diff --git a/runtime/history/NEWFI-260907-A-PORTAL200-APPLY4DESIGN5.json b/runtime/history/NEWFI-260907-A-PORTAL200-APPLY4DESIGN5.json
new file mode 100644
index 00000000..fe231a2c
--- /dev/null
+++ b/runtime/history/NEWFI-260907-A-PORTAL200-APPLY4DESIGN5.json
@@ -0,0 +1,38 @@
+{
+  "schema_version": 1,
+  "channel": "homelab-runtime",
+  "command_id": "NEWFI-260907-A-PORTAL200-APPLY4DESIGN5",
+  "status": "OK",
+  "rc": 0,
+  "host": "pve01",
+  "mode": "read-only",
+  "component": "newfi-portal200-apply4-local-carrier-recovery5",
+  "started_at_utc": "2026-09-07T20:27:18Z",
+  "finished_at_utc": "2026-09-07T20:27:18Z",
+  "reference_register_checked": true,
+  "reference_sha256": "5a3d8e5154c41cb582a4e0aca68090be1f0138918bf82131a948df326f9d8d66",
+  "error_register_checked": true,
+  "error_register_sha256": "3b09a553ec0f527ed3afeed4753f52a74ee3036045bbfb3c685e9f8af4ba7ba0",
+  "command_sha256": "d8972287e5a04bda3fc17acba988b2651b92ce4193aa3038f19cf27372093f65",
+  "duplicate_failed_command_blocked": false,
+  "block_reason": null,
+  "execution_started": true,
+  "change_declared": false,
+  "result_contract_valid": true,
+  "result_contract_status": null,
+  "result_contract_error": null,
+  "command_rc": 0,
+  "changes_made": false,
+  "rollback_started": false,
+  "rollback_restored": null,
+  "mutation_outcome": "NO_MUTATION",
+  "sanitized": true,
+  "secrets_included": false,
+  "private_addresses_included": false,
+  "raw_evidence_retained_locally": true,
+  "raw_evidence_sha256": "58a32ed77e16ff3fbab7bcfac43e592c6e2daf2a7cf6208e7a229a258b6e3a3f",
+  "sanitized_output_sha256": "58a32ed77e16ff3fbab7bcfac43e592c6e2daf2a7cf6208e7a229a258b6e3a3f",
+  "output_truncated_in_json": false,
+  "full_sanitized_output_url": "https://git.gram1.ru/.well-known/homelab-runtime/latest.txt",
+  "output": "LOCAL_APPLY3_CARRIER_RECOVERY5_BEGIN=true\nCOMMAND_ID=NEWFI-260907-A-PORTAL200-APPLY4DESIGN5\nMUTATION_SCOPE=NONE_READ_ONLY\nLOCAL_MUTATIONS_PERFORMED=NO\nTARGET_OLD_COMMAND_ID=NEWFI-260907-PORTAL200-APPLY3\nSEED_COUNT=41\nSEED_BASENAMES=NEWFI.txt,NEWFI-260907-A-PORTAL200-APPLY4PREP1.stdout.txt,NEWFI-260907-B-PORTAL200-RUNNERCONTRACT2_REMOTE.txt,NEWFI-260907-B-PORTAL200-RUNNERCONTRACT2_STDOUT.txt,NEWFI-260907-B-PORTAL200-RUNNERCONTRACT4_REMOTE.txt,NEWFI-260907-B-PORTAL200-RUNNERCONTRACT4_STDOUT.txt,NEWFI-260907-B-PORTAL200-RUNNERCONTRACT5_REMOTE.txt,NEWFI-260907-B-PORTAL200-RUNNERCONTRACT5_STDOUT.txt,newfi-38-portal200-apply.cmd,newfi-39-portal200-rca1.cmd,newfi-40-plink-portal200-rca.cmd,newfi-41-plink-portal200-rca3.cmd,newfi-45-pageant-portal200-rca4.cmd,newfi-46-portal200-http-rca.cmd,newfi-48-portal200-apply2.cmd,newfi-49-portal200-preflight-rca.cmd,newfi-50-portal200-preflight-tail-rca.cmd,newfi-51-portal200-prod-http-network-rca.cmd,newfi-52-prod-public-http-rca.cmd,newfi-53-public-css-regex-rca.cmd,newfi-54-portal200-apply3.cmd,newfi-55-portal200-apply3-rca.cmd,newfi-56-portal200-apply3-failure-contract-rca.cmd,newfi-57-portal200-contract-rule-rca.cmd,newfi-58-portal200-exact-contract-rca.cmd,newfi-59-portal200-contract-ast-rca.cmd,newfi-60-portal200-import-contract-discovery.cmd,newfi-61-portal200-import-compact-discovery.cmd,newfi-62-xf-addon-rebuild-help.cmd,NEWFI45_PORTAL200_RCA4_REMOTE.txt,NEWFI45_PORTAL200_RCA4_REPORT.txt,NEWFI46_PORTAL200_HTTP_RCA_REMOTE.txt,NEWFI46_PORTAL200_HTTP_RCA_REPORT.txt,NEWFI46_PORTAL200_HTTP_RCA_STDOUT.txt,NEWFI48_PORTAL200_APPLY2_REMOTE.txt,NEWFI54_PORTAL200_APPLY3_REMOTE.txt,NEWFI55_REMOTE.txt,NEWFI55_STDOUT.txt,NEWFI56_REMOTE.txt,NEWFI56_STDOUT.txt,NEWFI_PARALLEL_FULL_HANDOFF_2026-09-07.txt\nSEED_SHA256=869d6fdf2d4ac222d9ab4b83242563676f201e6ab21b84360fa73fc7f9bf7195,240d0fad482deb05c93289edd7ac58a84e34b98fc620d1e924b561aace8630bb,92255a714b86966ab5a15a86d18c6257c6c131b20520a6d2d2443b8fe969e93a,9bffe2728a05e52f03ec52fddfcce229588b6f6cff59e8932d6c8b5ae97c592b,e92d1a64266be86cc8e5441ff9f51e2161e35e00ffd12dce1eb049a4b6437dd0,53c8ea2dc91c33b2872da3974ac5a682cbdc907c9d232a29921b674d490d474e,0b4ba8d2b1eef91c627884071bbcdeea8ad9b4f6c04c8650e44eb468253d15f6,a59a4b7a482a0a39a51e08553749c1f15bcf74d4ba449f6d50caf7a6ba60f9b5,8481b33b162a78f0e1398b69fda50f581ace72f87cdfb2a16fb66ceb67fa4987,34245e3a7c02145e7f11e3c7919385ff955e739a5b278ede66f8ec91499a31e4,a398e89eec09cca84a907876dfe46cf491d8b61c402c1dc4e4ec36eb92167845,11ea567ce0485bd87c5da8292c4d01d55e741a85b75fe0bf5073ca33133055f7,96b2de593d982ef7a5cd09c5618e6aabaac259f896a70cc8f1b476b0c3b16a58,2ce247a8dae973819605d246273b294bf23ce1d118c3e8b92517696caff927c9,f0ad32266492990e58a90991f2d6ae808c3e57c1ad53244bfcd26100e163cd73,2d5a55fbb00e63a280680b312d3eff3e28d524e29e8acf9ee8cae77b7c7d1f2e,fae07cfd5e9196871cd8bec8305262c95ecd09654994675e9a4ac4617d761f99,9aca123af4a9674c2bc10f308a65b622dce616cac17fbfe9b58db3782fbd2d0e,c8e9abf642daba2118f3419a00ceaeb0a0cc9a54ae75575e5e903a8db8fd1c1d,92b919e1b4e0b910da5b8357619d853c5791dc73fb8a70d097563128d7c818e7,573c5c94fe59ed072e094281668ce9847dc4a9882019a2b89d8ba5f190d92176,6c98cb81713e91d9866d264e59c513b8a968c4f52bfbad55450957524600bb10,69d7a46640fd020c0daab39c3195ca77ff777242c22b419f66dfcb69be3a8a23,1f99ab8666c4d51844b8e95bf3768cb1b017921824e9ba8857a6579dfaafb6af,e10dcbd211b75626199ed50dda79f34ae169caef24ba747c74b9c79ddaab509e,3621712ba5fecff93abca54c601f4f176d976a67344a506a92d6de79918f05a5,07d2b88b41b30e90058fa1d389cc52d1ea3b20b557a962f9004db720bfc8d2b0,88b9f92828c1ee19537526a1eea93a52c59bc2f32a7034e45508e53cca2e3667,c8827d2f8b0ddc34771c1c71ffbf517d1bd117dcf36b4d3e5439ae262bc86c32,7fc78755edbeee8c49d3d47e26a723c01ee0e1e6b022b8fd2f70ccacdf8f4338,edba9db8c9ddedb0fe3e727c7ed5a255d1da6de82da722431f3db053abff2f38,3ea9e7e83411127caf13af674570f0ef9ac968b13393b0a173ce1344d6a29cf0,1c91f522bb94d4ce292bb451dd847f394362c0a8f4745ae8823a5eed33e2a10b,cfd23052413cad9d435f9aba290956e93d9191312d568cd1cc69437fc602ad03,474b251535372a61e8be1acf215c1cc2240f8414bdd1c5e03309fd5faa2f8f99,71da2a66224075527d8aa04c1281fdb7a2b9f078d76c349fc05b48a4b803a4c3,f4600697557109030fc188376f1407fc02e4ec2eff2c635d81e2438f8a325fe3,65ff188b6b7bd06f59feca719f4fad6e07ff8304ef157425b162b3928f674d31,5f2eb373b3b37d29dff72b8b7d5cc1346283f7b2de02ae2eb95a229e542c5468,b2968ec8823fa4bb7b3d6fd4a25f25d6a486eb9740ecc6ef362d1b31e5f439b2,869d6fdf2d4ac222d9ab4b83242563676f201e6ab21b84360fa73fc7f9bf7195\nDECODED_LAYER_COUNT=64\nSTRONG_LAYER_COUNT=3\nSOURCE_LAYER_COUNT=9\nCHOSEN_LAYER_COUNT=9\nCANDIDATE_LAYER_1_SOURCE=file:NEWFI.txt\nCANDIDATE_LAYER_1_SHA256=869d6fdf2d4ac222d9ab4b83242563676f201e6ab21b84360fa73fc7f9bf7195\nCANDIDATE_LAYER_1_BYTES=57343\nCANDIDATE_LAYER_1_TEXT_BEGIN\n\nПОЛНЫЙ ПАРАЛЛЕЛЬНЫЙ HANDOFF: NEWFI / PORTAL200\nДата сборки: 2026-09-07\nНазначение: начать работу сразу в двух чатах без повторного восстановления контекста.\n\n===============================================================================\n0. КРИТИЧЕСКОЕ РАЗДЕЛЕНИЕ ПРОЕКТОВ\n===============================================================================\n\nПриложенный handoff второго чата относится к KINGOFWOLK CSP.\n\nKINGOFWOLK:\n- agreed safe CSP stage полностью закрыт;\n- shared counter = 0;\n- final accepted checkpoint = KOW-260907-A-FINAL1;\n- его product-state НЕ переносить в NEWFI.\n\nИз KINGOFWOLK для NEWFI переиспользуются только проверенные operational rules:\n- true-parallel read-only direct bridge;\n- один writer для любых изменений;\n- Pageant -> Plink -> pve01 transport;\n- authority checks;\n- homelab-chat-run contracts;\n- immutable Gitea readback;\n- unique COMMAND_ID;\n- fail-closed drift handling;\n- destructive Git / raw SQL mutation prohibition.\n\nПолный KINGOFWOLK handoff приложен ниже как APPENDIX A.\n\n===============================================================================\n1. АКТИВНЫЙ ПРОЕКТ\n===============================================================================\n\nПроект: NEWFI.\nАктивный участок: Portal200.\n\nСейчас НЕ продолжаем KingOfWolk и НЕ занимаемся Linux.\n\nТекущая рабочая проблема:\nпредыдущая change-команда Portal200 APPLY3 не является accepted checkpoint.\nПосле неё выполнены read-only RCA/discovery шаги.\n\n===============================================================================\n2. AUTHORITATIVE GITEA RUNTIME\n===============================================================================\n\nRuntime repo:\nhomelab-admin/homelab-public-context\n\nBranch:\nassistant-runtime\n\nAuthoritative exact readback:\nruntime/history/<COMMAND_ID>.txt\n\nНе полагаться на generic latest без точного COMMAND_ID.\n\nКлючевые текущие NEWFI checkpoints:\n\nA) NEWFI-260907-PORTAL200-APPLY3\n\nSTATUS=FAIL\nRC=76\nHOST=pve01\nMODE=change\nCOMPONENT=newfi-portal200-deploy\n\nКритично:\nRESULT_CONTRACT_VALID=false\nRESULT_CONTRACT_STATUS=UNKNOWN\nRESULT_CONTRACT_ERROR=INVALID_CONTRACT:ValueError\nCOMMAND_RC=1\nCHANGES_MADE=unknown\nROLLBACK_STARTED=unknown\nROLLBACK_RESTORED=null\nMUTATION_OUTCOME=UNKNOWN\n\nСледствие:\nAPPLY3 НЕЛЬЗЯ считать ни успешным deploy, ни доказанным rollback.\nНе повторять этот COMMAND_ID.\nНе строить следующий change на предположении, что production/staging точно остались\nв старом состоянии.\n\nB) NEWFI-260907-PORTAL200-CONTRACTAST1\n\nSTATUS=OK\nRC=0\nMODE=read-only\nCOMPONENT=newfi-portal200-contract-ast-rca\nCHANGES_MADE=false\nMUTATION_OUTCOME=NO_MUTATION\n\nНазначение:\nread-only RCA runner result-contract / AST после APPLY3.\n\nЭто accepted diagnostic checkpoint.\n\nC) NEWFI-260907-PORTAL200-IMPORTDISC2\n\nSTATUS=OK\nRC=0\nMODE=read-only\nCOMPONENT=newfi-portal200-import-compact-discovery\nCHANGES_MADE=false\nMUTATION_OUTCOME=NO_MUTATION\n\nНазначение:\ncompact read-only discovery import path + runner-contract requirements.\n\nИз опубликованного evidence видно, что runner contract жёстко валидирует как минимум:\n- поддерживаемую version;\n- command_id exact match;\n- status только OK / BLOCKED / FAIL;\n- changes_made обязан быть boolean.\n\nПри APPLY4 не импровизировать contract JSON:\nсначала перечитать CONTRACTAST1/IMPORTDISC2 и runner source.\n\nD) NEWFI-260907-PORTAL200-REBUILDHELP1\n\nSTATUS=OK\nRC=0\nMODE=read-only\nCOMPONENT=newfi-portal200-rebuild-help\nCHANGES_MADE=false\nMUTATION_OUTCOME=NO_MUTATION\n\nКлючевой вывод:\n\nXenForo CLI поддерживает штатный:\nxf:addon-rebuild [options] [--] <id>\n\nArguments:\nid = Add-On ID\n\nOption:\n-f, --force\nSkip verifying that the add-on is rebuildable\n\nСледствие:\nстарый ручной PHP/import loop не должен быть механизмом следующего deploy.\nСледующий candidate должен опираться на штатный XenForo add-on rebuild,\nНО exact Add-On ID сначала должен быть подтверждён read-only evidence.\nНе hardcode Newfi/Portal только по памяти.\n\n===============================================================================\n3. ГЛАВНЫЙ ВЫВОД ПО APPLY3\n===============================================================================\n\nAPPLY3 имеет ДВЕ независимые проблемы, которые нельзя смешивать:\n\n1. RUNNER / PUBLICATION CONTRACT FAILURE\n   Runner отклонил result contract:\n   INVALID_CONTRACT:ValueError.\n\n2. PRODUCT MUTATION STATE НЕ ДОКАЗАН\n   Outer runtime показывает:\n   CHANGES_MADE=unknown\n   ROLLBACK_STARTED=unknown\n   MUTATION_OUTCOME=UNKNOWN\n\nПоэтому правильная последовательность сейчас:\n\nНЕ:\n\"сразу повторить deploy как APPLY4\"\n\nА:\n- параллельно восстановить current prestate;\n- параллельно построить корректный APPLY4 design;\n- change запускать только после read-only PASS prestate.\n\n===============================================================================\n4. ПАРАЛЛЕЛЬНАЯ МОДЕЛЬ ДЛЯ NEWFI\n===============================================================================\n\nИспользовать проверенную KOW concurrency model.\n\nLANE A = SINGLE WRITER / DEPLOY DESIGN\nLANE B = TRUE PARALLEL READ-ONLY AUDITOR\n\nРазрешено одновременно:\n- Lane A читает Git/Gitea/reference и строит новый carrier;\n- Lane B выполняет direct read-only audit;\n- оба читают immutable Gitea history.\n\nЗапрещено:\n- два change одновременно;\n- два git commit/push writer;\n- два application/XenForo mutation path;\n- повтор failed COMMAND_ID;\n- Lane B mutation.\n\nНа момент фактического APPLY4:\nLane A — единственный writer.\nLane B не должен запускать новый state-sensitive snapshot в середине mutation,\nкроме специально спроектированного concurrent monitor с drift guards.\n\n===============================================================================\n5. COMMAND_ID FAMILY ДЛЯ НОВОЙ ПАРАЛЛЕЛЬНОЙ СЕССИИ\n===============================================================================\n\nЧтобы не путать старую историю:\n\nLane A:\nNEWFI-260907-A-PORTAL200-...\n\nLane B:\nNEWFI-260907-B-PORTAL200-...\n\nКаждый attempt:\nновый COMMAND_ID.\n\nНе reuse:\nNEWFI-260907-PORTAL200-APPLY3\nили любой другой failed ID.\n\n===============================================================================\n6. LANE B — ПЕРВАЯ ЗАДАЧА, КОТОРУЮ МОЖНО ЗАПУСКАТЬ СРАЗУ\n===============================================================================\n\nЦель:\nPOST-APPLY3 CURRENT-STATE RECOVERY AUDIT.\n\nТолько read-only.\n\nLane B должен доказать:\n\n1. Authority:\n   /etc/pve/HOMELAB_ASSISTANT_ERROR_REGISTER.md\n   /etc/pve/31_HOMELAB_REFERENCE.md\n   readable + nonempty + прочитаны.\n\n2. Runner:\n   current /usr/local/sbin/homelab-chat-run SHA;\n   exact result-contract schema;\n   duplicate command semantics.\n\n3. Git:\n   authoritative NEWFI repo/worktree;\n   branch;\n   local HEAD;\n   remote HEAD;\n   clean/dirty;\n   relevant Portal200 files + hashes;\n   no unknown local mutation.\n\n4. XenForo environment:\n   exact production/staging VM/CT IDs;\n   exact docroots;\n   exact XenForo versions;\n   service health;\n   current addon list.\n\n5. Exact Portal Add-On ID:\n   resolve from add-on metadata/live XF state.\n   Do not mutate.\n   Candidate methods:\n   - xf:addon-list;\n   - addon.json;\n   - xf_addon read-only SELECT;\n   - existing deployment metadata.\n\n6. Current Portal add-on state:\n   installed/active/version;\n   pending rebuild/install state if observable read-only;\n   relevant cache/code-cache presence;\n   current route behavior.\n\n7. APPLY3 aftermath:\n   whether product files differ from accepted pre-APPLY3 baseline;\n   whether DB/install state changed;\n   whether staging changed;\n   whether production changed;\n   whether rollback evidence exists.\n\n8. Health:\n   Nginx / PHP-FPM / MariaDB / related app services;\n   HTTP codes for important NEWFI routes.\n\n9. DB:\n   SELECT only.\n   No UPDATE/INSERT/DELETE/ALTER.\n\n10. Final decision:\n   ELIGIBLE_FOR_PORTAL200_APPLY4_PREP\n   or exact HOLD_...\n\nLane B output should be bounded and sanitized.\nNo secrets/private credentials.\n\n===============================================================================\n7. LANE A — ПЕРВАЯ ЗАДАЧА, КОТОРУЮ МОЖНО ДЕЛАТЬ ПАРАЛЛЕЛЬНО\n===============================================================================\n\nLane A НЕ должен ждать Lane B, чтобы начать design.\n\nОн может сразу:\n\n1. перечитать:\n   APPLY3\n   CONTRACTAST1\n   IMPORTDISC2\n   REBUILDHELP1\n\n2. перечитать:\n   /etc/pve/HOMELAB_ASSISTANT_ERROR_REGISTER.md\n   /etc/pve/31_HOMELAB_REFERENCE.md\n\n3. найти authoritative NEWFI Git worktree / branch / Portal200 deployment source.\n\n4. построить APPLY4 carrier OFFLINE / PREP ONLY.\n\n5. В APPLY4 заранее исправить:\n   - result contract;\n   - official XenForo rebuild path;\n   - fail-closed prestate;\n   - explicit rollback semantics;\n   - exact mutation accounting;\n   - exact COMMAND_ID;\n   - publication/readback.\n\n6. Не запускать APPLY4 mutation, пока Lane B не подтвердил current-state eligibility.\n\n===============================================================================\n8. APPLY4 — ЧТО ДОЛЖНО БЫТЬ В ДИЗАЙНЕ\n===============================================================================\n\nAPPLY4 не должен быть слепым rerun APPLY3.\n\nОбязательные свойства:\n\nA. PRESTATE\n- authority checks;\n- runner SHA;\n- exact Git local/remote/clean;\n- exact expected source bytes/hashes;\n- exact current Portal add-on state;\n- services healthy;\n- target environment identity;\n- no unexplained post-APPLY3 drift.\n\nB. ADD-ON IMPORT / REBUILD\n- use native XenForo command:\n  xf:addon-rebuild <CONFIRMED_ADDON_ID>\n- use -f only if evidence/design shows it is needed;\n- do not return to manual PHP import loop.\n\nC. RESULT CONTRACT\nMust match runner schema exactly.\nAt minimum:\n- supported version;\n- exact command_id;\n- status in OK/BLOCKED/FAIL;\n- changes_made boolean;\n- rollback fields with correct types.\nDo not emit unknown where boolean is required.\n\nD. FAIL CLOSED\nIf prestate is not exact:\nBLOCKED / no mutation.\n\nE. ROLLBACK\nBefore mutation:\n- prove rollback target/material exists;\n- preserve previous product/app state;\n- rollback on any failed verification;\n- verify rollback result.\n\nF. VERIFICATION\nAfter candidate:\n- XenForo CLI exit;\n- add-on version/state;\n- relevant DB rows read-only;\n- routes;\n- services;\n- XenForo error log;\n- no unexpected file drift.\n\nG. GIT\nIf Git promotion belongs in this Portal200 stage:\n- one writer;\n- explicit path staging;\n- git diff --check;\n- no git add .;\n- no reset --hard;\n- no git clean -fd;\n- no force push;\n- verify local == remote after push.\n\nH. PUBLICATION\nExact runtime/history/<CID>.txt must be readable and match COMMAND_ID.\n\n===============================================================================\n9. ЧТО НЕЛЬЗЯ ДЕЛАТЬ\n===============================================================================\n\n- Не считать APPLY3 успешным.\n- Не считать APPLY3 rollback успешным.\n- Не reuse APPLY3 ID.\n- Не запускать raw SQL mutation.\n- Не запускать manual PHP import loop, пока native rebuild доказан.\n- Не hardcode add-on ID без live/source evidence.\n- Не делать git reset --hard.\n- Не делать git clean -fd.\n- Не force push.\n- Не запускать два writer.\n- Не принимать generic latest как authoritative без exact COMMAND_ID.\n- Не использовать KOW VM/IP/path как NEWFI environment.\n- Не переносить KOW product state в NEWFI.\n\n===============================================================================\n10. WINDOWS / SSH TRANSPORT — ПЕРЕИСПОЛЬЗУЕМ ИЗ KOW\n===============================================================================\n\nPlink:\nC:\\Program Files\\PuTTY\\plink.exe\n\nPageant:\nC:\\Program Files\\PuTTY\\pageant.exe\n\nSSH key:\n<USERPROFILE>\\Documents\\ssh\\homelab_ed25519.ppk\n\nEncrypted PPK.\n<REDACTED_SENSITIVE_LINE>\n\nNormal transport:\n\nCMD\n -> PowerShell 5.1\n -> Start-Process\n -> Plink -batch -agent -ssh -P 22 -m <remotePath>\n -> root@<PRIVATE_IPV4>\n -> pve01\n -> direct read-only bridge OR homelab-chat-run\n -> Gitea runtime publication\n -> exact immutable readback\n\nDo not use:\n- MobaXterm;\n- -i in normal carrier;\n- pause;\n- Notepad;\n- blind host-key acceptance.\n\nPowerShell:\nseparate stdout/stderr;\n-NoNewWindow;\n-Wait;\n-PassThru;\nreal ExitCode.\n\nRemote command file:\nUTF-8 no BOM;\none physical line;\nSHA verified.\n\nLarge payload:\nzlib + base64;\nSHA256;\npython3 -I -B.\n\n===============================================================================\n11. AUTHORITY CHECKS\n===============================================================================\n\nПеред серьёзной server command:\n\n/etc/pve/HOMELAB_ASSISTANT_ERROR_REGISTER.md\n/etc/pve/31_HOMELAB_REFERENCE.md\n\nОба:\nreadable;\nnonempty;\nпрочитать.\n\nVisibly emit:\n\nERROR_REGISTER_CHECK=OK\nREFERENCE_CHECK=OK\nAUTHORITY_CHECK_SCOPE=READABILITY_ONLY_INCIDENTS_NOT_CLOSED\n\nFail -> STOP.\n\n===============================================================================\n12. GITEA READBACK\n===============================================================================\n\nAuthoritative:\n\nhttps://git.gram1.ru/homelab-admin/homelab-public-context/raw/branch/assistant-runtime/runtime/history/<COMMAND_ID>.txt\n\nJSON, если нужен:\n\nhttps://git.gram1.ru/homelab-admin/homelab-public-context/raw/branch/assistant-runtime/runtime/history/<COMMAND_ID>.json\n\nНельзя делать вывод по runtime/latest.txt,\nесли COMMAND_ID не совпадает.\n\n===============================================================================\n13. КАК СИНХРОНИЗИРОВАТЬ ДВА ЧАТА\n===============================================================================\n\nПосле каждого accepted checkpoint:\n\n1. чат публикует exact COMMAND_ID;\n2. второй чат читает immutable Gitea history;\n3. оба обновляют общий current-state;\n4. FAIL/RCA не считать product progress;\n5. PASS read-only может закрывать audit/preflight;\n6. mutation checkpoint только Lane A.\n\nЕсли Lane A сделал change:\nLane B перед следующим audit обязан заново прочитать этот exact checkpoint.\n\nЕсли Lane B обнаружил HOLD:\nLane A не запускает mutation до разбора HOLD.\n\n===============================================================================\n14. PROMPT ДЛЯ ЧАТА A — SINGLE WRITER\n===============================================================================\n\nТы LANE A / SINGLE WRITER для NEWFI Portal200.\n\nИспользуй Gitea assistant-runtime как machine truth.\nНе занимайся KingOfWolk: KOW CSP agreed stage уже CLOSED.\n\nCurrent NEWFI checkpoints:\n- APPLY3 FAIL, invalid result contract, mutation outcome UNKNOWN.\n- CONTRACTAST1 OK read-only.\n- IMPORTDISC2 OK read-only.\n- REBUILDHELP1 OK read-only.\n- native XenForo command xf:addon-rebuild [options] <id> подтверждён.\n\nТвоя задача:\nпараллельно с Lane B спроектировать NEWFI Portal200 APPLY4,\nно НЕ запускать mutation, пока Lane B не вернёт\nELIGIBLE_FOR_PORTAL200_APPLY4_PREP.\n\nAPPLY4:\n- новый unique COMMAND_ID family NEWFI-260907-A-PORTAL200-...\n- exact authority checks;\n- current-state preconditions;\n- correct homelab-chat-run result contract;\n- native xf:addon-rebuild with exact live-confirmed add-on ID;\n- fail closed;\n- rollback proof;\n- verification;\n- single writer;\n- exact Gitea publication/readback.\n\nПеред каждой реальной mutation заново прочитай последние Lane A + Lane B checkpoints.\n\n===============================================================================\n15. PROMPT ДЛЯ ЧАТА B — READ-ONLY AUDITOR\n===============================================================================\n\nТы LANE B / STRICT READ-ONLY AUDITOR для NEWFI Portal200.\n\nНикаких Git/application/DB/production mutations.\n\nИспользуй proven bridge:\ndirect read-only phase outside homelab-chat-run;\nserialized sanitized publication through runner.\n\nCOMMAND_ID family:\nNEWFI-260907-B-PORTAL200-...\n\nСразу выполни post-APPLY3 current-state recovery audit:\n\n- authority checks;\n- runner SHA + contract;\n- authoritative Git local/remote/clean;\n- exact NEWFI staging/prod identity;\n- exact XenForo docroot/version;\n- exact Portal Add-On ID;\n- installed/version/rebuildable state;\n- APPLY3 aftermath;\n- file/source hashes;\n- service health;\n- relevant HTTP routes;\n- XF error log state;\n- read-only DB evidence;\n- no mutation.\n\nFinal decision:\nELIGIBLE_FOR_PORTAL200_APPLY4_PREP\nor exact HOLD_...\n\nПубликуй bounded sanitized evidence в immutable Gitea history.\nПосле публикации сообщи exact COMMAND_ID.\n\n===============================================================================\n16. РЕКОМЕНДУЕМЫЙ СТАРТ СЕЙЧАС\n===============================================================================\n\nЛучший быстрый порядок:\n\nNOW:\n- текущий чат = Lane A;\n- новый второй чат = Lane B.\n\nОдновременно:\nLane A готовит APPLY4 design.\nLane B снимает current-state recovery audit.\n\nКогда Lane B PASS:\nLane A сверяет immutable evidence и запускает единственный change APPLY4.\n\nПосле APPLY4:\nLane B выполняет независимый read-only post-change verification,\nесли это реально добавляет evidence и не дублирует уже встроенный rollback/canary.\n\n===============================================================================\n17. COUNTER / ROADMAP\n===============================================================================\n\nНе использовать KingOfWolk counter.\nУ KOW counter = 0 и scope закрыт.\n\nДля NEWFI ранее использовалась рабочая оценка оставшихся команд,\nно её нельзя считать authoritative runtime state без восстановления NEWFI roadmap.\n\nПервый Lane B recovery audit должен также найти/проверить текущую NEWFI roadmap/\naccepted-stage count, если он хранится в repo/reference.\n\nДо этого не печатать ложный точный countdown.\n\n===============================================================================\n18. SOURCE-OF-TRUTH PRIORITY\n===============================================================================\n\nПри конфликте:\n\n1. /etc/pve/HOMELAB_ASSISTANT_ERROR_REGISTER.md\n2. /etc/pve/31_HOMELAB_REFERENCE.md\n3. exact immutable Gitea runtime/history/<CID>.txt\n4. authoritative Git source/current live state\n5. этот handoff\n\nЭтот handoff ускоряет старт, но не перекрывает более свежий live/Gitea evidence.\n\n===============================================================================\nAPPENDIX A\nПОЛНЫЙ HANDOFF ИЗ ВТОРОГО ЧАТА: KINGOFWOLK CSP\n(сохранён целиком; используется для operational/concurrency rules, не как NEWFI product-state)\n===============================================================================\n\n\nПОЛНЫЙ HANDOFF: KINGOFWOLK CSP\nДата контекста: 2026-09-07\n\n1. СТАТУС ПРОЕКТА НА МОМЕНТ HANDOFF\n\nПроект: KingOfWolk forum CSP.\n\nShared counter:\n0 команд до полного финиша.\n\nВажно: 0 означает, что согласованный безопасный CSP-stage полностью завершён и подтверждён evidence. Это не означает, что CSP доведён до теоретически максимальной жёсткости.\n\nОтдельно оставлены будущие hardening-задачи:\n- удаление style-src 'unsafe-inline';\n- рефакторинг существующего javascript: URL;\n- перевод script-src-elem из Report-Only в enforcing после достаточного периода наблюдения.\n\nФинальный accepted checkpoint:\n\nKOW-260907-A-FINAL1\nSTATUS=OK\nRC=0\nDECISION=KINGOFWOLK_CSP_AGREED_STAGE_FINAL_EVIDENCE_CLOSED\n\nФинальный canary не внёс изменений в production.\n\n\n2. CANONICAL KINGOFWOLK ENVIRONMENT\n\nФорум:\n\nDomain:\nhttps://kingofwolk.ru\n\nForum VM:\nVM160\nhost: pve02\nIP: <PRIVATE_IPV4>\n\nXenForo:\n2.3.12\nXF id: 2031270\n\nDatabase:\nxf_kingofwolk\n\nDocument root:\n/var/www/forums/kingofwolk/public\n\nXF source:\n/var/www/forums/kingofwolk/src/XF\n\nИз ранее принятого baseline:\n\nboardActive = 1\nboard title = KingOfWolk\nstyle id = 2\nstyle name = KingOfWolk Dark\n\nCAPTCHA = Cloudflare Turnstile\nfriendly URLs = enabled\nthird-party add-ons = none\n\nusers = 2\nadmins = 1\nnodes = 13\nthreads = 73\nposts = 73\nattachments = 0\nXF errors = 0\n\nOrigin-side services были healthy:\n\nNginx\nMariaDB\nphp8.3-fpm\n\nCSP реализуется на edge, а не origin XenForo.\n\n\n3. EDGE / NPMPLUS\n\nEdge находится на:\n\nVM130\nhost: pve03\n\nNPMplus:\n\ncontainer: npmplus\nimage: zoeyvid/npmplus:2026-06-17-b1\n\nLive KingOfWolk proxy config:\n\n/opt/npmplus/nginx/proxy_host/996.conf\n\nMetadata:\n\nowner: root:root\nmode: 0644\n\nCSP collector log:\n\n/opt/npmplus/csp-reports/kingofwolk-csp-report.log\n\nLog metadata:\n\nroot:root\n0600\n\nDirectory:\n\n0700\n\nCollector endpoint:\n\n/__csp-report-v1\n\nSemantics:\n\nGET  -> 405\nAllow -> POST\n\nCollector поддерживает:\n\napplication/csp-report\napplication/reports+json\napplication/json\n\nCollector sanitizes:\n- script-sample;\n- query/fragment у URI.\n\nRotation threshold:\n\n>= 5 MiB\n\nФинальный canary снова подтвердил:\n\ncollector GET = 405\nAllow = POST\n\n\n4. GIT — AUTHORITATIVE SOURCE\n\nИспользуемый repo:\n\nhomelab-admin/homelab-ops\n\nИзолированный CSP worktree:\n\n/root/kingofwolk-csp-baseline-20260907\n\nBranch:\n\nforum/kingofwolk-csp-baseline-20260907\n\nНе использовать /srv/homelab-ops для изменений KingOfWolk CSP.\nИсторически он был dirty/diverged и использовался только как reference.\n\nClone-local Git identity:\n\nuser.name  = homelab-ops-bootstrap\nuser.email = root@pve01.gram1.ru\n\nТекущий финальный accepted HEAD:\n\n6f584c5faa76d0067b08977aeb583fa0e4de14aa\n\nParent:\n\n3e5d8584ae6887c292cc910c5796e73d8d20aecd\n\nCommit message:\n\ncsp(kingofwolk): stage script nonce and enforce font media\n\nТекущий source file:\n\ndeploy/forums/kingofwolk/edge/996.conf\n\nТекущий source SHA / production edge SHA:\n\n458c2cf0763e4790f7d2d3757efd883b25813a31aab4e8dce6f785b8dea48a6e\n\nФинальный canary подтвердил:\n\nGit local HEAD  = 6f584c5faa76d0067b08977aeb583fa0e4de14aa\nGit remote HEAD = 6f584c5faa76d0067b08977aeb583fa0e4de14aa\nworktree clean  = true\n\nИ edge до/после финального canary оставался:\n\n458c2cf0763e4790f7d2d3757efd883b25813a31aab4e8dce6f785b8dea48a6e\n\n\n5. ИСТОРИЯ ACCEPTED GIT CSP COMMITS\n\nПоследовательность основных accepted commits:\n\n6908d4ebf2552244a68e3c0990fdc3a219c05d2c\ninitial CSP baseline docs\n\nf8d1ae6981df35f25d09a41392bc0a26742b7f38\nJoyPixels Report-Only allowance\n\n34f9c76c5cbf81f9cdf7f50d1ac501cf870abc9c\nminimal structural enforcement source\n\nc7a8a68a74fd3eb74cfb708b6bd3b866159b4899\ncsp(kingofwolk): enforce same-origin form submissions\n\nЕго source SHA:\n\n834973af57263b326ca6aee52b2ecb3fa2cf0fb486e5a77a62d4210395b8d9c3\n\nСледующий:\n\ne4635c9997801a0ea65aad727270c88ee3bdb817\ncsp(kingofwolk): enforce PWA self sources\n\nSource SHA:\n\n28e855ff56c4844768f0e8606fe0edc2acb3f548a5c06fa15c0d80ae00e2bc1b\n\nСледующий:\n\n3e5d8584ae6887c292cc910c5796e73d8d20aecd\ncsp(kingofwolk): enforce image and network sources\n\nSource SHA:\n\nfc9fb1dbdb6141bfb43a8122dcf3db435a94da48d0a0c02fe9dfae019b1439c5\n\nФинальный текущий commit:\n\n6f584c5faa76d0067b08977aeb583fa0e4de14aa\ncsp(kingofwolk): stage script nonce and enforce font media\n\nSource SHA:\n\n458c2cf0763e4790f7d2d3757efd883b25813a31aab4e8dce6f785b8dea48a6e\n\n\n6. ТЕКУЩИЙ PRODUCTION ENFORCING CSP\n\nФинальный enforcing CSP:\n\nbase-uri 'self';\nobject-src 'none';\nframe-ancestors 'self';\nform-action 'self';\nworker-src 'self';\nmanifest-src 'self';\nimg-src 'self' data: blob: https://cdn.jsdelivr.net/joypixels/assets/8.0/png/unicode/64/;\nconnect-src 'self' https://challenges.cloudflare.com;\nframe-src 'self' https://challenges.cloudflare.com;\nfont-src 'self' data:;\nmedia-src 'self';\n\nВ одной строке:\n\nbase-uri 'self'; object-src 'none'; frame-ancestors 'self'; form-action 'self'; worker-src 'self'; manifest-src 'self'; img-src 'self' data: blob: https://cdn.jsdelivr.net/joypixels/assets/8.0/png/unicode/64/; connect-src 'self' https://challenges.cloudflare.com; frame-src 'self' https://challenges.cloudflare.com; font-src 'self' data:; media-src 'self';\n\nЧто намеренно НЕ enforcing:\n\ndefault-src\nscript-src\nscript-src-elem\nscript-src-attr\nstyle-src\nstyle-src-elem\nstyle-src-attr\n\nТакже enforcing policy не содержит:\n\n'unsafe-inline'\n'unsafe-eval'\n\nЭто намеренно: script/style hardening ещё не переведён в production enforcement.\n\n\n7. ТЕКУЩИЙ PRODUCTION REPORT-ONLY CSP\n\nSource-template на edge содержит Nginx variable $request_id.\n\nЛогическая policy:\n\ndefault-src 'self';\nbase-uri 'self';\nobject-src 'none';\nframe-ancestors 'self';\nform-action 'self';\n\nscript-src 'self' 'unsafe-inline' https://challenges.cloudflare.com;\n\nscript-src-elem\n    'self'\n    'nonce-$request_id'\n    https://challenges.cloudflare.com;\n\nstyle-src 'self' 'unsafe-inline';\n\nimg-src\n    'self'\n    data:\n    blob:\n    https://cdn.jsdelivr.net/joypixels/assets/8.0/png/unicode/64/;\n\nfont-src 'self' data:;\n\nconnect-src\n    'self'\n    https://challenges.cloudflare.com;\n\nframe-src\n    'self'\n    https://challenges.cloudflare.com;\n\nworker-src 'self';\nmanifest-src 'self';\nmedia-src 'self';\n\nreport-uri /__csp-report-v1;\n\nТочная source-строка:\n\ndefault-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'self'; form-action 'self'; script-src 'self' 'unsafe-inline' https://challenges.cloudflare.com; script-src-elem 'self' 'nonce-$request_id' https://challenges.cloudflare.com; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: https://cdn.jsdelivr.net/joypixels/assets/8.0/png/unicode/64/; font-src 'self' data:; connect-src 'self' https://challenges.cloudflare.com; frame-src 'self' https://challenges.cloudflare.com; worker-src 'self'; manifest-src 'self'; media-src 'self'; report-uri /__csp-report-v1;\n\nПри HTTP response $request_id уже заменён Nginx на фактический per-request nonce.\n\n\n8. NGINX NONCE TRANSPORT\n\nТекущий source также содержит transport для nonce-инъекции.\n\nКлючевые строки:\n\nproxy_set_header Accept-Encoding \"\";\nsub_filter_once off;\nsub_filter '<script' '<script nonce=\"$request_id\"';\n\nЗачем отключено upstream compression:\n\nsub_filter должен видеть HTML body в несжатом виде.\n\nДо production promotion был отдельно доказан forwarded-origin request:\n\nHTTP = 200\nContent-Encoding = NONE\n\nNonce source:\n\n$request_id\n\nВ Report-Only header используется:\n\n'nonce-$request_id'\n\nВ HTML тот же $request_id инъектируется в каждый <script> tag.\n\n\n9. ФИНАЛЬНЫЙ NONCE EVIDENCE\n\nФинальный checkpoint:\n\nKOW-260907-A-FINAL1\n\nпроверил HTML маршруты дважды:\n\n/\n /login/\n /register/\n /help/smilies/\n /threads/dobro-pozhalovat-na-ofitsial-nyi-forum-kingofwolk.1/\n\nДля каждого запроса проверялось:\n\nHTTP = 200\nровно один nonce в CSP Report-Only\nnonce не содержит literal $\nnonce имеет допустимый формат\nкаждый <script> имеет ровно один nonce\nnonce каждого <script> == nonce из response CSP header\nraw nonce count == parsed script count\n\nДополнительно:\n\nnonce не должен повторяться между двумя запросами одного route\nnonce не должен совпадать ни с одним nonce других canary requests\n\nФинальный результат:\n\nKOWAFINAL1_NONCE_UNIQUE_ACROSS_ALL_REQUESTS=true\nKOWAFINAL1_NONCE_VALUES_EXPORTED=NO\n\nТо есть сами nonce наружу не публиковались.\n\n\n10. CSP REPORT LOG BASELINE\n\nПринятый baseline:\n\nSHA256:\n2f7977cbfaed7953bd70033c0cf92138eedf974f5886fadf4b4971f2d00a4143\n\nlines:\n2\n\nИсторически в нём:\n\nline 1 = synthetic test\nline 2 = historical real JoyPixels violation до allow-list\n\nЭтот baseline не менялся через:\n\n- PWA stage;\n- img/connect/frame stage;\n- nonce design;\n- font/media promotion;\n- production Stage2;\n- финальный browser/evidence canary.\n\nФинальный результат:\n\nKOWAFINAL1_NEW_CSP_REPORTS_AFTER_FINAL_BROWSER_CANARY=0\n\nNPMplus:\n\nbefore = healthy\nafter  = healthy\n\n\n11. ДРУГИЕ SECURITY HEADERS\n\nОни не менялись и финальный canary проверил их exact match.\n\nX-Frame-Options:\nSAMEORIGIN\n\nX-Content-Type-Options:\nnosniff\n\nReferrer-Policy:\nstrict-origin-when-cross-origin\n\nStrict-Transport-Security:\nmax-age=31536000\n\nPermissions-Policy:\ngeolocation=(), microphone=(), camera=()\n\nРанее жёлтые browser console warnings были связаны с Permissions-Policy, а не с CSP.\n\n\n12. JOYPIXELS\n\nРазрешён только path-scoped источник:\n\nhttps://cdn.jsdelivr.net/joypixels/assets/8.0/png/unicode/64/\n\nНе разрешён весь:\n\nhttps://cdn.jsdelivr.net\n\nРанее dedicated evidence:\n- реальный historical CSP report указывал JoyPixels;\n- /help/smilies/ реально использует этот path;\n- bad JoyPixels path count = 0.\n\nФинальный canary:\n\nKOWAFINAL1_JOYPIXELS_RENDERED_REF_COUNT=32\nKOWAFINAL1_JOYPIXELS_SAMPLE_HTTP=200\n\n\n13. CLOUDFLARE TURNSTILE\n\nTurnstile остаётся обязательной runtime зависимостью для регистрации.\n\nНужные разрешения сохранены:\n\nscript:\nhttps://challenges.cloudflare.com\n\nconnect:\nhttps://challenges.cloudflare.com\n\nframe:\nhttps://challenges.cloudflare.com\n\nВ текущем enforcing уже есть:\n\nconnect-src 'self' https://challenges.cloudflare.com;\nframe-src 'self' https://challenges.cloudflare.com;\n\nВ Report-Only script policies также Cloudflare разрешён.\n\nКритически важный урок:\n\nне требовать статический <script src=\"https://challenges.cloudflare.com/...\"> в исходном HTML.\n\nTurnstile может быть динамически instantiated.\n\nИменно из-за неправильного static-script требования ранее упал:\n\nKOW-260907-A-ICF5\n\nс:\n\nTURNSTILE_SCRIPT_REF_MISSING\n\nПосле исправления модели:\n\nKOW-260907-A-ICF6\n\nбыл accepted.\n\nФинальный canary проверял наличие Turnstile/challenges runtime tokens на /register/, а не статический script tag.\n\n\n14. FORM-ACTION\n\nЭтап полностью закрыт ранее.\n\nEnforcing:\n\nform-action 'self'\n\nПеред promotion были проверены:\n\nexternal public form origins = 0\npayment profiles = 0\nuser upgrades = 0\nprovider/options related external forms = 0\n\nProduction apply был с rollback proof и browser/server canary.\n\nНе пересматривать без новой фактической причины.\n\n\n15. PWA DIRECTIVES\n\nПолностью accepted:\n\nworker-src 'self'\nmanifest-src 'self'\n\nЗакрыты checkpoints:\n\nPWA3 audit\nPWA4 preflight\nPWA5 Git promotion\nPWA6 production + rollback proof\nPWA9 final recovery/readback\n\nИсторический transport bug:\n\nPWA7 browser canary сам по себе был PASS,\nно outer publication сломался.\n\nPWA8 RCA:\npublisher ошибочно ожидал evidence path в sys.argv[1].\n\nПосле этого правило:\n\npublisher должен использовать literal evidence path, а не рассчитывать, что sys.argv[1] содержит путь.\n\n\n16. IMG/CONNECT/FRAME STAGE\n\nПолностью закрыт.\n\nТекущие enforcing directives:\n\nimg-src 'self' data: blob: https://cdn.jsdelivr.net/joypixels/assets/8.0/png/unicode/64/;\n\nconnect-src 'self' https://challenges.cloudflare.com;\n\nframe-src 'self' https://challenges.cloudflare.com;\n\nКлючевые accepted checkpoints:\n\nKOW-260907-A-ICF2\nSTATUS=OK\nDECISION=ELIGIBLE_FOR_IMG_CONNECT_FRAME_SOURCE_PREP\n\nEvidence:\n\nCSS bytes scanned = 297724\nstylesheets = 9\nCSS url refs = 245\norigins = DATA / SELF\n\nGit promotion:\n\nKOW-260907-A-ICF3\n\nCommit:\n\n3e5d8584ae6887c292cc910c5796e73d8d20aecd\n\nProduction apply:\n\nKOW-260907-A-ICF4\n\nRollback proof passed.\n\nBrowser recovery:\n\nKOW-260907-A-ICF6\nDECISION=IMG_CONNECT_FRAME_ENFORCEMENT_POST_BROWSER_CANARY_CLEAN\n\n\n17. INLINE SCRIPT/STYLE AUDIT — ИСХОДНЫЕ ВЫВОДЫ\n\nДо nonce stage:\n\nrendered nonce attrs = 0\nnative nonce source signals = 0\n\nKOW-260907-A-INLINE1 показал по 5 guest routes:\n\nexternal_scripts = 35\n\ninline executable scripts = 5\ninline non-executable scripts = 3\ninline script tags total = 8\n\nstyle attributes = 31\n\njavascript: URLs = 6 occurrences\ndistinct javascript: values later narrowed to 1\n\nevent-handler attrs = 0\n\nscript nonce attrs = 0\nstyle nonce attrs = 0\nstyle tags = 0\n\nОсновной decision:\n\nHOLD_UNSAFE_INLINE_APPLICATION_NONCE_HASH_DESIGN_REQUIRED\n\n\n18. ПОЧЕМУ СТАТИЧЕСКИЕ HASHES ДЛЯ INLINE SCRIPTS БЫЛИ ОТКЛОНЕНЫ\n\nKOW-260907-A-INLINE2:\n\nSTATUS=OK\nRC=0\n\nDECISION=\nAPPLICATION_TEMPLATE_REFACTOR_DESIGN_REQUIRED\n\nБыло установлено:\n\nEXEC_SCRIPTS_WITH_DYNAMIC_MARKERS=5\nGLOBAL_DISTINCT_EXEC_SCRIPT_BODIES=5\nGLOBAL_DISTINCT_STYLE_ATTR_VALUES=7\nGLOBAL_DISTINCT_JAVASCRIPT_URLS=1\nGLOBAL_DISTINCT_EVENT_HANDLER_VALUES=0\n\nТо есть все 5 executable inline scripts имеют динамические признаки.\n\nПоэтому:\n- хеширование уже rendered script bodies не использовать;\n- не публиковать и не хешировать dynamic rendered inline values;\n- nonce оказался более подходящим механизмом для <script> elements.\n\n\n19. STYLE ATTRIBUTES\n\nБыло обнаружено:\n\n31 style attributes\n7 distinct style attribute values\n\nОни оказались стабильными между guest renders и не сработал secretish gate.\n\nНо removal style-src 'unsafe-inline' не включён в текущий завершённый scope.\n\nПричина:\n\nnonce работает для <style> / <script> elements, но не решает обычные style=\"\" attributes.\n\nПотенциальные будущие пути:\n- template/application refactor style attrs;\n- либо отдельный строго доказанный style-src-attr / 'unsafe-hashes' design.\n\nНа текущем production:\n\nReport-Only:\nstyle-src 'self' 'unsafe-inline';\n\nEnforcing style-src отсутствует.\n\n\n20. JAVASCRIPT: URLS\n\nИсходно:\n\n6 occurrences\n1 distinct value\nevent handlers = 0\n\nВ процессе анализа было решено:\n\nJAVASCRIPT_URL_DESIGN=\nAPPLICATION_REFACTOR_REQUIRED_NOT_HASH_ALLOWLIST\n\nТо есть javascript: URL не закрывается текущей CSP-stage через hash allowlist.\n\nБыло выполнено source mapping на VM160 по:\n\n/var/www/forums/kingofwolk/internal_data/code_cache/templates\n/var/www/forums/kingofwolk/src/XF\n/var/www/forums/kingofwolk/public/js\n\nRaw javascript: value наружу не публиковался.\n\nТекущий статус:\n\ndeferred application refactor.\n\n\n21. EDGE NONCE DESIGN SEQUENCE И HARNESS FAILURES\n\nВо время разработки nonce-stage было несколько не product failures, которые важно не путать с production regressions.\n\nKOW-260907-A-INLINE3\n\nSTATUS=FAIL\nRC=23\n\nFailed step:\n\norigin_compression\n\nError:\n\norigin_compression:RC_2\n\nПричина:\n\nprobe зависел от Python внутри guest/runtime path\n\nProduct mutation:\n\nNO\n\n\nKOW-260907-A-INLINE4\n\nSTATUS=FAIL\nRC=23\n\nFailed step:\n\ntransform_and_hash_candidates\n\nError:\n\n'str' object has no attribute 'decode'\n\nПричина — чистый harness bug:\n- transformed HTML уже был str;\n- helper повторно вызывал .decode().\n\nДо падения подтвердилось:\n\nGit clean\nNPMplus healthy\nnginx sub module compiled = true\nnginx version = 1.31.2\n\nproxy_pass count = 1\norigin gzip = gzip\norigin identity = NONE\nHTTP = 200\n\n\nKOW-260907-A-INLINE5\n\nSTATUS=FAIL\nRC=23\n\nFailed step:\n\nnginx_nonce_syntax_probe_tempfile\n\nError:\n\nEPHEMERAL_PROBE_FILE_NOT_CLEANED\n\nЭто был слишком строгий/неправильный cleanup harness.\n\nProduct mutation не было.\n\n\nKOW-260907-A-INLINE6\n\nSTATUS=FAIL\nRC=23\n\nFailed step:\n\nvm160_jsurl_source_map\n\nError:\n\nqout() got an unexpected keyword argument 'timeout'\n\nОпять чистый harness bug.\n\nДо падения уже было подтверждено:\n\ndistinct javascript URLs = 1\ndistinct style attrs = 7\nevent handlers = 0\nGit clean\nproduction exact\nstale probe files = 0\n\n\nKOW-260907-A-INLINE7\n\nRecovery без повторения всего INLINE6.\n\nSTATUS=OK\nRC=0\n\nОн прочитал evidence INLINE6 и выполнил только недостающий VM160 source-map.\n\nDecision:\n\nHOLD_NONCE_STYLE_HASH_DESIGN\n\nНо единственный HOLD был:\n\nUPSTREAM_IDENTITY_PROBE_NOT_CLEAN\n\nПочему:\n\ndirect upstream ответил:\n\nHTTP=301\nContent-Encoding=NONE\n\nТо есть compression уже был в порядке; harness ошибочно требовал именно HTTP==200.\n\n\nKOW-260907-A-INLINE8\n\nИсправил probe с правильными forwarded headers.\n\nРезультат:\n\nSTATUS=OK\nRC=0\n\nFORWARDED_IDENTITY_200_OK=true\nFORWARDED_IDENTITY_TRANSPORT_OK=true\n\nHOLD_REASONS=[]\n\nDECISION=\nELIGIBLE_FOR_STAGED_SCRIPT_ELEM_NONCE_SOURCE_PREP\n\nЭто финально закрыло nonce design.\n\n\n22. LANE B — FONT/MEDIA\n\nLane B выполнил независимый read-only audit.\n\nAccepted checkpoint:\n\nKOW-260907-B-FONTMEDIA4\nSTATUS=OK\nRC=0\n\nDECISION=\nELIGIBLE_FOR_FONT_MEDIA_SOURCE_PREP\n\nПодтверждено:\n\nnative media attachments = 0\nXFMG media = 0\n[MEDIA] content = 0\nboard URL = https://kingofwolk.ru\n\nПри этом наличие media-site capability не считалось само по себе runtime requirement.\n\nLane B после этого прекратил новые checkpoints.\n\nLane A стал единственным writer.\n\n\n23. FONT/MEDIA FINAL POLICY\n\nПосле независимого Lane B audit и дополнительной precommit verification были enforcing добавлены:\n\nfont-src 'self' data:;\nmedia-src 'self';\n\nНа финальном canary:\n\nFONT_ORIGINS=[]\n\nдля непосредственно проверенных текущих страниц, то есть никаких новых внешних font runtime origins выявлено не было.\n\nРанее dedicated audit уже доказал допустимость SELF/DATA.\n\nRendered media origins также не потребовали дополнительного allow-list.\n\n\n24. KOW-260907-A-STAGE1 — GIT PROMOTION\n\nКоманда:\n\nKOW-260907-A-STAGE1\nMODE=change\nCOMPONENT=kingofwolk-csp-font-media-nonce-stage-git-promotion\n\nВыполнила перед mutation:\n\n- exact Git branch/head/remote/clean checks;\n- production old edge SHA check;\n- CSP log baseline;\n- NPMplus health;\n- font/media audit;\n- route checks;\n- DB read-only media checks;\n- repository validation;\n- unit tests.\n\nПосле этого построила exact candidate:\n\n1. enforcement:\n\n+ font-src 'self' data:;\n+ media-src 'self';\n\n2. Report-Only:\n\n+ script-src-elem 'self' 'nonce-$request_id' https://challenges.cloudflare.com;\n\n3. transport:\n\nproxy_set_header Accept-Encoding \"\";\nsub_filter_once off;\nsub_filter '<script' '<script nonce=\"$request_id\"';\n\nНе менялись:\n\nstyle-src 'unsafe-inline'\nbase script-src 'unsafe-inline'\njavascript: behavior\n\nRepository validation:\n\nPASS\n\nTests:\n\nPASS\n\nНовый Git HEAD:\n\n6f584c5faa76d0067b08977aeb583fa0e4de14aa\n\nНовый source SHA:\n\n458c2cf0763e4790f7d2d3757efd883b25813a31aab4e8dce6f785b8dea48a6e\n\nLocal == remote.\n\nВо время Stage1 production оставался на старом SHA.\n\n\n25. KOW-260907-A-STAGE2 — PRODUCTION APPLY\n\nKOW-260907-A-STAGE2\nSTATUS=OK\nRC=0\nMODE=change\nRESULT_CONTRACT_STATUS=OK\nCHANGES_MADE=true\n\nПеред apply были проверены:\n\nrunner SHA\nGit branch/head/parent/message\nsource exact bytes\nproduction old SHA\nlive file owner/mode\nCSP log baseline\nNPMplus health\nnginx -t\npublic old CSP exact\n\nRunner baseline SHA:\n\nb248a4c32c9cc64e5747e7dce6c7fc0a23f5124a77c71ce72e27a81aceae9d2d\n\nStage2 sequence:\n\nPhase 1 — APPLY1\n\nУстановлен новый candidate.\n\nПроверены:\n- nginx -t;\n- reload;\n- routes;\n- exact enforcing CSP;\n- dynamic Report-Only nonce;\n- каждый HTML <script> получил nonce;\n- nonce == header nonce;\n- CSP log baseline;\n- NPMplus health.\n\nPhase 2 — ROLLBACK PROOF\n\nProduction вернули к старому:\n\nfc9fb1dbdb6141bfb43a8122dcf3db435a94da48d0a0c02fe9dfae019b1439c5\n\nПроверены old policies, routes, отсутствие nonce injection, health/log.\n\nRollback proof:\n\nPASS\n\nPhase 3 — FINAL REAPPLY\n\nCandidate применён повторно.\n\nФинальный edge:\n\n458c2cf0763e4790f7d2d3757efd883b25813a31aab4e8dce6f785b8dea48a6e\n\nGit не drifted.\n\nИтоговая reason:\n\nFONT_MEDIA_ENFORCED_AND_SCRIPT_ELEM_NONCE_REPORT_ONLY_STAGED_WITH_ROLLBACK_PROOF\n\n\n26. PRODUCTION ROLLBACK ARTIFACT\n\nStage2 создал manual rollback backup в NPMplus VM/container filesystem:\n\n/opt/npmplus/manual-backups/kingofwolk-csp-font-media-nonce-stage-20260907-6f584c5/\n\nOld config:\n\n996.conf.before\n\nOld SHA:\n\nfc9fb1dbdb6141bfb43a8122dcf3db435a94da48d0a0c02fe9dfae019b1439c5\n\nТакже stage directory использовался для candidate copy.\n\nЕсли когда-либо потребуется ручной emergency rollback, сначала всё равно заново проверить текущий live state и не предполагать, что этот backup всё ещё является правильной rollback target после будущих изменений.\n\n\n27. KOW-260907-A-FINAL1 — ФИНАЛЬНЫЙ EVIDENCE CLOSURE\n\nSTATUS=OK\nRC=0\nMODE=read-only\nCHANGES_MADE=false\n\nDecision:\n\nKINGOFWOLK_CSP_AGREED_STAGE_FINAL_EVIDENCE_CLOSED\n\nClosure scope:\n\nAGREED_SAFE_CSP_STAGE\n\nПроверено:\n\n- Git exact local/remote/clean;\n- source SHA exact;\n- production edge SHA exact;\n- edge metadata 0:0:644;\n- CSP log baseline before;\n- NPMplus healthy;\n- nginx -t;\n- пять HTML routes по два запроса;\n- /service_worker.js;\n- /webmanifest.php;\n- exact security headers;\n- exact enforcing CSP;\n- exact dynamic Report-Only CSP;\n- unique nonce across requests;\n- nonce coherence для всех <script>;\n- JoyPixels rendered refs + HTTP sample;\n- fonts;\n- media origins;\n- Turnstile signal;\n- collector 405/POST;\n- CSP log baseline after;\n- production SHA after;\n- Git state after.\n\nФинал:\n\nNEW_CSP_REPORTS_AFTER_FINAL_BROWSER_CANARY=0\nNONCE_UNIQUE_ACROSS_ALL_REQUESTS=true\nNPMPLUS_HEALTH_AFTER=healthy\n\n\n28. CURRENT FINAL HASHES / IDENTIFIERS — БЫСТРЫЙ БЛОК\n\nGit repo:\n/root/kingofwolk-csp-baseline-20260907\n\nBranch:\nforum/kingofwolk-csp-baseline-20260907\n\nCurrent HEAD:\n6f584c5faa76d0067b08977aeb583fa0e4de14aa\n\nParent:\n3e5d8584ae6887c292cc910c5796e73d8d20aecd\n\nCurrent source:\ndeploy/forums/kingofwolk/edge/996.conf\n\nCurrent source / production edge SHA:\n458c2cf0763e4790f7d2d3757efd883b25813a31aab4e8dce6f785b8dea48a6e\n\nPrevious production SHA:\nfc9fb1dbdb6141bfb43a8122dcf3db435a94da48d0a0c02fe9dfae019b1439c5\n\nCSP report log SHA:\n2f7977cbfaed7953bd70033c0cf92138eedf974f5886fadf4b4971f2d00a4143\n\nCSP report log lines:\n2\n\nRunner SHA:\nb248a4c32c9cc64e5747e7dce6c7fc0a23f5124a77c71ce72e27a81aceae9d2d\n\n\n29. OPERATIONAL COMMAND CONTRACT\n\nЛюбая новая server command по этому проекту должна сначала читать:\n\n/etc/pve/HOMELAB_ASSISTANT_ERROR_REGISTER.md\n/etc/pve/31_HOMELAB_REFERENCE.md\n\nИ visibly emit:\n\nERROR_REGISTER_CHECK=OK\nREFERENCE_CHECK=OK\nAUTHORITY_CHECK_SCOPE=READABILITY_ONLY_INCIDENTS_NOT_CLOSED\n\nОбычно shell:\n\nroot@pve01:~#\n\nGit discipline:\n\nПеред любым change:\n\ngit status\nbranch\nlocal HEAD\nremote HEAD\n\nFail closed при неизвестном drift.\n\nДо commit:\n\ngit diff --check\n\nStaging:\n\ngit add <explicit path>\n\nНе использовать:\n\ngit add .\n\nПосле staging:\n\ngit diff --cached --check\ngit diff --cached\n\nПосле push:\n\ngit fetch\nLOCAL_HEAD == REMOTE_HEAD\n\nЗапрещённый destructive workflow:\n\ngit reset --hard\ngit clean -fd\nforce push\n\nТакже:\n\nне мутировать XenForo state raw SQL.\n\nRead-only SQL допустим.\n\n\n30. CONCURRENCY / LANE MODEL\n\nБыла доказана настоящая параллельность read-only lanes через direct bridge.\n\nCheckpoint:\n\nKOW-260907-PBR2\n\nDecision:\n\nALLOW_TRUE_PARALLEL_READ_ONLY_LANES\n\nПри этом обычные full runner carriers сериализуются из-за flock.\n\nCheckpoint:\n\nKOW-260907-CONC1\n\nПоэтому правила:\n\nread-only direct bridge:\nможет работать параллельно\n\nGit commit/push:\nровно один writer\n\nedge production apply:\nровно один writer\n\nXenForo/app mutation:\nровно один writer\n\nСейчас Lane B закончен.\n\nЕсли CSP scope снова открыть:\n\nтекущий чат/следующий оператор должен оставаться единственным writer.\n\n\n31. WINDOWS TRANSPORT\n\nСтандартный transport:\n\n.CMD\n  -> Windows PowerShell 5.1\n  -> Plink\n  -> Pageant\n  -> SSH pve01\n  -> direct bridge или homelab-chat-run\n  -> Gitea publication\n  -> readback\n\nPuTTY:\n\nC:\\Program Files\\PuTTY\\plink.exe\nC:\\Program Files\\PuTTY\\pageant.exe\n\nPPK:\n\n<USERPROFILE>\\Documents\\ssh\\homelab_ed25519.ppk\n\nPPK encrypted:\naes256-cbc\n\n<REDACTED_SENSITIVE_LINE>\n\n<REDACTED_SENSITIVE_LINE>\n\nНормальный carrier:\n\nplink\n-batch\n-agent\n-ssh\n-P 22\n-m <remotePath>\nroot@<PRIVATE_IPV4>\n\nНе использовать обычным carrier:\n\n-i\n\nPageant должен уже держать unlocked key.\n\nEndpoint:\n\npve01\nroot@<PRIVATE_IPV4>:22\n\nPuTTY registry host key:\n\nHKCU:\\Software\\SimonTatham\\PuTTY\\SshHostKeys\n\nssh-ed25519@22:<PRIVATE_IPV4>\n\n\n32. CARRIER IMPLEMENTATION RULES\n\nPowerShell запускает Plink через:\n\nStart-Process\n\nОбязательно:\n\nseparate stdout\nseparate stderr\nreal ExitCode\n-NoNewWindow\n\nНе использовать:\n\npause\nnotepad\nMobaXterm\n\nTemp diagnostics:\n\n%TEMP%\n\nRemote command file:\n\nUTF-8\nno BOM\none physical line\nSHA verified\n\nБольшие payloads:\n\nzlib + base64\nSHA256 verification\n/usr/bin/python3 -I -B\n\nКаждый attempt:\n\nновый COMMAND_ID\n\nНе reuse failed ID.\n\nRunner:\n\n/usr/local/sbin/homelab-chat-run <CID> read-only|change <component> -- <command>\n\nChange result contract:\n\nOK\nBLOCKED\nFAIL\n\n\n33. GITEA RUNTIME PUBLICATION / READBACK\n\nRuntime repo:\n\nhomelab-admin/homelab-public-context\n\nBranch:\n\nassistant-runtime\n\nAuthoritative history path:\n\nruntime/history/<COMMAND_ID>.txt\n\nГлавное правило:\n\nне доверять generic latest без проверки COMMAND_ID.\n\nExact history конкретного command ID — authoritative.\n\nFast latest может вернуть unrelated/stale result.\n\n\n34. НЕДАВНИЕ .CMD ARTIFACTS ИЗ ЭТОГО ЧАТА\n\nПоследовательность последних команд:\n\nKOW-260907-A-INLINE2\nKOW_CSP_INLINE_HASH_FEASIBILITY_AUDIT_PLINK_GITEA_MOSCOW.cmd\n\nKOW-260907-A-INLINE3\nKOW_CSP_EDGE_NONCE_UNSAFE_HASHES_FEASIBILITY_PLINK_GITEA_MOSCOW.cmd\n\nKOW-260907-A-INLINE4\nKOW_CSP_EDGE_NONCE_UNSAFE_HASHES_FEASIBILITY2_PLINK_GITEA_MOSCOW.cmd\n\nKOW-260907-A-INLINE5\nKOW_CSP_EDGE_NONCE_UNSAFE_HASHES_FINAL_FEASIBILITY_PLINK_GITEA_MOSCOW.cmd\n\nKOW-260907-A-INLINE6\nKOW_CSP_EDGE_NONCE_STYLE_HASH_JSURL_DESIGN_AUDIT_PLINK_GITEA_MOSCOW.cmd\n\nKOW-260907-A-INLINE7\nKOW_CSP_INLINE6_RECOVERY_JSURL_SOURCE_MAP_PLINK_GITEA_MOSCOW.cmd\n\nKOW-260907-A-INLINE8\nKOW_CSP_SCRIPT_ELEM_NONCE_DESIGN_CLOSURE_PLINK_GITEA_MOSCOW.cmd\n\nKOW-260907-A-STAGE1\nKOW_CSP_FONT_MEDIA_NONCE_STAGE_GIT_PROMOTION_PLINK_GITEA_MOSCOW.cmd\n\nKOW-260907-A-STAGE2\nKOW_CSP_FONT_MEDIA_NONCE_STAGE_PRODUCTION_PLINK_GITEA_MOSCOW.cmd\n\nKOW-260907-A-FINAL1\nKOW_CSP_FINAL_BROWSER_EVIDENCE_CLOSURE_PLINK_GITEA_MOSCOW.cmd\n\nНе нужно повторно запускать их для «проверки», если нет новой причины.\nПри новом scope создавать новые IDs.\n\n\n35. ЧТО НЕ НАДО ПОВТОРЯТЬ СЛЕДУЮЩЕМУ ОПЕРАТОРУ\n\nУже закрыто, не делать заново без новой фактической причины:\n\nform-action audit\nPWA worker/manifest audit\nimg-src audit\nconnect-src audit\nframe-src audit\nJoyPixels path audit\nTurnstile static-script search\nfont-src/media-src discovery\ninline hash feasibility\nnonce feasibility\nupstream identity/compression feasibility\nfont/media Git promotion\nfont/media production promotion\nrollback proof\nfinal browser/evidence closure\n\nОсобенно:\n\nне повторять KOW-260907-B-FONTMEDIA4.\n\nLane B audit уже accepted.\n\n\n36. ЧТО ОСТАЁТСЯ ТОЛЬКО КАК FUTURE HARDENING\n\nЭто не незавершённые команды текущего counter.\n\nТекущий counter:\n\n0\n\nFuture scope можно открыть отдельно.\n\n\nA. script-src-elem enforcement\n\nСейчас:\n\nReport-Only only\n\nNonce транспорт уже работает и финально доказан.\n\nСледующий возможный будущий шаг — только после периода наблюдения CSP report log:\n\nперенести script-src-elem nonce policy в enforcing\n\nНо до этого надо заново проверить:\n\n- log не накопил реальные violations;\n- authenticated flows;\n- Turnstile;\n- admin/Account overlays, если входят в scope;\n- все важные XenForo page types.\n\n\nB. style-src 'unsafe-inline'\n\nСейчас всё ещё Report-Only:\n\nstyle-src 'self' 'unsafe-inline'\n\nПричина — style attributes.\n\nИсходное evidence:\n\n31 occurrences\n7 distinct values\n\nНужен отдельный application/template design.\n\n\nC. javascript: refactor\n\nЕсть:\n\n1 distinct javascript: value\nнесколько rendered occurrences\n\nНе разрешать это через сомнительный hash workaround.\n\nПринятый design:\n\nAPPLICATION_REFACTOR_REQUIRED_NOT_HASH_ALLOWLIST\n\n\n37. ТОЧКА СТАРТА ДЛЯ НОВОГО ЧАТА\n\nНовый чат должен считать canonical current state следующим:\n\nKINGOFWOLK CSP AGREED SAFE STAGE = CLOSED\n\nshared counter = 0\n\ncurrent Git HEAD:\n6f584c5faa76d0067b08977aeb583fa0e4de14aa\n\ncurrent edge/source SHA:\n458c2cf0763e4790f7d2d3757efd883b25813a31aab4e8dce6f785b8dea48a6e\n\nCSP log SHA:\n2f7977cbfaed7953bd70033c0cf92138eedf974f5886fadf4b4971f2d00a4143\n\nCSP log lines:\n2\n\nNPMplus:\nhealthy\n\nfinal accepted checkpoint:\nKOW-260907-A-FINAL1\n\nfinal decision:\nKINGOFWOLK_CSP_AGREED_STAGE_FINAL_EVIDENCE_CLOSED\n\nЕсли пользователь просит «продолжить CSP», сначала надо считать, что открывается новый hardening scope, потому что прежний shared counter уже завершён.\n\nНаиболее логичный новый порядок:\n\n1. read-only observation / authenticated coverage для script-src-elem Report-Only\n2. javascript: application refactor design\n3. style attribute refactor/hash design\n4. только затем новый enforcement promotion с отдельным rollback proof\n\nНо ничего из этого не является долгом старого плана.\n\n\n38. КОРОТКАЯ ИТОГОВАЯ ФОРМУЛИРОВКА ДЛЯ ВСТАВКИ В НОВЫЙ ЧАТ\n\nKingOfWolk CSP agreed safe stage полностью закрыт. Shared counter = 0.\nФинальный accepted checkpoint KOW-260907-A-FINAL1, STATUS=OK, RC=0,\nDECISION=KINGOFWOLK_CSP_AGREED_STAGE_FINAL_EVIDENCE_CLOSED.\n\nТекущий Git HEAD:\n6f584c5faa76d0067b08977aeb583fa0e4de14aa\n\nBranch:\nforum/kingofwolk-csp-baseline-20260907\n\nWorktree:\n/root/kingofwolk-csp-baseline-20260907\n\nSource:\ndeploy/forums/kingofwolk/edge/996.conf\n\nSource/production edge SHA:\n458c2cf0763e4790f7d2d3757efd883b25813a31aab4e8dce6f785b8dea48a6e\n\nCSP log baseline SHA:\n2f7977cbfaed7953bd70033c0cf92138eedf974f5886fadf4b4971f2d00a4143\n\nCSP log:\n2 строки\n\nНовых reports после финального browser-canary:\n0\n\nNPMplus:\nhealthy\n\nEnforcing сейчас закрывает:\nbase-uri\nobject-src\nframe-ancestors\nform-action\nworker-src\nmanifest-src\nimg-src\nconnect-src\nframe-src\nfont-src\nmedia-src\n\nscript-src-elem с per-request $request_id nonce находится только в Report-Only.\nNginx добавляет тот же nonce каждому <script> через sub_filter.\nФинальный canary доказал unique nonce per request и полную header↔script coherence.\n\nstyle-src 'unsafe-inline', существующий javascript: URL и перевод script-src-elem в enforcing оставлены как отдельный будущий hardening scope.\n\nLane B KOW-260907-B-FONTMEDIA4 accepted и не должен повторяться.\n\nЛюбой новый change:\n- один writer;\n- authority checks;\n- exact Git/source/edge/log prestate;\n- explicit staging;\n- rollback proof;\n- новый COMMAND_ID.\n\n\n39. ОСНОВНЫЕ AUTHORITATIVE EVIDENCE URLS\n\nФинальный evidence:\nhttps://git.gram1.ru/homelab-admin/homelab-public-context/raw/branch/assistant-runtime/runtime/history/KOW-260907-A-FINAL1.txt\n\nProduction apply:\nhttps://git.gram1.ru/homelab-admin/homelab-public-context/raw/branch/assistant-runtime/runtime/history/KOW-260907-A-STAGE2.txt\n\nGit promotion:\nhttps://git.gram1.ru/homelab-admin/homelab-public-context/raw/branch/assistant-runtime/runtime/history/KOW-260907-A-STAGE1.txt\n\nLane B font/media:\nhttps://git.gram1.ru/homelab-admin/homelab-public-context/raw/branch/assistant-runtime/runtime/history/KOW-260907-B-FONTMEDIA4.txt\n\nNonce design closure:\nhttps://git.gram1.ru/homelab-admin/homelab-public-context/raw/branch/assistant-runtime/runtime/history/KOW-260907-A-INLINE8.txt\n\nInline feasibility:\nhttps://git.gram1.ru/homelab-admin/homelab-public-context/raw/branch/assistant-runtime/runtime/history/KOW-260907-A-INLINE2.txt\n\nImg/connect/frame final recovery:\nhttps://git.gram1.ru/homelab-admin/homelab-public-context/raw/branch/assistant-runtime/runtime/history/KOW-260907-A-ICF6.txt\n\nImg/connect/frame production:\nhttps://git.gram1.ru/homelab-admin/homelab-public-context/raw/branch/assistant-runtime/runtime/history/KOW-260907-A-ICF4.txt\n\nCANDIDATE_LAYER_1_TEXT_END\nCANDIDATE_LAYER_2_SOURCE=file:newfi-54-portal200-apply3.cmd::b64::zlib\nCANDIDATE_LAYER_2_SHA256=97a1807a275e5d309591f7a7e044d7d56ba5b2f4c6a068df6353bae147707184\nCANDIDATE_LAYER_2_BYTES=34155\nCANDIDATE_LAYER_2_TEXT_BEGIN\nimport hashlib\nimport json\nimport pathlib\nimport shlex\nimport shutil\nimport subprocess\nimport sys\nimport xml.etree.ElementTree as ET\n\nCID = \"NEWFI-260907-PORTAL200-APPLY3\"\nBRANCH = \"implementation/newfi-closed-mvp-20260906\"\nOLD_HEAD = \"06bab5acd124e768f70305b3d7eca2f595871890\"\nWT = pathlib.Path(\"/root/newfi-portal/.worktrees/implementation-newfi-closed-mvp-20260906\")\nCAND_ROOT = pathlib.Path(\"/root/newfi-portal200-candidate/src/addons/Newfi/Portal\")\nPORTAL_REL = pathlib.Path(\"src/addons/Newfi/Portal\")\nGIT_PORTAL = WT / PORTAL_REL\nEXPECTED_NEW = {\n    \"Pub/Controller/Portal.php\": (363, \"619d489f7cc3b461479c702fa8825097ae22d3c6cfeb911e9f14ea1de9c36d6d\"),\n    \"Service/PortalData.php\": (5213, \"4da03f26294ab6d163a1a746dee4bb6a82d7d4f39e66b24246bc0eb4c455dd1d\"),\n    \"_data/templates.xml\": (10977, \"1650c3d868d4bc47703f1b75f1f179cd25309b2d3b20a2b848e81a4423c00861\"),\n}\nEXPECTED_OLD = {\n    \"Pub/Controller/Portal.php\": (247, \"53909e753ea5a011550fd280ad1c342a74ca9949be092dfbd95244243cae92f3\"),\n    \"_data/templates.xml\": (1461, \"c29c04f8b937284e821c87957653e87c2f6ac014fac30648a0f6b18e84392adf\"),\n}\nEXPECTED_GIT_PATHS = [str(PORTAL_REL / p) for p in sorted(EXPECTED_NEW)]\nBACKUP = f\"/root/newfi-portal200-backup-{CID}\"\n\n\nclass PortalError(RuntimeError):\n    pass\n\n\ndef emit(key, value=None):\n    if value is None:\n        print(key, flush=True)\n    elif isinstance(value, (dict, list, tuple, bool, int, float)):\n        print(\n            key + \"=\" + json.dumps(value, ensure_ascii=False, sort_keys=True, separators=(\",\", \":\")),\n            flush=True,\n        )\n    else:\n        print(key + \"=\" + str(value), flush=True)\n\n\ndef fail(code):\n    raise PortalError(code)\n\n\ndef sha_bytes(data):\n    return hashlib.sha256(data).hexdigest()\n\n\ndef file_meta(path):\n    data = pathlib.Path(path).read_bytes()\n    return len(data), sha_bytes(data)\n\n\ndef run(cmd, *, input_bytes=None, timeout=180, ok=(0,)):\n    try:\n        p = subprocess.run(\n            cmd,\n            input=input_bytes,\n            stdout=subprocess.PIPE,\n            stderr=subprocess.PIPE,\n            timeout=timeout,\n            check=False,\n        )\n    except subprocess.TimeoutExpired:\n        fail(\"SUBPROCESS_TIMEOUT\")\n    if p.returncode not in ok:\n        fail(\"SUBPROCESS_RC\")\n    return p\n\n\ndef git(*args, ok=(0,), timeout=120):\n    p = run([\"/usr/bin/git\", \"-C\", str(WT), *args], timeout=timeout, ok=ok)\n    return p.stdout.decode(\"utf-8\", \"replace\").strip()\n\n\ndef qga(target, argv, *, input_bytes=None, timeout=180):\n    if target == \"prod\":\n        cmd = [\n            \"/usr/sbin/qm\",\n            \"guest\",\n            \"exec\",\n            \"210\",\n            \"--synchronous\",\n            \"1\",\n            \"--timeout\",\n            str(timeout),\n        ]\n        if input_bytes is not None:\n            cmd += [\"--pass-stdin\", \"1\"]\n        cmd += [\"--\", *argv]\n    elif target == \"staging\":\n        q = [\n            \"/usr/sbin/qm\",\n            \"guest\",\n            \"exec\",\n            \"211\",\n            \"--synchronous\",\n            \"1\",\n            \"--timeout\",\n            str(timeout),\n        ]\n        if input_bytes is not None:\n            q += [\"--pass-stdin\", \"1\"]\n        q += [\"--\", *argv]\n        remote = (\n            \"test \\\"$(id -u):$(hostname -s)\\\" = 0:pve03 || exit 72; \"\n            \"for f in /etc/pve/HOMELAB_ASSISTANT_ERROR_REGISTER.md /etc/pve/31_HOMELAB_REFERENCE.md; do \"\n            \"test -r \\\"$f\\\" && test -s \\\"$f\\\" && cat -- \\\"$f\\\" >/dev/null || exit 73; done; exec \"\n            + \" \".join(shlex.quote(x) for x in q)\n        )\n        cmd = [\n            \"/usr/bin/ssh\",\n            \"-T\",\n            \"-o\",\n            \"BatchMode=yes\",\n            \"-o\",\n            \"StrictHostKeyChecking=yes\",\n            \"-o\",\n            \"UpdateHostKeys=no\",\n            \"-o\",\n            \"ConnectTimeout=10\",\n            \"-o\",\n            \"ConnectionAttempts=1\",\n            \"root@pve03\",\n            remote,\n        ]\n    else:\n        fail(\"BAD_TARGET\")\n\n    p = run(cmd, input_bytes=input_bytes, timeout=timeout + 30)\n    try:\n        data = json.loads(p.stdout.decode(\"utf-8\"))\n    except Exception:\n        fail(\"QGA_JSON\")\n    if data.get(\"exited\") not in (1, True) or data.get(\"exitcode\") != 0:\n        fail(\"QGA_GUEST_RC\")\n    if data.get(\"out-truncated\") or data.get(\"err-truncated\"):\n        fail(\"QGA_TRUNCATED\")\n    return data.get(\"out-data\", \"\")\n\n\nINSPECT_PHP = r'''<?php\n$root = '/var/www/forums/newfi/public';\nrequire $root . '/src/XF.php';\n\\XF::start($root);\n$app = \\XF::setupApp('XF\\\\Pub\\\\App');\n$db = $app->db();\nfunction srcMeta(string $path): ?array {\n    if (!is_file($path)) { return null; }\n    return ['bytes' => filesize($path), 'sha256' => hash_file('sha256', $path)];\n}\n$portal = $root . '/src/addons/Newfi/Portal';\n$templates = $db->fetchAll(\n    \"SELECT title, style_id, LENGTH(template) AS bytes, SHA2(template,256) AS sha256, \" .\n    \"LOCATE('data-newfi-portal200', template) > 0 AS html_marker, \" .\n    \"LOCATE('--newfi-portal200', template) > 0 AS css_marker \" .\n    \"FROM xf_template WHERE addon_id='Newfi/Portal' ORDER BY style_id,title\"\n);\n$result = [\n 'hostname' => gethostname(),\n 'application' => [\n  'boardActive' => (string)$db->fetchOne(\"SELECT option_value FROM xf_option WHERE option_id='boardActive'\"),\n  'boardUrl' => (string)$db->fetchOne(\"SELECT option_value FROM xf_option WHERE option_id='boardUrl'\"),\n  'indexRoute' => (string)$db->fetchOne(\"SELECT option_value FROM xf_option WHERE option_id='indexRoute'\"),\n  'defaultStyleId' => (string)$db->fetchOne(\"SELECT option_value FROM xf_option WHERE option_id='defaultStyleId'\"),\n  'error_count' => (int)$db->fetchOne(\"SELECT COUNT(*) FROM xf_error_log\"),\n  'error_max_id' => (int)$db->fetchOne(\"SELECT COALESCE(MAX(error_id),0) FROM xf_error_log\")\n ],\n 'addon' => $db->fetchRow(\n  \"SELECT addon_id,version_id,version_string,active,is_processing,last_pending_action \" .\n  \"FROM xf_addon WHERE addon_id='Newfi/Portal'\"\n ),\n 'source' => [\n  'Pub/Controller/Portal.php' => srcMeta($portal . '/Pub/Controller/Portal.php'),\n  'Service/PortalData.php' => srcMeta($portal . '/Service/PortalData.php'),\n  '_data/templates.xml' => srcMeta($portal . '/_data/templates.xml')\n ],\n 'templates' => $templates\n];\necho \"PORTAL200_INSPECT_JSON_BEGIN\\n\";\necho json_encode(\n    $result,\n    JSON_UNESCAPED_UNICODE|JSON_UNESCAPED_SLASHES|JSON_INVALID_UTF8_SUBSTITUTE\n);\necho \"\\nPORTAL200_INSPECT_JSON_END\\n\";\n?>'''\n\n\nIMPORT_PHP = r'''<?php\n$root = '/var/www/forums/newfi/public';\nrequire $root . '/src/XF.php';\n\\XF::start($root);\n$app = \\XF::setupApp('XF\\\\Pub\\\\App');\n$addOn = $app->addOnManager()->getById('Newfi/Portal');\nif (!$addOn || !$addOn->isInstalled()) {\n    fwrite(STDERR, \"ADDON_NOT_INSTALLED\\n\");\n    exit(30);\n}\n$addOn->preRebuild();\n$dataManager = $app->addOnDataManager();\n$imported = [];\nforeach ($dataManager->getDataTypeClasses() as $dataType) {\n    $handler = $dataManager->getDataTypeHandler($dataType);\n    $xml = $handler->openTypeFile($addOn->getDataDirectory());\n    if (!$xml || !$xml->count()) {\n        $handler->deleteAddOnData($addOn->addon_id);\n        continue;\n    }\n    $start = 0;\n    $guard = 0;\n    while (true) {\n        $last = $handler->importAddOnData($addOn->addon_id, $xml, $start, 0);\n        if (!$last) { break; }\n        if ($last <= $start || ++$guard > 100000) {\n            fwrite(STDERR, \"IMPORT_PROGRESS_INVALID\\n\");\n            exit(31);\n        }\n        $start = $last;\n    }\n    $handler->deleteOrphanedAddOnData($addOn->addon_id, $xml);\n    \\XF::triggerRunOnce();\n    $imported[] = $handler->getContainerTag();\n}\n$addOn->postDataImport();\n$repo = $app->repository(\\XF\\Repository\\StyleRepository::class);\n$repo->updateAllStylesLastModifiedDateLater();\n$addOn->postRebuild();\necho \"PORTAL200_IMPORT_JSON=\" . json_encode(\n    ['result'=>'PASS','containers'=>$imported],\n    JSON_UNESCAPED_SLASHES\n) . \"\\n\";\n?>'''\n\n\nERRORS_PHP_TEMPLATE = r'''<?php\n$root='/var/www/forums/newfi/public';\nrequire $root.'/src/XF.php';\n\\XF::start($root);\n$app=\\XF::setupApp('XF\\\\Pub\\\\App');\n$db=$app->db();\n$b=%d;\n$rows=$db->fetchAll(\n    \"SELECT error_id,exception_type,message,filename,line FROM xf_error_log WHERE error_id>? ORDER BY error_id\",\n    [$b]\n);\necho json_encode(\n    $rows,\n    JSON_UNESCAPED_UNICODE|JSON_UNESCAPED_SLASHES|JSON_INVALID_UTF8_SUBSTITUTE\n);\n?>'''\n\n\nRUNTIME_VERIFY_PHP_TEMPLATE = r'''<?php\n$state = '__STATE__';\n$root = '/var/www/forums/newfi/public';\nrequire $root . '/src/XF.php';\n\\XF::start($root);\n$app = \\XF::setupApp('XF\\\\Pub\\\\App');\n$result = ['state'=>$state];\nif ($state === 'new') {\n    $service = new \\Newfi\\Portal\\Service\\PortalData($app);\n    $portal = $service->build();\n    $html = (string)$app->templater()->renderTemplate('public:newfi_portal', ['portal'=>$portal]);\n    $result['sections'] = [];\n    foreach (['forums','resources','media','events','dogs'] as $key) {\n        $section = $portal[$key] ?? null;\n        if (!is_array($section)) { fwrite(STDERR, \"SECTION_MISSING\\n\"); exit(60); }\n        $result['sections'][$key] = [\n            'available'=>(bool)($section['available'] ?? false),\n            'hasItems'=>(bool)($section['hasItems'] ?? false),\n            'status'=>(string)($section['status'] ?? '')\n        ];\n    }\n    $result['html_marker'] = strpos($html, 'data-newfi-portal200=\"1\"') !== false;\n    $result['locked_resources'] = strpos($html, 'data-portal-locked=\"resources\"') !== false;\n    $result['locked_media'] = strpos($html, 'data-portal-locked=\"media\"') !== false;\n    $result['html_bytes'] = strlen($html);\n    if (!$result['html_marker']) { fwrite(STDERR, \"HTML_MARKER_MISSING\\n\"); exit(61); }\n    if ($result['sections']['resources']['available'] || $result['sections']['media']['available']) {\n        fwrite(STDERR, \"GUEST_PERMISSION_CONTRACT_CHANGED\\n\"); exit(62);\n    }\n    if (!$result['locked_resources'] || !$result['locked_media']) {\n        fwrite(STDERR, \"LOCKED_COPY_MISSING\\n\"); exit(63);\n    }\n    if (!$result['sections']['forums']['available'] || !$result['sections']['events']['available'] || !$result['sections']['dogs']['available']) {\n        fwrite(STDERR, \"PUBLIC_SECTION_UNAVAILABLE\\n\"); exit(64);\n    }\n} else if ($state === 'old') {\n    $html = (string)$app->templater()->renderTemplate('public:newfi_portal', []);\n    $result['html_marker'] = strpos($html, 'data-newfi-portal200') !== false;\n    $result['old_copy'] = strpos($html, 'Закрытое пространство для общения, знаний и материалов сообщества.') !== false;\n    $result['html_bytes'] = strlen($html);\n    if ($result['html_marker'] || !$result['old_copy']) {\n        fwrite(STDERR, \"OLD_RENDER_CONTRACT\\n\"); exit(65);\n    }\n} else {\n    exit(66);\n}\necho \"PORTAL200_RUNTIME_JSON=\" . json_encode(\n    $result,\n    JSON_UNESCAPED_UNICODE|JSON_UNESCAPED_SLASHES|JSON_INVALID_UTF8_SUBSTITUTE\n) . \"\\n\";\n?>'''\n\n\nHTTP_VERIFY_PY = r'''import html,json,re,subprocess,sys,urllib.parse\nmode=sys.argv[1]\nstate=sys.argv[2]\nif mode=='staging':\n    host='newfi-staging.gram1.ru'; scheme='http'; port='80'; expected_status=503\nelif mode=='prod':\n    host='newfi.ru'; scheme='https'; port='443'; expected_status=200\nelse:\n    raise SystemExit(40)\ndef fetch(url):\n    cmd=[\n        '/usr/bin/curl','-sS','-k','--max-time','30','--connect-timeout','10'\n    ]\n    if mode=='staging':\n        cmd += ['--resolve',f'{host}:{port}:127.0.0.1']\n    cmd += [\n        '-o','-','-w','\\n__PORTAL_STATUS__%{http_code}',url\n    ]\n    p=subprocess.run(cmd,stdout=subprocess.PIPE,stderr=subprocess.PIPE,check=False)\n    if p.returncode!=0: raise SystemExit(41)\n    text=p.stdout.decode('utf-8','replace')\n    marker='\\n__PORTAL_STATUS__'\n    if marker not in text: raise SystemExit(42)\n    body,status=text.rsplit(marker,1)\n    return int(status.strip()),body\nroot=f'{scheme}://{host}/'\nstatus,body=fetch(root)\nhrefs=[]\nfor raw in re.findall(r\"href=[\\\"']([^\\\"']*css\\.php[^\\\"']*)[\\\"']\",body,re.I):\n    raw=html.unescape(raw)\n    hrefs.append(urllib.parse.urljoin(root,raw))\nnormal_css=[]\nnormal_status=[]\nfor u in hrefs:\n    s,b=fetch(u)\n    normal_status.append(s)\n    normal_css.append(b)\nnormal_css_text='\\n'.join(normal_css)\nforced_css_marker=None\nforced_css_status=None\nif mode=='staging' and state=='new' and hrefs:\n    u=urllib.parse.urlsplit(hrefs[0])\n    pairs=urllib.parse.parse_qsl(u.query,keep_blank_values=True)\n    out=[]\n    found=False\n    for k,v in pairs:\n        if k=='css':\n            found=True\n            parts=[x for x in v.split(',') if x]\n            if 'public:newfi_portal.less' not in parts:\n                parts.append('public:newfi_portal.less')\n            v=','.join(parts)\n        out.append((k,v))\n    if found:\n        forced=urllib.parse.urlunsplit((u.scheme,u.netloc,u.path,urllib.parse.urlencode(out),u.fragment))\n        forced_css_status,forced_body=fetch(forced)\n        forced_css_marker='--newfi-portal200' in forced_body\nresult={\n 'status':status,\n 'bytes':len(body.encode()),\n 'html_marker':'data-newfi-portal200=\"1\"' in body,\n 'css_marker':'--newfi-portal200' in normal_css_text,\n 'old_copy':'Закрытое пространство для общения, знаний и материалов сообщества.' in body,\n 'css_count':len(hrefs),\n 'css_status':normal_status,\n 'forced_css_status':forced_css_status,\n 'forced_css_marker':forced_css_marker,\n}\nprint('PORTAL200_HTTP_JSON='+json.dumps(result,ensure_ascii=False,sort_keys=True,separators=(',',':')))\nif status!=expected_status: raise SystemExit(45)\nif mode=='prod':\n    if not hrefs or any(x!=200 for x in normal_status): raise SystemExit(46)\nelif mode=='staging':\n    if any(x!=200 for x in normal_status): raise SystemExit(46)\nelse:\n    raise SystemExit(50)\nif mode=='prod' and state=='new':\n    if not result['html_marker'] or not result['css_marker']: raise SystemExit(47)\nelif mode=='prod' and state=='old':\n    if result['html_marker'] or result['css_marker'] or not result['old_copy']: raise SystemExit(48)\nelif mode=='staging' and state=='new':\n    if hrefs and (forced_css_status!=200 or not forced_css_marker): raise SystemExit(49)\nelif mode=='staging' and state=='old':\n    pass\nelse:\n    raise SystemExit(50)\n'''\n\n\ndef parse_inspect(text):\n    b = \"PORTAL200_INSPECT_JSON_BEGIN\\n\"\n    e = \"\\nPORTAL200_INSPECT_JSON_END\"\n    if b not in text or e not in text:\n        fail(\"INSPECT_MARKERS\")\n    try:\n        return json.loads(text.split(b, 1)[1].split(e, 1)[0])\n    except Exception:\n        fail(\"INSPECT_JSON\")\n\n\ndef inspect(target):\n    return parse_inspect(\n        qga(target, [\"/usr/bin/php8.3\"], input_bytes=INSPECT_PHP.encode(), timeout=120)\n    )\n\n\ndef source_is_old(data):\n    src = data[\"source\"]\n    for rel, (size, sha) in EXPECTED_OLD.items():\n        row = src.get(rel)\n        if not row or row.get(\"bytes\") != size or row.get(\"sha256\") != sha:\n            return False\n    return src.get(\"Service/PortalData.php\") is None\n\n\ndef source_is_new(data):\n    src = data[\"source\"]\n    for rel, (size, sha) in EXPECTED_NEW.items():\n        row = src.get(rel)\n        if not row or row.get(\"bytes\") != size or row.get(\"sha256\") != sha:\n            return False\n    return True\n\n\ndef template_state_new(data):\n    rows = data.get(\"templates\", [])\n    rows0 = [r for r in rows if int(r.get(\"style_id\", -1)) == 0]\n    titles = [r.get(\"title\") for r in rows0]\n    by = {r.get(\"title\"): r for r in rows0}\n    return (\n        titles == [\"newfi_portal\", \"newfi_portal.less\"]\n        and int(by[\"newfi_portal\"].get(\"html_marker\", 0)) == 1\n        and int(by[\"newfi_portal.less\"].get(\"css_marker\", 0)) == 1\n    )\n\n\ndef app_contract(data, target):\n    a = data.get(\"application\", {})\n    addon = data.get(\"addon\") or {}\n    expected = {\n        \"staging\": (\"0\", \"http://newfi-staging.gram1.ru\"),\n        \"prod\": (\"1\", \"https://newfi.ru\"),\n    }[target]\n    return (\n        a.get(\"boardActive\") == expected[0]\n        and a.get(\"boardUrl\") == expected[1]\n        and a.get(\"indexRoute\") == \"portal/\"\n        and a.get(\"defaultStyleId\") == \"4\"\n        and addon.get(\"addon_id\") == \"Newfi/Portal\"\n        and int(addon.get(\"version_id\", 0)) == 1000010\n        and addon.get(\"version_string\") == \"1.0.0 Alpha 1\"\n        and int(addon.get(\"active\", 0)) == 1\n        and int(addon.get(\"is_processing\", 1)) == 0\n    )\n\n\ndef new_errors(target, baseline):\n    raw = qga(\n        target,\n        [\"/usr/bin/php8.3\"],\n        input_bytes=(ERRORS_PHP_TEMPLATE % int(baseline)).encode(),\n        timeout=90,\n    )\n    try:\n        return json.loads(raw)\n    except Exception:\n        fail(\"ERROR_LOG_JSON\")\n\n\ndef assert_no_new_errors(target, baseline, phase):\n    rows = new_errors(target, baseline)\n    if rows:\n        emit(\n            \"PORTAL200_NEW_XF_ERRORS\",\n            {\n                \"target\": target,\n                \"phase\": phase,\n                \"count\": len(rows),\n                \"ids\": [r.get(\"error_id\") for r in rows],\n            },\n        )\n        fail(\"NEW_XF_ERRORS\")\n\n\ndef guest_backup(target):\n    script = f'''set -eu\nB={shlex.quote(BACKUP)}\nP=/var/www/forums/newfi/public/src/addons/Newfi/Portal\ntest ! -e \"$B\"\ninstall -d -m 700 \"$B/Pub/Controller\" \"$B/_data\"\ncp -p -- \"$P/Pub/Controller/Portal.php\" \"$B/Pub/Controller/Portal.php\"\ncp -p -- \"$P/_data/templates.xml\" \"$B/_data/templates.xml\"\ntest ! -e \"$P/Service/PortalData.php\"\nprintf 'PORTAL200_BACKUP=PASS\\n'\n'''\n    out = qga(target, [\"/bin/bash\", \"-lc\", script], timeout=90)\n    if \"PORTAL200_BACKUP=PASS\" not in out:\n        fail(\"BACKUP_FAILED\")\n\n\ndef guest_write(target, rel, data):\n    dest = f\"/var/www/forums/newfi/public/src/addons/Newfi/Portal/{rel}\"\n    parent = str(pathlib.PurePosixPath(dest).parent)\n    script = (\n        \"set -eu; umask 022; \"\n        + \"install -d -m 755 \"\n        + shlex.quote(parent)\n        + \"; T=$(mktemp \"\n        + shlex.quote(parent + \"/.portal200.XXXXXX\")\n        + \"); cat >\\\"$T\\\"; chmod 0644 \\\"$T\\\"; chown root:root \\\"$T\\\"; \"\n        + \"mv -f -- \\\"$T\\\" \"\n        + shlex.quote(dest)\n        + \"; printf 'PORTAL200_WRITE=PASS\\\\n'\"\n    )\n    out = qga(\n        target,\n        [\"/bin/bash\", \"-lc\", script],\n        input_bytes=data,\n        timeout=90,\n    )\n    if \"PORTAL200_WRITE=PASS\" not in out:\n        fail(\"WRITE_FAILED\")\n\n\ndef install_candidate(target):\n    for rel in [\n        \"Pub/Controller/Portal.php\",\n        \"Service/PortalData.php\",\n        \"_data/templates.xml\",\n    ]:\n        guest_write(target, rel, (CAND_ROOT / rel).read_bytes())\n\n\ndef restore_old(target):\n    script = f'''set -eu\nB={shlex.quote(BACKUP)}\nP=/var/www/forums/newfi/public/src/addons/Newfi/Portal\ntest -f \"$B/Pub/Controller/Portal.php\"\ntest -f \"$B/_data/templates.xml\"\ncp -p -- \"$B/Pub/Controller/Portal.php\" \"$P/Pub/Controller/Portal.php\"\ncp -p -- \"$B/_data/templates.xml\" \"$P/_data/templates.xml\"\nrm -f -- \"$P/Service/PortalData.php\"\nrmdir -- \"$P/Service\" 2>/dev/null || true\nprintf 'PORTAL200_SOURCE_RESTORE=PASS\\n'\n'''\n    out = qga(target, [\"/bin/bash\", \"-lc\", script], timeout=90)\n    if \"PORTAL200_SOURCE_RESTORE=PASS\" not in out:\n        fail(\"SOURCE_RESTORE_FAILED\")\n\n\ndef import_addon(target):\n    out = qga(\n        target,\n        [\"/usr/bin/php8.3\"],\n        input_bytes=IMPORT_PHP.encode(),\n        timeout=240,\n    )\n    if \"PORTAL200_IMPORT_JSON=\" not in out:\n        fail(\"IMPORT_FAILED\")\n\n\ndef runtime_verify(target, state):\n    src = RUNTIME_VERIFY_PHP_TEMPLATE.replace(\"__STATE__\", state)\n    out = qga(target, [\"/usr/bin/php8.3\"], input_bytes=src.encode(), timeout=120)\n    line = next(\n        (x for x in out.splitlines() if x.startswith(\"PORTAL200_RUNTIME_JSON=\")),\n        None,\n    )\n    if not line:\n        fail(\"RUNTIME_MARKER_MISSING\")\n    try:\n        data = json.loads(line.split(\"=\", 1)[1])\n    except Exception:\n        fail(\"RUNTIME_JSON\")\n    emit(\"PORTAL200_RUNTIME\", {\"target\": target, **data})\n    return data\n\n\ndef http_verify(target, state):\n    argv = [\"/usr/bin/python3\", \"-\", target, state]\n    if target == \"prod\":\n        try:\n            p = subprocess.run(\n                argv,\n                input=HTTP_VERIFY_PY.encode(),\n                stdout=subprocess.PIPE,\n                stderr=subprocess.PIPE,\n                timeout=180,\n                check=False,\n            )\n        except subprocess.TimeoutExpired:\n            fail(\"HTTP_PROD_TIMEOUT\")\n        out = p.stdout.decode(\"utf-8\", \"replace\")\n        err = p.stderr.decode(\"utf-8\", \"replace\")\n        line = next(\n            (x for x in out.splitlines() if x.startswith(\"PORTAL200_HTTP_JSON=\")),\n            None,\n        )\n        data = None\n        if line:\n            try:\n                data = json.loads(line.split(\"=\", 1)[1])\n                emit(\"PORTAL200_HTTP\", {\"target\": target, \"state\": state, **data})\n            except Exception:\n                fail(\"HTTP_JSON\")\n        if p.returncode != 0:\n            emit(\n                \"PORTAL200_HTTP_EXEC\",\n                {\n                    \"target\": target,\n                    \"state\": state,\n                    \"rc\": p.returncode,\n                    \"stderr\": err[:800],\n                },\n            )\n            fail(\"HTTP_PROD_RC\")\n        if data is None:\n            fail(\"HTTP_MARKER_MISSING\")\n        return data\n\n    out = qga(\n        target,\n        argv,\n        input_bytes=HTTP_VERIFY_PY.encode(),\n        timeout=180,\n    )\n    line = next(\n        (x for x in out.splitlines() if x.startswith(\"PORTAL200_HTTP_JSON=\")),\n        None,\n    )\n    if not line:\n        fail(\"HTTP_MARKER_MISSING\")\n    try:\n        data = json.loads(line.split(\"=\", 1)[1])\n    except Exception:\n        fail(\"HTTP_JSON\")\n    emit(\"PORTAL200_HTTP\", {\"target\": target, \"state\": state, **data})\n    return data\n\n\ndef verify_new(target, baseline):\n    data = inspect(target)\n    if not app_contract(data, target):\n        fail(\"APP_CONTRACT_NEW\")\n    if not source_is_new(data):\n        fail(\"SOURCE_NEW_MISMATCH\")\n    if not template_state_new(data):\n        fail(\"TEMPLATE_NEW_MISMATCH\")\n    runtime_verify(target, \"new\")\n    http_verify(target, \"new\")\n    assert_no_new_errors(target, baseline, \"verify-new\")\n    return inspect(target)\n\n\ndef verify_old(target, baseline, old_templates, strict_errors=True):\n    data = inspect(target)\n    if not app_contract(data, target):\n        fail(\"APP_CONTRACT_OLD\")\n    if not source_is_old(data):\n        fail(\"SOURCE_OLD_MISMATCH\")\n    if data.get(\"templates\") != old_templates:\n        fail(\"TEMPLATE_ROLLBACK_MISMATCH\")\n    if target == \"prod\":\n        runtime_verify(target, \"old\")\n    http_verify(target, \"old\")\n    if strict_errors:\n        assert_no_new_errors(target, baseline, \"verify-old\")\n    return inspect(target)\n\n\ndef lint_php(target, source, label):\n    out = qga(\n        target,\n        [\"/usr/bin/php8.3\", \"-l\"],\n        input_bytes=source.encode(),\n        timeout=90,\n    )\n    if \"No syntax errors detected\" not in out:\n        fail(\"PHP_LINT_\" + label)\n\n\ndef cluster_guard():\n    p = run([\"/usr/sbin/qm\", \"status\", \"210\"], timeout=30)\n    if \"status: running\" not in p.stdout.decode():\n        fail(\"VM210_NOT_RUNNING\")\n    p = run(\n        [\n            \"/usr/bin/ssh\",\n            \"-T\",\n            \"-o\",\n            \"BatchMode=yes\",\n            \"-o\",\n            \"StrictHostKeyChecking=yes\",\n            \"-o\",\n            \"UpdateHostKeys=no\",\n            \"-o\",\n            \"ConnectTimeout=10\",\n            \"root@pve03\",\n            \"/usr/sbin/qm status 211\",\n        ],\n        timeout=40,\n    )\n    if \"status: running\" not in p.stdout.decode():\n        fail(\"VM211_NOT_RUNNING\")\n    emit(\"PORTAL200_CLUSTER\", \"PASS\")\n\n\ndef result_contract(status, changes, rollback_started, rollback_restored):\n    emit(\n        \"HOMELAB_RESULT_CONTRACT\",\n        {\n            \"version\": 1,\n            \"command_id\": CID,\n            \"status\": status,\n            \"changes_made\": bool(changes),\n            \"rollback_started\": bool(rollback_started),\n            \"rollback_restored\": rollback_restored,\n        },\n    )\n\n\nemit(\"NEWFI200_BEGIN\")\nemit(\"COMMAND_ID\", CID)\nemit(\"PORTAL200_REMAINING_FULL_PRODUCT_COMMANDS_BEFORE\", 22)\nemit(\n    \"PORTAL200_FLOW\",\n    \"candidate->staging-apply->rollback-proof->staging-reapply->git-push->production\",\n)\n\nstaging_backup = False\nstaging_mutated = False\nstaging_final_new = False\nprod_backup = False\nprod_mutated = False\ngit_files_changed = False\ncommit_created = False\npush_confirmed = False\nfailure_rollback_started = False\nfailure_rollback_restored = None\nold_git_bytes = {}\nnew_head = None\ns_error = None\np_error = None\ns_old_templates = None\np_old_templates = None\n\ntry:\n    compile(HTTP_VERIFY_PY, \"<portal200-http-verify>\", \"exec\")\n    for rel, (size, sha) in EXPECTED_NEW.items():\n        p = CAND_ROOT / rel\n        if not p.is_file() or file_meta(p) != (size, sha):\n            fail(\"CANDIDATE_IDENTITY\")\n    tree = ET.parse(CAND_ROOT / \"_data/templates.xml\")\n    titles = sorted(x.attrib.get(\"title\") for x in tree.getroot().findall(\"template\"))\n    if titles != [\"newfi_portal\", \"newfi_portal.less\"]:\n        fail(\"CANDIDATE_TEMPLATE_SET\")\n    service = (CAND_ROOT / \"Service/PortalData.php\").read_text(\"utf-8\")\n    if any(\n        token in service\n        for token in [\n            \"\\\\XF::db(\",\n            \"->save(\",\n            \"->delete(\",\n            \"INSERT \",\n            \"UPDATE \",\n            \"DELETE \",\n            \"REPLACE \",\n        ]\n    ):\n        fail(\"CANDIDATE_MUTATION_SCAN\")\n    emit(\"PORTAL200_CANDIDATE_IDENTITY\", \"PASS\")\n    emit(\n        \"PORTAL200_ORCHESTRATION_FIXES\",\n        {\n            \"staging_503_without_css_links\": True,\n            \"failure_status\": \"FAIL\",\n            \"prod_http_via_pve01_public_route\": True,\n            \"css_href_regex_fixed\": True,\n        },\n    )\n\n    branch = git(\"branch\", \"--show-current\")\n    head = git(\"rev-parse\", \"HEAD\")\n    status = git(\"status\", \"--porcelain=v1\", \"--untracked-files=all\")\n    remote_out = git(\"ls-remote\", \"origin\", f\"refs/heads/{BRANCH}\")\n    remote = remote_out.split()[0] if remote_out else \"\"\n    if branch != BRANCH or head != OLD_HEAD or remote != OLD_HEAD or status:\n        fail(\"GIT_PRESTATE\")\n    emit(\n        \"PORTAL200_GIT_PRESTATE\",\n        {\"branch\": branch, \"head\": head, \"remote\": remote, \"clean\": True},\n    )\n    cluster_guard()\n\n    lint_php(\"staging\", INSPECT_PHP, \"INSPECT_STAGING\")\n    lint_php(\"staging\", IMPORT_PHP, \"IMPORT_STAGING\")\n    lint_php(\"staging\", RUNTIME_VERIFY_PHP_TEMPLATE.replace(\"__STATE__\", \"new\"), \"RUNTIME_STAGING\")\n    lint_php(\"prod\", INSPECT_PHP, \"INSPECT_PROD\")\n    lint_php(\"prod\", IMPORT_PHP, \"IMPORT_PROD\")\n    lint_php(\"prod\", RUNTIME_VERIFY_PHP_TEMPLATE.replace(\"__STATE__\", \"new\"), \"RUNTIME_PROD\")\n    emit(\"PORTAL200_RUNTIME_HELPER_LINT\", \"PASS\")\n\n    s0 = inspect(\"staging\")\n    p0 = inspect(\"prod\")\n    if not app_contract(s0, \"staging\") or not app_contract(p0, \"prod\"):\n        fail(\"APP_PRESTATE\")\n    if not source_is_old(s0) or not source_is_old(p0):\n        fail(\"SOURCE_PRESTATE\")\n    if s0.get(\"templates\") != p0.get(\"templates\"):\n        fail(\"TEMPLATE_PRESTATE_PARITY\")\n    s_error = int(s0[\"application\"][\"error_max_id\"])\n    p_error = int(p0[\"application\"][\"error_max_id\"])\n    s_old_templates = s0[\"templates\"]\n    p_old_templates = p0[\"templates\"]\n    emit(\"PORTAL200_ERROR_BASELINE\", {\"staging\": s_error, \"prod\": p_error})\n    http_verify(\"staging\", \"old\")\n    runtime_verify(\"prod\", \"old\")\n    http_verify(\"prod\", \"old\")\n    assert_no_new_errors(\"staging\", s_error, \"preflight\")\n    assert_no_new_errors(\"prod\", p_error, \"preflight\")\n    emit(\"PORTAL200_PREFLIGHT\", \"PASS\")\n\n    guest_backup(\"staging\")\n    staging_backup = True\n    staging_mutated = True\n    install_candidate(\"staging\")\n    import_addon(\"staging\")\n    verify_new(\"staging\", s_error)\n    emit(\"PORTAL200_STAGING_FIRST_APPLY\", \"PASS\")\n\n    restore_old(\"staging\")\n    import_addon(\"staging\")\n    verify_old(\"staging\", s_error, s_old_templates)\n    staging_mutated = False\n    emit(\"PORTAL200_STAGING_ROLLBACK_PROOF\", \"PASS\")\n\n    staging_mutated = True\n    install_candidate(\"staging\")\n    import_addon(\"staging\")\n    verify_new(\"staging\", s_error)\n    staging_final_new = True\n    emit(\"PORTAL200_STAGING_FINAL\", \"PASS\")\n\n    for rel in EXPECTED_NEW:\n        dest = GIT_PORTAL / rel\n        old_git_bytes[str(rel)] = dest.read_bytes() if dest.exists() else None\n        dest.parent.mkdir(parents=True, exist_ok=True)\n        shutil.copyfile(CAND_ROOT / rel, dest)\n    git_files_changed = True\n\n    if git(\"diff\", \"--check\"):\n        fail(\"GIT_DIFF_CHECK\")\n    status_lines = git(\"status\", \"--porcelain=v1\", \"--untracked-files=all\").splitlines()\n    actual_paths = sorted(line[3:] for line in status_lines if len(line) >= 4)\n    if actual_paths != sorted(EXPECTED_GIT_PATHS):\n        fail(\"GIT_SCOPE\")\n    git(\"add\", \"--\", *EXPECTED_GIT_PATHS)\n    staged = sorted(x for x in git(\"diff\", \"--cached\", \"--name-only\").splitlines() if x)\n    if staged != sorted(EXPECTED_GIT_PATHS):\n        fail(\"GIT_STAGED_SCOPE\")\n    git(\"commit\", \"-m\", f\"feat: build data-backed Newfi portal [{CID}]\")\n    commit_created = True\n    new_head = git(\"rev-parse\", \"HEAD\")\n    if new_head == OLD_HEAD:\n        fail(\"GIT_COMMIT_HEAD\")\n    if git(\"status\", \"--porcelain=v1\", \"--untracked-files=all\"):\n        fail(\"GIT_POSTCOMMIT_DIRTY\")\n    git(\"push\", \"origin\", f\"HEAD:refs/heads/{BRANCH}\", timeout=180)\n    remote_out = git(\"ls-remote\", \"origin\", f\"refs/heads/{BRANCH}\")\n    remote_head = remote_out.split()[0] if remote_out else \"\"\n    if remote_head != new_head:\n        fail(\"GIT_REMOTE_HEAD\")\n    push_confirmed = True\n    emit(\n        \"PORTAL200_GIT_PROMOTION\",\n        {\n            \"old_head\": OLD_HEAD,\n            \"new_head\": new_head,\n            \"remote_head\": remote_head,\n            \"result\": \"PASS\",\n        },\n    )\n\n    p_pre = inspect(\"prod\")\n    if not source_is_old(p_pre) or p_pre.get(\"templates\") != p_old_templates:\n        fail(\"PROD_DRIFT_BEFORE_APPLY\")\n    if int(p_pre[\"application\"][\"error_max_id\"]) != p_error:\n        fail(\"PROD_ERROR_DRIFT\")\n    guest_backup(\"prod\")\n    prod_backup = True\n    prod_mutated = True\n    install_candidate(\"prod\")\n    import_addon(\"prod\")\n    verify_new(\"prod\", p_error)\n    emit(\"PORTAL200_PRODUCTION\", \"PASS\")\n\n    sf = verify_new(\"staging\", s_error)\n    pf = verify_new(\"prod\", p_error)\n    if sf[\"source\"] != pf[\"source\"]:\n        fail(\"FINAL_SOURCE_PARITY\")\n    if sf[\"templates\"] != pf[\"templates\"]:\n        fail(\"FINAL_TEMPLATE_PARITY\")\n    if git(\"rev-parse\", \"HEAD\") != new_head:\n        fail(\"FINAL_LOCAL_HEAD\")\n    remote_out = git(\"ls-remote\", \"origin\", f\"refs/heads/{BRANCH}\")\n    if not remote_out or remote_out.split()[0] != new_head:\n        fail(\"FINAL_REMOTE_HEAD\")\n    if git(\"status\", \"--porcelain=v1\", \"--untracked-files=all\"):\n        fail(\"FINAL_GIT_DIRTY\")\n    cluster_guard()\n    emit(\n        \"PORTAL200_FINAL_EVIDENCE\",\n        {\n            \"commit\": new_head,\n            \"source_files\": 3,\n            \"templates\": 2,\n            \"staging_error_baseline\": s_error,\n            \"prod_error_baseline\": p_error,\n        },\n    )\n    emit(\"PORTAL200_PORTAL\", \"PASS\")\n    emit(\"PORTAL200_STAGING\", \"PASS\")\n    emit(\"PORTAL200_PRODUCTION\", \"PASS\")\n    emit(\"PORTAL200_REMAINING_FULL_PRODUCT_COMMANDS_AFTER_PASS\", 21)\n    result_contract(\"OK\", True, False, None)\n    emit(\"NEWFI200_END\")\n    raise SystemExit(0)\n\nexcept PortalError as exc:\n    code = str(exc)\n    emit(\"PORTAL200_FAILURE\", code)\n\n    if push_confirmed:\n        if prod_mutated and prod_backup:\n            failure_rollback_started = True\n            try:\n                restore_old(\"prod\")\n                import_addon(\"prod\")\n                verify_old(\"prod\", p_error, p_old_templates, strict_errors=False)\n                prod_mutated = False\n                failure_rollback_restored = False\n                emit(\"PORTAL200_FAILURE_PROD_ROLLBACK\", \"PASS_PARTIAL_OVERALL_STATE_CHANGED\")\n            except Exception:\n                failure_rollback_restored = False\n                emit(\"PORTAL200_FAILURE_PROD_ROLLBACK\", \"FAIL\")\n    else:\n        if staging_mutated and staging_backup:\n            failure_rollback_started = True\n            try:\n                restore_old(\"staging\")\n                import_addon(\"staging\")\n                verify_old(\"staging\", s_error, s_old_templates, strict_errors=False)\n                staging_mutated = False\n                staging_final_new = False\n                failure_rollback_restored = True\n                emit(\"PORTAL200_FAILURE_STAGING_ROLLBACK\", \"PASS\")\n            except Exception:\n                failure_rollback_restored = False\n                emit(\"PORTAL200_FAILURE_STAGING_ROLLBACK\", \"FAIL\")\n\n        if git_files_changed and not commit_created:\n            try:\n                for rel, old in old_git_bytes.items():\n                    dest = GIT_PORTAL / rel\n                    if old is None:\n                        if dest.exists():\n                            dest.unlink()\n                    else:\n                        dest.write_bytes(old)\n                service_dir = GIT_PORTAL / \"Service\"\n                try:\n                    service_dir.rmdir()\n                except OSError:\n                    pass\n                emit(\"PORTAL200_FAILURE_GIT_WORKTREE_RESTORE\", \"PASS\")\n            except Exception:\n                emit(\"PORTAL200_FAILURE_GIT_WORKTREE_RESTORE\", \"FAIL\")\n\n        if commit_created:\n            emit(\n                \"PORTAL200_FAILURE_GIT_HISTORY\",\n                \"COMMIT_CREATED_NO_DESTRUCTIVE_RESET_FRESH_ID_REQUIRED\",\n            )\n\n    persisted = bool(push_confirmed or commit_created or staging_final_new or prod_mutated)\n    if failure_rollback_started and failure_rollback_restored is None:\n        failure_rollback_restored = False\n    result_contract(\n        \"FAIL\",\n        persisted,\n        failure_rollback_started,\n        failure_rollback_restored,\n    )\n    emit(\"PORTAL200_ROADMAP_REMAINS\", 22)\n    emit(\"NEWFI200_END\")\n    raise SystemExit(1)\n\nexcept Exception:\n    emit(\"PORTAL200_FAILURE\", \"UNEXPECTED_EXCEPTION\")\n    result_contract(\n        \"FAIL\",\n        bool(push_confirmed or commit_created or staging_final_new or prod_mutated),\n        False,\n        None,\n    )\n    emit(\"PORTAL200_ROADMAP_REMAINS\", 22)\n    emit(\"NEWFI200_END\")\n    raise SystemExit(1)\n\nCANDIDATE_LAYER_2_TEXT_END\nCANDIDATE_LAYER_3_SOURCE=file:newfi-48-portal200-apply2.cmd::b64::zlib\nCANDIDATE_LAYER_3_SHA256=5e3aa56505b7d7ef5b7f0cf588f89d5e1c5f6b8bd9bffc13b8debdbdc5be26c7\nCANDIDATE_LAYER_3_BYTES=32663\nCANDIDATE_LAYER_3_TEXT_BEGIN\nimport hashlib\nimport json\nimport pathlib\nimport shlex\nimport shutil\nimport subprocess\nimport sys\nimport xml.etree.ElementTree as ET\n\nCID = \"NEWFI-260907-PORTAL200-APPLY2\"\nBRANCH = \"implementation/newfi-closed-mvp-20260906\"\nOLD_HEAD = \"06bab5acd124e768f70305b3d7eca2f595871890\"\nWT = pathlib.Path(\"/root/newfi-portal/.worktrees/implementation-newfi-closed-mvp-20260906\")\nCAND_ROOT = pathlib.Path(\"/root/newfi-portal200-candidate/src/addons/Newfi/Portal\")\nPORTAL_REL = pathlib.Path(\"src/addons/Newfi/Portal\")\nGIT_PORTAL = WT / PORTAL_REL\nEXPECTED_NEW = {\n    \"Pub/Controller/Portal.php\": (363, \"619d489f7cc3b461479c702fa8825097ae22d3c6cfeb911e9f14ea1de9c36d6d\"),\n    \"Service/PortalData.php\": (5213, \"4da03f26294ab6d163a1a746dee4bb6a82d7d4f39e66b24246bc0eb4c455dd1d\"),\n    \"_data/templates.xml\": (10977, \"1650c3d868d4bc47703f1b75f1f179cd25309b2d3b20a2b848e81a4423c00861\"),\n}\nEXPECTED_OLD = {\n    \"Pub/Controller/Portal.php\": (247, \"53909e753ea5a011550fd280ad1c342a74ca9949be092dfbd95244243cae92f3\"),\n    \"_data/templates.xml\": (1461, \"c29c04f8b937284e821c87957653e87c2f6ac014fac30648a0f6b18e84392adf\"),\n}\nEXPECTED_GIT_PATHS = [str(PORTAL_REL / p) for p in sorted(EXPECTED_NEW)]\nBACKUP = f\"/root/newfi-portal200-backup-{CID}\"\n\n\nclass PortalError(RuntimeError):\n    pass\n\n\ndef emit(key, value=None):\n    if value is None:\n        print(key, flush=True)\n    elif isinstance(value, (dict, list, tuple, bool, int, float)):\n        print(\n            key + \"=\" + json.dumps(value, ensure_ascii=False, sort_keys=True, separators=(\",\", \":\")),\n            flush=True,\n        )\n    else:\n        print(key + \"=\" + str(value), flush=True)\n\n\ndef fail(code):\n    raise PortalError(code)\n\n\ndef sha_bytes(data):\n    return hashlib.sha256(data).hexdigest()\n\n\ndef file_meta(path):\n    data = pathlib.Path(path).read_bytes()\n    return len(data), sha_bytes(data)\n\n\ndef run(cmd, *, input_bytes=None, timeout=180, ok=(0,)):\n    try:\n        p = subprocess.run(\n            cmd,\n            input=input_bytes,\n            stdout=subprocess.PIPE,\n            stderr=subprocess.PIPE,\n            timeout=timeout,\n            check=False,\n        )\n    except subprocess.TimeoutExpired:\n        fail(\"SUBPROCESS_TIMEOUT\")\n    if p.returncode not in ok:\n        fail(\"SUBPROCESS_RC\")\n    return p\n\n\ndef git(*args, ok=(0,), timeout=120):\n    p = run([\"/usr/bin/git\", \"-C\", str(WT), *args], timeout=timeout, ok=ok)\n    return p.stdout.decode(\"utf-8\", \"replace\").strip()\n\n\ndef qga(target, argv, *, input_bytes=None, timeout=180):\n    if target == \"prod\":\n        cmd = [\n            \"/usr/sbin/qm\",\n            \"guest\",\n            \"exec\",\n            \"210\",\n            \"--synchronous\",\n            \"1\",\n            \"--timeout\",\n            str(timeout),\n        ]\n        if input_bytes is not None:\n            cmd += [\"--pass-stdin\", \"1\"]\n        cmd += [\"--\", *argv]\n    elif target == \"staging\":\n        q = [\n            \"/usr/sbin/qm\",\n            \"guest\",\n            \"exec\",\n            \"211\",\n            \"--synchronous\",\n            \"1\",\n            \"--timeout\",\n            str(timeout),\n        ]\n        if input_bytes is not None:\n            q += [\"--pass-stdin\", \"1\"]\n        q += [\"--\", *argv]\n        remote = (\n            \"test \\\"$(id -u):$(hostname -s)\\\" = 0:pve03 || exit 72; \"\n            \"for f in /etc/pve/HOMELAB_ASSISTANT_ERROR_REGISTER.md /etc/pve/31_HOMELAB_REFERENCE.md; do \"\n            \"test -r \\\"$f\\\" && test -s \\\"$f\\\" && cat -- \\\"$f\\\" >/dev/null || exit 73; done; exec \"\n            + \" \".join(shlex.quote(x) for x in q)\n        )\n        cmd = [\n            \"/usr/bin/ssh\",\n            \"-T\",\n            \"-o\",\n            \"BatchMode=yes\",\n            \"-o\",\n            \"StrictHostKeyChecking=yes\",\n            \"-o\",\n            \"UpdateHostKeys=no\",\n            \"-o\",\n            \"ConnectTimeout=10\",\n            \"-o\",\n            \"ConnectionAttempts=1\",\n            \"root@pve03\",\n            remote,\n        ]\n    else:\n        fail(\"BAD_TARGET\")\n\n    p = run(cmd, input_bytes=input_bytes, timeout=timeout + 30)\n    try:\n        data = json.loads(p.stdout.decode(\"utf-8\"))\n    except Exception:\n        fail(\"QGA_JSON\")\n    if data.get(\"exited\") not in (1, True) or data.get(\"exitcode\") != 0:\n        fail(\"QGA_GUEST_RC\")\n    if data.get(\"out-truncated\") or data.get(\"err-truncated\"):\n        fail(\"QGA_TRUNCATED\")\n    return data.get(\"out-data\", \"\")\n\n\nINSPECT_PHP = r'''<?php\n$root = '/var/www/forums/newfi/public';\nrequire $root . '/src/XF.php';\n\\XF::start($root);\n$app = \\XF::setupApp('XF\\\\Pub\\\\App');\n$db = $app->db();\nfunction srcMeta(string $path): ?array {\n    if (!is_file($path)) { return null; }\n    return ['bytes' => filesize($path), 'sha256' => hash_file('sha256', $path)];\n}\n$portal = $root . '/src/addons/Newfi/Portal';\n$templates = $db->fetchAll(\n    \"SELECT title, style_id, LENGTH(template) AS bytes, SHA2(template,256) AS sha256, \" .