] = await sql(
+    lane,
+    "SELECT COUNT(*) AS n FROM spine_events WHERE run_id = ?",
+    "SELECT COUNT(*)::integer AS n FROM spine_events WHERE run_id = $1",
+    [runId]
+  );
+  return { events: Number(events?.n ?? 0), runs: Number(runs?.n ?? 0) };
+}
+
+/** The stored `sessions` cursor, or null when no state row exists. */
+async function sessionsCursor(lane: Lane): Promise<unknown> {
+  const [row] = await sql(
+    lane,
+    "SELECT state_json FROM connector_state WHERE connector_instance_id = ? AND stream = 'sessions'",
+    "SELECT state_json::text AS state_json FROM connector_state WHERE connector_instance_id = $1 AND stream = 'sessions'",
+    [lane.enrolled.connector_instance_id]
+  );
+  return row ? (JSON.parse(String(row.state_json)) as { cursor?: unknown }).cursor : null;
+}
+
+function putDeviceState(lane: Lane, cursor: string): Promise<JsonResponse> {
+  return requestJson(sourceUrl(lane, "/state"), {
+    body: JSON.stringify({ state: { sessions: { cursor } } }),
+    headers: { "Content-Type": "application/json", ...authHeaders(lane) },
+    method: "PUT",
+  });
+}
+
+async function terminalOutcome(commit: TerminalCommit): Promise<string> {
+  try {
+    await commitTerminalRun(commit);
+    return "committed";
+  } catch (error) {
+    return isCollectionRevisionUnavailable(error) ? "revision_unavailable" : String(error);
+  }
+}
+
+laneTest("no event commits against a stored revision that is unreadable or cannot advance", async (lane) => {
+  await commitProof(lane, "run-a");
+  // Both schemas accept a negative revision; SQLite's INTEGER affinity also keeps text and reals.
+  const stored: ReadonlyArray<readonly [string, unknown]> = [
+    ["negative", -1],
+    ...(lane.backend === "sqlite"
+      ? ([
+          ["text", "abc"],
+          ["real", 1.5],
+        ] as const)
+      : []),
+    ["exhausted", Number.MAX_SAFE_INTEGER],
+  ];
+  const outcomes: Record<string, unknown>[] = [];
+  for (const [label, value] of stored) {
+    await storeRevision(lane, value);
+    const before = await rawRevision(lane);
+    const runId = `run-${label}`;
+    const terminal = await terminalOutcome(await buildProof(lane, runId, { sessions: { cursor: label } }));
+    const state = await putDeviceState(lane, `state-${label}`);
+    outcomes.push({
+      label,
+      revisionUnchanged: (await rawRevision(lane)) === before,
+      run: await runRows(lane, runId),
+      sessionsCursor: await sessionsCursor(lane),
+      state: state.status >= 500 ? "refused" : state.status,
+      terminal,
+    });
+  }
+  assert.deepEqual(
+    outcomes,
+    stored.map(([label]) => ({
+      label,
+      revisionUnchanged: true,
+      run: { events: 0, runs: 0 },
+      sessionsCursor: null,
+      state: "refused",
+      terminal: "revision_unavailable",
+    }))
+  );
+});
+
+laneTest("a terminal commit whose revision write fails rolls back whole and keeps the prior proof", async (lane) => {
+  await commitProof(lane, "run-a");
+  const before = await highWater(lane);
+  const restore = await failRevisionWrites(lane, "terminal_run");
+  try {
+    const outcome = await commitTerminalRun(await buildProof(lane, "run-b", { sessions: { cursor: "b" } })).then(
+      () => "committed",
+      (error: unknown) => String((error as Error).message)
+    );
+    assert.match(outcome, /injected collection revision failure/);
+    // The trigger fails only the terminal advance: a state commit still records its own revision.
+  } finally {
+    await restore();
+  }
+  assert.deepEqual(await highWater(lane), before, "no revision was allocated");
+  assert.deepEqual(await runRows(lane, "run-b"), { events: 0, runs: 0 }, "no run event or run record");
+  assert.equal(await sessionsCursor(lane), null, "no state row from the rolled-back commit");
+  await assertCovered(lane, "run-a", "run A's proof is still the newest event");
+});
+
+laneTest(
+  "a retried legacy split terminal report neither advances the revision nor retires a newer proof",
+  async (lane) => {
+    const report = (statuses: string[]) =>
+      postJson(
+        sourceUrl(lane, "/terminal-collection"),
+        {
+          connector_id: CONNECTOR_ID,
+          run_id: "run-a",
+          source_instance_id: lane.enrolled.source_instance_id,
+          streams: [
+            { coverage_statuses: statuses, stream: "sessions" },
+            { coverage_statuses: ["collected"], stream: "messages" },
+          ],
+        },
+        authHeaders(lane)
+      );
+    const first = await report(["collected"]);
+    assert.equal(first.status, 201, JSON.stringify(first.body));
+    await commitProof(lane, "run-b");
+    await assertCovered(lane, "run-b", "run B's proof follows run A's report");
+    const proof = await highWater(lane);
+
+    const retried = await report(["collected"]);
+    const afterRetry = { highWater: await highWater(lane), run: await runRows(lane, "run-a") };
+    const conflicting = await report(["partial"]);
+    const afterConflict = { highWater: await highWater(lane), run: await runRows(lane, "run-a") };
+    assert.deepEqual(afterRetry, { highWater: proof, run: { events: 1, runs: 1 } }, "the retry is not a new event");
+    assert.deepEqual(afterConflict, afterRetry, "a conflicting report for the run writes nothing");
+    await assertCovered(lane, "run-b", "run B's proof is still current");
+    assert.deepEqual(
+      [
+        [retried.status, retried.body],
+        [conflicting.status, (conflicting.body?.error as Record<string, unknown> | undefined)?.code],
+      ],
+      [
+        [200, { ok: true }],
+        [409, "terminal_collection_conflict"],
+      ],
+      "an identical retry is acknowledged; a different report for the run is a conflict"
+    );
+  }
+);
+
+/** Raw `coverage_diagnostics` records, as an old collector left them: no run, release or revision behind them. */
+async function seedRawCoverageRows(lane: Lane): Promise<void> {
+  for (const [store, stream] of [
+    ["projects", "sessions"],
+    ["derived_messages", "messages"],
+  ] as const) {
+    const json = JSON.stringify({ id: `coverage:${store}`, status: "collected", store, stream });
+    await sql(
+      lane,
+      `INSERT INTO records(connector_id, connector_instance_id, stream, record_key, record_json, emitted_at, version, deleted)
+       VALUES (?, ?, 'coverage_diagnostics', ?, ?, ?, 1, 0)`,
+      `INSERT INTO records(connector_id, connector_instance_id, stream, record_key, record_json, emitted_at, version, deleted,
+                           primary_key_text)
+       VALUES ($1, $2, 'coverage_diagnostics', $3, $4::jsonb, $5, 1, FALSE, $3)`,
+      [CONNECTOR_ID, lane.enrolled.connector_instance_id, `coverage:${store}`, json, EMITTED_AT]
+    );
+  }
+}
+
+async function deviceCoverage(lane: Lane, cookie: string): Promise<Record<string, unknown>> {
+  const diagnostics = await requestJson(`${lane.asUrl}/_ref/device-exporters/diagnostics`, {
+    headers: { Cookie: cookie },
+  });
+  assert.equal(diagnostics.status, 200, JSON.stringify(diagnostics.body));
+  const devices = (diagnostics.body?.data ?? []) as Array<{ source_instances: Array<Record<string, unknown>> }>;
+  const source = devices
+    .flatMap((device) => device.source_instances)
+    .find((row) => row.source_instance_id === lane.enrolled.source_instance_id);
+  assert.ok(source, "the lane's source instance is listed");
+  return source.local_collector_coverage as Record<string, unknown>;
+}
+
+laneTest("device diagnostics show no coverage positive the owner projection has retired", async (lane) => {
+  const cookie = await ownerSessionCookie(lane.asUrl);
+  await seedRawCoverageRows(lane);
+  await commitProof(lane, "run-a");
+  await assertCovered(lane, "run-a", "run A's proof is current");
+  const current = await deviceCoverage(lane, cookie);
+
+  const refused = await postBatch(lane, {
+    ...batchBody(lane, "batch-refused", sessionRecords("s-1")),
+    body_hash: "0".repeat(64),
+  });
+  assert.equal(refused.status, 400, JSON.stringify(refused.body));
+  await assertRetired(lane, "the refused batch retires run A's proof");
+  const retired = await deviceCoverage(lane, cookie);
+
+  const view = (coverage: Record<string, unknown>) => ({
+    asOfRun: (coverage.coverage_as_of as Record<string, unknown> | null | undefined)?.run_id ?? null,
+    fullyAccounted: coverage.fully_accounted,
+    inventory: coverage.by_store,
+  });
+  const inventory = { derived_messages: "collected", projects: "collected" };
+  assert.deepEqual(
+    [view(current), view(retired)],
+    [
+      { asOfRun: "run-a", fullyAccounted: true, inventory },
+      { asOfRun: null, fullyAccounted: false, inventory },
+    ],
+    "the positive follows the owner projection; the raw inventory stays as history"
+  );
+});
+
+/**
+ * Change the boundary between the projection's own boundary reads and its
+ * fence read: a proof commits against the boundary the projection already
+ * read, then the boundary changes. Runs once.
+ */
+function changeBoundaryMidProjection(lane: Lane, change: () => Promise<void>): { readonly fired: () => boolean } {
+  let fired = false;
+  __setLocalCoverageFenceReadHookForTest(async (ids) => {
+    if (fired || !ids.includes(lane.enrolled.connector_instance_id)) {
+      return;
+    }
+    fired = true;
+    __setLocalCoverageFenceReadHookForTest(null);
+    await commitProof(lane, "run-b");
+    await change();
+  });
+  return { fired: () => fired };
+}
+
+laneTest("a scope change between the projection's reads composes no positive from two moments", async (lane) => {
+  await commitProof(lane, "run-a");
+  await assertCovered(lane, "run-a", "run A's proof is current");
+  const hook = changeBoundaryMidProjection(lane, async () => {
+    await putSyncState(
+      { connector_id: CONNECTOR_ID, connector_instance_id: lane.enrolled.connector_instance_id },
+      { [COLLECTION_SCOPE_STATE_KEY]: buildStoredCollectionScope(null, new Date().toISOString()) }
+    );
+  });
+  try {
+    const during = await projection(lane);
+    assert.ok(hook.fired(), "the boundary changed mid-projection");
+    assert.deepEqual(during, { asOf: null, axis: "unknown" }, "run B's proof measured the scope that was replaced");
+  } finally {
+    __setLocalCoverageFenceReadHookForTest(null);
+  }
+  await assertRetired(lane, "run B's proof does not measure the current scope");
+});
+
+laneTest("a manifest change between the projection's reads composes no positive from two moments", async (lane) => {
+  await commitProof(lane, "run-a");
+  await assertCovered(lane, "run-a", "run A's proof is current");
+  const hook = changeBoundaryMidProjection(lane, () => registerFixtureManifest(lane));
+  try {
+    const during = await projection(lane);
+    assert.ok(hook.fired(), "the manifest generation changed mid-projection");
+    assert.deepEqual(during, { asOf: null, axis: "unknown" }, "run B's proof is bound to the replaced generation");
+  } finally {
+    __setLocalCoverageFenceReadHookForTest(null);
+  }
+  await assertRetired(lane, "run B's proof is bound to the replaced generation");
+});
+
+laneTest("a batch whose acceptance cannot be recorded keeps its records and retries to acceptance", async (lane) => {
+  await commitProof(lane, "run-a");
+  const batch = batchBody(lane, "batch-acceptance-fails", sessionRecords("s-1", "s-2"));
+  const restore = await failRevisionWrites(lane, "batch_accepted");
+  let failed: JsonResponse;
+  try {
+    failed = await postBatch(lane, batch);
+  } finally {
+    await restore();
+  }
+  assert.equal(failed.status, 503, JSON.stringify(failed.body));
+  assert.equal(await sessionRecordCount(lane), 2, "each record committed with its own revision");
+  // The acceptance and its revision rolled back together. The retryable 503
+  // for an attempt the server received is itself an observed refusal.
+  assert.equal((await highWater(lane)).event, "batch_rejected", "no batch_accepted revision committed");
+  await assertRetired(lane, "the durable records retire run A's proof");
+
+  const retried = await postBatch(lane, batch);
+  assert.equal(retried.status, 201, JSON.stringify(retried.body));
+  assert.equal(await sessionRecordCount(lane), 2);
+  assert.equal((await highWater(lane)).event, "batch_accepted");
+  await assertRetired(lane, "the accepted batch is still later than run A's proof");
+});
+
+laneTest("a state commit whose revision write fails writes no state and keeps the prior proof", async (lane) => {
+  await commitProof(lane, "run-a");
+  const before = await highWater(lane);
+  const restore = await failRevisionWrites(lane, "state_commit");
+  let failed: JsonResponse;
+  try {
+    failed = await putDeviceState(lane, "unrecorded");
+  } finally {
+    await restore();
+  }
+  assert.ok(
+    failed.status >= 500,
+    `the state commit is not acknowledged: ${failed.status} ${JSON.stringify(failed.body)}`
+  );
+  assert.equal(await sessionsCursor(lane), null, "no state without its revision");
+  assert.deepEqual(await highWater(lane), before);
+  await assertCovered(lane, "run-a", "nothing was recorded after run A");
+
+  const committed = await putDeviceState(lane, "recorded");
+  assert.equal(committed.status, 200, JSON.stringify(committed.body));
+  assert.equal(await sessionsCursor(lane), "recorded");
+  assert.equal((await highWater(lane)).event, "state_commit");
+  await assertRetired(lane, "the state commit retires run A's proof");
+});
+
+// Bounded by the test timeout: a hang fails the test, and PostgreSQL reports a
+// deadlock between the two transactions as an error (40P01) to one of them.
+test("a record transaction and a terminal commit for one connection serialize without deadlock [real PostgreSQL]", {
+  skip: POSTGRES_SKIP,
+  timeout: 30_000,
+}, async () => {
+  await withLane("postgres", async (lane) => {
+    await commitProof(lane, "run-a");
+    const before = await highWater(lane);
+    const held = gate();
+    const release = gate();
+    let paused = false;
+    __setPostgresAdmissionLockedPhaseHookForTest(async (point: string, context: Record<string, unknown>) => {
+      if (paused || point !== "after-connector-instance-admission-lock") {
+        return;
+      }
+      if (context.connectorInstanceId !== lane.enrolled.connector_instance_id) {
+        return;
+      }
+      paused = true;
+      held.open();
+      await release.wait;
+    });
+    try {
+      const batch = postBatch(lane, batchBody(lane, "batch-holds-lock", sessionRecords("s-1")));
+      await held.wait;
+      const proof = await buildProof(lane, "run-b");
+      const terminal = commitTerminalRun(proof);
+      // The terminal commit must wait for the record transaction, not slip past it.
+      let waiting = 0;
+      for (let attempt = 0; attempt < 100 && waiting === 0; attempt += 1) {
+        const [row] = await sql(
+          lane,
+          "",
+          "SELECT COUNT(*)::integer AS n FROM pg_locks WHERE NOT granted AND database = (SELECT oid FROM pg_database WHERE datname = current_database())"
+        );
+        waiting = Number(row?.n ?? 0);
+        if (waiting === 0) {
+          await new Promise((resolve) => setTimeout(resolve, 50));
+        }
+      }
+      assert.ok(waiting > 0, "the terminal commit blocks on the lock the record transaction holds");
+      release.open();
+      const [accepted, committed] = await Promise.all([batch, terminal]);
+      assert.equal(accepted.status, 201, JSON.stringify(accepted.body));
+      assert.equal(committed.replayed, false);
+    } finally {
+      release.open();
+      __setPostgresAdmissionLockedPhaseHookForTest(null);
+    }
+    const [run] = await sql(lane, "", "SELECT facts_json::text AS facts_json FROM run_history WHERE run_id = $1", [
+      "run-b",
+    ]);
+    const proofRevision = (JSON.parse(String(run?.facts_json)) as { collection_revision: number }).collection_revision;
+    assert.ok(
+      proofRevision > before.revision + 1,
+      `run B's revision ${proofRevision} follows the record's revision ${before.revision + 1}`
+    );
+  });
 });
 
 // ---------------------------------------------------------------------------

From 29f4dd98137079420ec416515be7dc673f2a212e Mon Sep 17 00:00:00 2001
From: Tim Nunamaker <tnunamak@gmail.com>
Date: Thu, 22 Oct 2026 10:10:06 -0500
Subject: [PATCH 42/87] docs(coverage): record revision guard, legacy replay
 and boundary snapshot

Assisted-by: AI
Signed-off-by: Tim Nunamaker <tnunamak@gmail.com>
---
 docs/261021-local-device-coverage-evidence.md | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/docs/261021-local-device-coverage-evidence.md b/docs/261021-local-device-coverage-evidence.md
index 9d3a3da65..3cbccdca4 100644
--- a/docs/261021-local-device-coverage-evidence.md
+++ b/docs/261021-local-device-coverage-evidence.md
@@ -70,13 +70,15 @@ Atomicity. No event commits without its revision, and no revision is allocated i
 
 - SQLite. Each event runs in one `BEGIN IMMEDIATE` transaction (the record write, `completeProcessingBatch`, the gap upsert, the terminal commits). The revision `UPDATE ... RETURNING` runs inside it. The write lock serializes events per database, so revisions follow commit order.
 - Postgres. Each event runs in one `withPostgresTransaction` and locks the `connector_instances` row before the batch outcome or gap row. `completeProcessingBatch` and the gap upsert take the lock with the revision `UPDATE` as their first statement. A device record transaction already holds it from its admission check (`FOR UPDATE`). Terminal commits take the connector-instance advisory lock, then the row. Concurrent events for a connection therefore serialize on the row, and revisions follow commit order.
-- Failure. If the revision cannot be recorded (no connection row, or a storage error), the store throws and the event rolls back. A device record or acceptance is not stored, a failure report stores no gap, and a terminal report stores no run. A refusal whose revision cannot be recorded is answered `503 device_ingest_retryable`, not with the refusal, so the device retries rather than trusting an answer the server cannot order. No catch turns an unrecorded revision into success.
+- Failure. If the revision cannot be recorded (no connection row, an unreadable stored revision, or a storage error), the store throws and the event rolls back. A device record or acceptance is not stored, a failure report stores no gap, a terminal commit (v2, v1 or legacy split) stores no run, event or state, and a state commit stores no state. A refusal whose revision cannot be recorded is answered `503 device_ingest_retryable`, not with the refusal, so the device retries rather than trusting an answer the server cannot order. No catch turns an unrecorded revision into success. The one write without a revision is a state commit for a connector-keyed legacy caller whose connection row does not exist yet; it has no projection to retire.
+- Stored value. The schema does not keep the revision readable: both backends accept a negative value, and SQLite's INTEGER affinity also keeps text and reals. The advance `UPDATE` therefore matches only a stored non-negative integer whose successor is still a safe integer (SQLite also checks `typeof(...) = 'integer'`). Any other stored value matches no row and the event throws, so the server never increments a value it cannot order by.
+- Replay. A legacy split report's event id is its run's. The commit reads the stored event under the same lock before it allocates. An identical retry (same connection and facts) is answered `200 {ok: true}` with no revision, so it retires nothing; a different report for the same run is `409 terminal_collection_conflict` and writes nothing. A replayed v2 terminal response also allocates no revision.
 
 Each durable batch record takes its own revision, so a crash after any record commits, before the acceptance, leaves the earlier proof retired. A terminal commit that lands between two records of a batch is retired by the next record.
 
 Storage. `connector_instances` holds the high-water mark: `collection_revision` (0 before any event), `collection_revision_event`, `collection_revision_run_id`, and `collection_revision_at` (wall-clock, display only). `connector_state.collection_revision` records the revision of the commit that last wrote each row; the projection no longer reads it. The terminal run event, and so `run_history.facts_json`, carries `collection_revision`, for v2, v1 and legacy split reports. SQLite adds the columns with `addColumnIfMissing`; Postgres uses `ALTER TABLE ... ADD COLUMN IF NOT EXISTS`. Rows that predate the migration read 0 or NULL and fail closed until the next event.
 
-Proof binding. A proof is a v2 terminal run record at revision R; its own state rows carry R. The projection reads the high-water mark and the run it names in one joined query, so the proof payload and its fence come from one snapshot. A legacy `coverage_diagnostics` state row is never a proof: it names no run and no release digest, so it cannot back "complete as of" anything, and the projection shows unknown for it (PR #553 retires the legacy path).
+Proof binding. A proof is a v2 terminal run record at revision R; its own state rows carry R. The projection reads the high-water mark, the run it names, the declared scope, the manifest generation and (for a terminal-run high-water mark) the connector manifest in one statement, so the proof payload, its fence and the boundary it is judged against come from one snapshot. The rest of the projection reads the scope, the generation and the manifest separately. A positive needs all three to equal the snapshot's; a scope or manifest change that lands between the reads makes the coverage unknown rather than a positive composed from two moments. A legacy `coverage_diagnostics` state row is never a proof: it names no run and no release digest, so it cannot back "complete as of" anything, and the projection shows unknown for it (PR #553 retires the legacy path).
 
 Retirement. A proof is current only when its revision equals the connection's high-water revision, the high-water event is `terminal_run`, and its run id is the proof run. The server reads the proof run by that run id, not by the newest `completed_at`. Any later observable event raises the high-water revision and retires the proof to unknown. A legacy split report is its own `legacy_terminal` event, so one delayed past a newer proof retires that proof. No wall clock takes part.
 
@@ -84,6 +86,8 @@ Fail closed. Coverage is unknown when the high-water row or the proof revision i
 
 Terminal record for every successful run. A runtime that implements this profile version commits a terminal run record for every run whose DONE succeeded, even when coverage was not negotiated and no STATE changed. Without coverage evidence it sends a version 2 commit with empty `terminal_facts`, carrying the run's STATE delta. The server stores unknown inventory for it, and the device clears its receipt (`no_evidence`). A server that names no connection on its state read cannot bind a terminal record, so against such a server the runtime keeps the plain state checkpoint.
 
-As-of. Every owner projection that can show positive local coverage carries `coverage_as_of`: run id, release digest, collection revision, and commit time. That is the connector summary (list), the connector detail, the owner connection diagnostics (`health.axes` and `rendered_verdict`), and the connection health embedded in each. All of them read the same summary projection. Owner UI copy reads "complete as of <time>".
+As-of. Every owner projection that can show positive local coverage carries `coverage_as_of`: run id, release digest, collection revision, and commit time. That is the connector summary (list), the connector detail, the owner connection diagnostics (`health.axes` and `rendered_verdict`), and the connection health embedded in each (`connection_health.coverage_as_of`, `health.coverage_as_of`), which equals the top-level value. All of them read the same summary projection. Owner UI copy reads "complete as of <time>". The published `@pdpp/reference-contract` diagnostics schema does not list `coverage_as_of` yet and sets `additionalProperties: false`; the contract needs a release that adds it.
+
+Device diagnostics. `local_collector_coverage` in the device-exporter diagnostics takes `fully_accounted` and `coverage_as_of` from the same summary projection: true only while the fenced proof is current and the coverage axis is `complete`. Its `by_store`, `counts_by_status`, `store_count` and `unaccounted_stores` are historical inventory from raw `coverage_diagnostics` records, with no run, release or revision behind them, and never claim current completeness.
 
 Limits. The server cannot order an attempt it never hears about. Examples are a run refused before authorization, a device that goes offline before it delivers its failure barrier, and a runner that predates this version and sends neither state nor records. In those cases the projection keeps the last admitted proof, labelled with its as-of. The device keeps its stricter local verdict. There is no heartbeat or lease machinery.

From 7ea7846b9e762e1f5f801957517c4ace16016e05 Mon Sep 17 00:00:00 2001
From: Tim Nunamaker <tnunamak@gmail.com>
Date: Thu, 22 Oct 2026 11:19:17 -0500
Subject: [PATCH 43/87] feat(collector): register runs and order device
 receipts by run order

The runtime registers each run with the server after its state read and
before its scan (POST .../run-starts). The server answers a sequence for
the connection; only a run with one can produce an eligible coverage proof.
A server without the route, or a failed call, leaves the run without a
sequence, and the run still collects.

The device stored the latest acknowledged coverage in ACK order, without
the run or revision, so an older run's late ACK replaced a newer run's
receipt and status could not say what the verdict was about. Outbox schema
v6 adds the run id, run sequence, storage epoch and commit revision the
server acknowledged. A receipt is replaced only by a later run; an ACK
without a sequence clears the evidence and keeps the stored order. A v5
receipt stays readable and names no as-of. `status` shows the as-of, and
reads `covered` only for a receipt that has one.

Assisted-by: AI
Signed-off-by: Tim Nunamaker <tnunamak@gmail.com>
---
 .../collector-runtime/src/collector-runner.ts |  63 +++++-
 .../src/local-device-client.ts                |  61 +++++-
 .../src/local-device-outbox.test.ts           | 134 ++++++++++++-
 .../src/local-device-outbox.ts                | 187 +++++++++++++++---
 .../bin/pdpp-local-collector.ts               |  41 +++-
 packages/local-collector/test/runner.test.ts  |  76 ++++++-
 6 files changed, 515 insertions(+), 47 deletions(-)

diff --git a/packages/collector-runtime/src/collector-runner.ts b/packages/collector-runtime/src/collector-runner.ts
index 889eaf16b..270b45628 100644
--- a/packages/collector-runtime/src/collector-runner.ts
+++ b/packages/collector-runtime/src/collector-runner.ts
@@ -57,6 +57,7 @@ import {
   LocalDeviceOutbox,
   type LocalDeviceOutboxItem,
   type LocalDeviceOutboxSummary,
+  type TerminalRunAck,
 } from "./local-device-outbox.ts";
 import type { LocalDeviceQueue, LocalDeviceQueueItem } from "./local-device-queue.ts";
 import { resolveConnectorCommand } from "./resolve-tsx-binary.ts";
@@ -997,6 +998,11 @@ export async function runCollectorConnector(config: CollectorRunConfig): Promise
       recordsPending: pendingOutboxWorkCount(postDrainSummary),
     });
     const priorState = priorStateProjection.state;
+    // The run id the server orders this run by, and the one its terminal
+    // record names. Registered before the scan, so every record the scan
+    // admits is ordered after any earlier run's proof.
+    const runId = config.runId ?? randomUUID();
+    await registerRunStart({ client, config, connectorInstanceId: priorStateProjection.connectorInstanceId, runId });
 
     await client.heartbeat({
       agent_version: COLLECTOR_AGENT_VERSION,
@@ -1107,6 +1113,7 @@ export async function runCollectorConnector(config: CollectorRunConfig): Promise
       holderId,
       outbox,
       policy,
+      runId,
       terminalEvidence,
       terminalRunBoundary: collectorScopeFingerprint(declaredScope),
       terminalRunConnectorInstanceId: priorStateProjection.connectorInstanceId,
@@ -1346,6 +1353,37 @@ async function maybeSkipScanForBacklog(input: MaybeSkipScanInput): Promise<Colle
   };
 }
 
+/**
+ * Register the run with the server at its start. The answered sequence is the
+ * run's place in run order: only a run with one can produce an eligible
+ * coverage proof. A server without the route, a connection the state read did
+ * not name, or a failed call leaves the run without a sequence. The run still
+ * collects and commits its terminal record, which then reads as unknown
+ * coverage.
+ */
+async function registerRunStart(input: {
+  client: Pick<LocalDeviceClient, "startRun">;
+  config: CollectorRunConfig;
+  connectorInstanceId: string;
+  runId: string;
+}): Promise<void> {
+  if (!input.connectorInstanceId) {
+    return;
+  }
+  throwIfAborted(input.config.abortSignal);
+  try {
+    await input.client.startRun({
+      connector_id: input.config.connector.connector_id,
+      run_id: input.runId,
+      source_instance_id: input.config.sourceInstanceId,
+    });
+  } catch (error) {
+    process.stderr.write(
+      `${input.config.connector.connector_id} run start not registered; this run cannot prove coverage (${error instanceof Error ? error.message : String(error)})\n`
+    );
+  }
+}
+
 async function readPriorStateOrBlock(input: {
   client: Pick<LocalDeviceClient, "getSourceInstanceState" | "heartbeat">;
   config: CollectorRunConfig;
@@ -2210,6 +2248,7 @@ async function maybeCommitCheckpoint(input: {
   holderId: string;
   outbox: LocalDeviceOutbox;
   policy: CollectorOutboxPolicy;
+  runId: string;
   terminalEvidence: TerminalEvidence | null;
   terminalRunBoundary: string;
   terminalRunConnectorInstanceId: string;
@@ -2221,7 +2260,7 @@ async function maybeCommitCheckpoint(input: {
     return { flushedState: null, statePutFailed: false };
   }
 
-  const runId = input.config.runId ?? randomUUID();
+  const { runId } = input;
   const terminalCommitIdentity = input.terminalEvidence
     ? {
         collection_boundary: input.terminalRunBoundary,
@@ -3029,7 +3068,7 @@ async function drainClaimedOutboxItem(
       leaseEpoch: item.lease_epoch,
       leaseMs: input.policy.leaseMs,
     });
-    await sendOutboxItem(input.client, current, {
+    const terminalAck = await sendOutboxItem(input.client, current, {
       ...(input.blobUpload ? { blobUpload: input.blobUpload } : {}),
       ...(input.spool ? { spool: input.spool } : {}),
     });
@@ -3037,6 +3076,7 @@ async function drainClaimedOutboxItem(
       holder: input.holderId,
       id: current.id,
       leaseEpoch: current.lease_epoch,
+      ...(terminalAck ? { terminalAck } : {}),
     });
     result.sent += 1;
     sentByKind[current.kind] = (sentByKind[current.kind] ?? 0) + 1;
@@ -3134,12 +3174,26 @@ interface SendOutboxItemDeps {
   spool?: LocalDeviceBlobSpool;
 }
 
+/**
+ * What the server acknowledged for a terminal record: the run's place in run
+ * order and its commit revision. The receipt keeps them so the device can show
+ * the as-of and keep a newer run's receipt over an older run's late ACK.
+ */
+function terminalRunAck(response: Awaited<ReturnType<LocalDeviceClient["commitTerminalRun"]>>): TerminalRunAck {
+  return {
+    collectionRevision: response.collection_revision ?? null,
+    runId: response.run_id,
+    runSequence: response.run_sequence ?? null,
+    storageEpoch: response.storage_epoch ?? null,
+  };
+}
+
 async function sendOutboxItem(
   client: Pick<LocalDeviceClient, "ackLocalCollectorGap" | "ingestBatch" | "putSourceInstanceState"> &
     Partial<Pick<LocalDeviceClient, "commitTerminalRun">>,
   item: LocalDeviceOutboxItem,
   deps: SendOutboxItemDeps = {}
-): Promise<void> {
+): Promise<TerminalRunAck | undefined> {
   if (item.kind === "record_batch") {
     const payload = assertRecordBatchPayload(item.payload, item.id);
     if (payload.records.length === 0) {
@@ -3169,8 +3223,7 @@ async function sendOutboxItem(
     if (!client.commitTerminalRun) {
       throw new OutboxPayloadShapeError("collector client does not support terminal_run_commit; upgrade required");
     }
-    await client.commitTerminalRun(assertTerminalRunCommitPayload(item.payload, item.id));
-    return;
+    return terminalRunAck(await client.commitTerminalRun(assertTerminalRunCommitPayload(item.payload, item.id)));
   }
   if (item.kind === "gap") {
     // Validate first so a malformed gap dead-letters via OutboxPayloadShapeError
diff --git a/packages/collector-runtime/src/local-device-client.ts b/packages/collector-runtime/src/local-device-client.ts
index dcfaff3d0..7962394b4 100644
--- a/packages/collector-runtime/src/local-device-client.ts
+++ b/packages/collector-runtime/src/local-device-client.ts
@@ -17,6 +17,8 @@ export const LOCAL_DEVICE_ENDPOINTS = {
     `/_ref/device-exporters/${encodeURIComponent(deviceId)}/source-instances/${encodeURIComponent(sourceInstanceId)}/local-collector-gaps`,
   localCollectorGapRecovered: (deviceId: string, sourceInstanceId: string) =>
     `/_ref/device-exporters/${encodeURIComponent(deviceId)}/source-instances/${encodeURIComponent(sourceInstanceId)}/local-collector-gaps/recovered`,
+  runStart: (deviceId: string, sourceInstanceId: string) =>
+    `/_ref/device-exporters/${encodeURIComponent(deviceId)}/source-instances/${encodeURIComponent(sourceInstanceId)}/run-starts`,
   selfRevoke: (deviceId: string) => `/_ref/device-exporters/${encodeURIComponent(deviceId)}/self-revoke`,
   sourceInstanceState: (deviceId: string, sourceInstanceId: string) =>
     `/_ref/device-exporters/${encodeURIComponent(deviceId)}/source-instances/${encodeURIComponent(sourceInstanceId)}/state`,
@@ -215,13 +217,33 @@ export type TerminalRunCommitRequest = TerminalRunCommitBase &
   );
 
 export interface TerminalRunCommitResponse {
+  /** The commit revision the server recorded the run at. Absent from an older server's receipt. */
+  collection_revision?: number;
   commit_id: string;
   envelope_hash: string;
   object: "device_terminal_run_commit";
   run_id: string;
+  /** The sequence the server issued at run start; null for a run with none. Absent from an older server's receipt. */
+  run_sequence?: number | null;
+  /** The storage epoch the server recorded the run in. Absent from an older server's receipt. */
+  storage_epoch?: number;
   terminal_event_id: string;
 }
 
+export interface RunStartRequest {
+  connector_id: string;
+  run_id: string;
+  source_instance_id: string;
+}
+
+export interface RunStartResponse {
+  connector_instance_id: string;
+  object: "device_run_start";
+  run_id: string;
+  run_sequence: number;
+  storage_epoch: number;
+}
+
 export interface GetSourceInstanceStateRequest {
   sourceInstanceId: string;
 }
@@ -497,7 +519,8 @@ export class LocalDeviceClient {
         response.run_id !== request.run_id ||
         response.envelope_hash !== expectedHash ||
         typeof response.terminal_event_id !== "string" ||
-        response.terminal_event_id.length === 0
+        response.terminal_event_id.length === 0 ||
+        !isOptionalRunOrder(response)
       ) {
         throw new LocalDeviceReceiptValidationError(
           "terminal run commit response did not match the submitted envelope"
@@ -507,6 +530,27 @@ export class LocalDeviceClient {
     });
   }
 
+  /**
+   * Register a run at its start. The server answers the run's connection-scoped
+   * sequence; only a run with one can produce an eligible coverage proof.
+   */
+  startRun(request: RunStartRequest): Promise<RunStartResponse> {
+    return this.#request<RunStartResponse>(
+      LOCAL_DEVICE_ENDPOINTS.runStart(this.#requireDeviceId(), request.source_instance_id),
+      { authenticate: true, body: { connector_id: request.connector_id, run_id: request.run_id }, method: "POST" }
+    ).then((response) => {
+      if (
+        response?.object !== "device_run_start" ||
+        response.run_id !== request.run_id ||
+        !isPositiveSafeInteger(response.run_sequence) ||
+        !isPositiveSafeInteger(response.storage_epoch)
+      ) {
+        throw new LocalDeviceReceiptValidationError("run start response did not match the registered run");
+      }
+      return response;
+    });
+  }
+
   getSourceInstanceState(request: GetSourceInstanceStateRequest): Promise<SourceInstanceStateResponse> {
     const path = LOCAL_DEVICE_ENDPOINTS.sourceInstanceState(this.#requireDeviceId(), request.sourceInstanceId);
     return this.#request(path, { authenticate: true, method: "GET" });
@@ -619,3 +663,18 @@ export class LocalDeviceClient {
     }
   }
 }
+
+function isPositiveSafeInteger(value: unknown): value is number {
+  return typeof value === "number" && Number.isSafeInteger(value) && value > 0;
+}
+
+/** Run-order fields are optional (an older server omits them), but present ones must be well formed. */
+function isOptionalRunOrder(response: TerminalRunCommitResponse): boolean {
+  return (
+    (response.collection_revision === undefined || isPositiveSafeInteger(response.collection_revision)) &&
+    (response.run_sequence === undefined ||
+      response.run_sequence === null ||
+      isPositiveSafeInteger(response.run_sequence)) &&
+    (response.storage_epoch === undefined || isPositiveSafeInteger(response.storage_epoch))
+  );
+}
diff --git a/packages/collector-runtime/src/local-device-outbox.test.ts b/packages/collector-runtime/src/local-device-outbox.test.ts
index 0622267b8..564a266d5 100644
--- a/packages/collector-runtime/src/local-device-outbox.test.ts
+++ b/packages/collector-runtime/src/local-device-outbox.test.ts
@@ -54,14 +54,28 @@ test("acknowledged v2 terminal coverage survives outbox pruning and reopen", asy
   outbox.enqueue({ id: "coverage-1", kind: "terminal_run_commit", payload, sourceInstanceId: "source-1" });
   const [claimed] = outbox.claimReady({ holder: "worker", leaseMs: 60_000 });
   assert.ok(claimed);
-  outbox.acknowledge({ holder: "worker", id: claimed.id, leaseEpoch: claimed.lease_epoch });
+  outbox.acknowledge({
+    holder: "worker",
+    id: claimed.id,
+    leaseEpoch: claimed.lease_epoch,
+    terminalAck: { collectionRevision: 7, runId: "run-1", runSequence: 1, storageEpoch: 1 },
+  });
   outbox.pruneSent({ dryRun: false, keepCount: 0, sourceInstanceId: "source-1" });
   outbox.close();
 
   const reopened = new LocalDeviceOutbox({ path });
   try {
     assert.equal(reopened.get("coverage-1"), null);
-    assert.deepEqual(reopened.latestTerminalCoverageReceipt({ sourceInstanceId: "source-1" }), {
+    const receipt = reopened.latestTerminalCoverageReceipt({ sourceInstanceId: "source-1" });
+    assert.ok(receipt?.asOf, "the receipt names its as-of");
+    assert.deepEqual(receipt, {
+      asOf: {
+        acknowledgedAt: receipt.asOf.acknowledgedAt,
+        collectionRevision: 7,
+        runId: "run-1",
+        runSequence: 1,
+        storageEpoch: 1,
+      },
       collectionBoundary: "scope-1",
       terminalFacts: payload.terminal_facts,
     });
@@ -195,7 +209,7 @@ test("schema v3/v4 migration preserves pending v2 work and accepts terminal run
     const version = migrated.prepare("PRAGMA user_version").get() as {
       user_version: number;
     };
-    assert.equal(version.user_version, 5);
+    assert.equal(version.user_version, 6);
   } finally {
     migrated.close();
   }
@@ -223,12 +237,120 @@ test("an old v2 binary uses the production version fence to refuse a v3 outbox",
   }
 });
 
-test("current binary refuses a future v6 outbox before applying schema", async (t) => {
+test("current binary refuses a future v7 outbox before applying schema", async (t) => {
   const path = await tempOutboxPath(t);
   const db = new DatabaseSync(path);
-  db.exec("PRAGMA user_version = 6");
+  db.exec("PRAGMA user_version = 7");
   db.close();
-  assert.throws(() => new LocalDeviceOutbox({ path }), /newer than supported version 5/);
+  assert.throws(() => new LocalDeviceOutbox({ path }), /newer than supported version 6/);
+});
+
+/** Enqueue and acknowledge one v2 terminal record whose single store reads `status`. */
+function acknowledgeTerminal(
+  outbox: LocalDeviceOutbox,
+  runId: string,
+  ack: { runSequence: number | null; storageEpoch: number | null; collectionRevision: number | null } | null,
+  status = "collected"
+): void {
+  outbox.enqueue({
+    id: `terminal-${runId}`,
+    kind: "terminal_run_commit",
+    payload: {
+      collection_boundary: "scope-1",
+      run_id: runId,
+      terminal_facts: [{ scoped: true, stores: [{ status, store: runId }], stream: "messages" }],
+      version: 2,
+    },
+    sourceInstanceId: "source-1",
+  });
+  const [claimed] = outbox.claimReady({ holder: "worker", leaseMs: 60_000, sourceInstanceId: "source-1" });
+  assert.ok(claimed);
+  outbox.acknowledge({
+    holder: "worker",
+    id: claimed.id,
+    leaseEpoch: claimed.lease_epoch,
+    ...(ack ? { terminalAck: { ...ack, runId } } : {}),
+  });
+}
+
+function receiptRun(outbox: LocalDeviceOutbox): string | null {
+  const receipt = outbox.latestTerminalCoverageReceipt({ sourceInstanceId: "source-1" });
+  return receipt ? (receipt.terminalFacts[0]?.stores[0]?.store ?? null) : null;
+}
+
+test("an older run's late ACK does not replace a newer run's receipt", async (t) => {
+  const outbox = new LocalDeviceOutbox({ path: await tempOutboxPath(t) });
+  try {
+    acknowledgeTerminal(outbox, "run-b", { collectionRevision: 10, runSequence: 2, storageEpoch: 1 });
+    assert.equal(receiptRun(outbox), "run-b");
+    // Run A started first, but its terminal record was acknowledged later.
+    acknowledgeTerminal(outbox, "run-a", { collectionRevision: 11, runSequence: 1, storageEpoch: 1 });
+    assert.equal(receiptRun(outbox), "run-b", "run B's receipt stays");
+    assert.equal(outbox.latestTerminalCoverageReceipt({ sourceInstanceId: "source-1" })?.asOf?.runSequence, 2);
+    // A newer epoch orders after every sequence of the old one.
+    acknowledgeTerminal(outbox, "run-c", { collectionRevision: 3, runSequence: 1, storageEpoch: 2 });
+    assert.equal(receiptRun(outbox), "run-c", "a run issued after a restore step is later");
+  } finally {
+    outbox.close();
+  }
+});
+
+test("an ACK without a run sequence clears the evidence and keeps the stored order", async (t) => {
+  const outbox = new LocalDeviceOutbox({ path: await tempOutboxPath(t) });
+  try {
+    acknowledgeTerminal(outbox, "run-b", { collectionRevision: 10, runSequence: 2, storageEpoch: 1 });
+    acknowledgeTerminal(outbox, "run-unsequenced", null);
+    assert.equal(receiptRun(outbox), null, "an unordered run leaves no evidence");
+    acknowledgeTerminal(outbox, "run-a", { collectionRevision: 12, runSequence: 1, storageEpoch: 1 });
+    assert.equal(receiptRun(outbox), null, "an older run's late ACK does not restore evidence");
+    acknowledgeTerminal(outbox, "run-d", { collectionRevision: 13, runSequence: 3, storageEpoch: 1 });
+    assert.equal(receiptRun(outbox), "run-d");
+  } finally {
+    outbox.close();
+  }
+});
+
+test("a v5 outbox upgrades to v6 and keeps its receipt readable without an as-of", async (t) => {
+  const path = await tempOutboxPath(t);
+  const current = new LocalDeviceOutbox({ path });
+  current.close();
+  const raw = new DatabaseSync(path);
+  try {
+    for (const column of ["run_id", "run_sequence", "storage_epoch", "collection_revision"]) {
+      raw.exec(`ALTER TABLE local_device_terminal_coverage_receipts DROP COLUMN ${column}`);
+    }
+    raw
+      .prepare(
+        `INSERT INTO local_device_terminal_coverage_receipts
+           (source_instance_id, collection_boundary, terminal_facts_json, acknowledged_at) VALUES (?, ?, ?, ?)`
+      )
+      .run(
+        "source-1",
+        "scope-1",
+        JSON.stringify([{ scoped: true, stores: [{ status: "collected", store: "messages" }], stream: "messages" }]),
+        "2026-10-01T00:00:00.000Z"
+      );
+    raw.exec("PRAGMA user_version = 5");
+  } finally {
+    raw.close();
+  }
+  const upgraded = new LocalDeviceOutbox({ path });
+  try {
+    const receipt = upgraded.latestTerminalCoverageReceipt({ sourceInstanceId: "source-1" });
+    assert.equal(receipt?.collectionBoundary, "scope-1", "the v5 receipt stays readable");
+    assert.equal(receipt?.asOf, null, "a v5 receipt names no as-of");
+    // The first sequenced ACK replaces a receipt that has no sequence.
+    acknowledgeTerminal(upgraded, "run-a", { collectionRevision: 4, runSequence: 1, storageEpoch: 1 });
+    assert.equal(receiptRun(upgraded), "run-a");
+  } finally {
+    upgraded.close();
+  }
+  const version = new DatabaseSync(path, { readOnly: true });
+  try {
+    assert.equal((version.prepare("PRAGMA user_version").get() as { user_version: number }).user_version, 6);
+  } finally {
+    version.close();
+  }
 });
 
 test("schema v3 migration failure rolls back, closes, and reopens with v2 bytes and metadata intact", async (t) => {
diff --git a/packages/collector-runtime/src/local-device-outbox.ts b/packages/collector-runtime/src/local-device-outbox.ts
index 32d852bbe..70138c778 100644
--- a/packages/collector-runtime/src/local-device-outbox.ts
+++ b/packages/collector-runtime/src/local-device-outbox.ts
@@ -7,7 +7,7 @@ import { DatabaseSync } from "node:sqlite";
 import type { TerminalCoverageFact } from "./local-device-client.ts";
 import { hashCanonicalJson } from "./local-device-envelope.ts";
 
-const CURRENT_SCHEMA_VERSION = 5;
+const CURRENT_SCHEMA_VERSION = 6;
 type OutboxMigrationV3FaultPoint = "after_copy";
 let outboxMigrationV3FaultHook: ((point: OutboxMigrationV3FaultPoint) => void) | null = null;
 
@@ -146,6 +146,26 @@ export interface LocalDeviceOutboxLeaseInput {
   leaseEpoch: number;
 }
 
+/** What the server acknowledged for a terminal run record: its run order and commit revision. */
+export interface TerminalRunAck {
+  /** The commit revision the server recorded the run at; null when the server did not say. */
+  readonly collectionRevision: number | null;
+  readonly runId: string;
+  /** The sequence the server issued at run start; null for a run without one, or an older server. */
+  readonly runSequence: number | null;
+  /** The storage epoch the server recorded the run in; null when the server did not say. */
+  readonly storageEpoch: number | null;
+}
+
+/** What the latest acknowledged receipt is a fact about. */
+export interface TerminalCoverageReceiptAsOf {
+  readonly acknowledgedAt: string;
+  readonly collectionRevision: number;
+  readonly runId: string;
+  readonly runSequence: number;
+  readonly storageEpoch: number;
+}
+
 export interface LocalDeviceOutboxFailInput extends LocalDeviceOutboxLeaseInput {
   error: string;
   retryBackoffMs: number;
@@ -463,7 +483,7 @@ export class LocalDeviceOutbox {
     return row.next_time;
   }
 
-  acknowledge(input: LocalDeviceOutboxLeaseInput): void {
+  acknowledge(input: LocalDeviceOutboxLeaseInput & { readonly terminalAck?: TerminalRunAck }): void {
     const now = this.#now();
     this.#db.exec("BEGIN IMMEDIATE");
     try {
@@ -487,32 +507,8 @@ export class LocalDeviceOutbox {
         .prepare("SELECT source_instance_id, kind, payload_json FROM local_device_outbox WHERE id = ?")
         .get(input.id);
       if (isRecord(row) && row.kind === "terminal_run_commit" && typeof row.source_instance_id === "string") {
-        // The receipt tracks the latest ACK, including a legacy commit without
-        // coverage. Keep this in the ACK transaction so pruning cannot erase proof.
-        this.#db
-          .prepare("DELETE FROM local_device_terminal_coverage_receipts WHERE source_instance_id = ?")
-          .run(row.source_instance_id);
-        const payload = typeof row.payload_json === "string" ? JSON.parse(row.payload_json) : null;
-        if (
-          isRecord(payload) &&
-          payload.version === 2 &&
-          typeof payload.collection_boundary === "string" &&
-          payload.collection_boundary.length > 0 &&
-          Array.isArray(payload.terminal_facts) &&
-          payload.terminal_facts.length > 0 &&
-          payload.terminal_facts.every(isTerminalCoverageFact) &&
-          new Set(payload.terminal_facts.map((fact: TerminalCoverageFact) => fact.stream)).size ===
-            payload.terminal_facts.length &&
-          payload.terminal_facts.every(
-            (fact: TerminalCoverageFact) => new Set(fact.stores.map((store) => store.store)).size === fact.stores.length
-          )
-        ) {
-          this.#db
-            .prepare(`INSERT INTO local_device_terminal_coverage_receipts
-            (source_instance_id, collection_boundary, terminal_facts_json, acknowledged_at)
-            VALUES (?, ?, ?, ?)`)
-            .run(row.source_instance_id, payload.collection_boundary, JSON.stringify(payload.terminal_facts), now);
-        }
+        // Keep this in the ACK transaction so pruning cannot erase proof.
+        this.#recordTerminalReceipt(row.source_instance_id, row.payload_json, input.terminalAck ?? null, now);
       }
       this.#db.exec("COMMIT");
     } catch (error) {
@@ -521,12 +517,76 @@ export class LocalDeviceOutbox {
     }
   }
 
+  /**
+   * Replace the lane's receipt by run order, not by ACK order. A sequenced ACK
+   * replaces the stored receipt only when its (storage epoch, run sequence) is
+   * higher, or when the stored receipt has no sequence; an older run's late
+   * ACK leaves a newer receipt in place. An ACK without a sequence cannot be
+   * ordered: it clears the evidence and keeps the stored order, as the server
+   * attributes such a run to the newest issued sequence. Only a valid v2
+   * commit with facts keeps evidence; any other acknowledged run stores none.
+   */
+  #recordTerminalReceipt(
+    sourceInstanceId: string,
+    payloadJson: unknown,
+    ack: TerminalRunAck | null,
+    now: string
+  ): void {
+    const stored = this.#db
+      .prepare(
+        "SELECT run_sequence, storage_epoch FROM local_device_terminal_coverage_receipts WHERE source_instance_id = ?"
+      )
+      .get(sourceInstanceId);
+    const storedSequence = isRecord(stored) ? readOrderInteger(stored.run_sequence) : null;
+    const storedEpoch = isRecord(stored) ? readOrderInteger(stored.storage_epoch) : null;
+    const sequenced = ack !== null && ack.runSequence !== null && ack.storageEpoch !== null;
+    if (
+      sequenced &&
+      storedSequence !== null &&
+      storedEpoch !== null &&
+      !isLaterRun(ack.storageEpoch as number, ack.runSequence as number, storedEpoch, storedSequence)
+    ) {
+      return;
+    }
+    const payload = typeof payloadJson === "string" ? JSON.parse(payloadJson) : null;
+    const facts = sequenced && isRecord(payload) && isValidCoveragePayload(payload) ? payload.terminal_facts : [];
+    const boundary =
+      isRecord(payload) && typeof payload.collection_boundary === "string" ? payload.collection_boundary : "";
+    this.#db
+      .prepare(
+        `INSERT INTO local_device_terminal_coverage_receipts
+           (source_instance_id, collection_boundary, terminal_facts_json, acknowledged_at,
+            run_id, run_sequence, storage_epoch, collection_revision)
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+         ON CONFLICT(source_instance_id) DO UPDATE SET
+           collection_boundary = excluded.collection_boundary,
+           terminal_facts_json = excluded.terminal_facts_json,
+           acknowledged_at = excluded.acknowledged_at,
+           run_id = excluded.run_id,
+           run_sequence = excluded.run_sequence,
+           storage_epoch = excluded.storage_epoch,
+           collection_revision = excluded.collection_revision`
+      )
+      .run(
+        sourceInstanceId,
+        boundary,
+        JSON.stringify(facts),
+        now,
+        ack?.runId ?? (isRecord(payload) && typeof payload.run_id === "string" ? payload.run_id : null),
+        sequenced ? ack.runSequence : storedSequence,
+        sequenced ? ack.storageEpoch : storedEpoch,
+        sequenced ? ack.collectionRevision : null
+      );
+  }
+
   latestTerminalCoverageReceipt(input: { sourceInstanceId: string }): {
+    asOf: TerminalCoverageReceiptAsOf | null;
     collectionBoundary: string;
     terminalFacts: readonly TerminalCoverageFact[];
   } | null {
     const row = this.#db
-      .prepare(`SELECT collection_boundary, terminal_facts_json
+      .prepare(`SELECT collection_boundary, terminal_facts_json, acknowledged_at,
+                       run_id, run_sequence, storage_epoch, collection_revision
       FROM local_device_terminal_coverage_receipts WHERE source_instance_id = ?`)
       .get(input.sourceInstanceId);
     if (!isRecord(row) || typeof row.collection_boundary !== "string" || typeof row.terminal_facts_json !== "string") {
@@ -549,7 +609,20 @@ export class LocalDeviceOutbox {
     ) {
       return null;
     }
-    return { collectionBoundary: row.collection_boundary, terminalFacts: facts };
+    const runSequence = readOrderInteger(row.run_sequence);
+    const storageEpoch = readOrderInteger(row.storage_epoch);
+    const collectionRevision = readOrderInteger(row.collection_revision);
+    // A receipt from before run order (outbox schema v5) has none of these:
+    // it is still readable, but it names no as-of.
+    const asOf =
+      typeof row.run_id === "string" &&
+      typeof row.acknowledged_at === "string" &&
+      runSequence !== null &&
+      storageEpoch !== null &&
+      collectionRevision !== null
+        ? { acknowledgedAt: row.acknowledged_at, collectionRevision, runId: row.run_id, runSequence, storageEpoch }
+        : null;
+    return { asOf, collectionBoundary: row.collection_boundary, terminalFacts: facts };
   }
 
   failRetryable(input: LocalDeviceOutboxFailInput): void {
@@ -1514,6 +1587,7 @@ export class LocalDeviceOutbox {
     }
     this.#applySchemaV4();
     this.#applySchemaV5();
+    this.#applySchemaV6();
     if (version < CURRENT_SCHEMA_VERSION) {
       this.#db.exec(`PRAGMA user_version = ${CURRENT_SCHEMA_VERSION}`);
     }
@@ -1650,6 +1724,30 @@ export class LocalDeviceOutbox {
     `);
   }
 
+  /**
+   * Schema v6 — the receipt records the run it is about and its place in run
+   * order: run id, run sequence, storage epoch and commit revision. A v5
+   * receipt keeps NULLs; it stays readable and names no as-of.
+   */
+  #applySchemaV6(): void {
+    const columns = new Set(
+      this.#db
+        .prepare("PRAGMA table_info(local_device_terminal_coverage_receipts)")
+        .all()
+        .map((column) => (isRecord(column) ? String(column.name) : ""))
+    );
+    for (const [name, type] of [
+      ["run_id", "TEXT"],
+      ["run_sequence", "INTEGER"],
+      ["storage_epoch", "INTEGER"],
+      ["collection_revision", "INTEGER"],
+    ] as const) {
+      if (!columns.has(name)) {
+        this.#db.exec(`ALTER TABLE local_device_terminal_coverage_receipts ADD COLUMN ${name} ${type}`);
+      }
+    }
+  }
+
   /** Schema v5 — latest acknowledged coverage survives outbox pruning. */
   #applySchemaV5(): void {
     this.#db.exec(`
@@ -1710,6 +1808,35 @@ export class LocalDeviceOutbox {
   }
 }
 
+/** A stored run-order integer, or null when absent or unreadable. */
+function readOrderInteger(value: unknown): number | null {
+  const number = typeof value === "bigint" ? Number(value) : value;
+  return typeof number === "number" && Number.isSafeInteger(number) && number >= 0 ? number : null;
+}
+
+/** Whether (epoch, sequence) orders after the stored (epoch, sequence). */
+function isLaterRun(epoch: number, sequence: number, storedEpoch: number, storedSequence: number): boolean {
+  return epoch > storedEpoch || (epoch === storedEpoch && sequence > storedSequence);
+}
+
+function isValidCoveragePayload(payload: Record<string, unknown>): payload is Record<string, unknown> & {
+  terminal_facts: TerminalCoverageFact[];
+} {
+  return (
+    payload.version === 2 &&
+    typeof payload.collection_boundary === "string" &&
+    payload.collection_boundary.length > 0 &&
+    Array.isArray(payload.terminal_facts) &&
+    payload.terminal_facts.length > 0 &&
+    payload.terminal_facts.every(isTerminalCoverageFact) &&
+    new Set(payload.terminal_facts.map((fact: TerminalCoverageFact) => fact.stream)).size ===
+      payload.terminal_facts.length &&
+    payload.terminal_facts.every(
+      (fact: TerminalCoverageFact) => new Set(fact.stores.map((store) => store.store)).size === fact.stores.length
+    )
+  );
+}
+
 export function buildLocalDeviceOutboxId(input: BuildLocalDeviceOutboxIdInput): string {
   return `local-outbox:${hashCanonicalJson({
     kind: input.kind,
diff --git a/packages/local-collector/bin/pdpp-local-collector.ts b/packages/local-collector/bin/pdpp-local-collector.ts
index 56844bafd..e103ecaaf 100644
--- a/packages/local-collector/bin/pdpp-local-collector.ts
+++ b/packages/local-collector/bin/pdpp-local-collector.ts
@@ -1699,10 +1699,22 @@ export interface LocalOutboxStatusOutput {
    * - `not_current`: acknowledged for another release, or with no release
    *   binding, or this device selects no release. Says nothing about
    *   completeness, so it is never read as `incomplete`.
-   * - `no_evidence`: no acknowledged typed verdict, or one whose runtime
-   *   accounting is missing or malformed.
+   * - `no_evidence`: no acknowledged typed verdict, one whose runtime
+   *   accounting is missing or malformed, or one that names no as-of (a
+   *   receipt from before run order, or a run the server issued no sequence).
+   *
+   * `as_of` is what the receipt is a fact about: the run, the run sequence and
+   * storage epoch the server issued, the commit revision it recorded the run
+   * at, and when this device received the acknowledgement.
    */
   terminal_coverage: {
+    as_of: {
+      acknowledged_at: string;
+      collection_revision: number;
+      run_id: string;
+      run_sequence: number;
+      storage_epoch: number;
+    } | null;
     collection_boundary: string | null;
     verdict: "covered" | "incomplete" | "unadmitted" | "not_current" | "no_evidence";
   };
@@ -1926,6 +1938,7 @@ export function inspectLocalOutboxStatus(
       record_batches: inspection.recordBatchCount,
     },
     terminal_coverage: {
+      as_of: receiptAsOf(inspection.terminalCoverage),
       collection_boundary: inspection.terminalCoverage?.collectionBoundary ?? null,
       verdict: terminalVerdict,
     },
@@ -3702,7 +3715,11 @@ interface LocalOutboxInspection {
   openGaps: number;
   recordBatchCount: number;
   summary: LocalDeviceOutboxSummary;
-  terminalCoverage: { collectionBoundary: string; terminalFacts: readonly StoredTerminalFact[] } | null;
+  terminalCoverage: {
+    asOf: NonNullable<ReturnType<LocalDeviceOutbox["latestTerminalCoverageReceipt"]>>["asOf"];
+    collectionBoundary: string;
+    terminalFacts: readonly StoredTerminalFact[];
+  } | null;
 }
 
 /**
@@ -3836,6 +3853,9 @@ function terminalCoverageVerdict(
   if (latestRunOpen) {
     return "unadmitted";
   }
+  if (!receipt.asOf) {
+    return "no_evidence";
+  }
   const isSelectedRelease = (fact: StoredTerminalFact) =>
     release !== null &&
     fact.artifact_digest === release.artifactDigest &&
@@ -3859,6 +3879,21 @@ function terminalCoverageVerdict(
     : "incomplete";
 }
 
+function receiptAsOf(
+  receipt: LocalOutboxInspection["terminalCoverage"]
+): LocalOutboxStatusOutput["terminal_coverage"]["as_of"] {
+  const asOf = receipt?.asOf;
+  return asOf
+    ? {
+        acknowledged_at: asOf.acknowledgedAt,
+        collection_revision: asOf.collectionRevision,
+        run_id: asOf.runId,
+        run_sequence: asOf.runSequence,
+        storage_epoch: asOf.storageEpoch,
+      }
+    : null;
+}
+
 function emptyOutboxSummary(): LocalDeviceOutboxSummary {
   return {
     deadLetter: 0,
diff --git a/packages/local-collector/test/runner.test.ts b/packages/local-collector/test/runner.test.ts
index 970f1d620..7ea22791c 100644
--- a/packages/local-collector/test/runner.test.ts
+++ b/packages/local-collector/test/runner.test.ts
@@ -2568,11 +2568,28 @@ function enqueueRecordBatch(outbox, { id, sourceInstanceId = "src-1", streams })
   });
 }
 
-/** Claim + acknowledge the next ready row, which must be `id`, so it reaches status 'succeeded' (drained). */
+// Run sequences a current server issues: each acknowledged terminal record is a later run.
+let acknowledgedRunSequence = 0;
+
+/**
+ * Claim + acknowledge the next ready row, which must be `id`, so it reaches status 'succeeded' (drained).
+ * A terminal record is acknowledged as a current server does, with its run sequence and revision.
+ */
 function drainRow(outbox, id, sourceInstanceId = "src-1") {
   const [claim] = outbox.claimReady({ holder: "drainer", leaseMs: 60_000, limit: 1, sourceInstanceId });
   assert.equal(claim?.id, id, `expected ${id} to be the next ready row`);
-  outbox.acknowledge({ holder: "drainer", id: claim.id, leaseEpoch: claim.lease_epoch });
+  acknowledgedRunSequence += 1;
+  outbox.acknowledge({
+    holder: "drainer",
+    id: claim.id,
+    leaseEpoch: claim.lease_epoch,
+    terminalAck: {
+      collectionRevision: acknowledgedRunSequence,
+      runId: typeof claim.payload?.run_id === "string" ? claim.payload.run_id : claim.id,
+      runSequence: acknowledgedRunSequence,
+      storageEpoch: 1,
+    },
+  });
 }
 
 // The release this device selects for the connector, and one it has since
@@ -2663,6 +2680,19 @@ test("acknowledged v2 coverage stays covered after sent rows are pruned", async
   assert.equal(status.outbox.counts.total, 0);
   assert.equal(status.terminal_coverage.verdict, "covered");
   assert.equal(status.terminal_coverage.collection_boundary, "unscoped");
+  // The verdict names what it is a fact about: the run and its place in run order.
+  const asOf = status.terminal_coverage.as_of;
+  assert.ok(asOf, "a covered verdict carries its as-of");
+  assert.deepEqual(
+    { ...asOf, acknowledged_at: typeof asOf.acknowledged_at },
+    {
+      acknowledged_at: "string",
+      collection_revision: acknowledgedRunSequence,
+      run_id: "terminal-covered",
+      run_sequence: acknowledgedRunSequence,
+      storage_epoch: 1,
+    }
+  );
   assert.equal(status.lifecycle_state, "covered");
   assert.equal(buildLocalOutboxDoctor(status).checks.terminal_coverage, "ok");
   const matchingDoctor = buildLocalOutboxDoctor(status, null, {
@@ -2685,6 +2715,44 @@ test("acknowledged v2 coverage stays covered after sent rows are pruned", async
   assert.equal(staleDoctor.status, "warning");
 });
 
+test("a receipt without a run sequence is no evidence, and an older run's late ACK does not replace a newer receipt", async () => {
+  const path = await tempOutboxPath();
+  const outbox = new LocalDeviceOutbox({ path });
+  try {
+    // An older server acknowledged the run without a run sequence: the device cannot order it.
+    enqueueTerminalCoverage(outbox, { id: "terminal-unsequenced", stores: [{ store: "local_files", status: "collected" }] });
+    const [unsequenced] = outbox.claimReady({ holder: "drainer", leaseMs: 60_000, limit: 1, sourceInstanceId: "src-1" });
+    assert.ok(unsequenced);
+    outbox.acknowledge({ holder: "drainer", id: unsequenced.id, leaseEpoch: unsequenced.lease_epoch });
+  } finally {
+    outbox.close();
+  }
+  const unordered = statusFor(path);
+  assert.equal(unordered.terminal_coverage.verdict, "no_evidence");
+  assert.equal(unordered.terminal_coverage.as_of, null);
+
+  const reopened = new LocalDeviceOutbox({ path });
+  try {
+    acknowledgeTerminalCoverage(reopened, { id: "terminal-newer", stores: [{ store: "local_files", status: "collected" }] });
+    const newer = acknowledgedRunSequence;
+    // A run that started before it is acknowledged later, with its own, lower sequence.
+    enqueueTerminalCoverage(reopened, { id: "terminal-older", stores: [{ store: "local_files", status: "partial" }] });
+    const [older] = reopened.claimReady({ holder: "drainer", leaseMs: 60_000, limit: 1, sourceInstanceId: "src-1" });
+    assert.ok(older);
+    reopened.acknowledge({
+      holder: "drainer",
+      id: older.id,
+      leaseEpoch: older.lease_epoch,
+      terminalAck: { collectionRevision: newer + 1, runId: "terminal-older", runSequence: newer - 1, storageEpoch: 1 },
+    });
+    const status = statusFor(path);
+    assert.equal(status.terminal_coverage.verdict, "covered", "the newer run's receipt stands");
+    assert.equal(status.terminal_coverage.as_of?.run_sequence, newer);
+  } finally {
+    reopened.close();
+  }
+});
+
 test("a later partial terminal receipt replaces a previously covered verdict", async () => {
   const path = await tempOutboxPath();
   const outbox = new LocalDeviceOutbox({ path });
@@ -4060,12 +4128,16 @@ async function startAcceptingDeviceServer(): Promise<{ close: () => Promise<void
         // Every successful pass commits a terminal run record; acknowledge it as the server does.
         const request = JSON.parse(body || "{}") as TerminalRunCommitRequest;
         res.writeHead(201, { "content-type": "application/json" });
+        acknowledgedRunSequence += 1;
         res.end(
           JSON.stringify({
+            collection_revision: acknowledgedRunSequence,
             commit_id: request.commit_id,
             envelope_hash: hashCanonicalJson(canonicalTerminalRunCommitEnvelope(request)),
             object: "device_terminal_run_commit",
             run_id: request.run_id,
+            run_sequence: acknowledgedRunSequence,
+            storage_epoch: 1,
             terminal_event_id: `evt-${request.run_id}`,
           })
         );

From 824007e40eff6a4f784dfe13af04290756944f09 Mon Sep 17 00:00:00 2001
From: Tim Nunamaker <tnunamak@gmail.com>
Date: Thu, 22 Oct 2026 11:19:25 -0500
Subject: [PATCH 44/87] chore(collector-runtime): regenerate artifact for run
 order

Assisted-by: AI
Signed-off-by: Tim Nunamaker <tnunamak@gmail.com>
---
 packages/collector-runtime/artifact.json | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/packages/collector-runtime/artifact.json b/packages/collector-runtime/artifact.json
index f4654c5bd..10d4de429 100644
--- a/packages/collector-runtime/artifact.json
+++ b/packages/collector-runtime/artifact.json
@@ -1,13 +1,13 @@
 {
   "artifact_filename": "pdpp-collector-runtime-0.0.1.tgz",
-  "artifact_sha1": "d7019724607a7b49531138d4ecc6d8ef20bc045c",
-  "artifact_sha256": "9abeb28a2307e7a528cef4830db3e6627bc26502b56146cda52eab5088a34f5d",
-  "artifact_sha512": "868a92a83e81286d53e74ce5f8667f57863ea9ba2bad0ca84904f974cdb5b6fdc367c6505e464becd0cabf1604530d27b4d459b99e9042919ee17ca86b841c26",
+  "artifact_sha1": "6c898b6fcdf07a14a7238c9252bd26983b8ce36b",
+  "artifact_sha256": "576c88d1875f3a44e561c43aeb59674d3317614f5ee8406715820cac6cf5b370",
+  "artifact_sha512": "3df8bbf4844bef7a90bdf4424ecd37486411fb11e6d62948c01e0777012d27e56ca8c8532976a02df95af25bf0815cb243b264bef6fdc7d1ac4887605654a2b1",
   "connector_protocol_declarations_sha256": "8f1bf78ec644d002bfc8b1ce2399ccb660ea10bb3ee53c49a7995e1bb0e17dcb",
   "connector_protocol_source_inputs_sha256": "935e99c7e3307d7e48d748b3ca83b7427f1b91c89e7397de2a3842f08f2393fd",
-  "declarations_sha256": "143e48acd5b12670e354da3fd5ff1a265f93d2731d31e2d711d1cb1ef65a8b0e",
+  "declarations_sha256": "a2c6d0e4ac93d2b9186bbbd2fcf133ac314c23003fab4ba298ccb4c41571140d",
   "metadata_version": 1,
   "package_name": "@pdpp/collector-runtime",
   "package_version": "0.0.1",
-  "source_inputs_sha256": "7d2cd1fee2fd45d1765efe285c57b85c028ae12b0c7ccfd30664c958abeb6cd4"
+  "source_inputs_sha256": "4b9e627dc41a3351d2810218a0b22de99eecfa3f4bf69db4b39bf21d2384b0a4"
 }

From 3f91995827ebecda7576913b712a4d8c74a501ca Mon Sep 17 00:00:00 2001
From: Tim Nunamaker <tnunamak@gmail.com>
Date: Thu, 22 Oct 2026 11:19:38 -0500
Subject: [PATCH 45/87] feat(coverage): decide proof eligibility by run order,
 not commit order

A positive proof was current while its commit revision was the newest one.
An older run's proof that reached the server after a newer run's terminal
record (an outbox delay or retry) took the next revision and became current.

The server now issues each run a connection-scoped sequence at run start,
under the connection row lock, so several devices may collect one
connection. Every observation that takes a commit revision also moves a
run-order marker when its run sequence is at least the highest observed.
An observation that names no issued run (record batches, refusals, state
commits) counts as the newest issued run and can retire a proof but never
establish one. A proof is current only while it is that marker in the
current storage epoch. The revision still orders observations and dates
the as-of, which now carries the run sequence.

An exact terminal replay is answered from its stored receipt before the
request is checked against the current inventory, so an inventory change
no longer turns an authorized replay into a 400. The terminal response now
carries the run sequence, storage epoch and revision for the device.

A restore can regress the issued sequences and the proof tables.
scripts/mark-storage-restored.ts starts a new storage epoch for every
connection, binding to the storage epoch the config pointer already
documents for restores; no proof from before it can be current. A restore
that skips the step is not detected.

Tests cover a delayed older proof (store, HTTP and end to end), a second
collector, replay and conflicting-duplicate atomicity after an inventory
change, the restore step, ingest before a crash (including a killed runner
process), and the diagnostics and detail responses against the vendored
@pdpp/reference-contract, on SQLite and PostgreSQL.

Assisted-by: AI
Signed-off-by: Tim Nunamaker <tnunamak@gmail.com>
---
 .../(console)/lib/connection-evidence.test.ts |   1 +
 .../src/app/(console)/lib/ref-client.ts       |   2 +
 .../local-device-terminal-collection.ts       | 172 +++++--
 .../scripts/mark-storage-restored.ts          |  57 +++
 .../server/backup-table-policy.ts             |   5 +
 reference-implementation/server/db.ts         |  23 +
 .../server/postgres-storage.ts                |  24 +
 .../server/ref-control.ts                     |  47 +-
 .../server/routes/ref-device-exporters.ts     |  22 +-
 .../stores/collection-revision-store.ts       | 376 ++++++++++++++-
 .../server/stores/run-history-writer.ts       |   5 +
 .../stores/terminal-run-commit-store.ts       | 111 ++++-
 .../local-device-coverage-journey.test.ts     | 214 ++++++++-
 ...device-coverage-revision-atomicity.test.ts | 430 +++++++++++++++++-
 .../local-device-coverage-stale-proof.test.ts |  45 +-
 ...ice-coverage-state-commit-postgres.test.ts |  21 +-
 ...evice-terminal-coverage-projection.test.ts |  16 +-
 17 files changed, 1460 insertions(+), 111 deletions(-)
 create mode 100644 reference-implementation/scripts/mark-storage-restored.ts

diff --git a/apps/console/src/app/(console)/lib/connection-evidence.test.ts b/apps/console/src/app/(console)/lib/connection-evidence.test.ts
index 126e4385a..709ec8b08 100644
--- a/apps/console/src/app/(console)/lib/connection-evidence.test.ts
+++ b/apps/console/src/app/(console)/lib/connection-evidence.test.ts
@@ -2359,6 +2359,7 @@ const COVERAGE_AS_OF = {
   committed_at: "2026-10-22T10:00:00.000Z",
   evidence: "terminal_run",
   run_id: "run-a",
+  run_sequence: 3,
 } as const;
 
 test("coverage chip reads 'complete as of <time>' when the reference names the run it describes", () => {
diff --git a/apps/console/src/app/(console)/lib/ref-client.ts b/apps/console/src/app/(console)/lib/ref-client.ts
index a1243a963..d696b06d8 100644
--- a/apps/console/src/app/(console)/lib/ref-client.ts
+++ b/apps/console/src/app/(console)/lib/ref-client.ts
@@ -639,6 +639,8 @@ export interface RefCoverageAsOf {
   readonly committed_at: string | null;
   readonly evidence: "terminal_run";
   readonly run_id: string;
+  /** The sequence the server issued to the run at its start; it decides which proof can be current. */
+  readonly run_sequence: number;
 }
 
 export interface RefConnectorSummary {
diff --git a/reference-implementation/operations/local-device-terminal-collection.ts b/reference-implementation/operations/local-device-terminal-collection.ts
index fe1ea5fac..a935301c8 100644
--- a/reference-implementation/operations/local-device-terminal-collection.ts
+++ b/reference-implementation/operations/local-device-terminal-collection.ts
@@ -6,7 +6,12 @@ import { canonicalTerminalRunCommitEnvelope } from "@pdpp/collector-runtime/loca
 import { canonicalTerminalRunCommitJson } from "@pdpp/reference-contract/common";
 import { fingerprintDeviceAttemptManifest } from "../server/device-ingest-attempt-context.ts";
 import { readRuntimeCollectionFact } from "../server/runtime-collection-facts.ts";
-import type { ResolvedTerminalRunCommit, TerminalRunCommitResult } from "../server/stores/terminal-run-commit-store.ts";
+import { type IssuedRunSequence, RunStartConflictError } from "../server/stores/collection-revision-store.ts";
+import type {
+  ResolvedTerminalRunCommit,
+  TerminalRunCommitResult,
+  TerminalRunReceiptLookup,
+} from "../server/stores/terminal-run-commit-store.ts";
 import {
   commitLegacyTerminalCollection,
   TerminalRunCommitConflictError,
@@ -42,6 +47,14 @@ interface TerminalContext {
 export interface TerminalRunCommitContext extends TerminalContext {
   canonicalConnectorKey: (value: string | null | undefined) => string | null;
   commitTerminalRun: (input: ResolvedTerminalRunCommit) => Promise<TerminalRunCommitResult>;
+  /**
+   * Resolve a stored receipt for this exact binding before the request is
+   * validated against the current manifest inventory. Optional: without it,
+   * the store still answers a replay, but only after validation.
+   */
+  findTerminalRunReceipt?: (
+    input: TerminalRunReceiptLookup
+  ) => Promise<TerminalRunCommitResult | null> | TerminalRunCommitResult | null;
   getConnectorManifest?: (connectorId: string) => Promise<unknown> | unknown;
   getExpectedArtifactDigest?: (connectorId: string) => string | null;
   getRegisteredCollectionProfileRelease?: (
@@ -123,6 +136,64 @@ export async function handleLocalDeviceTerminalRunCommit(input: {
       return;
     }
 
+    const canonicalEnvelope = {
+      collection_boundary: collectionBoundary,
+      commit_id: commitId,
+      // The hash MUST be recomputed over the connector id the device actually
+      // SENT, not the canonicalized one. The collector hashes the bytes it puts
+      // on the wire and compares that digest against the `envelope_hash` this
+      // route returns; substituting the canonical spelling here rehashes a
+      // different envelope, so the digests never match. The guard above is
+      // deliberately alias-tolerant, which means `claude_code` is accepted and
+      // then silently rewritten to `claude-code` — every legacy alias that is
+      // not identity (apple_photos, claude_code, google_messages,
+      // google_takeout) dead-lettered its terminal commit forever. Storage
+      // identity below stays canonical; only the hash input follows the wire.
+      connector_id: reportedConnectorId,
+      connector_instance_id: reportedConnectorInstanceId,
+      device_id: deviceId,
+      run_id: runId,
+      source_instance_id: sourceInstanceId,
+      state_delta: stateDelta,
+      terminal_facts: body.terminal_facts,
+      version,
+    } as const;
+    let canonicalJson: string;
+    try {
+      canonicalJson =
+        version === 2
+          ? JSON.stringify(
+              canonicalTerminalRunCommitEnvelope(
+                canonicalEnvelope as Parameters<typeof canonicalTerminalRunCommitEnvelope>[0]
+              )
+            )
+          : canonicalTerminalRunCommitJson(canonicalEnvelope as Parameters<typeof canonicalTerminalRunCommitJson>[0]);
+    } catch {
+      ctx.pdppError(res, 400, "invalid_request", "terminal run commit body or binding is invalid");
+      return;
+    }
+    const envelopeHash = createHash("sha256").update(canonicalJson).digest("hex");
+
+    // An exact replay of a stored record gets its stored receipt, and a
+    // different request for the same run binding is a conflict, before the
+    // request is judged against the current manifest inventory. An inventory
+    // change after the commit must not turn a replay into a 400. The binding
+    // is already authorized above, and the store compares every binding field.
+    const receipt = await ctx.findTerminalRunReceipt?.({
+      commitId,
+      connectorId: canonicalConnectorId,
+      connectorInstanceId: authorized.connectorInstance.connectorInstanceId,
+      deviceId,
+      envelopeHash,
+      runId,
+      sourceInstanceId,
+      version,
+    });
+    if (receipt) {
+      res.status(200).json(receipt.response);
+      return;
+    }
+
     const registeredReleaseResolver = ctx.getRegisteredCollectionProfileRelease;
     const registeredRelease = registeredReleaseResolver
       ? await registeredReleaseResolver(canonicalConnectorId, authorized.connectorInstance.connectorInstanceId)
@@ -165,37 +236,6 @@ export async function handleLocalDeviceTerminalRunCommit(input: {
       return;
     }
 
-    const canonicalEnvelope = {
-      collection_boundary: collectionBoundary,
-      commit_id: commitId,
-      // The hash MUST be recomputed over the connector id the device actually
-      // SENT, not the canonicalized one. The collector hashes the bytes it puts
-      // on the wire and compares that digest against the `envelope_hash` this
-      // route returns; substituting the canonical spelling here rehashes a
-      // different envelope, so the digests never match. The guard above is
-      // deliberately alias-tolerant, which means `claude_code` is accepted and
-      // then silently rewritten to `claude-code` — every legacy alias that is
-      // not identity (apple_photos, claude_code, google_messages,
-      // google_takeout) dead-lettered its terminal commit forever. Storage
-      // identity below stays canonical; only the hash input follows the wire.
-      connector_id: reportedConnectorId,
-      connector_instance_id: reportedConnectorInstanceId,
-      device_id: deviceId,
-      run_id: runId,
-      source_instance_id: sourceInstanceId,
-      state_delta: stateDelta,
-      terminal_facts: body.terminal_facts,
-      version,
-    } as const;
-    const canonicalJson =
-      version === 2
-        ? JSON.stringify(
-            canonicalTerminalRunCommitEnvelope(
-              canonicalEnvelope as Parameters<typeof canonicalTerminalRunCommitEnvelope>[0]
-            )
-          )
-        : canonicalTerminalRunCommitJson(canonicalEnvelope as Parameters<typeof canonicalTerminalRunCommitJson>[0]);
-    const envelopeHash = createHash("sha256").update(canonicalJson).digest("hex");
     const result = await ctx.commitTerminalRun({
       collectionBoundary,
       commitId,
@@ -224,6 +264,74 @@ export async function handleLocalDeviceTerminalRunCommit(input: {
   }
 }
 
+export interface RunStartContext extends TerminalContext {
+  canonicalConnectorKey: (value: string | null | undefined) => string | null;
+  issueRunSequence: (input: {
+    readonly connectorInstanceId: string;
+    readonly deviceId: string;
+    readonly runId: string;
+    readonly sourceInstanceId: string;
+  }) => Promise<{ readonly issued: IssuedRunSequence; readonly replayed: boolean }>;
+}
+
+/**
+ * Register a run at its start and answer its run sequence. The sequence is
+ * connection-scoped and issued under the connection row lock, so runs from
+ * several devices are ordered by start. Only a run with a sequence can
+ * produce an eligible positive coverage proof. An exact replay returns the
+ * stored sequence; a run id registered to another device or source is a 409.
+ */
+export async function handleLocalDeviceRunStart(input: {
+  ctx: RunStartContext;
+  req: TerminalRequest;
+  res: TerminalResponse;
+  resolveAuthorizedSource: (deviceId: string, sourceInstanceId: string) => Promise<AuthorizedSource | null>;
+}): Promise<void> {
+  const { ctx, req, res } = input;
+  try {
+    const deviceId = decodeURIComponent(req.params.deviceId as string);
+    const sourceInstanceId = decodeURIComponent(req.params.sourceInstanceId as string);
+    if (deviceId !== req.deviceExporter?.deviceId) {
+      ctx.pdppError(res, 403, "permission_error", "Device credential is not valid for this device");
+      return;
+    }
+    const authorized = await input.resolveAuthorizedSource(deviceId, sourceInstanceId);
+    if (!authorized) {
+      return;
+    }
+    const body = asObject(req.body);
+    const runId = body && readRequiredString(body.run_id);
+    const reportedConnectorId = body && readRequiredString(body.connector_id);
+    const canonicalConnectorId = ctx.canonicalConnectorKey(authorized.sourceInstance.connectorId);
+    const reportedConnectorKey = reportedConnectorId
+      ? (ctx.canonicalConnectorKey(reportedConnectorId) ?? reportedConnectorId)
+      : null;
+    if (!(runId && canonicalConnectorId) || reportedConnectorKey !== canonicalConnectorId) {
+      ctx.pdppError(res, 400, "invalid_request", "run start requires run_id and the source's connector_id");
+      return;
+    }
+    const { issued, replayed } = await ctx.issueRunSequence({
+      connectorInstanceId: authorized.connectorInstance.connectorInstanceId,
+      deviceId,
+      runId,
+      sourceInstanceId,
+    });
+    res.status(replayed ? 200 : 201).json({
+      connector_instance_id: issued.connectorInstanceId,
+      object: "device_run_start",
+      run_id: issued.runId,
+      run_sequence: issued.runSequence,
+      storage_epoch: issued.storageEpoch,
+    });
+  } catch (error) {
+    if (error instanceof RunStartConflictError) {
+      ctx.pdppError(res, 409, "run_start_conflict", "Run id is already registered to another device or source.");
+      return;
+    }
+    ctx.handleError(res, error);
+  }
+}
+
 /**
  * Turns an explicit local collector terminal report into the existing
  * terminal-event/fold contract. The report carries raw collector coverage
diff --git a/reference-implementation/scripts/mark-storage-restored.ts b/reference-implementation/scripts/mark-storage-restored.ts
new file mode 100644
index 000000000..fc478aaea
--- /dev/null
+++ b/reference-implementation/scripts/mark-storage-restored.ts
@@ -0,0 +1,57 @@
+#!/usr/bin/env node
+
+// Copyright The PDP-Connect Contributors
+// SPDX-License-Identifier: Apache-2.0
+
+/**
+ * The storage-epoch restore step. Run it after restoring a database backup and
+ * before the server serves requests.
+ *
+ * A restore can regress the run sequences the server issued, the run-order
+ * marker and the coverage proof tables, so a restored proof could otherwise
+ * read as current again. This step starts a new storage epoch for every
+ * connection (server/stores/collection-revision-store.ts,
+ * `beginStorageEpochAfterRestore`): no proof committed before it can be current
+ * until a run issued after it commits a new one. It also increments the config
+ * pointer's storage epoch, which is documented for the same event.
+ *
+ * A restore that skips this step is not detected. See
+ * docs/261021-local-device-coverage-evidence.md, "Run order and commit order".
+ *
+ * Usage (from reference-implementation/):
+ *   node --import tsx scripts/mark-storage-restored.ts --db <path to the SQLite database>
+ *   PDPP_DATABASE_URL=<postgres url> node --import tsx scripts/mark-storage-restored.ts
+ */
+
+import { closeDb, initDb } from "../server/db.ts";
+import { closePostgresStorage, initPostgresStorage } from "../server/postgres-storage.ts";
+import { beginStorageEpochAfterRestore } from "../server/stores/collection-revision-store.ts";
+
+async function main(argv: readonly string[]): Promise<void> {
+  const databaseUrl = process.env.PDPP_DATABASE_URL;
+  const dbFlag = argv.indexOf("--db");
+  const dbPath = dbFlag >= 0 ? argv[dbFlag + 1] : undefined;
+  if (!(databaseUrl || dbPath)) {
+    throw new Error("Usage: mark-storage-restored.ts --db <sqlite path>, or set PDPP_DATABASE_URL for PostgreSQL");
+  }
+  if (databaseUrl) {
+    initDb(":memory:");
+    await initPostgresStorage({ backend: "postgres", databaseUrl } as Parameters<typeof initPostgresStorage>[0]);
+  } else {
+    initDb(dbPath);
+  }
+  try {
+    const { connections } = await beginStorageEpochAfterRestore();
+    process.stdout.write(`storage epoch advanced for ${connections} connection(s)\n`);
+  } finally {
+    if (databaseUrl) {
+      await closePostgresStorage();
+    }
+    closeDb();
+  }
+}
+
+main(process.argv.slice(2)).catch((error: unknown) => {
+  process.stderr.write(`${error instanceof Error ? error.message : String(error)}\n`);
+  process.exit(1);
+});
diff --git a/reference-implementation/server/backup-table-policy.ts b/reference-implementation/server/backup-table-policy.ts
index 39bb7cc12..95663dcaf 100644
--- a/reference-implementation/server/backup-table-policy.ts
+++ b/reference-implementation/server/backup-table-policy.ts
@@ -74,6 +74,11 @@ export const BACKUP_TABLE_INVENTORY: Record<string, BackupTableInventoryEntry> =
     classification: "backup_required",
     reason: "Subscriptions are durable client delivery configuration.",
   },
+  collection_run_sequences: {
+    classification: "backup_required",
+    reason:
+      "The run sequence the server issued to each run at its start, with its storage epoch. It decides whether a terminal coverage proof can be current, and cannot be rebuilt from any other table. A restore that regresses it must be followed by the storage-epoch restore step (scripts/mark-storage-restored.ts).",
+  },
   connector_accepted_declarations: {
     classification: "backup_required",
     reason:
diff --git a/reference-implementation/server/db.ts b/reference-implementation/server/db.ts
index cb01adf1a..9fdbac862 100644
--- a/reference-implementation/server/db.ts
+++ b/reference-implementation/server/db.ts
@@ -3010,6 +3010,29 @@ function ensureCollectionRevisionColumns(raw: SqliteDatabase): void {
   addColumnIfMissing(raw, "connector_instances", "collection_revision_run_id", "TEXT");
   addColumnIfMissing(raw, "connector_instances", "collection_revision_at", "TEXT");
   addColumnIfMissing(raw, "connector_state", "collection_revision", "INTEGER");
+  // Run order (collection-revision-store.ts): the last issued run sequence, the
+  // storage epoch a restore step increments, and the newest observation of the
+  // highest observed run sequence. A positive proof is eligible only while it
+  // is that observation, in the current storage epoch.
+  addColumnIfMissing(raw, "connector_instances", "run_sequence_issued", "INTEGER NOT NULL DEFAULT 0");
+  addColumnIfMissing(raw, "connector_instances", "storage_epoch", "INTEGER NOT NULL DEFAULT 1");
+  addColumnIfMissing(raw, "connector_instances", "run_order_sequence", "INTEGER NOT NULL DEFAULT 0");
+  addColumnIfMissing(raw, "connector_instances", "run_order_event", "TEXT");
+  addColumnIfMissing(raw, "connector_instances", "run_order_run_id", "TEXT");
+  addColumnIfMissing(raw, "connector_instances", "run_order_revision", "INTEGER");
+  raw.exec(`
+    CREATE TABLE IF NOT EXISTS collection_run_sequences (
+      connector_instance_id TEXT NOT NULL
+        REFERENCES connector_instances(connector_instance_id) ON DELETE CASCADE,
+      run_id TEXT NOT NULL,
+      run_sequence INTEGER NOT NULL,
+      storage_epoch INTEGER NOT NULL,
+      device_id TEXT NOT NULL,
+      source_instance_id TEXT NOT NULL,
+      issued_at TEXT NOT NULL,
+      PRIMARY KEY (connector_instance_id, run_id)
+    )
+  `);
 }
 
 function ensureConnectorSummaryEvidenceColumns(raw: SqliteDatabase): void {
diff --git a/reference-implementation/server/postgres-storage.ts b/reference-implementation/server/postgres-storage.ts
index e3d4d93cf..e42a91172 100644
--- a/reference-implementation/server/postgres-storage.ts
+++ b/reference-implementation/server/postgres-storage.ts
@@ -1852,6 +1852,30 @@ async function bootstrapPostgresSchemaOnce({
         ADD COLUMN IF NOT EXISTS collection_revision_run_id TEXT;
       ALTER TABLE connector_instances
         ADD COLUMN IF NOT EXISTS collection_revision_at TEXT;
+      -- Run order: see ensureCollectionRevisionColumns in db.ts.
+      ALTER TABLE connector_instances
+        ADD COLUMN IF NOT EXISTS run_sequence_issued BIGINT NOT NULL DEFAULT 0;
+      ALTER TABLE connector_instances
+        ADD COLUMN IF NOT EXISTS storage_epoch BIGINT NOT NULL DEFAULT 1;
+      ALTER TABLE connector_instances
+        ADD COLUMN IF NOT EXISTS run_order_sequence BIGINT NOT NULL DEFAULT 0;
+      ALTER TABLE connector_instances
+        ADD COLUMN IF NOT EXISTS run_order_event TEXT;
+      ALTER TABLE connector_instances
+        ADD COLUMN IF NOT EXISTS run_order_run_id TEXT;
+      ALTER TABLE connector_instances
+        ADD COLUMN IF NOT EXISTS run_order_revision BIGINT;
+      CREATE TABLE IF NOT EXISTS collection_run_sequences (
+        connector_instance_id TEXT NOT NULL
+          REFERENCES connector_instances(connector_instance_id) ON DELETE CASCADE,
+        run_id TEXT NOT NULL,
+        run_sequence BIGINT NOT NULL,
+        storage_epoch BIGINT NOT NULL,
+        device_id TEXT NOT NULL,
+        source_instance_id TEXT NOT NULL,
+        issued_at TEXT NOT NULL,
+        PRIMARY KEY (connector_instance_id, run_id)
+      );
 
       -- Existing Postgres deployments may have been bootstrapped before the
       -- static-secret draft lifecycle existed. Widen the status CHECK in place
diff --git a/reference-implementation/server/ref-control.ts b/reference-implementation/server/ref-control.ts
index 2ae61b7e2..9da5380e4 100644
--- a/reference-implementation/server/ref-control.ts
+++ b/reference-implementation/server/ref-control.ts
@@ -4852,6 +4852,8 @@ export interface LocalCoverageAsOf {
   readonly committed_at: string | null;
   readonly evidence: "terminal_run";
   readonly run_id: string;
+  /** The sequence the server issued to the run at its start. */
+  readonly run_sequence: number;
 }
 
 const LOCAL_COVERAGE_ACCOUNTED_STATUSES = new Set([
@@ -5179,6 +5181,8 @@ function localProofRunCoverage(
   readonly collectionRevision: number | null;
   readonly run: Pick<ConnectorRunSummary, "last_at" | "local_terminal_coverage">;
   readonly runId: string;
+  readonly runSequence: number | null;
+  readonly storageEpoch: number | null;
 } | null {
   const proofRun = fence?.proofRun;
   // A terminal run record always has a completion time; one without it is not a proof.
@@ -5203,27 +5207,33 @@ function localProofRunCoverage(
     collectionRevision: readCollectionRevision(proofRun.facts?.collection_revision),
     run: { last_at: proofRun.completedAt, local_terminal_coverage: terminal },
     runId: proofRun.runId,
+    runSequence: readCollectionRevision(proofRun.facts?.run_sequence),
+    storageEpoch: readCollectionRevision(proofRun.facts?.storage_epoch),
   };
 }
 
 /**
- * Keep a local coverage proof only while it is the connection's newest
- * observed collection event.
+ * Keep a local coverage proof only while it is the run-order marker: the
+ * newest observation of the highest observed run sequence, in the current
+ * storage epoch.
  *
- * The server assigns each event that can establish or retire proof a
- * monotonic per-connection revision at commit (state commits, terminal runs,
- * admitted and refused batches, delivered failure reports). A proof binds to
- * the revision it was committed at. It is current only when that revision is
- * the high-water mark; any later event retires it to unknown. No wall clock is
- * compared. The proof must also be the terminal run the high-water mark names,
- * and it must name its release digest.
+ * Run order decides eligibility. The server issues each run a sequence at its
+ * start, and every observation that takes a commit revision (state commits,
+ * terminal runs, admitted and refused batches, delivered failure reports) also
+ * moves the marker when its run sequence is at least the highest observed one.
+ * A proof is current only when the marker is its terminal record: the same
+ * run, sequence and commit revision, in the connection's current storage
+ * epoch. An older run's proof that arrives after a newer run's terminal record
+ * stays history. The commit revision orders observations and dates the as-of.
+ * No wall clock is compared. The proof must also name its release digest.
  *
  * Only a v2 terminal run record is a positive proof. A legacy
  * `coverage_diagnostics` state row names no run and no release, so it never
  * shows positive coverage: the projection is unknown.
  *
- * Fails closed: a missing fence, an unreadable or NULL revision, any
- * mismatch, a proof without a single release digest, or a newest settled
+ * Fails closed: a missing fence, an unreadable or NULL revision, sequence or
+ * epoch, a run without an issued sequence, any mismatch, a proof without a
+ * single release digest, or a newest settled
  * device run that is not the proof and carries no revision, whose order is
  * ambiguous, is unknown coverage.
  */
@@ -5236,7 +5246,7 @@ function fenceLocalCoverageProof(
   if (axis === null || axis.axis === "unknown") {
     return axis;
   }
-  const highWater = fence?.highWater ?? null;
+  const runOrder = fence?.runOrder ?? null;
   // A settled device run record with no revision cannot be ordered against a
   // terminal proof (a pre-revision row, or a writer that assigns none). If it
   // is the newest settled run and not the proof itself, the order is
@@ -5251,16 +5261,21 @@ function fenceLocalCoverageProof(
     terminal &&
     !unorderedLaterRun &&
     terminal.artifactDigest !== null &&
-    highWater?.event === "terminal_run" &&
-    highWater.runId === terminal.runId &&
+    runOrder?.event === "terminal_run" &&
+    runOrder.runId === terminal.runId &&
     terminal.collectionRevision !== null &&
-    terminal.collectionRevision === highWater.revision
+    terminal.collectionRevision === runOrder.revision &&
+    terminal.runSequence !== null &&
+    terminal.runSequence === runOrder.sequence &&
+    terminal.storageEpoch !== null &&
+    terminal.storageEpoch === fence?.storageEpoch
       ? {
           artifact_digest: terminal.artifactDigest,
-          collection_revision: highWater.revision,
+          collection_revision: terminal.collectionRevision,
           committed_at: terminal.run.last_at ?? null,
           evidence: "terminal_run",
           run_id: terminal.runId,
+          run_sequence: terminal.runSequence,
         }
       : null;
   if (!asOf) {
diff --git a/reference-implementation/server/routes/ref-device-exporters.ts b/reference-implementation/server/routes/ref-device-exporters.ts
index 53d4505d9..dfa3084f3 100644
--- a/reference-implementation/server/routes/ref-device-exporters.ts
+++ b/reference-implementation/server/routes/ref-device-exporters.ts
@@ -28,6 +28,7 @@
 import { createHash } from "node:crypto";
 import type { CollectionScope } from "@pdpp/reference-contract/evidence";
 import {
+  handleLocalDeviceRunStart,
   handleLocalDeviceTerminalCollection,
   handleLocalDeviceTerminalRunCommit,
   type RegisteredCollectionProfileRelease,
@@ -43,9 +44,10 @@ import type { LocalCoverageAsOf } from "../ref-control.ts";
 import {
   type CollectionRevisionEventInput,
   isCollectionRevisionUnavailable,
+  issueCollectionRunSequence,
   recordCollectionRevisionEvent,
 } from "../stores/collection-revision-store.ts";
-import { commitTerminalRun } from "../stores/terminal-run-commit-store.ts";
+import { commitTerminalRun, findTerminalRunReceipt } from "../stores/terminal-run-commit-store.ts";
 import type { MiddlewareHandler, PdppErrorFn, RouteArg } from "./_route-contract.ts";
 import {
   type EnrolledSourceKind,
@@ -3136,6 +3138,7 @@ export function mountRefDeviceExporterSourceInstanceStatePut(app: AppLike, ctx:
   );
   mountRefDeviceExporterTerminalCollection(app, ctx);
   mountRefDeviceExporterTerminalRunCommit(app, ctx);
+  mountRefDeviceExporterRunStart(app, ctx);
 }
 
 // POST /_ref/device-exporters/:deviceId/source-instances/:sourceInstanceId/terminal-collection
@@ -3169,6 +3172,7 @@ export function mountRefDeviceExporterTerminalRunCommit(app: AppLike, ctx: Mount
         ctx: {
           ...ctx,
           commitTerminalRun: ctx.commitTerminalRun ?? commitTerminalRun,
+          findTerminalRunReceipt,
         },
         req,
         res,
@@ -3178,6 +3182,22 @@ export function mountRefDeviceExporterTerminalRunCommit(app: AppLike, ctx: Mount
   );
 }
 
+// POST /_ref/device-exporters/:deviceId/source-instances/:sourceInstanceId/run-starts
+export function mountRefDeviceExporterRunStart(app: AppLike, ctx: MountRefDeviceExportersContext): void {
+  app.post(
+    "/_ref/device-exporters/:deviceId/source-instances/:sourceInstanceId/run-starts",
+    ctx.requireDeviceExporterCredential,
+    async (req: RouteRequest, res: RouteResponse) =>
+      await handleLocalDeviceRunStart({
+        ctx: { ...ctx, issueRunSequence: issueCollectionRunSequence },
+        req,
+        res,
+        resolveAuthorizedSource: async (deviceId, sourceInstanceId) =>
+          await resolveAuthorizedDeviceSource(ctx, req, res, deviceId, sourceInstanceId, { notFoundStatus: 404 }),
+      })
+  );
+}
+
 // Shared body-parsing helpers for the two local-collector-gap routes.
 // Extracted to reduce cognitive complexity of each handler.
 
diff --git a/reference-implementation/server/stores/collection-revision-store.ts b/reference-implementation/server/stores/collection-revision-store.ts
index 2a54fa7c7..d192dfaf7 100644
--- a/reference-implementation/server/stores/collection-revision-store.ts
+++ b/reference-implementation/server/stores/collection-revision-store.ts
@@ -14,7 +14,18 @@
 // it orders (a record write, a batch acceptance, a stored failure report, a
 // terminal run), so the event and its revision commit or roll back together.
 // A refusal has no other durable effect: its revision is its only write.
+//
+// The revision orders observations; it does not decide which proof is
+// eligible. Run order does: the server issues each run a sequence at its start
+// (`issueCollectionRunSequence`), and every observation also moves a run-order
+// marker when its run sequence is at least the highest one observed. An
+// observation that names no issued run is attributed to the newest issued
+// sequence with no run id, so it can retire a proof but never establish one.
+// A proof is eligible only while it is that marker, in the current storage
+// epoch. See docs/261021-local-device-coverage-evidence.md, "Run order and
+// commit order".
 
+import { writeTransaction } from "../../lib/db.ts";
 import { getDb } from "../db.ts";
 import { COLLECTION_SCOPE_STATE_KEY, readStoredCollectionScope } from "../local-collection-scope.ts";
 import { isPostgresStorageBackend, postgresQuery, withPostgresTransaction } from "../postgres-storage.ts";
@@ -43,7 +54,7 @@ export interface CollectionRevisionHighWater {
 }
 
 interface SqliteHandle {
-  prepare: (sql: string) => { get: (...params: unknown[]) => unknown };
+  prepare: (sql: string) => { get: (...params: unknown[]) => unknown; run: (...params: unknown[]) => unknown };
 }
 
 interface PostgresHandle {
@@ -93,7 +104,37 @@ export function readCollectionRevision(value: unknown): number | null {
   return typeof revision === "number" && Number.isSafeInteger(revision) && revision >= 0 ? revision : null;
 }
 
-type AdvancedRevision = { readonly manifestGeneration: number; readonly revision: number };
+interface AdvancedRevision {
+  readonly manifestGeneration: number;
+  readonly revision: number;
+  /** The issued sequence of the run the observation names, or null when it names no run issued in this epoch. */
+  readonly runSequence: number | null;
+  readonly storageEpoch: number;
+}
+
+// Move the run-order marker for an observation that has just taken `revision`.
+// The observation's run sequence is its own run's issued sequence in the
+// current storage epoch, else the newest issued sequence (with no run id). The
+// marker moves when that sequence is at least the highest observed one. The
+// caller's revision UPDATE already holds the connection row lock.
+const RUN_ORDER_OBSERVATION = `SELECT COALESCE(rs.run_sequence, ci.run_sequence_issued) AS seq,
+                rs.run_id AS run_id, rs.run_sequence AS run_sequence, ci.storage_epoch AS storage_epoch
+           FROM connector_instances ci
+           LEFT JOIN collection_run_sequences rs
+             ON rs.connector_instance_id = ci.connector_instance_id
+            AND rs.run_id = $RUN
+            AND rs.storage_epoch = ci.storage_epoch
+          WHERE ci.connector_instance_id = $CI`;
+
+function readEpoch(value: unknown): number {
+  const epoch = readCollectionRevision(value);
+  // An unreadable epoch can never equal a proof's epoch, so the proof fails closed.
+  return epoch ?? -1;
+}
+
+function readRunSequence(value: unknown): number | null {
+  return value === null || value === undefined ? null : readCollectionRevision(value);
+}
 
 /**
  * Read the result of a guarded advance. No returned row means either no
@@ -106,7 +147,7 @@ function advancedRevision(
   connectionExists: () => boolean,
   connectorInstanceId: string,
   event: CollectionRevisionEvent
-): AdvancedRevision | null {
+): Pick<AdvancedRevision, "manifestGeneration" | "revision"> | null {
   if (!row) {
     if (connectionExists()) {
       throw new CollectionRevisionUnavailableError(connectorInstanceId, event);
@@ -120,6 +161,36 @@ function advancedRevision(
   return { manifestGeneration: Number(row.manifest_generation ?? 0), revision };
 }
 
+interface RunOrderObservationRow {
+  run_id: string | null;
+  run_sequence: unknown;
+  seq: unknown;
+  storage_epoch: unknown;
+}
+
+/** The marker values for an observation, or throws when its run sequence cannot be read. */
+function runOrderObservation(
+  row: RunOrderObservationRow | undefined,
+  connectorInstanceId: string,
+  event: CollectionRevisionEvent
+): {
+  readonly runId: string | null;
+  readonly runSequence: number | null;
+  readonly seq: number;
+  readonly storageEpoch: number;
+} {
+  const seq = readCollectionRevision(row?.seq);
+  if (!row || seq === null) {
+    throw new CollectionRevisionUnavailableError(connectorInstanceId, event);
+  }
+  return {
+    runId: typeof row.run_id === "string" ? row.run_id : null,
+    runSequence: readRunSequence(row.run_sequence),
+    seq,
+    storageEpoch: readEpoch(row.storage_epoch),
+  };
+}
+
 /**
  * Advance the revision on an open SQLite transaction. Returns the new revision
  * and the connection's manifest generation, or `null` when no connection row
@@ -140,7 +211,7 @@ export function advanceSqliteCollectionRevisionInTransaction(
     .get(input.event, input.runId ?? null, input.at, connectorInstanceId) as
     | { collection_revision: unknown; manifest_generation: unknown }
     | undefined;
-  return advancedRevision(
+  const advanced = advancedRevision(
     row,
     () =>
       db
@@ -149,6 +220,22 @@ export function advanceSqliteCollectionRevisionInTransaction(
     connectorInstanceId,
     input.event
   );
+  if (!advanced) {
+    return null;
+  }
+  const observation = runOrderObservation(
+    db
+      .prepare(RUN_ORDER_OBSERVATION.replace("$RUN", "?").replace("$CI", "?"))
+      .get(input.runId ?? null, connectorInstanceId) as RunOrderObservationRow | undefined,
+    connectorInstanceId,
+    input.event
+  );
+  db.prepare(
+    `UPDATE connector_instances
+        SET run_order_sequence = ?, run_order_event = ?, run_order_run_id = ?, run_order_revision = ?
+      WHERE connector_instance_id = ? AND run_order_sequence <= ?`
+  ).run(observation.seq, input.event, observation.runId, advanced.revision, connectorInstanceId, observation.seq);
+  return { ...advanced, runSequence: observation.runSequence, storageEpoch: observation.storageEpoch };
 }
 
 /**
@@ -182,33 +269,70 @@ export async function advancePostgresCollectionRevisionInTransaction(
           connectorInstanceId,
         ])
       ).rows.length > 0;
-  return advancedRevision(row, () => exists, connectorInstanceId, input.event);
+  const advanced = advancedRevision(row, () => exists, connectorInstanceId, input.event);
+  if (!advanced) {
+    return null;
+  }
+  const observed = await client.query(RUN_ORDER_OBSERVATION.replace("$RUN", "$1").replace("$CI", "$2"), [
+    input.runId ?? null,
+    connectorInstanceId,
+  ]);
+  const observation = runOrderObservation(
+    observed.rows[0] as RunOrderObservationRow | undefined,
+    connectorInstanceId,
+    input.event
+  );
+  await client.query(
+    `UPDATE connector_instances
+        SET run_order_sequence = $1, run_order_event = $2, run_order_run_id = $3, run_order_revision = $4
+      WHERE connector_instance_id = $5 AND run_order_sequence <= $1`,
+    [observation.seq, input.event, observation.runId, advanced.revision, connectorInstanceId]
+  );
+  return { ...advanced, runSequence: observation.runSequence, storageEpoch: observation.storageEpoch };
 }
 
 /** Advance on an open SQLite transaction, or throw (also when no connection row exists) so the caller's event rolls back with it. */
-export function requireSqliteCollectionRevisionInTransaction(
+export function requireSqliteCollectionObservationInTransaction(
   db: SqliteHandle,
   connectorInstanceId: string,
   input: CollectionRevisionEventInput
-): number {
+): AdvancedRevision {
   const advanced = advanceSqliteCollectionRevisionInTransaction(db, connectorInstanceId, input);
   if (!advanced) {
     throw new CollectionRevisionUnavailableError(connectorInstanceId, input.event);
   }
-  return advanced.revision;
+  return advanced;
+}
+
+/** `requireSqliteCollectionObservationInTransaction`, returning only the revision. */
+export function requireSqliteCollectionRevisionInTransaction(
+  db: SqliteHandle,
+  connectorInstanceId: string,
+  input: CollectionRevisionEventInput
+): number {
+  return requireSqliteCollectionObservationInTransaction(db, connectorInstanceId, input).revision;
 }
 
 /** Advance on an open Postgres transaction, or throw (also when no connection row exists) so the caller's event rolls back with it. */
-export async function requirePostgresCollectionRevisionInTransaction(
+export async function requirePostgresCollectionObservationInTransaction(
   client: PostgresHandle,
   connectorInstanceId: string,
   input: CollectionRevisionEventInput
-): Promise<number> {
+): Promise<AdvancedRevision> {
   const advanced = await advancePostgresCollectionRevisionInTransaction(client, connectorInstanceId, input);
   if (!advanced) {
     throw new CollectionRevisionUnavailableError(connectorInstanceId, input.event);
   }
-  return advanced.revision;
+  return advanced;
+}
+
+/** `requirePostgresCollectionObservationInTransaction`, returning only the revision. */
+export async function requirePostgresCollectionRevisionInTransaction(
+  client: PostgresHandle,
+  connectorInstanceId: string,
+  input: CollectionRevisionEventInput
+): Promise<number> {
+  return (await requirePostgresCollectionObservationInTransaction(client, connectorInstanceId, input)).revision;
 }
 
 /**
@@ -226,7 +350,185 @@ export async function recordCollectionRevisionEvent(
         await requirePostgresCollectionRevisionInTransaction(client as PostgresHandle, connectorInstanceId, input)
     );
   }
-  return requireSqliteCollectionRevisionInTransaction(getDb(), connectorInstanceId, input);
+  // The revision and the run-order marker commit together.
+  return writeTransaction(() => requireSqliteCollectionRevisionInTransaction(getDb(), connectorInstanceId, input));
+}
+
+/** The sequence the server issued to one run at its start. */
+export interface IssuedRunSequence {
+  readonly connectorInstanceId: string;
+  readonly runId: string;
+  readonly runSequence: number;
+  readonly storageEpoch: number;
+}
+
+/** The run id is already registered to a different device or source. Nothing was written. */
+export class RunStartConflictError extends Error {
+  readonly code = "run_start_conflict";
+
+  constructor() {
+    super("Run id is already registered to a different device or source.");
+    this.name = "RunStartConflictError";
+  }
+}
+
+interface IssuedRow {
+  device_id: string;
+  run_sequence: unknown;
+  source_instance_id: string;
+  storage_epoch: unknown;
+}
+
+function issuedFromRow(
+  input: {
+    readonly connectorInstanceId: string;
+    readonly deviceId: string;
+    readonly runId: string;
+    readonly sourceInstanceId: string;
+  },
+  row: IssuedRow
+): IssuedRunSequence {
+  const runSequence = readCollectionRevision(row.run_sequence);
+  const storageEpoch = readCollectionRevision(row.storage_epoch);
+  if (row.device_id !== input.deviceId || row.source_instance_id !== input.sourceInstanceId) {
+    throw new RunStartConflictError();
+  }
+  if (runSequence === null || storageEpoch === null) {
+    throw new Error(`collection run sequence unreadable connector_instance_id=${input.connectorInstanceId}`);
+  }
+  return { connectorInstanceId: input.connectorInstanceId, runId: input.runId, runSequence, storageEpoch };
+}
+
+/**
+ * Issue the next run sequence for a connection at run start, or return the
+ * one already issued to this run. The connection row lock serializes issuance,
+ * so runs from several devices get distinct sequences in start order. A run id
+ * registered to a different device or source is a conflict.
+ */
+export async function issueCollectionRunSequence(input: {
+  readonly connectorInstanceId: string;
+  readonly deviceId: string;
+  readonly runId: string;
+  readonly sourceInstanceId: string;
+}): Promise<{ readonly issued: IssuedRunSequence; readonly replayed: boolean }> {
+  const issuedAt = new Date().toISOString();
+  if (isPostgresStorageBackend()) {
+    return await withPostgresTransaction(async (client) => {
+      const handle = client as PostgresHandle;
+      const locked = await handle.query(
+        "SELECT 1 AS present FROM connector_instances WHERE connector_instance_id = $1 FOR UPDATE",
+        [input.connectorInstanceId]
+      );
+      if (locked.rows.length === 0) {
+        throw new Error(`no connection for run start connector_instance_id=${input.connectorInstanceId}`);
+      }
+      const existing = await handle.query(
+        `SELECT device_id, source_instance_id, run_sequence, storage_epoch
+           FROM collection_run_sequences WHERE connector_instance_id = $1 AND run_id = $2`,
+        [input.connectorInstanceId, input.runId]
+      );
+      if (existing.rows[0]) {
+        return { issued: issuedFromRow(input, existing.rows[0] as IssuedRow), replayed: true };
+      }
+      const advanced = await handle.query(
+        `UPDATE connector_instances SET run_sequence_issued = run_sequence_issued + 1
+          WHERE connector_instance_id = $1
+          RETURNING run_sequence_issued AS run_sequence, storage_epoch`,
+        [input.connectorInstanceId]
+      );
+      const row = advanced.rows[0] as { run_sequence: unknown; storage_epoch: unknown };
+      await handle.query(
+        `INSERT INTO collection_run_sequences
+           (connector_instance_id, run_id, run_sequence, storage_epoch, device_id, source_instance_id, issued_at)
+         VALUES ($1, $2, $3, $4, $5, $6, $7)`,
+        [
+          input.connectorInstanceId,
+          input.runId,
+          row.run_sequence,
+          row.storage_epoch,
+          input.deviceId,
+          input.sourceInstanceId,
+          issuedAt,
+        ]
+      );
+      return {
+        issued: issuedFromRow(input, { ...row, device_id: input.deviceId, source_instance_id: input.sourceInstanceId }),
+        replayed: false,
+      };
+    });
+  }
+  return writeTransaction(() => {
+    const db = getDb();
+    const existing = db
+      .prepare(
+        `SELECT device_id, source_instance_id, run_sequence, storage_epoch
+           FROM collection_run_sequences WHERE connector_instance_id = ? AND run_id = ?`
+      )
+      .get(input.connectorInstanceId, input.runId) as IssuedRow | undefined;
+    if (existing) {
+      return { issued: issuedFromRow(input, existing), replayed: true };
+    }
+    const row = db
+      .prepare(
+        `UPDATE connector_instances SET run_sequence_issued = run_sequence_issued + 1
+          WHERE connector_instance_id = ?
+          RETURNING run_sequence_issued AS run_sequence, storage_epoch`
+      )
+      .get(input.connectorInstanceId) as { run_sequence: unknown; storage_epoch: unknown } | undefined;
+    if (!row) {
+      throw new Error(`no connection for run start connector_instance_id=${input.connectorInstanceId}`);
+    }
+    db.prepare(
+      `INSERT INTO collection_run_sequences
+         (connector_instance_id, run_id, run_sequence, storage_epoch, device_id, source_instance_id, issued_at)
+       VALUES (?, ?, ?, ?, ?, ?, ?)`
+    ).run(
+      input.connectorInstanceId,
+      input.runId,
+      row.run_sequence,
+      row.storage_epoch,
+      input.deviceId,
+      input.sourceInstanceId,
+      issuedAt
+    );
+    return {
+      issued: issuedFromRow(input, { ...row, device_id: input.deviceId, source_instance_id: input.sourceInstanceId }),
+      replayed: false,
+    };
+  });
+}
+
+/**
+ * The restore step. A restore can regress the issued sequences, the run-order
+ * marker and the proof tables, so it starts a new storage epoch: every
+ * connection's epoch, and the config pointer's epoch documented for the same
+ * event, increase by one in one transaction. Proofs and issued sequences from
+ * before the step no longer match the current epoch, so no pre-restore proof
+ * can be current until a run issued after the step commits one. Run it after
+ * restoring the database and before the server serves requests
+ * (scripts/mark-storage-restored.ts).
+ */
+export async function beginStorageEpochAfterRestore(): Promise<{ readonly connections: number }> {
+  const statements = [
+    "UPDATE connector_instances SET storage_epoch = storage_epoch + 1",
+    "UPDATE connector_instance_config_current SET storage_epoch = storage_epoch + 1",
+  ] as const;
+  if (isPostgresStorageBackend()) {
+    return await withPostgresTransaction(async (client) => {
+      const handle = client as unknown as {
+        query: (sql: string, params: readonly unknown[]) => Promise<{ readonly rowCount: number | null }>;
+      };
+      const connections = await handle.query(statements[0], []);
+      await handle.query(statements[1], []);
+      return { connections: Number(connections.rowCount ?? 0) };
+    });
+  }
+  return writeTransaction(() => {
+    const db = getDb();
+    const connections = db.prepare(statements[0]).run() as { changes: number | bigint };
+    db.prepare(statements[1]).run();
+    return { connections: Number(connections.changes) };
+  });
 }
 
 /** The terminal run record the high-water mark names, read by run id rather than by completion time. */
@@ -262,6 +564,18 @@ export interface LocalCoverageRevisionFence {
   readonly boundary: LocalCoverageProofBoundary;
   readonly highWater: CollectionRevisionHighWater | null;
   readonly proofRun: LocalCoverageProofRun | null;
+  /** The newest observation of the highest observed run sequence; null when unreadable. */
+  readonly runOrder: RunOrderMarker | null;
+  /** The connection's current storage epoch; null when unreadable. */
+  readonly storageEpoch: number | null;
+}
+
+/** The run-order marker: the newest observation of the highest observed run sequence. */
+export interface RunOrderMarker {
+  readonly event: string | null;
+  readonly revision: number | null;
+  readonly runId: string | null;
+  readonly sequence: number;
 }
 
 let fenceReadHook: ((connectorInstanceIds: readonly string[]) => Promise<void> | void) | null = null;
@@ -298,6 +612,23 @@ function declaredScopeFingerprint(stateJson: unknown): string {
   return readStoredCollectionScope({ [COLLECTION_SCOPE_STATE_KEY]: parsed ?? null }).fingerprint;
 }
 
+function readRunOrderMarker(row: {
+  run_order_event: string | null;
+  run_order_revision: unknown;
+  run_order_run_id: string | null;
+  run_order_sequence: unknown;
+}): RunOrderMarker | null {
+  const sequence = readCollectionRevision(row.run_order_sequence);
+  return sequence === null
+    ? null
+    : {
+        event: row.run_order_event ?? null,
+        revision: readRunSequence(row.run_order_revision),
+        runId: row.run_order_run_id ?? null,
+        sequence,
+      };
+}
+
 /** Batched fence read for one page of connections, keyed by connector instance. */
 export async function readLocalCoverageRevisionFences(
   connectorInstanceIds: readonly string[]
@@ -315,7 +646,12 @@ export async function readLocalCoverageRevisionFences(
     proof_run_id: string | null;
     proof_scheduler_managed: unknown;
     proof_status: string | null;
+    run_order_event: string | null;
+    run_order_revision: unknown;
+    run_order_run_id: string | null;
+    run_order_sequence: unknown;
     scope_state_json: unknown;
+    storage_epoch: unknown;
   }
   const ids = [...new Set(connectorInstanceIds.filter((id) => typeof id === "string" && id.length > 0))];
   const rows: Row[] = [];
@@ -324,13 +660,17 @@ export async function readLocalCoverageRevisionFences(
   }
   await fenceReadHook?.(ids);
   // One statement per backend, so the fence, the proof run, and the boundary
-  // the proof is judged against come from one snapshot. The manifest is read
-  // only for a connection whose newest event is a terminal run.
+  // the proof is judged against come from one snapshot. The proof run is the
+  // run the run-order marker names, and the manifest is read only when that
+  // marker is a terminal run.
   const select = (casts: { readonly json: string; readonly revision: string }, runTerminal: string) =>
     `SELECT ci.connector_instance_id, ci.collection_revision${casts.revision} AS collection_revision,
             ci.collection_revision_event, ci.collection_revision_run_id, ci.collection_revision_at,
+            ci.run_order_sequence${casts.revision} AS run_order_sequence, ci.run_order_event,
+            ci.run_order_run_id, ci.run_order_revision${casts.revision} AS run_order_revision,
+            ci.storage_epoch${casts.revision} AS storage_epoch,
             ci.manifest_generation, scope.state_json${casts.json} AS scope_state_json,
-            CASE WHEN ci.collection_revision_event = ${runTerminal} THEN c.manifest${casts.json} END AS proof_manifest,
+            CASE WHEN ci.run_order_event = ${runTerminal} THEN c.manifest${casts.json} END AS proof_manifest,
             rh.run_id AS proof_run_id, rh.status AS proof_status, rh.scheduler_managed AS proof_scheduler_managed,
             rh.completed_at AS proof_completed_at, rh.facts_json AS proof_facts_json
        FROM connector_instances ci
@@ -340,8 +680,8 @@ export async function readLocalCoverageRevisionFences(
         AND scope.stream = '${COLLECTION_SCOPE_STATE_KEY}'
        LEFT JOIN run_history rh
          ON rh.connector_instance_id = ci.connector_instance_id
-        AND rh.run_id = ci.collection_revision_run_id
-        AND ci.collection_revision_event = ${runTerminal}`;
+        AND rh.run_id = ci.run_order_run_id
+        AND ci.run_order_event = ${runTerminal}`;
   if (isPostgresStorageBackend()) {
     const result = await postgresQuery<Row>(
       `${select({ json: "::text", revision: "::text" }, "$2")}
@@ -391,6 +731,8 @@ export async function readLocalCoverageRevisionFences(
               status: row.proof_status,
             }
           : null,
+      runOrder: readRunOrderMarker(row),
+      storageEpoch: readCollectionRevision(row.storage_epoch),
     });
   }
   return fences;
diff --git a/reference-implementation/server/stores/run-history-writer.ts b/reference-implementation/server/stores/run-history-writer.ts
index e2f9e3b09..fab53d152 100644
--- a/reference-implementation/server/stores/run-history-writer.ts
+++ b/reference-implementation/server/stores/run-history-writer.ts
@@ -129,6 +129,11 @@ const FACTS_JSON_KEYS = [
   // (server/stores/collection-revision-store.ts). The coverage projection
   // binds the run's proof to it.
   "collection_revision",
+  // The run's place in run order: the sequence issued at its start and the
+  // storage epoch it was recorded in. A proof is eligible only while it is
+  // the connection's run-order marker in the current epoch.
+  "run_sequence",
+  "storage_epoch",
   "needs_input",
   // Preserve presence separately from the schema's records_emitted DEFAULT 0.
   // A missing runtime field is not evidence of zero yield.
diff --git a/reference-implementation/server/stores/terminal-run-commit-store.ts b/reference-implementation/server/stores/terminal-run-commit-store.ts
index 29d0161fe..78a540819 100644
--- a/reference-implementation/server/stores/terminal-run-commit-store.ts
+++ b/reference-implementation/server/stores/terminal-run-commit-store.ts
@@ -6,9 +6,11 @@ import { getOneOn, referenceQueries } from "../../lib/db.ts";
 import { appendPostgresSpineEventInTransaction, type PostgresSpineEventInput } from "../../lib/postgres-spine.ts";
 import { appendSqliteSpineEventInTransaction, type SpineDatabase, type SpineEventInput } from "../../lib/spine.ts";
 import { getDb } from "../db.ts";
-import { isPostgresStorageBackend, withPostgresTransaction } from "../postgres-storage.ts";
+import { isPostgresStorageBackend, postgresQuery, withPostgresTransaction } from "../postgres-storage.ts";
 import {
+  requirePostgresCollectionObservationInTransaction,
   requirePostgresCollectionRevisionInTransaction,
+  requireSqliteCollectionObservationInTransaction,
   requireSqliteCollectionRevisionInTransaction,
 } from "./collection-revision-store.ts";
 import {
@@ -31,13 +33,26 @@ export interface ResolvedTerminalRunCommit {
 }
 
 export interface TerminalRunCommitResponse {
+  /** The commit revision the run was recorded at. Absent from receipts stored before run order. */
+  readonly collection_revision?: number;
   readonly commit_id: string;
   readonly envelope_hash: string;
   readonly object: "device_terminal_run_commit";
   readonly run_id: string;
+  /** The sequence issued at run start, or null for a run with none. Absent from receipts stored before run order. */
+  readonly run_sequence?: number | null;
+  /** The storage epoch the run was recorded in. Absent from receipts stored before run order. */
+  readonly storage_epoch?: number;
   readonly terminal_event_id: string;
 }
 
+/** Where a terminal record sits in commit order and run order. */
+interface TerminalRunOrder {
+  readonly collectionRevision: number;
+  readonly runSequence: number | null;
+  readonly storageEpoch: number;
+}
+
 export interface TerminalRunCommitResult {
   readonly replayed: boolean;
   readonly response: TerminalRunCommitResponse;
@@ -63,7 +78,20 @@ function maybeFault(point: TerminalFaultPoint): void {
   terminalRunCommitFaultHook?.(point);
 }
 
-function terminalRunBindingIdentity(input: ResolvedTerminalRunCommit): string {
+/** The fields that identify a terminal record and its exact receipt, known before inventory validation. */
+export type TerminalRunReceiptLookup = Pick<
+  ResolvedTerminalRunCommit,
+  | "commitId"
+  | "connectorId"
+  | "connectorInstanceId"
+  | "deviceId"
+  | "envelopeHash"
+  | "runId"
+  | "sourceInstanceId"
+  | "version"
+>;
+
+function terminalRunBindingIdentity(input: TerminalRunReceiptLookup): string {
   return JSON.stringify([
     input.deviceId,
     input.sourceInstanceId,
@@ -73,16 +101,23 @@ function terminalRunBindingIdentity(input: ResolvedTerminalRunCommit): string {
   ]);
 }
 
-function terminalEventId(input: ResolvedTerminalRunCommit): string {
+function terminalEventId(input: TerminalRunReceiptLookup): string {
   return `evt_local_terminal_commit_${createHash("sha256").update(terminalRunBindingIdentity(input)).digest("hex")}`;
 }
 
-function responseFor(input: ResolvedTerminalRunCommit, eventId: string): TerminalRunCommitResponse {
+function responseFor(
+  input: ResolvedTerminalRunCommit,
+  eventId: string,
+  order: TerminalRunOrder
+): TerminalRunCommitResponse {
   return {
+    collection_revision: order.collectionRevision,
     commit_id: input.commitId,
     envelope_hash: input.envelopeHash,
     object: "device_terminal_run_commit",
     run_id: input.runId,
+    run_sequence: order.runSequence,
+    storage_epoch: order.storageEpoch,
     terminal_event_id: eventId,
   };
 }
@@ -92,15 +127,15 @@ function eventInputFor(
   eventId: string,
   response: TerminalRunCommitResponse,
   occurredAt: string,
-  collectionRevision: number
+  order: TerminalRunOrder
 ): SpineEventInput & PostgresSpineEventInput {
   return {
     actor_id: input.deviceId,
     actor_type: "local_device",
     data: {
       // The connection revision this run, and the state it wrote, were
-      // committed at. A proof is current only while it is the high-water mark.
-      collection_revision: collectionRevision,
+      // committed at. It orders the record among observations and dates it.
+      collection_revision: order.collectionRevision,
       collection_facts: {
         collection_scope: input.collectionBoundary,
         reference_only: true,
@@ -108,6 +143,12 @@ function eventInputFor(
         streams: input.normalizedFacts,
       },
       connector_instance_id: input.connectorInstanceId,
+      // The run's place in run order: the sequence issued at its start (null
+      // for a run without one) and the storage epoch it was recorded in. A
+      // proof is eligible only while it is the run-order marker in the
+      // current epoch.
+      run_sequence: order.runSequence,
+      storage_epoch: order.storageEpoch,
       terminal_run_commit_receipt: {
         bindings: {
           connector_id: input.connectorId,
@@ -138,7 +179,7 @@ function asRecord(value: unknown): Record<string, unknown> | null {
   return value && typeof value === "object" && !Array.isArray(value) ? (value as Record<string, unknown>) : null;
 }
 
-function parseStoredResponse(dataJson: unknown, input: ResolvedTerminalRunCommit): TerminalRunCommitResponse | null {
+function parseStoredResponse(dataJson: unknown, input: TerminalRunReceiptLookup): TerminalRunCommitResponse | null {
   let data: unknown = dataJson;
   if (typeof dataJson === "string") {
     try {
@@ -195,13 +236,19 @@ function commitSqlite(input: ResolvedTerminalRunCommit): TerminalRunCommitResult
     }
 
     const occurredAt = new Date().toISOString();
-    const response = responseFor(input, eventId);
     // Required: a terminal run without its revision rolls back whole.
-    const collectionRevision = requireSqliteCollectionRevisionInTransaction(db, input.connectorInstanceId, {
+    const observed = requireSqliteCollectionObservationInTransaction(db, input.connectorInstanceId, {
       at: occurredAt,
       event: "terminal_run",
       runId: input.runId,
     });
+    const order = {
+      collectionRevision: observed.revision,
+      runSequence: observed.runSequence,
+      storageEpoch: observed.storageEpoch,
+    };
+    const collectionRevision = observed.revision;
+    const response = responseFor(input, eventId, order);
     putSqliteConnectorStateDeltaInTransaction(
       db,
       { connectorId: input.connectorId, connectorInstanceId: input.connectorInstanceId },
@@ -213,7 +260,7 @@ function commitSqlite(input: ResolvedTerminalRunCommit): TerminalRunCommitResult
       }
     );
     appendSqliteSpineEventInTransaction(
-      eventInputFor(input, eventId, response, occurredAt, collectionRevision),
+      eventInputFor(input, eventId, response, occurredAt, order),
       db as unknown as SpineDatabase,
       {
         afterEventInsert: () => maybeFault("after_event_insert"),
@@ -270,13 +317,19 @@ async function commitPostgres(input: ResolvedTerminalRunCommit): Promise<Termina
       }
 
       const occurredAt = new Date().toISOString();
-      const response = responseFor(input, eventId);
       // Required: a terminal run without its revision rolls back whole.
-      const collectionRevision = await requirePostgresCollectionRevisionInTransaction(
-        client,
-        input.connectorInstanceId,
-        { at: occurredAt, event: "terminal_run", runId: input.runId }
-      );
+      const observed = await requirePostgresCollectionObservationInTransaction(client, input.connectorInstanceId, {
+        at: occurredAt,
+        event: "terminal_run",
+        runId: input.runId,
+      });
+      const order = {
+        collectionRevision: observed.revision,
+        runSequence: observed.runSequence,
+        storageEpoch: observed.storageEpoch,
+      };
+      const collectionRevision = observed.revision;
+      const response = responseFor(input, eventId, order);
       await putPostgresConnectorStateDeltaInTransaction(
         client,
         { connectorId: input.connectorId, connectorInstanceId: input.connectorInstanceId },
@@ -287,7 +340,7 @@ async function commitPostgres(input: ResolvedTerminalRunCommit): Promise<Termina
           collectionRevision,
         }
       );
-      const event = eventInputFor(input, eventId, response, occurredAt, collectionRevision);
+      const event = eventInputFor(input, eventId, response, occurredAt, order);
       await appendPostgresSpineEventInTransaction(client, event, {
         afterEventInsert: () => maybeFault("after_event_insert"),
         afterRunHistoryWrite: () => maybeFault("after_run_history_write"),
@@ -310,6 +363,28 @@ export async function commitTerminalRun(input: ResolvedTerminalRunCommit): Promi
   return isPostgresStorageBackend() ? await commitPostgres(input) : commitSqlite(input);
 }
 
+/**
+ * The stored receipt for an exact replay, `null` when no record exists for the
+ * run binding, or a `TerminalRunCommitConflictError` when the stored record is
+ * a different request. Reads only: a record that commits after this lookup is
+ * still caught by the commit, which repeats the check under its lock.
+ */
+export async function findTerminalRunReceipt(input: TerminalRunReceiptLookup): Promise<TerminalRunCommitResult | null> {
+  const eventId = terminalEventId(input);
+  const existing = isPostgresStorageBackend()
+    ? (await postgresQuery<{ data_json: unknown }>("SELECT data_json FROM spine_events WHERE event_id = $1", [eventId]))
+        .rows[0]
+    : getOneOn<{ data_json: string }>(getDb(), referenceQueries.spineGetTerminalRunCommitReceipt, [eventId]);
+  if (!existing) {
+    return null;
+  }
+  const stored = parseStoredResponse(existing.data_json, input);
+  if (!stored) {
+    throw new TerminalRunCommitConflictError();
+  }
+  return { replayed: true, response: stored };
+}
+
 /** JSON with sorted keys and without undefined members, as stored JSON reads back. */
 function canonicalJson(value: unknown): string {
   return JSON.stringify(value, (_key, member: unknown) =>
diff --git a/reference-implementation/test/local-device-coverage-journey.test.ts b/reference-implementation/test/local-device-coverage-journey.test.ts
index 67c047ea8..0f97bc0a5 100644
--- a/reference-implementation/test/local-device-coverage-journey.test.ts
+++ b/reference-implementation/test/local-device-coverage-journey.test.ts
@@ -34,6 +34,7 @@
 /// <reference path="../../packages/local-collector/src/managed/installer-core.d.ts" />
 
 import assert from "node:assert/strict";
+import { spawn } from "node:child_process";
 import { createHash } from "node:crypto";
 import { existsSync } from "node:fs";
 import { mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
@@ -42,9 +43,10 @@ import { tmpdir } from "node:os";
 import { dirname, join } from "node:path";
 import { DatabaseSync } from "node:sqlite";
 import test from "node:test";
-import { pathToFileURL } from "node:url";
+import { fileURLToPath, pathToFileURL } from "node:url";
 
-import { hashCanonicalJson } from "@pdpp/collector-runtime";
+import { hashCanonicalJson, LocalDeviceClient, LocalDeviceOutbox } from "@pdpp/collector-runtime";
+import { DEFAULT_COLLECTOR_OUTBOX_POLICY, drainCollectorOutbox } from "@pdpp/collector-runtime/collector-runner";
 
 import {
   bindOptionalRunCoverageToRelease,
@@ -76,6 +78,7 @@ import { reconcileDirtyConnectorSummaryEvidence } from "../server/connector-summ
 import { closeDb, getDb } from "../server/db.ts";
 import { startServer } from "../server/index.ts";
 import { __setLocalCollectorReleaseForTest } from "../server/local-collector-profiles.ts";
+import { __setTerminalRunCommitFaultHookForTest } from "../server/stores/terminal-run-commit-store.ts";
 import { closeTestServer } from "./helpers/close-test-server.ts";
 import { fixtureConnectorSource } from "./helpers/install-path-fixture.ts";
 
@@ -164,6 +167,7 @@ interface CoverageAsOf {
   readonly committed_at: string | null;
   readonly evidence: string;
   readonly run_id: string | null;
+  readonly run_sequence: number;
 }
 
 interface OwnerConnectionRow {
@@ -455,7 +459,27 @@ function serverRunCommittedAt(runId: string): string {
   return row.completed_at;
 }
 
-/** Shown coverage is a fact about one run: its id, release digest, revision and commit time. */
+/** The sequence the server issued to one run at its start, or null when it issued none. */
+function serverRunSequence(runId: string): number | null {
+  const row = getDb().prepare("SELECT run_sequence FROM collection_run_sequences WHERE run_id = ?").get(runId) as
+    | { run_sequence: number }
+    | undefined;
+  return row ? Number(row.run_sequence) : null;
+}
+
+/** The run-order facts the server stored with one run record. */
+function serverRunOrder(runId: string): { collection_revision: unknown; run_sequence: unknown } | null {
+  const row = getDb().prepare("SELECT facts_json FROM run_history WHERE run_id = ?").get(runId) as
+    | { facts_json: string }
+    | undefined;
+  if (!row) {
+    return null;
+  }
+  const facts = JSON.parse(row.facts_json) as Record<string, unknown>;
+  return { collection_revision: facts.collection_revision, run_sequence: facts.run_sequence };
+}
+
+/** Shown coverage is a fact about one run: its id, release digest, run sequence, revision and commit time. */
 function assertCoverageAsOf(journey: Lane, owner: OwnerConnectionRow, runId: string): void {
   assert.equal(owner.coverage_as_of?.run_id, runId, "the shown coverage names the run it is a fact about");
   assert.deepEqual(owner.coverage_as_of, {
@@ -464,6 +488,7 @@ function assertCoverageAsOf(journey: Lane, owner: OwnerConnectionRow, runId: str
     committed_at: serverRunCommittedAt(runId),
     evidence: "terminal_run",
     run_id: runId,
+    run_sequence: serverRunSequence(runId),
   });
 }
 
@@ -686,6 +711,189 @@ test("J3: a run that fails before its scan leaves the lane not covered; the serv
   });
 });
 
+/** Deliver what a device outbox still holds, without starting a run. */
+async function deliverQueued(journey: Lane): Promise<void> {
+  const outbox = new LocalDeviceOutbox({ path: journey.queuePath });
+  try {
+    await drainCollectorOutbox({
+      client: new LocalDeviceClient({
+        baseUrl: journey.asUrl,
+        deviceId: journey.enrolled.device_id,
+        deviceToken: journey.enrolled.device_token,
+      }),
+      connectorId: CONNECTOR_ID,
+      holderId: "journey-late-delivery",
+      outbox,
+      policy: { ...DEFAULT_COLLECTOR_OUTBOX_POLICY, retryBackoffMs: 1 },
+      sourceInstanceId: journey.enrolled.source_instance_id,
+    });
+  } finally {
+    outbox.close();
+  }
+}
+
+test("J5: an older run's proof delivered after a newer run's terminal record stays history", async () => {
+  await withJourney(async (journey) => {
+    // Run A completes its scan, but its terminal record does not reach the server: the commit fails
+    // and stays queued on A's outbox, as an outbox delay or retry leaves it.
+    __setTerminalRunCommitFaultHookForTest((point) => {
+      if (point === "after_event_insert") {
+        throw new Error("terminal commit unavailable");
+      }
+    });
+    let a: RunOutcome;
+    try {
+      a = await runOnce(journey, "complete", "a-delayed");
+    } finally {
+      __setTerminalRunCommitFaultHookForTest(null);
+    }
+    assert.equal(a.result.done?.status, "succeeded");
+    assert.equal(a.result.statePutFailed, true, "run A's terminal record is still queued");
+    assert.equal(serverRunStreams("a-delayed"), null, "the server has no terminal record for run A yet");
+
+    // Run B starts later, from a second outbox of the device, and its terminal record reaches the server first.
+    const bLane = { ...journey, queuePath: join(journey.dir, "outbox-b.sqlite") };
+    const b = await runOnce(bLane, "complete", "b-newer");
+    assert.equal(b.result.done?.status, "succeeded");
+    const bOwner = await ownerConnectionRow(journey);
+    assert.equal(bOwner.connection_health.axes.coverage, "complete");
+    assert.equal(bOwner.coverage_as_of?.run_id, "b-newer", "run B's proof is current");
+    const bRevision = bOwner.coverage_as_of?.collection_revision;
+
+    // Run A's queued terminal record now reaches the server, in commit order after run B's.
+    await deliverQueued(journey);
+    const aOrder = serverRunOrder("a-delayed");
+    assert.ok(aOrder, "the server stored run A's terminal record");
+    assert.ok(Number(aOrder.collection_revision) > Number(bRevision), "run A's record is the newer observation");
+
+    // Run order decides eligibility: run A's proof is history, and run B's stays current.
+    const owner = await ownerConnectionRow(journey);
+    assert.equal(owner.coverage_as_of?.run_id, "b-newer", "the older run's late proof does not become current");
+    assert.equal(owner.connection_health.axes.coverage, "complete");
+    assert.equal(owner.coverage_as_of?.collection_revision, bRevision, "the as-of still names run B's revision");
+    assert.deepEqual(conditions(owner), { messages: "complete", sessions: "complete" });
+    // Run A's record keeps its own as-of: it started before run B.
+    assert.ok(
+      Number(aOrder.run_sequence) < Number(owner.coverage_as_of?.run_sequence),
+      "run A's run sequence is below run B's"
+    );
+  });
+});
+
+// The collector runner in its own process. It sends its records, and when it
+// reaches its terminal record it writes a marker and waits, so the test can
+// kill it at exactly that point. Written with no template interpolation.
+const KILLED_RUNNER_SOURCE = `
+import { writeFileSync } from "node:fs";
+import { pathToFileURL } from "node:url";
+
+const config = JSON.parse(process.env.PDPP_JOURNEY_RUNNER_CONFIG);
+const realFetch = globalThis.fetch;
+globalThis.fetch = (input, init) => {
+  const url = typeof input === "string" ? input : input instanceof URL ? input.href : input.url;
+  if (url.includes("/terminal-run-commits")) {
+    writeFileSync(config.markerPath, "terminal");
+    return new Promise(() => undefined);
+  }
+  return realFetch(input, init);
+};
+const { runCollectorConnector } = await import(pathToFileURL(config.runnerPath).href);
+await runCollectorConnector(config.run);
+`;
+
+const BATCH_OBSERVATION = /^batch_(record|accepted)$/;
+
+async function waitForFile(path: string, timeoutMs: number): Promise<void> {
+  const deadline = Date.now() + timeoutMs;
+  for (;;) {
+    try {
+      // biome-ignore lint/performance/noAwaitInLoops: polling checks one file, one attempt after another.
+      await readFile(path, "utf8");
+      return;
+    } catch (error) {
+      if (Date.now() > deadline) {
+        throw new Error(`timed out waiting for ${path}`, { cause: error });
+      }
+      await new Promise((resolve) => setTimeout(resolve, 25));
+    }
+  }
+}
+
+test("J6: a runner killed after its records are admitted, before its terminal record, leaves the earlier positive unknown", async () => {
+  await withJourney(async (journey) => {
+    const a = await runOnce(journey, "complete", "a-complete");
+    assert.equal(a.result.done?.status, "succeeded");
+    assertCoverageAsOf(journey, await ownerConnectionRow(journey), "a-complete");
+    const recordsBefore = serverRecordCount(journey, "sessions");
+
+    // Run B runs in a separate process against a fresh outbox and is killed when it reaches its terminal
+    // record. Its "state" pass sends a batch the server has not seen. (A batch byte-identical to one the
+    // server already accepted is an idempotent replay, not an observation.)
+    const scriptPath = join(journey.dir, "killed-runner.mjs");
+    const markerPath = join(journey.dir, "b-terminal-reached");
+    await writeFile(scriptPath, KILLED_RUNNER_SOURCE);
+    const connector: CollectorConnectorSpec = {
+      args: [journey.childPath, "state", join(journey.dir, "start-b-killed.json"), "b-killed"],
+      command: process.execPath,
+      connector_id: CONNECTOR_ID,
+      protocol_capabilities: [],
+      runtime_requirements: { bindings: {} },
+      streams: STREAMS,
+    };
+    const child = spawn(process.execPath, ["--import", "tsx", scriptPath], {
+      cwd: dirname(fileURLToPath(import.meta.url)),
+      env: {
+        ...process.env,
+        PDPP_JOURNEY_RUNNER_CONFIG: JSON.stringify({
+          markerPath,
+          run: {
+            baseUrl: journey.asUrl,
+            connector,
+            deviceId: journey.enrolled.device_id,
+            deviceToken: journey.enrolled.device_token,
+            executionRoot: dirname(journey.childPath),
+            outboxPolicy: { maxDrainIterations: 1, retryBackoffMs: 1 },
+            queuePath: join(journey.dir, "outbox-killed.sqlite"),
+            runId: "b-killed",
+            sourceInstanceId: journey.enrolled.source_instance_id,
+          },
+          runnerPath: fileURLToPath(new URL("../../packages/local-collector/src/runner.ts", import.meta.url)),
+        }),
+      },
+      stdio: ["ignore", "ignore", "pipe"],
+    });
+    let stderr = "";
+    child.stderr.setEncoding("utf8").on("data", (chunk: string) => {
+      stderr += chunk;
+    });
+    const exited = new Promise<NodeJS.Signals | null>((resolve) =>
+      child.once("exit", (_code, signal) => resolve(signal))
+    );
+    try {
+      await Promise.race([
+        waitForFile(markerPath, 60_000),
+        exited.then(() => {
+          throw new Error(`the runner exited before its terminal record: ${stderr}`);
+        }),
+      ]);
+    } finally {
+      child.kill("SIGKILL");
+    }
+    assert.equal(await exited, "SIGKILL", "the runner process was killed");
+
+    // The server admitted run B's records but never received its terminal record.
+    assert.equal(serverRunStreams("b-killed"), null, "no terminal record for run B");
+    assert.ok(serverRunSequence("b-killed") !== null, "run B registered its start");
+    assert.ok(serverRecordCount(journey, "sessions") >= recordsBefore, "run B's records were admitted");
+    assert.match(String(lastCollectionEvent(journey)), BATCH_OBSERVATION, "the newest observation is run B's ingest");
+
+    // Run B's admitted records are an observed attempt of a later run, so run A's positive is unknown.
+    const owner = await ownerConnectionRow(journey);
+    assert.equal(owner.connection_health.axes.coverage, "unknown");
+    assert.equal(owner.coverage_as_of, null);
+  });
+});
+
 test("J4: a failure report the server receives after a covered run retires the proof", async () => {
   await withJourney(async (journey) => {
     const a = await runOnce(journey, "complete", "a-complete");
diff --git a/reference-implementation/test/local-device-coverage-revision-atomicity.test.ts b/reference-implementation/test/local-device-coverage-revision-atomicity.test.ts
index 1ed36c8ab..7c0910c36 100644
--- a/reference-implementation/test/local-device-coverage-revision-atomicity.test.ts
+++ b/reference-implementation/test/local-device-coverage-revision-atomicity.test.ts
@@ -22,6 +22,8 @@ import { join } from "node:path";
 import { DatabaseSync } from "node:sqlite";
 import test from "node:test";
 
+import { referenceManifests, validateResponse } from "@pdpp/reference-contract";
+
 import { COLLECTOR_PROTOCOL_VERSION } from "../server/collector-protocol.ts";
 import { reconcileDirtyConnectorSummaryEvidence } from "../server/connector-summary-read-model.ts";
 import { closeDb, getDb, initDb } from "../server/db.ts";
@@ -36,7 +38,10 @@ import { getConnectorDetail, getOwnerConnectionDiagnostics, listConnectorSummari
 import { __setDeviceIngestPhaseFaultHookForTest } from "../server/routes/ref-device-exporters.ts";
 import {
   __setLocalCoverageFenceReadHookForTest,
+  beginStorageEpochAfterRestore,
   isCollectionRevisionUnavailable,
+  issueCollectionRunSequence,
+  RunStartConflictError,
 } from "../server/stores/collection-revision-store.ts";
 import { getDefaultDeviceExporterStore } from "../server/stores/device-exporter-store.ts";
 import { commitTerminalRun } from "../server/stores/terminal-run-commit-store.ts";
@@ -349,14 +354,54 @@ function postFailureReport(lane: Lane, runId: string): Promise<JsonResponse> {
   );
 }
 
-/** A v2 terminal proof for both streams, bound to the server's release. Returns the commit so a test can replay it. */
+/** Register a run at its start, as the runtime does before its scan. Returns the issued sequence. */
+async function issueRun(
+  lane: Lane,
+  runId: string,
+  identity: { readonly deviceId?: string; readonly sourceInstanceId?: string } = {}
+): Promise<number> {
+  const { issued } = await issueCollectionRunSequence({
+    connectorInstanceId: lane.enrolled.connector_instance_id,
+    deviceId: identity.deviceId ?? lane.enrolled.device_id,
+    runId,
+    sourceInstanceId: identity.sourceInstanceId ?? lane.enrolled.source_instance_id,
+  });
+  return issued.runSequence;
+}
+
+/** A v2 terminal proof for both streams, bound to the server's release, for a run registered at its start. Returns the commit so a test can replay it. */
 async function commitProof(lane: Lane, runId: string): Promise<TerminalCommit> {
-  const commit = await buildProof(lane, runId);
+  await issueRun(lane, runId);
+  return await commitIssuedProof(lane, runId);
+}
+
+/** `commitProof` for a run that is already registered, or deliberately is not. */
+async function commitIssuedProof(
+  lane: Lane,
+  runId: string,
+  identity: Partial<TerminalCommit> = {}
+): Promise<TerminalCommit> {
+  const commit = { ...(await buildProof(lane, runId)), ...identity };
   const result = await commitTerminalRun(commit);
   assert.equal(result.replayed, false, `run ${runId} commits a new terminal proof`);
   return commit;
 }
 
+/** The device's last heartbeat: a drained outbox, as after a complete run. */
+async function markDrained(lane: Lane): Promise<void> {
+  await getDefaultDeviceExporterStore().markSourceInstanceHeartbeat(
+    lane.enrolled.device_id,
+    lane.enrolled.source_instance_id,
+    {
+      lastError: null,
+      outboxDiagnostics: { dead_letter: 0, pending: 0, stale_leases: 0, succeeded: 1, total: 1 },
+      receivedAt: new Date().toISOString(),
+      recordsPending: 0,
+      status: "healthy",
+    }
+  );
+}
+
 /** The v2 terminal commit `commitProof` sends, not yet committed. */
 async function buildProof(
   lane: Lane,
@@ -365,13 +410,7 @@ async function buildProof(
 ): Promise<TerminalCommit> {
   const { connector_instance_id: connectorInstanceId, device_id: deviceId } = lane.enrolled;
   const sourceInstanceId = lane.enrolled.source_instance_id;
-  await getDefaultDeviceExporterStore().markSourceInstanceHeartbeat(deviceId, sourceInstanceId, {
-    lastError: null,
-    outboxDiagnostics: { dead_letter: 0, pending: 0, stale_leases: 0, succeeded: 1, total: 1 },
-    receivedAt: new Date().toISOString(),
-    recordsPending: 0,
-    status: "healthy",
-  });
+  await markDrained(lane);
   const [instance] = await sql(
     lane,
     "SELECT manifest_generation FROM connector_instances WHERE connector_instance_id = ?",
@@ -1137,6 +1176,379 @@ laneTest("a state commit whose revision write fails writes no state and keeps th
   await assertRetired(lane, "the state commit retires run A's proof");
 });
 
+// ---------------------------------------------------------------------------
+// Round 4: run order decides eligibility; commit revision orders observations.
+// ---------------------------------------------------------------------------
+
+interface RunOrderRow {
+  readonly event: string | null;
+  readonly issued: number;
+  readonly revision: number | null;
+  readonly runId: string | null;
+  readonly sequence: number;
+  readonly storageEpoch: number;
+}
+
+async function runOrder(lane: Lane): Promise<RunOrderRow> {
+  const [row] = await sql(
+    lane,
+    `SELECT run_order_sequence AS sequence, run_order_event AS event, run_order_run_id AS run_id,
+            run_order_revision AS revision, run_sequence_issued AS issued, storage_epoch
+       FROM connector_instances WHERE connector_instance_id = ?`,
+    `SELECT run_order_sequence::text AS sequence, run_order_event AS event, run_order_run_id AS run_id,
+            run_order_revision::text AS revision, run_sequence_issued::text AS issued,
+            storage_epoch::text AS storage_epoch
+       FROM connector_instances WHERE connector_instance_id = $1`,
+    [lane.enrolled.connector_instance_id]
+  );
+  assert.ok(row, "the connection has a run-order row");
+  return {
+    event: (row.event as string | null) ?? null,
+    issued: Number(row.issued),
+    revision: row.revision === null ? null : Number(row.revision),
+    runId: (row.run_id as string | null) ?? null,
+    sequence: Number(row.sequence),
+    storageEpoch: Number(row.storage_epoch),
+  };
+}
+
+/** The run-order facts the server stored with one run record. */
+async function storedRunOrder(
+  lane: Lane,
+  runId: string
+): Promise<{ readonly collection_revision: unknown; readonly run_sequence: unknown; readonly storage_epoch: unknown }> {
+  const [run] = await sql(
+    lane,
+    "SELECT facts_json FROM run_history WHERE run_id = ?",
+    "SELECT facts_json::text AS facts_json FROM run_history WHERE run_id = $1",
+    [runId]
+  );
+  assert.ok(run, `the server stored run ${runId}`);
+  const facts = JSON.parse(String(run.facts_json)) as Record<string, unknown>;
+  return {
+    collection_revision: facts.collection_revision,
+    run_sequence: facts.run_sequence,
+    storage_epoch: facts.storage_epoch,
+  };
+}
+
+function postRunStart(lane: Lane, runId: string): Promise<JsonResponse> {
+  return postJson(sourceUrl(lane, "/run-starts"), { connector_id: CONNECTOR_ID, run_id: runId }, authHeaders(lane));
+}
+
+/** A v2 terminal record as the device sends it on the wire, bound to the server's release. */
+async function terminalWireBody(
+  lane: Lane,
+  runId: string,
+  stateDelta: Record<string, unknown> = {}
+): Promise<Record<string, unknown>> {
+  const diagnostics = await readCommittedLocalCoverageDiagnostics({
+    connector_id: CONNECTOR_ID,
+    connector_instance_id: lane.enrolled.connector_instance_id,
+  });
+  assert.ok("declaredCollectionScope" in diagnostics, "the connection declares its collection boundary");
+  const fact = (stream: string, store: string) => ({
+    artifact_digest: ARTIFACT_DIGEST,
+    manifest_fingerprint: fingerprintDeviceAttemptManifest(PROFILE),
+    runtime_accounting: {
+      checkpoint_eligible: true,
+      detail_complete: true,
+      durable_admission: true,
+      outstanding_debt: 0,
+      stream_evidence_consistent: true,
+    },
+    scoped: true,
+    stores: [{ status: "collected", store }],
+    stream,
+  });
+  return {
+    collection_boundary: diagnostics.declaredCollectionScope,
+    commit_id: `wire_commit_${runId}`,
+    connector_id: CONNECTOR_ID,
+    connector_instance_id: lane.enrolled.connector_instance_id,
+    device_id: lane.enrolled.device_id,
+    run_id: runId,
+    source_instance_id: lane.enrolled.source_instance_id,
+    state_delta: stateDelta,
+    terminal_facts: [fact("messages", "derived_messages"), fact("sessions", "projects")],
+    version: 2,
+  };
+}
+
+function postTerminal(lane: Lane, body: Record<string, unknown>): Promise<JsonResponse> {
+  return postJson(sourceUrl(lane, "/terminal-run-commits"), body, authHeaders(lane));
+}
+
+laneTest(
+  "run order: an older run's proof that arrives after a newer run's terminal record stays history",
+  async (lane) => {
+    assert.equal(await issueRun(lane, "run-a"), 1, "run A starts first");
+    assert.equal(await issueRun(lane, "run-b"), 2, "run B starts second");
+    await commitIssuedProof(lane, "run-b");
+    await assertCovered(lane, "run-b", "run B's proof is current");
+    const bOrder = await runOrder(lane);
+
+    // Run A's proof was queued on its device and reaches the server after run B's terminal record.
+    await commitIssuedProof(lane, "run-a");
+    const aStored = await storedRunOrder(lane, "run-a");
+    const bStored = await storedRunOrder(lane, "run-b");
+    assert.ok(
+      Number(aStored.collection_revision) > Number(bStored.collection_revision),
+      "run A's record is the newer observation in commit order"
+    );
+    assert.equal((await highWater(lane)).runId, "run-a", "commit order names run A's record as the newest observation");
+    assert.deepEqual(
+      aStored,
+      { collection_revision: aStored.collection_revision, run_sequence: 1, storage_epoch: 1 },
+      "run A's record keeps its own as-of: its revision, run sequence and epoch"
+    );
+    assert.deepEqual(await runOrder(lane), bOrder, "an older run's terminal record does not move the run-order marker");
+    const projected = await projection(lane);
+    assert.equal(projected.axis, "complete", "run B's proof stays current");
+    assert.equal(projected.asOf?.run_id, "run-b");
+    assert.equal(projected.asOf?.run_sequence, 2, "the as-of names run B's sequence");
+    assert.equal(projected.asOf?.collection_revision, bStored.collection_revision, "and run B's own revision");
+  }
+);
+
+laneTest("run order: a run with no issued sequence never produces an eligible proof", async (lane) => {
+  await commitIssuedProof(lane, "run-unregistered");
+  await assertRetired(lane, "a proof from a run the server issued no sequence is not current");
+  assert.equal((await storedRunOrder(lane, "run-unregistered")).run_sequence, null);
+  await commitProof(lane, "run-registered");
+  await assertCovered(lane, "run-registered", "a registered run's proof is current");
+});
+
+laneTest("run order: a second collector on one connection is ordered by run start, not by commit", async (lane) => {
+  const second = { deviceId: "device-second-collector", sourceInstanceId: "src-second-collector" };
+  assert.equal(await issueRun(lane, "run-first-device"), 1);
+  assert.equal(await issueRun(lane, "run-second-device", second), 2, "issuance is connection-scoped");
+  await commitIssuedProof(lane, "run-second-device", second);
+  await assertCovered(lane, "run-second-device", "the later-started run's proof is current");
+  await commitIssuedProof(lane, "run-first-device");
+  await assertCovered(lane, "run-second-device", "the earlier-started run's later commit stays history");
+
+  // A run id belongs to the device and source that registered it.
+  const before = await runOrder(lane);
+  await assert.rejects(issueRun(lane, "run-second-device"), RunStartConflictError);
+  const conflict = await postRunStart(lane, "run-second-device");
+  assert.equal(conflict.status, 409, JSON.stringify(conflict.body));
+  assert.equal((conflict.body?.error as Record<string, unknown> | undefined)?.code, "run_start_conflict");
+  assert.deepEqual(await runOrder(lane), before, "a conflicting run start issues nothing");
+});
+
+laneTest("run start: the route issues a connection-scoped sequence and an exact replay returns it", async (lane) => {
+  const first = await postRunStart(lane, "run-route");
+  assert.equal(first.status, 201, JSON.stringify(first.body));
+  assert.deepEqual(first.body, {
+    connector_instance_id: lane.enrolled.connector_instance_id,
+    object: "device_run_start",
+    run_id: "run-route",
+    run_sequence: 1,
+    storage_epoch: 1,
+  });
+  const replay = await postRunStart(lane, "run-route");
+  assert.equal(replay.status, 200, JSON.stringify(replay.body));
+  assert.deepEqual(replay.body, first.body, "a replay returns the stored sequence");
+  assert.equal((await runOrder(lane)).issued, 1, "a replay issues nothing");
+});
+
+laneTest(
+  "replay: an exact terminal replay after an inventory change gets its receipt; a conflicting duplicate fails atomically",
+  async (lane) => {
+    assert.equal((await postRunStart(lane, "run-a")).status, 201);
+    await markDrained(lane);
+    const body = await terminalWireBody(lane, "run-a", { sessions: { cursor: "a" } });
+    const committed = await postTerminal(lane, body);
+    assert.equal(committed.status, 201, JSON.stringify(committed.body));
+    await assertCovered(lane, "run-a", "run A's proof is current");
+    const snapshot = async () => ({
+      cursor: await sessionsCursor(lane),
+      highWater: await highWater(lane),
+      order: await runOrder(lane),
+      rows: await runRows(lane, "run-a"),
+    });
+    const before = await snapshot();
+
+    // The release now declares another store, so run A's facts no longer match the current inventory.
+    const changed = {
+      ...PROFILE,
+      streams: PROFILE.streams.map((stream) =>
+        stream.name === "sessions" ? { ...stream, coverage_stores: ["projects", "archived_projects"] } : stream
+      ),
+    };
+    __setLocalCollectorReleaseForTest(CONNECTOR_ID, { artifactDigest: ARTIFACT_DIGEST, manifest: changed });
+    try {
+      const replay = await postTerminal(lane, body);
+      assert.equal(
+        replay.status,
+        200,
+        `an exact authorized replay gets its stored receipt: ${JSON.stringify(replay.body)}`
+      );
+      assert.deepEqual(replay.body, committed.body, "the replay returns the stored receipt");
+      assert.deepEqual(await snapshot(), before, "a replay moves neither the run sequence nor the revision");
+
+      const conflicting = await postTerminal(lane, { ...body, state_delta: { sessions: { cursor: "other" } } });
+      assert.equal(conflicting.status, 409, JSON.stringify(conflicting.body));
+      assert.equal(
+        (conflicting.body?.error as Record<string, unknown> | undefined)?.code,
+        "terminal_run_commit_conflict"
+      );
+      assert.deepEqual(await snapshot(), before, "a conflicting duplicate writes nothing");
+    } finally {
+      __setLocalCollectorReleaseForTest(CONNECTOR_ID, SERVER_RELEASE);
+    }
+    await assertCovered(lane, "run-a", "neither request changed run A's proof");
+  }
+);
+
+laneTest("restore: the restore step makes a restored proof unknown until a new eligible terminal", async (lane) => {
+  await commitProof(lane, "run-a");
+  await assertCovered(lane, "run-a", "run A's proof is current");
+  const backup = await runOrder(lane);
+  const backupHighWater = await highWater(lane);
+
+  await commitProof(lane, "run-b");
+  await assertCovered(lane, "run-b", "run B's proof replaces run A's");
+
+  // Restore a backup taken after run A: run B's records and the connection's order columns roll back.
+  const id = lane.enrolled.connector_instance_id;
+  await sql(
+    lane,
+    `UPDATE connector_instances
+        SET run_order_sequence = ?, run_order_event = ?, run_order_run_id = ?, run_order_revision = ?,
+            run_sequence_issued = ?, collection_revision = ?, collection_revision_event = ?,
+            collection_revision_run_id = ?
+      WHERE connector_instance_id = ?`,
+    `UPDATE connector_instances
+        SET run_order_sequence = $1, run_order_event = $2, run_order_run_id = $3, run_order_revision = $4,
+            run_sequence_issued = $5, collection_revision = $6, collection_revision_event = $7,
+            collection_revision_run_id = $8
+      WHERE connector_instance_id = $9`,
+    [
+      backup.sequence,
+      backup.event,
+      backup.runId,
+      backup.revision,
+      backup.issued,
+      backupHighWater.revision,
+      backupHighWater.event,
+      backupHighWater.runId,
+      id,
+    ]
+  );
+  for (const table of ["run_history", "spine_events", "collection_run_sequences"]) {
+    // biome-ignore lint/performance/noAwaitInLoops: the restore rewrites one table after another on one connection.
+    await sql(lane, `DELETE FROM ${table} WHERE run_id = ?`, `DELETE FROM ${table} WHERE run_id = $1`, ["run-b"]);
+  }
+  // The restored snapshot is internally consistent, so without the restore step its proof reads as current.
+  await assertCovered(lane, "run-a", "an undetected restore revives run A's proof (the disclosed limitation)");
+
+  const { connections } = await beginStorageEpochAfterRestore();
+  assert.ok(connections >= 1, "the restore step reaches the connection");
+  await assertRetired(lane, "after the restore step, the pre-restore proof is unknown");
+  assert.equal((await runOrder(lane)).storageEpoch, 2);
+
+  // A replay of the pre-restore record is still only a replay.
+  const replay = await commitTerminalRun(await buildProof(lane, "run-a"));
+  assert.equal(replay.replayed, true);
+  await assertRetired(lane, "a replay does not revive the pre-restore proof");
+
+  // Run C, issued after the restore step, re-uses a sequence number the lost history had issued,
+  // but in the new epoch, and its proof is current.
+  assert.equal(await issueRun(lane, "run-c"), 2, "issuance continues from the restored counter");
+  await commitIssuedProof(lane, "run-c");
+  await assertCovered(lane, "run-c", "a run issued after the restore step proves coverage again");
+  assert.equal((await storedRunOrder(lane, "run-c")).storage_epoch, 2);
+});
+
+laneTest(
+  "crash after ingest: a later run's durable records retire an earlier positive without its terminal",
+  async (lane) => {
+    await commitProof(lane, "run-a");
+    await assertCovered(lane, "run-a", "run A's proof is current");
+    const bSequence = await issueRun(lane, "run-b");
+    const accepted = await postBatch(lane, batchBody(lane, "batch-run-b", sessionRecords("b-1")));
+    assert.equal(accepted.status, 201, JSON.stringify(accepted.body));
+    // Run B dies here, before its terminal record.
+    await assertRetired(lane, "run B's admitted records retire run A's proof");
+    const order = await runOrder(lane);
+    assert.equal(order.sequence, bSequence, "the records are attributed to the newest issued run");
+    assert.equal(order.runId, null, "an attributed observation names no run, so it can never be a proof");
+
+    // A late delivery of run A's own terminal record is only a replay; run A cannot become current again.
+    const replay = await commitTerminalRun(await buildProof(lane, "run-a"));
+    assert.equal(replay.replayed, true);
+    await assertRetired(lane, "run A stays retired");
+    await commitIssuedProof(lane, "run-b");
+    await assertCovered(lane, "run-b", "run B's eventual terminal record is current");
+  }
+);
+
+// The vendored @pdpp/reference-contract (built from PDP-Connect/pdpp
+// packages/reference-contract) does not list the as-of yet, and its
+// diagnostics schemas reject unknown members. These are the members this
+// change adds that the contract still lacks. The source schema must add them
+// and this repository must re-vendor the tarball; when the vendored schema
+// lists one, this test fails until it is removed here.
+const CONTRACT_PENDING_DIAGNOSTICS_MEMBERS = [["coverage_as_of"], ["health", "coverage_as_of"]] as const;
+const STREAM_NAME_PATH = /^\/streams\/\d+$/;
+
+/** The response schema the vendored contract declares for one operation and status. */
+function contractResponseSchema(operationId: string, status: number): Record<string, unknown> {
+  const manifest = (
+    referenceManifests as readonly { id: string; responses?: Record<string, { schema?: unknown }> }[]
+  ).find((entry) => entry.id === operationId);
+  const schema = manifest?.responses?.[String(status)]?.schema;
+  assert.ok(schema && typeof schema === "object", `the contract declares ${operationId} ${status}`);
+  return schema as Record<string, unknown>;
+}
+
+function schemaAt(schema: Record<string, unknown>, path: readonly string[]): Record<string, unknown> | null {
+  let current: Record<string, unknown> | null = schema;
+  for (const key of path) {
+    const properties = current?.properties as Record<string, Record<string, unknown>> | undefined;
+    current = properties?.[key] ?? null;
+  }
+  return current;
+}
+
+laneTest("contract: owner diagnostics and connector detail validate against @pdpp/reference-contract", async (lane) => {
+  await commitProof(lane, "run-a");
+  await reconcileDirtyConnectorSummaryEvidence(null);
+
+  const diagnostics = JSON.parse(
+    JSON.stringify(await getOwnerConnectionDiagnostics(lane.enrolled.connector_instance_id))
+  ) as Record<string, unknown>;
+  const schema = contractResponseSchema("ownerInspectConnectionDiagnostics", 200);
+  for (const path of CONTRACT_PENDING_DIAGNOSTICS_MEMBERS) {
+    const parent = path
+      .slice(0, -1)
+      .reduce<Record<string, unknown>>((object, key) => object[key] as Record<string, unknown>, diagnostics);
+    const member = path.at(-1) as string;
+    assert.ok(parent[member], `the diagnostics response carries ${path.join(".")}`);
+    assert.equal(
+      schemaAt(schema, path),
+      null,
+      `the vendored contract now lists ${path.join(".")}: drop it from CONTRACT_PENDING_DIAGNOSTICS_MEMBERS`
+    );
+    delete parent[member];
+  }
+  const diagnosticsResult = validateResponse("ownerInspectConnectionDiagnostics", { body: diagnostics, status: 200 });
+  assert.deepEqual(diagnosticsResult, { ok: true, skipped: false }, "diagnostics match the contract");
+
+  // The connector summary schema admits additional members, so the as-of is valid there. The
+  // vendored schema still types `streams` as names while the detail returns stream objects; that
+  // mismatch predates this change and is the only one allowed here.
+  const detail = JSON.parse(JSON.stringify(await getConnectorDetail(CONNECTOR_ID))) as Record<string, unknown>;
+  assert.ok(detail.coverage_as_of, "the detail carries its as-of");
+  const detailResult = validateResponse("refGetConnector", { body: detail, status: 200 });
+  const detailErrors = detailResult.ok
+    ? []
+    : (detailResult.errors as { instancePath: string }[]).filter((error) => !STREAM_NAME_PATH.test(error.instancePath));
+  assert.deepEqual(detailErrors, [], "the connector detail matches the contract outside the known streams mismatch");
+});
+
 // Bounded by the test timeout: a hang fails the test, and PostgreSQL reports a
 // deadlock between the two transactions as an error (40P01) to one of them.
 test("a record transaction and a terminal commit for one connection serialize without deadlock [real PostgreSQL]", {
diff --git a/reference-implementation/test/local-device-coverage-stale-proof.test.ts b/reference-implementation/test/local-device-coverage-stale-proof.test.ts
index cc837b25d..5fe36990f 100644
--- a/reference-implementation/test/local-device-coverage-stale-proof.test.ts
+++ b/reference-implementation/test/local-device-coverage-stale-proof.test.ts
@@ -53,11 +53,23 @@ import { buildStoredCollectionScope, COLLECTION_SCOPE_STATE_KEY } from "../serve
 import { __setLocalCollectorReleaseForTest, readLocalCollectorRelease } from "../server/local-collector-profiles.ts";
 import { putSyncState } from "../server/records.ts";
 import { listConnectorSummaries } from "../server/ref-control.ts";
+import { issueCollectionRunSequence } from "../server/stores/collection-revision-store.ts";
 import { createSqliteConnectorInstanceStore } from "../server/stores/connector-instance-store.ts";
 import { getDefaultDeviceExporterStore } from "../server/stores/device-exporter-store.ts";
 import { commitTerminalRun } from "../server/stores/terminal-run-commit-store.ts";
 import { closeTestServer } from "./helpers/close-test-server.ts";
 
+/** Commit a terminal record for a run registered at its start, as the runtime does before its scan. */
+async function commitRegisteredTerminalRun(input: Parameters<typeof commitTerminalRun>[0]) {
+  await issueCollectionRunSequence({
+    connectorInstanceId: input.connectorInstanceId,
+    deviceId: input.deviceId,
+    runId: input.runId,
+    sourceInstanceId: input.sourceInstanceId,
+  });
+  return await commitTerminalRun(input);
+}
+
 const CONNECTOR_ID = "claude-code";
 const LOCAL_BINDING_NAME = "stale-proof-laptop";
 const OWNER_PASSWORD = "local-coverage-stale-proof-password";
@@ -513,7 +525,7 @@ async function seedV2Proof(runId: string): Promise<void> {
     },
     server_artifact_digest: release.artifactDigest,
   };
-  await commitTerminalRun({
+  await commitRegisteredTerminalRun({
     collectionBoundary: "unscoped",
     commitId: `commit_${runId}`,
     connectorId,
@@ -660,12 +672,21 @@ test("as-of: a shown proof carries its run id, release digest, revision and comm
       committed_at: PROOF_AT,
       evidence: "terminal_run",
       run_id: "run_as_of",
+      run_sequence: 1,
     });
   });
 });
 
-test("revision: an unreadable or mismatched revision fails closed", async (t) => {
-  for (const tamper of ["drop proof revision", "high-water below proof", "high-water names another run"] as const) {
+test("revision: an unreadable or mismatched revision, run sequence or storage epoch fails closed", async (t) => {
+  const tampers = [
+    "drop proof revision",
+    "drop proof run sequence",
+    "run-order marker below proof",
+    "run-order marker names another run",
+    "run-order marker at another sequence",
+    "storage epoch advanced",
+  ] as const;
+  for (const tamper of tampers) {
     // biome-ignore lint/performance/noAwaitInLoops: each case needs its own fresh database, one after another.
     await withBoundaryConnection(async () => {
       t.mock.timers.enable({ apis: ["Date"], now: Date.parse(PROOF_AT) });
@@ -677,16 +698,20 @@ test("revision: an unreadable or mismatched revision fails closed", async (t) =>
             "UPDATE run_history SET facts_json = json_remove(facts_json, '$.collection_revision') WHERE run_id = ?"
           )
           .run("run_fail_closed");
-      } else if (tamper === "high-water below proof") {
+      } else if (tamper === "drop proof run sequence") {
         getDb()
-          .prepare(
-            "UPDATE connector_instances SET collection_revision = collection_revision - 1 WHERE connector_instance_id = ?"
-          )
-          .run(connectorInstanceId);
+          .prepare("UPDATE run_history SET facts_json = json_remove(facts_json, '$.run_sequence') WHERE run_id = ?")
+          .run("run_fail_closed");
       } else {
+        const column = {
+          "run-order marker at another sequence": "run_order_sequence = run_order_sequence + 1",
+          "run-order marker below proof": "run_order_revision = run_order_revision - 1",
+          "run-order marker names another run": "run_order_run_id = 'run_other'",
+          "storage epoch advanced": "storage_epoch = storage_epoch + 1",
+        }[tamper];
         getDb()
-          .prepare("UPDATE connector_instances SET collection_revision_run_id = ? WHERE connector_instance_id = ?")
-          .run("run_other", connectorInstanceId);
+          .prepare(`UPDATE connector_instances SET ${column} WHERE connector_instance_id = ?`)
+          .run(connectorInstanceId);
       }
       const projected = await boundaryProjection();
       assert.deepEqual(projected.conditions, UNKNOWN, tamper);
diff --git a/reference-implementation/test/local-device-coverage-state-commit-postgres.test.ts b/reference-implementation/test/local-device-coverage-state-commit-postgres.test.ts
index 636c8b0f5..09fa245e2 100644
--- a/reference-implementation/test/local-device-coverage-state-commit-postgres.test.ts
+++ b/reference-implementation/test/local-device-coverage-state-commit-postgres.test.ts
@@ -19,7 +19,10 @@ import {
   readCommittedLocalCoverageDiagnostics,
   readCommittedLocalCoverageDiagnosticsByConnectionIds,
 } from "../server/records.ts";
-import { recordCollectionRevisionEvent } from "../server/stores/collection-revision-store.ts";
+import {
+  issueCollectionRunSequence,
+  recordCollectionRevisionEvent,
+} from "../server/stores/collection-revision-store.ts";
 import { createPostgresConnectorStateStore } from "../server/stores/connector-state-store.ts";
 import { commitTerminalRun } from "../server/stores/terminal-run-commit-store.ts";
 import { dedicatedPostgresTestUrl } from "./helpers/dedicated-postgres-test-url.ts";
@@ -113,7 +116,14 @@ test("real PostgreSQL: the collection revision orders commits and observed event
       sessions: "1",
     });
 
-    // A terminal run takes revision 2; its own state rows and its run record carry it.
+    // A terminal run takes revision 2; its own state rows and its run record carry it. The run
+    // registered its start, so it is also the run-order marker.
+    await issueCollectionRunSequence({
+      connectorInstanceId: WITH_STATE,
+      deviceId: "dev_revision_fence_pg",
+      runId: PROOF_RUN,
+      sourceInstanceId: "src_revision_fence_pg",
+    });
     await commitTerminalRun({
       collectionBoundary: "unscoped",
       commitId: `commit_${PROOF_RUN}`,
@@ -145,7 +155,12 @@ test("real PostgreSQL: the collection revision orders commits and observed event
         runId: PROOF_RUN,
       }
     );
-    assert.equal(afterRun.withState?.proofRun?.runId, PROOF_RUN, "the fence reads the run the high-water mark names");
+    assert.equal(afterRun.withState?.proofRun?.runId, PROOF_RUN, "the fence reads the run the run-order marker names");
+    assert.deepEqual(
+      afterRun.withState?.runOrder,
+      { event: "terminal_run", revision: 2, runId: PROOF_RUN, sequence: 1 },
+      "the run-order marker is the run's terminal record"
+    );
     assert.equal(afterRun.withState?.proofRun?.facts?.collection_revision, 2, "the run record carries its revision");
     assert.deepEqual(afterRun.scopeOnly?.highWater, {
       at: null,
diff --git a/reference-implementation/test/local-device-terminal-coverage-projection.test.ts b/reference-implementation/test/local-device-terminal-coverage-projection.test.ts
index a4ef792c0..5f5635510 100644
--- a/reference-implementation/test/local-device-terminal-coverage-projection.test.ts
+++ b/reference-implementation/test/local-device-terminal-coverage-projection.test.ts
@@ -13,10 +13,22 @@ import { fingerprintDeviceAttemptManifest } from "../server/device-ingest-attemp
 import { buildStoredCollectionScope, COLLECTION_SCOPE_STATE_KEY } from "../server/local-collection-scope.ts";
 import { readLocalCollectorArtifactDigest, readLocalCollectorRelease } from "../server/local-collector-profiles.ts";
 import { getConnectorSummaryForRoute, listConnectorSummaries } from "../server/ref-control.ts";
+import { issueCollectionRunSequence } from "../server/stores/collection-revision-store.ts";
 import { createSqliteConnectorInstanceStore } from "../server/stores/connector-instance-store.ts";
 import { getDefaultDeviceExporterStore } from "../server/stores/device-exporter-store.ts";
 import { commitTerminalRun } from "../server/stores/terminal-run-commit-store.ts";
 
+/** Commit a terminal record for a run registered at its start, as the runtime does before its scan. */
+async function commitRegisteredTerminalRun(input: Parameters<typeof commitTerminalRun>[0]) {
+  await issueCollectionRunSequence({
+    connectorInstanceId: input.connectorInstanceId,
+    deviceId: input.deviceId,
+    runId: input.runId,
+    sourceInstanceId: input.sourceInstanceId,
+  });
+  return await commitTerminalRun(input);
+}
+
 const connectorId = "claude-code";
 const connectorInstanceId = "cin_terminal_coverage";
 const deviceId = "dev_terminal_coverage";
@@ -148,7 +160,7 @@ async function seedTerminalCoverage(
     },
     server_artifact_digest: readLocalCollectorArtifactDigest(sourceConnectorId),
   };
-  await commitTerminalRun({
+  await commitRegisteredTerminalRun({
     collectionBoundary: "unscoped",
     commitId: "commit_terminal_coverage",
     connectorId: sourceConnectorId,
@@ -360,7 +372,7 @@ for (const includeState of [false, true]) {
         validateServerArtifactDigest: true,
       });
       assert.ok(unknownFacts, "the empty successful result must expand to explicit unknown inventory");
-      await commitTerminalRun({
+      await commitRegisteredTerminalRun({
         collectionBoundary: "unscoped",
         commitId: `commit_terminal_coverage_omission_${includeState}`,
         connectorId,

From 832d0b2ed425079dfcb7bb4406c33142348e7a6c Mon Sep 17 00:00:00 2001
From: Tim Nunamaker <tnunamak@gmail.com>
Date: Thu, 22 Oct 2026 11:19:55 -0500
Subject: [PATCH 46/87] docs(coverage): record run order, the restore epoch and
 the contract gap

The note now separates the two orders: run order decides whether a proof
is eligible, and the commit revision orders observations and dates the
as-of. It records how the server issues run sequences, the multiple
collector rule, replay, ingest before a crash, the restore step and the
restore paths it cannot detect, and the device receipt order. It names the
@pdpp/reference-contract members the vendored contract still lacks and
where they must be added.

Assisted-by: AI
Signed-off-by: Tim Nunamaker <tnunamak@gmail.com>
---
 docs/261021-local-device-coverage-evidence.md | 66 ++++++++++++++++---
 1 file changed, 58 insertions(+), 8 deletions(-)

diff --git a/docs/261021-local-device-coverage-evidence.md b/docs/261021-local-device-coverage-evidence.md
index 3cbccdca4..2f9a0a2bb 100644
--- a/docs/261021-local-device-coverage-evidence.md
+++ b/docs/261021-local-device-coverage-evidence.md
@@ -34,11 +34,11 @@ Only collected can support a positive coverage verdict. START.collection_scope c
 
 The collector validates the typed field before accepting it. It carries store IDs and statuses in a version 2 terminal commit only after successful DONE, complete scan, drained outbox, and durable checkpoint. The server validates the commit against authenticated device/source/connector identity, boundary, manifest inventory, status enum and commit ID. Existing version 1 commits remain accepted; an old device or missing field continues to work but does not gain coverage. Malformed, partial, unavailable, failed, missing, duplicate, stale or mixed-boundary evidence stays unknown or a worse gap state. The validated proof must feed both the Collection Report and connection coverage axis. A drained outbox alone is no evidence of coverage.
 
-The collector stores the latest acknowledged v2 receipt in local outbox schema v5, outside prunable outbox rows. A later acknowledged v1 commit removes that receipt. Offline status can describe the receipt's measured boundary; doctor compares it with the active owner boundary. The server read model must make the same boundary comparison before showing positive connection coverage.
+The collector stores the latest acknowledged receipt in the local outbox (schema v6), outside prunable outbox rows, with the run's order as the server acknowledged it. An acknowledged run without coverage evidence clears the evidence; see "Device receipts" below. Offline status can describe the receipt's measured boundary; doctor compares it with the active owner boundary. The server read model must make the same boundary comparison before showing positive connection coverage.
 
 The device verdict (`pdpp-local-collector status`, `terminal_coverage.verdict`) is `covered` only when the receipt names the selected release, every store is `collected`, and the run's runtime accounting is clean: durable admission, complete detail, consistent stream evidence, checkpoint eligibility, and zero outstanding debt. Clean accounting is the same test the server applies before it withholds `collected`. Missing or malformed accounting reads `no_evidence`; a measured gap reads `incomplete`. Open outbox work for the lane (queued, leased or dead-lettered) reads `unadmitted`, because the latest run has not reached a durable terminal commit and the receipt no longer stands for it.
 
-The server's owner coverage is a fact about one admitted run, shown with its as-of. Any later attempt the server observes (a state commit, a terminal run record, a durable batch record, an admitted or refused batch, a delivered failure report, a legacy split terminal report) retires it to unknown; see "Revision fencing" below. Only an attempt the server never hears about leaves the last admitted coverage in place. Every failed run, including one that fails before its scan, leaves an open `connector_child_failure` gap on the device, so the device shows that run as `unadmitted` until a later complete run is admitted and recovers the gap.
+The server's owner coverage is a fact about one admitted run, shown with its as-of. Any attempt the server observes from the same or a later run (a state commit, a terminal run record, a durable batch record, an admitted or refused batch, a delivered failure report, a legacy split terminal report) retires it to unknown; an observation that names no run counts as the newest started run. See "Run order and commit order" and "Revision fencing" below. Only an attempt the server never hears about leaves the last admitted coverage in place. Every failed run, including one that fails before its scan, leaves an open `connector_child_failure` gap on the device, so the device shows that run as `unadmitted` until a later complete run is admitted and recovers the gap.
 
 ## Collection Profile amendment
 
@@ -48,9 +48,57 @@ The canonical Collection Profile is `data-connectors/docs/spec/collection-profil
 
 Failing-first tests must show absent coverage unknown, a valid fully drained proof covered, partial/unavailable/failed not covered, malformed rejected or unknown, and old devices still working. Verify connector emitters, collector checkpointing, server validation, and both read models. Bump the five connector manifest patch versions and regenerate connector-implementation-index.json. PR #553 then repins the five signed releases and their verified hashes.
 
+## Run order and commit order
+
+The spec gate amended the ordering decision. Two orders exist, and each controls a different thing. This section supersedes "retire by revision comparison only" where the two differ.
+
+| Order | Assigned by | Controls |
+| --- | --- | --- |
+| Run sequence | the server, at run start, per connection | whether a positive proof is eligible |
+| Commit revision | the server, at commit, per connection | the order of server observations and projections, and the as-of |
+
+No wall clock takes part in either.
+
+Sequence issuance. The runtime already contacts the server before it scans: a "starting" heartbeat, the pre-scan drain, and the state read, which names the connection. None of these can carry the issuance. The heartbeat is a best-effort liveness signal that names no run, and the state read is a GET, which must stay free of side effects. The runtime therefore makes one new idempotent call at the same point, after the state read and before the scan: `POST .../source-instances/{source}/run-starts` with the run id. The server resolves the authenticated device, source and connection the same way as the terminal route. In one transaction that holds the connection row lock, it increments `connector_instances.run_sequence_issued` and stores `(connector_instance_id, run_id) -> (run_sequence, storage_epoch, device_id, source_instance_id)` in `collection_run_sequences`. An exact replay of the same run id from the same device and source returns the stored sequence (200). The same run id from another device or source is `409 run_start_conflict`. The runtime keeps the run id it registered and uses it for the run's terminal record. A server without the route (404), or a failed call, leaves the run without a sequence. The run still collects and commits its terminal record, but that record can never be an eligible positive proof.
+
+Multiple collectors. The sequence is connection-scoped and fenced by construction: the connection row lock serializes issuance, so two devices or runtimes that collect one connection get distinct sequences in start order. Several collectors per connection are therefore allowed. The proof of the most recently started run that the server has heard from is the only one that can be current.
+
+Observed maximum. Every observation that takes a commit revision (see the table below) also updates a run-order marker on `connector_instances`, in the same transaction, after the revision `UPDATE` has locked the row: `run_order_sequence`, `run_order_event`, `run_order_run_id`, `run_order_revision`. An observation that names a run with a sequence in the current storage epoch has that sequence. An observation that names no such run is attributed to the newest issued sequence (`run_sequence_issued`) with no run id. Record batches, refused batches and state commits name no run, so they are always attributed this way; a failure report or terminal record of an unknown run is too. Attribution can retire a proof but never establish one. If the observation's sequence is greater than or equal to `run_order_sequence`, the marker moves to it: sequence, event, attributed run id (or NULL) and revision. A lower sequence leaves the marker unchanged. The observation still takes its commit revision and is stored as history.
+
+Eligibility. A positive proof is a v2 terminal run record. It is current only when all of these hold:
+
+- the marker event is `terminal_run` and the marker run id is the proof run;
+- the proof's commit revision equals `run_order_revision`;
+- the proof's run sequence equals `run_order_sequence`;
+- the proof's storage epoch equals the connection's current `storage_epoch`;
+- the existing checks pass: one release digest, the boundary and manifest snapshot, and no newer settled device run without a revision.
+
+So an old run's proof that reaches the server after a newer run's terminal record (an outbox delay or retry) takes the next commit revision and is stored, but its sequence is below the marker, so it stays a historical fact with its as-of and never becomes current. A run without a server-issued sequence never matches the marker.
+
+Replay. An exact replay of a run's terminal record returns the stored receipt and moves neither the sequence nor the revision. A conflicting duplicate fails with `409` and writes nothing. The HTTP route resolves the receipt before it validates the request against the current manifest inventory, so an authorized exact replay still gets its receipt after an inventory change. It keeps the full device, source and connection binding: the route authorizes the device and resolves the source and connection before the lookup, and the stored receipt must match every binding field.
+
+Crash after ingest. A durable record is an observation attributed to the newest issued sequence. The run that ingested it registered its sequence before its scan, so the record moves the marker to that sequence and retires an earlier positive, even if the run dies before its terminal record. Repeated authorized refused batches can keep coverage unknown. That is accepted: a false positive is never kept to resist it.
+
+Restore incarnation. The repository has no automatic restore detection. Its restore concept is the storage epoch: `connector_instance_config_current.storage_epoch` is documented as "bumped on backup restore / re-import", but no code bumps it, and only connections with a config pointer have one. The coverage order binds to that concept rather than a parallel one. `connector_instances.storage_epoch` (default 1) is the connection's storage epoch, and one restore step, `beginStorageEpochAfterRestore` (`reference-implementation/scripts/mark-storage-restored.ts`), increments it and `connector_instance_config_current.storage_epoch` for every row in one transaction. Issuance rows and terminal records carry the epoch they were committed in. After the step, every positive proof from before it fails the epoch check and reads unknown until a run issued in the new epoch commits an eligible terminal record. A sequence issued before the restore resolves to no run in the new epoch, so its observations are attributed to the newest issued sequence and cannot establish a proof. The declared restore path is: restore the database, run the step, then start the server. A restore without the step, such as a reverted virtual-machine snapshot, is not detected. A restored older proof can then read as current again. The server cannot detect that path, and this note discloses it as a deployment limitation, as Core restore safety requires.
+
+Device receipts. The device stores, with each acknowledged terminal receipt, the run id, the run sequence and storage epoch the server acknowledged, and the commit revision. It replaces the stored receipt only with an acknowledgement for a later run: a higher (storage epoch, run sequence), or any acknowledgement when the stored receipt has no sequence. An older run's late acknowledgement leaves a newer receipt in place. An acknowledgement without a sequence clears the evidence but keeps the stored order. `pdpp-local-collector status` shows the receipt's as-of, and its verdict is `covered` only for a receipt with a sequence and a revision. Outbox schema v6 adds the columns; a v5 receipt has none of them and reads `no_evidence` until the next acknowledged run.
+
+Tests. `A` is `reference-implementation/test/local-device-coverage-revision-atomicity.test.ts` (SQLite and PostgreSQL), `J` is `local-device-coverage-journey.test.ts`, `O` is `packages/collector-runtime/src/local-device-outbox.test.ts`, `L` is `packages/local-collector/test/runner.test.ts`.
+
+| Rule | Tests |
+| --- | --- |
+| Delayed older proof stays history | A "run order: an older run's proof that arrives after a newer run's terminal record stays history"; J "J5" |
+| No issued sequence, no eligible proof | A "run order: a run with no issued sequence never produces an eligible proof" |
+| Second collector | A "run order: a second collector on one connection is ordered by run start, not by commit"; A "run start: the route issues a connection-scoped sequence and an exact replay returns it" |
+| Replay and conflicting duplicate | A "replay: an exact terminal replay after an inventory change gets its receipt; a conflicting duplicate fails atomically" |
+| Restore incarnation | A "restore: the restore step makes a restored proof unknown until a new eligible terminal" |
+| Ingest before a crash | A "crash after ingest: a later run's durable records retire an earlier positive without its terminal"; J "J6" (kills the runner process) |
+| Device receipt order and as-of | O "an older run's late ACK does not replace a newer run's receipt", "an ACK without a run sequence clears the evidence and keeps the stored order", "a v5 outbox upgrades to v6 and keeps its receipt readable without an as-of"; L "a receipt without a run sequence is no evidence, and an older run's late ACK does not replace a newer receipt" |
+| Contract | A "contract: owner diagnostics and connector detail validate against @pdpp/reference-contract" |
+
 ## Revision fencing (replaces the wall-clock stale-proof rule)
 
-The spec gate replaced the server's wall-clock rule (MAX `connector_state.updated_at` compared with the proof instant) with a monotonic per-connection revision. Equal timestamps do not identify a transaction, and a skewed clock can order a later commit before an earlier one. The revision follows the Core restore-safety fencing principle: retire by revision comparison only.
+The spec gate replaced the server's wall-clock rule (MAX `connector_state.updated_at` compared with the proof instant) with a monotonic per-connection revision. Equal timestamps do not identify a transaction, and a skewed clock can order a later commit before an earlier one. The revision follows the Core restore-safety fencing principle. Since the amended decision, the revision orders observations and projections, and run order decides eligibility (see "Run order and commit order").
 
 Events that get a revision. The server assigns the next revision inside the transaction that persists each event it can observe for an authorized connection. The event and its revision commit together or not at all:
 
@@ -78,16 +126,18 @@ Each durable batch record takes its own revision, so a crash after any record co
 
 Storage. `connector_instances` holds the high-water mark: `collection_revision` (0 before any event), `collection_revision_event`, `collection_revision_run_id`, and `collection_revision_at` (wall-clock, display only). `connector_state.collection_revision` records the revision of the commit that last wrote each row; the projection no longer reads it. The terminal run event, and so `run_history.facts_json`, carries `collection_revision`, for v2, v1 and legacy split reports. SQLite adds the columns with `addColumnIfMissing`; Postgres uses `ALTER TABLE ... ADD COLUMN IF NOT EXISTS`. Rows that predate the migration read 0 or NULL and fail closed until the next event.
 
-Proof binding. A proof is a v2 terminal run record at revision R; its own state rows carry R. The projection reads the high-water mark, the run it names, the declared scope, the manifest generation and (for a terminal-run high-water mark) the connector manifest in one statement, so the proof payload, its fence and the boundary it is judged against come from one snapshot. The rest of the projection reads the scope, the generation and the manifest separately. A positive needs all three to equal the snapshot's; a scope or manifest change that lands between the reads makes the coverage unknown rather than a positive composed from two moments. A legacy `coverage_diagnostics` state row is never a proof: it names no run and no release digest, so it cannot back "complete as of" anything, and the projection shows unknown for it (PR #553 retires the legacy path).
+Proof binding. A proof is a v2 terminal run record at revision R, with the run sequence and storage epoch of its run; its own state rows carry R. The projection reads the run-order marker, the run it names, the connection's storage epoch, the declared scope, the manifest generation and (for a terminal-run high-water mark) the connector manifest in one statement (the manifest only when the marker is a terminal run), so the proof payload, its fence and the boundary it is judged against come from one snapshot. The rest of the projection reads the scope, the generation and the manifest separately. A positive needs all three to equal the snapshot's; a scope or manifest change that lands between the reads makes the coverage unknown rather than a positive composed from two moments. A legacy `coverage_diagnostics` state row is never a proof: it names no run and no release digest, so it cannot back "complete as of" anything, and the projection shows unknown for it (PR #553 retires the legacy path).
 
-Retirement. A proof is current only when its revision equals the connection's high-water revision, the high-water event is `terminal_run`, and its run id is the proof run. The server reads the proof run by that run id, not by the newest `completed_at`. Any later observable event raises the high-water revision and retires the proof to unknown. A legacy split report is its own `legacy_terminal` event, so one delayed past a newer proof retires that proof. No wall clock takes part.
+Retirement. A proof is current only when it is the run-order marker: the marker event is `terminal_run`, its run id is the proof run, the proof's revision equals `run_order_revision`, its run sequence equals `run_order_sequence`, and its storage epoch is the connection's current one. The server reads the proof run by that run id, not by the newest `completed_at`. An observation of the same or a later run moves the marker and retires the proof to unknown. An observation of an older run takes the next revision but leaves the marker, so a delayed older proof or report stays history. A legacy split report names its run: an older run's report is history, and a report of an unregistered run counts as the newest started run and retires the proof. No wall clock takes part.
 
-Fail closed. Coverage is unknown when the high-water row or the proof revision is missing, NULL, not a safe integer, or unequal; when the high-water event or run id differs from the proof; when the proof does not name exactly one release digest; or when the revision read fails. A proof is also unknown when the newest settled device run is a different run that carries no revision (a pre-migration row), because its order against the proof is ambiguous.
+Fail closed. Coverage is unknown when the run-order marker, the proof revision, its run sequence or its storage epoch is missing, NULL, not a safe integer, or unequal; when the marker event or run id differs from the proof; when the run had no issued sequence; when the proof does not name exactly one release digest; or when the revision read fails. A proof is also unknown when the newest settled device run is a different run that carries no revision (a pre-migration row), because its order against the proof is ambiguous.
 
 Terminal record for every successful run. A runtime that implements this profile version commits a terminal run record for every run whose DONE succeeded, even when coverage was not negotiated and no STATE changed. Without coverage evidence it sends a version 2 commit with empty `terminal_facts`, carrying the run's STATE delta. The server stores unknown inventory for it, and the device clears its receipt (`no_evidence`). A server that names no connection on its state read cannot bind a terminal record, so against such a server the runtime keeps the plain state checkpoint.
 
-As-of. Every owner projection that can show positive local coverage carries `coverage_as_of`: run id, release digest, collection revision, and commit time. That is the connector summary (list), the connector detail, the owner connection diagnostics (`health.axes` and `rendered_verdict`), and the connection health embedded in each (`connection_health.coverage_as_of`, `health.coverage_as_of`), which equals the top-level value. All of them read the same summary projection. Owner UI copy reads "complete as of <time>". The published `@pdpp/reference-contract` diagnostics schema does not list `coverage_as_of` yet and sets `additionalProperties: false`; the contract needs a release that adds it.
+As-of. Every owner projection that can show positive local coverage carries `coverage_as_of`: run id, release digest, run sequence, collection revision, and commit time. That is the connector summary (list), the connector detail, the owner connection diagnostics (`health.axes` and `rendered_verdict`), and the connection health embedded in each (`connection_health.coverage_as_of`, `health.coverage_as_of`), which equals the top-level value. All of them read the same summary projection. Owner UI copy reads "complete as of <time>".
+
+Contract. `@pdpp/reference-contract` is vendored as `reference-implementation/vendor/pdpp-reference-contract-0.1.0.tgz`, compiled from `packages/reference-contract` in PDP-Connect/pdpp at commit `0d3deca1` (see `reference-implementation/vendor/README.md`). Its diagnostics schemas set `additionalProperties: false` and do not list `coverage_as_of`, at the top level or in `health`. Its terminal-run response schema does not list `collection_revision`, `run_sequence` or `storage_epoch`, and the new run-start route has no contract entry, like the other local-collector routes (`terminal-collection`, `local-collector-gaps`). The source schema must add these members in PDP-Connect/pdpp; this repository then re-vendors the tarball by the documented process. `test/local-device-coverage-revision-atomicity.test.ts` validates the diagnostics and connector detail responses against the vendored contract and lists the members still pending; it fails when the vendored contract gains one, so the list cannot go stale.
 
 Device diagnostics. `local_collector_coverage` in the device-exporter diagnostics takes `fully_accounted` and `coverage_as_of` from the same summary projection: true only while the fenced proof is current and the coverage axis is `complete`. Its `by_store`, `counts_by_status`, `store_count` and `unaccounted_stores` are historical inventory from raw `coverage_diagnostics` records, with no run, release or revision behind them, and never claim current completeness.
 
-Limits. The server cannot order an attempt it never hears about. Examples are a run refused before authorization, a device that goes offline before it delivers its failure barrier, and a runner that predates this version and sends neither state nor records. In those cases the projection keeps the last admitted proof, labelled with its as-of. The device keeps its stricter local verdict. There is no heartbeat or lease machinery.
+Limits. The server cannot order an attempt it never hears about. Examples are a run refused before authorization, a device that goes offline before it delivers its failure barrier, and a runner that predates this version and sends neither state nor records. A run start is not an observation either: a run that dies after it registers, before it sends anything the server records, leaves the proof in place. That includes a run whose record batches are all exact replays of batches the server already admitted, because an idempotent replay takes no revision. A restore without the restore step is not detected (see "Restore incarnation"). In those cases the projection keeps the last admitted proof, labelled with its as-of. The device keeps its stricter local verdict. There is no heartbeat or lease machinery.

From 06fe905cdbb11b35bf06b0ebdc99645f822a664a Mon Sep 17 00:00:00 2001
From: Tim Nunamaker <tnunamak@gmail.com>
Date: Thu, 22 Oct 2026 14:04:50 -0500
Subject: [PATCH 47/87] docs(coverage): map each Collection Profile MUST to its
 failure and test

The Collection Profile trim in data-connectors #541 moves server storage
mechanics out of the spec and keeps the normative rules. This section of the
implementer note records what moved and what was dropped. It also maps each
remaining MUST to the failure it prevents and to the test that proves it.
Fifteen MUST rows have no test yet. The Gaps subsection lists them.

Signed-off-by: Tim Nunamaker <tnunamak@gmail.com>
Assisted-by: AI
---
 docs/261021-local-device-coverage-evidence.md | 160 ++++++++++++++++++
 1 file changed, 160 insertions(+)

diff --git a/docs/261021-local-device-coverage-evidence.md b/docs/261021-local-device-coverage-evidence.md
index 2f9a0a2bb..1e888c1b0 100644
--- a/docs/261021-local-device-coverage-evidence.md
+++ b/docs/261021-local-device-coverage-evidence.md
@@ -141,3 +141,163 @@ Contract. `@pdpp/reference-contract` is vendored as `reference-implementation/ve
 Device diagnostics. `local_collector_coverage` in the device-exporter diagnostics takes `fully_accounted` and `coverage_as_of` from the same summary projection: true only while the fenced proof is current and the coverage axis is `complete`. Its `by_store`, `counts_by_status`, `store_count` and `unaccounted_stores` are historical inventory from raw `coverage_diagnostics` records, with no run, release or revision behind them, and never claim current completeness.
 
 Limits. The server cannot order an attempt it never hears about. Examples are a run refused before authorization, a device that goes offline before it delivers its failure barrier, and a runner that predates this version and sends neither state nor records. A run start is not an observation either: a run that dies after it registers, before it sends anything the server records, leaves the proof in place. That includes a run whose record batches are all exact replays of batches the server already admitted, because an idempotent replay takes no revision. A restore without the restore step is not detected (see "Restore incarnation"). In those cases the projection keeps the last admitted proof, labelled with its as-of. The device keeps its stricter local verdict. There is no heartbeat or lease machinery.
+
+## Collection Profile trim: moved text, dropped text, rule-to-failure-to-test
+
+Non-normative. This section supports data-connectors PR #541, which trims
+`docs/spec/collection-profile.md` (Sections 3.2, 3.4, 5.1, 5.8.2 to 5.8.4,
+6.2 item 14, and 8). It records what left the profile and why. The table gives
+the failure behind each MUST that remains, and the test that proves it.
+
+Test labels used below:
+
+- ATOM: `reference-implementation/test/local-device-coverage-revision-atomicity.test.ts`
+- JOUR: `reference-implementation/test/local-device-coverage-journey.test.ts`
+- STALE: `reference-implementation/test/local-device-coverage-stale-proof.test.ts`
+- PROJ: `reference-implementation/test/local-device-terminal-coverage-projection.test.ts`
+- OP: `reference-implementation/test/local-device-terminal-run-commit-operation.test.ts`
+- RESTART: `reference-implementation/test/terminal-run-commit-collector-restart.test.ts`
+- GREEN: `reference-implementation/test/ref-connectors-local-coverage-green.test.ts`
+- STATE-PG: `reference-implementation/test/local-device-coverage-state-commit-postgres.test.ts`
+- RUNNER: `packages/collector-runtime/src/collector-runner.test.ts`
+- OUTBOX: `packages/collector-runtime/src/local-device-outbox.test.ts`
+- LC: `packages/local-collector/test/runner.test.ts`
+- CONSOLE: `apps/console/src/app/(console)/lib/connection-evidence.test.ts`
+- DC: data-connectors `schemas/connector-manifest.schema.test.mjs`. These are
+  text pins. They show that the profile says the rule, not that an
+  implementation obeys it.
+
+### Moved from the profile
+
+Each item below was in #541's text and is now in the section named. Two items
+were not in this note before, and they are added here.
+
+- Revision events and their transactions: "Events that get a revision".
+- Sequence issuance, the run-order marker, and the observed maximum:
+  "Sequence issuance" and "Observed maximum".
+- Commit order does not decide eligibility: "Run order and commit order".
+- Runs from several devices ordered by start: "Multiple collectors".
+- Exact replay resolves the stored receipt before it validates mutable state:
+  "Replay".
+- Restore incarnation and the storage epoch: "Restore incarnation".
+- Attempts the server never observes, runs that die after registering, and
+  the absence of a heartbeat or lease: "Limits".
+- A runtime from before this version sends no terminal record, so an earlier
+  proof stays current: "Terminal record for every successful run" and "Limits".
+- Added here. The server resolves the release pair only after it authorizes
+  the source instance, and it binds the claim to that instance's current
+  binding generation. A connector-id-only manifest lookup, with no artifact
+  pin, an unregistered digest, or a digest paired with another manifest
+  fingerprint, never establishes positive coverage. If the release pair or its
+  instance binding is missing or does not match, the result is unknown.
+- Added here. The runtime retains the validated assertion separately from the
+  derived verdict and from the evidence behind that verdict.
+
+### Dropped from the profile
+
+- "This section defines no client-visible PDPP Core response member." It is a
+  scope statement with no failure behind it.
+- "A runtime MAY request a separate run containing only instrumented streams."
+  It is a permission. The rule that matters, that a connection-wide verdict
+  does not cover uninstrumented streams, is kept.
+- "A manifest MAY advertise support ... with `run_coverage: { "version": 1 }`."
+  No failure depends on it, because START negotiation is what matters.
+- "Checkpoint eligibility MUST remain governed by Sections 5.6 and 5.8." It
+  restates the downgrade rule.
+- "Connector package patch versions alone MUST NOT establish wire
+  compatibility" and "Deployment MUST be runtime-first." Base Section 8 already
+  says that profile versions are independent of connector versions and that
+  rollout is runtime-first.
+- "Adding this optional feature to an already published profile requires a
+  minor profile version." Section 1 places this feature in 0.3.0, which covers
+  it.
+- "It also defines optional version 1 terminal store collection evidence ...
+  the linked schemas do not yet establish support." Section 1 already says the
+  linked schemas do not establish support for the version.
+- Folded into the rules that carry the same failure: "Emission is provisional
+  until durable admission" (into the durable-admission and rejected-effect
+  MUSTs), "Dispositions MAY include ..." (into the `collected` status),
+  "Runtime evidence that contradicts `collected` MUST take precedence" (into
+  the connector-assertion MUST), "Failure of a complete-data claim MUST NOT ...
+  gap debt" (into the checkpoint-downgrade MUST), and "Positive coverage
+  applies only to the validated targets, source account, boundary, and release"
+  (into the retained-bindings MUST in 5.8.4).
+
+### Rule, failure, test
+
+| § | MUST (trimmed profile) | Failure it prevents | Test |
+| --- | --- | --- | --- |
+| 3.2 | An identifier MUST NOT contain a credential or device-specific path. | A credential or device path is published in a signed manifest. | none (gap) |
+| 3.2 | The manifest MUST state each store's obligation, content or metadata only. | Metadata-only inventory reads as completeness of content. | OP: "proven empty content is complete while metadata inventory stays inventory only" |
+| 3.2 | A runtime MUST NOT derive store coverage for a stream with no `coverage_stores`. | An undeclared store reads as covered. | OP: "the terminal endpoint rejects a store outside the registered inventory" |
+| 3.2 | A change to a store's obligation MUST change the manifest revision. | A proof for the old obligation survives the change. | PROJ: "catalog obligation changes invalidate proof when the binding generation advances" |
+| 3.4 | A connector that cannot run without the evidence MUST declare `RUN_COVERAGE_V1`. | The runtime runs the connector and silently drops evidence it needs. | none (gap) |
+| 3.4 | A runtime that does not support the capability MUST refuse the connector before spawn. | Same as above, without the declaration. | none (gap) |
+| 3.4 | When START omits `run_coverage_version`, a connector MUST omit `DONE.coverage`. | Coverage that was not requested is trusted. | JOUR: "A: without START coverage negotiation, a successful run supplies no positive coverage"; RUNNER: "a connector that does not request coverage cannot submit a positive DONE verdict" |
+| 3.4 | If version 1 was requested and a successful DONE omits `coverage` (including from producers that predate the field), the runtime MUST treat the stores as unknown and MUST NOT keep an earlier positive. | An omission is read as "not supported", and the older proof stays current. | RUNNER: "successful DONE without coverage retires earlier proof with STATE" and "... without STATE"; PROJ: "legacy terminal commit without v2 proof stays unknown" |
+| 3.4 | Negotiating this evidence MUST NOT disable or weaken detail accounting, diagnosis, or checkpoint rules. | Opting into coverage skips the accounting that protects data. | RUNNER: "runCollectorConnector lets SKIP_RESULT defeat a collected DONE assertion"; OP: "checkpoint eligibility ${eligible} governs state advancement with accounted debt" |
+| 8 | A runtime MUST NOT request evidence that its persistence and validation path cannot accept. | Evidence is requested, then silently dropped. | none (gap) |
+| 5.1 | A runtime that requests version 1 MUST supply a non-empty `collection_scope`. | A proof with no scope binds to nothing. | none (gap; the mismatch case is below) |
+| 5.1 | The connector MUST echo `collection_scope` without modification. | Coverage is claimed for a different scope. | RUNNER: "runCollectorConnector rejects a DONE coverage scope echo that differs from actual START scope" |
+| 5.1 | The runtime MUST bind the string to the run's normalized targets, collection mode, boundary, and source-root restrictions. | A proof for one boundary is replayed for another. | PROJ: "v2 terminal proof for an old collection scope cannot cover the current scope" |
+| 5.1 | The echoed string MUST NOT confer authorization. | A connector string widens access. | none (gap) |
+| 5.1 | `unscoped` MUST NOT remove a restriction in `START.scope` or the authority bindings. | A run escapes its scope and still claims coverage. | none (gap) |
+| 5.8.2 | A failed DONE MUST NOT contain `coverage`. | A failed run's claims are trusted. | PROJ: "a newer failed run cannot retain an earlier v2 covered verdict" (projection side only; the DONE side is untested) |
+| 5.8.2 | The coverage object's shape: `version`, `collection_scope`, `streams`, the stream and store fields, and the status enum. | Malformed coverage reaches the projection. | RUNNER: "runCollectorConnector rejects malformed DONE coverage: ${label}" and "runCollectorConnector rejects ${versionLabel} DONE coverage versions"; RUNNER: "runCollectorConnector flags an unrecognized coverage status as unaccounted" |
+| 5.8.2 | Stream entries MUST equal the requested set, and each stream's stores MUST equal its manifest inventory, with no duplicates or extras. | Missing or extra streams or stores read as covered. | RUNNER: "runCollectorConnector rejects missing and extra DONE coverage streams"; OP: "v2 claims with an extra store outside the registered inventory are rejected"; OP: "v2 normalization rejects duplicate streams and duplicate stores" |
+| 5.8.2 | A connector MUST omit the whole object when a requested stream has no declared inventory. | A stream with no inventory claims coverage. | none direct (gap) |
+| 5.8.2 | A connector MUST report `collected` only after enumeration closes and every in-scope candidate has a disposition. | A complete claim with candidates still open. | RUNNER: "runCollectorConnector withholds collected coverage after an HTTP receipt rejects a record" |
+| 5.8.2 | A connector MUST report `partial` when an in-scope candidate, field, item, or payload is skipped, deferred, unsupported, or pending. | Skipped items read as complete. | RUNNER: "runCollectorConnector lets SKIP_RESULT defeat a collected DONE assertion" |
+| 5.8.2 | A connector MUST report `unavailable` when it could not access the store before enumeration began. | An inaccessible store reads as partial or complete. | PROJ: "an unavailable store verdict never projects complete on list or detail" |
+| 5.8.2 | A connector MUST report `failed` when enumeration or classification began and did not finish. | An unfinished enumeration reads as complete. | PROJ: "local-device v2 ${status} verdict never projects covered" |
+| 5.8.2 | Absence of records or a file-read failure MUST NOT by itself establish proven emptiness. | A missing store reads as empty and complete. | none (gap) |
+| 5.8.2 | `scoped: true` MUST NOT assert binding enforcement under Section 3.3.9. | Enumeration honesty is read as enforcement. | none (gap) |
+| 5.8.2 | The runtime MUST derive accepted coverage from the assertions and its observable accounting. | Connector claims are accepted as proof. | OP: "connector collected assertions cannot override runtime accounting or absent admission" |
+| 5.8.2 | The runtime MUST reconcile DETAIL_COVERAGE, STREAM_EVIDENCE, durable admission, and outstanding debt for the same obligations. | A store is complete while its detail or debt says otherwise. | PROJ: "runtime ${field} contradiction prevents both owner projections claiming complete" |
+| 5.8.2 | The runtime MUST downgrade a `collected` assertion when it observes a skip, an inconsistency, a rejected effect, unresolved debt, or a withheld checkpoint. | A complete claim survives runtime evidence. | RUNNER: "runCollectorConnector lets SKIP_RESULT defeat a collected DONE assertion"; RUNNER: "runCollectorConnector withholds collected coverage after an HTTP receipt rejects a record" |
+| 5.8.2 | The connector's assertion MUST NOT override runtime evidence. | Same as above. | OP: "connector collected assertions cannot override runtime accounting or absent admission" |
+| 5.8.2 | The downgrade MUST NOT by itself make an otherwise eligible checkpoint ineligible. | A coverage downgrade stalls checkpoint progress. | OP: "checkpoint eligibility ${eligible} governs state advancement with accounted debt" |
+| 5.8.2 | `DONE.coverage` MUST NOT authorize STATE advancement, a materialization receipt, debt settlement, or a substitute for accounting. | STATE advances, or debt settles, on a coverage claim. | partial: OP "connector collected assertions cannot override runtime accounting or absent admission" (no direct test that a collected DONE alone leaves STATE unchanged) |
+| 5.8.2 | Before it records positive coverage, the runtime MUST validate the version, boundary echo, stream set, inventories, statuses, and bindings. | Unvalidated coverage is recorded as positive. | PROJ: "malformed persisted v2 store inventory never projects covered"; OP: "version 2 terminal coverage validates named stores against the manifest" |
+| 5.8.2 | Missing, unsupported, or malformed coverage MUST NOT establish positive coverage. The runtime MAY fail the exchange; otherwise it MUST record unknown or a worse result. | A malformed claim keeps a proof positive. | PROJ: "legacy terminal commit without v2 proof stays unknown" |
+| 5.8.2 | A runtime MUST NOT treat a transport acknowledgment as durable admission. | Records lost after a transport ack count as admitted. | JOUR: "B2: a server-rejected record stays unadmitted, moves no cursor, and leaves the lane not covered" (partial: the record was rejected, not only acknowledged) |
+| 5.8.2 | A rejected in-scope effect, unresolved debt, missing accounting, or withheld checkpoint MUST prevent positive coverage for that obligation. | Positive coverage over a rejected record. | RUNNER: "runCollectorConnector withholds collected coverage after an HTTP receipt rejects a record"; JOUR: "J3: a run that fails before its scan leaves the lane not covered; the server keeps run A's coverage until a later run recovers" |
+| 5.8.2 | A positive's artifact digest and manifest fingerprint MUST match a release pair that the runtime or server has verified. | An unverified or mismatched release certifies code. | OP: "a v2 claim cannot pair a registered digest with another manifest fingerprint"; OP: "terminal coverage requires the release registered for the authorized connector instance" |
+| 5.8.2 | An unregistered digest, or a digest with a different fingerprint, MUST NOT establish positive coverage. | Same as above. | OP: "the terminal endpoint keeps an unregistered digest unknown"; OP: "unregistered well-formed artifact digests remain unknown" |
+| 5.8.2 | A different release MUST invalidate a positive unless a compatibility rule preserves its obligations. | A proof certifies a later release. | PROJ: "unchanged manifest with a different artifact digest projects unknown on list and detail" |
+| 5.8.2 | After a negotiated success, an omitted `DONE.coverage` is a new terminal result: the runtime MUST retire earlier positives for the connection and release, and MUST record the stores as unknown, with or without STATE. | A silent omission keeps the old proof current. | PROJ: "successful empty v2 terminal replacement retires earlier proof with state" and "... without state"; STALE: "journey: a later unnegotiated run with no STATE commits a terminal record that retires the proof"; JOUR: "U: after a covered run, an unnegotiated success with STATE retires the proof on server and device" and "... without STATE ..." |
+| 5.8.2 | A negative store result MUST NOT be erased by a later positive without independently valid recovery evidence. | A partial store flips to complete on an unsupported claim. | none (gap) |
+| 5.8.2 | A connection-wide verdict MUST NOT imply coverage for omitted or uninstrumented streams. | A connection-level "complete" hides an uninstrumented stream. | OP: "selected instrumented stream is accepted beside an uninstrumented stream"; PROJ: "selected-stream v2 proof cannot cover omitted manifest streams" |
+| 5.8.3 | The runtime MUST commit an orderable terminal run record for every successful run, negotiated or not, with or without STATE, and the record MUST name its run and run sequence. | A run without a record leaves an earlier proof current. | RUNNER: "successful DONE without coverage retires earlier proof without STATE"; STALE: "journey: a later unnegotiated run with no STATE commits a terminal record that retires the proof"; ATOM: "run start: the route issues a connection-scoped sequence and an exact replay returns it" |
+| 5.8.3 | A positive MUST be published only after a successful DONE, exit 0, durable admission of the run's relevant effects, and completion of its checkpoint commits. | A positive is published for data that is not yet durable. | RUNNER: "runCollectorConnector rejects a valid concrete ${effectType} before terminal coverage" (admission side; the checkpoint side is covered only by the OP checkpoint test above) |
+| 5.8.3 | The component MUST assign each run a sequence when the run starts, and the runtime MUST obtain it before it admits any effect. | Effects are admitted with no sequence, so no order exists. | ATOM: "run order: a second collector on one connection is ordered by run start, not by commit"; ATOM: "run start: the route issues a connection-scoped sequence and an exact replay returns it" |
+| 5.8.3 | A run without an assigned sequence MUST NOT produce positive coverage. | An unordered run becomes eligible. | ATOM: "run order: a run with no issued sequence never produces an eligible proof" |
+| 5.8.3 | An observed event of the same or a later run MUST retire the positive to unknown. | An attempt does not retire the proof. | JOUR: "J2: a batch the server receives and rejects after a covered run retires the proof on server and device"; JOUR: "J4: a failure report the server receives after a covered run retires the proof"; JOUR: "J6: a runner killed after its records are admitted, before its terminal record, leaves the earlier positive unknown"; ATOM: "crash after ingest: a later run's durable records retire an earlier positive without its terminal" |
+| 5.8.3 | A terminal record of an earlier run that arrives later MUST NOT become current. | A late, older proof becomes current. | ATOM: "run order: an older run's proof that arrives after a newer run's terminal record stays history"; JOUR: "J5: an older run's proof delivered after a newer run's terminal record stays history" |
+| 5.8.3 | If a sequence or revision cannot be read, is missing, or is ambiguous, the result MUST be unknown. | An ambiguous order picks a proof. | STALE: "revision: an unreadable or mismatched revision, run sequence or storage epoch fails closed"; ATOM: "upgrade: rows from before the collection revision fail closed, and the next proof is current" |
+| 5.8.3 | The runtime MUST NOT compare wall-clock timestamps to decide currency. | A skewed clock reorders evidence. | STALE: "revision: a later state commit retires the proof when the server clock has gone back"; STALE: "revision: a newer proof committed with the clock set back is the current proof"; GREEN: "coverage proof eligibility ignores wall-clock ordering when generations match" |
+| 5.8.3 | An exact replay MUST return the stored receipt and change neither the run sequence nor the coverage. | A replay takes a revision and retires a proof, or fails after an inventory change. | ATOM: "replay: an exact terminal replay after an inventory change gets its receipt; a conflicting duplicate fails atomically"; OP: "SQLite route operation composes authorization with 201, exact response-loss replay, and non-disclosing 409"; RESTART: "cursor-aware response-loss restart exact-replays once on ${backend}" |
+| 5.8.3 | A different record for the same run MUST fail and write nothing. | A second record overwrites the receipt. | OP: "divergent receipt conflict returns a typed non-disclosing 409" |
+| 5.8.3 | The component MUST assign a monotonic per-connection revision to every observed event that can establish or retire positive coverage. | Events are unordered, so the current proof is ambiguous. | STALE: "revision: a distinct state commit at the proof's own instant retires it"; STATE-PG: "real PostgreSQL: the collection revision orders commits and observed events, and both coverage readers return the same fence" (skipped unless `PDPP_TEST_POSTGRES_URL` is set) |
+| 5.8.3 | The admitted effect observes the run's sequence and retires earlier positive coverage. | An admitted effect before the terminal record leaves the proof current. | ATOM: "crash after ingest: a later run's durable records retire an earlier positive without its terminal"; JOUR: "J6: a runner killed after its records are admitted, before its terminal record, leaves the earlier positive unknown" |
+| 5.8.3 | The component MUST NOT keep positive coverage to avoid retiring it. | A false positive is kept to avoid an unknown result. | JOUR: "J2: a batch the server receives and rejects after a covered run retires the proof on server and device" |
+| 5.8.3 | Server-owned scope state, heartbeats, gap recoveries, and grant-scoped state MUST NOT take a revision or retire positive coverage. | Liveness writes churn the proof to unknown. | STALE: "revision: a later server-owned scope write is not an event and does not retire the proof" (heartbeats specifically: no direct test) |
+| 5.8.3 | A restore that can regress sequences or terminal records MUST reset positives to unknown until a run assigned after the restore commits a current record. | A restored older proof is current again. | ATOM: "restore: the restore step makes a restored proof unknown until a new eligible terminal" |
+| 5.8.3 | The component MUST disclose the restore paths it does not detect. | An owner trusts coverage after an undetected restore. | none (documentation duty; see "Restore incarnation" and "Limits") |
+| 5.8.3 | A device runtime MUST NOT report a lane as covered while a failure barrier or unadmitted work of a later attempt remains open. | The device shows covered over unadmitted work. | LC: "a later run whose record batch stays ready makes an earlier covered receipt unadmitted"; LC: "a pass that fails before its scan leaves an earlier covered receipt unadmitted"; LC: "a run aborted before start leaves an earlier covered receipt unadmitted" |
+| 5.8.4 | Every projection that shows coverage MUST carry the run identifier and run sequence, the release digest, and the revision and commit time. | Coverage is shown without the run or release it describes. | STALE: "as-of: a shown proof carries its run id, release digest, revision and commit time" |
+| 5.8.4 | A proof with no recorded release MUST show the digest as absent. | A digest is shown for a release that is unknown. | none (gap; the closest case is PROJ: "a local source without a server pin projects unknown with an explicit reason") |
+| 5.8.4 | Owner-facing text MUST present coverage as of its time, not as a present-tense claim. | A stale proof reads as current. | CONSOLE: "coverage chip reads 'complete as of <time>' when the reference names the run it describes"; CONSOLE: "per-stream coverage reads 'complete as of <time>' with the connection's as-of" |
+| 5.8.4 | A runtime MUST retain the run's bindings and MUST revalidate them before it reuses a positive. | A positive is reused across accounts or boundaries. | PROJ: "persisted terminal coverage cannot cross a source binding generation"; OP: "a run bound to its registered release remains valid after the connector catalog advances" |
+| 5.8.4 | Metadata-only inventory coverage MUST NOT be displayed as completeness of the underlying content. | Inventory reads as complete content. | OP: "proven empty content is complete while metadata inventory stays inventory only" |
+| 5.8.4 | A DETAIL_COVERAGE or STREAM_EVIDENCE projection SHOULD carry the same facts. | (SHOULD, so not a conformance requirement.) | none, by design |
+| 6.2 (14) | Runtime conformance: the rows above, as one checklist. | (Aggregate.) | the rows above |
+| 8 | `coverage.version` versions this payload only; it does not replace `protocol_version`. | A runtime reads it as the profile version. | none (gap) |
+| 8 | Implementations MUST NOT assume that an older runtime, or a runtime with a closed manifest validator, ignores unknown manifest or wire fields. | A new field breaks the exchange or the manifest. | none (gap) |
+
+### Gaps
+
+The MUST rows marked "none" have a failure behind them but no conformance test
+in #577 or data-connectors. The data-connectors tests in DC check only the
+profile's wording. Adding a test for each gap is the next step, or the
+sentence should be cut with the failure it covers stated explicitly.

From 5d9554c3835c5cc83e46e251d1876530a76381f0 Mon Sep 17 00:00:00 2001
From: Tim Nunamaker <tnunamak@gmail.com>
Date: Thu, 22 Oct 2026 14:44:30 -0500
Subject: [PATCH 48/87] feat(coverage): refuse a version 1 START without a
 collection scope

buildCollectorStartMessage sent run_coverage_version 1 without
collection_scope when the scope argument was empty, so the evidence
bound to no boundary (Collection Profile 5.1). It now throws. The
runner builds START before it spawns the connector, so a refused
START starts no child.

Assisted-by: AI
Signed-off-by: Tim Nunamaker <tnunamak@gmail.com>
---
 .../src/collector-runner.test.ts              | 24 ++++++++++++
 .../collector-runtime/src/collector-runner.ts | 39 ++++++++++---------
 2 files changed, 44 insertions(+), 19 deletions(-)

diff --git a/packages/collector-runtime/src/collector-runner.test.ts b/packages/collector-runtime/src/collector-runner.test.ts
index 56f21f91d..8cd207e1a 100644
--- a/packages/collector-runtime/src/collector-runner.test.ts
+++ b/packages/collector-runtime/src/collector-runner.test.ts
@@ -158,6 +158,30 @@ test("buildCollectorStartMessage populates START.state only when prior state is
   assert.equal(withState.type, "START");
 });
 
+// Collection Profile Section 5.1: a runtime that requests version 1 evidence
+// supplies a non-empty collection_scope. A request without one would bind the
+// proof to no boundary, so the builder refuses it instead of sending it.
+test("buildCollectorStartMessage refuses a version 1 request without a collection scope", () => {
+  for (const collectionScope of [undefined, "", "  "]) {
+    assert.throws(
+      () => buildCollectorStartMessage(["messages"], [], null, {}, {}, [], collectionScope, 1),
+      /collection_scope/,
+      JSON.stringify(collectionScope)
+    );
+  }
+  assert.deepEqual(buildCollectorStartMessage(["messages"], [], null, {}, {}, [], "unscoped", 1), {
+    collection_scope: "unscoped",
+    run_coverage_version: 1,
+    scope: { streams: [{ name: "messages" }] },
+    type: "START",
+  });
+  assert.deepEqual(
+    buildCollectorStartMessage(["messages"], [], null, {}, {}, []),
+    { scope: { streams: [{ name: "messages" }] }, type: "START" },
+    "a START that requests no evidence needs no scope"
+  );
+});
+
 test("transformRecordsToCollectorEnvelopes uses the given connector id", () => {
   const envelopes = transformRecordsToCollectorEnvelopes({
     batchId: "batch-1",
diff --git a/packages/collector-runtime/src/collector-runner.ts b/packages/collector-runtime/src/collector-runner.ts
index 270b45628..914022eab 100644
--- a/packages/collector-runtime/src/collector-runner.ts
+++ b/packages/collector-runtime/src/collector-runner.ts
@@ -1756,6 +1756,20 @@ async function streamConnectorIntoOutbox(
 ): Promise<StreamConnectorIntoOutboxResult> {
   throwIfAborted(input.abortSignal);
 
+  // START is built before spawn: a START the builder refuses starts no child.
+  const startMessage = buildCollectorStartMessage(
+    input.config.connector.streams,
+    input.config.connector.streamsToBackfill,
+    input.priorState,
+    input.config.connector.resources,
+    resolveScopedStreamTimeRanges(input.config.connector.scope, input.config.connector.timeScopableStreams),
+    // Roots only reach the connector when it declared it enforces them, so
+    // an unsupported connector cannot silently receive a boundary it will
+    // ignore while the run still looks bounded.
+    input.config.connector.enforcesSourceRoots === true ? resolveScopedSourceRoots(input.config.connector.scope) : [],
+    collectorScopeFingerprint(input.config.connector.scope),
+    input.config.connector.runCoverageVersion
+  );
   const child = spawnConnector(
     input.config.connector,
     {
@@ -1989,25 +2003,7 @@ async function streamConnectorIntoOutbox(
     // actionable diagnostic; do not mask it with EPIPE.
   });
   child.stderr.on("data", (chunk: Buffer) => stderr.push(chunk));
-  child.stdin.end(
-    `${JSON.stringify(
-      buildCollectorStartMessage(
-        input.config.connector.streams,
-        input.config.connector.streamsToBackfill,
-        input.priorState,
-        input.config.connector.resources,
-        resolveScopedStreamTimeRanges(input.config.connector.scope, input.config.connector.timeScopableStreams),
-        // Roots only reach the connector when it declared it enforces them, so
-        // an unsupported connector cannot silently receive a boundary it will
-        // ignore while the run still looks bounded.
-        input.config.connector.enforcesSourceRoots === true
-          ? resolveScopedSourceRoots(input.config.connector.scope)
-          : [],
-        collectorScopeFingerprint(input.config.connector.scope),
-        input.config.connector.runCoverageVersion
-      )
-    )}\n`
-  );
+  child.stdin.end(`${JSON.stringify(startMessage)}\n`);
 
   let exitCode: number | null;
   try {
@@ -2511,6 +2507,11 @@ export function buildCollectorStartMessage(
   collectionScope?: string,
   runCoverageVersion?: 1
 ): StartMessage {
+  // A version 1 request binds its evidence to this string (Collection Profile
+  // Section 5.1). Without one the proof would bind to no boundary.
+  if (runCoverageVersion === 1 && !collectionScope?.trim()) {
+    throw new Error("a version 1 store evidence request requires a non-empty collection_scope");
+  }
   const start: StartMessage = {
     ...(runCoverageVersion === 1 && collectionScope ? { collection_scope: collectionScope } : {}),
     ...(runCoverageVersion === 1 ? { run_coverage_version: 1 } : {}),

From bba5dda55e7b38cd0816fc5495a20eac9b6dce4e Mon Sep 17 00:00:00 2001
From: Tim Nunamaker <tnunamak@gmail.com>
Date: Thu, 22 Oct 2026 14:46:41 -0500
Subject: [PATCH 49/87] fix(coverage): request no evidence when START names
 stream resources

collectorScopeFingerprint binds since and source roots, not
START.scope.streams[].resources. A resource-restricted run therefore
sent collection_scope "unscoped" and could commit whole-stream
coverage (Collection Profile 5.1). Such a START now omits
run_coverage_version and collection_scope. The runner keys DONE
coverage on what START sent and checks the echo against that string,
so coverage for a restricted run is rejected as unrequested.

Assisted-by: AI
Signed-off-by: Tim Nunamaker <tnunamak@gmail.com>
---
 .../src/collector-runner.test.ts              | 68 +++++++++++++++++++
 .../collector-runtime/src/collector-runner.ts | 48 +++++++++----
 2 files changed, 104 insertions(+), 12 deletions(-)

diff --git a/packages/collector-runtime/src/collector-runner.test.ts b/packages/collector-runtime/src/collector-runner.test.ts
index 8cd207e1a..43ce838d6 100644
--- a/packages/collector-runtime/src/collector-runner.test.ts
+++ b/packages/collector-runtime/src/collector-runner.test.ts
@@ -55,6 +55,7 @@ async function assertCoverageFixtureRejected(input: {
   coverage: unknown;
   expectedError?: RegExp;
   requestedStreams?: readonly string[];
+  resources?: CollectorConnectorSpec["resources"];
   scope?: CollectorConnectorSpec["scope"];
 }): Promise<void> {
   const harness = await startCollectorHarness({ priorState: {} });
@@ -80,6 +81,7 @@ async function assertCoverageFixtureRejected(input: {
           connector_id: "fixture-invalid-done-coverage",
           manifestFingerprint: "a".repeat(64),
           protocol_capabilities: [],
+          ...(input.resources ? { resources: input.resources } : {}),
           runCoverageVersion: 1,
           runtime_requirements: { bindings: {} },
           ...(input.scope ? { scope: input.scope, timeScopableStreams: requestedStreams } : {}),
@@ -965,6 +967,72 @@ test("a negotiation-aware connector omits DONE coverage when START has no featur
   }
 });
 
+// Collection Profile Section 5.1: `unscoped` must not remove a restriction in
+// START.scope. The scope string binds the time bound and the source roots, not
+// per-stream resources, so a START that narrows a stream to named resources
+// requests no store evidence.
+test("runCollectorConnector requests no coverage when START restricts a stream to named resources", async () => {
+  const harness = await startCollectorHarness({ priorState: {} });
+  try {
+    const startPath = join(await createTempDir("pdpp-coverage-resources-start-"), "start.json");
+    const fixture = await writeFixtureConnector({
+      script: `
+        const fs = await import("node:fs/promises");
+        let input = "";
+        await new Promise((resolve) => process.stdin.on("data", (chunk) => {
+          input += chunk;
+          if (input.includes("\\n")) resolve();
+        }));
+        const start = JSON.parse(input.split("\\n")[0]);
+        await fs.writeFile(${JSON.stringify(startPath)}, JSON.stringify(start));
+        const done = { type: "DONE", status: "succeeded", records_emitted: 0 };
+        if (start.run_coverage_version === 1) {
+          done.coverage = { version: 1, collection_scope: start.collection_scope,
+            streams: [{ stream: "messages", scoped: true, stores: [{ store: "messages", status: "collected" }] }] };
+        }
+        process.stdout.write(JSON.stringify(done) + "\\n");
+      `,
+    });
+    const result = await runCollectorConnector({
+      baseUrl: harness.url,
+      connector: {
+        args: [fixture],
+        artifactDigest: `sha256:${"b".repeat(64)}`,
+        command: "node",
+        connector_id: "fixture-resource-restricted-coverage",
+        manifestFingerprint: "a".repeat(64),
+        protocol_capabilities: [],
+        resources: { messages: ["C07JYF0U8BY"] },
+        runCoverageVersion: 1,
+        runtime_requirements: { bindings: {} },
+        streams: ["messages"],
+      },
+      deviceId: "device-1",
+      deviceToken: "device-token",
+      executionRoot: TEST_EXECUTION_ROOT,
+      queuePath: await tempQueuePath(),
+      sourceInstanceId: "src-resource-restricted-coverage",
+    });
+    const start = JSON.parse(await readFile(startPath, "utf8")) as Record<string, unknown>;
+    assert.deepEqual(start.scope, { streams: [{ name: "messages", resources: ["C07JYF0U8BY"] }] });
+    assert.equal("run_coverage_version" in start, false, "a resource-restricted START requests no evidence");
+    assert.equal("collection_scope" in start, false);
+    assert.equal(result.done?.status, "succeeded", "the restricted run still collects");
+    assert.equal(harness.terminalCommits.length, 1, "the run still commits its terminal record");
+    assert.deepEqual(harness.terminalCommits[0]?.terminal_facts, [], "with no positive facts");
+  } finally {
+    await harness.close();
+  }
+});
+
+test("runCollectorConnector rejects coverage sent for a START restricted to named resources", async () => {
+  await assertCoverageFixtureRejected({
+    coverage: { collection_scope: "unscoped", streams: [validCoverageStream], version: 1 },
+    expectedError: /emitted unrequested DONE coverage/,
+    resources: { messages: ["C07JYF0U8BY"] },
+  });
+});
+
 for (const includeState of [false, true]) {
   test(`successful DONE without coverage retires earlier proof ${includeState ? "with" : "without"} STATE`, async () => {
     const harness = await startCollectorHarness({ priorState: {} });
diff --git a/packages/collector-runtime/src/collector-runner.ts b/packages/collector-runtime/src/collector-runner.ts
index 914022eab..ca1b11451 100644
--- a/packages/collector-runtime/src/collector-runner.ts
+++ b/packages/collector-runtime/src/collector-runner.ts
@@ -1444,6 +1444,8 @@ interface StreamConnectorIntoOutboxResult {
    * wins per store so a re-emitted store keeps its final status.
    */
   coverageByStore: Map<string, { status: CollectorCoverageStatus; stream: string | null }> | null;
+  /** Whether this run's START requested version 1 store evidence. */
+  coverageRequested: boolean;
   done: Extract<EmittedMessage, { type: "DONE" }> | null;
   duplicateStreamEvidence: ReadonlySet<string>;
   enqueuedBatches: number;
@@ -1536,7 +1538,7 @@ function buildTypedTerminalCoverageFacts(input: {
     return null;
   }
   if (!input.done.coverage) {
-    return input.connector.runCoverageVersion === 1 ? [] : null;
+    return input.streamResult.coverageRequested ? [] : null;
   }
 
   const evidenceRequired = input.connector.protocol_capabilities.includes("STREAM_EVIDENCE");
@@ -1928,7 +1930,9 @@ async function streamConnectorIntoOutbox(
         done = message;
         return;
       }
-      if (input.config.connector.runCoverageVersion !== 1) {
+      // Only the scope string START actually sent can be echoed.
+      const requestedScope = startMessage.run_coverage_version === 1 ? startMessage.collection_scope : undefined;
+      if (requestedScope === undefined) {
         throw new Error(`${input.config.connector.connector_id} emitted unrequested DONE coverage`);
       }
       if (message.records_emitted !== recordsObserved) {
@@ -1939,11 +1943,7 @@ async function streamConnectorIntoOutbox(
       }
       done = {
         ...message,
-        coverage: validateRunCoverageVerdict(
-          message.coverage,
-          input.config.connector.streams,
-          collectorScopeFingerprint(input.config.connector.scope)
-        ),
+        coverage: validateRunCoverageVerdict(message.coverage, input.config.connector.streams, requestedScope),
       };
     }
   };
@@ -2073,6 +2073,7 @@ async function streamConnectorIntoOutbox(
     // checkpoint state, so it is reported even when the scan budget cut the
     // run short — an honest partial coverage beats none.
     coverageByStore,
+    coverageRequested: startMessage.run_coverage_version === 1,
     done: scanBudgetExceeded ? null : done,
     duplicateStreamEvidence,
     enqueuedBatches,
@@ -2497,6 +2498,28 @@ export function resolveScopedSourceRoots(scope: CollectionScope | null | undefin
   ].sort();
 }
 
+/** The resources START names for one stream: its non-empty strings, possibly none. */
+function startStreamResources(resources: Readonly<Record<string, readonly string[]>>, stream: string): string[] {
+  return resources[stream]?.filter((value) => typeof value === "string" && value.length > 0) ?? [];
+}
+
+/**
+ * Whether START requests version 1 store evidence.
+ *
+ * {@link collectorScopeFingerprint} binds the time bound and the source roots,
+ * not per-stream resources. A START that narrows a stream to named resources
+ * would carry a scope string, often `unscoped`, without that restriction, and
+ * Collection Profile Section 5.1 forbids that. Such a run requests no
+ * evidence, so its terminal record reads unknown coverage.
+ */
+function startRequestsRunCoverage(
+  streams: readonly string[],
+  resources: Readonly<Record<string, readonly string[]>>,
+  runCoverageVersion: 1 | undefined
+): boolean {
+  return runCoverageVersion === 1 && streams.every((stream) => startStreamResources(resources, stream).length === 0);
+}
+
 export function buildCollectorStartMessage(
   streams: readonly string[],
   streamsToBackfill: readonly string[] = [],
@@ -2507,21 +2530,22 @@ export function buildCollectorStartMessage(
   collectionScope?: string,
   runCoverageVersion?: 1
 ): StartMessage {
+  const requestsCoverage = startRequestsRunCoverage(streams, resources, runCoverageVersion);
   // A version 1 request binds its evidence to this string (Collection Profile
   // Section 5.1). Without one the proof would bind to no boundary.
-  if (runCoverageVersion === 1 && !collectionScope?.trim()) {
+  if (requestsCoverage && !collectionScope?.trim()) {
     throw new Error("a version 1 store evidence request requires a non-empty collection_scope");
   }
   const start: StartMessage = {
-    ...(runCoverageVersion === 1 && collectionScope ? { collection_scope: collectionScope } : {}),
-    ...(runCoverageVersion === 1 ? { run_coverage_version: 1 } : {}),
+    ...(requestsCoverage && collectionScope ? { collection_scope: collectionScope } : {}),
+    ...(requestsCoverage ? { run_coverage_version: 1 } : {}),
     scope: {
       streams: streams.map((name): StreamScope => {
-        const streamResources = resources[name]?.filter((value) => typeof value === "string" && value.length > 0);
+        const streamResources = startStreamResources(resources, name);
         const timeRange = timeRanges[name];
         return {
           name,
-          ...(streamResources && streamResources.length > 0 ? { resources: streamResources } : {}),
+          ...(streamResources.length > 0 ? { resources: streamResources } : {}),
           // Only streams the caller proved scopable carry a bound. A stream
           // absent from `timeRanges` is collected whole rather than silently
           // narrowed against a field it does not have.

From 93691c41ec2d251183750814d76b9cb363d7fc78 Mon Sep 17 00:00:00 2001
From: Tim Nunamaker <tnunamak@gmail.com>
Date: Thu, 22 Oct 2026 14:53:28 -0500
Subject: [PATCH 50/87] feat(coverage): add RUN_COVERAGE_V1 and refuse it where
 no evidence is requested

The capability vocabulary did not know RUN_COVERAGE_V1, so every
runtime refused a connector that declared it as malformed, and the
collector, which requests store evidence, could not run one
(Collection Profile 3.4). It is now a required capability. The
collector profile advertises it. The provider profile and the
reference runtime do not, and refuse it before spawn. A collector run
whose START requests no evidence is placed without the capability, so
it refuses such a connector before its first heartbeat.

Assisted-by: AI
Signed-off-by: Tim Nunamaker <tnunamak@gmail.com>
---
 .../src/collector-runner.test.ts              | 116 ++++++++++++++++++
 .../collector-runtime/src/collector-runner.ts |  29 ++++-
 .../src/runtime-capabilities.test.ts          |  19 +++
 .../src/runtime-capabilities.ts               |   8 +-
 packages/connector-protocol/README.md         |   3 +
 .../src/connector-runtime-protocol.test.ts    |  10 ++
 .../src/connector-runtime-protocol.ts         |  12 +-
 packages/connector-protocol/src/index.ts      |   1 +
 packages/local-collector/test/runner.test.ts  |   2 +-
 ...detail-coverage-shortfall-severity.test.ts |   2 +
 10 files changed, 197 insertions(+), 5 deletions(-)

diff --git a/packages/collector-runtime/src/collector-runner.test.ts b/packages/collector-runtime/src/collector-runner.test.ts
index 43ce838d6..bc1b2868f 100644
--- a/packages/collector-runtime/src/collector-runner.test.ts
+++ b/packages/collector-runtime/src/collector-runner.test.ts
@@ -1033,6 +1033,122 @@ test("runCollectorConnector rejects coverage sent for a START restricted to name
   });
 });
 
+/**
+ * A connector that records that it started, then answers START the way a
+ * conforming RUN_COVERAGE_V1 connector does: with coverage when START asks.
+ */
+async function writeEvidenceRequiringConnector(spawnedPath: string): Promise<string> {
+  return await writeFixtureConnector({
+    script: `
+      const fs = await import("node:fs/promises");
+      await fs.writeFile(${JSON.stringify(spawnedPath)}, "spawned");
+      let input = "";
+      await new Promise((resolve) => process.stdin.on("data", (chunk) => {
+        input += chunk;
+        if (input.includes("\\n")) resolve();
+      }));
+      const start = JSON.parse(input.split("\\n")[0]);
+      const done = { type: "DONE", status: "succeeded", records_emitted: 0 };
+      if (start.run_coverage_version === 1) {
+        done.coverage = { version: 1, collection_scope: start.collection_scope,
+          streams: [{ stream: "messages", scoped: true, stores: [{ store: "messages", status: "collected" }] }] };
+      }
+      process.stdout.write(JSON.stringify(done) + "\\n");
+    `,
+  });
+}
+
+// Collection Profile Section 3.4: a connector that cannot run without store
+// collection evidence declares RUN_COVERAGE_V1. A run whose START requests no
+// evidence cannot supply it, so the collector refuses the connector before
+// spawn: before its first heartbeat, with the capability named as missing.
+test("runCollectorConnector refuses a RUN_COVERAGE_V1 connector before spawn when its run requests no evidence", async () => {
+  const harness = await startCollectorHarness({ priorState: {} });
+  try {
+    const spawnedPath = join(await createTempDir("pdpp-run-coverage-capability-refused-"), "spawned");
+    const fixture = await writeEvidenceRequiringConnector(spawnedPath);
+    for (const [label, evidence] of [
+      ["no store evidence configured", {}],
+      [
+        "START narrowed to named resources",
+        {
+          artifactDigest: `sha256:${"b".repeat(64)}`,
+          manifestFingerprint: "a".repeat(64),
+          resources: { messages: ["C07JYF0U8BY"] },
+          runCoverageVersion: 1,
+        },
+      ],
+    ] as const) {
+      // biome-ignore lint/performance/noAwaitInLoops: each case is one isolated run against the same harness.
+      await assert.rejects(
+        runCollectorConnector({
+          baseUrl: harness.url,
+          connector: {
+            args: [fixture],
+            command: "node",
+            connector_id: "fixture-run-coverage-required",
+            protocol_capabilities: ["RUN_COVERAGE_V1"],
+            runtime_requirements: { bindings: {} },
+            streams: ["messages"],
+            ...evidence,
+          },
+          deviceId: "device-1",
+          deviceToken: "device-token",
+          executionRoot: TEST_EXECUTION_ROOT,
+          queuePath: await tempQueuePath(),
+          sourceInstanceId: "src-run-coverage-required",
+        }),
+        (error: unknown) => {
+          assert.ok(error instanceof RuntimeCapabilityMismatchError, label);
+          assert.deepEqual(error.missing, ["RUN_COVERAGE_V1"], label);
+          return true;
+        }
+      );
+      const spawned = await readFile(spawnedPath, "utf8").then(
+        () => true,
+        () => false
+      );
+      assert.equal(spawned, false, `${label}: the connector never started`);
+    }
+    assert.equal(harness.heartbeats.length, 0, "the refusal precedes the first heartbeat");
+    assert.equal(harness.terminalCommits.length, 0);
+  } finally {
+    await harness.close();
+  }
+});
+
+test("runCollectorConnector runs a RUN_COVERAGE_V1 connector when its START requests evidence", async () => {
+  const harness = await startCollectorHarness({ priorState: {} });
+  try {
+    const spawnedPath = join(await createTempDir("pdpp-run-coverage-capability-ok-"), "spawned");
+    const result = await runCollectorConnector({
+      baseUrl: harness.url,
+      connector: {
+        args: [await writeEvidenceRequiringConnector(spawnedPath)],
+        artifactDigest: `sha256:${"b".repeat(64)}`,
+        command: "node",
+        connector_id: "fixture-run-coverage-required",
+        manifestFingerprint: "a".repeat(64),
+        protocol_capabilities: ["RUN_COVERAGE_V1"],
+        runCoverageVersion: 1,
+        runtime_requirements: { bindings: {} },
+        streams: ["messages"],
+      },
+      deviceId: "device-1",
+      deviceToken: "device-token",
+      executionRoot: TEST_EXECUTION_ROOT,
+      queuePath: await tempQueuePath(),
+      sourceInstanceId: "src-run-coverage-supplied",
+    });
+    assert.equal(await readFile(spawnedPath, "utf8"), "spawned");
+    assert.equal(result.done?.status, "succeeded");
+    const facts = harness.terminalCommits[0]?.terminal_facts as Record<string, unknown>[] | undefined;
+    assert.deepEqual(facts?.[0]?.stores, [{ status: "collected", store: "messages" }]);
+  } finally {
+    await harness.close();
+  }
+});
+
 for (const includeState of [false, true]) {
   test(`successful DONE without coverage retires earlier proof ${includeState ? "with" : "without"} STATE`, async () => {
     const harness = await startCollectorHarness({ priorState: {} });
diff --git a/packages/collector-runtime/src/collector-runner.ts b/packages/collector-runtime/src/collector-runner.ts
index ca1b11451..ef832b5f8 100644
--- a/packages/collector-runtime/src/collector-runner.ts
+++ b/packages/collector-runtime/src/collector-runner.ts
@@ -29,7 +29,11 @@ import { mkdirSync, writeFileSync } from "node:fs";
 import { delimiter, join } from "node:path";
 import { createInterface } from "node:readline";
 import type { EmittedMessage, RunCoverageVerdict, StartMessage, StreamScope } from "@pdpp/connector-protocol";
-import { validateHostBlobMessage, validateStreamEvidenceCounts } from "@pdpp/connector-protocol";
+import {
+  RUN_COVERAGE_V1_CAPABILITY,
+  validateHostBlobMessage,
+  validateStreamEvidenceCounts,
+} from "@pdpp/connector-protocol";
 import { buildAgentVersion } from "./collector-build-info.ts";
 import { type BlobUploadPayload, isBlobUploadPayload } from "./local-device-blob-capture.ts";
 import { type LocalDeviceBlobSpool, LocalDeviceBlobSpoolMissingError } from "./local-device-blob-spool.ts";
@@ -66,6 +70,7 @@ import {
   COLLECTOR_RUNTIME_CAPABILITIES,
   type ConnectorPlacementInput,
   type RuntimeBindingName,
+  type RuntimeCapabilityProfile,
 } from "./runtime-capabilities.ts";
 
 /**
@@ -936,7 +941,7 @@ export async function runCollectorConnector(config: CollectorRunConfig): Promise
       throw new Error("optional store evidence requires a bound manifest fingerprint and artifact digest");
     }
     throwIfAborted(config.abortSignal);
-    const satisfiedBindings = assertPlacementOrThrow(config.connector, COLLECTOR_RUNTIME_CAPABILITIES);
+    const satisfiedBindings = assertPlacementOrThrow(config.connector, runtimeCapabilitiesForRun(config.connector));
 
     const initialSummary = outbox.summary({
       sourceInstanceId: config.sourceInstanceId,
@@ -2520,6 +2525,26 @@ function startRequestsRunCoverage(
   return runCoverageVersion === 1 && streams.every((stream) => startStreamResources(resources, stream).length === 0);
 }
 
+/**
+ * The profile a run is placed against. The collector supports RUN_COVERAGE_V1
+ * only for a run whose START requests store evidence; for any other run the
+ * capability is withdrawn, so a connector that cannot run without the
+ * evidence is refused before spawn (Collection Profile Section 3.4).
+ */
+function runtimeCapabilitiesForRun(connector: CollectorConnectorSpec): RuntimeCapabilityProfile {
+  if (startRequestsRunCoverage(connector.streams, connector.resources ?? {}, connector.runCoverageVersion)) {
+    return COLLECTOR_RUNTIME_CAPABILITIES;
+  }
+  return {
+    ...COLLECTOR_RUNTIME_CAPABILITIES,
+    protocolCapabilities: new Set(
+      [...COLLECTOR_RUNTIME_CAPABILITIES.protocolCapabilities].filter(
+        (capability) => capability !== RUN_COVERAGE_V1_CAPABILITY
+      )
+    ),
+  };
+}
+
 export function buildCollectorStartMessage(
   streams: readonly string[],
   streamsToBackfill: readonly string[] = [],
diff --git a/packages/collector-runtime/src/runtime-capabilities.test.ts b/packages/collector-runtime/src/runtime-capabilities.test.ts
index ce24c805b..29aa03fe7 100644
--- a/packages/collector-runtime/src/runtime-capabilities.test.ts
+++ b/packages/collector-runtime/src/runtime-capabilities.test.ts
@@ -172,6 +172,25 @@ test("a declared OBSERVATION capability is a named missing capability, not a mal
   assert.equal(evaluatePlacement(observationConnector, observingRuntime).kind, "ok");
 });
 
+// Collection Profile Section 3.4: RUN_COVERAGE_V1 is required. The collector
+// runtime requests store collection evidence, so it advertises the capability.
+// The provider runtime does not, so it refuses a connector that declares it.
+test("a declared RUN_COVERAGE_V1 places on the collector runtime and is missing on the provider runtime", () => {
+  const evidenceConnector = {
+    connector_id: "evidence-connector",
+    protocol_capabilities: ["RUN_COVERAGE_V1" as const],
+  };
+  assert.equal(COLLECTOR_RUNTIME_CAPABILITIES.protocolCapabilities.has("RUN_COVERAGE_V1"), true);
+  assert.equal(PROVIDER_RUNTIME_CAPABILITIES.protocolCapabilities.has("RUN_COVERAGE_V1"), false);
+  assert.deepEqual(evaluatePlacement(evidenceConnector, COLLECTOR_RUNTIME_CAPABILITIES), { kind: "ok", satisfied: [] });
+  assert.deepEqual(evaluatePlacement(evidenceConnector, PROVIDER_RUNTIME_CAPABILITIES), {
+    connectorId: "evidence-connector",
+    kind: "missing_capability",
+    missing: ["RUN_COVERAGE_V1"],
+    runtime: "provider",
+  });
+});
+
 test("boundary_claim remains optional and does not require a protocol capability", () => {
   const skipResult = {
     boundary_claim: "provider_history_boundary",
diff --git a/packages/collector-runtime/src/runtime-capabilities.ts b/packages/collector-runtime/src/runtime-capabilities.ts
index e64f7ceb3..9871c57e7 100644
--- a/packages/collector-runtime/src/runtime-capabilities.ts
+++ b/packages/collector-runtime/src/runtime-capabilities.ts
@@ -5,6 +5,7 @@ import {
   CONNECTOR_PROTOCOL_VERSION,
   type ConnectorProtocolCapability,
   isConnectorProtocolCapabilityArray,
+  RUN_COVERAGE_V1_CAPABILITY,
   unsupportedRequiredProtocolCapabilities,
 } from "@pdpp/connector-protocol";
 
@@ -75,11 +76,16 @@ export const PROVIDER_RUNTIME_CAPABILITIES: RuntimeCapabilityProfile = {
  * deliberately deferred rather than half-built here.
  * Also does NOT advertise `BLOB`: this collector has no durable host blob
  * transport. The runner rejects any BLOB line before it can accept a RECORD.
+ *
+ * Advertises `RUN_COVERAGE_V1`: the runner requests store collection evidence
+ * in START and commits it in a version 2 terminal run record. A run whose
+ * START requests none is placed against this profile without the capability
+ * (`collector-runner.ts`), so it refuses a connector that declares it.
  */
 export const COLLECTOR_RUNTIME_CAPABILITIES: RuntimeCapabilityProfile = {
   bindings: new Set<RuntimeBindingName>(["network", "browser", "filesystem", "local_device"]),
   id: "collector",
-  protocolCapabilities: new Set<ConnectorProtocolCapability>(),
+  protocolCapabilities: new Set<ConnectorProtocolCapability>([RUN_COVERAGE_V1_CAPABILITY]),
   protocolVersion: CONNECTOR_PROTOCOL_VERSION,
 };
 
diff --git a/packages/connector-protocol/README.md b/packages/connector-protocol/README.md
index 8b07e47b5..cd89c34a6 100644
--- a/packages/connector-protocol/README.md
+++ b/packages/connector-protocol/README.md
@@ -66,6 +66,9 @@ runtime advertises `protocolVersion` and `protocolCapabilities`, and rejects
 unknown names and missing required capabilities before spawning a connector
 (`unsupportedRequiredProtocolCapabilities`). `DETAIL_COVERAGE_KEY_SETS` is
 advisory: a runtime that does not advertise it still starts the connector.
+`RUN_COVERAGE_V1` is required: a connector that cannot run without store
+collection evidence declares it, and a runtime that cannot request that
+evidence for the run does not start the connector.
 A manifest `protocol_version` is the Collection Profile version, `0.1.0` or
 `0.2.0`; a manifest that declares `DETAIL_COVERAGE_KEY_SETS` or `OBSERVATION`
 declares `0.2.0` (`collectionProfileDeclarationError`). `SKIP_RESULT.boundary_claim` is optional, does not require a
diff --git a/packages/connector-protocol/src/connector-runtime-protocol.test.ts b/packages/connector-protocol/src/connector-runtime-protocol.test.ts
index 4720ebc4a..48365f902 100644
--- a/packages/connector-protocol/src/connector-runtime-protocol.test.ts
+++ b/packages/connector-protocol/src/connector-runtime-protocol.test.ts
@@ -341,10 +341,20 @@ test("the capability vocabulary knows DETAIL_COVERAGE_KEY_SETS and OBSERVATION",
     "BLOB",
     "DETAIL_COVERAGE_KEY_SETS",
     "OBSERVATION",
+    "RUN_COVERAGE_V1",
     "STREAM_EVIDENCE",
   ]);
 });
 
+// Collection Profile Section 3.4: a connector that cannot run without store
+// collection evidence declares RUN_COVERAGE_V1. The capability is required: a
+// runtime that does not advertise it must not start the connector.
+test("RUN_COVERAGE_V1 is a known, required capability", () => {
+  assert.equal(isConnectorProtocolCapabilityArray(["RUN_COVERAGE_V1"]), true);
+  assert.deepEqual(unsupportedRequiredProtocolCapabilities(["RUN_COVERAGE_V1"], []), ["RUN_COVERAGE_V1"]);
+  assert.deepEqual(unsupportedRequiredProtocolCapabilities(["RUN_COVERAGE_V1"], ["RUN_COVERAGE_V1"]), []);
+});
+
 // Section 3.4: a runtime that does not advertise DETAIL_COVERAGE_KEY_SETS
 // still starts a connector that declares it. Every other declared capability
 // is required: a runtime that does not advertise it must not start the
diff --git a/packages/connector-protocol/src/connector-runtime-protocol.ts b/packages/connector-protocol/src/connector-runtime-protocol.ts
index dc3c7173f..8421bff90 100644
--- a/packages/connector-protocol/src/connector-runtime-protocol.ts
+++ b/packages/connector-protocol/src/connector-runtime-protocol.ts
@@ -115,12 +115,21 @@ export const DETAIL_COVERAGE_KEY_SETS_CAPABILITY = "DETAIL_COVERAGE_KEY_SETS" as
 /** Capability required by a connector that emits OBSERVATION (Collection Profile 0.2.0, Section 5.10). */
 export const OBSERVATION_CAPABILITY = "OBSERVATION" as const;
 
+/**
+ * Store collection evidence (Collection Profile Section 3.4). A connector that
+ * cannot run without it declares this capability. It is required: a runtime
+ * that cannot request the evidence (`START.run_coverage_version`) must not
+ * start the connector.
+ */
+export const RUN_COVERAGE_V1_CAPABILITY = "RUN_COVERAGE_V1" as const;
+
 /** Protocol capabilities that can be advertised by a connector or runtime. */
 export type ConnectorProtocolCapability =
   | typeof STREAM_EVIDENCE_CAPABILITY
   | typeof HOST_BLOB_CAPABILITY
   | typeof DETAIL_COVERAGE_KEY_SETS_CAPABILITY
-  | typeof OBSERVATION_CAPABILITY;
+  | typeof OBSERVATION_CAPABILITY
+  | typeof RUN_COVERAGE_V1_CAPABILITY;
 
 /**
  * The closed, exhaustive list backing {@link ConnectorProtocolCapability} at
@@ -136,6 +145,7 @@ export const CONNECTOR_PROTOCOL_CAPABILITIES: readonly ConnectorProtocolCapabili
   HOST_BLOB_CAPABILITY,
   DETAIL_COVERAGE_KEY_SETS_CAPABILITY,
   OBSERVATION_CAPABILITY,
+  RUN_COVERAGE_V1_CAPABILITY,
 ];
 
 /**
diff --git a/packages/connector-protocol/src/index.ts b/packages/connector-protocol/src/index.ts
index e3bedc139..c6ccdae63 100644
--- a/packages/connector-protocol/src/index.ts
+++ b/packages/connector-protocol/src/index.ts
@@ -74,6 +74,7 @@ export {
   OBSERVATION_CAPABILITY,
   PERMANENT_DETAIL_GAP_REASON,
   RETRYABLE_DETAIL_GAP_REASONS,
+  RUN_COVERAGE_V1_CAPABILITY,
   recordKeysEqual,
   STREAM_EVIDENCE_CAPABILITY,
   unsupportedRequiredProtocolCapabilities,
diff --git a/packages/local-collector/test/runner.test.ts b/packages/local-collector/test/runner.test.ts
index 7ea22791c..703328593 100644
--- a/packages/local-collector/test/runner.test.ts
+++ b/packages/local-collector/test/runner.test.ts
@@ -119,7 +119,7 @@ test("runner exports the collector runtime capability profile with collector id"
   assert.equal(COLLECTOR_RUNTIME_CAPABILITIES.id, "collector");
   const bindings = [...COLLECTOR_RUNTIME_CAPABILITIES.bindings].sort();
   assert.deepEqual(bindings, ["filesystem", "local_device", "network"]);
-  assert.deepEqual([...COLLECTOR_RUNTIME_CAPABILITIES.protocolCapabilities], []);
+  assert.deepEqual([...COLLECTOR_RUNTIME_CAPABILITIES.protocolCapabilities], ["RUN_COVERAGE_V1"]);
 });
 
 test("runner exports a stable COLLECTOR_PROTOCOL_VERSION string", () => {
diff --git a/reference-implementation/test/detail-coverage-shortfall-severity.test.ts b/reference-implementation/test/detail-coverage-shortfall-severity.test.ts
index cf9721146..1da2889ce 100644
--- a/reference-implementation/test/detail-coverage-shortfall-severity.test.ts
+++ b/reference-implementation/test/detail-coverage-shortfall-severity.test.ts
@@ -1292,6 +1292,8 @@ test("the pre-spawn gate rejects unknown and unsupported required capabilities a
     [null, UNKNOWN_CAPABILITY_PATTERN, null],
     [["OBSERVATION"], UNSUPPORTED_CAPABILITY_PATTERN, "OBSERVATION"],
     [["DETAIL_COVERAGE_KEY_SETS", "OBSERVATION", "BLOB"], UNSUPPORTED_CAPABILITY_PATTERN, "OBSERVATION"],
+    // This runtime requests no store collection evidence (Section 3.4).
+    [["RUN_COVERAGE_V1"], UNSUPPORTED_CAPABILITY_PATTERN, "RUN_COVERAGE_V1"],
     [["DETAIL_COVERAGE_KEY_SETS", "STREAM_EVIDENCE"], null, null],
   ];
   for (const [protocolCapabilities, rejection, unsupported] of cases) {

From 0778f3449fa7b40cadfb16c0e5bd1c383b145bf8 Mon Sep 17 00:00:00 2001
From: Tim Nunamaker <tnunamak@gmail.com>
Date: Thu, 22 Oct 2026 14:54:29 -0500
Subject: [PATCH 51/87] fix(coverage): keep a store's negative status for the
 rest of the run

recordCoverageIfPresent replaced a store's coverage status with each
later coverage_diagnostics record, so a later "collected" record
erased an earlier unaccounted, missing or deferred result in the same
run. The completeness summary and the version 1 terminal facts then
read the store as collected (Collection Profile 5.8.2). A later
"collected" record no longer replaces another status within a run.
Recovery across runs is not changed here.

Assisted-by: AI
Signed-off-by: Tim Nunamaker <tnunamak@gmail.com>
---
 .../src/collector-runner.test.ts              | 63 +++++++++++++++++++
 .../collector-runtime/src/collector-runner.ts | 11 +++-
 2 files changed, 72 insertions(+), 2 deletions(-)

diff --git a/packages/collector-runtime/src/collector-runner.test.ts b/packages/collector-runtime/src/collector-runner.test.ts
index bc1b2868f..917c3106b 100644
--- a/packages/collector-runtime/src/collector-runner.test.ts
+++ b/packages/collector-runtime/src/collector-runner.test.ts
@@ -350,6 +350,69 @@ test("runCollectorConnector summarizes coverage completeness distinct from decla
   }
 });
 
+// Collection Profile Section 5.8.2: a negative store result is not erased by a
+// later positive assertion. Within one run, a store that reported a status
+// other than `collected` keeps it when a later coverage record claims
+// `collected` for the same store.
+test("runCollectorConnector keeps a negative store status when a later coverage record in the run says collected", async () => {
+  const harness = await startCollectorHarness({ priorState: {} });
+  try {
+    const fixture = await writeFixtureConnector({
+      script: `
+        await new Promise((r) => {
+          let buf = "";
+          process.stdin.on("data", (c) => { buf += c; if (buf.includes("\\n")) r(); });
+        });
+        const coverage = [
+          { store: "logs", stream: "logs", status: "unaccounted", reason: "scan incomplete" },
+          { store: "downloads", stream: "downloads", status: "missing", reason: "not present" },
+          { store: "sessions", stream: "sessions", status: "collected", reason: "declared stream" },
+          { store: "logs", stream: "logs", status: "collected", reason: "late claim" },
+          { store: "downloads", stream: "downloads", status: "collected", reason: "late claim" },
+        ];
+        for (const c of coverage) {
+          process.stdout.write(JSON.stringify({
+            type: "RECORD", stream: "coverage_diagnostics", key: "coverage:" + c.store,
+            data: { id: "coverage:" + c.store, ...c }, emitted_at: new Date().toISOString(),
+          }) + "\\n");
+        }
+        process.stdout.write(JSON.stringify({ type: "STATE", stream: "coverage_diagnostics", cursor: "c-1" }) + "\\n");
+        process.stdout.write(JSON.stringify({ type: "DONE", status: "succeeded", records_emitted: 5 }) + "\\n");
+      `,
+    });
+    const result = await runCollectorConnector({
+      baseUrl: harness.url,
+      connector: {
+        args: [fixture],
+        command: "node",
+        connector_id: "fixture-sticky-negative-coverage",
+        protocol_capabilities: [],
+        runtime_requirements: { bindings: {} },
+        streams: ["sessions", "logs", "downloads", "coverage_diagnostics"],
+      },
+      deviceId: "device-1",
+      deviceToken: "device-token",
+      executionRoot: TEST_EXECUTION_ROOT,
+      queuePath: await tempQueuePath(),
+      sourceInstanceId: "src-sticky-negative-coverage",
+    });
+    assert.deepEqual(result.completeness?.byStore, {
+      downloads: "missing",
+      logs: "unaccounted",
+      sessions: "collected",
+    });
+    assert.equal(result.completeness?.fullyAccounted, false);
+    assert.deepEqual(result.completeness?.unaccountedStores, ["logs"]);
+    assert.deepEqual(harness.terminalCommits[0]?.terminal_facts, [
+      { coverage_statuses: ["missing"], stream: "downloads" },
+      { coverage_statuses: ["unaccounted"], stream: "logs" },
+      { coverage_statuses: ["collected"], stream: "sessions" },
+    ]);
+  } finally {
+    await harness.close();
+  }
+});
+
 test("runCollectorConnector reports null completeness when no coverage diagnostic is observed", async () => {
   const harness = await startCollectorHarness({ priorState: {} });
   try {
diff --git a/packages/collector-runtime/src/collector-runner.ts b/packages/collector-runtime/src/collector-runner.ts
index ef832b5f8..fb9bdd57a 100644
--- a/packages/collector-runtime/src/collector-runner.ts
+++ b/packages/collector-runtime/src/collector-runner.ts
@@ -1445,8 +1445,9 @@ interface StreamConnectorIntoOutboxResult {
   bufferHighWaterMark: number;
   /**
    * Per-store coverage status accumulated from `coverage_diagnostics`
-   * RECORDs seen this pass, or `null` when none were observed. Last write
-   * wins per store so a re-emitted store keeps its final status.
+   * RECORDs seen this pass, or `null` when none were observed. A later record
+   * replaces a store's status, except that `collected` never replaces a status
+   * other than `collected` reported earlier in the run.
    */
   coverageByStore: Map<string, { status: CollectorCoverageStatus; stream: string | null }> | null;
   /** Whether this run's START requested version 1 store evidence. */
@@ -1861,6 +1862,12 @@ async function streamConnectorIntoOutbox(
       return;
     }
     coverageByStore ??= new Map<string, { status: CollectorCoverageStatus; stream: string | null }>();
+    // A negative store result stands for the rest of the run: a later
+    // `collected` record does not erase it (Collection Profile Section 5.8.2).
+    const previous = coverageByStore.get(entry.store);
+    if (entry.status === "collected" && previous !== undefined && previous.status !== "collected") {
+      return;
+    }
     coverageByStore.set(entry.store, {
       status: entry.status,
       stream: entry.stream,

From 0a9a7f705b8898363455f0480295801791061942 Mon Sep 17 00:00:00 2001
From: Tim Nunamaker <tnunamak@gmail.com>
Date: Thu, 22 Oct 2026 14:57:17 -0500
Subject: [PATCH 52/87] test(coverage): pin the no-release and no-inventory
 fail-closed paths

Two Collection Profile rules were enforced on the server with no
test. A v2 proof with no recorded release digest projects unknown
with no as-of on list and detail, and its reason says the server
knows no digest (5.8.4). The terminal endpoint rejects a claim for a
stream with no declared inventory, with or without stores (5.8.2).
Each test fails when its enforcing check is removed.

Assisted-by: AI
Signed-off-by: Tim Nunamaker <tnunamak@gmail.com>
---
 ...evice-terminal-coverage-projection.test.ts | 39 +++++++++++++++++++
 ...vice-terminal-run-commit-operation.test.ts | 23 ++++++++++-
 2 files changed, 61 insertions(+), 1 deletion(-)

diff --git a/reference-implementation/test/local-device-terminal-coverage-projection.test.ts b/reference-implementation/test/local-device-terminal-coverage-projection.test.ts
index 5f5635510..07e695751 100644
--- a/reference-implementation/test/local-device-terminal-coverage-projection.test.ts
+++ b/reference-implementation/test/local-device-terminal-coverage-projection.test.ts
@@ -118,6 +118,7 @@ async function projectedCoverage() {
   const summary = (await listConnectorSummaries()).find((row) => row.connector_instance_id === connectorInstanceId);
   assert.ok(summary);
   return {
+    asOf: summary.coverage_as_of,
     axis: summary.connection_health.axes.coverage,
     conditions: Object.fromEntries(summary.collection_report.map((entry) => [entry.stream, entry.coverage_condition])),
     reason: summary.connection_health.conditions.find((condition) => condition.type === "SourceCoverageComplete")
@@ -265,6 +266,44 @@ test("a local source without a server pin projects unknown with an explicit reas
   }, "gmail");
 });
 
+// Collection Profile Section 5.8.4: a proof that has no recorded release shows
+// its digest as absent. Neither owner reader shows its coverage or an as-of,
+// and the reason says the server knows no digest, not that a different one ran.
+for (const [label, releaseFields] of [
+  ["the server recorded no release at admission", ["server_artifact_digest"]],
+  ["the proof names no release", ["artifact_digest", "server_artifact_digest"]],
+] as const) {
+  test(`a v2 proof with no recorded release shows its digest as absent: ${label}`, async () => {
+    await withLocalConnection(async () => {
+      await seedTerminalCoverage("collected");
+      const recorded = await projectedCoverage();
+      assert.equal(recorded.axis, "complete", "control: the proof with its release projects complete");
+      assert.equal(recorded.asOf?.artifact_digest, readLocalCollectorArtifactDigest(connectorId));
+      const row = getDb().prepare("SELECT facts_json FROM run_history WHERE run_id = ?").get("run_terminal_coverage") as {
+        facts_json: string;
+      };
+      const facts = JSON.parse(row.facts_json) as { collection_facts: { streams: Record<string, unknown>[] } };
+      for (const stream of facts.collection_facts.streams) {
+        for (const field of releaseFields) {
+          delete stream[field];
+        }
+      }
+      getDb()
+        .prepare("UPDATE run_history SET facts_json = ? WHERE run_id = ?")
+        .run(JSON.stringify(facts), "run_terminal_coverage");
+      const list = await projectedCoverage();
+      assert.equal(list.axis, "unknown");
+      assert.equal(list.asOf, null, "no as-of names a release");
+      assert.equal(list.reason, "coverage_unknown_artifact_unpinned");
+      const detail = await getConnectorSummaryForRoute(connectorInstanceId);
+      assert.ok(detail && "connection_health" in detail);
+      assert.equal(detail.connection_health.axes.coverage, "unknown");
+      assert.equal(detail.coverage_as_of, null);
+      assert.equal(detail.connection_health.coverage_as_of, null);
+    });
+  });
+}
+
 test("an unavailable store verdict never projects complete on list or detail", async () => {
   await withLocalConnection(async () => {
     await seedTerminalCoverage("unavailable");
diff --git a/reference-implementation/test/local-device-terminal-run-commit-operation.test.ts b/reference-implementation/test/local-device-terminal-run-commit-operation.test.ts
index c343a9336..4c93fd7bf 100644
--- a/reference-implementation/test/local-device-terminal-run-commit-operation.test.ts
+++ b/reference-implementation/test/local-device-terminal-run-commit-operation.test.ts
@@ -60,6 +60,7 @@ async function invokeBoundCoverageCommit(input: {
   claimDigest: string;
   claimManifest: Record<string, unknown>;
   claimStores: readonly string[];
+  claimStream?: string;
   currentManifest: Record<string, unknown>;
   registeredRelease: { artifactDigest: string; manifest: Record<string, unknown> } | null;
 }): Promise<{ committed: ResolvedTerminalRunCommit | null; status: number }> {
@@ -108,7 +109,7 @@ async function invokeBoundCoverageCommit(input: {
             },
             scoped: true,
             stores: input.claimStores.map((store) => ({ status: "collected", store })),
-            stream: "messages",
+            stream: input.claimStream ?? "messages",
           },
         ],
         version: 2,
@@ -1110,6 +1111,26 @@ test("the terminal endpoint rejects a store outside the registered inventory", a
   assert.equal(result.committed, null);
 });
 
+// Collection Profile Section 5.8.2: a stream with no declared inventory cannot
+// prove coverage. The endpoint rejects a claim that names one, with or without
+// stores, and commits nothing.
+test("the terminal endpoint rejects a claim for a stream with no declared inventory", async () => {
+  const registeredManifest = { streams: [{ coverage_stores: ["messages"], name: "messages" }, { name: "photos" }] };
+  const digest = `sha256:${"a".repeat(64)}`;
+  for (const claimStores of [[], ["photos"]]) {
+    const result = await invokeBoundCoverageCommit({
+      claimDigest: digest,
+      claimManifest: registeredManifest,
+      claimStores,
+      claimStream: "photos",
+      currentManifest: registeredManifest,
+      registeredRelease: { artifactDigest: digest, manifest: registeredManifest },
+    });
+    assert.equal(result.status, 400, JSON.stringify(claimStores));
+    assert.equal(result.committed, null);
+  }
+});
+
 test("an instance registered to release A cannot claim a larger release B inventory", async () => {
   const registeredManifest = { streams: [{ coverage_stores: ["messages"], name: "messages" }] };
   const currentManifest = {

From 2d98c5df8dbc88b26bd1295281fa8a7e3d5a5afb Mon Sep 17 00:00:00 2001
From: Tim Nunamaker <tnunamak@gmail.com>
Date: Thu, 22 Oct 2026 14:57:57 -0500
Subject: [PATCH 53/87] chore(connector-protocol): regenerate artifact for
 RUN_COVERAGE_V1

Assisted-by: AI
Signed-off-by: Tim Nunamaker <tnunamak@gmail.com>
---
 packages/connector-protocol/artifact.json | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/packages/connector-protocol/artifact.json b/packages/connector-protocol/artifact.json
index 310fbca53..211141578 100644
--- a/packages/connector-protocol/artifact.json
+++ b/packages/connector-protocol/artifact.json
@@ -1,11 +1,11 @@
 {
   "artifact_filename": "pdpp-connector-protocol-0.0.1.tgz",
-  "artifact_sha1": "b7d0234ebb099add97691f89756ca3e7e58febc7",
-  "artifact_sha256": "5d098bb216f0233527165d847bb073d5beee44370bc59a5e86a0c89fc054d34a",
-  "artifact_sha512": "d66e6412dc1f40924d1460aa34720c1acc783bba24d50ba7b76b2496ef039f98b8a611bf97535f3121a9e5b283b909b28c5cd1a3434df1445fb091414c9b0b2c",
-  "declarations_sha256": "8f1bf78ec644d002bfc8b1ce2399ccb660ea10bb3ee53c49a7995e1bb0e17dcb",
+  "artifact_sha1": "07d6708aaedeaac8d5df61e485649b2f3a489cef",
+  "artifact_sha256": "882e712491d604c1ea547fa43f1502dc18d05931d5b9751fdaaa8485029f44c7",
+  "artifact_sha512": "8f8309acee89a36308ff657bf5b2cb1f8e4652a0d692e5cb3ac6aa7aeb68d3e098c0f2fa97148e6ce9e9953b8d587de25d13665279504085997ccded5e244714",
+  "declarations_sha256": "6ea07145eaa6ec4859f1c6a21257416a947e468f2764f782867a96f4f81762e5",
   "metadata_version": 1,
   "package_name": "@pdpp/connector-protocol",
   "package_version": "0.0.1",
-  "source_inputs_sha256": "935e99c7e3307d7e48d748b3ca83b7427f1b91c89e7397de2a3842f08f2393fd"
+  "source_inputs_sha256": "a3b4bf5de8e1b6f10e42a56129219c4a520d7d28f21fcd071e30cc2edb3fa813"
 }

From 2c5d799660b14909016e21922e1dc0576126b169 Mon Sep 17 00:00:00 2001
From: Tim Nunamaker <tnunamak@gmail.com>
Date: Thu, 22 Oct 2026 14:58:06 -0500
Subject: [PATCH 54/87] chore(collector-runtime): regenerate artifact for the
 run coverage gates

Assisted-by: AI
Signed-off-by: Tim Nunamaker <tnunamak@gmail.com>
---
 packages/collector-runtime/artifact.json | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/packages/collector-runtime/artifact.json b/packages/collector-runtime/artifact.json
index 10d4de429..65d76cd97 100644
--- a/packages/collector-runtime/artifact.json
+++ b/packages/collector-runtime/artifact.json
@@ -1,13 +1,13 @@
 {
   "artifact_filename": "pdpp-collector-runtime-0.0.1.tgz",
-  "artifact_sha1": "6c898b6fcdf07a14a7238c9252bd26983b8ce36b",
-  "artifact_sha256": "576c88d1875f3a44e561c43aeb59674d3317614f5ee8406715820cac6cf5b370",
-  "artifact_sha512": "3df8bbf4844bef7a90bdf4424ecd37486411fb11e6d62948c01e0777012d27e56ca8c8532976a02df95af25bf0815cb243b264bef6fdc7d1ac4887605654a2b1",
-  "connector_protocol_declarations_sha256": "8f1bf78ec644d002bfc8b1ce2399ccb660ea10bb3ee53c49a7995e1bb0e17dcb",
-  "connector_protocol_source_inputs_sha256": "935e99c7e3307d7e48d748b3ca83b7427f1b91c89e7397de2a3842f08f2393fd",
+  "artifact_sha1": "3d60366f309fe2087efecc312555f38d6445a95f",
+  "artifact_sha256": "7d5fcb527ec1185abfb8bc90a37e9cfee4194799418bf0ac69adcf2ac97d0046",
+  "artifact_sha512": "572d3049fd12a272832369c287a904a4b5d99426b3e80c6bf9b5eebd0bbd5ff4a8846273c0b4ce47142b631763bdeaa3e66095b92aea68755bdb8dd0e9a6b312",
+  "connector_protocol_declarations_sha256": "6ea07145eaa6ec4859f1c6a21257416a947e468f2764f782867a96f4f81762e5",
+  "connector_protocol_source_inputs_sha256": "a3b4bf5de8e1b6f10e42a56129219c4a520d7d28f21fcd071e30cc2edb3fa813",
   "declarations_sha256": "a2c6d0e4ac93d2b9186bbbd2fcf133ac314c23003fab4ba298ccb4c41571140d",
   "metadata_version": 1,
   "package_name": "@pdpp/collector-runtime",
   "package_version": "0.0.1",
-  "source_inputs_sha256": "4b9e627dc41a3351d2810218a0b22de99eecfa3f4bf69db4b39bf21d2384b0a4"
+  "source_inputs_sha256": "b600d6348f40898abaae174c435b7efe2e8c51bcd5b25be1a15fcb3f4fabfa3d"
 }

From 4501d8fca98988c6c8929d5e441706c1b829b3e9 Mon Sep 17 00:00:00 2001
From: Tim Nunamaker <tnunamak@gmail.com>
Date: Thu, 22 Oct 2026 15:05:48 -0500
Subject: [PATCH 55/87] docs(coverage): close the untested Collection Profile
 rows

Fill the test cell of each MUST row that had none, with the test that
covers it or the reason it cannot be tested. The rows that
data-connectors owns are unchanged. The Gaps section lists the
untestable rows, the halves of the inventory rule tested here, and
three questions for the spec gate: negative results across runs,
what the scope string binds, and how evidence is negotiated.

Assisted-by: AI
Signed-off-by: Tim Nunamaker <tnunamak@gmail.com>
---
 docs/261021-local-device-coverage-evidence.md | 81 +++++++++++++++----
 1 file changed, 65 insertions(+), 16 deletions(-)

diff --git a/docs/261021-local-device-coverage-evidence.md b/docs/261021-local-device-coverage-evidence.md
index 1e888c1b0..6510a4fd7 100644
--- a/docs/261021-local-device-coverage-evidence.md
+++ b/docs/261021-local-device-coverage-evidence.md
@@ -160,6 +160,9 @@ Test labels used below:
 - GREEN: `reference-implementation/test/ref-connectors-local-coverage-green.test.ts`
 - STATE-PG: `reference-implementation/test/local-device-coverage-state-commit-postgres.test.ts`
 - RUNNER: `packages/collector-runtime/src/collector-runner.test.ts`
+- CAP: `packages/collector-runtime/src/runtime-capabilities.test.ts`
+- PROTO: `packages/connector-protocol/src/connector-runtime-protocol.test.ts`
+- SEV: `reference-implementation/test/detail-coverage-shortfall-severity.test.ts`
 - OUTBOX: `packages/collector-runtime/src/local-device-outbox.test.ts`
 - LC: `packages/local-collector/test/runner.test.ts`
 - CONSOLE: `apps/console/src/app/(console)/lib/connection-evidence.test.ts`
@@ -231,17 +234,17 @@ were not in this note before, and they are added here.
 | 3.2 | The manifest MUST state each store's obligation, content or metadata only. | Metadata-only inventory reads as completeness of content. | OP: "proven empty content is complete while metadata inventory stays inventory only" |
 | 3.2 | A runtime MUST NOT derive store coverage for a stream with no `coverage_stores`. | An undeclared store reads as covered. | OP: "the terminal endpoint rejects a store outside the registered inventory" |
 | 3.2 | A change to a store's obligation MUST change the manifest revision. | A proof for the old obligation survives the change. | PROJ: "catalog obligation changes invalidate proof when the binding generation advances" |
-| 3.4 | A connector that cannot run without the evidence MUST declare `RUN_COVERAGE_V1`. | The runtime runs the connector and silently drops evidence it needs. | none (gap) |
-| 3.4 | A runtime that does not support the capability MUST refuse the connector before spawn. | Same as above, without the declaration. | none (gap) |
+| 3.4 | A connector that cannot run without the evidence MUST declare `RUN_COVERAGE_V1`. | The runtime runs the connector and silently drops evidence it needs. | none, by nature: a runtime cannot observe whether a connector can run without the evidence; the refusal in the next row is the testable half |
+| 3.4 | A runtime that does not support the capability MUST refuse the connector before spawn. | Same as above, without the declaration. | RUNNER: "runCollectorConnector refuses a RUN_COVERAGE_V1 connector before spawn when its run requests no evidence" and "runCollectorConnector runs a RUN_COVERAGE_V1 connector when its START requests evidence"; CAP: "a declared RUN_COVERAGE_V1 places on the collector runtime and is missing on the provider runtime"; SEV: "the pre-spawn gate rejects unknown and unsupported required capabilities and admits implemented ones"; PROTO: "RUN_COVERAGE_V1 is a known, required capability" |
 | 3.4 | When START omits `run_coverage_version`, a connector MUST omit `DONE.coverage`. | Coverage that was not requested is trusted. | JOUR: "A: without START coverage negotiation, a successful run supplies no positive coverage"; RUNNER: "a connector that does not request coverage cannot submit a positive DONE verdict" |
 | 3.4 | If version 1 was requested and a successful DONE omits `coverage` (including from producers that predate the field), the runtime MUST treat the stores as unknown and MUST NOT keep an earlier positive. | An omission is read as "not supported", and the older proof stays current. | RUNNER: "successful DONE without coverage retires earlier proof with STATE" and "... without STATE"; PROJ: "legacy terminal commit without v2 proof stays unknown" |
 | 3.4 | Negotiating this evidence MUST NOT disable or weaken detail accounting, diagnosis, or checkpoint rules. | Opting into coverage skips the accounting that protects data. | RUNNER: "runCollectorConnector lets SKIP_RESULT defeat a collected DONE assertion"; OP: "checkpoint eligibility ${eligible} governs state advancement with accounted debt" |
-| 8 | A runtime MUST NOT request evidence that its persistence and validation path cannot accept. | Evidence is requested, then silently dropped. | none (gap) |
-| 5.1 | A runtime that requests version 1 MUST supply a non-empty `collection_scope`. | A proof with no scope binds to nothing. | none (gap; the mismatch case is below) |
+| 8 | A runtime MUST NOT request evidence that its persistence and validation path cannot accept. | Evidence is requested, then silently dropped. | RUNNER: "a run with invalid provenance leaves a failure gap for its lane" (a run with no bound manifest fingerprint and artifact digest is refused before spawn) |
+| 5.1 | A runtime that requests version 1 MUST supply a non-empty `collection_scope`. | A proof with no scope binds to nothing. | RUNNER: "buildCollectorStartMessage refuses a version 1 request without a collection scope" (the runner builds START before spawn) |
 | 5.1 | The connector MUST echo `collection_scope` without modification. | Coverage is claimed for a different scope. | RUNNER: "runCollectorConnector rejects a DONE coverage scope echo that differs from actual START scope" |
 | 5.1 | The runtime MUST bind the string to the run's normalized targets, collection mode, boundary, and source-root restrictions. | A proof for one boundary is replayed for another. | PROJ: "v2 terminal proof for an old collection scope cannot cover the current scope" |
-| 5.1 | The echoed string MUST NOT confer authorization. | A connector string widens access. | none (gap) |
-| 5.1 | `unscoped` MUST NOT remove a restriction in `START.scope` or the authority bindings. | A run escapes its scope and still claims coverage. | none (gap) |
+| 5.1 | The echoed string MUST NOT confer authorization. | A connector string widens access. | none, by nature: no code reads the echo except the equality check of the "MUST echo" row; `validateRunCoverageVerdict` returns START's own string, and server record admission (`validateAttemptRecords`) does not read it |
+| 5.1 | `unscoped` MUST NOT remove a restriction in `START.scope` or the authority bindings. | A run escapes its scope and still claims coverage. | RUNNER: "runCollectorConnector requests no coverage when START restricts a stream to named resources" and "runCollectorConnector rejects coverage sent for a START restricted to named resources" |
 | 5.8.2 | A failed DONE MUST NOT contain `coverage`. | A failed run's claims are trusted. | PROJ: "a newer failed run cannot retain an earlier v2 covered verdict" (projection side only; the DONE side is untested) |
 | 5.8.2 | The coverage object's shape: `version`, `collection_scope`, `streams`, the stream and store fields, and the status enum. | Malformed coverage reaches the projection. | RUNNER: "runCollectorConnector rejects malformed DONE coverage: ${label}" and "runCollectorConnector rejects ${versionLabel} DONE coverage versions"; RUNNER: "runCollectorConnector flags an unrecognized coverage status as unaccounted" |
 | 5.8.2 | Stream entries MUST equal the requested set, and each stream's stores MUST equal its manifest inventory, with no duplicates or extras. | Missing or extra streams or stores read as covered. | RUNNER: "runCollectorConnector rejects missing and extra DONE coverage streams"; OP: "v2 claims with an extra store outside the registered inventory are rejected"; OP: "v2 normalization rejects duplicate streams and duplicate stores" |
@@ -266,7 +269,7 @@ were not in this note before, and they are added here.
 | 5.8.2 | An unregistered digest, or a digest with a different fingerprint, MUST NOT establish positive coverage. | Same as above. | OP: "the terminal endpoint keeps an unregistered digest unknown"; OP: "unregistered well-formed artifact digests remain unknown" |
 | 5.8.2 | A different release MUST invalidate a positive unless a compatibility rule preserves its obligations. | A proof certifies a later release. | PROJ: "unchanged manifest with a different artifact digest projects unknown on list and detail" |
 | 5.8.2 | After a negotiated success, an omitted `DONE.coverage` is a new terminal result: the runtime MUST retire earlier positives for the connection and release, and MUST record the stores as unknown, with or without STATE. | A silent omission keeps the old proof current. | PROJ: "successful empty v2 terminal replacement retires earlier proof with state" and "... without state"; STALE: "journey: a later unnegotiated run with no STATE commits a terminal record that retires the proof"; JOUR: "U: after a covered run, an unnegotiated success with STATE retires the proof on server and device" and "... without STATE ..." |
-| 5.8.2 | A negative store result MUST NOT be erased by a later positive without independently valid recovery evidence. | A partial store flips to complete on an unsupported claim. | none (gap) |
+| 5.8.2 | A negative store result MUST NOT be erased by a later positive without independently valid recovery evidence. | A partial store flips to complete on an unsupported claim. | RUNNER: "runCollectorConnector keeps a negative store status when a later coverage record in the run says collected" (within one run; across runs, see "Gaps") |
 | 5.8.2 | A connection-wide verdict MUST NOT imply coverage for omitted or uninstrumented streams. | A connection-level "complete" hides an uninstrumented stream. | OP: "selected instrumented stream is accepted beside an uninstrumented stream"; PROJ: "selected-stream v2 proof cannot cover omitted manifest streams" |
 | 5.8.3 | The runtime MUST commit an orderable terminal run record for every successful run, negotiated or not, with or without STATE, and the record MUST name its run and run sequence. | A run without a record leaves an earlier proof current. | RUNNER: "successful DONE without coverage retires earlier proof without STATE"; STALE: "journey: a later unnegotiated run with no STATE commits a terminal record that retires the proof"; ATOM: "run start: the route issues a connection-scoped sequence and an exact replay returns it" |
 | 5.8.3 | A positive MUST be published only after a successful DONE, exit 0, durable admission of the run's relevant effects, and completion of its checkpoint commits. | A positive is published for data that is not yet durable. | RUNNER: "runCollectorConnector rejects a valid concrete ${effectType} before terminal coverage" (admission side; the checkpoint side is covered only by the OP checkpoint test above) |
@@ -283,21 +286,67 @@ were not in this note before, and they are added here.
 | 5.8.3 | The component MUST NOT keep positive coverage to avoid retiring it. | A false positive is kept to avoid an unknown result. | JOUR: "J2: a batch the server receives and rejects after a covered run retires the proof on server and device" |
 | 5.8.3 | Server-owned scope state, heartbeats, gap recoveries, and grant-scoped state MUST NOT take a revision or retire positive coverage. | Liveness writes churn the proof to unknown. | STALE: "revision: a later server-owned scope write is not an event and does not retire the proof" (heartbeats specifically: no direct test) |
 | 5.8.3 | A restore that can regress sequences or terminal records MUST reset positives to unknown until a run assigned after the restore commits a current record. | A restored older proof is current again. | ATOM: "restore: the restore step makes a restored proof unknown until a new eligible terminal" |
-| 5.8.3 | The component MUST disclose the restore paths it does not detect. | An owner trusts coverage after an undetected restore. | none (documentation duty; see "Restore incarnation" and "Limits") |
+| 5.8.3 | The component MUST disclose the restore paths it does not detect. | An owner trusts coverage after an undetected restore. | none, by nature: a documentation duty; "Restore incarnation" and "Limits" above are the disclosure |
 | 5.8.3 | A device runtime MUST NOT report a lane as covered while a failure barrier or unadmitted work of a later attempt remains open. | The device shows covered over unadmitted work. | LC: "a later run whose record batch stays ready makes an earlier covered receipt unadmitted"; LC: "a pass that fails before its scan leaves an earlier covered receipt unadmitted"; LC: "a run aborted before start leaves an earlier covered receipt unadmitted" |
 | 5.8.4 | Every projection that shows coverage MUST carry the run identifier and run sequence, the release digest, and the revision and commit time. | Coverage is shown without the run or release it describes. | STALE: "as-of: a shown proof carries its run id, release digest, revision and commit time" |
-| 5.8.4 | A proof with no recorded release MUST show the digest as absent. | A digest is shown for a release that is unknown. | none (gap; the closest case is PROJ: "a local source without a server pin projects unknown with an explicit reason") |
+| 5.8.4 | A proof with no recorded release MUST show the digest as absent. | A digest is shown for a release that is unknown. | PROJ: "a v2 proof with no recorded release shows its digest as absent: ${label}" (unknown, no as-of on list or detail, reason `coverage_unknown_artifact_unpinned`) |
 | 5.8.4 | Owner-facing text MUST present coverage as of its time, not as a present-tense claim. | A stale proof reads as current. | CONSOLE: "coverage chip reads 'complete as of <time>' when the reference names the run it describes"; CONSOLE: "per-stream coverage reads 'complete as of <time>' with the connection's as-of" |
 | 5.8.4 | A runtime MUST retain the run's bindings and MUST revalidate them before it reuses a positive. | A positive is reused across accounts or boundaries. | PROJ: "persisted terminal coverage cannot cross a source binding generation"; OP: "a run bound to its registered release remains valid after the connector catalog advances" |
 | 5.8.4 | Metadata-only inventory coverage MUST NOT be displayed as completeness of the underlying content. | Inventory reads as complete content. | OP: "proven empty content is complete while metadata inventory stays inventory only" |
-| 5.8.4 | A DETAIL_COVERAGE or STREAM_EVIDENCE projection SHOULD carry the same facts. | (SHOULD, so not a conformance requirement.) | none, by design |
+| 5.8.4 | A DETAIL_COVERAGE or STREAM_EVIDENCE projection SHOULD carry the same facts. | (SHOULD, so not a conformance requirement.) | none, by nature: a SHOULD, and the profile leaves those projections runtime-specific |
 | 6.2 (14) | Runtime conformance: the rows above, as one checklist. | (Aggregate.) | the rows above |
-| 8 | `coverage.version` versions this payload only; it does not replace `protocol_version`. | A runtime reads it as the profile version. | none (gap) |
-| 8 | Implementations MUST NOT assume that an older runtime, or a runtime with a closed manifest validator, ignores unknown manifest or wire fields. | A new field breaks the exchange or the manifest. | none (gap) |
+| 8 | `coverage.version` versions this payload only; it does not replace `protocol_version`. | A runtime reads it as the profile version. | none, by nature: no code reads one version as the other; `validateRunCoverageVerdict` checks `coverage.version` and never `protocol_version`, and `collectionProfileDeclarationError` checks `protocol_version` and never `coverage.version`; a wrong payload version is the shape row in 5.8.2 |
+| 8 | Implementations MUST NOT assume that an older runtime, or a runtime with a closed manifest validator, ignores unknown manifest or wire fields. | A new field breaks the exchange or the manifest. | none, by nature: it limits an implementer's reasoning, not observable behavior; its consequences are the 3.4 negotiation and pre-spawn rows |
 
 ### Gaps
 
-The MUST rows marked "none" have a failure behind them but no conformance test
-in #577 or data-connectors. The data-connectors tests in DC check only the
-profile's wording. Adding a test for each gap is the next step, or the
-sentence should be cut with the failure it covers stated explicitly.
+Rows marked "none, by nature" have no test, for the reason in the cell:
+
+- 3.4: whether a connector can run without the evidence is internal to the
+  connector. The runtime refusal in the next row is tested.
+- 5.1: no code path reads the echoed string except the equality check, so
+  there is no authorization path to test.
+- 5.8.3: the disclosure of undetected restore paths is a documentation duty.
+- 5.8.4: the DETAIL_COVERAGE and STREAM_EVIDENCE sentence is a SHOULD.
+- 8: no code reads `coverage.version` as `protocol_version`, or the reverse.
+- 8: "MUST NOT assume" limits how an implementer reasons. Its effects are the
+  3.4 negotiation and pre-spawn rows.
+
+The 3.4, 5.1, 5.8.4 and both section 8 sentences could become non-normative
+guidance without losing a testable failure. The 3.4 sentence can become the
+definition of the capability: `RUN_COVERAGE_V1` declares that the connector
+cannot run without the evidence. The 5.8.3 disclosure can stay normative,
+because a reviewer can check it against this note. The spec gate decides.
+
+Rows marked "none (gap)" or "none direct (gap)" are connector obligations
+that data-connectors PR #539 owns: the 3.2 identifier rule, the 5.8.2
+omission for a stream without inventory, the 5.8.2 absence and file-read
+rule, and the 5.8.2 `scoped` rule. The DC tests check only the profile's
+wording. This repository tests the runtime and server halves of the
+inventory rule: the collector requests no evidence when a selected stream
+has no inventory (`packages/local-collector/test/collection-profiles.test.ts`:
+"store evidence negotiation binds the exact selected release and leaves
+partial instrumentation unknown"), and the server rejects a claim for such a
+stream (OP: "the terminal endpoint rejects a claim for a stream with no
+declared inventory"). No code in this repository derives a Section 3.3.9
+binding or effective-authority record from `scoped`. It only qualifies
+coverage.
+
+Open for the spec gate:
+
+- Negative results across runs. The 5.8.2 negative-result row is tested
+  within one run. A later run's `collected` can follow an earlier run's
+  `partial`, for example an incremental run that does not revisit the
+  skipped item. Whether that later claim is "independently valid recovery
+  evidence" is not decided, and no cross-run rule is implemented.
+- What the scope string binds. `collectorScopeFingerprint` binds `since` and
+  the source roots, not per-stream `resources` or the requested stream set.
+  A START that names resources therefore requests no evidence. To bind
+  resources, three copies must change together: `collectorScopeFingerprint`,
+  `collectionScopeFingerprint` in `@pdpp/reference-contract`, and
+  `enumerationScopeFingerprint` in polyfill-connectors.
+- How evidence is negotiated. The profile uses `protocol_capabilities`
+  (`RUN_COVERAGE_V1`). The collector requests evidence when the pinned
+  manifest carries `run_coverage: { "version": 1 }`, a key whose profile text
+  was dropped. The code knows profile versions 0.1.0 and 0.2.0 only, so it
+  accepts `RUN_COVERAGE_V1` under both.

From 9769b68d076d8b7e702e0b4ce08103fab8ecfb96 Mon Sep 17 00:00:00 2001
From: Tim Nunamaker <tnunamak@gmail.com>
Date: Thu, 22 Oct 2026 15:57:27 -0500
Subject: [PATCH 56/87] test(local-collector): expect the collector to
 advertise RUN_COVERAGE_V1

The packaged collector now supports store collection evidence and says so in
its advertise output.

Assisted-by: AI
Signed-off-by: Tim Nunamaker <tnunamak@gmail.com>
---
 packages/local-collector/scripts/pack-install-run.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/packages/local-collector/scripts/pack-install-run.ts b/packages/local-collector/scripts/pack-install-run.ts
index 25f7c3c2b..f0f0b0527 100644
--- a/packages/local-collector/scripts/pack-install-run.ts
+++ b/packages/local-collector/scripts/pack-install-run.ts
@@ -196,7 +196,7 @@ async function main(): Promise<void> {
     assert.match(advertised.collector_protocol_version, /^\d+$/);
     // biome-ignore lint/performance/useTopLevelRegex: Preserves established ordered async behavior, boundary contract, or dynamic test-harness type where a mechanical rewrite would change semantics.
     assert.match(advertised.protocol_version, /^\d+\.\d+\.\d+$/);
-    assert.deepEqual([...advertised.protocol_capabilities].sort(), []);
+    assert.deepEqual([...advertised.protocol_capabilities].sort(), ["RUN_COVERAGE_V1"]);
 
     if (await pathExists(path.join(cliPackageRoot, "package.json"))) {
       log("Installing packed @pdpp/cli alongside the collector and checking shim advertise output...");

From 77f310adb38554ffd3846248d58bb7784278474d Mon Sep 17 00:00:00 2001
From: Tim Nunamaker <tnunamak@gmail.com>
Date: Thu, 22 Oct 2026 17:48:51 -0500
Subject: [PATCH 57/87] fix(coverage): gate evidence on profile 0.3.0

A collector could request the DONE.coverage field under a manifest profile that does not support store evidence, or for a requested stream with no declared store inventory. Require the pinned 0.3.0 profile to inventory every requested stream before asking for evidence; when run-start registration fails, the server leaves the run sequence null, so a later final record can remove earlier coverage but cannot certify a new collection. SQLite projection tests confirm that removal, show a registered run with no final record or ingested batch preserves the earlier result and timestamp, and show later successful coverage replacing an incomplete result only for the same requested stores. The connector-protocol and collector-runtime artifact.json receipts record package tarball and declaration SHA-256 hashes; npm run artifact:verify passed in both packages.

Signed-off-by: Tim Nunamaker <tnunamak@gmail.com>
Assisted-by: AI
---
 docs/261021-local-device-coverage-evidence.md | 67 ++++++++-----------
 packages/collector-runtime/artifact.json      |  6 +-
 .../collector-runtime/src/collector-runner.ts |  2 +-
 packages/connector-protocol/README.md         | 13 ++--
 packages/connector-protocol/artifact.json     | 10 +--
 .../src/connector-runtime-protocol.test.ts    | 19 +++---
 .../src/connector-runtime-protocol.ts         | 20 +++---
 .../bin/pdpp-local-collector.ts               |  8 +--
 .../test/collection-profiles.test.ts          | 33 +++++++--
 .../test/selected-collection-release.test.ts  |  2 +-
 .../test/helpers/install-path-fixture.ts      |  3 +-
 .../local-device-coverage-journey.test.ts     | 16 ++---
 ...device-coverage-revision-atomicity.test.ts | 56 +++++++++++++++-
 .../local-device-coverage-stale-proof.test.ts |  6 +-
 14 files changed, 163 insertions(+), 98 deletions(-)

diff --git a/docs/261021-local-device-coverage-evidence.md b/docs/261021-local-device-coverage-evidence.md
index 6510a4fd7..f9c813972 100644
--- a/docs/261021-local-device-coverage-evidence.md
+++ b/docs/261021-local-device-coverage-evidence.md
@@ -61,6 +61,8 @@ No wall clock takes part in either.
 
 Sequence issuance. The runtime already contacts the server before it scans: a "starting" heartbeat, the pre-scan drain, and the state read, which names the connection. None of these can carry the issuance. The heartbeat is a best-effort liveness signal that names no run, and the state read is a GET, which must stay free of side effects. The runtime therefore makes one new idempotent call at the same point, after the state read and before the scan: `POST .../source-instances/{source}/run-starts` with the run id. The server resolves the authenticated device, source and connection the same way as the terminal route. In one transaction that holds the connection row lock, it increments `connector_instances.run_sequence_issued` and stores `(connector_instance_id, run_id) -> (run_sequence, storage_epoch, device_id, source_instance_id)` in `collection_run_sequences`. An exact replay of the same run id from the same device and source returns the stored sequence (200). The same run id from another device or source is `409 run_start_conflict`. The runtime keeps the run id it registered and uses it for the run's terminal record. A server without the route (404), or a failed call, leaves the run without a sequence. The run still collects and commits its terminal record, but that record can never be an eligible positive proof.
 
+Run-start registration alone is not a coverage observation and does not retire the current proof. If a registered run crashes before a terminal record or ingested batch reaches the server, the earlier positive remains current with its original as-of. This is an accepted limit.
+
 Multiple collectors. The sequence is connection-scoped and fenced by construction: the connection row lock serializes issuance, so two devices or runtimes that collect one connection get distinct sequences in start order. Several collectors per connection are therefore allowed. The proof of the most recently started run that the server has heard from is the only one that can be current.
 
 Observed maximum. Every observation that takes a commit revision (see the table below) also updates a run-order marker on `connector_instances`, in the same transaction, after the revision `UPDATE` has locked the row: `run_order_sequence`, `run_order_event`, `run_order_run_id`, `run_order_revision`. An observation that names a run with a sequence in the current storage epoch has that sequence. An observation that names no such run is attributed to the newest issued sequence (`run_sequence_issued`) with no run id. Record batches, refused batches and state commits name no run, so they are always attributed this way; a failure report or terminal record of an unknown run is too. Attribution can retire a proof but never establish one. If the observation's sequence is greater than or equal to `run_order_sequence`, the marker moves to it: sequence, event, attributed run id (or NULL) and revision. A lower sequence leaves the marker unchanged. The observation still takes its commit revision and is stored as history.
@@ -203,8 +205,9 @@ were not in this note before, and they are added here.
 - "A runtime MAY request a separate run containing only instrumented streams."
   It is a permission. The rule that matters, that a connection-wide verdict
   does not cover uninstrumented streams, is kept.
-- "A manifest MAY advertise support ... with `run_coverage: { "version": 1 }`."
-  No failure depends on it, because START negotiation is what matters.
+- The former manifest-level `run_coverage` advertisement is removed. The runtime
+  derives START negotiation from the pinned profile version and requested
+  streams' store inventories.
 - "Checkpoint eligibility MUST remain governed by Sections 5.6 and 5.8." It
   restates the downgrade rule.
 - "Connector package patch versions alone MUST NOT establish wire
@@ -234,7 +237,7 @@ were not in this note before, and they are added here.
 | 3.2 | The manifest MUST state each store's obligation, content or metadata only. | Metadata-only inventory reads as completeness of content. | OP: "proven empty content is complete while metadata inventory stays inventory only" |
 | 3.2 | A runtime MUST NOT derive store coverage for a stream with no `coverage_stores`. | An undeclared store reads as covered. | OP: "the terminal endpoint rejects a store outside the registered inventory" |
 | 3.2 | A change to a store's obligation MUST change the manifest revision. | A proof for the old obligation survives the change. | PROJ: "catalog obligation changes invalidate proof when the binding generation advances" |
-| 3.4 | A connector that cannot run without the evidence MUST declare `RUN_COVERAGE_V1`. | The runtime runs the connector and silently drops evidence it needs. | none, by nature: a runtime cannot observe whether a connector can run without the evidence; the refusal in the next row is the testable half |
+| 3.4 | A runtime MUST request evidence only for a pinned `0.3.0` profile when every requested stream declares `coverage_stores`. | Evidence is requested under an older profile or for a stream without a complete store inventory. | LC: "a 0.3.0 manifest with inventories for requested streams requests store evidence"; LC: "a 0.2.0 manifest does not request store evidence even with inventories"; LC: "a 0.3.0 manifest does not request store evidence when a requested stream lacks inventory"; PROTO: "collectionProfileDeclarationError accepts profile versions and gates capabilities by version" |
 | 3.4 | A runtime that does not support the capability MUST refuse the connector before spawn. | Same as above, without the declaration. | RUNNER: "runCollectorConnector refuses a RUN_COVERAGE_V1 connector before spawn when its run requests no evidence" and "runCollectorConnector runs a RUN_COVERAGE_V1 connector when its START requests evidence"; CAP: "a declared RUN_COVERAGE_V1 places on the collector runtime and is missing on the provider runtime"; SEV: "the pre-spawn gate rejects unknown and unsupported required capabilities and admits implemented ones"; PROTO: "RUN_COVERAGE_V1 is a known, required capability" |
 | 3.4 | When START omits `run_coverage_version`, a connector MUST omit `DONE.coverage`. | Coverage that was not requested is trusted. | JOUR: "A: without START coverage negotiation, a successful run supplies no positive coverage"; RUNNER: "a connector that does not request coverage cannot submit a positive DONE verdict" |
 | 3.4 | If version 1 was requested and a successful DONE omits `coverage` (including from producers that predate the field), the runtime MUST treat the stores as unknown and MUST NOT keep an earlier positive. | An omission is read as "not supported", and the older proof stays current. | RUNNER: "successful DONE without coverage retires earlier proof with STATE" and "... without STATE"; PROJ: "legacy terminal commit without v2 proof stays unknown" |
@@ -267,14 +270,14 @@ were not in this note before, and they are added here.
 | 5.8.2 | A rejected in-scope effect, unresolved debt, missing accounting, or withheld checkpoint MUST prevent positive coverage for that obligation. | Positive coverage over a rejected record. | RUNNER: "runCollectorConnector withholds collected coverage after an HTTP receipt rejects a record"; JOUR: "J3: a run that fails before its scan leaves the lane not covered; the server keeps run A's coverage until a later run recovers" |
 | 5.8.2 | A positive's artifact digest and manifest fingerprint MUST match a release pair that the runtime or server has verified. | An unverified or mismatched release certifies code. | OP: "a v2 claim cannot pair a registered digest with another manifest fingerprint"; OP: "terminal coverage requires the release registered for the authorized connector instance" |
 | 5.8.2 | An unregistered digest, or a digest with a different fingerprint, MUST NOT establish positive coverage. | Same as above. | OP: "the terminal endpoint keeps an unregistered digest unknown"; OP: "unregistered well-formed artifact digests remain unknown" |
-| 5.8.2 | A different release MUST invalidate a positive unless a compatibility rule preserves its obligations. | A proof certifies a later release. | PROJ: "unchanged manifest with a different artifact digest projects unknown on list and detail" |
 | 5.8.2 | After a negotiated success, an omitted `DONE.coverage` is a new terminal result: the runtime MUST retire earlier positives for the connection and release, and MUST record the stores as unknown, with or without STATE. | A silent omission keeps the old proof current. | PROJ: "successful empty v2 terminal replacement retires earlier proof with state" and "... without state"; STALE: "journey: a later unnegotiated run with no STATE commits a terminal record that retires the proof"; JOUR: "U: after a covered run, an unnegotiated success with STATE retires the proof on server and device" and "... without STATE ..." |
-| 5.8.2 | A negative store result MUST NOT be erased by a later positive without independently valid recovery evidence. | A partial store flips to complete on an unsupported claim. | RUNNER: "runCollectorConnector keeps a negative store status when a later coverage record in the run says collected" (within one run; across runs, see "Gaps") |
+| 5.8.2 | A negative store result MUST NOT be erased by a later positive within the same run. Across runs, a validated `collected` proof replaces an earlier `partial` only for the same `collection_scope`. | An unsupported in-run claim erases a negative, or a proof is reused across scopes. | RUNNER: "runCollectorConnector keeps a negative store status when a later coverage record in the run says collected"; ATOM: "coverage: a later collected proof replaces an earlier partial for the same scope"; PROJ: "v2 terminal proof for an old collection scope cannot cover the current scope" |
 | 5.8.2 | A connection-wide verdict MUST NOT imply coverage for omitted or uninstrumented streams. | A connection-level "complete" hides an uninstrumented stream. | OP: "selected instrumented stream is accepted beside an uninstrumented stream"; PROJ: "selected-stream v2 proof cannot cover omitted manifest streams" |
 | 5.8.3 | The runtime MUST commit an orderable terminal run record for every successful run, negotiated or not, with or without STATE, and the record MUST name its run and run sequence. | A run without a record leaves an earlier proof current. | RUNNER: "successful DONE without coverage retires earlier proof without STATE"; STALE: "journey: a later unnegotiated run with no STATE commits a terminal record that retires the proof"; ATOM: "run start: the route issues a connection-scoped sequence and an exact replay returns it" |
 | 5.8.3 | A positive MUST be published only after a successful DONE, exit 0, durable admission of the run's relevant effects, and completion of its checkpoint commits. | A positive is published for data that is not yet durable. | RUNNER: "runCollectorConnector rejects a valid concrete ${effectType} before terminal coverage" (admission side; the checkpoint side is covered only by the OP checkpoint test above) |
 | 5.8.3 | The component MUST assign each run a sequence when the run starts, and the runtime MUST obtain it before it admits any effect. | Effects are admitted with no sequence, so no order exists. | ATOM: "run order: a second collector on one connection is ordered by run start, not by commit"; ATOM: "run start: the route issues a connection-scoped sequence and an exact replay returns it" |
-| 5.8.3 | A run without an assigned sequence MUST NOT produce positive coverage. | An unordered run becomes eligible. | ATOM: "run order: a run with no issued sequence never produces an eligible proof" |
+| 5.8.3 | Run-start registration alone MUST NOT retire current positive coverage. | Registering a run with no effect hides the earlier proof or changes its as-of. | ATOM: "run start alone leaves earlier coverage and its as-of standing" |
+| 5.8.3 | A run without an assigned sequence MUST NOT produce positive coverage. An observed terminal record or ingested batch without a sequence still retires earlier positive coverage. | An unordered run becomes eligible, or its observed effects leave an earlier proof current. | ATOM: "run order: an unregistered attempt retires prior coverage and cannot establish a proof" |
 | 5.8.3 | An observed event of the same or a later run MUST retire the positive to unknown. | An attempt does not retire the proof. | JOUR: "J2: a batch the server receives and rejects after a covered run retires the proof on server and device"; JOUR: "J4: a failure report the server receives after a covered run retires the proof"; JOUR: "J6: a runner killed after its records are admitted, before its terminal record, leaves the earlier positive unknown"; ATOM: "crash after ingest: a later run's durable records retire an earlier positive without its terminal" |
 | 5.8.3 | A terminal record of an earlier run that arrives later MUST NOT become current. | A late, older proof becomes current. | ATOM: "run order: an older run's proof that arrives after a newer run's terminal record stays history"; JOUR: "J5: an older run's proof delivered after a newer run's terminal record stays history" |
 | 5.8.3 | If a sequence or revision cannot be read, is missing, or is ambiguous, the result MUST be unknown. | An ambiguous order picks a proof. | STALE: "revision: an unreadable or mismatched revision, run sequence or storage epoch fails closed"; ATOM: "upgrade: rows from before the collection revision fail closed, and the next proof is current" |
@@ -295,28 +298,20 @@ were not in this note before, and they are added here.
 | 5.8.4 | Metadata-only inventory coverage MUST NOT be displayed as completeness of the underlying content. | Inventory reads as complete content. | OP: "proven empty content is complete while metadata inventory stays inventory only" |
 | 5.8.4 | A DETAIL_COVERAGE or STREAM_EVIDENCE projection SHOULD carry the same facts. | (SHOULD, so not a conformance requirement.) | none, by nature: a SHOULD, and the profile leaves those projections runtime-specific |
 | 6.2 (14) | Runtime conformance: the rows above, as one checklist. | (Aggregate.) | the rows above |
-| 8 | `coverage.version` versions this payload only; it does not replace `protocol_version`. | A runtime reads it as the profile version. | none, by nature: no code reads one version as the other; `validateRunCoverageVerdict` checks `coverage.version` and never `protocol_version`, and `collectionProfileDeclarationError` checks `protocol_version` and never `coverage.version`; a wrong payload version is the shape row in 5.8.2 |
-| 8 | Implementations MUST NOT assume that an older runtime, or a runtime with a closed manifest validator, ignores unknown manifest or wire fields. | A new field breaks the exchange or the manifest. | none, by nature: it limits an implementer's reasoning, not observable behavior; its consequences are the 3.4 negotiation and pre-spawn rows |
+Section 8 guidance (non-normative): `coverage.version` versions this payload only; it does not replace `protocol_version`. Implementations should not assume that older runtimes or closed manifest validators ignore unknown fields.
 
 ### Gaps
 
 Rows marked "none, by nature" have no test, for the reason in the cell:
 
-- 3.4: whether a connector can run without the evidence is internal to the
-  connector. The runtime refusal in the next row is tested.
 - 5.1: no code path reads the echoed string except the equality check, so
   there is no authorization path to test.
 - 5.8.3: the disclosure of undetected restore paths is a documentation duty.
 - 5.8.4: the DETAIL_COVERAGE and STREAM_EVIDENCE sentence is a SHOULD.
-- 8: no code reads `coverage.version` as `protocol_version`, or the reverse.
-- 8: "MUST NOT assume" limits how an implementer reasons. Its effects are the
-  3.4 negotiation and pre-spawn rows.
 
-The 3.4, 5.1, 5.8.4 and both section 8 sentences could become non-normative
-guidance without losing a testable failure. The 3.4 sentence can become the
-definition of the capability: `RUN_COVERAGE_V1` declares that the connector
-cannot run without the evidence. The 5.8.3 disclosure can stay normative,
-because a reviewer can check it against this note. The spec gate decides.
+The two Section 8 statements are non-normative guidance and do not add
+conformance requirements. The 5.8.3 restore disclosure remains normative,
+because a reviewer can check it against this note.
 
 Rows marked "none (gap)" or "none direct (gap)" are connector obligations
 that data-connectors PR #539 owns: the 3.2 identifier rule, the 5.8.2
@@ -325,28 +320,24 @@ rule, and the 5.8.2 `scoped` rule. The DC tests check only the profile's
 wording. This repository tests the runtime and server halves of the
 inventory rule: the collector requests no evidence when a selected stream
 has no inventory (`packages/local-collector/test/collection-profiles.test.ts`:
-"store evidence negotiation binds the exact selected release and leaves
-partial instrumentation unknown"), and the server rejects a claim for such a
+"a 0.3.0 manifest does not request store evidence when a requested stream
+lacks inventory"), and the server rejects a claim for such a
 stream (OP: "the terminal endpoint rejects a claim for a stream with no
 declared inventory"). No code in this repository derives a Section 3.3.9
 binding or effective-authority record from `scoped`. It only qualifies
 coverage.
 
-Open for the spec gate:
-
-- Negative results across runs. The 5.8.2 negative-result row is tested
-  within one run. A later run's `collected` can follow an earlier run's
-  `partial`, for example an incremental run that does not revisit the
-  skipped item. Whether that later claim is "independently valid recovery
-  evidence" is not decided, and no cross-run rule is implemented.
-- What the scope string binds. `collectorScopeFingerprint` binds `since` and
-  the source roots, not per-stream `resources` or the requested stream set.
-  A START that names resources therefore requests no evidence. To bind
-  resources, three copies must change together: `collectorScopeFingerprint`,
-  `collectionScopeFingerprint` in `@pdpp/reference-contract`, and
-  `enumerationScopeFingerprint` in polyfill-connectors.
-- How evidence is negotiated. The profile uses `protocol_capabilities`
-  (`RUN_COVERAGE_V1`). The collector requests evidence when the pinned
-  manifest carries `run_coverage: { "version": 1 }`, a key whose profile text
-  was dropped. The code knows profile versions 0.1.0 and 0.2.0 only, so it
-  accepts `RUN_COVERAGE_V1` under both.
+### Spec gate decisions
+
+- Cross-run negatives: a positive applies only to its bound `collection_scope`.
+  A later fully validated `collected` proof replaces an earlier `partial` for
+  that same scope. It does not establish coverage for another scope.
+- Effective scope: the current fingerprint binds `since` and source roots, not
+  per-stream `resources` or the requested stream set. When a runtime cannot
+  bind the effective scope, it requests no evidence; this is conformant. The
+  current runtime suppresses evidence when a START names resources.
+- Negotiation: a pinned manifest must declare `protocol_version: "0.3.0"`,
+  and every requested stream must have a non-empty `coverage_stores` inventory.
+  Otherwise the runtime omits `START.run_coverage_version`. `RUN_COVERAGE_V1`
+  is not accepted under 0.1.0 or 0.2.0, and the former `run_coverage` manifest
+  key is not read.
diff --git a/packages/collector-runtime/artifact.json b/packages/collector-runtime/artifact.json
index 65d76cd97..5faccfdf2 100644
--- a/packages/collector-runtime/artifact.json
+++ b/packages/collector-runtime/artifact.json
@@ -3,11 +3,11 @@
   "artifact_sha1": "3d60366f309fe2087efecc312555f38d6445a95f",
   "artifact_sha256": "7d5fcb527ec1185abfb8bc90a37e9cfee4194799418bf0ac69adcf2ac97d0046",
   "artifact_sha512": "572d3049fd12a272832369c287a904a4b5d99426b3e80c6bf9b5eebd0bbd5ff4a8846273c0b4ce47142b631763bdeaa3e66095b92aea68755bdb8dd0e9a6b312",
-  "connector_protocol_declarations_sha256": "6ea07145eaa6ec4859f1c6a21257416a947e468f2764f782867a96f4f81762e5",
-  "connector_protocol_source_inputs_sha256": "a3b4bf5de8e1b6f10e42a56129219c4a520d7d28f21fcd071e30cc2edb3fa813",
+  "connector_protocol_declarations_sha256": "8c4491a7ffcf26a96699a81beaed632bfac78c685f2aebf8fd94c1b3939eeae4",
+  "connector_protocol_source_inputs_sha256": "63e5856ee9c419ffcbdd0f0b3371c0c38d54bd2a4a07e983c5d68f37fab3f772",
   "declarations_sha256": "a2c6d0e4ac93d2b9186bbbd2fcf133ac314c23003fab4ba298ccb4c41571140d",
   "metadata_version": 1,
   "package_name": "@pdpp/collector-runtime",
   "package_version": "0.0.1",
-  "source_inputs_sha256": "b600d6348f40898abaae174c435b7efe2e8c51bcd5b25be1a15fcb3f4fabfa3d"
+  "source_inputs_sha256": "d51aada268993d1a5ee2929528511ccb60a512b8a0f85aa6770a705769666940"
 }
diff --git a/packages/collector-runtime/src/collector-runner.ts b/packages/collector-runtime/src/collector-runner.ts
index fb9bdd57a..8623352ad 100644
--- a/packages/collector-runtime/src/collector-runner.ts
+++ b/packages/collector-runtime/src/collector-runner.ts
@@ -635,7 +635,7 @@ interface CollectorConnectorSpecExtra {
   readonly manifestFingerprint?: string;
   /** Optional stream resources for scoped connector runs. */
   readonly resources?: Readonly<Record<string, readonly string[]>>;
-  /** Set only when the installed manifest advertises optional store evidence. */
+  /** Set only when the pinned 0.3.0 manifest inventories every requested stream. */
   readonly runCoverageVersion?: 1;
   /**
    * The owner-declared collection boundary this run must stay inside, as
diff --git a/packages/connector-protocol/README.md b/packages/connector-protocol/README.md
index cd89c34a6..1b062b219 100644
--- a/packages/connector-protocol/README.md
+++ b/packages/connector-protocol/README.md
@@ -66,12 +66,13 @@ runtime advertises `protocolVersion` and `protocolCapabilities`, and rejects
 unknown names and missing required capabilities before spawning a connector
 (`unsupportedRequiredProtocolCapabilities`). `DETAIL_COVERAGE_KEY_SETS` is
 advisory: a runtime that does not advertise it still starts the connector.
-`RUN_COVERAGE_V1` is required: a connector that cannot run without store
-collection evidence declares it, and a runtime that cannot request that
-evidence for the run does not start the connector.
-A manifest `protocol_version` is the Collection Profile version, `0.1.0` or
-`0.2.0`; a manifest that declares `DETAIL_COVERAGE_KEY_SETS` or `OBSERVATION`
-declares `0.2.0` (`collectionProfileDeclarationError`). `SKIP_RESULT.boundary_claim` is optional, does not require a
+`RUN_COVERAGE_V1` is a required capability when a connector declares it. A
+manifest `protocol_version` is the Collection Profile version, `0.1.0`,
+`0.2.0`, or `0.3.0`; a manifest that declares `DETAIL_COVERAGE_KEY_SETS` or
+`OBSERVATION` declares `0.2.0`, and one that declares `RUN_COVERAGE_V1`
+declares `0.3.0` (`collectionProfileDeclarationError`). The collector requests
+`START.run_coverage_version` only for a pinned `0.3.0` profile when every
+requested stream declares a non-empty `coverage_stores` inventory. `SKIP_RESULT.boundary_claim` is optional, does not require a
 protocol capability, and is disclosure-only: it never affects, reduces, or
 excludes anything from the servable denominator, coverage calculation, or
 connection/system health rollup, even when an independently recorded
diff --git a/packages/connector-protocol/artifact.json b/packages/connector-protocol/artifact.json
index 211141578..634f449c8 100644
--- a/packages/connector-protocol/artifact.json
+++ b/packages/connector-protocol/artifact.json
@@ -1,11 +1,11 @@
 {
   "artifact_filename": "pdpp-connector-protocol-0.0.1.tgz",
-  "artifact_sha1": "07d6708aaedeaac8d5df61e485649b2f3a489cef",
-  "artifact_sha256": "882e712491d604c1ea547fa43f1502dc18d05931d5b9751fdaaa8485029f44c7",
-  "artifact_sha512": "8f8309acee89a36308ff657bf5b2cb1f8e4652a0d692e5cb3ac6aa7aeb68d3e098c0f2fa97148e6ce9e9953b8d587de25d13665279504085997ccded5e244714",
-  "declarations_sha256": "6ea07145eaa6ec4859f1c6a21257416a947e468f2764f782867a96f4f81762e5",
+  "artifact_sha1": "981ac8207a06ee430db9523d5e669082402d90ce",
+  "artifact_sha256": "c630ecdafec9348fdcef932abad76bf1d9ef85a84170d1d0a8fa555d8e725c2e",
+  "artifact_sha512": "d2013de581d15367a7c245f0489529311419e861a8f868012f01cb92d478794e75cad02a1553c9284862d664af43c1e8e28435253c3ebcdf6478f661948f173d",
+  "declarations_sha256": "8c4491a7ffcf26a96699a81beaed632bfac78c685f2aebf8fd94c1b3939eeae4",
   "metadata_version": 1,
   "package_name": "@pdpp/connector-protocol",
   "package_version": "0.0.1",
-  "source_inputs_sha256": "a3b4bf5de8e1b6f10e42a56129219c4a520d7d28f21fcd071e30cc2edb3fa813"
+  "source_inputs_sha256": "63e5856ee9c419ffcbdd0f0b3371c0c38d54bd2a4a07e983c5d68f37fab3f772"
 }
diff --git a/packages/connector-protocol/src/connector-runtime-protocol.test.ts b/packages/connector-protocol/src/connector-runtime-protocol.test.ts
index 48365f902..a4ac5745e 100644
--- a/packages/connector-protocol/src/connector-runtime-protocol.test.ts
+++ b/packages/connector-protocol/src/connector-runtime-protocol.test.ts
@@ -346,9 +346,8 @@ test("the capability vocabulary knows DETAIL_COVERAGE_KEY_SETS and OBSERVATION",
   ]);
 });
 
-// Collection Profile Section 3.4: a connector that cannot run without store
-// collection evidence declares RUN_COVERAGE_V1. The capability is required: a
-// runtime that does not advertise it must not start the connector.
+// RUN_COVERAGE_V1 remains a known required capability when a connector
+// declares it; profile 0.3.0 does not require every connector to declare it.
 test("RUN_COVERAGE_V1 is a known, required capability", () => {
   assert.equal(isConnectorProtocolCapabilityArray(["RUN_COVERAGE_V1"]), true);
   assert.deepEqual(unsupportedRequiredProtocolCapabilities(["RUN_COVERAGE_V1"], []), ["RUN_COVERAGE_V1"]);
@@ -372,20 +371,22 @@ test("an advisory capability is never unsupported; a required one is unsupported
   assert.deepEqual(unsupportedRequiredProtocolCapabilities([], []), []);
 });
 
-// Section 3.1: protocol_version is "0.1.0" or "0.2.0", and "0.2.0" when the
-// manifest declares a capability Section 8 adds in 0.2.0. It is the profile
-// version, not CONNECTOR_PROTOCOL_VERSION.
-test("collectionProfileDeclarationError accepts 0.1.0 and 0.2.0 and binds 0.2.0 capabilities to 0.2.0", () => {
-  assert.deepEqual([...COLLECTION_PROFILE_VERSIONS], ["0.1.0", "0.2.0"]);
+// Section 3.1: protocol_version is the Collection Profile version, not
+// CONNECTOR_PROTOCOL_VERSION. RUN_COVERAGE_V1 is only valid in 0.3.0.
+test("collectionProfileDeclarationError accepts profile versions and gates capabilities by version", () => {
+  assert.deepEqual([...COLLECTION_PROFILE_VERSIONS], ["0.1.0", "0.2.0", "0.3.0"]);
   assert.equal(collectionProfileDeclarationError("0.1.0", undefined), null);
   assert.equal(collectionProfileDeclarationError("0.1.0", []), null);
   assert.equal(collectionProfileDeclarationError("0.1.0", ["STREAM_EVIDENCE", "BLOB"]), null);
   assert.equal(collectionProfileDeclarationError("0.2.0", undefined), null);
   assert.equal(collectionProfileDeclarationError("0.2.0", ["DETAIL_COVERAGE_KEY_SETS", "OBSERVATION"]), null);
   assert.equal(collectionProfileDeclarationError("0.2.0", ["STREAM_EVIDENCE"]), null);
+  assert.equal(collectionProfileDeclarationError("0.3.0", ["RUN_COVERAGE_V1"]), null);
+  assert.equal(collectionProfileDeclarationError("0.3.0", []), null);
   assert.match(String(collectionProfileDeclarationError("0.1.0", ["DETAIL_COVERAGE_KEY_SETS"])), /0\.2\.0/);
   assert.match(String(collectionProfileDeclarationError("0.1.0", ["OBSERVATION"])), /OBSERVATION/);
-  assert.match(String(collectionProfileDeclarationError("0.3.0", [])), /protocol_version/);
+  assert.match(String(collectionProfileDeclarationError("0.1.0", ["RUN_COVERAGE_V1"])), /0\.3\.0/);
+  assert.match(String(collectionProfileDeclarationError("0.2.0", ["RUN_COVERAGE_V1"])), /0\.3\.0/);
   assert.match(String(collectionProfileDeclarationError(undefined, [])), /protocol_version/);
   assert.match(String(collectionProfileDeclarationError("0.2.0", ["FORGED"])), /protocol_capabilities/);
   assert.match(String(collectionProfileDeclarationError("0.2.0", null)), /protocol_capabilities/);
diff --git a/packages/connector-protocol/src/connector-runtime-protocol.ts b/packages/connector-protocol/src/connector-runtime-protocol.ts
index 8421bff90..7ec73afc5 100644
--- a/packages/connector-protocol/src/connector-runtime-protocol.ts
+++ b/packages/connector-protocol/src/connector-runtime-protocol.ts
@@ -115,12 +115,7 @@ export const DETAIL_COVERAGE_KEY_SETS_CAPABILITY = "DETAIL_COVERAGE_KEY_SETS" as
 /** Capability required by a connector that emits OBSERVATION (Collection Profile 0.2.0, Section 5.10). */
 export const OBSERVATION_CAPABILITY = "OBSERVATION" as const;
 
-/**
- * Store collection evidence (Collection Profile Section 3.4). A connector that
- * cannot run without it declares this capability. It is required: a runtime
- * that cannot request the evidence (`START.run_coverage_version`) must not
- * start the connector.
- */
+/** Store collection evidence that a connector may require for a run. */
 export const RUN_COVERAGE_V1_CAPABILITY = "RUN_COVERAGE_V1" as const;
 
 /** Protocol capabilities that can be advertised by a connector or runtime. */
@@ -197,7 +192,7 @@ export function unsupportedRequiredProtocolCapabilities(
  * independent of {@link CONNECTOR_PROTOCOL_VERSION} and of the Core
  * SourceDeclaration `protocol_version`, which Core fixes at 0.1.0.
  */
-export const COLLECTION_PROFILE_VERSIONS = ["0.1.0", "0.2.0"] as const;
+export const COLLECTION_PROFILE_VERSIONS = ["0.1.0", "0.2.0", "0.3.0"] as const;
 
 /** Capabilities that Collection Profile 0.2.0 adds (Section 8). */
 const PROFILE_0_2_0_CAPABILITIES: readonly ConnectorProtocolCapability[] = [
@@ -205,13 +200,16 @@ const PROFILE_0_2_0_CAPABILITIES: readonly ConnectorProtocolCapability[] = [
   OBSERVATION_CAPABILITY,
 ];
 
+/** Capabilities that Collection Profile 0.3.0 adds. */
+const PROFILE_0_3_0_CAPABILITIES: readonly ConnectorProtocolCapability[] = [RUN_COVERAGE_V1_CAPABILITY];
+
 /**
  * Why a manifest's `protocol_version` and `protocol_capabilities` are not a
  * valid Collection Profile declaration, or null when they are. An absent
  * (`undefined`) capability list declares none. The version must be one of
  * {@link COLLECTION_PROFILE_VERSIONS}, every capability name must be known,
- * and a manifest that declares a capability added in 0.2.0 must declare
- * 0.2.0 (Section 3.1).
+ * and a manifest that declares a capability added in 0.2.0 or 0.3.0 must use
+ * that profile version or later (Section 3.1).
  */
 export function collectionProfileDeclarationError(
   protocolVersion: unknown,
@@ -228,6 +226,10 @@ export function collectionProfileDeclarationError(
   if (protocolVersion === "0.1.0" && profile020Only.length > 0) {
     return `protocol_capabilities ${profile020Only.join(", ")} require protocol_version 0.2.0`;
   }
+  const profile030Only = declared.filter((capability) => PROFILE_0_3_0_CAPABILITIES.includes(capability));
+  if (protocolVersion !== "0.3.0" && profile030Only.length > 0) {
+    return `protocol_capabilities ${profile030Only.join(", ")} require protocol_version 0.3.0`;
+  }
   return null;
 }
 
diff --git a/packages/local-collector/bin/pdpp-local-collector.ts b/packages/local-collector/bin/pdpp-local-collector.ts
index e103ecaaf..aab0ffc7e 100644
--- a/packages/local-collector/bin/pdpp-local-collector.ts
+++ b/packages/local-collector/bin/pdpp-local-collector.ts
@@ -52,8 +52,8 @@ import { COLLECTION_PROFILE_PINS } from "../src/generated/collection-profile-pin
 import { LOCAL_COLLECTOR_DEFINITIONS } from "../src/generated/collector-definitions.generated.ts";
 import {
   COLLECTION_PROFILE_MANIFEST,
-  collectionProfileMismatch,
   type CollectionProfilePin,
+  collectionProfileMismatch,
   ensureCollectionProfileInstalled,
   installedCollectionProfile,
 } from "../src/managed/collection-profiles.ts";
@@ -3275,15 +3275,15 @@ export async function prepareConnectorSpec(
   return spec;
 }
 
-/** Request the optional terminal assertion only for a verified, fully instrumented selected set. */
+/** Request store evidence only for a verified 0.3.0 profile with complete selected inventories. */
 export function bindOptionalRunCoverageToRelease(
   spec: CollectorConnectorSpec,
   pin: Pick<CollectionProfilePin, "digest">,
   rawProfile: unknown
 ): CollectorConnectorSpec {
   if (!rawProfile || typeof rawProfile !== "object" || Array.isArray(rawProfile)) return spec;
-  const profile = rawProfile as { run_coverage?: { version?: unknown }; streams?: unknown };
-  if (profile.run_coverage?.version !== 1 || !Array.isArray(profile.streams)) return spec;
+  const profile = rawProfile as { protocol_version?: unknown; streams?: unknown };
+  if (profile.protocol_version !== "0.3.0" || !Array.isArray(profile.streams)) return spec;
   const inventory = new Map<string, readonly string[]>();
   for (const value of profile.streams) {
     if (!value || typeof value !== "object" || Array.isArray(value)) return spec;
diff --git a/packages/local-collector/test/collection-profiles.test.ts b/packages/local-collector/test/collection-profiles.test.ts
index 1971a9026..8ad59c7c8 100644
--- a/packages/local-collector/test/collection-profiles.test.ts
+++ b/packages/local-collector/test/collection-profiles.test.ts
@@ -298,12 +298,15 @@ test("prepareConnectorSpec installs the pinned profile before a pinned connector
   );
 });
 
-test("store evidence negotiation binds the exact selected release and leaves partial instrumentation unknown", () => {
-  const spec = buildConnectorSpec(parseArgs([...RUN_ARGS, "--connector", "codex", "--streams", "messages"]));
+test("a 0.3.0 manifest with inventories for requested streams requests store evidence", () => {
+  const spec = buildConnectorSpec(parseArgs([...RUN_ARGS, "--connector", "codex", "--streams", "messages,sessions"]));
   const pin = { digest: `sha256:${"a".repeat(64)}` };
   const profile = {
-    run_coverage: { version: 1 },
-    streams: [{ name: "messages", coverage_stores: ["messages"], obligation: "content" }, { name: "sessions" }],
+    protocol_version: "0.3.0",
+    streams: [
+      { name: "messages", coverage_stores: ["messages"], obligation: "content" },
+      { name: "sessions", coverage_stores: ["sessions"], obligation: "content" },
+    ],
   };
   const selected = bindOptionalRunCoverageToRelease(spec, pin, profile);
   assert.equal(selected.runCoverageVersion, 1);
@@ -311,8 +314,26 @@ test("store evidence negotiation binds the exact selected release and leaves par
   assert.equal(selected.manifestFingerprint?.length, 64);
   assert.notEqual(selected.manifestFingerprint,
     bindOptionalRunCoverageToRelease(spec, pin, { ...profile, streams: [{ ...profile.streams[0], obligation: "metadata" }, profile.streams[1]] }).manifestFingerprint);
-  assert.equal(bindOptionalRunCoverageToRelease({ ...spec, streams: ["messages", "sessions"] }, pin, profile).runCoverageVersion, undefined);
-  assert.equal(bindOptionalRunCoverageToRelease(spec, pin, { ...profile, run_coverage: undefined }).runCoverageVersion, undefined);
+});
+
+test("a 0.2.0 manifest does not request store evidence even with inventories", () => {
+  const spec = buildConnectorSpec(parseArgs([...RUN_ARGS, "--connector", "codex", "--streams", "messages"]));
+  const pin = { digest: `sha256:${"a".repeat(64)}` };
+  const profile = {
+    protocol_version: "0.2.0",
+    streams: [{ name: "messages", coverage_stores: ["messages"], obligation: "content" }],
+  };
+  assert.equal(bindOptionalRunCoverageToRelease(spec, pin, profile).runCoverageVersion, undefined);
+});
+
+test("a 0.3.0 manifest does not request store evidence when a requested stream lacks inventory", () => {
+  const spec = buildConnectorSpec(parseArgs([...RUN_ARGS, "--connector", "codex", "--streams", "messages,sessions"]));
+  const pin = { digest: `sha256:${"a".repeat(64)}` };
+  const profile = {
+    protocol_version: "0.3.0",
+    streams: [{ name: "messages", coverage_stores: ["messages"], obligation: "content" }, { name: "sessions" }],
+  };
+  assert.equal(bindOptionalRunCoverageToRelease(spec, pin, profile).runCoverageVersion, undefined);
 });
 
 test("prepareConnectorSpec installs nothing for a custom --command", async () => {
diff --git a/packages/local-collector/test/selected-collection-release.test.ts b/packages/local-collector/test/selected-collection-release.test.ts
index 06072cb98..474a4c2db 100644
--- a/packages/local-collector/test/selected-collection-release.test.ts
+++ b/packages/local-collector/test/selected-collection-release.test.ts
@@ -29,7 +29,7 @@ function sha256(bytes: Buffer): string {
 
 const PROFILE = {
   connector_id: "fixture_connector",
-  run_coverage: { version: 1 },
+  protocol_version: "0.3.0",
   streams: [{ coverage_stores: ["messages_store"], name: "messages" }],
 };
 const ENTRYPOINT = Buffer.from("export {};\n");
diff --git a/reference-implementation/test/helpers/install-path-fixture.ts b/reference-implementation/test/helpers/install-path-fixture.ts
index 5ec05fecb..42dcecd06 100644
--- a/reference-implementation/test/helpers/install-path-fixture.ts
+++ b/reference-implementation/test/helpers/install-path-fixture.ts
@@ -27,8 +27,7 @@ export const INSTALL_PATH_PROFILE = {
   connector_id: INSTALL_PATH_CONNECTOR_ID,
   connector_key: INSTALL_PATH_CONNECTOR_KEY,
   display_name: "Claude Code (install-path journey fixture)",
-  protocol_version: "0.1.0",
-  run_coverage: { version: 1 },
+  protocol_version: "0.3.0",
   streams: [
     { coverage_stores: ["projects"], name: "sessions", primary_key: ["id"] },
     { coverage_stores: ["derived_messages"], name: "messages", primary_key: ["id"] },
diff --git a/reference-implementation/test/local-device-coverage-journey.test.ts b/reference-implementation/test/local-device-coverage-journey.test.ts
index 0f97bc0a5..13ea04fda 100644
--- a/reference-implementation/test/local-device-coverage-journey.test.ts
+++ b/reference-implementation/test/local-device-coverage-journey.test.ts
@@ -14,11 +14,11 @@
 // Three substitutions, all about the release the lane runs. None changes what
 // the lane does with it:
 //
-//   - The checked-in claude-code pin declares no run_coverage, so no real
-//     release can emit a v2 proof yet. The test registers a fixture release
-//     that declares it: on the server through __setLocalCollectorReleaseForTest,
-//     and on the device through bindOptionalRunCoverageToRelease, as
-//     prepareConnectorSpec binds a pinned release.
+//   - The checked-in claude-code pin is not the proof-producing release in
+//     this journey. The test registers a 0.3.0 fixture release with inventories
+//     on the server through __setLocalCollectorReleaseForTest and on the device
+//     through bindOptionalRunCoverageToRelease, as prepareConnectorSpec binds
+//     a pinned release.
 //   - Enrolment registers the eleven-stream claude-code catalog manifest. The
 //     journey narrows that entry to the release's two streams.
 //   - The owner routes read a summary read model that the server refreshes in
@@ -89,11 +89,11 @@ const STREAMS = ["sessions", "messages"];
 const PROTOCOL_HEADERS = { "X-PDPP-Collector-Protocol": COLLECTOR_PROTOCOL_VERSION };
 const CSRF_FIELD_PATTERN = /<input type="hidden" name="_csrf" value="([^"]+)"\s*\/>/;
 
-// The fixture release: a claude-code profile that declares run coverage for
-// both streams. The server registers it, and the device binds to it.
+// The fixture release: a claude-code 0.3.0 profile that inventories both
+// streams. The server registers it, and the device binds to it.
 const PROFILE = {
   connector_id: CONNECTOR_ID,
-  run_coverage: { version: 1 },
+  protocol_version: "0.3.0",
   streams: [
     { coverage_stores: ["projects"], name: "sessions", primary_key: ["id"] },
     { coverage_stores: ["derived_messages"], name: "messages", primary_key: ["id"] },
diff --git a/reference-implementation/test/local-device-coverage-revision-atomicity.test.ts b/reference-implementation/test/local-device-coverage-revision-atomicity.test.ts
index 7c0910c36..acd7d3535 100644
--- a/reference-implementation/test/local-device-coverage-revision-atomicity.test.ts
+++ b/reference-implementation/test/local-device-coverage-revision-atomicity.test.ts
@@ -59,7 +59,7 @@ const PROTOCOL_HEADERS = { "X-PDPP-Collector-Protocol": COLLECTOR_PROTOCOL_VERSI
 const CSRF_FIELD_PATTERN = /<input type="hidden" name="_csrf" value="([^"]+)"\s*\/>/;
 const PROFILE = {
   connector_id: CONNECTOR_ID,
-  run_coverage: { version: 1 },
+  protocol_version: "0.3.0",
   streams: [
     { coverage_stores: ["projects"], name: "sessions", primary_key: ["id"] },
     { coverage_stores: ["derived_messages"], name: "messages", primary_key: ["id"] },
@@ -1311,14 +1311,64 @@ laneTest(
   }
 );
 
-laneTest("run order: a run with no issued sequence never produces an eligible proof", async (lane) => {
+laneTest("run order: an unregistered attempt retires prior coverage and cannot establish a proof", async (lane) => {
+  await commitProof(lane, "run-covered");
+  await assertCovered(lane, "run-covered", "the registered run's proof is current");
+
+  const batch = await postBatch(lane, batchBody(lane, "unregistered-run-batch", sessionRecords("unregistered-record")));
+  assert.equal(batch.status, 201, JSON.stringify(batch.body));
+  assert.equal((await highWater(lane)).event, "batch_accepted");
+  await assertRetired(lane, "an admitted effect from an unregistered attempt retires the prior proof");
+
+  await commitProof(lane, "run-covered-before-unregistered-terminal");
+  await assertCovered(lane, "run-covered-before-unregistered-terminal", "coverage is standing before the unregistered terminal");
+
   await commitIssuedProof(lane, "run-unregistered");
-  await assertRetired(lane, "a proof from a run the server issued no sequence is not current");
   assert.equal((await storedRunOrder(lane, "run-unregistered")).run_sequence, null);
+  await assertRetired(lane, "an unregistered terminal retires prior coverage and cannot establish a proof");
+
   await commitProof(lane, "run-registered");
   await assertCovered(lane, "run-registered", "a registered run's proof is current");
 });
 
+laneTest("run start alone leaves earlier coverage and its as-of standing", async (lane) => {
+  await commitProof(lane, "run-covered");
+  const before = await projection(lane);
+  assert.equal(before.axis, "complete");
+  const beforeOrder = await highWater(lane);
+
+  const registered = await postRunStart(lane, "run-with-no-effect");
+  assert.equal(registered.status, 201, JSON.stringify(registered.body));
+
+  const after = await projection(lane);
+  assert.equal(after.axis, "complete", "registering a run is not an observed coverage effect");
+  assert.deepEqual(after.asOf, before.asOf, "the earlier proof keeps its original as-of");
+  assert.deepEqual(await highWater(lane), beforeOrder, "registration takes no collection revision");
+});
+
+laneTest("coverage: a later collected proof replaces an earlier partial for the same scope", async (lane) => {
+  const partialRunId = "run-partial";
+  await issueRun(lane, partialRunId);
+  const partial = await buildProof(lane, partialRunId);
+  const partialFacts = partial.normalizedFacts.map((fact) => {
+    const stores = Array.isArray(fact.stores) ? fact.stores : [];
+    return {
+      ...fact,
+      coverage_statuses: ["partial"],
+      pending_detail_gaps: 1,
+      stores: stores.map((store) => ({ ...(store as Record<string, unknown>), status: "partial" })),
+    };
+  });
+  const partialResult = await commitTerminalRun({ ...partial, normalizedFacts: partialFacts });
+  assert.equal(partialResult.replayed, false);
+  assert.notEqual((await projection(lane)).axis, "complete", "the earlier partial is not positive coverage");
+
+  await commitProof(lane, "run-collected");
+  const collected = await projection(lane);
+  assert.equal(collected.axis, "complete", "a validated proof for the same scope replaces the partial");
+  assert.equal(collected.asOf?.run_id, "run-collected");
+});
+
 laneTest("run order: a second collector on one connection is ordered by run start, not by commit", async (lane) => {
   const second = { deviceId: "device-second-collector", sourceInstanceId: "src-second-collector" };
   assert.equal(await issueRun(lane, "run-first-device"), 1);
diff --git a/reference-implementation/test/local-device-coverage-stale-proof.test.ts b/reference-implementation/test/local-device-coverage-stale-proof.test.ts
index 5fe36990f..a13161c34 100644
--- a/reference-implementation/test/local-device-coverage-stale-proof.test.ts
+++ b/reference-implementation/test/local-device-coverage-stale-proof.test.ts
@@ -77,11 +77,11 @@ const STREAMS = ["sessions", "messages"];
 const PROTOCOL_HEADERS = { "X-PDPP-Collector-Protocol": COLLECTOR_PROTOCOL_VERSION };
 const CSRF_FIELD_PATTERN = /<input type="hidden" name="_csrf" value="([^"]+)"\s*\/>/;
 
-// The fixture release declares run coverage for both streams. A negotiated run
-// binds to it; an unnegotiated run leaves the spec unbound.
+// The fixture release inventories both streams. A negotiated run binds to it;
+// an unnegotiated run leaves the spec unbound.
 const PROFILE = {
   connector_id: CONNECTOR_ID,
-  run_coverage: { version: 1 },
+  protocol_version: "0.3.0",
   streams: [
     { coverage_stores: ["projects"], name: "sessions", primary_key: ["id"] },
     { coverage_stores: ["derived_messages"], name: "messages", primary_key: ["id"] },

From 070943793bdcf2e1e55482da0164417063ff4083 Mon Sep 17 00:00:00 2001
From: Tim Nunamaker <tnunamak@gmail.com>
Date: Thu, 22 Oct 2026 18:04:48 -0500
Subject: [PATCH 58/87] Re-vendor reference-contract and drop the
 pending-members workaround

The server sends coverage_as_of, run_sequence, collection_revision and storage_epoch, which the old vendored contract rejected. The atomicity test deleted coverage_as_of before validating, so it checked a response the server does not send. This re-vendors the contract from PDP-Connect/pdpp#454 (head 473f9763) and validates the exact response.

Assisted-by: AI
Signed-off-by: Tim Nunamaker <tnunamak@gmail.com>
---
 docs/261021-local-device-coverage-evidence.md |   2 +-
 package-lock.json                             |   2 +-
 ...device-coverage-revision-atomicity.test.ts |  42 +-----------------
 reference-implementation/vendor/README.md     |   6 ++-
 reference-implementation/vendor/SHA256SUMS    |   2 +-
 .../vendor/pdpp-reference-contract-0.1.0.tgz  | Bin 201781 -> 203968 bytes
 6 files changed, 8 insertions(+), 46 deletions(-)

diff --git a/docs/261021-local-device-coverage-evidence.md b/docs/261021-local-device-coverage-evidence.md
index f9c813972..f49140da2 100644
--- a/docs/261021-local-device-coverage-evidence.md
+++ b/docs/261021-local-device-coverage-evidence.md
@@ -138,7 +138,7 @@ Terminal record for every successful run. A runtime that implements this profile
 
 As-of. Every owner projection that can show positive local coverage carries `coverage_as_of`: run id, release digest, run sequence, collection revision, and commit time. That is the connector summary (list), the connector detail, the owner connection diagnostics (`health.axes` and `rendered_verdict`), and the connection health embedded in each (`connection_health.coverage_as_of`, `health.coverage_as_of`), which equals the top-level value. All of them read the same summary projection. Owner UI copy reads "complete as of <time>".
 
-Contract. `@pdpp/reference-contract` is vendored as `reference-implementation/vendor/pdpp-reference-contract-0.1.0.tgz`, compiled from `packages/reference-contract` in PDP-Connect/pdpp at commit `0d3deca1` (see `reference-implementation/vendor/README.md`). Its diagnostics schemas set `additionalProperties: false` and do not list `coverage_as_of`, at the top level or in `health`. Its terminal-run response schema does not list `collection_revision`, `run_sequence` or `storage_epoch`, and the new run-start route has no contract entry, like the other local-collector routes (`terminal-collection`, `local-collector-gaps`). The source schema must add these members in PDP-Connect/pdpp; this repository then re-vendors the tarball by the documented process. `test/local-device-coverage-revision-atomicity.test.ts` validates the diagnostics and connector detail responses against the vendored contract and lists the members still pending; it fails when the vendored contract gains one, so the list cannot go stale.
+Contract. `@pdpp/reference-contract` is vendored as `reference-implementation/vendor/pdpp-reference-contract-0.1.0.tgz`, compiled from `packages/reference-contract` in PDP-Connect/pdpp PR #454 (head `473f9763`, not yet merged; see `reference-implementation/vendor/README.md`). The vendored contract, from pdpp#454, lists `coverage_as_of` (required, at the top level and in `health`) on the owner connection diagnostics response, and `run_sequence` (integer or null), `collection_revision` and `storage_epoch` (optional) on the terminal-run receipt. The new run-start route has no contract entry, like the other local-collector routes (`terminal-collection`, `local-collector-gaps`). `test/local-device-coverage-revision-atomicity.test.ts` validates the owner diagnostics response exactly as the server sends it; no member is removed before validation. Its connector detail check still ignores the known `streams` name mismatch (`STREAM_NAME_PATH`).
 
 Device diagnostics. `local_collector_coverage` in the device-exporter diagnostics takes `fully_accounted` and `coverage_as_of` from the same summary projection: true only while the fenced proof is current and the coverage axis is `complete`. Its `by_store`, `counts_by_status`, `store_count` and `unaccounted_stores` are historical inventory from raw `coverage_diagnostics` records, with no run, release or revision behind them, and never claim current completeness.
 
diff --git a/package-lock.json b/package-lock.json
index 4f444f2fa..8c1cb8a0d 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -3730,7 +3730,7 @@
     "node_modules/@pdpp/reference-contract": {
       "version": "0.1.0",
       "resolved": "file:reference-implementation/vendor/pdpp-reference-contract-0.1.0.tgz",
-      "integrity": "sha512-cZABagz5fGoa+dFUgBx1MUKVt9w8/5Bl41u0EKcE3Xfa0xAEocp1I2wTykd04VRVB1SJT63Azxv9DIkDaKCHaA==",
+      "integrity": "sha512-xGEzpz1wvcsMlz1Ni9QofjDehRyi0cJW0E2T76Bp6Y5W454dU88d4VYoDgfFBmb+MIOUT+QCDvJUDQjsnneJ1Q==",
       "license": "Apache-2.0",
       "dependencies": {
         "ajv": "^8.20.0",
diff --git a/reference-implementation/test/local-device-coverage-revision-atomicity.test.ts b/reference-implementation/test/local-device-coverage-revision-atomicity.test.ts
index acd7d3535..954666005 100644
--- a/reference-implementation/test/local-device-coverage-revision-atomicity.test.ts
+++ b/reference-implementation/test/local-device-coverage-revision-atomicity.test.ts
@@ -22,7 +22,7 @@ import { join } from "node:path";
 import { DatabaseSync } from "node:sqlite";
 import test from "node:test";
 
-import { referenceManifests, validateResponse } from "@pdpp/reference-contract";
+import { validateResponse } from "@pdpp/reference-contract";
 
 import { COLLECTOR_PROTOCOL_VERSION } from "../server/collector-protocol.ts";
 import { reconcileDirtyConnectorSummaryEvidence } from "../server/connector-summary-read-model.ts";
@@ -1535,34 +1535,8 @@ laneTest(
   }
 );
 
-// The vendored @pdpp/reference-contract (built from PDP-Connect/pdpp
-// packages/reference-contract) does not list the as-of yet, and its
-// diagnostics schemas reject unknown members. These are the members this
-// change adds that the contract still lacks. The source schema must add them
-// and this repository must re-vendor the tarball; when the vendored schema
-// lists one, this test fails until it is removed here.
-const CONTRACT_PENDING_DIAGNOSTICS_MEMBERS = [["coverage_as_of"], ["health", "coverage_as_of"]] as const;
 const STREAM_NAME_PATH = /^\/streams\/\d+$/;
 
-/** The response schema the vendored contract declares for one operation and status. */
-function contractResponseSchema(operationId: string, status: number): Record<string, unknown> {
-  const manifest = (
-    referenceManifests as readonly { id: string; responses?: Record<string, { schema?: unknown }> }[]
-  ).find((entry) => entry.id === operationId);
-  const schema = manifest?.responses?.[String(status)]?.schema;
-  assert.ok(schema && typeof schema === "object", `the contract declares ${operationId} ${status}`);
-  return schema as Record<string, unknown>;
-}
-
-function schemaAt(schema: Record<string, unknown>, path: readonly string[]): Record<string, unknown> | null {
-  let current: Record<string, unknown> | null = schema;
-  for (const key of path) {
-    const properties = current?.properties as Record<string, Record<string, unknown>> | undefined;
-    current = properties?.[key] ?? null;
-  }
-  return current;
-}
-
 laneTest("contract: owner diagnostics and connector detail validate against @pdpp/reference-contract", async (lane) => {
   await commitProof(lane, "run-a");
   await reconcileDirtyConnectorSummaryEvidence(null);
@@ -1570,20 +1544,6 @@ laneTest("contract: owner diagnostics and connector detail validate against @pdp
   const diagnostics = JSON.parse(
     JSON.stringify(await getOwnerConnectionDiagnostics(lane.enrolled.connector_instance_id))
   ) as Record<string, unknown>;
-  const schema = contractResponseSchema("ownerInspectConnectionDiagnostics", 200);
-  for (const path of CONTRACT_PENDING_DIAGNOSTICS_MEMBERS) {
-    const parent = path
-      .slice(0, -1)
-      .reduce<Record<string, unknown>>((object, key) => object[key] as Record<string, unknown>, diagnostics);
-    const member = path.at(-1) as string;
-    assert.ok(parent[member], `the diagnostics response carries ${path.join(".")}`);
-    assert.equal(
-      schemaAt(schema, path),
-      null,
-      `the vendored contract now lists ${path.join(".")}: drop it from CONTRACT_PENDING_DIAGNOSTICS_MEMBERS`
-    );
-    delete parent[member];
-  }
   const diagnosticsResult = validateResponse("ownerInspectConnectionDiagnostics", { body: diagnostics, status: 200 });
   assert.deepEqual(diagnosticsResult, { ok: true, skipped: false }, "diagnostics match the contract");
 
diff --git a/reference-implementation/vendor/README.md b/reference-implementation/vendor/README.md
index 1ab89cbb4..28cdc2cfe 100644
--- a/reference-implementation/vendor/README.md
+++ b/reference-implementation/vendor/README.md
@@ -10,8 +10,10 @@ already pins `@pdpp/collector-runtime` and `@pdpp/connector-protocol` from data-
 built with a plain `npm pack`, referenced via a `file:` dependency, with its digest
 recorded below.
 
-`pdpp-reference-contract-0.1.0.tgz` was originally built via `npm pack` from
-`packages/reference-contract` at `PDP-Connect/pdpp` commit
+`pdpp-reference-contract-0.1.0.tgz` was built via `npm pack` from `packages/reference-contract`
+at `PDP-Connect/pdpp` PR #454 head commit `473f97633458031425f85343cd822619ccae205b` (open,
+not merged; re-vendored 2026-10-22). Re-point this entry to the merge commit of
+PDP-Connect/pdpp#454 once it merges. It replaces the earlier build from
 `0d3deca19186a2185a6a15ab76c71352d10e627e` (`main`, 2026-09-02). SHA-256 is recorded in
 `SHA256SUMS` in this directory.
 