\n    \"LOCATE('data-newfi-portal200', template) > 0 AS html_marker, \" .\n    \"LOCATE('--newfi-portal200', template) > 0 AS css_marker \" .\n    \"FROM xf_template WHERE addon_id='Newfi/Portal' ORDER BY style_id,title\"\n);\n$result = [\n 'hostname' => gethostname(),\n 'application' => [\n  'boardActive' => (string)$db->fetchOne(\"SELECT option_value FROM xf_option WHERE option_id='boardActive'\"),\n  'boardUrl' => (string)$db->fetchOne(\"SELECT option_value FROM xf_option WHERE option_id='boardUrl'\"),\n  'indexRoute' => (string)$db->fetchOne(\"SELECT option_value FROM xf_option WHERE option_id='indexRoute'\"),\n  'defaultStyleId' => (string)$db->fetchOne(\"SELECT option_value FROM xf_option WHERE option_id='defaultStyleId'\"),\n  'error_count' => (int)$db->fetchOne(\"SELECT COUNT(*) FROM xf_error_log\"),\n  'error_max_id' => (int)$db->fetchOne(\"SELECT COALESCE(MAX(error_id),0) FROM xf_error_log\")\n ],\n 'addon' => $db->fetchRow(\n  \"SELECT addon_id,version_id,version_string,active,is_processing,last_pending_action \" .\n  \"FROM xf_addon WHERE addon_id='Newfi/Portal'\"\n ),\n 'source' => [\n  'Pub/Controller/Portal.php' => srcMeta($portal . '/Pub/Controller/Portal.php'),\n  'Service/PortalData.php' => srcMeta($portal . '/Service/PortalData.php'),\n  '_data/templates.xml' => srcMeta($portal . '/_data/templates.xml')\n ],\n 'templates' => $templates\n];\necho \"PORTAL200_INSPECT_JSON_BEGIN\\n\";\necho json_encode(\n    $result,\n    JSON_UNESCAPED_UNICODE|JSON_UNESCAPED_SLASHES|JSON_INVALID_UTF8_SUBSTITUTE\n);\necho \"\\nPORTAL200_INSPECT_JSON_END\\n\";\n?>'''\n\n\nIMPORT_PHP = r'''<?php\n$root = '/var/www/forums/newfi/public';\nrequire $root . '/src/XF.php';\n\\XF::start($root);\n$app = \\XF::setupApp('XF\\\\Pub\\\\App');\n$addOn = $app->addOnManager()->getById('Newfi/Portal');\nif (!$addOn || !$addOn->isInstalled()) {\n    fwrite(STDERR, \"ADDON_NOT_INSTALLED\\n\");\n    exit(30);\n}\n$addOn->preRebuild();\n$dataManager = $app->addOnDataManager();\n$imported = [];\nforeach ($dataManager->getDataTypeClasses() as $dataType) {\n    $handler = $dataManager->getDataTypeHandler($dataType);\n    $xml = $handler->openTypeFile($addOn->getDataDirectory());\n    if (!$xml || !$xml->count()) {\n        $handler->deleteAddOnData($addOn->addon_id);\n        continue;\n    }\n    $start = 0;\n    $guard = 0;\n    while (true) {\n        $last = $handler->importAddOnData($addOn->addon_id, $xml, $start, 0);\n        if (!$last) { break; }\n        if ($last <= $start || ++$guard > 100000) {\n            fwrite(STDERR, \"IMPORT_PROGRESS_INVALID\\n\");\n            exit(31);\n        }\n        $start = $last;\n    }\n    $handler->deleteOrphanedAddOnData($addOn->addon_id, $xml);\n    \\XF::triggerRunOnce();\n    $imported[] = $handler->getContainerTag();\n}\n$addOn->postDataImport();\n$repo = $app->repository(\\XF\\Repository\\StyleRepository::class);\n$repo->updateAllStylesLastModifiedDateLater();\n$addOn->postRebuild();\necho \"PORTAL200_IMPORT_JSON=\" . json_encode(\n    ['result'=>'PASS','containers'=>$imported],\n    JSON_UNESCAPED_SLASHES\n) . \"\\n\";\n?>'''\n\n\nERRORS_PHP_TEMPLATE = r'''<?php\n$root='/var/www/forums/newfi/public';\nrequire $root.'/src/XF.php';\n\\XF::start($root);\n$app=\\XF::setupApp('XF\\\\Pub\\\\App');\n$db=$app->db();\n$b=%d;\n$rows=$db->fetchAll(\n    \"SELECT error_id,exception_type,message,filename,line FROM xf_error_log WHERE error_id>? ORDER BY error_id\",\n    [$b]\n);\necho json_encode(\n    $rows,\n    JSON_UNESCAPED_UNICODE|JSON_UNESCAPED_SLASHES|JSON_INVALID_UTF8_SUBSTITUTE\n);\n?>'''\n\n\nRUNTIME_VERIFY_PHP_TEMPLATE = r'''<?php\n$state = '__STATE__';\n$root = '/var/www/forums/newfi/public';\nrequire $root . '/src/XF.php';\n\\XF::start($root);\n$app = \\XF::setupApp('XF\\\\Pub\\\\App');\n$result = ['state'=>$state];\nif ($state === 'new') {\n    $service = new \\Newfi\\Portal\\Service\\PortalData($app);\n    $portal = $service->build();\n    $html = (string)$app->templater()->renderTemplate('public:newfi_portal', ['portal'=>$portal]);\n    $result['sections'] = [];\n    foreach (['forums','resources','media','events','dogs'] as $key) {\n        $section = $portal[$key] ?? null;\n        if (!is_array($section)) { fwrite(STDERR, \"SECTION_MISSING\\n\"); exit(60); }\n        $result['sections'][$key] = [\n            'available'=>(bool)($section['available'] ?? false),\n            'hasItems'=>(bool)($section['hasItems'] ?? false),\n            'status'=>(string)($section['status'] ?? '')\n        ];\n    }\n    $result['html_marker'] = strpos($html, 'data-newfi-portal200=\"1\"') !== false;\n    $result['locked_resources'] = strpos($html, 'data-portal-locked=\"resources\"') !== false;\n    $result['locked_media'] = strpos($html, 'data-portal-locked=\"media\"') !== false;\n    $result['html_bytes'] = strlen($html);\n    if (!$result['html_marker']) { fwrite(STDERR, \"HTML_MARKER_MISSING\\n\"); exit(61); }\n    if ($result['sections']['resources']['available'] || $result['sections']['media']['available']) {\n        fwrite(STDERR, \"GUEST_PERMISSION_CONTRACT_CHANGED\\n\"); exit(62);\n    }\n    if (!$result['locked_resources'] || !$result['locked_media']) {\n        fwrite(STDERR, \"LOCKED_COPY_MISSING\\n\"); exit(63);\n    }\n    if (!$result['sections']['forums']['available'] || !$result['sections']['events']['available'] || !$result['sections']['dogs']['available']) {\n        fwrite(STDERR, \"PUBLIC_SECTION_UNAVAILABLE\\n\"); exit(64);\n    }\n} else if ($state === 'old') {\n    $html = (string)$app->templater()->renderTemplate('public:newfi_portal', []);\n    $result['html_marker'] = strpos($html, 'data-newfi-portal200') !== false;\n    $result['old_copy'] = strpos($html, 'Закрытое пространство для общения, знаний и материалов сообщества.') !== false;\n    $result['html_bytes'] = strlen($html);\n    if ($result['html_marker'] || !$result['old_copy']) {\n        fwrite(STDERR, \"OLD_RENDER_CONTRACT\\n\"); exit(65);\n    }\n} else {\n    exit(66);\n}\necho \"PORTAL200_RUNTIME_JSON=\" . json_encode(\n    $result,\n    JSON_UNESCAPED_UNICODE|JSON_UNESCAPED_SLASHES|JSON_INVALID_UTF8_SUBSTITUTE\n) . \"\\n\";\n?>'''\n\n\nHTTP_VERIFY_PY = r'''import html,json,re,subprocess,sys,urllib.parse\nmode=sys.argv[1]\nstate=sys.argv[2]\nif mode=='staging':\n    host='newfi-staging.gram1.ru'; scheme='http'; port='80'; expected_status=503\nelif mode=='prod':\n    host='newfi.ru'; scheme='https'; port='443'; expected_status=200\nelse:\n    raise SystemExit(40)\ndef fetch(url):\n    cmd=[\n        '/usr/bin/curl','-sS','-k','--max-time','30','--connect-timeout','10',\n        '--resolve',f'{host}:{port}:127.0.0.1','-o','-','-w',\n        '\\n__PORTAL_STATUS__%{http_code}',url\n    ]\n    p=subprocess.run(cmd,stdout=subprocess.PIPE,stderr=subprocess.PIPE,check=False)\n    if p.returncode!=0: raise SystemExit(41)\n    text=p.stdout.decode('utf-8','replace')\n    marker='\\n__PORTAL_STATUS__'\n    if marker not in text: raise SystemExit(42)\n    body,status=text.rsplit(marker,1)\n    return int(status.strip()),body\nroot=f'{scheme}://{host}/'\nstatus,body=fetch(root)\nhrefs=[]\nfor raw in re.findall(r\"href=[\\\"']([^\\\"']*css\\\\.php[^\\\"']*)[\\\"']\",body,re.I):\n    raw=html.unescape(raw)\n    hrefs.append(urllib.parse.urljoin(root,raw))\nnormal_css=[]\nnormal_status=[]\nfor u in hrefs:\n    s,b=fetch(u)\n    normal_status.append(s)\n    normal_css.append(b)\nnormal_css_text='\\n'.join(normal_css)\nforced_css_marker=None\nforced_css_status=None\nif mode=='staging' and state=='new' and hrefs:\n    u=urllib.parse.urlsplit(hrefs[0])\n    pairs=urllib.parse.parse_qsl(u.query,keep_blank_values=True)\n    out=[]\n    found=False\n    for k,v in pairs:\n        if k=='css':\n            found=True\n            parts=[x for x in v.split(',') if x]\n            if 'public:newfi_portal.less' not in parts:\n                parts.append('public:newfi_portal.less')\n            v=','.join(parts)\n        out.append((k,v))\n    if found:\n        forced=urllib.parse.urlunsplit((u.scheme,u.netloc,u.path,urllib.parse.urlencode(out),u.fragment))\n        forced_css_status,forced_body=fetch(forced)\n        forced_css_marker='--newfi-portal200' in forced_body\nresult={\n 'status':status,\n 'bytes':len(body.encode()),\n 'html_marker':'data-newfi-portal200=\"1\"' in body,\n 'css_marker':'--newfi-portal200' in normal_css_text,\n 'old_copy':'Закрытое пространство для общения, знаний и материалов сообщества.' in body,\n 'css_count':len(hrefs),\n 'css_status':normal_status,\n 'forced_css_status':forced_css_status,\n 'forced_css_marker':forced_css_marker,\n}\nprint('PORTAL200_HTTP_JSON='+json.dumps(result,ensure_ascii=False,sort_keys=True,separators=(',',':')))\nif status!=expected_status: raise SystemExit(45)\nif mode=='prod':\n    if not hrefs or any(x!=200 for x in normal_status): raise SystemExit(46)\nelif mode=='staging':\n    if any(x!=200 for x in normal_status): raise SystemExit(46)\nelse:\n    raise SystemExit(50)\nif mode=='prod' and state=='new':\n    if not result['html_marker'] or not result['css_marker']: raise SystemExit(47)\nelif mode=='prod' and state=='old':\n    if result['html_marker'] or result['css_marker'] or not result['old_copy']: raise SystemExit(48)\nelif mode=='staging' and state=='new':\n    if hrefs and (forced_css_status!=200 or not forced_css_marker): raise SystemExit(49)\nelif mode=='staging' and state=='old':\n    pass\nelse:\n    raise SystemExit(50)\n'''\n\n\ndef parse_inspect(text):\n    b = \"PORTAL200_INSPECT_JSON_BEGIN\\n\"\n    e = \"\\nPORTAL200_INSPECT_JSON_END\"\n    if b not in text or e not in text:\n        fail(\"INSPECT_MARKERS\")\n    try:\n        return json.loads(text.split(b, 1)[1].split(e, 1)[0])\n    except Exception:\n        fail(\"INSPECT_JSON\")\n\n\ndef inspect(target):\n    return parse_inspect(\n        qga(target, [\"/usr/bin/php8.3\"], input_bytes=INSPECT_PHP.encode(), timeout=120)\n    )\n\n\ndef source_is_old(data):\n    src = data[\"source\"]\n    for rel, (size, sha) in EXPECTED_OLD.items():\n        row = src.get(rel)\n        if not row or row.get(\"bytes\") != size or row.get(\"sha256\") != sha:\n            return False\n    return src.get(\"Service/PortalData.php\") is None\n\n\ndef source_is_new(data):\n    src = data[\"source\"]\n    for rel, (size, sha) in EXPECTED_NEW.items():\n        row = src.get(rel)\n        if not row or row.get(\"bytes\") != size or row.get(\"sha256\") != sha:\n            return False\n    return True\n\n\ndef template_state_new(data):\n    rows = data.get(\"templates\", [])\n    rows0 = [r for r in rows if int(r.get(\"style_id\", -1)) == 0]\n    titles = [r.get(\"title\") for r in rows0]\n    by = {r.get(\"title\"): r for r in rows0}\n    return (\n        titles == [\"newfi_portal\", \"newfi_portal.less\"]\n        and int(by[\"newfi_portal\"].get(\"html_marker\", 0)) == 1\n        and int(by[\"newfi_portal.less\"].get(\"css_marker\", 0)) == 1\n    )\n\n\ndef app_contract(data, target):\n    a = data.get(\"application\", {})\n    addon = data.get(\"addon\") or {}\n    expected = {\n        \"staging\": (\"0\", \"http://newfi-staging.gram1.ru\"),\n        \"prod\": (\"1\", \"https://newfi.ru\"),\n    }[target]\n    return (\n        a.get(\"boardActive\") == expected[0]\n        and a.get(\"boardUrl\") == expected[1]\n        and a.get(\"indexRoute\") == \"portal/\"\n        and a.get(\"defaultStyleId\") == \"4\"\n        and addon.get(\"addon_id\") == \"Newfi/Portal\"\n        and int(addon.get(\"version_id\", 0)) == 1000010\n        and addon.get(\"version_string\") == \"1.0.0 Alpha 1\"\n        and int(addon.get(\"active\", 0)) == 1\n        and int(addon.get(\"is_processing\", 1)) == 0\n    )\n\n\ndef new_errors(target, baseline):\n    raw = qga(\n        target,\n        [\"/usr/bin/php8.3\"],\n        input_bytes=(ERRORS_PHP_TEMPLATE % int(baseline)).encode(),\n        timeout=90,\n    )\n    try:\n        return json.loads(raw)\n    except Exception:\n        fail(\"ERROR_LOG_JSON\")\n\n\ndef assert_no_new_errors(target, baseline, phase):\n    rows = new_errors(target, baseline)\n    if rows:\n        emit(\n            \"PORTAL200_NEW_XF_ERRORS\",\n            {\n                \"target\": target,\n                \"phase\": phase,\n                \"count\": len(rows),\n                \"ids\": [r.get(\"error_id\") for r in rows],\n            },\n        )\n        fail(\"NEW_XF_ERRORS\")\n\n\ndef guest_backup(target):\n    script = f'''set -eu\nB={shlex.quote(BACKUP)}\nP=/var/www/forums/newfi/public/src/addons/Newfi/Portal\ntest ! -e \"$B\"\ninstall -d -m 700 \"$B/Pub/Controller\" \"$B/_data\"\ncp -p -- \"$P/Pub/Controller/Portal.php\" \"$B/Pub/Controller/Portal.php\"\ncp -p -- \"$P/_data/templates.xml\" \"$B/_data/templates.xml\"\ntest ! -e \"$P/Service/PortalData.php\"\nprintf 'PORTAL200_BACKUP=PASS\\n'\n'''\n    out = qga(target, [\"/bin/bash\", \"-lc\", script], timeout=90)\n    if \"PORTAL200_BACKUP=PASS\" not in out:\n        fail(\"BACKUP_FAILED\")\n\n\ndef guest_write(target, rel, data):\n    dest = f\"/var/www/forums/newfi/public/src/addons/Newfi/Portal/{rel}\"\n    parent = str(pathlib.PurePosixPath(dest).parent)\n    script = (\n        \"set -eu; umask 022; \"\n        + \"install -d -m 755 \"\n        + shlex.quote(parent)\n        + \"; T=$(mktemp \"\n        + shlex.quote(parent + \"/.portal200.XXXXXX\")\n        + \"); cat >\\\"$T\\\"; chmod 0644 \\\"$T\\\"; chown root:root \\\"$T\\\"; \"\n        + \"mv -f -- \\\"$T\\\" \"\n        + shlex.quote(dest)\n        + \"; printf 'PORTAL200_WRITE=PASS\\\\n'\"\n    )\n    out = qga(\n        target,\n        [\"/bin/bash\", \"-lc\", script],\n        input_bytes=data,\n        timeout=90,\n    )\n    if \"PORTAL200_WRITE=PASS\" not in out:\n        fail(\"WRITE_FAILED\")\n\n\ndef install_candidate(target):\n    for rel in [\n        \"Pub/Controller/Portal.php\",\n        \"Service/PortalData.php\",\n        \"_data/templates.xml\",\n    ]:\n        guest_write(target, rel, (CAND_ROOT / rel).read_bytes())\n\n\ndef restore_old(target):\n    script = f'''set -eu\nB={shlex.quote(BACKUP)}\nP=/var/www/forums/newfi/public/src/addons/Newfi/Portal\ntest -f \"$B/Pub/Controller/Portal.php\"\ntest -f \"$B/_data/templates.xml\"\ncp -p -- \"$B/Pub/Controller/Portal.php\" \"$P/Pub/Controller/Portal.php\"\ncp -p -- \"$B/_data/templates.xml\" \"$P/_data/templates.xml\"\nrm -f -- \"$P/Service/PortalData.php\"\nrmdir -- \"$P/Service\" 2>/dev/null || true\nprintf 'PORTAL200_SOURCE_RESTORE=PASS\\n'\n'''\n    out = qga(target, [\"/bin/bash\", \"-lc\", script], timeout=90)\n    if \"PORTAL200_SOURCE_RESTORE=PASS\" not in out:\n        fail(\"SOURCE_RESTORE_FAILED\")\n\n\ndef import_addon(target):\n    out = qga(\n        target,\n        [\"/usr/bin/php8.3\"],\n        input_bytes=IMPORT_PHP.encode(),\n        timeout=240,\n    )\n    if \"PORTAL200_IMPORT_JSON=\" not in out:\n        fail(\"IMPORT_FAILED\")\n\n\ndef runtime_verify(target, state):\n    src = RUNTIME_VERIFY_PHP_TEMPLATE.replace(\"__STATE__\", state)\n    out = qga(target, [\"/usr/bin/php8.3\"], input_bytes=src.encode(), timeout=120)\n    line = next(\n        (x for x in out.splitlines() if x.startswith(\"PORTAL200_RUNTIME_JSON=\")),\n        None,\n    )\n    if not line:\n        fail(\"RUNTIME_MARKER_MISSING\")\n    try:\n        data = json.loads(line.split(\"=\", 1)[1])\n    except Exception:\n        fail(\"RUNTIME_JSON\")\n    emit(\"PORTAL200_RUNTIME\", {\"target\": target, **data})\n    return data\n\n\ndef http_verify(target, state):\n    out = qga(\n        target,\n        [\"/usr/bin/python3\", \"-\", target, state],\n        input_bytes=HTTP_VERIFY_PY.encode(),\n        timeout=180,\n    )\n    line = next(\n        (x for x in out.splitlines() if x.startswith(\"PORTAL200_HTTP_JSON=\")),\n        None,\n    )\n    if not line:\n        fail(\"HTTP_MARKER_MISSING\")\n    try:\n        data = json.loads(line.split(\"=\", 1)[1])\n    except Exception:\n        fail(\"HTTP_JSON\")\n    emit(\"PORTAL200_HTTP\", {\"target\": target, \"state\": state, **data})\n    return data\n\n\ndef verify_new(target, baseline):\n    data = inspect(target)\n    if not app_contract(data, target):\n        fail(\"APP_CONTRACT_NEW\")\n    if not source_is_new(data):\n        fail(\"SOURCE_NEW_MISMATCH\")\n    if not template_state_new(data):\n        fail(\"TEMPLATE_NEW_MISMATCH\")\n    runtime_verify(target, \"new\")\n    http_verify(target, \"new\")\n    assert_no_new_errors(target, baseline, \"verify-new\")\n    return inspect(target)\n\n\ndef verify_old(target, baseline, old_templates, strict_errors=True):\n    data = inspect(target)\n    if not app_contract(data, target):\n        fail(\"APP_CONTRACT_OLD\")\n    if not source_is_old(data):\n        fail(\"SOURCE_OLD_MISMATCH\")\n    if data.get(\"templates\") != old_templates:\n        fail(\"TEMPLATE_ROLLBACK_MISMATCH\")\n    if target == \"prod\":\n        runtime_verify(target, \"old\")\n    http_verify(target, \"old\")\n    if strict_errors:\n        assert_no_new_errors(target, baseline, \"verify-old\")\n    return inspect(target)\n\n\ndef lint_php(target, source, label):\n    out = qga(\n        target,\n        [\"/usr/bin/php8.3\", \"-l\"],\n        input_bytes=source.encode(),\n        timeout=90,\n    )\n    if \"No syntax errors detected\" not in out:\n        fail(\"PHP_LINT_\" + label)\n\n\ndef cluster_guard():\n    p = run([\"/usr/sbin/qm\", \"status\", \"210\"], timeout=30)\n    if \"status: running\" not in p.stdout.decode():\n        fail(\"VM210_NOT_RUNNING\")\n    p = run(\n        [\n            \"/usr/bin/ssh\",\n            \"-T\",\n            \"-o\",\n            \"BatchMode=yes\",\n            \"-o\",\n            \"StrictHostKeyChecking=yes\",\n            \"-o\",\n            \"UpdateHostKeys=no\",\n            \"-o\",\n            \"ConnectTimeout=10\",\n            \"root@pve03\",\n            \"/usr/sbin/qm status 211\",\n        ],\n        timeout=40,\n    )\n    if \"status: running\" not in p.stdout.decode():\n        fail(\"VM211_NOT_RUNNING\")\n    emit(\"PORTAL200_CLUSTER\", \"PASS\")\n\n\ndef result_contract(status, changes, rollback_started, rollback_restored):\n    emit(\n        \"HOMELAB_RESULT_CONTRACT\",\n        {\n            \"version\": 1,\n            \"command_id\": CID,\n            \"status\": status,\n            \"changes_made\": bool(changes),\n            \"rollback_started\": bool(rollback_started),\n            \"rollback_restored\": rollback_restored,\n        },\n    )\n\n\nemit(\"NEWFI200_BEGIN\")\nemit(\"COMMAND_ID\", CID)\nemit(\"PORTAL200_REMAINING_FULL_PRODUCT_COMMANDS_BEFORE\", 22)\nemit(\n    \"PORTAL200_FLOW\",\n    \"candidate->staging-apply->rollback-proof->staging-reapply->git-push->production\",\n)\n\nstaging_backup = False\nstaging_mutated = False\nstaging_final_new = False\nprod_backup = False\nprod_mutated = False\ngit_files_changed = False\ncommit_created = False\npush_confirmed = False\nfailure_rollback_started = False\nfailure_rollback_restored = None\nold_git_bytes = {}\nnew_head = None\ns_error = None\np_error = None\ns_old_templates = None\np_old_templates = None\n\ntry:\n    compile(HTTP_VERIFY_PY, \"<portal200-http-verify>\", \"exec\")\n    for rel, (size, sha) in EXPECTED_NEW.items():\n        p = CAND_ROOT / rel\n        if not p.is_file() or file_meta(p) != (size, sha):\n            fail(\"CANDIDATE_IDENTITY\")\n    tree = ET.parse(CAND_ROOT / \"_data/templates.xml\")\n    titles = sorted(x.attrib.get(\"title\") for x in tree.getroot().findall(\"template\"))\n    if titles != [\"newfi_portal\", \"newfi_portal.less\"]:\n        fail(\"CANDIDATE_TEMPLATE_SET\")\n    service = (CAND_ROOT / \"Service/PortalData.php\").read_text(\"utf-8\")\n    if any(\n        token in service\n        for token in [\n            \"\\\\XF::db(\",\n            \"->save(\",\n            \"->delete(\",\n            \"INSERT \",\n            \"UPDATE \",\n            \"DELETE \",\n            \"REPLACE \",\n        ]\n    ):\n        fail(\"CANDIDATE_MUTATION_SCAN\")\n    emit(\"PORTAL200_CANDIDATE_IDENTITY\", \"PASS\")\n    emit(\"PORTAL200_ORCHESTRATION_FIXES\", {\"staging_503_without_css_links\": True, \"failure_status\": \"FAIL\"})\n\n    branch = git(\"branch\", \"--show-current\")\n    head = git(\"rev-parse\", \"HEAD\")\n    status = git(\"status\", \"--porcelain=v1\", \"--untracked-files=all\")\n    remote_out = git(\"ls-remote\", \"origin\", f\"refs/heads/{BRANCH}\")\n    remote = remote_out.split()[0] if remote_out else \"\"\n    if branch != BRANCH or head != OLD_HEAD or remote != OLD_HEAD or status:\n        fail(\"GIT_PRESTATE\")\n    emit(\n        \"PORTAL200_GIT_PRESTATE\",\n        {\"branch\": branch, \"head\": head, \"remote\": remote, \"clean\": True},\n    )\n    cluster_guard()\n\n    lint_php(\"staging\", INSPECT_PHP, \"INSPECT_STAGING\")\n    lint_php(\"staging\", IMPORT_PHP, \"IMPORT_STAGING\")\n    lint_php(\"staging\", RUNTIME_VERIFY_PHP_TEMPLATE.replace(\"__STATE__\", \"new\"), \"RUNTIME_STAGING\")\n    lint_php(\"prod\", INSPECT_PHP, \"INSPECT_PROD\")\n    lint_php(\"prod\", IMPORT_PHP, \"IMPORT_PROD\")\n    lint_php(\"prod\", RUNTIME_VERIFY_PHP_TEMPLATE.replace(\"__STATE__\", \"new\"), \"RUNTIME_PROD\")\n    emit(\"PORTAL200_RUNTIME_HELPER_LINT\", \"PASS\")\n\n    s0 = inspect(\"staging\")\n    p0 = inspect(\"prod\")\n    if not app_contract(s0, \"staging\") or not app_contract(p0, \"prod\"):\n        fail(\"APP_PRESTATE\")\n    if not source_is_old(s0) or not source_is_old(p0):\n        fail(\"SOURCE_PRESTATE\")\n    if s0.get(\"templates\") != p0.get(\"templates\"):\n        fail(\"TEMPLATE_PRESTATE_PARITY\")\n    s_error = int(s0[\"application\"][\"error_max_id\"])\n    p_error = int(p0[\"application\"][\"error_max_id\"])\n    s_old_templates = s0[\"templates\"]\n    p_old_templates = p0[\"templates\"]\n    emit(\"PORTAL200_ERROR_BASELINE\", {\"staging\": s_error, \"prod\": p_error})\n    http_verify(\"staging\", \"old\")\n    runtime_verify(\"prod\", \"old\")\n    http_verify(\"prod\", \"old\")\n    assert_no_new_errors(\"staging\", s_error, \"preflight\")\n    assert_no_new_errors(\"prod\", p_error, \"preflight\")\n    emit(\"PORTAL200_PREFLIGHT\", \"PASS\")\n\n    guest_backup(\"staging\")\n    staging_backup = True\n    staging_mutated = True\n    install_candidate(\"staging\")\n    import_addon(\"staging\")\n    verify_new(\"staging\", s_error)\n    emit(\"PORTAL200_STAGING_FIRST_APPLY\", \"PASS\")\n\n    restore_old(\"staging\")\n    import_addon(\"staging\")\n    verify_old(\"staging\", s_error, s_old_templates)\n    staging_mutated = False\n    emit(\"PORTAL200_STAGING_ROLLBACK_PROOF\", \"PASS\")\n\n    staging_mutated = True\n    install_candidate(\"staging\")\n    import_addon(\"staging\")\n    verify_new(\"staging\", s_error)\n    staging_final_new = True\n    emit(\"PORTAL200_STAGING_FINAL\", \"PASS\")\n\n    for rel in EXPECTED_NEW:\n        dest = GIT_PORTAL / rel\n        old_git_bytes[str(rel)] = dest.read_bytes() if dest.exists() else None\n        dest.parent.mkdir(parents=True, exist_ok=True)\n        shutil.copyfile(CAND_ROOT / rel, dest)\n    git_files_changed = True\n\n    if git(\"diff\", \"--check\"):\n        fail(\"GIT_DIFF_CHECK\")\n    status_lines = git(\"status\", \"--porcelain=v1\", \"--untracked-files=all\").splitlines()\n    actual_paths = sorted(line[3:] for line in status_lines if len(line) >= 4)\n    if actual_paths != sorted(EXPECTED_GIT_PATHS):\n        fail(\"GIT_SCOPE\")\n    git(\"add\", \"--\", *EXPECTED_GIT_PATHS)\n    staged = sorted(x for x in git(\"diff\", \"--cached\", \"--name-only\").splitlines() if x)\n    if staged != sorted(EXPECTED_GIT_PATHS):\n        fail(\"GIT_STAGED_SCOPE\")\n    git(\"commit\", \"-m\", f\"feat: build data-backed Newfi portal [{CID}]\")\n    commit_created = True\n    new_head = git(\"rev-parse\", \"HEAD\")\n    if new_head == OLD_HEAD:\n        fail(\"GIT_COMMIT_HEAD\")\n    if git(\"status\", \"--porcelain=v1\", \"--untracked-files=all\"):\n        fail(\"GIT_POSTCOMMIT_DIRTY\")\n    git(\"push\", \"origin\", f\"HEAD:refs/heads/{BRANCH}\", timeout=180)\n    remote_out = git(\"ls-remote\", \"origin\", f\"refs/heads/{BRANCH}\")\n    remote_head = remote_out.split()[0] if remote_out else \"\"\n    if remote_head != new_head:\n        fail(\"GIT_REMOTE_HEAD\")\n    push_confirmed = True\n    emit(\n        \"PORTAL200_GIT_PROMOTION\",\n        {\n            \"old_head\": OLD_HEAD,\n            \"new_head\": new_head,\n            \"remote_head\": remote_head,\n            \"result\": \"PASS\",\n        },\n    )\n\n    p_pre = inspect(\"prod\")\n    if not source_is_old(p_pre) or p_pre.get(\"templates\") != p_old_templates:\n        fail(\"PROD_DRIFT_BEFORE_APPLY\")\n    if int(p_pre[\"application\"][\"error_max_id\"]) != p_error:\n        fail(\"PROD_ERROR_DRIFT\")\n    guest_backup(\"prod\")\n    prod_backup = True\n    prod_mutated = True\n    install_candidate(\"prod\")\n    import_addon(\"prod\")\n    verify_new(\"prod\", p_error)\n    emit(\"PORTAL200_PRODUCTION\", \"PASS\")\n\n    sf = verify_new(\"staging\", s_error)\n    pf = verify_new(\"prod\", p_error)\n    if sf[\"source\"] != pf[\"source\"]:\n        fail(\"FINAL_SOURCE_PARITY\")\n    if sf[\"templates\"] != pf[\"templates\"]:\n        fail(\"FINAL_TEMPLATE_PARITY\")\n    if git(\"rev-parse\", \"HEAD\") != new_head:\n        fail(\"FINAL_LOCAL_HEAD\")\n    remote_out = git(\"ls-remote\", \"origin\", f\"refs/heads/{BRANCH}\")\n    if not remote_out or remote_out.split()[0] != new_head:\n        fail(\"FINAL_REMOTE_HEAD\")\n    if git(\"status\", \"--porcelain=v1\", \"--untracked-files=all\"):\n        fail(\"FINAL_GIT_DIRTY\")\n    cluster_guard()\n    emit(\n        \"PORTAL200_FINAL_EVIDENCE\",\n        {\n            \"commit\": new_head,\n            \"source_files\": 3,\n            \"templates\": 2,\n            \"staging_error_baseline\": s_error,\n            \"prod_error_baseline\": p_error,\n        },\n    )\n    emit(\"PORTAL200_PORTAL\", \"PASS\")\n    emit(\"PORTAL200_STAGING\", \"PASS\")\n    emit(\"PORTAL200_PRODUCTION\", \"PASS\")\n    emit(\"PORTAL200_REMAINING_FULL_PRODUCT_COMMANDS_AFTER_PASS\", 21)\n    result_contract(\"OK\", True, False, None)\n    emit(\"NEWFI200_END\")\n    raise SystemExit(0)\n\nexcept PortalError as exc:\n    code = str(exc)\n    emit(\"PORTAL200_FAILURE\", code)\n\n    if push_confirmed:\n        if prod_mutated and prod_backup:\n            failure_rollback_started = True\n            try:\n                restore_old(\"prod\")\n                import_addon(\"prod\")\n                verify_old(\"prod\", p_error, p_old_templates, strict_errors=False)\n                prod_mutated = False\n                failure_rollback_restored = False\n                emit(\"PORTAL200_FAILURE_PROD_ROLLBACK\", \"PASS_PARTIAL_OVERALL_STATE_CHANGED\")\n            except Exception:\n                failure_rollback_restored = False\n                emit(\"PORTAL200_FAILURE_PROD_ROLLBACK\", \"FAIL\")\n    else:\n        if staging_mutated and staging_backup:\n            failure_rollback_started = True\n            try:\n                restore_old(\"staging\")\n                import_addon(\"staging\")\n                verify_old(\"staging\", s_error, s_old_templates, strict_errors=False)\n                staging_mutated = False\n                staging_final_new = False\n                failure_rollback_restored = True\n                emit(\"PORTAL200_FAILURE_STAGING_ROLLBACK\", \"PASS\")\n            except Exception:\n                failure_rollback_restored = False\n                emit(\"PORTAL200_FAILURE_STAGING_ROLLBACK\", \"FAIL\")\n\n        if git_files_changed and not commit_created:\n            try:\n                for rel, old in old_git_bytes.items():\n                    dest = GIT_PORTAL / rel\n                    if old is None:\n                        if dest.exists():\n                            dest.unlink()\n                    else:\n                        dest.write_bytes(old)\n                service_dir = GIT_PORTAL / \"Service\"\n                try:\n                    service_dir.rmdir()\n                except OSError:\n                    pass\n                emit(\"PORTAL200_FAILURE_GIT_WORKTREE_RESTORE\", \"PASS\")\n            except Exception:\n                emit(\"PORTAL200_FAILURE_GIT_WORKTREE_RESTORE\", \"FAIL\")\n\n        if commit_created:\n            emit(\n                \"PORTAL200_FAILURE_GIT_HISTORY\",\n                \"COMMIT_CREATED_NO_DESTRUCTIVE_RESET_FRESH_ID_REQUIRED\",\n            )\n\n    persisted = bool(push_confirmed or commit_created or staging_final_new or prod_mutated)\n    if failure_rollback_started and failure_rollback_restored is None:\n        failure_rollback_restored = False\n    result_contract(\n        \"FAIL\",\n        persisted,\n        failure_rollback_started,\n        failure_rollback_restored,\n    )\n    emit(\"PORTAL200_ROADMAP_REMAINS\", 22)\n    emit(\"NEWFI200_END\")\n    raise SystemExit(1)\n\nexcept Exception:\n    emit(\"PORTAL200_FAILURE\", \"UNEXPECTED_EXCEPTION\")\n    result_contract(\n        \"FAIL\",\n        bool(push_confirmed or commit_created or staging_final_new or prod_mutated),\n        False,\n        None,\n    )\n    emit(\"PORTAL200_ROADMAP_REMAINS\", 22)\n    emit(\"NEWFI200_END\")\n    raise SystemExit(1)\n\nCANDIDATE_LAYER_3_TEXT_END\nCANDIDATE_LAYER_4_SOURCE=file:newfi-38-portal200-apply.cmd::b64::zlib\nCANDIDATE_LAYER_4_SHA256=e9d137ac729d7513d8d9aa1d9fb509005aefaa7bfe03f5cb26b9896fb1310f62\nCANDIDATE_LAYER_4_BYTES=32448\nCANDIDATE_LAYER_4_TEXT_BEGIN\nimport hashlib\nimport json\nimport pathlib\nimport shlex\nimport shutil\nimport subprocess\nimport sys\nimport xml.etree.ElementTree as ET\n\nCID = \"NEWFI-260907-PORTAL200-APPLY1\"\nBRANCH = \"implementation/newfi-closed-mvp-20260906\"\nOLD_HEAD = \"06bab5acd124e768f70305b3d7eca2f595871890\"\nWT = pathlib.Path(\"/root/newfi-portal/.worktrees/implementation-newfi-closed-mvp-20260906\")\nCAND_ROOT = pathlib.Path(\"/root/newfi-portal200-candidate/src/addons/Newfi/Portal\")\nPORTAL_REL = pathlib.Path(\"src/addons/Newfi/Portal\")\nGIT_PORTAL = WT / PORTAL_REL\nEXPECTED_NEW = {\n    \"Pub/Controller/Portal.php\": (363, \"619d489f7cc3b461479c702fa8825097ae22d3c6cfeb911e9f14ea1de9c36d6d\"),\n    \"Service/PortalData.php\": (5213, \"4da03f26294ab6d163a1a746dee4bb6a82d7d4f39e66b24246bc0eb4c455dd1d\"),\n    \"_data/templates.xml\": (10977, \"1650c3d868d4bc47703f1b75f1f179cd25309b2d3b20a2b848e81a4423c00861\"),\n}\nEXPECTED_OLD = {\n    \"Pub/Controller/Portal.php\": (247, \"53909e753ea5a011550fd280ad1c342a74ca9949be092dfbd95244243cae92f3\"),\n    \"_data/templates.xml\": (1461, \"c29c04f8b937284e821c87957653e87c2f6ac014fac30648a0f6b18e84392adf\"),\n}\nEXPECTED_GIT_PATHS = [str(PORTAL_REL / p) for p in sorted(EXPECTED_NEW)]\nBACKUP = f\"/root/newfi-portal200-backup-{CID}\"\n\n\nclass PortalError(RuntimeError):\n    pass\n\n\ndef emit(key, value=None):\n    if value is None:\n        print(key, flush=True)\n    elif isinstance(value, (dict, list, tuple, bool, int, float)):\n        print(\n            key + \"=\" + json.dumps(value, ensure_ascii=False, sort_keys=True, separators=(\",\", \":\")),\n            flush=True,\n        )\n    else:\n        print(key + \"=\" + str(value), flush=True)\n\n\ndef fail(code):\n    raise PortalError(code)\n\n\ndef sha_bytes(data):\n    return hashlib.sha256(data).hexdigest()\n\n\ndef file_meta(path):\n    data = pathlib.Path(path).read_bytes()\n    return len(data), sha_bytes(data)\n\n\ndef run(cmd, *, input_bytes=None, timeout=180, ok=(0,)):\n    try:\n        p = subprocess.run(\n            cmd,\n            input=input_bytes,\n            stdout=subprocess.PIPE,\n            stderr=subprocess.PIPE,\n            timeout=timeout,\n            check=False,\n        )\n    except subprocess.TimeoutExpired:\n        fail(\"SUBPROCESS_TIMEOUT\")\n    if p.returncode not in ok:\n        fail(\"SUBPROCESS_RC\")\n    return p\n\n\ndef git(*args, ok=(0,), timeout=120):\n    p = run([\"/usr/bin/git\", \"-C\", str(WT), *args], timeout=timeout, ok=ok)\n    return p.stdout.decode(\"utf-8\", \"replace\").strip()\n\n\ndef qga(target, argv, *, input_bytes=None, timeout=180):\n    if target == \"prod\":\n        cmd = [\n            \"/usr/sbin/qm\",\n            \"guest\",\n            \"exec\",\n            \"210\",\n            \"--synchronous\",\n            \"1\",\n            \"--timeout\",\n            str(timeout),\n        ]\n        if input_bytes is not None:\n            cmd += [\"--pass-stdin\", \"1\"]\n        cmd += [\"--\", *argv]\n    elif target == \"staging\":\n        q = [\n            \"/usr/sbin/qm\",\n            \"guest\",\n            \"exec\",\n            \"211\",\n            \"--synchronous\",\n            \"1\",\n            \"--timeout\",\n            str(timeout),\n        ]\n        if input_bytes is not None:\n            q += [\"--pass-stdin\", \"1\"]\n        q += [\"--\", *argv]\n        remote = (\n            \"test \\\"$(id -u):$(hostname -s)\\\" = 0:pve03 || exit 72; \"\n            \"for f in /etc/pve/HOMELAB_ASSISTANT_ERROR_REGISTER.md /etc/pve/31_HOMELAB_REFERENCE.md; do \"\n            \"test -r \\\"$f\\\" && test -s \\\"$f\\\" && cat -- \\\"$f\\\" >/dev/null || exit 73; done; exec \"\n            + \" \".join(shlex.quote(x) for x in q)\n        )\n        cmd = [\n            \"/usr/bin/ssh\",\n            \"-T\",\n            \"-o\",\n            \"BatchMode=yes\",\n            \"-o\",\n            \"StrictHostKeyChecking=yes\",\n            \"-o\",\n            \"UpdateHostKeys=no\",\n            \"-o\",\n            \"ConnectTimeout=10\",\n            \"-o\",\n            \"ConnectionAttempts=1\",\n            \"root@pve03\",\n            remote,\n        ]\n    else:\n        fail(\"BAD_TARGET\")\n\n    p = run(cmd, input_bytes=input_bytes, timeout=timeout + 30)\n    try:\n        data = json.loads(p.stdout.decode(\"utf-8\"))\n    except Exception:\n        fail(\"QGA_JSON\")\n    if data.get(\"exited\") not in (1, True) or data.get(\"exitcode\") != 0:\n        fail(\"QGA_GUEST_RC\")\n    if data.get(\"out-truncated\") or data.get(\"err-truncated\"):\n        fail(\"QGA_TRUNCATED\")\n    return data.get(\"out-data\", \"\")\n\n\nINSPECT_PHP = r'''<?php\n$root = '/var/www/forums/newfi/public';\nrequire $root . '/src/XF.php';\n\\XF::start($root);\n$app = \\XF::setupApp('XF\\\\Pub\\\\App');\n$db = $app->db();\nfunction srcMeta(string $path): ?array {\n    if (!is_file($path)) { return null; }\n    return ['bytes' => filesize($path), 'sha256' => hash_file('sha256', $path)];\n}\n$portal = $root . '/src/addons/Newfi/Portal';\n$templates = $db->fetchAll(\n    \"SELECT title, style_id, LENGTH(template) AS bytes, SHA2(template,256) AS sha256, \" .\n    \"LOCATE('data-newfi-portal200', template) > 0 AS html_marker, \" .\n    \"LOCATE('--newfi-portal200', template) > 0 AS css_marker \" .\n    \"FROM xf_template WHERE addon_id='Newfi/Portal' ORDER BY style_id,title\"\n);\n$result = [\n 'hostname' => gethostname(),\n 'application' => [\n  'boardActive' => (string)$db->fetchOne(\"SELECT option_value FROM xf_option WHERE option_id='boardActive'\"),\n  'boardUrl' => (string)$db->fetchOne(\"SELECT option_value FROM xf_option WHERE option_id='boardUrl'\"),\n  'indexRoute' => (string)$db->fetchOne(\"SELECT option_value FROM xf_option WHERE option_id='indexRoute'\"),\n  'defaultStyleId' => (string)$db->fetchOne(\"SELECT option_value FROM xf_option WHERE option_id='defaultStyleId'\"),\n  'error_count' => (int)$db->fetchOne(\"SELECT COUNT(*) FROM xf_error_log\"),\n  'error_max_id' => (int)$db->fetchOne(\"SELECT COALESCE(MAX(error_id),0) FROM xf_error_log\")\n ],\n 'addon' => $db->fetchRow(\n  \"SELECT addon_id,version_id,version_string,active,is_processing,last_pending_action \" .\n  \"FROM xf_addon WHERE addon_id='Newfi/Portal'\"\n ),\n 'source' => [\n  'Pub/Controller/Portal.php' => srcMeta($portal . '/Pub/Controller/Portal.php'),\n  'Service/PortalData.php' => srcMeta($portal . '/Service/PortalData.php'),\n  '_data/templates.xml' => srcMeta($portal . '/_data/templates.xml')\n ],\n 'templates' => $templates\n];\necho \"PORTAL200_INSPECT_JSON_BEGIN\\n\";\necho json_encode(\n    $result,\n    JSON_UNESCAPED_UNICODE|JSON_UNESCAPED_SLASHES|JSON_INVALID_UTF8_SUBSTITUTE\n);\necho \"\\nPORTAL200_INSPECT_JSON_END\\n\";\n?>'''\n\n\nIMPORT_PHP = r'''<?php\n$root = '/var/www/forums/newfi/public';\nrequire $root . '/src/XF.php';\n\\XF::start($root);\n$app = \\XF::setupApp('XF\\\\Pub\\\\App');\n$addOn = $app->addOnManager()->getById('Newfi/Portal');\nif (!$addOn || !$addOn->isInstalled()) {\n    fwrite(STDERR, \"ADDON_NOT_INSTALLED\\n\");\n    exit(30);\n}\n$addOn->preRebuild();\n$dataManager = $app->addOnDataManager();\n$imported = [];\nforeach ($dataManager->getDataTypeClasses() as $dataType) {\n    $handler = $dataManager->getDataTypeHandler($dataType);\n    $xml = $handler->openTypeFile($addOn->getDataDirectory());\n    if (!$xml || !$xml->count()) {\n        $handler->deleteAddOnData($addOn->addon_id);\n        continue;\n    }\n    $start = 0;\n    $guard = 0;\n    while (true) {\n        $last = $handler->importAddOnData($addOn->addon_id, $xml, $start, 0);\n        if (!$last) { break; }\n        if ($last <= $start || ++$guard > 100000) {\n            fwrite(STDERR, \"IMPORT_PROGRESS_INVALID\\n\");\n            exit(31);\n        }\n        $start = $last;\n    }\n    $handler->deleteOrphanedAddOnData($addOn->addon_id, $xml);\n    \\XF::triggerRunOnce();\n    $imported[] = $handler->getContainerTag();\n}\n$addOn->postDataImport();\n$repo = $app->repository(\\XF\\Repository\\StyleRepository::class);\n$repo->updateAllStylesLastModifiedDateLater();\n$addOn->postRebuild();\necho \"PORTAL200_IMPORT_JSON=\" . json_encode(\n    ['result'=>'PASS','containers'=>$imported],\n    JSON_UNESCAPED_SLASHES\n) . \"\\n\";\n?>'''\n\n\nERRORS_PHP_TEMPLATE = r'''<?php\n$root='/var/www/forums/newfi/public';\nrequire $root.'/src/XF.php';\n\\XF::start($root);\n$app=\\XF::setupApp('XF\\\\Pub\\\\App');\n$db=$app->db();\n$b=%d;\n$rows=$db->fetchAll(\n    \"SELECT error_id,exception_type,message,filename,line FROM xf_error_log WHERE error_id>? ORDER BY error_id\",\n    [$b]\n);\necho json_encode(\n    $rows,\n    JSON_UNESCAPED_UNICODE|JSON_UNESCAPED_SLASHES|JSON_INVALID_UTF8_SUBSTITUTE\n);\n?>'''\n\n\nRUNTIME_VERIFY_PHP_TEMPLATE = r'''<?php\n$state = '__STATE__';\n$root = '/var/www/forums/newfi/public';\nrequire $root . '/src/XF.php';\n\\XF::start($root);\n$app = \\XF::setupApp('XF\\\\Pub\\\\App');\n$result = ['state'=>$state];\nif ($state === 'new') {\n    $service = new \\Newfi\\Portal\\Service\\PortalData($app);\n    $portal = $service->build();\n    $html = (string)$app->templater()->renderTemplate('public:newfi_portal', ['portal'=>$portal]);\n    $result['sections'] = [];\n    foreach (['forums','resources','media','events','dogs'] as $key) {\n        $section = $portal[$key] ?? null;\n        if (!is_array($section)) { fwrite(STDERR, \"SECTION_MISSING\\n\"); exit(60); }\n        $result['sections'][$key] = [\n            'available'=>(bool)($section['available'] ?? false),\n            'hasItems'=>(bool)($section['hasItems'] ?? false),\n            'status'=>(string)($section['status'] ?? '')\n        ];\n    }\n    $result['html_marker'] = strpos($html, 'data-newfi-portal200=\"1\"') !== false;\n    $result['locked_resources'] = strpos($html, 'data-portal-locked=\"resources\"') !== false;\n    $result['locked_media'] = strpos($html, 'data-portal-locked=\"media\"') !== false;\n    $result['html_bytes'] = strlen($html);\n    if (!$result['html_marker']) { fwrite(STDERR, \"HTML_MARKER_MISSING\\n\"); exit(61); }\n    if ($result['sections']['resources']['available'] || $result['sections']['media']['available']) {\n        fwrite(STDERR, \"GUEST_PERMISSION_CONTRACT_CHANGED\\n\"); exit(62);\n    }\n    if (!$result['locked_resources'] || !$result['locked_media']) {\n        fwrite(STDERR, \"LOCKED_COPY_MISSING\\n\"); exit(63);\n    }\n    if (!$result['sections']['forums']['available'] || !$result['sections']['events']['available'] || !$result['sections']['dogs']['available']) {\n        fwrite(STDERR, \"PUBLIC_SECTION_UNAVAILABLE\\n\"); exit(64);\n    }\n} else if ($state === 'old') {\n    $html = (string)$app->templater()->renderTemplate('public:newfi_portal', []);\n    $result['html_marker'] = strpos($html, 'data-newfi-portal200') !== false;\n    $result['old_copy'] = strpos($html, 'Закрытое пространство для общения, знаний и материалов сообщества.') !== false;\n    $result['html_bytes'] = strlen($html);\n    if ($result['html_marker'] || !$result['old_copy']) {\n        fwrite(STDERR, \"OLD_RENDER_CONTRACT\\n\"); exit(65);\n    }\n} else {\n    exit(66);\n}\necho \"PORTAL200_RUNTIME_JSON=\" . json_encode(\n    $result,\n    JSON_UNESCAPED_UNICODE|JSON_UNESCAPED_SLASHES|JSON_INVALID_UTF8_SUBSTITUTE\n) . \"\\n\";\n?>'''\n\n\nHTTP_VERIFY_PY = r'''import html,json,re,subprocess,sys,urllib.parse\nmode=sys.argv[1]\nstate=sys.argv[2]\nif mode=='staging':\n    host='newfi-staging.gram1.ru'; scheme='http'; port='80'; expected_status=503\nelif mode=='prod':\n    host='newfi.ru'; scheme='https'; port='443'; expected_status=200\nelse:\n    raise SystemExit(40)\ndef fetch(url):\n    cmd=[\n        '/usr/bin/curl','-sS','-k','--max-time','30','--connect-timeout','10',\n        '--resolve',f'{host}:{port}:127.0.0.1','-o','-','-w',\n        '\\n__PORTAL_STATUS__%{http_code}',url\n    ]\n    p=subprocess.run(cmd,stdout=subprocess.PIPE,stderr=subprocess.PIPE,check=False)\n    if p.returncode!=0: raise SystemExit(41)\n    text=p.stdout.decode('utf-8','replace')\n    marker='\\n__PORTAL_STATUS__'\n    if marker not in text: raise SystemExit(42)\n    body,status=text.rsplit(marker,1)\n    return int(status.strip()),body\nroot=f'{scheme}://{host}/'\nstatus,body=fetch(root)\nhrefs=[]\nfor raw in re.findall(r\"href=[\\\"']([^\\\"']*css\\\\.php[^\\\"']*)[\\\"']\",body,re.I):\n    raw=html.unescape(raw)\n    hrefs.append(urllib.parse.urljoin(root,raw))\nnormal_css=[]\nnormal_status=[]\nfor u in hrefs:\n    s,b=fetch(u)\n    normal_status.append(s)\n    normal_css.append(b)\nnormal_css_text='\\n'.join(normal_css)\nforced_css_marker=None\nforced_css_status=None\nif mode=='staging' and state=='new':\n    if not hrefs: raise SystemExit(43)\n    u=urllib.parse.urlsplit(hrefs[0])\n    pairs=urllib.parse.parse_qsl(u.query,keep_blank_values=True)\n    out=[]\n    found=False\n    for k,v in pairs:\n        if k=='css':\n            found=True\n            parts=[x for x in v.split(',') if x]\n            if 'public:newfi_portal.less' not in parts:\n                parts.append('public:newfi_portal.less')\n            v=','.join(parts)\n        out.append((k,v))\n    if not found: raise SystemExit(44)\n    forced=urllib.parse.urlunsplit((u.scheme,u.netloc,u.path,urllib.parse.urlencode(out),u.fragment))\n    forced_css_status,forced_body=fetch(forced)\n    forced_css_marker='--newfi-portal200' in forced_body\nresult={\n 'status':status,\n 'bytes':len(body.encode()),\n 'html_marker':'data-newfi-portal200=\"1\"' in body,\n 'css_marker':'--newfi-portal200' in normal_css_text,\n 'old_copy':'Закрытое пространство для общения, знаний и материалов сообщества.' in body,\n 'css_count':len(hrefs),\n 'css_status':normal_status,\n 'forced_css_status':forced_css_status,\n 'forced_css_marker':forced_css_marker,\n}\nprint('PORTAL200_HTTP_JSON='+json.dumps(result,ensure_ascii=False,sort_keys=True,separators=(',',':')))\nif status!=expected_status: raise SystemExit(45)\nif not hrefs or any(x!=200 for x in normal_status): raise SystemExit(46)\nif mode=='prod' and state=='new':\n    if not result['html_marker'] or not result['css_marker']: raise SystemExit(47)\nelif mode=='prod' and state=='old':\n    if result['html_marker'] or result['css_marker'] or not result['old_copy']: raise SystemExit(48)\nelif mode=='staging' and state=='new':\n    if forced_css_status!=200 or not forced_css_marker: raise SystemExit(49)\nelif mode=='staging' and state=='old':\n    pass\nelse:\n    raise SystemExit(50)\n'''\n\n\ndef parse_inspect(text):\n    b = \"PORTAL200_INSPECT_JSON_BEGIN\\n\"\n    e = \"\\nPORTAL200_INSPECT_JSON_END\"\n    if b not in text or e not in text:\n        fail(\"INSPECT_MARKERS\")\n    try:\n        return json.loads(text.split(b, 1)[1].split(e, 1)[0])\n    except Exception:\n        fail(\"INSPECT_JSON\")\n\n\ndef inspect(target):\n    return parse_inspect(\n        qga(target, [\"/usr/bin/php8.3\"], input_bytes=INSPECT_PHP.encode(), timeout=120)\n    )\n\n\ndef source_is_old(data):\n    src = data[\"source\"]\n    for rel, (size, sha) in EXPECTED_OLD.items():\n        row = src.get(rel)\n        if not row or row.get(\"bytes\") != size or row.get(\"sha256\") != sha:\n            return False\n    return src.get(\"Service/PortalData.php\") is None\n\n\ndef source_is_new(data):\n    src = data[\"source\"]\n    for rel, (size, sha) in EXPECTED_NEW.items():\n        row = src.get(rel)\n        if not row or row.get(\"bytes\") != size or row.get(\"sha256\") != sha:\n            return False\n    return True\n\n\ndef template_state_new(data):\n    rows = data.get(\"templates\", [])\n    rows0 = [r for r in rows if int(r.get(\"style_id\", -1)) == 0]\n    titles = [r.get(\"title\") for r in rows0]\n    by = {r.get(\"title\"): r for r in rows0}\n    return (\n        titles == [\"newfi_portal\", \"newfi_portal.less\"]\n        and int(by[\"newfi_portal\"].get(\"html_marker\", 0)) == 1\n        and int(by[\"newfi_portal.less\"].get(\"css_marker\", 0)) == 1\n    )\n\n\ndef app_contract(data, target):\n    a = data.get(\"application\", {})\n    addon = data.get(\"addon\") or {}\n    expected = {\n        \"staging\": (\"0\", \"http://newfi-staging.gram1.ru\"),\n        \"prod\": (\"1\", \"https://newfi.ru\"),\n    }[target]\n    return (\n        a.get(\"boardActive\") == expected[0]\n        and a.get(\"boardUrl\") == expected[1]\n        and a.get(\"indexRoute\") == \"portal/\"\n        and a.get(\"defaultStyleId\") == \"4\"\n        and addon.get(\"addon_id\") == \"Newfi/Portal\"\n        and int(addon.get(\"version_id\", 0)) == 1000010\n        and addon.get(\"version_string\") == \"1.0.0 Alpha 1\"\n        and int(addon.get(\"active\", 0)) == 1\n        and int(addon.get(\"is_processing\", 1)) == 0\n    )\n\n\ndef new_errors(target, baseline):\n    raw = qga(\n        target,\n        [\"/usr/bin/php8.3\"],\n        input_bytes=(ERRORS_PHP_TEMPLATE % int(baseline)).encode(),\n        timeout=90,\n    )\n    try:\n        return json.loads(raw)\n    except Exception:\n        fail(\"ERROR_LOG_JSON\")\n\n\ndef assert_no_new_errors(target, baseline, phase):\n    rows = new_errors(target, baseline)\n    if rows:\n        emit(\n            \"PORTAL200_NEW_XF_ERRORS\",\n            {\n                \"target\": target,\n                \"phase\": phase,\n                \"count\": len(rows),\n                \"ids\": [r.get(\"error_id\") for r in rows],\n            },\n        )\n        fail(\"NEW_XF_ERRORS\")\n\n\ndef guest_backup(target):\n    script = f'''set -eu\nB={shlex.quote(BACKUP)}\nP=/var/www/forums/newfi/public/src/addons/Newfi/Portal\ntest ! -e \"$B\"\ninstall -d -m 700 \"$B/Pub/Controller\" \"$B/_data\"\ncp -p -- \"$P/Pub/Controller/Portal.php\" \"$B/Pub/Controller/Portal.php\"\ncp -p -- \"$P/_data/templates.xml\" \"$B/_data/templates.xml\"\ntest ! -e \"$P/Service/PortalData.php\"\nprintf 'PORTAL200_BACKUP=PASS\\n'\n'''\n    out = qga(target, [\"/bin/bash\", \"-lc\", script], timeout=90)\n    if \"PORTAL200_BACKUP=PASS\" not in out:\n        fail(\"BACKUP_FAILED\")\n\n\ndef guest_write(target, rel, data):\n    dest = f\"/var/www/forums/newfi/public/src/addons/Newfi/Portal/{rel}\"\n    parent = str(pathlib.PurePosixPath(dest).parent)\n    script = (\n        \"set -eu; umask 022; \"\n        + \"install -d -m 755 \"\n        + shlex.quote(parent)\n        + \"; T=$(mktemp \"\n        + shlex.quote(parent + \"/.portal200.XXXXXX\")\n        + \"); cat >\\\"$T\\\"; chmod 0644 \\\"$T\\\"; chown root:root \\\"$T\\\"; \"\n        + \"mv -f -- \\\"$T\\\" \"\n        + shlex.quote(dest)\n        + \"; printf 'PORTAL200_WRITE=PASS\\\\n'\"\n    )\n    out = qga(\n        target,\n        [\"/bin/bash\", \"-lc\", script],\n        input_bytes=data,\n        timeout=90,\n    )\n    if \"PORTAL200_WRITE=PASS\" not in out:\n        fail(\"WRITE_FAILED\")\n\n\ndef install_candidate(target):\n    for rel in [\n        \"Pub/Controller/Portal.php\",\n        \"Service/PortalData.php\",\n        \"_data/templates.xml\",\n    ]:\n        guest_write(target, rel, (CAND_ROOT / rel).read_bytes())\n\n\ndef restore_old(target):\n    script = f'''set -eu\nB={shlex.quote(BACKUP)}\nP=/var/www/forums/newfi/public/src/addons/Newfi/Portal\ntest -f \"$B/Pub/Controller/Portal.php\"\ntest -f \"$B/_data/templates.xml\"\ncp -p -- \"$B/Pub/Controller/Portal.php\" \"$P/Pub/Controller/Portal.php\"\ncp -p -- \"$B/_data/templates.xml\" \"$P/_data/templates.xml\"\nrm -f -- \"$P/Service/PortalData.php\"\nrmdir -- \"$P/Service\" 2>/dev/null || true\nprintf 'PORTAL200_SOURCE_RESTORE=PASS\\n'\n'''\n    out = qga(target, [\"/bin/bash\", \"-lc\", script], timeout=90)\n    if \"PORTAL200_SOURCE_RESTORE=PASS\" not in out:\n        fail(\"SOURCE_RESTORE_FAILED\")\n\n\ndef import_addon(target):\n    out = qga(\n        target,\n        [\"/usr/bin/php8.3\"],\n        input_bytes=IMPORT_PHP.encode(),\n        timeout=240,\n    )\n    if \"PORTAL200_IMPORT_JSON=\" not in out:\n        fail(\"IMPORT_FAILED\")\n\n\ndef runtime_verify(target, state):\n    src = RUNTIME_VERIFY_PHP_TEMPLATE.replace(\"__STATE__\", state)\n    out = qga(target, [\"/usr/bin/php8.3\"], input_bytes=src.encode(), timeout=120)\n    line = next(\n        (x for x in out.splitlines() if x.startswith(\"PORTAL200_RUNTIME_JSON=\")),\n        None,\n    )\n    if not line:\n        fail(\"RUNTIME_MARKER_MISSING\")\n    try:\n        data = json.loads(line.split(\"=\", 1)[1])\n    except Exception:\n        fail(\"RUNTIME_JSON\")\n    emit(\"PORTAL200_RUNTIME\", {\"target\": target, **data})\n    return data\n\n\ndef http_verify(target, state):\n    out = qga(\n        target,\n        [\"/usr/bin/python3\", \"-\", target, state],\n        input_bytes=HTTP_VERIFY_PY.encode(),\n        timeout=180,\n    )\n    line = next(\n        (x for x in out.splitlines() if x.startswith(\"PORTAL200_HTTP_JSON=\")),\n        None,\n    )\n    if not line:\n        fail(\"HTTP_MARKER_MISSING\")\n    try:\n        data = json.loads(line.split(\"=\", 1)[1])\n    except Exception:\n        fail(\"HTTP_JSON\")\n    emit(\"PORTAL200_HTTP\", {\"target\": target, \"state\": state, **data})\n    return data\n\n\ndef verify_new(target, baseline):\n    data = inspect(target)\n    if not app_contract(data, target):\n        fail(\"APP_CONTRACT_NEW\")\n    if not source_is_new(data):\n        fail(\"SOURCE_NEW_MISMATCH\")\n    if not template_state_new(data):\n        fail(\"TEMPLATE_NEW_MISMATCH\")\n    runtime_verify(target, \"new\")\n    http_verify(target, \"new\")\n    assert_no_new_errors(target, baseline, \"verify-new\")\n    return inspect(target)\n\n\ndef verify_old(target, baseline, old_templates, strict_errors=True):\n    data = inspect(target)\n    if not app_contract(data, target):\n        fail(\"APP_CONTRACT_OLD\")\n    if not source_is_old(data):\n        fail(\"SOURCE_OLD_MISMATCH\")\n    if data.get(\"templates\") != old_templates:\n        fail(\"TEMPLATE_ROLLBACK_MISMATCH\")\n    if target == \"prod\":\n        runtime_verify(target, \"old\")\n    http_verify(target, \"old\")\n    if strict_errors:\n        assert_no_new_errors(target, baseline, \"verify-old\")\n    return inspect(target)\n\n\ndef lint_php(target, source, label):\n    out = qga(\n        target,\n        [\"/usr/bin/php8.3\", \"-l\"],\n        input_bytes=source.encode(),\n        timeout=90,\n    )\n    if \"No syntax errors detected\" not in out:\n        fail(\"PHP_LINT_\" + label)\n\n\ndef cluster_guard():\n    p = run([\"/usr/sbin/qm\", \"status\", \"210\"], timeout=30)\n    if \"status: running\" not in p.stdout.decode():\n        fail(\"VM210_NOT_RUNNING\")\n    p = run(\n        [\n            \"/usr/bin/ssh\",\n            \"-T\",\n            \"-o\",\n            \"BatchMode=yes\",\n            \"-o\",\n            \"StrictHostKeyChecking=yes\",\n            \"-o\",\n            \"UpdateHostKeys=no\",\n            \"-o\",\n            \"ConnectTimeout=10\",\n            \"root@pve03\",\n            \"/usr/sbin/qm status 211\",\n        ],\n        timeout=40,\n    )\n    if \"status: running\" not in p.stdout.decode():\n        fail(\"VM211_NOT_RUNNING\")\n    emit(\"PORTAL200_CLUSTER\", \"PASS\")\n\n\ndef result_contract(status, changes, rollback_started, rollback_restored):\n    emit(\n        \"HOMELAB_RESULT_CONTRACT\",\n        {\n            \"version\": 1,\n            \"command_id\": CID,\n            \"status\": status,\n            \"changes_made\": bool(changes),\n            \"rollback_started\": bool(rollback_started),\n            \"rollback_restored\": rollback_restored,\n        },\n    )\n\n\nemit(\"NEWFI200_BEGIN\")\nemit(\"COMMAND_ID\", CID)\nemit(\"PORTAL200_REMAINING_FULL_PRODUCT_COMMANDS_BEFORE\", 22)\nemit(\n    \"PORTAL200_FLOW\",\n    \"candidate->staging-apply->rollback-proof->staging-reapply->git-push->production\",\n)\n\nstaging_backup = False\nstaging_mutated = False\nstaging_final_new = False\nprod_backup = False\nprod_mutated = False\ngit_files_changed = False\ncommit_created = False\npush_confirmed = False\nfailure_rollback_started = False\nfailure_rollback_restored = None\nold_git_bytes = {}\nnew_head = None\ns_error = None\np_error = None\ns_old_templates = None\np_old_templates = None\n\ntry:\n    compile(HTTP_VERIFY_PY, \"<portal200-http-verify>\", \"exec\")\n    for rel, (size, sha) in EXPECTED_NEW.items():\n        p = CAND_ROOT / rel\n        if not p.is_file() or file_meta(p) != (size, sha):\n            fail(\"CANDIDATE_IDENTITY\")\n    tree = ET.parse(CAND_ROOT / \"_data/templates.xml\")\n    titles = sorted(x.attrib.get(\"title\") for x in tree.getroot().findall(\"template\"))\n    if titles != [\"newfi_portal\", \"newfi_portal.less\"]:\n        fail(\"CANDIDATE_TEMPLATE_SET\")\n    service = (CAND_ROOT / \"Service/PortalData.php\").read_text(\"utf-8\")\n    if any(\n        token in service\n        for token in [\n            \"\\\\XF::db(\",\n            \"->save(\",\n            \"->delete(\",\n            \"INSERT \",\n            \"UPDATE \",\n            \"DELETE \",\n            \"REPLACE \",\n        ]\n    ):\n        fail(\"CANDIDATE_MUTATION_SCAN\")\n    emit(\"PORTAL200_CANDIDATE_IDENTITY\", \"PASS\")\n\n    branch = git(\"branch\", \"--show-current\")\n    head = git(\"rev-parse\", \"HEAD\")\n    status = git(\"status\", \"--porcelain=v1\", \"--untracked-files=all\")\n    remote_out = git(\"ls-remote\", \"origin\", f\"refs/heads/{BRANCH}\")\n    remote = remote_out.split()[0] if remote_out else \"\"\n    if branch != BRANCH or head != OLD_HEAD or remote != OLD_HEAD or status:\n        fail(\"GIT_PRESTATE\")\n    emit(\n        \"PORTAL200_GIT_PRESTATE\",\n        {\"branch\": branch, \"head\": head, \"remote\": remote, \"clean\": True},\n    )\n    cluster_guard()\n\n    lint_php(\"staging\", INSPECT_PHP, \"INSPECT_STAGING\")\n    lint_php(\"staging\", IMPORT_PHP, \"IMPORT_STAGING\")\n    lint_php(\"staging\", RUNTIME_VERIFY_PHP_TEMPLATE.replace(\"__STATE__\", \"new\"), \"RUNTIME_STAGING\")\n    lint_php(\"prod\", INSPECT_PHP, \"INSPECT_PROD\")\n    lint_php(\"prod\", IMPORT_PHP, \"IMPORT_PROD\")\n    lint_php(\"prod\", RUNTIME_VERIFY_PHP_TEMPLATE.replace(\"__STATE__\", \"new\"), \"RUNTIME_PROD\")\n    emit(\"PORTAL200_RUNTIME_HELPER_LINT\", \"PASS\")\n\n    s0 = inspect(\"staging\")\n    p0 = inspect(\"prod\")\n    if not app_contract(s0, \"staging\") or not app_contract(p0, \"prod\"):\n        fail(\"APP_PRESTATE\")\n    if not source_is_old(s0) or not source_is_old(p0):\n        fail(\"SOURCE_PRESTATE\")\n    if s0.get(\"templates\") != p0.get(\"templates\"):\n        fail(\"TEMPLATE_PRESTATE_PARITY\")\n    s_error = int(s0[\"application\"][\"error_max_id\"])\n    p_error = int(p0[\"application\"][\"error_max_id\"])\n    s_old_templates = s0[\"templates\"]\n    p_old_templates = p0[\"templates\"]\n    emit(\"PORTAL200_ERROR_BASELINE\", {\"staging\": s_error, \"prod\": p_error})\n    http_verify(\"staging\", \"old\")\n    runtime_verify(\"prod\", \"old\")\n    http_verify(\"prod\", \"old\")\n    assert_no_new_errors(\"staging\", s_error, \"preflight\")\n    assert_no_new_errors(\"prod\", p_error, \"preflight\")\n    emit(\"PORTAL200_PREFLIGHT\", \"PASS\")\n\n    guest_backup(\"staging\")\n    staging_backup = True\n    staging_mutated = True\n    install_candidate(\"staging\")\n    import_addon(\"staging\")\n    verify_new(\"staging\", s_error)\n    emit(\"PORTAL200_STAGING_FIRST_APPLY\", \"PASS\")\n\n    restore_old(\"staging\")\n    import_addon(\"staging\")\n    verify_old(\"staging\", s_error, s_old_templates)\n    staging_mutated = False\n    emit(\"PORTAL200_STAGING_ROLLBACK_PROOF\", \"PASS\")\n\n    staging_mutated = True\n    install_candidate(\"staging\")\n    import_addon(\"staging\")\n    verify_new(\"staging\", s_error)\n    staging_final_new = True\n    emit(\"PORTAL200_STAGING_FINAL\", \"PASS\")\n\n    for rel in EXPECTED_NEW:\n        dest = GIT_PORTAL / rel\n        old_git_bytes[str(rel)] = dest.read_bytes() if dest.exists() else None\n        dest.parent.mkdir(parents=True, exist_ok=True)\n        shutil.copyfile(CAND_ROOT / rel, dest)\n    git_files_changed = True\n\n    if git(\"diff\", \"--check\"):\n        fail(\"GIT_DIFF_CHECK\")\n    status_lines = git(\"status\", \"--porcelain=v1\", \"--untracked-files=all\").splitlines()\n    actual_paths = sorted(line[3:] for line in status_lines if len(line) >= 4)\n    if actual_paths != sorted(EXPECTED_GIT_PATHS):\n        fail(\"GIT_SCOPE\")\n    git(\"add\", \"--\", *EXPECTED_GIT_PATHS)\n    staged = sorted(x for x in git(\"diff\", \"--cached\", \"--name-only\").splitlines() if x)\n    if staged != sorted(EXPECTED_GIT_PATHS):\n        fail(\"GIT_STAGED_SCOPE\")\n    git(\"commit\", \"-m\", f\"feat: build data-backed Newfi portal [{CID}]\")\n    commit_created = True\n    new_head = git(\"rev-parse\", \"HEAD\")\n    if new_head == OLD_HEAD:\n        fail(\"GIT_COMMIT_HEAD\")\n    if git(\"status\", \"--porcelain=v1\", \"--untracked-files=all\"):\n        fail(\"GIT_POSTCOMMIT_DIRTY\")\n    git(\"push\", \"origin\", f\"HEAD:refs/heads/{BRANCH}\", timeout=180)\n    remote_out = git(\"ls-remote\", \"origin\", f\"refs/heads/{BRANCH}\")\n    remote_head = remote_out.split()[0] if remote_out else \"\"\n    if remote_head != new_head:\n        fail(\"GIT_REMOTE_HEAD\")\n    push_confirmed = True\n    emit(\n        \"PORTAL200_GIT_PROMOTION\",\n        {\n            \"old_head\": OLD_HEAD,\n            \"new_head\": new_head,\n            \"remote_head\": remote_head,\n            \"result\": \"PASS\",\n        },\n    )\n\n    p_pre = inspect(\"prod\")\n    if not source_is_old(p_pre) or p_pre.get(\"templates\") != p_old_templates:\n        fail(\"PROD_DRIFT_BEFORE_APPLY\")\n    if int(p_pre[\"application\"][\"error_max_id\"]) != p_error:\n        fail(\"PROD_ERROR_DRIFT\")\n    guest_backup(\"prod\")\n    prod_backup = True\n    prod_mutated = True\n    install_candidate(\"prod\")\n    import_addon(\"prod\")\n    verify_new(\"prod\", p_error)\n    emit(\"PORTAL200_PRODUCTION\", \"PASS\")\n\n    sf = verify_new(\"staging\", s_error)\n    pf = verify_new(\"prod\", p_error)\n    if sf[\"source\"] != pf[\"source\"]:\n        fail(\"FINAL_SOURCE_PARITY\")\n    if sf[\"templates\"] != pf[\"templates\"]:\n        fail(\"FINAL_TEMPLATE_PARITY\")\n    if git(\"rev-parse\", \"HEAD\") != new_head:\n        fail(\"FINAL_LOCAL_HEAD\")\n    remote_out = git(\"ls-remote\", \"origin\", f\"refs/heads/{BRANCH}\")\n    if not remote_out or remote_out.split()[0] != new_head:\n        fail(\"FINAL_REMOTE_HEAD\")\n    if git(\"status\", \"--porcelain=v1\", \"--untracked-files=all\"):\n        fail(\"FINAL_GIT_DIRTY\")\n    cluster_guard()\n    emit(\n        \"PORTAL200_FINAL_EVIDENCE\",\n        {\n            \"commit\": new_head,\n            \"source_files\": 3,\n            \"templates\": 2,\n            \"staging_error_baseline\": s_error,\n            \"prod_error_baseline\": p_error,\n        },\n    )\n    emit(\"PORTAL200_PORTAL\", \"PASS\")\n    emit(\"PORTAL200_STAGING\", \"PASS\")\n    emit(\"PORTAL200_PRODUCTION\", \"PASS\")\n    emit(\"PORTAL200_REMAINING_FULL_PRODUCT_COMMANDS_AFTER_PASS\", 21)\n    result_contract(\"OK\", True, False, None)\n    emit(\"NEWFI200_END\")\n    raise SystemExit(0)\n\nexcept PortalError as exc:\n    code = str(exc)\n    emit(\"PORTAL200_FAILURE\", code)\n\n    if push_confirmed:\n        if prod_mutated and prod_backup:\n            failure_rollback_started = True\n            try:\n                restore_old(\"prod\")\n                import_addon(\"prod\")\n                verify_old(\"prod\", p_error, p_old_templates, strict_errors=False)\n                prod_mutated = False\n                failure_rollback_restored = False\n                emit(\"PORTAL200_FAILURE_PROD_ROLLBACK\", \"PASS_PARTIAL_OVERALL_STATE_CHANGED\")\n            except Exception:\n                failure_rollback_restored = False\n                emit(\"PORTAL200_FAILURE_PROD_ROLLBACK\", \"FAIL\")\n    else:\n        if staging_mutated and staging_backup:\n            failure_rollback_started = True\n            try:\n                restore_old(\"staging\")\n                import_addon(\"staging\")\n                verify_old(\"staging\", s_error, s_old_templates, strict_errors=False)\n                staging_mutated = False\n                staging_final_new = False\n                failure_rollback_restored = True\n                emit(\"PORTAL200_FAILURE_STAGING_ROLLBACK\", \"PASS\")\n            except Exception:\n                failure_rollback_restored = False\n                emit(\"PORTAL200_FAILURE_STAGING_ROLLBACK\", \"FAIL\")\n\n        if git_files_changed and not commit_created:\n            try:\n                for rel, old in old_git_bytes.items():\n                    dest = GIT_PORTAL / rel\n                    if old is None:\n                        if dest.exists():\n                            dest.unlink()\n                    else:\n                        dest.write_bytes(old)\n                service_dir = GIT_PORTAL / \"Service\"\n                try:\n                    service_dir.rmdir()\n                except OSError:\n                    pass\n                emit(\"PORTAL200_FAILURE_GIT_WORKTREE_RESTORE\", \"PASS\")\n            except Exception:\n                emit(\"PORTAL200_FAILURE_GIT_WORKTREE_RESTORE\", \"FAIL\")\n\n        if commit_created:\n            emit(\n                \"PORTAL200_FAILURE_GIT_HISTORY\",\n                \"COMMIT_CREATED_NO_DESTRUCTIVE_RESET_FRESH_ID_REQUIRED\",\n            )\n\n    persisted = bool(push_confirmed or commit_created or staging_final_new or prod_mutated)\n    if failure_rollback_started and failure_rollback_restored is None:\n        failure_rollback_restored = False\n    result_contract(\n        \"ERROR\",\n        persisted,\n        failure_rollback_started,\n        failure_rollback_restored,\n    )\n    emit(\"PORTAL200_ROADMAP_REMAINS\", 22)\n    emit(\"NEWFI200_END\")\n    raise SystemExit(1)\n\nexcept Exception:\n    emit(\"PORTAL200_FAILURE\", \"UNEXPECTED_EXCEPTION\")\n    result_contract(\n        \"ERROR\",\n        bool(push_confirmed or commit_created or staging_final_new or prod_mutated),\n        False,\n        None,\n    )\n    emit(\"PORTAL200_ROADMAP_REMAINS\", 22)\n    emit(\"NEWFI200_END\")\n    raise SystemExit(1)\n\nCANDIDATE_LAYER_4_TEXT_END\nCANDIDATE_LAYER_5_SOURCE=file:newfi-55-portal200-apply3-rca.cmd::b64::zlib\nCANDIDATE_LAYER_5_SHA256=8911318cd314572edf9c6343c09b4c83d283e946dd2398ea2e05722ac9bd44ac\nCANDIDATE_LAYER_5_BYTES=10641\nCANDIDATE_LAYER_5_TEXT_BEGIN\nimport hashlib\nimport json\nimport pathlib\nimport shlex\nimport subprocess\n\nCID = \"NEWFI-260907-PORTAL200-APPLY3RCA1\"\nFAILED_CID = \"NEWFI-260907-PORTAL200-APPLY3\"\nWT = pathlib.Path(\"/root/newfi-portal/.worktrees/implementation-newfi-closed-mvp-20260906\")\nBRANCH = \"implementation/newfi-closed-mvp-20260906\"\nOLD_HEAD = \"06bab5acd124e768f70305b3d7eca2f595871890\"\nFAILED_DIR = pathlib.Path(\"/root/newfi-run-\" + FAILED_CID)\nWRAPPER = FAILED_DIR / \"wrapper.log\"\n\nOLD = {\n    \"controller\": \"53909e753ea5a011550fd280ad1c342a74ca9949be092dfbd95244243cae92f3\",\n    \"templates_xml\": \"c29c04f8b937284e821c87957653e87c2f6ac014fac30648a0f6b18e84392adf\",\n}\nNEW = {\n    \"controller\": \"619d489f7cc3b461479c702fa8825097ae22d3c6cfeb911e9f14ea1de9c36d6d\",\n    \"service\": \"4da03f26294ab6d163a1a746dee4bb6a82d7d4f39e66b24246bc0eb4c455dd1d\",\n    \"templates_xml\": \"1650c3d868d4bc47703f1b75f1f179cd25309b2d3b20a2b848e81a4423c00861\",\n}\n\nINSPECT = '<?php\\n$root=\\'/var/www/forums/newfi/public\\';\\nrequire $root.\\'/src/XF.php\\';\\n\\\\XF::start($root);\\n$app=\\\\XF::setupApp(\\'XF\\\\\\\\Pub\\\\\\\\App\\');\\n$db=$app->db();\\n\\nfunction meta($p) {\\n    if (!is_file($p)) { return null; }\\n    return [\\'bytes\\'=>filesize($p),\\'sha256\\'=>hash_file(\\'sha256\\',$p)];\\n}\\n\\n$portal=$root.\\'/src/addons/Newfi/Portal\\';\\n$baseline=(gethostname()===\\'newfi-staging\\') ? 40 : 0;\\n\\n$templates=$db->fetchAll(\\n    \"SELECT title,style_id,LENGTH(template) AS bytes,SHA2(template,256) AS sha256,\" .\\n    \" LOCATE(\\'data-newfi-portal200\\',template)>0 AS html_marker,\" .\\n    \" LOCATE(\\'--newfi-portal200\\',template)>0 AS css_marker\" .\\n    \" FROM xf_template WHERE addon_id=\\'Newfi/Portal\\' ORDER BY style_id,title\"\\n);\\n\\n$errors=$db->fetchAll(\\n    \"SELECT error_id,exception_type,message,filename,line\" .\\n    \" FROM xf_error_log WHERE error_id>? ORDER BY error_id LIMIT 30\",\\n    [$baseline]\\n);\\n\\n$result=[\\n    \\'hostname\\'=>gethostname(),\\n    \\'application\\'=>[\\n        \\'boardActive\\'=>(string)$db->fetchOne(\"SELECT option_value FROM xf_option WHERE option_id=\\'boardActive\\'\"),\\n        \\'boardUrl\\'=>(string)$db->fetchOne(\"SELECT option_value FROM xf_option WHERE option_id=\\'boardUrl\\'\"),\\n        \\'indexRoute\\'=>(string)$db->fetchOne(\"SELECT option_value FROM xf_option WHERE option_id=\\'indexRoute\\'\"),\\n        \\'error_count\\'=>(int)$db->fetchOne(\"SELECT COUNT(*) FROM xf_error_log\"),\\n        \\'error_max_id\\'=>(int)$db->fetchOne(\"SELECT COALESCE(MAX(error_id),0) FROM xf_error_log\")\\n    ],\\n    \\'source\\'=>[\\n        \\'controller\\'=>meta($portal.\\'/Pub/Controller/Portal.php\\'),\\n        \\'service\\'=>meta($portal.\\'/Service/PortalData.php\\'),\\n        \\'templates_xml\\'=>meta($portal.\\'/_data/templates.xml\\')\\n    ],\\n    \\'templates\\'=>$templates,\\n    \\'new_errors\\'=>$errors\\n];\\n\\necho \"PORTAL200_RCA_GUEST_JSON=\" .\\n    json_encode($result,JSON_UNESCAPED_UNICODE|JSON_UNESCAPED_SLASHES|JSON_INVALID_UTF8_SUBSTITUTE) .\\n    \"\\\\n\";\\n?>'\n\ndef emit(k, v=None):\n    if v is None:\n        print(k, flush=True)\n    elif isinstance(v, (dict, list, bool, int, float)):\n        print(k + \"=\" + json.dumps(v, ensure_ascii=False, sort_keys=True, separators=(\",\", \":\")), flush=True)\n    else:\n        print(k + \"=\" + str(v), flush=True)\n\ndef run(cmd, *, input_bytes=None, timeout=120):\n    return subprocess.run(\n        cmd, input=input_bytes, stdout=subprocess.PIPE, stderr=subprocess.PIPE,\n        timeout=timeout, check=False\n    )\n\ndef git(*args):\n    p = run([\"/usr/bin/git\", \"-C\", str(WT), *args], timeout=90)\n    return p.returncode, p.stdout.decode(\"utf-8\", \"replace\").strip(), p.stderr.decode(\"utf-8\", \"replace\").strip()\n\ndef qga(target, php_source):\n    if target == \"prod\":\n        cmd = [\n            \"/usr/sbin/qm\", \"guest\", \"exec\", \"210\",\n            \"--synchronous\", \"1\", \"--timeout\", \"120\",\n            \"--pass-stdin\", \"1\", \"--\", \"/usr/bin/php8.3\"\n        ]\n    else:\n        q = [\n            \"/usr/sbin/qm\", \"guest\", \"exec\", \"211\",\n            \"--synchronous\", \"1\", \"--timeout\", \"120\",\n            \"--pass-stdin\", \"1\", \"--\", \"/usr/bin/php8.3\"\n        ]\n        remote = (\n            \"test \\\"$(id -u):$(hostname -s)\\\" = 0:pve03 || exit 72; \"\n            \"for f in /etc/pve/HOMELAB_ASSISTANT_ERROR_REGISTER.md /etc/pve/31_HOMELAB_REFERENCE.md; do \"\n            \"test -r \\\"$f\\\" && test -s \\\"$f\\\" && cat -- \\\"$f\\\" >/dev/null || exit 73; done; exec \"\n            + \" \".join(shlex.quote(x) for x in q)\n        )\n        cmd = [\n            \"/usr/bin/ssh\", \"-T\",\n            \"-o\", \"BatchMode=yes\",\n            \"-o\", \"StrictHostKeyChecking=yes\",\n            \"-o\", \"UpdateHostKeys=no\",\n            \"-o\", \"ConnectTimeout=10\",\n            \"-o\", \"ConnectionAttempts=1\",\n            \"root@pve03\", remote\n        ]\n    p = run(cmd, input_bytes=php_source.encode(\"utf-8\"), timeout=150)\n    if p.returncode != 0:\n        return {\"transport_rc\": p.returncode, \"transport_error\": p.stderr.decode(\"utf-8\", \"replace\")[:500]}\n    try:\n        outer = json.loads(p.stdout.decode(\"utf-8\", \"replace\"))\n    except Exception:\n        return {\"transport_rc\": 0, \"outer_json\": False, \"raw\": p.stdout.decode(\"utf-8\", \"replace\")[:1000]}\n    if outer.get(\"exitcode\") != 0:\n        return {\n            \"transport_rc\": 0,\n            \"guest_rc\": outer.get(\"exitcode\"),\n            \"guest_out\": outer.get(\"out-data\", \"\")[:1000],\n            \"guest_err\": outer.get(\"err-data\", \"\")[:1000],\n        }\n    out = outer.get(\"out-data\", \"\")\n    marker = \"PORTAL200_RCA_GUEST_JSON=\"\n    line = next((x for x in out.splitlines() if x.startswith(marker)), None)\n    if not line:\n        return {\"transport_rc\": 0, \"guest_rc\": 0, \"marker\": False, \"guest_out\": out[:1000]}\n    return json.loads(line[len(marker):])\n\ndef source_state(data):\n    src = data.get(\"source\", {})\n    controller = (src.get(\"controller\") or {}).get(\"sha256\")\n    service = src.get(\"service\")\n    templates = (src.get(\"templates_xml\") or {}).get(\"sha256\")\n    if controller == OLD[\"controller\"] and service is None and templates == OLD[\"templates_xml\"]:\n        return \"OLD\"\n    if (\n        controller == NEW[\"controller\"]\n        and (service or {}).get(\"sha256\") == NEW[\"service\"]\n        and templates == NEW[\"templates_xml\"]\n    ):\n        return \"NEW\"\n    return \"DRIFT\"\n\ndef template_state(data):\n    rows = data.get(\"templates\", [])\n    titles = [r.get(\"title\") for r in rows]\n    has_html = any(bool(r.get(\"html_marker\")) for r in rows)\n    has_css = any(bool(r.get(\"css_marker\")) for r in rows)\n    if titles == [\"newfi_portal\"] and not has_html and not has_css:\n        return \"OLD\"\n    if titles == [\"newfi_portal\", \"newfi_portal.less\"] and has_html and has_css:\n        return \"NEW\"\n    return \"DRIFT\"\n\nemit(\"NEWFI55_BEGIN\")\nemit(\"COMMAND_ID\", CID)\nemit(\"RCA_TARGET_FAILED_COMMAND\", FAILED_CID)\nemit(\"PORTAL200_ROADMAP_REMAINS\", 22)\nemit(\"RCA_MUTATION_SCOPE\", \"NONE_READ_ONLY\")\n\nif WRAPPER.is_file() and not WRAPPER.is_symlink():\n    raw = WRAPPER.read_bytes()\n    emit(\"RCA_WRAPPER_BYTES\", len(raw))\n    emit(\"RCA_WRAPPER_SHA256\", hashlib.sha256(raw).hexdigest())\n    text = raw.decode(\"utf-8\", \"replace\")\n    keep_prefixes = (\n        \"CHAT_OUTPUT_BEGIN\", \"CHAT_OUTPUT_END\", \"COMMAND_ID=\", \"STATUS=\", \"RC=\",\n        \"RESULT_CONTRACT_\", \"COMMAND_RC=\", \"CHANGES_MADE=\", \"ROLLBACK_\",\n        \"MUTATION_OUTCOME=\", \"OUTPUT_BEGIN\", \"OUTPUT_END\", \"NEWFI200\",\n        \"PORTAL200_\", \"HOMELAB_RESULT_CONTRACT=\", \"STOP=\", \"Traceback\",\n    )\n    selected = [line for line in text.splitlines() if line.startswith(keep_prefixes)]\n    emit(\"RCA_WRAPPER_SELECTED_LINE_COUNT\", len(selected))\n    print(\"RCA_WRAPPER_SELECTED_BEGIN\", flush=True)\n    for line in selected[-250:]:\n        print(line, flush=True)\n    print(\"RCA_WRAPPER_SELECTED_END\", flush=True)\nelse:\n    emit(\"RCA_WRAPPER_MISSING\", True)\n\n_, branch, _ = git(\"branch\", \"--show-current\")\n_, head, _ = git(\"rev-parse\", \"HEAD\")\n_, remote_out, _ = git(\"ls-remote\", \"origin\", f\"refs/heads/{BRANCH}\")\n_, status, _ = git(\"status\", \"--porcelain=v1\", \"--untracked-files=all\")\nremote = remote_out.split()[0] if remote_out else \"\"\n\ngit_state = {\n    \"branch\": branch,\n    \"head\": head,\n    \"remote\": remote,\n    \"clean\": (status == \"\"),\n    \"status_lines\": status.splitlines()[:20],\n}\nemit(\"RCA_GIT_STATE\", git_state)\n\nstaging = qga(\"staging\", INSPECT)\nprod = qga(\"prod\", INSPECT)\n\nemit(\"RCA_STAGING_STATE\", staging)\nemit(\"RCA_PROD_STATE\", prod)\n\ns_src = source_state(staging) if isinstance(staging, dict) else \"UNKNOWN\"\np_src = source_state(prod) if isinstance(prod, dict) else \"UNKNOWN\"\ns_tpl = template_state(staging) if isinstance(staging, dict) else \"UNKNOWN\"\np_tpl = template_state(prod) if isinstance(prod, dict) else \"UNKNOWN\"\n\nsummary = {\n    \"git_old_head\": head == OLD_HEAD and remote == OLD_HEAD,\n    \"git_clean\": status == \"\",\n    \"staging_source\": s_src,\n    \"staging_templates\": s_tpl,\n    \"staging_error_max\": staging.get(\"application\", {}).get(\"error_max_id\") if isinstance(staging, dict) else None,\n    \"prod_source\": p_src,\n    \"prod_templates\": p_tpl,\n    \"prod_error_max\": prod.get(\"application\", {}).get(\"error_max_id\") if isinstance(prod, dict) else None,\n}\nsummary[\"clean_old_prestate\"] = bool(\n    summary[\"git_old_head\"]\n    and summary[\"git_clean\"]\n    and s_src == \"OLD\"\n    and s_tpl == \"OLD\"\n    and p_src == \"OLD\"\n    and p_tpl == \"OLD\"\n)\nemit(\"RCA_STATE_SUMMARY\", summary)\n\nrunner_path = pathlib.Path(\"/usr/local/sbin/homelab-chat-run\")\nif runner_path.is_file() and not runner_path.is_symlink():\n    runner_bytes = runner_path.read_bytes()\n    runner_text = runner_bytes.decode(\"utf-8\", \"replace\")\n    emit(\"RCA_RUNNER_SHA256\", hashlib.sha256(runner_bytes).hexdigest())\n    emit(\"RCA_RUNNER_BYTES\", len(runner_bytes))\n    lines = runner_text.splitlines()\n    terms = (\n        \"HOMELAB_RESULT_CONTRACT\",\n        \"rollback_restored\",\n        \"rollback_started\",\n        \"changes_made\",\n        \"status not in\",\n        \"ValueError\",\n    )\n    indexes = set()\n    for i, line in enumerate(lines):\n        if any(t in line for t in terms):\n            for j in range(max(0, i - 3), min(len(lines), i + 4)):\n                indexes.add(j)\n    print(\"RCA_RUNNER_CONTRACT_SOURCE_BEGIN\", flush=True)\n    for j in sorted(indexes):\n        line = lines[j]\n        if len(line) > 500:\n            line = line[:500] + \"...[TRUNCATED]\"\n        print(json.dumps({\"line\": j + 1, \"text\": line}, ensure_ascii=False, separators=(\",\", \":\")), flush=True)\n    print(\"RCA_RUNNER_CONTRACT_SOURCE_END\", flush=True)\nelse:\n    emit(\"RCA_RUNNER_SOURCE_MISSING\", True)\n\nemit(\"HOMELAB_RESULT_CONTRACT\", {\n    \"version\": 1,\n    \"command_id\": CID,\n    \"status\": \"OK\",\n    \"changes_made\": False,\n    \"rollback_started\": False,\n    \"rollback_restored\": None\n})\nemit(\"NEWFI55_END\")\n\nCANDIDATE_LAYER_5_TEXT_END\nCANDIDATE_LAYER_6_SOURCE=file:newfi-39-portal200-rca1.cmd::b64::zlib\nCANDIDATE_LAYER_6_SHA256=08edd716820df9797dc01cbee765750d9924fc4f94855fde4aba2c25eacb76f2\nCANDIDATE_LAYER_6_BYTES=9466\nCANDIDATE_LAYER_6_TEXT_BEGIN\nimport hashlib\nimport json\nimport pathlib\nimport shlex\nimport subprocess\n\nCID = \"NEWFI-260907-PORTAL200-RCA1\"\nFAILED_CID = \"NEWFI-260907-PORTAL200-APPLY1\"\nWT = pathlib.Path(\"/root/newfi-portal/.worktrees/implementation-newfi-closed-mvp-20260906\")\nBRANCH = \"implementation/newfi-closed-mvp-20260906\"\nOLD_HEAD = \"06bab5acd124e768f70305b3d7eca2f595871890\"\nFAILED_DIR = pathlib.Path(\"/root/newfi-run-\" + FAILED_CID)\nWRAPPER = FAILED_DIR / \"wrapper.log\"\n\nOLD = {\n    \"controller\": \"53909e753ea5a011550fd280ad1c342a74ca9949be092dfbd95244243cae92f3\",\n    \"templates_xml\": \"c29c04f8b937284e821c87957653e87c2f6ac014fac30648a0f6b18e84392adf\",\n}\nNEW = {\n    \"controller\": \"619d489f7cc3b461479c702fa8825097ae22d3c6cfeb911e9f14ea1de9c36d6d\",\n    \"service\": \"4da03f26294ab6d163a1a746dee4bb6a82d7d4f39e66b24246bc0eb4c455dd1d\",\n    \"templates_xml\": \"1650c3d868d4bc47703f1b75f1f179cd25309b2d3b20a2b848e81a4423c00861\",\n}\n\nINSPECT = '<?php\\n$root=\\'/var/www/forums/newfi/public\\';\\nrequire $root.\\'/src/XF.php\\';\\n\\\\XF::start($root);\\n$app=\\\\XF::setupApp(\\'XF\\\\\\\\Pub\\\\\\\\App\\');\\n$db=$app->db();\\n\\nfunction meta($p) {\\n    if (!is_file($p)) { return null; }\\n    return [\\'bytes\\'=>filesize($p),\\'sha256\\'=>hash_file(\\'sha256\\',$p)];\\n}\\n\\n$portal=$root.\\'/src/addons/Newfi/Portal\\';\\n$baseline=(gethostname()===\\'newfi-staging\\') ? 40 : 0;\\n\\n$templates=$db->fetchAll(\\n    \"SELECT title,style_id,LENGTH(template) AS bytes,SHA2(template,256) AS sha256,\" .\\n    \" LOCATE(\\'data-newfi-portal200\\',template)>0 AS html_marker,\" .\\n    \" LOCATE(\\'--newfi-portal200\\',template)>0 AS css_marker\" .\\n    \" FROM xf_template WHERE addon_id=\\'Newfi/Portal\\' ORDER BY style_id,title\"\\n);\\n\\n$errors=$db->fetchAll(\\n    \"SELECT error_id,exception_type,message,filename,line\" .\\n    \" FROM xf_error_log WHERE error_id>? ORDER BY error_id LIMIT 30\",\\n    [$baseline]\\n);\\n\\n$result=[\\n    \\'hostname\\'=>gethostname(),\\n    \\'application\\'=>[\\n        \\'boardActive\\'=>(string)$db->fetchOne(\"SELECT option_value FROM xf_option WHERE option_id=\\'boardActive\\'\"),\\n        \\'boardUrl\\'=>(string)$db->fetchOne(\"SELECT option_value FROM xf_option WHERE option_id=\\'boardUrl\\'\"),\\n        \\'indexRoute\\'=>(string)$db->fetchOne(\"SELECT option_value FROM xf_option WHERE option_id=\\'indexRoute\\'\"),\\n        \\'error_count\\'=>(int)$db->fetchOne(\"SELECT COUNT(*) FROM xf_error_log\"),\\n        \\'error_max_id\\'=>(int)$db->fetchOne(\"SELECT COALESCE(MAX(error_id),0) FROM xf_error_log\")\\n    ],\\n    \\'source\\'=>[\\n        \\'controller\\'=>meta($portal.\\'/Pub/Controller/Portal.php\\'),\\n        \\'service\\'=>meta($portal.\\'/Service/PortalData.php\\'),\\n        \\'templates_xml\\'=>meta($portal.\\'/_data/templates.xml\\')\\n    ],\\n    \\'templates\\'=>$templates,\\n    \\'new_errors\\'=>$errors\\n];\\n\\necho \"PORTAL200_RCA_GUEST_JSON=\" .\\n    json_encode($result,JSON_UNESCAPED_UNICODE|JSON_UNESCAPED_SLASHES|JSON_INVALID_UTF8_SUBSTITUTE) .\\n    \"\\\\n\";\\n?>'\n\ndef emit(k, v=None):\n    if v is None:\n        print(k, flush=True)\n    elif isinstance(v, (dict, list, bool, int, float)):\n        print(k + \"=\" + json.dumps(v, ensure_ascii=False, sort_keys=True, separators=(\",\", \":\")), flush=True)\n    else:\n        print(k + \"=\" + str(v), flush=True)\n\ndef run(cmd, *, input_bytes=None, timeout=120):\n    return subprocess.run(\n        cmd, input=input_bytes, stdout=subprocess.PIPE, stderr=subprocess.PIPE,\n        timeout=timeout, check=False\n    )\n\ndef git(*args):\n    p = run([\"/usr/bin/git\", \"-C\", str(WT), *args], timeout=90)\n    return p.returncode, p.stdout.decode(\"utf-8\", \"replace\").strip(), p.stderr.decode(\"utf-8\", \"replace\").strip()\n\ndef qga(target, php_source):\n    if target == \"prod\":\n        cmd = [\n            \"/usr/sbin/qm\", \"guest\", \"exec\", \"210\",\n            \"--synchronous\", \"1\", \"--timeout\", \"120\",\n            \"--pass-stdin\", \"1\", \"--\", \"/usr/bin/php8.3\"\n        ]\n    else:\n        q = [\n            \"/usr/sbin/qm\", \"guest\", \"exec\", \"211\",\n            \"--synchronous\", \"1\", \"--timeout\", \"120\",\n            \"--pass-stdin\", \"1\", \"--\", \"/usr/bin/php8.3\"\n        ]\n        remote = (\n            \"test \\\"$(id -u):$(hostname -s)\\\" = 0:pve03 || exit 72; \"\n            \"for f in /etc/pve/HOMELAB_ASSISTANT_ERROR_REGISTER.md /etc/pve/31_HOMELAB_REFERENCE.md; do \"\n            \"test -r \\\"$f\\\" && test -s \\\"$f\\\" && cat -- \\\"$f\\\" >/dev/null || exit 73; done; exec \"\n            + \" \".join(shlex.quote(x) for x in q)\n        )\n        cmd = [\n            \"/usr/bin/ssh\", \"-T\",\n            \"-o\", \"BatchMode=yes\",\n            \"-o\", \"StrictHostKeyChecking=yes\",\n            \"-o\", \"UpdateHostKeys=no\",\n            \"-o\", \"ConnectTimeout=10\",\n            \"-o\", \"ConnectionAttempts=1\",\n            \"root@pve03\", remote\n        ]\n    p = run(cmd, input_bytes=php_source.encode(\"utf-8\"), timeout=150)\n    if p.returncode != 0:\n        return {\"transport_rc\": p.returncode, \"transport_error\": p.stderr.decode(\"utf-8\", \"replace\")[:500]}\n    try:\n        outer = json.loads(p.stdout.decode(\"utf-8\", \"replace\"))\n    except Exception:\n        return {\"transport_rc\": 0, \"outer_json\": False, \"raw\": p.stdout.decode(\"utf-8\", \"replace\")[:1000]}\n    if outer.get(\"exitcode\") != 0:\n        return {\n            \"transport_rc\": 0,\n            \"guest_rc\": outer.get(\"exitcode\"),\n            \"guest_out\": outer.get(\"out-data\", \"\")[:1000],\n            \"guest_err\": outer.get(\"err-data\", \"\")[:1000],\n        }\n    out = outer.get(\"out-data\", \"\")\n    marker = \"PORTAL200_RCA_GUEST_JSON=\"\n    line = next((x for x in out.splitlines() if x.startswith(marker)), None)\n    if not line:\n        return {\"transport_rc\": 0, \"guest_rc\": 0, \"marker\": False, \"guest_out\": out[:1000]}\n    return json.loads(line[len(marker):])\n\ndef source_state(data):\n    src = data.get(\"source\", {})\n    controller = (src.get(\"controller\") or {}).get(\"sha256\")\n    service = src.get(\"service\")\n    templates = (src.get(\"templates_xml\") or {}).get(\"sha256\")\n    if controller == OLD[\"controller\"] and service is None and templates == OLD[\"templates_xml\"]:\n        return \"OLD\"\n    if (\n        controller == NEW[\"controller\"]\n        and (service or {}).get(\"sha256\") == NEW[\"service\"]\n        and templates == NEW[\"templates_xml\"]\n    ):\n        return \"NEW\"\n    return \"DRIFT\"\n\ndef template_state(data):\n    rows = data.get(\"templates\", [])\n    titles = [r.get(\"title\") for r in rows]\n    has_html = any(bool(r.get(\"html_marker\")) for r in rows)\n    has_css = any(bool(r.get(\"css_marker\")) for r in rows)\n    if titles == [\"newfi_portal\"] and not has_html and not has_css:\n        return \"OLD\"\n    if titles == [\"newfi_portal\", \"newfi_portal.less\"] and has_html and has_css:\n        return \"NEW\"\n    return \"DRIFT\"\n\nemit(\"NEWFI39_BEGIN\")\nemit(\"COMMAND_ID\", CID)\nemit(\"RCA_TARGET_FAILED_COMMAND\", FAILED_CID)\nemit(\"PORTAL200_ROADMAP_REMAINS\", 22)\nemit(\"RCA_MUTATION_SCOPE\", \"NONE_READ_ONLY\")\n\nif WRAPPER.is_file() and not WRAPPER.is_symlink():\n    raw = WRAPPER.read_bytes()\n    emit(\"RCA_WRAPPER_BYTES\", len(raw))\n    emit(\"RCA_WRAPPER_SHA256\", hashlib.sha256(raw).hexdigest())\n    text = raw.decode(\"utf-8\", \"replace\")\n    keep_prefixes = (\n        \"CHAT_OUTPUT_BEGIN\", \"CHAT_OUTPUT_END\", \"COMMAND_ID=\", \"STATUS=\", \"RC=\",\n        \"RESULT_CONTRACT_\", \"COMMAND_RC=\", \"CHANGES_MADE=\", \"ROLLBACK_\",\n        \"MUTATION_OUTCOME=\", \"OUTPUT_BEGIN\", \"OUTPUT_END\", \"NEWFI200\",\n        \"PORTAL200_\", \"HOMELAB_RESULT_CONTRACT=\", \"STOP=\", \"Traceback\",\n    )\n    selected = [line for line in text.splitlines() if line.startswith(keep_prefixes)]\n    emit(\"RCA_WRAPPER_SELECTED_LINE_COUNT\", len(selected))\n    print(\"RCA_WRAPPER_SELECTED_BEGIN\", flush=True)\n    for line in selected[-250:]:\n        print(line, flush=True)\n    print(\"RCA_WRAPPER_SELECTED_END\", flush=True)\nelse:\n    emit(\"RCA_WRAPPER_MISSING\", True)\n\n_, branch, _ = git(\"branch\", \"--show-current\")\n_, head, _ = git(\"rev-parse\", \"HEAD\")\n_, remote_out, _ = git(\"ls-remote\", \"origin\", f\"refs/heads/{BRANCH}\")\n_, status, _ = git(\"status\", \"--porcelain=v1\", \"--untracked-files=all\")\nremote = remote_out.split()[0] if remote_out else \"\"\n\ngit_state = {\n    \"branch\": branch,\n    \"head\": head,\n    \"remote\": remote,\n    \"clean\": (status == \"\"),\n    \"status_lines\": status.splitlines()[:20],\n}\nemit(\"RCA_GIT_STATE\", git_state)\n\nstaging = qga(\"staging\", INSPECT)\nprod = qga(\"prod\", INSPECT)\n\nemit(\"RCA_STAGING_STATE\", staging)\nemit(\"RCA_PROD_STATE\", prod)\n\ns_src = source_state(staging) if isinstance(staging, dict) else \"UNKNOWN\"\np_src = source_state(prod) if isinstance(prod, dict) else \"UNKNOWN\"\ns_tpl = template_state(staging) if isinstance(staging, dict) else \"UNKNOWN\"\np_tpl = template_state(prod) if isinstance(prod, dict) else \"UNKNOWN\"\n\nsummary = {\n    \"git_old_head\": head == OLD_HEAD and remote == OLD_HEAD,\n    \"git_clean\": status == \"\",\n    \"staging_source\": s_src,\n    \"staging_templates\": s_tpl,\n    \"staging_error_max\": staging.get(\"application\", {}).get(\"error_max_id\") if isinstance(staging, dict) else None,\n    \"prod_source\": p_src,\n    \"prod_templates\": p_tpl,\n    \"prod_error_max\": prod.get(\"application\", {}).get(\"error_max_id\") if isinstance(prod, dict) else None,\n}\nsummary[\"clean_old_prestate\"] = bool(\n    summary[\"git_old_head\"]\n    and summary[\"git_clean\"]\n    and s_src == \"OLD\"\n    and s_tpl == \"OLD\"\n    and p_src == \"OLD\"\n    and p_tpl == \"OLD\"\n)\nemit(\"RCA_STATE_SUMMARY\", summary)\n\nemit(\"HOMELAB_RESULT_CONTRACT\", {\n    \"version\": 1,\n    \"command_id\": CID,\n    \"status\": \"OK\",\n    \"changes_made\": False,\n    \"rollback_started\": False,\n    \"rollback_restored\": None\n})\nemit(\"NEWFI39_END\")\n\nCANDIDATE_LAYER_6_TEXT_END\nRECOVERED_VERSION_IDS=\nRECOVERED_VERSION_STRINGS==\nRECOVERED_SHA256_COUNT=11\nRECOVERED_SHA256=458c2cf0763e4790f7d2d3757efd883b25813a31aab4e8dce6f785b8dea48a6e,834973af57263b326ca6aee52b2ecb3fa2cf0fb486e5a77a62d4210395b8d9c3,28e855ff56c4844768f0e8606fe0edc2acb3f548a5c06fa15c0d80ae00e2bc1b,fc9fb1dbdb6141bfb43a8122dcf3db435a94da48d0a0c02fe9dfae019b1439c5,2f7977cbfaed7953bd70033c0cf92138eedf974f5886fadf4b4971f2d00a4143,b248a4c32c9cc64e5747e7dce6c7fc0a23f5124a77c71ce72e27a81aceae9d2d,619d489f7cc3b461479c702fa8825097ae22d3c6cfeb911e9f14ea1de9c36d6d,4da03f26294ab6d163a1a746dee4bb6a82d7d4f39e66b24246bc0eb4c455dd1d,1650c3d868d4bc47703f1b75f1f179cd25309b2d3b20a2b848e81a4423c00861,53909e753ea5a011550fd280ad1c342a74ca9949be092dfbd95244243cae92f3,c29c04f8b937284e821c87957653e87c2f6ac014fac30648a0f6b18e84392adf\nRECOVERY_RESULT=STRONG_APPLY3_CANDIDATE_EVIDENCE_FOUND\nLOCAL_APPLY3_CARRIER_RECOVERY5_END=true\n"
+}
diff --git a/runtime/history/NEWFI-260907-A-PORTAL200-APPLY4DESIGN5.txt b/runtime/history/NEWFI-260907-A-PORTAL200-APPLY4DESIGN5.txt
new file mode 100644
index 00000000..b49cfa0e
--- /dev/null
+++ b/runtime/history/NEWFI-260907-A-PORTAL200-APPLY4DESIGN5.txt
@@ -0,0 +1,5752 @@
+CHAT_OUTPUT_BEGIN
+COMMAND_ID=NEWFI-260907-A-PORTAL200-APPLY4DESIGN5
+STATUS=OK
+RC=0
+HOST=pve01
+MODE=read-only
+COMPONENT=newfi-portal200-apply4-local-carrier-recovery5
+REFERENCE_REGISTER_CHECK=OK
+REFERENCE_SHA256=5a3d8e5154c41cb582a4e0aca68090be1f0138918bf82131a948df326f9d8d66
+ERROR_REGISTER_CHECK=OK
+ERROR_REGISTER_SHA256=3b09a553ec0f527ed3afeed4753f52a74ee3036045bbfb3c685e9f8af4ba7ba0
+COMMAND_SHA256=d8972287e5a04bda3fc17acba988b2651b92ce4193aa3038f19cf27372093f65
+DUPLICATE_FAILED_COMMAND_BLOCKED=false
+EXECUTION_STARTED=true
+CHANGE_DECLARED=false
+RESULT_CONTRACT_VALID=true
+RESULT_CONTRACT_STATUS=NOT_APPLICABLE
+RESULT_CONTRACT_ERROR=NONE
+COMMAND_RC=0
+CHANGES_MADE=false
+ROLLBACK_STARTED=false
+ROLLBACK_RESTORED=null
+MUTATION_OUTCOME=NO_MUTATION
+SANITIZED=yes
+SECRETS_INCLUDED=no
+PRIVATE_ADDRESSES_INCLUDED=no
+RAW_EVIDENCE_SHA256=58a32ed77e16ff3fbab7bcfac43e592c6e2daf2a7cf6208e7a229a258b6e3a3f
+SANITIZED_OUTPUT_SHA256=58a32ed77e16ff3fbab7bcfac43e592c6e2daf2a7cf6208e7a229a258b6e3a3f
+OUTPUT_BEGIN
+LOCAL_APPLY3_CARRIER_RECOVERY5_BEGIN=true
+COMMAND_ID=NEWFI-260907-A-PORTAL200-APPLY4DESIGN5
+MUTATION_SCOPE=NONE_READ_ONLY
+LOCAL_MUTATIONS_PERFORMED=NO
+TARGET_OLD_COMMAND_ID=NEWFI-260907-PORTAL200-APPLY3
+SEED_COUNT=41
+SEED_BASENAMES=NEWFI.txt,NEWFI-260907-A-PORTAL200-APPLY4PREP1.stdout.txt,NEWFI-260907-B-PORTAL200-RUNNERCONTRACT2_REMOTE.txt,NEWFI-260907-B-PORTAL200-RUNNERCONTRACT2_STDOUT.txt,NEWFI-260907-B-PORTAL200-RUNNERCONTRACT4_REMOTE.txt,NEWFI-260907-B-PORTAL200-RUNNERCONTRACT4_STDOUT.txt,NEWFI-260907-B-PORTAL200-RUNNERCONTRACT5_REMOTE.txt,NEWFI-260907-B-PORTAL200-RUNNERCONTRACT5_STDOUT.txt,newfi-38-portal200-apply.cmd,newfi-39-portal200-rca1.cmd,newfi-40-plink-portal200-rca.cmd,newfi-41-plink-portal200-rca3.cmd,newfi-45-pageant-portal200-rca4.cmd,newfi-46-portal200-http-rca.cmd,newfi-48-portal200-apply2.cmd,newfi-49-portal200-preflight-rca.cmd,newfi-50-portal200-preflight-tail-rca.cmd,newfi-51-portal200-prod-http-network-rca.cmd,newfi-52-prod-public-http-rca.cmd,newfi-53-public-css-regex-rca.cmd,newfi-54-portal200-apply3.cmd,newfi-55-portal200-apply3-rca.cmd,newfi-56-portal200-apply3-failure-contract-rca.cmd,newfi-57-portal200-contract-rule-rca.cmd,newfi-58-portal200-exact-contract-rca.cmd,newfi-59-portal200-contract-ast-rca.cmd,newfi-60-portal200-import-contract-discovery.cmd,newfi-61-portal200-import-compact-discovery.cmd,newfi-62-xf-addon-rebuild-help.cmd,NEWFI45_PORTAL200_RCA4_REMOTE.txt,NEWFI45_PORTAL200_RCA4_REPORT.txt,NEWFI46_PORTAL200_HTTP_RCA_REMOTE.txt,NEWFI46_PORTAL200_HTTP_RCA_REPORT.txt,NEWFI46_PORTAL200_HTTP_RCA_STDOUT.txt,NEWFI48_PORTAL200_APPLY2_REMOTE.txt,NEWFI54_PORTAL200_APPLY3_REMOTE.txt,NEWFI55_REMOTE.txt,NEWFI55_STDOUT.txt,NEWFI56_REMOTE.txt,NEWFI56_STDOUT.txt,NEWFI_PARALLEL_FULL_HANDOFF_2026-09-07.txt
+SEED_SHA256=869d6fdf2d4ac222d9ab4b83242563676f201e6ab21b84360fa73fc7f9bf7195,240d0fad482deb05c93289edd7ac58a84e34b98fc620d1e924b561aace8630bb,92255a714b86966ab5a15a86d18c6257c6c131b20520a6d2d2443b8fe969e93a,9bffe2728a05e52f03ec52fddfcce229588b6f6cff59e8932d6c8b5ae97c592b,e92d1a64266be86cc8e5441ff9f51e2161e35e00ffd12dce1eb049a4b6437dd0,53c8ea2dc91c33b2872da3974ac5a682cbdc907c9d232a29921b674d490d474e,0b4ba8d2b1eef91c627884071bbcdeea8ad9b4f6c04c8650e44eb468253d15f6,a59a4b7a482a0a39a51e08553749c1f15bcf74d4ba449f6d50caf7a6ba60f9b5,8481b33b162a78f0e1398b69fda50f581ace72f87cdfb2a16fb66ceb67fa4987,34245e3a7c02145e7f11e3c7919385ff955e739a5b278ede66f8ec91499a31e4,a398e89eec09cca84a907876dfe46cf491d8b61c402c1dc4e4ec36eb92167845,11ea567ce0485bd87c5da8292c4d01d55e741a85b75fe0bf5073ca33133055f7,96b2de593d982ef7a5cd09c5618e6aabaac259f896a70cc8f1b476b0c3b16a58,2ce247a8dae973819605d246273b294bf23ce1d118c3e8b92517696caff927c9,f0ad32266492990e58a90991f2d6ae808c3e57c1ad53244bfcd26100e163cd73,2d5a55fbb00e63a280680b312d3eff3e28d524e29e8acf9ee8cae77b7c7d1f2e,fae07cfd5e9196871cd8bec8305262c95ecd09654994675e9a4ac4617d761f99,9aca123af4a9674c2bc10f308a65b622dce616cac17fbfe9b58db3782fbd2d0e,c8e9abf642daba2118f3419a00ceaeb0a0cc9a54ae75575e5e903a8db8fd1c1d,92b919e1b4e0b910da5b8357619d853c5791dc73fb8a70d097563128d7c818e7,573c5c94fe59ed072e094281668ce9847dc4a9882019a2b89d8ba5f190d92176,6c98cb81713e91d9866d264e59c513b8a968c4f52bfbad55450957524600bb10,69d7a46640fd020c0daab39c3195ca77ff777242c22b419f66dfcb69be3a8a23,1f99ab8666c4d51844b8e95bf3768cb1b017921824e9ba8857a6579dfaafb6af,e10dcbd211b75626199ed50dda79f34ae169caef24ba747c74b9c79ddaab509e,3621712ba5fecff93abca54c601f4f176d976a67344a506a92d6de79918f05a5,07d2b88b41b30e90058fa1d389cc52d1ea3b20b557a962f9004db720bfc8d2b0,88b9f92828c1ee19537526a1eea93a52c59bc2f32a7034e45508e53cca2e3667,c8827d2f8b0ddc34771c1c71ffbf517d1bd117dcf36b4d3e5439ae262bc86c32,7fc78755edbeee8c49d3d47e26a723c01ee0e1e6b022b8fd2f70ccacdf8f4338,edba9db8c9ddedb0fe3e727c7ed5a255d1da6de82da722431f3db053abff2f38,3ea9e7e83411127caf13af674570f0ef9ac968b13393b0a173ce1344d6a29cf0,1c91f522bb94d4ce292bb451dd847f394362c0a8f4745ae8823a5eed33e2a10b,cfd23052413cad9d435f9aba290956e93d9191312d568cd1cc69437fc602ad03,474b251535372a61e8be1acf215c1cc2240f8414bdd1c5e03309fd5faa2f8f99,71da2a66224075527d8aa04c1281fdb7a2b9f078d76c349fc05b48a4b803a4c3,f4600697557109030fc188376f1407fc02e4ec2eff2c635d81e2438f8a325fe3,65ff188b6b7bd06f59feca719f4fad6e07ff8304ef157425b162b3928f674d31,5f2eb373b3b37d29dff72b8b7d5cc1346283f7b2de02ae2eb95a229e542c5468,b2968ec8823fa4bb7b3d6fd4a25f25d6a486eb9740ecc6ef362d1b31e5f439b2,869d6fdf2d4ac222d9ab4b83242563676f201e6ab21b84360fa73fc7f9bf7195
+DECODED_LAYER_COUNT=64
+STRONG_LAYER_COUNT=3
+SOURCE_LAYER_COUNT=9
+CHOSEN_LAYER_COUNT=9
+CANDIDATE_LAYER_1_SOURCE=file:NEWFI.txt
+CANDIDATE_LAYER_1_SHA256=869d6fdf2d4ac222d9ab4b83242563676f201e6ab21b84360fa73fc7f9bf7195
+CANDIDATE_LAYER_1_BYTES=57343
+CANDIDATE_LAYER_1_TEXT_BEGIN
+
+ПОЛНЫЙ ПАРАЛЛЕЛЬНЫЙ HANDOFF: NEWFI / PORTAL200
+Дата сборки: 2026-09-07
+Назначение: начать работу сразу в двух чатах без повторного восстановления контекста.
+
+===============================================================================
+0. КРИТИЧЕСКОЕ РАЗДЕЛЕНИЕ ПРОЕКТОВ
+===============================================================================
+
+Приложенный handoff второго чата относится к KINGOFWOLK CSP.
+
+KINGOFWOLK:
+- agreed safe CSP stage полностью закрыт;
+- shared counter = 0;
+- final accepted checkpoint = KOW-260907-A-FINAL1;
+- его product-state НЕ переносить в NEWFI.
+
+Из KINGOFWOLK для NEWFI переиспользуются только проверенные operational rules:
+- true-parallel read-only direct bridge;
+- один writer для любых изменений;
+- Pageant -> Plink -> pve01 transport;
+- authority checks;
+- homelab-chat-run contracts;
+- immutable Gitea readback;
+- unique COMMAND_ID;
+- fail-closed drift handling;
+- destructive Git / raw SQL mutation prohibition.
+
+Полный KINGOFWOLK handoff приложен ниже как APPENDIX A.
+
+===============================================================================
+1. АКТИВНЫЙ ПРОЕКТ
+===============================================================================
+
+Проект: NEWFI.
+Активный участок: Portal200.
+
+Сейчас НЕ продолжаем KingOfWolk и НЕ занимаемся Linux.
+
+Текущая рабочая проблема:
+предыдущая change-команда Portal200 APPLY3 не является accepted checkpoint.
+После неё выполнены read-only RCA/discovery шаги.
+
+===============================================================================
+2. AUTHORITATIVE GITEA RUNTIME
+===============================================================================
+
+Runtime repo:
+homelab-admin/homelab-public-context
+
+Branch:
+assistant-runtime
+
+Authoritative exact readback:
+runtime/history/<COMMAND_ID>.txt
+
+Не полагаться на generic latest без точного COMMAND_ID.
+
+Ключевые текущие NEWFI checkpoints:
+
+A) NEWFI-260907-PORTAL200-APPLY3
+
+STATUS=FAIL
+RC=76
+HOST=pve01
+MODE=change
+COMPONENT=newfi-portal200-deploy
+
+Критично:
+RESULT_CONTRACT_VALID=false
+RESULT_CONTRACT_STATUS=UNKNOWN
+RESULT_CONTRACT_ERROR=INVALID_CONTRACT:ValueError
+COMMAND_RC=1
+CHANGES_MADE=unknown
+ROLLBACK_STARTED=unknown
+ROLLBACK_RESTORED=null
+MUTATION_OUTCOME=UNKNOWN
+
+Следствие:
+APPLY3 НЕЛЬЗЯ считать ни успешным deploy, ни доказанным rollback.
+Не повторять этот COMMAND_ID.
+Не строить следующий change на предположении, что production/staging точно остались
+в старом состоянии.
+
+B) NEWFI-260907-PORTAL200-CONTRACTAST1
+
+STATUS=OK
+RC=0
+MODE=read-only
+COMPONENT=newfi-portal200-contract-ast-rca
+CHANGES_MADE=false
+MUTATION_OUTCOME=NO_MUTATION
+
+Назначение:
+read-only RCA runner result-contract / AST после APPLY3.
+
+Это accepted diagnostic checkpoint.
+
+C) NEWFI-260907-PORTAL200-IMPORTDISC2
+
+STATUS=OK
+RC=0
+MODE=read-only
+COMPONENT=newfi-portal200-import-compact-discovery
+CHANGES_MADE=false
+MUTATION_OUTCOME=NO_MUTATION
+
+Назначение:
+compact read-only discovery import path + runner-contract requirements.
+
+Из опубликованного evidence видно, что runner contract жёстко валидирует как минимум:
+- поддерживаемую version;
+- command_id exact match;
+- status только OK / BLOCKED / FAIL;
+- changes_made обязан быть boolean.
+
+При APPLY4 не импровизировать contract JSON:
+сначала перечитать CONTRACTAST1/IMPORTDISC2 и runner source.
+
+D) NEWFI-260907-PORTAL200-REBUILDHELP1
+
+STATUS=OK
+RC=0
+MODE=read-only
+COMPONENT=newfi-portal200-rebuild-help
+CHANGES_MADE=false
+MUTATION_OUTCOME=NO_MUTATION
+
+Ключевой вывод:
+
+XenForo CLI поддерживает штатный:
+xf:addon-rebuild [options] [--] <id>
+
+Arguments:
+id = Add-On ID
+
+Option:
+-f, --force
+Skip verifying that the add-on is rebuildable
+
+Следствие:
+старый ручной PHP/import loop не должен быть механизмом следующего deploy.
+Следующий candidate должен опираться на штатный XenForo add-on rebuild,
+НО exact Add-On ID сначала должен быть подтверждён read-only evidence.
+Не hardcode Newfi/Portal только по памяти.
+
+===============================================================================
+3. ГЛАВНЫЙ ВЫВОД ПО APPLY3
+===============================================================================
+
+APPLY3 имеет ДВЕ независимые проблемы, которые нельзя смешивать:
+
+1. RUNNER / PUBLICATION CONTRACT FAILURE
+   Runner отклонил result contract:
+   INVALID_CONTRACT:ValueError.
+
+2. PRODUCT MUTATION STATE НЕ ДОКАЗАН
+   Outer runtime показывает:
+   CHANGES_MADE=unknown
+   ROLLBACK_STARTED=unknown
+   MUTATION_OUTCOME=UNKNOWN
+
+Поэтому правильная последовательность сейчас:
+
+НЕ:
+"сразу повторить deploy как APPLY4"
+
+А:
+- параллельно восстановить current prestate;
+- параллельно построить корректный APPLY4 design;
+- change запускать только после read-only PASS prestate.
+
+===============================================================================
+4. ПАРАЛЛЕЛЬНАЯ МОДЕЛЬ ДЛЯ NEWFI
+===============================================================================
+
+Использовать проверенную KOW concurrency model.
+
+LANE A = SINGLE WRITER / DEPLOY DESIGN
+LANE B = TRUE PARALLEL READ-ONLY AUDITOR
+
+Разрешено одновременно:
+- Lane A читает Git/Gitea/reference и строит новый carrier;
+- Lane B выполняет direct read-only audit;
+- оба читают immutable Gitea history.
+
+Запрещено:
+- два change одновременно;
+- два git commit/push writer;
+- два application/XenForo mutation path;
+- повтор failed COMMAND_ID;
+- Lane B mutation.
+
+На момент фактического APPLY4:
+Lane A — единственный writer.
+Lane B не должен запускать новый state-sensitive snapshot в середине mutation,
+кроме специально спроектированного concurrent monitor с drift guards.
+
+===============================================================================
+5. COMMAND_ID FAMILY ДЛЯ НОВОЙ ПАРАЛЛЕЛЬНОЙ СЕССИИ
+===============================================================================
+
+Чтобы не путать старую историю:
+
+Lane A:
+NEWFI-260907-A-PORTAL200-...
+
+Lane B:
+NEWFI-260907-B-PORTAL200-...
+
+Каждый attempt:
+новый COMMAND_ID.
+
+Не reuse:
+NEWFI-260907-PORTAL200-APPLY3
+или любой другой failed ID.
+
+===============================================================================
+6. LANE B — ПЕРВАЯ ЗАДАЧА, КОТОРУЮ МОЖНО ЗАПУСКАТЬ СРАЗУ
+===============================================================================
+
+Цель:
+POST-APPLY3 CURRENT-STATE RECOVERY AUDIT.
+
+Только read-only.
+
+Lane B должен доказать:
+
+1. Authority:
+   /etc/pve/HOMELAB_ASSISTANT_ERROR_REGISTER.md
+   /etc/pve/31_HOMELAB_REFERENCE.md
+   readable + nonempty + прочитаны.
+
+2. Runner:
+   current /usr/local/sbin/homelab-chat-run SHA;
+   exact result-contract schema;
+   duplicate command semantics.
+
+3. Git:
+   authoritative NEWFI repo/worktree;
+   branch;
+   local HEAD;
+   remote HEAD;
+   clean/dirty;
+   relevant Portal200 files + hashes;
+   no unknown local mutation.
+
+4. XenForo environment:
+   exact production/staging VM/CT IDs;
+   exact docroots;
+   exact XenForo versions;
+   service health;
+   current addon list.
+
+5. Exact Portal Add-On ID:
+   resolve from add-on metadata/live XF state.
+   Do not mutate.
+   Candidate methods:
+   - xf:addon-list;
+   - addon.json;
+   - xf_addon read-only SELECT;
+   - existing deployment metadata.
+
+6. Current Portal add-on state:
+   installed/active/version;
+   pending rebuild/install state if observable read-only;
+   relevant cache/code-cache presence;
+   current route behavior.
+
+7. APPLY3 aftermath:
+   whether product files differ from accepted pre-APPLY3 baseline;
+   whether DB/install state changed;
+   whether staging changed;
+   whether production changed;
+   whether rollback evidence exists.
+
+8. Health:
+   Nginx / PHP-FPM / MariaDB / related app services;
+   HTTP codes for important NEWFI routes.
+
+9. DB:
+   SELECT only.
+   No UPDATE/INSERT/DELETE/ALTER.
+
+10. Final decision:
+   ELIGIBLE_FOR_PORTAL200_APPLY4_PREP
+   or exact HOLD_...
+
+Lane B output should be bounded and sanitized.
+No secrets/private credentials.
+
+===============================================================================
+7. LANE A — ПЕРВАЯ ЗАДАЧА, КОТОРУЮ МОЖНО ДЕЛАТЬ ПАРАЛЛЕЛЬНО
+===============================================================================
+
+Lane A НЕ должен ждать Lane B, чтобы начать design.
+
+Он может сразу:
+
+1. перечитать:
+   APPLY3
+   CONTRACTAST1
+   IMPORTDISC2
+   REBUILDHELP1
+
+2. перечитать:
+   /etc/pve/HOMELAB_ASSISTANT_ERROR_REGISTER.md
+   /etc/pve/31_HOMELAB_REFERENCE.md
+
+3. найти authoritative NEWFI Git worktree / branch / Portal200 deployment source.
+
+4. построить APPLY4 carrier OFFLINE / PREP ONLY.
+
+5. В APPLY4 заранее исправить:
+   - result contract;
+   - official XenForo rebuild path;
+   - fail-closed prestate;
+   - explicit rollback semantics;
+   - exact mutation accounting;
+   - exact COMMAND_ID;
+   - publication/readback.
+
+6. Не запускать APPLY4 mutation, пока Lane B не подтвердил current-state eligibility.
+
+===============================================================================
+8. APPLY4 — ЧТО ДОЛЖНО БЫТЬ В ДИЗАЙНЕ
+===============================================================================
+
+APPLY4 не должен быть слепым rerun APPLY3.
+
+Обязательные свойства:
+
+A. PRESTATE
+- authority checks;
+- runner SHA;
+- exact Git local/remote/clean;
+- exact expected source bytes/hashes;
+- exact current Portal add-on state;
+- services healthy;
+- target environment identity;
+- no unexplained post-APPLY3 drift.
+
+B. ADD-ON IMPORT / REBUILD
+- use native XenForo command:
+  xf:addon-rebuild <CONFIRMED_ADDON_ID>
+- use -f only if evidence/design shows it is needed;
+- do not return to manual PHP import loop.
+
+C. RESULT CONTRACT
+Must match runner schema exactly.
+At minimum:
+- supported version;
+- exact command_id;
+- status in OK/BLOCKED/FAIL;
+- changes_made boolean;
+- rollback fields with correct types.
+Do not emit unknown where boolean is required.
+
+D. FAIL CLOSED
+If prestate is not exact:
+BLOCKED / no mutation.
+
+E. ROLLBACK
+Before mutation:
+- prove rollback target/material exists;
+- preserve previous product/app state;
+- rollback on any failed verification;
+- verify rollback result.
+
+F. VERIFICATION
+After candidate:
+- XenForo CLI exit;
+- add-on version/state;
+- relevant DB rows read-only;
+- routes;
+- services;
+- XenForo error log;
+- no unexpected file drift.
+
+G. GIT
+If Git promotion belongs in this Portal200 stage:
+- one writer;
+- explicit path staging;
+- git diff --check;
+- no git add .;
+- no reset --hard;
+- no git clean -fd;
+- no force push;
+- verify local == remote after push.
+
+H. PUBLICATION
+Exact runtime/history/<CID>.txt must be readable and match COMMAND_ID.
+
+===============================================================================
+9. ЧТО НЕЛЬЗЯ ДЕЛАТЬ
+===============================================================================
+
+- Не считать APPLY3 успешным.
+- Не считать APPLY3 rollback успешным.
+- Не reuse APPLY3 ID.
+- Не запускать raw SQL mutation.
+- Не запускать manual PHP import loop, пока native rebuild доказан.
+- Не hardcode add-on ID без live/source evidence.
+- Не делать git reset --hard.
+- Не делать git clean -fd.
+- Не force push.
+- Не запускать два writer.
+- Не принимать generic latest как authoritative без exact COMMAND_ID.
+- Не использовать KOW VM/IP/path как NEWFI environment.
+- Не переносить KOW product state в NEWFI.
+
+===============================================================================
+10. WINDOWS / SSH TRANSPORT — ПЕРЕИСПОЛЬЗУЕМ ИЗ KOW
+===============================================================================
+
+Plink:
+C:\Program Files\PuTTY\plink.exe
+
+Pageant:
+C:\Program Files\PuTTY\pageant.exe
+
+SSH key:
+<USERPROFILE>\Documents\ssh\homelab_ed25519.ppk
+
+Encrypted PPK.
+<REDACTED_SENSITIVE_LINE>
+
+Normal transport:
+
+CMD
+ -> PowerShell 5.1
+ -> Start-Process
+ -> Plink -batch -agent -ssh -P 22 -m <remotePath>
+ -> root@<PRIVATE_IPV4>
+ -> pve01
+ -> direct read-only bridge OR homelab-chat-run
+ -> Gitea runtime publication
+ -> exact immutable readback
+
+Do not use:
+- MobaXterm;
+- -i in normal carrier;
+- pause;
+- Notepad;
+- blind host-key acceptance.
+
+PowerShell:
+separate stdout/stderr;
+-NoNewWindow;
+-Wait;
+-PassThru;
+real ExitCode.
+
+Remote command file:
+UTF-8 no BOM;
+one physical line;
+SHA verified.
+
+Large payload:
+zlib + base64;
+SHA256;
+python3 -I -B.
+
+===============================================================================
+11. AUTHORITY CHECKS
+===============================================================================
+
+Перед серьёзной server command:
+
+/etc/pve/HOMELAB_ASSISTANT_ERROR_REGISTER.md
+/etc/pve/31_HOMELAB_REFERENCE.md
+
+Оба:
+readable;
+nonempty;
+прочитать.
+
+Visibly emit:
+
+ERROR_REGISTER_CHECK=OK
+REFERENCE_CHECK=OK
+AUTHORITY_CHECK_SCOPE=READABILITY_ONLY_INCIDENTS_NOT_CLOSED
+
+Fail -> STOP.
+
+===============================================================================
+12. GITEA READBACK
+===============================================================================
+
+Authoritative:
+
+https://git.gram1.ru/homelab-admin/homelab-public-context/raw/branch/assistant-runtime/runtime/history/<COMMAND_ID>.txt
+
+JSON, если нужен:
+
+https://git.gram1.ru/homelab-admin/homelab-public-context/raw/branch/assistant-runtime/runtime/history/<COMMAND_ID>.json
+
+Нельзя делать вывод по runtime/latest.txt,
+если COMMAND_ID не совпадает.
+
+===============================================================================
+13. КАК СИНХРОНИЗИРОВАТЬ ДВА ЧАТА
+===============================================================================
+
+После каждого accepted checkpoint:
+
+1. чат публикует exact COMMAND_ID;
+2. второй чат читает immutable Gitea history;
+3. оба обновляют общий current-state;
+4. FAIL/RCA не считать product progress;
+5. PASS read-only может закрывать audit/preflight;
+6. mutation checkpoint только Lane A.
+
+Если Lane A сделал change:
+Lane B перед следующим audit обязан заново прочитать этот exact checkpoint.
+
+Если Lane B обнаружил HOLD:
+Lane A не запускает mutation до разбора HOLD.
+
+===============================================================================
+14. PROMPT ДЛЯ ЧАТА A — SINGLE WRITER
+===============================================================================
+
+Ты LANE A / SINGLE WRITER для NEWFI Portal200.
+
+Используй Gitea assistant-runtime как machine truth.
+Не занимайся KingOfWolk: KOW CSP agreed stage уже CLOSED.
+
+Current NEWFI checkpoints:
+- APPLY3 FAIL, invalid result contract, mutation outcome UNKNOWN.
+- CONTRACTAST1 OK read-only.
+- IMPORTDISC2 OK read-only.
+- REBUILDHELP1 OK read-only.
+- native XenForo command xf:addon-rebuild [options] <id> подтверждён.
+
+Твоя задача:
+параллельно с Lane B спроектировать NEWFI Portal200 APPLY4,
+но НЕ запускать mutation, пока Lane B не вернёт
+ELIGIBLE_FOR_PORTAL200_APPLY4_PREP.
+
+APPLY4:
+- новый unique COMMAND_ID family NEWFI-260907-A-PORTAL200-...
+- exact authority checks;
+- current-state preconditions;
+- correct homelab-chat-run result contract;
+- native xf:addon-rebuild with exact live-confirmed add-on ID;
+- fail closed;
+- rollback proof;
+- verification;
+- single writer;
+- exact Gitea publication/readback.
+
+Перед каждой реальной mutation заново прочитай последние Lane A + Lane B checkpoints.
+
+===============================================================================
+15. PROMPT ДЛЯ ЧАТА B — READ-ONLY AUDITOR
+===============================================================================
+
+Ты LANE B / STRICT READ-ONLY AUDITOR для NEWFI Portal200.
+
+Никаких Git/application/DB/production mutations.
+
+Используй proven bridge:
+direct read-only phase outside homelab-chat-run;
+serialized sanitized publication through runner.
+
+COMMAND_ID family:
+NEWFI-260907-B-PORTAL200-...
+
+Сразу выполни post-APPLY3 current-state recovery audit:
+
+- authority checks;
+- runner SHA + contract;
+- authoritative Git local/remote/clean;
+- exact NEWFI staging/prod identity;
+- exact XenForo docroot/version;
+- exact Portal Add-On ID;
+- installed/version/rebuildable state;
+- APPLY3 aftermath;
+- file/source hashes;
+- service health;
+- relevant HTTP routes;
+- XF error log state;
+- read-only DB evidence;
+- no mutation.
+
+Final decision:
+ELIGIBLE_FOR_PORTAL200_APPLY4_PREP
+or exact HOLD_...
+
+Публикуй bounded sanitized evidence в immutable Gitea history.
+После публикации сообщи exact COMMAND_ID.
+
+===============================================================================
+16. РЕКОМЕНДУЕМЫЙ СТАРТ СЕЙЧАС
+===============================================================================
+
+Лучший быстрый порядок:
+
+NOW:
+- текущий чат = Lane A;
+- новый второй чат = Lane B.
+
+Одновременно:
+Lane A готовит APPLY4 design.
+Lane B снимает current-state recovery audit.
+
+Когда Lane B PASS:
+Lane A сверяет immutable evidence и запускает единственный change APPLY4.
+
+После APPLY4:
+Lane B выполняет независимый read-only post-change verification,
+если это реально добавляет evidence и не дублирует уже встроенный rollback/canary.
+
+===============================================================================
+17. COUNTER / ROADMAP
+===============================================================================
+
+Не использовать KingOfWolk counter.
+У KOW counter = 0 и scope закрыт.
+
+Для NEWFI ранее использовалась рабочая оценка оставшихся команд,
+но её нельзя считать authoritative runtime state без восстановления NEWFI roadmap.
+
+Первый Lane B recovery audit должен также найти/проверить текущую NEWFI roadmap/
+accepted-stage count, если он хранится в repo/reference.
+
+До этого не печатать ложный точный countdown.
+
+===============================================================================
+18. SOURCE-OF-TRUTH PRIORITY
+===============================================================================
+
+При конфликте:
+
+1. /etc/pve/HOMELAB_ASSISTANT_ERROR_REGISTER.md
+2. /etc/pve/31_HOMELAB_REFERENCE.md
+3. exact immutable Gitea runtime/history/<CID>.txt
+4. authoritative Git source/current live state
+5. этот handoff
+
+Этот handoff ускоряет старт, но не перекрывает более свежий live/Gitea evidence.
+
+===============================================================================
+APPENDIX A
+ПОЛНЫЙ HANDOFF ИЗ ВТОРОГО ЧАТА: KINGOFWOLK CSP
+(сохранён целиком; используется для operational/concurrency rules, не как NEWFI product-state)
+===============================================================================
+
+
+ПОЛНЫЙ HANDOFF: KINGOFWOLK CSP
+Дата контекста: 2026-09-07
+
+1. СТАТУС ПРОЕКТА НА МОМЕНТ HANDOFF
+
+Проект: KingOfWolk forum CSP.
+
+Shared counter:
+0 команд до полного финиша.
+
+Важно: 0 означает, что согласованный безопасный CSP-stage полностью завершён и подтверждён evidence. Это не означает, что CSP доведён до теоретически максимальной жёсткости.
+
+Отдельно оставлены будущие hardening-задачи:
+- удаление style-src 'unsafe-inline';
+- рефакторинг существующего javascript: URL;
+- перевод script-src-elem из Report-Only в enforcing после достаточного периода наблюдения.
+
+Финальный accepted checkpoint:
+
+KOW-260907-A-FINAL1
+STATUS=OK
+RC=0
+DECISION=KINGOFWOLK_CSP_AGREED_STAGE_FINAL_EVIDENCE_CLOSED
+
+Финальный canary не внёс изменений в production.
+
+
+2. CANONICAL KINGOFWOLK ENVIRONMENT
+
+Форум:
+
+Domain:
+https://kingofwolk.ru
+
+Forum VM:
+VM160
+host: pve02
+IP: <PRIVATE_IPV4>
+
+XenForo:
+2.3.12
+XF id: 2031270
+
+Database:
+xf_kingofwolk
+
+Document root:
+/var/www/forums/kingofwolk/public
+
+XF source:
+/var/www/forums/kingofwolk/src/XF
+
+Из ранее принятого baseline:
+
+boardActive = 1
+board title = KingOfWolk
+style id = 2
+style name = KingOfWolk Dark
+
+CAPTCHA = Cloudflare Turnstile
+friendly URLs = enabled
+third-party add-ons = none
+
+users = 2
+admins = 1
+nodes = 13
+threads = 73
+posts = 73
+attachments = 0
+XF errors = 0
+
+Origin-side services были healthy:
+
+Nginx
+MariaDB
+php8.3-fpm
+
+CSP реализуется на edge, а не origin XenForo.
+
+
+3. EDGE / NPMPLUS
+
+Edge находится на:
+
+VM130
+host: pve03
+
+NPMplus:
+
+container: npmplus
+image: zoeyvid/npmplus:2026-06-17-b1
+
+Live KingOfWolk proxy config:
+
+/opt/npmplus/nginx/proxy_host/996.conf
+
+Metadata:
+
+owner: root:root
+mode: 0644
+
+CSP collector log:
+
+/opt/npmplus/csp-reports/kingofwolk-csp-report.log
+
+Log metadata:
+
+root:root
+0600
+
+Directory:
+
+0700
+
+Collector endpoint:
+
+/__csp-report-v1
+
+Semantics:
+
+GET  -> 405
+Allow -> POST
+
+Collector поддерживает:
+
+application/csp-report
+application/reports+json
+application/json
+
+Collector sanitizes:
+- script-sample;
+- query/fragment у URI.
+
+Rotation threshold:
+
+>= 5 MiB
+
+Финальный canary снова подтвердил:
+
+collector GET = 405
+Allow = POST
+
+
+4. GIT — AUTHORITATIVE SOURCE
+
+Используемый repo:
+
+homelab-admin/homelab-ops
+
+Изолированный CSP worktree:
+
+/root/kingofwolk-csp-baseline-20260907
+
+Branch:
+
+forum/kingofwolk-csp-baseline-20260907
+
+Не использовать /srv/homelab-ops для изменений KingOfWolk CSP.
+Исторически он был dirty/diverged и использовался только как reference.
+
+Clone-local Git identity:
+
+user.name  = homelab-ops-bootstrap
+user.email = root@pve01.gram1.ru
+
+Текущий финальный accepted HEAD:
+
+6f584c5faa76d0067b08977aeb583fa0e4de14aa
+
+Parent:
+
+3e5d8584ae6887c292cc910c5796e73d8d20aecd
+
+Commit message:
+
+csp(kingofwolk): stage script nonce and enforce font media
+
+Текущий source file:
+
+deploy/forums/kingofwolk/edge/996.conf
+
+Текущий source SHA / production edge SHA:
+
+458c2cf0763e4790f7d2d3757efd883b25813a31aab4e8dce6f785b8dea48a6e
+
+Финальный canary подтвердил:
+
+Git local HEAD  = 6f584c5faa76d0067b08977aeb583fa0e4de14aa
+Git remote HEAD = 6f584c5faa76d0067b08977aeb583fa0e4de14aa
+worktree clean  = true
+
+И edge до/после финального canary оставался:
+
+458c2cf0763e4790f7d2d3757efd883b25813a31aab4e8dce6f785b8dea48a6e
+
+
+5. ИСТОРИЯ ACCEPTED GIT CSP COMMITS
+
+Последовательность основных accepted commits:
+
+6908d4ebf2552244a68e3c0990fdc3a219c05d2c
+initial CSP baseline docs
+
+f8d1ae6981df35f25d09a41392bc0a26742b7f38
+JoyPixels Report-Only allowance
+
+34f9c76c5cbf81f9cdf7f50d1ac501cf870abc9c
+minimal structural enforcement source
+
+c7a8a68a74fd3eb74cfb708b6bd3b866159b4899
+csp(kingofwolk): enforce same-origin form submissions
+
+Его source SHA:
+
+834973af57263b326ca6aee52b2ecb3fa2cf0fb486e5a77a62d4210395b8d9c3
+
+Следующий:
+
+e4635c9997801a0ea65aad727270c88ee3bdb817
+csp(kingofwolk): enforce PWA self sources
+
+Source SHA:
+
+28e855ff56c4844768f0e8606fe0edc2acb3f548a5c06fa15c0d80ae00e2bc1b
+
+Следующий:
+
+3e5d8584ae6887c292cc910c5796e73d8d20aecd
+csp(kingofwolk): enforce image and network sources
+
+Source SHA:
+
+fc9fb1dbdb6141bfb43a8122dcf3db435a94da48d0a0c02fe9dfae019b1439c5
+
+Финальный текущий commit:
+
+6f584c5faa76d0067b08977aeb583fa0e4de14aa
+csp(kingofwolk): stage script nonce and enforce font media
+
+Source SHA:
+
+458c2cf0763e4790f7d2d3757efd883b25813a31aab4e8dce6f785b8dea48a6e
+
+
+6. ТЕКУЩИЙ PRODUCTION ENFORCING CSP
+
+Финальный enforcing CSP:
+
+base-uri 'self';
+object-src 'none';
+frame-ancestors 'self';
+form-action 'self';
+worker-src 'self';
+manifest-src 'self';
+img-src 'self' data: blob: https://cdn.jsdelivr.net/joypixels/assets/8.0/png/unicode/64/;
+connect-src 'self' https://challenges.cloudflare.com;
+frame-src 'self' https://challenges.cloudflare.com;
+font-src 'self' data:;
+media-src 'self';
+
+В одной строке:
+
+base-uri 'self'; object-src 'none'; frame-ancestors 'self'; form-action 'self'; worker-src 'self'; manifest-src 'self'; img-src 'self' data: blob: https://cdn.jsdelivr.net/joypixels/assets/8.0/png/unicode/64/; connect-src 'self' https://challenges.cloudflare.com; frame-src 'self' https://challenges.cloudflare.com; font-src 'self' data:; media-src 'self';
+
+Что намеренно НЕ enforcing:
+
+default-src
+script-src
+script-src-elem
+script-src-attr
+style-src
+style-src-elem
+style-src-attr
+
+Также enforcing policy не содержит:
+
+'unsafe-inline'
+'unsafe-eval'
+
+Это намеренно: script/style hardening ещё не переведён в production enforcement.
+
+
+7. ТЕКУЩИЙ PRODUCTION REPORT-ONLY CSP
+
+Source-template на edge содержит Nginx variable $request_id.
+
+Логическая policy:
+
+default-src 'self';
+base-uri 'self';
+object-src 'none';
+frame-ancestors 'self';
+form-action 'self';
+
+script-src 'self' 'unsafe-inline' https://challenges.cloudflare.com;
+
+script-src-elem
+    'self'
+    'nonce-$request_id'
+    https://challenges.cloudflare.com;
+
+style-src 'self' 'unsafe-inline';
+
+img-src
+    'self'
+    data:
+    blob:
+    https://cdn.jsdelivr.net/joypixels/assets/8.0/png/unicode/64/;
+
+font-src 'self' data:;
+
+connect-src
+    'self'
+    https://challenges.cloudflare.com;
+
+frame-src
+    'self'
+    https://challenges.cloudflare.com;
+
+worker-src 'self';
+manifest-src 'self';
+media-src 'self';
+
+report-uri /__csp-report-v1;
+
+Точная source-строка:
+
+default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'self'; form-action 'self'; script-src 'self' 'unsafe-inline' https://challenges.cloudflare.com; script-src-elem 'self' 'nonce-$request_id' https://challenges.cloudflare.com; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: https://cdn.jsdelivr.net/joypixels/assets/8.0/png/unicode/64/; font-src 'self' data:; connect-src 'self' https://challenges.cloudflare.com; frame-src 'self' https://challenges.cloudflare.com; worker-src 'self'; manifest-src 'self'; media-src 'self'; report-uri /__csp-report-v1;
+
+При HTTP response $request_id уже заменён Nginx на фактический per-request nonce.
+
+
+8. NGINX NONCE TRANSPORT
+
+Текущий source также содержит transport для nonce-инъекции.
+
+Ключевые строки:
+
+proxy_set_header Accept-Encoding "";
+sub_filter_once off;
+sub_filter '<script' '<script nonce="$request_id"';
+
+Зачем отключено upstream compression:
+
+sub_filter должен видеть HTML body в несжатом виде.
+
+До production promotion был отдельно доказан forwarded-origin request:
+
+HTTP = 200
+Content-Encoding = NONE
+
+Nonce source:
+
+$request_id
+
+В Report-Only header используется:
+
+'nonce-$request_id'
+
+В HTML тот же $request_id инъектируется в каждый <script> tag.
+
+
+9. ФИНАЛЬНЫЙ NONCE EVIDENCE
+
+Финальный checkpoint:
+
+KOW-260907-A-FINAL1
+
+проверил HTML маршруты дважды:
+
+/
+ /login/
+ /register/
+ /help/smilies/
+ /threads/dobro-pozhalovat-na-ofitsial-nyi-forum-kingofwolk.1/
+
+Для каждого запроса проверялось:
+
+HTTP = 200
+ровно один nonce в CSP Report-Only
+nonce не содержит literal $
+nonce имеет допустимый формат
+каждый <script> имеет ровно один nonce
+nonce каждого <script> == nonce из response CSP header
+raw nonce count == parsed script count
+
+Дополнительно:
+
+nonce не должен повторяться между двумя запросами одного route
+nonce не должен совпадать ни с одним nonce других canary requests
+
+Финальный результат:
+
+KOWAFINAL1_NONCE_UNIQUE_ACROSS_ALL_REQUESTS=true
+KOWAFINAL1_NONCE_VALUES_EXPORTED=NO
+
+То есть сами nonce наружу не публиковались.
+
+
+10. CSP REPORT LOG BASELINE
+
+Принятый baseline:
+
+SHA256:
+2f7977cbfaed7953bd70033c0cf92138eedf974f5886fadf4b4971f2d00a4143
+
+lines:
+2
+
+Исторически в нём:
+
+line 1 = synthetic test
+line 2 = historical real JoyPixels violation до allow-list
+
+Этот baseline не менялся через:
+
+- PWA stage;
+- img/connect/frame stage;
+- nonce design;
+- font/media promotion;
+- production Stage2;
+- финальный browser/evidence canary.
+
+Финальный результат:
+
+KOWAFINAL1_NEW_CSP_REPORTS_AFTER_FINAL_BROWSER_CANARY=0
+
+NPMplus:
+
+before = healthy
+after  = healthy
+
+
+11. ДРУГИЕ SECURITY HEADERS
+
+Они не менялись и финальный canary проверил их exact match.
+
+X-Frame-Options:
+SAMEORIGIN
+
+X-Content-Type-Options:
+nosniff
+
+Referrer-Policy:
+strict-origin-when-cross-origin
+
+Strict-Transport-Security:
+max-age=31536000
+
+Permissions-Policy:
+geolocation=(), microphone=(), camera=()
+
+Ранее жёлтые browser console warnings были связаны с Permissions-Policy, а не с CSP.
+
+
+12. JOYPIXELS
+
+Разрешён только path-scoped источник:
+
+https://cdn.jsdelivr.net/joypixels/assets/8.0/png/unicode/64/
+
+Не разрешён весь:
+
+https://cdn.jsdelivr.net
+
+Ранее dedicated evidence:
+- реальный historical CSP report указывал JoyPixels;
+- /help/smilies/ реально использует этот path;
+- bad JoyPixels path count = 0.
+
+Финальный canary:
+
+KOWAFINAL1_JOYPIXELS_RENDERED_REF_COUNT=32
+KOWAFINAL1_JOYPIXELS_SAMPLE_HTTP=200
+
+
+13. CLOUDFLARE TURNSTILE
+
+Turnstile остаётся обязательной runtime зависимостью для регистрации.
+
+Нужные разрешения сохранены:
+
+script:
+https://challenges.cloudflare.com
+
+connect:
+https://challenges.cloudflare.com
+
+frame:
+https://challenges.cloudflare.com
+
+В текущем enforcing уже есть:
+
+connect-src 'self' https://challenges.cloudflare.com;
+frame-src 'self' https://challenges.cloudflare.com;
+
+В Report-Only script policies также Cloudflare разрешён.
+
+Критически важный урок:
+
+не требовать статический <script src="https://challenges.cloudflare.com/..."> в исходном HTML.
+
+Turnstile может быть динамически instantiated.
+
+Именно из-за неправильного static-script требования ранее упал:
+
+KOW-260907-A-ICF5
+
+с:
+
+TURNSTILE_SCRIPT_REF_MISSING
+
+После исправления модели:
+
+KOW-260907-A-ICF6
+
+был accepted.
+
+Финальный canary проверял наличие Turnstile/challenges runtime tokens на /register/, а не статический script tag.
+
+
+14. FORM-ACTION
+
+Этап полностью закрыт ранее.
+
+Enforcing:
+
+form-action 'self'
+
+Перед promotion были проверены:
+
+external public form origins = 0
+payment profiles = 0
+user upgrades = 0
+provider/options related external forms = 0
+
+Production apply был с rollback proof и browser/server canary.
+
+Не пересматривать без новой фактической причины.
+
+
+15. PWA DIRECTIVES
+
+Полностью accepted:
+
+worker-src 'self'
+manifest-src 'self'
+
+Закрыты checkpoints:
+
+PWA3 audit
+PWA4 preflight
+PWA5 Git promotion
+PWA6 production + rollback proof
+PWA9 final recovery/readback
+
+Исторический transport bug:
+
+PWA7 browser canary сам по себе был PASS,
+но outer publication сломался.
+
+PWA8 RCA:
+publisher ошибочно ожидал evidence path в sys.argv[1].
+
+После этого правило:
+
+publisher должен использовать literal evidence path, а не рассчитывать, что sys.argv[1] содержит путь.
+
+
+16. IMG/CONNECT/FRAME STAGE
+
+Полностью закрыт.
+
+Текущие enforcing directives:
+
+img-src 'self' data: blob: https://cdn.jsdelivr.net/joypixels/assets/8.0/png/unicode/64/;
+
+connect-src 'self' https://challenges.cloudflare.com;
+
+frame-src 'self' https://challenges.cloudflare.com;
+
+Ключевые accepted checkpoints:
+
+KOW-260907-A-ICF2
+STATUS=OK
+DECISION=ELIGIBLE_FOR_IMG_CONNECT_FRAME_SOURCE_PREP
+
+Evidence:
+
+CSS bytes scanned = 297724
+stylesheets = 9
+CSS url refs = 245
+origins = DATA / SELF
+
+Git promotion:
+
+KOW-260907-A-ICF3
+
+Commit:
+
+3e5d8584ae6887c292cc910c5796e73d8d20aecd
+
+Production apply:
+
+KOW-260907-A-ICF4
+
+Rollback proof passed.
+
+Browser recovery:
+
+KOW-260907-A-ICF6
+DECISION=IMG_CONNECT_FRAME_ENFORCEMENT_POST_BROWSER_CANARY_CLEAN
+
+
+17. INLINE SCRIPT/STYLE AUDIT — ИСХОДНЫЕ ВЫВОДЫ
+
+До nonce stage:
+
+rendered nonce attrs = 0
+native nonce source signals = 0
+
+KOW-260907-A-INLINE1 показал по 5 guest routes:
+
+external_scripts = 35
+
+inline executable scripts = 5
+inline non-executable scripts = 3
+inline script tags total = 8
+
+style attributes = 31
+
+javascript: URLs = 6 occurrences
+distinct javascript: values later narrowed to 1
+
+event-handler attrs = 0
+
+script nonce attrs = 0
+style nonce attrs = 0
+style tags = 0
+
+Основной decision:
+
+HOLD_UNSAFE_INLINE_APPLICATION_NONCE_HASH_DESIGN_REQUIRED
+
+
+18. ПОЧЕМУ СТАТИЧЕСКИЕ HASHES ДЛЯ INLINE SCRIPTS БЫЛИ ОТКЛОНЕНЫ
+
+KOW-260907-A-INLINE2:
+
+STATUS=OK
+RC=0
+
+DECISION=
+APPLICATION_TEMPLATE_REFACTOR_DESIGN_REQUIRED
+
+Было установлено:
+
+EXEC_SCRIPTS_WITH_DYNAMIC_MARKERS=5
+GLOBAL_DISTINCT_EXEC_SCRIPT_BODIES=5
+GLOBAL_DISTINCT_STYLE_ATTR_VALUES=7
+GLOBAL_DISTINCT_JAVASCRIPT_URLS=1
+GLOBAL_DISTINCT_EVENT_HANDLER_VALUES=0
+
+То есть все 5 executable inline scripts имеют динамические признаки.
+
+Поэтому:
+- хеширование уже rendered script bodies не использовать;
+- не публиковать и не хешировать dynamic rendered inline values;
+- nonce оказался более подходящим механизмом для <script> elements.
+
+
+19. STYLE ATTRIBUTES
+
+Было обнаружено:
+
+31 style attributes
+7 distinct style attribute values
+
+Они оказались стабильными между guest renders и не сработал secretish gate.
+
+Но removal style-src 'unsafe-inline' не включён в текущий завершённый scope.
+
+Причина:
+
+nonce работает для <style> / <script> elements, но не решает обычные style="" attributes.
+
+Потенциальные будущие пути:
+- template/application refactor style attrs;
+- либо отдельный строго доказанный style-src-attr / 'unsafe-hashes' design.
+
+На текущем production:
+
+Report-Only:
+style-src 'self' 'unsafe-inline';
+
+Enforcing style-src отсутствует.
+
+
+20. JAVASCRIPT: URLS
+
+Исходно:
+
+6 occurrences
+1 distinct value
+event handlers = 0
+
+В процессе анализа было решено:
+
+JAVASCRIPT_URL_DESIGN=
+APPLICATION_REFACTOR_REQUIRED_NOT_HASH_ALLOWLIST
+
+То есть javascript: URL не закрывается текущей CSP-stage через hash allowlist.
+
+Было выполнено source mapping на VM160 по:
+
+/var/www/forums/kingofwolk/internal_data/code_cache/templates
+/var/www/forums/kingofwolk/src/XF
+/var/www/forums/kingofwolk/public/js
+
+Raw javascript: value наружу не публиковался.
+
+Текущий статус:
+
+deferred application refactor.
+
+
+21. EDGE NONCE DESIGN SEQUENCE И HARNESS FAILURES
+
+Во время разработки nonce-stage было несколько не product failures, которые важно не путать с production regressions.
+
+KOW-260907-A-INLINE3
+
+STATUS=FAIL
+RC=23
+
+Failed step:
+
+origin_compression
+
+Error:
+
+origin_compression:RC_2
+
+Причина:
+
+probe зависел от Python внутри guest/runtime path
+
+Product mutation:
+
+NO
+
+
+KOW-260907-A-INLINE4
+
+STATUS=FAIL
+RC=23
+
+Failed step:
+
+transform_and_hash_candidates
+
+Error:
+
+'str' object has no attribute 'decode'
+
+Причина — чистый harness bug:
+- transformed HTML уже был str;
+- helper повторно вызывал .decode().
+
+До падения подтвердилось:
+
+Git clean
+NPMplus healthy
+nginx sub module compiled = true
+nginx version = 1.31.2
+
+proxy_pass count = 1
+origin gzip = gzip
+origin identity = NONE
+HTTP = 200
+
+
+KOW-260907-A-INLINE5
+
+STATUS=FAIL
+RC=23
+
+Failed step:
+
+nginx_nonce_syntax_probe_tempfile
+
+Error:
+
+EPHEMERAL_PROBE_FILE_NOT_CLEANED
+
+Это был слишком строгий/неправильный cleanup harness.
+
+Product mutation не было.
+
+
+KOW-260907-A-INLINE6
+
+STATUS=FAIL
+RC=23
+
+Failed step:
+
+vm160_jsurl_source_map
+
+Error:
+
+qout() got an unexpected keyword argument 'timeout'
+
+Опять чистый harness bug.
+
+До падения уже было подтверждено:
+
+distinct javascript URLs = 1
+distinct style attrs = 7
+event handlers = 0
+Git clean
+production exact
+stale probe files = 0
+
+
+KOW-260907-A-INLINE7
+
+Recovery без повторения всего INLINE6.
+
+STATUS=OK
+RC=0
+
+Он прочитал evidence INLINE6 и выполнил только недостающий VM160 source-map.
+
+Decision:
+
+HOLD_NONCE_STYLE_HASH_DESIGN
+
+Но единственный HOLD был:
+
+UPSTREAM_IDENTITY_PROBE_NOT_CLEAN
+
+Почему:
+
+direct upstream ответил:
+
+HTTP=301
+Content-Encoding=NONE
+
+То есть compression уже был в порядке; harness ошибочно требовал именно HTTP==200.
+
+
+KOW-260907-A-INLINE8
+
+Исправил probe с правильными forwarded headers.
+
+Результат:
+
+STATUS=OK
+RC=0
+
+FORWARDED_IDENTITY_200_OK=true
+FORWARDED_IDENTITY_TRANSPORT_OK=true
+
+HOLD_REASONS=[]
+
+DECISION=
+ELIGIBLE_FOR_STAGED_SCRIPT_ELEM_NONCE_SOURCE_PREP
+
+Это финально закрыло nonce design.
+
+
+22. LANE B — FONT/MEDIA
+
+Lane B выполнил независимый read-only audit.
+
+Accepted checkpoint:
+
+KOW-260907-B-FONTMEDIA4
+STATUS=OK
+RC=0
+
+DECISION=
+ELIGIBLE_FOR_FONT_MEDIA_SOURCE_PREP
+
+Подтверждено:
+
+native media attachments = 0
+XFMG media = 0
+[MEDIA] content = 0
+board URL = https://kingofwolk.ru
+
+При этом наличие media-site capability не считалось само по себе runtime requirement.
+
+Lane B после этого прекратил новые checkpoints.
+
+Lane A стал единственным writer.
+
+
+23. FONT/MEDIA FINAL POLICY
+
+После независимого Lane B audit и дополнительной precommit verification были enforcing добавлены:
+
+font-src 'self' data:;
+media-src 'self';
+
+На финальном canary:
+
+FONT_ORIGINS=[]
+
+для непосредственно проверенных текущих страниц, то есть никаких новых внешних font runtime origins выявлено не было.
+
+Ранее dedicated audit уже доказал допустимость SELF/DATA.
+
+Rendered media origins также не потребовали дополнительного allow-list.
+
+
+24. KOW-260907-A-STAGE1 — GIT PROMOTION
+
+Команда:
+
+KOW-260907-A-STAGE1
+MODE=change
+COMPONENT=kingofwolk-csp-font-media-nonce-stage-git-promotion
+
+Выполнила перед mutation:
+
+- exact Git branch/head/remote/clean checks;
+- production old edge SHA check;
+- CSP log baseline;
+- NPMplus health;
+- font/media audit;
+- route checks;
+- DB read-only media checks;
+- repository validation;
+- unit tests.
+
+После этого построила exact candidate:
+
+1. enforcement:
+
++ font-src 'self' data:;
++ media-src 'self';
+
+2. Report-Only:
+
++ script-src-elem 'self' 'nonce-$request_id' https://challenges.cloudflare.com;
+
+3. transport:
+
+proxy_set_header Accept-Encoding "";
+sub_filter_once off;
+sub_filter '<script' '<script nonce="$request_id"';
+
+Не менялись:
+
+style-src 'unsafe-inline'
+base script-src 'unsafe-inline'
+javascript: behavior
+
+Repository validation:
+
+PASS
+
+Tests:
+
+PASS
+
+Новый Git HEAD:
+
+6f584c5faa76d0067b08977aeb583fa0e4de14aa
+
+Новый source SHA:
+
+458c2cf0763e4790f7d2d3757efd883b25813a31aab4e8dce6f785b8dea48a6e
+
+Local == remote.
+
+Во время Stage1 production оставался на старом SHA.
+
+
+25. KOW-260907-A-STAGE2 — PRODUCTION APPLY
+
+KOW-260907-A-STAGE2
+STATUS=OK
+RC=0
+MODE=change
+RESULT_CONTRACT_STATUS=OK
+CHANGES_MADE=true
+
+Перед apply были проверены:
+
+runner SHA
+Git branch/head/parent/message
+source exact bytes
+production old SHA
+live file owner/mode
+CSP log baseline
+NPMplus health
+nginx -t
+public old CSP exact
+
+Runner baseline SHA:
+
+b248a4c32c9cc64e5747e7dce6c7fc0a23f5124a77c71ce72e27a81aceae9d2d
+
+Stage2 sequence:
+
+Phase 1 — APPLY1
+
+Установлен новый candidate.
+
+Проверены:
+- nginx -t;
+- reload;
+- routes;
+- exact enforcing CSP;
+- dynamic Report-Only nonce;
+- каждый HTML <script> получил nonce;
+- nonce == header nonce;
+- CSP log baseline;
+- NPMplus health.
+
+Phase 2 — ROLLBACK PROOF
+
+Production вернули к старому:
+
+fc9fb1dbdb6141bfb43a8122dcf3db435a94da48d0a0c02fe9dfae019b1439c5
+
+Проверены old policies, routes, отсутствие nonce injection, health/log.
+
+Rollback proof:
+
+PASS
+
+Phase 3 — FINAL REAPPLY
+
+Candidate применён повторно.
+
+Финальный edge:
+
+458c2cf0763e4790f7d2d3757efd883b25813a31aab4e8dce6f785b8dea48a6e
+
+Git не drifted.
+
+Итоговая reason:
+
+FONT_MEDIA_ENFORCED_AND_SCRIPT_ELEM_NONCE_REPORT_ONLY_STAGED_WITH_ROLLBACK_PROOF
+
+
+26. PRODUCTION ROLLBACK ARTIFACT
+
+Stage2 создал manual rollback backup в NPMplus VM/container filesystem:
+
+/opt/npmplus/manual-backups/kingofwolk-csp-font-media-nonce-stage-20260907-6f584c5/
+
+Old config:
+
+996.conf.before
+
+Old SHA:
+
+fc9fb1dbdb6141bfb43a8122dcf3db435a94da48d0a0c02fe9dfae019b1439c5
+
+Также stage directory использовался для candidate copy.
+
+Если когда-либо потребуется ручной emergency rollback, сначала всё равно заново проверить текущий live state и не предполагать, что этот backup всё ещё является правильной rollback target после будущих изменений.
+
+
+27. KOW-260907-A-FINAL1 — ФИНАЛЬНЫЙ EVIDENCE CLOSURE
+
+STATUS=OK
+RC=0
+MODE=read-only
+CHANGES_MADE=false
+
+Decision:
+
+KINGOFWOLK_CSP_AGREED_STAGE_FINAL_EVIDENCE_CLOSED
+
+Closure scope:
+
+AGREED_SAFE_CSP_STAGE
+
+Проверено:
+
+- Git exact local/remote/clean;
+- source SHA exact;
+- production edge SHA exact;
+- edge metadata 0:0:644;
+- CSP log baseline before;
+- NPMplus healthy;
+- nginx -t;
+- пять HTML routes по два запроса;
+- /service_worker.js;
+- /webmanifest.php;
+- exact security headers;
+- exact enforcing CSP;
+- exact dynamic Report-Only CSP;
+- unique nonce across requests;
+- nonce coherence для всех <script>;
+- JoyPixels rendered refs + HTTP sample;
+- fonts;
+- media origins;
+- Turnstile signal;
+- collector 405/POST;
+- CSP log baseline after;
+- production SHA after;
+- Git state after.
+
+Финал:
+
+NEW_CSP_REPORTS_AFTER_FINAL_BROWSER_CANARY=0
+NONCE_UNIQUE_ACROSS_ALL_REQUESTS=true
+NPMPLUS_HEALTH_AFTER=healthy
+
+
+28. CURRENT FINAL HASHES / IDENTIFIERS — БЫСТРЫЙ БЛОК
+
+Git repo:
+/root/kingofwolk-csp-baseline-20260907
+
+Branch:
+forum/kingofwolk-csp-baseline-20260907
+
+Current HEAD:
+6f584c5faa76d0067b08977aeb583fa0e4de14aa
+
+Parent:
+3e5d8584ae6887c292cc910c5796e73d8d20aecd
+
+Current source:
+deploy/forums/kingofwolk/edge/996.conf
+
+Current source / production edge SHA:
+458c2cf0763e4790f7d2d3757efd883b25813a31aab4e8dce6f785b8dea48a6e
+
+Previous production SHA:
+fc9fb1dbdb6141bfb43a8122dcf3db435a94da48d0a0c02fe9dfae019b1439c5
+
+CSP report log SHA:
+2f7977cbfaed7953bd70033c0cf92138eedf974f5886fadf4b4971f2d00a4143
+
+CSP report log lines:
+2
+
+Runner SHA:
+b248a4c32c9cc64e5747e7dce6c7fc0a23f5124a77c71ce72e27a81aceae9d2d
+
+
+29. OPERATIONAL COMMAND CONTRACT
+
+Любая новая server command по этому проекту должна сначала читать:
+
+/etc/pve/HOMELAB_ASSISTANT_ERROR_REGISTER.md
+/etc/pve/31_HOMELAB_REFERENCE.md
+
+И visibly emit:
+
+ERROR_REGISTER_CHECK=OK
+REFERENCE_CHECK=OK
+AUTHORITY_CHECK_SCOPE=READABILITY_ONLY_INCIDENTS_NOT_CLOSED
+
+Обычно shell:
+
+root@pve01:~#
+
+Git discipline:
+
+Перед любым change:
+
+git status
+branch
+local HEAD
+remote HEAD
+
+Fail closed при неизвестном drift.
+
+До commit:
+
+git diff --check
+
+Staging:
+
+git add <explicit path>
+
+Не использовать:
+
+git add .
+
+После staging:
+
+git diff --cached --check
+git diff --cached
+
+После push:
+
+git fetch
+LOCAL_HEAD == REMOTE_HEAD
+
+Запрещённый destructive workflow:
+
+git reset --hard
+git clean -fd
+force push
+
+Также:
+
+не мутировать XenForo state raw SQL.
+
+Read-only SQL допустим.
+
+
+30. CONCURRENCY / LANE MODEL
+
+Была доказана настоящая параллельность read-only lanes через direct bridge.
+
+Checkpoint:
+
+KOW-260907-PBR2
+
+Decision:
+
+ALLOW_TRUE_PARALLEL_READ_ONLY_LANES
+
+При этом обычные full runner carriers сериализуются из-за flock.
+
+Checkpoint:
+
+KOW-260907-CONC1
+
+Поэтому правила:
+
+read-only direct bridge:
+может работать параллельно
+
+Git commit/push:
+ровно один writer
+
+edge production apply:
+ровно один writer
+
+XenForo/app mutation:
+ровно один writer
+
+Сейчас Lane B закончен.
+
+Если CSP scope снова открыть:
+
+текущий чат/следующий оператор должен оставаться единственным writer.
+
+
+31. WINDOWS TRANSPORT
+
+Стандартный transport:
+
+.CMD
+  -> Windows PowerShell 5.1
+  -> Plink
+  -> Pageant
+  -> SSH pve01
+  -> direct bridge или homelab-chat-run
+  -> Gitea publication
+  -> readback
+
+PuTTY:
+
+C:\Program Files\PuTTY\plink.exe
+C:\Program Files\PuTTY\pageant.exe
+
+PPK:
+
+<USERPROFILE>\Documents\ssh\homelab_ed25519.ppk
+
+PPK encrypted:
+aes256-cbc
+
+<REDACTED_SENSITIVE_LINE>
+
+<REDACTED_SENSITIVE_LINE>
+
+Нормальный carrier:
+
+plink
+-batch
+-agent
+-ssh
+-P 22
+-m <remotePath>
+root@<PRIVATE_IPV4>
+
+Не использовать обычным carrier:
+
+-i
+
+Pageant должен уже держать unlocked key.
+
+Endpoint:
+
+pve01
+root@<PRIVATE_IPV4>:22
+
+PuTTY registry host key:
+
+HKCU:\Software\SimonTatham\PuTTY\SshHostKeys
+
+ssh-ed25519@22:<PRIVATE_IPV4>
+
+
+32. CARRIER IMPLEMENTATION RULES
+
+PowerShell запускает Plink через:
+
+Start-Process
+
+Обязательно:
+
+separate stdout
+separate stderr
+real ExitCode
+-NoNewWindow
+
+Не использовать:
+
+pause
+notepad
+MobaXterm
+
+Temp diagnostics:
+
+%TEMP%
+
+Remote command file:
+
+UTF-8
+no BOM
+one physical line
+SHA verified
+
+Большие payloads:
+
+zlib + base64
+SHA256 verification
+/usr/bin/python3 -I -B
+
+Каждый attempt:
+
+новый COMMAND_ID
+
+Не reuse failed ID.
+
+Runner:
+
+/usr/local/sbin/homelab-chat-run <CID> read-only|change <component> -- <command>
+
+Change result contract:
+
+OK
+BLOCKED
+FAIL
+
+
+33. GITEA RUNTIME PUBLICATION / READBACK
+
+Runtime repo:
+
+homelab-admin/homelab-public-context
+
+Branch:
+
+assistant-runtime
+
+Authoritative history path:
+
+runtime/history/<COMMAND_ID>.txt
+
+Главное правило:
+
+не доверять generic latest без проверки COMMAND_ID.
+
+Exact history конкретного command ID — authoritative.
+
+Fast latest может вернуть unrelated/stale result.
+
+
+34. НЕДАВНИЕ .CMD ARTIFACTS ИЗ ЭТОГО ЧАТА
+
+Последовательность последних команд:
+
+KOW-260907-A-INLINE2
+KOW_CSP_INLINE_HASH_FEASIBILITY_AUDIT_PLINK_GITEA_MOSCOW.cmd
+
+KOW-260907-A-INLINE3
+KOW_CSP_EDGE_NONCE_UNSAFE_HASHES_FEASIBILITY_PLINK_GITEA_MOSCOW.cmd
+
+KOW-260907-A-INLINE4
+KOW_CSP_EDGE_NONCE_UNSAFE_HASHES_FEASIBILITY2_PLINK_GITEA_MOSCOW.cmd
+
+KOW-260907-A-INLINE5
+KOW_CSP_EDGE_NONCE_UNSAFE_HASHES_FINAL_FEASIBILITY_PLINK_GITEA_MOSCOW.cmd
+
+KOW-260907-A-INLINE6
+KOW_CSP_EDGE_NONCE_STYLE_HASH_JSURL_DESIGN_AUDIT_PLINK_GITEA_MOSCOW.cmd
+
+KOW-260907-A-INLINE7
+KOW_CSP_INLINE6_RECOVERY_JSURL_SOURCE_MAP_PLINK_GITEA_MOSCOW.cmd
+
+KOW-260907-A-INLINE8
+KOW_CSP_SCRIPT_ELEM_NONCE_DESIGN_CLOSURE_PLINK_GITEA_MOSCOW.cmd
+
+KOW-260907-A-STAGE1
+KOW_CSP_FONT_MEDIA_NONCE_STAGE_GIT_PROMOTION_PLINK_GITEA_MOSCOW.cmd
+
+KOW-260907-A-STAGE2
+KOW_CSP_FONT_MEDIA_NONCE_STAGE_PRODUCTION_PLINK_GITEA_MOSCOW.cmd
+
+KOW-260907-A-FINAL1
+KOW_CSP_FINAL_BROWSER_EVIDENCE_CLOSURE_PLINK_GITEA_MOSCOW.cmd
+
+Не нужно повторно запускать их для «проверки», если нет новой причины.
+При новом scope создавать новые IDs.
+
+
+35. ЧТО НЕ НАДО ПОВТОРЯТЬ СЛЕДУЮЩЕМУ ОПЕРАТОРУ
+
+Уже закрыто, не делать заново без новой фактической причины:
+
+form-action audit
+PWA worker/manifest audit
+img-src audit
+connect-src audit
+frame-src audit
+JoyPixels path audit
+Turnstile static-script search
+font-src/media-src discovery
+inline hash feasibility
+nonce feasibility
+upstream identity/compression feasibility
+font/media Git promotion
+font/media production promotion
+rollback proof
+final browser/evidence closure
+
+Особенно:
+
+не повторять KOW-260907-B-FONTMEDIA4.
+
+Lane B audit уже accepted.
+
+
+36. ЧТО ОСТАЁТСЯ ТОЛЬКО КАК FUTURE HARDENING
+
+Это не незавершённые команды текущего counter.
+
+Текущий counter:
+
+0
+
+Future scope можно открыть отдельно.
+
+
+A. script-src-elem enforcement
+
+Сейчас:
+
+Report-Only only
+
+Nonce транспорт уже работает и финально доказан.
+
+Следующий возможный будущий шаг — только после периода наблюдения CSP report log:
+
+перенести script-src-elem nonce policy в enforcing
+
+Но до этого надо заново проверить:
+
+- log не накопил реальные violations;
+- authenticated flows;
+- Turnstile;
+- admin/Account overlays, если входят в scope;
+- все важные XenForo page types.
+
+
+B. style-src 'unsafe-inline'
+
+Сейчас всё ещё Report-Only:
+
+style-src 'self' 'unsafe-inline'
+
+Причина — style attributes.
+
+Исходное evidence:
+
+31 occurrences
+7 distinct values
+
+Нужен отдельный application/template design.
+
+
+C. javascript: refactor
+
+Есть:
+
+1 distinct javascript: value
+несколько rendered occurrences
+
+Не разрешать это через сомнительный hash workaround.
+
+Принятый design:
+
+APPLICATION_REFACTOR_REQUIRED_NOT_HASH_ALLOWLIST
+
+
+37. ТОЧКА СТАРТА ДЛЯ НОВОГО ЧАТА
+
+Новый чат должен считать canonical current state следующим:
+
+KINGOFWOLK CSP AGREED SAFE STAGE = CLOSED
+
+shared counter = 0
+
+current Git HEAD:
+6f584c5faa76d0067b08977aeb583fa0e4de14aa
+
+current edge/source SHA:
+458c2cf0763e4790f7d2d3757efd883b25813a31aab4e8dce6f785b8dea48a6e
+
+CSP log SHA:
+2f7977cbfaed7953bd70033c0cf92138eedf974f5886fadf4b4971f2d00a4143
+
+CSP log lines:
+2
+
+NPMplus:
+healthy
+
+final accepted checkpoint:
+KOW-260907-A-FINAL1
+
+final decision:
+KINGOFWOLK_CSP_AGREED_STAGE_FINAL_EVIDENCE_CLOSED
+
+Если пользователь просит «продолжить CSP», сначала надо считать, что открывается новый hardening scope, потому что прежний shared counter уже завершён.
+
+Наиболее логичный новый порядок:
+
+1. read-only observation / authenticated coverage для script-src-elem Report-Only
+2. javascript: application refactor design
+3. style attribute refactor/hash design
+4. только затем новый enforcement promotion с отдельным rollback proof
+
+Но ничего из этого не является долгом старого плана.
+
+
+38. КОРОТКАЯ ИТОГОВАЯ ФОРМУЛИРОВКА ДЛЯ ВСТАВКИ В НОВЫЙ ЧАТ
+
+KingOfWolk CSP agreed safe stage полностью закрыт. Shared counter = 0.
+Финальный accepted checkpoint KOW-260907-A-FINAL1, STATUS=OK, RC=0,
+DECISION=KINGOFWOLK_CSP_AGREED_STAGE_FINAL_EVIDENCE_CLOSED.
+
+Текущий Git HEAD:
+6f584c5faa76d0067b08977aeb583fa0e4de14aa
+
+Branch:
+forum/kingofwolk-csp-baseline-20260907
+
+Worktree:
+/root/kingofwolk-csp-baseline-20260907
+
+Source:
+deploy/forums/kingofwolk/edge/996.conf
+
+Source/production edge SHA:
+458c2cf0763e4790f7d2d3757efd883b25813a31aab4e8dce6f785b8dea48a6e
+
+CSP log baseline SHA:
+2f7977cbfaed7953bd70033c0cf92138eedf974f5886fadf4b4971f2d00a4143
+
+CSP log:
+2 строки
+
+Новых reports после финального browser-canary:
+0
+
+NPMplus:
+healthy
+
+Enforcing сейчас закрывает:
+base-uri
+object-src
+frame-ancestors
+form-action
+worker-src
+manifest-src
+img-src
+connect-src
+frame-src
+font-src
+media-src
+
+script-src-elem с per-request $request_id nonce находится только в Report-Only.
+Nginx добавляет тот же nonce каждому <script> через sub_filter.
+Финальный canary доказал unique nonce per request и полную header↔script coherence.
+
+style-src 'unsafe-inline', существующий javascript: URL и перевод script-src-elem в enforcing оставлены как отдельный будущий hardening scope.
+
+Lane B KOW-260907-B-FONTMEDIA4 accepted и не должен повторяться.
+
+Любой новый change:
+- один writer;
+- authority checks;
+- exact Git/source/edge/log prestate;
+- explicit staging;
+- rollback proof;
+- новый COMMAND_ID.
+
+
+39. ОСНОВНЫЕ AUTHORITATIVE EVIDENCE URLS
+
+Финальный evidence:
+https://git.gram1.ru/homelab-admin/homelab-public-context/raw/branch/assistant-runtime/runtime/history/KOW-260907-A-FINAL1.txt
+
+Production apply:
+https://git.gram1.ru/homelab-admin/homelab-public-context/raw/branch/assistant-runtime/runtime/history/KOW-260907-A-STAGE2.txt
+
+Git promotion:
+https://git.gram1.ru/homelab-admin/homelab-public-context/raw/branch/assistant-runtime/runtime/history/KOW-260907-A-STAGE1.txt
+
+Lane B font/media:
+https://git.gram1.ru/homelab-admin/homelab-public-context/raw/branch/assistant-runtime/runtime/history/KOW-260907-B-FONTMEDIA4.txt
+
+Nonce design closure:
+https://git.gram1.ru/homelab-admin/homelab-public-context/raw/branch/assistant-runtime/runtime/history/KOW-260907-A-INLINE8.txt
+
+Inline feasibility:
+https://git.gram1.ru/homelab-admin/homelab-public-context/raw/branch/assistant-runtime/runtime/history/KOW-260907-A-INLINE2.txt
+
+Img/connect/frame final recovery:
+https://git.gram1.ru/homelab-admin/homelab-public-context/raw/branch/assistant-runtime/runtime/history/KOW-260907-A-ICF6.txt
+
+Img/connect/frame production:
+https://git.gram1.ru/homelab-admin/homelab-public-context/raw/branch/assistant-runtime/runtime/history/KOW-260907-A-ICF4.txt
+
+CANDIDATE_LAYER_1_TEXT_END
+CANDIDATE_LAYER_2_SOURCE=file:newfi-54-portal200-apply3.cmd::b64::zlib
+CANDIDATE_LAYER_2_SHA256=97a1807a275e5d309591f7a7e044d7d56ba5b2f4c6a068df6353bae147707184
+CANDIDATE_LAYER_2_BYTES=34155
+CANDIDATE_LAYER_2_TEXT_BEGIN
+import hashlib
+import json
+import pathlib
+import shlex
+import shutil
+import subprocess
+import sys
+import xml.etree.ElementTree as ET
+
+CID = "NEWFI-260907-PORTAL200-APPLY3"
+BRANCH = "implementation/newfi-closed-mvp-20260906"
+OLD_HEAD = "06bab5acd124e768f70305b3d7eca2f595871890"
+WT = pathlib.Path("/root/newfi-portal/.worktrees/implementation-newfi-closed-mvp-20260906")
+CAND_ROOT = pathlib.Path("/root/newfi-portal200-candidate/src/addons/Newfi/Portal")
+PORTAL_REL = pathlib.Path("src/addons/Newfi/Portal")
+GIT_PORTAL = WT / PORTAL_REL
+EXPECTED_NEW = {
+    "Pub/Controller/Portal.php": (363, "619d489f7cc3b461479c702fa8825097ae22d3c6cfeb911e9f14ea1de9c36d6d"),
+    "Service/PortalData.php": (5213, "4da03f26294ab6d163a1a746dee4bb6a82d7d4f39e66b24246bc0eb4c455dd1d"),
+    "_data/templates.xml": (10977, "1650c3d868d4bc47703f1b75f1f179cd25309b2d3b20a2b848e81a4423c00861"),
+}
+EXPECTED_OLD = {
+    "Pub/Controller/Portal.php": (247, "53909e753ea5a011550fd280ad1c342a74ca9949be092dfbd95244243cae92f3"),
+    "_data/templates.xml": (1461, "c29c04f8b937284e821c87957653e87c2f6ac014fac30648a0f6b18e84392adf"),
+}
+EXPECTED_GIT_PATHS = [str(PORTAL_REL / p) for p in sorted(EXPECTED_NEW)]
+BACKUP = f"/root/newfi-portal200-backup-{CID}"
+
+
+class PortalError(RuntimeError):
+    pass
+
+
+def emit(key, value=None):
+    if value is None:
+        print(key, flush=True)
+    elif isinstance(value, (dict, list, tuple, bool, int, float)):
+        print(
+            key + "=" + json.dumps(value, ensure_ascii=False, sort_keys=True, separators=(",", ":")),
+            flush=True,
+        )
+    else:
+        print(key + "=" + str(value), flush=True)
+
+
+def fail(code):
+    raise PortalError(code)
+
+
+def sha_bytes(data):
+    return hashlib.sha256(data).hexdigest()
+
+
+def file_meta(path):
+    data = pathlib.Path(path).read_bytes()
+    return len(data), sha_bytes(data)
+
+
+def run(cmd, *, input_bytes=None, timeout=180, ok=(0,)):
+    try:
+        p = subprocess.run(
+            cmd,
+            input=input_bytes,
+            stdout=subprocess.PIPE,
+            stderr=subprocess.PIPE,
+            timeout=timeout,
+            check=False,
+        )
+    except subprocess.TimeoutExpired:
+        fail("SUBPROCESS_TIMEOUT")
+    if p.returncode not in ok:
+        fail("SUBPROCESS_RC")
+    return p
+
+
+def git(*args, ok=(0,), timeout=120):
+    p = run(["/usr/bin/git", "-C", str(WT), *args], timeout=timeout, ok=ok)
+    return p.stdout.decode("utf-8", "replace").strip()
+
+
+def qga(target, argv, *, input_bytes=None, timeout=180):
+    if target == "prod":
+        cmd = [
+            "/usr/sbin/qm",
+            "guest",
+            "exec",
+            "210",
+            "--synchronous",
+            "1",
+            "--timeout",
+            str(timeout),
+        ]
+        if input_bytes is not None:
+            cmd += ["--pass-stdin", "1"]
+        cmd += ["--", *argv]
+    elif target == "staging":
+        q = [
+            "/usr/sbin/qm",
+            "guest",
+            "exec",
+            "211",
+            "--synchronous",
+            "1",
+            "--timeout",
+            str(timeout),
+        ]
+        if input_bytes is not None:
+            q += ["--pass-stdin", "1"]
+        q += ["--", *argv]
+        remote = (
+            "test \"$(id -u):$(hostname -s)\" = 0:pve03 || exit 72; "
+            "for f in /etc/pve/HOMELAB_ASSISTANT_ERROR_REGISTER.md /etc/pve/31_HOMELAB_REFERENCE.md; do "
+            "test -r \"$f\" && test -s \"$f\" && cat -- \"$f\" >/dev/null || exit 73; done; exec "
+            + " ".join(shlex.quote(x) for x in q)
+        )
+        cmd = [
+            "/usr/bin/ssh",
+            "-T",
+            "-o",
+            "BatchMode=yes",
+            "-o",
+            "StrictHostKeyChecking=yes",
+            "-o",
+            "UpdateHostKeys=no",
+            "-o",
+            "ConnectTimeout=10",
+            "-o",
+            "ConnectionAttempts=1",
+            "root@pve03",
+            remote,
+        ]
+    else:
+        fail("BAD_TARGET")
+
+    p = run(cmd, input_bytes=input_bytes, timeout=timeout + 30)
+    try:
+        data = json.loads(p.stdout.decode("utf-8"))
+    except Exception:
+        fail("QGA_JSON")
+    if data.get("exited") not in (1, True) or data.get("exitcode") != 0:
+        fail("QGA_GUEST_RC")
+    if data.get("out-truncated") or data.get("err-truncated"):
+        fail("QGA_TRUNCATED")
+    return data.get("out-data", "")
+
+
+INSPECT_PHP = r'''<?php
+$root = '/var/www/forums/newfi/public';
+require $root . '/src/XF.php';
+\XF::start($root);
+$app = \XF::setupApp('XF\\Pub\\App');
+$db = $app->db();
+function srcMeta(string $path): ?array {
+    if (!is_file($path)) { return null; }
+    return ['bytes' => filesize($path), 'sha256' => hash_file('sha256', $path)];
+}
+$portal = $root . '/src/addons/Newfi/Portal';
+$templates = $db->fetchAll(
+    "SELECT title, style_id, LENGTH(template) AS bytes, SHA2(template,256) AS sha256, " .
+    "LOCATE('data-newfi-portal200', template) > 0 AS html_marker, " .
+    "LOCATE('--newfi-portal200', template) > 0 AS css_marker " .
+    "FROM xf_template WHERE addon_id='Newfi/Portal' ORDER BY style_id,title"
+);
+$result = [
+ 'hostname' => gethostname(),
+ 'application' => [
+  'boardActive' => (string)$db->fetchOne("SELECT option_value FROM xf_option WHERE option_id='boardActive'"),
+  'boardUrl' => (string)$db->fetchOne("SELECT option_value FROM xf_option WHERE option_id='boardUrl'"),
+  'indexRoute' => (string)$db->fetchOne("SELECT option_value FROM xf_option WHERE option_id='indexRoute'"),
+  'defaultStyleId' => (string)$db->fetchOne("SELECT option_value FROM xf_option WHERE option_id='defaultStyleId'"),
+  'error_count' => (int)$db->fetchOne("SELECT COUNT(*) FROM xf_error_log"),
+  'error_max_id' => (int)$db->fetchOne("SELECT COALESCE(MAX(error_id),0) FROM xf_error_log")
+ ],
+ 'addon' => $db->fetchRow(
+  "SELECT addon_id,version_id,version_string,active,is_processing,last_pending_action " .
+  "FROM xf_addon WHERE addon_id='Newfi/Portal'"
+ ),
+ 'source' => [
+  'Pub/Controller/Portal.php' => srcMeta($portal . '/Pub/Controller/Portal.php'),
+  'Service/PortalData.php' => srcMeta($portal . '/Service/PortalData.php'),
+  '_data/templates.xml' => srcMeta($portal . '/_data/templates.xml')
+ ],
+ 'templates' => $templates
+];
+echo "PORTAL200_INSPECT_JSON_BEGIN\n";
+echo json_encode(
+    $result,
+    JSON_UNESCAPED_UNICODE|JSON_UNESCAPED_SLASHES|JSON_INVALID_UTF8_SUBSTITUTE
+);
+echo "\nPORTAL200_INSPECT_JSON_END\n";
+?>'''
+
+
+IMPORT_PHP = r'''<?php
+$root = '/var/www/forums/newfi/public';
+require $root . '/src/XF.php';
+\XF::start($root);
+$app = \XF::setupApp('XF\\Pub\\App');
+$addOn = $app->addOnManager()->getById('Newfi/Portal');
+if (!$addOn || !$addOn->isInstalled()) {
+    fwrite(STDERR, "ADDON_NOT_INSTALLED\n");
+    exit(30);
+}
+$addOn->preRebuild();
+$dataManager = $app->addOnDataManager();
+$imported = [];
+foreach ($dataManager->getDataTypeClasses() as $dataType) {
+    $handler = $dataManager->getDataTypeHandler($dataType);
+    $xml = $handler->openTypeFile($addOn->getDataDirectory());
+    if (!$xml || !$xml->count()) {
+        $handler->deleteAddOnData($addOn->addon_id);
+        continue;
+    }
+    $start = 0;
+    $guard = 0;
+    while (true) {
+        $last = $handler->importAddOnData($addOn->addon_id, $xml, $start, 0);
+        if (!$last) { break; }
+        if ($last <= $start || ++$guard > 100000) {
+            fwrite(STDERR, "IMPORT_PROGRESS_INVALID\n");
+            exit(31);
+        }
+        $start = $last;
+    }
+    $handler->deleteOrphanedAddOnData($addOn->addon_id, $xml);
+    \XF::triggerRunOnce();
+    $imported[] = $handler->getContainerTag();
+}
+$addOn->postDataImport();
+$repo = $app->repository(\XF\Repository\StyleRepository::class);
+$repo->updateAllStylesLastModifiedDateLater();
+$addOn->postRebuild();
+echo "PORTAL200_IMPORT_JSON=" . json_encode(
+    ['result'=>'PASS','containers'=>$imported],
+    JSON_UNESCAPED_SLASHES
+) . "\n";
+?>'''
+
+
+ERRORS_PHP_TEMPLATE = r'''<?php
+$root='/var/www/forums/newfi/public';
+require $root.'/src/XF.php';
+\XF::start($root);
+$app=\XF::setupApp('XF\\Pub\\App');
+$db=$app->db();
+$b=%d;
+$rows=$db->fetchAll(
+    "SELECT error_id,exception_type,message,filename,line FROM xf_error_log WHERE error_id>? ORDER BY error_id",
+    [$b]
+);
+echo json_encode(
+    $rows,
+    JSON_UNESCAPED_UNICODE|JSON_UNESCAPED_SLASHES|JSON_INVALID_UTF8_SUBSTITUTE
+);
+?>'''
+
+
+RUNTIME_VERIFY_PHP_TEMPLATE = r'''<?php
+$state = '__STATE__';
+$root = '/var/www/forums/newfi/public';
+require $root . '/src/XF.php';
+\XF::start($root);
+$app = \XF::setupApp('XF\\Pub\\App');
+$result = ['state'=>$state];
+if ($state === 'new') {
+    $service = new \Newfi\Portal\Service\PortalData($app);
+    $portal = $service->build();
+    $html = (string)$app->templater()->renderTemplate('public:newfi_portal', ['portal'=>$portal]);
+    $result['sections'] = [];
+    foreach (['forums','resources','media','events','dogs'] as $key) {
+        $section = $portal[$key] ?? null;
+        if (!is_array($section)) { fwrite(STDERR, "SECTION_MISSING\n"); exit(60); }
+        $result['sections'][$key] = [
+            'available'=>(bool)($section['available'] ?? false),
+            'hasItems'=>(bool)($section['hasItems'] ?? false),
+            'status'=>(string)($section['status'] ?? '')
+        ];
+    }
+    $result['html_marker'] = strpos($html, 'data-newfi-portal200="1"') !== false;
+    $result['locked_resources'] = strpos($html, 'data-portal-locked="resources"') !== false;
+    $result['locked_media'] = strpos($html, 'data-portal-locked="media"') !== false;
+    $result['html_bytes'] = strlen($html);
+    if (!$result['html_marker']) { fwrite(STDERR, "HTML_MARKER_MISSING\n"); exit(61); }
+    if ($result['sections']['resources']['available'] || $result['sections']['media']['available']) {
+        fwrite(STDERR, "GUEST_PERMISSION_CONTRACT_CHANGED\n"); exit(62);
+    }
+    if (!$result['locked_resources'] || !$result['locked_media']) {
+        fwrite(STDERR, "LOCKED_COPY_MISSING\n"); exit(63);
+    }
+    if (!$result['sections']['forums']['available'] || !$result['sections']['events']['available'] || !$result['sections']['dogs']['available']) {
+        fwrite(STDERR, "PUBLIC_SECTION_UNAVAILABLE\n"); exit(64);
+    }
+} else if ($state === 'old') {
+    $html = (string)$app->templater()->renderTemplate('public:newfi_portal', []);
+    $result['html_marker'] = strpos($html, 'data-newfi-portal200') !== false;
+    $result['old_copy'] = strpos($html, 'Закрытое пространство для общения, знаний и материалов сообщества.') !== false;
+    $result['html_bytes'] = strlen($html);
+    if ($result['html_marker'] || !$result['old_copy']) {
+        fwrite(STDERR, "OLD_RENDER_CONTRACT\n"); exit(65);
+    }
+} else {
+    exit(66);
+}
+echo "PORTAL200_RUNTIME_JSON=" . json_encode(
+    $result,
+    JSON_UNESCAPED_UNICODE|JSON_UNESCAPED_SLASHES|JSON_INVALID_UTF8_SUBSTITUTE
+) . "\n";
+?>'''
+
+
+HTTP_VERIFY_PY = r'''import html,json,re,subprocess,sys,urllib.parse
+mode=sys.argv[1]
+state=sys.argv[2]
+if mode=='staging':
+    host='newfi-staging.gram1.ru'; scheme='http'; port='80'; expected_status=503
+elif mode=='prod':
+    host='newfi.ru'; scheme='https'; port='443'; expected_status=200
+else:
+    raise SystemExit(40)
+def fetch(url):
+    cmd=[
+        '/usr/bin/curl','-sS','-k','--max-time','30','--connect-timeout','10'
+    ]
+    if mode=='staging':
+        cmd += ['--resolve',f'{host}:{port}:127.0.0.1']
+    cmd += [
+        '-o','-','-w','\n__PORTAL_STATUS__%{http_code}',url
+    ]
+    p=subprocess.run(cmd,stdout=subprocess.PIPE,stderr=subprocess.PIPE,check=False)
+    if p.returncode!=0: raise SystemExit(41)
+    text=p.stdout.decode('utf-8','replace')
+    marker='\n__PORTAL_STATUS__'
+    if marker not in text: raise SystemExit(42)
+    body,status=text.rsplit(marker,1)
+    return int(status.strip()),body
+root=f'{scheme}://{host}/'
+status,body=fetch(root)
+hrefs=[]
+for raw in re.findall(r"href=[\"']([^\"']*css\.php[^\"']*)[\"']",body,re.I):
+    raw=html.unescape(raw)
+    hrefs.append(urllib.parse.urljoin(root,raw))
+normal_css=[]
+normal_status=[]
+for u in hrefs:
+    s,b=fetch(u)
+    normal_status.append(s)
+    normal_css.append(b)
+normal_css_text='\n'.join(normal_css)
+forced_css_marker=None
+forced_css_status=None
+if mode=='staging' and state=='new' and hrefs:
+    u=urllib.parse.urlsplit(hrefs[0])
+    pairs=urllib.parse.parse_qsl(u.query,keep_blank_values=True)
+    out=[]
+    found=False
+    for k,v in pairs:
+        if k=='css':
+            found=True
+            parts=[x for x in v.split(',') if x]
+            if 'public:newfi_portal.less' not in parts:
+                parts.append('public:newfi_portal.less')
+            v=','.join(parts)
+        out.append((k,v))
+    if found:
+        forced=urllib.parse.urlunsplit((u.scheme,u.netloc,u.path,urllib.parse.urlencode(out),u.fragment))
+        forced_css_status,forced_body=fetch(forced)
+        forced_css_marker='--newfi-portal200' in forced_body
+result={
+ 'status':status,
+ 'bytes':len(body.encode()),
+ 'html_marker':'data-newfi-portal200="1"' in body,
+ 'css_marker':'--newfi-portal200' in normal_css_text,
+ 'old_copy':'Закрытое пространство для общения, знаний и материалов сообщества.' in body,
+ 'css_count':len(hrefs),
+ 'css_status':normal_status,
+ 'forced_css_status':forced_css_status,
+ 'forced_css_marker':forced_css_marker,
+}
+print('PORTAL200_HTTP_JSON='+json.dumps(result,ensure_ascii=False,sort_keys=True,separators=(',',':')))
+if status!=expected_status: raise SystemExit(45)
+if mode=='prod':
+    if not hrefs or any(x!=200 for x in normal_status): raise SystemExit(46)
+elif mode=='staging':
+    if any(x!=200 for x in normal_status): raise SystemExit(46)
+else:
+    raise SystemExit(50)
+if mode=='prod' and state=='new':
+    if not result['html_marker'] or not result['css_marker']: raise SystemExit(47)
+elif mode=='prod' and state=='old':
+    if result['html_marker'] or result['css_marker'] or not result['old_copy']: raise SystemExit(48)
+elif mode=='staging' and state=='new':
+    if hrefs and (forced_css_status!=200 or not forced_css_marker): raise SystemExit(49)
+elif mode=='staging' and state=='old':
+    pass
+else:
+    raise SystemExit(50)
+'''
+
+
+def parse_inspect(text):
+    b = "PORTAL200_INSPECT_JSON_BEGIN\n"
+    e = "\nPORTAL200_INSPECT_JSON_END"
+    if b not in text or e not in text:
+        fail("INSPECT_MARKERS")
+    try:
+        return json.loads(text.split(b, 1)[1].split(e, 1)[0])
+    except Exception:
+        fail("INSPECT_JSON")
+
+
+def inspect(target):
+    return parse_inspect(
+        qga(target, ["/usr/bin/php8.3"], input_bytes=INSPECT_PHP.encode(), timeout=120)
+    )
+
+
+def source_is_old(data):
+    src = data["source"]
+    for rel, (size, sha) in EXPECTED_OLD.items():
+        row = src.get(rel)
+        if not row or row.get("bytes") != size or row.get("sha256") != sha:
+            return False
+    return src.get("Service/PortalData.php") is None
+
+
+def source_is_new(data):
+    src = data["source"]
+    for rel, (size, sha) in EXPECTED_NEW.items():
+        row = src.get(rel)
+        if not row or row.get("bytes") != size or row.get("sha256") != sha:
+            return False
+    return True
+
+
+def template_state_new(data):
+    rows = data.get("templates", [])
+    rows0 = [r for r in rows if int(r.get("style_id", -1)) == 0]
+    titles = [r.get("title") for r in rows0]
+    by = {r.get("title"): r for r in rows0}
+    return (
+        titles == ["newfi_portal", "newfi_portal.less"]
+        and int(by["newfi_portal"].get("html_marker", 0)) == 1
+        and int(by["newfi_portal.less"].get("css_marker", 0)) == 1
+    )
+
+
+def app_contract(data, target):
+    a = data.get("application", {})
+    addon = data.get("addon") or {}
+    expected = {
+        "staging": ("0", "http://newfi-staging.gram1.ru"),
+        "prod": ("1", "https://newfi.ru"),
+    }[target]
+    return (
+        a.get("boardActive") == expected[0]
+        and a.get("boardUrl") == expected[1]
+        and a.get("indexRoute") == "portal/"
+        and a.get("defaultStyleId") == "4"
+        and addon.get("addon_id") == "Newfi/Portal"
+        and int(addon.get("version_id", 0)) == 1000010
+        and addon.get("version_string") == "1.0.0 Alpha 1"
+        and int(addon.get("active", 0)) == 1
+        and int(addon.get("is_processing", 1)) == 0
+    )
+
+
+def new_errors(target, baseline):
+    raw = qga(
+        target,
+        ["/usr/bin/php8.3"],
+        input_bytes=(ERRORS_PHP_TEMPLATE % int(baseline)).encode(),
+        timeout=90,
+    )
+    try:
+        return json.loads(raw)
+    except Exception:
+        fail("ERROR_LOG_JSON")
+
+
+def assert_no_new_errors(target, baseline, phase):
+    rows = new_errors(target, baseline)
+    if rows:
+        emit(
+            "PORTAL200_NEW_XF_ERRORS",
+            {
+                "target": target,
+                "phase": phase,
+                "count": len(rows),
+                "ids": [r.get("error_id") for r in rows],
+            },
+        )
+        fail("NEW_XF_ERRORS")
+
+
+def guest_backup(target):
+    script = f'''set -eu
+B={shlex.quote(BACKUP)}
+P=/var/www/forums/newfi/public/src/addons/Newfi/Portal
+test ! -e "$B"
+install -d -m 700 "$B/Pub/Controller" "$B/_data"
+cp -p -- "$P/Pub/Controller/Portal.php" "$B/Pub/Controller/Portal.php"
+cp -p -- "$P/_data/templates.xml" "$B/_data/templates.xml"
+test ! -e "$P/Service/PortalData.php"
+printf 'PORTAL200_BACKUP=PASS\n'
+'''
+    out = qga(target, ["/bin/bash", "-lc", script], timeout=90)
+    if "PORTAL200_BACKUP=PASS" not in out:
+        fail("BACKUP_FAILED")
+
+
+def guest_write(target, rel, data):
+    dest = f"/var/www/forums/newfi/public/src/addons/Newfi/Portal/{rel}"
+    parent = str(pathlib.PurePosixPath(dest).parent)
+    script = (
+        "set -eu; umask 022; "
+        + "install -d -m 755 "
+        + shlex.quote(parent)
+        + "; T=$(mktemp "
+        + shlex.quote(parent + "/.portal200.XXXXXX")
+        + "); cat >\"$T\"; chmod 0644 \"$T\"; chown root:root \"$T\"; "
+        + "mv -f -- \"$T\" "
+        + shlex.quote(dest)
+        + "; printf 'PORTAL200_WRITE=PASS\\n'"
+    )
+    out = qga(
+        target,
+        ["/bin/bash", "-lc", script],
+        input_bytes=data,
+        timeout=90,
+    )
+    if "PORTAL200_WRITE=PASS" not in out:
+        fail("WRITE_FAILED")
+
+
+def install_candidate(target):
+    for rel in [
+        "Pub/Controller/Portal.php",
+        "Service/PortalData.php",
+        "_data/templates.xml",
+    ]:
+        guest_write(target, rel, (CAND_ROOT / rel).read_bytes())
+
+
+def restore_old(target):
+    script = f'''set -eu
+B={shlex.quote(BACKUP)}
+P=/var/www/forums/newfi/public/src/addons/Newfi/Portal
+test -f "$B/Pub/Controller/Portal.php"
+test -f "$B/_data/templates.xml"
+cp -p -- "$B/Pub/Controller/Portal.php" "$P/Pub/Controller/Portal.php"
+cp -p -- "$B/_data/templates.xml" "$P/_data/templates.xml"
+rm -f -- "$P/Service/PortalData.php"
+rmdir -- "$P/Service" 2>/dev/null || true
+printf 'PORTAL200_SOURCE_RESTORE=PASS\n'
+'''
+    out = qga(target, ["/bin/bash", "-lc", script], timeout=90)
+    if "PORTAL200_SOURCE_RESTORE=PASS" not in out:
+        fail("SOURCE_RESTORE_FAILED")
+
+
+def import_addon(target):
+    out = qga(
+        target,
+        ["/usr/bin/php8.3"],
+        input_bytes=IMPORT_PHP.encode(),
+        timeout=240,
+    )
+    if "PORTAL200_IMPORT_JSON=" not in out:
+        fail("IMPORT_FAILED")
+
+
+def runtime_verify(target, state):
+    src = RUNTIME_VERIFY_PHP_TEMPLATE.replace("__STATE__", state)
+    out = qga(target, ["/usr/bin/php8.3"], input_bytes=src.encode(), timeout=120)
+    line = next(
+        (x for x in out.splitlines() if x.startswith("PORTAL200_RUNTIME_JSON=")),
+        None,
+    )
+    if not line:
+        fail("RUNTIME_MARKER_MISSING")
+    try:
+        data = json.loads(line.split("=", 1)[1])
+    except Exception:
+        fail("RUNTIME_JSON")
+    emit("PORTAL200_RUNTIME", {"target": target, **data})
+    return data
+
+
+def http_verify(target, state):
+    argv = ["/usr/bin/python3", "-", target, state]
+    if target == "prod":
+        try:
+            p = subprocess.run(
+                argv,
+                input=HTTP_VERIFY_PY.encode(),
+                stdout=subprocess.PIPE,
+                stderr=subprocess.PIPE,
+                timeout=180,
+                check=False,
+            )
+        except subprocess.TimeoutExpired:
+            fail("HTTP_PROD_TIMEOUT")
+        out = p.stdout.decode("utf-8", "replace")
+        err = p.stderr.decode("utf-8", "replace")
+        line = next(
+            (x for x in out.splitlines() if x.startswith("PORTAL200_HTTP_JSON=")),
+            None,
+        )
+        data = None
+        if line:
+            try:
+                data = json.loads(line.split("=", 1)[1])
+                emit("PORTAL200_HTTP", {"target": target, "state": state, **data})
+            except Exception:
+                fail("HTTP_JSON")
+        if p.returncode != 0:
+            emit(
+                "PORTAL200_HTTP_EXEC",
+                {
+                    "target": target,
+                    "state": state,
+                    "rc": p.returncode,
+                    "stderr": err[:800],
+                },
+            )
+            fail("HTTP_PROD_RC")
+        if data is None:
+            fail("HTTP_MARKER_MISSING")
+        return data
+
+    out = qga(
+        target,
+        argv,
+        input_bytes=HTTP_VERIFY_PY.encode(),
+        timeout=180,
+    )
+    line = next(
+        (x for x in out.splitlines() if x.startswith("PORTAL200_HTTP_JSON=")),
+        None,
+    )
+    if not line:
+        fail("HTTP_MARKER_MISSING")
+    try:
+        data = json.loads(line.split("=", 1)[1])
+    except Exception:
+        fail("HTTP_JSON")
+    emit("PORTAL200_HTTP", {"target": target, "state": state, **data})
+    return data
+
+
+def verify_new(target, baseline):
+    data = inspect(target)
+    if not app_contract(data, target):
+        fail("APP_CONTRACT_NEW")
+    if not source_is_new(data):
+        fail("SOURCE_NEW_MISMATCH")
+    if not template_state_new(data):
+        fail("TEMPLATE_NEW_MISMATCH")
+    runtime_verify(target, "new")
+    http_verify(target, "new")
+    assert_no_new_errors(target, baseline, "verify-new")
+    return inspect(target)
+
+
+def verify_old(target, baseline, old_templates, strict_errors=True):
+    data = inspect(target)
+    if not app_contract(data, target):
+        fail("APP_CONTRACT_OLD")
+    if not source_is_old(data):
+        fail("SOURCE_OLD_MISMATCH")
+    if data.get("templates") != old_templates:
+        fail("TEMPLATE_ROLLBACK_MISMATCH")
+    if target == "prod":
+        runtime_verify(target, "old")
+    http_verify(target, "old")
+    if strict_errors:
+        assert_no_new_errors(target, baseline, "verify-old")
+    return inspect(target)
+
+
+def lint_php(target, source, label):
+    out = qga(
+        target,
+        ["/usr/bin/php8.3", "-l"],
+        input_bytes=source.encode(),
+        timeout=90,
+    )
+    if "No syntax errors detected" not in out:
+        fail("PHP_LINT_" + label)
+
+
+def cluster_guard():
+    p = run(["/usr/sbin/qm", "status", "210"], timeout=30)
+    if "status: running" not in p.stdout.decode():
+        fail("VM210_NOT_RUNNING")
+    p = run(
+        [
+            "/usr/bin/ssh",
+            "-T",
+            "-o",
+            "BatchMode=yes",
+            "-o",
+            "StrictHostKeyChecking=yes",
+            "-o",
+            "UpdateHostKeys=no",
+            "-o",
+            "ConnectTimeout=10",
+            "root@pve03",
+            "/usr/sbin/qm status 211",
+        ],
+        timeout=40,
+    )
+    if "status: running" not in p.stdout.decode():
+        fail("VM211_NOT_RUNNING")
+    emit("PORTAL200_CLUSTER", "PASS")
+
+
+def result_contract(status, changes, rollback_started, rollback_restored):
+    emit(
+        "HOMELAB_RESULT_CONTRACT",
+        {
+            "version": 1,
+            "command_id": CID,
+            "status": status,
+            "changes_made": bool(changes),
+            "rollback_started": bool(rollback_started),
+            "rollback_restored": rollback_restored,
+        },
+    )
+
+
+emit("NEWFI200_BEGIN")
+emit("COMMAND_ID", CID)
+emit("PORTAL200_REMAINING_FULL_PRODUCT_COMMANDS_BEFORE", 22)
+emit(
+    "PORTAL200_FLOW",
+    "candidate->staging-apply->rollback-proof->staging-reapply->git-push->production",
+)
+
+staging_backup = False
+staging_mutated = False
+staging_final_new = False
+prod_backup = False
+prod_mutated = False
+git_files_changed = False
+commit_created = False
+push_confirmed = False
+failure_rollback_started = False
+failure_rollback_restored = None
+old_git_bytes = {}
+new_head = None
+s_error = None
+p_error = None
+s_old_templates = None
+p_old_templates = None
+
+try:
+    compile(HTTP_VERIFY_PY, "<portal200-http-verify>", "exec")
+    for rel, (size, sha) in EXPECTED_NEW.items():
+        p = CAND_ROOT / rel
+        if not p.is_file() or file_meta(p) != (size, sha):
+            fail("CANDIDATE_IDENTITY")
+    tree = ET.parse(CAND_ROOT / "_data/templates.xml")
+    titles = sorted(x.attrib.get("title") for x in tree.getroot().findall("template"))
+    if titles != ["newfi_portal", "newfi_portal.less"]:
+        fail("CANDIDATE_TEMPLATE_SET")
+    service = (CAND_ROOT / "Service/PortalData.php").read_text("utf-8")
+    if any(
+        token in service
+        for token in [
+            "\\XF::db(",
+            "->save(",
+            "->delete(",
+            "INSERT ",
+            "UPDATE ",
+            "DELETE ",
+            "REPLACE ",
+        ]
+    ):
+        fail("CANDIDATE_MUTATION_SCAN")
+    emit("PORTAL200_CANDIDATE_IDENTITY", "PASS")
+    emit(
+        "PORTAL200_ORCHESTRATION_FIXES",
+        {
+            "staging_503_without_css_links": True,
+            "failure_status": "FAIL",
+            "prod_http_via_pve01_public_route": True,
+            "css_href_regex_fixed": True,
+        },
+    )
+
+    branch = git("branch", "--show-current")
+    head = git("rev-parse", "HEAD")
+    status = git("status", "--porcelain=v1", "--untracked-files=all")
+    remote_out = git("ls-remote", "origin", f"refs/heads/{BRANCH}")
+    remote = remote_out.split()[0] if remote_out else ""
+    if branch != BRANCH or head != OLD_HEAD or remote != OLD_HEAD or status:
+        fail("GIT_PRESTATE")
+    emit(
+        "PORTAL200_GIT_PRESTATE",
+        {"branch": branch, "head": head, "remote": remote, "clean": True},
+    )
+    cluster_guard()
+
+    lint_php("staging", INSPECT_PHP, "INSPECT_STAGING")
+    lint_php("staging", IMPORT_PHP, "IMPORT_STAGING")
+    lint_php("staging", RUNTIME_VERIFY_PHP_TEMPLATE.replace("__STATE__", "new"), "RUNTIME_STAGING")
+    lint_php("prod", INSPECT_PHP, "INSPECT_PROD")
+    lint_php("prod", IMPORT_PHP, "IMPORT_PROD")
+    lint_php("prod", RUNTIME_VERIFY_PHP_TEMPLATE.replace("__STATE__", "new"), "RUNTIME_PROD")
+    emit("PORTAL200_RUNTIME_HELPER_LINT", "PASS")
+
+    s0 = inspect("staging")
+    p0 = inspect("prod")
+    if not app_contract(s0, "staging") or not app_contract(p0, "prod"):
+        fail("APP_PRESTATE")
+    if not source_is_old(s0) or not source_is_old(p0):
+        fail("SOURCE_PRESTATE")
+    if s0.get("templates") != p0.get("templates"):
+        fail("TEMPLATE_PRESTATE_PARITY")
+    s_error = int(s0["application"]["error_max_id"])
+    p_error = int(p0["application"]["error_max_id"])
+    s_old_templates = s0["templates"]
+    p_old_templates = p0["templates"]
+    emit("PORTAL200_ERROR_BASELINE", {"staging": s_error, "prod": p_error})
+    http_verify("staging", "old")
+    runtime_verify("prod", "old")
+    http_verify("prod", "old")
+    assert_no_new_errors("staging", s_error, "preflight")
+    assert_no_new_errors("prod", p_error, "preflight")
+    emit("PORTAL200_PREFLIGHT", "PASS")
+
+    guest_backup("staging")
+    staging_backup = True
+    staging_mutated = True
+    install_candidate("staging")
+    import_addon("staging")
+    verify_new("staging", s_error)
+    emit("PORTAL200_STAGING_FIRST_APPLY", "PASS")
+
+    restore_old("staging")
+    import_addon("staging")
+    verify_old("staging", s_error, s_old_templates)
+    staging_mutated = False
+    emit("PORTAL200_STAGING_ROLLBACK_PROOF", "PASS")
+
+    staging_mutated = True
+    install_candidate("staging")
+    import_addon("staging")
+    verify_new("staging", s_error)
+    staging_final_new = True
+    emit("PORTAL200_STAGING_FINAL", "PASS")
+
+    for rel in EXPECTED_NEW:
+        dest = GIT_PORTAL / rel
+        old_git_bytes[str(rel)] = dest.read_bytes() if dest.exists() else None
+        dest.parent.mkdir(parents=True, exist_ok=True)
+        shutil.copyfile(CAND_ROOT / rel, dest)
+    git_files_changed = True
+
+    if git("diff", "--check"):
+        fail("GIT_DIFF_CHECK")
+    status_lines = git("status", "--porcelain=v1", "--untracked-files=all").splitlines()
+    actual_paths = sorted(line[3:] for line in status_lines if len(line) >= 4)
+    if actual_paths != sorted(EXPECTED_GIT_PATHS):
+        fail("GIT_SCOPE")
+    git("add", "--", *EXPECTED_GIT_PATHS)
+    staged = sorted(x for x in git("diff", "--cached", "--name-only").splitlines() if x)
+    if staged != sorted(EXPECTED_GIT_PATHS):
+        fail("GIT_STAGED_SCOPE")
+    git("commit", "-m", f"feat: build data-backed Newfi portal [{CID}]")
+    commit_created = True
+    new_head = git("rev-parse", "HEAD")
+    if new_head == OLD_HEAD:
+        fail("GIT_COMMIT_HEAD")
+    if git("status", "--porcelain=v1", "--untracked-files=all"):
+        fail("GIT_POSTCOMMIT_DIRTY")
+    git("push", "origin", f"HEAD:refs/heads/{BRANCH}", timeout=180)
+    remote_out = git("ls-remote", "origin", f"refs/heads/{BRANCH}")
+    remote_head = remote_out.split()[0] if remote_out else ""
+    if remote_head != new_head:
+        fail("GIT_REMOTE_HEAD")
+    push_confirmed = True
+    emit(
+        "PORTAL200_GIT_PROMOTION",
+        {
+            "old_head": OLD_HEAD,
+            "new_head": new_head,
+            "remote_head": remote_head,
+            "result": "PASS",
+        },
+    )
+
+    p_pre = inspect("prod")
+    if not source_is_old(p_pre) or p_pre.get("templates") != p_old_templates:
+        fail("PROD_DRIFT_BEFORE_APPLY")
+    if int(p_pre["application"]["error_max_id"]) != p_error:
+        fail("PROD_ERROR_DRIFT")
+    guest_backup("prod")
+    prod_backup = True
+    prod_mutated = True
+    install_candidate("prod")
+    import_addon("prod")
+    verify_new("prod", p_error)
+    emit("PORTAL200_PRODUCTION", "PASS")
+
+    sf = verify_new("staging", s_error)
+    pf = verify_new("prod", p_error)
+    if sf["source"] != pf["source"]:
+        fail("FINAL_SOURCE_PARITY")
+    if sf["templates"] != pf["templates"]:
+        fail("FINAL_TEMPLATE_PARITY")
+    if git("rev-parse", "HEAD") != new_head:
+        fail("FINAL_LOCAL_HEAD")
+    remote_out = git("ls-remote", "origin", f"refs/heads/{BRANCH}")
+    if not remote_out or remote_out.split()[0] != new_head:
+        fail("FINAL_REMOTE_HEAD")
+    if git("status", "--porcelain=v1", "--untracked-files=all"):
+        fail("FINAL_GIT_DIRTY")
+    cluster_guard()
+    emit(
+        "PORTAL200_FINAL_EVIDENCE",
+        {
+            "commit": new_head,
+            "source_files": 3,
+            "templates": 2,
+            "staging_error_baseline": s_error,
+            "prod_error_baseline": p_error,
+        },
+    )
+    emit("PORTAL200_PORTAL", "PASS")
+    emit("PORTAL200_STAGING", "PASS")
+    emit("PORTAL200_PRODUCTION", "PASS")
+    emit("PORTAL200_REMAINING_FULL_PRODUCT_COMMANDS_AFTER_PASS", 21)
+    result_contract("OK", True, False, None)
+    emit("NEWFI200_END")
+    raise SystemExit(0)
+
+except PortalError as exc:
+    code = str(exc)
+    emit("PORTAL200_FAILURE", code)
+
+    if push_confirmed:
+        if prod_mutated and prod_backup:
+            failure_rollback_started = True
+            try:
+                restore_old("prod")
+                import_addon("prod")
+                verify_old("prod", p_error, p_old_templates, strict_errors=False)
+                prod_mutated = False
+                failure_rollback_restored = False
+                emit("PORTAL200_FAILURE_PROD_ROLLBACK", "PASS_PARTIAL_OVERALL_STATE_CHANGED")
+            except Exception:
+                failure_rollback_restored = False
+                emit("PORTAL200_FAILURE_PROD_ROLLBACK", "FAIL")
+    else:
+        if staging_mutated and staging_backup:
+            failure_rollback_started = True
+            try:
+                restore_old("staging")
+                import_addon("staging")
+                verify_old("staging", s_error, s_old_templates, strict_errors=False)
+                staging_mutated = False
+                staging_final_new = False
+                failure_rollback_restored = True
+                emit("PORTAL200_FAILURE_STAGING_ROLLBACK", "PASS")
+            except Exception:
+                failure_rollback_restored = False
+                emit("PORTAL200_FAILURE_STAGING_ROLLBACK", "FAIL")
+
+        if git_files_changed and not commit_created:
+            try:
+                for rel, old in old_git_bytes.items():
+                    dest = GIT_PORTAL / rel
+                    if old is None:
+                        if dest.exists():
+                            dest.unlink()
+                    else:
+                        dest.write_bytes(old)
+                service_dir = GIT_PORTAL / "Service"
+                try:
+                    service_dir.rmdir()
+                except OSError:
+                    pass
+                emit("PORTAL200_FAILURE_GIT_WORKTREE_RESTORE", "PASS")
+            except Exception:
+                emit("PORTAL200_FAILURE_GIT_WORKTREE_RESTORE", "FAIL")
+
+        if commit_created:
+            emit(
+                "PORTAL200_FAILURE_GIT_HISTORY",
+                "COMMIT_CREATED_NO_DESTRUCTIVE_RESET_FRESH_ID_REQUIRED",
+            )
+
+    persisted = bool(push_confirmed or commit_created or staging_final_new or prod_mutated)
+    if failure_rollback_started and failure_rollback_restored is None:
+        failure_rollback_restored = False
+    result_contract(
+        "FAIL",
+        persisted,
+        failure_rollback_started,
+        failure_rollback_restored,
+    )
+    emit("PORTAL200_ROADMAP_REMAINS", 22)
+    emit("NEWFI200_END")
+    raise SystemExit(1)
+
+except Exception:
+    emit("PORTAL200_FAILURE", "UNEXPECTED_EXCEPTION")
+    result_contract(
+        "FAIL",
+        bool(push_confirmed or commit_created or staging_final_new or prod_mutated),
+        False,
+        None,
+    )
+    emit("PORTAL200_ROADMAP_REMAINS", 22)
+    emit("NEWFI200_END")
+    raise SystemExit(1)
+
+CANDIDATE_LAYER_2_TEXT_END
+CANDIDATE_LAYER_3_SOURCE=file:newfi-48-portal200-apply2.cmd::b64::zlib
+CANDIDATE_LAYER_3_SHA256=5e3aa56505b7d7ef5b7f0cf588f89d5e1c5f6b8bd9bffc13b8debdbdc5be26c7
+CANDIDATE_LAYER_3_BYTES=32663
+CANDIDATE_LAYER_3_TEXT_BEGIN
+import hashlib
+import json
+import pathlib
+import shlex
+import shutil
+import subprocess
+import sys
+import xml.etree.ElementTree as ET
+
+CID = "NEWFI-260907-PORTAL200-APPLY2"
+BRANCH = "implementation/newfi-closed-mvp-20260906"
+OLD_HEAD = "06bab5acd124e768f70305b3d7eca2f595871890"
+WT = pathlib.Path("/root/newfi-portal/.worktrees/implementation-newfi-closed-mvp-20260906")
+CAND_ROOT = pathlib.Path("/root/newfi-portal200-candidate/src/addons/Newfi/Portal")
+PORTAL_REL = pathlib.Path("src/addons/Newfi/Portal")
+GIT_PORTAL = WT / PORTAL_REL
+EXPECTED_NEW = {
+    "Pub/Controller/Portal.php": (363, "619d489f7cc3b461479c702fa8825097ae22d3c6cfeb911e9f14ea1de9c36d6d"),
+    "Service/PortalData.php": (5213, "4da03f26294ab6d163a1a746dee4bb6a82d7d4f39e66b24246bc0eb4c455dd1d"),
+    "_data/templates.xml": (10977, "1650c3d868d4bc47703f1b75f1f179cd25309b2d3b20a2b848e81a4423c00861"),
+}
+EXPECTED_OLD = {
+    "Pub/Controller/Portal.php": (247, "53909e753ea5a011550fd280ad1c342a74ca9949be092dfbd95244243cae92f3"),
+    "_data/templates.xml": (1461, "c29c04f8b937284e821c87957653e87c2f6ac014fac30648a0f6b18e84392adf"),
+}
+EXPECTED_GIT_PATHS = [str(PORTAL_REL / p) for p in sorted(EXPECTED_NEW)]
+BACKUP = f"/root/newfi-portal200-backup-{CID}"
+
+
+class PortalError(RuntimeError):
+    pass
+
+
+def emit(key, value=None):
+    if value is None:
+        print(key, flush=True)
+    elif isinstance(value, (dict, list, tuple, bool, int, float)):
+        print(
+            key + "=" + json.dumps(value, ensure_ascii=False, sort_keys=True, separators=(",", ":")),
+            flush=True,
+        )
+    else:
+        print(key + "=" + str(value), flush=True)
+
+
+def fail(code):
+    raise PortalError(code)
+
+
+def sha_bytes(data):
+    return hashlib.sha256(data).hexdigest()
+
+
+def file_meta(path):
+    data = pathlib.Path(path).read_bytes()
+    return len(data), sha_bytes(data)
+
+
+def run(cmd, *, input_bytes=None, timeout=180, ok=(0,)):
+    try:
+        p = subprocess.run(
+            cmd,
+            input=input_bytes,
+            stdout=subprocess.PIPE,
+            stderr=subprocess.PIPE,
+            timeout=timeout,
+            check=False,
+        )
+    except subprocess.TimeoutExpired:
+        fail("SUBPROCESS_TIMEOUT")
+    if p.returncode not in ok:
+        fail("SUBPROCESS_RC")
+    return p
+
+
+def git(*args, ok=(0,), timeout=120):
+    p = run(["/usr/bin/git", "-C", str(WT), *args], timeout=timeout, ok=ok)
+    return p.stdout.decode("utf-8", "replace").strip()
+
+
+def qga(target, argv, *, input_bytes=None, timeout=180):
+    if target == "prod":
+        cmd = [
+            "/usr/sbin/qm",
+            "guest",
+            "exec",
+            "210",
+            "--synchronous",
+            "1",
+            "--timeout",
+            str(timeout),
+        ]
+        if input_bytes is not None:
+            cmd += ["--pass-stdin", "1"]
+        cmd += ["--", *argv]
+    elif target == "staging":
+        q = [
+            "/usr/sbin/qm",
+            "guest",
+            "exec",
+            "211",
+            "--synchronous",
+            "1",
+            "--timeout",
+            str(timeout),
+        ]
+        if input_bytes is not None:
+            q += ["--pass-stdin", "1"]
+        q += ["--", *argv]
+        remote = (
+            "test \"$(id -u):$(hostname -s)\" = 0:pve03 || exit 72; "
+            "for f in /etc/pve/HOMELAB_ASSISTANT_ERROR_REGISTER.md /etc/pve/31_HOMELAB_REFERENCE.md; do "
+            "test -r \"$f\" && test -s \"$f\" && cat -- \"$f\" >/dev/null || exit 73; done; exec "
+            + " ".join(shlex.quote(x) for x in q)
+        )
+        cmd = [
+            "/usr/bin/ssh",
+            "-T",
+            "-o",
+            "BatchMode=yes",
+            "-o",
+            "StrictHostKeyChecking=yes",
+            "-o",
+            "UpdateHostKeys=no",
+            "-o",
+            "ConnectTimeout=10",
+            "-o",
+            "ConnectionAttempts=1",
+            "root@pve03",
+            remote,
+        ]
+    else:
+        fail("BAD_TARGET")
+
+    p = run(cmd, input_bytes=input_bytes, timeout=timeout + 30)
+    try:
+        data = json.loads(p.stdout.decode("utf-8"))
+    except Exception:
+        fail("QGA_JSON")
+    if data.get("exited") not in (1, True) or data.get("exitcode") != 0:
+        fail("QGA_GUEST_RC")
+    if data.get("out-truncated") or data.get("err-truncated"):
+        fail("QGA_TRUNCATED")
+    return data.get("out-data", "")
+
+
+INSPECT_PHP = r'''<?php
+$root = '/var/www/forums/newfi/public';
+require $root . '/src/XF.php';
+\XF::start($root);
+$app = \XF::setupApp('XF\\Pub\\App');
+$db = $app->db();
+function srcMeta(string $path): ?array {
+    if (!is_file($path)) { return null; }
+    return ['bytes' => filesize($path), 'sha256' => hash_file('sha256', $path)];
+}
+$portal = $root . '/src/addons/Newfi/Portal';
+$templates = $db->fetchAll(
+    "SELECT title, style_id, LENGTH(template) AS bytes, SHA2(template,256) AS sha256, " .