diff --git a/reference-implementation/vendor/SHA256SUMS b/reference-implementation/vendor/SHA256SUMS
index 74d63edfd..774c4de68 100644
--- a/reference-implementation/vendor/SHA256SUMS
+++ b/reference-implementation/vendor/SHA256SUMS
@@ -1,2 +1,2 @@
-5cc9e7fb37eedc835389007b93da1a54edb183c9a56ce9d4de827def397d9ea2  reference-implementation/vendor/pdpp-reference-contract-0.1.0.tgz
+2c5106e98cf10b45bcd6940b18fa761121961457717bebb685716e840f510f8d  reference-implementation/vendor/pdpp-reference-contract-0.1.0.tgz
 77fd221fe7002c7144fd6059ad73d58002fa8aa8d570dfdeac4cc49493be8917  pdpp-polyfill-connectors-0.0.1.tgz
diff --git a/reference-implementation/vendor/pdpp-reference-contract-0.1.0.tgz b/reference-implementation/vendor/pdpp-reference-contract-0.1.0.tgz
index d4049d875d44f899b9511838907bac3831170694..00b88a8410282172dab56e503e32ba825c7c77e6 100644
GIT binary patch
delta 200067
zcmV(^K-Isss0_fl41XVs2mk;800092?7i!D8%LHV+Q0P_Vc2bxGLRr;OVtGyt)?m3
zX18ubO6BRHSwH|8AflAWOlKrW!4lW%U+4Uv)$cHmF#r2e`bo~(mxzqK0U$-W%6-gL
zWs#YYaow?F$G&_!m6JE}LiIy!^8O^5&y%=6k#Q31iHw53nty+|gP)z9okw4PEt;P1
z?0ofyKft@M9zNRH-F@_E=WFo~JG)=+?EXRg!_Gha3O@^z%j_R^cJ5%1J3BkV{remF
z>G#E9k}flSG0VlPnG!FbyzCt&ajYh}I85R^)8j>+WaeJKFHT=R`JcU~dZJ>ZddH!P
zb3N568;FBcPJd>q_aNB0H%VfXi$hC7hl|W4+394a=2Gm7clU%4;xio%L?;c?w4k*<
zmF#q}M5xRp(`l}gcpy42Qu*^j38S)0mG!hS3l)k~Ug%gt2{FM>1922jl293u&lErF
zO|^=`ewyjI%$B`3YAMphX!t7Nrt)Q~2BKr~Ove|U?ti`OJs4^aegsbhw4rgh`BH3|
znaoruu5>;V>0%t|iI~e+PnF5dHhl;+z+}?vev+z8=1JCn`t(_EDknO=5R-b<fq15~
zEP={rDpSHFFcPTC&5}^@rHYbN2^oiidy**`_H>*saxqg;sxku~h)gYv!nsgy<s=tI
z&apCsi+^E+H2hMV9C}n83yv^Z<U+@JmV^uJwiFYcO%{>Npej92lPnL!zbcgqoN8gz
zT*kSc7@=bkC6hNjldII9t-g*!^)|>&a8JF3?*-G0n~~$NLNH}=aKvT1tQ{$eX_7%7
zi^<(eVkMHRSY^FQ5>NHT0;Wt(Cdnes`=Pqj6MxlDvt+6xwH=5<naZ(_bgq@bIljnb
zoU5>5y|6^4gbXiLmTRLzk<YSZaWNC4?~h)I{^f3;=6YmlZLZ^|D!#~P1F_pmeJzvn
zM4L2{%ja^gR?f}~9P3=kSjQLBMI<6QRuN7N?h998AfBsBMNdthWb#7wBDqwVNFzB>
zvwtKCRVKDZk-CtR<)|x0p_<A?ln;6KM%y1et|U8-O)le!It~vaEzQcIJyB_<CNjs}
z2Qv>};K)YBu!cGu1>$I~b0{aHB)%{@RMjFPTtL@w^mBcY5huCQahP1e%v^~{q*a_7
zar(oH*H51aeGw-a>?duQ)PX!;@71c-v46>x3~w|$j^`Zl4j+g}$8Su*P)7K7U{o|6
zi7Z*fVK2{g%DZ?vg$`UQk*S{-%H+U3B#(jF0g#X7D8v#bGK$<b&lE0AwwNG0_<5nS
zr7*e7RbbnW)!Td|w6UxhY8o$el;d0^#HRDaPTii6V*~BO3dM^k8VR6FBjQ9%7k^nk
z16q?8D!AA0Lsj1<`Ap2!d<-lMwpM~GFC&q}B2MC7qz&}bq)BX)>5B0pC!((LN2ty+
z!?B8zE0Hdu2nx@EF^!jkiJ7@95tNz9RKfTbv7RQ`yuzWL!X#{RmSI6&eHn(DM)5L(
zg8=x(Kul$16ctFl$5bc$z*PHxuYWrgX&K<F9!#ltee%?s_N$qStFsQ{l$TORavUj3
ztM-Q|^vsc{=s-oC^P<#s@hgzzK)kE;@2EzS&?n+U+PGy5I^D{CuvK4|HcK-8tD5Ak
zn*}+Nn5$eCJLV9cIZEp37|C>!n7nt9$xwv>p3*wjxt5W*OeS&+N81vnW`7hXu^M%8
z=P8rxIq;oP7poZI_8IN*<Qwtq;NL`;T*X+ekaolh&yNsKYpCei>(f_4&2=s$FpWi=
z58YScNL<Mbn6}VUAjzc&liCrvi1UBdak!B{WeYdTRENbZ@Z8}a0gszEDxM8EMv<v}
zk;N(mGNKPIWwdaFqvFLJ2!95?26AyzhJV0xS>joLG%Vu$nabtHgM`8#w%gw5I2=@`
zw;*t!0URwdza);9!aHDbbB&-1eC<&S?m(iIK%5e-_>}_LBtQ;2uhoLf5Qra@cmvWE
ztOWOcS@6Y7!gltn%x5wd`4Y(}2VTroUTP_%NMiM33M}v7U;YfdeSc}hWTs@gC$dGH
z>$wsr0r(XbTUC!Eh5HvMIOoH2j;p3kuHrme2JTCoE?^3C9qT#J#*W+PI?mOF%BmY3
zHjU0y2xJ7Et`N)`1~7&b5hVjS!iBuJ$kc_*RlyEk*jckhi!#7BLYYgJAK@s>LVMiE
zFc1ewSC?)lGe3b@g+i4XQLFp3)_iuRGLv(at85P!8Mpxmj+u&<mLca*SHUcj44%=F
zL`yMA=IJ5__AItyl+_$*Z3kkMC%KG}SY&i1le7jWe}E0vL!#IM2?stO!k<GFe@5Fh
zk47ZOuEbPFxyn@7C7HQrCP}JrvL;EEF5n!Vf&^7u-1dmgL94dkd2*rfgi10o264d7
z+?I?{Zkea~k}CvWEMO%k5#EEEI@yJaWGrM9^%ij|GoxTWy<RP$oN=>>7nL{>P>0Fo
zJT==^e>^!&)np)&RK+G$lm28T;|pa#Ym!DPS3UJMjgm}dJriA~Jsm0;^`WG}ujwaK
zQ<bTBqIw#>nyWa+sp!dUGSj)5<cmz<SHV0iKHK`V11D9LE|Gx%^E9fR{w-~HwkxN}
zk63b3PFs}zFjni4AFu}yv*5Q*D079>)+!Ice~%;9TYQTve0!FJpWlop@qup2S^+C>
zkgSdOQG4=({z4d)2jVbF;6{mps?itmK*Vq-0sV&M8F&SX#fwzMK$?OG61cm)x{%x-
zEkS-Z#7Lkn8R4x7>H(>GDsvf$C^1II${2fnfqk83Kw7EHbCtznF7wGu#}`#PqRt;C
zf1%olkc#4E*}*?`=&&qgs<0$fc>;^rQo%*Q_nF=|K8JMmb*iFPr*yPGTSU3;nPibo
z6m2W>MyDyZ$xp{>BCR&1=!VHNCFde3otJbs)CM`ZOw&kDaN_es=-lfQ)jZ^;hH;V)
zi_+x|p4cnh0t#Ti!s03n{72>*wH8ahe-oR<WF}-u*07h<BpYhJbK_OH=uuJU5NjDO
zOm(VGkO3LN9EiFl%^MZs$vLMRGDskBt(I?Lo6%*%=wImYEXgW$=@On<R)!xUL&h6}
z6ORk}lzw$aM|jzd<UI9;73sOohxoKU9J+(x0Vy-wmHtw5=gch0@*XO_G@eCBe{#TY
zl11*<H(rDnDi`YQM5$1P+jv<Znwd+Dou_3t;tDi;c-SYgSwy)Cy)JWKhM9s_rrc@X
z8q%W$y2&P4g%+kVipFyChC9qt;Mb+zrZNtPI7QpAa(tgAwE=5B#!AR5yhKe)d&+BS
zXq)1$ZYb(AE4TsI_^`7F*yo_mf3Hf@`y)tBs1aat%M>0uuz@8}3F<#RO<EU)riQ)d
z6hb)QiOOOVc%AXe@Uc|riB_Crz9{RRA(JG|)!RJ413}Qq<fvK6$*g?J%;nOrQRX=m
z3H1~Ol$`jOVbU29*@6<#vA-c+EV^RE;$TqPS$v&nxIKi)WC3yy>YPz6e;cyq#q2p%
zj9(WFECcqATJgUwOfD`K67{mI?6+E<q6?wQrN+a)nN;#@p}Lh*yfVkD3Bl<20tN(Q
z$Mpv#Gn69!pUQkz^ah_nXWAEau8ffvs;)-)VKJ9+4~``~MnK4vBt8e?IUF(eWamvw
z2Yk?3LqYaTahH_ZI(b9yf6{%TIG+M>#AXA(PBcWo$P2-TIH@Krt#@eQ0Rt+$sf^(w
zRa^>6y(E1N9QN+;_I42Vy?t66WVi_m9iqdteKTnel}lr=Y4|Fpd5VIX_j194TeD`;
zswIPxx)bWEYCH?IWYVDh6k!s7k&BtUB-tXqgw@CU5#4S;_tm!xf3a85hRQH>%1~%0
zU#8egY-0jTQxWnuy(WD41p#|LsH%Yqvamyfh1a>7n?d;;afC0kOfE}wPj{n1?dEf1
zeWROAM+nC;h{!VHHv`m*hX#%etF;-+3oFfl9R_Ue1ywK|1gLMMwhv+AN5uY;h&WxS
zfj7)yuOyj>bgnWue+3d!<r|%s2m>n16HxstnWOkQUBqO>vJHPLjVhLB%WHX?*Mvkf
zZ-LMjFz~hEJ{!yBKr}5I)eMV<1T_#|Q*OuZ-MhwJ<#r9yqhs&l7}gs%%B75Sh^)lz
zv?zkRH_OO4k3b%$Y=RS`nKVO?P*ER3a%K`K8H<@Ty+U(Ne++c5Wb?R3iZEpJq;{Vs
zQIuTu7Ab1Akv&=!3#$uW0o&t`JT~z2LSIT0R9SCA_BAnjs!eX`i#sheDm{Y2Wa{*R
zs2s7Ud(Cufa*dW9(&um!sJDvM9^NF2vMlA9E1gefKrYCyiHrqEErpf_82nP?329<<
z&T}*(r8unpf2gXlwgaz^PV9@VVu7~B{x@Rl-G?xaAP8Ehx&vg?*)E6?^dTPqD7vwN
zd06uC4jd++RVR*RBdDa1@UN{0evimd1P4+sTTi3yz4E3Y*`voIUa>ny(1fFImQYf;
zj1sslVd*_*0JMw;sEI$2b7gtYsLxB=r)BkxBa-faf24-6r;)F9fE&$R0j-f-*G3bk
z*uy$ic$}e&OZ6*|h|l<{bW(KT2FrZQrNw6Y6YGYs^qC*}9YCo(@m84WptPu97)^DI
z7wW{WDM(0IeP?8?o^YHbmuTo+WK%g&K;=TBn+Qpjr30sRA+g%}LRQvp<-%{-&XtzD
zIz0;Xf27`=JRvD`q0J0*5Lq(Eab2ibWqMLRK8XKCOM7B?(}LA@M&;4&iJ8s~-`%mQ
zUZmfUMgotQ;y^+E=babU+S5bV1Mc;los%R;vv~K1!z#&e>BwKn_i938p>r;w@9?5d
zubr=n=Vt;HZ5gE+l+<<#^)ISN#|7RgdiHX)f8Dya*!lX}&UF53aBg0jcHZs!@ta`X
zg<8I#;RAlAlbB?iGJkhG7FQRT>RjbO+-PDGX|yoKwc#R57OB}r1`vV03N&f#<AXDa
zB<u;9FkiM$)eR7c<C2jA6v|mfn}_;<CMP~%s3kgs+K9;xRedP0DEeGy7bL2m)|}&t
zf2*!_fh&A#NZaAg&NNH@%HCcQ<UH8?fjF2<REoD(Ba}unl@y1kU`a(^B2uY?wFxK?
z<hw!{U@XhUQx+T&$)1QRMuS2mS`EA6Urt{<7vm&ccJJ{G_}Sr0ktazca2&xZ<%&ro
zvd#8mFpfm}m%6_GI~?mvn2k+tbY5|Lf3b^~FQ&f2eskSb*`bBE@aCVhJJm6Lx7*~i
z!rQ;*sB+%q1@Rp@a@i%uDJ<4LC@*f~vIgQwf(A-jWKfZSgv^>%P|MA96td;c1nxdL
zq5@~<j^>hB^=3&bbR6keQ3VDlkcf}fzV_Z@P^CvQSVSj+ypW(8XNNv8O?+W|fA2(U
zQA|7+$2}7EX+OC05wsYl;uTe)p(CtoV;b^`H+%T59{Z8RLq8|a9O*7EJ!kt(B`7U>
zdD64<&65(tcJn4-ylnN(yb(24h^@4!q)#8gOw%;R3%J|^<&>zQuzJ8%3vQuv887`c
zWo0gLdOi>S>)-!_9?)R{DpWUGe{ycV1REpTGYxhNoIP-13*te7TOcn)pEqVs)(eCT
zhuGXAeiJ8Gaf#AkQprD9NSujKDDYfne-ttSNhgKTJd3H+(IRW6q^B@rHzcRxo0SSD
z&)&P+YVR$R<4b=|?Yh8ncEuaDBq}ORMj-y|tw?PVd}9(?VT={wORG1Uf6KR)b}A&>
zK(5Vtsu8(i6epQtCwTVH5ObMUH<UfgVm6~9b&)KIMBgX+?X%3Z%{~>@tzDSKcrH`1
zHF_tKbimYlJ=zY$0dQ8u9y3(hAhELtZHxP~H(H)MA_{U&x&fQ|4##|hqs|pyO;YY~
zsU3xM9IigW+<ThW_V-mPf2|d$O0mty>?Q;8f6&0hYfDakEc$qQ0yB|d1T!i}X$a|t
zD2&LxtzzB<4WbJSsW+La$r}tb@D4MMEWiZ}8Y{NT&@l5&v)wquO|yF5tu=RDe^lLx
zEyd4EH;p>SY1pPPtpmHK&#=JxK6xSrZjGu1&XTk!#5=HY`%RL$f1*3HzvEaK9{O^^
zI;LZij2y#B9`<D=P^b3NOilG$xS?aicz)pU;C?Z1RqXc^xqA&|-i1P-sK{~yEU<Wk
zQ>WsPJrL~~Z=azG{WQr)f5B$V4LD7ObwCXpGY(gHQwf<}Y6hb7m)_&EgWms=y<c{E
ze;fwqUv71)Pqy!Wf7bb6p?XD&t82e&nftUL2wYu(-fq6Az12bt+a<ypo%PPi^o%E&
z28yaKdozW5QaA;&*u%2X!^nnZQIQ{By?QA|FVT;Wz0UW8AQ(}=febkY2}K`r&ta{o
zf01J?P%6RO3K=L~8ZXc;-sJPWF(DSE8|Cbi<^diRMhTWnf0~8~9?9>Wf7N^Tb)`X*
zCp|OwiZ^^5iqjtso<3dg`F<zP<o&)t$*{O&Q|AgBjB_YJ0UfRweOA$d0mulMi-$Wq
zY<$5Bi8I?-W6evar~4mpYcK3IC1VY6bz;0ai7AjTHQ;#xJ~hCXGxo2@e7`Ev$b;%}
zcV`Da+1?Ybe-?D=LlNjwWf^D}$u|o4;FT^yn)rrPi(t8lm|YXF%f$4I{kw|W4YD3Q
zU@)wwJpTINA$~$N%C_t}Hh^_-K~z?T_ZQxt-*)8-O&dD$k>Y2(h(qvM_<?L%=;LjS
znvWw2X|$6iMyP@ru_DK*T}D`qU1O(Y=I~2LX2uJpe}cFvsN7!Cy_vK2!GkDj40hUc
zO2{6$V;XA$jzIO4m(~|4R9&hlXbe^b3uHWr7NHkYI!AZM!uyE2mqy8Q?wm%^cN?d$
z7!<k?6|0#kzI`*vk@vaXaV`446D7lAn9M>5btG8vhpLBzcKu>yH^#x5fI|Ce;aT8q
z0)B}KfA~Rj=rXe<ymk)i$`AiFUEl^S_gX4Rr_-RWiL<Xknj6$_FZ7xlXs#Mg&Oudp
zal0b{FA)v?=hnaro1tV69<WvdWI4MZKqc8@j$y4IWwUm%+YH{zl+y>VFbRw>(6YE3
zB70+Vv~wIXiB&-q3S7h1Xb?h+J#p|af5z>Ae=)2O?8Pmk3j`}R;Gme~JywL^Zd^mD
z9)AZlwR)RpvP`|#cVhurwMn`qQ%SiCtDRT2_wKEV|4)7V2XzUIW1{+#WJXa6cY*-1
z68~ZM;iHESYWNRd?fj1a@Y}?Ha1KVm5s=ev;Z?NaO$2nBOj%X5zrSDH&OiTLJjY)H
ze{H^lPzhx#`22G&|INPG5s$?)@UfgmNs`$T0|8O0=tOk?{ylLYd^lMliCbUh>SBq~
zB?{-j;>uw&eR88qvSr`IGBvX#?~^qyPhzO>Y6bxjqX`_w6AbYqLE44|LPLi?96bO2
z=!p~R(9Z`H9*elFAcYFi{0?qM+$pfSe|<;Zmqv9#I8o9pTzHcXA;fA#-3Dh2H2*=M
zH+UgJg<IfRhWDmz8w*qzwUVj$@rR@5;`s}x?vm<y{`%R`$-%1^C*sG0Q*rwG<;$nX
zM^E;kvSOg(Pr`2>@7)w5x`@fhT&T6tw;gQTnKA|f!XVI1+^0(q$%t5FuHkh+f1Xld
zq9|rUz0FmOeha9O1ea6rG;-agQ=ArqJ#?K+U_&HeHB=YwR;ZJxPqF~(VHQRpU?o$i
z%#sI3_;PcVVY^s63`YTn1PBcP=XbKZqvGp6`=Y@aG*UpCGFPW)kU6xB72TzgL`P)0
z7?Q`b#a7Vq1-2HdNRN?Nqb0-@e~>7rE>-O0P^ctMdTxT83mp1!f^(Bdu8`J27Yx%c
ziblF{zQR?*%?wmG2On!W$rmz;mcqzfn<>$DsN%#qgNXb6V!zw@`xb)&$;0vlsr}VV
z#)sVAmMvD{2ktpB15^X1iH`Fj(Qrq+e_zC#m&#5TQ8aY>c11zEqlW}re=^L}MCmkN
z^@ZK~L-OsLsLnQU7dPmlpA@e}!`><$SB6=<;Bnf$3Z1CE4YdJfM%XE}Ig{pfoGFt;
zmnuBSb8z|Hvfc!?Jv|lfS->$y+n&5(*>JW{dn7+t;Tn9xS-H0FF>zNJzqIsvAyc!x
z=a12T{mK45vSZ-e_SrXLleQNY0augF7aIX3lj#>h0gIC>7$twV?bdCR>iBt4&r14k
zEmk6QCXOd+0@{r$rV(@|v_@?^wS~i5nk8@n*XVx8%pMoWve}og+v%gNsm@GJ(Ts3J
znr%EygxC$l!tE@Gh=HvowqW}RyraZ;#6k6-W4w^*wt$#JAOY+^O!Yhnic{MP8?ff?
z&~EzaeZ!0vIQM^Ju1^e#6Nc*kDrm5NOXrxv<X5lT@88z}L^yL7;nI&sUYv-+oQ|S`
zV}@Kub({|a!SX?p^^!4a|3XoS44?#AnALrG6o9fkhp<u+scGItg+<WD6GUTQpsJHa
zq{IV(x-jsRQ=oGNeVr!Vq4-5*Nsl7xP!z+j#ihzLPC0+9HO9XVNHA-Xy9Q#1tsKtA
zivT$|hg+TFLbUV(8D+MF`e2GRB6Pu2<A6KcU2o07%xll^zAs@WQ?V1!_#Uz>2Nml0
zQf69$Mx$l2P~OTwZ-W+p2y(>dyji#xc8C0^;ZKp_Ja$(JU!E8QJCZ%33NZ^M5-U%1
z2{MA5OqqY62CL+&ieLqmm4r3N63Ft45-y3qfdEd**axo5P$$6<g^A_t^jQzr2ct5n
zV<0$gjcUTjs6Q$T8KXW*ZY=`Es6VO;4x?=Wp`m#qFysK-bv&WnKlQxmR(}?~xKy2$
zZXlpiE$BQ#YJ-?f4hRo>B$xBrm0dJoT%I`Cd{%$8$grzVt9~E&=|SwX)FeYE5RbV+
zoHQa^L=yEy3baUh!dn|oS6dlsg~5bH`y0jnV%9><@w0Hit(K4)&b4>ko>kNU2^!RK
z7o8t+mpc%pQk9q-1Kt;_PH6G?G2c*&PYa2&^r_uTL-)S)ZNCqv%)y#-#zq3<Spr_b
zdBK0S+zDz!vT26N4-EkW*y9+q!DUX_BMc6t;0jNL03DQ{T!lIZa3~B?q+#^H+NY;_
z!e<P4Gs*JZ)<QY)$Y`;>I{l$S#1qzm*O=lGS*YQnWdWAp4mhtiH@|Px@(Q*|o&Zyi
znVx8oitaTF#h(1M=g83es7a=>HD9i(_R@c=vj{FG&emOd0oHJowp@Py>)-#Q6gY3!
z1}s+~sspp+NtNCe*ZO3PTCT*ESkMS0q%QC8D|zYJ-N#GE{v76>jhDjhZSo|o)Y!ta
zmvj+k{(;v8@8rUVL{MaDD^*FR5RTe!V%jJuT%qN}Z40;uTqWL7UqVYF?FJl&#8iI?
z8DX2a+KAZ9h=Q0cM@OO6v9eO+GaYO05mD7;iKO6q)pVF{SKI>DvO3E(hHk+ft1H+Y
zckG~jHHd4_(rQEz#S<FhO5B##c?p`rw!G(X>Wb65AlfU$wIJ0-7pwLUL0zh``Rt?1
zTIp1+u#M!Z8pm&C*>CoJL4_^K#rc1O)B!#XaiLX|8O=tCh><c_vEt?f_L?SMOS=Wf
ziR9M2`1{4;mlpZPN|?&`E&7axi`({E`l1kfM_wM+9@^<?Auv7|on*Z42>kKmW;V&I
zv<(Gz_NvEwQIo$xO1*!4(~VL3dT`5OU)yu&D>%#BuX81*XYa~^dkyYw09}7pI(O0M
z3&^T|;_DbU4;a)??O(`EuH6+XfYyOlWu5vUzXrg9n_N3V1df*s&IiZbEQ!J9T?|vk
z=8C)tc`E243A?P2AQ2;B8G}Y$|H6Pd0N4eWy<+es&EML=S7{_phS+&0uGNSC5Z2h;
zm%%lEI@JJR1*_9J_U_GO_e29>yCaiH9V>r?7V6d1r{htH<lXFB{579U#%iYV_8f@g
zX=w;$qL+y9D%lz%5`Z%4l6N3Jwo*Z~+_OH<S8~Z#0#+zkjGJ22dwJ!(sh~06NT2t(
zq~V6MqazxL$P0`AIQG9b`!6mV;L@Qd$cLGMSKEJgzuJ9Rwf{bRwDah9`|oet{%e2Z
z&(x^~U4hY_h8lPdTY&L79yr#CuYu7N_g??foo9MJNAUnF3E=N7@BZ}(7ucXe1jNB`
z7na?`6?(T2K-U~hbaYb%b%sNc6y$-Fi>qW2g(3lta;1&CtBw`=pH{>{#wi2&4>Zsa
z$py+WtBWf->CE8I<@2p4fWwU~Z`n6t0UtpjaA2pRWG8Y9aFQgs*~;L*{sMe*0G_mg
zHux{UZ<wpI^ZL{qrDCy<jzgy^x04QvzAclf9vpwS{4!Pfv1FGx3xWW?IuF1tYHQmw
zFPx}w0qPHSb<4>LS~xU;@u=$|XzM9n6zIG{1arHnR)2a}gjl=N8t<}m`33+IupJ^M
zAf7=HOX0{vy=9X*TDRdOEbzD>cSVwgaH3rSQm9GgL}3rZ1;R4rie{Uvw<)G<a29E7
zXR3eW3zemrhN}<)-Ns2TNreivrD2mUGMy|;v_$<fg^N+#SYd6eYX}{!9lDd_6vn%S
zqb^Zh>B-tXPV8a7#!c{4BA((a(`W+rtF+I>32~7~(qj|U2GgDiBJ`O@!ra-QpEW@t
z2m<1Ec&VV@uHlMsy<KwS+A1~o4Z5_v6Mlau2RxqA*Vi5qA23Qomnfs8zi~dG1ZiBO
zR;v|q_X04kYHKK9PkfVLY6vHqJ9Vv`kM+eOS)i?ygw8AS?x4GxAvX$AAQ9ygIw|@z
z0M0Ek(D9OYgf`?~<7=k@rXgEUauR8MD$sgMZnJ?Hbrvzf40n9n0eS;<$uA=Jtg?Rt
zR(SUq`j`Cgji(p%ICYZH5YkMOQ-p1br(#Yj9B-S1jFQGDh&G5;o4NccsL5&AJd^UC
z`L5Wd<?TZx?npcI>AZR0c|=}()<Dz6G&VQ`$PBlXJqDn*qOzcLt}`fGZh~}SW?LhC
zx&PU_YWeHYcGW2D7xA{hW8NQaEnt74N(<iS!Cw;{Z*{tz?Mjo@R{^V{LVKO<2Hymy
zJ$1?&_G`6&j~Hx;jcNp+DfJu?cEL(yX=`M+-V@)a#|B;Y+<q-KL{~h2@ru&f<Wk3U
z<p-yJt7gA1axz<9pu1FdvEZ8ylc?=-f?HNxf#L&<X?Qx#Nl#2g2}||9h-H74VO#=e
zIzi&GDK_}q1sMCMNj4$mQFl5i@a2MPIeZPx3is_PR4(hL)TkUaaA-ti#CqxV2t%j2
zLuk~po0HC}F*svD06>;zioESDFZ0<5%>q@AdON6!Gzkt{gS^d_9+N^oLjde89vrx1
zUP50_5Fy6=8Ti1Ko%F6_Dph|Up!V%<zum^uXGK9*wMVgsku*k6m!7MH)7X0)j=1r{
zAf^FkGO&83shmJkCL+>88?P8djBuzy$+<9uf;pAr3<VEhthCvY4bPG|A-aS5c^^pI
zCvu^5tvZnkVF>lyhI=}ZWNf7-MC`}$kjoF6lu_t*$_|6K{ZNdEp}~I{gJ|%hT7Wyv
zt)a{dNu;cao{>CRsg!_7lypn<gksy$fFB*~p(Pzp%=2@;HFzEbEli(Ri)^YM({41T
z{@Sd+@?D+FqYVIAY>yz7?AE0HYJ4Ld>EI~R9hLF00<3y3Dec*E1?U;pT>w^<5MH@D
zz+vSzoGKL>XHxRPwe5e{S`RfMv8u(jnmu5z!DE@ftlV1gDPKuIyTc8Oft_DRiN1@|
zw*V1Y_H1GiqwK>}gd7!?-5iyimSK>55)$Jrmz*rJjINuO1-LB^fc6DNV*HkIVTg=c
zz+#s(D-!M?Rjvv5O_KYpj8u<UHwJ@1N2Hi$%FKFbMa#fci{26_#m(nZWuXR`;-!0r
zQs5$L*^^BpaDQ8lyH)e2!fhWJl!~}^+fTQ0on9R@l>=^s{`%-D(*M>!CH-%hOibTK
zF5gk|*R}ayA3dt;f4}-__jmp8uk!QhC;f%V`ePmUReUMpBvkkATqjKKabPY&;K64O
zdKQHJ@}m=ZC9dhb>jXi+lri+Lrn6Vn<ud7%s;fV()PLv-_?2>E77M5BWYc_+Mhxm>
zf%egG4;=F%wrM?107%KU2iIiqEJ4TsK0!@RnBWi{9`vocAjlaLP8)!R1h-2HxJ6uU
zL{$nnoo;pB_8X>ckIOd9%YO5;>=nA=xyolr_^k{t)E50-xwMS#-~a3#y}7=Be^gR5
zTY&4Q;9vZ(1$Y1$SW*N!c7;)(^~}K$#y_DWbeGr{XYQj;=e(v%J_DJ)%lI$nAg8>*
z@Wy~)AGV5?N;+e#o%IAg@zdzDcTmywPb2Z!JJ+FW@!2~H&K_HEL29U~G4N{Zbdwz=
z9)DEfs%_a);5>hJzFlY!=Q7>0Z!!9me-CU8wJ+#izO`iw;8*q!PYLN=9Q@v_(~6dj
z1omO4(-l16AP7qJ;Rs5d8TG_x?_7`YJ**eK^Hy)P%?cawr9i#Td2Q;I$-hlPCP;)*
ztWzLfap2vCCJ#reoligg)TK{=3ILR%(|@Ht!ruXA;)wHC%T&QSbU1GUbg%zclf)eu
zg{Mx#kBI6X2Ocqd9lObP@Tv=1wnm-gfZY5KD})p<jDVpv*(=r5y3vaDgiBFDQQLSk
z>RjJ&BbL2{yjDHps_!@iJ;6Rm@7<u&75;cJGoo)!+PL}y2sQv74;MLyA6uy&0e^wE
zOAJLt;QKcfTV*?3i5R$7-pbYb988l8;M^QP02w?~Z*kvLkb!{YEvIOvv+_nLFY|Q+
z`J{d%e7)*cI>8O&O{Vzl9rjv$DR!?1qY8oD!C}x&^)0M(CB^^RR9~O|jmcApR{FOi
zuhISu8))4Dwt*7$<5+Hgv|8cp34g{PQXl5)C5+LhpNh}k%>x}?k34=o4_K(dmw@34
zyxEgOV9(40vzX6iwrr6u+<W+LyMA>1EcV4b;DhOLfS?+WYr6zm`njcrAPCA*79K+X
zqnu_G(5Qd*XQH7iX}K%-t!eH{dZWI)gtR}UuB5G9sgqXe!1nrAJ-fLYpMPNJG-inG
zj<*6n(}27`T?86yVj0k&&13NXJ(yZoi;+-UgBXc8W**QF)U|~V8NTwd=s0j^;sqZh
zWID)}R|#K1vNr&#wdG!PMXqx&4@XLdT}BwPm?iH@{v13Gv2RNS#WRp$ep)=(+5Nh+
z*SxpHXYa73>+05lhFd0+`hQf}F#ZI*hdeT~Boyz7y52M5Ax^D0r7b7kcN&P|eUE?M
zm;R~z{=R`!=0G2A0_*V_MoyJ&df#IWI7yxDAX8~1Cu*zz)B8T$XMXz0wNfRf_rhMO
z_~OO9X!}~c7sQ;HA-TVGNPm6y&g;juc)y;CHX34iW3J`2O%_$Ef`0_`pW;fmeDg_H
z_73qM`MUg?eS(FciJz;;zp>I_Vcz_bz}{PG0vkh9Mey9O2mZEKkoRx}sZ`0{X<}cL
zB|H8cZuVd#@c!i5-gf}P#CuM+hj>}qc4JNU_}trO{0$|<Es2ZTnaXXpTsIDS&|r(V
zu6b09k=IHnEiFyVb${&D&mXRDfN|tDX+Xa98=wyx8sGvRGj6W1p<Dw^V|iZi|NOtA
zLezMiA12A0agw~*s_0D$1klc>phtVjxxpt~-owo7_`d@<oFaHso3bsJ8Ag!KT)rnx
z2Te8F1THdXL_O4wn?8V32I5unMsaqDZ<WlzfH0XrJZ(-d$bXoCnGLa*n8F({<v{fX
z$%X&(|NN8KI#HYtm%->U=^3=TjczoHe3oRGpX8DteYt1LIG1lluL2onL2Lhn#<OqE
zF&TN~89>>NI5}j=Fxm?<4e{}WP!?ohwjVP7FsEaoHw4Ny>N>;NsFV-3fSx3aw_O*A
zdb{H2$vK$7Fn?4p%M_wUMiB)ygDnd?x5svJawUgOSZncr{-1y9;^bX``6V_%+lqhs
zDI~MuY&=_(J1NPx+lp5~>>X+wnNEv<Ky<?*6V#<9v}MNl91|e`QkqQ`W#yniyg(Z`
zQ^!`CM9V37xj+sZie#pC&{W>D6&I~qH-10sa5!?8gOe~S7$LsY>S`aI0|1E>L8PI+
zo|;be1nZX<82D``mce~iRP#BLX(}ZFIFpYmEq}Gr-e@$M<$3BqDo;^~HPJRFC)a^x
zCx1dp7$(_}R(6Oh@lB<bwhp}Jgv$k5eZx3CPBD$-1%&FO>lE*MOit_Z0r)#oZ-Lhg
z3EmZ+7&VuWMaz36i~KvIZH~~-Ana35W){<&%-PjMJ>(bbSON9i;$`NUmQhc}VUKbn
ze1E;O!;r8{LCw6YZ=d_Ed5@W)Aylk2O~B4%uw?8F8SO2~Fe?8`sG$PLv6UJCehl{w
zr+7eyStJ<dEZ1GXV%|J<Q$Y2DTN7L3e&md;=3`UhD{nN=4@Tp)MtpYC>xvPwB@A)0
zIHj=TJbd%Q0St{f>=BD+gYfdZ5h-8Ibbq8oGN<G{B9m9%UcgHuLr{*RWW4eaIr5<R
z+lu*RY|a{DzllA?e?i2hw1?ob7VV#KO9Szm068J5tSF8y<uQf~d4)?zows5@EXU+Y
zI)vogCO3WNua8+;fayNpKS*clt$1~%<MlL>hCdTo4CQ#T`{1h$i33y(=pe{mj(=MS
zg5Z`JN8Ea1)0YJff5AYko1C38S0THaHu4ER9hop82^mCz2I7=*%K4E012MYDF?shz
zj$D!ch#*hhVWP4L!HNM$vav}^x(w@#>9rKmF8tOjT=dLGT26N0U8Lw#J(T(R*+s6-
z_aE#$c+}h3?d|No+SwW4|NhtK=zsXWFU@50B_vo~#47~-&!vpk3t4nnRHO%d*taLj
zh~sv>T$((fAP7K;B{3L{)aV8mQSQP5#evmcoL&ddHpUzn@wAO>J`SG@{Zn8gf}$uS
z>vGmeUV8|@TOlqChpEb)dE&$?8o8rC%K&1J6mLZ`IM0uN-q-PEq9=-v1b=gO?oNfz
zd8QG8=dw;TUzdpHqw$ARD;g##EG+uTQu1Yx0gG;1;c^Q@Gg$Vv@9o=dbXLw31*bY<
zqEhE0Tnv8Z3)$zRLJhkoCRt)k&w~fyuFYhc;)QULClG=>LBEES*N|=oUl@|Tp(S#O
zr8t^a24}aEmlhVViP(_BiGQMWDWxDMKY|$MNdjKL6hh%Lbp+z2P3eFIK(x_g>sN}8
z>{ZZs88<VP$r$s<*zDQF!8l2@ho?SUjx!w!Tbz@9h9KEwD-NtrKlRf#uIC@j_5MV^
zeA9RN3rB*T%n`DbCcFpAJzv@+2mZoQ)aUY)h>>^zr?co1!iAoQk$+jt`5wTJ`WVm!
zni@#$E8mU+@jc{>v?(DBZu}9|x{r@O$E1?O@p7L9@Xt{q+<#8|&?-q5lQ-bDfDD=7
z%m{a-$kx&&*jR{UE3&n?c~m~bz$Rfq_?eBiDMGkgPRX*=j8c0c(3Dbz^TqN*&ah0z
zMw0ATtmtE&JF}R7j(@%1mvfv(-mI_ywG-{5v7`-#VVP)s2$kiB^rte<<z$8q!b}Da
zKBl;JiXpE|1uAd7vQUO771;y`#@$*#+2Q2aQu-m1sC&*>>!%7LL?fF!ArQ|NjM;)1
zyapH+-i_#DfA@kA^kiR$nD?f8p#X(!^GSP-F%ZzRJMI@=%qqsx=o?5|Pm>Eux>8MW
z+<uG@iZlu}4C=ZRqb;g{JoCGlY637>-l*j^lU^@}f2@_1zZh|1!ca}+A|f2!2M?_e
z`vl|(#A@5!*#Tq^E6aiu3MrFG8wv?+pfo98p$d3XoFWEelH=Y~LTCb}o)1_-YamrB
zr7WbK2Uget<YD&Ixt&qh#(a{}rANy!O|mPQg~d9!%$vMGet?g9o5G}HSWg5>cTQ*X
z#ocZue|K|XKKgLSuOSEmIxT}B`0$!Pr(y2@39^&(Qh&4g9zKpI1jPctoXdD3wm7f&
zkOG5R*-WWeq5pJ1@fZr`9nfChWeX}#0n`k~d<n7X*acPymm1g~s|y{+h@Ecrwva(U
zbGKRkKmms)qTD?fW|ON7K+Yo~9smSXjOYrVe+i>7))7+wGNUk*x~YfdN8TilT&h-6
z>Fk{!8ZA>%B`S(Zz6Dj4>;F@I0&hT2M>fH4yM`*I03w?l)y#C-BJ#0DG!Rczn$Lj0
z>@s!u8F|kBWUB%Na?bb-MV{snCU=+dazsgbGZhC#KRJ^UC<b#hbubSqt>_*UDQ^@?
ze<<eA--)CN@xRCq5l71pAqE4`ibKd~_NG`Zn_hY!uEY@jHB2EfPWX9gPAV_Y_aAP)
zhTlfXSWHzunXNm?36qI$frS8xsp!Rc33netc9)bsJ^&@>FjLbJ=R793z2aayIR#Qk
zGEQYIbDJBPQxcD`Tf;>bjR^L!OEytdf1dXLgw^Zto6$Ba`CSHX$adgvR?xE^)`ZEu
zE7x(T&l86Gf70PMefIpNo4wI<9m#B4s5m6Fs$QWgp<z3YL(2x*7(4dB8-ss3Ibj43
zsA4i5t}6EdQp(>--BOvPk0#w86l@<SUQhkY*(^a>oHY<W1rf{xYS1i2Pzo|_e`gOY
zjh9*q=`5b3f}$u?a|K<$%n}GA&#cx&OhKO8a@5y)+U*A7L|tf;Q%VCACkJBm^2O;Z
z(NEx%>u3CaB(|O$p18xwx5Yaf>2|4;4+3$D@}Hd&7O*M}q%s>ZZ<79Eak>U`wsTIN
zCHn%_-wgVFNctCq>Jl^qvPWGhe;-a?!NAZM;%h0X6>6MgXZx8VLnlgwF_0vwLn%M-
zNTz_2Afurxm*pD5&PlOad5!-7^DX!0>p&c&1WDY~1*$}iIK+L#-5oA6JzCd{J<uVc
zwYDl!k+^)hGf+Po3au>l=^-WUkpQv75!z!+FF;Lng^U17MNwv%7;yi%e{~f?L?*Rg
zh^MxT!uGAy+M_@mGwv@1_X<L8cl;43w%a-}Rtg)vBT^dbuuHVpW!kzP@y!E}@^X*s
z(dDKGxyqT~@VgOQi|NKfa+l7+9$;%Mt)1WQrKQSO?LG232-T(LQLNZ&CAz0ih9#OG
ziU0b4{&z82E&|tvk@!-Klif2zDbhBGcOt0CkY_4*rnK_2o)~?NX;A5c$Qx-SdSWgk
za2`{k_3*(2DO;0CG&2DelYKN75LY!|<^G<%S`t@xQ&#`>E0d%&G=IBo{wg&V?mM+w
zzlJiyDahbnPcShT9_>&AzHRyxPxI3E#lf$Q%NGeU7{C(Ls@UD(#Q}2A8BIp@vg(#E
z5lIy8k;6`=dMMYsIJJh&b6#<OtzsD12<s=w#8mwSeRpH>L>p8c41MfT-V^BlZ3gWg
z;q~~>uIQknpL^3Q8-Hd*AH*eRxU=qs;9&o~%WX}WwK;~|6tT5En_;<cvWXXRI|4z%
zmLWVDtS96Cv(_!Q;6Lo=h#j?61|5F})(yN8C%bmk+~UE@<J*js!<7p`0+IE`OEj(r
zoi5<JS?}qA==3_GgzEOUj{k=YM>5rS4FRwk|MjcgN4vHBpMN{MJHN;O{~rJUd;I^e
z6#owr*{kG5s^WuGZ=rlvr141>S;1h1jG&iG)S|vaN$*;id<kHVnVcw7hS$qyWvBob
zAog9B%sGe}0wl}fNM54nGVoxger||ayKSI!QQN9G>7p|fGw@D8ltTx`)**E9ZV~k8
zcX3TbsqL8yhJUPr*xCWt;srlsyreR{`Ec>Ow(+tD(T5GUfMn$MD`EZQQUY{ynyLw2
zU#jQ{4Cc2l-U%<HV<4I$^EwWa9s@>-FuigJ5c|Vhr5aRyhK1J#`JY2p2&$5MU?-rA
zh413PtJU7TBhX}}cAi!HeQ8cz)^(Uv%NbnsU=5lALR?4rosH0>a7jNpDS-&nqTjBG
z<FJs@0v&em)#+`pf<1I=GXd$-uRUleiiPtUu`#)>NG>ltQ89o&iBz2k=I^>HG(?j6
zk*cLZ^5}Ea_titr&un#@(agQ3?2wbKI2V7vDk%<1^mK!$+JaWvgKKeC`SsZ;0_tr+
zwcF=-YBlZo2I@{yMAhqyL((=ue&oDo7UN>a(@lY#JJ1H!lOdRWPL3(zG+tzL&MXI2
z;R$QNT5gq;hP;wEAsJ}(?L8$-CWx8WWq$*5iO=i>2C4(iBVDQZCIztoP;*WVt2uw%
z><iRW6g6B>7g}@~!xCz<&i-%+@k{bk#}QcPse#{#F8zUhU_+>_taY~d`Xn%6Du09(
zYzOzeOtwc*!KwFsD=)Fxo*OoycV2YrJu<7W(pGYLXN?5znkkr^#dSm2GYt=e+-f3~
zL(G{YlEx=1hq+xsA*Y&L@%Fk`)LDOqHMgVTuGYo559qC{%<ph}3!C<N?unn(MY&g`
zT>|ImVi_1G$Qvy_sZ40OlzV)BugJ&LP;I4>bHB581DDu3SbLKgjC;jNZs>$9n4^xT
zNtJ1rWRKRd7jw{g>FGHz*yG^ku@Pys@GdmIzND<1>9ad)!C5-BMg}d7`1*e<JR>2B
zf5T2gMa4clE-O;DKwZ`?Y<9#pnme|-B3ifYN=E_966d$G6YK`Q>x{QJtk4*MKE7NC
z7-vO-Ao1X=)JjE;EE_<3<Z;X>@kx#$E|3kAVq~q?JPXYO(Q!|z2XeKU7tl^mhJTe{
zp0`RVu!k7BNwOnrVeu)ev5J2t(VDQfz3)+vOx8&9HnRpO5cMyUiG7M@y*x|MvR7&d
z)x2hHODBHFa-Wc53)Ldm#XbzR${=aN29$Z$C_&YGVmB6LcC2nD+=5$7wqDoxt6JyU
z+BtN-_bz=fIlL`m>zrOx?;Q2b#`T{pVv6wv&%Ol(;g&1S7IAZR=M8_m@$7uNvVyfj
zmGQNTTyq)A3(k%0i&=Z(FiI97a$@k+*%4oYZ5t4UL-C^;&ywT~#H>UbLUyYgAAWdX
zO=3c;;9HjRS>sb|Ad^NK6*6<>_^6N=K7r{z!M#hxm=gncy%Adnr+)U_lhbVk%XhI0
zrU>mo@#N*PJ7xk%FA#rYy~QzUW-@cBgBXReOSZBuN_P}CjJfNr9|8FPTV)m7TZ%Sb
z6<KqwmYP3AY;6b^A}<TXbk?Ck;ohQaqX;NiSp}<R>$2%)IMu2h8;YXrpNW9PHUo`}
zt!>Qp%}bDk8BlE<Uj@7Na$>N;FKHUkT}z2Ytie?mqEy@{Yv6w-b~;wWxL|MhD|#;{
zmExrDRX*Xac$Z*$66DEK$WU-7joR|QLOc`KPdsqW;J@cpjZ0G*6js}FV?vo@K%n1m
z{JPu;TlkFnd)@#9nCp0<nwqPAi}*k*wFV8>Guy@AF`ECr@t+Y~U1i3p#(xF;=iQy%
zod-4i=db_p)$f1ypWk-=KW$!S;A5&U)fW0dS9Jgs{opbgzklzTPVol3F(9XM=)Y$4
zprVw^#IUjuBMYrAG)|I8$trG@HZLQoV^VN6j)to6b8^?~CLdJ<)34;-qZ+GCQqanp
z=875m{PTuh6i+&x=Inr^bbG2zr6oFO*n7PSWyK{QbNzn<afZK~@6|eKJP6`Q=Fb4u
z7o`N$Q?SO5#D>R@5kU<lG0fRi1w1ak!{2NQz#7Q$x3q}m31v_RUc*wl2<|WIFTqrJ
z#5&B1N|U~Fx|Xvpjqx1&R9msnKd&WO<Tvl%a~!vayS&|~;6j#6&hRhMsI*14r3Pgd
zc{aJFf?<Db*#wPEtIb9#`fR(b6QYMtVgDY(m_dhA+5@GJ$(bC;q2V#+uB+G0FZV0!
zQf;`5fmkkENHO%)fd93#`q)m%px7nd$~V-FfnEDIYH7AggQ`~M234u@x_$ZB4Ia@t
z*Dc>m`?_u6OUp#p=>67tDS0#v?CO-Bc74gx1(AOjWxa=9QFM(e3gMr{YjWBfRCop#
zrk5VEFqVYN)FuYyH-5da?*`4JNH0tEqW@gu;`6F=N&L&x8i79Dy`-F*o}I}$e7X|F
zqoNoh;MfA_0_>-L^w+u|A1kkS7`z2;bWARve_k0?jrG@G+autURnz6)1;~oaHSCvb
zY><EIv3M)dqbKhZbX_ee&8$(cbsvz!@G&qlJ{>HT5t@$<?Lkq?_iI1(2L<V&t}sz8
zI=^mpifXiRmarz&UU1js9JjAeo}MBI1#iUyQ*#~|m3x(Tx^4gsFtl&f(jFO2$knvL
ztJ!iPTps0zq7gViKB=BJH@Vi;VaJ>6@H&65;ks!BnkHmzsI%x36mJCJb`ysP6yX-m
z39mGLREOHWUX4S(a+q~Fv|*66jDA<RXj85IzIdL*Jqh#1fk%c=^q{8RB8yZEHp~!#
ze$nJOS29LbkTHA0ywPb;-%s#yNn(-4s4Rb;JXIHRvOGnt^1s3XRT5s1WB6<u`38R$
zK^t?*;Vh*$D|ZO)-<LA8IS%4PL<wYPVt^at1=RZu_r0d}C@7Lt;b1<27=t%D4j+r_
zVzagIj-qWEYKcp%nU#Val<AvNMm5I7prp3qeM1UT>#YmSoVs{jXCU<XisPALZH99U
zWabVOk33_=B1;oPApo|Z|EylJVu641Kk#1pP8Hyn;FWd{ypxaDvV5FyDlU8nhp+#4
z^V!Q`i&gQ!&*^2nniveSu_}y@;DQ)V0Vl(%xTa3|v|S@sHc~@bR-}j9g&@BR1_*k3
z-rQ+s<DoVXbZNU^ep)LH;zp^UFKhsoip+H4mGU0Jq*%mVySNk*WdZ$4cj$k|Erq<X
zZ2Kbb?>e;qHu}FwGM^{$9c%yA>Hi+=KK#0-|J!}^yZ-ODss973j!x#Pr!Qh~R*7_+
z_fwT2*f_Xd$H})c%T)B821kQ{iOz;#Gd+G`6Zw*6h@z)K7)2vlXkAHXDoVjo)rt}C
z3V7*P4B>FHh!2zbT<1serHX$rzixY(f5D{N&Re{1aUdXpX>Wo>$YGq@qjUZ^WNc3B
zJn|Xv;SQWXc1s<HeDciY+oyO`48((nkNBC6?Xz8aLg$)g$=!R`l@?!Ty3(Wtcke7R
z-Px=XLa|xfbt=YnR@@W_IwxX;9}k&^Gy;J*iaFS@9lS@RiP3)W+S-49lltNmv={4p
z?-gzw!>EE8QpO8G{A>#m#Cnq+Ba&cPA5uyk3L^k4?_9?aJq{%ba1e&x*>tckK>M(E
zlvs*ugzN+Zan?adOwobScFs3z>^qATeVWUBVb(TVDPQRT$0kE3FbWTT;mEw3cWC3T
za3^FKB2mfcrE_&3_>O<AsrT4Zn8`H9B(<=Y-W9vbA)j`-l}`IE29Y#50HmpTn%}k#
zgHt(ZUJI7Hy7$Unyk{Nysxqx?Z@_8o_kkkie5@}Pv_);+5<uS26r3VsK_vi}81a(;
zkV0Nc9bqnDAL<xt1gd6N2G}JC1y6wM)`><sI5rk1Rp`*0JY0Wxs0_VuKwDd&MFHR;
zM$2DdM&qJ+K|offOK3faD@k}y2<^sBtvI+i#9$lnm@<STIV$SGfKha_qt5d+eY%Jo
z(lgYxRqk!y`}2)j0+cR`?L%lDp>-kY;gD8kv~82m<J>@n6A2#qJ#EZFl`s`JX|o;q
z1g>HJxP2gyiv@qc5XBb()c6eJjl7ufp7#|4&3<9rs8~h2CyatNdecm)puG1`8E|0N
z{?OI7b}P1h_<=jqUo_ZP?OUj<$lk2v8?{_r)L-GE<eB4LU|)=)&Uu+16jT7;Sk6cQ
z<p^geI#U@%V>x-#Id5YN4g0+`8!NVbeMRZ=x^@v?hG~C_<v(oIa8p*@W7pQ@v>A<c
zdTO{ADb-W3Ep)$(7D)Cp9p@$xN9-$qRp(PpbvCgsLN9mjO0pmvavtQ=EX<XfYTbaT
z4cb^OLH#$?T48cu7|Y|_K1aY4z`0%yf$xqOTbew{08SuJnkvo|L!cmfQk7+H2jXCi
zfB<7aoWF_*04C6X<O47pF1HD4H8ze5wSu_<P0(sy<Mst=TpK+ZNi();{}yTJ5$trc
z!YJ55hL6pPqXK`kqE@@IjzcvO``0_WM0QBvE+Es!gaBA(YPaubz?o_C1f6Z0Dqi8c
zjP!GbQ89@K6P%EsVK5BYZa>>}4lG%2R-Q_%E7=<Bbk>1?4}s+ZwZOkj3-D{P9+sPy
zTP?V1rJV-mjJse{ri`xMxK!(<d{^{tnDUB=#3E%a@~YyPVx|nfGc0DreQBL*{7*O8
z2(5G6xNz%c9GoAlGQiC_nx0NM{&W8u!CK&3&amAB%-)K+SFkcfnMpFWX1+XZ$<=E@
z<A*XhY(z?bHTkMJwKIlS6$o4C*gmyR?RI5uUpf^4dOK7|`nIAUkJeXM)J*yB1ZRUA
zh=)5nUBSucK&4{4&6zFAvqZLj@0wkjp5~j>q03?B60ym!@Uc#<z0rvO`uG13$|;^K
zl5Llv*1I+^khNM+O^?h;UKF-?id6x4K;NmZ0s`QFwQk{f8$*Mb)rpZixHjN40iM&K
z;9X>66^d|?5ni4WbA6FnDB(CvuJ9^xsxV6lqPO)~t5Gzpe^EUebq~Ai@K4<J;l5L!
z6}?5J+3(u+zjOV+0_&|0jqxk!|95u&@Mx#*|NHRa@B07Ws{a3o$*5;JpO_>w3bPr2
zg<5rg#V;yLddK}2UVMpVf)v_z4=*9j(QTB;BZ;j^0U){}s|dM?@xd&{UeroqWatEL
zD|84`o$y&~CQg}=*5+!KL@rvWiT~MQmy8Df`-l@3^eD4Rb1}4p^foMv?|QM!vgAs~
z7d@MlbJ@&;OZ)$>4SyT${|66tYWBa~M~@zV{l5QytNZ_-@zPR<NW0hXV=WXD$2Uy?
zJjfRL3^(3tY&MEWE0UW-WgL~=wTvXmOt%(pXH)N?p4iz8sW-0*qa)~gATYYei9s;b
zZoo<wYMizkME1EjGq}G(Mc$WAo!c)kX()#+1mywbJ*I)+z9TyU@p&;v_BVjqgy<E2
zk$7C2$16G3@8~ULwlEx$D7Ijfgzx^HG`XHGw{2b3De+*Wix_M1C4n5ed2^p1K0OwF
z5lS-~ClIAcj>k4$$d<}sS*lF92ibDhFk%!`k54NWVD6O9ok5=FsR9v~u)xStJXa9j
zVFYSB#*iKe!sP)eH`JFpTp*eT^Lx90iU0;;wN8vF-?0{Hxc^uHvQAg1d=j|an!;#@
zJbneC(^3$}g><^usfN>_7G2eRB$Qk*nu^q<w5CFJ;IvwiMkF+6NWW0IjqU5g-SmVB
z+1_K}GWo(r0v7vEvE!cqfIjr?>J9?!_j|$Lll*V-AMaQWSR?;G`s!g#{{QNK!5@A<
z|9`9JzddUhoCgjVkB37>zjP5Hj){)Nj}L;I`wTImZt67D&>=iX3Qo=^Nd-;_juEJl
z_!b;2bQ`G1C6U$7AP}`4!(BuK4n>tO4}s5H%gq#w(L-MSbr@r5|5px;Uqk-?>fwW(
zum8~C|F`@5{{OA+e;;V5BC}h6srv|JY9~X_q#*&BW#4!7j}TxLAl-J|Y~^qWFt&hg
zuWqk<z=O6jf-q>Pu-_MpG*#I|8YO;s_39-TwI71e*w_y+o`FCK9zVd*$hU=1QO&je
zoD~EE@da(LFZ|C*l{%G}!vv@7;N`LXk|2qw;j{CiK88A^7xuAB2=b19L$@AxNlt&<
z#XywDT`^M<B+$p=y7;I-QzSq?54Q4gS9pkpkGsC>++%>Tq*|^EP~N(4Ubn2auR9@h
zt6pB+1`ADBJX5)}zgKN$-ID&k@Q&>Iz`u3L+V%Pbd<HI6h%iX@(^H#Fk|o+x3*PB8
zEqH--0Kzvp!SKGr*Bg6(DbX=UTyUC62-Yy1+W@d}B5)j_a2IE40OM~GUr@^1>P~aV
z%?*av<rbb`4g~4j;ORwq<vbbRYk~7&dzXS*V+}=W?G|O4=bS7~&y)CQp5{vm+o~9x
zHu9{cdSKh14xhgmes^;4{j;OzuZAy9hObYLPL7{{_hR_^<al_0awPUe|1VpQKMC%i
z{gl2toLv88e){Rt^KE?ek6VvFIos*|@u2se>`l+#J-FW9KKo&Ie)cM-|G!Mn&rZ$x
z;HUmieJJ~v{^L*2@Bj1m*5koXXT_I;;QY&<&bJ;920w*gZa;pH<)EQ|9{l6^m+m=y
zcGiD<e)bpY#Qp7m$Dj2Vb~Lrw+{j}%1>eOi9&9uj9OJWQT2H<^9RBeS5B_O*a&-FQ
z^~vGU@c7Bm^H;~;9Uq;z8O4a5ZJHPw?oa1mZg0`>;13*}wsn5@;^f=oCr^%^V^0oW
zJUJS^d~y8z71vi<n_^0ipa1#b>G6}{%cGM+7}3%5!xv9~j-P+eUo|YB_wCC+KN=pq
ze)YqPljB$aX8XNj)x4$n;l=5z;lcAK!<R2kY#0A>_Lsr=mrxW7dKd+94i13NllZ_)
zv_4Ei^%BI`GBkr1l{uM7U<8mIx*;?Z!r-=Ckziu0JIJ?owjnNPXB$G69{iyi63Ky4
zc~+0BEXOQ=g6*~xv^bLnw&EoJ0T%VZYM-~99@>vvER@p)_UAu#5FerG)jxN(8-nn-
z4`tl!;&aTJYJSxDY^!tDSV3)d15jjnJ#Gko{-mjY1L}Hp#p~6Ta6Y{0dY$Pe5RL+f
zQtYqWQGt4^CJs=<PKN{BsvS~hVNyMTw3_`mc@1)ZA2`K8zLA)W^=1HB&5qutpF+(p
z`4BxjdaEWFz9-&Oyg6WVMS2{BL2mX$ZYHAFixY6c6Y?Tcc%o?oQ1LP4-OH4m%s~GZ
zh;N~D;z95**!>!CH9?z)quB;z{}}YJJ!}MSVqFNgMPOHoAGlP`c@~6~Q<PJ_K*wI-
zP9R->F}5zFcHJvOd^Q5ntl%`Xs1DD=eX@ehw0*L6*L!6@Y1?1LNX{OdbA<dRn+0yl
zb#Sx{Kqg)6dx@NU2p=j4X!3b7Ng@g)r1(pKxvApHL)lqka=cR$CQVx@X=YSgTM0<R
zh4ri~1wqJHkWPq7m81MILEGvXy1v)HfB&9;xDOfUq9yD-0eerJvS;;IUl?(vqNqm+
zhhCo?3rq@6hpU&P8S1bgEY|zNdE04sl_HfgW}qfLK8B`doIo#H2KU7Mel2J^RGGe1
zFRdHj3D^6Kz42aW(UxtixV3#Ki)pBF?{_xS%w~WEH?tamai|;s4HMfOt`8mHkbOsg
zm<=?=8O_IZwLQhWpe}XzG?N!->VZ%v*i#5-%*5M-is6niu`foSz4O@4?)mkg-!DCS
zaDF}V@oH>%%}bfjUS$8nL$BcvzGBuzA4Q6g4!xrF3W`Inv3A(^{f<9@<r-~Um0S!B
zb(JKE{^K%xUE9sTM0%pOcAJEW(P!^}+_YZzgMy(@^1xo*LHDzFUV|{l$fz3lQ}9&*
zsL2Wp>l;p)(qErE6;R+(M(C-~#9wC890C8SahPMSYRg6U*f(95VckBdfNfP@<4V=4
zu>&Lao0ER(rLaH~J@7TWgv{Uxy1C^Eq(=oEs-6^+Q6Qo=jLqIZZPwT4SmP6aPSd-z
zJhW+q*4x>aXq&ck<-_epAPGqHMxKzss|>~_7MU06%T5_(0@~xae%qD6?f*~8xOfeG
zruNO9cI=Z|5zPnmsc=Hq29<%GCQJ^~a4`l*SKBVQE)2P%uqXxDWB00)-dLAE?>C;$
z=7yVQx3-#1o!S049VpcVSHy0A^Hf}W;7~OC-yXa={9$<b;`u3v#;30izCU_0JbM1>
z<lly;FTQ&<JUn<Q_QgN#ZT!`b2Pe-#xPJA+$<gT#FP=UT`{Gffk8a-qd_R5q%<5ac
z7&*%oYr!s18QYnhKP$)1fc&{v3T2EzS2s~M5oM7}9NavhrckAsnn;R&g9P`3NK3QI
zC0AICuQ7%qj%uE{q$%{m{d#sNy(IQsbw`2t7J!~9^pC<2A?Z4*7(tTeFlT~v#AqoS
zQsU)ba_-D#kFiO}H1NZV*H52_6rBocA(rTUGgA&^-4C=Z$4=UeXGIK9ExNt}KVJ34
z_JrvvreyXOc?)!?E<DnIhG5AFx?|gXzkHZ%2jV4-21Q9s+K%|z#R|5qJT9t@@V<c#
zvKaIenv>^pu2zozMKx>{Lk>9!vmZGci08_Vz~o6LFH|p*OUT|H$%z6SaBv_RkrO$F
zw5q9GMEQ_sXSBTsTq809f)(MU9sS7-{~Ph2|JP2Vcs?THDbf>vgLwyJjZBe!w$im*
zPgIf}^Ryp_2QcR==juu0)`O|4kZTb#SZLR)6urucUOZP<c5m2?!FM6{$Oq<uIRGGT
zpjtJMl9J&qre%G!?%f36);DKcoa_pU-Y~WmqEWmmSBJR2R9TNR36l>1Br5;@=#}VS
z?)J&1HF5y`cvp*mOX1bT<fBMsn8Q(0mP6p(wN+x6L=2=K8<1q;obopY6_zG6a>#^f
zY6~+P%Qq_AZrmrhO`CTLdM#MzXm$>S(L(Y7+SC4SHY>Mt*H$zs@>7I(1C|upiJZig
zBF=H!utm@^>hCFG^?xIZYo{<~J~EYK9qD}eT_i8=X1F$g=lI%SIg-~_#eFRdaDWvR
zHB5kQ9w9pL`?a(1GE*lm2?bgFDHF&Yt$zV~)@0$U;iJ*wuP%y+EkhND=oy6JibLxY
zP(;baNvu|e-g{7=9j|rxv%Q72^Le5G1oToyr;w)YZYB}%7Jb}-@%+I<gkxdTDxl5b
z@!5_&;Kj&)74^*Y#SBm$&2X&1VhD9YPI>>)${JC`^hne~v$xMW3<a9OFX0#L)Y@4k
z)YfNk9sCgw=Zz*7?=&l!6F7k7>q0g0oF9_&$ZE=jb7M1<graMkfh5T60$n>+)K;0j
z#>nd=iPnu_UF>y&DTzAJp&N!+mqN@JnI3o^9>wN=R&VngMGzOOgF9Ef%_%gTmUca5
zp_l=O3n=+MXumQdX7dC$qy0en4Oj}`jvt2~+`+=0yp|oW8p;avA{<XwbT&ACQQ)|P
zL5T~hX!B|357zb&+?RaJ_d7Zf%UJFWo>sRJo^FGc<K1-!Yp!D54THEXfWHfwZ=|30
z;Q2CtnE$&KEX`umuY@yTocR@59r@->AaIOy)|)uV&|VMbGDTpkfHTwb2bVjT=n9g(
z6Sxf7_r!=kJHt+%@8e-d+LH`cyYl`lNnM$-nkF`kD8kfS+$m8(^r$6#T+e&!5%#-x
z5Mf^h(_gh9gr>i$M87Y-O(23N?6KY~N%Nk6jsr2msU3;``hWj7X+J1d>e<1+Ir9t5
zO+cTG{2I4Ld6LU$B))VQha)AkNGrs78}&zEq@~}t3k?x1k`MXY?-RG7$V~`d&C-S0
zvsbOY7=hGDedK#$Af6|=r$EFoGq1i;i64vt0SS@^PBiJMw`r7Qa378?Q&0)Yr~qz%
zp|ScR9ZJ1j(ZR`D3q{oiix4SD;wMI6P#NagBA$$J;EPD2$<Qcr$RA;b;^BBXggfjg
zaG&<%6(qrfxxZ5C4dNMPxp<bup<HeQT$v)D)0!GohG9=$Tx9CP!tC|Ni^&_6o1Tor
zUdV8aR#Wo*_a{f+AG|smet&ZC{Poj+gOlS|$494PUz~O3I$q>B8M9=O5gZ0&zVASf
z5H==>Noe?aAu|?#mr7=xbEk;09l1;X|98mLkq>RiOIPq@k3?28-DV0~#JYv7PHa|l
zRJ2rHgMvP#Yz4?-r%5)}VW?t}fXd@a8&zeNv|Cz;r;)EZC0zqw1wVLl>p(q!l+D^L
zLOthv<T@6YyMv<RBk@09oYaQtSNO{JD`8egM+{jbq9wF|2_FfEu`uPKG0v;awz7JC
zOMO|rdf#LAbb>wscjp9jZM2@K%HsV>j8r<E2%zbxzC+I>q6@^cMZREH=}ELOU<RfU
zxyf?tZ{VRLu~EwrxN50B><FBH!`*)3vs;`5yoxVS?wxClH=WD3bO~7y6g;x5)mQ0F
zk5HJp;V((NW{r*yo*&R^Kv_yQ3=5UaQ*bY@ZXsGSF@~d8LK2feJRwCR!qbdizd9W4
zS!XA<A5CTnJGQIo6j<0LHFm>gX%Nt9p4ZCfuhS@z;kQvTzI*n}Ja^rHbssJVggN;U
zu2ZFCAc($euUAFGYbOb&rx7dimh&@?lJN#pGY2xIPOUCjhqr<j%3EV5A3S_irFZA#
z-ucU!>`ixie>{Kp=<DmxZq5{p{zVPP%bc#0ju-5-@`9C^TRcIyVAyf|%{4(>f+uIa
zjv8+ptO3891&or5q*eQWvWfaNO(H#6wkvQF)B3LI`SqG9C}o{`f(bd?L^KD#lr#*k
zY(w-+V-u%%*jj&~yP0zYDYclHPOscJMNTd4Kp2PC?`i065#DwI)n5tU7LDH(48N5v
z;*AE$(Ue*!Z6m(U7rS(k#RIMK>40L?2I%27pxY6yC3gfd8mkI_#kr1;slwgH-Aamq
z#?4wvTfcf>2+N!`zC!n)#<Vauo`{ucYVL60*yS`+!y;$+kX$8(Y@=@J>KY5rU3ZXE
zM_FQbx|9aR_9`9Go%V{erPD$~PNq#3*vfd}GM0114(T*bzh^&c+O@02z7HMU!ps1n
zzJ}Nd+KiQ(qckOdD@&G*VH*_j?PWLFNhOQj2To4?h;}79#2378I?YVQFR{@?mp)j#
z8)~IjQE5ZfD>y-|^hT`C|Ej#A?QdGv+W%nXiR2e-J|+DUjYkz1Sm{tQ@+W>|{Q%K%
z3bN4Pk#95M70O?HABf9cPOgCdALReW5YD4Wy#;;ZFtcWVUsCgqoN3m3q2A`C55VyG
z6{bAMGca9%=ehR{CL53;`jY4j0~H{18PsHh0Azt(I$q4vz!^_rc!%B$+==ycwj5`u
zaNq%cBzX8qmKZa%7pRqn+OmzJEG}*EnRTrxlmwfp1q!W_Ws&PoG|nM(>$XTU)Hq>{
zhZxhT?=`T0{$Q%};0MhGT6l4bIhoU=&?fUcsoth4(+J2CZPvS+Eb$7XcEL+-ZqcrB
zfWM!8@S7s&31Mb8($~gQxY<-z{c4=%0sLy(HbKdQ#zApcyk%B>yvgmY`h!-%q1~}1
zX{iieG|W_l5ihM>XnEYc4Z6a4>X3tub=fKUQr#+l>$c1)W)SN%Rk_)atp5%+ef@a<
z@3ZTj*}~lFV>UloUHN95<EESj(O)nlk19FFEp$XmIKXJ+d_I)4Y@_2OlJUhtUZ~+%
zOY<u;qd3Xcro%64)`TFm`DYuj0j~89H@H0`$6zMX@x_Le{2}KF+@GRNCkEk_hKShj
zvsiS0Ci{CitSEvUlkae<mDZxS>c!1^<IDka@<zqs(8em=l!EVs>D&<$s#UXz{i5yX
zM)cRP1`xWmft}?BTfAwjSC^06B0?2WyoOy9j^6MmwT(M$$|W}FY*jp~yF33@WVN*&
zzH{M>U0^+i@i&y${+{l7wQ4&}N~_|f?R(RI%LWydd*=&oP4B%Ur?Fk0;-+`i)3m7!
zZ{qq3e^WQTEpPIsBEERp*t9*hn_hZ?Tjlkw(si|FNTsNM&a6hR5o1*g{>=<Hdjfha
zqPl|u4Wq_HtQ3XT%4v?CH!`$gf~&Hu6$l03zcY@K$s3LuBWRb90Pt+g7fu5x`!qm*
zYQzvw7G`?tat&W9F;+8qsUZdPsj{e=HJ>@K$eLNN0Nj_U22VMfgq~4yZu;<r>9>LM
z_aMGP!@w4q!m`0UbRj~O$bUD#Kfv_fm5G#H?LN{)$|<ZZ#^(pdLDcHI#VwLt1>#U=
zHgn{f7%AUXbU03u9Lxpj+Rv;Xi5YHxde36rZjlLmV`VDkL`{=uIn_~Qv&R{WNB{@d
z&~<1{UBn~D(yU!9iV59#cm~6XJ~E|kD!P$pr8iTUSL0@Pe)LBka^A{2p=-Q37qw!B
z+f^OCjS>YvEQoTWt+~puSD^yma#WC#|FmU8`9-RGwDfs>WBIRJ$G6sE)xvjw4=%_V
zh?wsk@!jxJn<QJV5OkwxZibLhWSGBgw*O*@wwK_nHlHi-=^suba#y#4F&HPwJErXM
z^+rcgV`cbeIFY%Gl8Y53Y<g$Ep<a_`MuRVxof6yvt~Tp;=MSYQ!98*hFqD#K#r<yQ
zaCPwe0XGlp0H``WKOuV(W8xM-bp8eLqQE$CA@XQ}M58DExd{x_h_bf3F!oTTQL?1`
zGBU>eJjDJ*OJ9tfs%R;;q@NO*0b9mdas_~7Nv1D!lMh@Le>B$pSzW4_lRwYLnlrF7
zE(+BRm?q*<W=2Fxz7aa!20=_4u=mDE+=~ei?NWIu$*k;#S%{v$cqJr3QyoGW4pRk8
z1Z4m8k}lIckj41q==2rfsU?KAc8^l=B9N5@OkwD7kT7{wMU;RHN`L`0pD1*q1AH;F
zHnU_BUnDruf6I76S&(#2@*}6O8TIFrbVMV~y)L?3^@wMPDQ#AXk`R8;KzF^ON4F9r
zeX{mRh?8{pcz#4!lHA$s4*4Yzyn~Sr>U-e1TbHqt5G(_9u0ods96=-~kAz(jN(&Cv
zP32reC=f#pg67zgyAhWr0EIfBFyslZ)?9^}fI=Wy5vRN)zko&TL?m!nx3hyA>oSut
zT^fJf?PHsL9?8gePjES)FaRRq<mR}Q92O8KE5a?Dc++dA!PS9qi%1&x2$R1~7d|~y
z7A|NzvM{_3&#goH;@}R!C2-}|svHYw0OGf2&KVd2)}yF%-UQ9C&YxT6i;{u8q@E!m
znCOJj7-HYtv<mhii#F+MQy?_X23tJx1$loO6KDZ+AdBb(gW+{<EPB+|@st++j)ag}
zCi$BY(yEA3xAhyPh4~~M(rOXs7*deUO2uE@Wu0np{!7rkA@7W`Tmu5N|Dofe!!j4$
z%+<UYo0HaY(c8v^ar-pYA3^~y9RK~*L{K<CPT8SXd?`*&i{L0a`ic9~p<-sqA_{*A
zQ3ru=7?Tr^{vs}_?2tx6Mk9?tDx~_E<sT|vG6nZ&4+@qBgAz2fM-+pbZm{Z1F!oud
zP;W0I;qER@)CfMnB^*R8a5o>jkRr3j)p~QUY#ZE$X)ZY6XgT1cl?awH`hi$w&%It6
zNq~5A12!n+`f;=*|JWG0e5U3BMF4-;VBKejkdtyQEwO-WT^7rzM^2Ln{Th4_W3YrG
zWD1_2G7>YH!bu7NfKsp^+%M8EA_mjjoDf_kxzUPLn%pB(<}F;~5YLA;k9P9StlCYm
zh7uoQ@w8;?B%yEUv9eZO%m=v>+l|{s902$FhlhWBz>yHWP(d8Dn8`SdltX{SLsk%$
zWl2XIf!7#_Uf3yE-i?)iK%_92JvE)`36cjX7chjK012^CCsC2~hG{pAO&*H0=GR#y
zsRW6=qOKV2`L_XM*;wj<7otgLlKWKx?k{u)_LGi1U38|VkdMb_1l%CkvUZ!EoO%M|
zm-Y(MgDXe_m#L}Xn(pQmjmUp({mlU)E|NO#S%(dnY>jz8@iIh{Rd7dbN*6Y~dX?72
zUEb_gEQR@7PQfJU#ox;;Mt6qW>8lDwgXgYITho8Ut(07)8_q8Oy#w_1p4A!2t-Q3`
zJ;T>~(YI~KlGdzUiPu8Et8{Mbb$~0RrHT`M!Cfm#z>>UoOWocb2b_O3&_`SNO~d~B
zz^D|S$eTxiP+qgU43H^@AGLYHR|CUPkaxUqu$d;dQVF;S4cDBSSkSdIL~G?>GkaU5
z68{EL=tl-O5#!fIasdf#V5B1CZ52(21pd6S<!A+D_h3aLtX2`|CNW+lBDp}Wj~cVJ
zQUG%JXzL<zSDh<O+`oTR@w%g=6hPFro7YD>F~!shHd4n5cDt(4$~N0180avG!X5$A
z6!Hz_6BMswR2_m74M9V*N<E3;+67uOynA9&6V%O$T*sWF7DP8vy~gToE@nyk!B%@d
zEgS<lhF+Facz<v_xQ^eLkLA7W3}l-cLu*`fv(HE}*t9fQM23H85xMyn!)CR?jcu+Q
z*hlMnrpkGNG+Tww+SGi+B-{1D;emF6zLTVM$0&?LEp-7zK3RYY^G_g7K>=-LT)#eY
zj471+t9)v@_No!u%{6h`*RK=$3@UEfU|503IdZ@uT(2m(D%9kj8t3)N)8Hc>tA(;J
zQ<r*^vvlLr01JO7QOOy;`HtY71pH_nNLaJ(5n3zNW^JU%Pv}i`xNDV;Pbk!y!qZPY
zl|ngp>xT-*X&Pz1hHT>Edjn`<F4~5F;l;1s9wTujfX5nej!cn>6$<!W@KWuzwri1p
zKD7U<;hRf9b}PlOHlUH~+Y{Mco~t)SzSiN8lv+cXZ-{?GQzOpJOkBSc>4y?&D`LSK
znp}rJ?$f{;9P$ci`DSRlvCj2J;HORC0xegrRy3avyI$da;B61Rd`vP$2-nVFlRQPu
zb+F2<m(M_lnndC1%4+G0nspJhUYzG(&;;((y*c|Z6BWx$Cu@qXqrk>Ryg6CjB?m2c
zsm<`A-ll)(ji}=rL=IWx4&1A)xMF~D1mrMC$<ZFX9sp)?@WBXoUi<aQXH$JKu(iv8
z(&rP@;FdPnO}6=3u>4I3awV1BeiU~}RUR(Yx~+99(!yI61q5&U3FPbCs6&@3(^D(D
zwjH0<Lc=1>!TM9lNA1ESBHS~KF{)JD^vpF@q2PZmjT|QCCUk&CxH~<pHs-50pp!yk
z`e1~#Hn@6%3+#&O0&Tv#N?Qt2Q~wR;c9ThkGD9M-^$M2e6)3aS8WNo^XKu1L$_r6n
z0lf1TRoX&s5E~?VK$Gp?aABI~kxj{@k*!Rj_vVHNLwP#OZQO{mUjS*Zn6xBTFQx-=
zwvvCZbT`=`-S#Cq_qQ6lm~)vsm58w7^|QU=@LGMFqzgxN{l7&Ez)F{SuVcl<#jfoQ
zB$*!)&{;m4q<`btBjVfy0(ip>@bPBXcJ)U4q;X#DMrozr?#lJ?x4^OQ3vj2r>^7{1
zW^Ud5RQh}a(px7xOGL+BWB=TkNvpT1uj+rX`?yipgTyiLp>S_b<2t7P4>$9Tu6v@j
z<CK4aVHT7c*Eml#Ftb@pEC7+)U=)MdKG4l1TuhX=80<QS#zHVCpo>ThF8b_GW5gDr
zm)p1xuzDEs{z&EIjl58u?LZvVK=;v~C{q)qFEM<hGCIz(t8)<o8aic1og^2r{zZR@
zXRl9Ru^TEhPJNU{EMhB}sE~ZgqKI?qBGR8t6|7?l4EW;akk*?i1#Sd9pUH{3`Sp)T
zXEQ~@0sAK1E!)3~EpU7JhU7xWy7A$9&~`|4_wlFX<Jf#>Itqu_!diI3dv}UnvpI6j
zrpw+44Z_YF>#=ce4Z(AB7@mg2GPi$2p4lur+^Qeq`M3Li18g6Ehv{$~3e8QBXx4OK
z#jCbm&t5ny`nXBo)`D{G-W4e4O}7OfoEu=|aLEnpUJ;(|bC;6v3+UW@ju*cU^=-iY
zHt+1MkA+Gf-3hVL!9c!n&t;Y+S9cbK<MQcka3<9G(Z)#bYY6k^PBNTEag%>;ukYRF
zpar*vvfl`{eD(SlG64i5-12fI<0anpTo2xr#Wrk1h1MYxU5%6}UoPHN)74CMHfIlW
zHI&u6NV&Lk8(}go%JL?#x6ya4mJ|4*vEMSnoiDD>*Z6_hvg=l^Wjd-<V7pu+`HdAY
z#Rq<V8%S>R<!7BuP_k|*aJ7H-{DVeuCnIVBh+1<z-t6={Z#LN0DY|XNn{M`=Hw&DL
zz~y%_Iyi1}Y&man7WNF4Yc6t?4Ye6lY(G&Nh5jXm+7HUBxwZ5DY`6Evb6nN?+n;rA
z!^gdA=-TtNJ)1K^(%cDy{JUa5dYETYgG<7YZP0b6_8XES4%N}*4ikSS{C7J2IP`fZ
zD@<$pQS)NGb5rSg9C<nJqX?$Mp9SlEWxs27Hd<MQ?-O<N4miJ~n}2$X&u+3tcWS_L
zt~1S)-%1+|V_D^)vx(ZjlB%WJrH14|t8xUj<`z2tP*0PJd9u>&4NQ{6LURa-sNr_l
ziT8ACL9u{AW<P73|4M%wwFsY<w(d1cI(MYK3iX9D8$-8k7!tMSPD^dFH-+yfeS_ok
z?_e^JV$BTv<?}q#;{~bse^rp|o2#x0Bp2tm5wpQQ{1CWao3ay;Sndvb*SXtUP>bcq
znc;?c!MKVcnJJQtqP>7xah^6pFuv=_xa;lLNWrBb2RG|~hr53jti&lmIM{HDp|f^v
zx+#9&@c+Nv@a?7;+wO3zIeEi}PWW9+cdc6=W%loe!>rhugslIoGNAJoN&PUAdT#zE
zQWv0V>U^%&n+!K6y$`jI;N2+JKQ9zlQ#g67SoT$>i(-(sIWj5&bbT$GbRP#<uBY;@
za)1AS?7i!f+%|ufE;_&U6o`t6aMg5PN^Z5MTWa@2St{F_BTE{U+&y!AG)ZI<nMoIu
zNE2jLrQM3yzs>{f*iSf5vSY0UfZ(0XWJ<ETI%3AEBng7Rx?x?urSp*VdB>h{00AS2
zQb~|=8WlKIE#+HvJ`J1KV%!%EHB65yj+&*@+yd$PaV>wXms94b0IN$W)i#Z{QgzD`
zHuvTdV7h`5Qt#@SjXu<zxb$`RNqq!+Tz!;tF|l<oZD=j3MCT<i@$kAC;pLK-(gApQ
z+<X8mIgp0QTd1`hnpk+RaH7>A6|jF3;{+VXxCWD(hbLWH*gBk;!*ZzNsT^1hB~_Jv
z(M;lA$e4d2-v>7%_^RI>;x3|3xCETPrYSOq<5Qr<+_e(8MVY8_SJUF|oaB)y-t~{V
zeIkOjnKkR9Rv7|Hb3~`UK(dPf-b0@97^u;W!1s|tzuMqObvM`As9i5pzun9qRIlgk
zy1p7X_w_)nkM|2Y_R-5#&+Vb3i-)%T^mTreuDX9acih@jk5}cmb=2wQNB7e2ji=!H
z22KqMF?UOyrpw(#kSaA7Ym{H*J=KaZcWZ-EEZkRCkhvQglx6<DqT;N$TBAf8g78hp
z>i2!Yv3`p--W;^dcwkGfCO@aq)~hk;iaNK#vdXe_O4rn}O|5~8fK1e#w!sa3wjZEJ
z?WQPTg#l(?)*1H)DW;`dq+{g0DkVQZD=a{-nJD(sg~^Z;%E^6bj~mL9OKKc{kL<|b
zlWO+J$!K$2HjqUHHGK34$bk!I^1bMB;e#&J15_K%N6G$bF@ui3v$e}`*tX~W&I=j)
z!{Acn%O0NEKcD-xjqqkcr2AYtkI4AB{`I+k5eB?;IDwQ6kUI_YEUbaM1B7GV27;>Z
z${m@jPFXq=M&mwZAFb0~;GkN6I*k*~U+d7~Zp)#=)&8H_R!UX|HjI%Ticp3x<O&;g
z&UcAmp@>$=n#m=hd(#u2DYi&suwR%*zs!DAGV&(uRTSnh2e)#YhTOq9r1R{Uo*EP2
z4L15@rwIBvnM|g1QB8jd{P*4&`=9^yf7~I%KqVG%N-<wz`5(X<?r4sGm{UJt7jw`k
zBi;4NJNHHirsxipMjOEu!Y1bWrs?mQ!3wAzXW>%wz&_A^CX(s4^=nY{xI`}kl?+-k
zJDE&i%**ITgmSCLJay&9nR6t~z8uT3Bcaq|_O<zE1$_Kd+XYtWHz499K~p|va+{2U
zh<OW{Mu|5ve`C7}K!v@34I*FOdhUp)ULq47dhB<QN{B;yg2&KVDw*-bn|eTg^zSoj
z;iZx|#Xed2P8J$`N_kNG3WqU-pa;ytAPIK>a*4f8a9M8z^I+l=JtOL53r%NT+6Smx
zWE^3G_PRM1UnDH%$(kx%BNhh;=$S@0JPdrzFS*&(Z>Kk5S6i`vc<kO@fqQEZV#e@I
z61sJ%@Mb#>e8EHATr59AuU2Cdx9<~w%m7!txc>mpJInQcY?fEKo=m-12~-CBcg^7l
z7q{ozUFbHrgTo%d*5M{OXs$d$*Ix)3J<zX@Cu=5D5^Qu^Ipm2rSg=zuSxp#c%M_N{
z9rN4WR>Uvl>V;f?X>P&p>_N0hyff;Fk=0x;Ln&hbixqc3cfbO%z&>laY2vqdll&>_
z4rkS(JyGCxb$C%bQ;f=^pvBqukg-t61wGyJjm;;M$;CI{yt(}5;_c<^n>QCPzkhM@
z=K0&_mscYObLi;0U&S)r&gQ$WAA`WZS|C7g>G3>WT#H11mvv2;2akAIY!00evHdj9
zXiYIC-Lb?SZsLk<`7V^)SCGZAqq6!Wn1@0mTQ_q$G>x-;oyX3!)R;&9*bqwTqi1ky
z*DuG1KAP*iFVW;GWkv1wZsr8&;9xs6hQqtLPEW4Ijtu-XD?&e-D-V0X<I?auje>T5
zKI)2zMv^CgAC5?Mqq7v-5pM`qY{T#DH(A-!9HJ=OpAIV&jnJ!f1G*E(r|z6YaZ^po
zp!y;Li=Xe9hhObwZCOFkg58&EH$y`R-&&6hEm}a87d|`vS;SIH=rGi;W6L0U!qC4P
zC2XE1?A#p^g({f{<`_#YDiOaTlG>V7>{bBaMl82~Tj8Hg*egBFrHu3TsF|TFB=%r>
z38uw3mSLD~v-O7`d&}E4n--}u*ofKBGU_Zn5Wd5`xsvyKbYaYNzc!$$3u8<*0F^qY
z)hM{akp?%h^?CLXxmleP)kSP}KD1Xnw(kKxpX%EC0PX&-%Q3_KU&z5{vPFw}pNL!@
z-?=S+?phXbni%T?mU$DXg9d9+H5nhc_{2w3Hsvpd(|Hdgy^RMgjr|7M5ctVIgu3iF
zCv6eseO*fVgkqrOUc}l^x!<cyy6+b3kLZ$bTs6e99U{Jl6lMF1wSz?5f#R+QOie#A
zxDQm#`&LAmrmW^egt<u}Fv~s5ta6>i@EeeS^w?hTYdAUER&l$pL%u2|$LF$yPV{rS
z7tt6Sg*x5ZmoUHtM&IzU5&#NJ9pJB_K`a{f@eN?%X^$VwZ$ywhx`cw9hN;2^qUb`I
z#$a<#LvaWG#;Fn;4xOu}j?tbIB<waw)-p|)*vy5Gp1#C%E!~QEjNStF?^my0GM)8*
zqxWDFL@&_)ZnNo&m8b<{)wDAlR8#7dR&)={dii=5X{==2?-`1N%nE||<9Hdcp%4%A
zt|s&<LI(=tVC2!Rdv2cY!%SPQV<L#I#7+|)uS9aD#U#63OC>bWA@o8Z*C3^h)D3OJ
zGuL7VaTB65d=~~^2wahlLkeEcRozg3-rv5xd~->2oBSEa_zU}z{h20UCV4G(fAN@~
z!Z)+^&Zi6}@IVI2b%z%Q$H_pSs%&l>9tBIG62poLARE1<j76}DX4hipJpsJOK(Uvv
z-og`gW8;iJ!`8FTEGO)ZmQ9oDy+(v9os@Gec7|xXCo%eB$<r{IWe%8bE|<c8^uOYZ
z>oIx!7>DB&IzPPX`FSG>d>N4v_|!u$tQ#H4X~JHLTMW7Z6<mG$>iZYZOvB^47gevC
zvps#53dL({P&QXq#P1GT*e+e93QP4`JAGutJd*xelz7;@3^Fp=Wt48T8=p{G0jt#L
zl6oc$Nk;^PT&h(|sv9W_8(Y<XLI1~f12Hy+_$$U&bvENHlF3XjuSXI9rHVGgnM@NE
z_|%XMZ>t}h5q2vHAV+%e5GZG-p<EN`^WE8#K2uC1Z0T1uJ&rNktV<j?!Rr^22!q7N
zlfH{YLsw10+5+J2i)7;x(I|}D%|c(;r0x+DEO>0AI<yPZZ7hEzPY7Fo@*so@kbB5B
zd<R+$Vn(2T>c-uGWf5CDV;&2B4Kl$76g0C>YTOV6FkF8;GODkh*eFS*YM(2vWb5An
zrLly%(WzuL)Jf32Sl*-gdBB-Ke(OLbGRB~CgxX3HgX+)Giklvqu;)pG#)~1-A=1FZ
zb63VkzV6AWGPOud*Pxt#iDLD7)(B_gx$U(CZ)-k}ED0Ik^4QNL7&gdKj3=3TbwgT(
zvAHHgoszNUAU;?Sf!;X@RJQz?p~Liw<5d3br20d1i_zzMjacubhFT75rV(T2f6h${
zgC&_giGNmVS_`j9JVjGH`tc55-Dq@o#iVS6v}--&RqxYBLo9ZGPIR9n^spOzd(84H
z+6O&2i+dkFh7Kd|KhTEX9rQS~-q`<f1)6TZ$9v)^R|ZtgD!Tv16|Ic6ekc@XI+*iC
zGNZHOJ}cDU=(ny<a<t5pfYhUX-i;0$JNHkHk&VT<$J$u2s{w)zXujD@x7tM9!)M%E
z(;moIW;L7D=Mg!7WjbZAwz@-xJxu5v0<xRlyn1oTPH)%2V$Ggjym`j1UZ7LMWUsaj
zzYM}qosD#S$IlK-){EkJ6PdV6L<E`SZNr{=s#taS1J38&<Zgy7IH3PDWSBkEGKk*n
z!Qy$Xqto}UFwJc#Ayop-CTDOM@)B{Ec-kGLt?wjALcv~ty?pUsl$8-As_hjpJ$T%%
zy0?vk4UczY9L$^86Bs6!;uei^TQhEZ1?KU=p)p9<)wdTfUZ6iJh?ZeW*>)&oMvR2j
z$TcCfU%8cdvcup=dvucBNIO$UEP#9ux+r5fSHyw1;h|1=UI_MO+xRDu%vK0HinIUu
z|Npn{@*XLFaA~kuMCcvDV~~u1q*fvlaj<BmO&*4Dz%iNEoOX4LC#Y2_RLv>Wva)Wd
zo^yWp6gx!5!v^q-oBsec)GiocN@cF5BShQKhW97zc`jjBp%+2F56G5-m&y?kZ3A2R
z(Lq3<BsimETP)Mnx@~Ye^G5z$-i<Mf+SgLRsfcBNsI1tjM|qV$yz`ioI8}R?r>SPo
zfO~{_zu;MZq$53cR~I2yioN&FCT#=Tj88ba8!7UbNhkHJ;L+ASirNOwwuoX*JYz?a
zG+9$4u6dm+;O4F)`zO{j4?UF}!ka>34pbbnb$~w4aHrkvZ9@~2Q`PJEHVzVWW@5e`
zkMNIwNr&L;{_NhdK?o5;;c%TdEb;W7XL2mkbdnT@?<w-`&`u0patib(&$9e4)z}~G
zBumU94Y1&0DB{nQ4vgA9T1vab0%hDpnHQV;ek_!tk_XCDnds)*)KP2;49BA#WUxDV
zX&zfcvLtXl)TJx%tD-ZUL)ez71yqd~PiGQ;2Ry{IW)a8m0w=SQAy%d@;&H^0Uv=d)
zaA+)?WH_s2vu<L1yA5}f!ZvEN`Wsr!Y>oOioamN>QI~9Ck&JV9YfERQ^P4TyOlkc3
z6TnZYh<8V7P~~Q{eqby`n{d+7E~n0~vfpCX`&fn<Z#vEDlprf;>YH?bU4G!04oszg
zTderVWgJ&2&79A{1I8DT&tpbu*Fm%*)nu&~wcsI-^&6W;4wBp?N@XjBEa%F2%fY1%
zEk3JZHU|Ay0}VxOWQQ0E{aS|)^?oprPfGM~rc(c6*L~wozQ%IzuS88iL#>0YYMfGb
zvZ$Yf1%_$94N{frU)GpWWr7W5x4mwE{98<+X-{^??;5uFZH_H=kJa!nYZ}nSDU~%@
z>vA_58E(!GwMcb3Np=_{*NnA1k_L)t9jXCNAbSJat}y96Kq0Jo_7TguehUfFd(@(J
zPmXTN@B0T%OC<n-=EF>u$YUyS5out0^KeSi{NF$lf4QL8q?c8Mkwc8qOEaH;T=7(p
z70ThAJ$r}L*!gr??W7Ax%4!4=&Bz_a{eOVHUy$|FDZ4aTBQy<t`Xe_I9@;{&;)@+a
zQ3fq^cHocJYEQ<BsdTY6*$ZG)y8P`uVb?-zZN7}Ic*kr45pM#e;HY-H4no09qZXas
zX2wIYHx|ofumBNiUyMg8#rO(;kC<vL)6my>ZIi>HPK<PFpfu~;!<89lD?`1l(X|4$
zZ=6P8a4ISj6n6k!$2Mu01lv$#?_-JBY!SYoNON6!QJcEGhWY*tm?4EDI=RMjd@y1J
zKc>$SL<(j{;3S@r8+`{N8vuH`a6JNhOkE>{HB9_UB!$_+gotsorr$1qiO}>NF1DTm
zXapYZs5(+7-q1iQ%hJ}5&!xZX`8{n-n=aC1{Vit24Ab&nduB|^f(x1Y6$%Pg+x@Q!
zv&<c?L8w6D&<<R;9^cG^6@ZsI&L)qcbH-wRWM#Tgy1Nny;fr{1vV4GtP?3BU%DI>M
zQZr|gPU(d#s!-0g>t-2$V8{Z29Wkj0P#+$kcbP|!lHz)MoJ7llTPxBsA1yQH2R{0O
zK;%7e#F%zd5zK<cF@bUj<1CAO1o3cQs#p+(K?FXi2ioba-?9Ms50S(>>(hc<zq=&n
zEC$>YaB*!X4C>#e<dk%J)<3Wg*q8@O^Bpa=&i>x9C6Az`J(O;L3hqw~-I;yL+*p_J
z+%T3uPT^RNq#GWD;8$*PXBMod3-e5~)6O||>+S=e57p#(p;3Nq>3apARGNt!p_K0S
z+-?>_dCR8Ttp-u7tHq5pIs+R0z}`DsJyNjpi4B`wZfW52R-Bnm`J|al%(C?K=mR!B
zF~N}iPlUUz&J^;01=YYK^|%mngfmsiMRc3l=blH&3iW|vpw$+A9ZNtH68;;(eH22<
z%AZH)=dd1m?f;x$k_-u-jI37%pMHgJ$V1LPI)7Lm=Q}VqqZR0qKo3c{uVg-S8~69+
zaWO!U#S+l0O$>fok10PY4}GQ6_+z67;RQ?36Kz9QFZbVnf@DpqAV_wFwVzBT6<cE_
z_orMjb$);9b#gC-3`xaCG2-Q7pa^uX@IkwI6#l8CYR@&<%o;W8KTFYe)u{d)mb}j@
zJ*=SKr<li~QTn@Y+bggXzYgVX7Y@Oj?GY;$KjQS9ci|1L!hdh<IEv6QaRc#Oh`*U(
zA)d`wm{u@<VHdUVU{1CX<ox)7TF4s_V^sJi;LO7`0TY@t`;>E5dTdJemh;;LCp2>>
zq`Wg03d|uQOf3xZX|qb-I2V{U1Z815Erosm<^@pW(@>`VB@C)`-oc1nB^-hs{`hZV
zzLxS@ja9G$Pk=AN;6}tdCYKLvnH|$n2=W$Ua1ttiVl?SuG$S9iAe6OUxM~k-;vR78
zjhKFZ{`nW<^FNF~|Kk`!Avy|Q-n((Ocbc5=%debUuCUm(VE!53##UgnuNk!vTX54L
zi`JaFX<??F@BVwHOIdQi8DL=ejZilW3Zh)wTAJ%~|20q62brqOU7lGRVtGDoH}_!6
zsmRoSS&a?sybfTC#ahAv2q;oU7~P(j0tjUbP_l<a0>jCr9!-;+sm;Jj1NDS?I!5Br
z_-^oi4AHkRun#?;G{OYRhTxQ?vq2`c^s%sbkcXZQvOvx;&Ig%K^?*FsJ(`JByK+CU
z3*8WNS9`ZlU1XO6m}B~Tt9UW*X0GNz(rDv<C0`)4URG%*mpaA7&^Q#vVm6aoj}@!{
z78C|jViAkvi7tkOf9C+i(7&vY`G5cb$y$^orf-fVN%{sJ8>DNu)^sxsph>B=&~Y;k
zPMV@ko%?Xprx{FRJHAaoXnc#K3GzARZGeNk)7*6Eu1S8mOiN8N8?|AsO-8%UZ~#ny
z39Y67GBtIkD5@W)=Yv_Iibi9F9~}zG^^u@Pp6)LgQ*<A-TkrmweX09vVW&IxqIimL
zDDB8s(%&70KN{T3-@bkO`ihCj$2v#ya^HeOKNbrC#-?LLvWJs%2U>WH<-3?<`})<@
zTVsnWrY%Z5(-?b`8GDnhb)7Er)=9E|eLS6F`{%V(3EBjvr71=ce1Wb<G{_5bHP7-7
z3fU<p&+_y0M}O??oc~bDy9Q$+cNm83z@*M7qF@kY4BDeWBFXJv{1pKo^{e4DX{+NW
zH9^zfZBhF<4BsE>c*!yNo(wl^F3A2$=@4B*ink?}RARz!zq@#9^uE#Er{3*<T8YK%
z&vUNC7mxk|MKD(hcr=t)q_Kc}>AWRiOaRPZj}YvoXb0>Q)jO8L>TuG*{Al<Br|I*k
zs7-PzqK)(rYrgm?YFNrM{UbEb))-x*&RJNU(5${kg?L0ICL&a=?P1bH8fb6$r&h_<
zq4C7PlVkXFOrt_QmeJi%X_5VZWlr>7!EAoYBXC4kj$lswg=ea1-@+|dX6XUnh*=k=
z{swB5(EMhRxMiAo|HUh?HO27YjtYBTD*_7^jL~0wK!(2aK(N^eKj4W#^B?`leZTJg
ze&jSPqjXtU01he(%nq`$A_*tAogTXdyeDdCu!mf9R;8ZDy9m1W)EN<f`EP}mTf^=E
z`8a#aY4cd~F&O8YTPS5lp^&r2vCjE?ZR7jLOaz!A!O@vYrwR(2Qvwp2q?sF*F2PSM
z7Ax@6Bf4Ikg2#S_`7tw0)Pdn>gbDjTa_*(<BD$m))I}LTcJ2AuI<;N*ctzkxXF_0<
zhiytxpzeX6ngB>{d@$R8(_~G+T#1Gi0_Z2Rpv-fZ)63Spa!I4&ntBzB>J0LPr5#tb
zB1%&F{BmHVv<WX|@-+mc@L6Xcs-jsgso6*t!)^%)P8Cx`KnmL|x3*{rWK+cn1&gWe
z%Hlg+hzC?bC+S~uO_NR_1w}p6k&4~(LNn5hNY)Z=`{wfPiQ6=P8O~5A)014oc<M@2
z6r!I~kjBhC|Ehuvd0!*oHc;L3n4Nqd<;iIwLw~FiXf}h#R3NFudXF*jOe1&2QYI7j
zlFmhI!EQwujuE5Do^eMMXUlRUJr_*V1ao#wrSXz4#7O5z#)4{x7)bn)O{9s_C?fPJ
z(~HD3JcD*Rn2t4nhZa-ZBwIm?7`B$%+WIb+MrjI<q4_K9vU4fnD+Pkl)=9m~$<ADR
z7SQJxS2_vLfnajJ6?^+gEI=nzK`9eDz;mWH=v~h@sEV$^Vb4xsfoHhDvs@<COm7G%
z!?Owdo3Q-MxI2=mU&%^I1K)yBU0j(ZFujSg)<QU1oa@AYwc$Yo5L8h4`S9^Ww&7bg
z7s;&<QI=4|0$)*s7zt^7^8mv>>PZf7aXO_^aHPIhTM=Enex4-;`od2^lh|f9$*t50
zw-z{$CAqdI{6<3PojTzxWEc{OoGKwO^u@Qq)Vy($D5pZ#aPP%$kb83!Q^&#=S5;j6
z>tR5<f$qnDUg5WzT=(vKImwn{Dq;D?xiuWq8t$><4YTXG?QbYG_088$*&iQ0e8j3I
z#>{GE2@l!6*;-Z|=yAoejkv3Qw+9+z!jxL~$w_q}-7>^3ZOx!#qp|kbquQDE-=RPK
z>*s%D<w<4x!~GjD-j#t}H6Q?`iepN4D7W~AKAs+bDbLr>Ucb&MPs$xvB3zEimKnkO
z0wv>}9uG~tnN?68o9YXW1vrz@Tq54wN~h5(zJwDhwy9Zxi+ZH72OXelow#o;(yFA3
zV~K$87TXU*UDM5C`-xMSQS#vV7e4#$>1!+858!e9?oO<3?2%`?h;M?$(_&L|y9*H9
zsMrR7e8tp^a#HG_U0iDLtyEU|$tV#~@>cuiwq#iVV8xGFM5zk-B{%UmWDn{7eol+&
zTDSZAPUKN>wAATS*@??JvNX)8&W32sfz;_v&Mr5lc;$!fmJ%66K@#w=E;X|KH5CUx
zy%J{jv9lHk-;^a2b$Lw<w;79Cp90OxG%ihlLBIM9Gup;-8HA!I<8|ON@|3?$p)qLA
z#&~1WM0+yamVXRh!+h80NG2bE!(LM^nrTa5vmABU!J(Pby!Pg@9%;MTc)zb&<ox(=
z3K^PgE*3mhBA@(4jvsrv1DCULRMqZDjpwF$BQox}O85$#=V+aPU>R%nH>*uuL@5e?
z&Y8{+92fQk%pA52Q&l+3eE;S}PiDd;P;EL3D#D)96ne0Zp7fNS{|Nl^iv`WS!tU4?
zx=Z{UoKT*f*jIqk)NseUhG6ph?nY0ZPR;umtr1%yjPcJoZmXQwhv&G;T>JovS3?LM
z3+-NHp^R2k@Yl`Z+o;d#WK!qs{6=Pf{93QJ1_YxQ;6BU+bYP%Xy?_BYJX6uoVt=mE
z1AGLwy2wp^NUe0<F4>9h^vC;j($e;ajtZz$_??6T4wW%huJWI_uHlY%Ex9H4Oj!4Z
zKefNX@Bn2%n!g<$s>5KB9K`0DUNd!Csd!!U71PViWQ;Qy>$xFnf)NkI5lj=gDP^1t
ze<UEp9Tg>LHhYSNXT7C_8RcVW-wz8#=J)DD)1e*_OZ|o^K^($VxYRp|pUPt43$bYu
zfO%`ZT8JHAXjO=l?<4J0cR#4ts1IA0M;C!%oLslnF)MbED0zc}KzM2`<75oEK0Z@u
zT#n&*VPr<`+cLaa?REP0?RPKit;<l}e_FScyOT$dDHsoV1<uT8;wD&#+}XJIq1eYU
z@)5XW$eFwG?d|Ot^xHU%LlME6Hfi{}4;<Q3>F~lPW}8eVh1$dRvtvvlEJ`+@^(O*C
z<pfkz@^TZbAXjU2TeG>82{>T3!+Tu}(L2lWmYiBW2`ec)_3<bP_6NV=c(miZe_~&1
zf&cxXN_105O#@dD^pD;o6JgObR1m?voq|^S@`xUG2Obr?6!aUGS|iA=R$Q2rW0Ics
zk$@dYG>DQ|Ld9p&mol>_KLx^kZfA2$xmI{fZ_B|ry=i|DLqjC($wsZt^rsMN!&-Rs
zoKTF%1bdw{0MqsDK&Ag2YlMw`e}ze7ZW37`?Vw_6I>}&oa;6MmH1K+mGFb}KU+}-r
z{r6KErk$>F2MtiOTPu7JmA%P6qK(FmeFUzt`CxvGJ77jo)}lKdZy>isw-gAHBiL+!
z#qcx(pz9p4y?HoYR6SO+x4J;;aS1r<puM#dCzyv81y_srP`fuUtb^+&e`5m)HwV82
z$DAn0%gOfvb#=^$l0qz;GmH#R;kiok7>xQXBLtA<`X+-AsDWyY(_d*M{T>^vijVBS
zxeiQu3B&Lp5~u{g9b)g_WT<qy65s5!&PLFC>TKUC=G*mzeXm3j<<4z6Vc-J3{4<og
z{l(LkNfG)E(?Q&H#zbtNf7osnIKEehcsJ6SDNgE&8tMKVZsN#Dqd6CTgkNlbf@6>)
z2%Rfk1Kx`uOV12KksrFsKf|th?l*an_QTh8o{CfgNLTJlW&B+K`rN;OKGjVVP$_D%
z&aZ#JH;lkOoR7qCOv!IbOD#N6MYCsHFhPfAtYt+2B;-pPVH`rqe=kd9!b64G!xK8x
zkIClKV~rhAVz65QW)Qo{gh>(pmITLE#A9M?jSAwj@)OhGh2C>>K6!|cB}zxG4e-bh
zlgZ?rH(}oamg(4mc=E+Il)DWUN<-slgn)u<;2pe}oznM>@&tbNgbBV_>-!8SLlFdu
zI^{sQ**4_68OTBpf3jQMFXxFtCPgnppa^~s@`;b6By(`h`^cv0FZ7T1g9#~P7Sr4y
zhq%fzz87b|32|196h5Ruqs<nZvKT~*Fr~1SX%0fhLoUM<xz(hzX12k{6JvJ%S??d6
z-79dDDhG1I8BKEVHK1h|1=gu{qWfYS3p$Q_mBi^W4wQICf5o{#UwFC)w?4Y^9saQf
z-6&tPYMY|~c0??dGKC_!_D;pFPRBCU-sl?-5r@;bG{^@Qiy0K48tU+&hwEg66p;wK
z7$ADhpro1SJ9W|4i)bn1g~s-~GHrT7xq|j+W9mG~wtN*tx{;-2aT$p*)Qh0~ukaf3
z1_9O0R1htMe`)(wYdv6VVM-}O?`)2XGKZWp`7T-lU?^UjPlW{PCpy4TD^TeD(1r}+
zVfJ%0y2*sSwsNFOh(XSckrISrU64gjtdt58Gi!)=VwE(lua%EjU#4n=MS=D6$eB-i
z$&nI(44x{JK(7dtr9vhALbqtU`u5fLFP`D@6p^owe;^*LpdvOrOhnkhKAw=cFjE*x
zL|kP3(~h9ipUTY^&0`ZK)<Qx9>+q#;8@M?#0y}<;SOi@vg9VIe|G<W1;CP&F_}xe|
zdA{q{$n+1xMqKEZPJ#ALZ67l4Y?L)2a~gb=@1%}pzw=<qX~?1W*&8{|61Y73Sw_NR
zzF2ZCe?Jn*zJL4ljHFhJ%)l?0l8DlRf`L!P6(7(BtySI?tb|J#7ZGCwEd&}-!A3V-
z-J<akhL5xEY##g1S8s~V+9vE9y^5Bmv{5FQhwTlhKa0msRk{J#B)x`9sW(7Pb@wzj
z7dsjG%nO4}ka%as^OP?Vj5Ne)q~jMBydFRxe<W3q8u0q#9I;3T4q{78e+m5I&sj9V
z>iEO`DXaaIl{JVvv}v7gh=#=6-ahVEampj&>ZSoIK)%~Djs>&=w&x6ucRb&jCZp_H
z?CK0i9jTC|M%N`%5hNdM40^<D3qD)C3`aThEA!kv^w>fKA>ux_T4L<ftLTU4ojoyJ
zf3D%9)5saezBW)<ZAQ!yuLBXxRS=2@WOlHMWGws%`<rQ15)6cXj_Xh~2LqKI^o-A*
z>vL*N@0HU>=YKjgxfR&vry3<)mvn%u&2%;}O+!Fe*e~7&i)$<qiv*z|{U+>BYOP|<
zVbmA8pKj3&qX$wV0E<ws23RN;*K~Hje|bm>2ZFuw7Eaj)KtPq7y8}7}--#Fxf_iu$
zPK_0S&0`m9vABjC=!+&ls!2{46nlb0Z&%D0!KsEj_VU$RgPoPl3EI(+d4<53x|2<L
zD0EVcvrs8gY$R<BpSeI_kM!vktz+xk#p<5lW1#dv-0*O0%jY#fd+81f#$I?sf61|9
zBv)t8PHD?goay%RR)QK^6D385&m=4p$NfGw4X(#B8q-RS5pldY*sDyoz~NPy=0Vzb
z1o;GQzN6xh!07132gket=hTk<b&%A$^^1*)VRf_@A0d=~otD(0HW9gE9y4kp(R3#f
zO;av<TZgfI63QEL)~)rm;dj(0fAit_`6%m}`LJ`>%%A#X(06FD$)g<>+EnAjx4_6}
zy`mnLtkHKvwcPya0ATe4N}Bd5k*KGiZWR(5uCw-fBdGomB;Iej1Bi#_gI9M-Kcd(v
zZITmgbwBhO{SN-IKEnx8JBabS|Mza76mE7KM83T3yk`zMU7=0#9gOlfe;lOG%UQQ>
zyB%d^<);DsD*Bi9__qC5mF4>3J^U0_qoQ9fZrzNmmXogI(7|AKEp~@2kRC<jT6go3
zlm)Gf#ba!Dg%;-({M}~~DhjsSGI(o$+1OCwHjI$W>=SJ3cNk$Jor$|-|CR4ScC4-u
zAk3hy0&ia<YR@^EuD|;&e`|-A)HDLuK^u0G@l>uOwT2JR1U<qL<)m7d73{NeEg#cS
zJT;86=4!S<zWt>L@Z9tmK<v$o9p8s+%VG~s){T$!5=tFvO|u<0kWyw5hOa=)$~9U_
z?F)sU>{Luv6P89<ob~3R4z=1)^2oye{&Y47iV8bolgSQ+1;u8Qe>`{GW~Xk!CS?wu
z9bC$qZ)B(orNB=CDJtOCr21JE@vU0R!)oJgXLaqIVb(d5p&vdrUL}+5V7wN_H{shv
zOe~MT!!CXJ1o))X2tCf|p3)f)nu2s9Ge{|&f$8aK%;=5Y)Kg-^p}NNW(l=qCU(E2}
z^oDN%%NATOyDG<vf9q-KpJSkfJmXN>q5>!^?&|D?X%FP>9kG*=Bd>=G_)72R9zNiy
zDnI)haR!ggr=eH)4Zkf8ctdqOBa>)nn+}T2T=)nkJVI^@nG&J7S!e!0SfM!JbtLD+
zKkZKDNt=UqT2H)Hj@ObaQ~O~dAn$c{vU>Nv%6nhsy|41#e^+_$tGxGBej*ONd*9ru
z$4s>KINKn2Q}?Yh-Lo@$ke#e|^Em6&(_^nn-H(Rw7TvoY@7<2SHn(G^3HAF*>%Z)F
zx9j8V_C($f+U*(FSK94~f<LwM*SPYn!&CQu+Iv6ky`T2pPg@PJwG}Z`E+jn664-Js
zTC#;42W}@fe=R|xo2N6Eo(r3SX?pB?I4VF!aS*Yahg8XBU{lP?orl2plvTDFmv5KE
zVw3IXxvt)cbp+cfdTb6JI+#yG%a5#LELn?<sTqUD!jx>Q-6;z8?}NH=%g$Q_9@yI}
zTi(MSZrN|ieBQ$;yDmO?uuJy4fLcw$!kVze?=l**e{M-N0l}7cUqTXhIrkNJc<N9i
zc|Wlc8sc)|H#o!(6#tklgIFcwB<9h=Y15_$B}^}6+IJFWn`QR#T1MDBAtNrBS|I>Z
z91}hSDD#XGz}@a*AS;x4Jdx~Lh^@<C^uBvf?I-1_z4yP~`(N+<ulN4fd;jab|Mk=N
zzuGU;e<of3fyngUXWM_VPTkPdh-DV-$-B`3?!Zqh$rgRX>R061)f;k%JKKJ{-q1tG
zdjDxSXYZZ#_fGnIC;dN`lfLkj)_C{c{d*_<QJwT7X2HVr#e28?p8bc&)#>=jbJ&Cc
zr@@kSpqS}ue@w6ax;U44s9Tg7$0s<$9p64ce_3c`3qm!rFj905VVJLJ{rV-xX349s
zR|7W!azBlqzJyI@*Ts4zpXe-B>XB}NuxA94POqM21I#R`dnUuQu@`*gkEp?VfcX9%
zT1g(Zbeb!~Ls`ON%=zLP9HLnmK_`lz>Lomb&L@kt`7)@8$8S3z0lK)X&5rhT8%pkf
ze-+Akk0uQ_52y1`&ebuxjmSkJl5wrt&pIVSLj~{$oXmrW$546HETjv6_5=C;-Y(OD
z&~7b~_$iNMguJC!Xv}>-77D{rp`0`0#kO6!Xag}?l~n3_+p0B`^B!Wiq1hU}a=)Hy
zA3>TU%Iwr6x9f-_mP?RY9;|6xzSo1Pe~#N<LKD$t!<ugxLmh~w2i$ejo(R#`NE93i
zf2~eX)CS^EPE3D+|IChow>D&;hUr;i3?hhLh-d}h@vtme+T8JapaY!p|2VOz4}zf9
zRo@gi`zy<0C&$8DbGX<^hJYjp3l7HC{D#mW$%+xa#(O4P2QF!_HV2)}0Vi`5f5$yS
z*{=(sY!M5dh|3!hC0FU(l4d_!P25mbR`z^%%dNG=Zq`nzda7SZf7ht*8d&#XyTRnX
ziqUHMwEvzGi&!L{?pza4&c;;&*n_dp{wC&YDX$e%!72j60d&Jt?{=-kV)o}bSK^CD
zfAP+c{P17_RE;Mv1Z|~v6}l@Ie@(8MB`LJ?9{%_a9E(Sf@87)0dXJ54h6EfcgNXQf
z#6+@~40m9kOeUodwjCQ=5s7iZAVCdjmbo-*Ene!7^_ha?wlG)(iDT29dc>zQ{5FsB
z-d2H1P-=QfoI;b^85Yvcut}14Het^<8{r2$5#f%B=%-YqAdTtlIC1ANf4LEHu-tii
zdb)1XU2dYi+`Lu7cZkC7=@#EJ97VH{$H1rywM1Wt0Gnbi)^O&fM6)%>-)JQ~=ognd
z{b3AVX6|j@es}TI(loJvCF_6j&X~l*F=DVqKnHVSPWVv0yW&CL&X!furL`$QiA4JK
z2WXRM-QZMTR8FK7XnTM1e@0k-@C!sT8v7y?pmNHTuF9mIQFxMWL%~ix`^)S)h<tCv
z4CM#-M}}kTQK>CLWaHoDxX3fg*|9f$C6Z2Btk0HDe{uh;Jzm(eLTLgnO!Gc?yrlsT
zqnWyUU&`cbINIU;EhP4hNHPfD3L&bGjys3Ej=lBi*6(b?T)chyf9=rwf0$YGef8|C
z%^LS)+DL6ja2?S^{oHm>GAk$`7d6|)0$aP25Qt^M6EQP4-ExIWQg}^fP0f<@Hfw6#
zOV~qzf)KG7i-^w&_nA>M*!(y4a=IUh73rJ))WKYZ<;F(5AvE`>`bKDK2B#o@roYxJ
ze(nI4T8+QSueH7=f9$PXflTpms)D+d=&6#KMIQkNuMmuw9eDba5{ZG$6sH3IyAqLz
z@r`)GDjF@;<kk*(+usOy_z9DtZ*C0~3mg+pdl8SW(@2AN5^T>dUtGSu{G>Hog<~^!
zxYG8@<m6+jw`VwsIuiX4u-wTDf+T3HE5Z`-W4YbJ>F~KPe>PhQ;@=ut*2nRyH?)+9
z{I^0Iwg>wO%7i#ggi6MuF#3^b^7ArH!nf(o&v|XE)N$0omAe+h*!4$K3@)n$_J|IR
zyFfxFYi_<*vBWNcVyBx_;UUh$-tQEHtUhQSQFC0<p}G3Z4AV6yW(-uQU9?!oGLosX
z+h)$v?vtOXf5OrF!rgHD!N_#gN9!Cd=MT>MoNvxw&z}v-nD3rE_^12-{Wkx%<%?^+
z5>x1BHMI!`(;)K2-Q-6#$UDx@&%b!|h*kZ5{^-&9?;rhv{nPLN@WuJVhhKbg{)qk4
z`NQ9T@#viW)A@&3fK(+s{-^Wv0Y38l944**`z!h1e{{;8%Iz)=R_g@4eXpOr9_y$V
zM8Bx~QpW1Rbjq$?Kl{(|i(nxlCC1Nf4CXPr*z(0%j6a{8!)<R28IAFfHl4*{3Ei}y
zml}_PrGSdU2h%Cs`*tm$$!F};;EjC&)-#^}Alk<vS`0_rScXQJDRfQl*jxZa9}6NF
z%eH=hf3+3S#p~yc$4Rg>jTwW;c}1|<hS=+eGH!giP$P_v5GtD)P5110{p|H?JY>f(
zn4ZGqL9oFDo?j{y4*S|PhBX?REn~T1CzHu^AvYTtSr$8a@&FU~vRLC4sUrR4ms;Jn
zRrgefM!WaG%2&BG-D#WNJ}!P{c2CGvGK<rwe`qXptx;+Y^rF6^UU1G-n=0v+JP6ZR
z%woY6*eK?qA1o{lJBiXTJb737bPxq<t!sArJ{qee_gqurB`#ano8vU<+}aDITvGUe
zmiv=bwclI#)2vLE8A>ZtX>#Gmsua^>mT7oTF8AcpL@q{mfLTmQolS3p!+@WL;z$%l
ze}1EmDceA4F($ENXGztO2!Dhmgt+HJ2>Rluq9^SgvN2iF@m_rn6PfUErZWgyz7je-
z#mQQ(Fu#|Mlj!zv#{h5JLPm=q6k|G9jrHknEN&omWFg!E$=sN1e0K7!;9;_++%rhS
zJi|}mp*SJ;2cEU`5SS0^;=O{+kei0Me*^3UG%En*Lf3N`-~w|nHvONWzgV))%`8ec
zb3nI+_$@@)jQ55kbO808^2gY~6;gpmlwb{{dm|!h_UaCY0&v0%67^&BK^x$MZ7h6F
z4P_zsnDPt|<beea+ClCMXSe}wO(EtE0=eKnW<QHq!e1$%KtPtaPgwh~qWCl2e_va5
zsQ=?;qvdK`G(8qmtlpPQs*1kk&32WOe^xCCbmg|8_-f;=f$BR}eN<vNHM4U|VMxWA
z7V0?aR~6U~VY|_=w@s=s%SbB1Uq*67M!5^9H>HDHu|@`iakjDik$wbIJ|O4G99`&;
zxPXWkDq}WFsMK9^5lXBeNRx%!e+U@Qb{kg220AoE_WeR`cbLzPzWFWa4@jM0G#!#7
z6HPN;he9M-+Mqqm6v(D3t#40KDx@qnX|?X=d`&{*;U|E4o}>?`>Y7nG8KgJol|Xlv
zbL)0NRd0h^ex*6Gc^`|fBFX<(5&OZSPEriG<r%dWt&65~(ax!|&BhDqf5h3XjISTJ
zEp*wy;E9F-s>{IbQe4-&JU5@)90}noN_=Ylf-Z$@&UjU6&J`nI?kZo28BhJ7!bl!j
zl?X=(AoU;un<PwCaD&Qk%ay7*1DHegjQcl%k}-aD?~QWsnr2%W28-Rt+p!1rFcwh?
zrbzFv%R)Y>f=%3OfDWWVe-oq)gEw`g53rDKYBJtG@{(izF&tkGSoH*|2&26>uEV<9
zSyBx;y{_xxQ)x*PSCZ!6krkTzLz|>Er`!;78TOQ%YNryh`G{iE7poY`t7bBu&10xX
z8bo@QhwZpeda-B5%ImqNg%O*I_fH(1SFyGyR;g88%**<!JE|mhf7N|ukz93`ksX!S
zh_tINxzt&C9m%iiN^u_w_f((y!PCB*Y1U~u#bB%Jk74O3h2@5OFe{`r1*<g9IeCmr
z!U1wSuXFgAeHM49^wHGoFET`uZf80kyvOrtwC57k^VW$OQ5*JpmB_@Y`fLIia=wG)
ztR1G#sia*C9VEE^f9DKJZ*m+6Q}Tt@9*M|H`*#f|n#?|jXL6*Dp9A!)T^WfvxWM7q
zRGvGvN2W_qmY$OxhqYTu*OFt6lRmeOObCkNX8N?O(;jsK8Pq-b?yF9@_WG33C?8Dg
z0VxsC1H4RIJY~mFT_K<?69&}4A??28b}f}C4rfLY>g)-*f67ehc=ip5BnrOxc;|4}
z19VK8(G47@PL88$1Fyl2<DuV-<KR$2b<SiALq5zLc6I{*YCv~$a>9>Lc`tl+3Jx}B
z*}O9>%C>nbg|FonkJKb6!*E2TEGu9YP{^{yLY^@eJOD?t(}$DE!}D{fTF?d3KDtU4
z2@8CMTTf0&e+W#1EF4qK{&*|mr4Emd`D!;l|JUE2qvP^B5J$Su8iJH3XIK`2>j%Sa
z(j-OLR?U_-Lf5G|A3R~+HkQjE6rNr)Wndz3N(8GgUSVL?7r@LSTI|M4z6rt|rl$zp
z16Xt@z*B2%*_L^FV3bqORDI8a2;wp_-a+bFED|0>f5N9Q%}jHKcZU0`>+y&=;v1?a
zfzdGBd+Pb{aOjQIns0@FW(jCg<p*?%-Vb#GW~<j;W?SpT$q8B+2}I{CN%HQ)XHQsf
ze9NN%QfiRfG)ieL%4ZkTAoEvtopS&uV_(dcprf>;b^XfcAZ#Bt!_yrGxvELueQB9c
zsXuHLFrl{kuxowPS2|Gj{Z@%MaZ>RQq|I(2s;bab#}zAwr!u3c_Q48WTbx3xSN}~K
zU6U@I8Gq9JH6))NL=2gz$wuuC2v8Yz$p-2YC%~#iR!H6fwS;x6!OsFLnv%7`DXWoC
z@KLWC6^=mS9*&(^vf2_j8!;s@(gtb3I&~Lno6%VLW#J$Jy!TklQF~*xcoA6smx`}_
zZz`;{=J7DCY5Fgo{VIybse;bYxxz#3Bo24b7JuRhUCA+!(eUcBL-ZocCosa84)Bg2
z4n;B6l<Y5i36uYg(Dn&#lN$J2`*5C{N4^ljHtGIQN1mky=QMP?pv^DOcN#G&TL-&H
zr4Uw^DHqA1(=${Rud^F0Y!cM^jL9)l^B^VG1kpBy|L=>tjtYyCl!S=-zcS>IExyM)
zw|{&GU^z2H(&+h&TJz8U@CDT_fPRL2{Qv%ekC*4;KfU|qi%0MOxpuxkr842ONbq=O
zZK)d5f%2ke3yo*oW#=^6_1NoJU~JIlZFN|Mq86`@lxGsgM9GbJBD;goM%yRb#xRFS
zlvW-r@;&9DPOimHowh!F)=vUF!*kX!0)KKcnRNWN97`aUMYHlS_hP3I^qXayOwU)|
zo`>44r<}5+olGV@R~@vN`#~qpFJ{{AZ!QRL*UdV5&PyY;|2k7&TnJNmLpFsDtG_Io
zq#rDIdyiy~ydv$J6w-GaVzG39kP4O#8gV`H6`j=1rj@NtV$6+&j<wl5h>WBdXn#bg
zuk8Fm9kOSski2=n%Jlu99;v!6Dd#~OoOC{E$N8N;Blk<T78O71MbEv`Ql<NA_U-Pk
z8R6u{*2JNI>weDp0OGPFAR2_^k+b+Bf#?~<6FOh$@@Ogql<|aJkr&s1xak{3l*GHO
z459?R)pC(SH4Qtp;IKHlDcjM|Q-22I$B8C*7OQr~HAor^i0gspd3YwdmA3Fl&uxx%
z(|Wq-EZ`f#Zut&SB9IO}jgm!vc`W8PZiL6qYdv#rhk8${EB4s$AbcT1h+24Q9C}YE
zY>})X-xu14L3G4C=K(`gySllAY(i{GNb8!xF2@q4tV1D~VmnWR(5KbYH-DjTd%~WH
zWq`mY)IqPt-NEK!0ViQ9r={9g7|qF)45&sGTp|_gOmu1773L+dT^HSTSSu4ybf8(b
znR4!K(y~~S(anEgzaIuA$Se)A;8R#IyP?s`oWoG>V<eu?N|>l&ijhV7a-2XM(%~FF
zuD5G#Y@AS8umvJ9+zGT5qkn8L5@F_GUOD)^a(tVC7OH^YJmk`Nz1+*1zq&j09B&@<
z*3&Fi3u_3B={V=m33oQK8N$GF712l|Zn6-YbHlaRX?z3j`-*uXpNnv&#Rh&4vM?@%
zX5<C92}Ky%-^UAxgGLOWrQ$xQZ<mlLG7kApU>I^~O1@9=zA+>kLVth?f^RZS0BFP)
zad1O<_kwLhz7T5}0$gRBhN8rtN3btHdfstvWBOaI&C+5Y`_-ifSB8+-Py&^#+1h4t
zQC8zL$h|S#)fjHR8|s%W(*8JWE-+$-{KlB9;TKFC14{>OV#{?hSw@8y3!oeq?G=L6
zX;k=S!z0KLGrQsCW`F1f5%d5^W`4j|kyJ^rQ1B3;&=ki;5^#S!o4A9$CJ7I~5g>G|
z?PI=g!4n?J6|1qtKz;fOOe=R#FidVy$VFi3utmrN6lk_-hGS}(H(9F>fGw0eoTE)A
z?5Z$^>Gz9^pMB<M_y<5B2>{4=k{{3F>Dob{W_-hAK+y8?`hVP;dd>tq%5=~OzV4``
zYjcqx3;gREakM08!GSV*bpB}KfNK=YD#zfjGpQP^{;E@6A0wl~dCyd73~&(43GOZ@
zL|3qW>L*9~t+>4%kCg>=ee|<srFrmiPM6j8N)JebUroK#KepXsGhYt0Uyf}d+>6v^
zk$RBe>>~zb{C`$#wh$D(f^6W|As^-#<BM%5cVLJBT!SAFGRb~b|8+U(#ju1*#MaR4
zgFG+*vRpaGUPQ4B!&xX7Je)0LNJrqRY<zv^JeIc#Ij-T}1>YusQvtgjEHo}<)s1p1
zq8Sv12R?v>r^&kNE~<lb7L?ovRk!M~W(0yWgWS2Q+kdEh3ZOmaQeIaVA2_a=2Mvw<
z3W?xVd$WzDT+UXx%<&dy5>0GI$blW@4<@s3q|f2d(U}4|Y`xiY%pI<&@o3)X+!jOs
z4PIB(qIX8dGirg<Z*SbXk%PBQzr?}`RIO*;ftPJ`$$K}dC*%GzL+n*vRqbl0mEr%P
zcEvOk_<ynI+bT@1Je{HA&|N4SptQm$zcT1fbjbT;PhmZ@&DJNMBmbysuy{MdF6?6v
zwp(}h))t{qmH{Q62mJ0}7Kwz)xLlBozQo%d(W}MUlkqIk)NoQ3gxioukGpC5B4$i)
zS{V4aT|yEX*f2cYywfwR9wQSCj+JNkBySC7%YR*Cz&2b{Lm!DV0{NgP<DyXec;VNI
z&}$Y^b$f?eADaabpYJf-QSIHEunVU9!sNmi==39x8zG%zg(>yx#M++vSTKgIAkK++
zE+gIJ6TEMkb1;YsA<a|txlwe>ji!G8=EWIBUTBzDY<OTID#m{Y^;50~(G+SK&t{<5
zT7O1>8$939_Qa_!!f_s(76vunLE&Yg``^00!7Or2ZMsU{LEE28y9p=kc|zmSQX$Dv
zH?2Bh<grs<hj;m0-iVQo^5UM><h4_mS+L;2i#%Pdd9)I03Uy)5zKsi^z^cIR6<r#Z
z;Rcb!8TGe>iWghm@Q7lUvsjQf++kIO<bUs=-Ei4vdf8@r*(&Rn-8?1=uFvuaqTK{T
z_K~?F(%NrAYhaOsW3Er<h||b`SVQb1@I|TGlma165CY}Gggw=n3{YHZ>Q12?Qg<XE
zu9zmlCWuzhw{sl$1Q4d4uod4@wgv$+5dbyn5{2c5FrMjo5G;U|tp2j)uQe2_=YRby
zn=e%U43w3y55D6bxQ^WulIvg>4@(`ZFG$MeA!IM6LyY}S@)){{)l7+4zMBHpJDR!{
zCkIR|fL0<fI|AjM%QP98+<**;j@p4Up|R(vX!He)_EZmcp<XS$kqcEk1)Xd1ifVCw
zr!+L+TpMXQNz@rC7&A7)@?pS-n}1sDF?10Z6cfY9kl>58n`uEAIBR*Us23S=6KX`R
z#&S8)2?`rh8#7KVY+yI3pxf3e!_w*Ymun75K?toD3VKbju{=^*kAY;lMogah!AiG4
zXgc=bF$RpsSlk2!OwQ_~T($&VDLexQ$;7b1g8{$NNj1B5F0@IbnSzE7`hOMO>lO=Z
zMQ{kE6``NA&qh69aW<I4jqXg^nT#x!60{yrsZzFUfU610av$v-ff+BlqvXPE*<Bbp
z;de5Uo1LpxWUQ|mtAjGos53m%-bw!n^Z1?6c9l2h{tEwyq1TQD^US8lsGQqoDPdJN
z+XUFX!mtVUzxFaMK>%)78h>2VGv(-o56>eH+N45VIjHdlwm@A9i{wwede1TTAGGRH
zpv?`RIi(NOW(OMF{6<0}@C-wI9t(c0ff6Fd?*i)F>ib~swrN5Aslzb*9aR{$Cwdqn
zbeV^~bpPiwWF0k=OBl!0zt_mOQO2PtDcJjWb%@eEL=1Y-pjv9PO@I36_IwdkS9M+M
z;hcwZacyu_B&6KU<Z_88N{z7OfSn+?i64s0-|1i&?dvtFazYwcqw}@!XJM(WGcsF7
zv|jHBhJ^@)zRcb7&RC-c6KTwS<V{FYcI4S9K>lBC#R4@goQyI76^S&7c{sL1tl&S9
zjJ**{xVl#C^T`*}&wnTXdIqVtad6|L*5uJiK2yw3W6VNvvI$9A%~pJ?JV>Kak6{LS
zmYz-V%RnniQ?p;koUaoL)F14WjOi%~c45qLoxX_TM{dVq5DDhpu6MIYCbLN1>V8d;
z#GGXkE;uwyK9aZk6z(Btl$$E8fqH4x@hZCoWEWqqChTd|RDZ~X0hkVBH<1N{vX<(X
zMraKtG9JO%o{kkAtbM&I14%lwwB2HZ{jsKe((xT}x)(h1A+#X60(<)!o2TRLkSQkO
zF>&n}cT5j~${qIciS3`58KLGa>@VzmQagv)e3u=aJ|uSGJoQ(iD~NxlWn}2f+o<Pb
zbR^GYVXub?Y=3PQD3yvHkJkL$h7DMU124j01svZQ#~<?xi!@OyM9Ku>NT9lHG}_MW
z3aSU()+{sMEIJ-dot3P@6>L&#HS5y=ZkDknsxQscq=Sj}YgB4e$^cl~#gghD95A_R
zLm>>0B&iHlJnbujK<8hOe!uA5*+Rn;c4(Q<uswPZJby%$zQUL#c8Ys!RT{x&5jtw^
zM5_*iM!Oh*dsEG!H=b-VGj^}&K#TjXJu+aTIMX}^%GAw9o;a0o=1nwS-oZ}rZPXpW
zRAT8AY7I;W$X}IJCl)!SSRCT}F(3gdv>{*v$(M=FsS*8<b%}v%^dlY(v)==7iYMqK
z8QG=^CV!`s4DV3}tvu2P=nRlPe{dez3X&Lb&frUo2Wx6Keysie?uins<zPIFEa;=M
zlA(ZLf%Of&e8qfm6D-6S>R94L#CTvuQK#El!24gm!jGi-8@Fsue+~sv^x55Xtsr+)
zDA0Sx)H>K=6VcdOct~F4YG&N$+XN#)0=kOQoPS~|lLDnJcofM5BN2oJcUUl@Z0!9i
zQbRjr0t|bg-6spwY0tIqx!eG-b@M?K&fmm{J<iciuQ0n@9by1Id;wW^sR3WmAw|~V
zpdz}DMhEYD`f;Bnc{J1VX#ZWVYmrosLHHp}{eCT$+FLEP7+gK!$@T0E>TMN%-2g^>
zk$?W$z!!(lUhbB?QgG^Y$ZH`9lTTzODNy<?&%>q5R@}7Ja#*>T&uA`TZJ!i5tTn-<
z-e#kOY4C`rAw;I3SW7OG@iGjy+d@t58@e|@CpC0V8ZWq7a9>bAs~D@cwm~FDT2G_1
zi3}A}qU%_D;9q}$wNr^qVL7M<UpugDZGXMR+Qsu88gB7M6+*|KK}_rxjW?YF?rHnX
znn_-k8;;jDThq}h7P{3H9wG@?SOU0{jO(00v=qM$lc0l|prt#skfH==W#I8T<tFs#
z;e*WYMvtAcfSz?hZv^7{9V5;3)7@<I$%PF!KeuD@l($-=BYuFLc4v9ApGZ{cCVwvy
zJ%V)f##*LifCCgxH17l%i4O;=PC%|=9wi_swF1z7a%kLuM=6k>7<nv;MT5Z+Bua!!
zllU#rUk#w)I|$#!0wIBUIMOHqJtb(?=RGeywPb~Fa|CFuaD@B*f%pYJx4<iAr9NFg
zF*DqYN01+KECLYJG0@mjfBl5L#($d{&4n^I5DbSz&rC+mbxZ=$ABRyup$FPCtP;6Z
zY?(rUAAB<8y(zGS_8&Ddgl7GcIYGa-G6OEcKMXJ6q7=Xj^)mJ41dXD5bWX4nY-WU)
zS-K&jB2ab)r3X3=PVz8TGtINh7ng4@QDXqelFITLbvokj3;<1FTi2^%@PAS#UxE8d
z0P7I?G|Wq3>~f1SHN3}Usc0AnUw1{NM0(S5!(4L{@I7t(vRiP}QQ8f0u86t9bQ#02
zGyS}$k)5b3!|hs_))U6R3GfY=ppB2y`2e7L)NB!gr_c9niVsWyeRxZAj?mpDOsOh%
zwjDb-QkY01F<-6Dk%!a#ZGZ5gUh;;7;;IdA387TcLF*%>O>B9hi$@CQQRxPnIUn9R
z@bO{%3wmZ1KjrqI>Uv$}OYy7o&z4sH03QH#MZ!hHluBM%p#ct(a)t=L33To)C~{0C
z^K~Mb2?Z<xq_2p6rJL56;cQmlwb(&U+lK#)9d0CLYpep5#5+V?aew;t*ryQHD@Z2n
zBFg%}0HT)b-0>*0m*BA0RK<e*sadj)Wx86!<YDj)PedHxsD<V~ItW4Oba#-AC$^@@
zL}6U%R7_SA$}Aq+B05F|(`PlJ={YX{8(RJ2;MjM~H7$DcH~h{#_qlFWauCjYbDs%F
z9L1PdwzxS$vUCdCR)6VEO!@9pXg%5p7nYihq124s$OWILAqSUsRu*JZ!1YEc%<0zK
zg+)z<7M|$5Ou5wUh3qGpXH2gpr!0ZY0B9mc5izl)RPoB1c<2tn8C0o{sbZZL;MA+A
zV~2aGi<FlyU-zCkU;|^FuE$KtHOrM;Q~o**Qd5rXJ#ovGN`If6!!V)@@;YPyfQ_pD
z>Jh8_Ks0MG|Er7(;IXT3FJ8Q0FJHaYKuzZIRKM65M2!shQrsn1iP#PT@sL~DSq_4+
zQrYXZ5Ru=Zq)4x7pPThA`YmO(;%*znLbY1w_dpV#8ju97u7;WFP(a<Uj;I=Rq8jyC
zL&CSwW`$ZnM1O#T3>Mu)4K;!O5tMvHt^zztL6!P4l(&>R3Zsuua&QBAl<Se^rhXVt
z7>pR+VxK=$yi_F+$r?~l%CUu~Zez&Jip;6dOc4EdIg7}YNqcUZhfw)C1{ekkjy60B
zmXJu|=^_J@j0R+^CYmG&CiK)RaG}Tk&b(YfKmOuW^nc^uIyu`rb7AJRp$0-Dgqqmf
zHMksC!HtMOg=n0I3GAxJZn?6@;ugDSz#dtp-E)o_xOe}sNDBi(5H&}~$>@k{Bj={&
zUu}TA>oocY>`{}oZD7^^@XXNvG15^z^8*?#<zy$hv2bS8zZUi3yM~VF9oly{XZKQ3
zbf>(4Reu`zJXf&RIR~>`ep2Kd$lvAACUs%juLDi*vO<$;G@apdac${|`CMdT%>aAk
zc3L6&xQof!%dJAn=j0xX>K=>gH;F|xDAr9gfKAEB$b06>iq^euS={~6g~W2Qd|YU(
z5`a!6v`!v<s}t(Y#TK}LhtN-Vn4_>Bu-&Q(1Akbi?%)GmI|5-)akhm5XL0M?T9ILB
zP(8Dnj|gf@vO*8?wDyG}HEYl<dgZJb{Mm9WDs0;jtvk6LY`?~x+4G&}{RTJZ3PrP?
z<L))}17u&alm9;bx5qzR@OM8vUC{qsig!O;Df++J_}#z#@HTn(!z=mjhyUlAF20Q3
z{eK;wc)fl1!}CDjWv>3$PG9{#eTR>JyQatA#B}%n`|~@z4%gssxMqiRAF6-(S9AIU
zo`7ND-|*l1C*Z?gg!DrFBisnzjt{}d!tZdO8S!oM?(cOM&i?+xGoSwY>kSQS)(*#m
zKVTC2roZDI@JIa=VKvPM!GFKoID7E#KY!96cCpOeW~csko2~LQ|J~p1WWQc!6Nej{
zSJvG5A3xDvn5W=od<uTlJNfteRjV8u9yL$c-6|~9**~8=d9X|)azpbR3IDq?;6bOp
z*d}ZCC3|$1H62w6d9%M{boDRnoc&wd5M%c6j6G(*ynmuu4bIVyh^@?j&Sa=LW`7tV
zivQirDX~~Ha>@F(*hnzlmZs`ewWU=82Zwr4b6DHGgn$wVoJc0QcA#Bk#QUn#L(>t*
zxn0Ys_fH<Y&zfw3*e|?zn5y1>>hMSvbrrg{=@hHuKp(hvwoeU7=?yXr7Q0y*2m6kY
zNOj2Ldp_DBlb<rv*-7?^@Ry!0b$@0G22APK(N>CNY+6GIZRM(l@UTLa$cj$vg}3Z+
zT<&TQc8zk7-6+#!AvfY!MfikA(QRGHb4Q)-g0_xgEgRvyn2Lq%uzRe$F`JFOYs}_u
zR`HB1^Sm=6jiFuEvBX~w1eC^wZ-2Cj7Y12-=sy$DtZL1Ovts*#PqTumtA9FbIITt2
zd2XFK5ywM$<B_eW2reJYK0@tOhDuyo)LN%{uZ?TpG%d{$XijybzdRdOCeC%&mW1i(
zR!Lg3wStaHMr?DrWW6cUMnRDP*-Gxs-rp1pV$tf)YFOd}K99nNP#E3Bp0z@vU0@s}
zJZfo@sh~Bc&=!;_`S1e=%>=ILe_fLnvmk$HL)Ef_E;JzWMx)iz9sGqxz`MPVaSf3v
z=PpcTbghsS3Kbx}?(dm3nse7VZed)h_Qo}tHR}GFvpwAl#cnv-P|BBsT3oeaGo3QT
zdd?e-i_-@l{TaGLKY?@dVD003ra%=UY}!4%pWWNXDV#e;nN}Juf#nFRrx!NAfkuDq
zH#kK`ZPd^<fj44#g%F%?Fgtq4<c|*d90q~EOM_5Rfd^YPX4^YAfKey>8H&r!xQ}Sc
z&OmHpjnR>gM};{xnL9T;Ob_!2;LA|_!%)=+pz@YfTf-3)srM*A1_9VBMXgvzL_-j?
zCGuPbo7+zEK<TgfYM?5VWe_G6c{YE8otUebscRBPew`0IG*|9G|8w)2gZCpAE%`VF
z6tv1R77XGp(pbs3>sQL<Qnlg&%GejNd%)#tVH^g{=UE7L_MDN)&TE;Il5yfrNuRC}
zR%C^k!p$>FWWvK<xYZ7P1_6^f#u%<*!S=zg$XPY;${d!5-uhA?o>nX$ino6YnYX6m
z{6t`<a@ZZjjU8>NXFTCbB)TWmu-z`^p`6d=I}MuGuZ5M2dpA51Jcgzv2Iiz6a=Lj|
z*GPe$>yF8k?D<yx<R0%Vn|3~JWM!+-40P>iGJ3O3`+a*3drAOadEX~vfjx98nz$OU
z=QxcbJq$Ev00B{{C8*oyI#_?LXSYyh1HH2M!E6+>4sL-xQw<T4hmNuMPdzHWmVU<7
zD17cg_@3FOnmT1+UrAr;ym*$?F=t!4ms6RF6bUSE_9Fmk_mv^VV$*()?e)q%o3tfz
zn{|%+c+S+$=armOu2u$R<5fwcJiYC;QypDKrLuf$yX8t@kM8&ZD`0;XLk)a{fY9AZ
zYv1(3at&`yZEsyoaETYH9xCyudsC+UOBPXKEpk4o3Pqg9F-sb*R+#`5PuE<{Gh-nw
zQY+BC%&IH$cMWS@eVV7PuIH!zilNoynHjg@z3Fpr`urMApN}0<-Jg>8HzIVt21@dN
z9?5)`Se)!!r9h<^sz-mt(;=tF%5nBM)#ZglGQe#1KVc4Nr5$QpH+l4$=&RW}tQ@|s
zLZeX4L$25At2Gu?)jgGlQ@$>}*`Uc6Dm585)uUFMQB|XMxU<a4b$8aWYyHTMIDXI}
zGCi32-WV9OVNA#Ama`Sx9r0uaUj;vl*Y>fYfLD4;bKI5|k-2{n2{%Ejb|~%ofL3LM
zBd2t6HrVr3zp~eIzLB>d(TRx<^%a+U?ASh5dKo96&%@L#Vs?l)??Ps)m<KIcrbAKU
z;SM8gm%ZyA?ZAiD0bon+_I;;$`~YWF*9jlVeSuq?^Ip`^R)y=K{P~Bw9$H)>xeY75
ztqiJ0;_E?!66=2>&)&-IU?OcYnN*6(Np^cdlyw&nxU22p6dS=+8n+?E@aQ^6Xb-z^
zM(*7$VR+NCylWJ`cIC`HxnAY;jd)Px5yEEJ)p2}~`Y*lC{gm9G4y6t<x9o$7#d2o-
zFu~8F*7?$8>o|LeJt1w*Y2{+ql!P^!YFgN^6L`S^RvLe>;h>A&i4mHYJ(1hvt-33B
z8fx)+bCPRDS24^!+XU?NR}llo-BrR9HJHFWf|*sBD417(eJz818X%#+%DlH{8zQ3+
zyFZrgrop)&L(n+-3UP&145z|b5+iaNW>}Ew20=5+kw#-eihXGp%hS0X+tfv?mIsEh
z=dMNLqb+|OdE!7_&q8rS*gzRNO}yb)bc=0iu_JP@S~o8j4n-Jku1x4s)bOB>lV&=F
z)JuX*9zVN$^Zc)u&ya+rLKbDGgfg9V049<V{@H|GXz)}(q<-uU86;VI0uD!VXKAMH
zr_mqD8vMyJ^wosDio%^cl<q$;gJzbC1OZnfi->>bdj=^xk+(ed0h$aX2Q=<wh+{IQ
z6kB&h6|5p2W}QH9NLJ09ukMUW(>S>*&=;DHFoX(Vwa_mh@Y6~RLB!CT1<_37x@peS
zR9^K&D3uDKun!Df>h?FYEkdhj1cC=Z1M@Fax-tF1_%xLy2IzEtz*|Y|Rh+El3c-65
z=?;Hcxoa-rDgfyF+qeIPpm}=12yk4D+}GzwgPyr~OQ`LJl8BbYU6Lnx(_KI}kw({(
zJ6cDYpH_T|X_oDbmf`+UXG6p|mobB8P;uZ3#5=wc!gg>3X!U5ZV{sY+8glMKJ&TnN
z;Ibh?1>$N<v6psi<}`NZH2G0^Wv+2nvJQXbCz6rS(SN8*m@UCK8gFBuwylUv#E25;
zH^E950hcb>vW6K|KJSA_M6*`2Esh5=zeY)DfP^kb=yo_E$M)#bYOLhhKB=-v`W%jn
z>dn1Yu_mRKWtnYKx|G=;)uH-X=?Grd?KM}eb&~rO%T=XcHG@@roXcBPmmMnZ>=l0~
z*|~$BNQ_U-9tLX7>IMq{oO4GCxMK&5c!SBmj4K6qV#i#bRLN!+YaP*2L1tDBN@A2C
z)zgiLg9XY_mdQ)T=ki8O*acy*;>;(Nh!y(XGrk1%tQ?u!1OwWV*>U6&=!5*ir8rxl
zuDh6`BkYv%ZnW1+`e*m|D73DTp>BWS1$^XyRoETN0!rlp8-7PR<PRDczl*c14>!3c
zQ=nKFT#MU4374&^#&xZe!`aH2#GY*BmKpSnJQob756qdEol`nrb_|%82B@(_s;!UO
z(GDI3<-lRXv~zLo+fQm=-%w9|QupPp&(xVm&3AWy({Mt_f^;~p#%iz247z`|&zf8|
zmB3gSguxO-?ON%<iuD;=Rj12RIZh!GWF}E{M@5}ZZ7onu<xM_iq*w!;w;wanQgutS
zMNxgUZW5NA4%YorF~J|LNx^6hNQzSjIHntY#+VPFa|3$%iQfhr5eAXCj1to^{F5yA
zHD@%p<hH4Le4y&!^4=zT!DfE~RxI!66B`}@vhjUga1%;S^K3N3)U;o(Giiqb9xfmF
z^VglK;_~4&=TSh0bfJNZlu_k>C|+#i-KTQ1k<lgO*DA}jkIv6w?Q$qtC(k3qfHtkf
zPN=cxhCgQb^eY@%bH857N9T{q<Ghp!Tk0kV9Y*+5d4#7jT86<Q(H(!e;xwA^5Mkmq
zX!BXy&{<Uhq8wb_A!K%3Scb`D;x3Pw(ZlkLF4ANT{;UO=^oE4Gec|uR<GmI!x>IDt
zd=UlhBRTu2$#M|z;6*mte(1r@0Ih0-_F|BE`+BJTCT*VXIO8j{M4sz2?Jzjo*g~(O
z$z$)5-yTgY_sCuAh{J!PTN<|N@;$<>Yr*4WE_gEID=~B9YApf2>6E>W1*F#sA4Un2
z^@#Z*4sL|cma*JqLqm%k##bCxDCc?4ULFdr;Pu{wd05imO>LtcY-WrjqjXRsjHOY9
zgHXlDfaxnpU0M}%9p})-FwoC=<f*l9rg6Lxv|=>9S=|x2GiHCFOhg<yiig3C;}yt8
zq{XO<0O-bZ=x@Rsb>>YH?}}9<D&cWrf0Wy;=~1w6r<?M6_uz?qZP20ljW`-5hWCl`
z_w4LdQK3bwq^pb!&lcj}@X-FkqcC<O+cu}6lm;Te3oQ()sz}QVRKP;&CX$UpALcOf
z@ul1mXx9;({gQuFdJ}yu5evOb1?s(#*S%7<3uNZzSkx=%##{>?wz-VUWrC(%2<8RA
z7c?h@s1#Raf9A@uQ8rq>|9KunEECLy73<1Xw*BN&>5Hd0_E*y1eOi5O+u`7X2>J#|
zUCm~l{eS#o_9*A?|Dr{qR0{JU+UQmb!hJSr*g$4?v+{o^ok|DOo<{J@3e)VydBunF
z@O<5rTHn3Ayd!_`aO{R{A7>>`Nyp9Hlgf)rx9>81EVAAs1+}YHK({6GT0|d@3kI|U
zn|x=E?&^_ZQ)Nz;#>55e;-{;!G`j&&;ETRB=F>;v$nF$7tmQ~23T5)Sj&!J~G3q`_
z3IDL`R{?(%(RoEWBJ@;n$+6LR%EqvJ@~`m{IDQ1<8+g~ENxHJ+z}Z{f1bDlcwI{A(
zwz>eHQ>*n;b>tu~Ve7(mI6*kmaE=fiUAA~4{0f4<!%4$ArW3TSI^CtjPkl;>rN5i4
zxmph;V>?oa7M>qVl69}_t!k#2a|Lz`j8>pk)Run|l6ZM{e2@w^+bmZu=oZ8uPgEY}
zTgxB%E8S~`Z?b<Y@e}@G$i5!EZ4ZVYR@NRG_vk1zdJBMojs03(p?z!g8L?1ln0z$X
zZi~)Aq5;Q?`8Un1k1qPqM}&+uoZm98aAWx7Ky&&+R1s!AE5BlAdYvc=UP=JSIy@3u
zpv-^gy*z6wH>2*)HicBJ+{%VM*?)b~0gqn>IBgFFS@FRHaJKiC9nHb<p(I(66KOpT
zl|^EI118=2ygL+3cf+|ptG!Y^Tj0BFJ{_s#E#!nmJbaTzUvr!LaWG}vh!`U0CLEnB
zP;Fs$xc;2(eb`pX?zaY1jDfee1HJGi<%WL(-4__reu8Ak*an8+A&C=lxp=(mBZwC`
zot|-#ed8&$!lH9P#uXi1AA%&VU=QuI?<A2AXTAszITR(DVrEOeNXl`?N{;QyHI5%p
zi`Iu-EUAh_LQ6e4dnJvk9jLVy*N~Q&v-&waq1<}r-&bOwUdC04w}(}*P#2v>W9)w%
z!8QVFEHHCtA%bn97!)4}pUuTm#sWy4x`8mc2@<H|*^HQy@Q)ql3dt=^VUnvrP9bXf
zQwoK?kjMl23i5p-EChlvZ@FTDQmOD+B$>H)QYD0-biLqZuE9_1FLy+ABSN_q_Jn17
zf1mvK4}82lAOGpyFJC-*|Ia6*eGGpKOCzu#G{FM}iMz6$)5l;-LEDI}T&!D`(N0<1
zWZlj7RC6u>yJhQ)ogE%BFQbs9vnLJea5`nLOr^X;QL<Vmm{~?W$`}p`$qP1HRZZC2
zwNQdhXR%naSf&Y9*h5VykS+DM2O4#s`b;5qLlCW)!XEHg@BSE`U{I_dsjYulOyU2j
zX<dE$7<!BaiC83QEb!jR#xIPZt7xWp>y4Oxe*XCv<MTg^KmX&H`~H}|YK&hscIP+V
z@QAPQU0RM@!aY~cEmvq~6y%3FChGvnjM@<{bTu+_vPAqq@p&kG_un%>TGn_y_BWGG
zf`(@(5>Y%b*^D_W^U8At6YPK20Fs^oHg~r|YgK5yhwhWcjIQjX+uEkKNBT(*XQ`X4
z@S)&f4G3(9K7%Dfe<mQSHQs%VjY}=9FSS*H+||o#hVeg8V4H0+lQ|%FbBrnJhukxC
z9GMlnl-DX3_hEZnU1C8o0rZP8K?b*;VT}y>DHUn=k8WJv7lBH^b{&7{RK&w@&KK9S
zwNy#3BZ}K5wDUu`G|q+<tw}N?X?(zb<i;U<iyjz|y}#G^ZW|R>E+Nt0(eq7t*GkWo
zMF7Y)Ms7d%6sBKp-dp(5tZ1{_x3FEgQC;F~?+om?d#c7SAg+`-H{Xx0B+W`tF0KTr
zyEv2AwU->R)fq(qU_hV0rCMHp92rZcO-MD^2jw$H7^tLU@Vpy*c6oLew7>(!%k*vq
zZJi!_D3r=GU7waJeNQ>rGjzTCQ-Gu&Ep~m%eq0q^>4+qrYhBP-Q}wKOpW1%rKm`$I
zn+~^|`QkCpJ@VNV#dAka9Iz94y{CDV@F4uy+TT2w#$k?@(>OS}HyaLrH5&+bw&@6Y
zh>hVCJ#?PYr*D~<M6SpxP}QQOa%!M6{_?=~j#D*qs1=mPVJGWILlgh@%_W1?=h8$+
zOR7XHgVaR#W~0ipd4cSjU5Sy<d0#9b7vM(3E8#PPf5A=xKTcmuw+p!ehhT<0ayDUK
z%NWpL#}BYLcC+P4Fc0B>!P<b$*@(?kbgMJ0GbN-8rK@lkAqQ8yk}#muMfOv*=3Bx1
zI9MiFB+FCqd!E7=b19SYBIat%5Du0lbTL)r>ty(>LWo)zQ`~LCU=bv21#N!LCT36X
zwxNuLfl46^zz>X-vQHX74|tWXX@L!RC>oNftp`C3`tjSfU<PM@lHk`2X2w((i6P}7
zX)J~CVXH9^1F@Oi6Kx+TmMTDCbw~DtSS+w;nsC?L;Sg<uotmG%{1V%$v-yrbFHSWn
zS3|tC<vcW}J+=f0@;QE8@b_{VkuFq80e_^K@nIuAKR>rd@?&Ct9z?Y6rykIiHv*2@
zY(XGM_UAA0rfm>^MHs-kWhT&fHi9v?d=*3**H*(BYtANsU3mEF^7X}=i?^4|Gs47U
zr^^)L17p-DXO3`zK>=`!ab&UVnHhpvX*lWv{}SK!!v}3+;KGr%K~glFWjjJ0M&g#5
zEm}<ImU9k3B?Dxv>VE!fIaVWG>zB963bQ8%uaDi_jthl<kud&KDj0n{2El;FUS9s^
zTOdZk<dS`Fbe5*FGn3>!Vz)fJhAYWhxP#Jt4jBUNi@P;X6#-}?)qVM8Ecjy0=Rt^o
z{t!*uF&W`YaTe~FC+6c$%<Dn2=@CLfxDh|5DgiJE4y6`=qyUiIFWn$=#WVqzI#6tx
zhT+blJ%VU|13U^`g$a8e`2s932n@<4^BjtCFsAML??F&`#%v(io++jUfTaqAx)W!%
zIV(1!-~8Q0?#kP=dY3AGqfe{6QZt1TL3cGST|xF$y0{jDrIPi_MHZ32$Ds@>i+Vm+
zot_!%VqUEqowntD)^1>^=s68q7I)?SY7lnf4$#$qkJg@fzn-P-``x+0ahx1HQUh3B
zBW?5uB*T$A4SBI8%UY%}d63b_x)lN&S#4xQJz0KAIf7!0*vU@txEV&GtZN0)i^)UR
z1eMQ6fu0aQ%P0p*`u*Fdof|)y&%%5YGZ@vu1L0w{iGFWAOHo}My`R|}kMDRCEQLxS
zc1zNK`<EQhBH&_P2}tKS$zh|fC0zXG@~!jpmcz;R1QS!Hs`!w`u`81JPpQD<%nuaj
z@7vtDpg7y^FGE^?z6Yc=QW_kTa+M%zK{+XE(M+Sc)$KlYI7Q_E&$&sRG5vVEzxKfL
zv5wge72$!>_J5Ahie;gu!TtK6U}xuw{XnpP#T{QHT@Uxg|DivzvYk<uC)=EvlOwK@
z7$bJAs)4GhECgfJ^j3JyS0z_<^<xD$ElHM+M~c#jX*Ae^Br#uzK}PEU%<n*(07;-!
z$M+j?pD3MUsN7n?%wGU&KM-tx;m=A4&SJt=y4het{RwR!5jHL16sJFh^w<D=fRS&1
zJd(PD4daVgDmX0>da|L5$%*@dc*!9*^u($u=W4=NidwDNYleKyn&`=vH5r7eEn=tY
zsnHfy4`y1;XfiuKyzD>Vw>$u8QCw*eWkpi%`GU3kepK9{>WzU%Va1ohDg|#_mgJ^y
z3WOqO%tq_~5u-Ngz*U5O>Zfp&g&kaf0_=7q)S;W?EMVJ4eIt^uLm`rH5zL_HMlIpV
z@w)ivVKX+Zlw7{c7W^AQ9&o&6j2*7PdoC4#TRPK$G6Nr=bTP-bYJ+l%+(akN`uvp!
z?My69%WlbUZ|<1>;-JvJujZ94#8=egI{4hata3#g(UVJH(>Q}BN}+Iigyr~uf{D9@
zh_{K$6BK1a{X+~w=1#_1AC6BPffnT3H}%-F!jrWkEs)Xv@~k>Lsh2<_=34Rv`1#7r
zBV(71XdAJ;iyE;oSc=7N5egkbA2E$YWSg+-oz$B=&=%s#cG*KRf!>H858g<Z`)tYY
z`zfi}aa{F=nv+?XN9}kHuZ}){&S~!8bJ@c^&SiriRf@b)AcI30#?Uru8y&T0ej0<9
z+Sp|oMKBp*6Hw$bFxLR3ET@|WWD0A{x+K}bDk!Yb@%d!>OH5^Dt-7o*HRKW1PgWL&
z$fbYv(P|Pi0df|0_DO8ZccJ7y<4b5Si~Ehj&#@A9SodfCDQtVrYJYBjK~(p&PsTyT
z2%n<Pd#ckfFeU}?;anjjLv*iJ1KN*cbFmI0zoay)%*<mdIDG%!X3EXODGu;qOqEyg
zszLS+M;ar-Ae##wi)`EEvc~WyizQc&G;-XQ*J3x)ySWh@O8J&)m_y?o>27w$#L0{v
zH*kLp6UQ8m=!^RigpA*Rip>^JpZn8=jK@jEC|x%@o5L~pT(hX1C{qG-M`9WvR3F$a
zM^D)0W-fg2orL&M<*6QXGxQtA*z1+4bc>L9{)}r%12F;?S+s%-g&Yw=#?1~w)&cr!
zJ}Q+wB_rf1-%?~g*q20Ll%8Y(k6h9B4o44qDh&HjVbAc#kRhOd^A4CV7b%p$LUkdQ
z>Y9zq7$16~!QZgWX=HC;&cfQa&~CFO-vps`_=G`p4L#qp!F3Jsfg9a#XRm~#51x?>
zdzo+LY`6FI#oMRfcGL~ls>3YK_w9!qz@r)}KyYxI%p$b<hToZdQ4>b$RczYPAD!!^
zeH6EH;V4;5vF&|-PAVws!x=Lc@bM<wr=(>)cZobaC^<rN1oRLKr6^a&%c*d0LbKIx
zf>Ty#b04Rh#dfyki)+YlBF{g&`u5_*3-<EWTgoV+)E{Kg3A<YJSSZt`zF^N1?1lLh
zlRl`~o*t3cff$2rFMQ^qUF<PruO|$Z$YLQB4R4c=VtH$SdgG9Jp>wZkk!DIHA5}wO
zHoHSs5e396q{yqQt_J2*tG;SOQ%j6GTBI4gq5BPCHqiCM4r2|Zejc+R3KCEtj2HAi
zsC`a~f5dp|2MJ}e<<*Y12>@vYsDmg)ttrD>B<Xg%4SD1y+nsv&`)nh94l2$YF;6QV
zf+&L@e6bCG<qlEmp{rZ~p$7PU8%w#It@K@S8qKA=p25y}XKWj$cFH;lP9<XNJz+tj
z8#ixwe64bv$_Ni)K$iT7wEvo?O5}wg*!71Je_n%5&2eG6h1YfR=9elcTBLfR7azO_
zbJF*xbDS%BK`L!(KtstQTn(~&gu+v%2}39lu*rgdMCn0~C)mmJ7BgTTv#pmAmg0Eb
z1v@PQ6-}fO;2&{&;?Rt(wI4jlxX-tVh!3P_6SO{vvfl`mZayGs$N0VvK-=_T2NE~U
z7O5Mz*gufSKXp3R-}`GMWLHGXcmOgkg;)2H&po59#}dyxvtb=tttM4W+w&&uB2DC2
z3BXl<BPzpCJ85-S&r|gPPqJ4`*xw-U9x}J#N`(AVeo)*6DlsN7E+FOh6WXvXU?Ho6
zZ|1=&l~{;qM)26_qw_zVu?3H@_W};ZZ+H-5)TO|C)a#kNHXgQXz^3$%+0j^Z7_K-#
zo*$bJdI<A_7-2|Ro@WIu)$cjtx62XF5LvE&n}zf2^2O!b%L8qkp^cl0M&srin1RhZ
zh%;!APBy&0q0P!Mht|)}A7wzEb__uC)DuVAGbH`U+zl9?=4Rvx;eP<jiKb+hwujZE
z*YDS8HRYJ2SzUDIje3PKu%`G>j8S7f5i8uQj7pW^N&p$zmHhDB{!xrDfMPc5G4M%$
zI!>cO6-=Ro<MT34U1WVxZ1PMBFgS79U%G#W`)5@Qi1liWL;mL&>gIt>YSmPCrSv)R
z1tANw-%&n2<^af;Jv#prUg05lNO!Zr{g`$7Cr+c6^0v=uJ&pP+9rj8?aI=5Edi4@r
z?3A;>Jg9|+ks$}2YH&P5VBp(@%PbauW2jmJAZ2noJJ8!3ME*K)hdJ@iFsd%N4-p@<
z!9mDi5Z;Nc1Ty;nKC@`zlyZp3;ar2^v)i=<KV$3%5s!D65sbJeL9~boI5}j9x(*m8
z5zbSAXFX7BNVRh(ZO|7`9BpHX5|vskpiA4A0D2-5wg?4}&7{zWKKbkuaM@XZ=~A6J
zzW2GVt7z${p+6PLa?(|@IC}nGtG8(Nk1Ikyj%NkH%8#elark4Z_DaW!0bs8Qi_#6p
zVnX`n{Wbd6VX##NHG=sz6gKxXzPtyDB$5XCBTl0!)!DL;N4|Q(G@XvMF3U>gMoeu1
z%uCz^K2Xm{cYuLVy~*(l=3ya!-xKvx8YMCXvzDFyEMmzPTrIc{5MBn-M}K{wY@WC-
z*rPOIm=duh75Z&uxLXEcNHB)5(K1XiXP8|uU#9a=jP;PQW>YI7s_>B_;!2bh=VwFO
zHy%9T<!z8GB|1>q+I-BIZjPUa)}-B;c|T?P$?|gktn8)(+$+=yg_=o!Fy!Z(e5z@c
zD9cHckr5qdpNw+t%Y?XBxx}Ku6{~s02Uo7<#f?m9ZaN-gnm6cL6(pn{S{5Mh;3Ne3
z(a<;tbN9STo5*|2mQ^|#k9!#n1AHnFx2ILmh)!A=na_CQjdV#nL~WGO-Pvh#!Y=By
zHW7KTxEhnKv_@}I(V$R&BN>g&Qk~K?r+&<r$(j3IM$uL&*hnU`jB7!7z_`#RD_BL-
zG$I7gz;7L73CC3&;?db}Bb}<m^@FS5UMxSL3jWkMKCh0;yuXiHt{A1GUOs|CZd0KJ
z$>Ru}64RGC>jSI8d?wc5YH;wxt1b*df%^t#fE$j-2o>pDJ+z*GM^AZUZH1Y$o}>TD
z=1a2<)FYNuARJKxnE672x{K2&q9fso2glWQv;~>dGf0#OmtesLJ{k=%)~|p)4jlsk
z3^U*%`=9^ye;`?%2ZSB!Tv-OOO4zBGtS0Ox;1v4>)Z)dM8sa%Oj~9GPhjP$KBX+wE
z7T~Mi1n6?M%a!ndcqNiE7A%X)3gFbht>OuI^N8Nu>spc^9Coyt1`&RkJ73M&*>Tyq
zhTTCRfCck`%xA{}flV@|f+nw=rJzrNelLr`eDJ-&(2&(Mu(2?764S3mE>@;O9cCMp
z2kB@Ulpp-C7J?NtpRR#WC_)(6J{Z2{pq&kLf@>`o;PqpFF+o<iP;wV_u?;HD!g>3x
z*$yx?2J~iVFXyE;>f8qfyx~#GLk#$$%Nn^VNP5}@q=+fPYE@k3kM3$Rpz5d93k+Lf
zLtU^}K2wR@S|tgQUKs=A{fJ!)u_d(cWF17S&tTa{P=}cW5ukLzvXI6!W`G{uc*jMA
zF=P&<MF?DfOV!yx%<Eul4VfSz*-*19Mq}$uKQ+F8+Jpl%x8qK~*W5K}`GYF%!L#sx
z6#^@-w9B6E--e&Po6@clqMw-3E@mGOopt<yHTE-|R$0pd&ukLyF<9W)<<;9a-#>l(
z{I8cU{;M@_xlN5<##~_@Rz~QQ?QC_Z22i3_>ueo=fcD&t7-~Bi5njBA0pc!{bNwF!
zcL%DMKwIJOh0yV0XqXjgg`(d=-=Xk~nQ3e75{Dmk(3vu!vLbZwA&f0;8h`ml-W2QB
zXBkux)R=?*=3&UL#SZhD;s6@}$)b}E(>bWV_ZH&c81|AmcyD%E75~<?{R)cX9Wa*N
zwqRI)oK4tsoo)qsOTd0mPEJHanxppPd}%R>5r{{Omtg=cs}KcOu{W1re}8rPjM{>j
z6!X(aYDqPwjJaF56<_9qr4b7A#xpYQ^g7GsIEf*3jtWvC+s$rSZ&I+^?iyrzU(G&d
zrdZ9+ouNq-^GFfi2oGT&$1)yA5{)XGK@f?5>XukfXk(Br$3f(aJC+C@`)Hpi^q|bs
zAoS7Ta*E3_{v&*rZZ(vdW}3|gtkBnQF0U@%{PpsxWJjJtPZk2hGkAA1Wa)_mb*K3l
z+j^d%Nw^550wdViux4HKf(akGvyiBPX_L_dCfj2$|AgUdI95Vym@;3Wu;8>Gw`&o9
zi!2u<+<}p-bq^WiV9mv1D|ljzxv4hp#+0k!n08G$7ey1#mOO`oV@I9;%ii0sw{2v3
z!t=MTqQc43A=4x%J8^nnX&jGZE8XsKY>#Dkw%6?yOGHtu7zEfTP%`6apSg$KE1WBN
zpYu_LDgY!wN|x<z=h>aM2%tVsopb7ceEbfDKc{2pu}a=m-4PBb23b}0&R9+4A}Iz|
zOSbTvt^t1GgkLzJ^*`}2ZmhSPjC>TPQrJMwf4)$WN|wa+W=Gtt2KzAz@Xs+LTg8kV
zmF%rSHU7$A)iv?^kj;s?$}5(L0S1!AR#z5Xqd0K9s<eKp(It;kGgspP{z{&IrI~@?
z`l|sWR;_1oW5d^nZLsRFmfc<hWDOWX8tB8D+f@=UP?$hvS(IiDI1zqeG$eq3LQMSX
zj~uND^?3S_9FW7PUCs~&=J!kJ{C<#T#9;7P;8aiam|#}DeX!H4RJA;?2MqUux#+1P
z+NYE3ChM~-0C$x+;sd4`D=Y(lDhQ-<tW>)+g_@yTja27>4=#vF2LBM2pYZTy`L&$A
zx)o^KleZ)O{l{?dKIbQVB8lp|o|~X7#Cw3;ZhJtQz~|fJYEO1X3$%FJ+f*N5zFom&
z7COGcvI2fB54(6*$ISjT_iz=IHo?uEt<WC)tz$H8hmT(a)V{%;y$<ky)GM6L&-key
z8b5VoDUKUBQmisS@-O5CBRu46QP91vC5|fTq%jzI(Jr<)P4w6)9+16PKx#0g$Yxws
ziI3JHiOYelQ-C$i->CG4<Y$|T1^4HW#VeC-3l+$Q?{1>J;nh!HSXbT7|52f4Ti5n$
zQPX_qqI+0}`Xi{Ghb3BnoFUroy0w<WpE{;WEI@a-5P(XH3MZW`wmeUg?Bc5M-CTCC
zg;HVnbyu<;zO(<_s5m$h+C^WmA3s;;T3zg@^i{V949{9!fPR-zxqAELM91W)am(tv
zD%9I?vWS)Snhjvfym%L`lqfI2B4!Y6#NA=ITFVV>Faat*#8Do9v4P+y1vChNGkB22
z+n~1L##gKjW~f|qgK-wCmN3gaq+lpC*dMZZ*%oLyv^&%HzTLU0mqz^M$_lO1J+TwO
zjF@J5F-SC+Mw4ue&=BM~vWA#)Wdy7Y-LI|2NrV<?r|d+zB4t!JXd{gry(QoC4N%E$
zv|$I>hB7MRbSEl*vHfkthiIaj4N}6kEhI1`EW6%JCziFaorWmPkygoTZkk#^%!Tvb
zRwJr)`DrUg;bQ#rs75;wKdMMX?W>rkv3_`+*J4pTTjhtR`ePj2uI0;W{IN3E7WEw8
zLv2Rhj1!o3y%gi8Q`-Ig9Px0+KOgi>2fbM-VyLY$=E%l>r_A$gmSH$|_1tR|b;S|_
z!#u;nvxm=~m4<~6&JcF;JvB3fRsN>W!to#d%#b58V;fn`JJ&2S`v6dvEbwMKRWdJ5
zm86I?c4}W&#rLgG31K&ci*e<v#5?+>Ee6g*etWmjrjO)Qt&_{!93O7TE+&FUP`JX{
zhDykc_5;{|?l9U3Qb}3c+sAZ1pIh*uX1V4i^imD^Y;M!6+?g~2eNcQR5uH*N+|o@S
z&103k_u~mk-h<C)^z#}0IL_!-2z%$B)P=D%px}WGm8TG4bU;z8Gyd#-Hj_)y5x)-x
z-0^Tr7~jAqHb{t^S2;Iy$U);6^iO0jW(z3qE{pMhl%v~yH(c5ASEk-Aa}V*7<8*N5
zHdiyt#VE<nvPFRjOc3&}I66N+SNXu`SV6WYOd6ui%eq*!fSyVFruoyKEYo~{?8))v
zZOoExT)s83zY8a;dN?ZWU(rrYxVJ)j8X=0DkJhmG2<2ip!5`pAT<4aP@Ex2&yW6=c
zXm~h(peyfuQwaUa-qu^8w=!|JZgn^AYe^2$kkxFS6&OMrUgih#f)KS)3BrA_blJ$W
zZ<-4KsMgx~j*AfRYp3hIuOU^;e#3Vr=nvm1HiC>b8mQp2YazylcHam2JcmG$CgxNM
zGh7Pxk5mjv9GE#ku}vY;7?jCBP*H3VXPCBsCy7#PlAWy2_#-6U$(yFWXN%pa@7c=_
zKz&VtW1A`G*&>vjje${Z=y@0G@`oYpXA}f*723wJQTC)MawTU2O01p9`5{G0qu~@E
z5jONp<!3fb8gd;57r8Ff;6kUStp0G*^!)&nIm0D<q4JqdW%7KHUhCbn1#K7HHRSAn
z4k*#o>`Ln1G-#F|kjg`C;OMO!1C9wq>eW<&+OT&~H}JzIg=5RscT_uyY^KLDNtT=}
z>~x9h;lkP-ePOrVL9SC;Fs9-wJuf)ReUT101=|b#iG*Fw0`qSu;njz|;YJSq^mH7R
zb7OGoLaZlvmWs-K&*suXL<m$)sb>9uLS%EIKa9)6*1p=-#bFx0+gy{;Rob#v|8~({
zXh{d~0WSvJ4Zziuz|ady5xb6B4;xM4yH!*P1NZ+~s;L}v<&-iu3iA1+S*GJ@o~7Bs
zB+IK-3c1le-wsQyT{QnTyT47Q#z#}FtC<ScriWg=e9Y&{RUcL5sunk<c7=$4UvAG`
z*OruQR0$y(L8ZkD_HWPU2`2*&e=)!T+;Oo(eK|KOZ=otS^YPXhA}hq|0(;-4f+a`4
zVy@LZkz=+d>+~$~imz4@NpFJHmUOV8{O)E#Si^BYN{YBr?$G<D44))cbM4N}^Nj#A
zaEB7+?O4b40|>4K4Q#zz_<jg~1Lf6D=7=ok3<3ukZQP9<<q(7RihI-IG;g;_yCl6{
z$7ZcOJvX*-TOP3rp!WMaW7m(ay&h4!^~OE77}z25w0G8S<Q7tar@es#wcU<f{Y34$
zGa)MYnxpjrj?Z<JO}~PEd#xqYA8uPIopJY82&kKrMOBolEAPUt%H`F6kIgl2OSMG(
z$EM(2p_FP{^UGER7_WoLQSrqsbNY=k1{?SUDxo?&`RlHTdY$!4?TQlOQP%})L;PNr
zsNSJ4W%2b8pSH|tK(mQ3*`xsc&AFK8dZrNqsjRGnUI~V@H68+k5A3w6NM5CAI~8{i
ztF+%7e!>+iFt$FA+g4<MyN)wiR%6@!T)vm$i48pPbLqsJDV_Lna)^d9VjmTkxDt&0
zhX*ISqH0xP3hxDlUV-ZxktJ86(L2y_h8SN9FaKd+<=-2mypI`we;X`#bo4X=W&>Zb
zSfQ&hvx9cp;AUH9^*-RjKNQgVj(l?zSD41gK@IQ3B_GzB`>6DPs73k+DgelxG$^=5
z4d3O9lmelf+Sw8nZj*E4qe@9#`FwTP;N<PE{ccl|%Z5Z7+}v^}IC*FnTsvG{yof;y
z;Lin0V|-(zGdS*myU=-kjaYf%;GrKH#QVj~yH?BtJP@0gy=gW4mB412rhTmt3AdXj
zzbZK6<2ZhG`o2nkavVl;crD8DoAp_7i|u>;0OzR8vZDdRzi#$y?NWCE#WW%?WJxLe
zWNI#KAppivw`zkoC5wht0zVgs3zH9KGL;azjHPd%TUj|Eq-6*^nL}6*V^aE95ci)w
zx*2~8>dG(lOeH$qHXDRB?O{>>{N{jO8tKPZklP=a1a75&jLxcOa9r*%HY@#AvQpUm
zGnKDwDa&I3Dlbo+G-C=>HRJY&&FFNj+7F*X=G(sy+hz(mn{zx@IoebLA=AMHb7%V@
zLo902ZV3Oh5Ipv@9i>IS+!{w@rgl{U*UV$P`INde+$H=2cA8~iyjwc~``<(-5Ubs$
zqbtp6x4Er<=OnKzVfRHRT_j28b(<NlIM-Kfta9qF)>`HK?%r6-*L=mnUusejU}pF)
z%|Z=_w@PW)^+L17ke!5RDF<pYL8oWiDRA$TS+|_HzejxJu}lNc2mX!g0{;ky3BT|$
z-?VAhaQl4k2upp@0q*-TD6Pi?dH}XZgjL9l8F;aO<!TJ+qNJaRiBd7wE>VItKJmR1
zL*nI?RZVJhvsGLc(x~E?X0dJRF?~EVwXaKE^BNR`aExIJz%}mQGna*B_mJmTzQenR
zwo|OFT1cI$*d=nEE(@??<B6L~4t9qhu%Nh&lOY?WL(M|<0lK<s#ubfr%Pl{qq|U4D
z{Ls{YTKVK|8y{5nZQPUhN9igbbo~|Tv&z!L7>F`KgtvLXp9YDFPhLKLJdAY?z=@FS
zMzjv)O2G)8XN$9`m}aRm#g*$-??&0rsSfPcS-%z1&TGwlip-7C3vzvSrYMaRXXWf1
zn|L45M7+qcxK)W-Pl-7nW_!n3I@a3<n$|aexZcpUZt)G{giTbQD{FElE6IL;8|}CO
zGmMt(gqQ53T(b3$Vf@xr2IEM${XyByFzN<NMj={7yy>uZ^U>Hv{ZmYX)~=8aG2|-W
z<|6PupZ<u>v;I}>s(yr@empuyS+2bO)$%NtI`wanXGwMnl~a5#u6GG<Z?oLO2ze8K
zT98*!iu7lofa}cfu50pEQx{2g24D`PsY5W!M5nrNnhtHk&C>siY`!D;7r~bwnELCM
z`rCJQGSttMgn*89LXJ<!TI)rp$O;L$(6sX>xZ@j4P963roe;x3fjEP9AMyu$5!~WK
z2!z_I3%q=8Ih<DC;7B&TxyED^GMBA?L^5I)`K+&z;W@Jg{0m0gjs<=&mi8i>Unf`l
zf$V&x)d8d*;4hvp#S{Q?axQL-0a})!X>fdE8RM%bO0;EcY|#1(08?cE+)$Vu-I(Xp
z#K2VA__QVc^*J?jZQcZi=PaL*%5Xv0mZCG&XVZTOT>&V<C#mZ^Th#i1$xV!Zr+~VI
zL`Tt?UU4>xCB@fmttBceSuFkIcWuRFwzcG<E_F4_hyGQ)Z?ngZ-iaIHeAMK`U265O
z>cmcW-Bq+Cf{N;zU0mBWwCv;Kyl*<IQ7DDH^HEw5KbqU+)lEfoBL0!=L|$O<wVH|=
zPF5RR(T-=U6j{5@Vyn~X+#F$lVD%?(Zkz2yAN?T)ti2<MuRmU#x+v6bl}QZHAD9&_
zd}vh?VT7*`nvHo6SNPtBqt=%B7$2-UeK)N9O=`mf(paqmHXjR{@sXjTcQ!2!5c`qP
z9C0H!n<F5WNc@Na6O{X8_iNM_BfIt^1brLPQjQ{Vtj4)2C})^bg(z8nhN_p3kSsa(
zV+ZxHk)HieTA+~Emh<XoYWU9o^F(jThpP?Y%HZ}*WbzPLT+)0;__hhP!2cNIfiZu{
zgVI6{{1l1&3Uqg-0DI6voB4g>g(Fr_`WImGibBoih0UD%0MznO8;}64C}y29)rw?>
zG4*zXSwp3$U%|vbh<=uTD`~QHSEhdXKJ#PNAKYtzln#!doD_JU2C|^?)mJ$04V^to
z&t;-r1@*QE{e$oiBPXg@igTHqs{^n$jP+@<<i)|N;a=yFpj;h;>68|DbVP(T5=24k
zWYq`YHAipfNtP=z$NaDuzfoJ84iz=wOo*qoRz42np{CQ_?mP#7>BqZ#X14M}ri(;^
zK`Tg?SQHuB6SGB5D*O`dj7q)1D9kJ^(BAm>g``SKqO(*o|7cPxylZ0nT#S=nvsC%l
z+m|mMTt}h>{P%VjLU_9)CA{5<6y9#T$Zxk=<r}?2G_jWJG$G@i+xAlOO9Vv_u}T3q
z1>%D#2m|})KvE%pF<6*!udsRtm)GEUQ=^KgUYhNNE3_sc>Km{P=GlCaAj-dbi{+6h
zOTEbaLoGBx8e~CEJXAQ?f#K71ufXK5$lkA=tv4rSZ^PBM<Isq<{UKaO!=ZS7^z)-9
z4-dq}RHdSGt26At>^tKAlZRqNBO3vJgi%<%VvsAuDVWQDGbL_`xlU6RuWFl%X;Uj-
z8S(V_qdz`+a{sX~shpc>R*0_s*RlG008~Df^J0-B4#cX~F?iZF#TZ2d;~+YZGZ~8+
zkR?=NTFl@`WVu)vgm%#6C8bHMY9GMQS@j&a0YfawM1!e7rmQN(+7KEss93o^!@3{P
z^xziQ(4rN8w#5sb#=dO5g?SpV_MfbyZsn~hJndTqxUSXKiLM9_8jn5QP88;~TuIk%
zX5*C3!EpG@oo$Y-t+>LM`EfRzX9j|b-l!$G;AyN49NZQYfQAN`yHmngiSEDM1!z}1
zWFpNj9CCh7KyCrz&Vb#j>*Ms;Fz#AckkqURhlU(~nwd_Eflf&rIT8odex2xI*%wlz
z>f!{IvJ>~5pk-|0%9BB=F2r0XNx$ABq0$^5J-h$>{);2An2$58KF}pFuR#oQs^=S>
zc^TmxxYtiGiii5WcJcK3aPMC}|F`PDxg5WdX9_Gb#c+&@5Sma1bhx5l%+>qY-{1f4
z+iyjG)9>)#t#7^+|MJb9@Ahxq`tG~^Z^ggt-}?6Uo$tiI?BB!!EKDKuf7#!^hDq-4
z?+f?8pU8j1p?HwZmpLL*fq;GX@Y#T|ivY~5$o1(0@|pIALvj4<;r|>w)??6f2am86
z)kH(S{r$NdPu1Xdw7*BSpv1e&&&TeQJO37cEOnU5nTiJ`5+l_c+?5%uKmXr+`-ktU
z=l{Du?BDu){y)j{Km7V@jI@G_DZ4W|B=pk^D)J_J3<ZGXlGO|bt21<$(4e`badr`j
zuZNbGpjk#dJo@qe%f~NHo*z9pdh+7rPmhjYJbnJxlZW^JdMxgWZ}t!OCX1AGj94yz
z%@0_Nyqjhhk4)CbpL(poQhRB3@skmEA>~9xbD10aa_?}DRAH>j2g(n;(xvwY*pm2K
z{EzQWzTMwH*#}JDB71cF^cYq1ZtrmK5*A@kd@Y_UlO+JQDeypv@ify|l9TUEqX+JU
z9m4?|dBAdb;@Eo#ZFMzzJfP65BsFk<^z7veFkcL-=XBJw_{dzOHrf+7o>7`z;9XCr
zzaX4yA8pt0YMBmbmZnfMsPjI4!v&(|di)0JddpPIb9JuO1+)e)19oeIWg>!-Pw?o$
z<442$&mN)8fzTqsXaQ!7ae@GRx<D=3P7uDK@`ez)e=d`SLa4?xqp^rM*Asw$+AA)U
zas$Ecs7YKFH`R_zlFq0^UIi3|k?1Z`GQRXgE{iEb48a{R72tncx=<H>UGvDaA#fo%
zE}(`MT>(@&&Jd9ZH04g3xh3d##9ZaP;1H^*e^u3;{>s2Ui@ZdxrRrapS*a2CQY8~1
zVRI5_ikHn25$zld{nTK<Mm9lzdk?G_tmFhR3G#WaS(A4Yf~U})JBp)@U6YRW7g*>^
zqZ4Qw*3=zFcgS)g?k7OmmDzR6F<#h1rze7cj^5}r7I*L76}U$|?^<ck+#*Tn5MHkS
zmU8Wb&*@;}0lmxX6yaaL`(5zo_hMh%3w}9R$6gMr<9lb#*de2_T;|e$A3Kc+-xqiB
zMh?ag>Y9Ir+1QJHIZ}KW6}g^ud*x_@Uk|*MqJHu$D`4{X0nR4U2LIQt9bIfs@SUEU
zQ`xllI3o0jZWsRQiM!w1k;C7$5yOu>rYJ!#CM<E;g+ET%%P(l+zx$o&enBJt?Kc{_
z{TzDO@3kNeyCZv^J-17L&EK>8BrXNS?)Cb?OVlxs-gx7t552`W;AIV(xdcA{kE;J6
zKNzGk&$A1io(){^^G+(@TK(@fTmY;3-yiPm-~O!seVY2;5SwYB9Taw4*YDxcUmiU;
z8k9oK2@oemp`{F~8v|OjP$@wB%@BoG&p>DzFw7P@9T%j$$W%Ok{rSn!^Rm?}RngvX
zXvb7ntVEX}dk3X?t$yn%%%~4djIbbd<MSRm)=_%`<8+uSAOo0eXvq!GDNP`@Wx7OV
ziEs}A316mQmB)77n*|uHm&FvsG_-Z9#$_Eg`dS;RxrvoEPF1N?0^oC{s`XbTDE$bU
z0}~LaBU1?lI)zz(j4>}Fn;d|?HqDaQI3wr)`t|l@oW)Kr!QDeE>o`|PDKd$~F_s&}
z4bTPct|>Q{ASSRt{qv*$e0g;ILKGP^M8ssZ66x!Ej6*I{!s+&F2VTGvH+N{K%O*`$
zarx>|YRj&ksftUw(MHTNtWrbDlR#r-U(5lI+G#^Lj986-b<EJxM?d~}gwX3W-#zqa
zWHTC-lH;i`I#!m#Bk`!9nI}q44q)jY4WIT=`E}?*0MVTQ)HQCro`F7wMZQzSV^>~9
zlaNH6@*3^YSLo{wRJI>WeGz(X)>_3S&7o7jb40(G&LLj@9@46cBm)Fbq+8OESz#kb
zRH`(p-?#{W?n+=Od-d(_<&%d;4<6rte)RC<_`%a>N4wnrsyDm(4Y2(+4;f2HPc*?N
zM~`0o>F9ZNg6<$6Fj!QHmX8Ogyahx}N;h}$GPNv(^leYi-lU?gUC17(HGF;jd8%-a
zMq`=A8cg|cZ5d(1c$JU^oHvTy8sWs?1>j{mQju_fpFv|-|JUG!=FA-!ki7*m8YS~Y
z+v^xMh4}fl1#3aTOBD}5Qb;eHPjHjUBv~R80A~sI1>Az@sfQO?jYo`_3Ej`IHy$}1
zBiuXti%d*rIU)B-cOkbQ_~Rq<gxh?YAN_qHldc<gpXTCUg6Kqmf(x0R6Nt?B_1xi5
zJjsZE6HbyW%Y`S+N=ZOuRZ0!JOr-AupG&h;_54;fIfZm8baCidEf5`I^uN_coGRcR
zxuUuVzyvGWH+XGo7c<xSx;bH9t83aYn$V(Pxn-Mhg`w@6uxY%}|NUS8&u<Y42>jNz
zh{Mm19v(fnLc;EHZ3-CC)o_FGn1CBjPkbML*oSB@;e-%VdUpTCpHA5M_4GNgq2a5)
z{cZSqcxaE%@jQVEV06O(3T4x+iA+FHfCkMDeGzBHz^F42qXWl%AtnTWf~b_QMUf>~
zUpqY$mU$}hheCB^F^cd+#(6e}&=L^gqbM3du!v#sA2n8Bu7IYvT|5;a8>CKAf<p^`
zD8n4J@hv~b83Z;HU7&Hq%vFLyrz@#P+?R`Nk;Foov7EDBgmu`x5qeEQGd4-ZTAZM_
z(gQzE^z2l~Qz#@36+yssGSN9)tZ62_>bc~F>!KYgH2lqx=iDU|Q)FO=x|N;mx%)4?
zjQ3yohkr@@-R}rP`U|)VN1a}93%84Zc2~T5O%Ff<cFX?3T!Z8Aj|rS6e2Dk!C<<&F
z?48GUqj@&(_73-|5z#ue$Fn5w@VkYX(v%ubfPHJd1St8wPLT;&X6e{|<z;>j&9PAn
zbz(l=;P_W*EK^((UGyRU;$jL~G}3_G$cQwt(th>y$q^7pmZG^Z);Vb-sN0r*1RZMP
zMvWKn$I#tQ*s`V#I?Z(&+WH{C##A_z0tOF?bw-+~H+*Zw#0mF1OuKZ7u%?zZPCitL
zK83TaD6ZGP#E4VvPv$}<Z&W^@ehN6nF+{p6(S?emXvj;9y1@HFk@4vTDMqI&6K|B7
zV=EX+zzYR1hDEO6lM9*05Q6i6H5xhkf|^2`=vaYfA`*3`3q7OJc6fD72Sj<6k#&)W
z2d&H(`8+eq^dh)EP7-2Rs5f6^B(V&SC7fwFH5^Trs)7I5?w!Cu5IEyVaAiTFX?B4d
zf(2p5z<+Q!U?$EM28#TEstq%{|K!0DSobV08pYR@*G8NcU4oF`Ks%CuD<Z(P)2@Mn
zO-37O!Kz1U=W4Y)CR@vwh|^&vf(gzE))oS4L7l}?J=S2O<I}g%O1vxR61bS^@e~!5
ziMl{}K!+vJYkD3ZHL}oVvJ~361nyhQw>`$)G-F=R5?E(x59KU=tEoDaQ`8$x!|?qh
z^D}B2RwbfCAw1dY^JIK~`ivQ~W8PNY2C5Uj71{~wX2PnXLcO@oYdw|2I;<-;L683?
zYNKfAf0dTueTzFy0;VstlQB4@u<KX)b+3Ub6R9AvhAhe`xSAQ_)B~yq2VB8qGv(fg
zmROaf*Q1ga%BJvb%%0Ombm&b_ukHZ3Sl$s(3@{QPPEX-xR}1xj3iZO!s9I{>!Jts}
zcGsp9EjfXN$FJ|_Y8%!23u^nf-}r{HB@tm0<=XuATe(o1np#B<WdlqO?uX~r@J>U8
zz3b8ea8Fhqv**ak!=`#Z2|Xk+0c4{l6Gi1S$W-81=u9rHT?Q*x^~IS6o02uFkRFMV
z$<}`2IB3^-oQCLspCT!NR}y5b&NM@PdAb1y`WbPqrI6y?zb86<BOc;wc-MVSFI-v%
z_I!~58ZU%9W9<j{?G_}waLlx$AS76fdi4s2fqt?`0XYXOnej*rzQ@OeX$oyY7+QF}
z$69OPB=WBAWSC09C_`Sg@){3~++I1LzCRMXek1Vqj+2FdEt6(_bv&LCBPo$f&-K)U
z!B4X^LyM^yXb5yhX^!_i--O5wo$D;YlVUR55~r`&TDf*JPSrSr5}l4%a8}>cXI0ua
z`kR)RXy+@#V{xO?UN?QQNC|%>#vZ?I-DA0w+#Nl0-PwRrZQPPQee(FPaK=M30dcJ?
zFBLzgeIN{fo&sE!et7!gPeQ&0zjhicC{{yiLATUNWQw=#94gCQ=(v~)(g*-zA>}JL
zo)hdEQKR`5mcc&SB7mvqyY(r7o9cQ5A<sZnE5!XLf3;`TUuT(IfR#%+-34U8lG}0m
z4AT3bj~=`@dML6*L9PPy%$H7LnCUo?Gq~AtaKoy9{e>?{mvOcEE~c57X#*}sQyPdN
zBqZSwg}*PfDiS+1(3El=$I7|;pW%JcQ~Yi8>d1HGjcAR%Tkh$SG=8%1(qQ3o$$Y1Q
z!(KWU`^MV`>W#q##N9i}OGhLgpw-@pIK!z@YzEwctwMZ&V}#a9L$oCOGgymVbd4pu
zF&4CcM8l9P2|JNv=$5V%&=g`MmW33pdOgThqRu5+^UKvl&rO2aCpvW+cb4KoKx_Nj
z7=a^uo{yZffb5n!oiB<|6J#>IyV3|vA4T-uLq6u7+D4D*%z5Dg9t&y;Ie6zZe9jIj
znb3h9)4hAE?61@(T45WU|9t*8PKn2i<lpmuz2(^bwu9zgFKZeMJ*e2{UU<bcnY$!Q
zxT<jp13x^)aur$SDK+z4Y3~F5g(NT?AF|!m8BlGCfsvz}ZbM?GO{VVDB^X-7gpG3%
zU6~{n&cBCq>N{H`PYEtnHMORcHMK~1l*`>O->r75ba@*udxxQtg&J_^;=<+VJ5QH?
z=P4X{nGGw#OrE}hn@zJ}+L9OrNZc#UwSAs=!=qj;zyy0(rGVQmJifc4r&VwGwBNN;
zvVj^;-!z4V>_8?X6s+uECXus#|M=Wo_Q;eTTiu|^gy87p1CqpcOycr$xb{DN{5KUs
z9MZwOmeh~U@ju^vvw!POHU8(DZ{YoZ&+$K>VEhk>i6>cl1g0eNmUC9#-HkXWhn3G?
zruy#-MU9xU6%r3r)UT;0Vu&-HKB9MS(GNkXKl*8b9q?<E73>B9jz6f?<c)p;3LMu;
zP?%NMSv`rDxo-M&k?S=d{iszELrg73Zr=2ikMZRHCnQrpkaNls)T+Aj8=*3PniHwz
z*;%g6q(vv#+X;PReU3J!6nIDum}S_I7>n<nSkKEr<Eq!cI?J=g{N!}G?fWM{C~ZHQ
z$+xXvg-QbLUNw+{y!qA2Qmx7#_FhwO=MvMLgAbWd-#f|*U&l_$g!vti=;hlheGjP}
z>(1nc9Bm(i5}LX~`R_&!P-(+|=LFT<Z?LnStf&s!ym9qiu{&SZw<s_(_Y9#m6Z#`*
zSu1hnWY$cm#A&Iqxpk;lG^r(=4%22gTO19eWImq0Cr+2Bw_tiYnZTJgt=WK@Nl38S
z;<N2o!et<K+*_B2VKg7fnIL8Vio%89I4VN6EvVX?3Q~hJn=$AsgvIB7CtUAyCFSz}
z_y-yq#sZ<SJ=X13hMgS$_zSdlVf+<&Scd#k;k@fv73czxJ`n~A55=a#PdE?l-VIPK
zHoS@$Bg^aI79vJ`ycK<lM4qY@4|mW2NdCQpoSNqD(k#G^{<<SB{qN_w#&TnC)be1R
z;$MEjU_Wb>RUgtMA)Rx7s^{iIDJo-`#{e5sfm@qOb25`DVywZxvvdn^7>McBXKA=_
z>-CRq^%Wn3=K3_8pxBEy3q;&57wU?d&}N0F8S=9&V$}Lg|I#(?2!C1>b8|2Z;5D-R
zY#8TqQVehJ-`*eGx;>-^oee0Rt<;ai;m%zLPq8XPQ_XpF^uTF<Y<^xHy-yL;EP=Oh
z8`X_(HCa+@0@YK_!5?-4##96^TtIe*Izedj^~Ve{i*JHgxJ6yZ_fT|SnUgn2UeLs$
z0jd^`+weY*T!Z*`?7(gx{y`@IH47&i=&d9~-*2Z(`Km*xG<=C*b@p7&<M|wXaC`&}
z+d&6jw$X4ux)tqz^VHlC-|l4hucEJbV>#hEHaDwTtd<_@4tdkXwv}<AP^oEeFIvf@
z?Y*v|0Pnz6=Xq9S<18sxzhv-C9BcRr8raPgOs3be8;weRwfl7&Q|jNlNS2d%u8b-^
zm{z6ZZ4{X`%yJW$>`DOdl{38(c)0s8NuEv)#H)8!hi(>soFJ__uVJHKuWzp%D7n)w
zw=ykURn7GOg9+{O?dAH%ZA@+30I9d=cC7`gr6p@c7u(5qTh!*g2>1>5HlKB%NIhsU
z0D13}=)!!w)|vqN!6H|NSRd9JZKTTEaow<Msuo=ny{MyDmX7a`tZi8E234g@R>FC>
zV`jP*;L(qNi+bmsUU3N#9{5s3ANvs#-h03MoyG0&e#CGn9tgbgMF<vBzS(O8;7}Lh
zSQXu-3?loC_B8@z%%C}lGH|m-h)-FlquHs7V~C`Ji9E?-MM+zIjK1rOiPXs=SH=(I
z4o6HmUjA6UY^zrgj`_Bar1TmRDk$wsfoD^hZm*huW3^^j&_rL1zI+D*yBvP`4x7Fl
zd1GwOzJkT6g<;XKy)B}@{oQF;f4>=jmT%OuFUC`y#5hUb0Xxh33UNXNe1Nf&cl~+2
zQOk(4=<g><xAT91p#RT)rx*M>#9wc9dY7ZaAcw8{MlER`U*>Akfk654mw1`VnI1n^
zlTHtR5nvo74%D3c!bg_*?KklS{v1)BFvMYYJOA40)i%wpKP9*|`2}NCi72qahl@(H
z6cG_l=p3Ci0gZ+b)o#t2_%DBaAc9#1cscj@#{<Es<oIW=!gm`fX$@^+BYkghRhqo?
z&mK*dwUH(Bn?6bWkCN>)Fq`s&S2*t10e4A%v-HU#;SwQGCdPDW$l>((%n5%w9Ox!5
z;4_;idM|<*9j@R&{Bje&<VP-{6q<2>N<{Avz1`_m8H5{vpH+=ON!|naw4qa*b?V0k
zQgroQ@ru8H9l+e-(>8<j)_5w-(^Ng7m4+sHiTj|qW*4eLN_GINx29o4US7>Dpc-y}
zIhsm?qcpGfUx%a8<`^AsVC(T!$IAY5FRSNZh1n~6a$onV9X$t+X=CfKfo+<$&gDKV
z@a$CO&`axlwkGP`X<o>Pna=4pNyinK4f5d?&nN_@w*F(8$o!8G{czQ#w>HGSXjrPg
zSiLn6xI^_H8i()^uOEmo20%yO2I_@>I0DPjEdn?*Y|}4O1xRVKv-A`Md=oSS`lOn6
zzDfnfbH-u;c(&`PyH<p363}Y|vZkq@pp%E(Y$tHgJ60d`ge*;}E-Npq>-jPT?3@(m
zXS{W^>*qb)bp^lh+VECw_k~!{n5|-h&F#DhR&$_>6OQt^ZNj+CqyK$G3UgI|@8(2Z
zX_QqMhkVBwe)-P((rSa=su_32>J&yVuiGTnI6Px;xpAW}-`Npe4!t)<y&CMoOaaq?
z4Sdz{ow!`*wc-Zuysm4@w9-}udPNPs4t3u^g(}T{t7pf`%Ze#|`Hp(I95w83^$q}L
z6W%=dCtd`2nIrUQK$QKf*S+R{%g?$&!q<@<VB<is{o$AI+!!v0^xmjfms{`1h3n~)
zo2kIRQ{vb6q99-i<_6%5&BMblhQSA;7No}=Q6$g3C=9xx)m+;leK-ui+o9u1+)n$R
zD<5t;7C~4fhHY^OqyO&{j(hFQ<Xik7O_q|yEIc$V=I4im-iz#sYB4>3|HJwrxpeE>
zR*<&Z=vA8KZd<?O&{mMbE@N9k9NP@8^{EV$<@SejdqS;|;FjyWo+KNT+nc1%aB#ta
zEJs*XeK!v<XlTRI^J#~(|Gt-c6UE%fBAdm`j>z31?tU+JzT9n|iCN4>&8AWp9iZgw
zC!Fn8x*N)7RK_Ys-0M?+B0vS=ZcqtE#X-l{Xt0YHRO?rrK-(wa=2&5<Tcw{i=_*j&
zd!0Ft=h4bY$J3W_?51B=f&8d6)Q8vaivK$Aj{j4zOF_Wf#@(t71ozGVH3DDRd)Yz1
zmlKKw*>*33$qv7KS6iq{EM~HPcWbk4v(NQ~gB`Cg+~Mlm*mHk>@Lg|>>~S_fVB|vm
zK>M^2oP7EN>A_!fZmyXO>J(|I@h3U&t|hA(yx>1U=J=|<pdq>TycK=_WL}x0iiv}|
z%LlJ=bf$`M|AH%O*iwsoa0}WTg-xR!AsAz?!B4;G<gGt_&aA)@n9bG8>CpLtirydf
zR}?#JK1(c|>b~oL%9=I<7>4J~yN6TA=zplC+sL3-FNTy%Z7$4K+^dklL2&<Ubzcv<
z@}gH?_v<!}>PV~7-}`*D-s6L5R(_asv)~U%ZoLoax|$AD3`z$xrJsm(D*ByHX<fR}
zQ|^cUz@yHst>aqr4QG(_D{5%?<vXt@|L|G+PHqZ(Chod_z9*XB@A|l~cfa?byMVzV
zq0u)!+b_*RuIVq_i}?5ZkgL@E28n9jy_?0OH?1~;u`W(32h<>^UA<UegaYNN22{T_
zHlWs~zhb&IMzs!QmFA79gn*0joG?FQM@vzVt%!6``t^SIJNuT)M_l<v*v|L0536)d
zcNK=pF^_S7fUS5Yq$8kfqs0V%`)$JnDw|wir{8{S9O>0v349!=$0if{svTcrNPk9=
zk6S5i%(3vxjrTBqjd&vcLF!MS)>R`hH>&%tcU1G~ulIF9qt-WE(W)~Te)-Ou`sSON
zn?f7bRL&lB^>X&r6GKl(X0N!N)wFOs5vz#Xzj4=pxU02l_$uXc(+YW#FBn6Uc3GPk
zl7aiK`KotyrL#s8H0D(jYK02ALQ+)-BAm=--Se^%UtL`wpp?o2HC+hI>N~~SuL<Gn
zBUAR@&q}w|^3fsf+Quq>;CpVgLJ=-1{Devw8(dI?g-x`f>J}@BvDW>jHG?OiB2k&c
z2Eto^=K*yMg+~8XKGo_iBQWoWf(=TT{DozjsR!B$kfFJj3@TlSKOaARA~@lL0WH;A
zI5f@mN}S)h7Qt&XetdZr3Q9YF4@KWUYJ9>xOGSeey|QgYJA;Eg(a11~65pF)Y(0D2
zU=rJ`(0jvgBQ*hGzB0*hNenPKuT4=ioYZfBwA<UV4{L4g63uYfCYmw`a_p~OYI<SR
zaMAWV*ul(q7&NezvKfRiIb!tjsj<Le_QuA;3(O&M%myA{ZVI8o`O$t>RmWm3mD(EI
z;SUtB)#c(Ew$3B{xkwA0z@J`C74OBK_`d!Gzj5Hz9<OptvBska2UTEs9x8~%!kJHh
z_<Bxdn`I1!l2I|1WB@4Mb#eXxjA}uJ0jrSyX_-qSW}&wSbqB#p?w4-%7U&wks|;r~
zuS-j%@Y;A>DZX~+aQZ#*wzSmoy!jqB@c#&dgV0M28(cpQwb!m~+3ZEOY<inDE5Ew7
zl`Er^OM2;iO#%H?Qe(~owt!nfj>ejQ#aOiv7dnZ-QgJd{nBwGAVQzP`c1z3AvCGk^
z=0Lh>cfR(s9GlWwuFgb5&SeYj49;=@TE15H#U;n%KSI+b@4}v1s#iNP80_G~uovq3
z(`PNXwz-6g-5dE!0CYf$zxnR9EMCB1%C@)WGUcb&%xbRfBoYBXR|SAq)&K!^%*qFg
ze`mZP#cWgFYL<dMQs)5<Oso<`&}e`uzntk`w}Vmg2LP?OPBx+|L9mb)XVZQqWV+<s
zWPc#2$3ZS~zmlztY8*Ux-LR0hR%M8|3CWuUpcqwvI4?H=MpZSqo$#V|&Ao1>kTy6U
zC1XfU0d<~Ebn8#rWLu|dtc<B35ZPHFf7Q%sMb=}Zcu+5`hE}Q{2UThd0aw<Ie-(B}
zTOg1sNo+|BS*nm2+;|(QqH3w7a}c~?lY;#PZEnkZb8{!y)>;At3~*ykX2|@@?WaP{
zCkvxE3?7Vg*}|+RfpMZCT7H~JJ$rvpuCtjgusYXD_=in!xLarAx5&ibfGgRMe>A@X
z$OzTYI~ntC?TFfEo7n<}F1Ld5peiF*!+&gQGtBvKfHqv4`oD&m@0j^tZbBWK%V7Y;
zvXBEhH0uN}XC`?t0sh{hKratoD`EV=sZbwOBCo?Y+(}&5#OKD<2(L2N2>N(4!nlfc
z-T;Gm?P9jnzYiLTX(JGqKifJif7m858}8WkfQDbc+<IREi-h6|xUHSBfZAd9B-vSZ
zvdHy8i8{X;Z)O*0o_Ut&@v?OnMP^#R+vdH?weor;LQfO)J8e@t=%_WwS+1R(aLwjW
z0ro@|2W^WAlpo`by~X&oF$)!A9~DOZPoZb5P%x<GkmpFbCM34CV0`Q7f5<`!?Eu48
zQ<hdr%qwV0W`RSvM!>plS7@grwlzFoT`0P?+#Z$9ckC(je{(0!|B=_v|A|;f@Di(!
z)n9x<^`C}HX8F6XZ2FA_Ht^NL{Bt>^fA0EEaOcj_VWILF#DWg;MLM8+_?3!5t*!sG
z|LyJlTh;nccm8na*5~?9f1hOiC$2CJO+iuHsWj6;Sp;>SXTPx5-b|^A9aJgB0(nqn
zGL1_&fvpqBC0=cr)Sq4+zo0slScKJ9A`m)ug-NA>BEA6sEOS>w_d@5YFP=PoAtW^C
zs<-N2sl??h!a<jVfuSqvMWyE|!J@QKpcE1uV5H-0HitN6XpTI0fBFpE|F%A6!E4}^
zl_Wog!HUbLSuqt*nB9n}JXcUR7rLa@lrRw7bh<3S;TH}p&ZvHLFbC1qm>F{+^B6}o
zdiL<yvy%r;A3r{N@Z#z7lLt?qJi&jBKscVtLeE^4_L-8Y@y7}NRqR4(C_Ri-wR3fm
z>jM0dqj4e^F^QiMe~g=d7|;(`b9zaUYSJ!B;ZK1#fJ+<ZYMy8DVywz?w8V8ptYkb$
zRDr4FypNblA!JcNt$JJgmd01)ODL!7Eebd-q0FZ|Q`ojfqAgs>Zd)c87G6*l*2Y4%
zZlzx^Z+yN;AK(~|m^8v#wq<#D`s^<d%hL6eS8Pql6I;gde}MaMc;ww+u}{?g?c4l=
z{|+CC;I;C%#y87*f5Ru`L%+5KRF3rCcRzSq{v!2WpucLmcth9qC%)DTKHgX*g><i%
zKY8{L-l&s_9D@m&UJZW@luF8Fgx@iev=)(Yu7HXVJ$_+8n|&2Uk@b<oXHo5)-s{L@
zdC{$a`$bV?e^C$dJFZHLX%`MOADo)>;2?Ml{hODS7Hy3Nda;spciHQO-Q$?LiJBCB
zfs7v~41e>t5kexW2gKjH_>N76>^11vY)!w!D6RHK=g%ff8;=bHnMS0a>&dd)`tXHW
z^OeIFM5|$*y2IN9Y&%Fl34l1i@PRn%(OdXZ6|-*>e=e#2Ez(;!#)drcvdH*d@$Rw~
zi2=BpCEO>%a8R#Ic=d!ixGGvuLqH9!;1}WJFmI=tqF_gaUyHldb%qw!d-2@|pR3M(
zT>8HaBD%iPubcJ%+jstO>kn1^|MoZEefL@a|1|Y~XmB>yi4yn!{1+RSmgPoF@@yvZ
zY*9dsf9q6FlqpD$28m&mkOB(Ci>XTHq?timHl&u@p>SVNno(^#qSOPcwRV5L-NP0k
z#XA>2N>k{`Qgna*t{3eMhdj2K1Hd&R(QlMjsFiDLi_w=l9)XTtOw|%K)l*eoOk$i0
zw05Ral|wqYcsf_<{b!FNaXghEw?r|;IgRtoe;AnWvNrW%nrDl%sgTeTIW&a)<=lCk
z#8`q7!Gi&{P-86&(d}>qp#j}{mgR~Hk!PvGrl`(HFA_iFD&-2&%<;AYyQ1WH%I`qT
zGUS407XX==VPZTC0a|gR`0xMve_}jUat@u@MzWOk@P&bJe>qV?7NGBe`5M+5Hy^e_
zfBtelAiJ{R8xJG|OCuiq`Ixl#(JYG>iHb;ZfXG9jgR>E|GEWw8hsae7ns8c(5x-?~
zQQg~kNz%D1u@Q?XjtV5(iB6O$_m&kDZeS$3N5?-6%v1v8Z7yNKXgTeRcX1@$2Y){1
zxA67`@-eq#2cu@Jo~XCQNc>)m?EUH|e|&hnObhuI8%gOpB}RINO~0i>@l_N>UyVeX
zl~2BgC3-s&d^0jcC1aT+fbb<wbs7VeNxE1eOmCvjRf5~4&K2C1kh<V8?~B0ULpzU-
zT~kOU@;uYAYiVGX2GoEvIfv`{Sw{3s)Cv>*3YQhA1~!q2F&Ev@I9C{hiZ;}df4g4t
zt(V54WCGiIrc;~|dMFoT<Pb;>1#Y98DWL}Iv;fssyqIbu;Q!$&p|b>sk|s;hg>MuD
z&W@29X=_B1$+*`SGg*x7bw11W8R(HB`UPiV*XLAC<+;vsx`)CwJN>E<X0|wkvpJIK
zawK4nq!FACCZrj`;4)|i@6U^Te<H^!+T(qECxSH*m$c)Z6kIMe!p<Rl47``>uZy8)
z1EE)p0LnFmP7?9w<3nB}wBH*+>$k{dk}RPmoT+#Y+~y}{Hm_dej9~A0hl^a#=diD^
zJh&<|fzyJ=F*L&@W{^O}(iCoCd1_>=NtVD2><Sjh*}6vIw!mLQyCU#MfAov#AsfLV
z#<`vp6g9x?($03K&w#CZt4K@pQz<u0^{40Z!mVy(OW9*^YV?cg9F|SF#SL1k{~9*v
zp8IWDr~};F2fqOC3bwmToklZN$Y_x#J-5|xaF9V^RQFQMGYtXYEDDc~f3p0EgTiI5
zfEMksfM%EjH8Pt>JX<6Qf1O)CbC$ifILK!jWXr<%%wsUl@?4Dz@}Jnh1YM9!#7lAi
zmvclGunW@d$Y0I@;FuoEIR24kLG3LoCCay}dw#cJ%ga5eZR*|TJ#}MA68~Me%~zW5
z!%e;3#%r&1$4tIa_kTIZ)KQg>6~dW|%P`Vj;-Y}50AJnn%KIGUe|eVI0?E9#0(YMV
zKU~GfwlL};Q%dm6MpBnc-j%<chuLBBmvhWc7>ef#AaV6M9OrQYMoVdRgo`N%{5a2u
zUywEeH_fP`OrexSg=z$0RMwmDGS{OX6u``v{4v~LSzi)rrj5aTw$nx7?4HmRy*raj
z(7kk;Aj-sSkra9ke_}yHk^%?}jf#&|6o<Job3pUuQ8`^CS4gN<FEc{UPW2hYjBrn$
ztIb4Mo57nfGQ?1iLZ@^N2L;8duc4v}3TO;=mc+T4D^hoC&EznAuQUU6{3teEkPxeD
zp5W7_@+?_QmIb<pgJH+Dh`-e848Rw7<3}q<S-Js#zq`T+e?o+vEeg*p(O8lM?F>yN
zNoo_Y<0(sp=(y8sj11kJLY^%OYo2h^Kle;5O%+<;qo$%ZS*-Y!Je?~h5b|EwBZ3pg
z1fDJty-;wjo!h|lMWRh1E^_cm<fhk0Jv~Fh<u+)MMK&o^>RcB(rK^LxG(_%lg=#!~
zL>kao3Ai^QfA2un1pDXfv+kA5PJ=`XUNUrHSvWP2p8ch~xe@dFS;;q?X6^E@^|)B~
zUTKS?Q9qM;;eawJ+&rl3^F@f#@9)AQNt&!<<0)i-b5oJegzq)Y<e)a_!)kLenzY7K
z#%}N{Q@{}EorV$81AmOL$4q>nv*wn^3a}FknV;$+f0y|Z&7FrVs14j{v?)1Z*$^vv
z%x)yTgNDyOU!;(+<Z70kt2hF#_mvSNUiy)331S51g%S5tTg#2LbZx|l&ClXD&he*1
zJHlH<w#Xf;w{7K0$m9aFP^Mpgq0g6RA&r6P53I=`rdbL~pughKn~MEo8mu^|Mpdrk
zObX(zf0MtKmLi^QmmBtxU2sp0Dhbdv<h@l|Xz5WvbEvg;Ri4*b;Y=9=PNutX^xfq-
zn+TNf;vW1Q*_T}DA84wIJyXat2bUjxsbg_ZjKr7k${#LA;y`pd4d0#NO2Qe$Ub~|o
zrG^`kcX6j?zI<26v&#bkpt(4t0AC)+ylECye`ZWQMrfv>i8nD<&^Ism-4cebvXv%;
zaTpH84_UlKR<BZ9I_3f$i`JLR=Rg~g&E?-0>?^e%M7jtO*Mw70mSYaXfBI$6+o?`v
zzU+w05i~0Kc3R|eTnu7m^jRvVIxR4g7i<!I<rz=a_zj*m3y1;URGpqp7JMPIW>q1@
ze-Dev1kOHth^3%m2uqSC6XuPci&L0=sZpR6gItwHg{u;Y=XDcV`7Ror3@IQqBk<aY
zxy<Fvh#>><55-i;Smnm@0#euT0LL+y*mQbERv}t0NXF$oeERJEf4)3A`Qhoqzk-kX
z#nF=&Colf`?C97_A;ntEn4SqmbhB}xe~Lj_0^EQ0c96zUMz{0Y7awMtEs~f;A5ezl
z-(9=Ol`<8ues>)OM64a&i{OD*wF>@h;N_@C*DAKb%h5^+Rr|(@Q`{`BC526RKi!Lp
z>~VIX@(0qWt}kZ1&wls2)r*X|wBF0THX{p)3V9wgUZqkv{+Q)myq^X_8h?pue=paW
z;ybqiSn2`4D_O*fW?aO${SVgcpcM(!RK<IN;?YbE_Z-YeaEWtSqxDt~P#Xz7uzY?F
zHgxEY*^0iZIqW$Gc&=}g-fGz-p7%{H;!Cv#DKgY+@3MiWR%~j8%;<{d9y>DY3v!+R
zhjJ8`s8HhD4yXz9!}1uvAZ5*ce|+eBdF{8Wyqea6z)iYNyoIrku$;l+iZ74nYK&F~
ze*2Xh&+F<Z#wJJj-`)$V>UjV#IC1{uUZXC(V(*z$>u0XIdd6S9x@Ht?v8Nkd?)g;$
z>{-tyfpNtybt&wzJGZ(z?gzQl^s^r;ULmG~avOtunQ%@Ar9$C{Cvbe)e_xzT28Yr(
zn}HOz&L%&Ai`@pX(*;nt$`l%L7bzQ~_M8pfBR?S>@A_tep}BpuAHOTJ())B(<ZzPL
z^fol*OLLp`PHLE8=}h`PX+d49t5NMo*6RAu5V41zb)}3@iyCn;BZ`NbEK5rvt-xI7
z1>FuOs6sYJMU|iv_*K`ff5)S^Pd5`Z4^$w6(cXF2CkHsY-nZWA{UVS)0eFsEw|92B
z2V%qsYTgwWqKdwJ=e2%0f|R!q7oc9C$TC%Cg&-*UmdT?q!|4SDBO3(S8iDG6N>ix;
zaiC@??uzatWkX7zikPEWr&4}wlDax`K}<{e%gTrjzr<#!yCZaQe`-T#pb=cM8stRD
z1Qb?COCz2Vq4YHvap<|l-HW0~^+~@!pee3F%j1X=UMX0kZf%{NP_+Nsp?}yio2x$K
z?dJdK;Qwy=hG>KSZwLNo(+5roaR2D=zdE6PmKTY^F77#^52zRME_@`ZdI%O6pGw<R
zw-RmT^J+33&Z-e`e{hIq0mkY~71IoVrGI(ZK!^}Bi{?RzT=oLN1OBHMswdA3Jb?eT
zth$j`1BXHYLR9ZT%%IVZ9F)%R+r+&w;52059*_9F_|uCQ&sg_Z!^``4IpdH#T>KFb
zEm?A%_?t>{S<`T!DHh!}*c99=Dfi|gUU5q7q>OCm7{}Y#e?R@1D`~RS4I|BLSL&?>
zw+8nZ$SMew&ho~=MAb<LB1&A2pdsw3BAwi#fosdF!U?WXO6~&ZBvgJK%oc@&AmRgv
zrKTWUqjHVmx>Sn?;N@w*K%*g%S>!S`aP_oKWZrAMPr1-=j9RwlVX%5YthSA(c1~Yh
z>FO*Xpj??ve`1b$ZIE;CN5qx;P8$uGd5lBq+QJ;9kS>}eny*Q&)4$m;RR-2BOwS)|
zsTsB$aGJRamRZh`vFisMXze@_yr*yIvU)b_i{RvJ*?uUfi2bP=`}35m1EHco+45K-
zYaz-R`tIEmoyt*Be#)4=;3+GwO77R7>omcN5vM|Wf4!J03NHC~biX;r<-jt&5wj+z
z(pG$B&=#<TQAprS1*1qjRt23uJdP9u0QH#BxpA&?2)2?1#p0i7$UG-614ag*7aJ~!
zd4^#c6b>cF#R7Rl$ThtY6`5y1Bi2s#Zty-$GPLju=@Ga!b;gU_Q|h6qsZ3*ViZ>r~
zMBL)re;CyaZd!)-aL`v+j<&s!RuDMLYbc*-p1^B+&Gbd=<1Bk47V}V$)#Rj(JqZB{
zrYHV%EHuh1h6K*?g0g$yAxD`;;-x8n^oS^ya|qZgGT<Ar6<Ll>zun)jQU=P+xgNg}
zPwy{^DMe<*;@m(0<1_mwo*QV&dE#hNmT2(|e;|1bn(kYTWOAkot1bl_y&GZpW)tud
z1pDl+?{1%*_wO9cw(h=~dS|&j2x)eKtP7Sjn*=d?Fg5WEW6OO1oDqrqRVPa{L`!j+
zXKz&M0s+7PCo<qM7uvW`Ck(!FiUEcbmIPzCOM8N2o6E$im|5sTVN?q+7HzQK6q^e>
ze@88YBdm0xR%GeWEbb>sscm-~N@me&Q>4G$9=zjJ5DPb6-zx1o3raO6fBo_8)h}di
z3}j7k-aE&C+Y<`5_v?-^UZ4MY`&)?l4&%RX-TC%&{P&Ig2ZTrHF9)KtN^wAq#bv>l
zsr2ycJlE$?<-Uwz>UcO1@G{)k1|(4jf5Z(ck<gyK5ehwX%uJk(7YP5wS%DCj$id<6
zVuQ@yi<Z>0d7|JWvdYm26AD;|p_Fmz^a$ab4n&6oG4VH!lj~T-gH8l*M3f=nV*mR5
zjH8^qS2*mc{w772d2d!@6f18I85N-R0mlsaU$`ak-foCkbnl-obb<zl@^$-Df5Y4A
z9PETa<MyY9x3jrQ<y?C&^DhnWTDjo8>?NUe_86C;Gm|=9wGADjHgCt!@B*(d5};oc
zG5Ay8dw$@8_d5p^k1L`fH#NjJ2JVfhaATh6w_(fh13!ZhSJ&8Jz!9f~c`Kr57?rKV
zdjm7h;kG}tN%l~Is4!wMpvbH6e+zgCejXHLrTGP3gnx(K{0)aN{F;Jo3-h;*8`^TN
z+_DsAECz!#JDO<=L(w7i9iGn9`AoR?!TX56gn!{w-S!Y<u}a5UdD{S?p9iAzzyC*c
zd!J7n{pvzJ;psQgess%k>il72YyW<#vzhwE4Do;A)7#OV=++(EuG<lKfAl}XM$uDV
zqaWPXfASPGEB^~K&eDlKdmjqGdinp&t#9wt<o_T3aQn0TzcKmGdUO7iqNv=N8xF-|
znVv1cl<|9;PtnCJf}`V~dJ(f0nV%`-dq>B&_iuk=4<rlK1JSX`G2s(LD_U4Bq4}MM
zs-RqWcm*!|7T2be=+h3Me*<x!3~JL+hT`BKrG?6~dB+c}wrNw4cl?tbocGwKK+!W3
zK5PoJ58qI^G!UCl&z`2qGJKB12Sh%&c&5bz2|+cF(jRrAuzHVs+phgFhAO7Ym;-Tp
z|Mqtjv@|XT;L7V@l`x2kj>Hk(1}BL;qZl;^gA%8UGuzNOA-D`#e~5V^bt*<Sm>fDB
zIY0^CP<j{+KFwaHC;=3etyJ-S0>=!O0020i&I4em<qKxML2Hj@5c8vpr{^lqb*!q-
zf0RkWnF<gZV;-f)7rGcvSGB`tiTa=yM#YaIoqff#XJB|!1?fWGbF>k>Omm2{g<XA+
z;UK*Td;1FZ06r^Ie|f$ziv5v~(g(0Fe*v8T)1+yuQKcJT9@C5C0|A-<rLE<QRKyx`
zEs`ateBc4R{mt(IPQTFSE=DxW?CC`U<UD0-z|NU|X>wOk3Nf-PfqFnNd$6TG)~63x
zWAL6>QThtC95{Ej`xoe)aXCClZU}4w7NMmo#HmuLP3?)HfATo%r+v=r=-ZZ9Uv&2Z
z)rZ@F=?l`WdtNpaWD~;0KpIHqqKw1btq3GHLHr}9ys)rysW8@xSgsKm2gyA2XM-X9
zZfzk!3cTWatmj~g)a>;krg)ai`Sg%<q(4Kr9frhCCY;>_L}XinZT*UJE@>?=zzr@b
zVlh9<WsK3-e_#uX+!pbO!kysGnuzids)RZ{dtr{=7AiH&*5PZX6zO!FERd*Qbxb}U
ze*HBljtKkd{`>|1B&D)^T>kwFV}o|o+p;krj1wk<&g;)P{-1*Whe|anf8%TKV}t$Y
z)_1pS`ro&=KI?xsr~iG)DdTWK!fU60f`{S7Ye@G5e=at`zC9!yx{T*pR`@KbqksX$
zBr@C`&9#*yfN%A8WXSSD=8T!$p$lW7^71|is?X0lE<h!?b$j2kHAvH;R0N&c)PpPs
zu?dmlr;xHmdBrRfJTooEf)8|x1}ADNM52kre<(E<1ZSpV3KJPx_q8nhIwWIutWhB}
z)D{Z&e;;6e5VnN^AJQYVaUtaixXW{qLpD6jnx1+W>T#%_m&lPmJSXTK$LN0f54FTw
zZ#J29_Ns6!Bm_{&D0|RnX_i~9B@j0(;9;NMsCdBRcZPfxCZ=4RKOYZY95c0$E^}xb
za&{HS`qN3=7rDF;0J+|0Uk15_@<Jm{6Uuv3f1d{|XJXe@qR!+Pa%h^u4Zw*8#?2Tp
z$yk`$p>|4)&(0TLeEoGm_0CC4kD@bORDJ?OLggo%Oy#$1QGF{)%WIDNt%3kbzgj@4
z%Fnbsrt#Oxk6%Y7mGjz<Q<>L(gCm?&=a`Mnu(Xqf4`CVum7YhQc`O`EM6D9-z24i=
ze?{^6zZ;PM&yVgu{OKr~#qXhyP5vM7^@Q?&{|?xMKFk02|KGogRZgG1y<@_pVOF0_
zKpGU&6~322=zF0QE!$SKxA(9ADt?|WNiH(c?d`qr{u0v+sxs{D4a7!|5sra;;Eb6O
zAcxXD8o${ah+HjD4D;>LVgGb>3|GoUe{Rt4G|82jrWm75;WoX!LB;E|@S+zUJbu&{
zu{6`uOy+T)kS|Dl$upG}gNek*lp@O@<YaFktb+vy&ttJ3e2iBxqDvr(C`5nli)Z(r
zLnPHW%VUGehE}GxxAzD$MC*&hDVGQwY9|@zkZ{_FqJ&`<RkYQ9LuNi=og!xSe*lq}
zC}#|(gTXYgw+|=<$-wrF;QGjJFiIU|tXFTyVv@@<bnms=2W*nvU(_V;I}u?>9rpdw
z0Y;xx=wmcI$<<`E>TBz?vfbsX=9;uy>W;)JPo!<r`Pl4$Xj|;hxRMVQhN@uu<m|7U
zlM88t8OzBeOTf6HQ}OdYo=$%Nf7Rot-l{R$TKDFOOe2DaS>=L-4KJasDr%U<=q;Tx
zw$<LxxBmOT{_oGXX#`|pOd}Zb>g6CP*22{Bv*;Yd*amiy_rm@msHFr&1Y4$uSVm=g
z7`b%Ba6xw6z{<G?Iw8Q=Dh7hcRRM7C5Jo&-6sSRF#H2ulF}ld|WwiH?e=q;hq+{vO
zx({ze{(tw~?V9}m=G$BQpXL82iT`JDmMHPxN4uh5hU{H%fK2Gc_FhBJ@}X-7E~ZGA
zM{nmcC38K-$>NVsFH)61M4@?~K*s4B&KXJWy=OA7{`8#W>VIOY$DRXviiQEBCQoqz
zU{9Ry{P^gP_aFTA<oM~!f9DU5PM#l$yJBcdkNgcPT=c~ooyLE=C;oOhJlxxZ`E)zA
zDFE8rjH2Fw)hJ29h*T+_Yw$8SBErdNu-JF{qU(}>Xg#A?srk|07c%MMHLKQ<i({si
zzzidk)5Q!ex%96-uvkO3UHea0a)UlQ!2v+334L-P?(_w}dmwK2e+8g%F9Dap71ZFg
zyS3f#)S2sHPY4KN?S-rCZ!CrcW(L<7ejQ+_GAS^e18<!GH~~tRYQ4^WS8km{{OyjJ
zXOLmn>DSi*XS8PW`20ZJDhr#~(q&i`r7waanD8_y;5fds*xHLZ23>NYp|b*j55SW+
z*#CC0f9u8m{sI2KfB)5i0;aYV?*H~3`vaP^4k)gx)4aJiG3Sns`$19X8=P(nN-Oc8
zW-<YLCE$eO2ub6Qvx}4qc@q{D)#}}y&g}HDZd7zusJk@RTZ8>uofWgI?%Pgn&|+L+
z#IG8=d%b>$>pyDVpbg@IhHAvy!NtV|1|<y^d7@G%V-SnEe_SFsVz5b!Oh>HaZYv?g
z)0c}_bH#bMar5eW<;b8e&`FY|XIN919wX>GSa6{W{OvMWdWFkQ!@&r1uP#}yUuhB}
zhF5-wUExR6+4{HbZ14k|Ps8$;QdcB;0@wBgs$`U<H7R+DwQlLJ-ASwp2>EV%Ldvcj
zwFRXEgNlKBf3;F@P(pC5^5O)<#B8Qgx+R~;d1*WitEJUThVt_vm<qrG%`>TeACyV!
z952qWJ_ZlKU|0u$m}1tZ0w5VN)lkEtWT$4VQkm<FnXUcHT3b$Bbf^1(^%E+<RkCN)
zRA~0ZzP-9`uDsZ*cdNt>R}$<L+5E(ca#v5ZdX5{ne>bS9?8U%u+`H@8kn7!)UDx?K
z);cJQwzigSL$S2iJD!Ivsc;30_IQMaXk?cT+a1kVCNgJE(ZGx8?MLt!D&T?G`8V>|
z^({*8_YPBLt)6lfdb;$uB_dv#E)BHGoxI`p`nAghFVF|N|2w<NV4j1_2N>9Eum!BW
z|9^AqfA;N$`d|3JpYQ+w1o!`T2-zEq1&CLj&D4M#*yu?gGDb1jl7|rP$KjtbMMs$f
za>fe?Bfn#@+xQ&}a{tP+9byDtmM;(O6AZ$0h{>3tV#b7UZ`+_40Gq_<V&s<&)*4~k
z-yvwSH1IzUAW*X}o*_JX-vJ-|XcOG*+CXIef8nP+X$B>xsdC`4KR=fv;0!OHVYUsT
z86SgxXO7V@fIlz5UgeTzHbQa37w-@n2|zQ=y_GVvci<>eTy6*84SmqY{#(;FfA6;R
z;nB0_M-T45IC{v2v{w(~*J_@tG2G*ap%u^-cDsLema8*aC|mxitn%yLd8|#b=J9hS
ze`A!vW%b(T=Xil_Xn=lN)5Ecn`FOhS1ypJqUdR?{@gF*kD?k0D3R(FH4SeNqWc7Ot
zlDqLq<;NdU(X9Olx9!T0O-(-5=^L*IeK<M@KdQX{v&=zlhA`^dkM@U(5jM!ABTg_J
z3OaxTs&;Yzm-7R!n9DiF<w`&~9#}5Mf4)ao&%|WnLW!Bi)bQa@OtT9ysvud7%7kce
zQ`rvu5+{w&?lnmF5VajI?=?X78cK54f|ag5nKj7(2c$%GkHVHP)4%M71Ti*I0%6qK
zWX!1p+b@Gp9WZ8T&(p!PH-4_WhqTQaarUO0z3Ge5m+!ENOGa}9WOw`uAi63=f8VMI
z9X*7otxw}odVaGL`C`>fG>wFZIUI@s{3q-QKLGjshK%|ksOYi13wg)MAvBk6PNR|u
z##@QG)H$_*0ACbJR=X29z>K?&ro0Zk2?a!;`r_SXUv$tC-dXn+_RBDsIJg7R8J^!7
z@;!FQ_$Ow_!3%KR6&-j{{N5XQf2|82Cy?U~ZC`8Kzemvncjf80(|SOh=|F>m`z{ov
zr-9Y3s{Z!aYpN{)1KTQQYIcfu-QD-XQgY)W%yV_#auFt3w(TM`Or^dC6~P2`B8;*q
z<hsx@5tzOp&a<&RT_gae+-f;04dasdH4b%(_!W>?kYc#7GKHQ|L?Y)Le{~$lTr<T&
z8}xs%^~+T~K=49J?aKK)&)#A`@F)ELqyKsT!HZ5GDY(*Mg$=nbN2fBT_G=stN5jC|
zm$ij11*+o*BbfilIjkgO`vEf;xg{A5N4O&No}d+Ly9s5dYfnF0vv51`WW&GQxNuaR
zHVydu$SnHS?Qg!tCfzfdf5#S$B0abU_o+4bQT(d%tkZDf+6`@Ri{=WdCukaDSg}pb
z@wa#IQ;eue&#;dj#$gsYWd2#qtbTcJ=bUO+F~Zk$E}_!J3?pvBbBjkAAWmb518XT!
zYOPlfE;a|piu09Vy-vUlhHS!y6LSdr3Bz}tq*-yoh~TG*OZSZ3f34s|CR!RW2FGPC
zDAYh6Cvr9~f5c=hnVe8f1(&~%MY{`qsuNu-PbM-+P9-A)Y~Ud<9s0kHhpgJZjw|kP
zazU%q@pg-U!ls&cta9)#RFVwXrDzL5z`>xG%~sph;&`+Dv%X&?#2Fu`!S|vhP$uzI
z&t%e0v^(c9S@~Pge}S{$67n64Ql}><_V;XEYH%zZ;4~U-y`|y1oDDw{v5u**x;1<u
zir~l!&Qa;hfy+&4(6=~zd!AvvgM5pI!#JcIN*R1ZVs;%TShXDiOW`4Q+O=g-1d#&$
zZB4UIz*rhcv_UYv!?E=pL0)n=Zm1`1r6RSHL~FFwwe+?~e=$N}ofs;~#Lf!6Gi}aB
zut%>$qQDQu@5{5>X8*(CI<c$X7P)MY2CTr@ZL8fxTs$-1K&*KUl)^_;9vZ!^ajb((
zZmqmZWpnR0t_={^%WK$qll_WMCB%1hs5|$9tzh2V0RA5~H(?kFm!#?oc9L;130!P$
zz`n9~St?emf2~8db%XBd;Z%b2F;_#pvkmdSW|3MkgecbFFNA93;LU5NVXf}HTP}WY
z8%l<;B3UAb%TI1~`fjQ13isXGb}S$B9fx+NmBMm3?}OcLdXBvo@?ahPdI#%u`I#Gk
zQYKir)8lT$xCtDgvEmGEUbohZu-(L)W`MbBNJh-De}j3IT)dF)eKyq%s*l@JPAJau
zEIq5xef^HO&bmp_ETnk`?cmXxWcjI%4RN*Ygar<8ZP(rMG}u)O7}yHtRqm<Jd~{sK
zuT_~1MLvXE*zy>Ar`V59+wB|<!)CVIYR~XQDL_{|XpJ*_KU8X4g$x-?ss%U%3f<tj
zSSZjMfAM~`*0?X`I<-~K?shm~`m602e^a~NcNH44@V~3Hb6(QRzPD86B9+U-LnO<a
zz5VgjH)tGfyFmVi9W*hARg2r;7%8Q%6R=d*f}C$|)$!A<SG}RbD+=5lq-Sfn*dRxE
z-XWz^yfQr!bI|=)bK?~rGh1j-+Q)-QBF`~<f4h2Ewp;QQ{k5X?7Tjc}z^h`_@KS64
z_I90dZd~??y$IT9*aEjim0fVZH}VyydLK_2a9hR$DvUCBxI>{Mpyrixx2y-pf3fA_
z2<9f2OF@|UP&?ONx9C39YQJiItzkSi`nnIB5EZ&e&@4JO=j*I;K@eLX!;J06uhC4B
zf6L{1ZiI$cqV-B&^><&rcJH=m`BkSJ1DL7YMbbM#HOFbmsi2qv^%Z7qv|IXG!)q7O
zMa|n-NZ04u#rKwj#h~OG%QTlnF2g|Im5bCc(GA<iLnh<!pd{AD1+F@n%T>l4Jo4)n
z>P+QWz}8KEi>0o1u~x>`(oQHLL3E0Xf6Vo6Hi=RDDVd<b_)MYnZNIA;oVWV8bB9Gg
zaSZpZxArw(zhgCI-J{4$@-`Btca{sYIGxG4Y0F?LJ*-`I1JS2giqi}5_ssXKmalDN
z0f=p}XB44Nxvp)eUH@V32<1YEq#W378W^_k7G@^roA##K0q6$+LhlPiZk8Unf2z>7
zlbRc3Z8xu&!M?^O`3&Nglnr_GP>I@b)BvSV2lHG_^jj1{PWtqn(1Bt<S(2UMr2%D9
zI|8Y6xlaBJ0JDy=d-_(KY?MCUM}91IE5Y;o@LQ~(#;f4nEH*S^2Oy{sGY7<copSlL
z7JRhhn>edZLVvf|9Sht!OV!XBe>I0z!D;IRtnSDAcg3!pyyuSPe^!@1@X=R<$Z57n
zV*?iaSGW4&&i?-Ew(j}XqT&|0Jk}B6o&9}yNxogb(fceS*1vUUA9^gZOq}Yo^{?KF
z?({`xk`rhYxn!E|22G)E;&hS55dBoffnVLEzqZG2Z#xVAdMA+Q`r)vze^u|{UBIVe
z`vhYtfH7ln=>h%yev&u?rMRBkxJD{9<T2jaFOz<9m|LB11{WBpQq9}l!WV(YxfAw&
zQG{DCo7bUR+TL-PaB4?(JrS1L2v`J5dmU98QEv(PHCc*mUSNdZF4n?EVzhMjcf4)t
z^f6Z8JAmWf?B8fM`S~lyf7^3wzYnc;rYcD?agpUoY=fiVB0n(260Y4Av~!cFcTI74
zK(3AQlpn@O#TZ0!s+JihlsiDsO`B2reK=y8ZMV)BFVGk7;7>|C(+i!(*+sA)5V<_d
z-YAUWKcF~qwm(>?55LN)tuBLLIb7cjL$ohsT2OOb)*d3ci>cB%e@0kSZa3G4FN@zS
z*yaxT4(ql)3S#}%ElCtGAz<-PeU3}ggg#!}L=G6m1-mQSv>dXpFbWadY3?-qjC$<!
z8a|J_q&LI@fT3Z72-^#V!pcG(egjyhu&Iq8p4&C)y}~8>WRd{lilZd%;AT^wKL6+C
zfBB_LocSL!C*D8)fB&r-{{OcS1@<}r>jwS{lX3tVpM|fB#UBEM<A8BqF$$mA4JY|9
zV|(B@-Xo6VJn)*^_|Zdc=80Sa5dOAbXZa&$caP%xz;IeO;Kkv#>MjUVZTm$T$<pGB
zpHXgZ_enJjul+Zz-`{FLYvLRZL{}GTR&NTmg!U~rxp)smf0wK!4=BRKW=(*0ef16-
zJa-48dp&J8_@@p;cdCmkH@(6SbH$O@+y*U(qGs=I{Y~{Ye$Zxs6|-ZDZz`6kwx@f$
zPj;BgIz_RTAyl^Zee32t<@Z2z@vc?&aBp1~HEQ{+PJOcapO<e}s(;sn0Jv8F`}Wo!
z?$q%AzxnRle?NTI|31z9fB%MUQChL8ue;iN;1YYoA*X7a60;Tp^3g6(#vxhfdKon6
zWf}F!jt31v*e$XtuvVINPWM<%bc$9Z_)cKW88cVo;dm-j2&8hI>tEG?<}tvg>^z3$
z;FkzZN&&OyPz?qw&lg$#=0K>o+CU{1yA&mcv0tcue_=4!oXi-fQ2zCe@`@IB8BPl{
zs<1|N-$sB;wM7x`Lrba{N4-ecO2wXOCL@GXSa2H$Je6~pJ>||$GO(@>7IQI|h7#8y
zZPv?C7l@83<0Xt7tczlV(H0|G^)f+WgbDd}$41_6vw;S@?h*!%0}(SWUNtI(%80HZ
zk;?*Rf0Scr$3s-R|L4Dmp#zbf>p51&au!6a-s7tMK;3C_;YLWV_s=t^UTtgURC_!i
zyAxOX$)N@TrT8NNbuooc5KUR*YC)-kzPOm`@sv>tj7`<zq~-B)40Y5-574G;=cx@w
zI}ufag_8(E8}9il@MO%n2>=FG1fQHQ(jMUuf8ZW@S2(=X!DN`UM66;>b~}8;Gb%Fi
z2FhBnX^-(5AaiVR0X{x5{0~@<ux*h+ygbVyfg)SU5`m3%@fA#(V-?s1jrkCPQ3)v(
z5qYy5pW(_>ks{h%O7|-Ijla0Qn#IBGU!p$%q0ikxA3i9J{2?CHQ*;6_MD{=%vp{^f
ze=~@5!^Ca;FcL=y9cR1+8lZW62+Jh%<=~B4a!7+MPaE2kDO%ly4VCv}p^@DdOVMSv
zhRa!HDm@!a#K(*wv#tMl`1tWp7MOfoZ#xn{VOl)b%kYj`ofEI%u$HBaWs1P-#5mZ0
zFK5`8OQ$#da21ENCswBgmMX{4Co$Ife;D{aG{wLlRF{Q(sz%LZTIeydvm_h88JI%N
z{pE5eJK8HPryETeOgKJakO!qE?X;7ORBhg0>MmqTBEa6j7SaJT`WPkHkl^2k^E?AC
z(u>3cIhUBKrr85`mP>0Vuk0Safl}xkba&&`JsbV;=!L*&Vd6DJd4XSJ1tqRnf1kD1
znw1NMIEjOqk{}Kyi-gkfo%f)eQY4;Wl{ySnDl#a6GQe0R02d!CC={S_(H#+%)~GK=
zjN)>_3pwgtZHg^SN-Jmiu=I{#4TRD~G77u`qevXt*Z_cNL}>lWD<WRx7G0+5T!BTp
zV9Yinj{o%Z<>QBfk$_Na&~YH{e=Xx$)9f5+zfda?4N8_ndO!s6>4>YJ#serv$me`A
zf$qI>1SW&Sfiqx+0aRsq4lxb%6<9_9QM)NA7_cnt>j7C9*}fs-7KJG@YeY#}=%nB<
zCS>H`IiiI-6!H{2tOE82;&ev>2o%Em#AJ~dQy@BdrmXJr17IDo+Z&Htf5z1=Iq-r2
zhI7`@Odmrtn{`<PA7OTRs*>zN%vp%ffOVZNEjE!Y?11FNo-I%oGz8jIc-RV)<~pf|
zpCA=9XMDNH=6cE(g*UtK+%+<jwg5{8!E%b1&mVhBjt<?*io+b`xzq^66m`Oci&u^`
zMF*PbglTq^An~p;qN5rCf5Iq;{h&%qn-+EYtCP^0lFJ$n2BrD=Fdul)TBL=ent@I^
z9n=&9N*9b!X4|Cf@`3|PLCOE9F?q@Uea`;JjQ>MkY$JZU|5xF%5QVh!RWTzpKz%cS
z(s_COf)scO>>*5P9JxGYjkP6~BF<_8bEQRmt(s*&YtXbFl&isue~5oX7W{w?Ckh6f
zD}&x(U=V+Rsx}b}q`Mz%h*oMT7gk#GH_jA3+wFK!gn9!Y6#B78I8o$vSkJ^0tazSA
z@HsyA2nG)wkxL|wiCk=hKs6aqgDz?<;Oa->XI0)6Ea*VV0&@wcw=9_|Q&B9Dg0P+`
zH+Qb3kZ`?tIswiGe^)oEmpYy*IX`r_OqBSxvGROsDCL9oe?WS&be!QnQDNm|8QIXG
zh2j7XJp)46cL$rJiC3kUB0$6IEzUcJnxVu8(Of1}c&Fc%MRxC&F9DwbgFLH?K2$x3
z?nvCXmIXez%syZxVJAk^?Og``@Zjyi)^UiN3Wp!`#9Spyf6H&tWK!~mET`mm*oK6l
z^A`nHPU>>iU`s~5NQ{cCkO>lpOfKXS@4kqEo?7amQQ<56AQB@b^F%8HAx$Fz8UtLA
z=`V?z3(7?fB^@9kbU}5&Fev!*1ofIx&xZGL<r@l^f|7!$A`dXv5EpBl<?{uI*a@gc
z<*n_IxEl0of5%;9X9@*SmJ_O>UAeBr>p15jV1vMV@y5<jhfRa*3ruc=fW^Tgoy*)P
z3oFQ@TB0w-ttQ@5(o8@brjWC_=~>O=c&^3=4Q8qgO6wG8l}NH&<pYzP&j&hIG8w{~
zW=IAu%3^FT4>SN1l7>?2i(KJX(JU@M>;7wp%K3zJe~Ao(p%hmh0887QUPXAUb9Juc
zspWUOF;$NMfjJOpAtT@;y>(Uvc{x(u@;lty-53#mx)mpK_R-J~V3mqGe27DRiNphf
zfkDj^g1!$B*$zz_mQ&!3CPhmd5Tqb71U_zWBBaPeR9*^v9oPr7B@?^^k;Nw+Ok@FB
z+!^FOe-jYA3)PzEKu{Lo5^aK5W-O$hbzbka<Wqj=s|c<TJ82cA8Wd<xo<<_NDmsfq
z9S5Zst%bV*IlD*-Z7ZnaL1N4kFqzS>r)n&%@ucjYjh$Iu))I#+o=tUiU@0JMbrH3P
z*BK6l1>rUec!*>1;`{>C9KO<;#ds>D(;h~Rf8l4NXfu8f_D)6an77bSq<Nz-FI>#%
zQY*RUx_k@Ah;9i+|EjoNuPxMGQw`xa%b@ThWV5LBI~}*AKWUpXI>DPM;0i^nk%n;i
zbag;cN4P`57V?11G|P(t+OIT96(k|x9oeF=ZJjRSGX*hyW2Ish_Z;p-u4Yo>U};MM
ze-{V~qS2XHB!!Bjb=XHGc}s7P>554u3B5hG$Vfa$p0aJnk8<vjeH<^jbeCsi#HkWk
z!&zjLXfyayD?NN=;7W@lzni!qz?Vk!Qe26jLDj+AIa3m*hbc@ukVFh<t@O-WebjO)
z$HtjuY}J9(M0*Xf?(O1{eSOno`QUO=e{YKj`L|6jvV@ABm_R7Z<kGe#ivk|UdV(56
z!C~J_9V4Phu*5lTb%NS{UyN8^i`-%Hy-1--Zv%nR8jL2=m@OXW(3wDNJI<eow(4IX
zu=H#p(LTy1cx!2)u1jR7HOMx#1m%_+&8`ldEAB5CdC{4KEE@8oXcYMOYM>m4e<D;h
zUi@h>lPNkNk;8+wCrOWu#1pI@&cc?@Aj#aQvxY(}%lE_d!~O84+b5;I6djQ`V#B>{
z58VJT(^3f`2B^6LQYCI2%wrRo!cC^s%H8P5HUje2$xuEKoPN*}Du^+zEcne<$`l%K
zPQi%~m~k-XJocaZm0=rvC2Z!4e**I%v{khrmS(=J!I~)I4A99jIvYfMdJa2{mlC>C
zfPHCb7yqzgU6gU`jEm4uv7DDsI%C+5ijK9tZoa!#&Y3t3NY_39*E<2>gXW+D9BsFg
zvidBA(^cf4cG1|*mRAMK8V<#y6f{$r@S_7;MoN|@kyCkQl?+#R*ii%Te?Nk`kGz=0
z5wWx^X@bZ}bfI$K<{6p9jV=O$*rS99DkX^8p94y^9seMWDz~F4TC%q;+{?$9rcGmv
zg$fk7g<7a?V+{k$8vvhOi=6x*#CdXjTmWDPSx{{jjCbrHNn~L4S6tjO*mM+$kp=4*
z*}N0Z3I-I9L1~&M&UqL(e-!q}1ciK^?Am3R1Q?N#H(Dcy3v(zlTs)re_k})}s93V)
zg3H~E>fy2@j!r3K5lRajnkTI2u6a%=@dr6c*#*UNs6)KfmG82)W-fFwo(fz3mP0aZ
z><8INY}5zYLMnkD80|5tnuymxuH9W34IJ{D??w0BE<7cQq7|f1f5<glpvqws5o;-j
zw1Tgcm@iHO+4S;_Xmw}_>6b7?@b85DFCd``xk5ZKn8<?)Fw=llxblFEpa)0bA$$`b
zxI^b)vkVCc%9ORknJ0~gyt_l%S>GWc>8eIn0V|z+BLG}TW(vrS^tV-H(TEdvce_yT
z_f0L{SOStMhtqP`e|Oty>|r>zkpN4d9ir<W-YPP0!<j6CJqADITw@9~nBuE2Q6uYQ
z1gVpqqhFOX@TL%|fpHt8U<Pt&<-RsSXx&{IcV5}Ty^U~gJZzsP>MKW)apiJ7Bz<+E
z%@hm^5K077#wz4`9LgGEmdVnJmr)gsX%sHRAw=LAzNBMQe}hE7AyWg&qEh-Gv-E_E
zb;JxX1b|09<3J)Pn3&-uA0%6r<F4A^t1<!!U3o6_gTBMtIX!lfAYK#*G}JXp?GXCd
zTe<B`;9hrEB{RHtHqTqt%;?>iK4v~&$CrwP&Fa9CNg$R(Vc-}tZZL3Q!pmZ~c*L=A
zcMb?uotqxAe+R6eLWpZ*w8D&Jpkhx`4Y05(XCM-f0=EJfgY%ru4~+qxL@bTCuo4Qa
zRrIt9xa=A^iHGb}XC@obyIe4v7X(A55hsM_dB){_3Ah4yLnQ8FXewNVjZhk$PSS_?
zB2zi|jx0V^X-Tj_uq3X_5KOK=3<@dw0Q&+;4v5n%e_r<Y_)7iLgJ+`1vV;mMM(eCG
zW}c9Tb!cmq*X{6YbAi@f6}=DX#+WXjPOKrmosrANo$z^X_YuZAJ)$peRZu+X{Cklk
zultQ5UO!S~mEBBSta6v5a2p#pFcJ?lbS%<#f>nj0snM<qmb$4<V)nS1sJxtx=#5ve
z9eF{Vf9^D!3!P%fGd_p(enE7`7GHZ^GHB)_y^X=V<e3EPH%HrnhXI0j%P2ywKtJ|E
z5fAB(K(y~9C0IgCB~qzEE^E`k){%?%VW)Xho~~bqBZ;a&LD4kQ-G2tofjfudZ^fX<
z26pj1v@?G}PM0epDz_lS3dM!HOLp}UEIF-bf4TsR0nkuD7o~>-u4-_Loym0RZ!TMU
ziSx63fB<bOb5Fi+l@Huht8i-uE9pUq2JUc4MM!xIWPliu#tg~EZjciYyJIkrfaDM;
z&jy6UQp5tQJaGgGxq75i%owh2B6YIJn@MV2X5D7GD!*Q1z4H9Gw^sOX>s0y7UtPOH
zf3UHA@kT9)n1W@ApnR3vo7#5x?j-cd7_0gR`#74(x0Z@3lv|_P6=tvzMO2hxOmQ%~
zg%F#`dG%OXL6)*#6v>SAOeFpx5%Q4rs2+z$RKVp#cl1tV^8+T^%TX^9_X+Zef?w!u
zgH+E^t}6ncy~!TdkPo+ETx(NG*ULHgf8jdXBET$P28xwF0`Cc}XVa6AFoQ>-78{n{
zUN=04WBxRNqqDk<XF=ea%|;cd-XJXy)er@T%`rJQXdqMrbE?K~F!bLOR2=K?Fk9UC
zc?lcVu4&a8*Q;rzUN;oZZbtuhFT8elgl4wTaF}4B4(!Q$g)h9mOJRPITlMM-f3LE6
z`O<xhcinJE#!&bbZ@vDxV14z(m+u=m10YLL<QJ+szK-Kz1;Q2Eq1+jq9o!BMToZSz
z&{QMDtTMo+$|tybDvdeP&x&LF8<j-Oa<WaZSF!~=sGRRL>EG*4xBG0f4$A>82cq-8
z2lrmxAN(&l_;r8q|D8myf8Xs_e}CzH{bgrIwRcTFtJ}N|t@zl3iG+O=7)RzS!`&6z
z-U~=*^lI>$e8wnP01&CR!Of)X>&cV{Vue>@2#-y7qF4U(;>9yDdWIo#9Kd}yilPyP
z>C2e2c~B>zm>9No`nM{!*g)nac=Ew=1~<4f^lCRnPwzl;<##JI;pfehe?2Na53DjY
zO&J1xe{;c1zi~(@Eda%*GrO+Dn5VHg{?q-(k2lAYUp+K?I3y&6^6E<?E4?f(HUL#<
zxB(13q;#z0dS`#1-79!saNauWj(O&cYaT)Zcw_>13@~!ywK_{FQ*Le`Z~~%VfEDK)
zB9Z$MPGoQgd*QA9efXqze<)ll7($1-$+^mNFbPtm67aqYUFHMv1*Vn&vYR4YQGvtY
zgP%C!s=S9F^Fi5y*)icd)E5C#6I6rl$)Q~TKYQ=G+%}S}3;y?0WV0%&NH;H%Y*%$t
zB|B8Ms!P3HvXA8InjYIjLPS!+HVCi)P_nkHi1TY6U}E0kJi`3ne~)sWWMW-1k+_ir
z30)0EN0*69A}=dfuIsn@h>}TpNJ_$v*IpgXdhuiP7)H;LNro^CyW&@JTwy467|O}9
zOKF2@zQho1BSW^ZXnV*In@MCHN2j`cumOY_CnG`T5j3t;YGcxr6L8mcbJK;kwc)Ts
z@sFW${<<+tx9Tzye<|esc5^dA!OiH6+?j3UZB8)8FpeFf?oD0)VxproF+>`tFdh^J
z0mTcc^M0A?D9BrFx&otJNu&~{%2b?FHW{=1s1Vq5e%c<r7{?c+DpM<{&)n2uWK|6I
znOj9WiT7Dtf?L64=2qQSXrH;&x4G%OMhW6GQ*B#q6CVOZe;kPSR_<Kb6$$TepKS;r
z%c+e4M#Bzs4CTH^I<ezz7ozecwKaE+^?ryMi?IfWtd5<}I!-9`MFu@IWZyGEh^o!8
z`_F&jzQDXt$fe>hV-y6NAqe@h!)6QImJ3MM#2?+sz~L++<E!di8jDKRliwrRz2eB0
zLSRLW|ALGwf9#>M)zL!E4dDN6ZEZZs;Qu|@dRF7V+{E8Ef9cJ_pm*$eJ?WhZ&$s2H
z>M>y$(BYDD{llXRZ=|st;FJ9^Kse~9Y$w1{BXGp}?wL$J3np{(X-Jj-{qXfW|1E?b
zCLWyyZVU~9N8^rayqS2d$v^@KSTYM-K%-V=5vTs4fA2?PNA;!&4Yft1+wI~18pgAb
zUuEwGku$bN(Ju}_Xz!pt*eFW90c-}(nmWDs0rI$Z`9>F@E>Ku1(+0pgmubQFM`2HI
zd!wNMth`}&Vz1nQ9Ix64o=2UL?|(Y>{ZI7z$L+XaC13-@(~T>XU4ZV`@$6>P;%f+6
z7L#F9e=Vw7XR7#tPXZA<a>k;W{t^M)PXm7>!>}7hwhV&qdEi8{IXt8;#Hm)gJtGgU
zFTTA@H+uEKqgvp(?JCVKf8z8vAQR*q<2^xM^Ua;x0{~$_p1<d&k_bWkocL$z(2Xn?
z&G{%tQ=Z&J1}C7beeg6axayev>_pAY76$7Xo%LrCcYn4~JPB-@!JK<&yGH!IL-@b)
z40MW-?2Y_WTDM9Nfajk7aMo{T&i`jmp48|6jo`mMe*8#07P~qAPz(cufY@o^gJm}Y
zrhIb2J|A-7fgt`L`v<QuZ;zc-(4L|s!>KI%b8sAc2!J!@Nc2#IR^)_Zhn!QEK>2g(
zJ6?pSD1VT;@wlgib_9fa$=!Mjy*lDfi5=01UmY;~y!b-(4F(h`?*|uni5$HH$_G)9
zF=!3_A{wD*O~X?^8jwUV2;@jQ(}?b207>L~1LET&+1P$GX9g{f@#rAG8-YL1bw(Hc
zgmV9V7^8Wi^$=Q1O&g>H1N&|xWC}N?LW}(%z<(M+vk0xCDHo~*scVmQFtQT?Hb(4N
z)C)zhU1Zd!0Z=*yr4~{y+$d)`R2<7L_3AB-5SGIR-XA~>>@Q%#;RP6g!woOZJdN(b
zzd687+VQM{^r^e3V;Mn<#mG{gp)vjnW**HfsXd7EG4nczO9pM>@zd5R)|$LWzQ>y5
zv48am5do8iVRCRA-fd`%lCwcVwPz!Wsnl*MwJyv<MKA+7&>BTE1W3b_esdndzD1#y
zM>wE89<WY9Af*te1pa7RjGcn?69bv(APxmfMoKH^QtE!G#z68x;Ja-mfP=k%?H!76
zHXb`8%q7w*09L0cgw!VXxjpVZqP%j;Mt@Ig+^H8TY*&22`j^{k3_90SRYoH4m6=9;
zvf`!jW)t=_8eh(S6pUtI8hFuH7RuB&&3T(hE5u|t$*tqcLw2YYT=d1MkJgb3;dmW&
zm93pj0;;id>71MbXbZ+(9vdx#d6;nYpgIZLE6mS9@&=mB5m!MqNJ&wemh`a5cz;zi
z<KQo~0r_Cz==Y08r0~a>LYiu2{wi$gI>#uDyB8RM8ptr@G*IX<zz|W?C}2YTVPrut
zEphY;uOjAuB4;F5u4-o(k7Bq@lOi0C_y@ar^lS_ZC*o|WS=dz*>j&Q>L1AQrVkO7m
z-B2;Jm`EdD?Y~m5nEMMjrfL%{{C^ffAa-=~g5cc5spZ-JcpPsujCsH>5pIMUnQ9L9
z^DOLYrftRiIzB3_V}E7_Z7EJon_e{qiqpgjKH<sXAgch-3@eN`ncm%w-eZDv|8rEC
zE!CF6acmzCCBO{e+ALVu104QNL_rm}Y;XpR#|}UxK=0L{lLKw@iqjjI_kV`P63JyU
zm-<zM1Cs}^*FNSrZ`pke4Z@%?iXBgXI3L44$DqV)K+WYe@XsJo){|MTGo?nA7y%6x
z(w;by42og^-2sG6T*JtAY)<9QP+IoeoXr2ijLgtC18If6r}-~+;!1bv$~;@OQ-pN0
zymJdrr)dEA5J!+(g@8UDM}PV#p%B{hz~hoH@gzg;II5kbB$REE5+?1e$Bdz>5K;iR
zfYxK!jv*@M9;7HDzKVqzo-I97s<#8~?TdbaIAbnnlHph<a-jPCqF*4KW~Tm+(+f=4
zRp+$YiU8#lC_D!mEDR7{>4>3mf(#U;4pDHk;<LwOrNWk;uM!B)Eq_DUh8BfRZD7_p
z>>0c$=GtBH7J3qjGZ}zw&*rkXRwRZSy^Ud)yO*9#>Y6F)#%o?6->Rmv+d6J6X0HZk
zF<61wHlR~H#_Upcls2uoEOh2!(uU%qntirZ&pdyC#Hts)c$7BkI@{vZ_YhbkmY|^_
zLt6oAQtN2&SV$XXe1Av}c>^L1OE;9bmOf_Uqa-OrBH7Tj&>4ei{1zinINq5RI2H(V
zX#1jEQIL~WhZIE(5TydJ8RDVEC%9r$L`fG68my^IH3nr^(XIwT9ud$>+!zQP3h>0F
zgFv`)93_}EFjX2Ku;*<Q+l>hVALi^hjGSl|NuvrGfXbYxEq_6g7g;Tmx!fUgOHf$S
z^ov?ac2@9mYW471-uA>B8JfYXSsG_GC_QsYZ762XXELy%t{Y-{8=>17eMzy9A+t{d
zL{F<!kf`C9^_H{ZfuRrpkPnD|z&Z$i3b4FV{9)u;&ZL`Q-27!H79fx+kkLbfcueH&
z&%J-`zuG%^xqrt8GfJ$p(2&y*J`J$4Y4PVC3wrJU#WR>X7O1l+IU;qu_R|!U;O>(1
zIpQsBkgWp=`6vY<z71fJ>MWV_Q{QES3vQ*o&!iFSOkV&EhGY!1t@u91Hb6x@-q1wg
zzzcBaA77xIrcc7SGAsZJ10;!Q40ei;V)rU88_n}XB7cw*OgA6r0NBp-keFgsWJKqj
zJK;+`;y0dq@e*2XN{y_Luj#f;(?h@D6mJ<T!!!O$jv!9voF{(%cA)j8@SE5OfW*oh
z<t-R}=%wb^2>?DHP^bV=AZ+!CA#HX=yj2BnRnY{-CVC`IrZ`zk08UhVvQs---T4}+
z$ouO&H-GGAFO-<t7n(^?+fTZ4j8b|{vu&IGd)fuAYw%J&jp9=-CA@JP>2W^m#wT}2
zpVjffOsc^AzWmUI5KB4-;jCz5+)KA;qlw(UKvRc+d%q<xstOV%CHN&E^2?zhGy(cY
zhtQMoyu!CNgG0y-#4YQCcJw$``s#~~VWINYY=7+Q)iwdDtN=x6m|_RP)b+vNXtk5J
z(tN4SAB&AHjqe%D1ISp_@!v0+EaajAg#Vy;2EHo1&YOjMp?1h04*Wz7L2R`t;Ga~P
zxL+K7r~x8Hgw+r*<1M!Fpyr^&i#7p!Qu;9yRA09!eiEi|i*p-DNc1(y9+LS2C|-=v
zkbjCLP;ftD6JnukyDNY#F;b=OGPFr}(6+DGCA~(b6GY#lj=^c!9A=Ep!`?7yavt{Z
z>@Bb>4|~I`Re9JF009>H0^upZzsJ3PlvKk_)G~7x4eT)|Ff9xilo!*vi_~_E0xwx{
zI;PT{vL$1w;MiO~{{WB>k#0pYb>vod1b^fo<+V3)jrvbH?!QVZK+X04J=uJ=m977|
z`E;xH|J~dAPijwhV)Y`{T68QPIcugf2&TdFcE9(AZBEKS<WMxyxfZB{nfHBY8f-bH
zK>1eQ9=`e49-9eF$xci#NFDSEj%J)BV0yR|juR#=-XIfLV}KpvN+bFpM7;&%3V)KF
zIn04ek{FR0ZT%31&C_oQ;u@qmaUm9pRi{pb*mUS4!jB5QJlq#ev_^+!I=K=V2qSVl
z1CYO54FNP|8h~mL)3h|R<{}ZJ)A*jDUB=JDWOv0Lp3lVi85qeTklVOL3=t1?>O<H^
z-5nF{+KBWIp*a^}BvI86o{XSe7JnB6;+f!DM-v92raBL14JksmiA@_0z;}#&z{c$J
za{}%C`C8b)n|EkQB%f%T1zAY4W!lj}+~$iake`j?%2E_YK3FusXm7C_6@z}X4oe7a
zZ24u+1DKZ}7XV{P$>eNG+N_!pxMElAnqn#D)6TrifzG3iJGOi9s!)7IQhz&+`$sbX
zfG<>AopWrI0Nd6=SqE}^oUt>?+6ge-v&bMB8`v#F>WXCw0?gLB1%ejjo0MA#uR)Y_
zh*Ic)*!4^ujpF?wiP%us&}~5t9c#-Oy6^xcCpKH4BCNzJOnJ|<)G31b11;BD^CVzC
z<Su~&TmSe%{I+|r|I6OdJAd)Z?#p*av6Y=;_|@o+F`e6DG)(0;I1VgtblNw|gCQFM
zryBXT)st~8qL39gXb%FcU1^`7LJ!VPV>$WFt`X5tV6Z1lAXfV>V$U}lJQW8?7=Vy%
zvYR)&@SqNz^Ir<5olHqUm{6GQp+u%U5-E!zN2k#BRD23uER0a0+kZtdDttFDN~I1{
zxt1`MI!+}Wr^2503S(5(iBLhu>5|bY)y1YP7nzcnsY;?!Dvn86Dk3F4;Cay~dc@U6
zqEr)yvPu+6dhllpM_zUGNu{wTl|`OZ7k5&1)Jf@>ljIUFiZ`h?+N5l(NmY?1d2uF%
z@g<4SlCM0rWSz*8wSVGD>cEmZu%r$wxs!n<q?BcXOXzY=cu7WGL{)^Y=7yNit!$79
zUC#+Kp&Pk@CUvCA^+%e_i!)g!$|MH%ho=$Ipvkok6B2>=5*L(jrSBP7{y?_=n8DU|
zc6MTXtna=P2l&sf6aE4f#3X&F1$XHA=R0CUyb!-ZeUq{4`+tFYqMvg%#jaR=9BU^y
ztVgnlTu*D`J!SCdY1;;!;ZP{dJX*BJ8Rrl_^zzr;gMaM3(pFov?~qQHG(n(eHKW^g
z#V@q^L)jLKjG6?kYr1Nin$@<H_c;cI^~d6mU-u5g!5hOAdhq*idxyL4-W-ZQc8|o-
z?{D9}-rsw*{eOtm6Lr`m9pQ+IMf9$<px8`}fFN35Lb4{)4eA%5d*LHM&Sbs@Go{)y
z@^d6T)c@wV`1`aN8JUwyF~Dlbwzk^jD9{O)Jy|V?Jh;4VvHza}3({c#1Z&Nq4^$Td
zl#F44Pa10zG2bdMybUw1A^DjRSJ0QEjL;;jcJu`4a(@(fU}78=iX~*wh3QWizfo5T
z<C($O5>RopQD)BZ*ozs1n!lg1L?#tLIYerIcWQYr`FqVc#A2R&8OK|hT!S)_^*%<v
zk(Yt@CFi+JPF~(a#ff;iPiKvul(ua0%ea43>5wL-8DCCWg;E?eXBG^hfo4GMcj#v3
zuI+>%eSd)A(CpT!75=Ud<6Sz77sg4X`U7d|`V?j%sHFoNiO&Z!31`d|;pjl&C)QMV
zjFUt+lB09Bw&RhjcmJ}pLv!`rclz3Mv6094zoK}^n~j6i6kxp7O-r09YC!ZEMGgdV
zkRgGX+qU#N&ufOS#qZDE9fgl2w@Dr1S%-MmA%C8Ah-V$*dCMW53qv~*)pNnYhR~7=
zkG4mJ0iNVz>;Z31M|Y${JHXnBHvUvp2eAn_(Wxl_zeUVk;uNV+65GL|x^P0ymD5_O
zgYi<U_k{DNHTpcm3sk;?BUDRfnuG6%d1tzK@j}~=>BU$oPP~}0DaUWpBy3^4$J|rO
z(SO!eAF2dJIo^4y!%TBZwJER;IM*Wrvs#kNvi%0BKgEwJ=q}XFaYTTX6M{si6PY;^
ziaAlZ9u+OFZZYHh<hVQ2W)vg$p-qPCpU3e@sx3XOpX9|kY_7;BmseM>Ox&@2dD{@S
zwwd6JSJL8_YV&MfgJ-%mRce@cV0*5%?tj3cTcD|{oOdJgr(<}Q)f8HWF0N49hXuO3
zQ9TwNWXdylZk-v>-4udD_34QV$4*Mzwh(`3v{t~;*+FO+vdwc1FA~uZXs>RL;8eLZ
zcOE-O5rX`dn&?53IQI=9K()qZ7dRwMcXullb%rI46`w~@R<k8t1DOsw{7DpZmVY1@
z(8}_T)|O5jU&yZVG9a%wsa$nqw|Ks3=hMQ$82E&S7{fR=A<|Xk)z`L(L_Oa)xnnX!
zmlIo7+Ssgl06Mz0{4-DaTaD8+we9_Lvp%<yU!U)o!bvwB;lg%Xuoh@zrWIUpuoRP}
zWdzvh@pDiU@JFJ392*i*ytKStdVkBuE6jIF8hu*vn+0}}90jd~Z_J?{Dx$54CqE}P
zK|XwLX}Nbt5Anr|e745x(Sipyw#`E~Zp9>a?(2)PM9%N^R~p_GAFNN{U@g|nlFsX7
zgq?C;n#Uj(cK~|H9=_=?3MIDaZx*QVg`>+RL?=e}6bg@*Q5!kd6zanFjekH<JvPe=
z&#4XwkDk;(*fX)r79|5mQ&FQd;)H2%?ugTLkdvyN81u7kDuTz1GimG_%B~Sr(MSaL
zICM(Uke7(A(c$T_3t4Z+Zrbvf_4eT$z``!O>UnwTi8=ToLD71yRlK4}5XbV=K|QxC
z_Qy#lv_aD#B}5!GkEsJ=%zu-Bj03zJ$F6Lv3Pb1C1v?a2@kje$vO0Bgja3pi4syO#
zE@6FZi5EHP{<);0OISYu{6}1R$M-r262Be{<b3?ct!I$)mCXP8VdH6y|9GSLj~<*G
zGB9K86$xlbMtjLZ2Sr{7tDEc}z3KezhmB1^i2Q7^n}wJ!k`A;?6n_~+vzo5T0OvLM
z-XL;$!1Z5LWCvv*QKc`>=2o4MbCa+xrwVvJ2_P1Qt14M8RV<%{GNhn%8Vq|&Ni#()
zU=;Wv>$jMd6ps~?Zw7(yN1+;WT=@}>H++CguR$y~fJKM$gz7A4J>s!S+yVe<JUz%4
z(dvplP=b4Gl%k$BAb)TT;H*6>2>f#}4x+pX$tQuNiHk<3Ts{=*Yw1sN@D*i3VIU%f
zgDb@fW#?mZbSdkmzQAVik>vqnJ(i{klh;s5%keYGfU;dKEI|hXGi;i62V(7Jt~=~V
zU5utLW*)v^LlC%%+C|1sQC9Ru(op3Iwj5AN!_dbWi$$<gHGeIvib-$e+r`luFEz0r
zjbgyXI1JLE5WXBh!}uA4PG0nl>-f(5k693?U;T3(t4B2eC3>wa<8Vdhn~1?8ndw4U
zpPjHzc2qKns+vFCpo{Ugj+dAQ@@-)(gJ)B%53IUIPBkMUkQO8-1nmS%pqPQkR_@kq
zb45t9>gxd+tbc<u_0V;qa@6pLViisl2Yo?*;3j@Tg|w;0KtR-A;B2<M9#dbq+nz75
zL<Dx1bUCfD#grY}j&!GzBU3V3Xo!A){QBng9_LiDyAs0cW>Lo<(|Ov_4{I|QG{(vw
z#Ph+5(cXvHLW)*B_h+sx?7*M0THu{IkVMM)pQf{m+JDm)P~KJ45twLIL@1s%7<+QQ
z)%qJ7D>>D$LtU5ZDvn$$44n}fkfHolHZqP3y12n!;?rYiL?SWx@9~2w!^T`~<C;Q-
z%?~d&(s)%^afm8PY~#{-Z{0aTTiC-aYFzre--r2UmWmcsk)O^OO$#bOH5W@T+fJ6-
zXuffXsee4cI*?aI6f+VRX90gW=20@^Om)CmPPO4*#`WH{j)F$DiS<c_{2e-UVOjd|
znXCyze%1*YkBRf!4#tssQ0?kMKyFU}c1I_Y;nW&Q?4dma$sW9M$Tun0Wg7T6K;C0~
z_IoF=qz=dzm?G-=9e*mM?L@pU!s#q<{8{K;pnofj3e{4&c^p7cj8~ybT+7s1(8SUA
zGe<;jgh>8F21ay<smyJfj)dh@S98L`RoNxV1WBqmO2v!O>IPP4KUTdp1F$B?&dJQ5
zA)_G;^PCe*kY$8)B9Q5pmKzOc6!sL!5v5=sUl_6%9y`XN401;>3n|G&g<WA31{J{S
zihp6ek4@hmMhvzobSg5UEBfq^>WutgIt#g~UT7YWv60R9X$aH6p|~maDV~Z68B-0~
zu*t+|#j*(;!4N4H5e3@wDQ1*h>|bIMEk!d5r85;QqmA$S2;vG$>i1BDkps+@ytmAR
zorwyW9jZwhDjIr~fHq*sprZ*dUfDLJ#($#&08@&|AO)r7;=?K;|2P(zfFyrb)p@Q}
zmwn2aI|n-)cx{olOvufkv+Yp;<+F|gJB+M!_3q450)q|fuX&5aFkIi$62E7&tWEij
z=CgWAL&>K&c&lL$RH{+;2qV+EL+Cx##~*T<V^BHt8H2I&YEzo~fo6f4M*#zx;(wTZ
zE_5p?vhu>%Z4u=lO{TMG0mK>-8G23+<piXYe*s}P)#NWjer>&zmL%3R@ERZF7iOBP
z5|z?&te9c+JRW$-!&?z(?9c%}3dtvshyzx2P~l*5#@2CwM@HX}0G$vf)+d_7G%yu5
z&V8a#;rw)wSPT^UFgcbP)s^DUFn?~rSNTaS`hgy2=ZLB4qUbck7?qBJZ7L1~U8SIY
z69K?s=C>2H6f35<e=dl}GUHOJm=UJ3fOGMx8S>8ZEGsuQEiE&(`o-d2;y6qvDsi;k
zpEJvKR2YmII)ig(`i_j%;UH-^&IXF~1~{%^QhUO3rcm{>FNR?K91_v6Q-72gTsF9j
z?a;(mh#4c(odp5P>z(YW1bPjNF$ocx4G&s}8Y!a73`^|dIh#XU^d@rMbIVjeC}xsW
zk5CM$_MY-Fo%*gFlEP@YoU9M5*7Sank3L^L$dj7!m{kG_no`pW^e909b7><Bv7BDa
zB4AE6cj_q<{@PT>r8S9fYJaKv=b7W$$*@9}A5us{8gHbCBuV(N=`cz@scA*etY&@l
z;d5BYBAH5i>H#50H4eW)eB-2lS9a()!%~gV5lf5%8J>2~Q4M99iV%Nz$H6rul$pDL
zogBl|<xoKrD@69w#8BqQ+0J`)F6SvAiWNSVAr)Y1*-_qa$hiXiw||uRe?1tux%U69
zt*xgS`~S12Pk*fK|MwRE?PZF7G{o6*kZ+`#at-W-UJ3Er-tNH>DSziira=b&4Vojq
z3|wBnPFfU|Za#*{4G+aT1?BV_e6GNY6<piUL`NL9lZK~4{5VF2Ga=;KbQsUaJ8LU!
zHhK^d)DR`j1W?1GzJCayrUI}MsB{@fI?Uxw;zcl=82Jgv$C6E~07vc8FmVP@+d_mk
z?2Ng%v}zQEhW{j+g(Y6?y?niUxc5pN?)_u`%|Q|(txfH*$s_io6MmWobAuC*!jiPi
zgm!dt1))g<4N6j?AAv*fRX9Szdh&>4dO&P)eg6|a5Oq^TqJRBRh92X}DCrQ#a6u#!
zk8MDvC!GxO5WmfIM&0=1*S*8NTo5`<l+Yxl@rCgcg`ea!az;+b^2}pYxgJBu9-mX-
zH;nLcKeLsn#=SB<Ef&n%EPNQ@P-;b}DKxcfFH>x2SEj2!XO2Y3nlO|>24js5=|sF0
zgi(>450GsRrGGEZ!Cs>|FM?kyi@lbB`OAS{TNZnb2BzQ|Q{Ie(^Fl>IWc>!5-mmW<
z-vEP}9atdn7-(8bLWl9Ixl4O6l*Q07;n`}(aqT#+9ml5Qc(L1f6{m6SHLktJwbyuM
zukkIpjVpH=mvk9F%KA5tfc%@d3FfD}C-12gV@3<X_kS^>xIxb~Qt_pV*Tvc9QQ%A_
z7~qXBcj0$a=eqobZ_jC_*As`Bm90<XbE$S6%L}x}Au()f1tGBs7B6@spmKNagq#O-
zED?<~6|NueCOR!cLqRa&Of@*lfpyS)1?bfH)utK>#E#<R_0`}D)&vUAhfO>Nicf*m
z@?;-VOMmp2-5{_ox=x7yrDoIVY41NK7blbwc9bX20YUC3YV$cQ4<a$rV<@A5RT10d
zCJnN{`#T0zKmrO}<kgNd2jGKU%eI^5-8e76NGE^a?RMemkKND@qGroH4eMBl3SuE{
zA_gKRPHbx-vmpMmlVMvZ+ThJrob*T&wv*mZ{C}_^W5wKt+GpYnyRP(3qEn>YjX8Zw
z#FuxwU1Fn{SwjE1f^3niR$D)iX#P23C0!=OzCQQfc=O7n@H%GX9><JaPpk;iA5p%h
zc-tiZ-0d6Fe*993)J=gYffHi|K&bkl+2P{@T8kUwZK<*^;GOPt7M?aq;@<i8GX3n;
zuzzJDkeIhk#fZ00Ud#AEs%7KV?tl7@*KD*KE#p%Pzy_P42euonJiwYd2B(g}$=}Zf
zu{V!IDTiZ>hOpf8j|xDjikXY*O$(2<IS;CCB=$ia-E$A3d*(*<JQ8C0z@B_;j<jC;
zXkKj34IWLY=aZ)o`FY?7=pe;t?m;XiG=IS#D615V{G23CHczxw>O^vmxQP51x`x7U
z3=sX;Vk*W`qPvB_3mh(Auf~#l$P$gFVLQ@F{&ohpliy3}Tx6gkwF)vAm8GPgwUnf#
z%{nCO!G>h57LZjU9BYYStT~}rbu3odSgcYpSSv?hm5skzIr^$>?3HocjMB#8yno{m
zC!?!+1rA5}ZDxCKr?vcKyKQ~Ccp~2ax%Pb8^A>4|%;ZRmb|M6z)OA(}$i;FdTy~8F
z_W1ZmPE_Dp=swb*AeoJ+&^?kfgErfYwfwv9ie%b(b0%#zb)>iZ97!|T9>1^Fn{Kid
z{2r#$-`n^<P%V4x@qoB3rIB_~=YPD$_`l5`pKd(K#Q#0}VWW=!yPxrY6y?U@I&?xe
zJl~dmy3zxdK7v{U{9uHNV*D8VHtvEC@KXFU1Ws})Cstb=`m;#>rj)%aez)7j7*+tj
z^t~QfNk4a^FmC8lRi2fH<n&IznfJ<ccI-MM^(`!4l)7|iou?b3C(QO#9Df|$F@goj
zdi2kuZI&<s3y;3pD4GQX5k>ANXdp4{_aE_OIq+?XQv?;Hoaq!%Q+<dPBx?$K!r;D*
zfl%nZf)%$Q0tEs4RAJjT$sJP!Li8}yBN+A6lyyOiXIo%uN_O&Q#0ul1Jk{@Q!~ZpQ
zJp0X*)v%_o{<UwbgTK{Jt$%iW-s`8cJ?KKa&8D&kw8YMHZ5-%2q$?R8!!w_Vv+I9~
zyU`Xy`FTo*xmr2Zk8dxH2H3X9VuQYs^!5EYlflK?0PaSP42wpK8YsKp+6LJ_PYhk`
z6wh6<FI^7tc+tfUyy#AK7XUu%@+w_Xf^1^+(Y#K!6^!qW*xJ}=^?!{%ny#LedP?68
zUv%Fe;kTOfsn*9A-H^VZQ7f+=F+IL{3-uEA-y9qb{@8!_>)_2>__6zX@bb;U!QM;w
zG1xzN`};evT0at^0pV996NZS`(>Rg*`!^X`pnlP1c#g{f>gVV;{S2iQj86H9*YY#?
z40G-r$%*Af&M4>BuYVWEfn)2&e|G)jM*9)$5a5B$23Z;~F0EtDqEkOWYYJ)+G5Hfp
zS19}`0ac3l6dyP$?2RKC2ILDL$pL&<G;wQOCSAM^V$Ci+tw}&ipe`VdG_^YlhBDq~
z_-HrL*|r#dd+FF$s^$R<EIFLv{AQ9PoY!3PNh)+WjG;0QIDh&~2Us%pr>$a}D4ve-
zL7~Q+ntif?hh1Y*^t<W3;MlFq{?re@c)?y4bF_a^x4RfCY0I$LNK6o5NYkj3Q%iFY
zpkS{%o1M)$?Wd?G^PSX;7Ju*R(N#;+xQaV-OoKe(V^S4>EH&FsICZUy0oY{|M9iLJ
z;uJe+UY6MShJW)Ii*W4lYbJku(FJDkqKmyro)Hd)-J2}}Go&%A^e76pf_EFO?AwX&
zq&7ifQm}i8hEwakplx%u7B-!j+EmLF>QT`3)W*YS7kvvtHb)j!6D{16s)|QUF>IvO
z#G-uKB?turiJ%oew?Gm*C8OGf&}<&tFirtuMPpRoz<+EfOLOs=k(y2Oy%%$dfyc{a
zy*wope<4K@b3QPS9u|%u&5V~ANiGE>m!D2h!9dZ=a|*~%ap{!qg?uLWPWc3$cM`rY
zIOz+|`TSG<WAdP6u9Kn{$8OE#Kv^EdC)^zFlV$RY_z$;v>O^zMZHZ=+bXL@=`PA}#
zEja0m`hQ$}+$T<><lbkQOt)nTQl)fY%pjf-@pR+w8vT9|K^c-{EcvAfBu8}CLX=`X
z%mH`O(sSeK#@`zm*+D&#6pP})!3fkd!^D>)6dBL(xNhE&iI1kgY`m{O4qr=j03Xs*
zn4$y;-X{ftY&4f54O=3Cgi)IxZRD+0L)}exg?|bP*|OlZA%P#y8C{|~x^BGDMwlHx
z3tA%g@nLGkqu>JSa)_P6Nx)|Y5OtVce}22T5An<M=3h6I_%OvFr=~x7LZ#+C{u;f^
zA&;01XQc)Ic<vKB7KIB8L!)y+>qSt+4nt@ZeZgQscpqC{$MKZ+QDvsWk6_WpC9x*0
zK!4`wiu2UNxeDSO6|n?=$Xm2r7NHg-5d&bX5H84^NmK`E$jHn&yQXO2LaDOESOW@i
z`)NJOD2r}z?$E4<k|M5*CU9(p5?sn+CvE#{Hbz*e=ItyzmG&;{);Np&M5E2KeeBy8
zeI2!InU8X5w6M>V0e_c|;?hQ-afabw0)JLb+zOH7!R+XLfYEHTVCsjk>G7%4D4K@-
zUT<nor(Ii~_4s~oDuWOvhQFO?gF@Z_r`)lPHXzt5jDm}<ZcLwsVK1Eeku$z%v>A^(
zR`VL-D$zKRdSAT1<l<?K$e#|ZAcAtgjkY**<T*g7TcI;*h^vq0%Wz=kjS9q*4u8#$
zF%tb<-Nwj;DzF0_mg{>b@GX7;AHFh$Qd`RD9@4y8`L?(e{wIRC7FTW2uoSgnl^lQK
zL`mv`J->S-ut3WU=ef20C{e;A;?&8SrYfQ-bN>6{ePiT!1M7Iy_}IQT<Yv%ChT?Q_
z5j9S6YI#t*ikPb+q6D3}^28clynl>^%bM6KBDTbl0q-!e<<i=15*MA_X+r4wpW3Qs
zL4$5;hL&UQgEJYUWI2lj!+wDl>G)1*)=S!rNqLf?CP@+bCloJ@(OSCVtrhCNp<6#p
z+h9!FN|Wl#2PYJnYuO^4VJuS%N(n&#1lw;DhFRa^+A)L_f}O@d9E<&1Mt^B|jLSny
zE=oZT#BGeR_%NiDIo=611GpEigBK{tfa87GYT;TJGN8&lQyEO0h;zT8bZ9pzG@?N_
zmK%$SPtnR{{)EqaGKY|tYa=C1vN<J(&m=@!%^e_GPX;0E*aS!Ei^k8=3Lp;8*oBZQ
zHNl5foJVS(sRwb&cuOQ@*?*YXQdiS_c1W}R?d3m@-W+tvRppE?ns~W&rHDuk&(!_v
z_zxBTq2ek#271Z*;U5d|pEkFiZDry=o@{K@@gHAD{KqA-`(GSa9$k1N9ZZ3*jKgK)
zL@p5!>G#9e@BFs_f01Zr7Pt_Fp&o@gmH8zsf%W9phJhPKI(lANOMl~bx}0VEQ7S}4
zBdwW1B5{39ZnX(feSu@kurJ;Mv$Wiw^1uIF>_GBhQPoW|S%kU1QS#g<%iQK8fnyl^
zVxz4O303kI{O|2YMkzA$Qclru-3V7DHy`hIyLyaq<|7?Rzx@9C^<e+tUwa4d-W>kB
zs8T2lTx6<S_OmtSuYa~x!#}@%^YT9iFW>z3+ui|01@u1jK0JQ^A^dRk@$rifk3aN!
zC)@n!>-~d0^U43~L-_bZ??bQq_}kveL_M|t+uJvX?*{*|_wPU69KOO9kBQbk9QV{i
zhkO6y_x;1Y!OPv(ujvtXwL+84o|eM65T=2mgF(Vz^s^Qe=zruav}_6Egy5AqP>agB
zYBIb`tp7$kUib}h)oQ0!s?|=_U&8uQiSkSNb<>m#Y>1=<g^X3HsZl1uHCf7d&2cXt
zT25)HOs%NgVewutvy1>iEU!>4m%hxIhqaeg@5oD|I_;GDG?;nXBHa*I%Pe%>Y~&QX
z&6^M}x19R5%zq2^uO!WHnnVvja{1ho+(~+5YSlSYwRo~9ODID^y4GPXGr*d<p6_vq
zU0@<%1O->A3l*>geMmgrYA0sv>DINg1p{r2YDH4jRy8LnXgbtOjXLzRDFZZ!na2e}
z*^wVsIWHTjX)%fD>GiYDxCAd}z@SYX9nW!v@3?-SV}E2Cc~xy8Jr_Tw=K_a+X%;n2
z9pI3j=|yUX#XVMALhY>5H9gbwR9L!}qH{e=<ugjxaxq(@bh}Ax*FSUZr1ZwDs4<86
ztUX1E!prKAg(=YjiQa3r45yILlrFv7;S4gh32`~o79q2WFFp`b8enRZB1GeMYL6!}
z5LF#=%70!rmW^?^C=*$covtgYW}&<O=6}{sogmk@;d?#tzyII=N&gdv3iY+4U7L_K
z)=w0=&a0{Hpo&*m)jLfD<Qm-j*WRHzo(a>9+Qp_c|1nPOxQr=7c9@-MDvVD^lsc0w
z3|2psC%~);MT6x%!aKoy$$ua0{tRWd7ZvA*rhklr>N{JS8SiYiC}$I~i38agJD-Ig
zSR+?*#-7H24SiP<jHW8f9VKf(pIWx6$sMoBjs5S@Bg6b?mfgj`XG1WhHKfSnl%hmo
z%APe1PyJ{>YRn*zBk8a-(#TFQL@f(Uc=aIM9!MHF$IzrXbyCM<fg(zhs$zhbENfCQ
zlz*`_$k~y`{5QY7RO7yC4NdM+#Eh3?#|7%Lx#2gH8-B}_7!!wG?s2F7rDQ^Nyor^H
zR+Dv;upDya#q^Sp@RYM08FZ7}Q*I8?6_Q;(;VmG&BH|MwO@7zD+FQk|y;aR>FIQ^3
zAi6@?09g7rC4Z8J(MuAKfZaVr4j7H4Ykw|-7z-;**$73#(pOIqDPccrCAnRKfLLp3
ztCI6t?demBm{L0htDU^@{aF-P-ltH^<>PBeylM&bRL65P&p??nQf``8%{`f%@zkSv
z#t(mL{W+6^vE{h4KpKuIb3O8ul^iNmOR-1>&r$kwWbnfEOPQPEtU`?<%i6Er>VJr$
z8#w_YP@xD`k<OC8WJLVS&sr&qNuIGS-&~SH2Lj&Z`3yIunbZY%l~E7wC~=js@I-jw
zLD~;yU;%iLD<fHvZ8g>zSV_3NTFSOoP=P)(^0`K1EISagCmo&WU|pqR3o*iznxIee
z;+*1^(|VgCuc4uZMM-=dz|8{HaDV?uVcn9dp#boyEgaG|CruF&QYc40g!3C_e?~QS
z!jXl^AeO6*z}?C%H!1U9(HfOi-q!ABfl*~S>dBEF^T~%dPK>2Pkr=3@g^D9h{g4vj
zv?<<+DGI%d>l@=Q^_K@4?GcbHW>eyH4YAakq#G$3whQ2~l%1qlr!75y;(vIoFB5hh
zMY<3pWkUieG2q3?7neyeire221y*N<7e25Kph*vZl_ebgnd|ap<hn~SnkwWP3;)Sh
zR|t_I1o_XDT4-Pt1~E~EDzrLFE)*1%`^EWQ8=!)0bk%}}Qf{w&^9{~g>86W_*#_fH
zpeT8@wo?bO=SPFoVO%%}V}DsGHlC@-KrCRq{R=GO)K7ycs|rV4>ICA!!NQ}0<FdJ$
z825)cC2<HqGvUc^0wneChp(F%-?>?0r_ttbcPBEky0gG-wc4UFi^hL5b3HM+V@DMP
z3gpzaMzWc32)9L}(bBg}2Qc2rtVYuLi}5l|_)IGf)H6HE`4$w3pnpmV5neu>mWTUo
z{qIl)XEMn7sOe13{iNrMmxzS%&m)z7+(=`2tJT4jq-o&u8Z}N_|JZT?tr30!tU3Jm
zH!C{r29{_06Zkon(dabJSxWQ{`V!|4^Jn7D4YTt>fr_eJ)wh@Y&Q%?zbzAXY=>mZ3
zgn`Y+|Ji!-!?Se!*MAQ`Z2nNkf7S6{*B1X(1ed1+xl(v_a6Jc54lfr%ox$BA;M2B3
zX3YSuEf*|CEd1U6Z+ox$6b_sM3e{lYR~#aheV_rPj{-=9@ln*~?+0^RMTD2)HtDwR
z;L-lU%e}!re?QpELICb4)cn3^Y;A1)(AoH*v$6SZW22A%`+q-;KB;D2|9hEce#|y=
zKSIB}7=S(otW^Yr;D8u9M?y3jcJZ+gEw<#soact7)433e7us&M@e^5zqwp=%Hp{-F
z7Yr=8?NmL4_aBAPW-?01tm{G*7cioqRg6Ss0RZqefRuG<muy9s73L})feTn#(M*Q6
zb<rs3_$Xadgnw#@Bno#Jl|C|MK5`^yNW`84vbbPpWv0Aw3__jN_{jPtCr~c@NU9YJ
zT2W24jaAO;g%FLroEJd9ZHtC3htdlqR=$As#Y!1ivB9!!wMz^cGQZeKD$hmlvDn#|
zD5;VxD3LaG?dF!3aH3GU<Gd;p+qyP{iRz72Bd9^BIDZ%UfbD4%%|H_Z*?7B;GU9dN
zitrYW!LqZ{TY&OOj3s8*X{`{v=XNVy>0|%kU%RjOU+uozJE9^QG~wE2ohU?*Q+rqA
z8xw*Dm9f*c0v7YKg2BYYNDV394p5?%*K>4!3UbbGYvD=P7NxiBXWXr1u`!G{4Zx&A
zQo~|Q3V-mNY%x&%VVjqVsyfgj>4i{rkcAUvp?B09dZB^zAwAqE#h|OjabbzLszmN`
zGBRTM3KO~IB~%JmTw|h(LaZvFL53}u9jrl+S4tv=gr~-gBD~!d2q(L$o6iyppSRIQ
ztwh~F26LgQMxbDtWHw319{w1Ueqp^>^lGHrB7d@pt^Q7$|0VfQ4#2WGbQUCIeiXwE
zn<g2w7w!}TSd)PvhO9O|Vcg;DGyY~0lsNm2PD2YnIj$Qv3eqnX0JJmd<{~WT?7ci#
zXe#rq(cKZ;JsGHO6st}iAiM{&GY?%#B2(wiaxx&4t7UL5fg%xuGR(rxS?GNB5#iTY
zCw~h~6y_0i9kfuA5-7&3kQU~VLBY8~uOy+d+vxQi$(;fw-$>Nr!V>Uds_a(Ix>~L-
zbe}wJAwJc$O>ZCIGwRKrSZCkMgVS4iO<w=|cGslflwN63;=)d*Z#`a^SNpHjcrvS#
zSA`@~PQ)mdtV)1J$eR5Cctp;+V6$NUFMrU8Q^Eq&knW&-zrD<c)vYJkc%e|apoyFY
zj4AT`9A2aAk%!5GD^{p=<Z>*C1l-J-wDfT3{oJ=xZWDHvP|THujuOi0+V8!AknwT#
zj*zsqcD_G^QtyhrAIbZxxj<+@2`5OhlX;Gir92%=woEPsG_yc;FWr9aN?5}FkAEev
zD)R!&wf}EC{qf1uwEh3bA2&8@`~O#s|8H9B=bPAH?ftU*`|Edu!@ZY#2k!>I?jM0$
zd+=)a-$!lCd&cOx10d;)5q^17`@x$(pyD`52!HEr{9Q{3-3^cuOnh2UHBTLo<Suls
zs%>3xoV6{-*36CY^q<rBTxerD-hbx|sd=g3aHt<>S~z&~M}E`@OFvly`sPMzczNR2
zyonc2HZrii=CnXTzaSY{s%NO8k+-46urGdGWeWb*+1SdPf`n)X>6LNdQ)V1+Lb;(h
zwnm>|tx4F%wNF^8rwQxe$t;`~Hnh$}Y*a}L=0v!zURUmyc2<a{l9XE7vVTgh3;!6b
z_QgWnQX{0C2O3q88)A;VwDdRTh<>A482J;l2+O$ipC!(v>vlNQi(D2|H93~gS6pU}
zD^}=N`1wXVwS1e4tcU<(1uD+D6;8*le-0`FsbL3i{zzFL781)!U(20FVw(xDr!;A`
z$(5t@SZ&sq-pIG-x^<RXc7LAG40UDuYGcs@U<TxJ?H#+8_bD-Uh`2_}in;Ma%G@+U
z0nt2U`{y2MI~5Z~!CIgT?&%h(R-Zh?(NfjHOA<rg7cwi%Cjn-hVBb1OL>&;;&ny?K
z1fTlONQPydV%+j--0?|*J+kqG7I?`93$|b`2hA|zC3w|{!l>pvLw`MJl~8l?<$qk!
z4q5IU??hD}S+N}0eEg>;kQ$qm|F<@t;eTuSzn1?mmCW?Jr>sOIyF;z2)BO-|s2%T3
zfUKykHtODZ3|r((?s<Xly5PMb+gOzXzlxVRdb{^>|Cjx}S7>=-W-#+OtpTHMbvBxM
z>yQ0cdxwK}zwRCkj(_$J|Fw5Gc)R=V-QM8=1c;C~EG`X=VW8PswmqW@FW<b~do|d7
z{aTCRMtk~b{Lr*qx5Kj9hZYJear}uoZXxD54(pBMC;ABy)(Hg({yIm-GXN$*^n=!O
zxU{Nmy0d7pv}yUw0d{IkG@VJFf8K{>VyiLE(kpF;Rwz?Bihm3DpsOOVvj+V5a7#Z6
zl`_>esXE>+AkrqvjJfU3d0{0XoQ7{kW24Ed&C_SDXDY;~Ps$kj0Xt5iG-{V#FufPl
z5aDQ~`k-^2-D-eJ_E=$^Q^JXzSU$dFtlm=HDL3DH|Hs?c`!Dz3z5cf`^`H;&44^b=
zPJO;zd%Z0)XMY7KQ199|k}R`{vJ$qzMb*S=OxY09zaqyQ@$q5W5-fDm;DddUY$P_m
zkVMr^zNI1|a#q1?=SG<qSK;7p?z-+BA_UKmUg^zd%ur&j&FjW`8zV|QZeG`q&)<IW
zDW!KH=E>^s_Kl<T`_RCRaXcfR_V$jeGz)r`$AaeYxql_M*ixTKPBl*_+b$wZ)*3?;
z4zGcZ!;JF+Lml^%*29^Uq04vlJXxx#0)B}9pXG*n+&UKO8i)Sl?F?NFZ7HED^Dt1W
zzBq?me=JF^KkxnW=5Q}VsfT<2+<W<M?-fug2-_Z>+!%=HT9X?)gXfyhZf@zar+6lI
z0xfM#^?xKxTa22Z@(dtr4z9F|m7Cm^N+jfKE`xwST;v{8z~dEc7cJq9ty*Dl#ceKD
zc4iF_7Z!%l%aE2rv(v0k$6KA~<t39lMg8-%@!VyiI9(Y=2ylwpw_XXnSL$rN5sL4f
z`V-lk^&r&~D`E7)*>R~2u&6=hhqxK_y~GHMmw(WoMYwnzu#{ZDyTq>&WAnl018^tk
zj=QxbEaqZ3gP6MGpu>3g;N>1{D$yi}&=$m*$HM*G8D}4)v6)5`9xiRse7gw|@(ecE
z$_rDMp8-$t_yW^DQ0b(wdb<-ra9SX#IFY4P5Fg^wm4k|UOO4r1fHgWUl6{YDd^iXl
z$bWP!O{|FqF^L8><wRX^IP<tk!1Q5mPF=Iyg*H*}wNYCTCk{{_u0O)}z@CSp@07O0
zeFeiS043U(pVPe!+Krq^k4ZLMpJvV0dgp%d3BxrzRIq0yD!viHDX}q98{qp;{Nr%<
z;MLpRLr7q3o}c=z6foMD_F8w7FGbGeE`KiR0>PDY(^7(~u_EE^i>(#viPz2hwWbVg
z$CJYP40yekhtL>-Wn;=vbgIyo@eu2C?WfPGxSD}s>t3+XlxFK%C)8hTVsc)qjd>ag
zCq6D%D4Hpgy5gOb%5jdVMdo&t<nkiSXc!C=W=nLQQ%5O-wR?Y-f04A^zJ3ac*MC~C
zT<A<@Ze)4VpM?a4r&_3Ti!laWW~TZ2^7GwZUg$K+#NENwVewn#uf4(pM$9~wvI4ny
zEIa5_Xg-Fh*z3s1(bKU8k5IUQyjrNY5U@N064v*+vYfOb2q<tq_gTE^;Gr0cdnmC%
zOL!2sF~3oIwgq;7r~$_^A*XrU!hiOop6y4rAGIL^7^;9m2C{2mj33~N1J969(F{Pq
zFwRc~=MwzqVOJ%-W<Aq=mL0JhK$+)ww>U;Ar;TQ#XZ4PISYn?4)k;qOoX-;vGRD7F
zC*m&j?DCy}qIBSbjwN_bZlwO`s(o)am8^~6VQWoRqd0MQ;oFUTjI8`25`R%?DGP$W
z!c&WLE0yRB5aR&a5D&Wi;NTSD(V+n<l%qgK;R*vaTEc_0%y^BxGwcpUC{JJ)6C{P>
z$sk&5U|syt>mnaqp3V}TGJD0WUL4D@A4ml9v;qfZZx$|OI0BqH4R*cuy7anT_@9hM
zJs{<CyMhIR2C?nWB_>6&Gk<Xg^S~S}oJtqyHRQRF0III0i?rqA3#F+*lw!&GU|x~t
zR!hE08!)wd7w*6U?u=|@;(V62=wbBXhYy_2mmPZ9QGWPP!7!nb65})wU_=wJY=O5Z
zVG}GEhy|=s-=SQRw+Qegw}(V|I)^GjaCHXN!^r=FP>P=IkHX%G^nWlDwQH|i_j9@Y
zuZ^wEbo}S$lV?vh>iEx_`1|HBy;&IajvcQjy)yw3n2+RVjJ#ycM(DbfiZWjLqp;ah
zno!`+BB)SFXT&xG$TF7WVb0Bw?|(Y>p?I&ldR6n0JF)+v2A?%`s%8Q6_y5+`vkd;@
z)2*j9{^PCfe-)SwIDd$j;-4WT8es8rBY1j*=(1+mG$QCg#dh&#D!tvQ^A@UpO9&Jq
zM&Wo^)h#-0h%cgng}EEV5g^?-%|I}7+Xj=K4`tT28C?nb(Kq@8C2lfb{!QAB_3nZT
z->TPMEPRiPp8xFI7jbp;NCJ*Bl|cWA`q<8V=y_qcb3cO>=znGM8!wjq2thPW2~b0`
z(Cla4Ocm-reaBb7_wD3lPt`(&{mk0E{}_*qr{+aJXTH=^G_tU0ENbXHlyEkgU<5KN
z7+(;!WDM>&dLXh+!ajl`Ab<uv27SsI?>p;6To%tzme6wAc;$~~XoXTsGnx7xs6u_C
zehZOPc8oD~@qh5Hwwdt9zWILSL~e@S;SW$uGCiI<9B!Z4c6w2x(`*;>S4C6G^XKNY
z$MZ@vzDO?M=bM*;!Jl<4I&t-)uem_-)(dm5wEF3V*j8V?tc8T@JpUmXCMo_`B>XQr
z|DXKuLyr8v`Si#7{J*X9zxtf8UQhgH1)ppz2BHg80)M>`u9OU*)FV8$Hvxz-sO#*F
zoKTW>fsVY-XtS{d3JzL{XbU@VpsJaU#(+FgGWZj|Sx7GODSC+D0pu`m_k|Ti&e$47
zVOQ*)pmlI$dEz9HQz{S&=sRHYLW{quF~XlmdvvHv<pdD&6UvVCP8?5C$OrWtvG8GR
zMM70upns0^n?hroFJq~kxasWJbw<DGAp+!L^3tJoZni~tbKBAjl4ve_HPxbiAdx%A
zfikWW$-r_Akh$5^m1GqTqhL0QW`X5Guu2#@Cmy2ZMSgNB;Lw3}bb`PS*m(q57$Jtq
ziEg*2z+Rz_fGX?C=u03nU{J&ar`+yxs$6>Fc7O8b4TsMnN2W_E)i^V0I|Xw#x3x$5
z6rITE)VF`O>=W6ff2#w%rRAeb#50LzfhUHKAAfsE&s{x!Jj7Cux~*vd!d`Uo+VN!A
zJe3yYnX6XX>b4{2$}sKNlA7ts`;Uev)rGGZcXq^k{v_Z<eN2^|cn?BYn}w*4;1_&@
zNPiGrPLXfMy=$rR68MGgbQYdAhaK@@`0XV$a`j;-zP;3)yb|ADD)>?wLX$qy(sd*f
zEisf8&nMnU&Z3g$cL8(MLwk8hGwNE$(v9cy%nBR}g+#s3@jSl&Xo|J@GpN3FB$1Aq
zszLGPi+KN$0l6mDw5jf(^_KtLRc|MrCV!;VW>ek7H`I@=E4`EGR6G|OI0w#HG|fJ!
z`#U>3VnZzgPZVhcSMkif2LmzANLzHf-9$Us=R_BV9r5j@?g!q7wWNE-$_`uI|MVTN
z*${sf4OqdC*~MYqgVyBOw=eqQ!1oSjt_uw1r{rd9@EeVf&)+xTVMM52MBy+qe}93e
z3umEl4>Z2{<{QB(lE4qbc4*Tm;dhrcKh#ved=U+V1td7n-hYO^*MNEWs1^ucVO6$k
zY!dERnJs2C)y>&%X|e>8G+#*(TwLn~S5hf1g_|~BfAK;zV#;eZL|-%-SEV+!;5v)O
z*9;=eZr#SA`nF}<>o?lM9HH;YH-F<6e_-jRcO$^}3nL8j(YAn8)0TIkn!Xa!4J9t_
zZV*@(T_?o<CYPG~!fTW1Wq0fcdlm*65<h5@xMWm5W-?a%B1=0lVXMWvN)W<w2Zq=Y
z*-zw918xFi`oy=FB;fs3Y+m(;nt;|kH1g@VfN2)c@Xb+iJmpK1n-GPxtbazCpyN_a
z7t*q7+Mr_<CRFx-Rnp-r8Ci}?pPuxSLee@?$ncwQ#J87|u47*f4c-gzuP8U+O)!)I
zpVhJo?3GEEO;b4%h`y)MFymw3Pq8B=T|Q}EbWvG&k=hN={+~JRcDvoA+=d6p|3G~s
zHqkZO;!k5vTB#09lO4eK!hgITOqcEf*3(IJV4B;3EO8~yXQNlZ!!k{nghMAM+Y%dk
zo=t`Tid7rJ7e;yP06xaA!v?>+nj=a=OF5z>G~G2!Z_rK?FVfb9UH{LcHwSdI<DOqt
z(A28xJD+KvbY(zt()ap>S_Bp?GHr@*!IhS6{`PSYA;t%)VZKNf34gkJl+-jB{6U9P
z?5IY%@ih=zKFqc@HlH@O=Wj*v?Im{dD!J33pE+v-mlONToX;=fH{8JD3lZlR5!<@I
zh$Gsa;!7h#S6@2(_a*V4)W5%EsBHoyrdOgB8}4C#tg%#|+%Y%@PK{AYu=n9h4-}#g
zAGrM_Eq)P7onsY{nSWI4N_-K-wU|@s-;PbczP&X1a3#LXBf^D)O77xZ4xPLEP3mUJ
z{ey=Pc?O~9o`I%YCRbI81#vz!lcIQ|q51&NuxOMh{jOAI8aGUy`4lk!oE89*JKX?W
zGv9~bN=^9!YKqYmeGKA@ld>JZ3Ra1hcp;3R+|rjuOZ3g_q<<TD7sd`dcB0e<i}a4-
zHz8Qd(o+C0Fs0FrzR;tf3kL6kR^Y>cKu?cM9M74|Ca4fBePdLh-S>8Ga!q!VZQHi(
zrpY$$++^2ed$MiYwmsSP_Wb_uhqKq-d)@1tPxo2-Y+M(6$#)x);uDysC+D`e*|(62
zDH%3vA9mcL6lH{4xj-{>+))p5vF;~Yh7;fuAeQTK&+9VXGhta`zRi*r@&^Ao*F@z+
zCK1Ll4}gw|0KSdnzwmgHD*<|98qT=H4zVJtZmMhWw!Y*cY_7k5CE>ly)A{IA*3Mkp
z`YPRzfB<+%#=3Xf3PC7cFEvr;z`TL#NyLXsQV=Ei_8>z^&b5Bvv#KlXFxQm#hGf)m
zS;LkYo=OFDm9!09WG73{J?>u1S=nJzq*k>36GjOS$OiDj^$%CQfER~h@r6b$rkuXT
zjUT>Xr!iTArCjb@czHs9u7;;n#_B><aS^x~oioEw5je8}%E<~4;@&ne*!0tT<egIL
zXjFOHr6f&K_U@;96jJHFe+6vZg_AZ;uAw4S8iu!K8I_+O27uMxex_h|8>Z_V&HDt$
zZW1bB%=s4lD?kxH>qUv?efb}u*A+x1jq+)1m~`%T%rNYg3Jl(0zkn0bu_kroiix)S
zP#~@G5RZ@*C5(vP_2GITJt`Y(ai<qk$hTpb#29ozw>x}7g0qs4y(((fz1&V#`}5pI
zq((?G%~GTwW!OZ`=1m?&YG-&~=96~<={OwV4(|8$R!`2j5^FzM_XD>hudBGK5*GY}
z<_A7SVzQ4u%ht@2n=jbK1s4abvnO>0RRN~6JF`|Z90`}2Qm>@Zui2p}EY|^C>SEfE
ze_`%XIYOfRa4Yo+(q!%2`}fu?J&1DDNNd$31y)Gni}T#By3nL9?#aX4KG@Jah^Fqq
z=?Ej<&tEp2cv<2zs_(M$5kL9rqdp^OoEY1lU^INUp~1CBKqudv@(=EY3_;_xMsh?1
zE4WOUTtAl^<b`MOjQJt1%&^K@ns%CK1i(MBf@WdGi|xr0QO6=O;v7b}xnTBT5RH}t
z5Voah{`EhXvTz?5E2%P0y2mb)EQHPhYw4bqZ(K^-nzlnX=h31^eREM!)ij%fs_|1X