+    "LOCATE('data-newfi-portal200', template) > 0 AS html_marker, " .
+    "LOCATE('--newfi-portal200', template) > 0 AS css_marker " .
+    "FROM xf_template WHERE addon_id='Newfi/Portal' ORDER BY style_id,title"
+);
+$result = [
+ 'hostname' => gethostname(),
+ 'application' => [
+  'boardActive' => (string)$db->fetchOne("SELECT option_value FROM xf_option WHERE option_id='boardActive'"),
+  'boardUrl' => (string)$db->fetchOne("SELECT option_value FROM xf_option WHERE option_id='boardUrl'"),
+  'indexRoute' => (string)$db->fetchOne("SELECT option_value FROM xf_option WHERE option_id='indexRoute'"),
+  'defaultStyleId' => (string)$db->fetchOne("SELECT option_value FROM xf_option WHERE option_id='defaultStyleId'"),
+  'error_count' => (int)$db->fetchOne("SELECT COUNT(*) FROM xf_error_log"),
+  'error_max_id' => (int)$db->fetchOne("SELECT COALESCE(MAX(error_id),0) FROM xf_error_log")
+ ],
+ 'addon' => $db->fetchRow(
+  "SELECT addon_id,version_id,version_string,active,is_processing,last_pending_action " .
+  "FROM xf_addon WHERE addon_id='Newfi/Portal'"
+ ),
+ 'source' => [
+  'Pub/Controller/Portal.php' => srcMeta($portal . '/Pub/Controller/Portal.php'),
+  'Service/PortalData.php' => srcMeta($portal . '/Service/PortalData.php'),
+  '_data/templates.xml' => srcMeta($portal . '/_data/templates.xml')
+ ],
+ 'templates' => $templates
+];
+echo "PORTAL200_INSPECT_JSON_BEGIN\n";
+echo json_encode(
+    $result,
+    JSON_UNESCAPED_UNICODE|JSON_UNESCAPED_SLASHES|JSON_INVALID_UTF8_SUBSTITUTE
+);
+echo "\nPORTAL200_INSPECT_JSON_END\n";
+?>'''
+
+
+IMPORT_PHP = r'''<?php
+$root = '/var/www/forums/newfi/public';
+require $root . '/src/XF.php';
+\XF::start($root);
+$app = \XF::setupApp('XF\\Pub\\App');
+$addOn = $app->addOnManager()->getById('Newfi/Portal');
+if (!$addOn || !$addOn->isInstalled()) {
+    fwrite(STDERR, "ADDON_NOT_INSTALLED\n");
+    exit(30);
+}
+$addOn->preRebuild();
+$dataManager = $app->addOnDataManager();
+$imported = [];
+foreach ($dataManager->getDataTypeClasses() as $dataType) {
+    $handler = $dataManager->getDataTypeHandler($dataType);
+    $xml = $handler->openTypeFile($addOn->getDataDirectory());
+    if (!$xml || !$xml->count()) {
+        $handler->deleteAddOnData($addOn->addon_id);
+        continue;
+    }
+    $start = 0;
+    $guard = 0;
+    while (true) {
+        $last = $handler->importAddOnData($addOn->addon_id, $xml, $start, 0);
+        if (!$last) { break; }
+        if ($last <= $start || ++$guard > 100000) {
+            fwrite(STDERR, "IMPORT_PROGRESS_INVALID\n");
+            exit(31);
+        }
+        $start = $last;
+    }
+    $handler->deleteOrphanedAddOnData($addOn->addon_id, $xml);
+    \XF::triggerRunOnce();
+    $imported[] = $handler->getContainerTag();
+}
+$addOn->postDataImport();
+$repo = $app->repository(\XF\Repository\StyleRepository::class);
+$repo->updateAllStylesLastModifiedDateLater();
+$addOn->postRebuild();
+echo "PORTAL200_IMPORT_JSON=" . json_encode(
+    ['result'=>'PASS','containers'=>$imported],
+    JSON_UNESCAPED_SLASHES
+) . "\n";
+?>'''
+
+
+ERRORS_PHP_TEMPLATE = r'''<?php
+$root='/var/www/forums/newfi/public';
+require $root.'/src/XF.php';
+\XF::start($root);
+$app=\XF::setupApp('XF\\Pub\\App');
+$db=$app->db();
+$b=%d;
+$rows=$db->fetchAll(
+    "SELECT error_id,exception_type,message,filename,line FROM xf_error_log WHERE error_id>? ORDER BY error_id",
+    [$b]
+);
+echo json_encode(
+    $rows,
+    JSON_UNESCAPED_UNICODE|JSON_UNESCAPED_SLASHES|JSON_INVALID_UTF8_SUBSTITUTE
+);
+?>'''
+
+
+RUNTIME_VERIFY_PHP_TEMPLATE = r'''<?php
+$state = '__STATE__';
+$root = '/var/www/forums/newfi/public';
+require $root . '/src/XF.php';
+\XF::start($root);
+$app = \XF::setupApp('XF\\Pub\\App');
+$result = ['state'=>$state];
+if ($state === 'new') {
+    $service = new \Newfi\Portal\Service\PortalData($app);
+    $portal = $service->build();
+    $html = (string)$app->templater()->renderTemplate('public:newfi_portal', ['portal'=>$portal]);
+    $result['sections'] = [];
+    foreach (['forums','resources','media','events','dogs'] as $key) {
+        $section = $portal[$key] ?? null;
+        if (!is_array($section)) { fwrite(STDERR, "SECTION_MISSING\n"); exit(60); }
+        $result['sections'][$key] = [
+            'available'=>(bool)($section['available'] ?? false),
+            'hasItems'=>(bool)($section['hasItems'] ?? false),
+            'status'=>(string)($section['status'] ?? '')
+        ];
+    }
+    $result['html_marker'] = strpos($html, 'data-newfi-portal200="1"') !== false;
+    $result['locked_resources'] = strpos($html, 'data-portal-locked="resources"') !== false;
+    $result['locked_media'] = strpos($html, 'data-portal-locked="media"') !== false;
+    $result['html_bytes'] = strlen($html);
+    if (!$result['html_marker']) { fwrite(STDERR, "HTML_MARKER_MISSING\n"); exit(61); }
+    if ($result['sections']['resources']['available'] || $result['sections']['media']['available']) {
+        fwrite(STDERR, "GUEST_PERMISSION_CONTRACT_CHANGED\n"); exit(62);
+    }
+    if (!$result['locked_resources'] || !$result['locked_media']) {
+        fwrite(STDERR, "LOCKED_COPY_MISSING\n"); exit(63);
+    }
+    if (!$result['sections']['forums']['available'] || !$result['sections']['events']['available'] || !$result['sections']['dogs']['available']) {
+        fwrite(STDERR, "PUBLIC_SECTION_UNAVAILABLE\n"); exit(64);
+    }
+} else if ($state === 'old') {
+    $html = (string)$app->templater()->renderTemplate('public:newfi_portal', []);
+    $result['html_marker'] = strpos($html, 'data-newfi-portal200') !== false;
+    $result['old_copy'] = strpos($html, 'Закрытое пространство для общения, знаний и материалов сообщества.') !== false;
+    $result['html_bytes'] = strlen($html);
+    if ($result['html_marker'] || !$result['old_copy']) {
+        fwrite(STDERR, "OLD_RENDER_CONTRACT\n"); exit(65);
+    }
+} else {
+    exit(66);
+}
+echo "PORTAL200_RUNTIME_JSON=" . json_encode(
+    $result,
+    JSON_UNESCAPED_UNICODE|JSON_UNESCAPED_SLASHES|JSON_INVALID_UTF8_SUBSTITUTE
+) . "\n";
+?>'''
+
+
+HTTP_VERIFY_PY = r'''import html,json,re,subprocess,sys,urllib.parse
+mode=sys.argv[1]
+state=sys.argv[2]
+if mode=='staging':
+    host='newfi-staging.gram1.ru'; scheme='http'; port='80'; expected_status=503
+elif mode=='prod':
+    host='newfi.ru'; scheme='https'; port='443'; expected_status=200
+else:
+    raise SystemExit(40)
+def fetch(url):
+    cmd=[
+        '/usr/bin/curl','-sS','-k','--max-time','30','--connect-timeout','10',
+        '--resolve',f'{host}:{port}:127.0.0.1','-o','-','-w',
+        '\n__PORTAL_STATUS__%{http_code}',url
+    ]
+    p=subprocess.run(cmd,stdout=subprocess.PIPE,stderr=subprocess.PIPE,check=False)
+    if p.returncode!=0: raise SystemExit(41)
+    text=p.stdout.decode('utf-8','replace')
+    marker='\n__PORTAL_STATUS__'
+    if marker not in text: raise SystemExit(42)
+    body,status=text.rsplit(marker,1)
+    return int(status.strip()),body
+root=f'{scheme}://{host}/'
+status,body=fetch(root)
+hrefs=[]
+for raw in re.findall(r"href=[\"']([^\"']*css\\.php[^\"']*)[\"']",body,re.I):
+    raw=html.unescape(raw)
+    hrefs.append(urllib.parse.urljoin(root,raw))
+normal_css=[]
+normal_status=[]
+for u in hrefs:
+    s,b=fetch(u)
+    normal_status.append(s)
+    normal_css.append(b)
+normal_css_text='\n'.join(normal_css)
+forced_css_marker=None
+forced_css_status=None
+if mode=='staging' and state=='new' and hrefs:
+    u=urllib.parse.urlsplit(hrefs[0])
+    pairs=urllib.parse.parse_qsl(u.query,keep_blank_values=True)
+    out=[]
+    found=False
+    for k,v in pairs:
+        if k=='css':
+            found=True
+            parts=[x for x in v.split(',') if x]
+            if 'public:newfi_portal.less' not in parts:
+                parts.append('public:newfi_portal.less')
+            v=','.join(parts)
+        out.append((k,v))
+    if found:
+        forced=urllib.parse.urlunsplit((u.scheme,u.netloc,u.path,urllib.parse.urlencode(out),u.fragment))
+        forced_css_status,forced_body=fetch(forced)
+        forced_css_marker='--newfi-portal200' in forced_body
+result={
+ 'status':status,
+ 'bytes':len(body.encode()),
+ 'html_marker':'data-newfi-portal200="1"' in body,
+ 'css_marker':'--newfi-portal200' in normal_css_text,
+ 'old_copy':'Закрытое пространство для общения, знаний и материалов сообщества.' in body,
+ 'css_count':len(hrefs),
+ 'css_status':normal_status,
+ 'forced_css_status':forced_css_status,
+ 'forced_css_marker':forced_css_marker,
+}
+print('PORTAL200_HTTP_JSON='+json.dumps(result,ensure_ascii=False,sort_keys=True,separators=(',',':')))
+if status!=expected_status: raise SystemExit(45)
+if mode=='prod':
+    if not hrefs or any(x!=200 for x in normal_status): raise SystemExit(46)
+elif mode=='staging':
+    if any(x!=200 for x in normal_status): raise SystemExit(46)
+else:
+    raise SystemExit(50)
+if mode=='prod' and state=='new':
+    if not result['html_marker'] or not result['css_marker']: raise SystemExit(47)
+elif mode=='prod' and state=='old':
+    if result['html_marker'] or result['css_marker'] or not result['old_copy']: raise SystemExit(48)
+elif mode=='staging' and state=='new':
+    if hrefs and (forced_css_status!=200 or not forced_css_marker): raise SystemExit(49)
+elif mode=='staging' and state=='old':
+    pass
+else:
+    raise SystemExit(50)
+'''
+
+
+def parse_inspect(text):
+    b = "PORTAL200_INSPECT_JSON_BEGIN\n"
+    e = "\nPORTAL200_INSPECT_JSON_END"
+    if b not in text or e not in text:
+        fail("INSPECT_MARKERS")
+    try:
+        return json.loads(text.split(b, 1)[1].split(e, 1)[0])
+    except Exception:
+        fail("INSPECT_JSON")
+
+
+def inspect(target):
+    return parse_inspect(
+        qga(target, ["/usr/bin/php8.3"], input_bytes=INSPECT_PHP.encode(), timeout=120)
+    )
+
+
+def source_is_old(data):
+    src = data["source"]
+    for rel, (size, sha) in EXPECTED_OLD.items():
+        row = src.get(rel)
+        if not row or row.get("bytes") != size or row.get("sha256") != sha:
+            return False
+    return src.get("Service/PortalData.php") is None
+
+
+def source_is_new(data):
+    src = data["source"]
+    for rel, (size, sha) in EXPECTED_NEW.items():
+        row = src.get(rel)
+        if not row or row.get("bytes") != size or row.get("sha256") != sha:
+            return False
+    return True
+
+
+def template_state_new(data):
+    rows = data.get("templates", [])
+    rows0 = [r for r in rows if int(r.get("style_id", -1)) == 0]
+    titles = [r.get("title") for r in rows0]
+    by = {r.get("title"): r for r in rows0}
+    return (
+        titles == ["newfi_portal", "newfi_portal.less"]
+        and int(by["newfi_portal"].get("html_marker", 0)) == 1
+        and int(by["newfi_portal.less"].get("css_marker", 0)) == 1
+    )
+
+
+def app_contract(data, target):
+    a = data.get("application", {})
+    addon = data.get("addon") or {}
+    expected = {
+        "staging": ("0", "http://newfi-staging.gram1.ru"),
+        "prod": ("1", "https://newfi.ru"),
+    }[target]
+    return (
+        a.get("boardActive") == expected[0]
+        and a.get("boardUrl") == expected[1]
+        and a.get("indexRoute") == "portal/"
+        and a.get("defaultStyleId") == "4"
+        and addon.get("addon_id") == "Newfi/Portal"
+        and int(addon.get("version_id", 0)) == 1000010
+        and addon.get("version_string") == "1.0.0 Alpha 1"
+        and int(addon.get("active", 0)) == 1
+        and int(addon.get("is_processing", 1)) == 0
+    )
+
+
+def new_errors(target, baseline):
+    raw = qga(
+        target,
+        ["/usr/bin/php8.3"],
+        input_bytes=(ERRORS_PHP_TEMPLATE % int(baseline)).encode(),
+        timeout=90,
+    )
+    try:
+        return json.loads(raw)
+    except Exception:
+        fail("ERROR_LOG_JSON")
+
+
+def assert_no_new_errors(target, baseline, phase):
+    rows = new_errors(target, baseline)
+    if rows:
+        emit(
+            "PORTAL200_NEW_XF_ERRORS",
+            {
+                "target": target,
+                "phase": phase,
+                "count": len(rows),
+                "ids": [r.get("error_id") for r in rows],
+            },
+        )
+        fail("NEW_XF_ERRORS")
+
+
+def guest_backup(target):
+    script = f'''set -eu
+B={shlex.quote(BACKUP)}
+P=/var/www/forums/newfi/public/src/addons/Newfi/Portal
+test ! -e "$B"
+install -d -m 700 "$B/Pub/Controller" "$B/_data"
+cp -p -- "$P/Pub/Controller/Portal.php" "$B/Pub/Controller/Portal.php"
+cp -p -- "$P/_data/templates.xml" "$B/_data/templates.xml"
+test ! -e "$P/Service/PortalData.php"
+printf 'PORTAL200_BACKUP=PASS\n'
+'''
+    out = qga(target, ["/bin/bash", "-lc", script], timeout=90)
+    if "PORTAL200_BACKUP=PASS" not in out:
+        fail("BACKUP_FAILED")
+
+
+def guest_write(target, rel, data):
+    dest = f"/var/www/forums/newfi/public/src/addons/Newfi/Portal/{rel}"
+    parent = str(pathlib.PurePosixPath(dest).parent)
+    script = (
+        "set -eu; umask 022; "
+        + "install -d -m 755 "
+        + shlex.quote(parent)
+        + "; T=$(mktemp "
+        + shlex.quote(parent + "/.portal200.XXXXXX")
+        + "); cat >\"$T\"; chmod 0644 \"$T\"; chown root:root \"$T\"; "
+        + "mv -f -- \"$T\" "
+        + shlex.quote(dest)
+        + "; printf 'PORTAL200_WRITE=PASS\\n'"
+    )
+    out = qga(
+        target,
+        ["/bin/bash", "-lc", script],
+        input_bytes=data,
+        timeout=90,
+    )
+    if "PORTAL200_WRITE=PASS" not in out:
+        fail("WRITE_FAILED")
+
+
+def install_candidate(target):
+    for rel in [
+        "Pub/Controller/Portal.php",
+        "Service/PortalData.php",
+        "_data/templates.xml",
+    ]:
+        guest_write(target, rel, (CAND_ROOT / rel).read_bytes())
+
+
+def restore_old(target):
+    script = f'''set -eu
+B={shlex.quote(BACKUP)}
+P=/var/www/forums/newfi/public/src/addons/Newfi/Portal
+test -f "$B/Pub/Controller/Portal.php"
+test -f "$B/_data/templates.xml"
+cp -p -- "$B/Pub/Controller/Portal.php" "$P/Pub/Controller/Portal.php"
+cp -p -- "$B/_data/templates.xml" "$P/_data/templates.xml"
+rm -f -- "$P/Service/PortalData.php"
+rmdir -- "$P/Service" 2>/dev/null || true
+printf 'PORTAL200_SOURCE_RESTORE=PASS\n'
+'''
+    out = qga(target, ["/bin/bash", "-lc", script], timeout=90)
+    if "PORTAL200_SOURCE_RESTORE=PASS" not in out:
+        fail("SOURCE_RESTORE_FAILED")
+
+
+def import_addon(target):
+    out = qga(
+        target,
+        ["/usr/bin/php8.3"],
+        input_bytes=IMPORT_PHP.encode(),
+        timeout=240,
+    )
+    if "PORTAL200_IMPORT_JSON=" not in out:
+        fail("IMPORT_FAILED")
+
+
+def runtime_verify(target, state):
+    src = RUNTIME_VERIFY_PHP_TEMPLATE.replace("__STATE__", state)
+    out = qga(target, ["/usr/bin/php8.3"], input_bytes=src.encode(), timeout=120)
+    line = next(
+        (x for x in out.splitlines() if x.startswith("PORTAL200_RUNTIME_JSON=")),
+        None,
+    )
+    if not line:
+        fail("RUNTIME_MARKER_MISSING")
+    try:
+        data = json.loads(line.split("=", 1)[1])
+    except Exception:
+        fail("RUNTIME_JSON")
+    emit("PORTAL200_RUNTIME", {"target": target, **data})
+    return data
+
+
+def http_verify(target, state):
+    out = qga(
+        target,
+        ["/usr/bin/python3", "-", target, state],
+        input_bytes=HTTP_VERIFY_PY.encode(),
+        timeout=180,
+    )
+    line = next(
+        (x for x in out.splitlines() if x.startswith("PORTAL200_HTTP_JSON=")),
+        None,
+    )
+    if not line:
+        fail("HTTP_MARKER_MISSING")
+    try:
+        data = json.loads(line.split("=", 1)[1])
+    except Exception:
+        fail("HTTP_JSON")
+    emit("PORTAL200_HTTP", {"target": target, "state": state, **data})
+    return data
+
+
+def verify_new(target, baseline):
+    data = inspect(target)
+    if not app_contract(data, target):
+        fail("APP_CONTRACT_NEW")
+    if not source_is_new(data):
+        fail("SOURCE_NEW_MISMATCH")
+    if not template_state_new(data):
+        fail("TEMPLATE_NEW_MISMATCH")
+    runtime_verify(target, "new")
+    http_verify(target, "new")
+    assert_no_new_errors(target, baseline, "verify-new")
+    return inspect(target)
+
+
+def verify_old(target, baseline, old_templates, strict_errors=True):
+    data = inspect(target)
+    if not app_contract(data, target):
+        fail("APP_CONTRACT_OLD")
+    if not source_is_old(data):
+        fail("SOURCE_OLD_MISMATCH")
+    if data.get("templates") != old_templates:
+        fail("TEMPLATE_ROLLBACK_MISMATCH")
+    if target == "prod":
+        runtime_verify(target, "old")
+    http_verify(target, "old")
+    if strict_errors:
+        assert_no_new_errors(target, baseline, "verify-old")
+    return inspect(target)
+
+
+def lint_php(target, source, label):
+    out = qga(
+        target,
+        ["/usr/bin/php8.3", "-l"],
+        input_bytes=source.encode(),
+        timeout=90,
+    )
+    if "No syntax errors detected" not in out:
+        fail("PHP_LINT_" + label)
+
+
+def cluster_guard():
+    p = run(["/usr/sbin/qm", "status", "210"], timeout=30)
+    if "status: running" not in p.stdout.decode():
+        fail("VM210_NOT_RUNNING")
+    p = run(
+        [
+            "/usr/bin/ssh",
+            "-T",
+            "-o",
+            "BatchMode=yes",
+            "-o",
+            "StrictHostKeyChecking=yes",
+            "-o",
+            "UpdateHostKeys=no",
+            "-o",
+            "ConnectTimeout=10",
+            "root@pve03",
+            "/usr/sbin/qm status 211",
+        ],
+        timeout=40,
+    )
+    if "status: running" not in p.stdout.decode():
+        fail("VM211_NOT_RUNNING")
+    emit("PORTAL200_CLUSTER", "PASS")
+
+
+def result_contract(status, changes, rollback_started, rollback_restored):
+    emit(
+        "HOMELAB_RESULT_CONTRACT",
+        {
+            "version": 1,
+            "command_id": CID,
+            "status": status,
+            "changes_made": bool(changes),
+            "rollback_started": bool(rollback_started),
+            "rollback_restored": rollback_restored,
+        },
+    )
+
+
+emit("NEWFI200_BEGIN")
+emit("COMMAND_ID", CID)
+emit("PORTAL200_REMAINING_FULL_PRODUCT_COMMANDS_BEFORE", 22)
+emit(
+    "PORTAL200_FLOW",
+    "candidate->staging-apply->rollback-proof->staging-reapply->git-push->production",
+)
+
+staging_backup = False
+staging_mutated = False
+staging_final_new = False
+prod_backup = False
+prod_mutated = False
+git_files_changed = False
+commit_created = False
+push_confirmed = False
+failure_rollback_started = False
+failure_rollback_restored = None
+old_git_bytes = {}
+new_head = None
+s_error = None
+p_error = None
+s_old_templates = None
+p_old_templates = None
+
+try:
+    compile(HTTP_VERIFY_PY, "<portal200-http-verify>", "exec")
+    for rel, (size, sha) in EXPECTED_NEW.items():
+        p = CAND_ROOT / rel
+        if not p.is_file() or file_meta(p) != (size, sha):
+            fail("CANDIDATE_IDENTITY")
+    tree = ET.parse(CAND_ROOT / "_data/templates.xml")
+    titles = sorted(x.attrib.get("title") for x in tree.getroot().findall("template"))
+    if titles != ["newfi_portal", "newfi_portal.less"]:
+        fail("CANDIDATE_TEMPLATE_SET")
+    service = (CAND_ROOT / "Service/PortalData.php").read_text("utf-8")
+    if any(
+        token in service
+        for token in [
+            "\\XF::db(",
+            "->save(",
+            "->delete(",
+            "INSERT ",
+            "UPDATE ",
+            "DELETE ",
+            "REPLACE ",
+        ]
+    ):
+        fail("CANDIDATE_MUTATION_SCAN")
+    emit("PORTAL200_CANDIDATE_IDENTITY", "PASS")
+    emit("PORTAL200_ORCHESTRATION_FIXES", {"staging_503_without_css_links": True, "failure_status": "FAIL"})
+
+    branch = git("branch", "--show-current")
+    head = git("rev-parse", "HEAD")
+    status = git("status", "--porcelain=v1", "--untracked-files=all")
+    remote_out = git("ls-remote", "origin", f"refs/heads/{BRANCH}")
+    remote = remote_out.split()[0] if remote_out else ""
+    if branch != BRANCH or head != OLD_HEAD or remote != OLD_HEAD or status:
+        fail("GIT_PRESTATE")
+    emit(
+        "PORTAL200_GIT_PRESTATE",
+        {"branch": branch, "head": head, "remote": remote, "clean": True},
+    )
+    cluster_guard()
+
+    lint_php("staging", INSPECT_PHP, "INSPECT_STAGING")
+    lint_php("staging", IMPORT_PHP, "IMPORT_STAGING")
+    lint_php("staging", RUNTIME_VERIFY_PHP_TEMPLATE.replace("__STATE__", "new"), "RUNTIME_STAGING")
+    lint_php("prod", INSPECT_PHP, "INSPECT_PROD")
+    lint_php("prod", IMPORT_PHP, "IMPORT_PROD")
+    lint_php("prod", RUNTIME_VERIFY_PHP_TEMPLATE.replace("__STATE__", "new"), "RUNTIME_PROD")
+    emit("PORTAL200_RUNTIME_HELPER_LINT", "PASS")
+
+    s0 = inspect("staging")
+    p0 = inspect("prod")
+    if not app_contract(s0, "staging") or not app_contract(p0, "prod"):
+        fail("APP_PRESTATE")
+    if not source_is_old(s0) or not source_is_old(p0):
+        fail("SOURCE_PRESTATE")
+    if s0.get("templates") != p0.get("templates"):
+        fail("TEMPLATE_PRESTATE_PARITY")
+    s_error = int(s0["application"]["error_max_id"])
+    p_error = int(p0["application"]["error_max_id"])
+    s_old_templates = s0["templates"]
+    p_old_templates = p0["templates"]
+    emit("PORTAL200_ERROR_BASELINE", {"staging": s_error, "prod": p_error})
+    http_verify("staging", "old")
+    runtime_verify("prod", "old")
+    http_verify("prod", "old")
+    assert_no_new_errors("staging", s_error, "preflight")
+    assert_no_new_errors("prod", p_error, "preflight")
+    emit("PORTAL200_PREFLIGHT", "PASS")
+
+    guest_backup("staging")
+    staging_backup = True
+    staging_mutated = True
+    install_candidate("staging")
+    import_addon("staging")
+    verify_new("staging", s_error)
+    emit("PORTAL200_STAGING_FIRST_APPLY", "PASS")
+
+    restore_old("staging")
+    import_addon("staging")
+    verify_old("staging", s_error, s_old_templates)
+    staging_mutated = False
+    emit("PORTAL200_STAGING_ROLLBACK_PROOF", "PASS")
+
+    staging_mutated = True
+    install_candidate("staging")
+    import_addon("staging")
+    verify_new("staging", s_error)
+    staging_final_new = True
+    emit("PORTAL200_STAGING_FINAL", "PASS")
+
+    for rel in EXPECTED_NEW:
+        dest = GIT_PORTAL / rel
+        old_git_bytes[str(rel)] = dest.read_bytes() if dest.exists() else None
+        dest.parent.mkdir(parents=True, exist_ok=True)
+        shutil.copyfile(CAND_ROOT / rel, dest)
+    git_files_changed = True
+
+    if git("diff", "--check"):
+        fail("GIT_DIFF_CHECK")
+    status_lines = git("status", "--porcelain=v1", "--untracked-files=all").splitlines()
+    actual_paths = sorted(line[3:] for line in status_lines if len(line) >= 4)
+    if actual_paths != sorted(EXPECTED_GIT_PATHS):
+        fail("GIT_SCOPE")
+    git("add", "--", *EXPECTED_GIT_PATHS)
+    staged = sorted(x for x in git("diff", "--cached", "--name-only").splitlines() if x)
+    if staged != sorted(EXPECTED_GIT_PATHS):
+        fail("GIT_STAGED_SCOPE")
+    git("commit", "-m", f"feat: build data-backed Newfi portal [{CID}]")
+    commit_created = True
+    new_head = git("rev-parse", "HEAD")
+    if new_head == OLD_HEAD:
+        fail("GIT_COMMIT_HEAD")
+    if git("status", "--porcelain=v1", "--untracked-files=all"):
+        fail("GIT_POSTCOMMIT_DIRTY")
+    git("push", "origin", f"HEAD:refs/heads/{BRANCH}", timeout=180)
+    remote_out = git("ls-remote", "origin", f"refs/heads/{BRANCH}")
+    remote_head = remote_out.split()[0] if remote_out else ""
+    if remote_head != new_head:
+        fail("GIT_REMOTE_HEAD")
+    push_confirmed = True
+    emit(
+        "PORTAL200_GIT_PROMOTION",
+        {
+            "old_head": OLD_HEAD,
+            "new_head": new_head,
+            "remote_head": remote_head,
+            "result": "PASS",
+        },
+    )
+
+    p_pre = inspect("prod")
+    if not source_is_old(p_pre) or p_pre.get("templates") != p_old_templates:
+        fail("PROD_DRIFT_BEFORE_APPLY")
+    if int(p_pre["application"]["error_max_id"]) != p_error:
+        fail("PROD_ERROR_DRIFT")
+    guest_backup("prod")
+    prod_backup = True
+    prod_mutated = True
+    install_candidate("prod")
+    import_addon("prod")
+    verify_new("prod", p_error)
+    emit("PORTAL200_PRODUCTION", "PASS")
+
+    sf = verify_new("staging", s_error)
+    pf = verify_new("prod", p_error)
+    if sf["source"] != pf["source"]:
+        fail("FINAL_SOURCE_PARITY")
+    if sf["templates"] != pf["templates"]:
+        fail("FINAL_TEMPLATE_PARITY")
+    if git("rev-parse", "HEAD") != new_head:
+        fail("FINAL_LOCAL_HEAD")
+    remote_out = git("ls-remote", "origin", f"refs/heads/{BRANCH}")
+    if not remote_out or remote_out.split()[0] != new_head:
+        fail("FINAL_REMOTE_HEAD")
+    if git("status", "--porcelain=v1", "--untracked-files=all"):
+        fail("FINAL_GIT_DIRTY")
+    cluster_guard()
+    emit(
+        "PORTAL200_FINAL_EVIDENCE",
+        {
+            "commit": new_head,
+            "source_files": 3,
+            "templates": 2,
+            "staging_error_baseline": s_error,
+            "prod_error_baseline": p_error,
+        },
+    )
+    emit("PORTAL200_PORTAL", "PASS")
+    emit("PORTAL200_STAGING", "PASS")
+    emit("PORTAL200_PRODUCTION", "PASS")
+    emit("PORTAL200_REMAINING_FULL_PRODUCT_COMMANDS_AFTER_PASS", 21)
+    result_contract("OK", True, False, None)
+    emit("NEWFI200_END")
+    raise SystemExit(0)
+
+except PortalError as exc:
+    code = str(exc)
+    emit("PORTAL200_FAILURE", code)
+
+    if push_confirmed:
+        if prod_mutated and prod_backup:
+            failure_rollback_started = True
+            try:
+                restore_old("prod")
+                import_addon("prod")
+                verify_old("prod", p_error, p_old_templates, strict_errors=False)
+                prod_mutated = False
+                failure_rollback_restored = False
+                emit("PORTAL200_FAILURE_PROD_ROLLBACK", "PASS_PARTIAL_OVERALL_STATE_CHANGED")
+            except Exception:
+                failure_rollback_restored = False
+                emit("PORTAL200_FAILURE_PROD_ROLLBACK", "FAIL")
+    else:
+        if staging_mutated and staging_backup:
+            failure_rollback_started = True
+            try:
+                restore_old("staging")
+                import_addon("staging")
+                verify_old("staging", s_error, s_old_templates, strict_errors=False)
+                staging_mutated = False
+                staging_final_new = False
+                failure_rollback_restored = True
+                emit("PORTAL200_FAILURE_STAGING_ROLLBACK", "PASS")
+            except Exception:
+                failure_rollback_restored = False
+                emit("PORTAL200_FAILURE_STAGING_ROLLBACK", "FAIL")
+
+        if git_files_changed and not commit_created:
+            try:
+                for rel, old in old_git_bytes.items():
+                    dest = GIT_PORTAL / rel
+                    if old is None:
+                        if dest.exists():
+                            dest.unlink()
+                    else:
+                        dest.write_bytes(old)
+                service_dir = GIT_PORTAL / "Service"
+                try:
+                    service_dir.rmdir()
+                except OSError:
+                    pass
+                emit("PORTAL200_FAILURE_GIT_WORKTREE_RESTORE", "PASS")
+            except Exception:
+                emit("PORTAL200_FAILURE_GIT_WORKTREE_RESTORE", "FAIL")
+
+        if commit_created:
+            emit(
+                "PORTAL200_FAILURE_GIT_HISTORY",
+                "COMMIT_CREATED_NO_DESTRUCTIVE_RESET_FRESH_ID_REQUIRED",
+            )
+
+    persisted = bool(push_confirmed or commit_created or staging_final_new or prod_mutated)
+    if failure_rollback_started and failure_rollback_restored is None:
+        failure_rollback_restored = False
+    result_contract(
+        "FAIL",
+        persisted,
+        failure_rollback_started,
+        failure_rollback_restored,
+    )
+    emit("PORTAL200_ROADMAP_REMAINS", 22)
+    emit("NEWFI200_END")
+    raise SystemExit(1)
+
+except Exception:
+    emit("PORTAL200_FAILURE", "UNEXPECTED_EXCEPTION")
+    result_contract(
+        "FAIL",
+        bool(push_confirmed or commit_created or staging_final_new or prod_mutated),
+        False,
+        None,
+    )
+    emit("PORTAL200_ROADMAP_REMAINS", 22)
+    emit("NEWFI200_END")
+    raise SystemExit(1)
+
+CANDIDATE_LAYER_3_TEXT_END
+CANDIDATE_LAYER_4_SOURCE=file:newfi-38-portal200-apply.cmd::b64::zlib
+CANDIDATE_LAYER_4_SHA256=e9d137ac729d7513d8d9aa1d9fb509005aefaa7bfe03f5cb26b9896fb1310f62
+CANDIDATE_LAYER_4_BYTES=32448
+CANDIDATE_LAYER_4_TEXT_BEGIN
+import hashlib
+import json
+import pathlib
+import shlex
+import shutil
+import subprocess
+import sys
+import xml.etree.ElementTree as ET
+
+CID = "NEWFI-260907-PORTAL200-APPLY1"
+BRANCH = "implementation/newfi-closed-mvp-20260906"
+OLD_HEAD = "06bab5acd124e768f70305b3d7eca2f595871890"
+WT = pathlib.Path("/root/newfi-portal/.worktrees/implementation-newfi-closed-mvp-20260906")
+CAND_ROOT = pathlib.Path("/root/newfi-portal200-candidate/src/addons/Newfi/Portal")
+PORTAL_REL = pathlib.Path("src/addons/Newfi/Portal")
+GIT_PORTAL = WT / PORTAL_REL
+EXPECTED_NEW = {
+    "Pub/Controller/Portal.php": (363, "619d489f7cc3b461479c702fa8825097ae22d3c6cfeb911e9f14ea1de9c36d6d"),
+    "Service/PortalData.php": (5213, "4da03f26294ab6d163a1a746dee4bb6a82d7d4f39e66b24246bc0eb4c455dd1d"),
+    "_data/templates.xml": (10977, "1650c3d868d4bc47703f1b75f1f179cd25309b2d3b20a2b848e81a4423c00861"),
+}
+EXPECTED_OLD = {
+    "Pub/Controller/Portal.php": (247, "53909e753ea5a011550fd280ad1c342a74ca9949be092dfbd95244243cae92f3"),
+    "_data/templates.xml": (1461, "c29c04f8b937284e821c87957653e87c2f6ac014fac30648a0f6b18e84392adf"),
+}
+EXPECTED_GIT_PATHS = [str(PORTAL_REL / p) for p in sorted(EXPECTED_NEW)]
+BACKUP = f"/root/newfi-portal200-backup-{CID}"
+
+
+class PortalError(RuntimeError):
+    pass
+
+
+def emit(key, value=None):
+    if value is None:
+        print(key, flush=True)
+    elif isinstance(value, (dict, list, tuple, bool, int, float)):
+        print(
+            key + "=" + json.dumps(value, ensure_ascii=False, sort_keys=True, separators=(",", ":")),
+            flush=True,
+        )
+    else:
+        print(key + "=" + str(value), flush=True)
+
+
+def fail(code):
+    raise PortalError(code)
+
+
+def sha_bytes(data):
+    return hashlib.sha256(data).hexdigest()
+
+
+def file_meta(path):
+    data = pathlib.Path(path).read_bytes()
+    return len(data), sha_bytes(data)
+
+
+def run(cmd, *, input_bytes=None, timeout=180, ok=(0,)):
+    try:
+        p = subprocess.run(
+            cmd,
+            input=input_bytes,
+            stdout=subprocess.PIPE,
+            stderr=subprocess.PIPE,
+            timeout=timeout,
+            check=False,
+        )
+    except subprocess.TimeoutExpired:
+        fail("SUBPROCESS_TIMEOUT")
+    if p.returncode not in ok:
+        fail("SUBPROCESS_RC")
+    return p
+
+
+def git(*args, ok=(0,), timeout=120):
+    p = run(["/usr/bin/git", "-C", str(WT), *args], timeout=timeout, ok=ok)
+    return p.stdout.decode("utf-8", "replace").strip()
+
+
+def qga(target, argv, *, input_bytes=None, timeout=180):
+    if target == "prod":
+        cmd = [
+            "/usr/sbin/qm",
+            "guest",
+            "exec",
+            "210",
+            "--synchronous",
+            "1",
+            "--timeout",
+            str(timeout),
+        ]
+        if input_bytes is not None:
+            cmd += ["--pass-stdin", "1"]
+        cmd += ["--", *argv]
+    elif target == "staging":
+        q = [
+            "/usr/sbin/qm",
+            "guest",
+            "exec",
+            "211",
+            "--synchronous",
+            "1",
+            "--timeout",
+            str(timeout),
+        ]
+        if input_bytes is not None:
+            q += ["--pass-stdin", "1"]
+        q += ["--", *argv]
+        remote = (
+            "test \"$(id -u):$(hostname -s)\" = 0:pve03 || exit 72; "
+            "for f in /etc/pve/HOMELAB_ASSISTANT_ERROR_REGISTER.md /etc/pve/31_HOMELAB_REFERENCE.md; do "
+            "test -r \"$f\" && test -s \"$f\" && cat -- \"$f\" >/dev/null || exit 73; done; exec "
+            + " ".join(shlex.quote(x) for x in q)
+        )
+        cmd = [
+            "/usr/bin/ssh",
+            "-T",
+            "-o",
+            "BatchMode=yes",
+            "-o",
+            "StrictHostKeyChecking=yes",
+            "-o",
+            "UpdateHostKeys=no",
+            "-o",
+            "ConnectTimeout=10",
+            "-o",
+            "ConnectionAttempts=1",
+            "root@pve03",
+            remote,
+        ]
+    else:
+        fail("BAD_TARGET")
+
+    p = run(cmd, input_bytes=input_bytes, timeout=timeout + 30)
+    try:
+        data = json.loads(p.stdout.decode("utf-8"))
+    except Exception:
+        fail("QGA_JSON")
+    if data.get("exited") not in (1, True) or data.get("exitcode") != 0:
+        fail("QGA_GUEST_RC")
+    if data.get("out-truncated") or data.get("err-truncated"):
+        fail("QGA_TRUNCATED")
+    return data.get("out-data", "")
+
+
+INSPECT_PHP = r'''<?php
+$root = '/var/www/forums/newfi/public';
+require $root . '/src/XF.php';
+\XF::start($root);
+$app = \XF::setupApp('XF\\Pub\\App');
+$db = $app->db();
+function srcMeta(string $path): ?array {
+    if (!is_file($path)) { return null; }
+    return ['bytes' => filesize($path), 'sha256' => hash_file('sha256', $path)];
+}
+$portal = $root . '/src/addons/Newfi/Portal';
+$templates = $db->fetchAll(
+    "SELECT title, style_id, LENGTH(template) AS bytes, SHA2(template,256) AS sha256, " .
+    "LOCATE('data-newfi-portal200', template) > 0 AS html_marker, " .
+    "LOCATE('--newfi-portal200', template) > 0 AS css_marker " .
+    "FROM xf_template WHERE addon_id='Newfi/Portal' ORDER BY style_id,title"
+);
+$result = [
+ 'hostname' => gethostname(),
+ 'application' => [
+  'boardActive' => (string)$db->fetchOne("SELECT option_value FROM xf_option WHERE option_id='boardActive'"),
+  'boardUrl' => (string)$db->fetchOne("SELECT option_value FROM xf_option WHERE option_id='boardUrl'"),
+  'indexRoute' => (string)$db->fetchOne("SELECT option_value FROM xf_option WHERE option_id='indexRoute'"),
+  'defaultStyleId' => (string)$db->fetchOne("SELECT option_value FROM xf_option WHERE option_id='defaultStyleId'"),
+  'error_count' => (int)$db->fetchOne("SELECT COUNT(*) FROM xf_error_log"),
+  'error_max_id' => (int)$db->fetchOne("SELECT COALESCE(MAX(error_id),0) FROM xf_error_log")
+ ],
+ 'addon' => $db->fetchRow(
+  "SELECT addon_id,version_id,version_string,active,is_processing,last_pending_action " .
+  "FROM xf_addon WHERE addon_id='Newfi/Portal'"
+ ),
+ 'source' => [
+  'Pub/Controller/Portal.php' => srcMeta($portal . '/Pub/Controller/Portal.php'),
+  'Service/PortalData.php' => srcMeta($portal . '/Service/PortalData.php'),
+  '_data/templates.xml' => srcMeta($portal . '/_data/templates.xml')
+ ],
+ 'templates' => $templates
+];
+echo "PORTAL200_INSPECT_JSON_BEGIN\n";
+echo json_encode(
+    $result,
+    JSON_UNESCAPED_UNICODE|JSON_UNESCAPED_SLASHES|JSON_INVALID_UTF8_SUBSTITUTE
+);
+echo "\nPORTAL200_INSPECT_JSON_END\n";
+?>'''
+
+
+IMPORT_PHP = r'''<?php
+$root = '/var/www/forums/newfi/public';
+require $root . '/src/XF.php';
+\XF::start($root);
+$app = \XF::setupApp('XF\\Pub\\App');
+$addOn = $app->addOnManager()->getById('Newfi/Portal');
+if (!$addOn || !$addOn->isInstalled()) {
+    fwrite(STDERR, "ADDON_NOT_INSTALLED\n");
+    exit(30);
+}
+$addOn->preRebuild();
+$dataManager = $app->addOnDataManager();
+$imported = [];
+foreach ($dataManager->getDataTypeClasses() as $dataType) {
+    $handler = $dataManager->getDataTypeHandler($dataType);
+    $xml = $handler->openTypeFile($addOn->getDataDirectory());
+    if (!$xml || !$xml->count()) {
+        $handler->deleteAddOnData($addOn->addon_id);
+        continue;
+    }
+    $start = 0;
+    $guard = 0;
+    while (true) {
+        $last = $handler->importAddOnData($addOn->addon_id, $xml, $start, 0);
+        if (!$last) { break; }
+        if ($last <= $start || ++$guard > 100000) {
+            fwrite(STDERR, "IMPORT_PROGRESS_INVALID\n");
+            exit(31);
+        }
+        $start = $last;
+    }
+    $handler->deleteOrphanedAddOnData($addOn->addon_id, $xml);
+    \XF::triggerRunOnce();
+    $imported[] = $handler->getContainerTag();
+}
+$addOn->postDataImport();
+$repo = $app->repository(\XF\Repository\StyleRepository::class);
+$repo->updateAllStylesLastModifiedDateLater();
+$addOn->postRebuild();
+echo "PORTAL200_IMPORT_JSON=" . json_encode(
+    ['result'=>'PASS','containers'=>$imported],
+    JSON_UNESCAPED_SLASHES
+) . "\n";
+?>'''
+
+
+ERRORS_PHP_TEMPLATE = r'''<?php
+$root='/var/www/forums/newfi/public';
+require $root.'/src/XF.php';
+\XF::start($root);
+$app=\XF::setupApp('XF\\Pub\\App');
+$db=$app->db();
+$b=%d;
+$rows=$db->fetchAll(
+    "SELECT error_id,exception_type,message,filename,line FROM xf_error_log WHERE error_id>? ORDER BY error_id",
+    [$b]
+);
+echo json_encode(
+    $rows,
+    JSON_UNESCAPED_UNICODE|JSON_UNESCAPED_SLASHES|JSON_INVALID_UTF8_SUBSTITUTE
+);
+?>'''
+
+
+RUNTIME_VERIFY_PHP_TEMPLATE = r'''<?php
+$state = '__STATE__';
+$root = '/var/www/forums/newfi/public';
+require $root . '/src/XF.php';
+\XF::start($root);
+$app = \XF::setupApp('XF\\Pub\\App');
+$result = ['state'=>$state];
+if ($state === 'new') {
+    $service = new \Newfi\Portal\Service\PortalData($app);
+    $portal = $service->build();
+    $html = (string)$app->templater()->renderTemplate('public:newfi_portal', ['portal'=>$portal]);
+    $result['sections'] = [];
+    foreach (['forums','resources','media','events','dogs'] as $key) {
+        $section = $portal[$key] ?? null;
+        if (!is_array($section)) { fwrite(STDERR, "SECTION_MISSING\n"); exit(60); }
+        $result['sections'][$key] = [
+            'available'=>(bool)($section['available'] ?? false),
+            'hasItems'=>(bool)($section['hasItems'] ?? false),
+            'status'=>(string)($section['status'] ?? '')
+        ];
+    }
+    $result['html_marker'] = strpos($html, 'data-newfi-portal200="1"') !== false;
+    $result['locked_resources'] = strpos($html, 'data-portal-locked="resources"') !== false;
+    $result['locked_media'] = strpos($html, 'data-portal-locked="media"') !== false;
+    $result['html_bytes'] = strlen($html);
+    if (!$result['html_marker']) { fwrite(STDERR, "HTML_MARKER_MISSING\n"); exit(61); }
+    if ($result['sections']['resources']['available'] || $result['sections']['media']['available']) {
+        fwrite(STDERR, "GUEST_PERMISSION_CONTRACT_CHANGED\n"); exit(62);
+    }
+    if (!$result['locked_resources'] || !$result['locked_media']) {
+        fwrite(STDERR, "LOCKED_COPY_MISSING\n"); exit(63);
+    }
+    if (!$result['sections']['forums']['available'] || !$result['sections']['events']['available'] || !$result['sections']['dogs']['available']) {
+        fwrite(STDERR, "PUBLIC_SECTION_UNAVAILABLE\n"); exit(64);
+    }
+} else if ($state === 'old') {
+    $html = (string)$app->templater()->renderTemplate('public:newfi_portal', []);
+    $result['html_marker'] = strpos($html, 'data-newfi-portal200') !== false;
+    $result['old_copy'] = strpos($html, 'Закрытое пространство для общения, знаний и материалов сообщества.') !== false;
+    $result['html_bytes'] = strlen($html);
+    if ($result['html_marker'] || !$result['old_copy']) {
+        fwrite(STDERR, "OLD_RENDER_CONTRACT\n"); exit(65);
+    }
+} else {
+    exit(66);
+}
+echo "PORTAL200_RUNTIME_JSON=" . json_encode(
+    $result,
+    JSON_UNESCAPED_UNICODE|JSON_UNESCAPED_SLASHES|JSON_INVALID_UTF8_SUBSTITUTE
+) . "\n";
+?>'''
+
+
+HTTP_VERIFY_PY = r'''import html,json,re,subprocess,sys,urllib.parse
+mode=sys.argv[1]
+state=sys.argv[2]
+if mode=='staging':
+    host='newfi-staging.gram1.ru'; scheme='http'; port='80'; expected_status=503
+elif mode=='prod':
+    host='newfi.ru'; scheme='https'; port='443'; expected_status=200
+else:
+    raise SystemExit(40)
+def fetch(url):
+    cmd=[
+        '/usr/bin/curl','-sS','-k','--max-time','30','--connect-timeout','10',
+        '--resolve',f'{host}:{port}:127.0.0.1','-o','-','-w',
+        '\n__PORTAL_STATUS__%{http_code}',url
+    ]
+    p=subprocess.run(cmd,stdout=subprocess.PIPE,stderr=subprocess.PIPE,check=False)
+    if p.returncode!=0: raise SystemExit(41)
+    text=p.stdout.decode('utf-8','replace')
+    marker='\n__PORTAL_STATUS__'
+    if marker not in text: raise SystemExit(42)
+    body,status=text.rsplit(marker,1)
+    return int(status.strip()),body
+root=f'{scheme}://{host}/'
+status,body=fetch(root)
+hrefs=[]
+for raw in re.findall(r"href=[\"']([^\"']*css\\.php[^\"']*)[\"']",body,re.I):
+    raw=html.unescape(raw)
+    hrefs.append(urllib.parse.urljoin(root,raw))
+normal_css=[]
+normal_status=[]
+for u in hrefs:
+    s,b=fetch(u)
+    normal_status.append(s)
+    normal_css.append(b)
+normal_css_text='\n'.join(normal_css)
+forced_css_marker=None
+forced_css_status=None
+if mode=='staging' and state=='new':
+    if not hrefs: raise SystemExit(43)
+    u=urllib.parse.urlsplit(hrefs[0])
+    pairs=urllib.parse.parse_qsl(u.query,keep_blank_values=True)
+    out=[]
+    found=False
+    for k,v in pairs:
+        if k=='css':
+            found=True
+            parts=[x for x in v.split(',') if x]
+            if 'public:newfi_portal.less' not in parts:
+                parts.append('public:newfi_portal.less')
+            v=','.join(parts)
+        out.append((k,v))
+    if not found: raise SystemExit(44)
+    forced=urllib.parse.urlunsplit((u.scheme,u.netloc,u.path,urllib.parse.urlencode(out),u.fragment))
+    forced_css_status,forced_body=fetch(forced)
+    forced_css_marker='--newfi-portal200' in forced_body
+result={
+ 'status':status,
+ 'bytes':len(body.encode()),
+ 'html_marker':'data-newfi-portal200="1"' in body,
+ 'css_marker':'--newfi-portal200' in normal_css_text,
+ 'old_copy':'Закрытое пространство для общения, знаний и материалов сообщества.' in body,
+ 'css_count':len(hrefs),
+ 'css_status':normal_status,
+ 'forced_css_status':forced_css_status,
+ 'forced_css_marker':forced_css_marker,
+}
+print('PORTAL200_HTTP_JSON='+json.dumps(result,ensure_ascii=False,sort_keys=True,separators=(',',':')))
+if status!=expected_status: raise SystemExit(45)
+if not hrefs or any(x!=200 for x in normal_status): raise SystemExit(46)
+if mode=='prod' and state=='new':
+    if not result['html_marker'] or not result['css_marker']: raise SystemExit(47)
+elif mode=='prod' and state=='old':
+    if result['html_marker'] or result['css_marker'] or not result['old_copy']: raise SystemExit(48)
+elif mode=='staging' and state=='new':
+    if forced_css_status!=200 or not forced_css_marker: raise SystemExit(49)
+elif mode=='staging' and state=='old':
+    pass
+else:
+    raise SystemExit(50)
+'''
+
+
+def parse_inspect(text):
+    b = "PORTAL200_INSPECT_JSON_BEGIN\n"
+    e = "\nPORTAL200_INSPECT_JSON_END"
+    if b not in text or e not in text:
+        fail("INSPECT_MARKERS")
+    try:
+        return json.loads(text.split(b, 1)[1].split(e, 1)[0])
+    except Exception:
+        fail("INSPECT_JSON")
+
+
+def inspect(target):
+    return parse_inspect(
+        qga(target, ["/usr/bin/php8.3"], input_bytes=INSPECT_PHP.encode(), timeout=120)
+    )
+
+
+def source_is_old(data):
+    src = data["source"]
+    for rel, (size, sha) in EXPECTED_OLD.items():
+        row = src.get(rel)
+        if not row or row.get("bytes") != size or row.get("sha256") != sha:
+            return False
+    return src.get("Service/PortalData.php") is None
+
+
+def source_is_new(data):
+    src = data["source"]
+    for rel, (size, sha) in EXPECTED_NEW.items():
+        row = src.get(rel)
+        if not row or row.get("bytes") != size or row.get("sha256") != sha:
+            return False
+    return True
+
+
+def template_state_new(data):
+    rows = data.get("templates", [])
+    rows0 = [r for r in rows if int(r.get("style_id", -1)) == 0]
+    titles = [r.get("title") for r in rows0]
+    by = {r.get("title"): r for r in rows0}
+    return (
+        titles == ["newfi_portal", "newfi_portal.less"]
+        and int(by["newfi_portal"].get("html_marker", 0)) == 1
+        and int(by["newfi_portal.less"].get("css_marker", 0)) == 1
+    )
+
+
+def app_contract(data, target):
+    a = data.get("application", {})
+    addon = data.get("addon") or {}
+    expected = {
+        "staging": ("0", "http://newfi-staging.gram1.ru"),
+        "prod": ("1", "https://newfi.ru"),
+    }[target]
+    return (
+        a.get("boardActive") == expected[0]
+        and a.get("boardUrl") == expected[1]
+        and a.get("indexRoute") == "portal/"
+        and a.get("defaultStyleId") == "4"
+        and addon.get("addon_id") == "Newfi/Portal"
+        and int(addon.get("version_id", 0)) == 1000010
+        and addon.get("version_string") == "1.0.0 Alpha 1"
+        and int(addon.get("active", 0)) == 1
+        and int(addon.get("is_processing", 1)) == 0
+    )
+
+
+def new_errors(target, baseline):
+    raw = qga(
+        target,
+        ["/usr/bin/php8.3"],
+        input_bytes=(ERRORS_PHP_TEMPLATE % int(baseline)).encode(),
+        timeout=90,
+    )
+    try:
+        return json.loads(raw)
+    except Exception:
+        fail("ERROR_LOG_JSON")
+
+
+def assert_no_new_errors(target, baseline, phase):
+    rows = new_errors(target, baseline)
+    if rows:
+        emit(
+            "PORTAL200_NEW_XF_ERRORS",
+            {
+                "target": target,
+                "phase": phase,
+                "count": len(rows),
+                "ids": [r.get("error_id") for r in rows],
+            },
+        )
+        fail("NEW_XF_ERRORS")
+
+
+def guest_backup(target):
+    script = f'''set -eu
+B={shlex.quote(BACKUP)}
+P=/var/www/forums/newfi/public/src/addons/Newfi/Portal
+test ! -e "$B"
+install -d -m 700 "$B/Pub/Controller" "$B/_data"
+cp -p -- "$P/Pub/Controller/Portal.php" "$B/Pub/Controller/Portal.php"
+cp -p -- "$P/_data/templates.xml" "$B/_data/templates.xml"
+test ! -e "$P/Service/PortalData.php"
+printf 'PORTAL200_BACKUP=PASS\n'
+'''
+    out = qga(target, ["/bin/bash", "-lc", script], timeout=90)
+    if "PORTAL200_BACKUP=PASS" not in out:
+        fail("BACKUP_FAILED")
+
+
+def guest_write(target, rel, data):
+    dest = f"/var/www/forums/newfi/public/src/addons/Newfi/Portal/{rel}"
+    parent = str(pathlib.PurePosixPath(dest).parent)
+    script = (
+        "set -eu; umask 022; "
+        + "install -d -m 755 "
+        + shlex.quote(parent)
+        + "; T=$(mktemp "
+        + shlex.quote(parent + "/.portal200.XXXXXX")
+        + "); cat >\"$T\"; chmod 0644 \"$T\"; chown root:root \"$T\"; "
+        + "mv -f -- \"$T\" "
+        + shlex.quote(dest)
+        + "; printf 'PORTAL200_WRITE=PASS\\n'"
+    )
+    out = qga(
+        target,
+        ["/bin/bash", "-lc", script],
+        input_bytes=data,
+        timeout=90,
+    )
+    if "PORTAL200_WRITE=PASS" not in out:
+        fail("WRITE_FAILED")
+
+
+def install_candidate(target):
+    for rel in [
+        "Pub/Controller/Portal.php",
+        "Service/PortalData.php",
+        "_data/templates.xml",
+    ]:
+        guest_write(target, rel, (CAND_ROOT / rel).read_bytes())
+
+
+def restore_old(target):
+    script = f'''set -eu
+B={shlex.quote(BACKUP)}
+P=/var/www/forums/newfi/public/src/addons/Newfi/Portal
+test -f "$B/Pub/Controller/Portal.php"
+test -f "$B/_data/templates.xml"
+cp -p -- "$B/Pub/Controller/Portal.php" "$P/Pub/Controller/Portal.php"
+cp -p -- "$B/_data/templates.xml" "$P/_data/templates.xml"
+rm -f -- "$P/Service/PortalData.php"
+rmdir -- "$P/Service" 2>/dev/null || true
+printf 'PORTAL200_SOURCE_RESTORE=PASS\n'
+'''
+    out = qga(target, ["/bin/bash", "-lc", script], timeout=90)
+    if "PORTAL200_SOURCE_RESTORE=PASS" not in out:
+        fail("SOURCE_RESTORE_FAILED")
+
+
+def import_addon(target):
+    out = qga(
+        target,
+        ["/usr/bin/php8.3"],
+        input_bytes=IMPORT_PHP.encode(),
+        timeout=240,
+    )
+    if "PORTAL200_IMPORT_JSON=" not in out:
+        fail("IMPORT_FAILED")
+
+
+def runtime_verify(target, state):
+    src = RUNTIME_VERIFY_PHP_TEMPLATE.replace("__STATE__", state)
+    out = qga(target, ["/usr/bin/php8.3"], input_bytes=src.encode(), timeout=120)
+    line = next(
+        (x for x in out.splitlines() if x.startswith("PORTAL200_RUNTIME_JSON=")),
+        None,
+    )
+    if not line:
+        fail("RUNTIME_MARKER_MISSING")
+    try:
+        data = json.loads(line.split("=", 1)[1])
+    except Exception:
+        fail("RUNTIME_JSON")
+    emit("PORTAL200_RUNTIME", {"target": target, **data})
+    return data
+
+
+def http_verify(target, state):
+    out = qga(
+        target,
+        ["/usr/bin/python3", "-", target, state],
+        input_bytes=HTTP_VERIFY_PY.encode(),
+        timeout=180,
+    )
+    line = next(
+        (x for x in out.splitlines() if x.startswith("PORTAL200_HTTP_JSON=")),
+        None,
+    )
+    if not line:
+        fail("HTTP_MARKER_MISSING")
+    try:
+        data = json.loads(line.split("=", 1)[1])
+    except Exception:
+        fail("HTTP_JSON")
+    emit("PORTAL200_HTTP", {"target": target, "state": state, **data})
+    return data
+
+
+def verify_new(target, baseline):
+    data = inspect(target)
+    if not app_contract(data, target):
+        fail("APP_CONTRACT_NEW")
+    if not source_is_new(data):
+        fail("SOURCE_NEW_MISMATCH")
+    if not template_state_new(data):
+        fail("TEMPLATE_NEW_MISMATCH")
+    runtime_verify(target, "new")
+    http_verify(target, "new")
+    assert_no_new_errors(target, baseline, "verify-new")
+    return inspect(target)
+
+
+def verify_old(target, baseline, old_templates, strict_errors=True):
+    data = inspect(target)
+    if not app_contract(data, target):
+        fail("APP_CONTRACT_OLD")
+    if not source_is_old(data):
+        fail("SOURCE_OLD_MISMATCH")
+    if data.get("templates") != old_templates:
+        fail("TEMPLATE_ROLLBACK_MISMATCH")
+    if target == "prod":
+        runtime_verify(target, "old")
+    http_verify(target, "old")
+    if strict_errors:
+        assert_no_new_errors(target, baseline, "verify-old")
+    return inspect(target)
+
+
+def lint_php(target, source, label):
+    out = qga(
+        target,
+        ["/usr/bin/php8.3", "-l"],
+        input_bytes=source.encode(),
+        timeout=90,
+    )
+    if "No syntax errors detected" not in out:
+        fail("PHP_LINT_" + label)
+
+
+def cluster_guard():
+    p = run(["/usr/sbin/qm", "status", "210"], timeout=30)
+    if "status: running" not in p.stdout.decode():
+        fail("VM210_NOT_RUNNING")
+    p = run(
+        [
+            "/usr/bin/ssh",
+            "-T",
+            "-o",
+            "BatchMode=yes",
+            "-o",
+            "StrictHostKeyChecking=yes",
+            "-o",
+            "UpdateHostKeys=no",
+            "-o",
+            "ConnectTimeout=10",
+            "root@pve03",
+            "/usr/sbin/qm status 211",
+        ],
+        timeout=40,
+    )
+    if "status: running" not in p.stdout.decode():
+        fail("VM211_NOT_RUNNING")
+    emit("PORTAL200_CLUSTER", "PASS")
+
+
+def result_contract(status, changes, rollback_started, rollback_restored):
+    emit(
+        "HOMELAB_RESULT_CONTRACT",
+        {
+            "version": 1,
+            "command_id": CID,
+            "status": status,
+            "changes_made": bool(changes),
+            "rollback_started": bool(rollback_started),
+            "rollback_restored": rollback_restored,
+        },
+    )
+
+
+emit("NEWFI200_BEGIN")
+emit("COMMAND_ID", CID)
+emit("PORTAL200_REMAINING_FULL_PRODUCT_COMMANDS_BEFORE", 22)
+emit(
+    "PORTAL200_FLOW",
+    "candidate->staging-apply->rollback-proof->staging-reapply->git-push->production",
+)
+
+staging_backup = False
+staging_mutated = False
+staging_final_new = False
+prod_backup = False
+prod_mutated = False
+git_files_changed = False
+commit_created = False
+push_confirmed = False
+failure_rollback_started = False
+failure_rollback_restored = None
+old_git_bytes = {}
+new_head = None
+s_error = None
+p_error = None
+s_old_templates = None
+p_old_templates = None
+
+try:
+    compile(HTTP_VERIFY_PY, "<portal200-http-verify>", "exec")
+    for rel, (size, sha) in EXPECTED_NEW.items():
+        p = CAND_ROOT / rel
+        if not p.is_file() or file_meta(p) != (size, sha):
+            fail("CANDIDATE_IDENTITY")
+    tree = ET.parse(CAND_ROOT / "_data/templates.xml")
+    titles = sorted(x.attrib.get("title") for x in tree.getroot().findall("template"))
+    if titles != ["newfi_portal", "newfi_portal.less"]:
+        fail("CANDIDATE_TEMPLATE_SET")
+    service = (CAND_ROOT / "Service/PortalData.php").read_text("utf-8")
+    if any(
+        token in service
+        for token in [
+            "\\XF::db(",
+            "->save(",
+            "->delete(",
+            "INSERT ",
+            "UPDATE ",
+            "DELETE ",
+            "REPLACE ",
+        ]
+    ):
+        fail("CANDIDATE_MUTATION_SCAN")
+    emit("PORTAL200_CANDIDATE_IDENTITY", "PASS")
+
+    branch = git("branch", "--show-current")
+    head = git("rev-parse", "HEAD")
+    status = git("status", "--porcelain=v1", "--untracked-files=all")
+    remote_out = git("ls-remote", "origin", f"refs/heads/{BRANCH}")
+    remote = remote_out.split()[0] if remote_out else ""
+    if branch != BRANCH or head != OLD_HEAD or remote != OLD_HEAD or status:
+        fail("GIT_PRESTATE")
+    emit(
+        "PORTAL200_GIT_PRESTATE",
+        {"branch": branch, "head": head, "remote": remote, "clean": True},
+    )
+    cluster_guard()
+
+    lint_php("staging", INSPECT_PHP, "INSPECT_STAGING")
+    lint_php("staging", IMPORT_PHP, "IMPORT_STAGING")
+    lint_php("staging", RUNTIME_VERIFY_PHP_TEMPLATE.replace("__STATE__", "new"), "RUNTIME_STAGING")
+    lint_php("prod", INSPECT_PHP, "INSPECT_PROD")
+    lint_php("prod", IMPORT_PHP, "IMPORT_PROD")
+    lint_php("prod", RUNTIME_VERIFY_PHP_TEMPLATE.replace("__STATE__", "new"), "RUNTIME_PROD")
+    emit("PORTAL200_RUNTIME_HELPER_LINT", "PASS")
+
+    s0 = inspect("staging")
+    p0 = inspect("prod")
+    if not app_contract(s0, "staging") or not app_contract(p0, "prod"):
+        fail("APP_PRESTATE")
+    if not source_is_old(s0) or not source_is_old(p0):
+        fail("SOURCE_PRESTATE")
+    if s0.get("templates") != p0.get("templates"):
+        fail("TEMPLATE_PRESTATE_PARITY")
+    s_error = int(s0["application"]["error_max_id"])
+    p_error = int(p0["application"]["error_max_id"])
+    s_old_templates = s0["templates"]
+    p_old_templates = p0["templates"]
+    emit("PORTAL200_ERROR_BASELINE", {"staging": s_error, "prod": p_error})
+    http_verify("staging", "old")
+    runtime_verify("prod", "old")
+    http_verify("prod", "old")
+    assert_no_new_errors("staging", s_error, "preflight")
+    assert_no_new_errors("prod", p_error, "preflight")
+    emit("PORTAL200_PREFLIGHT", "PASS")
+
+    guest_backup("staging")
+    staging_backup = True
+    staging_mutated = True
+    install_candidate("staging")
+    import_addon("staging")
+    verify_new("staging", s_error)
+    emit("PORTAL200_STAGING_FIRST_APPLY", "PASS")
+
+    restore_old("staging")
+    import_addon("staging")
+    verify_old("staging", s_error, s_old_templates)
+    staging_mutated = False
+    emit("PORTAL200_STAGING_ROLLBACK_PROOF", "PASS")
+
+    staging_mutated = True
+    install_candidate("staging")
+    import_addon("staging")
+    verify_new("staging", s_error)
+    staging_final_new = True
+    emit("PORTAL200_STAGING_FINAL", "PASS")
+
+    for rel in EXPECTED_NEW:
+        dest = GIT_PORTAL / rel
+        old_git_bytes[str(rel)] = dest.read_bytes() if dest.exists() else None
+        dest.parent.mkdir(parents=True, exist_ok=True)
+        shutil.copyfile(CAND_ROOT / rel, dest)
+    git_files_changed = True
+
+    if git("diff", "--check"):
+        fail("GIT_DIFF_CHECK")
+    status_lines = git("status", "--porcelain=v1", "--untracked-files=all").splitlines()
+    actual_paths = sorted(line[3:] for line in status_lines if len(line) >= 4)
+    if actual_paths != sorted(EXPECTED_GIT_PATHS):
+        fail("GIT_SCOPE")
+    git("add", "--", *EXPECTED_GIT_PATHS)
+    staged = sorted(x for x in git("diff", "--cached", "--name-only").splitlines() if x)
+    if staged != sorted(EXPECTED_GIT_PATHS):
+        fail("GIT_STAGED_SCOPE")
+    git("commit", "-m", f"feat: build data-backed Newfi portal [{CID}]")
+    commit_created = True
+    new_head = git("rev-parse", "HEAD")
+    if new_head == OLD_HEAD:
+        fail("GIT_COMMIT_HEAD")
+    if git("status", "--porcelain=v1", "--untracked-files=all"):
+        fail("GIT_POSTCOMMIT_DIRTY")
+    git("push", "origin", f"HEAD:refs/heads/{BRANCH}", timeout=180)
+    remote_out = git("ls-remote", "origin", f"refs/heads/{BRANCH}")
+    remote_head = remote_out.split()[0] if remote_out else ""
+    if remote_head != new_head:
+        fail("GIT_REMOTE_HEAD")
+    push_confirmed = True
+    emit(
+        "PORTAL200_GIT_PROMOTION",
+        {
+            "old_head": OLD_HEAD,
+            "new_head": new_head,
+            "remote_head": remote_head,
+            "result": "PASS",
+        },
+    )
+
+    p_pre = inspect("prod")
+    if not source_is_old(p_pre) or p_pre.get("templates") != p_old_templates:
+        fail("PROD_DRIFT_BEFORE_APPLY")
+    if int(p_pre["application"]["error_max_id"]) != p_error:
+        fail("PROD_ERROR_DRIFT")
+    guest_backup("prod")
+    prod_backup = True
+    prod_mutated = True
+    install_candidate("prod")
+    import_addon("prod")
+    verify_new("prod", p_error)
+    emit("PORTAL200_PRODUCTION", "PASS")
+
+    sf = verify_new("staging", s_error)
+    pf = verify_new("prod", p_error)
+    if sf["source"] != pf["source"]:
+        fail("FINAL_SOURCE_PARITY")
+    if sf["templates"] != pf["templates"]:
+        fail("FINAL_TEMPLATE_PARITY")
+    if git("rev-parse", "HEAD") != new_head:
+        fail("FINAL_LOCAL_HEAD")
+    remote_out = git("ls-remote", "origin", f"refs/heads/{BRANCH}")
+    if not remote_out or remote_out.split()[0] != new_head:
+        fail("FINAL_REMOTE_HEAD")
+    if git("status", "--porcelain=v1", "--untracked-files=all"):
+        fail("FINAL_GIT_DIRTY")
+    cluster_guard()
+    emit(
+        "PORTAL200_FINAL_EVIDENCE",
+        {
+            "commit": new_head,
+            "source_files": 3,
+            "templates": 2,
+            "staging_error_baseline": s_error,
+            "prod_error_baseline": p_error,
+        },
+    )
+    emit("PORTAL200_PORTAL", "PASS")
+    emit("PORTAL200_STAGING", "PASS")
+    emit("PORTAL200_PRODUCTION", "PASS")
+    emit("PORTAL200_REMAINING_FULL_PRODUCT_COMMANDS_AFTER_PASS", 21)
+    result_contract("OK", True, False, None)
+    emit("NEWFI200_END")
+    raise SystemExit(0)
+
+except PortalError as exc:
+    code = str(exc)
+    emit("PORTAL200_FAILURE", code)
+
+    if push_confirmed:
+        if prod_mutated and prod_backup:
+            failure_rollback_started = True
+            try:
+                restore_old("prod")
+                import_addon("prod")
+                verify_old("prod", p_error, p_old_templates, strict_errors=False)
+                prod_mutated = False
+                failure_rollback_restored = False
+                emit("PORTAL200_FAILURE_PROD_ROLLBACK", "PASS_PARTIAL_OVERALL_STATE_CHANGED")
+            except Exception:
+                failure_rollback_restored = False
+                emit("PORTAL200_FAILURE_PROD_ROLLBACK", "FAIL")
+    else:
+        if staging_mutated and staging_backup:
+            failure_rollback_started = True
+            try:
+                restore_old("staging")
+                import_addon("staging")
+                verify_old("staging", s_error, s_old_templates, strict_errors=False)
+                staging_mutated = False
+                staging_final_new = False
+                failure_rollback_restored = True
+                emit("PORTAL200_FAILURE_STAGING_ROLLBACK", "PASS")
+            except Exception:
+                failure_rollback_restored = False
+                emit("PORTAL200_FAILURE_STAGING_ROLLBACK", "FAIL")
+
+        if git_files_changed and not commit_created:
+            try:
+                for rel, old in old_git_bytes.items():
+                    dest = GIT_PORTAL / rel
+                    if old is None:
+                        if dest.exists():
+                            dest.unlink()
+                    else:
+                        dest.write_bytes(old)
+                service_dir = GIT_PORTAL / "Service"
+                try:
+                    service_dir.rmdir()
+                except OSError:
+                    pass
+                emit("PORTAL200_FAILURE_GIT_WORKTREE_RESTORE", "PASS")
+            except Exception:
+                emit("PORTAL200_FAILURE_GIT_WORKTREE_RESTORE", "FAIL")
+
+        if commit_created:
+            emit(
+                "PORTAL200_FAILURE_GIT_HISTORY",
+                "COMMIT_CREATED_NO_DESTRUCTIVE_RESET_FRESH_ID_REQUIRED",
+            )
+
+    persisted = bool(push_confirmed or commit_created or staging_final_new or prod_mutated)
+    if failure_rollback_started and failure_rollback_restored is None:
+        failure_rollback_restored = False
+    result_contract(
+        "ERROR",
+        persisted,
+        failure_rollback_started,
+        failure_rollback_restored,
+    )
+    emit("PORTAL200_ROADMAP_REMAINS", 22)
+    emit("NEWFI200_END")
+    raise SystemExit(1)
+
+except Exception:
+    emit("PORTAL200_FAILURE", "UNEXPECTED_EXCEPTION")
+    result_contract(
+        "ERROR",
+        bool(push_confirmed or commit_created or staging_final_new or prod_mutated),
+        False,
+        None,
+    )
+    emit("PORTAL200_ROADMAP_REMAINS", 22)
+    emit("NEWFI200_END")
+    raise SystemExit(1)
+
+CANDIDATE_LAYER_4_TEXT_END
+CANDIDATE_LAYER_5_SOURCE=file:newfi-55-portal200-apply3-rca.cmd::b64::zlib
+CANDIDATE_LAYER_5_SHA256=8911318cd314572edf9c6343c09b4c83d283e946dd2398ea2e05722ac9bd44ac
+CANDIDATE_LAYER_5_BYTES=10641
+CANDIDATE_LAYER_5_TEXT_BEGIN
+import hashlib
+import json
+import pathlib
+import shlex
+import subprocess
+
+CID = "NEWFI-260907-PORTAL200-APPLY3RCA1"
+FAILED_CID = "NEWFI-260907-PORTAL200-APPLY3"
+WT = pathlib.Path("/root/newfi-portal/.worktrees/implementation-newfi-closed-mvp-20260906")
+BRANCH = "implementation/newfi-closed-mvp-20260906"
+OLD_HEAD = "06bab5acd124e768f70305b3d7eca2f595871890"
+FAILED_DIR = pathlib.Path("/root/newfi-run-" + FAILED_CID)
+WRAPPER = FAILED_DIR / "wrapper.log"
+
+OLD = {
+    "controller": "53909e753ea5a011550fd280ad1c342a74ca9949be092dfbd95244243cae92f3",
+    "templates_xml": "c29c04f8b937284e821c87957653e87c2f6ac014fac30648a0f6b18e84392adf",
+}
+NEW = {
+    "controller": "619d489f7cc3b461479c702fa8825097ae22d3c6cfeb911e9f14ea1de9c36d6d",
+    "service": "4da03f26294ab6d163a1a746dee4bb6a82d7d4f39e66b24246bc0eb4c455dd1d",
+    "templates_xml": "1650c3d868d4bc47703f1b75f1f179cd25309b2d3b20a2b848e81a4423c00861",
+}
+
+INSPECT = '<?php\n$root=\'/var/www/forums/newfi/public\';\nrequire $root.\'/src/XF.php\';\n\\XF::start($root);\n$app=\\XF::setupApp(\'XF\\\\Pub\\\\App\');\n$db=$app->db();\n\nfunction meta($p) {\n    if (!is_file($p)) { return null; }\n    return [\'bytes\'=>filesize($p),\'sha256\'=>hash_file(\'sha256\',$p)];\n}\n\n$portal=$root.\'/src/addons/Newfi/Portal\';\n$baseline=(gethostname()===\'newfi-staging\') ? 40 : 0;\n\n$templates=$db->fetchAll(\n    "SELECT title,style_id,LENGTH(template) AS bytes,SHA2(template,256) AS sha256," .\n    " LOCATE(\'data-newfi-portal200\',template)>0 AS html_marker," .\n    " LOCATE(\'--newfi-portal200\',template)>0 AS css_marker" .\n    " FROM xf_template WHERE addon_id=\'Newfi/Portal\' ORDER BY style_id,title"\n);\n\n$errors=$db->fetchAll(\n    "SELECT error_id,exception_type,message,filename,line" .\n    " FROM xf_error_log WHERE error_id>? ORDER BY error_id LIMIT 30",\n    [$baseline]\n);\n\n$result=[\n    \'hostname\'=>gethostname(),\n    \'application\'=>[\n        \'boardActive\'=>(string)$db->fetchOne("SELECT option_value FROM xf_option WHERE option_id=\'boardActive\'"),\n        \'boardUrl\'=>(string)$db->fetchOne("SELECT option_value FROM xf_option WHERE option_id=\'boardUrl\'"),\n        \'indexRoute\'=>(string)$db->fetchOne("SELECT option_value FROM xf_option WHERE option_id=\'indexRoute\'"),\n        \'error_count\'=>(int)$db->fetchOne("SELECT COUNT(*) FROM xf_error_log"),\n        \'error_max_id\'=>(int)$db->fetchOne("SELECT COALESCE(MAX(error_id),0) FROM xf_error_log")\n    ],\n    \'source\'=>[\n        \'controller\'=>meta($portal.\'/Pub/Controller/Portal.php\'),\n        \'service\'=>meta($portal.\'/Service/PortalData.php\'),\n        \'templates_xml\'=>meta($portal.\'/_data/templates.xml\')\n    ],\n    \'templates\'=>$templates,\n    \'new_errors\'=>$errors\n];\n\necho "PORTAL200_RCA_GUEST_JSON=" .\n    json_encode($result,JSON_UNESCAPED_UNICODE|JSON_UNESCAPED_SLASHES|JSON_INVALID_UTF8_SUBSTITUTE) .\n    "\\n";\n?>'
+
+def emit(k, v=None):
+    if v is None:
+        print(k, flush=True)
+    elif isinstance(v, (dict, list, bool, int, float)):
+        print(k + "=" + json.dumps(v, ensure_ascii=False, sort_keys=True, separators=(",", ":")), flush=True)
+    else:
+        print(k + "=" + str(v), flush=True)
+
+def run(cmd, *, input_bytes=None, timeout=120):
+    return subprocess.run(
+        cmd, input=input_bytes, stdout=subprocess.PIPE, stderr=subprocess.PIPE,
+        timeout=timeout, check=False
+    )
+
+def git(*args):
+    p = run(["/usr/bin/git", "-C", str(WT), *args], timeout=90)
+    return p.returncode, p.stdout.decode("utf-8", "replace").strip(), p.stderr.decode("utf-8", "replace").strip()
+
+def qga(target, php_source):
+    if target == "prod":
+        cmd = [
+            "/usr/sbin/qm", "guest", "exec", "210",
+            "--synchronous", "1", "--timeout", "120",
+            "--pass-stdin", "1", "--", "/usr/bin/php8.3"
+        ]
+    else:
+        q = [
+            "/usr/sbin/qm", "guest", "exec", "211",
+            "--synchronous", "1", "--timeout", "120",
+            "--pass-stdin", "1", "--", "/usr/bin/php8.3"
+        ]
+        remote = (
+            "test \"$(id -u):$(hostname -s)\" = 0:pve03 || exit 72; "
+            "for f in /etc/pve/HOMELAB_ASSISTANT_ERROR_REGISTER.md /etc/pve/31_HOMELAB_REFERENCE.md; do "
+            "test -r \"$f\" && test -s \"$f\" && cat -- \"$f\" >/dev/null || exit 73; done; exec "
+            + " ".join(shlex.quote(x) for x in q)
+        )
+        cmd = [
+            "/usr/bin/ssh", "-T",
+            "-o", "BatchMode=yes",
+            "-o", "StrictHostKeyChecking=yes",
+            "-o", "UpdateHostKeys=no",
+            "-o", "ConnectTimeout=10",
+            "-o", "ConnectionAttempts=1",
+            "root@pve03", remote
+        ]
+    p = run(cmd, input_bytes=php_source.encode("utf-8"), timeout=150)
+    if p.returncode != 0:
+        return {"transport_rc": p.returncode, "transport_error": p.stderr.decode("utf-8", "replace")[:500]}
+    try:
+        outer = json.loads(p.stdout.decode("utf-8", "replace"))
+    except Exception:
+        return {"transport_rc": 0, "outer_json": False, "raw": p.stdout.decode("utf-8", "replace")[:1000]}
+    if outer.get("exitcode") != 0:
+        return {
+            "transport_rc": 0,
+            "guest_rc": outer.get("exitcode"),
+            "guest_out": outer.get("out-data", "")[:1000],
+            "guest_err": outer.get("err-data", "")[:1000],
+        }
+    out = outer.get("out-data", "")
+    marker = "PORTAL200_RCA_GUEST_JSON="
+    line = next((x for x in out.splitlines() if x.startswith(marker)), None)
+    if not line:
+        return {"transport_rc": 0, "guest_rc": 0, "marker": False, "guest_out": out[:1000]}
+    return json.loads(line[len(marker):])
+
+def source_state(data):
+    src = data.get("source", {})
+    controller = (src.get("controller") or {}).get("sha256")
+    service = src.get("service")
+    templates = (src.get("templates_xml") or {}).get("sha256")
+    if controller == OLD["controller"] and service is None and templates == OLD["templates_xml"]:
+        return "OLD"
+    if (
+        controller == NEW["controller"]
+        and (service or {}).get("sha256") == NEW["service"]
+        and templates == NEW["templates_xml"]
+    ):
+        return "NEW"
+    return "DRIFT"
+
+def template_state(data):
+    rows = data.get("templates", [])
+    titles = [r.get("title") for r in rows]
+    has_html = any(bool(r.get("html_marker")) for r in rows)
+    has_css = any(bool(r.get("css_marker")) for r in rows)
+    if titles == ["newfi_portal"] and not has_html and not has_css:
+        return "OLD"
+    if titles == ["newfi_portal", "newfi_portal.less"] and has_html and has_css:
+        return "NEW"
+    return "DRIFT"
+
+emit("NEWFI55_BEGIN")
+emit("COMMAND_ID", CID)
+emit("RCA_TARGET_FAILED_COMMAND", FAILED_CID)
+emit("PORTAL200_ROADMAP_REMAINS", 22)
+emit("RCA_MUTATION_SCOPE", "NONE_READ_ONLY")
+
+if WRAPPER.is_file() and not WRAPPER.is_symlink():
+    raw = WRAPPER.read_bytes()
+    emit("RCA_WRAPPER_BYTES", len(raw))
+    emit("RCA_WRAPPER_SHA256", hashlib.sha256(raw).hexdigest())
+    text = raw.decode("utf-8", "replace")
+    keep_prefixes = (
+        "CHAT_OUTPUT_BEGIN", "CHAT_OUTPUT_END", "COMMAND_ID=", "STATUS=", "RC=",
+        "RESULT_CONTRACT_", "COMMAND_RC=", "CHANGES_MADE=", "ROLLBACK_",
+        "MUTATION_OUTCOME=", "OUTPUT_BEGIN", "OUTPUT_END", "NEWFI200",
+        "PORTAL200_", "HOMELAB_RESULT_CONTRACT=", "STOP=", "Traceback",
+    )
+    selected = [line for line in text.splitlines() if line.startswith(keep_prefixes)]
+    emit("RCA_WRAPPER_SELECTED_LINE_COUNT", len(selected))
+    print("RCA_WRAPPER_SELECTED_BEGIN", flush=True)
+    for line in selected[-250:]:
+        print(line, flush=True)
+    print("RCA_WRAPPER_SELECTED_END", flush=True)
+else:
+    emit("RCA_WRAPPER_MISSING", True)
+
+_, branch, _ = git("branch", "--show-current")
+_, head, _ = git("rev-parse", "HEAD")
+_, remote_out, _ = git("ls-remote", "origin", f"refs/heads/{BRANCH}")
+_, status, _ = git("status", "--porcelain=v1", "--untracked-files=all")
+remote = remote_out.split()[0] if remote_out else ""
+
+git_state = {
+    "branch": branch,
+    "head": head,
+    "remote": remote,
+    "clean": (status == ""),
+    "status_lines": status.splitlines()[:20],
+}
+emit("RCA_GIT_STATE", git_state)
+
+staging = qga("staging", INSPECT)
+prod = qga("prod", INSPECT)
+
+emit("RCA_STAGING_STATE", staging)
+emit("RCA_PROD_STATE", prod)
+
+s_src = source_state(staging) if isinstance(staging, dict) else "UNKNOWN"
+p_src = source_state(prod) if isinstance(prod, dict) else "UNKNOWN"
+s_tpl = template_state(staging) if isinstance(staging, dict) else "UNKNOWN"
+p_tpl = template_state(prod) if isinstance(prod, dict) else "UNKNOWN"
+
+summary = {
+    "git_old_head": head == OLD_HEAD and remote == OLD_HEAD,
+    "git_clean": status == "",
+    "staging_source": s_src,
+    "staging_templates": s_tpl,
+    "staging_error_max": staging.get("application", {}).get("error_max_id") if isinstance(staging, dict) else None,
+    "prod_source": p_src,
+    "prod_templates": p_tpl,
+    "prod_error_max": prod.get("application", {}).get("error_max_id") if isinstance(prod, dict) else None,
+}
+summary["clean_old_prestate"] = bool(
+    summary["git_old_head"]
+    and summary["git_clean"]
+    and s_src == "OLD"
+    and s_tpl == "OLD"
+    and p_src == "OLD"
+    and p_tpl == "OLD"
+)
+emit("RCA_STATE_SUMMARY", summary)
+
+runner_path = pathlib.Path("/usr/local/sbin/homelab-chat-run")
+if runner_path.is_file() and not runner_path.is_symlink():
+    runner_bytes = runner_path.read_bytes()
+    runner_text = runner_bytes.decode("utf-8", "replace")
+    emit("RCA_RUNNER_SHA256", hashlib.sha256(runner_bytes).hexdigest())
+    emit("RCA_RUNNER_BYTES", len(runner_bytes))
+    lines = runner_text.splitlines()
+    terms = (
+        "HOMELAB_RESULT_CONTRACT",
+        "rollback_restored",
+        "rollback_started",
+        "changes_made",
+        "status not in",
+        "ValueError",
+    )
+    indexes = set()
+    for i, line in enumerate(lines):
+        if any(t in line for t in terms):
+            for j in range(max(0, i - 3), min(len(lines), i + 4)):
+                indexes.add(j)
+    print("RCA_RUNNER_CONTRACT_SOURCE_BEGIN", flush=True)
+    for j in sorted(indexes):
+        line = lines[j]
+        if len(line) > 500:
+            line = line[:500] + "...[TRUNCATED]"
+        print(json.dumps({"line": j + 1, "text": line}, ensure_ascii=False, separators=(",", ":")), flush=True)
+    print("RCA_RUNNER_CONTRACT_SOURCE_END", flush=True)
+else:
+    emit("RCA_RUNNER_SOURCE_MISSING", True)