zo~NzPY<tWsR6E>81>QfZUr7^C@1U9yozpVZkCi0Vox$SA{ys5uqYQ@y>!76)E>y<s
zA4%d(ougtmOh9><PzDT*A1DVUwsny+!&jhUtIL^PMH2M64Ny=O=kEF;zToEr5sg^H
zI&lwv*l3l4=_#1yvrT)JBt+ps-liZ7m}#aAe`Kc=dSH(GUWmY}ClR<ME@BQAO_l^E
z&0f6zJcy9SciL>i)liN@*2x%T)_w+S1<pm&Op*RWA8Wuu;yMrCf~jnx`>Frto^ClP
zI03b1RKTuA>0}YoQ!BQw0KH8IAmmpM@&1F%-exQ$baO2(zNvF}L$sj1UG%a1l#=1A
zj+RK*Q8=XK)C8#>BueqNddbpChnGm=;yXcrbryE_=$LWPHUh4lk3&l2l|OtB6T-vb
zsY^iwoiy+)?5aOh4d4}sVQ5cCg)hYf)_;AQO@bFE;?2^|LI@xT!p|HAKtQepw;>^R
zCBNhMc5yq1RaW;F?q+nYpml<Z0Ro)@Vf#awyvLVU)%%Ch=+TD^GYreD+vt*v?HO9O
zHG(3tJTA(616jN0BJ#_TpxH?U%NMRf!lWpud}WO6`vn=!XAS{G&pP(yDwFuO)Knq7
zVj?-eQ_snV$My$hP~d9;bIa>j#%%A#9<@wzg5?ZsY=)Z#N)eK!yF&IV^Vro{Qh%q{
z-6{Mb9&k>ZpEEnJF=;ZuP#v7)?@6s>%B-S)>olut64LWG#ntXC)w7U}(jb_9&FRvb
zR=p=hrdlor8#exuF~VGnT&fTv3O;zdLAPuwzuq|`ZPM0^(VmQe<*)<Yg$5NXZn0oX
zjAv9DF#rCJ>6H>v3xF`57S5p8DN5OoWz4yxQ4)`wihMCR{C7SlWL(htaetULi9olq
z{VZy-57gkg;umtlB2tMdEkDR^pc9_Gm|%N>Dy2A<P*9p6RPrMX)Hg8U?KW@N_<u7y
z5ta1=Cj$=Kf@Wrb=hpy8ieDa8Akh)gR|r&tJH|iI?$@%Qa2IpLN5(kvBkLxX)h```
zq7nR%P9*@fSw%6l_famI*I$cZ#+SetY#I6aFMLKER!AMp*pzo^=s-Y^J=3{=lF>5y
z=eM^NG_zvtVU_Bz(D_qD{g+D!0xUd(^J>Lcd}$pX=>9bz5#NaY1!B`%t?h}E{xbl(
z`ItAtkWE19Ti}kB9v?8f{`Mp#+mmng8^=CF@M%<FCO)20y0^yA!MmrG`!6?*so7L|
z_gAdH|JNPe;GcJJ-H6-r9==t8$`CFJIiJ&u>YzS`vldgAwVTSAmt`<GP59p#s-Ge^
z%yw#2yLd(bmy^C4wpqVtB8$j~`)BuVqAAj7XEGeZb>rA~3kfd@1kh>6sa#5YC%iTq
z-*hn+Q;VD1;mj`-WkrB!pb=*Wyt8v}*~WP%OOoMtL*ScK4>cU+fyO@{Rpsc4X)U6W
z_6LP&UA8pHABh}|@^}m>VR4`7kWjl^Lzu?P1(?tPr@mr6UiBan|477QH4PED7+ch?
z#P2KS*i+WnAImJq@*3^^&?l%L^Dj>1Vxe?2;x$gh__9v-ltqYp8}U_EiNT0zA1}t|
zZH8t+s&}ZRtwB}<W4gn2n)1rwl$bhD^`&l|WuFx~65H>?u*4?2_3Sp+=8amyDndI2
z(Towmxoie<4~pMy8EBC4FxdvQGo48MRzjxT9}w3~&yWm66qBOv(F#dxTWjZm%48&=
z+VrPy^Tr<bsM+KuKUhIEjBTU;cy%se>!4_|))W!rqV+uzhH7pE%lIJlWG-Vy1wDV&
zn<5Bvg>psa1ResNXsY*~i>FSgBoiazvWppkmER=W0dZKRs;*rIK*BGJY>)LignQSf
zwL+D$wTsH7T{qT(%xvCguH6G~en8>Ui=?dGriJJwMl|7=9*?MBYSBHd8Gr4dS!MTa
z9;wg+gc%tLnFd^tg#a0+9>lsoJNU_hU6q`_+KE;H59v2iBL#OBD%ZLm|CW+pjt~XV
zRxFZCf-Q^JEhLop+q*hF9vxR7RTrv>M*q3}x(}Hx8<AgtmE5_c8O}O$|ESFH5VDUW
z46-L-R9U8WBfB=C!B6p_yBgz=(W)I(X^&LmRp0$o7EY9`anfaghARp=-z-5Rv!YsZ
z<O)!h^JikYSt%5b@p}PN?(4sy4>1OuPn%tdI&9Ykel1*2$D-$2WO|4j7dGz1k?!;f
zhf3G07D#VXrL_u~(6tTcLTVeJY33_jTTW|k0_#8gydRAjT`J%#fRsO>^Aj;VQ-@VE
zQ<VViATv%TMrH|w+0d#Yt-Fiv5vn1JpF9ZUC_@lg$gkg^`D;Y6dp|G}MC5>JPD8{P
z!_s$<h+igWcNx_F{QZ~kKmB>o<W~4j8b^vl2HQ6kmfKAP2pgAk#u>d5!;9DukF}t6
zdJD=ExnVD`g-x$0hI}{ox)o-vMa*}b)u+GD))jZ|iRGcDga2BFnkSV-*TkD&ZX3iJ
zpA&|IbT{lz81Z`|Npk&07MudGQx%XGF-y5~{2bwInOs(tmG?<B&>CYeCGF3QN+xPJ
z4Qf0o!3O&xhBJYY@frzXTFCjET-?`*;7tjSMj7Gfr|p8gJCvBj<-y*ztC+?4;~#&7
zSVJdPr;pQ}{GB(agD2<~VfbNrO6W@t<9pp|%;Ie3>S;JhV)^_(7qtjLbWeo_i<zNj
zd;n`1s~M$p>q#;ff(LAo?fen>pxkPVW!kR-(S?McG^^WhdfHZd;TZ1Dh=}n-j4xoH
zcw@H56V9}gq`f?sEfeY^^#JkCDZ^DHq<h}x4T*8InL?q>7?Uu*CA%1EUvXUcuFgRN
zx~?0W{w0W8v2W$NU+ECw&9(Mzg~boxI{n~1gS~4Mq~jjM;ucqAu<WFx<+!V9B=nRT
zl4smukiiX~pKCISQ*coz@jYR9pGJQ*UBH_FGrj*Ejeg6KGwQk%M0sNFE>*x{4^oD3
z{CA?>nQgwLhBDo%QcPNS=&?T*27U`SAWbq}V1!5B(5*-vS&tIvs#;~hWFB49*!TJQ
zB>MOB&xQm{Ymo#rOd3J>=R5EzaDDuQg4`CmTV>1%XC~M+F4tc%+jotJA~sMZ2)+Z4
z1Y?MQ=qh;^Q5>jWymD~C2G`z6lJAf$%<%f;oqewPPf}pUz=_noejB0&nouDAOhp(U
zO#2%ZDGD(XGjAzC5~3hfWds?{F{tPq8IT~(j;m@}cp9^O+sN5yec;^#y$YL;C*Sf%
z<l6knY!=ud5m|f-W$FoOwlcJ$DzWbC=*{JV?9iy3LzL3ajROnFnP$<GkZI|H7m}5-
z7K@@;Y000b-yQT!i@)N_WrF7wz^QIR(LX57`<M9^H(LorBt<*7iAu5(F1JIj#iku;
zfw>;IQ|aJ$UAphcib=vxL+P;^lrHYtM~X%$?0gu)-&D+iPfMQ+2RB{YzOeBcp<WG!
z)}U%&L#|NN>ZZE;I0a&YCgV*Cd-D}?otWJOU#+g8Iin0Cj*fD-P}cn5FADt5Rn?BQ
zK^|qT^4k(f5UNMf_{qC$276DAF1$D?F`kNvn&B>VghLH73nlJ4V9`j0d_^$KznWgK
zJHqO1u}8>@#4eR7GKq||7o>25q?!M%Zg7ux`o}OlcZ-Ixv3Zc@AuB1nwiu2?M(<j6
zTiJ*$_-pP@vyl<W1ABTd)VKGIrq}YAtXoSHE#XxFQTWims;PXfgS8F|CliXoYn!pk
z5ARC&1AzKCBLCOLo^8XwHopJ)sd)4$Q2hoZxqKG1QCSDq_Ktjp;rWiHFY$D~mdIyT
zsT?_}9AOg4qwmNS&J;P;6y3xXVF<~ggUHc|r%?y9Bt<Ycfcz}O8&(DFpC^ti1q&)2
zcv1$&a%7VFlC{4&)S)%Xur$j+La7j_8$i^k{izz@lhJy3nSQIn@=}B2BrQo<5<!z$
zB1D#W2T_9i_lC=FJ;S2F`X1zK-FfzALqcgr9Q2my<}B@hr#g}jnhB;Ea4?LjUIrUm
znEv&WA3p61^9D1AM0!Xc1~)yLuRwxs%l`uq!I+c)m-|8S?3kqc-dy;m`rfRPxa(-a
z*x8t~XcBG2&LIG)eIMrJMJ07OiltB9;<7Lk_gXl<{W}#iGTP)?9XF$h?tX*y6yh2y
zrz*b`FZbRI)TNYl@hi`Sx&v6>N4T>R#5hyE!mFkz*j{CzEr<s`4{*j+;F#AskpBjl
zKSlDdu6u%ip%I#d3~Z?<NM^Hc!_Oilzw&xZHegqUd2+N6zl{5nDa~!FzL6%$5-51z
zY|k=+#_~-}l{uS@5=N_By;;bU@OWTFw2}?kn)_kEc_guaJKnpDKl43ik>mLLeFkBg
z-v`O}`*mHsg|!~)bboeQ%c>`7i0pTukE&gRfkA@yr9(4o7J>0(d%y8M@Fn|&@cMAE
z>a^lLB@<s*#%{>|w?@n;S@=+SW;R3gTwl{B;m(JRa6(0lDi`?}qIN5;Z1V@26vjMt
z?H6I|UH?S%UZzYkBJ8X%q32L-Po{S>!`I6w9u!H>V1~-_7o}GyGF`sIIHfe8sCf?f
z|1n~&r}QbGxE4?RK%s<#XNAuCUJG9%^zBA3=ioO#ErsETDuO2l^$%`rlzcwPnC{8a
zAdH}b;`GESe-g!>NS``Xn-_nd?QWO_%^hpDl>io3Fp%)>lxlx<j-SZ#&Cm#V*jEfa
z<eIhY7w!`o6=oSUQPu)|kVS(4mtU&v@-D2qEz?hOic50`7P(SL3K$h$7V7knurwmw
zaf3s7^)X6ug^T0R2%W6CyqOI3&*pS37yE;()1vW7jHWJKfFk5HO&{MBmjR-HwqIpx
zT62){TG|pPLE&VKux7+pKcN(ge^5^~onHor$K$xMhTO4q%#Y093N;UqxXiKGj%o_g
z!*nWe-MS1lKAjXsePe1wqM)1Qi{_8PRubXZWcbC)USI3U+Vs_T(LVQ(AihKX^nKOA
z5A-_06!VZnP-b>kZ<boyB)@G%EzX5^K%2&jm&vx)xJX`{du7W?$I+N9eg+eto*Vkj
z8|Mk-(8~oZX}V%oQPUN;j0oxcPS|pS)b7vVO#3Q8_xnldr<46wh^g`}=gl%xCTsl=
zp@{i$2E#izz9|}xkWt|%52Er%s(`Wv(;^Y9H#~==H`u%8PKF&`+R7bYJ!ro?@&atA
zF!sb(s`e1C%+qd|+ha@BH0Ce_zH|@Dg1HnsbGs?hcE9OUnW7TlB&Y_Xq>Y#<XHhV7
z@1HoOO|ds>Q`Epfo%liPCZ4)IG8mAWVtbfhqp=BCpSTPU)Uj_`p~*;~j@8M>=7`QE
z{%#zQS;}4+{vgt|6L~}LHOp~rq5Fs(D(?J*QEt+OuI=BWD~)7tF?W@QP}{Ae2g6J7
z;QVU%$(AoTRPP0Pb%{|jU$OGTT#h-P$<Zb@NN9;eqwonDss{_?k6`v_Da`0KblYh@
z1mlj^IVK58Xvj<HLf~x@oI0a+F%I$rtw~k?p)8J>v@!Ge?lH9U91JFgMi>Ns109dd
z7o??aKVJSJz0xz@XDwE{TBnAs9&&~^rAg;U#HtVjdms!TrahQfR_u=LV7rc<`6`JF
zIhy)Q4Lg%m6CfKq0fjK#zhz+>pnq5rd~djWQa<Le#0ih{sZQacQc1=DbI5Co8fpO#
zfs)c_jr+vu4mHruwZ6gq{WISy<otv0?Q>}PF3t@zm=E=y@$%T0l){+evEnJ=wC8cY
zE(WH1X!siVIcv@P&I%?tG1oY!N!<wL&{bBmb|v(V={gjAo?KQ2G9U25FvXr_`qm}D
z@1gz**zF=^mYJe@AQ&z3SlkLgpYbjQV;NsTK`!M(@~%G?v8b^H8aL?QEwrr-s=*R)
zT<J~NJx$P#T5!28@3Z0~nd>jWlDgi?$TcoK)`0_7_f9Vb<`74*fy*eBapWcx<^i2^
zlvbr$f&`IDawp}#_(ymx2Sp0)l(+R>s6}&rW<z9h%r(c6XLe#jOOP+xdwsB`C!i`g
z{T$UEX&9S^42kLNeHsaxHTg~m9&YOO@sTip*&X9?m$G%AXGa}TK`^mC+3<pF4g_I8
ziy{GBeO^|O>t$R-;o}4#!YZDUExDVi3k5JWnaJPSU@w0bTXDk``ARyJi9Ny#@xT9u
z?fVImc5YKmaMTX%F|EG+<WUexZGA{>R$IW(m*rjaMm?mm<!pFqa5q;Tr;z^GNiDbg
zrXV_@s{Y~7^ZaSLr`7l|HaAi6RSpXixcvr<Ro#bNW<&?%2T78Nz1}U#1m8VI*I@xQ
z;`L^$Ot3kvZk)IJF9~6&7ar!b_diP7pHcy1y`OKAJFjoK%}vxPwW#Cmli#xCAZ#j_
zXa9)hr~7S=sfT$<@KRJoZ$zvMyQT`}zFn2#fH8r*MfkQ-%+n@r#0vef)Mz8PwT%TZ
zftBce^vW@8*Be8|t3;gU=<~f<qtaHF5o#)jmAdoqAg9g(OsS=wE-TF?{eB4tr?Vo&
zV@UnFIc8{m6UJ+Lx=I&fLj6joro@@PTl}LiLSsI6kKI}?TD?%39}e*>F@oc|FNGXL
zHT3Uy46sB0C~NbyntQ#*I{htJ+RTCEK>sh~4?*1)C`njNUuHq9e#{i#g9cQ~k0O0b
z?zjw79YKTTUZ^cgS*XN@Bj^2^!{9VJREocJWCs5462h}qc*))@57|+4%_)ta*7Ns(
zo$?3ELkA!YtsxA?eAN~yKL6uS-P=%im$6&2H`bL4?|)z?Lp&#xK_?MukHGrzN0s)q
zj_s#_Ph-;Nr%t*~!~3J_1278xRi>LgVM~=zHkbMkS(#58CuwP6)&}Q`Q_`h8o`+59
zuKXU<4PKtl+Sll)NKMz>F36BpRuD&WYuKV_{8<js9sb-M@ZNPT!v1-+QdfNc(be+~
zq()1zHu}dQY7-73d45tX1J_Z@00&2wE#LF?(BF4AtNhJR4!h6bUWUumdM3oG%r~i=
z2^)ukX~}!+w9dS2(NMWwY}bCltuD=Io<QV9uBkT}XjJ@B`$O^59Sw(_$P5`s14`dr
zvO{Pz{svKo_`P?ep}K{x5%mJ!-0OovC3KOEY1AhSKf(LA0op&hfC1GCMGH6WKhs5F
zy(wpIhdx$IvLNC;INl#2Xi3kSlO$rdI2ch?k5AVm*I10%L?@3aDZ5t!UqozpOtO0k
zS0WDddQBq8#9f4!a6v>xIO<TRl=VA3VoT2qy%2rOoM=#I$Gk41l7g~o!t|onor2WI
zPnRUu%^Jr%^<<=#K$n_BW0~!&9iGao*EahC$He@TDlus^mwCwsg~M;$V%fo9dJwDK
zuUQ^20?s<!`Q;;*`+3-!b<v`_*LBkbgoEqM=I(|7GPx}aY+Hnc1j@I1@P7IwmzY^E
zD*5!6c}%68ys2K+i8lf)i*iLI24A>3(nO{$SSCw0ao)USV4A3k-Vq%l{{>MnxMm{D
zj+$~6N}RoW7nw~wDEJ>nFFFiiG~BX0IB>2=&?y$5$P$jp8eN@H$8Xt(CYwoI>QP=G
z+|rXGWE+wV8{k1S=Q6@Z%}Djx{(5;(6_{d&82x~_i4eVc@nLecV0g8?vC{=DVdv|?
z;okD9e*U`)NCIACHu?hJ0|EHWch6?GyR-DAs{ZJw+?-U^Q7Hq~B`352Y&ULscPkT;
z)M1R`TCyr*-Vhs;&cuUGHdt~BJm4@}OO0y{3)AFH)!iwWf&SAh-;WtOg2D4U#p<=b
z$-xtU3j2!w6RdF_*<$YTm8F-E0yvkT-Qo6fz}*Vawy|MM-73=&l<(@tyZ3R&8iv7{
zGyU4O{?65e(PZ$C8FXV3m#ua>X%%XJ8dU9HZ<-1C7SBUP_h90r&c0f*&tVWhsU(BG
z6~TLN6@!q+^Zr+GA_pExiLN($S|q}Bc!wTu3&lNcc>Pa3<Lt(%Qh-zWpfJS~PvJyT
zUb+KN?CD;_EqLZ=B#-v08BM3DO}k&7f_2VZvr8_ZU%IRe-{?F<q$%7!(=I|5u~5fn
zQ*F>UPqj50uIuigFx9%b#sV>EAgFBoPR6bE0WQNH4HNMDx50@+8ONif6jM+Wui^pI
z*t8NhSKj_V%m{m$-_A4-kR+_OT{JShwWF>;sVvM$APr$jEn?DlCUSbD?_pz0x4EKe
z@Auxu6;YbGL{rpJ)R=x0(!qVA4Pmgx-j40ef#rV8E5aUiglrW|=<=lIg$8?<u=O?#
zv*PG}10azxfs*n?+fL1d$z`A#Tb)@jM|QdjYl%Nx`J(20JCloAy4U#{bd$J3H5wg(
zlWj)5d9zLHq(6mhp8fo!U|1~&lTWu?AGP6|()hzI_3(0N0L_9S^XqVe`3aRQ`Hw;Z
zMx3?P<?&6R_4+X*A|2O5;ZT3v=2mKRpm-!gV@;}hXkC@$mN-|0%$!x;b2r(f>Lk!1
zI_@GBUv;6@FcY0mk$=J8aTn2fr-=-RJaa0X4UqGC=N8qiqSUozmC>?HLBl=5!$uui
zD`wEcm1q~Y8HDN65(@$5(Hs+AyC&88p8r7EkJ4b3gFb&i>!N#Hcxd)jDNe@ZXpPk_
zCZgL+AN+Nc!BTJDi`Y+VTfQ%djpngZoJ>%f&2VW*?p0e1YFPK)2&0qzA@KrC6JYnm
zTG{Qy&%4_Fq%*n%!TLk}3}72fb^NKpHZ(3qRDcv$Iq?8|)Jv?YsnDFdtEB&wxXfx(
zbm(WYQegZ_O{gHQ+d*K|be-`I9tY=XDd={*sIe`^90Cn#7Qv2S8S6+8GWs1fes4X-
z8B;}<=SMR}FILa7NTm~9@kJ1f;%$~nAoo?<^m|fgXFtIqVNV=awnQr*)YMz!BwsuV
zt;X9AZ~n*`cL5u$<m0t?R@pgRB+C;iP<=WsOYru|Z)VZGs|<x~xnUu)SSWV!VO)gX
z%QWncrB(m=4ZRTmZ<b@Vb^mf&$Qk;SX0H9{l`EzOca8FfF4aPTslXIK>qZWpJDS+l
zmY}^m<I=la6@%nH=}evfPae;$fw#dLdVaD5vaCuyr#2HN2?Xxym9uv^0Avs*_U5>A
zEEGv>QtaDb(1Mu}uZsM(WH;tI`TgzXnqDumf1bWArB!}ui!4$VL`QPqp>GyQZhs#2
zgjI{uO*A|o;%A;3Fgo`c7`=5`AKwdd@F-|;oXwTlu2O9RiI#H6`#`$a)Qv*Xdxd{D
z<o?*cTE_8-&*D=|QOpI!0Nj2Ns3$)Xl4?z-bX`hO`XKW6OKn3OeD}Xbav)b1Zq`B~
z+!trdT8&Z?!nEQLuP7jg*_Cf$I^9mL8pL*T(c@xBT(hE4+^s@UpLL<wG30gH5V~v8
zHiWTmITZ(op_80SelR?LIpT<5MfG)Dx18~;9_Sekr(F_g2}w?w0P_F-jJCxs0q1am
z%55oAwV0rQDxM55-99_QprG*Q)ta?)-lMn31XYLfKCVnNxbpndTXRN;gg501){EPG
z`|VWq+znZ{VXLR+N+NcPv*We<3O3JIaq!(cUGMNbv$S$dhn}pk))#qqW8RHn(4M^1
zlB7%$>em@KUkAr(9q<aZ57<dEB&suVcg%&(`MAME<8uh3$uy+nUG*oqQ6a<c=t6Hh
zr_Y0Rvt2fz-E4RGdAFmM3G3+z1C5pRN*XDY&l(yjCFL@@dnIS5-`)Puen}UXFf)Sk
za+!4=m%RV`D4FB`+^wzsj^wMYt)hB*#!@n>08||Y^82M=F3h<u<;Jz2v<btJkoK)p
zOT*lekKH*msuhf@KtrA+)aEYq60V>({~}gvgw-Eahy*VQ*u44WDkQj9bX-=L)8!@>
z3>6cl8_a9+8lz&BB_k9YrPVRH3?dn@mn}n$e~hJ#-6I_$Nd_K>dY}DO)=<TrXOZ;O
zfE9f#8U!T5CK28ZHw6)~3}C}rubmrdMMomO0Za2^pd3BMZ7;icw$=>!=hPQ)t|@~_
zq}U&?JdExXyQ1RNSX|q8c%3rO34|=HXuj@NnTPIh3}=g${+%;^xs+?Dg-}x;$;Hrp
za30c>YOk%g6OB|b@1$t~4gMZ=Jfqz+Aie43zW8gI*+A$#vj<S1TYVVh$7gFaT&I<x
zM$>U5!evBfd9&yb4qiRW41xXK1@D4ddRfSW9u?cx%8!E=`CHZK-R}7;S#(A{#_33B
z{_H-KbYjua62)<9x+|I>2FatbNsi7{wWw2vzH2bL_E3ItIPUb3A@$*W@@okwmp1XI
z-XfaQV!RjO!b)0R8EdVeCaSl>wG;l=Y;dm)4s+xY7QOXd031);OFV13w%tOm)A_<7
z1^Mm9<1|r%qN8rWFWK9A;rH^Wn-Ha5bVNE7bK;E8+Q4X-cX5-wM{|wZWXNmniH84C
z*`t@*YcTOha^~mk_v=+2cw7fy;{a_GJ!y<u{U>B^7xmo3X{nxxMC*gJ<@o4JO!L&U
zq1B1VnVSb+$FE=^9)kQnZnmU(Rpnv%l%VL=sUl>B04`gx?Q<6ucsuJvYR=lt^ZTC+
zr<E*mfgpaVWqkt-RJSLC?GZP%25P;!7F0Gq7IJWhexVJB)c4%fCN2d4jXLyEmPg#4
zZv%_HOQ=FDi$vDaec<9D<C4bS&%)a>Z#Q+Gl*;6ZeeK$9qn7&f@`mrwWAu-iqwW4(
zgGY#@WG=!0o{RWmeND5`JuJnQOWvGdNO7kXgS(rrXzoRj%2KOd?141+?I^W$Q|hO-
z19I-AftZj941tP~m&Ou+jq1JDGqNM;`St#4T2I1-eR>@g*-bz(Q0w8&xl#)OA8OmE
zc17&bNj&oEcy2S0+CNQr#p7x9KrJnJWXWL_z~>y%3(r<c)PIA3_F#v5Qt_Cv$;~y_
zT4|d$tYf5ixnQ8B@U-O28gKyN$jlbhOK23<>yDp~fINBbul~wH*QBYBN(eKp9In=-
zc<~;B%fQ<|6VUpESFn?~{q!SSGS#{VJZ5!T1Zd_iaYC{RlZ_9^v{D}yv6Ra5V&A_@
z|65m>e4ZbE9F%7?T4&{|)@|ZO)U-YAF4sJ`q&q8Y_g~RhUhRt7Q_LTR@CP~}?A1D#
zouF$f#)cp&xa)x=>{lOWyx(33@;a*rnvinq_s8>Av|3u!H;xDIw`%hL7UXc|!X6k9
z|Bg8B8%UqFwqBChhWr_Klf|SPmCj!KSp!ku`>c%%hk*;1A%v!h$O#Er!koDI9b{+>
zZgec7ldQ>!j&e!Y6cKYok06|kntZ4P+5dX+O`}Eqj^_fHSN=;M8$leIyhm(RqGljL
z@F|VQTg8FC;yRq#ssEr~`m~Jx12P%WsC3X+YsYViu>BbmdipOx;mDlQXnM0HOg1`+
zlE#FOCNMz59-wN1thJ%&6ZQUUgHi6!4^^bJCl|$~K!Srlf}IJdgsT4Ui%<Hc6$ZxC
z$*>n~G2~5vXhSNq@ELdSSybd@XW>>AM1h)qMv0`ouAZSTc#zDzR;Yo{;?9O#3zbV+
zQbfN_`_yPx8>eGcZ%Zk4kq9J#&I}z6;nx_27s!*<5@SNF(WNokj*nnUX`I?A_=P8w
z9!dGUs-w^104#>PSR`$YHrxJMo#Z?S)qPfl^Yk|$Hb4ht-CQXu-cg2<iqgNrq`6|c
z)X_?iicM7(0o@5sr!&O3r7__eQK%*{M67C*+s8!vjoa^ZH;atoFMKuqC0y?gI1}ks
z9+Ruuw<jw`(#2nwYEJ1m6CLAzm-uNs2Q;gW``QPH^<Kv+jhP8(e+NZ)Yo<(*eIWy2
zL=_bP5(|@a4tRIu;Tre?j`#z<R7s6GlO-4hGsfyXO8aPY!SZsp!gGIcalLT*(WYC!
z_qF??DsPVc?{+TYgF2B|ZkAShrebyWnOd52_sTk{$@@1*#(f(aj;KtdM$Sx}uDom4
z^6ETYT~MbL1O3|MZFH&DlX<+(o__~swDBr{|H*+FHL+ID&xO}2j1oJuKW-Wy72`=#
z)n6F6in~UIe>OR)v_>jEkYN$&R2d1Go#n;G&BXpXcN~pDg>R9*-BlEcEIkQ4iltRu
z1C<^FRZ?pxY#&pttV(;Iyd_GDPXY@TIcy&aQJ*U1S&!eIdSU%0ix-a*T!>|+f!78x
zZw3Pglg?k>F&QQ0CQ_<O!A53<cR0cGIxHhw?k{&y*bN$!Xch5;msatw6BWwOqeMyP
zTb@Q`9(SwfHia}%{S<GoE}NCMY+(mQLix6w`eg+pZPYuj;?K*{+sO+n6V#2#>LyI+
zXMslQ)Kz*34mI3;n>dacOpR<afJLRb=2`xtDx(xlr@9!e1Y~dT=;D#3ANQ?CpXbG2
z#BHse_T<K*6!F2jgClekD|M%U&8L$l*o<ETc+Z1Ftzd7*+z$n8p6%447G|M#h5rl|
zM##(4b1iEMFl4?cI9zsAtiu0N)viiub0F{IeEWs)ZK*)M)fL%8OjJ{e7Z^URs)YR1
zzRgHGQst3C7o5;9UoXYghYon)mWA`YT(Zf*8R7n6q%kwi<`81pqy&j4tP1LouIV4%
zt$%eFS%DDtsy4BlR;4jfYpVv;x`nZW)9xFVL=AId^`RH4aJg8ae<loKuovfjb~>#c
z+jF?p>U)+Zq~1%U;hMVP0Hn;8RS$@Xv|nB(2e5at6L_v6Q>#fOBmKB^MnB#^Gpu$&
ziLhF`Di>riXu5NOCeBk2o$(xwU&28qMe@+54h@%|c5<nnky3Bq4|1jpScE_Ky_g@h
z2d_$nDk}`OgxIqxh_F1#Cq^wRfq<KME1xc;vxIY62rPrz`lrtv0))yQ=4mfqdO|Op
z_UI`gS*E_)j;y2iMGNfnDV0++cq)I1b#*w6FHPUO>REJx!jfN!#>gNz%Q@4C+6~kG
zvoS~C())utta<PV6A2=_D;5sjIkfti4%6nxjc&T=;e-~<cfIwq0AGBanPX>t3Uym-
za{Z7Q;$ORG1g5}bp_ydflTIm=L??95>J@zv*P_hcN--|(iG`#e)4or*VVF!F2B!D>
zNQLkF$=AACN%ClIiF0x=VeyF5fiX`AgS=k&Dbc6J*eFg#9QHTi3y*xc>}+|2f`Xa*
zUS+8W!y5b+){fZeA=-y0{}e}*6JW1<wfF5_g@t}`1fZX&-|T};yrgXPy{)9^U2*kr
zpEs9b$aw>2L#D+t`kwU@xz0UPog96eB08`P_{h-dm-3?N36){52gcf_lQF?lZsn4q
zZ0WDxTe!F0*E*KkAXySzlDufMq{otl5HVJ>S+Ms-1>`Hb(}G%#Oo;kQuYyN>T9f!?
zPj*k00Y%sMQKNpkz|TgkwTtA*v4n1Ic)DuG-I2_yZ?5Ly8cD;uEm5;-NreOzM>U#F
z=c?#Z5*%4Y?T8Q4K4K60UBj~-x~FV1^c!PLfZSe3tI53|foX1jr~&LR^wz5OHA=2z
zqD*wDq8ncxBhG{epY#hg!C;M(Cq1n~HoxF2U=&$8zhXW9XEh?!s2+oR6LW}^-f<<h
z!e{s~o|_qFO5j;@A)T(ipN@oc=UKWhI%kw;mqx3Bx_?`9VMm=YkwFEhnk37CG?S|8
zQ+dJt4Lh~BZ<5-3C%5LH%NYK=>J6LXNSUqQ*X<vr3~oivw0>Y&VU+||@_4>fZBF9{
z{HsE{bD%5vpuS;M57;*l7_+fCeh>9yZedUKRg2ARVh6Vp+1on9b{`f@f8^`2Y)Gj2
zFC+rBqs~1;T$Qq7nevf3Dr+BWN&so(6Hs-634N7=&XM?_IPu{#n&!w3s}_&ERHp63
zW5CbkuH@_H->4sGtRHP`Jyc|GEi?wqc0y)G%2i}FLfEtnMsT0AhAMv^m1{hlVrw>)
z^!j86YHz%@E_6WS^>Q_cXa7ajQjRN8-Z&swuWM<u!kM_K(>!D4NM9}89GTMin@fF3
zs5)Td+cDUmBQSnVCl5+rszkT=2ZIc5ohLG58M-c(X~R|Alb(D0zPPkXi~$ZnkfTYx
zNLf0UA@?&NVeEff8>8^9Iyj=V`>w?|@|r9{x+Hb3zeMF_(%7gIx!qdBRGHH3W0&k0
zC3@k-G8oF+S<Yh!p-uJdiJ)&!2d+hpRND?&S)1Rg>*%7jTJbmCjMjlBR?zI7Hi_5A
zs!oettJPY<&IwXoHnMYqK1CV`>NE=TSlB;m8w?#N8<{L8=l4x29-$r?Z)&+se!SfJ
z*GNNg_m^6Eb3jgekxuVwYW7Z_{rM@x0tgP;(>`U8f*zwlOM#VZE37_P`2Jf%o~cdY
zq3B+DRQ>AEv(%Ifszu(>UJew=A55JIx2naDhWxEE?%ZoB7DYq;vf?XgEVArmMSiKC
zT;Jx{d)b<sQHbiY6tSgGBlOr=)K`@h>m^X*yCl`^bNs98%yxx)$-V-$Oc!%BTQov-
z@c{MLReePzyISIzAdHow)OBk-Jw0VW-Fbb5?u8xp(6QV+i!K(j{u1sRY;OsNo!fbf
zQISGtE92?uUO`G&f6Ekr`vw)5YnLMM7d_l35Y2py#k`(V@PJ&N9sS1vE%#;yj5~2v
z1z|Mi$o9CST@z-VB9xo4)}-lnWF`tX6V<%)zy?#*OwVw(tRD7AgHD&)HR*uq;TVGq
z8OZ@b1+CwFq4&~G)Yw^$%+S!Lv*U66_$zy>_~~~xmM(J{>I4G-rhhWCu%S)Tbh;Q6
zpN#oQ+YKbH?E=CPP0f{mY3)=<d4w}|=VaSz2(9FPX7p}GCw`by;BgY==El;RicDEG
zgj89^6e)c1lKT5mCZ7etr1&4VGBwL$ch@%G<W*_MGyO2=3&(bbf3zIUn~Ri=lZVVh
zpV=L58_{dSv!Z7}Qx<W!-Uj)YX?(oR0@?z7lXQIfyon5s)Mb_yJvtTyF-!h$i0yBF
zrmKhAw{{=dY*&sS*%BudTr{@Lrn}$$b%;l%wbhcp3-(8^Mf*HIY*s{#B-q<aQOUXa
zslm4*QW`ofEw8h&yG1P$rnmj{g8MQa%_7;|<YYXpFVg^Z?L8umh6z3JFQXHtp~Wgv
zva!W#uto99&ULGu(3_j9scW%1f5x-!T3csB@+JIlw}{>x)75o0SLiPz9fK~tZ7{3F
z%i+-a66Z@jkD1WRck#8kOzVmM`?bMINNtOiXU&3^N-#F)*TFUtDkFM<;GlHQ-vR(u
zcvm_3eX%&d5*|6I1Mz+*1_&ig$k=UrFc~r~3vjZFIxLjqJg<x+h`Tf@!=cn@0tKYc
zt|~<U6niT}0UW}uW4{Oc{cKdF&?66rSizFRXAXwit_}QKHl)J3z&C!Or5*G#vl#Ay
z{m1k(pDz%`e8R|j=y6GchMr~=*<A)R$$wJ~{QKVqnTQdT7v#C(+4n%bFwr~r+I*TQ
zyo<5%9?1ppB8@ia3JyvwP|{Ph>p(?-nfFRwHX%RC3o;eu1wz8vWhr8$!IC5ec?z(G
zVi*ftWscSGREK%Q^@fDK5ri=F!8-A5S(0;cFNsyd<}LkHZ<Fre6$s}knc2lZtKPh<
z(LEbJ(uI~^v<Hig(CMW3kV0!qCaemnl3c!BOIRC`YiF4|WjZF|Y(?vU$tW2RP{6Nb
zBa<m@0K*!dvL$8e3S86JV#)D9MiV?37Mot;w8rZ%&ujmvKzF=Rm&{MBTy$PpbsiBF
zNajcv!>SMIi1}sggeojji&>Dj_6;g)Zh?E9JIEYlj`<i*J8oq>EEN2B&wZm1d-?}?
zhrymvXq57w6tV|Cih!WZQJQ+dm3ts>zuAJ2i7FwL3~9n>cPKhWgY(kJal9&RM1F#o
z^cw?MquY5Ul~R`CQD6P7Lp80C>yh2N#hFjrlujoX|8~ztHN^Aaa|1!IdTCRsz`R!2
z53QW#ngo>xirjy*5?(&pjc<RgoUH{+y3(0Bf1l7zGESGczE*Vh$7ihqM#$~##4N|Y
z0cB&L7sI2|*@gb7&6>#d#|Nu~_U-R6JS?|l#3(={ILBrA0!oo_Gu6l>>)7Oy9u3~*
z&$H)Q0(rURGpb{W<drq5<C@Y=(|m`++G2kO$v>i#2dg*gV>)zp4ebjziys~|kIFhw
zR@i^ds*`)Pq1Lv#HU2FEwQ6JPbUF>z3$+UbE7XXz|5N|xyRh44)zWITTq!dvPp;5z
zT%GFn`epo^>&&i_8xeU!n8WpOIp!=sn!@qu4p@SB7?M@*KK`UnJy(3~Vxa}rL_QW(
zOveib_w#kmg|~9QeRs2HX*^g>w$iEe$!=!%?*Y>)y#xIJaj<(-Qvnet+43WhWgmBV
zhpf?TyO*gQ#24rmRl{DcVj=I=0ic?zriUfmc3b@rzfZ=ow0npKD;MZ0Y%Lh%y&N|C
zB2<u#874vbFPygSke_|#i$2?+4U$FE#_?10(L#mF%NtS>!5&$~47uwNFKK_?rL}^t
z4<&m35eN8nd3;P~Y7;g-&Dr;4=LmItN}+K`0<;QK8c#@gHbfuYtdbXvS9%WC-;F2D
zW>1`36!^^)&t6Q>&6_Y)<RuC#KUoDkUSeL@(AGC-yybxvvGe$-R?`kLy6Q7_SSG#!
z;k5-E^M)6gn)-6KFI&uZWdSGSPg`bM!I}>_a9ZKKg2_X|7qg%5#SuVdwMo6kqqqB8
zewBNkAcTn^Y#0;jSxRLjyk1#{Yh4|Y<Eq}pMGR>G`PC(Ta+o4d$G%UUyD4eXrtntz
ztkv=h_2Nzsx?@wS!smhQJ>x5Ga)B*%wP4L*g4bm|pvr+U_wbSTQ{)`w(0tHMJT3DD
zWK`?_`qI}2oE{-ee5$@ns&mi*Js4SpU2Zz=zNf)Qd{})Q<=HkNIhF{U7BI6X9lz>k
zI-IY>x1fd^9s>ywZ%#yTc%=4)0`I;Ru@$jF{i;ptn5x9K9YHQHm=O@NmE^5^xn7ht
zTJSA@*s^LcIK~K^Q1%&_`Z2F+g<0bYpjctHJi4M-eO5oj_%r~F*T|4e&}`i8{dSp*
zrTO2~B+GX1kXD0DMOw+iDSoc{_xFL`Is8R{U38&Fw93#j-f|+AT&8aoK08FuDu{#p
z?+4z6Wg#M{TK;~%sQUeT5T?JB-<0al4MrKWtM{ty3;xRHu!~>RGB(NfCf_pvxgQe`
zHf3k`>!r&0BDI1wb=m#t2bwiS<Fj6oBM7U#IxV{D0-r{Ho0C&LI}A9xf^eTw5fdd{
zsLbX2g0s}W(5+J=2-rY>J)qI9@^jXEZSU`cdAts9HSn~1A9?HYkaT$YR`~QhJ;v1-
zvrfCGeADr2yjW>8_j)mJbD?Ym__iPX*1-8Uz&DwHZV^~{{k^Ek`d4F{vflIm4SO_?
zHd>+w%{3F7m<BmZMp5O!#(N*P%Rk4xf#Tymv&l=5;>KQC##1TDkdw`w=Z5w5Rd7}c
zZG0CG^;XCWwe+QY2HXJm0_a5|cTF)h{3FLio0$(%);;!O`nf$&0EHXqLEM{#^=MCG
zX;3w@DV2P!HCVj%?}M42&adma9hb<}>g*pvK+YwbMYs_kFUfHIM49O=Y!v^o7b?|E
zy>Y@AIr!aKtc63!hMbSdMpd$`Otw+#;u#JfX@B#idb+1}ny~CEV~o0Ml54=h2I=|p
z;jd?CZn43fJ!p17A!K<Xl%3}%ax*kLPl#k5G%Jr=M_JK*%>CKr-D06bM~1#9fw1s=
zrNUfm=uaox*CLnGo_gDknrNBwWScVS^s?EavW!)TB<j(3vV7gz*8pxb=<`VDde_zY
zWUu&D<^9;R_RaenxqL+n!!c_gwMN+)t?Y@>W~Hq7;D=>E7vE3P%MJTchlh&BeJx{F
zhUO}TN$<zC;^PLdV5bIo$^GIo0%Ci0Emx+jfgU|``s6~9(?$N{kU4v*bv{jw0rVa0
zKy^w8m@_U9F7Y17sg3YkXz98(-{NVFdQ5{D`en_bR{DIax!7<sSIE4yx1^<VsFi}@
z)lGA>TZ;=2*wDEgTC7;9C|k{wR>l_lFd~EUh6hE$V7<i=szzI3>;b6qV2P2o571yC
z<?|wFVT$TD4LdoXAzBtc+wti}(eRk8gyw<&qxtrIt139j?GG9LH%+7oj^5(dhZ+So
z1KFJTxe`7jMYDpVveHMW&J9fmQJDa|P=y7V#O@qGb%<2x#Hd}=6!uZbX(i&JvY*_c
zm1M3X#Ftrg4P(jVBKL8EK)ZqrNgZJxqod(r<<&0x;@ioJQ^q8SIH%6vC7c}s#MZs@
zm<lh#o`;ZcFeA2s@>M?`v|151tU<&dk_pb~FU}dnm%JCU7n!a@+>8at3BXkpxVtgJ
zzzF(*{o|ro%hb)nPsb)sce=?vkb9Uj!nWK{Ruu=<R7X}X-5=6BU{N>&gAGFtdxt?q
zRU?g_=j`NGM^Hm!Qbk0J)Izq+7w|}*#61Mof_Sdx+Fo%;UuafcuiXj>Qh)FY>PBkX
zbqH%4|Co`oMWRHTn8K&-f8)jK16BR~a7RQ4u#qBPtu})18Ko^HhEg;^Ps0v@Pew4>
zEL5E=ufcnHrBKQQsQy9dYtbG0y(u$QaDS<FwfPQl>%<}3;GttbQgkFA_|9ARq|sI9
zHd!8u>aR}-GQAt$&Vl@p?Yc))HP``l)^zJ+&#BJscW3*{MvkNYkLzI1i4HnjhykoE
zfRA62y?Rs9d1X&T<c5{gbZbel)fT;3K(RVL(KfaIH}G*8eD$7|>e2FmKzGu{r>+l;
z%AjXikDJ&(tns#olj>lSCcb%x+8CowD&=*XA7A2E-=XP);)&(>D$Qm`NiqCLfNSaL
z+O1zJgXtKg91o&M*O>R6Y9+#Qz=#Mwpo>G^FD5T+&k$xsEfHjEqVx1?x>v$S24&dk
zwC=<OgQQ5)V-nASbr_bl%?e(RBjjBsC0giwUzOBQ%0tAmTu3U%R&sj(M}Y<>BgU$;
z2*s<(0aUvdd2zc0i6y)$US^pOc<d~Q1WGssfE9HO7$O-i+XV5qdEK@(p^PvB6S$n@
zSb8E`TEPTm4-l%r7tKJ~CsmgN+g2Bc7ItzhcR7?)zRv)EmcQyt^do%Co#9*>7%s|_
zAqzd=@lYt{qcxv0NctuI(=;SnX-~)UI>kHDX-{dUj2>a{)%?tk%NsCgfA$!^vU<W{
ztO->AsY%z^$bYehU&lNGs$FiiIqZ@$by6bP5hZRBCYr)OU>f9Y&gKcML>Egpo+-79
zA1)iKTrAx-I=n9D8z(I?V=A0hxr>`{>n1JEGQJ#V8Ji?W&LZj#XYB-e&ZYO<I#o`o
z$0i+<kDF)hNgeRA8|ayH;-^XN&^vX9tCcPeR#B_1%@q+|giwHu-a5B|7N*-5+-I)d
z#In7W-a4OVhn(K}Pl;kNw!r3Dtd*2tpt>E}W~1(r@5J9eQFgQ9<iC(=ubq?c5b8Af
zxCB8w?`-kn5`k@fHkhUaA;h>!Vjb3`2GueO6~kq$l9iL!FAp7l_XTV}nMd=|u%%CA
z577;SPW^Q#4;Ub?hojT}%eH{gTR7Jotf}>T0i;7<JbYV4RE4SQ`p|iw-Gh*9w0r`H
z8{|2CQtz7Cmdpw@g|y;Kw0M_^5CEU+&5lB7v~X2}hr7kDTk3QhxCEtIZTAgoZAkHT
zU)fF~%=bQmt%{vfCHH_A4oPG``Og1*YN5BL&D${d1W<lpU$ovG%9EMWfariOhoGM4
zb5hV>_WUf}Azz1{DN^08Skfo3<_!6UU*fwd*sH)c4@24>1+g;2WC^NTmGD`S`0rl<
zMCq=amV-#p{19uC^VCV({x(}bfBRir0uw8pKo$zTt-1c7`Zd(xo4vtClFjr5lCk5%
zgpFnNF)&Y&o9m^4N@eZ$Y;)`oOc@MUA@7AtrlBK#p;Y!K&ANQZ)}+?ewpt&3F4}t|
zqZl_|Tw8F0?SB^zYKdG4HpFZNq$`KHYKKiJd4zox{vt1PYS2ik=v5Zm6Eo`uMijr6
z+;#ITIgioWI{U=>V(t6wx5;yP%Ro4v&+n~(hFp)ZIJ0&Fz|-NobFqzxXS9^dvk-~n
z_`^9lI0~(#6rvPiBENXtP0nW$Y3<ZxTbto_9MF0=+@o4^bWW|M&$gN1)eA6mdV1J4
zRosvF#A`)avsRFR-z!L-ITd%Qr})t#E759_F(}#Y==SgcGo1ZEKRvBc&+wZ8f&MqZ
z?NYp+#IXxmWAN<fTvf;JHkw0Rc4mUs|N6&5;%qZ(-P`LA^Jm-<GK2*iYhg4ZzEdI;
z864Q7<4!5A_!sf#1CGm$|M7*m8=OyPT`Rv|S9#l2d0|3zS9E9;6aoKY*9Mejhl3|C
z*M<Vp@u_Tf|A)=qai@ZL^8kfj;CUMmbw3#Zwi<yR6%xZP9&04E$dM?k6e~k)w?+Eo
zh0@9IOdBrG=xW}EI_#aIMS*G`f*85H#C!AVx6Tnvs-yVtok>!D{ectzC^6c_HWF(l
z%zXs@uQ@kHUAVq8t%-@OXMUlTy=tgGx|OrN2^_cx&0g<*-LH#pWGlG4Glo9^LP4y7
z?bpI6wIOlBb0kV@`)&Ga#<<1BNFlNUuiRxFK_@3X)9&Eyjlcm(tUfF*mF~)o`(Vw6
zqIA!>D7M-2n7Bg+g`yNH&`=8S#0mVP%+uqdX%-a<X`rTxT(J%VM*;}K5gK!4&!)>U
zC1<P+*_7KhY15UpX<kOmbBY3f81wn-t_JFGclUA&^?C-xN9xNNqtOm+K$MwAnMGy7
z3)W(~FCD+uz!g{#PHp>?=iCvg5Fd-w$r@?B$NfSaSS?gEh3Z%h3wi}nRypUM*d(+O
zUX^Dzj`*l07mc_bJr7^qW~ejLt~6>1Ily`Bxz3p&%97<qxVXP$O3eqPN?vJ52x>k*
zCqzC`g&tw)r%OXEyrrk{P|%u>(Vz)hGd=45JWLO*tgOs2bU~PX^&7wLmQ$E3blY`4
zot~`h4Jl-2`M~%(Jv@!o6&v_(WkfN7!bJUeo><XB3gqSC0Y3pA_x~Sb-xQo_&~+Qz
z$;5Uhwr$(CZN9N>Ost8`i9K;9wrxA_$@l$rF8-TS=Vn)RKV45>b@kqRtzHYc)4UwT
zYwVFkn6#ft>bd`!sn1o+)CUO(;ENgOVHh>Z_bFJHKdbB7^-H9*8PYLl0?~SroTaR)
zwX7{3a;kka-zP^EH`z<=-+4?g4(D;9?PQgVTE=+fE!-S-Eve-XpWkoYkU?C(1G+>K
zDNBxgudwZ_SCp&6lvSC~=Bu(tQqOxmxDXv-SnCzyP;))4_-Ue$VdIzC0Sh~Q;sig7
z>did@kV3LKl8HwG9`|)~LANnK)O4;FQT%Dc7hi%MC^9?2N;umqZ4{pOs0!4B$60l;
z%_Mn_mL?M_t~LkW&LZ{6rmT+HEdS7k2$)?;Y2UKj{5H5L2-$Hv*lG1`MMpCO8<N|s
z=?-1c4l~>Mhu<RemzW>w1i;~Ore4*WQ&@QHBv5X((Z6)2ks|a{3_}0ff*U3p9j(Bb
zwt0ajHbpDp+nNGM3>RSL$+KBJR7=mW@|6<KaWHV{l4awTpuxo<yRh(%aN%^P$>fnS
z<{BGKgIEs-8hgv`qH;e=SR%w;EdV(pq+}o}D4bGcGX(OK*Gh`$1i&ctiiqf!`&-Yw
zBSRw}?9ahJ1kq`g4_&YekAio`)3w*;_~|Pr^&4Osmc4b8X<Fat<YN#CuXn-OO_lrn
z$S6+!A(?`zyY5nF?%igM=5f+c6O~R-Sm|5Jg$8wU$>$#IS)h<#>U5>nn-=!s{jPH_
zuf5dzHD$NI5Z~Crt4x1ogMBcYg;TX^bEVJ=Qx6p)_|p`71SX^q2?R+`@HUb488teW
zA~?XkdrkP)iK@7W82K+#qBst$C1>t{Yvg6;4$B{@l*U$rY<IhB%&;jLN+Y1(L~V~j
z@<=L6p={9$DhM1*CmUOMYf)k(CVkvhTglS+*>*DP5R?(*QHWF0zvT0gEL!dx-YJOU
z*}^mlG^<|F^{IFE^61Orsnh7&jev<S`uDbr?M7fk|Cc7qz-Wg==$;3pr0>u54l#p0
z#a@?k36ITOJ6rsrNIlW~(se{|)&zz4J^)iHOctFte#8ldmCy6uReOl>632e5eMo7}
zxgf1z$SybTP4n$<rxo$=r!vyr4BSyrM!-m9VlYEQ*;eR5r6KvBhFN0<r<I?|?h823
z>2dOUm^lL6Ki9d?%gy4fz`3p{$p$hP3;T{bF7o9WSy+X}iWR)jPliL>bzd|pn%AjJ
zTBX}{nL`D<&M_h#W?Vfb{ILwW(2FGH^a3~!BhSlJ=y%ykor3T)z5GYnb9B^kr2z8A
z{74VA%!pBxGfn>*)6#32?Me?XiwUKyao!X#-d6Ot!5h3GL&O*fw`3+YOj^;J(lVcQ
zOfU_?LrG^E`6lk@CYtDGaAAEo(U|y#-KFjB38P0LhRvpKte-mTm&3XlF5GX4$q%rT
zejrtA_p$I#JkZTIvD~4su+VbUivUud3g)oi1n%gjCw-<RsHT0Up;E3!o`21;$IYD)
zW`grI6VHm~p`#rqhiX#SlQ#ZHs)@7{H=`weW+0{NS4Y``K<XSJq|LJuSE3EpL0yP0
z7)kJ@9#Ebe;=BE9nY`&BBo9c_jN6DvWRpQH^~cI-kXvK1o+u%T&Fw=B;RYCxo564t
zrOj!jO!J{(Z*~U!!{)Nn&Nuf@f7D*mv?mpJM&m|><HM(;qiXmy<bpOKt&=@f&0w(_
zX-<|NCpT-flxd>q*yt|A@L8f}o6jb%@iG1_d>xueEzkNbww>7ZG*VsId^=M{VWYhi
zkzv@R?r*1_@8c}|d}nW%t^&BXvDp;veYAJ8Swpz8XQI=Z)xGt)H-Vs(4$a}=q-C46
zop}?7@X4_a0R!!RtjPc9ZDW{1dw*W7vH168(77;)XGblMyQI@#_qUN^BArebH=90d
z0pt_}!MgUEnQw5uZgXxO(^@s7xNUmM*5P5P#h5=X@8yDtN~{<uJRMNs?I{l5e6IO0
zFY0O!x7l8&@vx!;arngPAd0*7q2c<9x4cu^YitkeU|Zcp(N3fSd!_L8=c|GQCOeJ$
zm!AAxo=g~f#*a0v;W9MQ@K1C%0)rNVsGhUZIKv^QNaavi=OovtmVW&dqKO|!UHVt>
z#mU9pO_Ahx9)C-(<PQOyx;*xJ?&fUmfvMzAcpOaCF3<B%(|^6_qN?(juvpoap#8fl
z84l`$+opukb&`IJxOt!8x@tH3P>Sr4sC;G~E*CQEiBJE0P?`!o8oD`a!-Uu?c)NuY
z&Q8oW@FLE~M9soB_~hw-s4Qb9VwF@Ibi&<2@w6iwF6DE2C(r>X%It{-@4F+ib2*(`
zXkufWbB5fzVlOoJv#`8=8!fp*`RNKJ+jMJ+KGa}q?8EC+srBa1em4lpUg-f_n?t7Z
z+)JshjB?x-ATIJGR&waGUvmz2OxfQVvni{P=d~I92^dmQ=x1+)1LBdsV5~dS9pnvE
zq0#oyW(4!vaTFk7XAQaVSg+PJ1XnPHG?!sFr7rL6A7KM-Df!B6>njbc=?Mf3TDgWH
z?k|*}8<&k)(f5%GSQpgzJ^n6Jm^~y=d%bP9>0bg)c4*;iU)|Uuj;rN}o{q79WTkS|
zrNX1EcZ`1f$YP&BDL1xS+vZ#?7tt^Z;mKOs^B{lg{j36HOq@{LdPLl62#aTn%!g+e
z3)Us!vb89hDK?f4PIPdf^08Q}`ft#S?IE!fQY~r>bW<GVW1`ZxI??43{Sayk%as#E
zqw>P}J_78Pym-Ut*{qu`-N5+e-DAV#xZz7qPBTLAi5DT^HtJ!Kmjigz8JRodpjQwz
zVwylvyQu+Y9K-`Qdf+yC$bB&au%0je$P-c(9U|xah)Ab@i<y&dP>2jjx0zk*GE<@O
z?NIIYV&ZHYoawvUWh01*qcZyjrz1eh&;FU{mDZN?xL(>$PVK_IpL0MCu3^EmR)3T(
z)H{%8FTjJ_kEfhc60EKAWfN4@Y91+sXQBWG-iH7?iwuibla}vSs{#@zNcmzLBPcrX
z`7IRMy8pWCDK1HzSg{B_02DXVKk_6~YCARDw;&5Qe{x?3nt;#mIZ(562wq8%o$H|Z
zim9w;GC!*bva<SmFa>%1JCK(z=3Qf_k9Gf3)ciP2m?Y(DzL1UL;V6=snd9>9B9|Ji
zej*GY8a?lJiE?+R*@Ex=MHhHFXe1`7!n-*vnnYBqNjD59JUdv_8jW*&A^i$wilMmQ
zufZmvT!q&b6Up&1ONtimYB`sv+c9H1b3iB?Ji*lE5~}auau9`XJMR2!qASH|<+^m)
zjkn7F&;V^}ch!({Q4d8|$TcQUo4ECEmDUV638cxwpyM%G=IIoN)>;gJ5vWq;{5`><
zZ50@V>uXpDYLtmKjLB$p3s%{0f#a-`2+EpO=UMAWIfDrD#h$VVH5>E9kl8O(+nDjt
z6b&+wSzU|*Js5gkw=o9m2qyMR76O(ONm!2hcbzu%aIg+0YvUxS8k{rjbS%xZ9V8c^
z$!TMXLa9kTkI+{xG_Q=z8q(376*e}>El~3zbV_<W2!dp(cP_O};LmC0HqM(=yD>^J
z@mD(oEv(bC-9d>J7s8crDH0xn<B#OLe+h_rs?`Zd4>!5|4-0`8*j%UD5pMjQ%f=B5
zZnrTZ8pi}WR||uX9)GLY^yu#y)T|=_oY%3flzbxv9krco4tr9~5~Q}|jS@xB_T>LW
zsn_)!kVhAoOE0>8tvs^Qg9a%vwoT){ZrRv;D5VUFgR0-i&K^Uo*Cm+ILe8tou;0?}
zx_j&Zrx8~_NOg)zQGYpG8pF}=Swlw<x%&P+_+2zcL7j)8{SIZb<XB(WARf#QuvlKu
zMnre7DActt>8+4ioful+V_60Lc6w-lDadWK${d<V+{yQT2`;YCcy49Z#~y|iMuO{-
zXcxK8Ee;Ir>7D3#Rj<+Ytnck{B$Go~M3BF#(cR=~%Vh!&NC;<mNVC@Ab!u+AdW;L?
zZ?u|sYTuH`5o<K+AB%8Y)&oef<tH2Lm_uWQTsfTX4bLJ4;_K!9L(;<kh1Lx+DEv1w
zSXgsKVp>LC3%UMkZ%Z`RZgcP*D&uJelm#FFwlrGZ*pxKILg|z#lubgPlpducJ$9!w
zAxe+j!nXid^gRZzLnPz8Hll8S4HzZkgu+o^oR5E$(fPY=p!4*vF(bXZ`J&WZo!-}W
zRd-@b=V|H8$M&|}X7B*-X{&KOy}R|I#k`K**M8M@!a!GJv++5-yX~Ue{JLhu7Z5{9
z>ub5nJ5j0gG~TG0-rabSW?n~EW$`_=rTsMB=&51osR4m*Q%C1(u1!C&rS&w@$eG^V
za1m#o_C2*qJ7J)Wd^UcUm=InS#-Qs7<087p?U0F}cA)PrW*WR>GaFyq5Q86lwBYQo
zp|rKmt1R+k-Hi<sPzk!Oq1Xb*=;?mAEOlh`_dQ*g-8OjBSZr(S>3$sTdb}(ZXt~Q<
zj_iYUA$A||*2nrEIKf!7rsYYUcB)cc1Z|(&&2)4y2JuMex%?R{+~MTiB?Hwhj%Ld^
z$=5^9c>}*oMO+NIbbpn|EsnoLJ6c(lkGZ6P+fY9y$LZ$KR85r<K#M)8Unj<<;mAsh
zTPdkasqb!gJjQez=J5K6)WLoPF?T3L5v|+w@tsTi+c)jfx@_67ygINa`c@ry!gdb_
zC|3jOayGB|<ItOH6*lj-97h=uGd+>-`Xbq~Ct&Rl!@h+q$C2p|BQaC6{{A31jG1c{
z#p^J|*eg??>{3<$Sg&3wkG{1Elr)HbXU@&?{rmCV_h{Qp@pC_;N3ZoUFdWnk*DwQ!
z>a%ILQ@D&cADptzy{O1xpT=yMBUUVjcOK!5kxPnaoC8l?meawS-rYdJtPuWAUs6ml
z$yD7w7u_B^j(hLvZW((=91^5^S|Qr5XjwVbYF{r=9@j7d7TGo3*npWi0od-&;2?#6
z94afEI+<?jp-ovQ7L5+Ptm0v^#x|%;eoeIO$}gs9H*{Mk>H45M2F1piT+)+-m*MtX
zifqF>21}#kY(YeFtr9R9tDI(!SRES4ptEU<AQ}){Sh=bq-`#>4zKzYg@nI`-PPCwh
zHlT-cQa)t<)G>!5h=^}q9~fE9VT~d_;TAC1_3|UjxmHvmR36<KZWaSA+ZDhXSvk&V
z{Rc`7z{R61EST{%BM|{z=ii#XvE+(G?FjD?O~QjB+)UCpD+-Tlw68~WsNIJ2xvoMz
z>*f#aH<S8yIX1~`8?`e1w5!e+|I}UR{Z9ZYCC7_@I>P5;K5l2*#JmxS(?McBIw}L-
zc(;qbd<m)Qe*<&>St$c+sGEKRm7|(|0|2?!^}hizZ~580qeWj6K&=CZi1!6j&zg~K
z>HW6ffC*l@>-w(2qAywA|E{}^!;X1d{xVet@=`1oebJw7?<L_?+hIQTHUQ|(zIS=&
zH~;UJo7gGhpNgwY#>zm<M?uUp!T*4dW^+KyPhkBV(A4O@fzLkVQ4D|*8&S2%1BT?G
zwg2kwWzNPMK6DNf%nwsurWW?!ED;<TI!5}RM;N%{Z+2@p-xdKR=>tUfwQ4Oj2F!+-
z0N2KI^A%J^H2tUc;I>X`MQ|ajbNfkm=HCO`XY8QJBlTa1&Rb{Os9Skwp5a@c4%kD~
zk%F~kY8~%2C=NeE0lLoX(d!x;t$VFM+G^VEhcEpx+Aits9jy<EJHs6G7>5~Q5cVXb
z^EEBvcfd}&zDWpZY+b16CmgQ=nMkUm!cMUoxY%P2jhbSpuvz5@*VDSkZ`hEx4$KQa
zjY|ddeVkqB4MzHIO{_n&8Lo?Rmht~A@b*u!lofVydqZD00X~1OFvLuAt_HAp_k4B#
zuxUi4IdHsBLup@e^ih<N`)_F-0n=IsV3dUv&$-Zp=>M^qi)xFJ#bOyg#j`5t+14pm
zld%r>@J=$jyg#fXmG7fc9@M=0%7CGAXa;eqAmYFnoZS3;3e9s#-Jp=d--sO7XSDXO
zKUBbDSwRGF0}&M?%A-79Cb`(0+;L*mkCizB;evc7!`ctiP9)sQexa{xe7*6bGmc5v
zEw(lkkyy@z)6ODzA16voCO`MGn_hbS3P8^rSJqHmhQ+@x^BhnVDn^n!9q*~@@R(Pf
zM8NsJ70$3A4$3Trn4j>xkq)dYYA{WN&=mGU|ES=8)7?$C%a;0VPAMLJ*|ip1$jJ;3
zLbTr`7oxQ{d|$zzB^7|i9zDU1@8Bpkno5?sx14vFzbm~w$aq}@#RD`o_l(eP<VH0s
zIjnn@<PSA5p}$2mL!%}5Y_XPw=Yrl#GWkP|o=4$R28TwnY<ZszC0tB%>hECJC5jr=
z3k}veDQ3k8m0yT|AdS-h<MM0)Z8h5quWM^TjQ4lxlups7m~c=zf=Fn9WwPv}H9dP3
z?HtsS5`pI6`R@Ka9sz3ll?}a>u9Ga?Q}eD$lYn2D4iWs~k{nR#=TE<k+!nEeO6~VD
zVtJJ4K%sfOLp5$N>oWUQ$xbw`ho8ieMX<h~&Hv^$@Y-p~)@ZL0Z@;7;xSVJj<-Poj
z$t`+cOZXHJ+bsIeeZI%>2(@iz86c?CRfD6Mho1_N;xGtp0HoiU&=#NOiMJb-AK)gH
z;lG*UOVH|R?GC_UX|&hV@E<gfYqgW;CJfSIXrY#INDe2$e+E)e_?E8H+LLN#%R4r_
z{sWhDWDaUZ($V~?$FRa3|I=Q}KDHyyh)P0&!wlj4+nElP{FWm4)}e~wEQ6CUGg04S
z7i4X92P!WV5wNO4wCxDzvgz&4gNcgCJo58ffmSY9WB9B&*Z9*(b`a9OI7}f*iJzjp
z4*g%4#lEi(m8z{@#&!5O=JRL#62E60L*hKasUU8LEQEjAS9Z!e$4{FF`&7gw$;4Lu
z+)v}1qq|cO%{wFxcU~M9%^_TEV$YuP$)P<YQWt1kSbzze0JZk?Butm83!=d#S{jp9
zwfglEg2u3`r!{ppx{_!2`8yT&uAG%7CUp*(YO#F|nX4?Ig_~t`D(P?1&ydowj|!hO
zD=C{+*Wz*eRMwPy)9(UulO$%b<hy|6+g5(`_4ZYI)P)Cgo(eD|kwRCQhj$;8N{Ez8
zuL#IB0{E!UXGWh_5GV}d$wOv0&ez-{)lgB~lJq+xZtpVxb|2z!LLqE_|4;3h1i}1N
zMYMf}@Y0&NCw$(GTjV%gk83!qQ>x>$5jtCcMEB|yW;@Lx%*l0=onHR&s?WG;KVjsH
znQz&Tu->i9H0Te(dJ?titMRWm#<4aHu^bo;Ag1@T7ezC6pz6%0kfBR2E#9_KQknEq
zNvW4_d1jUmQQoALo5yexyZq#RuB=zG?44wbm-H2kVHZxY4{mKejIh+*>Q#{y0c#0M
zucjE+DXOM8Bh)E+Vkr36h4d%O5}zXqPlLDtENW`85OrMu!Euf?sF}_8L<{@MCaVn{
zK;j^4C8fgRB+-gmG#z9N@~`<9=JRl(1wA4E^@&7RX)VE@IyEHlQlv&)*SHZochf37
z-OctVmQ72@f8sAbT!=0{nvshWWwjal11tJS?wMly7@y6$xuNudO`&cb`98<>2#Pid
z@5Msw#tTqtxjxFjzOh+e2~O!hH$QZ)0W1+PZTH%x&U;Jg)`z(*<HhQPHFs8Nqe~7j
zs$(xO|4s|gUbKp?4a(68HBLDpIJbz1;@BkvPml52@aJ5_CQ#`mFR1kYK%T`Haa;I4
zwQMwEQrkUhSIr1;`7e#*rF3r0^^FOU1t*Wq!xTHf@-<Iy@w+`K*u?0J2LC{=0hkWL
z1#6%*2N(Q+s3Eq3>}T!>yPl|y$S_9pO04$OUe`)&*4ZuFnA%4via5s0!sP!Z$0+My
z^<jr5l4pYauxJ~n#%O>ayG=AiPQ`!6jYiep1$mps@4O`hRoJ}2MNR*dYj=dI_OPhu
zp41d~O_Q<mp&w~jhmfV?Z*Cj30l-iiEvBD))iKw;z5iwpnTuq|7#AggT~afbSO0H7
zo={__kkV1$r8vPw&SW+t{YeE^n?xk>8#M#7pG$(=swc7>_9HvAXXJOmqyc)n6^L(U
zBBp39QvtPGL_bbhCq^e`nw$rB71_>s-$PJyx~+Dtc}M!8&itLMRxZF)gh$f1!xva}
zg=qIjik|`##UA+$0_iP<CZ=+VRQ{bduM}jfjSoT`Q{SiW312s{iRs$!xe&zQ%_{RU
zA_P0h_JlX}kgHbFmeo&dRZy!8tI=0Sf`_;GTQO7Ai19Xpre=L&$bj;RrQxlpTkWFs
zF3|L<re!qG+PCa7s}*3mmUmh>-MqR|1M9qi3(~Q7g7{-@r#YCoT>%zS&I~t+lvhrQ
zf`g#My=DI@qEkA#?`P)IUSqAK|5sbN5mOGn6Y#U@*D9h1)`yz^>RjSN>Zd%oW0m0?
ztN};-%<V0lW?uP^E_)6RTkVp#Q@E%IsTR|M*ZNG!pS!p(rQQJB7U8gwsbQ}$D+JA?
zCOCe!vo3Ps*v~DfMq-p@sZd%7YZ04+07BYIcZtT#%d=(JGEMflS1lp!D#P8hPTOsi
z>fWTiHQWiE$26S(0VCWO*f5MN@TOk55p0fLG$IZ*WLxH4tJqt0g+0GJP4{{;X5U0d
zl_t~ge$!7tPw)9~EP3+}+W6~IdoQ``7kamSpYJD*3e6oxe7C<~7!s#r<ZCG8DR#Ic
z6FJg49WlZo#J?G&GyV%x3T!Q@7(U!Klg(g=6vJlYl|0uK0hx`UWhOJzlqO(5Ha*%A
zvls0}7uV|n(HcyV4Yoa~KEIKyJnR<pxg~lm??9~pX}gdomfpsI+QR$-Y30(_Y-@%T
z(5!z*F}Pse2-M&Tecd!w?IIyuaSvILisR)OS5g3EcDfn-cV<!@ziP65Hp^`LgIo^0
zjlk1|?BJ2I;mC6YIk_5oD>0qsvz=^1{O;T~ovJfpeivUFB+O!uO3O66{iBn#g=|U6
zKW51Q1zO}O)QTbZ1NY~?;edJHf2yiL6|n&TTNbdnCS6BDIwztX_oUcT2x4i<@iN-y
zTjG((fG6V|`;v>2G6kMWNeo4J&s5A58X8^<TDINbL`KJAm4a7EQy_K}C*{KG1r^bI
z(c*ba;Zc%PPdute`kxq>W3mlN9D$gWl*APvvtR<^J#QYN*qY3e!;Qf;knz^!bVDfp
z2qw8Ii7IepRx-X-XU%bj8P|EllfJ5|vqg3+vuLpPibgMdo~E3ZCTn~MX44oB9X%o`
zWt?u|4exn;uEe)T$G)Q9;%W=~aG&YB7*IlR4(!su|6%LU?l`OMKu`nSZSFCdgxU_k
zMAf$D#D_%v8+v98nzCVQa+_K@(@|bRu)(5B2tV3vF|VH^&#retmKi=N_L_GA@x0n=
z5f`v@Vi_0kym3Mmmh0cRiroOtgh1?qmQFUZmZdOo=tOpNN!;#^R(J2fpd6fWh1BD4
z(uVI9Am^V0o??0g#E;0do}3I=6O99WqR*27B8cyOjpe`J6Ttsy;y}g==IKXSc;nR4
zlR=jTJNu){`CNeGrIL9UFAN#&dd(sy1s}eu<8?|8)dy16;cK#9Daya5u~sS6o&B)4
zIW5eqUM>mtuuBQ0l=4RcJ|Uc<16mc$3MbssP6ccbDkn=jPm*|SgLHF5!A1(8W-I#$
zgKlBfPZ&{zEpK#KM%cFk2leOueRILC#Z~6n+{E3u^-sAPQMm2F+UcnQRLy;KGhzy~
zX$cl{$aQOCjn2Qtk=V_@gnZ+%37I^l89CLXP4-aeTlAc3Et=~i*19_n5JB_dN{0c?
zOZyfWSDesJn&j<a9(awc@RwVFAI<9`Z8dnVe4G}SQy_FK-bG_(NUeD6+duB-&MZbQ
zt*G0nX8q8%E>NqNCXeAL!EyK9u1Pem1Nt)GsfxAVaYFJ!QOZy+xC>O?)3HmQCFV?K
zx8$#?@?zI9W4h#D@oVdQxA?Ptqpb0h9|>nlaQg>EJ)fJ=*K}rsrab=vGPLaC4wj_0
z`lYrK8O$mlKT2+W^xk=!A`;e$<y%eY?|gN-kXGz|E|Cl3r1%ZG8^_%(Q9J%W0&l9j
zhYzz$-j!bABhsr+@i@<gb!h*h!CgXn%#x=1HV;|Dqs6J;23OdUqQxh`4E;U@F<GOx
zO(~(m=QeZDCSTO5T6U^)VZ^mUJ0r_IEAE)ZwvlGDuF_Ps=^Dv+b5k@WF~a&_um!!3
zfXd^$Xs~b{)y}p4r8DLsBYl+ZVT8sgN~v*@JWmO)a_vjY8Myg|>=IhdRLZ4wF@54{
z7(1qEWq0<@vTy2h_;Lckef4$E<XVLg#)VpIwI~*oE>Oq(^(P|3Blq(gpM&d>C{8rl
zBu`3Nm5&Yx))*UfGCVC;2#rkbu~Qp5@i05W*`~2$@ch8%$|vJ2Q|Ka(WDwmhhB`HA
z!6*xNpQol?4q1ZIp^UjK;0Ow8YF=8QuELouEP(ug3m$q-aI*%0iI&r{ccep+Tb#Yh
zWPJ0K5(|`*%3CyiOk@1ZWlKl9N=^}bd@-ezekFo<qbnYci&-~u<K`OQKg`xN4+$T>
zfN2wi*6&9B`svKc<WVlYxlo6Y#O1$%3j%i9Vq#ln&F+&~A!{G0fYmV_esbX+84oG2
zisrFo>ma+bxsL|$m~tf_?_)n8!`i6$DupJNxsa{kYKk1wPj6mNv$BYe#woL9O>xL)
zbBl7=*bKliELe&+^6MkzTN(9HdQ*=2oJnr*b~<iaWVmx$R&SOt(AQ-f6)R~PcB;m8
zT=c3M(Pa<NvGI#%yl&;_YN68d4gOyN@IPY_dC7m@%*Cw5Y!W-%G=ACQf853a=0_O#
zei6Zt>jd3p;>z5jBUhScq^sg#;5i#5dlb6;p03_ysd&Q{C$q?Snfw3AdQ1dKtcb`a
zyw4!9N3DJgD|oe>lcPkV^*0l6KFo?qv5Y_RBmadPv6urBHER+IiU<h<+^YsBcW>k}
zJbcQY7;sM{W+&E?Ng*iurIfI155NZRUp@EyJL{7L5Y1T2bd0e#tRwXMc9@@seQ<~X
zZ^)@KDwK_oE%~Cl{7uoGDWQjyt`=!B`vU_b?F4~$7u9MJS*iVUCpsb8lWg82C}pW}
z0FKL;^v+6>Wb3xd%ECJUC*Q?@P}Y1Bft$~q+Jetn?QPFow<*u8>2Ec}-m^8C<e-z;
z+|1Ayf5ucC5}vhXYSyAsc|-xC?6o-<=rN)7)7hAKO4gA(&Lw|r{0fdkd~MvkZ4IcM
zyyh|wo5&!{#h#FW<d}!p##tS#V#tfa`kdF=jXR_)hqnIb80j;>i9Z*3r}eqc!2r(C
zo3o-3r@REKzNoe@8k)m+<^X?<V?166KL7pNjtZG@?HJO`Vjcg_$m)lA0?eN)Vf*!1
z1K(BNY9Tt9{&o4b+$??eCgZq2c5$CR@0-gi$ix<s|E%otKzfs?L1A?c5~34Ep?-Sb
z3jf2N!HYHJf$S>4y8V)n%RZCV#5I0{DN-2)P^}kl$1Gc#VZ#~vR*#FeB3Q<t>GWG5
z7z3J_v>pcowmH}=CmJOB)QSZRiQZwmg)hu=rh0v5<#KtmzkI5@8hX|Tq~`xS0RHdl
z=P7V4w+8+(yPjuq`=+T{H^wH~#p8zxK=EJuY#hqU71xMZaduCm2n}mT`y&<7xa|2T
zOYJjzj7Mo$U5@2#@^YHON*%jM#-1uEl103rHt=6T>&8g^mnh{st;dLN>(5BIOt$IL
z8g#l)#){*_3j?b{;0161ALE@mTCsBO2O1xZPxU5s8vjQY=Q^csL^^-X3GAi#hx9?}
z&q-<;wKsJ*Yc5}lr$Vl3XatK^p@RadDQ%8;uo*A%@ePl@*cz&fEnX{5a%U4CLew~t
zsAqtjXSOewYQlVe0N;+QlM@1x(oO^LhQRkmx=ETFEs6QCpp*(wwt`6xQHzWacVZK>
z#iCY$32r@%rc)2@sxcdl*lY^g$t!t(;>k;jCrW*x9H126FP!-D)n6U}RqFpnB}kV$
zzc{nY$@3y#t}eQ~u@ZK{bTDQZ4r^@Y>ooP{8uG1UeEkz)kK%no5tf{JudW)EoD#h1
za7rHBR)IKeA5IT2&nwiHM1)o{9xA2$+Z-78W=;bu=;!A=JN2g1ws@ex4F%m{ZV8l&
zI($!Lb$a4t2hX?Rsay~BTq?4r&t59(Fs5#Xou|D}R+Y`%YAXHRcGPZM!6E{+#UXmz
za`QIg1{<@~PI>-i7y7xnA;ZG^WQ*jpgL5ihwTcL4VWkgPc0jRlll_edQ7%M_pJUwT
zlOJT^z1`O_KVC4L7Ear|wThwC94s8GAF;Xhr&#0<HqJ`S#b_>qZ4Gn9f3eW!eZ)9i
z<k`4E3b6<%rlJWZ!rwXTD-{|3LTxYQBr!LY71l;J1bs6O?F0P-TYsLmTApjWJuka?
z!+bTJ%`+5EK;Z$)wwL~FxhQ>|8m9HC)UuvAkErj!?G-`ZkN@FP(NJ8Sng{zMqxwXH
zBX3Tdtf>-NT3RahexRj(26#NZ#0dJmLcUC48S?Y{e!QH{H!=1*P7?xdhcf^mz1(=F
zU}#5{AODL<^)1rwg(_hij5UGnrw1UtxjOulf+dm;!8kxn`N9$<DngW-7mR#u@HLZi
zT^|D$tzh6w9eImS=7N+bIjdikLe<nHdC{F9i;o{Nkx1ZnGx&bpN8?Ee+R`s1k_64L
zOl&}Uv-f9tv@gWX8%Jc1AOw3ZlMo!+tGdD)jS2#^T}arEC4#}08A+4~ItH*>Jg+*3
zR|G?sMAT5mthhBi91vdOq>nM&hb$T$-`@-HdOw1gr|1(-9m2pL|I((7BHI5Ei|SfR
zcAzY=4mT;?4wgt)+i#ste2&Wu85AZ)NDvbEy6OMHx<`cHRA#i}42vOj^x6J^S|E$v
zfMtZB@l9@u<V0rpqQ5ITNd**elTtg)!OHTFbhaB!NoD*xSaKVI>Vz_Y31)&?o*kW>
zNB%ko01Y3J@u7@hi(w!!`ZAwymJ^7!8(J9#$#00YLu?UV!B?sKK)?N^4O=*4P9eGc
zzOI4JY$>u)Lv}RjNKBA~cefOzCat7m8ks77ans&l*sU<AB^VoY#^96HZ5i5Upp*dK
z0lK#r+)wBSbT?2v?1s(0XHr{l#NY7#QY(@!r6iDvrX&hzd&Pl}EZ%kjXb@JJC|La9
zOj@I|tqB9<Wh<i9EnZPH1=JSBqFe@~U`8NZ8_@U+#yhWL;26xuRCo`lFtB|w#N=Z+
zLBM{!{Gans+aRIWP=O9O@*lVc!ubH@Fuq4ZEs9jdGxl{wXKKxZR3_kDG<uq@2JW3U
z1l=~q&ESwJ(_r8Tj1Tdz5WI`RK%zK`J%*E2GD_*dJ&54C!$bIhG$f>(s(%r$iap2y
zkkUJa+_d_@izKT9dMt^aLCxx*XT6#i&ADmj#HyEa%LKxyltA7{kTUDG2tUBl%%ZL2
zu?r2;CV8AR6T~nqY##|0=1`0w;IpOVd^yfgm1U7k!j@~MyU+=3kug&Gx3{pubUztL
zd>(%%Ez-XTE)-W)*2#^7!*FUspa$ZV;a6#iBMo?CM6dre#~y;}m*Lzx2S0=|M(S*l
zMtd{R4i|W6C^I%5z|BSNkqNl#M)phZ9c(VKr8vLs>4>M*DcP}A;-I{VyST;w7y}N7
zAMnkk)-Bjw4Ziqd6A%^=Q=XIEJmv=$h<<?dyh7pQ<4;)~?7!UXyzHDv`L+EF7zA>}
zz#0%#at__{eKch@$7y>EszYpQ(Vg`MU}Op~_KpL14mR%a{rGt5v;cm$=drilnim1$
zY8PIwyve<{9`P9b5rTv<urEWf+gev-tr`)f>kuDrRWD9Q_eQ2SR8AwKKf}WvvfzlX
zIHtD@Hzk;EwwzN(ZKq#wP9uSD@|~?S|F-cVj}`OTTHZLK+Onr?#qcgIQZgNR^wAhp
z4{`+6aB$ir@7P}suK*`q(bx@w;@78NW>s$31$Z~0!x84b1`izQ`2++6{OeYyyc`IN
z{z<kN0zdZ6sR|A(osa@L*6p+f-a6Z9kvaeHj}sK`<%rl~T<1>!EA{W<vLo+f#qp1~
zJWHDN9oA@@%Ob*p>^M@9N@h1UQU5fwVUhPPe4wE{BOPkiWOGklLVjWOB<k|AV5KC#
z%kKu<)zKT*3oR%!C2bUcw+tj>di71+nqDz^Yw+SQgM>S%w82sbUcEIk8ZJTcSkBkh
z%uLQP%FgxdHwNlVW-#av&bl`e?%1twlo@XT(UK-_Gn@{HuSH&&yu5o6tAZjKUzea%
z0B7<EU$T4)!6?m@X&ItMKxDpUlXd{)FszAf*zwMdkdjxQna?f7pC8c+j{2|b35$!s
z^-gQ<WJ;<Y-i2jDEL~H#P4ljZUY!8mu5MTq@4rbtGbvs;XdkRtzD@5`$l?<O1w<X*
zx_X59GIa%eu$5;g-AXP0MAa1&`HTd+0KhBo;356-{nT6*;Y(YO7^w=eODlE+iUOE9
z(V88{#RwapeF|8|OkK1t6KicG<VGkadBkXFNt4R?udFiAo}+Dh6q+}a8B2`ejwhse
z)yjlCezfaA(K-Aaa|(YZds9)RBs$T#Nhp`FC6UOfHA|N<N6z8&;suw#Y=-#c0G6Iz
z2Kx%RlD|FUsDJf>g`{UCxnrom&p<}EhnpHx=H2R!O_S%C<j-Zfu54CcfuCP((FgRO
z<x=&TuYQturGC8S<va4&zhEHMtibd%x0mcYjKgSt(L!Xwosh}ogZhLOXRTq}fiyBs
z%xv>Y9l(w$;Ln%SsAn#3WQDwf19rWr!&kQ3u?{OIHug(rI22t{6RArgEeUA=Dnnt1
z28kYM5y$quahyaluCpUk=S3iB_zs4DH>B!sb)(}aKgUXv5i2+k*%MX7_BeMvtw1*)
zp|=hImT1Wfh(p0F?94-i`S#Pj_gJLIdjmIj=XE>8q`T}-O1IJ!89QAJ09`ed&_3i4
zNLCvsT3ASD?A(_V+}E(GSGMITR^uVmduOBo&=p=NO*$5=4VrM(VT-2P#Yj$1t&Ug~
zK}VV#x;uz3JB?1-4jr|7z46~RgooU(VfsxbXV)CqRWG$7xZ}B*u8X!$DeZmt>w4X(
zz?v70{v=gD?&lLNR7Q?YfDh}ZFdTskNlaU(mpY$mqr%trdXWMyjX^8eopJ4t+d&W3
zfxi?6djtG`5Hg(c=kDiKEl_j4Pu^06VHAcS2&sk34N_?I_lu%Q1Ng?>c1L&cZi-(X
z=Q&EnCCaQAzI41&qTIqVQiU>1xz6G?6z!mpN@1mH41y|tAnI(Z0lHF)fl~6Tn`HLD
zga^>4i%;u2Am8WS1+wl}eiN0UHgIO^4PbB+m->bcqw<wU-SN;caru!oFFIr%CLP-c
z2jw;WA^5FD1lK7`e1&Zhc#Oz0hZP*@%)C2?`ep6(lHBL*=kf&Ik8k34T1@7>+}LUb
z<Ak7x9ViQNGzLxxpd5?qpx{U9zXt#l7F^LC`Tg+<cV7Q2@5HQ{E~R62{)K~N&J6;J
z;R%$7l8(@zb1J|*aJLm3MZthUxXg%jg@W3OwQpzf8?<M^74OC>=S{orHflFsI2rKN
z$erlQaAq0#kL{D8FtR3~yOz~2@0e!}?I<D2$3LmXoxvCZdU`;~$-A<Gj=kR)Szv^Y
zf>3*^@$eb72bK3&Bk-}5UN49#<(f)@f927JlJ4Hf_)CGtCDQtt{!<;+lMLL$HV-Jr
zN5w%jG4b<@YZr<&g&W8LsTN^0j&Dt*cfvNpdTYu=j;3!Xh6x3|j&1|_WD+tb+o>(!
zewwqyz{q6=Ogi{`H4R;%ZG=W$|GoGEiH?vd(D@?(ChSFa6v;{T8(pCry&<<k>w&LD
zvMKoQdB(@@>!EY#Ci%z_)~l_-UASDB2#gzNlzfTEo5*h_db#k6r4-Cv@2~(5G~9WA
zJZcVN$EZLtUtKem-5xQVbKei?))Xm^r;;4@(g!RW0=N(?8)Bj?L8id3w%H#8gnyzo
zrpm8V0-a&;d*L#;?m<~V_cCnnLCNve<nuu5!|(J&E2C#Jbs|wAjZ+&bu+SQzl+xNV
zs_sGkz|P?_Xdb?SRkU#U5s*x<bh>onW3l6WuU&cK5~Er{@~V%&e;2Nw?S7en0w<fj
zt)*1N$9n!2|6a+Z?%*mpt#Kov5Po`<%L-$#*rCWC96Ej@Y>$M!FWj!D*}V)c%C+3M
z_U~_!)w?lAy+?9LClMd$32e$`^Huw8njWGWWB)qEJ!U#GPB@9^*JWea)ITn@ALngk
z&wy$cm=q`BsysHFuO3B{vHJju0f_A;$m_=WMZc^epZJUGR%~R|-?is7lQH&2abUI2
z*=JapI&&*%M+JIE(<zbAGhWcFpxbf!K8r@>#eher5Wn|HKuXUzJ~v=0;)9pt2pq{H
zNoK@0f!3YYtICB~@b!!aNHG!pq2>HRciiv1#Y@`x8MHGVFkgZV+YhZ%1L)onfDQ?Y
zME2T;bpPD3hXBZ++zdkgnG=G*;zH3=dSSQN`N6rX>_i>l#1+B|h1zddi0$?cBSvy4
zjKC`YZ9j4d?%JJ+K>ED8q}2Z9<K+CU?`wo9(NFFaXo}!3v>fC+xx>T+Qi$E?29oOp
zjS~5d;zr7<7x>&?72<eB0j$6E05Bb2GDoOT^@zEp)m%3mvpk25`ab-(nqhiBZ$VTt
z%Fl%s_+LsEkJ}*T%mb-E`$RVoeYRg3g(7lLNay8dvETUaL)lnx=NE%X6=dbVNS?fS
zc_b<!S$2x(u%>RIHg^<!W@O;Hvi$1CwNe?N+Jf)}$3^SB4RAP)AzwSxUIjBepFjx!
zsjvCUPN3f}KC@Kz5BBc3(-SUjN#bu@2R3A>@aM-E3DMp_e&Q$WJ&*0L!M2a-S}}%3
z9>Nbt@7{E9z-BTGnn`vUO(eoEYkCdttKHv1bnC6nkeupadx0r?b!gNN$B3)|AtOIR
zW%f$jjPqVVTt$T@Ndh9oZ4_OBT_Wdz7*nStMyc_y%R$+L37KFlNtva6*WzZ*U<Ia9
z*yIxq63#wIGY~Fzmy9gl`~B(DHKQbA8442&zl7DBuq(2W<oEI84Xaxmc}a?41xktr
z0fi%oLhai==c;$tmZxtEQ-o<lb#(fKeTmla=%yyrwxyT!NQz1?`rg`A-SsFyNn=QU
z4X>}^tzZv1lK3z1X>;NJ5XHk|z_}Bagn|D^TZSTb6r#pOE|&PmgokXivPJRk`&s6Y
zs>Kkhp#}bFC^7C^6bOW=L#c|);1mb^c$@l2+{zHs{r9!PYTs`s2@^&WZWg3s<l4iI
z_~m9W%>JrO*WB7)E>IjTUn&VmyB&fLHfi+0KJP-|V^Ad&#y`R%kEF~%NF`tBLv-+D
z1D|2cn#rtamL{g;l>4p4!y~Kvvozm#QY_Vm-<ONw2vcoT^cNqpIuTbAL!^oWQMGTB
zto}Et^wU<av=Sixig&g$d{p*vcj2s12Q_P%J;c+}Xi(cPUK0Orn0p<NA39jLYWoUB
zhBo3yb~iQksY;6>dPITN?(6^$!!1C#Insnbx92X|y~QTc;(xZCl4kI8TMC$Lsd!<Y
zG%>voOgkU_%ATq*(p{f3+FN$%8GSCH?Dd`a#<zRqA&wr39X@JJdS3R6dYjG`xl<l~
z71c53L_g3%Zfblh$ZP_lrRlYEMrbU?l+07*sM5h@TFXCva{&Qh8#&f|{Wg}eWhsy9
z{YEa%ztmMV5C*EX;@PITrxr)CJr`3gvYxQJFM6ZnqqF$eeyw>{5KfUKr0K5cStWx{
z>4Lz)^cptes~G0y5?KB%A|!IO;E<=16asNwv*w}wQ7LI7q1gjq8G#OphTm%iji)Q(
zyMd<J=WY)Q{k#95b>LEJO`OcO-DIHv@jHmsXUIg!Vu$xoGAs9pA2l|Kr7n)e=M6tG
zDW+k(i+u7h*7{eX>=CPMWVDF(E~K)=b|1WB`^6_HiG}^)R=%n=%oxvzU@<!L8M;C(
z?xXcjN1y=v^l=4%zh1bcdk8=p{%MR<%)Bo+GyQe*@Ymzx*z_E@Z3qO?b|fia0KgpD
zF*pugp&Ud;cPzyQQkKgd;e{Q7)uY;#cIj%Iq?t!3_05%5u+7DOSFom1W=wAM96s=6
zmX`1CWbIgPgvs_(+zsZi4P0B`yjAG_iIuN#hUZYf+js_qaX1aI`f7BI@HbIqGu~TL
z4P+#Q3`b$4?YZMrP38l)f&_Jrfqzq|5;$jo`*nGK#xuaJJYZ$L#i{*QpYb?a(%7#P
zX6Zc&LC<T09$)CnkEtAD5{7*#%a;Zda+1Q)3PZNAQ+#+V22Ma3O8De6y&`Cn=Rwyg
zm8)E)7;OgPJ18r_9S?QLsB-}5KPK__%p2{7zJxiiE<sH<N0oHQ8mfL*Ab`d`0O^SC
zgDki0;T~(d8>(D8vj+iQ1@!Zbp72laaHt}7b9oS|tM}bw1fp1U$<LYGtd$&|d5TaO
zQcaD>uzQ)%zQb(ph8xn%pyi;5x`qrU$F#j?8=Ndx!z>E`mrpWG>tw1yS>B{VspSK9
z!AkC}e6~m$1_B%u-IAe`o*21uljM4}H|?OrYpznD@i#q{q9U!E9H!2ng5R3Lk-5ey
z$mFoof@cCv<xpk18K>;3`w#}s;@PB^8awns4GVyle=N+yy%3sq;7J2yokEak_v9`R
z{sO!W&(i~5fw%MJPv6PsyWu7~Jcd+HqUA2@4MQxNhpe;a89*Q_OBDN1V{w=%9cAb`
zDK=>$Myx0B1sc_&4aQda=BGy;jJc60gY?{Q{QYP~?o>CAO5BuA(eSK|GfLC&v%gxC
zOn@&=hFIkTAS0pR=N__Q>JE@-{l2&D7?_K)9tvPG1id(BasMgGSSS`Nv-*s6o6o1^
zK&DDKC`?@uGFnzKBy(0>u4w36*+9BfyP}0A9@(B4{Y&~z{n3~(xlI}}g9;}g%$W^z
z^+mi7{d(b;X7Y;Fc}QRaz<`j)(()s}@%Y-HiZO=fzVQi;=6PX88xbokfiFFB%oMbN
zPXTb7y2J2JJ+X)!U>0AYc;Se)?WG4IL5Q`JxTDbGlCf8jHQOF1Y>Kv1rtLp*J{_<T
z$k34As!wyVe65Vo1hDsMesL7f@r_2Cl+H6RYQ=^2n$bI19(#wcaw_7ZAxdQHlbZ8@
zXJv5HfyH7Bd?gApNg2%%^xF|Ke!90{Gzat^ZXM}k4lD?c4OMN6T(H{ee(C~~Y|^e#
z<v+N5KPg=NsgaaV6Vg7_dhbP`xHWpp#ix!=fV@au7ltO9=D?%)A}prhjFoR^+7y17
z^0d*2@+O_0f^Zc$P3uyqs)uQl5|njfH82dVX$wV&QkZ`#<;aH(KjG6W?Q(LCQUNWE
z1iG!Rja0hxowru^UPsOCdWtT)aFyE{<)w`3m!LW=U<skfH}cqBI^wrFLo-+#0X#Rx
zb1<g&M87y4a~-z@ffLVlTYhd^J)QwCH)o&coZCI_0bam0Zy=oCRKXoU@Z+ehX&d;`
zc9Ma0wYhz={q>}nAOE5V^n00d1OWJWU-$1*9C!bI%rh!p#m5JHoZrnS5SiZgdd`&-
z3C=1W19(5zX?&l*(T0!t@@?Sy+%D%a;GOyX&hP2;zSp1U<LKkVaqC!e`(u3Dl;Csy
zRS@vT_nGVew13K(AMo*qc<=f9+ZCHMbTfM{%}kYus3d}ybg*kpN1`&I|1st5YaMHv
z2zYbQ%YAL=@AW?Tj#c+-nbENO_2q4Sxo+$J)vW2SsDHvxNo3*I<@~W^go)J!k)P2^
zmfih&+cogx?QlZVk&A?JtH<xK%lG|lN^;e}SbxP$itQ~2==HUEo-zGL^V+Z;wA<%?
z?{Z?<@r$(gr*`K?+w~V<zvBKQA_3t4{`EKtEIp~!ZrC>8{(8KONSMCoWX$z++@?hX
ze(i712>MSO{5VgWpu!wN7<r*Y$Wz5K9U<6et`RR)L09cc8lum59MBgTAw^l0@$Uya
zM4lgI)ol6T6X4@DxgD{Tr2BaNOVoIP!P1;P9A(x)?Si9c2Ko=+R~AB1a)Hu$Yq**%
zpqUpwxNxk*3?ZR^l+hP-PDNN00S)x)Lr+iRe`^aVjuZN9CjOZ)%gFJ!O7b6Y==Sbr
zXS9Z~4by9cE@SmrTja-UzvBco57v-F?Td%*u$X@b?0eA8T3UJxer*wx(UDeqV8d7F
z)GWQrJVKC(hMEK*>2e~5l5Kzi3Ec-bRFJ7KA2fOFO&lBM0YZ_f#mgP<6WvyG8Y-=~
zyHlKD2BaWaQX&$B$Z)y~2VOX)0$xEO_~wUVSSNAhwp(VfEEu>aO<&loKFj<$!bcV=
zblzl7Hvbpej?pwihaVlEC^jRw`v9-8&I_|_=zxadh@>8%7z23{Vi8$S;!{p6e8iT}
zbYufTmi+K7ORUx6zB9?PG5k34P(J1ScG)&le)Sx2RKWkbO?{NM_+ykR-;9AI{a@Xc
zA5)AJ9C8^x)Id?=JezQbd{a_1`k1FBLI_r8A!8$IWGo_`u=#C`xs<5`8>%%~TfS%~
z2ECo2EHx?MV?FwqjtVwm7k%bc)LAQNLKLiua_4HUczzrBh5EwpMJWE2O+eNckNQHK
zv~B1o(T{ldiB4z(`hCQ3hajNT^s>Q52Ta4X@qVHjrMsx}G&xmbOxX3({jG8uyD4xR
z;FC%WOPe7K+Rk?<RlG&%Up~nl;OWV@3}7sb5kvt1l^)ZUdsUA})E5}KO#gh6;doiS
zO6CEWrgf%;weqSEDGgaF)>nPCmRUj+JNacj(&Y&JXy|?rt*m}0Deu4fAfGoH66rj$
zSM+|<ccoF&b(i!l@9cT@9;}S-D|#N6mxtx&`E~voy929C%=ct6=%E0TWl$*fe1)0G
zU7!PqhBp+FeVyOGT?EovC*$8wgR+}Ubc+&r16P7Inw3ys6ng)X2TL?sEQ~Vn`1v&_
z&0Kx|yky?flV`$f)OsvHa21LUc$J}NX~zJm`g2#ji4nslxst3#=xUVjlT)^G+MqpL
zKr$osHkqQN4!dr3kFw5OHNv_i$*1U>gAKqxcuKkR8_03Ie_XTir>!{V&2l(HG?Toc
zD03K_49=khsSW#t3jp0+>_}9g@F@6wUb1nm(8b`0^rY;AI)*ltDrvPBXj>GoLqzyl
z8IW4w%y>RvY?A_$s2=Ge*Rgm@Odr|5th&L}z*N=){<C698btld3+Y#^C`cF;$REHe
zp;GPhKMM71*WsZG+dZZjTn24jR5!Z9n`?8u>s}4=r?2_qV%JM|m1KV$;CjK4744};
zr^2W^ty{SQ$+@J3oJw(4>EvD8@WVC*g7<lj0nD3y467%C&cDWP#J0P%Gy?P+_a&0S
zQ?-i+%VBN?dm6zhiFr-;_UM$37At_c82;nxZE>6hb`v)P(fg(c$VYzucT-yPczB(Y
zC==;scmKY(%jdMq=l=E+=pxYd`BZ$r_sV<2{^B^(-1|0je7(&?zqfC=-TQX4+_v2f
zVHi?=$aSllHnjKf=ekF8D^$;@xKp5Y;FlLE=}*<0-yGu280bU!KlT)x#$5nd7i8ID
zEUf6@%zq~ZAv%;G>R9aJ5=d%7!obsFo{~os4D1RA!{XSmioJ`%UC^Ms+h2weKDf=8
zSP1KAOeD2O&>i&5e}=^>V8I@F<NtyaF_~q7oL5Oyf0H|ML(i-0?fKmOlR>-}m{rrR
zmF7kxPo5kTPY=~KU6Mu}1EvblMlXqT;Jpc;B_%F5Ws*giWV|P7A}Uv|`MH7A$w$4j
zu#aP}cnImn27W!{)viV`u0rt2UajNXQ%%ZdxV@7d_gb2n%;^+{3kCFGUCE4yyK}xL
z$l>4ycT}rE71~eigXFp0{pMs+Pl`_@?$-A0hDDm~1dWk$Mw3w;@0|c}_HhLu>2^}7
z<X)HE9spp#ZD5rJY8R@sS|f<bRkxW6jxbn2y|B(7Z@9m<+=q4D$96q<WoPE6bEd2<
z4f;(+vy*l89mVHh{|A*oYQH(a8+4=2hB_EhDU?wmjCqJ0Z_wLnT9z#_ot4S}%GU8d
z#USbJ6ImA5T(gHY;*nX{Q?9w%e;fqw5IK>#g9Mr-48X--UVQ|o*N;!BOveVjYc?p#
z71W>*|E_YXA;MZ)L6Mh^m&e&$5t+W5XF9l~Og;%>l|iY<zGR*_nK=j?vQ0mSSI9dm
zJrevxmLCd^zfmxM33Fwmjj1}m`GZSqPwug5C_S$LdtB{@B7m1O4O&PEf54B3^ldAq
z%-vbY+v5#ZxuGOyQ9jW1w?15S8=VlL8bU6G^i>r)m{4|}D;wAvtLl=cMB(2y4fq{F
z@6iI&7%`omU!N~H<LbDwS+dtMS7ae0tXS6S*LZpy2L&EStMRy2N8wbmn93jwP-V`8
zTn_hxT(9h()vY&8-Fw8cf4g5p|AQM6)NQ_4+UR_ahs)KIuXutRRUno{5VD)DD$he2
zNtv~=#ET_MR85^r#JrfSJ)gm^b3awKCVejH##4o$$|snS&zk37vA=L)nkG=B-T$5`
zX8*}APK`O_`bGsaVUWYPE?k%2yN-Y=Rqr>(*PHTAC^D+kPC&BYe}JKy?>DBV5IY}+
zejSZf(eq*Gv*~A@YXr&XLjMzH9m+v~_;=_w)(!>F=9Zr-bQ_B>ez7QxTY=x>jFU6F
zV(YV%mNG8IKa?aoVsAH}b7uE>?RBE;k%H<~uW23a6?vLC`N!a(`C{WYcgHb+g=j=~
zdgbd)q%r(jzD7^Sf19URai<(=r!9JzCIBi_makV+jvHd?Rn@69VL|D>C{JBbtU&ck
z1*1_FgDUe#$m&0escmUgIR#YYu#>6TPTW+CQlj$;Mm#Im3<&W;esFy@dn^QLnMOxA
z|G<U#>_<-Gr?0O?bxW=>vGv?|{$m)W?_8pJsDj0Oo;q3*e+4#jqRb97_~UkBgU6i`
z8x%_$RZYC8ZB+I2^c4J=6)Q#FiL?-fQG9}f8Mxq+cLDzE|NK8f%@;9m-#`CfsY`~9
zekMM<P^}$a@Cx4-;PW&W;{}3*<*Q|x=Pph!n15FM{V217h$T>k08UQ@dk}%QEclp2
z34Nv%j8kyIe<U<Po79eG;7u6kOk_MvP_}hZIL8+=@F7C(d3wpS6w!W2m<H%yN6g?Q
z@~#4@g6HKRE*Tz!13o#md9o@qPWXt`h6NYQv*5%e3ET@l+Qf(4H^}nCay!C;gh}LF
zt{tYXUCh!?PvDKrMSOUJ&=pV2L}KuL7<h1f#8RgrR{<2>vhG38JAsP@K?{}X@8mLZ
zuTV@+VBnp2GC8EO0sQ4J?_d4p`NvnzU*11|^TT(~-@pF&`qc;UHTdyhg@YvKGqDU4
zA~KAu*?$;CJl9Sbh}-+8mr4l&D1TmFrowcv@tB#HBT=(SrHj7Ao`(VuG9~^7Q<Skd
zaTY3e#|9rvO-ngG$l?(MDuY{5I3<j?dU%BbD#LBBAD?GLUV#7k_Wjn7RAV3WkPykH
z#04O1=Kh+se#xxWBE@6oR^rYf*^+9#di4tZH?7ZK*vm3Kj3{d0suknr7k_#11Pg?z
zg3mGwq0=-Ir`S+4@O>gvZKGS)Pgwb9IhJ&a(iNuc$8;NAY+X%dOVa*oS~11d&9g{8
zWUg-}T%KHE9@@Ktw?c?dL@^i6X{vQbovV#akn?jGG_J+#=Wm{iS!ZvHdgyFH!d1io
z-kXO(ERCw-jae9ZA+`4pAAet5JX1&{>Bn%Fp@f#B`5cL|<*YM}>EDud#hf;Yx<5pI
z2)#f1;bnjPQ!>UneU{1AA~$7^+DD-l7th73w2`dCrukqqk%!Q?or+68ylj|-729}%
zlIoYXQ+2VHvkkt4PriDZ?c5X{e(?7n;mQ2$<d2_zdHUtu?{tnY#SuRv=W-nj%_=>$
zXBDTmCQq1_3j#BLn9oaI+$tSyc{s?kyds^xTM|)H-p2=i$0_(px0&TRNmVM%)O5Ku
zDXG;n&FknW=!}yJ-MPKaY*J~iTJ8tk$RSwS6BqpX{-TAJ<tdQ*Yj&s-5}acc&(CEw
zQ4R+?7wQ9FGub^)0-0I5RycSqntHr(z=ZZ&IA55hY2`J4bZSZGX_Lv;&m8tqS}o0B
zn6(AlS`Ld777^r-)N1btueT!|j#~sZnE1PpA!{M3t?1?=$hOF+GiI9iEru@vDy({7
z{gNm_$6E(*#dDP$lulyKK~Q#Xs%0P3F(h=!lDTi?=wxbk<z_7my7H}}N2B3!-r=FQ
zt8<PP!(nfK-eJNkFHWF*@1XqHs;64hmcHD$M+<M(?Wm0=YffL`O)UnZz9_Cs`L7kL
zrCzS(+Ulk9+e1AqW##-~oh$w#KdToCEyd9#tP~W#`&99-%rwZK&%pI#SvP=t&IL+H
zrbfQ-(Jiw_IYjx|gc0x}^^4^mpxapJqCAAY#__^`Qs~bUhGNcr!}I8~ibnAgVZw3k
ztR5z7Ng>B!mSyxZSw*wdjm3tSkDl%1$6Bs030HLGz<Nl5?vjvFM@jgV?y<}sU6c=M
zUROYaOc`xfKZQL)ai_X#fmgpVZd+It3KLLr6Ud#Fce2)T_adu%lK;7c-4z^kyab2X
z@_7P(&~1bW<|$JA`kwU`qtqdo9bp}B;MQpyckfMdGr1xIbZ)&hrlNW}^3MKL$7Ig_
z;#SMK^V6i!8?O7!51K@J^@saO9JS{QS9>vOk3*2p;p`h-75-7a*^WU92@psCg$>C1
z%{FA!rrbP40W0nq(}qnn+F{wgg7)LIq$XQ`YV?sbsw>-J{Yle3kvy#kFL8nj=$8ch
z!nDD%0m|YiqSjL_qx500NZ<lFml)EX4{Z>}sA)K&1uQbpG`(7RjARSO2Sjo2OJ=gh
z!J=XRwBd$KEcTm*#uMr|vaEf^TsS0TXx1u1NO`FdS)k%kF)5N}5B0rplOuGmP~bU#
z3Tv;kH(DRRmd7yttjX?~|D(0WxjAA$`3Bo-#irlf_?uHIe3BmW1uR(2n*<5xC!%;(
z>ds3E5u4ZXHs)>$cXI_XJzd5Us+BuBgWb=&l7%zZ(x%=lepGbjf85ZH`EU6vI{$l)
z?G@UU(~|#flT+uP$qk?Vkl*<EUyBESApa;Y7!;aT96$eK?g~zS)-116T^mqDKgxne
z!oPQkwj!tqWk?~GV3H?(X8JXU<MZ0XT=RzWm^+4{r(!MYiX3Huq0GH}>4)x>gyV~(
z0iMX1q`>ri%vsHQhSc{6o~Ly-uMxOJOL&c0CDIQ_CEnXYXfS^TU7ln)xnYEV87@Oi
z!U;uiMNiom^t38(_Xz{SVm7dZApY)b<)sMijX=qCe*em*x2r2b;yHSdT~i~KO7+(Q
zz`E6jmMAVfV1b8;Dw$RTI?v;ZoXaqbnb9w*{X}^>siPy<N&`+-&Q{BsBC7gDp}(GE
z-&ggTsEWsA9Nb9>scA>Bp-V`AYo}j?$7l_Qa+G$D`=d!x5P+N94De+5dP)%opE<Hn
zTkGA&)s3trUT3k6C_R0VznX0!jbl=7FyB}^Wx353Uj0(B)z#z8Q<HwSz1`KL$}!Yi
zh$|S`^M&v=3vSktk$KmchGbnKVEO)vIxKO&6W?yTMEKLP2Mo!uS|NsiwRGmbfE6l%
zj9K`FD>lOiTw&keYJ~slxG;u(xTtulYJ%n)KiPH{ZlM6wu=$QnTT&p5Jn7jRl9KcX
z9v32KApN_VtJ(;>=dyP;)huBDBww~S40s&`j^koiaTZjW#_4fmKKCE+f9hlixe&E|
z(^xtWMSi#z<r-kX%UuXSW(z84p>U4;H8_O%YMU}b{E~z>EFnxt@B#-sou!D-Q&EIU
zgn&St8i1lDS|I{`Uf4k)+0Zo#WF67fC6;x1m+24!A%BG*CFk&>9&g@$1W;tpc){?_
za#OI0V5RMHbv?yA2<OZDS06sIls2KrcJoM7jpVsDRD`z7#LJ{HxvIbqnY<>V7R7vW
z0gYo8vzb-p)WTp9@`>hU&)F|H7P6Ks261t^a-$0|(l|$ATG5zimEr{=>clPvj4j!B
zCmBVpgnzF5wl1kceIn-vcm*jpSNWPp3(IiJ?KAKuU6)G)8Gf1VbL6FEWqBm4NXxEP
zL{yq(&CTHoGgP)r^2Cf|YP(Z#O=rv|$U;HmP_EVrd00dyvkG<aTDaJfAQea$0#VHl
zKUmkH3ojWCas7-hPej617z^xOy4!?+%_QXP@PA%EKIMI$%8^{;J$-3O6^>aAWxZT}
zl+xq_vhoK%!eMTD)ik7S@I+U9YdjJuuDAC^em`t1+^p(0;&BZ8N_ru_c-}*VD_^l%
z+fWwC*i;W%1&h{U_%>@r7pwq6#1wl%#)t-an|D<ZD)F1i+l~k0BbSC-R!*K5bLDZB
ztbb$Ti%W_P>A+NQ*jlO&Vr@H$5L<PL&GtxDEKYi&x9<Lx8#!W81T%0{Dd`F+W*eR;
zzD`~Gj3h^H^h_#Yl5GB?lp#7rhS&@>%*K+6$b4O^#=&C|#k6)<<hLmo9aKhSod1Ia
zgn`e&`wtmHU0m9NZ;R`IF2jVC%Vq)jJb#W}COYGnwg9IWVHiR**xCZD7RdH3lfMQ&
zmmBj$oG2j0w^^DeGq>jFre`HTa+wr`AZ~tzK1el&R4ACW00%N*hye~SQ<OKYf#d0+
z_EZD`&-E=a-|KUE>4`lkDpxUqN8Ly#kq=o0h;)FIi=QgsNJu3r2q9jg)l7grRewa&
z_b*uCwG~twfni5T0R0mI{o#4?X06V(+5`Yb46g)zu!Ir2*H}~q1X3(L&1#GBv<$bg
z$aDt<qzgol#&YXPwjf(`I0r97I0|&prU9IPow5%pAQoIXLhN#K+^5w3&<egr(rj$o
zi_UVu{o$)WK9Shg6A!UqFtCJy=YOL#=M6u?UQv2W7kwr>VS)}Pge{wv$%<_{HeV-b
zKF2O!a-oXzcs-G6h<BFCE<#S?_2Q_iddK&VYA-9S#^mA+#s1=1UgoBX<wUuRMBHZY
z#;Q4%^N^9j&IJx~mQjLuO>lL9Wk>Ss+GF<qLrxU?TnYClOt|0R3R@<nO@Bpq!**bb
zTVxque29Y+<>h6QiFrLbu2zT%$+#D$1=WWuG3mUgDv&xth1f-PvgJ0DfrX-ew5hcw
z)6gX_P#h=qPuXe;&MUby)U!0Bp8WUrAveMSmg5cU@t0M{CbbWho2DxETa{I*+M-n>
zXyjm*8CT1hv<jk88*5ch*nj<!1>VL=Z)|--aIu^l6Hu?HdeauoT*Q4>;UV+LdM>c0
zjOAR<HkfOGK?j_gtA@Xnw(oF9)VZE3CD%Y+y3SPja}!y$4ld7@zQJ1|(oZ6P?ud+t
zTCRkeoR#M_H84u$0zFv0kQh?zd~Y!MN?9PyTT&lPRL+t&8EK)hI)6@_qPwe3SUvPy
zu6N<3(zUJNW>p<+9EL`;_KVQ>PDB8DcDIWPPvD1u8>AR2K;$=+hT1S-Dgv{`aJ`5p
zDd!eH5aU1=5@e!^Fz5y7HU`Tu>g+d_%s4%#uNjra3ahQ-({OM_`+)4F?vf_Q))v#M
ze_h;~O>Z%qxx;Pd`hRaa<*KQczpTc?wQZi*V8eWm<?~qRIuPXcI?m@KW&4cn#V}0e
z-^?{o(GJVVD(wH6@qY$BF!Q65)6!BP96pelb?cA^$4V6T)B$kQBc|G8bTY#xEHS6E
z&;tQc5Q#PX@Fp{k=1c)Uy#H=C!0nXTg9y6DO;?g8>ji*>et!YgSuWe=*suJlE<;DT
zS&H>kXh}K2_!$>ZHiy_`k9sL0#YCjs`<&)lENs_S42&WlOG&y3oTr&4Prg<b9-9m5
zX_rr^GM2X{R+k{*BV!Nq-Da<q_od?VyU<&oGO&;srczWXk2St)y=(fovrN(|V$TtV
z5C_IuA?6!9t$*1eVRxMFjw_9wtl3~q$t&|~+mOU^Bjcr3nz#VRxJO=B76rMbOjJhX
zn<)+e9NeC8^aKs(JQ3N!xlY>o&99|h<|JM+!&&Hi_04SMp)cykVgY0x+w-z43&;BB
zo4P1~1c$Y+)o-KHB{AL`eQ>lQC1r+cbQ^KR6%I53^M5KHn4hhZR2?k)09)hpNT6?-
zhnQtiI&YEoCD+&Xyh<l$Hh`uX=7QQwZoDfT2mNDMlODBsYt`(T)`a)5M{?O9>duAn
zM&UYzh}+V6oz;qJB;pzoJXexk*(J64f|KQ~t-lBIIWc&8XGsl*^KUd-_FLM~#-2PD
zBV`j|uz$?l6Vl7|pvChvw?HO#bWAr=p379E&^ZR1YoUEk3WtN$G#q&vo92%_cf`i2
zHwctZbdmiPvbW@Av!<P1oa^mL=K5ULoO&rGyg8vS_lAu;_vKS2J#)g!mz%BJuLcae
zICI6eP4+1-7hgF)VSwJw&%uwi?BG~uvmaNl#eb*5x#1vK`BE=p2XC-xek<>kY86UI
z;+w1dXKpX91o7sG$)tI;iu&TiUqfa?``(RqFi~RXH6^0c+SNl$q9V^^<CjdI+WD3H
z@wj#o3VZr>-qYF(8#3h<Vy+ryWP?oYJyk7<LY`@{#($;7PSI_Yw^68bxMif^D}SC(
z+kd9NVR0a6b(*1<+i;q??3SN#%(f`(MN_~H^R6fl8cScPknNObaOR$QFL6<B!X@&D
zJBOH!ntRv-hWC{)0}2jB&PxR%X9jdC9O)5suiye59L>P<tz@hmQbCZ5@HNMRZ;VgY
z2*WY(SPo55+Q|(U0sa|*?|=C4Q6l45=YN7mNI?=P0RedeF5~;MA{fuWqY9njK%k62
z(@CSKqYP`NCMD2CW(tzn9$Jd?bBWXFhb?#6)$N1|A$O(hmH*h7-jkK~7;g04U3W|D
zdk$}{B3;m<R=ES}G6(3aP%dy>y1%#c4;UmeXi8<Um5N(0_P?o~Me&c|ih6ICWPd)$
zZ%FKI$NSeu{BJe6@z1L5E^z`Iy;b*AkuK`7S-L3QEg~6sO-=#%Mq^v0(UAGmQIMfn
z@<e%eWPf$AUfLWzl3MYo4Qf($rNgBJEanX)B)sViG*1g_)H0~-AZldDtk^d?Zh2V=
zrJk6&zMF$ujgo!VriW};rtBVJn19<AQZo$JT!QD_{!+ZmdD|#0fy>bfh-RYXFPr(V
z=a{S{024VdFLf4QO})}`cd7UI##B1RFO`O6_I4?)(C4QP+<mI_GOM@hmZW0f*`g{E
z)4iyr3X2!>IkH)T?9YF9P?z7M@e<ym#gL+wbQRKKY_a+#p8l!m4%*&1+kbOirXA&c
z*NoFM4)>S`b_Hc_>`xm|x|~;}Mo`|^s!e>Ont5)BUc5{rcdq7U{_yPAA0MCm@e^Nx
z-yi+%K#!s2g!$SVqNd&$58v<1O(t-5u@e)BnXl53eyluF({MNOfu-B(OztiA|MPi&
zTde!?i3J-ZS^Y2RoaJBxxqmW<zR$+3hOD3x>YH-JK;`FoFoRjgDR{u_GviMT7NQp$
zdg>$J+`*MgUP5}A^S#M5xsm)iBcLR8cwL6@%FN=Q%)QGSE{_coo826OtFZ#Un}N(~
zR&xe~S+*uKqCP5}+|4ewAmyc9J<4D2tyOjpFA!}^A)|q;uTXkK`+w4Zn&AW+ZlsZh
z#di{AMO|SW6MUJ7WJkSbP}I}uvq<yQ$r?!ao2Q$hPL++}(cz}q=2EDq3cOu+pNEoB
zajdQ*Y?L7pkbbr+_$X_V@3k9LAKSKcj}*YM>5PrO%bAZRVu7OygzKb+>84F*56A=#
zNYNUq+I23m%s1O+T7OI@Wvkl`bJYI4)$C-Eo^<fz_^C<^d*MU8q61#REUy%fSE$Np
z-n0wM?4p3xNBk*4@{@ewZP1X<J4dJ<f7=jswx+pEYkW>(JcnHim`U%olst2F`GOb+
zNhs2%$eeQttwF6<>4T}GR4ITJXzue8k-i{DyL@|{S8ll?Zhr#CIzaL$AyG)1;a%#z
zyiZjtagHd`<)qfi3b9u{S6@jP_`F<_R@o6{u`q|%;?x?ha_Ur3!5<gQF}Wzt^LnAX
zpklXokyYMu<tI(k_Mh_Gl3X-1W$-v5e0;O(#|L#~gK{S(4cRQ)`)LTc@T(X8B{#GB
zG266Ry`gMlZh!uk+l2W*()>otewRBZjd<VKHR<n#xYX^%PoE_D**(YymVPp}qVJf4
zRiBe;yL1+TTyOO)kJV`6bcW0evg+ba-mj(00w!)|-K?XtWsldAA*&?F-mW|;m6%*l
zx#|<=CaweBi>mmx;dPbC@8*}5`c~)ak`j4~3#^Du(0{nb@*fyqW?PEQc1ris`#|Mu
zFJblh+~>ugN;v+;lWo2)U#Q^z>C@sJpwh#a-vsJu{yr%DR&pzBxTwnYpS$Ly3;QTM
zTr&Q6(t`+5;R7xeB1+_i&AVXZD$hK?h2QBQ_j*qNVC9DrbDH-aG^<0$&GN>^ZJ&0e
z6^qW7y?+Kts^yW|M)egb;elNh#PK3Uj0mC9=lp(+w)yZ1an9M#G7;Wjd4jo;s5Sm_
zW3-Am3@?NzT^9+^lX<Yk4lwXLR+(~YmUe4J2e**6oB{<Y5T7BBT@UiZyv)@*xS-^2
z9%dyf2WY-b8<sOxtG-)gWf462BK_xUue6GUgMR~AyCwH}NM6fdUwhAe3=85a^DwfL
zT|?Q%aI-qzEaI;&S(JREpzLf)*wQI069Z%elzv#IauoC@k))-zNpu@QmYcrau<Bsk
z+gWG`U*mk<neV~{uR(LUjuG%tu!xr+oQo8K;_c5UD}~B#b8sPkasENW;9>^e27a0(
zCVvW}#D}?rG(ulF5nr5$z-nH<1|0HCO0(JQR6L}ozhLj~;t2fL|Ng(KIUmzF%|<|h
z7jj@d%R#div~ghJ3_QPN4Eb0lr@uJ6IObVzR5MAiLXh&@Hfa?DNx#EJOf_|$t%@7E
z`B;?WBCCy2cN6m2_zu&!m*|q&Y{uGp6@OeKKa6BshxucEl+#kgKzUeFfG9l&->ScE
zq@H|{)-6J^WuE;<qzO7_6^l=B0504x3F3=m^>3b<mSxep!GRavT&UI#FXAv}HH$xI
z$P?b|1%ia-c8?txUz}dBT_yg0B$DXUm?S(?eU`CS<|v>SELenT13YylODuz9e}B!A
z4e@-%d;+f#xL^d&BqgHe5-X3SwlYfx#?Jss-DqA`@R-1ODZ)YmKrm0Hlmyq%$DZ8&
zDOJ@Ab}<7VBIKT{S4(n&sTk!GHja?x$EW^vbb>tueVNWb``Re6|4e0Dhv$H$a?GzU
zOIP;)v-jppZW~$NX#cIJ$f%eISAR`&DXG<-ZmHc9vQ)M;SGF`Nse9)7Y6ujOB;f)9
z8cS8tZbjU`?gQNTp748;FV2z+_5{f)Np3l!TSXE`Br?yIXZf93sas0BcqyTwJ97j`
zaQJuS!+9g^&E0syeVGncLk~NHdtiZNLBs3$Tt*Pwh9($(z7jIa!!`G6Kz|ZX!?`$?
zljTJC+%#K__uY0Q(-+C|MY3eV$BubnJkPxog1$9%M~f&)Qo!GmH$YB6(W%771$ufo
zdv9V612;I64&8;~(8Xav-Fq-xhoTT?>nH^wwHz8Elv~zKCX*-Me*60D+b3_%X5YSk
z^26H~PhLNN^Ze|5B;eT&?tjf?niQMa#n$Bo5G#%O7@C)jFN*o4%sJD1B0RX<!=fr^
zAA<eOd_zN-$PzV<yunRcijBXG5<kcwD7&T7u{^wpB!l*~Gbwaf(2c{!)^xJ59|vPa
z1f`dp!DTLQiZ|Sv({aegbKQz;-Jtaa6&zZ%hpo}Ib|==+rQDK*TYspEsy!VzrmL%e
z!=M(Yrz01L3)NQCcE=VB_FrHhtTiD<to<83XU+BPF50?HW)Y`tn4K4EP(nB^HJBlK
zm@<KZ9*GH=@?tAId{fVK76P#bHj&18rrTwpttx>Q9>7=1Kpg)f(}ZPV6!D|PBFrBP
z^v1=xxF~XQs)j@HMSuELow%sG3RX+T30qp3xRy}fnI@Z!3{EEEB~NdWq{c>5Gqc%r
zAnPTdlgDWiMa72J8NL`K-MVc&fx>3?OA<TrE*6E_7dG;UV*?SRJXNnvY#@?S3TC53
z@6)R1IMBgNO+J<l6IA5{hITpSbf&BzkPbgt>bAl|&Uf6VuYbpARxP>VT)sgo(LJ<K
zMxbjB_|#<z(@8asQr7q#!oEd58$vV)YI{oP`rP5@=V(Uu5V_v=Pl(Qebc5j=uJ1l-
zj!f<1T2OgvKuS(j(@+H0QNHB1TrO3+WzhBAUv&sK@59sXoIQxY2XnbYBl32RAKYBL
zHLGoi+)-gbwSNRNW0i5J@#7at*!tlcIIif<0NZaOe_75{tf6Hb@tur@J;qimR%f{d
z3^9T6*Zw$@fbd1#>Mo&u4q9>P6+msUe*~sDq6%wHMkV)3kzpGaJe^KcFt(=LrF*Kn
zq)#nNt;Br-`lTmDF68<`2D()>_I=sNbc}~I@gL_ee}51hCdY+ehw%$^J#r#swJxM;
zx2Ogb2a)NVABD%Vne#b%UZh!)x?fLT-dROd-OkAlajpGoXL)eA0O+dnz4-CAFO!6u
zOVO^eUl(iP#c}SZOPQarxDnT@B$Et<0vMs>G@&4Hc|h${zLZ<=_!5EO6VPo;petn5
zX7EryD}N8*{r$VM*Jm`3$zSl!zlyKKU+7_KLYH#;S5E{5yp>pO1IiE3twqa2>duR1
z9&0}i7tqL*`6UC`7H^THGF-;9OS$zP1LjMZVgFHRa#<P?XZHp6-LYl_Jtj$ROziza
zbO8>SU&^f_s=lO}Qg?et<VHQgul@Pum^>ZA2Y*`_kC<NbT)Yvv-W5NG0kuVl%46d8
zPs9)M8Xf(xf9K!5eEZ^=>eSRWyuBLM68A3wO0UkK4kudsH#;m-AI`Xb@mG9AhIYOr
zKABlP#H@!LAaNEKYj!UZh7w>2DPde?k%&YqH-=@2TyTdcspBym?R!+dU5GJ6YA_nZ
z8GkslILT+cSRQd5@-G`~A}Mm!td-WZI-(%-Bw}!jPyGmXddpx+c@p^BlgItjDPrut
z&@>evBRU539~^Vl1)?n_27T=I@-$4-1GPc~2S=PVygJ=0e7)f43z(EIR8Gl9+B-}u
zIpr>|u%8P*jNk{zvk_~53vwQO&mf}9qkpYIfu>rWUZm2$1n$!=OJ=Z1>3m1fTxA1U
ziT`$jpty0<{xtkz*0Kc)rc}(?Siur;!kYtQdGu6lkqpGJ3bQ;(F-jDpyyiZ4JV{ng
zbkjsU&ufxCg*ar)pj#KV42%PAagiByK;&LiKtw;hA|>Iad`J$j_NHapqz{wy8h^SQ
zYDs`-=9%zwqe7G;TaV~7QE)JH<zxHfFb2tc6lP{IjcOLWemH@DKeAt?^pgE=q{LpQ
zAZ{`5RgVhe-6}mC-K)l?!H<o4L__m%OJAJQK@J2se2ekc2Wis))6shduvhjLkhd)J
z{SE-NY{&Q`QGVZclq?ey8hQr@Sbtn^Tl+TyE(Z8h*NZcdylxlw;CwZP9Mt>Tf8)D1
z#v}Ga2@`Z4oRMAb_ExUO8LC)1Va_rM5o@>c@ocJRbjxI{tOTdG5fre%O6eWDXjEx|
zRl9??$WazMQl5J6W`VjREkT#x4dZrd^NZt5r0-t8d~qg@uUFxGC7wQc{eMiHzrbUb
z%KWJhxCo;tI~lRZGcX3EKFL{b2kdJaL(*J*pkwYnYvsoLh|hdCxtSsOCp1}txc)Qd
zE_#*+i{LekM{lvjRDwkUfike*PQXy~pm(vy$4<6!@-UC2c=^MN|E73cm}m7tVG3}A
zUOjJ<hHF3Fj`4PHqU}-4z<<G|9+j4OTptwkA;3Tmb8-INlNT@WY#YXlsG!URWVMkX
zCLP&ogdIr@8*R+r5uY3L?TFncBN0L@kA8%1y%5xrSAN8aU2`eEs*iXSC+5Ae;g$H`
z|KI=5&Bo#kj#(m=F`hrsXiQ?*{-um%8qOOi$B!Z~1yvTAPx~=O3x9K2$gE^#+x@&s
zeyd*AR9)=$b5JWE+#pfe&v5YAI`5DHRv%39)I>Zl<r`&qs^KR989_gIoAK&HX-;%t
zJmjzwGFsE5Sgz{Bk?kG_7s<^S6T1TDE~`pJpr{qc9_5Vu_|6j?j;<U&XgcO9IF1SL
zS3G-+*nz6|V;=cgCRN^hCzJY6I%5Tn8HyhtiNp%lSG-P)C0rlMEH1fgeM9ubvj%S1
zXCCr1;F<QZf+Ou01AJqPET#|-g`|D~ePdBTu-mIX7%>mGBfn0=9Gw=Jx8TQ@t|<a3
ze`W&TSr3Nxk%?22#GCt3B-1Z4_U>z}>5LD|(EO1Oo5rW)2SF;cj4~Z5mN?<|OoY0<
z0rK|aEo8V^A$d=%AjJc?3hJdY@Q|Qu%7@s4z&_&IkCCULA7N^gOjCG(l@B6Rm)LRa
zBd>5p5O7B-tvmp&MhxOMG!fiR^!Bj1fAuY`q*)y|^v%A|Tw6F!LtvTq!=#gEoH?aS
zb!+1`+kn_0^#I_`c3#bap-*&}u?2Rw=>#}@A?jzs-N%?tO^PtYZKr`s-QyHOOYsTr
zGMwprC0jj|&RiZaos0uN6_lVA#!C{=THj`KKk`$4N_Dg_FFmZ5Mr!3lmAsRCf2Ab0
zoSb)GTs%wfaXU2^+4XijZ|{2h`+<l#6wtFCQy<hmpxP6v*>)~!L%9O8Rk+DoA8TyP
z=4a_5+xAN!uH5#3j@Y+y;?-Sc+`6S2{_IUr!&f;>&Np=_KLk#`fl%x^iyPeXuB%Wt
zHa3q}Jq0>$E_K-0rTu(k;h7l~e@!Krpi{Y@-TM2s@|8c0{3z#i>h4^ru0)4VHm`=N
zz?!XDab%*Xsw@Kw#im#HrzF<?9YoVtb8?=0CV81o{*)YJ+zrMYG#T7@jRXE@qmf6)
zi(WxUvW6=)nJL_4-G73;R}ys7sW?*+KYBjf_H@ujlRT13f4=1|>YF6me}X5B1$~lc
zA}i)AieZ7#VzZI=SX@fE(NRq<V#0WnOxIzSff;_i3L_~Lsw<}e&}b+v#&WR;=OAtL
zL(zcFsHJ-*vQ<(<0p|crb}uVctlvmH+Py*j?#((-FCRR<f?bssF&H@+C92CC0J0G4
zBFe)}B+ZjVF4r5ZJewT3fAro_x#OM3w7&yQ7jVQPM?#65M}i;`*#4x=R;vytDML*(
zcPvN)7(Hp9=$xj@@CBWdJ(qc9hA;`@In&I@-h7&}#en*B2MvzmE#>5MP?ZMCOnMmK
zevt&*iDUcO?(UM`VK8*R{#<t7z6z2M^<Wb%Q2BKv1$(G=aR7nge=RtzJb!%=E&=?<
zas+q+kIlO9(v*8Z3CL3BRNU#ox#J!lQDpvglw5em!(@*6oR$P}@F=<9Lp3ywRDe4e
zK86y#d+1m5V+dv1=Wr__rQ&diStz3sB7!i$Q#y#NdzKJl2Lcty>0(kywN!45IKZk(
z>!HxxD+*)q4%}mRe;+?(4)vHaPq*6J0GSmxdFqQ4ici7$u$c(R1)q}Z$LhFsPdl(u
zKg^h;Xt6m*Z7UXj3=O%UvOxO5M3I`>C*x)~gZuU~Sn<(^IQn1tVFbRnW_Oa^bzEK9
z<}N7%Rz4Wk$Y;*jR=Vh^fx1if(OPC1cl2qu^stL<_azDtf1%H4M9P@~<s8^UqBBG*
zrYI4A-NjLaf!|qn+k*;gG9h@R!C0`$Ej#SsQ0Y<2`)6ZPaKrT`ilocb4mg}RYVs8s
zrq9fJl_pRNErZw650FbUX3&SHr|`;Uo8mc@bt@V=8tLOT-un_CVB<MGJiT8Z<$JKB
z;w1>$kOw5Ve<h(>$n}o;hx(}K+cXYPwAXS4+u%IihxLKaIU_Jt3Ic{-fB@|quw|Y9
z9_A|&l3~6rE&60KY1k2(*`H0z^O|*X^t@eH4N_E)Or;bC{#<o!gD#>rj2=0x8>!b*
z28&vrZk@pNYnF@3lVGu3m*;*1wLZm=Dnm97*eq=HfBH?7T=z2sUaF4^sr(7&W<3fo
zu+`stZPrjILC7lz4?&<njSE39e~B?fYQNbGWnhKuA*ddN**v+DDF&IYLSJ|oAyhF0
zwLK+|lP9KRepug4a6&VCLYa3WB8fqI0tUcn1X~$=;f2JwJY;%v^jN%o{Q`*aX_OSf
z84Q|ne*khM&T}6;!@>CP@?w=Fm)STAmvC|oWE5V>bSsj@J)Ijb*p*BEA&jCxaxGIV
zx`E5CUqXWzgaL7{#d!>uUdic$(+6LUPyaZ6@TW2OlR2nY-@CEdJEkUl^K<Kxb1W?>
zSwrePzL5x9&fUuAz5)d2UZRK|jwvUB{r8Nse`rhJDI72CNRKc+C0)=^Nm85W^Wc@A
zuXZ-uguO1aZrs0eYFFvD?xTT9&mJp;MUJn@`6_`^0MKC)WAJUF@;x)1J!@`~ISiL9
zcr+$7m4J%Lm)T?CvFqBS@$J~+7=jg1sBgMQ88|uQEW=TQgUFLss+em;n%!FqD!=-^
ze@3$L#O;)*^?r};fQNOCD$46N9bL*Ax-xb5_XO6Nz;-gW5I-r9@xq@YWQWPBPZk_{
zR>TD*D42_2=W~ZkKnQ|?GC5CW{+P=c;O`O?0=gghkO}2&kWN8~8+>t^kYMc~?!DSS
zu|k<Kz7C~~LEDTpY;DZv)Y^$&MWK=De{ppHv~_e#%$D;IyTD8OJGXNDqf0m_?x9{8
zoytW+w)RV5#xJ6}-J#3TjG$T-<BVHsI>naI)~zqB-PYKr)Wbu4!XS*gTyLTJ#=M34
zrm|Zun5j>3*xK@bodny15_6}=@w+!~UY!dW2UzStPR?ua;d1kJ+q4q*C#Mz=f7lo+
zYB102)ywlY%0$fs+gWJfD=SPWD@?4oh(>s;Jl{N;PO-_+D#>!xnX0u3I*tR0{wXw5
zwWKTa<~<z*SLsX-P9Ofs!5@1Ys;pEf*s$E><b{Ntyv-0GFFqvkXrnhz$g5lZ7ExpP
z;c#5ig=CXbNXoG<N}oUJ{c!(4e~Hg_<A%e8qIVPTyGm|SS-rmg8fSd>{gbCkXDYpS
z>|L)iIiLOI!q4QF5B~}&(C0avxidL0QVF?%Wi6`IC+1wnSVCOYp>ENY!;Al3I~+3w
zVXjtJrBPL0mjrSTRUsB*^$oJa5S4;OW&UchNJdU69WEdSZ&B&og1(S3f2uB*;8dO{
zpgj1Km7YFPKUN@r7_=JGxR7zLv?JvFnosIb=~WELr+y6nuf`G7p|f&Nm7+BeS}B_c
z=wHs<*z;S+Tt_2R#PV7&8~&?TVNi;rz!eQvEz4vL{)KTiydjAK>xOW>mO<#}5{+PV
zSGv5>`<>|JFvRb+h)|VYf0uI(BCa7Vp|pFRxCUqdg7tI~XVwa|^J<@r>P;z-aqvd6
z$T`eHldEiyR8_Zhp6qanrDe&~AQZ!6pt+LQ&}!x<LkukY=#C=;o8pj^ih<^vapciY
z@RcyFX(0#<uHG4@56m!g0fwUyCgN>uT}!DJ^iw7v8DF_VTaSd=e=lnMs|}$7jwxeY
zK&)$V1J_VNtKYmdJ{Y(~z9J-toa^5KaX>An@a)C(%!)TIXk1-UuVG28K^}|3aZM}E
z_1de~{OPsT{~^i0fd~fPsyCo1_+e9+4txm263uar7-|Pes?&UW-RzKLlI9fuBS7K#
z_gv=z)Bp#_Up1EZe-T9SvuEtx-afbbvaDskO5l=j&)yuVj!SULIGP^m_HG22ZG_<i
z^5d&XmItngh4&RPwT9$%O+0VoGP%r?C>UosfF<LB4M--}en!l?VUUP4N%D#Kfld=E
zDXwJ{jS*l#pY}!+elfXTo(*lJoc&vo73spC%Ms^%rIM25e+9_vk<L3vi#R5b1O>XQ
z0Q3P08go=G0PWmY87KgIELO>;wNOFPAU*yOce9-H*SWvUK-%d7fOlFLYRq9!wNK7D
z<H*7ou-*-Es1vOCBjA`M$?53oi)@X4SA&lpUxFJ~9K&MHa4~149FrL@KB%peiTJzJ
zyeWJ&ib@7Ie|1M;pfMGmoU7MW_}K;mn;LLy@b|SJ#(=8;<wN%$-4|<rBQ9iqEoE$S
zEJPS&gm#=j&Jy=5%^qv;oavNm^pLt<Ze;xA)pL^p7093fJ)jYp^Xr5Y1U1Tv$ThaF
zf0aO>m7tvGNfgocA7@fx*u&q1Q}wh-o^jEZ;=m`Le>ex0D4~rFpPV;w;>XKGdUNcT
zJI8lZd9wZcG%>F{O<<YErL`K<S~>4#$6PwMR2;pgOuE<KJQaU>c>kejnubtoVItIK
zH*~oaJO6Egsbi(t&_#zfCoq-P)we>@B<1&6`;8iGtaOI+%D2wLiIuF?|MR~+_>-tl
z#H_s^e_VkboGJ7xRliv)Sfdbhy(<}XWAR93y?XZQRY_%0x@sn)#hC1b5j-!<l61@C
zq2V;sYQhs!{=u@VW=VXJAVkWNbNw=Z0Y^B*W?q7ebi@!h7FZu=25UR7DHMJvru}}t
zxn;_kuIHOurk-JRqZBFllVu>jfBH%b*&VnNQs1tVIhB5YwvGLDIDcw)Xwz#8?(xdv
z;*e8y_fe@|m{~w@7?gWo$I!;_4SSR}q?@5;_@}JYh)*j%ds?r_g5b6eRy(bVi}!uU
zhBh3aILXA9kv0Mpe^CRvrH6%an1_DUmL}HqfQB;-zqgukYP~rkNSG9hz6UgLgR&_3
zT%#Vs<@ptj6?DvGlO~HWl8%hg!3E@yeN{lymXdaUt<vHg8Dit#9xq__-gDgM19QMD
z%BfMPraD=R{nXYj*XFPT7dWRH(nx=>7p*+v>q=6YxR7(df5>DxafMtB`WyoOO63}<
zt#PBDpuVt%n$L582|iZT(ZJMWW<a%u)T)JIk-p&UrEz7YLD`E<RAdz+{O#)(j>L^G
znYGDyZ01XkbRcD(+*I{%yd`?>?u1z;@8$-b))nt+fxh>BYQ0QLYHUGoEf$Cz_e+WT
z`@4kR8V59HfAWS<(G@{tPqM#BL`l4)dKnkjU#t9YlL*dvy^YNB4X-KVkI=xl+7}Wa
zTy_7(0}#Dm>b^OE>iNc7Bm0iFpaUtmMJf_)s8+mW!Lx>CA8uC2ppzkS2t(+lI#S|-
zjw{|Z#N0o#1C9OX{;?Gg;4v%;=lM>o##ClhPNQ<Ne@!k-gi(`FPCP6;1m`vSoe?^y
z$dh#`48I4H${R`|W@dP5T1mTbs=E93G}K{HPh6Vbx0dK&jm)sBoZS@R8Lui%SfnzL
za@{3H%C=#%NVpwA(7>o~V|Gm1FX1@e{ocjkG6{?WGKRHUpB<RgxRqcCaM!PrG#^7M
zLZCXKe}XZqc(U|P25yZ#1>e2-{)N7D5hd5!m0<7M0eBXD$1lN+^h{obb6GksIUke)
zytf>E*q@JY#@E-^W6%KOB8_AWE7hdw+NQscHg*`inI$HZNu`{o{j8CatDXX%w1%|V
zD5zn_Yra9k6Y{eaI{U;$lH_oJ-t2#BRs?CifAAY}J2(<SZe4vByAG?2Gd#>bTf+_8
zSt0(|BnBxIz!k)VpukJ4yvV%c6`|(rdePF%kLf0Rz)|JwN#9{fAEM8(*vBxwN|G2N
zQ#uGKjPo>snxfp5e#{+rM?TN>GY=&xDkBcin92c2dx9m+GVjkU=x`}M1*bojNa7io
z68zFCq-2E<RZ9Z7+Y#_N){ZHcu{i=9e-;0I9=xB@?QPVDJEG78?IN*(6!O|kvYkF|
z^FY+#zJ(cKYfy#S0BPLZF=`DFWyXRH^8;8LP)z&OK;rZUeXj0L=he$=yTd8`k7|$~
z19zvZSD>u~S}Jl|EkYR1f|W^9g-C-9(S6KXfT()8!HX@EM-=?kh=edc+=W(rf8wWL
zR+`8!0NuC-eYr<#Ys~JP0aYC~Dzh&gx=9-8vIc`Ra1$FL<M!FT*9Pu}>mJo!am<l-
z#oB;n>TgyP@ivoH_#7MiR~2V|^%p3z_^ZddxQeNR!CgB=D3_bZ8a5cm_u8OzMjU6h
z0@2xs!I14R@Q9%dD__Dl8mjgXe*^{Wf6jG&P9#;jc4wNpoeE3mHnhFfn0vRZ%?gzD
zy^nhDShnfTZEZb-_m-EckVvB~H1xjGX}olR!pbGYb3k685ylY|ZHYX|{V2msxCtHU
z#$>bbSYwNQ6}%dt2_dj{lviQsh*?cLL#}(a+2^ss!KUY2olfp!QFg}he=Sv7{o`aZ
zdFM^U_W(dPwh$`<xrvhP8cW@vw-zE=K$hDU9xRUO{YGW7Jb5gnKVR{6s`|BxX+faj
zp55u#gN!cw&HY?Ki{Xhg%m}Xsa^()BT1xPSL*&8qSNh}q&VoT1bTkLZhpXCjpM}RA
z36GXWo(E9bteAB&P8iRle}bIn3Xhr8V<{sFc|)aN8SVGsgod8KfjZ}GG>IG0IFRk&
z?UFjL06wxR9*)`77|2a3>G0+?l9@++BTuNp3TOt;g5dl_ho?pL+GH7(i;y%<HPqUs
zNtUTJ;}V*E6~z8f#>i{FU>D&tO-nc5st_{pK-uo5F%QtAt*b~xfBmYO*8%Fw{BlzP
z+BO+4l621KKIaPIJW7_(m0?V6V8q5>hB5b%(d?PTatztTXq{&G8`3pF)y%Rmo=erC
zpjFRe*D6ZfKyO)z1B|mJQ&DT?UJT-~p;1Zed(3XxR$)NThmHy0@z<}zHQp2PO3Q#I
z0R)kA#o+|&Sdk--f3<`Ob2V#--(VFRt*@4CSW%F*FnWb;%aB=*2g!h1u{<?Z40%Pc
zu_iRD=57+)6c(1J3I%xp*49GhoVy3^!rpq2yI}Aq>S4RH_Y>3N;efgn`V^uOsA5>m
z;0zYvFQnaD!s2g4j~)qZc^l4QT>Sz2Er4@ry7q5I%%J6Fe+MJgDgpZvp!cu<x;fS@
z7rc{^>9=6@IH+Gq%^800!IX>0hsrZ=WF5n?>-R57EIrjvnS8P0?VG13ByoE9-D;F>
z+E!m-Oh>ambbRQQRTb@g2IFE8y`+Ue<0V{kx1<d!{U~~58c}%Szh1ts_NADJZ+R6p
z6|pfSg@=f|e}whziQ}wT0~7?W;UeJ;$fn#tLR`pg5(mP=R?6N<_0$l^9R0y*5wmw$
zBe6n(Z9=s_3W@bF2MN+vd+G4$uVJwNX@VwF_YeQ`oFz<0jNLkLaE}Pxr@Iq%|3jTy
zXq)?FYXjzGr=a~tLXRzNIWrF6#a49?g68pUW)=H~f0J5&x0(S3G6j|xJu14Nh%Weo
z!-;M<?Ag2FiMb3T#6#@0PsFj;(CouId8~MgVHJzm8prN<t}}pBAM212&@&4o8G|$o
zmvNHHU?Tpm5Us-lfq~*WRE?xCGe;NYXZ88y)dJCd{P6V8Co1xbIPcA%p`1<(t{Mf^
ztFWa(e+uh2-h^{({hh>;02@9@tBer0)hUFUvbjlZ?$WlSc!pBYc5y4BWPVAf%&Yq(
z${_@nT*LWL6;oz*=R&Bx^|vy`0}l@j<i-_~*hgx<lJiTrfaX5=DVvlev1y+Njh`@<
zjnj*^+;Ed>IQ2XLft-vGgt=nya(fUwJdaJ7e+lU>PIOg<`hftR=tWB%rP_N*aRa@v
z?#(&Y#f1z!TDwAnjGA6qRVRazInG`NYdcW{aX&>Z^_1m>+}-(7RDo?dTgR%O+&GEH
zv|?jK&@{umG%^5=UYWvzXRifBP5ZnSW-wqy^wWatRe^1>>vk39t&UsMgA7)IJ+z2J
zfA}%k8N1mI<Op~q2*kMldvllP?tTsfn>Y%gEswQ-Lp^-%pPr6PN1yvW9esZ8&k1d5
z`s2r2OxAA39qoZ7HK6?WYxdQ<VGV(Pb_Vx!PH1;ez^(3Ed;TrMT~*qN)*w}fl8IY8
z`vGjxY=-yI$ibLOFP9bSv8Viuz6ak#fBVgnL?1%Wxz2nIWd*bAFb<OImUT3Zu27qO
z4|n_>Z)hL3qt{hOH*=m2V0_^@yk|bH?<h)qcfi>;be_T`nvw2l?GO)^6?GbQeFeUU
zfe2kX%Vz+&@(5A$QPZEp=k^C=ak$yo&|EHjS<AzBXHKi%hWj=O0ZrIlS3tCVf8E%F
z14gcP6z*3_oljD&rrchzVThInaO^A<M~0G0J<J#r(TD>qN-uF%)0=j`Wo>#LEK|95
z<!7@sQsb{xT)OI|08BDd7DnGT*Vzwj@Y-b#Ow(HbVOCug_p6uLttvz%mbMg;RZ23%
zv79U?qKHkj;OagH40J$bq~XVYe?Hlvw)VDKq4Xq4R@<TYB@<g5+vO9K4|1|cK}osc
z2B%lU83cl$;Af!vl`Qr**(%BRC@ay;?f9rA^ij(oy*yIqLKTryXA^Y-33OTw7J=Ph
zFA2N@PL<gR{XclX<ft6e2d9DohjTuSS8l5AO}$D_b#G`;YnX3*?-1N~e}J$B$E<DB
zA<I5n4UdDdfD}HY=Vl?4_qe)VuxI*yz8BN+-W<mr95Uy;e*-)+)2w{YC+V6QtCv6@
z&1?VK40T0$$0L=Lp&MSv^@R)&x@?4;WA)k`sYo+8?95P?adJUi(C_S-v^!0v?ZnsQ
z60sZ(>>GiQk>~9G@ILz$e?I#aKKm6u`xQPizrx`U^1r=vy4L-(H8tLBd~el<%V=_O
zwAx;z3a+_zrAnyQE@#%yZiC;F+n{0iuK8%+Lep=yx1s6xvj3s!3fm*m^n1le(J~90
zUmC9Y?AiG2+4$_)IJ{@$>}Dg=5PMZdCYW1tYLITSTpmu24ax1@Oz3WN7`99GFib7p
zg1G}3F<~sO?o)oQDz;P)w{C(Hp2=5MP7;^I7!~s__aD`+6Fo%_8nV+VwF6$%<N@a^
zxmKCL(1nMRMfm8G!Iud`0w8~o8au#(DF@x}4ejWoeKrAcRCWPCa*>_KfqOQ!=!<*@
z2wRQ_F*sX`oPmZPiA9)Z`8ZGgc+OzzI2_g2XR1L4;UQ?Y9j}rYp&<>Sz;r6^KQkIk
z8|dqV(vWOiaNze$-IyohQp%0ZCG@1vzKw(WHa`0<KKm{{`z}8FE`EROz6(7^R@HsC
zk)hPL#J_6yN2Ib*jm>fNZsd5ZzojG)^q6FK>H*<paCg&C?=@PmA$Pq$tYhP|v*@$4
z=;Lx0m9AlF^y&DNKD&u3ZlaOUWy<{HXU9<sW-A@PEniIuu>czY=c_Ois>{;t`Hfc9
znOsB+o~(}O;Eu7pOHh9d#I-?Gaj8pO$tDsQo!6eF+CjYLSK_t64S-0$@)Xr--u0^J
z6ZK=xQ=mRS8vbcU;9m6TnHgZF3E5Nm1fBhi;$TEgf<nZVQ(bhy0d$dJMcD!t1KJ#8
zmtF11;^dxVUcwVVww$ljn?c0_zS|B-E7j#}cJ&mSDDi`@qvU_W0p{=O{`4YBF0%bm
zC6jqB^Knfv8LV~PkozKx{d9ZOZanHgT;Z$U>Q^3I9Nr=gpZakUBM0yskNqG>Wrl9c
zD7g^IXQEMuY1z@MnU^$~Zl(|=7d@h{11g$^ABq@#r?M3BU#2RF$TUJ#O6>qJ*JX@A
zm5n<b)R73r45xo)J?8GEu*0~I3jP%<vWXQBRFmDrpp7nA<j?7^@XzcJHQ4*O@dVET
zeO+PvLdHv&=lwb_w>gS<0B3j6r|f+^SY5TN)U9?()?|Ei=qhZBL#z-Jcm1W3VX^YB
z2#tX>vkXd|uBdA!mT+4&+g8c4C1yX@Eq~l~%hWfk)=_`j&HliKisMp4#U5*<x3Pr*
ztZkmy*GaH#)DW!=#2U>6OH!1ZVsjrc+EFi)^Hk;@ql$(U13S+FV;~L0-{r+BNiH*y
zg-dKD3n&K1-t{Vz^VwgZ|K*nt|LUC}L818zbc&}0ggv2WS=~u&lcVMJD-CY;J0=33
zp%MJ{^$UN4zC6+~Cpg>yo<L#0gfVg9NXUFX+3jFBnM^tw#&;w1;4(l^9%)V3w5IJh
zLKFTXgMfY%&cocYV2&$I-Z9qS-NXH4BA&0;G6?+~T8zs0=Ry`BE$O^6vF9+kl4-cu
zdOSVO#<mxhD5*5>EcdsFDCTj)n;DM6jNl0{Xd;%l*o`eZ6>`2xxUI1_Ux9p#m(l}l
z?7~6?RVWvwr+xSRlc$<OiJ&!+{;PK)5<HM$U3LsRej(MV60-c4e(0CnMgk#!#z{O5
zWF$e**XcK_6R@G%yx2ri9DDkk*<~09-bgpI4e^7)iSZ~oAAz9oGaZ4;<bQJLtz62y
zS9iE><n&kjW23>WE#cZjZD1mIw42&6yHG*%RX-&8H*oa8D_hPo-^$#8;xq_2KGJM0
zB02O17Ms9H|37*2^t(gt;;trt!Q1A!)=dK8Mkjl@8E7&=X~QPQVhG9EC^o6YHb=ya
zX_EW7oT-bhp*c0gq`f8+pyhR)On_Eb1ftWCgE*CA8T%K6dnBkyMEQLjU8M(Q64iRH
zW!cYR0d>E*#y9a)%ikHllUIGIeS4`YK~Fo>Y@JNRn`8-m?cvlUAyV>x)W{5>NyEVb
z8fm3l@V@3XA_1EsEhPNAl(9_liFiV&Ds^pOvXfNf&;qAD7D*JSOQEr>W#X_m>EPOd
zbYHJ<d3N^V?9JInq$3*KSfxV(>-5Rd-6#r0ZqM+sZRGZ!V5QQD9LY)998{SXq{(Ij
z=bGn%TyK&bTdyUR^Y$lyXMSWd4&F#M>vle~)`@BgO(e(C8ug&`^`K5)@D{wSCEtLS
z4VEZAx8Hgn`}HtFx%Dg^>LVmTCxhI|SH60`3>$SS5<OlQ86G`6?6XACn&#ut0p<4@
z9qpP=b}&74u0vOHwvFejG>MZU)7zp>eD<ARWR(Np6MIAT3nIIJG#>y<)LA~>@o7|@
zC!Rk$0871leD8Ok|NGtVHvat5U&?8g&Zjz7ISu1L-c0iBFwZzWJ^k|GL(%m8>BG}M
z{NetW;&*@e<CmxR?|=E_=|l0m)BAsT_-}s@zdOB)1t_3l=I>5V5Ac$wr>8>y`-%KF
zor<T)W}Ak~RgPYNn^(_XjX7cfkpn6oNYd=ybSlnYJ^Qcmi*PREOpc#xUpF+(_U9`(
zelR(`2iLt;gfzzUz;u?%1;7LYNVFe^3+Prnxi_7{wQp7ux(1|H^7%NBVCLab1HvLc
zguLLylqQkl`3!wbTX7))lR<<rjHSCJz1+z7$*bqWPxEkpq0r*P*m^{`-b4tsO5yq-
znP($(LsJ328jZmgUp;&E3eRjQ48~KK+`AX9G5r5)gD@7~s8$n7OHtdkqse4CPuA-s
z)?9Y<_})Ft%Q2yvbCTM8>sP3Sy3>2>5hORD;BwMz+f}-6#-r+c(eII;<+HSijlS$p
zMsALIq0lCO_-bo9O^N8x=CDZRER}u+_Jq3lM_tP*j^ZMUj^35-3ga+aaiXv5EoqjQ
zu5ZeX!X@atC@tb%d}Hk3TbW?Xb$O9>U8Da{Z)uXW=q*c@0=__2V03*^M4z|w)80-c
zX~E8-{HeB)!J-U`NFHFf>Db?skqEn=Vjd*|$Y(u&gz*!^JX6Puv3fQrq%%DXTU1lm
zG8hmYJC@BjFxl}I08N|bt7M7kZ*+#hQ>%SHI6me{JP#u|CgXa{hW=PyK@@r})nKGd
zC+k2QeJA}WU#T{g+oKce7aqwYI=P~;&9`H!n1Z|kZCHA|yn*63RG3hH$Vt4a3Qe7Y
zRJ#>_06WfCdPZ@vz5qxc2rognKpnV!tOp~g++d9T79cxrL>Y%ba#u2@-VACe6f6^=
zz_cErQ%}{fZBiNd)cXNa@hG5))p^kTw7w}bTx`3H0MmGY6!4GPFEUNwQvn5hknR`|
z%pR;Deofc66dK_F*~ulP)Mli!YTm{Bx@FLR(Cw$oJkWV2b%y2YB1Oo}wnqywJLDcW
z*0Hy9VrPnSZRsl6#;uD7%!IgNXo%_#FqnRjWCSOLgodPl6B3lYRcyFImVt3LY4Q_&
z38rUA=iv+VO+v&J%M>%iKAH?w>#hWoWs7{CtR;-6+kRw3;OsS5-Mu$kOx{GN=LRHy
zIK*rPO^2kygh}I@NXpz~25IBFL>={vp274|$wg|@CT?bDORmyBR%#o6(S)0TFB>O;
zL}fh=h|BO{+hS);t8J3_na8@fs`ea`*ME~~5YC&K{s7x*=+J2L=KL>*OtxmTfHc(X
zI!P}d^{t>$<$lgp)#a49_Ie7(x}b7@ieM~dkWnr~@7&s}AFNUATtVx4Oe*u2a^@F7
z*kB5dw9)}X7>F>8LBmHy7G9xx+4xyjv1HXzY{m@^@tvF(*eY9}ZIURQZ*Oy@@0BYj
z;{w#R^IXZJU1YG_18!>FFq!}@D~#H*YhW2%RT4UHbzv|G4~*!6Ym-AMNIY<VNn2M(
z&w`54Xy~>jqFm%IiYBeKB^#;qfeoh0IVgfa=0ItYZL?giZ&g$Ta+yNT{47al7b&El
z?;$bjgSD(LFVaj|7S3y;$7rhDJF;Z5wK7Lq=-OYFWtaU+lLWGVuZtM_SH)eW?}(i2
zuWX7aeUDpie^Xs6{ag7I2R_1o?TiVr!-U1oDz~Q<vkWUV1`s*q0EEjTEgiAd0n$Qn
zIISMH)gH(jR4AzI-C0ZK#b(A~n*sL~@!(f%qS+%g3Y%=a0;D3FUX7~0tvQpd(Zf`a
z^nB=ZkY4=f405SU6c1B@R(U8Xb6J*j?^^6rV|l^#C8ESv0P5odX0FYDP&m=3+Bhqd
zT;bK40Jk~AuxEg)-7sUF4;v%p=O*VoA8|O1htnw_i#@O(b?oyYypH&CZ`uy}f@QdH
z=-=ScD21$B3828}wFjS^{gCTblF90DY808BJSLBYDsD6HfT%p+c7!&pnpp0kuRx8i
zz-~BIgmP28jw7~*E({-k2Zx0CQ<0=F<bC5e(Hj7zkc=yA#W<igPzK@{{2kV^c_&zC
zrsKnvxAis7k4l+?;fO+oDfPi_Ya2}B9%Fheu&g+~KbhP=J%t=sE)G-8I7Jv_xb@^4
zg6Ic`u`yK@jyE!0a13VbFSp~<fBVBJ`j5T``NBnJ5D7Ut!6aILTt66YUE~EqATcjq
zNv=AuUU(wBO`0si2s+f`nq{hh6{kdnpW`J)e*y^{EaUlhyztjyw8b#7#65sThjNN+
zg+Soucn+f+d#d7X7RKO$PEzO*>ZLOG!&nC7k)APUcqi14i_xx-Inpc2J%-URrgZED
zaC791u?25%q6uh!(&VGDO8a(o(3n;0FJNjsd$TM}Vu`3bS}?l}MptS#XU{DFCZtd^
z7)_`Zt*2Ql8()#j?6}|QYypae#is4LI|a#kza8{rcMv2dU;ANoVxz7bO~lse9&C32
zp0ktw?Ix3HZsmXONL>A{`X)EM!}8SK^~Nk|xv8cZtB>w~^NzkQ;&TYI3~-FL$4&c!
zIw1PGyj8Wgp#hyeyrxX=6=YrQyv;@$m=RqoAsgM)W*7&DE7p~WO4J@y1=bNk_dF;E
zs#*{}W&99&BkDS(RuL}G!?BGS$=dm31Z|7KuMbIYoU8`bV`xD9I=8AO-+QGVq*Xw~
zUmITby{ch<V{PDJKEw21J^fbP-LIktI6LkTTZlvLv3GdCBLRj<d^p|J;{`S`PbEp|
zSZeuYP>y0s^Nxa(P$XYVwhnMZvID)`5XMruk#iYta@QN2n2{Ph(XhRevb-AKGk}D7
zabA;}v%i0?)h&0pg9;BhR;v*gAi;c0PJqVSD1aY-#+w5EKae+0N`}%Kq>P6?F7hEQ
za`5vu{uZkCXIOST=#FgVKltO9ly(cc6mn(%=SP3MI354_-LGFheE%;kGyS<pa(@;}
zKdp7#E-QD+v6#&njIDpCn7*8MHkBAZ(Rm-e?_O29ZGl1~F;tjPo$=N01as9t$zGn=
zRYvrGvRIj?DQj$UDYw~i@2w|;xceC%SoV{3lgY&Cg)D-{BH(tRudYMrTJ$KH&7^y4
zmzI&%+GwLHEGLu6z{LfvW52|a^^KaY{hh&SbKa9%i{E!r@uv~Sw?V^TWb^3$MP5{`
z!duOn92mYXE4m>e?jb9k%7umMV3{0fJ~?K8L|MsTU2E5xE~UpoU()O%j1`X`U^FPm
zae9fKTso==?AnhisotxD9JZwo+-t)vET<LlcQjS~$-HOfD_%%FyrwAijd>^ajoElT
z7H=+oc0LZ=qR6UoZHu6~z3iY^a_7PFfz_XL)f?50B<Vz)lcQ0g#_)wQ&eQEC3F91p
z9jeK^fUI(HtP$35bd|o&$QTN=z;bwd8t`rAGb#%Vh|7S-Tev5`PILl1&+P(><9NDw
zcJ|j&T>D!n%thMr7{r5I$5?%-PSuaB$9lR+y)Qf}DD%Yc!NZ<J;8^#HH1ZykXFXp*
zW+33lg9BeTw+AMqt^*edWGP{130hZwgISm+FlF}EV`AP#5k>*69$$p+*NJ#07a>-I
zQzL|y)4#Zob2uwfr4_dioKEcwtdPo?z(dfm&P0yt^sXKP+x5g%pLEbXIj-Afk*eM6
zmul6_=>F5RepeWb@IJT#HlPrdxuDfiS^@=iHNB4LtyT1@zz7$;DLy!j=+p{-FErGd
zG*)gG<MM}ifNzC+s<9pziLeAP*%UlICDt@RNLffF)yYEndF-E=h1^|Omj4R+CotEv
zLL~w3S?(xwJDrSlav^Y4LrhFb6cgyNF1VCiu2c1cAQN8XU&v_2k^$cbxfGXzd36qs
zF&Rbr`|%v2ak0RAsf-1x8xzQX2^eF4PK=VM0>ERuZVWk55GH{TP*UVj{2j<NyrP6$
zDK?Qmm#ZWK2&}Y-WQ_w4XwH3*q{Y%E3^NYfg}_iV(cW)cG>|mNB&tcZb?s81u7GKP
z&-P}Mz1e;x)Z1xP*|CAq9SKEJV~qO;6-z_`=Ri}Qass@G%X_H=s<07%;2`8##FcN>
zehkSxYUMpWGcSw*=Qf`Op}&liEDz@y+(5Pe)p2o~?JrLzYM@snnW6j_goQRs)H}`n
z+>er_Xfcwg*)v!@YCy0Tu2C?>V1S5u<cBDPG~Bag0jZ~GV+=}@Gc}Z@^d{oGa=+@N
zgbQt6?F;+>FcK2Vn;)Bhu{55Z9so)i*M17PB3@bLdQ;DOxJR*ZM(|T3l1ePaC^YDw
zZBNlMpfLqX<KgMU3714ytQ*VRZnJD!Z0@E*lB@pjI4-Gl>>bZgC864Nu(Ac;hd*q=
z=jztDoWd%)@YarEjXL*E4`a=`-?<L<BQ0F`=duBGj>C?&z-?)N-G4?=wu8_bz?(_>
zMy@vy8aszf%U6-VpPe4aO_XdwTSEbG5K^tVdp&AXZm#XY&T_d?gmtgfD%oTY%Q#J<
zXci@NKbp;xh)!;HelcHhktWv}5`M!qbAOXV9W!iDIA=&J`+{U6;~5k)h5_Jj7WvBl
zl`2WB<)BloeF@)xJ0tXg86+dwKT~M~ly6@o$z?e`+Hwfot8^@B>H}>uo|46ES;~{`
za8uBOX9Pgxz{Z%WyG{ZhY~qgn>DU;xBbW|Z$sKRrh0+E9Ahci2dgpaa(ix%I_pPMK
zKOeNXJdiFvy;o`EZM$&HM%4T_qju79nFWHO`Q>UWJp}`Q0)&bJ!|(8=!^kyrpuF4Y
zAhH)g$9*)zmfsuQMizk`?IyDhWly*Vxb54r4#Uf#_;#qF(rtO@%UU_G&UiJ30}RV>
z7R#J!H0)aFe%f<`AnCC_l602y?jDsT%O>*UM{df?F7h9=w+B3S)!-TqV5sb7cJNH<
z_ZjYG>qD=9v$0Oh5;ho3E#GGcJ1UtSzLOJERkGZ96ssYEWdc)nA0zD((ZHD(TXZQm
zdtxTyiD10&l8YD}G~^{AgikEwqTWH6#or!M!^i-Hi?G~&#QlcAYhs)^VO)s}9iy*=
z0tj|c>h0?nC*<9xVN$vFL*=zreix{eu)RL2Btv<Bp~8%t8AEIjcP1@3?cTa=S{YQm
z2Sw>5_u#U9Iwk-|?G<XC9o<)fT|5)<Jg4z!sgTmB3qqR^@x*b!Q8ND`xsoFemf@bZ
zWXn>=D=<UB+c%xB{CFv|DO7-1`!=qGTbkly=k(KI_-k*;X(+xU+BV-X@IA$YX4L4K
z65*MDD-n9ON9*7c&3K7syhOFaK|3{rVv(~l@K`_Zo0lrpgtfj0>f*TtcGwa4PK#LK
zLxTG`3}mfzjC|3SKNwkmBA#;07b?Y65gF7rG1x8<{xlEQVZ4NPMdL6a0G8~rSo#}^
zYZEjEp*o^U$gq|O##3;<;T*U{s~%m;)<Tqjy5p~&FO&xC8NVHhOEnOa$~E<|8A@u`
zB$&1;g;K=UJdg~3{a)lSvKOY4*s$EL08CUgB{diV7(0M%L0CY9)OV2-`A9`k4VVwL
z7sNKr5YML~uNN@dQy%O|_HyBkYyiV4C{C4R(F*=IrJ(`-QpvnYo}HkYP-7#a5xU%e
zeN{U-hQ5T7A`$4Dm;QWZ$D}D8VU=8G)M<hk2KAbsjg!TML%D0+zZ5eyU=yhTQ`Z*4
z(sA>ll@A#bh+h*)dQ7<1Y*1T|JtZ>3C(eR!$w0tuhX_0xfN7V?tFQt$RzC=>t!CT(
zglsC`jX+hP1mNa4s&kT4Dt-~qGJrUL=Aqq6lPYUMHOaNNr?1ymXIgP&iqeI}Z1yaA
zd5Fx48axpYVU}qyU0asdB{v!+5<~yo+-Gig53G!w`!`9PthcseNK*b)nFf??L#-qQ
z`@e$6!t-w=8$aHKA1v`h3PA80-pou-P<5qF*T5o6u?`WsS#bfj>hp}8CxD!PbA}!B
zRCQ?O#mneTI)RFdhPeC}d#PqvvwG~c`x~)&j8=FO4P$uCDZL=u3uqPlR|#}0G`OJ`
zsq`<oZaEhIO-OCAf&gsNK0U^-x*tE^P$fctWL#07;uU(k-R?E$5!ozRz!<6^wMATw
z3^Sr25bxhLVN^Ow5A-HM9mRTole=o<a(RS{qHXZpT|~+JQlS<kkX1BG77IMjG4_WA
zDS!|HK_rbI&qCrD;!deM+>~3*dMo%?SxW7AGfRc0<PE_a5CPD;*xTs}y{4c(#(sco
z2Dz1%XgUVO-t&!|qfUgAh><n1Eb`Qk#(Ib){1YdsHxjv@U1s9J<jd)QgUP?0K*nGi
zURh}e<+}ebG7%IhM(eE%DH1%hrN7BMNHfSD!3=noo=#gb<>0lc>9-Ts+sQd<0&z^1
z?G$CSR5mfEWT7NUHsdIarSPs-+gY6CvpBitUIKA~sg@)saA=r(oLuv%*F$U+JHwNa
z32D{wS8)xP2|==)h^I||Qz2sm3gDH6L$(HrO)7L4q1~1z=?FWSqK)rhdh@F6DYVp*
z_JxC7AXfs?$UPvUb3YEi8!r3MMgvB&=(!9sVq`id1{~w+^R1|JVNV|Gt~ti^Q=^N&
ziqlE$nX`+nIg=a`g6g6Oma-46mjrtf1<7^na48*Cjacfvfv|mlW?_~UviI`$gBr}U
zN{~^w1a9gD=EZ!b>fW?6rr9Wqo6AeA6ogtol&`qxCQaAsLVRSeg$)wbtOZK%+K8uP
z$Qva*^8_g-qOF>qX^N|YIa#eU{Lw-qs%yz8Isgx=eS7N4q@d`YkWzc%3=++lQ=Lf0
zjf=}SqQPIAsnWZDdOA)EUBs}|1Pa$Oo%%6FNlk@Ns}inx%gCru;|_5y_qc}o9m~qu
zKP?yLPwk|`iB*20o<!r7{j-GgL&(0W9)dF@8NrA<?$#5-bvb`Ef15j}XQ&ckx5!V1
zPLUCPVNlZHH~JC}E#~_We5yH~&PN&uS*3)L$v83qjw3#Q+8Man@{w+&le|*^#DO<a
zu9K<W_c6PT?XwQntiX8anC3%VmP8VK&DtsP!%Gp!t8gyIkZPXhGR315${mKFhUfqA
z5?_*1<n7`WejW0`^QlsyOp_lZlIXS(*(%(aw#Oz^KweDY2mU6<K!St@PBf=9N%9J%
zQQuB<WD{tA(0;z`y6y5&W}Ni|au0XR8k%5cwTIZ{gs9Ma+)lsNNsyS#@l<E^sL)H}
z;5T+Wjhc=L2O8WV+s@($8(@MFOI;0fbsx!<8OxR3cCy||pbkEDNL$sd;XrrOfexFc
z2PT!Du8;`ph(!Zz(kdM^VPqX5HL*JlpmMnHNDd%>o;4YY#9O7$WzH!5q#3s@Sz1dJ
zld4$43O%aQYj=h~yBR|%kl?;7B8dG#sY0^I$BQW3Y$}yxuj$$lJ&Mo_U_AG;xgSVs
z$B<&p!X}L6h*cN56G(Tf!ZOPM0%zzwtRl#h0^XmBL)k^4i#|0@A)Y?amPyxHB~teV
z#3!zQ(Vj6KK+$B;mV;-qJ@L2oMm1(gC3kGVBMpHvCV=6Qq;1E1T8d9kOFBqZTBco7
zm}~eX3caW|(mMdI9y!(y)LDtV!xHRYOGI2cWKP`2wU_Gkto>A9b>lJAcapKGZh0f^
z*&Xd9(6VA(7HA$}X?bIo2&TxDA~))hAmQ+T<}hm$Z`jl{8)-$)eoVlH#<KxPKMe9z
zg_<hu4)aV#3zct*U4aoUbqkS_R3ea~AC0&&b)ft+ohHk&kL4n~n<f5QMH^iA8)XN0
zHH#J0ihO)*pk}rU3n00dH~?@tQy`%Qzw|`B!izd}d7ap)vO7Uff+5y69suXN#Rs5&
zZ9{e<W_hy7#G-&uDfke`+fbo+_IGsAJ9BnT*VFgCw2q7Ln<RBy01HTpmtzQ_GXmkQ
z61tvPC!PObGOMr_m%`YT31#`)$l=w@6Vz}V<vk#8WG01+Gp~NHAPYj>*fXn!hByfY
zyeZJan4~n$E5pdp2BRE!jSA;;@o>O@O|~fYS3!lV-|Tc@j}1?84SplaPawvWsh?q9
zf#Sy*-|sQp2cbz{ucU&^R_-<^9>#Q2yq#=w0C&h{^9USIfv0mJU<&9`S|}TyQL$A~
z7dA#4Ti_y?agbo%PMco|r}^oz882^3YGl*KcDUl3_PX=(+9q{e?cyxK=hr-c6*KE4
zom}gOKXmg9Dj!ShTK%mlzrOlL=APP0?s{0Jeha2Cyx*7{4sL>aupA!+`tKT)DkjJT
zoF1dx$P0j3s)C!S&gndy&Q-dUTgcQ|`@bNJenNrkWtipZ7K`+)rU3db1Z@fPiFgtl
zuz3JXv0WS<r6UsB$%+!_u_vK_$X97nELW-n`r6NB8seyx4g>7KrX-;o$T5-|mEWFW
zOyXEhmJ>>c9P7#&K?Q~<Epp^JF8^y<{lnt(x+Kh1y~1n%M&0v(vD0^kv+V@PhU_;C
zkC?SA(Tyfc>>1D99m*Xo&~Vei5G+_3L&1u;O6LAW5&7UTH3bMNO_le5CBwW^-W@ET
zP+R|)lgp9?w=B?ar0!Au8?5YTQqj<jgn}n>L+PxIrK5mu?F%UK9CN#AT!3S*p$rtR
zrOp&yxeC;KY*pBfIWtM98c0#9futN;9Hgb9(0gnbM$}%pgmOVyu5E?003_1<)+5pQ
zf@pGJ=1aYd))VL7J$dne0$X?!jEDMp$`4k?N+*B)AaC;XTyFNNXD+Sitc0OeQ^x%M
zG7fr*7kCw2FXSByI*RJ#%_dA`)@c}juA1JhYMNGrp+tI$8{LZwnyahp0GEte+f6Ao
zd5i_O`xpk?5d}pse+kMorsFZ5FQ7zp5hd4@tp>x7kY#;^f>COJd}4>^m2(G1jIOb1
z52`rIF^-cKY&A;jgS)O%NOg(TQAte@T~Z~>Lsd9>b|_wE<t%6z2C5NMr)|Vqf`Gru
z-T_L?CQJc@ws!1Q7{wF+5MHU87QeB|Y4I~BfO;o33J@Daz{L@iy<M-si?$4*O|qw}
zs3)+gp1AfieOBy$u`dqLM5DHAmTiuE_M0tc-V?~8Io3%UJFUb&Rd1eBptJuGeL+<r
zIv3gehZeHSg(S`$qO_HdCDBB#6MQChctaKOuF?mywdG?|lAvkOTf1gign?hG4Czf6
zvy;GWii0FTA3B1~RZC5vjIBxauHrQ8p4z9Az18%QyqS1^oRZD7*m&e(9XX%ANz@*F
zMilvsC~{y#k-cCK+A$4k3e31u>H=Q<rkO{5VFQ=kQ~ga1cu5IAp@ynZ#zpA|KzOnN
z67(bJySCrqg$L?Z$x#Sv;8wZn0)UUvme~eM=;XC^StZ3tp@W$$>KJmfP3koHyN1A+
zsrT)7^;;`{10TE1<;t$?+Y8Fq1MSiY%G~Wb;n%nk=P2iRdfQjjkVbrUPl%)cIsW%Y
zKR)r_{rGfF|2vcKemu|Uf3xwsfB*4K{_e+@$-5u_uS@#zhxpw;@QzoTcRxN4`6~76
ze{cEMx5YcW^}7|_{yL?r|L<Sk;qUMpe1_ljkoHY~?GOL@f<C|<Ff9BH|F+)&FZLp$
z2lAJ2A-p@@1TPEU!*y!JH~G7NwEb}Mj~|}}^yzO`G^|=X91lLgB>19#;1%$peTuM}
z>V@Fn@7LBI{Krr9K`)lNTJ6-|ugxky3*P-hPxhOInK)e7y|U`c|NNQuLfr)y<6ZD2
z@8my!+E=Y{Y`9h3p?9mYP$&O#^!VPrMG=!v&@WN(e`E?f;y93-d?mgT4^LFjl)n($
zj8v=bzp4&cSxz3uuLRxnS8*!-y>H~PxPKxZiC^D8Mh=7n7mL+ODx{H`${JQ;6aQUb
zP(~v2v}J5+d<>XeYjaJz>ZwV};LZ0cr-AK%58%58`4T62sRNaZRCsS2#LbpCUw|U$
z{o{M@t!@(_#Vb$QuW-y=iyfdWr9mAworl<me&CWV*F0@K61HNW6=^u+t~|+x-ZJR&
z);wFvI~7M}+VF{|L;VE8!3nn<D<TK&y3<SAR!60_980HYW9f8P8QJOJ<zgbaxNFIO
zj7o}po~-2|Y9^^dxNn7o?v)aD^{8lT@opYMb!d7hr?pcyp)%-{P1tYp&B)v|2h$>j
zUJHj12#(d`txMN+OEW$0xOxC<9@Dd1b=!%J(0f<e{e8l;<v0*)$DTft$37n6-i<m(
zYZX9MYyZG`{R(o>T7a5s&uKB+mXalZ6=Kz7{kyCPxH03TPl^-DlU)a6H4(434X;`+
z?FBJSs;+q-V+qoPTtAMpP9>3c^TazAZ14+EfB?$Ws^nf{raDUvVyp(55Lwvk)2zF1
zD?Y|hL)Dc3Yxli2xOUq)qvGhQ-CK4KbZ=})-`6xZ@k3(@A5k$5%EpH#D$Y-TC2~PS
zMDHkkLUr=a(GG6(MC(4|MOM;T1thUT94Z))npE;wuxkt7z8xprSQ+Y@l1-t$w86$%
zZJOd7ja_2nlb6v!wbu+^)EVLP8M=2q&_QAEE{_8O?iFV`yS0XzH15u<k~yo8mu>1O
zQN}PQlD$7l%yk_3Mtxh|-wyPD9MP!gfPV)KK@~V`Ut=NJfP7XRtLr&yz;cnn4CRv(
z{1I9{Gmuf32z~&|w({&I9em|S#qa|a4vaDsZm-&|^+he4P%#wjITmTDCeg!_)J95t
z5n>Z^g@Ji<>IMADU+$R<ya=Pb6b;_vl+r}qeWA|s^6hX?X<Sg3vx-B1$Kq=1^J=c}
z(2mB7Mb-(2lca%6?IVbv&DAli{lo!rjsde!nHwGR$dWX-r@?0)EKXh`QeFFO@+9{o
zXAnd#<Ru&tHac*XEd7tO)fyg#*OkM%#j_PO<2KJaY^E2-SP-ds7_7Li6eeD9u^*oK
zxu40LG4>CGT6_^D7qg3hEyK{bw*g4fK>+j8PXTONRZhEOXR7-+n;i6j8(2cV!_)Y#
zfzPU&G68K=t(}lTHaUpsTW<>Ychi6m5+EsE??@$Lm^U<EQfPl^5yyNxAnF2_mV_;J
z_F09?)$AIQj-j{Q5ELUhb2#%k<*{H*KAnE>PaXpwLSN&%R$j(`8I{UxhbobhdU$#V
z>mf5!LS;6^(c4936@(Ns`w1`+hwyK;+{OKt!H?RZ5k;PCOh=5{^Cvmk#O&2*<!&=d
zmCqG*3|{GuGk>jKPn#d5LYsq}+(F&VQmBB75vb2~%ZKH*l&gOlDuS9Sh-$Q0y|~5~
z>H?$bN@~6Gp4y3j(4cq>1W4ZUOOu+b+|}?)ndq(D8&(#>ZG&_2P#nfY_>k6mzy0kZ
zGkZ1kOu2MEYwFLM`cRtswu2(WscM+!<0vEwICqDQ$`eTQtt}xb5jE@0q2BeNP`P`c
z39pzg-}%YA9Ub;E6m~bvn*AV6RM2dUSc5d>s_IN*@-x|g-!-W8@-H>Lt%|VPHLFU7
zZqu*T5$bxoJVNX5b%rSa-bVD*Q7rLuuOVKvqutiwDc1oD%iT~iFnaxdWFno1zsOhm
zu6-+b2Z=9S+YafmmbtH-*!{SFZ4T}R-)Tu#;4H9z5kGFo%Dqmm@7Py^Hw^3XIA~Lb
z+H*b4r#o(cBmmmkt^%)*dX}jlc4Yk=hPd`Qdt<k@t(&J6Z&-zZ^RwOMS?bmu&-*Tu
zJn#t<w@)81+i0b7Qmnt`ZYRZ#Q)+1wN~4!iF-WT1Yg7*d1k9Ucv$u?yOeT#oYho_7
zWQ!a3;`Ve`KCY#o6=_$6u^(TSDCB-08JC{d5lmBmz3yCMX|1cHt||4nqj$oygdbxi
zrd|olZ^NH>JqIb2gB<UBWMBR4oXW*apP$2DWaFW^%Vgkf!d4|ZN2zgL8?(bZ3>_8(
z;s^%c-Npe%I>_4gl6Cj$=E>&pi)%}XmhAgMJYn0JO{BlWP5@v0jk@=q=YF2;E!7Te
zsMIolXUZyPh|V1fRgOLg^}GSV;Yt;`-C{ONRfCfGq#QIAXX`SBbIvSJ5!M3Zr=%!B
zJj_Zv-x^NV5A3tmtV^*+M7->{cz<i?Qg+_ffxexF+2t&fS5#wes;Sepk2Nyb*9d!P
zh09g@(%>)zuwk>bOET&`mt+2P3i(FdTJqU{+3V+jJ9~y?nPkXh;+VkmOxq|T2^pL~
zdu4)|0-(J|YPc{rc&R=dH?5_Z+OI<&@)h{_k|@X~;wAKB<zW~Mbp~Bs<~f!f#~RBb
z@D%W0o?QEB0H6}U_0Z)>VBPPS^2pR^S-6b-Xkzy$pIL9&QDxmZ4ZGNx9w-&L0bmz@
zK$eC<QG#kgNRwF@&lqcid4*}zzA{R(EP}!UFbaL{J+8X3l%EVD0dQK%gJ;}Ya8Uhq
zBS8Qf2y~9_BZ!x#Ibxou;TqT5Cb0~_Q2zeie<MH%F9abTW+VI2dNb+zCvONcQtdlY
zoxI7*gsG5Axjz^>K-5T%lsRp91=Rz8jYl%LD%9NrffbWf0PK4T{VYRj_@TR)0G?w!
z--@(|0M$*uoY&XsmFF_H<}&#y^UAbsty;Z+Jx*fDp+v}Zoh`s?mTpp@osEo@XPq)P
z*Wr?jfoebLMA;eDHn~;S(+soO21fuX+ai*=im>bG*Ig=aY45IP03}c5QIj@*cRAQq
z6^8o0;eAWZ1dKK>eQh*$Jt8<O9U1EyvEdi3$MtkI<(Ix;2B=Klru*to7NxnJSZn6p
zL2Pa1pwT98s}<RzD8b8ffM_4$-KJ~IUK7x$Fg5Lz8&=Z>YeX0*5K{JFB(DgIu~^GA
zoTJbZMmRy!=_@%APY6^B=Qt^Um2C2}X8r<nSY`>fHe92|!0$n-qIPxy>Oe%8UAkCQ
zBgC|QH*y|$NMdMby;X|<vQuy2B?cE`Ib@HPGDz3{4T;o0GQMS>>%^6QZEGORL=;}i
z>oAixA=~5Gig$NHwjMf=knQYK$M9H1{~wqKFvwmzl=SqJEZx+iM4J?UXJv$)?nKVo
z<<>SHDUE*AI((%J>!|Gw8n0{8(#==&jX0E1b)Bi@)@eQx&!Dm0tm`~o0wq8{G!{|t
zxz~xDo6;cc!$T?C*>ZTR2id<=(w}Ro)U~8$6%DpasEoN`Sj_&ZTW6I|K3zhg_1xo@
zB?P`W-WnzOAR8px$tl-=;WxubB1aX6`O4meYYEMl&*I#vQSn{X2`MYvuG?uVDciH8
zsJ?AEFUm~9su)LzT>CL#pZyaQ6ZQCfn3`Lf$TeF%y8@S$4_D@UtL&(JpwK5Z<O&5b
zR^7Ymd9M6J58FIV*6SobgH*1J`Q_p1DJ(|`%HZgEj4*HtG5&~uda11aM*{DCi6b-H
z;rcv0eOMpmha?vZ#^&t3|IhXNpC<7lf?lZvx}FyC%#RR*k+I!Q`UbZ0M6o9EjN7D^
zR$wxj*y}>mxnG~olOkWish?WA3aiy~@5}w6KH4jpnx6A<*guZFi%e~MW0TFzNV|ZO
zS-1BIY+C=lCmiqvFuTlF-IphC0w{mdPxA}u=QC(pxpwR7X&Sogj?2)nF%7R|AQow|
zHp2qWvhbHatcG?knukWx&)~7%M0l9}>P<CLGj@Q&QIXBF5xVm!8CGVt+fy}vpuRU5
zbYb(M*F?zoc;wE~Po*)u5%kMY-EP!qzBOK$slXa^SBt_cJ`0+WRO8*Mdy{_~1fVAX
zFX4E5o^GqD#98jAx&AVNo|!`-lk4m0NYmvc?|l-BcIYNN0NuSIeV$l>Q^pmqS)nty
zVK+vvjM>3%U4iJ@AXL%H4BS*jQ(uq@et?s-REl*!Q~bjSqXUzpCEMJ?)Prcal`d5m
z_+6WzmZ`^%y0+`Y*66Drb@_km>g5^=uGh3)Z4C`)1+KtuJW}EYGg7&~TNyvYNX^O$
zIWmWC>+v)R<Wn5_>m=BI_*OvOU?*X0ciq-b)jxeXdsy<Te%T@F8^!Iu9fz95)((4d
zm<WuUjdsxHE(cL#N?gn;Q|srU>J4R#88<C6aJ$ZK$V<3C<6sYtS<QbH;ILmi&~0_4
zc6{r*B-DXPU@jV&F3FQi8Q(okAHc+F^7&YL#3B6NWSN!5!NuwFCp8&r4)w7(`gh7E
zxiju@BelbsUfldwrD`19=x(%*Zl%8QaBEVkZ*_Xdjyn7X0zO2|eccYUPo^!WSnHgt
z&aUq|<gqh%94H~9Um$<>i!XhOu=6q{xH=rWAse%roKKxA<X|aVkGD)^H?JQaZoY<~
z+WzwA0z;-<i%VBz@@Lm-u_V~eR(`hHSDHC&Jd3H@k{#~FTGjR(>_~EmNtH@)TZ>JI
z)!!Ye^488EDV2|yV#Iv~(eD12@`<w11*53e{GG|4@q;41c7%VE;aqkYIku16+JQ?4
zaovFo(N?+3{ui2dDzhTW@7Sx?DZ7yt;N-6UrWv`)^xHIF4Q2CZL(unh<E=vHRW=fp
z$s}!9X?H8P;+_J0i~Yh)7Fj)a_OWE8S-9TU9<9<c#SD40^KujiH~}aClfhc1_KpNW
zvg^wn{7ih?LZ*MpMD+T*iVC@#qAxaq?^@~ZY8$raeKsmXjXY!K;zk5-AZ8x>(d#1q
z#-H!qO8rWv5Pnp#y;6};568mq&*|FxUB!e!rwd$JLp%9HE3>ZxvJO~F$bJa(LwKYy
zgbC?l2mpf3+1-TZ9H%hAlf8@gyOq_QT<139yW9ZjD&c=Xt+C6*keg<KjCM8sbEbsZ
z!k_2$pid*yxiEm`BVs{#zso$SWI<_)usSf-y=IN(%f2R!wW1mbp|nP3{2IZ#TPrmN
zJd8erDz+jXBi621OGr(|)P%VVH+d!??^g!mLN1b20*w+5vPjlp4k_yE5p=4~S8|Jq
z5XpufKGA=5V+90-elDO)3o;czT|hEJjQQ;_9yF{Dv#gNN+FPh=CshdnMS~R=VgoA6
zFrgshD;Xslsm~R<4cgKF{OFGtr{h1r`}NC*@Big!G*owM0)PdeiS5Yg_6j=Xy}*`%
zq?emyzUo*mJw<tCS|046T5QBk&4Y&jEM`y-qL6=(wf5b;=vCQbf-JvW<(LseeGCMS
z2@zhMESF(h`b>)HER_q9CPj|rj!-WI6iL1Mfc)&czR0ljHH??s#u|$dAHf|0DktM?
zBj;22ziir8csPb$1Ys`cd67!IcCrpCBXI8e6feD!(+8&yz8s(aas1#<V?PMS^j2eh
ztFeDQzwz3S{Utt&#ljg}b8cO7j;g&R4%Eqz-P|+kEHdXJG+_nNgD``()q(x@3?Ks;
zpFn@7qU~tZMKYJ=<Au)rG4iWEQ80Br7O+hNKj?1Fwe(_q|1qE)Hg<DrX`tjBU+?s_
znegmkf!P!sTYndj8ihTRkO!A;zrp@KOk{rx*2qZH1KctgVFAss-sH2Sg!Nf%>G`hV
z4zjps)kbkG^4q>uAG;P<XhwLfa!iPOJ!dh+@jn-`aDUnERecd=xntMqF0<c{q6>e1
zIa?)J?re+OeR-U2C?$t=EMP;<3kkZNm);tKs)QZEp9a03^8R&d0iFJ&e;x3I^2vXH
zzzQPzQy)*Z8}^mymfKlbU#Jypb{tl=K#yV*UwdyX%hOOD&#E)8vzX~tQ4=+#qIH|W
zn|_!jmyKUrvc#>1yqSq_sgk@;VzemEx)B|PS?&;TbOM&FPwELR=AO|G-jT4YSIYo7
zUOSt(f?5x=-qrQ=o7)|L_ZrW)u6cj=wuY=Zv4~eX7cFJtoDFLAG(^YNXv%CRT&m`X
z#}xa>qE`-0=MoExqvUcoLnZga=tC$}byJZ>CDNo`%b&Hdn-(SnxULh<F6!FKR(6`j
z$Ex5d3nkY2E9+4gCCTgrYPhG#V5M{KVnh^a)M;2S(BG$SWe{kOy^k)&M{R$1_pas}
zOy><}$_k})I-X+5c`G6$htXQ5OBo1NI4zC=iH3hGHuGc+?juu`elii?Bq_kIjqhOz
z*m~pV;Y9>Dwz}O<M&hDC->SgcD(<w*b!PL(2Y+mqz<>!?gif=SzmXzH!$pqeV15B!
zvSS$IB1!V`JoU4cKr}Xy(~o~eMxHT&_hyI%2V=^cO%%?<Tr2_Q{bZsx^JWtzsZ@3J
zch+!oXt?!&{W&`d<{A2;3rV*DKJd*-3I#7kuraD!d&-3tNLje`3n>HGO7yma1AhCM
zwQnYh3_#M<s6m*@IhOtrW{f=)7J7?g_0?BjVfR3Bv87i^3ntTg-G6^qEO}5@&Gvpw
zF6cj{+%3BjzEbMm#K*88_?nubVFMnVo@xv85izwN#<bqY9?*|B0!~?PfYB52m#^@m
zO&G@*p|}<*baOI-F*p7)j2U*0Q3RP|3HJ_eK0kZ)<n@y`XTnoL!V|}f0=&dy)Bq=z
z(11Y!>_qs;Jm#Jmf{lMLo@0eCi64g`gtaqf<yhCj`7P%;2l%B}UQ-7d4ZV24PM%%I
zNoXKT5A5W9wdQ-RgWfoY1;IFn|8pS)y(oq_fOdX3`>!`ZWKtvx@mA>=rk)d(AUYD)
zesl@H<SVHLq-!kF0(zD=E5FDHpAsqQtFKb&&sY9M7$JHs#7Td)(7hQRh%->*9jO;O
zQjY}*#dk-Ns+fN&vK-2jeMqy0nqNS>{K1a;Ri+2<k6|VjMHFo{0u_iTsEo!ppNQvi
zAi)lTP*1WDo<$K1=cw0uAhDF0YhY{CN`{<;!{N~U)S^RkRh27@rN}E^`8+GNTy0u}
z+Ha+)^^460G4p?QF~5|1XVVO5ib{Rb2OLnaCScG#O}S<%*RHX)(rp9V*GvE1wQvW*
zalD|x>JqBHNiFh8-T*4;K^nIW>&Vo<p}j59(tM8*8i9m5HoP9xvNqis5RR8c<X2I^
zS4okQzY@)uYbmkG!8(Zv2K?v3$13cRINC}-ZLedlYc_vLTdopdnI=q#AHa=&N#YX3
z+S@lzojL@lSHTdz8i-0afo?Dxou4;=EvRCJJ_;R3|K5+oh0JmY)q!yRRl`{UxY)Ub
zX!((bA6+Hz!?$N|_^XW%=f5M2_fIqXVg@8K#QJj~G0W`k8>CisQu9@HOv(oXFe!KK
zQqF7BH@Sa(T95Bk(a{-6uDFY>t$BbLRYqJeOj18Ir80{9ktyYkKhIrGn(9AvJv9Q;
zoAkQ2yn?n4yF}{M`h!Zz4OmbL=J%DqEO{l%msY%U#B~mKt{$a`_j<uR_2+Vr5n6F(
ztwMCzHWX<1EG6mkj5C%pyNt#hKw%9BqR{F;8sLAzOfm?yRedCmXt9Z`Xd$LJu_>g;
zh2Z{)1LcfjG;-n3(<B1}oB$QoE>4cr;OWALoUtP<X8D)gUuM*vLVvG_iQW>YSC+vL
z$$MIDzS}2@Yu$Q{JXVrej|mU>Px#J;LMyX3Gqz^v(!CX{>iwv?^7TcB+h8>p;j#cH
zi%EZ;;fq3<(OG=W`f0=sEP>Vue=R8B<O92dEm&ij?YaThVzq6;w=(}Gk~04e>s%c-
zVF7oHSN1Kt&rCtuD{e50`K=_UCH_3degfd|Ofo>*vZerez5$^0VG>`{;_C(M+Iwpq
z{zd~j5<v5^YEl|Z+0$PwSiARiI^TfLJ9~fBhQc?5%vINFcM6A1@dZHLN7CxNP@-ue
zZ{{-H<TgE%yB{Sw5jQDr!xpzk<CdTa4ZyzRepq+3ikdKqcat;C$rJtCz>0vx4Y9|<
zpM$fePX0-1GXiZCVufcT5rqpm-_9e+(ZrEpbO+sdk@t$XanDV{wd~p@G7VnKpLT!V
zDw}t7wc7hBDY9`|9l2)B*Lh2iV)5AMc5MG0?fLry?D;)R;VKPRHftY^si+MlIEN=i
zP^91lR5ps)JCVfLbO`AlOc%geDarc-kf}D+Y@+GVqLtOSJ<6T_no=o6r*5cB2WdBR
zmrs@3OF1R3S|Y(<XUUQ@uOT-6HcEf|K==!2Q-ynpqQ<hAII{JN{~@-tWSu_OaBBl~
z`8cfH`SIuwKsTo7F}mpi=hM%S0U@~2s!Q|>i3_<3<DjN~swUT=RRun8uu8wWKgAnw
zSFOK<M;u7E<5*(^I}#VtPo>$IWYJ>gl6Eg;?2jy$(xu#vc)!-thsu;i5tV-+`9|DE
zM41D|K(Hf_hcpM2`A=`^w&h9sMy@w_ZW_MxNjlCece`$>dG77*EVG)PrpP47^<1G0
zHy<!HXHLY~`a%Y9j*sxB##1PUlKBZ^>_#QBVuRp6!OUlR0&xH~O}vBvYl+k#IbaJB
zxe$E^cS;LSN$EfJHxy(HhZ27R+&y6P;qr5OuS4!SPefq11neL92*R8kI2A!MFQ7UL
zs%o%`Ol^;0VraktpJ6kLSYIHlWz<ihJr&r{T)QEnFusINj%IK!Z`*M@-S+QXTGIO&
z$)6ugTR6Rmub#Yl`kjL$*R~VpguQPw?g1HOH#hEp4ntLh)3tx2^2vXc<K3w=s>AzO
z>ZG@$6R~p8sV37op8_f>?+|Q}N_a7qEKt)|p8fhB9tJGIG=d#WWtLIM-zzCYZ$k6s
zCuP{AQl&vn*YnM6<IgW4HG+J&;{3ZOFJ6crUcRBE1j-;l2APQSm7mH?HI=N`dsODE
zUPWaVG1Jj4$z>?9fv0~Agok#cCy?MD3l!Azxy)#Iox_kO*9z>N6g4MS(jv_=nct}t
z#`IH*fMSZ`Re1R2xr;G2Wi?Va%9v~0D2|@`nyy#m*Fw4X9mYABcz-0qILtvn3%{a0
zL3#S5K1aeYf-t9am$F!A%?h>iu>V90*^1INWnOH?o5+vtY@B~%55J$SlfVZR;*EsI
zf}OBl;EO<RqGY?KMw@;Rf`b{p-=s;hm@WCLw1_W~<Z=dk=ADR5ROl&lwoI1GjrZ8J
zcU}AGWme)vLB+raWV$<~?pJ=1$+BPrn|D|8E^DZ%GNGp%cucR4x0dVNA(<;(USNDo
zEZv8aah7<ZZ?u0sq14?(E;{7z2nAqL<N_<b!Kw-Kj0e3v;Y=Q)Q~-OZjXaAnFWz$(
z&a?=W<6OjmS>bEToLQGO7~ClQz~AID-H~Qh=x`_6eJ!(MeFwyw;&X11dg(>>CSRH-
z(l2geuqPRR?3Bvy`zesBEoPH+4??X4&W6g^0dch36S053u_Y~PY$irb67nYENs%Yx
zOaiVA(GiA9N%z{?m=b{f+&p3;{thX$kh}@M#K<A_8>t^Wo1(aUl%`8qi8{BOYy*FN
z5iW}at9{f6o;ZGZ`sWid_fv#W#-aQxKa9}BU*Rt5+eaP>4^fw~SLY*fYfQKw-R~fi
zZ;R3$1@eE+q<&a=Tqbsw%%5rgw?p&K5YDIH4taL=;_S`Y9+t?VOpt~il4{OEVH531
z`!tM`EzKA7*&^zA_~7)R0YcMb02&%k9jQwZ?L&1nV5F&wk?Lh|2lfq3NiFUG+lJTg
zQ?PAH<lipxov6QE=pRVh-yP|<*f>P&pT&No*tdUq92>UMO5Qy`--)RNfRyU}4|HZt
zi})Z)LMMbjXz0&t(9(4xMFDsWY2B|lAeWaf{i2Dbu*O9AkXJW`Qc@uNR@LIJNFETS
z6XK%yJ>?H$G&xD3RdPcs<U7zAX%YXBTn{-17x8dKAzm`%sQ8cbmp`EUnWEpqgOWlR
z8S;N}DYxHK<OH5i_*tZK4Al&PFi9?13vzUgXfj9kFh|}AMsA^VYqB8A7{mq!dac+(
zn8g3j7aBd4QpFG{)o0{halJ~wN0$a+?5A7Iw8RqsFrKG`C>aTal!bEs80VRR-#N@y
zkWOV!S`{RtfZ3!8%1DBHMu%^ZKz)Cbi+O(}{Zvf~J<O9YK7hMR%Zqxp?M~+@7h&O`
zRX?1pIC7O0mM;FRd3!YPhZTx<<D&p1*2C*w9QLs4x6wJFaAaFTe00H~*^1t7cdh$P
z6mGJLsK<;93hjCfkL!W3j}ukoo)+<xYUD)Z$3ga3Fy)O|-<a~9k;pcHEhDeO0O)^W
z#8C1OPF5LR;YC!*-$UI|#CcMHF)5CJk!d34em3_5K$KBP6#VvKrt@{Vh=@`;VM@eg
zRD85aqU|D#BEq?Xtxci=^E<^85hTS$B*#2t%8aL(z6stVCO$*nKRr354dTHKUfE7C
z>8oL8*5)pwk|hp3l(utY&mju$qvL<h@|n{PQGZr?4NA|*B;?SmauQ*aa4N}%krD<c
zA6x;tvK8)4DV^nD%1;e_2MSO<s*}ysMTciKH8SV^BWVoKgn*_5Ckn`A1!R8A0rMIy
z6Yr5&H0ez|HW{h}{5&96kJZG8PArCSXMXODxD*y*5}DGk=F~P3Puevrk!^pqa1&E{
zSnGDFQBZnu5|7nV9n&<YLFzB^6Z^fCGHg<UagxsrAA&f5aiP6NxQwSoOrURJ&^yQi
zj(s@9!;?=lX{W}=2UC&GOuV<6{8)IntTOA|yo>5=7{yU{-h$HXQ*#wrVu_I&8`pW|
zmeo}`zvp18>R{<S-6T#y<PLxGh6@f)+6_rS12mIIcX?yBebkxB(ouCIqFYb#h&43@
zN4*ecK2Ja;r9~Xm(Q4_3x2un6>5YRg%rhA+z-|l!RO~5M3V;<1P|Sdz7W$F+-~aFb
zg2ZG$B#1fdmqnOnxj2@S<wRVCKE);hta3i4t~l1k<GH_~!!78Ik+^?eg>&%Bu0wRM
z>gCG)bSd)_5iY9B3Yeq7fATT-xrol}-&r;w%4xiuhB3aFJzwTmbL_N!Lj-jQzrcJT
z2iCF@V3U+OXYwj(b3SDSgS5JO;eU3eUdo&~kU~FHqRhuD=^E2(_S4_>K^)b0{l>f1
z;#zckJW9NhV16JSez<>p@-D*Wl*d-O#@`Q3)+PzP=16hT-wkKVvK7^>s}<D%1u1GO
zd1RH!4M0h*{kZTW3_zlL7WpL12kLH8mK5>RYRLFrUDZ0OXIi~bF$#9R1DoQDEKfFC
zkwN4!Ndc93Brc`g5O{083ghJ$u<RqKZ_C3N&~{*1NUJGT&7&eKPq2(Jrs+c=2!bC{
zMJkZ(D%@yeBg~20TXschRo?Vt<(Jrm0v~^E_>|ogYm->~z>2k+b$Y05(_7c7&p6Gl
zm8PHRq{%}P^|Q0{H?QA5ee?WpXD|M{H$MP-K!m@wPt~5KeulX_hIA>bRqHthVWGaI
zVikgh+m2MXX2SlJDS%N$$p!zTfT=(|60jkBo=c8jLKl&kg+4!p-Xp`an$f82{)I0&
z2uj(1Gp2AC&f;TDb;>uqPOhr8zB2=b0(H5dWBn)+mvW1_FlmTA6q2g@3KIsXV)7c|
zu^6;TO2Dt;xG5gX_0Sm<6k8w>+f7CJpG?GaPSF9~B4Ix$>m#Ni)sgj4xmc3~1Nh#@
ziwK+IB2r`~UY~vQ_WbM_p|Pt};^R1B*)yhpEURm{6dx9VH4sVl#1k^Vc%75QI8Pzn
ziV6TBLrQPiU{cWAZW~R!uWBESxzw_ACup{$ew-0Pf*-*?j+1m8CusQSh;}TSyN5ic
zjX}B`hjAcpL@xa_KpP@MPsBwLMgbZ{R=F<5I%FV<4Z|QY(?HMTiFoz;?ELKY-_Fi|
zYqs7oK;aWemcqfBAxlpz2rTAfY%z9%X4^bUGB8w?ovGG^7fc2Kj87s4rcH(km{pI!
zM3aiI;V=h?{B^!SVd2w$T(4v*O>RWA1w)p#2^q{_aiwx2{ahJbQ#QcHlsjOVUtKu>
zRWnSNm`2ja1_qP_3oXFKlPY;v?K^CL3=U~LRogI-3%`i+v9e?pP@W!uFPQNKGg|+d
zh038~wd5?Lw253L|NZt;7b@BChslD!Z7cI*Qpull7zX7qoEd@DV7`8lVOtvU`?BB?
z8<|$l|6@#53Y0x7jx)*W!&O7`Q^|ICj*a6>5Ip`ePBKWT-VI8v>V*nw10JS-I=qbu
z&EpON+yM@T1`4p=YM(@VQ~=N(4>gd6T7xeb^#x#V5D&WgC1?CW^Mny3fu}HQUG0Gh
z*dqfQJt`H5FjzA7Yzr6RoM08LT~M!CY3B7vu@LSC%f|~z)J?pqU)B~%0OshYh&2``
zY-Eh7S%XZm^WHYg<r+guWbTfCZJ;ttCjTToDrNRc(!IE=?p+zeTRUJwe;lm!IWPSq
zF9aUS86{Bk0|Ml_us{=pvl|NTVh3b1gMK>%nVY3<1!Yx)!7V~=+bH#Fk#<M8{dD%H
z4fvMeu$C=)-QE_)zSStyHTc_G+_inc6L;jP&-jUb_=%lB@wZ0G6-5hw#g9-IiQsYT
zBBv9LBaR~3Y5_Pb(Z^F<MB!YkYp8X~p)?Xo1QYJY!NmQTl+0M+bz_^;OBvs?*6Bj-
zezJk8ML%){?Di|yAF>715ZW&{N>y+1JeO;yen~xzN}Zb;VdKeL?M{TS|JsSER$qBq
z;bRyOx<BkUz7BRO_BG;vID0J@QF6U2SS>ed>QIkr2ZoZ-^jGy~rwY^?JXG_k8(+(-
zP+kv~7s^1XZUDF?LwOChNJ711)i1L!AUD2VK--ZmZ{|@ENEK5V!=_jn3*2kUzXtD0
zhKK~(mgYVHx3q->QThyLb;d`}vl!~hp&<IHX-D4`@W!pJoL{pOsno-ap{>0Ga4Aot
z^mv-!*GaIKe~AJbe<f)?jzVyuMadis$th-_j`L<U1gr*~;goemL{ze**nPg^u2(ms
zb^p(9D9U(?6fk_>)uj4%T`QiQ_Fg@uqnf;l3R>i~8cp~hIIuBl^PVdaz~_3R7ELBb
zCfxSUgMul)pQ|lUd&I|N5|m%*Q!)w$5E~i?L|ttHCsWbOe=w~@@GW1`-BZ~)PG)Gs
zn3`;<yi<0I-Di1eTN=)O$mXg0vPpR_ev`~n>IB!Uni(F(<UFYO_$E!(38s8jIVeOS
zoo^vA#X1bWdiLs-ISk%8YYp<FH?vif@BFh^ze}-B!HtCd2sOWdv#=ilh*4DFS!E^t
zG{2BOWuS0Ce{A1Qsm@eMb;#wH-r0csmA-MoV0gw?4oPLWWeV=n8hxb7H>;(<@?{E0
zHZ+}9h1z`&av^p#X=(<iM!p;Rf32V>n&q@rXh!`}lZ`4Z&@`V3^g=VuBSM&;^GLT%
z`sXsbHS&id!|`Vx_^tDRvR1k|;R^&0viYINRHq2|e?cX9QeqprnkhpMzqW2$`&)4&
zey^TtRiJZSt4hT6A=6W)Jj7#8a>OK6A~~@xpiQZt&sUs{X}j9ZBfrS(2QpuZw;a31
zw^fxtNh-W3Stdn}$@7q$DLIccy^`rT3j+zYL-3-I7il_X(4txHwcF<W@09pCJmYK0
z=ITb#e{-?DC!?V<qUukrjJ=1?jBx#gZ`mm*s6QIV$aB;l<(K&y2>TG*Nvdgl0pq#5
zL}^MmiM@8UoXFYwj5d$hAV-_Sc*Cp%ML1A)CfA!J$JDO!!EEeb6QU;?0JzGEx*8?v
zZPU`XveWx<o*TfF!ACXQI;c29roU#T=ioJYe<wIgqeB30*@L7SMmq#47$xZkjY7jH
z5PWI&yH<|*oFFtt^+?Hhm>k4kP?JXyBv{np6YbSBD0$iNODM_kZ=0T86~pQ2)!RFy
zr*a}hKRvuE%6h7jJm5l=Zr-)KCCyh9#@mNFaZXenljW)O*JCQ2TKk*FlyirUDg24B
ze<;^7U8;mT$cr6cr(rI~*I}F)MCjY5(5G0OQ(mw)GF^wUAH6Q(gPesNs59qBLhaR<
z3Wl;_#A;2N-sz6$w5(mvZu~h^g+m@nO~uxxI81TlElsN1dE8xC<4K;Z!?_<tTQ20%
zy1B|2h{Zh;YAZE7E0t_vnWPLiIaeSSfAN^h<E+5@M5qPKG0&Qck!;ui9^|oII*7B<
zE?!Px4Z;QTLtZ)Cs5&Qz*#Z)JwIU1h<f8Cy+`+0Jg{%8Ft6bmT-$-}7P`=duWJ2_6
zLgA;CF{mG`5u-6+N~!+)AUU_XC5IuPms2=@JLu=)=$tXmO{M|VSoqmCp0Cm*e@==l
z+U|?#eXINDh6Ll5$LYG0uKBkgu=hptzIGPj><``kxevrg(FdaAw9wy9@9i+z*V<I6
zVoX64RL1!mj?is35f@ZVf69P^H4~_bz1?Io?KHBQC2Ma6af<>g@Of@Mn{=iZ=D=?v
zf6kuBFkVJhE3ryp&TR-nv!`8cQ)}PuC=Wl1-Q6iq{5E&l-rja;dUX5zylX31H<tc*
z+Q9O)Wl##MV_!#$?Au_uog1AG<U02a7+Mgt??$vz{jG0`BWvv5Jl2snKBC64>SEzn
zmtu|rECH&QkB$N>e`YevaEMQ!tCq%VJ#=@iL-xW_D@wQs$2##6vXGKUo;((rX|`F$
zmNWUlc(4~)vd95DYa=#kxDF90!Jx~d*P7wzGOOa$hJR>l=2B_WNzFVD(Z1P@+ji>x
z<IHhGI*07bb*6X7KAd+eZG0N!+UF)dchkh@<CFmn%`!fye;n8eHul4Tl<aK!w6OiH
zpukE9Pa;ZGD;lf@{bY#GPI%W31M7Ngkghgn>ysf^tQbyc1gr$fp>V(2Fe^*rxZqYQ
zadaDSogWJ5bVteP1r;&jX<)#e<lwW~a39nbD&psWxa$wHg5Yd3{WUFON&&6j--{#D
z=Wf4~QmoQ<e{I7;sBcucvMp7<mX0rkwKiNd;ErY^{ttU^yWO^tEQ;p0o}z=vNyuz|
zN&d>FM)sCvCDDvyc}sF;&vCRUh-gWOK!5{)k{Ow2-G{g@ai8P9$$gT$s;axu4KzTI
zqGUTGuUQijXmnRsS65Y6*M~T|z*lfb2kR>`1LEq!f98UCS?74ktT-lc&?gOe+YC9k
zicLkLnvW=bR{EUqbA19!hp=ww6Dhm;zFR^qQqQ6xCwTv@_2LdMi?Jq?dcEH<HD>WD
z1Q7hSY6@LEOD~EEjDU@TjQ_e}axK%wikzHMY-u3NoETY(!4xCh<Mzl6U2tv05@H9E
zXSXS*e;-`0kHPst<Z;qtakt;@-Hjz2b+aRX!~;L9>%lEFx^8NIb{8S*+G^`c);yvO
z;KU+wiuofT+9x8T82!o^3oP3?k8|Hgu?HzEGm3YUAvv)n!+C_B_~DSx1CZQZ=d}U^
zC#gFc3qO(!p3nu-qOAf(ta(6zUs_N-+!q=Ce=jL_H%#Mct!U~Iudf6Y;Hrj=G#=3B
zbOJq%A~2B@0D*sJegM9ZwvHBpX+B)#JLtV6h8A<eNf0>4Hb^a$y}*Y#YOnugj&AFI
zXnm*)9UT=UUI0S;%NL9jhc*RH9YwHYc*T(_`HseY{P29fXkIOou!62*O%OMxffX>q
zf8RJa_`?JRo(KXjqHzITdZqafTFe0saJM<{4k@q`ED;zq8YM|v^JnBk2+tuY%Fa0V
zM9yN)ggj=?6=P%XmKOZfSGg6;P2Gg2hXi%q;4S*7n;2hZl7C_0U_xO!klsp-d#ils
z<vIx1vvm?HfYuPKR+PGa$UWtLe>zRUe=dboJ$8kYBs{<}dh))RtPUzK1qv7#YFR&d
zg0kka9a7lLa;w)(jITc%{q4>)5i9OiNpn1IH}rY7gy?JH9bx9;D;A<HIxqq~-n@JL
zy6gEdB;|ov0-`!7#RCSWIGUVau!|_<NxF1(wZ&-cfNC1mj(ExuS!{g%Ik5_Pf7VN5
z|NNX&5DmhrPGIwR2(75Bf|+H^B**CcS)5@M4*mMhOU30eJGjLHtvKVx8INNwO+s{T
z>$T?TPnPT(G~t1m@F1ITG5Lmgv*@6Tpz4rlU1Nv>h7O*D4b)JD?7dSJrnoZ*9ABlH
zCKi?FWTNDs&bdC}9`XO+i;BkVf0O%@hgpHSc`E;T?E0au<DUo7DP%3yt^V49W}dC0
zh8bd2(pbxYPI?xs&h28riaMUu;aCuzLvSYPaBy*X=7)Z&BrhTIZmI7m8ZStEsrurM
zX|HG>+jz2od2Ga8xOU64Y(bN`lb(}CsSD9hv@!!+k;0+b5%$ypF^~b=e+QK{6-|Vi
zUfC3`n&)(b>i^t9N?Kw6ws*M$uerTSMFGaw>)YG9sny{Q{sIW9xA~oJ;G<}KyFL7p
zYzo=w3pg<3)VZ3n3kd6uMF}pvdY0SQ2a`G$Us~Q#bKW)<hw)#jL@7kUCkq<LMRn75
zqJ8^0N|oE1%VR&eGz?Ese>@_gbWQn&m~-KuUwo$02-Zqp<lE6R_19K~Z7(2B9|?eb
zJ+x%{<e8$ENEU@P(y31Jw@z|g*Aj&Cc)7El{|8^)L2sq!2+Q3lKO3k+f&T{|NWk-I
zeYR9Nr6syvN~O>GyKmiHooY=ktI=X+pZH{&`tnCvqQ1}b9IH9wf86>gYoXk-v+P2&
zD_QSi5Z0i0Wne6nk^6Le!G4bY>^25u8`%Z#vct)#@<FMqfS_AiJF$Fu*XjqR9$VPu
z3H|pL{z^Kg6wq{tFY<JL2dcwaVQ5%3y8=<>ZX!JqBUBmAFVa5dq@heRh)&^UXe?)k
z{fJj<<dZA0e$rwme-f7`nDXL;kaW^vhkO|Gl;Tmyg_WE*sS?-;5{~dmTtLyVQkvep
zBBNjddCOCG_eTFY@T)wr3&Sp%Zql~=uYipNdCl>$Erw1141IslS5`|ofP8HqNwkuZ
z>@;-FA&ZJk?4XZ@YN*Gd$PXm^NK-x<r_ww79#;O9p8y}7f4ll+V!zh%cRd<q<({dT
zpv$quJJB9u?j}*V7+aj(&Wp2pdn}dw%^-F6EX7j|EDsfiT53mGhS>|R+`v~A$LegQ
zyWX1xE}yt(Je@-A-z(mSQ{K=&4W<GeSb<9$y2HrhG(o3$nWX51h~k9N>Q{00d)Upp
zAI3oxb2|3Ef1C_2d2KTZr%#o+<ka~3ehei(?XIf*WQ2dzZ=BSy<%g5Nh2y^AYB)(F
zw3tMbm=wh+T2eT_MDLX-Owpq9uZc^!xtTNNZhVh!iP~Xdp7-M5k0|8&5$4^|&f>0#
zjD4uTTpt!%uMZ0>*oS)P`A`c#E7wMC8*v2*+2{l%e|yh32?l&IkB1QT3Eob0<%i=6
zml|2*lOpdibF4`1Dm-rzo_6#!`bR1$J_GMEh}arO<4J(|DftIXlufZWX{2u-=7(At
zZW-wVxj7eLfHc7+nBJ1??v`xM3{aWR<?8S*%rSS@#^P?59qj&N@6D?|yT0HdbJm@%
z1G911JocMc?1Z2=f!MW#V|LVb%rQo43}x=u+1L+5?wLJ`@>TThcM01+*!yYk&Gu`S
zgzh-Gh*H*&e;x9F8MkAX0xto7dib~Czp*>Kbk8{)sMGEcwFW#Bw`o^(yiS_jc8p%H
z_w?~&W_#Z2_14$dd+e)6PoDPH*PlM^J!W6^)*nCVJz-z<?gIgnBz5Djdc74)ve)Y|
z_1`b#A7$*O_%_&l>~9IBj~cmxr+?#nFZ$v%y17=Svb^Xs5emaTYJG@*4}xI->;<MI
z@i6o*Yw-S9Gzq8kn&2VhMW2bVb$X~tj2x68E%gq?XR^05xW!I$-(cL)i+*7OLK%9|
zXW?XY%47AEj5hh_q%0MmT3bgUpEvU{nDOHL1jjn^NzDG0-nX<qo^P({hAn*{YAgo<
z>90m$A9HWtqk>K;Cg{xxv9=Pk2hRJ2^Ou{M0wRCpBya|L`|535q_KdkHfijiP9P9w
zt=naXZ(sdS`?Ws=vp{<fD^HyH5K6l}c83?dz0v8dVY@V*4AV(0a;~?9Ji$a7n1}<D
z&2YS-AVPyPJ|3(DJ$BZ*UFhj&H}u-%Hv?*T#4b4>izFZro6W-^c+*7bIQGMog>D>2
z*L{Ds{kLCHTwoF@H=IIO<G=+&0-g_A*v0;shud%W*f|en8QVz95kjFqU}s>U<0tHt
zhy2V>*YNZhjo_GxK5CFA=7I~G$t9m&qi%oA;k?LV7fTYR7cLd_z@+l8Ag5Hj_YAs%
zYLTa4>X>%eb~sHhpg*um!#yGQ@T8o=>2ZGy6-J;E3cK=M?8^^5{sH<({PWNS?YqUU
zFMLS5ldy~EnqBeGi(;mDcfuMcAKINx=cI{~<8Z!#@g&sPS?W$PAf+t=QsiR1Mw^Wv
zstS&y2-7X55j%~!dx<bzxxs|D1AfH=Hk=LvsC$@Ra~?tuoi2jhNfXwHWw{W{Umt&k
z=+Jw?gE5a2g09n5FYpUm@`Od$7ga}5goea*I!UR-BjAsk!}Vu2EMzPaRXh;Tq}f@U
zrvl{_pas>RxysL6)yJavl&L+HN{>b5u`4__b;qvk*i;?6qBB>`u_-wVs5tW!oGSI^
z-&nbk@;~KC+6{tH`@#>?qys-!Bm95o%KvB2p04NR|Dz|pXAkoK%as5A2-&HdKuH4<
zluih->-3~c`PZCH*)UZ_u&EjRb~aT%$k%V!0eG(b;)ebiG@pqNIvrhcl}tYC`$nW$
zksl_I$1C^fz`f4*M=kXJVD?8@))pc7lxY6j;U)@2OiH0irC>_MhB>0on8SbjW0Y}k
zB9G%7+kltxm<j{C9wfm7VBHX|&@c;|Nc#rTnC-Yp$|CSmb5ll>ZBb$~!A9X*m<n1@
z!H+FXI%_CM3MkpKVZ==`HkyNbb4_&g<KFJ;SA(7Hx7#oGUhf_4?H&&H4+cN(y*}DK
z7#!@fE!M?CJA<J+Cc~r8laGItG@$Emie7eJ@9n-h8XWEaefQ1a*WUWzVE1pkJ4bu_
zZ$uwP!ON@OZ=H1n4FCjPF6-&%f4)4}do_5w4VMF22N%=R*!Kow7tHK<TcUE}b>+9O
zcmHQ^XZ!Ww$L-gzUvBUGU3?nw51@X0{H=Sn{#%!F8vb^wzS{rCo85l{0s79ng9Dg|
z!pA>FACXqTQ^div6-K5R_=iUayW77Ez^?ksZiYfK_ip_)bVvNT8u{1t!Qsx&yT5FU
zRsukjhgqY&-G2;r_J4W1y>lemUHSZa3+&eJFzs%xt({Fmk=4i#J@RAlqflhfL-!CV
z5}W<pCcKfV2~(|$wA6orejAOE_}ye%&zbzu@jbS+wZ*i-ny3&Vqv%AJ85k{g!as~D
z->ck%5{_?fv<_w`P0|Lif}VN-Qaqch&=o`=XEsW1hE1g|+}NS&h%1E_JJEpX_}+}P
zP>&A-aNBU@-Gd!C*$n~-?5}}2Fhm5qibnSQm=Dv0y?*^m0y=+p_i9}%IGXIKrj@?c
zoEB>!!tE<%uDCv=(^P7w8hxu2Yx<fYw`(Z0=v3Nb`Vex?gs9BvHk*`F>{q|Wp^Jez
zEQlJFj|=w+a4NjMnCj>pxfGeyAYR3~tjNcj&KhIQ&9zx`Q!d&$7o+?ll0@9s(iH~2
zs|73!bg#=eXY_yS#k4OMHF3QwIAy@?u3(J}*>#(ro%us_(uH)S5gIH+!nY-sNW;e}
zmd0f6Vs*%DXW%8}LBKF&X~Nu7D1IX+DKMnw=2Q%4kxq*YDT)INN0G{b4Gt@Ad|!0X
zapFZsI}vt3mgz8%bA`!zq0Mr=6U6iS7eSjQWs#mBZoYqiM(u-TA@pL8B&<R&LETU&
zAK>#AfDgf96lVeAwzOB=xHgqb>{iS8CXs+bgI1g>JY@S04yIxg&jrh(&DDhpuI5K0
zE>aEWmjKzd@JGntE%Fu$6u?3L8;C}15+P4C>kUj0EQk|7x!{Qi3dCydz0SIf5SSww
zf^0CmSeJjEOxp4jB!aHD^e!ql1$}02C%r2n<Rvtg4daTTrEO=bLuGh?uo=!K>s%X_
z|7+p~4LBD;j8FDWOZm7I$wcq^#S7**t@--9N^;iGzs3oTV~*ZzV$EbOv=Z_x4vvp2
z4?lur%K)JA)0mQ7Cl>u|q@c<OwCes});{UN*7SecS=j~R+sirw%(?%0QoR3pw*F}S
z!Txg}|4b{(j#}|USn$j)(k;*ennk+be~)I7^djb*4KE_d^$)H-vKV?4vv+%J><=$_
z%pxdFo`~|J;9H~@`Tf2t4e<!e8=$}(I6K%s+Y*im%06+4{&5av-g7q1m!3OKG(+@^
zeJp?Z+zkS!>iuw%q|qqfJ$g{-c4bIhnQw!>WP>=0(!^$-R$t8sqYz~dJ6QznIOIST
zMyTQXLnzqmPKC3UNc*3VkE9R&U!fOW>-dzMmssqp-5<B#y#|eO2RP5qdxuB+2mc(r
z+WzMu+hUJ;2*Miso*nQc3ZN_q3TjWRE?j?;kT>Q@Zgozy1o=oJBH9f4YWNs`!-i0~
zl#cUn-yMOYa)GemW{OI@fa@h6r=2y1@SKFvHTsSE;qPb&XyGjnG|f`4CDSD3BQ^}8
z;iV|2EQk+$FUK(leGqzs#!zJ@!0S7sKr+1AdA-+#t3kZ|Llz5e%CW>HTIWEEmJ@%(
z+c-3cg0_HHOIUIuj0hIy#r|0;ufilCI2?6J`ly^L65~l$BL>Lhgf%81>Ca8$RuPIl
zkH+a#g%peCzJSb6=*;2{Q>Zviu8TYzMwr<ecB2zU3I#0(E*b^GA<={X2hXqccXa(1
zXEk={S`)L_`B=Y$2WQNM#R;G*fi{0hM6_}M`e}m4#pnz@ya8i)M+zBDW4h7>_|$~p
zE%c{0!ighs;>d^@S;8an1LzxYTG$GjB?yV!#%&q|YrldO!91=t`&gcR%6<KX_<zh3
z|I6M7Rm=Y;PaYTi|DHa1kpEw>|Hn3ojF!>^+GnxPLob-h4Hqjf<DBXs%ENyE^XhgX
z$NmIwQBZZ@9>o;UE=J#Itu&b8VEuvsZ9!kob`WGw7}Y>Wna)m7il1~(bV+@}#;zYr
z--jb$qx^#p7bZz0d{;m^5Eo9Razho8NK^tlb5&3Q$)Of=@&4xZ9=rDcaAU8f<}Av}
zkd}`hO9_LBI^6zcS3=4t{SSX~N1U6`eKJ9at(BV4G6V*9hZl^GPPymF3dqql`c!!C
zv^{dMW|2oC3$YCD<sJ6gzvNV}iAo?P%4vtL!&)E|!G&iMb6mX86S7*AW<o)z0|K%e
z28cqA!dg}5@x$>1Oh>`BJ4HeeWFsR%u#sHvPX4ZNQ7!fpsj+Jebj^QKHMT^BWwVm+
zKxHU>DV5iGitEBkE1L=YtypQTtE^_1I)J5@9BNrL!svQ0iTX+*fL9WK=A{k|6Gqp+
zfa&BFT$GO8IFViG*EO)x(4axB+t@4np8fE2@VM6-^q^K}8tonKA7b~7CSK<}DANzh
z^q*9jzE>q0cdLKKM2CMJ;A?n!jH}yJXLj1E;tW13`$q6s`5AEm+|OGAs~!CH?YG9y
z=d8zG7*G0DENWAS=|;wAn|z9xQxn)I!7Hru(3Wj6Vc`@*il;CG8OfJHh%Y;7?2j7F
z3`*l^UtxwuLFUf3*fzMWbo>PWE3u^ufF{l)>r{IsOu~%@{Az#pu}^Z0K_<KPT+RVs
z<Y9-00=iCsPJ@7C8ZLtt*6?eZ{I}n-#@7V*$B#4t`62Y(YgUkgT!}RiB;BAcU&ys#
zGX@F8nl06U1`=>48ie$bhK9aCrq;#mOK=@D{QpSahzriP<a4)n2CO{)tv~Ip7wo@J
zH`X8g{~!GS$c2CJ!p%nyGwIbPpXVL;a-MrTf|40tB|_M?Jbmg1uUtJic}XqZy%RQa
zJv`X>=(~f?|6NM$nRH#xYipgUO(bJl#W9kxwm3Ud+0enzs2F<9hHf1Dc=$L`m!JbG
zJeQmZ|3au=03LzVAya^hW~`CA$tBz9Y_KleJNf5fXXJmezdUJfN)S-Hqd*KSK*u3;
zn(^?82Ox4my#qj|RLOO8>Yq>iblOHiKS7y~Zo(3P6ZgvX14wbB%_liw{{h)-(s(+6
zv%m?dekWsZJjPJ%6Q!H-k&kt|BiW%UJWFFolf*z2fh&n1VeYvL2Vz+O7}r{MrR4%R
z<sgwzm4OcWzkU$#b2ktrT2CtS&6hBy0v&(taaw-3Cf?C720bdjw#G)U$3!tkMT|nF
z7K>-phnCBiH05C$!z6Hfxqgs<@(gvJ{WFoX1AC15Io5wpI%|eg<Iet@H}WQO{~zMg
zC6{o*8T#SC9l3u*;Q+!m0C{+^X;y=As7d~fp24_APnUd}>k7_4ST(-SoQ>Yb({_LF
zN&C_IQLop>|8;u3-v7pylx<-;fU{ShIcnoGW2nGA<-tIv9du}aLJ~)KDUSnAe%s>P
ztbjc!E$~cMwbq`Hz99T~A>V;4)(pEz2kgK22X{0McxM=mM79R;u{`V#v$W(2VyZ|<
z&+@!OW^R{x8qVC2A578Q09eUS$V?H{wtckovwAF(mN|!*gHEe<mt3a;Ab%u#8HuO_
z55>7n!s>}-Iq39xrBJ5Rg+QS;<YXX2k2cTKskssEXRc75dCq)A&F`uyzuJAhd$e1e
zG}W)Jo+p@VI244Z0`1`7n3Z40XR^k;t0!*1KN7%95R<W2i!IDHtqgDfU~shi%iGu6
zN4s{$hZ_$P;jHEIfteeuE`O^m7SGaoTt(9NnmrcSCcduCI?;Ef7W>5PK~*eN&w5;7
zqXV<%oSmg2EtT>?gVHo!h-6liC`?kSBgTqiNxd3Ho*Q8PH|G=*4fA+#N|^?WGHE;O
zz>cFR9zZHju$&Qx=jmiT7zb`Blka$Z97NL*mDvEpI!}@;L3YSLq<@1X<ztCD9zxmT
zfrLz$4x?Bmw~C|aY;f+TTmxS<8bE&00ks+VNs`sQh$rD`6kQG|IaaoE1aBoul-NQF
zf^jn-s0B$vbh(uKaAPrX2X$h6x0*@n<fa(pO9Hoz;A#Z|rTZjvnV3;qVTp}nNT=mr
z*~H-_Ea8UP@EIkFf`0>j=JY!2ot|J{<ZEctBs1Hp3;CJydLt>&1WL}O&~UIT9KGzL
zIV~8Z*}@b*&CTU|dEEQYtQXClGT%IkkHlWM$C+w_-hRSnXJzv?#4#KX@lvHg?Q@Po
z7MD@7*0Zg`NxF1tXeWupx}s3?d)rarxRr4*qm-+p{Ec1@_kXgEH;?o2F5-?LYq1*^
zU5Y$-EV=Z@W0jN_zqBC<&h!GQ8L~74l8AxR^<Co2T-o_(%PAc9j=mx_VNf{vn4$-3
zhMXv9y8@RN?wDH;b?SNt(Y5l?>vTFc8Zo%N!L@IyP9|)2+=487LgJ{HZ-JXGG4Spr
z4!Xp*$qKt-qJO6;F11cvTcb{N*`gK6g(sNSc+nX7SkgpWwEjf5nwz^K%nUbq`wk^!
zv)OFef3VDAlWh}Yp`|wj-5`my7f279aR=Z=zSaWesA$A-T0k2u>h8u4OiPDl);u9Q
zk$E1A;x=AOr*3@CQ|b=wOd{?UvpCY#9$bpa0}A)_TYvjiQHYS@h;1Xsr)_p-Ew!?;
zBJ)-KI!B0Fhk`|w{hBI&A!&K-sgel4pNZ-^pLJqc5RQFbTAh<2R%$OH`?ajhUXr-y
z&@dBU-w~wWfz7)P<!;grkr@_CtP&#oyFSvu_i|b9c|s*RoS6S>;BnVG<^0TOBe!B-
zFZW`0B!4o90<3{QOb56VN-~K`%mR;CtvWzqfMh|=alS?vX>1XV*i8|`Z)bLQ$`=Ho
zSPuAMln&0cgOQbBgjGh%U|+tXL-&lI^?H`YQbW~Tt;efft<Wx<LNv<@M+b_JrDf7h
z+4sIuK4qjGs2T*8#W{6#Bm;Kcft<+zXOd6vTz^=s_2Me!My|P53uqvg*r11h|33Nu
z@cv(vE2P*la3Wic3qZC1_v1$!&kFbd*#6=E|Ka|h-DsQ~S>Ix}|0ESgG9g3BHKzLA
zUbo#}W@nA{vYW>r+Ux5_8wG3fnI8jV2Y2QHf+a2v0yjwq3Fo1;k9DIDG$q(N8M{+R
z6@Nq(ko#=Ic$i$c8&95s8tQanKIU%Pc={OqlKwS`Qg;w?7p%CL?OzpDp;PmqAnmYN
zGPz`?Q*q-t<o;O7tauQO-G5EEc!heku+O3hf{Qq6Iguz<iZvwZljdWYu--uvgkj~(
z^Co4jNiZ>zZs!q|R{=h((O{;FFBkwb^?wDWXO7$&vRog<G#|+EGu0t0u5^<T&YsZZ
z_6qcs9U5dU2vwTFkyw;v7&e|L(Js8wGR+EI+U#mr={$bo`DrXWi<ZRjo=E`n;nkGC
z!kS`fJh`yU_3*r}HZQF!1r!J}$NT_61og^G0^^k_N?31XZ{oam;U)t(Xc?7-@PDpE
zE=qPXH0?btX<RCxzo>dvkdV+kq05$TI|2*}$dxWl+MS_KX9}KhVkLZV59SRf7V20`
z9-l}Iv=pyM`G>U6zPoXJ&*`HAJNu5!j*aQ@rKhGq%FnN$f0mJjhgHHd!jP`qnfXZ;
z_*8U(ini@2C;HM1lnNgr*S27)Zhyj`KJK%Z6A1U{fPiV37y@^H;p^{EYo}@UA^pPf
zRDcc4_cpvQNLKb8EisRCT?JX)6!0<-4_@MLwB`x3>|3z}kiLN+s7FSXQ!)FVOGyuk
z{et?xng0Q!0NRvI*$>a#s&e^KDIlu-e|sBG9~bgJJbV05|KUFKKTw6BrGN52yrN((
z7DU%juokb!F%Cw?Bx1~F$bAg5NqmoMSGFSG_55@N@7}!H-Fdxzu={FoxU>Iu*OIW{
zA7J)(na8hujDo=^JvU|K=zs-yT6(%2xIuFE*oAw=A+%_mRg{6=XySV+IwqL1Ylyg1
zAu<?Xb7GHH0oPVE+PYyFrGL=f$h{P~S_lGJ%Ln5QvXC6<5sQ+|h$>R!V#p4-5MN*L
zm@^JWH5rJh&g*Pj;sM7@<4G_@qjDIrXzYhr9UHVO71cyxR-oa>Jeab^3E1DxK&GB_
z1$?f!CY2e{o0}QBVHoHOaFiG!ObO=fKDm*hh|(5@m7Aimu)VX{iGPM_BhCmZ^A!$*
zI2H<RX&#UXdS=7P)T>PBp#aIJ>maDgg84;~j-R7zHT$*<PZptioNC(1U{$Pn*H+fd
z1|*uNP16L^ej#WS$9p50@2@=e{GnyK6w$|pIWad0es;#u1*&2qMa*PfqA<<%DScsN
ze(qV807irgifPf7e}A*Pcl7h_L4M0?aoVvFGAaVuGScZ(Wo{5dy;D|ViZ`o_CDT|1
zM{aa7bVCm{5!!tzMEd$6LVSX7p5Qk3JG_%`EZ#$RB18}GCCR*j`JQ;_0mq2Wn4h-5
zoAUYs1Hs`)n(%Y*)Ji(~T`Kgo|7KUqhfj$ksWL2VZr2Y-Sbrx`3S?vs2_H`2M^{N~
z5hv(V(*HbrfCILO$(B=MsF(rC;w%jCWlSbcxaEkDKnnT<$0RO8Eno4#KZVR=oQmEe
zpCeA{vQuB5%(WX_;-*ND1jaG<pd>SAjY$IK|Gr1YMl3Fka4sGPx}s1`Q3wKhp*#T8
zcLX5|5W}5D*MDy8LCwGKF)$12B0yId;W^|$Z!F;Fe(H}1T1Q|valrF8iYQi6fCs&d
zC-FE+pkM%)#m)j()qO~>BMS9T1T5xEv#B98QOMi+Yq@p|nHo?w5?n$D8{pa+qk;J8
z0I`EXuhArtxe;Jy+i!MuA^H#lL@bO4rv-;-6nQ>QOMmWoNcb#qz+sV9n8Y>cgmSJb
z=AOt_?nXp2Ib$ToK1m~rxsk;_i0T1Av3**yWTIFV3~;6z79g(9I4Bizv(Rm*__C>$
zQ%u~{PtK;yR{_r3GLBbnW4QUlofmW3qLASb0~PUGpK6jQg`_fT4D_>?{KJQ)`!Su)
zaF{IQTz}y}<3^%FgyKT4h^SH4OLi?ph+6QGJCzCy#;LT}xqrnW$tg)==tmS)mAZo=
zXh?K-F*cZJI*dY2^)+N4Vl0i5iCd-wD~-79=Dz|zytK&RnMC)&BmjR8h>U^~hkbaq
z4z;UAxmUsb!-&e8Kq=5{VC1Hn)IMSD=ad*S3V(TmWC{mVQ^fcQqmWxod>}2jAtXen
zh~`X`Kqnie0JU^TB>qky(ta3BPzQs1N}-+zcuq9!<s=)a3BX@OAr`E0leQ1lT#@(q
zsC}vE_%sq7UHK8{3%C<tNfdV#Fsa2jh18Th$%qAK^{6<jOvbk6p_pjryF|dEp!2n1
zT7PU3Qk<KIBR;M@VungF9KBP+$$Fkxu7*&y|K{~SAw-FCiI6~(!TE4aEX9<dee^7*
zDL|!{m-|OQGxr0QsgV_efQdCS4vH!{OJf)0iSMNsjQAIoVq@+HQQnn?1}AFh82w;i
z9h)LZKh)ypbxIIjH8g^dK8D+G{wepWj(=y$a>882X|WEF=tps1q<6>-x%-MmlawxO
zFe^e9pbs-02JUE_S3ZmD3ttlFjb!oq>x&4?ETDn{G{lHNPly7M9^zjUpQnKY4fuNO
zdmdM*7T&t#aH-T38D^PFtb;iA6Cu@+@oITw2w2F8Aoz}j-Of~cgSomAN;yMaQh!=f
zrXqFN4(9Snm>1zxDK7?OypZC%k1*m{PE~(!G1(0ZxO=AZooI!r@GfGixvHJHLl~Bn
zALuHG&i!F4b6OV4Ks)9Ezj8%Ts>CLwh+u&%!X)*BD8!9`<%DY`JKL4}dKcvibWOT5
z-Z1s^X9C(ceGB)`9S=0sJAa}=B7b}(m_ccZhmTC1Il+q8w;zNajC*&U|E=8oxBC3A
z8yo8z#r&_29zT7s|9!Ff-=H50^$-Ii_uW^!zwYhqW@i&i9yjPo8dj7U4;dku^4uhU
z#tbQxFY6VoD_NknC7%*&oT#K1p>ldDm^x1|gWO3F4c)-{zRBE}G<nSRW`D{X-7)h!
zM5F@HkjE%1WJ)>E7~y~eWySTA7YKHFN<pYj`Ot+zgVHpI$@3t53yuj;nvZ9h4!|ym
zlVB=F={q>E5qKDW4%yG?jEL%LG8tY_ELa~@vWqD25>)`b4dZI-0)7KB9TBb`It~wG
zj-=uS9d;OHnnh~2(UM#}*nj=+ce{s2pe1*^f|!(sucvtu8TZ_fR3)kskHRoJ-yj^&
zPebS<=2;?3lEtAyIz{LkiT^T*j|YAzUEU(muY@bvc2S|BR=Yp`2muej?$Uf!)kuU2
zQ}CggNl<u)?WHtxP$v3-`n~Rc3v*s6_h2YU7jW;K<HD2ap7Q4fWPdUinfX|rL^H#%
z=2v60__wrA@xhN-_9y_xp2MnMhP_o^6x6>Uc(@_>H@zV!$%d%k5R|4&%&rG&UJa;J
zi1&Xrke@>CYG8qDfg(EccLHVi0XY5JWn;`|S}f*cTp;b@{oG63>OMlBbZLILN(R@Y
zEMpb-8X(_g(pY)J;eVb%`bA+G{VvI_IMip*85(XAOgwn5BphhVDKZJ}#(^&_GuRdI
zl<Y!5oQE;_p#T85Zx8?+SYZ}3`-0SF4KWsSEoAhR!^SiM5huzlz$Eu@P303eNFvF_
z#Hhq6)H>nAz2uGPQ<`rJ_FDZk+G2)vSAUh6bybE!l5CKTE`Mt!4%OW*dlQkCa~4EV
z%rs3k)AEQiGmTJUlte*8+Hhr$m_HSe#{6_ssZeO-x)Am(%6ud(-)P3mQsl|oLzOL2
z4OljZmk6coE}=1@_Of}Ugw?but*E#agPN8^1OMOu^?%FWkgi0=K(uK5WAD}OfmHV7
z;u|2V+et00pMS<I6bMcB+{o&R=p_z8+QZxJqn`(dyHM5YX#W88h3@;`e(N50Go|5h
z9QbGma?^{ppIk^Hz}&526t?l6p~bu?ZHtSFwo;Tlb$8K1>Wu;{%oCn7spfESyG*0F
z!%jN5MZGuzM=Z1nopd@UY#fbAqZ|WY^2F_)=ohz%Zhs`w%xZ$BgxSXv*B@H4Qz6}x
zF%M8}Y`8QcuE;f9H8GwHA+VE*Z9`rh4MMFex&RWFM<P`$8Uxi8%`ossr%((`q>2Ii
z9(qU1nKbhoRUoc`dWXhDRR-eBsc(!-X^T{pP68{|$SrMCC8~tR=oE-)t+kwv-+qga
z*w>JxvVWu3C6XxA2H#?;s5Y=K2?bnjAvAKkz>dNfnEJBQQAtOc>a{bD#*OA?mbxYN
zLwTV;TQgfuk_(zZj{0SbInv<amiytB`{9=R;g;KS%e|u8Z9NwReDqeZX2s5>4Azt-
zY-6VJHM98YDhl<jASm>o3IEN!LSu~cS5_E1H-D;4%h0~T#U^pmV!o0nI019W_x^Fy
z#+Zp*kYG(VmGA(g9FSYLqqr@&brOxZY7adLeUX}XGJ43m!qylF;U`f35L#+_wgV(1
z`G-L@z)XNZ3%9W1r1V`PQXXeoxB(QZ;@U-f$a4Z7zut~{UKNKm&gjclcpy{E*O*kz
zD}URqS=98e3Cxcl#o?tU`QfJ-dOv>5fUWAnMoZa;f|S&Q1IVQf1Vy01vNvd}s5hm%
z^Z*5c*;UgZzX!jQ2fvdCzmo^QlLx<(2fvd$@H<(?-=wCuNtv(7-FTX4s;t;PTcuZE
zG?|V$K7=%q#z1dra#|e{{URc#Fx=#f_<t?kb}ztr@uJM^Oyh;owW=(l1wdX=71cRY
z5y0YhY-UwBaO6c`730ke1&SVOCdH#n?r8UEZgR;zafhDW7fHV6=DC_-QOwMfpgxiO
zr_D>|#v=POrX;K}x!aFiT2Pgx#VN{7G~ubsK-O@Bpe<B}CeEX!Or~NQa1<;kQ-7I+
zV-EWdHQ-6(o15~h+J;!BnSKEWDjjVe<2D_q-%^+Anp47w2<6TZ5SpR)FX7B(x1~$U
zq3S9xbUQl1WqH-iRi(lH%T5S#0FAkqj8oPk+nHZC<a}hAm;K9p5t(|#z)nzD8~1(H
zt0Z>8tVuR}PwE>svxcIAdtdlPw}1KU!9ni}&HqE&Wp#yr>iGXX-gwk|l=uI8{H(X}
z;Q#mUk^kpLq|-SNd9-KxH>C2;O%?=haDFu6ZT}ojb1d+~v^$JqP|V>Z)eWO}p}Zp5
z!>*D(dkLS&gPE)_Iu6I9?;yVj?u*RgzRBK19w&`C8LH-Bi#4l{ZvTD-W`E}G->-H8
zl=5$b$+;i4*smh#!H-fumNRvKzxvGP@FS>(X+n_ik0~{*25$R|8fXhM748h8(xvxP
z?1m}GkwY$ImCWA+&ydl)%Dnij4-YXLP-`uh-U*B73<b05=s*<47xkhnP-t%o!>U(W
znhLE?K60TnWumtzbZ>1`7=I~iHGht4@+uOy$<FUst5DxL4Z;HEGwDp?pt&hN+5Y`%
zqqormg-U(gfMukt5Ad$@d*U>KY;Vx}rV)*?>MP~r_^UMgPeSlO44*gqio8MK(<rXz
z39=~;r0505AhP<ajmVy>-hRJ=BMQHk&^K<tZ-7c2snn9lO7zT<8GjHB_xG!&?vVr)
zM*V;{sP0kK+zK02bJKBuzv`Ghk!e*8LtGBKkZDdJi%`DL78BRnV%%n*T}8g9=cS4+
zvkvGIyxC%ZJKTTMA(;KMY1Tj{h_*trM~S>{36GJwMFUCYU6CY8REr6SFzJ`7?!wRg
zB#oyX$Px|b%WhUip?`bsrx%k`r==<u%U2GY0nuRBk~;h(negOLWD6@{99gnAut5*N
zNk!)0bh3INl+X=xJ(azM`%$RLO$8YCaBQ%I#C#kjei}hadA+6w<_gEeH?lcP{WL%~
zR!@{7L7y4OPlRcPRktF4mPo!#)5NZ!l7t&iDWUOuNEmcXxqsX!g&6AV?)iDl&s~vS
z`i6-NY_wO-<7hG-oK6uB(1kY1W0|!p24m}h93`*|y>7~T=NxK}FelKyNVpphFQ93_
zKY%%mkeEmysohK##Da}?BkPN(B5On^H!|0$tPeVC8ROqD;v(Ri>88956LDIFk0fN`
zIVJ7Vs)tBUjei{qSP4ZS4}p>rnXru73m)BP&S;Wi7H=$1f?Y!4VUf08pLWZjq2m_q
zgHt#0huV_A#NUwAeob*v&9mJ?*n*_BMuV&}2-xo2g!d^ETl?x+o+brV{p6=VPfi7;
zjpHbdhEXsmRv2NbTwUDHZ)No+E7&A9a1P6Zam*8*5`T`c3nJ=v9vOoETOtP_eURG+
zh;D^Q%usfm)kez_2*SrYi#XO32^Ntm45}b;8Hk$p`UcyH;>>FvEl{TsIJ6LJ10GdT
zOr%7m=zNoi`jrZgzbEJ@k8h*+yz9m88A;^!`bL*t=#EHIl>pf<q)^FVT4q2)7=ed-
z*0x!hX@9I-VQJ`nw2Ul&6$4}XIql1qz-OP{h-H)#076*6CNc<JtmOn-TkAY0)aG;#
zq$ji~-@A2BPNlS3v~TMk-01Y2#i7*pPN&n+_drW-rtfLvRQD`%<9Viv&Z<XH9G-n6
z|3peJBlLFfnV|8%Al{CPY3DR{Jy3sRwmG=>h<_%j(!4R>oDPrKjpE`1^|#rLcxdfr
znH9*xcYKT0%maBx>!%WuQWXbToznN@-ZqwKiNP&WLD*2mzM^0}Q4&nahJB19lTY<2
zXch5L_6m^OE(l#ydLY#k9CthksYev%aUfn;r;?X-nl|#Dp0?LPpDNBmOPyI1Zj#!i
z=zpM#IZ$~0D~>@Nlu$K{LW&Gjbzw!UlP!rRwmgt6$`zG)G`N<p2$CmB^}<vh>EAaV
zKdaCl&8j1A5bU2JqQ8mxS)Vz7>EicY-*W_6t7;i{t(qE{{WS$OS5(AU=Vb-8xl~12
zt@${QBCsWV;zcd2lT?+cai(wLy1{h5@qebFJMxDI*c_cDgrxZkuEUqIy5=(E%2-sa
zaBksj)gH1g?Nz7r3LZvV_JX}XW_<&y4wT@S#60PY+;O9EBf@^s?R18WBLA$}DilY>
z1mi*>(`cz9+0cMiaFB&uwp5yGEJ4#11lR2e%IG5HbbDQ(8+)PLI~;bstC68mNPl!W
z294%jhT+JZO+x=)6OJxHlmlA;$K*;_ShPsqzVJ4lE8V;aT+ibHSP8ZtA&|o^&t!E_
z+N*_!$JvIc=>L!pqqzc891ca_ZTMLb`pfaDoOwu$ATosO#a;?#n_Qyz+z1_f(E^VL
z7mg7HthMQli6=%;q+sQ_@W=T&Vt;Jt#-1O_Dyxv+JPHAq5K-u#hoU5woWt3rqZB2e
zI)!6%=~gs?D%Y!J`q%AVi;jV&mWBG(M1i#37~^JU90fl-Q8pY!okU;xEs&pvX$+g!
zhaht+yxKM?JK5!?D<#X4ii2PvDqXnbHMX5o&REr42QXK&T3C^#;*xaNyMMXrWJ)C|
zpss+Ng+S8x5!QjL1kTuX-HmSU10BqKS?Y!06Bc+WiirNI0Mpr12|y(*>u%wq)$Da;
zF8)f$%<h(4P*ECs&Qh*dEnSXzFNYx<XaQpCbqk+ZaCA@0W`eff)mZMlHN3nXi2BHt
zAfnvtl5p(ys+Kb+NbhJ_^M6W{TF|5xbhjmY8g(A^R{*(wXF%QxckB0uJG)>iz*a{z
z-40QPT&o7f<g{}(fK6Ts<pS&hM%9lc&MRa@5;_AZyrOKQ@aqpfq2^L;BYTxiOpa3T
zTDL@97pf3sv4UtoS#ZUEd#W9~mpv}6$m)?l7$nLE#cH-N3e|QxoqvYq<4*Pk+@F`Z
zJD5dplOfhZQWg=)(vnkaXBKNl?kZZ?a?A_qT#a5ZEz9uf{Drg$mAt#I*Gk=R%Vo~~
zjoc3<FZ|H{BAJYAFARLB<D2p2jr7fzRo2#fEdW6MY!!&r?3QKc<%$;hK~%43O3!^@
z%%O1E59Cjm{Kw{JRezWKNHK7<k$j=}u7qF~JjIUOa9Vi)%=UbC0xUt?GUrReXU)^)
zEb|T5c-m)lE|azWaM#k34PejLP`ij4x+W=<NFSnrr3B*bA<R+aX9c3M`O1zW-o1mR
zbL_6cP(M=`M}GLZLgs$>Od(4qqdS6(B;i16c(qS(CE(<=xPPT}d;!*63y%R*<>BLY
zklhkp8zn#q3AM0}ug(@($T#Ml8Ajn14}H36h~iNq-?u3-VCacRB8YpRvNJbq!)`3-
z^){y^t2?&l`2l4HmF5j$M+wyF^a%HuASs$C?Vgg>$g;J{M@@Q}iuYYOIDudgpJiTS
z>b9=%Db$5*(|_>!f}d9BCIH)dOHuT?srtUmZK-D0CC(+4ohw%+<!!ZsdE^eQdGEgk
zfS%J+)y>cX*jWG|ZMeLVf4<k^GNY8cy0q9_znA91bX&)>W<ko!?bB>K-fr>a;T#9S
zAH%>0kMCjN`c%-EzU5FVdq5GAx{EKX9)AI6p$vqWr+*M0MQ+A$>hmVjtJit^sQ1cg
zu_y!q;KQNW0X&FZS0A9crJqZqQW{c988EZu2tZtRgOMRWU`5etQJCHTz`cL?fd}U?
z-Q8gh<ObX&Y)ZRt&f(4qYQb&7fX(hV5nU3(zs|R1-+sF$EerY^<vKwreaKHjcunA+
zm=-`VWq-x=I@jX+!Dy1CgHt{L0W58*O%tU`?aAsS-V&>8Ww)93dq=aS=?7nRQ(13S
z^3$8MFqY=o+7w<cxjgm@sNA}UEP~$3mu0T|0Y<*yfwP~b8Fn^$8&BK4jdpMSsMqV`
z|NgfFhQSo$R_OJ*`MSh=sou)v5HM%qimfp~KY#ah$pw=Nc!n9dT1FXikvH``#+2nE
zrY+0Aa~4N`@KCIX%=PjI8I8}}q1DE1(S<D$iyGPB;B_@&5_}l@Ln09U4czg#y{^^{
zJERx*XM0_IjC4aDZ({X-Xs`E<);AP!tV-J!X&H=Imm5|U$x@Vy1?sO1z)`KLq}tq#
zWPf+b&22PXw%GM)9c&?Gxh+_0kAWo`T?zZ9t8})mwg8@r;|i|*Jhc!TwTfg_3@SPh
ztIf8@W0bu%0<5b>oy*u^w(!u%z~Tv{Um3(vfX)~m7>UYYs-fLgVM6PxV(0}%(3Y8x
zD1;DK`oDzVD@30<tvm@VGJqKYfKNN(;eY!c_$ZlM<hZ7eU$^^3&kl9_t+)9whGEHJ
zmpWF8eypKAMV;*@!R@Of&l|R#l0jO;O$o~Kp_-XAH^!|{!ti}v6-+h;L7scKkQ}Fp
zETnX;1h2L$-U3o9gn@PeRT62eF5D`0G_7H!wl>e{yv9Ns_^YY0>C0?BTVj<BO@A%J
zrmn6%B=K2s{vS;*YkPizsja8CNCs4y|7ZQ_#<OR|`hU+J^8fss<o_v2>7%7|@p$ZC
z@wWhpKz6@zlyWFuBBSVj;i(Ju`FC*u?Cio#b|E!op&bF5PW4nQZ$)hJ8#H#ml0+`M
z%q4#rLkfvPjuy!D`oYM}a<F^2|L$OCmu-LPNiPIH)AYA4DsEjj@Q3_G%0o9yw}gw5
zqo*txmrc3RG)f22(NI5s3M(hdb_t2mKnF)2VNSUl^LPNs5+g4eB$F{L0Y|Tp3+{S6
zmM!71H-LL{aTf{ZiT<29U&(VOeyoDKMdY-Ze?V^uiJ=FST2u!KQ#NF+(&&<h1B`#m
zHvyM!8xAS#at0E_zFIW%`9LUpyEFs!Tpp`t(n@g7LmvCXY^~a|DI1B^!rL@i!iA>Y
zrdt*^j{Fd6F-2pMKo&05l$gU3XoVaDCB|M!rvOq~x>=l-(nC%oZ`!Y-vCJy$rjw-4
zHhMi_>n+%ITP(Tsp(u<>#zXS?uAqN5bg&vzkhD}VJPanWuTie{CNZd25Hy6b7w>#;
zhakOzj3kFMp>4|W`32xwXfA&N@1!Kne>zEc{9ntA2_N<$x#@KjdrS4O)QtXD-Io1j
zko4OGMEX)+F10AX71rbb{eLQv_kJ<@J*K!sv591@4sVJXo967N>U|{XcSe83i)@Lb
z7TEC!R7>AoY}U*jLT0+fHqTv^@|u-xfmG|{qby-1&t%B*q8PU?G=?(!t?m*$m-(!i
z@l*$b&(UidO4u>eiBPdA%|5GnAHG`>*7*$1DCO~Q#P4pkW$hxhwsxyg!HVUmSY9O{
zo7s(E=76N~B|GwPZ|}|##m|45D*yD-WM8eBx*;VEkg8&FYiQ}774S+^9Qnz}O~pk=
zk>tfBRql_1Y`4K=CD1wzZEgN?7Q0v+sUT~$b4Z<zigMQ0s$Z)sZD_lEo%>Z-DJ3ma
zqcX1V4)&at?xx%V=Qb6-D_$Y>^K`N3o>2#q`MYFoN#2lwuYo;}KyrV&Z$0p9D#8!?
z;WGN+U5E{hH0mjYtCR$q#&_`J4*Sn%8$V=c?RN*SAr1|VPjKSC=0VWLSSQLxa*Cyu
zGhGiKf)0q5jPjg*2*7+xRJEvansu05Cxf{gfz_s6G%h&uo@4bus)y^V16S+w?f}o5
z(pCn2zT-Q@{g*)@Uj~1sCBIr76<648bC9MNade$Dh?&&IcRAN!N7FIK<kz<zWWJWT
z^5M$0*L#^+_kZ2bIQ{z>MyMP2Ggi3zadc(no@VizF4BwvZMp<qtLT<|E!2IIa8b2b
z6@s@}iwuS}_i9R0tum&C2ALA>w@8l*UqvODhDhV<sI8T=;-!Cpk&o)$ixok6xcgt>
z{XbTMFsn{@D=7Ul|Nj5kvvs)hH}C%+(SINA|L^>tsM(0+TPW!K?^vDCNNN4Cn2dW<
zR(r(r-I+U-pYNmlqBwE-o?fMqi4e1F9Jog<=|^~Y&+YC-&HjpcM6&A-vpmELa}Yhd
zR_>Kn7$X0Myi|W*=r@&A5+c_S{$cvJ+;ee*LbuTR3nP_@taVMV@C2*y@!#-k#~r(;
ze&9nEkj=G1)`b^+wjIar^sidfsy*=n(16U6kU?%_OUO^F2z%yEmz(T!`tO|5ESqMA
z%D%<<TNL@;w7F~>?`E>Ith$3ch61V>T7%Oyt36PAOlf~+!I~W3To4=0ss%5ipp<qC
zOKB<iVUQa7w7=-9!sWJ<D=%!&%8>ucm$+A~Ek^DK`*T0EK2Ij2!gH}Q6zgn3wUO}T
z1ynzV6g376rSFO)DM`=B$55<%L_lC}6d;ZB6#o;5pF!$8SJVlv=*D80i8AbXFf&!y
zaH5DqW7U5u=H@L1#pd!OnUkHdZ<+9KwG%6lHlPeVHlg`Prnk=C$hLad^V(|tHaBZ<
zXwjXu&WVN1_6tE!7FNnXq&!T-R;lDLr8QB+Ypp6u={BEj+SBP;2)ZVRFnp0K)?d+#
zq)1`7*TwVZnx(gbgoK`KJSiWpri;@O0@h;+3NL?)OBQknbMjN*Lyow+_i(F8M=591
zaMvn!nuT^5n-M*$EixD#sqHdY5U`^5wQ^Lvgcx#Lq!y%L3;1A?5W~;{w>FCr%Q;p)
z8u=+En<!(IW<-{uEQmMdii(O;HU>2Vmh-qW0++)moR0iIXkH!<xRRAK8~qt--Dd6F
z3k84vmqR?;vaf~WdHIcK@~CVlSZNzKf?{&TTm(9TL|1b-o*92o+(1?PXa4q?vnw(;
z`WFQq%EEIN+cC2_lfA|EFt&ve4fZ0RT`q{uBe*%Tz%5Z$@@gCf{%~6HZ5kyNZ|!ep
zn|Z)X<VE-U@7dnrKKtQmZ(W3b(pKxR?Nfg^r?3%sL#Wmvo^P@fsAzuzMXcz4n>>`T
zIA4c--<8S~cs~u?GzVN345~lXB0+83<TK?n#T{<!%W^Sji$=||gxmCvS&nU3wzJ%E
zSv=o7U7@ILsJ$dAbPFFeeF}$0GD+9-e3FlEwRDkaGuvD%&mxIMFbp!51utwQKJtIV
z*E~Fj6h(RcI%DS*JAjM;=6F1ujBJYW+zw}wyhukV@H^w%*=7|&4bk*~*OlS5P?}Bx
z`AvQ!sH$Q5!zFQVJv-d26ycWBM=gNor*zH4dhvM;$g5{ynTh3R*~-_(PIlg^hal5d
zq2Xux#vR#FRJEIC3xZob^yTx_hDm?PQ1kn?ofub0Dn&k12Sc9)m00S{m^1NHKC(`_
zHty!*uNsF7Y`FR8wBRsz=Kr)nD3zuhjM5cZdUcEsss2}W@5mpcv`(`+RJs6u)a!YD
z%%?bGpNdmoz4_Eyfh8$taY|Yca~e#0G>=6<S{xiIo+XAV+z;Gh5>*0vMGJqh*lcUS
zOorPp2j)4i7v0$PV5=CkKG814fh~{fOtE~dT3XQjU7`zYnLhOMQ)KQ!D=s@&)j42&
z9txISpx>8TRlHvR)EbUi%<t2}qS?znIVkqS?5%aW`g#!gN7Ru{OGu{rQfZFJnX9FL
zY9MEKKpgW_os|-3P36AgKwbr7MkS98m#ohMCVztBYoB2jIE>}1G1UiZ;j`#1&!fv7
z0vABV@@LcKL0j&Oy1=Be3R({<`{!I)QT6O$dH-C?ixul07WGfIsDAjcsDHLa#Y&M6
zi~8qT)Y&~+6=Vs~`Q)$=-Q4O#v)rkM<z4ibpmBc$d+GC}@T`FApJ`f)++}?U%&2Cw
zWgRYt*<IYrEzUSs#(MH)fR{9r+|kW-o%@y5P}jegZqNc80oj*}&;m^YJPMcE&;s58
zua~*e0xtpEm+8?0wE}??m!Q%DCIZ;3m&norK>|cCmkZMZ8-KjlsNymhWTxRydf`&*
zqU(XE>Hw9Q09Jli>W0(#si_t*tXC$Hs(%ZH8G377mDNxs?&KmDa|M645YF!C3iVU+
zwlDhTB<rG94#ricEH&*vt4IQSw+52CvWyt%waW;3VJ=#ar^)2qb3IZPU>3I)bamX`
z?pyd~xynB)RDX#K>7Nx$pA$T@6`jttRPtYPnqZllei38g+-|eP_Nz4lX{qs72<?N-
z^ucEOU^9KNnSOeDsH}yt!nG^Ovi>DWu1}m<^TDS3VAK6m+jQ?d2jqjv_A@fsX5L``
zHg?;&DTtS(kd>NlAB@XiZbZ=+Zv?g!PrH}%!<V3bu79{r(UR8lo7v{tR}cTb*neYp
zc<G+=ZW0f>Sf*;&6<*V6vZ^t9z24KukD2XxulMZH)5ja^t4B|s_SV;*KJ7hbU-i}>
zZLF`euX^`^fJu_N@mIax3MSd>^_cqa7xJ&$WjoP$8vExLDLcC0?Cq<!?VTtL`7mWW
z5qM6YPJhxUPS(0zcKG(y|FmEGLmno)z2|{l@63m)X4_+Tc){Bno!;7-KgvAgZ`j`w
zS@n<2*jXHnnA7QW!SOZ<yME~L51kaMyjmRU|L%t##5fHJnkYt}{&5^#`5uo4p_}?w
zT>CU1%0Pu2kv*D)2FXH`4FdlBWt|vBAxrvtQGd6yLWOPYuvj9)C|#=8t1w=a6<gJ6
z;)<FI*=vepRKJPq=L-lMN$_<sfB{izw*L*kcHFUh>IXi^SZHEo5y=%hH<EQY7j7~b
zx#1L76@EmatmtZF$1v)G7fKz=%nsQzs(UV@{woT->p}I(nj*Ck{d^~$5wf%hZO0u$
z#D4(>k>D&wlhi#8AYR24)oC%3IzvOTy0cDBX4Q9`NI5MPu#dE)r@U8{b}_m83q7TR
zneM$%C0gc`E`5QtT6jBhKNO$&Vc}Ua8RecKW+^sLLza<7@`X~xvK)-sGo3O72^fj(
zUKB`yMsdzliWNGiD5OCA3{vO0pb|(FhJTyMOwFZFA)nPrdq*{~E$mH2e!NA?yI=@g
z>?SuCsA0awAV|nUJ)$-}mKtX>qnWBeE__jBe-(|io|>C=xEK<cwbE*V9rX(nqcxXB
zLSIzw)nau{RV3Lguc_@PxnFYyCN%;p-Fur_Mfmc?g2g2oDXA@;>!iT`v97!g&wth`
z^oZ;t?X8(6%-pLy$5j4~FZ#@p%05zjG^Qh!Lu}k$K|b@Y!yS>U4WFwCPYWOjD+`@l
zE1&2~H=!uQMash)kwOTT7T1&8iRDGi=an!w3Ygmqm(MR)E=bZK7em899OF^Txk%G-
z((iW1-gw;c_*K_)Q@2fsaf&=8hkr@7Wk>F}Ym7B+Y{k+AAINCdN`!z$<R8VG!`#-%
zn2D8_SW2dA1YS<x)#P1Cx0#9Yg%bH1*mG%lHg6hBlCF}|hSSxH>|`$;qF&@r?=bzs
z!^|tF@Je{*6rLBK33GtvVxnnS@P81Rxp%nFet6njCvOXK<(PKZ_9^JIY=6YvFkxXN
zo^P^~a1sP3%!h|5b1CK${(r(THdA*7F~G^3IkIP(BSvu(f6C2W+*#Q;rGmnC?aFe(
zRP-<Rr)2{Xt!GBFf-o#f&)M1<IX=FL!rjq0ogQLyabyE+M6-phw<L3-P8~L5iJSV#
z8R(zcQExNX=R36bQO`-%^?#bWAh8YJTGI`T>#dA4x*)zCcwiV3LA`CQRYUa3P5F^O
z;@bSARoH>>-!?D`XTfQ{i+x*vlh|LhryqeOL1JFiP(Bf+1S}=T3<IbNLu_l!W`4Do
z<eJk>xg}SY(2`b9m>8S2%=cPZD;s`Wn$MUll2osqD7jPJ7z?<}X@3IcK&qQyafzxX
zYSLomBjf=NJrytWMFtADlQq_%+@_vS`k!UI&)5dY&2t_*`Wl%z_3M8{qQ7iE<glU}
zw%<FLNaDDa^EEedrhS~-TiO@d{!-0L(y7l&nl9HuxCp(+b7>2Yr7b#@;(wguB1bU@
zDG#U>)WRJMF@)T-bAO4#t1w+bbooTvOYil3V(d8^CZA^ccAICWF;(@plz|E@QRky1
z>u<+A@xCfAU#i73O+mP%DcZ^`s;#0ywS>a(|MX1+ox=CNM_cJO*fGvPe<ma?j2s;+
z1$)8mFk>slT)wHzGRfub4A<d`X8A~xMfrd#4{RMnns2OHY=0fuDEyXKr_-?yK;B4F
z(Qv*8RZe_s*vl()UTQ6>qE@O`LX_Aua<5iwn;Enf^(*UqD>Kel%ATCnzFIEVlirzi
ze|ah2LSP}iQ;Rtogz!_F`U2WOx#-Vl8ZJ+4TrKIcl*NkNq%r9CBnsQ~x)a6cT`zXe
z((XoYqt{;F=zr1+ZCPfu1au*{@WOjj`J&2!#FYtvVtC3G-)AuDYeyZzBB`&lC90fE
zmOod~vVKj|%HPtI5_K*K?h1CDLQ@rwKmm3O9#@b*pf|#YxB&>Qw<q?3pi`SoE&%=@
zdPMoDSR}O)G<SQ|K^Ky`c>D(NSTv#%NQrQAXloXiE`OOs03Njg7u$EOWu&t8_T(<*
zXgTM#Z$<O4RC&CVcR5S2Kvj;&RNZQEu;S%V#yG{Imh5r;=4e@bS{2TM)yIljsU6nk
z(DDlFu5<z4n=g_pm{3u2*A0%S1+{2OiFe-LNR7-cHZZv<+*Qnu^F35M1=c%WE~dul
zDFN!Voqy#YR2eU-__(z@tCgU_QebpYPtJ(dzn!2dwNc1zVKJub_{>O9l3nGos%0Q1
z2T&1|5;>UXMTiX?7XGp@dz6ln4PhJN@C7t3DkK-kBaJQrb#qDAZ>*<nt?`wfPr63)
zVn*p2A1w%y%qm^l)Sg#*Zu3HB>C!LCb4!<gVt>spJ-4-yUwVFPI#bPUCvr?LnPhsg
z6w~?4z1F<F%jTCBUNbUnZ{|j`NOI{cTQ6M4t*PX*gnK1%l7>9@mM|>HJj+wzDDzx7
z5vJ@$6K-tAwgeCCB!V|E=AW^~*A1=Jx8EWzqBH%|t*tG^X`sc|C<Hrxg8$V%Z#J7k
zhJVI9ox~vv`8B}SXyQfjTH!gd>CPpeCPp{7Hic}wyQ5R?dE6u3_9pUp1Fwtw(mAMQ
zta@vq<!JWVRpfhgyLQGJ<{WVxHM_GYW(~sed-Pgup-eeu(V4iw7D<L1>JwHq3;4Lj
zPQJMT@Mqm`Zm`qYNj8I~xQEw}D^W^oh=0Rs%SXTUmCLP-{9K>QC7-s~@WKx~oQhZ-
zITz~EP0Bp8)Bw~Q_Vd<FFW8nowM#zj#C#mML%tmZ4d?%WX!}1sr)fOx;?s4fIXj`5
z!z>$@d`eULCgx`j`}mP%PrPa9j{M;PKXaOZhlW4|g2BFqHd6oo_>p~$k2~P)oqs0(
z@Y9Qi^B1S7t(HW5XFN$R8u}fhp6<LJZ`M?8Bu|AIU3*g8$$)!Hhx>(i*k`0JHt=Ut
zX-@``RFE5f*3!T*$!un9KAMeC#HaIkQOoqBX{xRHIkBZ2GtvjDpzilLvtyGrg;Drs
z5(I?Yqv;s9wXhb54>J_JKh}^S_J5~9Z^gLmBLhbn_K{6OkDvJ=_cm28v3m`JvMuWG
zMF+67Y2{#|X`Vxi#~r$&Y~ZeGvaRPN5^>wW@J>@_H)`0etqdyIR{9J0EH{{N?^WQ#
z7zx{A@5Oh=o7t-1yE<U$%W>f*`yqcrivm67SEB_d#^@Tf^8@aBU<A};XMZ#E?!GAi
zS-RBC0@MNCE+H1yfilIIoeMX?nI!Lf$FSsLlbCbxlS8~D1*@cfEVK}o4y*v63<E7C
zbKgsTa@;J8d;r(gwT1&Ss56$lt#84Cfpaztn<ES9i9TD|?pO*LC^f`BA_ESw7~rBP
zG)mr)mr!vPhi>4;KY@41s(%+y+RIzag5MUaSYYsWdN~<h^0XFAf0oq%A-+eaExcnx
z<r+a)TdX2XYc0EmDieX4+v;A*W7x-%!I06Hdw8DgvjX;k!wLMia%Y$|T|w29HXI7H
zH5yZHE!dwW2Z<)~A#9FV{#rrQunK!2(<`*23azO0j7z$DOV@m8Du22fGb^m(JHixB
zDp_Xrs+LCU+Bj3KU@gAZ`quEj3`(tM^d-=#D!1S&BWMTmYea1gLZ>Esa9okmH?0L1
z#Xu(E@zhPYJUMiQ*{l1_jW!q^3pA`Jia!<UoqT@tv?F0`N&Qp1l@cVM;Gs-HGwW(C
zPOw*P?MECY4~zfa(SN-q@M^i>YvG{$$1lxO6D^w5iQiMN$JrT3Y+Fe+Rnrm*Ysp-`
zxuL#iCkBC-2SPB|?9l-i{=`$Ez-k9?MA?fM?EP`Gc;2l748H70psc`Q-`#I+)cCV5
zwL58=ioy*!P-w@9d5f)^94LaZV>s!-jBaMl62S0_uJOUiTz~o!!-&|ij_JBa7_1zQ
zKJ1#`Ej(<_2d@6Oxeu!;-*B--mqp<otN%R^e$~#%{eb`R$ud3}S@wmM>+2j-o`1!B
zjiASl+(BZxYx=d0{AHQC-ifwV@B>AHm0Cp}zC`g%R*N8L$CsQ1=xuFMSrb673Sc`a
z-3sD7k=+{Px_|pzK&_p8N<lTZy@YV_onWW&idhzEU7zVfly5ngeClmrf^F~!ld|%M
zm(qnYz&1LZw`zhD0blyGt5l%J&t-j*$w-G)+Cbpsva~&*-a;mmkyt*P7OT9cxI6j<
z@$hMNSX5n5EftfOhlxg>{%)aVfkr3>!b1gWR=#&DJAZcZzB6yXF4M_vYMbw!SgqUw
z(h}RXn3C&xYD%Wwr{89xu3rbw`bPra`XdAHhPQ1c{tKYsO6X5JaKXHyH7VY6*IpfC
zO5Ja63h0=1p+oz673O1Kxgs)P4U5RwEIo}L=ukGygaVeWm~G(XC3=nZ*)Q%`S*A+1
z{qtLGaDSbqGz`mwB+`+-dIG*8`4nkc((y0uSPGR&iX6G)hJjvW#P5r%Wm0-GlMr{k
zMT}W;PbIc67Oiv6Q<F-xqkGmz4ZA=MDnF5(qFu&-tEstwmF-ei$223H%(aii=G0{z
zwK~yTmF+lFlgM_Rzzsx^t7LaG182g^{qKCLP=9aqthv3D5jD%i^CGuseeH-{c`_?%
zLM%s<n(w{l6;?3d<biKyZ4FFn-JOUQ_RCOo%+Vt(l#SEa$OaKrUXNDvd@JoE7ww_*
zG@)Rj@v<zHh+};396x_gT^~PRfoenUO-XihD-=a~PMjbwd+D7(Fa1DfBKj)hjpI4H
zoqyCs>ZJS4jW&wh=F+SdCn-K>TWZWRU$kvBhHmKLIwJp6zmRw0wxDk^;U%qcs@tzs
zBmBJ@X|FrM73941sVEoP8qjueT@*k$_K+ZFwom?RQ|>Hp$TnQlTK4IcOiN>gCL7e}
zM}BzQF+YF|BnkJ>fh&uF?ij(!xRTke_J6nE%2p~cxwM7Z&-22EIz`f9iFO`OUL%MK
zuK64qBCzm^ti}{Rew;G}ZBdK3`uNcb>uoNBO#evB)rD<^%P%k}3)5$+EDAn`Al5t&
zipIn%=?5uZhEkai1E@TtsPXY|LcdmbP|VzcEr*djoZWA3v<a4<5EYPi)|Jf&PJbBL
zjPyM=*3xrTo)U99y#!gR_3}5af*7h)skbYu^RS@FH)C{DTP;ioms5R_KWHwe#8!H4
z&rxY}vdDD1HNdp#vNIJ@lb<H6ac-LC(I6>5SCo8*A}sj?YX9wURIcyimB0EP>?U}-
zZ?z;P(TF$Dwt@<eFtVU{F}tXurhgh3L67g24GZwb6ze(IEo4!3hpRp|ueZwXgmV{O
z`qh>uY9OtZ@c!nBCE+0mwAgpUG-2t5o3g(h?!RFod~WE5kl2cU0BTM!rIqkDFW$hH
ziIf^L4TMd7&-F|qEh5msMejJfa5uJCX0VtmM~jl~R@M_=nIhzFM`lRWzJEfKo1Oj5
zF}9T}<r;tm$;NmfQXXm{OJZ^furlpiW|&CKbFR%8ZawJc{L8CdLKf-4;&yDf`L@bY
zM-5I2$8J_)Bh*%{W#TN?MP6U5{h@GRQ$(csclOu|BM^l3wJ?yD8RAi%zIS_)UPQ6~
zM|JEAA~=h%!8~~7(M-jrQh)u<r9aF!&RA)!zO&{=|9Dwi-uBuLJUG}4Mw28RoN|oE
zmjd)Q@jF&jE+4^DwK5ekJQr>v4^S_oN$4dqQe}RYRJ&W~OL|1zbg&PQ?(`G8fS-`i
zt}}MygzF8P?0NAGej^-2O);kysUY4w4yh9uL<RV#0YEF%F2S3tg@0T=gQza!VtQ80
zGn$FFdJB7_!Ut5mB=bYrKj29GDdkGu8Cj<Z^Ui58(#Xlou<j+5Ul4{lfbD`X%uWNh
z5P<WxewFz1ZzK3r)*YehYjfDl3HwgQUSK(kJFU>{7HF`rv>G_bS}%nO8D^2Ksq;Mr
zHRVY`2qG}%tgGNO>wgr>CRoXbRf+?gs3RxpWZ4VUl$`HnmV$h&-wLFr$)948>a<OH
zW>?Cj%rvTsL*YodB&$m>rccX9NC~(HE>fkKd_Ei`Q-J2Pk*w{K$S702>N1n;lchPz
z>b4_M*n!NFe7ih!W_soFd>DFlWtGcG<XUd&IhgAv<I@L*9)HvTOXcVT-!#o<s~$E)
zDZ=+=+7i^+AX`Z*m(K)MHh6JdK&33qXJ#~R$!d7HM8~sbk`P)Gz%Ml0rE;|tDW*=|
zthHh-*SXE-Wp7c%5_AewMH5<D&4kh{Vp{UEx!`0<L_bemSxT~Uc<nj4Zj)duPXG%n
zeH3zBdW74${(pG`Inlq-LZ&~F$h7yPwVFS`8e=6yX5{V9mRn2U-!k&|moB+ck76ZB
zu2nUQT)L*}l;Csn{gh_=Da{Pb7E3H>CgWc!C#xlIf7N_d8vlM?R@oD2RrOU-q+?E!
zp$fLSRE{Bu<YG2RYiW=Y;U_}yv}8p3`k+9~Ho(#Xaeqf?EuTm#R^_W*LSz;M)>4?U
zlxn!03U#*vF<<k+lKOUK;!ZF7Y$Kq`WRv>r^64#?6M5!J-LBNZYURl)1c^~!#*`&B
zGw_w?&XYB2`dK*)GrL^fRC!tXn$oUB8Jp7g<?m(|30TOPrx%dO>fcmBZq4qfzO9)(
zQ<lEz*MBWa(h@cK+_?~H#d31Y?@uSGEh5@hTxZ#ApOq<E?Q|d${nbkKSx_fRWyg}b
zM4_biQVCD%&%P%4FPOSDFA}g1g=y;2kvl{FR=Yqx5V(*(X~U|QLQ&Fx=|m*om}(R~
z(^V<ifo4fvNI>0B{pXY?X*ZeR6=es0+*keQ$A3?s_8t}MKW{vJsQ>&$*MD}CgoC{u
zOFoAnSm+6uJN;qmY^p-ha7(8(gWuWP8+Oh^9=j=j6%7-;hBQ<x_o89al?|wnwE8aa
zlXQQ~X|qBO0%h>WW10RS8AG~;eCJwq>H;wPV;*jg{ro4<n1}Azw|%<C*vsvsou3Cg
z`+si^ci$Wh4v)5f+I=<HeRFj1&%xpTk4J-@?YFJ!X8+hec(eEBr@_(B2fK$q@4tT4
zlI2f_zqp})#*;JwPGSHh%DU^twn^EQLu|i&d$9lO?%-gTZLzLMUGZDj9YfU<-ueEw
z8>M8lSQ=gOuq7(~{Wj}v<~lpr{dI5mA6lZX-?H9f4%REx{HKF$YP|pVUDX&nO@8bC
zc7uQIdB4r@!|0N$5BIm<9sN9byM3U(irh(h@mqK7#<@mE`+whklW&IbtA+==JNpN(
z4hIMO?~XD!uGW8(m(=M3AqO`+nI}B`4VV1s0we)*mm%r`Spkc;d+Gv^0Rd~54D15l
z0dbe>>;ifL9hYY90)qj%x9aTzTmk{_w@2^-IRSs4cq$K-HO=+0I5FprdzO$6U+79h
z9;X9HatrkqR3mG^htQpN=p*)H{v$IGL#a<<kd8Qvb*Yi@or=zY%78{-VO3A|_zR&q
z5>pd8>o|s__~gRHJ#nMq6iAB{H41tVckMs4*Vm8MH|Vat(}Vl=R+bl5g<s@auNPa>
z(KCOVq{9dUrq&j4O)(-Qoc-`T0`@~6ZjvIT%pwd`AP{GyHelAzFcRLE6ujOkPCZke
zH8(VEv*j!@S=J9y?#T%sW`HZ0gZOZAe$I*9Vf~VhqdWequ#OuL*M0<WynWPrr8UZV
z)zosB$+Ui}M^HZGR*RWM_6Ruxn0uD;7#M$B&dI`Hb1=RiLT(g|rgVRgJW<<Rcl6g;
z2zmZXEmki7N{<B3zcWrbRX#pxJi$1MNqEI$xMB0=GFS_L6+|?b!74TwWmce7vO?_E
zYWO1S&@k|w``G$|NNG?K33WHvLU`BESReNRcQ3j3h9@caeiU^DzXV~F1rL@A8fbsg
z8HeXiYiS`?*kzT1%6$0c$)pNdR4IdWetwsN1nUOdB!`Z8DJzU;N*1hy)zO)xuygDd
zerk5ehcQnfNb66j>^<z0FJhnEun@@={xU3)edfI6ZVc8ExNc};`bQ`8shGE|YN}ZH
zfVKjtarlQCt3tubQ_-DjR_|{B`+k4>l24r?l*fxHT_vQxayFFl7dsak`5(CVE9JoZ
zWIC2)Pe!}sBANu=AdE1xAYCHOzI?Te7Dq?Bu`q^l!4g}P*`XpV`Y{O;4q;9dcFo=$
z?5XQ7i(O&lhyKV7N*3B0%2emx70Xi_PBrrVKuZ^}K6v&+Z}6W_9}NUvw3dIgLG?|M
zUCE+PmuZt6s>Cw1M?F6VCx}VxV`EVK`rR%%LR>^i+FyVC<Vknv2EnO2ywpFW$!Eiu
z9V5>h@X#AaewYpbhQWxZ7kCs6p^8e$vaeTY<6;f!YvN!Yei!?n>!LY3fjjXy+sUrO
zRg0V+jtx7m?<}#%b`z59u^WHzb2oq*>sPL3L;A8PLoD=SlmXSezJ&d(Q^cQmpL4a6
zurOt;9WNK(?x95(0?*|wD&@__>r=d*!n+zYC`SQ{qX}fNb>TKQ@jWhLX{~{Ex4oqm
z?p~81Sg;dyW2_vRV0v3d=zYVmzpLQH!lh~Fng>A}U6$$Es%=n5JHdajUFX;u>R6+<
zv5f9*OD(T%U)ptUy$^&sFGANB8wRPf?k5!Y-jz}BGZFJ{eojPM(gQg3Yfcq#gQj2T
z89?X+Qr<xh^74-;ynInuMMS#{XqQp(dBC#^IDD;N+LuFA+V`K!l_6W4Ja))i0WOZK
z@R7gWhHtXid&d^LVGe(Tqja=r?iPA<zM|m{X|w}@{M(X;NOw?9AfmytB%=EN^AbrO
zLvzVQe6R$e<cF$BDsmAFmNf#$!3Kz=4oTCNkpx5^-qN&?mt;<RGj+(E#<?seb6V$<
zjg&Q)g84vwr)Bn7<fCG0lI6b6l9H5sKa8Tw(+KpYVosSqr2~K2X%L<M#M5%$v8(ki
zv`M-*@SlP2&A^H5oTsK(75%^-EPj#Scjvrp+eMd+uSHiKsW&I@okzV5A(#Jb_y=2E
z;D?;npq$UkggvsobrH1A6f?|!Sbr@vC-SV{PUc>OMTi>>^#D%+>Q`2O*n!WJ)E$i}
zk6bfzU4vYrEt!88Cv;Q)if3tJ&gB{K&$;rRAu{Hze@>=Zm%q?snM7P{KNh;xcjn{X
zI_^w3bbZqNZ!-U%=O<|wye6WsoAP)BF);0T61K^cqT}5nA7Ewvzuu!>?@2!Y-_woW
zL;k;e`Bx}Uw*z%G{Gl5h2`c!}9j1HXc#^8BS*`~qgD8J(n0pS@Ucj^hHX8Mgb~Tl;
z(LPCr(U^NLRK2tOYrKNe%e@uAlTaN@!X2c{-SCPB(U_Nj7|1-br%>Ys1F^FTb4E+(
z42@|e@0FipjV75ZWJy~Qja2$Ro`mHuRXUt`qrk#I&e8xpOAo};zvdXPDBSw|dG2G$
z1qNsCFx7w8wwyu=>#ef7uESz>zyE%XeUDitqmY9itTGOzQ}Ct!T~wh<F5H-V>{Klv
z`0ZjII_VcjR;11v!yb3sAb>Opzq~s<Vq-T+P{645V7|xr2X~kTQwTZoF>3^OV<n2N
z{g}7doBbo^LU%(sLH`f#VKU?n0-XT^pmQ393;KV9ZWA7Q2|_xIMq{X)4&70WDj%KZ
z+;i7Q{YBsa-Pv(2qFN6WwvE_nlwL3}7bfh&z2Yp5a7gM+IKZDyQz&g^0_H_L!2l|K
z4y@s)FpX<B_7I|zx3Av59qjDCe!aVMw0{6@)^G5y6IiiRH}#=h?)8N~ykH~lhKUX*
z3PFFYbL*!UJnln>F~5%e6z;}P$hwb4;1hsbJZRGcj2@d(y<S%$CDo@O7J!AEkTQ-V
zZvsA0fL3Y=JC%9d_1XbXL8X%Gc;?4|<22=?F&Wxf7!iCBeUwoyAO#W*CTRp54Ey#m
z5k)#}iJ{>=bP9-PK9Dz%n<^wG)c{pcY?wpe76lg7z+U=ucv!P9x8&v$W5K0y?Qta2
z`0C-`zw19E|Fcc;TR|@9YW;8HS#LeB|2=v9toNY*{d?qpz7c*QKLeLE`2vFiKhT%C
z`2sHiAD8L*0$%|Smr42pDFMTmbNT|g4?LEmJG2-HmW5@%Rqww-mpl6cqksSZ_O89T
zZ6nG5?@uvNxngpcglxs}Zc$NmiY@OtXU94#kK1y&$PqClA%g&e0Vr{8R^5lVPk5i?
zsvk3$!Gj`g$D7>Am5L-h2J`6d>F(+Nb(<wrZqL7slhfr4fN=@vax__Wwq?UEb+g_-
zVld1pvYc4q$!H?z0bCnQ>3@3vUhvY<jW1x)xEfs79%NyM@d2unLQN4eSfueMHQa4_
z2Px3+XV<h-aX$=1%hnF{PuGWjg`T%+1(kWI)?)Bhtu%LnDb)0ZVe)b{7e{6Sq;C6C
z_w`$~;v*y&CB6sKQU?5$!SANu_>Sv4q1AwQyVTU02V9klu$s62Uw_yCYw{7m>RUwd
zrz!-v+5Wr#m#-hz?7#aD4sPwgKeYe1#aZikYl+5AV&GU)l&IpPH3Z2X+5LTCP&P@a
zucA9?)2fK&KcjesDlw>H8N8EDC|F4sQLdmdW3a&+q^YK5-KhwGPmA%4ROLw1i0sp#
z>8(%`Pbbh;K2vl2oPQJ-83g|u7_bQfaiRK}Nzi*itxrJlgj7IMJb3^RC~N%A)PB}9
zTyEHOrQ%es&uV9btEid(&8I$%0NBX?U)?|W>Y&E|2e<tH|GfTZDJW)An*=#i`FMxY
zozU+Q)U?x2B8@ur3L_aufOuw4Y!KNmG!K+wKwQmIjk1Ez;D1BN53aGIHJ-yPn($~y
z?6BJbTJW))(Eip6hp&aYR@pczMOitr((aczv|{V%U8u1Hl(r~`k)VBRkCOJ#Y0+o&
zKe!QMtDwWNu(D(5m%;}ggg8eT$LSRyvH<|FHx7|!GSRRwR#4TJ2TboY%XK+r<#ZWW
zd@G`Ft+mcx!++xK^<WvgJ<MD)VXi>EO-ooVj*Z-W_~5U$Q^5y!;o*b7c3m*${e8j3
zI-IXZ2t$aZoTN-I+k6r=-Y8e`s-L8JU-mO4<9@oZLvP4XtPu}*v>^MC$jX@=>w78^
z!tM?mEB&qFR04(&Y29&@ywzUO0nQd1Q24r&K2{cL$bZ!E*Ft5h;e`aC3wW@^!N;-k
z+f1zH9whz^aWdilR(XJ4zNbz42aL&~9XS<|GiR2z3XX$GAF8FjZEKfc&NTSGgiV_?
z52dj}Bzu0A^Bd8wEz^@O)C7XBkE*sOPw{5tVUrx(OoeW0FgLdg&eWFpiAdc)my*Kz
z^5zA2NPkdDpp|U;P^0mdk@t9RZlGi%Q=n_)pUaelQ+=>Xizcqy4aRc=yVbGUcb;3K
z$hU4?1nNGX++*j5w(})`rd<c~+Ipv1nyI9eIRx;@0vRSv@*sAbr<-Ze8tc`Wdib$3
zm83%&%W#rrL(}^Yn<>)D$8oAvNHb-m-7-pJ34b};4cixsC}+a<_r(i3M>ZJ|p%|f{
z91*Zh;8Y91UYu2=>hDWXebmzXBit5Ng+AF@*ueL7@xxTNpjt22yBQE-zW7$$H}dOL
zj%QrZU@S94*#|Djig8}R!ZAj!_@Dp!Z@`J16ftrNab}tUOr55d)KY<Flor#OJqL0Q
zbbmA+GA4xY5`!`#e=ShcaGYo=%fKY{N931RrU_y<p~|v=d)R}b(jZCq*q!H)x?i@%
z;vJ)cNaRkH7#s*(TH)OU!B*8_FrnRpFq=hjIHY`c1ZOgZ<p*Mqex)ZK?Dg7kLLmmo
z!ELHFz!t586~$Nlsx<a8y=(q>PzNKs;eR>I^hca3z@vEZAy|*QV;H{#z%Tl=A!u82
z!&&f5O#oB7pQ%C<^aN^ubD6yb*575lcP#RPor2m7Bob)JOKc~&JM_`jUQu6pP^QO#
zgAkIZM9!mlbtvd54^%=RW-duz`we_<=tGm3hnkDAQuvzsb;#2;#7;CX=)+IEpnnyv
z&8X~<P}g}T86gdfF?q|ppMiOWC=ye@-u>|UBepbWt-VS-CF8Qbp{bf1dRJsD#u%Z1
z^bS|3+5)OCMYiLr-%y6g=Un%&(gGu@>pbv#GK8LZVDlx={4;-?1clZx5byOGGkUXy
z{Omm4R@{Yl)BWxGyl&y}2cL+;!G8m#t`{;1hhw>r7f~ER35b!%Wj0lLAE2I+sU?Jf
z^^_#fR^t5cC(oawwz9(54s49x8`7ETNOVZlgVq`nlk!n+7yZT~;z~G-P4eMewHl&4
zq4%IY{L@52(ECt^0r~`2=*4>)PW`%pIExY}#<7er0rng}^n%gr?&+IcWq*M<SNKr@
zYE=U3x=$O6-j^X5^KdlS$I*ZreikkIiCjigsxlJXxl@L3o#LE6HdDGf#Ti3ZkXZ;P
zxrh!~#x^xi#IgGbn4-}%fxGTyluod;PN*3v+g{|9P7|-SY7m+b-qLx`78*Q}&KKOX
zX6;S$FHt_D!Q+rSNGgNo`G4rTC*Q=>4YW8Audxx9%{VWW2aM^<Hb$W>RHU_FsF%YM
z%aCk~^_@E;n|?ld{_M%{^gqu|e&AvrEuCiL$XmueteYVd0*Y&1O754jpuNTP?%4G-
z!rd7aT9#y3+F0(&b#E2xx6M*g<7+GUYy4uBHJLQ63d;cGe&j~?vwsvV);JA2oAiFK
zDjUOQ+It5<DD{OECa~nU(tzu8X>_KIbIC#9{!}*1mojA7HoR7Bg@wu>@DBou_LKAp
z)*cwpDF-^uuzfH&5kVj+qC`P-;RWh_cn-l;f>vNJa_s`_PT+O=@V8%E{A%|z*zr(b
zaD(yw>6U$Ke)(Ole}8lDZwX-sLO|Cs9KRQNKb`aeNrgA=&nh(U*!aCVZFwM@Wnz&v
zR;@QQAIhQ8wT5O8#(?21$a#1DdtX4a87feJ9q%jp`EjKvf-Fs71)~JcmvL3SrE@%N
z{AxN8ulHC#X5onl)jYv_h(+ezWuJV*9e59%n~;IzN4b3vv48AFE;kTN8_5`=DgSPu
zj*>oV6k=%P1NZHo81X{feMi5n1>uC-sT#R%Oo;L+l75<nD&vrNii8z&HNSwMZH$Ze
z&!suUTp_+T1$;-kw5?I{!ijbO%|B5SR9HFIpB{<qaX?3ggn}gFGh48ahtuU4AL<Gm
zzT4wvJTS*|1%LR4bE=+BgcNbKbOQGI=vlnX<QO$Y8zp~FLj@fehz37@PdtZc+Q&Qv
zC;H_?L<xMr3DlrkrhNQbPD<a8IM}BT>}P7yXL#CxC(Cr`X_|Gq-2P3?Km@$fP1$07
zycOh}W8ihpOgBa$z@C^DiKaj-s?P*+yuVaQm}VTkWq%^JOqc_OOd%>2Q33@0kI5}&
zHhPSdz$FUAIlMe@#$yd_W0yRC`S|4d@bSx^PhXw<?R0o@K79F<O%SL&0P)a6$~ZuX
zdn`+SadB}$mPi>lUmngpIG|fF9X{m!gZur1CdhlW1eXt%__o31SwRBb&8;0udr5<<
z1Yh}ztbYt^E>iKJNKTVf=h0Y$KrtlLk^1GNJ=*s@MkhB|jkPjaX;OO3DoMrDxs2l4
zEi%LWdmQ5~^)Q_b1aytV{;7;f4U-xjvx(A<K{``1hRVpcuEDiyt_pD>!>NCz{j);E
zQs+ZmP)!h6HW&9gQP=s9vqWk)Nwy80LLQDdMSm|9c68-Cl<|9n+E!^1?_@<%yT-kn
z6mj*owZyqzL%C#ONeuSTkWK@fi3?fiU{#cmNOvIa_sRewjemx~O6W$v?^Y&};V_Qo
zQC=H;97BsLj;7H?tRDM~!H`a9N>9wI^pd-WSidZMrmotUAwgXm6%Lmw3nQ2adtN`D
zseiDDorNL41gRo8Tf&(ll;yfYCxSPfJY9%bEmcg(KM50H56hW@@}5pan&F3<f@;9=
z-dr~byYUQtV)<jcbWhxs^K{IOT;3$pb~4GSqgw=q(71}^bBzq;(=H=1UE9UIP$vn;
zypXz|PK*lRB)C~s0MwA(?1@i0Luj-%5r04r+{8+1)x4d3oQYtRH`w!CtpFsAiWa%(
zfIk>`=HUK=t|0w^)VLzKr^O-$r*4!W(gtdO0qj!ns-~wyXr4o<>_b>ng&1>|DXS#f
z&~KwO>RhgD&6S`D-NW?LFn?`d?|IuU4u$gohiZ|IXN^lvZ64WOv<l2&_fQi)Fn@%+
zLBx*;GPO`L?>u_gt;lyyf^#*6AvM<k$1yZfb@p)xU*JxtB^Weg8JCTD{c>VMtUA+H
zbBMC0=y3QHv$<5}Bvn-poPbJsetNBHR87<IryM~+cB$842eGweOVV?*;{UpFn{Dx9
zhF%V2>#;+HmhtM-jN1%(2gyyJ-+x7JH!`#p-9G=K@epZ|P(Cs_6>>FInMm3<@C`zI
zcT%tlX{%J&N-pdo8CqmR)uh<_syrnB0I{({-IbQD<QALlv*Z8TbgS^=lm52O|9kZC
zFJD#je-0iU+~U7|mVYJ*2Y|ZYiBoXdQdX}`sgajUCs~J{!!iLcOeTs=zJD<YLQeWk
z4RhsZD>X6B!-eeynRx7=U$Su@s!UfeBVKy#Dkd7Z7uT)dkJ98R#n3>E6{2srgQpH%
zLDn9|4Z+v;#Cx%apTOUsxA+TpanJc2PE+}%S7yub!<!H9ti^lh8cIJJ3Hi<k0$uFi
z)cgG2iO;bCH!cS7`rAWr34bwgikWoU;>PLR#4A^kMXcA|x<xTmJb^}RfVu%sc}2J*
zVpML=Vm$))JbNg5U<dPEMn^LP1Gs}X^fWZ(cuP67Ne8qbnuA|XzW*73<!5pMs3eTs
za3;a-HbJq_5G_?#EaC$8`w=c7hhj5O$7E$9Tg(hBWJU>A9FDXZ=zn$TQ*g(rYGT%)
zN4XHkgGO@i4r;W~z$g|8pAqDF#j9Y?rsSD>4IuFSE4si&ftIP{E)cHui0;utxtum(
zE{XSLOus|pwRr)v$#z<Ix`Wyf0OV(bKp-{hCW&AailhL$uF7<#l`WXh%Nt<c^BJ<?
zx$@HH1P++r#(agXnSZ`yaF^PT{dH~S|8^nSA{l@m@bnqx9FHvUkd!JOXZ38vQdS`D
zjxR2pOq@T9zyJ8-8L!#~$x&DAN0gU=HoVzt2xilC2bwZj){MC`jlc&*U$ekJI3z4r
z17d|gj&Mee-={zM%*u45Or%lQ=pW!OdXf?FqSCCfGeLFGo_|0T>k%}BU#iGLJ89ro
zvCLLWF-X#+kGWV;G9AFV6k!o*l|_hJq!F1iTIe3FmxB7pD4;Q=6G9fWmluk&7FdKV
z6T1M#u@P1ZAgc_lRGLLow7PJntD~SS#BGHt8&mC4b<iv_x`S5cx77ZM5;3o43Jt!|
zzd^w0e*I)<#D9d=mI4HA!6J`3UP&uj>Fy{H&lN}D+k9CksTPYvuY}AAV5+Q=j%96V
zBZ44?Bm>_-NHrvd9OnhDw9f-hkMh(`qhZt@20Ww%GUgbImzQV>7AzqwGDjhRre-n;
z<0zSKUbK4JYU8T;61(e!IP$VQPt&)eSoo}7lO$2-@P7~(=Z=7gLJ=WHqxY5UZiIoO
z09Led0`ZeBFFFeo%0-UF(sA!IOl{ZxVMD?<NR~x3ek(8$qmODyD3%&dWzWo?$lB19
zvEWH)SVBO$!YS`J=|3B%eyVb#e>Y7!FoUO~)3KhN@yERK8&D=nGD*@a+=F0p;A|t|
zBiI6yr+@z>&JbvggV`A#!@=LE0%Ba@(SHgYcm*l%tefB=uoZ%EjPERc1t>#>2ELBB
z9XcR}Sa~i;1m8`txh6CY^x4BJH$eI~f@uuIGL6FjBMu4||J6ZT`J~_2jQ{b~qX&;_
z_W!}bgIoLmkBR?*Es}IO`Tl1Yn+LrFw3!(xPk%ZZ@E<6bz`Agp8ZQV%k-|_&HaQY9
zO0beLF!Aa2B2!wM1GvsF2bA*wF<Y5<Dm9pUqVvn6E(HE?-{z?i2XN5)R*9doh@mTt
z2pHXs!V#Y!tuVmk!ihEtaVXH5sgN8Bt_~fD^O?-Zz{D{j7Cel1RU3Lf%P@gdLQ4>}
z5`QZpFPB!|7YOj7xifH3fX4$`bTErIUc&KND&}w;#+X8wTES_`-9Y?;vy{<^nc3|z
zyv`(rv!uNO8JkiDiM(7QT#4xgWW$bUN-p4IrV)1&=m{++3XaDa@;*Q+fYpb!keACo
zM#Sct;YnxF0uIX`e}7K#n4@_Lhw}l+VSlJR4TLZqK`U&?XDS3t$|T2B8h9!Q)kKnI
zM^EFH5M@-6QO{H;(2q$OE^(RAZCViAz({mX&tK4{-Sse<%!5bRlg{Js&-p3b*T5*w
zOy39Mhcr|_sOx+r{wziY4D|)xJYOZbyv9b%S;L4OYS+XS_ktj}H^O5FbLUSmMSs^L
z!7!$p$ON`HM69`p63oysK?z{|Qd9!0S2aJ`)FQy{Lp#sTZBs}l681FPQeUq$fbUJ^
z0`w&^0u8ysKq=7&$OaaXsWB6s5rLw=qCCry#e!vsS~f6b49hyDI5Qg$4I%=`A;)F3
zBgOjfVC`UT6hd*qe>h8h7?p+c>VIIe9HcUhksN7h1mjGw0q7en!6lBw%+H0I$z=qg
zXH?}~>EvE6^t_k?bB<)P8lg{1Y706c^$0qb8eAP#XM$>d3!W3d#0B+m@9<7zDET<e
zGBwU2+zIP6@;rynuw^|E-@z;5Aox1?8iW)mzx<3?B#Sv5s?+{1!YIQatbf&^xdY2s
zt{j@mdQ1#z+CWXp>cOE}KzvOyUIi6*@X6&8i1p-h`8bx~_B%;d2CB*Ns`kVgu6oZJ
za8He<<vW}I(3A0$L>&$F<$}QEobef1SaYfas;QZ^?H%kKa6xW8;e>56^=knlPv=n_
zi|@}5nYkpmn6$+{0K1aFrGFrb();-9H#i+QK_nW$i?9HJ0DOh)G#AJZaGOFjNH%Gd
zEMp1Kd(4pr91IN&07ghG>k$xEM^kzr;?WsaLKM17-Ng+EyGS@&@Mg>#tr_h+n!<+c
zupdp$i&Epz)l0ABl{3e5)1716l$~6!wfa@RL3`iBB{QeVC>0)G!hf#k35pJVHGpio
zpvdB`U271zxV3Rk!y=6m%oRs1>h%1D+1WT!8uCT%<yN3VGrV^-Zc~9cE8@8Hkwcjq
z-k7)80>I~`MWNkor_a3GBMRcb_{>@dJQW~Cj+_bUpfu>h48Icqjoe8WIk+?1;A00?
z0zuRYH7di98M5BC<$px{1~Ke6P3-%vU9KuE9W{{>k_0=^E4*}Qm%T<vM=f-;u{ATw
zIJWN$S|1ljc<fT?agV}Ls-K3&ODFxw<<f{Uii807;g7H}w<N62<y&=fx$L}ipB3wY
z(~`ShWq5@|DuCt2*D38Fj!)S)UMAx^?V3n~3}Zf>xX?nYCx6Te&UKDKu$0k}m&@*9
z8SgAFmsE8C;6|ZLO|%4AHI4!8Q(8C13|(hgO2Uwobbvw*DmDh{j%a6$(A~%~{HH7$
zb@_0MUIyn7n-Na@|3#5o=zh%p#%Jep1tv+9K!NE{%!@dW7N9Ia(P&hoBD4pL{j^`r
z!!{baiH%`%MSlx9zlf$qS{S>7wmdr23B<XT{&?33$TOA!7-V3LnZr8Aa6`)sJfmim
zv@Nm7r_XU3I^jnIUIuiucoymo>P;J9w*BlRc)ALW4c7>p9Z{koyvMeVSGq3NHav|e
z)QH;s<(CGv8?PTVfOZodr{Ji*2~yk3RstmJ9;G<FaevUYLB>al#=QwVyTrzZUIRim
zcJ6Kz?sYvh2Xf(?W1_VQAS!YLrEMo;X#vB{b3B7-kstb~+R!`0H02>6)#E4uYtf{H
zU7mP=p=+#rv`0BKR~b~<$aJ@d)@+J&%x%zIi*%B!#1`X-5;Cx@X&safPB3=qB{CDn
zN`Q9(rGEzsD%AWuU|xQtbU)%Qil%s!o85{UNTv>WF^R2TlzjU_F1~TqxvIYVEkN>8
zJ0!I}yp=muZ{?ZH@{U1PEMIp|aeEvGt1IHTrk0b}*s|6a)NGZV(6Q`;%8zFdEXiL9
z+%4d^Y32sCX*l#73lZUcJX27<okxd+3EiS6Du2DAi>6;dM@-cO7Q|v*q^R#_7g3(U
z89SVS9-3n?a4vAp5ei?^46Dp6-=r?V4}0v-KuMOVdAbBoHH9vWczs6H0bK{8_>M_-
zbW9~Ol_M=iyrqiwg6@$h7@=vO7Ma~ys3m|jjjuqTXYSzJHUyf&?bwk%OA}D1%lU;b
z;RIX0H_Lx4o$eucg^fa>SIZ-UBfH`Ans);pZim}vF+z)|?IQNdM!JWU`UP|umyp%|
zj><A$%o@nHBZN~kKC5&>cBeRYQPac#x36T1%^W(d<Z=q*r=9U`6pCXp5_jK~7uF*&
z5PN%-ccwUPz^?eU&gdzIkGOs^YU1v@Tu#>marb{6cV#{5mURxAdR~fb`c6P#zc@@+
zAcIDJ#m{gKrK`7b*onhx&@2U?ws1SN!XZr?pP}f2jgMfk)P^U#uG&79FfK-(R}Ql{
z_5PLb8Lp$h`%=8;L9SC1)li-;8cE1EWPOnp6lvp1vKbx=xk3*$HsheiV*(JwKJodx
z`2v3&=NVnBT#Z4)0(sFkJkXnP?s23}oCRYx%~MTgpU_dRSX`iGfPIVM*j47NCVCLf
zJ@%sib5(u`6t{x6bZQC@S5?;M1M15qA`C|h&`H4;=voP=eUEy^vyN({3cJ*hIiy}l
zjLjlU*8)y!4PtcZ&g%nCs~|VCu>IEGt<Hb>m>ITBqaC%7-nR}Y&9b`nHoVV7NgM9|
zzW5Hp91vV8$=N@Nfo3HZB<&56X6Q$%xn%-UTpVxM8O(0|&fr-wxMNR{g*p&>7ZD(H
z??E_9WL&{~_}LGYj;4v2MM>U6;*{2@f?2Y-0~wbXROO12>7-znPZ=>FzAGjZ*bRR<
z#z&gcIYv_Jlz?S1$fH#2(ZNm;FIxGt5>%NqV#Hp07U@Ql6+k0`!ayup#6HOnv2VnY
z*&)eh!i_Bq;rNFWexrn@3qurXabKRD{KrqH!|z@``3KZ0`|<RLABR8w<LvaD*BYuV
zy#_eEn6bh3({ZjKgPCz*ynEOEB)oqFl!Z5*;zh~qtZ@QqSgPr?NU$;n!m)gDT8}JY
z1S~C%1Gr&yoiE^zimGEn$ky&dL8G$fJ!>>sTruENaYRu+&ZXlZPoJk(Dtj!o>XbT{
z^U{}Jw$F1gliGc_yQx2Xjbme-8LkOVNK|LkE1yNXgO)uH=Y?QYYOVPy#k+qp24xK!
zF1*75dd;uf*g}iua5F)4twDC|Deldye;gPdd?)HsRjkX_{M=i+k8l2j<*%03OE5*+
z@;A3ePu<uUD+im~!iQ>2QKT`qw60K3%OX_?%8L|BvsQvK;Y<Hs0>a&3DaFdyj7^6s
z8x>hHrfthu&YMk@uWSwyHD-UCcc#wVIzF~u2LG+|g&L!~k)M2Rd-2A7oGtDn?>$3_
z^q@OTe*Cz>4sE3cCRd-ks`I4Xd8*nA&cZtu11xpvSh4I3QLT=rl;*VD|M5$9BBRjc
zYMDzW$-Jh-RUpqBbdnamqNbNnaX-Hx-WItN^*HIqyosiO;D(%uk4b-;*ga+9#+(T!
zxd0-kov7(;(j=<k(PI5Ah>Y9Jh>y>V_<)Rv=7b3Jhc;wIG~ls0+zRs3`I42Ow98lY
zjCbYyIwUb_s@DQ$y3_7@1dzq$N|hUqQ5VdH$D0*UdCxE)st`DI7pASQK(uQ(PByL?
zLXFVrZ0C*RG(&WpBhi1EB(0kj`<gB50~E)Fikq6>Lt@!`!?BMhA(rQRl0Y%bdU?z8
zN<#rhS{K)q0c}kZb~@v0ln!cNak2A3mQNDK7=x|u^&8jA&Ddj$LeB^dLG_Gi!a-U@
zEA#QSO?8Kv>(rLRYBlDkk#OBjFEK^%50-=*-yq_l|C7Aj__%-7-0Uw_wz?-;J`~%r
z<pz(ep&YCuu9|m(#;hbiC#jy1RLw`)A{%MTT%?*P+9nCf#Wr&F0Xh?!yTy88Wb?q(
z2R0*{2lQLd$+nsY@U!P<Tg?OhwdW*Q%>(#J`}~a?eKjYlzSGz9p|(tjx+Cm%iWXNb
z0f!!7Hh}{=eqeu8$vzqQar$sH8LMfOM{@}Ub*K<Il+!j1Rio*t9F3Q{(^0`RfTA%X
zN&9R+LQW2a?&x0G7<oouVj@mxF_mp786YX<9HJTd$wXb7+)_3Mk)GgZh36Qx4r`Hz
zY78N#CUFFh1i%#n6On5b1H#)y0qGK=o;=o=KK2m_WJZ5pm5WnJB&(&8wWN^MQpai<
zB4&%Rm35mkcAGNxFH9NxJgH)zROKuQ<%VisJ|R^#OxMb8cU<($;Z|9=zTgT;*u~Or
z-lCh$rMB9->G>`A`{<|K@Tn^6`a@<CKXTgjbv@dv)xb4Cy^Y%ucmtsV&n~*-rOhgP
zK6rdA_9}m@WXnVt-<L9)pxM7`CPu|pSl_wLKKvBfho36z@Dp-)gEM_M&m6b&9rdhJ
zdgPduc}d?GuUpq8r`xQ_o3bW9GFx(YN^xD#5PRSefOU43OL&`x*^q|0Rr+NW>YJuK
zowzH6o&?=-cA<?v7Oy?)aCRc`Ah@%$nW?+3gQFjPr}o|c?0vYizQw${{dfEC_TOjx
N_rI*2U#S4#7XWt~Br5;_