+
+emit("HOMELAB_RESULT_CONTRACT", {
+    "version": 1,
+    "command_id": CID,
+    "status": "OK",
+    "changes_made": False,
+    "rollback_started": False,
+    "rollback_restored": None
+})
+emit("NEWFI55_END")
+
+CANDIDATE_LAYER_5_TEXT_END
+CANDIDATE_LAYER_6_SOURCE=file:newfi-39-portal200-rca1.cmd::b64::zlib
+CANDIDATE_LAYER_6_SHA256=08edd716820df9797dc01cbee765750d9924fc4f94855fde4aba2c25eacb76f2
+CANDIDATE_LAYER_6_BYTES=9466
+CANDIDATE_LAYER_6_TEXT_BEGIN
+import hashlib
+import json
+import pathlib
+import shlex
+import subprocess
+
+CID = "NEWFI-260907-PORTAL200-RCA1"
+FAILED_CID = "NEWFI-260907-PORTAL200-APPLY1"
+WT = pathlib.Path("/root/newfi-portal/.worktrees/implementation-newfi-closed-mvp-20260906")
+BRANCH = "implementation/newfi-closed-mvp-20260906"
+OLD_HEAD = "06bab5acd124e768f70305b3d7eca2f595871890"
+FAILED_DIR = pathlib.Path("/root/newfi-run-" + FAILED_CID)
+WRAPPER = FAILED_DIR / "wrapper.log"
+
+OLD = {
+    "controller": "53909e753ea5a011550fd280ad1c342a74ca9949be092dfbd95244243cae92f3",
+    "templates_xml": "c29c04f8b937284e821c87957653e87c2f6ac014fac30648a0f6b18e84392adf",
+}
+NEW = {
+    "controller": "619d489f7cc3b461479c702fa8825097ae22d3c6cfeb911e9f14ea1de9c36d6d",
+    "service": "4da03f26294ab6d163a1a746dee4bb6a82d7d4f39e66b24246bc0eb4c455dd1d",
+    "templates_xml": "1650c3d868d4bc47703f1b75f1f179cd25309b2d3b20a2b848e81a4423c00861",
+}
+
+INSPECT = '<?php\n$root=\'/var/www/forums/newfi/public\';\nrequire $root.\'/src/XF.php\';\n\\XF::start($root);\n$app=\\XF::setupApp(\'XF\\\\Pub\\\\App\');\n$db=$app->db();\n\nfunction meta($p) {\n    if (!is_file($p)) { return null; }\n    return [\'bytes\'=>filesize($p),\'sha256\'=>hash_file(\'sha256\',$p)];\n}\n\n$portal=$root.\'/src/addons/Newfi/Portal\';\n$baseline=(gethostname()===\'newfi-staging\') ? 40 : 0;\n\n$templates=$db->fetchAll(\n    "SELECT title,style_id,LENGTH(template) AS bytes,SHA2(template,256) AS sha256," .\n    " LOCATE(\'data-newfi-portal200\',template)>0 AS html_marker," .\n    " LOCATE(\'--newfi-portal200\',template)>0 AS css_marker" .\n    " FROM xf_template WHERE addon_id=\'Newfi/Portal\' ORDER BY style_id,title"\n);\n\n$errors=$db->fetchAll(\n    "SELECT error_id,exception_type,message,filename,line" .\n    " FROM xf_error_log WHERE error_id>? ORDER BY error_id LIMIT 30",\n    [$baseline]\n);\n\n$result=[\n    \'hostname\'=>gethostname(),\n    \'application\'=>[\n        \'boardActive\'=>(string)$db->fetchOne("SELECT option_value FROM xf_option WHERE option_id=\'boardActive\'"),\n        \'boardUrl\'=>(string)$db->fetchOne("SELECT option_value FROM xf_option WHERE option_id=\'boardUrl\'"),\n        \'indexRoute\'=>(string)$db->fetchOne("SELECT option_value FROM xf_option WHERE option_id=\'indexRoute\'"),\n        \'error_count\'=>(int)$db->fetchOne("SELECT COUNT(*) FROM xf_error_log"),\n        \'error_max_id\'=>(int)$db->fetchOne("SELECT COALESCE(MAX(error_id),0) FROM xf_error_log")\n    ],\n    \'source\'=>[\n        \'controller\'=>meta($portal.\'/Pub/Controller/Portal.php\'),\n        \'service\'=>meta($portal.\'/Service/PortalData.php\'),\n        \'templates_xml\'=>meta($portal.\'/_data/templates.xml\')\n    ],\n    \'templates\'=>$templates,\n    \'new_errors\'=>$errors\n];\n\necho "PORTAL200_RCA_GUEST_JSON=" .\n    json_encode($result,JSON_UNESCAPED_UNICODE|JSON_UNESCAPED_SLASHES|JSON_INVALID_UTF8_SUBSTITUTE) .\n    "\\n";\n?>'
+
+def emit(k, v=None):
+    if v is None:
+        print(k, flush=True)
+    elif isinstance(v, (dict, list, bool, int, float)):
+        print(k + "=" + json.dumps(v, ensure_ascii=False, sort_keys=True, separators=(",", ":")), flush=True)
+    else:
+        print(k + "=" + str(v), flush=True)
+
+def run(cmd, *, input_bytes=None, timeout=120):
+    return subprocess.run(
+        cmd, input=input_bytes, stdout=subprocess.PIPE, stderr=subprocess.PIPE,
+        timeout=timeout, check=False
+    )
+
+def git(*args):
+    p = run(["/usr/bin/git", "-C", str(WT), *args], timeout=90)
+    return p.returncode, p.stdout.decode("utf-8", "replace").strip(), p.stderr.decode("utf-8", "replace").strip()
+
+def qga(target, php_source):
+    if target == "prod":
+        cmd = [
+            "/usr/sbin/qm", "guest", "exec", "210",
+            "--synchronous", "1", "--timeout", "120",
+            "--pass-stdin", "1", "--", "/usr/bin/php8.3"
+        ]
+    else:
+        q = [
+            "/usr/sbin/qm", "guest", "exec", "211",
+            "--synchronous", "1", "--timeout", "120",
+            "--pass-stdin", "1", "--", "/usr/bin/php8.3"
+        ]
+        remote = (
+            "test \"$(id -u):$(hostname -s)\" = 0:pve03 || exit 72; "
+            "for f in /etc/pve/HOMELAB_ASSISTANT_ERROR_REGISTER.md /etc/pve/31_HOMELAB_REFERENCE.md; do "
+            "test -r \"$f\" && test -s \"$f\" && cat -- \"$f\" >/dev/null || exit 73; done; exec "
+            + " ".join(shlex.quote(x) for x in q)
+        )
+        cmd = [
+            "/usr/bin/ssh", "-T",
+            "-o", "BatchMode=yes",
+            "-o", "StrictHostKeyChecking=yes",
+            "-o", "UpdateHostKeys=no",
+            "-o", "ConnectTimeout=10",
+            "-o", "ConnectionAttempts=1",
+            "root@pve03", remote
+        ]
+    p = run(cmd, input_bytes=php_source.encode("utf-8"), timeout=150)
+    if p.returncode != 0:
+        return {"transport_rc": p.returncode, "transport_error": p.stderr.decode("utf-8", "replace")[:500]}
+    try:
+        outer = json.loads(p.stdout.decode("utf-8", "replace"))
+    except Exception:
+        return {"transport_rc": 0, "outer_json": False, "raw": p.stdout.decode("utf-8", "replace")[:1000]}
+    if outer.get("exitcode") != 0:
+        return {
+            "transport_rc": 0,
+            "guest_rc": outer.get("exitcode"),
+            "guest_out": outer.get("out-data", "")[:1000],
+            "guest_err": outer.get("err-data", "")[:1000],
+        }
+    out = outer.get("out-data", "")
+    marker = "PORTAL200_RCA_GUEST_JSON="
+    line = next((x for x in out.splitlines() if x.startswith(marker)), None)
+    if not line:
+        return {"transport_rc": 0, "guest_rc": 0, "marker": False, "guest_out": out[:1000]}
+    return json.loads(line[len(marker):])
+
+def source_state(data):
+    src = data.get("source", {})
+    controller = (src.get("controller") or {}).get("sha256")
+    service = src.get("service")
+    templates = (src.get("templates_xml") or {}).get("sha256")
+    if controller == OLD["controller"] and service is None and templates == OLD["templates_xml"]:
+        return "OLD"
+    if (
+        controller == NEW["controller"]
+        and (service or {}).get("sha256") == NEW["service"]
+        and templates == NEW["templates_xml"]
+    ):
+        return "NEW"
+    return "DRIFT"
+
+def template_state(data):
+    rows = data.get("templates", [])
+    titles = [r.get("title") for r in rows]
+    has_html = any(bool(r.get("html_marker")) for r in rows)
+    has_css = any(bool(r.get("css_marker")) for r in rows)
+    if titles == ["newfi_portal"] and not has_html and not has_css:
+        return "OLD"
+    if titles == ["newfi_portal", "newfi_portal.less"] and has_html and has_css:
+        return "NEW"
+    return "DRIFT"
+
+emit("NEWFI39_BEGIN")
+emit("COMMAND_ID", CID)
+emit("RCA_TARGET_FAILED_COMMAND", FAILED_CID)
+emit("PORTAL200_ROADMAP_REMAINS", 22)
+emit("RCA_MUTATION_SCOPE", "NONE_READ_ONLY")
+
+if WRAPPER.is_file() and not WRAPPER.is_symlink():
+    raw = WRAPPER.read_bytes()
+    emit("RCA_WRAPPER_BYTES", len(raw))
+    emit("RCA_WRAPPER_SHA256", hashlib.sha256(raw).hexdigest())
+    text = raw.decode("utf-8", "replace")
+    keep_prefixes = (
+        "CHAT_OUTPUT_BEGIN", "CHAT_OUTPUT_END", "COMMAND_ID=", "STATUS=", "RC=",
+        "RESULT_CONTRACT_", "COMMAND_RC=", "CHANGES_MADE=", "ROLLBACK_",
+        "MUTATION_OUTCOME=", "OUTPUT_BEGIN", "OUTPUT_END", "NEWFI200",
+        "PORTAL200_", "HOMELAB_RESULT_CONTRACT=", "STOP=", "Traceback",
+    )
+    selected = [line for line in text.splitlines() if line.startswith(keep_prefixes)]
+    emit("RCA_WRAPPER_SELECTED_LINE_COUNT", len(selected))
+    print("RCA_WRAPPER_SELECTED_BEGIN", flush=True)
+    for line in selected[-250:]:
+        print(line, flush=True)
+    print("RCA_WRAPPER_SELECTED_END", flush=True)
+else:
+    emit("RCA_WRAPPER_MISSING", True)
+
+_, branch, _ = git("branch", "--show-current")
+_, head, _ = git("rev-parse", "HEAD")
+_, remote_out, _ = git("ls-remote", "origin", f"refs/heads/{BRANCH}")
+_, status, _ = git("status", "--porcelain=v1", "--untracked-files=all")
+remote = remote_out.split()[0] if remote_out else ""
+
+git_state = {
+    "branch": branch,
+    "head": head,
+    "remote": remote,
+    "clean": (status == ""),
+    "status_lines": status.splitlines()[:20],
+}
+emit("RCA_GIT_STATE", git_state)
+
+staging = qga("staging", INSPECT)
+prod = qga("prod", INSPECT)
+
+emit("RCA_STAGING_STATE", staging)
+emit("RCA_PROD_STATE", prod)
+
+s_src = source_state(staging) if isinstance(staging, dict) else "UNKNOWN"
+p_src = source_state(prod) if isinstance(prod, dict) else "UNKNOWN"
+s_tpl = template_state(staging) if isinstance(staging, dict) else "UNKNOWN"
+p_tpl = template_state(prod) if isinstance(prod, dict) else "UNKNOWN"
+
+summary = {
+    "git_old_head": head == OLD_HEAD and remote == OLD_HEAD,
+    "git_clean": status == "",
+    "staging_source": s_src,
+    "staging_templates": s_tpl,
+    "staging_error_max": staging.get("application", {}).get("error_max_id") if isinstance(staging, dict) else None,
+    "prod_source": p_src,
+    "prod_templates": p_tpl,
+    "prod_error_max": prod.get("application", {}).get("error_max_id") if isinstance(prod, dict) else None,
+}
+summary["clean_old_prestate"] = bool(
+    summary["git_old_head"]
+    and summary["git_clean"]
+    and s_src == "OLD"
+    and s_tpl == "OLD"
+    and p_src == "OLD"
+    and p_tpl == "OLD"
+)
+emit("RCA_STATE_SUMMARY", summary)
+
+emit("HOMELAB_RESULT_CONTRACT", {
+    "version": 1,
+    "command_id": CID,
+    "status": "OK",
+    "changes_made": False,
+    "rollback_started": False,
+    "rollback_restored": None
+})
+emit("NEWFI39_END")
+
+CANDIDATE_LAYER_6_TEXT_END
+RECOVERED_VERSION_IDS=
+RECOVERED_VERSION_STRINGS==
+RECOVERED_SHA256_COUNT=11
+RECOVERED_SHA256=458c2cf0763e4790f7d2d3757efd883b25813a31aab4e8dce6f785b8dea48a6e,834973af57263b326ca6aee52b2ecb3fa2cf0fb486e5a77a62d4210395b8d9c3,28e855ff56c4844768f0e8606fe0edc2acb3f548a5c06fa15c0d80ae00e2bc1b,fc9fb1dbdb6141bfb43a8122dcf3db435a94da48d0a0c02fe9dfae019b1439c5,2f7977cbfaed7953bd70033c0cf92138eedf974f5886fadf4b4971f2d00a4143,b248a4c32c9cc64e5747e7dce6c7fc0a23f5124a77c71ce72e27a81aceae9d2d,619d489f7cc3b461479c702fa8825097ae22d3c6cfeb911e9f14ea1de9c36d6d,4da03f26294ab6d163a1a746dee4bb6a82d7d4f39e66b24246bc0eb4c455dd1d,1650c3d868d4bc47703f1b75f1f179cd25309b2d3b20a2b848e81a4423c00861,53909e753ea5a011550fd280ad1c342a74ca9949be092dfbd95244243cae92f3,c29c04f8b937284e821c87957653e87c2f6ac014fac30648a0f6b18e84392adf
+RECOVERY_RESULT=STRONG_APPLY3_CANDIDATE_EVIDENCE_FOUND
+LOCAL_APPLY3_CARRIER_RECOVERY5_END=true
+
+OUTPUT_END
+CHAT_OUTPUT_END
diff --git a/runtime/latest.json b/runtime/latest.json
index 4d40bd5e..fe231a2c 100644
--- a/runtime/latest.json
+++ b/runtime/latest.json
@@ -1,19 +1,19 @@
 {
   "schema_version": 1,
   "channel": "homelab-runtime",
-  "command_id": "NEWFI-260907-A-PORTAL200-APPLY4DESIGN4",
-  "status": "FAIL",
-  "rc": 1,
+  "command_id": "NEWFI-260907-A-PORTAL200-APPLY4DESIGN5",
+  "status": "OK",
+  "rc": 0,
   "host": "pve01",
   "mode": "read-only",
-  "component": "newfi-portal200-apply4-local-carrier-recovery",
-  "started_at_utc": "2026-09-07T20:23:49Z",
-  "finished_at_utc": "2026-09-07T20:23:49Z",
+  "component": "newfi-portal200-apply4-local-carrier-recovery5",
+  "started_at_utc": "2026-09-07T20:27:18Z",
+  "finished_at_utc": "2026-09-07T20:27:18Z",
   "reference_register_checked": true,
   "reference_sha256": "5a3d8e5154c41cb582a4e0aca68090be1f0138918bf82131a948df326f9d8d66",
   "error_register_checked": true,
   "error_register_sha256": "3b09a553ec0f527ed3afeed4753f52a74ee3036045bbfb3c685e9f8af4ba7ba0",
-  "command_sha256": "8127ffc23bc78ed0a33fe11a82208105c1c291f72bb883df6b03ca818f466970",
+  "command_sha256": "d8972287e5a04bda3fc17acba988b2651b92ce4193aa3038f19cf27372093f65",
   "duplicate_failed_command_blocked": false,
   "block_reason": null,
   "execution_started": true,
@@ -21,7 +21,7 @@
   "result_contract_valid": true,
   "result_contract_status": null,
   "result_contract_error": null,
-  "command_rc": 1,
+  "command_rc": 0,
   "changes_made": false,
   "rollback_started": false,
   "rollback_restored": null,
@@ -30,9 +30,9 @@
   "secrets_included": false,
   "private_addresses_included": false,
   "raw_evidence_retained_locally": true,
-  "raw_evidence_sha256": "026f31fe2496a8273dc8c81e554b12273f6afbdf7d70c66dc718f0fa3bf4e8f7",
-  "sanitized_output_sha256": "026f31fe2496a8273dc8c81e554b12273f6afbdf7d70c66dc718f0fa3bf4e8f7",
+  "raw_evidence_sha256": "58a32ed77e16ff3fbab7bcfac43e592c6e2daf2a7cf6208e7a229a258b6e3a3f",
+  "sanitized_output_sha256": "58a32ed77e16ff3fbab7bcfac43e592c6e2daf2a7cf6208e7a229a258b6e3a3f",
   "output_truncated_in_json": false,
   "full_sanitized_output_url": "https://git.gram1.ru/.well-known/homelab-runtime/latest.txt",
-  "output": "  File \"<string>\", line 1\n    import base64,zlib,hashlib; b=zlib.decompress(base64.b64decode(\"\"5L17cxvXnSD6f1flO3RwPUsyJt4gQEKGsiAJSohJggOAllWSLqoBNEhEIACjAUmMx7dsZzzJ3MzGjie543HWnjiZvamt2dmRbSmWLVmu2k9AfoX9JPf3OOf0Od0NinKk8VRdp2IT3afP83d+78d2baO83Srv7W1fzbY2yvV6tVJv1SsbtVcq9aut9cql6m5pOpm537M2ajs75d3NVnWztFu5slWNZ/KptVQhXo7v1erN8nYmlYpTP7nNSqN6aTf3PWtnv1luVmu7rcZGba9S2q3tVqDv8martrt99XvWNo0tGzVae5X6Vq2+U4EBat+zmuX6pUqzVdvebM0bOjBwVnVZbm5chq/2d5ultPlwvdyo7JZ3Ko2S+bxxuZxZycPDTVj7ZmWztV2+Cjsh+oC1VHeblXql0azuXjLe5WFnYG7VzXKzIl6kW43afn2jUur1B26RZpyY3plGNuRhV/Nr3Xyv28t0c04nk8l015x2rr2azeTgbTZfyPcyqbSbd9qZdHs1l82nek4h2+sUemvtXiG9thLV9frVJqxypZDNZaNeNyuvNvl8v2dZJ/908vHJb08+OvmXk3+04cd7J7+D//8W/vcb+P//EC8uQye1ra2iTUuyk7baf+vk1yd3T98+uWufvnXy6cnj0zdPvjp5ULQzqUw+nlqLpwoW9HH35IuTr6Hdz07uw38fnNwv2uI3fHv6dzZ8dZe+fvv0p9AR/fwC/jz5zD65d/LZ6U9P37G5Mfz/HRua3j/5wj755uQxvHybRv0a/v785DF8Aj/fgv9BU3r42clDHvX0XRvm9vjka3h1/+QrbpKwrNKz/cdKJeyTD2EbPzj5Pfz/j7CRn8Dvj09+Y9Pe/gPs2G9ofz+C17/BTf8dvoU2v4f/vv/M5wNnDPvzALbh8cmfaCu+Pv3FyZf2oTPsjno9W20hb6DcZxuPA3cQDvYBHMxbtH/2y3ANaltXatsv2xuNPdg+/0HRitvOwcR1u7bn9Fx8b3tT58Dlk3rIneGBn/7SBoi4C4fw5ukvTt++AB96h84EPuyMZsOpO7FLdgqf9vpDZ2A7nY47nuLbQ7dzczzqD6fQ4OXaFR8TbVV3y9tp/ARWiMsYT0bdWWcahwlMYQIf4U5/c3IflnlfW9TfIYjxPYV9+gCASlsfgN5DWDTDvPr4AXxKyzn9O4TR01+KvcFNpIdfIRR+Q/v5mRoQt/y+PRq7E2faH+GiJrOB6+GWIZKNj52JMxi48Nh1uvHRcHBsd/sTtzO125N+98CllT2GGT04+dq+PenjHon5wb9+efIp7CNcjAewrY9oQL5oX+J3e3AEDmxZ/KK9N+gPb+If41tuKg1DO0NvPJpMsZkzmx6OoOdj3mYPnx2OjtyB0453Dp1pfDIbwvkM4aPOlN72j45mU6c9cO1LMCGH5t52Ojfx3WzYf20GMKAQOB2n0x/EO4ORB2fZnfR7UwJCmNMBvu26HuxFZ9q/RR0Cmpk4t+3GX27bOAxuG57qYb/dx78ThLwIrAictYNTkP2NCfg27Qn8iYgAoM8G4lEB9PiqXX4OeCANeOA9utUfnLzvY1h12Z/TRX9MyO3togRrmAP8hHV/JjYKYBav+FsEsF8V7T04f2cAuBx39BP4+kt+Ly8N9XmPdvpPsGv3Tx7ZL8OJ1XpXRoObAHKi3ReEbx8A+FEbuhPb/eHsDnb7e5rUT0//Fjp+10f3P6OfYohPCVHD50WLntw/uQfzvae+AhgcHrhxwuGPaLB7gKXU7G3mBPCM79un7yLeh3/fF7czAoUkCH7gNj9EgICvTn+FuPAXClndxw3TLmR9o5zs9r3O6JY7ObZPfw5z+PzkwXOAnEzCLu83L9fqVWSQXqnYl6rNStmuA9dR3ak8e7ipA87tH7mw1PGoaMk773SP+sOk/DWetQf9Thzvv3tnalnrgDo6h0XL8bw+4NghoQfsxbLKApE4dJPdO4AuFGooWqJZ8hA+G02Oky/5KOIiMksWMgz3JcnALSYegekPMA32gTt0J/2OPQDE7k0lM0A07GeKDfA7RfD7EHEkcR+fER4WHABCFjAjAsP7kAFo2Sov2WdynJbVgMPZb5S2ytVtq75RKuSty7VGs0SY1doBVrLEEIv88x4wwMAyDt3bvX58LEE23nXHg9ExThARFd5SXkLRAoZzf7sJnOZus17eaLZeKW8DD9xzBp4beicmsr/78m7tym7odaVer9VL1V3qQj0uvuIMZm5lMhlNFIMPq0hbG8DsXao0gDuGFcyGN4ej20OrXtveXi9vvIxj1ZvAp4deIIdcq8Ob4Www8Pn/2n4Teq+oySGGeUhXG/HPZ8QLWvLmfiSYzn84+TfkAn9GW8IcIqIWxFxvER3+OaGyRzbv3zK/JRz1FfGadwXFfWRPRoMBwl1CgyrB75y+y7znf6GfbxsgQ42JV0HMxJwCYwpCSL8kwPlSoCQGS4mzBOBKXuvByYNl4KlwDMmTAPFKIl8ESFQDW5uZI5j7Q+QxTv/OAtaEn9AkHuEEuMljQGzUM8D2+lw4lSddbjTTClprLyOsphg+FWo7A0QlwY87HlzxjmPCBwNk6LR3a0q4s6L5f8tAq8AMDeFSA5bwZoOpGhM4AJg8HZpA0wwpeKX/lXZUofVu3zkYjrwp4AUdw1sbc7enuoN/b1YbG5lvvzv9I/wbJnw0xj1S1OFZ7ZLo2OAKJQHise2xMz20XxQ76G/dxH1tBgzkkQvoTPK2AEXfnP6UCO0DIqOf8U0RONO91e+6w45r0728h88V6IoDUt2f/On0VwSLX7HMRVCL7Cncq58i1ZUsFpDqB8wXwPNHyO/SBbkH/0Pe+E/EmDDHAPfKhpV5cD+QHYS1HwEj1+p3BQ05cqadQ5IVgLTMPJPjrr0M0LIOgv3LlU34C7EydUI31GsdOV0X1/8pXB3CDzaxzHiv26PRAPjjhBSUGMhyzEgQQyOZeeSuH4i/GS2p/fhRo7ZbtABKhViLpEvJDAYm069lUgNC5KTELnuj2aTjwoQ250JvvbK+X93evFzZ3vszLvfEbc/6g2780B2MvwXIamQV9uRL5p7wz3tAQF91h1ujycje2K7OOXIAktOf874wa1q07vSKTrc7GsqZ2ddGY8SX3g37Wjx+w36p370ItHlyMCPALloAHCW73O3Ga0O7umlZNWoOYNZbtuPx3gj20Wrc7I8RsPq9Y0S5U5Bl4F+uDSPBBtl9zxajoSgTTaEkHmYG+k1iob+mNe9d3kuKmzgYjcYCaiS7fF8HNJTMTt8RbDLKaQKp61SFhVemawl/KhrJgSvR75JMawwCV5tgM8AsmRtsy0MRSxfrXkbs87G4ZWoz7SA0Ry+KjpZ2ig/33umv4L2PsCRWEUQVxPxuZwSXcRdhMcnse1B45n/dBZzwLjJFz4HFzoJw9vfAbLzni2bvw3/eB+Hs1yilfSxIzbNntiWz84AEdcKUv4Zxf0OQQ7jpM9IxIMb8BbEsunR0+otl0mIJFuYXQnQR2oh38cweEYP0QOIouIogiYLssFupo+Zuf327ukE3WKEiwpb79Ypl23adURCN8BXxMQitDwVpVgiviG3P4CnhyECK2avXNvehf4kzbERUFSEw/hr2+kNSiL138hF2V5uhVkPIBwxYxM4RUiF8QaNGMqg483k8Krw7gx9FGZBYQKRAvNt0BLSlXwsBVTIgdAdoY8WeK5UW7rwSnYtEz39TtGK6MlNXVzJLyfdc00YA3YnBt+8JOnmXPn5II4vRohSc3FlnNpkAUgQu0yWl14Uz+vhGTNvnbgmo3iQW9iuFLgQl7Lpe/2Dok1MW9r8hdvwrqcIN3mDBsfmIYK/caKjJPYcrnUtEK7DfA2ni5L/ixeZHCHm/hWdEWZ+DEuYDXUGo8QoROkHkeF6uXcFbxafXObaPADkOYHu2y7sVuwzUrVHdvbRdsa/Uq026wZuVve3aVZttLdxsHZo16/sV2ON6eXu7sm2jsSWOxha7vL9ZBckMJvY7AsQ3CT3cFyIHs3kAlm+S7uU+s4MIftvO0IXxJe9CmOpSf5okVV9y4vbcCTOLDwxByRb9/YJo1WTSdycXZG/rhn6FtTNSzenDiTPr9qdC3/kpkjDJPf0SWgdVjkKLgMzbPxBM4vL+lpdHl+ge7r+C2znrveC3POhPifOElY5n3qHQtWoNnPF40O+QOjIpyamvnwRm/ILkccVdJ60niCimKlRsiPwywRKAzVwBqZ6AO/pr0pGzWuA+XTbm1PleFi1xRv/7zV/bhJuA0xZci6/m5wUkLHkCYf4kfJm1M6TbGvfcodcndY43dMbe4Whqk3QqYJlGhn7laoCh+IqFVhKjiQ/+G2hzV2EgfOgrK32uWhNH1KUAzn807MMxw1dCbXwwAzbCew5IZCWhnRPQxZ0qXCGBMJBJIg5hjqWMXnxC9p5PQN764Dnglj8SmgXeS5wjHpsULBSPiliFVAiS1PwS6BGDStGaa8FNJBKi1Xqg1XqwFZDtu8TpIYA406l7NAaGQAMaU/v2EZGBmecG+g2p1EhX/0AYNFiiuEfy5Of0Q9wj6vRZb20+YQtMSpfpn+AUfwdnTbQDGZRfw///ePLesk2mPDTU/e7kDyf/kwnL/0PsM7X7J3j6CbE1v0dK84kw+f3hOcDC/8sEvWjt1RpNsYX2xn69DpJenBktac5nIsCKeJ9KK5SrDj6AGDSFms9JSu3uMTFjSXfaSY5vucnLwFVtl9dbQOSrMPiu0Du26pVL8LtSTxx1jfbZdEt+Uq9sVWDSGxXRBudFKP5FezgaInAdw5+MLxQ5AuTGPCYzrDQZiS6SM2+SHIw6ziDptTUdtrJiNS6XL+AHUjdtap28zqF75FCD7oyRvSu1EbYHr4BB7SDyASECqBAN7Rg6b1Yoozo9eXs0uTmduC511yalOf1J07MvA5m+wGs+GsEo6ncHVRJJoI3TY/F+4N5CI55v70AfAw825tDxDl2PWg1HtmB6Rf8aeQH2SJIrd3irPxkNUYQu+tsQoZ18ZScJ3Ht109N2qzvqTEajqf5I9iuUN/zKcye3+sAfHLrOYMprludDIr49ANIN8wKMW6FehCio5M8ir9sbDWBHe5PRkZRaj9wpAMjUSQ5wr1/dsgVHCc03R7AHU142P9lQ8jJ8djjqetRt3FaaBpzGBX5GDxI/9lD/JBq1eK4+d9KobFc2muK9ewc+xo1iRv6IaJWYHSwNkMqGWLJYnFgBTZgm0h/C3wNAa0mHDJ9JpQCDl2MX5g69CzE9KRrz53a/Z4/auMt0V9QMTXDpOADMSRS44/QnMeDItxkHMhmB6GW33UPnVp9kt0JCmtOcHnAPR8DW0HRvH8ImgpAmYEXAYLffA25QnJHUyMJAEim1Hc8d9Ic8puxicz2wHubRukYjCYhR73x4jXwtNf++WpNOC+/tasK+TFBJa9qFEe6gZHx5L761twN/7TiTvrO5jgZoF61MXWT6JEAzdF9uNvds3FbP7gFjwhog3HBx9XFDcai1BCyUhmHAsRnf4rAje38PHXOS1d1Gpd5MbkID+FXeRmwJqDaVsLfI/aHrdvoeabXgs8p29VJ1fbvS2gLkqigo+3HlWnv1yh62ginx1byMXlQaabdhYuMZ4LjD0WzQhSO326PZsItLROTmAJ/V/4nbTVgwPc/tTNyplxxP+rfogCYubOS07wyeB+dVEBS4/GdQYJbwBO2NZNGePR0WPDjrNAzy+Sc0UBNrxnsvlemSf/P9n1jARvr8MX74iK1HKAEo9QET3yiNMoGF4KAQ4elmH1TSaHYO1JIYiuPMGV0+c9JOSjdY9smXyPFHkkx0+5AUE64f00u8m4rqaZhWqclziSiNhlBeCCHUrm1tbVcBvqAzuCQ2ysZMfU7eVxr/L4S2BDVq92129ZH6ILUv8aAuTBCDUa/X78DlUORQ6rBZKKQ2ugOMr6cRtARZjf7UR1yK1VAtyAoiZU3AtOgsRc4z2ntdzKTHbLlngVWa4Zk4sUk0LP6J7VDSnNLF2YYQaWp+75GaUFAU4XYFWP+g3+4PgFt8DhhjNSFnShjjj4gUWK34W4kQfnXyL4wM3scXHxAi+Ue8qs9Jr5s7S/8vVIjfsGHaRUbUt2d+LE1TvmqRXRXeYuOKkOvvomsCKlYrxOHPcdsSdiRicyVc4NVinph5zSSxmP57gD+3g7SOr5XdPgYKlpTMpWzVmc/PkGVO0EjB9R3js6kzOXCnOtNp94mOTOk18awI/A5wCHArRt5U8g0k66ONGw56E9VZApnBHRZoDB3NPNceMg6RF0/w6nhbQwallwA/blXR17gFfdZ20e1E9BLvEXVGxkryDEnGzEgub3s27GDfs4cukMEuOawxtwlEcjYZ2tORDaPOYFeAk7A1mxCaoUFOIbcMhZ6tnZknTJrK7EdyB280MglleN8f9o9mR6jJ8mZj7BG2SLORikNRllLNOtof2rWXk8Iimoy0hwrLJ0GMRDq9vjvoevbt/vQQ+p2Qbm56PEZmRjDX7hHsgxQzgNuaqI7YlEZ25y5aLxNkWLA3tmuNyqZV7SmUR9uIXd0hU4Jvth2OdJGlklBKfWvdBT7LVW9xR4ABhENXM2c4S8KWuhNEw8zuXaCGLgImMb/A4MLmCN4xSXydBF7VEyLX4bHUN5DlUCBQbMaWRL81UwOY7lbCBmG7uiXMK1YZWWffYIdT1o2iMD/2u+Q7JE416U9H8vDAiU4Q/DQWPy44TP3OXdD6d9EGA8B3oN8wvt7IsqubdSmBvmV4NIgeYFcAMyBtabuD0fCAgGh6CIfl019y6MWlgGSuKUcV9SJ3BMG24wvUp6J8YMfjhJ/EhPAxLNxOiN94QlNog+ZBrQnhKLiY8hkZdG1UzGonwaJuqSSFaBJZqBGs8HJCN3lZLGqGfdCE8xnAF9zKtuvrIJAt5ltqKLWeNfkAOUESMN0LSudonz3JitvSz0l3UBDIN+hslTi7uboOc78jFaBsjpsYn8uABP1+z2objXM1nkUQB0kATDcx1bOyS4vrWN2UnoWoZUgKougbs+WE7iG1FlNBiNUBeX4rBdeqiQ/ZZy1W2CCkTl82ZD9n4X3LgwScJNnCaLLcYn1BttHv9sEcSxaarF7ZSVb3knTbRefMwWtkXptfhOM9diLVCMJJ33fFf9agjsL0leruZu1KA6hMo3HZBiK82yBmQhM3fwMs4iciJAYv4B/gyX+1kW/E6T77C0ju+EVro3h9bzI6mDhHIPEPXO/63qzZvHp9jG8T7h0XGrIL//ym/J4b4/JuusdF66X9RqW+V69tVbcrF69vjjrsNXPd8w6vC51oy+1mVlbSa4nx+CYQ3GFnckzam729lxPWS/XKJrAqwCo1KruNKroit1CGumhZu6PJEdw6FUAAbOnGzqZFMQaj2+6kcegOBvZKIk2PGkCbp3GYOJApz9ICEdqEWeMwe4xPgHnZ8T07k7HjR/ZLjM33AMIu0ieodfzPL+3Vq69gNFN175UcP2eHW/wrZErk2Am7Vg8FMlB7EbUgHA40OYne8r3wDY5SdrIkI0QWjbi9M2o7r6KSDElSvI80c8i7o9k/xw60xj92YU1jh+gZDAfE5RAZXjguoTlzCLtY/iYWLc/F6BC4IN60C1QfOIQu0HfoYXe0696+Ap2MbsOvKw7xE3uO5zUPJ7ML6GI5sCvAZWwAXoM+60wepSabYtSs/eZWfBVJ63pt54KFRH18eOz1kaKyyg6ECMECEVO3jVwWLOd4MHKAw/7JoN+2XyQNXz5HjTMr+QvW+BgQzTBrx6t2fP153Oe07yJ/1d64XNl4ufE84imkfVOYOk//7vRX5KSJ5ihiKSe+sGE9lcLkydoSFAlR3pOsyAVLWkMuWKYxBPEpbPIrfa/fRo+rIzRKWOaYLdokchGUo/iP1FbyIxG1iT4E5fXqNj5HdUmrugt8UmW32Wjt1potwdZbW8Am0yVv1vaex1FnEjL+AeZDssCzHsKMWICtO5xOx14xmQRSnUBcm05MZsnzxEUkgXNJstYqGYqMSD459AHdSIF1uU+qggc2uoiwFuE7mhTaQtiCqzzMDF7G9/hkrz3ZGbMduKZlS61GM6xzkM5bxFOgo989djB5HuCTpXDM904+tMkq/9HJf6MQrI9IG/QB/f2+VBmjI957yIjj7/eeC0JRAUdfsQ1dODtExCexxpd1xLbuuC0crMPqPtTm+sGcX8pvDReeOQ40F0g5yw439B8ROnv6LrndkNJaOKDqGr4LqHtFIT+JXvziVA3xQLJ4Y+RagPpfQJUruYL5ZFpTePthoYrbJH+gJIjuvUH/4BBIXD7hK0G1iFDDA4218qhY+42APunP9JYEYNRWkjakqKzf3+j43vS8fcTzCPiQf6F88B7bYZzsx5YIPY0emWBObF3uOjlwkI/0QzLeKCcfViwaIgHtmNoKhCUOrftCRGLfpR6ex6XKkW/nzl5T+caIOyPMN4bP2nO4R78//YW0FiUDDnJG1K4R22g45sEmfymuQAgnSonmyOkcAg+EEbrTQxlBpMc5fkmO1n40ZJGkGox7lnHQFP7MSFzowVAbKJSoEXFncSkg46VaBl7yljPod4MWh2X/1IEhBA7EtYVDK8pcugUI4yI0P4+4bg4KvdNtQ6GX0TrWsILV99hHZ/05/uHsioKerO/yjt5jaxiGfkZ6rJ6+Je/JPM8xunCBUxf2gWWLvR1VnGpAg/AEOwfP/OvTX52+bT3Z/JqQpgByP/R9okIB0XbPOeoD9jvTI0uqeKO0/KatBRAkgEeXYqP5tdDehrxfQuYrdbihwyQ1MM8A1SDIUfT6kyM0F0s1iYzrttmsZShSAemPekpTp+lQPbgyA1N/KGwUcB/nGKw0blwjnhiOAc+UZyE88DHifPSMvmW6VzfFW0ka8aI8f+1qPg8sujIXi7IbWtiJ91lPQcOk6O7QaNarG83wuGcg1Y8olOwuZv04fYcchHUH2c31pOamIQ/Gi8bGpM8fCqG9aIWk+fEhSJmI8Lx+1w2B9QWQk1Hvj+4LviODDkz29HAymh1Iewsi4uBlfKLn4ydabhItVPyBYbcyLybeSwrYIwaiaD3RZgfwp99NU2n3JDMeH5FQwNPmG9Y202FL+HIlQxaloC8WZXtQrkrSVKGFTflWlKDfEKfxGCgVqm9RDHqIaSYPcq/xTRyvbvkWDc1eoyBjc11pZoWhQLMiBZ1ozuFBE+E+c/JPBgP+pfKb8UFNi5+c76euiwB6MOZdcpB+wEKR4LYjVLPPHgmhH8DvKCPFxyf/lbLS/Jr1nhwV9QniI2jwe3Zt/kdCUZ88B0T0Wwyqo8ClL9lkTt4cRDoJU78JXDep7uEGAaeD1NUI41fiTkmg8Qsm/Y2SjETTdTbAzwmFkPz35xx1xb4gZmiM8q6nkDmRAwManYUI2I8apb97PsOBgpEakUz/92nhpuTmA9qDKIlgbiiAiILgqScMcdSIKIiM04gMT/tSR8+IAcUQOr3XNAAsDwUoNltkPqWeRcoOc4XsUSHvigowFlw1TFX6/fgrlRxIsuMMncnzcD5JFzBSYH+XY3LqtfLmTnnvOVyLsw0xfh4WkTgJEMwfREiRSqSEm+h1RmPXSLqE5/9rjaqHHJ/M8Ujl85aeq0skb3kMiAs3/itOGcVxaZ/hRT59RySN8hO2SE6ccq2YcYuG4GzSPCmWCTORyP51VqIv6YXpdI+csc87MiYQMG5eR9Nnhzr9iuFLeawljQiuBzLsTaAgCrswxk1aUqsTZzmQzkRX7z3God4RO6+SbH3GnuMqxIpP6rG4PZzl7GtpVpNZ0Ugbx2knRJofkVmCbz6O3B3dHj6Pm7CasDntXby2FW/W95uXga2tkj75eSUzk5nc/loQ5LcxSBvVZU+lg88knuy0mE2EDEGG2SjsQ4AqsTDPxtxPUvpPkes6wTPqw5SeSGSukvkt/Ce2wPCPFTlQ4T5vU/4THSY4iPNNP27WpnCah3S5maqQhulLtm3zenzT9jM/ND/NlplvUKQVZAPryfvCqffjk79HNwghChUDGeesRUqDIi4NxZoTApIpLR5dCKAvphZ8s1iK0bKwJfXIS8rItiz2UbdpG7nklp49TEfuSmjhKtNiOIuhkW+R/ISZbfs9RiOZGQbfQzXIe+w1zeze7+WIwQRiGnXpjSazI5Hwr2Fk6itaKQPDsxrST/jHOQX/mt0TMGcWYrP3SXxH7gqp02OV94SAVeUcIVb4cyY8fnQgM3NEAyjpAb7khzC9+Nn5Bpmd+jlBDSKR6NwF6ibYIssMQ8S8aaK6T8SF3xc9sCoWD+gxuVbrEZwPbNqqr5iHMhQXelIV+u8DYkzhj3t68LYiskzw0Jn8U4DyeyqfFfqeuEM4vbimW3tAHPNPydTyUGaYARR0PHDj3qRjL8yGmLUx3h+i3XcBuWeau4xBfSx8TD5HzIMj3Wf+0khc8WPnluN1Jv3xtGjv17dFKCxjJDYT8VscMQ7C3hGlLLTrLqXRqZEx4DPbHaI3DMZ9aIHkuKcC55mpvsQADyi49y7T608phvCe5AdwG/+ZZn9XudZ+OcfmEpFWMphfZbOyUW1Ua7sl/4a2AApa5Uv1CjpLNMuXQLrET1uVV9BiirZWYS2NmAfzqErZiIrGtyJSOeLO+MoUWBLSr43ybm23ulHe1rFFZfeVar22u1PZbdKAj4lnflREz4Ujpw8ysLQl3oRNHvVuwxVPTGYgKtM1f2WnaL2yk86nLPRNKJKDRcaq7hXtgPeFzPFShJlkE+mMBXJ6v4vIKJvOFFIwnAMU00E3iTu9lj8WzoN9Ucipo2glbzmT5O3bt5OEZzxtWknW31jYNZPQM1sDWCVf3RLpjnSOVnhIUT4RBhsZlAS70h7BhSlz4smSnebf9rQ/HeBvHw1adFtsyjmTET+GzpHZyN50JrDCjfJec+Myxu9vDEazbm8ASNNuziZDb9ofuFZv0neHXQB3uCUeNHKHyFp0relhf9LFbKDTY6Fixbdo+LesmedOPBqarL0ezXVIMUjwVxa+RWEMfxSyFkpj4k9nOnU6h+T6g+KAJbUp/MuqTfoH/WGclGrKfxslcOJRhSM3Ct0YJ2WJ2ChrfDheTWTjvfERrBUwoJTpEG51kotJaNzugQt09S6D+IjGkzoohGPgsSqblzA0Y3dvZ297v2FZla7Iq3b6Dt3rB1p/MBcAz6wOnlmY3t7OeDDD1H2oPENn8knRHo6P8KHVP0KvVfsnI/cYkHtSPC4y1czH04V4O21Z2wgA2knCbbtzbJPO+wD9O0bjqfw0OcTdSFKLFs4jubaWT2BTy9oREYDwCXDcOA2CcvyXhdkdgOjlcznetg4Iqm5nyqqt4BgdbxyfEGrUgTzuP07ARzDt0YGKOoQu/MFS+RReQtKjAosK71IFfLKhBgUYlHgv2Wr5HcdvYVYpGX8Cby9VmjY6eeRSK1Z5MBjdJieuWqOp9zYvzRN8ryuF/WGMx2KlL5LPgf6CnRD8YaTGjcxlkp44sGWk/HttBjJdsjdxDgjBnP4Urhi6FNZHU6UFdr3D0QBddi6W7BV7p79+Fl4mnQ6xH5EhLwRwcmq4TSVtk0pij1AmuFRlX0MztSdLThH68PtKwYJJOedk5RyNPUZ2xO8YWRQkS6TiqfCMSdsbACWJCON4G5Du+ck9LcKw5/jgbDUFoOVb+pRV5uIwjdNuH3GbuC0qj4HGQj0WgTUnD20Kkk524e5ODoCY49tI/UVElmZm8nVBG5A1LIw9ylFsk7rzIqPfBKF7OFZtNfE2hkNPJ86Ym8Ct6Q+gCfkrknOictcxMuGSyvKv53MlGAsOw+Z7K6u5zkrPcQr5biqVL7RTq2uFguO2V1azPSfl5rpuOuc46CQ6oYhuK+uudFfhK8fNr64WOpm1TKezlk51VgprebeQ7a52MynH7XTxUmGmE8Aenkdu/Rac76J/3EtFYcHmW4Z0qMMu8cyiuSAYUMhzt++E1ib0/exmaHHcXgTJRuKgIc/oTtAqktQjfvErfAo951ZWO5lOL1XIZ91cYS3VK3Qz3WxhpeD2uqur2XZmZTWddbJpx2nn3NVux833Cqsr7dWu6+RWnbx7Jk8WfeGVEYYOCeHh3Kd0iXzEVbD/03yqAiPZexw+xdTheP95O5BDTmocswlcMquKWJgvRIir8Ux2kuIpPyDpE0X5D07+zS5vbFT2mpVNwn+Ij9CcUW02dPXzGWm1qAnj368px7nPtRPsInHKr6VWuzm33cusrGQyuZyTX3WzndQarKDbyTqZ9FontdLNdKw+Eg44NZyGxGJoBAMk2lvtpuG+rK2mu73sCvTUTa05uXR2LdPupJxMvpDLtAu97Kr1o9HxXv+OO/AMqcVBdI++u3D7cr21TiHfWem0e6tp+LvbK/RWUtB9ZyWV7vRWCymn3VnrWBTc5WD4O2Y9n00wZomvlRbeCley4MDmrjqFXK+bdduFXKfXLqRW2/l2N9tezefTK2vt3OraWvjuyksKxNGNC7YLnhzZ3qx91PcoVwM6IhFg+DcNdnQ1m1srZJ3eSiGTz7azmXzHyTuuu5JpZ9xOG6ASwaQHw+bdFQdgNZ/p5jLpVHYNoWGtk7UiUhdCt24un13prK2tFVZTaYBsJ7/iON1CBv6X6qyuum623W2vpgvzl7J3pQxM6qAnpgvTb+jzzqy6qysrvd5KvpNbzeUK+dVeyl3Np/I9N+V2OxkHJ78CwLrSgWdOGv7TXQVcmEq5cM7p9px5nxuhzp03MaCEOYfuFC/ynAX0Omu9droL25BP59Jt2OKss5rOZLqdXrYLP1actVwXbls35aQ6qUzPXev2YPrptXY6l13rrEQis4CdjC/O05CWP4cqGMt7BhgG7ZW/J2XWH07+O2CYf5RZBjG/YGV3q1bfAEmYNGZRe+HrFqAFyn6ABuKzSd9eQLBauGCN2j92O1NWiaDcBY+AmYQLhLcbVb2eaop3Ke4wQZLP8GzdCX8uHgEX3e/Bp8bD/tGB9tsm3t1uD0btoi2F804Xk5F0AUvdAsbDnSZ/PDoeE+pBN17MzLCaSCXHw4PkbNjH2KVkPpe8gOLPUK2Ae1c9HqIBHwNAEx0llQLhPZJrfMpvRsNpaBGwXjx4Y7EWxl/L3Gtf+vniviK1ffAI7PAR2HOOwI44Ajt8BHbUEdjP7Qjsb3UE9rc4Ajv6COyoI/ij1GXepRShb0oLN/vFqXtBvFrPwYxI8L3l6+usgOpO/+1MpxNL6RL9v0RD9ZPaIY8nrWv+dRyPQOA71jzDlRhJAmRAPal+u7ecwYLKBx5eXVFgqSSra5RqFK1wfyuskLqOUqlwPzPYTZ8uo8KicBYOqlfQqYT9pwgLMQaMY5q0ARkwpU4ktE6Ri+YW6ljQ0vQCRlMD2Lb6GHpz8lvi4Xw5CO2vvG3moalDf9bITTtyCXCBczkP2ggBkg3/cHf8JxGUuLZ4fn6urn19duT8oIm49sFRWXuCfxEKMEf8dph4HoLUUXRwGudZpEIU3+bj8xKoCBQidEMIUEFt0QXOLUdqeQRL5m7iGqa/Gw2j9rPG/s8CRENWCtlTGDLP1duTgPI5kqI5BOLfj0KdlxqH4M1+ArixIwB7CrreGGQZA2Eq/6AvmCQIYzFjWM6NHk6viuzxGGYrumHWFjH+asLevVTdfdXere1uVPzo4XkKC82BJITkVdCs1IMxVJF94v+mzv5GFPcIF67x79MDuE+sfobDbx26Tted2GUSjuOVIQAAErlY7IIFwl6r1x9M3UmLGPVRr6c/tBdeYmhfUH/xhEoxbTdjxEL8g6hO8UjlBxezQzZiNgZB1nWOUL7AjBvsbamPZKbF4SIT90nKv9zc2bbboy6Z/5Akw6b9iS19OJhoKh1hNMLsp6wQ2kCamGEuNeL9EWXcRh6gKwVisUaYKYFSycaqhhsYOTfUNrKEB1/BuGfcQmmJsrQdIiZXVwmII5nnjYA8TQShw15oN4T/B4GQDtYamLzte8NJzyHpGU+yjjjOizZIawjEmGTinykG7j2tuCNDtDRURmvDnmQgtUzXKIxdwjVQOgI0uGNS2rfRUE35C3iCqI+27ORgBKeAf0zcg74HYIJ/Y0GKpHfUH/RdD38L01ayO2pPRvHx6CeAb0a3nGl86MRHvf7U6zuD+PC4Hyf9Ylwza6aTys8tEHInPCffJA3TXSM99+m76EqF7m4mWIgWKnU2FuNj6Re2HpVK2vlb4kUUP2sPMO7BGdgvyFZaNQCcHzl04vkKIwCgKlSBU3YHK/qMtS7mTlOOZm6E6qJUstV0vvCRKi6MgdnCxBzchNw/8IuxM8FsZgJz0GO+pr5zvK7Wgw3VNsbECKHiTAzVj8hd6R763FMxUCwLETg9rDLjS5i4KHIenzuUGXqqVZh6S/aCEX/ia5mDGAMchPpU3EcvWt2CkgTedHjE/gp8a8p8WVp04Vr7u9W/3K+0yhv1WqPRKm9vt+oVeNBoNqjsbviDV8rb8LpVeRXpDpXKZZ7LZk8MTjDGO6GWLaIJceu+DnqcS7dOKjaF6AGTZBAQkwBjb9cu2Vg0FzM+qCKiZEGnVWr2c476L1qZXmGtUOi0e47bLaytZNvdQiqVzXZSnd5aJp1ddd1ub62Q662sruZ7TreXa+fWCulepptKObl0LmtZ2KEHHVlzDT9IHoCQozMDaW/TcDW94+H00MXaTxh1zM8zaKQh1zzKZUC5EHzV7a3+aKBFTZL2ljLBap53SkHMW8csxLvSjvQzITF+QQEdpJZEnRiXxTxICv4qSRyT/4oPxq+ngNxZkjgfn5JxxipF4Rr4bYbcccLGojYmhgKUqfyllb/zt4HLyhVyY+HzB5jcwrwB7MeyXq9daWAWgfJuuX61lNLt7W1OzVWSvgIWJ2DSHliUsAGQAqbs/Hsqe9uobOxT8ga0glTqDc59qdy91W4zeFKVgfDylZUmQHzoqmpFo2A/Xo1vEfPKBYJg2o3yTqVWrwJThy8lwW8ej7U2w5EHnGoPU2f03MkEGMM9IW4Dq9MH9pl5iPjtQ3cY70xGnieewJ3gBk3J68UbbmfGabOPnDuY8aSUTa9k8yk0yO+5E6mPVyMcuCM0MeFMSotLy/ZRHwYYH4JARD87sJiJA3+Kwg7Cz+VPcDce0g29L4EDeX1vhNF2zgQ1H5pzB/qCymBmoM6A/cIz8R034DV7AFJOhh/Vru5VX61sN8zKEuyRqVtZMUdQnPzPu35a+p8Riv1KS2vwreQbYXkWQVn+BAgWmHzP69/YN+AHKc23H8RTFP5vBrxpCAURJYsjKGjodWoe+ngGb63Jy4RiHyK4Q98dWJaTaDtdDXlR0iVBf+1U9F3nm2Heb3VicMN34c5VNtHVWVQzz2aim8I12duutJAJKiELZFFGhY3t2v7m1na5DqLQfn230axuA41Q7k3KvIgxs0zEH4fzW5IuWIVcG6EluuMmy0i0b58z/OBx+zLSRyToiWyZGiCoYADdYZgdJotSB+V7ws2VYJW25lxtCd+fqyXw+ZpdBmUqXxcqRVdB2IvWv6NSPyjGCMaO9IwAwbpkq3m2BW9gIlDU1Kff7PorKxG/KSK6GMG8Taf8qeY6ojw+TRldCqqwtFLsiYtKJhKJ2EXiHRB+3lGM4iMSUxIG5Gq5KFSNs3vifj0y1kIBkZgPe0qZkYCsqagx4qDJ+5bDXIJVpZhHRX/yficu1mKuXsKu78MIQIH86sOgCFbd2FqxLCo6pe5iq7FRr+416X7vVBuYIcHMPqKnNvbDZmjxnB7jQcQweeiDpWxphD8L+YQkKtbOP6Q9RN9jtenaySl8MB3ddIceK2p80VAnRpGAIfZSCLyYp2KrVt+JlzdEycJ/JfD95kkV6bV9xzykmm0krHI0ItOD+gjyMte4E4l+3DuwHIxLZf9WNssz78BumWOHk1xDh5xkHx+if5E9Gx9MnK54gjHTQLAmSZF1QWWsVwNgz8LTc8/nKtG/7ljqTICwmyH7yG5J1lKmuVKMpZ7Rj8rN3SXIVQXnVICWiLxn8TVcyOhL4ZVL0MDlPDgkHnjpzWq9soH+cQ2/yrt2VBL8ihHq7ChttqgOJQ4XOB2z1jOMmOUoMPwzZ6tcM/hzxUyNio/yOn/+YmDvsMGa3aOgYxlilvRzx0XLNbAZvlawPTvgSRV8Fk65It5Ffdg3HB2ByOK+PEQMHRXhdaMZJ0D1I9/p2j8W4QZvkUM89L+KtXeLFjX0DrnqHwbgfqrVJCY/TooZ8IMyOevjZyB3eQlncnDrWvqGGU2qR6ppqI+kf200Q/if5zwoVSXG6BoeeJPiEkX4oJ82SIVnaJMM62G4gJIQf/MJu7pzKblR290F4Etu1UFCsMmZPxIIg8GUuh5YN2xyHoP+LRRsn6PZ/1uyCN+SRwgqpiNiKbwICpLRQilUFIURkA8n0BIn0KITaLGHLAfmWxXFnlsbjQYnKQek7wwxd3jJzqwVCpkcWwEBxlzyeF+jprMJ3sceOdDnViwf126Wm5RFqLK9xZ596q5HLCArfSafys0yiHgjOs6hh7KBg8d42khh1wUSkNgkkjKr3QxvIDvFVDAcpIXuyAFhvrWxXSnv4gUowAXYpSIJzD4kG82r2xVOAsJpUtG1779RKUXUHf9GK5p68i9COc8qDpEm2pq4Q6BOcDbCSWg6FWEHIuPMUNOn26gVcQaCWJlLpGmltaKghJEIEa7YB2Sr4XQRGm1tMTOA/WWBQ2JjGxBGEMQ5kNN/vyLfwnzikS2ysoXPYXjApGCWjJK9KgzPtL5+G+eBn6QtKxAQhY/z9qgjYg5dz+pSBaHO1AiduoV1VD1K3juxAfMDAMAWTkc29OjeQj0FhoUO4KW/oZbpjaWeizCVyKe0CPr45GPfzZJos58vw6IkGPu7jfJWpcUHQckyREptoZ28XG5cbnFNSlJkAgHfRJhapaqcH5/8kVJK/MGPTPyAHmGtNFQH4eeVhsyDY0Bhg8s4/PbkA5sKv3wIf35MWbI/QqCLgJNMMVQS278flj73ZgWkWwxoAkYZeETAP6ElnPyK+LjHtlDJm8HmSNEqr1Y2BMPdaF2pNmEfru6Wd6obrZ1y/eVKvVFasS5t19bL263NKrDnu3AztW9a67XNaiWqEV2/VrnZrAvlb6kQavOj8itl0Q/AV6OUDg/1Cl58jPHcrqiOUkHdMaZRADy+ot8PA+I9YWHgfICREpEfaEWRkvhI8gWqwi7pVd7hEsVauMIDFnD+RHnCBcoQAN0edVHuZL3gHC5B5PqI0nDz6oReMTgyV985HjpHwIOrgcW6+Rb6alsd9bBSw4+qFo7iJFqevisyBkYW/Bb6DGV0Qf8ClxNMWem1hC1wLhx6dX2/SQywhMATM0WghL9s2g5iH6tgK8QSeCeW5etbtVUJZauA80+luIpp3DluVRpiBMalDfP83X1LJYd4m/AzV5ACbs8+4Jq/cGUfk/v7LfJ7nhN7qkIhhYFZOmQF/FiDIb1C+iRVY0JaLFi6IO8TPkVjisLgxgeC07kInEDoaPQAe6FbEp9SLSeRZUEE05ZiMe0gJPy/TZKfVgOVS3ebcbuinCdF6kpvMT2dFvIvDodAqTMl+CR4/5RjgzXrNytZpMvA5yFjuNwwwz0PNkAeB6dqWtDKU2GJ2oDWyheFiqgnV4qj4nl8sZRkrQEDroFCjN+WAcYiNayVSSVsH98RQW0IiUrpdNCt2SCwaf8mEOQzAbUFAZXk732ZH+5vCCMiKqQdEhGNKG18KumAVkEZRjMRsKAfJpVRxEVSFcqfTBSzvL1du7JdbTSD+DjAOGjpP43MDjKoyT8RPQ7et1JR2i22c4m6iz5W0ROZsSuH4MeOAPbIVRKVMBQRTHgODffzQ3D7Q8F9UYlGlE9aXIRQQrR3jgDeJwYEJ38MGKzu3A6zTec0ewopOBiPJbRKSOvZXw3NPl076hISRKZF6Co7UfDhgyjxl/voSwH8MjA29d0KiB+Yz3O/Tuj8fd50SjMlVXxfaGjpK2nBldkMJOQJx5iv9BA2XJ+qxuj0B7MJ5bD4ipNVEajcV1pXP0uIUTdYV2dM3APhu4O4K4K5yireCpeE3FUmy0nAKd+pO8awVxKuWpojEFx1DDmOfFesb7QyEfgaZtU2DAP3hX+PvUfp5TlY/qesfWKSlFTJ/J3poZK7tKpBFlrNo5aVO8eySEWD+rQWVlvCG9VS1X08f4UL3nSyINwY8d5hPjqf/C4AZw2XYiG4YBKwSIvxlrCwHzqTIewQ64PithodYwPJQ0hYCVj/A4MiKUBrkzsxfCn43PGW+yaqBM9icUn6VAlfCKUJjgh8Ux4xl2QFE2kEVoZeiorG8CIsYz8bULGBMW2hCFbjBiKBIIatJ7LpREZ6sqHIqyxbaQEq9sFP+mP4jf+Rj2RYpvTL0nx0Ik935RynS1Nr0cVroUeBc6dFENhCxIU6WP+EK3uXQZyuA5e9V6+tY64H4NM5Jz6I0iQ1CH90qWAl3urnnChFJ8mAdJJRFgLWo+Mez8YSEBJhgBbXWSCIRPTi8+dY/K0jwO6tH3uzCYjNhP1bgP39Fb8GwvXikn0wmtrOUC8nddM9vj2aAIacHHBGhwW8f9B6gTjMb9iRZy5gzwE/A7RlPhkjU4uivxECtJS001YEE0xJEaKYAB+qdcd/dCKwMPElZthFfORr4yM3u4BMkEgsJhXh+l1UF4zkLWLKxCklwkIrlwM1E9dqeljxIfHfRjZSBLm3A1RCy58iAtsESReu2pwobTMg9rNwz4KoJuILTn5upkH8Vpwe9LS/12jWK+WdFlWPwHISfG3UjRFMMrmWUqlTkftVuZQSNfuMM+lQl2SPzqbSIU/NEvtpmsyURmwCWBNtgn52ya9O7l9Q0BlShgcMdA+lyx1b/GhGJc6KGwUYqzLG37/oAqLQ6Sx8/VHiUs6qwv+OxInfRXjxBAFnq1a/Uq5vVjb9Lcccp7WX2bcs4rXyaFaNGADg3Bq13Ubp2g1dh2KobElFvim1GZXtyo4EG11zKzBiMChZ52kfKvWhkjisTCYh8xMjgdyq7TaTO5XNatmKylXJ3j9PylQp82+Wn5QAaD2O49FwuTM0SsZu4Bct+iSw/n+ai8KELpT9wMLZWnYuiVf48xp1fYMyBLvsASLy1aCUULLnZPYR3vJSDxM0xQrn+z6WB3LGDpdsDdZzkByA9DN8HDBESd5LlIAUwVJ+bYV51iFKVse2XD69x8KoYKbfVllRBRqcg3weqepoADzZhAYxNjm32Hs1EMyumubwEMSI+YnJiwyRD4RzbpRfK+Wvdjm01kh/6huCtbRWWsZTZRJ+imjKjzh6wYzuf+Q7/RAMsnMb31yZcIM4DTpFMlfrW6dSpPuWahFxr6td8KfwwKEd+JtlmxkdpUf82kgILk8T//yM5Jef03fvcIywBBlpjaGm7/ra1RB/E+mzxccjEbuu4ngYcqdWiQXQ3pNE2w9VxhKaP75ncjanRhZQVvIFicDZQPG54VxKIJlL2AZ1IOyZJuSGGRIwIXxNOCt8eKLS6pFAFPGdtVPbrJQ46y6mM98D6rfbLAUythBoMSBpgmX8oD+N+4ZtEExNRMoJb6RngyZD6SWFRV0hpE9GRnIts7nGTo0GXZW6w1b1QNGXDjN7S49bqpNmSBYBX1k6cFUFVRsKS6UqNM9ttQzr7ngEKG4EnBlV1VDVCGZDWAi6Dit1XQSi0uuL096Imi5+eVdMvKgFisKDF+eEX8GLiGsNlM7Qn0GrZxqHRom29Ip9/97hQx9FePYWjZjNQJAvAoQR0Bd4ryt/2u6hc6s/mrASMnTO6FFRbjQsq4nnrH4hGyvSAiM0P3XOHe1779kmOtg2q9omwooj8gxP69crnNVFRLqJXLFEJWCChIhWohBRhhCRFs1MicGjUE8myBDpmIiLXbdkJZqW33Tjcnn3UqXR2ilDa5G/xnef0t2S5rlO+YUSrCACGlMGpKRIZ2TJoq10UclVwArgIuyEUvFSVWTK1pbEFG1WECUFNB1CjxGfWsJ/CzvDb1hetOo8RxVCwEDRzsDZ5jrZTGet08nn3JVCruAW8PA7hR5mmcn2VtKZnFModArpjlvIuJmCs5p2Oq7jrgH8oFc5BgPYHl4s9oLYo6IYTD/orDAY6w9hS6WeCl/hLGklCWxx3JbLE0UZRk7XrDktSsbruTSoILqwpOn+o4QMyEihhy2RAsuPXWKT3k+JG33of8LCQKkkY+nUiydTjITcGoZoWUccQbu2ZXhkqPo+P2WY+8q4LiSOPoOsLKFtJpCRXrXLYm+XQ9YPYs95H/pD1ChSoSJeI8bOJYJ+Iwq18fKzLDYR5wuyHN/mDQkA0l7rx8cGFYfRHp4uVWh5BlgObzDxVlSRXPjRSqpLFtp3kaJ7hMA10Ur4tGy2sDBGWPLkEBauWinEUzLMSzBoCTCwMvmEkbtBgkm53qyi0UZdOXId+0J4woma08rxD/81G1MBYwGEr+wkVRpKVhkde1P3KJjhkTuK8/ehJI9z2DaZdi8uyFTSsmqDrp+nUiZTS3BgDr99ZumF/NwdbJ3oyvSSZ6XdE/KHQjww2fGxXgSPNKNUCiPuGzM1dluLcqVg0p8JmQs4rckBZ+8Wh7HMCRs5TzPxsFgg4le2ULAolYNZF2pOUn+VJF3WHnigDChEsAS7fBembnodqhAOBRo0CZF0hEUcTuTO+xN2EPeLWNhTrLk7NZIha4ZjFK1CiRSJwhcCFJ6DO9iTKxwHLCOAqU7dfr0S0ioRgVfstUnJe87Acw314bfIjbwxGHmzicsWfOhCfoOOR9iH8sUMiKmPSSZBVCJKlUXWR9JSCVKzgGiixBL1kp7IxKp2qpgq5nO5KOpj80ULEyEquaTTUqUPJ/rHOJ+1KKKyuxnWSvFDIidviz2dEz/mqKLbbls6OifGh2OfKHsizkyqDM8g1/w4imiLBqJmnXAeowA3Ffrq0+fO6JDzZ6q8nqTbBriUBB7b+vFLys+G3DFf5BQOfgJXxHrUuyGM4wM/SoM9BbnKncy9mkutJNG9MfKEKCQxGFkJh62eU40GuuP0yCB7aDZ8mtjI8wX4ilzHLZA5toE0UY8lP2Iys5qwN/brdRDnBfkWPnJJm5W2W9VKvcGXGf3j0K/ud1yz6VfkIfehJZJNYv7Yp838et7Er7KUJQtOT5+r9ClSlYqRZO6F8yYUNb+bl0X0z+dk9iYuiJ9w9U0IKz4DmqvFGiJQU69/fqx1oFc/9LquBKziMxBZrMxawq7tVerkCwNgLMqZqTKlmNjq9JeoDmVxVbJ9Zn11oWtWfoSSblMeDE4NwMEELO8aHIBeWqj47Ou0f2Df+m4qr2OFeHY/Q5+dQ3cwKHL6b047XPy//g9GAd2+1+mPRbC+XkYTiyR8SjpzWQnZOhB4cOZZLFlbfqJbS0tcK+q+c9FPIUawfhl5kc9EdQjWSxNvLy29KvvkAc2s17PjcdLRMavNUVb4zul27ZfcO+h4g075zvTw4hMSTWsfmoo8z+hYDopeSV01euiN0cN45h2Kz3sAEYfWdm0DUD+n8C2BZLVTa1ZavDEUa0QMIjJ7yibadTnRK3KTSMt7g9Ft0eXE9YC/i8cxOx09YBVqvNe1OKEmDq/z3jJiEm/CabAIrqzuKKrOObftxl9uk5Zbakbhd0gxTon4MQMEEC8iOxtXAVmS6Q0Zv23lMXY36EXINTdEWBP6vt5lB5KIOr5C9+7raAfOEGNKfT81YfnlIqCYkHuOaW5vvZ4x+E3ypGs160By98p1+FVBglve5AuE62hEmMFMB87ebDCQhTg7zmTSR98A4mXeZM9Nrm6ALtDMtqsoTzhMKlI7b7q4q+mgL7QZHHWXwiXkxhj7ULS0sFTdgZVNLpFbLdx06LYlGXyj8sKwscyyiBSOQ3EqZ30i4Aw9VDXrwFlfAJNy/+RLqlmm6jmz/fcEKxpRJildKkQSxZXr9CT85CMnQvnwzp9GlYFMhiq4f2mTmea+sDU+Pn0zEIGmKU/95DNPNjJm0wn7SnV3E5hAIy/YJ0IFd4+rdAksoOvfExs7mxaVVbjSH3ZHtz17b3TbnTQQk9sriTS/2wPEfVP8CQK3M5zyj0bjMtW+EM0MgLEJoh6EiuRy01CZZX7sBynuzZrNqxhiVby+Nxlh9np7C3UY1+nFdSQlNxPuHXduA54nNbH29l6Grl7aBxZ5r15DV6mL12X9F++65x1eF7Nsud3Mykp6LTEe36TPQGLpTI450NNxvcxKPt5pd6CvemUTGAcUDSu7jSrGibbQxeLima9QVX/6pl9ySahC6ZajMYS2GXhcxO6YnwP2OQ6zs+J7diZjxY/sl5j87RElIjIbrIdzdhkEA9k80oaO95Ehpi0LpClSJk12GeB+ZkNENux7RdHJqoYHg0PE1IqwAj5Vm2OpJyAfjrwpdoHeNC9v7BevN0a96W3gy683+kejYROW6RyJA214h5eh+cvusWdZsClxcVT/OZMpBjfBylJdonod5BMsN79NkWdl1q/tbyMa1sA8on4pAbyZYQc4AxBNAdQ6rucJxieUTQJNSe7YmSDV86ZdEK6N3+5kYlEaoMqd/nQDlfzx3dGue5vv3pNZi7Ez8zCj1BT67Fo7o7bzKpY4RovS0Riun3MwhC3icil/gYFFf4EklxgmycOKWgj7za34KvRkr9d2rBFgwfHhsUdZRcjUgHIpexAQE/Irng05IwEj4hyjOh4H+cmg3wbxGaWyfE4kYTJcD6zkzJsk2/1hckwOs1k7XrXj62RZ9lXxzhQdHKfMUkgTgV9zWGzMxIXVk4cxAB5VImYxAflpHIV1Ll5bK06iCs5TaUSf6P+VKBL7ErplwfKH04vA+9BP3KWLSEWpQaBQPQwFHPM6cF4vA/dLvowAbFmqrFIpA2yBULxTsff216XnPVZmBRYANbo0X+GeckZBFUaKcfKuuTPVKqE4ntendA9x4bMAHIdR5FHUgSRGla1UgfKQake5SqR18vekOeSAu/vhQOkTlbVMZFCgyw94CU64Q7GBcH+Vi6GmEkP/caNmdIX0PHKCTGzJ5+a+YNE/F3w5wmh1k3QKRgVLrKLtwGhyUC1HhjKeCNQk8g8k2WWST5CoZC5BiaZBBnjv5H34C6P+kAAqVXtD1IH8VyoeodeAtM5ZKuIbrRE7meiVCUNhsxwriA9JtSNCG8nLcatSblSFAEbhr609ePlyiyCttVMDMe1KooPSX6SHvOwSQwNUujdSY7IOx+j/KXrOPVXPmafpeuUcXZO261tOPR/Vv+ZX+qOGHz3z9FteCJxiHlj/jdorlfpV0bFwxdsp7z1Nt6uq27CJSUxVKMvP16vw2ZGdavYsuR+oHb+Ea5duQE/RceZJHfuGrvP1KpJ7ql4NbaehvT9rB5iufs1ZmqQvtxGaYLAAIl4TLy9rk//XvwSx2/96qBdR/lqWJ5fZRoJpRWTJYNnikS9TSJOeYtF858PqJoVkZrGizR8RJXGefDKa/Bp/YVSzrFn7b/Df/4Gxzb8lDPeHk/958t9lwPPH0PI30OY90fYPaKD3UxMLSebksaw8y/l3xHwMS9W3y6sSSFqj8pyIzMxJaUYQb2SGCv6lJ5XgJ36+CP4dyEvGDzVNvZHjyHOdCbDX0isq6XtBoY6KvOZlnD0FrPVcx+uzN6oI39SfKPdwGQ6S1B299Zaa75iZzcVMwBjKKmwFcrtwWpdw1kU2XIkw+sd0UF8LllR5DpqpTe05bsa+x6zh1aglXLKyeR8kPxbx9G/Bvz85+TebYAxteh/i2w/hzYf21n4T7idGosGF5UxQel1b3/fVjKS9b1BPTA+ohxkyyyBqzgfD6FRtYAt90WdTZdSTrMPXMlZVyfGhxM240nIi5AGnOdiZ+gQz+tQmE6VI1yz9VZm1R2Fcbms4GDiYZzIUNJuwImoEUTV6EeIts5sZwb1wVzFo+HOO8jJiMzSr7pMr2dqm1h7h6xtlB2Wd64PQnvHNkQU2tPq6MozjXqi6/F0u43y2oZzMrmg7kIDEipxvOADFTJ5438+5SrY85C/x0rIHL+pCTRMftSHWvNzhiDDEDgPn2NNx/2cq4v5tSkiEMEZ2Vs5moGWbu6/UoqicsKfHYwrOttYT8+PQAwor04Zvumo+KdY5MtovGLWfCAYzYx4hP+FNNm0ENhcCgc2eyoUotFnBSHC9pqYqRuJHWmwkjGBaGebK6jhx3FowdSjw1ooIT1WmXn3i4ZydMhL1v7DvhK8NJmz6yHSrFiFkQB2QgDkTAI6uCvfXEhTzylAz/NSh2FaWK7xg2pIPsVo6I9nfnVD9dM5RAov4mFLfBCQV3yGUFZHBxNO6MQodYkZDkvw70kxJSvuQ8vKR4VFBWIC9I2zk0DlLFdYaFpYhz6jRztFqcgTfz/X85lr5LdlWdUfXP99uKk31z9CqaZozVaJiZVtnKh5Z/jsyuT239zPifJuy38rRKaRcYri2ldcH5iVTPK+EHXZMgtGQ9w06OEl0bQKX8kXyCa2RNUDT9vhVkQiDLgvXK2GlkN2wz9Of2MHIDoCYXm1D4yRE0gj26JK5Uh6eyDpGglL6M9GC8TgxaDqhWYtGbTQKc1hNMkBCiHt0DpQTSpAI6qn5Myaqi0yxwegDXeaDCVRkkyQhIdEulwiQdamcfKQvT6/v6KeKpKzzAXT9KJhWUJDqr5nXZzqNafpNun0/wreMYejzExl6LFxbRVjDQ7bhEWOJyZo+JCGFEy29h3juA6mPAWxHD/6ZWoBsgzmZqO37jCUFYnxfoEt8+oGNqTUYVZJvCiFKwGVGnV/bOZi4GIwMFFO4FT4hQWfCboRQXCLKUzXilkc5xS3bytlt2UZvt2U/vu+pr3uYIf42OPdpXXGuqDrP53X2aTylKw23Tz4nB5qQz9azpQjQlVE+xyfVp+8IjtozohSjqucKyS8uI+1SUeTFT2pDoZGKfQwlbymqAm1aYbZgQTZdeNeynRppTlVNM72wmF8lTIrbfixhqAYbZQHRCh/pFWe0ahLMmT7w885oCO8zHcUmLFFoSYt0ZJxkFLYJ1SNBeqPCAjRG0A84irzlMuOwGftnuC+OKYMir07RYVJc/1K4Sv7vv/m1qmJyqCqCz5UOkA6zMCzzFClpMJS854FeYhC2MESddKlMt0SL8FBZqjyCqw+ImQFS7qsT5ugbfASpfJufXJMloXy2HpvkW7oRxYO2fynyjcg11Y/JU4GEgqtklINoAPU4yAtzK+EFJBx5OBhFJ48iAVzYfEV0DQsfoaaE6RCnrpSeV2W0EfvOzyKnVETIgxLEZKTdQX+qKrsnz2NOSk6c20kRrxSyJyWDFqMIKsWGo3A20e9iRqxy5hkFsqZ+Z9MRGyQg3tftfRdTMpR6NK1dLbWBVBl+N5slrBs8rSrrWzV16Xc5KQFR1VANHTOj9nc0xY2t/Lz56XnwvqO5MZx9z9oA1FfdRJeM7fLVSr2VbjUrrzZbld3N8LuMMI2VyDdh6N7u9eMruTgScmeQSaXihGKyaMopFtv5XLGIbgeR/ZADQmmt4KRXUwUnU1hxV7rZ1NrKWrpXcApuKpfrFror+baz0s70cp28k8qvdnv5LDB1DvC8hUKqkF7NRXW9frVZaZSyufTKStRrWt165VJ193vACZFuFEUzmKf8+WMPmCfxN5optFfQzr3j/5hN+wP1a9YeC5cT+eRY/XnnaJBwkd9OVDhNZBP+th3PrjSB56xugkQS261c2aoqj8VavVnexi2lKLxszFqvl3c3LmPDPgY/YCesneNjYN/a+NGtseTZ8zELc7Kw16kdS8FetlecTjedyblY676QyqZW2tluwe04md7K2soq7OhaKmZdadolufAEOjAtxlhI4JH4tJOJ20KE8JLmhOLzJ7RE59Gq12rnGQJXr4LAKNmf0+2Ohl5yFxsl96gR9Ml71apXtkOdzv+I7Kb0IXwEK07afjdW5dW9CvmFwZnA69epXm5sb9ZOYgYhZCbciegK42liRXsxm88u27F8eq2bW13rFTqdbDuXBzhd6xRSmZ6zuppZSQG0uxkQdDr5Ts9tr6XT7lovnXOddNdd62Tz3Xw3trTMYzU4jkcMsulMHTnQCggyMFKu66SyvUw+s5Zz2vluOp910k4hl++6bq7dzjurGbg/uV52zc3n25lcJpdvd1JuO9fJrax0u2l/JE69qPItJgBUcZg0zLYA46TzK6lOtrsKty/X7uC9y/bS7cJKL91Lw+K6mRW4tW1YVDuTcjLt1dyqu5p2crkMSF2p1Xwax3nD31BM9XS+Dc3kcPiV7FpqzS2sZF1nxUml4U6net3MasrppjvZXAZW3HHW1nJrbTe1lun22t21lQwMnst2HHct08s+cZlwSDBMJ7PWSeV6q+21bCGzCjJnJt1ZBQmykIeRMdSkl3c6qXSu53SyqTzIoKlevp2GpeayaxkQJAOrJOAqNy83YK3XvOlkUQPRpD1ewlxN9tjuD20P1ux2F3WAW7phoQ/SPuao6825FhwoGH8dUMcbMWBaOwNMhscbSFnYFoUDE/1Y4gLVmDDPojyVFHuweNM9XmZtfAm4DVe06vdEasy+Z+NjfkrfT/pD8VUPhNjDUnMyc5foNcjgPfiAi9x03EXqYdle7PY702Ub05ks29MZYIlluz0aDZZh6VPsZeRMl5aCI6if+A8MZ79ox0ox+Dci5kR3djT25ADuEPmiFshP/X5pC8MKl2lLW/CZR/OD3+zWB9JxaTG2HIPTLsaWBFjIf/z1+M/lyryoLVBzwtOlySyZu8L7jC5wi5g7USxy4vQ91zgneilae4dOizIPLCKwyk/c6WwylDQqAW2AcHKDxKF7p9s/ANFnUQ0IhLmFYYiLiAhFFxSSGECN9DqB2lIx5JI+2sAd8hDLwUmJcYC7WAQqv2z/AM9yPJtyGwIkOGrO6lcC2r5sj26WFlPL8pinyI6p7cR6jIpuJrBT41hwBOMBDVXSBjRfsyNnSetyr7pXCbVxJ5Oz28j5i/+aL0keFcAWBJY7KB7rS2pyD5U74/4EPZMVwCFgxBr763v12kal0WihN2JtvxlbkpdwnOCzQACxh6MpYovRzTN6qG/EjDMci6MCvnLxB87kwFNHoR1QJiWRAxwF7v+1mPIDhQ/xtsQ34N8I5lea8CX1dGM5tEXY9+imOYEEn4dMHxqbTXvxVexy4gIW7rixpQSWRhwr6H3twFnk+OVlzBF568ng5SMtEfdcAlYHueuYv1MARYiHjUPkVZIH6mtHMfOAY5QdNvgQU90Hn2XSqeCjeNw7BoZ8MhqOZl7wZTrcWqwlFgTSyaJ4o2GqG+ovxLb+tiCqRggx0bVc+ouwdhgIsX8cDqQ/xBNIx25YEY1ifMC3bvhYXdtXoVDRtva157axEVv1H2ljX3vytr4Wvan4jwiNK9kmuouRw+z12AuL/a4dny0VX1hEv/shSoxxb+l6DA0XRfTbz9p/9VeAbfpTu5C5YMfMXpC5wGXYTxO7aD8pdvGC3R0FR6L5xic45R7M7j/9J5ufeNqTjoPBavLBxWTXvZUcYuiUWkEWux66F6iaRGAIILN2LPHjUX+4SLJX4rUZ7NziHWah7uAqX1sKYGH8Z/6dR8j0vMMQwDRDT0bBJ+sY7rEDqKx07IZAMNycq7qKUAiK9cKUo+f6dH+MMo+MoigNQw3Cn2ywgqEpcWMYM837BGS2Mrv1e6XQRVIRotnAG4bh4B0y2SWmUevlzVazXL9UQepmEBviIHT8rlP2IIkBWMimlsJMhOBuiDmkaIfFOYRnySDSFfoPaWDM6f7lpXLrR43ark+KcYQEIMHFGAKsC7KTJMiLIDwQv2ejEdhohiNDw+/jlY0Y4RIG9/s02xgFph6fwv6QrToW7Hsy0V9G9d2s7+9ulEGcMBkCcwD8hSgLz8Sq7jZQAGntXUapY7KwsPDSD0EOs17A44cnC8Ec+ySQiPT6CxcskcXT5vYJaM+5+VGYg9fXX90qFj0My1mkFksXrBcwELBk8xuY37g8Hi8uvLp1/TpIhdevw68FbNVtQyNsG7/YbS/Ckx6snLTZMMAO8rnIQQwP7BeY37V/6EwmzrGQMGFXF7/f99AY5C5yiyX7dbkfiIUu2G/oW3RtgWBvwS5d5EQ8/Z/ID5ftBea96SXlc6du5dNlMYUbF0ASfIFFNZy7sSMRugjYnheUWIofdNvxixQ2XB4MFoU2oLINpwMXYooSFBmZWn24OtuV3UvNy4vy8yW7LKqcLaM9NKNeLMME6SXPFU7dTnDPGJncrCwuIDTEA1ImLMnv+aKdwg4Op0eD1pGDhsWIXuLn6aLjeaIHv4Otem3HvtNrKU+zK5eB8Ni0XbDS0oKxY3atvlmp2+tX/a2grYlZCDIiEIiw/4Kkn3RoAPvy9yJS/wXNl4MaIL1YoAS5ZQq9pocCwpb8g6kNAaeIM+FSmi0WmeUy+KFYhGiBq9C7Zs0EP9qfDJ7LUNivGKc/7Lp36phD5lmPpPUsxgJW3oEjaODhVLvPerxA72JMF6XpFjl48IAgqM8ZjWpYL/5gSY3E3w5GB0ZfR84dypX5pM7K25XGRmVxp/zqIn/Y7y4tpyJ7t+wbBHYI1tSx32d9dBsvu+xWQv6yqH6g/8lbuewQHC0DehPCJj4cON60NXaHmJGzJZz4+ZapO0Zdn33BgAej+8FmVv9qzFXYUROJkSXyQ6Q3/wve6mg959zu5jTnviJUfHM7imorj0c95SPyS9EAanc7h8AFK+18SxJOZBjYqnB9GBPNkCNpuSTAMx4XqIl5Jvpifxdgp7xXwZJ51Y3aZuWvAo8b2xROxY+ru6+Ut6vQtrm12gLJv9GsNvebFcR6PK/rwzkzq+xu0rx+eBFIO9L7HUp59x+O3AM81oaK4tOvHWfoHLiTxaX4RcDf68fV7qIJrPAd0XnxMYgV4s/4xb5XRY0kgF53ESk/bXyPnAwWG02gIXUgYuXNTSpM2MQta2IuCNwr6JWZxf50EdhOIuqi1/HErbvtWX/QXSQWBSBJTNKc+ab/ghqyLYjKm1wDUMIsYE7n0F7Ue6BF4ofN47G7gVpdVM2hpYha4VO5jhdkWceSPbeHy9xk0f+Yl/UCwDt+J7qIXxwBzsD3W8QpiYWKjjZl0j7Ywws+X0V90G7DH/GLhHr9XdZnCLybO3CnblnuihpB4h/RL/6Dxs3+cObyE+bOXiBgQulXTP9ghkns1e/bhxg9tDglTlwbH7GhsUw+gvnzWKadWRYDLtspbWK8aOwSecg2HN5NyT3K1zzgSyU5YdidF18Uk71op1P4jz7BKHCUV7Neu1RHtZ649D5Iyn8YNNPaU38yasNoRsZWBs6kNhnDE7f7pD0Rw9AFBvpzAJBWnw1rqOyXMCXh+9oNY88BijZkdsumc7Bo3iXgx3DUKn27yPzbeKQukp+GexGGvu5na75O9N//XSySDUR2EL84IxEaeGhq6G3DPoDoTnHyMKC7jeVSFxXO4Zlo1zqE6PlYEJuWgKCGkfu1BcbuC6WLC5hTdWF5QSX19OCh2p4bkfhfIHprCfqOGbiaVDUNxNWqAmkYaZeeCmUnzoewS0+Wzkq6bPZCu/QXXTyA0W2vdIYcI9mkZVfK4C0MsVkWqZiXUa5CJn2ZfE1CfJTgXWQvF3/oywPymdBVXHuhfUNRxwhyDPN8HsRYnpxIMtB6pVKvbl094wQ5jgPobouSX1darYUL3z0x9gWpBZogAjH9cYMprpx2CeYIc1pQhEkkoYQv4bF9naj1dabW1wUHd93n4BZxOhKH+HKz6CR+UV1JRl9TolxKniDwkywacQkcRtQUjxYXeKPYW6XF/YNYem1B/AmL4r9uyCF43bBo1o15CzcExSZ0Lan2tQU+Drjn8AExyvg3uZDBf6lmFD7ojg6wB6TgN91jgzyJAXC1PIVr2OSG/cMfsm7CJD3A6JNuY1F+R7qMIPloVDhme6faaFR3LxHZYFKRB2Kmk4jwMsXwQb3pgnPL6Q+wyC9s1iLab5fUHK5pL2nilNs1YF1dOHS8KpyRF/W9ejf/c04xhx+LU9c+F+/o44UFXwF8wyB6cq2a+oJOFfoDvL9IULVsR2pBSrF0bAH1eCWeXABIOLtOyweBed1yh3FuX4qpD87ROcPUOTumxmd1SnvAai7RJVp7qUuDvYvcsyiQw/S0onp1FNilFdgR0ogAO+0C3TABChioyA/EjhiN9asVnCJrW/cqdZofXA9VbIATE2/qE84s6bBjbkbEcRMLHH1iZ02JM9PARPauRu1a9oxJ6DshkFB436KbC7R03uaMvM69zZxNpyVx0P5u+ZVydbu8vl3Rl5ZTS3uD7AV2kJiMBl2fmDwzhB/C798CGZxxrWDSLUxUHtUVJXlUuRtk/h5ZI+auyhj3WCVFxuxffyvjuJdtUSOdg+m4ujYFjKlUg4+x4jXGv4oPRYd3E382IpizXQbI+Gs/Czq4QtzuJmY5FddPB4uVIFi87kvg+TxJDUGmXDJY87ny56ZyCbHpmJhacXpXBX8nHUwRDHBuyxN32fcOWfaOveXZZIBOOWNn4rkWlhMpwdME2ouvpW9YdCv8J5kbyHlRq9KCMMcvsAkINdulBYZX8Ua5Ey9csL3OoXvklhbQ2xh+4rRKC6upBdx9rs7ZYlJaWkllLbL8i2HQmyI8RrhXT3Wby2Uj+sV6q755kD2hGlToAHOsLeZSS+zBhCLDIuyKMG11jrolnx9ZUDbcDjQB9iruoaQVv4n/ih85d8juDz+yKXoiY5xkndHlhXRqgXq7ISE8cjfFyGTCh24Q3w9uQb+9hddxE94ovo5LfaOYzhQSKfhfeuGGpX/jTzg+wong/2/Dv64PW8LtVJS5abX+4nXcvRbC7BsLCA7a9MalgHsUWkzneDnNcWzS3JUifYu+X0oVI04jLSyt7p1pKWhPXSB7KjG+5Mcj2C7GDaWoNS6ozWbDjzCfYu9Rg2e4w/aoe7wsoAebJibeeADvhf0pbVg30TGP20qnoqVl7IAyHJbg3BhW3ygmk3yEyQWL21OzEsMdSUjWISabx1p46GSAOXH7GOub6PWHXQeE2UkMG5SuXY8t3Fi89n/if37Q8bzrKHGJn0v0MkZdw6VPVJUD4O0SYoPEbOh6HWfsLsITXgcNmgDyBuRsUccKCfhBHhA4uWVsv2QNR5MjZ9CCUXGa4pfYKjHvGc6aOuWhYZ1ikTMe0PhKDuwZ76B/+aKtD9oiuICTXmDfDP/NEich7rZ8Mx95bemPxTzpcfgC2phYjvEe4Rp+oC1kVgruDoMFNbmWusErGDv9iWe2pH+3XvMGi7PEazN3crx803XHrfbAGd5k45On+bTiHbt2Qwh9s2GX75AUAu2by7dwg2kYH2fAcm7CtGGVC6bDEHeBvRuPYUpTOLE7vjvLrQSvBq7XEnZ354bxATyJYnASA7jwC/JeUa/m+GoweZ7ze1kyPrxVgpnwKdP3/lvECKKzRdiNJYVeaK2aYwKdfOjQZkNeKBwGX83lWWLoToGDhj/QlL4c/EIQdvLdmiV6E+cAgw6WlgIjaTC2LJ5oN5yfRH4jEVjYjI2bqnVlMVdRet1SwmlRDAhPmKUqIjOFjRNi2uRzbHBRxfkCJw5IuAM+8acGX0TPLXAz8SvFkxW/U/YzuBC20NLm0H1dki/kPhpYCV+GDnWhGD5ns53crdAj9NJnH+4Fn4skzo1YyIUXNRdzwTlGuJgHPMx1B3O4K8uw40sAlHAReHLfLwVYoSiSt7JkRbJc8BAvNe0VOgI5w+PFO99HZspHGcaWLUX1nl8yWDqT14Hnf0avcxm6lVRoSSHUbqwxWtAYTYyX2vHeiJpTYSnMvBrDonCphp07ZNRwwan4Uk/URFajt3z+FvAR4+vFEHzz0YjxQ1AdeThr5xjf3wuKDXnCYbKcgzw6E9I+IHAA60XEOIK9QW+tJ1nHWarDhmeZq2NyW9o6s4hb4Brco4/Hyf1NdsPqqEYswl9Q8IuavyDxlkyM2st2egkEL/HTpZ+SpXiS56C+hpj0aVe7RH7UZlCHuY+qN90NXvPHB+5yNZGN3TBdJjXXPUVpTAd/6lfFmJDeqtX3WnD4epwJJi0okY/gtRg3it1QzM7EHSzbi+gNRwEhS7j9ekxXoo8q3EXNG3Eyuo06hUmHPA7he5/iyusOLbDr0W12SqTlsMckDmS8Y7818fLQMVkbsZk+eyYeyMHnBdMtyRCn0NbAvXw2W7NbufIfcmuID+VVS1UaYRo3uHQ0kYm183DKGyZGKjXVKIVmgwnvCIlL+CF508MSxUyFsx58GU8vLWFIQYr3kbz3POpBjELufEtmd6Jx+xgjCM2GgAADbQ23Tv9qyZHQM1/nfNETNsQJa878iDVxKe3jwHc3eB4aAYmh2wCtLv3Ez8Uw3IeP0INdyMsL3HZLJjinU1q2DbTiGEeleTdCh6+/wYfF7l9GO3zCbsavvyEQHfMrKlQT//HDP+zFWAo3DPUWIE5H65ximhVHROTAd2n5nSc/1Jq+cY1XcyP67MR0NSfKGO2RnO21lHleevv9ySDQOB3Z2Hdm5OYxEe0ci2pseiKKD3KBpri52j4j/HNDIyA5BCnad74LoAYX6EqSTs0bynQVFAOmUVNllwfjQ8dOnzkiuxaeBchaY8MBMYYEk6+2Ablw1GzA9xRlk6mbfM0IgBuSPv+yckv1O4oW+qhTo4mLUT4Tf8E3UI665FNLDTsw1VxLLYvZ09OzuQelwHkSe8AxN9u1SyaDgD5eIE8MR60zNmnZHmOFXhMrn7WpisOFpv5EKO7XoBAat4ZlC1/d4tCgRiDaw/RZog95SLjVwWNSLWjK0ID+G/GeZEF4j8IgznMpok2/60ELSReUf0eANNwwv3wjGJjpH4K5SHkGFJjW4qhqk1MTSZ5Kdg/YXyq85c6s9dLrejQSh2svvWHtlc7y1ZgXAWBR0NT3oWc79sJ6zOqzz6Id79rxI7sAjD88DnjSxugZebHGrM7Yjo8xyCr2wt58j9tYRDf6a7ObqHh5f8zAC2MFe3O8dGMsefdsTfTmnSuhv9T14QJJGLjpGO1TCrLBeO0BvA8pJnXQwaBUOhstGHUtpeA+FjlITEXSzkKiAzdrYakQipzRIYMtWXIyxPJpTBIWa+Ng/W9x+snXobs3YkIKo8SpZItbVOHas4m7N/L6dyhuG8daSnDDJRNC/YsdE4B6wZ4dOd5NO5UxogRfhGtlwtjKivFaB259KPHxBbtZemHx6CYCwRO+w+bJhFJWJV6lf2JGd0sXKEjw4vXYC83r0HnnEGRWO5XP5Wz/0eg23vTRtEheTvK5saajW3a8J2IN4e3cmdEWmusJQ+aVerVZYcAEyIxp5MAHzrMI1XxojaRYxMw9gQ6ZUO1P8CygplZBmBaH31LJVUyUJ6Qa7NG3Y52RrEPj8+bcfK1FFPrg1zf8uc+9dIt+/pgkPjEzGKjkBJQM0SUJ97tB5gCHT0C2erNIlKph47M6egLON7uZg9Sjsb01ORL36SycPjnq9ieBRjE7Y8b5Ugnj8B0TdVbqlUazVq88ZyoQMdhZF8dsHrpBZNfnUBoTxM6HHc7HxvpRGmfwqpncGUjC9Fqev1rRLrBKkUKsRWXCjtUpkKLAUI2c4eiaEDbixZjybY3JLuaf8tkqL1SdnKHqIq9h5I7vaLzuomZiQ8MV6fco7/cim9kS5CPr3e5j3qh5LiZ63hjKRWHuPG4wV841t1d2YjrJRSknw8HM2J/QRsZKMaGePJ/Aoc9dDEYCQHh5qB8IMfT2D36A03kjFEQswIPcFs6ADfRYQZ1OLFhZju5ubNk2PlL+GPMTeRg7hf88KX+MnEVYruBEMqbPTsQlk/+cJ7GMaPfE5DK0Ei1BTuhlZIIZ/MdnWs6faAb/YWigxWJVp0CuGfyHL+E5Erb4M5hM5Bfw53m+iLyW+M+3vZq+3S6Uz8m/m+a+ietFSl/5DEYw7ywdUBDUtK/Pdzn1f4K3DmcefeVidBfgAf03cAUDpx9x7yNOXLv8YrVGZiEzP4GabFgQD+x75dXKRiwMu2E9AX38RF0BtTLXHt1m0kGFgraCuX0hXEJb+Pe14moqdSPc8I151wv/CV4alaoB/xHpGsI50gJfRiJ8/MfApvjgHHyDicl0gvhEPBbCN8+BUs65jk9BJudv2fOjkcE78oyuaphaMqEk+8ocDahYV8BgqG/ak/T//rLKe3u+j/tu5UrM6GeupcvvQPC/qC6Do9gpNzcum32cbTfyO5KMYFRXcxhMNJGIFlE8hvb6nLrTGPcQ9z9UToPmXhtH5YuPel9o9VeCEiVG63emYmj2HnvOp1nb3px3mgGTbug00QM7fJpRxj0yJxpLnXuu9dr2NgrNET3PZ+XmnTwMedbJ+6/Ju0bber/rp4QJv8szYQI+mrZAHPE5Xdr1ZXvgtN3BnyP8kSA7TwTkUc5tqkDpb3dke8fDqXOHoyE9u+tOyeR1lgCIItt2dbfZwpyWvCSx8M5g5k3dSYuimBejswWqdG+MFDE/GyfH06TyrCaVKzeo2RCrD6iJBRnQEBy/sgO9Uqw+CC67Pn2Q8/G32aDI/z/P/DU3h5dxesJbzTZz790Ig1xY4fBnnWc64jyDVHhjex/z1CFYkeJG0/TNBlMfiwpvQFFaAv6QhR9axLO4Xe2J0BJ2xaRMtjfmp8Br7G83FfbVdsZkdaXJFfiBdGCTRbFsNFsV7Y3qZuC1uDFFW7kyGh/zSlpHThd5DYyeXBTPlkLHbK5VNg8+n/ud3BH4MPTM/+YNefqWxcdEicvJ0IIeXnA2/NgvqwHHBsuWzzXlQ2WnXMVTb23tb2/LisMt8WED+tuq1VE3kcmIj2lkrYet7doVcSQxpc2OXxS+CJyOPn5RLiZO1T/81xNXNDjoT+PjmXeIuT1kYn7odgkLulBTYRoELMOuNPLx0WzqsJ+E+ZzqDyD9UW+w42Av9CzYBcyFEot5LT5m/w3CEbzswLT1D3DieAN6/cmR9hgvGDquBk9/fgN51FJARvKPs+FUmCV0DkGKivVvZBOP6av8OTZ/EkPicxB+q8jHlmLysTAv5iExxRq4+y/5GbCRPYgzCb+IaIGyiDLy+HZeWXgsAeuCLu4hRhsnZC45cpbRci0Tu6QNFyUQ+qUIsHpMs9q8qoQbF6WwSpM93Q0bR6S9RHwmnaZEDvE7Ca46F/agIlGOqg/AKyQGi0sqlkXxfDHff1/0/P1zOkkFkfr/x96bbbmNJImC7zon/yFak9WSmpKwb5lX1U1iIwgSILGSSNXRxUqCxEbsQN+abx+AjE0Rocys6u6ZhwlWpYIEzM3Nzc3NzdzdzB8aem8jquzdatNDboDv2/mjM3rXDZ7xhOZ9Gsc7MsdDyw+TU3ryk0tG9SuiB5oGBty/fGIWfL2kQPCc988m2b8Wdu2/8PiaNOXZC0FSWUW7eTaZr0c2PHvMsEv2hccKOzCL/u75dVH02bT5wOGVrl3vKlWHZz+aPJ8L3sM8el/gYep7KCkr9JxVh4nvUgUnbFn1xxPgne7DQOTbuDYwzPuXM8qD5Xwap7fvs6tfitypoPsp8O24A/GULxc1eXUHQvvbaMdA366bcIPuqi4u+Au4x6rHI9WDWtv77TBs28vE9j3kw1w2/rnepTKI5pgy++3118U8/1Qc0ubT7b2md/7JVQ1eQHO//nQZuyP0eOHGnbBfLapbqAfT+NMYvuH6kR0mX2ro+qS6mDAn3/t00f5fhsF575eMmVa/XZ2LC6ao+HR9OBZN83B/yT4cvB1PkAMjYQXwn9f7Qv7+HY7RSr5HdrtgMh5vvh6Fv6/lEn379uEE9pUtgzq4vYNkGFGX1g9P7m8YuejcSx1Pnt7ahk8k+HJDwri5NojlH0nhd7CPxO+uh365pXA8WTiQNfwe/1zWoC88+uUuV+0gFJFvJ7dS8PfHVuwTL+fN3fLY1ee7P/r48ebRceuPN/cnvscLpR6s1xfL3e/lPeR4+uNS//DG2nVtZPh7V/JHdVz88R81Z7TEfljihYb8Hvx/vQmPsP9g+2oQtuWaVS4e7GMf4TIGwUerMPesvXUbv3t3IfjHKzQF+PHhDOyHu2CM70CyEeSK5qUlnCcC/+LyTQHeo/7+RQb+aFXnOdoCfHE9J3v++IerOndIv62nyoOp8mDvXcJtwd++O2T8t9/ePk6d+fYuEvO7QtmfK/Tcdhxre6D8Nj76GVT2AtRTqbkexJxNVXa8ROyyuvtwtvm2iR/vDy3fkv/358tSjwbqo5WpJ0tbd+PgB0tbL7x+cQHrUV2PKfSDKNwfyt8teVtD9sNiT/kz9D23FPj5s7H03THJJ2Ppmad0H+v63Fm6f/X8JNITrN8dtHjy7tGK+nPuvNyyW204mDKKqn27XK31tI2PDw/948R8V+pRVz0R5w8/YMxDoMaPKL9fbR20osw9U3b/37H6Jdf3vvIf94M0XT5txKPzZ49dtkcbQNfzlo+u8PreXfvOcb3cvzQeFRtznIwlvzsydln/Hh/6bViU44OL8fPdBvHl/fU44+f45IX57dnGuwuGLkW/padHseMXhlyuh/s8RghefMYnzuXHm4dziC/5/NcQnVuFfrH6vDAIrrbi5YTAc+U9MoQROO7bYLXT4nc26LfLBt5/wRL9bhvwqmzcshp6ejym+sgLHSF+Q37526UXL/uLo0/2mIZxv91PLoAfbv765QZ9cOgeY/yXL88ux7q/VuvFlqu0vL6bAy+tHCT52qDxAo4XkNyL7YXfd170g8f8lOn2wPZbjGN2wsst808Yc9kffbRBccH9j7dkvJ6Ued6g6wLQhYL4Yu8Hvl0O1u+YIO+yi3O5F2yo8XIg8eY2l95vl1vC/naL6Nki0v0YfbS287tOTRg8An2w9V9qyLiSN/z5vvA/K4EvuhCyqt1WwgjKvZlyqWJcF3viH13ofMlJ+v5Oof9mr+uOq/+E6/UYwb98uef7S6xQ2JWssY95/Wxh8Ht1/GNXSx4wDQ7/j139UcHeulp33f/E+76jdIC4+/p01fmhafce2stw4xL/uDZwmSN+5Ltn3war5vet+Sf29FjgYmtfvr1sMH/73S3Qy7kQZnBrtNul6luL4r7Wi707Yv8jk/da2eXhi5VcLdZLVXci/p0p9qix3y8033f5k7Xm3zMLHnPuO5vg0YvHBsH39uWPTMrL2v5Fqp6YLMFAzp+wL7KncC9VOyrd4CFI98LWR7+f8vZiftydDP7O0blF9MiTuMP16NHL6B5cqCcIf6RVf29kX1GO92ssHw/t/w7ldJ914R7V/RrOUx31hwQ+Vz7/jYr+WgX/RMc/XbG5l7qX9NoVxd297T9WbLcz7A+V1q0KuRA7QCFPXj/Ixi838PNtvot9fB35d+cQHjmc34Nfxusz2Owp7HeLWM8G3eXbS4u9z03xP4B6cfy+BPhHe3pTTmOVb1dVfgPfp/D6fhv3rSy+vV6s9PHm9lbPyw2lj2q833Qcc0XcYnmatGKYyd/cnv96dOXmmIp3eHq31eT5t/FWw7OXmzSuSeuXfcjbyzpv5fv7+fW7HFDfadsxZvaRVn6+N/SDbbpnyaJePJT6nb/6SEM//vxQjT/+PPZgny4ZPJkInx57epRd7vHnxf3Np0C/tw35cokf9M/tMc1b//hOTEctrAnD4JcNVpkul7cLjbdpX5+w4c8drP0fovay9XErgd/donbrSTz262+TuDxacPmflKrv1wIef35vzeDx5x9bHfmT4vV7yycvwT3flP9HevcZ336vc5+u1jxRmvfF/1+Ut5dIuhW5x5L2fClilLXRUPjec/wTx+Xv9+GHzr0cO3u8LPN8A/7x549WeB5/BqIvFbx0FPsJ3HcrPT+GvKPgc5WMm5fvn4ve+Pl+kL5Y/hLBeLvUNND4gghfN6u/jTF0T5p7tyP+9lmhF5n9BNvnS1zeC5Tfipysst87G48/l2RQzwr+QK5Gok1ZETWFvQ+X+6fF/R+t5AUB/j0x/cPQhsf1zYWxmt0LQQ5vb5ccaIWdXhYn5W/MuE0+GkjGhT5W+8YNf+bfhDHl8UYXlGGueRptcHVrxmNjxVV9XU5rPfHahzH0ZMnmuqf6RKONbuyj2fbeBv/hRDCO6h8rl2eD6c/poad23IMp/mRf/77VH39cw92JvT+m4fdsYEWeMqvp+tYuVW8Pkz1A/hk7EnqwI5/I7o9Nxbe6dL/ax25pdn2xnV82d3/Ipv9GgXhA+iSw7Gl8xv8QA39683AMZTndDT4APHjKW20s9vwdcuuUfxmnomuK0k8Y+pD08nqyD/nsxt6LhedTGMO/YATiYi6FBj5G+R5IwD5IoTAJ4Tjp+hSJEp6L2hRJwiBE2bBDUh7p2FgAUaBHwRCBv4R6ttNY9QtEwCD10utLky7nIH968x+XdOVpEPz0prjkNbWjGyYsxjT6zOAGd77HtpmdjKdGLxCX+3G4L3/5vwPw7U9v3v7lykAlTcu/fL1+R+CvZph4aVOs08bP1YMfRV9r6DP4NRt/F+PvYX7z3958ktJluk/Hv+s8Hbk4fk2EZHCZr9l9bj6xre9Woyyv0yh0u5tZNyr+m0/09bzqzdufL3PE9HIccp37gZ/7iet/eaeW6ZhD/Ofyy2+C/Hm8Muxvv/yiDN7yNIq08aTWz35S/zI25sNn5XaL/7drKqK//TaYFfnfIOTju3cfBhTxl3f/181FhDB0mPtMVlHn7GClz2Rm925yCwwOgOGXn8vPwpidSQ7e/xwPZcPhb3jzKSpvwA//eblJGv77AOiMgGrlXOsbQCY/x5+XfrIvD2OFhy+/qUOzh4m5+0znXVam+9zODt3nq8wMDaEvw+r9COx9ef/bLByvrxoM2IFzw1stVW8RHz4PjMqq0p/bxeH9b2PDP7PjOf2xmb/8MmaM/8yPN9aNs//Pzofhc8+NS0Lwdx8+a0MvDR0nJLWdh/Z4f9pI4udBSrK0uNAwttK7+ZT4N+8CH8c9hKRskHRd3w+QAHJID8dwn4Jx1yUwm8QCAvIgH0UdcvgfTPk+FdhoQJCYF7jvHrHpX2/e/6ZeAudn45UVD80eCf317a08KvSXv1yWHpeswS7/Mjy+IACcm78o9F9+evPDrvvpze/KzvA6Gy2rMaPJl3f0L18HGR3zht2MslR8XVeatvt6gRileQS/rktd4BdpmHwav91cxGxcbrt590DHnd66LMUitytTn8u2HNFcj6P/E2hUjZF17RGawTX559AM/HxAM66N/VNoxrTqt2h+urtJ8P3P2Whm/8f7R9z6+KjJHx/R/fFR5eM9Qj9dFLcylKv9T+N9PDefluGoK6IrUdnNJ25cvRu0xkO/3qjjRV1l1NG3d/b99ObvIz2DzH4aPYb32jBBX1v1BNtd599c3o4XD94sfTt4oOSRYjFHI/peszyQ/fHdYJ+tv6yXgiTehQsOKoNN6jBPkzEz9FBY8pvluNF4xXoV/wuVA43/8X4Ynp/W1wDqQT3a8TDIMnvvDwPx3979fks/DIO/SsqL+oH+GaqnPDuVtMehD3+e9vvx8OU/hv5/f5/sZ9xR/HIf0vHLXdDLL7c/h39+vVnS36bL5Rf6cj/DeDfFWOj26UMenOt17V8uZy1vVI1df7mVxZunsvg1eTem7xnm+5/fh4Oiqj788vP7u1uWbz4Vl5PX4C8XTB9ufv315t8+3DZl+O4XtvvrzV0qFMAvXWAABO5iLwYPYrDBRzZd9z+UYV4dw0A+x97Nv/7rbbn8nyxX/MPlxiRFnz79Y8W+z4Ny2/DnLUagbw8BJxyrjKvUP2rlH8IWfwr2aWt+BPpyC+4E5SuIIL8hUPx9y68HEL7I4uU1GH9N7uDuUT8HeXefrYoghq/JKNaz6eBDsZJxM/633mlzWbrI6/XrSO8jZo7ifrGyrhFNhzQerCzn02BDlJ/yKrln0L8M2ujPQ39q/3HYR7kunne7dwOMZ/CBJ3ncP93vwD0u4n15DDzU9ekyED/BOEiBxKf70fjpOhp/vbkcULnLGzf072A8wL/fhQ9xOl9+F/fX5LJ0+mV0bxVjcGtu9zzHTAD66N0MXXjz1589wC7HlbxynJ5G++WP2fe71d7Gct08ZZc3mFJpdxHhpyz/JNx8mt18cm/u7t8Zd1Bw9ONhMNSi0Llcu9MPX371vox/LtFpcTZ4ZcX7K+RnB0dvQ9YeXcYzGEbXA3Y3t4g+X3Pvvvc+fD74rRfuh/59/+HL4+t6fh3jUgaAdze+lJeBV3YoGaowUwHTdJ0WjZKowvl05ovALjozne2oSNxHZyv2T/yepYWpauQNNBXTiILmLJGjGLCk10CKtIcTgMJyQQH7LTTvT/25memoLmYWkR37VCJ2JzU8LQwrskwjsmLD2CpJh+pbkfHjoJegtjG36wBnaiycI5gXC0uUlmV3EkR7jjgquJnCW6RYdAFDnv1dOEGKSWyoQTMX/bOGwdaqmfAkB7aBrgfc/jxPVDnK7EMyOQHzRM+OFWFtYTx2KSBnvNxTztDWxiaBl/SB0WTlZDLpm9mUnS1AKZxVWFgfOWR96t3waHgTYSDIA0sRBW3Bi0yaQKrTlg/LJqKcbVkcc2/V4SgSF4RMVdgpIywLbrMaPlaype1iEymdqq8hxIFtsz5k9JomUcroJ5KmM+akpZl9RCymGGIfJuY8RGDaADYwtlk41CxzF4eBNgFfe/iy42e1E6wqH7GtalZMFji083J4V2F1Qs837fE0m+oEL+Jy7UGSQHYVRWwayTiw582ORKLZQdpsKSQ/kDKlrph2r/hB16QkS1JbFESYQ9A3XLnKUGKuG+ZWAktoS7Fw2QfLMM88hJCdCqm0uVvbc8ZHcBL21maVQFm4q4hKyr3cP1YnkK/tuDQhKVlzfu0TheZnUov3Tp/hUGVCNQyfs57fDwoTkEullbHVftUvmI1xluVocYZNr3Kl5c4Z5ui+5pHtUL9U5YmGLHde1p98B6sIZlvPnRMKU1hfElv+CJuH6ojD9grG7N4GSxgn5tG03+f5SZEZmm94G6DPomjJ+QY+wHudAvxzFDtURcB5CbomCXqnRbYInK6XBsMQL6dDLTxkeoWzwQP+aOUWLw8NxhCvKqNCOtqlGUNIhWLgPJb5/UmdnEReWmTLAC67nNBOhIlVcmVuTbw2y4E37CAEprYsK0fbOSC/XiJSmRMp7MERwSRpX9Y2yLM8VZlnu4ewQ7EuS4mnN/tdv4VzLuuLY+3DVJsRjO0huuPBJWLBVG7NijMhQ9axiCG73Gb9Ljo7pY/E+dA+RwByUNrG2FBHSfuLbbZoyp2bTCfHPFMoNA7pkCfPXcY2ZpIvdGSZhBuM9Mx2xeXHzbnmTwGQzFom0xPZk0KHOyNneBsJeCgrhLERuYMGAq7RnhiPbG0figBpigQxyEpZgoTNbBZOSwteoEXvbpYlNC9yMdEiT7bhvvX6gy7jbKTGVQ5PWxHf4smxTkrV0aItoPFJmmegWidqpLsIhBD7IEbmAthEM1OSKmifC523RVAeb6cqphqkKbRLfb2dkmq3EiRV1E8Hv1CADUtgWsQ5Yt1yrdFBBiFH83bRYDUhuk2vlVCHDA2WA/XARIds09sB3DhyLzFgb84PExVaL8W0h+soD3eH+SQECi1CXYokpB271BcK5to6JmJNvSdXHpxZIVKclrGPB2dZYgnwdFoTEr5rgz2TQdxs13SZXKyXMapkxsw68tBxx5wlFKUIiyCCcMYdODBD0dZtFtoG3Aq6Omv041bF8TyJmV1iKmKmWSAmQJwspblGGlbfD/Jp+YYzX9WRGE+bBbtvIHqGhdB2c64AsysGD+C8NbqKbWYUzjQslhpOWxkHPpPoVtio6V4P4Vm67m0Gbk4iPiUJrM9F5TgnKYc5yEiSAIslTtqtk8fNYreNkEQ00zDazDVhNakRlVIagjieFofjGfXna59okfMeZVti0Z/rXXUw92mCOkux3QucsjjV03JjhlQB8evz/HxUebXHdKhnjLo3KbsnbTrmp3xubGR3thHWZA3tYIOA4RUSnHhjpVn6MWbr7hivG/iwiFk7MlbFpuyWJnGaGdrON7x6psXHs5gddO/ARxg6NctDB81mtF+h3YkCYOi8MabNlCPJ+Ryp50dOTWtDh7I9vmd6R9vGHLtX8JjLWO5UB34fT7DTmSFmeL0TskhtQeIA5qZnpxC24KJdDqyWXlWvDLIIRG05KTNbQreSGp+SwgnoRXbm5hDjKFU/G2pR07DIC7kKGo+agWIKqEUjyKir4HR13KfWhk4ddFkquaRzdbroasRJoGaRIwgJtaUDlIeEAJIYrgsqFrNiX4Db/VSmTp7t0p1OY3pEZfkZ0o3zljKoXGr2QIwVrSImRKamul0GSJQYa8dYE+CCmsLOmSkkDs3PacMdN3VxyJeHmbTj9/zEpVgCcupKAhV0JafSYQK3Kb6GJnkDwB1XolBdGidhKvhLqTqsZxRgHGsc9ufyniaNquVOBxEqJ4vDqQs2VQ4QMmoaE1ZcWPpitlAbFF7SXoUimH08Sz5BL85yINuNHgk6S0dRxOUBwTQZlGPz0kDwydSlUmqFz6vCCmq1OZX1nJBTWMOBEyTuBDs7ncwOE0DLZPwkXWU2gxLAer2feovCSFZTAaim5FwWz1NrnViGXkfVsSfFbGITGFrv0x2YrOd0ah+cc0dV0xx1ZHC69NdTB9djNjsHAMqxy5rnu+2sY4okZgcESK6ujzxPAJAzh3TIdlYhza5NoloKSdSGm4ML2aIJsa5c8Ud21Yg8FHRQhKqlEA4mxJxiEAtZDlLZOxMUnyFcCHCqyIpqNNN0c+qRC4SeGScGQ+fFemOe9I3FdHsGZXTCYqZZvQS02YrD+4Wabyg2nQICn21I5YQs0KQuenrtt0Eyg+HGgjfMRrSmDH7oCqEVt5o8q8IpL7sJPjfQ1ly2R2rCzCELPbir9cI1JZlaO5M1c2gaa1VR25XVEIs2EaAkz0xyu525FF43q5nCzxsDleZ9kPir/tCRdZIh9ZJcn1F3a08VxY8g1FIxhS73ji1Nutpoz+02mBtQsOcMzGuMlZL6TTuluQJzp74NTbu9RRzPdDRFZ1q5XW72WBmIIuzUYjlxktiduFNSq8SMQoGUNwvd3nf7bA5Kk3Rm4bnWictlWpyqxoi83Sz2xMkEA5gwNqOOb2s/TWKZXTlRZmEsaNeNIpGt0UDOsmZPu3Y3WzKJ4avmbm8QWybe7RlxYuuThE9JHufA3dzab6bbbBPU06mSo0sd9/OEAL0kPhwoa6nOwwNJ7lsZTpFUUU62SlOWCc/1SM0ZRIYPKX/gIsESm6Jil4W5Y7CNLeT7hRVJRys5I8fMn2WBoHILp3abpt1X0oSAVCxp94OBsNRotSHpnF36ZXpWD63m1+CxtifkRIvimcPxS5sRfAEH4r21mrQBQ1krnjE3QCBZDaVO6K0wJ/VSFadzmhIFdJvFPrJxj5VJg9XONtDdPOtBOiK1mX3aNH28SgNvJ5gk2za03/GhlbELI9EOmkOKoqstcefQw0RSN6QGoMPkvZpL9m51dlbTDTNfdDJgDxaIM+vjPYaDqA2ZK5BRDsNwVtrzgYCXBT6HHTUOWzmTOcpV8yzCGED1Fcqp8FRitlpZ1pS0Uzy3iszKgqe1GK42cmulm7Y/EmFDorAug6mvbom2X3sTsz4ujOg0UVNGPksyVu5kZks13B53idk8b2DN1lO4wwVMOR+3Wk83jTmY3EI1zKpJC632EjzjhPOCY7CdJy4Jkt8hBpwwq+12g6INpitoUXLRVHeYE6V36S71w25qJ37BEzSdTkKSVXHXZqY7h6TddV7Z57ZZLZUlI2x8H9/yVZwdJYXRq/40DM4qwNltn8/XtkwxZBTuA4+qZuycYMK+jNeEic53QjCvGmsQd+lgIfsW4uZ5sbW8fivZWUZ6ulNN1igdzb2A0BuNhKG62igYQcJHLsM9zYUxX8Yw83zopkBC9OCShUwjPMzPSF8zIsoFbY65DCS3oTKT+F4yeiwMeI1p0Z3rZXuaL4V5a7dUySquHBYSqJrTQB68DkEsmMUR3IDgiikz3fd2EUZoHrnLB7Mot0RxulhzfBeCQBiRG0Eqlm6xb6cGS0PHc+zZUirsnYHVO3cddt4G7c+7eC97aCrQp5oJ8g5f+QEczeZSgzD0Zqmiq6o2RWyG5CtPMaaomTLrBtA4S82741xiFWapG8tlM0fleQ6LaDhfKeWEEzBB0h0XigrBO1R9uVkkc0eIdgf6PCfRbb10N1yFktiWUbMDRKVnlnagAKn7nLPbigzkOQ+HcLo3TuGmBnWlFBFTYU7SRF4lfNxPB+Vi5ZuVZGWKcIKx2Z4nBqdk0NrbozwNTJhn9lodBK7r+Dij28Bh7fC0KQuWVlAUAZN+M88AsNBDHsAOKZRu1YphlQY/cGxYaDtq2UcRE8IroD0s5AO96fO+NwQzISEC5ps1pmb6Eq2Vdrne7LJmpjFe5a+k3iyl5FTuj93cYMqtEa9heMtuNFqhyAjdrFUOgFLSzc0aOGIARMH71YIdzC+jUujBmpT2c3Q7mdLVwLB2rhSCHCFoAkLLVN3SJYtm/nFXnFnIKUQ6joIyOpkJsquqvS+hPiPkUXowYBgN6JCBj9oaWXNb+DBbHgzV8LQzb0+rMt3h5yDZOjQIgmeCMk6D6Zp2Bw/CkeOYTIKwzsg8Z/qd3Mgig0D5sUWVWC9Pi2A7PU4lSEtSVpl25+I4Rw2+SiJRm9aO7rVwt2XdekYR0wlraa3pBtF5LWRmi/YRL+WYpDhHV9amjOs3dc0fkYp0AaKNZ8Ic4qZowe/tYsOuvZVwrgMA4OS5fQpLZTpoWHwVC7lTHgsu3yhwpK640A5MM9qw6NkQoXOZU4dz4OplJda7fTmQbrNyGECDZap0LAstshylzfwUBuiSXfba8DBvmnXKaa68LOnFEWKwtjcZtFFharkWa5BOYEdR1d0a5rV8vYs50iUV04HmJmpHpAlvmelacEWLPh4pLDpWnUXKSSCvV1PaR3iJn0+5GtH9TDYXLMn4RWi5QnEQJgFGcFm1iVq0oegYTndbSFzYypZB+dWKxYUFniQuv3cB24z2MGzwPbMbXH/Wjyq3Xi4qPlFqZu2dtdhP90pazSknLLNGdLrT4UQ1265rK+hMrgJQPi74wNAoPIJIDzNbLgrilKa2mIxn7nK1m6ELHsQFg+JcYSsNZtowB0yUaGEYR/Eo0DCUH3btsfTCo14I3VY5INoZZnfldB6d+WK13JtwpqObrRDrHcUy7GxwgsU1PzssU1T1kGKRmZpvBUIxYJUPZ89DBzUFgPPaQiNvrQiEfkitXeit0gVb6PxsahnOfr7gp60dGw4tLsuMyAMzDTQBYJAybpDGQfA1fQoC2zSBjmx2sCoyRbfqRT4G+z0x4xwIVyoCmM5NbiX7ExewEK50QfCosFizsLTY7HeoARb1zAxEnDSKdU6h4AR0+TMrV8dDDlDHypPKusrzXWk6eqkH9hKi1XCYJuzCX3aKp03ohALCSm+sLJvtQDhfbTthUxsgQhGTapsFCIC3IABQ3gpYAwiEu4A4/qQEah0ACKhhwIQf/vGDDAHWDpiDgylvEZOWkoEgSLezHTOZ4AFA1tpg2VHApKiSoDvlGkBqdQ3T2oBMRRI8BJZggGGTvZIBhzID9sECmAIHwNAIikX6Jjz0hyW1DfLpoYNpc6FJPeJ54gzeHShg0/lpdUrCwjD1sJm0BwKljhbG6PFxzQwGzxnp8tbqVCvJFuT64JtaBrh9KWPERDXFqaOWhHZMZCZMCAbBMEwHW9H0Mj/HtFiex0KmmK4DoMURPYNiJ6hteiyXjXCOticY4Lhyb7InHzJP7ikPIJmiitaq/XMZnkkDIbLWOqFL5chOzxAzs3JTrAg9dBNysWpxnYvKwcSvoH6zLIH5qotZWMmyOY+fvDQmEYlZNs1OMFAfm0WbPegHi6Mo77G2gKyQ1/t0FR+nnINDlosURtytOXFFbafltFl254l8yAyTaDXYiJFSnqz7odj5yO6G4bfTdtNIMvJWF8ktlsw1jR38a3pfZ4A/9bAFqa46dDsHBMSBhrb7sJiY6JLCXWOzwcmNlIddIwRHYAYceknzUDiMrMnBZRrgyCgT1d9rS8JklZZdnBGH3qopwswlOliKqt+q+mHbFU05OVsGTJK7o5YH9nZb7SGrWxOGMMEH84sTfKb3iZjHUiswW57hHSfoG8JYs8nJJBuFljnAYmK9WO+jHRX0MUchPXBWidKJF+E8XUknNBMtXdkIa3fXpsgCr9aTdr9zmhQK9y6rmUK9mG8j4aDU6zgIy64d+C7OsDlBl0kke9V87cz4wNRbfu9t44g7BTa2BegjTJYIQdFHtACiKozU8+EARi6hb5b7Q2ud95PsTNShWW03oMjPKUFcGKaEDYaJxOYGzc3I87RZ2QbrYHpMT8hYO0F7OoVPPdUaNQfnBGMcFqoyuOuddkZ3GzsyVSncIvv5hFwZuwV/3mxXM4GDokqpu/iw3AyW3raVDlTk7BKuXkB6ssCn4TFGONtBVMlvpmf2eIZsVQabgpbVTgrz1uGCLQkP/I4rksID+1xnE2y7X2NGPTeV/DjoZcCyynWdMVqYrAu3UL263LpWskq9qWjAgOCtsqNACJUPhyDII5kVzWSenw4OxsFgTo2wK4ICTXyz6pKUAfGKxWVs7u6dk7I6da6YafGa4VwOVYwsmih04/ZIUyzsJNxuSrs52RZeeLWuSo01y5q0VTNucs5Pi8NUwEi7lEzXUzb8HkQk8pziXiM2qcwunbO5PfVbtDnhmInX55aRa9Kbzc6Wul+sDrt4mL5WWGdY0m7BGQecbytrmDLOK7EKKYfdyHZAJDStrxbSeY6C2UwkOitay4WpcITvEgkbbrypp4dWwUvOcvAFQ8ukq64LLMAAVj2s8PAGrAfXJ7LpaMIGCxVkc2zFmFm77hF5FfVCbmwUq4r7uYyFDmuqmD6QtWYJwTVdE0Ut0bcXzHzVNkofq4cTut2Lh4OQTPnak0SYFS0VGtpm0Flx4g5amIWGv6N5TZ4TGuFQ9C6MTL5dLlSudspTrKmds5OjNcnnyxOPGLsSsk3dzgI8lqF0yfRZptFkijcwYWlqey5ZLkOWId9Undp2ne2w2xNlbhC7Ny1iPT067ITLlp3mOvwJBRaeae2JNTKt03Y5ORQdIzNd0LilNLc21Zme7v0Wipiju17xBWH6cAsl2wNI52VVGScZPrLG8P9kr0rWUajBUlmtaX2zggRosoHRkq5DxoripuUz3/D3J3cJECnIS6l+7LayeoQ3G6iHw1WlKzgUiAcGi2V3EPFTs6mxCT/ziGiHQBbvrsL4RJz0/Gj1+y08sC7oVrRrlozkIrtRDjt7Yg3u2m7FR13K6LqpFf4KB3M+3DG6O9+cciGouZVBbTlWRGOLlvDBf9zpwLTojiE7CbeKcl5ksxkt+DU/W6iG6kFHfjETVSTnSSkgurZs15YoqCt43R9nPtuuVzKIbWkBRDOooEmAEYtBTwCTrDwxXnzIJe8gCsOkb60LOcYV0kF7N2IHnqWHchMO/xT8vFoJlV7uTs4yS3cVmWmtxcCZiZ91dR7G6UrDVCrD1oMXYaiVm3f+HiXX+5nWMuJenE5ZYqaasUuW+kKMF6fazPEdbVXdQTBOQana8GLbbvClHy4NxmRnujar9khpBrlLLFazrt2cJiFNu7UpFbwTZsTivF/OF3InnE+G3qZnwSkUdo6RlrDmwJw8yXR7sN1dMCficAdYosepmhdPjmg7EbPS3uyUEJnOXVye2Cc6L1BgGJKQOFiH4+bTnsH9VYSvyNSXKcwVdpG6UHAud+CiG1400WADNUqzVlaoFg8zL50ChN3GU7eywmVLrxpe7Gdb9LherqeiznRqtGD9nBN3NL3lp2fVgU0FzGTO37B4G2Z6mWvYDs4gyVMtMebwRrGmi53Kcoa7khI9CjfbQ5aV6LpWuuMODjYuMpHXAj04pssEaS3e3IDb9WDeh5vj3ukkY77ssgSdYtVM8Ay15lLzVAUTKs6jTdIN03ySC5t8v+Zdv2BWCOJhDqwz0zkNNIvJbrlrYK3bn1dxBQz+28nTu9WSA5njoaSHqSmeKnBHN+YiqpkyVtAVP5ik/hxaz2YLUzlwsTcXLRSKB8dlN52sKFxbNscaVBLWy3bdjuudGXpotrtjJ7eLZQOG1cQ4yvJsyc5O88pi9rzHMNJO9M+WXktl3yKhftqw/QwIVG8jFviZFB1I1zqpFbB88AuWGA5BlZJhi2YqevzxzJN0cRYB/zw1t5janDmjyvrFxlutu4O84BZnSLAshz/PzCozFhbasRnlWXjg2mWczrigg8OuL+q5NFvV2Qx3MVjLzkXfJ2FI4ySIQuSCPNsldtKa1TxKwuo0bfbI3N4jxwBcJPp5Z871OCoOKzn1B1uDKI2VEGfgKdkZmUBmgnVoERkDcV9dibOoWHRlwSwicp9xJxlTYpnjgN4/1MFUAY9djjTHNpnnNCXTIJ7nSJesZY6gCK0y4ZNhp12zEIrUOjcGI80CGy6sswWcqY0NhsmMgGd2p4lwqZoUlxrOYqXnNWTzuRHYxMzm0EWE00tMOe4WBrQNBlt7u4kMQhNcnhGBrUFOzxuzD/ZFd4YI09LCXWHOETpeoguqSwSxw/VJ7+N6l6qBtFORSgWPXJFTql7HGoDIOu/TtCVmdFHOlos+584ZabuQW7jhzod33ums4041xVPVTjO27xvNDzvIOEWuT/HFZkfAclnZLVOspc7K0enJ1ifDIwVZO65qBxxFesVOGHgHcqC8mevbZC/7Tggce2Eub1se3mX7WM0McGXVUFhDZOueKc3D1CPkwK1P8ha1xhEVlwjJWzb8SdwjWEKTsRV76eh7pckk5RGIWsk9RNkTko43Az+81lozOiMuqGBr68rBbiM4nkdY3JJqLEmOdU6JiFfdg9UBMTWo3sU2yQvmcGLqaYSQB1qa7nUxkxghPmlbsSSPULlJS0iXdF9dk/V5w6HWMGuquMgXu9yXiMZzjAMNwsOMGU5mGI3WrIjwdq6neAGQc87H151+6lkfXqfL/dkiycO+XUQnBz2wWrbQtoi644N5a4uarScRSsa6fKAOsJY27n6uISsG36yq0HAIgMOOXcwcuHG3CzxoZrdXTjkvrZRDvTpUXLKS4KQ6xwZ3Pio4EArr0FjVlUbGwwxu5/B027l7TG5jjZivqihJMkxbhthKX7qRUK+6ye60ha3BxwZZsGC8wCaRvhQRRtc0Uthupb1akkzfHPJmECJodQ4iB4tt0sE8/IgnPk+IgbzWQlScbIrWSHLZSmvHOkEr/JzJO887dgQdJ2DUTad1ttJWcxbng9UEbRSuswCogGiyBllY42ll0U1BOa8pdgUtnTqTV/Plbm8c9tw89Xt7ZcHcdOMfZssQ11WU5mosICpia4tTBI0ZnypCS/I4k3E5iJmkOKisoNXBAtQsnIA8rEiLEBf6ybmNlgRGh2XUJxp55PUugY3AQaFVn7G1xG21c2c4Ih8BC9Wlu7oyYGaqx4HlAgxQGXVNrldYu6YkQA91stJKTwyKbQPrDScGJerziyO/puqIX4nMhi0gJuIXIaq4wqGImxUa6Msd7p4biF6IoLXY92Kd2byI6K7CTQhcQVF1u+tjc88mvbOc1/UipfJs7tuyBUsL6aha8U705iu47I/ETstsIj4OEwM0GaxxrJvJ3kQfDA5MWEYVJq+3EQceCwbjAevUsbbkiq20EbVhbtmdyq2/wE0rtocZDDexBnBjrd+yMx5zDYfzj1SigjoAs368DgpJVGuYxaYmRORzdgbCztkr8MHQgs7dsuZlk5KNeR/6G9vflX7vTM/rHMkOaruuLVg20H3kT8TtMdKVXLePxFyzV6nTc4e96JwmK09r2CyhXK6Vd/X2QEypQT0AAAkFS+LIDL43lZzhuJsH9dETwqhBUUB02pz3VxYiGOuq9VEGgkRup1czNgzsMmP5Ukn2oLDMNlgNOtBxxraItGs73mqHzmWVJiqR8GgR3PYoAlOeo6BDNge5vghjJz9GdG1N1y53snveibcrp8QROHLXsu4LUNLPCTXTRJEz4rXGxVkKw7MM96H5wRK17cqNKIbkFczJ4Y0ATVtDcba+2s5loixi+Ri6ZZY2m2awFgeDShqsaNdIHX8QkD2Mz63dstkEVCkhg9Hly0si81b5qibZvX/u99Ng5VPrYhfze8ivrFmj7HCitgD0JB4UaVl2zXyliNl+RhpTjGZKba8b6WoXBX6Dzqu5zXTJMkImjDffl8Qw5+rhZgGedusu1+ebVdgZi7Dzc49BC2MdsYhXacmcCj10j4YbUzxV4X7pbFpTnDS7HRakUjejydJeWrupUskrmAn9o3zgaXe3OKOx0pOBMOvPIDvnMYVyGpygHZ7raBFPpcHf2QeHItiAQQQIR15VeX95sg5kWixPCr9OFDAM/E3Ho1K/BoH26O1TJNrs9Bqd2ilXnUyQmlVdkcx2bF4sO0ctLM0kVRRXrZ1KREXkssUhkneqUM9llovWicqQjpfuAIXEpT2E79axahGl4CsTa6LqkRxXCySUqG2/Ycxky+J7NHPlIIem25ALUc4MC7xTGDvgq6B2yT6omdlCPCc6imK8VC2mDC5JpAdO3SPQu7W2m+2p2GadrSxkiw6Yh+XyAGGJepRPqxNWB/NlK8WNYnh7k16X3ib0J7TjgRi/cgpwEZih2zubCbiKSisMhLZUW93DDZJMiaoevG05S6YGpwInd52Du7KKC2LDiOTBWZcyw+HwkQcPwZZY62sN2MyW85ZF82OvHYDTEqUPRFmdHSXd8egMShBRb7bipPUNqY5gDzG0pWHQ4Ew8Dzbr/ETj0QLb42iWcrAmQfsYofcV5Jz2cbBXSnGn76Ez4Z2xAxwRWlM5zCyuLUux8EXU443FsjiwMsqTFvuuAcBOm5piuZZ6lalBLdvvFtB8XYlHBWGVDHDple7FluLax50kEntygyxjK6/qubG1Oj1fxVw1d0oazknu1K87FaBjY7fCOFTJ8MjbCYbl+TIKIRpK6hrPBNPVMF1RpLUkt2R4PGzoAtsUO2aRHf2eWx6ELgMnkS2tiKllglOPlMj9Xom4euer+MzjVdlVj/omKxtQY08dcBJox+5oswfjw4yuhG1/oCdEx8XcSeh3iwQQpztpzaVrosu5VAnx7NAv9+Y6PZgOORfE3TZcTbatgseSxXpi2YFnndxAY7ZoJ8cSKM1hciLgCQaXFFXs7BBFpha074+Ng6FI4m30oihBix+G0wwAdhUtHfryTE3hZZ74GUma0jBZMtGOxYWGNSsM7kIqbZxEgY+keUzkvQpzh549nWiTXjGKJVgd2/A+7wCtfeCySWH3kbLdqvYasq3Bzo1VQj76Z1YVkN47krBhLogjSjhQOAiFvFYyNfMTO+YXPR+pRbU19Nw5nvbl8A8wx2DajAfXyTb5xaAz7A0FsrMQptokkerBFjnLJ8sjyBZRdsMknW7izZn1UhEDOdmmB1Vv7qYqPo3KkrY0CcljeFZqOnaIjaLsFHI3mUgVNoEWdogtbEtcVJbWRaLY53GUiNuz0Z8UcbfQ1aWyrA/CAY+PtbX21zbLDoZHPEtBlsoXQZEu9hQVxPLJLBabhati0UreTcQZvy2qo02XaethrVomVHDuZTcBj2idHF3JqRbH4oAtJotlVjVTV+uWOzMgF0tPcqM286igiTZtLa9YG0yzXasB7WnwDmudWdLMUaHSfVa7ReKweEUY3nHiwocjORhFptTaUONlzW5zJNfGIMX7atMvsn5ZHJaJYDoYMLjZTBSk1nprEbFGD3aeyLL7wR3WBN0PUHhK50AwnXebHWRP17UEhSF43O313jILQVTao2I0m5ILV7UEKLwkVGCdnsi43M8RGAOxqWXre8xRjzMQZ/0VknvqejeYAmdsO9ix3IHoW3eKx1thFRcbYM/MZ5Eg5OxAked7ctMusKialgWm5J1XLMWdNljhR3FO6SbP7JPBbzxRe6+acdLqJBeb6aY0ZzxVE+xqIzdBzdNraRg6HslN0bN+Eo9NBWwq3Aho5dAqYjo0w2APZb42z1s2mcaHAoc9aEZLGElzWyDX1ViOaGpqMVqlpiAKrDhanLkOzw7eVNnPRRWTSH1SLHyDPBrbCYeHm3Bi6wbZwwtu2wMlszUVCE+mqdjJJASX83hKH3oggHSX64bf7nqvIUmw09OpUHf2sU/mW2FPlnyDMcBs76SMHvaIF/AxY+TLIGaBHWiEMycmsIgnex4OoU23L7Bp7sUduzYQURTOC5EKqTBYISdrpearxUoojFAwwvxwCvexF23WEmhNk12B5P1UVFxsIQmDpcBsllZdNL2oxrAGicaKO8XgotnCs2C54BrTNFT8BISbZc4ZPkt0UdGtV4M77yYbVCh4jZ6zC8VL0t3BPe+12fqM4w68aSIgx3gD6+0tKGCK41aKGIY8i6lKjzjNUhu8BlFMMg6NKabtdkfJzBFel/fAbs+A+oraOvOO6w3D3grGZtdw5wLrybXdbqTaNpTjiVivsjjIwrnAhC6vz9ec3HS0WnCFIWrHHItm21rL6n2vL5Je6lchSXb+ti7R89qVsuJsKInKRUQnnQFrokuntYjpBnCufGpaRdPCSMF2XofhIdpC6UxE4hmGkIs1ES8MgKNt52hYTE3WM1O3tu5iRwnbcgosArzpe1HWoSjImPCwgCeiZepsngE+7+ZOpmceZ6l2pNb4OR0cBEd2SUnFPIpW0GI1OqLCQRN3FO0ES9VPLDOoHNOOz75XbWDN6Np0UJXbJSDPFA1aLRnm1E+QlMJrCinJ0/RYA5YBaOaiNCZZ6WjQKTCPBdVp7BrCgzResnMGiyMhaptlN1OLgKjlUOhIPUe2h1PXoZTokBjaVmEM5LOja+X6Ke09ikFy0W5ZQ46WCihOFxGzATl4K5EbJyPLKbneg2VmwYvdIgdnS3hrr9v1QfU6QWnUYcZlNZcTT4uW7Oh66Mb8gJ0tvRN8YxFHcaAdmU6fyeBKl1nYtKG9GaRsCUoeqRmUzCtLfpcU3DbbchjfEYlAbWyc4HuBajQcSOuIPtSUjgNAQ9C1QgZRkJto0OEKM+UG78RZz2Nwg1sQeFr1a37nusYM62S5z51NJg8T2xGhrfl0Es3tjJxIAnFASS1FF9t5gAAK7kr2qW/LRmpsbVb3cXAOHRFmoQbrB/Xe7bbVmd7BvHPuGriwtqvBdZkxYU5ixtI+ipQ2JSPCOe44Fihw0KeWB983iaXYE94h2SAuQZhrrawThEY9kle7nlgdcYIdzJfBjeYkpdbCZZogeAWuqYTvE7DyW3xTiIrQgK4zLXyNOIr9vAEavs45Kb+hCHtwwwkbJjAf8xCQwigoIGzCB1HUIzwMd2zMgQPUxW0QJ70ARzDEsX0IJQiQgEj0EsvS5HaW+fnnKN3fwH/9V+jXm/LgJze5+wX89Zqscfj687//ehOE/0xEzTVgJvddP7wLmLlDYioDEKt8U+gvA9QzsEts+c+5+8Kr+4u29dlSoC93N3zhBY2d3qdLv8tMcCHgOeoxQGhA/eGnN+/+4yHW8PbvfQzz2/+d/+/k7ce3wz8fPmt5GLOJ9/7yazL++9ObH0ZDPg5PvU3Nfw2fHmOmH4VQj2n+fg4uyX8+XKIe/3zw9k/jbTJ3YZk/XxPL/gPB3M/C2m+juB8o/5Ph3D+9+fvNJSlDNFDzOLL7LlD2lrZrhDcBeTZs4zgMoyCBYTDhkbYNoi4ED8675wyy7FABSJAegbsISgUuiDkoaaMOCSI26iLv/olI1LvUfWOk3d0Nfv9QKKqd74sv/zHwwBkvSRsY8cneD6XGL0Vx+b0e/oHh8Vv87uPj3n93uZnsf60VwbhcT7I20L+++zBGh39Rx+wfD8G5Y1uexQ5P8301ErgMi0FgRzrGJAcDrdckCTefTHsg9NPaLgrtkFc3nxTfCwdRLwfkiWfnnlyVQ5/fPIqRfg5zzRn3KHR6HBHDmM8+j6kt6MFKu3DhyteBD1cW/Wkd8O7jbYFrHPM42icD/runt71zvYXsy+0dCoL07TKe78te80NeY9TH8o9ivp9CsIpyC3HfnA83n47peDnOi33+O+P4kSzdfv+B3Py54X2nd356IVkI8jvJQtDvkoX8iUwAL6K4pgz5r47Al1DfpgxBUZh46fXjlCGvsdyvsdyvsdyvsdyvsdyvsdyvsdyvsdyvsdyvsdyvsdyvsdyvsdyvsdyvsdyvsdyvsdyvsdyvsdyvsdyvsdyvsdyvsdyvsdyvsdyvsdyvsdyvsdyvsdyvsdyvsdyvsdyvsdyvsdyvsdyvsdyvsdyvsdyvsdyvsdyvsdyvsdyvsdyvsdyvsdyvsdyvsdyvsdyvsdyvsdyvsdyvsdyvsdyvsdyvsdz/f4rlfiGmEv2dmErspQvYsWcXsH/KXXu8hP2XXxwc/eWXMQLnRVzX4EqSgiAEIl0PgVCMgH0voFwcQREXpBzUJREPJhGfQnHPgxGK9G3YBwcw2HYpx0NR230J9W1wJYij0EuvHwdX3gYQ3Qb83P08Fmly9z2zy8evBji/vf9ROdk1GvnNG1pgbr7cvP1dgVDoKfT2DTcVlizz7c8UePvG1AagWxo+j2G1798+Dy8DPjdpfipz3y+AgbTIH0Nt7fGS4k9XMDdKC9/7FNfZJxi81IW//fBmpkwlej4S8X0h4MeF3shL5tucnV5IB4ch5mC260Ew6hM4GRAgAmIO4hG+a8MBRmHkMNAo8L7JjKD8bmvG+Le3N5ObBw59eHM7ToZyj5AAN28fjdy3b0ayBoj/vAQ2v3XTpMzTKPLzt7/cvMUQCqR8AkN8G7NBCMIwMBikCrQ9yEVQ2CZQ16YolHJ8kIK9wPEoDEZReBBB26fgAHn78Yp1DHqL7NIvvrVxNCJ2YcoF0YB0KISASdQnYcglCQoj8KEuknDhALddEEID20UGWSRtMMAdiPRJFKFg2wsGxH9/M3T/jwjHIcpDSSogXBdxUHxQXJRLgHBgk+RgeA7qz4cH99PF3cB3hlHkUwGE+jbk+ZSL4B7u3RFe+Hkduv6IEvVsEAlgHKZQ28HHU2A2NDAA93wfdRzcJuFBc6IBQvmjZTMwAXdc0B8GIophngd5P+QFhGOgi3jkoGhRxx1V7HgTPYEFUAANZHswNihoZyDXgUEbdkh0YANkD2weBjpI4tCFF28ESR0V18CQd//r37ND9jX5eZSOL1/fAbWdA03TAEGaD877VV6ArHKi0P367tevSe6fqzD3by4FPg8FitwFttznEcv4/uvXLffLL8WYQeD9BebD8PDnQYS+3L7xyyqbZtn7r++23Nfhs66c8c/w6Ou7C6znfBnhP/3Vc96PD74mQZVcbwKP/dJ+/3P24eY/vyYjf8Lg5v2/hMW3UVGOz4cXN/lQQZ7cjFGav978/Qp3++y3r++cMZfE13df/joWKcL+Uuzj13fXCMTxxaiirggfnn4cgP42kPL3kZqfr7rgy3ccsD0vTQpAurBrfQG4sOPnMRAyChP/y/u9X97Fc4/BjQOzr4Nx4NU+TPZD62/+/QYFb365AS+t/vm+878MPPn018Av3cM0it5f2/RWZZdjH5ZhGfkfB98z8r+F3sclK/Ha/P1d2Q83U/Xm0uiP40Rw//zj0K7Lu2sTP769+XyL9mZMV6CxQ+s9u7Q/PQkXHXhxj/qv4IjgUMbRt9jOT37+IpZPf4zCLYpbDI8QcIq8ummDb3ewN+acVdibC6OHhg7s+57ZN7LCDOprtru558WFNW+/Jlcp+tkfs0n8PjMvIGNRv3X9bJS5b2WX+R/jYeqx9/7HUS7GDvw4dukLxF7Lj0bOldo7fH/99wfy7p7dLIWVoN0g4NuPVzS/3QvL3+5pzv2iisovv10hvr67k6BRUr8TqI93EKNxELqX+WUEui15feekdu5Nh7FUXxC8Ly4ZWD48cERO/Pd3vEiv7a/tqPLvG3h9eNu6W4hLZ3yH+u0dOY+q1fPof6TOC94nFYaJ57dKWpX/7c18jPlJpdd+ddMqKS+1DsbjD6qk5cF+fP9vH56LzYsoY7sdKv9DnNMlq9Ls+9V0+/5OxD58BF+s5FrH3+5lpkir3PWficvDNDm+ulW+l+E2qr1BcQP0PcTtOLzOA9+34nZefAmHen11W5gZFM5LCL6bBV9C821UVcA92OcL2LNW3r8fUTxo1/v3g566MukKcPs1+dtlJF78hLcPWTsGE/Mbr7Oq9m2hDn7BvS4YTdpvfnKJeb8dvR9HiG+6NHTPdD0YVrok0DLD/p8nj9XlVJ2z6vWxIBnTpTDAahz5TdVnqiZousZ+uFc5X78mbwfC/v2v79688fzgxo/D8v3p4039RUoT/8Mvb27nx/omLG7GR9cn4+fi14ywQVQVhy9aXvkfrrmFoqFAWITJMCUlrv++/njz3gvd8uNNFBbDv06aRh9vhsJj0dQuP3x4hnQwKt9+GU3LkQ+fvSrOihGNnxRV7n+zCzcMv3Bj2pmPN8XQfd9OfldcKBh++5md2+Woot+//fj2483bX95++PASlcXzxtzXO4z19/WTUhcGDTbv+8Fb+njzb2MTsqr8dpkWL+z6OMyisT+M6i8QDN426tZmeHA9Po8Y7uu9oLrg+fII29CKS/qfL4+K/T/FPW172riy3/M8+Q+6XvZibzALtEmbZL2nNKFtbhPIAbI9u4TDAnaALTHUhjY05f72Oy+SLZuXJD33PKcfGpBmRqPRaDQzEtLl2WWFykGhVsojeooB+Tcn+kOv/5FlRUCyGwMY5p/wuiXJ5hScOGSsZUTXNwAISs8+MXIkjg9NkAfhtOOOHhYsvZvTPH9Avc3BN+5GXl7eYMxnN/ZLJBrwrVuGlUejOoV1h4Ghb48A5i58GnRN8A9h+QLk4bTD1idWWa4TDkQ+ICvXONKFDt1tRd9pJkQX9fz86RZbHcy9kASAV0bg31KxYOSSOLYdLvz+MJj4k3mIMEWSmC2lQyWlNVjTbhiCw+aOfA0J/4/vzhhOX+YhnlRI7TU6++m7OlH8T3eC1QUvEAP+zSRVupLl2thwd9G1ARh8eVF8kcuL0rEwklQg6BA3eNHRk+4GeujqnWPhTtItqduAgOUb4E678ycukTf7yII1l7+8eIakfQ9TPV4/1QQYJGHk8XIvk3IZ+U9zkJx5Zwns5R328pMVYViP0HEcmTAc0ng1V4Z1guWv8Rq4C5iFzsIL14PgrXv92TsYnffe4gSNDPhGm8GvpniVjgQPHX+yHgwcAVgiZ01lRlfVTgcDd6rMl9uEzopa0710pCqAwfqWUkRl82IbLG15bE3ycgmWxsjSLPy+tHxgaXSrJ/4LVVRTdLKL98Ys6PohuhqdoA8ReNJQarXkLhDAg+awdbRfKLSX1NYsWMSNol8ZQOdo8YQV1g3NR5hiuSxSxCIqKnB5uCsFIEItdrA9KJALsxF0v6iObG+5dVQsRD0BeRK1PBhv08AJgmiGtUGwqfmYZi1ZTeaQq9a2sRYcbWACHj7a6CliHyLm16LC+KWaCoJtqCwBgIfB29ggwXCci1m9zb4kAWIcCGA+3vZn3sVGA0ckhBBvhgChaaHc7/KUcAm/jGZDk1tAz4k8QTU2/mRGNB+nF5rA8auMzmMVSUk4oQiSrqbE2G4LImfF21FbugI8WTt4gaFnoqSkFxAGfeg7FrAgGQ7EeL/kDsWhCa5FAM5wWmLPEiAxAJcEKM0hx0AGJIAZIarcHQNEsUGCeDIZt4U+SFvnzxG189OWzltbdH03YkM66FSmtSzRkq22V4bPAChDNav5pwkGqpUPSQYiOGzUVJys61GErkSUxE0wTHAphtl5XWUbYA1dXYzT+tmbpsF6oWisakYw+RImVCNqDrSj1Zbjh4kfBGvJiciZIF56A5xFSIZZG3bDDuawALrrL0yMcUyJpaW2wMomka0IuR+Ga3C1nNZ6VHR0JZvAp0FJsg6HtFI/cMZG3OkFQHu7GmwkDDNX/54HqFC2lmhpYysbR43iT95k2d/nXR+YDVwa7+MBA7TZwOVo9/iGzI7aiWBIANO3Jhhas5e18ulF+RJvFS2fVRsAXSrpNC+umrRb12mc1C4r2OlqrYoXuZZPO7Xq+e/A2A5ISe545FUC2YqErNWEi1u89NZU6tf9AoOt6gOv67LrYcpFOOJBbTvSHhmwgNYPkK1NcLxNB4CpO/EQR78VTxmoO1xqoHLL6kyQHz1v2pkG3s3ojs1ZNKTGybtys1O7al5eyW068tC0wgqNhDZ8DjmQINyrBn2snzia92bwTbkwiNVmvXzS7OjIBErkq28rjc5F+bTCJGrn56/LJ+87OqFoAIERIMCQaU6TTJLmgXLoZGKNQYg4NEhwKftUu6QPzQBE1+v2P0o6asEYg9fqkWNO6zLOZ/oAUxrHYmVFxo/6opwYBqu9SQkolwdqf34G+kppQqk6igM5/pz1WI+rBJTOm+g8K3Itu7RfOGqn0ykItkpgW6M8CjpGHPKu9vPiDMK56lvAkAmaTk70wAnpD3OiA0LGJIfBBRydhsPJF7s/DwLPn4FiA/gQpp4GHHifIa4NQo9GGiY6Q3H40KGESgQ7Dm0uR9hJMBpQIHwDNG7Cn5Fu+PM9b9kumQrfr6xR4AJmDSxp3xt3R77zWYbSc1hmQYM816ZNJqc7Bm9hJ4qcY55Ya0yrVWijzsQVfCLCALMKzfEaGG9eSrkcKYlxKfINZSQWLpF9PJJ0ZWl/7HXR1ze5D5RlUf6z7FeH9Bhg+GtCt1tHJfR7l5q1fXvW7NCNptD7iF0YU7mvBYxjwseQXwFI7j5aO5jdUdWU6dHqtAaAOGj026gRSUm3+Jf12mlUj6Sw/Q57kQkfU+GKZKZTFucEpjstKf6r6vtq7UPV2Jmuo0StpMhg2QYaYWc2RR8j5dl8Jz9raT2Ro51wfgseyiLWLBy9ydjtaLok3VA+ioDLo1LjuDgXIyvl0nUrVi3skQzPEQaFmqqMfTmsh06m6qP9EG4Dy9jb0ja9OEiIorZo/8R4jIwpGcxtouRibqcat1SjszrVWKVKnU8s+H4mV8aPOVyqwWvxhKZhw5t3URHAoXMoV89rfQSZGF5egigM0et5BLVKVn1H8y+5mDQwXTxdDz1NQlvJud2sdBpX4CTUf8e5zczA9A3mvu8FHTzEsnqW5YGbkMHcjijjryis8fFStWk/j2vJt+NsUwS84vTJSuWTaZgPOWexHOpX1eo2L1AjusYdXKGT8Dp1XCvKLWjdWvFgpI8Z3KY8xg0ulO5zYYCJ/lMHlXESeO7aSvKMknV8PTUGTa6nl0tbgkOG63Rc8Rvu2NILEQlfjXZoqXchzK7Y9RnlIu/H8+e3XoAmk/qrBaegNRjIYVMicvRm7OWBNDRIRfYviuqQdROmsFnIiZGwxTMrJ25Hvony5zawfE88t1IkNI7zXdc1/1pxteSIRk41nw3c6uURT7i95rmmJK41KxNLxFbrr7bed8WuJX4V+4VCklUNjxOYmOLO5/OtJrCIhz1O23EGnDugbQLeG3Rk4giY2xNFzJyC0sFXLF1u2CB85Ibgw8J6nHeq5iDjrPioDLhxCqhF9LMXhCNKpxaVyzUBm+a7aN6PMPxNOFt4qKv2Xq2SiUmgsm076+fOhupo3h3RWrGztFKxOQpj3ZHU/S1HUg9Wn/nQHvk4L1crZX7H4vlppXH2tvq8w4+eyOc/Tsr1+hmewa2c1H6r1H/HY6trG+GzqoWDwrPnzz334ODg0PNKL3rus563X9wvdV+6B8/77ouD570D1+33X+Bxuf3+M6jpFg/7bu/F4U2xuJY0n1U9fHG45qjqQeKo6iva6p/c3OzugAWhVYY+yRgTY543zo//e1Mwdnem+ORQOPTG4zzMMnwB5zKYoIyEXbnz+nNc6y8nsOovxOsF7rsJ+4S1QRgZiN6d1deO+HkXz/98FDdnHWc4l+Rkf/jhB3FZ+1CpZ/eyjXeV83NmW0B59jgzcpBq/gwnfe3GlFjWMT52BHZpPBMF6572rg4Ly+PMNGT4xrwXyseYRnsSKX/u+YPZ0Dr+b2G2Gv1gNJ29BmF8jB96AnTLMqRsIL7/kbbmziu/Vc5/NOSTMj/3xI/1kx93dyK+U0zv7mTIhpdpV+gSYjAPgry+52Qbs8k0C9X9ketkE6d3y+nzu0rrEJx3j2tj92QFb+X9H3ztSD1p5GRPjq5h9AZB91bgkITXl/Nm8/drgsDhRXDc1WxSC87aB5QkyHtvUe3eQifCcGh7bml/v3j4qlQ6WoHe3YkON771ZnaDlvt33p3ZwvW61W5n6PUr+bZUBtyBJzzDRbtL8ZHILU9wAd3EI1yy1Uc9syWW2FL00BYxGb+1hbVLrZeyfZsaaE6uZjcv1/c1wTq/YaS9X4TnYvIgMdUBibnETdv+MEbM0IZtiofK3RRmoP0HOFjr28bpQt/lJKCZ88JapSrZlE+d+U4Cyz6Q5SEYAM+pel/sWu8vrz8T3CYgyAfDykHQXeDQTaYL2XKulGO8XCGX8eXjX5mRfxHqhMB6XEBAFixADl731pQ4Cnwyn22Fl2BuGuZEPuMBwsqfejcY58gGiINcKwWjfcbNZ+jJafQUiOSFhxOaymMnmxOTmcMh01QHqiPNOebuJlWJ+O05jAzKSJIjWC7RsNVY9RDrSYrx9utoukUpHz0WjPm0sRhsG4u3f4ym/08DMdg+EIP/7EDUPbfbn9m0FrZ4aWpn8JsyhDOHvqrJisvlVaNSv6zX3pydV2CmIsQssl5pgFz2F+3br1nq0i/1ymmZspmNSrVx1jz7rUKJ2F+5wVbgDbw7Wqgl0Vkua/5tZJmh14fOfJtNPnr+t+501OrY7b999BbWdfhT68hp459/Xoe542zWaO+BHc0UnV8C6qLn0qN7mxu47hUPS9f54sHL6/y1e1/MPVvGH3pAa/UFv63ECmvI/Cv0XgBzZrF1YB+2v5Wu3W/PWoVi23oCbaUGs6QGlF3XvvJHn+YejvN5d+EFZubvc2/u5TINz/NzkVo0KEeTW6cmoBqq+OjoLKyCptWCD8MRmLMp9YFgY7tOep3hsyQblxz5HCWhEvzQSSzdkoBSTWQ2j+dkuyM/BL/AzAxXWkSYVmbYBpWFWIOKqKvQ/Cf8a7amYX8Ofv3thOxC+9U999qRvT9GbnhKHAMjTmZ4TGw6zItckJaWfDcS+LIhoDabECvY/PTiOQgl6I5X3nnE/5uLqSfOve6NJZ3HUmFJRF6Z2PPooUh0eUR22h144Bj8lAUfOPbsRAOPzs/GCxTFyIeICoQy92e0tBYV3eJSezw0AypHoj2bebfQyBT8hgVzJLLv3p9cHV03JjezL93Au26Mbid+E2q6t9Jta4RDdWopzQk4lnJ0SArYTv6ywSY3LxsagdSoP3Zfjp3QPbtIEiW0XMqmxUX4UCW4hwlj3liE0BHo9njMZ6BCUCffC0b9PL6iqTQVJgHEb90+eGFTDOT5WUvzfyYjn/ueNmYiezr54tNJi6yVexjYCz+ia/0Y0EmfHvlUdAmiWbm4ZNQGpoxspSe4NyPSgcvuDkhKTYWpsOm4wUa109RNzhgIXhgJR4p/dBRGs4l+8nPf+jwZuW1ZBWYDS5fqgdRbHBjvScMgp5g2DEgaR4Lb4P6gXp4MR2MXlTPVD4K36+imhx6/n7p9LohvvKB+GELwo/iENawT+5+eKJb2X5YOiyWWB9RV7maej0u9sElNshhWg5XN97r4Amx+Ghbxz+xuhuubauPNJKhAr6JWdmXORnNtaG0HtI3RaSf/BkwpzYMYA0cYkLTR0UMxqQYR+d4a4tKyrqUOXjKPsxxRGulVs6gjCEFxnUYvWUsRGtSu1kjbqcSfrET7aqYtvpWEYXM8YwdF/VtqQEv1MbIdsiTSXDL8ut5mtygurRZKczEIDWFFcV4h0UiLb0mFpfhgBVqzwgpuVRC6MA3K9hh7mVuSkQXYeYQVzOEYUb5vagEbd+eM/rKwu/NlSD/go8bVsjCYiYJUdW5IWy9idNaqzMSRyKceL5gkaqkxEp1Mw4SX7OBOOTTZVtn+o2t/LdiHez+374svC7mlc1/IlZZZgqTf8zgFCnEjSbIog7v8BUsT6OalK8GjiHOhL/vhiecF674HuB+V30xVe3sJh5yyQTI6hinxJpjcvqZHFFWIe3ubp5S3HuX2lQFZxu1iQkcLW4sFaF3BKQb4mWVnTTBOjMTEGFDabflt0wwXNj7WrDBI0QQ5yFHe5Zv+k71vMlPaGbnf6Fd913nMF3+Lf6aDv+PJaobjYY2FcWCHaM+gn8UblmIoml3U/6+OlgNIdflr3GDm6wYZfVUQhBDJ5+sDsvn675HL90iGLwxA+XyNjNQyIaS0LsGEVGsPFOOZBdv7JAp3xRuttKhKX/Y0MQ4cLbLWxM2NDPSeZAYbRD5IrjSDSOiDB4Q++HcJ/fvEPgARoNgHs3WrgTYC0Uow8sG3AJcJz+n/S37MmMzWWDOcKMkx2/S1MsoqC7wKYz5KYt8CPA4tP0cv81pZJUdporUusp0eW7EI9FrhgKOTKPgmGjCCSiikMsIGH7fv+Ri4WfxCfE+XHEV2bFZfz8GF84LdHclI2MuXp1NAxafTzezWXQxOYjsYsmEou56Cdnguu4e57I2QyVOLTvLI4uYGmEWF3OhcVupvavWLyilQ2Iwlj13iGY4kh4kJ9ECb5ebJOz6lhpjKMaNl+lGor8uNSrV8UWkAuhaoY0Rigueae2UqojDKab9VOm5Ly7Ie1ZjcW/q+lsDV29rQaQV/0Xkq95MikeiOy0bcs2qzUq80mnjEKYWvTwtFBLc4Jnj/QAFnhnuHf1MzXEOLpzkhkTsCPk6hkHBJkA67I5mZo+Xe1MSPaOiLwSFT4URbvINUyHHFnvGn/0u0Ncw9+9Xg5piXPUdEFDV3LSkeI71Zl7kHZpdqPxKc07G0sNbTabBKMI1h9+kEeFOR8ONc75MoxBuPxmbkzOw7CdNWL9lQ2gBMaxMv1awi63UzMnW83e2gvUhZw1q9o7T/svz7eQ0MVrXW7LwBHT5F+7Pkc0tPaCTukSJY+e3slB67j6l+n8UGgUT2GqaP93nk0mYjUol2wyyqef2oLKCiQPR+EOe4WzxeCJVzF3j4VyS2UAQe6RYuF+Hv0vAeLLpgJRzCF1gvB0OBZ4zsiQ+U+IhOHkMm77Y2n23dQXjSTg7Te8QWgirJUXbSkhk62qz5EIxwI1hKC7eq5Ee1e7x5ewcX94ySk+c6kp/EVoIsinBwv7a7wEzX64PnerTUnCRjpZiuhoOBeypul9ySMkwXjpF85x49ZPXY/bHoPfzIfVZjL2vl7OI+9GL9W/e91Fv3WY3LrLx7zOypA2RZOkAGK5U8PwbEQeOdbBb333FjvXH2D0HnEEQIAhh7Nv3aVIAb1J3yKaYB+oZdPMR+uZgNJ76Y+J6Np29IuaaLvyOC6xhZ/BU9fI/2TqAkZ2T/NP6U/4HzuifgD6Y46TCo8+B5PIGOj6bUqRth+EKz5zZRsPvdIBh5gQ1R2wSGd4G/wY1/mUy8PxP2mbBfC7svIs4NNnLyfKryVFvXwbXfzqps7T571DBjV/xBnNhqnpuZGzxag7qDY+ykcqSYAaUuRSLgRBPC7mXzXER5N3Q96UeUCQD5u8oYwAuCNAD+gjQCwINCKQA6mc0AWiKN5mOUpot5y8nPOey6FbEtbdymRFyMH6OsmUQaLRqDVHLMfAx9C4I13xNxI2rEDnjE8PYC55WZtXs4rjAR7C4oNKY57TCk75fwX6mEn26zOTNrgPsU09+D71ZOO71BZsFp4FGqeP8CmVzZACkHA8qBY0wliA885gPa82Hku5Mvwv7QBT5BO8KwOQzm4k9c6GxwoijtAC34bjdwwYxN54Afa8MqDGWIhaYPKPS+k5nmK3d4cMP1tox1rCQ5M/GLHQo6wBkL/vQvz8+q7zuVf5zhubVTcp6CPlfVKxc1PIgbeUTRQHD9qsdvpDx+htvkzBprnFnGMCyllHVo8rNnr0uoRwMJg4S/t9ieTpdnj6Bzu2vOuR1o59ye6nrs7jzOv9jd+T8=\"\"),-15); assert hashlib.sha256(b).hexdigest()==\"\"3e42ff5453c3a7d13173a7b65113281df1d7b740d4b59d957bd78ed810fa49d7\"\"; print(b.decode(\"\"utf-8\"\",\"\"replace\"\"),end=\"\"\"\")\n                                                                     ^\nSyntaxError: invalid decimal literal\n"
+  "output": "LOCAL_APPLY3_CARRIER_RECOVERY5_BEGIN=true\nCOMMAND_ID=NEWFI-260907-A-PORTAL200-APPLY4DESIGN5\nMUTATION_SCOPE=NONE_READ_ONLY\nLOCAL_MUTATIONS_PERFORMED=NO\nTARGET_OLD_COMMAND_ID=NEWFI-260907-PORTAL200-APPLY3\nSEED_COUNT=41\nSEED_BASENAMES=NEWFI.txt,NEWFI-260907-A-PORTAL200-APPLY4PREP1.stdout.txt,NEWFI-260907-B-PORTAL200-RUNNERCONTRACT2_REMOTE.txt,NEWFI-260907-B-PORTAL200-RUNNERCONTRACT2_STDOUT.txt,NEWFI-260907-B-PORTAL200-RUNNERCONTRACT4_REMOTE.txt,NEWFI-260907-B-PORTAL200-RUNNERCONTRACT4_STDOUT.txt,NEWFI-260907-B-PORTAL200-RUNNERCONTRACT5_REMOTE.txt,NEWFI-260907-B-PORTAL200-RUNNERCONTRACT5_STDOUT.txt,newfi-38-portal200-apply.cmd,newfi-39-portal200-rca1.cmd,newfi-40-plink-portal200-rca.cmd,newfi-41-plink-portal200-rca3.cmd,newfi-45-pageant-portal200-rca4.cmd,newfi-46-portal200-http-rca.cmd,newfi-48-portal200-apply2.cmd,newfi-49-portal200-preflight-rca.cmd,newfi-50-portal200-preflight-tail-rca.cmd,newfi-51-portal200-prod-http-network-rca.cmd,newfi-52-prod-public-http-rca.cmd,newfi-53-public-css-regex-rca.cmd,newfi-54-portal200-apply3.cmd,newfi-55-portal200-apply3-rca.cmd,newfi-56-portal200-apply3-failure-contract-rca.cmd,newfi-57-portal200-contract-rule-rca.cmd,newfi-58-portal200-exact-contract-rca.cmd,newfi-59-portal200-contract-ast-rca.cmd,newfi-60-portal200-import-contract-discovery.cmd,newfi-61-portal200-import-compact-discovery.cmd,newfi-62-xf-addon-rebuild-help.cmd,NEWFI45_PORTAL200_RCA4_REMOTE.txt,NEWFI45_PORTAL200_RCA4_REPORT.txt,NEWFI46_PORTAL200_HTTP_RCA_REMOTE.txt,NEWFI46_PORTAL200_HTTP_RCA_REPORT.txt,NEWFI46_PORTAL200_HTTP_RCA_STDOUT.txt,NEWFI48_PORTAL200_APPLY2_REMOTE.txt,NEWFI54_PORTAL200_APPLY3_REMOTE.txt,NEWFI55_REMOTE.txt,NEWFI55_STDOUT.txt,NEWFI56_REMOTE.txt,NEWFI56_STDOUT.txt,NEWFI_PARALLEL_FULL_HANDOFF_2026-09-07.txt\nSEED_SHA256=869d6fdf2d4ac222d9ab4b83242563676f201e6ab21b84360fa73fc7f9bf7195,240d0fad482deb05c93289edd7ac58a84e34b98fc620d1e924b561aace8630bb,92255a714b86966ab5a15a86d18c6257c6c131b20520a6d2d2443b8fe969e93a,9bffe2728a05e52f03ec52fddfcce229588b6f6cff59e8932d6c8b5ae97c592b,e92d1a64266be86cc8e5441ff9f51e2161e35e00ffd12dce1eb049a4b6437dd0,53c8ea2dc91c33b2872da3974ac5a682cbdc907c9d232a29921b674d490d474e,0b4ba8d2b1eef91c627884071bbcdeea8ad9b4f6c04c8650e44eb468253d15f6,a59a4b7a482a0a39a51e08553749c1f15bcf74d4ba449f6d50caf7a6ba60f9b5,8481b33b162a78f0e1398b69fda50f581ace72f87cdfb2a16fb66ceb67fa4987,34245e3a7c02145e7f11e3c7919385ff955e739a5b278ede66f8ec91499a31e4,a398e89eec09cca84a907876dfe46cf491d8b61c402c1dc4e4ec36eb92167845,11ea567ce0485bd87c5da8292c4d01d55e741a85b75fe0bf5073ca33133055f7,96b2de593d982ef7a5cd09c5618e6aabaac259f896a70cc8f1b476b0c3b16a58,2ce247a8dae973819605d246273b294bf23ce1d118c3e8b92517696caff927c9,f0ad32266492990e58a90991f2d6ae808c3e57c1ad53244bfcd26100e163cd73,2d5a55fbb00e63a280680b312d3eff3e28d524e29e8acf9ee8cae77b7c7d1f2e,fae07cfd5e9196871cd8bec8305262c95ecd09654994675e9a4ac4617d761f99,9aca123af4a9674c2bc10f308a65b622dce616cac17fbfe9b58db3782fbd2d0e,c8e9abf642daba2118f3419a00ceaeb0a0cc9a54ae75575e5e903a8db8fd1c1d,92b919e1b4e0b910da5b8357619d853c5791dc73fb8a70d097563128d7c818e7,573c5c94fe59ed072e094281668ce9847dc4a9882019a2b89d8ba5f190d92176,6c98cb81713e91d9866d264e59c513b8a968c4f52bfbad55450957524600bb10,69d7a46640fd020c0daab39c3195ca77ff777242c22b419f66dfcb69be3a8a23,1f99ab8666c4d51844b8e95bf3768cb1b017921824e9ba8857a6579dfaafb6af,e10dcbd211b75626199ed50dda79f34ae169caef24ba747c74b9c79ddaab509e,3621712ba5fecff93abca54c601f4f176d976a67344a506a92d6de79918f05a5,07d2b88b41b30e90058fa1d389cc52d1ea3b20b557a962f9004db720bfc8d2b0,88b9f92828c1ee19537526a1eea93a52c59bc2f32a7034e45508e53cca2e3667,c8827d2f8b0ddc34771c1c71ffbf517d1bd117dcf36b4d3e5439ae262bc86c32,7fc78755edbeee8c49d3d47e26a723c01ee0e1e6b022b8fd2f70ccacdf8f4338,edba9db8c9ddedb0fe3e727c7ed5a255d1da6de82da722431f3db053abff2f38,3ea9e7e83411127caf13af674570f0ef9ac968b13393b0a173ce1344d6a29cf0,1c91f522bb94d4ce292bb451dd847f394362c0a8f4745ae8823a5eed33e2a10b,cfd23052413cad9d435f9aba290956e93d9191312d568cd1cc69437fc602ad03,474b251535372a61e8be1acf215c1cc2240f8414bdd1c5e03309fd5faa2f8f99,71da2a66224075527d8aa04c1281fdb7a2b9f078d76c349fc05b48a4b803a4c3,f4600697557109030fc188376f1407fc02e4ec2eff2c635d81e2438f8a325fe3,65ff188b6b7bd06f59feca719f4fad6e07ff8304ef157425b162b3928f674d31,5f2eb373b3b37d29dff72b8b7d5cc1346283f7b2de02ae2eb95a229e542c5468,b2968ec8823fa4bb7b3d6fd4a25f25d6a486eb9740ecc6ef362d1b31e5f439b2,869d6fdf2d4ac222d9ab4b83242563676f201e6ab21b84360fa73fc7f9bf7195\nDECODED_LAYER_COUNT=64\nSTRONG_LAYER_COUNT=3\nSOURCE_LAYER_COUNT=9\nCHOSEN_LAYER_COUNT=9\nCANDIDATE_LAYER_1_SOURCE=file:NEWFI.txt\nCANDIDATE_LAYER_1_SHA256=869d6fdf2d4ac222d9ab4b83242563676f201e6ab21b84360fa73fc7f9bf7195\nCANDIDATE_LAYER_1_BYTES=57343\nCANDIDATE_LAYER_1_TEXT_BEGIN\n\nПОЛНЫЙ ПАРАЛЛЕЛЬНЫЙ HANDOFF: NEWFI / PORTAL200\nДата сборки: 2026-09-07\nНазначение: начать работу сразу в двух чатах без повторного восстановления контекста.\n\n===============================================================================\n0. КРИТИЧЕСКОЕ РАЗДЕЛЕНИЕ ПРОЕКТОВ\n===============================================================================\n\nПриложенный handoff второго чата относится к KINGOFWOLK CSP.\n\nKINGOFWOLK:\n- agreed safe CSP stage полностью закрыт;\n- shared counter = 0;\n- final accepted checkpoint = KOW-260907-A-FINAL1;\n- его product-state НЕ переносить в NEWFI.\n\nИз KINGOFWOLK для NEWFI переиспользуются только проверенные operational rules:\n- true-parallel read-only direct bridge;\n- один writer для любых изменений;\n- Pageant -> Plink -> pve01 transport;\n- authority checks;\n- homelab-chat-run contracts;\n- immutable Gitea readback;\n- unique COMMAND_ID;\n- fail-closed drift handling;\n- destructive Git / raw SQL mutation prohibition.\n\nПолный KINGOFWOLK handoff приложен ниже как APPENDIX A.\n\n===============================================================================\n1. АКТИВНЫЙ ПРОЕКТ\n===============================================================================\n\nПроект: NEWFI.\nАктивный участок: Portal200.\n\nСейчас НЕ продолжаем KingOfWolk и НЕ занимаемся Linux.\n\nТекущая рабочая проблема:\nпредыдущая change-команда Portal200 APPLY3 не является accepted checkpoint.\nПосле неё выполнены read-only RCA/discovery шаги.\n\n===============================================================================\n2. AUTHORITATIVE GITEA RUNTIME\n===============================================================================\n\nRuntime repo:\nhomelab-admin/homelab-public-context\n\nBranch:\nassistant-runtime\n\nAuthoritative exact readback:\nruntime/history/<COMMAND_ID>.txt\n\nНе полагаться на generic latest без точного COMMAND_ID.\n\nКлючевые текущие NEWFI checkpoints:\n\nA) NEWFI-260907-PORTAL200-APPLY3\n\nSTATUS=FAIL\nRC=76\nHOST=pve01\nMODE=change\nCOMPONENT=newfi-portal200-deploy\n\nКритично:\nRESULT_CONTRACT_VALID=false\nRESULT_CONTRACT_STATUS=UNKNOWN\nRESULT_CONTRACT_ERROR=INVALID_CONTRACT:ValueError\nCOMMAND_RC=1\nCHANGES_MADE=unknown\nROLLBACK_STARTED=unknown\nROLLBACK_RESTORED=null\nMUTATION_OUTCOME=UNKNOWN\n\nСледствие:\nAPPLY3 НЕЛЬЗЯ считать ни успешным deploy, ни доказанным rollback.\nНе повторять этот COMMAND_ID.\nНе строить следующий change на предположении, что production/staging точно остались\nв старом состоянии.\n\nB) NEWFI-260907-PORTAL200-CONTRACTAST1\n\nSTATUS=OK\nRC=0\nMODE=read-only\nCOMPONENT=newfi-portal200-contract-ast-rca\nCHANGES_MADE=false\nMUTATION_OUTCOME=NO_MUTATION\n\nНазначение:\nread-only RCA runner result-contract / AST после APPLY3.\n\nЭто accepted diagnostic checkpoint.\n\nC) NEWFI-260907-PORTAL200-IMPORTDISC2\n\nSTATUS=OK\nRC=0\nMODE=read-only\nCOMPONENT=newfi-portal200-import-compact-discovery\nCHANGES_MADE=false\nMUTATION_OUTCOME=NO_MUTATION\n\nНазначение:\ncompact read-only discovery import path + runner-contract requirements.\n\nИз опубликованного evidence видно, что runner contract жёстко валидирует как минимум:\n- поддерживаемую version;\n- command_id exact match;\n- status только OK / BLOCKED / FAIL;\n- changes_made обязан быть boolean.\n\nПри APPLY4 не импровизировать contract JSON:\nсначала перечитать CONTRACTAST1/IMPORTDISC2 и runner source.\n\nD) NEWFI-260907-PORTAL200-REBUILDHELP1\n\nSTATUS=OK\nRC=0\nMODE=read-only\nCOMPONENT=newfi-portal200-rebuild-help\nCHANGES_MADE=false\nMUTATION_OUTCOME=NO_MUTATION\n\nКлючевой вывод:\n\nXenForo CLI поддерживает штатный:\nxf:addon-rebuild [options] [--] <id>\n\nArguments:\nid = Add-On ID\n\nOption:\n-f, --force\nSkip verifying that the add-on is rebuildable\n\nСледствие:\nстарый ручной PHP/import loop не должен быть механизмом следующего deploy.\nСледующий candidate должен опираться на штатный XenForo add-on rebuild,\nНО exact Add-On ID сначала должен быть подтверждён read-only evidence.\nНе hardcode Newfi/Portal только по памяти.\n\n===============================================================================\n3. ГЛАВНЫЙ ВЫВОД ПО APPLY3\n===============================================================================\n\nAPPLY3 имеет ДВЕ независимые проблемы, которые нельзя смешивать:\n\n1. RUNNER / PUBLICATION CONTRACT FAILURE\n   Runner отклонил result contract:\n   INVALID_CONTRACT:ValueError.\n\n2. PRODUCT MUTATION STATE НЕ ДОКАЗАН\n   Outer runtime показывает:\n   CHANGES_MADE=unknown\n   ROLLBACK_STARTED=unknown\n   MUTATION_OUTCOME=UNKNOWN\n\nПоэтому правильная последовательность сейчас:\n\nНЕ:\n\"сразу повторить deploy как APPLY4\"\n\nА:\n- параллельно восстановить current prestate;\n- параллельно построить корректный APPLY4 design;\n- change запускать только после read-only PASS prestate.\n\n===============================================================================\n4. ПАРАЛЛЕЛЬНАЯ МОДЕЛЬ ДЛЯ NEWFI\n===============================================================================\n\nИспользовать проверенную KOW concurrency model.\n\nLANE A = SINGLE WRITER / DEPLOY DESIGN\nLANE B = TRUE PARALLEL READ-ONLY AUDITOR\n\nРазрешено одновременно:\n- Lane A читает Git/Gitea/reference и строит новый carrier;\n- Lane B выполняет direct read-only audit;\n- оба читают immutable Gitea history.\n\nЗапрещено:\n- два change одновременно;\n- два git commit/push writer;\n- два application/XenForo mutation path;\n- повтор failed COMMAND_ID;\n- Lane B mutation.\n\nНа момент фактического APPLY4:\nLane A — единственный writer.\nLane B не должен запускать новый state-sensitive snapshot в середине mutation,\nкроме специально спроектированного concurrent monitor с drift guards.\n\n===============================================================================\n5. COMMAND_ID FAMILY ДЛЯ НОВОЙ ПАРАЛЛЕЛЬНОЙ СЕССИИ\n===============================================================================\n\nЧтобы не путать старую историю:\n\nLane A:\nNEWFI-260907-A-PORTAL200-...\n\nLane B:\nNEWFI-260907-B-PORTAL200-...\n\nКаждый attempt:\nновый COMMAND_ID.\n\nНе reuse:\nNEWFI-260907-PORTAL200-APPLY3\nили любой другой failed ID.\n\n===============================================================================\n6. LANE B — ПЕРВАЯ ЗАДАЧА, КОТОРУЮ МОЖНО ЗАПУСКАТЬ СРАЗУ\n===============================================================================\n\nЦель:\nPOST-APPLY3 CURRENT-STATE RECOVERY AUDIT.\n\nТолько read-only.\n\nLane B должен доказать:\n\n1. Authority:\n   /etc/pve/HOMELAB_ASSISTANT_ERROR_REGISTER.md\n   /etc/pve/31_HOMELAB_REFERENCE.md\n   readable + nonempty + прочитаны.\n\n2. Runner:\n   current /usr/local/sbin/homelab-chat-run SHA;\n   exact result-contract schema;\n   duplicate command semantics.\n\n3. Git:\n   authoritative NEWFI repo/worktree;\n   branch;\n   local HEAD;\n   remote HEAD;\n   clean/dirty;\n   relevant Portal200 files + hashes;\n   no unknown local mutation.\n\n4. XenForo environment:\n   exact production/staging VM/CT IDs;\n   exact docroots;\n   exact XenForo versions;\n   service health;\n   current addon list.\n\n5. Exact Portal Add-On ID:\n   resolve from add-on metadata/live XF state.\n   Do not mutate.\n   Candidate methods:\n   - xf:addon-list;\n   - addon.json;\n   - xf_addon read-only SELECT;\n   - existing deployment metadata.\n\n6. Current Portal add-on state:\n   installed/active/version;\n   pending rebuild/install state if observable read-only;\n   relevant cache/code-cache presence;\n   current route behavior.\n\n7. APPLY3 aftermath:\n   whether product files differ from accepted pre-APPLY3 baseline;\n   whether DB/install state changed;\n   whether staging changed;\n   whether production changed;\n   whether rollback evidence exists.\n\n8. Health:\n   Nginx / PHP-FPM / MariaDB / related app services;\n   HTTP codes for important NEWFI routes.\n\n9. DB:\n   SELECT only.\n   No UPDATE/INSERT/DELETE/ALTER.\n\n10. Final decision:\n   ELIGIBLE_FOR_PORTAL200_APPLY4_PREP\n   or exact HOLD_...\n\nLane B output should be bounded and sanitized.\nNo secrets/private credentials.\n\n===============================================================================\n7. LANE A — ПЕРВАЯ ЗАДАЧА, КОТОРУЮ МОЖНО ДЕЛАТЬ ПАРАЛЛЕЛЬНО\n===============================================================================\n\nLane A НЕ должен ждать Lane B, чтобы начать design.\n\nОн может сразу:\n\n1. перечитать:\n   APPLY3\n   CONTRACTAST1\n   IMPORTDISC2\n   REBUILDHELP1\n\n2. перечитать:\n   /etc/pve/HOMELAB_ASSISTANT_ERROR_REGISTER.md\n   /etc/pve/31_HOMELAB_REFERENCE.md\n\n3. найти authoritative NEWFI Git worktree / branch / Portal200 deployment source.\n\n4. построить APPLY4 carrier OFFLINE / PREP ONLY.\n\n5. В APPLY4 заранее исправить:\n   - result contract;\n   - official XenForo rebuild path;\n   - fail-closed prestate;\n   - explicit rollback semantics;\n   - exact mutation accounting;\n   - exact COMMAND_ID;\n   - publication/readback.\n\n6. Не запускать APPLY4 mutation, пока Lane B не подтвердил current-state eligibility.\n\n===============================================================================\n8. APPLY4 — ЧТО ДОЛЖНО БЫТЬ В ДИЗАЙНЕ\n===============================================================================\n\nAPPLY4 не должен быть слепым rerun APPLY3.\n\nОбязательные свойства:\n\nA. PRESTATE\n- authority checks;\n- runner SHA;\n- exact Git local/remote/clean;\n- exact expected source bytes/hashes;\n- exact current Portal add-on state;\n- services healthy;\n- target environment identity;\n- no unexplained post-APPLY3 drift.\n\nB. ADD-ON IMPORT / REBUILD\n- use native XenForo command:\n  xf:addon-rebuild <CONFIRMED_ADDON_ID>\n- use -f only if evidence/design shows it is needed;\n- do not return to manual PHP import loop.\n\nC. RESULT CONTRACT\nMust match runner schema exactly.\nAt minimum:\n- supported version;\n- exact command_id;\n- status in OK/BLOCKED/FAIL;\n- changes_made boolean;\n- rollback fields with correct types.\nDo not emit unknown where boolean is required.\n\nD. FAIL CLOSED\nIf prestate is not exact:\nBLOCKED / no mutation.\n\nE. ROLLBACK\nBefore mutation:\n- prove rollback target/material exists;\n- preserve previous product/app state;\n- rollback on any failed verification;\n- verify rollback result.\n\nF. VERIFICATION\nAfter candidate:\n- XenForo CLI exit;\n- add-on version/state;\n- relevant DB rows read-only;\n- routes;\n- services;\n- XenForo error log;\n- no unexpected file drift.\n\nG. GIT\nIf Git promotion belongs in this Portal200 stage:\n- one writer;\n- explicit path staging;\n- git diff --check;\n- no git add .;\n- no reset --hard;\n- no git clean -fd;\n- no force push;\n- verify local == remote after push.\n\nH. PUBLICATION\nExact runtime/history/<CID>.txt must be readable and match COMMAND_ID.\n\n===============================================================================\n9. ЧТО НЕЛЬЗЯ ДЕЛАТЬ\n===============================================================================\n\n- Не считать APPLY3 успешным.\n- Не считать APPLY3 rollback успешным.\n- Не reuse APPLY3 ID.\n- Не запускать raw SQL mutation.\n- Не запускать manual PHP import loop, пока native rebuild доказан.\n- Не hardcode add-on ID без live/source evidence.\n- Не делать git reset --hard.\n- Не делать git clean -fd.\n- Не force push.\n- Не запускать два writer.\n- Не принимать generic latest как authoritative без exact COMMAND_ID.\n- Не использовать KOW VM/IP/path как NEWFI environment.\n- Не переносить KOW product state в NEWFI.\n\n===============================================================================\n10. WINDOWS / SSH TRANSPORT — ПЕРЕИСПОЛЬЗУЕМ ИЗ KOW\n===============================================================================\n\nPlink:\nC:\\Program Files\\PuTTY\\plink.exe\n\nPageant:\nC:\\Program Files\\PuTTY\\pageant.exe\n\nSSH key:\n<USERPROFILE>\\Documents\\ssh\\homelab_ed25519.ppk\n\nEncrypted PPK.\n<REDACTED_SENSITIVE_LINE>\n\nNormal transport:\n\nCMD\n -> PowerShell 5.1\n -> Start-Process\n -> Plink -batch -agent -ssh -P 22 -m <remotePath>\n -> root@<PRIVATE_IPV4>\n -> pve01\n -> direct read-only bridge OR homelab-chat-run\n -> Gitea runtime publication\n -> exact immutable readback\n\nDo not use:\n- MobaXterm;\n- -i in normal carrier;\n- pause;\n- Notepad;\n- blind host-key acceptance.\n\nPowerShell:\nseparate stdout/stderr;\n-NoNewWindow;\n-Wait;\n-PassThru;\nreal ExitCode.\n\nRemote command file:\nUTF-8 no BOM;\none physical line;\nSHA verified.\n\nLarge payload:\nzlib + base64;\nSHA256;\npython3 -I -B.\n\n===============================================================================\n11. AUTHORITY CHECKS\n===============================================================================\n\nПеред серьёзной server command:\n\n/etc/pve/HOMELAB_ASSISTANT_ERROR_REGISTER.md\n/etc/pve/31_HOMELAB_REFERENCE.md\n\nОба:\nreadable;\nnonempty;\nпрочитать.\n\nVisibly emit:\n\nERROR_REGISTER_CHECK=OK\nREFERENCE_CHECK=OK\nAUTHORITY_CHECK_SCOPE=READABILITY_ONLY_INCIDENTS_NOT_CLOSED\n\nFail -> STOP.\n\n===============================================================================\n12. GITEA READBACK\n===============================================================================\n\nAuthoritative:\n\nhttps://git.gram1.ru/homelab-admin/homelab-public-context/raw/branch/assistant-runtime/runtime/history/<COMMAND_ID>.txt\n\nJSON, если нужен:\n\nhttps://git.gram1.ru/homelab-admin/homelab-public-context/raw/branch/assistant-runtime/runtime/history/<COMMAND_ID>.json\n\nНельзя делать вывод по runtime/latest.txt,\nесли COMMAND_ID не совпадает.\n\n===============================================================================\n13. КАК СИНХРОНИЗИРОВАТЬ ДВА ЧАТА\n===============================================================================\n\nПосле каждого accepted checkpoint:\n\n1. чат публикует exact COMMAND_ID;\n2. второй чат читает immutable Gitea history;\n3. оба обновляют общий current-state;\n4. FAIL/RCA не считать product progress;\n5. PASS read-only может закрывать audit/preflight;\n6. mutation checkpoint только Lane A.\n\nЕсли Lane A сделал change:\nLane B перед следующим audit обязан заново прочитать этот exact checkpoint.\n\nЕсли Lane B обнаружил HOLD:\nLane A не запускает mutation до разбора HOLD.\n\n===============================================================================\n14. PROMPT ДЛЯ ЧАТА A — SINGLE WRITER\n===============================================================================\n\nТы LANE A / SINGLE WRITER для NEWFI Portal200.\n\nИспользуй Gitea assistant-runtime как machine truth.\nНе занимайся KingOfWolk: KOW CSP agreed stage уже CLOSED.\n\nCurrent NEWFI checkpoints:\n- APPLY3 FAIL, invalid result contract, mutation outcome UNKNOWN.\n- CONTRACTAST1 OK read-only.\n- IMPORTDISC2 OK read-only.\n- REBUILDHELP1 OK read-only.\n- native XenForo command xf:addon-rebuild [options] <id> подтверждён.\n\nТвоя задача:\nпараллельно с Lane B спроектировать NEWFI Portal200 APPLY4,\nно НЕ запускать mutation, пока Lane B не вернёт\nELIGIBLE_FOR_PORTAL200_APPLY4_PREP.\n\nAPPLY4:\n- новый unique COMMAND_ID family NEWFI-260907-A-PORTAL200-...\n- exact authority checks;\n- current-state preconditions;\n- correct homelab-chat-run result contract;\n- native xf:addon-rebuild with exact live-confirmed add-on ID;\n- fail closed;\n- rollback proof;\n- verification;\n- single writer;\n- exact Gitea publication/readback.\n\nПеред каждой реальной mutation заново прочитай последние Lane A + Lane B checkpoints.\n\n===============================================================================\n15. PROMPT ДЛЯ ЧАТА B — READ-ONLY AUDITOR\n===============================================================================\n\nТы LANE B / STRICT READ-ONLY AUDITOR для NEWFI Portal200.\n\nНикаких Git/application/DB/production mutations.\n\nИспользуй proven bridge:\ndirect read-only phase outside homelab-chat-run;\nserialized sanitized publication through runner.\n\nCOMMAND_ID family:\nNEWFI-260907-B-PORTAL200-...\n\nСразу выполни post-APPLY3 current-state recovery audit:\n\n- authority checks;\n- runner SHA + contract;\n- authoritative Git local/remote/clean;\n- exact NEWFI staging/prod identity;\n- exact XenForo docroot/version;\n- exact Portal Add-On ID;\n- installed/version/rebuildable state;\n- APPLY3 aftermath;\n- file/source hashes;\n- service health;\n- relevant HTTP routes;\n- XF error log state;\n- read-only DB evidence;\n- no mutation.\n\nFinal decision:\nELIGIBLE_FOR_PORTAL200_APPLY4_PREP\nor exact HOLD_...\n\nПубликуй bounded sanitized evidence в immutable Gitea history.\nПосле публикации сообщи exact COMMAND_ID.\n\n===============================================================================\n16. РЕКОМЕНДУЕМЫЙ СТАРТ СЕЙЧАС\n===============================================================================\n\nЛучший быстрый порядок:\n\nNOW:\n- текущий чат = Lane A;\n- новый второй чат = Lane B.\n\nОдновременно:\nLane A готовит APPLY4 design.\nLane B снимает current-state recovery audit.\n\nКогда Lane B PASS:\nLane A сверяет immutable evidence и запускает единственный change APPLY4.\n\nПосле APPLY4:\nLane B выполняет независимый read-only post-change verification,\nесли это реально добавляет evidence и не дублирует уже встроенный rollback/canary.\n\n===============================================================================\n17. COUNTER / ROADMAP\n===============================================================================\n\nНе использовать KingOfWolk counter.\nУ KOW counter = 0 и scope закрыт.\n\nДля NEWFI ранее использовалась рабочая оценка оставшихся команд,\nно её нельзя считать authoritative runtime state без восстановления NEWFI roadmap.\n\nПервый Lane B recovery audit должен также найти/проверить текущую NEWFI roadmap/\naccepted-stage count, если он хранится в repo/reference.\n\nДо этого не печатать ложный точный countdown.\n\n===============================================================================\n18. SOURCE-OF-TRUTH PRIORITY\n===============================================================================\n\nПри конфликте:\n\n1. /etc/pve/HOMELAB_ASSISTANT_ERROR_REGISTER.md\n2. /etc/pve/31_HOMELAB_REFERENCE.md\n3. exact immutable Gitea runtime/history/<CID>.txt\n4. authoritative Git source/current live state\n5. этот handoff\n\nЭтот handoff ускоряет старт, но не перекрывает более свежий live/Gitea evidence.\n\n===============================================================================\nAPPENDIX A\nПОЛНЫЙ HANDOFF ИЗ ВТОРОГО ЧАТА: KINGOFWOLK CSP\n(сохранён целиком; используется для operational/concurrency rules, не как NEWFI product-state)\n===============================================================================\n\n\nПОЛНЫЙ HANDOFF: KINGOFWOLK CSP\nДата контекста: 2026-09-07\n\n1. СТАТУС ПРОЕКТА НА МОМЕНТ HANDOFF\n\nПроект: KingOfWolk forum CSP.\n\nShared counter:\n0 команд до полного финиша.\n\nВажно: 0 означает, что согласованный безопасный CSP-stage полностью завершён и подтверждён evidence. Это не означает, что CSP доведён до теоретически максимальной жёсткости.\n\nОтдельно оставлены будущие hardening-задачи:\n- удаление style-src 'unsafe-inline';\n- рефакторинг существующего javascript: URL;\n- перевод script-src-elem из Report-Only в enforcing после достаточного периода наблюдения.\n\nФинальный accepted checkpoint:\n\nKOW-260907-A-FINAL1\nSTATUS=OK\nRC=0\nDECISION=KINGOFWOLK_CSP_AGREED_STAGE_FINAL_EVIDENCE_CLOSED\n\nФинальный canary не внёс изменений в production.\n\n\n2. CANONICAL KINGOFWOLK ENVIRONMENT\n\nФорум:\n\nDomain:\nhttps://kingofwolk.ru\n\nForum VM:\nVM160\nhost: pve02\nIP: <PRIVATE_IPV4>\n\nXenForo:\n2.3.12\nXF id: 2031270\n\nDatabase:\nxf_kingofwolk\n\nDocument root:\n/var/www/forums/kingofwolk/public\n\nXF source:\n/var/www/forums/kingofwolk/src/XF\n\nИз ранее принятого baseline:\n\nboardActive = 1\nboard title = KingOfWolk\nstyle id = 2\nstyle name = KingOfWolk Dark\n\nCAPTCHA = Cloudflare Turnstile\nfriendly URLs = enabled\nthird-party add-ons = none\n\nusers = 2\nadmins = 1\nnodes = 13\nthreads = 73\nposts = 73\nattachments = 0\nXF errors = 0\n\nOrigin-side services были healthy:\n\nNginx\nMariaDB\nphp8.3-fpm\n\nCSP реализуется на edge, а не origin XenForo.\n\n\n3. EDGE / NPMPLUS\n\nEdge находится на:\n\nVM130\nhost: pve03\n\nNPMplus:\n\ncontainer: npmplus\nimage: zoeyvid/npmplus:2026-06-17-b1\n\nLive KingOfWolk proxy config:\n\n/opt/npmplus/nginx/proxy_host/996.conf\n\nMetadata:\n\nowner: root:root\nmode: 0644\n\nCSP collector log:\n\n/opt/npmplus/csp-reports/kingofwolk-csp-report.log\n\nLog metadata:\n\nroot:root\n0600\n\nDirectory:\n\n0700\n\nCollector endpoint:\n\n/__csp-report-v1\n\nSemantics:\n\nGET  -> 405\nAllow -> POST\n\nCollector поддерживает:\n\napplication/csp-report\napplication/reports+json\napplication/json\n\nCollector sanitizes:\n- script-sample;\n- query/fragment у URI.\n\nRotation threshold:\n\n>= 5 MiB\n\nФинальный canary снова подтвердил:\n\ncollector GET = 405\nAllow = POST\n\n\n4. GIT — AUTHORITATIVE SOURCE\n\nИспользуемый repo:\n\nhomelab-admin/homelab-ops\n\nИзолированный CSP worktree:\n\n/root/kingofwolk-csp-baseline-20260907\n\nBranch:\n\nforum/kingofwolk-csp-baseline-20260907\n\nНе использовать /srv/homelab-ops для изменений KingOfWolk CSP.\nИсторически он был dirty/diverged и использовался только как reference.\n\nClone-local Git identity:\n\nuser.name  = homelab-ops-bootstrap\nuser.email = root@pve01.gram1.ru\n\nТекущий финальный accepted HEAD:\n\n6f584c5faa76d0067b08977aeb583fa0e4de14aa\n\nParent:\n\n3e5d8584ae6887c292cc910c5796e73d8d20aecd\n\nCommit message:\n\ncsp(kingofwolk): stage script nonce and enforce font media\n\nТекущий source file:\n\ndeploy/forums/kingofwolk/edge/996.conf\n\nТекущий source SHA / production edge SHA:\n\n458c2cf0763e4790f7d2d3757efd883b25813a31aab4e8dce6f785b8dea48a6e\n\nФинальный canary подтвердил:\n\nGit local HEAD  = 6f584c5faa76d0067b08977aeb583fa0e4de14aa\nGit remote HEAD = 6f584c5faa76d0067b08977aeb583fa0e4de14aa\nworktree clean  = true\n\nИ edge до/после финального canary оставался:\n\n458c2cf0763e4790f7d2d3757efd883b25813a31aab4e8dce6f785b8dea48a6e\n\n\n5. ИСТОРИЯ ACCEPTED GIT CSP COMMITS\n\nПоследовательность основных accepted commits:\n\n6908d4ebf2552244a68e3c0990fdc3a219c05d2c\ninitial CSP baseline docs\n\nf8d1ae6981df35f25d09a41392bc0a26742b7f38\nJoyPixels Report-Only allowance\n\n34f9c76c5cbf81f9cdf7f50d1ac501cf870abc9c\nminimal structural enforcement source\n\nc7a8a68a74fd3eb74cfb708b6bd3b866159b4899\ncsp(kingofwolk): enforce same-origin form submissions\n\nЕго source SHA:\n\n834973af57263b326ca6aee52b2ecb3fa2cf0fb486e5a77a62d4210395b8d9c3\n\nСледующий:\n\ne4635c9997801a0ea65aad727270c88ee3bdb817\ncsp(kingofwolk): enforce PWA self sources\n\nSource SHA:\n\n28e855ff56c4844768f0e8606fe0edc2acb3f548a5c06fa15c0d80ae00e2bc1b\n\nСледующий:\n\n3e5d8584ae6887c292cc910c5796e73d8d20aecd\ncsp(kingofwolk): enforce image and network sources\n\nSource SHA:\n\nfc9fb1dbdb6141bfb43a8122dcf3db435a94da48d0a0c02fe9dfae019b1439c5\n\nФинальный текущий commit:\n\n6f584c5faa76d0067b08977aeb583fa0e4de14aa\ncsp(kingofwolk): stage script nonce and enforce font media\n\nSource SHA:\n\n458c2cf0763e4790f7d2d3757efd883b25813a31aab4e8dce6f785b8dea48a6e\n\n\n6. ТЕКУЩИЙ PRODUCTION ENFORCING CSP\n\nФинальный enforcing CSP:\n\nbase-uri 'self';\nobject-src 'none';\nframe-ancestors 'self';\nform-action 'self';\nworker-src 'self';\nmanifest-src 'self';\nimg-src 'self' data: blob: https://cdn.jsdelivr.net/joypixels/assets/8.0/png/unicode/64/;\nconnect-src 'self' https://challenges.cloudflare.com;\nframe-src 'self' https://challenges.cloudflare.com;\nfont-src 'self' data:;\nmedia-src 'self';\n\nВ одной строке:\n\nbase-uri 'self'; object-src 'none'; frame-ancestors 'self'; form-action 'self'; worker-src 'self'; manifest-src 'self'; img-src 'self' data: blob: https://cdn.jsdelivr.net/joypixels/assets/8.0/png/unicode/64/; connect-src 'self' https://challenges.cloudflare.com; frame-src 'self' https://challenges.cloudflare.com; font-src 'self' data:; media-src 'self';\n\nЧто намеренно НЕ enforcing:\n\ndefault-src\nscript-src\nscript-src-elem\nscript-src-attr\nstyle-src\nstyle-src-elem\nstyle-src-attr\n\nТакже enforcing policy не содержит:\n\n'unsafe-inline'\n'unsafe-eval'\n\nЭто намеренно: script/style hardening ещё не переведён в production enforcement.\n\n\n7. ТЕКУЩИЙ PRODUCTION REPORT-ONLY CSP\n\nSource-template на edge содержит Nginx variable $request_id.\n\nЛогическая policy:\n\ndefault-src 'self';\nbase-uri 'self';\nobject-src 'none';\nframe-ancestors 'self';\nform-action 'self';\n\nscript-src 'self' 'unsafe-inline' https://challenges.cloudflare.com;\n\nscript-src-elem\n    'self'\n    'nonce-$request_id'\n    https://challenges.cloudflare.com;\n\nstyle-src 'self' 'unsafe-inline';\n\nimg-src\n    'self'\n    data:\n    blob:\n    https://cdn.jsdelivr.net/joypixels/assets/8.0/png/unicode/64/;\n\nfont-src 'self' data:;\n\nconnect-src\n    'self'\n    https://challenges.cloudflare.com;\n\nframe-src\n    'self'\n    https://challenges.cloudflare.com;\n\nworker-src 'self';\nmanifest-src 'self';\nmedia-src 'self';\n\nreport-uri /__csp-report-v1;\n\nТочная source-строка:\n\ndefault-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'self'; form-action 'self'; script-src 'self' 'unsafe-inline' https://challenges.cloudflare.com; script-src-elem 'self' 'nonce-$request_id' https://challenges.cloudflare.com; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: https://cdn.jsdelivr.net/joypixels/assets/8.0/png/unicode/64/; font-src 'self' data:; connect-src 'self' https://challenges.cloudflare.com; frame-src 'self' https://challenges.cloudflare.com; worker-src 'self'; manifest-src 'self'; media-src 'self'; report-uri /__csp-report-v1;\n\nПри HTTP response $request_id уже заменён Nginx на фактический per-request nonce.\n\n\n8. NGINX NONCE TRANSPORT\n\nТекущий source также содержит transport для nonce-инъекции.\n\nКлючевые строки:\n\nproxy_set_header Accept-Encoding \"\";\nsub_filter_once off;\nsub_filter '<script' '<script nonce=\"$request_id\"';\n\nЗачем отключено upstream compression:\n\nsub_filter должен видеть HTML body в несжатом виде.\n\nДо production promotion был отдельно доказан forwarded-origin request:\n\nHTTP = 200\nContent-Encoding = NONE\n\nNonce source:\n\n$request_id\n\nВ Report-Only header используется:\n\n'nonce-$request_id'\n\nВ HTML тот же $request_id инъектируется в каждый <script> tag.\n\n\n9. ФИНАЛЬНЫЙ NONCE EVIDENCE\n\nФинальный checkpoint:\n\nKOW-260907-A-FINAL1\n\nпроверил HTML маршруты дважды:\n\n/\n /login/\n /register/\n /help/smilies/\n /threads/dobro-pozhalovat-na-ofitsial-nyi-forum-kingofwolk.1/\n\nДля каждого запроса проверялось:\n\nHTTP = 200\nровно один nonce в CSP Report-Only\nnonce не содержит literal $\nnonce имеет допустимый формат\nкаждый <script> имеет ровно один nonce\nnonce каждого <script> == nonce из response CSP header\nraw nonce count == parsed script count\n\nДополнительно:\n\nnonce не должен повторяться между двумя запросами одного route\nnonce не должен совпадать ни с одним nonce других canary requests\n\nФинальный результат:\n\nKOWAFINAL1_NONCE_UNIQUE_ACROSS_ALL_REQUESTS=true\nKOWAFINAL1_NONCE_VALUES_EXPORTED=NO\n\nТо есть сами nonce наружу не публиковались.\n\n\n10. CSP REPORT LOG BASELINE\n\nПринятый baseline:\n\nSHA256:\n2f7977cbfaed7953bd70033c0cf92138eedf974f5886fadf4b4971f2d00a4143\n\nlines:\n2\n\nИсторически в нём:\n\nline 1 = synthetic test\nline 2 = historical real JoyPixels violation до allow-list\n\nЭтот baseline не менялся через:\n\n- PWA stage;\n- img/connect/frame stage;\n- nonce design;\n- font/media promotion;\n- production Stage2;\n- финальный browser/evidence canary.\n\nФинальный результат:\n\nKOWAFINAL1_NEW_CSP_REPORTS_AFTER_FINAL_BROWSER_CANARY=0\n\nNPMplus:\n\nbefore = healthy\nafter  = healthy\n\n\n11. ДРУГИЕ SECURITY HEADERS\n\nОни не менялись и финальный canary проверил их exact match.\n\nX-Frame-Options:\nSAMEORIGIN\n\nX-Content-Type-Options:\nnosniff\n\nReferrer-Policy:\nstrict-origin-when-cross-origin\n\nStrict-Transport-Security:\nmax-age=31536000\n\nPermissions-Policy:\ngeolocation=(), microphone=(), camera=()\n\nРанее жёлтые browser console warnings были связаны с Permissions-Policy, а не с CSP.\n\n\n12. JOYPIXELS\n\nРазрешён только path-scoped источник:\n\nhttps://cdn.jsdelivr.net/joypixels/assets/8.0/png/unicode/64/\n\nНе разрешён весь:\n\nhttps://cdn.jsdelivr.net\n\nРанее dedicated evidence:\n- реальный historical CSP report указывал JoyPixels;\n- /help/smilies/ реально использует этот path;\n- bad JoyPixels path count = 0.\n\nФинальный canary:\n\nKOWAFINAL1_JOYPIXELS_RENDERED_REF_COUNT=32\nKOWAFINAL1_JOYPIXELS_SAMPLE_HTTP=200\n\n\n13. CLOUDFLARE TURNSTILE\n\nTurnstile остаётся обязательной runtime зависимостью для регистрации.\n\nНужные разрешения сохранены:\n\nscript:\nhttps://challenges.cloudflare.com\n\nconnect:\nhttps://challenges.cloudflare.com\n\nframe:\nhttps://challenges.cloudflare.com\n\nВ текущем enforcing уже есть:\n\nconnect-src 'self' https://challenges.cloudflare.com;\nframe-src 'self' https://challenges.cloudflare.com;\n\nВ Report-Only script policies также Cloudflare разрешён.\n\nКритически важный урок:\n\nне требовать статический <script src=\"https://challenges.cloudflare.com/...\"> в исходном HTML.\n\nTurnstile может быть динамически instantiated.\n\nИменно из-за неправильного static-script требования ранее упал:\n\nKOW-260907-A-ICF5\n\nс:\n\nTURNSTILE_SCRIPT_REF_MISSING\n\nПосле исправления модели:\n\nKOW-260907-A-ICF6\n\nбыл accepted.\n\nФинальный canary проверял наличие Turnstile/challenges runtime tokens на /register/, а не статический script tag.\n\n\n14. FORM-ACTION\n\nЭтап полностью закрыт ранее.\n\nEnforcing:\n\nform-action 'self'\n\nПеред promotion были проверены:\n\nexternal public form origins = 0\npayment profiles = 0\nuser upgrades = 0\nprovider/options related external forms = 0\n\nProduction apply был с rollback proof и browser/server canary.\n\nНе пересматривать без новой фактической причины.\n\n\n15. PWA DIRECTIVES\n\nПолностью accepted:\n\nworker-src 'self'\nmanifest-src 'self'\n\nЗакрыты checkpoints:\n\nPWA3 audit\nPWA4 preflight\nPWA5 Git promotion\nPWA6 production + rollback proof\nPWA9 final recovery/readback\n\nИсторический transport bug:\n\nPWA7 browser canary сам по себе был PASS,\nно outer publication сломался.\n\nPWA8 RCA:\npublisher ошибочно ожидал evidence path в sys.argv[1].\n\nПосле этого правило:\n\npublisher должен использовать literal evidence path, а не рассчитывать, что sys.argv[1] содержит путь.\n\n\n16. IMG/CONNECT/FRAME STAGE\n\nПолностью закрыт.\n\nТекущие enforcing directives:\n\nimg-src 'self' data: blob: https://cdn.jsdelivr.net/joypixels/assets/8.0/png/unicode/64/;\n\nconnect-src 'self' https://challenges.cloudflare.com;\n\nframe-src 'self' https://challenges.cloudflare.com;\n\nКлючевые accepted checkpoints:\n\nKOW-260907-A-ICF2\nSTATUS=OK\nDECISION=ELIGIBLE_FOR_IMG_CONNECT_FRAME_SOURCE_PREP\n\nEvidence:\n\nCSS bytes scanned = 297724\nstylesheets = 9\nCSS url refs = 245\norigins = DATA / SELF\n\nGit promotion:\n\nKOW-260907-A-ICF3\n\nCommit:\n\n3e5d8584ae6887c292cc910c5796e73d8d20aecd\n\nProduction apply:\n\nKOW-260907-A-ICF4\n\nRollback proof passed.\n\nBrowser recovery:\n\nKOW-260907-A-ICF6\nDECISION=IMG_CONNECT_FRAME_ENFORCEMENT_POST_BROWSER_CANARY_CLEAN\n\n\n17. INLINE SCRIPT/STYLE AUDIT — ИСХОДНЫЕ ВЫВОДЫ\n\nДо nonce stage:\n\nrendered nonce attrs = 0\nnative nonce source signals = 0\n\nKOW-260907-A-INLINE1 показал по 5 guest routes:\n\nexternal_scripts = 35\n\ninline executable scripts = 5\ninline non-executable scripts = 3\ninline script tags total = 8\n\nstyle attributes = 31\n\njavascript: URLs = 6 occurrences\ndistinct javascript: values later narrowed to 1\n\nevent-handler attrs = 0\n\nscript nonce attrs = 0\nstyle nonce attrs = 0\nstyle tags = 0\n\nОсновной decision:\n\nHOLD_UNSAFE_INLINE_APPLICATION_NONCE_HASH_DESIGN_REQUIRED\n\n\n18. ПОЧЕМУ СТАТИЧЕСКИЕ HASHES ДЛЯ INLINE SCRIPTS БЫЛИ ОТКЛОНЕНЫ\n\nKOW-260907-A-INLINE2:\n\nSTATUS=OK\nRC=0\n\nDECISION=\nAPPLICATION_TEMPLATE_REFACTOR_DESIGN_REQUIRED\n\nБыло установлено:\n\nEXEC_SCRIPTS_WITH_DYNAMIC_MARKERS=5\nGLOBAL_DISTINCT_EXEC_SCRIPT_BODIES=5\nGLOBAL_DISTINCT_STYLE_ATTR_VALUES=7\nGLOBAL_DISTINCT_JAVASCRIPT_URLS=1\nGLOBAL_DISTINCT_EVENT_HANDLER_VALUES=0\n\nТо есть все 5 executable inline scripts имеют динамические признаки.\n\nПоэтому:\n- хеширование уже rendered script bodies не использовать;\n- не публиковать и не хешировать dynamic rendered inline values;\n- nonce оказался более подходящим механизмом для <script> elements.\n\n\n19. STYLE ATTRIBUTES\n\nБыло обнаружено:\n\n31 style attributes\n7 distinct style attribute values\n\nОни оказались стабильными между guest renders и не сработал secretish gate.\n\nНо removal style-src 'unsafe-inline' не включён в текущий завершённый scope.\n\nПричина:\n\nnonce работает для <style> / <script> elements, но не решает обычные style=\"\" attributes.\n\nПотенциальные будущие пути:\n- template/application refactor style attrs;\n- либо отдельный строго доказанный style-src-attr / 'unsafe-hashes' design.\n\nНа текущем production:\n\nReport-Only:\nstyle-src 'self' 'unsafe-inline';\n\nEnforcing style-src отсутствует.\n\n\n20. JAVASCRIPT: URLS\n\nИсходно:\n\n6 occurrences\n1 distinct value\nevent handlers = 0\n\nВ процессе анализа было решено:\n\nJAVASCRIPT_URL_DESIGN=\nAPPLICATION_REFACTOR_REQUIRED_NOT_HASH_ALLOWLIST\n\nТо есть javascript: URL не закрывается текущей CSP-stage через hash allowlist.\n\nБыло выполнено source mapping на VM160 по:\n\n/var/www/forums/kingofwolk/internal_data/code_cache/templates\n/var/www/forums/kingofwolk/src/XF\n/var/www/forums/kingofwolk/public/js\n\nRaw javascript: value наружу не публиковался.\n\nТекущий статус:\n\ndeferred application refactor.\n\n\n21. EDGE NONCE DESIGN SEQUENCE И HARNESS FAILURES\n\nВо время разработки nonce-stage было несколько не product failures, которые важно не путать с production regressions.\n\nKOW-260907-A-INLINE3\n\nSTATUS=FAIL\nRC=23\n\nFailed step:\n\norigin_compression\n\nError:\n\norigin_compression:RC_2\n\nПричина:\n\nprobe зависел от Python внутри guest/runtime path\n\nProduct mutation:\n\nNO\n\n\nKOW-260907-A-INLINE4\n\nSTATUS=FAIL\nRC=23\n\nFailed step:\n\ntransform_and_hash_candidates\n\nError:\n\n'str' object has no attribute 'decode'\n\nПричина — чистый harness bug:\n- transformed HTML уже был str;\n- helper повторно вызывал .decode().\n\nДо падения подтвердилось:\n\nGit clean\nNPMplus healthy\nnginx sub module compiled = true\nnginx version = 1.31.2\n\nproxy_pass count = 1\norigin gzip = gzip\norigin identity = NONE\nHTTP = 200\n\n\nKOW-260907-A-INLINE5\n\nSTATUS=FAIL\nRC=23\n\nFailed step:\n\nnginx_nonce_syntax_probe_tempfile\n\nError:\n\nEPHEMERAL_PROBE_FILE_NOT_CLEANED\n\nЭто был слишком строгий/неправильный cleanup harness.\n\nProduct mutation не было.\n\n\nKOW-260907-A-INLINE6\n\nSTATUS=FAIL\nRC=23\n\nFailed step:\n\nvm160_jsurl_source_map\n\nError:\n\nqout() got an unexpected keyword argument 'timeout'\n\nОпять чистый harness bug.\n\nДо падения уже было подтверждено:\n\ndistinct javascript URLs = 1\ndistinct style attrs = 7\nevent handlers = 0\nGit clean\nproduction exact\nstale probe files = 0\n\n\nKOW-260907-A-INLINE7\n\nRecovery без повторения всего INLINE6.\n\nSTATUS=OK\nRC=0\n\nОн прочитал evidence INLINE6 и выполнил только недостающий VM160 source-map.\n\nDecision:\n\nHOLD_NONCE_STYLE_HASH_DESIGN\n\nНо единственный HOLD был:\n\nUPSTREAM_IDENTITY_PROBE_NOT_CLEAN\n\nПочему:\n\ndirect upstream ответил:\n\nHTTP=301\nContent-Encoding=NONE\n\nТо есть compression уже был в порядке; harness ошибочно требовал именно HTTP==200.\n\n\nKOW-260907-A-INLINE8\n\nИсправил probe с правильными forwarded headers.\n\nРезультат:\n\nSTATUS=OK\nRC=0\n\nFORWARDED_IDENTITY_200_OK=true\nFORWARDED_IDENTITY_TRANSPORT_OK=true\n\nHOLD_REASONS=[]\n\nDECISION=\nELIGIBLE_FOR_STAGED_SCRIPT_ELEM_NONCE_SOURCE_PREP\n\nЭто финально закрыло nonce design.\n\n\n22. LANE B — FONT/MEDIA\n\nLane B выполнил независимый read-only audit.\n\nAccepted checkpoint:\n\nKOW-260907-B-FONTMEDIA4\nSTATUS=OK\nRC=0\n\nDECISION=\nELIGIBLE_FOR_FONT_MEDIA_SOURCE_PREP\n\nПодтверждено:\n\nnative media attachments = 0\nXFMG media = 0\n[MEDIA] content = 0\nboard URL = https://kingofwolk.ru\n\nПри этом наличие media-site capability не считалось само по себе runtime requirement.\n\nLane B после этого прекратил новые checkpoints.\n\nLane A стал единственным writer.\n\n\n23. FONT/MEDIA FINAL POLICY\n\nПосле независимого Lane B audit и дополнительной precommit verification были enforcing добавлены:\n\nfont-src 'self' data:;\nmedia-src 'self';\n\nНа финальном canary:\n\nFONT_ORIGINS=[]\n\nдля непосредственно проверенных текущих страниц, то есть никаких новых внешних font runtime origins выявлено не было.\n\nРанее dedicated audit уже доказал допустимость SELF/DATA.\n\nRendered media origins также не потребовали дополнительного allow-list.\n\n\n24. KOW-260907-A-STAGE1 — GIT PROMOTION\n\nКоманда:\n\nKOW-260907-A-STAGE1\nMODE=change\nCOMPONENT=kingofwolk-csp-font-media-nonce-stage-git-promotion\n\nВыполнила перед mutation:\n\n- exact Git branch/head/remote/clean checks;\n- production old edge SHA check;\n- CSP log baseline;\n- NPMplus health;\n- font/media audit;\n- route checks;\n- DB read-only media checks;\n- repository validation;\n- unit tests.\n\nПосле этого построила exact candidate:\n\n1. enforcement:\n\n+ font-src 'self' data:;\n+ media-src 'self';\n\n2. Report-Only:\n\n+ script-src-elem 'self' 'nonce-$request_id' https://challenges.cloudflare.com;\n\n3. transport:\n\nproxy_set_header Accept-Encoding \"\";\nsub_filter_once off;\nsub_filter '<script' '<script nonce=\"$request_id\"';\n\nНе менялись:\n\nstyle-src 'unsafe-inline'\nbase script-src 'unsafe-inline'\njavascript: behavior\n\nRepository validation:\n\nPASS\n\nTests:\n\nPASS\n\nНовый Git HEAD:\n\n6f584c5faa76d0067b08977aeb583fa0e4de14aa\n\nНовый source SHA:\n\n458c2cf0763e4790f7d2d3757efd883b25813a31aab4e8dce6f785b8dea48a6e\n\nLocal == remote.\n\nВо время Stage1 production оставался на старом SHA.\n\n\n25. KOW-260907-A-STAGE2 — PRODUCTION APPLY\n\nKOW-260907-A-STAGE2\nSTATUS=OK\nRC=0\nMODE=change\nRESULT_CONTRACT_STATUS=OK\nCHANGES_MADE=true\n\nПеред apply были проверены:\n\nrunner SHA\nGit branch/head/parent/message\nsource exact bytes\nproduction old SHA\nlive file owner/mode\nCSP log baseline\nNPMplus health\nnginx -t\npublic old CSP exact\n\nRunner baseline SHA:\n\nb248a4c32c9cc64e5747e7dce6c7fc0a23f5124a77c71ce72e27a81aceae9d2d\n\nStage2 sequence:\n\nPhase 1 — APPLY1\n\nУстановлен новый candidate.\n\nПроверены:\n- nginx -t;\n- reload;\n- routes;\n- exact enforcing CSP;\n- dynamic Report-Only nonce;\n- каждый HTML <script> получил nonce;\n- nonce == header nonce;\n- CSP log baseline;\n- NPMplus health.\n\nPhase 2 — ROLLBACK PROOF\n\nProduction вернули к старому:\n\nfc9fb1dbdb6141bfb43a8122dcf3db435a94da48d0a0c02fe9dfae019b1439c5\n\nПроверены old policies, routes, отсутствие nonce injection, health/log.\n\nRollback proof:\n\nPASS\n\nPhase 3 — FINAL REAPPLY\n\nCandidate применён повторно.\n\nФинальный edge:\n\n458c2cf0763e4790f7d2d3757efd883b25813a31aab4e8dce6f785b8dea48a6e\n\nGit не drifted.\n\nИтоговая reason:\n\nFONT_MEDIA_ENFORCED_AND_SCRIPT_ELEM_NONCE_REPORT_ONLY_STAGED_WITH_ROLLBACK_PROOF\n\n\n26. PRODUCTION ROLLBACK ARTIFACT\n\nStage2 создал manual rollback backup в NPMplus VM/container filesystem:\n\n/opt/npmplus/manual-backups/kingofwolk-csp-font-media-nonce-stage-20260907-6f584c5/\n\nOld config:\n\n996.conf.before\n\nOld SHA:\n\nfc9fb1dbdb6141bfb43a8122dcf3db435a94da48d0a0c02fe9dfae019b1439c5\n\nТакже stage directory использовался для candidate copy.\n\nЕсли когда-либо потребуется ручной emergency rollback, сначала всё равно заново проверить текущий live state и не предполагать, что этот backup всё ещё является правильной rollback target после будущих изменений.\n\n\n27. KOW-260907-A-FINAL1 — ФИНАЛЬНЫЙ EVIDENCE CLOSURE\n\nSTATUS=OK\nRC=0\nMODE=read-only\nCHANGES_MADE=false\n\nDecision:\n\nKINGOFWOLK_CSP_AGREED_STAGE_FINAL_EVIDENCE_CLOSED\n\nClosure scope:\n\nAGREED_SAFE_CSP_STAGE\n\nПроверено:\n\n- Git exact local/remote/clean;\n- source SHA exact;\n- production edge SHA exact;\n- edge metadata 0:0:644;\n- CSP log baseline before;\n- NPMplus healthy;\n- nginx -t;\n- пять HTML routes по два запроса;\n- /service_worker.js;\n- /webmanifest.php;\n- exact security headers;\n- exact enforcing CSP;\n- exact dynamic Report-Only CSP;\n- unique nonce across requests;\n- nonce coherence для всех <script>;\n- JoyPixels rendered refs + HTTP sample;\n- fonts;\n- media origins;\n- Turnstile signal;\n- collector 405/POST;\n- CSP log baseline after;\n- production SHA after;\n- Git state after.\n\nФинал:\n\nNEW_CSP_REPORTS_AFTER_FINAL_BROWSER_CANARY=0\nNONCE_UNIQUE_ACROSS_ALL_REQUESTS=true\nNPMPLUS_HEALTH_AFTER=healthy\n\n\n28. CURRENT FINAL HASHES / IDENTIFIERS — БЫСТРЫЙ БЛОК\n\nGit repo:\n/root/kingofwolk-csp-baseline-20260907\n\nBranch:\nforum/kingofwolk-csp-baseline-20260907\n\nCurrent HEAD:\n6f584c5faa76d0067b08977aeb583fa0e4de14aa\n\nParent:\n3e5d8584ae6887c292cc910c5796e73d8d20aecd\n\nCurrent source:\ndeploy/forums/kingofwolk/edge/996.conf\n\nCurrent source / production edge SHA:\n458c2cf0763e4790f7d2d3757efd883b25813a31aab4e8dce6f785b8dea48a6e\n\nPrevious production SHA:\nfc9fb1dbdb6141bfb43a8122dcf3db435a94da48d0a0c02fe9dfae019b1439c5\n\nCSP report log SHA:\n2f7977cbfaed7953bd70033c0cf92138eedf974f5886fadf4b4971f2d00a4143\n\nCSP report log lines:\n2\n\nRunner SHA:\nb248a4c32c9cc64e5747e7dce6c7fc0a23f5124a77c71ce72e27a81aceae9d2d\n\n\n29. OPERATIONAL COMMAND CONTRACT\n\nЛюбая новая server command по этому проекту должна сначала читать:\n\n/etc/pve/HOMELAB_ASSISTANT_ERROR_REGISTER.md\n/etc/pve/31_HOMELAB_REFERENCE.md\n\nИ visibly emit:\n\nERROR_REGISTER_CHECK=OK\nREFERENCE_CHECK=OK\nAUTHORITY_CHECK_SCOPE=READABILITY_ONLY_INCIDENTS_NOT_CLOSED\n\nОбычно shell:\n\nroot@pve01:~#\n\nGit discipline:\n\nПеред любым change:\n\ngit status\nbranch\nlocal HEAD\nremote HEAD\n\nFail closed при неизвестном drift.\n\nДо commit:\n\ngit diff --check\n\nStaging:\n\ngit add <explicit path>\n\nНе использовать:\n\ngit add .\n\nПосле staging:\n\ngit diff --cached --check\ngit diff --cached\n\nПосле push:\n\ngit fetch\nLOCAL_HEAD == REMOTE_HEAD\n\nЗапрещённый destructive workflow:\n\ngit reset --hard\ngit clean -fd\nforce push\n\nТакже:\n\nне мутировать XenForo state raw SQL.\n\nRead-only SQL допустим.\n\n\n30. CONCURRENCY / LANE MODEL\n\nБыла доказана настоящая параллельность read-only lanes через direct bridge.\n\nCheckpoint:\n\nKOW-260907-PBR2\n\nDecision:\n\nALLOW_TRUE_PARALLEL_READ_ONLY_LANES\n\nПри этом обычные full runner carriers сериализуются из-за flock.\n\nCheckpoint:\n\nKOW-260907-CONC1\n\nПоэтому правила:\n\nread-only direct bridge:\nможет работать параллельно\n\nGit commit/push:\nровно один writer\n\nedge production apply:\nровно один writer\n\nXenForo/app mutation:\nровно один writer\n\nСейчас Lane B закончен.\n\nЕсли CSP scope снова открыть:\n\nтекущий чат/следующий оператор должен оставаться единственным writer.\n\n\n31. WINDOWS TRANSPORT\n\nСтандартный transport:\n\n.CMD\n  -> Windows PowerShell 5.1\n  -> Plink\n  -> Pageant\n  -> SSH pve01\n  -> direct bridge или homelab-chat-run\n  -> Gitea publication\n  -> readback\n\nPuTTY:\n\nC:\\Program Files\\PuTTY\\plink.exe\nC:\\Program Files\\PuTTY\\pageant.exe\n\nPPK:\n\n<USERPROFILE>\\Documents\\ssh\\homelab_ed25519.ppk\n\nPPK encrypted:\naes256-cbc\n\n<REDACTED_SENSITIVE_LINE>\n\n<REDACTED_SENSITIVE_LINE>\n\nНормальный carrier:\n\nplink\n-batch\n-agent\n-ssh\n-P 22\n-m <remotePath>\nroot@<PRIVATE_IPV4>\n\nНе использовать обычным carrier:\n\n-i\n\nPageant должен уже держать unlocked key.\n\nEndpoint:\n\npve01\nroot@<PRIVATE_IPV4>:22\n\nPuTTY registry host key:\n\nHKCU:\\Software\\SimonTatham\\PuTTY\\SshHostKeys\n\nssh-ed25519@22:<PRIVATE_IPV4>\n\n\n32. CARRIER IMPLEMENTATION RULES\n\nPowerShell запускает Plink через:\n\nStart-Process\n\nОбязательно:\n\nseparate stdout\nseparate stderr\nreal ExitCode\n-NoNewWindow\n\nНе использовать:\n\npause\nnotepad\nMobaXterm\n\nTemp diagnostics:\n\n%TEMP%\n\nRemote command file:\n\nUTF-8\nno BOM\none physical line\nSHA verified\n\nБольшие payloads:\n\nzlib + base64\nSHA256 verification\n/usr/bin/python3 -I -B\n\nКаждый attempt:\n\nновый COMMAND_ID\n\nНе reuse failed ID.\n\nRunner:\n\n/usr/local/sbin/homelab-chat-run <CID> read-only|change <component> -- <command>\n\nChange result contract:\n\nOK\nBLOCKED\nFAIL\n\n\n33. GITEA RUNTIME PUBLICATION / READBACK\n\nRuntime repo:\n\nhomelab-admin/homelab-public-context\n\nBranch:\n\nassistant-runtime\n\nAuthoritative history path:\n\nruntime/history/<COMMAND_ID>.txt\n\nГлавное правило:\n\nне доверять generic latest без проверки COMMAND_ID.\n\nExact history конкретного command ID — authoritative.\n\nFast latest может вернуть unrelated/stale result.\n\n\n34. НЕДАВНИЕ .CMD ARTIFACTS ИЗ ЭТОГО ЧАТА\n\nПоследовательность последних команд:\n\nKOW-260907-A-INLINE2\nKOW_CSP_INLINE_HASH_FEASIBILITY_AUDIT_PLINK_GITEA_MOSCOW.cmd\n\nKOW-260907-A-INLINE3\nKOW_CSP_EDGE_NONCE_UNSAFE_HASHES_FEASIBILITY_PLINK_GITEA_MOSCOW.cmd\n\nKOW-260907-A-INLINE4\nKOW_CSP_EDGE_NONCE_UNSAFE_HASHES_FEASIBILITY2_PLINK_GITEA_MOSCOW.cmd\n\nKOW-260907-A-INLINE5\nKOW_CSP_EDGE_NONCE_UNSAFE_HASHES_FINAL_FEASIBILITY_PLINK_GITEA_MOSCOW.cmd\n\nKOW-260907-A-INLINE6\nKOW_CSP_EDGE_NONCE_STYLE_HASH_JSURL_DESIGN_AUDIT_PLINK_GITEA_MOSCOW.cmd\n\nKOW-260907-A-INLINE7\nKOW_CSP_INLINE6_RECOVERY_JSURL_SOURCE_MAP_PLINK_GITEA_MOSCOW.cmd\n\nKOW-260907-A-INLINE8\nKOW_CSP_SCRIPT_ELEM_NONCE_DESIGN_CLOSURE_PLINK_GITEA_MOSCOW.cmd\n\nKOW-260907-A-STAGE1\nKOW_CSP_FONT_MEDIA_NONCE_STAGE_GIT_PROMOTION_PLINK_GITEA_MOSCOW.cmd\n\nKOW-260907-A-STAGE2\nKOW_CSP_FONT_MEDIA_NONCE_STAGE_PRODUCTION_PLINK_GITEA_MOSCOW.cmd\n\nKOW-260907-A-FINAL1\nKOW_CSP_FINAL_BROWSER_EVIDENCE_CLOSURE_PLINK_GITEA_MOSCOW.cmd\n\nНе нужно повторно запускать их для «проверки», если нет новой причины.\nПри новом scope создавать новые IDs.\n\n\n35. ЧТО НЕ НАДО ПОВТОРЯТЬ СЛЕДУЮЩЕМУ ОПЕРАТОРУ\n\nУже закрыто, не делать заново без новой фактической причины:\n\nform-action audit\nPWA worker/manifest audit\nimg-src audit\nconnect-src audit\nframe-src audit\nJoyPixels path audit\nTurnstile static-script search\nfont-src/media-src discovery\ninline hash feasibility\nnonce feasibility\nupstream identity/compression feasibility\nfont/media Git promotion\nfont/media production promotion\nrollback proof\nfinal browser/evidence closure\n\nОсобенно:\n\nне повторять KOW-260907-B-FONTMEDIA4.\n\nLane B audit уже accepted.\n\n\n36. ЧТО ОСТАЁТСЯ ТОЛЬКО КАК FUTURE HARDENING\n\nЭто не незавершённые команды текущего counter.\n\nТекущий counter:\n\n0\n\nFuture scope можно открыть отдельно.\n\n\nA. script-src-elem enforcement\n\nСейчас:\n\nReport-Only only\n\nNonce транспорт уже работает и финально доказан.\n\nСледующий возможный будущий шаг — только после периода наблюдения CSP report log:\n\nперенести script-src-elem nonce policy в enforcing\n\nНо до этого надо заново проверить:\n\n- log не накопил реальные violations;\n- authenticated flows;\n- Turnstile;\n- admin/Account overlays, если входят в scope;\n- все важные XenForo page types.\n\n\nB. style-src 'unsafe-inline'\n\nСейчас всё ещё Report-Only:\n\nstyle-src 'self' 'unsafe-inline'\n\nПричина — style attributes.\n\nИсходное evidence:\n\n31 occurrences\n7 distinct values\n\nНужен отдельный application/template design.\n\n\nC. javascript: refactor\n\nЕсть:\n\n1 distinct javascript: value\nнесколько rendered occurrences\n\nНе разрешать это через сомнительный hash workaround.\n\nПринятый design:\n\nAPPLICATION_REFACTOR_REQUIRED_NOT_HASH_ALLOWLIST\n\n\n37. ТОЧКА СТАРТА ДЛЯ НОВОГО ЧАТА\n\nНовый чат должен считать canonical current state следующим:\n\nKINGOFWOLK CSP AGREED SAFE STAGE = CLOSED\n\nshared counter = 0\n\ncurrent Git HEAD:\n6f584c5faa76d0067b08977aeb583fa0e4de14aa\n\ncurrent edge/source SHA:\n458c2cf0763e4790f7d2d3757efd883b25813a31aab4e8dce6f785b8dea48a6e\n\nCSP log SHA:\n2f7977cbfaed7953bd70033c0cf92138eedf974f5886fadf4b4971f2d00a4143\n\nCSP log lines:\n2\n\nNPMplus:\nhealthy\n\nfinal accepted checkpoint:\nKOW-260907-A-FINAL1\n\nfinal decision:\nKINGOFWOLK_CSP_AGREED_STAGE_FINAL_EVIDENCE_CLOSED\n\nЕсли пользователь просит «продолжить CSP», сначала надо считать, что открывается новый hardening scope, потому что прежний shared counter уже завершён.\n\nНаиболее логичный новый порядок:\n\n1. read-only observation / authenticated coverage для script-src-elem Report-Only\n2. javascript: application refactor design\n3. style attribute refactor/hash design\n4. только затем новый enforcement promotion с отдельным rollback proof\n\nНо ничего из этого не является долгом старого плана.\n\n\n38. КОРОТКАЯ ИТОГОВАЯ ФОРМУЛИРОВКА ДЛЯ ВСТАВКИ В НОВЫЙ ЧАТ\n\nKingOfWolk CSP agreed safe stage полностью закрыт. Shared counter = 0.\nФинальный accepted checkpoint KOW-260907-A-FINAL1, STATUS=OK, RC=0,\nDECISION=KINGOFWOLK_CSP_AGREED_STAGE_FINAL_EVIDENCE_CLOSED.\n\nТекущий Git HEAD:\n6f584c5faa76d0067b08977aeb583fa0e4de14aa\n\nBranch:\nforum/kingofwolk-csp-baseline-20260907\n\nWorktree:\n/root/kingofwolk-csp-baseline-20260907\n\nSource:\ndeploy/forums/kingofwolk/edge/996.conf\n\nSource/production edge SHA:\n458c2cf0763e4790f7d2d3757efd883b25813a31aab4e8dce6f785b8dea48a6e\n\nCSP log baseline SHA:\n2f7977cbfaed7953bd70033c0cf92138eedf974f5886fadf4b4971f2d00a4143\n\nCSP log:\n2 строки\n\nНовых reports после финального browser-canary:\n0\n\nNPMplus:\nhealthy\n\nEnforcing сейчас закрывает:\nbase-uri\nobject-src\nframe-ancestors\nform-action\nworker-src\nmanifest-src\nimg-src\nconnect-src\nframe-src\nfont-src\nmedia-src\n\nscript-src-elem с per-request $request_id nonce находится только в Report-Only.\nNginx добавляет тот же nonce каждому <script> через sub_filter.\nФинальный canary доказал unique nonce per request и полную header↔script coherence.\n\nstyle-src 'unsafe-inline', существующий javascript: URL и перевод script-src-elem в enforcing оставлены как отдельный будущий hardening scope.\n\nLane B KOW-260907-B-FONTMEDIA4 accepted и не должен повторяться.\n\nЛюбой новый change:\n- один writer;\n- authority checks;\n- exact Git/source/edge/log prestate;\n- explicit staging;\n- rollback proof;\n- новый COMMAND_ID.\n\n\n39. ОСНОВНЫЕ AUTHORITATIVE EVIDENCE URLS\n\nФинальный evidence:\nhttps://git.gram1.ru/homelab-admin/homelab-public-context/raw/branch/assistant-runtime/runtime/history/KOW-260907-A-FINAL1.txt\n\nProduction apply:\nhttps://git.gram1.ru/homelab-admin/homelab-public-context/raw/branch/assistant-runtime/runtime/history/KOW-260907-A-STAGE2.txt\n\nGit promotion:\nhttps://git.gram1.ru/homelab-admin/homelab-public-context/raw/branch/assistant-runtime/runtime/history/KOW-260907-A-STAGE1.txt\n\nLane B font/media:\nhttps://git.gram1.ru/homelab-admin/homelab-public-context/raw/branch/assistant-runtime/runtime/history/KOW-260907-B-FONTMEDIA4.txt\n\nNonce design closure:\nhttps://git.gram1.ru/homelab-admin/homelab-public-context/raw/branch/assistant-runtime/runtime/history/KOW-260907-A-INLINE8.txt\n\nInline feasibility:\nhttps://git.gram1.ru/homelab-admin/homelab-public-context/raw/branch/assistant-runtime/runtime/history/KOW-260907-A-INLINE2.txt\n\nImg/connect/frame final recovery:\nhttps://git.gram1.ru/homelab-admin/homelab-public-context/raw/branch/assistant-runtime/runtime/history/KOW-260907-A-ICF6.txt\n\nImg/connect/frame production:\nhttps://git.gram1.ru/homelab-admin/homelab-public-context/raw/branch/assistant-runtime/runtime/history/KOW-260907-A-ICF4.txt\n\nCANDIDATE_LAYER_1_TEXT_END\nCANDIDATE_LAYER_2_SOURCE=file:newfi-54-portal200-apply3.cmd::b64::zlib\nCANDIDATE_LAYER_2_SHA256=97a1807a275e5d309591f7a7e044d7d56ba5b2f4c6a068df6353bae147707184\nCANDIDATE_LAYER_2_BYTES=34155\nCANDIDATE_LAYER_2_TEXT_BEGIN\nimport hashlib\nimport json\nimport pathlib\nimport shlex\nimport shutil\nimport subprocess\nimport sys\nimport xml.etree.ElementTree as ET\n\nCID = \"NEWFI-260907-PORTAL200-APPLY3\"\nBRANCH = \"implementation/newfi-closed-mvp-20260906\"\nOLD_HEAD = \"06bab5acd124e768f70305b3d7eca2f595871890\"\nWT = pathlib.Path(\"/root/newfi-portal/.worktrees/implementation-newfi-closed-mvp-20260906\")\nCAND_ROOT = pathlib.Path(\"/root/newfi-portal200-candidate/src/addons/Newfi/Portal\")\nPORTAL_REL = pathlib.Path(\"src/addons/Newfi/Portal\")\nGIT_PORTAL = WT / PORTAL_REL\nEXPECTED_NEW = {\n    \"Pub/Controller/Portal.php\": (363, \"619d489f7cc3b461479c702fa8825097ae22d3c6cfeb911e9f14ea1de9c36d6d\"),\n    \"Service/PortalData.php\": (5213, \"4da03f26294ab6d163a1a746dee4bb6a82d7d4f39e66b24246bc0eb4c455dd1d\"),\n    \"_data/templates.xml\": (10977, \"1650c3d868d4bc47703f1b75f1f179cd25309b2d3b20a2b848e81a4423c00861\"),\n}\nEXPECTED_OLD = {\n    \"Pub/Controller/Portal.php\": (247, \"53909e753ea5a011550fd280ad1c342a74ca9949be092dfbd95244243cae92f3\"),\n    \"_data/templates.xml\": (1461, \"c29c04f8b937284e821c87957653e87c2f6ac014fac30648a0f6b18e84392adf\"),\n}\nEXPECTED_GIT_PATHS = [str(PORTAL_REL / p) for p in sorted(EXPECTED_NEW)]\nBACKUP = f\"/root/newfi-portal200-backup-{CID}\"\n\n\nclass PortalError(RuntimeError):\n    pass\n\n\ndef emit(key, value=None):\n    if value is None:\n        print(key, flush=True)\n    elif isinstance(value, (dict, list, tuple, bool, int, float)):\n        print(\n            key + \"=\" + json.dumps(value, ensure_ascii=False, sort_keys=True, separators=(\",\", \":\")),\n            flush=True,\n        )\n    else:\n        print(key + \"=\" + str(value), flush=True)\n\n\ndef fail(code):\n    raise PortalError(code)\n\n\ndef sha_bytes(data):\n    return hashlib.sha256(data).hexdigest()\n\n\ndef file_meta(path):\n    data = pathlib.Path(path).read_bytes()\n    return len(data), sha_bytes(data)\n\n\ndef run(cmd, *, input_bytes=None, timeout=180, ok=(0,)):\n    try:\n        p = subprocess.run(\n            cmd,\n            input=input_bytes,\n            stdout=subprocess.PIPE,\n            stderr=subprocess.PIPE,\n            timeout=timeout,\n            check=False,\n        )\n    except subprocess.TimeoutExpired:\n        fail(\"SUBPROCESS_TIMEOUT\")\n    if p.returncode not in ok:\n        fail(\"SUBPROCESS_RC\")\n    return p\n\n\ndef git(*args, ok=(0,), timeout=120):\n    p = run([\"/usr/bin/git\", \"-C\", str(WT), *args], timeout=timeout, ok=ok)\n    return p.stdout.decode(\"utf-8\", \"replace\").strip()\n\n\ndef qga(target, argv, *, input_bytes=None, timeout=180):\n    if target == \"prod\":\n        cmd = [\n            \"/usr/sbin/qm\",\n            \"guest\",\n            \"exec\",\n            \"210\",\n            \"--synchronous\",\n            \"1\",\n            \"--timeout\",\n            str(timeout),\n        ]\n        if input_bytes is not None:\n            cmd += [\"--pass-stdin\", \"1\"]\n        cmd += [\"--\", *argv]\n    elif target == \"staging\":\n        q = [\n            \"/usr/sbin/qm\",\n            \"guest\",\n            \"exec\",\n            \"211\",\n            \"--synchronous\",\n            \"1\",\n            \"--timeout\",\n            str(timeout),\n        ]\n        if input_bytes is not None:\n            q += [\"--pass-stdin\", \"1\"]\n        q += [\"--\", *argv]\n        remote = (\n            \"test \\\"$(id -u):$(hostname -s)\\\" = 0:pve03 || exit 72; \"\n            \"for f in /etc/pve/HOMELAB_ASSISTANT_ERROR_REGISTER.md /etc/pve/31_HOMELAB_REFERENCE.md; do \"\n            \"test -r \\\"$f\\\" && test -s \\\"$f\\\" && cat -- \\\"$f\\\" >/dev/null || exit 73; done; exec \"\n            + \" \".join(shlex.quote(x) for x in q)\n        )\n        cmd = [\n            \"/usr/bin/ssh\",\n            \"-T\",\n            \"-o\",\n            \"BatchMode=yes\",\n            \"-o\",\n            \"StrictHostKeyChecking=yes\",\n            \"-o\",\n            \"UpdateHostKeys=no\",\n            \"-o\",\n            \"ConnectTimeout=10\",\n            \"-o\",\n            \"ConnectionAttempts=1\",\n            \"root@pve03\",\n            remote,\n        ]\n    else:\n        fail(\"BAD_TARGET\")\n\n    p = run(cmd, input_bytes=input_bytes, timeout=timeout + 30)\n    try:\n        data = json.loads(p.stdout.decode(\"utf-8\"))\n    except Exception:\n        fail(\"QGA_JSON\")\n    if data.get(\"exited\") not in (1, True) or data.get(\"exitcode\") != 0:\n        fail(\"QGA_GUEST_RC\")\n    if data.get(\"out-truncated\") or data.get(\"err-truncated\"):\n        fail(\"QGA_TRUNCATED\")\n    return data.get(\"out-data\", \"\")\n\n\nINSPECT_PHP = r'''<?php\n$root = '/var/www/forums/newfi/public';\nrequire $root . '/src/XF.php';\n\\XF::start($root);\n$app = \\XF::setupApp('XF\\\\Pub\\\\App');\n$db = $app->db();\nfunction srcMeta(string $path): ?array {\n    if (!is_file($path)) { return null; }\n    return ['bytes' => filesize($path), 'sha256' => hash_file('sha256', $path)];\n}\n$portal = $root . '/src/addons/Newfi/Portal';\n$templates = $db->fetchAll(\n    \"SELECT title, style_id, LENGTH(template) AS bytes, SHA2(template,256) AS sha256, \" .\n    \"LOCATE('data-newfi-portal200', template) > 0 AS html_marker, \" .\n    \"LOCATE('--newfi-portal200', template) > 0 AS css_marker \" .\n    \"FROM xf_template WHERE addon_id='Newfi/Portal' ORDER BY style_id,title\"\n);\n$result = [\n 'hostname' => gethostname(),\n 'application' => [\n  'boardActive' => (string)$db->fetchOne(\"SELECT option_value FROM xf_option WHERE option_id='boardActive'\"),\n  'boardUrl' => (string)$db->fetchOne(\"SELECT option_value FROM xf_option WHERE option_id='boardUrl'\"),\n  'indexRoute' => (string)$db->fetchOne(\"SELECT option_value FROM xf_option WHERE option_id='indexRoute'\"),\n  'defaultStyleId' => (string)$db->fetchOne(\"SELECT option_value FROM xf_option WHERE option_id='defaultStyleId'\"),\n  'error_count' => (int)$db->fetchOne(\"SELECT COUNT(*) FROM xf_error_log\"),\n  'error_max_id' => (int)$db->fetchOne(\"SELECT COALESCE(MAX(error_id),0) FROM xf_error_log\")\n ],\n 'addon' => $db->fetchRow(\n  \"SELECT addon_id,version_id,version_string,active,is_processing,last_pending_action \" .\n  \"FROM xf_addon WHERE addon_id='Newfi/Portal'\"\n ),\n 'source' => [\n  'Pub/Controller/Portal.php' => srcMeta($portal . '/Pub/Controller/Portal.php'),\n  'Service/PortalData.php' => srcMeta($portal . '/Service/PortalData.php'),\n  '_data/templates.xml' => srcMeta($portal . '/_data/templates.xml')\n ],\n 'templates' => $templates\n];\necho \"PORTAL200_INSPECT_JSON_BEGIN\\n\";\necho json_encode(\n    $result,\n    JSON_UNESCAPED_UNICODE|JSON_UNESCAPED_SLASHES|JSON_INVALID_UTF8_SUBSTITUTE\n);\necho \"\\nPORTAL200_INSPECT_JSON_END\\n\";\n?>'''\n\n\nIMPORT_PHP = r'''<?php\n$root = '/var/www/forums/newfi/public';\nrequire $root . '/src/XF.php';\n\\XF::start($root);\n$app = \\XF::setupApp('XF\\\\Pub\\\\App');\n$addOn = $app->addOnManager()->getById('Newfi/Portal');\nif (!$addOn || !$addOn->isInstalled()) {\n    fwrite(STDERR, \"ADDON_NOT_INSTALLED\\n\");\n    exit(30);\n}\n$addOn->preRebuild();\n$dataManager = $app->addOnDataManager();\n$imported = [];\nforeach ($dataManager->getDataTypeClasses() as $dataType) {\n    $handler = $dataManager->getDataTypeHandler($dataType);\n    $xml = $handler->openTypeFile($addOn->getDataDirectory());\n    if (!$xml || !$xml->count()) {\n        $handler->deleteAddOnData($addOn->addon_id);\n        continue;\n    }\n    $start = 0;\n    $guard = 0;\n    while (true) {\n        $last = $handler->importAddOnData($addOn->addon_id, $xml, $start, 0);\n        if (!$last) { break; }\n        if ($last <= $start || ++$guard > 100000) {\n            fwrite(STDERR, \"IMPORT_PROGRESS_INVALID\\n\");\n            exit(31);\n        }\n        $start = $last;\n    }\n    $handler->deleteOrphanedAddOnData($addOn->addon_id, $xml);\n    \\XF::triggerRunOnce();\n    $imported[] = $handler->getContainerTag();\n}\n$addOn->postDataImport();\n$repo = $app->repository(\\XF\\Repository\\StyleRepository::class);\n$repo->updateAllStylesLastModifiedDateLater();\n$addOn->postRebuild();\necho \"PORTAL200_IMPORT_JSON=\" . json_encode(\n    ['result'=>'PASS','containers'=>$imported],\n    JSON_UNESCAPED_SLASHES\n) . \"\\n\";\n?>'''\n\n\nERRORS_PHP_TEMPLATE = r'''<?php\n$root='/var/www/forums/newfi/public';\nrequire $root.'/src/XF.php';\n\\XF::start($root);\n$app=\\XF::setupApp('XF\\\\Pub\\\\App');\n$db=$app->db();\n$b=%d;\n$rows=$db->fetchAll(\n    \"SELECT error_id,exception_type,message,filename,line FROM xf_error_log WHERE error_id>? ORDER BY error_id\",\n    [$b]\n);\necho json_encode(\n    $rows,\n    JSON_UNESCAPED_UNICODE|JSON_UNESCAPED_SLASHES|JSON_INVALID_UTF8_SUBSTITUTE\n);\n?>'''\n\n\nRUNTIME_VERIFY_PHP_TEMPLATE = r'''<?php\n$state = '__STATE__';\n$root = '/var/www/forums/newfi/public';\nrequire $root . '/src/XF.php';\n\\XF::start($root);\n$app = \\XF::setupApp('XF\\\\Pub\\\\App');\n$result = ['state'=>$state];\nif ($state === 'new') {\n    $service = new \\Newfi\\Portal\\Service\\PortalData($app);\n    $portal = $service->build();\n    $html = (string)$app->templater()->renderTemplate('public:newfi_portal', ['portal'=>$portal]);\n    $result['sections'] = [];\n    foreach (['forums','resources','media','events','dogs'] as $key) {\n        $section = $portal[$key] ?? null;\n        if (!is_array($section)) { fwrite(STDERR, \"SECTION_MISSING\\n\"); exit(60); }\n        $result['sections'][$key] = [\n            'available'=>(bool)($section['available'] ?? false),\n            'hasItems'=>(bool)($section['hasItems'] ?? false),\n            'status'=>(string)($section['status'] ?? '')\n        ];\n    }\n    $result['html_marker'] = strpos($html, 'data-newfi-portal200=\"1\"') !== false;\n    $result['locked_resources'] = strpos($html, 'data-portal-locked=\"resources\"') !== false;\n    $result['locked_media'] = strpos($html, 'data-portal-locked=\"media\"') !== false;\n    $result['html_bytes'] = strlen($html);\n    if (!$result['html_marker']) { fwrite(STDERR, \"HTML_MARKER_MISSING\\n\"); exit(61); }\n    if ($result['sections']['resources']['available'] || $result['sections']['media']['available']) {\n        fwrite(STDERR, \"GUEST_PERMISSION_CONTRACT_CHANGED\\n\"); exit(62);\n    }\n    if (!$result['locked_resources'] || !$result['locked_media']) {\n        fwrite(STDERR, \"LOCKED_COPY_MISSING\\n\"); exit(63);\n    }\n    if (!$result['sections']['forums']['available'] || !$result['sections']['events']['available'] || !$result['sections']['dogs']['available']) {\n        fwrite(STDERR, \"PUBLIC_SECTION_UNAVAILABLE\\n\"); exit(64);\n    }\n} else if ($state === 'old') {\n    $html = (string)$app->templater()->renderTemplate('public:newfi_portal', []);\n    $result['html_marker'] = strpos($html, 'data-newfi-portal200') !== false;\n    $result['old_copy'] = strpos($html, 'Закрытое пространство для общения, знаний и материалов сообщества.') !== false;\n    $result['html_bytes'] = strlen($html);\n    if ($result['html_marker'] || !$result['old_copy']) {\n        fwrite(STDERR, \"OLD_RENDER_CONTRACT\\n\"); exit(65);\n    }\n} else {\n    exit(66);\n}\necho \"PORTAL200_RUNTIME_JSON=\" . json_encode(\n    $result,\n    JSON_UNESCAPED_UNICODE|JSON_UNESCAPED_SLASHES|JSON_INVALID_UTF8_SUBSTITUTE\n) . \"\\n\";\n?