delta 197796
zcmV(@K-Ry&xeT?a41XVs2mk;800092?7iD|8%LHV+}C=FFzmJg8Ay<_Wp{%`t7(e1
z*{uVIl*-dXvw#3HKtw5#na)U%f+eoiSM%S`>UWq&nEQT|ev*IfLqtX%a3Dpy%e~B1
zWs#YYaon+E$3A>Jm6JE}QuRY^^8O^5&y%=6k#Q31iHw53nt#8$ho7CDov*(9QZzl^
z+4<t@ui@PnkH6a4-TmsToiD}T?d*QJv-`F9yPd!L4Sp6Tm)YO#?A*g3cXoD!`}cS9
z)9;JJBwc3ua+Zr%GbK)*p7airI98Kf942v|>G2{@GV`F{7iT9=|7Y)+o~YQU-f^hn
zTu-&i2I3%<lYg1&JqmUnOp@5-;?R=N;UY6hb~c%*xfJ{2-2)+n_(X>T(MrQKEoiMz
zC0kuA5h^pubeiiV9*EY<RQ|kB!l>*@Wj$@oLWLrgmpYbELQL?}Kpe%BBveM^GsVw(
zQ>~(~pJsY4vt{p%T8cC=8omm+seGBLfoPdL)A41i`+wkO4~E)<AHfp=ZD<^Bz7%aU
zlbH&|wa#ZEU5q0=5px;qsWQ3g(1%b1OeVeVC#lM0o@D)J&z|?Da-!o)F{xJ_i03-X
z5~zHpG9^p`BZ0cyED04~sVGU6kZ~xuCz+CAPsiyZ7c&*5Dl_nb$kf6poD20<PI6)7
z94j-p7=K1c!!NbTp-0uR;0TjNE_9q{Nw~mnOEJ;eWD&^>s?zf`$?`z_i&Ck;sTM}f
zWt{7Y5jqx8GI`T8xk~-n>gzaEZ-d+f57b-uUNFtL895Fs1XCslM_jhc+L5A|CK>dx
znA~;}E0J8sD(g*>c&aZKFlBNwNfvS557m{PsDFN%B~u-#P9P3tD#tp~xmE_}_%f4m
zuEK`(!V;MhGQ3h*u8j&sKFgBD<xGseKYAtlSG#?h>yf3kxsIQy_%fdj#O_M!TQMn5
zwMiqnd?Dv*?d-h7vCfr@b$mHpL?V)772(9-zHk)=;)S|W^wi`@CNEVll1r6|G?EiF
zOMjwJWuiTb)TNv(M_n-r)l@E`e8{sm>U{9HlI%D(xr`_3I6R27G;4?URHd1k$Q*Yc
z%shO7BO4XN8tQNqh@-jAp`478_|oW5Rf~vl0bRq<&-G<Soa9=^VR8*Kb1f#3R&j2`
z*$*#YKYJ?lWt?QNpR{382l9ZuSF2jbCVy8lyw&VDo^!-Id>|qnzcB?v8R6f7QPFfH
zvSbm5y*$$?@8ancI&h^#rhZ;1lLPmVJO*Y5Kt7hE5KEZID0168Q@AwQVuI}8=Y`6a
z!sIenfo(fhZ}XAR#<F6lX}r);j&qR^o6ZwEb$ddN4YUs{6fdG^B!DiBh!ZhgWPkY#
zXiZ+K;6c9+RehV}Gci~5F|aV$S_!Vaj6@QPIEj0aHqcL#Cb3bbE5?hQh`Pofp*qV9
z$0|y$MY@P0C_D$oG+qiOX6CX)P-Z4m1>;-9dYWYO3Ws_Ild#QMh6Q=`Wf*E2#YqMS
z0q~81n99f~Dv)}QsZRKTsrLWgbbl(+GQd|om{Rfj^qDv9*E1DYXC1~VucVITI8v5Y
z?GI7txg$~0f{I!fMX8(OS0KrOcvtD)QH>;_PsE3`amyIAx|RK4tG+31mSp@_HOW_Q
z7UW1`u5wxIm_vBxD5<AoB-2S^^4?`8Llp*iO6yqXT1Mh3naD95ZA+M%QGcAoYShJ@
zr%bNrz;{MntYU=QXSBzYZ^ZM1e-&YJ9b>gZ+7T-}KSDgMp`z!n&t3^N*SV0uG!}6_
zbYF!daV;}o+Coo(B$pygYDeTE&i_Tn;Z_2bE!-$m9Tu~|bBBKfJZ|2ocsAe|MW*sa
z7ON1*h(5TI(ZUgqiWhSr7=QR0$i+<={sGfviD&cCu!!^LDwkUi5(<CVZhNESa8RAz
zg1~_WaJ0z$k~mrl?|{Y4HG(SewMQ+u1Bq4waYnS_R|;g406FNqRtqjeAbwQh4M<n8
z65RJ?!51?L+u5%&pUGI{OC+NlcrjObrKOM}iPg&~u)KqR{xk6QrGF8VnUd+A$QE&~
z=SrXi;8$2|RXvUr?q8tboDa`Au9`Nvit}h0xG!<KfGNy%tmi-*J8qxrI9Hb{t8R4I
zG&)lukP&pcLNFT`z!*+Mlnmeq7xMBlQ<pMV1v_|YXU!HZ$^hR8WiDBMgrhJE?QtW+
zKpY@lUAdji`~+qdRzYS&t?tuW^VyloOwLuVvOQd6;07Q#W-3}*hMYrP1+z#pct%SS
zEyX06r;8levuMXCt2xr@1Y(pYxr~rlWOOZ)wFW1Dgbmh1qG*GJ1D_A!&moFGqYllZ
z5ec#@G1XD7G8J}7X6~6uk}906Ns^@tIESYoK@}IbJz{gvs_l24Tq-=Fl1z+29I!Lj
zmNCjL^E6*_g}{pitmGuZdr(s+yHJsgg^Z%!B2Hyy6wIgBt0j~(ZZ`3v5+?%cFu9zk
zreno_le1J!1|msSY*IDpPi8W{R0gyrX{2)1Q*YBK$yC-e(N)^hp^{M_N*er{elj&x
znTjW>r{Sx)igTQbp3EjQovTT{$P|7R%){cd_Qx$asj75|3<Q{`QLE|S(srv;IZb}V
zlG}3HqV$KcT95pIJ%E@6zqLY{E2OrS@&NpQIAXoSx46Q0XG!?^?RXL&=%%a{u<{1U
z+ISzeCqL*fgi(1Q4x<EalqjegeHjl#40jUHZ&;pzSD;wDOjQh|DTp9}yW6V^$^Fq1
z<Yz;S1nQCz-kP8ukgBILmyw7PV|1*HvDX*a*J%c%mC8I<SuEx<pUiZ8S*0WD{9zJ*
zs;vmAC|;Hw{8NVx%R;6KOG1?=u!yz_E(5;L^uF;qq^qx06}4KWqy70J%5~2qi)^B3
zTbVaHO|eaWI#v^DwJAk6Or9w@7fI>7q`RRu$jN1zMtXu1pC>}+UZ1GuAvZOQlYCf|
zE_d+MUg;K40Q(gdS7G2kGS{fJSn{2J*eoV9AxpA`y`(1DQ1hJ|ugXP_iaLi_%Wz?;
zQ+0|A$Oz^@)GcY=s1Q%iIo*&!0)cC_d<)x*E*nPwLWgHbR;f#u@XWF@{16#3-WZ&C
zT+pZVt1~*n%Wfp+sW+@h&vib;r}g2`9Rv?Znc=SVmzq0gW=WR!Q1PYlEJBih1Adb%
za=*UuBD_?&P;Vzng(~deWr1jBE;V+ZmfeVJ(D315pTuSn<tp^L%zYVV3SOCVr+I5g
zj~3`An`9MQn93*`%gGz=Fi(MBmwKDZI2_^>bztTAK22%^)_jbWkk@#LnwIvI*VNE9
z#a-P})Mr+33$F2DXAiK?L7iWJm8SPckepB>z~q)GJak|KOQI6ge|nm<E(%Qzd(A0?
zaKICl#U}7N<CWoKsn8RxImdia);mKcNt~;<d4LCkpp(f_vyzip`IMQ<rC+1Wb0`w(
zDGDe#@iD`sGa|ADC7@$}L%djY#fZhhptQ62I?-@@2$RVI<Q~*Hqgpn9WX+4&bE+7>
zE*Mw_>>ah@e_fbdTrMQ)Wm(y8wLV1`LX}I6hkY}t<k>=XE2ns6j@J`{(eWh=2*!@<
z4@zbzMf^XN`K;&-K7-DzUeviVMqaAA8s&$@T*f^(mhcz>Aybn09EcZi#MqOaH!U6T
zL2CmA*)zpmQflku4ZTZ$_le?s3d9kc4g5OM5CJ1E1Rvt0nzXdup@jzwsPLvThKp2j
zDJb=l^fhqUyTjYtLD=`z)7l`zO;G3%EuQV$Npq-N8iP&4S24{~6x6(z3l`j(HIr5?
z8I;tWP*+vsS*RtG2JNQ^llZe-%;Xix7V#CVKHiV$b_2SvzFmlay^1zehM`l2LOb~~
z#a?0?6IhyxkhkqM;lnQo*z-YE4OEbY9TF_O&ehxu%IAn9e3@l(S)zNo8x3kVpIhr2
z-E2BSIF3O?mJz=hpk6#QaAa7m%~)PqX$I^tU~4a^g6SYYeIvDf2opad_LoG&=|T;>
zVGesG$wZ`cmBA^0kdP|h=)6Q2P+6XU>R-tm#n0&?CL@+@_*-dIu{>?B<qoe2iDupc
zp)FwGYr}mumdk-?S~jW~77Yn%AiSpBj@^53gS*P@8l*?Z-o-JjH*S<G8R-yNiQ8#W
z1b1(ik#Qb@JkHnzCq^@Ah9IG$K7{1VBvLXKGiiE-=A0OR=w8X@@qiRz$mU7yK24%1
zx$Z4e)M_Jpv?>->7rX+t#~*oY;OB+Dk|?OM-h}LHV)RU#+|n0!T4+>y1ck}e=>t(Y
zVo&#)>DJ^LEjy&o;U-XT6{|hGNfu>U$}`tGpUi+<kY5uS3y@k0Ee$aErN|S~#OR#o
zXhceJSo=|bRby=jULT#<7wuw!I%5AD(SG+Kj3Wqw6;#~<GHP`SVg!AN$3Kd0tYIFO
ze7pmP325DkW7!BQDJ1-B>w(`RG8Dmql*^T;QD?8bDM<F{v4~gfjuABBsGB8}R4$_g
zZcA8t&lvzM;{j^o59C}~-ZSd+()MXtedCCv`yZ))A?#`7YaQT5Ggm-sB-gE?i8JhB
zohm%e(8Z<t4M@aid{sIrx^RnSzT?tjGyREmLs<IE5B(0HRGxS%%ydv%R4|ODI>rli
zV%HQTB&@zQvQ|$xPLeA$^e(cgoG74jA<<2Qq{`BPvvMJ^+WJCP)^6>>w{7Q2OJ1EG
z1$t6{Z%&?)6uQu620Dl=nd7)FRje{SDIXui|DvTmF}!KPYFnf7X!pcS=Z5d@SXD35
zZ%8A7$4habApi5u3v2D^q3Z$ndd|*C5~NwY`@><CWVm$XujG3*p|Q|8m(X{3QK#3=
z*TnNPfr{EjsRkvrokIPK>d|q5cZ#09Ty<7|t}S-HzP2-+{}!B^mu5BZcK!HWu<k-F
zU(oOYKhsG}vQ3%4J06Rx3ruycav*Lrv57QVnBv-SnI((VbdUi=V6OsA8vFR*Od<(;
zLMF_Y?NfCF1md`4qyU9-meJ;+KA_2o4;X5R&Y)GqWQVFglvfmeuCogg)z50qam7`C
z*Sf$JzBQ!naA#+lC4XgaF9~uUZ2mwTOeQMD+p7^uqnS#I!!xj?qAwAt)WO;W6bSNN
zp$ssV<>Dy|4vAz>L=~e!Arh^IUGdLnFJFjp5-z(B_y+v^@I>TE5(ykfuui#R(ui!c
z{TPfRk^ZHwum29mdIGbt&5h10ZZCF!@$%)=SJ-c_yDB@h@D|?wb9SdXrtfx}d{%h-
z*Bn(Yn!F&sBS$W~#5je;+6U#uZCutsJWbF*NsA0B5|EHtvkGdtnT|rX+?l}LCr4D^
z{KC;(606=UNrjFh9V@E900k29vD(+(dkm`dNCu1OM39#fRO9T>2d0V7jPIR)NG*zq
z=i<0W!anT>cRqp^!&JPYDl~M2b!|;UUh!rR-}PfZl6dIn<e4Mg<)!Crzo`VJWiL;9
zcD{L1V%TopB#f6Uy)$n`jTK@mEh_2LM=;Ygjqw65_dq!%YACE8aMgla=v>B2e@$7L
zOPrq1ga7=uf2Rj@Sbz%Ejh38$o3Fsei1ti_-2!J1T-btmkl+@`3(@C|nUnPbA;Tdy
zw}{`w$#q<!G?-NK4;B(<A`}Wdm)ReMOhD2}VKmQTDs{BTnknfS%-Ai-srY8C!pXDu
z?yj`=mdWwNpHsUou$*1-MlFeoN|O<YKYJ@uTLj;jgjN`1MflR{jpp)yt)-m`$u^K{
zvz}^1ZWzT$rq~Id{WHW|rqvB)&$5`!s7PHTOCr(tiGKSmGj-Uf!n(B!vl!21D%zuW
zB1s2Ktv91iAP#`DD)yM6(gum0J!n_BPkW=~xg(+==cHS(sqb*iw>aut@%1F-4wu?d
zNXOy&6U@D*d0qX!N~N`b0#zxt`Iy~iApQ>;n0Rf;$&W=JPfuVb5{zI*<tPmy-4KNl
zxv#32cR_>b0z>LeW@_>V0}Z^xj3Wzh0fWYh?J_jXeA8?<&T!MLUUX~C-P9jdcjAiT
z7p0p<o#QlYQ<&C)-P7k-;9{RV5d*hI)dJ^9S`^|P*tq>B$z0KYo!Q@UEDR5QIbjpi
zF-b;_;Uo|HvJ$9MdugVo`Yqhhv0*$vaCmUP7`Q6-dy3q>hBEI$Ay8Cgxd9efyuqnc
zamXHs_KdgBP=$V$WTd}fGv*eYrouX)hOHTgE4;0Q%q}$p(fUj8$@xL=f63l2JH3A#
z1{a^VyVWP1ho7{6K3J$;)8hKt?_1_RD+mHtSD?3>FKV|}5JRU#Sflga1(}}lB-21q
z)n#v{a8C-SKo)ygHhLJ@uq-O_!>d;(VswIjeC&0;9|XaO0uE%zF-R!-kb4emMg5B$
zYk^V;-d4y!@zQvScJU^k@2v^3DBUP$pEeKhs4z;fT+%duOz=p4@BFLYv#%=+nmp;5
zxmUd5<4~OaaPaKeX3zI~aVGEg1xkj+C7U`|*kGJP0Sf4F#ptt&4h%p>$Xq<$*<s@g
zUPzqT&Khe@oSyD~z^%Qo*OZJkz}1QI>LjK>zSMx{1^CneU(VRSBJ=&KNFxub$K9PB
z_@uKZTrKE-)Q2L_mC7>EE|PB)@WE?cgf#IDsTRR<8!@{kV3&#MIs11Nw;N<Vc)(y-
zPkH?H!9)CnYLso+b!-6Z;DV^E4DT<zJ-_YB7n(M7<Rit;coB!-v+x7iw9v=f7&RY9
z6w+uXON>wjGh#)KQ@f0?8oS0$$;{!Gj?9b~N(FI$Q&73Rq<b@G?SltV)EMlv=ai5=
za>q2*1RR0tDKD)rQmDF8QP3Ey3KqzC5-mb6rgV<(j)nITbuW#Q<=i=qqVG0NVKFFl
zAu3igQ+)eok|XbPyW>{q|4x+*k6|(kA=Hsz#UH934%+pLmE9Nz8v+XLr-f&Mw+Z+q
zD&Ply&7sT8mhjp+s4GAG*K~m!thm=wNjjYdbxoXo4bt48etV(U+(2{HaB>c+!i(D-
z33!QU@ISW(Uf2vJd+>m@5+KXj{QxS-9&-$9{V1EYi`{1MUZ$Krc#TP5gn^dD<q+8$
zo1>lMkV&ixqEO%(wnl>xTI`8~fBrLW2aI8Vg<vmk8C@V)u>l9gB=4~z1b5>GO7-|V
zsHxT4Jd<VWy}2I?$hu9^EtyKnU0CnD(%E~kF8)9D@gLL`Fpi1pPm&o$DclPJ#9I7^
z-N#=&epJJM_+sY|{D<Es{)2Nc0*-*3wvAWOiZ>C^X)<M1(f<B^aXbI?Q}F_S4Yc`x
z4nifAt>Dv7x%@Z#Vn;j?&%wuX8YM|)OAG`=siG6n!-o&VL-65bg(Pl$nXAhsN|z{{
z1B)w%&GgBQF3FaC6U)@hlDtpWxIBrW!s{6XM2seI7*8<7j|6EO76=U;{&4W(`=h5$
zs6#&=P<SljvVs&UMDshi9dW0?>h>Lfd0!gU1>r<VvvA=}I)o6b5p^4!G0^-6f!^SS
z2o<)$vkdP|9UBW&7`2kA`0<CM7vjZBsP2mDdhz=C(dogfm#5;#gEMjV`sC!<@zK*g
zsH_;M_>=J4$9p%$h%RC>G8bxX^lb;*cBYJhfG`Mj6A$UqLoy;3nQM3*kf&6Cm?(;w
zP;YY;qu&B5B*EnrJdIp;=@h5MU=Lj<6W9<5SPj*MyA|pr>XR(MdYFX~2w2G!DzoIl
z5x(49W!Ns(4#QEvApt@I!1<l*?x^^B$i8TB28|Surp(nD8e|SFV?}pqB+(I>E{5c>
zY_Sz|e2J}vD$-*l)@TWF1tiLUsVfybITR|1lb)L(=K_a*oZ#Ffl53=O&;`Tvi=vS(
zoUd@za5Dqd&B4c7PV$9}qNOl0*Jetz9jZ8S&LHApzu50~{=UVaK=QCWMQVRFlkp+9
z*S5tf{J=dYW`JtIG|_QBBpPms_wS2%^HSOAB8rA?->xZWcl3~8ONN<$nkb#->%OpC
ze@MQ46V>VfcX5L*`bqIxH0*ZqxH8P*1&`D2Rp><RZKw?>Gs0G>&6zZ><4l<(x>Dgm
zo`cJ8+j<k&_ViS^X933;bv${)vf*r@_DFuP!ZrAWvvO_UW8$tderf6TQl_S}=a12T
z{n7qDvSZ-e_SrXLr-3_@y%!S!*OSo~8v!ko?H54-%abn{B^lRo>$XjG{Jf}VEq$*n
zRw8sJj;Cq@+Kp?IZ5SGV6WHzaQG2R0lT$P!9FeAjr-=}|fmpbm1raf@wL}}XkH9-h
zj7J<)4?4z6nRW!k90Cbo2V$z{QBa)PR@i_wcZYV<PwyLMw7|KaaD8G>oG?`P7eRyd
zTRO)SCck>!e*eA<Ai|lu2$z05^5R4k=5!Pl95duPs^fed2$m0jlB}1EQTrE)LSz6X
z$il4e%U1y?%X0`T6_J|eT~t^Et9XKF><d(Nx`>o`Bv2Oyo^lFwuAr~eq&pP9s4VGG
zL>-D^__erFnZ_xHwZ{0@0SRVJa@RoYu$9Bvco856=dj&6E<{T&kWpq!s1K%CBSIHU
zH4eDd>3VApW?p-LhWC95GntB=fX4TjWjUx&$5%4b5;PhsCJW`Q4D>c=@rNKse9oJN
zdtrCTj~f0I8O~#Oo$%#}L9ip)BdQRyP$IGNM3*2V$jOumYOqeest8t4SxH!PEP*V)
zDB+U$8wlW}jD6s`40RF=QJ7fHPM`H~eK0DMItGGcdsGvDK1TgfS;!dmQF2=$P>lMc
zy5KPC2nY?$6M-QI;I88d?f$9fMYsC1=*6Y#taJkbm1;rf5mFn(Y;r(&*dw`|*RJfM
z0ps$-!RE7Sg$%p?wCeYPpB}_MOHDF#0`ZtD#7QHvMI=#Qq(F<5C%m=cbhVYCRv1iJ
zw7*g8FJ>)&)Eqwx2i$rIso`9E$L(1~4UnKg9e2_BA$Pe2Q7To5$uZ!4vF?NxPoD4%
zwfMA<I7^?}y)<<1OW*eUaLOEPIA?4mK%OPw1)LXb%blP$B%5ZK{Lm0EfIW^u8(ij;
zJ;LBX3a;=}2+%?K$yKOx0EfaLMH)sAtbKZ_Cw#_#fH#vY-)$|F6OW7*+pE(bDnvYC
z9e9l?E|G;AE?O2~3GRUNYIF1ZMlG*lo8$>F^_c027OCi7vrz2GPkW9Gy^oq?DqHi_
zx@xbyI*Z_9;%wcu7hnxX>59wmfBxIQmjdVQ+JNN>M0H@6JgL&V;#!}K(TXc^B^ERS
z38~9}`}<m6d3N{l(y>2>xo6|0aC@6PNh>w3;Mq&M2s8h{>w<T3;X@)Qvb2?|BvS}S
z?Kd%P6cnz}a^kiH+ykx?@2D@KC6RUmjzeOqgpAN3t~MezGom17%h6G2b*!uu`Ao-}
zdqh-qRU#?4UNs%2or+t)MpkFJ#?UReV|4|8yW@@>tX>V`8nm<;QAF{ChPV>9rFC9{
zrm!vVIh?xU^e%|@8gVU1wb8|@{X<ZfYHU9H=(1KiRV!>Gxvs|XTUqv-eP2*vi*j-P
zAa#IGLtJPTWk$16B4VTrR;;-BfW4-P*V1mmaU!`jFaCb9_@za@wGyWC{R(|X!^N$C
zvyr|i#NLsY$F+xcdR7n^AB;{i-ggB4<ViD|<W=fGft|hT@m|#AZ;(>&pWJq1l)fI^
zao9KZ9Qp#z^3~V5lGC$y<-olL_cnkoE1kRO^95v8Kk;>pn+FVPsP-@9CfDv76~M}Y
zR%M;~Aio5_g4<j>K?IJM49*9~+$@Qc{u~DZnv(_{AScGbS7{_phS+&0uGNSC7}nU`
zm%%lEI@JJR1*_9K_U_GO_e5d4C6i4ZD}RO->ebYz<Es+MyV<w+Yd)Eb)lB2<IS|Lw
z(h$l-FA?EYvNc8|0A<o8??8NPrGjX=XMLWp<&v!gtWdBRH?^qu^2&QtL1Vs^KJQ6M
z!wqLgOEeOZ7Z(5P*#B19e{tCWmkvEaKFkcf-u}D$#qQ&({rB-#J74`_|NVX2e}8TK
znL5*;D=^yAPy^3l3ot&%1IIe?H87gu-s@kw^Gwg@C>~%X0sP(e?q45qfh{UTKpYHr
zVcAVwqjw7dbj`s;M>kbaXE+o|K^{oCxK0*PC=%c(*V?$d>R6%wX+<1loHCIAKm!et
zT%a7Yy11f~&J6xSzGy!M9Byp6Z8wJnd<2ESft`wyoyaY~X_Dlooxy+o1^DOyJZS@M
z@Lzu4Fjwan^{F>X#bO^Fht5=PCmj@hZIi7Y9Dmz>nX3F)vP+x?K>%M}1mG6c?s(>f
zQxz^i{lTtoIaxsqhbAx{bv*=aJ;jRxomYrpZWq<+PY;U_Yj;}XU3M<t06+q^L&OBc
zGbmyy9C@g>Y%)jdHk^b79v9@UNU{)4v}-^LHL08^>|wY-Sf*UjY?Jji#gq-sB8}}#
zb$@)RvNY3h6+)ofIO!#+P@%RoY|=%hlZA<vs9&aVF^U^2tZj7-p`*1!cXFJ;c-uJY
z64jNSY~16-9`<Y81WzU6DZVm|CSbox`&^t57l|Z2HbHGL?U^7#pLrzAoh|xV6BL3V
zAZ~}33i|B^t_U}sk{egM)Z91d((+FDoqrtgcuHU2ctm`_C=FerjFSGw`G69nagAE7
zR><88z__Zdp@2Q{O@gT*oM`UUwQ@ezmy2Y9wo(#0ugSZE?rMhIC`f@sluziS=+gi=
zx5z-pOWqOMkbjM@od%eOY(dFMr1hyl>n*v>24d7&!~`?k@@)s`4b&ySh}^Tv4u4qT
z-DBuq^1nBpUeM#zNkT(NGfhqrwke*9IjL~GZ4xp{8lNEAAX;ta@~5CCr(yF<%6sO!
zVwaY;50SVd?a-(5=6&Z8dGT2TO&8PH;0z!$+*0-!fZB@6g3`IpplrDb(uJ9|NBDC8
zlXunfH=|C~DD4;Vw!jnKAFEoxLVuMOyw8KbCOU4nx~)#7N$abCRZ*e6R;R%?!D&yO
zvWERy?cXB?TVkUc!DmW6M}%Fl5?R_B*{%1~_vx`gmp!*%iw)5gFJ8W)bT+xvF<tq=
zso$#EABvpJmY3)*m0d3Qro$v^yPV*b71yBn0Am`SPIJ-|Q&GZFeJEm?Wq%l#0Gdva
zcx;Ld{&oSz{%Mj;2zk_<P6~Xvpjr-JL$ks|dkU4yx+yg(M-3br5gD;wdOgC>Y3>jj
zwe04kvuX^^7!UxErI{jcd&|pwHbS#N)uY}Hsv=E-!`2{gv!%zRkk1eR`w9;Z+%YH6
z*Hc7@F@FX=(6*D_bxft|1Anx7yW4L&c>1g<=&JT8_Arvh=;_jPm2et+kHZl+UKqqQ
zz)S{KuQZhtNXkS+T4>`HgNP9hH7Ge3hEOo4a-5;y0gRP4JF?+f5+_7=P(SYjY5PPj
zl&)1LQXveXp4)IwCz6b<)P#urI39BOL6b5H-A>tI@U|a{5ivA4V}B40epCx^r@1wh
zc_E3EHPJJYCo7c_5Q&m*iJnkwTN?1AgFUpQ<B55G&bJ27gJ1>I=hY&cs>ie&jj6vi
z>#uxQ=kjO+Ko;90NF}>9X}=oZNJlz2igZV1Jgfk#-b+e*wp;;vhIJQ!RV9R1t`2Zm
zc@3vZg~pkbd~j_$wttm}8j)Dl;#$ofu-D+R%wJY+E%=nLB%s~lhQ+|nucJiY#pzps
zh%9?Hv4~OjVJbq73d?SeN>0l#NInUP@s>+Y7FkBuP0Iq@76(B4f+8_~%eXK^MlE2m
z%b67kcaSRAg!?AReO5-QN30uzL7*d2OfzL>J+z`_V5&uLlo8_QbEUFS15EMKJwqvQ
z5v|yhQX_DGR~&ci=1+wk9~qR2xOP{cZsj_?I%p~f+z9>ktE))=TmO{wzhN>leH*!a
zPsv|5>3_f6-TkVj|NY{N-A8}ue}9Xgk3Z@!Ox7RkxUb?X5htN~aPK-{a*qRZ5dsfB
zchIvS?3W*%%4=~$=UpoZ`lXDae>JVWqAr(7r&L{k{b{8}SHQ276SG)2Wha~Fi!@?T
z9}BdPhI`<cm$6OjaSA|6wmrBegJ%gs2Ji`La>4|M=<uL#)dfM$m~h$vG$goPQot?Z
zawDoz!0B|W^S0kGZF^j{VP5u|r)96u70*>ZOTuquc&Xa-d*#wHdid~@cl74w;loi$
z(QE-?uAhPPLmTh_FtDTubnFVFK<k-<BaDASN9ZoGFV5XZt=2_NmwXN~eV6fHE<jFs
ziQ$a_!#=c&mP$Hftey1)J@M1%lXp<j%}*oo$vfAf8}Z3I3eFx|a6xLQsxk0tYqgUf
zB_4lF;i|Q5DR7=YzvvX&!?{e`_AN%A^6!DIq4ovc%iC>R0Kc+-cuGj`;^6mYlUB5B
zB(M)#t*+n!2SHG(4@Xey%%~?mdFOhB?_s^@ows_U4l8WL=K}RQ7qzKZCjT}GnII8L
zu}*<_#esKQnmin>wm$y&W0yVwDgaQ5R+oSJ2!98di6hQmEmH;S(Bixa(7pa&O%k_Y
z6rMT_KO(Ao5_rVyb?i3V!K*G<u{G)>2ju2|SRtf<VFV1V$zG|Zl^d;CPq-8n6xG3-
zQS0WG8?o#q<hAM%SAEAJ=n3{gdhZ6UuJFf;nGt<+($>`<K(GPuc(}+p{MbtM2nc`F
zDKQikf$!f`w99t55;1VEyp^l<IhZCHz_~eo05W)}-r~NgAOiu(TTanTXXTAhUgnzy
z@=5(j_<GeV=>#{7H<{v-ci3z3x!AoKj4A|n4~M~Os$ao6*HZj%P4)HZ-<mvySV{kO
z<TcvAWdkdBfNh{e{WzApAFWn6dy0SYht!ApW(i~T@yFtmck@7pHzSW<&jS`}@Fifl
z0&n)@5ZE*Gz%1r-nJrgH7w$cL*Qp;JKZ|`a5BOku5+JC?liDtUmVRE*LJ$OHDGLvw
z|4~je3TV_n`!mtdm9*Ry{MI!0CB0Q&P9W`1sVnKquGC4ZbYOe^tDfCljZc3tbQ&{6
zcFS7<pJ_nepDqH8HL(n6(B?6C{~k=O>%~Z@twD@L95WB-2kL6$Lx!(>B3cgInRvkm
z37HPE<yFF0kn9bBYPH>quE=!`=HW=mu*(QT7PI7C$)AJAA@*&lpm+u{%ukC)JG)=D
z_L}#W_~ae7bW`0r(C~`Mq&|ODHjF<3?;(%OED6PXqOSLhc!*Og&S=Yt_pJt^c;Dln
z_oaU-zrSxFl{wIdo4|U!hLKZco8I?W15Q$_6J#ol<V3amKfUk6eded1Tq{*#dN1si
ziZ5Qwi#j*ry&&eq49WeiL;CBJcV0hk#QV)uwAB#H8*?M4ZL+9R6(oP4{}flk<(p5s
zvUiC8$k*l9>=P^mP5fL%{*9Fe3-jie1opn7Ca^IyRRquddf;z+1$hrwkV=*8ohJ50
zS+e8L;bsp;0`E_*?R^U%OuXlGdx)2%Z8z3rkI%hr#@|pv+>*GcovGYr%XQ<R2MxA(
z>zYT!7<sLP(z2q7xsHFm`uW4n4KR+}HVw$PegpJjLjzpEW5&%DHk50iX)MnR{vZEO
zREQdn^TQ;0Gft8>?TX%{Kmcuh40^N^&J8}{@*ZYp%l{p~;S|B6+LUd%%rJs<=JGvp
zI%ulVCUB8CBkG}c-1GsQG7ztlH;S`Me5+&z28783;%RewLB@Xs%xs9g#1!6uDF>=A
zNG|*z|Mwq6`&4m0Tn3}Zq-W4-2i<5E`7FsWKgktA`f|^faW3DAUIjADg4X^Cjc4Cn
zU^4Q`Gk~%kadOC#VYC-!8sg&#p)AP2Y(HfDVNS<FZwQoa)OCijQ7Ip60X<0;Z@VrK
z^>)qClXEbEVW?nUmMKJyj3NqZ23r<(ZjbHc<Vp^mu-4-L_`m<q#mTz_^Gj@kRV)7S
z$B@j1v+=YkcT$pfRu!*;*gMoVGMyFyf#`-sCa5b-Xv>W8IVM5?q%@l>%F023c!@S}
zrjB-#6)H9%xzg%-ADsgLi4;Mkp}wA)PW1%qmzNm$Z6}t&eb!X-DU)m}B>_2;k}55K
zt)#utXf(_7)PGc-q7rMOZB9<E1IteSgp@E$vLUVP5Le=xN-L{6@R}1Y7ijej<McSi
zG?JGPs*kQyyzenNt;Yx8??}A`UNa<kS9oI7TtXHt?~yF>?~FPep`St6r=H9#ra76j
ztBHEZFV?XF>bb?s%rh;co{YmD<wp2_a%YDjVVQ!Oc~{>)_gnKGGebkDSZkVqoylOy
z*c&q1Ta;l`{+Ccg1(4%PY5@2#+&7%!0U2hIV3@O9cm0Za^Vm%R)er7WY>oSoGq##v
zn-X7nqk(=f8m~3tvy)y|jF2s1h?B)Bg&pVNn->mXXv|@cSUekqm*0&@`Ff^*BPEhK
zCGQcLy!Q42UK$yKavUY&wTH-&2gSdtm|w=`tReQB*i-x$L|jUH2rg^U{t34<5U&Z4
z6QatB;^<NyW5|$KxP;VsCkDiFOrE4eNWN`y(`Wwrgrx<T?u-3{bf(^lSJyh;Oe1Od
zGm*tmjwid1zSxpDK-GW_g6!pg*hUZpx6C-=l_xfRS>W&&48*$0*(q}sva4w$pWxGx
z2@{f#K@?~p&M2px5BWb3qsttVcVFhn73q%%^3)wBDw`0j7=R=jo3y0Mu+ErXOA+nD
zZ@t1r&-_Zu$qu}W6rHMvGQT*#%+<yIqn$@z^>%i9JG-xTb_V#r|Me+<I==5qGueI#
z304>J3PJyKC8Nzk79AE9=>Z@1?TIqtxLq%oCJ!hG0+3=!3`Qe0y1_-1yRblUV6_*g
z*TJ)mF$YFGZ6lkH!zV-k6xfQOC<@8CoHdfy9s=-IhzrAEs&Z$ZIPr=`?&!}lfY>9&
zJCO{|^OK+Vb$pfRiQ*%F!JJ>XQ{hvdX++?;suRtZC8GJ&_`{hM4U-fW7X4%?`7+3W
zMYpYR*~ZWemc8wJ`?iD5%9*0zR7Xry>SBb8!Owgl`(jk6VfVx&ON{Ax@F3i^nM_l>
z5H9irLXaou*O2lW(#_yAL$WutL@u!uN3)W_+3n<|g#~OPHl%QWq9|QTDagr>AclF8
zfEO@@P`FGTfjF@#9k2k1HhOIRO7W4s3K}otW~MS3V;&isJ)1ZfCyDm()Mv|arbA(i
zbF$A6B%5r_f%Wmne%i*({DZmPpXirw`YwOrNU)PRLYC5m_dvPlOPl1tUpR{TT%Hm!
z5)a^X7F|NP&=WC#GK)Fi1Nc!N1G+#{1F3!G+fg9Chn$f%C4|9^KcZUq@zJN4RB||8
z?y~^?DN2O<FNhynCCOs)2HX~qArqV#;jR?fTDk-q3z2L^wiY*!%4ZnZBrFI&v(Yw1
z2=|IpvMe>D)LsZQrBva3vHXxTER(U3B>NRB`h@4sEasnoV(<6m9H)^tD=a|mMEliP
z(iX$8Ote0P%JM_{Q<>*-GD8PpCWA-6rnq&6A+JmYDqneJp$t(fvI!83yS0F_!^yFw
z^g|?3_nfiTPZdOnMmBdsAf7K6vjs7D4KOUc8_~u7{skfE$-WLT?@jko0SejnllB5*
zAfRXW+%LQ<n2n{;w~)4;C6|<RrJCS)^)W&y(kRq0sOwUU+Ef8~=65mG1YokfQOgdK
zU@wP%Y$YjwHsZvDp_<A?L^!&S9$O#w3CI(O)wa8{1IQj$mIWykQYMo&6cXA%X;QvI
z74W1uMGVFy$Gxe9&;(39AFzVfK&n(qSx7q%tgr*f!|bVZTcfUx`6Q)FkCtJYWY;na
zi*<0BH+g~l03Y=>g-OS-o(PogoX+O6``t``?&iXL^zn{gLl6XXS_VPz;Wd9s!`%N9
zWGCmP{$~3<d>l^*iUoi<m+?fjIj{JT0)tkvnNqPr|LK6@F%--@puN1y7F3=Bs2Ps=
z3S!f-3#<?>HLyQcmpYCSJKgGSA%lSCZnOM>0uD_?xqB|mCRZ7NoJT}F00^iU(G@;_
z6GmaIBc%RiMqwy*QxD6Jyh$FpRIR4c*?T`UR!l{es3<1+4pddH|4;P^yahoW*#y6<
zHB>1D5ZUCYW~S2>A|Go+1MyU)`3(5WE>nk}k>~tRwkl8{=ZxP_<Y^vZa(5XoN0g*D
zQ*luAlQSuSVlYQj2lJrPita&?@<yS5gklc;ok*Gx|BL((akTspVlV)$IE0L5Z;I8j
z>81DKN(|v&!xR$ZgrAn?r1J7&|MB)~_-&Mo#Z={!*`|}6Fq!xkSO}1qie8MDaQ7i(
zcS-5v15k1fGc_G?&SQexD-O2PGa!W|<5b2nx4DryCGiNmHC$xTh+rSPWD`Yy<!S#<
zSiKIv8Fg66?=o;hwgY#wf}ZuTCQR;KxsF49o-o}1lMcV>v*$0}?2Vr5NM;?O;*ij)
zdWEWlhV3{GEgNWK?AQZu4F2ilgb_TTipg}is@w-iDSsz*OJ$ONHR=AKVEZ`ndg@=!
zW(msTtby<;h+rO2gJvm$QjlqXJ9}VhywXxgXYm{r6h)z$Yv}qUOCXFqvsx1|1$nOR
zsBh(Iw;PC4b*W8GDGgAZ9Ej1$%d=OapTH^C&-ndFw4WZHy2Hu0#XB2mr_{+ufjC3?
z&rS&oSd|7+nT?n?Nq@08U4uE_xggJyeF5ul2K_!H{R={M1)2fbqpp;H52r6+U}y~S
zwUpEfHO{fK{Y;Ue6Q#l!NRrf{lplB`Q$R_O(a@F4at&eUq*$%I#(#kMmV5JMAP!Q3
zByQ>gRiZ{5;y&W;4i}joZED6I=#bD_TNSBDT)x~Hs2>f5R+jqon3DELfY{*(?J=eo
zpeDLPMgXOvD6>oqxPRP#x(Xp8liDxDQ`<#h`&Mf0t3Vtx?k@%R3PNso{1GU&yK-Wz
z6gGNCq%_oFmuRocv~@G$n+G7}<sR3g%S{h*l{3NNcO$qK(~X7XE}exvz}8q=JHOpa
zOO>zNd*pQxsw>T-ShLqkbWfiQOEf<c|M|cFPcd390@sF-_*{&W-!nrg);5TDBB;rb
zXDWE6tmJ1sG5QkIpwb1AH_}M-#9T(;Jf=eH;e!cM+LKE(GXXV|e>4{m*EL|}{+_*B
z5?6OqR{!=3lcqE@e|y#ZRcb8UcWSkM31x;;kios4U}7#j+Mxz~+w>`(=B4k8gI^n$
zFA`)hfF-C^vAe^I1LUAHnvCjY)h%Blk|^9Ghn-CIP_B1zY7Lv`VwL+V?EW(}_PolZ
zhLl7v)HOKFw&(1+U5&c@<ehzk;1Wl1*zVl?6l45l6&k??e{MfbCZ_6!=zB4fgWI6$
zx9CHf@>WByax+-%XkHI1?TQxq54tzKvb{(2K?-yBK<l*#e*53Ml-ZQ9n?uu05whE}
ziJSW-n|P7DBalyQ8G@<7dNS@mEAw)TDa7uR*il<$(DG+s)4(g?w;M;zEgqa4-({p6
z1zpG|2-r7Xf1=GkXmtTL&N^ieM61^lC9pV&6zhcz=(t^W|9?m59N%e(6_~#XbtZ1a
zzL3`v92zm=y4`}<@WIsd(=3^5h_xso@4W+wfnu|O`cYpAc{5g31ZP0ChN+I!>(ghi
z5_I=p@!=wi%HN@QvTvJjmnvz~rvWMw7g^LPeVHusf2TUb@M!F78>;GJn7I4jswFLh
zC4{z1)M1>$HdWunSao0~`brT}vI~E*11EaxR(D>va7Ts7C~t7TJ-2#o<UF?FR?&HC
zA()4db7(amqGFxfR<5R7H&7nob}b>N>e;#2*oG}=D^Ifo?lghP!(@>M*h+hJoh3Ph
z9a1YdfBlBJ`Y9gWwF-YmZd*-lxKzQ-1MqCG5Hvc?gBySv^!uN@vkl1X^6Gr|;$~#`
zIc@r20+*6@TV+`#Jd`LA_L0i6Js<Sic35SZ?eHh>RA6#Bd4oya0=6IC6yx+iRd03P
z-nDM^oj-6|{&w+SAj6$Z^?gIYY{>uo=<(OJfBerok9PjRfB6Id<q!Oq-w6K&q_J1Y
z%T&b&scz%_yh!7gEV4op7BYffF42ni4sZH5!sJT;^UdT$nKHa;J}X1TxB%hrvSiL6
z8W12~mPd<X72w%S{oD|<d{>~1qPBH78AWF(X6&7SD7O|0u#{b*TLiuPUEF{uV0-4I
zf59q<xgBsVUi?GGOD4114;Q~%HD2~0{jlK{ki6V}1=fXJ3W09UQZ+&KRTVvl!Cd#@
zHd2K24MbC9cFUzC!GOUcOuHNc%JERvr~*}=W8sY;FBgy%h^pis*a;}-LUA}C)oO3w
z5ooefJI|{9zBH$a4X1`lwVc64kJq4ye*ijw-`NO#3YRb4sQ_W1=(lU)I4rKyfeyP5
z>hv~P!ydY|nJ_R`4;qkSp}j^dCW9-I%S-Q0AHbhPs_w4r@46~9P?Gvc1*Jjq=ySC9
z)FDUCZFSqx%!8)vz?P0&RZL4b|J~Xrl}D97i{0z0b9)!?A1f(tO7wIKRE2_8e^!Gl
z;H>iN^D_igZ9}!43%Zs!?D+=jPEtfw?TbUQHmEDKh%Uy(j;GrgIrpItL{Elb_CGxq
z>TRw_k(qO5QK$+}SOeZt)<|W@E0q&cf>qZll)_|!n5kX%H=~fK%xapTI<P#E?u%7k
z5DNx1=hU#8gF2!>y+%>P1@)pwe-C3ALv1$L3l1TENpVUz0_!|G@H^3^Kd=w%2xBW-
zIa{pf5|}WXKf($+!2>Uo`4Lob=6%1Cm+*SE8#bYLUbN~xGNejfrSr6s%R6f%cKSfU
z<cu1WD(nRf4}+X*B9%i-o8wjaqqV~<>y@Y`SA2EdYw9egwXmb%uGYo5e-G%btIY54
z>K3-`^V}0ZtBdlWNV^BYF~u@4PMkMdd{UXvaw+%t;z5y*uc6vXB^Q2Y?FKHfb@28{
zVsP##PI5yhY{49LJWZ-hyCi$89D6YbtrJfnjlq5gC&xyl(ZajX_=@ea61~si3<YOt
z)fySBXvDW);28-hE?agQe<~{W*>PFp-3D_>xA55@w$a?N^%c>&bt)YNEMuJC)=sb+
z_^y-Q;;=$v0QT5&Az+*p34+9f^HM7nIkM~k)1!zJ&JvR37~%-okO?EfMoqEMJP<AS
zq<SD%n|TTC^kn!~3GP|edI0utLpMndWGF2DW#x3yBwCX<w)Z{Se-X(Wg}jZe0|JQp
zSINXaMYoPTOVG2U)DW8a%*K{ZeaMPFA%zz<Ag+sj*lLwQ(wr?Q^Sn`ls`tchEXwR#
z-AuRz+f24z*Z8Yi=T^0I=wh#2`gn49Uc@#ysi@usYMHI;KV8Ix@c^FP3j$#%SDG#2
z=ISmQcH{X)r?P^ze?pb<trWTDGM1N=!LjX&S$pCzN){n<V(``65ubx^6Clcm;zu=}
zCCM9zS&TG5HdHr0{P4h<#DtZCZ&}J`jZd+GOd4ra$jp`Fqe5c%9Hx5)_g)oaP9)s*
zMzjyk{OswcXB|wI;$qiK5!#31$;q)hW&%hr6Jx!_F==Kpe{-qh7=^b>z7k!O?g%yl
zL@{Cg$RPg9Dy!JuUbOM5$eM1=iTokvR)BC(^0Grre;pbW?rnAj6afV*t6<e^T{hhq
zr`on-Ls69d^AV8VW+0QX^^I_S^AhA?25ei$7s0N*oEWU|bD9Qp*HvN>YY5eVC`C8Q
z8n~66j`c8Jf7sjoir&jfr8wz(l~1@U-X)lx1bOldGSnPOquSnAh-c;ci3iR({P&`&
zacL@p!s_bW$WZ1OGLY;yeqHW_EqqS>y=VY}&2_v`P0dxmMSQrmT7!n`neE~q#^_(m
z7|nvthghN0#n`hkuf9+X?0u^AH9E&^_j#%9ZB5K1e*y(O&H$Aqoh~@YfG8VKDi%Fm
zg0$Gh9DQB!sN<O=w`~XpvPCl_-8QsyTT5}n!0ujIt@D3aj{o@C-u{cpbyQ}YY3w)1
z|FOHXyYr})|KrQAzxc!c`}@xStj$RVF-H1IwJ`>+ssp6xSKvaJ#Q6Pt#{h~q;Eg-g
zG1`=he~UVyM;4`ACa$%G7+G?Cp>dK#N>&{=wK<8Tj!D7YI2x+rBRiN+KW(U+Vw5nM
zQYH5?)mUwkf|fTlSIp3-pEmTOc+zS$XNM-G`!j7SEfHVm=*23ODVKc0^$)~3{&KNb
z>!k5gP((6+4rv|mmVn0yYy9cj@Z<?1=;BQbe{*(L6J8YG;cqqtbS=rnx3q}m31v_(
zUc*wlFzzqgFThpch;0}ZlLmd|bgk!I8si1_skUODep*Yi&2QenXB;0d??$Il!Hq1L
zf+0`PsN5#oa)UCPJlow;!7$o3L3h(?vyqxU>y(92diV_X?=g%SbhxEGQ2LmH34t6M
ze;#A*;(Fcua=)@J)rQL$*yXZ?3_@QG_+LA#PwbQoie1vJd_&zB*tLJ7mZn`ARJAfU
zs7jSLtCx?%AQ7#7)AF6z*Q*x3v`nN%+g~{^C6D%jU7ga?t}n<r5TT;1_s}bfuJJ`7
z{IhsXK^ub#&)~xJ(jyke5_6e)#i0Dgf3Fwz-JqEi>1C;2jGt&+d|q`fiGO)oW3Z>W
zmy~nevoqU(A6KGyR1`x5L|Xtu!2HzT{#qC0WAE!N2JZun4wK8LpH@ayWBv8l_6YcB
z-E{f70P^DC8urUIHr(p5_)4P3NUo<Cx>Qn{TciHUeLw+Y$H2(=bg)!LXpTCxe+LDz
ze=pIg{nQ^6qzAngzy~q-sog57(Z*TAo3b`QxDMo5Ro4(odxjunycG*f^?6`a?p50A
zx&bt#A$X&f_Q+_;TtXY%?>!6);F3^&C>ntS<fH0&a~rizJ?%_$9bV@(sGF=n)09~S
z@0hMnP`oh#i<>w^APd_#C%n@1e^EWv%FX&bG;4=hmqQx{Nz3SWg^M=T+V6`ON!*h#
zZyb1T2t^rc>MgQJ#o)sbVxk9hIhZRMqbk^#Jz?JHG^p<<__!poNMlr%zet{`OF3Dd
zp;hT$;D9O#FUT=`HjR7(i=dB5%HhnVH*0qY?%xxc*&J7KBBBJcb27l8fAIj7{D%8p
zQ+ou8L8dS;pF)i38y$yF#7(i;R`8CZZ5nEcOKg~xf*q9Un^J~0#zdo}w&s093VIt>
z1<ahfcvEK}^!b|OnPRPna|E*C4it|(W91@C6GI`OwxIv4Ub13=_CN4m`A${fm*kap
z54@9)*Rp(^a4J@O2Zyi!e|PiQ%dizy@xagNYP^~l47{-_jF07l7)}c(!@9WkR{6Bu
zAXYX~Ls?d&hn+%@-vt9CJ-uk|G_&zg8vxy~-7i0_l?HL6RL~bT083A1I`K+*k6==4
z#s#~$6cTR%olAG<Co2khW9fANP|5vw)c;MA`8<j5S^Kw1|MzJ3fAN<!{on3af9U^y
zpZY(r>gr^!dipX3XSGPjc|TPdCYyn<i#YjKW|@k>3NsJ^6P<<NVS4<`pp8FdgEFD#
zfG~<i^3b}H&s3Cxqq-F%-WBOZUNMB%=^{Q%=5w7N#aAjy0EJ+6nSVCm<>I16`W6Qa
z64>`9ScC#bxIH@Oe~&}PX1C5`p8y|j!TDpi)N#ls&s@HJhDXIfJbL^UKhv>&wo6aw
zT(c~>`{1V1;_FOTnzYG%T8m7#wyT6t3^#V2igBG4Hzk5jj2Pk3Lnb7RKp>7{2Afz7
z-YC+<Xdk>_W4}p#aR%Cp&As;uH;!Rc!Hg^8#bN#w3lYhBf0G^~(jlw^Qc4{PEr47u
zxsCxn2uc*-a16b;?O<Pm_F>~Fu@u(`*{KHNyoHeHq6MREU2NCbcQ#YVSuXR1+1PBQ
ze5C`7O#_`k6bAT(kr{5^p{={ZoseOOL?xpW7wR(b9otjyv8OPTX}-u1KO8PCZdW<v
z`&PHoY2U>tf08B#fLt|C^Sjnza4HAQYr%3?_d(f<|GY(CRi>5g4LGg+K2W5bkM-q(
z08&7$zqY8&TL;K%nu610ET{zJr9k{l03?%FQb!Q$R!VgNH3C($D--MzOa(*<cdQeg
zba1>ZPO8wMcY1k&pfdEr18r@A77BpZh?aB-Ya)u~1p%3wE`OmlBCa^$eIm3kJGJBB
z;t+%Fz+=)7j`*mk2LVIS&6YaP*YxQka+yA$u6DV%eecgVY6+<nSZp6c^O#xzl3ovK
zRYo0l+^3`}P~k*EL{3i|vrr{WEku^$M5>bnzyx#UkJ|@=yIcSaWqcVxjn6UO(8C1k
zd0%m&fzON^6@RN}_k>Z<MsJ!a6_ocLDgzGe+8?^wHg3gLAAaD@^cM~G)#@!&R%CBi
z@{L-qFY2#wQS#jJF0d~~QR|}24+<)PZ!Bk|1T_d}Em~6<MPoU6)4Ev278>?@X*Sku
z`}&H~<#ppCo`h+N<v(oIa8p*@<2TmjIf69Q>8asfrhimV!M4!-I$9vv&vcxdKpb(b
z%ypelHPzX~x+r^%b61oF;gIt%r{-g>)Ku#hOl`1=)l#abrdlgZ?lWU~oZIIJcn5h-
zmP6pXBhD>Co}>ULl_yOVXNn>45IwWXGCP4d7$cx|0)SaG`2fs|%WZ;Mjg8|%tzfP|
z6SSV!xPN_t8rMcoX3~tU+rRdQU5>UZjDj6xc-yWxD)6@}YPBnyI8+m{f4Q?uWQPRq
z0<vvP7=WdxcKeP7oS86B(AmDJ;x(}gNI%yY6_<!G!3hZ(2E!?P>}T7~fhEiB%2SC=
zC0E8ep10sbV7Wjo@GsLs3mpLMdRT5+Znfa5m49{`m^1EzZJ9ELdf-xRmhxTE`(es!
zCK8L3waDv=V~W8t_~Njb5%;BauJJ$JW+SYe<Hm*CG~?j>V3h%G&e8OA#_`|#-w4(M
z-*JZR9$@xX)V+q4A<AHqsSWexVT-R{6B<91!C@m(zRB0kshu&rszBIM%l2vI)OIR!
zdw=3o0O;*dA?dq{emq)VVNo;XzZ0Adcpx6{>~sYu9|o0*?KWpNE6)<y`n_v*X?mJ(
zQim>wtxLo!!y?8awf06M{`24dT_~q`vY8CJoNA|Q1A|$s1=aM(oaCV}h-X+8fQR&*
z>MEcF3^ptTZ)0c>vpO*f2hj%o*g<u#O@F?~#wrxyA|t$HCFc4vv#BKFFuBI7#F@e@
zb%@^EXRSuju>QsREcdXx4yevuA09gOS<zcmn*E_|{~Oo;E3n@B&^W(={(ooZ>#ug|
z{=bhO|Dpf?z3Tsun2dUs^NC3^v(X>v0-{=eQCZSE?!WZn%PbS5(AEcd32BaQrGHFr
zNo-9D0MQy*MaXT84`wm;qSgu{Lo0Awp+z}$2%pJjVwV|dZLViY<e~+e_@5ni$!Ore
zk2qmfk232u7eh-(Z_C2?t{2NJORjZ%*|SO6m(4u5wEyqh@VC|ef3*AcZgv0feg)6|
z*#E!J{r^vRX{lq`KIr$c7K(}Gn|~$%o@9%Bh8u4^h%QB>x}Z*!o*0#(YZ*zBnXU^b
zb-*p0dKvY^&Sprxc~ux4LDvIeUOi3>hoQCuR<cmzwA~=G*TtE_{S_+mzI5u`et}7a
z2<Qfaav|jrrUB!=BRc`{c`--!H-OrN=oOK;T${%$Io9{+Eo3$`9Fi>BFn>zQ@AI8B
zxt=aNwk|s*9H8d`D~Qi2c+X9i`{wZ3vFM9Xn%Ovk&}{NHwn0L+R1RxV<-9!^MVq)U
zN~gzX6|*mQ%4f+SMDzTBTuT6eWFDR?i0LpCb~%Qekbsc^=@CMGrNae6=rEJFO9u!*
zR@KCbgj&`N4VNB^I@sz8m48nHmrz|8?b6L$173m@#Aa2-ooYA&Y9Uq4=RnEtqNzwt
zG;1nUM@y^~X@oy?*7Hl1+koCKTu4uudhO*EZjdi+_;0c46npFW59mYRnC@^7|F{hN
zjpM)GvmCHN{{QNW$2Ix?i$`DoasK~a&;N$A#$)G@(K%g2h-0K<@qgo^;PyU4OsLyB
z4K;KK&y<3x^Py4+UxyO~Y9tm0XAIp2Dso9=^)r}=M33PvA_9k^%$JA2XS3yI3Lfbp
zFaI_?vb6sz=f`g$|9|m#=j*SV{QtiCWB>nN_rDJ`R*~7Q)P009wUeP|(vX16vhO?k
zM+mSAkZ!wfwsJTm7=K&9wpX{;J>XGW89|sdRM_u}MVhK?B8?J1yn1!QMeT<mKQ{IQ
zjAtNQg2xYVH1cgBRAh5wKW7EOKzv3U>@)v!Ql(BM=CH#lJ2*MEUlJr4HGF<i)W=Y#
z^uj)N3E|#x=+=`iiR@3h7>M$uD`rZ9F#1H?6dx66ss!li!GG31=?V|A^hwuuoqGZ>
zwp7ba0m@zX&Fhxc_H`$OZq>`H+hC#Tisveq_V=pItXtCG7v7OwANad2WV>FU65>jT
zFlhGEGn-7Dh1)X=-s?0ic!6~Q;<q`$@an@i9eY2~F-Kf*nsEr$Fr3>8u(2X=9H4L)
zXKDcBZxUZ(K7Xj%PIJf2Er!?S7M@}bEa}_e=|y?vJaOM^LCs~H>xp+is5RD5q}Fax
zrg_fE;`AbkkLGE<q_C}u!D%bcTB--O{n_xv%i(vY2j4$Gdhu%b@^tw6?CA9P#dj}<
zuTPJMr$=I6^#9U+@=@^c{HOHY;pFBg^V3fsUv%)%-+#BCe009k`^SUccd|FVc=zb0
z(>ecPc5(hHr~jX%7w2c@V(?S{r#_VZOaIBo7Z3lb(|$7e>Ad)I5L|rz(?$EqVDMA;
zdFRP{EC&t!)8OwfK6lUIv-AFwi}SxwCmwd5e9~Xo(bQ&hE05t6d>6BLu+?O6jL(K?
zJ^k)*_<xUIKl+E^>CxHC*QbX^!{et%FJ2vgcYJi}W)vfKIy5mf+@CH!@3d)n@COb~
z+d98{dHU_~)2Bx-uqTHvpB@cQULL=A#r2ierkIlB7k@r@cKmdBa&&qKBRYC<`10xT
zi|_fXhUN3VJ^Axj!-Lnaet3C${OVtAzt^mqw|^8rygYj~Jb3YRc=GbpcJVLge;HhS
z4n?t`hfxsc-~jj{i4V*~>%$~eCm_a_p&7iW%*jjwBT!jmXeNZgwOx^5VyipI+dCbI
z3)<;G$kL;)t09pb7zI#GYr)#lc3TQsoJj*)agzT4i+W(S&uyoN_Tv@{<#d7l`}Zxx
zM}KH~^-rx%Ll7SKp^Tefd=BzmZhqAHtlc_qtf02K0qC^69ybI(f7H~!0d>8);`QoE
zI3M10z0PzK2uA@#EA}_-s6f3{69*__r^BzI0dQr_j-t*x+zR)}n(egela18vmHlWH
z9Tg)ve{{i-;M))d+z9I+fEj?Px)|@$w14?fHB=C?CgjN^A?PfQGXyx7YW@T$J4;NC
zcSpirSyf7!8P&F`1f(0qde)YLVB2d*n@FX~(d?LrcKr<9Jm^1s_&_{_%(~GMXiNZ&
zi8J;f{^Bzuu2mHED6!(}(_@imGB$LG*xZK6B8NIG*ogHqa9(BFT^UG=I$xNa^?%hE
zf|+rm;Aj~<5D)vc;NVbY`bwQxcePWl_c?o=z0RVxZL7GQeCSqcsBzQ2g4q1Zu5PHM
zIR+afZH~istI#lkh9+-J_mwkD_HEZdOfz|jNy#C81qcXHs(GcFpbi{w68nI4=k2lG
ziyMT8D{Z@*kq<&*V<rIN@MZQtJby?M{@@GVr}R;z2)@!QTCc#H;ilSw$onmS0?Rep
zwkioW8tN(?5B(=)Ub3;9fr<1)6&Q7u+?{S(Z~8&8dnhAtukLmE$vdyX8_e<9fB3Lr
zGX`H2D5-oawGO{s%n$kc^qGJHS29BLbJJ#;Npl37t+t(xxvI7c*|2ZAJb$+0Nd-Zv
z`WjcNR*fAP@tT~J4kyB*2lT*!>`KAk=)06Bkn<cAV|r3dMgeo%FgAOsu&LZ%V2w|;
znIxciunePVgw}=C7gL(HbLGQMBRT-2Sta*2@a-}fa8{&KrY~D%=m2PsgSBl}0=NG^
zDubOh@R`~-_u8?K?nE>n(0`}GvsfF{@U)tM7EHr!2XK0AyI_wVaz$ZL3R1%FRVTf%
zE`Q!{J)g}DH_dKsHJduq`E@!_stM%&Zu3;!c!)nV``;eCI{aaH`0~XW$bo0C4!%En
zIy`#u>hxcSXD`2dH9R~x5&PmF_O|}&$Ai-sAW6RZ;q>V2hnLTuihq6aRioo&-=VfY
zd-mKa(Y(MX%N1)83{V*x51f-C2Sk9dwO5Kyi$MW1Q8v4@S)?!yNDO0ygqlK?W@;iS
zxDCw9k(OqipQW(CO=FBN8`az`N&Vx+aP{m^dP(g2UycItEueQ(JQu~5Wf^f*bTZ)B
zRl@1R5EvUL;3d^^K7Xoaj{zr0-}}SM*Uz4c6phBUxH)vGm??*x??=y-1LABNyCSfo
z7BXGIl&?D2dXghtex<+2ZBUH4m^T|&BPZx%+Yb?fs?Uc>ClDtz8dSl-X+WUq#R{%k
zd0bQ*wtEZ3QZeYKG$$|QT&*4b%W5nl#*yK`DY1~PFc2@49e;tzlT2Q!UL=<)6KNzT
z3c%gLD`Z5T!5F8grg9PGL!O;cXAihWWCTQ@!AU#%lN<gw;y?bMoksCuM8xCb3sGke
zvPP!J=vL|4ohK^Ej(OUT!vmP}wR82faqGcURmio711nUfRf=Bc87*F@Yr8k>#$aVH
zyIBMCz{C#V41Zp&8c0dW@D9_mIRx{5A}Z^fb5-!;8j9XBU=czLyeiknEuW~YM<_sS
z*iB+F`u^yZ=wI#j$xtzJSr=gaIKs~I2V(M3q%us*DJgX&@b20wG4>rsM~@9iGI35x
zIfDvI6B;>W!Zg)}oiLSeRM=_UC%8?UcM6)Kt;Z{Se1E}cAtMCsX@57HwcELCE1DEZ
zN5T${mE!e~lbBK%F>V_+^H@fWdVCfBH=?-J6voU)rgE$!oiD$O<mLSgmjtdYBA`fK
zTNli;Fu(!URMap5wt2)|!0$KC!bzr1U1kw7<5GH;ds_bj%c{w2Qv<!C#a~|(VK{~=
z4$<8MV}H<w*3esoKE+9_*2YtN_>C>Eb@+323mfP2Q~|Q%m5k0H_ul<XB7o@m!Q|ul
zqsNG`!S*tM5X0khbwIfn_*B$0)0Z=V?lZ%&0y7ZQ8G&=7_h@a6C}MgfYVo#L&pHeR
zn!zvO7wpu=StTgW=WreT5fA6BCKm5BYnc;x^?&4>;_vXBACgDFddh@zW4qAzqHEhl
zzRT<q?e%MFtIS?wIBk+do5rvypf<rgQ!VJwE#qcOal?yD4?MGdvANaT{8nM1#p>YB
zRc~{O_ob!XOj#&qz~KT)z7N{340G5#!OajZP<{)R0$|d|;RkoHFcNNL$Lof&29gHH
z(|;AMEskFlIPPIk;*u)be%kqijXeaP6d%a@o=(IvKzD=t%w2@1y8xhgciq8;t5|o-
z$Xtuc?&6>u>1TCBbQz)j-5Qo=0ms+Is55x@npB;9^Co03hOg>PoMdRP2XmPsT2a91
zhWUf59n4-PLyH(f#w^USldJ3;J9)8>hkqSuPcm5T%KP&qb!EnCn%LNo2=lFRr$hy&
zp_avSGw-d3P4C`A*mM;kecgf(MEbfC{l54%fe4MT$9l6Q&3ify#0aN$B>waN`#+@p
zpa7WX2mk8KFPP_uJ{$QpwnurA%V;D%cffTcC9_B?1n(O4M_`ep-#dkdh!)AmaewXi
ziQ7;(9z-N&>B8*Ut5#o(K<cDE@;xySFOu9-AY$y0SKp|_4@QB2tk(l4n)KA$G)gkK
z4@Xxis03wHpmESxeUT2O-mYljWNpM3S{3UaDagzyMqp4G=Gh{ijBwzKNTSKmDDtu%
zVcO~8csYbS>?m-b_T)8WHiWsqR)6XZg4ATWc%H<eTy_A1N|7UBO${o;uqQ7sGj(aP
z(|Y5@<c-QrPsU*{WQ;wlDf#~U)1&VXUL6g;KRtNy`q{zh@vGybGqEquTXP*Ra-57=
zvd9SIU<v;~j}QwaiAiYqc_A|vf0s&TtqZ4!u^qWj{{J_~)R7Nu$xGMpWPguD)-&B^
z3R}c_1zDZiRQ0H6sk{aSeM%7Y$YQ5SHr8RNVv&H#<60Y4WtOyCRuE4kUv)~l2EGc;
z&E&&?dMKNUU4(khN#=Ddu674S$4BCSzC5iB)35NA??l0@j*b|zMnp?!0ke1#xL#q(
zLt~s*n{8$N`j+~#e)YbGqJNBM0Y0n==-OyKQI*B}l^CgXIuU?KQGExANJJNi=Zk#7
z{;!j00l5l!L~gR&`WtxYNNlv?2wb;RA9e)J;ch?i*)2{2Ud0zE_s%uO6VByZx`ZqU
z-y2!h`m6M|M<`6)@RuasutvuRFAiumpe$vOhJ{MzDfkRmw-7Cv7=OdjD<LyQAfA$<
z5iv(buU{RG_N-?Q+m9x*guRv3bP6o&iW<A+vNQ<jG|wC5^VeyV$ne`J8Q(v9W}dt0
zx(}BF0uuZcu2ZE94+yDhuUAFG8z%{-rx5_~j`K5)lJOQ(GY2xIPOUFk$1H*t%3EV5
zA3gr6O7G5dx%HQG*?*hv^#1YU-B(}Ud~$oHVDv9)I9}#-opiilXC*IK3#7yogbRip
z$KPBN#3gugHtVSIw!s?k`&qy!xlC4SU$#-drb(nH%hd{;#H@VR^!#SS6qHg4J;f{w
zZX%i^8cG@lSGFM}qOplHJZ!DM(EZFgB2QW%M5kA7oFb=|c7MovL+kf6bhij^yHILf
z&x(S^?+P&6+7|IfgXCyREtIwqU+0Tmy2#>zR{3;5fky-Ma2wF=2-lK3g1~!Kh2mVt
z$5i2N<8CFzK;vfB0M!XMhRp**tlg~f6}ksC=K8qxM6As{a*qSYE~l9q7Kz}8<SH>_
z8}*8=Zm{s&cYg;tACM(>r%P#2Y_HQ1-D|IC%GePK676iWz*fc!m$959Hbkp&`aSzm
z)2>}F_I>E+7G?&p<24vY&}OXN9Hl8)Te55n+oFhXFT2f7Dp~A4aB}KLv@6jfzTkb+
zYGx{aiLEBO^ufm6P%FKTN*k(P!wG7ow_<hvSLGF5{eNb~TKgZYJ(2u^&8MVaqVcHW
z0&5*gM*hT)tREmcPC;rBJo0UNvqJfc?*nnQ%ZT~t|3Ut5jLSQU)LYOe4l`@^B{lEJ
znP$Bg>TOQ?0E~%VW6A^Y_~`;X&%JLDL0*RFOQJLIG!c-F3Tm=J0I~q2953c+;Ebm*
zyhCpW?tjI4I$Mr2R5<Vee<jTCNtPHhv=^wghT5`?qAV_L@tJk4DU<};sRatHl4X&b
zPc%*pbLX~5Gt@X?jfWW1sqZzg`CzK^;782`R`B8#=48%!L7U9)q<WjGOe4xhv|aCR
zv&3tR+66DUy+ymm0seOO!S9NoCj^AtNMBn|;eU2hS@o-Nng{T!S+xmD9yAVLx#BIe
z?&EE4Z`B{P3J&d#ElEpdM4DlyB8+%h*@YF4o3}w%I8PmN(6KH%MPI60Wz&{f#|&bf
zrYbjElJ(!frmr9G|9y77Gh3KDeaz-3t1I7*bKI8GAfyMTSy3g&xP^{L2?rQ_oTP;^
zQGac9oJ2CdT*yl`9BXNQV`da5x!QL4Ma`OEVYdHl3pT*D-s1+hXXF^nL^{6Ql9E5<
zJc0XDwC%(oX3h{{*nJj@&SZZphZTiOV@4IupRuy&oqBP*-Z*oBoV-zSIJB`!x252F
zVLJE3glg4nW4~DSb1V95SOW-M+QQCqi+?TNwAHK2M{W_JiYQ*gt_eqP_>;PdJ8a7(
zw&-kCJgd7q|6XLZjUB#s;f!5iJ%;gLD6jo3-SukKwwjby#Y@}wrk4#WD)-J8+?w8d
zM^0nAJjG4#s;6mF8Q#S87yhPhdRyM)O+|e1vaxA<YB#;~1h>lTJLO<nnf8*R{(m`L
z7P&@@RW0~8GvMqAke~?F4GJ`j8WXWn6k02%IeOm6(1r=FOPy696oCKEI7%jOIBJY=
zOhQ66voT*d4WR7P0I3l}Kv|gSsY@VxrNmgx<dufJx@XElCDwfAz#?mAy#hsDrW!ou
zXcBrx$+_vn7pA`oX}t&W6&eP%$bS@;4d$T>5voM~yZQYAruV)~r0i<<D_x|V!rB5i
zeqbC#t-d?lBFR-C4s~YJ0d9zq@?AxT<0Q$!T##=3%=(d-;kNfI*6kMQowrt|QliT=
ziI!6xMK&dvv4{k4a1C9DHq=EtaxBfp#iE$dt%qkYoak4kv~5K<@~re`3V)L&-0seg
z{>Vd4MtCoDjW_3_R!m#EuA_HRqTq)GQEs(0*BSOIRNz~V3R3c)uGmn1k?I~TeO}*K
z{_B<F+i0;`!FLZX$r*^4?>+I|@JgE`TdomwqiAl1kT7DHziqbvVu@8R!C7rSSK!k>
zoJQoXZUtj7PLg*_+2iYtj(?)Y%J9u_B6ArfmupJcoV|WSy(Z6$245~aCAbA#ZPxG3
zA4*Yzd*mKqC?(H|``ymr`r!8iZXVVFP<48KmhB|Q#2o1S3*tqAao|Ga(E^D^PyBNm
z7^)Ga;&x%|p-Q7<Imfi#GRCAU#Qw#Kz8E=G(NeUfpXZhVTgF*(4S#@SNv1D#j6<a0
zcpJcP#Ud$amkE{5)LdmU!b~I9{aIb9m^1p$$C}e>GcF3%4VWh4N@hkxO1=>~?tmbs
z4cL3*B<{roh<2sCJX2P7!_+b_UcM5Nps5Za42P)#CIV7AdYN=-9>`*RdUW;*@YE7Q
zTYEtHRT0R_0;Vt?G=E5#ys9EfKn5ki0Gdw}I?(~Xm|2@HFo`b{oakjdq0}}yC;5@n
zlZ^WFNjjpD=3W<F0&)cJ!;~fKL`ew0XrQ}Z(W5&Fl0I2CB#rO!{D`n5xqFG~5xj$u
z4(fa0g<F@gk`OEdbgn{|*cm}2C^>*#5z6%p)lKDGLnsh|dViqi*pj;uS0(_3I-oG*
z39r^%g_?juAOoYkBENt|>_jARShur-8|x~W$T7IBFZXbH(kz)LIk{vzYNJa7Nd3j;
zz1r<#n|&V1$ahb$w+#w_NH}9PZY75W#K~xI3n$+6+G%ig$V<ov52W#cfY$4D;nPE9
z;eu617KYd1xqo#?UmV;cxCE};MwMd$4X{lDcMHw1$)CHL;Ju`tAt9LPgwYsc-`ung
z_92V5>1tCTG|mQFJn{v38WU&%bRdi91cTwVZY_G$*71xM{+@)8T6*x?5z@MdQn&RR
zrG@z<9nxwM=NQ_|?`!0ty30D%;QW`MdqdtCWw{0fYJdMj$3=%_F1nqoc`-I8t>dDv
z8WYCt(^P*51-x|p_cs$k;ruvbhhFiyI6W(Zqv+@-?oWq`nI#KIa}S6*2!z9!oOtvX
zaZzQ5G!ilzX$11y)XyycQ2CrGxJP?XurwHyaF9Ks7~FP)RcC^+&oYI2dl?CLcX6Ud
z@BuF2Ab)CsyZP9K6qyaK*4uk!+u%0LUBCfH%K;y)M6i^x4a6#Y?)B100>qOWut6c$
zkE12|$HvIzGc^w=0>B3AK0ky+gL7$#1zhX0SVlc^nndW=;DZ>0B@`i3@cfjKn8_4Q
zQV0N)f(7AzkzNlmnBL}u;3~<DR;1G89+@(4;eQ&3cs{K1XeZyys@()@DDfc{PfNB=
z68eT7D_g0H`5<><yKz?$2f)34{rDdraU?`9R1gO(W-<;V<q+|Z6@+D3(h*1CH3p&=
zb_$kvYvmshDa>V0O{aQ-<Uz^>3}GigLTuDYR3yD&T18_sLL#mCbrwkoL1M3{D@J?%
zZGXU6HkNweg=o^5<bIWa`wQKH{iI`07oDjoBw6tp0XN9CY}}@&XP&_LxxIq);0n^f
zWojz8rn`AXBXU=NbAX78q>g*mVFM;xV_rwR4AEp2+!1gey$c&&y-MriE^l@#mcslk
zr(lxw;_oTD`(5=_g`&Z8*QTxMKjKzOu7A=EXP5up0s4B+>Wt)0UfQcY!#8`;uiB0!
zt=VcN-U|9%r*qq^16(65Rh;Mx?pjd-mgK!V>h|tA;H-f@R)ya*?5_`uO5usTeFO+4
ztGdqsnR58iDo^-oU>FMWj`t0=)5KOP0T-d+hEo#@x^{+WtsHD;Z>v<|-#`le$baBA
zV*I8^E+C;Tj8ufYt)l6Wz@N9a9Ib)u9<0f3v{D4RO^g?bNG_1;SB=?PD*!osv`vw?
z>&}%X?q8~S(@|0iAX>GXH%B`$#ncKmQpXy0yROm7Hrpl`=rD=G9s$x6@(m@46R%@b
z9fA`LK|`}jJ&EDk1zIz_djj4N`F{t9T*sVv6ht>ty~gToE@nyk!B%@dEgS<lhF+Fa
zG=FeBxQ^eLU(0*h8OXLZhSs>|cAt@Cux)9uhz!vpa{Dia&1!>N+g!J>kJj}}mGc5=
zwhEuMt@(&aw(En#1MLERCrRm!Q5c6-)CCavWC1G7KY=&{1+<lM{rbo;rhicGuk)$t
z+N(xrH`l~%U%yW1GpM*_gJA_C=g0wvaJ{1Bx=@pQYMj@n&w^j^SS^%&nYz;3oTXcz
z23R<WO3v`jcLeVw;76N4!kTrD&|0ZBYa>N|LT{?W-KcbYN}<*io_^}76v_!XKU6qQ
z(@66*WE&UXTR;<Y(N*{tUVr@R-7yl^0(fiy=g1V9SfPO51uuW<%62XC&xiJZJ$!Qs
z$Zo9|whCzE=I%sxpXcgrk*{?)B&F6+=3C;>)QEFC6W1R^`k_R+60u+dO>V*;_i11Q
z4tWK%d^@z=Sm*jz;HORC0xPauE75#D?0SXwfww*M@-fL2AzWL7ZGZ9<HP^u^w_ZL2
z9cmJV>np3JFKX6B(0Xy6gFzFxQ}_1l!%S2xGo5TGx`_fC7xDIFb)Oux+@)295A`-h
zZ$us6B67$gci>)Ki7N&eM?emPlpO8B>j7XU2Oo@Z=e1v-d^Xh=1KYR^D1AOf4Q^?J
z-DaC_1k2xsAlFja-G4`MpH$`HQf=B=cOoskRZ&3jwx2-0&aFChr7}IWqU);Tvs!3a
zq&e7pD*32gm_&qohA~E!ikqIf#wrxtrIEwL+=dR&2zRfC)z*CV7IacbOdpJpwhFGE
z-~zj%x<K3SuF{r*Jk0-vbGyx?LYX0v*JcGv^9q#NY7L3bmwz+2*&F4BsILItd5bD-
zAvcIE5<Q^F_P=mpn&**C$)u63OriJYmIp(5I?HX`in3n<X|I{IBvvn{1985VuXMNB
zAl=nVbm4C`bTQ{L_bL%##hYh)&Ed8FHc1zb>iU0+7J#)b^Ipe_i;G>`TSziLB%rf=
zK1u(JXOD<;8-EDkEjPfgH@mj0x7sI-^J+KBO8V`tT_1l79Q(ci_sYxe!fI&dHqB3^
z&$l4GO|r8@bnFfG&#jrXdYk&H9=nelbv;NN10M?a_B5_z>i=*%-{`t0+G?Eg&oIn_
zQsWxusRm{?Yl#IQavO|dFxv;ZnS_gp@)m<#=g?RP27d)~5sAS?pZ#f!XcKz5jr#zr
zhavBeR8HQ=OV#QG;-Ch)kN!lNnkapR;Tx6Fah6@3ixAMzDLd*Uxs3HMN<4pk_KMw5
zp>gV?G-453$wY<ZOBO|(Qx}o`Y^q=#Q((Ynw}-UePAPCJ;Q35W)a|c-L^|6k5)Rlm
z>3-S%eSd6$yURBu7dqCB4>yChL!!H1e@cEGo9|3V;SgKc2v7LnUeRl|N3Pj+*&Crj
z*m+|!HqM<Pcy15F(~wx^Zpbs+Wrth$Lp=X(-*18K<L@vXZbG5C4HC_U4y<{#YS*(D
z&YC`M)3=SFoV)i0%6Z#u!3XCS7&%;W%evQur+@q0r6l|UIyax=#jits7jVDrJA3D2
zq0&cpLTq&~kT2W|nPtiKy#?X8e0p1)33Yz7HIn-V!o0nc45v}trrVo)w>@aVouTZv
zf-PUa{)J2c!3cM}T*-KecRkmGcV)2++fbo($V68oWy+U}chz(?Q=QG(!(0tz^)6B_
z?tk1yn2d|Eyb0`W^xaC!34GDmZyDjv7dICh{6K8kO)IxzI;vD)yIdprtralE2Y!AV
zNN)4_C$0aVy?0%X+sM*I`?sDVgE0{%r|Uwg)t)xh?g?6=EzOZ74Jox}j*m8wRmiG>
zi2}+<fMnUNi2dt4z={2Y^CTzMTA7K&9e=1oNwS+AF=Md+BodkHmh1AZE+|<$8eFwA
z-|H&|`Jx(ts226uPy4;E4%n6{x^Bm-PWDzd3+P3V@(-~(IIK!+d0&$(Yy~P?4sr#C
z>LwKHHA<z?zr|Afv;1xzpZ?>=hvTo_<F5Ye$-f-!BFC*`XsbT0@8*n<G=m7p&won%
z_)ZdYA5sz=6@xA(wf7`N{8U4er;0G)|1TDYq0d2fnD+FbeX)KuOKD{sSv~H90G7jE
z1)Y7RpQ}zbY8=AOiRwQAlXukr(H$P^vqysluuSSqHRadRM#Z-@W$1Kq`xjcZ6sJ_t
zJgBKhP;GCa_xom=6vC5*X?F-ol79$Ipd_M%+o2cU@~us>4V=XKvC8!?yrWd%Q}eC|
z)t1gc-Yd^v3fURDtz$`4%bAwmsj?~TJn0_l^D|fsq*%FveEB4a{aH#b{*MZh-QRVU
zA-R~mjZg*by?x+%b<0jfVi^v4*QDEPP>bzhR=8qau&%<PFhvwowHHt;u76V}1mmF>
zV`%oPq~KhUgIV>@kXs>2ya5OYU2fr+XjfOJxM%o(T86I=#pw4sGha1t*muE)Snkra
z4zl{gNSFrBBxL=MDuCYCSn5v$?yu!1vAO_N(@)l-J!IIO^!AO9;Mpkje@=xOCQI^Y
z*!HH-MfQ=qsEmREUEa$o-+#w>ocIeqRPS$<hosIs=8OXf7=D;W1UaWrfm7L1zE$Vb
zFnKN7ebG?EbXIZHES=`&NY`hzv|dh`qXMihrBs_V-bAunmax7zmjKfhl#qH?J0|*2
zbK+9h?I+a{?5z4IXJcZkUfR%FREo|^pyT0nGs4RyFQo<WaMpYPEPpwWhRIu~wH%sQ
zc&Bip(IFMEe-rHl9LKl@lbeS}U0T>$oS4IMsN$&{SPdmrm3~o7VqeIZA>Ri#BlxP{
zE#fYsPuK*UzosZMhvQSA#@w|MxJ8+$a#z#h?i}TjDc<*wx_u^swV5^RqgELLN^?Y~
zzCf~z0Nz2K@))Smj(@=SkwU-O;74^g*V?FEFH^tW%pX**=j^(^8aVg$K&@xH1s(h7
z<*Mg)(9y+1+iv<gKT22KojY#rsK={v+&b#?@}oQH_r_CjeFLWkg_yggPSfRXB1n~*
zi#5ux@}6o%n7g$>DHiT4E6Cgp4azcqUr}*ZT&+=}4MF&(V_x-#zTjBDM;mVjT4p@3
zrB{=m(`f6}m~=&*TVYvcSvsX_^3bN%z(qhh>Q38Whd$d6(4%%!u)+W{FYAo^gA~(J
zF48gbUX_xcpA{CM*Gv?9>B3~l31#Izw8ssjlMiVee-G@)-;ru|$jNAPTsDwJ1vPx~
z2*{obr}Mq&ap8e3R0C8S&Iif<YB7Tjzq7T=u-~@l{m%0!_J+Zw$d^4lHGjVFY8&A>
zeyI9fT8~8W3-#*@?>z8%>2Lxm8z6TY=2=(+dj|-|ybT0Z-IY5sSDms{CXB*;%0619
zy}&`We{>oroWItg#odNOhpXK`wXKw_3~U%9Jrtn~Uq(x8)H&NGf(0U6CMy;#2;G~W
z_(HOI8iW19T>8cNNk*YNVXwm=hdH>3Hfg{uoI^U#j_Ii}0p4JvPj-x;pOeXCN*Cqy
zSKs^Kp0NM<-~Y!RGVo<$0H-ALA}s#{Si>#Ne-U%)C+vI%8fB!qUb(042*DKXq0(?I
zxJ1~*T;DYHJr1mZ>~R(@H4p3q?WZG|c3Zy&MUPAL(wE7gC9{*s1jf7wZ$uDn)R@P%
z+&Hn0q}i8aId&+dJY(PLe^$W9KQ&!og?a-bP7*Zb8H+Z_*bkXIkJ2!4NBVDUR{^N7
zf46?<MYpa!;<1}V2@hQMM@S{ap<Tga=q!~uJaMNkkRSc~gj#sXBu=qUR=$&k0-usD
z)V{)D3?b+Nv(Qh1Er48NuM=F>8^K(d_(aW!I@v<gS)29&>J}MCn4rCCj>YE*i+Qr5
zO4pFZJ_35C;SCRbPw`7`cJ<roPT18(f6UM9+beKyHA2i7zA1ukT{5`YjD1h=Ks6W3
zkI<{t*u?Jp#LpPusu%Yk;CY=~@5g3&mFvmWi<LlSz<*a9j&N~%zTLTMgF86v5o{f9
zl7;5VLv;NGkkJGE`gpQpLMHxNwUtAji2XS`7L(<KakfZdsqHbJZ#N=-87*H%e@n$J
z*qz-E=ZSklJu$MH>qQVnF@VL2JD@vYfmmRlwcIrETii+h6m^HQYSEr3aJxFZsGTWB
z<x$Y$?0d*qDCB~kZu!RMlgZ@#yYDV9zB_+=;e2;_{_5S!^UD`+UtC;`7|fxg>wXzW
z>BgCDyM7D;|0;n1y`{&qbbc)oe^u5sVJ<x4VzD`NLd5pdJfk(qWMq#e?r;;AY{R!f
z#61aF99t@@PyAUR6tZ<Qr$f^?)7N=yO-qh>=#4d@ls?*lTf2TaKJ>|4=Y5GLS1BuM
zw|6}wKnDxkp)nlZ&2@ToEw*Ifr&$sD!CZOR10I)#-zgNd)6-E`Of-@_fBA4ksv4c8
z*p7HjuwrX|XTHhEp5_om+5WUxp=g9&rEAcgI6igfB#N6VQU=u*5?K6f%Ut|wH*3oZ
zf)?z)T)P<>LU_h{WN6U>s=V;n@h>8dl!Oif^*XljlP3)QyJ5m+X~ItJAyKH3iJ*_M
z)S?pcE5b-wlak#E0NjY9f6YdCClmHsO>+^&d3#jP&=wLqFnt83#W;?FAl+o^4?p&n
zw{12pQl-BZ&M#5eS$ZIRhkbJ;@Ac@ynCX6HKvNgSm}&qjbxx~MaD^icZepwR>^^d{
zIwz`&*zA00uXt?N1AIQ!wf6zq{$H14hW)>QgU@7x7WFO>xjepee_PzOEZ`I|)(0%}
zCQt_r)}m@MKCtnL52kF&Uks=79!7c_4;mW#9kL<tleZ6bnQ@NVBFekEl=2D1K+C;|
zwV`sqSDAF*E!Z8=CEvJeh-KSHd<`keb{A`ViMTz*T@RR=eqwMJsG1M0h%!xC&HD&*
zokF0O+sUkQmBjEne~|RpUhrEuIh$5-+iwHDEGEb2vV@M*bE+577#oFJ-P#v0zywBL
z^RW~F3QQf~uc1LK8usxGVBsl`AIxt=kUXk{f}Dn_#0H}1LYc;3b58?t2mZ#X6l)Hh
ztEQIGo)aYO)=ySZnlQ1R2@gGeiSAmu5%Czk1?)erUcX{0f9pr>!P*aBqW|4w(-$jI
z3&yH$XE>;)R4J|K9&md3dgf^?qqyHQ6bEq%g80*T8L*)c5Av=i^eRFJ3hiLz;kJ8j
zp6bI)Tdravh_1wr6CN)`a-zf}yIn<6D4;{=g+Q)BN*k#g+JtAW#TMcwL}&Oe489P!
zA{~b$yq?Rtf1%tTo?l#E(A*|}#WDWIzGi==3Ft{)i|yZB=B4n>Y_;_$g9$v4zO>!p
zg~4$$(5EV!+nR^|LdZn3q6ElBcM-+HUxv=L*t$;u@6ng+)$6zLMBUgp<1euFtToFC
zyHv7iQoYxRaHW!RuEkapZTBQbPb_#EBu?gl>E?1Ne@y=yKEEE5$B%J1PNDO|t)8Dd
zqQI9HDZWQN^n$w4k(?&%mAJ*A8&JX3^VjcQKGO}4>t0m7YS#AjSt=B-twGsbSrNb6
zYhk-|kt!_J8|CzgLgte6SE9tl=4FtP$u7clt=#y8(h69mT9?!_X+S!{C*)G4T2j?W
zS(w<We+v4a)eXeh7~-!OUsc(RP8cPQT3(kV07?~QhO;P5r0-EfHoUEVY)06vB!DdG
z!2_V2t%7n*B9CuRp7fbw8e&Vos_Aiz*=AkhzzJTzkVF_HHlFldBpSME62=w)cV8Ga
zE)k8wxY;c9g-z-n(ZPZ<6V;(zm~P_eC-Q`_e+BmgxB$6_Y|Xcz)gWdB>ZfkpHCPt0
zu`_0|;MX7%Oh7>~`=rJVK>)+`$0M!!>WPh#RI2v5;!3vu9Z(ues2iP1Rs)p;-HYX2
znx6}t3FNo(WfH|0R1Q&FMZ}=$bClwyhbHVr(xCBT$aDx5@bJu*@u8=BGRjOX64Ny(
ze`lgtwVpM?S$l4KEy3HG&m&7Bif?)BWfBY<WJ$)8OugD6t-{z`k)cY-SaA>^%nw2D
z9QiU^{>;!}YQ=FX|9({cp}EEA^SxTEcTz(whc(@ZG4ns?riH<h%$~$QD>bcw*Cd{z
zDIWZIhp%oly1QahHbUC99`dU9>60NAe_JQI&k}mr4!)hS{EGHL56<G=`;Vc*$h!};
z=68EN4y`wKe_Vp5+wJk5ILeg)RlSP#zi~w?qpcqcg_#cKe4aRTcHCu!`WyYm^+}Ev
zM+!(i+U4EourYK0>=;>FoI9+I5xWW?XpiQb&2+0w#2tLby*2Hge5F^jS$!Ume^aJY
z_Ijf_WSGN*${`@T>GJi<3wC_F^5-k|^!)M}yLyRE4V}H(HvGa50(ml0@f|NaFc~k3
z<xOPbE)gMQlD7?e?8;)*;g2|<_mevZTW~=CX~-~preqMk*@eY(TSuqwU1FNsB7#&2
zIGdcnVaQFyUE(Ttkg~oLKM4eTfBov^e^XY5pUAdX!1Um8v+C|9_SZb#j&U$|VoqR~
zT#8#X%5BZK?G>2E2Zu&KVOP)3U%o_tlpijFl(Owm$cz{XtC4L&D8F(m@nna=k@Dyy
z+mUjnj+hVm9&|B^;am~>;)Vw*;dw6D*KOk;g;BOb*ioGQ&;R@XsV?uKe*~8Xi$#du
zAv^{}A&}Hkgd+Cmt+dI501h}h^P1DHj`0MwOogmDg&I~?4b^kb@1A0Z$avTQo_6!^
zp@!N815ByR)pUet8(Q=JguTcm>`L?^sP_Tca_~}F0-|kTBR@I_2$TdTbZm>Gbh&C9
zoX)(VH;eAZm__X=DPUE^e=<~7?AWEe${*jm%u1Z9J<QWovuD6P!rWi+EI(3_9<!_S
zfJ@0fxF?ggflbCI9No1PIb)HPdRFjgs~$yd17}-AF(;m}BT1U9sS#Ja&Lwbj*O9#=
z<C%w^N*3WwAu$Ik4%x~_pJ%XD?)J8!iOH$zb$lE92|6<|Uyq0Qf5)Ul@O5`~@7N%O
zh@o(}&Ks6^de1XC7HL{Zio^F5dB1NbhAue;>XV%;|4TOZ2Rq6Vvq%HXc@T*B3#kI5
zrjM3XE-_zfH&N!r=AIV|DXHXv@>C|O`8IVF+W^Dya0?miR$iLRR*)<STn}~W68x&@
z4CfHGWpWNxBihrMf5biyFs)g{F}%RatYnCl>4|t8a^zQ4ISm{d3o9AUDA}x=7~gDy
z?WC}c%B=p5Rx?|p{tYL(C1KPhTNotc+}+C3aa4Y@fto3eUw;DlITi8tKn<$wjMk5g
zrDzgPTH58*`BipX%z7WoFyl?9S)CGO1x-Dj?yt%ZEYpF>e{_QtAGwU<Dy5n8Ik>?1
zBJ_C7DDB!0m!z7E^&;my;IVpR)5w03n?$K>rI6)Z8E@IU)S<;^HO$7K|7xJ2sEzCp
zL!n=5|Diq%2J%UX9@bRqUu?T??8(<y?){ah4rs`gzmbho%1##bb1=X#&9_0SQvJ&s
zGpcm3q3pI-e~o{ODKzcL?)Y897QfA~#qOaR9%fAgx;Uk>CTm^pMkB+{`Joo6Rwv00
zgXEgAmPb-RF|9*2zzJk;K-(22y#pwOG0#3>IoIzYA$o^ewC>5#P5FKQ#A&GnAkci6
z$r5>V1uh~DOm7}eNt*vVNaC;O6q|IjiZF7BQF>|Sf0HYo3bH~uyt8NTkQzImPOF`C
z0ZCbfAfgz#qqzT1u=fkHemZ3rI%|Zcp-z9~M#4i|AeMZ-Whly^h0YfI(Ms(_v1Brx
zuXOeT7?n1EyHD7)5F3*(qblApn?S^CUrIQt-LCvVFx{v{rMKzvQ0$GxV&Tt0gqj!Q
zkxDYYf5aoETt#W%sl2wy{!k}cIyF$5aqi*DjI))Y-qz?^0oylDLohfcl?jSFfUaZf
zG)VkSAhP$dM65RmUr?mEF1@IA-Co0de*k7k;fPMIu^b<a7{QOJa|Drs-Vr#7XXHlT
zfyf4co-S;Uzz$Pa2w@EqzY<AdwlE=L+^p%he@!AZeT$2YrvMs(hg+(SREak<kj%2Q
z)#J0s+xGmPwx&(zX|j5bSuw-3yjPwXow8s<rhbEhg4K5atHLa^hiecjkT|pj*R9Lf
zGk*!-rIxeFW$2tSm>*f0E|l&rMMC%@E}SeM;2~5b-vrUj&3vhuGfAcNLKamJ&6MkA
zf8k@u0)ZVdsR&RX9-w!bhmewDdwZ-z%Ys`gR5BkeGv@go`hq~@J+Q=>a#In^g26F?
zatQ4#3q1t!uwE*e9|nF1KBx!E>8;)}2lx+>#9QOjf?U75B<3sz+!JtdZ6*xr-=^f0
zw0hP*Fb>$5`%>{8Ew;-3-m(P`p`|^Pe{KryO*Gx<eahTe7x3ILmOoD6P>!S<?g!vk
zZgOW9tfzDROtaI@I(Dn>1CNGk@;p~4zozuPf=?>V#I=x8b$f0%i=n(_-R)M5DAv{D
zMjCa1MnAIm&Qy;StbAg_W|v#)d%P8Arc*v?CKIzPJvI7(jZbtiWcL%{cB3+de>_1o
z@JKy2gdE{aRdNyCruVt$QL;jPpcrViMc>2`pa}`@Qg9E2kTmk=@#!h7M_&8CAebag
z!bc<HmBFW9;~VmjvyV?7mdE)XjLmQfy2MvQ67DOR58cN7Q+Zqr5M;3gG;0%$pVni_
zkIO?}sWkpr>p^(I0`x@Nkk!lme}kW_NEP_Wwy^e-$)sXy^yI$E6;tQ;r(P%bQpk{0
ztQ8|(E(VG~=L!$Bn@i!JN~(5klTEKtv;H#_ZB~uy&tb{?tkS~@>V1lN915ks`?kFX
zOYz$vy6wUtc(XZT#o{NNp7k!g!B+Smv>itgIwo!)o(u6eJuJkt`4ZC#e<tj_79PyX
zHiDcV&zJM)M#LBuzVSJ8F-<^+=JY=0oRuz{lD%d9Ho*xw_JpK+!UBOgM1-k@K|W<x
zsT*ek(}tidOr@o;cb6}L8lMJH>RrH~Qso_t*j2(I*x`+T5VKVjUCXibm*5HTMBv|u
zc*~;215;+lR1|`|g&3TKe~K7Ix){yKM=c0ttrxD^gPOPp+<GIXk4_(bIX?aK_|ad+
z5DHOI`10P3v%OQ~gkOGT-ExJ+t_AZ?`!+TLn|(RdLTt`;gDhHe>ZXO6cAoujN0qYV
ze$&9f@Ef6S78FFewzV|Z7v3A5toAZhnY}zt8)A7rZ8!H|%c)4$e_4$+?7RwKi}@;o
z0}xPT6k>FHq6;9TDL}~{5(x|!E!1d=<aBKYRvO4B%vCWGm&Uh)_hX2@1-^Oc0i_Wp
zP&NdoER_v1silv(!GqlQbdUvd4skxne5!lo!S2vZq}rAHkzMGTn7i7$ed;2+6u=zP
z-&@6tc{g)450XY3e=qnPq4ly#yJ(?OOf-!{VJv1d+4Wfd5@11LASvdtNS>%-NceXS
zKn(rM>X;7*0FbOjNn+~eI3h{kz+;1S?N*x3Q2?5hY6~4VWB;fr+SIuZH+`DMG&bX#
z1cb)7SehW8Q{DzR$UDtVh3=Z<m(8@)B(qT)=GtVm>kJFPf0WQ#`Y%&cXNscwv3fq}
zC8}sNR`}7PkX#=LYUFAEf-yz=QM2{-ui2N{zZQ17V=s!Q_=eJsd=q)wgYZX#oB8?M
zw{NbP2tBNGBro?ZIP_yN7hr5!MkISUIkljL$5_6LNw#lZU%l0~xMa$r#50YyH<`9K
z*-F*vGIy0Ef19)E6x%<qBAK8~pj(<^6u}eddPIY~AXoD&|DceaqVp^toj(3cZ|D5S
zQr<Nf3%SEEWCtd7MiB*rAY;%R1(Jx|{>5Jr@KL=QPLrlOeo_-O?cEl&pTqFOzK)k1
zgYU?2!{&nQu9WuCHKcf3Vo4<?eE$9UQ?2*4?ml*Je^*k>oxjew6kk668x+A@CE(GJ
zVxGnV@}={ZfHnaze?3I7m!ci8OH}Vr3ai6O2lJ!h3#_KkqoOv+sfaexL#+AYr^sO`
zPxp^dJX>RQjXGyxbwaaxhYIn4N=$^PTHC{<Nu;5@;h#z+8;8ad4Ns2Y(=m+-^;lYW
zL#0Lbf0sVdy9KlPDG$LBSvi6}@fV({rhNmqT$!Z@d?TDLO#L0yDxvw!LUGF!^Zu(_
zU~7uu!5tO$yix=PEEuD|_&^kR)&u@}Ej*tm0?mK)BlrEf54(}mu#D1WT>&_#EHFFB
z%8DeM+;+O`7Vw^^p}`Jv(OQ*y9`7RP+EZslf9SmxN^T9i1LWiEEvNNk&BtJzZ*HNa
z9)&{A3dcI<^EHj{&zSHrLxQ6-l};5DHm3w6G)XfzEM0=1SS*&{r$=<XI0cWrgZVKI
zChEX&G{S_v3$1%8yNE7H26a)|k6n9yHcoBZJzf#`QJD}J<zeem6sUXPrzQZB8z0Q}
ze>7PUFjt~rg#h|VFDP^E<#e+(uUyiwxTbE!qFRGIVQI%zt%#D8KEE6oDQ&{5DESrw
zQuwU34^`1Do77Asi($8f1gDBAA|QoLmRno21hT2(go4G?c4hv(D#Qb-pp*2kxu!`+
zkb)wgsYu24MWGq#S|qCoZu{=y?UCIye;LkDN7JKR!+7dSR1~6*C`hB{o_|$AhJ2_I
zaBHaUIb%of!aO<6qre->1e(p@F%?KEG2UZLJX6SBaTFyJ_KMC$E5U9>5R4I{$((UV
z6lcqFBV8LzQwMXlOs4UI&&5dPNXCL{hZsowkx8V9(=a6TDcy@iH#~!OI+%_%e}fiN
zTqj#Wix{?wHnsI#HjUC0&Y<}#?6P$!;Y$gE(bP%3&&keQdlt~==T|BT&w^mGz7>1>
zL|A}MsDe?H&;gz^xkm4LzCl%Z4Gw#D3=8bw0z0`(Do1SyD8rKp`#~6fX51c0*RN!y
zq`qfBsLrqS66oGUS!*F2EzWh~e_C@t1PCgq{Cs%!kgfTK%|vo5M3^NMG2fHaASQw|
zzL}3<ANeGQw>X_rDL7K!>x~G{-@M2Y13lrTph-+Ko8&f93AY9~k0rUbC;TRY&^vX)
znMXlDByuc;z|a@p_*4DHNg}NZUCq7czeDcLQA`~RpI=pR@o$F#%?8>Ze|v@Bs&n1D
z@8u+0ifIJPH_ol$nAUKI9dDRj$8Eo))YQvwpR&I^e)yPGO^oT)$`T&3eKWPJD$rw#
zWfO6iyKWCO$b>1i?vs`3K)Pj!UE1hD$690Uut&8s>%T)^{oA9zu=1p`{o&pX81GWU
zu4)i~QpGVPJCs{|Lmy9<f0XB&XK&u*lqcnmOA#!_WXp`;eZGw1tr`zaJjW;~mrd0L
z%K~(wa26rn+)|~{O1^*-Dz>Rvf{S{jum>%mYL&QeEYhl^i$jTk@8_G3L|xPMeDj%8
zm{#)O`4=Ah{^=Vd-1p#d{O(SyuI-U$+mNsQ`O{)kbF&K&+^E<Fe|*JMk8)J%pIuyP
z@U2u<`9)zO!sM;;&27lC0Kkf$vWQX@@=I>wmt+sA{(e@A=~}n@hfd^CakNzFQ`w2j
zI<hp(sm_LI&4E<uPS!3rrFi9s?UoYhhkoMope{AC{WTQ_KeZBi_OZ1V2;Y<?6Lon_
z4Yz5FTAc#*%M>n6e?h-`4Kv!r(ZUZzPsZ!OW#lP;lR{(AoQ-h+Wk8z0snbMzGTerL
z3SPr}*B3}8AA!T(P%fHoOJK4bRoKCznbN#==CU4XyV-bus#@gy_?LwYO*RvAo=TBV
z{vyYZIo*NFSv#s~_oT*i)4UNG_gp1>3C?r0PC&4X75nSerY@os1%KyE<p+)ndje(-
z+XSgB9A@5KzU;|NxCF9IXF)~SQ<_2#)=`t5((|8ye||NfxmVa7`&@O2zr+dU*@=Av
zC`}D_yl)65f9P)X<mptukI@>j1;QBrlH<0@iG6&ItIWmsp?Ecb;IUBdMHWQik_!I1
zIeZ)SS)EMkoSomujDO#%)mDID^a9+6nSc%q)T$RS0EcHP8d~hmRce4wz*gtEsSl}@
zPTM6r(VhBuk4{?3{!mc?nF_CyP{5%w#>!Rx6W2A|@xCRu<emxZ-tblX8#LeHp*ryA
z$zE)(=rvQPm5SFkUopK*Pewa~v7Q^ECK&NR9Kke+)}@S-fqw*qxTB&3#b!^j@T|9#
z(4%|`?fY?|$h=;CXgbs*VyWLSC5S_q3Kwc8@l#nWJR#Oi0x)l_R|~Pj3#|%q@-9?P
zb^C*Qjry>4c~lV?#>rJ%9lc_EiIPhk1j19RC{D(Z>*Fzr#^o4}7g}cIzAeL>RbHp(
zZ@+(OZe0Y?t$%S#**kdvnS$|<*Wk>2CT{$>$eoRQABsI3BOie~gq*n>-`?JiLBEaD
zI1nMMX_JPp`@o?sl@2d#Vz$X-Qm8#_KRd=0!lGmYT7M!SR8BxeB`-I@3UawZw>6tZ
zQ34K_&G23qP4w1syd|erPr^zHPklN{g8jj7I2`R*uYcH;THt?wt`gl8Qd7Vc1pT8n
zNk>=|4HZOiZ>OM<zC5Id?SV%HF9rRErPc_ts}vU|<>;iRT_j)!67|C*j-cW*=}Vc}
zlb-`&zA&>nq+Bb!rMKmvo!+#+h@l~p_GF`0XZlkJwP7thdQK?Dql3Lx8i4Nlwx`m6
zfi=R~zJJ1`F*}K@kakcpHI-yAJULSaFdBG0NSQ2!>96?T7v6^{4bx87xPuy~*{&7d
zi^?vuk7%Q@Lmz=_Y(AJD;})0^l(nc%$7{$fQ7r}h<N!7sU@<(+0O&dgY;PV;=T(o@
z?5!%0Ix7KZ?X|aN;so>1qTp)r9%}anhP80rqJLOJ!p*=h!7(Qa@^bQhKy4i}qNET5
z=L{pmQ+Te5cnn5;mJtF-bA6LR2-HBf#_6vVl75d3mc>VQ-&_l(yo6!67YS4X;103(
zml-OZs>Ihjt+El+o?6?tjQM6YVeh0UqTJanCp28Z*MEglx4*f{GATmeVLFJN&X|bJ
z6MxgK0>^jj5bs7RGsQ|>kt5Zg!%iF-DKzK8kMN7>PjCow1fg@KYQTFDWa*hfDDq=h
z`DfTQFT5r%(r);=)>ENO0O`tpX%xRuzrOI!p-*+w1Z0Yutn=$X><lBY3+E#-98&V@
z(ozFYRMG6&6im>e8EaV)015e$Mi>WB@_);cDB*#`?BNL=>c?dBsj<eEDACxh05gc)
zWP+p!e@lX6BjPbJwn7E5S^0@>@IvpoIh{O2$P%d{*BW@_$H`>!-kq@T0n2o3K|Fb4
z6GYoJ7D_|oXoP@*Y~U@tm>tvijq(J3@`MRKU#a^vC_@nhiaO;$x!ES*TL)yJ3xC<I
z_LuWSBa@<+!IuQT2l>PYQj$5i=3Qjd^jG@FhrxuDHj8O)kV9N$8Q+Vu--S4<MhYL&
zpiyRvNm=y6d5}`rN;d}~;~|$}irlKxSu@+<(}^)N|E%|q%I+1oNtFZH;fy9Z_y*9j
zivsIdInh0_i3J_U-Adwg83#%{p?~6Bpf5b#gIgb6`4;~egKm_sSvAd306QX%q|}8X
zx%N)Qu1<$C)h^YI`-sD7TpHvfi^U8IP!4tYP{VbyL5fI(T?`PlW>C`1^PReA>qWST
z;<>{1yV7lXf@lft(Z<wyl5P0X4^<;e!{SjW#!xSU_P@ky$QuMy=SV-C3xD1AtJZqJ
z*20uhhThp67iA7Psq<Zw1i(<dGM@?w)K64^p;n;K`=JdP#KX+zD0Gtvdt>BCl@NoR
z8!aUW#kwGio){_RCwkTp@x&@=T3;g{vA#^!2#W&i=aDm?^pYbb02w@0Ccat`C`*M(
z__=D)cJ=)AyO+;!d5Xx_2Y(O`Mo<wO?k6J5V4qG%oa-qJB_htV{%Hr$=})8e2F+s~
zC00U00qgLEup78pG6Fk(j93U=D*ZW(X#T*4WZ-z5uKC?aF?qi0*GTsd!$w@_mrjB9
zj!hpj_hghcA+s8MmG7jEWq)*G%4xu%_Sqd-&Jwun{1S!2Wu91YC4WDXh`oFJ^n|2V
zi_E|;n39N6f`Wlh#TFmX2CY@z6|95{7#9&^1T6#_QT|#rUEQGZ5d>#hcQ%*(*Xzq-
zv$hHQPOYM$DP@!i=3;vT>d)e`W0|f2Hc74FB2pV5r>c7zn~7}{ddv;{wV${r#q*RW
z5{xv&X{h2C2D~0XAb%pNAl2aYhdE-A4jjamnEvW}!=JNgg4OYd`%_l?DJyFbw{O!r
z)esGdxxIbdZ{n0k#MMm$RDgW9WgH7=1#He43h#Kf)lEj(wb<4fkSbCUl^R`_Ohu4<
zurcTnGcEW`@iH9c^smgd_t0f?;RlHO+-ixjW4EFoo_q2{bAP#lk4{5t9P?UVX0;hH
zN4yS1FqeKHLXg@1GK^y3P1p~*Rf#_k`Z=yc(H!(;cF@y4d#=u@HN97kAD@18qH`;-
z%}+H-x+>`aSDWr^pqqw(t}tJ`@#oiAA{GilL;79VpVV4KpTnpxbU)pq8b%MKL;x0{
zUJbAynqSk|{eR{mDI5s)Mz?Uv)&K&s+}s_|Dfm{zco0;>192*>0BjyRUy1oO+(2J6
z`AJT4x}ew-9D2KAz6ee=*s@oz-)iivY);UQhRiDj##Ehb%0r=(Vw{Cakz&Kh)bQyG
z1olXuUeP+XzFn;9`8@_o_r(nl#-@B;0koIyFktM3H-D5IJ6dve_Ux3l9L1SxFK;BM
zwlz^wbofldGO^t6W8L6-9ED?A$uT017YBQt$rd=gO5Hq2`Hmo;pv`ww91<8Ez4+jm
z*WjGWvA^<@TDN|&Q8BEJ^5P?e@^90U+Seu`SIilsCK63|645l}qPKMz+a;mAA!prK
zUu%9xeSb0^o}P}fu9*)zcg_5{PX>L57MncWVxdhnPJ9cDeAX-KVaXbOKUB-jpZ5S(
z-=m~ymlBD3`sr37q2M}euQ!6~4?*JnraORmXg+v#r}P7gozf;*!B+c2pV9B&AL}!m
zAhm-Szq^0$8cN}uTR-%o+s=Dtk<%60B;Ug*KY!pLeO}JGb=&PID=R+@;8)SVw8OXU
zzN#$O5AWgUuo@Npa&hY%vRaP1jzb3n=UQy{Ss*ov!nN+^B`FKqC>Cef?g}l=EBL$5
zBxLAsHf8YE{<5*5!fhBKnb{}U)^9(;L^>09$?hxPgX~ycBS4rzT?O8*M%0dT)Lnmf
zTYuILFR5t+u7Wn~DC4PIM`{Hho(Xz{Bg#p&E-Tn)<yt<bqj+i<WyPhlM!x;E2=LtW
z7(nbf+K%r-wq>ygC+o&XdI_ZtwWisQYe*@*2*X#PX5|_!rS^rwPj)OO%Lz-vEY5oK
zP=#7eD0yUHe}6t11Vx1%u*qbH!h&M6Nq?R@ZnI;%V3RTjPxdZl%{MYsg;L<BfD{$*
zYf}BJ4EaW`qWx;)O=orGoMFZ}lc67;X|IybcF<l6?VIpSA|{r{-(i<Nd;)w@a)cgd
zbWf>_2Sq_Dkr||v%D{BhG#q-PJ9VX4bEvM-zw}KQ=od5GJH6pKVA+D}Wn1NVv41@+
z{c{YIkY^l9Tci(##a*4fFztc7y(4y1a^&@J0bi;8+`$JtmE~uDC(hup{xtLoU-H}H
zfHzdfGt!B6rs<$q&xD6y!XxCifJqVPn^ooygcXVdUWd_)_@~{;JZW>#PV0%c%JEuq
zWhy@`1mxY$PFDBcS9$NNy!Tb!`+q9$eU<mV%Fo21cki29_LzyX9-TFUH+A1C-90<A
z2iehTJBzbUJw5iS)ct4(Z_&Nm@!swDTXQ>hnoz&5H2%wOciTSBZcpU>pxvIaeWl%=
zDEL!5e~m5QIy`mnr@i;n-ur3q{j}8pTN@EW<wC-PEP*ZOq9t3%a^QAy(|-~qx_&xy
z>DjOun5M_x!BGJ+iv5t?Jfuo44V$80ZaoCPr>wF~yL`JO7VB(3*LL+zj3d}g(PcC6
z(7}8fT7F~|W64Uab<G$w7N%rd<xY{Xe;?J2TXx<e@W9Sq+43ItaLYa?^LYoS?5g<W
z-Y(hieQGrc3#-Etf6QpixPK+(1O!{&eF;h2<=j`?;i*N9<o(1(Xo$;+-(V3xQ2ZHN
z__0jJNzB8!)uv4iN|;_!x9=p(HpA@WRTN_Lgp9agYJ~tuaZLCSpv)6W0Jpn~fvk}F
z@g!o`LTqgQqW9f<YCkJa?Y;l?-v4^<f4%p=-uqwg{jZ<D|J8h%GJom%4@9Q-F5CXA
zaq0%TMl7>vkKT{=a0h;7Nw(-4mcJp-uG)}&+}Y;a)rRgn)`!o-IeYJ<zjxB#JL&(q
zob-jKl*YUF?%zA<59*{JF#{H+F5bKCckDkzu1?EOp2H>tI1QGpe93fI`$Kx|SH-!^
z0@b2SJ3he~Zu#~B%6~#3TM(*|fsvwf2*Z3$<JT`aHcMW8wHmk)ko&3q^d)RMvo6Lf
z`9x*0Qjc^4gzXSWI=$M-25=0iyE?<Pu@`*kji|x8kNEyBT1hUpbec)TLs`IL%=r8o
z9HLnmK_!YGt0g>v&L{Jg{xYbD$8Xys0lK)X&5rhT6GYtmCVz-#J(@J!Je<ygXeJNQ
zZ6ul}A{p1J{j5_WG*ke8z|qVPc?^|D%|g2HXFrhdcV?OPgm!C@#7}t`g~(fKg~r_T
zVj(dc6+|<pz1XHJ7i}O$tCC7xZ(6km(X5BqZD_VeuiUNY+9#0ah%!6X$?YoQh~*Nb
zmIrGZm+$qUtAFEmm(WCX*|7Q>#!v^M=mB?Kw<kjMH4+5}!e6Ts6t#gkloQim;XlqH
z@YaS5)G#$mj6wL}OA#*NJ06xLOPf1h4YY?-{+}ln^-&Piy6T$(XMbZ@?C4N<YZez<
z$q<kPVZg!Iir)}ABv~=SQ+Us0>%b)i)@GrzS>R-r;(xeDDEn<8l+9zo6LE1P!sIHQ
z8Pe=$tBD(`%F3SaZn?F#*v;B0RZsPs$lEsRy9U;M*lsY{uVS=X9__y?#XJ^?t2)>C
zl(TV_0QO+)u^+^26-C#QNq-pv;Q+efv3t9cV($EP#-;f3@!#ANBtJY@09E4&3_)Az
zU4`z-MSqj4W=RU|yoW!&1IOag<K5-UtoPW+WJtiF(hrHBM@%I1$#4hu$z)RcVAHX&
z6_FSh3=-6kW|>X1#^R+8Szky<ZVUXmpIA2Cu}ggF;J3My_qOz9f>P5>;uM<PI#@{S
zV3Q>GWWrvo*TVC8B7!Xw;m@f^K^oK9abnM5a(^RYf3bDd^i<uXz1&25xp~WkZxMyv
zRV}_997VB_%fP4$ltiBkADd#%S8(Q~M6(sh-*72h=ogn-{b4j-X6|jzzdwI!Xqs5S
zkoCX1CoIClF=DWVKnF9SPxw&1yX1b~&X!furL`$QiA4JK2WXRM-QZMTR!*c9XnS|^
zMt@j-@C$@dIQB#!K;@JvU6x5bqwpl%1cDvA<`?JM4?TCpH0AsFM}}kTQmHLMWaHoD
zxX3fg$)PuWDUwcFtk0HDf3^RtJzkizLTLgvO!F>yyrlv6qnWyUUq#8caJ0kwTS)9X
zkz^3Q6+%=U9k&*F9eV52jn~<RIe+`~`G3&+zn@w2u6p*>W{rI^ZKSpXxQ=L|UT(W5
znHA)di<)g>fvw$12*gps6XEEaZn;DyDcmNrre;Zcn>DrWCF~(UL5Nt4MaXA_`^=~r
zZ2lX2Io%J$iu6ribud?9xv>#%0L?wBz7d+5!70dd)YrPj&mF*0tMNB^wbs{!y?>3C
zAX8kNs-P|<YN}*r(MQ0+D*z*A3!eU@L}Fkw#i@Y*E=4F}d?TK)ibjhuxs^lS^fv+?
ze!`-_)3^GP`IZT%yod+aX{5nB3ASe!FE8F+eAb$+!m*h<Tq%2Ha`Y+H+cTU*9f|%Y
zSnlKnK@!x~6=8{ZakSaM>F|Xo)_<D_#J@4LjF00tZ)iyodT)g?Z1?sPlnHT~2$_sU
zVe|vh<fAf8!ndi-&v|W()UnjTmAw|j*!2ff3^uFz=7<iByFfxFE3Us+vcxQbWXJ1N
z;vvq(-tQEHtUhQSP;*?+p}G3Z4Aa#oW(-uwZ8%@WQ5dDtY@0qy+fRNW3x7xJb9=+h
z2P4x}AFXq=oIg0LbG|-*y?8b#W4?d#;17TJ!yh($e$AI+3ayW(CN@3wLr>gIev*F}
z;(w>7r(ZsP%&LAref+0C|M}k@vp@Xl&tINCeE8*;r;phmP9Og1%Ris8Kb-#IBm6Iw
z36KA9dOE;Io}R*_)qj5@|9_iK+0$sVjs4{+LC4UWXK%(TKmvghs?>{O`CvL_S8tyE
z*Z8GB7oim67sg$G#?Ci<z7pd{lT*0uQj^gb?fIz_iv=`Zg0@>c^cMn(&mK&taPQld
zfPRp%RjxJm1Q=R)RDi$`hrlA7hT<sDbT841wPiB_Xl~38VJy=n{D1XEgy(NwFdirV
zLih0VL+cg(dJ|w<7)s9YqPZNQBb@-e^k}NR!<%Ps-r#vGhQZVnCJ+2I=6d{EA)DB@
zx`(J1=4=s1Yj!l5Oy|*h9fgL)j-EWgT(2xFbwyH3J^8hg%x#4r)lszW?UM2Z5lwfR
z{-|fg&&=)#xJ;Zl4S$PzrE57$b4(CL8?_CyrrK0=wcvh`#=?mOm!Qt{Lq8e>6Lu7)
zL2&fG@@YTx<w})z^nEmzN$$C(96emNt~bYN*trW7NV%l&0WJ3@scgTu@TXpxEQyd-
zrcyiO$I28lDHdsPPcHZ5(nKy=cYp;&`F~As1G~{n192dVB7YY{$LwC9v>5Z9u?eB<
zNQ6H@ygKgr5aNS)spv_2`)o{BpSn{^yd+9^;HY48%U41(pg37YOH2i&lLwxV?J>YH
zGmpZ#ABZuT;A3?V7>gUoGMEc{Kr%NbYmXg07d%K-l%@n3dnfn_JP=28Qbw~}4S}hX
zHZ&;M47q8DJAWv%N3#L|5mf5Gu5s6ADBUU;T2Upd+|0ssJp&+A2=zfgMj!M!R+&?a
zB5#bnJ|Sy#M7g*?x;G-EzM%GSC;%r+gBG8myHeN4Z(`wb>OBf+suYq&JOJifh4HyB
zbZ`Ug@-s{`19HKCIKPNEg1=G#41k1Sk6_thMe%34zkjwsP5sACT*{S0D0(br<9sNY
zR240(o9!wqRjFDMs3KoY@zus#1J!pd5U7OvX=dk^8iI;7Eu{R{uPU$~B0QsEZ~7Ty
zLP{hFsu#%-8RgEWHij0&!3r4+#@WQtPxK?0@;;rjXXtH(7&n3=$c)(xq3S005hk0b
z$vj#M7=O<+rj^77DvCh%{XE)iG4&bUxEs(P5M^gH9g-sxMKj+9LL^y+nK{f9$fha-
zY)4WmWVbbGweIG8P43(NCxCjMqz|ZSuuwS}q&Mr8KzD|7>vlm_Z-ZT_qd2m8AB(Rd
z$^Ul|d;YvmQVh7|8MPLzi>A!N&RLbs#tZ30=YKYeug}^Rx@=(ZL?Oo1C2Mx6!|Gkh
znNNcah43Wh$h3YzmzpPQysC`YiV-l)kuQbAQ_rt3l1D}*!chW9-4DSg2~z3bpz_;r
zDQnIE`cUm~@5Yx=j9=Y*qbz72XA=efeEaEk>_I)^L70Lm();VO=s+rA6L%V*18L9%
zX@A4uO&#e2ETo&7<mgYl<d~`o$Co`;J%NI=aOaKdu<mA-RIW^~>$><<h0w&6r1`gG
zh35WHCTYznH-NDBj*?SuWg^y}P;7c)8ABzG6UELfhSHTmq-S~9j{Bq*+tF5D&owQK
z*i`3zWa+$$wLLOQt?FW4)>qw8C9$jSD}RgRs=Ku8sJup`U3JN(&dTdZepOeB`%t*2
z`qU4e_N}8>r{xrbU6DV9r6VO)rtQG2kOAW_(>Ukk(Jl!K^Xs(E;iLCi+@aD(Q?I|s
z5J|dmROoPr=hJY<C8+1EBR!%r?A0ofiBt92ghgY02gzA8Or29nxfVJ|aP?0Is(&<c
z90*hLgwh^~$V>b84JVq+K8I&=q>i5h^sHPNi9Wc%;aC?bTV*P`p-h&^ksXJXTS}E3
zV>ygEw~llOisEMKw5&4ZRIU+}$awavj=A#slz|H$OzW`=5&HqWOdC99$B>9Gpo0$v
z)W9KazvOlmNl_e5k0RvB6LOX5Du3hb8xV97eDU$t;;skin9`$b<VKZ8MTzNdgB!<1
zzZu8Dq1xt@MKKKdFmu?M4S=e2)%eE>KSGhV@Ypdp*sNu9Pq2R1q%;)1mK*3woy!Wt
z5s|X2)=@ys!v<?U#+Vxq9L<g&P9_gePa(lw)zW(CDw!wD_atsTIVB-534gM1Oy%9<
zjffX2JUZsf?fCTH{&b3t%kM!PshV5}QXZXP20gAH47W~`6cIiZTiys&(qw(`gt?nI
zTKIu*)tX6-D1cL<3jFaB1GAn0W)|UmJ6`a$A8av`LEs+1qC>5gTw!;w%+mv-9J{(e
z*zrS%%S7=OvXo+xa6c3tg@0)r#To7i?yoA{BIby1sPF(r!*K7h>%qf;JC-ZH5#EU*
zph=Y<(5jE#*9n-dUVBAmtrI6FXroXdkYh=bcOO1`!g%9b9tAv04f3S`Eo%WGyO;)<
zzq0F`eK;9=!dZZhQj*s8E1!a}eb|g-wjVmDB7OU%WkRJ^qE&?2>VLzo^-*7`K-IgA
z6meo@ZSP5&-9l7Vp{b55Rt`^PMp5m96}q-Kg;uZrWg1>Ve6p8Azb#RsOLP=OYqJ}*
z;`3<W?xBjTDESTKDegrKnW)J|?Or=x8FtAA>Jlfw0yb7i-T}3QC64|t0xX)6wZbU@
zjsVk9uWA*JnA0wfoqt)f$`UvkF&SZ`4KhYmmM4_KqOtPp+$tLX;If#b_Qt~EA_n=d
z6<_;77vn0;<6>IV^j}@`RTPht1)ZbPN{8A>9B!{I#1XoZqaTICtIH12i!7f&3u8LK
zTYfkc#aMo@yX+<S_DiAc6Wk^_@VEBiJUiuhF8oc>{h^LLOMktvY3O!An_r&q6}V8g
z4rY-`A*?P_E|Np1XQ+T$Wj7dv9ViPKlVhajK}xLg!%YhR-xGHo6&58a2@&>xWxye^
zc!zgx_!e+g90XnH`HWogM}Pj3(%eBmL+bYb`jL+pr{k~Q|N7<Q5C2j--=EVc;Z7)c
z>=;|B#&n>(D1T?Jpl`eEoFcm(dmRgm4Vt{I4y#bq;`Nd8Ov30Wx%N(EcMvdT`()b~
zW*>>t%7aC|r##fjwb;tz)`w5}Nq}c~&KgEQP9~F%-<D$uggt0h9{OHvDuI5pY?JBv
z%G>j(to4*rmb8<}r01%G7PCL-$ofT3+y2eQYwfyO2Y=6bX{7ewX6lQLb_s9DrqE&a
z7e$lwqvdYzknE9Hq<xb@`ffuk78Yhs!O}q^u1CJ2mD<^~vb9N!xv|i(=FI$1ONxO;
zgi^fDAJidxmTHch_p40b59&dU>ymOFv>^}YlXk4%=`(V_WNT6Jvs(1rD-BiJzh>WV
z|C$j_Zhve=9O}33=bVoqE=vNUK}a4ri!T%iv`{>u^SP>|rJAuQp0F$O;%dAvb)yKA
zc)N-GFhOs1G*6+Lh8-ImQ5;>D?I@HY4F_XI6I=sp>Trdp1q0%G;CUXNNp2%k_@m}F
z!xCFHU33=kwP3e=3xEPhhpqxtBELM=eQP(unSb?KSD)LVG>}SAUG_%^Uqk^!E!;E?
z+$R*aNLG;V3!SDQI-;L*fuX6h*(`!=LhN5h>zX0-#t}?eg+egJc9!~qN2{l9Lf`g;
zJrfHbF)*mvT8+Dd&BPo|!c=)lWs)$Ol_}{{IU~44D%P3kQoAekOJKXsyX&x4CZOm*
zvwv*UmA~DjWw9osoBzOkKMYFfN~#{;qp)ChL!*~D2e;kFNIasI&{4w_Ba8IqIDt5z
z!#R9hZ`aybJE5{*3q)eL6=*9)*<d7sSHZk;@O$O>Hp91*J|RCu3+?r?FDw4)?$EQm
zdC-PUu~aPr9x$fmoI@wv$;e~~1ItxJBY(BH$wF+_4cB6;O5wTZN#+K8CIUx^4g4Nt
zVO$Eu$a8QLiXbq*kLM5v4H-U5#eGl;9YLbVIN)1>VaSE94nD^F#*k<T0V)W-MQH+<
z6rPCv8_K&EY!mRgSVaLK8^&oMO6++6`|^|L9p^Ttzt!3-Eq1YAZF;a}2#F0TP=Cql
zt!)+;Wi?KN+#ADPjp63Ip?=wbvX3(y`VrIQH^yWQuVCV61T*L;TCS7HGAi6y0Oi=g
zpb)H1!@@6X9zuqg-VHZ5L)Q-hE<SNQpD)8mCjMN)Lj+h-92-f%{_$jD5B7#6JYWof
z&@r};{=PX+cn~dFjU@)^)01FY*?)tAVRDN?E(A-5%>(YEKr{UnEK^Ir$yj}WfgtVS
zENwbrSA{WjYgk<T>@&Z>KL9O90G7g&{CEa>)eHhP<7*xR*pi#q=kC<CCg4)0g93ZC
zM<rdGiv$^rSlfuBB|!@gl+okU#}f;Op<q^727jGN)nN5ko$~q^86D1hx_?SzfP-L8
zaCbQ&+Jg0SKRMEG#qI5QtSqSOgP$!c&4W*Kx~#TWdO#ZdX6mK>x$PE{`Ld_|a%c<T
zUZggQ)V%~}A2ATcZ^e28LD4J727VLpVU97L*aXoQ3=x29@O(lh*{$loE+@ShmXL|q
zXqtVH2L?cvE9cmYFph%234fwF51e@v&=I&Q8(-Zyi=$hK9M^E~oNp4qses+~=L*8G
z>c(gzLI(=NeGhP@(_~e37uCU83rg;Ts$11q4uRk}kULj(8<kH1w8t!puB(d=EZ59~
zhMsSQMDVJ;*~C$_aF)5u@fK$iP0S&XxsLJ&liAmi$KlY?nF2a&y?@?w%pI<&@o3)X
z+!jNt23}XyqIM>V9qN|TZ*T0nk-fJ~y~Mx?RIO*;ftPJ`$$K}dC*%GzLzqrpRqbk~
zl|jX!cEvOk__62PDon0CouT8<UMLfwG{PvqGU!gU$optVVLi0X)+e7M|EO%Rcss%_
z>|zkMTX*Kx7NJm<0e>Z)2dHP?2}MF>TsBBXU*heK=+$EFMX{48YB(wj!cD-#vu>Kc
zh#AwH76v|Umym=8HVpSS@6-&d$H+v3W#ySY$y<Zja@QEJ4cFw*N8*e?KI+N1DAYb(
z__ZSRnnhIYHj~E3X0WDbTMTzpd-o>noT(Nfx$p%#{mA1+pnup{VM?tXv9_l^7K~vl
zh;t&I%Sg3@1n*ns9Q4CNNb?wdZWP_Jqp9yMU!G9pg@%d6n)^DUqWyPJKV^Fmb)lB_
zZ2FR|q7WcvXIt8yI8{YB)??Gcp!z!~yew3!RNFV0MUJVXQ^`AMS~)2<;e@?NXgpdf
zBsprlR40sFc7N=t@GhT4H)5osytt<|dF|AY6fAh~B2VWl9xjEPLS2}(Z{tEJuqv>7
zMVE$UxIrXwM*S_J;`v7P#-Z4y6ASW&Tda!c?H#lmE}Ns4%~8u%S+{KGF;Q^c$s>q%
z6Aal$=88ybzX`2@c@DX^KAj^@LydO~u@B!9rD{_Ognw8;2$TyG_EcpuKyj(AJB4yc
z1zt~FF-`onA1<NA<Jk8IAWS}COTM9O4FYB&tYXw963Y)^JPnWU&w-VU{xapSH59An
z{Vba=RQ?Q<m9PuG;|{ov-4l}QU>EmG9jh-$%H<(sFQ!9``A+f}+Kbgpi6Ey*n3hn#
zAgCmz!GFHCiL^|TD2fFJ<5gd@x!riSFml50qA*%-ZHkX#byW*QN{*ra#!NX*yeG`%
zcS4DLcgDRX{t-jR2!k`2O^;EfsY#%~f>XBk5rdtGTy=4EGXf@TsVjy1=juw?!iVQU
z(M-ORDr!=t(Ael(V*T#1Tkq7uE?S0@1)2l!nSWFIKqV2;7T`A#w6o3Njc2jo*Q$m)
zWc<#j{)3(enz)TY)u#@lSMI3zp*;qziO^;Y`qJH>x4~(9@FO0`q3~k8N&1M1d_6^1
z&aZWr%z|istsxpB$lh_H#R82}1=eEWCLm6N7l_PtV!@&8dH}8RXK1g5^|kP4VX2K@
zBY#^)RD^eg=s+9W8Kh8ysf@XYoCDd7mb5trtnjOin4<v(CRHXrLXjph55{JQCHyCh
zVt2$6F0UnfH2HG+X!36-kh2&2H&#qO4{Pv+WL_F$_}WTCB3a@r`9``Bf0t)412s$6
z<OXHc?xm@juVdENiMfyeI3_JTMX@Wi{(n|^PbeIs%{cHw!Q9)`)(NA;38P!p6C{i<
z*^yWuhla_A(XBGyT|}F)b1W6YC#^bOWw!tc;YG^{ds;OW0<(bneu}Vj1(Ax9kP070
z3_K=D6pyfDHQFN`%mlS61IZ!1wB3RV{XuFxI!$y0_?`361D~YmiU{l}P>+tcLw|~i
zh{wdEW85({1gc)x$0w#o7w#YujD8FI8#|rU&cT^&Gn?yUf}YJ%Zz;N>e`kKZDDa}&
zu;*iB%V(0W*TaO;<oHsiqQ|2(KevI3)d5J0z+VE#cLo5*#H1ok)C!R@fmjl#ZX303
z)4PJo0Jk+u>D7ylHm$XiRe)qoN`I_oeHu`aGPXozrFfb&F42CC0&R*lf-PLE#r)Ai
zp{h0ug5W@sN>jztz9I-T{5fg!^WKp73fHUy)_TMCs6p@)Uiu1cgqSJruvKXYn?<mS
zwG*u{ii~#A$k;j!Tx~pAV0!FcZpD^!f4fUjyML#7@Pw(I#yGJ`X!M(CynnoBj&Pp{
zR$P~GsN741Xr<b_m($e^<U%p4-1B095R+&_zy^{N1W&ai`XOsC0oUk9Jh)}Q``}GW
z7@XQh28~@OgOQm%$}m|+>Uf(WS?7<nBa?a_13(gd$qk_jv#Htmv2qyN=RGX5f$`8K
zsSdI-3Iuo=O|i+V*US?){(oGIApt&4M2yEt6m<#@AKw4!HGU)|?%VY?>T}5Zs!rA#
z?w%@10)de4Os@P5HmZw_g@@!tJ}SmNzDdx9ETD58%_)weq(EuZ#2H<f1R}Mc7qe{a
z{U&nCT0@Atq<dL?cy>MIYNVxZC;Gzam>8$WDc5QWWPq+ZIQvG~%75XQ?8E!^HZlXg
zphGU4Me#)#4+R6<^|WF?OY*}}@?-a1uIq(T4>tBOP4j-eRN8y0v=~S|afsFIG`wXM
zP}KlNcai?uP}YV|Q`|31O>!ikmq@%``Yq3?rOQUBw54Vn>6cGXEJ5cU75S(&UR`fV
zQT`)%k<$PIO;CFgEq{{nBJekxLW$ia-Rq-c7aF0A=UmRYC#XG5j71n5KNKUSJ<$b3
z=7X-dvurT%Nk70+h$Kp3IjE#oxs^<*tbxwNQy7|4@mdxlL0?GdgMlVh*1;LACS$y~
zS*j;qTW@rOnpmjLHF&fmoX`lcTB5klHA74B`%u&!lmRW>zJGbqC43r<cGW4=*rO!}
zvbY@#va)=8ruknAgy}j&*4XE}+4_?U8?JwDhuA1@wE{c)2s>@h@@O}aDARRbB)Wvq
z=8lz2$?AtG1gGB#G7=y5Wu1V;meg`&EEwgz1{`)g;DG$ZXkAe(>XLdtks?^=JWlKb
zj~KvP2zkW<5q~~;Fj7UoJtb(?;WsZmm1Ko)vjk|ZaD@B*iTDLRx4<iUr9NLi(KFnM
zN01+KECPtKG0@mTef@;J!J8V*g)%o#Regm1l8l<`m;_=n7NdYd_m#g^CecQ+MG8T2
z@RX2GrN9!(tJA~~iuFt81pVI147dpYG`xU|Qotfp%YW3D6BH=s!8yT9u$d8FW!Xbm
z<V+b2l<i}=9m(%k%{0$0US7PtK#c*IDKbk_QrSg+)OZrU=|nAyAw^;xOm2W?^d#qT
zUJ@gU8;o?}Jvy^PRb_js$sy&%Y6N|K&CaKFmGR4N!F@)lD#W=W<`Pp(G{ZXTc~=3o
z5Xk!NN`Gi1dF^$CYHZB6#K-A;0LUBCnFrv1^IVe_15-fH+CrZr6j;2jJi|tnV+$4r
zlTRWBHfNoC4X61#@vPC3H{=IaZFoyyqlyk%A1Q5O%M)GvPB@QBXOCljc;|4$NAe=j
z%qo7$?LpP`x<vNkSLdHCt^6K70BUlAizZ-Gcz<QWH8@Dhc^mj9(7Csu$T9uOQ^{A_
zLB9aZts<C>>OrB0GnsJLVhed-YyJy1tcWOwV(H5y-Xe&C)qcY~g&;kCGGXUo*46<4
za%|_0OI>FP-DX8e>DX?TC960}mn)b&48G=xh<zNj(91)G1}FvX4l>xpM(2!6jP@Lh
z$$xT!86Lsd)Wk5Ve>|xXO)qfyFKP7;154c%qq*p_U-LWt+#}U_U@zF_X4rU0w!}zO
zwzxS$GIR>sR;tD-`DQX`J({=^R*sCJa)jMPb3RK04vy<A%O5w2nT?W6to=l77uG0f
zT6m&z8KZ^j7Gge0KcicxSXsto20%|Bihomy4YdoYEO7;}cg~>bbW8=Pv;fC$MOiA`
zOHE<id^M{3#Ht-0tCTsWD=1m6f)eMAwz*qVUFbfss}D+_oP#96k_NY~&=*i(s=s=~
zDnAg-8qCTnm-)Kv>iPN0m+aN+w+eSfU!JNLYlEnf;a-Wm<SG%HK`OR$E9>MC)qg6L
zy;=(qdL1eR)T;KmS?!|NQY9zuHhwH*t95=~7yh}`h12RP)R+$Skp0R6s%yxrL0lEW
za~o||s0A$W-OFH6J&{los2@SehvX{2qZAaKE`sQm5;|e@5lRlO5lnI|kL-jD?FoYs
zgIjFdg^HIl>%*u9<Bu|5;i=mgGJmE*eJa!wME_mRBGOfluAO`#WIp#Fh5_8mH4ps-
zq<6R~F<+;M0U67QA_+qMJ9Z0P=(2w>H&>sFzgPvj__s=sc28{7C}pUD&<LQ!?REt&
z$EANGLQo;9Y<mK`>atrd&9S(}?isM<O=<V6qXzEXKW*XkfQTZ^F>o?E;(yxsxbEOp
z8wT$>js9VI)MRZNSoJ?VGxUFqbX3nQfQCys*-36JoEf#FM1A<ap}}#7ZoJJow{}bV
zmZz4f?{VyZ+dDI|Tmn+$9LTEW(DiVxyD0-rZ?j^LYH*C<Gh|KqhyGk-V#NSEWLz2{
zde+5c?d4V><#TioEprbo^MAX9mKhYfq8X2(WMt$$b7e(qUpFjn|7auJJg^&MXGk|C
zJd8@Dj69f5ClHJC4R8Supgra=M`1N!yHyqVuuR=+iMuxVz@VbDiN%dCZmnA@@(49Z
zUsj0`Ld8c`enFnrzQ}@l4Z20ItQCVlTaHDAZ5yH!A2);T)`u^9zJK$)FL86OP&BJK
zZr@OQFZMM%`d`QYe)i)zfB)mtIsM;-c>m*-r2liq@BjVBx5@h-Uq|nM{J*a0;;Zoe
zKk$h+oA*Dy@YP-V>VI$5)pzN8eDwK>9>0v~?*IFj_jnzy!QXJr3~4`9|MG8U^anfv
z!@|Gezx7YRhrJBwg@5WtxDmb`AA*mC-{C$z;@jl?Kk6=={Nu-G9{u(A8yZ%x9gYWo
zz$Da7|G+!okNPRXYU&Sy|9-!=_TWE$qCd=H>AUq#{cxMD@-y%KKg?vmU1Sr78=F^F
z-}#?E(_ZMO;AVUZepEa8kNQ=s92*|hPng{*EY!)r96fokNPk0eL-QO7|A*9AAjh8A
zBrEncdwi1h5R?gdv%h9^^>6Hy{d?OGWA^Zbov~j(JW;F$=V(jBR%SV8GE^Tkv=GJr
zu4j}!tQfgueH*9~m~Kmt<f@9#DuIJTJ*YXXZC^n^2?S0UCAsc?U1Y?Es?$T$5y!e+
z$*2!c9(>4p=6`_LFT8k|THAi=@IZBL6}q<R6szJuAGxBnPo+rd4N>6Fw@w=SyN-}V
za-YX{e6&NpK4qq}qwEvmFEw3iwBiq#xUZtE6v<e(h7j6{NHyVM-6)Y2o!AR++2Od{
z)gJ5`<siE;N|SlC7KbX0CrpTL>q?$GYFy>FH3(|i2!HFvRKjb9-C^am*{tndZ8mqa
ziXF1d^UjDghVD0q5`R5VNE#Qu{m~{~7-a3CokU2psx>1{ifH7YXPs16b<}WL3yt&K
zICDadhw{cFTTc;OKA3%i3aJcaw6v(TPW4_J*S={=nqw~&*^U14Y*?8%*Iio@M4Md;
zY0TCNIzcKKvCT!1^`=N01%(1+E4ep&e^V@oMXNunVTt$nJPI2^xpEVG)(VMsfw7nH
zsHI6J{nnU5TTrIt!-pZ8;wF8Q<gy@tC_~k-gDNy2@<yZ8&>j4RM!@@>k8ur=DeEpw
zWwfo36bcm}zV7XqHJWqRS#DumsrEh;nKf$vnzKFa3&rLZ%23LegBonJVsDHxVsg$K
zjf>L<?f4nGLqCIa@?hPdd!|4YB5cY%yqn$I$0?jUM`>hyo4|5})zb@`-#{&Y_8Xic
zqc&>j&|3ToVJoTQ`bTaqt^u{X^!pP8d(=uFZSPzIa-8rS6qlW`7txe;Kx|@-(SeRf
zg*i2uJ2yN?_wxwg%TWBoP}K*Z@|ILv!yy!@_b5OH0oW@=tyo7yLlC?q@|>ZLqjr)9
zN`J$b1683c{2-~wvl;BfT*XX(U6VNS>%8ZoxpD{kpPN@4ydSY>$;T;RlU0_nU=Vkn
z#u6HDcl*j{v5>83eNpU**goKLIoA$@=JPBBJA2MZXXmxdNk(yEPf4Aw5j<pxIK0g>
zOQM7a4ew~Oy%b!SWsKn}7Hl8<ikwvgugqb2sI4yr;%UY5p?I^9d21?v&QAn(Du>-c
z+}P2Udd3qjMWR}~3=3XA3!<4b+bSr#ejRC|xOe{&!DHw_pkYpWAwrmERgDzrx$ekI
z$&PPTPww!}vT5hhMpkwX%%IQ?CZpGzwBNVq5T*oReD{4a7T6M_q9>yUT#nN)RKozy
zItYkLEkVuuR{nD3+(Mau4Ya=91xZmj9ozytrWzt74;^FipK4TmE&YtEQTW`wP&czp
z)pg3kypq1uda;w$F=t!4lT(?B6bZu4`3b<R`^u1Fv1z}@c6#NGJ(rSblQn|+bk5Yy
z=armOu2u$R<5fwcJiYC-QypDKrLufuyX8t@5AOH@E5M1N20lc8nC9-JwQG7|xrVo<
zwzsY(xWo%p50!Y-zA4lGC5x!A7CE0(g(A-5m?aHYt4x53r)#d}nX!--sTAl=X4Mt>
zyN0!{KF?EE*Yi_<#n5W<INGgvZ~EMuKEFlN=TnDNcc<jtjR=*mfs(wRM>3x!7AIR<
zDNref>{0Qw&*`y$a-1Dbb$Q{C3^1GBPnZK*Y5UsNO&+}_`f9cgD~GSE&?r>%kn6Sj
zYK=uzbx)<?l&?!~HfZvNN=?R1^{CZmRMn^*?kux%-JNypT0gQSjvsW0Ob=$hHwMN`
z7}IjP<!r@vM?9IqSN<>Jjd^S+;FaFe9Ji%KWUfWRb<nDR9Wc8-pj8>+$SGZ%4YqJp
zuk5v)m(lGfbYkK|{d;lu-mzV*^fFFBpNFZ1gR_q~??PtFnENeRrbAKU{thGTe!J}+
z?ZAgtK4433cYUXRd=F<;*9jlUeSuq?^Ip`^R)y=K{Q3L49$H)>xeY75tqiJ0;_E?!
z66+(+-bR~$!9?0*GN}}mlkE0_DC;gDa97*GDb|9^G;TwR;o)_T&>nW-jNH3h!tlBU
zan~q(?aJwUa;=By8}XpXLxjyRt7G{f)n96z`zg6W9ZDT!ZrKMDi-lwSF#a#1*7?$8
z>sWh;of=KfY2{+ql!P^!YD(C!BY43cRvNJ3po`vri4mHYJ&87lTXkFRG}Pkt<|NyU
zu40&7wh7qj?;-|_yQ_pJaxj5;05hvHQ82Fn`&tIOv^he5m40u}W<y#bc7H6}O^tIw
zhM;!z72*oZ7*2&w5+iaNW>}Ew20`QGNTV?!#k{nO<!RlH&Evvl%LBvMbJwEr(U!hD
zu`jQGoj}|WHc*C66R$ZI-D0y?>`Lq}SIx_XLlH)sEfcyFH9Y9!q?t}3^^#zd$ImV<
zU;O>z8Io`$kww`tp-g9ed5L6%cQRq;3Op4Msn6^o{UmEoz~M-4EzQ*aH2Nc1fj>D4
zJUL;n!(eL<rTPyz&|-3)AmB=95YaqWBV{Ll(JhZXfF=XU0qt}d;+Tvn#nv8C`pb|9
zS%1zOl2wlN)tymk8Yfo;`a;tYnot3(7WxJFURsGEh!}c~A36%xO>v&0@~S6-NXh^T
z`@qnp9(;~z+*v&%5Ig`Hn17j6&D{6Kr>P_{K&SJ3-b!MxvljJ9WDi-nYc}CZ0O<RF
z;rV|fXr5Xy0vwkk`}H}}pl8nC5^B4qB%)<;m*h!acNb8tozeAVkJgdqrxl-~TUcA8
zWw?LTZxAugqnJT6sMz-e;vHWJVfrcpw0bz-vN#O@4LSFruE9zNaM=K%0&z8_*x@?X
za~fN7n*1c)GS^ruSqJhHMxjvAf2d1;a2DVjjW;n++eU;sVnhk_Yk#SVfJ>K5S%X8B
z&$}QJ(X6Gj!SO)m*C+`EkkI7_-3}*Y*&bb5jg>sxM^!dSpTlucz1i0))}++3EVE5Y
zmoodKI#lnJj^Jh8UUSu0C%I2CTvhs2F<8aN*}PSC*`ngkUV)OGJLri-`_#;TVW8Hm
zZm<BrId`CdJ9fZ`*O>gvpyhq6`q=WMN;cbA>xh;LGP7z>5~BpEo~}jg&ry!DOkOfR
zi*Ce(of8Ht&U{jdSfSqS@CB%6Y02Cs7|@o?jsurK@8uUR#o2s$-Nh6gVW*7uqn%#T
zKfAw2p>>T6wF@ucBL}R)?pPLoP$~~t^E=WZe^$WwU7TfoxXCt|e8~d;THN|l*lblb
zu5F#{&sNqXc4RBN%%ErFxnMYbWX{CwoYMKSW5B#LK#e6*ZGF^^w)ZF~2lgALor`PV
zepLJVhI;Cwx-V~irp`QSzPtOIh7&>tq{DJGR(o9>=%wy7xoj$du`mdKgC&T{wbFwX
z>oc~hPM4)}oI)f>PonCMiaMRzTA-TBn|#Vhu?9MCKW3t(>Xv4UqWWmvBrH1}tox;6
zf<Ic3g4P<46ess^OgH+BF&{wX2K4k3zxCH5@I!GCCb}>9XIbv6&uDhZZBzC5K-IzJ
zy-n1DIRaKJ@8}b29s;s|@qJxz6G~3=Y!t)PG+D1RX@>zGE+6>w*R87J^5He-Q9y>Y
zp@EB(QRROqUTovtr_p*Hg%^-tD-F{=K0SrC%b{c)y$BHlTDKBAqQ;(Ue#Y?W*EqD|
zezla3Pal`Zc@-sWp_(9c7~!k(2v4JM5%}{&b>xcE(BT2X#4FH$=99Lev#J6_Ik>n(
z$n3bV43o*kULHN8hvgZar^yQZS#vV!H3@b5!atSAdn00Wr$iz1MCiAVWbLOS%R#_{
z=h<kxp$A(7w5k!>i$Uh?siAh8w0^qdjIYoVd7;j<!{BUV3%!aakG)HNdo;1!A$P4K
z4vT7O*s9BS2)C|(1do%M;EBVR!m;COEdjpil)Z@sq}K`$MhTMDh<PIRZ-mDdakS2c
zh88)DFFCAG&hwtVJP=&M>)i=+v82JBnnpX=%os;T=^#fKOQQ-0A&Zd#-B*yhv`XkY
z&Y_K=uby+sQ)}K#<G3Se#i)C;+9PsnOke7VICK;b{2R-EE0B#yi%}N=P>tu%--I`+
z%$p?M7OO~P!sEpJ7;QGXN5QV0Zp!Q3gD3K}LHp)6;%Jl@-Y3f6v$I!4g%+`rsxs0%
zTZn(dL%R!)!q|;$+nk0{8i)WdlrX5OA}uda0Sl>{NY)B{n8V1YmvRT7T}yEGOH%1g
z^tD7R)Gif&sP`ti?v=7#ATvA1qFzBa=34Ne&1GCJ6V&ZOFfRbUpgAc-rnoA*Ggpp{
zveEMW&+{N+nP4ugSXZtx?I)i`o_LC5e-nAz&#SL(I~<%JLf@cBRkImq|6jgz9_Rf1
zU$!WeN?|@k8{KL_xXUID8_4W#Rvx5N>0sJZ3m&I`FwJh9S9~ZB&(}?<_1(*hJMsq)
z$8Om6(J6UKI&S8UR9;-VU6<igk@XHKs9miBx-E&WMfmBsU_d*t$#-Vyt{y2iRpw-A
zOkBV&e!414vl|cvzUa9&pFRmkcBj~3Ek`<0NS)7hphHECQTIto_=jD;3ZRJ2E7B36
zr-Dm=4vofBHiqq!e~p*G@*`;9!21?W(v>9#&fe-Kz}v;FIdK)U)dl#RTCJa|BL{g2
zTNkdw3BsC&b%f~Xvc(hOHxT?CP8!ZIouF;i=`JaL?o&z}d0S`2<!UGy+mS+)@cdMg
ztb1i|RWrq$E3ji=v;wW7wv>>>%lpHFRM^>nX1Q`fyCD8>qH;gqTK>>q>0Z-(ll@zY
zpYab(_Vws(J23pPvUcCNM@OO2TL27f?APiF<y)iAh=ojp<deB}TXYT*4LDx(ziDQD
zbkWB?B4n&#{g!cs9m6LFn$;JgiZJt8`4v0U>qJrTQUXBM{*llEWxnX;S(CXLb$_;h
zDWq!TRyOR>?(35dc>L19X*(#$iVr4$vz@=}U=EItCCQ4MNb9k$EE2mLFzLqQ-JxK*
z8_xAv?Um};0N-Wv=}0ASAtxl{!DSkL%T4ab-js18Vu+mUaCELfwT0Q?`U|@EVOu4;
z*BVgK2HwsN^um{v8wzw^U`YG%lObb&8yJFzBu>QT;_<eRAfDrNdd5X|ji=NKi_QTV
zTXb}N2$Hz`9kkP~lSDprJQ3`3C`uH?I14^c%5ld^j_t}dmLE`w)`wjzsft8GLp?cr
zB@L?`sI?Z?kd~OW`Z+wI+<NBUS7M-E##M>8hgPsVFsKM`L=bI+If|Gj*+>6>>qkCb
zoQ}VG|Ld2JKm5zlXcrA^78ACbCb%cZnGwZJ)}?Dlacu*M8}iJ^(xL_ZG77y}OV%LP
zr&IP?SA0jv63bPB8B)}1i{YRUgg052a>CxOgcNM*#A3nXC{3_Z9BLb(0G#@?L(!G}
z)E5#l2>fu#B=$1Ly6rP~f<e)Lc_=qxK861$r*(DOW9XITCt{wYvA}yLYp*bZss@?j
ztv6!&==9N-<I_KnAN^&_J#S23HO8+R+w&W*dB~UeF2xTQaL<)>%N6R&0w3t(o^td%
z)K+h<s%n{)?cn*6&jR7u|8@W|SmDl?-*j388c=~qMA7g!nO}x?%X0;PQ{uM(_MHI_
zcekc$RYAR{>9fW@uIvZf+HSQ+8buGMpB;4nSg@uV%(O$lyb_^56Of%5Z@<L`oQBpH
zN;@KV_458;91HZzdXqR&4v<`%<E2AT?in(xonp7`+8kT^VRP(SU|}o)&5JQX-?pB`
zv<&(=6>0a6Zd~4%zD&S>1{+BG^B|b<`L(l(WYWvjw%c8HekhlY*s!8C$x<YZ_t=lz
zIE2&C1Iw`Y_i7(xqvFaX)|oqczA5h_=((~8WZ1^Y?e=?N`sF6Hg&*~bHoGqi+m##D
zCf@cAx0c(YYWxCnNSSl<ebq|RtOQA7OOU#YPIO&+$r4+g(Lkzy<;8(9LE3~=gMCmw
z0tCKHItGEe!9bU1cTNjDP~1oDmfzN~u!lmaJaYAE4bu0NlRZP%yFUep@Bnu}h`-@{
z+oycRR^gQnHR8F}1&tL|JH7j@_A>`6h%no9xLwZ|k9qcy&#Wk(J96TH9YxnWnpX+;
zgHNsf^@C{~<Y+mK{iA!ce_>y<f$&qCj*$D<7*_Ir=NWzemWfVC3XKAlElMh<20G&i
z4{YyP)erkxL1`RxvW^tQ?(g4R(wK8LO?0%RO2jfqZEtTjsyv$)$gbIy7z&lY#C&oA
zu0^~Q9@97u>=<y+)U|XokJjK2%n&qAChXfN22|7W11$1fZ+PO*e*$>0Ht=vVVzV^C
zA+cVP5F4bbCY=X779Nuk3>c|m@u^(#jbL8vFA^;F<SF<)k70~i6eZ(%%;kz9tSL+A
zVk*hk$?#c;P^&PexZ4E&+)vmN+SQy)^q$^rf+!Xm@`JGKJ~HOVF5&DRFd<#j+Zu2^
z6tqwqmVOP2@7tANe;O~5V8k@`!&DVJA>|=yEQIi2tFdXd@YrnoMA-+Dr4o=t?U6k{
z7IQ5ACHydZI7E$L$NHzQzsC09Y__G(i&I6))lemEvHRxqy_Nt$K3A;^j$AIY&xYJ6
z;Ak{6K5WFJ(^F$4pAqwOKcsa(c7d+k5pdLc0|FspfBhP7f7<wAC_ENMw@e4DPDU{1
zhA;h4;j=1OUd7o26blbuUA#HJJb!z^TrEsocDzU-J}^doa$*S=7!-h`7)KV%o^cSA
zNx>=?_?P&$AI@bP0~e084U(eaEZY&XFBG@bG|*rhx14jVmhijRt>%u^NZ0D+t+GPz
z$=>T@Hn-zKe_<qy|C|a&ACEyWps`mM|MeD#QLt#i-f5kssO&^1E05SM53b=#vJ&>7
zbe~0rK>Olu#ZyT@&`5P(e;o@xU-6kAATT{d)3z)M@ufHmd(0#KaYy>~AlcLifgt>Y
zpHi6sr~!wP0YC%*Xz5pJ5CHf=STjw)SN0`aq(QJXf2f5Z+5lGpS7E|lgq{Ek3<87E
zg1HvOSXjws{dXX!JYzNxY|m850#Hx|(%O+V+ng1f(Qp3lB6sC&TD40RztN{vUa6Tv
ziJ-e0m$o4LCY@i4!BV37<<yGM+u=}#6*4`at4=eFRZ*(ajaK{ZK5I8H<nfFKEsMMI
zel-X?e{lyW;RkCoyj$<h_WkbMs5egb9;pFzt&ui*1d`#%od&$vT4WWaF?o>D$hs8*
z8#1k<ka~;!oN@$r7_p<R;Bhk?LRr@eq8FV{tq3Zgj{?07eu=^yxaPaJPdhg-(w~L-
zCVDWc=LW*VstNVpdX}R4E_y#RIUe8h&|e6de?aV(r1!5mz(Bxvyb_Skag@XOUPW;6
zyNkEh&l?UW+apX&nabir3XiQw;y<SXlMFvnoWF0A;)3FAyT1(0{AdSgW~4MYDCH^|
z<eYL+<h+?ibF15Z>Trt60e5qqI-~o_c7N@jWl$Zn9V)^DrR{%&5P@Z(ra<cYpgCvf
ze~R6}oW&iVCtVNs#s8r{v9c{smhah|nUf=~k{Ba)t*YgzsgMI>RQCvY!<Qvjb@gKf
zH!Vq)jz@~ph-o<3f+R7Yi$O-~05ESsbO1@9RLA#gai2()V<_#Kx6EGvYd;YDeBsYZ
zD9K{NR=QqeV)zkl9}zY!;S{Gojnk0%f8YZQJ?)WHomd#3$B~575}^QVx|kf<FNhZ$
zps0_GnzF7Yd?~4An7O9OSFeehY*~{*sM;V;%AOi+UiDz6)wCuv<HO7T6MoABX%@wm
z5>ZAZ<(@BCyB|iy9je|KcobHA;V)D0wq;3f>Ly=Ea>lHc{vWA^@xWDt;pwGtf0TtC
zTmXD@DCEAIWG!IZMtvueZv!Ec=U9~AbE6jU<akwlbiWzvmOwV&WefhDAP+d+GR96#
z;60BdfHYdufpmEfAYn1bw`zlOi`+yf*82RN2JK8NP0Mb`Z)fh9{%WDAeyHY^4a8UE
zSse^)Usk!Ijp)fGuxXq@GoV0Nf4#19e8I%sT*RBi<_U^2q5dHTA#*2Vt&hhimO%6K
zZHRj8S>efAk>*F??((cUJE@mIBj#H0Ir#a?%oD{n8__mmn-V!<fxi&*?K}`Fgg#;l
zQO7hBS39XTd7v%CmF=>JWCC4^pZ4BJoBK@Z>W3+**>PO;hMJREnMcide-^KfKFw)v
z?{nG19nNKgA61IHQXqqU8Aj7KY8w@`XI>hEms;Cp8AY%t#AcSrWniuW+Ez|C4agM6
zn6*i=gH=#ip~LgZ^jCzO*(9yHtS~j?5!p{x7KX^BfA!I75oQA9EbQ!)*oJR|h<l7L
zpiL_7Hwr(?N>pLpU-;*+f9*M|{e=Mo-O)Z7`xPU6jymtDO25FE6u@9}iHr=<y;==u
zK90@A$`8Gg(yTHw52@hr{X3f}HxH*cz{fFFUc;*f**hF*j7WKGCU`8eZHpE)hCf*>
zxq76L<+i*Q+mYJMwct?7w@8B=s_aO0Wz!~3X7t#B`$L#G`fx;Ff838CqWG;?Z}9ZF
zJ6%NaIH?$=>t<(jIOLuy7Bv%PQh@GAG?0Jwf!%QQgk7v>!UNw)fDcuk>M=J%y<v<!
zOPNeJ2<_%MTu~Z`5wOU@C1fb%h!8Svwh*%R(O>gPspKgcAy4^+BJ=*PBm$%KBnx=t
zioSO^dQekg*iQ+2e_x+LhJeaDU|uv&p#&DH3$avJZ(PRs(Ax|ChHXwma|5#$*1Uyw
zn=Sa-4~)Yn@WX59U7iiDYKZsT=zcqUB`kgLjAYoWd`n`py>HInK7HO%HyEo9vp7Gr
zA94U!X{Z3f-t8WX5aDZnr}IU17^zpWX-9u_t|#<C+{%Tce`GPmw)Z)yps4p}%viw3
z>ujHrmUZnVa`B*K3C$7ELoB4ETpc&3!rckYR=r7L8+V=iI9<;-&W6vgA-{<{|Lp4d
z`OBB=)$6yEQADXf$f6T=wc@dmy4`xgo@LNGQs__7>4S>x>5=H#7uf1vc+5q+*k#CG
zPZ%nZ`CLdEf8Hb?#nG+q@j~W>%DtvVa->K;sfNI8c8jb+3W!%ok=IvU4a})hebt7h
zk{ETgNHe&k`!!)U(DlO(V-2K!&X^zi2`CW83wj^aJ}1RLVm$TygfiLkYDd`w(CY`N
zgD6F=D8pMM>1MnMcxWfv9lQ9uvyMCtD$X4-S1BHXf7*f{Jh2I)?V6g+bI*rR1N^>;
zqiEqQ)m?EK&Z6krft_<t*d|ELlvNU(OvJ{0!u&)vAYSwMTIM*F5gx>VEcpp({|!&2
z$O}QR>-Q!8yat`><HB?Uuj}N^FI7;qNcBQbId~7|r0-7WI9K$7RNB;lhLT0N8f5nf
zg=dr|e+;2Oz$Wt(sRliqU?<O8%z%0HwqAr-isN<{?6e3}G?9iLIC;#8Lov3}e()gU
z9^WJ)-jkwr(0VV*z7#TDe?-!b@qHhGw&}z6ByO55Qa5g~w<nQ*?sTla_qRyMwup}6
z0m!%%Ufo4L_l&k4N<8z-hP7z5np81u&z-RIe>924QUJypQ5lBXNvqp>o~j3UlD%TW
zet^7t$lQi2A@Wc8L2>8HM4Q04fRx)$sJW(qg{%&~p83l(!a_tng3FE{pMG`1<~+t8
z0yq@E;eLQomjdrm&tmf0xY%|8o2#F(gR$r^T(O5dKQtfo5axR^!jQ5&&k9Pa-*d$8
zf0rYkA+lUI3+LIz%Zs-cd)hcd8#fgVv-LMH4V$+YXV4&>Y<P7;o0X#vt&dJ0n;NWa
zj9V`C#F6$iNk7(ihf#Jj@`Ug{g5^Y0(o5UJYEtX>TeO;T%+ahaI`c-o!WdXnd@RPO
zv7U$(?o~#m%CIE>wydX>{P^7dNsKUne-zg1G4M$`PQyVJOreD1QJJUCv;H0?c_sxI
zoVe^S-95woiz)`hdNsx&|8op=^S~yxYO1?ZdPICd$inQ8luwU208z{ypMHf`cmN*K
ztuweEvrhlSY4|F-?Q>dB!~RN#z1~nbjs3^f>sRPvr<?`mLM=3m3_0jjgX3xfe*@nx
zTxPKtL)8)hDU;LLg5h2x^4F0)%#nM7QFUloA1%lR2O)z&cq_KzN8$eivK7KAo=Q0!
zF&V)(A#6CiT}9w$j6FZ(@fI_J5%<Io=P>~%2Mp1}0pldZc}noC`*H=TcJ`z-`T~lh
zO&p;_rB(sx()J<%J&6)F4+M|(f27cdKKbG^aM>B@Qk^-z^SQ38Xz8e-KNrbz)K#)r
zdj4Lkw`lcGD?&ewX9d8@52x30_(Q7pO2>)@V6O>_(hY}VLi*<2HTt)KzmWwsg84QS
zHg^@iybFpXj5P8`oQ6}Xvt<DfJ^6$wIvp!rmX*qlnA`xEm$>mgpq`QHe`ErodY$9v
z&w@g}C+ej%OrjLbT6X-4h$A-Va?U+~@Y0Yz>g#=J^2Ala9;FGxl!zs%&~Fn3+l3zl
z1Y-yr9R(@o46}3QMd>UMV>M)~*wl!KDtx4nxDqAB>B*4xjSCOBc^f24iS}i-HlH%4
zo8#x9HEDNd-c6Z)w!EA_e=FPR0QU;DLZN074EgycpK4kq%5u_Vq(#TcXQN#EG9m6&
zF0p8E#j0QN(Uq%yaU)aen-0gA`VFd91qrE#mIcT=I0-?1G&Ih^+&#C_CUVc%qDm*@
zaWA7`fKLVDc9jYm(Mc;KbB8DHNR_lh)JAIEot-u(?7UuU6Ok8-f2%RsN@?^a6%7hC
zjKZ;As$-hw)QkBdIkCS>E7~dr8%BwfaV-cB7<UoH!e55dG$aI1-)kLY0moGw;_=Dv
zBb}<m^@FS5UMxSL3jW+UKCh0;yuXWDt{A1GUOs?AZd0KJ$zutf64RGC>m#eed?wc5
zYH;wxt1b*df%^t#e}Eef#|RbaTRpU%OHa9DWrgXpo~8fF=1a2<R3nyDARJMBnE5;c
zbr+{$NJqjY_YbS<XbUo@r=Lg>EWm>GJv16(tX~0p96AO77^cqy_CNpo|3I=j_X#`H
zy0Y+NnXqFqSx(rE&nfl`sKxU!HN>-S9?$uP4&|VeM(lRwf6u{Jz4p=NY?dqG@lqrw
z%wH6j6~L*1Tg4Ob<`KQw*OeqeIP7pa^+WtHd%lXZv*WUL4ZDLt01M^=na`F50-K~w
z1w~#tOF^9iy<QfB{@{Cqp&_ejU}ItEB&OerT&zrm+Rrv957N;zC_ngdEd(QIK3@Z&
zP=qkBeK35@e?dDNs07zqF2L)DVuGx2q2w;=VjEPPh4c1XvmKym4CqbMUd~Ic)wu@>
zc+JC<2N>{0mo;*gpY*f~ND)(n)u_14AKletK-EvH=WDjYhPq&{d?Ax)W0WLBdZQR1
z??>!fhz+5ACo4Z(egVrqf;!B^4*{hMmW4E?HUre?f7&}PLX07EC@n(ZTB^<lVqW<h
zW61ak$%dL;(HdKA`my%?(<bbpxh;44z2>e-%O6y651xhpn-ExerCs)P|33We-IR8f
z5dF-Qb}{>S=&a+9tg)Y|w8~lzcxIAl55WS@F0S5QzI*!i#osSp{&#EMa+?~zh`Gc(
ztc=hpf7{vUPz9hwt=8Gf2kp5XG1PWZNO<ug28g>LnyLS2xI0k21lkIJ&xMK?L&L04
zDHQb<`VNU_%uHJ=mpJ^Wg3go)l@+0b4`FO*Q~S%;(M_>#-N~SepvD~ZHxB}KEw-4~
z6#Li!C@MPXFr9<ydv78BjbX1S2k*^}tK#3Pf3{yjal8e_vfUI6i<1d^q0+5DZwc5B
z%E<|7NPW~k%a<0D7=d`icoF!}vI<dfCA+-%_TAORGinQ>Q_PRUNJ*+OWz5~et@ttz
zER8_uH=dAbr`9=IjFT8r=cphRvfa#<^(F<g?Y2Rt_Eqm=W{TD9+zFaQF%Ko-jqm{W
ze{mee<1j*_%486PqPiv46WSQ0%dsDN;*KSP#~#`z5<Muh)DJu~xUAxGjQ<Far5goh
zrkG~E1}pT<<;B&-<=-!^N_ONi^kgA0JdJnfAWKgys5`~S*w*s|O~QE)Nic%74Xf8h
zEtv42I}3>#m^K+bV6vTo`6o1A!?6-tf5Vjd0)+*q{kUC;Sp5I&z58|>N0KKzfAcBQ
z7#|yO0|ipH?ET1*H8e%H>5(N3DYds(ttFDE1dvvt3SC(s1<Tws@38xX^CaJiOJ-$V
z02DxqlDgGrcPyf+@){Wt8JAz=u_)03lw_7Yq>O_$m#UePnN{Zctlae|R>M>6e^$j@
zlvO;J@*F9N6?G{5IUYifW%4fTj&MLR$f~S&hH50|QP#6svW4Gt4e$%+{K7e{|G9^8
zW4+yE<fAZ^%m#A)^M#6(vLtRdJK}CN*bh;Fe~KB|C}!k1XKyvC@s|dxu8BVt*_@cE
zv}B3sVIWy(b!E{uiUY^XO6$iOe_e7Co0%FG;IHI3P7DOs-wYVBY&{EW8@@ekgJp*`
z@AeiTYrqgvLm%GUZjyk3!UQVIqBL{BiSPrXAp!goV&a#7<Y-N($J2%6fD}gUa)vN4
zzneqncMEAo3<i${PW4C+31-#X2RqGDRm**Qz;G{^i(V+AeLBf*vOdcKe{ffsB0gZ8
zu)@-#f<P+8O0^4<sVTbENOkV{;DVTB@DE}6DIUHgy_K_9wE}H=^0vgk{}2w|r~HJE
zBvF0ab5ke_@eUxjn;wul@cHJr+M}(}0xh2QCe;U+Z<jEcg%0nqtbkw3!!F*<F|$9;
zJzNH*O>lGLCEA0(b&RI%fAH}ufZBJsv$p}BdV{n12|x9H<EO4I#c>Bmid6<k{)N0?
zgom8YGrHF`#8D-kGz23r+QsG<ksdn51G4urNDYP**@UYq@zFXUaoMwV3b3a6YZc#-
z{A^OO;BW?6yfWIfP=T!Z?k>t3-u(0x>#E!NpJZyfac#c_HO;p!f4YZts6T+}d03*w
z8KUj3TWdM|sY9y70(6H90jRX7aMH<Q%kwBou5Jq7&1DB0C>3^Jw<YWTTl>$oii0De
zZS)2E@u|Ah>S{}+ue?2Ac-HC)^t*)0)!QfMIwVJpTUOsyq23Imd8n+{tOr}>#k+8&
zM0o`kF@tC$?heD%e_HNng9%Xi5svbh4FtzApg{nf!BG-!g4%`~U$QoszH-g=hDoRz
z!YuQU3PYj6{*Z)=ra;R@yEA?7+nwursl{I|t<Wmn6FULSh)I%Wy-0&;G)jgD4MCnG
zYlz8LM!?F@{n~1rL}&%=l$|Iyq>S<gt)-FUH{^T111i~$e>Us@n@~ncoNh%Ww!gLb
z5Oq|uMoQSWg#?C#W!LNJ#IhE)(-4I@(#m<wT~iB)x#GMx)rcxxe%y*taWVdRRHH43
zA5|ox_GL`dSU<c@E3qh^t@8a-{TU8!+wx@<{#cr8gL;ndpf)3K#yQNoT8i=GDeeAl
zj(Bm$KOOXSe+Ru@DPpLtJm$#8r_9o1nqWA0`P^$1b=d*}!#u;nvq#UK<%Wg#&Jecp
zJ=HUVW&Wm5!to#d%#b58VH;V+J6A6<y8uuZ&GBYCQ8LXgl%$9>c52^N#rKU*31K%B
z7vsiPiMRAiQw*F({PuRCO&`dqS|yh^IX>KwT}%Xzf1q%Ml?~;P8O;Z<*<rL3q>{3>
zw-4!jo?7ssdb#E$^imD^WM<Q>+?g~2eNcQR5uH+I+|pei%`+9f^WzCg-n~y}^wSyr
zFwW?g2z%$B)VZ-Wpx}WGm8TG4bU;z8Gyd#-HkAv}5`QWTxaHxNFus9JY>*H+uTpO4
zfP=;{f9RjcUQFju-d$$H2}ig4Zn(VTFHN;u<{sh&$LZkAZLVgLib0f&lX->-Oc3&}
zI66PQRB6xXP(ijQOd6ui^SW5HfSyVFuKCkXmTA5__T>2TCT2-DF5ep2-G-BuJshR>
zZ)m3`+*=_%jSxl72Wwb7LAh9*;16&lZga~?fB5z;pxw<}6*N2?(2aM#E`)w*Z>z1)
z8=1Hpx4IqowIl~=$Z9%EG7O<DUgmr9iV(F?3BrA_bXm)@@0tq#tXA6j&axul*H+hi
zUqdRH{rYcBp+9^lTMIH)YoLP9ZiN_Y+I<(~a|(eXb<8OjX1EmWA1N7<I54w^Vw*yw
ze=#VNf1sk+B1|xCPZFh8Bs*E3@kdCylXp#h&*s}v-?JC*f%@tK$JSHMvw2Z+)&@p3
zq33O^%kPJ<pHUFNO=ug(M%j}lOO>4VD6w`bX9pB1jfPWvMA*<%m5yzgG~_z;u2P+;
z-j$9`Uj5;&>H7$iIg3m9T%}VT%jk3-f8XlevjJ^q+%@Fv_9)TRY)k6iG-#IZk;;qO
z!0{V71RN8H)T^ijm0@qAZs3P?3de@6Z>e@<$y5(z6fHPe*y$4G!-cgwy25U|gIuSy
zU`)kVdX{mP`#kP(3bq&e69~JU8Rp+m!mAH^!;KvH>FGEs=f>dFg;0<1EM=wpf1b^y
zg@_QSoKnvEg~;YezaN)}t$nqri^J4>x4tH$tF&dU{>`Gj(2@?|16~Zc8-S}RfuR?a
zB6b_K9@d(|x2vd94BY=`sitzql~eNAD9GoNW)Tl3X%Z)M6D@99DdbM~d^0SyX3_kc
z?EWU18Xruxu6in1nI3xc@-d$(e^-4_m8%-un3@$Lez7@sU0G7HRwaaJ1Qln`*}pxT
zMVt)W|IGjgaL2_C^~KDnw1KKv&&L~Qh%6DSbL@SS3YHxGin&&^NDkSWtmARy6<;kS
zlHLWY&FNrG`Q7z|u!7@$kQ8yF+@W_(89qrY=i05i=Nkpgz%5FcH)9>Qe-9wI5;U;!
zZsGey7$~oHGDl=NXAn5ZXyfkWC>JqkZ@4!NPV;7)v`y0MZEV)k({pDVx8V^h0cyXy
zGj{vv+N%+@8*kjH#lS8iPkU$WPHrJ3c-lKSP@C<@%}>;}J5xjjUvaeF!|}O|vgtR_
zZ*R3^`lC%Nr8Dl{5&?C0f3m2IQg!29*jBl``LVg>Z7G+i|Iie?8<bLQYJS<M0OM^i
zIV!%mVNSnM#$W><K_yg&Cx6=&QE#(;sa;V*JZigOZHV7XBGow%CNI8T#HY=38qjPa
zOft#<e{&{gsh(<tK*}rYpjUz+ZH<S(-~&4?E0R|#+D^sYi&fh1e-1z4h7}kapT|ur
zvfaj+%&W0&e=gri@x&S)_^EW_-IPxJFgZj`8L<zFOWX*?{{4fK-B7hEF@<-6La)Ge
zjmVNq(dZrMI75uDgqMFmu=4K=Qr^dmKimWh9vwZkfZ4!TELP|;%<MutO>na<vw9bB
z;qMD*eM`PM2un<3f8d~ox8jnID$RXRdel5VfeHX}D-8;6QT?~+Jf=YCx^^~1g<I#`
z_@Gi!mp)(KH8^>@E5BQp<gzBw1~)g~2~Hl`2G<T(7cXMa0{C-*(iq<u=?soL;4ZXY
z-6B?Aaq!R&4dUJ6=G`jh0Un6;%U-t{{z_mob<@68h=hA}f0JJpobh2Czbbv-BsmVF
zIlLC-@b&7fxcTP2zK3&^XW7w!;a_)qwzjFefMOaE7?LQLeKIyzwh#d0s9Uwco03Jt
z%7LFV#Dz(FQyEJLUB=S4r&d<>2x%DtPi7Dn#F&&m7R2GRle_V!psxH}PgSJjO|wB*
z)9z>0&+iWCf2Edwd<D7rfr;Q&%IK_m3diL>W3$p<IV*+DAFFg}OGz36P<ejpq#076
zsu?yvY(~dJ)qMCAGT;1t*fx{N>5SvK^3lc;2$>Epm^+&f8DdeRW<&U=h2XKL?KsZT
z#l|=yQ?;!MxMCig%_rBT;V$7Hu!|%C<K4;$*#C`me+04GO**>KoVJ_WYEJUf5_VU#
z;&~LcUNxEVl5>5-#!9FDX04UZ@Ai!~e9c!J{G}!p0cM8((k#?)c*~TAZ7(z%4B1JD
zhH{`H6LdV@Oo4ls%(~&k{XOC%k7XKoKJaf`7x+hUnD7f9^L3kc3%AdAj<D1fE#ST%
zg3@|Mf1n3odqh};#F(BJTdszXE=u~D7%3HU?Ghze;}hRIF(h8xSk<I9*IUJ9CXLF@
zXcn8M9@EEtQ~5gAHE%&ND2}n10&t7__snHs**)a><?rzBq3slFt7cNiDs+il7mEz6
z*m&Y*l7rph2P`OV<7CK2=}@y!eSofRnsG&=f8B7)&nT($W;@?El~z8w+s1p<eQWpR
z-BG$qdu@M(x~#HvFa{z|5aDg^@u!7E#V0QwKkkP*1>i);bt77ba;0DdPm}q0A|^?!
zOm^dX)!R|_Db<19IP14W+G(YkkCC}CdO@nkV?}ACI4fu8SjYQ_Cc=4&#jSGGdP>ZB
ze?QwhOyZ&5JkYed!PSOtb&Ky9Cv2qBR9TZVSxI)gn`p;1m|?VJ=e%U+`I4=M4CA+M
zG8jj~%@4|UhEX?IG78Zu;!TIOn-9h=>Yrj7w04Dbh#{BxHWz{S`Sb^Lp7rl)TlJ&(
z>4&3p<mJknUoFR})Ukhy97o9oR8H}|f4JTyyt&PC10&>JXhB{@Dbk;T0&X+EyQ;}s
zO<hFE7{DAzQ-@%dk&bodG#%Q6yQTl<$!tsV&kA3@XX>w7>hIm(%1}R55&}9_2{}F?
zE3Fr;EXgF~LetKl<BqQ}IkniMbWRNO9O4X`eaIj1MR0=;ArNY#F7WcX;cyy#e}f}g
z_vQ+dQIWZ9B$5%c$Y*`E49}T0;9oG>W-Rc%v9#yO>^8aD4`k=dtqvgl0DtjvAtnHj
zlX7uu4A8O+O@reT%NXB0QKBhhV}sUT0GKKP;D*d>>BhXICVHmS#>Xw`Z_lZjYV*2a
zcuvwOsSH<yZ7Et4J)ZnS=n6m)e?Cdw=GmgwdrWR(I04ipBsz-D^op}lEGfQjYb{Y(
z$!y^tzgsINv#BK)b*Y<KKJ@SEU7J1b^iEt8=c7jF?oz9NSLb%RtFEFs5tLNd<m%S0
zp?M!4=6%yyjfzspJ0H0P@q@Wt-rQ6~C*mK;PUHm!->Rvo=43Uo6>WL8e{zwv?JPDr
zozBfs46ObL&TYM&=z~ARfVFoF@%3l(3m1jDsWOQH`aQFxh4-yWB8>12LbEaN;RfH^
zaMa2&pW%aLr|*uHzfom)KpM+c!1`lhGd>bj^v08HAF&?^%@H?(vpEXH5{Mr$V1ja=
z?0yZpVqn*PfS_*!TFOBnf6mk}RT<?BQ>qXp%TV?50g@%>er%y0*3z^8Ndpw}%5vWP
zO!eRTf1c}g`EZpX+!)-xj!Yf_i;L>-2;bD97Wf}yJTT@jc~Dx&fuACg-+=DM3a|$)
zw3**0UN}MprGEh?FU!<)mf6g?_dqR=v;hgwh+<YLQ;kTbA5w33f0#9ti~1!@{JrRB
zsgfp%w`J<r?=nAT^})RbNa?~6l%ovq(?AwfzWN5|y{5C1_)<pNRZwqw(BBLHFmj}_
zg}9W_rP>E;!%$yD3tk+o8t!!-2+Gwlm`-VdM+Zb$13?tDN>;rGUUU3r7A2`7bIcF(
z;cK<A=}=J<&V+bTe`)2zFdk|;-ObK(A^mup&&)=C$ao$}FlZIhCFWUz_QYhKk_x{-
zJEKysF$yz@GqgAUeJ-hzl4vcIOh1^^3h$cOJQw5q_as*S_4dW{quWTdfd9SOh7jIt
zNeOSZB84}bF7lg=R{2iv5Ou8OHciNQ=eE7%{1QPCM5toGe@%h-U<$&({yC6TNDLNc
z+$*f!!R0kL-qffpsFr4X?h365i24R>gIO}0M~L#T-e7qo%2Lk~|4<7}kOoO1Cmt#s
zY{Bqpx;J3*H)QX(&erRbvNz%Cn{jAF+kPLeqkdnU9{+ms<k7ykny6T`_FDZG%)TWK
zpF9!+8rcBwe<O^->J`0IAx^<ej+NLGGabh&T-G)h)23FwG~(&$$)8W296lB%mNPR+
zGSRmGI#Yiy0F@8rESsl@1F@`i44!sPF-8%=IEdEcM22DtWC@j+=2JKlNh;<Bp&c}N
zNof+x+6VA+Ry})ezz|C^(qJl(F{?_UHiSkDDpsn;e^~ben(pm^4J}w=TfEY7=*!kU
z%+r9i|7aa`OK(lZ)4oA~>q>2%=!)>5@z~StL}6abjdbmLHcsgr42RF$+2+{ViYt7X
zA12dTVj!sKwOW7+p2k|k!EG@CXsCy|J2{M%X#d*-fOf@0CgSAEA?J4l<Q5?A4A`yO
zK2DDff8(xn1xd}CaA?S(ndms{>6pZkBXL0O*OAT^T_HuRuFg>@J9p0sTE-@>Jn6;i
zO3ZW=b*nuRD$UvPv%}NF=f`3`8zxwNpiN+2y%6M7$2U6jGQv4<ub*QS5A}QN;_21F
z&cA#B|C`C-YdKb6`pEi2)Hu*q(IYAjels`ke`9xd_uFs25p}=A|MtHAM*Pdy_rKlU
z+xzz0-EYLd?CyPY@BX*qUv}?e0p=!?>A&pm-ohkzcXx&R??>{#eqS6Vvqg%~Paw&j
zJ$lw-kRU(}%Tj$Yhs2?seqWqDd-OkhkM$4~%H9dqd>Uy;Y(JdI;Y9WB1-m;`bV<Cu
zfBrD&`_un6IR6%vv>(f<3VS)^Ar<!9mKm%*|6hOe-M8iQ|Lu3Xd!Nq#M|uAHUwwrk
zO>hHbzd?(nYn(vo+ei<g(vDoPJZDrmLrS{_6(J6jt3Z6!x4Z=HAL7yRkB2WFKR-V`
zK01E#{QRerv*%Aw|9bxD@ULg$f%tm&e_&@ck4cz^a$$bJs^9H6xjHdP7k}!orbz9@
z$<;4LJb>H|70hI6?8}{l9nv|m{2gc+@JgHB?_o>gEAc<RJ^yBR_k0(?bF<{+?CBZm
z!0pb#&NVE;j`&KPDw9NjYANtQiQy#CSo@MMD1#$+!p`7;4Lk%lJaO!%gSOfle_abu
z(N&VZHF);oIoJvM<#RgdSRi7q1{>@M9M2$5uJBT&<KGasw2MY!cs0+vGYgZcDHK#6
zzUE3yGd+9_1+-->W~sW=>IzzemjNU-!g>sa+Dh=~=<!Ma@YxAo?g^F=tOH;#7)FS6
zr!!Pn?F8W)sv`(7@|QB2E5t;Me-j#u2va=*OuOt#DK`-8j+(?}aZ_!{C~6IIh*N+o
z7>M>fCM!orq!KIFXA`(=#R42%3l~$uuWKHeHiY6MhZz*BB3)a>!vvv!KqYO(iCcnh
zOUzWt3l1@n`gc{{=`RiJvq*D@SSquHDU2EcCRH>N5;iA-rg+&b5z)@Uf6y-sMn)tf
zG_1gi!Ag!G`9GbdnpI{uA$SVyxuZB}*)?fd!@R|qG&+K|VNKm(bcZY@;(h{@U7B4x
zALErhbb2KC=is%DL-F9j1A%+g@$PT-%*~^S4&n9kZz-w0@Hri9JfIJFodW#pi!Ta)
zelK>#!@@87tJupyd3<lJf4#WKXe^hx_Qy_R!uQ1ky!wKbfx6~jVK(*#osSeB23e}7
z?M^=0!ms<@N>M*)l4LOXL%@v*w88({wWAy4Ilj|zbIP0c9tQ-|&~C$D9r56MJ97BD
zGGh3V#}q{9E`%k{yYR;ed-)kn{EII{`!gExAAiu$?dQ<LZl?ihf7l(_@eHSJYW|_!
zCvhzxNUqZ@yhI)I=#4jS`p{d9eO}f=GuOc9|55cn<OjW2rfG7e<8jYL8E>TmuGIhT
z!3D6a|9y9V_ueP{@8i_}`q)ej?VzyZ0(y^*|8jD4+{=ZU6Ch5CLQ4sj5e8Uhp<=+$
zn<Ct;o`TRcU;)i^e>}`cd6BVr`s<V9)4bIrR>4lcZ^u+stVElzaeKKPt9t9n%%BTR
z46yQY?eh+Luu*#gD{wI=Ul#DFp(Qs!r!;}smhl3WB?1@($axuq`5W7HZ)RW}UStyx
z)6mw18s-Jh=xc4LxFwdbxKO!L3CPN&^3h-B=<fq)4opCxe~wHfRKgTyKEwosWV8?Z
z+9ZiW<E)K6=-1nqVG=sM1a}Y3nZr~erN}4{XIR%0H$Z2!yC&aU!g9b$@TbTB`QrHO
zxyTY|h=|E*CDPaT81P%h1c>by>AQj_Ztl=dn{9`z;_}ra*Op!3P!;BMqm7s*SPq7i
zCxKSMu9yMvf3wqua2TN)>X0#<kAM8}7%|RizB}kRNTxI@C5IDXbf_$a2jV27nMX>F
z_F?Hy`cJ#4{5lvPz`~9IQyMp3PeC8UYT7XZpDV9)NRdRH@*3>WSLjqOsBAyx`XcmN
zueFM6nnSC4=Lmi?tpmLLJ)%_=Q36nzNVlXRv%*Fmf1g-sRKIZ%+?Bvm_VU}`izknc
zj~*YM9zQxiJ9_%;c$@oQ`DRzW0XDzpA!8}h6HV~R@yYX_j!(-IbO(8#QJHdBdOSG!
zEg+~<y19!Nv1K8oZ+m+7Iu&*0LUu^4;p^+K6NP&;7|J-*U^9nn%K#h3tAxzpyit(U
z04D}7e*iDjfeM8C3>w2iy9O^bV|QRc_GZXvluRRSuVdI00@d3VtOWrtRXhMmv9oYK
z!5=B3Xn{-syb{<Ka0{ZR4qjw69x-AjbU(x1c;s}9aPRCdGBSzfgxo9Lh1`DNk0<5{
zxA`<Z{`*`;Z8z>N&Beb2(TM;B7g8!m5CZS(f4Tj>c#;q&97Rcz3QwBll7Pr6ml}4N
zNZ$oM7bmgm_^oR4zUWx!?7*>FAUXuYf1{1KP{2J>MFj|e36`{PaF0|jX0G#9bHW5t
z*R)~So_WS{%QoREFxxj_(|Du*`@jC5-y#waIEZbvgkMh{9iLhuVRyMQ1q_|4xj}eL
zf4~i=Bfc-#hiEV1gb-7DcKH0KbM`VlJq0$@fBCn+^<VW5>=8PfMKA#jBj`azYPvO%
z2?#2^pxL1-!X)b%H3l)-bKDn#FYqS_|M*H|NrZ*0<FT;JQ-R|V$`Fe|fG09clNrQt
zfCwK1!2qH%45RF*p#pOSG{x=WsQ}p^e|3x!99lpb=BSNt`614rU^CGf8b{1bMJROI
zl6u5_xk~0yD3lq>8S6z@@Z1}r*Az5kvq7xI33|(2-NQ&vFNC~+irr9p1576)ox;VM
zX3{C2OJ2A(+L4NezZvqJ2V`Oj4D3+5w38io|Am+F{tN%`FNt4#L14|F!Cg3Le{~AC
zaJy&^#LHLo03={L?;p%HI1c}qz-hvVc)t#Uf^CD{;Mi_3OJ?oP!A?2!SjYBw=Hy-c
zZf+(trJ569-&!pJa=x!)WI~o%I<{YWnV&;*Y}7)Xn2$Gj*i{_L7?(t6T}X7ent&FK
zG+;L}AWbZ{Up;+t3<Q$IXf6zOe@fa2>b5yS7d3IChI9C%?`|h-S<?o+(>gBN`XG|U
zlsJ?E1`mpLLYk;Id~3zT33ppeyL5`Mc$GCyK2njsfU~S9fY!gnhzspc=1NAdRobI|
zGC0K{gp@1MhSHvB$cv1+!uvv&@aY99MyD$gua%l%E9kT5g#x_5ELHHyf0ax_h;{i2
zjT~J;O`%P6s6aCjks9kvPieF*UR~1yQJy4ZUF6|GE3<hzON=s|0IrXth!_^?%~uIY
zEW=|d&NQDIjwXp!&wp(9PGH0ZoN*+$yz<W^xxx*>$}2<QKR6sP6DM;6)pS7BhM65c
zIXVXGo&_MIK(_qah|{7=e-QE;Xh(AC0l0SBHBhk0Xd}&7^@#0Ut(M1RYxxp!It=+Y
zg>!;Me1KX|XR%a|#m?yXbZuA=?+UsEt|odoK?P-`u23G(VJYY}9gmM1nQ1dx2<=<~
zht~3Kk8wLrnAfue)=At!Ig8(FD#PRy^;**~e1BqoMQy{XM06;Ge<xdgo{UeQF=KYj
z+sfO5>V$6<?Sxe`VOde3UR>vup7LQGR27>-kN+krqp0bBnU>*wi#tsMrYp3QF*v1S
z*Dv*}P7PBgQbA%ZvM8hAYG#O2_o(n1a0Qc0m3tprVpWn}4{}<_o5Hs-O-&ooqBlLg
zx&`E7c}Ia_fRO-ke|icxyIQDMD9nXM)m-Z?3<_0mcWsK%l2efI`1N6`Hc`DlqqhI}
zgKroc5)n3$ugxES<O{W~sb%z#H^AiJemJ#;cN!|}U7HSod$RPHogybMHr4S-=n;tt
zAR9FrDXLRJrUJ)8r*dKKGFT$2E5;gZO4h7GdL)JbTl<OQf1qvWaq6RgilhWyNszHR
z(+u_H=>{B8XT+tJLW;Nl9_jeCc!aOvUH6n;xV8-JbRGfhEyNXLkp=i|4>C(QIN4DU
z5-f(7dKJ1rKbgk>Q3ICDa3Ff$<6{C3g|;Bxt9ZS~qGsSE@~-Y=n2NzDLteG~8V`-!
zTRNbwKN7ose*^IL4x_oPM`nF>Je~nV7LiNO_0)mEPm(x6i>c{ph$u#Bj`uv@gvbqD
z>LkLGViMdEr?1$ew01Kt)G&csn2uO*R$o_VmD@ME>z0^k=S#z5aih~-H(fE03Fsum
z9=~baW4@H!9X)g1*~m?8+>$+g^7yZC#*1bG;#x_Xe=B}W`#=~x1-LBz@bvjlLcRgN
zb{s0G3PWl^JJ(5MjJNF+O1NF=Fq;U{2ms3<<|{a!6YLt{nfVr$z&_e)d$H%c^(ldy
zYI_7B$DpcZ;_%5|?OFBLSw>f2<&sW!0U5C1cAP$g^#1el(evX+BAI98DnQSC?j(kp
z4kI~*f14c#H!Ry<_>y!PR|M~Bl8C7`;9@knffzzUA`Vgb`&_FmvO@z+Db-=9oV))S
z-WNT^--d|}d`I4Z*4Vq{UMxuCCkrnP7A}{}cWOB7wR5qry?vnGSh#?=dq;lh2*eRu
z?TrW%oGQg;z#Z5s#QQi#Xe~EHOR_(Mwb(`1e^{~`V&zCQ47u8?BRPa_={f;TAsAs^
zvCyj5y;Mc&Qld3KUrqGfM40BGW2bQ^F&+f8wy%s4IJW2c*f|TxZmHwhJS%E~Or{T(
z8lmZ<fZlt=$J|rf=rNr+FI>Q5L3JSqZ=HtEX&5;Z+P7nR_;8v1mHI?0Y>o4u&;Qyf
zfAN@+{5!t49J}9i(A?{FMT4OSCHvfSuWBW8muLZ3HLexlho@MsBFj9bVxG(GeW1UP
z1g7Idw!10=s!Xw9<jAL6lL2Y7mRnT`h88hl<6J~rMv=wM@8F!e&KAj2f=g9Jt;uCg
zCFC6Ca{KeQ%iSt%-p1?BK~c#<4Y=syf5PSHI!~A9DI9ny1WUq9p1y{gO}$~-k{AU@
zJj~6tU7mQ&qfRBj1bbMffZHxSzPqHSWpDVj-?me-ff`R=*M)^_K_&wftn6SWk+XXL
z_}pA~$dn#h-Js5d;OOK%lEh|A;`&p#_CJ06H&q<$)4{xz)Q|P?Ki_`6yLZ1FfB*CK
z*YN(Q_@9q3{)fcGlO#R{QxbX0IsNUyT0oJ5(&sN?{r9<|Moiuci3h5lSJx9U#Ho%?
z=$$?Kp-@wgewt$k{2Ha-x<P>B4~imrqaT3+$3+PgrmwY@PvS+Y>pq>Qdc{XSY88bL
zQ;U(CcRl4ZJo*0#S<6RqM(KE3f0b8$Eha^M#<CobQ#F<r24H6^n2XiP(3n!-K_*~2
zUrh!o7oca)%YN;uSHBvk$$WNxvDozeb0CzaA5G<(#;*cof3sH&<od3EwX{^r5_P@T
z)SH>aeB#1~OsMZ1&V;XH=XqxO7Lf1q&5gc?)Q(kWa!oR{5B3O6-Js5Pe=P?nwc&Gu
za*{RJ+0K`g;jG`d>aN(G&kIRpm;yUS49kfAh#D3pTsoN*6UqTmDr{~QycA7p0jI+>
z+06z=!zh^!C+~>UMd}Thp3X;brcGlupr#TMY&Q68GnQ~&5IgRz>w{u6AIX_QZu|{}
z3*largltpvvezX@1ZOs5e{@v{i%-wFu;x<A<^T8x8XCq*oS{9|%~pn;9RK(Wv~pqm
z6?v40{8ELw+gTOp0w6UJZwU{@y2DR^3eDavz(=fk6~R0fx5F(&h(L5p`V^78P)i<e
zp#hNmdkZ-=_1(ou0i^k>mbmu6pQRe>dc9VQ{Z)#8{sp7ztW;Kgf9#Nmbk2#MnfIlr
z3}qSuK1&JLY$DD1RK^Hq2LDdt4NzDhrdN;S;=--gKQ`4@e6W|>({Kt^RlHdsv~|8v
zH`IjID?IhsnoXgZR&V;}u5m~BlPsH={eA&nBT2{oFqNaMe{c8RZg1~ipB}W<z+pC0
zKOzV4b{jm!stk3-f8Ej11E;b6d3p3cMNqSZlEQ72H@?wiNwF!Yo^l5MuyZh`B1+&K
zvOCl{Vu-IkW{_EY7reqP>MFj6qWi|2yhieZCJqfyS#I2hcX{M$#J^()cKh%TIsvFz
zIMG0FMMaqVX3CVWIuw<L&k+^Qp37M{n}H9GkDy^YXwS<wf9mfBd%-SG%^mU0PImVu
z`ieJ}b1oQjx0=Or>9OjN*IjHI85c4Yo96bSrA*r1>q-jn7F>0fCRs8}qI~sp2G7K?
zg0G-~-Auq_dMmq8tJIgfU$rs0{=JQ4IiID<sO-IIRXW^6ky*hk*P*s9Mao_}(;K05
zyAPx2>1bcPe|&3o=z75k(yH|eHu}}-_L`x8JN<Ga)51;FO#go{p>4jsUj4X<scjR)
z@&?_mv|u%~WG(4pGx=_-$Gj5(zsBC?vknxg`!xn2@0}dRmyg#<6F|4H$fY4xhqXc*
zDf4z*H|(0qGFL<|>L`|_<2xj4YZkmlRmqc;a31cMf0?#LQuO1Z-g>83TtkEhz7){M
ze#C_L-WOk3+z#(Y42R-@z#E?x!9wykJGB5D>PnoctX-EuWS`N#1^_`>Xbz$b+^i8x
zQ)cRTdZEG)BB@{^Pm)kk(pDFv@48|nbu>?v@dLSwBc>cLf2>}%)k_G+eA7izdIbp;
zl=h{-f3vAfyHn1wS}`nWqALcUzlDKa_dkD&O<xbZG1g~a!QxcHuxQxc7SZ4S?$oTm
z-;6)Y*J{xf!-<YUoFwmnon>`}I3WT)z}U$L{=8nRMZj6~hf&mS{U0Fc|Fhfb6n^dF
zuY0Y|_28h8!`6PS7Br8~Q#EQqpnU#IxQOLce-BU9sMSFP7zc?1#oa#hk!Ak)Lwtrm
z2b3oaahUDazqUG+O|$Dy32t?M!4Op<3T*J<qT(b*M1*rXN9T2jo<%HZw`O(xmp|SY
zg;^Ewavt)J`+`%+@y||)@77Y%3fja*y58W*G<ofxJ(?_QBMas?U6S}8B-^QBHu(oH
ze{tNe3fv`5;wSTnYjHq57SpC77pKQ(PWaQ|KsR{>pV>UohXKs!U<n7}m+SZ?KXM7B
z(2N6AB6^4D?N+DEAlv}_tZD>G@*cpaHJ#e5Q$IG4qN^W>m;C*!0?ZvgZ8Au2jVIDP
zjnxxcX=sv{xC@GFa-~Y7WCyT(YidU1f92Ke0o8EJ!9*GyrFpsgsyHfb&d~7&wjN(~
zEbTw{vV0C!n7y<o_f@Cd(J6RLYg>m6Y|^xKE_Y#prxz-PUK;1K)lu(O^Fl_<bWXQP
zI<CNMkPk0;Mj<ej^&iSerhkU$hnp_FwIOyz%~Ey6@~wfu9V)a?JA@B-{Xm2<f6_Sm
zHc&6b5m=6Hp|+V}n{J*eKuVLHrKcd^o1hucC*`#BWhyA1GZqWLvt38+l_F%FfL<Yx
zHBJ2-ojl}bJBNebvihJWWNA`WS$SPv&lfRZ=fpTa<E^7zKkw<bEBKk$hPP_lFT|Y2
zY!wr1ZtF#`ngd;&aFnOE3F9`8fBt(y3UgWS=0sg-lvNn}e8=g3{?_}_YJ=XY8F$92
z6h<$v+9cLEJY#Uaaf8p_+7Vs%y*CD(3hcsE0n>mDeA)7yxLi=R<OXiNs%p!$(pCj}
zNe#X#>b?aPDmVKrpB*bNOQ!VsTk7R{P_w_~I{=tXc=O<&coE=b4$z|ke^K@?Uv=s)
zKdS}_Uk7%8wFAZW`=7scW4P|qdxK6@ZoMTJuBT6~rvm>@iC;eq3IR(nHvng>A0B?u
zFMKd)KziH}Me;lhia|HDnkze`5BtUMw&=JNx6{1m(ueDgMIkH_!?rkt(f{{3$Gx_u
z@(un+lci)nEgqT%^YcSOe;)?+L^YV6|6%ozT)XvcDo7h`^fJwIyRF}HXiG?8o3Sk+
zj!g#F_*52@<>rTTb3(0<;D+nGnj~wK+q<OC;@}DgG9O`C^<6)}LPKkoo=-cR{dc|8
z>nP?<7TL_Fc0}$D@!)&0_2q8;Ow4>bs5h0m=l~_Bzu;^)(%n!tf1@&1GUDEz5&<d@
zcY{hWDh@ilMT1>9r=q&*9NInyH^&k~-7@{OPFI04+N;cYJdZ|3I-b4^LpS}Z3gkzn
zp+3BNSNzv`cl@6UyHp5xTf1A8f#AORzXsqddnY^S_i|3LAe-)GVY2<t-&Pjt8jG2%
z-rdS<o9uIS;b6zBe+zf8{5E##55DcKkv-1l2aH^(9%!F73MZfbKzi`koSUmBgDOQ@
zYWzjc+AGOw3NQFikU74rE@+WlJKl=EdonN0QH8`o-Q|N<IT)*~xPOH!YO$pT_uvM!
zIVd)bc7(zhJ2ig#btiB2>2qcUj=-!h6HbTD7gY5Apu421e_;JtV&PQvU6<Ch9>B18
z-n@G_g^d1(TDXlY^y<ZslBvyw*@}lH64)=?KO5cG3tf59tFO9M8%KGhW$EvIK3MJX
z!89vB%(-6h7f5ck59qd<E~prk4rX#c5$ja+JDt+1bfc%-5B-5hom*SQwPtJ1An8}s
zQ2+C{UQhnvf3x<T)MWTfJaB!FG{4{WabX{P??HC~gF`~2Z+y0&n}uA{pSc(D?{^_r
zsrfY$)w+Avi$`x-O$1|AoRkizK~B4Tu|6vbl$#n*{nprkTABWm=~fukDwI{4H>MH-
zF2*Tgeuj>gf<m?;(n0Rm`{E1xmdi(6`bM#x?<*gcf9aa;Dh!ol9^(KT@k~fZK-Wft
z3H<TLnhBIPxw=k&{82m7o4XSDI8cvuCiG=HzQU0Hj3OU5Qrehf;g@UgVf-5LMEZl&
zpMqLfj>KH6?z`Sm&8NTK)dh`OUvot(&!GSLTW{*?Z)R=^O;}Std(hSM*_TfYJt3LB
z<aSokf5PoVtRimz#$DsCR;uC4l*@H1<Vn8580xgk%EXWi+;{a?y_+kY6`G(iFOyJ9
zRL~`oszeaQ$*k8suS@aO<plytDJ@Xlg}^MoQ>^@&5WYSzW&ho*bW<%K9n!9CtnvrG
z=UOWi;iAG%sFbn61w~k~i6&ItU?nlux?8tqfAFNJNR;NVhVWK-KwU#cqyI9WYWbE?
zFz*)y8<a5l3(GW94YU;?LsKmoR5}wspFMpdIN^f<E!7)1H1+jLoZq<;!D};qe0f$B
zly?3eioSo;_=I_uiW(_;W7~*!1_yhhkzo=gzB9wvYWBFsB(`3m_lDm@Y68N1X_Cby
ze=)%1yf#I}a8kX|Zf?sysI;+7G{ZrYXv#v6V|V#d(+h)|i?-jv7G}PKLIWEqn}skY
zM~pr`H5NEbUfXzhfjLBu*}wzLO(9e`Kibc#>R8OBR9k~P{DA_t+FV@2)_J5q=W(VZ
z_|vPY;=R}r-&ddDHx9ho<5i9+R(KTQf1nC1&qD>VSUB?uU(Km(vy8!zGb+ZCEC7nP
zU7SAvqgqg5z$&DFTIN!VS?KLS)j_b7`^D?M1-ioTO2b*s>*8D~yfq$|i?8iDoPI~V
zEzWg3Z@vdL{6E0pAoNnh23L<m<+WQ|HhYoHo8Dy2@~>`f<?<-yoL*XAQ9ys0f7F=s
zfGuFJkfX6;F_taFm5xHNRGd%eCOf}SnA=^i-O_Tj>~gfqIgoDJt*`tn$GWtZn={cO
z=dy)%dgBy;mT#4Pamn%U&(L(vyRfH*>eW^Z20M5^?1j4i_*o0CZ7QK+_gemvzk4f-
zS70!C+Z%J4{L@=zHMe#WiGWX4e+J-{6+nP3v+}{>8O}*DTbH+*#9)uqX#oc&RFNWR
zG{BT!O!e=Z!6^9yfL2^5YXDY2slU;cAXvzYvuVB(GG1_QvOf^i;~*EgTgp~OH4YxU
zs#!=|tFnl=3CWuopcs{aIIq_MMwK<Vt?;6@&AqOtkR~`EIb(=T26dj!b>mN(WPe-7
zYN(7UArRSFA=S)iMOI^@cu+5mhL)=z`(<h?0<NqY|1#{5ra&NNlGu<Kl2{=zxbfCf
zMcGnI=b-S0O$zoGw7xCx&GnsNTPq0=Fu;vDpCa?mx1S0*pU;irFnBP|C3CZy1cs4@
zX!&6z_4M6AxlX4#!|Gg1;UCt);eT$Njo%;>e+{l=P15`pAR|;m?|jI+wIynwZDs=)
zy3`8B{j!W)4*#*P&0@}f4Yc9P)c+OCe9O%Ld=skJTn+;$l$q?&p;;w(IWx(F3Gnw0
z1$ut)8VTbgr$W6~iM$Hma4T_L5ua;Uqj;6MMbO8)5yoY#^BNe$TNksr{(rq+OH6Bl
zxcu2xVZqjk+2W4f4ruu8%dK}Mut+E_f!o>|3#b`pPn3+4^LeWGbJY3ecr)8T^URV+
z4;PKQ$P&}|-6ro{uawtI5qj#N-)WngK}W4X&T{Q+g=;p03b5xg+izM_ApaO|><z}R
zjhU+u`zSH$e+oTgiGo2jhkrar$}J(Wtpwv+MMoA&XbTv&in6p+V%|VgGIJclEdthU
zx<XqWv5n#RszTAV<@P9VzGY9L|C>8;{*SzV{!hd@3NNwxSpLN)RR3vF$;^NEl}*2~
zf(?ARF#l8z>7Tp)6WqCzxSy$X3bCNQbRPHU9)6=@P%G;{?S6A_cYm*3|LOjB_xC>4
zfBGovKXHX=XbOtjPNbRi@*=3SH2ICa_GUs=?4U|17RZAtlW~~432dD}F7ay1r2g{a
z>^aq;#3HP=5`oa6D@-a46!8W4XPLShx>q_?UGe1Ub0MKQSG`sLP9-j<0S-DJ3=CaS
zFDkxN5f-I|0;Q1P0DmJLCes<jDMNGQxzl5C|J(YQ8Lxp?R+9V}1}iRKB-unjVRj=X
z@=`(FT<DToQ^G)S)5RhKhhK4EVM6tz3v&={jhQi5G7WJ=gJ+MPJv%>o`uOqj(etOL
z=SNSUJi&hrKsa8=Oix{v_NkJw@y7}NRqR4(C_Ri-wNrJK>VFLUk%M6*=OKxo0gRh}
z=+O^Yb9zCMYSJ!B=1+k)fJ+;uYL+J9e5mqrw8V8psASlSREDYKypNblA!L?8t$JJg
zmd2N*3n-`SEebd-q0FZoD{NaM(Ppk>w=EM43oob&Yi%K0x6;p<H=fSpBOK!~lSZ+Y
zZC>7;KKl#AvVXMw<P}>J^4ykj+~@vl9(gxd>=U(r`!@gJzr#nO@LK*`?VI_%zvh$t
zp<mkqDo1+nyB|C)e;#`;&|ei@yr%2w6JP5EA8)9lOuE<epFDdAZ`Aon4#9*>uNHqT
zD3z4U2)|<_X(b}zQUMhqdi>mgHv2LN0_!7(&w|Q3oqtz>Nz$xc0{07oz@i@FcU+Yg
z(=HrnJ~%b$!G7T_^lx65TC_D9=*3df-F2r^>>kI|j?^gY3S|5^VfdTB4G<Dh9T9(P
z<2yDPvQwjDvo-x1qqLeIou5q-*B%=PG7U&S*P}(d@!>0G&6f^eAzBUd)E(X?VB10Z
zNdbuSGk+h5vl_jHFO@O-*5Q)+-y*#g$5@jmo);N^Al_bAA~670Gl%;`7!K-{39p(k
z2UkT4Y6z&ICHx|MT+G`krzqGF;n(6pd7Yt!)n0t}!KbRTAC~@agNSag^y_;4|K7cC
z@9&oN|9fBG|L&9i|8eU7(BO2YBP9-h{)>%EOMg-$Mrkq?X)@2C#&xVm%4DQRgTydO
zNC5@n#Y9Cj(#)VO8&b>dP`EEB&8W5=Q|f`$THC+g>tKtJ;+={grOEVYA=<xw+X;61
zeIDD?0pJ=D>DS6D)XKHB#o%)t4nRlGCTfA2>V?WLCLvA*S{tiarI1c8p3YQ!`0OMQ
zXMYn3a!X_roYOE(jDh(sDpSuUX)+&AgoKvJp&{gNm(JrPh7yzr9t^038f#&Qc8enj
z4d~v}Bvn+1Jc$)HMRi6xf%p|yDOHeWj<*%q6(xrgeg|TfAr~~c0?5n+6XRhB(25(y
zfB)D26T^v;Ga(_}8relp$2vooQ&$){Qh)F$1^3@n!9wHC!#>F0E_-BDHhkTIY+z}`
z(a&e3x(}vFIFD37S_6a~0uhV{(8?^D!v!K$A*jJ|CI<YLO+<BX;|)otuD(Vnf-uOC
zW=A?wCf``rPPl=AXdj>b(lZkYc(<v9)uOeuFFwGLw2yv1<G1kY2EsA5V+V_7sDGZQ
zH`ze^Net}e>KA-?wum$N1{;a#E+qzficP<v6Y*sb1YZtBoa9fwf+c!05PU5%L?S~O
zMF8(5E_56MiAlOuAx3YcE>(nkr7jg*l#sOGG4G4O;X^woXRawE5qX*D(6!Vv3j;d9
zSkB;XK2C_3iBw^tU*fU?$-pKuC4Z)(Js74615nX`I&gPOzVgyol#F0o$2!Itp?h*Z
zMD~E>kl{AEnG$5Mjx*3}#q)_a0{$Pa5_(E-C~>q9ZTLn()a($ck+w!ei3~ekF_qcS
z-sO{2k3oqP!EZPdyFM3cA}@84(j^q`*zuQ{Fw^-M4(33{i-CYWl16Ycn17IF0E0`Q
z8N58t(~%siV2AhdtthOCxTYO%#o%wD5w;HCV_>{gd|mWC0|>oh1W>NYbQFo7&klHv
z(0FeIt=~MAQM7=TaHirESj{iYX<oj<8NuH14ri&J&0t?)d2m&x0;dI!LuiIc%pidb
zrODjF^3=#u6D{CYZdWivwtv<(3bzIR>f058KZ4&(2N>26hZv@Mlu^h4^GZA0sU8DQ
z^;VIV=9gS(nDS4j^2)7lVC&dpWNPr6X&vNExy3ECR{gcupnLAOX>ks4Z;yTh-c{J{
zHgy_IRVIUZ8g<-O!@)rYg(2MwF-tT=f3qAsKKsS;Cyof0sRCNG$A1EvVGdNwYy$CY
z9z}F+`OI1N+Tb9MH3*iu@tH?&n53y1X5>7ve+jxBnSht#@V85Z6|f7^Zpq&+0o|A$
z%P{<rWkKaFD<$%`%X|KyX3O(EsBG$k`aN}Hi6Z}9xXPEB@4_{`+QuudZpT!<R)@b`
zV&14qhYGRG#dR^vUVq}EfSmwe-SKMs9H(iLR-(wfwhF#J4Nka{gKciqBc_zXGaE*o
zFL_)3c3DgflfPYJYC>O}D!{|lmvEei5m+pxRS>QwpfZGMLi~bM5x8asB~1#YBx+Lw
zh@rBsgcqqEbfEfWy5NuD^2*ARP*ZITCbM14GiUUKrs&<NTz`P#rQ--8CZ_W!(=!kY
z8Zs0>U})5Otd`hMm6-vQFOSOUBB??`wMv;0a(bc15HP|$d44t%U||Mt!pIPdN)&pe
zQ#dFnR(<sp^-q9eu(Kr2&0LYXV^b!_;Cpo$pyQL!v_V2FFL;7a>uR$kA(<8E5)M`!
z*CPH>DKY?G;D2==O(1#Q2K@cO5(@|sb~4XAn?!9r5;QW@)g!4)z>X)c6QaXbr#38f
zeg1ed&#Z02P5;ufuhf-ifsg7c+9aVW8kL9up2;+Gh>sLET_{lVSrKmDZ*d+)en+6N
z^B_UDN$pt_U`!M;z0g@I(*@eZ4w#`E(0#SZPfXqrD}Mt_mXh8<>sXf+ZY01|O_NI%
z25>sQG-ANh8rYV=kvz+cIE-z<FV^O?5d*eSia$6JoHloW+GjFP9ZRrnrAo-?3bYj>
zCi_B{Z&*Sa10ezk+%G0c49bFU1B2dF=x=ACU<8QJ$~s%-Y&R$1DYm(_qOA>8lD10I
zDxFW2F@NAbcpy}ox@%D~63D*AL-;wcFS(*F&{P>!B$HzYgdTjZL-9}y#OH7GAFc;t
zU$j~^-;HtlAVsj(_TWdULEQy)idhmh^ZDCMj<5Fxz@g%h3drF=nsu`%pET+*zzZl%
zyzb<HGI7Q4<^W@^w1U0&7ZUXQeepvQF7O<y*nbuUxk8tb_0lo%Y9o@F{QI1}VAeN8
zS}uuWAl<ysZZWW<n};)9=vbzUmbe~3qmr*4St^HFFH}a4V=>WjhB2CO;beVwI8npb
zctkAJ0r<&uJRZ$i+qMQXA;k~#(FhJK`~IY$VF=44Od`x{Jrfr&`&?Y$6_uP&Mio~j
z5Pzpt<4683niC937n%{+<Hby-a%x1MA=dk1qGYI2V-GONVmx(W2*wi~kLkWo%LQqc
zyoXPp9scKw<MSV$KKd(o51$`Dd4B%<ug{LpyyQTvvWtm#P#!fIW-9CD#hv|UZ+dYE
z1yWm3uO*jwlVl!+Y%v1L_=_c+w%z1X0e=EmzXy&20v7!b19;%oBZ5C`*e@zcm0Dcz
za<G(TSH5AkM4QD`g0Knir-wn7JWj4udL)gqIh4?u|JfH`EMH{IlJs8gG#Oc;T+H>3
zkKxP<2GZEqer>Dyfkik6x4t^;di}yI_Zw|mfuB4q$j$n_d+6X63i`Cm-Yd4akAH$R
z*MynM_t$jf4#Sc@x?WBned~oe;>lXq1HILt1FmAfx;1>M(ip|)bqc}asP~#57H8;t
z+|PNg@0;V`jK4Ux1=iGIG6hCuEv<g^0-Mc3$1aio$QT-dus&uN6rgd+hMs|+jfuLh
znPXg97wso+^OVdkNEW;T!3FFUy?+f&`3%pde3GOx%)m%*Awki$;*1KPvEb`ML$n(m
zYf2oTpc!x_4+;htE%KW(t-wsC8C|?bC}rzI0`iP&{HpEN<0R~o#)ax}2_F;h`w#rn
z1_)8!w;reX4BxIrj&SSt)=qa{3>ZEr-x&<I{QRxg`t<<vJ&H-O)#@CUhJTs*;B<EF
z3B#ftI6XgSoW@g0B}WM=9*FiR=Gy?*EXTV^sesNXc9oI}UfKMYr9Mf&NL*1zLGaDk
zI)9-NoOdN@I%kv$Yy89kPl<4*YHlL*+#*K>L7=*%$L!M-SKvLdPn1^*)~JnJ?U;xC
zZ;Sq6i^KV^^4{=&TKM0(_kU>f=>N9hKXorTw&?!R;(xV@MgyKSr(ZvGlvp4s%)s`s
zO{zfwkv7>=OO~cx^8fqtiSD!0a!dwL_OyWdH&xjr!C&cLKI4WE_GvIH6m4YFBs}1M
zdch-dY~TU>*YeL=1`2EgA+b;`0nv&#NwS(dYeXGO#So|>SM?6=pMS(p&!0aN6iBjy
z!FExp<RB4T`~eUlnHQYMpGfkf&~TtBHt*Q*C$Ra&+?$KR!YQ%kJg}W(WLa(h^k=H1
zNn$sQII&%+HyUhh++#t2K<HkQ)($2pPr4vC#Pt9g!k$VZ!z~)vTfMq)V6Ufi1F)Dw
zEyCV(o=FI6+lS~r3V#bTD%BW3M%5tz@R;@sgfPjmES0eVmDzeWc&||pbis-kM`vvo
za9e}uK^x)cJQ29k<yk<8qcZDc5A|9jeBO=R$@iT$8gfM#8PBzaQSn8(s1q}^!T$jU
zAA4!e!@1@b$0}0ZT@tRM$ge8;4&f}?7QMN6-!2m%)`rYYx_?eQZOlHxYBmQ;zC4?$
zA=;h!?U!ymugaeon;YkU`>;?{wV;zbvq4FdUZXLymYg@ZZ1s%4dfmL=ioNi&{82;l
zh!a=AE=f5uZZ&xnwvA~5Z*yz9EOWvt$vG`0Z@(z!N!X~0u<`WEeW8MazUc`dR>YJu
z2R(c!S|!G${C|`Yd!<lT^5?RqM%}A}6(YHS+~I1X$iMvWXn}XWi=GuT0~Q2Mt1p?$
zp)Fv-gCaZO^Ee2^W0euNL*_?*K&ZzG(j1}zA=pA@6pK67ka>#JCg&hJvSOj)G(k@-
zg+s_;Hb+ielu_P@vcxm9kRT;fCK#YcNjgMVxOY~pL4Pcqr{28=nwrQs1ix54Q$@rb
zK8{o~v~C&R0b5;SU)Yo*l@R!HKE&LWC-BPh8DF7!oFuQsd{$H&Dq4vSJ$VeA#ZxwP
zC^TvZ3<;W~8AbQQLk=4W#0!)E=n+vUXArQHCBQdAs~|W!{bqN!Oc|)9%=GZJczQU`
zCKQ|zihoN30Zh;ApLlMdDI35~3Wy_GJOfA`y}B!BEt!l}W|h;zMsG(LR<FkQAC~sn
z@$YvRCTZjU><)p2?za0_o&R(1yKgG_KYRD@-}@B*cNhNyqNVKrebHJbI8b7_EXX{S
z5`LYf`Vy)f=Wgtlmj?_l!~Lj79JNQu8>L7%Pk-TnLZ9q5m1(9iN}sbrAT))81Kl+O
z54#sIqo=b-0cH#trf7r_1uVi)@;F6$gzz2vqQ$W|_#1~xv~0#}D}XlwijZ~TA6<UN
zj&AQ2_Iy|0qyPi&&2pGZ>CHZ8g;qXbx3T|)TLSOxnxGZ;{>5BJc)ibGw?EaqtuDb-
zR)1*R{#5gJGE=dfY42tJrRH5L*}a#&Amr8#=jFDhQpd}-p+(f@?HHOi;PrU~^s6)W
z<=B4lk9`-s32)Bg*%TZ<E~Il`l0zIl;X$AK=;Nn7_i2#1$&B=yVwdm(Kl2-H?Nb04
zG@1_G+SpehD#+_L9rnXyX#B^OM&X50tAA_1@iuAoVC<I=!R6lW^*Ep^GjBu?^n-kX
z;Juz1reHVd+XPamu8|qh>+!q_U%*T7b1x%%&u{P|{JYrA-*5>1uPBx*Gk<Hjp)F?0
zZFy#fqSuR)<EgeO)-6&^-8Q@TVWIJt;$JvbM|uRusp6ql9*IF@)4pi^@Bb0p+ka(l
zLch95CV2XFup8|8O<g{!ZSCJLbTU=HnLhp(KD`&*5BBzKyN;;f(Rab#Ztz{+Dmn`*
zhXYA-z2acye`bbBJksNLp#ZFw|6hNz`&~u;fA`(jpXC3Y$$!2vrB5kV!qH{FFCNQy
zJcq07pKM5N8v{v?&wk0nYG+Bb7=P&~>baaj2xe5%StQd=z=u?(V}%^#`0U>9y{|24
zv*_IyEgMB$e1e!3bE`|#zw=0Clragfz?IOVAG9KU(E<z!?vtSpTFOws<Vl>VG?}&h
z7(5$X57}wI*ui;^ZJ<0oGsTB>@tDOoR4NS?X~t(y<7iQQj>8AsCb*u&*?*A)2mML>
zqmC5TcyMpq9Xi9%z*rfxFYfK$`<4PAhFK4MUM;L81L1SLTh`ZgAyc7DCOKZ-Hl|~H
zS2O*ZT@A$XB}5gBA~~j@8Hmde7xS?gMwF5b_kU_@7D*k8fel@RQ4d`1GE)UTEUrMD
zyoiw@E2@yD!b8GgE3PBtdVfEi6);E^&zTh#T05CS5Q5I0UaB<Jp(;QBQAQER#e%Qi
zoWy5WIvY-wwZk{y>Y(RFg^wX~a>=u2VB=94sa@W4ypFzzQ^?E!(l|<RkX}5eeFb{}
z=aMNspBu&Azmxa~_T?`CDSZ*u(F<yiJ&c-vezq?_FjJBQs6U~G$ba5w!2!m2*6)4&
zCqQn_^ree5E5?y`0s&%|VuNAlOgFcsE2z2^h%;$(5I8E$k;w|?5!eMpX<k?~u=YLH
z7e_4jy(d;4zC>LG&b;mFIeKecpgEePF!dg677LY$3#DQke;z_@T-Knw9DLlhEwQ5H
zZZ4`TK;`NR(*8SM$bUYhyuj5(8pt@Hw3yV*9wP7|j*H{6`S7`TZENSsmln)dWWe~@
zV4SJj5{Tjl*R>w%85qkndx3~;k5f6D9FV5-GlUIcJl<%;A^1Rhwk4p3FDWaC)&c`{
z;2I_7vvDc`u>jJ45}=*HBha5qgw37R(eeo@b~+wEH^*->6@MERJn*&CY;-(~=6Duf
zwm?1o>MKzH5SY&W`5XR8s$u>(|NA#auWP9{d1F8r=S&8zSO3ges8;_&#S@jk;jQ<v
z#{RSS?Y)Zr_s!lX`_J9!f1h*8AlxDFYUZDhe(`eBr+Wf}jk9kD35PD@X_93Afo~}|
z-XSq$caL#xrGE(ESpFT^oxGAMW2Uy~QkAJRzcYbS^Q#Uskkfnjb}iHB_c_=cyfz$F
zoTMPjAfEIBqV_4Zj5)5CI*$>fJsqRLiJB@R5d`8tl$r^Gvr!=hU-YfBSmu2}ptd$5
z)TrtiY6~Uq4=_K7TtX=fk<Z$=z|#nv)2T=yArfXyPk+5j=dh@s=g46`JR2wjXJ~%^
z54FIHVKN%EcFO7a#9~qM=RN3goTOHjC@^ytpRiA_RoLV4y9fqm)h1t@pU?Ww&zM?B
z!8ouDIr9l5e&{Idid0?+fZXkJVi~ywtOXFIDJsT2=Hj7iD^g=Qgz)$}=RP=5z_=MA
zCJl=!JAc$xj`7y|?6a@FDp0+1($S+}th3TjaMv#Vgp(=#mdwj<1#y0Xale%i;OJKi
zC{p^FmdDioTKe&;z{GM^`EerC%5QLlqw*YmGg5hGFpZvyF9XjCRvb(~trG3M+M)RH
zPnZiIqWnKSK791caWD<vK_Bbn|JN1&&+h%Nzkm58|L@{||0<R_eRg)v2$O(WeKG=R
zkWH5OUV25}3ng;cwt}6VfBjeS>tsQ4k%?|+=ehTnm?VJ8y|dF3YduCd28E^wPMa<u
z$I;~$zuD=DRLxNg^WDs0KeTlS7q)q7(C;)#m6^mCrcB`$ot<74;K370ZSML{0`fuN
z?SG<=YVP^Ej~<_NMJUbWB9Up>rBrDWc5<xZtT&Pv$B-on1SstEgmuT@RC(k!KpC&m
z21-E#<Q9tD-@D@3;VH!343ji8sG4YHIy*Zjm?~CXQqH|Xm^r&7VG5aNwU`@tWiMm%
zb!$>N5g88=PJ4*cL3t=R9SpqyN;sml27d#aJ%FnmJIyGEjFADoA&XHe$5;!Z(XL^W
z>@1@ud8>$Ii?n3l&)sG8Nr{>U{qt0f2Ft#-o)h}kt_qV+lG@jtlg;))D{X(q#d)MK
zRsp8VK_{hyawUy0Lpd5H5!eoNEPma^<2g~w&!c*yhG<6JnME=V2qIva4;J<?Cx88t
z9;PvTN5>3qvh(ZSfB)D2{q-J=05C$J{ZC^4<C6bqFtKE4U2JzE|G)kA-nV7>|MfR}
zyPxF$M~VMrp*AR|*9SbIU;1qFcbFXL>GfVi@9TkU2QH>am&b2rGA0{3#!2FjPp@K?
zK0+~gNFcLx4d<jB_uey^mVY`WNq_mDm_V`Pus+BUUJ8cD0PlmdA|D_B`S9qk=Vwn}
zoE{yYpB{?`qHm$+{{{%>UGZAS;olyLzg_nac6MMs?N((90QfVd7<0JqDoMd;R4JHi
zFfuq6A_{0Qqqn-E?NVoGJ%doG+40}!GHT;BtJ0B+W2KhB3?rk9`4sJ>^nb4|aCk$O
zQ~OT`xlW&*;{YJBgFe|8_q&4M-52+|0?=3&kiF~x)j9KQW%pZk=6cu>0)iMj#Z~q<
z7K1?(gKG@G_ApeHR1(gVwI+6)03{nWUT426x6VcU)s~qhkYv{CR@VV%v|{r3d|&M4
z!1lIu4Wi<AMWF~9JdH9qj(=}0w(5KazKM_vO^h>0j|LxMZ}*$t?%wm=-F^Ij|EmQB
z>})IC|GoS62Q+EzQ(RZ8esk|)&Mh5w3q?KeaJmgBEr$e|$_VV0fD?x!Bpp6Xu3|3a
zN^m4pt8sfev(v}AA;CCP4`{A?z1_XmlG&B_ZL2nDF>Wy8m$lu!T7Nyn)gRSw&>HbT
zLp9<}@9OFb19y7!G*U6ZSchUJ7l@Bl*dzugBG&Pskr3kP%Xz4|;xOE}d3C*VG*B1f
zJWAp*)|8~j2>J^aT<8LSyDluf!eyu7V1%((m!{J#HHjg|OFzV}@FVJM_1ktf_yNwR
zX8CieD<VCDYkLGJ>3?}?HA+=NyKTajV_v)SP-T$D)%1kqT{&til#VJ?jM}M`0)i4!
zLzQOdASR|$71O=<T+VXiX|Y;PwPYMW@5ALEEYLiY%J+pbIjyt#81d1000sj#u=+Cw
zr~}-Dm}tN-&)KONs#vBvVP<RpveuS!7v1STVEu#&u;lC+HGdVFJ+W`Eu8%7(^YZO7
zvBQ<5T3IqXx1!wDlPjO&+U+gW)bz4t*Y4eIY{>0y%C_r#8*5!Ci?gzpVNJ1|S6iNk
z4XJPmi}rYgMd@Of4%;2gP)0IkPEo^)>FpDE3>A<-?ED*f?79}H@q1T=Zl#`b6MDM#
zxFzD^m^KZx%zvG{;dZ)}%LFgbd%FKSVD8>51(^>>fVW@^Sb6{ddhg!7n))xhpX~qt
zB=`SjAgODN1qfN1OjVB@*yu^`GfX8|hx-tN$AO(8#U7b`a>fe?wZ3l=p7<RM1phKO
zxl&kMk}eMH6O4>=pqZGVVul2AY}=q10Gq_-;>Z^c*?$y~d*32%rZn)MBM74Gif4$B
z+jTGlKib?gyEYJge(-TmnsF&<svLOi&(FotJHyK-q*a4}mKaGn!)O?QAQoV+a!E65
z(OBV&w}=h|(0JzIQkmJ=cN8hEH^Xp+K4@eAt!|sYcU$`C_}S_4(c$ysM{G!Y`6zs)
zW~my&J%7Gmv;w-qK8NFRs>U)?w){t4<<Y(KSetCc<5ML=l)-uR!uscUfvstPep=DP
znUd*nvg!p?YHMCd=5h8PIu1)e{h~5i`Uwqu`EO+Pdkm7h_DSi-A5qb){0O)0(vNjb
zKGyMTuLyB*bP#@2djD6Mg4ztR&6OYR4<#dPA%ByOI6=QJ=m7Qz@ci(%%Y6^b{}Q8K
zrI@L-XSo=A6CIwtNyL>BQ;n&?{l1taS7J~Ca~jwra)bEzwgVsKz82lLg6dlY?#0V{
z1(UY|F50$`hRaW8MKZtv$$@=?VoR9mop(cm7@Np}5UOo5V$;6um!X^X8QHMo>EOw0
zKY!QR16yT{IC<SpUU$Xd^S9W<H6zFYxG#PMC{?ARKV^i54gy(Lr*RTr-t9y_TQ(C-
zBjI88`=ST`6ZVAfgM5BXMtu-e^w{2oyyN7+SM%CGMnxlxw-Pg{Q)&a@u_%<Rawl?t
z2@f1ic^!BYDiDF{inrHY(LzgjYt>uWFMmVu;o$Z~tADxI=X-3Q@h?oD!x6C7c?(_?
zfAR)i>B2`M<hVoI*UI)EQar!|c`<A?9uVgd(4gSH3q^@(V3n(?zdiPvYO4Uiwu-5m
zUf^AK`@OJ~T)POfR9!Y)gi(@gx(GE>sjfjuFacD!Q5IlWXIe%AlLN$MGL#qd2!9|~
z8!bnvVO$cw#+8mk2rhuI{TRcAmC5v!A`&?fsO2Eq>M0i5p#O`lUoYzcVi#g+SI%Z>
z@&@~XKjHr$|Ifpt=dCVMaH+!*8**I^E@VjUS2!GwhT(ayD+`?qRL2hnF#mybSV>04
z17<LAOETyWa7E}nK`YjD6Y@@1o_~I}X5n_=$%cQqap9<1O&aj`ky-TKy|2H)Cfzfd
z#|DieJ-7yUsWtdf{I1fZRdeE+4Xw9Fa|P8CG>svw*t+KU+xz$_#z@6u>|={@n0X30
zeXd4#er~zQ_M&8jujpJt#q%jf^%T!79%VrJ3?Z_sp+u>)UOu?k92_go27iL}ItMox
zvI!ebY)f4;eA9WHWao?<d=a@s&d}Wo&Sj*f0b_8OXL&*m%wZ&_v;0R)g_6-Z!KJ%A
zb}ZVO=?fj{Y;iu4QFI|08DI?$f$7lybv$I*_O%>t`}q~EQp?*d{t26^-?7rczfw`u
zW0#`Ec!z^QFPn|FtHJSR`+sM3zjBBxK2W{yMNXhh;<28}sF`SY&SSFjH=qM&!6lqI
z7^RNSQS9&7x}@M(;JWX1w%*+EozI4!iBN}BSl1f95VLP!1?M35<-p}8H|Sf`JHL{A
z3;7lehY>wFII{2!iP=@0VA*yQSPBoZ)vPUx*+=!`y@iOAR)Mk9kbh{6V0w#V>pFtG
z=5XAip0tsQ)Jzhs&{kK{+dReyfmLECClfm>^v*On8-+c3RU``hQ2Z%ByG{1LI9w-o
z)tfApHPV0;IJ<3?n}~~0<{OALuYpo{Lghix+Zu+tkY25oSFC2{{l;}K!YT;Aoj2L9
z_*6oCM~k|1FW3sU^?wcE|6y|zhLLbplCEGU8AHzFVsiubm7VKcv082&vaK6*PxmJh
zoR6vM<DIRK_ce=)iXlXy27e(`qXlnXGYxBb@9li?JDX54j1|ceIb3?a*Xp{ZwkzCq
zYumDX%y%5xnU-n`;k@^^yXiUhn#uiD^y?k0SNUgd{864@<$q3(yAk6iaD>K^Gqir)
z8ZW|T6R(>A=BgnXF~=^<E9c^weCM+%Z%}pImU4>XEKTBZiSDa+#8uW!ie@3rv(OG6
ztx=L*=+F>X+e}#C09SV1&QF6~wE_cM!o2c5^_h<j^Z2zgv!Td`;ubbM#@;FRqtmuK
zhy7wRn{Bmccz>c4pc@{v+L^r@Dz&Xb&I=~h0@whBZtz?z6l8^Xzg%hD7c(8(0!9y7
zoG|_6W{khC-S*oO4O#ftW!gC}>2=pzs(g|1<>4Wc<;~vyc<O63j;388f5Q&yn8UKg
zt#ORx($@)Cf(jw$n_G4KbmLX8>F|aEcMIv+ST5Gc5r3X{k<uw%nI4H5=>E&O@e+@j
ztsy4u<K8Hemzcd>J}jFp`I7z`(Ru@JGF9MJv1)j(wSRN3$~f09d&yn|ZPaXmTcXk~
zxZi8}ic`JMCJeYN!yeTJnK>|^q9dT<m2<bOqqD!*qEZARlgfo41bQf+Xs=szA8NE;
zmA+Om9)BBs-GxmEGMz<e79E<)RaUt|5L*|+jP1v-&`grb#cFPZhF7BXQeV|~U%qnh
zHfZ@}D<1=xsoX`<J3$r4Y0jyjbO7~L%-U$S^p%EJE~1N?x3Q3}&y|bsEeDH1E*Z`8
zAd-t>pzqQ}s+s7TZQ~)6ak!TgYwZG;9nASE&wmnwacBtbFjgtJcJs+^u+-%)R?65)
z+6g5jh*ox$xZce=F={_06Eql~DU`nHcV&a~MjyBCv*;&|;lB0OzT)e5tcI+66nRPB
zMnbMmQeoy7Q#mtD8BD2%m8)(b`V<THc>(^O`JUDCm2J!cMlJM=BJ?SjtZX&wznD8h
zxqlEM$_I9j28Qjsg_+9Py1glP0Qv!dkoy9Wo23V~V5aM&;s#mS%}ZvmudqozgSaJm
zLmoYpqBa~gK!L>GEL9`@28EE5K3yktptMdBC1boapiF8;Af+x>$)6qo$x(Js*NT(1
z(#QMAkEL!Tc>YxU7E6fnDtI@GHI3K-2!CqC%;XSbRHy=313udFO`K&Xp}$+~js@<V
z#H#O%ntiL_G<5=&_v78WVwX<dbI0;O%S&JI(U*kCMKX_}ynP~G?sdie-Q8DB-Sdq_
z#U8mlRuSR--CcM|zFED|yDTDBzjc2Xdd!kUT<G!YSNDSZUC|n)1R6yynYz0{U4N*X
zxR}QwL_g(m;5Rqvuk5ki+025!+6m;jemLxF*?V{w@Tu57!B`4l%vgf9M}NPYB+i0T
zT+MA<A(d+K81L`qNk1vft;#nG7Z|`U;q7kVi$LStIeWh-!mTiyS4Fq9z2h+9RF3Rw
zBFwcBun6Y%Ix0G%-VhvXw15KK7=PinjkU0r7%iRs9dDaDevI|*_TjkK`#0)Me*Vhw
z_U!F;q1DzzMNuNIk~9i!a1>nRdnQ}JwcA2st`qgHDGm=vwNak(!w94pgD5W4BEf`m
z2e-LyGjhKVM@+Nr*7@QE`r;iTP>vRQrQ<NUD(nYDE>Dx!3S;>9DNda24}W1YoC8vc
zUucwT@)7(ES5w0f?JF5))EpPThDh#gqI8N8)|A`L6{KU6K|PsdB<5^$hkS=sTOSl+
z{Z=hWP+&s9;-S_XSBok7cySXsU=$bZfoRflk$n}T5V4*5PK%#WkF8G4=Yf~>hFAbF
zG;9z-aiLIDUdY350Fk8Y+J7j-bGs(JSGXV^)K-8{AxlZz!QG}lefpo5|K*o1apr%_
zoOtK>|9gA)%lTj5-1~(8b~pbkCglL;JquqKi{A$b#~$OnViZ2J8&2|J#&+a5-U-KX
z?t9Ix{pgW4vq&xg;(pVwlk|ky-AQ-|45x7eUL0<t?h0Y5O~1$^S$`UQ@hi&B%|0oI
z;WhuJ@%tMMXhodEzG&-AO{-0zme9QAIv4N0Xp^<%h$2jE)&ywRH}9~<bGI+rx6^iw
ze`;T}Cpx=v(@Xp?HynAzZP0)yD)#Qi-;{6T`%MN|GCMZ-reuj~db&6JWQ)11QWPs0
zLV0W7H*U^Te)mNi?|)i(4-Z#$QK6Pk>eNT8|9Sa#x%ziY2!Jc~zi;-wyI;Zo|N7f+
zzWb#AeVqCK{tesWu3}YJceVGxC3gCKPSrL!3M~ZWqg^16L$c2GJZR9%GU}2Y4;q57
zTVzvUtu(8g?pz35=or2eSkcAI)UZFC$QS~tT<7|C)uVazuzx8#kA6P*1tOzT!0aW|
zS^>-RRg%8mr@Hsxf#apfF^v7P@N<K?=48gWfKs=wl~=U3&2U<vQ59<xcWng7L|a_o
zF0`bwVbBSLtyJroW)i?!%5cGL9PmWWVD^+dJ4(R1-kZ;`0zD?KL)xsDqYh>pScwIU
z9IT6CfYBBMT7UICL1BOi`F6(!-fpvj2E6VP29E=A^~46bP#MrQByd^4j9U!tc!+9;
zKmSGa9qjH*&#>l|vmjz^99K&R>JF0&H$ZYdyiA~av8_l`?s1>&PFzPPg&G8u;*S8-
z8J5&Sd}NKQ1*HzU;%cIY6Gka8HdTw0mWPWW)KME8p?^);&QqJbJUv=Ci6FG$p1%Z7
z#*CW)Twq0j$mu-p5Do$Ek#~i|OC3yxNlSz()MU5AM?9k}5wD@F1)KI5uK_a0dRO4%
zBg21>^$6P*8N~CmEF!3U6)h0gSZ80tq&ZfBUC@{hQ7|eYrGi7}DoODfu1pyzqS>W%
zr=;Kbi+}5@SsdK{Ir;+-`rIA#{!wn^FXBNxMJE7*UiY*ybHs-mL!=ufZsUi6I7a9=
z<1J7R&EtJoCYdgJuhoJ>8f<ymqCJ_S)m_+7em@o(*=@EEZDwn@oMoocvB5-q%oqgQ
z`j7jMAOB*Z#)s9m1Mv%{#dEz3@2FKd@e&SeS%1n<#t6JljD!96a*B<)bb7-NmvKmY
zVs)IQNjT?9??asqf$u|84E#ZLS;(hq)Ktcq9wIx7lHu!~$<)kWE_bqno!oM|)`Y=?
z;}ZsXP%6?+JIP4Z#{H#kL#8AG?DcFR9WbL0QG)de(7iuP6W}79Kpe@L#8frS9=LHT
zt$&@ow0rmlN})^8-HlgOZ1Csf=K`aJiPsS275o}YC~?X9thClFT`0s!>`j#faWI-k
zl!ouT2l<o&@dQi9VW?7;Knau{#wr1}_)tNi0F{dNfUvX%T`^!3mvdgoLFZ;uY+zDa
zI?G47cLZx7<Svpy!7DHb#IcPH0Ek8e%YQGuBEorU(Phfc6<DMz#%wd<?5C$M9zPO{
z1cYLPjstOT8CIHR=ScH~T8e0pvmDX`0*FsXr2IJSL5)B@=c5sH?-dv@2^<cb0W%Ds
zD$8?-X`rvbG6IO&jY+|PWno_r$il$(4H35}Oqp3DO43|M8HX_;BL~kBE!=^S7k}Vk
z6|g@Lr#lcppb*|CM)NeA0MW^@vbxI;fOW)fZ#-@Zm!Rap3j!EUSw}Nn49%?9Wf6RY
z+2w_bk}EM|AwC7xb+NG6M7C4|k`sHjKv~cbXj9^0OH7)pq#k~PR8XJs<szG_DPI)c
z?80+b$V}P-EExpLDPEjD_LdwSx__k=hdIhisS$`NXcZGKUOLhgEoh=uOtYf|iMOQ@
z9ajhtMnUWcRa)A#pw(TTgjSbaR&y{Y&CiGVz>C&A&K%YBK-<Q2P?Pm2T`)kIZIiO|
z3l1y=CI6$w<R$xeIr|?o{ttMujris8ufk;^3Tfx7LPltS`ep#7^Wy9|DSz-1*h4X;
zap3ZlHI|lGh%l)L%%v9bm1>s#tVYv1%2$II5&sA*_yHYG6bv|52ED<+ApQVVZ6X**
zci&$Vt<+F1EVbmXohf{_-SMIb^%_7Z^kWZjqR8v8LWw6>@jMOSbA0R(3?4cnmq45m
zx!4AQY7(FZomE=E)epq4Du2H#SkQr-1*Q^CZ(fj8#v)rF1!1*NZthY`A>n%QbOf9Y
zu5MI~bU0CRcHnNADDhokVs}0@l=8v)KOj9>I!<w)sAO`q2yE!kTyX%0o&q84x`WNp
z#LLo45uoAK2In0^%~0ZlXwDNVywh)M6}xxymw-=zL7vq`AF3WicYh!bt!04^F0&6<
zN!W=2b^CyUKRkGQuyq{Zro!O|Juy|$!tz@*ndH17Nh$dqwjm<u{CS3zliFO$*OE~u
z5Q8kqWQ4>aqbs?<yDws($Ci3%RQL)%2*g0iG}6jINYg-o#sC*&`b(nbf^v~VNqa~L
zZBSh>3<~}{N4;jyv47!xT=<3prl6!Cs>nUeHN?dlCh2SrB6b9-QGRPXAg%_z+Hq&e
zSfKz)QbIMfE7z8I9p^j*Y!Fy4-q;!Hux^lDfys>!u-Kc&GnpD?VFh_q3-qP9)x=v$
zoCs*cWO6z)9jkeq&D3ze#!Qt!ou3S?5>b+>v}dBrSx<*bMt^;H)AY%}MOlpX)q#3o
zLefw~eV!`(Dwu}(XYGG&Jx6@QB3&ZGU?|0<2f)&Ht5Xslt6ZI{cxwLLc1+bHKwu68
zTF40aNN=rWL0*njH~bFwb~{FdpKip7oPD%t2(U^;6+XnFz69ckU|>-5grM(zM7Bed
zhUFA^qlwYd27d%8hzx;`+nWd}@(`653q$M!+L94og2>_%_eL^<EbavIo(Txvg=)=G
zASerPX{*+ksb`hfdnNhgANneStBy`uMXm-Fv?os^5p5NW15w36=>#j`Za~h?qfFZh
zs(6qX^8`$0^y`HhN^3mHyJur(lIE4V;fiNdT^(2o2!C6h1<m1g`h8(RxXm0M;#j;m
zzXECwUun&JI1$om4};q9vq7*PzXyA#vUSW`XeiRWR+twqrgW*5T+v*<fn!9s1fzdf
zT(8%bL9eKW@S9~&_z|*MRQjEco711PO&J~G%@lBjg5^j<IDEP~pr|9<p~4pOfXpOG
zvmV;7G=EAJBq87($vm@dUChI=f|$OcQlSbv4tF9|Q>k&Vw55Oxlq!o?10Y8#3|3(u
z<>W2BJ*F!r6&dvQ*dinGAbHBR9Y4ysL-ujJ<kDT9jS&}0U=3%HjDq#xOO5pKrGYCA
zj{J7wf&gD?(Mxe9eg#zrZ|6)&m>#Au?LZPSpntW}GjDZK%PAcjXO^*52VxWK)Wo_s
zi%0hLO^@Y+%SpY-0_5K|xyTYKdSVJfVJa84HJN4bIMgH5ATkd7X6hIaMS>;HajSFG
z_Pb)h`dZ))i|<7$s`NGx7_Gr*A`RK%VGf)L#J1!7iD;|-4FXHYbBXp*Ho;p<3w50%
zLw~J6wy7j2H{57;b>Liaf5FI$&Lm{fkRL^(z`vIR<v0|fvhm`l`BcW}fJ6=t+MXmm
zHV{v+dN>PPK7%B4gVqWPu`J&Y(=YCaH{C8N^||N>#4#K0ZF}ejfSKk>2r)p-6_84C
z<6s^e$rx@jxmNB*N461=w@!xgiQx2uhJR2&jB#bbZ#Gh<(13FRPK1IP2V>4d|EXW=
zwZ>P%X1<_cK7_W)7R21lm(*AjMVJ6OIYwuLh>tH}r}0ukR|>E%_3h#xl&p&~44rWi
z`pFiv97<;h+fmZ7HrLI!*UC8)rv~ZT2jF@uAbim5mw=<~c2ZWKrEt26>{l)tn}6Bz
z%3xXjzBq|NGnElP+P7t-WNs3<kYlT4xVpoR8hHN^%zfa+EDngJB~cwjPNXxH0yj^{
zByMz8Ac!4Gh@et}sQo#hWZUr%(x`kp>Y^n(tHQl}jA`05##kspfm^7B@-|j5z`OzQ
z*|o^YM@5_`$HxT#c8~?tX2E#J4u6tFdRBkM#m$3F2Z0z^u#SPvJK?NgK=J71rfK4w
z2L*@14w;~kuajLn50d~RGV(@i<ZxjQd4`L}6aGHeml73Awp?(zn?W^PcEHgoc`QP1
zfkX3z72OrjDJA|OC&{~@SPpf7x4QgY*4E6G&W00#!6Dk%kPI99L3R=w^?yOOkW%0W
zMtcm(CgK&4YY&!20~h(t_oDrF8=evb!4lFZ<Qgte<uHnfwd6xu!dG(47bk&idih$k
zI<$mzbC@FdcSQadkWiUiBAysb<fsJ9)MFJcKOh6>!4Y^7zKIXqfpf4~h6Ds<@@nAB
zlLmd>-9GKC?~ssmRU@l_m48mY5dbbEQw8Kk`r9(HsKp6;uvsYgyQUUzECrIuhtqJ^
zx7%s#p+B^d01KZTqU#^t$`WtGnJfx>41UO&#uREW#g}2C2G+?4QYX1Yzba?oO(0YQ
z<2FdaEXbv$`&tK~^<Zh-d1(uG*21~*uzi}St{g?i<;(Sm^wqgG6Mrx)KqwJR87rOZ
zVNuo)vy2v2ybQ`{OoQS=96$t~;Y&I;)r<6NGBuzq%B2r7OHa61M@$bx0C?0>4kUtt
zi3wivL9!(&?y3#G$|I1_mFGe~=sUcf(_<G2;zfZ#Lv5qf7NL)wrQ2Qy?)6|<GQ&G(
z^So8{jNXmuL+0~Ue1EAx*sKmLnFM0FC=47!#tjAzOn6xg7mqj=?#=<Bsx#9;_JH+M
z2yu;!R+y0tRP1T01uU%683@El!L0zs;54Q4Lt{WE5lbU3tb_t<89glnF1tle;vsug
znaNu8E*H$^1;LPM#0lY9nsB*a0<Hkw5QswzO@*tl5lW-eNq_nfUt}r=-;u?q$}I^t
z2$sZk9)ijBhe07lA7EEN$pLYZgp2MDU#WjNdM2_YiKw7ru*w=^W)XQ<`?gkj)egTh
z7iiU0(fg2YjPc^>$Qt6C8M$oS37_X?A7QN134O6wLh+>Y??sZl>ehyM{Ya5jb~ACY
z@?8#!+gQ7Sfq!_EpktA?6Rau}O^tR{u+&X-6tc(71o`E3KySQ!<;V--bSKG7=omwu
z@j0aT3!*c&_}c4|K{FreZ4Blm#}cgH9Bl_41_<8GqX@YI{m=_VJfJ%Q(Y}+EU<om$
zNTm|FtV{!2MK0clt@=%Qx_TXsC8`1$Mbk)k|LHjg?tcu5zh%8F>Dk5i(9Zk?xmYZT
zsN8@MOB7e!U9zhWV99Ac<2hIifQAZmk$X7css^{%sf-u?=CY-iI6un=2+*c7_vHIl
zY0piy47X;mk{*O;;11_hgp@Z&28aP^%#dvC1~~z-I|c(OkQ@T#*?@3ZicnycCypQ?
zSC4dx8Gpmojiip|X+24;%B)*YSNYc~tXH1@c5jLQwn~-H{MEHP1RL8GuhoKxsjw^o
zl&^AoQ`rvRorFFaV^#mcJ`SexjisUz<yNS6i5YA_5f!-@Qyk20A;hL~Rz6l%kj3m5
zMKU8j6N$f1gxqI6s>9(CC2%>>9=sLFY@f;YdVkOf#34aGQSb}BZIJ3Y%5_QLvp3m;
z3i9D5jB8~|>1sLWK3qjx1eoQ^K(W+E;60)Btb0-<%)+Ch7F#U6y=r(4$NXslj?U^b
zo&|wxHXD_pdV{n;R6`V8Y>vsfMgyT5m=iU8jiLXZpyF76huPxB&r4Xdc6F;(yIyrG
z^?$0SaCSZVw|n80yCc-Ig_^?z3$<@g-b;Mp)dLFi3*4%gUwE0!@|O-R-gV6(8A9P#
zy!HC$g7wvNU%s#541g>}kzc6l_&Sb<6$n>shjM3dc5pk`cTGGfLsJb9v&sOQ%Aers
zsW{|FKP!&yZ&VUBNy#?BUdaaRpme@hq<?>}I^FKG^*SsEwCs!4|L#3}dD#13viJLL
z@BcdwUj3=vE&tN_>hso?YVV4EmbZBuTJf0&6AAk$FpkVuhTBWFy;C5e!OPw&@)@IG
z0YIe62G^6auP0L;h!tM7Av`wSiC+2X`SWLD@C-xbIDq>>5Cj7X)0ZJ<^Po;bF@G^^
z>-29`Y_WmNN$})@<qU3cWAtj*MNe-*bNP2mG~v_w$sXsP2UZ#CrVN3;f4E?#KRBe6
z7J%Z@nO&D+%;Qj;{dD;F@%ni3n}=ri`-G&BUwvt0xtGPo2A~QJH-Nr}l#Z2L@9*xi
zdj;<c&Rb{QG0&WF%|l24k4(WG1AmO1c&$!i%9NWK2%LcE7huIHhe)J;gcBLu!Cttx
zy9=Lm4uoq3L+DU9xm0NiCP9i+0^WC}^L!w_z*G`Iwo`;lDsVCQ;1`a#%I_h_d{DMv
zc1&>{s*3=r393f-<WR1CM9HK)B&%WPdv8Uv+x*--hS76mk|7MkK>S3GD}M~7HbzY^
zB1#*y>m>$g8yT>L#o0p!*i0eoIGecg!5$E1o{R*UN6@&vQhSSLoq&f?RGThz;0%X7
zihnfL`5Wah-FC=Gq>%R;)MkW&n=u|n^U%xNoMMb&9y>(Cn?=cD>Y_9;L>iYcpA-fG
z<s0epewpeh$lD&eB}Tgqk$*~<Dob%r)nv@>&Qf5{)oFY5VIE&ls!VO6K5J8lkySC+
zXKfYjBHrin65JLhv$pECMf<F+zRgY7HA)blm1^7em?RJ&q9NYfx^v-F6uiItY(oHD
z&K?Xf8uplDSocNIiJc!igO?}ethp<!_XEsW%x`eW>e%`0;)F~hDu3vqhJDWjA!-lD
z;m?1;bAfrGkW0lqV-y6NAqe@h$7TyWmTO4X#~*!Afx}rx#@Dy!(pXojp8Oug;VqAB
zSqiM^@L!N|nLb{&dQQoCU-*Atf4%z&|K<N@?_HPMMzVFm|9*;WRz(%*CP7KItGcO@
z9V%PZrQR;tM{;#dkAJNpK_V$(8w6MYD4APU#Q8N3Ffs3N9%26PM>$V2u`ZcN+<1j<
zHXS>5mk1!QD_5@Tw{GL#H-BkQqOjd}{kHTkgdaHaQT3QG4Cny(!E*46>&cU;KhS6n
z&}jz^o85633}gg&4*C<v4YBSB+_!;uA=96M{oH&T^5%a(et-QgcnfiesaGeVm*7O;
zJ-MeEuctn%GpYchmrOzrps7`j#Bp#O1hLptqp3qfO;NL~HvV5tzYCGSLwgXzbOG@d
zw8C0h0uCTF`1aUsCohoS)#3*h0A8TTv`iZS?z~J3PB4ht`tTbKg<$KAtdX;F19G@(
zBX}#d20`$#AAbZN>GRXwM~@6#dbQRVzHhEOLD7SCl9PW7`m5K@TyWODueDy*ntE@+
zQyaB_AkbOcYN2JiHSsYMrPkCPoF=v8qS$c*kW?}KUYCJGe0wo~@Ay@wZ!3x&8HUzn
z=*F_%`-j#k^_nD8;_MDkXFh_P`P(b?==y_C)x%5L<$uA|jwin8js5Y+$p2CbQb(;b
zhb5eW^5!@_GWh}tVyuMfQm4_4WOxR;+y}pg-DJigKe=&zTa`9fhYq60#omIO058)9
zzzJ=EtUci!sWsv9OKmi7h6Df>*FS?AxAE|Ac=cIv=#J{(&~=BR4$Tr(6s}oq)?Tm(
zKS4T+fPaOd)(C5cAOxKcjFViv&EH-@=X%$Q`(I+SLOBd&biTw^rTW!-bp7a&F_vHw
zFTNIoNeE6eZhHf#_ptGw<pt=J1KAz~=d|6GAVANQ|F)k#+1bv?f6tyg*~ovlg8%pU
z@gwnA>=*dMF$@p_qQ_wX{4NGoa5iP1AGvUW^?&@w;n6G1+hk`Yw5KS^2r3Z4B?J!m
z2!J%?OoT{8cI-w&mz<NfK>cGJxPFYNIFP#YxUG~n1O$7@!+Hy&I^jWyJyA<O?Q;16
z@tNvdbSYCJ2&ecHIr_Vl52PT2&>H?()FR&=N9RG@B_XgI%7JvpF+IZoqB!uo6zV;Y
zwSV15Ggi>%0B1m$zZjnuV$2M{pX<4UX(wge`94a}+|YUqt!0)CQo<oNsfmy|+?Wb2
z55f>@L``C}if3HtHl!{-*1_m*4A>}%V_9z$!M2f8hbBPjIFwpSxsZc`?ND({`!uSz
zI78SD2d<0|YM_4x6CQ6s7aXqm)5O>4F8ntKI7)vfSyj+J^bmC{D@cAAS<EXm#J|Fc
zPb*7mFXFsR{1)QUL0fohHFb);ChtMuv*n;~e?&ycv}1q*9E|7&XpEBcL11wv1B$8D
zZb`K-%tJ*u0S&+&#1jO_Lr4d69l^dyp|&SDp#z?<PC+5r5tju1(XtpP1?eXNve7|2
z3YLG4j24_rtH-4p1DOkf4|kaWjt>5Ha4e$9aOe&&mrU;fSRLaCQrp<)`ndgwa0P4!
zJ?Y7yUZ}8b@fqu%?y5QHTwhfgi@<j#8uiOgw#J`~*wbwEobMEjreGR+(NPxaOrPeu
zjieo6GNk0zapxgB*bb*1aUP&`Y${y8rG9^9Yd4dCYV1<FXXgOggR!@Lqh)Xp5RM{L
zr(t`Q*&QVBpa_S!8md7`iqo{Dr$xrgvK0q^xdX@-b7y~8HY0^U#}ramJM&lJNYCw~
z4CqZU06COV#A(1VVt}EdsA0ea`NPP9VOrwoCEi8M|3%J7u6)%_FPTMemlj31KJkAK
zcJt}g=#?(S#X_sFuNF24zej??$QH#)`rzGCG1HhxC0-rAQlFUT3pl1~6FodOL14CY
z^Mc^~#JTM|!El%yG>mz{o(MNY%}g~%x{jrpww>_n<f^dy!Nd&OQ=FO(y=n?n=8+wK
z#G8Zk6aY=JqvVk3)9varCdl@4iB^9STeW3y94Ej_2{0qLHV+ndfq)M;rl1<!Hn@X^
zLl>YjVDxIz>4`RZ$LR~qd&FXy<T9H{{i?yP$pbiQBjGr2IeY*bgh^u-1K$2{KSmvn
zK}y(wTFY@5TtK3<FY{byOpPir0val%J#iu#6vqHM1PG&~hLz(woXVf0w0wWx4Ce5{
zjLgvwLup5WulX+x;#v>s+Pqt}Q;bx)qI(N(r*R1QASaMphk#B#M|vrt5Zd#><5n#3
zq(d$_tAV5>lx@-yCY`LujG?O#asar3_M_KKAWCLlq$nc3N`x6+Exl4|v|S$Ui%y9+
zV{T`f;n-)gtH%AJQzD$^mi~W_^C>25t9x1<MS$`OmBoi93loG-TB2v%AYDbNJrvyR
z<nA$9sc@tps07kW+Yq*)MWIt$n05Br1}{puwk6)eNFs3|L$K{ST=v+GMQ^LU)w6hb
z+0~?>nWAp8=Oyy3YAS!Mlg1MEYH${V6_{-UI>}?qE>>4*-JZ!pCq92B?I<p)*=IwI
z%n!Oqta{VSXX&7>vn$R6AAwa82^tzQv=yKxwT}jmg|uPD2lbIRAkwt-B8ht$AQA&g
zl0u}CO+6c(aR}pJGXjb0U)Z5*gD?kK`w`^|gPg1eq$sM3C?$Z+kxVVQ!4;b#N}4ig
zw5BrE7?j~f`#1#o#6W*9Nn;>zD8L(&4npC{VVq*pz*K2|z@B$eY&RANeAttI6ua>x
zmPQpi02Mk@M}i`6@>(Qwxnty(ps-}=7qyc7s^HI=-NWCCjwe3I(G32Yr*T$;vMZO?
zh7$ICAwvi1`XQ#f5xSq#mlO->G5a(?6tzkPi8`)XZ#yp@7z%#@06Bs92dsnO#{kPM
z!yg8o?T)Mz<K~{-M1Vl5Kt>M@;x$opJ`etN`0C*3<pE#JD6vi=Lrz2ZJitn)&7XNK
z=)M0JuVCg{puuM3h|Klc$x={?yGzdJNsh2Vwk}v^Q3^zSBfz57SyGqhfyV|HJW2<j
zNF&yn-T)d6$vA&#TL}V;ZGno2e4vTIffwM(?@!TA(;;D885RJA1Cj(a20ul}v3ni2
zjn;W25y%Uco3C>K>}PsNEwL&xqcI2E=%t?V8{eD0gjVZPBWo0Ex=qvc&?&ja8^+G?
ziocQrh?BbHg`a&KXn!gEDlq~evGPHA3q~LMs6KQ<D4&0TKAcO}j~X3fNZXc3j;i3J
zD(b-4M4P0^3@2*{zzIukc4}wGnyrzFqJORDhTZIi5>q=uGbw8Oi8aG0rS~-7wmH71
z7I0mIm-20t+;SP=joZl1^O=?0+%0`qCl@oR0<*{Rg9RbBbPvK^(ZskXtL&hO!m&V8
z$58iRM__+c9VE(1aA!c|pG!fA0`!j-p=aTJg<oq1hmb3XTh{^Y=y9R+)e&30Qsu2)
zJJh>v0+iVyiqf#eE`sUni@(-rrfsFgQd=+-TNcgl8OsC6Sk?94DO)V$q9KHTp?C&B
zX81cF79NE<A%D2=Cu#^{r%4GPq{<}Y;^<Qi5GsFStcHOZkBN;3H3ubLGzr+1($ATo
zI=V&ilQ4x_T-#7WqPI!*kjxoE@oIzyRV;y$I}n=^3#B`j0Jg+PrFzKFCgFiQfnt~R
z8JSKHeT@bNw`IMTGdlO$y|l@>*T%cI#ID?H_wrWdUPAx`TpS35CxIM29`&QN8g8Q2
znX7+jV9&XsX<@*i%!JN8q_#c^ykx~`nM!xYmW-vM6Lb0O3qV3ff*s4um0Q^rP<)kd
ze2{C@|0;0*RZ;<LrvLBB_OqRQ{MYu=osIwR!Pfs$XS$WB7m3!QV=+4%xB&4}c;6nj
z->}U|8HikpM!VDkbvW_Ak4%FthaxE7%G-bAH~%_dGl41Di4i6#fIh*|tfLf66PH4A
zqqM~vWCD8#uv1)VMqh-ew_scj%FY}e!6j*oV5X*iiP9$MZwcZWq`7e+9?DgqK}6Ve
z6d=Nr3cWo(6m_&lM<$$r5*Y|1bT|Q!$3hJOG-aBAY7o=(G_&R+A%pYenW0@K@56s$
zTjBukXJY&ejAawZand5D2t+#dCF-E=j)|5{tn>guJJTqZsA>pb#!xPe3qtWqaILEm
zgOF3553`0Cp&KQp4Hw{Bh5=xscKAJk_Woim?C8xqv?P*Gw8?@jBv~`<=pcUcLzT$E
z#&KmSisAq)8ep`y*^P?fTUv)Dgg$?^{Icf(%uA39g0aM8ayBJxR?P@p(-QlpSc>`7
z6F+yM^K6rW?H|1=6<?9m`pNic1px2|v{Id8r3Bcf7Rp+X+vN`3LEcV)>AqzK$;7~J
z8&X#yQxIUf)-4dUqS&O|NO=w7v_q6a2gJT_>S&bj0ZHVB!iH`OYN)R*XXt;z1C*r1
zY=Mff5~~pMpvY3E2<8v8Tx-pffEkgygf1NY{#5+7e{}fE!O1)E%l^xECyAAvb2!xO
z`k2mdGa9P$8}vilADnm0@^HvTz^O*QZS`hSiz;Hp4cdbMdrvxNsL+G6)7Vb_(lR0%
zN(}ad3B_vPH1T}1!BcUNlmUMT*(SSrqp1&d2;KiuIQ?Ww0>XsCd|ygr$|I4n7;<z9
z{ho<Wp&v^lROoS8j0!(3ic;BxsoY4I$|g=F8>hma_6lQE)`?I-$LWI6Db>ZMEEbuP
zTB%B+QYwx~StueUJK<T;D0;@#Mxs;`hq6i(N_O%Wb7x+4^hu?$CzXFio>UiiQgzhH
z(lICLEuI%|Qf;)!vau#rMVb`FnUuztq(V!+^4OAfB1_haE7=5=YywL*fhG4cu!NMd
zTyP2fTo7K8Qx{Pcp<fF_Oz2TQ$b^0`2s5Dvg@GoUNRyk7G?^7=vPhIkQrH3BMnsD`
z*Sbte1mZJ-G7Mc`I*otqGozLRkZmwzu)V##y#ycayYIvi{-@<ezd!{!NgXxd3BCV(
zPi%=7;y0*oGxUNWRBv<&?xw^QtFL421c&`d7ZGf0ZM>}v9&K&gpgSB2#hF)&_Bi7j
zLPsxu-9P%r!7FXGMf(ovbZHX=dRB9~oh5#u!yn0}m}k@^Xk~xXRa@7rwxPVw2`F$d
z6o34Ba3qf27^cvp-+wze-hcPzSp2bnB2IpP`}XzW!K>Xzq@JkDChZ7ER5YS@tpz1!
zY6OJQ`Vx{gnQl<O0No2;0dgkuHJB;YnUSAj>7)KP!^PjB&B)1|T#5sBLpHV5ra*yC
zx$MbmLFB>Zjmv-i{}fn|4Fe!pa}Ir=x*(ur^h$ivSeuIZR*B)QmvartPmH*Oz8qzQ
zCRw$m7f6>Q!3z`Puuv=^gDxz8%J_}CQk1L=#+HDJqm42%uE%!57}Waxj3rX30M0Q|
z`@3`7f64vTlMstp@?{clWpWM5F4yN6`9@I&-sgh%ayfr_MK6^n;uXG~H+nw8taOuK
zCgY<@m$WeT<mZf4D8oSuR>2S&Xa&@HhhgTPI&K8g2N({`VV&F2@A@*{r@MG=oJ3|k
zklL<qVHScKI<S%Wd^nMmkS`eihSf?$vrspQZlplxZ0sg8SKt0+Z;#gMyYKXG&&5^|
z<Nu1{A#Z;-4pLKq@s*X8I5X6M=tGJe;M)QcNVsi7@AIr?__yTynWv-lwe&IBgm`X3
zJU1bpn-I@Ui02)Lc+L&&MEspO7aKy0&b`_ml?Hf{kFgEBIUC)P4ebDHC))TkQ60o4
z;6|sW0Q?v+lZjJgLP;DKiz>qnIa5w+WG==lt=@kV&Y#xkiwrMN`4Fy9EtzQ!z9(kg
z>Egu;Z9k?D6R9}$Va}$Ud`XM2gYh0SZz)$>R|BXL6&HBtsSY=-Db*&yI`CYN3e0M0
zF3a{Cr2Y&)rl7k>H^&hHc0mXd-A-iYOey9>;d)lIxw^%i^ONK5Oq)@H+=w<AL~J$V
zlT?3OdRafp=_MSlI3SmorFSM7Sh2iq2wS^MaK<ND@k_ONF{{A~-I^*jO+2tUQ(Jf8
z(k;={RnEH+`O`8y%W4U2Ll;-5{k;<1-KZXn4l?DLyR<J1=ynRhK?cd(I&o6sv4!|M
zqqP!_&JIGukZs;;_#+Vwfi~;r2u_zvvloA{a}*)SZ>fnMG>OZ=5CT+dY<7W5(sXw>
zGErw((pvF(6lFDA(lxN@qQgIlVlGnT0$N$o)!NXB<8#?nQ3m8SCzY#V?3b@MoqXCj
zm;>L?5M!9cCd83yN%gi%B<cso&7F`Tx}4au(!^%X3((cA72kQv-)h{ZnPVSZn)QF#
zmHhgA&lFCqY=jHjZNXZgjhS{h<zOi$OWO#r(evk^Cg6`m`#3iwqGW4%zx0t$c36WD
zE@kv-Bwv=;MG6$O27&#RQx6qU*Thqt6PqF*zPGg8yQio4;zcoA<NavB3tPM9rJJ;3
z5<8Fe#j-@s-*r}+-ZfvWPvBxL*UW#?&g*o9opN59*B}=60D8$^zS%GeCAR23OH}yM
z+2s?WQ!{%Ch3A)18#&hWqYGf#Nua2no9#!JR0oD<Pii2XnM7ub(}AOzs8O16$}~80
z##uTjNYzfw`I(i8;4$M&YKMlhYeZGlQh_}#-BL8=1)^(oczWVO*2mGxTK<3X-acFd
z*w{sPy(lj|wFW<=C|a+zidQrVqA$-~)N?IyI7~aC4VnfiA?B!gOdS|vo&;nZ;Ll0y
z%C4#~b!ku8p}>ki+6U9s$<uqRlDKh_v#oL|>sv#-C`k7&Bo$r4{0qQ;#I1J&zlB8t
z)`NkZjsLjw4068G`CmV5J>7rcKi(?-qYw9n49ysOMFLuq(O$C1MUmIV>NbZbZ(4u*
zVQX7ZMFzImO(M(}$p%`cicF$eO;_cB`x<<25V_pt`adeNgR+mP(wpyat8T=(Nm!Rv
z1w5aH5R1Z9wQP?n)=wfCQBXQfhP|bvnW7dj2!n|ATg*yI=8DNT-7tR$;z&(7sr(7o
z8@|A$_aK%V@WCT_Ms+r{9`RTuZUN>v-X7$OXjtL^l;AcSrD$X|2wVdMbKefb;1Z03
zC~rdYNhoRI;=wtWkHz|Gx=RkeqD&|ZM5J(VrC6ct+$TquvTo`h*bF|fePFD8X__#3
z50$i>yps+n+vma}bRmB*!=`0-A=Yl<dA*j@#fUm$;^PMn1c9rlU1a<eWkp}44OPBi
z%K??Ni~?M-L<Bom%fhOd!i6r0)_AFj{bY~;E+%1+E`{(F02(Im7<BTYWBiWayg$u@
zK>ZqA>R3Ih0V&aIWgC|(GT&4T7RgLgVSjR?4%t!3B&upYaf5#z#@o7nY8lA4g|Q62
zL$zM8>K-}OjEF$mkb)4jGc18)1|r*qN4LopLCLDGCuFb=&eTKKiONyKKNPEQ<0R+{
z#sd$r3l-9)8Uq1Q_rTd~MI)xM@UZ<rV2KbMF6nYwV@oJIu^s6_rDvvOw8#+s{`mFH
z>jTcIWOpTm)lGlmRxqUdw54CxW-e%ql|P8*gB_!@53z+5t$G<uJV!WTFlM#Dzi=Um
zl=DALXBV}nEueg=XdtlAs)$swY%urqdaM064pw@p;e>h~)zut$b`-e-G9W|wvwUP6
z8FcZ0y~MYN?tnyM@ZV#HD#OOyZR0nE3|kytY^3q3u;PCRRg}cWrSsmb89`e(!aQnR
zw%_lg;yX)43#!OZcZjA16`)#(C75p~&uui{IL1^SU>(S-Vu~3_it~U!9P=odab^Z!
zY^OT#y4H;QUs^{&quR*+C?oENE?wA`PI4z}!jPYILdIj_{D5^2rhBM%HWiTD6N25*
zjb${p2NHir=uAMe2X7qmO^S6HhXGEI&lunR{uykk3-Se~i26Y*7z^pRF`tWQJPF-k
z5_wZ}g;AkmN;gje2+Hv)REcw$xeMwz`%dnPD2xy(e#yXyjxd$ENz0M4oa$;`Shy^|
zMY$kJ6-TLfF<RZg>Kr7hw`KtLsPCRlf(bGj(lCE7Il%;3MnpFPnQm#j(Qrm#Pq7?O
z3U+^L$X<Bu7?(209pNORBoh^Og;5w(0L>D;<Q$v6J&YJ^Qs`7{L|1g!A=MfL;dl~p
zRmI4>AQK~75YQCHp-XX7sw-ZK5gAhr+HlCkXeY7>T)_}2783<Jvnghf-t1oz5?zXB
z6iR<*CRj!r-}M#56}HshJrTt&FkAB8G81-3DrB~&7OAIb=v4~ZfF*;LCcI>4n~)lh
z4ggFkCW91|8cZ&$nEc~sD6oWQ6IRuEt<{hN%9*<aI~;gzk++P<&7iaGQ2^z;jsiQ3
ztaSD5#8(1?1N*Oei^MS8z}FJL@35>*`Hp|)yLw3@$+tLot6>sUs#A{$Bhz_6=snff
zA99*Ls2uu^!Pt3qD9!Ugt3b`8fB{W$%sv-7mK0ezHBMVhIY^`NB%TAYhD3&*(_=XT
z>EvHP*mbq|i;!PapQHteH4D7P7x~mob5){JR*n@DjGo5}FMW9{0!<t`;71|(1QLI7
zz^V=^94yYz?uU3~bPNg5jbLE|qB%?hQ(@ygCJGfUP8UhUK%p;_zRanv6n}<s3xUc{
zV$l!uIHy2NB|%YFqhp4FQRx`irs6=*RSN1i5dd6fK{G{5iDHW9XG%Pl8JAMUj4+is
zoQrqOkaremS%tA_S(&NPDHr!r*I|D)QHi7N{+!sJtHNN+&>37i(|2U-4hKoYb=Fm+
z*Ts4D(%KW2vxTa!9nk~pXOD=6oub6x^1)?nhbF#4%ov$2mB8_)t^BP7dJT&)DG{0t
z4_b#BD5A?vOYGx4TR>a%C34+M+f+X&W|CBoNc5=oqVh4F2c8p=!f1P(tPg*z*7San
zkG@zvD3Y4-npFY{no_e0^dLn5Gif6av7Ft^GGI=%cIqt?{@PT>r9Da>YN`6?iR(G(
zutJs}GDt!iZ={SQN%(N+GD^RxX+^KBW_`2ab6CkDnM!-=0U<~=4u6CA#!3I4Y|(Xw
zr8;3Cw!mspEp${veWx<SA3lF^@Ea1!#GAuT`ml5bR8YqXp`9!-EOX`T7JWLC^OO+9
z3Z3Oh1(;fXmJb_pt_1%rWBy+c25zSPe`jasY0m!t?CH}VH}?Mri~sgALq8hgY%$0;
zQcbxA`dqJs`0Zf-=!BHNOC!@D2mc1m5nl!_uRkX(ib{9)A#%e<@lJn1IlTs-EAV0k
z*VZ%95qr(F;i(iqj*;O^2)QO*#<TIxnhKkZUPJ^nL`gFN)Uc>C0;s6~tQ0C;4w4RY
zdDD0i3@1i@0`jrs6Dz<`yD&_g0n|1Zp$!LPZZ7Q_MWNw;lFh;vuMS?m-akHgC5{jN
zarova4UyKQ_Soc+_|bm}KTU(V!3{`ZNm^z?J36_7&?JHeB`ML5z@hgl93f>rdBib2
zAU1hH@DX2#tqhT9Ka`=zcrs2q#4%hD$;4+Hkm*S$Lp;Q9Go8^e{`mFa_@EGkP7@_G
zNojmhvPIEHIgZ_d8?ij|7*(#vFtEp$6!;A@eB8+$B}D4drl)`Tf_amL4<j5(?Fco6
zrgrURN(}AFboJ-Nl?YiAMKa7`tkET%inoF=Dw6X7vdyLR#TnRZwB}{-Ys+G<rC|OF
z;MW$#UZaUAxW<e(BjvnMQ4o2*0jKxtC&)Lzpyq@&2s{RwmXgq6{%Y;A9t>qMbWM1+
zjpKOZINmspO~-%ne7Er`PUDT&c;hwRc#T)~8sCxIxN@iQk}l&%dH?1KkbfNy!R&PR
z^fQ%W%xEF_Jw_DQ=)GDdzEttLB-<Ryu#Ygn8$Z@%*{R*X@Z%ZHwA<nsv$FMVd@0qb
zV|jtjI3$LR?Jy!X!QurU1XS)W-H7vm`V!GdGvWHlX`+AIGBOkdBhFNVqa4{s^;dvS
zjlI^@R3LT~7q6oxU$Q4q@;<8LHBf#FWVR>&n%bhj?1!N}wcH5*mzvF{r@cQ-Z%!m7
zoG4#j0)pI6)aG;A9z<fK*HA_Qt0K0^O&Vl@&-V<ffCLoyk#{@E9Doij+i~jV(<Cpz
zNGE@9Sr&i1eQHHP7}p!-ZMcbrs2~>NHew(W;>5P*G7I7_dpWj+q76Q5BuS67V0+o~
z#4j5%R>EzleJ0Mx@}z$jpCjdN%@|uMzTC1bVxyQ@LjQFQ*&^4CrhXyS{By)gx=M+C
z9Ui^$<+VxSo0yRY95Zq=u_8!+MERQH9h3YEk8giM`^iTcQa1&r6i$pC0-@@QW{<BA
zXf0`skEP1KfN!kvBs#B?#J%_JRrcNMUc*EnF&~?X5g(tTmhpv5%f_eHe+I5!uQh88
zqbmhqgU!$jyR}9UV9h25XA^@{e4a~UZyt%I9F7SZ!eZ|~DgmJ?XD(_q4ZPZByr_ne
zItPE7=$;1<-7_<)=aCSL2lf<Wb7b|}N3&vkZt-f$yq~^($j<{;Knp2Ga}Q!EkqQ1l
zS*2j)=Ol5md7`aSCz5l-MI0p1H57hhfaoU{Q!$hh-7N%O;BxtTHJ8FmmS{8!+mTiB
zcXPO%{9Q)pA_EnvRgl4`EG3=1r6enDZbE;uzSxkg)dI4X2*+9=7;8o-)+QEf*;uTl
zVz5?@z*;u`YUSvwWn-_5>t>KO4i{aAxEPii6*wH>Z!_C_H>>5R+imLG#TUu>FSO^=
znYT$xWF|*iv>PJ;rLMC=KrXgB;<9TbuqW3)a-tH~g7rv)g5(aSLib3o4BBjS*7ASv
zzAKYyXRVoZ*wm3d?lUCKbbI{0+HZQuR`3UyPXA!z|3I~Dv&RGCwv<L{q0V`O@qgPt
zKHYkfi~oD}!`3GL?_tLOQIs2p>(C8d^8-hA=$AII^a0cw;1^?56qDEBZ{sQW0I$S9
zBj6<Ga%4BfaWIMHZ%Wy_=5H+vV_1Iy_%iU@U?u%z#Zl7Gm8v`|kICts{j%tj@ucs$
z1JxInFUtIMY+q&@qBqR;R2&>VF@gojdi2keU6wFH8?U~}AfAK-5k>ANXdpH1_osNX
z90iWVC4vf4?s$x-sR6_ak~IZAVes6+Kq&NH!H(Myfr5a2s<3U7<c=`{A^Lw9>Jbjw
zYRN3n;@K9MS(3e?6|tk_D$k62*YJN0UEg^#W;LuHsQ)^2)WzTEWOh5b@AcdH5m?Y}
zy{_y54YBuJ8wV_xbS0xRyz_}Tt>9xajHc+xPh+~w)y}DLe0yayz_vve8}x&;ukX)^
z45x2HcpAGhDw{28pzMBY8f1U}JT-N(SH5=Xu~;19@xsCZys*Z42mqgTb)Bs!K{he!
zv}lk`1>?IXcDA+}9b=59t7oN=Qs2=F>-`D#Ri~~Rr!TCCdeEqq*N>PU-@Ju-35Rcv
zPP%^_zWcTN<}LiO|GN9~&C$`pOZcOEc=Y!7cVM-CBt#9uuSh105V3!!b|(4n-(+lq
z`b9s(dt44szej)5pOLh~!8yP2T7CkbVZoCVIkNrO9TYtJb=nVIM>qbn7xZh*M{q)b
z2i9w3X~4L&mOY8jgAlDLs6`~?PbgiH2*w0dDUw^f>#DFfj%4VPFMJ@o(66ZD(YQ*x
zcwNMrU3gj3fRsR8KpKBpYIhY3Wpd8&RVy{vrs#cp<vQ1@<^fDBJ)Pd{X3{g9)m-{b
zDs<ROpfZm*`b-B{GWMsVVw)(Qj`2aE#++JxvVljIu_*f6>{)P~M(%v-mtVYKFN-<b
zzo^F+#!5Oes@GBr1Q^mZ>-5sn8iXj=>%rz%b4L3a>dEz!S<!#;{;nTgH#Ci_xHH!@
z$P+#$RRPFTv*Si%&z^R{E}J4^_8b$Z*vs;=)WJ8L$5@18k3Tc{;|mLz!3zsVlfENd
z47)d51ZGHcR_Rd`Yz5!e8u_nN{bUY7YEf`_sfIKAJ*RDRwdOXRTG~v@6zWkj^vuD-
zcjxs5A)5o6s)>J=o=H{3BcT{J(rRK+KJ6t41p|qo6~4DX5<4fO+Ei#Zk8K#YfU%<q
zs&8nvlc%}l&d98$`Q3||#K7}qvR<4L%6rI=#EcGR(Zk#sWSQ{-GbyBi^!C#YDi|nw
zaZUjlDjwa^?TGK>_Br3cvu?uoB{zNPJzspwpQbNL<~n~FdU2h`Ob(RiL43o_;68aK
zKac-#o9AvkgWMKqHce+`t(tEwKGu?(zHH3p*L~_XN}qj}$#h$`AXQ2S#&nYv5l^@N
zuF>!35tJcGCX!!<Kng@>Ekr5S!yIrgD?QhqZvDNMlO5C>X|X7o9Lzwy(@XUvp~!fS
z$5};JCcb}~?b-NVcMiR!27oW=CCpHQ1n-lAKsK7okcK0XK%%(Guhxq8s-~W1he8E~
z99i;NkHC*-%q}$?T{qrnBg)U81uaqddM~r%aX5v#9Ad9@5%8TZL>=b$pT902L-O&g
z_16uhI;I%p%<`visLZ-2z0t=U@`%}Rc2@9D);@oAVo|ujFf_Usv|a>7>@b8z(HBe>
zg!iHCw_IO&A5~^5{1MJOxFptO703czah7^GQ$d`eA}+xniZ-o~MW_u)#Q+#Pgc~wr
z5!FQ+F*0+(sVUpINUAI`)_@{Bep-(*%Ay;bJ2LB`WQZ%L3H0qqf=gNKWo>`;+5ijH
zyq$kU=hE3{-5OVs->5ZtwfliH?dYgw+kBNvqeUI24ET5TC@F0O8fO%BM_|>&qY%43
ztd2eh7|k{b$3X;#9^X2T<8jn!x5v(SY&r6x&ClCo8Ah-$+;^%C3V8#Za@R51fMBmE
z4yTrGOy7o4I~oVEJDk><jK`g*c{OpJYMg&ay(8XVaq+ZT9E`hm7(=<=T2oxO@)97_
z?Z_R}#PzB9F<h8MvjXv?MeAeCME9%P7<f<xwu{s90{;y9;t%lUYf~t7q#Pe0&8wYn
ziYpO(B#3Kq-4r!jQ5#mt2}W+5rY<=1`zHbmv`lcF8@rEEB|KtIo!rn=MKooue@B13
zuMJ$kYxf7W)8>OAH-j#66sL=esCkNW+lSg!#9S2-rRdC)XZB$FG7&B}#8wfprLGM4
zhKa3^*6xzH=<d!Ef)#vhs+t8gdZ-y%fw>RvWQ>yKED{X+1zM!*JEK`IXg4P1Nk*C^
zMI4+_yfj8@>58{@q{oJC{U~dLF>QY<b*e8Po>643?TBcCu}lppB?JKwY`;wzW&@vV
z#}HBo4jKb-Z1!&%rQtCy4=uSU1-THnF~s7-kW%LQXVeVfUU)A4KuHE1@55FL&z{PV
zD)WqGIC5jo{f5$^R$6F8gKi=>mJ^?%m8;?fpY>(|AurZOMw(=EN&%lqiMD^5J3zFa
z3?n$PDUQ++wV$OOLL8oP3L#f&gfFW&kIXq!FXEE%kx0w33A3f4X8CN7R{Ptlf1bQK
zvdC5C4ySeexpA$CNKMbw{WtL+D*i*oRkjTDlJ&zs=HNeV?>yVd#eY26+S$Z^d>!#0
zSIF*vaXoo5^#?kb0zVl>i^hM6Tp=LR@5is-1#bcVBGt?!^dJgDy$W?Ii%VDn>nW@a
z0}qUJ^rEts#^Y=`%jTm@h=@j7GlN8u`kLHo9isX|*O5_2yai@ydp{NT|6J@r@?crj
zO*2`9xxP{I+$hW3<ST(=7&~ICsV@mt@)rE>%|}KlGV`Z`qT#v`u1bGyzHV8To@0{v
zNLSJ?zrTLnJv{o?!O^=n$Nw&?6bcg;x$2gke2w|*UDfc<uiw1<kM7Gizx{S_1W^I)
z5A6?+-+zccoSZ&>@!|1@cKd9XUwwUebYQ;ue|?A^e`tSbTaUkOpN-U8hrhjjbNsIR
z9|!;b<IV9aY_U(Y_Mv~@RxceN{Ey!cj}N*p_g}xJSJ>4GP1f653gbeU28s>_34_tk
zo>QQcv(WM-j8lSF?m{gq=c>u@Dz*Px&1B=Z#C4;Y*{Mb|Q-2BTOQp&$71vEuGO!_%
zmJ~8prKSeC1lM#a<2C0!e`*D#rE;~R3a7<q!OSuO1hJw*wOoJtvS1z7-d24guZ-%n
zV;WO;;%kd^O<XUs(M79KQ0%s7LHxpU>Nm13IKCxme%mB^_@j`|Jt<tIN2XR?uvGIG
zi?W1rB&2H{7BT~@sp|(mm)Hd+62(w(m4;9OOVF3Z)178&wVv+WI9o8##;8^#Rc%#k
zl7Xf}z0{~fKN){BK!ce0Tp*Mk`B9bYvXxmDlZc+)JnKwK@NxzW+SJkUoK*Nu>i4-u
zrjcLO5z=e%V|FcY`d4OA)64}9>6w14PFONxbtKfuTDqoZcAZK~*HUz@kEwh{=~^yk
zYm{y`iS6cBu9=qJm=)D#FrT%TC{=h_U9zwwS|HJ9&5?i67!sPYrFUDLL8cBNZfDja
zWLELT7a~dn%p6jLXxz=5@l*z)szXlM>&CV*4i{x2E3(sdMb#=;>mUAS&CCsQa|gcN
z7XSPI{h#!I;#i@+wzO*#vc@{8Lf1t#m0eWvN~?NjiGW;#2md-aR@XCOx>38>l;%Ii
zt(}xHWypUHb1-#<@d=4i7qWrD>c{d7m^Gnju)IfjCzvn!@1y;nq0IKY;@r@bQBZwv
zM>FHS?FQv+A~ta-TSNDg2ts?{NzT~Q7_d>`NrKT-Wx3;Y4d`>*Q8l@fJ-N02d-TXK
zKbmECG4R<COlc1(@;IX?QJAuCkE8P-?vfhQ4ds78x-5;<@(T=6%K{T#eF(P)l19$a
zGigrU)CpOjh?1tN1mGplniLFWA`NnOq_O_>Z?Dw6uNys+yOc5G#n^F)x@;c!?eu})
zF(t;-WmkCJssB<kp}OA0N=2*5x=C0L1@dBcOGtPs*p3{!N#QLwgXl`hu9)!VkX{+_
z36Xy#zZ>7}o$}q@sb;qqD>YscU7>6MEd863KS{&rB}rz$?j9lsjK<P6mqCn$9j0uA
zGGXbfCy0!&pSP0SEkQu6wRBX;d9C(zC`C-Eor2X)KKQ{T4sHKqBxdsQH6&iO1$wEI
zHJW9h%or)R&0ozknO^bCt3}3-U~K<6k==ix?Rt|?8jdM*KZ=x<0xDEnF;50BQ2GmG
z@Y4Oun46NULX9HJ+OIz9h@u<2AtF$r2v(8KQoLnE{EM&JQWldUV_UJgB!dnFyvq+5
zZb~z$DR`Ap4{j-Om9g+dH1#3v2Q#n$Jjj!=tjM;S=nSkRTwO0@TPvwRpPTtiqcMM$
z9f;VIj!ty2u2Qju1mQ_7&__AFq`2j*-loW_XJ}z@8XpI6vp_XGJW*J;q-rPtd}<4)
zw983TgoG5yK>*?WhS{G{jooNqV={>CX(O;zx#cEf{wv#~WtF$Jhgo7&S&VuLq{m|N
z;e(T4=};sFYH5+;NaG-)L^y4VcN2e#Lhs`G#`r7Ub62B10+PjKOq{MJ7TS|+BW2U}
z06dnmlN9T8q#ul2pY>(JuA@j7Vx(+H03`;zIK|>J2}Vi#d!oeZ%<#fT_7ODc<6p}X
zj_&5Bd>MuAQjDgGxW>YNvegwrWC%h26Qvd!7=>X%RFMj;&XWrTMHTiq+iQOVRFIFZ
zn$u9m?Nw~P!Btzj=`vz=z<3iXN?xt)%th=6aW``rmrlaiR*H>hDl!lY7;k@yMVvZW
zFlANYh)bP7JUCc*RB&8AR}<s@FsCF50jQ@u`E`J#{{8rMJ?A?&OYGE|+_yE7v29I4
zuhD3V+9V$S&CK=0<c>X65Ga3?W6vJQddeZ(6t!AIKQbM__$0R*Y3DD-%haKpMiQuJ
z4wUmPC=x-H6e7HQx-E|noBF>a8D7Y+pi|SCT-c=_h?j_j@y`>Leq769d8^&Ql%#PO
z@E+C9yr6G;fYu0q0jxRv?{9W|ZiTk*1S9x!DC5C-lCzW=9gHQ(ALf5<lEL-z>p_8v
zs$A8#SNzTOCQR$D;=i&50M`ivn~ndo^W=wT+4!#?e%StD6aTe||GKgGuQIqi9mtiz
ztApPQ0Oj!KQm8X{S_XXDRLHD3z_rDK#fXK!JN)h7RfocXGeDslEc}{7r1CG+fb>xS
zi7`Hk+Wh@!W~+$sQr>?iJ=Oy}IXrrK(EaD{M+bQbz&(YU-x0N)t(_lQTR*h6w%=`S
zb@2cGPh(7~nb-ebq?sS{%{+|IFFygGPXKEb0U<abhR%@?jfP!(EkcVexiDwBq3L!m
zh2n*_8%^vYFL9K9h1%w_-{=hk3vM%058?f(FxpH<37K_WsN#PDM)b3ak*X{J0Nw_W
zvM%kCujsPES|u~^081;L$jGs$wUU7kvNc7hmPo2_hf(PxSLUNYa)w0g86b;uPF8No
zYkd&v?Aj^omz+R3x06gOHngIeY8ty-GzuYVML92ke%ll^T@IxkO00YV`-_z_uwsMl
zIO>!bGGuYFlT3e}i#}tCvoTdtC0$S=YwFrBEHB~4k@SW|RVH?IZ3q+98>>c8gHUlU
z4glNJD4KyL1hVm3k8<L5>5lLbPQbGB%Ugo-NsJ|7*IBI)yys3MTj}HQ=wJJ<4`1!S
zJ2;^t8nocrW}PZTP*8hU;~Nu#2bHnYwF2hzvXaRp)5w2Jsn`y%L@Tdn==>DqT-?^&
zo31IAKC++iw35ZfFy7PvlL|=<i!mv{bF#%i^@m;FDyr&0o1`~F)j<|+oQK{~U+9en
z(ueeLqZEU#7RQAplByDg+sVj?%U75vEH9x_xRM$Z77DSdfCd@1V0EwtK~X7*1QMPa
zGm7w9D-eH9epk1jr8d6kpbZ+Sx_=DjLQ9Q6!L-P1l1@DQ2`2sAda>x$$hJjflUV)T
zEdNXMp#p$qbLuQeCj2OY8#YZcXfNC=2e2jsLjqZCbYVQ<>@)5&4N9E<MyH`gA6?Ij
zY9;BH3IN(2S%nD81!u1a7MjX@Yjk%6cTWeZ8^wRB(-#Pz!Tid@kkZK1g{zzn2<2)S
zoJ*ic#GnkbuyY<dpM6Bw`|4z&iNd_1Zh{t;qy&mFE2V{5WKeRi&?jkV>?V3W2Xe23
z$=6b~xUd9#lqtJau&=hK3*D!0TZm8f9Mjte_>B6nr}jDUi{SKD-jmn=zS})1xusXy
zl%#*Klj&PeHs;mgD>a|o?i5ua$(0i^iY2QOpfR%MAOs#!urJswnEy*O;*78WHKbc8
z-|sGRV0G&$HeM=J&S|2c0b_~$pn%utdgM{M;EEk-9eFtxL;`N^PFi?6^nKyi8Mg^L
zODN{bMn?(dbRD+eK*;#8dPhjsT07exLaBdu<=&6<^VM7+G@+CeBt6I?N612+js;sL
zmjaqupt_fCf8$D6!2XXVuPXBb%(VY+J^k^?)2#jf#~-)0H}?Op8voz4*3UMvzdHD3
z|M%DLy2l4E502h-e?2?_w|4i{{=ZL}nD>m)bw@zbIV1eyruL&Ze?Y}?k`VsZ+WLRH
zmJqBhkP=LMT2M95U6ACaI#<=PryOVP$e}&)V!ZuljJ*)rn6CF3Q>tGnI2;-Wnih`U
z{81b=!qQLPfWEzznO>3jHEZF;ldT+VuemHx&@W5}mg*I%Xy#35G3tmPS6PC;wYGMO
zmLMhCL3(8p_>`Lm+)!R5`u5->>@|N0+qm~BOZ7Nq9Xy*vv%-efS%|GFX~A3w&(r(L
z<I>IwQCE^uLt9qKbrJNzYF{qIEi^;Qd7xR9xgloQOPB6rhUhn#L~$@ei?B>e|JmYF
zdR~h|y~t%jRg)9>e8p|%xMGEVh27VhneE%2XGH`UD^PJR?Pxsof=f^lNDY5Gdh<ud
z`Y@MRR_d*A8HsJCz@D<C)g)Jr(qpw*U;2Z<nd#P9Xxn)~bJUd|tAj-kfEkd>wcYn@
z|6^+I5OIx`74zUnl(}hy0-|}y2`+uob}A-}lD$9|+|wOWtv>pQqot~YFG&nVJ>+(n
zZvxCX!LhZFh*}`5U)Ua22|j-h+<}aib&7Gzt8vFCDfY<558B`b8!S13g&Z`;h!@~h
z0}7*>@eYlkv4omaEdS$<w#aht`e&;8$cp8_X5&9Sfz;Tv{J*pH4F7i{|8L~~D<w1i
z?kg)1$?j0A>ijSQ9BS8p6Cx{Ws)Kqk9KsQ~kOzJkcpi9f$Tn7`z^{MeWlr86ygdBn
z@Zc3%-k2Fod`@e?s9T+lroQ^)@YTU__ua4iN8OWy<9{6-ci-;6dv|br1OX!C4NFQx
zV;E?@mTlV@!pk>r4_<ZmU%%F3xY3@z8b8!+&ug))_Mw5oN)msfu3LzCPQrSV_=!$R
zgmoi9g1^p@@eP1U5dD9k^#U%fYMbuO+bnHbzHot^8VgN#k{?`lV4K)#jH~oY+o2W8
zRDt5cBd}BicHV%WTyEKSp;D&$O{#%6ONg|NGGk%8Gd@^J2&d_r(b#D6YVz`#`<V$b
z>X0&qe!!MnDvdfzZ<sy{YKm|*Qhm^w&Tch9C3~!}&l%ywNo{{0|77gmLc>{Zy$}A6
zx33Rh9=?11Z)52}AL122Y0_N!V!QTwM`p$jP@vw8A0)ZVA<9eG1{YNet1)FGNdJmm
zf56v=X-lxtNrNwTM7oj0_(Bp@GyRo{gecervz=RIUR;HPhq>>0_lOYuAbzC}o3TQv
zy*7V0_S=|I>UDqfcm4Y8<Col0`UGO0tnRmCT&3Sf25yY&8~L<%cU@&!(6b^IG=tAA
zc*GX!CcV_WoNT*@F<EN}Q8>H@Iu0|*3ygH!PgW0SQidVl)B9whrb_rB{{K8T)brM{
zP&YXBAMa-BYHAA!Rk@deTJ?`J$o0o1$@S-hU)~%a<S2jj_~4%hFW()!0!js8+sB(5
z0}(xYbZd9;O!L|8ZC(Br&&5ulrLC^sgk?)m6I7l7WX-`Z&2r_YaHmoU`I^fh;13tM
z#}x2n2b*PEcx$^>8eDOgo0VT#1H^@eA@nk2rO^B`>)Y{87kY8Y<X%z#EN#4Sn<!3K
zMlk}MqV|8ScLJX+b+_IM#kbFck!(-ekm`w*Fxt_iztjPk*P!x4+>ZLb#0<-~Fqp)+
zc^t5m-oX3BuTpahz~%#RC+Lp5vn?#=Vz`2sy5pk5c>n0-0URn(Cy3An#F;0;{md0-
zAEa@Z1{5AH9Z`R~4H5DTHrOZ%Q<t9rPq9D6v=4t&Iw`E)X~htn7D_5kWGfXUfVgz!
zprX-IV~!hQjgD!0?1_yJC!qtG`qIRjs1cK>QB!VgiQ|dSO#-G5b8{M+?aj4`g0GF*
zf;e%2`tX7Qeh2nE41K4xB_1mnUI8f4!TcQSE@(G)M{OqAXnmSBTWeni;YSSDY*E3U
zm8gICRs^Ti!N?qd?<4V#<Nc#oZ}*QOfw6vh9(Yo~Y!ljR+)us~yQBNKrE>&V&P~e*
zuEvf;cQ3Y9s3+bu@7J0#upM6t`xD^x+CD;KgtmhzL-DynU&c$U!?mA2sp4t|hOIYc
zp()GOwN9vetYdOsqltMMDJMQ|SS0Ehle&N6os`OPiK#{Aag^lpBFt!*3=?KUw4T#I
zDTCE|INLu@+HT%Fg(Q2ecP?^A6EC)X8B8LA!c#3&dBhllF1OPB`{L`}TwLfh%EaBn
z-C^-t<*&WM3r0+Qm9hf4cq}{URA|12sMzbk$kEfW29Hp<fxKF%w-B;C0}|Hvy0U+q
zbRY;QbU$@iylUa4n238Qu|Z3C5jQcvQTmPzc7Lb=$1)+Oc{{=h;<gjSP7pUC0~o4+
zLI$#DV~ii*iUZG(P|*xPz%b5FhL;lj=aHonU-O>n4$F=>44}+Qd|Do(RM1Af*0$UI
zHkO#@|7xTce@6GjgN*sFHHc&gZD)V^K|oPDa6u;$JSR8Ocy!gix7$kAM)0t;7OPgC
zxI6djS}{ge@f3-uw3G!wU(vbExs^(E28eM0ZAd1){N&&k;n|@9Dw2ax#?cBBHCn=p
zbeZ`YXQyZNL?qAP6cZ$c>&q}+Yho7u(YBBeE>35uL7AgsRxkQ;7=#jmJnetbMcJE$
z3mFXnr%r=iue~pA%Yy%t@t_T)eCbrMLC_$!{b`9sQS3}yz&bETi^kFedX0E3B!H@`
z<sxmlKUJCvL@6%09?UDU+-kv3=>TR<@7xnu!kv+=jNDJs5p9e<{P2O(`SMd=c9tJL
zR4`3wWQlni2r!}!Shm1hl(2sZ77WA!)~N4LF3Fz<cv3h*qCA~Ll_I!J2Gy65{{^8G
zZ6_E+?KA0PCaUGETlaIZ{I9K@?QHz#_LFB%wl?vfxAE_rzqBV&*zUW2TlyCQA}}Ax
zPZ)X0nvKwPDHUbB3I<WVp){c|n8Z+_lJ1CI29RYe$K!&BgCO|W51@Z|uln_R!$<DL
z`G*>O_SmhO1<XGGJ3G&E_>WI_o^J3T@9g}mz-+)lyb}M6AkhGepBur`14NfK!=@2I
z2P(FUH)HAVkKMOW^;<%q5HSkZ$Et4ec};v4H7v|sBaQ&+##sh}ncEJS^a3cew#(>B
zFpiEfCMa=}>-jh7xb}a$DHpy~pS_s-9Tz?SIdG;)b@W&Qjxv=%|B1%f%ysm<bl8R6
zU<G=a?&HOxoe)IRm;g023(a@)W~@;6sh>doedweYd#pAp>g4wB{b@2YUYZx3g7s2w
z(afT<xu~i0RHDgfgb~QBV0=c{k|DU`=!Mumi#iC3fB+iw8jOFbV7~9{GjUbELU}?f
zXya8dn4lF(ZOv#L_@D}PjQTA^PWd?|)Wy@g-etlc2Ilv%8+#dghkt-#k{j{N>2UkZ
zwzHcWpXY~Iyepbgo<BF2Jy};;@p*CqzhA!+4F0TZ(TVF99nA&Ok6xH(rP0Z5#IEY~
zY9l1v<oyrHFlm4Bzars(-u?e{`{}dooczDNx&QC({;xhKtlbvB+2KbAi-G6@l|XNb
zc?2O8dxRGcMgTGfm7V>88%feH(3STItv0qm(Lt*bP2q$t)HT!b7?3GSCVxUWi^xen
zMjsKpfIQ~yp|Hc)9omC9vc&!w+6M==FU~?arV^omzXN|pFSPlqDkI!ITBIXgEGLAZ
zpGdZ(f9Cp<f<9>Eh=$K|dozj0leh!_DMZUyigchw`XoB-<ULZhtdX;96FBIWS~F;%
zRLpA%)Y^Vi_;9nOK9!|6p7cF;@S9$80D(;ZbZlRmZPC-hw)CV@&E<d1w5VT5W%F_9
zj_1ZQv^{?V_HHuvB-yE>IGhaPNoaczJ`+XmnUDB=agbgLxCVi)+%OD6c4t9eNQ8lV
z!m`>5eikYls6w-h2L(b5hG~p&$sLQ6_p%GOSF~<8eHMapLsH4lxkcM6S+kj~J<|93
zNXF-Z^Rw-o$vXYF5-}QDV!J|wm3R{RqWAdmw^x7k-u2_hJuE({+Zu-;e#X<+t}mnd
zxwIkkUA59wk6k%as%j>--P}mtpBlbh4|*}4?1}f>B_LRxW(r}v2eGipV%;ftD&HVB
zg~dtx^<;DnRqz6Pu*Q?<yxwbx54~@%ppokjJ@M_89^|$7_DTV&(iG~{Nkdn*NVUY^
zTD*Ur_#nNCO260#6jUEA_z|tBXZNL-tmlOtx;BcfdZUwde1B>R+QloVdODFvM|IVp
z`21PCKV^upkv*=fCumRR|F+cEskaHcwO&^b@eB2b<w^f6J{Ql$7OsIi6m@e9>iOQ@
zp4d{Gzzan>%5}1G@4;k^E7BB}Wu@A|F{giq&})fruk<+ZIqW4pGj_Juu>Lb}{d!IO
zRn%YyPxG6@+7RtYKX9fUaTNGR6VC&N@>BY-)%c6r>GStBco{LX=TSJU%wOQ`(p4xu
z1GR6y`9`qPCa^;|4o#XR{B5x=in{aX&!UDvg#<9#{?91zYp@QdYJ>0-R<14Mknn%N
zmN{ZZQ&z!o%aSFKr1?pP;F9VyxRXkiDm}Ex{)-o)mQY@!COV>4yI$&03$FZV^kxuY
z{^-_@Ro}MptW#?WbB2L0-wYev!NN`N$ACB(#Ta&^trMB1ZGWnoz82DpByR407}`_I
zjqrcdTg_wPy~&Nz8V2EkjbV?(51M}@z8STcnT!>`$kR?j*lP2xQ-rYCg(3DtzKa5C
zz(ZgxpZNBQ1kS&T?dwiY6VRHMMll_iFwGJgzC9{VmV9Ay6QY!s)httVyj0Vrw5*yo
z=vW0VEqlQ#>F|||ZP%l&N1e2gw2l<g`{o<*?bXO~o$H>#djXIZ<tBUxrW=3YvszYx
zvof;SSXLl`=w}+AGr0!-6nkQ1@lEr>LOtL`<}^V2e-^ZBSyozZ!wckpp#GB>4QoyD
zr?DoD%mBve0pNF0(Fn#1j{qzDqy{i996+A9QunhlD&S$cCQQPio0F}ZHNDOzLjXmu
z2>}&@B6a|s@#k>BudZi^lF)xrfhY-0TZS<Z+NtA@badg=|MTR{5nb(g=2sOowd(vX
zVA?0`9k8YJvrefNfn}6TD<}NmN!v014sa3?Ml7mnzDSoXx_*?_G#HLT2YBqMMy%vF
z5L-S>cDA;k)^=wfMe*$w4)QvE(qNngdjmhG&X>8KpT%!@fW>Db&d+}$vA%y6Cv-Z+
z=UR@gKDYSa=hXjX{`+%|+D1TPdM6r*D*@KW9!k~ap20bAX^i5A?GK;Zpb&ld!0o4L
z@v~6s9IJrLq#D=avmma;oJ#-gI`r4KSH>8w#phW>ICoO%Q(VZQ3s1jE-7L9(@Da4n
zAoRjJ&~y|Ps!E9<&X<2?S`@F<)EM9$7L8KH=#|P$^M=JU-vZ`e&;o#jXB&Xu%<tiE
zrKWraHN|L(I)jMkv~0(pf>oj+UI^n)Zs~KaAv)&oq#O8C<An9yICH>aeWLhF2p_Zc
z62J#cY4o5Y^epHHgLgqI&@o`*(<>v_cSn;EDugwvjaw^ddIW!7N8K)eG`nH@(?Si~
zpUj5oqfEp6&|um5h6>)v5HP;WTl(MspU6@$-smscuvag%%)F=K6yJa$_ie^}%5m#8
z^}m2FB0t$9G>-M97hH<i4$mazlaXl(kW+%tX|W}ALM}8r7QObxcAE?Mwk^x*S>j#r
z5ppKL%=WXiLm7W^HCPeT1Bze6%0D=|vk*i%@e;x_;cgTE{lESu>c^51(oZO-;!rv6
zFvv}XjFapR424HF^<(>!Xk{YLdt`}t{}bX$K0ob=cJ8<L!T7YtM&71b!=T01<{owd
z6;aQi_#J#4_0T}gPvobu0IWb$zwJ9cs@4Vr=y~qQjk}C6&=Z$`b_g-*mVi>LdOt*T
zuFCa9Bir*NmaPpjqJ99W+b}(856)?DyPR+0QW6;0pcy&rzyH_Ynz(pp5Q6VVR(7Yq
z`9{2QBMi`=iaH3@(RmOzvaj|2aqv#yz9Oaen5Yyk|A71g0Ttz8l>Q4B!l0!>z3tP+
zyFTPKyZ#wkLrEBavc#K9ABIfSP#*{0bO<q-BPeJqfbOWD0A6dUhLc_uzH(3h)ODSn
z)(>_CrF^LlA}Iw*EL?#eC=~_<e=_O)9!Zgz^b5#3*uyZ<LEOVF!1h{lICKY8;}{$W
zSdbnUl(v0VGv86~dq08p_M969Iz5;67!n>@yqGN9MX?-ztGH#PFmy5CL5wW%h6+53
z9(0lH5j2QcY!RFGNvVWSd%T}bCfJ@y<xvw(g!G*5z#iLu*K<Kqhj)prvp?fxhoOwl
zeHlf)9If?wz4JI8t3T7rqFE0e<NxAXA<Qm*!kzC1VV8EYi!1-!XgS*%Y#=f#8MX*I
zwqP#C=^uK3_E{wAJ<QPHvkX%;&o=z+$xpyPx{<WQ!8!aA$&u~H?!frTK06EL8BU?s
zfCJ!3JM_inxjQ)L@>NvA&Ulg7BUP-^$D2m3{7Z4@+Fr}{ot8xB!_%#;$P#Z8Dk<hi
zZS}j^oAEO<DdD+Mtb8GG`XrMRj0U(444Ry1=ut?2*O&s5%kB6tz!Au)hDQ{cpL8hN
z<x?#B6X#6EO|wBh7>eLAmwG8eDm-5!8AbM)jH;%xcgBdJU-41Oailn)i=NPU+7vxx
zE7IvQgTftX^7g{n*Y^t~2u|_7!7BrJxzHp#Wiq`y2d88J`-2R?zBK3@wLg|y`(Ds5
zWcmkxn21Cql6`DGi?B@1l-XsVZrT6BJjQX$lNS>BitX8q&>UIfcLES@iiw}R-lQrv
zP({Lc8L3T`?p&B*uxt?r<1Tn_qd00a4}8HlI4tSu-v0PpeiH94A+cuGzK@+hX{)<-
zf3UstWX6Vr1puoaauK?E;G5Oba8|k7lfIyT&?^MI*9RS!70wqghi-@}Hx-{}zNwhV
zptcJ@MqA=Ud#80*9nm|BC9tHk7`Yey;l(|Wu4Fg>;qlz|9T4;&5b8{Z0Ko?WFJL0a
zlIRfrtCiFUiz?hI&O)4wp${lSeER+@mZy6~VB+6l5zsw58qD6JU$ALFP>^7Fxv;%|
za)E}JcIKwWAKQwv_c(<#fuL5BqGeeiA(DuR9#xnda#BtM_Bmyd{4IFYDGLw}l@vW*
zq8?DhL|Q5GGP&_W1cU6ETKqmLCZAn!RcDC@4rflrivumn(9AV`sl)3Vq_!|g;M%_U
zbI<iJ0N|ThboBmIbLsDRbpe~vy~q=P#nTMJd_`ybM2T9#7&dPLR=QA*338*C3{wef
zb-3M>EUTWYrwtJ4Q7FgCi;7_At<xSZIR9n}t*5=jrnxHyVGu>FM9x)1JGaMURH!C#
zFtTG1NW7`ek0nX_`-o&&=n3yNN=nXc)3G`tN#Ld!*;5sxM{x=w9az#zQpW~=L5Ria
zq%Ume0*twlbS&{U2&srIz5wEb+Yh-$A^xOPD8@WN%$!h$w*L_(2m(SFczg?z@X_KQ
zJ?V(^X+LzK)-$~xV&zT1^^{>)aFKlTjo43QpK@Nn-0CO#kLPVAFv%X?@(^}|hZYyM
z1?DYNf)jXBP=~_rO^!T*RUXiPdG29KS`YcG4Bdg~MUxTB&-_yx%NK*;qSpp1L(dZb
z2!qKOWv2<qQ*elT)aoAo^xYY}(Ctt6Sg8FDrLDaq;%&-~Fd2LVZ@#Lg+)oP9U`{YP
z&tllkj}pRQ_%}<hpEM6Yc8N)W^c&(B^i!B)#Wz}75=BWk5iI&s*41Hu*I6N3_Pz;i
zKe9>AN_O!DuU9k~eTO67vq!jed=O#LbGJ`r>}Af774ypvH?zIxcGR`w*dCl?ekO18
zPL(3g2^LuAU6pZ8tVcOBl3alRSe%mVLD|=Gp&{N{ERnXfchV35ZSNAw<T1x_Eb-eU
zo*+w;p9bC}0!D-S11YwD)d(NZ`=0AG(S>^^{V>rEiWddzKA@CeLI0?v^zF!<BgwoD
z&d^*nn1m4&T(-|#zmSQM|C<E{;yL}P=+)`NF3uMeEf=iu-H&qG=ve|{QdH9@enj{!
zL%WVc8G${6o><}~zDQjJWBbpE6fL%_80FWAbTIMOr<gj7cT0bNu5lk)X!`4jVc>z4
z5t8H2q#6?Lc_MQm&tf@ADWY8d8St;(1*#&sZXHVj#C8}P3#YYdo4eU%2~CBmlRCmI
zvNdueglhoKt0oYM9v7MK(r-DE{GRN5y%f~+&NJk6h+#7ZR&K{)duz)Q`&vE($!-)N
zbd2r8LwuWzh0p|l{E~2UL;(!^*3gc@qKQ==*`OG`KkZ??87@B719xIa)KcchS}!Tb
zga(BcE&nhGFYVAt)}Ol5OOPsHBR`E{u@Tw810yj~skFXd|Bz^DpLyJ~E%mi!S#(QT
zmbG4s-_exze)8p~n78x!>@#`j52zNn?Sbe&5Ot!vsEeR~D|zE->TzP1<3Wkb^B|Ju
z1<24qK&%W&%?L$k&;t0AU=m^1Y^Y3iu-BJot`9_z*b`mfja?ot-|r|u(4^DD(;?Kc
z3`Z^?vmjB#0oYB+iVdF$F3f9*R{<aVC_>Grh41%_1??&B0!Js^T@}o{WcnttAe_^(
z)RJ!Zr~G1n%^{QnFswxd%o-m+6g$b$fghc_;}TJct#g)mCC4$M#%%MhvlSL8`Tb9-
zDKKWn0lQS_6;NM5Y8cu6v?m7VuIGf(x03NetFDiRtQbw}%rjCuwF|GL2_H5(Qlh0I
zRf2QT)D0TzvYQ;)p!LO}J@}aH2F>OD=^jD$d(-ZJ*t4h7`7X5%nTMx)&t~t@&tA|M
zLm3aw%WhNx*JEuc5xiQS`w`G0Kqr8b=~H2g9vWi6=++J8u*c=?P!lvRnBx=J>LA3j
z-q<?5r;4)oa5&vb==DThT4z?1d}?USYyX7JyUz1ogAK|I{71=gTH}C`wXh{j1IwtR
z(4HZGM7Do&o#$;1{3Ojba!0ObhYcZpXB@bGELw><fTnGLU&2y>#X-&8GUj037FsC4
z3nN)fhUg!tL`W!dys$|jvoMuO!uttJ#>I7qrebm)p!~{Own-%so@}%Psa+@hPgkuF
zc&9F0TiDu5)=Q`cWwjz5_H7tIsiII>1O!xn&w~&@rmWn}vu%lEdFDpI`)n4~I->XX
z&B;5_4&cUVhy1)J>aSiN>x;tl&uTwfLl0`l5+^8Esp;!F8>z;}cGzQHVw;=Mbue%v
zdcSo_p#*yZ_BHCX5qHdT<OOKJc8i9QToO-ULTG3=t!mT*bqoY1{kTmaVWeBSSOJ26
z%y)#q)w9RrFu1V2u6~cxfXEP-d5r%9j4~O?Q%mgQOR}(gYC!hHBtkzM54Af9-QK(|
z)P)*N`Xg7F^Mtbb>AH9bFR91#%o6Brf$DgSdeldlF>1akY%dD1+8}yKhi*9Ho~6@u
z<be84L_Re<p~j_q`oR*1WYru@LS*%Sh}V_yH=xR9>4GTfr*}o9({%wn4(P1Ov~=Cm
zIJPL8Ypz8~LM!k^j|mLF>w%g`l0V5iZs@eeb{J2U-&dWNsf>%x6?vZ-&=D(A=Fd@z
zuIbfoil%$wfB)bAPcl1x1;p;2_^aqmA{o+O<{{!%>E&dNh@z5Dpn+(DmjtkX4)Zvq
z#>LA)pVR8{@tTBw$CdH0L!p-)e7{3>EO@1p8m~DMyjpO9*n^Lq6#A4<hkzC$3Q2^>
zgB(w4iQZGtYgmEegV7T$qXedrT?e&esU9Vcyeay&qnt1JLQ|op!!4I^DDH+oCjA#W
z>9OYDO9(c?Qv*j!fp;736%NgRDH*+Towi8Qii{KxgsGnB%3jL-We8$QVk>K0$<8gM
zb`dw$%as1^3C*GF2XU9ZjqoWi6@~8<&y-GGqI6{2B|@V0z~*f@hSWT-60j@R&)Dkt
zbJve1Dng=*Ht4eT%Cwe*W29Pq3eUSkkZ+9<fL2OZE_{tov!CG&oBB3?xs2VU?kUJV
zvF*v!=i6Jn39#jG7vkp`%}H-lAOg?XrJ##Ywoq2q$wjFHaatOb2#5FteGBhG+XZ;G
zBY6pNjP()6;m%IP`}Rt`XT_mAI`Ex(<NAY7DS4bvUykaNMf52}^T{Fkh--5gR~fXQ
zOrTn`7%6C0<Z<c)ozbX&fLCi6KUS6yE7~AoX`hvfTGOztwSTBwS(0sgoEaY(*|+G0
zum>?_%O}~UJ&;UvQnSSL(HJq@X-aGwi#2{a1<~PfRg+c?$Dvkb!NtgAiY~Yk-2eXD
z!_{Zc*}I9vA{`f@0>Ptf>2|NoT!~t%#wjH@&1)n_8&8N4c<%atK!tC^VB|*fr;EUK
zOw`^haT&U?{KfTTQ;a@3ZitcM_N5IGaF{?`r#hm;2p|%nk*H==QM&>GgK~G^`00wF
zWz8U9P3n8d3jh81^}7Hgy-Plugr4~oN-}$@>w2n*I(=xN4Q~>94dc6D62Eeda#3|?
zsEOIm`u`S80jJ@A&`@#V>eP4>6Rv@Oxfim7*nX+9bBZ4{vuCxL#4N%hr1?nFm)@^B
zvOCpjtsto#um#I`AHCLCu4y@3xcT(#7U?IKR6n~1^&&Mr4g*kdtSEMZNo-*s_1<L|
z#E^bQeOwo%{(ta$t2JP*#d3}0CQ6@QKY9dV&Kdf}$Z2qYaLZ1+{q2?N!4A(Z-fy2?
z_b3LM4!Sj<`Uo-%JL(oT(ge9$oY(^+H5E^YVterMMREtR@61RXVf>q9VloWX#J;_f
z7PbHp?9$?ouhnWKpUF>dT;HZpY@F#=fd7(%f4dF*$L$}VZRhb{egI6E4gSj)g#V&2
zSDskgiNQsGgTJIOTnINs%RVV!m;&q+5=AVgUJKIHg{Z4cg@7YBylEr<DM;y=50g*-
z$|57*I~%~14PZ(!V9Ffi!!q2%Eb3t)=3z17;XKI062Qaxh=)tz9TuV;&Vf5z4(zZ5
z>Tn*`VF}XVe4N8YP!5;FIGlrUI0N6X9N@474=@XVZa4?sFokWn2&N%PRt#pC0Wr*h
z7ZweY8Yn<3Tm!4H7^%>}9kS!|cY#7CgujYSC+)TfCZPctW_z$JQ}mTzA>~|)D4u#!
z^h0}qMSs}N0gYxmRfP6S7>t;H0FGfnG?+#aeHu#eY(j?I%TohGry%8i6@-?grDA}V
zWKfiU*mz|yzNVno6OLgvHyijujfs^~N{zfWrk8^>Sao*fbYEt2#LP=(#}U}8O-|F6
z>NkruL_7xQ>trkkXmg)KT?)M5^!a-t{L@CKj7Q`3NI&J@*#jd=>Ub9b6Vz(VFNP_M
zf+T;L^Z%677aDz!FV4jvI!zcB_pKI@x->w4Y_bh5*FAKk+D!IDeVg79edoZIsAaD!
zev*L@NfthRacOWEz|7!x6-Wi4Mi{1{aX}+{MOeSOCD&=@0Dnt)l{V1o>+Xu{Pw6{N
zH>}`C4DeX}4E`kIXQQ8SbWIqmU~D3E=$RNYNdlttUVXe6vFPs-c}h3Hq=Spw)Gz9P
z|J47H9B%!oKH7iT+oP%-%><VB`q6UmAjxhQqlDn{@T2!9cz)~9WaE^qgL!t)(8FND
z4aP{apx%*hR9;~G#iXB{T-KK`G#4YMTDAj0M8}6heu^czZ7|>=K1WRvW$y@LBsH2Q
z#fA%;z3z}HLWXaL<&P#unNreUs4U`t&>Z;3N$p|-J!CmT%Q1B<M_?0G4f-}JAvy&e
zWBf>uz`?0BMl6j&4=GCzXP`pZJLVvo^aqZC!{t<CrK_bh#-SSmJP>|_4K%ETLAcQY
zG;m^kzW|$H$=dX*)C-Q5aj(?!<BZtBROb4b0o=@lEv|v*mSZ<FTuUCm*_2v;aFH;v
zKc}*3aKI5-|Nb&_u}lLwwWD7yZ+S+GMsr&I<6-92!Iej<n=%Jm-u`0a9T}=?c6X3%
zybzG6mMlF3A{w*AUoy*>eoOy+icNNkn#?qCnha4L`aEgu6``yrn#h$dN0|mtPl+Cd
zlctH+-Wq;3%#7WCdl-qaH;GJt5aPsNm-Z00Ip-*0L^a)br=;=3@x|)V%;CYO$w@m*
zJL&3Rn`$OuWyDX?LzvwFZAn89NvmkJEo<9S@zlJ;S}UtPF&?sFrfx>M+23p5UTP=O
zF?TI4ehU124BiCD@@<6*#zQ3^vh3UuHT_F+<z_p013k2C=Ra+T^HgqsObFVE$fU&C
zLrFMN+98&7h9NLBdin>3MNmK-B@?KaD3J0mf`R%KBh2D3z#y|!7Z|+|&FJIU#87FY
z4Ipt!t5!Gw)@a7EtojV9dT+=&MSUu=M{`4t)bW7SnbeFy@K?q#irasw(-mDGSOF9`
z$DD<Uuk!kmW_503G`C%UsBez&B9M$RA^eYYW8uWlHgjs6mG`F&y$^+T6^!p{<<il}
z_U$tyC{Z^hqFwRQ3nmV-KM2y^5`TptN#B7~ia%ukJP1BQ!mj56Hb`<LmC>f~&d!LS
zN_^JE=o2!J#-5Az(~;ENO4yh|D&orkBlEEyDyLjVqP~BE#Z0k(vE!2l);iWnoKce7
zs?7F^i(BFk6p1ba<L-g_mXg|Hpy(!rWHnLTA`}vkjf4t0#k#F*SLSe^q=$Fs+?a|u
z;Lji~4D+EW{1yuUyH12sb~y1dN1c2JY*mJxp_ZHps|65x?CV*fT*#?1!NhY^RuR0z
zp;&rc)KFgzY%mFbneGhM10rnhue1OdhcBT9F62r<daj;d2J=iULph!sj&d(!%F;q0
zF7&SPIuF3mAn6w?4qgKU{!2TOb^Zb|%=E~R-M@$bf0~#+ik_mdXJXwZ13ir82qGN{
zzDl}OFTSUdou*)ZW7nTZv+?ZP2>Uln+s-0rIl7q0Cg9|MCIe1bh*&k!WIX8`aU|tR
zNk{1<#<v)6x7f!<zl(;E6u1~6)T8(96^MQonbX|i6l5;Q?FPwhr=i0N7VReIjx6qk
zB*R=U%f^EgOlsApas%JQhdjjkfBlK;IWmmc9b8ob&^h)0o^3tJ#ee+x<k=?v<2L?b
zFay~lUqe!V+g{e~#)s~?F2t316)BYwJx|f0Kc1+nX%rd%LLb;&<5x=6GoM}0ZkS5u
zWLr)gr3FnV)0tJZ42j+Bsm^|~PJUvIPQjS;ir^Y@${>Pc(_-uuEYNov(>AjT$jvZ@
zJo_t}EpxA$(dXHRl;)8A74m)ZZ-T8U*SG;nlYN$dq@twuaCi1Hn~Reyb8g8R>AlO*
z1t#mf!fch4vB4xhhHuM{{QXC%-SDSH^jAFevOblkM9*gC;2IssYCJ*wBcg|b>Akf>
zZq=L+<-v6U4>LQZ!o<4VZqkA{ZUkwuB~SCqHJ*gyAfl|GvS)?@oqa_my)oQh{xNuM
z3cdq>)EPT;gCf#H(^2kM${Wu93}^Di;=7zIecgq%f6>YAMlo$Z_^O1d`#%+}R$2M)
zIrsmQt!MfA-%q!9HuwK+{4=kx;#$AxMr|qZZ-@|7v`=5XRJh9T7&GD*dq78~nP4uf
zXU7x&WiT4K@qvFKy#P}9%HM&}G^vx)@42IYWV8yoq7_d3)&Sp41xv0n(}YE%dyc-#
zR|$ScJg2CR@r%Mj#<>8!;{H^{rlj1?i%xbV)GQP^lVOx;SG)X+9#Hhmq5~-^TwE~i
z^u=I4S!&`sqLxd?X6hEFYtkiUZ}VFKH9k72#mv+z&c`FBCY&x;oShO`Tp`v8HEIlh
z^Gs~!Nk!ckC6Ruan~9X#L+7L*^t15Q-$QrdcL|AU@z+VtJOMFt;g8;c#Jcd?zbMq`
zlh}?Y(F)%!`UNH_?_bz121vcsaJ<VkKvKZsivhwQez@=_uiZ%VH}z57jpZoc0@_06
zHuzQ}V4<u%V<3+;FVt+AIN_#J@|T@||AX?M1c;F&9pHBCKU+KSENlPS+SGr(P5I9_
z_rW<`Tqz02eC{#!V~ap#i(dn;gVS2@Wqj81?Jx{3UH`15>Um5zyysTWf7OcLV(0(q
zvz_eu-`U>T*njWl{AYXsWlSKO)|PuEbC(pqluv2Py;7K?rZvzr87E~K&+SNm3G6B{
z4<a9Qbad2IfdNVjFn^#AO;ys!P5WZGQ0n}v1mKGKz?}2H^+P`Y_t~?joAZB*=l?3}
zIX8}hkq*AOjKApfpJK<iV*lOVdb;!E#~<_d-<_?^`M-Vp?=c1aI2ixhO#ewGGMeH<
zVZZA;H2aHw6CE}wXV?jsRr$q#cD)G%7R`9)Upk2ISVj{sRxiIw%9IuSRMJEF8!s_0
zr}V7_Mv<QHf4IJ*{+nz?>Mu0DyfkW%sRw!i-vaEqUcZC|lj|!Z`=ob=1)khqsNZvg
zPCYP<S}CE(=z$l+kfL&(6}(cmu2I?i+K(SU5|0646O!$Jc`5$><IdlI#0i69Klwfq
zm(ufE1lacb@u9$i4^%PKz<7r?eE89G|BDb<vFIR$pSv2Tf-->+!JcrU5eYezs!)&h
zNIY(r`VJiluoZ7re7mYr`5VWw{~mgE)u#!Kkx4+tITuXTdXj{ea_~}8Rtzw=em{OK
z;Drm@LydjbP|xiMi+kmN27Aa&*4a>=JkiCPH3)q6NyBh!n4CnR)gED`7+qyDdzO-P
z#g7!0XF7Tfn)y96(#4_raPk#K0xDy^9bvS1f-gxep+R2#$Tg>oT89A4$~Jp`sDS@#
z7})@uL(~`(7Rp<Q0wXkDs!<PrLp&RmF-3XF9V8o?L^jXZA9Y}VN|sKM)T~`nDHPz#
zAUDHLCBZz;Dd2UHJt{FN|GfY1<*(hBZ;nn5j^1@o-tGV6;8pkF=-u(ZyC-jcdDnfp
z|5ogYzb*guAN$8ghe!YDzWep~;N;gguV0Bh@k2>7nN+WisITWJN-|w_eE!bXRyu(+
zNg+-Dit!kZgL#U7w)a*ik!Ku#=D)G=Qob=Ref_cY;R-!2-n06bBx%fh6BpX`UrYZC
zR+b9M?auuK5olBUQ1<V7cg{#d*+p+=w{Jt*`u!emIThWfQNmT*MV|3+Mw-TE?o!Ij
zeIEXdNAue+`IyQI%$hZ_(3RQ-oc1o&OT`MW-N5e$cIaS#D)k-mD%-hmqX2*j=I=Gn
zes1pzP+l>)spO0V1S}I>(y+3j7&FES$!=X8XfS_zE3WnOYpy$_f@_Puj<<9yM@xNB
z!Nk^^r1@`Xk6drM%9ks$n)TSv3UpmKZkD93)*h~k-M--gE2ZG;+NKCYX;z)J^e3Zr
zw&_l$JPEyj2SS!hzMcTjtTw{cc4CP^F5kg|jbmai)*q_$I@O1Jprjb8ZqZf6$d{p`
zW#ot@r$1kWTS25-aV!|2arZ-6;FVR5OJzz(QE`~ADxy^>5hGwgHw74QGaaSiEpDcZ
zwGLv1f;_7<syGwgC>2f<)g~%G_R;m1nOp^w$rj3g+wIh}##FeFj0SOorz_O9)k+&x
zz%gAgK6Ya{8iUW_VOXlV=olHqH?!c}$IY}&8DclnIGyJkX`0LVK2XcmGWYPxRxTYJ
zrc3C}TCF8kX^j!F4~c+%?szc4Y>vOEqPNlj3VvFICd&KDG?>mY^5sQ#3DfCGnHP-4
zcDA;E^Ut4dZ591k_~z51AD<Nc`1gVzw=*4G@1{Xk3sa5E9|@H$y`o9d6StgrO}`lD
z7}=iLK~*ga)>+YA<x}k{CvI1l*<HZ6K2s_!IkY#gLnPH9qs3;kkfnA(v2n(gF>?Jw
z>gmQf;tgsuZWK)_GW?^aP?+5Rb?zFj$2f$4TVBD(b;<YNrIQ-1y$);m6_)cOXx6f*
zHDyH`^m10Y1q>@Z@Og60eH?mPNXL`aUCxuSq&e$)Ern}Y6V_tubuW%Eg&gTidtd}Z
zu6=};q_zjMYAJIEz`#_=|CjOgJct#W02Y1b@>F0nmEQL^XN9@}n?gAU{HlbBjZV6M
z(MfMsCoPBtTI6P{$ZU8E43=FqUm^3rK`tn;+<2_p`LrKmh&z;zxv;%^85D*H<Xy7A
zFXKGEv4{dfSX_)~Z*5SH9NH5vCiu!_Ml^DLcLd_wvav}w7_p&bmZfH~YK+y5&0}PL
z`VzK-ToE@Pl(|m8*o}uLEq*K9-oC_tbcrk#KDz26-`p(j4Hv!dVL_h!1V~z&+j?^`
zZZ5`q!GIxIY?&!kly<Os%E6)$V{00&SG;3|!YRMsLtN>`$_#U*RFfsgd0~4K*^N}D
z{QX_jC0<=8jQ!^LfbWjSGLG)Wb+?hH79D^(85@D>s}-mmcSNQ4qK7_@D7GPgfN=z*
zJb38x;g=%kA_P_!(&*%a*3muNKbzQRvfFp<=s^j*ez4rqS3phcnWR>b^Twe|{<JT5
znh#w<RHmE0Cw*tZX#9;9zTh+hM|uzarl1@rEE;rgQZ*l#ZG#}!pe92Xz}r?~hZVv?
zh_#_1;9uV!e3ZV^Re)`)wj-*4Lm?1rr{#;)Qu9}r*DK>;_h=nfmiNC%vY?*7?nPMo
z9{ds)ffJOM2#o&{S7IfEoAvNPZdK#ixG^di;>L}!QBu<caj)DMo8XqO#u;;cQ#mh`
z+v_M$;;#`_((^`9cR2C9Zv3fQU<quw>PABeElA&yPIu@9m$!>F6Mb}ly=u{Vu*L4c
zj%_bEyMdM$&7-VljqVz#0}pi$p}DG5Y0W3P=kA<j;G5?bXJ?^2ThMQG>n>@X0k#bI
z(0w((-uEztz8CbnuJ5=Z;SJn-1a&I*+l`>wZ?_)=G2}On??3Rnf~fB<<9@!&A#?W5
zSl8uUE+wV1aS-C&IPj)_L%5SvwGmY$1GM$7Ufx?B*+T>Je=wvMNjn^z-|Nfip}Pc!
zt`{SUr8-Tnf9A>i6bOcJu3d1tjWz<n4W6|O^5BDje7qN`!lt@}?sijMVpCmW$$y*b
z5}WE0H#qA}b%}dSmYeDlo9Ysaytb(>@!-^nO?8P)b%}C$b5mV^VpCmWQ(a;)6YZwD
z#HPB$f|jTpW-TE4-Gf3CIJii9!!DJ^Ud)5EW_N|P(`WTJ48oDU0J|UCaV$fB{)_8P
zAh{nm7`pRom{bIldru0YY_MOyEbLco&?KmS;N&c(#+nyz;%#EXj>n$MBHFyPm)p2O
z76kOa#i8J3Qf+~MlLv<?zw#P-!C6q*3XTKM9ZV~0E|e4m1r6RJ9P&ChAR<eDZ8Wr6
zp^O_XBSyoDDj~(|6|Z;WKQU$^%3qu3(spE6@Bpn8g*R#meED{EsSUy6&hM~=s@L4&
zjo~_7th?lN?Rd_R7E2ty>DzP>Z_wtF++32IOY#f5Bp0xMd*A-;SD6BQozhfSzQI<U
zVXF7-JMI1H9rnIcY$Lck&Hrmu@{6iA-cWVIq3uO-j?>YXZ-$H5`2AqvSb$Z0;5Xn}
zzn=HPauIm;U?8Ii>#HpuufBXF(@m9S9C)_7c)a7v^t9UACI@via^umwf}JZLlZu>I
z>+RVJ@h{7N+xDv+=EQgZoJj6^>1fyMN@Ia4KOo~tI1VD&9V~IO7j;`zKxj8M-<06-
zu<Esj67KUQ27X8U3~(5o33)=7<xOkyr5lgCgy5G?V|RIU(tBGBXu;Q3jfk!M6hzYF
zxVUjBBN;!mQ>>iG_xcDg4>z{T-SAKj{VMQWoAX|O)p?;vvPIW_X^D946NZg=-eL;n
zippgbJF^1eUoX@4>Zx5rS9;D$YRt;|k9f%WU~B0^>koN7y=a9=yFR1Cx*IClP)R8}
zT@X6zA)7*c3Ff#JfwR|5F}$@|s^G}YVc#6~vf;WT*$n}hsXAQzC1pO{m_J=!_Nz*m
zTUttgTVGn!f;r$}t%FLvj>=da>5A3CxhH<?dSC4dT;Jmx<ieGgoBBa(bC{c}akJ8W
zwft~ayO*vP&E#6J;Nfy<+1G0&4lcXh_bT%S{?$IUAStO81;e;Cu*bFe4XaN$d9M|p
zhcY@3JZH|gvm*)}HyV5P-GVGv8ko1NqI8#k`L7iR5$f?(6f~CNF%`CVeUmZ4cO9G@
z4Ww^}Zg9s#xut-=uRJ6^9r0BatONR9Wz=>3yA5mS5WIPLzBik{`;|nlKDmFfql@R4
zZURd29|v64OL)cdV$@ut%c62{sqtiPjOf}uEG7nOXq@>z`P<GFprJ`eAs}FR==nl_
z?QCLLiIK0SAu@X|&Py+~Eid+ZawZoT!Qw++Zi2jicR0bNtnrHz#>xb;o|R^4f?0f_
zR;GycX0$Yg;EWm-1-IWYH7~VYvnMrUGK0V$y5Wd1%w*U0yy`gMaw`NLzA8`evL3@F
z)c;jidqK(jF0Mn3=n{s(<pLm5#bVEYJ;a$_K0asFsjYl<JVYbDc+fzxOS}K7po#k)
zDSCtDBbSPTT>1Qbl?!}*n}%(o{ppcCT8#Xc5(uwv`ih$%KJq=&Mawe8XSP``0j+Sq
zZj1%<jRkHu4s914bO0I|Nq+&b;f<jDMGDGa5Em)jo+1uXPHy7`-ckIc{EfJO5I|9j
z@EB=S{QR!`S6lbmf2BBSDCY$eEykqQ(AvI^l>L=1h@#O{WSk<u`Fe?ZONGL&h#s(T
zv`RH5*9s@R{^ZSnNvzE30hzoUOF0f#t=6+*(CMma4(soD#Wt2|>@BNX+HY_ija#M(
zGg|74CVm~i^+nI}%bwxw#*MFk#1hu%Z>gid#8NC2#rF^`da1%P%LuLO2(Py?yN8x(
zzY=EF^5R5Ag5&A};~IEdVv}I_6(ktm-|U*DZnM=^d^y|I{L{JoxASdXtKYl}Y^{nh
zw&OcAKCA-I_60z#-M~shGP#FAiVp!uW&@(KxzKKA(i;$!4VB!Sb+Lkf4PFrrORQG-
z`0gwc8!VK~nXPovh=qbj0NiKs1`y?r08vl^TgPx)p;P6~Fi|$BFdI~uJ2>(i)Rh~%
z8SfG5%F+nvRavKRO^aU#J6$}m+=rF1)Wt&qGyG}|$(0#nS4Dfj0Yl;jxV>s_vjJ{j
zW<n1RxSi4=9Xasq<u0^;2k29F+_MaV#+P_wU&t`}3Ivn!r0==WxeU8@9EWay0;ILP
zAJa77br}ySp03so1a*&N>0mfI>_In_Lm5hcAeV3O3lU2;hyLzPLv=>RJB%22H`cn?
zjwjJNtFWf)Wn*Pp@Y?ty4%|Z}H<17u#?x-!^&QtgTkRtM8mRYwD-jbnGTA+p$!2WI
zmrjoxadab&Zp6`zIJyx>R~6|t=WlcVHUjmXO!NNAzm>T%3H9dQ14?{ZDW(t2YqsQ3
z{}O5o%~deJWaylVn9GV#?E1_v8z_E@z}we%nhw3e|9L3V{09H$hIjmiv>ma*|5=wN
zHuyhZ)GRmnKh<e}pd0+34gSwY^?X3U7j_7AKDGxR?K8Oqz28{G_u>UTW{buT$cef-
zmP8dr9#&RLZ%|0RGn4$Sr%&ISQG4Y~(JE=|p(eTC-YzX)c%+i^yV;m(UcE7U+tP(h
zk{f=73U}9cn#6M3pi#FRFSVq}yDH)PR{7XU;Fi_d%__EkmR4gi73+gxRw}REka4j(
z!`>QloH4gG(P?gGTI-|MRIo@ZepW>+M+L&d%GT%gcd;7K&SLJeUOTISd9H3!6RRNO
zIr7tru{EnXL2v!`TLn(EVvc<4b6o*`bRB!r8Y5m6qO`Khw^I18>SUAE%}^V$WFwYT
zyGZN8r*0^Jazl~TF4DSzAU8ljYe2ZBb<(wi$SWekisC_5|8y<**A36v@SJKFsRF3k
z8<jhC!|OoM-h^pEul>3WR3llZB<w00x*^U`?J=r=Lx?IMZc{r@5!ma!Ua_?yalfh+
zTl4d(S=OD(Ko8p@yaBIYV5gRZ^fmw8gir3ytzPSYLIB_3m3-&w&{~ke=D&6Q)*A*{
z34^>Nm)VWGlvaf;E}P;_4|geO;~V3lcMYLZm1OxP#GS4JoqQ7vc2mUS#?JdH(9Ab2
zecgkIsMTS#zGTU34G5Aid08riicWKrYG9*N2d+xE!i@;JVPIdtNxc~d#@ZelQMsYt
z-B|g5m;ARr7Ml65LYKDKSeUDxR5kd950Wu_$z(37h3(#)ppAO4k-0ZA_mUgEITIW8
zWTT#J)RT>RvJtK}>dCs|`-V?!_{4@!Y?QFCLQlHMFqQiYxPMnrFB^RRDv5Z5&o90Z
zeEw1{R5BdGqPIP?g~&^75}CDTOOWXNQJ0K=t8d4H^I3yfxn)>*8O8IUiEnz61wSo9
z66Jkm8XN>Z1Z%&Wjti`p#=B3qwzA8R0%IuZieQPCL@h4q{mGs7{`3xe-`U#E@66NU
zAOBwP<MvkiM{YWrj7ByDU7MqiCgIQ?WGE-L&mxo75>v11q~9FL_&mt`Hn!nxn7{CU
z$ugI;A2>Pv*PzVVOPoKPv!mEnxaAkS)mLGXE8OJ^viR~x3$nJm7}_B4hi*9H6_gId
zGvXS~cCF0d;fq|Jvxi;o+W6`zsdT&M4RrB1)8(W+2vJ_l3%8iVYT1zI#Ya0^5qx;3
z_hye^Zn3Tl@5-?q+M@z=vvX-XGAww1@aIH^)57~Pl+ifwqx3o5SwjlCH`mlzXwOgc
zUpWcn-dE?kH-)5@$f&uCGE$YL0j=jfShoaJ6$wDMo-(`+4$wnI*<Qck(SzLTHOn78
z$T@#a^S!=jwRyhCqC;PPS)NtszVczC<hTUstVlAIkK2u+iF6*?YOezDyUM_S@5?T&
z0rGoarm!^f$sK71>)?^x_u_La<B4pF&Q;}gUlA$ezMSIapfm312rn<dts^?$_d~x5
zw8iGUS9)Gnfu6Xdv$JAQ-9`hdkY<)Ei%?M!t|hIPcTsKgtE{m1)j=e#TY6waC0_%T
ztm+1+V1w6y{a-Vo;67JQT?@K@e{*KPhBI3MoPMPMjBCN>SCKQZ5<LF;8E0$5;C~5-
zk88u)R|TJWXDhHaO#OpifiD^K@}Va?t#&gmKb+NWz}rf$x`%esjhW}6q*hfv<hx16
z+MOM$xq!p{w&T9z;G^`vp6KJ-PXJgWMt30=zZ@?eoV%XW#WCHs#dc|bm2Gv+VcF=G
zij{?1MhdS^F<lvAWPK%X5cod3n%%En+1sqZx&;m%`WkH1y{}u{`+`F_$M)c(eI}Pw
zB&t+*c?1t^?e3dKv-m1*beh}Es4Nrk%F}7b3%sL7`~S1|uFG*F*P5t*>nYM4Z<}<J
zMM{0~nA+{$vZS`Pr(4p0NNVrdA<JMA$f`;c1)wtllGWXen1A#C#JtP-e;#E&$%(w-
zQiV$<E(H{sim+QM0GTUqE7#>)YgNAym!_ToHdV#`rK<Si?2r4ADB}U<#4yy|nsu|L
zu!OzKj003ib~UdO&Y(tawYL%Jy>F66J60>NfWG0tFur`ibPx4^kM-lpJGoKJEiUb2
z$VWzCc8MGB>hs;1DQ`r8*v`h-EiQa-ma;<}_}+~1K9BEi0yd^rvE3bb!5{<C3bQmf
z@bz|8o5gOM?%m$VG%@tG*aE%LX%w41+H9J}Vw(~=<_ffoyB?Edqd4mwOU!L!tEa|?
zLEBjBwsDmY@-}II6DvLD$<qf9?D*K32|aB^$|)XFQ?Iu@pT_&$G`4xid%s0Ivz7V{
z_kn)AvJvuaBvf>}_~h0RZ2M$y>K3uqp3H8MY6gSs5_@cSz<t;OZOq0U7qDeKafevq
zsU==)9Xo8#+<iE69pi#~iwSNW58M?gY8(gL4IbVp{&!!0qwPDz`|f8d;V$vL_dS_#
z*CT5~89UujW+a&3L`^EIethnvZFSaEVMc&~HONrB?uEpL(l)x&*1E8tj$?Eer3)MJ
z=C-up13*kaKHHPhf}d;D8?-QL^Se<Cv$M~vV25DnaXCo|6nlsJ$V1oIZ3d|9;$~9_
zDcp3u;T7|LL=Hv=4q`;Ep+7Da2}NWQ%W{nfo@19gF$L7L<({u=)N#XA<f9mMZhdI+
zB*z)b13Gl&7n57`i?&xQu%&#p_0}HpuV^D_cO9jw$>zr(O(<5PnR?1J)y@Z!>u0ii
zZHk+W(d39r2a$(*0>pOrFhOqI+f8nd)xF#$bAsr9(s}5~4aU(&zZ}`JwKv-ENK&4R
z4xZfM&{v|3R9MhkniMPL-K)Je)ik4%y}j<wL8!Yat(D}#dL{0)b8_7DEIV99=*IZE
zmOZsLCQrg`CFLaD0amfdI-r2fU1M|C*xWT*e{AlW?JZz)*W8ye+T1lQ>9M(MTIp?r
zT-7#zcMY()Yx*YC=B_a!+2*d<&4prf*9^UrZSI<$j-Ab2W6$Sc``zZQdGPzd=B}|>
z6b2>J=B}|jz~-*mv}oDfHTKNii!*0)*Vx=OW`At%8m;qdbJq-ZWNq%6PB)azUDJ!L
z&YCLB2(Y<pYCD=r?iw5jXrV(8q+u{NIguBCMFJ%5G#Qi|BVc+Vh`K0%1cwt?D#=M3
zC~2R?h(H(J<Lo7%PYnFnnT{S$FW1ohhx!YM`R2?UV7=>Q6n-VVsyu(1XRjejr1p3;
zowf3|bB(ZIi2Dk`C+Ir7LbdEsr&j%bbG^@}$9K-U1taY%Gm?jDFm42sco`D>Q?0is
zIf8MFNQ3+}L5@@vEVNfy%Epxf#^nX$=6W1CKOBr<-7Tc$sc8`%mv*uNLw}w7U3qeV
z08!dY{-dftKBTdeL>`P$E1#TB1Zqzc(l(@SXDepLQ9E$gPL3xxB%T@1+WBM}VK>@4
z(gwr*_R8cN11`)apnGPJw#L-v<Dqd3?(SbIRjX~^Yi*nB&x1{pjw+$;6*8KqO!(Y=
zzt<Su?6%jt!E7wnm|~47(|<CiTp~#7)6cflsq~dVqj>pIBD4F8Uva}|+9`1Kum_`(
zIW}}9y@si^LRu^2<gJiKNmZ@svbE`w33MzQHj6N54SV0AiOo$24ar`Rif$tqcurUA
zaO)7B0ZhxFb7)0oGbbJnppWBqmu5hRnDl;)haEObVP2Nl_nZh4c7H0b(Awz~i<0A}
zeZ-_pW|llOhlw9MK3?IthsiO&Y9>21^N=9C2-x1SyQV~WLY)uO=;L5ng6z)U`qS3?
zcAvL=b9}&qyI~3Pjq__ggsoC<DSxQ55<{{;v12Ev>`y}BrH}UdK5h9~*XY=O#(p<t
za1hg5oME6*?e<%Jk$)pSwZkBIZHLUD`w6Np$TO0ap+8FlCvdSKXwl2HKj3)#A9rTv
zOGG067zb|LSF1aiis7atJJT#XUw5r=xSOr#OM5sqVXvp4A6aH^r=Z8C`jU-yGnYLL
zd_lq_axT}Fw_4t6d8_5EmbdoLTe+9oGFZ!CErYcT)-u@s27kVSx0bD1wrbg`WviC0
z_Q+OoVA-l=tCp==wrbgGe*>q<%Cc3<RxMk#Y}K;Weg@t{6GO~de{<Dwfan&wu`|bh
zTpx8jkvpgVyJm<xX0ifC|98n`huZ(0Vfou0^0%HMV<t5wAKhXX`VK{qxJ%2mE!VbO
z+j8yu#I*?w7JtY}r4NL^vB`r?`CCl?bV@Ez^{3}Br`=d1?w;B!(q57Fio9o6WZ2Ip
z7=WcsW{#@!_DxKHn9hu$6%1nRTHVs>miFSb7w0{^I0Yg0;vC@9KKD%zk>5vc`oDYd
zWl5yT+>tp-aTv6^T6;+;a8FYNrZel{&SFNdsT;t3On<3|Y2?GT(?=F9JK6nzW;4z-
z{jt@TdY~~PnALA-n?ADBO>}>^W@&|$5iaNM7jrI?PN&O#@+pH_*B`4myS<olIx2Pj
zrvd8Kf7Gv`;O<`GbNb6JVwY^EOV(S`0=sTIA*QETXuDdwS*?CTEbVITgqWTpx9n;S
zPR!k?CV%O6pNV=aUG~Ljr00=*bniwmWzAb<d#6hr(Mel}+QTq*M<VitL4MLyveK*6
zRt~q7!_7NwU0u;bF~ok|rZe)1=oZ|tmCkLYbN<IxItP=fbYAbU*5(76K2PJy<T^!F
zyEGcm7zQqy@)Xd7v%fwkKqw#OJSlrF%63)1C4Z`0RzDXSLiO{8=6|eyBrBbkzo1oG
zK7T-KS+6ZTZwt@wYvFkh#&GZIXPY6YT7!35f^>Q>+H7<e-Mi7Z!Ex>VpofEe`jEy>
z5_!-dJ%VYCX^jDztY+`CYld4g#42g@PmmiD&#ZpDHB(r%->Usq?a%2JgUwQXanK=@
zSbu95v33z_7rFO#5o`aj_K#`VKbUxkf|!FE9bV$MPMFkDgeoLeapDK<Lb4v+62%iU
z?Lgw;0QxxA1_kRn6^Av>EV1u75hQFEU7>aJ3Qy9=g61&sV{vU65RX@E3C1;*gaqM5
zU=rXnm035;QrUa|D|ow)D{f*tn#xj}C4bzQ1ZPu7vwfTDdhK<pRL77kQ0(j{@n$(z
ztSPhf9%FKYw(wRim(|aI7@#-vb8z^xhB(l|f6`(z>hFZi);N%~3R(qQ=AuVU0Gd4o
zi?$CA?H)Kexj^1N@^_7gm+zd9Yc$fk=hxa7jDH^)D|QAN?-F5a&$d0=_H0l8Y=5^7
z#kL3B9&mfWr+dI##_Zc;ZI87*))PL~?UFm#V{MPMJ=PPBB5#)k#2#yVtnIP3NezZb
zYS6a6@92(+E<9+5Iau2Anw^o@o~PLJrDcILt}i<nE$!>V+S6`NyFKk1M769-YR{L>
zpH6i^JEczSsS3mWP4jM9--Bm;hJW=YI~=LO#$cX^uqVbn+=$xOYqWQgWqg+L={CH-
zj86;TZ$9q^h~3&ce1jmUdrg{RSP#z#GHtUe*}OtKAN0M6lxSM9$z_uP`gO>(IKy~T
z-&psnCDYPpSf=&5b{-O9TxY9IJuOWkrhS-4E4xZN!SZer_Iz`+`~#gLV}H=`1Dhv9
z?B+w89Ww~r1DhQ~B+&z!ox5ID)B4Byb$5E}(zsquFFg+-A!^sBY28D!Ik$b&I`v>$
zx87LCrB%x|Ri#Z;X;W3&RFxH}DwphLp$^3XJ0l(KqBim6o+Q2$+2%U0cfBOkD1I7P
zJzHO@EfaXw=e;s+lqYYYJ%2V=2Q|{(UB>;^PRa`2HYfkm$`EEuS4ce6eK!w~4VH;?
zy)|}&123#>PA4Z=my4|NqB2b9`gq)Qt~QzMSiL{oWU~D_pjRk{y)+b{+t}F<1P4%W
z6XILtwqCildaTuBtsZMjF5F|yvo`&8&x(+7a}3j!_>j~j8P}e`-hbtB9Y1vI25Y^x
z4^N?7p_pKIXR6jf+9xks@KYG<cwzg#Ic%K}tJ+OnwS!Sa!dtw8@i5BMkaa=CC5k*p
zx9*^Jn*Y|r)wqZ=Mtmqb0Kb4B@%>s@d52ljfq?bUd?S3SYajbm^Th-zIgQ#A231CS
zu9|vp;M<KAN3`U^-GA_@dN~mol<JryC_Rjqh)m%=XfAuv-a*(TBzI)G*U(RfXxrj?
ztUdJM+C!_g<iTo%S_`bTz}^Q7Y)8<}o+EJvFtgcWy(LDtKejdn?Z8@t2nor!VT#uf
z`z%3&Zv42BhTemw-cDmTx(urRw2q=S<edE&1q_S>=>S`VmVZBp$<a+Z)G{GR{{>QU
z@JgJ=0V>+nKXyY8X(n%IQvNl2Tp>!~0_`;JiE9zNjkFRPpC;StvD=ueof{l4CmFPE
zRJ7V~+Zi7IMS?xpfKlttwDux{j*bO){7^xYNthf6&|-$IV|i4^vbH2`BpB`@^2W$2
zGRYBmFopwYiGS_sK|X58D&Dni2gbuRuc`7(ZV#Xpjt86<VdJV_(_L>f?Co9lEQwrU
ztlha>$B5obcjcbD{H%BH-gx({E9rqoeAff+TijIl1~UHRI1cG*L~5{pGd~B1y9&Qg
zd2ws6g`s7-GeS+@daE(~QrKyO1G>hsmwG9y-w~o?(|>cP#=AH?P(QWdQhndyxcYXJ
z&Sz6IkDr=Z2gI=lwCh<#?$ydYxTM<pCWI+czJjs4bVS|}ZC{ab*2&RJj=13}V%D!o
z*Yn^mI7cY4=4AFz%4(OzRlIvqFd32s?NYY4=K*zJ$d(J5b{vL&m-*<a9viR~k%v0C
zG)#z#oPUJiUNX~EjtJexwzAQnm5utAB9Q0QC&BA1Moh7^oH;;jkQHcly%@S-4EvYv
z8H3=+sYt+*@`l`1gOWhqkf6yUey?y~EVSvyM)t?b4S2K6DS3}Z)EJ4lbE@_Y?@I$5
zMJS&9VKjzof;~XZw-Ng6?#=JsMpVKyZ{V0<bbk$fXBB#=+TBt8olr`s{-^xL)qMZn
zq+M7->Z}?hjrJw^c#2W!g5EQ1(O%>&<&zMgH*+mdUvEGki-{hs_fhj_SLAf~!sfWO
zs4t89nh>=X^_81qi~6#tFN^xJsIL-6ZBbv7Hw0MJmqmT;(V+Jn_4P3QwdM^gaYEm^
zXn*~+gIbG6_tzE;*1BZ0@f@1(R=!nw-Ky3*J&H5TdZ(>_Z|f*p@AP=v*LtVB?%uuh
zP8T91taBPz=X4us-a4ntHGk`zw$5qmoVLzs>zuxyr9iD$*?N`BWD@ID-aD@{XefkW
zz0M^Z*m|8Oui#s+v-LXf(V(r@c{n?=^?y1W+N=!ww_fK?B((85w<y!VoQV3{PK~wK
zjk;w$AB<bH^_brGgaX0|F?mm;k8ZIGjdRZQn0KdJ5}`J*g|1t-yMxkjOBb%7Hn4`h
z9&sz!!zk1mCj;u1xoB{YJw+=R#P!v?EqAco!E%R(#vSe~fUEY81#nGh7g_*UcYm{!
zIe?2RKo*46U*r1*k^)8GSoK!0Xex`Q+VAp*k2Qc(U|$M6F~9NVZ03%DX=(a-NLH|h
zE44nxRRUi1+mXgQit{wGj@(}@{tQe8e^%>;9ts@P?3Wo9mbA-W``#5j08+Gh{SFW-
zmwtHJfFamLQO*@!A*ZRn^)3h*Qh#ctOZeo=uj<;?Vv3!{NAXW+?1Gv@SG}|XuoZwG
zkN|AOIfILPuvu!jNcTasu>lu*mkn@_@Zum15UGCN(EN`zV-)cYS{AhGX|C3$Yk}%@
z^8XiSf1I-Xj|iy`l5Ode()UBbYlwY#=_4oO5L(VFBkb2`uC-Pmdt(N(uYW$eHjwTI
zF**C@D>R2O>XXpWy{ie2HGsx8^teKl!i83+y^WHKuRHBgsv4SXtH*9*vUYB;URlhJ
zeBGR<8$%^pAhI<N|02O2lTb~l83f0yh440KRK0DfCc|Q{9o9TDnS{w%)~w;o8qT)Y
zz0uRENnWkSRc^3*fX?aO)qg)1`u-(!ubLvAjAZR57kVm2!P~+8Il|&VN7Zl}axrw)
zX^a%%slfDxzH6s^f0p@>bC&$=2i!7iVsm=9H{_EJW1kSi)#ahB8KX-OY>q1*oD7Ow
zQV)<fVu|hPh+&-6GEv=dllCMem+44HhGaYlJ>tpPS=+2~Q<XpMU4PJ|uh?WjRc0#9
zi>b}+FsLBu`WOZAJ|^?gx`8J*-yWvSTjx0hL0Sz6siQ;3_@_b1g2268c<P1`+Jl(D
zM$LI3db`oxLhJ6VR1e@??Cxo7>5}cQ<6#4ihfgQaZUeR6I6a=6?xzQIg)U5D|F(e@
z+@~|#;*+j%{N2WSXMZ6W?Zt{l6Gj_z#;_#on>?l{$R&}tZxZ~yh+Q8#fTXt&>xxK&
ziP@b%=DW;V9>5toFalqbnd}1+zdRRqf9|0#EPUeu8YHLVd(tu4?IPN9B2F*^lbVhh
zt)dqlbJ;E?z0v$NI3UBow6$}5X$z}ED~rSAvv-XIRP7CPYJaeh4<M3d@cq)p)MEoc
z_6N^3ICdIX6i90m$Dk6@z0~$?wyj}w929U#dVD|`31b)|XA1bXyS@;s)^yWsy6MkI
z^T!7pXJSo6lf^Gj2Ctjr7^B(}OmTCj9-#ihq)l*gEi|M42sOgRjf{O$aA#5XWo$bg
z+qR94?T+nq%wKHV=-9Sx+qUgw@_qB4r<sR&S+(z}y7yL{x;T67wbx<Kp|iIq$7%`Q
zlC7~bqAy}!vIztT+8TLj%R^;7jbtLEHp#g)W!p3IR5#V45{_+xm4#l8S@L2#nK7(1
zWL*!_yES<820T~xEd)$t=f%*l3?@EG{NswYmdP7|<6sXD^wg_Q_3a!*?CAc@P*JO}
ztYPk;`@9%x#(poWIEvU?Z`}GLj0$$<<(0{PG@c6!uO0@3L|#$Si7(US0&D>TU*GD8
zpYmXvG%bR~_(iu=LXM&eJO7k%-A-JNCJom_2+YjP^t^AuDc?VDR}+R~1inE&&h8ny
zxjjE#%B!ckfc_H=uBu;jx2O6B4#j?)T~ve!WoKpiJ#>5CL2feR!}1=y#S+G?pclOF
zcw+5v0sb-ZL5A=}i0`WtvsBCU&;UOy;WEG}P}TRYA6bfNkwrzGmeJ`~86mJ--41UZ
zB?gmjQJp>xZbxR^&#)aGa#@xM@AOnso#E`G|6|e-o1%WO+>-XkdS_E*7_$sk>Fy##
zf?SMIhng#>LSu3*T~Y}gcqj{23j!%Atlot;03h3D#!3kuCWA^GvuVjY?1}jAJCFYu
z&2n%G1PM)UY@J13s5zQ9YZ<kpJ8^U=Xp<zW_FpOd5+iXgv`|c}hpaIAy6qJw{HLv<
zr&DX?hI5%|Z_{CUA(EV(h_06(T!xOweJ3Y@VB2oS)5}dRII-ZpAT61tD(RvfU#Lcf
z4Ja4}+8mPWv|MyyVST`zI!3#6scCFmB-MvR7Fyn?g%olS25DFy<8_AFCtV^zFgg(k
z6=qn?l6$5cw2pvn`hF;c*K}{!Df+dUj~+d#B>u<`N+S0KGjxUG9<7L639Lrs%hV+<
zXZgJvU|bQbI^09Q6Z^BOn<*$+Gg$DF2WZDZaE2@J?inyDGh4H_DM=;h=g1;5`O&W(
z1J`JGt^t*u(jjSIad+%JJAQi7ENtxJ#?5KXWeDr+7<QlXopw|MsEBt3GAicR#GUCf
zUQ1fBuZmzz*TaUJ$RC_B!H>(|5I`SHv$=bD6pE*nI9<!O$AmvRybE88Xw7uK0j5n3
zTJ<vhjDb_QYO+F(u5ajBkD*c$YmCJbCUE^&28;{9J$~mD_<xW1g=_0YXR51|c|%dX
z%OpcX1065&vnGR_b*{Re1=h6WmS&1<%==mIcGsA~+%L02xrCgs38l2{dZmsL3u;B;
z_3w&EfHPhCNkb{j1k*(>D8R6j0r8eruofbO2#kMzty;NC;pI6<%s~)E5=2AKiN*gu
zqBp5IYq=-K31<!XN32|Ti=a<+xSmd46+xLr(Pi?T{Hgt9x7uy;jTrD*Z5$Zm7zH(W
zDV6i2BIp#>F_7Z}uNY<Bk#B8<I}oZPl2dpL4;mvE-2-4wgi51z#|=3lBQ^JU-gDdN
zWdzS~cx&waJN&2z<J)_K3-7jeRbsy)7W`DizL&x<1k3<%K_&wKgCN@pJ*wI*>0*@E
zud`EASbA2%f<U{@=Ae1=c2HuyFOwP1_78riB_k5bD0v?xgQ5t)-8nJ=L=?llE1Qdn
zxMZ`deK=^Fqq=IkU^|HPwo|E0*v2=F7xhNp;fD6lH8tqNb_{u0)>*yJN^}Q=i}Cg?
z+KRogj5QXJ-sgdP^2g{Gifp!7p$QG0w#BN{___pN>>Tq$7Ue^2dl#hPJq$#cE^kLt
zYUO}6nJEp^b>jeS2OP9mwuyW4p=Pp~W;PqjgDt7PTljhW$`K!040QNt`tJONvq3ei
z=bx4HJt4^vCSn>~je1`bkK|L$A~TZ%B4cAU2E!l#`K3@k(}VYcW@g%B=4B@5ITwyh
z+j{45WR*pv+H()?P9C@){#|A)X9{VDupfF{WvI27F%7Xca;qyc7j%{X4Y~ac+mptv
zD2=}s@<Mp78W@|;h6r+WIQdc7b+t+G^dsSIc}MI%e_(-PIOS#gN~FnL@^5YOPyGup
zTdWDdEisWu4RU4VP`cAm+)u~$W5Q66!T1~Pd40unU6&;)Rd~Wkn8MDkz5!R*A!%}g
zhTPnowW%}HxHv6Nt+lZ~MEww&r$<61=-*R{Lap}#i@H7ar!^q50ny&{Jgd;4gQVv1
zUs5>V)>{9D>i9cm(ksu5%HJA(!xekJHZe#8O5NESuX4BF*tywkAfDN=FlbLI-8$Tv
zKoUs%WV15Rf1Na%eG-FoPBsep`EI=}$bW5Xr<jI)zF(-ZSO6IQSRTQ%Cz8WkRcbUD
zug055C)2@CCd*j*IspZ<E<a;s@18DSo!CS)l#b78A0M%Cc$}}*WQ)stxul~0Q-l-&
zj4$x&&VpRNp?^Ni=wt|UT$Q8qHDL&~enx302Xk~U>U<5cwVc~&X#21KI=6<t3Q_TI
zPx!6^SVH-mnjlc9Cv+4m8BCf4v8&aV4#XOKgZ&9nuT=k6?P1Z*V8}T@*%#O{(mJrV
zQ#BfM2m`s5`rcP^V17+Y9M-|qy3kn)_%M|&zEu0Oimf9kh4Ku<&bVQ`xJ1gTcJ9?t
zRyADX-#l51s0EBN<aB7VaakYF46;Y0^!YM;Cc#STFsW>7R_1e+XEg!7l}>KI^Y3h!
zHViRpm-??-p87q$^z**D0DV$lxt<<UXu#Pp4VZ<nWy!8$&|(a9kvdz$TWV`7;Ma+j
zo5;pa6sppgLGyO$CADYNl5*xt?2g-JLzelct-TLSKzeKEBKB(K(Tr{5kjuIgoGlKd
z_zXM(H53!ut%h<m+u???ax}KDjxy9*A+-7Tj|vTIQl!qm7CX1ywGP|~7*etCYg?ol
z;=YPth#Tt_#4SLf#_s;AAM5fSFd$)n88YKYzg#O6mGe7JF6Cx4MelSDzxG!lDVF>C
zM`|FG69`zCa=AIYT&SQMm+eWO_x=J{E0n}7{uUFMLx?YXl^wU4904agw1~~OE?nNq
z#e8r($IvEO!4x%V{{X8!qe>?<yi)+B=6XY;?6Vb25@v2xVLf{mq~-i?KqIE)thyfD
zU#1dzg`Hs8ttS^a-fihf+kL+)0-K0<znM7?HD@|eo;<Pfy?iSha{^Th!`|5?2(5&C
zt2k^g-3eOSe)-6zL1WhfR&BwCO8iO-rdsocE75taTG*;QGw&66GLNOe-DjhE=UnAb
ziG-u=uQ!{evk+a$^1)SKK&UPnGY*mgTNN-{737XsP9V=mSBOc$f==FJHblt7!ECCe
zTPPw!+;wWJx{MSkLQ^Pv)!<O$N=vftMxh8&tf<V6!LdlLl(Pj>mC~|uR_hbn(UE=7
zr*nqC!DU1cw%V7Hr3MFz>{*Z>`{Afl0zwpfjOlRMc@ozc66&5jz%2)>W36y4>(zRj
zZ*v%`Z#N-y9ZT41x4wzgO1cfRselj6_Gqu|sv2yoweNnapu9>oYnZS>o9q~wlAVz*
zTBNl0)qyms!b<1@FMe$(vNh!`Ep4?v0J<T8+|KeBp2czl<5HBE#d%hz2=Qc+qLnb#
zb|51Y$6-lyZ(_J=ioygi8XzRPz@;rBgjhhQS_1{mKQ~0o2AySUHQ^52MUgiOQhOFl
ztkQOao_K9XBtjBvDoaen_K?4tFTs-*n!f*L4B4f1G>$^9f@*j(!iH!wcT%(Y+17Y@
zW*9%RwsqLHuK!m};2t4Ir69v~zUtgR&>~}{niJnzXQv2+nzBzMFMwLUtwM@P-3$;Y
z+f$b?Xb&S<IGt|K9=J-tB=cSaA*d;{-nGuQOg0YChZT7_d@knYAI1Pb9TSGrVszkS
zCQS(<gkWePz1BF?EwE6|6etu?T>n%B1-*KOaPUT2(_v;v1<m$K&U$GFQ<|Q%pv~y8
z-gzhV%AHEvk9YdN_yEQeedoUpxn&-GN0G;ZB(7dADXQHp4@Iv1gyKRU27i*w^d8mR
zNqeT^|Lroixc(lsX6#UvENgBTT1ybRGk%=)!|$pO$^I3K2TE~w7V9tmTz4@OMDOD;
zbJig;p5@WfL*MEjTyC-zM16U4G;40vX9SntT`Ij#9xZA`S_cp(wj%YI5hvyg{3{)7
zOu|QDah9qywaUlZei7oAPn_kZImc5zE3cdn;DwLMhK^r0CoKO$czo+^u*t^?>wQ#J
zhVzzw)zxe2eh_(vL8hCXgPP*hN)?W9TkG8&-q2;{Dx>@h9Zn&()a94{h+}PT9j70&
z%I2)rFZ##wL=Av*YFDQ8#LUDNBjY02{8yS5#9Rdf{=c<9R75>{*2S|e_9EDPPNESZ
zzhx-(lTJsp*qP_yiwwQRHfPB9^LO?>FvZE4gRQp3C`X(i>>E#3r@U&J`8B`%PUmVn
zu!}gcjNtx9_BGOYvLF|)m!YFKk+;ML5C)zWEGJiKYD|V;7odZkvqYDky`97pa4ZC=
zAvCzQKK8$AmVF++&Y0IE15hi}xbJW&z|+9YfG*IA7|ljQk_;1>9Y#M^5iMdm)W-PO
z!@T4WEqqJ&5_Hj@V+dUwaoeq41^fHYXbD?5=1kopyz``n`0mbzi$W6yI!}vL>G3kH
zr=_~)<j%&6%EiZ}J%`2MQI3mFlO#G%n^miEUG1l}y5;1~riwO`YdTN6RnPG)?Wkt}
zhOFAtRGn+GYU4$cNj0sf$tumbuBO`L&roOmMV85RMb}jY6#0U#=F?c6R&r<UMU;sh
zt*6l{&N%gdhSZZg>+lzn4v7fh)nWfMT_GI=4>)cxVwa4xpM?&A^)BY({V~Gi0-G$|
zf2+vtXm<S<NZoX5PWz<-+Ekfs31IN{JYARG)_r@LYfkCve5fq5v-9>mzrI^)PI()k
zcb<e9!~>Z)2Ae$;bmrEM@eIq=)7vq7sdH-faOUE{0J*HpTqJwIco(Zhw78fVa7MOK
zhN&{zWYYaW8e-BCyS?(nEL_r3-Kr;Jf~;^Hd?rP}2p#G_eAvl~Eoe$q`=6r4N>9NW
zfl2*YzhkJk8o6?}XzpnfxCgq$F=vm{>Io}eYWPuP1}Lhak>p;jS>9^zMznyr)Aoq&
zBn;*GY_df<-a40MKjVQcm%P_F5AAhLNB>>)>}AZvFR!Q(4;`^dZ3C%Ve6!P%_f#f+
zu|FI7>6cCGY>2pe762@_ipX;Q*MRu_JT78mV#oYY2m0k;4pqeWvd=H6#qR;_+?9uN
z7Zyv-dh8r%Z-x$Na#>?HRKh)D*Pg)Ng;u}vlLDw@XN;lQ+?;FjCuR9YhGD%<NkD7O
z6#m&JTTwt6Q9#+roG>+x!Eqz}d_on{&ldY6ksfdfs_i>GNl-Jc<(2Rihj(5ZM1hNT
z`B8^f%u>|nfGGiMjn^`M!cQZ@fgnwu9f}pe7l{8AO<XG+1p7%y)J0r08vL{Dx84^y
zdyd$8x1>+sW@k=?3v&e#a|)@{(ybBHL~Hmkx>dkHH2DvxzWl^PbMb>BX^*zI3VhmI
zwD@Bss1X+Cg>70g0o;Qa^EK5)pb;T;Ka+<r4&ZU=<Dtbblh_>I%cI4&4E0|00TiBf
z4~jer7yN*9$)JepN3C1QE?p!BVq+)Z=W2U-Z+s^Iz1=2O!l1}yw*iO-Z{nbc^N<KQ
zYp`DgE&bTuKYVt2OUx27TKRQ-K4ezo%QHOR{9v|hy%2TrdLzk>Xu_2MdrK)*Kq?X@
zR|@BieN8H<jXLK|uvUV2v-<gdtmu|P@npEzp&@entV9R36ZQ_w*4c;*#GWcg7rc=M
zL$jkd9JRguXZxP$VmHYL*Wxu?XZI#!s3H<TL!u-z)Y6%JIUc=_2WD4oqiL@Ry}7c*
zX3&PlR@=ezZm+4c@RBY|8T%|6fE_(61xndM;))STjKb`Sf<Ik&_#ft}MbL=P&v?c{
z0|{$DPIQJ%oFiXx)~O%eJMRc6XA9aEV*oCwZq!pK=SrOn*9msBW$UE3*(cv1Foh$0
z2jsM4WkCytwF4RTguT_xB<~-2yFB^ya(A<^>=Jp<hfTI$&!Eq|r;?#&*?-eku^Z1%
zPt90fo1Zn<ouU&j>av{iSSB|6x$*bLrWAjTt}V^Xb%>x|45k&4#yRu?gum0Vl`hmo
z!YmQ@=ym6a@7z`~!N~#_NYS4M=>)zyM3do^n}whMbkdQP&CgV4YWriP4uSo>K9yqW
zg=!%XYGS+ivyL&_O5=oM;D18jhH@0e7`9oH27NX4MW*x?+4S5*O4a_|D5H?>l9{gi
za3Q|=9)^Mv<iyRhWz)Lo$=u+wap8&6rho}P0L0<NzvVE$*d0C;Erg;2zAJlEd}bG<
zU1vcIcoa78!D8}p`-S{Su4bn%qRjzq9y!iL;Q9W7J3}lEi8XlYyQYy9Ocr-EU9?$r
zNRE3rBIUgONMwrk>%QV|e(iiV>I1Gc&+y1|<bsFy*P3NeJ4+nKn9Y0iLyM3A=$>N<
zVBitKE&`i{?E)@U!2gtmQ&;|g5t&ppaWktJAonqH<uwl;eG9_{1_8_Z0rQ;L3gtAW
zJ8*4}+fsSA;#3RVWV{z#-P{O&H9dMtuIZA*ye^#?fNz94G3%>7v~VBdBykcOh+yqh
z29|U_sU48tb(gzEGJPiJ(Uv0q^={OL_k@PGilss(CClJrN#R#WN1O<!n6fvsFG!&b
zn1R{aLuawD1lv68T<NM1IuX_b2WA_FMeI;}N4C}WvqN1GL=9ZuS7b8HiCJqGdybla
zPe5qD;uqcg=Ns77y~q9tv2A_4uAl3s&63U6N*P3y=7l_@H5O4BnQUd>JJriZEUS6v
z>abB^Zx94aqoc8F7!wq+S@<Anv>R*<;6tcZ&=*Tx!$lXNe*jHRyht*wZV1z{VDAiK
zUvd9vK+t;Lt3fkgOK*R1WgFQ^B0?r2S~bYrQrOoZmfVvD+jo#gJzECCPmN`&w+FgR
zv;dXw3kE7e^yd)skJjyr3X&CztR1VswM_-9q;9i#Pk7r+4u)M5SIt1l^GFv2=us5F
zP7XakP%2w_rNoGsM7;YHI8Xn{hdpo#>A#NLAoJ&+N1hzD!QpPWw@HLwl89~kll5tE
zb98qKq<#mL(Ut|rg;6VR+BW-~n5MBIBzh%CA{03UNj9FQDJ4O+yt7C@^Vtg$@6l{p
zqm;6LXlXt*xA9nYopTV#l2=O$P+*rR5?}v;$v9187Iq0!Kq`5(J~pkGX})3)<>O&d
zX{iTn3v?b)sn1kIn7RN$ScqlUSM3`z{BPNI!}BFxv)Y8k7)@TPpB!zEE3It%znorz
zvME@(kGBwE6<7QJ&e8I0u@-sBQ*{?-%KW1(Pp#bYOPf@NJOEBxrQ2@YI+2S1lc1^p
zKNGZuVY~m6ptZ70*lGt4fYQyaYccj~bZRq-{NBfym?@sGOmZmtRwAIwG#5cJumx(%
zX_TOqEX)_NR8X48lucmdZgj<$4N%;qshL9q628RacrG&pD42zevqnpJLWVceX|LD)
z2k!8T7_eIw;#Ve`X5t$~HKiB&>qX&z@o`le9;$haR>Y_g)`EmhF6JS3^1~S|u-rGW
zUY=+uURk!rq7vCMSV$@{+lx2h4J3i~pOji~nO;TI&S*J%Y|TdLEB?{;)*JohlF2<{
zIbp+US`NU`-ds5wdKTeuLGHqr<I3IwH+rnQeXNtlY9G&wjxf*sM=-qjdj*Y0S~BIm
z)D>ZTuHdOf07eBB!A@|o6mt-|(w>*uU-}nk^^C^^80AL1S<+CLw)PXrb%iQ^<(+ww
zL^-dElTxbxkt<<40(H){6yw&pQ(r&zXYkF``#zwz_6UmcGjl(gL@U~y>)&DMXMt6-
z;AWP2^lG*@S#t$AjJEgESv{g$PUGEB0lh0LqwP#+F6kXB$f$N7N@cxk{M6QO8{u<}
zn!P+{YYm|p7=JaS2LD`iuu8%fX`h{U=KfuiR4{zfb0#Ys*myOXjYKyOj=+=MR~MNG
zd~LuQxS|%V4`yI2X(|x9>GO~rrJ;J{K2bM5W$Sqaxwvr<=n0SG$&e=)r*prRs75fy
zZZ39>N=EMyqaOOCDs|pz64r3b?*ffEW4i$*1akew<a4)brmDC161ITZQ2LZJAw1|M
z6%$$2|AEDS&sir`sETNc_E8^<!hk5ZTBso=Vxjv-E?L1P(uN8ZcfsX<UxTS&mq66u
zMKSP=khAy$?*JqUeLngmxJsu6ySdq~WpNyhewoTmj3!IOH!y^^1S)C0$vMGyn(RZ8
z&1Q`|;s|;^{e)+r;|t&XYX-C)X#)8AUV9{xzwq86bvpHrqY}Z0*RK@g!vLY7ViR+k
zd$h=rRrK$gi<T#p=DD^`nF|v`2GnwfHR(ZJYIf!|EzgUzCbP9{3(um<H2e#hjHu0Y
zB+scqgko^P<8)#)1BQ9Q)0osNNb3bfJ8BpRi$CzyA-T5kq%|-_oh=pTia9Y?RMBHa
z_UnLeYBQI98g4e8QO>#EVE~Oz>#_Px)2dE|i86Z;4JkhHV$tUjybb=nA1LM{d-Y?l
z_R!>@TaY=NdR#pWU&Fln?;p~>6Mo=F$M?HY;o0bs<X3#UaJxmI{Uc3b+~i_41JnT9
z-Z6|&dh9Rk<PbzPf&aesXGXxzmH%P#9oSgqBy9>eF7UEiD;WSq<CJn<lJ*@{ByD+X
z^gOUr@&*bl&CT2-?Tff;l}jtO;G0nl3#>x_C1+Y$65E4x4KF3xU8j-M5=+6y&rPNo
z6P(#Z?GmWU&pL|7#K$V)VPNuQ2f!?4qgvq8lO#og=4t@pYK)<^R$a&*CEBJg){8k@
z;$3EUz~)Jw0Faa89DP7lUQX_B#lqKgi{v2Sw7Jm3C0||JU|@=!Ei^CfJRu$Gw+a7Z
z*m>!Jf88O!lFgz&v5<du#*TAHXPIQblgog&?Qyb<qG&G~3_XXFk*Rz%4rwq~Jz?$U
z^x&~;bQuxyIKU9crFB^=&Bm*ay6sX|vcgZhi2vPY2$-RB+V_}dX|9+hzh-4XN9zTj
zbFVFJBsF&nfE;1#$Tt8*NBiO5bVRHyZKEYiL4Q<?ei5HV&jrOrUxlH8-_~{O78y8=
z6=Ce!)=>;r8HQHs4K9OEE`!nn9ZvMiOux7c$rExZ6wcs<_KZZ0AR%EzA*Cb!oJeiy
z%HU#`0B8t?+OZQZ%wLe<sS=H!w@T8RaH{@^Zo66iD`y@3jvYcECMD&$O3fVyd(WPS
z%eNqj<8Y$C=VZ7wJlzmXK7xub$CC$&%8S9Z0q@$*Hfrd{CeSWdTog-*WfBYdv#Hzy
zSFHS?qQsmOhTPVVMox}ELXo6d@;GsoBrW&s1!!DT3YgsJbkG|xfb$N?#o7aMH@Zi+
zvTfm*StX|=;jmB_IC?q;_KlV0WQ8Xo!h|>nc1uHUf8)D)ud$!-@37iU#fY|;ELyU*
zBvrEVMRw8u#f*CBS%<n|CSSnzrkS6^_O|JmpM%EoG-_%zfY8G@Gy7X38q3PePyo{*
z3ZOq0K=|>yW2(JX6kC-We`b5ej_c+l^^F~pe0bu!700lMiRIk_k?l!dCguZq_vN`S
z-P)!ZgWA*vza2&>X=mO6uR7o;@V8$*NqZ|g12)Tm1T5Cd8}}uAw;d2JZq7;*h)2wt
zk9J;%I*Bsx6>bA+mnW$p0gwTZPm5Ip7r=al-ILMQH<`$3NF0IDIyW_q&IuAMZC!F*
z;|ea!(uQZVHxPSG#Z^QxlDy`xG9te<_yq2^4+mR8q}*wjOa=XoqnFg9U!M3>aQ2nS
z3^#@3I+ANm!~&tI?;J**s&v~LmKu*Hr7QD3kBsNsxa`vYDm!RZ^mx?JQ~lO)4Zs$w
zKMTUAK9Yf5ZXKkUhOw=asD!J)wfVQtyX<%drm|&E%RE@PJOq?&-ue*jyl^v}(|Q}z
zb5E3}=OA!|Og1HRTEL}CI(FpfMjKZkPrAt!G;2;EhbLG$+r53jsP7Qxrf2A4I|1X-
z*QmMLzKf8&Fcj+8Gp<6Zw=~?GCm`RP$^4r9SyjFYEJAFn$O}PzMK31iNZ0UJh;ipI
zOR4zH&CDj>Wnj}6jQ)Mr0~v-k$t#xlUFp(Hg3IFOua&e?mtwvrqk!gB4UfqoL)p6}
zQoH|vfLMZ8f1`QS-4dl;)E(jor9c^3;`ooGK`X|5#L76NKV47XzA*&=k)Ir~q;Av6
zEoQ}`OLRV2w?+H^fQqiiQE{f_w;z^jw4l>|0^QI^=gJ#tyyp<QVtk@);=eHDkj7Rz
z^jv<nvM`|{f>rvYQ2)pn<<;T>!ui+G>=%zEyTsI)%)ZJjK~nq#+hq@_Ztw*_e3`6R
zcB*viS<Mz`KV8T%u!6CWQzP;?wVk1<hNi*l?7dFh(Btss<kzdGb1LU5n9whXHFB2x
z29;dZsl4`(6ql^eR`EcXF7f<W!_CCZgjLyaAAhxxetW&sV!6Q3#I6cF_hT31qa7S{
z_7ol;gv{wU9Aye!6w#EtYsCP-L5CKMa(|lzTH^WW{3<z{9psPNHxspaC|P^b7Xh4Z
z2NQ|33s4}9ip9-UG1|yV$fP`t&>py;83cBT=B{-<$@paL)TZJw0g|z`vtKXhzZVEL
zlHs<eLoSsuIXi{TE<dy>C5@{R%@DgN1cj45Qi|dVYUG-}Ap1FnWN`*?)pig9Qd6^@
zWUUlOWKpbupFJgBUPa34M3}AZq0sJ|@|bizU;_YgOm;2UutdCL*LQ7ba5Phy8>UuG
z()xJM&5#9~b$r%&x=ZuO9Ro|d=@Ue-oDOe22uKet<<FXx|M8k!A**!hXlwG1s?;Z`
zDm_)LQG6`SIF?*6|7il$BT3ZMh8r%sRg3C2v-G-J+1fUISjyJFg#N#v=J^S%R4kgN
zUMqiykKIy(Wq{H`MTI(a%$S1n1pypZ+`KwXM#Vqu&oj-O+J%9lUmVOk|4ce4XbN&u
ztD?1SBKLjG<V+p`JL53$Ll)P7kMImXKs@<=0hTd(mO4D^#`1y`DICQ?nfs?A5Eg5k
zSm%Zxj~+Ss4?K9p)DHv^683l)jLfr@=g-M|%1r0qWFj`AKN21|*)Qa`E_H#ZV6N@k
z?^5NU44>Y-#Z-sH%L6T{xKDq_m#oxmSSxpb%h4<6_ux;tp}4;fkzUCngywx51C$v9
zfPs-$eZB@)HA@j#r~=YvdLZgkE$$+TF4TW&Tx*z7ZI<AD7C9=a{yK5oF*Hz~Ds)m7
znk1$UxFY3eLH44OlH!RoGmk#h=>E2|7e0zVMG)|-wORRd_MW<CmdS^?#v1&{5gN2}
zS99NdsHijoC$IK}PGm!P+2Vdrzze)g9=BE5e8iE<S!w&wxZ1P-rC?0n@4qjq%j`_Q
zbR;&zeur*93#a{v@Y**<Bh6QdA#)IA*Y^+*V*M&>L>RbTdj8M?j1~)e{XUeZ7)ya8
ztqMb*NW+>@q2LQ@pYR?M(#y?|%9h%&==2d6@g`l#R={FYZJT?aBYy7&0lYau+kWe5
z8^_~_=CxCl9FV6ZRArR%K|{NO$?Rq?xtd=3<MJIZ<SOk4dQs&EuV4Ai2fyO7ACJHX
z{E#3aV}~Oc^$*;er8xh7Bd-j`jbpN%{j&89z(QVun*;k*2y`torQu_MLzJf7BYpm4
zb@;^MbYtPja1PvnFZct1|Kk5Q^myL`Vf?X1WX`w-ok&U4Emiewv+>A%V_DBrUDM8J
zWo71(%^g66dSnlOvksukIJb-cX+U73DmdShx~68Pcog5c1Tx!kNfoi@8K7#pbO(TL
zK6M5>ac`%J^D}J*8h9ol%cQ-XCAcki&j$9V>SohuLl`iO5h8(gGTtns|6Ra+L*uLb
zl7bZ=)9sYmpizn0liXfp?rR|FJY<v-U>SQ&^htWtnaWQ0rj)w^?zf{u;yM|9rooZ$
zGvh@m+`(hCxd~*t4sa1cf&6!jJPW{zcl#c8DsBy7x#ajf-3QJI2r#nu1&R3#xn2p7
zPnR8w3k{@%q>~jJY$7DG_trPI9%(wE1C6p|idCb{1Lt8h1Fu{W<iW^ocVvz6X(p*-
z3hcu_ggnH;1q-_-@H#V7SStqH_0Mtr`NZ|f57>6nVv~WvX^+JV#(f=UBmzWQBUY^f
zY?0awzyAaYbr=I)nfyq_Ka$w|2aNR_J6bLDCtvga>iE$-K%TJQiTJCeVN$^~UUbh!
zDoFJq5@ZuNu~aSDu(c{j_X^prt_mm{zVaWyWq!&|_7tZ_pRwmn0@)eQUMzl$RKj+$
z4M!m-rFy!p!^zL}F=Ee?u>#IEe~G*|@}FWyh&Mc~T-@fbgik0ftZ&@g{GDFkxTA|>
z<B6DMqT}U+Qpk6P?h`7Rt#pBe2=CC`U7^)4ea1G&xP;$u{xN3M5oi%UpDptJ_n&qP
z?ns6hi6ECv&KgYjNS@Uht$wHESnl#z^I?80HvC+i5NUe^czw|n0|2iAM{})mwWF`C
z#s$$iS$V02z9pWohHXn<Z{Jq?(^lhiRj2D^Cr^;4x`T<?3@qoR$qNnhWq8Wcr8jF<
zO-CnoXfK)qjrZ|Am*Mv}&AZthfcQkW7o59rfUi@g=9)-Y-eD(iT~o&MZ2#ioqMV@%
z$fP?bi|^|LQO^s(2k`isqL;<z^RcLIrsw+;eSO?Bd;$45H$^~8rncXyo0;*!-CbP3
z6?|_d2ox9ZxMNj9>(UzC7=-n#W7^4Q!*ZeXA_k=HjFTcjdpmi+Y;}9zcFT43)5B15
zyC3Ee4mn1SaJgX!xrWJQPfX$0KJ(K$*u&9_3?cL&UjLX77H|B6T7UqB7Q=7R32+PR
zxxd!M14W!WG=U0pg)<a2@_^IdsVzGCorwgt0|I_KirZE($O-3-OKTb<Cog6fN?arA
zGmt*SJBX=Hg+<u!tcV6G07u0Q@%{BRd5$WR0tBguqHIt3ZdOU^6RFN9K0y)_D}il8
z!$`3UBUsl0fGE}kDYqI(L`=pxIl%&(@V?&9LHgcFWdjF|k!}WJ&VMP40s7My+6iP-
z^P?#i?QplhwTr_PD-K*76!(je)9`0r8U(iz=e{D%FJ@t%VY?AV3S?>t<~Q{PzR~-B
z|1JaUFak+qiBaYP4RwTc`@GyFH#%dJ`$3NW(lHw0B^VJ0M(6?Oc`xhKlws)Etp|Ls
z&&tq~q0|>*3G|@3jSQ!RhOUMqX&Ok~vT+~#U0EX&OH#FH_N8u8r7)iXle1~}bvV8J
z`h<UjZUdr^T(RBpjBD(GSP0@Ly&!3wiv<}WLZ^VfRqRn>bhGwB0W<$0wE4hOqRxPE
ze-sC}^aeYxBcNzZo?JK&$WYKd5rm{88GhfR8>Q6$Qtg2HTtNk!BguUNs&l7HgtI*m
zD^SKL9@8(2ITLCAN~P*q42F%-(ZIjbf+VYhz8LH=H5dvSf$<?t^};_X^u!FIILJR;
zASWmZI)L;p--SbTOBR#8h@Gx|P;5hX1AIwuW^f@#Jl`Z)?}A~uw|8lldU&epKFZCH
zu|`xs=I141j(+!a;sDJztc&p9AD=bmJGP>w+QttB68vYOvlAPEwl`Sa{iQYcI6hQO
zm3D@l&z5<-rC=X%hB-jG&_PIXyn_rRAy2T04tXkq8`@fmZEAb>R|G8vPzmu2Sl>>5
zpgWX)y7}==7tb^p`=;?&FA5<H_earMfJu4Ek=?fgXbY=7jrR)G_9tF<9@l^16_Nd+
z35$K6d^DRS2G<LyWAd{zjyc{T`G&>pz86*QQmSu7+`l$(`cH38MNH2!0K^~R7WCx^
z$KKwaH9sz9zdv9<AfM!Rv+M-`|GiF2?&e&wg*1GBGi^A>Zn_Guj_hPqTk`!TBnaC1
zLH&Ii>p1RsvwPBEcsp3lGW4ul_l~YuyMK5s`8Bl8rSyR7!;67>6NcJVyCGp+i6Gq!
z{c?zTyE}2bo3<mr6B(ll2fxXDDYRje+1cF@rN7g87~QL$dCM|~{QU^XaI(oM>gJ-Z
zAn~4CILjd2vShEev1!PVHS9Wd`rRTEXZNLWXtRMoy1aATo_|kmIPitmS^S<*IcMN&
z+vABwkbLPryDsD9;^g$;lwWwg!l?2rR;Bo&5}A_a8=uq5_3~<4Z}NI_zE{P&aq&dy
z8W?T|6QtY$p#Ls+8RamwB%WfyaLDxB{&DAMwWyv+$H#!ETUFqW6?Sx$xER{fjr~x%
zmzLb%Nz`k!WN*fNY4##&b}^=Br+Uut&ppu7?$h@x$tNUkm2iyoiopQ151p9a)46DI
z{GtOf{3~B4c-{Bvu9XsT35>&xzP@H`c#c+du4A*&S8X_rR(XBaxe;^6W+9`*a03XJ
zFnpWlu!Vp9=a$ODvlp@|Ad<3j2}}WiCX2XE`SHvjps_Y9L|hdZn66)??e^aTt8MIa
zw09$<<ke^He2L$L5j$(H`nViEJNtItY{30(g}#k<c3vG($<%hmyw$Hq*NwNe0T$Y^
zGg4{x`$y{a6&BIC`k5d>d5AFc<C=h(GF&`IQ{v`d#_d6&Qu&~;h)RmMf_M$+@{A#L
zNV(%QDV9-q58otKqE_V5f)|0N6n;>kd9ixTOW$()-G_5@2gac3GuIzb0W70zbl4l0
zde#6avhb~bb;S`4?^?OX7IUcT4A@UR%P)=@;Mq}N9X8ecO(3(rf}}z^uE1LFr<2!+
zWLW={hI@A|TYE^!=D|FP2^j`}OK6eSrbe}>tNts>>`J15@}M}CI;J)HW>SrZhi+Zz
z#on@Zfp-@-#)evbL|YUS{#{AzF8xh~LTk#u9p^>0J#|Xuh6h0*42+%*w7l5ttZl1d
z0Q1976@k2k&K3LW?wS{|2l4t|jNjcqW1zT$)S(VPSV*BmFuNY<e+dFO@xzIpIIhH6
z&zL>kPU|NVaLGtvsP?!}$8*qZPFpbxvIcfnH|_Q(L*{TB9Pa<yN4&1i%z<M4kt}@m
zSAe<HSmaFB9lii9?#1~9PfO7CGn?a8AT^NG8MHQ6Mi#Di*ev7z`XgwhwS}?c;|`WH
zRMIVqPsK}Vl#H`_9DsoiMs(A!-y8XBLrPc(SDb>sP26YKl7G_qUIoixz$-H#2ly$v
z7d_$$+%<exrFON#ifwNaPmMl*VOo2PJc8FxAS3BYstRL~H-)(@UBX??$8@<O^{pL#
zh`OshHux{ak<MfKCn^2S2fI4MA%Lb!^#&MSZ;FpwZ6G453a}*uh!qae8QH6(*F~RB
ztw{KOZYoJQLZ{RQeq~$^e=%ss-W5b;aM;cM6Fkltee!xrRUbOV>*PJQ15IHFf|!`A
zTs@jt<)A2rEP!v)c4Kq{|3c~W*&u5X7e|#I(T%ZXO#Ek;jBMr*E82tP88yRC!~#UA
zTwUK%EMSQP9l&sSBA}$~@+`UjO|lun=Ltyv5YY4Xc?zNXo?cC0sQfmw`xKad6_@gc
z1ET`SC+fVd9J+i>oD%i5_mPV0gM;##eGwe4yF+i1A-Te_^xQ+FoxlnWw4~mgKrOR#
zdI|0D@^ifh=p!(7J<P^+SZQjrf^kC7!}XAXI355a0#FZzHsbL^c2>K;=^i%*wB@%&
zDczo)&|kcsQX3D0Z0m%DWXyI1W`d`w@<JWP2BJ_wyr(WHHHiIz{5I;57z}!TA!mD<
z#$ehO^_g=TB^KZ7v{)z8%C@D*(V)I1&&iT&5Zt{$4UA9h4`fnZ{A{dA&cvxAl911*
zn$HcA3aGXNf`+y;-O<ecih$#bb=MDMIENUPUb0VonIIYlSK;Rgg`THv=Py2n$&=*l
zP$EzgBsqZDPJK{eT1L+06i?fxk`NUSNW~)1BcVsyPyLZs0+r85r{>cc!{S1$1bxvS
z1sKB8LxC9dwC~Xg3cx9>LbcGCM|(f;z=Tg>0Zg0uJ2VYlp>6vHo{ce#fCfd#6e|A^
z_z`v>I}T)^E<hJ=g{@4f(0XLA<!kmHJUaR;xb8g$tdh6wQ@LL6+6T!6iom>ZhRTzO
zy6HRY{F^8IU?By2-8Ll10tH7k7!I8b-Z1LU=LHl|Snm<SIP{?ZZc31Jc`C?YD||4c
z!h;Dowj?A-6=3xJYMw#w!*37Um@K}I_jQ2A?S@N1xd&zjK1dO}2PVb6kj)0J3BJ=2
zDGQfR(+WifH%P1_!$hfrP(bfZ3AzXN!k2*Cj}6T*4+Fhg3CSM5g5AnGDBDn;aG8LA
z@<tF$A$S1B1Grje8UlY$G`RoNaSF$}MvW?0vM5_Q3r;JYh{%MVUS-mP=uLOP)B6XG
z-|$;Pq3`pyYp8ZF1OH_eZ(Mu#CaCD#m>}OH*d`N+^>z8yXR&&!loTZeSVq{qPI8U(
zPmWE%dv#dq)%T9s*GIYQ+t4E$`^H6yJNj7-=BN@;17u+i+{-eq|1A=|Z(7%!1;YO6
zMyl(?8|cLDqgz&!jm_k|6&2t2cI-M$Wr)0y?_2Ge^%_*9WZd@KQG(pTw2#GijkYnK
z>9U);ho)DG)#KL6!|lG?l9n`#&hnWI`M_a60!46%lNzFlp>d{hE3X^kf4!sml1`R*
zs@;3h1e^u#cesi=y@U29eHOK{q4*;<Xn9U~BS3&66Wk2Jp1t*EKz*eW?u5X)<oiL<
z+Y`3r-dIiaNZa=1?<joi*h9F&5&N$SGikgahYF8@lA5L;z;2Iw9(gcfi(b`N=GlKf
z?(Ct^+4s;!`v2Ym8pe9_tpa^c?KRK`5@s?!1psmHA`l{ls8b@PlnKHeZ;G(ofXx52
z)YER=Fh$7|w+Q}?FF9)2X1osX^?iNsus~M&z6DZBG5Zu;;Cm@pJZ=V?HSwkNo+inG
z_t<`^6AZ~fBCc1R!FuEM3u0ydHNWUjEGI4di{#0T=T5u~oH;e0ws7(mVsl5%V_FJk
z6+6|ddd@k89-`R~S75Ba&E4Y{`|)e5iiK#3;?vLLvF6a7zXPHxa=}tKGz#wNNK3H3
zER4H*9N3y7$5|Ao$4mMEtip*ucpW#~h-x3#JfjPRJdPQT-v8oggTnYHcr@CrH<<`i
zqWUIyxb$cr+M~50M`W&*@doVQ&EHD>2+W|BCs?Fc=%fK@yMEqV;G<yQRFMyah=uH<
zFZZA&0Os%xv7S=m=XyxWND6uaeRN{Q@Uggs9axsW6e{Vgjj*jR><Ey(<pDj5>(Ox5
zd}A-MP@>cT<qLlOF6^d6B-wM)bnEP%D=S_S8c$l{z#C^8YM|*L=y2uL^un5eyfzCb
zKvlMZHyQ_9gL-O8Tt;VKn^>-NukoYJ)XwG@kUxgt({y#=J^1|+&xz)Mz?l-1fWV)W
z^Ih5h2h05tds~;^fRtUMwpkbLmSLT4R=jgG__}-_Pd*J<!Yj?80M+08gaQO9@@Fr1
zDtL}{TFPxTYz{-z{t4HSpos?XdORYuBCL3DDZk0rCDxaDcl6~0iQ1Vph@3Y(RcmTK
zKv^V(E)rToW5336(2hge9n>D<HlYw}t8p%A9)zuZdp@?C%c$3oOrb0YQ>%gS;M}a{
zniAFLh7mcj{`qRZ1Cv-DH~!v%d&yf*SOa6?-*^2@X`QowOyOsG`_!tRG-KNe!}RPN
zhnQwDjvj2j{PUzsrAd!};pvH;6X~Z`0biuJ2$Q<w99VITM>uhIwpTe?d05O0aXnFv
z+JYmuw<qk`hoKnNJZFzZOl6nK-`TY8TCd`7DZHMB3=xTL_}|q!0#D1<w&3e)(X6Q5
z$@hF+6l|}XI1m=Q_cp|g#RSg#uITrJ1el*$s?}3z1;=RK-m5AFdQ>M(Zx!y>05uuQ
z(KS{%CXrz3d}HofT!lKmLy5uHZ`7SFnSE$A9&P5VifR~$gb3uy^g2Udv%$XwObZrc
z0z)n3MXb^*!zU)+s!l2s7qdqTU9ykn2<{adeMiCxxaM0R3W6`6nTJ8|Kj}87G|=;l
z8;g)7Hx~#<>b%^%W~l<75=+}1Ac=_|N<{~$8Q$I)`Or^55_`HAo>T_Ec$k=sRu(j_
z;5D1gkysEubCv`nfEjd~N?`1Q^*T&HGSS^8ad!ULH&Q23^@z-X-b`jcP=`53Q&<IU
z42B_;`3*wXt>5JO8H&k@=J_jAN<?sp=?gk5R58c??_!C(vitjUsRO?};L;DC?UL*Z
zmFWV}5$lrq>;B>bQIBsm`rFI;^ZWh$8$iV|7q%zg1E11Y<TceJdxG^5DCu^0_8?0%
zB3na^j7gnYh)z#6v{FzG2ZNIz3B~3dJa-VEw%(kX4O#!dipz`s5!r4})gtQSmLUGJ
zNh>1YY?V?=#b(=EB$fSc(=`Jj=LRtxzT9H=BzkZ1bs_q4=TO5L_fM&V-YDtyew*h;
z;`~Fv{qNJ_(JSENFroU#6o36*4}FQYbMl%?Mw1vN4V91lcgMl;)n!DpolsJ@J1Xgb
z3GOMJfLbIe=>z9ugfPlJmy-!^D{IQ^8?Xex9S3<pzpd}vdqn(H1S9g6u7D}KIz~m?
zQVN4oP>GQzk@(0=f69=5Zd9t<{cDrPK7H_LT!RpOuzG6`_+2~mIdIqgR|^9sv0mr4
zZ=Ph?9c|iZTPft9y&_T_lOPSa>OgRvs<dMm27hcfbhnpZp3shpROHo5(e4jPe8D0B
z^01vjnRyfL(F>I}kr?3cP3-M7D*oRFIr=>yAK)2cq9|;h4U;j=bC!vEVBi-&%1!M(
z%~fgtn>F>hebqY*<sb}7wJ*z}5?Ufvp97g71MaO1Nn29<kb)Y-Ilez1zrC_0jt+8B
z)Vy*+Kc-n(uy(f&eIZ`I%cq;KzNZNQ0F&$Q&(3e@t8`qB9KU9R#2W4JcBSwA(Fxo>
z%H}fq;Mzb!pF(5aKU-9H-~$4ojO_{<5&kx{G~$$?IDdbKiyvaCdyVE5)GIHhF5odw
z9H?<%>#4}Q3}W6N1NN_0!alxV_Zb8LO8(yf>wAIA>sJ5`DJRi{I?#KoOx74+Mw${i
zU+L*n^Me90d3~gB*d9p=Xt&max;CEs{B&MD+p;3Gk%m246q%U5fY>bFOVv9y<iJL$
zS4=us&j43eklhF4W`O6>9j5+0i_@@s96%43&D@BdQ)gzUSIQ6(_E`4>6ZX0=tyzc}
z6vLYwI${J|%PV)AxI_O=Ier2_<YyjUpm^d4v*V=)B8h>um$Wa|YL&iSkn!0V%4IUJ
zpRedTbT$*P6--%?U#~)YI)A1NUhQV*)B0%sH_0akeH1vuT&f)f+F?ZhV0G{rgx;l)
zo%k&IOTXZ!oQ{pjT^SgG+4B)2SUb8uNwDRZ%lPhIpHjE|*Y2Jk*5C|qZKAYnNA#4|
zSou}iU8r@)BZ?|8r3>)WAqW>yc{4H*SiI&<5sFT_wot6+di(YRWq40nQC;nB%|GFa
z+#!2na(p$8nX@>&-94>HW+=%^>}%96ouEc<z@i#phe`qhPexor6{7NQSU44NuNd<$
zq+UNN;_9rl9!|c@ych*6HQ4g5@n&-c(Jv?HwD@DRELxmOt9tsXRrZkVf_mXWFsLhb
zVBFq=H|HRDX|VRKe0Ux|;vBELPJi8fjxQ5ra$IK;Y;}7*pFK9){Y0IAw>rV}SV}$w
z5V~I<FP;g$@jpK{I^TId-?zWli%GubyK#N)&tuFe0A4P4bOyX>fVbDt&Dq)EZh8Ul
z52T3i&M1CwFL{Bi@6U(p;)_i{rqBI0|L50sG(tDm_xte0`2A|}^w-zvO~(Cww`UHX
z_dP5i#`(eS`1|g({=xNWb$H&6-}@tkaPL`S`{O9({R<cyaJ7CsMeu!d(9LtL+XcAq
zZ$D<pQfJWZ`now=S7+G1eKoEh74eQ4C<x8_`kXhD2r)FjAn?+EDYd>|=eYj*I2(*e
zspcY@-tKTa?eM-odxTuoHTbjQB+2@A-p%)ZwFrBBIqo{W>Z{x3^K~>>z6^-dOQQXA
zwcZSPA9H^K^oMkJxj&!v1E|}q)Gjzyn*rYUUjg?Qk3Z*SxP}h^ygr6si>Fu04Lkq7
z4)~|`V(EqSvYZ)CwCrmaHI}GY8isSkw;a~#wn&d?fDvn#GHB#}7`(Y1l_lp4hL}mv
zZoOQD1_=nfiX>+W2dmX{#?fMm(Fa6S7^P1;)dT_(@q{_PXtd|e#^&u)-*BmedrHPX
zP&n;B2SgrjcJvV3`s(T=zFq7akV|rwR1cBg2Fcx#rQQfQb@B1NHs1bP`I$|Grg>+R
zsl*X{v_<}N6uLMHw`*3FSxCvKA%Lp-W6?UYOAP~xVKaupxRg_a-6m$6PNXmq9_U~i
zWlaiDt>Dr(q_rUD`tq0@rS|MJh$+7QY_nuANd$P^{U)C>cs)O32UY%7rlmbhg~agB
zJQ^6CoDtvpO}L%K)T4P4+y&K%c?zw;KD4Jj9y_!lO!$}7Rv^TQN^8X@SwZxr8GTw4
z1OdN>Jo`Sx&<rGHxLZ}WXER@-xcmE)<i-<lLmU3Vw$9>viG8Enmnra#2hK6_EbpcR
z{Ia`AgM^Bu;2;7u1A!Q6VpCG#s_CP6+S*$RL8-i67g^Nz-a}FY?U*8nA;RYg<^yO;
zq8ShY)5~v$S$URgdhZ-K{S^EVSyb0um5~o$7;eK&ynLEhR`$`?K*)~*)tMV|F~tBB
z35;IQo?0f#6v)7OQZ>vxTbIwVO1jJK_(NvZ+v7C310l?zuS<a>F%#afwY*GDw<<rp
z%x}J)TI?26<Xq9$W!h0^?$br4*o}NonD{1C1L&uT-UlR@mi-(VYysJFmYU<%t~vN6
zTr^E&Z!MrB#U*7yAoT*D<oi!i#*=`Om_JT0FXklbtAlnva>dtIPRV#l^Rb^kb@1Y!
zKX;p2(FteK`1@d*LnDf-%A*0C8slzhmdu#ZX%FumjZ4YHEiI{6m*42@raM}MFi(l{
zD4LaG#5HnBaoB3ev3+#jxcH{lH`L6WG-EZgW68kiEMj`Ms&d^D_zC-h9SBfA7QT!1
z+5Lx`f&avF+h&}2kuU7*>`!<&>&m&K6`a2mBEeopKt{MS-e#XFN$XF5u7#y+tH>=W
zO?>l+2FHdGT-Pi}Cc_P#I|e%?<lq36TXSc~u?|XYC3+f9U0Gtdho;UuK`bo2qz0BK
zm3q&EUH{|2{X66P;p9ZeGYgQopf>c)Uc$8|RgzdW@30B8S*kqp7Po4@U~WoP|KZHk
z=m;&c^;U%G@3Xl#fftb6U~Si5siR^t4Ca;PJi>^D&hu&E5G}1eCSO1Mpo&+uXKYKS
zg^euX?ebxsk3D1^JwEKyjJNS|Y(|j%z3BdR^yo=`*Y$mK!N8!$$pFv;xIO1gy>o2)
z*k=oP!gfJ?f0jO}f8SngT9LB?Ue4Q7uD{=o+A(*mZdAD-UR1~^IX|!3uagQnF&m1i
zVk(g^vW<hs9;nM?k)it!riz1B`YMQ5!QVs4<0jhrfvB0wVTI_?{KDXbca0>^3A+Uk
zu{#fH{V=sh^bEeo1_9eyC3%^FLijLVOrQV+Y|+r+y|5O+<Vk;=sZ=mJk{Gc&d;I+Z
z5E(3MNg;bQ+&KQE*S0|Q{c1a(mn-m4PI^O{BSo@>-wC1z!~_w&kt`O#Bg9@Rq8$z0
z){v@pd7X~LZ1Z;pK52+)HjGgkDtRh1hrZX!iZ5>}x`GlcHvqNB5N#q6&0wPLU{$N>
z6xF~#=Q#6qOx;MzcfYC>`ggXiA>!|11^I2ejONMBb{fk_fX#7HS_CQhbx8W+1zXLr
zncd(yJCG=y@r|kPbUFY2rH{^LuG&@Z@rQP2js(a`d{f+fe|B49^jgIclE5MyW>b+T
zA(QHi;}kSz6a!*A;+4O~Jco|j4a#&A@%h-5an{*jAI7bRGI-h$3J`Vkah%x~dSjPt
z!(PlLL=LX~x76nANP|u*R3L^MqYo(|dTet>>QWce`6`gD#)P&0PA(3mbc-E`9t9yw
z1~CF*0^DDLGj#>{3z-)&9;#MzDXUdb&<rzFyJ$r<tN=8Wf1_{bC^Be>m09j7pQOhQ
z5(w2+9l|f9kAM<14SI;y9~|9+I`Zd8dgYB@^LAEXz;~08#M#$U%l0z_S{k1I7XV;D
zpTFcDtA^6^3b4nM#zPUD$(aT%gnRQNBK?+%DRWl^^7eRxRc<KBS(JZk{jCod-9{%w
zsD^MlA$?Vag(Z}of9J{uw#KTu<moQ>w@m|nOVB&Cz%)ior{~w_bI!Oru56abv&_v@
z$o46gwfZ%l`ouwj$B{@pX3<d?ge+bz2m@3Z&z{TAeUR&w{j<9Drm1^}Smy3)=)ZSE
zg1XHYO9`Bh-@jZv`I09uQH4cWbQrtos$%%lD7mbSC0;C9e-dKqTq5S7V(s}1Wt;n{
zvNdT>PdA<_@>4#+jC|HS|BC&E6Vo(-BBlEGOfmZpesOBdA=fu5m<fZE#dV>W{N8m0
z45fO%F}~iEQ$UeXol*dj1qXxFe7`X@g}CT2^y_G>ii{3JpG`mOTq6KF7uKCH>rf8f
z!M{Vdv38hme>S)LRH55gglLOJY1|6@9%r1K*%e!#rL+WYsc*X^i4A+Z`J6Mm&nvGJ
zWsejLt9niAXs^h@!^uAe2hA57zqvb(0W3r#y3;FPZz7Fhlk)XfI^I0RYAWS0Ds9oj
zG`UNmB6+=<a@-Ivtttwo!RV#?qC70USY7Dn3Pz)<f5BAd2#}Rs6jR&MsB#LZ$WJEI
zZk@QP7^Ot#6^wYsr5O<7h5X?9Z1z|P(lSMg@O6O;@!3aC;-{~#Mdd=SF|qaBc>Xbr
z(swS=JXC=|K2HlQi2@t>E@lTB{Bb*I{c)$D^<vqYs)-kMYpR}}o`OHKLX^lmkrtvb
zicfGbe*+hM@-D!C{h$9wsQDtE>HBB@nYv`y=x5@y3)R};1+NT!0X|Ff>|G#8ST0hQ
zRqW#Qg1IBb-;XjYh*$!Z<o)zium=%T$pTABl+dS2!8ipMOhOa1N$qF`UWakcM8-qF
zWLp=7b9^xa?<3@%r<XiS|Lcc@X@LH9#0*{{f2SspDtKNF;*#MpIN+00n**sbn}Cm4
z-A{1AJPS@tlEA&-qfLCseS<9bC$}RkNSH*<<(e0QznG<;p1>QKXZG+0p(~zrhs5Cf
zF!12|h^56s0tC8c-GiQY0v8K{7AlL|$z|eRp_rb)z&r6|;y+~r_{(43z5L6w4=<g+
zE4+L5`iJkHy?gcH)ywzbYw+=4g@YvKGqDU4BC<!U*?$;CJda8kh}-+em(mFWC=gCw
zrowcv@tB#HBT<h>r2>}<3IZE{u;v1Uz^y2p62@CSyg~t$p_JE;&od$~!2f#lZfi)Y
zu@89!gk)3V0uVNHf6ZFIWY%htzAtktap#b1Nwr?RdWHU**5@zmWtsXzB&>JUigELc
zJa~cy!c@U$S!2*?nq^UJs2TV^k!h6Ct?MVOw67dXIz{OUQ}$!JjV`u-uBNgjX@51X
znBwZ@StK7a*EbU`Pp&YJ;9S95A;c%5PzUEU)jFfj)y5{s`6&z<*W%T)*U!YPv$sX9
zYqlWaDq`T>&BGv;MpbCWEJV1Fw)uw-&o7=T;EnWSxXVz&hS7YEL`iDana1>Q$+}`r
zn?&6oB0q%QpZ)N%KmI9Y8DpJ3%VcYjcd$q8qflpw=UG+SNY-J~e6X3w!=u|y#ibu!
zHq63`Z9G9q^-J4nm{`l%24BJ_Uw)PC+!XnH@Q;u1WPWz?$4@_h^~K$9bdE2@KOyIG
z9ShAWJ+)^Qr?w^sl$VGL0yBRI#|vJ#C>?D%)c<K-kxt(&i54jD<2}FQ6#S&y%<_Db
zDotW)y4;$S)ase$>~j=!#z}?l++JrksWcBM_k(WahpX&~3;uk6(L&4e6iEFwJ5&h?
z&M}JT=dw~Hhl8C9^?|RM?4Bq1%Pd_h9J~@uJ>EEALi;V8FU(SK^7?-$wWRZuxMb^R
z4*Mvrgk><y+G1QShs6nt2y#ejwReQq+mQ~(ErJ?M{9VY9b?($wbaT-`TV&K3GtK)J
z!<PURRvE5-NtB@Dtpm8?DJc$0Co$(BC_6XRvXAK)61rrGy0`K#GBvw$vla$j`Bu@R
z(eOC$@X*`UIY*1(us472FyWOKCs4k3P=0LHQ>|%BUvAu^g*WSV)JBsvr?2p)76VaV
z6xXHv*NW9rFV}Ky^-}rmp`Mnqa{jQ+6@QVR)eD7|;^-1q=7-;Xs<2aL8syJs;QF!5
z3C}&}0wpBV-d_0Vmf52mqI_+_2zZhD#c~hOZ7g(A9v)recwv9((dP+6G3UPFInr6R
zns|vY;nlEMtwYw5LXN{MgXCqhie{-Biw!Ry8QIB?wOn5kuIS2v^^o4$B_XAblJG0t
zW0^g=C?C|ku7C!aGTN+u3VVd&PIcD;uWVx6wy-J`CZOadkUJ~yWUb@wMOODD|8ohu
zD>&$Qc?GfM^8|mO+XxZN(_i@YJ?kw-sY5V3!aCl-t<$#Ky*J6t<cjRRx%JkVit6de
zJNr`|lR5i~TP^3#PZI)fxb8PUXcFnwAMPh{)SfR~?Zt#F4naPLvu|`&_(%C>I|eBv
zKp+7WHX!Ra+mKb8a`O-ctZ-vY8#d9-4$Jlxv>&G>HQ9esqmQIfUD*!nPnzzD<S8R~
z`3h7(za-cfrVW<#O%}cob$n_Wr4NHe0vE`+#E|xUXoE0DO~Vl_V3Ad%>D9_(BwH{(
zAc}imGLtn977hES4L4+BvEMW_o-D<YCCfAB!XY6;vsMu?$;(K{;scM032!uesPBcF
z9HD!K0?&U@SbLql(fatcJcj9KO?J=xAFVac%@G62H`rb)HvQ(t-<(q6lk|`;V8LqM
zBuF?v5yi7ocV0?}*u0LnF?UnAn=6Rv=`xm3t=!QW?0z0g7S3Etn|ibOQPGwEaYH-i
zzvZv!{O>uoS7=vGOa8Y_PMv=yH+=R(e&gqVEgpY>{G+^JP-t3l{QQr(D>(gGvvf*z
z-8T{aD2vqy|K26qil8EtA%$4-K%Uf>>DL^N&+E!^%^S{R?ihxiinXXKV3P%gGWYVO
zAG%i(jxS>5J&_GZf$8~}vwG$XsqYayPirV%BXEh9@EWr!lkbsAs<wsDVEziaJjwDc
z!w7#fT!xs06N=!9p0Y3KX;n_<69$CEY+wmN{N35gOA*=|fs*O`{*_H{S670>bMzp)
zrba52#;pZ_b*l|6QCxVy0#R$8m%XV0o#$~y&Se<J%;*=@exf{`)X@=ar2!`^RjOr8
z5f$5_&|lB7@2groRK;U54(_Cc)U+em&?SGQwbL)cW3+}tIZC_7{m~>T2*6El26&=#
zJ*9|)&m38VtM%^V>PFTQuc22*l%BrGU(L3V#xW^3m~X6|vfO41uYRf6>gw_4sYyTE
z-tOvA<rwNM#1)L}*+Tf51vl%+$h>PzL$a<AuzY_-9hRTniEp=EBK&FD1BPT+tq_01
zS~_!IzzUT>#w`586`SD$uCVWKHNt;&To^+?TvR+&^&az$pKQAew@?6T*nG#PEh!L2
zp7iVuNlE$xj|-7Akp5lGRc!>`Gub<vY8J46k}t^`20Yz8$8oW%I18#w<Mg;OpZgE^
zKXo#MT!^}@X)K+GB0pTOcnw&{tJFbDW(z84p>U4;H8_O%N{TW<{E~z>EFnxt@B#-s
zRiTK`Q&EIUgn&St8i1lDS|I{`p1)rq+0Zo#WR1wxC6+Z<mv9jRA%FE2CFk&h4X@vP
z08nJlc+T+7a#OI0U}ej4H5<h|2<OYYm+wEYls2KrcJoM71mw9kRD`z7vdW|}xvIbq
znY<>V7R7vW0gYo8vzb+;vcg~y@`>gpt=TU)7P6Mi`G0Y`a-$0|(l|$ATCJ8RQQ~y~
z>clPvj4j!BCmBVpgnzF5wl1kKd?M!ucm*jpSJjwD3(IiJ?KAK?U6)G)8Gf1VbL6EZ
zLwO{tNV%<6L{t%F&CTHoGgP*SBId?1wcRPWrZZ*}WTBvOC|7HRJS-xUS@kh^EnI9#
zkP0LWfv9GOAFS)pg_jJ6xPHo)CnDi0j0N^C-EBg^W)gCCcz>@SpYlFW<w!2_o<1d+
z3(RULYoYR^lqMgL1s?bj4s+A1rXg(uE?DtkwlyA!^u^ozBEKIt7H(E`8}T>>ekDB@
zUp(s}!j-RBt!*faWNfPStAa)AFnpVJfD2XtA!3R>A!9^?yv@5R2$lHF<ZZ`;@sUfz
zEicc`3U%_hN`KZd@x>*@hIC*mIBYG|d$G11MTo7Mvu1mwDi$X_(OY-_%8eYcD1sR{
zs!VW&6tfLa6kn$<eMXWaH+m+OFiAH5QOXdVB13G38fIfjMP$CNRpa2Xh+<khEb^O_
ziw-IyGS2^A0>Z#&;NANSp)M|MniW+CbQvbB6fz6Q=YMhZGSL~ov;{c52*VJf!PXXF
zbskFU*ypZ+&*a8D5hn^r@oko-h0Lw_x#?NSk6b22A&8q_p$}4xAr%T{Ex>_H7-E3K
z%M|5JYv6c#s67=y!1Fju%=h|SUV35=iULJU;88cyN#sM80U{kB<>IFbI1*Bc3POmN
zXf+dHPk$BB^!;;IRBHv*Mqt<x5<ve%K!13iyjiPrtu_IG5yLA%A1q<S?ll%w0f7`t
zPqPwIJT1d*EHd3e0qFt}q_Nz3k}b&A9L~YZ5RL*}v}pk6U#ILt3Wx<)ju5+?9QP@;
zKeU3cku)3I_M)>KaDVvnk544F^~6Ig7z`|7;D7lj&3VI*uve7c(nX)iPMDy>31Q2o
zWwK(Mj?LEzn$NMzmt3ggJYG*^8seR$vWt+Dcv&#2Dw^^AquR^rXEC{WL$SYjnwPn$
zVmVPRBN4aRyRmAH<ve6$uycWfoMn_CUhi2QVA+xUy7rj8d!G}<K2yT|2@~!&xWbl6
zX@67E-LM^);ucxP7a!u_M0t7HWMW=+jH?x5LNe~f5;o;jAFjlt^PZ|e>IfBL7uCs@
z+e`))irT=Y)|yO1m%u=AoYX&Mt0_3I<jzpf(u{iY-`j`W2nSe>H>}5BRvnwvK2&a+
zs@QK;R;6l-R*j&MgI#7^Eoagyh(>L!RewEU_e&Od8!NrB^$o$ra&AmOy`rK?TQqYK
z_g#gD%p>c$z?w3ab3NN&t^o!eaB8j^{!-e$!yQrQdajgQ19|B>Q{~T1WYs#jJX`t(
zZ-q!diTt@EG9qfZ5^8c*p4ZejD3uHJVD&;`NU`(1!Q?Atfi!PPeK1iuOWtIpg@4BC
zIB|;Zt~z1$&~v%og_la#wt|~gb+mC98qwO%L*F|Q0qEJ?E~@u{9|CTWVyFO--%uKA
z!+@y>%ofA-B9=@*cxXY416d@Fi7LXN7ogi1EW@a?-&8W=^qjt8R2B<qwvJE3!4>TT
zvX{C`njBkOOsoENacefc#cbvdw||-Izv+~#rds~88V}dDd18YN^F5Z&W1;InklX7x
zpO2L7GqxAQFqMBZ*FZ%(EF-J1|7XVk8F<gkk4jEcZ3*~5X4b7k9vmxC*i#3<O^=vr
zkI~5to3O;3&O#3aL_s9hV71Xx<7mzl@WZ?BW&_+#nLUW0Yut1tX|i4bNPp-TP@Uzn
zZI1oQpXxGnl$)hkPlcA06O5m6@nmy|P4=i4B2r95%Du~JuEnBdZN<PS^0Abpo4|RR
zY4YT2W#O^8pq_U5geqfsYhrZ?5<W8aFyC$VT6te8KEDgS^(g}jiD4>5mGW5QyVkp=
zk2}jGts?duVF+<xtQBIuv47K=9TIlO>F&7F*vXm=)|9+5zqSoYEH^S<YNd$_aEyE8
zb!AbITgpUbM828g0KmcR2}e)RaLyBv9h~c=o!|Ug+GS4SB{Q6bzE|JORv!AIek>M1
z=CM65%d&8+f4-@U0!VOJ`&#`rDqRxez0n6pD^gNss7ALDM_l1R6MrzT;(__uDoNGB
zvJbE|K92<YmU)O-7NzqRX<u@EZO^N8a%KZ)nqe-ez2L^X!g0_)hBfI?o3~cYo@q^Z
zAA2O14WjN`7;hA=Q;4`No!42ds74~L5y5jM*_B;Vn=d$7-rD+mAfFS1r+1dra5(=)
zqh-IP9c}E%V=+=T5q}2D%snB!Tn}12Pjd@oVn@exBjveFMGBo`u(=l6=cI5rSP8!!
zPh->kvFDE1IQ0gB@`*08ze4twylmFA(~EPxJ;_|3%bHU!rGz&p^yS{L9nXFFlu6H=
zu=3?*EBC7b!!FKTv2Bxm%1eP)&QBPiH}iAwv6dYi>umPp>VLKPR5&*r1S?<aMeN`W
zHqCG4ol>nr2}yi&mH*7`#g!o595I<RuU1iCeE4g~Y-r!R(FhYIc3x8=I;~wj#3U;6
zOg4VW^r@X+xgU>f7oo7HU*$cmy|5uuZXxEXVMaE{)ZSCok|^Yv7Hj-hTI>|vMtK{B
zI)__E3cm8^V1J{WyWWPyfuPlChF)&NY3j0D{*Gg|MPV<R0&bXhMS0Lz`bvdtr#yo*
z_sn~Vi*ge#kw4ry#B9{u!yYiauY?&;a42$KDiAp{pi|*UkDz-67wF(<2A*vtW95(v
zf?R~JITn0le6mIuj)BK=Xo}KKZny~WPY8Vf!}|{s8Gpw*7c@c&l0XRv$P;iG-<K7^
zcm^I-=nMw}W&AsxG>SUPux4sf0$pULAc^gvr8qy6IE{YTa+h7*PN)!aSIS=bkB#X)
zS!s{qM&I3ax5U2Z@YX8Q1wCq&JD@IefX)i#0>`EMdprMtK_Y{uR0dnAxb<THo9bB<
z{|K(A_kVUt=7ao(#NKwie|^ONR+Ah5tlI7pC$Q05bx#%Pq8^*2i_+a9l7ZLc6p(K;
zwpAJpnLix`8Hy!Oly^t=R|o5*&Cw&N6_47WCS_MTTuQ)VUPD5{o6bP<w6I1kgUSw~
zMuyCaeWT-+mz7ZJiK*+mIjGer*=KEf$cAOg?tc-6xosge!(h!Nc;4;L#mk(xjnWdh
z9Ib$8CQAOing4o@$w~q+kpuHmXYtk4D=l}IdXH~RrBnP|X;@}&m(mJ-e(J#8r%Erg
zdaG_pDh8e{sv<Gni(0C%crl+Nn<dEp>^BE>`8^sh;VoJWDQZbqAuYxht8e1zpNj6F
z?SGxKJ=bO0QO<YGI6dQVk9lBMQ0B(|v;n2dc|~dj<&CY{#5by$=Z5IT%QSN5YHsEa
z&wly%_~ehD_zL{~=r;#?3@s<j*WM5{^~QMkerIknfwPO9m_W>Ym5%gd<&m0(yNM4h
z-BxFEZ?XTM&->eA-Iq@+*dWR3e@^Et2Y(yLl|l4<Hf}X!1(i_Wlp_WzKhJ|1%sNiN
z17@EYe`2r@z1YxGANl4Eu3YjG(#xFhO{U3><j)xaC8@*fGK5!V7XM`KUEXkcY>?RO
z<`7(s74Y2*WLC49Ga$^eHJK6hQR(DvcCiI1FYW44{(5h%vU_-eXk!W)4P<?V(tjh`
zm;TcXC)jW!?PyqhCs9_^6~-~amx)Mr)N2MsJ)J&_G*6wZfpoulx*6(J*%%%jZklZ_
zg?g&M+jaMOC>a&U>N>(k84>~MXS;%rvL^XnyFvA_ZA<q^0UVpo*v@x3^U*{sa8!YC
zozyVhwCU^tnZN-lT0>R4&Lx)lW`EmEi|M3nb=zT%+Ml<Yoh;Im4t^XzRf%EGeTY|d
zz$=*LmBR4~RT<5jc7d5)6tMb;KPE_ik}tds8uEGP2-V|n8=}tEG?!_O&q$2tuxkM`
z>AjYcXRa<^5aS>TMfwz(b1tDZsP!s+Fm;qF1+W6meO@Bc7vyM{Z?E&pEq_<UO~6<O
zNFF653TZREOTCx(scI$85k<P3)LK~~_R8n#D=7n?mrK$rJEANW=I~maTEkUNohmB$
z<AOOR7sYvAFLW1F?Dj6Q%3H4dq-omzQ+`{Li)N+_9w&s4Z+89opss9C?!=@an`L`H
z4FMN^^}@g8W>!CDn>MRAlz(l^&EImHFds;o-)PzIa_6KG?;E=&{k;&Ey1n@6lO#X8
z2l>F#PsUdCkvUlPIjOcwXA#KtR^ReijV4ZK$h;t{F7D+0TDmM?;%3&(IyzhScr6*S
zN`ma|%9B!w$@P@0K5=g1I?%nSif<cUSDE~7erc(1b*?Tck+-<OihtMyjcY9bf$?Rw
zrPyqzbT7RRRKE5SR-ey(Ui_(q<8M6K=KJ!63htjiE#3htJ$(61pq}RMgTikmx59>t
zs$BoMYfiebkHW(x<Bumjh!7P%;8G!?L|)ju3pTFu%mZBboepxZ_XGe|ekd`gdGA59
zI&|DDZ*1K5X-8VI=zo0KYmlT`9;t0qUy%|X*i}IsFH*#a5GsAn@7HLX53dmCoc$~l
z;SH82m@A1|<1aTxtBAw!T!_+jkpMlJ2V3j_1HWUHDW_&>w^np;3u((KP>=%g8S>cm
zAV18@T)l$}O77-iR-$r%=F7BUIb*fzyG2$O!IRI^f4=fctA9v1IFPkla<7NvmHhRU
z_sqwzAg(eGBRknOlx++*tK-cg{_2uN$u|nh&ZdMdow719KsG?>hh-{9L4OiST56j_
zw-IEy>Dvvf4#vHmg@*7o&gY%^E?n>$G?(ib0Urg6cnQL}NFgZR{vBndP}yw`F2pa+
zKWP|T%)pz#Pk)odL}8TpFqe=<=qo4UixUx8&Fj~IL!L=#Hk+M_hxGJk?A=`)f&cp7
z|5r8VV;ZN~2q^GE4y<Q6Xx4%@4lJC3XP1m2AIs$Q7iSm8JnM~WCJ9yuQl8r;tzsbQ
zci4!jrp~ifaYHvBi*j6KwK3{$LOvVcVH)=mT{4@^SbtkDgKOl6k!<TQf6R|^T8bDb
z4@(LVrRU&V_1BHmlh4z-MM$>Hv;T-RLFcSu@d*yVg&QV8d~vM)%~R8|ELt}>@WPu5
z)!N}j9LB6>@n;Nq!kfK7kg(kDu><3a(+jq%#NUrZ5`7wzglDSHGS<o*1@wXii!g0~
zr><m)Wq)w&uUWDop0Ais;57mljNqB1MATej<&o4@X6eBA89=EU&C3cNlmDN+cVBMf
z$npl~Z#_i@V<JpW<3g#`o^Gk#6S73xnw2e$D79zSs}Ge#C4e#uRd8KM!fr+EU;6+X
z`-I<<Y@ADGW!<v?kdoYTM7Ic_Dl04V-11z0M}KB3Dhr835+ImT9$m>W@R|J0tlBrs
zn~3v`nm^K)HeiD38s#y(M-2G*X?V362fmUa!}%9?4+8d|XtZ_tNC1?hy}tlgHY;^Y
zX%{agG<0W<00|ENt|Xi{lHS~nC)}6mU^VoxGq?v9NES4_p3hYX!EI=QA+wcGX%?)x
zSAPSNcoNLTv6?I=LUPk=J>GZQjY?j`%NOyI2_HM=1<^e7P6+z8s5@GOahw4Dmbw9Q
z0*X!)HZCyJ!`XY2;xKT7GwIM>C=Oj57Sz25!*wVMakh?95K_ybAws!j-DEO(^6j^;
z&%S-~=4|%u>nA_FeevY=^Ec1W&PM{C?SJ6jTqbe8nO$sMUI4Mun2(`(+4v%#U#g5V
z%_qWx%RMZrg7zWU-%J)Xl!`Rg<ER_lq@~!%Z5T^Gg`n(~O2@L`B2*08*UqHSVZk&G
z8(Y&!$1?KAng~iSIfKhw-V|@RHK*f{jpw=*)w)6J3o1CYY7bkZYwb>~qf50V3x7A)
z6;*pWaEh+3@`gbzPESWJ5Er_wsO^r;8SFpDK3Ho)j9AMXGiSr~?JnB7O=c0NZJ3?s
zYfwTsE;X1TdYCeSfgXtnnet*QJbY8H=qv<c4QwKV^GvrZ-&j=wEj)m)RK7U=RV6XY
z!Z74ViA9h-7U+$OGI5b-;#3cZ;(v?ut3Gj2cNMIbjAFL5QgN-IyfcY68|9x&#7myu
zB2Ee$P0!3`(}AoPgH9eNaTw+sT4(rTkaX*|@dOH+*{^Zr#JgA&YG2sMBaRJ33gxML
zZDIqFgi<gYC3>G$J;#9#W@_@WY?z=bCor_jDW@}K1%Y(<$<nkH9&*0pHh+CRMze0o
z4d?O=T8ZwVg)#zNbHJxAQ<zSwag?&g?-2Ga^0^?y0zqw030<E%9Q_>4$Q~j$+x`jB
zIgqYDe8bJ%N6nF`U0e$~PYp=PiE0{(;5y2e+?LCwYPSr!zWb{V;pTmK+MTlp@%LaZ
zcW6Z3&hdkri??RA4Us!K41cJXU{+XV9BTadg%Y-Y_y&$ErZd3yn@}#xnTj>Ej3d62
z(XhwZYQ^d-w}2rgF#cMOQw0cL)UECk+UKAZms|nV2Kz@~iX*D9=44cIujDDVVZqbs
zGy!94%3Zprx=Z@hveZi4C!k+?oM%F<FO+XuRb$_mjY`INNE82g{(tfZ!C`V-_;nDy
zK-VKDLRRZSs&<QRKyeV6&iPSzESou>qvv^&#)<p&<mH`JMAhw_>=4&lRy)gs!v#QB
zweLkn+rCT^ZZ1W;#(rI_g%`(}OqMD;VR0j_S8=Ks3I#Ai$!S7C;PQaRseGxn;PE8_
z!6%^Gm_S#^s7>LaGJh=(;QjdB+3Pc!$K<bg=ikIv;;-~DJ)ujr{hKHJ9NtQ-wm#(t
znAW1@Ax-DSVjgQ51q*0o%KVZ7Y>T&u6BR6@*`?Zgj{)-~NU{GYG`TE|h_m|w`|emX
zf*zA3HzxLeA-Vtu%rDhe6IEYQO{u%RBXXme;Ma0~IVMkskbhtc;}O$qo{Kjk*SqHD
zz^AqdVR=m4{)zZOU8AEP_V4_=mv3J@)18{yhPPM4TH^jCK<U*P)Zs*Hd9%YZ_2G=0
z7k|Y^WN7D0;**)xL(F=}0TO3XzGn9#VJHEXkQT;O770nTa${JQ$T@d-QYIe5(Y{CJ
z+l3fIqz0ogoPU8ci{fm?i{%m5A^)<$CgMEP&01+qt0M|RPa+1l_*90l(_02p%3@z`
zPagMACy%iELeo?vMsy0$e{jrI7l^i$81%8*%hNDT4>Sr992`;H@alB0kY>Tr7cePb
zsGX9JjCYt;a>`v^VLul#2;m3Fvk_~#1vwACXAsfl(SO#UKog@*FA^m$f%}Zhk{N7L
zI^PjASJ^<;;=i3BC~n-eKMlVWYuSPYQ!3_ctY8T_;mv`uJbEg&NCsk91!)#17$u5O
zUUQ#2o+K+Lx@jVwXEjNmKpZk+(5(ww21Y)&xJV0iK;&LiKtw;hA|>IaeMk<k_NHap
zqz~id8h^SQ8cBd?=Bbcbp+dAH+l(lgC^#6plGy$@h(Pil1!=LEg=!YOemH^uII>@*
z^pgE=q{UvRAZ{`5b&ra|yH$EPx>pOE20u3H5d+P`Eq!rH2RRVn@GZt$AEZqKOh@k-
zz+Tx~K;E*<_d5X8vK`}(MEQN&QL>7d(9k<Lz<=U;+gjcXxESD1T`x{S^15BzgY(rG
za?tN<|Bdh77?0QwB}~wHa7K2y+grIBXQ*Q7ggHwUM6BJ$$Fr%K(Jhm)wi2A)Mo_>4
zE2VerqEV#<R_zYnB1c*5NO}6bn+58Qv;<v#H;mh9%rA~Jk-mHV^2M1rzFr0Mm3aE(
z^?x&Q{sNC#I`gMK;35da^kl>yProoA%}LI3J78ba2$JUN108esSt~c@Cw%6+$;}MG
zKcUGI#Py#schR#vSOl+OJbH^IrV=b-2$X>ZcLIi@2fd3uK6bK=lLc9*#LFLE{13(B
zf-J2M3R8d^%<6fYBv{L2JI33+iLpm91AhmXdQ@8CaeYwChX4aP$i(?~PhPyhvuzM9
z!kjV}kkv+lm~>>T5q2asY;<A%j`-Y|ZAa`r8HoU5dGsT6>xH0}x{@I$cFmResy^aT
z6c_J}4X?!i{(t^oZZ;OBaLf{kitzl2Mq?bo_AgbWl3?CIIWi2v6x3N{lJ;Ya7Jue4
zS82)0w)=UN{8qiJsk_+i=b+X;xIv<_pW)!Kb>1NZtUj3Lsfl=A$~Q{!RKrgIGJ<~a
zHsjTYGMwnZc*tQVWV9x6zFgIZBilXlFXEdqCU*JET~?KdKv64>J<1vR>76Gy99=nl
z&~%Ec;5a6{-|*})Vh5_(k9jE5R8_q9PA2uCOvVZvGc-Rw60sGmuXvppOSnE%vAE=}
zl?Blg&lYgQl6gp`z%%V*`A5bt2KdGnSxg}w3Q7F}`o^MwV7FI&Fk&8VM}D0I89FU6
zZ$U<vH7Wure^vy((;f`%qasdC5^pZUP$gfa?A<q5(<vXAq4^^nHVdDU^!-GoDP=lR
zEOEl^nFw`z1LQ5EEo8V^A$d=%AjJc?3hJd&@Q|QuN<!>GU>|Yg$H<aEhL{?qk^~-L
z<%0;_C3YN1<Q1+60`5qZl?PzdNP)NwO$4_SvpsBXe|<|US*(s5`et8ft}PsAAh3$|
z!=#gEoH=Dmb!+1`+kn_0^#I_`c3#bap-)Vhu?2Rw=>#}@A?jzs-N%?tixgpq+fIF*
zy2mMmmf{oKWjHnYO163^ow+<<Iu-dc5tN`6L`xFTM&G7$8Ons8QXMVGN)M~0ky`ms
zCGX^3e<_JAC+FQ47thjr+)m9!cD)_X+q>TWejs8F1@x@P)CaW>sP=?vww;UG(5}FA
z6>QSh#}+nb^RrBmZTlq<S8jViN9<cW@#?NJZrxH1fA*%R;j0`b=bO5e9|9-8fKco@
zix;@%U00!QY-}E{dkS>iT<Wl~OZ)l8!n0yje>9a~f==arcI)rk%2)n0@}r#7sk?Kf
zx)L2e*}NL60&BKr#ZeJO)nyr2C^o&iKP9pDA0V2(nv?U~E0UM#<WI>lg}b3J2a61D
zyv6~4w9&|;<3+C^Bw53in#>e#vhKgY-YW^Z=~SHQh#x(lZF@Rsqe&jBrJQfMi~1%G
zf4ATXV?iG$sYvtriegw`wAgIqJr<WrZA?^?i<mIpq>^=zreKC&uYynsjq1uN05lp(
zi?LcPf;mVV^H4OPQ)=m+igXp{q0c!0likZoHS0GLk8y8Mzx!exsFx2OU%{?Q@(7Ha
zloHj|4FFk)bslEHCRD|fM5fjotUQ|>f4TJD(YfQD$Fv`TrgJ!Akt3l*&LcsP2yB1S
zX6sdllT<-XG<PgW0~kGJpXi*X%kTxAlRZ~iWri>b;<=)kk-hmeWs3pL=?)qkMO(_r
z=b$PLlosh>eEUW0ZzqoJXS=&geuu%({rYp+efug%Lezszv_R$8kreEq+Qk6`e}=c<
zwDRQoB3J_WkL3vP1Rk4B;bl?o0VN<yl~Hl02j`A^ctlaz*I|6&6&|MIn9pfR5C;$A
z3qDjs(?|`tgW+Q+(YuF!H5oxD(>{k=2`LqaL&QQEjS%4nKAzG+T-~#T5IYd4K+Y7C
zLaL>9V?;hyRay^)=3ZeCfp_2@f4lqmDRZdDR9Uh$-Ui65xXBVJ5-2_e=fh?qAQyZ}
zt{<!8);;6EN@S2SN6}()j@ni%WCRVlpt3+of1*iE?^EGsID`B4Gg$G_hdBCQ$sh#Z
zTeCaK?mDioY;%{C0V^L2YveO$Y%5dr)Ii-O`)IAwlso#gTYA{Vw)+wde~8d$G$Q59
zfN~D(Au$=E6;qUmzwYA517CKQ-S(iu7MTz{(qJrD?Uo&OaH#aC<^8iUDY)T!6GhTx
zdIua%95wlh4AW<3y-H%Jg;xG+C4J=5lo|Bl=_$N&*`|0-W!;*Fjz;EqjrYF92iSN{
z4^QvcNBJJ?sAvg-HsApXX>LjA7IM9#{;@tP`Zfy(DB5e8hHY@3?!)@P=bRCkXaxbo
zFF=6y4cM~IKL*)~gk+FyON&04Od58CX7-n&<$29IIeOl%s|G15NT$*X1Anf%wm}zB
z8%B>D){WHbX@f;CPq$8B`Yo3|F9I2V7+?1@1YT;63yJy}=Vm<$FR<0$dt=s6C_$(z
z2oFJ^K#vPSFS*1RBDLRahBB~1_7GI}gLEEWsRV;eSAi5BMhJBbL2pmV<K&4cnIG17
z6P(b@o>1zYh)`jWo`3-`8o^cuUwEM~E)SXB96c6qU%vn%d>Y2Ne+Gl59Dp2uiStZ?
zXV@SAs4iA<e3_2ZU<oHzUxmSyO12_i+%viHf?c`fAHpaKB-b*<q8qsE`Xw}oK^PGC
zTAasl>6My3IDPQt`1DWX2Y()eKbeDi^}QPxd&ks-Z+>oFa*m}XC2L5Z$2SUL%eh<m
zTxvjY?j?%o;h1vb+kekEi?;NCoyPIPj`RrQQ_=+ul_a%^KKEbAY_+r5ChT>Yb>se(
zQ@cvHbsr6MdiGc&EOLBJ%~vs;0)P(V2!n4Eo$r~N?AhWbmBDcFf=6RQ(+Q}Ue3?EL
z9=onR8sCmBjv-hP2Ii)Fl!22$&N3V|IEXxHrHZ*hq}jc-p!TcpYa|zcp17S7wchX1
z9q_QuQB8T>rlU()LszEm{+_@(6WC717UCxbGG53zLUt5c_3?s3&ziWP1O;;u?0oKE
z2?#+jP^#vM${uqW1N>crLO}N;A2Ol54bmwnaf2^TViK$!#JyMhCsrsk#@C^gF=(5S
z1g(wvoLW24t7tSbGp-4LfVPfqiP>@<Vi$Nxf9F<?e{=~4%{|mBqf@yU$ku)-%=krA
zw>xw>nh{j1Vw`bHi%zj6v~}wXYqt&dDfRHspD+lcFE?ALzbW2Ae^c2l7tGYBIBacs
zzmEOwL5aE3<M`d1H?PixihL|~ASdTF_;9)Tx@}sC`;$`(2yBdh6*ZV=_Uh&N8*QSd
zg6%9c@U;~tv=t^+Ttp+hRhDfYO{du8Xcea!>P+3*1Rck|LjM$+sYcS3dGnqLg6njq
z2d5AJ?BI{R4OLbu6l_>-a`HmLPS$1!kQX14c#P4T#pKnkev7Cv{BSrfnL@HjDJ13C
z7p2di^nSR1pu}f?yK%!|Leaa4_gy77sjOaKe~mM~`~JyOtuwXWJNB+ushZFJdLdKw
z<-@;03iNpfXYN$Z^F%>zU|EZ5^@%x`5ta~Fb*Ni(<?!Oa*AB-_L71!6RcTa}*Cm16
zLsf{ySbc-^Fhr$cQJKG5ERvB^N{0)G!CO>1x1cXngsRJbB{-GE8YmC`WTj_L)Q>gD
z9|o<)G%jS^YwZX*zr`ngsPrm^<Wm`e|EqBXedw&*Q>ADFgjUMt0s2=nH}?D%GS|@v
z6_L6Y%!dEwRTz}wC~!rCRm(EjfPZ0}4R44;-?|}KuazIjOra5s?n;+8dcPCB9ESMa
z77?n_>vGP2LButrC6sp06W0I@K(L-p;>=osc3$n1QN1YzD)Qeb7CDDmXmXVelB)Wa
z&XXNZv9v6y9)x0e3^Z5r8d}Z#RDgkHiS9Tuuqh5nsTgR!6^=am3BD3VYgz~bgR6Ij
z=>s#&T!7(dgo$_?S=Umk1^tu?NXFN$(AFcN@rxFJ{?&$10mqavE+E#mxPfb^pw(|)
z8XpYYJX;ZxL&o**fH<I+Q+W1bdc}%2E@)I;QLkZ1twA1(+;L4S&h^@>*Zk?V)&C*R
zzJUk^-fA|WDfnSim<fCc#1hSLju>hONovx3dfn`hWRheQ|06)*`S)Ds0n`8o$lnZ>
z_Yp*Y@zZDQ-QGU8`m(H5wu<4BZ_nNw>5fZq$~c-Hnf7i3m|Y0N2js`slPnKh5ex4t
zVrmV^>xOvVMrCrD$Duz?GXP7*0~?S`X8eqpb;BSLNgQVr@dKSER!Ur}FdQSmfI01r
zDEw07dU-aqk#_cPMVcoIIaedj`AQTe$qSHw*CUg6kmONBAPE|DR|Dt+6g1|jTmag+
z)EOuMdn{J*rnOK((;z+m5qGnk^VgYNrXcN10l+&W3=QTmsM;szoN;7f3|Q}mIMgv#
z{1I?W9A|WNl_FiE-?hL;k1oNDD~@3?XSkTNQjW=t7a!Et$wd693~vglN72dPMcq+<
z;2TVZC+GTgHGXyhflUp#4fy+71`*&YK>5)9NB6~AZp4Mku9b?4919WnDWM(5kh8=+
zOVh^&JZCzk8a<@0mm3v5dG)-=fbx}}gB~!5%-MC!34#V?MPvrsS6;;sXeB7;c^rnc
z{l}?N81|5xV5*-s$x<%b(j55Y6X(Ex5+$^;;gj<wPW*V8$ZU@Na_9JNI#0HLpC-jC
zPh(i7acQl_v{uf$*)f;SEfq(vDU<H?H&4Z%AKrf`nx-N2S`-oLVmC~=6g&TIfoWo;
z>Ci=oHYYHZ*44K{(j?{gS^JG1Y^-&L^UAl*!-<uw)&I-CKlrn#Po!9T>0f~c9h_?P
zD_xgPHUb%cs=~#X?1T|KFG%BL%j2QpG&5?#6I1@dva4osbP*#&%93;aQn`R59AYys
z!9_Y^h#L#6k28afo!1l!KNQn`Ki}Lk<xJP}%`H>UFuKu-6#U7`7vDd9WrXYwT#0Yj
z$(&lhKifuf9n7EF9oo#=f_uEOxH#lg-+ff-7gj8PAUF)ly{{u^<M)O=N*mJ6P&52<
zT57~+6rVk<*JMF(TL-J1R>j5pzGFih4p5wAQk*L+`@G}%O**(ICydiUtR3pgfzboH
zrH2JkkOeYqOB3sQK*O1a-&@Z(vECdJB#IP^z6UgLgSII7T%#Yt<@ptj<#)_vlf;W4
zRE~^)(ZL1ekbRXy)0UEUey!8u92sIGZ;ux+d+#}J^MN_w73I`uR8y0z#eQmQmuqv_
zfeV~d4QZr5+KW~m@pUDsOkAkB%u`iPTp?G3IfsD1QoBZKYuxB3s4r|m&F7h1f{zt-
zG%)p;8BnhwwQ8YQq!gUJG_I^PD0{I9^R!}rgui|L!jZV~CDS$;kIj7Pkq)HHlbh=P
zjkiS4-JLMY<lWq$)4JkaEztMAPpy|}Nsle)t;GV7<9;nse}9+ITjPMnOx^%0x<ZKT
zDfTysFpic~FXQ6+YnA_P62UpIw~<-C;WcIa5gHg*`$7SPtLfi(0HT+r?wbRso^QN=
zHL~w$3p$X3Tcje<hHk}67CdWM_Ti?v@;ez4hbRcWR7Xl&&~e4PhM4<jcA&BU(m%H5
z0X&9<!93fE)tJf(mD8x4Y?BKUVe}-l6Audy!Fi2-XM_&Qvv^$!!|%bQ>V}etnHioI
zt)yKzRo{Jk8tSm9CoWCzTT67XMrK%lRnBgT@Qha#CoB@>E4A(tBW2sLStQ(!AZTFJ
zw-Gxg?U!&I?|$!MaG3<g0U5(uug?xlTDX;92yoZ0;v^eGDuS;&p@K21d9w6Q1>72Y
z3ch>u{R?yHB8;z%E5Y8i1Mn>Rj$eWs>6y9;=BjjFay}^ecyBrSus<K)jIXbMug9PP
z#(5H|2v({|)3r^1A8qU~cr!~(CX-4zP5W6RAy+*GK4}eUvr$mPj@NvHgeN4^6*~LG
zMI2{vfZptXYSsj4z3>}yJ2(<SW?g+3yAG?2Gd#>bTf+_8St0(^BnBxIz!k)VpukJ4
zy~w=d6`|(rdNI;WMs$-s;HYwc_N4Eyqz}>OSnOjMUnfZnktrR76hv7PLrqcUN<YON
zcSk<Y%`*=rDJmll(3si*NPB`M%_{59Ea-44J_V;gmPq0mnEcW@q-2E<bxQ)Z+Y#_N
z){bc#0+T`P<d90JvSCUbnB1S}C=m~h76*bOjX3=c|9$SipVIAZ)Q3BNqR|BHBC&xK
z^17I0JAK^dfvCZK3p2vjpc=IS(zv-})EXknj0GEH2e3AvnD%J_iPIbOxw=1{S1+&a
z4yW)xszH7X+?}pofwmH8smN`$2w^x2Rwhm~A`Lb~mzcExQT1|z7h5KeDEMm-31NJ=
z3$6HACSX<;kzWA1aSi%^a*x*5nB6%8syb{`YF|2ZlMK>j4F+l8CN@IG?X!EY3%DDu
zd(?ZyF-P7NYXg>v+^i<zZK|s9IX3pMF3$YwuTW(1H;;936;lU;yLO6DrZ$faY%q@R
zwL$5OIL>SZqSFzBA=_c#5knbPzJzZKRP7-M3fTXg>-?NZs&wst&NOv96_(CzXnU(M
z_ikC6<|ylXANAg`Y}1|F+Ik4@EiZK;kwIH%=zV3<c<BIzl}m`{fV@B>j6*2e5?P$d
zFvU!`2_5OiWV7&CV~c$?yc(bhA+UCsRbl9eS&MdtT=#6V&tr{)P0zVHo!rNw?3CkM
zy0rSI$z<}*n~3j!0f205Ay)Wm6UN&$mbyW2Ekv|{EVnH@SRB*)jml(s@>nQ2U-5Oi
z`n8H_L7?HD-Ranaj4u1lWu~FU@WdIUgx3SPatBf^C3wRj@?iQK{qcTh!JrK~ngis+
zRc*S@!sCvFM@u8m1E_3P%qAHph~{BV&U1~&OzN?e5rw>eq0_Gl?f2n?hM9i>b<Wvn
z3OAy0Alt#)C3Ri_d}LKT9J8y@SDQr9;mvC#GmrX4o=}Aq&<vgh!TE^}PmAh}$ucSz
zAsL)%sI^VvG}URwB{cggi2b3Ak=J~|F2ZM;ly1INAymKvrMsKPJV1}Ot|Afjt7={c
zs4tV{rUJBoZ7N#C$(+%B&Nae$7%!nK!<gE@h>ctZ5%-ZX>={RD4B5nJou>F3(ltTV
z%+es5E8U@>RnKDADoWfyZ&`^03TI2Iqt?v57{p^kqmtJ5nBB6i!hoI+9TULgZ(fIM
zyeHz7kpWEt2qNd2!wJ^0B1aw@2@_;`))2qJDmGewUnASFq9AQy^a|USA+sJ2k^!}1
zd1|T{@QPq#O=wol-6XgvEG$nI3i1G~ZG_4>cMsf!z0DwZ!QfBy!**xyCq;{g1L{)f
zQ;0^Oj$tu_GgyFJD7&|W#ove?JrdaRHkiY><^%Ry0O!(lEpJB5pyg%<Bi$+i`x2n{
zFbBGSIW{d9ypvJUZ^7zuP`{FzGyK7WDd(Yt$}?|d9mBEf_pfoJJl#*3e6ix~o2Mrv
zaeDaOYLs5It-ivTj$wW1_|Pk>D%$xB#>FCfMGJw(OR(l{NgGu9Vfd(MMB$15e)+oE
zmtrEm<yACP#Kw>k9wPD**0(2)(|iq35WI$ei<mbcopJ*SaiO+x<O>g5DSIc?Q-iNE
z^am$-#NK6t#0mwrG1dNPB-X<mBuHEBrNgJc1^)i037SaVKm5;gmMA)6?AC#UdqkK%
z-JPiWAL`sf+uSEx8!#_B1?@KqdTbfXnQ;Iwwz`85G>>mHtJpsr*ZRBF3@DH(u*B$p
zQ8E2QOu-i%PE5mL&)yAB%vBH~9%8S3B96U=W*^?kW6fI(tC&aDICjT#lL4GatV2dX
z&ol^C1kx~AMscG2iTF_?S_cOL1I2Zy8c9J~99^`ZRr1NJ1)}@-;ptyabmSLt-kU)~
zIh`0>H5#f{V@rb+HgCKM=Ggi>juZiZHhhv+86j@#QwTL>bCcTKrEN#?45gs$;#P$5
z{E|+YSNBPjLkKLshV!8=rcCY5g;0Adw<^H{4-X9F#uby;M{2%O^GmpZ=05p3os=YT
z(LN6vKVd8zrx$Ly;U?8^nt1>MIT;}cbH(80_8@q89v5LIq`N3KRT=sR0(hc-7cF&^
zYVRe*4fMvQH|N+C7c%f@?Fs`jTJ*}QIvKRgarQD;+leBG`zac!r!6n!?#`E@3T(^S
zI@bN<#&I;J6&oXhW--jmLI%LmE7e%=?6rWXX`k1k7z|hu{j}hE)nHrfx?KfXtK+ul
zK?bY99$Lg9{Fv;F-E0SP1UwRd1Y%tOy}8SCcRz=LO&o<Vmd9G&P!FH`r>CQ$qtE@G
zjy}Ki=Y+O2{gKfYleL?1M|)sN3sC<1HT&w_u!catID>mSC$zgK;8ypoJ^z;Bt}5+B
zYmll#$;7Rl{Q$OTHpBa9<X}u?mdgtD*i(K+--B<W{bog?525E=XTFAivVz%l5c%<S
z%Q_Z~u27qO4|n{CH?$Ai(d(+Cn>kMhFuw2{-ZLN9cN8VQJK$^^I#1ye%}DpOc8CYd
ziaL$Dz5?IFK!h%x<x_xMd4#C>sOit)bNd6*DA;UlXf7ANtmWamGpE&W!+jftfF|s&
zD<ImwZtTGUBUd{L_ba7;&L`<sQ*JNVFholOIChqbqk@u3J<J#ru@DDXlwRVjrZ??=
z%i8ohSf+CAN~W_lQsZw`T)OI|08BE|7DnGT*Vzwj@Y-b#Ow(HbQLMTy?$<A~TUCfo
zENv+wtCVDjV>MY$L>?8<f~)%+Ffaj;k%1rk<z$E2+S_V{(vu{AS#5_ROD48Bw#z3d
zALL|@f|7E>4Nk9yGYAAh!OuYTD`_M*=_=0lC@V3|?f9rA%u%aAdU>SJg*qaq&nEf=
z;+wP@ECRd1UJ`f*oGQ~1`hW0%$x%6`4^9OG4(EItuiRAKn|hU=>fX?x)-d1r-XXZ}
z0AUM`S=**VmVLH=8XgB@0VyP;=cWOa_qe)VuxI*yzL%ooeQ_LjaLAnV{tfWROw;l`
zpQLMMtX~3sG_U1#G1L|19glQUhG}@A))&f0=&})Vj@4^(q$ADXuq%eTjN%L8f_`Vu
zq}^#UZ704amx$$XVBZLYj67%ehxgg9@Y%2M*{|@~ukew7`4tX-kpKOi(~a(*t*P;5
z<9q8qT!khVN2~2cqT!lbSE__+?Q&-Q>^As4xeXeI@0ySCEj0aRdmEa5FZ&;wuCP54
zO}|%s6fLu``K95S&z_CXo{i6*jl+93&Tcj;39wgXSOjxRP7TscmdnG*v7xxV8{J(T
zhV4>43{#6jw_xr-MobWitNWCntBWo5!>ya(gjeJ%YbS|IVvLS?m-~+z*NK^;2MyWj
zl-dC=TI2y|E49{{z|e(<l12FFlfsvcLjoXwfEqi%f@ufc9}3zrNBeXF;;8HbfaD@O
zj|2B?YS9<@4iL5+5n^z*7C8eAKN5=|Nwaa5$Y{=B>Np(L*QdHc2H_zXwjHnH2%#Yh
zLV@X2+<(PrFm0f(6G}s}alwJ#Q+;C=i%X?8HkZ(oKKnKf>f8A2yZG$8`0Ts*?7R4X
zz56cA99dQO-A0B|-xB|3+#jLNMlEcPqjw|6WBn~9fuP4Ey;BbeFN3?AhI+5jf(^Or
z{b3y&pPfaYokbs)v#4|pOQTQ6r}WuPRB;oHgeg<zA3r;eS}<Gb_-*-WN{9v6061F(
zsnA`PZqIMDs?OvhWbkBtL<e__<z0e*Vj!*!qKZpX;z~A=!05d3EY%L;HNO(C1#SRD
z`n9L1R`YIF#hj=gbDjeA`7!WMGXnRbN6(4@W`>YGolnr&&nWUo)FdcCTshrE7aTwr
zDOQv%U@@T0F?QKCjx0{@Ip!ri0c6YhO1~LYEa1ECkhD@=&SqCnz6oRLe;vku7Y;Cg
zSNEqEVSJJ9k183@GnI{NimAX_Hx0Qjf=DLYqjuxb{NV~;_13)d;NtKWY4}t|afBSe
zZ#<U1pQsewmSKD$w9mw#4%4!uS2HVVGSf^Uj4ygbUk6k)4L=ky`c7pj;=fFF5>e3z
zRV%dvz+9Ix0(Ca-a8O4gm|{48J?k-dFNGb(ebn%;SdmSvc%Yi>CI)SE!6JW7e}jK!
zhp55c$Bid=7U=5=q8BP!!aVQSdAZF|!~;0Hi#}!V<H72xU8QcdQ?eoBqeE9=TO4AA
zn7HdNl?;oOydpFP(#*;)b-JRinOMSY)ofcO%a)k^T(|sj*DX`utXfBZX*c@=8!C=V
z4HbK=k>17@1z>IS#J-OGZKH;0Z6MZYCRmc9+!UMph|!LEshTG$^B7e$pcvSB1{ed0
zFMd=Pt2n+)MH(!zl`Nnb9DCQRRLy69h5nacKKz?^f&_);FVHET5)k%;o@I3>u}zMa
z*RM3V+3%PLe1=Bw+t)9D3iRcXi8;aHCWwd&M?z)u$!-V3$z;;eFuoh12bTeY@<?mK
zrZr=~5t{H9DFpPxU>;<a1#?_!@{Y0o?jG(Z6Y+e#R(>EeXfdjyUvia$w50RO#Gb?C
zN+rQ!>+$qB8{1x3qNLKi(@bs=QOx6pH!~cC8Nm}^(1a{;u^U@DBGh~pb6aC?z5)Pr
zK#RZm7%i0t*x0#+3aU{qN>BUl`zKEgg%Uv<BK<e-M8tR?!@BGUcKkx=Qzc~iFJ<7D
zU`GNWe@1aM_Eo4r(AViVtrKuTw^_akl{ogyH?zwi^1YF1W*gv#0w>0!<a`8z!q0RB
zE|dSsp|^6WvR>Wcx{=f0?2nBGv$2G054C}b+|h1o!|Xx@%~$;pXWzil1Fvj3%Y3V{
z0u-k~!10l0YZ1wzH!$D$PWu1Jo2TC$Y8Q7ke+k|;&$Vt62sb*}%gsQO@k<*vDJ+J7
zoQ-0WC~R{?%$UTP%+yR@bPdg^AtvoLnE)-X>tq77x*`yrjvT~^8mmZN5blwnCK2WL
zaded)lu2~!xt3)=hXpkK<{IC`(=C5z{7zo=rS|Qmss%mmP_uP15pUup@U@3iQ-ny#
ze^VnfgeDCK2WX^~Y{C1Q)rbUaiX>O??@~o7!6)Jgp{mr4fyqu%gF_3P_E^NBuP=qh
zvX+U%-lT(T2hx4L!sXf7i?cUpACZn|aATDY39Qp6M|YzrG`T&)$F`B%e}R=sCvqew
zZF5j%o}a{<4V-J9`)a+3Gi<#USI*m?f1LS|s>pw%*sR<6%vvX^DKwEBD{It)($|AJ
zeZgDsww8PYMmAWY_}qT$eeBo62<6tZbYPB<0G$kSD_cqZeknHU)FgVm&Qm;kc-Uu&
zqBYIOqXWwCGdkKepX^|I`do*u<a8U&S4kYjd1|&rpZM%Mzep<wz$f;GnioWNe`!7d
zmZ-CQyyMfTK2JP<b^w-o_xRqweE!evzm1$<%B7m7$$V<!nbRQh)y*VJ5A%%E)6*{>
zJ`_#gpFV`&z7+rR$3J~}djI~HU!Fb`|8jc&j}QO-OYtwKcd-CDG}Zi<)6)aI<mu_D
zF#moc|4pajX}sAc!E%+MXXn+ke^+CUDnN9B3Jl^Ty*HhT^H<OQd;B7pt0-0D=f)on
zjkV=`rN$2?r}yBx*P4*VcxIT+614y*VE~erQLuoH#*=%~DO~$zrJ%DwVkM}LeFdf<
z9!DT_A|WgWr>Z0lwOmNi549B+3UC`l5W!fcqteTbik`fBE@YAg3ymlre?-<Jg7qdu
zI93Yj`|&&-p{tsT{Pk!I$oT5nt5<lgOJFdb!sOn)V2vpPzcmPK@r`arp*0z`W;>cp
zrt^5cjw8cmN00B_!`z)BoO4c+op1dLHC1;Ca6QW81}0oitZlo>^wxM(eJ}bwlxa3g
z@~F_M{Rzv>aWNF^1aWOmf2S!~9a<sgiJB!!reJgEi+?ipuHq=l!|>=`>8>CO(iJBI
zyWWzdS?T(w{3%?5zKfDP>cv3DF29utwp^FxY1cL85B-)!A{V`7$(q0yNOO$9FY@s7
zc7EF1sU<DgVw7XmHZoY9ejcg=>^8Xuda@Q__Y=&uM3DKkhcJGIf4FGkcrjMk`nhtZ
zhhd9a)V>S`O~<ZgGY(#MyamA5CfO=pVu~D{Gw@_<-w)1_c^u7yP>sm|AM;^gtgawZ
zJy&`#Ql^u&FOI%bGR#)GmF4#6gnEjH>WEIaXpr;mm`<i)aX=fE9<OeoKn@iqlqhnd
zudY<nCnepI1ptw=f0db0l&>!U_6I^x5K_>Ga)~u#1gGndu_ps$(2Xc75lHSzMby7R
z4~2qdA~fLEBXs=fI=4-td`bNwAYG4wo>;*L4N~iyGQ-8TOARp92S@?`nEk4f7(V4t
z<OeB{K0)!p3gXvveM>O{{-2$IQc8bDI;-YpysujZ4IP2Hf6N1ui&AG;u0Ya++-!Ta
z5VJ#ma$~J~J12IgG1r!^l9AlHc)(1EJ%)y;=@Nq}3UNx1Q%Gn?`Zoc=-CG5TD`XiM
zXOqM~)0bd+26Se=K>sB~Rk4&YE!fA9p>FRLV?u47&EvI#@l0!wln9(X>$(H@W{U})
z=osCA1c$h;f1v4*RG2Vnd=n~_71=|^_%2aLJ?m#My;Sm*+O&zA+1ZlMw2zhA#$Pny
zCUDHgNgz>Kj|1W=_^@rU)27uf68)LSy0@zK9Fo_6SBW3Yo0<Lq+gi|Jp~;(b#2m8S
zn#}^zP_yeexqQ^Of`uxV8CPDH)8^W1E*xuz%4vj=e^P!*`4YWzYp;;7MzQk=t?M!I
zOfJ<-=6=v%3XY7@0YeywFo;0Ihj|)Yp?cZKG_6>&`Y1NzCW!b>&I@dnw$C<k7|ge~
zxzhK_)s;~W>e_j(<n_)|SndHgwQd+qfR+_TZP_)j46Z6kpSQX&n5YLv^uV>rpj;#x
zxTLMCe`97r1#2{P+Y(W}au-FD*4mPdRQkXMQ{@~KLa=k7v`DvUrq;JADtxs}Ag_KF
zC$ozLQq=d581=zg)|VG)rY#HSH8Eo}RreiPGTB<0BO`R}FUzva{-sF**}vCCjQy+T
zuF`izPWD$eMU=kBEw{g^u9f+%e2N1f;daJ^f7oHdV)vEX(~4<|RU89|9P$K$WuBCd
z*!lozp*);ckK1|=)D0>WRQB$yrLuf8<Iv84`|@b;D>l*WksgIjHeLZzkxj2gmEqQ$
zN!FNQsz-W0^f^c`{&NQT)+LIEsX#kDl$4n&OS*S0_Gw{x!SyAg#8&|7;{#@9%uqPd
zf9U!-E8ARS+7?0Z;ta!{0j`L{tad(ZjI^Jdob!Cd;Zz?^xqwV}-+t7w<U@EJ73SWw
z9T)~nb>Yyz!J|<EnYjvpgVAdbJ~{g#*Q+>H)#3CgDm{5j9t&LnSG)rv_ki0GTD2Nt
zxre?2J-P<O;dBzpU-deU*dDqtBn}QqfAgmzPGHFUh2O+%0F+BI_OKP>fcin@i(~M2
zSj*;}U@@ABAy?j38Z024RtLiog^Hpa2s^TEFwuLADYU?{;`sh#a{u%c@?g1uOgHQl
zfuG{mlWz#3A0WoYRCzewsAR!0n6X@L$EW}P$5ZqleGl@53(+7Fa&&@;wzz&Uf809H
za)e1@Uc6FVnP9!}M0lGdUIZa@vBxz_b&)GhiHbwVON{>b3OHCr^X+&c*Fm_&P_n{3
zfJKLri*$ux;l=SBMmhF$RopCyzy%#A&_~ouR3?K+`Q(wFF=u!u)U%5bv5+~EE6PuX
z(J-cT?D=qW=#8;WuYY0)Xwu}Pf3eE{c6HDctJYuS)Ohx0SsF(Qk$H?@b{mYYG;YqG
zTL5rKBWp0?P%ENOvsNyAMJ}`Bo~W}0C>9o*w(IT`B<KBhV36H`l9+t$ht-LVI&(A;
zTc>-l-2r&cPWrc-R3({}Bf2AT^}Fhu-1H91Q+L-FW=YFUHO*Lkbf0(he{~+6LzrcN
zW3)YP+85LT(bwgzs=W;j=<MMwO8H(vX4cNzTu6grMAvG`MmKdajDy1!YfnTaY7eRc
zYmK189+V7KEeJ_jL4@##x=yQAgw*qJ?81y>?R+wV*2du1hr~EeXoCtfG$4MPTa}gX
zy;7gjDrn+w4KMp%*SWDafABD$Vft^Lc`NP!SkVKVL3fBP#G&@sJG|eK0E0L>obKxJ
z0v9n)ElKHEYWZbQj$+#Lj)IerCSNPI4sb)#1HIf3#?twda}{hd*BhLek(xl!u)UJ9
zyc*v#$VBntye2hgfB#&oTkdcN6(@46)}S&#68e~&0FAd%06&N}e>wcWuWp=_45c?H
z6%Bn{C?R!n@bflu3zhvdEKMGCN4k;^{`4iK=7KJTeA@r@lN>Kj$A5YE+m{dD|7*)k
zf63!a&LSm~T37C}a;F@N*_;8}`ge-y%Xw!Lh4B-U_tE?ARi)b&C@ds~4ioA#zW$w{
zu=*$2%M-iGh+Y;efAchDjZH4qHa+gW^<)rtKf?pdezI;dnK-?WMetZC+%EL>bqH^Z
z9;IS4>E7C<Wi+-n+NcW4$z(EcaY5_YFL7jjqo-?sS75n0@5!yj?>njZ(+K0+z+y0R
z@#y|VUR15ZTg{pr7``qmx*;L%AuFAzg@ycJnH*?7Ic7vzf5~87YuB1CWyV2Y((EFL
zG>;!(G$`6}dWoJ~I;tD&+K(!!-m3#4wxti;Yr{4yrxoybG*$Ddc+bjLypU#iLs9yh
z;+^z2#m1YlcysZy^Ksx7MOKY#TLjhZWd}uyyAzfVta8qkaa3OtClhf_jz*0v!xyS3
zOSYRhh%$7jf5!71vdYD=L1Dwub^1D^XJ}vp%i--AP`H_7<Q5nZmjREra8Gs}n*?~C
z+XWWT@pSR*EZ0h0%Pkb|B5ipL^g*s;tkBe_>POaNJ=4fu3Xh7;Jn;wcu*V@d*1bFl
zy~pHP&sLBb2pIF=z}NSAz=YJ9;39@BCG0*y>ssI%e<m?ZnZ5Oxn0Ju}p--#F7oq!g
zBA%&5fEDA^ETQG}FD}#^&Wcox#VrP>Q#%7Ippqx>5Hzeak)uAn>xaO0J#p119W+ml
z>vmbB>-+kpS~WAe|1@ph6$T?r5U!H-DMVFV(CR2H0f)MpUPtuSI(n63gp1x3ADo1A
zYK0dXf9gycYqv|`@`reUw8A~rSPzUucmtSh3Z9-4YZhQhX+UMy@k0A~?4Oy1++A3f
z{|b66FxRxgDFN?U?kIFSos3L!A#hbgOiW9ZBG6-9aH+Oj%PM_86<#PWR5)YFfbWA`
zic7(~ItRy?3Pbb#cn;CHNZ`Fx#sU?PG2{e{f3b%rMoDy$;4xk|hMXt}lRyY4&NC<w
z_f-;HQ9`Z~n^4ZxDh>fAE6GDu<G=%&a~~vWv9t-pjKg*zFw{)6_uCc?Bn?u9YEo}q
zyA-G^U>e}Fz1d`MwqFVLb_RKNTtMxPgeIvm#{K<@C8EJ~pm9$*0ltXKdx-+7uu<Y5
zf8?1*m2cKEf@B`O@}8NQ7es)Co6Y<{E~7Zjf_Vxz5I#V4T-;{+%ae&7=oLw3C=mu>
zVayW!PIH;bFkXrlBZ(S9gVm!41bg8c1yckDh?s{mKp|uxp)CtYKgAehP`;e%p)930
z5$Bcrb+;v4=;GDBzz+a5p`Zl%aWR&`f7~+zKq=!|CV)NSl~t}c^{j_`6dPxhKRqI;
z#8QmH00Y|g6fFZ9Q=l{+o<5v#*>uIavCQo@%cjNVZaO5n>i>@8l1|6o@eEZGs$B;w
zTkw7O!xnt5ZjH++tfC8V?I_l$bMN#p)~x%T>tH|9!i9e>8^Gi^>}U(zme&1ee-vdq
z2(1CU87FVldIO=cbI7!O70UhWbYE@4cnjJZ3V{89YR%p2QJZpeZ4Y*usf{MAd!=^D
zMfR|Yk~j=!VLX@NY#xVna<lV``HG7qzD|+w8?KqlO$K$$utC9`VXy29;*E-CP|O(k
zfYF&}EBjZfB(au*PPO(WeD93Ve+OoejAZ{zr43NNeG$i(<@9LFA#ktK)ugFcbdm8C
zFJ{Y9o@|Gkf*w30kRk^*##G&P>`SnTJNBnzWAu(-I%Fkxym=Q&8vvluvYPeI>li09
zLcH%=$s+%J(Bkqyrug(;rP;Ub!YMYQ=D!)Wla9+Q5HL-atF6ow3ZNiVe-s#ghc6vQ
zu9*Yn-9`tIy#OZeV;Hvl-sm>62<&J#nRO_8!acxk-<Eb5UJk{#Lk*Q~%fnpO%7Jyp
zt1%qlTn4j9WmKbK*FyKxo*M*7kM$8Jvy6B5s4Q7Fp^P56DKERof6(3@@Yq#@YdC<R
zvYXk#GpXNKa4%aQW}OS`f23H#2BWFv`}AN(rDBKg<iu2!EO#EoYKUMJfhoJ!k@1Nb
zaLtP?x|EweF%$7bFs69PMT`y_@{$k=C>C;2e<94`Zx5+qWB|fNSZ+V!o<!g^DV#Y$
zREZ27qpySl2zF5F?dumO<lUxW61A3r_F8Md3sg$jULReOp}kN+f65JyA-0D*ljNLs
zZ{0Sn465IQqI8P;blE<gA^=A%7;2s!(|dtkJQMLeqw#2|kkY7ALYolr#Ies&GI<eS
zsSyXua8FyZWvMF`n4#e9o6c7<TB>vk6(H8WjVs}nruf)7{d5@q+FNoK6yFhTn{OB#
zpW;C?YKBdT@XVD6e^1+^b#RGhyhJlzqFUjgoti<h$XOY9te^LbmnzkSwY~@H;<*Kg
z*b(?n@<?Myg8Mn}RjqW4e9@La7+HTJo^s3=D#dgW8Pqm0ATJUAGz->2w1k#M<G?2X
zmh`b$$_>S}2^xctA5kTwSW5)sX~^GT4%}i?kEvyAAxhH~f7r|yN(1(c-wws48i+~d
zn)=ubCADi3Ok0&gDPmhZkPLtGUgR*c7p9ZgK-!W>tU;@QD?d#QSg1{hb*e*wsxWNH
z%}eHXceKjLnY@Xkc)hiWI!^dkE!HSgfLi4VKD+ymg(q(m3vTa1`b+$f0MNC8W-6v9
zs4~oinz2Akf2;$9rX@P&R%Bj5qXh18&X7r-u57Ekco})dB!6(h1D7shugDbZ?T)>6
zUkNtHFwCk@sl#hd=>=KVp+=WiF?3@qFb^*hB`>+=G7|D8pte805Bju^2l-X^(+)S3
zMcp6O)6}Q=fZlGmdu>cSN4CS$E97mjH<_yhD5qn)e=v4~r{E%t=a;%lI)*HUS-e=F
z{m57YRtYnfEc>A<{03I#|B&Nb{eZ8J@zz_x$I4QggMP78sJd>boSHVx71&7w35=zW
zi~yNimhd<RJkaxvnxj<&c1|G;B9&)}498}OCHxb`i8m6NOfOUMVDjbk!Q|ghARj3S
zuB@PDf4Qpoi&Xe|g0Vm=|AIurY$-RX2SLpA5zK&R>6xU6qS&-HHS>1DdOI}_@Q-8C
zn^TmcN^4wB_&{EdH{&pfl<=-s+gTK6vnal1H1jCNL@wfF92zDc#n)_8dx*SX=Z`V&
z8Lc}0Dz2d-+mDwM@w90wR7(!!wG^_H3>Jrie~r?pM*<uSS)7cpmm*pa4vL*uWlyo9
zm$c8>>;mZElNsLwQ8<^8556|lhh^w<oqW$_5N}t>nAmNMtIxNhR)jryZ2ETKZs6wY
z(Z%1y>7@3|*~PZ7cn%40bCLT?)rSR2j;T2G<Lk)bQZj@KA=G;VA&1O@G|g4-<?jcz
zf4F7^pu%7Y+|&#EiP;j>y=i64Vxuf>E-$fG2YUTbn&P4tNq|-#)FXQ>8ryl7WPWoy
z?^1=DA#arD%oC)Bh_-54r73Cy24A&`=_d>8q^=Xg@Blol_wA`GlY&}%LMrTuGXyOo
z+H~TiHZCsThzG;kOtqFZ({WnpJc6Yrf5@qp>C|+*k(wI+Qm1qBmXQge#~tFj>N$A!
zyREb<aau0>o!Ti)6Dzr0KZ(XGdw&Q;gm6Q3wl(KpF+K|S{H&*)nquK<b}095PEjSo
zZqX?mk6a`AqQGE=-{?y`Ruta{;IYXBoGC^IW>qJgkbyWV;NeDm_$t6G%ZIL!e@P)t
z0B!@`<cdHC#nkNkn4MDgX#_LkVLWtu@i8lnLj|5JlNbKOOW~`lV6MiH$eLs-!NU&9
z9R|3C=l}2$Uy>4V?bLXF9rEz;xld!*Qqp&*5Yttpt6)<!UM(Dv<RcN%mzxaTlnPqN
z(43Mu&MK5fodeNLMvx@?dCKaxf6GUi&(awt8k%xq0mkog?$UT3Zf8pCtVWFCc<!=L
z>kUYXgC}WJtP+kV-oNX{P(RS%4*5407274}jA7_%OzZnd7R*={?6#A2aPc}E%^~ee
zHwf}>81fD~qX#&VpRTdV>KG;i?8qt|G@<4kB3Ws8V34@8$W9_IDt#{Ve?aLc!=i18
zl16qEX-XxWz@sW<c1H)>jSNbE0{34Yg5Mv~l;cG<UWCDBQ>h|(P1gqKkpm#`@m!{J
z=_`U_PcUD36GUpniUkk*q*--QiDjOEGw~i~5NB}??@xtc>_9LDUk0NL&jx5|B<r-|
zrT-!YlxVaziVlHjP#C@Le-)Wt_}hA;LD>_<Xzh65AV9Vl>i6TM?GR2&@#*O>2l+|M
zv}^ie4VyqCm-I$?20&FKZ`w|JD~WGda_wt{Xe)=zhxxenQoo+HpZcrrTI~8xGA_+6
zZ=^lDqn!j=ny<?O%_AHgZ_E;*C~%|5hkhhTIJ`MX+r%3-JxoVNf2FgR5inuVatG;$
zL6WLa(`B7Oma1@}bIq`8C_*J}A<~d21W}XWh^x{D%D<u$U0L?AT!eSC#9ymugX?~$
z>;SK3v4UQakB<%X%ywY`B=-^r0484oB(&g{o`_d?QKv4i6FXIP#(2&zh_#Iez%_31
z0chKRU3_U4Z&I<ye<9QeCw%e+R4AUk5nc4ooL$rP^nEX_<0AYnNgWr!0+He67((cb
zK6a~wZYI`A=RXu#6<CKyVPMLFu)Ja9j%wx!YDkRo9;)usB7K9iF8-j)l>^h%FRcb{
zh%<C|bHb0Md8HV)*<cI;uhHRfE*$i^!49SUX_#RBo1H4?f3e{yuEDEA@qJ=UmB<w1
z@|quKe80z~{)8lZy;2%3S3AR?a1c|?@OHAzp|Crh%|mbt`JTxofGMEEXQ6F)M#R+x
z9oQ6UYyk^k#6A{a2ex^AaGIZ>!-tl)B`vCHV>=w>O?%yWd2N$Au6A*Y;PY!fiJA41
zPLA(eI9}5Xe<~kK>stM-DYv%zM#Vj~mE85POjzqh<7nBK7z%EJdMFzo1^VwAlqx2e
z_?%v%oxBTxSg8UV=+4SKoXPdMR9nb&S<7D$LOZ6g@-j%XWQzs579hB}3jrH~Y$BdS
z1<*8rCD<+wkJ^$E(!q+7XR#ld$W}?5FIT!l@>*spe+h8Z3c5JEmnq5S26A-NM(4Js
z7%@0jljQ`1-r?9})e9;vI%$z3&vE%*)9N1<o6`livg-d`%Nu>q1IA6>8OpK~92c_3
zFnCd{Wr=PKSz=FVMs_cw*`wiRLKT>-K89p<aTU+yMIJ&6Z7ca0_eGd}NrhSm8Sf6J
zPV23If6U2Q@q*#X%^T@^G<Lg{8A&P{IuTH4Lv0AJys>NykZq-a0<ST*n#Bb;_8LmS
z;95eZ_sSJu-eaq}Zp>LiLf1cuQvDOo8_i;`rJBflY$rw6Ub$4^j+xe8ThSbV2sFR-
zNHo46njDyyQZJ$N#QAqmUcA8ey;Q=lf1dJ#f3>mF$zMOHo9sMOo4sloODj4n;pfzp
zF~7fx{GP;RUPadndB^;Yf*N(R2@;id8pfY1CU>itq!nQpfu6!9_r&7n%E~&p9phDY
zQ%X%9W3k;nh5>g&KoQJef-;Thc#P)@C=XkN@ipa=!SEwwS*a`FOHB{#;JJ40z=+{B
ze>Utu6-PO`QQU&7L`ipW*L4DkD3LxY=?S7ss$_ZS>L$+)l&iFyMGV6LoS5#ii#RI~
zj@P+0K#A#uDS(icj=c(_c;X+zD^=3rH&!Vfe&%FM@5Dv`VS@;`IE0dy>lJv>mI1U#
z^-Klj1UA(Z*D^I{#UA_O008>6U9)U+f84X*Z6V{HMeNN{P14v&CDN(;a+E@v{g3Di
zp9;~r$i;tXA-h~i;@lw~TlrWLP2@VkXHs`3R1xngJ@8uFy)~uq70o$o*DUkEm)L5}
zIi1T+$hIjCQuHKr1Dfl0dO#W5BJH|bqrH3Lok_gb(?{}V;&Dm^Gh*YBi*@9DfBGg-
zd-NGi;4_-Qfzbr^DtT_NXRax*!ktnV@cK8yJo*b8wBVlZZCC&olxnAI71d=-g#O~^
zCmSF^8A8vc{SGfYP`64B16TvMsx=qzYmBzcHi^0l)U|b4C7DPg0~I;W5oAsmiOuBi
z8UkUY-?!h@Z><crgzq$$E4#99e;*iW2HK?yOmVmCgkR%EoTHrM>1|(8GYaw5Jt2<%
z*YSTm`ss;$_tVok{qIb@`{_KT|INnl{^O@N*}I=!#_xXmKQ8IVAEI~vz&l=T-u?7E
z;H&hn|Fh*^-{$Y|*6&ty`|E_R{y%?xhrh#b@ELwHL)tgBKm6+p`T%#pf3Wa3{M&v9
zyx5D79>`z9h4Aip6TB>Z57+4t-(>Ip(e}g1KYn`V)2F{*(Xe{$a6I?`li-W~fmgtX
z_9?<@>KB54zh7H>@Si`^2eVlEYQ0lGUKgwU%zyU}Gudwz#l+#l?v>S7{?{+G7y2%^
z81I5Fc_;tTzG{tQ!>#%bf3sVag*y4yqsRB|E%Jzbg0e)#|C#E#@nc_YvX%HsJUr3;
z68=hTGtzB#|E9a&q#1b}zY=uQ-^8i-kG_$|;{J(vBz}AU7&#CQTr5^ANsoop)Yh;T
zoA~egf^rX;r!8aC)W*Z)S{v)xHAziU25-JsISp)o0N*|KM31vlfA<*|sqo%5h?^~O
zz5qqg`^Wd*TS)UD#Vb$QudK^miyfe7q(L1vorl<me&B*C*Nkj461HKU<w-E)t}IT6
z-ZJR&){I)pI~7O8w6P~SO^2|=gTbk_94jIR?Yh%T+E(SHw;T(bXk+PgR~gyq;N@Z>
zxwvb|jEeJY9<S9Qe<~WOTDNb7gz1wIbm7ytwRbKaLRDgBD5tg4Hla4?v`yG=^3BNH
zEDol50yyi35D1Qy+^tL3bxSin?znmYX&lkBTXoxsjm~*jdHj9CwB<Mu8ONSEl1CDc
zaPLN)qqPd4s<nUM41NtaW-UO?wdb^$ZA;0L3K6r@{#`bWf99JqPWq%cA-vcXFIEHL
zdduLd_0nGY(xmE|_c2l+P001*IBRHf4y4^Y@s0%>`~nmpfFiOgx!0Jf&QgOItAQq<
zgLt1$v+lmF_!wb`s^7KS_uAmvZRd=NqpNmr**(y`u_b+9)7-=ljVXLY#W*M%ABLzn
zKb6P@4H2`WfA9&_$va0oxX}}BdJN}jNoVDd#0qgJe?V$d$z#E;EqwcSjNrn`(BG77
z3jL)GG|XzVD9$lBA~rU085z)c&G1E?(fyvGd*=fk6!z}$HXz_$ai+6dYp6-%?#wEg
zvl?~Prj8P2409sc`=iBN$B}Q;x7Gcv0M8N4i4OR8f6xq214H&T6;T9*(7FFz&shV~
zit=YDpPZnG(DIpqjKW0l16a0|XE*8KD;eg)4^%iX%22qyYP;4KwQNE~P_XA%q@^3g
z4o^}WY4JtqNyrsuPu==}zLLv5lYtjOn3bZzdz@05sJk!JSzf*!4l0cc>T*_b=vG>7
zdtA*Ge;(S+bg@V~!D`~fS4pXVc{<m}u=W!N#5o4cLT7Gt%p;AH%$^3Hd9Vz5iAZnl
zv&rI2hOJ{a+Zl}V!A1wJlBNG~wnoFl@TPLuw0E_FX58Y{gw4$26c$8MJPcOcR0<O>
zxY!TRWF}LUF~0U;5KAw@_+mhRZ=2(WfJ-Zxe*n;|uAFwRM>Y3xHaX}4H&}#hho|vf
z1D{nlWqjJGS}TzPcjO?VZ@tOg-_1ZfD1dZyy(3YGU)<1mMI-Mec@**OfTjstS`xO@
z)ngSbSF>wKI)=VdLokNa%;C)El*fWK`E>fhKY0v%2z`z3T6q~~%&1~JbcvKQ!_zxh
ze-D`zB~-<xIC{INtb%Y{W<LWy;Sm0<mb<v$GWbzDfY4|0ra;5LJ%5suP0U`6R_-oF
zsq(p|j=?M4aptep>lyQ-RA_UMlRK!pSppSs5yI%XZuzj>mU8t^Lq$+i1yPL_s~6Y!
zLSIm5x{_M2yr*#@G$@_|0winsrAf_If9`7drA+iz?hPx8;kLm!c_<EJB78_|z2E+J
zk(s?3dZt}EpEdPoO?@a$ecM5i;Z!wD^Klds1)RIXM&}76+18ejl!%)4=1}i?P^jEJ
z(1h1am+k!I-Hr}>849}_X3c((CMsw)Myx@aa#c;HG5MM7?;2Ek`InmB)<szDf0|V%
zL$~SI>IikcT^^zJ_c}wAe{UoD>L`}@xz`Xc+R<+7@RXZ?h2?H285q5OKQfWdgJ0Dv
zbJxBVyo1CSu5E|(SgTBGC-&}Lvm1P;C0&8Dz}_YNxFIX|I=;SRUk%<ctiRi!O&My>
z^)#OCxRKytXS)i#KI&N}GU&+qe>n_s?Q{0VPEA`kPb=QA3IOM4yUVlmtvjCgT_$<p
z6DDq-IbgQYO68<jf6d)aiXEra(k7HfFQa0RRJqrv9tH@QH}Pg~88ewo8fDg`xYUv@
zZrqF8(_Q(vRx-_#t_ourU6v^1ejgc^p4Smf(|xX7Vri|bqpvCTx1x8#f3t*)uoBa(
zgypy4PrROk6v{!4_dT+&es)gOVrI_I!LO?E(A;G*@HSy15tF0TxUP-a;T?t!3j%Qj
zgYRzR03#h_ZF|YOdv&vTbNI!zr9?~i{UDyO?aU_9-(e?!FaA!QJI^zjrF%=Y0~;!}
z%$c&v8KQHCf|8>TLO*W+e?+)eMQ*ngo29Ek$$Zidnu@b^nZP+`mL&*lf$>vPlpr2v
zrJZjLCz}WM*=p9M*uf!Mc3ix_HFT*uZ|lI>PJ;Au7OE?%F)ymAleNSe8SFZQ{j7rJ
zs(op27y{U^S=uET^`6Tye>#PHBSM24KRbK<{O@PakSyaAnM@oLe|TQe)QLz!`6tj?
zm0+d-Xz!68F31YJR0+pTYbmDo>(Ga61wOtw^wWuW3B4G37zRU~LC=+WhGoZ*!Lsl@
z4g8nI*D~<|R06mjdN2vB`yEprnI0_-mXQo6c7NiT^_Cq~)}7O^i=F9#N|PG^b^&B*
z;O8Z%7KAjJ1<{PLe>Rv`m`3d@!#GVtC@cV@P;%d4-7BU1WDp5}(^4Kh<<@+I>aQCK
z0?<I9Yiu7uyeygvX0aZwalLI4O92e!$M60J0ZMow2=Oo-*^f4xN!LGlLy(br--+tf
zO;#pMja<szyU+omM{=ahX~Qe%4rM%2fvZBjHxO7cP6WWde<#onGN5)GrpE~2IY#rX
zNb(R+-OS5*2ApwR?zB3^#$}0~%h;OB<mc2Y)3&v0^#b-NjueLyA=7oX0IylHNq}}X
zD$<^H%G_KBOD+bg{bUklXH?tdR#{IoOlKP$0i<k;NaiZSuA^Ufsl27VyP5%%Je5aH
z+T7(}S5+95e;(xa`<9vs6xzJ>b)m8A5y4sM$XM5i4Zj#YZl-G}zw`|=KxOha-B*9I
zD9!D}S~Kr%qqlj771^RF!OL@iXdmL;CTq-I6VOI5;buxQYZ8PuSR=wffsnEXBY8zw
zjQLt6!5oE_D1;NW&7O!S1S*AdoRms7`B^i$03DWEe}b(I*Qhb@dyuNAot=Ot5D}!8
zE*8}YF>T+CoCh9~7}{BH)gplG)LVFo!Nph(*`uWl(zU!Hk@_dbx9oGBxYDm}4FstO
zgG+TCq{=2_dpuk5?oP<oLkAMFoqg&U9;@j81M>g|*=vWAo{o>Dn_84;lj5w5u+yE$
zS-afYf5s!F(T`e(uasdOwY@>(bxm5j`HH>~hcc?EGqv10%}3%Hw4IxEou^Bn1n7sx
zA__kDI+1fz8iaj#C}lfa4sZP+`<F`kb1jv+mej1H!FCB%VQv&GX8+W!v&tu*E}_tR
z?s3Z!0$&_&jh1|n4U+EUl<V-DVI+~Gio<+me{X`dg4W1qQRdV}_^#@Nw3Thw?X;DY
z?O9S(-?oewWu{<N3P*@q%LuT~{t1eSdVD@i%`NTXnysE)fy>H=tKxgB?5KR8Fef$S
z3Joz<-Mi{}uKYs}+dPfe>o_`tRIZfy<>BcmEJq2-;OKdTFmM_%{)l?1tmPwt_rAoD
zf0^xYeIA}ZtdH_ToQVZvbN1f<m-_ur<7g2=CsP7lPx5FcL&RWYY`2rXfvr4ItVulM
zCZ?qom`o=2y3lm)*QfI&&sK2ir^c(oYQ)_8a(}Fk_DUs1NBAh{AIIKBrnbGY$>zmK
zyMU8fxAzHbTK~N#?DH_Y%vRs)Hq~>~m$+~OBY#RJ*@cqXOfJ=I?bg4uXt!?qAw$E)
zB)C$(SS0bf7#47rg<MKl4dY%c9vUi{!ehOO@G$$;n;N8M>;Q$MBAcfpbmvnttV(US
zr*8g0eQ#3e!X}~DM8NlW<jyirr7^q_^vlrQZuDr<8ZSt7U=6yfg~1h{1&fh%i`}Yw
zlYbiopeFz?;dpzNY^$lnX(p4*d>KQ}%%PCU_4Rb5>2i|yK8Zy;^bH<>?%t3-PprTx
z<C@p3&>7sY8>3go>|nR9Ky+;os%T{fZmOcGFGvMHz)4za#k!v<{$YgCfyvR5ZSG;}
zK{VV-m%2y$u1!$O)MH0o+jU}V^i_sk{(ri9xrT=8En2U(hKAD|S70|DDRDzFQn|ld
z89$?tnw1rDWDe8T<7w=xr#ST2vA_NBt$@10PJ+npuWg*FfBtgzu;f?$vP0B2iralV
z4mFFd9rofd5g0cc?V!zF4x+}ixR_O@*3U!L8_F0nZdzvGcAedjmvDc^!5$p5ntv<6
zVZU~u+v-Z~_||txr~{M0Tr@IWlEs%Qx_g>FfQi-Q^Re`ZL-@VPGAoUPi__&#YBJOu
z>SJ;A@3c*FXWZjPYKJquxcRS6)i}7(-Dn-%N`2$u)}&P5>hz8sb@&Yge2AL+x*cer
zOj}N|);U+7UEg)cV`uI-P(nt(K!5BPU*;5H=VdBzbvSlIF3f6jK6S2;gQaXe-ZGWl
zyncAN`5J<1`^%pT44HN<E?tqTUtFujVt+eZ$#k`^G;`Q^7E`w+JKT%4s_i-0k>n7Q
zDwW{27Ml>OzdKart(`$qDjz9|5%(2DyZc|tC(1?_jHcS+?^OMQA2ji`BY&I>=d#1d
zv3=au4qQ5j>kedyw#r@hztFT3mF8h~$6mco*^RUSCwKif&B#@z-=_ImP&R)q2>PCB
zyp@~0%0{9pGD#a&+TF^nxTgT$V!v>cMOM$9eJp8d7OwZTN2`oXDTX}Sc{%a}oB%X{
z$zUy0dq;vG+4W@(ekQ(cA%9b4B6|H@MTOc;(dQdqx>mZo+J^0UpN-1UAkP$YaU+5^
z5HpWt_&Sfik@LM<sb8rC!jC$(S1K~<;aK?nIbD0dtC-O5bb)JYXeWPYW%gA-)&Xk?
z*$+W>2#+*|Fd<zG0YI=hyPMFQ;}iyXvUl-*x3apE>)d91mm45mC4U&GHFlX8a?{LL
z;jX5C#*{Ey$az)|`ZO|~3j<g_A{K=AyUdeH7L=g~s{>=*Yu0GK>}%3kD{6ocN^4Y%
zUn6*TYo*43htg*QIY~uVDvUSE7~`gQ*wO#`Nsbq%<G;N7?aPPn|Mh4zRN<LbgT14P
z?Z_TxBz0B5`R^b$ZGSXLLth1LSsSe%MBxr=iMso&>yo?}$$7cTFx!JL`UQ>&(MyvE
zmSW5GREg;<Q45j8d4{EYPzwW9denywN(bz_zDTjGGl-Vlq8SV99>E;~ssf{Qqvlii
zzjWGGR5u2k{UB5GEKd|(J6Zdc5jZb<ikDug>4Vb;Uye`zG=F~Z=dtwtF}>9o-)d~n
zZ@iX~T;j8s<j>%mbL*0GR9hud*QXwK;m)XQ#+(bRgcTt6gA`ga`}W^6fWzb3d-I)+
zB%{F+s!WwlXOq=Z@Me9YpvFHIAjtw+&)rgK=`;BLV?gq2>{Qg!9LPC#-04RuLXU?9
z9n(-_{T(i96o2+iL5^3l{RVs2Fp(`-+aOI3a5-S~00j7Ylg;81j%Br7<-3ME$eNs0
zo1nGi<k`2HBgF!Xs0eFRjR{Sz=bWKA{+C?k?l0TDsxN{xbL^<xrA=iRUdZ|7Y!#=O
zvz=-8oN>CLl=#%KfDQQ^B<OZtdTR`-fOP~m8uWhJvwzj81x#v>`E|e(%BR`^D~QNO
zeLUH2v{t5DZq;Ocp;xTgDOTA6Gm1@o?R}rDQ*?DatA@JHVnrv0ny4uiWZMkh^usK^
zZ2a1iC2sZ6%}jhtRnmPDqeXGnZQU?PGly836KG<6Qcq|x_w?lRjs#tONCwF9+7ZGP
zuz8sEu79tm-`ws1EYoPdb<HWaHDt{}L%h<tXbBVNY)~7cAv(6+5#DSjT&m}Y#}xa>
zVpa}K=MoExqxf<+LnV_z_#qUkz9~<_5@}K&;m=ywO$!scS=R|?7j<oA;yTUZV^#2!
zVG$YqmG-EMl4N!Q?Az01uu_$GF(UFL>@+MG#DDHnw=xKj#@<I4<D<5_dsnIrrt^j~
zWrb2Y9Z!+soD30=!)UFNrSgR?3KqwJvckXRn|Ztj_fb)CeKHZ>#0fx(jqhQ3(|RMb
z;39+@TV2X0BXN;uI3(5$aTj5(p_+#>QNBoH7%=8)$7#Bf8zuZCSY%l0By;eR9m5zG
zaethR=ZQ>L0+Gf<MnC2$dBz0Zn<CB`jHzxmVK5Ieu>=J3lZoEUn@t!eO4o?rSu@F@
zp~M6Bp6n<FXIO_Wl-LGnyf-T)G;|U{qUciODHjnSW#QH@l=5LKvA>)0#l`k9Yu{Al
zDFA@!QT-rMb1Z8kJQRB<EMgYN`m3+L!hg<q;$lm$l;ljN^_upsIO(8{k?p;PT##)_
zc}aGaccqNGiH~7H@HGuX!v;J!JvA2QBVuY9M6}+=9?*|B0!~?PfYD>|*RSxRO%O%O
z7g2mIbXekK1Y>UGGKd&bjS=#gV+qp@ZazPI_2l)FH)q1rLc$ZriyXYfW7GgAmVeNI
zK>^4^NMxSko*4pZFjirOFNq(ApkK8!X60Dd!TBxcIR|K=NL^ER6ay=Gz%G?t$4O|8
zN)PPheZA&;t%KP(hXuhnhx{d1f?gCu96&oioc;G3ATlN5g?OuV3{%gEPJSGTYZ+d`
zFWE}z0qGixw1A$~%}VAeVJ{*jeSh^;qU3xfFM<$}Ss_lch0etAK%9Xd??}JUk$x;l
zD84&XRH6HGo@P*bD<Op#>RAEF@rOJNp*%Ngm>xhI2B}!&VYoHuN+6=3>KEU9BA!RS
z0y_voJ@G<#7DX^rp;_yJ#8PIifo(r4*<TjMghOLbiw=vcs$5Z6ioEib&wsO0JJF^^
zsQp%&TEEzA5Hnxr^GmgNrpSPXpVR|<zySsG-3Q&%lt-0tT^4IA(-N<Jz0BWT3wI!l
z!V4O#E}`n1)FPkM4IpkFq$%03ZbSVW+S~3c$@Unb5hSN$!|OpUYtyX(;dq&cvWjrM
zit~j0m1xFXD}@05>o_8a>wjNzi512pakN!3X|K_(Yc@q&u9G{NCW;V00QdeHM<w{M
zw{M<0q2KFQ!4SS4h{_UyZZOlDpErOls2YPl3KK~GUPi$}r5S|kK)C*9pqc<UiyGJ;
z8EDN_3_pB(_J+UONI3r;VZ48u+7~m}PC=}{<O(yW?!NhFRVOuHRe#4@d@ulSan}yq
zyf%H4+o!GePSpyXk>rZI*xH&0h`&^b3x)vdhh5Z0aX;#!x{>qD<)o?qL)TLy=z5Vl
z)|OY$);*R;y_#EJDJKC7N<-MblFO1;vV3X9J4amSVCR}q@@TIY%n~_QdyLSEp=uRb
z!?vM7!)Iwpm!+Jslz-YKBE<m|)^H%gs`;Y<3ady4p_ZYK#1Snvkrge(6el)K@<;^W
z{)v3;jAEp1A?Hb)f&orofqEAwM|$vNAptq^$cS0~C6mjPS}&OIH8Ig!;`GWg7$SL3
ztBqy*WO1z%Z6S}fBsOEh1O5xXvtho<?9GgA7`k+C#j1Kgs(-G0ebM1ISj|PS%)!Z0
zB+u|gflBEtzGnS2;^vG%>x3=l=Wz0Y-NE*vkxF;n0Bf<@HsM>9eG@8`eTOxij+?N6
zJH{*fmfdHj;o3Df6pQ(-BBv$(JVva1aCpWkAW2zMfE-pI5a=+8uW9kk0(R}awGMx$
z0UZgTd07o94S%NW>2DTf+xt45Z@}lBK59dl8$#x~BeOe&!=^|9Fz%tUx(bwNTBw`3
zN;a8I&*bh$iB7~#io0No+oN$y&;$i|yyJdYceIL{AdYsEGtJ2p{oBBbfW!^4$3o7*
zSyLzfII$UlHVSdD(~$^+g_>{Yq2g%bNHB7NX)4Hj#edtl=O*D=cI^_G2Cvo6J8zZE
zJEjur{gf2hIH`_Yv*zo(Wk#`hY;-%e|Bm+j{Q>s;9;R@WhAW%3kH*y0h7z2^lfusv
zZ~|%@rPw<WN7zsY=^jiMzz`|P`vZ`vG1Y9M>CmE;)wn&%o&JVJ{+p~*H&mvBw41ui
zr^@Z6oPQEmEfHg|vt&sYuOT*a8^+QXase%va4%8RSQZmUwtkf#VoOWb>2m`mHc*$3
zgUX#Bj}8IkUWy*0n;tMMWr_?4!Hrg3VqQpGs8ta8HT6?9xel!=@Ogt(`qlj@-gvue
z{Uto&K)M~r8Y7U8xKJ`t#m2;o7BiQ$dnsdoWPiDoF4cC#`?XdQDpMADSc01yaf=LX
z4ipB09f3TgIiSsddQ-P8kCQiQy}@(S@STs7aaOt8bxVuq-tNvatC?wvRDoR2G=gsP
z0n>2iM4YWJln>|l5N~Qcg<>d~pD@NwOCrrT2yEleB-0a!1F&hLB?MSYqz1_WTZqU7
z=zlx7Q(AaRO8=?cP>?YgN(gZGfX#=?&*{Amx$8U;ft>)bH{K%%b8_HR`0+f4>MW?L
z!74JnJp~g(a|!qio0&)E0%0wqc?#{Rz-HaX4G{*>C3Gn)2Ium&9k<hM|IU>qy`Pc%
z`JrfeW;XHFlQ&PlbCBf5cEX&n_ie^KpnqQM=Efb+J*SG^xt2FNpG-U6ol2uRypN?W
zaXUH@D+irwGM)1&prY~)!4`>v7t_fCHGSpTukYbuz!FR&*ug}lDTVyKk}~urG+%yF
ziVYZb8q{<>-^@00ehH}&<ii!`-#vNpLj3UZ4J9Q|1_3h2M4Yc=qEg*3v10EDXn)<K
z^sDI1B4#?eCB6(4Hm6j+@X&7b1QPsXfr5HIS1Ao|au|~MS_7GrqUOX(TBKR3vOAT+
zn0{&zP()F@3J<?LcQMAMtVZfa8FOtL#nDq=)AgGCS}6Cv!#D>M?~g<f1sMovAuHMw
zl&2*1ITAAWgN)K$%3_^0D?rx6{(loKq$^6-R9U_mZ$cT_**M1@em`5sz62HGjfBU7
zop4Ox3tw%*c)O-1lF|>r!3^JTk~m(>mV8x`M;CE?IfFg(PQ)h6&6GJ?Ce75wdt9_G
zUCZP$E%BnDV&DTZ-5pZ*E19RNEZD&2-Ict{8fvOd=;;O?)9d4{<vMpr=6^~D6Br*8
zOZTB<oF$&<8*NW0buS_p9rAaC0x-@qftB81)dX3}gWjHSCJ#{}fIaj^o<*1!@3{+S
zS_H~*&LbZj7REAX)@2O_Hwx*?O{S6^X;z00ccR_bD$Un-K)eY)=N74#USx0brFkO#
z;wJiglJUn*sr<g50;$?!Hh)g`Ak<pmY^aPK5J$T`5i1K@(xS#@V#FjNZz7)LSv*b^
zfZPxrVW^aJudR(K0a#|mBPQZUNTG$~P53234yoTrz0TPb#pR<kUBUr0x#eUV$n{0A
z%ww$f(Ia@`_~GeaPQ+X$2oH=y$txLz=;5z$7xkng4~2(_!q|uMk$<=~CftwicaX`q
zMd^+Ld1q2TtUN9gJ4@!zH2?dd`DX~{({G17J9}~V=4=m3<WMF^Lw`g)XQ8o)_N09p
z#>tlE3;JvkeLQ?{`p}d_6k}Y=R8JkLOB3xweRUKU7bDdx{|@XMnv!1J0k#dV-=|>P
zl*qqb<U3J+yU;(7w12-l(r>YGh}b`i{YJ5G^EfsmrIoyUe!de^3BVTh`yc4cn&i<z
zl!QqLf6&l-wm<?mi4-~DF(h@r;(%OUzVwSGmckknAtA4B45g$%_^qnNU6DK>N+-lc
z@dwHu#%OY!KpWtOHoteEGm<>|A-*1R4$h<DibA~HPyk5$=YRRjAJF|w(Qn~FNg<33
zdAXF^?`d)Z&nNsW5;cZu20)l3m#l?9x<)jaBYT)5?*t>a(3Lb^kYx;F0|UKQY$1rF
z{|lrggcW>F6&r~(hIc}YRB^qE!AF<)K_rtcW?Ev2e-O<RLX->z!lgnve}wZ)!S5WT
zD@doZC#?&TQGdW}k{D$qK^ddN*N>sTKhDHFR5H<%LJ#xgix1%LGV-FHZM)NX%0*Z>
zXw?rVD~?=cg{6x>Yu+Bs`(cIR-S{W~iS_Wh7l%Ep`fYShXdKy=5FcG|Xttua+g<B^
z69${KBI+?CgF?F=!{d4&?4wv0xhHuvr5ZUA%E(V23xB4(G3%S6d}k!m4PeWttH1}k
z7%@ybgp+kfS8x$l^7l}8<WUyqU`&eRUsV!|xlHHM2Sgc-M8R(#q$XdNi-;(t6Q)E=
zM#V>)INUCRFeIES*xESEF~3th5q_Lsglfz~Cd_z->6_p^BH}aT{nL{}+8`d>;Fax!
zB7HSTi+{Db%cx|DLl33x+}Lx7!u#mBvwY^XL)4#@UW3vrWD;`dRXK^UNjR0{!$=E*
zlMk){UD*ovrj*WdFy*I*z5@lQAJxfb`l7?LnjV>R|B*BXXhJ|!f)fSgvH~(c=74#P
zmWlUBESmHt9-9iP1pGW8SC7@ih)yg8;m%~{jeocl7Ge^q*005>Z6cnuYgQuLYT+iP
z^sv_LQlp^sqBt7sr8=f*PW?nKvJ?Bgv@&c`f>E5!3O)pJ0OKy=L<P%ennwis7Wln`
zEa2FOLp(hBG?R8}e0(q!>CD7?tI3arhs!Fn&ds~1&W2GOb>}T8%|10(ktLQGsj+dL
zSAT9<U6u2D4yLLOmd?{n;uJ*gAaA(f@TA?41T;W1d32XIX4^-fnJgVuHzK<A6pvU_
zQ*hJ^VCM4}R8o>h5go0TGPqrRL`z>d_<}4|;R5W&z(>WNV5I<9!2rb!_-TO*#sB`l
z|364fmH|P`S-&iTB+bOJnk*;cDv%VL1b?u~`Ix%mSQn4yazlq(&>JIhy$a^wmt6<w
zUNy^=$z-Xr6A>(`%L<sIz<=s7__>JA?B7{7Aj)a9oCXoTm_1+S*W%b|{e}qY5PpIA
zKn|>BCBP<Wb<X5f(&l{1@&{>k{lfq3O1+dhb0CF&s6?5MSJE}6*X*ai>w`F|?|=G@
zcdNyX==gY)cqPI7Ksx+z`Q%-M%_)zqbdA3snyiZ?^qM2ZMSnM(Da%$=x31Py0~DmG
zspOH>D%S@kxt38bLkvKodlva5$Oh_eQkE3)Gis>ty}GJ(RL`_}fo2r!d<Qng7iku6
zj3R@`W1Ijg@km@MwIT4<Y!yVyFEn7;M^N9E1rea_z_O55)2f<B*PdV%VN6p(AqavW
zQbj6|?JC$9V<X6j+go-;YgOL#W9^sGh5{b}eV6fu0vmssq{%}P^|Q0{H?QA5ee?Y9
zXD|MzH$Syc)t)6X#oV2ObSbOV=s5;qp}wVJ6@Z4@j&vtt!v0kWfKi3<1^=UgsX#pv
zupxY&D~?}67m<jCK0k%tBgL~?p;6iW3tw^&l(J`v!d*Cvj}6sn-|#xVs@D3>3Mdq)
z%LN@P!%%-*sx9WiBmwqNh^y`^Oc<bw$!mzmV$dco0l$jlrg$vZL#I$sY=J~<Hx=c7
zG7--?MF(_?g8iVZkBElUN7hH>VoeeZ;Cml0LTrkQNRg>{efG`U^Rs7!#;#L|kE57n
z&zQ2TuHjOAm=D%KsPq$0$o%4Uju+!BfpjY>0EB-GDYIpRNx^KpZ8Y(|>U}KCrIwvL
zL9->1QA!92GK75`$H_Q~(eN=5?MO9u4|z-*gLF9#B46EzOv%JY8zMzd#6=#2J{m<<
zxh}>!lrQoP!yqx!K+ofec=h`1{OtAL&(3SM-Z4Po6G)cE!I~jUPb>&5=3{Izc7kTx
zJdA%+FjTdjsn>-UO!)wePa+1UO@;}WRgb_#Q<|^gFb9bIb-qAhA!$FZS1M6OZbY~R
zLzcA(8O&gDC2FH&rVXws8(?F~9k9%=t{i}>8D>gMLnX0+0VTmkb9iEvysP#dFes++
zRBc0FEo2^MV{OT5pgc1GUohhUZ$Oa03ud(bGYge}L&s{#Sw?9SnNI%u{iiNevf&St
z1%KOC=EtOxKj$zE%3(Mw1XhFj`bCOuX~ZAOf=g^vQaS&RF;&Ue_N+Kg6{inZ4b4v_
z+u=DjjxRy*$Ym6#kW#%Hlv>pb<<|y0Om%o06Bds<2yh2D7#b+RdaHdB?NI?hdpy)Y
z25Jp|zF^cBfVn|D=<1i8@dwQlMvw%az^qNR2PR;T3fSmTsX&CmlCfu7un6V^t7z?l
ze$7fVuSc4Na5q>!UMQk&;#Kpqwon2vN0}hjSQN97F{Wk>D#6Zs+cZ;a3@MShJGOz!
zFq!<5^r)2CD^B*}uDW++2yg9x4gGPj*5|x`^pCs{cqnI-K+z8fkn6$%O%Tp*D7cFq
zkj)D8+abu@EOjd=t0M4k5pvr`sn?6NJHqX!vp;RXw*-f^Y|-oXwlMasL7}d}-`?V`
z?E{{;BTs$CPwc}_>;#IxHBzo9S}1;mx<~|%Tjv>_XdH1A$yW2hVTnGT{2~nIMqNXH
zty2c2kx(KSb2knq?#HBL#u~31+nipi=$5rk7jpNL4OA`4&=s&-R<1u}3#cKqUv8AD
z-{N_u)=vGBdK#5FH#Ne>legNP2x0$?6H~9g_O!ysz$bKn*l&Ct>{Kib;y8OP7h!z8
zD_AWzYU)srdIyG*(eyX{XQv7@8$48h^XVI3tE)g=50)3&K&fs3xFrL14Yo*3y<_z+
zv%n`ezF9!qk*#j#VeTs(QyIgiSQ!i4Yf4^&cO^wc0%J>aAAnohLV_rLhO;{3qvu%!
z_2f_x{j_LD-xcu2t*xA2)2TAUjG?W)18^x%qx5*1;McLgb%8D|`zGmL+c(*lg^L0Y
zf5k~Q4g+wZh4CB<$th-_kMqT92v`j|!)fb?h^S;qvHN_-U9WCN>;9kJP?Yf&DPZ`%
z>q+(Px=}nk?Y(|VM>Tm96|~4}J(`dpIIuBl^PX!Fz~_3R7DFb5Ot|fx2L)4pKUZ6z
z_K1(kBq+bqr(_fiAT~4(h`QPYPO77qe?d}<;9I_=yQi{qoXpUMF*Vszd8hOiyU+5{
zwltjmkj+!~Ws~w={4SZL)CsOxH8VU+k@KMA<C`R2$C&b2<)8qCbhd@W6zeef>e;JT
z#bNNyS!<9Vy_v0=eCMCV`dx~33U0*gN2vMzn}z)dK#am1&nhb=lk7rC%0S_Of7rgA
zQk|)i>X6GXy|V%N8-3$~!SIZ)9Fod#%M{$DHTp=EZ`MnJ<;xV1Y-l>I3$^<m<U;Iv
z($ox2k9;@u|5`&)G|OqL(2V+{#v5H)U}!!S=!IsQM}#n$@kqB#`sXUVHS&id!|`Vx
z_`UOhwpO}1;R^&0viTuTb*BjUe?cdBQeqprnkhpMzqW2$%dI#Pf6!00D$u#ERVU&~
z$n;bR5Am3j95G3iNKUMCXj3Y)`HHhKZC88o$S+d+fy|fUEyu3$ZFS{OoCq(BmvNq9
z@;oGGD$XNKu2eEk17AVy5WFblMHU@1XwfY9+HG_GcUt@$p7D)jb9JMbf4SJ+lhIHa
zQT3-*#@@qcM!0@LT6PKw>W{`T@*K5C`DMNa!al@yl4=@Xz<BO1QJNA?Vy|5-Cvvtv
zqs=2W$kFC7-Z1Mx6AqM}sr4q#Ftw|EFdNHjLi9uf09RR4SED4oZCd(Pb$UO}vjQ+>
z@KMdS4l2%&>2GQ2Ie1Ohe+kag=n#Ng_8_T-(GEchg_4whqtGZ62);D?T`R|YP7oTS
zdZc7LOb+5NsL7-7V=U^BM0+(2N?tbn5=t`UZPU}Md^kP5dV7cTR8EBGr-xU0Sx;4x
z2VAJq&AWEDr1^@%c>7Q%&WWmH(kxMOJ*L8`wcI?WoI7+(;ZKA`f4Nr4QYYL&UhMcf
z2{JXl4x+R`guZPGeTv07<pq1Al64Tt@O2&?<SgVsof$t8YOlsrFq94>R%_DqPIpA7
zW$k))Bj->R4tXdw6<eF)FvX3xG^uXqad%;jCt17><}wVoT*zf~bCod=i+d#WRvLI#
zD%rv^Nfm4|u0YJAe=(QGS%LS7&<mJho;4LC*{}gT$YZ;75NBmvyqv)52Mgqfta7%|
zbxsho1tj!pMHb}Ag~8ppgLOX&SNCsPxxT-@k?DA$eX0G)gy_|T!cQw>&^*{6Mq|K~
zQvLTqa&C1?4nsgMr*Qs$(9gxuIb)m`nFdf}A=7O%UnOxAf9Gkq-51mQR`<^h3C1mt
z({(3Z^KU<3?~CSr?JUCCAG-Z>ABc~l4@Adlp}(Ep+hMY=wW(6Yn1U#%in2Exq1$Xi
zE~uLRoB{_MCeRamyGd2jX=F7^*4_-_76q2$^W1tinM^Otf!~C3&Ys91T836Du}Wdi
zZ3x0*PrKUIQoh|$9)1+NyHlR{ZSJzYz3tNU==S+}*H*A@EdBAcf#qw<pcGcezK#~z
zx508dH##54b?zH5v><5TjcBF%Ti+B%*4VvytRruHM2%zh#X?q>UXTJT0qU2FkOC`z
zrYcQwh)<xamceU1ba$;o_QKLDO1KEeCh-!okm69CJQiuuY_p6lSL6fZ!Cs{CA_MHK
zjo2i?IzXU=0$m=x)(l6NS{0`@{6kwamr9dPYUX)}_RVhGwo~sPXO0`vIb>h1D|(0Q
z!+E#T#-~B9eQx4&H%)v#P8rb9EaQWJ%7L9=V?P{7$<C%v3)|lc3ao<gB%(yMqQM%_
zPlovHgm?Wgu&%cT>1t!PJ{f|=is6Jtz)FxD8uzOWv$8af3vQ(rN4Ejj`JsSLca)5t
zUl9|Y0S4Sj4nC_5_d#u;JbDg@yK;~f1ZSJ+Z%H0e3TXBIUL2V|cl(``VwJvsYa13q
zeWS{iZK?9LbbKMKwc(-xcQhNpM;EvYVsx;-j0}jo3(N)evPbWBM8zpj4#uPh?u(GK
zS8Xa1RsTZSZ)Lv|-fq9Z&Lyl5>=$VZecvvj)~RP`$qB~4tx@FsvR-SFyN!O!)L7K3
z(1hTxLsRH*lwMR5SOFV{h5VI&QF^UmV;PfEt1WBF8WW>{7|gK3JsGcMBq6mCTZp~Z
zGJ8yzeh^;YK=K3QIN7zhPhLI09ZxvgW^aPE3WLZsgPSe7X;!}NHcHm5-L{RaKB5ib
z#KM?j!5WD6PmCx=p9;YO+qP6m<^DMF0m8DNc$v;Ai7lP?5qcU#bJaJ0K}vV+y9yRK
z&E$H+c_hVrBKiNb_qN+@8_A+*e(NbZn4E;n=9lEJY-(h0Sym>RaV&31&g?mk76lP4
z2@wcz08la`^Q`+2_a*Lg+&8&Ta#vM#H@bla2vU@6C-Ry#5rIZ`b#--Bb#;9JY0*{z
zBi1~iz%MPR9`1__|Cf}1yBntQv{p3rh}TyF3UF1!Mj8+3b2@>ZMiH1u3V^`BGd}=d
zNLxn>!89MP@*VVE5<`nQ;Uoy0V;iIv%3k2Z9JSZ~GDo*{KeRs7g^rF25-$KD{^bkC
zi9?$Lr;Z|6GQ8qQm3&9zK7M#UUo@|lNmxPGu_lNc)4&QC;cuLO8~kB{0#5{i7ty$Y
zF1^zH2QB6R2e{jucZU?%36=;98jX^qt@$(ZA%y3U6lG_edm?8sXF?vc=ZdkhcS{R?
z>Z{xe=B94K(?f!~Ztxa;)J=@9GReQNa4?}T9Y}Ab#=TX(^Ku;o?Abbr6+mkURx3(f
zKjfZrzdxO(V3$IFsvf(-NfI7l89jO5OjZY#mjVS047IGEJV9A=*$ydeX1UetCdSvF
zjsA9Lnury5tE4#|w;TFATSD|T@s2Qa@f8cv79ALY9&g^ge%<x_7?ScpECEp+l;Qyc
zQyfjsFW5yC@+4ily4qqic0e_aYDYZfh%7cf|D0HbJnN-@v44KfDToGPRVT1{JcL$M
zR>90NW|Cv{{VdKf3Wt7u=cVHEm>t|=fmWPx<BZ2KmnI=PxAj`{^e0R94Vv&kOn8t@
zxR`uHyjgTmMNoA}w5~Bk0Ye8*!Uk%nLiXON3RBz}1dgv#O%sdCb23r#Pv=~paF6)E
z^F>8t_R0N!$-}I`+&q>4Ja+w1*YVGT=oGRR>sEj5Kr_!)QNs+eDru}`Kqoy5R_Asx
zU_~8I>ToQG&LKFHbU3)UJo7_8Rg#wwdAHPe6pa@ozEpj2$Fx_pk8M0zz&tkME?m3i
zS+=0b+)2+#qtu1yCt8^Su1Mj~><D}6fEdUC?t{vInu;buO|NVUSIu*}LG^#`ASJD^
zf7`p<f!Ew#rJ?}i>-Ftz-PG!E2Y&$s)!Y0|H}Fw3zTF;vNj8P-^aUIka_U@7*#(4k
z$D#xmUOmh0>w`%hi!Uwjs5x&Ni^KRYRH783;FARn<f6K1JJG)V9Hq)_&E>J5TpEU_
zC?1i2P`ajkL(IAG&o4exX#{JfFY@i^nfhz1!nPL>r;h|cz8+dKeez7vOC*cJ8tGIg
z`CBJBu4@TGdA!_N&;OmT?x45QbA;t?l%EaMp}_y04<z7uwLV*_oYE3qFQw9F{oS|j
zu1>Wkm(^%7vrl|7O?~;JEK%R*d5+bbac+Hol(kT9*;#fW+Lf$#F$il=yfQEr%E*1X
zy<k7bes&uJvW@J5ciG|ORQaIPRY1@!t({oDyleFXQ;#j|@`V0-3x6dYQwnH0#20xw
zzXR3btS~ezn_Yn@b2pKmh!Ls`=ND-obJ9?z8APY>GBlR6!+yl8HS)=oSU+j86N$@z
z6HIw=LP$F4utPqKc}npp<ibi$oKy+y1PMp@Brc$6SSd|!UXf9-fV}0YyL+Sm9Qak9
z*o9%2OgCv;{#U?8g1qMV*cQX4e}=w4=qszG96-Ldk0e@2Np>1K=a5B3CU(%rLN(Om
zP~-;^exxZMjZ^8JeGe=D%1?lg&RzX~GO=H4`MVyCvU1PVOwi?6;+<#@F?W+FT#PNw
zZs)~Wy*-vn{$`N6dzRv<29}2kLoKzVEW_-DS8m{|ieq)Q(p~S(0+&zRGoDVN_U{$%
z!zpj*p9WKb4y?eX4c%enahjl0yi8JbLPT-GX!WZ&`#tRD-4Ej+ia8y7UrvU9m%O%_
zgwv<WTykoBeLsd0pLSQ(elo&8>Niem*z&_k;KFg=a5bEy5n4>5Nlc336fG&7U!wO)
z6sBlV`S--7+}zBWayPz5w?yr*Fwc8&@Ou<;{Rs2!XlHTPM8-bUU#<@et=ESI7VJYk
z^n9p=pOtH)wvD)gglu$zlD%htoCE{Dn8!ni`UGz$y7I$ug-eYr@=1~Rm^oIYb`_pC
z2~RtE8vP@c6rX{28ANQ2qwyrb{FM9yCd#JRn>5n55A#E<47ZH*f!v%6FhH8%5=?JN
zc6UoQX9lRu=W=y;7v`9|Yh!V@%MNz`x%cK(pIu+@kU8s4*MZqMZ2QeRD|SLqoIvba
z!ZAB)JLVW8HHI?x>ul_YA@|H4MfocF_Pd1bAME{Y@6GmWmW1v&xrkEMkbfQWe;c=9
znF22Xf4Z}OV|RGzo^v>OrrjY*S3EnmiTXNTCrxfUMz7a<`uH)kJ@55;>+9=1_SK^&
zPkZa@PoMT4v#)yVkDv6Ou&;Vw-NV00lDhF%z1|8Y+3WR~`tKL=k1|_R92gKO`+GuZ
zmPW4Nec$-ri@rFuZLXDx_7{C7LPpp}tq<`*e-P}Sy};BR9)_r84c;G%CgF5m6I8}u
z^qC0nriU75%|QuLMek62CVM-B+uk(y4aVoZ=ocm+l!h057EVT|JXTN1xRHNON=5Oh
zwRIHoc{3k_xhu|3aI7Pr#L-{reM{@(`R1B#0MZAd#&Qsll4=C@G57X8DzcP{f!-Wz
z3o9{O`|9D}7x_=}mzSFYB7Y<va8`Kx>TO%3dw}dOY3!d)AYf#z+hvDuU;R(}wLgU8
zb9)afG@SVma=JZshZnrP(dn&WyEL8*(@89HledLD!Gsf-umY2^aJ1wTp}|=g4<Ldb
zJ8Ru8^z@S(dTsJA0d+NEmz<A9vJ8k}=HU>$PNH-i`(esLH;$w0K7ZT(`!6UiFxiqD
zPNA!D;KG3$_2?FMu|MYF_S-#n&O=%5HPUivP>2ki#~J9t2|MK>Kl9TyJY_{AIF6w&
z7o=0U;KH_W$*0$-17CAESFzZ|(tYWLONB2m`T8r!z0~eKgRY>e;whK}rX98&PSXqM
z53ILvpT<2rQKoRp8h=A24yYKyu6!5!@<We*fIbrcJaj=zZL#YMAJWq#>>|2mS3LBh
zm?_?!u*S)UcBj)hY2xHKoC9Dy2{m?>x>F3?Xp6uNxfrj}w&91W(%~q=w1jEIPGjy~
zB1~6qFyZZhU-5tqr^5j11E$xUhtNZ(iy(K>gf(JWRs-|AM}HwYzFzQP%;SWh>vYu%
z{DPJ|VG;I4RYVk_A#t5fQYwWA_@m}<O_&V}nSDgH3j{Q2cGl*pKzRjdLG@>@@-tWU
zu_!)eYEPxoV^MkR3Xe_Qu`4?^RmZOA%vE!2O3nf*&O8ODO1=3LD>qX9r#wl!K`?4x
z_+grK;OA<D|9@Qh|Lob*^}PIl^rZLfLH>W4^4}jJJ9QIC{ZE3@2_eRto^&ZsnX@Sy
zrm9#pHG|*Irs@az`VBh(509VS&_9FbGx0&EqbshG$!C4vh;$_K!vykO<sKcl*ZKaa
zh29^`{wT|CA_Sij&3`}KM4^bu8#JjDOsOa@NAwwUcz=J4GVV>}ahzit@G>4#0bSRF
zWN`qj8^To+W-Alv(Lfrr9T#fVgEyC(GMa3Q5`YOd3g5z1(9#J0UTM-<LqSqN$(9Wx
zZj!Ol9Ne30qN5-8c3;05>}<c?e!2I0?`UuLaIk+c_;K&`(eA<EV3%#NE*7L24Basq
z=zN}hq<`T0uD>aI*?GOU`{rnHwEvIYH-le#>w|;czwhoG?d`u2eHeuyuX?|B))6!S
z5Ole$r=R}y@?h`P;O#aT(X|dPrl+y*4aP2*qw!Wj<&NvhZ(r~J&)&}V>%ouPuV261
z-uZ|4G~gdV{rLE6_iFvuF6I9F^;CVe|IatO2Y&+eop%QZFcF21e~CUKt<a^27ilYu
zOf&Egj}CUXe;$DS@#ozPg=7}p`fKQp_;WS#FYANDou77p-WII{fG7{MMti&e9PI4>
z{C0ciNVL21`Sljqcimyy-CSEcn}j0!j~{w;-|t7E$TWv;6jCHM`?*bcBUKZoS{G@l
z1AqNC8YA($$+n&|`J>}|Y-?+aX@fOUAwovci7qoRTI_^>7*k$Uxd$a2-`r>&%ubr5
z4Pd1?^#Y`LHdmo5h=9jzl-vxPN?o|IL)8(c_ZB<Rfav(%jI>aX4+C&-aHWmj4xH=;
zfdux~z+4d`(pyFCdVb7@X~JH={y71iyMKGNE*2b3+f@5W-)c^aH4x$Ul`>acAJS<m
zwNs70Rf;uz&5+wQ6k2pDZ83caIcGvt=A4>M$|?4%Uw4oJeGUtvM&;vz-5pMa*B4VA
zog<ebcpAj3SeF&~SkqZ!thu>1Yi`O#JLh7QpG7i-`&zofz<0HPg@NvM8Rv{%y?>bY
z<)S98cLk>mxCIrgks-To^RqL5h|a8#wlhM5g-DFH#1d)vSjEzq%w4Pwne7a`q&x^1
zruIyjdkRHj<Rk@#)ZCnk;VjZ=ks(D9UExqsIk3TD#m(r84mudT=x8Ux4#+Yc2693$
zSueC%u6KfXUjHJv(WETW6T}ViPk*R=uq@PE?2&|3=q0Ed3grWQ!veT#UyR}`K-`x0
ziW}Faa*5q)8Q&xlP-xJKQ-z0Y-@(CDY~s0KS+u#jP{9@UXv9TI-ux0EyB7EM8N5Z_
zLJsvf$bSRTh)p8oiDtcl34#T2;wKk85y5j<)x6hPm!9-<Btwu5W*6(y<9|n6eu6~M
z^_Jd6<))y|%<ZIiC4{_$#<F2tF|@SpOm(OXPYE`|*<_t-!}5Pm+@JyHB8Y{_zG*36
zkRqArUB7t29H%v3e^<%CI{Mc*p>fR7>r1Se%o$cfp2flOapmDhkZc(MRHhkIm+Qo$
zpN$k$8G%;a|H~R7UD%plJAW%rKzw^yXMj2PKTnGHKhM@5tv}d*?&F_nW!X_Heh3Sm
z*+seqT0pZ%_xtbBERtTtoU`FY1Ud1+B}Ntvk7D+2kB$A|C68GICA<?+rW1T{^kTT*
zccmd7VR-`-m;+}A`)6CiF+tfUF42$7p$v7-ruouyr-^2Wp0ST5pMSeS;8eXIPLebl
z<-12uBi*hH2_Exp(C2CpM^T#C%+u<t8DSKnv0*2R;1-7*jlu{uTz?3KZQZGGY7*)3
z6Y?eW!A~mmqH7(WlJgRaeYN}J_Pf`hG4258`DyR)X#e0}gIC-CI%HeyQ4c{_W8bp_
zo<sqZ&p<)#iPeQ`5`XeqJjt!jiIzwnNkl|tL0=6Y<5buXDtyv${_VRXaOf=%7Tiox
zDHL!~<m0rn#t@#9FuF$nN<aJ!4FN5@<$<PIin3&yq<qANK{UJ+Wrqdvfsf)i=AaKk
zZ_pU3u>^R1XA}~KS39rwx^Oj!w|~fD!JRjjxJ2t5Xwh<lcz+w`QCa$cu9mPgLl_Y(
z%!~cAR9=NiKyWzflJrqIRV2oftd<Ip#|djpLeig`#;qb0MIMdQsS3Rn&3yrxpU|1b
z9i~v3nOyvMIE*j@H0(wvj1&r54qP+}ghN6E|975W>F?<JFV1Sw(6uIJd-Ji*1rN@c
z3yTv#R|0L4h<|A10QA!YkBiY6dO`!n@QxHRf5vpB3-GB4!CUB0ZG;m?;>3}WC9>2-
z;s?+-;Iyz6G)oW?xsBU22-bcDD}s4kYxc1``;`0o3-SM$C;pec52}{`Po6w3`2Rh9
z@*w}eVE>P85*aO}2ei*(pNC#Bl^ZTr-nco{L6lJe=6}`gLN59V-lCxDz&-N4r(KLb
z#99e0#liXo0osDTob4dUo-nEvjxwE{pcFspp6HVLgpFN4mc9>1z()B8A1+LiNcgUR
zbRaIAO67(s36ZD-cIGPQdy+#f=HmU$>pgbu|L(?KOU+r7Um-0YKb8^(5p}rz^R9%H
zQJNg&j(<2eq5EWl5L+uXp=AgR?hY>)ADwc~la+#_YxJq`+-ZB{Vr?IfL>6Kh+^{?B
zwSUQ}t`U_AN|e(MU5B+mD1r;mB<8qyp(kXuC}D(xPzMBLHw+Mk9EG*2V&jM737C$8
zYj=u-Ajn2WOkg9q-ktni;i6jXCsJeA80ea%YJY5r3d?3C-+{_d`cf*d^Ay*Gl~y(r
z_*=2kT31=kE_DD)FFDkFYJ}1CUJ~_{LIAHM{>)1q8YYace+JXZE4U~fyKy4B(64J?
zrJ+HCTDP%R_C5RI>ELm%H|Rl4%QV_M+&{$b8%?~<c~GVwl<7aHGJUT~H11aajEN3A
zz<<~9@)%dQsm|=QRmB;6R`!kHvGOzG0=S>I1Xerv>)UUQpU+v3y)d5it60>g4%3Z{
zWj6T~F{dW5QG!=k=b<gzV#2~Hh7?a>1~TF;gAiYK(%2t0ni-VF)4swCje^XbZLw`|
zTj}@-{#Rm47XVG1N!F?MN|=Nj4fxgUV}GCI7=ui9>$#i*zR1H44+V6c0G$Q_$uwLB
zEv(_!H2H78WsR>1?vEd70`f!XyVtBB1-TMyBAB>AUA~ZO!)6Q;Z#7%00SzSJOf(4T
zBMl9GflRH7*_YrtX!!q;yb%|iZOP|u?F?9X{#$?ATQAsupKh!_`2Ron|B(ydg@2om
zvSre%O+L>%@Z~)Bb_69eyh?=dW_kM54_>*tY4Va<x_c*V<a&6p@zHk&o&UR(0yF8l
zp4ZkoQ=3S}eu`rxV{LJEr1F}Bp;1}$nho7J_VMs>qAo!PRG=+65&ngc=N~)*sY9j!
z7tL5Bb(2fB(b-^KxOei;!_LTKe}8$>+>{`oc1M92Sg4Idh%w{g6%Rn<f_evlOsV4O
z=+r--`02Ebf_{QBAKio{04MI1>j#huMw?G^!u|uYzNGPV0B3;{QvFWG-gt~5%_mAX
z<s%>KTSu}(RiKr|jwXqLC<0d!LBiZ~7Y@X-P%f^u>`IH7Kjk2iP?do?xeR^~@N+j1
zrA$vM^0JpMr~(~-jc!_gxF+7wFa|v;zqZCkug65uLPd;1r51~4)KQkpmo(*J8p9-T
zd%1p)fbtCWko_}}+X8!x`8n1}PC9FbQ{&G5n>X?%a{r&=(j}Le!5RADz#X~2N8td%
zHUN2ev1wLKai~fDjh^YZMo*V~n(GSAKUiJ8&zz0k#?y9x?@9a7`cbdf$NzPDz25)E
zmXwuXI)JlRpE+vdGh?X0J>|hbrss2Le?qcDcqxwqPJY|s+pN$#DJ}3!R)5x>kiH=N
zcp)!<ENTq9NeAq|_y>114tQr6jYL)h@v%JY53}^$3Sz3<NYC=TLuNRa`3%n7ksnOa
z+yGd~PsmIWX|{c|^OJfklY2Rbn5#{z3YS``0w8~Mc^QeQL<q&XO~UGlWx3k)d8JU!
z(uF{wHsmfKLytDk)2X=;?q{x0#(2(rMQ!Y=DH~PdwMkQ*=jwTaxrRgGbSh*H4vtxw
za(pIhvAcSL^ZO$K%$P74d$riYY}3l{_74U}yFb5uy?wN6XMDKvAYsf}E^n5(!RoTg
zVv&C-oyS!qN3Ypqfo<aJ+N=|OS8B0O%(7F(LiOyx1vWY`YqQx|D$-IZA2cXU<Aq3O
zHHpF`r8;7)D3;W#QRKM+=1Fr-At5i12d9*guPBqYvkvSyisAvJyadY`ad@6i#)EO-
zhB8Tw$Hzf59Z@+7Fs$<=$r4G2{6jiOQa*o{sN*4&_Z>*cgy}GfWfG`3ip~b-Zpt<A
zRigpq;T%w#k)I@4eTaAxo<`B-fRadMD@X8FqC|-;q#zhK1A<zRBt(}>xeqrM6L(Ng
z#doWjq)u*%LB1q#+X${!NKd*?GM9-NwH21wIEJ)S{*_G}PQnsym<^v%qDai&XHI{w
zv)<_m_C>yiHcc|Kt-6rMD6cn?0!^UgTnY^byTZ}SKAO{lL7FX0h11+zzL&?n|IB*P
z+$r<TqxeYdg?pT-Ht6jqY<5;QZ$liz@enUn3e-O5C}eRNC2Kv~Dx9QCmxgwdNI)wJ
z8o#$46^>gO2Qx~ZO3L5p^>8oic=LZaAMYaW2(lKtVbP_?7srxIe>_&nYw=4PlHg1)
zkeVS&Lm-J5I9=Z*zRZ=KkG7n`aqs9WQWFM+laDESux7}Kg0?6YpIo?OZb8(k>m5Yb
z%15u$>DXw*;PwXBzNtEyu-S17ve5~Nqhh`VZo0(4yOTKR65l2(?23t=rnrC9I&p1{
zI?-i|RwNgmU|QovW8`B=6K&D@6WwZV?usxo+~n;$l(@`hvtj?iGK)>NO^k(>-Vk(y
zB+_0WJ!r-qfE)Q*3zVax5yxo(ZM3Mn8#^#99hO=1gzQA-c`S<CcrBf}@i|YaJG3*2
zxLeG2NLPDsDJBmn+|zIES4DpzLW(1{ja-<v*_k!R%F1udSM}>0A!;287FG6Zs{DoI
z-nFMnBK&?Ps_T5#iDf}J_IYXbK!#Y+yoBu6vT}4u;+{jpOniMukbVa??>dybNjpSl
zA}p~=h%D*)NLWDL$PUjFDrMos{NDqQyWT11XGR;j75jQw6tg3dX%l~74g6s`z@1Q%
zaZ_Rzc*JVe0SW^o3v!P0HNr?^i)h4diWq)7v%6EiAPB{Bzz?HzaHbuMtOO&hGFqnh
z@)aGrXZ)<!vn-Yxs^)4vUhQgycHtDFSzb6gP<$*clWxks_m%P~bL&9m>bES;sjDLy
zu<H)wOa?fUd>Z7!Vy%A{S1C7g&9z!U1F^&gJ^cIg<p0C_e^J(tV#mOVY&9+b)&Ad)
zA8kA<-2Y?yhx`AB`+s($adKpRi{1W{R2a#G3?<i?>UVqHc7K_jHP*{+9)D=BuODp`
ztjTA742&JznFk1#xHt&hBpoE2ht@vUjXuznVC!V;P9aqgRSJLZvkl{6a^Y?~c?xQ%
z(~0?*yJ_R;WAsb<_asW)LC9UO;$l{OReXd_&4Yrp!=l3El9^7$jpva2V=1%ZK{R&%
zJ>lXN>ea$Niy{av;;7|BqF5=`kfcwVk7Z(a2Tc%$l{3$ql(i<o#7MfGM^q>U_^_6N
znO41E0L;`El%9V%a%;%4b`;ZmAji*ChpY(EO-49-LX+Do&{uY7kTnxj2?IxBQI;#%
zc%nqR@Jh=xD|BhIt6`<{_#4kpW7%1>B!>4)0+<i4ru-Gw6idj-g=MaX=Y6$#X<aFx
zK#)1+2M8jl>s=BUuS`+GdLw%i=d}wr8NflysKA4FC31gJvXh}{?`cWnQUU!%)w6<x
zgysodwshMOU{FA=bZOG=41GFN@Prd9;e&fHZ!ob?$71sML}H+&cty%Tq<!|?jpKVx
z9~IcycWicSOph-;H3d?Beg*xrj4V8?rj-$fbmh*>PqGlEq6<{CZAUrLmu8?;_z=0a
z1ygks{`7xwpS_$wxJL&BOvA(wxcduVe}`H-O|uW_7mlX_Y+$~(;eA1}vhQe#d7SGi
z$m*tmmw|Zj5`UvLPnc!jiY0*b4Fo|wGOC=4+4o#ZdQj{a)c?)=4;Tf|rfkZ7c-~eO
zzL!b?QSJZR+j#o8kpJP?<A?eW_nH5JD(Nhh|KWcX1#__=x`x88cs-7BFft|)V>UzX
zV~|badtAG+75T2`rz?2(=GE@b>+OTxSA)Zy{kOZ8ga!Wuv%kwce&u5n3`Xg>DI-S*
zEL79d)9t_wlC#Gy+$#>DMdPgU3iL)3-&4^s!IWJ?#H9+6!2p{Rd$bC;wxZG24Z|pf
z?nZy^rO4Gn5XhQ07<Z6`<VcTLlx#*+ks236cEE-B`hv%taWJaMKumRBXWJ4FIA$78
zf+-r6!-z#=Kg251pk1k`CJM6x4L|0=lr>Jk{&og3^`tA{bHz2O%!uCH%+L+PKwp5P
z#0X(ZFlYD4jSNMUwlJ)46pe-Loy|@(R2zSBMo5{ja2Uj~P-si@fK1Rc8&0NPWkL@H
zNIqQ$K~)yaFOqcp6kV&?w`F*;2-V|M`%MO`Vr{s#vSv0Q(L8OMCYbgML8Ca{8_9fs
z;j!lrEz_llJ}%6Oxk>P|Gmb7$6%#39ChHP~X|7M{3nTM$&$0wCB2-XJi?;lm-MxRK
zpLP%OTV9LPj*XB}5y+O2PNyn!gBa?avJz9gS!FDl#ws{+qm!W<dZ>xe?n@!k*AEfm
z6NK{wx4GZpoqS{Q9=a1DdU!8M<_*mE#6u4_Ms&vfv<2Rj*B2NF4oA|2pM$4X($Viy
zp|AZnyIMYcN*qZQRAF<wemKH<f>M7VBXdajZ~{NNN@9yRL7$TT=h*`sutiL^oDxID
z3`iDdVSq1VGI7E!M}!1Y&?h)1aT#j)iU<BFWFF&G92WT;aZ;C^`ub$9-QW^8MS>(S
zj=2Y=i#cmd5-5}RJu)_8acP8e@i@>Gg=&gI5YP+d0ieDk2w8v_?lih~V-J67<9&~T
zSx^@Ny21$0AqRS60YCRse?-ta0=tO=p1)B<v62Ej=w&>K$58?W1HdeH7PzYJLwX%i
zsDC10F=v`h4WWrb-qv5swPVQCfU=R`5<1ub*VY&f#7_r^9SnMnCW*|A05jWuv$G4)
zhZrDYVLUi3I7Fk!^Kn{o$3uU@XNdz2i>$&Vu0bc1b5$|-M7DA_BAUq=BQf?#8d1!R
zEcQWE4*-ho(~_kH#j0R{Gu5yFadpN)sgRq6ZbQYFO|9%;;--FbHf6pFaNd@2ymA}E
z%^&W(n9~-842Kw~h~N5DlSC;bm04q;pS|RtJ~Z8r>2!v}WFhAY2O57j5)~p87kWiR
zjj~>{Yav3^f{)y(RA4YprNz$uD-KCcNg6{xqWGxP9SlK3qPvT+!9>$x6mqJsA^Q+x
zX`D>lG9_4P#AP@C75L$$MF!6#x(_A+_<KNP6qEw&!?Sg$@hr-s3g#b1RNe$iW@ZB;
zH`S!}32Q&6#E?<Q6C{6AIG~y$#!nc9+-l+jX~7L4Av#4gXQBi;*(e35r9&d|cLI_2
z!(f6s7~E3|^+dpPqG>ND*+@+Q{vryoV2zu!eW-ehyvIlFOGU@0k?82kk3e6*od8Rs
zxT}CkEygLNrsPRREI6x2#aU%CwlxpML_6Ol0u}|GuMN{;laPPn+&modaqST^REpu~
zof=Noy~J`ggtGlNum1%hN|Z~41ey%ahihUfrUdPyXE99yD!shiKl+KeAFxb~tPliD
ztdVh0RLNNyyC6?|FTG&Izo--&b3ceOs5CS<QA5Y*2LtQa6hZo-7B{a`g6OKD5rp(H
z+<x;fxmR^OQ<i@d<|<B$b$~=aiu)qHLvG03S1g*ObYX*85wZY%nCUQZN8`NmSzKTE
zk~nW9i@aZ7L||qC6%?Q$Mg)376o~W?|DO0f4J2s5*JI!FxJtF~)+L8arKZR*%Uog|
z#Ic_Usg8_S%OgX;LQVw1cP#97rqUbC)s;}n8S0YKk}`i4sl#?KmrugH2&YPUF(BiG
z6yJS>5zlg}`h$zfZdkzGGnMZ|D@=uV5mU`o?aUp*u%!GzS3z{{4_lejvQP%vF%S5a
zD}qubHX%g>3uF-{sUJikZUij5TPxYwuH4tVC|96s(w*^!sh>X+(7x$gxPR_=psC*Z
z6BQESE5UyZN>e<1Wa`WbR=mFbAoO6|yYu{S<>tTD=YQSUSl=k-e|_}$>4W|6i_QNA
z{aC1n7#O+lzS{j|Z)Z0<n^^L=K~K`KqRe>62+5S^CiydFNTGaLuV7ut0<|sqlvv|L
zCA|oh(@VkBd4d__PJ(FY2G;jY=EkJSW3D$--spdhncpEI6@Z33Mp+?K%7MlR2OKEB
zt)IL=u**{lLUqcAE)*J+ra4TW2jN?AOn}mSJj-+dc0rs3Q!z^4!GVpy!|-#+eokjZ
zR9BP9@PcB&`k<0sM1hy6Lg8%~S6dhG8<6RUaP`n}co=ge6*uUx!zj}%QoD_o<m$oh
zf4_g*Jv;&}x!V=Qq%?dz&6CKu=Z2&zQ8jg{L9fm?2nY1j5c-IDmdKK1ai}Ct5&A~r
zzf9uefgehIw@CCW;Yzk$RA{Kx?vFo0z{4-QG+$LU5~0Erd}wA86y9NbDa{;|i9Voy
zue;yEoL9;{7z)w_+&kyE@MOBD{CNSHj75KDK9(oZ%rLC^)z~clE$vf$@MD%e3V^Za
zu&S3~Z`BtC^)Cn>ZV3LQHv}cw5cL~^(v*qW^+3(50hJ2z{;vk|Q^;KnEO0GQL`VKk
zpzJ;Xr+>R_jQLE9#e9qlq+Pt9dx=}!N9dC-%@0?};F^?Wtm0k+<hx87D{na5Gf02G
zC@iDjCD|2+`V2Zl!)=0z2hWv+18q4)Cc)h}@TFx2y8@n)T_}k2FeX0~008$50)PW6
z%wlF=klL&v#zL-zjGl7Xm_{JtM41Jc<Q}f6eBuU4B)OOvl{kf3Cw#b<yb*m$^KHRi
ztDi<&%&_k2uQIc)%1}s>4YJW?t;Bz!y4z)MBGPisf+&iarm1FH9#Lkd5lW1bC}>C<
zuIv%>rvlQLpKdA@3XNPB!k$H$kEG=r&3IXgJb8PlvL&hk%jWPBp_JVvG$zzuHm{Vh
znl_~s6}Mtg(~@Z5|NFoGZ`m8tmB<)~7L9-Iz1lsH%AQ<&17vkOsipPPn1z1=p~;>b
zSzQsm#34v~c)NY{)8KFys#+cGAAr8legEsP-Q#YiG#rit9}PindeQci3rPf+yETl$
zHr_L|m=~pOaZ%A$ijt@9E?P*vQGkVc!gD6o91d=mX%u(ZNe8#67f0ZTg*Ks+PUnP;
zqcLfeW8h1kxZM-|;x^HZM4EqDP0*Au`*`B|LrZolq<b>v0jiA+mqx@DxrVDI#*-lg
zc2coz$cv*vsC7jbK;rU9q>4pjpt_<N2L9+2ih+q#F<{?A?`S!bW`3gz#5GXw(3q&o
zK%6=CjgcvBk&4nuV8t4_rERK2mCzWS0x_+%mecXuZ}AcP8j@6Y^tyjU5{25}TTB(z
z2KFVPfU7NpMs63_QTPH=Uv@ew=_pgZcE-`T(cH{Zx1@e3FZ5??X3I%(K@-SPzicr_
z8a&)`KiqOZ+;TtMa$9b>S9H6r=YoKb-U`;N*twL!nzDp#%rw4c7GGUOp}rLah5j?)
zznNEPjB)<T3S;L+wP}AD+Bdk^Bu-k)R}uv$U=I1-KW^F>Gm#4ttjVSl9$=IMa_e>!
zw*|LOq7hf^p(mj)Qu9tm4_Q~(8UrEx1j-*mOHI#qfMg{9FsKHY2@q)E7FL{;zDq>P
z<4g-TfI?MVyJ!!2PQc^W+cD3p;;_aUec1{RWQzG3ld5@TyET7{n*KF``SGJTywoH=
z{4_)F$B!AXRbAL<Df>{6l6r6exwL_x2sBvs25lAfrgWDcpdc{2Y8vGC;CJ%ick<wO
z^5A#!;CJ%icX9`QC(HPo)butf^EJ5}PZLd*729X4^a_k7(=o?~kVeuN=q*i7t3#q+
zMC25Po1789rQ3h*1voEWl$o7ryfC^}l|{4w$SbO%I%g^ZSlo`ytO^H?ya=pfyqTdu
z(L>Foc$CQ<?LN&-F1aV}(6jp@$=BRGS2HY%nRyb_CzAiPdCA;ZWPiq#gf%92`;kiv
zs<N~=MY)M4Jark!8g3A@h04&xd9;+tR7?Yof(2zNlW>2`VgI29JZXG$Q+`$35X&^v
zFW^9>qs?R7rsMQm>QY^EN;nar+&Kb5GxYu?oVo0_bV)f>UFC&tM<=)}ubR24G}wRH
z2|*5^G53;j%35SQ^XrD3k1X@Df0-{LQ;!(f2?}fDzOQ<f#4eaM$%gMqeZywfP*ia5
z3%}?#pFMv#=zXF2e`vd`uJBJC|G&o@k9v>t{(q03^)?>-|Nb2Le{MuNodc0ad!~Ow
zD(~E6LEr}GM<d?$&*3!30zXW<!zc#D98OZ*FnSltE0R6zD(SPA@QFN_$qJ+6a6I}B
z@{8cU$Sm%g>`mlx(wLK>Y7Vwov-;@vZ&zSu-u{2>Y9~M`|2CMM`(cayB9b2bDD`7G
zQ}?&4&uk7qf@+v11o{4$Qp0NCw$G@6wlGuS&LApXdVh=EFa<es$c3zu`J3PwGMZPJ
z7oYXvA!Y+=t>w}?VG*67U{)O+h{E`yUX%q2?M-1=^-4=qq4mi}E|jKB^cIEgt&IvJ
zWvzea&v8v&MdCKu`3-9o>N}@FSipQHok<)tH^nF0zg=zgHhQ2?sgE15jFj~O-gSOU
zoF<U%4SL@+qA^x|rF<NJm1h4*2p)*x^JZU>Hwb(h#q~TvHpPJyz2F!`R)4h-*>ly~
zZ&z?c;nx!S#trxlP^lx8S`t}_o>?*jqTzr3cGc89lAyw<AMgg%J*t{pVWVnpI__^*
z9kVAgt*T*&%V8HX%?V@?%J<n~;#ymb+w8Ne$oKTTRMBPD0bPPOTkP+L`)@h~vwt?t
z8ps6ER%rGpk=HHZF;cf^AgR17l0=DWF#!=K{ZiFk__?2?@w5Y3qTzhm&B`cr&;5V&
zVsh%VRK;TX%3(7g8tht9ho2-9o*as7VI_<sOZEmf=m9vX$o!j5Ru6;{x?!%TvbS(Q
z3N^W@0K*=R4VI9YkE6s-BS<N)*Yv<#;h6YFHfO1y2I$7>iBcr!GXwdFFwL;)R^-nT
z$(L!G*fms=aN{W@G=2{WgN`Ye8>N2`Lw(&nKacsjE3!-9Fp+_c_R4u2O~!-MDdGXT
z&?b2-vv$Q`Y#orJ1a_g<O?mH}L+ugf1lkt~cjMs&G!6I%FozKm6A2`>o5_M$u<>qW
zeGye;jp*b?<~o)2L1!&v{2NAG1bj2yl(%6bPOI>dgiJiAq+MF|5Xq^rLjiv)p$Oz5
zP*NfjmQj1bqx;MmO;XI_jpa$OODH@n($?$KZW%Om+@gJO>L&hBTk@Cq8<N_uDK4sc
zwp$2WkhIolkW~f&+nt;6K4oHSUp>pyq@b$5`RPxSQ$cCtI7*{o6by<LMwlvB7x(j9
zS-r^$Hi-?K!}4Gp^Mt2_BkX^Ih`OCehM@nJ$N@+n<n{rgTOkrNlpSZa(Xs@B@UhM!
zj`c)>MWhOYDo9)gqNcsR!FHlJ^O{Es)M*3`EyUV@M^zLPDN!jp-z1`brNZNH2|CK-
z+bBNoda-*(61ly;(WMu<Ba&1lK=unMR5F;B8PE_$;NhONZB}L)D_4J58hRfsBg<dK
zz?gnc`?4kQ*{3&R8Kne(5EihB3_=%cIl<P}I?oBUIo$*432n;vZrzhpDXkXm+qwrg
zIz4A`D7C%Q>2&lx(2|?!d)heFJ<Hs9o~fd<>Jb!&XWz&_k<!Zuz1@2zX#6jTx8q{k
zIgMQp)ZdtG4(>goNveM|Z_GER!((=%xcET*ZFVCbTDw_h1@iD6-(ofMK;F^%sf46d
z#X(l5^gX$^jU`%QaEnwBHdL{%C>T$a1XHqMALGd6Q+*0rMLd+f0_3&}Lf4cYNc9BA
z9Zy2)5rugih!@tW<Yk?vjl8F)?RC(ninGvCXBLH<q;@Gf=wg2k6kh*|V-N==R1Kq$
zA_G-jSP|=FOQMM_4`hpSMP(ihuH`F&<VjM!FqKF8_l?KTDzrzl>WCWz`)7#gZ(@Gd
zXU<=`_<h&+96{EqTE<<grbcFeO+n2S6*1O%SwU?sRZ&)JKF*^EYzd!uQ48xNRV8Yi
z>6^H2Fr9C_Y3P5B{NVvMM`sBkY5s!i@TIJ-xeU2778NU;TR2;_hpbC`)hWG#htZb3
zVDFDv-+-zEB{(KAPdX!a+-Tg0uwQgLogt&hKWnxM#ZfWAxKPM6TIxtPG@un6WFeO=
zm8Kd?&~ydCb$fy`x=1<QUKi-bUMTkthh6V#WM~u;U5<Z2qj{HMI5KCG(Es;@qe~Fw
zz!tzUxe^u@Et0n{yp88dH*W&h^LPMOg6&5L<gm*#Ssj%2YT@B=wjnC|Kjgz`uD}$B
zL(z8|einrOa(pUh9ugyn4B>jQmx9?Qm*_n=LI+>8z~jM%V?+UKZF*zkiBS|OSa~k|
zalVci8@hk7=ZCV&D&#khLck?N6#D0(D2XNKaCYe^MG2@*;n-Zd6^)?E^=g^^b-UN1
zW1y*Jp}sXyAZ<6sxS1J8!4FTA4M$NY(N}&8<fma8!{+rN$lMCAwoS@TcDd<F$+D#4
zAQ*^B7cO~?ZReCTRyEfF%+;(GR%EHTB;ECHt~!62Qb`J^D<Eefko0|ob>J$2Gj?5f
zqnrCc2Qy!mdLj6P1zw6GqQ5G@boNvNPzlSrTexU7dtI4}zY;RDyCoM?l!l(Ol<QSX
zmt)?`VF(9WfS7vS!Y39S-P5v}psjZ`mOF0^FK-8;K5`|9C^x$#9J{@$<;)4vJ6hJf
z(xiVDG^qvMZONWSok#r@K(5~zkhj9!`u*X~E|?0i)e%j%LzE%cszEV1?VJr@lb1rd
z0DFK@^<#<i3K@}v&Oi#UDBCFf`a@5sxm4T8US$)Lqtv_BEm7BnDg;@qAR15>T(RGt
zYRB$nk4r1EdgKoViSj|Qnk|e%wVh6<VflZ!lYIgA=Vk5=X3^VZh_#TEMTD}n<kZ@k
z#hQ`3iWasU^FlgTqZdreGJHCJA#Fk>@2=~$Qa9XknX`W*_e04GKeWF{CL`Mm10U-6
zW_)=gee-3Nwe?;L08l?$1!6V3W!ZVTqD6iX)hn9Pa~~LUC|vdf`O_u;vH4lmB|m>s
z3><AFUnssSA(#bEu_HH}RvrMeJ)fNbOAxor`I7Ki^K?1Oe8V-K_8FbaWNkm(wX|dd
z*z+~iE~196NeU&>hbUkvfp~iea}@bmfoN>LvZIK1?_lX1yK6Ai&lJXyAAYWoxgS1L
z$dbwEjvymRIFK4%?Gs!HI5{nDX&rxGfHl{`V*pio__!Tpw?x-Q2~a{pEv)0Kvqcv2
zjd^E=QFz5epKcnWc$CQZZAuIndLoht;@+q1%njSH8w+~9&1uQ%j;(oqK$$_Mc|+Jy
z0(Ck)!aXKPiY7|Cr=&HqY_0N9lU}CceHRW+AQ;4Fnb(-Qtt)&Abs^g{e7=9+r`5R$
zz_#8}6uoY$zAtlIs@Zjkb4g|A%9TlZTdiOoxkGE-`)>iD=k!!{GqeD9763>aE^p+Y
z@3pwhDCMp$EjHKhrMWQO*72-akn(c-G~151TReF<$3gJNFz~_Sdl<Mr6*Q)AIh4vC
zP=uuJ;>)VXU%*)?10m)qghzjon=zdFyovPcb>2Sey>ePC3PAw)aA<Y_4`SEV2WW2T
z=hCQ@hLlnU%xpOV5SQIxWXKO#QM6hVX7@jE@1K6)!Ffz~cbEgY0e1<T((apcxU+&<
zaGNk-v-?d%mxS=I^KIF;->yl^g8oLiPEbl8@{<r=6Zj{l1rSVGF};7zwfKH8nk4Dq
zln+1vOPgxbM5$7HvO0;k#OhkvZKnO+(QIk@!B^c>)?1bQ^yVy#rFphCg_lb%kNpBF
zw=N=!pttg6nd^RlkuP}Q>}P3)osHhc({^v8-CIBE_4@d~|LuTbFvYkPdcAJGF7aNf
zw{kfI%vrc%YYfoOJzalt!K4D7VMeZ&QHEUPO+Ak>Wx0rH%kuA>#nJCP6e}Wgz5Gr_
z<1=??wQ*Z?VN1lKMm9KjT}_w-AIAQW2t<DacRX&dtF^-p=>`7TUKbxD-H^wdSp6T`
z>%F7(4MiNQ(zZof1|!zxhE+wf6y;)p`YQu)RI4hfHg_Z0U2=bO8x5B&c70k0TS!@M
z3)b3WV2MUo!oKM$ovo`afT!ZPf@?odEyPBxB3TuKiVnnTv+eO1Wv`6@>#9-bGIp3P
zJTx+}cmnBH25}UiGlmC7qB59jXm?eZ(E6$vdVvwNW#%IaA;gvbFX8tJ(Wg!;PXdb!
zU`7Do(~fxfz6XCkO6C?huBqeK?S9d-L*0JsZ9a@)SaR5<j+LSxYiLhVXZxGr_SKQ+
z4cku1AT8pi1ZDY9%}kmb<5nnP_`a?RCL4nw&plj7j?+XIQo2@xSKAeD0jU+jK)Zk{
zi8NLhZk0Nk*054ro9A?1W1$WF)zsMZWj3EJvC4*~mSKNWSJxhr_^depkEWNkJwL(J
z*3(-g1FFpbv;K7B*|TE(zh@8mfBq!-e@asNXenJh9{X4PZ5*W>ikHYJx}SOKf_?s7
z8~{7JaFbm~O<8D1fTmMD70X)@Tl@x%-LE8(%Pw=tU&fF^qL8BnGQEB<a<d%l9`3(8
z*x6-UdeVOj!Ot}Pt&56V*A4t3f06Rg4bv^*qU7i)OU7kWZZwV3L3A|K&!57|iLzZn
zVl>dfkw=(Q?#4VGK(fThO9shg3`@Y#E98Q^9*<>9IP4AJ-dx;8f_b7pXU<phoQWT+
z;BFB)ZRQ`)TS8*!0i_nzLBf;`S*tX<<lzA0@=brhrQ3!>3cH+v1hKCc&3rx(%HA%`
zKs}eos+qJBob!;!{xDmswrt8qVzux#O_p$>X}9T?g^eRWgj!6|SR{~zOEo3tumoBm
z$3Tg(SJEkfl$LH5r=|3e)5x3lt7t5<3cKkf>9dVqPuO}3cHI_BE`2BpqmuEEe7-BF
z4IO{1#uOwi6$}r9N$hKstG!7K>J<bHVeG{_-`gQbuOK7I;Y?_oGJJjkxE7krU%)#l
zN%Nmh5+488GGoGreMoM49mU>KJuEe&|5dkTe;FkGIsuWs)R#*w%CCj>_<#SOO60v?
zjDC+PE>UbES*ydFV#cO9`>A>#N&1~p@gjd);;037JOb4LYCo00(svh|HFJlMnQpPo
zb62IjW@TF-)jIhoOIXP>8M3@6#_bD@q0D}(y9Cc=J}YKC)q&u1^qPhecFc4lRBTGK
z&uZR>@0NshK7%t#dHjj^-L1B)U8L65ZZ#@cu^bi4s{~{-yAjMBkW{{8M;`9&-8rK8
zSySbIpI(~mt2I+Mq@)2-RV;1|E#0#MUTKOWKN-2HxacU7yqKiQ{ZWwZHkhmgTBo6{
z&0o%97mFhmWUY1%snbzW&e~e_Yjvd!ZI`cezX~g*q-APU#`WF7p0m>3lw083rowl{
zE2Ms&E*9N0>OeAom#i(x8#3@Uu;&p-PWP>U2YyXO_(4BhMnAj@v7wPhJ%w<Ul0eh=
z4u0HW|M_g=hwQBV?%*}Vp`q~!PTbc#2-+CyMA=AAv9xlg>)}Jt0nw6Cp3@Hjm~V-y
z7Bx<@4wLI-Fn1%c+O&(t1xMa<tR6`9aD8>)YJJ`v;CWNp%An78e22LIGAQKBz_jFl
zSF5Aq3cGC%()1#Zu9F5ale+jW=Njy2I_8-C`qqQY*AiDgT)FmoFEi`@ulpINe?P+r
zb>n`<3RgdluB_bCEPmBRnlYeFm!NAE-IA|`x=#`=surt4@HT6a!La6DO=+rC#<b8N
zQ^Nfg>2cw!s07mxX?z{EwQ^Rx6fp9CQQdp7A}9}c|0}%z$4U@p)d_C}rGMt%|37=S
z4tM_M{r@BS@5BB7o&OUx8?k%~1)cu`s}mY2tv?o%ac|0Mk9fX2bBFTteRN+GCr;nf
zt28nZVwQ~q_oyZP2oLYM-My&UUonqJcKu<Nhj?KQqG#92z0wLp<lm5&>I?mUrjklR
z<Ql?1O#ha9E^bih7FvH{q%x7UuIUw?U==?88-DG$WB1e#e8>W_xmL)!@S@MQ<Jg`4
zRf}4+Ctd&=kXaHk$c=0X`Dqnl&)n&9lYLJAol}}+)67uWw>W=`BHx=fmu=(SOm>!4
zcW}p0Kovu4aJpu-2WpQg%`8}dljEBUVxw8L;6)Ua(r#fXEd@UeQbV8i7kyQ@+?I0X
zg$-I6@?ZH9_lmW}$o*h{?uXXr$z)V`E>?zOoh_&~5}v$(>c^0x#(<&pU6CXu=^6PL
zij|KD2+WNFq;a0&e**C{NS)`3I>8m)SPU~!h8+)PrV1NQ6me**TE*Odyv3l{Tz({T
zvNQHA6aKAsVg=F$l!3=4H2=u-*4Z1`R_}UVTdm*bW(^K4y0g|fv9Q^GAqdLCO8JMB
zhl$uKl^mwDCW?5iRYfV?=Ce(EI$aAv*W?g}FLK5DE1HoMDGc|zc-~yI^j46N(36cP
z<-^r<aauyadQ3s#WpT-WLJnb0ehPfZ5qI|<ZZ+vB<!l=6TE$MY&@N*$qGz>52BRaj
zT?PvRR@A;$j*6EMLvD-If)s24A50Qr7+T=gW-($p$I3?|KgDDdWvtSS$TE}#@upl+
zQE|$~pk}~w9#=--au|ivk^ei*%i{r8vT|mlKSQnCtetzI!2fc8h-X{&wNN}SzY$Fy
zmF)y8ZR18zOs<%VKu3`1Y7WOU;}41(sA~Vr-#&A8Mdn8TqM$=rc+O%wW;SQCx7Z%W
zwlJc>UgWdO1<`o~H%At@CCW-(jibOHPAk4mqom@k{mpDM4|s{Z=zjk_+dJH6KRoTN
zi_lNnY8|$H3g;AmHsWpw)jGuUO?Cnm?N6YH72R)>hY}X&>#*;;Qkeqpr-7U1fXjkG
z^`}}SsEwO^rhKNj!;O7eE(UGUs9Bb9o8B?Yu?@?1mOCzs=bNW16txYtmqdkb;e)16
z;m}AX>3W_|^6{;fE)s2Kn``A+B(VsFLB_J+g^k2Ve)yVyhv$%@D6d~<?7U(JkP*Nf
zkB5_yO);L^;Y^Yj=?DdWXM8)`tU{<EnjY}FGQ1W_(@7w|$!`QzHB5iFB<`(ehntlm
z+;aM;1@Qcou9;XbKCc0J^$aXCvHUDs`P$gY&Rg{mWZEh;{7m1tBRh(!cGGM@aEph&
ze7@Q+DH&>ie&4ne;|fWo$Y<(c=(C^_OT8I$CVt9C)=AgK-F*C2<8XluHy@oA9Olma
zpB4zE(v*Wyx*|)jj`1PY|ElgC`D2vUX;z0y7r>8tJ+F`X6ld&Haq6o#pIR%hB;_nl
zNeg05gK3ZEu?R?ugG0r$#88F%fm=+XN<gn@0T!EoZ4H>oaQo%JJm>YI8@nEC6@%6%
z+NC(K<x!m}mXB3S3!1-6bb&3?hkkyF%w1^3We2M|2dvLS!LkeV`%<fl*Xy5J!!e8b
zeOg#Fd)X%k#eSH*wN6)G4<i4FI?`zg$y8q|%@H|swe(L7<m?WJW1gy0Ll>_&Ki8MN
zcfJb&441Ca0w#ZA3)McuEN~dhS7WLV)WT=cTb@UkI|MF(isjFy%Y(Mu8Fhh4Wfim@
zR`!p%vZCtQ!}9*ImKQ75JuK=UY*GF2VNw5Ri;9&Z9~SkGv#7Isv?|CFqVvgNA-cKM
ziDtP|4a>XeFG1t}2=>zFN#R)m*FVy<7P-s%5|~lVX3HI1470nqms^~1u8j5M%K$HF
zCb^@V>pJ%<tD&wxmvGVo90AyujnV>50$dcA+|mNx0WX)k(*iF6`<Ls}0<{8>7?+~d
z0ww~el$XlX0zm?VLzfNJ0vmsvcawY{s+Gz#{7EldYF%_a5LF$ZG84ec?@HZpIzKhl
zB8K(KBvSQn!7xK_t*f#cs>GdK<YKPi&lbYj9bKV*O5XNG-<)J!)XKrQ%9N$1{bv<P
zVDHvIa#xlSBfWMRAur5D>+v+1ynC)k$^y*d)`G5%+uMB$-z-=8XN7+%ks<xFg6VUD
zXSSl#xt2=)OHLCkQ`0YEES%eIme_u^Mj$OU{tBUeu$eyCOdo8f4>r?JPY;!~FjlyB
zC0W+LB+2!OGiyHBbRTTGe`uTTy(E=<Fxh@4Cfm##>`!C2otuJqNeWr1>Gr|6{N+Xz
zeep(MOYyXOIX`>}>gRuo>l7_%J-?Z4u6_0J?~DC6c88blIqxR%u#07?hF#$`ohGXq
zqu1*_ef*f&p7(ms9zA`$!M=L*<Y{kx{pr)*WA;^V{n5tyI{T`39|)KvsT+UQ>#bmt
zy<U&0|9&C=x?Q#tji<4Hevz`H3(nrYdfVQK!jKPBwiAKp^yz;jjpAgj+hvDuU;R(}
zwLj!x!rOZu*!9kQsA{%7c83?dz0v8dt@)$OGyaDCJ&{%a*o>XU(TF*nP8S?+qp<6T
z9{<oup~|bpq5dC!=s}Frkf4cT^yweR(UtG<co4d&f5o*=^Pvn>$PwA2S!j?fG}$2F
z&tKMwQ53SIuNQxHJ1bP!#tw@mGK|utdc6wcMOm>`ttPIhsgS*<I7aoGxPHEXu#p5`
z7Xug&rDprz@N35%yQhBOgN%hHMi!A=v2!C?hjZa3gOM9faaG|*6v~ROMs^INE_k8T
zvCQm{J)^qkGU~sg(7PT~udFFj8_~~q;u#@Ji_mu5F+_hHU=Rt;Vl+wJ(*WXCTv44C
zBdIeq6stSy<YZQT$BC5FQUUu&OM1$CRcRNKyT8y=Dwyfs3ss_JPU+GYNUMdnBlkn`
znI9IOC6iI^8Df@V^E6}`X(V4LRV>TFs6EpuLy&-x*zQGv6lfIZJf&EnbBaO=#Lpmg
zo(n30L}7opnatE&`V{h6owRpU6WhYxROH87w7d(3u*Gh2bAcM>YYc*fEYu@v(_^V|
zHZz*33gp5UMfO+GNb9M&S%-@ufmti97T8h0Ffm$lStRsD<z6jT=Tt?K&GMSsev<n&
zS71^ju+qJ^sa1q8Uo2Q$qLGr?(z#9w>>umO+wgyEtwN8;F4EqbX~N9C%5zNR@A#t6
z9I5Oh#Yba0QaQxN?G@xR?>gKOx!Ul#n((v$g0QmCxwZ0%zH}3cGF+rQyb&pcU}<qZ
zxt&;E#C%=}bEAN{y>R*bg5`oF4RSFw48$=WwVaDI9Vh*6ckGSF9gkmiJvVjRgczsD
zQ*wWpWLtLRe!Iq4<HlAjUGRa7X01dBXhi-|ygAHmos5}Sd5NWDx<=sT^j%Hfm2{h#
z7+)xnuYo<6mS^*(u_Wm#Ic+#yy~s}X(jn?a{`3yhFFee=f(oyMXHMaH@tH6OXf7t2
zh6Vozp_zM!`|O9Oy>;@oAXkoQhi#vNKFfbb+zk^JM&kJ<I|(O2aKe0em@=1QF5&+t
z9Ah(eXAlFN%$Xy5ra591H}R+3+{K-hjZ-QpY}c+VCrm~Ea(`Mj5Yc*OG%E<hqV$}t
zt&!v7n<(5JjnnBNHWx=W&_*;{*m_GcC+gH;GnTlipPYgInH}{ubA7%;dmr_jWL<x+
zsS6U@;H@>?z_{MZIHL>V+kpp$AraKu)><`0uiTU$`6I5)Pg;c?2>)#Zqi`0S=DXOp
z^*4$AMSJ=YSP~@WMGfT>VM@SKa?CJ*sxZX1)@<fidr7W2-IQB$WeF{5^@NGBS<8H{
zm9?_rx25@v$s$Sh+KG}o)s3-$%bb5EP!6QJ2^N>AYN94BRz5-=;Lua?GGAn%a64IJ
z9m;L$`K13@#`}zIfZROiv7@h%nNz?1S0wt&_CpRUx?%ghgNY=LTRC5I6KC4TxxJ-*
zk?k+lyd<6ayrk)JErg5Edpwu6@L1ZSQz`z(IWBS(gOKuoT0t$`!4N~pO*?;=D7*^O
z6-1X$w7v9R&nL#7vtjaSmT$LtW*SpfZ%Y}d&=Pe%O0xcT%oFdc^75rxJku0}OPZps
z%%a*V8dOUt4F6BxM9?XG?|ZbBZi5};4D?4r(!$8mu~M)X+zvCgQq1L>+ANb?-p+6x
zu4tBzBw3UXsPe$pF{Js%s>OfSk&VJ{iFG<1`vByPBoz(kdr;-Xw}!pELg%H{qAF^o
zdL=}OJtOyO#kQG2TT#EV&bKn-e5LHkS?#Okay{vtS@)Nh@+|}w(mS=7qd^EiwW%+l
z4U~)ie5T>@#KzT<E=yUg$W0o9eoLaTO|LsqeBSk9_blyh^fr3!^^Jcnz0j6rR!cw^
zatklKH<d4{97tT504Rp1T=9JdqrP_3AuN*mI$NU3$z=I+6)o%6G_CwCO({|5lHjgj
z*C{kr@dy-Px8QLF`2%_*e25!>(0Y4fF9<rd+2jJ?528nupNd6ND?xL&R~>XAsf)*N
z0FOl@DuI*;Cx^CXap`}ONd(|g8*s6G*IGs@TW?S9QjV5$Ui(%w4@;HDOL>>G1PfH<
zh)mV376&U{4rPo}ENaOf*KdxN#iv!_ELeT4sFm7bT@Ed;u<lA1@V)sWxq=B5C3oH6
zh+0sKrj&T+{f*Sf>|z6xo5Eei>^R>;wNqfd<K<#%jGhvpPTPN3{y~-TqKc1OyR%ve
zDl7#?2leEPSpC}xno=8u+!hvNx{l9`1SQ#39;;dgVsZc#K`D`gd0vFrz+vGp3$sV*
zDA^FUAr4<a<Dx=xfjrXa5>Pjnbp6J9+SVFh>G`B<G%se9uJO@=Ajz!KrA_U5rRO#;
zWR@=dqCB^B=_h~I?9y{v8~LT@x27}I+;$?z^pZ)Y7fUgn&)jRx+q-OjY2h^^)AnX=
zG>asc&a(Bwb=;atK1;Y)5+`ZMb8iX5g3Pl#6^=5`l@npgZZzS>W^7CFz)m7~17rRf
zYkb|%T7CO1;vzcJKi%5eQk(`_e2qe|<0trE?ek`{DP(_W%+pC6vXEZ`Y>g&f6t5MY
z6PxZ_@@ZmpgKJaB#=AQ@<(|hq;%#ptk2mnTxG$Z9TE?ok7Fv#GpIt@1N4INdtYOX(
z$5FF8i(=Lw9KT1e)fUQ>V-}r>3v7{OxS>8_RkMJPTkPbU8vuXS{pJQcot<PeXo`Dy
z4Y?Afw1$5;thRjgTVJ`{+Q`rKxm@yTiw!UQz{9DC)sb_dF5RTeGfNFXy<tCZ-SmQO
z=~KJp(@xCCfji{eLC|pi4~Vw^({q}}(=I+;cbc;knmNp}amlANrEg+>=CF?+S@y)6
zhVIB89`G}#33zA-L?9UKYiJ|&?~fnZ*Z8;t-rj#{@=rg#XgGgyn%Zhf#COJ%<f5V9
zG3x2g>+xny)kgAEn9;Q-#hnbew{*B)h=+Yf>S6<bHkI~d5J?5O;b$!k43o@e#^$5h
z2t|B4j~BH}Kbof6nx7L}$}uB-pbF}Kk25<qSyLE=Zze%N$UT~lfm;h}f%q^(!TVzk
z31WYL3iMWt%RVx2lwlv)B=q>1A98O~^%A?+Feuxi{$6wdOPf{>CYt6sw0PX1E6N7$
znkL(NP9hPv4Gixzb#|kM-P+2af^DV0fX{M+3HM$FK8%sDE%sh~cf6Uc3cjlYmcASp
zZn7WpH?%0wV}3PSaAJ(EK|4R-t_MayO?H1aGw<%30+6Lk-7G*I;O!D(VI3$_jM=$x
z6P!u%zIO~uE;fld2R}K)OH!~(>c>J0Vd=mM0Ln1XQZo0w<R{0?!pH}3U0rK9AcHz%
z$=muCEEqUv!>~EBke=wXmF<qDkbzP|>?1PZ5Q_mWibA909eD{AS8?bDZu~d!4q1Qo
z0!n*%i&^m7VigMv-cBzk!%Lplg6WU48X&~?=(L4*Y^Yo#2y2T~glVm1*HC35P;*<|
zOL+|YSTYzg`f?A?lYLgeK5#gJ|5ok{v!*Mkn$m_tfwo3t%B=<av*aMrL_UPg5zAjI
zh#FR5FJyX!c2uDim7Z})S8wT>4^4kXS7T;{ReVR7!bv5|tX|d9Xk8m;suiro*IM5i
z{+B_i^^Cp*I#uNsTxA69Kz@y=twHG2WDkxjGWw>q;G!7FBs`wF3702_t}uIbzq!!{
zqho=F^+fTfBE6H(Z=QA}j4i2uYPV8?<P$uUNoZzWt;GrUs;&Kq!{lM{-#dT0w*+1-
z7kn)ol>hjpd1|6XlREKx>h(A~1Bq=bsitaLLSZeL%QrXF_w2+V5c5C?2Ae%P;KHAH
zDim1l;EgDI@q)cSZWhnGRe-^l9SM{bIPAOo&5as=)}?kQO;b_0AqNWW7%^|Lb&~@{
zFm?<lJ($tWtXTpWe$h2PIGKM-Ut$;$JJvB>*9e1^!_kLb^SgzI&H2F9A2;`5HRT&F
zw&=1b+++2>2g0w~8Mz<uKR#K;CnL+guyTE!W6JZdn6DA^*pWL(Om|Jc){(y~Q`bAu
zwhDfrNU&0?$itT?p2=zv1nu~evjDxVO)6^w=v4u1C#73KoF}qdgIs@ip9`q9lTRtA
z=C+p*F1{1&G+r^wBCYE)U5N56=aNso4NR~N9$`{e{_s+|PzKmWhx1lVa3bJKpLUfB
z^!T}~Pcj+luu2;UoLrW+2h>~0WHJ)VXVYSp_Y`+WKO-JKtqzN-3#z4J^71gz$kX2~
zv@FmF#XxwdK+VecZe@SRF5Y+M?bl^GxlL{Jy%VdITR>W3yB1S&Jx@)^)cf??Ow{%3
z;937j;9GxW;N9@Ht;Bx;6kG}YX$LNtSF|R@d+yq+V@#?0%}oIvvo3UKU$4S^>?>D9
z2CQKb8Jnf2(E}aIhM7>nvK6xpoV-M@u|E6R9V^RJ$+mxfs||my)0Bo`d5}ap(pOKw
zS0tYzElWE7*&R!vQb~~`cib@0i;VbvakWfJZ)OtWuD6IWOYW(}7RI7=&UtE5iFS0)
z`lw+Ss6pi?vQxCn7;rT;7qGHj%IcVAgp;}Uk=UHNjH6a3daJS>XKE7Jt`oR{C~}qT
zZf4+2c)9<BPZfXajh;2PcQT@8nRs607Ok%xu`5qzMNNq1Xj1dN*Sx|C2An+b&8)3~
zNv*pR(ZYTiijFyYgoUzk8XMUlqRQ*hik@$!edMA&be<*@EHqx0r4n(B@15i4@2TtK
z=POWc$h|4aZf=F5NY9BA<Yh0t6X>NM$V^0EWxR1bXSaWonn;~=zq!#yk=tCF)#4<@
z=WI)jdFG3@jmFRoJzPiRpXwL#PTUssO(wjgHBNQ=wQ7XFS0n9pC%A%~mp&EcLR$mc
zF0P9LD90WW<jnTTe{IU0<qg?}Yg)@by^?8ZjL>9*`uxZbZ#(7(kbxxO9y)MkG0+_&
zSQ%F`yVZaG_FLIX1tyoaF#CC4_)w=vIxNx7<H>6TQNcBzLqh}>UXj(9!pDzurl2iq
z5mz5ST4BA-WsvC~X}P+vt#J7T24!LTOqE5!#}LGt=Rwh!cqRQH#mi7C^I-s$hZHqF
z9!}`j>JEyTJFw+2l83YV&5bs}@)M#0($2cF8Nq)EBb$-F$HrQEuF6wlPN$b3OSNA9
z##InQl`8diWpy4FH2G$XZfdKA3E^_8FY*V?<&@Y;&+R!XZB7=MZnp-QHeGh6LTd8U
zgf-4h(>xj^<>!i$?@)v#pFr)u9gfQNeZ2Bl--F!*Z}+X1q$C>g2HI9o;Soj_6fb5M
zRn&h}10(41-Lhc;-k4%N2fKwVs_t;r$L94`*`09i!b`u}(nJlUwG!UnJh3D^1c4U&
zZkQ%4y>L_Z_rv`+OoY!3-4GI6@ee@F38u6X-sZ&{_%e}FL#BbSsqeX-Nu)&t8o1~k
zXBY0q7RwA4bLD7J(%s5>;ww{x-0jE=iQ0cxXmYc&zd6RXa;01YuprqO4@AmCEo4bd
zE&*1ieaj3JiFwYo8N;my-JE}UwM)n%Jy_h14L9FbIqImvN#WSdN^FGMs<lj<<+{l0
zi?u%#4s42uH2=;Xdtn5Eu)Y=s(lSFl%G395PtuDh_J6OAeL)0g5jL0yuRNNm*i?V2
z-?{XM`NkP5t<`td+~^-KOUv6{`+)}so55(3q=QqA@%U1J-X?y>ipu39c&b*WB8KO}
zP2>UUWi$!BL`JI2&ys3)3w=qCsGAP<0n(j*Vi)ie654gfZk%wvVUs;CzQJ#VgQzLy
z)FKtco5vw_0)wak|1<z-h1w-}bG3hv%V!YPWn4_pig`ve@m6nPZ&dhzikD=5DEkK-
zi9e-W$vY$KG-2L3Ek+tSnHko-r1A^GFbA+*5Qf=l;1&XK-qx=YfBtO*pUS!;RDEp@
zn>k_M$=C}lXK|+$n%x2o7M4~62U+W-Fd@S%vNd(Sr=X@hDF{IX#+-E(oMwNWV%Y>M
z`LIfHfD?7(M4c>qftr%@z06XOkM&!D)HL~1EK;4eDbMUmnUtAERdFaBDVJn*3C8qk
z`3NZi_rOJ}6qC<~gJcTOd^VD`T@o2(s#jfRl6|r?M_Ju=Bnmr_S(0y;ht5o|T%Hd@
zudb|eIf-1$Ej<Tw-DG_Fz|en#8epj$ec+p>`E1q0hA2h&-b`D9IvZpwY31^npvnd>
zjti)ih55{k#w}S5FPG?ewoDR2YXbO%X1i3bmLkQ}$(yxStmQhl`Mm5cs#t<ffvRXi
zORJesnng@Yel{1JOo`~{sVhrKRt~Q{C)aHfY~=}Hfu)Z^j!TblTi1U-Zy+c7H(JQ_
zClZ<VezaEe2UugQgvgA%{n>JB3H)0|{{GS>H|kNWB+0d^W|2$RRGkuhPQIVgY(J%$
zf!Sh-1<hpqOXXy><n6DTuS(<J&&w)%BCV>vDvET>NitNyHkZmVB#~Uq25Bt~QX>3B
z2%eUVNM9cmsM!WsS|ES!D6QoaNyVyswM&T1g1}k|GnP^fw^O0+Rv_kUK3G!Uu1wtN
zWuI*XRGDm2pItt^<#Hm=T&dfYI#{hdS%n}m>dTn2q-F-b^4xi{Mom8}hhb)ytD7n>
zD_>LEl_+CV`o8?#%pw5`IrH=a5?TG5D#)$b9o4rrvuDcEH~oLQMM+wsCZ9VOLakU%
zj`{uJB(+6E+luQfo9(kQMXQ|-WTL-XsXhzpM5*jpQkN){)Lts#Y5m#PB>x3dx8_9x
z_MtFMT{?1S$lq!g$Oi%!@+WOr^-?HG`Y)Y`<Qr3sqG!4)B|Fe8sS63H`>Fq&@+9ph
z6TG7Az>oW?|NMXW>C@h$V*Tfhrw{d?zv%kUZjx}Yw`0lY5CjW70duE6Or1?tC>n0*
zv}W)-dwavqdB|fo<*%Y)qSugyisfE3OuDiG6_Qrp1%8t5k2!5t$U&eC{&+0YA0%T)
z*O2dAt4>`2W`E4X?XjQ#BpUP39s9OV*BE=beYEq_U}t~-&Ef8wqru_P_TP424R+rg
z9sFx>xc}qPU}yVntGd}gw-4Uzz4_bV=%<6-!=LtFziP?yr^BD!&_ClzngAy;fD&ch
z^<vwk?8+gw-@ZNA|7CY@u*<esSER1^wd;<d>Iv_B|LcuXGFmK+E_v7z75{#nbvJXJ
z9qj(HxBEg*(bun8Z!rh!m1_RCgKcWO|BqeO7&}dV?f!a$f9-j{&hW$NlB*B*x8EK8
zG<dsxpuURSNqX^XckITwMo0Vq*q6NP0vG|6m(}Y6AqQ7HnI}B`6_@?%0we))mm=%}
zSpl=ReCz^{0RelL4ekQo0d|+{?gDxN1D9v-0)qj#x9jf$Tmk`aw@C5=IRSsa@l+lv
zYntn0abnIL_beeDzR;D1JWdCY<QD2Js7BU+51~8l&`0dY{6}UWhEkuzARTcS>rx}*
zI~AP)l>v>w!m6I^@fSjKB&H^G)^Q9;@yUgYd*VjJDUcQ^Y83P!?%IE7udg4iZ_r(P
zrw8}#tt>CB3ctv;UN5$$qi26KNrw>zOsy^8nqovqIQ!vw1nh@C+$2RvnMD|?Kp@UY
zZNRLbVI;gSDR{k8oO-4_Yi?-TX3JS*vaBDZ+>;YN%m7y~2l3(L{G1cH!}=v1M|b>J
zVI4OhuKft$c>AdLN^6w!s;T8LlWF}{kDz?Wtrjzj>=AMXF!wCwF))9&oRfvY=3sn3
zgxn|^P3is~d7`$t?&z<x5c2$&TC80Dl^zM6e`lO>s(gIXc!F^hlkkeiaKq-!Wv~|h
zDu`$<gH>!W%B(=EWQEwR)$m2up<&=V_p$W_k<y?f66$WSh48MSu|Dnt?p|{54Np?;
z{V3`RehI=T3mz;LG|+#fGY-$4*3v?(u*)h1mHF_?lSvh_s8R;${QNEj3Dym^Ne&(H
zQdStxlq^^YtD`eXVdvN_{M77_4`ZG}kk%hk*?ZV0U&KDSVIh(${AE}o`^<UC-59JT
zaNW?x^p8&FQ!#H_)l{+Y0c{0P<M0nPR)vC<r=mO6tlr-M_WghMC7(J)D32FYx=KiW
z<!mV9FLo|8@;`9z7s`S6$#g8qo{V<MMKlS#K^S3XLApemefeq`Esl<MV_^*Af+e;n
zvqME#^kWhx9KxI^?3%qh*i+YE7Q4d85B-rFlq|G0l&Q|WE0(7=oNDCzftD^{eempu
z-rzr<J{kzTXf1zfgX)_iyOKqpF4HDCREcG1k9vL#P7ssW$Ht)e^}Ahkgt&;3w7>rN
z$&>ET4T4j5c&UF#lh1}RJ4T*2;Gs8;{4gB=41*C*FYqWDLKT&gWnZt*#>E=c*Tlg*
z{4VxC*F|%70(atZwv%0ls}?yu92<6A-&taj?ItAIV>f@`=WYNs)~{U6hV*4ohFIvu
zC<Cf_eF^(nr-(oBKIdvBVPVQxJ6<ln-9w8o1fI)VRLYx;*Qa<rg?BY*P>uo?M-#|k
z>%whr;(J`g(pm%SZhK2B+`T42uwW<Z##lKr!SuF_(EEmAe^<eYg-g@UH4lO|x-8SR
zRokGBc7lIlyUwvS)UifyV;SAsmRerjzO?JydLIaNUWBeMHVjf{-A^d)y(^>MXCmg^
z{G5oiqz7>5*PJTg22H=vGl0+uq`ZS1<mDexc=@8Riima@&@Q9m^MGd;aQIrkv@eIK
zwC_KbD?_$8dF+t40$dzd;Uj;$4c}z3_l_-g!yJDGN9kzM+%5Fzd_}_@(r5<)`L`tx
zk?x?JKtzLONksMk$0d?HhUSuq_+SY_$q!YNROBKUENcXggAEW#9g?OkBMFE;yrpR&
zFUg$tX6leRjdNK{=CsZy8!2lp1@nRWPRs1E$VbK0B+GrBB_%2Oei%iUrxEB)#hfyK
zNC$ti(;zzi8&Au9$FA19&?f2Lz<&n5Hv=cKbDo-FRrCXUu=quO-<|WaZ5LfOz7}0|
zq~4socOLaNgk1ik;U8>ufgf^OgK|DE6ZXjV)<w`dQ_L{`Vg0qxoXE3&JDGbC79nml
z)B`*Ps9#zAVFx}>Qg<|_JaWy<bq#Wfwq$=^oX}1EE1so^IhSX^KjzANhRB$={yCXu
zUH(FkWfF0*{aEN$-<gkl>$o%F(Dh04zsdZ6o}Z*$@S2FiZpz~k#K5%UN!TV&ijH@S
ze1Mht|9X#ly(jtne@{1h5BdM@<zJyZ-44{%@P}@2B&gs=cbM*l<4LNjX1N}e45ELu
zVeUCpdjZo5*l5%{+SOFXM*AcgMq}>1Q1#C8uki{>FZWgePeOGt33re(cf%_lL}Ok8
zVj%O#o<fZm48+bV%o#1AGc=}^yjOmXHJW6ukR@$JG*apNcoLSsROxW$jRFe;IZFfZ
zEIklU|C(dGqHyc;=edt17Z{wm!&HA?+j0sithdVQx(<uk{r>wk_C02qj6x26u*x`;
zPQjP@H&KNyxo~6du~W5x;J1r;=%im9S&=$x413&hg8<Sb{QU0lh>hJOK>?%IgZUog
zAKYOYOd;gR$E*?Djg=_6_G8{+Z}yLv3*8On1pVK+hslsT2y_MvfX-<YF6e&`x=ncK
zB?##-8jYcHI&?=hs(f^sbI)BL^%sEybZ5u8h-y7h*fwIPQF_6^T$r#6_lmPL!Xc?Q
z;Q)U+O`)`v378l01Ouq_Ik1MG!Zfbk*h7d;-oASKcCfSm`t|P4(f$FrS--)*PGH4O
z-PDJ2xz`u|@PduF8zwrOC<K48&aIzb@VE~h#{4?=Q@9&HA?rRGflmN#@t{o)FnVlC
z^?F^2lvJOBSO6AsLdrOfyb1U~0a~dg>{RA)*J}qn1(iy!<Cz}=j?<Kn#$;$`VMOpj
z^if8+fD}kLn4}SKFznmML=@??C5DFg&?z9E`9R)4ZmN)&R0C8&v0+1gTNGGS1AFPu
z;bG0b+>)D1j0Km*wa1Z6<Ew{%f7X9S{%4!ww}M>I)%xGYv)+1M|9kTIS?@vr`*Y-f
zz7c*QKLM9D`vQXk-_e)4`vNZk@0aTP0$%}lmrDEsDFNM=bo>Ij4>*>iJG2-HmW5@%
zRqww*mpuIfqkqdzLYa8J8zZN_Ga!vihaUT9(?;EG*d#EE@X-dtm?E_kb9>T1W7GiG
z21B|&eq>_l=*8EtXrdZiQ(a^sz}SH5q)=Cs8O%@cztnNl_6<^?31?IGlQTc`S&3+e
z`lqu^vqH}$pF(9Gs<qg;<kLg|At+SBBGTlge8jdS0)O13Y^3J<OFk7>NH9zM4$zW0
z{AJGX5^nrPx1G>xz_(56Y9=O}=ZmnK5B6W({ww1V+R{^DHI)D>&wm@ejg5`M`EO(W
z!T$T_uK$;rbuZjR2FS?Drwf$s1GrD1rd9IFPf(^#(Ua)}G9D?5EoS!eWP{ABhh1Mp
z3IG4wyMOxSHf|*Uzn%hNxnlB`9L3peZi`x3Cp&U&a(3dg9Ot%DE)K+j$dQLL%wR~1
zYqRPe;-2uH<f^|gz|2q|w%3=flPVQU^ML`-jYgyK>mQ&D-h)dZKd{c{W2!IbJSSy(
z&aD9t&@DTlgpkVx{cmfq`Bs@rQ%=*GsH$#R?SJ>{3QBS3Xq}m<29~C@f|j6v>q5yr
zT(pds{R?g+SSr|XD1_=pUl{Qxc}fGElg_f@Eif_x0cg+;Rh2roAecx3<Sp@l>s^$U
zt-Gx5E(yi$Wb|y6*6(!)uQvoS42GDwA}}}5-YyZ=!g0v0Zyx;FRVw=6Dtz<c&jX)~
zb$@?fF<HO&^%QByP?ht7_2nj?#2GKGOtu;2MK#i+(&%hdEM3z(GL%}%11nm{J|ea9
zddICjS2=O_CY>jJZL&fqd;q!v=-?Y0kdAY<$e7@(UiwH))Lxp&Z!1%7CTAKF-QmHS
z2OHbUZ?m$>JxKhSU}wVp8|487`CcyR7k@bBCa&dlh?MMExKl7ZPU^(0d*NaBk~0Zw
zU**!K<e?%n$YjmWa()x~wRL*JnK=jW<zdtJ<SxFNc~p`EyS30y4dmi(!!vV3{xsC?
zSGA>ZYx%_rR!C?i&`Xv&v~+w&%ZJ=I*J!fX6sQ`l&r73WR}Z|>RoAGy9gW`=!+)*K
z)qLx|C5?RJ^P*Grapw*zKXH|>3G|#C<hAXsdTDO*+U5|!9~)%oG|i2;T|Zr~gU(rR
z_S82Y+f#Wlp|(uUi*h2h|FE7qM|#X@R#=lzPl>f#r$weAXR~AaViV<c*#5qHM*B$a
zIC2%Ep^S;xBJ$Y6u@=u8R`vH~sDD06^kEBcN~=Jh+(~R6u66lg;w^8Uml@oQh%s9|
zR9}hxI?>ZP6PizTi7eYN3d+^AT7lr0BUAm)fBiS`#GS7)94Rz1ixOz6ER|%|20Wu;
zHJiIQuouv^xXF+cze5Jji2iMbo`$!GHf0Hm=&(iM@v788940Vj8F3AVcz>QeY+mwm
z-c$AP*apXUiVh;FJ2A0)6qqF8+ZlozoeqHstpSD6Jk62`<+~y|iySOHRz3Qao_Nq3
z?&1jq41mYm(kg&gv>sOsUkOj8aF^*_`Qt&GjOd!@Fw+-#Y9Jr|!H00Y-JZkrCm{Tx
zPm4l3%6(7Zr8x&q-BD>)mVZ*u(feEI@(m3A+sONthdf}VfSa960*Solc7eN-kX`8o
z)s-71HHJLsL;-2axn88%=0MR?K~lLw&P=kt?i={rB%~&ghq@1AB>0N?ZNl9)!Af)s
z^qWsC(8j1O>DUovE~`>ALlP{;^xfe741-sxRW9dO`ybwZ#FXaAI)6BcqaL{IZ&*6b
z38O1IQ&ZfbM16-V#I}y^%c{Jk)UP>)BpkW^W`!e0GnZ8q)?@-T3CN~vqUrC$b`lj*
zM?-?wTZ1v^Ega9@)4L9LpxJc)W_8}~7~u~-(FlhKl(}5$Jef@OQlF(+3Ka0Ms&qLs
z)d;9w@|jbFi2W2e+kab~{`L6jQ}k9gxVMXi(R&lxQ;AidOg(t52@O)-${FDHWK5$H
zHe>Q?^2Tf?Xiw-pC=dUXoltroXxO1naD`sHZz1YGh}82m2QvP3iV1MxvGVurb)m9I
zof`b80=Fs$x$e`%V)u0di+R`@7-4H54{@F@N4Z|7Gdg7;+JD=t;TtE|r;nveHz(L*
zI23f5z)lXb!`0Y^?v6O}AAzN4I?Lg%e;KV4h}MIekh2{iCv1@ir8Pk)N(G_|o?Tgp
zM0#KF_nK_b&A+78oEnc!rUT)}-Tg7}cfM#)cj)3+{fdRKZN`3SJRnP7USq7Rql$AY
z7^>x@<}#zT#ea5hk8IPc<EP($H#zyw=f^)Xng5PT^WrEFV-I=rbxuT4-J;}r$qG6U
zW^l*JQ;fUUDqLC8!qQ<m8`lFVwr`6lsqn2c{H^igoHd<yNri0yj(!}C{$~j-(%B8S
zUebrPYD^4Q>)t!qgl-E~$;R?O$^&lqrT9!&_9cTp!+);q=r1E`xT|?PbE}u81mF(<
z3-<HkJLDc8(=G=F&9Hn}a$*K?zDjcg=%O?9`*0tEPYKz;dXc%yu{u#u>4Sf~Z1Jmu
z&#;b%^Tn=Myni~e-*~+IF6G}{`#VLrg(6_+Sm&x(Riom31WXD%aer2$x##dZZQTk;
z_Ugm}w|`i5(a>t5C*o^Oq!F@!;VH;_cl&!6piG7a++Q#HigA9F6d_2893+_Lu)mB_
z4MgWf*!b1rT>aW(|Co&@GSqSh_mGPyxXUs5jyv!k1UDfAAw;=+kh0uPU9M4>T`D6=
zQ~%we9kqV6G(>dd1Ly6bidhi%-q9~xMLfZ-tAAoIjCq%n`G3a$A>#NbwvSuqfBfsW
zUp4VRUw`}HF8|}R{0ImKh<e_s6EN9?>T{49eX;hyI`kaUggp}^iUZ$B29XE9Y2{qJ
z3J=uuX*<9a9(mdCcvzazi79RKGM)0<yox{r|KfJ%_tPSOLNPRmu_F53Z#-2954**<
zA%A?Wr{1d`egc2PqZ8p5u42#o9ClOvr57?agxi}3dt3G1yN33XT0(Q@n2vz`OS{hR
zz4)99xcM9)+lL3R@Z`h^>2#Vmr^Q0{E1Q`GZq{{CN!%*Vp%Ax0Ey)uvDDObU{<)(u
zOwV?OtW85zlyaA|Bc)*gcYaMzLs1?EiGM?zHX?yo4t^c~@Ct~f;P5ro7v%PHUCoEm
z0YfN=L^V*$Yz3QpF^Z74Vi~A^zLCh5^uSV=1hC?8<kdtE%_CtwRzs1&kgyO(<4$!S
zj9a?VF;E;67Bfh(#G7O<LV4_80}8D0id|u$pv!dR1}LuERqoM4m7aCwT&ef<o`1fl
z<E?%Hz?iGF?GMJSCP0$U6$XLarRyw$I4AjPac0Wqpp#N=F!%!80FS+JKz2M=U%DE=
z0sY&FSGe(@uLroV?MI<pcaHzvMskN`fboE<Pv~=SnQ4(kC!UmTG-7QlFz+Tb7akJl
z59+TkUp{B4U12%eeq&6y4EU4-J%3V~y;KK^Vswk-+{{wgnWwM0#2;)D(p7?4;g4fF
zQ|I^TPxe`*8a0r{T*6r-^2NY1LcUm0c2*{8HaakfY8yjA_@#y|be#tHMmN}65QDtP
zM~KBr^Vt|cp_GecO_^fWlEuvQbZLhqF9YYJpn*n6Cxk3)fD6T5i(H1B#D6Z}a2!l4
zgOoK%D=W%$h9n8t)6G^83h|~!l^0FBt?IbjWDLeT2fx$y7X-w7J2#Mkrs98t4WoT$
z2S=jDF)P|G2oRJ7LXP_Zr7cN%5J&2%;T?E~m-RrkcsR^P>53A}>Qj=C){-V72x8<V
zq+}(;A+PkbTA`%FG2qpxDt}xz%0L}rz@u2<z?|aYMc!GskZTD1zR9Ze90Dk6uJa^I
z^V!uxYr|GMr50N3fw#rMVtHB=Z`5iT4)vBLNfU1jK?;p$An*WNC<@aHvAUE7N*h?X
z#);I=w!Y{ICeh0Z4@<(iPX@J<{Wl$eZ?G)Oboxdi5MzXHNut&k;D7Va<xd>iP?P|J
z$Y?l4K)u2)A9eXZS9bl(RN{Ykbvg`&z(;?NNk{F~wV(g*mVcje@ps+&?~h-7_4OZH
z>%Tkx$A8-V4=j=F%JC1cYHMR@l}N@+Mmf#Vpyc3O0GDj8<|bQG7A=$|KDswT(i~6H
zfKhyMxh&!2cg`^G|9|o|?Ri7Yu2fI71$STdfBAM0?d|V#-4?Jy!EtO=mcB9S=Q8Eg
z1sP}Yy)=m-pSqfx4Q3Ued07w%HU&zP6EYITr-MZ5bgoNUU|^e&3kce~X*Io?mk1!#
zP!eoUWJc+Wwe$BBCU{t`4CLn`^wX+7qByfPB$5{j&Ju@7BY%gya4d=seUH>H*h?jW
z&&AqfcvV2bIby2-Je}Ht5Cr;Sjp-^<3qV6o=SDA;uEds(04$Bu)lgY|Zr~R49Yv@D
zAbJplzF3cNJEXFln?6sMkOTPmhf@m1$BQCaWhNp^2gi<p7R+KOg;#N<NgyFPuMkH8
zPeqA2*W}jI(|?#wla@rsZRaLY7{nrYLsp}Cr3A$V#HxRC`iw00K$RN(0_;qA@DOX#
zfBeHKKZSYrup%m@?ql_1k(eLNWfiMGs8}-LpW)5ZO<w6sEF`DIcNKFq<&uWP{V0m=
z$0{%CJO2V*bQvqoVYj3sfCa*IrL#0gc!nlV99KS>S$~@hh1CS73K11nAIkau)D?v~
zqSr;5xROS8V<Gc$rk5~T(h5Ly6&gw?56~G9BCBGl`Y|!$ydaQW?1%uEpMbqfoq<?q
zX^t(D%`mVJs16m1(X|v0{{dGQfiW+EYa0H;UK&BGuqv=z?IThOa4b_)M-q+VBm?&T
zLvJ;@z<-uV|D2h*UZ+Jl<RgBJ&F@#rE><%bnX%3{F$OfWbr}cR#!$IJlB#%}9W}|#
zxKBcUGpb?lV6Sr@aaxpcZc=V6k#uuEC*NbqcB~%3E9&d$Ptl*iLV@SQ&!}a-T->)Z
zSQVYXRFs<oxdURXC5P)IJEZ|CWgxG&bAl4HG=F(w^64gO!~%~m)}XA%7wgBFhM3QB
zzL7jVFQhh9&r#|_=e<7>UnYz+{!@3x6Ebzw)SnRAYW?<!Eo?<pA*Ee<?dH){&U&Mm
zj@tL~^hmd?0+VN}G|SWvrw2T^G{hII1HQwef-(yMSsHx&*Vot`*g<3(U<tVdg8<_S
zhkw&T;dp@C2?-BvlSRui)o@e@k4VW3MLrfl#piD5Q5Iz15;hEzk!2`h3i5>=z*INI
zDpHaqyqWPVE3I9mGnkFN;YVHbtadkS^U@3b*6U-s>G!cK%5`o~TKj5Ppt~O=rOK8e
zT7}0KFzW?|qEBCq07@0D%530d4JH?-Hh<pG#?#NNxKJmj&tzt^ypSvnSTQlEPz=vq
zozqmLp0Bd34v+%JAy3RVm;xZ+Vb#j|)6R&;?vONy|6<UXjkqhoiX3_!(no7BfF6c(
zZr`eYv8*7LwTnAo>?{yqGpJCVBs?J7WxJ7x-=G2em#*Ra(21+5ONU*mget)i)PKfU
zI&fldDbnE%J-V_qX=RqVcg8y(SBDsLZ`61QJId`(L*aFV_V{8gri`!=5IcHFr}A~8
z6&L!AIlfr;-}%p~?bs{HmsbtA(5M9<ZhW2goU`nN1EVz(+bdT<4UknH>}ap7`HqKz
zcb(x5PBZ%YVm&yhA(HxHO_Wpnpnqzs(xz*$RnrVem$dlJZ|4{{DGM@&<e>u(M$}kf
zpznx_j2L50Y{P#p(|Eu;8}u?n2IPc6gK(uHAF8ue<#?MA`isvl^aj==X%450z&T!7
zl`g?qf)hi~jY@GbAd9E{CJ0wNbb-w9TE!~8I7?@6_%(ltraX%1N9xpBe}BA-);?TY
zz-kPZVzN`?t=e!|24OL2B~43g^67JoL8jz^D1g7F%kLB0N5AO`j+GFa0#7%2QQ#U8
z^B_eCphjHjcxB)dt-#YrL4uSmUw$c+EqMK~gRzD5xPU0-b$luTR0U{EhJ<f<?NO_M
zjZY1=`zq#?nivIY4fHHnxqo|U(i;R&ev0499>G>lNM2RKqvASa?bu@EIqtz?RUL$s
zDp0!yHxB8;b6r+_$?~pU9Dhe?$mby2hIMFpi4?(dlKz5<ZAuq|TvRz&33Fp8L5N4Q
zD$va<&(f-deKpwiIFQgctSOmJ0mqya!=4hWwYGJ_^N^RZsKBLJ6n|@zM7&)Yb3epX
zjsToI51Cd-sZ}vsQuSWZJ<@;}S9HaybOwb=0vdztEx2){fO31tK?{cJ@K(XRfTQB;
zRMaVa35cR<aZ7h<uX+ercRP>V#bVr9Y=el~*yloN{IILmH)R<P4au=Q#QaAIG8E^u
zR!~QNnxh({$;oF}%zuGbN~LE|d9r5r(nKApSlxS9U)aWKta`o1J2PxE%rE%0e*6UY
zd(pLI3r0oUdspe%cC7Bb<Em`qK}}55Rr7k7(RU(Z=fGzAg9yB+xBLu)p8UD?m4wUc
zWClWr?HCVG1OpJRd`6;9jkqw}qHV$}-$vBKl~3Sw$&-v1@_&<F&Gg^XY@;Bq=WPda
zYSE&w<e(~>R)#ekeHh%r%3yauS3IEwOd>-L_WgZRe+j0Tl_e%fDhl@iOgZ9xl#4YI
zVWdku*Q*}~{tWsF@lXPQIN_OOKn2NO%2FeQfT#ynu&E%#CUxMUj*vxr^<l>L(dLwQ
zL!RlSv*SBD_J5(5JK=RIX>iB;tThk&oOSdFcH=MyDz7+_f_R8JWtq%bYB@uhs3B$F
z)Tf&PV<v|DouplH4)RcuFFjVhvlIwqda!GnO3;e;)JBQ1=`2_CG_QuZPov%P504l_
zqbZAbAdgJ*8Jz5ei_>~zOFdehpMwGCt!OO_Z<bA}Eq{pr0QVwm2LwZbv@vT<*ekHF
z)QU3K&+-}0=&w+VfWMB%joPQtq4s4Qicu%;4sCIgK$JSoXB1ea?m{FD3HPVx$N%y3
z$>h;b-~A0JHDAIBiZB26{N$8n4Wxj-Le^%+DQx@2v@+Gmr7r~cE=PHC0bpP_Va#))
z5Oc|~d4Et1r#1Z@)}h|2^L%vd)<dTl5&M`&5!^VC*%|(5%*_tzu=O8`I_L4=S)Q{<
zVlYnCA#F~3myV*Ucv`$Q<zsD4e<1bnU;6UP-TfTRwe=q!TvZ>w#t^Q(J<pAEyO#i<
z@YZEiTs?*(Ybw|4QJOTs<JU_{=opUzSF2kna({5(P`y)aW2d%KmVd^(n^UeX-l_bK
zlBqCxZ|Gt7t}B_Ix~5>Bm#!`eA8HlEXP!F(ji!0tVPab*n&>z~3d<Xy9oxvJPNZWO
zgr@`L_%SfY+k+ghMLBwKK)^bAIH#Kc8=HV8wS5R7ojWY!$72~k0K?b~VZ=pj2ad5L
zgMZ31dNUJz$yw<yOr5D(=c?BI>#0QC#jpl`x>xQt29kkVQk1M!&m`}Z7#B7Tpyfju
zfNHA_sp)lMmDHrAuM}5%T|bGQ43M3k=R5snUgx_JJXD!JGg(*hJ(PLx^<b=UkB)O(
zxZBQiV3BR}%GOspm{X~H{Ur&Mb)NHrAAet?tRMG^Pg(;r+j-8(J?iL4{rcLEFmTe(
za%Ja~8fu1OVX%=dl|(+ib^JrnbChZ3jKBOV#%a)ekOj#9u;FSwMe?QplSykm;wCcp
zi!*tCbTG_mI&w-HXdCb<dsd{|KzG7>LvU{!+S>&7-T>BnLr`zaLfiz+>!+6c-hU3o
z*A_nOHMDFI3DLH+Y!T6KLl3sRz!Q9jA#8aO@vlP<sl15bUz&ceoqwC);`RjG1{U8C
zS-hv*EQdZ}3&~0ku-ZeglOKp1FwSuZc!Mx+W@c%XE;KOH5u-ow(n~>2SQ_!V1sK@A
ziDnV7uc^Ekv4;!bR@w%&!@4k9yMIB)q>Ky|ia0{m<*Nl_UD6PhJ8&q`x-fvuK>P!q
z<Mb~i^-s(cusedl#5fx))}SLQYqE2oxLE=2P_<FmojB}|Kw^visfE)(WVbNcJFwU-
z40g+LL)bNbufvnM!(QKEuRkC5`tx9}KdC2JE6O#rnV}*z9Y4~Be}~->34bitr#!4I
z)*>@rtPR4q=pM8dh}Z&Go~yt2W|#NnGKHxySG>1qm0L$gZks54>vU<RxL+)X$-7#-
z_8;c~a~QlQkpOzoZzex})Uk83a}CY`15RGq(NEUzr(ylgV4LlW`tl7#-^~NMOZ0(Q
zSl$?&y5dt!a~P@-n~g)S+<(v?CjZBb{k3-B40)5tSeYnT0`3JlJ;v>Y9381%!#p_-
zD+#F>@tnmcYOSUk%cA;hrMuLKk4cUAR4Eak&}w#sP;X~=xSU5+vwm%G*mSZ;UyD&0
z`08|*(s5l%$491e++I^;35!o3H59<v^1Cxp?tbom?tbom{$Kq3F9>QJrV{|F7XU7B
B{`3F<