>'''\n\n\nHTTP_VERIFY_PY = r'''import html,json,re,subprocess,sys,urllib.parse\nmode=sys.argv[1]\nstate=sys.argv[2]\nif mode=='staging':\n    host='newfi-staging.gram1.ru'; scheme='http'; port='80'; expected_status=503\nelif mode=='prod':\n    host='newfi.ru'; scheme='https'; port='443'; expected_status=200\nelse:\n    raise SystemExit(40)\ndef fetch(url):\n    cmd=[\n        '/usr/bin/curl','-sS','-k','--max-time','30','--connect-timeout','10'\n    ]\n    if mode=='staging':\n        cmd += ['--resolve',f'{host}:{port}:127.0.0.1']\n    cmd += [\n        '-o','-','-w','\\n__PORTAL_STATUS__%{http_code}',url\n    ]\n    p=subprocess.run(cmd,stdout=subprocess.PIPE,stderr=subprocess.PIPE,check=False)\n    if p.returncode!=0: raise SystemExit(41)\n    text=p.stdout.decode('utf-8','replace')\n    marker='\\n__PORTAL_STATUS__'\n    if marker not in text: raise SystemExit(42)\n    body,status=text.rsplit(marker,1)\n    return int(status.strip()),body\nroot=f'{scheme}://{host}/'\nstatus,body=fetch(root)\nhrefs=[]\nfor raw in re.findall(r\"href=[\\\"']([^\\\"']*css\\.php[^\\\"']*)[\\\"']\",body,re.I):\n    raw=html.unescape(raw)\n    hrefs.append(urllib.parse.urljoin(root,raw))\nnormal_css=[]\nnormal_status=[]\nfor u in hrefs:\n    s,b=fetch(u)\n    normal_status.append(s)\n    normal_css.append(b)\nnormal_css_text='\\n'.join(normal_css)\nforced_css_marker=None\nforced_css_status=None\nif mode=='staging' and state=='new' and hrefs:\n    u=urllib.parse.urlsplit(hrefs[0])\n    pairs=urllib.parse.parse_qsl(u.query,keep_blank_values=True)\n    out=[]\n    found=False\n    for k,v in pairs:\n        if k=='css':\n            found=True\n            parts=[x for x in v.split(',') if x]\n            if 'public:newfi_portal.less' not in parts:\n                parts.append('public:newfi_portal.less')\n            v=','.join(parts)\n        out.append((k,v))\n    if found:\n        forced=urllib.parse.urlunsplit((u.scheme,u.netloc,u.path,urllib.parse.urlencode(out),u.fragment))\n        forced_css_status,forced_body=fetch(forced)\n        forced_css_marker='--newfi-portal200' in forced_body\nresult={\n 'status':status,\n 'bytes':len(body.encode()),\n 'html_marker':'data-newfi-portal200=\"1\"' in body,\n 'css_marker':'--newfi-portal200' in normal_css_text,\n 'old_copy':'Закрытое пространство для общения, знаний и материалов сообщества.' in body,\n 'css_count':len(hrefs),\n 'css_status':normal_status,\n 'forced_css_status':forced_css_status,\n 'forced_css_marker':forced_css_marker,\n}\nprint('PORTAL200_HTTP_JSON='+json.dumps(result,ensure_ascii=False,sort_keys=True,separators=(',',':')))\nif status!=expected_status: raise SystemExit(45)\nif mode=='prod':\n    if not hrefs or any(x!=200 for x in normal_status): raise SystemExit(46)\nelif mode=='staging':\n    if any(x!=200 for x in normal_status): raise SystemExit(46)\nelse:\n    raise SystemExit(50)\nif mode=='prod' and state=='new':\n    if not result['html_marker'] or not result['css_marker']: raise SystemExit(47)\nelif mode=='prod' and state=='old':\n    if result['html_marker'] or result['css_marker'] or not result['old_copy']: raise SystemExit(48)\nelif mode=='staging' and state=='new':\n    if hrefs and (forced_css_status!=200 or not forced_css_marker): raise SystemExit(49)\nelif mode=='staging' and state=='old':\n    pass\nelse:\n    raise SystemExit(50)\n'''\n\n\ndef parse_inspect(text):\n    b = \"PORTAL200_INSPECT_JSON_BEGIN\\n\"\n    e = \"\\nPORTAL200_INSPECT_JSON_END\"\n    if b not in text or e not in text:\n        fail(\"INSPECT_MARKERS\")\n    try:\n        return json.loads(text.split(b, 1)[1].split(e, 1)[0])\n    except Exception:\n        fail(\"INSPECT_JSON\")\n\n\ndef inspect(target):\n    return parse_inspect(\n        qga(target, [\"/usr/bin/php8.3\"], input_bytes=INSPECT_PHP.encode(), timeout=120)\n    )\n\n\ndef source_is_old(data):\n    src = data[\"source\"]\n    for rel, (size, sha) in EXPECTED_OLD.items():\n        row = src.get(rel)\n        if not row or row.get(\"bytes\") != size or row.get(\"sha256\") != sha:\n            return False\n    return src.get(\"Service/PortalData.php\") is None\n\n\ndef source_is_new(data):\n    src = data[\"source\"]\n    for rel, (size, sha) in EXPECTED_NEW.items():\n        row = src.get(rel)\n        if not row or row.get(\"bytes\") != size or row.get(\"sha256\") != sha:\n            return False\n    return True\n\n\ndef template_state_new(data):\n    rows = data.get(\"templates\", [])\n    rows0 = [r for r in rows if int(r.get(\"style_id\", -1)) == 0]\n    titles = [r.get(\"title\") for r in rows0]\n    by = {r.get(\"title\"): r for r in rows0}\n    return (\n        titles == [\"newfi_portal\", \"newfi_portal.less\"]\n        and int(by[\"newfi_portal\"].get(\"html_marker\", 0)) == 1\n        and int(by[\"newfi_portal.less\"].get(\"css_marker\", 0)) == 1\n    )\n\n\ndef app_contract(data, target):\n    a = data.get(\"application\", {})\n    addon = data.get(\"addon\") or {}\n    expected = {\n        \"staging\": (\"0\", \"http://newfi-staging.gram1.ru\"),\n        \"prod\": (\"1\", \"https://newfi.ru\"),\n    }[target]\n    return (\n        a.get(\"boardActive\") == expected[0]\n        and a.get(\"boardUrl\") == expected[1]\n        and a.get(\"indexRoute\") == \"portal/\"\n        and a.get(\"defaultStyleId\") == \"4\"\n        and addon.get(\"addon_id\") == \"Newfi/Portal\"\n        and int(addon.get(\"version_id\", 0)) == 1000010\n        and addon.get(\"version_string\") == \"1.0.0 Alpha 1\"\n        and int(addon.get(\"active\", 0)) == 1\n        and int(addon.get(\"is_processing\", 1)) == 0\n    )\n\n\ndef new_errors(target, baseline):\n    raw = qga(\n        target,\n        [\"/usr/bin/php8.3\"],\n        input_bytes=(ERRORS_PHP_TEMPLATE % int(baseline)).encode(),\n        timeout=90,\n    )\n    try:\n        return json.loads(raw)\n    except Exception:\n        fail(\"ERROR_LOG_JSON\")\n\n\ndef assert_no_new_errors(target, baseline, phase):\n    rows = new_errors(target, baseline)\n    if rows:\n        emit(\n            \"PORTAL200_NEW_XF_ERRORS\",\n            {\n                \"target\": target,\n                \"phase\": phase,\n                \"count\": len(rows),\n                \"ids\": [r.get(\"error_id\") for r in rows],\n            },\n        )\n        fail(\"NEW_XF_ERRORS\")\n\n\ndef guest_backup(target):\n    script = f'''set -eu\nB={shlex.quote(BACKUP)}\nP=/var/www/forums/newfi/public/src/addons/Newfi/Portal\ntest ! -e \"$B\"\ninstall -d -m 700 \"$B/Pub/Controller\" \"$B/_data\"\ncp -p -- \"$P/Pub/Controller/Portal.php\" \"$B/Pub/Controller/Portal.php\"\ncp -p -- \"$P/_data/templates.xml\" \"$B/_data/templates.xml\"\ntest ! -e \"$P/Service/PortalData.php\"\nprintf 'PORTAL200_BACKUP=PASS\\n'\n'''\n    out = qga(target, [\"/bin/bash\", \"-lc\", script], timeout=90)\n    if \"PORTAL200_BACKUP=PASS\" not in out:\n        fail(\"BACKUP_FAILED\")\n\n\ndef guest_write(target, rel, data):\n    dest = f\"/var/www/forums/newfi/public/src/addons/Newfi/Portal/{rel}\"\n    parent = str(pathlib.PurePosixPath(dest).parent)\n    script = (\n        \"set -eu; umask 022; \"\n        + \"install -d -m 755 \"\n        + shlex.quote(parent)\n        + \"; T=$(mktemp \"\n        + shlex.quote(parent + \"/.portal200.XXXXXX\")\n        + \"); cat >\\\"$T\\\"; chmod 0644 \\\"$T\\\"; chown root:root \\\"$T\\\"; \"\n        + \"mv -f -- \\\"$T\\\" \"\n        + shlex.quote(dest)\n        + \"; printf 'PORTAL200_WRITE=PASS\\\\n'\"\n    )\n    out = qga(\n        target,\n        [\"/bin/bash\", \"-lc\", script],\n        input_bytes=data,\n        timeout=90,\n    )\n    if \"PORTAL200_WRITE=PASS\" not in out:\n        fail(\"WRITE_FAILED\")\n\n\ndef install_candidate(target):\n    for rel in [\n        \"Pub/Controller/Portal.php\",\n        \"Service/PortalData.php\",\n        \"_data/templates.xml\",\n    ]:\n        guest_write(target, rel, (CAND_ROOT / rel).read_bytes())\n\n\ndef restore_old(target):\n    script = f'''set -eu\nB={shlex.quote(BACKUP)}\nP=/var/www/forums/newfi/public/src/addons/Newfi/Portal\ntest -f \"$B/Pub/Controller/Portal.php\"\ntest -f \"$B/_data/templates.xml\"\ncp -p -- \"$B/Pub/Controller/Portal.php\" \"$P/Pub/Controller/Portal.php\"\ncp -p -- \"$B/_data/templates.xml\" \"$P/_data/templates.xml\"\nrm -f -- \"$P/Service/PortalData.php\"\nrmdir -- \"$P/Service\" 2>/dev/null || true\nprintf 'PORTAL200_SOURCE_RESTORE=PASS\\n'\n'''\n    out = qga(target, [\"/bin/bash\", \"-lc\", script], timeout=90)\n    if \"PORTAL200_SOURCE_RESTORE=PASS\" not in out:\n        fail(\"SOURCE_RESTORE_FAILED\")\n\n\ndef import_addon(target):\n    out = qga(\n        target,\n        [\"/usr/bin/php8.3\"],\n        input_bytes=IMPORT_PHP.encode(),\n        timeout=240,\n    )\n    if \"PORTAL200_IMPORT_JSON=\" not in out:\n        fail(\"IMPORT_FAILED\")\n\n\ndef runtime_verify(target, state):\n    src = RUNTIME_VERIFY_PHP_TEMPLATE.replace(\"__STATE__\", state)\n    out = qga(target, [\"/usr/bin/php8.3\"], input_bytes=src.encode(), timeout=120)\n    line = next(\n        (x for x in out.splitlines() if x.startswith(\"PORTAL200_RUNTIME_JSON=\")),\n        None,\n    )\n    if not line:\n        fail(\"RUNTIME_MARKER_MISSING\")\n    try:\n        data = json.loads(line.split(\"=\", 1)[1])\n    except Exception:\n        fail(\"RUNTIME_JSON\")\n    emit(\"PORTAL200_RUNTIME\", {\"target\": target, **data})\n    return data\n\n\ndef http_verify(target, state):\n    argv = [\"/usr/bin/python3\", \"-\", target, state]\n    if target == \"prod\":\n        try:\n            p = subprocess.run(\n                argv,\n                input=HTTP_VERIFY_PY.encode(),\n                stdout=subprocess.PIPE,\n                stderr=subprocess.PIPE,\n                timeout=180,\n                check=False,\n            )\n        except subprocess.TimeoutExpired:\n            fail(\"HTTP_PROD_TIMEOUT\")\n        out = p.stdout.decode(\"utf-8\", \"replace\")\n        err = p.stderr.decode(\"utf-8\", \"replace\")\n        line = next(\n            (x for x in out.splitlines() if x.startswith(\"PORTAL200_HTTP_JSON=\")),\n            None,\n        )\n        data = None\n        if line:\n            try:\n                data = json.loads(line.split(\"=\", 1)[1])\n                emit(\"PORTAL200_HTTP\", {\"target\": target, \"state\": state, **data})\n            except Exception:\n                fail(\"HTTP_JSON\")\n        if p.returncode != 0:\n            emit(\n                \"PORTAL200_HTTP_EXEC\",\n                {\n                    \"target\": target,\n                    \"state\": state,\n                    \"rc\": p.returncode,\n                    \"stderr\": err[:800],\n                },\n            )\n            fail(\"HTTP_PROD_RC\")\n        if data is None:\n            fail(\"HTTP_MARKER_MISSING\")\n        return data\n\n    out = qga(\n        target,\n        argv,\n        input_bytes=HTTP_VERIFY_PY.encode(),\n        timeout=180,\n    )\n    line = next(\n        (x for x in out.splitlines() if x.startswith(\"PORTAL200_HTTP_JSON=\")),\n        None,\n    )\n    if not line:\n        fail(\"HTTP_MARKER_MISSING\")\n    try:\n        data = json.loads(line.split(\"=\", 1)[1])\n    except Exception:\n        fail(\"HTTP_JSON\")\n    emit(\"PORTAL200_HTTP\", {\"target\": target, \"state\": state, **data})\n    return data\n\n\ndef verify_new(target, baseline):\n    data = inspect(target)\n    if not app_contract(data, target):\n        fail(\"APP_CONTRACT_NEW\")\n    if not source_is_new(data):\n        fail(\"SOURCE_NEW_MISMATCH\")\n    if not template_state_new(data):\n        fail(\"TEMPLATE_NEW_MISMATCH\")\n    runtime_verify(target, \"new\")\n    http_verify(target, \"new\")\n    assert_no_new_errors(target, baseline, \"verify-new\")\n    return inspect(target)\n\n\ndef verify_old(target, baseline, old_templates, strict_errors=True):\n    data = inspect(target)\n    if not app_contract(data, target):\n        fail(\"APP_CONTRACT_OLD\")\n    if not source_is_old(data):\n        fail(\"SOURCE_OLD_MISMATCH\")\n    if data.get(\"templates\") != old_templates:\n        fail(\"TEMPLATE_ROLLBACK_MISMATCH\")\n    if target == \"prod\":\n        runtime_verify(target, \"old\")\n    http_verify(target, \"old\")\n    if strict_errors:\n        assert_no_new_errors(target, baseline, \"verify-old\")\n    return inspect(target)\n\n\ndef lint_php(target, source, label):\n    out = qga(\n        target,\n        [\"/usr/bin/php8.3\", \"-l\"],\n        input_bytes=source.encode(),\n        timeout=90,\n    )\n    if \"No syntax errors detected\" not in out:\n        fail(\"PHP_LINT_\" + label)\n\n\ndef cluster_guard():\n    p = run([\"/usr/sbin/qm\", \"status\", \"210\"], timeout=30)\n    if \"status: running\" not in p.stdout.decode():\n        fail(\"VM210_NOT_RUNNING\")\n    p = run(\n        [\n            \"/usr/bin/ssh\",\n            \"-T\",\n            \"-o\",\n            \"BatchMode=yes\",\n            \"-o\",\n            \"StrictHostKeyChecking=yes\",\n            \"-o\",\n            \"UpdateHostKeys=no\",\n            \"-o\",\n            \"ConnectTimeout=10\",\n            \"root@pve03\",\n            \"/usr/sbin/qm status 211\",\n        ],\n        timeout=40,\n    )\n    if \"status: running\" not in p.stdout.decode():\n        fail(\"VM211_NOT_RUNNING\")\n    emit(\"PORTAL200_CLUSTER\", \"PASS\")\n\n\ndef result_contract(status, changes, rollback_started, rollback_restored):\n    emit(\n        \"HOMELAB_RESULT_CONTRACT\",\n        {\n            \"version\": 1,\n            \"command_id\": CID,\n            \"status\": status,\n            \"changes_made\": bool(changes),\n            \"rollback_started\": bool(rollback_started),\n            \"rollback_restored\": rollback_restored,\n        },\n    )\n\n\nemit(\"NEWFI200_BEGIN\")\nemit(\"COMMAND_ID\", CID)\nemit(\"PORTAL200_REMAINING_FULL_PRODUCT_COMMANDS_BEFORE\", 22)\nemit(\n    \"PORTAL200_FLOW\",\n    \"candidate->staging-apply->rollback-proof->staging-reapply->git-push->production\",\n)\n\nstaging_backup = False\nstaging_mutated = False\nstaging_final_new = False\nprod_backup = False\nprod_mutated = False\ngit_files_changed = False\ncommit_created = False\npush_confirmed = False\nfailure_rollback_started = False\nfailure_rollback_restored = None\nold_git_bytes = {}\nnew_head = None\ns_error = None\np_error = None\ns_old_templates = None\np_old_templates = None\n\ntry:\n    compile(HTTP_VERIFY_PY, \"<portal200-http-verify>\", \"exec\")\n    for rel, (size, sha) in EXPECTED_NEW.items():\n        p = CAND_ROOT / rel\n        if not p.is_file() or file_meta(p) != (size, sha):\n            fail(\"CANDIDATE_IDENTITY\")\n    tree = ET.parse(CAND_ROOT / \"_data/templates.xml\")\n    titles = sorted(x.attrib.get(\"title\") for x in tree.getroot().findall(\"template\"))\n    if titles != [\"newfi_portal\", \"newfi_portal.less\"]:\n        fail(\"CANDIDATE_TEMPLATE_SET\")\n    service = (CAND_ROOT / \"Service/PortalData.php\").read_text(\"utf-8\")\n    if any(\n        token in service\n        for token in [\n            \"\\\\XF::db(\",\n            \"->save(\",\n            \"->delete(\",\n            \"INSERT \",\n            \"UPDATE \",\n            \"DELETE \",\n            \"REPLACE \",\n        ]\n    ):\n        fail(\"CANDIDATE_MUTATION_SCAN\")\n    emit(\"PORTAL200_CANDIDATE_IDENTITY\", \"PASS\")\n    emit(\n        \"PORTAL200_ORCHESTRATION_FIXES\",\n        {\n            \"staging_503_without_css_links\": True,\n            \"failure_status\": \"FAIL\",\n            \"prod_http_via_pve01_public_route\": True,\n            \"css_href_regex_fixed\": True,\n        },\n    )\n\n    branch = git(\"branch\", \"--show-current\")\n    head = git(\"rev-parse\", \"HEAD\")\n    status = git(\"status\", \"--porcelain=v1\", \"--untracked-files=all\")\n    remote_out = git(\"ls-remote\", \"origin\", f\"refs/heads/{BRANCH}\")\n    remote = remote_out.split()[0] if remote_out else \"\"\n    if branch != BRANCH or head != OLD_HEAD or remote != OLD_HEAD or status:\n        fail(\"GIT_PRESTATE\")\n    emit(\n        \"PORTAL200_GIT_PRESTATE\",\n        {\"branch\": branch, \"head\": head, \"remote\": remote, \"clean\": True},\n    )\n    cluster_guard()\n\n    lint_php(\"staging\", INSPECT_PHP, \"INSPECT_STAGING\")\n    lint_php(\"staging\", IMPORT_PHP, \"IMPORT_STAGING\")\n    lint_php(\"staging\", RUNTIME_VERIFY_PHP_TEMPLATE.replace(\"__STATE__\", \"new\"), \"RUNTIME_STAGING\")\n    lint_php(\"prod\", INSPECT_PHP, \"INSPECT_PROD\")\n    lint_php(\"prod\", IMPORT_PHP, \"IMPORT_PROD\")\n    lint_php(\"prod\", RUNTIME_VERIFY_PHP_TEMPLATE.replace(\"__STATE__\", \"new\"), \"RUNTIME_PROD\")\n    emit(\"PORTAL200_RUNTIME_HELPER_LINT\", \"PASS\")\n\n    s0 = inspect(\"staging\")\n    p0 = inspect(\"prod\")\n    if not app_contract(s0, \"staging\") or not app_contract(p0, \"prod\"):\n        fail(\"APP_PRESTATE\")\n    if not source_is_old(s0) or not source_is_old(p0):\n        fail(\"SOURCE_PRESTATE\")\n    if s0.get(\"templates\") != p0.get(\"templates\"):\n        fail(\"TEMPLATE_PRESTATE_PARITY\")\n    s_error = int(s0[\"application\"][\"error_max_id\"])\n    p_error = int(p0[\"application\"][\"error_max_id\"])\n    s_old_templates = s0[\"templates\"]\n    p_old_templates = p0[\"templates\"]\n    emit(\"PORTAL200_ERROR_BASELINE\", {\"staging\": s_error, \"prod\": p_error})\n    http_verify(\"staging\", \"old\")\n    runtime_verify(\"prod\", \"old\")\n    http_verify(\"prod\", \"old\")\n    assert_no_new_errors(\"staging\", s_error, \"preflight\")\n    assert_no_new_errors(\"prod\", p_error, \"preflight\")\n    emit(\"PORTAL200_PREFLIGHT\", \"PASS\")\n\n    guest_backup(\"staging\")\n    staging_backup = True\n    staging_mutated = True\n    install_candidate(\"staging\")\n    import_addon(\"staging\")\n    verify_new(\"staging\", s_error)\n    emit(\"PORTAL200_STAGING_FIRST_APPLY\", \"PASS\")\n\n    restore_old(\"staging\")\n    import_addon(\"staging\")\n    verify_old(\"staging\", s_error, s_old_templates)\n    staging_mutated = False\n    emit(\"PORTAL200_STAGING_ROLLBACK_PROOF\", \"PASS\")\n\n    staging_mutated = True\n    install_candidate(\"staging\")\n    import_addon(\"staging\")\n    verify_new(\"staging\", s_error)\n    staging_final_new = True\n    emit(\"PORTAL200_STAGING_FINAL\", \"PASS\")\n\n    for rel in EXPECTED_NEW:\n        dest = GIT_PORTAL / rel\n        old_git_bytes[str(rel)] = dest.read_bytes() if dest.exists() else None\n        dest.parent.mkdir(parents=True, exist_ok=True)\n        shutil.copyfile(CAND_ROOT / rel, dest)\n    git_files_changed = True\n\n    if git(\"diff\", \"--check\"):\n        fail(\"GIT_DIFF_CHECK\")\n    status_lines = git(\"status\", \"--porcelain=v1\", \"--untracked-files=all\").splitlines()\n    actual_paths = sorted(line[3:] for line in status_lines if len(line) >= 4)\n    if actual_paths != sorted(EXPECTED_GIT_PATHS):\n        fail(\"GIT_SCOPE\")\n    git(\"add\", \"--\", *EXPECTED_GIT_PATHS)\n    staged = sorted(x for x in git(\"diff\", \"--cached\", \"--name-only\").splitlines() if x)\n    if staged != sorted(EXPECTED_GIT_PATHS):\n        fail(\"GIT_STAGED_SCOPE\")\n    git(\"commit\", \"-m\", f\"feat: build data-backed Newfi portal [{CID}]\")\n    commit_created = True\n    new_head = git(\"rev-parse\", \"HEAD\")\n    if new_head == OLD_HEAD:\n        fail(\"GIT_COMMIT_HEAD\")\n    if git(\"status\", \"--porcelain=v1\", \"--untracked-files=all\"):\n        fail(\"GIT_POSTCOMMIT_DIRTY\")\n    git(\"push\", \"origin\", f\"HEAD:refs/heads/{BRANCH}\", timeout=180)\n    remote_out = git(\"ls-remote\", \"origin\", f\"refs/heads/{BRANCH}\")\n    remote_head = remote_out.split()[0] if remote_out else \"\"\n    if remote_head != new_head:\n        fail(\"GIT_REMOTE_HEAD\")\n    push_confirmed = True\n    emit(\n        \"PORTAL200_GIT_PROMOTION\",\n        {\n            \"old_head\": OLD_HEAD,\n            \"new_head\": new_head,\n            \"remote_head\": remote_head,\n            \"result\": \"PASS\",\n        },\n    )\n\n    p_pre = inspect(\"prod\")\n    if not source_is_old(p_pre) or p_pre.get(\"templates\") != p_old_templates:\n        fail(\"PROD_DRIFT_BEFORE_APPLY\")\n    if int(p_pre[\"application\"][\"error_max_id\"]) != p_error:\n        fail(\"PROD_ERROR_DRIFT\")\n    guest_backup(\"prod\")\n    prod_backup = True\n    prod_mutated = True\n    install_candidate(\"prod\")\n    import_addon(\"prod\")\n    verify_new(\"prod\", p_error)\n    emit(\"PORTAL200_PRODUCTION\", \"PASS\")\n\n    sf = verify_new(\"staging\", s_error)\n    pf = verify_new(\"prod\", p_error)\n    if sf[\"source\"] != pf[\"source\"]:\n        fail(\"FINAL_SOURCE_PARITY\")\n    if sf[\"templates\"] != pf[\"templates\"]:\n        fail(\"FINAL_TEMPLATE_PARITY\")\n    if git(\"rev-parse\", \"HEAD\") != new_head:\n        fail(\"FINAL_LOCAL_HEAD\")\n    remote_out = git(\"ls-remote\", \"origin\", f\"refs/heads/{BRANCH}\")\n    if not remote_out or remote_out.split()[0] != new_head:\n        fail(\"FINAL_REMOTE_HEAD\")\n    if git(\"status\", \"--porcelain=v1\", \"--untracked-files=all\"):\n        fail(\"FINAL_GIT_DIRTY\")\n    cluster_guard()\n    emit(\n        \"PORTAL200_FINAL_EVIDENCE\",\n        {\n            \"commit\": new_head,\n            \"source_files\": 3,\n            \"templates\": 2,\n            \"staging_error_baseline\": s_error,\n            \"prod_error_baseline\": p_error,\n        },\n    )\n    emit(\"PORTAL200_PORTAL\", \"PASS\")\n    emit(\"PORTAL200_STAGING\", \"PASS\")\n    emit(\"PORTAL200_PRODUCTION\", \"PASS\")\n    emit(\"PORTAL200_REMAINING_FULL_PRODUCT_COMMANDS_AFTER_PASS\", 21)\n    result_contract(\"OK\", True, False, None)\n    emit(\"NEWFI200_END\")\n    raise SystemExit(0)\n\nexcept PortalError as exc:\n    code = str(exc)\n    emit(\"PORTAL200_FAILURE\", code)\n\n    if push_confirmed:\n        if prod_mutated and prod_backup:\n            failure_rollback_started = True\n            try:\n                restore_old(\"prod\")\n                import_addon(\"prod\")\n                verify_old(\"prod\", p_error, p_old_templates, strict_errors=False)\n                prod_mutated = False\n                failure_rollback_restored = False\n                emit(\"PORTAL200_FAILURE_PROD_ROLLBACK\", \"PASS_PARTIAL_OVERALL_STATE_CHANGED\")\n            except Exception:\n                failure_rollback_restored = False\n                emit(\"PORTAL200_FAILURE_PROD_ROLLBACK\", \"FAIL\")\n    else:\n        if staging_mutated and staging_backup:\n            failure_rollback_started = True\n            try:\n                restore_old(\"staging\")\n                import_addon(\"staging\")\n                verify_old(\"staging\", s_error, s_old_templates, strict_errors=False)\n                staging_mutated = False\n                staging_final_new = False\n                failure_rollback_restored = True\n                emit(\"PORTAL200_FAILURE_STAGING_ROLLBACK\", \"PASS\")\n            except Exception:\n                failure_rollback_restored = False\n                emit(\"PORTAL200_FAILURE_STAGING_ROLLBACK\", \"FAIL\")\n\n        if git_files_changed and not commit_created:\n            try:\n                for rel, old in old_git_bytes.items():\n                    dest = GIT_PORTAL / rel\n                    if old is None:\n                        if dest.exists():\n                            dest.unlink()\n                    else:\n                        dest.write_bytes(old)\n                service_dir = GIT_PORTAL / \"Service\"\n                try:\n                    service_dir.rmdir()\n                except OSError:\n                    pass\n                emit(\"PORTAL200_FAILURE_GIT_WORKTREE_RESTORE\", \"PASS\")\n            except Exception:\n                emit(\"PORTAL200_FAILURE_GIT_WORKTREE_RESTORE\", \"FAIL\")\n\n        if commit_created:\n            emit(\n                \"PORTAL200_FAILURE_GIT_HISTORY\",\n                \"COMMIT_CREATED_NO_DESTRUCTIVE_RESET_FRESH_ID_REQUIRED\",\n            )\n\n    persisted = bool(push_confirmed or commit_created or staging_final_new or prod_mutated)\n    if failure_rollback_started and failure_rollback_restored is None:\n        failure_rollback_restored = False\n    result_contract(\n        \"FAIL\",\n        persisted,\n        failure_rollback_started,\n        failure_rollback_restored,\n    )\n    emit(\"PORTAL200_ROADMAP_REMAINS\", 22)\n    emit(\"NEWFI200_END\")\n    raise SystemExit(1)\n\nexcept Exception:\n    emit(\"PORTAL200_FAILURE\", \"UNEXPECTED_EXCEPTION\")\n    result_contract(\n        \"FAIL\",\n        bool(push_confirmed or commit_created or staging_final_new or prod_mutated),\n        False,\n        None,\n    )\n    emit(\"PORTAL200_ROADMAP_REMAINS\", 22)\n    emit(\"NEWFI200_END\")\n    raise SystemExit(1)\n\nCANDIDATE_LAYER_2_TEXT_END\nCANDIDATE_LAYER_3_SOURCE=file:newfi-48-portal200-apply2.cmd::b64::zlib\nCANDIDATE_LAYER_3_SHA256=5e3aa56505b7d7ef5b7f0cf588f89d5e1c5f6b8bd9bffc13b8debdbdc5be26c7\nCANDIDATE_LAYER_3_BYTES=32663\nCANDIDATE_LAYER_3_TEXT_BEGIN\nimport hashlib\nimport json\nimport pathlib\nimport shlex\nimport shutil\nimport subprocess\nimport sys\nimport xml.etree.ElementTree as ET\n\nCID = \"NEWFI-260907-PORTAL200-APPLY2\"\nBRANCH = \"implementation/newfi-closed-mvp-20260906\"\nOLD_HEAD = \"06bab5acd124e768f70305b3d7eca2f595871890\"\nWT = pathlib.Path(\"/root/newfi-portal/.worktrees/implementation-newfi-closed-mvp-20260906\")\nCAND_ROOT = pathlib.Path(\"/root/newfi-portal200-candidate/src/addons/Newfi/Portal\")\nPORTAL_REL = pathlib.Path(\"src/addons/Newfi/Portal\")\nGIT_PORTAL = WT / PORTAL_REL\nEXPECTED_NEW = {\n    \"Pub/Controller/Portal.php\": (363, \"619d489f7cc3b461479c702fa8825097ae22d3c6cfeb911e9f14ea1de9c36d6d\"),\n    \"Service/PortalData.php\": (5213, \"4da03f26294ab6d163a1a746dee4bb6a82d7d4f39e66b24246bc0eb4c455dd1d\"),\n    \"_data/templates.xml\": (10977, \"1650c3d868d4bc47703f1b75f1f179cd25309b2d3b20a2b848e81a4423c00861\"),\n}\nEXPECTED_OLD = {\n    \"Pub/Controller/Portal.php\": (247, \"53909e753ea5a011550fd280ad1c342a74ca9949be092dfbd95244243cae92f3\"),\n    \"_data/templates.xml\": (1461, \"c29c04f8b937284e821c87957653e87c2f6ac014fac30648a0f6b18e84392adf\"),\n}\nEXPECTED_GIT_PATHS = [str(PORTAL_REL / p) for p in sorted(EXPECTED_NEW)]\nBACKUP = f\"/root/newfi-portal200-backup-{CID}\"\n\n\nclass PortalError(RuntimeError):\n    pass\n\n\ndef emit(key, value=None):\n    if value is None:\n        print(key, flush=True)\n    elif isinstance(value, (dict, list, tuple, bool, int, float)):\n        print(\n            key + \"=\" + json.dumps(value, ensure_ascii=False, sort_keys=True, separators=(\",\", \":\")),\n            flush=True,\n        )\n    else:\n        print(key + \"=\" + str(value), flush=True)\n\n\ndef fail(code):\n    raise PortalError(code)\n\n\ndef sha_bytes(data):\n    return hashlib.sha256(data).hexdigest()\n\n\ndef file_meta(path):\n    data = pathlib.Path(path).read_bytes()\n    return len(data), sha_bytes(data)\n\n\ndef run(cmd, *, input_bytes=None, timeout=180, ok=(0,)):\n    try:\n        p = subprocess.run(\n            cmd,\n            input=input_bytes,\n            stdout=subprocess.PIPE,\n            stderr=subprocess.PIPE,\n            timeout=timeout,\n            check=False,\n        )\n    except subprocess.TimeoutExpired:\n        fail(\"SUBPROCESS_TIMEOUT\")\n    if p.returncode not in ok:\n        fail(\"SUBPROCESS_RC\")\n    return p\n\n\ndef git(*args, ok=(0,), timeout=120):\n    p = run([\"/usr/bin/git\", \"-C\", str(WT), *args], timeout=timeout, ok=ok)\n    return p.stdout.decode(\"utf-8\", \"replace\").strip()\n\n\ndef qga(target, argv, *, input_bytes=None, timeout=180):\n    if target == \"prod\":\n        cmd = [\n            \"/usr/sbin/qm\",\n            \"guest\",\n            \"exec\",\n            \"210\",\n            \"--synchronous\",\n            \"1\",\n            \"--timeout\",\n            str(timeout),\n        ]\n        if input_bytes is not None:\n            cmd += [\"--pass-stdin\", \"1\"]\n        cmd += [\"--\", *argv]\n    elif target == \"staging\":\n        q = [\n            \"/usr/sbin/qm\",\n            \"guest\",\n            \"exec\",\n            \"211\",\n            \"--synchronous\",\n            \"1\",\n            \"--timeout\",\n            str(timeout),\n        ]\n        if input_bytes is not None:\n            q += [\"--pass-stdin\", \"1\"]\n        q += [\"--\", *argv]\n        remote = (\n            \"test \\\"$(id -u):$(hostname -s)\\\" = 0:pve03 || exit 72; \"\n            \"for f in /etc/pve/HOMELAB_ASSISTANT_ERROR_REGISTER.md /etc/pve/31_HOMELAB_REFERENCE.md; do \"\n            \"test -r \\\"$f\\\" && test -s \\\"$f\\\" && cat -- \\\"$f\\\" >/dev/null || exit 73; done; exec \"\n            + \" \".join(shlex.quote(x) for x in q)\n        )\n        cmd = [\n            \"/usr/bin/ssh\",\n            \"-T\",\n            \"-o\",\n            \"BatchMode=yes\",\n            \"-o\",\n            \"StrictHostKeyChecking=yes\",\n            \"-o\",\n            \"UpdateHostKeys=no\",\n            \"-o\",\n            \"ConnectTimeout=10\",\n            \"-o\",\n            \"ConnectionAttempts=1\",\n            \"root@pve03\",\n            remote,\n        ]\n    else:\n        fail(\"BAD_TARGET\")\n\n    p = run(cmd, input_bytes=input_bytes, timeout=timeout + 30)\n    try:\n        data = json.loads(p.stdout.decode(\"utf-8\"))\n    except Exception:\n        fail(\"QGA_JSON\")\n    if data.get(\"exited\") not in (1, True) or data.get(\"exitcode\") != 0:\n        fail(\"QGA_GUEST_RC\")\n    if data.get(\"out-truncated\") or data.get(\"err-truncated\"):\n        fail(\"QGA_TRUNCATED\")\n    return data.get(\"out-data\", \"\")\n\n\nINSPECT_PHP = r'''<?php\n$root = '/var/www/forums/newfi/public';\nrequire $root . '/src/XF.php';\n\\XF::start($root);\n$app = \\XF::setupApp('XF\\\\Pub\\\\App');\n$db = $app->db();\nfunction srcMeta(string $path): ?array {\n    if (!is_file($path)) { return null; }\n    return ['bytes' => filesize($path), 'sha256' => hash_file('sha256', $path)];\n}\n$portal = $root . '/src/addons/Newfi/Portal';\n$templates = $db->fetchAll(\n    \"SELECT title, style_id, LENGTH(template) AS bytes, SHA2(template,256) AS sha256, \" .\n    \"LOCATE('data-newfi-portal200', template) > 0 AS html_marker, \" .\n    \"LOCATE('--newfi-portal200', template) > 0 AS css_marker \" .\n    \"FROM xf_template WHERE addon_id='Newfi/Portal' ORDER BY style_id,title\"\n);\n$result = [\n 'hostname' => gethostname(),\n 'application' => [\n  'boardActive' => (string)$db->fetchOne(\"SELECT option_value FROM xf_option WHERE option_id='boardActive'\"),\n  'boardUrl' => (string)$db->fetchOne(\"SELECT option_value FROM xf_option WHERE option_id='boardUrl'\"),\n  'indexRoute' => (string)$db->fetchOne(\"SELECT option_value FROM xf_option WHERE option_id='indexRoute'\"),\n  'defaultStyleId' => (string)$db->fetchOne(\"SELECT option_value FROM xf_option WHERE option_id='defaultStyleId'\"),\n  'error_count' => (int)$db->fetchOne(\"SELECT COUNT(*) FROM xf_error_log\"),\n  'error_max_id' => (int)$db->fetchOne(\"SELECT COALESCE(MAX(error_id),0) FROM xf_error_log\")\n ],\n 'addon' => $db->fetchRow(\n  \"SELECT addon_id,version_id,version_string,active,is_processing,last_pending_action \" .\n  \"FROM xf_addon WHERE addon_id='Newfi/Portal'\"\n ),\n 'source' => [\n  'Pub/Controller/Portal.php' => srcMeta($portal . '/Pub/Controller/Portal.php'),\n  'Service/PortalData.php' => srcMeta($portal . '/Service/PortalData.php'),\n  '_data/templates.xml' => srcMeta($portal . '/_data/templates.xml')\n ],\n 'templates' => $templates\n];\necho \"PORTAL200_INSPECT_JSON_BEGIN\\n\";\necho json_encode(\n    $result,\n    JSON_UNESCAPED_UNICODE|JSON_UNESCAPED_SLASHES|JSON_INVALID_UTF8_SUBSTITUTE\n);\necho \"\\nPORTAL200_INSPECT_JSON_END\\n\";\n?>'''\n\n\nIMPORT_PHP = r'''<?php\n$root = '/var/www/forums/newfi/public';\nrequire $root . '/src/XF.php';\n\\XF::start($root);\n$app = \\XF::setupApp('XF\\\\Pub\\\\App');\n$addOn = $app->addOnManager()->getById('Newfi/Portal');\nif (!$addOn || !$addOn->isInstalled()) {\n    fwrite(STDERR, \"ADDON_NOT_INSTALLED\\n\");\n    exit(30);\n}\n$addOn->preRebuild();\n$dataManager = $app->addOnDataManager();\n$imported = [];\nforeach ($dataManager->getDataTypeClasses() as $dataType) {\n    $handler = $dataManager->getDataTypeHandler($dataType);\n    $xml = $handler->openTypeFile($addOn->getDataDirectory());\n    if (!$xml || !$xml->count()) {\n        $handler->deleteAddOnData($addOn->addon_id);\n        continue;\n    }\n    $start = 0;\n    $guard = 0;\n    while (true) {\n        $last = $handler->importAddOnData($addOn->addon_id, $xml, $start, 0);\n        if (!$last) { break; }\n        if ($last <= $start || ++$guard > 100000) {\n            fwrite(STDERR, \"IMPORT_PROGRESS_INVALID\\n\");\n            exit(31);\n        }\n        $start = $last;\n    }\n    $handler->deleteOrphanedAddOnData($addOn->addon_id, $xml);\n    \\XF::triggerRunOnce();\n    $imported[] = $handler->getContainerTag();\n}\n$addOn->postDataImport();\n$repo = $app->repository(\\XF\\Repository\\StyleRepository::class);\n$repo->updateAllStylesLastModifiedDateLater();\n$addOn->postRebuild();\necho \"PORTAL200_IMPORT_JSON=\" . json_encode(\n    ['result'=>'PASS','containers'=>$imported],\n    JSON_UNESCAPED_SLASHES\n) . \"\\n\";\n?>'''\n\n\nERRORS_PHP_TEMPLATE = r'''<?php\n$root='/var/www/forums/newfi/public';\nrequire $root.'/src/XF.php';\n\\XF::start($root);\n$app=\\XF::setupApp('XF\\\\Pub\\\\App');\n$db=$app->db();\n$b=%d;\n$rows=$db->fetchAll(\n    \"SELECT error_id,exception_type,message,filename,line FROM xf_error_log WHERE error_id>? ORDER BY error_id\",\n    [$b]\n);\necho json_encode(\n    $rows,\n    JSON_UNESCAPED_UNICODE|JSON_UNESCAPED_SLASHES|JSON_INVALID_UTF8_SUBSTITUTE\n);\n?>'''\n\n\nRUNTIME_VERIFY_PHP_TEMPLATE = r'''<?php\n$state = '__STATE__';\n$root = '/var/www/forums/newfi/public';\nrequire $root . '/src/XF.php';\n\\XF::start($root);\n$app = \\XF::setupApp('XF\\\\Pub\\\\App');\n$result = ['state'=>$state];\nif ($state === 'new') {\n    $service = new \\Newfi\\Portal\\Service\\PortalData($app);\n    $portal = $service->build();\n    $html = (string)$app->templater()->renderTemplate('public:newfi_portal', ['portal'=>$portal]);\n    $result['sections'] = [];\n    foreach (['forums','resources','media','events','dogs'] as $key) {\n        $section = $portal[$key] ?? null;\n        if (!is_array($section)) { fwrite(STDERR, \"SECTION_MISSING\\n\"); exit(60); }\n        $result['sections'][$key] = [\n            'available'=>(bool)($section['available'] ?? false),\n            'hasItems'=>(bool)($section['hasItems'] ?? false),\n            'status'=>(string)($section['status'] ?? '')\n        ];\n    }\n    $result['html_marker'] = strpos($html, 'data-newfi-portal200=\"1\"') !== false;\n    $result['locked_resources'] = strpos($html, 'data-portal-locked=\"resources\"') !== false;\n    $result['locked_media'] = strpos($html, 'data-portal-locked=\"media\"') !== false;\n    $result['html_bytes'] = strlen($html);\n    if (!$result['html_marker']) { fwrite(STDERR, \"HTML_MARKER_MISSING\\n\"); exit(61); }\n    if ($result['sections']['resources']['available'] || $result['sections']['media']['available']) {\n        fwrite(STDERR, \"GUEST_PERMISSION_CONTRACT_CHANGED\\n\"); exit(62);\n    }\n    if (!$result['locked_resources'] || !$result['locked_media']) {\n        fwrite(STDERR, \"LOCKED_COPY_MISSING\\n\"); exit(63);\n    }\n    if (!$result['sections']['forums']['available'] || !$result['sections']['events']['available'] || !$result['sections']['dogs']['available']) {\n        fwrite(STDERR, \"PUBLIC_SECTION_UNAVAILABLE\\n\"); exit(64);\n    }\n} else if ($state === 'old') {\n    $html = (string)$app->templater()->renderTemplate('public:newfi_portal', []);\n    $result['html_marker'] = strpos($html, 'data-newfi-portal200') !== false;\n    $result['old_copy'] = strpos($html, 'Закрытое пространство для общения, знаний и материалов сообщества.') !== false;\n    $result['html_bytes'] = strlen($html);\n    if ($result['html_marker'] || !$result['old_copy']) {\n        fwrite(STDERR, \"OLD_RENDER_CONTRACT\\n\"); exit(65);\n    }\n} else {\n    exit(66);\n}\necho \"PORTAL200_RUNTIME_JSON=\" . json_encode(\n    $result,\n    JSON_UNESCAPED_UNICODE|JSON_UNESCAPED_SLASHES|JSON_INVALID_UTF8_SUBSTITUTE\n) . \"\\n\";\n?>'''\n\n\nHTTP_VERIFY_PY = r'''import html,json,re,subprocess,sys,urllib.parse\nmode=sys.argv[1]\nstate=sys.argv[2]\nif mode=='staging':\n    host='newfi-staging.gram1.ru'; scheme='http'; port='80'; expected_status=503\nelif mode=='prod':\n    host='newfi.ru'; scheme='https'; port='443'; expected_status=200\nelse:\n    raise SystemExit(40)\ndef fetch(url):\n    cmd=[\n        '/usr/bin/curl','-sS','-k','--max-time','30','--connect-timeout','10',\n        '--resolve',f'{host}:{port}:127.0.0.1','-o','-','-w',\n        '\\n__PORTAL_STATUS__%{http_code}',url\n    ]\n    p=subprocess.run(cmd,stdout=subprocess.PIPE,stderr=subprocess.PIPE,check=False)\n    if p.returncode!=0: raise SystemExit(41)\n    text=p.stdout.decode('utf-8','replace')\n    marker='\\n__PORTAL_STATUS__'\n    if marker not in text: raise SystemExit(42)\n    body,status=text.rsplit(marker,1)\n    return int(status.strip()),body\nroot=f'{scheme}://{host}/'\nstatus,body=fetch(root)\nhrefs=[]\nfor raw in re.findall(r\"href=[\\\"']([^\\\"']*css\\\\.php[^\\\"']*)[\\\"']\",body,re.I):\n    raw=html.unescape(raw)\n    hrefs.append(urllib.parse.urljoin(root,raw))\nnormal_css=[]\nnormal_status=[]\nfor u in hrefs:\n    s,b=fetch(u)\n    normal_status.append(s)\n    normal_css.append(b)\nnormal_css_text='\\n'.join(normal_css)\nforced_css_marker=None\nforced_css_status=None\nif mode=='staging' and state=='new' and hrefs:\n    u=urllib.parse.urlsplit(hrefs[0])\n    pairs=urllib.parse.parse_qsl(u.query,keep_blank_values=True)\n    out=[]\n    found=False\n    for k,v in pairs:\n        if k=='css':\n            found=True\n            parts=[x for x in v.split(',') if x]\n            if 'public:newfi_portal.less' not in parts:\n                parts.append('public:newfi_portal.less')\n            v=','.join(parts)\n        out.append((k,v))\n    if found:\n        forced=urllib.parse.urlunsplit((u.scheme,u.netloc,u.path,urllib.parse.urlencode(out),u.fragment))\n        forced_css_status,forced_body=fetch(forced)\n        forced_css_marker='--newfi-portal200' in forced_body\nresult={\n 'status':status,\n 'bytes':len(body.encode()),\n 'html_marker':'data-newfi-portal200=\"1\"' in body,\n 'css_marker':'--newfi-portal200' in normal_css_text,\n 'old_copy':'Закрытое пространство для общения, знаний и материалов сообщества.' in body,\n 'css_count':len(hrefs),\n 'css_status':normal_status,\n 'forced_css_status':forced_css_status,\n 'forced_css_marker':forced_css_marker,\n}\nprint('PORTAL200_HTTP_JSON='+json.dumps(result,ensure_ascii=False,sort_keys=True,separators=(',',':')))\nif status!=expected_status: raise SystemExit(45)\nif mode=='prod':\n    if not hrefs or any(x!=200 for x in normal_status): raise SystemExit(46)\nelif mode=='staging':\n    if any(x!=200 for x in normal_status): raise SystemExit(46)\nelse:\n    raise SystemExit(50)\nif mode=='prod' and state=='new':\n    if not result['html_marker'] or not result['css_marker']: raise SystemExit(47)\nelif mode=='prod' and state=='old':\n    if result['html_marker'] or result['css_marker'] or not result['old_copy']: raise SystemExit(48)\nelif mode=='staging' and state=='new':\n    if hrefs and (forced_css_status!=200 or not forced_css_marker): raise SystemExit(49)\nelif mode=='staging' and state=='old':\n    pass\nelse:\n    raise SystemExit(50)\n'''\n\n\ndef parse_inspect(text):\n    b = \"PORTAL200_INSPECT_JSON_BEGIN\\n\"\n    e = \"\\nPORTAL200_INSPECT_JSON_END\"\n    if b not in text or e not in text:\n        fail(\"INSPECT_MARKERS\")\n    try:\n        return json.loads(text.split(b, 1)[1].split(e, 1)[0])\n    except Exception:\n        fail(\"INSPECT_JSON\")\n\n\ndef inspect(target):\n    return parse_inspect(\n        qga(target, [\"/usr/bin/php8.3\"], input_bytes=INSPECT_PHP.encode(), timeout=120)\n    )\n\n\ndef source_is_old(data):\n    src = data[\"source\"]\n    for rel, (size, sha) in EXPECTED_OLD.items():\n        row = src.get(rel)\n        if not row or row.get(\"bytes\") != size or row.get(\"sha256\") != sha:\n            return False\n    return src.get(\"Service/PortalData.php\") is None\n\n\ndef source_is_new(data):\n    src = data[\"source\"]\n    for rel, (size, sha) in EXPECTED_NEW.items():\n        row = src.get(rel)\n        if not row or row.get(\"bytes\") != size or row.get(\"sha256\") != sha:\n            return False\n    return True\n\n\ndef template_state_new(data):\n    rows = data.get(\"templates\", [])\n    rows0 = [r for r in rows if int(r.get(\"style_id\", -1)) == 0]\n    titles = [r.get(\"title\") for r in rows0]\n    by = {r.get(\"title\"): r for r in rows0}\n    return (\n        titles == [\"newfi_portal\", \"newfi_portal.less\"]\n        and int(by[\"newfi_portal\"].get(\"html_marker\", 0)) == 1\n        and int(by[\"newfi_portal.less\"].get(\"css_marker\", 0)) == 1\n    )\n\n\ndef app_contract(data, target):\n    a = data.get(\"application\", {})\n    addon = data.get(\"addon\") or {}\n    expected = {\n        \"staging\": (\"0\", \"http://newfi-staging.gram1.ru\"),\n        \"prod\": (\"1\", \"https://newfi.ru\"),\n    }[target]\n    return (\n        a.get(\"boardActive\") == expected[0]\n        and a.get(\"boardUrl\") == expected[1]\n        and a.get(\"indexRoute\") == \"portal/\"\n        and a.get(\"defaultStyleId\") == \"4\"\n        and addon.get(\"addon_id\") == \"Newfi/Portal\"\n        and int(addon.get(\"version_id\", 0)) == 1000010\n        and addon.get(\"version_string\") == \"1.0.0 Alpha 1\"\n        and int(addon.get(\"active\", 0)) == 1\n        and int(addon.get(\"is_processing\", 1)) == 0\n    )\n\n\ndef new_errors(target, baseline):\n    raw = qga(\n        target,\n        [\"/usr/bin/php8.3\"],\n        input_bytes=(ERRORS_PHP_TEMPLATE % int(baseline)).encode(),\n        timeout=90,\n    )\n    try:\n        return json.loads(raw)\n    except Exception:\n        fail(\"ERROR_LOG_JSON\")\n\n\ndef assert_no_new_errors(target, baseline, phase):\n    rows = new_errors(target, baseline)\n    if rows:\n        emit(\n            \"PORTAL200_NEW_XF_ERRORS\",\n            {\n                \"target\": target,\n                \"phase\": phase,\n                \"count\": len(rows),\n                \"ids\": [r.get(\"error_id\") for r in rows],\n            },\n        )\n        fail(\"NEW_XF_ERRORS\")\n\n\ndef guest_backup(target):\n    script = f'''set -eu\nB={shlex.quote(BACKUP)}\nP=/var/www/forums/newfi/public/src/addons/Newfi/Portal\ntest ! -e \"$B\"\ninstall -d -m 700 \"$B/Pub/Controller\" \"$B/_data\"\ncp -p -- \"$P/Pub/Controller/Portal.php\" \"$B/Pub/Controller/Portal.php\"\ncp -p -- \"$P/_data/templates.xml\" \"$B/_data/templates.xml\"\ntest ! -e \"$P/Service/PortalData.php\"\nprintf 'PORTAL200_BACKUP=PASS\\n'\n'''\n    out = qga(target, [\"/bin/bash\", \"-lc\", script], timeout=90)\n    if \"PORTAL200_BACKUP=PASS\" not in out:\n        fail(\"BACKUP_FAILED\")\n\n\ndef guest_write(target, rel, data):\n    dest = f\"/var/www/forums/newfi/public/src/addons/Newfi/Portal/{rel}\"\n    parent = str(pathlib.PurePosixPath(dest).parent)\n    script = (\n        \"set -eu; umask 022; \"\n        + \"install -d -m 755 \"\n        + shlex.quote(parent)\n        + \"; T=$(mktemp \"\n        + shlex.quote(parent + \"/.portal200.XXXXXX\")\n        + \"); cat >\\\"$T\\\"; chmod 0644 \\\"$T\\\"; chown root:root \\\"$T\\\"; \"\n        + \"mv -f -- \\\"$T\\\" \"\n        + shlex.quote(dest)\n        + \"; printf 'PORTAL200_WRITE=PASS\\\\n'\"\n    )\n    out = qga(\n        target,\n        [\"/bin/bash\", \"-lc\", script],\n        input_bytes=data,\n        timeout=90,\n    )\n    if \"PORTAL200_WRITE=PASS\" not in out:\n        fail(\"WRITE_FAILED\")\n\n\ndef install_candidate(target):\n    for rel in [\n        \"Pub/Controller/Portal.php\",\n        \"Service/PortalData.php\",\n        \"_data/templates.xml\",\n    ]:\n        guest_write(target, rel, (CAND_ROOT / rel).read_bytes())\n\n\ndef restore_old(target):\n    script = f'''set -eu\nB={shlex.quote(BACKUP)}\nP=/var/www/forums/newfi/public/src/addons/Newfi/Portal\ntest -f \"$B/Pub/Controller/Portal.php\"\ntest -f \"$B/_data/templates.xml\"\ncp -p -- \"$B/Pub/Controller/Portal.php\" \"$P/Pub/Controller/Portal.php\"\ncp -p -- \"$B/_data/templates.xml\" \"$P/_data/templates.xml\"\nrm -f -- \"$P/Service/PortalData.php\"\nrmdir -- \"$P/Service\" 2>/dev/null || true\nprintf 'PORTAL200_SOURCE_RESTORE=PASS\\n'\n'''\n    out = qga(target, [\"/bin/bash\", \"-lc\", script], timeout=90)\n    if \"PORTAL200_SOURCE_RESTORE=PASS\" not in out:\n        fail(\"SOURCE_RESTORE_FAILED\")\n\n\ndef import_addon(target):\n    out = qga(\n        target,\n        [\"/usr/bin/php8.3\"],\n        input_bytes=IMPORT_PHP.encode(),\n        timeout=240,\n    )\n    if \"PORTAL200_IMPORT_JSON=\" not in out:\n        fail(\"IMPORT_FAILED\")\n\n\ndef runtime_verify(target, state):\n    src = RUNTIME_VERIFY_PHP_TEMPLATE.replace(\"__STATE__\", state)\n    out = qga(target, [\"/usr/bin/php8.3\"], input_bytes=src.encode(), timeout=120)\n    line = next(\n        (x for x in out.splitlines() if x.startswith(\"PORTAL200_RUNTIME_JSON=\")),\n        None,\n    )\n    if not line:\n        fail(\"RUNTIME_MARKER_MISSING\")\n    try:\n        data = json.loads(line.split(\"=\", 1)[1])\n    except Exception:\n        fail(\"RUNTIME_JSON\")\n    emit(\"PORTAL200_RUNTIME\", {\"target\": target, **data})\n    return data\n\n\ndef http_verify(target, state):\n    out = qga(\n        target,\n        [\"/usr/bin/python3\", \"-\", target, state],\n        input_bytes=HTTP_VERIFY_PY.encode(),\n        timeout=180,\n    )\n    line = next(\n        (x for x in out.splitlines() if x.startswith(\"PORTAL200_HTTP_JSON=\")),\n        None,\n    )\n    if not line:\n        fail(\"HTTP_MARKER_MISSING\")\n    try:\n        data = json.loads(line.split(\"=\", 1)[1])\n    except Exception:\n        fail(\"HTTP_JSON\")\n    emit(\"PORTAL200_HTTP\", {\"target\": target, \"state\": state, **data})\n    return data\n\n\ndef verify_new(target, baseline):\n    data = inspect(target)\n    if not app_contract(data, target):\n        fail(\"APP_CONTRACT_NEW\")\n    if not source_is_new(data):\n        fail(\"SOURCE_NEW_MISMATCH\")\n    if not template_state_new(data):\n        fail(\"TEMPLATE_NEW_MISMATCH\")\n    runtime_verify(target, \"new\")\n    http_verify(target, \"new\")\n    assert_no_new_errors(target, baseline, \"verify-new\")\n    return inspect(target)\n\n\ndef verify_old(target, baseline, old_templates, strict_errors=True):\n    data = inspect(target)\n    if not app_contract(data, target):\n        fail(\"APP_CONTRACT_OLD\")\n    if not source_is_old(data):\n        fail(\"SOURCE_OLD_MISMATCH\")\n    if data.get(\"templates\") != old_templates:\n        fail(\"TEMPLATE_ROLLBACK_MISMATCH\")\n    if target == \"prod\":\n        runtime_verify(target, \"old\")\n    http_verify(target, \"old\")\n    if strict_errors:\n        assert_no_new_errors(target, baseline, \"verify-old\")\n    return inspect(target)\n\n\ndef lint_php(target, source, label):\n    out = qga(\n        target,\n        [\"/usr/bin/php8.3\", \"-l\"],\n        input_bytes=source.encode(),\n        timeout=90,\n    )\n    if \"No syntax errors detected\" not in out:\n        fail(\"PHP_LINT_\" + label)\n\n\ndef cluster_guard():\n    p = run([\"/usr/sbin/qm\", \"status\", \"210\"], timeout=30)\n    if \"status: running\" not in p.stdout.decode():\n        fail(\"VM210_NOT_RUNNING\")\n    p = run(\n        [\n            \"/usr/bin/ssh\",\n            \"-T\",\n            \"-o\",\n            \"BatchMode=yes\",\n            \"-o\",\n            \"StrictHostKeyChecking=yes\",\n            \"-o\",\n            \"UpdateHostKeys=no\",\n            \"-o\",\n            \"ConnectTimeout=10\",\n            \"root@pve03\",\n            \"/usr/sbin/qm status 211\",\n        ],\n        timeout=40,\n    )\n    if \"status: running\" not in p.stdout.decode():\n        fail(\"VM211_NOT_RUNNING\")\n    emit(\"PORTAL200_CLUSTER\", \"PASS\")\n\n\ndef result_contract(status, changes, rollback_started, rollback_restored):\n    emit(\n        \"HOMELAB_RESULT_CONTRACT\",\n        {\n            \"version\": 1,\n            \"command_id\": CID,\n            \"status\": status,\n            \"changes_made\": bool(changes),\n            \"rollback_started\": bool(rollback_started),\n            \"rollback_restored\": rollback_restored,\n        },\n    )\n\n\nemit(\"NEWFI200_BEGIN\")\nemit(\"COMMAND_ID\", CID)\nemit(\"PORTAL200_REMAINING_FULL_PRODUCT_COMMANDS_BEFORE\", 22)\nemit(\n    \"PORTAL200_FLOW\",\n    \"candidate->staging-apply->rollback-proof->staging-reapply->git-push->production\",\n)\n\nstaging_backup = False\nstaging_mutated = False\nstaging_final_new = False\nprod_backup = False\nprod_mutated = False\ngit_files_changed = False\ncommit_created = False\npush_confirmed = False\nfailure_rollback_started = False\nfailure_rollback_restored = None\nold_git_bytes = {}\nnew_head = None\ns_error = None\np_error = None\ns_old_templates = None\np_old_templates = None\n\ntry:\n    compile(HTTP_VERIFY_PY, \"<portal200-http-verify>\", \"exec\")\n    for rel, (size, sha) in EXPECTED_NEW.items():\n        p = CAND_ROOT / rel\n        if not p.is_file() or file_meta(p) != (size, sha):\n            fail(\"CANDIDATE_IDENTITY\")\n    tree = ET.parse(CAND_ROOT / \"_data/templates.xml\")\n    titles = sorted(x.attrib.get(\"title\") for x in tree.getroot().findall(\"template\"))\n    if titles != [\"newfi_portal\", \"newfi_portal.less\"]:\n        fail(\"CANDIDATE_TEMPLATE_SET\")\n    service = (CAND_ROOT / \"Service/PortalData.php\").read_text(\"utf-8\")\n    if any(\n        token in service\n        for token in [\n            \"\\\\XF::db(\",\n            \"->save(\",\n            \"->delete(\",\n            \"INSERT \",\n            \"UPDATE \",\n            \"DELETE \",\n            \"REPLACE \",\n        ]\n    ):\n        fail(\"CANDIDATE_MUTATION_SCAN\")\n    emit(\"PORTAL200_CANDIDATE_IDENTITY\", \"PASS\")\n    emit(\"PORTAL200_ORCHESTRATION_FIXES\", {\"staging_503_without_css_links\": True, \"failure_status\": \"FAIL\"})\n\n    branch = git(\"branch\", \"--show-current\")\n    head = git(\"rev-parse\", \"HEAD\")\n    status = git(\"status\", \"--porcelain=v1\", \"--untracked-files=all\")\n    remote_out = git(\"ls-remote\", \"origin\", f\"refs/heads/{BRANCH}\")\n    remote = remote_out.split()[0] if remote_out else \"\"\n    if branch != BRANCH or head != OLD_HEAD or remote != OLD_HEAD or status:\n        fail(\"GIT_PRESTATE\")\n    emit(\n        \"PORTAL200_GIT_PRESTATE\",\n        {\"branch\": branch, \"head\": head, \"remote\": remote, \"clean\": True},\n    )\n    cluster_guard()\n\n    lint_php(\"staging\", INSPECT_PHP, \"INSPECT_STAGING\")\n    lint_php(\"staging\", IMPORT_PHP, \"IMPORT_STAGING\")\n    lint_php(\"staging\", RUNTIME_VERIFY_PHP_TEMPLATE.replace(\"__STATE__\", \"new\"), \"RUNTIME_STAGING\")\n    lint_php(\"prod\", INSPECT_PHP, \"INSPECT_PROD\")\n    lint_php(\"prod\", IMPORT_PHP, \"IMPORT_PROD\")\n    lint_php(\"prod\", RUNTIME_VERIFY_PHP_TEMPLATE.replace(\"__STATE__\", \"new\"), \"RUNTIME_PROD\")\n    emit(\"PORTAL200_RUNTIME_HELPER_LINT\", \"PASS\")\n\n    s0 = inspect(\"staging\")\n    p0 = inspect(\"prod\")\n    if not app_contract(s0, \"staging\") or not app_contract(p0, \"prod\"):\n        fail(\"APP_PRESTATE\")\n    if not source_is_old(s0) or not source_is_old(p0):\n        fail(\"SOURCE_PRESTATE\")\n    if s0.get(\"templates\") != p0.get(\"templates\"):\n        fail(\"TEMPLATE_PRESTATE_PARITY\")\n    s_error = int(s0[\"application\"][\"error_max_id\"])\n    p_error = int(p0[\"application\"][\"error_max_id\"])\n    s_old_templates = s0[\"templates\"]\n    p_old_templates = p0[\"templates\"]\n    emit(\"PORTAL200_ERROR_BASELINE\", {\"staging\": s_error, \"prod\": p_error})\n    http_verify(\"staging\", \"old\")\n    runtime_verify(\"prod\", \"old\")\n    http_verify(\"prod\", \"old\")\n    assert_no_new_errors(\"staging\", s_error, \"preflight\")\n    assert_no_new_errors(\"prod\", p_error, \"preflight\")\n    emit(\"PORTAL200_PREFLIGHT\", \"PASS\")\n\n    guest_backup(\"staging\")\n    staging_backup = True\n    staging_mutated = True\n    install_candidate(\"staging\")\n    import_addon(\"staging\")\n    verify_new(\"staging\", s_error)\n    emit(\"PORTAL200_STAGING_FIRST_APPLY\", \"PASS\")\n\n    restore_old(\"staging\")\n    import_addon(\"staging\")\n    verify_old(\"staging\", s_error, s_old_templates)\n    staging_mutated = False\n    emit(\"PORTAL200_STAGING_ROLLBACK_PROOF\", \"PASS\")\n\n    staging_mutated = True\n    install_candidate(\"staging\")\n    import_addon(\"staging\")\n    verify_new(\"staging\", s_error)\n    staging_final_new = True\n    emit(\"PORTAL200_STAGING_FINAL\", \"PASS\")\n\n    for rel in EXPECTED_NEW:\n        dest = GIT_PORTAL / rel\n        old_git_bytes[str(rel)] = dest.read_bytes() if dest.exists() else None\n        dest.parent.mkdir(parents=True, exist_ok=True)\n        shutil.copyfile(CAND_ROOT / rel, dest)\n    git_files_changed = True\n\n    if git(\"diff\", \"--check\"):\n        fail(\"GIT_DIFF_CHECK\")\n    status_lines = git(\"status\", \"--porcelain=v1\", \"--untracked-files=all\").splitlines()\n    actual_paths = sorted(line[3:] for line in status_lines if len(line) >= 4)\n    if actual_paths != sorted(EXPECTED_GIT_PATHS):\n        fail(\"GIT_SCOPE\")\n    git(\"add\", \"--\", *EXPECTED_GIT_PATHS)\n    staged = sorted(x for x in git(\"diff\", \"--cached\", \"--name-only\").splitlines() if x)\n    if staged != sorted(EXPECTED_GIT_PATHS):\n        fail(\"GIT_STAGED_SCOPE\")\n    git(\"commit\", \"-m\", f\"feat: build data-backed Newfi portal [{CID}]\")\n    commit_created = True\n    new_head = git(\"rev-parse\", \"HEAD\")\n    if new_head == OLD_HEAD:\n        fail(\"GIT_COMMIT_HEAD\")\n    if git(\"status\", \"--porcelain=v1\", \"--untracked-files=all\"):\n        fail(\"GIT_POSTCOMMIT_DIRTY\")\n    git(\"push\", \"origin\", f\"HEAD:refs/heads/{BRANCH}\", timeout=180)\n    remote_out = git(\"ls-remote\", \"origin\", f\"refs/heads/{BRANCH}\")\n    remote_head = remote_out.split()[0] if remote_out else \"\"\n    if remote_head != new_head:\n        fail(\"GIT_REMOTE_HEAD\")\n    push_confirmed = True\n    emit(\n        \"PORTAL200_GIT_PROMOTION\",\n        {\n            \"old_head\": OLD_HEAD,\n            \"new_head\": new_head,\n            \"remote_head\": remote_head,\n            \"result\": \"PASS\",\n        },\n    )\n\n    p_pre = inspect(\"prod\")\n    if not source_is_old(p_pre) or p_pre.get(\"templates\") != p_old_templates:\n        fail(\"PROD_DRIFT_BEFORE_APPLY\")\n    if int(p_pre[\"application\"][\"error_max_id\"]) != p_error:\n        fail(\"PROD_ERROR_DRIFT\")\n    guest_backup(\"prod\")\n    prod_backup = True\n    prod_mutated = True\n    install_candidate(\"prod\")\n    import_addon(\"prod\")\n    verify_new(\"prod\", p_error)\n    emit(\"PORTAL200_PRODUCTION\", \"PASS\")\n\n    sf = verify_new(\"staging\", s_error)\n    pf = verify_new(\"prod\", p_error)\n    if sf[\"source\"] != pf[\"source\"]:\n        fail(\"FINAL_SOURCE_PARITY\")\n    if sf[\"templates\"] != pf[\"templates\"]:\n        fail(\"FINAL_TEMPLATE_PARITY\")\n    if git(\"rev-parse\", \"HEAD\") != new_head:\n        fail(\"FINAL_LOCAL_HEAD\")\n    remote_out = git(\"ls-remote\", \"origin\", f\"refs/heads/{BRANCH}\")\n    if not remote_out or remote_out.split()[0] != new_head:\n        fail(\"FINAL_REMOTE_HEAD\")\n    if git(\"status\", \"--porcelain=v1\", \"--untracked-files=all\"):\n        fail(\"FINAL_GIT_DIRTY\")\n    cluster_guard()\n    emit(\n        \"PORTAL200_FINAL_EVIDENCE\",\n        {\n            \"commit\": new_head,\n            \"source_files\": 3,\n            \"templates\": 2,\n            \"staging_error_baseline\": s_error,\n            \"prod_error_baseline\": p_error,\n        },\n    )\n    emit(\"PORTAL200_PORTAL\", \"PASS\")\n    emit(\"PORTAL200_STAGING\", \"PASS\")\n    emit(\"PORTAL200_PRODUCTION\", \"PASS\")\n    emit(\"PORTAL200_REMAINING_FULL_PRODUCT_COMMANDS_AFTER_PASS\", 21)\n    result_contract(\"OK\", True, False, None)\n    emit(\"NEWFI200_END\")\n    raise SystemExit(0)\n\nexcept PortalError as exc:\n    code = str(exc)\n    emit(\"PORTAL200_FAILURE\", code)\n\n    if push_confirmed:\n        if prod_mutated and prod_backup:\n            failure_rollback_started = True\n            try:\n                restore_old(\"prod\")\n                import_addon(\"prod\")\n                verify_old(\"prod\", p_error, p_old_templates, strict_errors=False)\n                prod_mutated = False\n                failure_rollback_restored = False\n                emit(\"PORTAL200_FAILURE_PROD_ROLLBACK\", \"PASS_PARTIAL_OVERALL_STATE_CHANGED\")\n            except Exception:\n                failure_rollback_restored = False\n                emit(\"PORTAL200_FAILURE_PROD_ROLLBACK\", \"FAIL\")\n    else:\n        if staging_mutated and staging_backup:\n            failure_rollback_started = True\n            try:\n                restore_old(\"staging\")\n                import_addon(\"staging\")\n                verify_old(\"staging\", s_error, s_old_templates, strict_errors=False)\n                staging_mutated = False\n                staging_final_new = False\n                failure_rollback_restored = True\n                emit(\"PORTAL200_FAILURE_STAGING_ROLLBACK\", \"PASS\")\n            except Exception:\n                failure_rollback_restored = False\n                emit(\"PORTAL200_FAILURE_STAGING_ROLLBACK\", \"FAIL\")\n\n        if git_files_changed and not commit_created:\n            try:\n                for rel, old in old_git_bytes.items():\n                    dest = GIT_PORTAL / rel\n                    if old is None:\n                        if dest.exists():\n                            dest.unlink()\n                    else:\n                        dest.write_bytes(old)\n                service_dir = GIT_PORTAL / \"Service\"\n                try:\n                    service_dir.rmdir()\n                except OSError:\n                    pass\n                emit(\"PORTAL200_FAILURE_GIT_WORKTREE_RESTORE\", \"PASS\")\n            except Exception:\n                emit(\"PORTAL200_FAILURE_GIT_WORKTREE_RESTORE\", \"FAIL\")\n\n        if commit_created:\n            emit(\n                \"PORTAL200_FAILURE_GIT_HISTORY\",\n                \"COMMIT_CREATED_NO_DESTRUCTIVE_RESET_FRESH_ID_REQUIRED\",\n            )\n\n    persisted = bool(push_confirmed or commit_created or staging_final_new or prod_mutated)\n    if failure_rollback_started and failure_rollback_restored is None:\n        failure_rollback_restored = False\n    result_contract(\n        \"FAIL\",\n        persisted,\n        failure_rollback_started,\n        failure_rollback_restored,\n    )\n    emit(\"PORTAL200_ROADMAP_REMAINS\", 22)\n    emit(\"NEWFI200_END\")\n    raise SystemExit(1)\n\nexcept Exception:\n    emit(\"PORTAL200_FAILURE\", \"UNEXPECTED_EXCEPTION\")\n    result_contract(\n        \"FAIL\",\n        bool(push_confirmed or commit_created or staging_final_new or prod_mutated),\n        False,\n        None,\n    )\n    emit(\"PORTAL200_ROADMAP_REMAINS\", 22)\n    emit(\"NEWFI200_END\")\n    raise SystemExit(1)\n\nCANDIDATE_LAYER_3_TEXT_END\nCANDIDATE_LAYER_4_SOURCE=file:newfi-38-portal200-apply.cmd::b64::zlib\nCANDIDATE_LAYER_4_SHA256=e9d137ac729d7513d8d9aa1d9fb509005aefaa7bfe03f5cb26b9896fb1310f62\nCANDIDATE_LAYER_4_BYTES=32448\nCANDIDATE_LAYER_4_TEXT_BEGIN\nimport hashlib\nimport json\nimport pathlib\nimport shlex\nimport shutil\nimport subprocess\nimport sys\nimport xml.etree.ElementTree as ET\n\nCID = \"NEWFI-260907-PORTAL200-APPLY1\"\nBRANCH = \"implementation/newfi-closed-mvp-20260906\"\nOLD_HEAD = \"06bab5acd124e768f70305b3d7eca2f595871890\"\nWT = pathlib.Path(\"/root/newfi-portal/.worktrees/implementation-newfi-closed-mvp-20260906\")\nCAND_ROOT = pathlib.Path(\"/root/newfi-portal200-candidate/src/addons/Newfi/Portal\")\nPORTAL_REL = pathlib.Path(\"src/addons/Newfi/Portal\")\nGIT_PORTAL = WT / PORTAL_REL\nEXPECTED_NEW = {\n    \"Pub/Controller/Portal.php\": (363, \"619d489f7cc3b461479c702fa8825097ae22d3c6cfeb911e9f14ea1de9c36d6d\"),\n    \"Service/PortalData.php\": (5213, \"4da03f26294ab6d163a1a746dee4bb6a82d7d4f39e66b24246bc0eb4c455dd1d\"),\n    \"_data/templates.xml\": (10977, \"1650c3d868d4bc47703f1b75f1f179cd25309b2d3b20a2b848e81a4423c00861\"),\n}\nEXPECTED_OLD = {\n    \"Pub/Controller/Portal.php\": (247, \"53909e753ea5a011550fd280ad1c342a74ca9949be092dfbd95244243cae92f3\"),\n    \"_data/templates.xml\": (1461, \"c29c04f8b937284e821c87957653e87c2f6ac014fac30648a0f6b18e84392adf\"),\n}\nEXPECTED_GIT_PATHS = [str(PORTAL_REL / p) for p in sorted(EXPECTED_NEW)]\nBACKUP = f\"/root/newfi-portal200-backup-{CID}\"\n\n\nclass PortalError(RuntimeError):\n    pass\n\n\ndef emit(key, value=None):\n    if value is None:\n        print(key, flush=True)\n    elif isinstance(value, (dict, list, tuple, bool, int, float)):\n        print(\n            key + \"=\" + json.dumps(value, ensure_ascii=False, sort_keys=True, separators=(\",\", \":\")),\n            flush=True,\n        )\n    else:\n        print(key + \"=\" + str(value), flush=True)\n\n\ndef fail(code):\n    raise PortalError(code)\n\n\ndef sha_bytes(data):\n    return hashlib.sha256(data).hexdigest()\n\n\ndef file_meta(path):\n    data = pathlib.Path(path).read_bytes()\n    return len(data), sha_bytes(data)\n\n\ndef run(cmd, *, input_bytes=None, timeout=180, ok=(0,)):\n    try:\n        p = subprocess.run(\n            cmd,\n            input=input_bytes,\n            stdout=subprocess.PIPE,\n            stderr=subprocess.PIPE,\n            timeout=timeout,\n            check=False,\n        )\n    except subprocess.TimeoutExpired:\n        fail(\"SUBPROCESS_TIMEOUT\")\n    if p.returncode not in ok:\n        fail(\"SUBPROCESS_RC\")\n    return p\n\n\ndef git(*args, ok=(0,), timeout=120):\n    p = run([\"/usr/bin/git\", \"-C\", str(WT), *args], timeout=timeout, ok=ok)\n    return p.stdout.decode(\"utf-8\", \"replace\").strip()\n\n\ndef qga(target, argv, *, input_bytes=None, timeout=180):\n    if target == \"prod\":\n        cmd = [\n            \"/usr/sbin/qm\",\n            \"guest\",\n            \"exec\",\n            \"210\",\n            \"--synchronous\",\n            \"1\",\n            \"--timeout\",\n            str(timeout),\n        ]\n        if input_bytes is not None:\n            cmd += [\"--pass-stdin\", \"1\"]\n        cmd += [\"--\", *argv]\n    elif target == \"staging\":\n        q = [\n            \"/usr/sbin/qm\",\n            \"guest\",\n            \"exec\",\n            \"211\",\n            \"--synchronous\",\n            \"1\",\n            \"--timeout\",\n            str(timeout),\n        ]\n        if input_bytes is not None:\n            q += [\"--pass-stdin\", \"1\"]\n        q += [\"--\", *argv]\n        remote = (\n            \"test \\\"$(id -u):$(hostname -s)\\\" = 0:pve03 || exit 72; \"\n            \"for f in /etc/pve/HOMELAB_ASSISTANT_ERROR_REGISTER.md /etc/pve/31_HOMELAB_REFERENCE.md; do \"\n            \"test -r \\\"$f\\\" && test -s \\\"$f\\\" && cat -- \\\"$f\\\" >/dev/null || exit 73; done; exec \"\n            + \" \".join(shlex.quote(x) for x in q)\n        )\n        cmd = [\n            \"/usr/bin/ssh\",\n            \"-T\",\n            \"-o\",\n            \"BatchMode=yes\",\n            \"-o\",\n            \"StrictHostKeyChecking=yes\",\n            \"-o\",\n            \"UpdateHostKeys=no\",\n            \"-o\",\n            \"ConnectTimeout=10\",\n            \"-o\",\n            \"ConnectionAttempts=1\",\n            \"root@pve03\",\n            remote,\n        ]\n    else:\n        fail(\"BAD_TARGET\")\n\n    p = run(cmd, input_bytes=input_bytes, timeout=timeout + 30)\n    try:\n        data = json.loads(p.stdout.decode(\"utf-8\"))\n    except Exception:\n        fail(\"QGA_JSON\")\n    if data.get(\"exited\") not in (1, True) or data.get(\"exitcode\") != 0:\n        fail(\"QGA_GUEST_RC\")\n    if data.get(\"out-truncated\") or data.get(\"err-truncated\"):\n        fail(\"QGA_TRUNCATED\")\n    return data.get(\"out-data\", \"\")\n\n\nINSPECT_PHP = r'''<?php\n$root = '/var/www/forums/newfi/public';\nrequire $root . '/src/XF.php';\n\\XF::start($root);\n$app = \\XF::setupApp('XF\\\\Pub\\\\App');\n$db = $app->db();\nfunction srcMeta(string $path): ?array {\n    if (!is_file($path)) { return null; }\n    return ['bytes' => filesize($path), 'sha256' => hash_file('sha256', $path)];\n}\n$portal = $root . '/src/addons/Newfi/Portal';\n$templates = $db->fetchAll(\n    \"SELECT title, style_id, LENGTH(template) AS bytes, SHA2(template,256) AS sha256, \" .\n    \"LOCATE('data-newfi-portal200', template) > 0 AS html_marker, \" .\n    \"LOCATE('--newfi-portal200', template) > 0 AS css_marker \" .\n    \"FROM xf_template WHERE addon_id='Newfi/Portal' ORDER BY style_id,title\"\n);\n$result = [\n 'hostname' => gethostname(),\n 'application' => [\n  'boardActive' => (string)$db->fetchOne(\"SELECT option_value FROM xf_option WHERE option_id='boardActive'\"),\n  'boardUrl' => (string)$db->fetchOne(\"SELECT option_value FROM xf_option WHERE option_id='boardUrl'\"),\n  'indexRoute' => (string)$db->fetchOne(\"SELECT option_value FROM xf_option WHERE option_id='indexRoute'\"),\n  'defaultStyleId' => (string)$db->fetchOne(\"SELECT option_value FROM xf_option WHERE option_id='defaultStyleId'\"),\n  'error_count' => (int)$db->fetchOne(\"SELECT COUNT(*) FROM xf_error_log\"),\n  'error_max_id' => (int)$db->fetchOne(\"SELECT COALESCE(MAX(error_id),0) FROM xf_error_log\")\n ],\n 'addon' => $db->fetchRow(\n  \"SELECT addon_id,version_id,version_string,active,is_processing,last_pending_action \" .\n  \"FROM xf_addon WHERE addon_id='Newfi/Portal'\"\n ),\n 'source' => [\n  'Pub/Controller/Portal.php' => srcMeta($portal . '/Pub/Controller/Portal.php'),\n  'Service/PortalData.php' => srcMeta($portal . '/Service/PortalData.php'),\n  '_data/templates.xml' => srcMeta($portal . '/_data/templates.xml')\n ],\n 'templates' => $templates\n];\necho \"PORTAL200_INSPECT_JSON_BEGIN\\n\";\necho json_encode(\n    $result,\n    JSON_UNESCAPED_UNICODE|JSON_UNESCAPED_SLASHES|JSON_INVALID_UTF8_SUBSTITUTE\n);\necho \"\\nPORTAL200_INSPECT_JSON_END\\n\";\n?>'''\n\n\nIMPORT_PHP = r'''<?php\n$root = '/var/www/forums/newfi/public';\nrequire $root . '/src/XF.php';\n\\XF::start($root);\n$app = \\XF::setupApp('XF\\\\Pub\\\\App');\n$addOn = $app->addOnManager()->getById('Newfi/Portal');\nif (!$addOn || !$addOn->isInstalled()) {\n    fwrite(STDERR, \"ADDON_NOT_INSTALLED\\n\");\n    exit(30);\n}\n$addOn->preRebuild();\n$dataManager = $app->addOnDataManager();\n$imported = [];\nforeach ($dataManager->getDataTypeClasses() as $dataType) {\n    $handler = $dataManager->getDataTypeHandler($dataType);\n    $xml = $handler->openTypeFile($addOn->getDataDirectory());\n    if (!$xml || !$xml->count()) {\n        $handler->deleteAddOnData($addOn->addon_id);\n        continue;\n    }\n    $start = 0;\n    $guard = 0;\n    while (true) {\n        $last = $handler->importAddOnData($addOn->addon_id, $xml, $start, 0);\n        if (!$last) { break; }\n        if ($last <= $start || ++$guard > 100000) {\n            fwrite(STDERR, \"IMPORT_PROGRESS_INVALID\\n\");\n            exit(31);\n        }\n        $start = $last;\n    }\n    $handler->deleteOrphanedAddOnData($addOn->addon_id, $xml);\n    \\XF::triggerRunOnce();\n    $imported[] = $handler->getContainerTag();\n}\n$addOn->postDataImport();\n$repo = $app->repository(\\XF\\Repository\\StyleRepository::class);\n$repo->updateAllStylesLastModifiedDateLater();\n$addOn->postRebuild();\necho \"PORTAL200_IMPORT_JSON=\" . json_encode(\n    ['result'=>'PASS','containers'=>$imported],\n    JSON_UNESCAPED_SLASHES\n) . \"\\n\";\n?>'''\n\n\nERRORS_PHP_TEMPLATE = r'''<?php\n$root='/var/www/forums/newfi/public';\nrequire $root.'/src/XF.php';\n\\XF::start($root);\n$app=\\XF::setupApp('XF\\\\Pub\\\\App');\n$db=$app->db();\n$b=%d;\n$rows=$db->fetchAll(\n    \"SELECT error_id,exception_type,message,filename,line FROM xf_error_log WHERE error_id>? ORDER BY error_id\",\n    [$b]\n);\necho json_encode(\n    $rows,\n    JSON_UNESCAPED_UNICODE|JSON_UNESCAPED_SLASHES|JSON_INVALID_UTF8_SUBSTITUTE\n);\n?>'''\n\n\nRUNTIME_VERIFY_PHP_TEMPLATE = r'''<?php\n$state = '__STATE__';\n$root = '/var/www/forums/newfi/public';\nrequire $root . '/src/XF.php';\n\\XF::start($root);\n$app = \\XF::setupApp('XF\\\\Pub\\\\App');\n$result = ['state'=>$state];\nif ($state === 'new') {\n    $service = new \\Newfi\\Portal\\Service\\PortalData($app);\n    $portal = $service->build();\n    $html = (string)$app->templater()->renderTemplate('public:newfi_portal', ['portal'=>$portal]);\n    $result['sections'] = [];\n    foreach (['forums','resources','media','events','dogs'] as $key) {\n        $section = $portal[$key] ?? null;\n        if (!is_array($section)) { fwrite(STDERR, \"SECTION_MISSING\\n\"); exit(60); }\n        $result['sections'][$key] = [\n            'available'=>(bool)($section['available'] ?? false),\n            'hasItems'=>(bool)($section['hasItems'] ?? false),\n            'status'=>(string)($section['status'] ?? '')\n        ];\n    }\n    $result['html_marker'] = strpos($html, 'data-newfi-portal200=\"1\"') !== false;\n    $result['locked_resources'] = strpos($html, 'data-portal-locked=\"resources\"') !== false;\n    $result['locked_media'] = strpos($html, 'data-portal-locked=\"media\"') !== false;\n    $result['html_bytes'] = strlen($html);\n    if (!$result['html_marker']) { fwrite(STDERR, \"HTML_MARKER_MISSING\\n\"); exit(61); }\n    if ($result['sections']['resources']['available'] || $result['sections']['media']['available']) {\n        fwrite(STDERR, \"GUEST_PERMISSION_CONTRACT_CHANGED\\n\"); exit(62);\n    }\n    if (!$result['locked_resources'] || !$result['locked_media']) {\n        fwrite(STDERR, \"LOCKED_COPY_MISSING\\n\"); exit(63);\n    }\n    if (!$result['sections']['forums']['available'] || !$result['sections']['events']['available'] || !$result['sections']['dogs']['available']) {\n        fwrite(STDERR, \"PUBLIC_SECTION_UNAVAILABLE\\n\"); exit(64);\n    }\n} else if ($state === 'old') {\n    $html = (string)$app->templater()->renderTemplate('public:newfi_portal', []);\n    $result['html_marker'] = strpos($html, 'data-newfi-portal200') !== false;\n    $result['old_copy'] = strpos($html, 'Закрытое пространство для общения, знаний и материалов сообщества.') !== false;\n    $result['html_bytes'] = strlen($html);\n    if ($result['html_marker'] || !$result['old_copy']) {\n        fwrite(STDERR, \"OLD_RENDER_CONTRACT\\n\"); exit(65);\n    }\n} else {\n    exit(66);\n}\necho \"PORTAL200_RUNTIME_JSON=\" . json_encode(\n    $result,\n    JSON_UNESCAPED_UNICODE|JSON_UNESCAPED_SLASHES|JSON_INVALID_UTF8_SUBSTITUTE\n) . \"\\n\";\n?>'''\n\n\nHTTP_VERIFY_PY = r'''import html,json,re,subprocess,sys,urllib.parse\nmode=sys.argv[1]\nstate=sys.argv[2]\nif mode=='staging':\n    host='newfi-staging.gram1.ru'; scheme='http'; port='80'; expected_status=503\nelif mode=='prod':\n    host='newfi.ru'; scheme='https'; port='443'; expected_status=200\nelse:\n    raise SystemExit(40)\ndef fetch(url):\n    cmd=[\n        '/usr/bin/curl','-sS','-k','--max-time','30','--connect-timeout','10',\n        '--resolve',f'{host}:{port}:127.0.0.1','-o','-','-w',\n        '\\n__PORTAL_STATUS__%{http_code}',url\n    ]\n    p=subprocess.run(cmd,stdout=subprocess.PIPE,stderr=subprocess.PIPE,check=False)\n    if p.returncode!=0: raise SystemExit(41)\n    text=p.stdout.decode('utf-8','replace')\n    marker='\\n__PORTAL_STATUS__'\n    if marker not in text: raise SystemExit(42)\n    body,status=text.rsplit(marker,1)\n    return int(status.strip()),body\nroot=f'{scheme}://{host}/'\nstatus,body=fetch(root)\nhrefs=[]\nfor raw in re.findall(r\"href=[\\\"']([^\\\"']*css\\\\.php[^\\\"']*)[\\\"']\",body,re.I):\n    raw=html.unescape(raw)\n    hrefs.append(urllib.parse.urljoin(root,raw))\nnormal_css=[]\nnormal_status=[]\nfor u in hrefs:\n    s,b=fetch(u)\n    normal_status.append(s)\n    normal_css.append(b)\nnormal_css_text='\\n'.join(normal_css)\nforced_css_marker=None\nforced_css_status=None\nif mode=='staging' and state=='new':\n    if not hrefs: raise SystemExit(43)\n    u=urllib.parse.urlsplit(hrefs[0])\n    pairs=urllib.parse.parse_qsl(u.query,keep_blank_values=True)\n    out=[]\n    found=False\n    for k,v in pairs:\n        if k=='css':\n            found=True\n            parts=[x for x in v.split(',') if x]\n            if 'public:newfi_portal.less' not in parts:\n                parts.append('public:newfi_portal.less')\n            v=','.join(parts)\n        out.append((k,v))\n    if not found: raise SystemExit(44)\n    forced=urllib.parse.urlunsplit((u.scheme,u.netloc,u.path,urllib.parse.urlencode(out),u.fragment))\n    forced_css_status,forced_body=fetch(forced)\n    forced_css_marker='--newfi-portal200' in forced_body\nresult={\n 'status':status,\n 'bytes':len(body.encode()),\n 'html_marker':'data-newfi-portal200=\"1\"' in body,\n 'css_marker':'--newfi-portal200' in normal_css_text,\n 'old_copy':'Закрытое пространство для общения, знаний и материалов сообщества.' in body,\n 'css_count':len(hrefs),\n 'css_status':normal_status,\n 'forced_css_status':forced_css_status,\n 'forced_css_marker':forced_css_marker,\n}\nprint('PORTAL200_HTTP_JSON='+json.dumps(result,ensure_ascii=False,sort_keys=True,separators=(',',':')))\nif status!