From 98d1673828cc96ee0f9e3b509cfba6c5e6ed7339 Mon Sep 17 00:00:00 2001
From: Tim Nunamaker <tnunamak@gmail.com>
Date: Thu, 22 Oct 2026 18:20:26 -0500
Subject: [PATCH 59/87] test(manifest): accept profile 0.3.0 at registration

The registration test still treated protocol_version 0.3.0 as unknown,
so it failed once the runtime learned the 0.3.0 profile. It now rejects
0.4.0 as unknown, accepts RUN_COVERAGE_V1 at 0.3.0 and rejects it at 0.2.0.

Assisted-by: AI
Signed-off-by: Tim Nunamaker <tnunamak@gmail.com>
---
 .../test/connector-manifest-validation.test.ts | 18 ++++++++++++++----
 1 file changed, 14 insertions(+), 4 deletions(-)

diff --git a/reference-implementation/test/connector-manifest-validation.test.ts b/reference-implementation/test/connector-manifest-validation.test.ts
index 5684de7d6..3f267fc74 100644
--- a/reference-implementation/test/connector-manifest-validation.test.ts
+++ b/reference-implementation/test/connector-manifest-validation.test.ts
@@ -39,7 +39,8 @@ const TOP_LEVEL_REGEX_27 =
   /capabilities\.proven\.local_collector=true requires runtime_requirements\.bindings\.filesystem/;
 const TOP_LEVEL_REGEX_28 = /credential_capture field 'password' is a secret field .* with no label/;
 const TOP_LEVEL_REGEX_29 = /credential_capture field 'password' is a secret field with zero env aliases/;
-const PROFILE_VERSION_PATTERN = /protocol_version must be one of 0\.1\.0, 0\.2\.0, received 0\.3\.0/;
+const PROFILE_VERSION_PATTERN = /protocol_version must be one of 0\.1\.0, 0\.2\.0, 0\.3\.0, received 0\.4\.0/;
+const PROFILE_0_3_0_CAPABILITY_PATTERN = /protocol_capabilities RUN_COVERAGE_V1 require protocol_version 0\.3\.0/;
 const PROFILE_0_2_0_CAPABILITY_PATTERN = /protocol_capabilities DETAIL_COVERAGE_KEY_SETS require protocol_version 0\.2\.0/;
 const UNKNOWN_CAPABILITY_PATTERN = /protocol_capabilities must be an array of known capability names/;
 
@@ -217,8 +218,9 @@ test("validateBlobRefSchemaDeclaration rejects non-object, missing props, wrong
   assert.throws(() => validateBlobRefSchemaDeclaration(stream, noRequired, "invalid_request"), TOP_LEVEL_REGEX_5);
 });
 
-// Collection Profile Sections 3.1 and 3.4 at registration: 0.1.0 or 0.2.0,
-// known capability names, and a 0.2.0 capability only at 0.2.0. A manifest
+// Collection Profile Sections 3.1 and 3.4 at registration: 0.1.0, 0.2.0 or
+// 0.3.0, known capability names, a 0.2.0 capability only at 0.2.0 or later,
+// and RUN_COVERAGE_V1 only at 0.3.0. A manifest
 // without protocol_version is checked as 0.1.0. The stored-manifest read path
 // skips this check so a manifest already stored stays readable.
 test("validateConnectorManifest enforces the Collection Profile declaration at registration only", () => {
@@ -227,8 +229,16 @@ test("validateConnectorManifest enforces the Collection Profile declaration at r
     validateConnectorManifest({ ...manifestWithStream(), ...keySets, protocol_version: "0.2.0" })
   );
   assert.doesNotThrow(() => validateConnectorManifest({ ...manifestWithStream(), protocol_capabilities: ["BLOB"] }));
+  assert.doesNotThrow(() =>
+    validateConnectorManifest({
+      ...manifestWithStream(),
+      protocol_capabilities: ["RUN_COVERAGE_V1"],
+      protocol_version: "0.3.0",
+    })
+  );
   const rejected: [Record<string, unknown>, RegExp][] = [
-    [{ protocol_version: "0.3.0" }, PROFILE_VERSION_PATTERN],
+    [{ protocol_version: "0.4.0" }, PROFILE_VERSION_PATTERN],
+    [{ protocol_capabilities: ["RUN_COVERAGE_V1"], protocol_version: "0.2.0" }, PROFILE_0_3_0_CAPABILITY_PATTERN],
     [{ ...keySets, protocol_version: "0.1.0" }, PROFILE_0_2_0_CAPABILITY_PATTERN],
     [keySets, PROFILE_0_2_0_CAPABILITY_PATTERN],
     [{ protocol_capabilities: ["FORGED"], protocol_version: "0.2.0" }, UNKNOWN_CAPABILITY_PATTERN],

From 23ae4b249a69f72ae72b2fc7adf6b2f22703093d Mon Sep 17 00:00:00 2001
From: Tim Nunamaker <tnunamak@gmail.com>
Date: Thu, 22 Oct 2026 18:20:55 -0500
Subject: [PATCH 60/87] test(source-declaration): treat 0.4.0 as the unknown
 profile

The legacy adapter test used protocol_version 0.3.0 as its unknown
version, which the runtime now accepts. It now uses 0.4.0.

Assisted-by: AI
Signed-off-by: Tim Nunamaker <tnunamak@gmail.com>
---
 .../test/source-declaration-boundary.test.ts                | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/reference-implementation/test/source-declaration-boundary.test.ts b/reference-implementation/test/source-declaration-boundary.test.ts
index 49b49ad9d..1c9da0efc 100644
--- a/reference-implementation/test/source-declaration-boundary.test.ts
+++ b/reference-implementation/test/source-declaration-boundary.test.ts
@@ -33,7 +33,7 @@ const RUNTIME_IMPORT_REGEX = /import\s+(?!type\s)[\s\S]*?from\s+["']([^"']+)["']
 // src/public/source.ts directly.
 const SOURCE_CONTRACT_PATH_REGEX = /\/dist\/public\/source\.js$/;
 const PROJECTED_DECLARATION_VERSION_REGEX = /^reference\.legacy-connector-projection\.v1:sha256:[0-9a-f]{64}$/;
-const UNSUPPORTED_PROFILE_VERSION_REGEX = /manifest\.protocol_version must be one of 0\.1\.0, 0\.2\.0, received 0\.3\.0/;
+const UNSUPPORTED_PROFILE_VERSION_REGEX = /manifest\.protocol_version must be one of 0\.1\.0, 0\.2\.0, 0\.3\.0, received 0\.4\.0/;
 
 const query = {
   aggregations: {
@@ -318,9 +318,9 @@ test("legacy adapter admits Collection Profile 0.2.0 and keeps the Core declarat
   assert.deepEqual(declaration, sourceDeclarationFromLegacyConnectorManifest(legacy, attribution));
 });
 
-test("legacy adapter rejects a profile version other than 0.1.0 and 0.2.0", () => {
+test("legacy adapter rejects an unknown profile version", () => {
   assert.throws(
-    () => sourceDeclarationFromLegacyConnectorManifest({ ...legacy, protocol_version: "0.3.0" }, attribution),
+    () => sourceDeclarationFromLegacyConnectorManifest({ ...legacy, protocol_version: "0.4.0" }, attribution),
     UNSUPPORTED_PROFILE_VERSION_REGEX
   );
 });

From e62d1d7f66e8aad656c3eec6c48571c42b3436d0 Mon Sep 17 00:00:00 2001
From: Tim Nunamaker <tnunamak@gmail.com>
Date: Thu, 22 Oct 2026 19:03:25 -0500
Subject: [PATCH 61/87] test(reference): validate terminal commit responses

The vendored contract permits run-order members to be absent from terminal receipts written before run ordering.

Validate fresh, exact-replay, failed-START and legacy-replay responses against the contract as returned by the real routes.

Assisted-by: AI
Signed-off-by: Tim Nunamaker <tnunamak@gmail.com>
---
 docs/261021-local-device-coverage-evidence.md |   2 +-
 ...device-coverage-revision-atomicity.test.ts | 117 ++++++++++++++++++
 reference-implementation/vendor/README.md     |   6 +-
 3 files changed, 121 insertions(+), 4 deletions(-)

diff --git a/docs/261021-local-device-coverage-evidence.md b/docs/261021-local-device-coverage-evidence.md
index f49140da2..4b3f00d4a 100644
--- a/docs/261021-local-device-coverage-evidence.md
+++ b/docs/261021-local-device-coverage-evidence.md
@@ -138,7 +138,7 @@ Terminal record for every successful run. A runtime that implements this profile
 
 As-of. Every owner projection that can show positive local coverage carries `coverage_as_of`: run id, release digest, run sequence, collection revision, and commit time. That is the connector summary (list), the connector detail, the owner connection diagnostics (`health.axes` and `rendered_verdict`), and the connection health embedded in each (`connection_health.coverage_as_of`, `health.coverage_as_of`), which equals the top-level value. All of them read the same summary projection. Owner UI copy reads "complete as of <time>".
 
-Contract. `@pdpp/reference-contract` is vendored as `reference-implementation/vendor/pdpp-reference-contract-0.1.0.tgz`, compiled from `packages/reference-contract` in PDP-Connect/pdpp PR #454 (head `473f9763`, not yet merged; see `reference-implementation/vendor/README.md`). The vendored contract, from pdpp#454, lists `coverage_as_of` (required, at the top level and in `health`) on the owner connection diagnostics response, and `run_sequence` (integer or null), `collection_revision` and `storage_epoch` (optional) on the terminal-run receipt. The new run-start route has no contract entry, like the other local-collector routes (`terminal-collection`, `local-collector-gaps`). `test/local-device-coverage-revision-atomicity.test.ts` validates the owner diagnostics response exactly as the server sends it; no member is removed before validation. Its connector detail check still ignores the known `streams` name mismatch (`STREAM_NAME_PATH`).
+Contract. `@pdpp/reference-contract` is vendored as `reference-implementation/vendor/pdpp-reference-contract-0.1.0.tgz`, compiled from `packages/reference-contract` at PDP-Connect/pdpp main merge commit `99b06a77cbc7129c3fe97c0450a830f2a023e6ea` for PR #454 (see `reference-implementation/vendor/README.md`); the package bytes are unchanged by the merge. The vendored contract lists `coverage_as_of` (required, at the top level and in `health`) on the owner connection diagnostics response, and optional `run_sequence` (integer or null), `collection_revision` and `storage_epoch` on the terminal-run receipt. The run-start route has no contract entry, like the other local-collector routes (`terminal-collection`, `local-collector-gaps`). `test/local-device-coverage-revision-atomicity.test.ts` validates owner diagnostics and fresh, replayed, failed-START and legacy terminal receipts exactly as the server sends them; no member is removed before validation. Its connector detail check still ignores the known `streams` name mismatch (`STREAM_NAME_PATH`).
 
 Device diagnostics. `local_collector_coverage` in the device-exporter diagnostics takes `fully_accounted` and `coverage_as_of` from the same summary projection: true only while the fenced proof is current and the coverage axis is `complete`. Its `by_store`, `counts_by_status`, `store_count` and `unaccounted_stores` are historical inventory from raw `coverage_diagnostics` records, with no run, release or revision behind them, and never claim current completeness.
 
diff --git a/reference-implementation/test/local-device-coverage-revision-atomicity.test.ts b/reference-implementation/test/local-device-coverage-revision-atomicity.test.ts
index 954666005..ffe6be74b 100644
--- a/reference-implementation/test/local-device-coverage-revision-atomicity.test.ts
+++ b/reference-implementation/test/local-device-coverage-revision-atomicity.test.ts
@@ -557,6 +557,28 @@ async function failRevisionWrites(lane: Lane, event?: string): Promise<() => Pro
   };
 }
 
+/** Fail run-start persistence once, then let the terminal route record its unregistered run. */
+async function failRunStartWrites(lane: Lane): Promise<() => Promise<void>> {
+  if (lane.backend === "postgres") {
+    await postgresQuery(`CREATE FUNCTION pdpp_test_fail_run_start() RETURNS trigger
+      LANGUAGE plpgsql AS $$ BEGIN RAISE EXCEPTION 'injected run-start failure'; END $$`);
+    await postgresQuery(`CREATE TRIGGER pdpp_test_fail_run_start
+      BEFORE INSERT ON collection_run_sequences FOR EACH ROW
+      EXECUTE FUNCTION pdpp_test_fail_run_start()`);
+    return async () => {
+      await postgresQuery("DROP TRIGGER pdpp_test_fail_run_start ON collection_run_sequences");
+      await postgresQuery("DROP FUNCTION pdpp_test_fail_run_start()");
+    };
+  }
+  getDb().exec(`CREATE TRIGGER pdpp_test_fail_run_start
+    BEFORE INSERT ON collection_run_sequences
+    BEGIN SELECT RAISE(ABORT, 'injected run-start failure'); END`);
+  return () => {
+    getDb().exec("DROP TRIGGER pdpp_test_fail_run_start");
+    return Promise.resolve();
+  };
+}
+
 /** A promise the test resolves to release a paused batch. */
 function gate(): { readonly open: () => void; readonly wait: Promise<void> } {
   let open: () => void = () => undefined;
@@ -1559,6 +1581,101 @@ laneTest("contract: owner diagnostics and connector detail validate against @pdp
   assert.deepEqual(detailErrors, [], "the connector detail matches the contract outside the known streams mismatch");
 });
 
+laneTest("contract: terminal commit, replay, unregistered run and legacy receipt validate as sent", async (lane) => {
+  const runId = "run-contract-fresh";
+  const registered = await postRunStart(lane, runId);
+  assert.equal(registered.status, 201, JSON.stringify(registered.body));
+  const freshWireBody = await terminalWireBody(lane, runId);
+  const fresh = await postTerminal(lane, freshWireBody);
+  assert.equal(fresh.status, 201, JSON.stringify(fresh.body));
+  assert.ok(fresh.body);
+  assert.equal(typeof fresh.body.collection_revision, "number");
+  assert.equal(typeof fresh.body.run_sequence, "number");
+  assert.equal(typeof fresh.body.storage_epoch, "number");
+  const freshValidation = validateResponse("refCommitDeviceExporterTerminalRun", {
+    body: fresh.body,
+    status: fresh.status,
+  });
+  assert.equal(freshValidation.ok, true, `fresh terminal response: ${JSON.stringify(freshValidation)}`);
+  assert.deepEqual(freshValidation, { ok: true, skipped: false });
+
+  const replay = await postTerminal(lane, freshWireBody);
+  assert.equal(replay.status, 200, JSON.stringify(replay.body));
+  assert.deepEqual(replay.body, fresh.body, "an exact replay returns the stored receipt");
+  const replayValidation = validateResponse("refCommitDeviceExporterTerminalRun", {
+    body: replay.body,
+    status: replay.status,
+  });
+  assert.equal(replayValidation.ok, true, `exact replay response: ${JSON.stringify(replayValidation)}`);
+  assert.deepEqual(replayValidation, { ok: true, skipped: false });
+
+  const unregisteredRunId = "run-contract-start-failed";
+  const restoreRunStartWrites = await failRunStartWrites(lane);
+  let failedStart: JsonResponse;
+  try {
+    failedStart = await postRunStart(lane, unregisteredRunId);
+  } finally {
+    await restoreRunStartWrites();
+  }
+  assert.ok(
+    failedStart.status >= 500,
+    `the injected START registration failure is surfaced: ${JSON.stringify(failedStart.body)}`
+  );
+  const unregistered = await postTerminal(lane, await terminalWireBody(lane, unregisteredRunId));
+  assert.equal(unregistered.status, 201, JSON.stringify(unregistered.body));
+  assert.ok(unregistered.body);
+  assert.equal(unregistered.body.run_sequence, null, "the failed START registration issued no run sequence");
+  const unregisteredValidation = validateResponse("refCommitDeviceExporterTerminalRun", {
+    body: unregistered.body,
+    status: unregistered.status,
+  });
+  assert.equal(
+    unregisteredValidation.ok,
+    true,
+    `unregistered terminal response: ${JSON.stringify(unregisteredValidation)}`
+  );
+  assert.deepEqual(unregisteredValidation, { ok: true, skipped: false });
+
+  const legacyRunId = "run-contract-legacy-receipt";
+  assert.equal((await postRunStart(lane, legacyRunId)).status, 201);
+  const legacyWireBody = await terminalWireBody(lane, legacyRunId);
+  const original = await postTerminal(lane, legacyWireBody);
+  assert.equal(original.status, 201, JSON.stringify(original.body));
+  const [stored] = await sql(
+    lane,
+    "SELECT event_id, data_json FROM spine_events WHERE run_id = ? AND event_type = 'run.completed'",
+    "SELECT event_id, data_json::text AS data_json FROM spine_events WHERE run_id = $1 AND event_type = 'run.completed'",
+    [legacyRunId]
+  );
+  assert.ok(stored, "the server stored the original terminal receipt");
+  const legacyEvent = JSON.parse(String(stored.data_json)) as Record<string, unknown>;
+  const legacyReceipt = legacyEvent.terminal_run_commit_receipt as Record<string, unknown>;
+  const legacyResponse = legacyReceipt.response as Record<string, unknown>;
+  for (const field of ["collection_revision", "run_sequence", "storage_epoch"] as const) {
+    delete legacyEvent[field];
+    delete legacyResponse[field];
+  }
+  await sql(
+    lane,
+    "UPDATE spine_events SET data_json = ? WHERE event_id = ?",
+    "UPDATE spine_events SET data_json = $1::jsonb WHERE event_id = $2",
+    [JSON.stringify(legacyEvent), stored.event_id]
+  );
+  const legacyReplay = await postTerminal(lane, legacyWireBody);
+  assert.equal(legacyReplay.status, 200, JSON.stringify(legacyReplay.body));
+  assert.ok(legacyReplay.body);
+  assert.deepEqual(legacyReplay.body, legacyResponse, "the legacy replay returns the stored pre-run-order receipt");
+  for (const field of ["collection_revision", "run_sequence", "storage_epoch"] as const) {
+    assert.equal(field in legacyReplay.body, false, `legacy replay omits ${field}`);
+  }
+  const legacyValidation = validateResponse("refCommitDeviceExporterTerminalRun", {
+    body: legacyReplay.body,
+    status: legacyReplay.status,
+  });
+  assert.equal(legacyValidation.ok, true, `legacy replay response: ${JSON.stringify(legacyValidation)}`);
+  assert.deepEqual(legacyValidation, { ok: true, skipped: false });
+});
+
 // Bounded by the test timeout: a hang fails the test, and PostgreSQL reports a
 // deadlock between the two transactions as an error (40P01) to one of them.
 test("a record transaction and a terminal commit for one connection serialize without deadlock [real PostgreSQL]", {
diff --git a/reference-implementation/vendor/README.md b/reference-implementation/vendor/README.md
index 28cdc2cfe..d28e8f1f8 100644
--- a/reference-implementation/vendor/README.md
+++ b/reference-implementation/vendor/README.md
@@ -11,9 +11,9 @@ built with a plain `npm pack`, referenced via a `file:` dependency, with its dig
 recorded below.
 
 `pdpp-reference-contract-0.1.0.tgz` was built via `npm pack` from `packages/reference-contract`
-at `PDP-Connect/pdpp` PR #454 head commit `473f97633458031425f85343cd822619ccae205b` (open,
-not merged; re-vendored 2026-10-22). Re-point this entry to the merge commit of
-PDP-Connect/pdpp#454 once it merges. It replaces the earlier build from
+at PDP-Connect/pdpp main merge commit `99b06a77cbc7129c3fe97c0450a830f2a023e6ea` for PR #454
+(merged and re-vendored 2026-10-22). The package bytes are unchanged by the merge, so the
+existing tarball and its recorded SHA-256 remain valid. It replaces the earlier build from
 `0d3deca19186a2185a6a15ab76c71352d10e627e` (`main`, 2026-09-02). SHA-256 is recorded in
 `SHA256SUMS` in this directory.
 

From d993b19dee49bdd2cb7b31483867d7228f5f86a8 Mon Sep 17 00:00:00 2001
From: Tim Nunamaker <tnunamak@gmail.com>
Date: Thu, 22 Oct 2026 19:54:07 -0500
Subject: [PATCH 62/87] Negotiate store coverage as an elective extension

Model RUN_COVERAGE_V1 as an elective extension over accepted base profiles and refuse unsupported 0.3.0 declarations. Keep store positives behind validated inventories, bound scopes, and runtime accounting; document the remaining 0.2.0 OBSERVATION gap.

Assisted-by: AI
Signed-off-by: Tim Nunamaker <tnunamak@gmail.com>
---
 docs/261021-local-device-coverage-evidence.md |  65 +++++--
 .../src/collector-runner.test.ts              | 172 ++++++++++++++----
 .../collector-runtime/src/collector-runner.ts |  69 +++----
 .../src/runtime-capabilities.test.ts          |  15 +-
 .../src/runtime-capabilities.ts               |   8 +-
 packages/connector-protocol/README.md         |  25 ++-
 .../src/connector-runtime-protocol.test.ts    |  31 ++--
 .../src/connector-runtime-protocol.ts         |  37 ++--
 .../bin/pdpp-local-collector.ts               |  42 ++++-
 .../test/collection-profiles.test.ts          |  31 +++-
 .../test/selected-collection-release.test.ts  |   3 +-
 reference-implementation/runtime/index.ts     |  20 +-
 .../server/connector-manifest-validation.ts   |  14 +-
 .../connector-manifest-validation.test.ts     |  48 +++--
 ...detail-coverage-shortfall-severity.test.ts |  73 +++++++-
 .../test/helpers/install-path-fixture.ts      |   3 +-
 .../local-device-coverage-journey.test.ts     |   7 +-
 ...device-coverage-revision-atomicity.test.ts |   3 +-
 .../local-device-coverage-stale-proof.test.ts |   3 +-
 .../test/source-declaration-boundary.test.ts  |   7 +-
 20 files changed, 481 insertions(+), 195 deletions(-)

diff --git a/docs/261021-local-device-coverage-evidence.md b/docs/261021-local-device-coverage-evidence.md
index 4b3f00d4a..d4857ba52 100644
--- a/docs/261021-local-device-coverage-evidence.md
+++ b/docs/261021-local-device-coverage-evidence.md
@@ -40,9 +40,38 @@ The device verdict (`pdpp-local-collector status`, `terminal_coverage.verdict`)
 
 The server's owner coverage is a fact about one admitted run, shown with its as-of. Any attempt the server observes from the same or a later run (a state commit, a terminal run record, a durable batch record, an admitted or refused batch, a delivered failure report, a legacy split terminal report) retires it to unknown; an observation that names no run counts as the newest started run. See "Run order and commit order" and "Revision fencing" below. Only an attempt the server never hears about leaves the last admitted coverage in place. Every failed run, including one that fails before its scan, leaves an open `connector_child_failure` gap on the device, so the device shows that run as `unadmitted` until a later complete run is admitted and recovers the gap.
 
-## Collection Profile amendment
+## Collection Profile extension
 
-The canonical Collection Profile is `data-connectors/docs/spec/collection-profile.md`. [Data-connectors PR #541](https://github.com/PDP-Connect/data-connectors/pull/541), stacked on #516, specifies the optional START capability, stream store declarations, terminal store collection evidence, and its relationship to detail accounting and checkpoint eligibility. Data-connectors #539 and this PR implement the amendment. The owner approves it at merge.
+The canonical Collection Profile is `data-connectors/docs/spec/collection-profile.md`. [Data-connectors PR #541](https://github.com/PDP-Connect/data-connectors/pull/541), stacked on #516, specifies the elective store-collection extension, stream store declarations, terminal evidence, and its relationship to detail accounting and checkpoint eligibility. Data-connectors #539 and this PR implement the extension. The owner approves it at merge.
+
+## Store collection extension negotiation
+
+`coverage.version: 1` versions the store evidence payload as an elective extension, negotiated by `RUN_COVERAGE_V1`. The extension applies to base profiles 0.1.0, 0.2.0, and 0.3.0. Declaring the capability never blocks spawn. A runtime that does not support the extension starts the connector, omits `START.run_coverage_version`, and records no store evidence. Using the extension does not make a runtime conformant to a base profile it does not fully implement.
+
+This data-connect runtime requests evidence only when the manifest declares `RUN_COVERAGE_V1`, its base is 0.1.0 or 0.2.0, every requested stream has a non-empty `coverage_stores` inventory, and the effective scope is bound by `collection_scope`. Any stream that declares `coverage_stores` must declare `RUN_COVERAGE_V1`. The reference runtime does not implement the extension; it accepts the capability electively and sends no positive store evidence. Both runtimes refuse base profile 0.3.0 until they implement its mandatory rules in full.
+
+## Profile 0.3.0 refusal
+
+The audit found mandatory 0.3.0 rules that the runtimes do not implement. Every 0.3.0 manifest is therefore refused at reference-runtime registration and before spawn in both runtimes. The feature gaps below are the reason for that version-level refusal; `RUN_COVERAGE_V1` remains an independent elective extension.
+
+| Mandatory feature or obligation | Reference runtime status and gap | Collector runtime status and gap |
+| --- | --- | --- |
+| `protocol_version: 0.3.0` | `REFUSED-AT-REGISTRATION` and `REFUSED-PRE-SPAWN` (`reference-implementation/server/connector-manifest-validation.ts:194-205`; `reference-implementation/runtime/index.ts:2642-2654`). | `REFUSED-PRE-SPAWN` (`packages/collector-runtime/src/collector-runner.ts:941-948`). |
+| `OBSERVATION` capability and message; `diagnostic_descriptors` manifest member | `REFUSED-AT-REGISTRATION` and `REFUSED-PRE-SPAWN`; `OBSERVATION` is not advertised or handled (`reference-implementation/runtime/index.ts:2597-2606, 6482-6497`), and the manifest type has no descriptor member (`reference-implementation/runtime/index.ts:173`). | `REFUSED-PRE-SPAWN`; `OBSERVATION` is not advertised (`packages/collector-runtime/src/runtime-capabilities.ts:80-90`), and the profile binder reads only version, capabilities, and streams (`packages/local-collector/bin/pdpp-local-collector.ts:3282-3304`). |
+| `DONE.error.basis` and the Section 5.11 diagnosis/recovery-hint gate | `REFUSED-AT-REGISTRATION` and `REFUSED-PRE-SPAWN`; `DONE.error` has no `basis` member in the shared wire type (`packages/connector-protocol/src/connector-runtime-protocol.ts:931-936`). | `REFUSED-PRE-SPAWN`; `DONE.error` has no `basis` member in the shared wire type (`packages/connector-protocol/src/connector-runtime-protocol.ts:931-936`). |
+| Section 5.12 diagnostic data stays on the device | `REFUSED-AT-REGISTRATION` and `REFUSED-PRE-SPAWN`; the runtime has no `OBSERVATION` record path (`reference-implementation/runtime/index.ts:2597-2606, 6482-6497`). | `REFUSED-PRE-SPAWN`; the collector advertises no `OBSERVATION` support (`packages/collector-runtime/src/runtime-capabilities.ts:80-90`). |
+| `parent_streams` detail accounting and declared `transform_epoch` | `REFUSED-AT-REGISTRATION` and `REFUSED-PRE-SPAWN`; the `DETAIL_COVERAGE` wire type has no obligation, validator-domain, or epoch members (`packages/connector-protocol/src/connector-runtime-protocol.ts:503-563`). | `REFUSED-PRE-SPAWN`; the runner rejects `DETAIL_GAP` and `DETAIL_COVERAGE` rather than accounting them (`packages/collector-runtime/src/collector-runner.ts:1952-1954`). |
+| Runtime-sent `START.detail_debts` (required on every 0.3.0 run, including an empty array) | `REFUSED-AT-REGISTRATION` and `REFUSED-PRE-SPAWN`; `START` sends `detail_gaps`, not `detail_debts` (`reference-implementation/runtime/index.ts:3489-3490`; `packages/connector-protocol/src/connector-runtime-protocol.ts:311-348`). | `REFUSED-PRE-SPAWN`; the START type and builder have no `detail_debts` member (`packages/connector-protocol/src/connector-runtime-protocol.ts:311-348`; `packages/collector-runtime/src/collector-runner.ts:2565-2585`). |
+| Fully typed portable `DETAIL_GAP_RECOVERED` lifecycle | `REFUSED-AT-REGISTRATION` and `REFUSED-PRE-SPAWN`; the handler accepts partial optional fields and settles a gap claim, not the full portable seal (`reference-implementation/runtime/index.ts:2196-2213, 5945-6008`). | `REFUSED-PRE-SPAWN`; the message is not accounted by the runner, which rejects the related detail accounting messages (`packages/collector-runtime/src/collector-runner.ts:1945-1965`). |
+| Complete, empty, unchanged, and gap replacement invalidates earlier hydrated-without-record and `optional_skip_keys` exchanges | `REFUSED-AT-REGISTRATION` and `REFUSED-PRE-SPAWN`; it validates and retains these key sets but has no 0.3.0 replacement lifecycle (`reference-implementation/runtime/index.ts:1986-2020, 4192-4203`). | `REFUSED-PRE-SPAWN`; it rejects `DETAIL_COVERAGE` and has no replacement accounting (`packages/collector-runtime/src/collector-runner.ts:1952-1954`). |
+
+The universal 0.3.0 obligations include supporting `OBSERVATION`, applying the Sections 5.11–5.12 rules when diagnosis is present, and sending `START.detail_debts` on every run. In particular, `START.detail_debts` is not keyed to a manifest feature; both runtimes omit it. The version-level refusal prevents any 0.3.0 run from reaching that non-conformant START.
+
+Section 5.13 names future features and explicitly defines no behavior for them, so it adds no separate runtime obligation to this audit.
+
+## Known defect: 0.2.0 OBSERVATION
+
+Main Section 3.4 requires 0.2.0 runtimes to implement `OBSERVATION` and the mandatory Sections 5.10–5.12 accounting. Both runtimes accept 0.2.0 manifests without implementing those rules. The reference runtime rejects a declared `OBSERVATION` capability because it does not advertise it (`reference-implementation/runtime/index.ts:2596-2601`); the collector runtime also does not advertise or implement it (`packages/collector-runtime/src/runtime-capabilities.ts:75-90`). This defect is tracked by (issue: PDP-Connect/data-connect#579).
 
 ## Acceptance and release
 
@@ -205,9 +234,9 @@ were not in this note before, and they are added here.
 - "A runtime MAY request a separate run containing only instrumented streams."
   It is a permission. The rule that matters, that a connection-wide verdict
   does not cover uninstrumented streams, is kept.
-- The former manifest-level `run_coverage` advertisement is removed. The runtime
-  derives START negotiation from the pinned profile version and requested
-  streams' store inventories.
+- The former `run_coverage` manifest key is removed. The runtime derives START
+  negotiation from `RUN_COVERAGE_V1`, the supported base profile, and each
+  requested stream's store inventory.
 - "Checkpoint eligibility MUST remain governed by Sections 5.6 and 5.8." It
   restates the downgrade rule.
 - "Connector package patch versions alone MUST NOT establish wire
@@ -215,8 +244,8 @@ were not in this note before, and they are added here.
   says that profile versions are independent of connector versions and that
   rollout is runtime-first.
 - "Adding this optional feature to an already published profile requires a
-  minor profile version." Section 1 places this feature in 0.3.0, which covers
-  it.
+  minor profile version." Section 1 puts `coverage.version: 1` in a separate
+  extension, which applies to base profiles 0.1.0, 0.2.0, and 0.3.0.
 - "It also defines optional version 1 terminal store collection evidence ...
   the linked schemas do not yet establish support." Section 1 already says the
   linked schemas do not establish support for the version.
@@ -237,8 +266,10 @@ were not in this note before, and they are added here.
 | 3.2 | The manifest MUST state each store's obligation, content or metadata only. | Metadata-only inventory reads as completeness of content. | OP: "proven empty content is complete while metadata inventory stays inventory only" |
 | 3.2 | A runtime MUST NOT derive store coverage for a stream with no `coverage_stores`. | An undeclared store reads as covered. | OP: "the terminal endpoint rejects a store outside the registered inventory" |
 | 3.2 | A change to a store's obligation MUST change the manifest revision. | A proof for the old obligation survives the change. | PROJ: "catalog obligation changes invalidate proof when the binding generation advances" |
-| 3.4 | A runtime MUST request evidence only for a pinned `0.3.0` profile when every requested stream declares `coverage_stores`. | Evidence is requested under an older profile or for a stream without a complete store inventory. | LC: "a 0.3.0 manifest with inventories for requested streams requests store evidence"; LC: "a 0.2.0 manifest does not request store evidence even with inventories"; LC: "a 0.3.0 manifest does not request store evidence when a requested stream lacks inventory"; PROTO: "collectionProfileDeclarationError accepts profile versions and gates capabilities by version" |
-| 3.4 | A runtime that does not support the capability MUST refuse the connector before spawn. | Same as above, without the declaration. | RUNNER: "runCollectorConnector refuses a RUN_COVERAGE_V1 connector before spawn when its run requests no evidence" and "runCollectorConnector runs a RUN_COVERAGE_V1 connector when its START requests evidence"; CAP: "a declared RUN_COVERAGE_V1 places on the collector runtime and is missing on the provider runtime"; SEV: "the pre-spawn gate rejects unknown and unsupported required capabilities and admits implemented ones"; PROTO: "RUN_COVERAGE_V1 is a known, required capability" |
+| 3.4 | A runtime MUST request evidence only when the manifest declares elective `RUN_COVERAGE_V1`, its base profile is supported, every requested stream has a non-empty `coverage_stores` inventory, and `collection_scope` binds the effective scope. | Evidence is requested without opt-in, under an unsupported base, for a stream without inventory, or for an unbound scope. | LC: "a 0.2.0 profile with RUN_COVERAGE_V1 and inventories requests store evidence"; LC: "a 0.1.0 profile with RUN_COVERAGE_V1 and inventories requests store evidence"; LC: "RUN_COVERAGE_V1 without a requested stream inventory does not request evidence"; LC: "a manifest without RUN_COVERAGE_V1 requests no store evidence"; RUNNER: "runCollectorConnector requests no coverage when START restricts a stream to named resources" |
+| 3.4 | A runtime MUST NOT block spawn solely because a connector declares elective `RUN_COVERAGE_V1`; without extension support it MUST omit `START.run_coverage_version` and record no store evidence. | An optional extension blocks connectors that can run without it, or an unsupported runtime records evidence it cannot accept. | SEV: "reference runtime starts RUN_COVERAGE_V1 electively without requesting or recording store evidence"; RUNNER: "runCollectorConnector starts a RUN_COVERAGE_V1 connector when this run requests no evidence"; CAP: "a declared RUN_COVERAGE_V1 places on runtimes with or without the extension"; PROTO: "RUN_COVERAGE_V1 is known and elective" |
+| 3.4 | A manifest that declares `coverage_stores` MUST declare `RUN_COVERAGE_V1`; runtimes MUST refuse the mismatch at registration or before spawn. | Store obligations have no negotiated evidence contract. | connector-manifest-validation: "validateConnectorManifest refuses coverage_stores without RUN_COVERAGE_V1 at registration"; RUNNER: "runCollectorConnector refuses coverage_stores without RUN_COVERAGE_V1 before spawn" |
+| 3.4 | Runtime accounting MUST override `DONE.coverage`; incomplete or unevaluable base accounting MUST NOT produce a positive store status. | A connector's collected claim hides a skip, detail gap, or accounting the runtime cannot assess. | RUNNER: "runCollectorConnector lets SKIP_RESULT defeat a collected DONE assertion"; RUNNER: "runCollectorConnector records no 0.2.0 positive when it cannot account for DETAIL_GAP" and "... DETAIL_COVERAGE" |
 | 3.4 | When START omits `run_coverage_version`, a connector MUST omit `DONE.coverage`. | Coverage that was not requested is trusted. | JOUR: "A: without START coverage negotiation, a successful run supplies no positive coverage"; RUNNER: "a connector that does not request coverage cannot submit a positive DONE verdict" |
 | 3.4 | If version 1 was requested and a successful DONE omits `coverage` (including from producers that predate the field), the runtime MUST treat the stores as unknown and MUST NOT keep an earlier positive. | An omission is read as "not supported", and the older proof stays current. | RUNNER: "successful DONE without coverage retires earlier proof with STATE" and "... without STATE"; PROJ: "legacy terminal commit without v2 proof stays unknown" |
 | 3.4 | Negotiating this evidence MUST NOT disable or weaken detail accounting, diagnosis, or checkpoint rules. | Opting into coverage skips the accounting that protects data. | RUNNER: "runCollectorConnector lets SKIP_RESULT defeat a collected DONE assertion"; OP: "checkpoint eligibility ${eligible} governs state advancement with accounted debt" |
@@ -320,8 +351,8 @@ rule, and the 5.8.2 `scoped` rule. The DC tests check only the profile's
 wording. This repository tests the runtime and server halves of the
 inventory rule: the collector requests no evidence when a selected stream
 has no inventory (`packages/local-collector/test/collection-profiles.test.ts`:
-"a 0.3.0 manifest does not request store evidence when a requested stream
-lacks inventory"), and the server rejects a claim for such a
+"RUN_COVERAGE_V1 without a requested stream inventory does not request
+evidence"), and the server rejects a claim for such a
 stream (OP: "the terminal endpoint rejects a claim for a stream with no
 declared inventory"). No code in this repository derives a Section 3.3.9
 binding or effective-authority record from `scoped`. It only qualifies
@@ -336,8 +367,10 @@ coverage.
   per-stream `resources` or the requested stream set. When a runtime cannot
   bind the effective scope, it requests no evidence; this is conformant. The
   current runtime suppresses evidence when a START names resources.
-- Negotiation: a pinned manifest must declare `protocol_version: "0.3.0"`,
-  and every requested stream must have a non-empty `coverage_stores` inventory.
-  Otherwise the runtime omits `START.run_coverage_version`. `RUN_COVERAGE_V1`
-  is not accepted under 0.1.0 or 0.2.0, and the former `run_coverage` manifest
-  key is not read.
+- Negotiation: a manifest must declare `RUN_COVERAGE_V1`, use a base profile
+  the runtime supports, and give every requested stream a non-empty
+  `coverage_stores` inventory. The effective scope must bind to
+  `collection_scope`. Otherwise the runtime omits
+  `START.run_coverage_version`. The extension does not establish conformance
+  to an unsupported base profile; this runtime refuses 0.3.0 until it
+  implements that profile in full.
diff --git a/packages/collector-runtime/src/collector-runner.test.ts b/packages/collector-runtime/src/collector-runner.test.ts
index 917c3106b..e775f8486 100644
--- a/packages/collector-runtime/src/collector-runner.test.ts
+++ b/packages/collector-runtime/src/collector-runner.test.ts
@@ -50,6 +50,12 @@ import {
  * process.cwd()` module constant produced when tests ran from here.
  */
 const TEST_EXECUTION_ROOT = join(import.meta.dirname, "..");
+const RUN_COVERAGE_DECLARATION = {
+  collectionProfileVersion: "0.2.0",
+  coverageStoreStreams: ["messages"],
+  declaresCoverageStores: true,
+  protocol_capabilities: ["RUN_COVERAGE_V1"],
+} as const;
 
 async function assertCoverageFixtureRejected(input: {
   coverage: unknown;
@@ -82,6 +88,7 @@ async function assertCoverageFixtureRejected(input: {
           manifestFingerprint: "a".repeat(64),
           protocol_capabilities: [],
           ...(input.resources ? { resources: input.resources } : {}),
+          ...RUN_COVERAGE_DECLARATION,
           runCoverageVersion: 1,
           runtime_requirements: { bindings: {} },
           ...(input.scope ? { scope: input.scope, timeScopableStreams: requestedStreams } : {}),
@@ -484,6 +491,7 @@ test("runCollectorConnector commits a typed DONE coverage verdict without a diag
         connector_id: "fixture-typed-coverage",
         manifestFingerprint: "a".repeat(64),
         protocol_capabilities: [],
+        ...RUN_COVERAGE_DECLARATION,
         runCoverageVersion: 1,
         runtime_requirements: { bindings: {} },
         streams: ["messages"],
@@ -544,6 +552,7 @@ test("runCollectorConnector lets SKIP_RESULT defeat a collected DONE assertion",
         connector_id: "fixture-skip-overrides-coverage",
         manifestFingerprint: "a".repeat(64),
         protocol_capabilities: [],
+        ...RUN_COVERAGE_DECLARATION,
         runCoverageVersion: 1,
         runtime_requirements: { bindings: {} },
         streams: ["messages"],
@@ -659,6 +668,7 @@ test("runCollectorConnector withholds collected coverage after an HTTP receipt r
         connector_id: "fixture-rejected-http-receipt",
         manifestFingerprint: "a".repeat(64),
         protocol_capabilities: [],
+        ...RUN_COVERAGE_DECLARATION,
         runCoverageVersion: 1,
         runtime_requirements: { bindings: {} },
         streams: ["messages"],
@@ -722,6 +732,7 @@ test("runCollectorConnector records withheld checkpoint accounting before a type
         connector_id: "fixture-withheld-coverage-checkpoint",
         manifestFingerprint: "a".repeat(64),
         protocol_capabilities: [],
+        ...RUN_COVERAGE_DECLARATION,
         runCoverageVersion: 1,
         runtime_requirements: { bindings: {} },
         streams: ["messages"],
@@ -796,6 +807,7 @@ for (const [label, scope, expectedScope] of [
           enforcesSourceRoots: true,
           manifestFingerprint: "a".repeat(64),
           protocol_capabilities: [],
+          ...RUN_COVERAGE_DECLARATION,
           runCoverageVersion: 1,
           runtime_requirements: { bindings: {} },
           ...(scope ? { scope } : {}),
@@ -888,6 +900,7 @@ for (const [versionLabel, coverageVersion] of [
             connector_id: "fixture-unknown-coverage-version",
             manifestFingerprint: "a".repeat(64),
             protocol_capabilities: [],
+            ...RUN_COVERAGE_DECLARATION,
             runCoverageVersion: 1,
             runtime_requirements: { bindings: {} },
             streams: ["messages"],
@@ -1066,6 +1079,7 @@ test("runCollectorConnector requests no coverage when START restricts a stream t
         manifestFingerprint: "a".repeat(64),
         protocol_capabilities: [],
         resources: { messages: ["C07JYF0U8BY"] },
+        ...RUN_COVERAGE_DECLARATION,
         runCoverageVersion: 1,
         runtime_requirements: { bindings: {} },
         streams: ["messages"],
@@ -1101,6 +1115,7 @@ test("runCollectorConnector rejects coverage sent for a START restricted to name
  * conforming RUN_COVERAGE_V1 connector does: with coverage when START asks.
  */
 async function writeEvidenceRequiringConnector(spawnedPath: string): Promise<string> {
+  const startPath = `${spawnedPath}.start`;
   return await writeFixtureConnector({
     script: `
       const fs = await import("node:fs/promises");
@@ -1111,6 +1126,7 @@ async function writeEvidenceRequiringConnector(spawnedPath: string): Promise<str
         if (input.includes("\\n")) resolve();
       }));
       const start = JSON.parse(input.split("\\n")[0]);
+      await fs.writeFile(${JSON.stringify(startPath)}, JSON.stringify(start));
       const done = { type: "DONE", status: "succeeded", records_emitted: 0 };
       if (start.run_coverage_version === 1) {
         done.coverage = { version: 1, collection_scope: start.collection_scope,
@@ -1121,14 +1137,12 @@ async function writeEvidenceRequiringConnector(spawnedPath: string): Promise<str
   });
 }
 
-// Collection Profile Section 3.4: a connector that cannot run without store
-// collection evidence declares RUN_COVERAGE_V1. A run whose START requests no
-// evidence cannot supply it, so the collector refuses the connector before
-// spawn: before its first heartbeat, with the capability named as missing.
-test("runCollectorConnector refuses a RUN_COVERAGE_V1 connector before spawn when its run requests no evidence", async () => {
+// RUN_COVERAGE_V1 is elective. A run that cannot request evidence still starts
+// and writes no positive terminal fact.
+test("runCollectorConnector starts a RUN_COVERAGE_V1 connector when this run requests no evidence", async () => {
   const harness = await startCollectorHarness({ priorState: {} });
   try {
-    const spawnedPath = join(await createTempDir("pdpp-run-coverage-capability-refused-"), "spawned");
+    const spawnedPath = join(await createTempDir("pdpp-run-coverage-elective-"), "spawned");
     const fixture = await writeEvidenceRequiringConnector(spawnedPath);
     for (const [label, evidence] of [
       ["no store evidence configured", {}],
@@ -1138,43 +1152,108 @@ test("runCollectorConnector refuses a RUN_COVERAGE_V1 connector before spawn whe
           artifactDigest: `sha256:${"b".repeat(64)}`,
           manifestFingerprint: "a".repeat(64),
           resources: { messages: ["C07JYF0U8BY"] },
+          ...RUN_COVERAGE_DECLARATION,
           runCoverageVersion: 1,
         },
       ],
     ] as const) {
       // biome-ignore lint/performance/noAwaitInLoops: each case is one isolated run against the same harness.
-      await assert.rejects(
-        runCollectorConnector({
-          baseUrl: harness.url,
-          connector: {
-            args: [fixture],
-            command: "node",
-            connector_id: "fixture-run-coverage-required",
-            protocol_capabilities: ["RUN_COVERAGE_V1"],
-            runtime_requirements: { bindings: {} },
-            streams: ["messages"],
-            ...evidence,
-          },
-          deviceId: "device-1",
-          deviceToken: "device-token",
-          executionRoot: TEST_EXECUTION_ROOT,
-          queuePath: await tempQueuePath(),
-          sourceInstanceId: "src-run-coverage-required",
-        }),
-        (error: unknown) => {
-          assert.ok(error instanceof RuntimeCapabilityMismatchError, label);
-          assert.deepEqual(error.missing, ["RUN_COVERAGE_V1"], label);
-          return true;
-        }
-      );
-      const spawned = await readFile(spawnedPath, "utf8").then(
-        () => true,
-        () => false
+      const result = await runCollectorConnector({
+        baseUrl: harness.url,
+        connector: {
+          args: [fixture],
+          command: "node",
+          connector_id: "fixture-run-coverage-required",
+          ...RUN_COVERAGE_DECLARATION,
+          runtime_requirements: { bindings: {} },
+          streams: ["messages"],
+          ...evidence,
+        },
+        deviceId: "device-1",
+        deviceToken: "device-token",
+        executionRoot: TEST_EXECUTION_ROOT,
+        queuePath: await tempQueuePath(),
+        sourceInstanceId: "src-run-coverage-required",
+      });
+      assert.equal(await readFile(spawnedPath, "utf8"), "spawned", `${label}: the connector started`);
+      const start = JSON.parse(await readFile(`${spawnedPath}.start`, "utf8")) as Record<string, unknown>;
+      assert.equal("run_coverage_version" in start, false, label);
+      assert.equal(result.done?.status, "succeeded", label);
+      const facts = harness.terminalCommits.at(-1)?.terminal_facts as Record<string, unknown>[] | undefined;
+      assert.equal(
+        facts?.some((fact) => Array.isArray(fact.stores)) ?? false,
+        false,
+        `${label}: no store evidence was recorded`
       );
-      assert.equal(spawned, false, `${label}: the connector never started`);
     }
-    assert.equal(harness.heartbeats.length, 0, "the refusal precedes the first heartbeat");
-    assert.equal(harness.terminalCommits.length, 0);
+    assert.equal(harness.terminalCommits.length, 2);
+  } finally {
+    await harness.close();
+  }
+});
+
+test("runCollectorConnector refuses coverage_stores without RUN_COVERAGE_V1 before spawn", async () => {
+  const harness = await startCollectorHarness({ priorState: {} });
+  try {
+    const spawnedPath = join(await createTempDir("pdpp-coverage-stores-capability-refused-"), "spawned");
+    const fixture = await writeEvidenceRequiringConnector(spawnedPath);
+    await assert.rejects(
+      runCollectorConnector({
+        baseUrl: harness.url,
+        connector: {
+          args: [fixture],
+          collectionProfileVersion: "0.2.0",
+          command: "node",
+          connector_id: "fixture-coverage-stores-capability-refused",
+          coverageStoreStreams: ["messages"],
+          declaresCoverageStores: true,
+          protocol_capabilities: [],
+          runtime_requirements: { bindings: {} },
+          streams: ["messages"],
+        },
+        deviceId: "device-1",
+        deviceToken: "device-token",
+        executionRoot: TEST_EXECUTION_ROOT,
+        queuePath: await tempQueuePath(),
+        sourceInstanceId: "src-coverage-stores-capability-refused",
+      }),
+      /coverage_stores requires protocol_capabilities RUN_COVERAGE_V1/
+    );
+    await assert.rejects(readFile(spawnedPath, "utf8"));
+    assert.equal(harness.heartbeats.length, 0);
+  } finally {
+    await harness.close();
+  }
+});
+
+test("runCollectorConnector refuses Collection Profile 0.3.0 before spawn", async () => {
+  const harness = await startCollectorHarness({ priorState: {} });
+  try {
+    const spawnedPath = join(await createTempDir("pdpp-profile-030-refused-"), "spawned");
+    const fixture = await writeEvidenceRequiringConnector(spawnedPath);
+    await assert.rejects(
+      runCollectorConnector({
+        baseUrl: harness.url,
+        connector: {
+          args: [fixture],
+          command: "node",
+          ...RUN_COVERAGE_DECLARATION,
+          collectionProfileVersion: "0.3.0",
+          connector_id: "fixture-profile-030-refused",
+          runCoverageVersion: 1,
+          runtime_requirements: { bindings: {} },
+          streams: ["messages"],
+        },
+        deviceId: "device-1",
+        deviceToken: "device-token",
+        executionRoot: TEST_EXECUTION_ROOT,
+        queuePath: await tempQueuePath(),
+        sourceInstanceId: "src-profile-030-refused",
+      }),
+      /protocol_version must be one of 0\.1\.0, 0\.2\.0/
+    );
+    await assert.rejects(readFile(spawnedPath, "utf8"));
+    assert.equal(harness.heartbeats.length, 0);
   } finally {
     await harness.close();
   }
@@ -1193,6 +1272,7 @@ test("runCollectorConnector runs a RUN_COVERAGE_V1 connector when its START requ
         connector_id: "fixture-run-coverage-required",
         manifestFingerprint: "a".repeat(64),
         protocol_capabilities: ["RUN_COVERAGE_V1"],
+        ...RUN_COVERAGE_DECLARATION,
         runCoverageVersion: 1,
         runtime_requirements: { bindings: {} },
         streams: ["messages"],
@@ -1235,6 +1315,7 @@ for (const includeState of [false, true]) {
           connector_id: "fixture-coverage-retirement",
           manifestFingerprint: "a".repeat(64),
           protocol_capabilities: [],
+          ...RUN_COVERAGE_DECLARATION,
           runCoverageVersion: 1,
           runtime_requirements: { bindings: {} },
           streams: ["messages"],
@@ -1357,14 +1438,23 @@ test("a pass that reuses an acknowledged run id commits no second terminal recor
 });
 
 for (const effectType of ["DETAIL_GAP", "DETAIL_COVERAGE"] as const) {
-  test(`runCollectorConnector refuses ${effectType} without durable detail accounting`, async () => {
+  test(`runCollectorConnector records no 0.2.0 positive when it cannot account for ${effectType}`, async () => {
     const harness = await startCollectorHarness({ priorState: {} });
     try {
+      const startPath = join(await createTempDir(`pdpp-${effectType.toLowerCase()}-start-`), "start.json");
       const fixture = await writeFixtureConnector({
         script: `
+          const fs = await import("node:fs/promises");
+          let input = "";
+          await new Promise((resolve) => process.stdin.on("data", (chunk) => {
+            input += chunk;
+            if (input.includes("\\n")) resolve();
+          }));
+          const start = JSON.parse(input.split("\\n")[0]);
+          await fs.writeFile(${JSON.stringify(startPath)}, JSON.stringify(start));
           process.stdout.write(JSON.stringify({ type: ${JSON.stringify(effectType)}, stream: "messages" }) + "\\n");
           process.stdout.write(JSON.stringify({ type: "DONE", status: "succeeded", records_emitted: 0,
-            coverage: { version: 1, collection_scope: "unscoped", streams: [{ stream: "messages", scoped: true,
+            coverage: { version: 1, collection_scope: start.collection_scope, streams: [{ stream: "messages", scoped: true,
               stores: [{ store: "messages", status: "collected" }] }] } }) + "\\n");
         `,
       });
@@ -1378,6 +1468,7 @@ for (const effectType of ["DETAIL_GAP", "DETAIL_COVERAGE"] as const) {
             connector_id: "fixture-detail-no-admission",
             manifestFingerprint: "a".repeat(64),
             protocol_capabilities: [],
+            ...RUN_COVERAGE_DECLARATION,
             runCoverageVersion: 1,
             runtime_requirements: { bindings: {} },
             streams: ["messages"],
@@ -1390,6 +1481,8 @@ for (const effectType of ["DETAIL_GAP", "DETAIL_COVERAGE"] as const) {
         }),
         new RegExp(`unsupported ${effectType}`)
       );
+      const start = JSON.parse(await readFile(startPath, "utf8")) as Record<string, unknown>;
+      assert.equal(start.run_coverage_version, 1, "the extension was requested for this 0.2.0 run");
       assert.equal(harness.terminalCommits.length, 0);
     } finally {
       await harness.close();
@@ -1441,6 +1534,7 @@ for (const effectType of ["DETAIL_GAP", "DETAIL_COVERAGE"] as const) {
             connector_id: `fixture-concrete-${effectType.toLowerCase()}`,
             manifestFingerprint: "a".repeat(64),
             protocol_capabilities: [],
+            ...RUN_COVERAGE_DECLARATION,
             runCoverageVersion: 1,
             runtime_requirements: { bindings: {} },
             streams: ["messages"],
@@ -1534,6 +1628,7 @@ test("runCollectorConnector refuses a collected assertion with mismatched emitte
           connector_id: "fixture-count-mismatch",
           manifestFingerprint: "a".repeat(64),
           protocol_capabilities: [],
+          ...RUN_COVERAGE_DECLARATION,
           runCoverageVersion: 1,
           runtime_requirements: { bindings: {} },
           streams: ["messages"],
@@ -4138,6 +4233,7 @@ test("a run with invalid provenance leaves a failure gap for its lane", async ()
             command: "node",
             connector_id: "fixture-provenance-barrier",
             protocol_capabilities: [],
+            ...RUN_COVERAGE_DECLARATION,
             runCoverageVersion: 1,
             runtime_requirements: { bindings: {} },
             streams: ["messages"],
diff --git a/packages/collector-runtime/src/collector-runner.ts b/packages/collector-runtime/src/collector-runner.ts
index 8623352ad..57159a652 100644
--- a/packages/collector-runtime/src/collector-runner.ts
+++ b/packages/collector-runtime/src/collector-runner.ts
@@ -30,6 +30,8 @@ import { delimiter, join } from "node:path";
 import { createInterface } from "node:readline";
 import type { EmittedMessage, RunCoverageVerdict, StartMessage, StreamScope } from "@pdpp/connector-protocol";
 import {
+  COLLECTION_PROFILE_VERSIONS,
+  collectionProfileDeclarationError,
   RUN_COVERAGE_V1_CAPABILITY,
   validateHostBlobMessage,
   validateStreamEvidenceCounts,
@@ -70,7 +72,6 @@ import {
   COLLECTOR_RUNTIME_CAPABILITIES,
   type ConnectorPlacementInput,
   type RuntimeBindingName,
-  type RuntimeCapabilityProfile,
 } from "./runtime-capabilities.ts";
 
 /**
@@ -618,10 +619,16 @@ interface CollectorConnectorSpecExtra {
   readonly args: readonly string[];
   /** Release identity of the executable used for this run. */
   readonly artifactDigest?: string;
+  /** Raw base profile version from the verified manifest, when one was loaded. */
+  readonly collectionProfileVersion?: unknown;
   /** Argv for the connector entrypoint (typically tsx + connector index.ts). */
   readonly command: string;
   /** Stable connector id used for ingest envelopes. */
   readonly connector_id: string;
+  /** Streams with a valid, non-empty manifest `coverage_stores` inventory. */
+  readonly coverageStoreStreams?: readonly string[];
+  /** True when any manifest stream declares a `coverage_stores` member. */
+  readonly declaresCoverageStores?: boolean;
   /**
    * Whether the connector declared it ENFORCES path roots at enumeration time.
    * Gates whether a roots boundary may be reported as `scoped` coverage; a
@@ -635,7 +642,7 @@ interface CollectorConnectorSpecExtra {
   readonly manifestFingerprint?: string;
   /** Optional stream resources for scoped connector runs. */
   readonly resources?: Readonly<Record<string, readonly string[]>>;
-  /** Set only when the pinned 0.3.0 manifest inventories every requested stream. */
+  /** Set only when an accepted base profile inventories every requested stream. */
   readonly runCoverageVersion?: 1;
   /**
    * The owner-declared collection boundary this run must stay inside, as
@@ -931,6 +938,14 @@ export async function runCollectorConnector(config: CollectorRunConfig): Promise
   try {
     // Preflight refusals are attempts for this lane too. They run inside the try
     // so the catch below opens the failure barrier for each of them.
+    const profileDeclarationError = collectionProfileDeclarationError(
+      config.connector.collectionProfileVersion ?? "0.1.0",
+      config.connector.protocol_capabilities,
+      config.connector.declaresCoverageStores === true
+    );
+    if (profileDeclarationError !== null) {
+      throw new Error(`Invalid Collection Profile declaration: ${profileDeclarationError}`);
+    }
     if (
       config.connector.runCoverageVersion === 1 &&
       !(
@@ -941,7 +956,7 @@ export async function runCollectorConnector(config: CollectorRunConfig): Promise
       throw new Error("optional store evidence requires a bound manifest fingerprint and artifact digest");
     }
     throwIfAborted(config.abortSignal);
-    const satisfiedBindings = assertPlacementOrThrow(config.connector, runtimeCapabilitiesForRun(config.connector));
+    const satisfiedBindings = assertPlacementOrThrow(config.connector, COLLECTOR_RUNTIME_CAPABILITIES);
 
     const initialSummary = outbox.summary({
       sourceInstanceId: config.sourceInstanceId,
@@ -1577,7 +1592,7 @@ function buildTypedTerminalCoverageFacts(input: {
       },
       scoped: stream.scoped,
       stores: stream.stores.map((store) =>
-        skipCount > 0 && store.status === "collected" ? { ...store, status: "partial" as const } : store
+        !detailComplete && store.status === "collected" ? { ...store, status: "partial" as const } : store
       ),
       stream: stream.stream,
     };
@@ -1776,7 +1791,7 @@ async function streamConnectorIntoOutbox(
     // ignore while the run still looks bounded.
     input.config.connector.enforcesSourceRoots === true ? resolveScopedSourceRoots(input.config.connector.scope) : [],
     collectorScopeFingerprint(input.config.connector.scope),
-    input.config.connector.runCoverageVersion
+    connectorRequestsRunCoverage(input.config.connector) ? 1 : undefined
   );
   const child = spawnConnector(
     input.config.connector,
@@ -2521,35 +2536,20 @@ function startStreamResources(resources: Readonly<Record<string, readonly string
  * {@link collectorScopeFingerprint} binds the time bound and the source roots,
  * not per-stream resources. A START that narrows a stream to named resources
  * would carry a scope string, often `unscoped`, without that restriction, and
- * Collection Profile Section 5.1 forbids that. Such a run requests no
- * evidence, so its terminal record reads unknown coverage.
- */
-function startRequestsRunCoverage(
-  streams: readonly string[],
-  resources: Readonly<Record<string, readonly string[]>>,
-  runCoverageVersion: 1 | undefined
-): boolean {
-  return runCoverageVersion === 1 && streams.every((stream) => startStreamResources(resources, stream).length === 0);
-}
-
-/**
- * The profile a run is placed against. The collector supports RUN_COVERAGE_V1
- * only for a run whose START requests store evidence; for any other run the
- * capability is withdrawn, so a connector that cannot run without the
- * evidence is refused before spawn (Collection Profile Section 3.4).
+ * the extension forbids that. The manifest must also declare RUN_COVERAGE_V1
+ * and a non-empty inventory for every requested stream.
  */
-function runtimeCapabilitiesForRun(connector: CollectorConnectorSpec): RuntimeCapabilityProfile {
-  if (startRequestsRunCoverage(connector.streams, connector.resources ?? {}, connector.runCoverageVersion)) {
-    return COLLECTOR_RUNTIME_CAPABILITIES;
-  }
-  return {
-    ...COLLECTOR_RUNTIME_CAPABILITIES,
-    protocolCapabilities: new Set(
-      [...COLLECTOR_RUNTIME_CAPABILITIES.protocolCapabilities].filter(
-        (capability) => capability !== RUN_COVERAGE_V1_CAPABILITY
-      )
-    ),
-  };
+function connectorRequestsRunCoverage(connector: CollectorConnectorSpec): boolean {
+  const profileVersion = connector.collectionProfileVersion ?? "0.1.0";
+  const coverageStoreStreams = new Set(connector.coverageStoreStreams ?? []);
+  return (
+    connector.runCoverageVersion === 1 &&
+    (COLLECTION_PROFILE_VERSIONS as readonly unknown[]).includes(profileVersion) &&
+    connector.protocol_capabilities.includes(RUN_COVERAGE_V1_CAPABILITY) &&
+    connector.streams.length > 0 &&
+    connector.streams.every((stream) => coverageStoreStreams.has(stream)) &&
+    connector.streams.every((stream) => startStreamResources(connector.resources ?? {}, stream).length === 0)
+  );
 }
 
 export function buildCollectorStartMessage(
@@ -2562,7 +2562,8 @@ export function buildCollectorStartMessage(
   collectionScope?: string,
   runCoverageVersion?: 1
 ): StartMessage {
-  const requestsCoverage = startRequestsRunCoverage(streams, resources, runCoverageVersion);
+  const requestsCoverage =
+    runCoverageVersion === 1 && streams.every((stream) => startStreamResources(resources, stream).length === 0);
   // A version 1 request binds its evidence to this string (Collection Profile
   // Section 5.1). Without one the proof would bind to no boundary.
   if (requestsCoverage && !collectionScope?.trim()) {
diff --git a/packages/collector-runtime/src/runtime-capabilities.test.ts b/packages/collector-runtime/src/runtime-capabilities.test.ts
index 29aa03fe7..5ca9e94cf 100644
--- a/packages/collector-runtime/src/runtime-capabilities.test.ts
+++ b/packages/collector-runtime/src/runtime-capabilities.test.ts
@@ -172,10 +172,10 @@ test("a declared OBSERVATION capability is a named missing capability, not a mal
   assert.equal(evaluatePlacement(observationConnector, observingRuntime).kind, "ok");
 });
 
-// Collection Profile Section 3.4: RUN_COVERAGE_V1 is required. The collector
-// runtime requests store collection evidence, so it advertises the capability.
-// The provider runtime does not, so it refuses a connector that declares it.
-test("a declared RUN_COVERAGE_V1 places on the collector runtime and is missing on the provider runtime", () => {
+// RUN_COVERAGE_V1 is an elective extension. The collector advertises it and
+// may request evidence; a runtime that does not advertise it still starts the
+// connector without evidence.
+test("a declared RUN_COVERAGE_V1 places on runtimes with or without the extension", () => {
   const evidenceConnector = {
     connector_id: "evidence-connector",
     protocol_capabilities: ["RUN_COVERAGE_V1" as const],
@@ -183,12 +183,7 @@ test("a declared RUN_COVERAGE_V1 places on the collector runtime and is missing
   assert.equal(COLLECTOR_RUNTIME_CAPABILITIES.protocolCapabilities.has("RUN_COVERAGE_V1"), true);
   assert.equal(PROVIDER_RUNTIME_CAPABILITIES.protocolCapabilities.has("RUN_COVERAGE_V1"), false);
   assert.deepEqual(evaluatePlacement(evidenceConnector, COLLECTOR_RUNTIME_CAPABILITIES), { kind: "ok", satisfied: [] });
-  assert.deepEqual(evaluatePlacement(evidenceConnector, PROVIDER_RUNTIME_CAPABILITIES), {
-    connectorId: "evidence-connector",
-    kind: "missing_capability",
-    missing: ["RUN_COVERAGE_V1"],
-    runtime: "provider",
-  });
+  assert.deepEqual(evaluatePlacement(evidenceConnector, PROVIDER_RUNTIME_CAPABILITIES), { kind: "ok", satisfied: [] });
 });
 
 test("boundary_claim remains optional and does not require a protocol capability", () => {
diff --git a/packages/collector-runtime/src/runtime-capabilities.ts b/packages/collector-runtime/src/runtime-capabilities.ts
index 9871c57e7..88299605a 100644
--- a/packages/collector-runtime/src/runtime-capabilities.ts
+++ b/packages/collector-runtime/src/runtime-capabilities.ts
@@ -77,10 +77,10 @@ export const PROVIDER_RUNTIME_CAPABILITIES: RuntimeCapabilityProfile = {
  * Also does NOT advertise `BLOB`: this collector has no durable host blob
  * transport. The runner rejects any BLOB line before it can accept a RECORD.
  *
- * Advertises `RUN_COVERAGE_V1`: the runner requests store collection evidence
- * in START and commits it in a version 2 terminal run record. A run whose
- * START requests none is placed against this profile without the capability
- * (`collector-runner.ts`), so it refuses a connector that declares it.
+ * Advertises `RUN_COVERAGE_V1`: the runner may request store collection
+ * evidence in START and commit it in a version 2 terminal run record. The
+ * capability is elective, so a run that cannot request evidence still starts
+ * without it.
  */
 export const COLLECTOR_RUNTIME_CAPABILITIES: RuntimeCapabilityProfile = {
   bindings: new Set<RuntimeBindingName>(["network", "browser", "filesystem", "local_device"]),
diff --git a/packages/connector-protocol/README.md b/packages/connector-protocol/README.md
index 1b062b219..ea71aa0d8 100644
--- a/packages/connector-protocol/README.md
+++ b/packages/connector-protocol/README.md
@@ -64,16 +64,21 @@ arrives as `unknown` JSON.
 Connectors declare protocol capabilities with `protocol_capabilities`. The
 runtime advertises `protocolVersion` and `protocolCapabilities`, and rejects
 unknown names and missing required capabilities before spawning a connector
-(`unsupportedRequiredProtocolCapabilities`). `DETAIL_COVERAGE_KEY_SETS` is
-advisory: a runtime that does not advertise it still starts the connector.
-`RUN_COVERAGE_V1` is a required capability when a connector declares it. A
-manifest `protocol_version` is the Collection Profile version, `0.1.0`,
-`0.2.0`, or `0.3.0`; a manifest that declares `DETAIL_COVERAGE_KEY_SETS` or
-`OBSERVATION` declares `0.2.0`, and one that declares `RUN_COVERAGE_V1`
-declares `0.3.0` (`collectionProfileDeclarationError`). The collector requests
-`START.run_coverage_version` only for a pinned `0.3.0` profile when every
-requested stream declares a non-empty `coverage_stores` inventory. `SKIP_RESULT.boundary_claim` is optional, does not require a
-protocol capability, and is disclosure-only: it never affects, reduces, or
+(`unsupportedRequiredProtocolCapabilities`). `DETAIL_COVERAGE_KEY_SETS` and
+`RUN_COVERAGE_V1` are elective: a runtime that does not advertise either still
+starts the connector. Store evidence is a separately versioned extension
+(`coverage.version: 1`) that applies to base profiles `0.1.0`, `0.2.0`, and
+`0.3.0`; declaring `RUN_COVERAGE_V1` does not make a runtime conformant to a
+base profile it does not implement. This runtime accepts base profiles `0.1.0`
+and `0.2.0`, and refuses `0.3.0` until it implements the full profile. A
+manifest that declares `DETAIL_COVERAGE_KEY_SETS` or `OBSERVATION` must use
+base profile `0.2.0` on this runtime, while a stream that declares `coverage_stores` must also
+declare `RUN_COVERAGE_V1` (`collectionProfileDeclarationError`). The collector
+requests `START.run_coverage_version` only when the manifest declares the
+extension, uses a supported base profile, inventories every requested stream,
+and the effective scope is bound in `collection_scope`.
+`SKIP_RESULT.boundary_claim` is optional, does not require a protocol
+capability, and is disclosure-only: it never affects, reduces, or
 excludes anything from the servable denominator, coverage calculation, or
 connection/system health rollup, even when an independently recorded
 coverage horizon agrees with it.
diff --git a/packages/connector-protocol/src/connector-runtime-protocol.test.ts b/packages/connector-protocol/src/connector-runtime-protocol.test.ts
index a4ac5745e..ece63a74a 100644
--- a/packages/connector-protocol/src/connector-runtime-protocol.test.ts
+++ b/packages/connector-protocol/src/connector-runtime-protocol.test.ts
@@ -346,23 +346,22 @@ test("the capability vocabulary knows DETAIL_COVERAGE_KEY_SETS and OBSERVATION",
   ]);
 });
 
-// RUN_COVERAGE_V1 remains a known required capability when a connector
-// declares it; profile 0.3.0 does not require every connector to declare it.
-test("RUN_COVERAGE_V1 is a known, required capability", () => {
+// RUN_COVERAGE_V1 is an elective extension. A runtime that lacks it still
+// starts the connector and omits store evidence for the run.
+test("RUN_COVERAGE_V1 is known and elective", () => {
   assert.equal(isConnectorProtocolCapabilityArray(["RUN_COVERAGE_V1"]), true);
-  assert.deepEqual(unsupportedRequiredProtocolCapabilities(["RUN_COVERAGE_V1"], []), ["RUN_COVERAGE_V1"]);
+  assert.deepEqual(unsupportedRequiredProtocolCapabilities(["RUN_COVERAGE_V1"], []), []);
   assert.deepEqual(unsupportedRequiredProtocolCapabilities(["RUN_COVERAGE_V1"], ["RUN_COVERAGE_V1"]), []);
 });
 
-// Section 3.4: a runtime that does not advertise DETAIL_COVERAGE_KEY_SETS
-// still starts a connector that declares it. Every other declared capability
+// Elective capabilities never block spawn. Every other declared capability
 // is required: a runtime that does not advertise it must not start the
 // connector.
-test("an advisory capability is never unsupported; a required one is unsupported unless advertised", () => {
+test("elective capabilities never block spawn; a required one needs advertisement", () => {
   assert.deepEqual(unsupportedRequiredProtocolCapabilities(["DETAIL_COVERAGE_KEY_SETS"], []), []);
   assert.deepEqual(
     unsupportedRequiredProtocolCapabilities(
-      ["DETAIL_COVERAGE_KEY_SETS", "OBSERVATION", "STREAM_EVIDENCE", "BLOB"],
+      ["DETAIL_COVERAGE_KEY_SETS", "RUN_COVERAGE_V1", "OBSERVATION", "STREAM_EVIDENCE", "BLOB"],
       new Set(["STREAM_EVIDENCE"] as const)
     ),
     ["OBSERVATION", "BLOB"]
@@ -371,22 +370,22 @@ test("an advisory capability is never unsupported; a required one is unsupported
   assert.deepEqual(unsupportedRequiredProtocolCapabilities([], []), []);
 });
 
-// Section 3.1: protocol_version is the Collection Profile version, not
-// CONNECTOR_PROTOCOL_VERSION. RUN_COVERAGE_V1 is only valid in 0.3.0.
-test("collectionProfileDeclarationError accepts profile versions and gates capabilities by version", () => {
-  assert.deepEqual([...COLLECTION_PROFILE_VERSIONS], ["0.1.0", "0.2.0", "0.3.0"]);
+// protocol_version names the supported base profile; RUN_COVERAGE_V1 is an
+// elective extension over either accepted base.
+test("collectionProfileDeclarationError gates base versions and coverage declarations", () => {
+  assert.deepEqual([...COLLECTION_PROFILE_VERSIONS], ["0.1.0", "0.2.0"]);
   assert.equal(collectionProfileDeclarationError("0.1.0", undefined), null);
   assert.equal(collectionProfileDeclarationError("0.1.0", []), null);
   assert.equal(collectionProfileDeclarationError("0.1.0", ["STREAM_EVIDENCE", "BLOB"]), null);
+  assert.equal(collectionProfileDeclarationError("0.1.0", ["RUN_COVERAGE_V1"], true), null);
   assert.equal(collectionProfileDeclarationError("0.2.0", undefined), null);
   assert.equal(collectionProfileDeclarationError("0.2.0", ["DETAIL_COVERAGE_KEY_SETS", "OBSERVATION"]), null);
   assert.equal(collectionProfileDeclarationError("0.2.0", ["STREAM_EVIDENCE"]), null);
-  assert.equal(collectionProfileDeclarationError("0.3.0", ["RUN_COVERAGE_V1"]), null);
-  assert.equal(collectionProfileDeclarationError("0.3.0", []), null);
+  assert.equal(collectionProfileDeclarationError("0.2.0", ["RUN_COVERAGE_V1"], true), null);
+  assert.match(String(collectionProfileDeclarationError("0.3.0", ["RUN_COVERAGE_V1"])), /protocol_version/);
   assert.match(String(collectionProfileDeclarationError("0.1.0", ["DETAIL_COVERAGE_KEY_SETS"])), /0\.2\.0/);
   assert.match(String(collectionProfileDeclarationError("0.1.0", ["OBSERVATION"])), /OBSERVATION/);
-  assert.match(String(collectionProfileDeclarationError("0.1.0", ["RUN_COVERAGE_V1"])), /0\.3\.0/);
-  assert.match(String(collectionProfileDeclarationError("0.2.0", ["RUN_COVERAGE_V1"])), /0\.3\.0/);
+  assert.match(String(collectionProfileDeclarationError("0.1.0", [], true)), /coverage_stores.*RUN_COVERAGE_V1/);
   assert.match(String(collectionProfileDeclarationError(undefined, [])), /protocol_version/);
   assert.match(String(collectionProfileDeclarationError("0.2.0", ["FORGED"])), /protocol_capabilities/);
   assert.match(String(collectionProfileDeclarationError("0.2.0", null)), /protocol_capabilities/);
diff --git a/packages/connector-protocol/src/connector-runtime-protocol.ts b/packages/connector-protocol/src/connector-runtime-protocol.ts
index 7ec73afc5..82c0ce947 100644
--- a/packages/connector-protocol/src/connector-runtime-protocol.ts
+++ b/packages/connector-protocol/src/connector-runtime-protocol.ts
@@ -115,7 +115,7 @@ export const DETAIL_COVERAGE_KEY_SETS_CAPABILITY = "DETAIL_COVERAGE_KEY_SETS" as
 /** Capability required by a connector that emits OBSERVATION (Collection Profile 0.2.0, Section 5.10). */
 export const OBSERVATION_CAPABILITY = "OBSERVATION" as const;
 
-/** Store collection evidence that a connector may require for a run. */
+/** Optional store collection evidence a connector may request for a run. */
 export const RUN_COVERAGE_V1_CAPABILITY = "RUN_COVERAGE_V1" as const;
 
 /** Protocol capabilities that can be advertised by a connector or runtime. */
@@ -145,11 +145,15 @@ export const CONNECTOR_PROTOCOL_CAPABILITIES: readonly ConnectorProtocolCapabili
 
 /**
  * Capabilities a runtime need not advertise to start a connector that
- * declares them (Collection Profile Section 3.4). Every other declared
- * capability is required.
+ * declares them. RUN_COVERAGE_V1 is an elective extension: a runtime that
+ * does not support it starts the connector without requesting or recording
+ * store evidence. DETAIL_COVERAGE_KEY_SETS has the same non-blocking spawn
+ * rule under Collection Profile Section 3.4. Every other declared capability
+ * is required.
  */
-const ADVISORY_CONNECTOR_PROTOCOL_CAPABILITIES: readonly ConnectorProtocolCapability[] = [
+export const ELECTIVE_CONNECTOR_PROTOCOL_CAPABILITIES: readonly ConnectorProtocolCapability[] = [
   DETAIL_COVERAGE_KEY_SETS_CAPABILITY,
+  RUN_COVERAGE_V1_CAPABILITY,
 ];
 
 function isConnectorProtocolCapability(value: unknown): value is ConnectorProtocolCapability {
@@ -172,7 +176,7 @@ export function isConnectorProtocolCapabilityArray(value: unknown): value is rea
 
 /**
  * The declared capabilities a runtime that advertises `advertised` cannot
- * satisfy, in declaration order. An advisory capability is never in the
+ * satisfy, in declaration order. An elective capability is never in the
  * result. A runtime MUST NOT start a connector for which this is non-empty
  * (Collection Profile Sections 3.4 and 4).
  */
@@ -182,17 +186,17 @@ export function unsupportedRequiredProtocolCapabilities(
 ): ConnectorProtocolCapability[] {
   const supported = new Set<ConnectorProtocolCapability>(advertised);
   return declared.filter(
-    (capability) => !(supported.has(capability) || ADVISORY_CONNECTOR_PROTOCOL_CAPABILITIES.includes(capability))
+    (capability) => !(supported.has(capability) || ELECTIVE_CONNECTOR_PROTOCOL_CAPABILITIES.includes(capability))
   );
 }
 
 /**
  * Collection Profile versions a manifest `protocol_version` may name
- * (Collection Profile Sections 3.1 and 8). This is the profile version. It is
+ * (Collection Profile Sections 3.1 and 8). This is the base profile version. It is
  * independent of {@link CONNECTOR_PROTOCOL_VERSION} and of the Core
  * SourceDeclaration `protocol_version`, which Core fixes at 0.1.0.
  */
-export const COLLECTION_PROFILE_VERSIONS = ["0.1.0", "0.2.0", "0.3.0"] as const;
+export const COLLECTION_PROFILE_VERSIONS = ["0.1.0", "0.2.0"] as const;
 
 /** Capabilities that Collection Profile 0.2.0 adds (Section 8). */
 const PROFILE_0_2_0_CAPABILITIES: readonly ConnectorProtocolCapability[] = [
@@ -200,20 +204,20 @@ const PROFILE_0_2_0_CAPABILITIES: readonly ConnectorProtocolCapability[] = [
   OBSERVATION_CAPABILITY,
 ];
 
-/** Capabilities that Collection Profile 0.3.0 adds. */
-const PROFILE_0_3_0_CAPABILITIES: readonly ConnectorProtocolCapability[] = [RUN_COVERAGE_V1_CAPABILITY];
-
 /**
  * Why a manifest's `protocol_version` and `protocol_capabilities` are not a
  * valid Collection Profile declaration, or null when they are. An absent
  * (`undefined`) capability list declares none. The version must be one of
  * {@link COLLECTION_PROFILE_VERSIONS}, every capability name must be known,
- * and a manifest that declares a capability added in 0.2.0 or 0.3.0 must use
- * that profile version or later (Section 3.1).
+ * and a manifest that declares a capability added in 0.2.0 must use that
+ * profile version or later (Section 3.1). RUN_COVERAGE_V1 is an optional
+ * extension independent of the base profile version. A manifest that declares
+ * `coverage_stores` must also declare RUN_COVERAGE_V1.
  */
 export function collectionProfileDeclarationError(
   protocolVersion: unknown,
-  protocolCapabilities: unknown
+  protocolCapabilities: unknown,
+  coverageStoresDeclared = false
 ): string | null {
   if (!(COLLECTION_PROFILE_VERSIONS as readonly unknown[]).includes(protocolVersion)) {
     return `protocol_version must be one of ${COLLECTION_PROFILE_VERSIONS.join(", ")}, received ${String(protocolVersion)}`;
@@ -226,9 +230,8 @@ export function collectionProfileDeclarationError(
   if (protocolVersion === "0.1.0" && profile020Only.length > 0) {
     return `protocol_capabilities ${profile020Only.join(", ")} require protocol_version 0.2.0`;
   }
-  const profile030Only = declared.filter((capability) => PROFILE_0_3_0_CAPABILITIES.includes(capability));
-  if (protocolVersion !== "0.3.0" && profile030Only.length > 0) {
-    return `protocol_capabilities ${profile030Only.join(", ")} require protocol_version 0.3.0`;
+  if (coverageStoresDeclared && !declared.includes(RUN_COVERAGE_V1_CAPABILITY)) {
+    return "coverage_stores requires protocol_capabilities RUN_COVERAGE_V1";
   }
   return null;
 }
diff --git a/packages/local-collector/bin/pdpp-local-collector.ts b/packages/local-collector/bin/pdpp-local-collector.ts
index aab0ffc7e..382900745 100644
--- a/packages/local-collector/bin/pdpp-local-collector.ts
+++ b/packages/local-collector/bin/pdpp-local-collector.ts
@@ -38,6 +38,12 @@ import {
 import { homedir } from "node:os";
 import { basename, dirname, extname, isAbsolute, join, relative, sep } from "node:path";
 import { fileURLToPath } from "node:url";
+import {
+  collectionProfileDeclarationError,
+  isConnectorProtocolCapabilityArray,
+  RUN_COVERAGE_V1_CAPABILITY,
+  type ConnectorProtocolCapability,
+} from "@pdpp/connector-protocol";
 import {
   buildConnectScopeRequest,
   type ConnectScopeChoice,
@@ -3275,28 +3281,50 @@ export async function prepareConnectorSpec(
   return spec;
 }
 
-/** Request store evidence only for a verified 0.3.0 profile with complete selected inventories. */
+/** Bind the elective evidence extension to a supported base and verified manifest inventory. */
 export function bindOptionalRunCoverageToRelease(
   spec: CollectorConnectorSpec,
   pin: Pick<CollectionProfilePin, "digest">,
   rawProfile: unknown
 ): CollectorConnectorSpec {
   if (!rawProfile || typeof rawProfile !== "object" || Array.isArray(rawProfile)) return spec;
-  const profile = rawProfile as { protocol_version?: unknown; streams?: unknown };
-  if (profile.protocol_version !== "0.3.0" || !Array.isArray(profile.streams)) return spec;
+  const profile = rawProfile as { protocol_capabilities?: unknown; protocol_version?: unknown; streams?: unknown };
+  const profileVersion = profile.protocol_version === undefined ? "0.1.0" : profile.protocol_version;
+  const rawCapabilities = profile.protocol_capabilities === undefined ? [] : profile.protocol_capabilities;
+  const capabilities = isConnectorProtocolCapabilityArray(rawCapabilities) ? rawCapabilities : [];
+  const profileStreams = Array.isArray(profile.streams) ? profile.streams : [];
+  const declaresCoverageStores = profileStreams.some(
+    (stream) => stream !== null && typeof stream === "object" && !Array.isArray(stream) && Object.hasOwn(stream, "coverage_stores")
+  );
+  const baseSpec: CollectorConnectorSpec = {
+    ...spec,
+    collectionProfileVersion: profileVersion,
+    declaresCoverageStores,
+    protocol_capabilities: rawCapabilities as readonly ConnectorProtocolCapability[],
+  };
+  if (!Array.isArray(profile.streams)) return baseSpec;
   const inventory = new Map<string, readonly string[]>();
   for (const value of profile.streams) {
-    if (!value || typeof value !== "object" || Array.isArray(value)) return spec;
+    if (!value || typeof value !== "object" || Array.isArray(value)) return { ...baseSpec, coverageStoreStreams: [...inventory.keys()] };
     const stream = value as { name?: unknown; coverage_stores?: unknown };
-    if (typeof stream.name !== "string" || inventory.has(stream.name)) return spec;
+    if (typeof stream.name !== "string" || inventory.has(stream.name)) {
+      return { ...baseSpec, coverageStoreStreams: [...inventory.keys()] };
+    }
     if (Array.isArray(stream.coverage_stores) && stream.coverage_stores.length > 0 &&
       stream.coverage_stores.every((store) => typeof store === "string" && store.trim())) {
       inventory.set(stream.name, stream.coverage_stores as readonly string[]);
     }
   }
-  if (!spec.streams.every((stream) => inventory.has(stream))) return spec;
+  const coverageSpec = { ...baseSpec, coverageStoreStreams: [...inventory.keys()] };
+  if (
+    collectionProfileDeclarationError(profileVersion, rawCapabilities, declaresCoverageStores) !== null ||
+    !capabilities.includes(RUN_COVERAGE_V1_CAPABILITY) ||
+    !spec.streams.every((stream) => inventory.has(stream))
+  ) {
+    return coverageSpec;
+  }
   return {
-    ...spec,
+    ...coverageSpec,
     artifactDigest: pin.digest,
     manifestFingerprint: hashCanonicalJson(rawProfile),
     runCoverageVersion: 1,
diff --git a/packages/local-collector/test/collection-profiles.test.ts b/packages/local-collector/test/collection-profiles.test.ts
index 8ad59c7c8..fbdca4beb 100644
--- a/packages/local-collector/test/collection-profiles.test.ts
+++ b/packages/local-collector/test/collection-profiles.test.ts
@@ -298,11 +298,12 @@ test("prepareConnectorSpec installs the pinned profile before a pinned connector
   );
 });
 
-test("a 0.3.0 manifest with inventories for requested streams requests store evidence", () => {
+test("a 0.2.0 profile with RUN_COVERAGE_V1 and inventories requests store evidence", () => {
   const spec = buildConnectorSpec(parseArgs([...RUN_ARGS, "--connector", "codex", "--streams", "messages,sessions"]));
   const pin = { digest: `sha256:${"a".repeat(64)}` };
   const profile = {
-    protocol_version: "0.3.0",
+    protocol_capabilities: ["RUN_COVERAGE_V1"],
+    protocol_version: "0.2.0",
     streams: [
       { name: "messages", coverage_stores: ["messages"], obligation: "content" },
       { name: "sessions", coverage_stores: ["sessions"], obligation: "content" },
@@ -316,26 +317,42 @@ test("a 0.3.0 manifest with inventories for requested streams requests store evi
     bindOptionalRunCoverageToRelease(spec, pin, { ...profile, streams: [{ ...profile.streams[0], obligation: "metadata" }, profile.streams[1]] }).manifestFingerprint);
 });
 
-test("a 0.2.0 manifest does not request store evidence even with inventories", () => {
+test("a 0.1.0 profile with RUN_COVERAGE_V1 and inventories requests store evidence", () => {
   const spec = buildConnectorSpec(parseArgs([...RUN_ARGS, "--connector", "codex", "--streams", "messages"]));
   const pin = { digest: `sha256:${"a".repeat(64)}` };
   const profile = {
-    protocol_version: "0.2.0",
+    protocol_capabilities: ["RUN_COVERAGE_V1"],
+    protocol_version: "0.1.0",
     streams: [{ name: "messages", coverage_stores: ["messages"], obligation: "content" }],
   };
-  assert.equal(bindOptionalRunCoverageToRelease(spec, pin, profile).runCoverageVersion, undefined);
+  const selected = bindOptionalRunCoverageToRelease(spec, pin, profile);
+  assert.equal(selected.runCoverageVersion, 1);
+  assert.equal(selected.protocol_capabilities[0], "RUN_COVERAGE_V1");
 });
 
-test("a 0.3.0 manifest does not request store evidence when a requested stream lacks inventory", () => {
+test("RUN_COVERAGE_V1 without a requested stream inventory does not request evidence", () => {
   const spec = buildConnectorSpec(parseArgs([...RUN_ARGS, "--connector", "codex", "--streams", "messages,sessions"]));
   const pin = { digest: `sha256:${"a".repeat(64)}` };
   const profile = {
-    protocol_version: "0.3.0",
+    protocol_capabilities: ["RUN_COVERAGE_V1"],
+    protocol_version: "0.2.0",
     streams: [{ name: "messages", coverage_stores: ["messages"], obligation: "content" }, { name: "sessions" }],
   };
   assert.equal(bindOptionalRunCoverageToRelease(spec, pin, profile).runCoverageVersion, undefined);
 });
 
+test("a manifest without RUN_COVERAGE_V1 requests no store evidence", () => {
+  const spec = buildConnectorSpec(parseArgs([...RUN_ARGS, "--connector", "codex", "--streams", "messages"]));
+  const pin = { digest: `sha256:${"a".repeat(64)}` };
+  const profile = {
+    protocol_version: "0.1.0",
+    streams: [{ name: "messages" }],
+  };
+  const selected = bindOptionalRunCoverageToRelease(spec, pin, profile);
+  assert.equal(selected.runCoverageVersion, undefined);
+  assert.deepEqual(selected.protocol_capabilities, []);
+});
+
 test("prepareConnectorSpec installs nothing for a custom --command", async () => {
   const previous = process.env[ALLOW_CUSTOM_COMMAND_ENV];
   process.env[ALLOW_CUSTOM_COMMAND_ENV] = "1";
diff --git a/packages/local-collector/test/selected-collection-release.test.ts b/packages/local-collector/test/selected-collection-release.test.ts
index 474a4c2db..02644f4e6 100644
--- a/packages/local-collector/test/selected-collection-release.test.ts
+++ b/packages/local-collector/test/selected-collection-release.test.ts
@@ -29,7 +29,8 @@ function sha256(bytes: Buffer): string {
 
 const PROFILE = {
   connector_id: "fixture_connector",
-  protocol_version: "0.3.0",
+  protocol_capabilities: ["RUN_COVERAGE_V1"],
+  protocol_version: "0.2.0",
   streams: [{ coverage_stores: ["messages_store"], name: "messages" }],
 };
 const ENTRYPOINT = Buffer.from("export {};\n");
diff --git a/reference-implementation/runtime/index.ts b/reference-implementation/runtime/index.ts
index 80bee13d3..155c86740 100644
--- a/reference-implementation/runtime/index.ts
+++ b/reference-implementation/runtime/index.ts
@@ -16,6 +16,7 @@ import { join as joinPath } from "node:path";
 import { DatabaseSync } from "node:sqlite";
 import {
   type ConnectorProtocolCapability,
+  collectionProfileDeclarationError,
   DETAIL_COVERAGE_KEY_SETS_CAPABILITY,
   HOST_BLOB_CAPABILITY,
   isConnectorProtocolCapabilityArray,
@@ -2618,7 +2619,7 @@ const SPAWN_TOLERATED_PROTOCOL_CAPABILITIES: readonly ConnectorProtocolCapabilit
  * absent `protocol_capabilities` declares none. A malformed list or an unknown
  * name fails closed, and so does a required capability this runtime does not
  * implement, except BLOB (see SPAWN_TOLERATED_PROTOCOL_CAPABILITIES). An
- * advisory capability never blocks the run.
+ * elective capability never blocks the run.
  */
 function validateRequiredProtocolCapabilities(manifest: ConnectorManifest): void {
   const declared = manifest.protocol_capabilities === undefined ? [] : manifest.protocol_capabilities;
@@ -2636,6 +2637,22 @@ function validateRequiredProtocolCapabilities(manifest: ConnectorManifest): void
   }
 }
 
+/** Reject unsupported base profiles and incomplete store-evidence declarations before spawn. */
+function validateCollectionProfileDeclaration(manifest: ConnectorManifest): void {
+  const streams = Array.isArray(manifest.streams) ? manifest.streams : [];
+  const coverageStoresDeclared = streams.some(
+    (stream) => stream !== null && typeof stream === "object" && !Array.isArray(stream) && Object.hasOwn(stream, "coverage_stores")
+  );
+  const error = collectionProfileDeclarationError(
+    manifest.protocol_version === undefined ? "0.1.0" : manifest.protocol_version,
+    manifest.protocol_capabilities,
+    coverageStoresDeclared
+  );
+  if (error !== null) {
+    throw new Error(`Invalid Collection Profile declaration: ${error}`);
+  }
+}
+
 function validateRequiredRuntimeBindings(
   requiredBindings: Record<string, { required?: boolean }>,
   availableBindings: AvailableBindings
@@ -3058,6 +3075,7 @@ export async function runConnector(opts: RuntimeRunConnectorOptions): Promise<Ru
   const availableBindings = buildAvailableBindings(onInteraction);
 
   validateRequiredRuntimeBindings(requiredBindings, availableBindings);
+  validateCollectionProfileDeclaration(manifest);
   validateRequiredProtocolCapabilities(manifest);
 
   const explicitlyRequestedStreams = requestedRuntimeStreams(providedScope);
diff --git a/reference-implementation/server/connector-manifest-validation.ts b/reference-implementation/server/connector-manifest-validation.ts
index b2213ea93..8a05c2e79 100644
--- a/reference-implementation/server/connector-manifest-validation.ts
+++ b/reference-implementation/server/connector-manifest-validation.ts
@@ -186,14 +186,20 @@ export function invalidConnectorManifest(message: string, code = "invalid_reques
 /**
  * Collection Profile declaration gate (profile Sections 3.1 and 3.4):
  * `protocol_version` names a supported profile version, every
- * `protocol_capabilities` name is known, and a capability added in 0.2.0
- * comes with `protocol_version` 0.2.0. This server has always admitted a
- * manifest without `protocol_version`; it is checked as a 0.1.0 manifest.
+ * `protocol_capabilities` name is known, a capability added in 0.2.0 comes
+ * with `protocol_version` 0.2.0, and any stream with `coverage_stores` also
+ * declares the elective RUN_COVERAGE_V1 extension. This server has always
+ * admitted a manifest without `protocol_version`; it is checked as 0.1.0.
  */
 function validateCollectionProfileDeclaration(manifest: Record<string, unknown>, code: string): void {
+  const streams = Array.isArray(manifest.streams) ? manifest.streams : [];
+  const coverageStoresDeclared = streams.some(
+    (stream) => stream !== null && typeof stream === "object" && !Array.isArray(stream) && Object.hasOwn(stream, "coverage_stores")
+  );
   const error = collectionProfileDeclarationError(
     manifest.protocol_version === undefined ? "0.1.0" : manifest.protocol_version,
-    manifest.protocol_capabilities
+    manifest.protocol_capabilities,
+    coverageStoresDeclared
   );
   if (error !== null) {
     throw invalidConnectorManifest(error, code);
diff --git a/reference-implementation/test/connector-manifest-validation.test.ts b/reference-implementation/test/connector-manifest-validation.test.ts
index 3f267fc74..7a0510f9f 100644
--- a/reference-implementation/test/connector-manifest-validation.test.ts
+++ b/reference-implementation/test/connector-manifest-validation.test.ts
@@ -39,8 +39,8 @@ const TOP_LEVEL_REGEX_27 =
   /capabilities\.proven\.local_collector=true requires runtime_requirements\.bindings\.filesystem/;
 const TOP_LEVEL_REGEX_28 = /credential_capture field 'password' is a secret field .* with no label/;
 const TOP_LEVEL_REGEX_29 = /credential_capture field 'password' is a secret field with zero env aliases/;
-const PROFILE_VERSION_PATTERN = /protocol_version must be one of 0\.1\.0, 0\.2\.0, 0\.3\.0, received 0\.4\.0/;
-const PROFILE_0_3_0_CAPABILITY_PATTERN = /protocol_capabilities RUN_COVERAGE_V1 require protocol_version 0\.3\.0/;
+const PROFILE_VERSION_PATTERN = /protocol_version must be one of 0\.1\.0, 0\.2\.0, received 0\.4\.0/;
+const COVERAGE_STORES_CAPABILITY_PATTERN = /coverage_stores requires protocol_capabilities RUN_COVERAGE_V1/;
 const PROFILE_0_2_0_CAPABILITY_PATTERN = /protocol_capabilities DETAIL_COVERAGE_KEY_SETS require protocol_version 0\.2\.0/;
 const UNKNOWN_CAPABILITY_PATTERN = /protocol_capabilities must be an array of known capability names/;
 
@@ -218,34 +218,29 @@ test("validateBlobRefSchemaDeclaration rejects non-object, missing props, wrong
   assert.throws(() => validateBlobRefSchemaDeclaration(stream, noRequired, "invalid_request"), TOP_LEVEL_REGEX_5);
 });
 
-// Collection Profile Sections 3.1 and 3.4 at registration: 0.1.0, 0.2.0 or
-// 0.3.0, known capability names, a 0.2.0 capability only at 0.2.0 or later,
-// and RUN_COVERAGE_V1 only at 0.3.0. A manifest
-// without protocol_version is checked as 0.1.0. The stored-manifest read path
-// skips this check so a manifest already stored stays readable.
-test("validateConnectorManifest enforces the Collection Profile declaration at registration only", () => {
+// The runtime refuses 0.3.0 until it implements the whole profile. RUN_COVERAGE_V1
+// remains an elective extension over supported 0.1.0/0.2.0 bases, and any
+// coverage_stores declaration requires that capability. The stored-manifest
+// read path skips this registration check so existing rows stay readable.
+test("validateConnectorManifest refuses 0.3.0 until the whole profile is implemented", () => {
   const keySets = { protocol_capabilities: ["DETAIL_COVERAGE_KEY_SETS"] };
   assert.doesNotThrow(() =>
     validateConnectorManifest({ ...manifestWithStream(), ...keySets, protocol_version: "0.2.0" })
   );
   assert.doesNotThrow(() => validateConnectorManifest({ ...manifestWithStream(), protocol_capabilities: ["BLOB"] }));
-  assert.doesNotThrow(() =>
-    validateConnectorManifest({
-      ...manifestWithStream(),
-      protocol_capabilities: ["RUN_COVERAGE_V1"],
-      protocol_version: "0.3.0",
-    })
-  );
   const rejected: [Record<string, unknown>, RegExp][] = [
     [{ protocol_version: "0.4.0" }, PROFILE_VERSION_PATTERN],
-    [{ protocol_capabilities: ["RUN_COVERAGE_V1"], protocol_version: "0.2.0" }, PROFILE_0_3_0_CAPABILITY_PATTERN],
+    [{ protocol_version: "0.3.0" }, /protocol_version must be one of 0\.1\.0, 0\.2\.0/],
     [{ ...keySets, protocol_version: "0.1.0" }, PROFILE_0_2_0_CAPABILITY_PATTERN],
     [keySets, PROFILE_0_2_0_CAPABILITY_PATTERN],
     [{ protocol_capabilities: ["FORGED"], protocol_version: "0.2.0" }, UNKNOWN_CAPABILITY_PATTERN],
     [{ protocol_capabilities: null, protocol_version: "0.2.0" }, UNKNOWN_CAPABILITY_PATTERN],
   ];
   for (const [fields, pattern] of rejected) {
-    const manifest = { ...manifestWithStream(), ...fields };
+    const manifest = {
+      ...manifestWithStream(),
+      ...fields,
+    };
     assert.throws(() => validateConnectorManifest(manifest), pattern, JSON.stringify(fields));
     assert.doesNotThrow(
       () => validateConnectorManifest(manifest, "connector_invalid", { skipCollectionProfileCheck: true }),
@@ -254,6 +249,25 @@ test("validateConnectorManifest enforces the Collection Profile declaration at r
   }
 });
 
+test("validateConnectorManifest refuses coverage_stores without RUN_COVERAGE_V1 at registration", () => {
+  const manifest = {
+    ...manifestWithStream({ coverage_stores: ["messages"] }),
+    protocol_capabilities: [],
+    protocol_version: "0.2.0",
+  };
+  assert.throws(() => validateConnectorManifest(manifest), COVERAGE_STORES_CAPABILITY_PATTERN);
+});
+
+test("validateConnectorManifest accepts coverage_stores with RUN_COVERAGE_V1 on base profile 0.2.0", () => {
+  assert.doesNotThrow(() =>
+    validateConnectorManifest({
+      ...manifestWithStream({ coverage_stores: ["messages"] }),
+      protocol_capabilities: ["RUN_COVERAGE_V1"],
+      protocol_version: "0.2.0",
+    })
+  );
+});
+
 test("validateConnectorManifest accepts valid stream evidence declarations", () => {
   assert.doesNotThrow(() =>
     validateConnectorManifest(
diff --git a/reference-implementation/test/detail-coverage-shortfall-severity.test.ts b/reference-implementation/test/detail-coverage-shortfall-severity.test.ts
index 1da2889ce..257434ebe 100644
--- a/reference-implementation/test/detail-coverage-shortfall-severity.test.ts
+++ b/reference-implementation/test/detail-coverage-shortfall-severity.test.ts
@@ -1273,8 +1273,8 @@ test("a 0.1.0 manifest keeps legacy crediting and cannot declare a 0.2.0 capabil
 
 // Pre-spawn gate (Sections 3.4 and 4): an unknown capability name fails closed,
 // and a known required capability this runtime does not implement fails before
-// any connector code runs. DETAIL_COVERAGE_KEY_SETS is advisory and
-// STREAM_EVIDENCE is implemented, so both pass. BLOB is covered separately.
+// any connector code runs. DETAIL_COVERAGE_KEY_SETS and RUN_COVERAGE_V1 are
+// elective; STREAM_EVIDENCE is implemented. BLOB is covered separately.
 test("the pre-spawn gate rejects unknown and unsupported required capabilities and admits implemented ones", async (t) => {
   const server = await typedStartServer({ asPort: 0, dbPath: ":memory:", quiet: true, rsPort: 0 });
   t.after(() => closeServer(server));
@@ -1292,8 +1292,7 @@ test("the pre-spawn gate rejects unknown and unsupported required capabilities a
     [null, UNKNOWN_CAPABILITY_PATTERN, null],
     [["OBSERVATION"], UNSUPPORTED_CAPABILITY_PATTERN, "OBSERVATION"],
     [["DETAIL_COVERAGE_KEY_SETS", "OBSERVATION", "BLOB"], UNSUPPORTED_CAPABILITY_PATTERN, "OBSERVATION"],
-    // This runtime requests no store collection evidence (Section 3.4).
-    [["RUN_COVERAGE_V1"], UNSUPPORTED_CAPABILITY_PATTERN, "RUN_COVERAGE_V1"],
+    [["RUN_COVERAGE_V1"], null, null],
     [["DETAIL_COVERAGE_KEY_SETS", "STREAM_EVIDENCE"], null, null],
   ];
   for (const [protocolCapabilities, rejection, unsupported] of cases) {
@@ -1339,6 +1338,72 @@ test("START advertises the protocol capabilities this runtime implements, to eve
   }
 });
 
+test("reference runtime starts RUN_COVERAGE_V1 electively without requesting or recording store evidence", async (t) => {
+  const server = await typedStartServer({ asPort: 0, dbPath: ":memory:", quiet: true, rsPort: 0 });
+  t.after(() => closeServer(server));
+  const ownerToken = await registerAndAuthorize(server);
+  const manifest = {
+    ...MANIFEST,
+    protocol_capabilities: ["RUN_COVERAGE_V1"],
+    streams: MANIFEST.streams.map((stream) => ({
+      ...stream,
+      coverage_stores: [`${stream.name}-store`],
+    })),
+    version: "1.1.0",
+  };
+  assert.equal(isAdmitted(await registerManifest(server, manifest)), true, "the extension manifest is admitted");
+  const terminalMessages = holdingsRun([]).map((message) =>
+    message.type === "DONE"
+      ? {
+          ...message,
+          coverage: {
+            collection_scope: "unscoped",
+            streams: ["holdings", "activity"].map((stream) => ({
+              scoped: true,
+              stores: [{ status: "collected", store: `run-coverage-${stream}-store` }],
+              stream,
+            })),
+            version: 1,
+          },
+        }
+      : message
+  );
+  const run = await runCapturingStart(server, ownerToken, manifest, terminalMessages);
+  assert.equal(run.thrown, null);
+  assert.ok(run.start, "the connector received START");
+  assert.equal("run_coverage_version" in run.start, false);
+  assert.equal(run.result?.status, "succeeded");
+  const terminalRow = getDb()
+    .prepare(
+      `SELECT data_json FROM spine_events
+       WHERE run_id = ? AND event_type IN ('run.completed', 'run.failed', 'run.cancelled')
+       ORDER BY event_seq DESC LIMIT 1`
+    )
+    .get<{ data_json: string }>(run.result?.run_id);
+  assert.ok(terminalRow, "the run has a terminal event");
+  assert.equal(JSON.stringify(JSON.parse(terminalRow.data_json)).includes("run-coverage-"), false);
+});
+
+test("reference runtime refuses 0.3.0 before spawn until the whole profile is implemented", async (t) => {
+  const server = await typedStartServer({ asPort: 0, dbPath: ":memory:", quiet: true, rsPort: 0 });
+  t.after(() => closeServer(server));
+  const ownerToken = await registerAndAuthorize(server);
+  const outcome = await runCapturingStart(
+    server,
+    ownerToken,
+    {
+      ...MANIFEST,
+      protocol_capabilities: ["RUN_COVERAGE_V1"],
+      protocol_version: "0.3.0",
+      streams: MANIFEST.streams.map((stream) => ({ ...stream, coverage_stores: [`${stream.name}-store`] })),
+    },
+    holdingsRun([])
+  );
+  assert.equal(outcome.start, null, "the connector was not spawned");
+  assert.ok(outcome.thrown instanceof Error);
+  assert.match(outcome.thrown.message, /protocol_version must be one of 0\.1\.0, 0\.2\.0/);
+});
+
 // BLOB is a runtime-specific extension (Collection Profile Section 7) that this
 // runtime does not implement. chatgpt and anthropic declare it but emit BLOB
 // only for an item over the inline cap, so a declaring connector still starts
diff --git a/reference-implementation/test/helpers/install-path-fixture.ts b/reference-implementation/test/helpers/install-path-fixture.ts
index 42dcecd06..189c6dbe5 100644
--- a/reference-implementation/test/helpers/install-path-fixture.ts
+++ b/reference-implementation/test/helpers/install-path-fixture.ts
@@ -27,7 +27,8 @@ export const INSTALL_PATH_PROFILE = {
   connector_id: INSTALL_PATH_CONNECTOR_ID,
   connector_key: INSTALL_PATH_CONNECTOR_KEY,
   display_name: "Claude Code (install-path journey fixture)",
-  protocol_version: "0.3.0",
+  protocol_capabilities: ["RUN_COVERAGE_V1"],
+  protocol_version: "0.2.0",
   streams: [
     { coverage_stores: ["projects"], name: "sessions", primary_key: ["id"] },
     { coverage_stores: ["derived_messages"], name: "messages", primary_key: ["id"] },
diff --git a/reference-implementation/test/local-device-coverage-journey.test.ts b/reference-implementation/test/local-device-coverage-journey.test.ts
index 13ea04fda..477edca08 100644
--- a/reference-implementation/test/local-device-coverage-journey.test.ts
+++ b/reference-implementation/test/local-device-coverage-journey.test.ts
@@ -89,11 +89,12 @@ const STREAMS = ["sessions", "messages"];
 const PROTOCOL_HEADERS = { "X-PDPP-Collector-Protocol": COLLECTOR_PROTOCOL_VERSION };
 const CSRF_FIELD_PATTERN = /<input type="hidden" name="_csrf" value="([^"]+)"\s*\/>/;
 
-// The fixture release: a claude-code 0.3.0 profile that inventories both
-// streams. The server registers it, and the device binds to it.
+// The fixture release: a claude-code 0.2.0 profile that opts into the
+// independent store-evidence extension and inventories both streams.
 const PROFILE = {
   connector_id: CONNECTOR_ID,
-  protocol_version: "0.3.0",
+  protocol_capabilities: ["RUN_COVERAGE_V1"],
+  protocol_version: "0.2.0",
   streams: [
     { coverage_stores: ["projects"], name: "sessions", primary_key: ["id"] },
     { coverage_stores: ["derived_messages"], name: "messages", primary_key: ["id"] },
diff --git a/reference-implementation/test/local-device-coverage-revision-atomicity.test.ts b/reference-implementation/test/local-device-coverage-revision-atomicity.test.ts
index ffe6be74b..07500c89f 100644
--- a/reference-implementation/test/local-device-coverage-revision-atomicity.test.ts
+++ b/reference-implementation/test/local-device-coverage-revision-atomicity.test.ts
@@ -59,7 +59,8 @@ const PROTOCOL_HEADERS = { "X-PDPP-Collector-Protocol": COLLECTOR_PROTOCOL_VERSI
 const CSRF_FIELD_PATTERN = /<input type="hidden" name="_csrf" value="([^"]+)"\s*\/>/;
 const PROFILE = {
   connector_id: CONNECTOR_ID,
-  protocol_version: "0.3.0",
+  protocol_capabilities: ["RUN_COVERAGE_V1"],
+  protocol_version: "0.2.0",
   streams: [
     { coverage_stores: ["projects"], name: "sessions", primary_key: ["id"] },
     { coverage_stores: ["derived_messages"], name: "messages", primary_key: ["id"] },
diff --git a/reference-implementation/test/local-device-coverage-stale-proof.test.ts b/reference-implementation/test/local-device-coverage-stale-proof.test.ts
index a13161c34..ac668c418 100644
--- a/reference-implementation/test/local-device-coverage-stale-proof.test.ts
+++ b/reference-implementation/test/local-device-coverage-stale-proof.test.ts
@@ -81,7 +81,8 @@ const CSRF_FIELD_PATTERN = /<input type="hidden" name="_csrf" value="([^"]+)"\s*
 // an unnegotiated run leaves the spec unbound.
 const PROFILE = {
   connector_id: CONNECTOR_ID,
-  protocol_version: "0.3.0",
+  protocol_capabilities: ["RUN_COVERAGE_V1"],
+  protocol_version: "0.2.0",
   streams: [
     { coverage_stores: ["projects"], name: "sessions", primary_key: ["id"] },
     { coverage_stores: ["derived_messages"], name: "messages", primary_key: ["id"] },
diff --git a/reference-implementation/test/source-declaration-boundary.test.ts b/reference-implementation/test/source-declaration-boundary.test.ts
index 1c9da0efc..fdf6f9ad7 100644
--- a/reference-implementation/test/source-declaration-boundary.test.ts
+++ b/reference-implementation/test/source-declaration-boundary.test.ts
@@ -33,7 +33,8 @@ const RUNTIME_IMPORT_REGEX = /import\s+(?!type\s)[\s\S]*?from\s+["']([^"']+)["']
 // src/public/source.ts directly.
 const SOURCE_CONTRACT_PATH_REGEX = /\/dist\/public\/source\.js$/;
 const PROJECTED_DECLARATION_VERSION_REGEX = /^reference\.legacy-connector-projection\.v1:sha256:[0-9a-f]{64}$/;
-const UNSUPPORTED_PROFILE_VERSION_REGEX = /manifest\.protocol_version must be one of 0\.1\.0, 0\.2\.0, 0\.3\.0, received 0\.4\.0/;
+const UNSUPPORTED_PROFILE_VERSION_REGEX =
+  /manifest\.protocol_version must be one of 0\.1\.0, 0\.2\.0, received 0\.3\.0/;
 
 const query = {
   aggregations: {
@@ -318,9 +319,9 @@ test("legacy adapter admits Collection Profile 0.2.0 and keeps the Core declarat
   assert.deepEqual(declaration, sourceDeclarationFromLegacyConnectorManifest(legacy, attribution));
 });
 
-test("legacy adapter rejects an unknown profile version", () => {
+test("legacy adapter refuses 0.3.0 until the whole profile is implemented", () => {
   assert.throws(
-    () => sourceDeclarationFromLegacyConnectorManifest({ ...legacy, protocol_version: "0.4.0" }, attribution),
+    () => sourceDeclarationFromLegacyConnectorManifest({ ...legacy, protocol_version: "0.3.0" }, attribution),
     UNSUPPORTED_PROFILE_VERSION_REGEX
   );
 });

From 5ee351d18c9fd1150aa5e43b5bf06012278d0877 Mon Sep 17 00:00:00 2001
From: Tim Nunamaker <tnunamak@gmail.com>
Date: Thu, 22 Oct 2026 19:54:42 -0500
Subject: [PATCH 63/87] Refresh connector protocol artifact metadata

Regenerate the package receipt from the committed protocol source and declarations. This keeps downstream artifact checks aligned with the extension negotiation changes.

Assisted-by: AI
Signed-off-by: Tim Nunamaker <tnunamak@gmail.com>
---
 packages/connector-protocol/artifact.json | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/packages/connector-protocol/artifact.json b/packages/connector-protocol/artifact.json
index 634f449c8..46c6cf720 100644
--- a/packages/connector-protocol/artifact.json
+++ b/packages/connector-protocol/artifact.json
@@ -1,11 +1,11 @@
 {
   "artifact_filename": "pdpp-connector-protocol-0.0.1.tgz",
-  "artifact_sha1": "981ac8207a06ee430db9523d5e669082402d90ce",
-  "artifact_sha256": "c630ecdafec9348fdcef932abad76bf1d9ef85a84170d1d0a8fa555d8e725c2e",
-  "artifact_sha512": "d2013de581d15367a7c245f0489529311419e861a8f868012f01cb92d478794e75cad02a1553c9284862d664af43c1e8e28435253c3ebcdf6478f661948f173d",
-  "declarations_sha256": "8c4491a7ffcf26a96699a81beaed632bfac78c685f2aebf8fd94c1b3939eeae4",
+  "artifact_sha1": "6caf376d43151bf3cbeb1df13d35e500ff7f2be4",
+  "artifact_sha256": "ca2c1a6d9a69f1d91780ee38ce7562b8c02856f750dc379bec70de9eed1b1f0f",
+  "artifact_sha512": "0d4377f24b8e68644a96183f194007e8174d54a663c2016d14b073964be4441e37366763bd456f8505c472cbac427079003ceeac49013c96869b029c1fc42ddc",
+  "declarations_sha256": "150696417901ff375d734c3fec38b4786929d5ea0708f28b0c2a9d798d9fff3e",
   "metadata_version": 1,
   "package_name": "@pdpp/connector-protocol",
   "package_version": "0.0.1",
-  "source_inputs_sha256": "63e5856ee9c419ffcbdd0f0b3371c0c38d54bd2a4a07e983c5d68f37fab3f772"
+  "source_inputs_sha256": "e25e7d4b15da6268857361fb967c29f8efba7c687668e8d6f71b8acb31ef4757"
 }

From 1a43e843ff82829c4d4d484ac3d318b610b72da6 Mon Sep 17 00:00:00 2001
From: Tim Nunamaker <tnunamak@gmail.com>
Date: Thu, 22 Oct 2026 19:55:00 -0500
Subject: [PATCH 64/87] Refresh collector runtime artifact metadata

Regenerate the collector receipt against the updated connector protocol artifact and runtime source. This keeps its declared dependency digests and package output in sync.

Assisted-by: AI
Signed-off-by: Tim Nunamaker <tnunamak@gmail.com>
---
 packages/collector-runtime/artifact.json | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/packages/collector-runtime/artifact.json b/packages/collector-runtime/artifact.json
index 5faccfdf2..fa3ba67b9 100644
--- a/packages/collector-runtime/artifact.json
+++ b/packages/collector-runtime/artifact.json
@@ -1,13 +1,13 @@
 {
   "artifact_filename": "pdpp-collector-runtime-0.0.1.tgz",
-  "artifact_sha1": "3d60366f309fe2087efecc312555f38d6445a95f",
-  "artifact_sha256": "7d5fcb527ec1185abfb8bc90a37e9cfee4194799418bf0ac69adcf2ac97d0046",
-  "artifact_sha512": "572d3049fd12a272832369c287a904a4b5d99426b3e80c6bf9b5eebd0bbd5ff4a8846273c0b4ce47142b631763bdeaa3e66095b92aea68755bdb8dd0e9a6b312",
-  "connector_protocol_declarations_sha256": "8c4491a7ffcf26a96699a81beaed632bfac78c685f2aebf8fd94c1b3939eeae4",
-  "connector_protocol_source_inputs_sha256": "63e5856ee9c419ffcbdd0f0b3371c0c38d54bd2a4a07e983c5d68f37fab3f772",
-  "declarations_sha256": "a2c6d0e4ac93d2b9186bbbd2fcf133ac314c23003fab4ba298ccb4c41571140d",
+  "artifact_sha1": "f117ee2e0988d2f1539796c02a0363d6950ed3fc",
+  "artifact_sha256": "2b04261e618484c8ee2eda201d6126a8b1d1e4b755ebcda6135d3d31557ca18f",
+  "artifact_sha512": "ad1bcb66129b6533e4f69d4938e3a6650298284a8ac7c8b33e4e9456761c67766773bc7fb33687d0e9679f2c9646b2b3a760f1f0bdb9f45fad0b76f2ac19e39b",
+  "connector_protocol_declarations_sha256": "150696417901ff375d734c3fec38b4786929d5ea0708f28b0c2a9d798d9fff3e",
+  "connector_protocol_source_inputs_sha256": "e25e7d4b15da6268857361fb967c29f8efba7c687668e8d6f71b8acb31ef4757",
+  "declarations_sha256": "eef0eee97e38b6e038babc5fa01872e40901c3f46f598af183d8c31a31673dcf",
   "metadata_version": 1,
   "package_name": "@pdpp/collector-runtime",
   "package_version": "0.0.1",
-  "source_inputs_sha256": "d51aada268993d1a5ee2929528511ccb60a512b8a0f85aa6770a705769666940"
+  "source_inputs_sha256": "2e6df33c1031210bbc94cfb8a673919a76bf814833dced8453694b7bae5c53b6"
 }

From 3d17c84749a390977afca3ef68d571764c91d887 Mon Sep 17 00:00:00 2001
From: Tim Nunamaker <tnunamak@gmail.com>
Date: Thu, 22 Oct 2026 20:01:09 -0500
Subject: [PATCH 65/87] Correct extension audit references

Refresh source locations in the Profile 0.3.0 refusal table. Clarify the manifest and detail accounting gaps.

Assisted-by: AI
Signed-off-by: Tim Nunamaker <tnunamak@gmail.com>
---
 docs/261021-local-device-coverage-evidence.md | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/docs/261021-local-device-coverage-evidence.md b/docs/261021-local-device-coverage-evidence.md
index d4857ba52..4bcdacae9 100644
--- a/docs/261021-local-device-coverage-evidence.md
+++ b/docs/261021-local-device-coverage-evidence.md
@@ -57,12 +57,12 @@ The audit found mandatory 0.3.0 rules that the runtimes do not implement. Every
 | Mandatory feature or obligation | Reference runtime status and gap | Collector runtime status and gap |
 | --- | --- | --- |
 | `protocol_version: 0.3.0` | `REFUSED-AT-REGISTRATION` and `REFUSED-PRE-SPAWN` (`reference-implementation/server/connector-manifest-validation.ts:194-205`; `reference-implementation/runtime/index.ts:2642-2654`). | `REFUSED-PRE-SPAWN` (`packages/collector-runtime/src/collector-runner.ts:941-948`). |
-| `OBSERVATION` capability and message; `diagnostic_descriptors` manifest member | `REFUSED-AT-REGISTRATION` and `REFUSED-PRE-SPAWN`; `OBSERVATION` is not advertised or handled (`reference-implementation/runtime/index.ts:2597-2606, 6482-6497`), and the manifest type has no descriptor member (`reference-implementation/runtime/index.ts:173`). | `REFUSED-PRE-SPAWN`; `OBSERVATION` is not advertised (`packages/collector-runtime/src/runtime-capabilities.ts:80-90`), and the profile binder reads only version, capabilities, and streams (`packages/local-collector/bin/pdpp-local-collector.ts:3282-3304`). |
+| `OBSERVATION` capability and message; `diagnostic_descriptors` manifest member | `REFUSED-AT-REGISTRATION` and `REFUSED-PRE-SPAWN`; `OBSERVATION` is not advertised or handled (`reference-implementation/runtime/index.ts:2597-2606, 6482-6497`), and the manifest type has no descriptor member (`reference-implementation/runtime/index.ts:172-176`). | `REFUSED-PRE-SPAWN`; `OBSERVATION` is not advertised (`packages/collector-runtime/src/runtime-capabilities.ts:80-90`), and the profile binder reads profile version, capabilities, stream names, and store inventories, not `diagnostic_descriptors` (`packages/local-collector/bin/pdpp-local-collector.ts:3292-3317`). |
 | `DONE.error.basis` and the Section 5.11 diagnosis/recovery-hint gate | `REFUSED-AT-REGISTRATION` and `REFUSED-PRE-SPAWN`; `DONE.error` has no `basis` member in the shared wire type (`packages/connector-protocol/src/connector-runtime-protocol.ts:931-936`). | `REFUSED-PRE-SPAWN`; `DONE.error` has no `basis` member in the shared wire type (`packages/connector-protocol/src/connector-runtime-protocol.ts:931-936`). |
 | Section 5.12 diagnostic data stays on the device | `REFUSED-AT-REGISTRATION` and `REFUSED-PRE-SPAWN`; the runtime has no `OBSERVATION` record path (`reference-implementation/runtime/index.ts:2597-2606, 6482-6497`). | `REFUSED-PRE-SPAWN`; the collector advertises no `OBSERVATION` support (`packages/collector-runtime/src/runtime-capabilities.ts:80-90`). |
-| `parent_streams` detail accounting and declared `transform_epoch` | `REFUSED-AT-REGISTRATION` and `REFUSED-PRE-SPAWN`; the `DETAIL_COVERAGE` wire type has no obligation, validator-domain, or epoch members (`packages/connector-protocol/src/connector-runtime-protocol.ts:503-563`). | `REFUSED-PRE-SPAWN`; the runner rejects `DETAIL_GAP` and `DETAIL_COVERAGE` rather than accounting them (`packages/collector-runtime/src/collector-runner.ts:1952-1954`). |
-| Runtime-sent `START.detail_debts` (required on every 0.3.0 run, including an empty array) | `REFUSED-AT-REGISTRATION` and `REFUSED-PRE-SPAWN`; `START` sends `detail_gaps`, not `detail_debts` (`reference-implementation/runtime/index.ts:3489-3490`; `packages/connector-protocol/src/connector-runtime-protocol.ts:311-348`). | `REFUSED-PRE-SPAWN`; the START type and builder have no `detail_debts` member (`packages/connector-protocol/src/connector-runtime-protocol.ts:311-348`; `packages/collector-runtime/src/collector-runner.ts:2565-2585`). |
-| Fully typed portable `DETAIL_GAP_RECOVERED` lifecycle | `REFUSED-AT-REGISTRATION` and `REFUSED-PRE-SPAWN`; the handler accepts partial optional fields and settles a gap claim, not the full portable seal (`reference-implementation/runtime/index.ts:2196-2213, 5945-6008`). | `REFUSED-PRE-SPAWN`; the message is not accounted by the runner, which rejects the related detail accounting messages (`packages/collector-runtime/src/collector-runner.ts:1945-1965`). |
+| `parent_streams` detail accounting and declared `transform_epoch` | `REFUSED-AT-REGISTRATION` and `REFUSED-PRE-SPAWN`; the manifest type has no `transform_epoch`, and `DETAIL_COVERAGE` has no obligation, validator-domain, or epoch members (`reference-implementation/runtime/index.ts:150-169`; `packages/connector-protocol/src/connector-runtime-protocol.ts:503-563`). | `REFUSED-PRE-SPAWN`; the profile binder does not read these accounting declarations, and the runner rejects `DETAIL_GAP` and `DETAIL_COVERAGE` rather than accounting them (`packages/local-collector/bin/pdpp-local-collector.ts:3292-3317`; `packages/collector-runtime/src/collector-runner.ts:1952-1954`). |
+| Runtime-sent `START.detail_debts` (required on every 0.3.0 run, including an empty array) | `REFUSED-AT-REGISTRATION` and `REFUSED-PRE-SPAWN`; `START` sends `detail_gaps`, not `detail_debts` (`reference-implementation/runtime/index.ts:3485-3494`; `packages/connector-protocol/src/connector-runtime-protocol.ts:311-348`). | `REFUSED-PRE-SPAWN`; the START type and builder have no `detail_debts` member (`packages/connector-protocol/src/connector-runtime-protocol.ts:311-348`; `packages/collector-runtime/src/collector-runner.ts:2565-2585`). |
+| Fully typed portable `DETAIL_GAP_RECOVERED` lifecycle | `REFUSED-AT-REGISTRATION` and `REFUSED-PRE-SPAWN`; the handler accepts partial optional fields and settles a gap claim, not the full portable seal (`reference-implementation/runtime/index.ts:2196-2213, 5950-6025`). | `REFUSED-PRE-SPAWN`; the message is not accounted by the runner, which rejects the related detail accounting messages (`packages/collector-runtime/src/collector-runner.ts:1945-1965`). |
 | Complete, empty, unchanged, and gap replacement invalidates earlier hydrated-without-record and `optional_skip_keys` exchanges | `REFUSED-AT-REGISTRATION` and `REFUSED-PRE-SPAWN`; it validates and retains these key sets but has no 0.3.0 replacement lifecycle (`reference-implementation/runtime/index.ts:1986-2020, 4192-4203`). | `REFUSED-PRE-SPAWN`; it rejects `DETAIL_COVERAGE` and has no replacement accounting (`packages/collector-runtime/src/collector-runner.ts:1952-1954`). |
 
 The universal 0.3.0 obligations include supporting `OBSERVATION`, applying the Sections 5.11–5.12 rules when diagnosis is present, and sending `START.detail_debts` on every run. In particular, `START.detail_debts` is not keyed to a manifest feature; both runtimes omit it. The version-level refusal prevents any 0.3.0 run from reaching that non-conformant START.

From 6f7e5b986f792ad0606a91e59976d87ce1926147 Mon Sep 17 00:00:00 2001
From: Tim Nunamaker <tnunamak@gmail.com>
Date: Thu, 22 Oct 2026 20:04:07 -0500
Subject: [PATCH 66/87] docs(coverage): cite the extension's Section 7.1 rules

data-connectors#541 now defines store collection evidence as Section 7.1
of the profile on main instead of Sections 5.1 and 5.8.2 to 5.8.4 of the
unmerged 0.3.0 draft. The note's requirement table now cites 7.1.1 to
7.1.5, and it drops the row for the Section 8 sentence that the spec made
non-normative guidance.

Assisted-by: AI
Signed-off-by: Tim Nunamaker <tnunamak@gmail.com>
---
 docs/261021-local-device-coverage-evidence.md | 151 +++++++++---------
 1 file changed, 75 insertions(+), 76 deletions(-)

diff --git a/docs/261021-local-device-coverage-evidence.md b/docs/261021-local-device-coverage-evidence.md
index 4bcdacae9..7ed792fc2 100644
--- a/docs/261021-local-device-coverage-evidence.md
+++ b/docs/261021-local-device-coverage-evidence.md
@@ -42,7 +42,7 @@ The server's owner coverage is a fact about one admitted run, shown with its as-
 
 ## Collection Profile extension
 
-The canonical Collection Profile is `data-connectors/docs/spec/collection-profile.md`. [Data-connectors PR #541](https://github.com/PDP-Connect/data-connectors/pull/541), stacked on #516, specifies the elective store-collection extension, stream store declarations, terminal evidence, and its relationship to detail accounting and checkpoint eligibility. Data-connectors #539 and this PR implement the extension. The owner approves it at merge.
+The canonical Collection Profile is `data-connectors/docs/spec/collection-profile.md`. [Data-connectors PR #541](https://github.com/PDP-Connect/data-connectors/pull/541) specifies, as Section 7.1, the elective store-collection extension, stream store declarations, terminal evidence, and its relationship to detail accounting and checkpoint eligibility. Data-connectors #539 and this PR implement the extension. The owner approves it at merge.
 
 ## Store collection extension negotiation
 
@@ -176,7 +176,7 @@ Limits. The server cannot order an attempt it never hears about. Examples are a
 ## Collection Profile trim: moved text, dropped text, rule-to-failure-to-test
 
 Non-normative. This section supports data-connectors PR #541, which trims
-`docs/spec/collection-profile.md` (Sections 3.2, 3.4, 5.1, 5.8.2 to 5.8.4,
+`docs/spec/collection-profile.md` (Sections 3.2, 3.4, 5.1, 7.1.2 to 7.1.4,
 6.2 item 14, and 8). It records what left the profile and why. The table gives
 the failure behind each MUST that remains, and the test that proves it.
 
@@ -256,79 +256,78 @@ were not in this note before, and they are added here.
   the connector-assertion MUST), "Failure of a complete-data claim MUST NOT ...
   gap debt" (into the checkpoint-downgrade MUST), and "Positive coverage
   applies only to the validated targets, source account, boundary, and release"
-  (into the retained-bindings MUST in 5.8.4).
+  (into the retained-bindings MUST in 7.1.4).
 
 ### Rule, failure, test
 
 | § | MUST (trimmed profile) | Failure it prevents | Test |
 | --- | --- | --- | --- |
-| 3.2 | An identifier MUST NOT contain a credential or device-specific path. | A credential or device path is published in a signed manifest. | none (gap) |
-| 3.2 | The manifest MUST state each store's obligation, content or metadata only. | Metadata-only inventory reads as completeness of content. | OP: "proven empty content is complete while metadata inventory stays inventory only" |
-| 3.2 | A runtime MUST NOT derive store coverage for a stream with no `coverage_stores`. | An undeclared store reads as covered. | OP: "the terminal endpoint rejects a store outside the registered inventory" |
-| 3.2 | A change to a store's obligation MUST change the manifest revision. | A proof for the old obligation survives the change. | PROJ: "catalog obligation changes invalidate proof when the binding generation advances" |
-| 3.4 | A runtime MUST request evidence only when the manifest declares elective `RUN_COVERAGE_V1`, its base profile is supported, every requested stream has a non-empty `coverage_stores` inventory, and `collection_scope` binds the effective scope. | Evidence is requested without opt-in, under an unsupported base, for a stream without inventory, or for an unbound scope. | LC: "a 0.2.0 profile with RUN_COVERAGE_V1 and inventories requests store evidence"; LC: "a 0.1.0 profile with RUN_COVERAGE_V1 and inventories requests store evidence"; LC: "RUN_COVERAGE_V1 without a requested stream inventory does not request evidence"; LC: "a manifest without RUN_COVERAGE_V1 requests no store evidence"; RUNNER: "runCollectorConnector requests no coverage when START restricts a stream to named resources" |
-| 3.4 | A runtime MUST NOT block spawn solely because a connector declares elective `RUN_COVERAGE_V1`; without extension support it MUST omit `START.run_coverage_version` and record no store evidence. | An optional extension blocks connectors that can run without it, or an unsupported runtime records evidence it cannot accept. | SEV: "reference runtime starts RUN_COVERAGE_V1 electively without requesting or recording store evidence"; RUNNER: "runCollectorConnector starts a RUN_COVERAGE_V1 connector when this run requests no evidence"; CAP: "a declared RUN_COVERAGE_V1 places on runtimes with or without the extension"; PROTO: "RUN_COVERAGE_V1 is known and elective" |
-| 3.4 | A manifest that declares `coverage_stores` MUST declare `RUN_COVERAGE_V1`; runtimes MUST refuse the mismatch at registration or before spawn. | Store obligations have no negotiated evidence contract. | connector-manifest-validation: "validateConnectorManifest refuses coverage_stores without RUN_COVERAGE_V1 at registration"; RUNNER: "runCollectorConnector refuses coverage_stores without RUN_COVERAGE_V1 before spawn" |
-| 3.4 | Runtime accounting MUST override `DONE.coverage`; incomplete or unevaluable base accounting MUST NOT produce a positive store status. | A connector's collected claim hides a skip, detail gap, or accounting the runtime cannot assess. | RUNNER: "runCollectorConnector lets SKIP_RESULT defeat a collected DONE assertion"; RUNNER: "runCollectorConnector records no 0.2.0 positive when it cannot account for DETAIL_GAP" and "... DETAIL_COVERAGE" |
-| 3.4 | When START omits `run_coverage_version`, a connector MUST omit `DONE.coverage`. | Coverage that was not requested is trusted. | JOUR: "A: without START coverage negotiation, a successful run supplies no positive coverage"; RUNNER: "a connector that does not request coverage cannot submit a positive DONE verdict" |
-| 3.4 | If version 1 was requested and a successful DONE omits `coverage` (including from producers that predate the field), the runtime MUST treat the stores as unknown and MUST NOT keep an earlier positive. | An omission is read as "not supported", and the older proof stays current. | RUNNER: "successful DONE without coverage retires earlier proof with STATE" and "... without STATE"; PROJ: "legacy terminal commit without v2 proof stays unknown" |
-| 3.4 | Negotiating this evidence MUST NOT disable or weaken detail accounting, diagnosis, or checkpoint rules. | Opting into coverage skips the accounting that protects data. | RUNNER: "runCollectorConnector lets SKIP_RESULT defeat a collected DONE assertion"; OP: "checkpoint eligibility ${eligible} governs state advancement with accounted debt" |
-| 8 | A runtime MUST NOT request evidence that its persistence and validation path cannot accept. | Evidence is requested, then silently dropped. | RUNNER: "a run with invalid provenance leaves a failure gap for its lane" (a run with no bound manifest fingerprint and artifact digest is refused before spawn) |
-| 5.1 | A runtime that requests version 1 MUST supply a non-empty `collection_scope`. | A proof with no scope binds to nothing. | RUNNER: "buildCollectorStartMessage refuses a version 1 request without a collection scope" (the runner builds START before spawn) |
-| 5.1 | The connector MUST echo `collection_scope` without modification. | Coverage is claimed for a different scope. | RUNNER: "runCollectorConnector rejects a DONE coverage scope echo that differs from actual START scope" |
-| 5.1 | The runtime MUST bind the string to the run's normalized targets, collection mode, boundary, and source-root restrictions. | A proof for one boundary is replayed for another. | PROJ: "v2 terminal proof for an old collection scope cannot cover the current scope" |
-| 5.1 | The echoed string MUST NOT confer authorization. | A connector string widens access. | none, by nature: no code reads the echo except the equality check of the "MUST echo" row; `validateRunCoverageVerdict` returns START's own string, and server record admission (`validateAttemptRecords`) does not read it |
-| 5.1 | `unscoped` MUST NOT remove a restriction in `START.scope` or the authority bindings. | A run escapes its scope and still claims coverage. | RUNNER: "runCollectorConnector requests no coverage when START restricts a stream to named resources" and "runCollectorConnector rejects coverage sent for a START restricted to named resources" |
-| 5.8.2 | A failed DONE MUST NOT contain `coverage`. | A failed run's claims are trusted. | PROJ: "a newer failed run cannot retain an earlier v2 covered verdict" (projection side only; the DONE side is untested) |
-| 5.8.2 | The coverage object's shape: `version`, `collection_scope`, `streams`, the stream and store fields, and the status enum. | Malformed coverage reaches the projection. | RUNNER: "runCollectorConnector rejects malformed DONE coverage: ${label}" and "runCollectorConnector rejects ${versionLabel} DONE coverage versions"; RUNNER: "runCollectorConnector flags an unrecognized coverage status as unaccounted" |
-| 5.8.2 | Stream entries MUST equal the requested set, and each stream's stores MUST equal its manifest inventory, with no duplicates or extras. | Missing or extra streams or stores read as covered. | RUNNER: "runCollectorConnector rejects missing and extra DONE coverage streams"; OP: "v2 claims with an extra store outside the registered inventory are rejected"; OP: "v2 normalization rejects duplicate streams and duplicate stores" |
-| 5.8.2 | A connector MUST omit the whole object when a requested stream has no declared inventory. | A stream with no inventory claims coverage. | none direct (gap) |
-| 5.8.2 | A connector MUST report `collected` only after enumeration closes and every in-scope candidate has a disposition. | A complete claim with candidates still open. | RUNNER: "runCollectorConnector withholds collected coverage after an HTTP receipt rejects a record" |
-| 5.8.2 | A connector MUST report `partial` when an in-scope candidate, field, item, or payload is skipped, deferred, unsupported, or pending. | Skipped items read as complete. | RUNNER: "runCollectorConnector lets SKIP_RESULT defeat a collected DONE assertion" |
-| 5.8.2 | A connector MUST report `unavailable` when it could not access the store before enumeration began. | An inaccessible store reads as partial or complete. | PROJ: "an unavailable store verdict never projects complete on list or detail" |
-| 5.8.2 | A connector MUST report `failed` when enumeration or classification began and did not finish. | An unfinished enumeration reads as complete. | PROJ: "local-device v2 ${status} verdict never projects covered" |
-| 5.8.2 | Absence of records or a file-read failure MUST NOT by itself establish proven emptiness. | A missing store reads as empty and complete. | none (gap) |
-| 5.8.2 | `scoped: true` MUST NOT assert binding enforcement under Section 3.3.9. | Enumeration honesty is read as enforcement. | none (gap) |
-| 5.8.2 | The runtime MUST derive accepted coverage from the assertions and its observable accounting. | Connector claims are accepted as proof. | OP: "connector collected assertions cannot override runtime accounting or absent admission" |
-| 5.8.2 | The runtime MUST reconcile DETAIL_COVERAGE, STREAM_EVIDENCE, durable admission, and outstanding debt for the same obligations. | A store is complete while its detail or debt says otherwise. | PROJ: "runtime ${field} contradiction prevents both owner projections claiming complete" |
-| 5.8.2 | The runtime MUST downgrade a `collected` assertion when it observes a skip, an inconsistency, a rejected effect, unresolved debt, or a withheld checkpoint. | A complete claim survives runtime evidence. | RUNNER: "runCollectorConnector lets SKIP_RESULT defeat a collected DONE assertion"; RUNNER: "runCollectorConnector withholds collected coverage after an HTTP receipt rejects a record" |
-| 5.8.2 | The connector's assertion MUST NOT override runtime evidence. | Same as above. | OP: "connector collected assertions cannot override runtime accounting or absent admission" |
-| 5.8.2 | The downgrade MUST NOT by itself make an otherwise eligible checkpoint ineligible. | A coverage downgrade stalls checkpoint progress. | OP: "checkpoint eligibility ${eligible} governs state advancement with accounted debt" |
-| 5.8.2 | `DONE.coverage` MUST NOT authorize STATE advancement, a materialization receipt, debt settlement, or a substitute for accounting. | STATE advances, or debt settles, on a coverage claim. | partial: OP "connector collected assertions cannot override runtime accounting or absent admission" (no direct test that a collected DONE alone leaves STATE unchanged) |
-| 5.8.2 | Before it records positive coverage, the runtime MUST validate the version, boundary echo, stream set, inventories, statuses, and bindings. | Unvalidated coverage is recorded as positive. | PROJ: "malformed persisted v2 store inventory never projects covered"; OP: "version 2 terminal coverage validates named stores against the manifest" |
-| 5.8.2 | Missing, unsupported, or malformed coverage MUST NOT establish positive coverage. The runtime MAY fail the exchange; otherwise it MUST record unknown or a worse result. | A malformed claim keeps a proof positive. | PROJ: "legacy terminal commit without v2 proof stays unknown" |
-| 5.8.2 | A runtime MUST NOT treat a transport acknowledgment as durable admission. | Records lost after a transport ack count as admitted. | JOUR: "B2: a server-rejected record stays unadmitted, moves no cursor, and leaves the lane not covered" (partial: the record was rejected, not only acknowledged) |
-| 5.8.2 | A rejected in-scope effect, unresolved debt, missing accounting, or withheld checkpoint MUST prevent positive coverage for that obligation. | Positive coverage over a rejected record. | RUNNER: "runCollectorConnector withholds collected coverage after an HTTP receipt rejects a record"; JOUR: "J3: a run that fails before its scan leaves the lane not covered; the server keeps run A's coverage until a later run recovers" |
-| 5.8.2 | A positive's artifact digest and manifest fingerprint MUST match a release pair that the runtime or server has verified. | An unverified or mismatched release certifies code. | OP: "a v2 claim cannot pair a registered digest with another manifest fingerprint"; OP: "terminal coverage requires the release registered for the authorized connector instance" |
-| 5.8.2 | An unregistered digest, or a digest with a different fingerprint, MUST NOT establish positive coverage. | Same as above. | OP: "the terminal endpoint keeps an unregistered digest unknown"; OP: "unregistered well-formed artifact digests remain unknown" |
-| 5.8.2 | After a negotiated success, an omitted `DONE.coverage` is a new terminal result: the runtime MUST retire earlier positives for the connection and release, and MUST record the stores as unknown, with or without STATE. | A silent omission keeps the old proof current. | PROJ: "successful empty v2 terminal replacement retires earlier proof with state" and "... without state"; STALE: "journey: a later unnegotiated run with no STATE commits a terminal record that retires the proof"; JOUR: "U: after a covered run, an unnegotiated success with STATE retires the proof on server and device" and "... without STATE ..." |
-| 5.8.2 | A negative store result MUST NOT be erased by a later positive within the same run. Across runs, a validated `collected` proof replaces an earlier `partial` only for the same `collection_scope`. | An unsupported in-run claim erases a negative, or a proof is reused across scopes. | RUNNER: "runCollectorConnector keeps a negative store status when a later coverage record in the run says collected"; ATOM: "coverage: a later collected proof replaces an earlier partial for the same scope"; PROJ: "v2 terminal proof for an old collection scope cannot cover the current scope" |
-| 5.8.2 | A connection-wide verdict MUST NOT imply coverage for omitted or uninstrumented streams. | A connection-level "complete" hides an uninstrumented stream. | OP: "selected instrumented stream is accepted beside an uninstrumented stream"; PROJ: "selected-stream v2 proof cannot cover omitted manifest streams" |
-| 5.8.3 | The runtime MUST commit an orderable terminal run record for every successful run, negotiated or not, with or without STATE, and the record MUST name its run and run sequence. | A run without a record leaves an earlier proof current. | RUNNER: "successful DONE without coverage retires earlier proof without STATE"; STALE: "journey: a later unnegotiated run with no STATE commits a terminal record that retires the proof"; ATOM: "run start: the route issues a connection-scoped sequence and an exact replay returns it" |
-| 5.8.3 | A positive MUST be published only after a successful DONE, exit 0, durable admission of the run's relevant effects, and completion of its checkpoint commits. | A positive is published for data that is not yet durable. | RUNNER: "runCollectorConnector rejects a valid concrete ${effectType} before terminal coverage" (admission side; the checkpoint side is covered only by the OP checkpoint test above) |
-| 5.8.3 | The component MUST assign each run a sequence when the run starts, and the runtime MUST obtain it before it admits any effect. | Effects are admitted with no sequence, so no order exists. | ATOM: "run order: a second collector on one connection is ordered by run start, not by commit"; ATOM: "run start: the route issues a connection-scoped sequence and an exact replay returns it" |
-| 5.8.3 | Run-start registration alone MUST NOT retire current positive coverage. | Registering a run with no effect hides the earlier proof or changes its as-of. | ATOM: "run start alone leaves earlier coverage and its as-of standing" |
-| 5.8.3 | A run without an assigned sequence MUST NOT produce positive coverage. An observed terminal record or ingested batch without a sequence still retires earlier positive coverage. | An unordered run becomes eligible, or its observed effects leave an earlier proof current. | ATOM: "run order: an unregistered attempt retires prior coverage and cannot establish a proof" |
-| 5.8.3 | An observed event of the same or a later run MUST retire the positive to unknown. | An attempt does not retire the proof. | JOUR: "J2: a batch the server receives and rejects after a covered run retires the proof on server and device"; JOUR: "J4: a failure report the server receives after a covered run retires the proof"; JOUR: "J6: a runner killed after its records are admitted, before its terminal record, leaves the earlier positive unknown"; ATOM: "crash after ingest: a later run's durable records retire an earlier positive without its terminal" |
-| 5.8.3 | A terminal record of an earlier run that arrives later MUST NOT become current. | A late, older proof becomes current. | ATOM: "run order: an older run's proof that arrives after a newer run's terminal record stays history"; JOUR: "J5: an older run's proof delivered after a newer run's terminal record stays history" |
-| 5.8.3 | If a sequence or revision cannot be read, is missing, or is ambiguous, the result MUST be unknown. | An ambiguous order picks a proof. | STALE: "revision: an unreadable or mismatched revision, run sequence or storage epoch fails closed"; ATOM: "upgrade: rows from before the collection revision fail closed, and the next proof is current" |
-| 5.8.3 | The runtime MUST NOT compare wall-clock timestamps to decide currency. | A skewed clock reorders evidence. | STALE: "revision: a later state commit retires the proof when the server clock has gone back"; STALE: "revision: a newer proof committed with the clock set back is the current proof"; GREEN: "coverage proof eligibility ignores wall-clock ordering when generations match" |
-| 5.8.3 | An exact replay MUST return the stored receipt and change neither the run sequence nor the coverage. | A replay takes a revision and retires a proof, or fails after an inventory change. | ATOM: "replay: an exact terminal replay after an inventory change gets its receipt; a conflicting duplicate fails atomically"; OP: "SQLite route operation composes authorization with 201, exact response-loss replay, and non-disclosing 409"; RESTART: "cursor-aware response-loss restart exact-replays once on ${backend}" |
-| 5.8.3 | A different record for the same run MUST fail and write nothing. | A second record overwrites the receipt. | OP: "divergent receipt conflict returns a typed non-disclosing 409" |
-| 5.8.3 | The component MUST assign a monotonic per-connection revision to every observed event that can establish or retire positive coverage. | Events are unordered, so the current proof is ambiguous. | STALE: "revision: a distinct state commit at the proof's own instant retires it"; STATE-PG: "real PostgreSQL: the collection revision orders commits and observed events, and both coverage readers return the same fence" (skipped unless `PDPP_TEST_POSTGRES_URL` is set) |
-| 5.8.3 | The admitted effect observes the run's sequence and retires earlier positive coverage. | An admitted effect before the terminal record leaves the proof current. | ATOM: "crash after ingest: a later run's durable records retire an earlier positive without its terminal"; JOUR: "J6: a runner killed after its records are admitted, before its terminal record, leaves the earlier positive unknown" |
-| 5.8.3 | The component MUST NOT keep positive coverage to avoid retiring it. | A false positive is kept to avoid an unknown result. | JOUR: "J2: a batch the server receives and rejects after a covered run retires the proof on server and device" |
-| 5.8.3 | Server-owned scope state, heartbeats, gap recoveries, and grant-scoped state MUST NOT take a revision or retire positive coverage. | Liveness writes churn the proof to unknown. | STALE: "revision: a later server-owned scope write is not an event and does not retire the proof" (heartbeats specifically: no direct test) |
-| 5.8.3 | A restore that can regress sequences or terminal records MUST reset positives to unknown until a run assigned after the restore commits a current record. | A restored older proof is current again. | ATOM: "restore: the restore step makes a restored proof unknown until a new eligible terminal" |
-| 5.8.3 | The component MUST disclose the restore paths it does not detect. | An owner trusts coverage after an undetected restore. | none, by nature: a documentation duty; "Restore incarnation" and "Limits" above are the disclosure |
-| 5.8.3 | A device runtime MUST NOT report a lane as covered while a failure barrier or unadmitted work of a later attempt remains open. | The device shows covered over unadmitted work. | LC: "a later run whose record batch stays ready makes an earlier covered receipt unadmitted"; LC: "a pass that fails before its scan leaves an earlier covered receipt unadmitted"; LC: "a run aborted before start leaves an earlier covered receipt unadmitted" |
-| 5.8.4 | Every projection that shows coverage MUST carry the run identifier and run sequence, the release digest, and the revision and commit time. | Coverage is shown without the run or release it describes. | STALE: "as-of: a shown proof carries its run id, release digest, revision and commit time" |
-| 5.8.4 | A proof with no recorded release MUST show the digest as absent. | A digest is shown for a release that is unknown. | PROJ: "a v2 proof with no recorded release shows its digest as absent: ${label}" (unknown, no as-of on list or detail, reason `coverage_unknown_artifact_unpinned`) |
-| 5.8.4 | Owner-facing text MUST present coverage as of its time, not as a present-tense claim. | A stale proof reads as current. | CONSOLE: "coverage chip reads 'complete as of <time>' when the reference names the run it describes"; CONSOLE: "per-stream coverage reads 'complete as of <time>' with the connection's as-of" |
-| 5.8.4 | A runtime MUST retain the run's bindings and MUST revalidate them before it reuses a positive. | A positive is reused across accounts or boundaries. | PROJ: "persisted terminal coverage cannot cross a source binding generation"; OP: "a run bound to its registered release remains valid after the connector catalog advances" |
-| 5.8.4 | Metadata-only inventory coverage MUST NOT be displayed as completeness of the underlying content. | Inventory reads as complete content. | OP: "proven empty content is complete while metadata inventory stays inventory only" |
-| 5.8.4 | A DETAIL_COVERAGE or STREAM_EVIDENCE projection SHOULD carry the same facts. | (SHOULD, so not a conformance requirement.) | none, by nature: a SHOULD, and the profile leaves those projections runtime-specific |
-| 6.2 (14) | Runtime conformance: the rows above, as one checklist. | (Aggregate.) | the rows above |
+| 7.1.1 | An identifier MUST NOT contain a credential or device-specific path. | A credential or device path is published in a signed manifest. | none (gap) |
+| 7.1.1 | The manifest MUST state each store's obligation, content or metadata only. | Metadata-only inventory reads as completeness of content. | OP: "proven empty content is complete while metadata inventory stays inventory only" |
+| 7.1.1 | A runtime MUST NOT derive store coverage for a stream with no `coverage_stores`. | An undeclared store reads as covered. | OP: "the terminal endpoint rejects a store outside the registered inventory" |
+| 7.1.1 | A change to a store's obligation MUST change the manifest revision. | A proof for the old obligation survives the change. | PROJ: "catalog obligation changes invalidate proof when the binding generation advances" |
+| 7.1.1 | A runtime MUST request evidence only when the manifest declares elective `RUN_COVERAGE_V1`, its base profile is supported, every requested stream has a non-empty `coverage_stores` inventory, and `collection_scope` binds the effective scope. | Evidence is requested without opt-in, under an unsupported base, for a stream without inventory, or for an unbound scope. | LC: "a 0.2.0 profile with RUN_COVERAGE_V1 and inventories requests store evidence"; LC: "a 0.1.0 profile with RUN_COVERAGE_V1 and inventories requests store evidence"; LC: "RUN_COVERAGE_V1 without a requested stream inventory does not request evidence"; LC: "a manifest without RUN_COVERAGE_V1 requests no store evidence"; RUNNER: "runCollectorConnector requests no coverage when START restricts a stream to named resources" |
+| 7.1.1 | A runtime MUST NOT block spawn solely because a connector declares elective `RUN_COVERAGE_V1`; without extension support it MUST omit `START.run_coverage_version` and record no store evidence. | An optional extension blocks connectors that can run without it, or an unsupported runtime records evidence it cannot accept. | SEV: "reference runtime starts RUN_COVERAGE_V1 electively without requesting or recording store evidence"; RUNNER: "runCollectorConnector starts a RUN_COVERAGE_V1 connector when this run requests no evidence"; CAP: "a declared RUN_COVERAGE_V1 places on runtimes with or without the extension"; PROTO: "RUN_COVERAGE_V1 is known and elective" |
+| 7.1.1 | A manifest that declares `coverage_stores` MUST declare `RUN_COVERAGE_V1`; runtimes MUST refuse the mismatch at registration or before spawn. | Store obligations have no negotiated evidence contract. | connector-manifest-validation: "validateConnectorManifest refuses coverage_stores without RUN_COVERAGE_V1 at registration"; RUNNER: "runCollectorConnector refuses coverage_stores without RUN_COVERAGE_V1 before spawn" |
+| 7.1.5 | Runtime accounting MUST override `DONE.coverage`; incomplete or unevaluable base accounting MUST NOT produce a positive store status. | A connector's collected claim hides a skip, detail gap, or accounting the runtime cannot assess. | RUNNER: "runCollectorConnector lets SKIP_RESULT defeat a collected DONE assertion"; RUNNER: "runCollectorConnector records no 0.2.0 positive when it cannot account for DETAIL_GAP" and "... DETAIL_COVERAGE" |
+| 7.1.1 | When START omits `run_coverage_version`, a connector MUST omit `DONE.coverage`. | Coverage that was not requested is trusted. | JOUR: "A: without START coverage negotiation, a successful run supplies no positive coverage"; RUNNER: "a connector that does not request coverage cannot submit a positive DONE verdict" |
+| 7.1.1 | If version 1 was requested and a successful DONE omits `coverage` (including from producers that predate the field), the runtime MUST treat the stores as unknown and MUST NOT keep an earlier positive. | An omission is read as "not supported", and the older proof stays current. | RUNNER: "successful DONE without coverage retires earlier proof with STATE" and "... without STATE"; PROJ: "legacy terminal commit without v2 proof stays unknown" |
+| 7.1.1 | Negotiating this evidence MUST NOT disable or weaken detail accounting, diagnosis, or checkpoint rules. | Opting into coverage skips the accounting that protects data. | RUNNER: "runCollectorConnector lets SKIP_RESULT defeat a collected DONE assertion"; OP: "checkpoint eligibility ${eligible} governs state advancement with accounted debt" |
+| 7.1.1 | A runtime that requests version 1 MUST supply a non-empty `collection_scope`. | A proof with no scope binds to nothing. | RUNNER: "buildCollectorStartMessage refuses a version 1 request without a collection scope" (the runner builds START before spawn) |
+| 7.1.1 | The connector MUST echo `collection_scope` without modification. | Coverage is claimed for a different scope. | RUNNER: "runCollectorConnector rejects a DONE coverage scope echo that differs from actual START scope" |
+| 7.1.1 | The runtime MUST bind the string to the run's normalized targets, collection mode, boundary, and source-root restrictions. | A proof for one boundary is replayed for another. | PROJ: "v2 terminal proof for an old collection scope cannot cover the current scope" |
+| 7.1.1 | The echoed string MUST NOT confer authorization. | A connector string widens access. | none, by nature: no code reads the echo except the equality check of the "MUST echo" row; `validateRunCoverageVerdict` returns START's own string, and server record admission (`validateAttemptRecords`) does not read it |
+| 7.1.1 | `unscoped` MUST NOT remove a restriction in `START.scope` or the authority bindings. | A run escapes its scope and still claims coverage. | RUNNER: "runCollectorConnector requests no coverage when START restricts a stream to named resources" and "runCollectorConnector rejects coverage sent for a START restricted to named resources" |
+| 7.1.2 | A failed DONE MUST NOT contain `coverage`. | A failed run's claims are trusted. | PROJ: "a newer failed run cannot retain an earlier v2 covered verdict" (projection side only; the DONE side is untested) |
+| 7.1.2 | The coverage object's shape: `version`, `collection_scope`, `streams`, the stream and store fields, and the status enum. | Malformed coverage reaches the projection. | RUNNER: "runCollectorConnector rejects malformed DONE coverage: ${label}" and "runCollectorConnector rejects ${versionLabel} DONE coverage versions"; RUNNER: "runCollectorConnector flags an unrecognized coverage status as unaccounted" |
+| 7.1.2 | Stream entries MUST equal the requested set, and each stream's stores MUST equal its manifest inventory, with no duplicates or extras. | Missing or extra streams or stores read as covered. | RUNNER: "runCollectorConnector rejects missing and extra DONE coverage streams"; OP: "v2 claims with an extra store outside the registered inventory are rejected"; OP: "v2 normalization rejects duplicate streams and duplicate stores" |
+| 7.1.2 | A connector MUST omit the whole object when a requested stream has no declared inventory. | A stream with no inventory claims coverage. | none direct (gap) |
+| 7.1.2 | A connector MUST report `collected` only after enumeration closes and every in-scope candidate has a disposition. | A complete claim with candidates still open. | RUNNER: "runCollectorConnector withholds collected coverage after an HTTP receipt rejects a record" |
+| 7.1.2 | A connector MUST report `partial` when an in-scope candidate, field, item, or payload is skipped, deferred, unsupported, or pending. | Skipped items read as complete. | RUNNER: "runCollectorConnector lets SKIP_RESULT defeat a collected DONE assertion" |
+| 7.1.2 | A connector MUST report `unavailable` when it could not access the store before enumeration began. | An inaccessible store reads as partial or complete. | PROJ: "an unavailable store verdict never projects complete on list or detail" |
+| 7.1.2 | A connector MUST report `failed` when enumeration or classification began and did not finish. | An unfinished enumeration reads as complete. | PROJ: "local-device v2 ${status} verdict never projects covered" |
+| 7.1.2 | Absence of records or a file-read failure MUST NOT by itself establish proven emptiness. | A missing store reads as empty and complete. | none (gap) |
+| 7.1.2 | `scoped: true` MUST NOT assert binding enforcement under Section 3.3.9. | Enumeration honesty is read as enforcement. | none (gap) |
+| 7.1.2 | The runtime MUST derive accepted coverage from the assertions and its observable accounting. | Connector claims are accepted as proof. | OP: "connector collected assertions cannot override runtime accounting or absent admission" |
+| 7.1.2 | The runtime MUST reconcile DETAIL_COVERAGE, STREAM_EVIDENCE, durable admission, and outstanding debt for the same obligations. | A store is complete while its detail or debt says otherwise. | PROJ: "runtime ${field} contradiction prevents both owner projections claiming complete" |
+| 7.1.2 | The runtime MUST downgrade a `collected` assertion when it observes a skip, an inconsistency, a rejected effect, unresolved debt, or a withheld checkpoint. | A complete claim survives runtime evidence. | RUNNER: "runCollectorConnector lets SKIP_RESULT defeat a collected DONE assertion"; RUNNER: "runCollectorConnector withholds collected coverage after an HTTP receipt rejects a record" |
+| 7.1.2 | The connector's assertion MUST NOT override runtime evidence. | Same as above. | OP: "connector collected assertions cannot override runtime accounting or absent admission" |
+| 7.1.2 | The downgrade MUST NOT by itself make an otherwise eligible checkpoint ineligible. | A coverage downgrade stalls checkpoint progress. | OP: "checkpoint eligibility ${eligible} governs state advancement with accounted debt" |
+| 7.1.2 | `DONE.coverage` MUST NOT authorize STATE advancement, a materialization receipt, debt settlement, or a substitute for accounting. | STATE advances, or debt settles, on a coverage claim. | partial: OP "connector collected assertions cannot override runtime accounting or absent admission" (no direct test that a collected DONE alone leaves STATE unchanged) |
+| 7.1.2 | Before it records positive coverage, the runtime MUST validate the version, boundary echo, stream set, inventories, statuses, and bindings. | Unvalidated coverage is recorded as positive. | PROJ: "malformed persisted v2 store inventory never projects covered"; OP: "version 2 terminal coverage validates named stores against the manifest" |
+| 7.1.2 | Missing, unsupported, or malformed coverage MUST NOT establish positive coverage. The runtime MAY fail the exchange; otherwise it MUST record unknown or a worse result. | A malformed claim keeps a proof positive. | PROJ: "legacy terminal commit without v2 proof stays unknown" |
+| 7.1.2 | A runtime MUST NOT treat a transport acknowledgment as durable admission. | Records lost after a transport ack count as admitted. | JOUR: "B2: a server-rejected record stays unadmitted, moves no cursor, and leaves the lane not covered" (partial: the record was rejected, not only acknowledged) |
+| 7.1.2 | A rejected in-scope effect, unresolved debt, missing accounting, or withheld checkpoint MUST prevent positive coverage for that obligation. | Positive coverage over a rejected record. | RUNNER: "runCollectorConnector withholds collected coverage after an HTTP receipt rejects a record"; JOUR: "J3: a run that fails before its scan leaves the lane not covered; the server keeps run A's coverage until a later run recovers" |
+| 7.1.2 | A positive's artifact digest and manifest fingerprint MUST match a release pair that the runtime or server has verified. | An unverified or mismatched release certifies code. | OP: "a v2 claim cannot pair a registered digest with another manifest fingerprint"; OP: "terminal coverage requires the release registered for the authorized connector instance" |
+| 7.1.2 | An unregistered digest, or a digest with a different fingerprint, MUST NOT establish positive coverage. | Same as above. | OP: "the terminal endpoint keeps an unregistered digest unknown"; OP: "unregistered well-formed artifact digests remain unknown" |
+| 7.1.2 | After a negotiated success, an omitted `DONE.coverage` is a new terminal result: the runtime MUST retire earlier positives for the connection and release, and MUST record the stores as unknown, with or without STATE. | A silent omission keeps the old proof current. | PROJ: "successful empty v2 terminal replacement retires earlier proof with state" and "... without state"; STALE: "journey: a later unnegotiated run with no STATE commits a terminal record that retires the proof"; JOUR: "U: after a covered run, an unnegotiated success with STATE retires the proof on server and device" and "... without STATE ..." |
+| 7.1.2 | A negative store result MUST NOT be erased by a later positive within the same run. Across runs, a validated `collected` proof replaces an earlier `partial` only for the same `collection_scope`. | An unsupported in-run claim erases a negative, or a proof is reused across scopes. | RUNNER: "runCollectorConnector keeps a negative store status when a later coverage record in the run says collected"; ATOM: "coverage: a later collected proof replaces an earlier partial for the same scope"; PROJ: "v2 terminal proof for an old collection scope cannot cover the current scope" |
+| 7.1.2 | A connection-wide verdict MUST NOT imply coverage for omitted or uninstrumented streams. | A connection-level "complete" hides an uninstrumented stream. | OP: "selected instrumented stream is accepted beside an uninstrumented stream"; PROJ: "selected-stream v2 proof cannot cover omitted manifest streams" |
+| 7.1.3 | The runtime MUST commit an orderable terminal run record for every successful run, negotiated or not, with or without STATE, and the record MUST name its run and run sequence. | A run without a record leaves an earlier proof current. | RUNNER: "successful DONE without coverage retires earlier proof without STATE"; STALE: "journey: a later unnegotiated run with no STATE commits a terminal record that retires the proof"; ATOM: "run start: the route issues a connection-scoped sequence and an exact replay returns it" |
+| 7.1.3 | A positive MUST be published only after a successful DONE, exit 0, durable admission of the run's relevant effects, and completion of its checkpoint commits. | A positive is published for data that is not yet durable. | RUNNER: "runCollectorConnector rejects a valid concrete ${effectType} before terminal coverage" (admission side; the checkpoint side is covered only by the OP checkpoint test above) |
+| 7.1.3 | The component MUST assign each run a sequence when the run starts, and the runtime MUST obtain it before it admits any effect. | Effects are admitted with no sequence, so no order exists. | ATOM: "run order: a second collector on one connection is ordered by run start, not by commit"; ATOM: "run start: the route issues a connection-scoped sequence and an exact replay returns it" |
+| 7.1.3 | Run-start registration alone MUST NOT retire current positive coverage. | Registering a run with no effect hides the earlier proof or changes its as-of. | ATOM: "run start alone leaves earlier coverage and its as-of standing" |
+| 7.1.3 | A run without an assigned sequence MUST NOT produce positive coverage. An observed terminal record or ingested batch without a sequence still retires earlier positive coverage. | An unordered run becomes eligible, or its observed effects leave an earlier proof current. | ATOM: "run order: an unregistered attempt retires prior coverage and cannot establish a proof" |
+| 7.1.3 | An observed event of the same or a later run MUST retire the positive to unknown. | An attempt does not retire the proof. | JOUR: "J2: a batch the server receives and rejects after a covered run retires the proof on server and device"; JOUR: "J4: a failure report the server receives after a covered run retires the proof"; JOUR: "J6: a runner killed after its records are admitted, before its terminal record, leaves the earlier positive unknown"; ATOM: "crash after ingest: a later run's durable records retire an earlier positive without its terminal" |
+| 7.1.3 | A terminal record of an earlier run that arrives later MUST NOT become current. | A late, older proof becomes current. | ATOM: "run order: an older run's proof that arrives after a newer run's terminal record stays history"; JOUR: "J5: an older run's proof delivered after a newer run's terminal record stays history" |
+| 7.1.3 | If a sequence or revision cannot be read, is missing, or is ambiguous, the result MUST be unknown. | An ambiguous order picks a proof. | STALE: "revision: an unreadable or mismatched revision, run sequence or storage epoch fails closed"; ATOM: "upgrade: rows from before the collection revision fail closed, and the next proof is current" |
+| 7.1.3 | The runtime MUST NOT compare wall-clock timestamps to decide currency. | A skewed clock reorders evidence. | STALE: "revision: a later state commit retires the proof when the server clock has gone back"; STALE: "revision: a newer proof committed with the clock set back is the current proof"; GREEN: "coverage proof eligibility ignores wall-clock ordering when generations match" |
+| 7.1.3 | An exact replay MUST return the stored receipt and change neither the run sequence nor the coverage. | A replay takes a revision and retires a proof, or fails after an inventory change. | ATOM: "replay: an exact terminal replay after an inventory change gets its receipt; a conflicting duplicate fails atomically"; OP: "SQLite route operation composes authorization with 201, exact response-loss replay, and non-disclosing 409"; RESTART: "cursor-aware response-loss restart exact-replays once on ${backend}" |
+| 7.1.3 | A different record for the same run MUST fail and write nothing. | A second record overwrites the receipt. | OP: "divergent receipt conflict returns a typed non-disclosing 409" |
+| 7.1.3 | The component MUST assign a monotonic per-connection revision to every observed event that can establish or retire positive coverage. | Events are unordered, so the current proof is ambiguous. | STALE: "revision: a distinct state commit at the proof's own instant retires it"; STATE-PG: "real PostgreSQL: the collection revision orders commits and observed events, and both coverage readers return the same fence" (skipped unless `PDPP_TEST_POSTGRES_URL` is set) |
+| 7.1.3 | The admitted effect observes the run's sequence and retires earlier positive coverage. | An admitted effect before the terminal record leaves the proof current. | ATOM: "crash after ingest: a later run's durable records retire an earlier positive without its terminal"; JOUR: "J6: a runner killed after its records are admitted, before its terminal record, leaves the earlier positive unknown" |
+| 7.1.3 | The component MUST NOT keep positive coverage to avoid retiring it. | A false positive is kept to avoid an unknown result. | JOUR: "J2: a batch the server receives and rejects after a covered run retires the proof on server and device" |
+| 7.1.3 | Server-owned scope state, heartbeats, gap recoveries, and grant-scoped state MUST NOT take a revision or retire positive coverage. | Liveness writes churn the proof to unknown. | STALE: "revision: a later server-owned scope write is not an event and does not retire the proof" (heartbeats specifically: no direct test) |
+| 7.1.3 | A restore that can regress sequences or terminal records MUST reset positives to unknown until a run assigned after the restore commits a current record. | A restored older proof is current again. | ATOM: "restore: the restore step makes a restored proof unknown until a new eligible terminal" |
+| 7.1.3 | The component MUST disclose the restore paths it does not detect. | An owner trusts coverage after an undetected restore. | none, by nature: a documentation duty; "Restore incarnation" and "Limits" above are the disclosure |
+| 7.1.3 | A device runtime MUST NOT report a lane as covered while a failure barrier or unadmitted work of a later attempt remains open. | The device shows covered over unadmitted work. | LC: "a later run whose record batch stays ready makes an earlier covered receipt unadmitted"; LC: "a pass that fails before its scan leaves an earlier covered receipt unadmitted"; LC: "a run aborted before start leaves an earlier covered receipt unadmitted" |
+| 7.1.4 | Every projection that shows coverage MUST carry the run identifier and run sequence, the release digest, and the revision and commit time. | Coverage is shown without the run or release it describes. | STALE: "as-of: a shown proof carries its run id, release digest, revision and commit time" |
+| 7.1.4 | A proof with no recorded release MUST show the digest as absent. | A digest is shown for a release that is unknown. | PROJ: "a v2 proof with no recorded release shows its digest as absent: ${label}" (unknown, no as-of on list or detail, reason `coverage_unknown_artifact_unpinned`) |
+| 7.1.4 | Owner-facing text MUST present coverage as of its time, not as a present-tense claim. | A stale proof reads as current. | CONSOLE: "coverage chip reads 'complete as of <time>' when the reference names the run it describes"; CONSOLE: "per-stream coverage reads 'complete as of <time>' with the connection's as-of" |
+| 7.1.4 | A runtime MUST retain the run's bindings and MUST revalidate them before it reuses a positive. | A positive is reused across accounts or boundaries. | PROJ: "persisted terminal coverage cannot cross a source binding generation"; OP: "a run bound to its registered release remains valid after the connector catalog advances" |
+| 7.1.4 | Metadata-only inventory coverage MUST NOT be displayed as completeness of the underlying content. | Inventory reads as complete content. | OP: "proven empty content is complete while metadata inventory stays inventory only" |
+| 7.1.4 | A DETAIL_COVERAGE or STREAM_EVIDENCE projection SHOULD carry the same facts. | (SHOULD, so not a conformance requirement.) | none, by nature: a SHOULD, and the profile leaves those projections runtime-specific |
+| 7.1 | Runtime conformance: the rows above, as one checklist. | (Aggregate.) | the rows above |
 Section 8 guidance (non-normative): `coverage.version` versions this payload only; it does not replace `protocol_version`. Implementations should not assume that older runtimes or closed manifest validators ignore unknown fields.
 
 ### Gaps
@@ -337,17 +336,17 @@ Rows marked "none, by nature" have no test, for the reason in the cell:
 
 - 5.1: no code path reads the echoed string except the equality check, so
   there is no authorization path to test.
-- 5.8.3: the disclosure of undetected restore paths is a documentation duty.
-- 5.8.4: the DETAIL_COVERAGE and STREAM_EVIDENCE sentence is a SHOULD.
+- 7.1.3: the disclosure of undetected restore paths is a documentation duty.
+- 7.1.4: the DETAIL_COVERAGE and STREAM_EVIDENCE sentence is a SHOULD.
 
 The two Section 8 statements are non-normative guidance and do not add
-conformance requirements. The 5.8.3 restore disclosure remains normative,
+conformance requirements. The 7.1.3 restore disclosure remains normative,
 because a reviewer can check it against this note.
 
 Rows marked "none (gap)" or "none direct (gap)" are connector obligations
-that data-connectors PR #539 owns: the 3.2 identifier rule, the 5.8.2
-omission for a stream without inventory, the 5.8.2 absence and file-read
-rule, and the 5.8.2 `scoped` rule. The DC tests check only the profile's
+that data-connectors PR #539 owns: the 3.2 identifier rule, the 7.1.2
+omission for a stream without inventory, the 7.1.2 absence and file-read
+rule, and the 7.1.2 `scoped` rule. The DC tests check only the profile's
 wording. This repository tests the runtime and server halves of the
 inventory rule: the collector requests no evidence when a selected stream
 has no inventory (`packages/local-collector/test/collection-profiles.test.ts`:

From 02ed156bce839cb6b5546446e88843f1abf33787 Mon Sep 17 00:00:00 2001
From: Tim Nunamaker <tnunamak@gmail.com>
Date: Thu, 22 Oct 2026 20:09:27 -0500
Subject: [PATCH 67/87] test(collector-runtime): drop capability keys the
 declaration overwrites

Fourteen fixtures set protocol_capabilities and then spread
RUN_COVERAGE_DECLARATION, which sets it again. TypeScript rejects the
overwritten key (TS2783), and that failed the package verify job.

Assisted-by: AI
Signed-off-by: Tim Nunamaker <tnunamak@gmail.com>
---
 .../collector-runtime/src/collector-runner.test.ts | 14 --------------
 1 file changed, 14 deletions(-)

diff --git a/packages/collector-runtime/src/collector-runner.test.ts b/packages/collector-runtime/src/collector-runner.test.ts
index e775f8486..40d026bb5 100644
--- a/packages/collector-runtime/src/collector-runner.test.ts
+++ b/packages/collector-runtime/src/collector-runner.test.ts
@@ -86,7 +86,6 @@ async function assertCoverageFixtureRejected(input: {
           command: "node",
           connector_id: "fixture-invalid-done-coverage",
           manifestFingerprint: "a".repeat(64),
-          protocol_capabilities: [],
           ...(input.resources ? { resources: input.resources } : {}),
           ...RUN_COVERAGE_DECLARATION,
           runCoverageVersion: 1,
@@ -490,7 +489,6 @@ test("runCollectorConnector commits a typed DONE coverage verdict without a diag
         command: "node",
         connector_id: "fixture-typed-coverage",
         manifestFingerprint: "a".repeat(64),
-        protocol_capabilities: [],
         ...RUN_COVERAGE_DECLARATION,
         runCoverageVersion: 1,
         runtime_requirements: { bindings: {} },
@@ -551,7 +549,6 @@ test("runCollectorConnector lets SKIP_RESULT defeat a collected DONE assertion",
         command: "node",
         connector_id: "fixture-skip-overrides-coverage",
         manifestFingerprint: "a".repeat(64),
-        protocol_capabilities: [],
         ...RUN_COVERAGE_DECLARATION,
         runCoverageVersion: 1,
         runtime_requirements: { bindings: {} },
@@ -667,7 +664,6 @@ test("runCollectorConnector withholds collected coverage after an HTTP receipt r
         command: "node",
         connector_id: "fixture-rejected-http-receipt",
         manifestFingerprint: "a".repeat(64),
-        protocol_capabilities: [],
         ...RUN_COVERAGE_DECLARATION,
         runCoverageVersion: 1,
         runtime_requirements: { bindings: {} },
@@ -731,7 +727,6 @@ test("runCollectorConnector records withheld checkpoint accounting before a type
         command: "node",
         connector_id: "fixture-withheld-coverage-checkpoint",
         manifestFingerprint: "a".repeat(64),
-        protocol_capabilities: [],
         ...RUN_COVERAGE_DECLARATION,
         runCoverageVersion: 1,
         runtime_requirements: { bindings: {} },
@@ -806,7 +801,6 @@ for (const [label, scope, expectedScope] of [
           connector_id: "fixture-coverage-negotiation",
           enforcesSourceRoots: true,
           manifestFingerprint: "a".repeat(64),
-          protocol_capabilities: [],
           ...RUN_COVERAGE_DECLARATION,
           runCoverageVersion: 1,
           runtime_requirements: { bindings: {} },
@@ -899,7 +893,6 @@ for (const [versionLabel, coverageVersion] of [
             command: "node",
             connector_id: "fixture-unknown-coverage-version",
             manifestFingerprint: "a".repeat(64),
-            protocol_capabilities: [],
             ...RUN_COVERAGE_DECLARATION,
             runCoverageVersion: 1,
             runtime_requirements: { bindings: {} },
@@ -1077,7 +1070,6 @@ test("runCollectorConnector requests no coverage when START restricts a stream t
         command: "node",
         connector_id: "fixture-resource-restricted-coverage",
         manifestFingerprint: "a".repeat(64),
-        protocol_capabilities: [],
         resources: { messages: ["C07JYF0U8BY"] },
         ...RUN_COVERAGE_DECLARATION,
         runCoverageVersion: 1,
@@ -1271,7 +1263,6 @@ test("runCollectorConnector runs a RUN_COVERAGE_V1 connector when its START requ
         command: "node",
         connector_id: "fixture-run-coverage-required",
         manifestFingerprint: "a".repeat(64),
-        protocol_capabilities: ["RUN_COVERAGE_V1"],
         ...RUN_COVERAGE_DECLARATION,
         runCoverageVersion: 1,
         runtime_requirements: { bindings: {} },
@@ -1314,7 +1305,6 @@ for (const includeState of [false, true]) {
           command: "node",
           connector_id: "fixture-coverage-retirement",
           manifestFingerprint: "a".repeat(64),
-          protocol_capabilities: [],
           ...RUN_COVERAGE_DECLARATION,
           runCoverageVersion: 1,
           runtime_requirements: { bindings: {} },
@@ -1467,7 +1457,6 @@ for (const effectType of ["DETAIL_GAP", "DETAIL_COVERAGE"] as const) {
             command: "node",
             connector_id: "fixture-detail-no-admission",
             manifestFingerprint: "a".repeat(64),
-            protocol_capabilities: [],
             ...RUN_COVERAGE_DECLARATION,
             runCoverageVersion: 1,
             runtime_requirements: { bindings: {} },
@@ -1533,7 +1522,6 @@ for (const effectType of ["DETAIL_GAP", "DETAIL_COVERAGE"] as const) {
             command: "node",
             connector_id: `fixture-concrete-${effectType.toLowerCase()}`,
             manifestFingerprint: "a".repeat(64),
-            protocol_capabilities: [],
             ...RUN_COVERAGE_DECLARATION,
             runCoverageVersion: 1,
             runtime_requirements: { bindings: {} },
@@ -1627,7 +1615,6 @@ test("runCollectorConnector refuses a collected assertion with mismatched emitte
           command: "node",
           connector_id: "fixture-count-mismatch",
           manifestFingerprint: "a".repeat(64),
-          protocol_capabilities: [],
           ...RUN_COVERAGE_DECLARATION,
           runCoverageVersion: 1,
           runtime_requirements: { bindings: {} },
@@ -4232,7 +4219,6 @@ test("a run with invalid provenance leaves a failure gap for its lane", async ()
             args: ["unused.ts"],
             command: "node",
             connector_id: "fixture-provenance-barrier",
-            protocol_capabilities: [],
             ...RUN_COVERAGE_DECLARATION,
             runCoverageVersion: 1,
             runtime_requirements: { bindings: {} },

From 547cd728a391503f927679f6b498c8ea22dd343d Mon Sep 17 00:00:00 2001
From: Tim Nunamaker <tnunamak@gmail.com>
Date: Thu, 22 Oct 2026 20:54:38 -0500
Subject: [PATCH 68/87] Retire device coverage on reference observations

Reference-runtime record batches and terminal failures can change the state of a connection also collected by a device, even though they have no device run sequence. Advance its collection revision and retain an unsequenced marker, so an older pending device run cannot restore a stale collected claim.

Assisted-by: AI
Signed-off-by: Tim Nunamaker <tnunamak@gmail.com>
---
 .../lib/postgres-spine.ts                     | 24 ++++--
 reference-implementation/lib/spine.ts         | 22 +++++
 reference-implementation/server/index.ts      |  4 +-
 .../server/postgres-records.ts                | 24 +++++-
 reference-implementation/server/records.ts    | 29 +++----
 .../server/routes/rs-mutation.ts              | 31 +++++--
 .../stores/collection-revision-store.ts       | 33 ++++++--
 .../server/stores/run-history-writer.ts       |  4 +
 ...device-coverage-revision-atomicity.test.ts | 83 ++++++++++++++++++-
 9 files changed, 217 insertions(+), 37 deletions(-)

diff --git a/reference-implementation/lib/postgres-spine.ts b/reference-implementation/lib/postgres-spine.ts
index 3352c1623..d148e797c 100644
--- a/reference-implementation/lib/postgres-spine.ts
+++ b/reference-implementation/lib/postgres-spine.ts
@@ -11,8 +11,10 @@ import { createHash, randomUUID } from "node:crypto";
 import type { PoolClient } from "pg";
 
 import { postgresQuery, withPostgresTransaction } from "../server/postgres-storage.ts";
+import { advancePostgresCollectionRevisionInTransaction } from "../server/stores/collection-revision-store.ts";
 import {
   isRunHistoryRelevantEventType,
+  isRunTerminalEventType,
   type RunHistorySpineEvent,
   writePostgresRunHistoryForSpineEvent,
 } from "../server/stores/run-history-writer.ts";
@@ -1223,6 +1225,13 @@ async function appendNormalizedPostgresSpineEventInTransaction(
   rawData: unknown,
   hooks: PostgresSpineTransactionHooks = {}
 ): Promise<SpineEventRecord | null> {
+  if (isRunTerminalEventType(event.event_type) && event.connector_instance_id && !hasCollectionRevision(rawData)) {
+    await advancePostgresCollectionRevisionInTransaction(client, event.connector_instance_id, {
+      at: event.occurred_at,
+      event: "terminal_run",
+      runId: event.run_id,
+    });
+  }
   const result = await client.query<SpineEventRow>(SPINE_INSERT_EVENT_SQL, spineInsertEventParams(event));
   await hooks.afterEventInsert?.();
   if (isRunHistoryRelevantEventType(event.event_type)) {
@@ -1252,11 +1261,16 @@ export async function postgresEmitSpineEventInTransaction(
   input: PostgresSpineEventInput = {}
 ): Promise<SpineEventRecord | null> {
   const event = normalize(input);
-  const result = await client.query<SpineEventRow>(SPINE_INSERT_EVENT_SQL, spineInsertEventParams(event));
-  if (isRunHistoryRelevantEventType(event.event_type)) {
-    await writePostgresRunHistoryForSpineEvent(client, toRunHistorySpineEvent(event, input.data));
-  }
-  return hydrate(result.rows[0]);
+  return await appendNormalizedPostgresSpineEventInTransaction(client, event, input.data);
+}
+
+function hasCollectionRevision(data: unknown): boolean {
+  return Boolean(
+    data &&
+      typeof data === "object" &&
+      !Array.isArray(data) &&
+      typeof (data as Record<string, unknown>).collection_revision === "number"
+  );
 }
 
 export async function postgresListSpineEventsPage(
diff --git a/reference-implementation/lib/spine.ts b/reference-implementation/lib/spine.ts
index ae44db4bb..4a1111e86 100644
--- a/reference-implementation/lib/spine.ts
+++ b/reference-implementation/lib/spine.ts
@@ -4,8 +4,10 @@
 import { randomBytes } from "node:crypto";
 import { getDb } from "../server/db.ts";
 import { isPostgresStorageBackend } from "../server/postgres-storage.ts";
+import { advanceSqliteCollectionRevisionInTransaction } from "../server/stores/collection-revision-store.ts";
 import {
   isRunHistoryRelevantEventType,
+  isRunTerminalEventType,
   type RunHistorySpineEvent,
   writeSqliteRunHistoryForSpineEventOn,
 } from "../server/stores/run-history-writer.ts";
@@ -17,6 +19,7 @@ import {
   type Page,
   referenceQueries,
   decodeCursor as wrapperDecodeCursor,
+  writeTransaction,
 } from "./db.ts";
 import {
   deriveTokenAuditId,
@@ -501,6 +504,13 @@ export function appendSqliteSpineEventInTransaction(
   assertRunEventHasConnectorInstanceId(input);
   assertRunStartedIsStamped(input);
   const event = normalizeSpineEventInput(input);
+  if (isRunTerminalEventType(event.event_type) && event.connector_instance_id && !hasCollectionRevision(input.data)) {
+    advanceSqliteCollectionRevisionInTransaction(db, event.connector_instance_id, {
+      at: event.occurred_at,
+      event: "terminal_run",
+      runId: event.run_id,
+    });
+  }
   execNamedOn(db, referenceQueries.spineInsertEvent, event);
   hooks.afterEventInsert?.();
   if (isRunHistoryRelevantEventType(event.event_type)) {
@@ -533,9 +543,21 @@ function insertSqliteSpineEvent(input: SpineEventInput, dbHandle: SpineDatabase
   if (!db) {
     return null;
   }
+  if (!dbHandle && isRunTerminalEventType(input.event_type)) {
+    return writeTransaction(() => appendSqliteSpineEventInTransaction(input, db));
+  }
   return appendSqliteSpineEventInTransaction(input, db);
 }
 
+function hasCollectionRevision(data: unknown): boolean {
+  return Boolean(
+    data &&
+      typeof data === "object" &&
+      !Array.isArray(data) &&
+      typeof (data as Record<string, unknown>).collection_revision === "number"
+  );
+}
+
 /**
  * Write one SQLite spine event before returning to a caller-owned transaction.
  *
diff --git a/reference-implementation/server/index.ts b/reference-implementation/server/index.ts
index da7d876d5..b782fc890 100644
--- a/reference-implementation/server/index.ts
+++ b/reference-implementation/server/index.ts
@@ -7621,14 +7621,14 @@ function buildRsApp(opts: ServerOpts = {}) {
     ingestRecord: (
       target: unknown,
       record: unknown,
-      options?: { requireConnectionAdmission?: boolean; runId?: string | null }
+      options?: Parameters<typeof ingestRecord>[2]
     ) =>
       ingestRecord(target as Parameters<typeof ingestRecord>[0], record as Parameters<typeof ingestRecord>[1], options),
     ingestRecords: (
       target: unknown,
       records: readonly unknown[],
       afterRecord: ((record: unknown, outcome: unknown) => Promise<void>) | undefined,
-      options?: { requireConnectionAdmission?: boolean; runId?: string | null }
+      options?: Parameters<typeof ingestRecords>[3]
     ) =>
       ingestRecords(
         target as Parameters<typeof ingestRecords>[0],
diff --git a/reference-implementation/server/postgres-records.ts b/reference-implementation/server/postgres-records.ts
index 1ef0d4483..fc11fdc23 100644
--- a/reference-implementation/server/postgres-records.ts
+++ b/reference-implementation/server/postgres-records.ts
@@ -67,6 +67,10 @@ import {
   resolveStorageConnectorId,
   resolveStorageConnectorInstanceId,
 } from "./storage-utils.ts";
+import {
+  type CollectionRevisionEventInput,
+  requirePostgresCollectionObservationInTransaction,
+} from "./stores/collection-revision-store.ts";
 import { createPostgresConnectorInstanceStore } from "./stores/connector-instance-store.ts";
 import { advancePostgresDeviceIngestPrefix } from "./stores/device-exporter-store.ts";
 import { markSearchIndexDirtyPostgres } from "./stores/search-index-dirty-store.ts";
@@ -261,6 +265,7 @@ interface IngestRecord {
 
 interface IngestOptions {
   attemptContext?: DeviceAttemptContext | null;
+  collectionRevision?: CollectionRevisionEventInput;
   deviceReservation?: JsonObject & { inputIndex: number };
   /** See RecordIngestOptions.requireConnectionAdmission in server/records.ts. */
   requireConnectionAdmission?: boolean;
@@ -1911,6 +1916,20 @@ async function assertPostgresRunStillAdmitted(
   }
 }
 
+async function assertPostgresRecordIngestPreconditions(
+  client: PostgresTransactionClient,
+  connectorInstanceId: string,
+  options: Pick<IngestOptions, "collectionRevision" | "requireConnectionAdmission" | "runId">
+): Promise<void> {
+  if (options.requireConnectionAdmission) {
+    await assertPostgresConnectorInstanceWritable(client, connectorInstanceId);
+  }
+  await assertPostgresRunStillAdmitted(client, options.runId, connectorInstanceId);
+  if (options.collectionRevision) {
+    await requirePostgresCollectionObservationInTransaction(client, connectorInstanceId, options.collectionRevision);
+  }
+}
+
 /**
  * Opt-in re-check, inside the SAME locked transaction as the mutation it
  * guards, that the `connector_instances` row still exists AND is in a
@@ -2018,10 +2037,7 @@ export async function postgresIngestRecord(
   crashPoint("ingest:before-write-transaction");
   const outcome = await withPostgresTransaction<DurableIngestOutcome>(
     async (client) => {
-      if (options.requireConnectionAdmission) {
-        await assertPostgresConnectorInstanceWritable(client, connectorInstanceId);
-      }
-      await assertPostgresRunStillAdmitted(client, options.runId, connectorInstanceId);
+      await assertPostgresRecordIngestPreconditions(client, connectorInstanceId, options);
       const finishDurableOutcome = async (value: DurableIngestOutcome): Promise<DurableIngestOutcome> => {
         if (options.deviceReservation) {
           await advancePostgresDeviceIngestPrefix(
diff --git a/reference-implementation/server/records.ts b/reference-implementation/server/records.ts
index aed7f16bc..079b3c9d6 100644
--- a/reference-implementation/server/records.ts
+++ b/reference-implementation/server/records.ts
@@ -142,8 +142,10 @@ import {
   resolveStorageConnectorInstanceId,
 } from "./storage-utils.ts";
 import {
+  type CollectionRevisionEventInput,
   type LocalCoverageRevisionFence,
   readLocalCoverageRevisionFences,
+  requireSqliteCollectionObservationInTransaction,
 } from "./stores/collection-revision-store.ts";
 import {
   ConnectorInstanceResolutionError,
@@ -206,6 +208,7 @@ interface AttemptContext {
 type DeviceReservation = Record<string, unknown> & { inputIndex: number };
 interface RecordIngestOptions {
   attemptContext?: AttemptContext;
+  collectionRevision?: CollectionRevisionEventInput;
   coordinatorOwnership?: ConnectorInstanceWriteOwnership;
   deferIndexes?: boolean;
   deviceFinalInputIndex?: number;
@@ -1737,7 +1740,7 @@ export async function ingestRecords(
   storageTarget: RecordStorageTarget,
   records: readonly RecordEnvelope[],
   afterRecord?: RecordIngestAfterRecord,
-  options: Pick<RecordIngestOptions, "requireConnectionAdmission" | "runId"> = {}
+  options: Pick<RecordIngestOptions, "collectionRevision" | "requireConnectionAdmission" | "runId"> = {}
 ): Promise<RecordIngestBatchOutcome[]> {
   const coordinationConnectorId = connectorIdForStorageTarget(storageTarget);
   const coordinationInstanceId = resolveStorageConnectorInstanceId(storageTarget, coordinationConnectorId);
@@ -1746,13 +1749,7 @@ export async function ingestRecords(
     releaseFence = resolve;
   });
   try {
-    const batch = await ingestRecordsWithinCoordinator(
-      storageTarget,
-      records,
-      afterRecord,
-      options.runId,
-      options.requireConnectionAdmission
-    );
+    const batch = await ingestRecordsWithinCoordinator(storageTarget, records, afterRecord, options);
     if (batch.changedRecords.length > 0) {
       // Fire-and-forget: the HTTP batch ack must not await derived index
       // work (see the single-record path's identical reasoning at
@@ -1889,8 +1886,7 @@ async function ingestRecordsWithinCoordinator(
   storageTarget: RecordStorageTarget,
   records: readonly RecordEnvelope[],
   afterRecord?: RecordIngestAfterRecord,
-  runId?: string | null,
-  requireConnectionAdmission?: boolean
+  options: Pick<RecordIngestOptions, "collectionRevision" | "requireConnectionAdmission" | "runId"> = {}
 ): Promise<IngestRecordsWithinCoordinatorResult> {
   const outcomes: Array<RecordIngestBatchOutcome | undefined> = new Array(records.length);
   const changedRecords: DeferredRecordIndex[] = [];
@@ -1906,8 +1902,9 @@ async function ingestRecordsWithinCoordinator(
     // any lock across the whole batch, so only a per-record, in-transaction
     // check closes the delete-or-revoke/write TOCTOU for every record, not
     // just the first.
-    ...(requireConnectionAdmission ? { requireConnectionAdmission } : {}),
-    ...(runId ? { runId } : {}),
+    ...(options.collectionRevision ? { collectionRevision: options.collectionRevision } : {}),
+    ...(options.requireConnectionAdmission ? { requireConnectionAdmission: options.requireConnectionAdmission } : {}),
+    ...(options.runId ? { runId: options.runId } : {}),
   };
   // Computed once per batch, not per record: the storage backend cannot
   // change mid-batch, and this decides whether the explicit yield below
@@ -1965,7 +1962,7 @@ async function ingestRecordsWithinCoordinator(
       // above explains why the detail must appear here at all.
       const logIngestFailure = ingestFailureLogLevel(classified) === "warn" ? console.warn : console.error;
       logIngestFailure(
-        `[records] ingest write failed connector_instance_id=${loggingConnectorInstanceId} run_id=${runId ?? "unknown"} ` +
+        `[records] ingest write failed connector_instance_id=${loggingConnectorInstanceId} run_id=${options.runId ?? "unknown"} ` +
           `stream=${record.stream} code=${classified.code} retryable=${classified.retryable}: ${classified.message}`
       );
     }
@@ -1984,7 +1981,7 @@ async function ingestRecordsWithinCoordinator(
         };
         // Same server-log-only rationale as the write-failure branch above.
         console.error(
-          `[records] ingest afterRecord failed connector_instance_id=${loggingConnectorInstanceId} run_id=${runId ?? "unknown"} ` +
+          `[records] ingest afterRecord failed connector_instance_id=${loggingConnectorInstanceId} run_id=${options.runId ?? "unknown"} ` +
             `stream=${record.stream} code=${classified.code} retryable=${classified.retryable}: ${classified.message}`
         );
       }
@@ -2066,6 +2063,7 @@ function toPostgresIngestOptions(options: RecordIngestOptions) {
   const attemptContext = toPostgresAttemptContext(options.attemptContext);
   return {
     ...(attemptContext ? { attemptContext } : {}),
+    ...(options.collectionRevision ? { collectionRevision: options.collectionRevision } : {}),
     ...(options.deviceReservation ? { deviceReservation: options.deviceReservation } : {}),
     ...(options.requireConnectionAdmission ? { requireConnectionAdmission: options.requireConnectionAdmission } : {}),
     ...(options.runId ? { runId: options.runId } : {}),
@@ -2322,6 +2320,9 @@ async function ingestSqliteRecord(
     if (options.requireConnectionAdmission) {
       assertSqliteConnectorInstanceWritableWithinTransaction(connectorInstanceId);
     }
+    if (options.collectionRevision) {
+      requireSqliteCollectionObservationInTransaction(getDb(), connectorInstanceId, options.collectionRevision);
+    }
     const finishDurableOutcome = (value: DurableIngestOutcome): DurableIngestOutcome => {
       if (options.deviceReservation) {
         advanceSqliteDeviceIngestPrefix(options.deviceReservation, options.deviceReservation.inputIndex);
diff --git a/reference-implementation/server/routes/rs-mutation.ts b/reference-implementation/server/routes/rs-mutation.ts
index 23d494323..fb0ca173c 100644
--- a/reference-implementation/server/routes/rs-mutation.ts
+++ b/reference-implementation/server/routes/rs-mutation.ts
@@ -87,6 +87,7 @@ import {
 } from "../../operations/rs-records-ingest/index.ts";
 import { canonicalConnectorKey } from "../connector-key.ts";
 import { HOSTED_INGEST_MAX_LINE_BYTES } from "../hosted-ingest-limits.ts";
+import type { CollectionRevisionEventInput } from "../stores/collection-revision-store.ts";
 import type { MiddlewareHandler, PdppErrorFn, RouteArg } from "./_route-contract.ts";
 
 // Express-shaped surface, structurally typed to avoid pulling in the
@@ -236,10 +237,12 @@ async function ingestRecordClassified(
   ctx: MountRsMutationContext,
   namespace: ConnectorNamespaceLike,
   record: Record<string, unknown>,
-  runId: string | null
+  runId: string | null,
+  collectionRevision?: CollectionRevisionEventInput
 ): Promise<unknown> {
   try {
     return await ctx.ingestRecord(ctx.storageTargetForConnectorNamespace(namespace), record, {
+      ...(collectionRevision ? { collectionRevision } : {}),
       requireConnectionAdmission: Boolean(namespace.connectorInstanceId),
       runId,
     });
@@ -431,14 +434,22 @@ export interface MountRsMutationContext {
   readonly ingestRecord: (
     target: StorageTargetLike,
     record: unknown,
-    options?: { requireConnectionAdmission?: boolean; runId?: string | null }
+    options?: {
+      collectionRevision?: CollectionRevisionEventInput;
+      requireConnectionAdmission?: boolean;
+      runId?: string | null;
+    }
   ) => Promise<unknown>;
   /** Optional common-path batch capability; hosts without it use the ordered fallback. */
   readonly ingestRecords?: (
     target: StorageTargetLike,
     records: readonly unknown[],
     afterRecord?: (record: unknown, outcome: unknown) => Promise<void>,
-    options?: { requireConnectionAdmission?: boolean; runId?: string | null }
+    options?: {
+      collectionRevision?: CollectionRevisionEventInput;
+      requireConnectionAdmission?: boolean;
+      runId?: string | null;
+    }
   ) => Promise<readonly unknown[]>;
   readonly insertOrReplayRecordRejection?: (input: {
     auditActorId: string;
@@ -1204,7 +1215,10 @@ export function mountRsRecordsIngest(app: AppLike, ctx: MountRsMutationContext):
         },
         ingestRecord: async (cid: string, _cin: string | null, record: Record<string, unknown>) => {
           const namespace = storageNamespace ?? (await resolveAdmittedNamespace(cid, _cin));
-          const result = await ingestRecordClassified(ctx, namespace, record, runId);
+          const collectionRevision = namespace.connectorInstanceId
+            ? { at: new Date().toISOString(), event: "batch_record" as const, runId }
+            : undefined;
+          const result = await ingestRecordClassified(ctx, namespace, record, runId, collectionRevision);
           if (ctx.getLatestAcquisitionBatchForConnection && namespace.connectorInstanceId) {
             acquisitionBatchPromise ??= Promise.resolve(
               ctx.getLatestAcquisitionBatchForConnection(namespace.connectorInstanceId)
@@ -1255,6 +1269,9 @@ export function mountRsRecordsIngest(app: AppLike, ctx: MountRsMutationContext):
                 records: readonly Record<string, unknown>[]
               ): Promise<readonly (IngestLineFailure | null)[]> {
                 const namespace = storageNamespace ?? (await resolveAdmittedNamespace(cid, cin));
+                const collectionRevision = namespace.connectorInstanceId
+                  ? { at: new Date().toISOString(), event: "batch_record" as const, runId }
+                  : undefined;
                 // biome-ignore lint/suspicious/noUnnecessaryConditions: Express route params are nullable at runtime even though the local adapter type narrows them.
                 const streamName = req.params.stream ?? "";
                 const getLatestAcquisitionBatch = ctx.getLatestAcquisitionBatchForConnection;
@@ -1282,7 +1299,11 @@ export function mountRsRecordsIngest(app: AppLike, ctx: MountRsMutationContext):
                   ctx.storageTargetForConnectorNamespace(namespace),
                   records,
                   afterRecord,
-                  { requireConnectionAdmission: Boolean(namespace.connectorInstanceId), runId }
+                  {
+                    ...(collectionRevision ? { collectionRevision } : {}),
+                    requireConnectionAdmission: Boolean(namespace.connectorInstanceId),
+                    runId,
+                  }
                 );
                 return mapBatchIngestOutcomes(records, outcomes);
               },
diff --git a/reference-implementation/server/stores/collection-revision-store.ts b/reference-implementation/server/stores/collection-revision-store.ts
index d192dfaf7..1e7c0af28 100644
--- a/reference-implementation/server/stores/collection-revision-store.ts
+++ b/reference-implementation/server/stores/collection-revision-store.ts
@@ -115,8 +115,10 @@ interface AdvancedRevision {
 // Move the run-order marker for an observation that has just taken `revision`.
 // The observation's run sequence is its own run's issued sequence in the
 // current storage epoch, else the newest issued sequence (with no run id). The
-// marker moves when that sequence is at least the highest observed one. The
-// caller's revision UPDATE already holds the connection row lock.
+// marker moves when that sequence is at least the highest observed one. An
+// explicit run id with no issued sequence is marked `unsequenced_attempt` and
+// stays ineligible at that sequence, even if a run was already pending there.
+// The caller's revision UPDATE already holds the connection row lock.
 const RUN_ORDER_OBSERVATION = `SELECT COALESCE(rs.run_sequence, ci.run_sequence_issued) AS seq,
                 rs.run_id AS run_id, rs.run_sequence AS run_sequence, ci.storage_epoch AS storage_epoch
            FROM connector_instances ci
@@ -230,11 +232,25 @@ export function advanceSqliteCollectionRevisionInTransaction(
     connectorInstanceId,
     input.event
   );
+  const runOrderEvent =
+    input.runId !== null && input.runId !== undefined && observation.runSequence === null
+      ? "unsequenced_attempt"
+      : input.event;
   db.prepare(
     `UPDATE connector_instances
         SET run_order_sequence = ?, run_order_event = ?, run_order_run_id = ?, run_order_revision = ?
-      WHERE connector_instance_id = ? AND run_order_sequence <= ?`
-  ).run(observation.seq, input.event, observation.runId, advanced.revision, connectorInstanceId, observation.seq);
+      WHERE connector_instance_id = ? AND run_order_sequence <= ?
+        AND NOT (run_order_sequence = ? AND run_order_event = 'unsequenced_attempt' AND ? IS NOT NULL)`
+  ).run(
+    observation.seq,
+    runOrderEvent,
+    observation.runId,
+    advanced.revision,
+    connectorInstanceId,
+    observation.seq,
+    observation.seq,
+    observation.runSequence
+  );
   return { ...advanced, runSequence: observation.runSequence, storageEpoch: observation.storageEpoch };
 }
 
@@ -282,11 +298,16 @@ export async function advancePostgresCollectionRevisionInTransaction(
     connectorInstanceId,
     input.event
   );
+  const runOrderEvent =
+    input.runId !== null && input.runId !== undefined && observation.runSequence === null
+      ? "unsequenced_attempt"
+      : input.event;
   await client.query(
     `UPDATE connector_instances
         SET run_order_sequence = $1, run_order_event = $2, run_order_run_id = $3, run_order_revision = $4
-      WHERE connector_instance_id = $5 AND run_order_sequence <= $1`,
-    [observation.seq, input.event, observation.runId, advanced.revision, connectorInstanceId]
+      WHERE connector_instance_id = $5 AND run_order_sequence <= $1
+        AND NOT (run_order_sequence = $1 AND run_order_event = 'unsequenced_attempt' AND $6 IS NOT NULL)`,
+    [observation.seq, runOrderEvent, observation.runId, advanced.revision, connectorInstanceId, observation.runSequence]
   );
   return { ...advanced, runSequence: observation.runSequence, storageEpoch: observation.storageEpoch };
 }
diff --git a/reference-implementation/server/stores/run-history-writer.ts b/reference-implementation/server/stores/run-history-writer.ts
index fab53d152..a8d19faf6 100644
--- a/reference-implementation/server/stores/run-history-writer.ts
+++ b/reference-implementation/server/stores/run-history-writer.ts
@@ -76,6 +76,10 @@ export function isRunHistoryRelevantEventType(eventType: string | null | undefin
   );
 }
 
+export function isRunTerminalEventType(eventType: string | null | undefined): boolean {
+  return RUN_TERMINAL_EVENT_TYPES.has(eventType ?? "");
+}
+
 export interface RunHistorySpineEvent {
   readonly connectorId: string | null;
   readonly connectorInstanceId: string | null;
diff --git a/reference-implementation/test/local-device-coverage-revision-atomicity.test.ts b/reference-implementation/test/local-device-coverage-revision-atomicity.test.ts
index 07500c89f..5474bb266 100644
--- a/reference-implementation/test/local-device-coverage-revision-atomicity.test.ts
+++ b/reference-implementation/test/local-device-coverage-revision-atomicity.test.ts
@@ -24,6 +24,7 @@ import test from "node:test";
 
 import { validateResponse } from "@pdpp/reference-contract";
 
+import { emitSpineEvent } from "../lib/spine.ts";
 import { COLLECTOR_PROTOCOL_VERSION } from "../server/collector-protocol.ts";
 import { reconcileDirtyConnectorSummaryEvidence } from "../server/connector-summary-read-model.ts";
 import { closeDb, getDb, initDb } from "../server/db.ts";
@@ -82,6 +83,8 @@ interface Lane {
   readonly asUrl: string;
   readonly backend: Backend;
   readonly enrolled: Enrolled;
+  readonly getRuntimeOwnerToken?: () => Promise<string>;
+  readonly rsUrl?: string;
 }
 
 interface JsonResponse {
@@ -247,11 +250,16 @@ async function withServerLane(
   }
   await server.startupBackfillDone?.catch(() => undefined);
   const asUrl = `http://localhost:${server.asPort}`;
+  const rsUrl = `http://localhost:${server.rsPort}`;
   __setLocalCollectorReleaseForTest(CONNECTOR_ID, SERVER_RELEASE);
   try {
     const cookie = await ownerSessionCookie(asUrl);
     const enrolled = await enroll(asUrl, cookie);
-    const lane = { asUrl, backend, enrolled };
+    const getRuntimeOwnerToken = async () => {
+      assert.ok(server.controller, "the reference runtime controller is available");
+      return await server.controller.issueRuntimeOwnerToken();
+    };
+    const lane = { asUrl, backend, enrolled, rsUrl, getRuntimeOwnerToken };
     await registerFixtureManifest(lane);
     await run(lane);
   } finally {
@@ -1354,6 +1362,79 @@ laneTest("run order: an unregistered attempt retires prior coverage and cannot e
   await assertCovered(lane, "run-registered", "a registered run's proof is current");
 });
 
+laneTest("cross-runtime reference records and failures retire device coverage without run sequences", async (lane) => {
+  await commitProof(lane, "device-run-covered");
+  const pendingDeviceRunId = "device-run-pending-after-reference";
+  await issueRun(lane, pendingDeviceRunId);
+
+  const referenceRunId = "reference-run-record-batch";
+  // A reference runtime run normally creates this admission row at run.started;
+  // it deliberately has no collection_run_sequences entry.
+  await sql(
+    lane,
+    `INSERT INTO run_history(run_id, connector_instance_id, connector_id, source_json, status, known_gaps_json, started_at, attempt)
+     VALUES (?, ?, ?, '{}', 'running', '[]', ?, 1)`,
+    `INSERT INTO run_history(run_id, connector_instance_id, connector_id, source_json, status, known_gaps_json, started_at, attempt)
+     VALUES ($1, $2, $3, '{}'::jsonb, 'running', '[]'::jsonb, $4, 1)`,
+    [referenceRunId, lane.enrolled.connector_instance_id, CONNECTOR_ID, EMITTED_AT]
+  );
+  const { getRuntimeOwnerToken, rsUrl } = lane;
+  assert.ok(rsUrl, "the cross-runtime lane exposes the reference resource server");
+  assert.ok(getRuntimeOwnerToken, "the cross-runtime lane can mint a runtime owner token");
+  const ingestUrl = new URL("/v1/ingest/sessions", rsUrl);
+  ingestUrl.searchParams.set("connector_id", CONNECTOR_ID);
+  ingestUrl.searchParams.set("connector_instance_id", lane.enrolled.connector_instance_id);
+  ingestUrl.searchParams.set("run_id", referenceRunId);
+  const runtimeOwnerToken = await getRuntimeOwnerToken();
+  const ingested = await requestJson(ingestUrl.toString(), {
+    body: `${JSON.stringify({ data: { id: "reference-record" }, emitted_at: EMITTED_AT, key: "reference-record" })}\n`,
+    headers: {
+      Authorization: `Bearer ${runtimeOwnerToken}`,
+      "Content-Type": "application/x-ndjson",
+    },
+    method: "POST",
+  });
+  assert.equal(ingested.status, 200, JSON.stringify(ingested.body));
+  assert.equal(ingested.body?.records_accepted, 1, JSON.stringify(ingested.body));
+  assert.equal((await highWater(lane)).event, "batch_record");
+  const referenceObservation = await runOrder(lane);
+  assert.equal(referenceObservation.sequence, 2, "the unsequenced reference run counts at the latest issued sequence");
+  assert.equal(referenceObservation.runId, null, "the reference run has no device run sequence and cannot name one");
+  assert.equal(referenceObservation.event, "unsequenced_attempt");
+  await assertRetired(lane, "the reference runtime's accepted record retires the device positive");
+
+  await commitIssuedProof(lane, pendingDeviceRunId);
+  assert.equal(
+    (await runOrder(lane)).runId,
+    null,
+    "a same-sequence device terminal cannot replace the unsequenced observation"
+  );
+  await assertRetired(lane, "a device run already pending when the reference observation arrived is not eligible");
+
+  await commitProof(lane, "device-run-covered-again");
+  await assertCovered(lane, "device-run-covered-again", "a later device run gets a newer sequence and proves coverage");
+  const referenceFailureRunId = "reference-run-failed-without-sequence";
+  await emitSpineEvent({
+    actor_id: CONNECTOR_ID,
+    actor_type: "runtime",
+    data: {
+      connector_instance_id: lane.enrolled.connector_instance_id,
+      reason: "connector_reported_failed",
+      source: { id: CONNECTOR_ID, kind: "connector" },
+    },
+    event_type: "run.failed",
+    object_id: referenceFailureRunId,
+    object_type: "run",
+    run_id: referenceFailureRunId,
+    status: "failed",
+  });
+  assert.equal((await highWater(lane)).event, "terminal_run");
+  const failureObservation = await runOrder(lane);
+  assert.equal(failureObservation.runId, null, "the reference failure has no issued device sequence");
+  assert.equal(failureObservation.event, "unsequenced_attempt");
+  await assertRetired(lane, "a reference-runtime failure report retires the device positive");
+});
+
 laneTest("run start alone leaves earlier coverage and its as-of standing", async (lane) => {
   await commitProof(lane, "run-covered");
   const before = await projection(lane);

From 9fa54894c67a8a5e177390d8cb9f1548f9b869e3 Mon Sep 17 00:00:00 2001
From: Tim Nunamaker <tnunamak@gmail.com>
Date: Thu, 22 Oct 2026 21:28:18 -0500
Subject: [PATCH 69/87] Gate collection observations on current-epoch device
 runs

Reference-runtime writes could lock a connection and fail ingestion even when no current-epoch device run exists to hold a positive store coverage claim. The first record admission check reads for a current-storage-epoch collection_run_sequences row once per batch; without a match, the batch skips revision writes, while a match preserves per-record observations so a later write can retire a positive committed mid-run. Terminal failures use the same gate, and tests cover retired positives plus successful ingestion when revision storage fails without a current-epoch sequence.

Assisted-by: AI
Signed-off-by: Tim Nunamaker <tnunamak@gmail.com>
---
 .../lib/postgres-spine.ts                     |  12 +-
 reference-implementation/lib/spine.ts         |  12 +-
 .../server/postgres-records.ts                |  50 +++++-
 .../get-write-gate-state.sql                  |  10 ++
 .../server/queries/index.ts                   |   1 +
 reference-implementation/server/records.ts    |  53 +++++-
 .../stores/collection-revision-store.ts       |  72 ++++++++
 ...device-coverage-revision-atomicity.test.ts | 158 +++++++++++++++---
 8 files changed, 326 insertions(+), 42 deletions(-)
 create mode 100644 reference-implementation/server/queries/connector-instances/get-write-gate-state.sql

diff --git a/reference-implementation/lib/postgres-spine.ts b/reference-implementation/lib/postgres-spine.ts
index d148e797c..739d609c4 100644
--- a/reference-implementation/lib/postgres-spine.ts
+++ b/reference-implementation/lib/postgres-spine.ts
@@ -11,7 +11,10 @@ import { createHash, randomUUID } from "node:crypto";
 import type { PoolClient } from "pg";
 
 import { postgresQuery, withPostgresTransaction } from "../server/postgres-storage.ts";
-import { advancePostgresCollectionRevisionInTransaction } from "../server/stores/collection-revision-store.ts";
+import {
+  advancePostgresCollectionRevisionInTransaction,
+  hasIssuedCollectionRunSequenceInPostgresTransaction,
+} from "../server/stores/collection-revision-store.ts";
 import {
   isRunHistoryRelevantEventType,
   isRunTerminalEventType,
@@ -1225,7 +1228,12 @@ async function appendNormalizedPostgresSpineEventInTransaction(
   rawData: unknown,
   hooks: PostgresSpineTransactionHooks = {}
 ): Promise<SpineEventRecord | null> {
-  if (isRunTerminalEventType(event.event_type) && event.connector_instance_id && !hasCollectionRevision(rawData)) {
+  if (
+    isRunTerminalEventType(event.event_type) &&
+    event.connector_instance_id &&
+    !hasCollectionRevision(rawData) &&
+    (await hasIssuedCollectionRunSequenceInPostgresTransaction(client, event.connector_instance_id))
+  ) {
     await advancePostgresCollectionRevisionInTransaction(client, event.connector_instance_id, {
       at: event.occurred_at,
       event: "terminal_run",
diff --git a/reference-implementation/lib/spine.ts b/reference-implementation/lib/spine.ts
index 4a1111e86..9b5ab1386 100644
--- a/reference-implementation/lib/spine.ts
+++ b/reference-implementation/lib/spine.ts
@@ -4,7 +4,10 @@
 import { randomBytes } from "node:crypto";
 import { getDb } from "../server/db.ts";
 import { isPostgresStorageBackend } from "../server/postgres-storage.ts";
-import { advanceSqliteCollectionRevisionInTransaction } from "../server/stores/collection-revision-store.ts";
+import {
+  advanceSqliteCollectionRevisionInTransaction,
+  hasIssuedCollectionRunSequenceInSqliteTransaction,
+} from "../server/stores/collection-revision-store.ts";
 import {
   isRunHistoryRelevantEventType,
   isRunTerminalEventType,
@@ -504,7 +507,12 @@ export function appendSqliteSpineEventInTransaction(
   assertRunEventHasConnectorInstanceId(input);
   assertRunStartedIsStamped(input);
   const event = normalizeSpineEventInput(input);
-  if (isRunTerminalEventType(event.event_type) && event.connector_instance_id && !hasCollectionRevision(input.data)) {
+  if (
+    isRunTerminalEventType(event.event_type) &&
+    event.connector_instance_id &&
+    !hasCollectionRevision(input.data) &&
+    hasIssuedCollectionRunSequenceInSqliteTransaction(db, event.connector_instance_id)
+  ) {
     advanceSqliteCollectionRevisionInTransaction(db, event.connector_instance_id, {
       at: event.occurred_at,
       event: "terminal_run",
diff --git a/reference-implementation/server/postgres-records.ts b/reference-implementation/server/postgres-records.ts
index fc11fdc23..0b3d48083 100644
--- a/reference-implementation/server/postgres-records.ts
+++ b/reference-implementation/server/postgres-records.ts
@@ -68,8 +68,10 @@ import {
   resolveStorageConnectorInstanceId,
 } from "./storage-utils.ts";
 import {
+  type CollectionObservationGate,
   type CollectionRevisionEventInput,
   requirePostgresCollectionObservationInTransaction,
+  setCollectionObservationGate,
 } from "./stores/collection-revision-store.ts";
 import { createPostgresConnectorInstanceStore } from "./stores/connector-instance-store.ts";
 import { advancePostgresDeviceIngestPrefix } from "./stores/device-exporter-store.ts";
@@ -265,6 +267,7 @@ interface IngestRecord {
 
 interface IngestOptions {
   attemptContext?: DeviceAttemptContext | null;
+  collectionObservationGate?: CollectionObservationGate;
   collectionRevision?: CollectionRevisionEventInput;
   deviceReservation?: JsonObject & { inputIndex: number };
   /** See RecordIngestOptions.requireConnectionAdmission in server/records.ts. */
@@ -1919,13 +1922,33 @@ async function assertPostgresRunStillAdmitted(
 async function assertPostgresRecordIngestPreconditions(
   client: PostgresTransactionClient,
   connectorInstanceId: string,
-  options: Pick<IngestOptions, "collectionRevision" | "requireConnectionAdmission" | "runId">
+  options: Pick<
+    IngestOptions,
+    "collectionObservationGate" | "collectionRevision" | "requireConnectionAdmission" | "runId"
+  >
 ): Promise<void> {
+  const collectionObservationGate = options.collectionRevision
+    ? (options.collectionObservationGate ?? { checked: false, enabled: false })
+    : undefined;
   if (options.requireConnectionAdmission) {
-    await assertPostgresConnectorInstanceWritable(client, connectorInstanceId);
+    await assertPostgresConnectorInstanceWritable(client, connectorInstanceId, collectionObservationGate);
   }
   await assertPostgresRunStillAdmitted(client, options.runId, connectorInstanceId);
-  if (options.collectionRevision) {
+  if (options.collectionRevision && collectionObservationGate && !collectionObservationGate.checked) {
+    const result = await client.query<{ current_epoch_run_sequence_issued: unknown }>(
+      `SELECT EXISTS (
+         SELECT 1 FROM collection_run_sequences AS rs
+          WHERE rs.connector_instance_id = ci.connector_instance_id
+            AND rs.storage_epoch = ci.storage_epoch
+       ) AS current_epoch_run_sequence_issued
+         FROM connector_instances AS ci
+        WHERE ci.connector_instance_id = $1
+        FOR UPDATE OF ci`,
+      [connectorInstanceId]
+    );
+    setCollectionObservationGate(collectionObservationGate, result.rows[0]?.current_epoch_run_sequence_issued);
+  }
+  if (options.collectionRevision && collectionObservationGate?.enabled) {
     await requirePostgresCollectionObservationInTransaction(client, connectorInstanceId, options.collectionRevision);
   }
 }
@@ -1983,14 +2006,29 @@ async function maybeAfterConnectorInstanceAdmissionLockPhase(
 
 async function assertPostgresConnectorInstanceWritable(
   client: PostgresTransactionClient,
-  connectorInstanceId: string
+  connectorInstanceId: string,
+  collectionObservationGate?: CollectionObservationGate
 ): Promise<void> {
+  const readsRunOrder = collectionObservationGate && !collectionObservationGate.checked;
   const {
     rows: [row],
-  } = await client.query<{ status: string }>(
-    "SELECT status FROM connector_instances WHERE connector_instance_id = $1 FOR UPDATE",
+  } = await client.query<{ current_epoch_run_sequence_issued?: unknown; status: string }>(
+    readsRunOrder
+      ? `SELECT ci.status,
+                EXISTS (
+                  SELECT 1 FROM collection_run_sequences AS rs
+                   WHERE rs.connector_instance_id = ci.connector_instance_id
+                     AND rs.storage_epoch = ci.storage_epoch
+                ) AS current_epoch_run_sequence_issued
+           FROM connector_instances AS ci
+          WHERE ci.connector_instance_id = $1
+          FOR UPDATE OF ci`
+      : "SELECT status FROM connector_instances WHERE connector_instance_id = $1 FOR UPDATE",
     [connectorInstanceId]
   );
+  if (readsRunOrder && collectionObservationGate) {
+    setCollectionObservationGate(collectionObservationGate, row?.current_epoch_run_sequence_issued);
+  }
   await maybeAfterConnectorInstanceAdmissionLockPhase("after-connector-instance-admission-lock", {
     connectorInstanceId,
   });
diff --git a/reference-implementation/server/queries/connector-instances/get-write-gate-state.sql b/reference-implementation/server/queries/connector-instances/get-write-gate-state.sql
new file mode 100644
index 000000000..6f6fe8b0c
--- /dev/null
+++ b/reference-implementation/server/queries/connector-instances/get-write-gate-state.sql
@@ -0,0 +1,10 @@
+-- @terminator: one
+SELECT ci.status,
+       EXISTS (
+         SELECT 1 FROM collection_run_sequences AS rs
+          WHERE rs.connector_instance_id = ci.connector_instance_id
+            AND rs.storage_epoch = ci.storage_epoch
+       ) AS current_epoch_run_sequence_issued
+  FROM connector_instances AS ci
+ WHERE ci.connector_instance_id = ?
+LIMIT 1;
diff --git a/reference-implementation/server/queries/index.ts b/reference-implementation/server/queries/index.ts
index dbb5fe543..2c8da6ea7 100644
--- a/reference-implementation/server/queries/index.ts
+++ b/reference-implementation/server/queries/index.ts
@@ -306,6 +306,7 @@ export interface ReferenceQueryRegistry extends Readonly<Record<string, Register
   readonly connectorInstancesGetById: ReadOneQuery;
   readonly connectorInstancesGetTombstoneByBinding: ReadOneQuery;
   readonly connectorInstancesGetTombstoneByConnectionId: ReadOneQuery;
+  readonly connectorInstancesGetWriteGateState: ReadOneQuery;
   readonly connectorInstancesInsert: MutationQuery;
   readonly connectorInstancesInsertTombstone: MutationQuery;
   readonly connectorInstancesListActiveByOwnerConnector: ReadManyQuery;
diff --git a/reference-implementation/server/records.ts b/reference-implementation/server/records.ts
index 079b3c9d6..32ed7e300 100644
--- a/reference-implementation/server/records.ts
+++ b/reference-implementation/server/records.ts
@@ -142,10 +142,12 @@ import {
   resolveStorageConnectorInstanceId,
 } from "./storage-utils.ts";
 import {
+  type CollectionObservationGate,
   type CollectionRevisionEventInput,
   type LocalCoverageRevisionFence,
   readLocalCoverageRevisionFences,
   requireSqliteCollectionObservationInTransaction,
+  setCollectionObservationGate,
 } from "./stores/collection-revision-store.ts";
 import {
   ConnectorInstanceResolutionError,
@@ -208,6 +210,7 @@ interface AttemptContext {
 type DeviceReservation = Record<string, unknown> & { inputIndex: number };
 interface RecordIngestOptions {
   attemptContext?: AttemptContext;
+  collectionObservationGate?: CollectionObservationGate;
   collectionRevision?: CollectionRevisionEventInput;
   coordinatorOwnership?: ConnectorInstanceWriteOwnership;
   deferIndexes?: boolean;
@@ -1663,13 +1666,43 @@ export async function assertConnectorInstanceWritable(connectorInstanceId: strin
  * transaction, never before it. See
  * harden-connector-instance-write-fence-transaction-native.
  */
-export function assertSqliteConnectorInstanceWritableWithinTransaction(connectorInstanceId: string): void {
-  const status =
-    (getOne(referenceQueries.connectorInstancesGetById, [connectorInstanceId]) as { status?: string } | null)?.status ??
-    null;
+export function assertSqliteConnectorInstanceWritableWithinTransaction(
+  connectorInstanceId: string,
+  collectionObservationGate?: CollectionObservationGate
+): void {
+  const readsRunOrder = collectionObservationGate?.checked === false;
+  const row: { current_epoch_run_sequence_issued?: unknown; status?: string } | null = readsRunOrder
+    ? (getOne(referenceQueries.connectorInstancesGetWriteGateState, [connectorInstanceId]) as {
+        current_epoch_run_sequence_issued?: unknown;
+        status?: string;
+      } | null)
+    : (getOne(referenceQueries.connectorInstancesGetById, [connectorInstanceId]) as { status?: string } | null);
+  if (collectionObservationGate?.checked === false) {
+    setCollectionObservationGate(collectionObservationGate, row?.current_epoch_run_sequence_issued);
+  }
+  const status = row?.status ?? null;
   assertConnectorInstanceStatusWritable(status, connectorInstanceId);
 }
 
+function maybeObserveSqliteCollectionRevision(
+  connectorInstanceId: string,
+  collectionRevision: CollectionRevisionEventInput | undefined,
+  gate: CollectionObservationGate | undefined
+): void {
+  if (!(collectionRevision && gate)) {
+    return;
+  }
+  if (!gate.checked) {
+    const row = getOne(referenceQueries.connectorInstancesGetWriteGateState, [connectorInstanceId]) as {
+      current_epoch_run_sequence_issued?: unknown;
+    } | null;
+    setCollectionObservationGate(gate, row?.current_epoch_run_sequence_issued);
+  }
+  if (gate.enabled) {
+    requireSqliteCollectionObservationInTransaction(getDb(), connectorInstanceId, collectionRevision);
+  }
+}
+
 /**
  * Ingest a RECORD envelope (owner-authenticated).
  *
@@ -1892,6 +1925,7 @@ async function ingestRecordsWithinCoordinator(
   const changedRecords: DeferredRecordIndex[] = [];
   const loggingConnectorId = connectorIdForStorageTarget(storageTarget);
   const loggingConnectorInstanceId = resolveStorageConnectorInstanceId(storageTarget, loggingConnectorId);
+  const collectionObservationGate: CollectionObservationGate = { checked: false, enabled: false };
   const perRecordOptions: RecordIngestOptions = {
     deferIndexes: true,
     // Re-verified inside EVERY record's own durable write transaction on
@@ -1903,6 +1937,7 @@ async function ingestRecordsWithinCoordinator(
     // check closes the delete-or-revoke/write TOCTOU for every record, not
     // just the first.
     ...(options.collectionRevision ? { collectionRevision: options.collectionRevision } : {}),
+    collectionObservationGate,
     ...(options.requireConnectionAdmission ? { requireConnectionAdmission: options.requireConnectionAdmission } : {}),
     ...(options.runId ? { runId: options.runId } : {}),
   };
@@ -2063,6 +2098,7 @@ function toPostgresIngestOptions(options: RecordIngestOptions) {
   const attemptContext = toPostgresAttemptContext(options.attemptContext);
   return {
     ...(attemptContext ? { attemptContext } : {}),
+    ...(options.collectionObservationGate ? { collectionObservationGate: options.collectionObservationGate } : {}),
     ...(options.collectionRevision ? { collectionRevision: options.collectionRevision } : {}),
     ...(options.deviceReservation ? { deviceReservation: options.deviceReservation } : {}),
     ...(options.requireConnectionAdmission ? { requireConnectionAdmission: options.requireConnectionAdmission } : {}),
@@ -2286,6 +2322,9 @@ async function ingestSqliteRecord(
   const { stream, key, data, emitted_at, op = "upsert" } = record;
   const recordKey = encodeKey(key);
   const recordJson = data ? JSON.stringify(data) : null;
+  const collectionObservationGate = options.collectionRevision
+    ? (options.collectionObservationGate ?? { checked: false, enabled: false })
+    : undefined;
 
   // Validate record identity against the manifest-declared primary_key. The
   // record `key` is the ordered tuple of primary-key field values; each
@@ -2318,11 +2357,9 @@ async function ingestSqliteRecord(
   const outcome = writeTransaction<DurableIngestOutcome>(() => {
     assertSqliteRunStillAdmitted(options.runId, connectorInstanceId);
     if (options.requireConnectionAdmission) {
-      assertSqliteConnectorInstanceWritableWithinTransaction(connectorInstanceId);
-    }
-    if (options.collectionRevision) {
-      requireSqliteCollectionObservationInTransaction(getDb(), connectorInstanceId, options.collectionRevision);
+      assertSqliteConnectorInstanceWritableWithinTransaction(connectorInstanceId, collectionObservationGate);
     }
+    maybeObserveSqliteCollectionRevision(connectorInstanceId, options.collectionRevision, collectionObservationGate);
     const finishDurableOutcome = (value: DurableIngestOutcome): DurableIngestOutcome => {
       if (options.deviceReservation) {
         advanceSqliteDeviceIngestPrefix(options.deviceReservation, options.deviceReservation.inputIndex);
diff --git a/reference-implementation/server/stores/collection-revision-store.ts b/reference-implementation/server/stores/collection-revision-store.ts
index 1e7c0af28..084c1358c 100644
--- a/reference-implementation/server/stores/collection-revision-store.ts
+++ b/reference-implementation/server/stores/collection-revision-store.ts
@@ -61,6 +61,11 @@ interface PostgresHandle {
   query: (sql: string, params: readonly unknown[]) => Promise<{ readonly rows: readonly unknown[] }>;
 }
 
+export interface CollectionObservationGate {
+  checked: boolean;
+  enabled: boolean;
+}
+
 /**
  * The revision for an observed event could not be recorded, so the event
  * itself must not commit or be acknowledged. Device routes answer it with
@@ -104,6 +109,73 @@ export function readCollectionRevision(value: unknown): number | null {
   return typeof revision === "number" && Number.isSafeInteger(revision) && revision >= 0 ? revision : null;
 }
 
+export function currentEpochRunSequenceExists(value: unknown): boolean {
+  return value === true || value === 1 || value === "1";
+}
+
+export function setCollectionObservationGate(
+  gate: CollectionObservationGate,
+  currentEpochSequenceExists: unknown
+): void {
+  if (gate.checked) {
+    return;
+  }
+  gate.checked = true;
+  gate.enabled = currentEpochRunSequenceExists(currentEpochSequenceExists);
+}
+
+/** Read the run-order gate from the caller's handle when its schema has both required tables. */
+export function hasIssuedCollectionRunSequenceInSqliteTransaction(
+  db: SqliteHandle,
+  connectorInstanceId: string
+): boolean {
+  const table = db
+    .prepare(
+      `SELECT 1 AS present FROM sqlite_schema
+        WHERE type = 'table'
+          AND name = 'connector_instances'
+          AND EXISTS (
+            SELECT 1 FROM sqlite_schema WHERE type = 'table' AND name = 'collection_run_sequences'
+          )`
+    )
+    .get();
+  if (!table) {
+    return false;
+  }
+  const row = db
+    .prepare(
+      `SELECT EXISTS (
+         SELECT 1 FROM collection_run_sequences AS rs
+          WHERE rs.connector_instance_id = ci.connector_instance_id
+            AND rs.storage_epoch = ci.storage_epoch
+       ) AS current_epoch_run_sequence_issued
+         FROM connector_instances AS ci
+        WHERE ci.connector_instance_id = ?`
+    )
+    .get(connectorInstanceId) as { current_epoch_run_sequence_issued?: unknown } | undefined;
+  return currentEpochRunSequenceExists(row?.current_epoch_run_sequence_issued);
+}
+
+/** Read the run-order gate and lock its connection row on the caller's transaction handle. */
+export async function hasIssuedCollectionRunSequenceInPostgresTransaction(
+  client: PostgresHandle,
+  connectorInstanceId: string
+): Promise<boolean> {
+  const result = await client.query(
+    `SELECT EXISTS (
+       SELECT 1 FROM collection_run_sequences AS rs
+        WHERE rs.connector_instance_id = ci.connector_instance_id
+          AND rs.storage_epoch = ci.storage_epoch
+     ) AS current_epoch_run_sequence_issued
+       FROM connector_instances AS ci
+      WHERE ci.connector_instance_id = $1
+      FOR UPDATE OF ci`,
+    [connectorInstanceId]
+  );
+  const row = result.rows[0] as { current_epoch_run_sequence_issued?: unknown } | undefined;
+  return currentEpochRunSequenceExists(row?.current_epoch_run_sequence_issued);
+}
+
 interface AdvancedRevision {
   readonly manifestGeneration: number;
   readonly revision: number;
diff --git a/reference-implementation/test/local-device-coverage-revision-atomicity.test.ts b/reference-implementation/test/local-device-coverage-revision-atomicity.test.ts
index 5474bb266..ea110d49b 100644
--- a/reference-implementation/test/local-device-coverage-revision-atomicity.test.ts
+++ b/reference-implementation/test/local-device-coverage-revision-atomicity.test.ts
@@ -347,6 +347,35 @@ function postBatch(lane: Lane, body: Record<string, unknown>): Promise<JsonRespo
   return postJson(deviceUrl(lane, "/ingest-batches"), body, authHeaders(lane));
 }
 
+async function seedReferenceRuntimeRun(lane: Lane, runId: string): Promise<void> {
+  await sql(
+    lane,
+    `INSERT INTO run_history(run_id, connector_instance_id, connector_id, source_json, status, known_gaps_json, started_at, attempt)
+     VALUES (?, ?, ?, '{}', 'running', '[]', ?, 1)`,
+    `INSERT INTO run_history(run_id, connector_instance_id, connector_id, source_json, status, known_gaps_json, started_at, attempt)
+     VALUES ($1, $2, $3, '{}'::jsonb, 'running', '[]'::jsonb, $4, 1)`,
+    [runId, lane.enrolled.connector_instance_id, CONNECTOR_ID, EMITTED_AT]
+  );
+}
+
+async function postReferenceRuntimeRecord(lane: Lane, runId: string, recordId: string): Promise<JsonResponse> {
+  const { getRuntimeOwnerToken, rsUrl } = lane;
+  assert.ok(rsUrl, "the lane exposes the reference resource server");
+  assert.ok(getRuntimeOwnerToken, "the lane can mint a runtime owner token");
+  const ingestUrl = new URL("/v1/ingest/sessions", rsUrl);
+  ingestUrl.searchParams.set("connector_id", CONNECTOR_ID);
+  ingestUrl.searchParams.set("connector_instance_id", lane.enrolled.connector_instance_id);
+  ingestUrl.searchParams.set("run_id", runId);
+  return await requestJson(ingestUrl.toString(), {
+    body: `${JSON.stringify({ data: { id: recordId }, emitted_at: EMITTED_AT, key: recordId })}\n`,
+    headers: {
+      Authorization: `Bearer ${await getRuntimeOwnerToken()}`,
+      "Content-Type": "application/x-ndjson",
+    },
+    method: "POST",
+  });
+}
+
 function postFailureReport(lane: Lane, runId: string): Promise<JsonResponse> {
   return postJson(
     sourceUrl(lane, "/local-collector-gaps"),
@@ -516,6 +545,17 @@ async function highWater(lane: Lane): Promise<HighWater> {
   };
 }
 
+async function collectionRevisionAt(lane: Lane): Promise<string | null> {
+  const [row] = await sql(
+    lane,
+    "SELECT collection_revision_at AS at FROM connector_instances WHERE connector_instance_id = ?",
+    "SELECT collection_revision_at AS at FROM connector_instances WHERE connector_instance_id = $1",
+    [lane.enrolled.connector_instance_id]
+  );
+  assert.ok(row, "the connection has a revision timestamp row");
+  return (row.at as string | null) ?? null;
+}
+
 async function sessionRecordCount(lane: Lane): Promise<number> {
   const [row] = await sql(
     lane,
@@ -1243,6 +1283,22 @@ async function runOrder(lane: Lane): Promise<RunOrderRow> {
   };
 }
 
+async function currentEpochRunSequenceCount(lane: Lane): Promise<number> {
+  const [row] = await sql(
+    lane,
+    `SELECT COUNT(*) AS n
+       FROM collection_run_sequences AS rs
+       JOIN connector_instances AS ci USING (connector_instance_id)
+      WHERE rs.connector_instance_id = ? AND rs.storage_epoch = ci.storage_epoch`,
+    `SELECT COUNT(*)::integer AS n
+       FROM collection_run_sequences AS rs
+       JOIN connector_instances AS ci USING (connector_instance_id)
+      WHERE rs.connector_instance_id = $1 AND rs.storage_epoch = ci.storage_epoch`,
+    [lane.enrolled.connector_instance_id]
+  );
+  return Number(row?.n ?? 0);
+}
+
 /** The run-order facts the server stored with one run record. */
 async function storedRunOrder(
   lane: Lane,
@@ -1362,6 +1418,82 @@ laneTest("run order: an unregistered attempt retires prior coverage and cannot e
   await assertCovered(lane, "run-registered", "a registered run's proof is current");
 });
 
+laneTest(
+  "reference runtime records without a current-epoch device run leave revision and run order unchanged",
+  async (lane) => {
+    assert.equal(await issueRun(lane, "device-run-from-prior-epoch"), 1);
+    assert.ok((await beginStorageEpochAfterRestore()).connections >= 1);
+    const beforeRevision = await highWater(lane);
+    const beforeRevisionAt = await collectionRevisionAt(lane);
+    const beforeRunOrder = await runOrder(lane);
+    assert.equal(beforeRunOrder.issued, 1, "the cumulative sequence counter includes the prior epoch");
+    assert.equal(await currentEpochRunSequenceCount(lane), 0, "no device sequence has been issued in this epoch");
+
+    const runId = "reference-run-without-device-sequence";
+    await seedReferenceRuntimeRun(lane, runId);
+    const ingested = await postReferenceRuntimeRecord(lane, runId, "reference-record-without-device-run");
+    assert.equal(ingested.status, 200, JSON.stringify(ingested.body));
+    assert.equal(ingested.body?.records_accepted, 1, JSON.stringify(ingested.body));
+    assert.equal(await sessionRecordCount(lane), 1);
+    assert.deepEqual(await highWater(lane), beforeRevision, "record ingestion leaves revision columns untouched");
+    assert.equal(
+      await collectionRevisionAt(lane),
+      beforeRevisionAt,
+      "record ingestion leaves the revision timestamp untouched"
+    );
+    assert.deepEqual(await runOrder(lane), beforeRunOrder, "record ingestion leaves run-order columns untouched");
+
+    await emitSpineEvent({
+      actor_id: CONNECTOR_ID,
+      actor_type: "runtime",
+      data: {
+        connector_instance_id: lane.enrolled.connector_instance_id,
+        reason: "connector_reported_failed",
+        source: { id: CONNECTOR_ID, kind: "connector" },
+      },
+      event_type: "run.failed",
+      object_id: runId,
+      object_type: "run",
+      run_id: runId,
+      status: "failed",
+    });
+    assert.deepEqual(
+      await highWater(lane),
+      beforeRevision,
+      "terminal failure without a device sequence is not an observation"
+    );
+    assert.equal(
+      await collectionRevisionAt(lane),
+      beforeRevisionAt,
+      "terminal failure leaves the revision timestamp untouched"
+    );
+    assert.deepEqual(await runOrder(lane), beforeRunOrder, "terminal failure leaves run-order columns untouched");
+  }
+);
+
+laneTest("revision write failure does not fail reference records without device run state", async (lane) => {
+  const beforeRevision = await highWater(lane);
+  const beforeRevisionAt = await collectionRevisionAt(lane);
+  const beforeRunOrder = await runOrder(lane);
+  assert.equal(beforeRunOrder.issued, 0, "no device run sequence has been issued");
+  const runId = "reference-run-with-revision-trigger";
+  await seedReferenceRuntimeRun(lane, runId);
+
+  const restore = await failRevisionWrites(lane);
+  let ingested: JsonResponse;
+  try {
+    ingested = await postReferenceRuntimeRecord(lane, runId, "reference-record-with-revision-trigger");
+  } finally {
+    await restore();
+  }
+  assert.equal(ingested.status, 200, JSON.stringify(ingested.body));
+  assert.equal(ingested.body?.records_accepted, 1, JSON.stringify(ingested.body));
+  assert.equal(await sessionRecordCount(lane), 1, "the record commits while revision writes are unavailable");
+  assert.deepEqual(await highWater(lane), beforeRevision, "ingestion does not try to write a revision");
+  assert.equal(await collectionRevisionAt(lane), beforeRevisionAt, "ingestion leaves the revision timestamp untouched");
+  assert.deepEqual(await runOrder(lane), beforeRunOrder, "ingestion does not try to write a run-order marker");
+});
+
 laneTest("cross-runtime reference records and failures retire device coverage without run sequences", async (lane) => {
   await commitProof(lane, "device-run-covered");
   const pendingDeviceRunId = "device-run-pending-after-reference";
@@ -1370,30 +1502,8 @@ laneTest("cross-runtime reference records and failures retire device coverage wi
   const referenceRunId = "reference-run-record-batch";
   // A reference runtime run normally creates this admission row at run.started;
   // it deliberately has no collection_run_sequences entry.
-  await sql(
-    lane,
-    `INSERT INTO run_history(run_id, connector_instance_id, connector_id, source_json, status, known_gaps_json, started_at, attempt)
-     VALUES (?, ?, ?, '{}', 'running', '[]', ?, 1)`,
-    `INSERT INTO run_history(run_id, connector_instance_id, connector_id, source_json, status, known_gaps_json, started_at, attempt)
-     VALUES ($1, $2, $3, '{}'::jsonb, 'running', '[]'::jsonb, $4, 1)`,
-    [referenceRunId, lane.enrolled.connector_instance_id, CONNECTOR_ID, EMITTED_AT]
-  );
-  const { getRuntimeOwnerToken, rsUrl } = lane;
-  assert.ok(rsUrl, "the cross-runtime lane exposes the reference resource server");
-  assert.ok(getRuntimeOwnerToken, "the cross-runtime lane can mint a runtime owner token");
-  const ingestUrl = new URL("/v1/ingest/sessions", rsUrl);
-  ingestUrl.searchParams.set("connector_id", CONNECTOR_ID);
-  ingestUrl.searchParams.set("connector_instance_id", lane.enrolled.connector_instance_id);
-  ingestUrl.searchParams.set("run_id", referenceRunId);
-  const runtimeOwnerToken = await getRuntimeOwnerToken();
-  const ingested = await requestJson(ingestUrl.toString(), {
-    body: `${JSON.stringify({ data: { id: "reference-record" }, emitted_at: EMITTED_AT, key: "reference-record" })}\n`,
-    headers: {
-      Authorization: `Bearer ${runtimeOwnerToken}`,
-      "Content-Type": "application/x-ndjson",
-    },
-    method: "POST",
-  });
+  await seedReferenceRuntimeRun(lane, referenceRunId);
+  const ingested = await postReferenceRuntimeRecord(lane, referenceRunId, "reference-record");
   assert.equal(ingested.status, 200, JSON.stringify(ingested.body));
   assert.equal(ingested.body?.records_accepted, 1, JSON.stringify(ingested.body));
   assert.equal((await highWater(lane)).event, "batch_record");

From 92438ec7b290a39594b8daf4f9fb613a44a87882 Mon Sep 17 00:00:00 2001
From: Tim Nunamaker <tnunamak@gmail.com>
Date: Thu, 22 Oct 2026 21:51:01 -0500
Subject: [PATCH 70/87] Revert "Gate collection observations on current-epoch
 device runs"

Restore the prior record path while the placement boundary is decided; the cached false gate can miss a device registration between per-record transactions. This removes the batch gate that added state reads and row locks.

Assisted-by: AI
Signed-off-by: Tim Nunamaker <tnunamak@gmail.com>
---
 .../lib/postgres-spine.ts                     |  12 +-
 reference-implementation/lib/spine.ts         |  12 +-
 .../server/postgres-records.ts                |  50 +-----
 .../get-write-gate-state.sql                  |  10 --
 .../server/queries/index.ts                   |   1 -
 reference-implementation/server/records.ts    |  53 +-----
 .../stores/collection-revision-store.ts       |  72 --------
 ...device-coverage-revision-atomicity.test.ts | 158 +++---------------
 8 files changed, 42 insertions(+), 326 deletions(-)
 delete mode 100644 reference-implementation/server/queries/connector-instances/get-write-gate-state.sql

diff --git a/reference-implementation/lib/postgres-spine.ts b/reference-implementation/lib/postgres-spine.ts
index 739d609c4..d148e797c 100644
--- a/reference-implementation/lib/postgres-spine.ts
+++ b/reference-implementation/lib/postgres-spine.ts
@@ -11,10 +11,7 @@ import { createHash, randomUUID } from "node:crypto";
 import type { PoolClient } from "pg";
 
 import { postgresQuery, withPostgresTransaction } from "../server/postgres-storage.ts";
-import {
-  advancePostgresCollectionRevisionInTransaction,
-  hasIssuedCollectionRunSequenceInPostgresTransaction,
-} from "../server/stores/collection-revision-store.ts";
+import { advancePostgresCollectionRevisionInTransaction } from "../server/stores/collection-revision-store.ts";
 import {
   isRunHistoryRelevantEventType,
   isRunTerminalEventType,
@@ -1228,12 +1225,7 @@ async function appendNormalizedPostgresSpineEventInTransaction(
   rawData: unknown,
   hooks: PostgresSpineTransactionHooks = {}
 ): Promise<SpineEventRecord | null> {
-  if (
-    isRunTerminalEventType(event.event_type) &&
-    event.connector_instance_id &&
-    !hasCollectionRevision(rawData) &&
-    (await hasIssuedCollectionRunSequenceInPostgresTransaction(client, event.connector_instance_id))
-  ) {
+  if (isRunTerminalEventType(event.event_type) && event.connector_instance_id && !hasCollectionRevision(rawData)) {
     await advancePostgresCollectionRevisionInTransaction(client, event.connector_instance_id, {
       at: event.occurred_at,
       event: "terminal_run",
diff --git a/reference-implementation/lib/spine.ts b/reference-implementation/lib/spine.ts
index 9b5ab1386..4a1111e86 100644
--- a/reference-implementation/lib/spine.ts
+++ b/reference-implementation/lib/spine.ts
@@ -4,10 +4,7 @@
 import { randomBytes } from "node:crypto";
 import { getDb } from "../server/db.ts";
 import { isPostgresStorageBackend } from "../server/postgres-storage.ts";
-import {
-  advanceSqliteCollectionRevisionInTransaction,
-  hasIssuedCollectionRunSequenceInSqliteTransaction,
-} from "../server/stores/collection-revision-store.ts";
+import { advanceSqliteCollectionRevisionInTransaction } from "../server/stores/collection-revision-store.ts";
 import {
   isRunHistoryRelevantEventType,
   isRunTerminalEventType,
@@ -507,12 +504,7 @@ export function appendSqliteSpineEventInTransaction(
   assertRunEventHasConnectorInstanceId(input);
   assertRunStartedIsStamped(input);
   const event = normalizeSpineEventInput(input);
-  if (
-    isRunTerminalEventType(event.event_type) &&
-    event.connector_instance_id &&
-    !hasCollectionRevision(input.data) &&
-    hasIssuedCollectionRunSequenceInSqliteTransaction(db, event.connector_instance_id)
-  ) {
+  if (isRunTerminalEventType(event.event_type) && event.connector_instance_id && !hasCollectionRevision(input.data)) {
     advanceSqliteCollectionRevisionInTransaction(db, event.connector_instance_id, {
       at: event.occurred_at,
       event: "terminal_run",
diff --git a/reference-implementation/server/postgres-records.ts b/reference-implementation/server/postgres-records.ts
index 0b3d48083..fc11fdc23 100644
--- a/reference-implementation/server/postgres-records.ts
+++ b/reference-implementation/server/postgres-records.ts
@@ -68,10 +68,8 @@ import {
   resolveStorageConnectorInstanceId,
 } from "./storage-utils.ts";
 import {
-  type CollectionObservationGate,
   type CollectionRevisionEventInput,
   requirePostgresCollectionObservationInTransaction,
-  setCollectionObservationGate,
 } from "./stores/collection-revision-store.ts";
 import { createPostgresConnectorInstanceStore } from "./stores/connector-instance-store.ts";
 import { advancePostgresDeviceIngestPrefix } from "./stores/device-exporter-store.ts";
@@ -267,7 +265,6 @@ interface IngestRecord {
 
 interface IngestOptions {
   attemptContext?: DeviceAttemptContext | null;
-  collectionObservationGate?: CollectionObservationGate;
   collectionRevision?: CollectionRevisionEventInput;
   deviceReservation?: JsonObject & { inputIndex: number };
   /** See RecordIngestOptions.requireConnectionAdmission in server/records.ts. */
@@ -1922,33 +1919,13 @@ async function assertPostgresRunStillAdmitted(
 async function assertPostgresRecordIngestPreconditions(
   client: PostgresTransactionClient,
   connectorInstanceId: string,
-  options: Pick<
-    IngestOptions,
-    "collectionObservationGate" | "collectionRevision" | "requireConnectionAdmission" | "runId"
-  >
+  options: Pick<IngestOptions, "collectionRevision" | "requireConnectionAdmission" | "runId">
 ): Promise<void> {
-  const collectionObservationGate = options.collectionRevision
-    ? (options.collectionObservationGate ?? { checked: false, enabled: false })
-    : undefined;
   if (options.requireConnectionAdmission) {
-    await assertPostgresConnectorInstanceWritable(client, connectorInstanceId, collectionObservationGate);
+    await assertPostgresConnectorInstanceWritable(client, connectorInstanceId);
   }
   await assertPostgresRunStillAdmitted(client, options.runId, connectorInstanceId);
-  if (options.collectionRevision && collectionObservationGate && !collectionObservationGate.checked) {
-    const result = await client.query<{ current_epoch_run_sequence_issued: unknown }>(
-      `SELECT EXISTS (
-         SELECT 1 FROM collection_run_sequences AS rs
-          WHERE rs.connector_instance_id = ci.connector_instance_id
-            AND rs.storage_epoch = ci.storage_epoch
-       ) AS current_epoch_run_sequence_issued
-         FROM connector_instances AS ci
-        WHERE ci.connector_instance_id = $1
-        FOR UPDATE OF ci`,
-      [connectorInstanceId]
-    );
-    setCollectionObservationGate(collectionObservationGate, result.rows[0]?.current_epoch_run_sequence_issued);
-  }
-  if (options.collectionRevision && collectionObservationGate?.enabled) {
+  if (options.collectionRevision) {
     await requirePostgresCollectionObservationInTransaction(client, connectorInstanceId, options.collectionRevision);
   }
 }
@@ -2006,29 +1983,14 @@ async function maybeAfterConnectorInstanceAdmissionLockPhase(
 
 async function assertPostgresConnectorInstanceWritable(
   client: PostgresTransactionClient,
-  connectorInstanceId: string,
-  collectionObservationGate?: CollectionObservationGate
+  connectorInstanceId: string
 ): Promise<void> {
-  const readsRunOrder = collectionObservationGate && !collectionObservationGate.checked;
   const {
     rows: [row],
-  } = await client.query<{ current_epoch_run_sequence_issued?: unknown; status: string }>(
-    readsRunOrder
-      ? `SELECT ci.status,
-                EXISTS (
-                  SELECT 1 FROM collection_run_sequences AS rs
-                   WHERE rs.connector_instance_id = ci.connector_instance_id
-                     AND rs.storage_epoch = ci.storage_epoch
-                ) AS current_epoch_run_sequence_issued
-           FROM connector_instances AS ci
-          WHERE ci.connector_instance_id = $1
-          FOR UPDATE OF ci`
-      : "SELECT status FROM connector_instances WHERE connector_instance_id = $1 FOR UPDATE",
+  } = await client.query<{ status: string }>(
+    "SELECT status FROM connector_instances WHERE connector_instance_id = $1 FOR UPDATE",
     [connectorInstanceId]
   );
-  if (readsRunOrder && collectionObservationGate) {
-    setCollectionObservationGate(collectionObservationGate, row?.current_epoch_run_sequence_issued);
-  }
   await maybeAfterConnectorInstanceAdmissionLockPhase("after-connector-instance-admission-lock", {
     connectorInstanceId,
   });
diff --git a/reference-implementation/server/queries/connector-instances/get-write-gate-state.sql b/reference-implementation/server/queries/connector-instances/get-write-gate-state.sql
deleted file mode 100644
index 6f6fe8b0c..000000000
--- a/reference-implementation/server/queries/connector-instances/get-write-gate-state.sql
+++ /dev/null
@@ -1,10 +0,0 @@
--- @terminator: one
-SELECT ci.status,
-       EXISTS (
-         SELECT 1 FROM collection_run_sequences AS rs
-          WHERE rs.connector_instance_id = ci.connector_instance_id
-            AND rs.storage_epoch = ci.storage_epoch
-       ) AS current_epoch_run_sequence_issued
-  FROM connector_instances AS ci
- WHERE ci.connector_instance_id = ?
-LIMIT 1;
diff --git a/reference-implementation/server/queries/index.ts b/reference-implementation/server/queries/index.ts
index 2c8da6ea7..dbb5fe543 100644
--- a/reference-implementation/server/queries/index.ts
+++ b/reference-implementation/server/queries/index.ts
@@ -306,7 +306,6 @@ export interface ReferenceQueryRegistry extends Readonly<Record<string, Register
   readonly connectorInstancesGetById: ReadOneQuery;
   readonly connectorInstancesGetTombstoneByBinding: ReadOneQuery;
   readonly connectorInstancesGetTombstoneByConnectionId: ReadOneQuery;
-  readonly connectorInstancesGetWriteGateState: ReadOneQuery;
   readonly connectorInstancesInsert: MutationQuery;
   readonly connectorInstancesInsertTombstone: MutationQuery;
   readonly connectorInstancesListActiveByOwnerConnector: ReadManyQuery;
diff --git a/reference-implementation/server/records.ts b/reference-implementation/server/records.ts
index 32ed7e300..079b3c9d6 100644
--- a/reference-implementation/server/records.ts
+++ b/reference-implementation/server/records.ts
@@ -142,12 +142,10 @@ import {
   resolveStorageConnectorInstanceId,
 } from "./storage-utils.ts";
 import {
-  type CollectionObservationGate,
   type CollectionRevisionEventInput,
   type LocalCoverageRevisionFence,
   readLocalCoverageRevisionFences,
   requireSqliteCollectionObservationInTransaction,
-  setCollectionObservationGate,
 } from "./stores/collection-revision-store.ts";
 import {
   ConnectorInstanceResolutionError,
@@ -210,7 +208,6 @@ interface AttemptContext {
 type DeviceReservation = Record<string, unknown> & { inputIndex: number };
 interface RecordIngestOptions {
   attemptContext?: AttemptContext;
-  collectionObservationGate?: CollectionObservationGate;
   collectionRevision?: CollectionRevisionEventInput;
   coordinatorOwnership?: ConnectorInstanceWriteOwnership;
   deferIndexes?: boolean;
@@ -1666,43 +1663,13 @@ export async function assertConnectorInstanceWritable(connectorInstanceId: strin
  * transaction, never before it. See
  * harden-connector-instance-write-fence-transaction-native.
  */
-export function assertSqliteConnectorInstanceWritableWithinTransaction(
-  connectorInstanceId: string,
-  collectionObservationGate?: CollectionObservationGate
-): void {
-  const readsRunOrder = collectionObservationGate?.checked === false;
-  const row: { current_epoch_run_sequence_issued?: unknown; status?: string } | null = readsRunOrder
-    ? (getOne(referenceQueries.connectorInstancesGetWriteGateState, [connectorInstanceId]) as {
-        current_epoch_run_sequence_issued?: unknown;
-        status?: string;
-      } | null)
-    : (getOne(referenceQueries.connectorInstancesGetById, [connectorInstanceId]) as { status?: string } | null);
-  if (collectionObservationGate?.checked === false) {
-    setCollectionObservationGate(collectionObservationGate, row?.current_epoch_run_sequence_issued);
-  }
-  const status = row?.status ?? null;
+export function assertSqliteConnectorInstanceWritableWithinTransaction(connectorInstanceId: string): void {
+  const status =
+    (getOne(referenceQueries.connectorInstancesGetById, [connectorInstanceId]) as { status?: string } | null)?.status ??
+    null;
   assertConnectorInstanceStatusWritable(status, connectorInstanceId);
 }
 
-function maybeObserveSqliteCollectionRevision(
-  connectorInstanceId: string,
-  collectionRevision: CollectionRevisionEventInput | undefined,
-  gate: CollectionObservationGate | undefined
-): void {
-  if (!(collectionRevision && gate)) {
-    return;
-  }
-  if (!gate.checked) {
-    const row = getOne(referenceQueries.connectorInstancesGetWriteGateState, [connectorInstanceId]) as {
-      current_epoch_run_sequence_issued?: unknown;
-    } | null;
-    setCollectionObservationGate(gate, row?.current_epoch_run_sequence_issued);
-  }
-  if (gate.enabled) {
-    requireSqliteCollectionObservationInTransaction(getDb(), connectorInstanceId, collectionRevision);
-  }
-}
-
 /**
  * Ingest a RECORD envelope (owner-authenticated).
  *
@@ -1925,7 +1892,6 @@ async function ingestRecordsWithinCoordinator(
   const changedRecords: DeferredRecordIndex[] = [];
   const loggingConnectorId = connectorIdForStorageTarget(storageTarget);
   const loggingConnectorInstanceId = resolveStorageConnectorInstanceId(storageTarget, loggingConnectorId);
-  const collectionObservationGate: CollectionObservationGate = { checked: false, enabled: false };
   const perRecordOptions: RecordIngestOptions = {
     deferIndexes: true,
     // Re-verified inside EVERY record's own durable write transaction on
@@ -1937,7 +1903,6 @@ async function ingestRecordsWithinCoordinator(
     // check closes the delete-or-revoke/write TOCTOU for every record, not
     // just the first.
     ...(options.collectionRevision ? { collectionRevision: options.collectionRevision } : {}),
-    collectionObservationGate,
     ...(options.requireConnectionAdmission ? { requireConnectionAdmission: options.requireConnectionAdmission } : {}),
     ...(options.runId ? { runId: options.runId } : {}),
   };
@@ -2098,7 +2063,6 @@ function toPostgresIngestOptions(options: RecordIngestOptions) {
   const attemptContext = toPostgresAttemptContext(options.attemptContext);
   return {
     ...(attemptContext ? { attemptContext } : {}),
-    ...(options.collectionObservationGate ? { collectionObservationGate: options.collectionObservationGate } : {}),
     ...(options.collectionRevision ? { collectionRevision: options.collectionRevision } : {}),
     ...(options.deviceReservation ? { deviceReservation: options.deviceReservation } : {}),
     ...(options.requireConnectionAdmission ? { requireConnectionAdmission: options.requireConnectionAdmission } : {}),
@@ -2322,9 +2286,6 @@ async function ingestSqliteRecord(
   const { stream, key, data, emitted_at, op = "upsert" } = record;
   const recordKey = encodeKey(key);
   const recordJson = data ? JSON.stringify(data) : null;
-  const collectionObservationGate = options.collectionRevision
-    ? (options.collectionObservationGate ?? { checked: false, enabled: false })
-    : undefined;
 
   // Validate record identity against the manifest-declared primary_key. The
   // record `key` is the ordered tuple of primary-key field values; each
@@ -2357,9 +2318,11 @@ async function ingestSqliteRecord(
   const outcome = writeTransaction<DurableIngestOutcome>(() => {
     assertSqliteRunStillAdmitted(options.runId, connectorInstanceId);
     if (options.requireConnectionAdmission) {
-      assertSqliteConnectorInstanceWritableWithinTransaction(connectorInstanceId, collectionObservationGate);
+      assertSqliteConnectorInstanceWritableWithinTransaction(connectorInstanceId);
+    }
+    if (options.collectionRevision) {
+      requireSqliteCollectionObservationInTransaction(getDb(), connectorInstanceId, options.collectionRevision);
     }
-    maybeObserveSqliteCollectionRevision(connectorInstanceId, options.collectionRevision, collectionObservationGate);
     const finishDurableOutcome = (value: DurableIngestOutcome): DurableIngestOutcome => {
       if (options.deviceReservation) {
         advanceSqliteDeviceIngestPrefix(options.deviceReservation, options.deviceReservation.inputIndex);
diff --git a/reference-implementation/server/stores/collection-revision-store.ts b/reference-implementation/server/stores/collection-revision-store.ts
index 084c1358c..1e7c0af28 100644
--- a/reference-implementation/server/stores/collection-revision-store.ts
+++ b/reference-implementation/server/stores/collection-revision-store.ts
@@ -61,11 +61,6 @@ interface PostgresHandle {
   query: (sql: string, params: readonly unknown[]) => Promise<{ readonly rows: readonly unknown[] }>;
 }
 
-export interface CollectionObservationGate {
-  checked: boolean;
-  enabled: boolean;
-}
-
 /**
  * The revision for an observed event could not be recorded, so the event
  * itself must not commit or be acknowledged. Device routes answer it with
@@ -109,73 +104,6 @@ export function readCollectionRevision(value: unknown): number | null {
   return typeof revision === "number" && Number.isSafeInteger(revision) && revision >= 0 ? revision : null;
 }
 
-export function currentEpochRunSequenceExists(value: unknown): boolean {
-  return value === true || value === 1 || value === "1";
-}
-
-export function setCollectionObservationGate(
-  gate: CollectionObservationGate,
-  currentEpochSequenceExists: unknown
-): void {
-  if (gate.checked) {
-    return;
-  }
-  gate.checked = true;
-  gate.enabled = currentEpochRunSequenceExists(currentEpochSequenceExists);
-}
-
-/** Read the run-order gate from the caller's handle when its schema has both required tables. */
-export function hasIssuedCollectionRunSequenceInSqliteTransaction(
-  db: SqliteHandle,
-  connectorInstanceId: string
-): boolean {
-  const table = db
-    .prepare(
-      `SELECT 1 AS present FROM sqlite_schema
-        WHERE type = 'table'
-          AND name = 'connector_instances'
-          AND EXISTS (
-            SELECT 1 FROM sqlite_schema WHERE type = 'table' AND name = 'collection_run_sequences'
-          )`
-    )
-    .get();
-  if (!table) {
-    return false;
-  }
-  const row = db
-    .prepare(
-      `SELECT EXISTS (
-         SELECT 1 FROM collection_run_sequences AS rs
-          WHERE rs.connector_instance_id = ci.connector_instance_id
-            AND rs.storage_epoch = ci.storage_epoch
-       ) AS current_epoch_run_sequence_issued
-         FROM connector_instances AS ci
-        WHERE ci.connector_instance_id = ?`
-    )
-    .get(connectorInstanceId) as { current_epoch_run_sequence_issued?: unknown } | undefined;
-  return currentEpochRunSequenceExists(row?.current_epoch_run_sequence_issued);
-}
-
-/** Read the run-order gate and lock its connection row on the caller's transaction handle. */
-export async function hasIssuedCollectionRunSequenceInPostgresTransaction(
-  client: PostgresHandle,
-  connectorInstanceId: string
-): Promise<boolean> {
-  const result = await client.query(
-    `SELECT EXISTS (
-       SELECT 1 FROM collection_run_sequences AS rs
-        WHERE rs.connector_instance_id = ci.connector_instance_id
-          AND rs.storage_epoch = ci.storage_epoch
-     ) AS current_epoch_run_sequence_issued
-       FROM connector_instances AS ci
-      WHERE ci.connector_instance_id = $1
-      FOR UPDATE OF ci`,
-    [connectorInstanceId]
-  );
-  const row = result.rows[0] as { current_epoch_run_sequence_issued?: unknown } | undefined;
-  return currentEpochRunSequenceExists(row?.current_epoch_run_sequence_issued);
-}
-
 interface AdvancedRevision {
   readonly manifestGeneration: number;
   readonly revision: number;
diff --git a/reference-implementation/test/local-device-coverage-revision-atomicity.test.ts b/reference-implementation/test/local-device-coverage-revision-atomicity.test.ts
index ea110d49b..5474bb266 100644
--- a/reference-implementation/test/local-device-coverage-revision-atomicity.test.ts
+++ b/reference-implementation/test/local-device-coverage-revision-atomicity.test.ts
@@ -347,35 +347,6 @@ function postBatch(lane: Lane, body: Record<string, unknown>): Promise<JsonRespo
   return postJson(deviceUrl(lane, "/ingest-batches"), body, authHeaders(lane));
 }
 
-async function seedReferenceRuntimeRun(lane: Lane, runId: string): Promise<void> {
-  await sql(
-    lane,
-    `INSERT INTO run_history(run_id, connector_instance_id, connector_id, source_json, status, known_gaps_json, started_at, attempt)
-     VALUES (?, ?, ?, '{}', 'running', '[]', ?, 1)`,
-    `INSERT INTO run_history(run_id, connector_instance_id, connector_id, source_json, status, known_gaps_json, started_at, attempt)
-     VALUES ($1, $2, $3, '{}'::jsonb, 'running', '[]'::jsonb, $4, 1)`,
-    [runId, lane.enrolled.connector_instance_id, CONNECTOR_ID, EMITTED_AT]
-  );
-}
-
-async function postReferenceRuntimeRecord(lane: Lane, runId: string, recordId: string): Promise<JsonResponse> {
-  const { getRuntimeOwnerToken, rsUrl } = lane;
-  assert.ok(rsUrl, "the lane exposes the reference resource server");
-  assert.ok(getRuntimeOwnerToken, "the lane can mint a runtime owner token");
-  const ingestUrl = new URL("/v1/ingest/sessions", rsUrl);
-  ingestUrl.searchParams.set("connector_id", CONNECTOR_ID);
-  ingestUrl.searchParams.set("connector_instance_id", lane.enrolled.connector_instance_id);
-  ingestUrl.searchParams.set("run_id", runId);
-  return await requestJson(ingestUrl.toString(), {
-    body: `${JSON.stringify({ data: { id: recordId }, emitted_at: EMITTED_AT, key: recordId })}\n`,
-    headers: {
-      Authorization: `Bearer ${await getRuntimeOwnerToken()}`,
-      "Content-Type": "application/x-ndjson",
-    },
-    method: "POST",
-  });
-}
-
 function postFailureReport(lane: Lane, runId: string): Promise<JsonResponse> {
   return postJson(
     sourceUrl(lane, "/local-collector-gaps"),
@@ -545,17 +516,6 @@ async function highWater(lane: Lane): Promise<HighWater> {
   };
 }
 
-async function collectionRevisionAt(lane: Lane): Promise<string | null> {
-  const [row] = await sql(
-    lane,
-    "SELECT collection_revision_at AS at FROM connector_instances WHERE connector_instance_id = ?",
-    "SELECT collection_revision_at AS at FROM connector_instances WHERE connector_instance_id = $1",
-    [lane.enrolled.connector_instance_id]
-  );
-  assert.ok(row, "the connection has a revision timestamp row");
-  return (row.at as string | null) ?? null;
-}
-
 async function sessionRecordCount(lane: Lane): Promise<number> {
   const [row] = await sql(
     lane,
@@ -1283,22 +1243,6 @@ async function runOrder(lane: Lane): Promise<RunOrderRow> {
   };
 }
 
-async function currentEpochRunSequenceCount(lane: Lane): Promise<number> {
-  const [row] = await sql(
-    lane,
-    `SELECT COUNT(*) AS n
-       FROM collection_run_sequences AS rs
-       JOIN connector_instances AS ci USING (connector_instance_id)
-      WHERE rs.connector_instance_id = ? AND rs.storage_epoch = ci.storage_epoch`,
-    `SELECT COUNT(*)::integer AS n
-       FROM collection_run_sequences AS rs
-       JOIN connector_instances AS ci USING (connector_instance_id)
-      WHERE rs.connector_instance_id = $1 AND rs.storage_epoch = ci.storage_epoch`,
-    [lane.enrolled.connector_instance_id]
-  );
-  return Number(row?.n ?? 0);
-}
-
 /** The run-order facts the server stored with one run record. */
 async function storedRunOrder(
   lane: Lane,
@@ -1418,82 +1362,6 @@ laneTest("run order: an unregistered attempt retires prior coverage and cannot e
   await assertCovered(lane, "run-registered", "a registered run's proof is current");
 });
 
-laneTest(
-  "reference runtime records without a current-epoch device run leave revision and run order unchanged",
-  async (lane) => {
-    assert.equal(await issueRun(lane, "device-run-from-prior-epoch"), 1);
-    assert.ok((await beginStorageEpochAfterRestore()).connections >= 1);
-    const beforeRevision = await highWater(lane);
-    const beforeRevisionAt = await collectionRevisionAt(lane);
-    const beforeRunOrder = await runOrder(lane);
-    assert.equal(beforeRunOrder.issued, 1, "the cumulative sequence counter includes the prior epoch");
-    assert.equal(await currentEpochRunSequenceCount(lane), 0, "no device sequence has been issued in this epoch");
-
-    const runId = "reference-run-without-device-sequence";
-    await seedReferenceRuntimeRun(lane, runId);
-    const ingested = await postReferenceRuntimeRecord(lane, runId, "reference-record-without-device-run");
-    assert.equal(ingested.status, 200, JSON.stringify(ingested.body));
-    assert.equal(ingested.body?.records_accepted, 1, JSON.stringify(ingested.body));
-    assert.equal(await sessionRecordCount(lane), 1);
-    assert.deepEqual(await highWater(lane), beforeRevision, "record ingestion leaves revision columns untouched");
-    assert.equal(
-      await collectionRevisionAt(lane),
-      beforeRevisionAt,
-      "record ingestion leaves the revision timestamp untouched"
-    );
-    assert.deepEqual(await runOrder(lane), beforeRunOrder, "record ingestion leaves run-order columns untouched");
-
-    await emitSpineEvent({
-      actor_id: CONNECTOR_ID,
-      actor_type: "runtime",
-      data: {
-        connector_instance_id: lane.enrolled.connector_instance_id,
-        reason: "connector_reported_failed",
-        source: { id: CONNECTOR_ID, kind: "connector" },
-      },
-      event_type: "run.failed",
-      object_id: runId,
-      object_type: "run",
-      run_id: runId,
-      status: "failed",
-    });
-    assert.deepEqual(
-      await highWater(lane),
-      beforeRevision,
-      "terminal failure without a device sequence is not an observation"
-    );
-    assert.equal(
-      await collectionRevisionAt(lane),
-      beforeRevisionAt,
-      "terminal failure leaves the revision timestamp untouched"
-    );
-    assert.deepEqual(await runOrder(lane), beforeRunOrder, "terminal failure leaves run-order columns untouched");
-  }
-);
-
-laneTest("revision write failure does not fail reference records without device run state", async (lane) => {
-  const beforeRevision = await highWater(lane);
-  const beforeRevisionAt = await collectionRevisionAt(lane);
-  const beforeRunOrder = await runOrder(lane);
-  assert.equal(beforeRunOrder.issued, 0, "no device run sequence has been issued");
-  const runId = "reference-run-with-revision-trigger";
-  await seedReferenceRuntimeRun(lane, runId);
-
-  const restore = await failRevisionWrites(lane);
-  let ingested: JsonResponse;
-  try {
-    ingested = await postReferenceRuntimeRecord(lane, runId, "reference-record-with-revision-trigger");
-  } finally {
-    await restore();
-  }
-  assert.equal(ingested.status, 200, JSON.stringify(ingested.body));
-  assert.equal(ingested.body?.records_accepted, 1, JSON.stringify(ingested.body));
-  assert.equal(await sessionRecordCount(lane), 1, "the record commits while revision writes are unavailable");
-  assert.deepEqual(await highWater(lane), beforeRevision, "ingestion does not try to write a revision");
-  assert.equal(await collectionRevisionAt(lane), beforeRevisionAt, "ingestion leaves the revision timestamp untouched");
-  assert.deepEqual(await runOrder(lane), beforeRunOrder, "ingestion does not try to write a run-order marker");
-});
-
 laneTest("cross-runtime reference records and failures retire device coverage without run sequences", async (lane) => {
   await commitProof(lane, "device-run-covered");
   const pendingDeviceRunId = "device-run-pending-after-reference";
@@ -1502,8 +1370,30 @@ laneTest("cross-runtime reference records and failures retire device coverage wi
   const referenceRunId = "reference-run-record-batch";
   // A reference runtime run normally creates this admission row at run.started;
   // it deliberately has no collection_run_sequences entry.
-  await seedReferenceRuntimeRun(lane, referenceRunId);
-  const ingested = await postReferenceRuntimeRecord(lane, referenceRunId, "reference-record");
+  await sql(
+    lane,
+    `INSERT INTO run_history(run_id, connector_instance_id, connector_id, source_json, status, known_gaps_json, started_at, attempt)
+     VALUES (?, ?, ?, '{}', 'running', '[]', ?, 1)`,
+    `INSERT INTO run_history(run_id, connector_instance_id, connector_id, source_json, status, known_gaps_json, started_at, attempt)
+     VALUES ($1, $2, $3, '{}'::jsonb, 'running', '[]'::jsonb, $4, 1)`,
+    [referenceRunId, lane.enrolled.connector_instance_id, CONNECTOR_ID, EMITTED_AT]
+  );
+  const { getRuntimeOwnerToken, rsUrl } = lane;
+  assert.ok(rsUrl, "the cross-runtime lane exposes the reference resource server");
+  assert.ok(getRuntimeOwnerToken, "the cross-runtime lane can mint a runtime owner token");
+  const ingestUrl = new URL("/v1/ingest/sessions", rsUrl);
+  ingestUrl.searchParams.set("connector_id", CONNECTOR_ID);
+  ingestUrl.searchParams.set("connector_instance_id", lane.enrolled.connector_instance_id);
+  ingestUrl.searchParams.set("run_id", referenceRunId);
+  const runtimeOwnerToken = await getRuntimeOwnerToken();
+  const ingested = await requestJson(ingestUrl.toString(), {
+    body: `${JSON.stringify({ data: { id: "reference-record" }, emitted_at: EMITTED_AT, key: "reference-record" })}\n`,
+    headers: {
+      Authorization: `Bearer ${runtimeOwnerToken}`,
+      "Content-Type": "application/x-ndjson",
+    },
+    method: "POST",
+  });
   assert.equal(ingested.status, 200, JSON.stringify(ingested.body));
   assert.equal(ingested.body?.records_accepted, 1, JSON.stringify(ingested.body));
   assert.equal((await highWater(lane)).event, "batch_record");

From 5fff3e458087d341636ffd337bc56438592fa254 Mon Sep 17 00:00:00 2001
From: Tim Nunamaker <tnunamak@gmail.com>
Date: Thu, 22 Oct 2026 21:51:07 -0500
Subject: [PATCH 71/87] Revert "Retire device coverage on reference
 observations"

Restore the server ingestion and spine paths to their 02ed156bce behavior while placement is audited. This removes the per-record and terminal observation changes that added ingestion overhead and Postgres lock-order risk.

Assisted-by: AI
Signed-off-by: Tim Nunamaker <tnunamak@gmail.com>
---
 .../lib/postgres-spine.ts                     | 24 ++----
 reference-implementation/lib/spine.ts         | 22 -----
 reference-implementation/server/index.ts      |  4 +-
 .../server/postgres-records.ts                | 24 +-----
 reference-implementation/server/records.ts    | 29 ++++---
 .../server/routes/rs-mutation.ts              | 31 ++-----
 .../stores/collection-revision-store.ts       | 33 ++------
 .../server/stores/run-history-writer.ts       |  4 -
 ...device-coverage-revision-atomicity.test.ts | 83 +------------------
 9 files changed, 37 insertions(+), 217 deletions(-)

diff --git a/reference-implementation/lib/postgres-spine.ts b/reference-implementation/lib/postgres-spine.ts
index d148e797c..3352c1623 100644
--- a/reference-implementation/lib/postgres-spine.ts
+++ b/reference-implementation/lib/postgres-spine.ts
@@ -11,10 +11,8 @@ import { createHash, randomUUID } from "node:crypto";
 import type { PoolClient } from "pg";
 
 import { postgresQuery, withPostgresTransaction } from "../server/postgres-storage.ts";
-import { advancePostgresCollectionRevisionInTransaction } from "../server/stores/collection-revision-store.ts";
 import {
   isRunHistoryRelevantEventType,
-  isRunTerminalEventType,
   type RunHistorySpineEvent,
   writePostgresRunHistoryForSpineEvent,
 } from "../server/stores/run-history-writer.ts";
@@ -1225,13 +1223,6 @@ async function appendNormalizedPostgresSpineEventInTransaction(
   rawData: unknown,
   hooks: PostgresSpineTransactionHooks = {}
 ): Promise<SpineEventRecord | null> {
-  if (isRunTerminalEventType(event.event_type) && event.connector_instance_id && !hasCollectionRevision(rawData)) {
-    await advancePostgresCollectionRevisionInTransaction(client, event.connector_instance_id, {
-      at: event.occurred_at,
-      event: "terminal_run",
-      runId: event.run_id,
-    });
-  }
   const result = await client.query<SpineEventRow>(SPINE_INSERT_EVENT_SQL, spineInsertEventParams(event));
   await hooks.afterEventInsert?.();
   if (isRunHistoryRelevantEventType(event.event_type)) {
@@ -1261,16 +1252,11 @@ export async function postgresEmitSpineEventInTransaction(
   input: PostgresSpineEventInput = {}
 ): Promise<SpineEventRecord | null> {
   const event = normalize(input);
-  return await appendNormalizedPostgresSpineEventInTransaction(client, event, input.data);
-}
-
-function hasCollectionRevision(data: unknown): boolean {
-  return Boolean(
-    data &&
-      typeof data === "object" &&
-      !Array.isArray(data) &&
-      typeof (data as Record<string, unknown>).collection_revision === "number"
-  );
+  const result = await client.query<SpineEventRow>(SPINE_INSERT_EVENT_SQL, spineInsertEventParams(event));
+  if (isRunHistoryRelevantEventType(event.event_type)) {
+    await writePostgresRunHistoryForSpineEvent(client, toRunHistorySpineEvent(event, input.data));
+  }
+  return hydrate(result.rows[0]);
 }
 
 export async function postgresListSpineEventsPage(
diff --git a/reference-implementation/lib/spine.ts b/reference-implementation/lib/spine.ts
index 4a1111e86..ae44db4bb 100644
--- a/reference-implementation/lib/spine.ts
+++ b/reference-implementation/lib/spine.ts
@@ -4,10 +4,8 @@
 import { randomBytes } from "node:crypto";
 import { getDb } from "../server/db.ts";
 import { isPostgresStorageBackend } from "../server/postgres-storage.ts";
-import { advanceSqliteCollectionRevisionInTransaction } from "../server/stores/collection-revision-store.ts";
 import {
   isRunHistoryRelevantEventType,
-  isRunTerminalEventType,
   type RunHistorySpineEvent,
   writeSqliteRunHistoryForSpineEventOn,
 } from "../server/stores/run-history-writer.ts";
@@ -19,7 +17,6 @@ import {
   type Page,
   referenceQueries,
   decodeCursor as wrapperDecodeCursor,
-  writeTransaction,
 } from "./db.ts";
 import {
   deriveTokenAuditId,
@@ -504,13 +501,6 @@ export function appendSqliteSpineEventInTransaction(
   assertRunEventHasConnectorInstanceId(input);
   assertRunStartedIsStamped(input);
   const event = normalizeSpineEventInput(input);
-  if (isRunTerminalEventType(event.event_type) && event.connector_instance_id && !hasCollectionRevision(input.data)) {
-    advanceSqliteCollectionRevisionInTransaction(db, event.connector_instance_id, {
-      at: event.occurred_at,
-      event: "terminal_run",
-      runId: event.run_id,
-    });
-  }
   execNamedOn(db, referenceQueries.spineInsertEvent, event);
   hooks.afterEventInsert?.();
   if (isRunHistoryRelevantEventType(event.event_type)) {
@@ -543,21 +533,9 @@ function insertSqliteSpineEvent(input: SpineEventInput, dbHandle: SpineDatabase
   if (!db) {
     return null;
   }
-  if (!dbHandle && isRunTerminalEventType(input.event_type)) {
-    return writeTransaction(() => appendSqliteSpineEventInTransaction(input, db));
-  }
   return appendSqliteSpineEventInTransaction(input, db);
 }
 
-function hasCollectionRevision(data: unknown): boolean {
-  return Boolean(
-    data &&
-      typeof data === "object" &&
-      !Array.isArray(data) &&
-      typeof (data as Record<string, unknown>).collection_revision === "number"
-  );
-}
-
 /**
  * Write one SQLite spine event before returning to a caller-owned transaction.
  *
diff --git a/reference-implementation/server/index.ts b/reference-implementation/server/index.ts
index b782fc890..da7d876d5 100644
--- a/reference-implementation/server/index.ts
+++ b/reference-implementation/server/index.ts
@@ -7621,14 +7621,14 @@ function buildRsApp(opts: ServerOpts = {}) {
     ingestRecord: (
       target: unknown,
       record: unknown,
-      options?: Parameters<typeof ingestRecord>[2]
+      options?: { requireConnectionAdmission?: boolean; runId?: string | null }
     ) =>
       ingestRecord(target as Parameters<typeof ingestRecord>[0], record as Parameters<typeof ingestRecord>[1], options),
     ingestRecords: (
       target: unknown,
       records: readonly unknown[],
       afterRecord: ((record: unknown, outcome: unknown) => Promise<void>) | undefined,
-      options?: Parameters<typeof ingestRecords>[3]
+      options?: { requireConnectionAdmission?: boolean; runId?: string | null }
     ) =>
       ingestRecords(
         target as Parameters<typeof ingestRecords>[0],
diff --git a/reference-implementation/server/postgres-records.ts b/reference-implementation/server/postgres-records.ts
index fc11fdc23..1ef0d4483 100644
--- a/reference-implementation/server/postgres-records.ts
+++ b/reference-implementation/server/postgres-records.ts
@@ -67,10 +67,6 @@ import {
   resolveStorageConnectorId,
   resolveStorageConnectorInstanceId,
 } from "./storage-utils.ts";
-import {
-  type CollectionRevisionEventInput,
-  requirePostgresCollectionObservationInTransaction,
-} from "./stores/collection-revision-store.ts";
 import { createPostgresConnectorInstanceStore } from "./stores/connector-instance-store.ts";
 import { advancePostgresDeviceIngestPrefix } from "./stores/device-exporter-store.ts";
 import { markSearchIndexDirtyPostgres } from "./stores/search-index-dirty-store.ts";
@@ -265,7 +261,6 @@ interface IngestRecord {
 
 interface IngestOptions {
   attemptContext?: DeviceAttemptContext | null;
-  collectionRevision?: CollectionRevisionEventInput;
   deviceReservation?: JsonObject & { inputIndex: number };
   /** See RecordIngestOptions.requireConnectionAdmission in server/records.ts. */
   requireConnectionAdmission?: boolean;
@@ -1916,20 +1911,6 @@ async function assertPostgresRunStillAdmitted(
   }
 }
 
-async function assertPostgresRecordIngestPreconditions(
-  client: PostgresTransactionClient,
-  connectorInstanceId: string,
-  options: Pick<IngestOptions, "collectionRevision" | "requireConnectionAdmission" | "runId">
-): Promise<void> {
-  if (options.requireConnectionAdmission) {
-    await assertPostgresConnectorInstanceWritable(client, connectorInstanceId);
-  }
-  await assertPostgresRunStillAdmitted(client, options.runId, connectorInstanceId);
-  if (options.collectionRevision) {
-    await requirePostgresCollectionObservationInTransaction(client, connectorInstanceId, options.collectionRevision);
-  }
-}
-
 /**
  * Opt-in re-check, inside the SAME locked transaction as the mutation it
  * guards, that the `connector_instances` row still exists AND is in a
@@ -2037,7 +2018,10 @@ export async function postgresIngestRecord(
   crashPoint("ingest:before-write-transaction");
   const outcome = await withPostgresTransaction<DurableIngestOutcome>(
     async (client) => {
-      await assertPostgresRecordIngestPreconditions(client, connectorInstanceId, options);
+      if (options.requireConnectionAdmission) {
+        await assertPostgresConnectorInstanceWritable(client, connectorInstanceId);
+      }
+      await assertPostgresRunStillAdmitted(client, options.runId, connectorInstanceId);
       const finishDurableOutcome = async (value: DurableIngestOutcome): Promise<DurableIngestOutcome> => {
         if (options.deviceReservation) {
           await advancePostgresDeviceIngestPrefix(
diff --git a/reference-implementation/server/records.ts b/reference-implementation/server/records.ts
index 079b3c9d6..aed7f16bc 100644
--- a/reference-implementation/server/records.ts
+++ b/reference-implementation/server/records.ts
@@ -142,10 +142,8 @@ import {
   resolveStorageConnectorInstanceId,
 } from "./storage-utils.ts";
 import {
-  type CollectionRevisionEventInput,
   type LocalCoverageRevisionFence,
   readLocalCoverageRevisionFences,
-  requireSqliteCollectionObservationInTransaction,
 } from "./stores/collection-revision-store.ts";
 import {
   ConnectorInstanceResolutionError,
@@ -208,7 +206,6 @@ interface AttemptContext {
 type DeviceReservation = Record<string, unknown> & { inputIndex: number };
 interface RecordIngestOptions {
   attemptContext?: AttemptContext;
-  collectionRevision?: CollectionRevisionEventInput;
   coordinatorOwnership?: ConnectorInstanceWriteOwnership;
   deferIndexes?: boolean;
   deviceFinalInputIndex?: number;
@@ -1740,7 +1737,7 @@ export async function ingestRecords(
   storageTarget: RecordStorageTarget,
   records: readonly RecordEnvelope[],
   afterRecord?: RecordIngestAfterRecord,
-  options: Pick<RecordIngestOptions, "collectionRevision" | "requireConnectionAdmission" | "runId"> = {}
+  options: Pick<RecordIngestOptions, "requireConnectionAdmission" | "runId"> = {}
 ): Promise<RecordIngestBatchOutcome[]> {
   const coordinationConnectorId = connectorIdForStorageTarget(storageTarget);
   const coordinationInstanceId = resolveStorageConnectorInstanceId(storageTarget, coordinationConnectorId);
@@ -1749,7 +1746,13 @@ export async function ingestRecords(
     releaseFence = resolve;
   });
   try {
-    const batch = await ingestRecordsWithinCoordinator(storageTarget, records, afterRecord, options);
+    const batch = await ingestRecordsWithinCoordinator(
+      storageTarget,
+      records,
+      afterRecord,
+      options.runId,
+      options.requireConnectionAdmission
+    );
     if (batch.changedRecords.length > 0) {
       // Fire-and-forget: the HTTP batch ack must not await derived index
       // work (see the single-record path's identical reasoning at
@@ -1886,7 +1889,8 @@ async function ingestRecordsWithinCoordinator(
   storageTarget: RecordStorageTarget,
   records: readonly RecordEnvelope[],
   afterRecord?: RecordIngestAfterRecord,
-  options: Pick<RecordIngestOptions, "collectionRevision" | "requireConnectionAdmission" | "runId"> = {}
+  runId?: string | null,
+  requireConnectionAdmission?: boolean
 ): Promise<IngestRecordsWithinCoordinatorResult> {
   const outcomes: Array<RecordIngestBatchOutcome | undefined> = new Array(records.length);
   const changedRecords: DeferredRecordIndex[] = [];
@@ -1902,9 +1906,8 @@ async function ingestRecordsWithinCoordinator(
     // any lock across the whole batch, so only a per-record, in-transaction
     // check closes the delete-or-revoke/write TOCTOU for every record, not
     // just the first.
-    ...(options.collectionRevision ? { collectionRevision: options.collectionRevision } : {}),
-    ...(options.requireConnectionAdmission ? { requireConnectionAdmission: options.requireConnectionAdmission } : {}),
-    ...(options.runId ? { runId: options.runId } : {}),
+    ...(requireConnectionAdmission ? { requireConnectionAdmission } : {}),
+    ...(runId ? { runId } : {}),
   };
   // Computed once per batch, not per record: the storage backend cannot
   // change mid-batch, and this decides whether the explicit yield below
@@ -1962,7 +1965,7 @@ async function ingestRecordsWithinCoordinator(
       // above explains why the detail must appear here at all.
       const logIngestFailure = ingestFailureLogLevel(classified) === "warn" ? console.warn : console.error;
       logIngestFailure(
-        `[records] ingest write failed connector_instance_id=${loggingConnectorInstanceId} run_id=${options.runId ?? "unknown"} ` +
+        `[records] ingest write failed connector_instance_id=${loggingConnectorInstanceId} run_id=${runId ?? "unknown"} ` +
           `stream=${record.stream} code=${classified.code} retryable=${classified.retryable}: ${classified.message}`
       );
     }
@@ -1981,7 +1984,7 @@ async function ingestRecordsWithinCoordinator(
         };
         // Same server-log-only rationale as the write-failure branch above.
         console.error(
-          `[records] ingest afterRecord failed connector_instance_id=${loggingConnectorInstanceId} run_id=${options.runId ?? "unknown"} ` +
+          `[records] ingest afterRecord failed connector_instance_id=${loggingConnectorInstanceId} run_id=${runId ?? "unknown"} ` +
             `stream=${record.stream} code=${classified.code} retryable=${classified.retryable}: ${classified.message}`
         );
       }
@@ -2063,7 +2066,6 @@ function toPostgresIngestOptions(options: RecordIngestOptions) {
   const attemptContext = toPostgresAttemptContext(options.attemptContext);
   return {
     ...(attemptContext ? { attemptContext } : {}),
-    ...(options.collectionRevision ? { collectionRevision: options.collectionRevision } : {}),
     ...(options.deviceReservation ? { deviceReservation: options.deviceReservation } : {}),
     ...(options.requireConnectionAdmission ? { requireConnectionAdmission: options.requireConnectionAdmission } : {}),
     ...(options.runId ? { runId: options.runId } : {}),
@@ -2320,9 +2322,6 @@ async function ingestSqliteRecord(
     if (options.requireConnectionAdmission) {
       assertSqliteConnectorInstanceWritableWithinTransaction(connectorInstanceId);
     }
-    if (options.collectionRevision) {
-      requireSqliteCollectionObservationInTransaction(getDb(), connectorInstanceId, options.collectionRevision);
-    }
     const finishDurableOutcome = (value: DurableIngestOutcome): DurableIngestOutcome => {
       if (options.deviceReservation) {
         advanceSqliteDeviceIngestPrefix(options.deviceReservation, options.deviceReservation.inputIndex);
diff --git a/reference-implementation/server/routes/rs-mutation.ts b/reference-implementation/server/routes/rs-mutation.ts
index fb0ca173c..23d494323 100644
--- a/reference-implementation/server/routes/rs-mutation.ts
+++ b/reference-implementation/server/routes/rs-mutation.ts
@@ -87,7 +87,6 @@ import {
 } from "../../operations/rs-records-ingest/index.ts";
 import { canonicalConnectorKey } from "../connector-key.ts";
 import { HOSTED_INGEST_MAX_LINE_BYTES } from "../hosted-ingest-limits.ts";
-import type { CollectionRevisionEventInput } from "../stores/collection-revision-store.ts";
 import type { MiddlewareHandler, PdppErrorFn, RouteArg } from "./_route-contract.ts";
 
 // Express-shaped surface, structurally typed to avoid pulling in the
@@ -237,12 +236,10 @@ async function ingestRecordClassified(
   ctx: MountRsMutationContext,
   namespace: ConnectorNamespaceLike,
   record: Record<string, unknown>,
-  runId: string | null,
-  collectionRevision?: CollectionRevisionEventInput
+  runId: string | null
 ): Promise<unknown> {
   try {
     return await ctx.ingestRecord(ctx.storageTargetForConnectorNamespace(namespace), record, {
-      ...(collectionRevision ? { collectionRevision } : {}),
       requireConnectionAdmission: Boolean(namespace.connectorInstanceId),
       runId,
     });
@@ -434,22 +431,14 @@ export interface MountRsMutationContext {
   readonly ingestRecord: (
     target: StorageTargetLike,
     record: unknown,
-    options?: {
-      collectionRevision?: CollectionRevisionEventInput;
-      requireConnectionAdmission?: boolean;
-      runId?: string | null;
-    }
+    options?: { requireConnectionAdmission?: boolean; runId?: string | null }
   ) => Promise<unknown>;
   /** Optional common-path batch capability; hosts without it use the ordered fallback. */
   readonly ingestRecords?: (
     target: StorageTargetLike,
     records: readonly unknown[],
     afterRecord?: (record: unknown, outcome: unknown) => Promise<void>,
-    options?: {
-      collectionRevision?: CollectionRevisionEventInput;
-      requireConnectionAdmission?: boolean;
-      runId?: string | null;
-    }
+    options?: { requireConnectionAdmission?: boolean; runId?: string | null }
   ) => Promise<readonly unknown[]>;
   readonly insertOrReplayRecordRejection?: (input: {
     auditActorId: string;
@@ -1215,10 +1204,7 @@ export function mountRsRecordsIngest(app: AppLike, ctx: MountRsMutationContext):
         },
         ingestRecord: async (cid: string, _cin: string | null, record: Record<string, unknown>) => {
           const namespace = storageNamespace ?? (await resolveAdmittedNamespace(cid, _cin));
-          const collectionRevision = namespace.connectorInstanceId
-            ? { at: new Date().toISOString(), event: "batch_record" as const, runId }
-            : undefined;
-          const result = await ingestRecordClassified(ctx, namespace, record, runId, collectionRevision);
+          const result = await ingestRecordClassified(ctx, namespace, record, runId);
           if (ctx.getLatestAcquisitionBatchForConnection && namespace.connectorInstanceId) {
             acquisitionBatchPromise ??= Promise.resolve(
               ctx.getLatestAcquisitionBatchForConnection(namespace.connectorInstanceId)
@@ -1269,9 +1255,6 @@ export function mountRsRecordsIngest(app: AppLike, ctx: MountRsMutationContext):
                 records: readonly Record<string, unknown>[]
               ): Promise<readonly (IngestLineFailure | null)[]> {
                 const namespace = storageNamespace ?? (await resolveAdmittedNamespace(cid, cin));
-                const collectionRevision = namespace.connectorInstanceId
-                  ? { at: new Date().toISOString(), event: "batch_record" as const, runId }
-                  : undefined;
                 // biome-ignore lint/suspicious/noUnnecessaryConditions: Express route params are nullable at runtime even though the local adapter type narrows them.
                 const streamName = req.params.stream ?? "";
                 const getLatestAcquisitionBatch = ctx.getLatestAcquisitionBatchForConnection;
@@ -1299,11 +1282,7 @@ export function mountRsRecordsIngest(app: AppLike, ctx: MountRsMutationContext):
                   ctx.storageTargetForConnectorNamespace(namespace),
                   records,
                   afterRecord,
-                  {
-                    ...(collectionRevision ? { collectionRevision } : {}),
-                    requireConnectionAdmission: Boolean(namespace.connectorInstanceId),
-                    runId,
-                  }
+                  { requireConnectionAdmission: Boolean(namespace.connectorInstanceId), runId }
                 );
                 return mapBatchIngestOutcomes(records, outcomes);
               },
diff --git a/reference-implementation/server/stores/collection-revision-store.ts b/reference-implementation/server/stores/collection-revision-store.ts
index 1e7c0af28..d192dfaf7 100644
--- a/reference-implementation/server/stores/collection-revision-store.ts
+++ b/reference-implementation/server/stores/collection-revision-store.ts
@@ -115,10 +115,8 @@ interface AdvancedRevision {
 // Move the run-order marker for an observation that has just taken `revision`.
 // The observation's run sequence is its own run's issued sequence in the
 // current storage epoch, else the newest issued sequence (with no run id). The
-// marker moves when that sequence is at least the highest observed one. An
-// explicit run id with no issued sequence is marked `unsequenced_attempt` and
-// stays ineligible at that sequence, even if a run was already pending there.
-// The caller's revision UPDATE already holds the connection row lock.
+// marker moves when that sequence is at least the highest observed one. The
+// caller's revision UPDATE already holds the connection row lock.
 const RUN_ORDER_OBSERVATION = `SELECT COALESCE(rs.run_sequence, ci.run_sequence_issued) AS seq,
                 rs.run_id AS run_id, rs.run_sequence AS run_sequence, ci.storage_epoch AS storage_epoch
            FROM connector_instances ci
@@ -232,25 +230,11 @@ export function advanceSqliteCollectionRevisionInTransaction(
     connectorInstanceId,
     input.event
   );
-  const runOrderEvent =
-    input.runId !== null && input.runId !== undefined && observation.runSequence === null
-      ? "unsequenced_attempt"
-      : input.event;
   db.prepare(
     `UPDATE connector_instances
         SET run_order_sequence = ?, run_order_event = ?, run_order_run_id = ?, run_order_revision = ?
-      WHERE connector_instance_id = ? AND run_order_sequence <= ?
-        AND NOT (run_order_sequence = ? AND run_order_event = 'unsequenced_attempt' AND ? IS NOT NULL)`
-  ).run(
-    observation.seq,
-    runOrderEvent,
-    observation.runId,
-    advanced.revision,
-    connectorInstanceId,
-    observation.seq,
-    observation.seq,
-    observation.runSequence
-  );
+      WHERE connector_instance_id = ? AND run_order_sequence <= ?`
+  ).run(observation.seq, input.event, observation.runId, advanced.revision, connectorInstanceId, observation.seq);
   return { ...advanced, runSequence: observation.runSequence, storageEpoch: observation.storageEpoch };
 }
 
@@ -298,16 +282,11 @@ export async function advancePostgresCollectionRevisionInTransaction(
     connectorInstanceId,
     input.event
   );
-  const runOrderEvent =
-    input.runId !== null && input.runId !== undefined && observation.runSequence === null
-      ? "unsequenced_attempt"
-      : input.event;
   await client.query(
     `UPDATE connector_instances
         SET run_order_sequence = $1, run_order_event = $2, run_order_run_id = $3, run_order_revision = $4
-      WHERE connector_instance_id = $5 AND run_order_sequence <= $1
-        AND NOT (run_order_sequence = $1 AND run_order_event = 'unsequenced_attempt' AND $6 IS NOT NULL)`,
-    [observation.seq, runOrderEvent, observation.runId, advanced.revision, connectorInstanceId, observation.runSequence]
+      WHERE connector_instance_id = $5 AND run_order_sequence <= $1`,
+    [observation.seq, input.event, observation.runId, advanced.revision, connectorInstanceId]
   );
   return { ...advanced, runSequence: observation.runSequence, storageEpoch: observation.storageEpoch };
 }
diff --git a/reference-implementation/server/stores/run-history-writer.ts b/reference-implementation/server/stores/run-history-writer.ts
index a8d19faf6..fab53d152 100644
--- a/reference-implementation/server/stores/run-history-writer.ts
+++ b/reference-implementation/server/stores/run-history-writer.ts
@@ -76,10 +76,6 @@ export function isRunHistoryRelevantEventType(eventType: string | null | undefin
   );
 }
 
-export function isRunTerminalEventType(eventType: string | null | undefined): boolean {
-  return RUN_TERMINAL_EVENT_TYPES.has(eventType ?? "");
-}
-
 export interface RunHistorySpineEvent {
   readonly connectorId: string | null;
   readonly connectorInstanceId: string | null;
diff --git a/reference-implementation/test/local-device-coverage-revision-atomicity.test.ts b/reference-implementation/test/local-device-coverage-revision-atomicity.test.ts
index 5474bb266..07500c89f 100644
--- a/reference-implementation/test/local-device-coverage-revision-atomicity.test.ts
+++ b/reference-implementation/test/local-device-coverage-revision-atomicity.test.ts
@@ -24,7 +24,6 @@ import test from "node:test";
 
 import { validateResponse } from "@pdpp/reference-contract";
 
-import { emitSpineEvent } from "../lib/spine.ts";
 import { COLLECTOR_PROTOCOL_VERSION } from "../server/collector-protocol.ts";
 import { reconcileDirtyConnectorSummaryEvidence } from "../server/connector-summary-read-model.ts";
 import { closeDb, getDb, initDb } from "../server/db.ts";
@@ -83,8 +82,6 @@ interface Lane {
   readonly asUrl: string;
   readonly backend: Backend;
   readonly enrolled: Enrolled;
-  readonly getRuntimeOwnerToken?: () => Promise<string>;
-  readonly rsUrl?: string;
 }
 
 interface JsonResponse {
@@ -250,16 +247,11 @@ async function withServerLane(
   }
   await server.startupBackfillDone?.catch(() => undefined);
   const asUrl = `http://localhost:${server.asPort}`;
-  const rsUrl = `http://localhost:${server.rsPort}`;
   __setLocalCollectorReleaseForTest(CONNECTOR_ID, SERVER_RELEASE);
   try {
     const cookie = await ownerSessionCookie(asUrl);
     const enrolled = await enroll(asUrl, cookie);
-    const getRuntimeOwnerToken = async () => {
-      assert.ok(server.controller, "the reference runtime controller is available");
-      return await server.controller.issueRuntimeOwnerToken();
-    };
-    const lane = { asUrl, backend, enrolled, rsUrl, getRuntimeOwnerToken };
+    const lane = { asUrl, backend, enrolled };
     await registerFixtureManifest(lane);
     await run(lane);
   } finally {
@@ -1362,79 +1354,6 @@ laneTest("run order: an unregistered attempt retires prior coverage and cannot e
   await assertCovered(lane, "run-registered", "a registered run's proof is current");
 });
 
-laneTest("cross-runtime reference records and failures retire device coverage without run sequences", async (lane) => {
-  await commitProof(lane, "device-run-covered");
-  const pendingDeviceRunId = "device-run-pending-after-reference";
-  await issueRun(lane, pendingDeviceRunId);
-
-  const referenceRunId = "reference-run-record-batch";
-  // A reference runtime run normally creates this admission row at run.started;
-  // it deliberately has no collection_run_sequences entry.
-  await sql(
-    lane,
-    `INSERT INTO run_history(run_id, connector_instance_id, connector_id, source_json, status, known_gaps_json, started_at, attempt)
-     VALUES (?, ?, ?, '{}', 'running', '[]', ?, 1)`,
-    `INSERT INTO run_history(run_id, connector_instance_id, connector_id, source_json, status, known_gaps_json, started_at, attempt)
-     VALUES ($1, $2, $3, '{}'::jsonb, 'running', '[]'::jsonb, $4, 1)`,
-    [referenceRunId, lane.enrolled.connector_instance_id, CONNECTOR_ID, EMITTED_AT]
-  );
-  const { getRuntimeOwnerToken, rsUrl } = lane;
-  assert.ok(rsUrl, "the cross-runtime lane exposes the reference resource server");
-  assert.ok(getRuntimeOwnerToken, "the cross-runtime lane can mint a runtime owner token");
-  const ingestUrl = new URL("/v1/ingest/sessions", rsUrl);
-  ingestUrl.searchParams.set("connector_id", CONNECTOR_ID);
-  ingestUrl.searchParams.set("connector_instance_id", lane.enrolled.connector_instance_id);
-  ingestUrl.searchParams.set("run_id", referenceRunId);
-  const runtimeOwnerToken = await getRuntimeOwnerToken();
-  const ingested = await requestJson(ingestUrl.toString(), {
-    body: `${JSON.stringify({ data: { id: "reference-record" }, emitted_at: EMITTED_AT, key: "reference-record" })}\n`,
-    headers: {
-      Authorization: `Bearer ${runtimeOwnerToken}`,
-      "Content-Type": "application/x-ndjson",
-    },
-    method: "POST",
-  });
-  assert.equal(ingested.status, 200, JSON.stringify(ingested.body));
-  assert.equal(ingested.body?.records_accepted, 1, JSON.stringify(ingested.body));
-  assert.equal((await highWater(lane)).event, "batch_record");
-  const referenceObservation = await runOrder(lane);
-  assert.equal(referenceObservation.sequence, 2, "the unsequenced reference run counts at the latest issued sequence");
-  assert.equal(referenceObservation.runId, null, "the reference run has no device run sequence and cannot name one");
-  assert.equal(referenceObservation.event, "unsequenced_attempt");
-  await assertRetired(lane, "the reference runtime's accepted record retires the device positive");
-
-  await commitIssuedProof(lane, pendingDeviceRunId);
-  assert.equal(
-    (await runOrder(lane)).runId,
-    null,
-    "a same-sequence device terminal cannot replace the unsequenced observation"
-  );
-  await assertRetired(lane, "a device run already pending when the reference observation arrived is not eligible");
-
-  await commitProof(lane, "device-run-covered-again");
-  await assertCovered(lane, "device-run-covered-again", "a later device run gets a newer sequence and proves coverage");
-  const referenceFailureRunId = "reference-run-failed-without-sequence";
-  await emitSpineEvent({
-    actor_id: CONNECTOR_ID,
-    actor_type: "runtime",
-    data: {
-      connector_instance_id: lane.enrolled.connector_instance_id,
-      reason: "connector_reported_failed",
-      source: { id: CONNECTOR_ID, kind: "connector" },
-    },
-    event_type: "run.failed",
-    object_id: referenceFailureRunId,
-    object_type: "run",
-    run_id: referenceFailureRunId,
-    status: "failed",
-  });
-  assert.equal((await highWater(lane)).event, "terminal_run");
-  const failureObservation = await runOrder(lane);
-  assert.equal(failureObservation.runId, null, "the reference failure has no issued device sequence");
-  assert.equal(failureObservation.event, "unsequenced_attempt");
-  await assertRetired(lane, "a reference-runtime failure report retires the device positive");
-});
-
 laneTest("run start alone leaves earlier coverage and its as-of standing", async (lane) => {
   await commitProof(lane, "run-covered");
   const before = await projection(lane);

From a6daef5c7d25f301002a6f8030055950f467cd96 Mon Sep 17 00:00:00 2001
From: Tim Nunamaker <tnunamak@gmail.com>
Date: Thu, 22 Oct 2026 22:37:00 -0500
Subject: [PATCH 72/87] Gate store coverage by source kind

Paired-device terminal reports on browser_collector connections could otherwise create store-coverage positives that later server runs cannot retire. Refuse local_device at shared server admission and startup enrollment, and keep terminal claims from other source kinds unknown while storing their run records. browser_collector retirement remains a gap until server observations participate in device run order.

Assisted-by: AI
Signed-off-by: Tim Nunamaker <tnunamak@gmail.com>
---
 docs/261021-local-device-coverage-evidence.md |   2 +
 .../local-device-terminal-collection.ts       |  25 +++-
 .../server/auto-enroll-eligible-schedules.ts  |  10 ++
 .../server/connector-instance-placement.ts    |  24 ++++
 .../server/connector-summary-read-model.ts    |   8 +-
 reference-implementation/server/index.ts      |   7 +-
 .../server/ref-control.ts                     |  72 +++++++----
 .../server/routes/_route-contract.ts          |  10 +-
 .../server/runtime-collection-facts.ts        |   7 ++
 .../server/stores/connector-instance-store.ts |   8 +-
 .../stores/terminal-run-commit-store.ts       |  10 +-
 .../auto-enroll-schedule-instance-key.test.ts |  66 ++++++++++
 ...device-coverage-revision-atomicity.test.ts | 114 +++++++++++++++++-
 ...vice-terminal-run-commit-operation.test.ts |  28 ++---
 .../test/ref-source-webhook-route.test.ts     |  38 ++++++
 .../test/scheduler.test.ts                    |  82 ++++++++++++-
 16 files changed, 455 insertions(+), 56 deletions(-)
 create mode 100644 reference-implementation/server/connector-instance-placement.ts

diff --git a/docs/261021-local-device-coverage-evidence.md b/docs/261021-local-device-coverage-evidence.md
index 7ed792fc2..a2baf03fe 100644
--- a/docs/261021-local-device-coverage-evidence.md
+++ b/docs/261021-local-device-coverage-evidence.md
@@ -88,6 +88,8 @@ The spec gate amended the ordering decision. Two orders exist, and each controls
 
 No wall clock takes part in either.
 
+Placement makes cross-runtime execution impossible for every connection that can hold a positive: shared admission refuses `local_device` runs (`reference-implementation/server/stores/connector-instance-store.ts:1238`), and startup enrollment filters them out (`reference-implementation/server/index.ts:9678`). Terminal collection checks the source kind with the same shared predicate (`reference-implementation/operations/local-device-terminal-collection.ts:456`, called by the v2 path at line 240) and stores an ineligibility reason; the run selector and stream-facts fold keep those claims out of coverage (`reference-implementation/server/ref-control.ts:2892`; `reference-implementation/server/connector-summary-read-model.ts:1632`). Device-enrolled `browser_collector` connections remain server-schedulable. Their records and terminal reports are stored, but the device's store claims stay unknown because a server-scheduled run of that same connection has no device run-order marker to retire a positive; cross-runtime retirement for `browser_collector` is a gap.
+
 Sequence issuance. The runtime already contacts the server before it scans: a "starting" heartbeat, the pre-scan drain, and the state read, which names the connection. None of these can carry the issuance. The heartbeat is a best-effort liveness signal that names no run, and the state read is a GET, which must stay free of side effects. The runtime therefore makes one new idempotent call at the same point, after the state read and before the scan: `POST .../source-instances/{source}/run-starts` with the run id. The server resolves the authenticated device, source and connection the same way as the terminal route. In one transaction that holds the connection row lock, it increments `connector_instances.run_sequence_issued` and stores `(connector_instance_id, run_id) -> (run_sequence, storage_epoch, device_id, source_instance_id)` in `collection_run_sequences`. An exact replay of the same run id from the same device and source returns the stored sequence (200). The same run id from another device or source is `409 run_start_conflict`. The runtime keeps the run id it registered and uses it for the run's terminal record. A server without the route (404), or a failed call, leaves the run without a sequence. The run still collects and commits its terminal record, but that record can never be an eligible positive proof.
 
 Run-start registration alone is not a coverage observation and does not retire the current proof. If a registered run crashes before a terminal record or ingested batch reaches the server, the earlier positive remains current with its original as-of. This is an accepted limit.
diff --git a/reference-implementation/operations/local-device-terminal-collection.ts b/reference-implementation/operations/local-device-terminal-collection.ts
index a935301c8..110245657 100644
--- a/reference-implementation/operations/local-device-terminal-collection.ts
+++ b/reference-implementation/operations/local-device-terminal-collection.ts
@@ -4,6 +4,7 @@
 import { createHash } from "node:crypto";
 import { canonicalTerminalRunCommitEnvelope } from "@pdpp/collector-runtime/local-device-envelope";
 import { canonicalTerminalRunCommitJson } from "@pdpp/reference-contract/common";
+import { isLocalDeviceConnection, NON_LOCAL_DEVICE_COVERAGE_REASON } from "../server/connector-instance-placement.ts";
 import { fingerprintDeviceAttemptManifest } from "../server/device-ingest-attempt-context.ts";
 import { readRuntimeCollectionFact } from "../server/runtime-collection-facts.ts";
 import { type IssuedRunSequence, RunStartConflictError } from "../server/stores/collection-revision-store.ts";
@@ -31,7 +32,7 @@ interface TerminalResponse {
 }
 
 interface AuthorizedSource {
-  readonly connectorInstance: { readonly connectorInstanceId: string };
+  readonly connectorInstance: { readonly connectorInstanceId: string; readonly sourceKind?: string | null };
   readonly sourceInstance: {
     readonly connectorId: string;
     readonly manifestGeneration?: number | null;
@@ -236,6 +237,8 @@ export async function handleLocalDeviceTerminalRunCommit(input: {
       return;
     }
 
+    const coverage = terminalCoverageEligibilityForSource(validatedFacts, authorized.connectorInstance);
+
     const result = await ctx.commitTerminalRun({
       collectionBoundary,
       commitId,
@@ -243,7 +246,8 @@ export async function handleLocalDeviceTerminalRunCommit(input: {
       connectorInstanceId: authorized.connectorInstance.connectorInstanceId,
       deviceId,
       envelopeHash,
-      normalizedFacts: validatedFacts,
+      normalizedFacts: coverage.facts,
+      ...(coverage.reason ? { coverageEligibilityReason: coverage.reason } : {}),
       runId,
       sourceInstanceId,
       stateDelta,
@@ -390,6 +394,7 @@ export async function handleLocalDeviceTerminalCollection(input: {
     // record takes the next collection revision in the same transaction, so a
     // report delayed past a newer proof retires that proof.
     const { connectorInstanceId } = authorized.connectorInstance;
+    const coverage = terminalCoverageEligibilityForSource(streams, authorized.connectorInstance);
     const event = {
       actor_id: deviceId,
       actor_type: "local_device",
@@ -402,7 +407,8 @@ export async function handleLocalDeviceTerminalCollection(input: {
           ...(collectionScope ? { collection_scope: collectionScope } : {}),
           reference_only: true,
           schema_version: 1,
-          streams,
+          ...(coverage.reason ? { coverage_eligibility_reason: coverage.reason } : {}),
+          streams: coverage.facts,
         },
         connector_instance_id: authorized.connectorInstance.connectorInstanceId,
         // Durable compatibility telemetry for retiring the split terminal
@@ -443,6 +449,19 @@ function asObject(value: unknown): Record<string, unknown> | null {
   return value && typeof value === "object" && !Array.isArray(value) ? (value as Record<string, unknown>) : null;
 }
 
+function terminalCoverageEligibilityForSource(
+  facts: readonly Record<string, unknown>[],
+  instance: { readonly sourceKind?: string | null }
+): { readonly facts: readonly Record<string, unknown>[]; readonly reason: string | null } {
+  if (isLocalDeviceConnection(instance)) {
+    return { facts, reason: null };
+  }
+  return {
+    facts,
+    reason: NON_LOCAL_DEVICE_COVERAGE_REASON,
+  };
+}
+
 function readRequiredString(value: unknown): string | null {
   return typeof value === "string" && value.trim() ? value : null;
 }
diff --git a/reference-implementation/server/auto-enroll-eligible-schedules.ts b/reference-implementation/server/auto-enroll-eligible-schedules.ts
index e50d09880..ad1999247 100644
--- a/reference-implementation/server/auto-enroll-eligible-schedules.ts
+++ b/reference-implementation/server/auto-enroll-eligible-schedules.ts
@@ -31,6 +31,7 @@
 
 import type { ConnectorSchedulePatch, ScheduleApi, ScheduleUpsertResult } from "../runtime/controller.ts";
 import { deriveRecommendedMode } from "../runtime/refresh-mode-derivation.ts";
+import { isLocalDeviceConnection } from "./connector-instance-placement.ts";
 
 const DEFAULT_INTERVAL_SECONDS = 3600;
 
@@ -54,6 +55,15 @@ export interface AutoEnrollConnectorRow {
 
 export type AutoEnrollListConnectors = () => Promise<readonly AutoEnrollConnectorRow[]>;
 
+/** Exclude paired-device connections from server-owned startup schedules. */
+export function listServerRunnableConnectorInstanceIds(
+  instances: readonly { readonly connectorInstanceId: string; readonly sourceKind: string }[]
+): string[] {
+  return instances
+    .filter((instance) => !isLocalDeviceConnection(instance))
+    .map((instance) => instance.connectorInstanceId);
+}
+
 export interface AutoEnrollOptions {
   controller: AutoEnrollControllerLike;
   /**
diff --git a/reference-implementation/server/connector-instance-placement.ts b/reference-implementation/server/connector-instance-placement.ts
new file mode 100644
index 000000000..a79e7da03
--- /dev/null
+++ b/reference-implementation/server/connector-instance-placement.ts
@@ -0,0 +1,24 @@
+// Copyright The PDP-Connect Contributors
+// SPDX-License-Identifier: Apache-2.0
+
+/** The source-kind fact shared by server controls, run admission and coverage. */
+export interface ConnectorInstancePlacement {
+  readonly sourceKind?: string | null;
+}
+
+export const NON_LOCAL_DEVICE_COVERAGE_REASON = "connection_source_kind_not_local_device" as const;
+
+export function isLocalDeviceConnection(instance: ConnectorInstancePlacement): boolean {
+  return instance.sourceKind === "local_device";
+}
+
+/** Refuse server controls that would try to operate a paired-device connection remotely. */
+export function assertRemoteControlSupported(instance: ConnectorInstancePlacement): void {
+  if (isLocalDeviceConnection(instance)) {
+    const error = new Error(
+      "Local-device connections are collected by their paired device and cannot be started by the reference server."
+    ) as Error & { code: string };
+    error.code = "local_device_control_unsupported";
+    throw error;
+  }
+}
diff --git a/reference-implementation/server/connector-summary-read-model.ts b/reference-implementation/server/connector-summary-read-model.ts
index 05191d7f9..871b8ce21 100644
--- a/reference-implementation/server/connector-summary-read-model.ts
+++ b/reference-implementation/server/connector-summary-read-model.ts
@@ -35,6 +35,7 @@
  */
 
 import { iterateDynamicSqlAcknowledged } from "../lib/db.ts";
+import { NON_LOCAL_DEVICE_COVERAGE_REASON } from "./connector-instance-placement.ts";
 import { readConnectorInstanceIdPage as readInstanceIdPage } from "./connector-summary-evidence-bounded-reconciliation.ts";
 import type { RepairCandidateReason } from "./connector-summary-evidence-engine.ts";
 import {
@@ -1258,7 +1259,9 @@ const TERMINAL_TYPES_SQL = TERMINAL_RUN_EVENT_TYPES.map((t) => `'${t}'`).join(",
 // tests previously hardcoded the then-current number and had to be edited on
 // every semantics bump, which makes a stale literal — not a real regression —
 // look like a failure.
-export const STREAM_FACTS_FOLD_LOGIC_VERSION = 6;
+// Version 7 drops device coverage rejected for its source kind and replays
+// older fold rows so cached stream facts cannot retain that claim.
+export const STREAM_FACTS_FOLD_LOGIC_VERSION = 7;
 // A route may retry a replay once after a concurrent writer wins its CAS.
 // This is deliberately small: each retry rereads the durable baseline, and
 // persistent contention fails closed in memory rather than spinning or
@@ -1626,6 +1629,9 @@ function parseTerminalFactEvent(row: Row): { payload: Row; streams: unknown[] }
     return null;
   }
   const block = payload.collection_facts as Row | undefined;
+  if (block?.coverage_eligibility_reason === NON_LOCAL_DEVICE_COVERAGE_REASON) {
+    return null;
+  }
   const streams = block && typeof block === "object" && Array.isArray(block.streams) ? block.streams : null;
   return streams && streams.length > 0 ? { payload, streams } : null;
 }
diff --git a/reference-implementation/server/index.ts b/reference-implementation/server/index.ts
index da7d876d5..8fc907370 100644
--- a/reference-implementation/server/index.ts
+++ b/reference-implementation/server/index.ts
@@ -155,7 +155,10 @@ import {
   stageOAuthAuthorizationCodeRequest,
   updateRegisteredClientName,
 } from "./auth.ts";
-import { autoEnrollEligibleSchedules } from "./auto-enroll-eligible-schedules.ts";
+import {
+  autoEnrollEligibleSchedules,
+  listServerRunnableConnectorInstanceIds,
+} from "./auto-enroll-eligible-schedules.ts";
 import type { CimdFetchDependencies } from "./cimd.ts";
 import { acquireDefaultDeliveryWorker, getDefaultDeliveryWorker } from "./client-event-delivery-worker.ts";
 import {
@@ -9672,7 +9675,7 @@ export async function startServer(opts: ServerOpts = {}) {
           ownerAuthSubjectId,
           canonicalId
         );
-        return instances.map((instance) => instance.connectorInstanceId);
+        return listServerRunnableConnectorInstanceIds(instances);
       },
       listConnectors: async () => {
         const manifests = await collectValidRegisteredConnectorManifests({
diff --git a/reference-implementation/server/ref-control.ts b/reference-implementation/server/ref-control.ts
index 9da5380e4..b7e1f171a 100644
--- a/reference-implementation/server/ref-control.ts
+++ b/reference-implementation/server/ref-control.ts
@@ -155,6 +155,7 @@ import {
   loadOwnerConnectorInstanceGroupsSqlite,
   resolveCanonicalConnectorInstanceId,
 } from "./connector-instance-canonicalization.ts";
+import { isLocalDeviceConnection, NON_LOCAL_DEVICE_COVERAGE_REASON } from "./connector-instance-placement.ts";
 import { canonicalConnectorKey } from "./connector-key.ts";
 import {
   type HeartbeatRow,
@@ -600,12 +601,6 @@ export interface ConnectorRunSummary {
   readonly collection_facts: RuntimeCollectionFacts | null;
   /** The per-connection collection revision this run was committed at; `null` when the run carries none. */
   readonly collection_revision?: number | null;
-  /** Authenticated v2 device terminal evidence, kept raw until manifest and current scope are checked on read. */
-  readonly local_terminal_coverage?: {
-    readonly eligibleLocalRun: boolean;
-    readonly collectionScope: unknown;
-    readonly streams: unknown;
-  } | null;
   readonly connector_error?: ConnectorRunErrorSummary | null;
   readonly event_count: number;
   readonly failure_reason: string | null;
@@ -613,6 +608,13 @@ export interface ConnectorRunSummary {
   readonly first_at: string;
   readonly known_gaps: unknown[];
   readonly last_at: string;
+  /** Authenticated v2 device terminal evidence, kept raw until manifest and current scope are checked on read. */
+  readonly local_terminal_coverage?: {
+    readonly coverageEligibilityReason: string | null;
+    readonly eligibleLocalRun: boolean;
+    readonly collectionScope: unknown;
+    readonly streams: unknown;
+  } | null;
   readonly records_emitted?: number | null;
   /**
    * Whether this run was dispatched `recovery_only` (drains pending detail
@@ -1648,6 +1650,8 @@ function readLocalTerminalCoverage(
     return null;
   }
   return {
+    coverageEligibilityReason:
+      typeof block.coverage_eligibility_reason === "string" ? block.coverage_eligibility_reason : null,
     eligibleLocalRun:
       history.status === "succeeded" &&
       history.schedulerManaged === false &&
@@ -2885,6 +2889,9 @@ function coverageClassifyingRun(
   lastSuccessfulRun: ConnectorRunSummary | null,
   latestSettledRun: ConnectorRunSummary | null = lastRun
 ): ConnectorRunSummary | null {
+  if (latestSettledRun?.local_terminal_coverage?.coverageEligibilityReason === NON_LOCAL_DEVICE_COVERAGE_REASON) {
+    return null;
+  }
   const settledIsIntervening =
     latestSettledRun !== null &&
     latestSettledRun !== lastSuccessfulRun &&
@@ -5076,8 +5083,15 @@ function deriveLocalTerminalCoverageAxis(
   };
   // A failed scope-state read cannot establish which boundary the connection
   // currently asks the collector to cover.
-  if (!legacyAxis || typeof declaredScope !== "string" || !terminal.eligibleLocalRun || typeof terminal.collectionScope !== "string" ||
-    terminal.collectionScope !== declaredScope || !Array.isArray(terminal.streams)) {
+  if (
+    !legacyAxis ||
+    typeof declaredScope !== "string" ||
+    terminal.coverageEligibilityReason !== null ||
+    !terminal.eligibleLocalRun ||
+    typeof terminal.collectionScope !== "string" ||
+    terminal.collectionScope !== declaredScope ||
+    !Array.isArray(terminal.streams)
+  ) {
     return unknown;
   }
   const normalized = normalizeTerminalCoverageFacts(terminal.streams, manifest, terminal.collectionScope, {
@@ -5293,6 +5307,25 @@ function fenceLocalCoverageProof(
   return { ...axis, asOf };
 }
 
+function localDeviceCoverageForSourceKind(
+  axis: LocalCoverageDiagnosticAxis | null,
+  localDeviceBacked: boolean
+): LocalCoverageDiagnosticAxis | null {
+  if (localDeviceBacked || axis === null) {
+    return axis;
+  }
+  return {
+    ...axis,
+    asOf: null,
+    axis: "unknown",
+    evidenceAsOf: null,
+    measuredCollectionScope: null,
+    reliable: false,
+    rows: [],
+    unaccountedStores: [],
+  };
+}
+
 /**
  * Read durable local coverage diagnostics for one connection and project the
  * coverage axis. Returns `null` (axis derivation skipped) when the read throws —
@@ -6353,13 +6386,10 @@ export function projectConnectorSummaryConnectionHealth(input: {
   // Persisted source kind decides authority before health derives any scheduler
   // fact. A local device may have historical/foreign server runs, but they are
   // never evidence for its current device-side collection proof — UNLESS the
-  // row itself proves it is this connection's own current scheduler-managed
-  // run (`scheduler_managed = true`), not a foreign/stale artifact. A local
-  // device can still be enrolled behind this connection's own scheduler (e.g.
-  // a push-mode collector whose runs the scheduler nonetheless records), and
-  // discarding that proof unconditionally left `axes.coverage` stuck at
-  // `"unknown"` forever even when every required stream's collection report
-  // had already proven `"complete"` from the same run's evidence.
+  // row itself proves it is this connection's own scheduler-managed run, not a
+  // foreign/stale artifact. Keep that rule for historical rows written before
+  // placement admission began refusing new server runs for local-device
+  // connections.
   const localDeviceBacked = input.localDeviceBacked === true;
   const isOwnScopedRun = (run: ConnectorRunSummary | null): boolean =>
     !localDeviceBacked || run?.scheduler_managed === true;
@@ -7297,11 +7327,11 @@ function synthesizeConnectorSummary(input: ConnectorSummarySynthesisInput): Conn
     runtimeOk,
     schedule,
   } = input;
-  const localDeviceBacked = instance.sourceKind === "local_device";
+  const localDeviceBacked = isLocalDeviceConnection(instance);
   // See the matching comment in `projectConnectorSummaryConnectionHealth`: a
-  // local device's run evidence is quarantined as foreign/historical UNLESS
-  // the row itself proves it is this connection's own current
-  // scheduler-managed run (`scheduler_managed = true`).
+  // local device's run evidence is quarantined as foreign/historical unless
+  // the row proves it is this connection's own scheduler-managed run. This
+  // keeps historical rows readable after placement admission blocks new ones.
   const isOwnScopedRun = (run: ConnectorRunSummary | null): boolean =>
     !localDeviceBacked || run?.scheduler_managed === true;
   const authoritativeActiveRun = localDeviceBacked ? null : activeRun;
@@ -7340,7 +7370,7 @@ function synthesizeConnectorSummary(input: ConnectorSummarySynthesisInput): Conn
         proofRunCoverage,
         fallbackSettledRun
       )
-    : localCoverage;
+    : localDeviceCoverageForSourceKind(localCoverage, localDeviceBacked);
   const authoritativeLatestStreamFacts = localDeviceBacked ? null : latestStreamFacts;
   const terminalSetupDisposition =
     instance.status === "draft" && authoritativeLastRun
@@ -8277,7 +8307,7 @@ async function projectConnectorSummaryForInstance(
   // `projectConnectorSummaryConnectionHealth` are the actual authority
   // boundary for run evidence: they quarantine any hydrated run that is not
   // proven `scheduler_managed`, exactly as before for every other run.
-  const localDeviceBacked = instance.sourceKind === "local_device";
+  const localDeviceBacked = isLocalDeviceConnection(instance);
   const hydrateRunSummaries = shouldHydrateRunSummariesForInstance(
     deps.includeRunSummaries,
     instance,
diff --git a/reference-implementation/server/routes/_route-contract.ts b/reference-implementation/server/routes/_route-contract.ts
index 4f0fdaca6..d8c0e4ace 100644
--- a/reference-implementation/server/routes/_route-contract.ts
+++ b/reference-implementation/server/routes/_route-contract.ts
@@ -21,6 +21,8 @@
 // keeps a single source of truth without widening any adapter's documented
 // request/response surface.
 
+import { assertRemoteControlSupported as assertPlacementSupported } from "../connector-instance-placement.ts";
+
 // A middleware passed alongside the final route handler (e.g.
 // `requireOwnerSession`, `requireCsrf`). The transport forwards these
 // positionally, so the structural shape is intentionally permissive.
@@ -55,13 +57,7 @@ export interface ConnectorNamespace {
 }
 
 export function assertRemoteControlSupported(namespace: ConnectorNamespace): void {
-  if (namespace.sourceKind === "local_device") {
-    const error = new Error("Local-device connections are collected by their paired device.") as Error & {
-      code: string;
-    };
-    error.code = "local_device_control_unsupported";
-    throw error;
-  }
+  assertPlacementSupported(namespace);
 }
 
 export interface ActiveBinding {
diff --git a/reference-implementation/server/runtime-collection-facts.ts b/reference-implementation/server/runtime-collection-facts.ts
index 50232fbc2..391a2a5a0 100644
--- a/reference-implementation/server/runtime-collection-facts.ts
+++ b/reference-implementation/server/runtime-collection-facts.ts
@@ -12,6 +12,7 @@
 
 import { optionalRuntimeScopeFields, readRuntimeSkipFact } from "@pdpp/connector-protocol/connector-runtime-protocol";
 import type { CollectionRateSnapshot } from "../runtime/connection-health.ts";
+import { NON_LOCAL_DEVICE_COVERAGE_REASON } from "./connector-instance-placement.ts";
 import type { RuntimeCollectionFact, RuntimeCollectionFacts } from "./ref-control.ts";
 
 const COLLECTION_RATE_NUMBER_FIELDS = [
@@ -92,6 +93,12 @@ export function readCollectionFactsFromTerminalData(
   if (!block || typeof block !== "object" || Array.isArray(block)) {
     return null;
   }
+  if (
+    (block as { coverage_eligibility_reason?: unknown }).coverage_eligibility_reason ===
+    NON_LOCAL_DEVICE_COVERAGE_REASON
+  ) {
+    return null;
+  }
   // biome-ignore lint/style/useDestructuring: Explicit property or positional access documents this compatibility boundary.
   const streams = (block as { streams?: unknown }).streams;
   if (!Array.isArray(streams)) {
diff --git a/reference-implementation/server/stores/connector-instance-store.ts b/reference-implementation/server/stores/connector-instance-store.ts
index 00e9d2f1e..2e966b896 100644
--- a/reference-implementation/server/stores/connector-instance-store.ts
+++ b/reference-implementation/server/stores/connector-instance-store.ts
@@ -8,6 +8,7 @@ import {
   loadOwnerConnectorInstanceGroupsSqlite,
   resolveCanonicalConnectorInstanceId,
 } from "../connector-instance-canonicalization.ts";
+import { assertRemoteControlSupported } from "../connector-instance-placement.ts";
 
 // Type definitions
 interface ConnectorInstance {
@@ -1204,7 +1205,7 @@ export async function resolveOwnerConnectorInstanceNamespace({
  * account. Keeping that policy here prevents run creators from treating a
  * connector type (or another owner's deterministic id) as a capability.
  */
-export function admitOwnerRunConnection({
+export async function admitOwnerRunConnection({
   allowDraft = false,
   ownerSubjectId,
   connectorId,
@@ -1222,7 +1223,7 @@ export function admitOwnerRunConnection({
   displayName?: string | null;
   now?: string;
 }): Promise<ConnectorInstanceNamespace> {
-  return resolveOwnerConnectorInstanceNamespace({
+  const namespace = await resolveOwnerConnectorInstanceNamespace({
     // Explicit selectors never materialize or fall through. The broader
     // resolver still supports legacy read compatibility independently.
     allowDefaultAccount: !connectorInstanceId,
@@ -1234,6 +1235,8 @@ export function admitOwnerRunConnection({
     ownerSubjectId,
     ...(now === undefined ? {} : { now }),
   });
+  assertRemoteControlSupported(namespace);
+  return namespace;
 }
 
 /**
@@ -1269,6 +1272,7 @@ export async function admitOwnerBrowserEnrollmentRunConnection({
     connectorInstanceStore,
     ownerSubjectId,
   });
+  assertRemoteControlSupported(namespace);
   const binding = namespace.sourceBinding;
   const isBrowserEnrollmentShell =
     binding !== null &&
diff --git a/reference-implementation/server/stores/terminal-run-commit-store.ts b/reference-implementation/server/stores/terminal-run-commit-store.ts
index 78a540819..6aafc2c63 100644
--- a/reference-implementation/server/stores/terminal-run-commit-store.ts
+++ b/reference-implementation/server/stores/terminal-run-commit-store.ts
@@ -23,6 +23,8 @@ export interface ResolvedTerminalRunCommit {
   readonly commitId: string;
   readonly connectorId: string;
   readonly connectorInstanceId: string;
+  /** Stored with the terminal receipt when assertions are retained as unknown for placement. */
+  readonly coverageEligibilityReason?: string;
   readonly deviceId: string;
   readonly envelopeHash: string;
   readonly normalizedFacts: readonly Record<string, unknown>[];
@@ -133,15 +135,16 @@ function eventInputFor(
     actor_id: input.deviceId,
     actor_type: "local_device",
     data: {
-      // The connection revision this run, and the state it wrote, were
-      // committed at. It orders the record among observations and dates it.
-      collection_revision: order.collectionRevision,
       collection_facts: {
         collection_scope: input.collectionBoundary,
+        ...(input.coverageEligibilityReason ? { coverage_eligibility_reason: input.coverageEligibilityReason } : {}),
         reference_only: true,
         schema_version: input.version ?? 1,
         streams: input.normalizedFacts,
       },
+      // The connection revision this run, and the state it wrote, were
+      // committed at. It orders the record among observations and dates it.
+      collection_revision: order.collectionRevision,
       connector_instance_id: input.connectorInstanceId,
       // The run's place in run order: the sequence issued at its start (null
       // for a run without one) and the storage epoch it was recorded in. A
@@ -157,6 +160,7 @@ function eventInputFor(
           run_id: input.runId,
           source_instance_id: input.sourceInstanceId,
         },
+        ...(input.coverageEligibilityReason ? { coverage_eligibility_reason: input.coverageEligibilityReason } : {}),
         commit_id: input.commitId,
         envelope_hash: input.envelopeHash,
         response,
diff --git a/reference-implementation/test/auto-enroll-schedule-instance-key.test.ts b/reference-implementation/test/auto-enroll-schedule-instance-key.test.ts
index 030efa4d2..c4cf31b02 100644
--- a/reference-implementation/test/auto-enroll-schedule-instance-key.test.ts
+++ b/reference-implementation/test/auto-enroll-schedule-instance-key.test.ts
@@ -42,6 +42,7 @@ import { registerConnector } from "../server/auth.ts";
 import {
   type AutoEnrollListConnectors,
   autoEnrollEligibleSchedules,
+  listServerRunnableConnectorInstanceIds,
 } from "../server/auto-enroll-eligible-schedules.ts";
 import { canonicalConnectorKey } from "../server/connector-key.ts";
 import { closeDb, initDb } from "../server/db.ts";
@@ -158,3 +159,68 @@ test(
     );
   })
 );
+
+test(
+  "startup auto-enrollment omits local-device connections and schedules an ordinary server connection",
+  withTmpDb(async () => {
+    const manifest = testManifest();
+    const registryId = manifest.connector_id as string;
+    await registerConnector(manifest);
+    const canonicalId = canonicalConnectorKey(registryId) ?? registryId;
+    const instanceStore = createSqliteConnectorInstanceStore();
+    const now = new Date().toISOString();
+
+    await Promise.resolve(
+      instanceStore.upsert({
+        connectorId: canonicalId,
+        connectorInstanceId: "cin_autoenrolllocaldevice",
+        createdAt: now,
+        displayName: "Paired-device connection",
+        ownerSubjectId: OWNER_SUBJECT_ID,
+        sourceBinding: { kind: "test_local_device" },
+        sourceBindingKey: "test-local-device-binding",
+        sourceKind: "local_device",
+        status: "active",
+        updatedAt: now,
+      })
+    );
+    await Promise.resolve(
+      instanceStore.upsert({
+        connectorId: canonicalId,
+        connectorInstanceId: "cin_autoenrollserver",
+        createdAt: now,
+        displayName: "Server connection",
+        ownerSubjectId: OWNER_SUBJECT_ID,
+        sourceBinding: { kind: "test_account" },
+        sourceBindingKey: "test-server-binding",
+        sourceKind: "account",
+        status: "active",
+        updatedAt: now,
+      })
+    );
+
+    const controller = createController({});
+    const summary = await autoEnrollEligibleSchedules({
+      controller,
+      env: { [TEST_ENV_KEY]: "integration-token" },
+      listActiveConnectorInstanceIds: async (id) => {
+        const instances = await Promise.resolve(
+          instanceStore.listActiveByConnector(OWNER_SUBJECT_ID, canonicalConnectorKey(id) ?? id)
+        );
+        return listServerRunnableConnectorInstanceIds(instances);
+      },
+      listConnectors: buildListConnectors(manifest),
+    });
+    assert.equal(summary.enrolled, 1, JSON.stringify(summary));
+    assert.equal(summary.errors, 0, JSON.stringify(summary));
+
+    const rows = (await Promise.resolve(getDefaultSchedulerStore().listSchedules())).filter(
+      (row) => row.connector_id === canonicalId
+    );
+    assert.deepEqual(
+      rows.map((row) => row.connector_instance_id),
+      ["cin_autoenrollserver"],
+      "startup enrollment creates no server schedule for the paired-device connection"
+    );
+  })
+);
diff --git a/reference-implementation/test/local-device-coverage-revision-atomicity.test.ts b/reference-implementation/test/local-device-coverage-revision-atomicity.test.ts
index 07500c89f..a0cfc336e 100644
--- a/reference-implementation/test/local-device-coverage-revision-atomicity.test.ts
+++ b/reference-implementation/test/local-device-coverage-revision-atomicity.test.ts
@@ -24,6 +24,8 @@ import test from "node:test";
 
 import { validateResponse } from "@pdpp/reference-contract";
 
+import type { Controller } from "../runtime/controller.ts";
+
 import { COLLECTOR_PROTOCOL_VERSION } from "../server/collector-protocol.ts";
 import { reconcileDirtyConnectorSummaryEvidence } from "../server/connector-summary-read-model.ts";
 import { closeDb, getDb, initDb } from "../server/db.ts";
@@ -81,6 +83,7 @@ interface Enrolled {
 interface Lane {
   readonly asUrl: string;
   readonly backend: Backend;
+  readonly controller?: Controller;
   readonly enrolled: Enrolled;
 }
 
@@ -251,7 +254,7 @@ async function withServerLane(
   try {
     const cookie = await ownerSessionCookie(asUrl);
     const enrolled = await enroll(asUrl, cookie);
-    const lane = { asUrl, backend, enrolled };
+    const lane = { asUrl, backend, controller: server.controller, enrolled };
     await registerFixtureManifest(lane);
     await run(lane);
   } finally {
@@ -486,10 +489,62 @@ async function assertCovered(lane: Lane, runId: string, message: string): Promis
 
 async function assertRetired(lane: Lane, message: string): Promise<void> {
   const projected = await projection(lane);
-  assert.equal(projected.axis, "unknown", message);
+  assert.equal(projected.axis, "unknown", `${message}: ${JSON.stringify(projected)}`);
   assert.equal(projected.asOf, null, `${message}: retired coverage carries no as-of`);
 }
 
+laneTest("placement: direct runNow refuses a local-device connection at shared admission", async (lane) => {
+  assert.ok(lane.controller, "server controller is available");
+  await assert.rejects(
+    lane.controller.runNow(CONNECTOR_ID, {
+      connectorInstanceId: lane.enrolled.connector_instance_id,
+      runId: "run-local-device-server-run-refused",
+    }),
+    (error: unknown) => {
+      assert.equal((error as { code?: unknown }).code, "local_device_control_unsupported");
+      assert.ok((error as Error).message.includes("cannot be started by the reference server"));
+      return true;
+    }
+  );
+  const [run] = await sql(
+    lane,
+    "SELECT run_id FROM run_history WHERE run_id = ?",
+    "SELECT run_id FROM run_history WHERE run_id = $1",
+    ["run-local-device-server-run-refused"]
+  );
+  assert.equal(run, undefined, "admission refuses before a server run record is written");
+});
+
+laneTest("placement: webhook-triggered runNow refuses a local-device connection at shared admission", async (lane) => {
+  assert.ok(lane.controller, "server controller is available");
+  await assert.rejects(
+    lane.controller.runNow(CONNECTOR_ID, {
+      connectorInstanceId: lane.enrolled.connector_instance_id,
+      runId: "run-local-device-webhook-refused",
+      sourceWebhookEvent: {
+        action: "schedule_run",
+        bodyHash: "a".repeat(64),
+        eventId: "evt-local-device-webhook-refused",
+        receivedAt: EMITTED_AT,
+        sourceId: "source-webhook-local-device-refused",
+      },
+      triggerKind: "webhook",
+    }),
+    (error: unknown) => {
+      assert.equal((error as { code?: unknown }).code, "local_device_control_unsupported");
+      assert.ok((error as Error).message.includes("cannot be started by the reference server"));
+      return true;
+    }
+  );
+  const [run] = await sql(
+    lane,
+    "SELECT run_id FROM run_history WHERE run_id = ?",
+    "SELECT run_id FROM run_history WHERE run_id = $1",
+    ["run-local-device-webhook-refused"]
+  );
+  assert.equal(run, undefined, "webhook admission refuses before a server run record is written");
+});
+
 async function highWater(lane: Lane): Promise<HighWater> {
   const [row] = await sql(
     lane,
@@ -1560,6 +1615,61 @@ laneTest(
 
 const STREAM_NAME_PATH = /^\/streams\/\d+$/;
 
+laneTest(
+  "coverage: a browser_collector terminal commit stores the run but cannot establish a positive",
+  async (lane) => {
+    await sql(
+      lane,
+      "UPDATE connector_instances SET source_kind = 'browser_collector' WHERE connector_instance_id = ?",
+      "UPDATE connector_instances SET source_kind = 'browser_collector' WHERE connector_instance_id = $1",
+      [lane.enrolled.connector_instance_id]
+    );
+    assert.equal((await postRunStart(lane, "run-browser-source-kind")).status, 201);
+    const batch = await postBatch(lane, batchBody(lane, "batch-browser-source-kind", sessionRecords("browser-record")));
+    assert.equal(batch.status, 201, JSON.stringify(batch.body));
+
+    const committed = await postTerminal(lane, await terminalWireBody(lane, "run-browser-source-kind"));
+    assert.equal(committed.status, 201, JSON.stringify(committed.body));
+    assert.equal(await sessionRecordCount(lane), 1, "the device record remains stored");
+
+    const [run] = await sql(
+      lane,
+      "SELECT run_id, facts_json FROM run_history WHERE run_id = ?",
+      "SELECT run_id, facts_json::text AS facts_json FROM run_history WHERE run_id = $1",
+      ["run-browser-source-kind"]
+    );
+    assert.ok(run, "the browser_collector device run remains stored");
+    assert.equal(
+      (JSON.parse(String(run.facts_json)).collection_facts as Record<string, unknown>).coverage_eligibility_reason,
+      "connection_source_kind_not_local_device",
+      "run history retains the rejected coverage reason for projection"
+    );
+    const [terminal] = await sql(
+      lane,
+      "SELECT data_json FROM spine_events WHERE event_id = ?",
+      "SELECT data_json::text AS data_json FROM spine_events WHERE event_id = $1",
+      [String(committed.body?.terminal_event_id)]
+    );
+    assert.ok(terminal, "the terminal event remains stored");
+    const data = JSON.parse(String(terminal.data_json)) as Record<string, unknown>;
+    const receipt = data.terminal_run_commit_receipt as Record<string, unknown>;
+    const collectionFacts = data.collection_facts as Record<string, unknown>;
+    const facts = collectionFacts.streams as Record<string, unknown>[];
+    assert.equal(receipt.coverage_eligibility_reason, "connection_source_kind_not_local_device");
+    assert.equal(collectionFacts.coverage_eligibility_reason, "connection_source_kind_not_local_device");
+    assert.ok(facts.length > 0, "the terminal report retains its stream facts");
+    for (const fact of facts) {
+      assert.deepEqual(fact.coverage_statuses, ["collected"], "the stored run retains the device's assertion");
+      assert.deepEqual(
+        (fact.stores as Record<string, unknown>[]).map((store) => store.status),
+        ["collected"],
+        "the terminal record stores the device's collected assertions"
+      );
+    }
+    await assertRetired(lane, "a browser_collector terminal record projects no store-coverage positive");
+  }
+);
+
 laneTest("contract: owner diagnostics and connector detail validate against @pdpp/reference-contract", async (lane) => {
   await commitProof(lane, "run-a");
   await reconcileDirtyConnectorSummaryEvidence(null);
diff --git a/reference-implementation/test/local-device-terminal-run-commit-operation.test.ts b/reference-implementation/test/local-device-terminal-run-commit-operation.test.ts
index 4c93fd7bf..529e70fb8 100644
--- a/reference-implementation/test/local-device-terminal-run-commit-operation.test.ts
+++ b/reference-implementation/test/local-device-terminal-run-commit-operation.test.ts
@@ -120,7 +120,7 @@ async function invokeBoundCoverageCommit(input: {
     res: capture.response,
     resolveAuthorizedSource: () =>
       Promise.resolve({
-        connectorInstance: { connectorInstanceId: "cin-1" },
+        connectorInstance: { connectorInstanceId: "cin-1", sourceKind: "local_device" },
         sourceInstance: { connectorId: "codex", manifestGeneration: 7 },
       }),
   });
@@ -180,7 +180,7 @@ test("version 2 terminal coverage validates named stores against the manifest",
     res: capture.response,
     resolveAuthorizedSource: () =>
       Promise.resolve({
-        connectorInstance: { connectorInstanceId: "cin-1" },
+        connectorInstance: { connectorInstanceId: "cin-1", sourceKind: "local_device" },
         sourceInstance: { connectorId: "codex", manifestGeneration: 7 },
       }),
   });
@@ -294,7 +294,7 @@ test("terminal run commit resolves authorization before receipt lookup and passe
     resolveAuthorizedSource: () => {
       authorized = true;
       return Promise.resolve({
-        connectorInstance: { connectorInstanceId: "cin-1" },
+        connectorInstance: { connectorInstanceId: "cin-1", sourceKind: "local_device" },
         sourceInstance: { connectorId: "https://registry.pdpp.dev/connectors/codex" },
       });
     },
@@ -366,7 +366,7 @@ test("a device sending the legacy connector alias still commits: both sides are
     res: capture.response,
     resolveAuthorizedSource: () =>
       Promise.resolve({
-        connectorInstance: { connectorInstanceId: "cin-1" },
+        connectorInstance: { connectorInstanceId: "cin-1", sourceKind: "local_device" },
         sourceInstance: { connectorId: "claude-code" },
       }),
   });
@@ -428,7 +428,7 @@ test("the envelope hash is computed over the connector id the device SENT, not t
     res: capture.response,
     resolveAuthorizedSource: () =>
       Promise.resolve({
-        connectorInstance: { connectorInstanceId: "cin-1" },
+        connectorInstance: { connectorInstanceId: "cin-1", sourceKind: "local_device" },
         sourceInstance: { connectorId: "claude-code" },
       }),
   });
@@ -492,7 +492,7 @@ test("an identity-alias connector still hashes correctly — the alias fix does
     res: capture.response,
     resolveAuthorizedSource: () =>
       Promise.resolve({
-        connectorInstance: { connectorInstanceId: "cin-1" },
+        connectorInstance: { connectorInstanceId: "cin-1", sourceKind: "local_device" },
         sourceInstance: { connectorId: "codex" },
       }),
   });
@@ -538,7 +538,7 @@ test("an unrelated connector id is still rejected — canonicalizing both sides
     res: capture.response,
     resolveAuthorizedSource: () =>
       Promise.resolve({
-        connectorInstance: { connectorInstanceId: "cin-1" },
+        connectorInstance: { connectorInstanceId: "cin-1", sourceKind: "local_device" },
         sourceInstance: { connectorId: "claude-code" },
       }),
   });
@@ -603,7 +603,7 @@ test("divergent receipt conflict returns a typed non-disclosing 409", async () =
     res: capture.response,
     resolveAuthorizedSource: () =>
       Promise.resolve({
-        connectorInstance: { connectorInstanceId: "cin-1" },
+        connectorInstance: { connectorInstanceId: "cin-1", sourceKind: "local_device" },
         sourceInstance: { connectorId: "codex" },
       }),
   });
@@ -652,7 +652,7 @@ test("SQLite route operation composes authorization with 201, exact response-los
         resolveAuthorizedSource: () => {
           resolved = true;
           return Promise.resolve({
-            connectorInstance: { connectorInstanceId: "cin-1" },
+            connectorInstance: { connectorInstanceId: "cin-1", sourceKind: "local_device" },
             sourceInstance: { connectorId: "https://registry.pdpp.dev/connectors/codex" },
           });
         },
@@ -849,7 +849,7 @@ test("terminal commit records the server pin at admission and refuses an unbound
         res: capture.response,
         resolveAuthorizedSource: () =>
           Promise.resolve({
-            connectorInstance: { connectorInstanceId: "cin-1" },
+            connectorInstance: { connectorInstanceId: "cin-1", sourceKind: "local_device" },
             sourceInstance: { connectorId: "codex", manifestGeneration: 7 },
           }),
       });
@@ -937,7 +937,7 @@ test("terminal coverage requires the release registered for the authorized conne
     res: capture.response,
     resolveAuthorizedSource: () =>
       Promise.resolve({
-        connectorInstance: { connectorInstanceId: "cin-1" },
+        connectorInstance: { connectorInstanceId: "cin-1", sourceKind: "local_device" },
         sourceInstance: { connectorId: "codex", manifestGeneration: 7 },
       }),
   });
@@ -1018,7 +1018,7 @@ test("a run bound to its registered release remains valid after the connector ca
     res: capture.response,
     resolveAuthorizedSource: () =>
       Promise.resolve({
-        connectorInstance: { connectorInstanceId: "cin-1" },
+        connectorInstance: { connectorInstanceId: "cin-1", sourceKind: "local_device" },
         sourceInstance: { connectorId: "codex", manifestGeneration: 7 },
       }),
   });
@@ -1265,7 +1265,7 @@ test("a successful empty v2 terminal commit replaces every store with unknown ev
     res: capture.response,
     resolveAuthorizedSource: () =>
       Promise.resolve({
-        connectorInstance: { connectorInstanceId: "cin-1" },
+        connectorInstance: { connectorInstanceId: "cin-1", sourceKind: "local_device" },
         sourceInstance: { connectorId: "codex", manifestGeneration: 7 },
       }),
   });
@@ -1364,7 +1364,7 @@ for (const eligible of [false, true]) {
       res: capture.response,
       resolveAuthorizedSource: () =>
         Promise.resolve({
-          connectorInstance: { connectorInstanceId: "cin-1" },
+          connectorInstance: { connectorInstanceId: "cin-1", sourceKind: "local_device" },
           sourceInstance: { connectorId: "codex" },
         }),
     });
diff --git a/reference-implementation/test/ref-source-webhook-route.test.ts b/reference-implementation/test/ref-source-webhook-route.test.ts
index 6b8da4f19..ac834aa46 100644
--- a/reference-implementation/test/ref-source-webhook-route.test.ts
+++ b/reference-implementation/test/ref-source-webhook-route.test.ts
@@ -504,6 +504,44 @@ test("source webhook route accepts schedule_run as a webhook-classified run requ
   });
 });
 
+test("source webhook refuses a local-device connection at shared run admission", async () => {
+  await withHarness(async ({ connectorInstanceId, rsUrl, secret, sourceId }) => {
+    getDb()
+      .prepare("UPDATE connector_instances SET source_kind = 'local_device' WHERE connector_instance_id = ?")
+      .run(connectorInstanceId);
+
+    const refused = await postWebhook(
+      rsUrl,
+      sourceId,
+      secret,
+      "evt_local_device_webhook_refused",
+      '{"action":"schedule_run"}'
+    );
+    assert.equal(refused.status, 409, JSON.stringify(refused.body));
+    const error = objectField(refused.body, "error");
+    assert.equal(error.code, "local_device_control_unsupported");
+    assert.ok(String(error.message).includes("cannot be started by the reference server"));
+    assert.equal(
+      (
+        getDb()
+          .prepare("SELECT COUNT(*) AS count FROM source_webhook_run_receipts WHERE source_id = ? AND event_id = ?")
+          .get(sourceId, "evt_local_device_webhook_refused") as { count: number }
+      ).count,
+      0,
+      "refused webhook admission creates no run receipt"
+    );
+    assert.equal(
+      (
+        getDb()
+          .prepare("SELECT COUNT(*) AS count FROM controller_active_runs WHERE connector_instance_id = ?")
+          .get(connectorInstanceId) as { count: number }
+      ).count,
+      0,
+      "refused webhook admission creates no active run"
+    );
+  });
+});
+
 test("source webhook route keeps a blocked signed schedule event generic after policy becomes allowed", async () => {
   await withHarness(async ({ connectorInstanceId, rsUrl, secret, sourceId }) => {
     await assertBlockedScheduleStaysGenericDuplicate({
diff --git a/reference-implementation/test/scheduler.test.ts b/reference-implementation/test/scheduler.test.ts
index fae254c4d..7cd2f7a7d 100644
--- a/reference-implementation/test/scheduler.test.ts
+++ b/reference-implementation/test/scheduler.test.ts
@@ -427,6 +427,7 @@ async function registerSchedulerFixtureConnectorInstance(options: {
   displayName: string | undefined;
   ownerSubjectId: string;
   sourceBindingKey: string;
+  sourceKind?: string;
   timestamp?: string;
 }): Promise<void> {
   const timestamp = options.timestamp ?? "2026-04-29T00:00:00.000Z";
@@ -438,7 +439,7 @@ async function registerSchedulerFixtureConnectorInstance(options: {
     ownerSubjectId: options.ownerSubjectId,
     sourceBinding: { kind: "test_scheduler_fixture" },
     sourceBindingKey: options.sourceBindingKey,
-    sourceKind: "account",
+    sourceKind: options.sourceKind ?? "account",
     updatedAt: timestamp,
   });
 }
@@ -506,6 +507,85 @@ test("server-owned scheduler starts persisted enabled schedules after startup",
   }
 });
 
+test("server scheduler refuses a persisted local-device schedule during admission", async () => {
+  const spotifyManifest = readServerSchedulerFixtureManifest();
+  const tmpDir = mkdtempSync(join(tmpdir(), "pdpp-server-scheduler-placement-"));
+  const dbPath = join(tmpDir, "pdpp.sqlite");
+  const { attemptsPath, connectorPath } = writeLoggingConnector(tmpDir);
+  // biome-ignore lint/suspicious/noEvolvingTypes: test fixture inference is intentionally widened
+  let server = null;
+
+  try {
+    server = await startServer({
+      asPort: 0,
+      autoEnrollEligibleSchedules: false,
+      dbPath,
+      quiet: true,
+      rsPort: 0,
+    });
+    const registerResp = await fetchJson(`http://localhost:${server.asPort}/connectors`, {
+      body: JSON.stringify(spotifyManifest),
+      headers: { "Content-Type": "application/json" },
+      method: "POST",
+    });
+    assert.equal(registerResp.status, 201, JSON.stringify(registerResp.body));
+    const connectorId = canonicalConnectorKey(spotifyManifest.connector_id) ?? spotifyManifest.connector_id;
+    await registerSchedulerFixtureConnectorInstance({
+      connectorId,
+      connectorInstanceId: connectorId,
+      displayName: "Paired-device connection",
+      ownerSubjectId: "owner_local",
+      sourceBindingKey: "scheduler-local-device",
+      sourceKind: "local_device",
+    });
+    const scheduleStore = getDefaultSchedulerStore();
+    const scheduleCreatedAt = new Date(Date.now() - 120_000).toISOString();
+    await scheduleStore.createSchedule({
+      connector_id: connectorId,
+      connector_instance_id: connectorId,
+      created_at: scheduleCreatedAt,
+      enabled: true,
+      interval_seconds: 1,
+      jitter_seconds: 0,
+      updated_at: scheduleCreatedAt,
+    });
+    assert.equal(
+      (await scheduleStore.listSchedules()).filter((schedule) => schedule.connector_instance_id === connectorId).length,
+      1,
+      "the test starts from an enabled persisted local-device schedule"
+    );
+    await closeServer(server);
+    closeDb();
+    server = null;
+
+    server = await startServer({
+      asPort: 0,
+      autoEnrollEligibleSchedules: false,
+      connectionScopedRunEnvResolver: resolveCredentialFreeFixtureRunEnv,
+      connectorPathResolver: () => connectorPath,
+      dbPath,
+      quiet: true,
+      rsPort: 0,
+    });
+
+    const schedulerStore = getDefaultSchedulerStore();
+    assert.equal(readAttempts(attemptsPath).length, 0, "admission refuses before connector spawn");
+    assert.deepEqual(await schedulerStore.listRunHistory(20), [], "admission refuses before creating a run to retry");
+    assert.equal(
+      (await schedulerStore.listSchedules()).filter((schedule) => schedule.connector_instance_id === connectorId)
+        .length,
+      1,
+      "the persisted schedule remains available for diagnosis but is not dispatched"
+    );
+  } finally {
+    if (server) {
+      await closeServer(server);
+    }
+    closeDb();
+    rmSync(tmpDir, { force: true, recursive: true });
+  }
+});
+
 test("scheduler enforces automation policy before starting an unsafe automatic run", async () => {
   const tmpDir = mkdtempSync(join(tmpdir(), "pdpp-scheduler-automation-policy-"));
   const { attemptsPath, connectorPath } = writeLoggingConnector(tmpDir);

From 5e6efdc036ddeca0855e5e22d61f5c036fe3c536 Mon Sep 17 00:00:00 2001
From: Tim Nunamaker <tnunamak@gmail.com>
Date: Thu, 22 Oct 2026 23:18:12 -0500
Subject: [PATCH 73/87] test(scheduler): stop runs leaking across tests; wait
 for the placement refusal

"server-owned scheduler starts persisted enabled schedules after startup"
closed its server and database while its admitted run was still in flight.
The run's run.completed event then landed in the next test's fresh database,
so "server scheduler refuses a persisted local-device schedule during
admission" saw a stray succeeded row and failed in CI. Under taskset -c 0
the file failed about 1 run in 2. Both tests that stopped at the connector
attempt now wait for the run's terminal record before closing.

The placement test also asserted "no attempt, no history" immediately after
startup, before asynchronous scheduler hydration had looked at the schedule.
It now waits for the hydration refusal (local_device_control_unsupported in
the server log), then asserts. With the guard removed the test fails; with
it, the file passes 4 of 4 runs under taskset -c 0.

Signed-off-by: Tim Nunamaker <tnunamak@gmail.com>
Assisted-by: AI
---
 .../test/scheduler.test.ts                    | 31 +++++++++++++++++++
 1 file changed, 31 insertions(+)

diff --git a/reference-implementation/test/scheduler.test.ts b/reference-implementation/test/scheduler.test.ts
index 7cd2f7a7d..e466ad284 100644
--- a/reference-implementation/test/scheduler.test.ts
+++ b/reference-implementation/test/scheduler.test.ts
@@ -22,8 +22,10 @@ const TOP_LEVEL_REGEX_17 = /not scheduled \(gave_up/;
 import assert from "node:assert/strict";
 import { chmodSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import http from "node:http";
+import { createRequire } from "node:module";
 import { tmpdir } from "node:os";
 import { dirname, join } from "node:path";
+import { Writable } from "node:stream";
 import test from "node:test";
 import { fileURLToPath } from "node:url";
 import { readPolyfillManifests } from "@pdpp/polyfill-connectors/manifests";
@@ -46,6 +48,22 @@ import { resolveCredentialFreeFixtureRunEnv } from "./helpers/credential-free-ru
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const REFERENCE_IMPL_DIR = join(__dirname, "..");
 
+type CapturingLogger = NonNullable<NonNullable<Parameters<typeof startServer>[0]>["logger"]>;
+
+function capturingLogger(lines: string[]): CapturingLogger {
+  const loadedPino = createRequire(import.meta.url)("pino") as (
+    options: Record<string, unknown>,
+    destination: Writable
+  ) => CapturingLogger;
+  const destination = new Writable({
+    write(chunk, _encoding, callback) {
+      lines.push(Buffer.from(chunk).toString("utf8"));
+      callback();
+    },
+  });
+  return loadedPino({ level: "debug" }, destination);
+}
+
 function readServerSchedulerFixtureManifest(): Record<string, unknown> & {
   connector_id: string;
   connector_key: string;
@@ -498,6 +516,11 @@ test("server-owned scheduler starts persisted enabled schedules after startup",
     });
 
     await waitFor(() => readAttempts(attemptsPath).length === 1, 5000);
+    const schedulerStore = getDefaultSchedulerStore();
+    await waitForAsync(async () => {
+      const history = await schedulerStore.listRunHistory(20);
+      return history.some((run) => run.status === "succeeded" && run.connectorInstanceId === serverOwnedCanonicalKey);
+    }, 5000);
   } finally {
     if (server) {
       await closeServer(server);
@@ -558,16 +581,23 @@ test("server scheduler refuses a persisted local-device schedule during admissio
     closeDb();
     server = null;
 
+    const logLines: string[] = [];
     server = await startServer({
       asPort: 0,
       autoEnrollEligibleSchedules: false,
       connectionScopedRunEnvResolver: resolveCredentialFreeFixtureRunEnv,
       connectorPathResolver: () => connectorPath,
       dbPath,
+      logger: capturingLogger(logLines),
       quiet: true,
       rsPort: 0,
     });
 
+    // Scheduler hydration admits each persisted schedule before handing it to
+    // the executor, and runs asynchronously after listen. Wait for the
+    // hydration refusal itself, so the negative assertions below cannot pass
+    // merely because the scheduler has not looked at the schedule yet.
+    await waitFor(() => logLines.some((line) => line.includes("local_device_control_unsupported")), 5000);
     const schedulerStore = getDefaultSchedulerStore();
     assert.equal(readAttempts(attemptsPath).length, 0, "admission refuses before connector spawn");
     assert.deepEqual(await schedulerStore.listRunHistory(20), [], "admission refuses before creating a run to retry");
@@ -4301,6 +4331,7 @@ test("scheduler default readiness checker probes a manifest-declared executable_
 
     scheduler.start();
     await waitFor(() => readAttempts(attemptsPath).length === 1, 5000);
+    await waitFor(() => scheduler.getHistory().length > 0, 5000);
     scheduler.stop();
   } finally {
     if (previousSlackdumpBin === undefined) {

From 76b3d2a886bc83fbb48c552c5468961e1337a759 Mon Sep 17 00:00:00 2001
From: Tim Nunamaker <tnunamak@gmail.com>
Date: Thu, 22 Oct 2026 23:27:58 -0500
Subject: [PATCH 74/87] Decide device coverage by the connection's current
 source kind

Device terminal facts were rejected only when the stored event carried
coverage_eligibility_reason, which a6daef5 began writing. Terminals stored
before that, and terminals stored while the connection was local_device, carry
no marker, so a fold replay accepted them and a connection that is not
local_device now kept them as stream facts and as run collection facts.

Device terminal facts now count only while the connection is local_device:

- The stream-facts fold refuses an event whose actor_type is local_device when
  the participant's current source_kind is not local_device. The fold version
  moves to 8 so cached facts replay.
- An evidence repair that sees the source kind change clears the fold cache and
  replays it, so a cache built under local_device is not kept.
- The coverage run selector drops runs that a device terminal commit recorded
  (they carry a collection_revision), not only runs with the stored marker.

An exact replay of a terminal commit still returns its stored receipt. The
receipt grants no coverage; the projection decides it.

Assisted-by: AI
Signed-off-by: Tim Nunamaker <tnunamak@gmail.com>
---
 docs/261021-local-device-coverage-evidence.md |   2 +-
 .../connector-summary-evidence-engine.ts      |   9 +-
 .../server/connector-summary-read-model.ts    |  19 ++-
 .../server/ref-control.ts                     |  30 ++++-
 ...device-coverage-revision-atomicity.test.ts | 118 +++++++++++++++++-
 5 files changed, 169 insertions(+), 9 deletions(-)

diff --git a/docs/261021-local-device-coverage-evidence.md b/docs/261021-local-device-coverage-evidence.md
index a2baf03fe..65af9e030 100644
--- a/docs/261021-local-device-coverage-evidence.md
+++ b/docs/261021-local-device-coverage-evidence.md
@@ -88,7 +88,7 @@ The spec gate amended the ordering decision. Two orders exist, and each controls
 
 No wall clock takes part in either.
 
-Placement makes cross-runtime execution impossible for every connection that can hold a positive: shared admission refuses `local_device` runs (`reference-implementation/server/stores/connector-instance-store.ts:1238`), and startup enrollment filters them out (`reference-implementation/server/index.ts:9678`). Terminal collection checks the source kind with the same shared predicate (`reference-implementation/operations/local-device-terminal-collection.ts:456`, called by the v2 path at line 240) and stores an ineligibility reason; the run selector and stream-facts fold keep those claims out of coverage (`reference-implementation/server/ref-control.ts:2892`; `reference-implementation/server/connector-summary-read-model.ts:1632`). Device-enrolled `browser_collector` connections remain server-schedulable. Their records and terminal reports are stored, but the device's store claims stay unknown because a server-scheduled run of that same connection has no device run-order marker to retire a positive; cross-runtime retirement for `browser_collector` is a gap.
+Placement makes cross-runtime execution impossible for every connection that can hold a positive: shared admission refuses `local_device` runs (`reference-implementation/server/stores/connector-instance-store.ts:1238`), and startup enrollment filters them out (`reference-implementation/server/index.ts:9678`). Terminal collection checks the source kind with the same shared predicate (`reference-implementation/operations/local-device-terminal-collection.ts:456`, called by the v2 path at line 240) and stores an ineligibility reason. The stored reason is not the authority, because earlier terminals carry none and a connection can change source kind after it commits. Device terminal facts count only while the connection is `local_device` now: the run selector drops device terminal runs (`reference-implementation/server/ref-control.ts:2892`), the stream-facts fold refuses `local_device` events for any other current source kind (`reference-implementation/server/connector-summary-read-model.ts:1917`), and an evidence repair that sees the source kind change clears and replays the fold cache (`reference-implementation/server/connector-summary-evidence-engine.ts:3630`). An exact replay of a terminal commit still returns its stored receipt; the receipt grants no coverage. Device-enrolled `browser_collector` connections remain server-schedulable. Their records and terminal reports are stored, but the device's store claims stay unknown because a server-scheduled run of that same connection has no device run-order marker to retire a positive; cross-runtime retirement for `browser_collector` is a gap.
 
 Sequence issuance. The runtime already contacts the server before it scans: a "starting" heartbeat, the pre-scan drain, and the state read, which names the connection. None of these can carry the issuance. The heartbeat is a best-effort liveness signal that names no run, and the state read is a GET, which must stay free of side effects. The runtime therefore makes one new idempotent call at the same point, after the state read and before the scan: `POST .../source-instances/{source}/run-starts` with the run id. The server resolves the authenticated device, source and connection the same way as the terminal route. In one transaction that holds the connection row lock, it increments `connector_instances.run_sequence_issued` and stores `(connector_instance_id, run_id) -> (run_sequence, storage_epoch, device_id, source_instance_id)` in `collection_run_sequences`. An exact replay of the same run id from the same device and source returns the stored sequence (200). The same run id from another device or source is `409 run_start_conflict`. The runtime keeps the run id it registered and uses it for the run's terminal record. A server without the route (404), or a failed call, leaves the run without a sequence. The run still collects and commits its terminal record, but that record can never be an eligible positive proof.
 
diff --git a/reference-implementation/server/connector-summary-evidence-engine.ts b/reference-implementation/server/connector-summary-evidence-engine.ts
index 2f2a3fef5..f7599555c 100644
--- a/reference-implementation/server/connector-summary-evidence-engine.ts
+++ b/reference-implementation/server/connector-summary-evidence-engine.ts
@@ -3355,7 +3355,7 @@ const POSTGRES_PROJECTION_RELEVANT_EVIDENCE_CHANGED = projectionRelevantEvidence
 function upsertSqliteEvidenceRow(db: Db, row: Row): void {
   const existing = db
     .prepare(
-      "SELECT manifest_generation, manifest_fingerprint, stream_latest_facts_json, stream_facts_event_seq, terminal_facts_state, terminal_facts_reason_code FROM connector_summary_evidence WHERE connector_instance_id = ?"
+      "SELECT source_kind, manifest_generation, manifest_fingerprint, stream_latest_facts_json, stream_facts_event_seq, terminal_facts_state, terminal_facts_reason_code FROM connector_summary_evidence WHERE connector_instance_id = ?"
     )
     .get(row.connector_instance_id) as Row | undefined;
   const manifestGenerationChanged =
@@ -3457,7 +3457,7 @@ function upsertSqliteEvidenceRow(db: Db, row: Row): void {
 
 async function upsertPostgresEvidenceRow(client: Db, row: Row): Promise<void> {
   const existingResult = await client.query(
-    "SELECT manifest_generation, manifest_fingerprint, stream_latest_facts_json, stream_facts_event_seq, terminal_facts_state, terminal_facts_reason_code FROM connector_summary_evidence WHERE connector_instance_id = $1",
+    "SELECT source_kind, manifest_generation, manifest_fingerprint, stream_latest_facts_json, stream_facts_event_seq, terminal_facts_state, terminal_facts_reason_code FROM connector_summary_evidence WHERE connector_instance_id = $1",
     [row.connector_instance_id]
   );
   const existing = existingResult.rows[0] as Row | undefined;
@@ -3625,6 +3625,11 @@ function terminalFactsForRepair(existing: Row | undefined, row: Row, manifestGen
       state: "stale",
     };
   }
+  // Device terminal facts count only while the connection is local_device. Facts
+  // folded under another source kind cannot be kept: drop them and replay.
+  if (existing && existing.source_kind !== row.source_kind) {
+    return { eventSeq: null, latestFactsJson: null, reasonCode: null, state: "unobserved" };
+  }
   if (existing) {
     return {
       eventSeq: existing.stream_facts_event_seq,
diff --git a/reference-implementation/server/connector-summary-read-model.ts b/reference-implementation/server/connector-summary-read-model.ts
index 871b8ce21..3edc1f495 100644
--- a/reference-implementation/server/connector-summary-read-model.ts
+++ b/reference-implementation/server/connector-summary-read-model.ts
@@ -1259,9 +1259,9 @@ const TERMINAL_TYPES_SQL = TERMINAL_RUN_EVENT_TYPES.map((t) => `'${t}'`).join(",
 // tests previously hardcoded the then-current number and had to be edited on
 // every semantics bump, which makes a stale literal — not a real regression —
 // look like a failure.
-// Version 7 drops device coverage rejected for its source kind and replays
+// Version 8 drops device coverage rejected for its current source kind and replays
 // older fold rows so cached stream facts cannot retain that claim.
-export const STREAM_FACTS_FOLD_LOGIC_VERSION = 7;
+export const STREAM_FACTS_FOLD_LOGIC_VERSION = 8;
 // A route may retry a replay once after a concurrent writer wins its CAS.
 // This is deliberately small: each retry rereads the durable baseline, and
 // persistent contention fails closed in memory rather than spinning or
@@ -1401,7 +1401,7 @@ function createStreamFactsFoldStore() {
       }) {
         const { sql: scopeSql, params: scopeParams } = buildTerminalScopeFragmentPostgres(scope, 4);
         const result = await postgresQuery(
-          `SELECT event_seq, occurred_at, run_id, manifest_generation, data_json::text AS data_json
+          `SELECT event_seq, occurred_at, run_id, actor_type, manifest_generation, data_json::text AS data_json
              FROM spine_events
             WHERE event_type IN (${TERMINAL_TYPES_SQL})
               AND event_seq > $1 AND event_seq <= $2${scopeSql}
@@ -1509,7 +1509,7 @@ function createStreamFactsFoldStore() {
       const indexHint = terminalScopeIndexHintSqlite(scope);
       return getDb()
         .prepare(
-          `SELECT event_seq, occurred_at, run_id, manifest_generation, data_json
+          `SELECT event_seq, occurred_at, run_id, actor_type, manifest_generation, data_json
              FROM spine_events${indexHint}
             WHERE event_type IN (${TERMINAL_TYPES_SQL})
               AND event_seq > ? AND event_seq <= ?${scopeSql}
@@ -1892,6 +1892,7 @@ function foldTerminalEventFacts(
   factsByInstance: Map<string, Record<string, StoredStreamFactEntry>>,
   checkpointByInstance: Map<string, number | null>,
   generationByInstance: ReadonlyMap<string, number>,
+  sourceKindByInstance: ReadonlyMap<string, string>,
   generationCurrentByInstance: Map<string, boolean>,
   row: Row,
   counters: { folded: number; refused: number }
@@ -1913,6 +1914,10 @@ function foldTerminalEventFacts(
     counters.refused += 1;
     return;
   }
+  if (row.actor_type === "local_device" && sourceKindByInstance.get(instanceId) !== "local_device") {
+    counters.refused += 1;
+    return;
+  }
   const facts = factsByInstance.get(instanceId);
   if (!facts) {
     // Not a tracked evidence row (deleted or foreign connection).
@@ -2469,6 +2474,7 @@ async function drainTerminalEventBatches({
   factsByInstance,
   checkpointByInstance,
   generationByInstance,
+  sourceKindByInstance,
   generationCurrentByInstance,
   counters,
   ownMaxSeqByInstance,
@@ -2480,6 +2486,7 @@ async function drainTerminalEventBatches({
   factsByInstance: Map<string, Record<string, StoredStreamFactEntry>>;
   checkpointByInstance: Map<string, number | null>;
   generationByInstance: ReadonlyMap<string, number>;
+  sourceKindByInstance: ReadonlyMap<string, string>;
   generationCurrentByInstance: Map<string, boolean>;
   counters: { folded: number; refused: number };
   ownMaxSeqByInstance: ReadonlyMap<string, number>;
@@ -2534,6 +2541,7 @@ async function drainTerminalEventBatches({
           factsByInstance,
           checkpointByInstance,
           generationByInstance,
+          sourceKindByInstance,
           generationCurrentByInstance,
           row,
           counters
@@ -2778,10 +2786,12 @@ async function foldConnectorSummaryStreamFactsOnce(
   // scan.
   const ownMaxSeqByInstance = new Map<string, number>();
   const startCursorByInstance = new Map<string, number>();
+  const sourceKindByInstance = new Map<string, string>();
   for (const row of participants) {
     const instanceId = String(row.connector_instance_id);
     ownMaxSeqByInstance.set(instanceId, maxSeqByInstance.get(instanceId) ?? maxSeq);
     startCursorByInstance.set(instanceId, checkpointByInstance.get(instanceId) ?? 0);
+    sourceKindByInstance.set(instanceId, String(row.source_kind ?? ""));
   }
   const drain = await drainTerminalEventBatches({
     checkpointByInstance,
@@ -2790,6 +2800,7 @@ async function foldConnectorSummaryStreamFactsOnce(
     factsByInstance,
     foldStore,
     generationByInstance,
+    sourceKindByInstance,
     generationCurrentByInstance,
     maxEvents: typeof options.maxEvents === "number" ? options.maxEvents : null,
     ownMaxSeqByInstance,
diff --git a/reference-implementation/server/ref-control.ts b/reference-implementation/server/ref-control.ts
index b7e1f171a..d798b6057 100644
--- a/reference-implementation/server/ref-control.ts
+++ b/reference-implementation/server/ref-control.ts
@@ -2889,9 +2889,37 @@ function coverageClassifyingRun(
   lastSuccessfulRun: ConnectorRunSummary | null,
   latestSettledRun: ConnectorRunSummary | null = lastRun
 ): ConnectorRunSummary | null {
-  if (latestSettledRun?.local_terminal_coverage?.coverageEligibilityReason === NON_LOCAL_DEVICE_COVERAGE_REASON) {
+  if (isDeviceTerminalRun(latestSettledRun)) {
     return null;
   }
+  const selected = selectCoverageClassifyingRun(lastRun, lastSuccessfulRun, latestSettledRun);
+  return isDeviceTerminalRun(selected) ? null : selected;
+}
+
+/**
+ * A run recorded by a device terminal commit. The stored coverage-eligibility
+ * marker is not the authority: a device terminal written before the marker
+ * existed, or while the connection was local_device, carries none. Every
+ * device terminal commit stamps the connection's `collection_revision` (no
+ * server run does), so that stamp identifies it. Local-device connections
+ * quarantine these rows before this point; any other source kind has no
+ * device-coverage authority, so such a run is never its coverage evidence.
+ */
+function isDeviceTerminalRun(run: ConnectorRunSummary | null): boolean {
+  if (run === null) {
+    return false;
+  }
+  return (
+    typeof run.collection_revision === "number" ||
+    run.local_terminal_coverage?.coverageEligibilityReason === NON_LOCAL_DEVICE_COVERAGE_REASON
+  );
+}
+
+function selectCoverageClassifyingRun(
+  lastRun: ConnectorRunSummary | null,
+  lastSuccessfulRun: ConnectorRunSummary | null,
+  latestSettledRun: ConnectorRunSummary | null
+): ConnectorRunSummary | null {
   const settledIsIntervening =
     latestSettledRun !== null &&
     latestSettledRun !== lastSuccessfulRun &&
diff --git a/reference-implementation/test/local-device-coverage-revision-atomicity.test.ts b/reference-implementation/test/local-device-coverage-revision-atomicity.test.ts
index a0cfc336e..b60fc4d4d 100644
--- a/reference-implementation/test/local-device-coverage-revision-atomicity.test.ts
+++ b/reference-implementation/test/local-device-coverage-revision-atomicity.test.ts
@@ -27,7 +27,10 @@ import { validateResponse } from "@pdpp/reference-contract";
 import type { Controller } from "../runtime/controller.ts";
 
 import { COLLECTOR_PROTOCOL_VERSION } from "../server/collector-protocol.ts";
-import { reconcileDirtyConnectorSummaryEvidence } from "../server/connector-summary-read-model.ts";
+import {
+  reconcileDirtyConnectorSummaryEvidence,
+  STREAM_FACTS_FOLD_LOGIC_VERSION,
+} from "../server/connector-summary-read-model.ts";
 import { closeDb, getDb, initDb } from "../server/db.ts";
 import { fingerprintDeviceAttemptManifest } from "../server/device-ingest-attempt-context.ts";
 import { startServer } from "../server/index.ts";
@@ -1670,6 +1673,119 @@ laneTest(
   }
 );
 
+/** Move the connection to another source kind, as an owner or migration would, and queue its evidence for repair. */
+async function changeSourceKind(lane: Lane, sourceKind: string): Promise<void> {
+  const id = lane.enrolled.connector_instance_id;
+  await sql(
+    lane,
+    "UPDATE connector_instances SET source_kind = ? WHERE connector_instance_id = ?",
+    "UPDATE connector_instances SET source_kind = $1 WHERE connector_instance_id = $2",
+    [sourceKind, id]
+  );
+  await sql(
+    lane,
+    "UPDATE connector_summary_evidence SET dirty = 1 WHERE connector_instance_id = ?",
+    "UPDATE connector_summary_evidence SET dirty = 1 WHERE connector_instance_id = $1",
+    [id]
+  );
+}
+
+/** The folded stream-fact cache the evidence row holds, as stored. */
+async function foldedStreamFacts(lane: Lane): Promise<{ readonly streams: string[]; readonly version: number | null }> {
+  const [row] = await sql(
+    lane,
+    "SELECT stream_latest_facts_json AS facts, stream_facts_fold_version AS version FROM connector_summary_evidence WHERE connector_instance_id = ?",
+    "SELECT stream_latest_facts_json::text AS facts, stream_facts_fold_version AS version FROM connector_summary_evidence WHERE connector_instance_id = $1",
+    [lane.enrolled.connector_instance_id]
+  );
+  assert.ok(row, "the connection has an evidence row");
+  const facts = row.facts === null ? {} : (JSON.parse(String(row.facts)) as Record<string, unknown>);
+  return { streams: Object.keys(facts).sort(), version: row.version === null ? null : Number(row.version) };
+}
+
+/** Pretend an earlier fold version built the cache, and mirror the source kind so no evidence repair fires. */
+async function ageFoldCache(lane: Lane, sourceKind: string): Promise<void> {
+  await sql(
+    lane,
+    "UPDATE connector_summary_evidence SET source_kind = ?, stream_facts_fold_version = ?, dirty = 0 WHERE connector_instance_id = ?",
+    "UPDATE connector_summary_evidence SET source_kind = $1, stream_facts_fold_version = $2, dirty = 0 WHERE connector_instance_id = $3",
+    [sourceKind, STREAM_FACTS_FOLD_LOGIC_VERSION - 1, lane.enrolled.connector_instance_id]
+  );
+}
+
+/** The per-stream coverage conditions the owner's collection report shows for the connection. */
+async function reportedConditions(lane: Lane): Promise<Record<string, unknown>> {
+  await reconcileDirtyConnectorSummaryEvidence(null);
+  const summary = (await listConnectorSummaries()).find(
+    (row) => row.connector_instance_id === lane.enrolled.connector_instance_id
+  );
+  assert.ok(summary, "the lane's connection is projected");
+  return Object.fromEntries(summary.collection_report.map((entry) => [entry.stream, entry.coverage_condition]));
+}
+
+const UNKNOWN_CONDITIONS = { messages: "unknown", sessions: "unknown" };
+
+async function assertNoDeviceCoverage(lane: Lane, message: string): Promise<void> {
+  assert.deepEqual(await reportedConditions(lane), UNKNOWN_CONDITIONS, `${message}: no stream is credited`);
+  await assertRetired(lane, message);
+  assert.deepEqual((await foldedStreamFacts(lane)).streams, [], `${message}: the fold cache credits no stream`);
+}
+
+laneTest(
+  "source kind: an unmarked device terminal credits nothing to a browser_collector connection, whatever the cache holds",
+  async (lane) => {
+    await commitProof(lane, "run-unmarked");
+    await assertCovered(lane, "run-unmarked", "the device terminal covers its local_device connection");
+    assert.deepEqual((await foldedStreamFacts(lane)).streams, ["messages", "sessions"], "the fold cached its facts");
+    // The terminal carries no coverage_eligibility_reason: it predates the marker. The cache was folded by an
+    // earlier fold version that accepted it.
+    await changeSourceKind(lane, "browser_collector");
+    await ageFoldCache(lane, "browser_collector");
+    await assertNoDeviceCoverage(lane, "an unmarked device terminal on a browser_collector connection");
+    const { version } = await foldedStreamFacts(lane);
+    assert.equal(version, STREAM_FACTS_FOLD_LOGIC_VERSION, "the fold replayed the cache");
+  }
+);
+
+laneTest(
+  "source kind: a connection that stops being local_device projects its earlier device terminal as unknown",
+  async (lane) => {
+    await commitProof(lane, "run-was-local");
+    await assertCovered(lane, "run-was-local", "the device terminal covers its local_device connection");
+    await changeSourceKind(lane, "browser_collector");
+    await assertNoDeviceCoverage(lane, "a device terminal stored while the connection was local_device");
+  }
+);
+
+laneTest("source kind: an exact replay returns the stored receipt and grants no coverage", async (lane) => {
+  assert.equal((await postRunStart(lane, "run-replayed")).status, 201);
+  await markDrained(lane);
+  const body = await terminalWireBody(lane, "run-replayed");
+  const committed = await postTerminal(lane, body);
+  assert.equal(committed.status, 201, JSON.stringify(committed.body));
+  await assertCovered(lane, "run-replayed", "the device terminal covers its local_device connection");
+
+  await changeSourceKind(lane, "browser_collector");
+  const replay = await postTerminal(lane, body);
+  assert.equal(replay.status, 200, JSON.stringify(replay.body));
+  assert.deepEqual(replay.body, committed.body, "the replay returns the stored receipt unchanged");
+  assert.equal((await runRows(lane, "run-replayed")).events, 1, "the replay writes no second terminal event");
+  await assertNoDeviceCoverage(lane, "a replayed receipt is not a coverage grant");
+});
+
+laneTest(
+  "source kind: a local_device connection keeps its device coverage when its fold cache is replayed",
+  async (lane) => {
+    await commitProof(lane, "run-local");
+    await ageFoldCache(lane, "local_device");
+    await assertCovered(lane, "run-local", "the replayed fold keeps the local_device positive");
+    assert.deepEqual(await foldedStreamFacts(lane), {
+      streams: ["messages", "sessions"],
+      version: STREAM_FACTS_FOLD_LOGIC_VERSION,
+    });
+  }
+);
+
 laneTest("contract: owner diagnostics and connector detail validate against @pdpp/reference-contract", async (lane) => {
   await commitProof(lane, "run-a");
   await reconcileDirtyConnectorSummaryEvidence(null);

From 7d99020ed53d181f507002e884f89ce3283c8bd1 Mon Sep 17 00:00:00 2001
From: Tim Nunamaker <tnunamak@gmail.com>
Date: Fri, 23 Oct 2026 00:30:26 -0500
Subject: [PATCH 75/87] Treat stale fold caches as unobserved and fence folds
 by source kind

A deploy that bumps the stream-facts fold version leaves every cached fact
map behind until the maintenance sweep replays it. Reads served the old map
as current, so an unmarked device fact cached for a browser_collector
connection still credited coverage in that window. A fold also published
under the source kind it started with: a concurrent repair that changed the
kind, and reset an already-empty checkpoint without moving the version,
could not stop the old-kind fold from writing device facts as current.

- A cache whose fold version is older than the current one reads as
  unobserved with no stream facts, as a newer-version cache already reads as
  stale. The durable row is untouched; the fold replays it.
- The fold's publish compare-and-set also checks the evidence row's source
  kind, captured at seed time, on SQLite and PostgreSQL.
- The upgrade tests seed the literal predecessor version 7 and assert the
  literal version 8, so reverting the bump fails them. New tests cover a
  behind-version read before any repair and a fold that loses to a source
  kind change.
- Tests that read the raw stored cache of a version-behind row through the
  masked read now read the column.

The run-history selector still cannot recognize a device terminal stored
before collection revisions: run_history carries no actor_type.

Assisted-by: AI
Signed-off-by: Tim Nunamaker <tnunamak@gmail.com>
---
 docs/261021-local-device-coverage-evidence.md |   2 +-
 .../server/connector-summary-read-model.ts    |  62 +++++++++--
 ...y-persisted-count-state-read-proof.test.ts |   8 +-
 ...ry-stream-facts-monotonic-postgres.test.ts |  11 +-
 .../connector-summary-stream-facts.test.ts    |  12 ++-
 ...device-coverage-revision-atomicity.test.ts | 102 ++++++++++++++++--
 ...ile-active-summary-evidence-oracle.test.ts |  10 +-
 7 files changed, 185 insertions(+), 22 deletions(-)

diff --git a/docs/261021-local-device-coverage-evidence.md b/docs/261021-local-device-coverage-evidence.md
index 65af9e030..8a41b6cb6 100644
--- a/docs/261021-local-device-coverage-evidence.md
+++ b/docs/261021-local-device-coverage-evidence.md
@@ -88,7 +88,7 @@ The spec gate amended the ordering decision. Two orders exist, and each controls
 
 No wall clock takes part in either.
 
-Placement makes cross-runtime execution impossible for every connection that can hold a positive: shared admission refuses `local_device` runs (`reference-implementation/server/stores/connector-instance-store.ts:1238`), and startup enrollment filters them out (`reference-implementation/server/index.ts:9678`). Terminal collection checks the source kind with the same shared predicate (`reference-implementation/operations/local-device-terminal-collection.ts:456`, called by the v2 path at line 240) and stores an ineligibility reason. The stored reason is not the authority, because earlier terminals carry none and a connection can change source kind after it commits. Device terminal facts count only while the connection is `local_device` now: the run selector drops device terminal runs (`reference-implementation/server/ref-control.ts:2892`), the stream-facts fold refuses `local_device` events for any other current source kind (`reference-implementation/server/connector-summary-read-model.ts:1917`), and an evidence repair that sees the source kind change clears and replays the fold cache (`reference-implementation/server/connector-summary-evidence-engine.ts:3630`). An exact replay of a terminal commit still returns its stored receipt; the receipt grants no coverage. Device-enrolled `browser_collector` connections remain server-schedulable. Their records and terminal reports are stored, but the device's store claims stay unknown because a server-scheduled run of that same connection has no device run-order marker to retire a positive; cross-runtime retirement for `browser_collector` is a gap.
+Placement makes cross-runtime execution impossible for every connection that can hold a positive: shared admission refuses `local_device` runs (`reference-implementation/server/stores/connector-instance-store.ts:1238`), and startup enrollment filters them out (`reference-implementation/server/index.ts:9678`). Terminal collection checks the source kind with the same shared predicate (`reference-implementation/operations/local-device-terminal-collection.ts:456`, called by the v2 path at line 240) and stores an ineligibility reason. The stored reason is not the authority, because earlier terminals carry none and a connection can change source kind after it commits. Device terminal facts count only while the connection is `local_device` now: the run selector drops device terminal runs that carry a collection revision or the stored marker (`reference-implementation/server/ref-control.ts:2892`; a device terminal stored before collection revisions carries neither, and `run_history` does not record the event's `actor_type`, so the selector cannot yet recognize it: open), the stream-facts fold refuses `local_device` events for any other current source kind (`reference-implementation/server/connector-summary-read-model.ts:1952`), and an evidence repair that sees the source kind change clears and replays the fold cache (`reference-implementation/server/connector-summary-evidence-engine.ts:3630`). A fold writes only while the evidence row still has the source kind it started under (`reference-implementation/server/connector-summary-read-model.ts:1466`, `:1578`), so a fold begun before the change cannot publish after it. A cache folded under an older fold version is read as unobserved until a replay rebuilds it (`reference-implementation/server/connector-summary-read-model.ts:779`, `:889`); the first replay after a deploy is the maintenance sweep, so every connection reads unknown until it runs. An exact replay of a terminal commit still returns its stored receipt; the receipt grants no coverage. Device-enrolled `browser_collector` connections remain server-schedulable. Their records and terminal reports are stored, but the device's store claims stay unknown because a server-scheduled run of that same connection has no device run-order marker to retire a positive; cross-runtime retirement for `browser_collector` is a gap.
 
 Sequence issuance. The runtime already contacts the server before it scans: a "starting" heartbeat, the pre-scan drain, and the state read, which names the connection. None of these can carry the issuance. The heartbeat is a best-effort liveness signal that names no run, and the state read is a GET, which must stay free of side effects. The runtime therefore makes one new idempotent call at the same point, after the state read and before the scan: `POST .../source-instances/{source}/run-starts` with the run id. The server resolves the authenticated device, source and connection the same way as the terminal route. In one transaction that holds the connection row lock, it increments `connector_instances.run_sequence_issued` and stores `(connector_instance_id, run_id) -> (run_sequence, storage_epoch, device_id, source_instance_id)` in `collection_run_sequences`. An exact replay of the same run id from the same device and source returns the stored sequence (200). The same run id from another device or source is `409 run_start_conflict`. The runtime keeps the run id it registered and uses it for the run's terminal record. A server without the route (404), or a failed call, leaves the run without a sequence. The run still collects and commits its terminal record, but that record can never be an eligible positive proof.
 
diff --git a/reference-implementation/server/connector-summary-read-model.ts b/reference-implementation/server/connector-summary-read-model.ts
index 3edc1f495..0b19bcf98 100644
--- a/reference-implementation/server/connector-summary-read-model.ts
+++ b/reference-implementation/server/connector-summary-read-model.ts
@@ -126,6 +126,12 @@ const REASON_CODES = {
    * replay, or overwrite it; this reason fails the row closed instead.
    */
   FOLD_LOGIC_VERSION_INCOMPATIBLE_FUTURE: "fold_logic_version_incompatible_future",
+  /**
+   * A row's stored `stream_facts_fold_version` is BEHIND this binary's: its
+   * cached facts were folded under older semantics and no replay has run yet.
+   * Reads present it as unobserved, never as current evidence.
+   */
+  FOLD_LOGIC_VERSION_BEHIND: "fold_logic_version_behind",
   // A source-attributed terminal event without a matching durable generation
   // is historical, never an empty/current fold result.
   TERMINAL_FACTS_HISTORICAL: "terminal_facts_historical",
@@ -767,6 +773,17 @@ function shapeTerminalFacts(row: Row) {
       state: "stale",
     };
   }
+  // The mirror of the future case: facts a replay has not yet rebuilt under
+  // this version's semantics are not evidence. The durable row is untouched;
+  // the fold replays it.
+  if (rowIsFoldLogicVersionBehind(row) && row.terminal_facts_state === "current") {
+    return {
+      as_of: row.computed_at || null,
+      event_seq: eventSeq,
+      reason_code: REASON_CODES.FOLD_LOGIC_VERSION_BEHIND,
+      state: "unobserved",
+    };
+  }
   return {
     as_of: row.computed_at || null,
     event_seq: eventSeq,
@@ -868,7 +885,10 @@ export function shapeEvidenceRow(row: Row) {
     status: row.status,
     stream_count: Number(row.stream_count || 0),
     stream_facts_event_seq: row.stream_facts_event_seq === null ? null : Number(row.stream_facts_event_seq),
-    stream_latest_facts: parseEvidenceJson(row.stream_latest_facts_json, null),
+    // A cache folded under an older version credits no stream until replayed.
+    stream_latest_facts: rowIsFoldLogicVersionBehind(row)
+      ? null
+      : parseEvidenceJson(row.stream_latest_facts_json, null),
     stream_records: parseEvidenceJson(row.stream_records_json, []),
     terminal_facts: shapeTerminalFacts(row),
     total_records: Number(row.total_records || 0),
@@ -1417,6 +1437,7 @@ function createStreamFactsFoldStore() {
         eventSeq,
         baselineEventSeq,
         baselineFoldVersion,
+        baselineSourceKind,
         foldVersion,
         terminalFactsState,
         terminalFactsReasonCode,
@@ -1426,6 +1447,7 @@ function createStreamFactsFoldStore() {
         eventSeq: number;
         baselineEventSeq: number | null;
         baselineFoldVersion: number | null;
+        baselineSourceKind: string | null;
         foldVersion: number | null;
         terminalFactsState: "current" | "stale";
         terminalFactsReasonCode: string | null;
@@ -1440,7 +1462,8 @@ function createStreamFactsFoldStore() {
                   canonical_evidence_revision = canonical_evidence_revision + 1
             WHERE connector_instance_id = $1
               AND stream_facts_event_seq IS NOT DISTINCT FROM $4
-              AND stream_facts_fold_version IS NOT DISTINCT FROM $8`,
+              AND stream_facts_fold_version IS NOT DISTINCT FROM $8
+              AND source_kind IS NOT DISTINCT FROM $9`,
           [
             connectorInstanceId,
             factsJson,
@@ -1450,6 +1473,7 @@ function createStreamFactsFoldStore() {
             terminalFactsState,
             terminalFactsReasonCode,
             baselineFoldVersion,
+            baselineSourceKind,
           ]
         );
         return (result.rowCount ?? 0) > 0;
@@ -1524,6 +1548,7 @@ function createStreamFactsFoldStore() {
       eventSeq,
       baselineEventSeq,
       baselineFoldVersion,
+      baselineSourceKind,
       foldVersion,
       terminalFactsState,
       terminalFactsReasonCode,
@@ -1533,6 +1558,7 @@ function createStreamFactsFoldStore() {
       eventSeq: number;
       baselineEventSeq: number | null;
       baselineFoldVersion: number | null;
+      baselineSourceKind: string | null;
       foldVersion: number | null;
       terminalFactsState: "current" | "stale";
       terminalFactsReasonCode: string | null;
@@ -1548,7 +1574,8 @@ function createStreamFactsFoldStore() {
                   canonical_evidence_revision = canonical_evidence_revision + 1
             WHERE connector_instance_id = ?
               AND stream_facts_event_seq IS ?
-              AND stream_facts_fold_version IS ?`
+              AND stream_facts_fold_version IS ?
+              AND source_kind IS ?`
         )
         .run(
           factsJson,
@@ -1558,7 +1585,8 @@ function createStreamFactsFoldStore() {
           terminalFactsReasonCode,
           connectorInstanceId,
           baselineEventSeq,
-          baselineFoldVersion
+          baselineFoldVersion,
+          baselineSourceKind
         );
       return result.changes > 0;
     },
@@ -1576,19 +1604,26 @@ function createStreamFactsFoldStore() {
  * stream_facts_fold_version IS <baseline>` predicate in test code. Never
  * used outside tests.
  */
-export function __testOnlyUpdateStreamFactsCasWrite(args: {
+export async function __testOnlyUpdateStreamFactsCasWrite(args: {
   connectorInstanceId: string;
   factsJson: string | null;
   eventSeq: number;
   baselineEventSeq: number | null;
   baselineFoldVersion?: number | null;
+  /** Omitted: the row's current source kind, so the write is fenced by nothing but its other anchors. */
+  baselineSourceKind?: string | null;
   foldVersion?: number | null;
   terminalFactsState?: "current" | "stale";
   terminalFactsReasonCode?: string | null;
-}): Promise<boolean> | boolean {
+}): Promise<boolean> {
+  const baselineSourceKind =
+    args.baselineSourceKind === undefined
+      ? (((await getConnectorSummaryEvidence(args.connectorInstanceId))?.source_kind as string | undefined) ?? null)
+      : args.baselineSourceKind;
   return createStreamFactsFoldStore().updateStreamFacts({
     ...args,
     baselineFoldVersion: args.baselineFoldVersion ?? null,
+    baselineSourceKind,
     foldVersion: args.foldVersion ?? STREAM_FACTS_FOLD_LOGIC_VERSION,
     terminalFactsReasonCode: args.terminalFactsReasonCode ?? null,
     terminalFactsState: args.terminalFactsState ?? "current",
@@ -2049,10 +2084,20 @@ function checkpointIsResumablePosition(checkpoint: unknown): boolean {
   return checkpoint !== null && checkpoint !== undefined && Number(checkpoint) > 0;
 }
 
+function evidenceRowSourceKind(row: Row): string | null {
+  return row.source_kind === null || row.source_kind === undefined ? null : String(row.source_kind);
+}
+
 /** A participant row's write-time CAS anchor, captured at seed time. */
 interface FoldCasBaseline {
   readonly eventSeq: number | null;
   readonly foldVersion: number | null;
+  /**
+   * The source kind the participant was folded under. Device terminal facts
+   * count only for a local_device connection, so a write built under another
+   * kind must lose to the repair that changed it.
+   */
+  readonly sourceKind: string | null;
 }
 
 /**
@@ -2125,6 +2170,7 @@ function seedFoldState(
     casBaselineByInstance.set(instanceId, {
       eventSeq: row.stream_facts_event_seq === null ? null : Number(row.stream_facts_event_seq),
       foldVersion: row.stream_facts_fold_version === null ? null : Number(row.stream_facts_fold_version),
+      sourceKind: evidenceRowSourceKind(row),
     });
     // The pass's default verdict for an instance no qualifying event touches
     // THIS round (e.g. a generation-transition boundary whose checkpoint
@@ -2407,6 +2453,7 @@ async function stampZeroCheckpointForBootstrap(
     const accepted = await foldStore.updateStreamFacts({
       baselineEventSeq: row.stream_facts_event_seq === null ? null : Number(row.stream_facts_event_seq),
       baselineFoldVersion: row.stream_facts_fold_version === null ? null : Number(row.stream_facts_fold_version),
+      baselineSourceKind: evidenceRowSourceKind(row),
       connectorInstanceId,
       eventSeq: 0,
       factsJson: null,
@@ -2991,10 +3038,11 @@ async function writeParticipantStreamFacts(
 ): Promise<boolean> {
   const effectiveCheckpoint = checkpointByInstance.get(instanceId) ?? null;
   const participantEventSeq = effectiveCheckpoint === null ? writeSeq : Math.max(writeSeq, effectiveCheckpoint);
-  const casBaseline = casBaselineByInstance.get(instanceId) ?? { eventSeq: null, foldVersion: null };
+  const casBaseline = casBaselineByInstance.get(instanceId) ?? { eventSeq: null, foldVersion: null, sourceKind: null };
   return foldStore.updateStreamFacts({
     baselineEventSeq: casBaseline.eventSeq,
     baselineFoldVersion: casBaseline.foldVersion,
+    baselineSourceKind: casBaseline.sourceKind,
     connectorInstanceId: instanceId,
     eventSeq: participantEventSeq,
     factsJson: Object.keys(facts).length > 0 ? JSON.stringify(facts) : null,
diff --git a/reference-implementation/test/connector-summary-persisted-count-state-read-proof.test.ts b/reference-implementation/test/connector-summary-persisted-count-state-read-proof.test.ts
index 878680c8d..b383834f7 100644
--- a/reference-implementation/test/connector-summary-persisted-count-state-read-proof.test.ts
+++ b/reference-implementation/test/connector-summary-persisted-count-state-read-proof.test.ts
@@ -33,6 +33,7 @@ import { mkdtempSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import test from "node:test";
+import { STREAM_FACTS_FOLD_LOGIC_VERSION } from "../server/connector-summary-read-model.ts";
 import { closeDb, getDb, initDb } from "../server/db.ts";
 import { listConnectorSummaries } from "../server/ref-control.ts";
 
@@ -111,9 +112,9 @@ function seedPersistedEvidenceRow({
          connector_instance_id, connector_id, display_name, status, source_kind,
          total_records, stream_count, stream_records_json, dirty, computed_at, state,
          record_snapshot_state, terminal_facts_state, manifest_declaration_state,
-         retained_bytes_state, stream_latest_facts_json
+         retained_bytes_state, stream_latest_facts_json, stream_facts_fold_version
        ) VALUES (?, ?, ?, 'active', 'account', 0, 0, ?, 0, ?, 'fresh',
-                 'current', 'current', 'current', 'current', ?)`
+                 'current', 'current', 'current', 'current', ?, ?)`
     )
     .run(
       connectorInstanceId,
@@ -129,7 +130,8 @@ function seedPersistedEvidenceRow({
         },
       ]),
       NOW,
-      streamLatestFacts === null ? null : JSON.stringify(streamLatestFacts)
+      streamLatestFacts === null ? null : JSON.stringify(streamLatestFacts),
+      STREAM_FACTS_FOLD_LOGIC_VERSION
     );
 }
 
diff --git a/reference-implementation/test/connector-summary-stream-facts-monotonic-postgres.test.ts b/reference-implementation/test/connector-summary-stream-facts-monotonic-postgres.test.ts
index 918b88662..8dbc602ce 100644
--- a/reference-implementation/test/connector-summary-stream-facts-monotonic-postgres.test.ts
+++ b/reference-implementation/test/connector-summary-stream-facts-monotonic-postgres.test.ts
@@ -148,6 +148,15 @@ async function factsFor(instanceId = INSTANCE_ID): Promise<StreamFactsByStream |
   return (evidence?.stream_latest_facts as StreamFactsByStream | null | undefined) ?? null;
 }
 
+/** The fact map exactly as stored, before any read masks it: a version-behind row reads as no facts. */
+async function storedFactsFor(instanceId = INSTANCE_ID): Promise<StreamFactsByStream | null> {
+  const { rows } = await postgresQuery<{ facts: StreamFactsByStream | null }>(
+    "SELECT stream_latest_facts_json AS facts FROM connector_summary_evidence WHERE connector_instance_id = $1",
+    [instanceId]
+  );
+  return rows[0]?.facts ?? null;
+}
+
 test("real PostgreSQL: a later cancelled/not_committed attempt does not regress an already-durably-proven stream", {
   skip: !POSTGRES_URL,
 }, async () => {
@@ -391,7 +400,7 @@ test("real PostgreSQL: existing-row self-heal — a row pre-seeded in the exact
     assert.equal(preFixRow.stream_facts_fold_version, null, "premise: row predates fold-version stamping");
     assert.equal(Number(preFixRow.dirty), 0, "premise: row reads clean, exactly like the live corrupted row");
     assert.equal(preFixRow.state, "fresh");
-    const preFixFacts = await factsFor();
+    const preFixFacts = await storedFactsFor();
     assert.ok(preFixFacts, "evidence row must exist before healing");
     assert.ok(preFixFacts.messages, "messages stream fact must exist");
     assert.equal(
diff --git a/reference-implementation/test/connector-summary-stream-facts.test.ts b/reference-implementation/test/connector-summary-stream-facts.test.ts
index e06700e62..a077b86cb 100644
--- a/reference-implementation/test/connector-summary-stream-facts.test.ts
+++ b/reference-implementation/test/connector-summary-stream-facts.test.ts
@@ -153,6 +153,14 @@ function factsFor(evidence: ConnectorSummaryEvidence): StreamFactsByStream | nul
   return (evidence?.stream_latest_facts as StreamFactsByStream | null | undefined) ?? null;
 }
 
+/** The fact map exactly as stored, before any read masks it: a version-behind row reads as no facts. */
+function storedFactsFor(connectorInstanceId: string): StreamFactsByStream | null {
+  const row = getDb()
+    .prepare("SELECT stream_latest_facts_json FROM connector_summary_evidence WHERE connector_instance_id = ?")
+    .get<{ stream_latest_facts_json: string | null }>(connectorInstanceId);
+  return row?.stream_latest_facts_json ? (JSON.parse(row.stream_latest_facts_json) as StreamFactsByStream) : null;
+}
+
 /**
  * Narrows a possibly-missing per-stream fact entry off a `factsFor(...)`
  * result to a definite `StoredStreamFactEntry`, asserting (never silently
@@ -832,7 +840,7 @@ test("existing-row self-heal: a row pre-seeded in the EXACT pre-fix corrupted sh
       "premise: row reads clean, exactly like the live corrupted row (not merely stale)"
     );
     assert.equal(preFixRow.state, "fresh");
-    const preFixFacts = factsFor(await getConnectorSummaryEvidence("cin_gmail_shaped"));
+    const preFixFacts = storedFactsFor("cin_gmail_shaped");
     const preFixMessages = requireStreamFact(preFixFacts, "messages");
     assert.equal(
       preFixMessages.fact.checkpoint,
@@ -1496,7 +1504,7 @@ test("existing-row self-heal: a row already folded under v5 with its proof ERASE
       )
       .run(JSON.stringify(erasedFacts), erasingSeq, "cin_ac_stale");
 
-    const preFix = requireStreamFact(factsFor(await getConnectorSummaryEvidence("cin_ac_stale")), "contacts");
+    const preFix = requireStreamFact(storedFactsFor("cin_ac_stale"), "contacts");
     assert.equal(preFix.fact.considered, undefined, "precondition: the stored row really is in the erased shape");
 
     // An ordinary reconcile — no connector-specific mutation, no manual repair.
diff --git a/reference-implementation/test/local-device-coverage-revision-atomicity.test.ts b/reference-implementation/test/local-device-coverage-revision-atomicity.test.ts
index b60fc4d4d..1b248e2b9 100644
--- a/reference-implementation/test/local-device-coverage-revision-atomicity.test.ts
+++ b/reference-implementation/test/local-device-coverage-revision-atomicity.test.ts
@@ -28,8 +28,9 @@ import type { Controller } from "../runtime/controller.ts";
 
 import { COLLECTOR_PROTOCOL_VERSION } from "../server/collector-protocol.ts";
 import {
+  __testOnlySetFoldPauseHook,
+  foldConnectorSummaryStreamFacts,
   reconcileDirtyConnectorSummaryEvidence,
-  STREAM_FACTS_FOLD_LOGIC_VERSION,
 } from "../server/connector-summary-read-model.ts";
 import { closeDb, getDb, initDb } from "../server/db.ts";
 import { fingerprintDeviceAttemptManifest } from "../server/device-ingest-attempt-context.ts";
@@ -1703,19 +1704,28 @@ async function foldedStreamFacts(lane: Lane): Promise<{ readonly streams: string
   return { streams: Object.keys(facts).sort(), version: row.version === null ? null : Number(row.version) };
 }
 
-/** Pretend an earlier fold version built the cache, and mirror the source kind so no evidence repair fires. */
+/**
+ * Literal on purpose: the fold version this change introduces, and the one before it. Deriving either from the
+ * current constant would let a revert of the bump pass.
+ */
+const PREDECESSOR_FOLD_VERSION = 7;
+const UPGRADED_FOLD_VERSION = 8;
+
+/** Pretend the predecessor fold version built the cache, and mirror the source kind so no evidence repair fires. */
 async function ageFoldCache(lane: Lane, sourceKind: string): Promise<void> {
   await sql(
     lane,
     "UPDATE connector_summary_evidence SET source_kind = ?, stream_facts_fold_version = ?, dirty = 0 WHERE connector_instance_id = ?",
     "UPDATE connector_summary_evidence SET source_kind = $1, stream_facts_fold_version = $2, dirty = 0 WHERE connector_instance_id = $3",
-    [sourceKind, STREAM_FACTS_FOLD_LOGIC_VERSION - 1, lane.enrolled.connector_instance_id]
+    [sourceKind, PREDECESSOR_FOLD_VERSION, lane.enrolled.connector_instance_id]
   );
 }
 
 /** The per-stream coverage conditions the owner's collection report shows for the connection. */
-async function reportedConditions(lane: Lane): Promise<Record<string, unknown>> {
-  await reconcileDirtyConnectorSummaryEvidence(null);
+async function reportedConditions(lane: Lane, repairFirst = true): Promise<Record<string, unknown>> {
+  if (repairFirst) {
+    await reconcileDirtyConnectorSummaryEvidence(null);
+  }
   const summary = (await listConnectorSummaries()).find(
     (row) => row.connector_instance_id === lane.enrolled.connector_instance_id
   );
@@ -1743,7 +1753,34 @@ laneTest(
     await ageFoldCache(lane, "browser_collector");
     await assertNoDeviceCoverage(lane, "an unmarked device terminal on a browser_collector connection");
     const { version } = await foldedStreamFacts(lane);
-    assert.equal(version, STREAM_FACTS_FOLD_LOGIC_VERSION, "the fold replayed the cache");
+    assert.equal(version, UPGRADED_FOLD_VERSION, "the fold replayed the cache");
+  }
+);
+
+laneTest(
+  "source kind: a behind-version cache holding an unmarked device fact reads unknown before any repair runs",
+  async (lane) => {
+    await commitProof(lane, "run-behind");
+    await assertCovered(lane, "run-behind", "the device terminal covers its local_device connection");
+    await changeSourceKind(lane, "browser_collector");
+    await ageFoldCache(lane, "browser_collector");
+    // No reconcile, no maintenance sweep: this is what a read sees between a deploy and the first replay.
+    assert.deepEqual(
+      await reportedConditions(lane, false),
+      UNKNOWN_CONDITIONS,
+      "the list read credits no stream from a cache an older fold built"
+    );
+    const detail = await getConnectorDetail(CONNECTOR_ID);
+    assert.deepEqual(
+      Object.fromEntries(detail.collection_report.map((entry) => [entry.stream, entry.coverage_condition])),
+      UNKNOWN_CONDITIONS,
+      "the detail read credits no stream from a cache an older fold built"
+    );
+    assert.equal(
+      (await foldedStreamFacts(lane)).version,
+      PREDECESSOR_FOLD_VERSION,
+      "the reads repaired nothing: the cache is still the predecessor's"
+    );
   }
 );
 
@@ -1757,6 +1794,57 @@ laneTest(
   }
 );
 
+laneTest(
+  "source kind: a fold begun under local_device cannot publish after the connection's source kind changed",
+  async (lane) => {
+    await commitProof(lane, "run-fenced");
+    await assertCovered(lane, "run-fenced", "the device terminal covers its local_device connection");
+    const id = lane.enrolled.connector_instance_id;
+    // The cache as an evidence repair leaves it: no checkpoint, no facts, the current fold version.
+    await sql(
+      lane,
+      "UPDATE connector_summary_evidence SET stream_latest_facts_json = NULL, stream_facts_event_seq = NULL, stream_facts_fold_version = ?, dirty = 0 WHERE connector_instance_id = ?",
+      "UPDATE connector_summary_evidence SET stream_latest_facts_json = NULL, stream_facts_event_seq = NULL, stream_facts_fold_version = $1, dirty = 0 WHERE connector_instance_id = $2",
+      [UPGRADED_FOLD_VERSION, id]
+    );
+    const paused = gate();
+    const reached = gate();
+    let held = false;
+    __testOnlySetFoldPauseHook(async (point) => {
+      if (point === "before_cas_write" && !held) {
+        held = true;
+        reached.open();
+        await paused.wait;
+      }
+    });
+    try {
+      const inFlight = foldConnectorSummaryStreamFacts([id]);
+      await Promise.race([
+        reached.wait,
+        inFlight.then(() => assert.fail("the fold finished without reaching its compare-and-set write")),
+      ]);
+      // The fold has folded the device terminal as local_device and not yet written. The source kind changes:
+      // the repair writes the new kind on the evidence row and leaves checkpoint and version as they were.
+      await changeSourceKind(lane, "browser_collector");
+      await sql(
+        lane,
+        "UPDATE connector_summary_evidence SET source_kind = ? WHERE connector_instance_id = ?",
+        "UPDATE connector_summary_evidence SET source_kind = $1 WHERE connector_instance_id = $2",
+        ["browser_collector", id]
+      );
+      paused.open();
+      // The write built under local_device loses its CAS; the fold's own retry rereads the new kind and refuses the
+      // device terminal.
+      const outcome = await inFlight;
+      assert.ok(outcome.refused > 0, "the retry under the new source kind refuses the device terminal");
+    } finally {
+      __testOnlySetFoldPauseHook(null);
+    }
+    assert.deepEqual((await foldedStreamFacts(lane)).streams, [], "the stale fold published no device fact");
+    await assertNoDeviceCoverage(lane, "the fold after the source kind changed");
+  }
+);
+
 laneTest("source kind: an exact replay returns the stored receipt and grants no coverage", async (lane) => {
   assert.equal((await postRunStart(lane, "run-replayed")).status, 201);
   await markDrained(lane);
@@ -1781,7 +1869,7 @@ laneTest(
     await assertCovered(lane, "run-local", "the replayed fold keeps the local_device positive");
     assert.deepEqual(await foldedStreamFacts(lane), {
       streams: ["messages", "sessions"],
-      version: STREAM_FACTS_FOLD_LOGIC_VERSION,
+      version: UPGRADED_FOLD_VERSION,
     });
   }
 );
diff --git a/reference-implementation/test/reconcile-active-summary-evidence-oracle.test.ts b/reference-implementation/test/reconcile-active-summary-evidence-oracle.test.ts
index 699e63f13..7617f3e23 100644
--- a/reference-implementation/test/reconcile-active-summary-evidence-oracle.test.ts
+++ b/reference-implementation/test/reconcile-active-summary-evidence-oracle.test.ts
@@ -922,11 +922,19 @@ test("SQLite route fails terminal facts closed when bounded v3 replay contention
       assert.equal(v2Wins, 2, "the barrier made exactly its bounded two replay attempts");
       assert.equal(route.terminal_facts.state, "stale");
       assert.equal(route.terminal_facts.reason_code, "terminal_fold_contention");
+      const rawDurable = getDb()
+        .prepare("SELECT stream_latest_facts_json FROM connector_summary_evidence WHERE connector_instance_id = ?")
+        .get(INSTANCE_ID) as { stream_latest_facts_json: string | null };
       assert.match(
-        JSON.stringify((await getConnectorSummaryEvidence(INSTANCE_ID)).stream_latest_facts),
+        String(rawDurable.stream_latest_facts_json),
         TOP_LEVEL_REGEX_3,
         "the raw durable v2 row may still contain history, but the same route cannot trust it"
       );
+      assert.equal(
+        (await getConnectorSummaryEvidence(INSTANCE_ID)).stream_latest_facts,
+        null,
+        "a read credits no stream from the version-behind durable row"
+      );
     } finally {
       __testOnlySetFoldPauseHook(null);
     }

From 133f73da15b148844dcc8280baa4ede28ffa757d Mon Sep 17 00:00:00 2001
From: Tim Nunamaker <tnunamak@gmail.com>
Date: Fri, 23 Oct 2026 00:43:53 -0500
Subject: [PATCH 76/87] test(coverage): assert each behind-version mask on its
 own; narrow the fence claim

The read-before-repair test checked only the projected conditions, which
stay unknown if either mask is removed. It now also asserts the shaped
evidence directly: stream_latest_facts is null and terminal_facts is
unobserved with fold_logic_version_behind. Removing either mask alone now
fails the test.

The design note said the fold fence compares the connection's source kind.
It compares the evidence row's cached kind. A change made only to
connector_instances, such as a boot migration, is caught by the next
evidence repair, which clears and replays the cache.

Signed-off-by: Tim Nunamaker <tnunamak@gmail.com>
Assisted-by: AI
---
 docs/261021-local-device-coverage-evidence.md              | 2 +-
 .../test/local-device-coverage-revision-atomicity.test.ts  | 7 +++++++
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/docs/261021-local-device-coverage-evidence.md b/docs/261021-local-device-coverage-evidence.md
index 8a41b6cb6..fd4f44b66 100644
--- a/docs/261021-local-device-coverage-evidence.md
+++ b/docs/261021-local-device-coverage-evidence.md
@@ -88,7 +88,7 @@ The spec gate amended the ordering decision. Two orders exist, and each controls
 
 No wall clock takes part in either.
 
-Placement makes cross-runtime execution impossible for every connection that can hold a positive: shared admission refuses `local_device` runs (`reference-implementation/server/stores/connector-instance-store.ts:1238`), and startup enrollment filters them out (`reference-implementation/server/index.ts:9678`). Terminal collection checks the source kind with the same shared predicate (`reference-implementation/operations/local-device-terminal-collection.ts:456`, called by the v2 path at line 240) and stores an ineligibility reason. The stored reason is not the authority, because earlier terminals carry none and a connection can change source kind after it commits. Device terminal facts count only while the connection is `local_device` now: the run selector drops device terminal runs that carry a collection revision or the stored marker (`reference-implementation/server/ref-control.ts:2892`; a device terminal stored before collection revisions carries neither, and `run_history` does not record the event's `actor_type`, so the selector cannot yet recognize it: open), the stream-facts fold refuses `local_device` events for any other current source kind (`reference-implementation/server/connector-summary-read-model.ts:1952`), and an evidence repair that sees the source kind change clears and replays the fold cache (`reference-implementation/server/connector-summary-evidence-engine.ts:3630`). A fold writes only while the evidence row still has the source kind it started under (`reference-implementation/server/connector-summary-read-model.ts:1466`, `:1578`), so a fold begun before the change cannot publish after it. A cache folded under an older fold version is read as unobserved until a replay rebuilds it (`reference-implementation/server/connector-summary-read-model.ts:779`, `:889`); the first replay after a deploy is the maintenance sweep, so every connection reads unknown until it runs. An exact replay of a terminal commit still returns its stored receipt; the receipt grants no coverage. Device-enrolled `browser_collector` connections remain server-schedulable. Their records and terminal reports are stored, but the device's store claims stay unknown because a server-scheduled run of that same connection has no device run-order marker to retire a positive; cross-runtime retirement for `browser_collector` is a gap.
+Placement makes cross-runtime execution impossible for every connection that can hold a positive: shared admission refuses `local_device` runs (`reference-implementation/server/stores/connector-instance-store.ts:1238`), and startup enrollment filters them out (`reference-implementation/server/index.ts:9678`). Terminal collection checks the source kind with the same shared predicate (`reference-implementation/operations/local-device-terminal-collection.ts:456`, called by the v2 path at line 240) and stores an ineligibility reason. The stored reason is not the authority, because earlier terminals carry none and a connection can change source kind after it commits. Device terminal facts count only while the connection is `local_device` now: the run selector drops device terminal runs that carry a collection revision or the stored marker (`reference-implementation/server/ref-control.ts:2892`; a device terminal stored before collection revisions carries neither, and `run_history` does not record the event's `actor_type`, so the selector cannot yet recognize it: open), the stream-facts fold refuses `local_device` events for any other current source kind (`reference-implementation/server/connector-summary-read-model.ts:1952`), and an evidence repair that sees the source kind change clears and replays the fold cache (`reference-implementation/server/connector-summary-evidence-engine.ts:3630`). A fold writes only while the evidence row still records the source kind it started under (`reference-implementation/server/connector-summary-read-model.ts:1466`, `:1578`). The fence compares the evidence row's cached kind, not `connector_instances` directly: a fold begun before an evidence repair records a changed kind cannot publish after that repair. A change made only to `connector_instances` (the boot migrations in `db.ts` and `postgres-storage.ts`) is caught by the next evidence repair, which sees the mismatch and clears and replays the cache. A cache folded under an older fold version is read as unobserved until a replay rebuilds it (`reference-implementation/server/connector-summary-read-model.ts:779`, `:889`); the first replay after a deploy is the maintenance sweep, so every connection reads unknown until it runs. An exact replay of a terminal commit still returns its stored receipt; the receipt grants no coverage. Device-enrolled `browser_collector` connections remain server-schedulable. Their records and terminal reports are stored, but the device's store claims stay unknown because a server-scheduled run of that same connection has no device run-order marker to retire a positive; cross-runtime retirement for `browser_collector` is a gap.
 
 Sequence issuance. The runtime already contacts the server before it scans: a "starting" heartbeat, the pre-scan drain, and the state read, which names the connection. None of these can carry the issuance. The heartbeat is a best-effort liveness signal that names no run, and the state read is a GET, which must stay free of side effects. The runtime therefore makes one new idempotent call at the same point, after the state read and before the scan: `POST .../source-instances/{source}/run-starts` with the run id. The server resolves the authenticated device, source and connection the same way as the terminal route. In one transaction that holds the connection row lock, it increments `connector_instances.run_sequence_issued` and stores `(connector_instance_id, run_id) -> (run_sequence, storage_epoch, device_id, source_instance_id)` in `collection_run_sequences`. An exact replay of the same run id from the same device and source returns the stored sequence (200). The same run id from another device or source is `409 run_start_conflict`. The runtime keeps the run id it registered and uses it for the run's terminal record. A server without the route (404), or a failed call, leaves the run without a sequence. The run still collects and commits its terminal record, but that record can never be an eligible positive proof.
 
diff --git a/reference-implementation/test/local-device-coverage-revision-atomicity.test.ts b/reference-implementation/test/local-device-coverage-revision-atomicity.test.ts
index 1b248e2b9..e65b247af 100644
--- a/reference-implementation/test/local-device-coverage-revision-atomicity.test.ts
+++ b/reference-implementation/test/local-device-coverage-revision-atomicity.test.ts
@@ -30,6 +30,7 @@ import { COLLECTOR_PROTOCOL_VERSION } from "../server/collector-protocol.ts";
 import {
   __testOnlySetFoldPauseHook,
   foldConnectorSummaryStreamFacts,
+  getConnectorSummaryEvidence,
   reconcileDirtyConnectorSummaryEvidence,
 } from "../server/connector-summary-read-model.ts";
 import { closeDb, getDb, initDb } from "../server/db.ts";
@@ -1765,6 +1766,12 @@ laneTest(
     await changeSourceKind(lane, "browser_collector");
     await ageFoldCache(lane, "browser_collector");
     // No reconcile, no maintenance sweep: this is what a read sees between a deploy and the first replay.
+    // Each mask on its own: the shaped evidence withholds the cached facts and marks terminal facts behind.
+    const evidence = await getConnectorSummaryEvidence(lane.enrolled.connector_instance_id);
+    assert.ok(evidence, "the connection has shaped evidence");
+    assert.equal(evidence.stream_latest_facts, null, "a behind-version cache credits no stream facts");
+    assert.equal(evidence.terminal_facts.state, "unobserved", "a behind-version cache is not current terminal evidence");
+    assert.equal(evidence.terminal_facts.reason_code, "fold_logic_version_behind");
     assert.deepEqual(
       await reportedConditions(lane, false),
       UNKNOWN_CONDITIONS,

From 85432c109118b42b81d14f7428c9f88409312fc8 Mon Sep 17 00:00:00 2001
From: Tim Nunamaker <tnunamak@gmail.com>
Date: Fri, 23 Oct 2026 07:14:54 -0500
Subject: [PATCH 77/87] Repair run_history.scheduler_managed for device runs;
 stop reading it as proof provenance

A database that predates run_history.scheduler_managed got the column
with DEFAULT true (Postgres) or DEFAULT 1 (SQLite). Fresh schemas default
to false. The spine-driven run-history writer leaves the column unset, so
on an upgraded database it stamped every device terminal run as
scheduler-managed. Production has 13,351 such rows. The coverage
projection requires scheduler_managed = false for an eligible device
proof, so no production device proof could make local_device coverage
complete. Tests passed because they run on fresh schemas.

Postgres: a boot step sets the column default to false when it differs.
A ledgered pass (run_history_device_run_provenance_v1) then sets
scheduler_managed = false on rows that a local_device spine event names
by the same run_id and connection. It runs in pages of 2000 ids, one short
transaction per page that also advances the ledger cursor. On a local
bench with 44,320 rows and 1.6M spine events it takes about 0.4 s.

SQLite cannot change a default in place. The two writer queries that
leave the column unset now set it to 0, so the stale default no longer
decides the value. The same repair runs once, in one statement, behind
the same ledger id.

Server rows are not changed. The default stamped them true whether or not
the scheduler wrote them, and nothing stored separates a scheduled run
from a manual one.

ref-control no longer reads the flag as device provenance. A device
terminal commit stamps the connection's collection revision, as
isDeviceTerminalRun already assumes. eligibleLocalRun now requires that
stamp instead of scheduler_managed = false. The fence stops passing the
flag, and the proof-run read drops it. isOwnScopedRun additionally
refuses a device terminal run stamped scheduler-managed. The
later-unordered-run veto still reads the flag: a run with no revision
carries no other provenance, and the repair makes the flag correct there.

Tests build run_history the legacy way, commit a device proof, and
assert coverage is complete; assert the migration flips device rows only
(including a same-run_id row of another connection), pages, and is
skipped once ledgered.

Signed-off-by: Tim Nunamaker <tnunamak@gmail.com>
Assisted-by: AI
---
 reference-implementation/server/db.ts         |  79 ++++-
 .../server/postgres-migration-ledger.ts       |   6 +
 .../server/postgres-storage.ts                | 128 +++++++
 .../insert-finalized-run-history.sql          |   5 +-
 .../queries/controller/start-run-history.sql  |   5 +-
 .../server/ref-control.ts                     |  23 +-
 .../stores/collection-revision-store.ts       |   7 +-
 ...device-coverage-revision-atomicity.test.ts |  69 ++++
 ...ef-connectors-local-coverage-green.test.ts |  27 ++
 ...ry-device-run-provenance-migration.test.ts | 324 ++++++++++++++++++
 10 files changed, 647 insertions(+), 26 deletions(-)
 create mode 100644 reference-implementation/test/run-history-device-run-provenance-migration.test.ts

diff --git a/reference-implementation/server/db.ts b/reference-implementation/server/db.ts
index 9fdbac862..cf9b8f2d9 100644
--- a/reference-implementation/server/db.ts
+++ b/reference-implementation/server/db.ts
@@ -30,6 +30,7 @@ import {
   makeConnectorInstanceSourceBindingKey as canonicalSourceBindingKey,
 } from "./connector-instance-utils.ts";
 import { canonicalConnectorKey } from "./connector-key.ts";
+import { RUN_HISTORY_DEVICE_RUN_PROVENANCE_MIGRATION_ID } from "./postgres-migration-ledger.ts";
 import { RECORD_REJECTION_GENERATION, recordRejectionReplayKey } from "./record-rejection-replay-key.ts";
 import { SqliteDriver } from "./sqlite-driver.ts";
 import {
@@ -2492,16 +2493,15 @@ CREATE INDEX IF NOT EXISTS idx_connector_summary_evidence_connector
 -- module for the semantics of each column and why completion may never be
 -- inferred from the data.
 --
--- SQLite has no writer for it today, and that is deliberate rather than an
--- omission: this backend's local-device canonicalization
--- (migrateLocalDeviceConnectorInstances below) is a synchronous
--- single-file transaction whose cost profile is not the one the Postgres
--- ledger exists to bound -- there is no pre-listen multi-GB index scan and
--- no 503 window to protect. The table is created here so the two backends'
--- schemas stay at parity (backup-table-policy.ts's parity invariant, proven
--- by test/backup-table-inventory.test.ts) and so a SQLite deployment that
--- later needs the same receipt does not require a schema migration to get
--- one.
+-- SQLite's only writer is run_history's device-run provenance repair
+-- (migrateRunHistoryDeviceRunProvenance), a one-statement pass that needs a
+-- receipt but no resume cursor. The local-device canonicalization
+-- (migrateLocalDeviceConnectorInstances below) writes none, deliberately: it
+-- is a synchronous single-file transaction whose cost profile is not the one
+-- the Postgres ledger exists to bound -- there is no pre-listen multi-GB index
+-- scan and no 503 window to protect. The table keeps the two backends'
+-- schemas at parity (backup-table-policy.ts's parity invariant, proven by
+-- test/backup-table-inventory.test.ts).
 CREATE TABLE IF NOT EXISTS storage_migration_ledger (
   migration_id      TEXT PRIMARY KEY,
   status            TEXT NOT NULL CHECK(status IN ('pending', 'running', 'complete', 'blocked')),
@@ -6039,6 +6039,64 @@ function migrateSpineEventsConnectorInstanceIdBackfill(
   return result;
 }
 
+/**
+ * Set `run_history.scheduler_managed = 0` on the rows a device wrote. The
+ * Postgres twin (`migratePostgresRunHistoryDeviceRunProvenance`) explains the
+ * rule and why server rows are left alone.
+ *
+ * A database that predates the column carries `DEFAULT 1` (see
+ * `migrateRunHistoryRename`), and SQLite cannot change a default in place. The
+ * two run-history writers that leave the column unset
+ * (`start-run-history.sql`, `insert-finalized-run-history.sql`) now set it to
+ * 0 themselves, so the stale default no longer decides a value. This pass
+ * repairs the rows already written. It is one statement in one transaction:
+ * SQLite is the single-file local backend, where the Postgres ledger's bounded
+ * pages answer a cost this table does not have. The COMPLETE receipt skips it
+ * on later boots.
+ */
+function migrateRunHistoryDeviceRunProvenance(raw: SqliteDatabase): void {
+  if (!(tableColumns(raw, "run_history").length && hasTableColumn(raw, "spine_events", "connector_instance_id"))) {
+    return;
+  }
+  const receipt = raw
+    .prepare("SELECT 1 FROM storage_migration_ledger WHERE migration_id = ? AND status = 'complete'")
+    .get(RUN_HISTORY_DEVICE_RUN_PROVENANCE_MIGRATION_ID);
+  if (receipt) {
+    return;
+  }
+  raw.transaction(() => {
+    const result = raw
+      .prepare(
+        `UPDATE run_history
+            SET scheduler_managed = 0
+          WHERE scheduler_managed <> 0
+            AND run_id IS NOT NULL
+            AND EXISTS (
+              SELECT 1 FROM spine_events s
+               WHERE s.run_id = run_history.run_id
+                 AND s.actor_type = 'local_device'
+                 AND COALESCE(
+                   NULLIF(s.connector_instance_id, ''),
+                   NULLIF(json_extract(s.data_json, '$.connector_instance_id'), ''),
+                   NULLIF(json_extract(s.data_json, '$.connection_id'), '')
+                 ) = run_history.connector_instance_id
+            )`
+      )
+      .run();
+    const nowIso = new Date().toISOString();
+    raw
+      .prepare(
+        `INSERT INTO storage_migration_ledger(
+           migration_id, status, attempt_count, changed_rows, started_at, updated_at, completed_at
+         ) VALUES (?, 'complete', 1, ?, ?, ?, ?)
+         ON CONFLICT(migration_id) DO UPDATE SET
+           status = 'complete', changed_rows = excluded.changed_rows,
+           attempt_count = attempt_count + 1, updated_at = excluded.updated_at, completed_at = excluded.completed_at`
+      )
+      .run(RUN_HISTORY_DEVICE_RUN_PROVENANCE_MIGRATION_ID, Number(result.changes), nowIso, nowIso, nowIso);
+  })();
+}
+
 /**
  * Migrate `blob_bindings` to include `json_path` in the primary key.
  *
@@ -6804,6 +6862,7 @@ CREATE INDEX IF NOT EXISTS idx_blob_bindings_record ON blob_bindings(connector_i
   // connector-summary-read-model.ts exactly: `data.connector_instance_id`
   // first, then `data.connection_id`.
   runWithSqliteBusyRetrySync(() => migrateSpineEventsConnectorInstanceIdBackfill(raw, opts));
+  runWithSqliteBusyRetrySync(() => migrateRunHistoryDeviceRunProvenance(raw));
   // Index gives us a fast lookup-by-approval-id and approximates the
   // UNIQUE constraint on the column (the inline CREATE TABLE form
   // declares it UNIQUE; SQLite's ALTER TABLE ADD COLUMN does not
diff --git a/reference-implementation/server/postgres-migration-ledger.ts b/reference-implementation/server/postgres-migration-ledger.ts
index ed0cefe95..c98357c05 100644
--- a/reference-implementation/server/postgres-migration-ledger.ts
+++ b/reference-implementation/server/postgres-migration-ledger.ts
@@ -65,6 +65,12 @@ export const POSTGRES_MIGRATION_LEDGER_TABLE = "storage_migration_ledger";
  */
 export const LOCAL_DEVICE_CANONICALIZATION_MIGRATION_ID = "local_device_connector_canonicalization_v1";
 
+/**
+ * Stable id for the run_history device-run provenance repair: device terminal
+ * runs carry `scheduler_managed = false`. Both backends ledger it under this id.
+ */
+export const RUN_HISTORY_DEVICE_RUN_PROVENANCE_MIGRATION_ID = "run_history_device_run_provenance_v1";
+
 export type PostgresMigrationStatus = "blocked" | "complete" | "pending" | "running";
 
 export interface PostgresMigrationLedgerRow {
diff --git a/reference-implementation/server/postgres-storage.ts b/reference-implementation/server/postgres-storage.ts
index e42a91172..7ab58be42 100644
--- a/reference-implementation/server/postgres-storage.ts
+++ b/reference-implementation/server/postgres-storage.ts
@@ -36,6 +36,7 @@ import {
   ensurePostgresMigrationLedger,
   LOCAL_DEVICE_CANONICALIZATION_MIGRATION_ID,
   readPostgresMigrationLedgerRow,
+  RUN_HISTORY_DEVICE_RUN_PROVENANCE_MIGRATION_ID,
 } from "./postgres-migration-ledger.ts";
 import {
   assertTestDatabase,
@@ -3955,6 +3956,7 @@ async function bootstrapPostgresSchemaOnce({
     await migratePostgresSchedulerInstanceColumns(client);
     await migratePostgresRunHistoryRename(client);
     await migratePostgresRunHistoryCompletedAtNullable(client);
+    await migratePostgresRunHistorySchedulerManagedDefault(client);
     await migratePostgresConnectorMaintenanceCursorNameCheck(client);
     await migratePostgresRecordsBlobSearchInstanceColumns(client);
     // Legacy blob tables gain connector_instance_id in the migration above.
@@ -3966,6 +3968,7 @@ async function bootstrapPostgresSchemaOnce({
     // own completion, which is the defect the ledger exists to remove.
     await ensurePostgresMigrationLedger(client);
     await migratePostgresLocalDeviceConnectorInstances(client, { log });
+    await migratePostgresRunHistoryDeviceRunProvenance(client, { log });
     await migratePostgresLegacyConnectorInstancesToDefaultAccount(client);
     await migratePostgresConnectorInstancesSourceKindBrowserCollector(client);
     await migratePostgresConnectorSummaryEvidenceRepairChunkPageSize(client);
@@ -5638,6 +5641,131 @@ async function migratePostgresRunHistoryCompletedAtNullable(client: PoolClient):
   await client.query("ALTER TABLE run_history ALTER COLUMN completed_at DROP NOT NULL");
 }
 
+// `run_history.scheduler_managed` is false for every row the spine-driven
+// writer inserts (fresh schemas default it to false). A database that
+// predates the column got it through ADD COLUMN ... DEFAULT true, and that
+// default outlived the backfill it was written for: the spine writer, which
+// leaves the column unset, then stamped true on every run it recorded. Set the
+// default to the fresh-schema value. Only the default changes; rows are
+// repaired by migratePostgresRunHistoryDeviceRunProvenance. The ALTER takes
+// an exclusive table lock, so it runs only when the default differs.
+async function migratePostgresRunHistorySchedulerManagedDefault(client: PoolClient): Promise<void> {
+  const result = await client.query<{ column_default: string | null }>(
+    `SELECT column_default FROM information_schema.columns
+       WHERE table_schema = current_schema() AND table_name = 'run_history' AND column_name = 'scheduler_managed'`
+  );
+  const columnDefault = result.rows[0]?.column_default;
+  if (columnDefault === undefined || columnDefault === "false") {
+    return;
+  }
+  await client.query("ALTER TABLE run_history ALTER COLUMN scheduler_managed SET DEFAULT false");
+}
+
+const PG_RUN_HISTORY_PROVENANCE_BATCH_ROWS = 2000;
+const PG_RUN_HISTORY_PROVENANCE_LEASE_MS = 15 * 60 * 1000;
+
+/**
+ * Correct `scheduler_managed` on the run_history rows a device wrote.
+ *
+ * A device terminal commit writes a spine event with `actor_type =
+ * 'local_device'`; the run-history writer turns it into the run_history row.
+ * While the column default was true (see the default migration above) every
+ * such row was stamped true, and the coverage projection read it as scheduler
+ * history. A row is set false when a `local_device` spine event names the same
+ * (run_id, connector_instance_id): run_id alone is not unique across
+ * connections.
+ *
+ * Server rows are not touched. A row for a server-side run was stamped true by
+ * the default whether or not the scheduler wrote it, and nothing stored
+ * separates a scheduler run from a manual one, so no correct value can be
+ * rebuilt for it.
+ *
+ * Pages run in id order, and each page is its own short transaction that also
+ * advances the ledger cursor, so a crash resumes at the last committed page.
+ * Each page probes the run_id/event_type terminal-event partial index once per
+ * still-true row; a COMPLETE receipt skips the whole pass on later boots.
+ */
+async function migratePostgresRunHistoryDeviceRunProvenance(
+  client: PoolClient,
+  { log = NOOP_STORAGE_LOG }: { log?: StorageLog } = {}
+): Promise<{ changedRows: number; skippedByReceipt: boolean }> {
+  const claim = await claimPostgresMigration(client, RUN_HISTORY_DEVICE_RUN_PROVENANCE_MIGRATION_ID, {
+    leaseDurationMs: PG_RUN_HISTORY_PROVENANCE_LEASE_MS,
+    leaseOwner: `${process.pid}@${POSTGRES_MIGRATION_LEASE_OWNER_NONCE}`,
+    nowIso: new Date().toISOString(),
+  });
+  if (!claim) {
+    return { changedRows: 0, skippedByReceipt: true };
+  }
+  let cursor = claim.cursor ?? "0";
+  let changedRows = 0;
+  for (;;) {
+    // biome-ignore lint/performance/noAwaitInLoops: Pages are sequential by contract — each cursor is valid only after the previous page committed.
+    const page = await client.query<{ upper_id: string | null }>(
+      `SELECT MAX(id)::text AS upper_id
+         FROM (SELECT id FROM run_history WHERE id > $1::bigint ORDER BY id LIMIT $2) page`,
+      [cursor, PG_RUN_HISTORY_PROVENANCE_BATCH_ROWS]
+    );
+    const upperId = page.rows[0]?.upper_id;
+    if (!upperId) {
+      break;
+    }
+    await client.query("BEGIN");
+    try {
+      const updated = await client.query(
+        `UPDATE run_history rh
+            SET scheduler_managed = false
+          WHERE rh.id > $1::bigint AND rh.id <= $2::bigint
+            AND rh.scheduler_managed
+            AND rh.run_id IS NOT NULL
+            AND EXISTS (
+              SELECT 1 FROM spine_events s
+               WHERE s.run_id = rh.run_id
+                 AND s.event_type IN ('run.completed', 'run.failed', 'run.cancelled', 'run.abandoned')
+                 AND s.actor_type = 'local_device'
+                 AND COALESCE(
+                   NULLIF(s.connector_instance_id, ''),
+                   NULLIF(s.data_json->>'connector_instance_id', ''),
+                   NULLIF(s.data_json->>'connection_id', '')
+                 ) = rh.connector_instance_id
+            )`,
+        [cursor, upperId]
+      );
+      const batchChangedRows = updated.rowCount ?? 0;
+      await advancePostgresMigrationCursor(client, RUN_HISTORY_DEVICE_RUN_PROVENANCE_MIGRATION_ID, {
+        changedRows: batchChangedRows,
+        cursor: upperId,
+        nowIso: new Date().toISOString(),
+      });
+      await client.query("COMMIT");
+      cursor = upperId;
+      changedRows += batchChangedRows;
+    } catch (err) {
+      try {
+        await client.query("ROLLBACK");
+      } catch {
+        // Rollback failure must not hide the original migration error.
+      }
+      try {
+        await blockPostgresMigration(client, RUN_HISTORY_DEVICE_RUN_PROVENANCE_MIGRATION_ID, {
+          error: err instanceof Error ? err.message : String(err),
+          nowIso: new Date().toISOString(),
+        });
+      } catch {
+        // A ledger write failure must not hide the original migration error.
+      }
+      throw err;
+    }
+  }
+  await completePostgresMigration(client, RUN_HISTORY_DEVICE_RUN_PROVENANCE_MIGRATION_ID, {
+    nowIso: new Date().toISOString(),
+  });
+  if (changedRows > 0) {
+    log(`[PDPP] run_history device-run provenance: ${changedRows} device runs set scheduler_managed = false`);
+  }
+  return { changedRows, skippedByReceipt: false };
+}
+
 // Widens `connector_maintenance_cursor.name`'s CHECK to admit the
 // `run_history_backfill` cursor row alongside the existing
 // `connector_summary_evidence` one. No-op once the constraint already
diff --git a/reference-implementation/server/queries/controller/insert-finalized-run-history.sql b/reference-implementation/server/queries/controller/insert-finalized-run-history.sql
index 657496662..c94e5ba4d 100644
--- a/reference-implementation/server/queries/controller/insert-finalized-run-history.sql
+++ b/reference-implementation/server/queries/controller/insert-finalized-run-history.sql
@@ -25,6 +25,7 @@ INSERT INTO run_history(
   failure_reason,
   terminal_reason,
   facts_json,
-  attempt
-) VALUES(?, ?, ?, ?, ?, ?, '[]', ?, ?, ?, ?, ?, ?, ?, 1)
+  attempt,
+  scheduler_managed
+) VALUES(?, ?, ?, ?, ?, ?, '[]', ?, ?, ?, ?, ?, ?, ?, 1, 0)
 ON CONFLICT(run_id, connector_instance_id) WHERE run_id IS NOT NULL DO NOTHING
diff --git a/reference-implementation/server/queries/controller/start-run-history.sql b/reference-implementation/server/queries/controller/start-run-history.sql
index f40bd54cb..244c95e0d 100644
--- a/reference-implementation/server/queries/controller/start-run-history.sql
+++ b/reference-implementation/server/queries/controller/start-run-history.sql
@@ -19,6 +19,7 @@ INSERT INTO run_history(
   status,
   known_gaps_json,
   started_at,
-  attempt
-) VALUES(?, ?, ?, ?, ?, 'running', '[]', ?, 1)
+  attempt,
+  scheduler_managed
+) VALUES(?, ?, ?, ?, ?, 'running', '[]', ?, 1, 0)
 ON CONFLICT(run_id, connector_instance_id) WHERE run_id IS NOT NULL DO NOTHING
diff --git a/reference-implementation/server/ref-control.ts b/reference-implementation/server/ref-control.ts
index d798b6057..19e5f7b1f 100644
--- a/reference-implementation/server/ref-control.ts
+++ b/reference-implementation/server/ref-control.ts
@@ -1641,7 +1641,6 @@ function readLocalTerminalCoverage(
   history: {
     readonly connectorInstanceId?: string | null;
     readonly runId?: string | null;
-    readonly schedulerManaged?: boolean | null;
     readonly status: string;
   }
 ): NonNullable<ConnectorRunSummary["local_terminal_coverage"]> | null {
@@ -1652,9 +1651,12 @@ function readLocalTerminalCoverage(
   return {
     coverageEligibilityReason:
       typeof block.coverage_eligibility_reason === "string" ? block.coverage_eligibility_reason : null,
+    // A device terminal commit stamps the connection's collection revision
+    // (see `isDeviceTerminalRun`); no server run does. The row's
+    // `scheduler_managed` flag is not provenance here.
     eligibleLocalRun:
       history.status === "succeeded" &&
-      history.schedulerManaged === false &&
+      readCollectionRevision(facts?.collection_revision) !== null &&
       typeof history.connectorInstanceId === "string" &&
       typeof history.runId === "string" &&
       block.reference_only === true,
@@ -2915,6 +2917,16 @@ function isDeviceTerminalRun(run: ConnectorRunSummary | null): boolean {
   );
 }
 
+/**
+ * A run the connection's own scheduler recorded. `scheduler_managed` says so,
+ * but a device terminal commit is never scheduler history whatever the flag
+ * holds: a database whose column default was once `true` can still carry such
+ * a row stamped `true`.
+ */
+function isSchedulerOwnedRun(run: ConnectorRunSummary | null): boolean {
+  return run?.scheduler_managed === true && !isDeviceTerminalRun(run);
+}
+
 function selectCoverageClassifyingRun(
   lastRun: ConnectorRunSummary | null,
   lastSuccessfulRun: ConnectorRunSummary | null,
@@ -5234,7 +5246,6 @@ function localProofRunCoverage(
   const terminal = readLocalTerminalCoverage(proofRun.facts, {
     connectorInstanceId,
     runId: proofRun.runId,
-    schedulerManaged: proofRun.schedulerManaged,
     status: proofRun.status,
   });
   if (!terminal) {
@@ -6419,8 +6430,7 @@ export function projectConnectorSummaryConnectionHealth(input: {
   // placement admission began refusing new server runs for local-device
   // connections.
   const localDeviceBacked = input.localDeviceBacked === true;
-  const isOwnScopedRun = (run: ConnectorRunSummary | null): boolean =>
-    !localDeviceBacked || run?.scheduler_managed === true;
+  const isOwnScopedRun = (run: ConnectorRunSummary | null): boolean => !localDeviceBacked || isSchedulerOwnedRun(run);
   const authoritativeLastRun = isOwnScopedRun(input.lastRun) ? input.lastRun : null;
   const authoritativeLastSuccessfulRun = isOwnScopedRun(input.lastSuccessfulRun) ? input.lastSuccessfulRun : null;
   const fallbackSettledRun = input.latestSettledRun ?? fallbackLatestSettledRun(input.lastRun, input.lastSuccessfulRun);
@@ -7360,8 +7370,7 @@ function synthesizeConnectorSummary(input: ConnectorSummarySynthesisInput): Conn
   // local device's run evidence is quarantined as foreign/historical unless
   // the row proves it is this connection's own scheduler-managed run. This
   // keeps historical rows readable after placement admission blocks new ones.
-  const isOwnScopedRun = (run: ConnectorRunSummary | null): boolean =>
-    !localDeviceBacked || run?.scheduler_managed === true;
+  const isOwnScopedRun = (run: ConnectorRunSummary | null): boolean => !localDeviceBacked || isSchedulerOwnedRun(run);
   const authoritativeActiveRun = localDeviceBacked ? null : activeRun;
   const authoritativeCollectionRate = localDeviceBacked ? null : collectionRate;
   const authoritativeEphemeralBrowserRuntime = localDeviceBacked ? null : ephemeralBrowserRuntime;
diff --git a/reference-implementation/server/stores/collection-revision-store.ts b/reference-implementation/server/stores/collection-revision-store.ts
index d192dfaf7..49a0ba6b0 100644
--- a/reference-implementation/server/stores/collection-revision-store.ts
+++ b/reference-implementation/server/stores/collection-revision-store.ts
@@ -536,7 +536,6 @@ export interface LocalCoverageProofRun {
   readonly completedAt: string | null;
   readonly facts: Record<string, unknown> | null;
   readonly runId: string;
-  readonly schedulerManaged: boolean;
   readonly status: string;
 }
 
@@ -640,11 +639,10 @@ export async function readLocalCoverageRevisionFences(
     collection_revision_run_id: string | null;
     connector_instance_id: string;
     manifest_generation: unknown;
-    proof_manifest: string | null;
     proof_completed_at: string | null;
     proof_facts_json: unknown;
+    proof_manifest: string | null;
     proof_run_id: string | null;
-    proof_scheduler_managed: unknown;
     proof_status: string | null;
     run_order_event: string | null;
     run_order_revision: unknown;
@@ -671,7 +669,7 @@ export async function readLocalCoverageRevisionFences(
             ci.storage_epoch${casts.revision} AS storage_epoch,
             ci.manifest_generation, scope.state_json${casts.json} AS scope_state_json,
             CASE WHEN ci.run_order_event = ${runTerminal} THEN c.manifest${casts.json} END AS proof_manifest,
-            rh.run_id AS proof_run_id, rh.status AS proof_status, rh.scheduler_managed AS proof_scheduler_managed,
+            rh.run_id AS proof_run_id, rh.status AS proof_status,
             rh.completed_at AS proof_completed_at, rh.facts_json AS proof_facts_json
        FROM connector_instances ci
        LEFT JOIN connectors c ON c.connector_id = ci.connector_id
@@ -727,7 +725,6 @@ export async function readLocalCoverageRevisionFences(
               completedAt: row.proof_completed_at ?? null,
               facts: parseFacts(row.proof_facts_json),
               runId: row.proof_run_id,
-              schedulerManaged: row.proof_scheduler_managed === true || Number(row.proof_scheduler_managed) === 1,
               status: row.proof_status,
             }
           : null,
diff --git a/reference-implementation/test/local-device-coverage-revision-atomicity.test.ts b/reference-implementation/test/local-device-coverage-revision-atomicity.test.ts
index e65b247af..fbe1788bb 100644
--- a/reference-implementation/test/local-device-coverage-revision-atomicity.test.ts
+++ b/reference-implementation/test/local-device-coverage-revision-atomicity.test.ts
@@ -2059,6 +2059,75 @@ test("a record transaction and a terminal commit for one connection serialize wi
   });
 });
 
+// ---------------------------------------------------------------------------
+// A database whose run_history.scheduler_managed column was added later.
+// ---------------------------------------------------------------------------
+
+/**
+ * Give `run_history.scheduler_managed` the default a database that predates
+ * the column carries (`DEFAULT true` / `DEFAULT 1`), then boot again as the
+ * server does. SQLite cannot change a default in place, so the table is
+ * rebuilt; it is empty at this point.
+ */
+async function restoreLegacySchedulerManagedDefault(lane: Lane): Promise<void> {
+  if (lane.backend === "postgres") {
+    await postgresQuery("ALTER TABLE run_history ALTER COLUMN scheduler_managed SET DEFAULT true");
+    await bootstrapPostgresSchema();
+    return;
+  }
+  const db = getDb();
+  assert.equal((db.prepare("SELECT COUNT(*) AS n FROM run_history").get() as { n: number }).n, 0);
+  const definitions = db
+    .prepare("SELECT type, sql FROM sqlite_master WHERE tbl_name = 'run_history' AND sql IS NOT NULL")
+    .all() as { sql: string; type: string }[];
+  const table = definitions.find((row) => row.type === "table")?.sql ?? "";
+  assert.match(table, /scheduler_managed\s+INTEGER NOT NULL DEFAULT 0/);
+  db.exec("DROP TABLE run_history");
+  db.exec(table.replace(/(scheduler_managed\s+INTEGER NOT NULL DEFAULT )0/, "$11"));
+  for (const index of definitions.filter((row) => row.type === "index")) {
+    db.exec(index.sql);
+  }
+}
+
+async function schedulerManagedFlag(lane: Lane, runId: string): Promise<boolean> {
+  const [row] = await sql(
+    lane,
+    "SELECT scheduler_managed FROM run_history WHERE run_id = ?",
+    "SELECT scheduler_managed FROM run_history WHERE run_id = $1",
+    [runId]
+  );
+  assert.ok(row, `run ${runId} has a run_history row`);
+  return row.scheduler_managed === true || row.scheduler_managed === 1;
+}
+
+laneTest("legacy column default: a device proof stays covered when the flag defaulted to true", async (lane) => {
+  await restoreLegacySchedulerManagedDefault(lane);
+  await commitProof(lane, "run-legacy-default");
+  assert.equal(
+    await schedulerManagedFlag(lane, "run-legacy-default"),
+    false,
+    "the run-history writer records a device run as not scheduler-managed whatever the column default"
+  );
+  await assertCovered(lane, "run-legacy-default", "the device proof is eligible on a legacy-default table");
+});
+
+laneTest("legacy column default: a device run stamped scheduler-managed is not scheduler history", async (lane) => {
+  await commitProof(lane, "run-stamped");
+  await sql(
+    lane,
+    "UPDATE run_history SET scheduler_managed = 1 WHERE run_id = ?",
+    "UPDATE run_history SET scheduler_managed = true WHERE run_id = $1",
+    ["run-stamped"]
+  );
+  await assertCovered(lane, "run-stamped", "the proof does not depend on the flag");
+  await reconcileDirtyConnectorSummaryEvidence(null);
+  const summary = (await listConnectorSummaries()).find(
+    (row) => row.connector_instance_id === lane.enrolled.connector_instance_id
+  );
+  assert.ok(summary, "the lane's connection is projected");
+  assert.equal(summary.last_run, null, "a stamped device run is not the connection's own scheduler run");
+});
+
 // ---------------------------------------------------------------------------
 // Upgrade from a database that predates the collection revision.
 // ---------------------------------------------------------------------------
diff --git a/reference-implementation/test/ref-connectors-local-coverage-green.test.ts b/reference-implementation/test/ref-connectors-local-coverage-green.test.ts
index 365b3b5d0..bd672a045 100644
--- a/reference-implementation/test/ref-connectors-local-coverage-green.test.ts
+++ b/reference-implementation/test/ref-connectors-local-coverage-green.test.ts
@@ -1669,6 +1669,33 @@ test("a local_device connection's foreign (non-scheduler-managed) run does not p
   assert.equal(health.axes.coverage, "unknown");
 });
 
+test("a local_device connection's device terminal run stays quarantined even when stamped scheduler_managed", () => {
+  // A database whose column default was once `true` stamped device terminal
+  // commits `scheduler_managed = true`. A device terminal commit stamps the
+  // connection's collection revision; that, not the flag, says the run is
+  // not the connection's own scheduler history.
+  const failed = { ...ownScopedRunSummary({ scheduler_managed: true, status: "failed" }), failure_reason: "boom" };
+  const healthOf = (lastRun: ConnectorRunSummary) =>
+    projectConnectorSummaryConnectionHealth({
+      freshness: FRESH_FRESHNESS,
+      lastRun,
+      lastSuccessfulRun: null,
+      localDeviceBacked: true,
+      manifestStreams: ownScopedManifestStreams(),
+      nowIso: NOW,
+      outbox: { axis: "idle" },
+      pendingDetailGaps: [],
+      schedule: { enabled: true },
+    });
+
+  assert.equal(healthOf(failed).reason_code, "boom", "control: the connection's own scheduler run is evidence");
+  assert.equal(
+    healthOf({ ...failed, collection_revision: 7 }).reason_code,
+    null,
+    "a device terminal run is quarantined whatever its flag says"
+  );
+});
+
 test("a local_device connection's run with scheduler_managed unset (legacy/absent evidence) stays quarantined", () => {
   // `scheduler_managed` is optional/absent for callers/fixtures that predate
   // this field (see `ConnectorRunSummary.scheduler_managed`'s doc comment).
diff --git a/reference-implementation/test/run-history-device-run-provenance-migration.test.ts b/reference-implementation/test/run-history-device-run-provenance-migration.test.ts
new file mode 100644
index 000000000..4d6a6afd3
--- /dev/null
+++ b/reference-implementation/test/run-history-device-run-provenance-migration.test.ts
@@ -0,0 +1,324 @@
+// Copyright The PDP-Connect Contributors
+// SPDX-License-Identifier: Apache-2.0
+
+// run_history.scheduler_managed is false for every row the spine-driven writer
+// inserts. A database that predates the column got it through
+// `ADD COLUMN ... DEFAULT true` (Postgres) / `DEFAULT 1` (SQLite), and that
+// default outlived the backfill it was written for, so the writer — which
+// leaves the column unset — stamped true on the device runs it recorded. The
+// coverage projection reads a true flag as scheduler history, so a device
+// proof could never become eligible.
+//
+// Proves, on both backends and on a table built the legacy way:
+//   - the spine writer records a device run with the flag false;
+//   - the boot migration flips an existing device row (matched by the
+//     local_device spine event for the same run AND connection) and leaves
+//     server rows alone, including a row of another connection that shares the
+//     run_id;
+//   - the pass is ledgered: a later boot skips it;
+//   - on Postgres, the column default is false afterwards and the pass pages.
+
+import assert from "node:assert/strict";
+import test from "node:test";
+import { closeDb, getDb, initDb } from "../server/db.ts";
+import { RUN_HISTORY_DEVICE_RUN_PROVENANCE_MIGRATION_ID } from "../server/postgres-migration-ledger.ts";
+import { closePostgresStorage, initPostgresStorage, postgresQuery } from "../server/postgres-storage.ts";
+import { writeSqliteRunHistoryForSpineEvent } from "../server/stores/run-history-writer.ts";
+import { dedicatedPostgresTestUrl } from "./helpers/dedicated-postgres-test-url.ts";
+import { withTemporaryPostgresDatabase } from "./helpers/postgres-temp-database.ts";
+import { makeTemporaryDbPath } from "./helpers/temp-dir.ts";
+
+const POSTGRES_URL = dedicatedPostgresTestUrl(process.env.PDPP_TEST_POSTGRES_URL);
+const CONNECTOR_ID = "claude-code";
+const DEVICE_INSTANCE = "cin_device";
+const SERVER_INSTANCE = "cin_server";
+const OTHER_INSTANCE = "cin_other";
+const NOW = "2026-10-22T12:00:00.000Z";
+
+interface RunSpec {
+  readonly instance: string;
+  readonly runId: string | null;
+  /** The spine event written for the run, if any. */
+  readonly spine?: {
+    readonly actorType: string;
+    /** `data_json` carries the connection id; otherwise only the column does. */
+    readonly identity: "column" | "data";
+  };
+}
+
+// scheduler_managed is true on every row: the legacy default stamped it.
+const RUNS: readonly RunSpec[] = [
+  { instance: DEVICE_INSTANCE, runId: "run-device-data", spine: { actorType: "local_device", identity: "data" } },
+  { instance: DEVICE_INSTANCE, runId: "run-device-column", spine: { actorType: "local_device", identity: "column" } },
+  { instance: SERVER_INSTANCE, runId: "run-server", spine: { actorType: "runtime", identity: "data" } },
+  { instance: SERVER_INSTANCE, runId: "run-server-no-spine" },
+  // Another connection minted the same run_id as a device run; its row is a server row.
+  { instance: OTHER_INSTANCE, runId: "run-device-data", spine: { actorType: "runtime", identity: "data" } },
+  { instance: DEVICE_INSTANCE, runId: null },
+];
+const DEVICE_RUNS = new Set([`${DEVICE_INSTANCE}/run-device-data`, `${DEVICE_INSTANCE}/run-device-column`]);
+
+function spineParams(spec: RunSpec, index: number) {
+  assert.ok(spec.spine && spec.runId, "only runs with a spine event are seeded into the spine");
+  const dataJson = JSON.stringify(spec.spine.identity === "data" ? { connector_instance_id: spec.instance } : {});
+  return {
+    columnInstance: spec.instance,
+    dataJson,
+    eventId: `evt_provenance_${index}`,
+  };
+}
+
+function key(row: { connector_instance_id: string; run_id: string | null }): string {
+  return `${row.connector_instance_id}/${row.run_id}`;
+}
+
+function isStamped(value: unknown): boolean {
+  return value === true || value === 1;
+}
+
+function seedSqlite(): void {
+  const db = getDb();
+  db.exec("DROP TABLE run_history");
+  db.exec(`
+    CREATE TABLE run_history (
+      id INTEGER PRIMARY KEY AUTOINCREMENT,
+      run_id TEXT,
+      connector_instance_id TEXT NOT NULL,
+      connector_id TEXT NOT NULL,
+      trigger_kind TEXT,
+      source_json TEXT NOT NULL,
+      status TEXT NOT NULL,
+      records_emitted INTEGER NOT NULL DEFAULT 0,
+      reported_records_emitted INTEGER,
+      checkpoint_summary_json TEXT,
+      known_gaps_json TEXT NOT NULL DEFAULT '[]',
+      connector_error_json TEXT,
+      trace_id TEXT,
+      failure_reason TEXT,
+      terminal_reason TEXT,
+      started_at TEXT NOT NULL,
+      completed_at TEXT,
+      error TEXT,
+      attempt INTEGER NOT NULL DEFAULT 1,
+      facts_json TEXT,
+      scheduler_managed INTEGER NOT NULL DEFAULT 1
+    );
+    CREATE INDEX idx_run_history_connector_completed ON run_history(connector_id, completed_at, id);
+    CREATE UNIQUE INDEX uniq_run_history_run_id_instance
+      ON run_history(run_id, connector_instance_id) WHERE run_id IS NOT NULL;
+  `);
+  RUNS.forEach((spec, index) => {
+    db.prepare(
+      `INSERT INTO run_history(connector_instance_id, connector_id, source_json, status, started_at, completed_at, run_id)
+       VALUES (?, ?, '{}', 'succeeded', ?, ?, ?)`
+    ).run(spec.instance, CONNECTOR_ID, NOW, NOW, spec.runId);
+    if (!spec.spine) {
+      return;
+    }
+    const spine = spineParams(spec, index);
+    db.prepare(
+      `INSERT INTO spine_events(
+         event_id, event_type, occurred_at, recorded_at, scenario_id, trace_id, actor_type, actor_id,
+         object_type, object_id, status, run_id, data_json, version, connector_instance_id
+       ) VALUES (?, 'run.completed', ?, ?, 'scenario', 'trace', ?, 'actor', 'run', ?, 'succeeded', ?, ?, '1', ?)`
+    ).run(spine.eventId, NOW, NOW, spec.spine.actorType, spec.runId, spec.runId, spine.dataJson, spine.columnInstance);
+  });
+}
+
+function sqliteFlags(): Map<string, boolean> {
+  const rows = getDb().prepare("SELECT connector_instance_id, run_id, scheduler_managed FROM run_history").all() as {
+    connector_instance_id: string;
+    run_id: string | null;
+    scheduler_managed: number;
+  }[];
+  return new Map(rows.map((row) => [key(row), isStamped(row.scheduler_managed)]));
+}
+
+function assertFlags(flags: Map<string, boolean>): void {
+  for (const spec of RUNS) {
+    const id = key({ connector_instance_id: spec.instance, run_id: spec.runId });
+    assert.equal(
+      flags.get(id),
+      !DEVICE_RUNS.has(id),
+      DEVICE_RUNS.has(id)
+        ? `${id}: a device run is not scheduler-managed`
+        : `${id}: a row without a local_device event for this connection keeps its flag`
+    );
+  }
+}
+
+test("SQLite: the migration flips device runs only, is ledgered, and the spine writer stamps device runs false", () => {
+  const dbPath = makeTemporaryDbPath("pdpp-run-history-device-provenance-");
+  initDb(dbPath);
+  seedSqlite();
+  // A database from before the receipt existed.
+  const dropReceipt = getDb().prepare("DELETE FROM storage_migration_ledger WHERE migration_id = ?");
+  dropReceipt.run(RUN_HISTORY_DEVICE_RUN_PROVENANCE_MIGRATION_ID);
+  closeDb();
+
+  initDb(dbPath);
+  try {
+    assertFlags(sqliteFlags());
+    const receipt = getDb()
+      .prepare("SELECT status, changed_rows FROM storage_migration_ledger WHERE migration_id = ?")
+      .get(RUN_HISTORY_DEVICE_RUN_PROVENANCE_MIGRATION_ID) as { changed_rows: number; status: string };
+    assert.deepEqual({ ...receipt }, { changed_rows: DEVICE_RUNS.size, status: "complete" });
+
+    // The receipt retires the pass: a row flipped back is not touched by the next boot.
+    getDb().prepare("UPDATE run_history SET scheduler_managed = 1").run();
+  } finally {
+    closeDb();
+  }
+  initDb(dbPath);
+  try {
+    assert.ok([...sqliteFlags().values()].every(Boolean), "a boot with a COMPLETE receipt does not rerun the pass");
+
+    // The table still defaults to 1 (SQLite cannot change a default in place), so the
+    // writer's own insert is what keeps a device run from being stamped true.
+    const started = {
+      connectorId: CONNECTOR_ID,
+      connectorInstanceId: DEVICE_INSTANCE,
+      data: {},
+      eventType: "run.started",
+      occurredAt: NOW,
+      runId: "run-written-by-spine-writer",
+      status: "started",
+    };
+    writeSqliteRunHistoryForSpineEvent(started);
+    writeSqliteRunHistoryForSpineEvent({
+      ...started,
+      eventType: "run.completed",
+      runId: "run-finalized-by-spine-writer",
+      status: "succeeded",
+    });
+    const rows = getDb()
+      .prepare("SELECT run_id, scheduler_managed FROM run_history WHERE run_id LIKE 'run-%-by-spine-writer'")
+      .all() as { run_id: string; scheduler_managed: number }[];
+    assert.equal(rows.length, 2);
+    for (const row of rows) {
+      assert.equal(row.scheduler_managed, 0, `${row.run_id}: the writer sets the flag itself`);
+    }
+  } finally {
+    closeDb();
+  }
+});
+
+let tempDbCounter = 0;
+
+test("PostgreSQL: the boot migration repairs the column default and device rows, pages, and is ledgered", {
+  skip: !POSTGRES_URL,
+}, async () => {
+  assert.ok(POSTGRES_URL, "Postgres URL is configured when this test runs");
+  tempDbCounter += 1;
+  await withTemporaryPostgresDatabase(
+    {
+      closeConnections: closePostgresStorage,
+      connectionString: POSTGRES_URL,
+      databaseName: `pdpp_test_rh_device_prov_${process.pid}_${tempDbCounter}`,
+    },
+    async (url) => {
+      await initPostgresStorage({ backend: "postgres", databaseUrl: url });
+      // A database whose column was added later: the default is true.
+      await postgresQuery("ALTER TABLE run_history ALTER COLUMN scheduler_managed SET DEFAULT true");
+      await postgresQuery("DELETE FROM storage_migration_ledger WHERE migration_id = $1", [
+        RUN_HISTORY_DEVICE_RUN_PROVENANCE_MIGRATION_ID,
+      ]);
+      // Filler spans more than one page, so device rows land in the first, a middle and the last page.
+      const filler = await postgresQuery(
+        `INSERT INTO run_history(connector_instance_id, connector_id, source_json, status, started_at, completed_at, run_id)
+         SELECT $1, $2, '{}'::jsonb, 'succeeded', $3, $3, 'run-filler-' || n
+           FROM generate_series(1, 4500) AS n`,
+        [SERVER_INSTANCE, CONNECTOR_ID, NOW]
+      );
+      assert.equal(filler.rowCount, 4500);
+      for (const [index, spec] of RUNS.entries()) {
+        // biome-ignore lint/performance/noAwaitInLoops: a handful of fixture rows.
+        await postgresQuery(
+          `INSERT INTO run_history(connector_instance_id, connector_id, source_json, status, started_at, completed_at, run_id)
+           VALUES ($1, $2, '{}'::jsonb, 'succeeded', $3, $3, $4)`,
+          [spec.instance, CONNECTOR_ID, NOW, spec.runId]
+        );
+        if (spec.spine) {
+          const spine = spineParams(spec, index);
+          // biome-ignore lint/performance/noAwaitInLoops: a handful of fixture rows.
+          await postgresQuery(
+            `INSERT INTO spine_events(
+               event_id, event_type, occurred_at, recorded_at, scenario_id, trace_id, actor_type, actor_id,
+               object_type, object_id, status, run_id, data_json, version, connector_instance_id
+             ) VALUES ($1, 'run.completed', $2, $2, 'scenario', 'trace', $3, 'actor', 'run', $4, 'succeeded', $4, $5::jsonb, '1', $6)`,
+            [spine.eventId, NOW, spec.spine.actorType, spec.runId, spine.dataJson, spine.columnInstance]
+          );
+        }
+        // Push the next fixture row into a later page.
+        // biome-ignore lint/performance/noAwaitInLoops: a handful of fixture rows.
+        await postgresQuery(
+          `INSERT INTO run_history(connector_instance_id, connector_id, source_json, status, started_at, completed_at, run_id)
+           SELECT $1, $2, '{}'::jsonb, 'succeeded', $3, $3, 'run-gap-${index}-' || n FROM generate_series(1, 700) AS n`,
+          [SERVER_INSTANCE, CONNECTOR_ID, NOW]
+        );
+      }
+
+      const flags = async (): Promise<Map<string, boolean>> => {
+        const result = await postgresQuery<{
+          connector_instance_id: string;
+          run_id: string | null;
+          scheduler_managed: boolean;
+        }>(
+          `SELECT connector_instance_id, run_id, scheduler_managed FROM run_history
+            WHERE run_id IS NULL OR run_id NOT LIKE 'run-filler-%' AND run_id NOT LIKE 'run-gap-%'`
+        );
+        return new Map(result.rows.map((row) => [key(row), row.scheduler_managed]));
+      };
+      const columnDefault = async (): Promise<string | null> =>
+        (
+          await postgresQuery<{ column_default: string | null }>(
+            `SELECT column_default FROM information_schema.columns
+              WHERE table_schema = current_schema() AND table_name = 'run_history' AND column_name = 'scheduler_managed'`
+          )
+        ).rows[0]?.column_default ?? null;
+      assert.equal(await columnDefault(), "true", "premise: the legacy default is true");
+      assert.ok([...(await flags()).values()].every(Boolean), "premise: every fixture row is stamped true");
+
+      await closePostgresStorage();
+      await initPostgresStorage({ backend: "postgres", databaseUrl: url });
+
+      assertFlags(await flags());
+      assert.equal(await columnDefault(), "false", "the column default is the fresh-schema value");
+      const filled = await postgresQuery<{ n: string }>(
+        "SELECT COUNT(*)::text AS n FROM run_history WHERE run_id LIKE 'run-filler-%' AND NOT scheduler_managed"
+      );
+      assert.equal(filled.rows[0]?.n, "0", "server rows are not touched");
+      const receipt = await postgresQuery<{ changed_rows: string; cursor: string; status: string }>(
+        "SELECT status, changed_rows::text AS changed_rows, cursor FROM storage_migration_ledger WHERE migration_id = $1",
+        [RUN_HISTORY_DEVICE_RUN_PROVENANCE_MIGRATION_ID]
+      );
+      const maxId = await postgresQuery<{ id: string }>("SELECT MAX(id)::text AS id FROM run_history");
+      assert.deepEqual(
+        { ...receipt.rows[0] },
+        { changed_rows: String(DEVICE_RUNS.size), cursor: maxId.rows[0]?.id, status: "complete" },
+        "the receipt counts the flipped rows and its cursor reached the last page"
+      );
+
+      // A row written without the column now defaults to false.
+      await postgresQuery(
+        `INSERT INTO run_history(connector_instance_id, connector_id, source_json, status, started_at, run_id)
+         VALUES ($1, $2, '{}'::jsonb, 'running', $3, 'run-after-default-fix')`,
+        [DEVICE_INSTANCE, CONNECTOR_ID, NOW]
+      );
+      const written = await postgresQuery<{ scheduler_managed: boolean }>(
+        "SELECT scheduler_managed FROM run_history WHERE run_id = 'run-after-default-fix'"
+      );
+      assert.equal(written.rows[0]?.scheduler_managed, false);
+
+      // The receipt retires the pass on the next boot.
+      await postgresQuery("UPDATE run_history SET scheduler_managed = true");
+      await closePostgresStorage();
+      await initPostgresStorage({ backend: "postgres", databaseUrl: url });
+      const rerun = await postgresQuery<{ n: string }>(
+        "SELECT COUNT(*)::text AS n FROM run_history WHERE NOT scheduler_managed"
+      );
+      assert.equal(rerun.rows[0]?.n, "0", "a boot with a COMPLETE receipt does not rerun the pass");
+      assert.equal(await columnDefault(), "false", "the default stays repaired across boots");
+    }
+  );
+});

From 3626036f5ee0531dea819371811cdfa868b24630 Mon Sep 17 00:00:00 2001
From: Tim Nunamaker <tnunamak@gmail.com>
Date: Fri, 23 Oct 2026 07:31:36 -0500
Subject: [PATCH 78/87] fix(reference): keep fresh SQLite schemas
 deterministic; register the migration test

The SQLite device-run provenance repair wrote its ledger receipt on every
fresh database, with a boot-time timestamp. A restored schema snapshot then
no longer equalled a freshly initialized schema, which failed the memory
snapshot tests. The repair now returns early when run_history is empty;
the first boot that finds rows runs it and records the receipt.

Also: register run-history-device-run-provenance-migration.test.ts as
cold-required (39 entries; report total 196), add scheduler_managed to the
hand-built run_history in the spine seam test now that the spine writers
set it explicitly, and record the in-flight-run limit of the Postgres
repair in the design note.

Signed-off-by: Tim Nunamaker <tnunamak@gmail.com>
Assisted-by: AI
---
 PG-PROFILE-51-REPORT.md                                   | 2 +-
 docs/261021-local-device-coverage-evidence.md             | 2 +-
 .../scripts/postgres-template-eligibility.ts              | 1 +
 .../scripts/run-tests-resource-policy.test.ts             | 4 ++--
 reference-implementation/server/db.ts                     | 8 ++++++++
 .../test/terminal-run-commit-store.test.ts                | 2 +-
 6 files changed, 14 insertions(+), 5 deletions(-)

diff --git a/PG-PROFILE-51-REPORT.md b/PG-PROFILE-51-REPORT.md
index 293619b67..d03dee4d9 100644
--- a/PG-PROFILE-51-REPORT.md
+++ b/PG-PROFILE-51-REPORT.md
@@ -168,7 +168,7 @@ tail:
 
 The completed profile receipt recorded 1,034 files; that historical receipt
 is unchanged. The template equivalence registry is a different measure:
-157 eligible plus 38 cold-required files, for **195** total. The
+157 eligible plus 39 cold-required files, for **196** total. The
 handle-generation, issuance-cutover, opaque-cursor and search-index repair
 tests remain registered. These counts are recomputed from the merged registry arrays.
 
diff --git a/docs/261021-local-device-coverage-evidence.md b/docs/261021-local-device-coverage-evidence.md
index fd4f44b66..9244b50ce 100644
--- a/docs/261021-local-device-coverage-evidence.md
+++ b/docs/261021-local-device-coverage-evidence.md
@@ -88,7 +88,7 @@ The spec gate amended the ordering decision. Two orders exist, and each controls
 
 No wall clock takes part in either.
 
-Placement makes cross-runtime execution impossible for every connection that can hold a positive: shared admission refuses `local_device` runs (`reference-implementation/server/stores/connector-instance-store.ts:1238`), and startup enrollment filters them out (`reference-implementation/server/index.ts:9678`). Terminal collection checks the source kind with the same shared predicate (`reference-implementation/operations/local-device-terminal-collection.ts:456`, called by the v2 path at line 240) and stores an ineligibility reason. The stored reason is not the authority, because earlier terminals carry none and a connection can change source kind after it commits. Device terminal facts count only while the connection is `local_device` now: the run selector drops device terminal runs that carry a collection revision or the stored marker (`reference-implementation/server/ref-control.ts:2892`; a device terminal stored before collection revisions carries neither, and `run_history` does not record the event's `actor_type`, so the selector cannot yet recognize it: open), the stream-facts fold refuses `local_device` events for any other current source kind (`reference-implementation/server/connector-summary-read-model.ts:1952`), and an evidence repair that sees the source kind change clears and replays the fold cache (`reference-implementation/server/connector-summary-evidence-engine.ts:3630`). A fold writes only while the evidence row still records the source kind it started under (`reference-implementation/server/connector-summary-read-model.ts:1466`, `:1578`). The fence compares the evidence row's cached kind, not `connector_instances` directly: a fold begun before an evidence repair records a changed kind cannot publish after that repair. A change made only to `connector_instances` (the boot migrations in `db.ts` and `postgres-storage.ts`) is caught by the next evidence repair, which sees the mismatch and clears and replays the cache. A cache folded under an older fold version is read as unobserved until a replay rebuilds it (`reference-implementation/server/connector-summary-read-model.ts:779`, `:889`); the first replay after a deploy is the maintenance sweep, so every connection reads unknown until it runs. An exact replay of a terminal commit still returns its stored receipt; the receipt grants no coverage. Device-enrolled `browser_collector` connections remain server-schedulable. Their records and terminal reports are stored, but the device's store claims stay unknown because a server-scheduled run of that same connection has no device run-order marker to retire a positive; cross-runtime retirement for `browser_collector` is a gap.
+Placement makes cross-runtime execution impossible for every connection that can hold a positive: shared admission refuses `local_device` runs (`reference-implementation/server/stores/connector-instance-store.ts:1238`), and startup enrollment filters them out (`reference-implementation/server/index.ts:9678`). Terminal collection checks the source kind with the same shared predicate (`reference-implementation/operations/local-device-terminal-collection.ts:456`, called by the v2 path at line 240) and stores an ineligibility reason. The stored reason is not the authority, because earlier terminals carry none and a connection can change source kind after it commits. Device terminal facts count only while the connection is `local_device` now: the run selector drops device terminal runs that carry a collection revision or the stored marker (`reference-implementation/server/ref-control.ts:2892`; a device terminal stored before collection revisions carries neither, and `run_history` does not record the event's `actor_type`, so the selector cannot yet recognize it: open), the stream-facts fold refuses `local_device` events for any other current source kind (`reference-implementation/server/connector-summary-read-model.ts:1952`), and an evidence repair that sees the source kind change clears and replays the fold cache (`reference-implementation/server/connector-summary-evidence-engine.ts:3630`). A fold writes only while the evidence row still records the source kind it started under (`reference-implementation/server/connector-summary-read-model.ts:1466`, `:1578`). The fence compares the evidence row's cached kind, not `connector_instances` directly: a fold begun before an evidence repair records a changed kind cannot publish after that repair. A change made only to `connector_instances` (the boot migrations in `db.ts` and `postgres-storage.ts`) is caught by the next evidence repair, which sees the mismatch and clears and replays the cache. A cache folded under an older fold version is read as unobserved until a replay rebuilds it (`reference-implementation/server/connector-summary-read-model.ts:779`, `:889`); the first replay after a deploy is the maintenance sweep, so every connection reads unknown until it runs. An exact replay of a terminal commit still returns its stored receipt; the receipt grants no coverage. Databases that gained `run_history.scheduler_managed` through the old `ADD COLUMN ... DEFAULT true` migration stamped every spine-written row TRUE, device runs included, so proof eligibility uses the collection-revision stamp, not that flag. A one-time boot repair (`run_history_device_run_provenance_v1`) sets the flag false on rows whose run has a `local_device` event for the same connection, and the spine writers now write it explicitly. Known limit: a device run still in progress when the Postgres repair passes its page keeps TRUE after it finishes; recording run provenance in `run_history` (follow-up PR) closes it. Device-enrolled `browser_collector` connections remain server-schedulable. Their records and terminal reports are stored, but the device's store claims stay unknown because a server-scheduled run of that same connection has no device run-order marker to retire a positive; cross-runtime retirement for `browser_collector` is a gap.
 
 Sequence issuance. The runtime already contacts the server before it scans: a "starting" heartbeat, the pre-scan drain, and the state read, which names the connection. None of these can carry the issuance. The heartbeat is a best-effort liveness signal that names no run, and the state read is a GET, which must stay free of side effects. The runtime therefore makes one new idempotent call at the same point, after the state read and before the scan: `POST .../source-instances/{source}/run-starts` with the run id. The server resolves the authenticated device, source and connection the same way as the terminal route. In one transaction that holds the connection row lock, it increments `connector_instances.run_sequence_issued` and stores `(connector_instance_id, run_id) -> (run_sequence, storage_epoch, device_id, source_instance_id)` in `collection_run_sequences`. An exact replay of the same run id from the same device and source returns the stored sequence (200). The same run id from another device or source is `409 run_start_conflict`. The runtime keeps the run id it registered and uses it for the run's terminal record. A server without the route (404), or a failed call, leaves the run without a sequence. The run still collects and commits its terminal record, but that record can never be an eligible positive proof.
 
diff --git a/reference-implementation/scripts/postgres-template-eligibility.ts b/reference-implementation/scripts/postgres-template-eligibility.ts
index 4747a21ed..0c75befdf 100644
--- a/reference-implementation/scripts/postgres-template-eligibility.ts
+++ b/reference-implementation/scripts/postgres-template-eligibility.ts
@@ -243,6 +243,7 @@ export const POSTGRES_TEMPLATE_COLD_REQUIRED_FILES: readonly string[] = [
   "test/records-instance-stream-id-keyset-index.test.ts",
   "test/rs-opaque-cursors.test.ts",
   "test/run-history-completed-at-fleet-migration.test.ts",
+  "test/run-history-device-run-provenance-migration.test.ts",
   "test/run-history-duplicate-run-id-identity.test.ts",
   "test/run-history-interrupted-migration-reconciliation.test.ts",
   "test/run-history-writer-authority.test.ts",
diff --git a/reference-implementation/scripts/run-tests-resource-policy.test.ts b/reference-implementation/scripts/run-tests-resource-policy.test.ts
index 55bb1b41c..3fc0114ca 100644
--- a/reference-implementation/scripts/run-tests-resource-policy.test.ts
+++ b/reference-implementation/scripts/run-tests-resource-policy.test.ts
@@ -33,8 +33,8 @@ test("only reviewed files bypass outer allocation; restore remains separate", ()
   assert.equal(isDedicatedPostgresTestDatabaseName(restoreName), true);
 });
 
-test("all 38 cold-required entries remain cold, including helper-owned bootstrap", () => {
-  assert.equal(POSTGRES_TEMPLATE_COLD_REQUIRED_FILES.length, 38);
+test("all 39 cold-required entries remain cold, including helper-owned bootstrap", () => {
+  assert.equal(POSTGRES_TEMPLATE_COLD_REQUIRED_FILES.length, 39);
   for (const file of POSTGRES_TEMPLATE_COLD_REQUIRED_FILES) {
     assert.equal(isPostgresTemplateEligibleFilePath(file), false, file);
   }
diff --git a/reference-implementation/server/db.ts b/reference-implementation/server/db.ts
index cf9b8f2d9..be837099e 100644
--- a/reference-implementation/server/db.ts
+++ b/reference-implementation/server/db.ts
@@ -6064,6 +6064,14 @@ function migrateRunHistoryDeviceRunProvenance(raw: SqliteDatabase): void {
   if (receipt) {
     return;
   }
+  // A database with no run history has nothing to repair, and every writer now
+  // stamps the column explicitly. Writing a receipt here would put a boot-time
+  // timestamp into every fresh schema, so a restored schema snapshot would no
+  // longer equal a freshly initialized one. The first boot that finds rows
+  // runs the repair and records the receipt.
+  if (!raw.prepare("SELECT 1 FROM run_history LIMIT 1").get()) {
+    return;
+  }
   raw.transaction(() => {
     const result = raw
       .prepare(
diff --git a/reference-implementation/test/terminal-run-commit-store.test.ts b/reference-implementation/test/terminal-run-commit-store.test.ts
index bb4e49910..fe3a32686 100644
--- a/reference-implementation/test/terminal-run-commit-store.test.ts
+++ b/reference-implementation/test/terminal-run-commit-store.test.ts
@@ -269,7 +269,7 @@ test("SQLite transaction-aware spine seam uses only the supplied handle", () =>
         status TEXT NOT NULL, known_gaps_json TEXT NOT NULL, started_at TEXT NOT NULL,
         completed_at TEXT, records_emitted INTEGER NOT NULL DEFAULT 0,
         connector_error_json TEXT, failure_reason TEXT, terminal_reason TEXT,
-        facts_json TEXT, attempt INTEGER NOT NULL
+        facts_json TEXT, attempt INTEGER NOT NULL, scheduler_managed INTEGER NOT NULL DEFAULT 0
       );
       CREATE UNIQUE INDEX run_history_identity ON run_history(run_id, connector_instance_id) WHERE run_id IS NOT NULL;
     `);

From 14d71bd43c676784252b8e9c953b9cce8d44a929 Mon Sep 17 00:00:00 2001
From: Tim Nunamaker <tnunamak@gmail.com>
Date: Fri, 23 Oct 2026 07:51:30 -0500
Subject: [PATCH 79/87] test(reference): name the Postgres skip reason in the
 provenance migration test

The RI runner's test accounting rejects a skip with no reason. The Postgres
test used `skip: !POSTGRES_URL`, a boolean, so in the SQLite lane the file
reported an unexplained skip and failed shard 2 ("accounting error in
test/run-history-device-run-provenance-migration.test.ts: unexplained-skip").
The skip now carries the reason "PDPP_TEST_POSTGRES_URL unset", as the
other Postgres twins in this PR do. Reproduced with the accounting reporter
and structuredNodeSummary: the boolean form throws, the named form
accounts one skip with its reason.

Signed-off-by: Tim Nunamaker <tnunamak@gmail.com>
Assisted-by: AI
---
 .../test/run-history-device-run-provenance-migration.test.ts    | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/reference-implementation/test/run-history-device-run-provenance-migration.test.ts b/reference-implementation/test/run-history-device-run-provenance-migration.test.ts
index 4d6a6afd3..296364fee 100644
--- a/reference-implementation/test/run-history-device-run-provenance-migration.test.ts
+++ b/reference-implementation/test/run-history-device-run-provenance-migration.test.ts
@@ -206,7 +206,7 @@ test("SQLite: the migration flips device runs only, is ledgered, and the spine w
 let tempDbCounter = 0;
 
 test("PostgreSQL: the boot migration repairs the column default and device rows, pages, and is ledgered", {
-  skip: !POSTGRES_URL,
+  skip: POSTGRES_URL ? false : "PDPP_TEST_POSTGRES_URL unset",
 }, async () => {
   assert.ok(POSTGRES_URL, "Postgres URL is configured when this test runs");
   tempDbCounter += 1;

From 45116f90fa2dc8e6be7c6f8e9fb88c4fe3df3a8f Mon Sep 17 00:00:00 2001
From: Tim Nunamaker <tnunamak@gmail.com>
Date: Fri, 23 Oct 2026 11:48:06 -0500
Subject: [PATCH 80/87] fix(coverage): accept bounded terminal scope misses

A bounded run can lose its terminal state update when one stream cannot enforce the requested boundary. Accept the terminal commit and preserve its store statuses, but mark collected data from that stream unknown so it cannot prove complete coverage or inherit completeness from a parent stream. A sibling with a positive scope assertion can still prove complete coverage, and partial or failed stores remain visible.

The route-level regression test confirms that a mixed verdict is accepted, advances saved state, and replays without a second revision; it also reports the stream without a positive scope assertion as unknown and the positively scoped sibling as complete. A second case confirms that partial and failed stores remain partial and gaps.

Assisted-by: AI
Signed-off-by: Tim Nunamaker <tnunamak@gmail.com>
---
 .../local-device-terminal-collection.ts       |   5 +-
 .../server/ref-control.ts                     |  45 ++++--
 ...device-coverage-revision-atomicity.test.ts | 146 ++++++++++++++++--
 ...vice-terminal-run-commit-operation.test.ts |  87 ++++++++++-
 4 files changed, 259 insertions(+), 24 deletions(-)

diff --git a/reference-implementation/operations/local-device-terminal-collection.ts b/reference-implementation/operations/local-device-terminal-collection.ts
index 110245657..bee0b61d4 100644
--- a/reference-implementation/operations/local-device-terminal-collection.ts
+++ b/reference-implementation/operations/local-device-terminal-collection.ts
@@ -537,7 +537,7 @@ function normalizeTerminalRunRecordFacts(
 export function normalizeTerminalCoverageFacts(
   rawFacts: readonly unknown[],
   rawManifest: unknown,
-  collectionBoundary: string,
+  _collectionBoundary: string,
   options: {
     allowSubset?: boolean;
     bindingGeneration?: number | null;
@@ -625,8 +625,7 @@ export function normalizeTerminalCoverageFacts(
       seen.has(stream) ||
       typeof entry.scoped !== "boolean" ||
       !Array.isArray(rawStores) ||
-      rawStores.length !== expected.size ||
-      (collectionBoundary !== "unscoped" && entry.scoped !== true)
+      rawStores.length !== expected.size
     ) {
       return null;
     }
diff --git a/reference-implementation/server/ref-control.ts b/reference-implementation/server/ref-control.ts
index 19e5f7b1f..bb806788f 100644
--- a/reference-implementation/server/ref-control.ts
+++ b/reference-implementation/server/ref-control.ts
@@ -3993,12 +3993,23 @@ export function buildCollectionReport(input: {
       schedule: input.schedule ?? null,
     })
   );
-  return inheritStateStreamCoverageCondition(entries, entryIndexes.manifestByStream, {
-    attentionOpen: input.attentionOpen,
-    freshness: input.freshness,
-    refresh: input.refresh,
-    schedule: input.schedule ?? null,
-  }).sort((a, b) => a.stream.localeCompare(b.stream));
+  const scopedFalseStreams = new Set(
+    (input.localCoverage?.rows ?? [])
+      .filter((row) => row.scoped === false)
+      .map((row) => row.stream)
+      .filter((stream): stream is string => typeof stream === "string" && stream.length > 0)
+  );
+  return inheritStateStreamCoverageCondition(
+    entries,
+    entryIndexes.manifestByStream,
+    {
+      attentionOpen: input.attentionOpen,
+      freshness: input.freshness,
+      refresh: input.refresh,
+      schedule: input.schedule ?? null,
+    },
+    scopedFalseStreams
+  ).sort((a, b) => a.stream.localeCompare(b.stream));
 }
 
 /**
@@ -4042,11 +4053,12 @@ function inheritStateStreamCoverageCondition(
     readonly freshness: FreshnessAxis;
     readonly refresh: ConnectionRefreshEvidence | null;
     readonly schedule?: { readonly enabled: boolean } | null;
-  }
+  },
+  scopedFalseStreams: ReadonlySet<string>
 ): CollectionReportEntry[] {
   const entryByStream = new Map(entries.map((entry) => [entry.stream, entry] as const));
   return entries.map((entry) => {
-    if (entry.coverage_condition !== "unknown") {
+    if (entry.coverage_condition !== "unknown" || scopedFalseStreams.has(entry.stream)) {
       return entry;
     }
     const parentStream = localCoverageParentStream(manifestByStream.get(entry.stream));
@@ -4816,6 +4828,7 @@ interface LocalCoverageDiagnosticRow {
   readonly status?: unknown;
   readonly store?: unknown;
   readonly stream?: unknown;
+  readonly scoped?: unknown;
 }
 
 interface LocalCoverageDiagnosticAxis {
@@ -5155,7 +5168,7 @@ function deriveLocalTerminalCoverageAxis(
   let axis: CoverageAxis = normalized.length === manifest.streams?.length ? "complete" : "unknown";
   for (const rawFact of normalized) {
     const stream = rawFact.stream as string;
-    if (rawFact.scoped !== true) {
+    if (rawFact.scoped !== true && terminal.collectionScope === "unscoped") {
       return unknown;
     }
     let storeIndex = 0;
@@ -5163,10 +5176,20 @@ function deriveLocalTerminalCoverageAxis(
       store: string;
       status: string;
     }[]) {
-      const status = (rawFact.coverage_statuses as string[])[storeIndex] ?? "unknown";
+      const assertedStatus = (rawFact.coverage_statuses as string[])[storeIndex] ?? "unknown";
       storeIndex += 1;
+      const status =
+        rawFact.scoped !== true && (assertedStatus === "collected" || assertedStatus === "inventory_only")
+          ? "unknown"
+          : assertedStatus;
       const rawStore = { ...assertion, status };
-      rows.push({ collection_scope: terminal.collectionScope, status: rawStore.status, store: rawStore.store, stream });
+      rows.push({
+        collection_scope: terminal.collectionScope,
+        scoped: rawFact.scoped,
+        status: rawStore.status,
+        store: rawStore.store,
+        stream,
+      });
       if (rawStore.status !== "collected") {
         unaccountedStores.push(rawStore.store);
       }
diff --git a/reference-implementation/test/local-device-coverage-revision-atomicity.test.ts b/reference-implementation/test/local-device-coverage-revision-atomicity.test.ts
index fbe1788bb..7fa22bcca 100644
--- a/reference-implementation/test/local-device-coverage-revision-atomicity.test.ts
+++ b/reference-implementation/test/local-device-coverage-revision-atomicity.test.ts
@@ -69,8 +69,18 @@ const PROFILE = {
   protocol_capabilities: ["RUN_COVERAGE_V1"],
   protocol_version: "0.2.0",
   streams: [
-    { coverage_stores: ["projects"], name: "sessions", primary_key: ["id"] },
-    { coverage_stores: ["derived_messages"], name: "messages", primary_key: ["id"] },
+    {
+      coverage_stores: ["projects"],
+      coverage_strategy: "checkpoint_window",
+      name: "sessions",
+      primary_key: ["id"],
+    },
+    {
+      coverage_stores: ["derived_messages"],
+      coverage_strategy: "checkpoint_window",
+      name: "messages",
+      primary_key: ["id"],
+    },
   ],
   version: "0.0.0-revision-atomicity",
 };
@@ -108,6 +118,19 @@ interface HighWater {
   readonly runId: string | null;
 }
 
+type ProducerRunCoverageVerdict = {
+  readonly collection_scope: string;
+  readonly streams: readonly {
+    readonly scoped: boolean;
+    readonly stores: readonly {
+      readonly status: "collected" | "partial" | "unavailable" | "failed";
+      readonly store: string;
+    }[];
+    readonly stream: string;
+  }[];
+  readonly version: 1;
+};
+
 type TerminalCommit = Parameters<typeof commitTerminalRun>[0];
 
 function testName(backend: Backend, name: string): string {
@@ -211,7 +234,11 @@ async function registerFixtureManifest(lane: Lane): Promise<void> {
   const streams = PROFILE.streams.map((release) => {
     const declared = catalog.streams.find((stream) => stream.name === release.name);
     assert.ok(declared, `the catalog declares ${release.name}`);
-    return { ...declared, coverage_stores: release.coverage_stores };
+    return {
+      ...declared,
+      coverage_stores: release.coverage_stores,
+      coverage_strategy: release.coverage_strategy,
+    };
   });
   await sql(
     lane,
@@ -1323,15 +1350,32 @@ function postRunStart(lane: Lane, runId: string): Promise<JsonResponse> {
 async function terminalWireBody(
   lane: Lane,
   runId: string,
-  stateDelta: Record<string, unknown> = {}
+  stateDelta: Record<string, unknown> = {},
+  coverageForScope?: (collectionScope: string) => ProducerRunCoverageVerdict
 ): Promise<Record<string, unknown>> {
   const diagnostics = await readCommittedLocalCoverageDiagnostics({
     connector_id: CONNECTOR_ID,
     connector_instance_id: lane.enrolled.connector_instance_id,
   });
   assert.ok("declaredCollectionScope" in diagnostics, "the connection declares its collection boundary");
-  const fact = (stream: string, store: string) => ({
+  const [instance] = await sql(
+    lane,
+    "SELECT manifest_generation FROM connector_instances WHERE connector_instance_id = ?",
+    "SELECT manifest_generation::integer AS manifest_generation FROM connector_instances WHERE connector_instance_id = $1",
+    [lane.enrolled.connector_instance_id]
+  );
+  const coverage = coverageForScope?.(diagnostics.declaredCollectionScope) ?? {
+    collection_scope: diagnostics.declaredCollectionScope,
+    streams: [
+      { scoped: true, stores: [{ status: "collected", store: "derived_messages" }], stream: "messages" },
+      { scoped: true, stores: [{ status: "collected", store: "projects" }], stream: "sessions" },
+    ],
+    version: 1,
+  } satisfies ProducerRunCoverageVerdict;
+  assert.equal(coverage.collection_scope, diagnostics.declaredCollectionScope);
+  const fact = (stream: ProducerRunCoverageVerdict["streams"][number]) => ({
     artifact_digest: ARTIFACT_DIGEST,
+    binding_generation: Number(instance?.manifest_generation),
     manifest_fingerprint: fingerprintDeviceAttemptManifest(PROFILE),
     runtime_accounting: {
       checkpoint_eligible: true,
@@ -1340,9 +1384,10 @@ async function terminalWireBody(
       outstanding_debt: 0,
       stream_evidence_consistent: true,
     },
-    scoped: true,
-    stores: [{ status: "collected", store }],
-    stream,
+    server_artifact_digest: ARTIFACT_DIGEST,
+    scoped: stream.scoped,
+    stores: stream.stores,
+    stream: stream.stream,
   });
   return {
     collection_boundary: diagnostics.declaredCollectionScope,
@@ -1353,7 +1398,7 @@ async function terminalWireBody(
     run_id: runId,
     source_instance_id: lane.enrolled.source_instance_id,
     state_delta: stateDelta,
-    terminal_facts: [fact("messages", "derived_messages"), fact("sessions", "projects")],
+    terminal_facts: coverage.streams.map(fact),
     version: 2,
   };
 }
@@ -1362,6 +1407,89 @@ function postTerminal(lane: Lane, body: Record<string, unknown>): Promise<JsonRe
   return postJson(sourceUrl(lane, "/terminal-run-commits"), body, authHeaders(lane));
 }
 
+laneTest("bounded terminal: scoped false commits state without positive coverage for that stream", async (lane) => {
+  const runId = "run-bounded-unscoped-stream";
+  assert.equal((await postRunStart(lane, runId)).status, 201);
+  await markDrained(lane);
+  const body = await terminalWireBody(
+    lane,
+    runId,
+    { sessions: { cursor: "bounded-cursor" } },
+    (collectionScope) => ({
+      collection_scope: collectionScope,
+      streams: [
+        { scoped: false, stores: [{ status: "collected", store: "derived_messages" }], stream: "messages" },
+        { scoped: true, stores: [{ status: "collected", store: "projects" }], stream: "sessions" },
+      ],
+      version: 1,
+    })
+  );
+  assert.notEqual(body.collection_boundary, "unscoped", "the fixture exercises a bounded run");
+
+  const committed = await postTerminal(lane, body);
+  assert.equal(committed.status, 201, JSON.stringify(committed.body));
+  assert.equal(await sessionsCursor(lane), "bounded-cursor", "the accepted terminal commit advances state");
+  const [storedRun] = await sql(
+    lane,
+    "SELECT facts_json FROM run_history WHERE run_id = ?",
+    "SELECT facts_json::text AS facts_json FROM run_history WHERE run_id = $1",
+    [runId]
+  );
+  assert.ok(storedRun, "the server stores the terminal run");
+  const storedFacts = JSON.parse(String(storedRun.facts_json)) as {
+    collection_facts?: { streams?: { scoped?: unknown; stream?: unknown }[] };
+  };
+  assert.deepEqual(
+    storedFacts.collection_facts?.streams?.map(({ stream, scoped }) => [stream, scoped]),
+    [
+      ["messages", false],
+      ["sessions", true],
+    ],
+    "the committed terminal keeps each producer scope assertion"
+  );
+  assert.deepEqual(
+    await reportedConditions(lane),
+    { messages: "unknown", sessions: "complete" },
+    JSON.stringify(await projection(lane))
+  );
+  assert.notEqual(
+    (await projection(lane)).axis,
+    "complete",
+    "a stream without a positive scope assertion cannot make the run positive"
+  );
+
+  const beforeReplay = await highWater(lane);
+  const replay = await postTerminal(lane, body);
+  assert.equal(replay.status, 200, JSON.stringify(replay.body));
+  assert.equal(await sessionsCursor(lane), "bounded-cursor", "an exact replay leaves state unchanged");
+  assert.deepEqual(await highWater(lane), beforeReplay, "an exact replay does not advance the revision");
+});
+
+laneTest("bounded terminal: scoped false preserves partial and failed store statuses", async (lane) => {
+  const runId = "run-bounded-negative-unscoped-streams";
+  assert.equal((await postRunStart(lane, runId)).status, 201);
+  await markDrained(lane);
+  const body = await terminalWireBody(
+    lane,
+    runId,
+    { sessions: { cursor: "negative-cursor" } },
+    (collectionScope) => ({
+      collection_scope: collectionScope,
+      streams: [
+        { scoped: false, stores: [{ status: "partial", store: "derived_messages" }], stream: "messages" },
+        { scoped: false, stores: [{ status: "failed", store: "projects" }], stream: "sessions" },
+      ],
+      version: 1,
+    })
+  );
+  assert.notEqual(body.collection_boundary, "unscoped", "the fixture exercises a bounded run");
+
+  const committed = await postTerminal(lane, body);
+  assert.equal(committed.status, 201, JSON.stringify(committed.body));
+  assert.equal(await sessionsCursor(lane), "negative-cursor", "negative coverage does not block state commit");
+  assert.deepEqual(await reportedConditions(lane), { messages: "partial", sessions: "gaps" });
+});
+
 laneTest(
   "run order: an older run's proof that arrives after a newer run's terminal record stays history",
   async (lane) => {
diff --git a/reference-implementation/test/local-device-terminal-run-commit-operation.test.ts b/reference-implementation/test/local-device-terminal-run-commit-operation.test.ts
index 529e70fb8..d8ce2ee91 100644
--- a/reference-implementation/test/local-device-terminal-run-commit-operation.test.ts
+++ b/reference-implementation/test/local-device-terminal-run-commit-operation.test.ts
@@ -241,7 +241,40 @@ test("typed terminal coverage is green only for complete scoped store evidence",
     ),
     null
   );
-  assert.equal(normalizeTerminalCoverageFacts([fact(["collected", "collected"], false)], manifest, "bounded"), null);
+  const boundedVerdict = {
+    collection_scope: "bounded",
+    streams: [
+      {
+        scoped: false,
+        stores: [
+          { status: "collected", store: "messages" },
+          { status: "collected", store: "history" },
+        ],
+        stream: "messages",
+      },
+    ],
+    version: 1,
+  } as const;
+  const boundedFacts = boundedVerdict.streams.map((stream) => ({
+    ...fact(["collected", "collected"]),
+    scoped: stream.scoped,
+    stores: stream.stores,
+    stream: stream.stream,
+  }));
+  assert.equal(
+    normalizeTerminalCoverageFacts(boundedFacts, manifest, boundedVerdict.collection_scope)?.length,
+    1,
+    "a bounded producer verdict without a positive scope assertion remains admissible"
+  );
+  assert.equal(
+    normalizeTerminalCoverageFacts(
+      [{ ...boundedFacts[0], scoped: "false" }],
+      manifest,
+      boundedVerdict.collection_scope
+    ),
+    null,
+    "a malformed non-boolean scope assertion remains invalid"
+  );
 });
 
 test("a selected-stream terminal commit is accepted without proving omitted manifest streams", () => {
@@ -256,6 +289,58 @@ test("a selected-stream terminal commit is accepted without proving omitted mani
   assert.equal(normalizeTerminalCoverageFacts(selected, manifest, "unscoped", { allowSubset: true })?.length, 1);
 });
 
+test("a bounded producer verdict allows positive coverage only for scoped streams", () => {
+  const manifest = {
+    streams: [
+      { coverage_stores: ["messages", "history"], coverage_strategy: "checkpoint_window", name: "messages" },
+      { coverage_stores: ["projects"], coverage_strategy: "checkpoint_window", name: "sessions" },
+    ],
+  } as const;
+  const artifactDigest = `sha256:${"b".repeat(64)}`;
+  const verdict = {
+    collection_scope: "bounded",
+    streams: [
+      {
+        scoped: false,
+        stores: [
+          { status: "collected", store: "messages" },
+          { status: "collected", store: "history" },
+        ],
+        stream: "messages",
+      },
+      { scoped: true, stores: [{ status: "collected", store: "projects" }], stream: "sessions" },
+    ],
+    version: 1,
+  } as const;
+  const facts = verdict.streams.map((stream) => ({
+    artifact_digest: artifactDigest,
+    manifest_fingerprint: fingerprintDeviceAttemptManifest(manifest),
+    runtime_accounting: {
+      checkpoint_eligible: true,
+      detail_complete: true,
+      durable_admission: true,
+      outstanding_debt: 0,
+      stream_evidence_consistent: true,
+    },
+    scoped: stream.scoped,
+    stores: stream.stores,
+    stream: stream.stream,
+  }));
+  const normalized = normalizeTerminalCoverageFacts(facts, manifest, verdict.collection_scope, {
+    expectedArtifactDigest: artifactDigest,
+  });
+  assert.ok(normalized);
+  const conditions = Object.fromEntries(
+    normalized.map((raw) => {
+      const fact = readRuntimeCollectionFact(raw);
+      assert.ok(fact);
+      const stream = manifest.streams.find((entry) => entry.name === fact.stream);
+      return [fact.stream, deriveStreamCoverageCondition(fact, stream)];
+    })
+  );
+  assert.deepEqual(conditions, { messages: "unknown", sessions: "complete" });
+});
+
 test("terminal run commit resolves authorization before receipt lookup and passes canonical binding", async () => {
   const capture = responseCapture();
   let authorized = false;

From 2b2cafc278794add30e2090e3ecd5d7f66733f98 Mon Sep 17 00:00:00 2001
From: Tim Nunamaker <tnunamak@gmail.com>
Date: Fri, 23 Oct 2026 11:39:38 -0500
Subject: [PATCH 81/87] fix(reference): fence local-device coverage by current
 source kind

Compare cached evidence with the canonical connection kind before projecting facts, and fence both fold writes against the canonical kind.

Signed-off-by: Tim Nunamaker <tnunamak@gmail.com>
Assisted-by: AI
---
 .../server/connector-summary-read-model.ts    |  76 ++++++---
 ...device-coverage-revision-atomicity.test.ts | 147 ++++++++++++++++++
 2 files changed, 200 insertions(+), 23 deletions(-)

diff --git a/reference-implementation/server/connector-summary-read-model.ts b/reference-implementation/server/connector-summary-read-model.ts
index 0b19bcf98..a1b225e02 100644
--- a/reference-implementation/server/connector-summary-read-model.ts
+++ b/reference-implementation/server/connector-summary-read-model.ts
@@ -135,6 +135,9 @@ const REASON_CODES = {
   // A source-attributed terminal event without a matching durable generation
   // is historical, never an empty/current fold result.
   TERMINAL_FACTS_HISTORICAL: "terminal_facts_historical",
+  // The cached terminal was folded under a different source kind than the
+  // current connector instance, so this read cannot treat it as evidence.
+  SOURCE_KIND_MISMATCH: "source_kind_mismatch",
   // A bounded replay lost its CAS race on every attempt. The route receives
   // an in-memory stale overlay instead of trusting the competing durable map.
   TERMINAL_FOLD_CONTENTION: "terminal_fold_contention",
@@ -244,6 +247,16 @@ export function normalizeSourceEventSeq(sourceEventSeq: unknown): number | null
 }
 
 // ---------------------------------------------------------------------------
+/** Attach the canonical connection kind to a shaped evidence-row query. */
+function withCanonicalSourceKind(query: string): string {
+  return `SELECT evidence.*, instance.connector_instance_id AS canonical_connector_instance_id,
+                 instance.source_kind AS canonical_source_kind
+            FROM (${query}) AS evidence
+            LEFT JOIN connector_instances AS instance
+              ON instance.connector_instance_id = evidence.connector_instance_id
+            ORDER BY evidence.connector_instance_id ASC`;
+}
+
 function createConnectorSummaryStore() {
   if (isPostgresStorageBackend()) {
     return {
@@ -310,7 +323,8 @@ function createConnectorSummaryStore() {
           where = `WHERE connector_instance_id = ANY($${params.length}::text[])`;
         }
         const result = await postgresQuery(
-          `SELECT connector_instance_id, connector_id, display_name, status, source_kind,
+          withCanonicalSourceKind(
+            `SELECT connector_instance_id, connector_id, display_name, status, source_kind,
                   revoked_at, total_records, stream_count, last_record_updated_at,
                   stream_records_json, retained_bytes_json, total_retained_bytes,
                   record_checkpoint_json, manifest_fingerprint,
@@ -325,8 +339,8 @@ function createConnectorSummaryStore() {
                   manifest_generation, schedule_checkpoint, run_lifecycle_event_seq,
                   list_summary_projection_reason_code
              FROM connector_summary_evidence
-             ${where}
-             ORDER BY connector_instance_id ASC`,
+             ${where}`
+          ),
           params
         );
         return result.rows;
@@ -538,13 +552,11 @@ function createConnectorSummaryStore() {
                     CAST(source_revision AS TEXT) AS source_revision,
                     manifest_generation, schedule_checkpoint, run_lifecycle_event_seq,
                     list_summary_projection_reason_code`;
+      const selectEvidence = (where = "") =>
+        withCanonicalSourceKind(`SELECT ${columns} FROM connector_summary_evidence ${where}`);
       if (connectorInstanceId) {
         return db
-          .prepare(
-            `SELECT ${columns} FROM connector_summary_evidence
-              WHERE connector_instance_id = ?
-              ORDER BY connector_instance_id ASC`
-          )
+          .prepare(selectEvidence("WHERE connector_instance_id = ?"))
           .all(connectorInstanceId);
       }
       if (connectorInstanceIds) {
@@ -553,17 +565,11 @@ function createConnectorSummaryStore() {
         }
         const placeholders = connectorInstanceIds.map(() => "?").join(", ");
         return db
-          .prepare(
-            `SELECT ${columns} FROM connector_summary_evidence
-              WHERE connector_instance_id IN (${placeholders})
-              ORDER BY connector_instance_id ASC`
-          )
+          .prepare(selectEvidence(`WHERE connector_instance_id IN (${placeholders})`))
           .all(...connectorInstanceIds);
       }
       return [
-        ...iterateDynamicSqlAcknowledged<Row>(
-          `SELECT ${columns} FROM connector_summary_evidence ORDER BY connector_instance_id ASC`
-        ),
+        ...iterateDynamicSqlAcknowledged<Row>(selectEvidence()),
       ];
     },
     listPendingMaintenanceInstanceIds({ includeIncomplete, limit }: { includeIncomplete: boolean; limit: number }) {
@@ -763,8 +769,16 @@ async function bumpAllCanonicalEvidenceRevisions(): Promise<void> {
  * binary that actually wrote it, or any future binary at that version or
  * newer) still reads `terminal_facts_state` exactly as stored: `current`.
  */
-function shapeTerminalFacts(row: Row) {
+function shapeTerminalFacts(row: Row, sourceKindMatchesCanonical: boolean) {
   const eventSeq = row.stream_facts_event_seq === null ? null : Number(row.stream_facts_event_seq);
+  if (!sourceKindMatchesCanonical) {
+    return {
+      as_of: null,
+      event_seq: null,
+      reason_code: REASON_CODES.SOURCE_KIND_MISMATCH,
+      state: "unobserved",
+    };
+  }
   if (rowIsFoldLogicVersionAhead(row)) {
     return {
       as_of: row.computed_at || null,
@@ -848,6 +862,9 @@ function shapeSourceRevision(row: Row): {
 export function shapeEvidenceRow(row: Row) {
   const retainedBytesState = String(row.retained_bytes_state || "unobserved");
   const sourceRevision = shapeSourceRevision(row);
+  const sourceKindMatchesCanonical =
+    row.canonical_connector_instance_id === row.connector_instance_id &&
+    row.canonical_source_kind === row.source_kind;
   return {
     canonical_evidence_revision: String(row.canonical_evidence_revision ?? "0"),
     computed_at: row.computed_at || null,
@@ -886,11 +903,12 @@ export function shapeEvidenceRow(row: Row) {
     stream_count: Number(row.stream_count || 0),
     stream_facts_event_seq: row.stream_facts_event_seq === null ? null : Number(row.stream_facts_event_seq),
     // A cache folded under an older version credits no stream until replayed.
-    stream_latest_facts: rowIsFoldLogicVersionBehind(row)
-      ? null
-      : parseEvidenceJson(row.stream_latest_facts_json, null),
+    stream_latest_facts:
+      !sourceKindMatchesCanonical || rowIsFoldLogicVersionBehind(row)
+        ? null
+        : parseEvidenceJson(row.stream_latest_facts_json, null),
     stream_records: parseEvidenceJson(row.stream_records_json, []),
-    terminal_facts: shapeTerminalFacts(row),
+    terminal_facts: shapeTerminalFacts(row, sourceKindMatchesCanonical),
     total_records: Number(row.total_records || 0),
     total_retained_bytes: retainedBytesState === "current" ? Number(row.total_retained_bytes || 0) : null,
   };
@@ -1463,7 +1481,12 @@ function createStreamFactsFoldStore() {
             WHERE connector_instance_id = $1
               AND stream_facts_event_seq IS NOT DISTINCT FROM $4
               AND stream_facts_fold_version IS NOT DISTINCT FROM $8
-              AND source_kind IS NOT DISTINCT FROM $9`,
+              AND source_kind IS NOT DISTINCT FROM $9
+              AND EXISTS (
+                SELECT 1 FROM connector_instances
+                 WHERE connector_instance_id = $1
+                   AND source_kind IS NOT DISTINCT FROM $9
+              )`,
           [
             connectorInstanceId,
             factsJson,
@@ -1575,7 +1598,12 @@ function createStreamFactsFoldStore() {
             WHERE connector_instance_id = ?
               AND stream_facts_event_seq IS ?
               AND stream_facts_fold_version IS ?
-              AND source_kind IS ?`
+              AND source_kind IS ?
+              AND EXISTS (
+                SELECT 1 FROM connector_instances
+                 WHERE connector_instance_id = ?
+                   AND source_kind IS ?
+              )`
         )
         .run(
           factsJson,
@@ -1586,6 +1614,8 @@ function createStreamFactsFoldStore() {
           connectorInstanceId,
           baselineEventSeq,
           baselineFoldVersion,
+          baselineSourceKind,
+          connectorInstanceId,
           baselineSourceKind
         );
       return result.changes > 0;
diff --git a/reference-implementation/test/local-device-coverage-revision-atomicity.test.ts b/reference-implementation/test/local-device-coverage-revision-atomicity.test.ts
index 7fa22bcca..b66e6d2bd 100644
--- a/reference-implementation/test/local-device-coverage-revision-atomicity.test.ts
+++ b/reference-implementation/test/local-device-coverage-revision-atomicity.test.ts
@@ -1919,6 +1919,81 @@ laneTest(
   }
 );
 
+laneTest(
+  "source kind: current local-device evidence reads unknown after a canonical-only kind change before repair",
+  async (lane) => {
+    await commitProof(lane, "run-canonical-kind-changed");
+    await assertCovered(
+      lane,
+      "run-canonical-kind-changed",
+      "the local-device terminal initially covers the connection"
+    );
+    const id = lane.enrolled.connector_instance_id;
+    // Keep the evidence row clean and untouched: this is the read window before any repair or reconcile.
+    await sql(
+      lane,
+      "UPDATE connector_instances SET source_kind = 'account' WHERE connector_instance_id = ?",
+      "UPDATE connector_instances SET source_kind = 'account' WHERE connector_instance_id = $1",
+      [id]
+    );
+
+    const evidence = await getConnectorSummaryEvidence(id);
+    assert.ok(evidence, "the connection has shaped evidence");
+    const summary = (await listConnectorSummaries()).find((row) => row.connector_instance_id === id);
+    assert.ok(summary, "the list path projects the connection");
+    const detail = await getConnectorDetail(CONNECTOR_ID);
+    const detailHealth = detail.connection_health;
+    assert.ok(detailHealth, "the detail path projects connection health");
+    const diagnostics = await getOwnerConnectionDiagnostics(id);
+    assert.ok(diagnostics, "the diagnostics path projects the connection");
+
+    assert.deepEqual(
+      {
+        evidence: {
+          dirty: evidence.dirty,
+          sourceKind: evidence.source_kind,
+          streamFacts: evidence.stream_latest_facts,
+          terminalState: evidence.terminal_facts.state,
+          terminalReason: evidence.terminal_facts.reason_code,
+        },
+        list: {
+          coverage: summary.connection_health.axes.coverage,
+          conditions: Object.fromEntries(
+            summary.collection_report.map((entry) => [entry.stream, entry.coverage_condition])
+          ),
+          asOf: summary.coverage_as_of,
+        },
+        detail: {
+          coverage: detailHealth.axes.coverage,
+          conditions: Object.fromEntries(
+            detail.collection_report.map((entry) => [entry.stream, entry.coverage_condition])
+          ),
+          asOf: detail.coverage_as_of,
+        },
+        diagnostics: {
+          coverage: diagnostics.health.axes.coverage,
+          asOf: diagnostics.coverage_as_of,
+        },
+        storedCache: await foldedStreamFacts(lane),
+      },
+      {
+        evidence: {
+          dirty: false,
+          sourceKind: "local_device",
+          streamFacts: null,
+          terminalState: "unobserved",
+          terminalReason: "source_kind_mismatch",
+        },
+        list: { coverage: "unknown", conditions: UNKNOWN_CONDITIONS, asOf: null },
+        detail: { coverage: "unknown", conditions: UNKNOWN_CONDITIONS, asOf: null },
+        diagnostics: { coverage: "unknown", asOf: null },
+        storedCache: { streams: ["messages", "sessions"], version: UPGRADED_FOLD_VERSION },
+      },
+      "all readers withhold current cached facts when the canonical connection has left local_device"
+    );
+  }
+);
+
 laneTest(
   "source kind: a connection that stops being local_device projects its earlier device terminal as unknown",
   async (lane) => {
@@ -1980,6 +2055,78 @@ laneTest(
   }
 );
 
+laneTest(
+  "source kind: a canonical-only kind change fences a local-device fold before publication",
+  async (lane) => {
+    await commitProof(lane, "run-canonical-fold-fenced");
+    await assertCovered(
+      lane,
+      "run-canonical-fold-fenced",
+      "the local-device terminal initially covers the connection"
+    );
+    const id = lane.enrolled.connector_instance_id;
+    await sql(
+      lane,
+      "UPDATE connector_summary_evidence SET stream_latest_facts_json = NULL, stream_facts_event_seq = NULL, stream_facts_fold_version = ?, dirty = 0 WHERE connector_instance_id = ?",
+      "UPDATE connector_summary_evidence SET stream_latest_facts_json = NULL, stream_facts_event_seq = NULL, stream_facts_fold_version = $1, dirty = 0 WHERE connector_instance_id = $2",
+      [UPGRADED_FOLD_VERSION, id]
+    );
+
+    const paused = gate();
+    const reached = gate();
+    let held = false;
+    __testOnlySetFoldPauseHook(async (point) => {
+      if (point === "before_cas_write" && !held) {
+        held = true;
+        reached.open();
+        await paused.wait;
+      }
+    });
+    try {
+      const inFlight = foldConnectorSummaryStreamFacts([id]);
+      await Promise.race([
+        reached.wait,
+        inFlight.then(() => assert.fail("the fold finished without reaching its compare-and-set write")),
+      ]);
+      // Change only the canonical source kind while the local-device fold is paused at its write.
+      await sql(
+        lane,
+        "UPDATE connector_instances SET source_kind = 'account' WHERE connector_instance_id = ?",
+        "UPDATE connector_instances SET source_kind = 'account' WHERE connector_instance_id = $1",
+        [id]
+      );
+      paused.open();
+      await inFlight;
+    } finally {
+      paused.open();
+      __testOnlySetFoldPauseHook(null);
+    }
+
+    const [evidenceRow] = await sql(
+      lane,
+      `SELECT evidence.source_kind AS evidence_source_kind, instance.source_kind AS canonical_source_kind
+         FROM connector_summary_evidence AS evidence
+         JOIN connector_instances AS instance ON instance.connector_instance_id = evidence.connector_instance_id
+        WHERE evidence.connector_instance_id = ?`,
+      `SELECT evidence.source_kind AS evidence_source_kind, instance.source_kind AS canonical_source_kind
+         FROM connector_summary_evidence AS evidence
+         JOIN connector_instances AS instance ON instance.connector_instance_id = evidence.connector_instance_id
+        WHERE evidence.connector_instance_id = $1`,
+      [id]
+    );
+    assert.deepEqual(
+      evidenceRow,
+      { evidence_source_kind: "local_device", canonical_source_kind: "account" },
+      "the evidence-row fence input stays local_device while the canonical kind changes"
+    );
+    assert.deepEqual(
+      await foldedStreamFacts(lane),
+      { streams: [], version: UPGRADED_FOLD_VERSION },
+      "the fold publishes no device fact after the canonical kind changes"
+    );
+  }
+);
+
 laneTest("source kind: an exact replay returns the stored receipt and grants no coverage", async (lane) => {
   assert.equal((await postRunStart(lane, "run-replayed")).status, 201);
   await markDrained(lane);

From ad27b2baffc9da3ded089cd9d9b2574dcee6bc32 Mon Sep 17 00:00:00 2001
From: Tim Nunamaker <tnunamak@gmail.com>
Date: Fri, 23 Oct 2026 11:33:47 -0500
Subject: [PATCH 82/87] Fix SQLite collection revision migration order

Run revision setup after connector instance rebuilds and repair stale run-sequence foreign keys while preserving rows.

Assisted-by: AI
Signed-off-by: Tim Nunamaker <tnunamak@gmail.com>
---
 reference-implementation/server/db.ts         |  70 +++-
 ...nces-collection-revision-migration.test.ts | 314 ++++++++++++++++++
 2 files changed, 383 insertions(+), 1 deletion(-)
 create mode 100644 reference-implementation/test/connector-instances-collection-revision-migration.test.ts

diff --git a/reference-implementation/server/db.ts b/reference-implementation/server/db.ts
index be837099e..1a52fedf2 100644
--- a/reference-implementation/server/db.ts
+++ b/reference-implementation/server/db.ts
@@ -3035,6 +3035,67 @@ function ensureCollectionRevisionColumns(raw: SqliteDatabase): void {
   `);
 }
 
+// A previous boot could create collection_run_sequences before rebuilding
+// connector_instances. SQLite then retargeted its foreign key to the renamed
+// table, which those rebuilds later dropped. Rebuild only when the stored FK
+// does not name the final connector_instances table, preserving every row.
+function repairCollectionRunSequencesForeignKey(raw: SqliteDatabase): void {
+  const foreignKeys = raw
+    .prepare("PRAGMA foreign_key_list(collection_run_sequences)")
+    .all() as Array<{ table: string }>;
+  if (foreignKeys.length === 1 && foreignKeys[0]?.table === "connector_instances") {
+    return;
+  }
+
+  const foreignKeysEnabled = raw.pragma("foreign_keys", { simple: true }) === 1;
+  if (foreignKeysEnabled) {
+    raw.pragma("foreign_keys = OFF");
+  }
+  try {
+    raw.transaction(() => {
+      if (
+        raw
+          .prepare("SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = 'collection_run_sequences_new'")
+          .get()
+      ) {
+        throw new Error("Found unfinished collection_run_sequences migration table; refusing to overwrite it.");
+      }
+      raw.exec(`
+        CREATE TABLE collection_run_sequences_new (
+          connector_instance_id TEXT NOT NULL
+            REFERENCES connector_instances(connector_instance_id) ON DELETE CASCADE,
+          run_id TEXT NOT NULL,
+          run_sequence INTEGER NOT NULL,
+          storage_epoch INTEGER NOT NULL,
+          device_id TEXT NOT NULL,
+          source_instance_id TEXT NOT NULL,
+          issued_at TEXT NOT NULL,
+          PRIMARY KEY (connector_instance_id, run_id)
+        );
+        INSERT INTO collection_run_sequences_new(
+          connector_instance_id, run_id, run_sequence, storage_epoch,
+          device_id, source_instance_id, issued_at
+        )
+        SELECT connector_instance_id, run_id, run_sequence, storage_epoch,
+               device_id, source_instance_id, issued_at
+          FROM collection_run_sequences;
+        DROP TABLE collection_run_sequences;
+        ALTER TABLE collection_run_sequences_new RENAME TO collection_run_sequences;
+      `);
+      const foreignKeyViolations = raw.prepare("PRAGMA foreign_key_check").all();
+      if (foreignKeyViolations.length > 0) {
+        throw new Error(
+          `collection_run_sequences migration failed foreign_key_check: ${JSON.stringify(foreignKeyViolations)}`
+        );
+      }
+    })();
+  } finally {
+    if (foreignKeysEnabled) {
+      raw.pragma("foreign_keys = ON");
+    }
+  }
+}
+
 function ensureConnectorSummaryEvidenceColumns(raw: SqliteDatabase): void {
   addColumnIfMissing(raw, "connector_summary_evidence", "last_record_updated_at", "TEXT");
   addColumnIfMissing(raw, "connector_summary_evidence", "stream_records_json", "TEXT NOT NULL DEFAULT '[]'");
@@ -6657,7 +6718,6 @@ function buildSqliteSchema(raw: SqliteDatabase, opts: InitDbOptions): void {
   );
   runWithSqliteBusyRetrySync(() => ensureRecordResetGenerationColumn(raw));
   runWithSqliteBusyRetrySync(() => ensureRecordIdentityGenerationColumn(raw));
-  runWithSqliteBusyRetrySync(() => ensureCollectionRevisionColumns(raw));
   // Incremental add-source linkage: a later same-client ceremony records the
   // prior package it extends via `parent_package_id`. Pre-existing reference
   // DBs predate the column; add it non-destructively (NULL = a root package
@@ -6741,6 +6801,14 @@ CREATE INDEX IF NOT EXISTS idx_blob_bindings_record ON blob_bindings(connector_i
   runWithSqliteBusyRetrySync(() => migrateConnectorInstancesSourceKindCheck(raw, opts));
   runWithSqliteBusyRetrySync(() => migrateConnectorInstancesSourceKindBrowserCollector(raw, opts));
   runWithSqliteBusyRetrySync(() => migrateConnectorInstancesStatusDraft(raw, opts));
+  // These legacy migrations rebuild connector_instances from fixed column
+  // lists. Re-add projection metadata and collection revisions after the final
+  // rebuild so state writes and the new run-sequence reference survive boot.
+  runWithSqliteBusyRetrySync(() =>
+    addColumnIfMissing(raw, "connector_instances", "manifest_generation", "INTEGER NOT NULL DEFAULT 0")
+  );
+  runWithSqliteBusyRetrySync(() => ensureCollectionRevisionColumns(raw));
+  runWithSqliteBusyRetrySync(() => repairCollectionRunSequencesForeignKey(raw));
   runWithSqliteBusyRetrySync(() => migrateRecordRejectionBytePayload(raw));
   runWithSqliteBusyRetrySync(() => migrateConnectorCredentialKindCheck(raw, opts));
   runWithSqliteBusyRetrySync(() => migrateConnectorCredentialStatusRejected(raw, opts));
diff --git a/reference-implementation/test/connector-instances-collection-revision-migration.test.ts b/reference-implementation/test/connector-instances-collection-revision-migration.test.ts
new file mode 100644
index 000000000..552bbcff8
--- /dev/null
+++ b/reference-implementation/test/connector-instances-collection-revision-migration.test.ts
@@ -0,0 +1,314 @@
+// Copyright The PDP-Connect Contributors
+// SPDX-License-Identifier: Apache-2.0
+
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import test from "node:test";
+import { closeDb, initDb } from "../server/db.ts";
+import { issueCollectionRunSequence } from "../server/stores/collection-revision-store.ts";
+import { createSqliteConnectorStateStore } from "../server/stores/connector-state-store.ts";
+import Database from "./helpers/sqlite-driver.ts";
+
+const CONNECTOR_INSTANCE_ID = "cin_collection_revision_migration";
+
+function tempDatabase(): { directory: string; path: string } {
+	const directory = fs.mkdtempSync(
+		path.join(os.tmpdir(), "pdpp-collection-revision-migration-"),
+	);
+	return { directory, path: path.join(directory, "pdpp.sqlite") };
+}
+
+function createLegacyConnectorTables(
+	raw: Database.Database,
+	statusValues: string,
+): void {
+	raw.exec(`
+    CREATE TABLE connectors (
+      connector_id TEXT PRIMARY KEY,
+      manifest TEXT NOT NULL,
+      created_at TEXT NOT NULL
+    );
+    CREATE TABLE connector_instances (
+      connector_instance_id TEXT PRIMARY KEY,
+      owner_subject_id      TEXT NOT NULL,
+      connector_id          TEXT NOT NULL,
+      display_name          TEXT NOT NULL,
+      status                TEXT NOT NULL DEFAULT 'active' CHECK (status IN ${statusValues}),
+      source_kind           TEXT NOT NULL CHECK (source_kind IN ('account', 'local_device', 'browser_collector', 'manual')),
+      source_binding_key    TEXT NOT NULL,
+      source_binding_json   TEXT NOT NULL DEFAULT '{}',
+      created_at            TEXT NOT NULL,
+      updated_at            TEXT NOT NULL,
+      revoked_at            TEXT,
+      UNIQUE(owner_subject_id, connector_id, source_kind, source_binding_key),
+      FOREIGN KEY(connector_id) REFERENCES connectors(connector_id) ON DELETE RESTRICT
+    );
+    INSERT INTO connectors VALUES ('gmail', '{}', '2026-10-22');
+    INSERT INTO connector_instances(
+      connector_instance_id, owner_subject_id, connector_id, display_name,
+      status, source_kind, source_binding_key, source_binding_json,
+      created_at, updated_at, revoked_at
+    ) VALUES (
+      '${CONNECTOR_INSTANCE_ID}', 'owner_1', 'gmail', 'Gmail',
+      'active', 'account', 'binding_1', '{}', '2026-10-22', '2026-10-22', NULL
+    );
+  `);
+}
+
+function tableColumns(db: ReturnType<typeof initDb>, table: string): string[] {
+	return db
+		.prepare(`PRAGMA table_info(${table})`)
+		.all()
+		.map((column) => column.name as string);
+}
+
+function foreignKeyTables(
+	db: ReturnType<typeof initDb>,
+	table: string,
+): string[] {
+	return (
+		db.prepare(`PRAGMA foreign_key_list(${table})`).all() as Array<{
+			table: string;
+		}>
+	).map((foreignKey) => foreignKey.table);
+}
+
+function revisionSchema(db: ReturnType<typeof initDb>) {
+	const sequenceTable = db
+		.prepare(
+			"SELECT sql FROM sqlite_master WHERE type = 'table' AND name = 'collection_run_sequences'",
+		)
+		.get();
+	return {
+		connectorInstanceColumns: tableColumns(db, "connector_instances"),
+		connectorStateColumns: tableColumns(db, "connector_state"),
+		sequenceTable,
+		sequenceForeignKeys: db
+			.prepare("PRAGMA foreign_key_list(collection_run_sequences)")
+			.all(),
+	};
+}
+
+function assertRevisionColumns(db: ReturnType<typeof initDb>): void {
+	const connectorInstanceColumns = new Set(
+		tableColumns(db, "connector_instances"),
+	);
+	for (const column of [
+		"collection_revision",
+		"collection_revision_event",
+		"collection_revision_run_id",
+		"collection_revision_at",
+		"run_sequence_issued",
+		"storage_epoch",
+		"run_order_sequence",
+		"run_order_event",
+		"run_order_run_id",
+		"run_order_revision",
+	]) {
+		assert.ok(
+			connectorInstanceColumns.has(column),
+			`connector_instances has ${column}`,
+		);
+	}
+	assert.ok(
+		tableColumns(db, "connector_state").includes("collection_revision"),
+	);
+	assert.deepEqual(foreignKeyTables(db, "collection_run_sequences"), [
+		"connector_instances",
+	]);
+}
+
+function seedLegacyNarrowStatusDatabase(dbPath: string): void {
+	const raw = new Database(dbPath);
+	try {
+		raw.pragma("foreign_keys = OFF");
+		createLegacyConnectorTables(raw, "('active', 'paused', 'revoked')");
+	} finally {
+		raw.close();
+	}
+}
+
+function seedBrokenOrderDatabase(dbPath: string): void {
+	const raw = new Database(dbPath);
+	try {
+		raw.pragma("foreign_keys = OFF");
+		createLegacyConnectorTables(
+			raw,
+			"('active', 'paused', 'revoked', 'draft')",
+		);
+		raw.exec(`
+      CREATE TABLE collection_run_sequences (
+        connector_instance_id TEXT NOT NULL
+          REFERENCES connector_instances_old_status_draft(connector_instance_id) ON DELETE CASCADE,
+        run_id TEXT NOT NULL,
+        run_sequence INTEGER NOT NULL,
+        storage_epoch INTEGER NOT NULL,
+        device_id TEXT NOT NULL,
+        source_instance_id TEXT NOT NULL,
+        issued_at TEXT NOT NULL,
+        PRIMARY KEY (connector_instance_id, run_id)
+      );
+      INSERT INTO collection_run_sequences(
+        connector_instance_id, run_id, run_sequence, storage_epoch,
+        device_id, source_instance_id, issued_at
+      ) VALUES (
+        '${CONNECTOR_INSTANCE_ID}', 'run_preserved', 7, 1,
+        'device_1', 'source_1', '2026-10-22T12:00:00.000Z'
+      );
+    `);
+	} finally {
+		raw.close();
+	}
+}
+
+function insertFreshConnection(db: ReturnType<typeof initDb>): void {
+	db.prepare(
+		"INSERT INTO connectors(connector_id, manifest, created_at) VALUES ('gmail', '{}', '2026-10-22')",
+	).run();
+	db.prepare(
+		`INSERT INTO connector_instances(
+       connector_instance_id, owner_subject_id, connector_id, display_name,
+       status, source_kind, source_binding_key, source_binding_json,
+       created_at, updated_at, revoked_at
+     ) VALUES (?, 'owner_1', 'gmail', 'Gmail', 'active', 'account', 'binding_1', '{}', '2026-10-22', '2026-10-22', NULL)`,
+	).run(CONNECTOR_INSTANCE_ID);
+}
+
+async function writeOwnerState() {
+	return await createSqliteConnectorStateStore().putState(
+		{ connectorId: "gmail", connectorInstanceId: CONNECTOR_INSTANCE_ID },
+		{ messages: { cursor: "after-1" } },
+	);
+}
+
+test("legacy status rebuild creates collection revisions after connector_instances and keeps both writes usable", async () => {
+	const { directory, path: dbPath } = tempDatabase();
+	try {
+		seedLegacyNarrowStatusDatabase(dbPath);
+		const db = initDb(dbPath);
+		const errors: string[] = [];
+		let state: Awaited<ReturnType<typeof writeOwnerState>> | undefined;
+		let runStart:
+			| Awaited<ReturnType<typeof issueCollectionRunSequence>>
+			| undefined;
+		try {
+			try {
+				state = await writeOwnerState();
+			} catch (error) {
+				errors.push(
+					`owner-scoped state write: ${error instanceof Error ? error.message : String(error)}`,
+				);
+			}
+			try {
+				runStart = await issueCollectionRunSequence({
+					connectorInstanceId: CONNECTOR_INSTANCE_ID,
+					deviceId: "device_1",
+					runId: "run_after_migration",
+					sourceInstanceId: "source_1",
+				});
+			} catch (error) {
+				errors.push(
+					`run-start registration: ${error instanceof Error ? error.message : String(error)}`,
+				);
+			}
+
+			assert.deepEqual(errors, [], errors.join("; "));
+			assertRevisionColumns(db);
+			assert.deepEqual(state?.state, { messages: { cursor: "after-1" } });
+			assert.equal(state?.updated_at !== null, true);
+			assert.equal(runStart?.issued.runSequence, 1);
+			assert.equal(runStart?.issued.storageEpoch, 1);
+		} finally {
+			closeDb();
+		}
+	} finally {
+		fs.rmSync(directory, { force: true, recursive: true });
+	}
+});
+
+test("a previously misdirected run-sequence foreign key is repaired without losing rows", () => {
+	const { directory, path: dbPath } = tempDatabase();
+	try {
+		seedBrokenOrderDatabase(dbPath);
+		const db = initDb(dbPath);
+		try {
+			assertRevisionColumns(db);
+			assert.deepEqual(
+				db
+					.prepare("SELECT * FROM collection_run_sequences ORDER BY run_id")
+					.all(),
+				[
+					{
+						connector_instance_id: CONNECTOR_INSTANCE_ID,
+						run_id: "run_preserved",
+						run_sequence: 7,
+						storage_epoch: 1,
+						device_id: "device_1",
+						source_instance_id: "source_1",
+						issued_at: "2026-10-22T12:00:00.000Z",
+					},
+				],
+			);
+			assert.deepEqual(db.prepare("PRAGMA foreign_key_check").all(), []);
+		} finally {
+			closeDb();
+		}
+	} finally {
+		fs.rmSync(directory, { force: true, recursive: true });
+	}
+});
+
+test("fresh collection revision schema and data stay unchanged on a second boot", async () => {
+	const { directory, path: dbPath } = tempDatabase();
+	const onSchemaMigration = () => undefined;
+	try {
+		const first = initDb(dbPath, { onSchemaMigration });
+		let schema: ReturnType<typeof revisionSchema>;
+		let stateRows: unknown[];
+		let sequenceRows: unknown[];
+		try {
+			schema = revisionSchema(first);
+			assertRevisionColumns(first);
+			insertFreshConnection(first);
+			const state = await writeOwnerState();
+			assert.deepEqual(state.state, { messages: { cursor: "after-1" } });
+			await issueCollectionRunSequence({
+				connectorInstanceId: CONNECTOR_INSTANCE_ID,
+				deviceId: "device_1",
+				runId: "run_fresh",
+				sourceInstanceId: "source_1",
+			});
+			stateRows = first
+				.prepare("SELECT * FROM connector_state ORDER BY stream")
+				.all();
+			sequenceRows = first
+				.prepare("SELECT * FROM collection_run_sequences ORDER BY run_id")
+				.all();
+			assert.deepEqual(first.prepare("PRAGMA foreign_key_check").all(), []);
+		} finally {
+			closeDb();
+		}
+
+		const second = initDb(dbPath, { onSchemaMigration });
+		try {
+			assert.deepEqual(revisionSchema(second), schema);
+			assert.deepEqual(
+				second.prepare("SELECT * FROM connector_state ORDER BY stream").all(),
+				stateRows,
+			);
+			assert.deepEqual(
+				second
+					.prepare("SELECT * FROM collection_run_sequences ORDER BY run_id")
+					.all(),
+				sequenceRows,
+			);
+			assert.deepEqual(second.prepare("PRAGMA foreign_key_check").all(), []);
+		} finally {
+			closeDb();
+		}
+	} finally {
+		fs.rmSync(directory, { force: true, recursive: true });
+	}
+});

From 5a6b5ef9df5b65d21921ce08bd1adb84e51e1372 Mon Sep 17 00:00:00 2001
From: Tim Nunamaker <tnunamak@gmail.com>
Date: Fri, 23 Oct 2026 10:59:30 -0500
Subject: [PATCH 83/87] fix(local-collector): preserve managed profile
 capabilities

Keep signed profile capabilities in managed definitions so the existing runtime placement gate can reject unsupported required capabilities.

Assisted-by: AI
Signed-off-by: Tim Nunamaker <tnunamak@gmail.com>
---
 .../src/managed/artifact-contract.ts          |  3 +
 .../src/managed/managed-definitions.ts        |  2 +-
 .../test/managed-connectors.test.ts           | 89 +++++++++++++++++++
 3 files changed, 93 insertions(+), 1 deletion(-)

diff --git a/packages/local-collector/src/managed/artifact-contract.ts b/packages/local-collector/src/managed/artifact-contract.ts
index f6d7d4fd9..ecaf0beca 100644
--- a/packages/local-collector/src/managed/artifact-contract.ts
+++ b/packages/local-collector/src/managed/artifact-contract.ts
@@ -38,6 +38,8 @@
  * can be tested against a fixture without a registry.
  */
 
+import type { ConnectorProtocolCapability } from "../../../connector-protocol/src/connector-runtime-protocol.ts";
+
 /** Media type of the artifact envelope a reference resolves to. */
 export type ArtifactMediaType =
   | "application/vnd.oci.image.manifest.v1+json"
@@ -159,6 +161,7 @@ export interface CollectionProfile {
   readonly connector_id: string;
   readonly version: string;
   readonly display_name: string;
+  readonly protocol_capabilities?: readonly ConnectorProtocolCapability[];
   readonly runtime_requirements?: {
     readonly bindings?: Readonly<Record<string, { readonly required: boolean }>>;
   };
diff --git a/packages/local-collector/src/managed/managed-definitions.ts b/packages/local-collector/src/managed/managed-definitions.ts
index 843a7f9a7..4e2f1924c 100644
--- a/packages/local-collector/src/managed/managed-definitions.ts
+++ b/packages/local-collector/src/managed/managed-definitions.ts
@@ -92,7 +92,7 @@ export function definitionFromProfile(profile: CollectionProfile, release: Insta
     // one remain comparable, which is what makes the migration checkable.
     entry: profile.connector_key,
     bindings: Object.freeze(bindings),
-    protocol_capabilities: Object.freeze([]),
+    protocol_capabilities: Object.freeze([...(profile.protocol_capabilities ?? [])]),
     streams: Object.freeze(streams),
   };
 
diff --git a/packages/local-collector/test/managed-connectors.test.ts b/packages/local-collector/test/managed-connectors.test.ts
index c165193b2..4bc0fef36 100644
--- a/packages/local-collector/test/managed-connectors.test.ts
+++ b/packages/local-collector/test/managed-connectors.test.ts
@@ -41,6 +41,8 @@ import {
   definitionFromProfile,
   LAYER_MEDIA_TYPES,
   managedConnectorCommand,
+  managedDefinitionsFrom,
+  managedEntrypointIndex,
   obtainManagedConnectors,
   PDP_CONNECT_CONNECTOR_IDENTITY,
   readTarGz,
@@ -48,6 +50,13 @@ import {
   type SignatureVerifier,
   UNSUPPORTED_PLATFORM_SELECTION,
 } from "../src/managed/index.ts";
+import { RuntimeCapabilityMismatchError } from "../src/errors.ts";
+import {
+  assertPlacementOrThrow,
+  COLLECTOR_RUNTIME_CAPABILITIES,
+  createBundledConnectorRegistry,
+  runCollectorConnector,
+} from "../src/runner.ts";
 
 const sha256 = (bytes: Uint8Array): string => `sha256:${createHash("sha256").update(bytes).digest("hex")}`;
 const encode = (value: unknown): Uint8Array => new TextEncoder().encode(`${JSON.stringify(value, null, 2)}\n`);
@@ -289,6 +298,86 @@ test("a verified artifact installs under its digest and yields a runnable defini
   });
 });
 
+test("a signed profile's RUN_COVERAGE_V1 declaration is preserved in the managed definition", async () => {
+  const fixture = buildFixture({ profile: { protocol_capabilities: ["RUN_COVERAGE_V1"] } });
+  await withRoots(async (installRoot, durableRoot) => {
+    const managed = await obtain(fixture, installRoot, durableRoot);
+
+    assert.deepEqual([...managed[0]!.definition.protocol_capabilities], ["RUN_COVERAGE_V1"]);
+  });
+});
+
+test("a managed profile requiring an unadvertised capability fails before spawn with the typed runtime error", async () => {
+  await withRoots(async (installRoot, durableRoot) => {
+    mkdirSync(durableRoot, { recursive: true });
+    const spawnedMarker = join(durableRoot, "spawned.marker");
+    const fixture = buildFixture({
+      codeEntries: [
+        {
+          path: "collection-profile.mjs",
+          content: `await (await import("node:fs/promises")).writeFile(${JSON.stringify(spawnedMarker)}, "spawned");\n`,
+        },
+      ],
+      profile: { protocol_capabilities: ["BLOB"] },
+    });
+    const managed = await obtain(fixture, installRoot, durableRoot);
+    const registry = createBundledConnectorRegistry(
+      managedDefinitionsFrom(managed),
+      managedEntrypointIndex(managed)
+    );
+    const connector = registry[CONNECTOR_ID];
+    assert.ok(connector);
+
+    await assert.rejects(
+      runCollectorConnector({
+        baseUrl: "http://127.0.0.1:1",
+        connector: {
+          args: connector.args,
+          command: connector.command,
+          connector_id: connector.connector_id,
+          protocol_capabilities: connector.protocol_capabilities,
+          runtime_requirements: { bindings: connector.bindings },
+          streams: connector.streams,
+        },
+        deviceId: "device-1",
+        deviceToken: "device-token",
+        executionRoot: process.cwd(),
+        queuePath: join(durableRoot, "queue.sqlite"),
+        sourceInstanceId: "src-required-capability-refused",
+      }),
+      (error: unknown) => {
+        assert.ok(error instanceof RuntimeCapabilityMismatchError);
+        if (error instanceof RuntimeCapabilityMismatchError) {
+          assert.equal(error.code, "runtime_capability_mismatch");
+          assert.equal(error.connectorId, CONNECTOR_ID);
+          assert.deepEqual(error.missing, ["BLOB"]);
+          assert.match(error.message, /missing capabilities \[BLOB\]/);
+        }
+        return true;
+      }
+    );
+
+    assert.equal(existsSync(spawnedMarker), false);
+  });
+});
+
+test("a managed profile's advisory capability does not block placement when the runtime omits it", async () => {
+  const fixture = buildFixture({ profile: { protocol_capabilities: ["DETAIL_COVERAGE_KEY_SETS"] } });
+  await withRoots(async (installRoot, durableRoot) => {
+    const managed = await obtain(fixture, installRoot, durableRoot);
+    const registry = createBundledConnectorRegistry(
+      managedDefinitionsFrom(managed),
+      managedEntrypointIndex(managed)
+    );
+    const connector = registry[CONNECTOR_ID];
+    assert.ok(connector);
+
+    assert.deepEqual([...connector.protocol_capabilities], ["DETAIL_COVERAGE_KEY_SETS"]);
+    assert.equal(COLLECTOR_RUNTIME_CAPABILITIES.protocolCapabilities.has("DETAIL_COVERAGE_KEY_SETS"), false);
+    assert.deepEqual(assertPlacementOrThrow(connector, COLLECTOR_RUNTIME_CAPABILITIES), []);
+  });
+});
+
 test("installing twice is idempotent and does not rewrite the release", async () => {
   const fixture = buildFixture();
   await withRoots(async (installRoot, durableRoot) => {

From 23025d5fe2c23a37111b798e6ac511f31a0dee29 Mon Sep 17 00:00:00 2001
From: Tim Nunamaker <tnunamak@gmail.com>
Date: Fri, 23 Oct 2026 11:46:13 -0500
Subject: [PATCH 84/87] fix(postgres): bound run history boot migration waits

Apply transaction-local lock and statement deadlines to the default and provenance repairs. Retry timeout failures three times, then stop bootstrap so scheduler history cannot run with incomplete ownership data. Commit each page cursor with its repair so a later boot resumes safely.

Assisted-by: AI
Signed-off-by: Tim Nunamaker <tnunamak@gmail.com>
---
 PG-PROFILE-51-REPORT.md                       |   2 +-
 .../scripts/postgres-template-eligibility.ts  |   2 +
 .../scripts/run-tests-resource-policy.test.ts |   4 +-
 .../server/postgres-storage.ts                | 228 +++++++++----
 ...run-provenance-migration-deadlines.test.ts | 312 ++++++++++++++++++
 5 files changed, 486 insertions(+), 62 deletions(-)
 create mode 100644 reference-implementation/test/run-history-device-run-provenance-migration-deadlines.test.ts

diff --git a/PG-PROFILE-51-REPORT.md b/PG-PROFILE-51-REPORT.md
index d03dee4d9..397633754 100644
--- a/PG-PROFILE-51-REPORT.md
+++ b/PG-PROFILE-51-REPORT.md
@@ -168,7 +168,7 @@ tail:
 
 The completed profile receipt recorded 1,034 files; that historical receipt
 is unchanged. The template equivalence registry is a different measure:
-157 eligible plus 39 cold-required files, for **196** total. The
+157 eligible plus 40 cold-required files, for **197** total. The
 handle-generation, issuance-cutover, opaque-cursor and search-index repair
 tests remain registered. These counts are recomputed from the merged registry arrays.
 
diff --git a/reference-implementation/scripts/postgres-template-eligibility.ts b/reference-implementation/scripts/postgres-template-eligibility.ts
index 0c75befdf..4ff142f43 100644
--- a/reference-implementation/scripts/postgres-template-eligibility.ts
+++ b/reference-implementation/scripts/postgres-template-eligibility.ts
@@ -244,6 +244,8 @@ export const POSTGRES_TEMPLATE_COLD_REQUIRED_FILES: readonly string[] = [
   "test/rs-opaque-cursors.test.ts",
   "test/run-history-completed-at-fleet-migration.test.ts",
   "test/run-history-device-run-provenance-migration.test.ts",
+  // Exercises bounded boot retries and cursor recovery after run_history lock timeouts.
+  "test/run-history-device-run-provenance-migration-deadlines.test.ts",
   "test/run-history-duplicate-run-id-identity.test.ts",
   "test/run-history-interrupted-migration-reconciliation.test.ts",
   "test/run-history-writer-authority.test.ts",
diff --git a/reference-implementation/scripts/run-tests-resource-policy.test.ts b/reference-implementation/scripts/run-tests-resource-policy.test.ts
index 3fc0114ca..147ce5060 100644
--- a/reference-implementation/scripts/run-tests-resource-policy.test.ts
+++ b/reference-implementation/scripts/run-tests-resource-policy.test.ts
@@ -33,8 +33,8 @@ test("only reviewed files bypass outer allocation; restore remains separate", ()
   assert.equal(isDedicatedPostgresTestDatabaseName(restoreName), true);
 });
 
-test("all 39 cold-required entries remain cold, including helper-owned bootstrap", () => {
-  assert.equal(POSTGRES_TEMPLATE_COLD_REQUIRED_FILES.length, 39);
+test("all 40 cold-required entries remain cold, including helper-owned bootstrap", () => {
+  assert.equal(POSTGRES_TEMPLATE_COLD_REQUIRED_FILES.length, 40);
   for (const file of POSTGRES_TEMPLATE_COLD_REQUIRED_FILES) {
     assert.equal(isPostgresTemplateEligibleFilePath(file), false, file);
   }
diff --git a/reference-implementation/server/postgres-storage.ts b/reference-implementation/server/postgres-storage.ts
index 7ab58be42..8f79591c3 100644
--- a/reference-implementation/server/postgres-storage.ts
+++ b/reference-implementation/server/postgres-storage.ts
@@ -1072,6 +1072,7 @@ async function migratePostgresRecordRejectionBytePayload(client: PoolClient): Pr
 
 // Postgres SQLSTATE raised when a statement is cancelled by `statement_timeout`.
 const POSTGRES_STATEMENT_TIMEOUT_SQLSTATE = "57014";
+const POSTGRES_LOCK_TIMEOUT_SQLSTATE = "55P03";
 
 /**
  * Thrown by `postgresQueryBounded` when Postgres itself cancelled the
@@ -3956,7 +3957,7 @@ async function bootstrapPostgresSchemaOnce({
     await migratePostgresSchedulerInstanceColumns(client);
     await migratePostgresRunHistoryRename(client);
     await migratePostgresRunHistoryCompletedAtNullable(client);
-    await migratePostgresRunHistorySchedulerManagedDefault(client);
+    await migratePostgresRunHistorySchedulerManagedDefault(client, { log });
     await migratePostgresConnectorMaintenanceCursorNameCheck(client);
     await migratePostgresRecordsBlobSearchInstanceColumns(client);
     // Legacy blob tables gain connector_instance_id in the migration above.
@@ -5649,20 +5650,122 @@ async function migratePostgresRunHistoryCompletedAtNullable(client: PoolClient):
 // default to the fresh-schema value. Only the default changes; rows are
 // repaired by migratePostgresRunHistoryDeviceRunProvenance. The ALTER takes
 // an exclusive table lock, so it runs only when the default differs.
-async function migratePostgresRunHistorySchedulerManagedDefault(client: PoolClient): Promise<void> {
-  const result = await client.query<{ column_default: string | null }>(
-    `SELECT column_default FROM information_schema.columns
-       WHERE table_schema = current_schema() AND table_name = 'run_history' AND column_name = 'scheduler_managed'`
+const PG_RUN_HISTORY_PROVENANCE_BATCH_ROWS = 2000;
+const PG_RUN_HISTORY_PROVENANCE_LEASE_MS = 15 * 60 * 1000;
+const PG_RUN_HISTORY_MIGRATION_RETRY_ATTEMPTS = 3;
+const PG_RUN_HISTORY_MIGRATION_RETRY_INITIAL_DELAY_MS = 100;
+const PG_RUN_HISTORY_MIGRATION_RETRY_MAX_DELAY_MS = 500;
+const PG_RUN_HISTORY_DEFAULT_LOCK_TIMEOUT_MS = 5_000;
+const PG_RUN_HISTORY_DEFAULT_STATEMENT_TIMEOUT_MS = 30_000;
+const PG_RUN_HISTORY_PROVENANCE_LOCK_TIMEOUT_MS = 1_000;
+const PG_RUN_HISTORY_PROVENANCE_STATEMENT_TIMEOUT_MS = 30_000;
+
+interface PostgresMigrationTimeouts {
+  readonly lockTimeoutMs: number;
+  readonly statementTimeoutMs: number;
+}
+
+const PG_RUN_HISTORY_DEFAULT_TIMEOUTS: PostgresMigrationTimeouts = {
+  lockTimeoutMs: PG_RUN_HISTORY_DEFAULT_LOCK_TIMEOUT_MS,
+  statementTimeoutMs: PG_RUN_HISTORY_DEFAULT_STATEMENT_TIMEOUT_MS,
+};
+
+const PG_RUN_HISTORY_PROVENANCE_TIMEOUTS: PostgresMigrationTimeouts = {
+  lockTimeoutMs: PG_RUN_HISTORY_PROVENANCE_LOCK_TIMEOUT_MS,
+  statementTimeoutMs: PG_RUN_HISTORY_PROVENANCE_STATEMENT_TIMEOUT_MS,
+};
+
+async function withPostgresMigrationTimeouts<T>(
+  client: PoolClient,
+  timeouts: PostgresMigrationTimeouts,
+  operation: () => Promise<T>
+): Promise<T> {
+  await client.query("BEGIN");
+  try {
+    // SET LOCAL reverts on COMMIT and ROLLBACK, so bootstrap never changes the
+    // session settings of the pooled connection it releases afterwards.
+    await client.query(`SET LOCAL lock_timeout = ${timeouts.lockTimeoutMs}`);
+    await client.query(`SET LOCAL statement_timeout = ${timeouts.statementTimeoutMs}`);
+    const result = await operation();
+    await client.query("COMMIT");
+    return result;
+  } catch (err) {
+    try {
+      await client.query("ROLLBACK");
+    } catch {
+      // Rollback failure must not hide the original migration error.
+    }
+    throw err;
+  }
+}
+
+function postgresMigrationTimeoutKind(err: unknown): "lock_timeout" | "statement_timeout" | null {
+  const code = (err as { code?: string } | null)?.code;
+  if (code === POSTGRES_LOCK_TIMEOUT_SQLSTATE) {
+    return "lock_timeout";
+  }
+  return code === POSTGRES_STATEMENT_TIMEOUT_SQLSTATE ? "statement_timeout" : null;
+}
+
+function postgresRunHistoryMigrationRetryDelayMs(attempt: number): number {
+  return Math.min(
+    PG_RUN_HISTORY_MIGRATION_RETRY_MAX_DELAY_MS,
+    PG_RUN_HISTORY_MIGRATION_RETRY_INITIAL_DELAY_MS * 2 ** (attempt - 1)
   );
-  const columnDefault = result.rows[0]?.column_default;
-  if (columnDefault === undefined || columnDefault === "false") {
-    return;
+}
+
+async function retryPostgresRunHistoryMigrationTimeout<T>(
+  operationName: string,
+  timeouts: PostgresMigrationTimeouts,
+  log: StorageLog,
+  operation: () => Promise<T>
+): Promise<T> {
+  for (let attempt = 1; attempt <= PG_RUN_HISTORY_MIGRATION_RETRY_ATTEMPTS; attempt += 1) {
+    try {
+      return await operation();
+    } catch (err) {
+      const timeoutKind = postgresMigrationTimeoutKind(err);
+      if (!timeoutKind) {
+        throw err;
+      }
+      if (attempt === PG_RUN_HISTORY_MIGRATION_RETRY_ATTEMPTS) {
+        throw new Error(
+          `Postgres boot migration ${operationName} timed out after ${attempt} attempts (${timeoutKind}; lock_timeout=${timeouts.lockTimeoutMs}ms; statement_timeout=${timeouts.statementTimeoutMs}ms). The timed-out transaction rolled back and the last committed migration cursor remains intact. Bootstrap stopped to avoid serving with incomplete run_history ownership data. Resolve transactions blocking run_history or spine_events (inspect pg_stat_activity/pg_locks), then restart.`,
+          { cause: err }
+        );
+      }
+      const delayMs = postgresRunHistoryMigrationRetryDelayMs(attempt);
+      log(
+        `[PDPP] ${operationName}: ${timeoutKind} on attempt ${attempt}/${PG_RUN_HISTORY_MIGRATION_RETRY_ATTEMPTS}; retrying in ${delayMs}ms`
+      );
+      await new Promise((resolve) => setTimeout(resolve, delayMs));
+    }
   }
-  await client.query("ALTER TABLE run_history ALTER COLUMN scheduler_managed SET DEFAULT false");
+  throw new Error(`Postgres boot migration ${operationName} exhausted its retry loop unexpectedly.`);
 }
 
-const PG_RUN_HISTORY_PROVENANCE_BATCH_ROWS = 2000;
-const PG_RUN_HISTORY_PROVENANCE_LEASE_MS = 15 * 60 * 1000;
+async function migratePostgresRunHistorySchedulerManagedDefault(
+  client: PoolClient,
+  { log = NOOP_STORAGE_LOG }: { log?: StorageLog } = {}
+): Promise<void> {
+  await retryPostgresRunHistoryMigrationTimeout(
+    "run_history scheduler_managed default repair",
+    PG_RUN_HISTORY_DEFAULT_TIMEOUTS,
+    log,
+    () =>
+      withPostgresMigrationTimeouts(client, PG_RUN_HISTORY_DEFAULT_TIMEOUTS, async () => {
+        const result = await client.query<{ column_default: string | null }>(
+          `SELECT column_default FROM information_schema.columns
+             WHERE table_schema = current_schema() AND table_name = 'run_history' AND column_name = 'scheduler_managed'`
+        );
+        const columnDefault = result.rows[0]?.column_default;
+        if (columnDefault === undefined || columnDefault === "false") {
+          return;
+        }
+        await client.query("ALTER TABLE run_history ALTER COLUMN scheduler_managed SET DEFAULT false");
+      })
+  );
+}
 
 /**
  * Correct `scheduler_managed` on the run_history rows a device wrote.
@@ -5700,57 +5803,64 @@ async function migratePostgresRunHistoryDeviceRunProvenance(
   let cursor = claim.cursor ?? "0";
   let changedRows = 0;
   for (;;) {
-    // biome-ignore lint/performance/noAwaitInLoops: Pages are sequential by contract — each cursor is valid only after the previous page committed.
-    const page = await client.query<{ upper_id: string | null }>(
-      `SELECT MAX(id)::text AS upper_id
-         FROM (SELECT id FROM run_history WHERE id > $1::bigint ORDER BY id LIMIT $2) page`,
-      [cursor, PG_RUN_HISTORY_PROVENANCE_BATCH_ROWS]
-    );
-    const upperId = page.rows[0]?.upper_id;
-    if (!upperId) {
-      break;
-    }
-    await client.query("BEGIN");
     try {
-      const updated = await client.query(
-        `UPDATE run_history rh
-            SET scheduler_managed = false
-          WHERE rh.id > $1::bigint AND rh.id <= $2::bigint
-            AND rh.scheduler_managed
-            AND rh.run_id IS NOT NULL
-            AND EXISTS (
-              SELECT 1 FROM spine_events s
-               WHERE s.run_id = rh.run_id
-                 AND s.event_type IN ('run.completed', 'run.failed', 'run.cancelled', 'run.abandoned')
-                 AND s.actor_type = 'local_device'
-                 AND COALESCE(
-                   NULLIF(s.connector_instance_id, ''),
-                   NULLIF(s.data_json->>'connector_instance_id', ''),
-                   NULLIF(s.data_json->>'connection_id', '')
-                 ) = rh.connector_instance_id
-            )`,
-        [cursor, upperId]
-      );
-      const batchChangedRows = updated.rowCount ?? 0;
-      await advancePostgresMigrationCursor(client, RUN_HISTORY_DEVICE_RUN_PROVENANCE_MIGRATION_ID, {
-        changedRows: batchChangedRows,
-        cursor: upperId,
-        nowIso: new Date().toISOString(),
-      });
-      await client.query("COMMIT");
-      cursor = upperId;
-      changedRows += batchChangedRows;
-    } catch (err) {
-      try {
-        await client.query("ROLLBACK");
-      } catch {
-        // Rollback failure must not hide the original migration error.
+      // Pages are sequential by contract: each cursor is valid only after the previous page committed.
+      const page = await retryPostgresRunHistoryMigrationTimeout(
+        `run_history device-run provenance page after id ${cursor}`,
+        PG_RUN_HISTORY_PROVENANCE_TIMEOUTS,
+        log,
+        () =>
+          withPostgresMigrationTimeouts(client, PG_RUN_HISTORY_PROVENANCE_TIMEOUTS, async () => {
+            const pageRows = await client.query<{ upper_id: string | null }>(
+              `SELECT MAX(id)::text AS upper_id
+                 FROM (SELECT id FROM run_history WHERE id > $1::bigint ORDER BY id LIMIT $2) page`,
+              [cursor, PG_RUN_HISTORY_PROVENANCE_BATCH_ROWS]
+            );
+            const upperId = pageRows.rows[0]?.upper_id;
+            if (!upperId) {
+              return null;
+            }
+            const updated = await client.query(
+              `UPDATE run_history rh
+                  SET scheduler_managed = false
+                WHERE rh.id > $1::bigint AND rh.id <= $2::bigint
+                  AND rh.scheduler_managed
+                  AND rh.run_id IS NOT NULL
+                  AND EXISTS (
+                    SELECT 1 FROM spine_events s
+                     WHERE s.run_id = rh.run_id
+                       AND s.event_type IN ('run.completed', 'run.failed', 'run.cancelled', 'run.abandoned')
+                       AND s.actor_type = 'local_device'
+                       AND COALESCE(
+                         NULLIF(s.connector_instance_id, ''),
+                         NULLIF(s.data_json->>'connector_instance_id', ''),
+                         NULLIF(s.data_json->>'connection_id', '')
+                       ) = rh.connector_instance_id
+                  )`,
+              [cursor, upperId]
+            );
+            const batchChangedRows = updated.rowCount ?? 0;
+            await advancePostgresMigrationCursor(client, RUN_HISTORY_DEVICE_RUN_PROVENANCE_MIGRATION_ID, {
+              changedRows: batchChangedRows,
+              cursor: upperId,
+              nowIso: new Date().toISOString(),
+            });
+            return { upperId, batchChangedRows };
+          })
+      );
+      if (!page) {
+        break;
       }
+      cursor = page.upperId;
+      changedRows += page.batchChangedRows;
+    } catch (err) {
       try {
-        await blockPostgresMigration(client, RUN_HISTORY_DEVICE_RUN_PROVENANCE_MIGRATION_ID, {
-          error: err instanceof Error ? err.message : String(err),
-          nowIso: new Date().toISOString(),
-        });
+        await withPostgresMigrationTimeouts(client, PG_RUN_HISTORY_PROVENANCE_TIMEOUTS, () =>
+          blockPostgresMigration(client, RUN_HISTORY_DEVICE_RUN_PROVENANCE_MIGRATION_ID, {
+            error: err instanceof Error ? err.message : String(err),
+            nowIso: new Date().toISOString(),
+          })
+        );
       } catch {
         // A ledger write failure must not hide the original migration error.
       }
diff --git a/reference-implementation/test/run-history-device-run-provenance-migration-deadlines.test.ts b/reference-implementation/test/run-history-device-run-provenance-migration-deadlines.test.ts
new file mode 100644
index 000000000..24c6157d2
--- /dev/null
+++ b/reference-implementation/test/run-history-device-run-provenance-migration-deadlines.test.ts
@@ -0,0 +1,312 @@
+// Copyright The PDP-Connect Contributors
+// SPDX-License-Identifier: Apache-2.0
+
+import assert from "node:assert/strict";
+import test from "node:test";
+import pg from "pg";
+import { RUN_HISTORY_DEVICE_RUN_PROVENANCE_MIGRATION_ID } from "../server/postgres-migration-ledger.ts";
+import {
+	closePostgresStorage,
+	initPostgresStorage,
+	postgresQuery,
+} from "../server/postgres-storage.ts";
+import { dedicatedPostgresTestUrl } from "./helpers/dedicated-postgres-test-url.ts";
+import { withTemporaryPostgresDatabase } from "./helpers/postgres-temp-database.ts";
+
+const { Pool } = pg;
+const POSTGRES_URL = dedicatedPostgresTestUrl(
+	process.env.PDPP_TEST_POSTGRES_URL,
+);
+const CONNECTOR_ID = "claude-code";
+const NOW = "2026-10-22T12:00:00.000Z";
+const MIGRATION_HARNESS_TIMEOUT_MS = 25_000;
+const PAGE_HARNESS_TIMEOUT_MS = 12_000;
+
+let tempDbCounter = 0;
+
+function nextDatabaseName(prefix: string): string {
+	tempDbCounter += 1;
+	return `pdpp_test_rh_${prefix}_${process.pid}_${tempDbCounter}`;
+}
+
+function errorMessage(error: unknown): string {
+	return error instanceof Error ? error.message : String(error);
+}
+
+type BootstrapOutcome =
+	| { readonly kind: "returned" }
+	| { readonly kind: "rejected"; readonly error: unknown };
+
+async function observeBootstrapWithinHarness(
+	attempt: Promise<unknown>,
+	timeoutMs: number,
+	releaseBlocker: () => Promise<void>,
+	migration: string,
+): Promise<BootstrapOutcome> {
+	const settled = attempt.then(
+		(): BootstrapOutcome => ({ kind: "returned" }),
+		(error: unknown): BootstrapOutcome => ({ kind: "rejected", error }),
+	);
+	let timer: ReturnType<typeof setTimeout> | undefined;
+	const deadline = new Promise<{ readonly kind: "deadline" }>((resolve) => {
+		timer = setTimeout(() => {
+			void releaseBlocker().then(
+				() => resolve({ kind: "deadline" }),
+				() => resolve({ kind: "deadline" }),
+			);
+		}, timeoutMs);
+	});
+	const outcome = await Promise.race([settled, deadline]);
+	if (timer) {
+		clearTimeout(timer);
+	}
+	if (outcome.kind === "deadline") {
+		let settleTimer: ReturnType<typeof setTimeout> | undefined;
+		const settledAfterRelease = await Promise.race([
+			settled.then(() => true),
+			new Promise<boolean>((resolve) => {
+				settleTimer = setTimeout(() => resolve(false), 5_000);
+			}),
+		]);
+		if (settleTimer) {
+			clearTimeout(settleTimer);
+		}
+		assert.fail(
+			`${migration} exceeded the ${timeoutMs}ms test harness deadline; bootstrap ${settledAfterRelease ? "settled" : "remained pending"} after the test released its lock.`,
+		);
+	}
+	return outcome;
+}
+
+test("PostgreSQL: a run_history default lock timeout fails boot clearly and the next boot repairs it", {
+	skip: POSTGRES_URL ? false : "PDPP_TEST_POSTGRES_URL unset",
+	timeout: 60_000,
+}, async () => {
+	assert.ok(POSTGRES_URL, "Postgres URL is configured when this test runs");
+	await withTemporaryPostgresDatabase(
+		{
+			closeConnections: closePostgresStorage,
+			connectionString: POSTGRES_URL,
+			databaseName: nextDatabaseName("default_lock"),
+		},
+		async (url) => {
+			await initPostgresStorage({ backend: "postgres", databaseUrl: url });
+			await postgresQuery(
+				"ALTER TABLE run_history ALTER COLUMN scheduler_managed SET DEFAULT true",
+			);
+			await closePostgresStorage();
+
+			const blockerPool = new Pool({ connectionString: url });
+			const blocker = await blockerPool.connect();
+			let blockerHeld = false;
+			const releaseBlocker = async () => {
+				if (!blockerHeld) {
+					return;
+				}
+				blockerHeld = false;
+				await blocker.query("ROLLBACK");
+			};
+
+			try {
+				await blocker.query("BEGIN");
+				blockerHeld = true;
+				await blocker.query("SELECT 1 FROM run_history LIMIT 1");
+
+				const attempt = initPostgresStorage({
+					backend: "postgres",
+					databaseUrl: url,
+				});
+				const outcome = await observeBootstrapWithinHarness(
+					attempt,
+					MIGRATION_HARNESS_TIMEOUT_MS,
+					releaseBlocker,
+					"scheduler_managed default repair",
+				);
+				if (outcome.kind !== "rejected") {
+					assert.fail(
+						"bootstrap returned even though the legacy run_history default was not repaired",
+					);
+				}
+				const message = errorMessage(outcome.error);
+				assert.match(
+					message,
+					/run_history scheduler_managed default repair timed out after 3 attempts/i,
+				);
+				assert.match(message, /inspect pg_stat_activity\/pg_locks/i);
+				assert.equal(
+					(
+						await postgresQuery<{ column_default: string | null }>(
+							`SELECT column_default FROM information_schema.columns
+                  WHERE table_schema = current_schema() AND table_name = 'run_history' AND column_name = 'scheduler_managed'`,
+						)
+					).rows[0]?.column_default,
+					"true",
+					"a timed-out ALTER leaves the committed default unchanged",
+				);
+
+				await releaseBlocker();
+				await closePostgresStorage();
+				await initPostgresStorage({ backend: "postgres", databaseUrl: url });
+				assert.equal(
+					(
+						await postgresQuery<{ column_default: string | null }>(
+							`SELECT column_default FROM information_schema.columns
+                  WHERE table_schema = current_schema() AND table_name = 'run_history' AND column_name = 'scheduler_managed'`,
+						)
+					).rows[0]?.column_default,
+					"false",
+					"a later boot repairs the default once the lock is released",
+				);
+			} finally {
+				await releaseBlocker();
+				blocker.release();
+				await blockerPool.end();
+				await closePostgresStorage();
+			}
+		},
+	);
+});
+
+test("PostgreSQL: a locked provenance page keeps its cursor and a later boot resumes it", {
+	skip: POSTGRES_URL ? false : "PDPP_TEST_POSTGRES_URL unset",
+	timeout: 45_000,
+}, async () => {
+	assert.ok(POSTGRES_URL, "Postgres URL is configured when this test runs");
+	await withTemporaryPostgresDatabase(
+		{
+			closeConnections: closePostgresStorage,
+			connectionString: POSTGRES_URL,
+			databaseName: nextDatabaseName("page_lock"),
+		},
+		async (url) => {
+			await initPostgresStorage({ backend: "postgres", databaseUrl: url });
+			await postgresQuery(
+				"DELETE FROM storage_migration_ledger WHERE migration_id = $1",
+				[RUN_HISTORY_DEVICE_RUN_PROVENANCE_MIGRATION_ID],
+			);
+			await postgresQuery(
+				`INSERT INTO run_history(
+             connector_instance_id, connector_id, source_json, status, started_at, completed_at, run_id, scheduler_managed
+           )
+           SELECT 'cin_page_fill', $1, '{}'::jsonb, 'succeeded', $2, $2, 'run-page-fill-' || n, false
+             FROM generate_series(1, 2000) AS n`,
+				[CONNECTOR_ID, NOW],
+			);
+			await postgresQuery(
+				`INSERT INTO run_history(
+             connector_instance_id, connector_id, source_json, status, started_at, completed_at, run_id, scheduler_managed
+           ) VALUES ('cin_page_locked', $1, '{}'::jsonb, 'succeeded', $2, $2, 'run-page-locked', true)`,
+				[CONNECTOR_ID, NOW],
+			);
+			await postgresQuery(
+				`INSERT INTO spine_events(
+             event_id, event_type, occurred_at, recorded_at, scenario_id, trace_id, actor_type, actor_id,
+             object_type, object_id, status, run_id, data_json, version, connector_instance_id
+           ) VALUES ($1, 'run.completed', $2, $2, 'scenario', 'trace', 'local_device', 'actor', 'run',
+             'run-page-locked', 'succeeded', 'run-page-locked', $3::jsonb, '1', 'cin_page_locked')`,
+				[
+					`evt_page_locked_${process.pid}`,
+					NOW,
+					JSON.stringify({ connector_instance_id: "cin_page_locked" }),
+				],
+			);
+			await closePostgresStorage();
+
+			const blockerPool = new Pool({ connectionString: url });
+			const blocker = await blockerPool.connect();
+			let blockerHeld = false;
+			const releaseBlocker = async () => {
+				if (!blockerHeld) {
+					return;
+				}
+				blockerHeld = false;
+				await blocker.query("ROLLBACK");
+			};
+
+			try {
+				await blocker.query("BEGIN");
+				blockerHeld = true;
+				await blocker.query(
+					"SELECT id FROM run_history WHERE run_id = 'run-page-locked' FOR UPDATE",
+				);
+
+				const attempt = initPostgresStorage({
+					backend: "postgres",
+					databaseUrl: url,
+				});
+				const outcome = await observeBootstrapWithinHarness(
+					attempt,
+					PAGE_HARNESS_TIMEOUT_MS,
+					releaseBlocker,
+					"run_history device-run provenance page after id 2000",
+				);
+				if (outcome.kind !== "rejected") {
+					assert.fail(
+						"bootstrap returned without resolving the locked provenance page",
+					);
+				}
+				const message = errorMessage(outcome.error);
+				assert.match(
+					message,
+					/run_history device-run provenance page after id 2000 timed out after 3 attempts/i,
+				);
+
+				const blocked = await postgresQuery<{
+					changed_rows: string;
+					cursor: string | null;
+					status: string;
+				}>(
+					`SELECT status, cursor, changed_rows::text AS changed_rows FROM storage_migration_ledger
+              WHERE migration_id = $1`,
+					[RUN_HISTORY_DEVICE_RUN_PROVENANCE_MIGRATION_ID],
+				);
+				assert.deepEqual(blocked.rows[0], {
+					changed_rows: "0",
+					cursor: "2000",
+					status: "blocked",
+				});
+				assert.equal(
+					(
+						await postgresQuery<{ scheduler_managed: boolean }>(
+							"SELECT scheduler_managed FROM run_history WHERE run_id = 'run-page-locked'",
+						)
+					).rows[0]?.scheduler_managed,
+					true,
+					"the failed page does not partially update its locked row",
+				);
+
+				await releaseBlocker();
+				await closePostgresStorage();
+				await initPostgresStorage({ backend: "postgres", databaseUrl: url });
+				const completed = await postgresQuery<{
+					changed_rows: string;
+					cursor: string | null;
+					status: string;
+				}>(
+					`SELECT status, cursor, changed_rows::text AS changed_rows FROM storage_migration_ledger
+              WHERE migration_id = $1`,
+					[RUN_HISTORY_DEVICE_RUN_PROVENANCE_MIGRATION_ID],
+				);
+				assert.deepEqual(completed.rows[0], {
+					changed_rows: "1",
+					cursor: "2001",
+					status: "complete",
+				});
+				assert.equal(
+					(
+						await postgresQuery<{ scheduler_managed: boolean }>(
+							"SELECT scheduler_managed FROM run_history WHERE run_id = 'run-page-locked'",
+						)
+					).rows[0]?.scheduler_managed,
+					false,
+					"the later boot resumes at the blocked row and repairs it",
+				);
+			} finally {
+				await releaseBlocker();
+				blocker.release();
+				await blockerPool.end();
+				await closePostgresStorage();
+			}
+		},
+	);
+});

From 14364a287c8ba9bfd36b3c2ba2562b5458ce34c8 Mon Sep 17 00:00:00 2001
From: Tim Nunamaker <tnunamak@gmail.com>
Date: Fri, 23 Oct 2026 12:17:30 -0500
Subject: [PATCH 85/87] fix(reference): reconcile run-order counters with
 retained run sequences on boot

A database whose legacy connector_instances rebuild dropped the run-order
columns got run_sequence_issued and storage_epoch re-added at their
defaults while collection_run_sequences kept its rows. The next run start
then reused sequence space, and an older retained run could outrank a
newer one in terminal ordering.

After the foreign-key repair, raise storage_epoch to the highest retained
epoch and run_sequence_issued to the highest retained sequence in that
epoch. Counters only rise, so the step is idempotent and runs every boot.
run_order_sequence is left alone: it records the highest observed
sequence and the next observation sets it.

Assisted-by: AI
Signed-off-by: Tim Nunamaker <tnunamak@gmail.com>
---
 reference-implementation/server/db.ts         | 37 ++++++++
 ...nces-collection-revision-migration.test.ts | 93 ++++++++++++++++++-
 2 files changed, 129 insertions(+), 1 deletion(-)

diff --git a/reference-implementation/server/db.ts b/reference-implementation/server/db.ts
index 1a52fedf2..711861cbc 100644
--- a/reference-implementation/server/db.ts
+++ b/reference-implementation/server/db.ts
@@ -3096,6 +3096,42 @@ function repairCollectionRunSequencesForeignKey(raw: SqliteDatabase): void {
   }
 }
 
+// The legacy rebuilds above can drop run_sequence_issued and storage_epoch, and
+// ensureCollectionRevisionColumns re-adds them at their defaults while
+// collection_run_sequences keeps the sequences already issued. The next run
+// start would then reuse sequence space and an older retained run could
+// outrank it. Raise (never lower) each counter to cover the retained rows.
+// run_order_sequence is left alone: it is the highest OBSERVED sequence, a
+// fresh observation sets it (RUN_ORDER_OBSERVATION), and a stale 0 only means
+// no observation has been recorded yet. Idempotent and a single indexed pass,
+// so it runs on every boot.
+function reconcileRunOrderCounters(raw: SqliteDatabase): void {
+  raw.transaction(() => {
+    raw.exec(`
+      UPDATE connector_instances
+         SET storage_epoch = (
+           SELECT MAX(rs.storage_epoch) FROM collection_run_sequences rs
+            WHERE rs.connector_instance_id = connector_instances.connector_instance_id
+         )
+       WHERE storage_epoch < COALESCE((
+           SELECT MAX(rs.storage_epoch) FROM collection_run_sequences rs
+            WHERE rs.connector_instance_id = connector_instances.connector_instance_id
+         ), 0);
+      UPDATE connector_instances
+         SET run_sequence_issued = (
+           SELECT MAX(rs.run_sequence) FROM collection_run_sequences rs
+            WHERE rs.connector_instance_id = connector_instances.connector_instance_id
+              AND rs.storage_epoch = connector_instances.storage_epoch
+         )
+       WHERE run_sequence_issued < COALESCE((
+           SELECT MAX(rs.run_sequence) FROM collection_run_sequences rs
+            WHERE rs.connector_instance_id = connector_instances.connector_instance_id
+              AND rs.storage_epoch = connector_instances.storage_epoch
+         ), 0);
+    `);
+  })();
+}
+
 function ensureConnectorSummaryEvidenceColumns(raw: SqliteDatabase): void {
   addColumnIfMissing(raw, "connector_summary_evidence", "last_record_updated_at", "TEXT");
   addColumnIfMissing(raw, "connector_summary_evidence", "stream_records_json", "TEXT NOT NULL DEFAULT '[]'");
@@ -6809,6 +6845,7 @@ CREATE INDEX IF NOT EXISTS idx_blob_bindings_record ON blob_bindings(connector_i
   );
   runWithSqliteBusyRetrySync(() => ensureCollectionRevisionColumns(raw));
   runWithSqliteBusyRetrySync(() => repairCollectionRunSequencesForeignKey(raw));
+  runWithSqliteBusyRetrySync(() => reconcileRunOrderCounters(raw));
   runWithSqliteBusyRetrySync(() => migrateRecordRejectionBytePayload(raw));
   runWithSqliteBusyRetrySync(() => migrateConnectorCredentialKindCheck(raw, opts));
   runWithSqliteBusyRetrySync(() => migrateConnectorCredentialStatusRejected(raw, opts));
diff --git a/reference-implementation/test/connector-instances-collection-revision-migration.test.ts b/reference-implementation/test/connector-instances-collection-revision-migration.test.ts
index 552bbcff8..13f78e9bb 100644
--- a/reference-implementation/test/connector-instances-collection-revision-migration.test.ts
+++ b/reference-implementation/test/connector-instances-collection-revision-migration.test.ts
@@ -7,7 +7,10 @@ import os from "node:os";
 import path from "node:path";
 import test from "node:test";
 import { closeDb, initDb } from "../server/db.ts";
-import { issueCollectionRunSequence } from "../server/stores/collection-revision-store.ts";
+import {
+	advanceSqliteCollectionRevisionInTransaction,
+	issueCollectionRunSequence,
+} from "../server/stores/collection-revision-store.ts";
 import { createSqliteConnectorStateStore } from "../server/stores/connector-state-store.ts";
 import Database from "./helpers/sqlite-driver.ts";
 
@@ -260,6 +263,90 @@ test("a previously misdirected run-sequence foreign key is repaired without losi
 	}
 });
 
+function runOrderCounters(db: ReturnType<typeof initDb>) {
+	return db
+		.prepare(
+			`SELECT run_sequence_issued, storage_epoch, run_order_sequence, run_order_run_id
+         FROM connector_instances WHERE connector_instance_id = ?`,
+		)
+		.get(CONNECTOR_INSTANCE_ID);
+}
+
+test("a repaired database keeps run-order counters at or above its retained sequences", async () => {
+	const { directory, path: dbPath } = tempDatabase();
+	try {
+		seedBrokenOrderDatabase(dbPath);
+		const db = initDb(dbPath);
+		try {
+			const repaired = runOrderCounters(db);
+			assert.equal(repaired?.storage_epoch, 1);
+			assert.equal(repaired?.run_sequence_issued, 7);
+
+			const next = await issueCollectionRunSequence({
+				connectorInstanceId: CONNECTOR_INSTANCE_ID,
+				deviceId: "device_1",
+				runId: "run_after_repair",
+				sourceInstanceId: "source_1",
+			});
+			assert.equal(next.issued.runSequence, 8);
+
+			// The older retained run cannot take the run-order marker from the newer one.
+			for (const runId of ["run_after_repair", "run_preserved"]) {
+				db.transaction(() => {
+					advanceSqliteCollectionRevisionInTransaction(
+						db,
+						CONNECTOR_INSTANCE_ID,
+						{ at: "2026-10-22T13:00:00.000Z", event: "terminal_run", runId },
+					);
+				})();
+			}
+			const marker = runOrderCounters(db);
+			assert.equal(marker?.run_order_sequence, 8);
+			assert.equal(marker?.run_order_run_id, "run_after_repair");
+		} finally {
+			closeDb();
+		}
+	} finally {
+		fs.rmSync(directory, { force: true, recursive: true });
+	}
+});
+
+test("run-order reconciliation raises a stale epoch to the retained rows and never lowers a counter", () => {
+	const { directory, path: dbPath } = tempDatabase();
+	try {
+		seedBrokenOrderDatabase(dbPath);
+		const raw = new Database(dbPath);
+		try {
+			raw.exec(
+				`UPDATE collection_run_sequences SET storage_epoch = 3 WHERE run_id = 'run_preserved'`,
+			);
+		} finally {
+			raw.close();
+		}
+		const first = initDb(dbPath);
+		try {
+			assert.equal(runOrderCounters(first)?.storage_epoch, 3);
+			assert.equal(runOrderCounters(first)?.run_sequence_issued, 7);
+			first
+				.prepare(
+					"UPDATE connector_instances SET run_sequence_issued = 20, storage_epoch = 4",
+				)
+				.run();
+		} finally {
+			closeDb();
+		}
+		const second = initDb(dbPath);
+		try {
+			assert.equal(runOrderCounters(second)?.storage_epoch, 4);
+			assert.equal(runOrderCounters(second)?.run_sequence_issued, 20);
+		} finally {
+			closeDb();
+		}
+	} finally {
+		fs.rmSync(directory, { force: true, recursive: true });
+	}
+});
+
 test("fresh collection revision schema and data stay unchanged on a second boot", async () => {
 	const { directory, path: dbPath } = tempDatabase();
 	const onSchemaMigration = () => undefined;
@@ -287,12 +374,16 @@ test("fresh collection revision schema and data stay unchanged on a second boot"
 				.prepare("SELECT * FROM collection_run_sequences ORDER BY run_id")
 				.all();
 			assert.deepEqual(first.prepare("PRAGMA foreign_key_check").all(), []);
+			assert.equal(runOrderCounters(first)?.run_sequence_issued, 1);
+			assert.equal(runOrderCounters(first)?.storage_epoch, 1);
 		} finally {
 			closeDb();
 		}
 
 		const second = initDb(dbPath, { onSchemaMigration });
 		try {
+			assert.equal(runOrderCounters(second)?.run_sequence_issued, 1);
+			assert.equal(runOrderCounters(second)?.storage_epoch, 1);
 			assert.deepEqual(revisionSchema(second), schema);
 			assert.deepEqual(
 				second.prepare("SELECT * FROM connector_state ORDER BY stream").all(),

From 1034303c273d613abb0dcce81822bfdd0ae2a7f5 Mon Sep 17 00:00:00 2001
From: Tim Nunamaker <tnunamak@gmail.com>
Date: Fri, 23 Oct 2026 12:38:34 -0500
Subject: [PATCH 86/87] test(reference): drop the post-deadline real wait from
 the migration deadline harness

The real-wait ratchet (test/real-wait-ratchet.test.ts) failed at 174
against its baseline of 173: the deadline harness raced bootstrap
against a 5-second setTimeout after it had already released the lock.
That timer only shaped the failure message. The harness now awaits the
bootstrap promise directly once the blocker is released (the runner's
per-file timeout bounds it), so teardown never races a running
migration, and the ratchet is back at 173.

Signed-off-by: Tim Nunamaker <tnunamak@gmail.com>
Assisted-by: AI
---
 ...ce-run-provenance-migration-deadlines.test.ts | 16 +++++-----------
 1 file changed, 5 insertions(+), 11 deletions(-)

diff --git a/reference-implementation/test/run-history-device-run-provenance-migration-deadlines.test.ts b/reference-implementation/test/run-history-device-run-provenance-migration-deadlines.test.ts
index 24c6157d2..ec1b23de3 100644
--- a/reference-implementation/test/run-history-device-run-provenance-migration-deadlines.test.ts
+++ b/reference-implementation/test/run-history-device-run-provenance-migration-deadlines.test.ts
@@ -61,18 +61,12 @@ async function observeBootstrapWithinHarness(
 		clearTimeout(timer);
 	}
 	if (outcome.kind === "deadline") {
-		let settleTimer: ReturnType<typeof setTimeout> | undefined;
-		const settledAfterRelease = await Promise.race([
-			settled.then(() => true),
-			new Promise<boolean>((resolve) => {
-				settleTimer = setTimeout(() => resolve(false), 5_000);
-			}),
-		]);
-		if (settleTimer) {
-			clearTimeout(settleTimer);
-		}
+		// The blocker is released above, so bootstrap can now finish; wait for it
+		// (the runner's per-file timeout bounds this) so teardown never races a
+		// still-running migration, then fail with the harness verdict.
+		await settled;
 		assert.fail(
-			`${migration} exceeded the ${timeoutMs}ms test harness deadline; bootstrap ${settledAfterRelease ? "settled" : "remained pending"} after the test released its lock.`,
+			`${migration} exceeded the ${timeoutMs}ms test harness deadline and settled only after the test released its lock.`,
 		);
 	}
 	return outcome;

From 5f3f54e589be134e99eca2bd660983641df7fda9 Mon Sep 17 00:00:00 2001
From: Tim Nunamaker <tnunamak@gmail.com>
Date: Fri, 23 Oct 2026 14:15:14 -0500
Subject: [PATCH 87/87] test(reference): lock the table discovery reads, not
 the one the fold reads first

The statement-timeout cancellation test held ACCESS EXCLUSIVE on connector_instances
and expected discovery's bounded read to be cancelled. Since 2b2cafc278 the
terminal-facts fold, which runs before discovery in a bounded round, reads
connector_instances through listEvidence (canonical source-kind join) with an
unbounded postgresQuery. That read now waited out the 900 ms lock, the 200 ms
round deadline passed, and discovery never started, so the round returned
incomplete with no failureClasses instead of discovery_statement_timeout.

Lock retained_size_connection instead: discovery reads it, the fold does not.
The product behaviour (fold finishes its started unit, no new unit starts after
the deadline, evidence left untouched) is the documented cooperative-deadline
contract, so only the test target changes. No new real waits.

Assisted-by: AI
Signed-off-by: Tim Nunamaker <tnunamak@gmail.com>
---
 ...evidence-statement-timeout-swallow.test.ts | 54 +++++++++++--------
 1 file changed, 32 insertions(+), 22 deletions(-)

diff --git a/reference-implementation/test/connector-summary-evidence-statement-timeout-swallow.test.ts b/reference-implementation/test/connector-summary-evidence-statement-timeout-swallow.test.ts
index 7b1fa7de3..abbe7035c 100644
--- a/reference-implementation/test/connector-summary-evidence-statement-timeout-swallow.test.ts
+++ b/reference-implementation/test/connector-summary-evidence-statement-timeout-swallow.test.ts
@@ -106,20 +106,26 @@ async function cleanup(id: string): Promise<void> {
 }
 
 /**
- * Holds a real `ACCESS EXCLUSIVE` lock on `connector_instances` for
- * `holdMs` on a SEPARATE connection checked out from the app's own pool —
- * genuine PostgreSQL lock contention, not a mock, blocking any concurrent
- * plain `SELECT` against that table for the hold duration (proven directly
- * against `psql` before writing this test). This is what stands in for the
- * production incident's real cause (a slow, unindexed discovery read
- * contending with unrelated heavy I/O): either way, discovery's own
- * `SELECT ... FROM connector_instances` genuinely cannot complete quickly.
+ * Holds a real `ACCESS EXCLUSIVE` lock on `table` for `holdMs` on a SEPARATE
+ * connection checked out from the app's own pool — genuine PostgreSQL lock
+ * contention, not a mock, blocking any concurrent plain `SELECT` against that
+ * table for the hold duration (proven directly against `psql` before writing
+ * this test). This is what stands in for the production incident's real cause
+ * (a slow, unindexed discovery read contending with unrelated heavy I/O):
+ * either way, the discovery read of the locked table genuinely cannot
+ * complete quickly.
+ *
+ * Choose `table` for the statement the test needs to cancel. The terminal-facts
+ * fold runs BEFORE discovery in a bounded round and reads `connector_instances`
+ * (the canonical source-kind join in `listEvidence`) through an unbounded
+ * `postgresQuery`, so a lock on `connector_instances` stalls the fold past the
+ * round deadline and discovery never starts (see the cancellation test below).
  */
-async function withInstanceTableContention<T>(holdMs: number, fn: () => Promise<T>): Promise<T> {
+async function withTableContention<T>(table: string, holdMs: number, fn: () => Promise<T>): Promise<T> {
   const pool = getPostgresPool();
   const lockClient = await pool.connect();
   await lockClient.query("BEGIN");
-  await lockClient.query("LOCK TABLE connector_instances IN ACCESS EXCLUSIVE MODE");
+  await lockClient.query(`LOCK TABLE ${table} IN ACCESS EXCLUSIVE MODE`);
   const release = lockClient.query(`SELECT pg_sleep(${holdMs / 1000})`).then(() => lockClient.query("COMMIT"));
   try {
     // Give the lock a moment to actually be held before the contended call starts.
@@ -153,7 +159,7 @@ test(
       // (routine, since the fold runs first in the same round).
       const { postgresQueryBounded, PostgresStatementTimeoutError } = await import("../server/postgres-storage.ts");
       let caught: unknown = null;
-      await withInstanceTableContention(300, async () => {
+      await withTableContention("connector_instances", 300, async () => {
         try {
           await postgresQueryBounded("SELECT 1 FROM connector_instances WHERE connector_instance_id = $1", [id], 50);
         } catch (err) {
@@ -229,7 +235,7 @@ test(
       // way this test can distinguish the old 50ms floor from the new one
       // (a generous, never-exhausted budget would never floor at all,
       // making the floor value irrelevant to the outcome either way).
-      await withInstanceTableContention(300, () =>
+      await withTableContention("connector_instances", 300, () =>
         reconcileDirtyConnectorSummaryEvidence([id], { maxDurationMs: 200 })
       );
 
@@ -261,15 +267,19 @@ test(
       // `maxDurationMs: 200` is NOT already expired when
       // `runBoundedObservationPhases`'s `canStartWork()` admission checks
       // run (so discovery genuinely starts, unlike an already-past
-      // deadline, which short-circuits before ever calling `discover()`),
-      // but by the time discovery's own query actually executes,
-      // `withInstanceTableContention`'s 900ms of real lock contention has
-      // already been waited on -- so `remainingStatementBudgetMs` floors at
-      // exactly `MIN_STATEMENT_TIMEOUT_MS` and the contended query is
-      // genuinely cancelled by real PostgreSQL (reproduces the exact
-      // production call chain: readPostgresDiscoveryContext ->
-      // postgresQueryBounded -> PostgresStatementTimeoutError ->
-      // discoverCandidates -> observeConnectorSummaryEvidence's catch).
+      // deadline, which short-circuits before ever calling `discover()`).
+      // The lock is on `retained_size_connection`, which discovery reads
+      // (`readPostgresDiscoveryContext`) but the fold that runs first does
+      // not: discovery's earlier statements are uncontended, then its
+      // `retained_size_connection` read blocks, the round deadline has
+      // passed so `remainingStatementBudgetMs` floors at exactly
+      // `MIN_STATEMENT_TIMEOUT_MS`, and the contended query is genuinely
+      // cancelled by real PostgreSQL (reproduces the exact production call
+      // chain: readPostgresDiscoveryContext -> postgresQueryBounded ->
+      // PostgresStatementTimeoutError -> discoverCandidates ->
+      // observeConnectorSummaryEvidence's catch). Locking
+      // `connector_instances` instead would stall the fold's unbounded
+      // `listEvidence` read past the deadline, so discovery would never start.
       const originalError = console.error;
       const logs: string[] = [];
       console.error = (...args: unknown[]) => {
@@ -277,7 +287,7 @@ test(
       };
       let result: Awaited<ReturnType<typeof reconcileDirtyConnectorSummaryEvidence>>;
       try {
-        result = await withInstanceTableContention(900, () =>
+        result = await withTableContention("retained_size_connection", 900, () =>
           reconcileDirtyConnectorSummaryEvidence([id], { maxDurationMs: 200 })
         );
       } finally {