=expected_status: raise SystemExit(45)\nif not hrefs or any(x!=200 for x in normal_status): raise SystemExit(46)\nif mode=='prod' and state=='new':\n    if not result['html_marker'] or not result['css_marker']: raise SystemExit(47)\nelif mode=='prod' and state=='old':\n    if result['html_marker'] or result['css_marker'] or not result['old_copy']: raise SystemExit(48)\nelif mode=='staging' and state=='new':\n    if forced_css_status!=200 or not forced_css_marker: raise SystemExit(49)\nelif mode=='staging' and state=='old':\n    pass\nelse:\n    raise SystemExit(50)\n'''\n\n\ndef parse_inspect(text):\n    b = \"PORTAL200_INSPECT_JSON_BEGIN\\n\"\n    e = \"\\nPORTAL200_INSPECT_JSON_END\"\n    if b not in text or e not in text:\n        fail(\"INSPECT_MARKERS\")\n    try:\n        return json.loads(text.split(b, 1)[1].split(e, 1)[0])\n    except Exception:\n        fail(\"INSPECT_JSON\")\n\n\ndef inspect(target):\n    return parse_inspect(\n        qga(target, [\"/usr/bin/php8.3\"], input_bytes=INSPECT_PHP.encode(), timeout=120)\n    )\n\n\ndef source_is_old(data):\n    src = data[\"source\"]\n    for rel, (size, sha) in EXPECTED_OLD.items():\n        row = src.get(rel)\n        if not row or row.get(\"bytes\") != size or row.get(\"sha256\") != sha:\n            return False\n    return src.get(\"Service/PortalData.php\") is None\n\n\ndef source_is_new(data):\n    src = data[\"source\"]\n    for rel, (size, sha) in EXPECTED_NEW.items():\n        row = src.get(rel)\n        if not row or row.get(\"bytes\") != size or row.get(\"sha256\") != sha:\n            return False\n    return True\n\n\ndef template_state_new(data):\n    rows = data.get(\"templates\", [])\n    rows0 = [r for r in rows if int(r.get(\"style_id\", -1)) == 0]\n    titles = [r.get(\"title\") for r in rows0]\n    by = {r.get(\"title\"): r for r in rows0}\n    return (\n        titles == [\"newfi_portal\", \"newfi_portal.less\"]\n        and int(by[\"newfi_portal\"].get(\"html_marker\", 0)) == 1\n        and int(by[\"newfi_portal.less\"].get(\"css_marker\", 0)) == 1\n    )\n\n\ndef app_contract(data, target):\n    a = data.get(\"application\", {})\n    addon = data.get(\"addon\") or {}\n    expected = {\n        \"staging\": (\"0\", \"http://newfi-staging.gram1.ru\"),\n        \"prod\": (\"1\", \"https://newfi.ru\"),\n    }[target]\n    return (\n        a.get(\"boardActive\") == expected[0]\n        and a.get(\"boardUrl\") == expected[1]\n        and a.get(\"indexRoute\") == \"portal/\"\n        and a.get(\"defaultStyleId\") == \"4\"\n        and addon.get(\"addon_id\") == \"Newfi/Portal\"\n        and int(addon.get(\"version_id\", 0)) == 1000010\n        and addon.get(\"version_string\") == \"1.0.0 Alpha 1\"\n        and int(addon.get(\"active\", 0)) == 1\n        and int(addon.get(\"is_processing\", 1)) == 0\n    )\n\n\ndef new_errors(target, baseline):\n    raw = qga(\n        target,\n        [\"/usr/bin/php8.3\"],\n        input_bytes=(ERRORS_PHP_TEMPLATE % int(baseline)).encode(),\n        timeout=90,\n    )\n    try:\n        return json.loads(raw)\n    except Exception:\n        fail(\"ERROR_LOG_JSON\")\n\n\ndef assert_no_new_errors(target, baseline, phase):\n    rows = new_errors(target, baseline)\n    if rows:\n        emit(\n            \"PORTAL200_NEW_XF_ERRORS\",\n            {\n                \"target\": target,\n                \"phase\": phase,\n                \"count\": len(rows),\n                \"ids\": [r.get(\"error_id\") for r in rows],\n            },\n        )\n        fail(\"NEW_XF_ERRORS\")\n\n\ndef guest_backup(target):\n    script = f'''set -eu\nB={shlex.quote(BACKUP)}\nP=/var/www/forums/newfi/public/src/addons/Newfi/Portal\ntest ! -e \"$B\"\ninstall -d -m 700 \"$B/Pub/Controller\" \"$B/_data\"\ncp -p -- \"$P/Pub/Controller/Portal.php\" \"$B/Pub/Controller/Portal.php\"\ncp -p -- \"$P/_data/templates.xml\" \"$B/_data/templates.xml\"\ntest ! -e \"$P/Service/PortalData.php\"\nprintf 'PORTAL200_BACKUP=PASS\\n'\n'''\n    out = qga(target, [\"/bin/bash\", \"-lc\", script], timeout=90)\n    if \"PORTAL200_BACKUP=PASS\" not in out:\n        fail(\"BACKUP_FAILED\")\n\n\ndef guest_write(target, rel, data):\n    dest = f\"/var/www/forums/newfi/public/src/addons/Newfi/Portal/{rel}\"\n    parent = str(pathlib.PurePosixPath(dest).parent)\n    script = (\n        \"set -eu; umask 022; \"\n        + \"install -d -m 755 \"\n        + shlex.quote(parent)\n        + \"; T=$(mktemp \"\n        + shlex.quote(parent + \"/.portal200.XXXXXX\")\n        + \"); cat >\\\"$T\\\"; chmod 0644 \\\"$T\\\"; chown root:root \\\"$T\\\"; \"\n        + \"mv -f -- \\\"$T\\\" \"\n        + shlex.quote(dest)\n        + \"; printf 'PORTAL200_WRITE=PASS\\\\n'\"\n    )\n    out = qga(\n        target,\n        [\"/bin/bash\", \"-lc\", script],\n        input_bytes=data,\n        timeout=90,\n    )\n    if \"PORTAL200_WRITE=PASS\" not in out:\n        fail(\"WRITE_FAILED\")\n\n\ndef install_candidate(target):\n    for rel in [\n        \"Pub/Controller/Portal.php\",\n        \"Service/PortalData.php\",\n        \"_data/templates.xml\",\n    ]:\n        guest_write(target, rel, (CAND_ROOT / rel).read_bytes())\n\n\ndef restore_old(target):\n    script = f'''set -eu\nB={shlex.quote(BACKUP)}\nP=/var/www/forums/newfi/public/src/addons/Newfi/Portal\ntest -f \"$B/Pub/Controller/Portal.php\"\ntest -f \"$B/_data/templates.xml\"\ncp -p -- \"$B/Pub/Controller/Portal.php\" \"$P/Pub/Controller/Portal.php\"\ncp -p -- \"$B/_data/templates.xml\" \"$P/_data/templates.xml\"\nrm -f -- \"$P/Service/PortalData.php\"\nrmdir -- \"$P/Service\" 2>/dev/null || true\nprintf 'PORTAL200_SOURCE_RESTORE=PASS\\n'\n'''\n    out = qga(target, [\"/bin/bash\", \"-lc\", script], timeout=90)\n    if \"PORTAL200_SOURCE_RESTORE=PASS\" not in out:\n        fail(\"SOURCE_RESTORE_FAILED\")\n\n\ndef import_addon(target):\n    out = qga(\n        target,\n        [\"/usr/bin/php8.3\"],\n        input_bytes=IMPORT_PHP.encode(),\n        timeout=240,\n    )\n    if \"PORTAL200_IMPORT_JSON=\" not in out:\n        fail(\"IMPORT_FAILED\")\n\n\ndef runtime_verify(target, state):\n    src = RUNTIME_VERIFY_PHP_TEMPLATE.replace(\"__STATE__\", state)\n    out = qga(target, [\"/usr/bin/php8.3\"], input_bytes=src.encode(), timeout=120)\n    line = next(\n        (x for x in out.splitlines() if x.startswith(\"PORTAL200_RUNTIME_JSON=\")),\n        None,\n    )\n    if not line:\n        fail(\"RUNTIME_MARKER_MISSING\")\n    try:\n        data = json.loads(line.split(\"=\", 1)[1])\n    except Exception:\n        fail(\"RUNTIME_JSON\")\n    emit(\"PORTAL200_RUNTIME\", {\"target\": target, **data})\n    return data\n\n\ndef http_verify(target, state):\n    out = qga(\n        target,\n        [\"/usr/bin/python3\", \"-\", target, state],\n        input_bytes=HTTP_VERIFY_PY.encode(),\n        timeout=180,\n    )\n    line = next(\n        (x for x in out.splitlines() if x.startswith(\"PORTAL200_HTTP_JSON=\")),\n        None,\n    )\n    if not line:\n        fail(\"HTTP_MARKER_MISSING\")\n    try:\n        data = json.loads(line.split(\"=\", 1)[1])\n    except Exception:\n        fail(\"HTTP_JSON\")\n    emit(\"PORTAL200_HTTP\", {\"target\": target, \"state\": state, **data})\n    return data\n\n\ndef verify_new(target, baseline):\n    data = inspect(target)\n    if not app_contract(data, target):\n        fail(\"APP_CONTRACT_NEW\")\n    if not source_is_new(data):\n        fail(\"SOURCE_NEW_MISMATCH\")\n    if not template_state_new(data):\n        fail(\"TEMPLATE_NEW_MISMATCH\")\n    runtime_verify(target, \"new\")\n    http_verify(target, \"new\")\n    assert_no_new_errors(target, baseline, \"verify-new\")\n    return inspect(target)\n\n\ndef verify_old(target, baseline, old_templates, strict_errors=True):\n    data = inspect(target)\n    if not app_contract(data, target):\n        fail(\"APP_CONTRACT_OLD\")\n    if not source_is_old(data):\n        fail(\"SOURCE_OLD_MISMATCH\")\n    if data.get(\"templates\") != old_templates:\n        fail(\"TEMPLATE_ROLLBACK_MISMATCH\")\n    if target == \"prod\":\n        runtime_verify(target, \"old\")\n    http_verify(target, \"old\")\n    if strict_errors:\n        assert_no_new_errors(target, baseline, \"verify-old\")\n    return inspect(target)\n\n\ndef lint_php(target, source, label):\n    out = qga(\n        target,\n        [\"/usr/bin/php8.3\", \"-l\"],\n        input_bytes=source.encode(),\n        timeout=90,\n    )\n    if \"No syntax errors detected\" not in out:\n        fail(\"PHP_LINT_\" + label)\n\n\ndef cluster_guard():\n    p = run([\"/usr/sbin/qm\", \"status\", \"210\"], timeout=30)\n    if \"status: running\" not in p.stdout.decode():\n        fail(\"VM210_NOT_RUNNING\")\n    p = run(\n        [\n            \"/usr/bin/ssh\",\n            \"-T\",\n            \"-o\",\n            \"BatchMode=yes\",\n            \"-o\",\n            \"StrictHostKeyChecking=yes\",\n            \"-o\",\n            \"UpdateHostKeys=no\",\n            \"-o\",\n            \"ConnectTimeout=10\",\n            \"root@pve03\",\n            \"/usr/sbin/qm status 211\",\n        ],\n        timeout=40,\n    )\n    if \"status: running\" not in p.stdout.decode():\n        fail(\"VM211_NOT_RUNNING\")\n    emit(\"PORTAL200_CLUSTER\", \"PASS\")\n\n\ndef result_contract(status, changes, rollback_started, rollback_restored):\n    emit(\n        \"HOMELAB_RESULT_CONTRACT\",\n        {\n            \"version\": 1,\n            \"command_id\": CID,\n            \"status\": status,\n            \"changes_made\": bool(changes),\n            \"rollback_started\": bool(rollback_started),\n            \"rollback_restored\": rollback_restored,\n        },\n    )\n\n\nemit(\"NEWFI200_BEGIN\")\nemit(\"COMMAND_ID\", CID)\nemit(\"PORTAL200_REMAINING_FULL_PRODUCT_COMMANDS_BEFORE\", 22)\nemit(\n    \"PORTAL200_FLOW\",\n    \"candidate->staging-apply->rollback-proof->staging-reapply->git-push->production\",\n)\n\nstaging_backup = False\nstaging_mutated = False\nstaging_final_new = False\nprod_backup = False\nprod_mutated = False\ngit_files_changed = False\ncommit_created = False\npush_confirmed = False\nfailure_rollback_started = False\nfailure_rollback_restored = None\nold_git_bytes = {}\nnew_head = None\ns_error = None\np_error = None\ns_old_templates = None\np_old_templates = None\n\ntry:\n    compile(HTTP_VERIFY_PY, \"<portal200-http-verify>\", \"exec\")\n    for rel, (size, sha) in EXPECTED_NEW.items():\n        p = CAND_ROOT / rel\n        if not p.is_file() or file_meta(p) != (size, sha):\n            fail(\"CANDIDATE_IDENTITY\")\n    tree = ET.parse(CAND_ROOT / \"_data/templates.xml\")\n    titles = sorted(x.attrib.get(\"title\") for x in tree.getroot().findall(\"template\"))\n    if titles != [\"newfi_portal\", \"newfi_portal.less\"]:\n        fail(\"CANDIDATE_TEMPLATE_SET\")\n    service = (CAND_ROOT / \"Service/PortalData.php\").read_text(\"utf-8\")\n    if any(\n        token in service\n        for token in [\n            \"\\\\XF::db(\",\n            \"->save(\",\n            \"->delete(\",\n            \"INSERT \",\n            \"UPDATE \",\n            \"DELETE \",\n            \"REPLACE \",\n        ]\n    ):\n        fail(\"CANDIDATE_MUTATION_SCAN\")\n    emit(\"PORTAL200_CANDIDATE_IDENTITY\", \"PASS\")\n\n    branch = git(\"branch\", \"--show-current\")\n    head = git(\"rev-parse\", \"HEAD\")\n    status = git(\"status\", \"--porcelain=v1\", \"--untracked-files=all\")\n    remote_out = git(\"ls-remote\", \"origin\", f\"refs/heads/{BRANCH}\")\n    remote = remote_out.split()[0] if remote_out else \"\"\n    if branch != BRANCH or head != OLD_HEAD or remote != OLD_HEAD or status:\n        fail(\"GIT_PRESTATE\")\n    emit(\n        \"PORTAL200_GIT_PRESTATE\",\n        {\"branch\": branch, \"head\": head, \"remote\": remote, \"clean\": True},\n    )\n    cluster_guard()\n\n    lint_php(\"staging\", INSPECT_PHP, \"INSPECT_STAGING\")\n    lint_php(\"staging\", IMPORT_PHP, \"IMPORT_STAGING\")\n    lint_php(\"staging\", RUNTIME_VERIFY_PHP_TEMPLATE.replace(\"__STATE__\", \"new\"), \"RUNTIME_STAGING\")\n    lint_php(\"prod\", INSPECT_PHP, \"INSPECT_PROD\")\n    lint_php(\"prod\", IMPORT_PHP, \"IMPORT_PROD\")\n    lint_php(\"prod\", RUNTIME_VERIFY_PHP_TEMPLATE.replace(\"__STATE__\", \"new\"), \"RUNTIME_PROD\")\n    emit(\"PORTAL200_RUNTIME_HELPER_LINT\", \"PASS\")\n\n    s0 = inspect(\"staging\")\n    p0 = inspect(\"prod\")\n    if not app_contract(s0, \"staging\") or not app_contract(p0, \"prod\"):\n        fail(\"APP_PRESTATE\")\n    if not source_is_old(s0) or not source_is_old(p0):\n        fail(\"SOURCE_PRESTATE\")\n    if s0.get(\"templates\") != p0.get(\"templates\"):\n        fail(\"TEMPLATE_PRESTATE_PARITY\")\n    s_error = int(s0[\"application\"][\"error_max_id\"])\n    p_error = int(p0[\"application\"][\"error_max_id\"])\n    s_old_templates = s0[\"templates\"]\n    p_old_templates = p0[\"templates\"]\n    emit(\"PORTAL200_ERROR_BASELINE\", {\"staging\": s_error, \"prod\": p_error})\n    http_verify(\"staging\", \"old\")\n    runtime_verify(\"prod\", \"old\")\n    http_verify(\"prod\", \"old\")\n    assert_no_new_errors(\"staging\", s_error, \"preflight\")\n    assert_no_new_errors(\"prod\", p_error, \"preflight\")\n    emit(\"PORTAL200_PREFLIGHT\", \"PASS\")\n\n    guest_backup(\"staging\")\n    staging_backup = True\n    staging_mutated = True\n    install_candidate(\"staging\")\n    import_addon(\"staging\")\n    verify_new(\"staging\", s_error)\n    emit(\"PORTAL200_STAGING_FIRST_APPLY\", \"PASS\")\n\n    restore_old(\"staging\")\n    import_addon(\"staging\")\n    verify_old(\"staging\", s_error, s_old_templates)\n    staging_mutated = False\n    emit(\"PORTAL200_STAGING_ROLLBACK_PROOF\", \"PASS\")\n\n    staging_mutated = True\n    install_candidate(\"staging\")\n    import_addon(\"staging\")\n    verify_new(\"staging\", s_error)\n    staging_final_new = True\n    emit(\"PORTAL200_STAGING_FINAL\", \"PASS\")\n\n    for rel in EXPECTED_NEW:\n        dest = GIT_PORTAL / rel\n        old_git_bytes[str(rel)] = dest.read_bytes() if dest.exists() else None\n        dest.parent.mkdir(parents=True, exist_ok=True)\n        shutil.copyfile(CAND_ROOT / rel, dest)\n    git_files_changed = True\n\n    if git(\"diff\", \"--check\"):\n        fail(\"GIT_DIFF_CHECK\")\n    status_lines = git(\"status\", \"--porcelain=v1\", \"--untracked-files=all\").splitlines()\n    actual_paths = sorted(line[3:] for line in status_lines if len(line) >= 4)\n    if actual_paths != sorted(EXPECTED_GIT_PATHS):\n        fail(\"GIT_SCOPE\")\n    git(\"add\", \"--\", *EXPECTED_GIT_PATHS)\n    staged = sorted(x for x in git(\"diff\", \"--cached\", \"--name-only\").splitlines() if x)\n    if staged != sorted(EXPECTED_GIT_PATHS):\n        fail(\"GIT_STAGED_SCOPE\")\n    git(\"commit\", \"-m\", f\"feat: build data-backed Newfi portal [{CID}]\")\n    commit_created = True\n    new_head = git(\"rev-parse\", \"HEAD\")\n    if new_head == OLD_HEAD:\n        fail(\"GIT_COMMIT_HEAD\")\n    if git(\"status\", \"--porcelain=v1\", \"--untracked-files=all\"):\n        fail(\"GIT_POSTCOMMIT_DIRTY\")\n    git(\"push\", \"origin\", f\"HEAD:refs/heads/{BRANCH}\", timeout=180)\n    remote_out = git(\"ls-remote\", \"origin\", f\"refs/heads/{BRANCH}\")\n    remote_head = remote_out.split()[0] if remote_out else \"\"\n    if remote_head != new_head:\n        fail(\"GIT_REMOTE_HEAD\")\n    push_confirmed = True\n    emit(\n        \"PORTAL200_GIT_PROMOTION\",\n        {\n            \"old_head\": OLD_HEAD,\n            \"new_head\": new_head,\n            \"remote_head\": remote_head,\n            \"result\": \"PASS\",\n        },\n    )\n\n    p_pre = inspect(\"prod\")\n    if not source_is_old(p_pre) or p_pre.get(\"templates\") != p_old_templates:\n        fail(\"PROD_DRIFT_BEFORE_APPLY\")\n    if int(p_pre[\"application\"][\"error_max_id\"]) != p_error:\n        fail(\"PROD_ERROR_DRIFT\")\n    guest_backup(\"prod\")\n    prod_backup = True\n    prod_mutated = True\n    install_candidate(\"prod\")\n    import_addon(\"prod\")\n    verify_new(\"prod\", p_error)\n    emit(\"PORTAL200_PRODUCTION\", \"PASS\")\n\n    sf = verify_new(\"staging\", s_error)\n    pf = verify_new(\"prod\", p_error)\n    if sf[\"source\"] != pf[\"source\"]:\n        fail(\"FINAL_SOURCE_PARITY\")\n    if sf[\"templates\"] != pf[\"templates\"]:\n        fail(\"FINAL_TEMPLATE_PARITY\")\n    if git(\"rev-parse\", \"HEAD\") != new_head:\n        fail(\"FINAL_LOCAL_HEAD\")\n    remote_out = git(\"ls-remote\", \"origin\", f\"refs/heads/{BRANCH}\")\n    if not remote_out or remote_out.split()[0] != new_head:\n        fail(\"FINAL_REMOTE_HEAD\")\n    if git(\"status\", \"--porcelain=v1\", \"--untracked-files=all\"):\n        fail(\"FINAL_GIT_DIRTY\")\n    cluster_guard()\n    emit(\n        \"PORTAL200_FINAL_EVIDENCE\",\n        {\n            \"commit\": new_head,\n            \"source_files\": 3,\n            \"templates\": 2,\n            \"staging_error_baseline\": s_error,\n            \"prod_error_baseline\": p_error,\n        },\n    )\n    emit(\"PORTAL200_PORTAL\", \"PASS\")\n    emit(\"PORTAL200_STAGING\", \"PASS\")\n    emit(\"PORTAL200_PRODUCTION\", \"PASS\")\n    emit(\"PORTAL200_REMAINING_FULL_PRODUCT_COMMANDS_AFTER_PASS\", 21)\n    result_contract(\"OK\", True, False, None)\n    emit(\"NEWFI200_END\")\n    raise SystemExit(0)\n\nexcept PortalError as exc:\n    code = str(exc)\n    emit(\"PORTAL200_FAILURE\", code)\n\n    if push_confirmed:\n        if prod_mutated and prod_backup:\n            failure_rollback_started = True\n            try:\n                restore_old(\"prod\")\n                import_addon(\"prod\")\n                verify_old(\"prod\", p_error, p_old_templates, strict_errors=False)\n                prod_mutated = False\n                failure_rollback_restored = False\n                emit(\"PORTAL200_FAILURE_PROD_ROLLBACK\", \"PASS_PARTIAL_OVERALL_STATE_CHANGED\")\n            except Exception:\n                failure_rollback_restored = False\n                emit(\"PORTAL200_FAILURE_PROD_ROLLBACK\", \"FAIL\")\n    else:\n        if staging_mutated and staging_backup:\n            failure_rollback_started = True\n            try:\n                restore_old(\"staging\")\n                import_addon(\"staging\")\n                verify_old(\"staging\", s_error, s_old_templates, strict_errors=False)\n                staging_mutated = False\n                staging_final_new = False\n                failure_rollback_restored = True\n                emit(\"PORTAL200_FAILURE_STAGING_ROLLBACK\", \"PASS\")\n            except Exception:\n                failure_rollback_restored = False\n                emit(\"PORTAL200_FAILURE_STAGING_ROLLBACK\", \"FAIL\")\n\n        if git_files_changed and not commit_created:\n            try:\n                for rel, old in old_git_bytes.items():\n                    dest = GIT_PORTAL / rel\n                    if old is None:\n                        if dest.exists():\n                            dest.unlink()\n                    else:\n                        dest.write_bytes(old)\n                service_dir = GIT_PORTAL / \"Service\"\n                try:\n                    service_dir.rmdir()\n                except OSError:\n                    pass\n                emit(\"PORTAL200_FAILURE_GIT_WORKTREE_RESTORE\", \"PASS\")\n            except Exception:\n                emit(\"PORTAL200_FAILURE_GIT_WORKTREE_RESTORE\", \"FAIL\")\n\n        if commit_created:\n            emit(\n                \"PORTAL200_FAILURE_GIT_HISTORY\",\n                \"COMMIT_CREATED_NO_DESTRUCTIVE_RESET_FRESH_ID_REQUIRED\",\n            )\n\n    persisted = bool(push_confirmed or commit_created or staging_final_new or prod_mutated)\n    if failure_rollback_started and failure_rollback_restored is None:\n        failure_rollback_restored = False\n    result_contract(\n        \"ERROR\",\n        persisted,\n        failure_rollback_started,\n        failure_rollback_restored,\n    )\n    emit(\"PORTAL200_ROADMAP_REMAINS\", 22)\n    emit(\"NEWFI200_END\")\n    raise SystemExit(1)\n\nexcept Exception:\n    emit(\"PORTAL200_FAILURE\", \"UNEXPECTED_EXCEPTION\")\n    result_contract(\n        \"ERROR\",\n        bool(push_confirmed or commit_created or staging_final_new or prod_mutated),\n        False,\n        None,\n    )\n    emit(\"PORTAL200_ROADMAP_REMAINS\", 22)\n    emit(\"NEWFI200_END\")\n    raise SystemExit(1)\n\nCANDIDATE_LAYER_4_TEXT_END\nCANDIDATE_LAYER_5_SOURCE=file:newfi-55-portal200-apply3-rca.cmd::b64::zlib\nCANDIDATE_LAYER_5_SHA256=8911318cd314572edf9c6343c09b4c83d283e946dd2398ea2e05722ac9bd44ac\nCANDIDATE_LAYER_5_BYTES=10641\nCANDIDATE_LAYER_5_TEXT_BEGIN\nimport hashlib\nimport json\nimport pathlib\nimport shlex\nimport subprocess\n\nCID = \"NEWFI-260907-PORTAL200-APPLY3RCA1\"\nFAILED_CID = \"NEWFI-260907-PORTAL200-APPLY3\"\nWT = pathlib.Path(\"/root/newfi-portal/.worktrees/implementation-newfi-closed-mvp-20260906\")\nBRANCH = \"implementation/newfi-closed-mvp-20260906\"\nOLD_HEAD = \"06bab5acd124e768f70305b3d7eca2f595871890\"\nFAILED_DIR = pathlib.Path(\"/root/newfi-run-\" + FAILED_CID)\nWRAPPER = FAILED_DIR / \"wrapper.log\"\n\nOLD = {\n    \"controller\": \"53909e753ea5a011550fd280ad1c342a74ca9949be092dfbd95244243cae92f3\",\n    \"templates_xml\": \"c29c04f8b937284e821c87957653e87c2f6ac014fac30648a0f6b18e84392adf\",\n}\nNEW = {\n    \"controller\": \"619d489f7cc3b461479c702fa8825097ae22d3c6cfeb911e9f14ea1de9c36d6d\",\n    \"service\": \"4da03f26294ab6d163a1a746dee4bb6a82d7d4f39e66b24246bc0eb4c455dd1d\",\n    \"templates_xml\": \"1650c3d868d4bc47703f1b75f1f179cd25309b2d3b20a2b848e81a4423c00861\",\n}\n\nINSPECT = '<?php\\n$root=\\'/var/www/forums/newfi/public\\';\\nrequire $root.\\'/src/XF.php\\';\\n\\\\XF::start($root);\\n$app=\\\\XF::setupApp(\\'XF\\\\\\\\Pub\\\\\\\\App\\');\\n$db=$app->db();\\n\\nfunction meta($p) {\\n    if (!is_file($p)) { return null; }\\n    return [\\'bytes\\'=>filesize($p),\\'sha256\\'=>hash_file(\\'sha256\\',$p)];\\n}\\n\\n$portal=$root.\\'/src/addons/Newfi/Portal\\';\\n$baseline=(gethostname()===\\'newfi-staging\\') ? 40 : 0;\\n\\n$templates=$db->fetchAll(\\n    \"SELECT title,style_id,LENGTH(template) AS bytes,SHA2(template,256) AS sha256,\" .\\n    \" LOCATE(\\'data-newfi-portal200\\',template)>0 AS html_marker,\" .\\n    \" LOCATE(\\'--newfi-portal200\\',template)>0 AS css_marker\" .\\n    \" FROM xf_template WHERE addon_id=\\'Newfi/Portal\\' ORDER BY style_id,title\"\\n);\\n\\n$errors=$db->fetchAll(\\n    \"SELECT error_id,exception_type,message,filename,line\" .\\n    \" FROM xf_error_log WHERE error_id>? ORDER BY error_id LIMIT 30\",\\n    [$baseline]\\n);\\n\\n$result=[\\n    \\'hostname\\'=>gethostname(),\\n    \\'application\\'=>[\\n        \\'boardActive\\'=>(string)$db->fetchOne(\"SELECT option_value FROM xf_option WHERE option_id=\\'boardActive\\'\"),\\n        \\'boardUrl\\'=>(string)$db->fetchOne(\"SELECT option_value FROM xf_option WHERE option_id=\\'boardUrl\\'\"),\\n        \\'indexRoute\\'=>(string)$db->fetchOne(\"SELECT option_value FROM xf_option WHERE option_id=\\'indexRoute\\'\"),\\n        \\'error_count\\'=>(int)$db->fetchOne(\"SELECT COUNT(*) FROM xf_error_log\"),\\n        \\'error_max_id\\'=>(int)$db->fetchOne(\"SELECT COALESCE(MAX(error_id),0) FROM xf_error_log\")\\n    ],\\n    \\'source\\'=>[\\n        \\'controller\\'=>meta($portal.\\'/Pub/Controller/Portal.php\\'),\\n        \\'service\\'=>meta($portal.\\'/Service/PortalData.php\\'),\\n        \\'templates_xml\\'=>meta($portal.\\'/_data/templates.xml\\')\\n    ],\\n    \\'templates\\'=>$templates,\\n    \\'new_errors\\'=>$errors\\n];\\n\\necho \"PORTAL200_RCA_GUEST_JSON=\" .\\n    json_encode($result,JSON_UNESCAPED_UNICODE|JSON_UNESCAPED_SLASHES|JSON_INVALID_UTF8_SUBSTITUTE) .\\n    \"\\\\n\";\\n?>'\n\ndef emit(k, v=None):\n    if v is None:\n        print(k, flush=True)\n    elif isinstance(v, (dict, list, bool, int, float)):\n        print(k + \"=\" + json.dumps(v, ensure_ascii=False, sort_keys=True, separators=(\",\", \":\")), flush=True)\n    else:\n        print(k + \"=\" + str(v), flush=True)\n\ndef run(cmd, *, input_bytes=None, timeout=120):\n    return subprocess.run(\n        cmd, input=input_bytes, stdout=subprocess.PIPE, stderr=subprocess.PIPE,\n        timeout=timeout, check=False\n    )\n\ndef git(*args):\n    p = run([\"/usr/bin/git\", \"-C\", str(WT), *args], timeout=90)\n    return p.returncode, p.stdout.decode(\"utf-8\", \"replace\").strip(), p.stderr.decode(\"utf-8\", \"replace\").strip()\n\ndef qga(target, php_source):\n    if target == \"prod\":\n        cmd = [\n            \"/usr/sbin/qm\", \"guest\", \"exec\", \"210\",\n            \"--synchronous\", \"1\", \"--timeout\", \"120\",\n            \"--pass-stdin\", \"1\", \"--\", \"/usr/bin/php8.3\"\n        ]\n    else:\n        q = [\n            \"/usr/sbin/qm\", \"guest\", \"exec\", \"211\",\n            \"--synchronous\", \"1\", \"--timeout\", \"120\",\n            \"--pass-stdin\", \"1\", \"--\", \"/usr/bin/php8.3\"\n        ]\n        remote = (\n            \"test \\\"$(id -u):$(hostname -s)\\\" = 0:pve03 || exit 72; \"\n            \"for f in /etc/pve/HOMELAB_ASSISTANT_ERROR_REGISTER.md /etc/pve/31_HOMELAB_REFERENCE.md; do \"\n            \"test -r \\\"$f\\\" && test -s \\\"$f\\\" && cat -- \\\"$f\\\" >/dev/null || exit 73; done; exec \"\n            + \" \".join(shlex.quote(x) for x in q)\n        )\n        cmd = [\n            \"/usr/bin/ssh\", \"-T\",\n            \"-o\", \"BatchMode=yes\",\n            \"-o\", \"StrictHostKeyChecking=yes\",\n            \"-o\", \"UpdateHostKeys=no\",\n            \"-o\", \"ConnectTimeout=10\",\n            \"-o\", \"ConnectionAttempts=1\",\n            \"root@pve03\", remote\n        ]\n    p = run(cmd, input_bytes=php_source.encode(\"utf-8\"), timeout=150)\n    if p.returncode != 0:\n        return {\"transport_rc\": p.returncode, \"transport_error\": p.stderr.decode(\"utf-8\", \"replace\")[:500]}\n    try:\n        outer = json.loads(p.stdout.decode(\"utf-8\", \"replace\"))\n    except Exception:\n        return {\"transport_rc\": 0, \"outer_json\": False, \"raw\": p.stdout.decode(\"utf-8\", \"replace\")[:1000]}\n    if outer.get(\"exitcode\") != 0:\n        return {\n            \"transport_rc\": 0,\n            \"guest_rc\": outer.get(\"exitcode\"),\n            \"guest_out\": outer.get(\"out-data\", \"\")[:1000],\n            \"guest_err\": outer.get(\"err-data\", \"\")[:1000],\n        }\n    out = outer.get(\"out-data\", \"\")\n    marker = \"PORTAL200_RCA_GUEST_JSON=\"\n    line = next((x for x in out.splitlines() if x.startswith(marker)), None)\n    if not line:\n        return {\"transport_rc\": 0, \"guest_rc\": 0, \"marker\": False, \"guest_out\": out[:1000]}\n    return json.loads(line[len(marker):])\n\ndef source_state(data):\n    src = data.get(\"source\", {})\n    controller = (src.get(\"controller\") or {}).get(\"sha256\")\n    service = src.get(\"service\")\n    templates = (src.get(\"templates_xml\") or {}).get(\"sha256\")\n    if controller == OLD[\"controller\"] and service is None and templates == OLD[\"templates_xml\"]:\n        return \"OLD\"\n    if (\n        controller == NEW[\"controller\"]\n        and (service or {}).get(\"sha256\") == NEW[\"service\"]\n        and templates == NEW[\"templates_xml\"]\n    ):\n        return \"NEW\"\n    return \"DRIFT\"\n\ndef template_state(data):\n    rows = data.get(\"templates\", [])\n    titles = [r.get(\"title\") for r in rows]\n    has_html = any(bool(r.get(\"html_marker\")) for r in rows)\n    has_css = any(bool(r.get(\"css_marker\")) for r in rows)\n    if titles == [\"newfi_portal\"] and not has_html and not has_css:\n        return \"OLD\"\n    if titles == [\"newfi_portal\", \"newfi_portal.less\"] and has_html and has_css:\n        return \"NEW\"\n    return \"DRIFT\"\n\nemit(\"NEWFI55_BEGIN\")\nemit(\"COMMAND_ID\", CID)\nemit(\"RCA_TARGET_FAILED_COMMAND\", FAILED_CID)\nemit(\"PORTAL200_ROADMAP_REMAINS\", 22)\nemit(\"RCA_MUTATION_SCOPE\", \"NONE_READ_ONLY\")\n\nif WRAPPER.is_file() and not WRAPPER.is_symlink():\n    raw = WRAPPER.read_bytes()\n    emit(\"RCA_WRAPPER_BYTES\", len(raw))\n    emit(\"RCA_WRAPPER_SHA256\", hashlib.sha256(raw).hexdigest())\n    text = raw.decode(\"utf-8\", \"replace\")\n    keep_prefixes = (\n        \"CHAT_OUTPUT_BEGIN\", \"CHAT_OUTPUT_END\", \"COMMAND_ID=\", \"STATUS=\", \"RC=\",\n        \"RESULT_CONTRACT_\", \"COMMAND_RC=\", \"CHANGES_MADE=\", \"ROLLBACK_\",\n        \"MUTATION_OUTCOME=\", \"OUTPUT_BEGIN\", \"OUTPUT_END\", \"NEWFI200\",\n        \"PORTAL200_\", \"HOMELAB_RESULT_CONTRACT=\", \"STOP=\", \"Traceback\",\n    )\n    selected = [line for line in text.splitlines() if line.startswith(keep_prefixes)]\n    emit(\"RCA_WRAPPER_SELECTED_LINE_COUNT\", len(selected))\n    print(\"RCA_WRAPPER_SELECTED_BEGIN\", flush=True)\n    for line in selected[-250:]:\n        print(line, flush=True)\n    print(\"RCA_WRAPPER_SELECTED_END\", flush=True)\nelse:\n    emit(\"RCA_WRAPPER_MISSING\", True)\n\n_, branch, _ = git(\"branch\", \"--show-current\")\n_, head, _ = git(\"rev-parse\", \"HEAD\")\n_, remote_out, _ = git(\"ls-remote\", \"origin\", f\"refs/heads/{BRANCH}\")\n_, status, _ = git(\"status\", \"--porcelain=v1\", \"--untracked-files=all\")\nremote = remote_out.split()[0] if remote_out else \"\"\n\ngit_state = {\n    \"branch\": branch,\n    \"head\": head,\n    \"remote\": remote,\n    \"clean\": (status == \"\"),\n    \"status_lines\": status.splitlines()[:20],\n}\nemit(\"RCA_GIT_STATE\", git_state)\n\nstaging = qga(\"staging\", INSPECT)\nprod = qga(\"prod\", INSPECT)\n\nemit(\"RCA_STAGING_STATE\", staging)\nemit(\"RCA_PROD_STATE\", prod)\n\ns_src = source_state(staging) if isinstance(staging, dict) else \"UNKNOWN\"\np_src = source_state(prod) if isinstance(prod, dict) else \"UNKNOWN\"\ns_tpl = template_state(staging) if isinstance(staging, dict) else \"UNKNOWN\"\np_tpl = template_state(prod) if isinstance(prod, dict) else \"UNKNOWN\"\n\nsummary = {\n    \"git_old_head\": head == OLD_HEAD and remote == OLD_HEAD,\n    \"git_clean\": status == \"\",\n    \"staging_source\": s_src,\n    \"staging_templates\": s_tpl,\n    \"staging_error_max\": staging.get(\"application\", {}).get(\"error_max_id\") if isinstance(staging, dict) else None,\n    \"prod_source\": p_src,\n    \"prod_templates\": p_tpl,\n    \"prod_error_max\": prod.get(\"application\", {}).get(\"error_max_id\") if isinstance(prod, dict) else None,\n}\nsummary[\"clean_old_prestate\"] = bool(\n    summary[\"git_old_head\"]\n    and summary[\"git_clean\"]\n    and s_src == \"OLD\"\n    and s_tpl == \"OLD\"\n    and p_src == \"OLD\"\n    and p_tpl == \"OLD\"\n)\nemit(\"RCA_STATE_SUMMARY\", summary)\n\nrunner_path = pathlib.Path(\"/usr/local/sbin/homelab-chat-run\")\nif runner_path.is_file() and not runner_path.is_symlink():\n    runner_bytes = runner_path.read_bytes()\n    runner_text = runner_bytes.decode(\"utf-8\", \"replace\")\n    emit(\"RCA_RUNNER_SHA256\", hashlib.sha256(runner_bytes).hexdigest())\n    emit(\"RCA_RUNNER_BYTES\", len(runner_bytes))\n    lines = runner_text.splitlines()\n    terms = (\n        \"HOMELAB_RESULT_CONTRACT\",\n        \"rollback_restored\",\n        \"rollback_started\",\n        \"changes_made\",\n        \"status not in\",\n        \"ValueError\",\n    )\n    indexes = set()\n    for i, line in enumerate(lines):\n        if any(t in line for t in terms):\n            for j in range(max(0, i - 3), min(len(lines), i + 4)):\n                indexes.add(j)\n    print(\"RCA_RUNNER_CONTRACT_SOURCE_BEGIN\", flush=True)\n    for j in sorted(indexes):\n        line = lines[j]\n        if len(line) > 500:\n            line = line[:500] + \"...[TRUNCATED]\"\n        print(json.dumps({\"line\": j + 1, \"text\": line}, ensure_ascii=False, separators=(\",\", \":\")), flush=True)\n    print(\"RCA_RUNNER_CONTRACT_SOURCE_END\", flush=True)\nelse:\n    emit(\"RCA_RUNNER_SOURCE_MISSING\", True)\n\nemit(\"HOMELAB_RESULT_CONTRACT\", {\n    \"version\": 1,\n    \"command_id\": CID,\n    \"status\": \"OK\",\n    \"changes_made\": False,\n    \"rollback_started\": False,\n    \"rollback_restored\": None\n})\nemit(\"NEWFI55_END\")\n\nCANDIDATE_LAYER_5_TEXT_END\nCANDIDATE_LAYER_6_SOURCE=file:newfi-39-portal200-rca1.cmd::b64::zlib\nCANDIDATE_LAYER_6_SHA256=08edd716820df9797dc01cbee765750d9924fc4f94855fde4aba2c25eacb76f2\nCANDIDATE_LAYER_6_BYTES=9466\nCANDIDATE_LAYER_6_TEXT_BEGIN\nimport hashlib\nimport json\nimport pathlib\nimport shlex\nimport subprocess\n\nCID = \"NEWFI-260907-PORTAL200-RCA1\"\nFAILED_CID = \"NEWFI-260907-PORTAL200-APPLY1\"\nWT = pathlib.Path(\"/root/newfi-portal/.worktrees/implementation-newfi-closed-mvp-20260906\")\nBRANCH = \"implementation/newfi-closed-mvp-20260906\"\nOLD_HEAD = \"06bab5acd124e768f70305b3d7eca2f595871890\"\nFAILED_DIR = pathlib.Path(\"/root/newfi-run-\" + FAILED_CID)\nWRAPPER = FAILED_DIR / \"wrapper.log\"\n\nOLD = {\n    \"controller\": \"53909e753ea5a011550fd280ad1c342a74ca9949be092dfbd95244243cae92f3\",\n    \"templates_xml\": \"c29c04f8b937284e821c87957653e87c2f6ac014fac30648a0f6b18e84392adf\",\n}\nNEW = {\n    \"controller\": \"619d489f7cc3b461479c702fa8825097ae22d3c6cfeb911e9f14ea1de9c36d6d\",\n    \"service\": \"4da03f26294ab6d163a1a746dee4bb6a82d7d4f39e66b24246bc0eb4c455dd1d\",\n    \"templates_xml\": \"1650c3d868d4bc47703f1b75f1f179cd25309b2d3b20a2b848e81a4423c00861\",\n}\n\nINSPECT = '<?php\\n$root=\\'/var/www/forums/newfi/public\\';\\nrequire $root.\\'/src/XF.php\\';\\n\\\\XF::start($root);\\n$app=\\\\XF::setupApp(\\'XF\\\\\\\\Pub\\\\\\\\App\\');\\n$db=$app->db();\\n\\nfunction meta($p) {\\n    if (!is_file($p)) { return null; }\\n    return [\\'bytes\\'=>filesize($p),\\'sha256\\'=>hash_file(\\'sha256\\',$p)];\\n}\\n\\n$portal=$root.\\'/src/addons/Newfi/Portal\\';\\n$baseline=(gethostname()===\\'newfi-staging\\') ? 40 : 0;\\n\\n$templates=$db->fetchAll(\\n    \"SELECT title,style_id,LENGTH(template) AS bytes,SHA2(template,256) AS sha256,\" .\\n    \" LOCATE(\\'data-newfi-portal200\\',template)>0 AS html_marker,\" .\\n    \" LOCATE(\\'--newfi-portal200\\',template)>0 AS css_marker\" .\\n    \" FROM xf_template WHERE addon_id=\\'Newfi/Portal\\' ORDER BY style_id,title\"\\n);\\n\\n$errors=$db->fetchAll(\\n    \"SELECT error_id,exception_type,message,filename,line\" .\\n    \" FROM xf_error_log WHERE error_id>? ORDER BY error_id LIMIT 30\",\\n    [$baseline]\\n);\\n\\n$result=[\\n    \\'hostname\\'=>gethostname(),\\n    \\'application\\'=>[\\n        \\'boardActive\\'=>(string)$db->fetchOne(\"SELECT option_value FROM xf_option WHERE option_id=\\'boardActive\\'\"),\\n        \\'boardUrl\\'=>(string)$db->fetchOne(\"SELECT option_value FROM xf_option WHERE option_id=\\'boardUrl\\'\"),\\n        \\'indexRoute\\'=>(string)$db->fetchOne(\"SELECT option_value FROM xf_option WHERE option_id=\\'indexRoute\\'\"),\\n        \\'error_count\\'=>(int)$db->fetchOne(\"SELECT COUNT(*) FROM xf_error_log\"),\\n        \\'error_max_id\\'=>(int)$db->fetchOne(\"SELECT COALESCE(MAX(error_id),0) FROM xf_error_log\")\\n    ],\\n    \\'source\\'=>[\\n        \\'controller\\'=>meta($portal.\\'/Pub/Controller/Portal.php\\'),\\n        \\'service\\'=>meta($portal.\\'/Service/PortalData.php\\'),\\n        \\'templates_xml\\'=>meta($portal.\\'/_data/templates.xml\\')\\n    ],\\n    \\'templates\\'=>$templates,\\n    \\'new_errors\\'=>$errors\\n];\\n\\necho \"PORTAL200_RCA_GUEST_JSON=\" .\\n    json_encode($result,JSON_UNESCAPED_UNICODE|JSON_UNESCAPED_SLASHES|JSON_INVALID_UTF8_SUBSTITUTE) .\\n    \"\\\\n\";\\n?>'\n\ndef emit(k, v=None):\n    if v is None:\n        print(k, flush=True)\n    elif isinstance(v, (dict, list, bool, int, float)):\n        print(k + \"=\" + json.dumps(v, ensure_ascii=False, sort_keys=True, separators=(\",\", \":\")), flush=True)\n    else:\n        print(k + \"=\" + str(v), flush=True)\n\ndef run(cmd, *, input_bytes=None, timeout=120):\n    return subprocess.run(\n        cmd, input=input_bytes, stdout=subprocess.PIPE, stderr=subprocess.PIPE,\n        timeout=timeout, check=False\n    )\n\ndef git(*args):\n    p = run([\"/usr/bin/git\", \"-C\", str(WT), *args], timeout=90)\n    return p.returncode, p.stdout.decode(\"utf-8\", \"replace\").strip(), p.stderr.decode(\"utf-8\", \"replace\").strip()\n\ndef qga(target, php_source):\n    if target == \"prod\":\n        cmd = [\n            \"/usr/sbin/qm\", \"guest\", \"exec\", \"210\",\n            \"--synchronous\", \"1\", \"--timeout\", \"120\",\n            \"--pass-stdin\", \"1\", \"--\", \"/usr/bin/php8.3\"\n        ]\n    else:\n        q = [\n            \"/usr/sbin/qm\", \"guest\", \"exec\", \"211\",\n            \"--synchronous\", \"1\", \"--timeout\", \"120\",\n            \"--pass-stdin\", \"1\", \"--\", \"/usr/bin/php8.3\"\n        ]\n        remote = (\n            \"test \\\"$(id -u):$(hostname -s)\\\" = 0:pve03 || exit 72; \"\n            \"for f in /etc/pve/HOMELAB_ASSISTANT_ERROR_REGISTER.md /etc/pve/31_HOMELAB_REFERENCE.md; do \"\n            \"test -r \\\"$f\\\" && test -s \\\"$f\\\" && cat -- \\\"$f\\\" >/dev/null || exit 73; done; exec \"\n            + \" \".join(shlex.quote(x) for x in q)\n        )\n        cmd = [\n            \"/usr/bin/ssh\", \"-T\",\n            \"-o\", \"BatchMode=yes\",\n            \"-o\", \"StrictHostKeyChecking=yes\",\n            \"-o\", \"UpdateHostKeys=no\",\n            \"-o\", \"ConnectTimeout=10\",\n            \"-o\", \"ConnectionAttempts=1\",\n            \"root@pve03\", remote\n        ]\n    p = run(cmd, input_bytes=php_source.encode(\"utf-8\"), timeout=150)\n    if p.returncode != 0:\n        return {\"transport_rc\": p.returncode, \"transport_error\": p.stderr.decode(\"utf-8\", \"replace\")[:500]}\n    try:\n        outer = json.loads(p.stdout.decode(\"utf-8\", \"replace\"))\n    except Exception:\n        return {\"transport_rc\": 0, \"outer_json\": False, \"raw\": p.stdout.decode(\"utf-8\", \"replace\")[:1000]}\n    if outer.get(\"exitcode\") != 0:\n        return {\n            \"transport_rc\": 0,\n            \"guest_rc\": outer.get(\"exitcode\"),\n            \"guest_out\": outer.get(\"out-data\", \"\")[:1000],\n            \"guest_err\": outer.get(\"err-data\", \"\")[:1000],\n        }\n    out = outer.get(\"out-data\", \"\")\n    marker = \"PORTAL200_RCA_GUEST_JSON=\"\n    line = next((x for x in out.splitlines() if x.startswith(marker)), None)\n    if not line:\n        return {\"transport_rc\": 0, \"guest_rc\": 0, \"marker\": False, \"guest_out\": out[:1000]}\n    return json.loads(line[len(marker):])\n\ndef source_state(data):\n    src = data.get(\"source\", {})\n    controller = (src.get(\"controller\") or {}).get(\"sha256\")\n    service = src.get(\"service\")\n    templates = (src.get(\"templates_xml\") or {}).get(\"sha256\")\n    if controller == OLD[\"controller\"] and service is None and templates == OLD[\"templates_xml\"]:\n        return \"OLD\"\n    if (\n        controller == NEW[\"controller\"]\n        and (service or {}).get(\"sha256\") == NEW[\"service\"]\n        and templates == NEW[\"templates_xml\"]\n    ):\n        return \"NEW\"\n    return \"DRIFT\"\n\ndef template_state(data):\n    rows = data.get(\"templates\", [])\n    titles = [r.get(\"title\") for r in rows]\n    has_html = any(bool(r.get(\"html_marker\")) for r in rows)\n    has_css = any(bool(r.get(\"css_marker\")) for r in rows)\n    if titles == [\"newfi_portal\"] and not has_html and not has_css:\n        return \"OLD\"\n    if titles == [\"newfi_portal\", \"newfi_portal.less\"] and has_html and has_css:\n        return \"NEW\"\n    return \"DRIFT\"\n\nemit(\"NEWFI39_BEGIN\")\nemit(\"COMMAND_ID\", CID)\nemit(\"RCA_TARGET_FAILED_COMMAND\", FAILED_CID)\nemit(\"PORTAL200_ROADMAP_REMAINS\", 22)\nemit(\"RCA_MUTATION_SCOPE\", \"NONE_READ_ONLY\")\n\nif WRAPPER.is_file() and not WRAPPER.is_symlink():\n    raw = WRAPPER.read_bytes()\n    emit(\"RCA_WRAPPER_BYTES\", len(raw))\n    emit(\"RCA_WRAPPER_SHA256\", hashlib.sha256(raw).hexdigest())\n    text = raw.decode(\"utf-8\", \"replace\")\n    keep_prefixes = (\n        \"CHAT_OUTPUT_BEGIN\", \"CHAT_OUTPUT_END\", \"COMMAND_ID=\", \"STATUS=\", \"RC=\",\n        \"RESULT_CONTRACT_\", \"COMMAND_RC=\", \"CHANGES_MADE=\", \"ROLLBACK_\",\n        \"MUTATION_OUTCOME=\", \"OUTPUT_BEGIN\", \"OUTPUT_END\", \"NEWFI200\",\n        \"PORTAL200_\", \"HOMELAB_RESULT_CONTRACT=\", \"STOP=\", \"Traceback\",\n    )\n    selected = [line for line in text.splitlines() if line.startswith(keep_prefixes)]\n    emit(\"RCA_WRAPPER_SELECTED_LINE_COUNT\", len(selected))\n    print(\"RCA_WRAPPER_SELECTED_BEGIN\", flush=True)\n    for line in selected[-250:]:\n        print(line, flush=True)\n    print(\"RCA_WRAPPER_SELECTED_END\", flush=True)\nelse:\n    emit(\"RCA_WRAPPER_MISSING\", True)\n\n_, branch, _ = git(\"branch\", \"--show-current\")\n_, head, _ = git(\"rev-parse\", \"HEAD\")\n_, remote_out, _ = git(\"ls-remote\", \"origin\", f\"refs/heads/{BRANCH}\")\n_, status, _ = git(\"status\", \"--porcelain=v1\", \"--untracked-files=all\")\nremote = remote_out.split()[0] if remote_out else \"\"\n\ngit_state = {\n    \"branch\": branch,\n    \"head\": head,\n    \"remote\": remote,\n    \"clean\": (status == \"\"),\n    \"status_lines\": status.splitlines()[:20],\n}\nemit(\"RCA_GIT_STATE\", git_state)\n\nstaging = qga(\"staging\", INSPECT)\nprod = qga(\"prod\", INSPECT)\n\nemit(\"RCA_STAGING_STATE\", staging)\nemit(\"RCA_PROD_STATE\", prod)\n\ns_src = source_state(staging) if isinstance(staging, dict) else \"UNKNOWN\"\np_src = source_state(prod) if isinstance(prod, dict) else \"UNKNOWN\"\ns_tpl = template_state(staging) if isinstance(staging, dict) else \"UNKNOWN\"\np_tpl = template_state(prod) if isinstance(prod, dict) else \"UNKNOWN\"\n\nsummary = {\n    \"git_old_head\": head == OLD_HEAD and remote == OLD_HEAD,\n    \"git_clean\": status == \"\",\n    \"staging_source\": s_src,\n    \"staging_templates\": s_tpl,\n    \"staging_error_max\": staging.get(\"application\", {}).get(\"error_max_id\") if isinstance(staging, dict) else None,\n    \"prod_source\": p_src,\n    \"prod_templates\": p_tpl,\n    \"prod_error_max\": prod.get(\"application\", {}).get(\"error_max_id\") if isinstance(prod, dict) else None,\n}\nsummary[\"clean_old_prestate\"] = bool(\n    summary[\"git_old_head\"]\n    and summary[\"git_clean\"]\n    and s_src == \"OLD\"\n    and s_tpl == \"OLD\"\n    and p_src == \"OLD\"\n    and p_tpl == \"OLD\"\n)\nemit(\"RCA_STATE_SUMMARY\", summary)\n\nemit(\"HOMELAB_RESULT_CONTRACT\", {\n    \"version\": 1,\n    \"command_id\": CID,\n    \"status\": \"OK\",\n    \"changes_made\": False,\n    \"rollback_started\": False,\n    \"rollback_restored\": None\n})\nemit(\"NEWFI39_END\")\n\nCANDIDATE_LAYER_6_TEXT_END\nRECOVERED_VERSION_IDS=\nRECOVERED_VERSION_STRINGS==\nRECOVERED_SHA256_COUNT=11\nRECOVERED_SHA256=458c2cf0763e4790f7d2d3757efd883b25813a31aab4e8dce6f785b8dea48a6e,834973af57263b326ca6aee52b2ecb3fa2cf0fb486e5a77a62d4210395b8d9c3,28e855ff56c4844768f0e8606fe0edc2acb3f548a5c06fa15c0d80ae00e2bc1b,fc9fb1dbdb6141bfb43a8122dcf3db435a94da48d0a0c02fe9dfae019b1439c5,2f7977cbfaed7953bd70033c0cf92138eedf974f5886fadf4b4971f2d00a4143,b248a4c32c9cc64e5747e7dce6c7fc0a23f5124a77c71ce72e27a81aceae9d2d,619d489f7cc3b461479c702fa8825097ae22d3c6cfeb911e9f14ea1de9c36d6d,4da03f26294ab6d163a1a746dee4bb6a82d7d4f39e66b24246bc0eb4c455dd1d,1650c3d868d4bc47703f1b75f1f179cd25309b2d3b20a2b848e81a4423c00861,53909e753ea5a011550fd280ad1c342a74ca9949be092dfbd95244243cae92f3,c29c04f8b937284e821c87957653e87c2f6ac014fac30648a0f6b18e84392adf\nRECOVERY_RESULT=STRONG_APPLY3_CANDIDATE_EVIDENCE_FOUND\nLOCAL_APPLY3_CARRIER_RECOVERY5_END=true\n"
 }
diff --git a/runtime/latest.txt b/runtime/latest.txt
index 26d8db80..b49cfa0e 100644
--- a/runtime/latest.txt
+++ b/runtime/latest.txt
@@ -1,22 +1,22 @@
 CHAT_OUTPUT_BEGIN
-COMMAND_ID=NEWFI-260907-A-PORTAL200-APPLY4DESIGN4
-STATUS=FAIL
-RC=1
+COMMAND_ID=NEWFI-260907-A-PORTAL200-APPLY4DESIGN5
+STATUS=OK
+RC=0
 HOST=pve01
 MODE=read-only
-COMPONENT=newfi-portal200-apply4-local-carrier-recovery
+COMPONENT=newfi-portal200-apply4-local-carrier-recovery5
 REFERENCE_REGISTER_CHECK=OK
 REFERENCE_SHA256=5a3d8e5154c41cb582a4e0aca68090be1f0138918bf82131a948df326f9d8d66
 ERROR_REGISTER_CHECK=OK
 ERROR_REGISTER_SHA256=3b09a553ec0f527ed3afeed4753f52a74ee3036045bbfb3c685e9f8af4ba7ba0
-COMMAND_SHA256=8127ffc23bc78ed0a33fe11a82208105c1c291f72bb883df6b03ca818f466970
+COMMAND_SHA256=d8972287e5a04bda3fc17acba988b2651b92ce4193aa3038f19cf27372093f65
 DUPLICATE_FAILED_COMMAND_BLOCKED=false
 EXECUTION_STARTED=true
 CHANGE_DECLARED=false
 RESULT_CONTRACT_VALID=true
 RESULT_CONTRACT_STATUS=NOT_APPLICABLE
 RESULT_CONTRACT_ERROR=NONE
-COMMAND_RC=1
+COMMAND_RC=0
 CHANGES_MADE=false
 ROLLBACK_STARTED=false
 ROLLBACK_RESTORED=null
@@ -24,13 +24,5729 @@ MUTATION_OUTCOME=NO_MUTATION
 SANITIZED=yes
 SECRETS_INCLUDED=no
 PRIVATE_ADDRESSES_INCLUDED=no
-RAW_EVIDENCE_SHA256=026f31fe2496a8273dc8c81e554b12273f6afbdf7d70c66dc718f0fa3bf4e8f7
-SANITIZED_OUTPUT_SHA256=026f31fe2496a8273dc8c81e554b12273f6afbdf7d70c66dc718f0fa3bf4e8f7
+RAW_EVIDENCE_SHA256=58a32ed77e16ff3fbab7bcfac43e592c6e2daf2a7cf6208e7a229a258b6e3a3f
+SANITIZED_OUTPUT_SHA256=58a32ed77e16ff3fbab7bcfac43e592c6e2daf2a7cf6208e7a229a258b6e3a3f
 OUTPUT_BEGIN
-  File "<string>", line 1
-    import base64,zlib,hashlib; b=zlib.decompress(base64.b64decode(""5L17cxvXnSD6f1flO3RwPUsyJt4gQEKGsiAJSohJggOAllWSLqoBNEhEIACjAUmMx7dsZzzJ3MzGjie543HWnjiZvamt2dmRbSmWLVmu2k9AfoX9JPf3OOf0Od0NinKk8VRdp2IT3afP83d+78d2baO83Srv7W1fzbY2yvV6tVJv1SsbtVcq9aut9cql6m5pOpm537M2ajs75d3NVnWztFu5slWNZ/KptVQhXo7v1erN8nYmlYpTP7nNSqN6aTf3PWtnv1luVmu7rcZGba9S2q3tVqDv8martrt99XvWNo0tGzVae5X6Vq2+U4EBat+zmuX6pUqzVdvebM0bOjBwVnVZbm5chq/2d5ultPlwvdyo7JZ3Ko2S+bxxuZxZycPDTVj7ZmWztV2+Cjsh+oC1VHeblXql0azuXjLe5WFnYG7VzXKzIl6kW43afn2jUur1B26RZpyY3plGNuRhV/Nr3Xyv28t0c04nk8l015x2rr2azeTgbTZfyPcyqbSbd9qZdHs1l82nek4h2+sUemvtXiG9thLV9frVJqxypZDNZaNeNyuvNvl8v2dZJ/908vHJb08+OvmXk3+04cd7J7+D//8W/vcb+P//EC8uQye1ra2iTUuyk7baf+vk1yd3T98+uWufvnXy6cnj0zdPvjp5ULQzqUw+nlqLpwoW9HH35IuTr6Hdz07uw38fnNwv2uI3fHv6dzZ8dZe+fvv0p9AR/fwC/jz5zD65d/LZ6U9P37G5Mfz/HRua3j/5wj755uQxvHybRv0a/v785DF8Aj/fgv9BU3r42clDHvX0XRvm9vjka3h1/+QrbpKwrNKz/cdKJeyTD2EbPzj5Pfz/j7CRn8Dvj09+Y9Pe/gPs2G9ofz+C17/BTf8dvoU2v4f/vv/M5wNnDPvzALbh8cmfaCu+Pv3FyZf2oTPsjno9W20hb6DcZxuPA3cQDvYBHMxbtH/2y3ANaltXatsv2xuNPdg+/0HRitvOwcR1u7bn9Fx8b3tT58Dlk3rIneGBn/7SBoi4C4fw5ukvTt++AB96h84EPuyMZsOpO7FLdgqf9vpDZ2A7nY47nuLbQ7dzczzqD6fQ4OXaFR8TbVV3y9tp/ARWiMsYT0bdWWcahwlMYQIf4U5/c3IflnlfW9TfIYjxPYV9+gCASlsfgN5DWDTDvPr4AXxKyzn9O4TR01+KvcFNpIdfIRR+Q/v5mRoQt/y+PRq7E2faH+GiJrOB6+GWIZKNj52JMxi48Nh1uvHRcHBsd/sTtzO125N+98CllT2GGT04+dq+PenjHon5wb9+efIp7CNcjAewrY9oQL5oX+J3e3AEDmxZ/KK9N+gPb+If41tuKg1DO0NvPJpMsZkzmx6OoOdj3mYPnx2OjtyB0453Dp1pfDIbwvkM4aPOlN72j45mU6c9cO1LMCGH5t52Ojfx3WzYf20GMKAQOB2n0x/EO4ORB2fZnfR7UwJCmNMBvu26HuxFZ9q/RR0Cmpk4t+3GX27bOAxuG57qYb/dx78ThLwIrAictYNTkP2NCfg27Qn8iYgAoM8G4lEB9PiqXX4OeCANeOA9utUfnLzvY1h12Z/TRX9MyO3togRrmAP8hHV/JjYKYBav+FsEsF8V7T04f2cAuBx39BP4+kt+Ly8N9XmPdvpPsGv3Tx7ZL8OJ1XpXRoObAHKi3ReEbx8A+FEbuhPb/eHsDnb7e5rUT0//Fjp+10f3P6OfYohPCVHD50WLntw/uQfzvae+AhgcHrhxwuGPaLB7gKXU7G3mBPCM79un7yLeh3/fF7czAoUkCH7gNj9EgICvTn+FuPAXClndxw3TLmR9o5zs9r3O6JY7ObZPfw5z+PzkwXOAnEzCLu83L9fqVWSQXqnYl6rNStmuA9dR3ak8e7ipA87tH7mw1PGoaMk773SP+sOk/DWetQf9Thzvv3tnalnrgDo6h0XL8bw+4NghoQfsxbLKApE4dJPdO4AuFGooWqJZ8hA+G02Oky/5KOIiMksWMgz3JcnALSYegekPMA32gTt0J/2OPQDE7k0lM0A07GeKDfA7RfD7EHEkcR+fER4WHABCFjAjAsP7kAFo2Sov2WdynJbVgMPZb5S2ytVtq75RKuSty7VGs0SY1doBVrLEEIv88x4wwMAyDt3bvX58LEE23nXHg9ExThARFd5SXkLRAoZzf7sJnOZus17eaLZeKW8DD9xzBp4beicmsr/78m7tym7odaVer9VL1V3qQj0uvuIMZm5lMhlNFIMPq0hbG8DsXao0gDuGFcyGN4ej20OrXtveXi9vvIxj1ZvAp4deIIdcq8Ob4Www8Pn/2n4Teq+oySGGeUhXG/HPZ8QLWvLmfiSYzn84+TfkAn9GW8IcIqIWxFxvER3+OaGyRzbv3zK/JRz1FfGadwXFfWRPRoMBwl1CgyrB75y+y7znf6GfbxsgQ42JV0HMxJwCYwpCSL8kwPlSoCQGS4mzBOBKXuvByYNl4KlwDMmTAPFKIl8ESFQDW5uZI5j7Q+QxTv/OAtaEn9AkHuEEuMljQGzUM8D2+lw4lSddbjTTClprLyOsphg+FWo7A0QlwY87HlzxjmPCBwNk6LR3a0q4s6L5f8tAq8AMDeFSA5bwZoOpGhM4AJg8HZpA0wwpeKX/lXZUofVu3zkYjrwp4AUdw1sbc7enuoN/b1YbG5lvvzv9I/wbJnw0xj1S1OFZ7ZLo2OAKJQHise2xMz20XxQ76G/dxH1tBgzkkQvoTPK2AEXfnP6UCO0DIqOf8U0RONO91e+6w45r0728h88V6IoDUt2f/On0VwSLX7HMRVCL7Cncq58i1ZUsFpDqB8wXwPNHyO/SBbkH/0Pe+E/EmDDHAPfKhpV5cD+QHYS1HwEj1+p3BQ05cqadQ5IVgLTMPJPjrr0M0LIOgv3LlU34C7EydUI31GsdOV0X1/8pXB3CDzaxzHiv26PRAPjjhBSUGMhyzEgQQyOZeeSuH4i/GS2p/fhRo7ZbtABKhViLpEvJDAYm069lUgNC5KTELnuj2aTjwoQ250JvvbK+X93evFzZ3vszLvfEbc/6g2780B2MvwXIamQV9uRL5p7wz3tAQF91h1ujycje2K7OOXIAktOf874wa1q07vSKTrc7GsqZ2ddGY8SX3g37Wjx+w36p370ItHlyMCPALloAHCW73O3Ga0O7umlZNWoOYNZbtuPx3gj20Wrc7I8RsPq9Y0S5U5Bl4F+uDSPBBtl9zxajoSgTTaEkHmYG+k1iob+mNe9d3kuKmzgYjcYCaiS7fF8HNJTMTt8RbDLKaQKp61SFhVemawl/KhrJgSvR75JMawwCV5tgM8AsmRtsy0MRSxfrXkbs87G4ZWoz7SA0Ry+KjpZ2ig/33umv4L2PsCRWEUQVxPxuZwSXcRdhMcnse1B45n/dBZzwLjJFz4HFzoJw9vfAbLzni2bvw3/eB+Hs1yilfSxIzbNntiWz84AEdcKUv4Zxf0OQQ7jpM9IxIMb8BbEsunR0+otl0mIJFuYXQnQR2oh38cweEYP0QOIouIogiYLssFupo+Zuf327ukE3WKEiwpb79Ypl23adURCN8BXxMQitDwVpVgiviG3P4CnhyECK2avXNvehf4kzbERUFSEw/hr2+kNSiL138hF2V5uhVkPIBwxYxM4RUiF8QaNGMqg483k8Krw7gx9FGZBYQKRAvNt0BLSlXwsBVTIgdAdoY8WeK5UW7rwSnYtEz39TtGK6MlNXVzJLyfdc00YA3YnBt+8JOnmXPn5II4vRohSc3FlnNpkAUgQu0yWl14Uz+vhGTNvnbgmo3iQW9iuFLgQl7Lpe/2Dok1MW9r8hdvwrqcIN3mDBsfmIYK/caKjJPYcrnUtEK7DfA2ni5L/ixeZHCHm/hWdEWZ+DEuYDXUGo8QoROkHkeF6uXcFbxafXObaPADkOYHu2y7sVuwzUrVHdvbRdsa/Uq026wZuVve3aVZttLdxsHZo16/sV2ON6eXu7sm2jsSWOxha7vL9ZBckMJvY7AsQ3CT3cFyIHs3kAlm+S7uU+s4MIftvO0IXxJe9CmOpSf5okVV9y4vbcCTOLDwxByRb9/YJo1WTSdycXZG/rhn6FtTNSzenDiTPr9qdC3/kpkjDJPf0SWgdVjkKLgMzbPxBM4vL+lpdHl+ge7r+C2znrveC3POhPifOElY5n3qHQtWoNnPF40O+QOjIpyamvnwRm/ILkccVdJ60niCimKlRsiPwywRKAzVwBqZ6AO/pr0pGzWuA+XTbm1PleFi1xRv/7zV/bhJuA0xZci6/m5wUkLHkCYf4kfJm1M6TbGvfcodcndY43dMbe4Whqk3QqYJlGhn7laoCh+IqFVhKjiQ/+G2hzV2EgfOgrK32uWhNH1KUAzn807MMxw1dCbXwwAzbCew5IZCWhnRPQxZ0qXCGBMJBJIg5hjqWMXnxC9p5PQN764Dnglj8SmgXeS5wjHpsULBSPiliFVAiS1PwS6BGDStGaa8FNJBKi1Xqg1XqwFZDtu8TpIYA406l7NAaGQAMaU/v2EZGBmecG+g2p1EhX/0AYNFiiuEfy5Of0Q9wj6vRZb20+YQtMSpfpn+AUfwdnTbQDGZRfw///ePLesk2mPDTU/e7kDyf/kwnL/0PsM7X7J3j6CbE1v0dK84kw+f3hOcDC/8sEvWjt1RpNsYX2xn69DpJenBktac5nIsCKeJ9KK5SrDj6AGDSFms9JSu3uMTFjSXfaSY5vucnLwFVtl9dbQOSrMPiu0Du26pVL8LtSTxx1jfbZdEt+Uq9sVWDSGxXRBudFKP5FezgaInAdw5+MLxQ5AuTGPCYzrDQZiS6SM2+SHIw6ziDptTUdtrJiNS6XL+AHUjdtap28zqF75FCD7oyRvSu1EbYHr4BB7SDyASECqBAN7Rg6b1Yoozo9eXs0uTmduC511yalOf1J07MvA5m+wGs+GsEo6ncHVRJJoI3TY/F+4N5CI55v70AfAw825tDxDl2PWg1HtmB6Rf8aeQH2SJIrd3irPxkNUYQu+tsQoZ18ZScJ3Ht109N2qzvqTEajqf5I9iuUN/zKcye3+sAfHLrOYMprludDIr49ANIN8wKMW6FehCio5M8ir9sbDWBHe5PRkZRaj9wpAMjUSQ5wr1/dsgVHCc03R7AHU142P9lQ8jJ8djjqetRt3FaaBpzGBX5GDxI/9lD/JBq1eK4+d9KobFc2muK9ewc+xo1iRv6IaJWYHSwNkMqGWLJYnFgBTZgm0h/C3wNAa0mHDJ9JpQCDl2MX5g69CzE9KRrz53a/Z4/auMt0V9QMTXDpOADMSRS44/QnMeDItxkHMhmB6GW33UPnVp9kt0JCmtOcHnAPR8DW0HRvH8ImgpAmYEXAYLffA25QnJHUyMJAEim1Hc8d9Ic8puxicz2wHubRukYjCYhR73x4jXwtNf++WpNOC+/tasK+TFBJa9qFEe6gZHx5L761twN/7TiTvrO5jgZoF61MXWT6JEAzdF9uNvds3FbP7gFjwhog3HBx9XFDcai1BCyUhmHAsRnf4rAje38PHXOS1d1Gpd5MbkID+FXeRmwJqDaVsLfI/aHrdvoeabXgs8p29VJ1fbvS2gLkqigo+3HlWnv1yh62ginx1byMXlQaabdhYuMZ4LjD0WzQhSO326PZsItLROTmAJ/V/4nbTVgwPc/tTNyplxxP+rfogCYubOS07wyeB+dVEBS4/GdQYJbwBO2NZNGePR0WPDjrNAzy+Sc0UBNrxnsvlemSf/P9n1jARvr8MX74iK1HKAEo9QET3yiNMoGF4KAQ4elmH1TSaHYO1JIYiuPMGV0+c9JOSjdY9smXyPFHkkx0+5AUE64f00u8m4rqaZhWqclziSiNhlBeCCHUrm1tbVcBvqAzuCQ2ysZMfU7eVxr/L4S2BDVq92129ZH6ILUv8aAuTBCDUa/X78DlUORQ6rBZKKQ2ugOMr6cRtARZjf7UR1yK1VAtyAoiZU3AtOgsRc4z2ntdzKTHbLlngVWa4Zk4sUk0LP6J7VDSnNLF2YYQaWp+75GaUFAU4XYFWP+g3+4PgFt8DhhjNSFnShjjj4gUWK34W4kQfnXyL4wM3scXHxAi+Ue8qs9Jr5s7S/8vVIjfsGHaRUbUt2d+LE1TvmqRXRXeYuOKkOvvomsCKlYrxOHPcdsSdiRicyVc4NVinph5zSSxmP57gD+3g7SOr5XdPgYKlpTMpWzVmc/PkGVO0EjB9R3js6kzOXCnOtNp94mOTOk18awI/A5wCHArRt5U8g0k66ONGw56E9VZApnBHRZoDB3NPNceMg6RF0/w6nhbQwallwA/blXR17gFfdZ20e1E9BLvEXVGxkryDEnGzEgub3s27GDfs4cukMEuOawxtwlEcjYZ2tORDaPOYFeAk7A1mxCaoUFOIbcMhZ6tnZknTJrK7EdyB280MglleN8f9o9mR6jJ8mZj7BG2SLORikNRllLNOtof2rWXk8Iimoy0hwrLJ0GMRDq9vjvoevbt/vQQ+p2Qbm56PEZmRjDX7hHsgxQzgNuaqI7YlEZ25y5aLxNkWLA3tmuNyqZV7SmUR9uIXd0hU4Jvth2OdJGlklBKfWvdBT7LVW9xR4ABhENXM2c4S8KWuhNEw8zuXaCGLgImMb/A4MLmCN4xSXydBF7VEyLX4bHUN5DlUCBQbMaWRL81UwOY7lbCBmG7uiXMK1YZWWffYIdT1o2iMD/2u+Q7JE416U9H8vDAiU4Q/DQWPy44TP3OXdD6d9EGA8B3oN8wvt7IsqubdSmBvmV4NIgeYFcAMyBtabuD0fCAgGh6CIfl019y6MWlgGSuKUcV9SJ3BMG24wvUp6J8YMfjhJ/EhPAxLNxOiN94QlNog+ZBrQnhKLiY8hkZdG1UzGonwaJuqSSFaBJZqBGs8HJCN3lZLGqGfdCE8xnAF9zKtuvrIJAt5ltqKLWeNfkAOUESMN0LSudonz3JitvSz0l3UBDIN+hslTi7uboOc78jFaBsjpsYn8uABP1+z2objXM1nkUQB0kATDcx1bOyS4vrWN2UnoWoZUgKougbs+WE7iG1FlNBiNUBeX4rBdeqiQ/ZZy1W2CCkTl82ZD9n4X3LgwScJNnCaLLcYn1BttHv9sEcSxaarF7ZSVb3knTbRefMwWtkXptfhOM9diLVCMJJ33fFf9agjsL0leruZu1KA6hMo3HZBiK82yBmQhM3fwMs4iciJAYv4B/gyX+1kW/E6T77C0ju+EVro3h9bzI6mDhHIPEPXO/63qzZvHp9jG8T7h0XGrIL//ym/J4b4/JuusdF66X9RqW+V69tVbcrF69vjjrsNXPd8w6vC51oy+1mVlbSa4nx+CYQ3GFnckzam729lxPWS/XKJrAqwCo1KruNKroit1CGumhZu6PJEdw6FUAAbOnGzqZFMQaj2+6kcegOBvZKIk2PGkCbp3GYOJApz9ICEdqEWeMwe4xPgHnZ8T07k7HjR/ZLjM33AMIu0ieodfzPL+3Vq69gNFN175UcP2eHW/wrZErk2Am7Vg8FMlB7EbUgHA40OYne8r3wDY5SdrIkI0QWjbi9M2o7r6KSDElSvI80c8i7o9k/xw60xj92YU1jh+gZDAfE5RAZXjguoTlzCLtY/iYWLc/F6BC4IN60C1QfOIQu0HfoYXe0696+Ap2MbsOvKw7xE3uO5zUPJ7ML6GI5sCvAZWwAXoM+60wepSabYtSs/eZWfBVJ63pt54KFRH18eOz1kaKyyg6ECMECEVO3jVwWLOd4MHKAw/7JoN+2XyQNXz5HjTMr+QvW+BgQzTBrx6t2fP153Oe07yJ/1d64XNl4ufE84imkfVOYOk//7vRX5KSJ5ihiKSe+sGE9lcLkydoSFAlR3pOsyAVLWkMuWKYxBPEpbPIrfa/fRo+rIzRKWOaYLdokchGUo/iP1FbyIxG1iT4E5fXqNj5HdUmrugt8UmW32Wjt1potwdZbW8Am0yVv1vaex1FnEjL+AeZDssCzHsKMWICtO5xOx14xmQRSnUBcm05MZsnzxEUkgXNJstYqGYqMSD459AHdSIF1uU+qggc2uoiwFuE7mhTaQtiCqzzMDF7G9/hkrz3ZGbMduKZlS61GM6xzkM5bxFOgo989djB5HuCTpXDM904+tMkq/9HJf6MQrI9IG/QB/f2+VBmjI957yIjj7/eeC0JRAUdfsQ1dODtExCexxpd1xLbuuC0crMPqPtTm+sGcX8pvDReeOQ40F0g5yw439B8ROnv6LrndkNJaOKDqGr4LqHtFIT+JXvziVA3xQLJ4Y+RagPpfQJUruYL5ZFpTePthoYrbJH+gJIjuvUH/4BBIXD7hK0G1iFDDA4218qhY+42APunP9JYEYNRWkjakqKzf3+j43vS8fcTzCPiQf6F88B7bYZzsx5YIPY0emWBObF3uOjlwkI/0QzLeKCcfViwaIgHtmNoKhCUOrftCRGLfpR6ex6XKkW/nzl5T+caIOyPMN4bP2nO4R78//YW0FiUDDnJG1K4R22g45sEmfymuQAgnSonmyOkcAg+EEbrTQxlBpMc5fkmO1n40ZJGkGox7lnHQFP7MSFzowVAbKJSoEXFncSkg46VaBl7yljPod4MWh2X/1IEhBA7EtYVDK8pcugUI4yI0P4+4bg4KvdNtQ6GX0TrWsILV99hHZ/05/uHsioKerO/yjt5jaxiGfkZ6rJ6+Je/JPM8xunCBUxf2gWWLvR1VnGpAg/AEOwfP/OvTX52+bT3Z/JqQpgByP/R9okIB0XbPOeoD9jvTI0uqeKO0/KatBRAkgEeXYqP5tdDehrxfQuYrdbihwyQ1MM8A1SDIUfT6kyM0F0s1iYzrttmsZShSAemPekpTp+lQPbgyA1N/KGwUcB/nGKw0blwjnhiOAc+UZyE88DHifPSMvmW6VzfFW0ka8aI8f+1qPg8sujIXi7IbWtiJ91lPQcOk6O7QaNarG83wuGcg1Y8olOwuZv04fYcchHUH2c31pOamIQ/Gi8bGpM8fCqG9aIWk+fEhSJmI8Lx+1w2B9QWQk1Hvj+4LviODDkz29HAymh1Iewsi4uBlfKLn4ydabhItVPyBYbcyLybeSwrYIwaiaD3RZgfwp99NU2n3JDMeH5FQwNPmG9Y202FL+HIlQxaloC8WZXtQrkrSVKGFTflWlKDfEKfxGCgVqm9RDHqIaSYPcq/xTRyvbvkWDc1eoyBjc11pZoWhQLMiBZ1ozuFBE+E+c/JPBgP+pfKb8UFNi5+c76euiwB6MOZdcpB+wEKR4LYjVLPPHgmhH8DvKCPFxyf/lbLS/Jr1nhwV9QniI2jwe3Zt/kdCUZ88B0T0Wwyqo8ClL9lkTt4cRDoJU78JXDep7uEGAaeD1NUI41fiTkmg8Qsm/Y2SjETTdTbAzwmFkPz35xx1xb4gZmiM8q6nkDmRAwManYUI2I8apb97PsOBgpEakUz/92nhpuTmA9qDKIlgbiiAiILgqScMcdSIKIiM04gMT/tSR8+IAcUQOr3XNAAsDwUoNltkPqWeRcoOc4XsUSHvigowFlw1TFX6/fgrlRxIsuMMncnzcD5JFzBSYH+XY3LqtfLmTnnvOVyLsw0xfh4WkTgJEMwfREiRSqSEm+h1RmPXSLqE5/9rjaqHHJ/M8Ujl85aeq0skb3kMiAs3/itOGcVxaZ/hRT59RySN8hO2SE6ccq2YcYuG4GzSPCmWCTORyP51VqIv6YXpdI+csc87MiYQMG5eR9Nnhzr9iuFLeawljQiuBzLsTaAgCrswxk1aUqsTZzmQzkRX7z3God4RO6+SbH3GnuMqxIpP6rG4PZzl7GtpVpNZ0Ugbx2knRJofkVmCbz6O3B3dHj6Pm7CasDntXby2FW/W95uXga2tkj75eSUzk5nc/loQ5LcxSBvVZU+lg88knuy0mE2EDEGG2SjsQ4AqsTDPxtxPUvpPkes6wTPqw5SeSGSukvkt/Ce2wPCPFTlQ4T5vU/4THSY4iPNNP27WpnCah3S5maqQhulLtm3zenzT9jM/ND/NlplvUKQVZAPryfvCqffjk79HNwghChUDGeesRUqDIi4NxZoTApIpLR5dCKAvphZ8s1iK0bKwJfXIS8rItiz2UbdpG7nklp49TEfuSmjhKtNiOIuhkW+R/ISZbfs9RiOZGQbfQzXIe+w1zeze7+WIwQRiGnXpjSazI5Hwr2Fk6itaKQPDsxrST/jHOQX/mt0TMGcWYrP3SXxH7gqp02OV94SAVeUcIVb4cyY8fnQgM3NEAyjpAb7khzC9+Nn5Bpmd+jlBDSKR6NwF6ibYIssMQ8S8aaK6T8SF3xc9sCoWD+gxuVbrEZwPbNqqr5iHMhQXelIV+u8DYkzhj3t68LYiskzw0Jn8U4DyeyqfFfqeuEM4vbimW3tAHPNPydTyUGaYARR0PHDj3qRjL8yGmLUx3h+i3XcBuWeau4xBfSx8TD5HzIMj3Wf+0khc8WPnluN1Jv3xtGjv17dFKCxjJDYT8VscMQ7C3hGlLLTrLqXRqZEx4DPbHaI3DMZ9aIHkuKcC55mpvsQADyi49y7T608phvCe5AdwG/+ZZn9XudZ+OcfmEpFWMphfZbOyUW1Ua7sl/4a2AApa5Uv1CjpLNMuXQLrET1uVV9BiirZWYS2NmAfzqErZiIrGtyJSOeLO+MoUWBLSr43ybm23ulHe1rFFZfeVar22u1PZbdKAj4lnflREz4Ujpw8ysLQl3oRNHvVuwxVPTGYgKtM1f2WnaL2yk86nLPRNKJKDRcaq7hXtgPeFzPFShJlkE+mMBXJ6v4vIKJvOFFIwnAMU00E3iTu9lj8WzoN9Ucipo2glbzmT5O3bt5OEZzxtWknW31jYNZPQM1sDWCVf3RLpjnSOVnhIUT4RBhsZlAS70h7BhSlz4smSnebf9rQ/HeBvHw1adFtsyjmTET+GzpHZyN50JrDCjfJec+Myxu9vDEazbm8ASNNuziZDb9ofuFZv0neHXQB3uCUeNHKHyFp0relhf9LFbKDTY6Fixbdo+LesmedOPBqarL0ezXVIMUjwVxa+RWEMfxSyFkpj4k9nOnU6h+T6g+KAJbUp/MuqTfoH/WGclGrKfxslcOJRhSM3Ct0YJ2WJ2ChrfDheTWTjvfERrBUwoJTpEG51kotJaNzugQt09S6D+IjGkzoohGPgsSqblzA0Y3dvZ297v2FZla7Iq3b6Dt3rB1p/MBcAz6wOnlmY3t7OeDDD1H2oPENn8knRHo6P8KHVP0KvVfsnI/cYkHtSPC4y1czH04V4O21Z2wgA2knCbbtzbJPO+wD9O0bjqfw0OcTdSFKLFs4jubaWT2BTy9oREYDwCXDcOA2CcvyXhdkdgOjlcznetg4Iqm5nyqqt4BgdbxyfEGrUgTzuP07ARzDt0YGKOoQu/MFS+RReQtKjAosK71IFfLKhBgUYlHgv2Wr5HcdvYVYpGX8Cby9VmjY6eeRSK1Z5MBjdJieuWqOp9zYvzRN8ryuF/WGMx2KlL5LPgf6CnRD8YaTGjcxlkp44sGWk/HttBjJdsjdxDgjBnP4Urhi6FNZHU6UFdr3D0QBddi6W7BV7p79+Fl4mnQ6xH5EhLwRwcmq4TSVtk0pij1AmuFRlX0MztSdLThH68PtKwYJJOedk5RyNPUZ2xO8YWRQkS6TiqfCMSdsbACWJCON4G5Du+ck9LcKw5/jgbDUFoOVb+pRV5uIwjdNuH3GbuC0qj4HGQj0WgTUnD20Kkk524e5ODoCY49tI/UVElmZm8nVBG5A1LIw9ylFsk7rzIqPfBKF7OFZtNfE2hkNPJ86Ym8Ct6Q+gCfkrknOictcxMuGSyvKv53MlGAsOw+Z7K6u5zkrPcQr5biqVL7RTq2uFguO2V1azPSfl5rpuOuc46CQ6oYhuK+uudFfhK8fNr64WOpm1TKezlk51VgprebeQ7a52MynH7XTxUmGmE8Aenkdu/Rac76J/3EtFYcHmW4Z0qMMu8cyiuSAYUMhzt++E1ib0/exmaHHcXgTJRuKgIc/oTtAqktQjfvErfAo951ZWO5lOL1XIZ91cYS3VK3Qz3WxhpeD2uqur2XZmZTWddbJpx2nn3NVux833Cqsr7dWu6+RWnbx7Jk8WfeGVEYYOCeHh3Kd0iXzEVbD/03yqAiPZexw+xdTheP95O5BDTmocswlcMquKWJgvRIir8Ux2kuIpPyDpE0X5D07+zS5vbFT2mpVNwn+Ij9CcUW02dPXzGWm1qAnj368px7nPtRPsInHKr6VWuzm33cusrGQyuZyTX3WzndQarKDbyTqZ9FontdLNdKw+Eg44NZyGxGJoBAMk2lvtpuG+rK2mu73sCvTUTa05uXR2LdPupJxMvpDLtAu97Kr1o9HxXv+OO/AMqcVBdI++u3D7cr21TiHfWem0e6tp+LvbK/RWUtB9ZyWV7vRWCymn3VnrWBTc5WD4O2Y9n00wZomvlRbeCley4MDmrjqFXK+bdduFXKfXLqRW2/l2N9tezefTK2vt3OraWvjuyksKxNGNC7YLnhzZ3qx91PcoVwM6IhFg+DcNdnQ1m1srZJ3eSiGTz7azmXzHyTuuu5JpZ9xOG6ASwaQHw+bdFQdgNZ/p5jLpVHYNoWGtk7UiUhdCt24un13prK2tFVZTaYBsJ7/iON1CBv6X6qyuum623W2vpgvzl7J3pQxM6qAnpgvTb+jzzqy6qysrvd5KvpNbzeUK+dVeyl3Np/I9N+V2OxkHJ78CwLrSgWdOGv7TXQVcmEq5cM7p9px5nxuhzp03MaCEOYfuFC/ynAX0Omu9droL25BP59Jt2OKss5rOZLqdXrYLP1actVwXbls35aQ6qUzPXev2YPrptXY6l13rrEQis4CdjC/O05CWP4cqGMt7BhgG7ZW/J2XWH07+O2CYf5RZBjG/YGV3q1bfAEmYNGZRe+HrFqAFyn6ABuKzSd9eQLBauGCN2j92O1NWiaDcBY+AmYQLhLcbVb2eaop3Ke4wQZLP8GzdCX8uHgEX3e/Bp8bD/tGB9tsm3t1uD0btoi2F804Xk5F0AUvdAsbDnSZ/PDoeE+pBN17MzLCaSCXHw4PkbNjH2KVkPpe8gOLPUK2Ae1c9HqIBHwNAEx0llQLhPZJrfMpvRsNpaBGwXjx4Y7EWxl/L3Gtf+vniviK1ffAI7PAR2HOOwI44Ajt8BHbUEdjP7Qjsb3UE9rc4Ajv6COyoI/ij1GXepRShb0oLN/vFqXtBvFrPwYxI8L3l6+usgOpO/+1MpxNL6RL9v0RD9ZPaIY8nrWv+dRyPQOA71jzDlRhJAmRAPal+u7ecwYLKBx5eXVFgqSSra5RqFK1wfyuskLqOUqlwPzPYTZ8uo8KicBYOqlfQqYT9pwgLMQaMY5q0ARkwpU4ktE6Ri+YW6ljQ0vQCRlMD2Lb6GHpz8lvi4Xw5CO2vvG3moalDf9bITTtyCXCBczkP2ggBkg3/cHf8JxGUuLZ4fn6urn19duT8oIm49sFRWXuCfxEKMEf8dph4HoLUUXRwGudZpEIU3+bj8xKoCBQidEMIUEFt0QXOLUdqeQRL5m7iGqa/Gw2j9rPG/s8CRENWCtlTGDLP1duTgPI5kqI5BOLfj0KdlxqH4M1+ArixIwB7CrreGGQZA2Eq/6AvmCQIYzFjWM6NHk6viuzxGGYrumHWFjH+asLevVTdfdXere1uVPzo4XkKC82BJITkVdCs1IMxVJF94v+mzv5GFPcIF67x79MDuE+sfobDbx26Tted2GUSjuOVIQAAErlY7IIFwl6r1x9M3UmLGPVRr6c/tBdeYmhfUH/xhEoxbTdjxEL8g6hO8UjlBxezQzZiNgZB1nWOUL7AjBvsbamPZKbF4SIT90nKv9zc2bbboy6Z/5Akw6b9iS19OJhoKh1hNMLsp6wQ2kCamGEuNeL9EWXcRh6gKwVisUaYKYFSycaqhhsYOTfUNrKEB1/BuGfcQmmJsrQdIiZXVwmII5nnjYA8TQShw15oN4T/B4GQDtYamLzte8NJzyHpGU+yjjjOizZIawjEmGTinykG7j2tuCNDtDRURmvDnmQgtUzXKIxdwjVQOgI0uGNS2rfRUE35C3iCqI+27ORgBKeAf0zcg74HYIJ/Y0GKpHfUH/RdD38L01ayO2pPRvHx6CeAb0a3nGl86MRHvf7U6zuD+PC4Hyf9Ylwza6aTys8tEHInPCffJA3TXSM99+m76EqF7m4mWIgWKnU2FuNj6Re2HpVK2vlb4kUUP2sPMO7BGdgvyFZaNQCcHzl04vkKIwCgKlSBU3YHK/qMtS7mTlOOZm6E6qJUstV0vvCRKi6MgdnCxBzchNw/8IuxM8FsZgJz0GO+pr5zvK7Wgw3VNsbECKHiTAzVj8hd6R763FMxUCwLETg9rDLjS5i4KHIenzuUGXqqVZh6S/aCEX/ia5mDGAMchPpU3EcvWt2CkgTedHjE/gp8a8p8WVp04Vr7u9W/3K+0yhv1WqPRKm9vt+oVeNBoNqjsbviDV8rb8LpVeRXpDpXKZZ7LZk8MTjDGO6GWLaIJceu+DnqcS7dOKjaF6AGTZBAQkwBjb9cu2Vg0FzM+qCKiZEGnVWr2c476L1qZXmGtUOi0e47bLaytZNvdQiqVzXZSnd5aJp1ddd1ub62Q662sruZ7TreXa+fWCulepptKObl0LmtZ2KEHHVlzDT9IHoCQozMDaW/TcDW94+H00MXaTxh1zM8zaKQh1zzKZUC5EHzV7a3+aKBFTZL2ljLBap53SkHMW8csxLvSjvQzITF+QQEdpJZEnRiXxTxICv4qSRyT/4oPxq+ngNxZkjgfn5JxxipF4Rr4bYbcccLGojYmhgKUqfyllb/zt4HLyhVyY+HzB5jcwrwB7MeyXq9daWAWgfJuuX61lNLt7W1OzVWSvgIWJ2DSHliUsAGQAqbs/Hsqe9uobOxT8ga0glTqDc59qdy91W4zeFKVgfDylZUmQHzoqmpFo2A/Xo1vEfPKBYJg2o3yTqVWrwJThy8lwW8ej7U2w5EHnGoPU2f03MkEGMM9IW4Dq9MH9pl5iPjtQ3cY70xGnieewJ3gBk3J68UbbmfGabOPnDuY8aSUTa9k8yk0yO+5E6mPVyMcuCM0MeFMSotLy/ZRHwYYH4JARD87sJiJA3+Kwg7Cz+VPcDce0g29L4EDeX1vhNF2zgQ1H5pzB/qCymBmoM6A/cIz8R034DV7AFJOhh/Vru5VX61sN8zKEuyRqVtZMUdQnPzPu35a+p8Riv1KS2vwreQbYXkWQVn+BAgWmHzP69/YN+AHKc23H8RTFP5vBrxpCAURJYsjKGjodWoe+ngGb63Jy4RiHyK4Q98dWJaTaDtdDXlR0iVBf+1U9F3nm2Heb3VicMN34c5VNtHVWVQzz2aim8I12duutJAJKiELZFFGhY3t2v7m1na5DqLQfn230axuA41Q7k3KvIgxs0zEH4fzW5IuWIVcG6EluuMmy0i0b58z/OBx+zLSRyToiWyZGiCoYADdYZgdJotSB+V7ws2VYJW25lxtCd+fqyXw+ZpdBmUqXxcqRVdB2IvWv6NSPyjGCMaO9IwAwbpkq3m2BW9gIlDU1Kff7PorKxG/KSK6GMG8Taf8qeY6ojw+TRldCqqwtFLsiYtKJhKJ2EXiHRB+3lGM4iMSUxIG5Gq5KFSNs3vifj0y1kIBkZgPe0qZkYCsqagx4qDJ+5bDXIJVpZhHRX/yficu1mKuXsKu78MIQIH86sOgCFbd2FqxLCo6pe5iq7FRr+416X7vVBuYIcHMPqKnNvbDZmjxnB7jQcQweeiDpWxphD8L+YQkKtbOP6Q9RN9jtenaySl8MB3ddIceK2p80VAnRpGAIfZSCLyYp2KrVt+JlzdEycJ/JfD95kkV6bV9xzykmm0krHI0ItOD+gjyMte4E4l+3DuwHIxLZf9WNssz78BumWOHk1xDh5xkHx+if5E9Gx9MnK54gjHTQLAmSZF1QWWsVwNgz8LTc8/nKtG/7ljqTICwmyH7yG5J1lKmuVKMpZ7Rj8rN3SXIVQXnVICWiLxn8TVcyOhL4ZVL0MDlPDgkHnjpzWq9soH+cQ2/yrt2VBL8ihHq7ChttqgOJQ4XOB2z1jOMmOUoMPwzZ6tcM/hzxUyNio/yOn/+YmDvsMGa3aOgYxlilvRzx0XLNbAZvlawPTvgSRV8Fk65It5Ffdg3HB2ByOK+PEQMHRXhdaMZJ0D1I9/p2j8W4QZvkUM89L+KtXeLFjX0DrnqHwbgfqrVJCY/TooZ8IMyOevjZyB3eQlncnDrWvqGGU2qR6ppqI+kf200Q/if5zwoVSXG6BoeeJPiEkX4oJ82SIVnaJMM62G4gJIQf/MJu7pzKblR290F4Etu1UFCsMmZPxIIg8GUuh5YN2xyHoP+LRRsn6PZ/1uyCN+SRwgqpiNiKbwICpLRQilUFIURkA8n0BIn0KITaLGHLAfmWxXFnlsbjQYnKQek7wwxd3jJzqwVCpkcWwEBxlzyeF+jprMJ3sceOdDnViwf126Wm5RFqLK9xZ596q5HLCArfSafys0yiHgjOs6hh7KBg8d42khh1wUSkNgkkjKr3QxvIDvFVDAcpIXuyAFhvrWxXSnv4gUowAXYpSIJzD4kG82r2xVOAsJpUtG1779RKUXUHf9GK5p68i9COc8qDpEm2pq4Q6BOcDbCSWg6FWEHIuPMUNOn26gVcQaCWJlLpGmltaKghJEIEa7YB2Sr4XQRGm1tMTOA/WWBQ2JjGxBGEMQ5kNN/vyLfwnzikS2ysoXPYXjApGCWjJK9KgzPtL5+G+eBn6QtKxAQhY/z9qgjYg5dz+pSBaHO1AiduoV1VD1K3juxAfMDAMAWTkc29OjeQj0FhoUO4KW/oZbpjaWeizCVyKe0CPr45GPfzZJos58vw6IkGPu7jfJWpcUHQckyREptoZ28XG5cbnFNSlJkAgHfRJhapaqcH5/8kVJK/MGPTPyAHmGtNFQH4eeVhsyDY0Bhg8s4/PbkA5sKv3wIf35MWbI/QqCLgJNMMVQS278flj73ZgWkWwxoAkYZeETAP6ElnPyK+LjHtlDJm8HmSNEqr1Y2BMPdaF2pNmEfru6Wd6obrZ1y/eVKvVFasS5t19bL263NKrDnu3AztW9a67XNaiWqEV2/VrnZrAvlb6kQavOj8itl0Q/AV6OUDg/1Cl58jPHcrqiOUkHdMaZRADy+ot8PA+I9YWHgfICREpEfaEWRkvhI8gWqwi7pVd7hEsVauMIDFnD+RHnCBcoQAN0edVHuZL3gHC5B5PqI0nDz6oReMTgyV985HjpHwIOrgcW6+Rb6alsd9bBSw4+qFo7iJFqevisyBkYW/Bb6DGV0Qf8ClxNMWem1hC1wLhx6dX2/SQywhMATM0WghL9s2g5iH6tgK8QSeCeW5etbtVUJZauA80+luIpp3DluVRpiBMalDfP83X1LJYd4m/AzV5ACbs8+4Jq/cGUfk/v7LfJ7nhN7qkIhhYFZOmQF/FiDIb1C+iRVY0JaLFi6IO8TPkVjisLgxgeC07kInEDoaPQAe6FbEp9SLSeRZUEE05ZiMe0gJPy/TZKfVgOVS3ebcbuinCdF6kpvMT2dFvIvDodAqTMl+CR4/5RjgzXrNytZpMvA5yFjuNwwwz0PNkAeB6dqWtDKU2GJ2oDWyheFiqgnV4qj4nl8sZRkrQEDroFCjN+WAcYiNayVSSVsH98RQW0IiUrpdNCt2SCwaf8mEOQzAbUFAZXk732ZH+5vCCMiKqQdEhGNKG18KumAVkEZRjMRsKAfJpVRxEVSFcqfTBSzvL1du7JdbTSD+DjAOGjpP43MDjKoyT8RPQ7et1JR2i22c4m6iz5W0ROZsSuH4MeOAPbIVRKVMBQRTHgODffzQ3D7Q8F9UYlGlE9aXIRQQrR3jgDeJwYEJ38MGKzu3A6zTec0ewopOBiPJbRKSOvZXw3NPl076hISRKZF6Co7UfDhgyjxl/voSwH8MjA29d0KiB+Yz3O/Tuj8fd50SjMlVXxfaGjpK2nBldkMJOQJx5iv9BA2XJ+qxuj0B7MJ5bD4ipNVEajcV1pXP0uIUTdYV2dM3APhu4O4K4K5yireCpeE3FUmy0nAKd+pO8awVxKuWpojEFx1DDmOfFesb7QyEfgaZtU2DAP3hX+PvUfp5TlY/qesfWKSlFTJ/J3poZK7tKpBFlrNo5aVO8eySEWD+rQWVlvCG9VS1X08f4UL3nSyINwY8d5hPjqf/C4AZw2XYiG4YBKwSIvxlrCwHzqTIewQ64PithodYwPJQ0hYCVj/A4MiKUBrkzsxfCn43PGW+yaqBM9icUn6VAlfCKUJjgh8Ux4xl2QFE2kEVoZeiorG8CIsYz8bULGBMW2hCFbjBiKBIIatJ7LpREZ6sqHIqyxbaQEq9sFP+mP4jf+Rj2RYpvTL0nx0Ik935RynS1Nr0cVroUeBc6dFENhCxIU6WP+EK3uXQZyuA5e9V6+tY64H4NM5Jz6I0iQ1CH90qWAl3urnnChFJ8mAdJJRFgLWo+Mez8YSEBJhgBbXWSCIRPTi8+dY/K0jwO6tH3uzCYjNhP1bgP39Fb8GwvXikn0wmtrOUC8nddM9vj2aAIacHHBGhwW8f9B6gTjMb9iRZy5gzwE/A7RlPhkjU4uivxECtJS001YEE0xJEaKYAB+qdcd/dCKwMPElZthFfORr4yM3u4BMkEgsJhXh+l1UF4zkLWLKxCklwkIrlwM1E9dqeljxIfHfRjZSBLm3A1RCy58iAtsESReu2pwobTMg9rNwz4KoJuILTn5upkH8Vpwe9LS/12jWK+WdFlWPwHISfG3UjRFMMrmWUqlTkftVuZQSNfuMM+lQl2SPzqbSIU/NEvtpmsyURmwCWBNtgn52ya9O7l9Q0BlShgcMdA+lyx1b/GhGJc6KGwUYqzLG37/oAqLQ6Sx8/VHiUs6qwv+OxInfRXjxBAFnq1a/Uq5vVjb9Lcccp7WX2bcs4rXyaFaNGADg3Bq13Ubp2g1dh2KobElFvim1GZXtyo4EG11zKzBiMChZ52kfKvWhkjisTCYh8xMjgdyq7TaTO5XNatmKylXJ3j9PylQp82+Wn5QAaD2O49FwuTM0SsZu4Bct+iSw/n+ai8KELpT9wMLZWnYuiVf48xp1fYMyBLvsASLy1aCUULLnZPYR3vJSDxM0xQrn+z6WB3LGDpdsDdZzkByA9DN8HDBESd5LlIAUwVJ+bYV51iFKVse2XD69x8KoYKbfVllRBRqcg3weqepoADzZhAYxNjm32Hs1EMyumubwEMSI+YnJiwyRD4RzbpRfK+Wvdjm01kh/6huCtbRWWsZTZRJ+imjKjzh6wYzuf+Q7/RAMsnMb31yZcIM4DTpFMlfrW6dSpPuWahFxr6td8KfwwKEd+JtlmxkdpUf82kgILk8T//yM5Jef03fvcIywBBlpjaGm7/ra1RB/E+mzxccjEbuu4ngYcqdWiQXQ3pNE2w9VxhKaP75ncjanRhZQVvIFicDZQPG54VxKIJlL2AZ1IOyZJuSGGRIwIXxNOCt8eKLS6pFAFPGdtVPbrJQ46y6mM98D6rfbLAUythBoMSBpgmX8oD+N+4ZtEExNRMoJb6RngyZD6SWFRV0hpE9GRnIts7nGTo0GXZW6w1b1QNGXDjN7S49bqpNmSBYBX1k6cFUFVRsKS6UqNM9ttQzr7ngEKG4EnBlV1VDVCGZDWAi6Dit1XQSi0uuL096Imi5+eVdMvKgFisKDF+eEX8GLiGsNlM7Qn0GrZxqHRom29Ip9/97hQx9FePYWjZjNQJAvAoQR0Bd4ryt/2u6hc6s/mrASMnTO6FFRbjQsq4nnrH4hGyvSAiM0P3XOHe1779kmOtg2q9omwooj8gxP69crnNVFRLqJXLFEJWCChIhWohBRhhCRFs1MicGjUE8myBDpmIiLXbdkJZqW33Tjcnn3UqXR2ilDa5G/xnef0t2S5rlO+YUSrCACGlMGpKRIZ2TJoq10UclVwArgIuyEUvFSVWTK1pbEFG1WECUFNB1CjxGfWsJ/CzvDb1hetOo8RxVCwEDRzsDZ5jrZTGet08nn3JVCruAW8PA7hR5mmcn2VtKZnFModArpjlvIuJmCs5p2Oq7jrgH8oFc5BgPYHl4s9oLYo6IYTD/orDAY6w9hS6WeCl/hLGklCWxx3JbLE0UZRk7XrDktSsbruTSoILqwpOn+o4QMyEihhy2RAsuPXWKT3k+JG33of8LCQKkkY+nUiydTjITcGoZoWUccQbu2ZXhkqPo+P2WY+8q4LiSOPoOsLKFtJpCRXrXLYm+XQ9YPYs95H/pD1ChSoSJeI8bOJYJ+Iwq18fKzLDYR5wuyHN/mDQkA0l7rx8cGFYfRHp4uVWh5BlgObzDxVlSRXPjRSqpLFtp3kaJ7hMA10Ur4tGy2sDBGWPLkEBauWinEUzLMSzBoCTCwMvmEkbtBgkm53qyi0UZdOXId+0J4woma08rxD/81G1MBYwGEr+wkVRpKVhkde1P3KJjhkTuK8/ehJI9z2DaZdi8uyFTSsmqDrp+nUiZTS3BgDr99ZumF/NwdbJ3oyvSSZ6XdE/KHQjww2fGxXgSPNKNUCiPuGzM1dluLcqVg0p8JmQs4rckBZ+8Wh7HMCRs5TzPxsFgg4le2ULAolYNZF2pOUn+VJF3WHnigDChEsAS7fBembnodqhAOBRo0CZF0hEUcTuTO+xN2EPeLWNhTrLk7NZIha4ZjFK1CiRSJwhcCFJ6DO9iTKxwHLCOAqU7dfr0S0ioRgVfstUnJe87Acw314bfIjbwxGHmzicsWfOhCfoOOR9iH8sUMiKmPSSZBVCJKlUXWR9JSCVKzgGiixBL1kp7IxKp2qpgq5nO5KOpj80ULEyEquaTTUqUPJ/rHOJ+1KKKyuxnWSvFDIidviz2dEz/mqKLbbls6OifGh2OfKHsizkyqDM8g1/w4imiLBqJmnXAeowA3Ffrq0+fO6JDzZ6q8nqTbBriUBB7b+vFLys+G3DFf5BQOfgJXxHrUuyGM4wM/SoM9BbnKncy9mkutJNG9MfKEKCQxGFkJh62eU40GuuP0yCB7aDZ8mtjI8wX4ilzHLZA5toE0UY8lP2Iys5qwN/brdRDnBfkWPnJJm5W2W9VKvcGXGf3j0K/ud1yz6VfkIfehJZJNYv7Yp838et7Er7KUJQtOT5+r9ClSlYqRZO6F8yYUNb+bl0X0z+dk9iYuiJ9w9U0IKz4DmqvFGiJQU69/fqx1oFc/9LquBKziMxBZrMxawq7tVerkCwNgLMqZqTKlmNjq9JeoDmVxVbJ9Zn11oWtWfoSSblMeDE4NwMEELO8aHIBeWqj47Ou0f2Df+m4qr2OFeHY/Q5+dQ3cwKHL6b047XPy//g9GAd2+1+mPRbC+XkYTiyR8SjpzWQnZOhB4cOZZLFlbfqJbS0tcK+q+c9FPIUawfhl5kc9EdQjWSxNvLy29KvvkAc2s17PjcdLRMavNUVb4zul27ZfcO+h4g075zvTw4hMSTWsfmoo8z+hYDopeSV01euiN0cN45h2Kz3sAEYfWdm0DUD+n8C2BZLVTa1ZavDEUa0QMIjJ7yibadTnRK3KTSMt7g9Ft0eXE9YC/i8cxOx09YBVqvNe1OKEmDq/z3jJiEm/CabAIrqzuKKrOObftxl9uk5Zbakbhd0gxTon4MQMEEC8iOxtXAVmS6Q0Zv23lMXY36EXINTdEWBP6vt5lB5KIOr5C9+7raAfOEGNKfT81YfnlIqCYkHuOaW5vvZ4x+E3ypGs160By98p1+FVBglve5AuE62hEmMFMB87ebDCQhTg7zmTSR98A4mXeZM9Nrm6ALtDMtqsoTzhMKlI7b7q4q+mgL7QZHHWXwiXkxhj7ULS0sFTdgZVNLpFbLdx06LYlGXyj8sKwscyyiBSOQ3EqZ30i4Aw9VDXrwFlfAJNy/+RLqlmm6jmz/fcEKxpRJildKkQSxZXr9CT85CMnQvnwzp9GlYFMhiq4f2mTmea+sDU+Pn0zEIGmKU/95DNPNjJm0wn7SnV3E5hAIy/YJ0IFd4+rdAksoOvfExs7mxaVVbjSH3ZHtz17b3TbnTQQk9sriTS/2wPEfVP8CQK3M5zyj0bjMtW+EM0MgLEJoh6EiuRy01CZZX7sBynuzZrNqxhiVby+Nxlh9np7C3UY1+nFdSQlNxPuHXduA54nNbH29l6Grl7aBxZ5r15DV6mL12X9F++65x1eF7Nsud3Mykp6LTEe36TPQGLpTI450NNxvcxKPt5pd6CvemUTGAcUDSu7jSrGibbQxeLima9QVX/6pl9ySahC6ZajMYS2GXhcxO6YnwP2OQ6zs+J7diZjxY/sl5j87RElIjIbrIdzdhkEA9k80oaO95Ehpi0LpClSJk12GeB+ZkNENux7RdHJqoYHg0PE1IqwAj5Vm2OpJyAfjrwpdoHeNC9v7BevN0a96W3gy683+kejYROW6RyJA214h5eh+cvusWdZsClxcVT/OZMpBjfBylJdonod5BMsN79NkWdl1q/tbyMa1sA8on4pAbyZYQc4AxBNAdQ6rucJxieUTQJNSe7YmSDV86ZdEK6N3+5kYlEaoMqd/nQDlfzx3dGue5vv3pNZi7Ez8zCj1BT67Fo7o7bzKpY4RovS0Riun3MwhC3icil/gYFFf4EklxgmycOKWgj7za34KvRkr9d2rBFgwfHhsUdZRcjUgHIpexAQE/Irng05IwEj4hyjOh4H+cmg3wbxGaWyfE4kYTJcD6zkzJsk2/1hckwOs1k7XrXj62RZ9lXxzhQdHKfMUkgTgV9zWGzMxIXVk4cxAB5VImYxAflpHIV1Ll5bK06iCs5TaUSf6P+VKBL7ErplwfKH04vA+9BP3KWLSEWpQaBQPQwFHPM6cF4vA/dLvowAbFmqrFIpA2yBULxTsff216XnPVZmBRYANbo0X+GeckZBFUaKcfKuuTPVKqE4ntendA9x4bMAHIdR5FHUgSRGla1UgfKQake5SqR18vekOeSAu/vhQOkTlbVMZFCgyw94CU64Q7GBcH+Vi6GmEkP/caNmdIX0PHKCTGzJ5+a+YNE/F3w5wmh1k3QKRgVLrKLtwGhyUC1HhjKeCNQk8g8k2WWST5CoZC5BiaZBBnjv5H34C6P+kAAqVXtD1IH8VyoeodeAtM5ZKuIbrRE7meiVCUNhsxwriA9JtSNCG8nLcatSblSFAEbhr609ePlyiyCttVMDMe1KooPSX6SHvOwSQwNUujdSY7IOx+j/KXrOPVXPmafpeuUcXZO261tOPR/Vv+ZX+qOGHz3z9FteCJxiHlj/jdorlfpV0bFwxdsp7z1Nt6uq27CJSUxVKMvP16vw2ZGdavYsuR+oHb+Ea5duQE/RceZJHfuGrvP1KpJ7ql4NbaehvT9rB5iufs1ZmqQvtxGaYLAAIl4TLy9rk//XvwSx2/96qBdR/lqWJ5fZRoJpRWTJYNnikS9TSJOeYtF858PqJoVkZrGizR8RJXGefDKa/Bp/YVSzrFn7b/Df/4Gxzb8lDPeHk/958t9lwPPH0PI30OY90fYPaKD3UxMLSebksaw8y/l3xHwMS9W3y6sSSFqj8pyIzMxJaUYQb2SGCv6lJ5XgJ36+CP4dyEvGDzVNvZHjyHOdCbDX0isq6XtBoY6KvOZlnD0FrPVcx+uzN6oI39SfKPdwGQ6S1B299Zaa75iZzcVMwBjKKmwFcrtwWpdw1kU2XIkw+sd0UF8LllR5DpqpTe05bsa+x6zh1aglXLKyeR8kPxbx9G/Bvz85+TebYAxteh/i2w/hzYf21n4T7idGosGF5UxQel1b3/fVjKS9b1BPTA+ohxkyyyBqzgfD6FRtYAt90WdTZdSTrMPXMlZVyfGhxM240nIi5AGnOdiZ+gQz+tQmE6VI1yz9VZm1R2Fcbms4GDiYZzIUNJuwImoEUTV6EeIts5sZwb1wVzFo+HOO8jJiMzSr7pMr2dqm1h7h6xtlB2Wd64PQnvHNkQU2tPq6MozjXqi6/F0u43y2oZzMrmg7kIDEipxvOADFTJ5438+5SrY85C/x0rIHL+pCTRMftSHWvNzhiDDEDgPn2NNx/2cq4v5tSkiEMEZ2Vs5moGWbu6/UoqicsKfHYwrOttYT8+PQAwor04Zvumo+KdY5MtovGLWfCAYzYx4hP+FNNm0ENhcCgc2eyoUotFnBSHC9pqYqRuJHWmwkjGBaGebK6jhx3FowdSjw1ooIT1WmXn3i4ZydMhL1v7DvhK8NJmz6yHSrFiFkQB2QgDkTAI6uCvfXEhTzylAz/NSh2FaWK7xg2pIPsVo6I9nfnVD9dM5RAov4mFLfBCQV3yGUFZHBxNO6MQodYkZDkvw70kxJSvuQ8vKR4VFBWIC9I2zk0DlLFdYaFpYhz6jRztFqcgTfz/X85lr5LdlWdUfXP99uKk31z9CqaZozVaJiZVtnKh5Z/jsyuT239zPifJuy38rRKaRcYri2ldcH5iVTPK+EHXZMgtGQ9w06OEl0bQKX8kXyCa2RNUDT9vhVkQiDLgvXK2GlkN2wz9Of2MHIDoCYXm1D4yRE0gj26JK5Uh6eyDpGglL6M9GC8TgxaDqhWYtGbTQKc1hNMkBCiHt0DpQTSpAI6qn5Myaqi0yxwegDXeaDCVRkkyQhIdEulwiQdamcfKQvT6/v6KeKpKzzAXT9KJhWUJDqr5nXZzqNafpNun0/wreMYejzExl6LFxbRVjDQ7bhEWOJyZo+JCGFEy29h3juA6mPAWxHD/6ZWoBsgzmZqO37jCUFYnxfoEt8+oGNqTUYVZJvCiFKwGVGnV/bOZi4GIwMFFO4FT4hQWfCboRQXCLKUzXilkc5xS3bytlt2UZvt2U/vu+pr3uYIf42OPdpXXGuqDrP53X2aTylKw23Tz4nB5qQz9azpQjQlVE+xyfVp+8IjtozohSjqucKyS8uI+1SUeTFT2pDoZGKfQwlbymqAm1aYbZgQTZdeNeynRppTlVNM72wmF8lTIrbfixhqAYbZQHRCh/pFWe0ahLMmT7w885oCO8zHcUmLFFoSYt0ZJxkFLYJ1SNBeqPCAjRG0A84irzlMuOwGftnuC+OKYMir07RYVJc/1K4Sv7vv/m1qmJyqCqCz5UOkA6zMCzzFClpMJS854FeYhC2MESddKlMt0SL8FBZqjyCqw+ImQFS7qsT5ugbfASpfJufXJMloXy2HpvkW7oRxYO2fynyjcg11Y/JU4GEgqtklINoAPU4yAtzK+EFJBx5OBhFJ48iAVzYfEV0DQsfoaaE6RCnrpSeV2W0EfvOzyKnVETIgxLEZKTdQX+qKrsnz2NOSk6c20kRrxSyJyWDFqMIKsWGo3A20e9iRqxy5hkFsqZ+Z9MRGyQg3tftfRdTMpR6NK1dLbWBVBl+N5slrBs8rSrrWzV16Xc5KQFR1VANHTOj9nc0xY2t/Lz56XnwvqO5MZx9z9oA1FfdRJeM7fLVSr2VbjUrrzZbld3N8LuMMI2VyDdh6N7u9eMruTgScmeQSaXihGKyaMopFtv5XLGIbgeR/ZADQmmt4KRXUwUnU1hxV7rZ1NrKWrpXcApuKpfrFror+baz0s70cp28k8qvdnv5LDB1DvC8hUKqkF7NRXW9frVZaZSyufTKStRrWt165VJ193vACZFuFEUzmKf8+WMPmCfxN5optFfQzr3j/5hN+wP1a9YeC5cT+eRY/XnnaJBwkd9OVDhNZBP+th3PrjSB56xugkQS261c2aoqj8VavVnexi2lKLxszFqvl3c3LmPDPgY/YCesneNjYN/a+NGtseTZ8zELc7Kw16kdS8FetlecTjedyblY676QyqZW2tluwe04md7K2soq7OhaKmZdadolufAEOjAtxlhI4JH4tJOJ20KE8JLmhOLzJ7RE59Gq12rnGQJXr4LAKNmf0+2Ohl5yFxsl96gR9Ml71apXtkOdzv+I7Kb0IXwEK07afjdW5dW9CvmFwZnA69epXm5sb9ZOYgYhZCbciegK42liRXsxm88u27F8eq2bW13rFTqdbDuXBzhd6xRSmZ6zuppZSQG0uxkQdDr5Ts9tr6XT7lovnXOddNdd62Tz3Xw3trTMYzU4jkcMsulMHTnQCggyMFKu66SyvUw+s5Zz2vluOp910k4hl++6bq7dzjurGbg/uV52zc3n25lcJpdvd1JuO9fJrax0u2l/JE69qPItJgBUcZg0zLYA46TzK6lOtrsKty/X7uC9y/bS7cJKL91Lw+K6mRW4tW1YVDuTcjLt1dyqu5p2crkMSF2p1Xwax3nD31BM9XS+Dc3kcPiV7FpqzS2sZF1nxUml4U6net3MasrppjvZXAZW3HHW1nJrbTe1lun22t21lQwMnst2HHct08s+cZlwSDBMJ7PWSeV6q+21bCGzCjJnJt1ZBQmykIeRMdSkl3c6qXSu53SyqTzIoKlevp2GpeayaxkQJAOrJOAqNy83YK3XvOlkUQPRpD1ewlxN9tjuD20P1ux2F3WAW7phoQ/SPuao6825FhwoGH8dUMcbMWBaOwNMhscbSFnYFoUDE/1Y4gLVmDDPojyVFHuweNM9XmZtfAm4DVe06vdEasy+Z+NjfkrfT/pD8VUPhNjDUnMyc5foNcjgPfiAi9x03EXqYdle7PY702Ub05ks29MZYIlluz0aDZZh6VPsZeRMl5aCI6if+A8MZ79ox0ox+Dci5kR3djT25ADuEPmiFshP/X5pC8MKl2lLW/CZR/OD3+zWB9JxaTG2HIPTLsaWBFjIf/z1+M/lyryoLVBzwtOlySyZu8L7jC5wi5g7USxy4vQ91zgneilae4dOizIPLCKwyk/c6WwylDQqAW2AcHKDxKF7p9s/ANFnUQ0IhLmFYYiLiAhFFxSSGECN9DqB2lIx5JI+2sAd8hDLwUmJcYC7WAQqv2z/AM9yPJtyGwIkOGrO6lcC2r5sj26WFlPL8pinyI6p7cR6jIpuJrBT41hwBOMBDVXSBjRfsyNnSetyr7pXCbVxJ5Oz28j5i/+aL0keFcAWBJY7KB7rS2pyD5U74/4EPZMVwCFgxBr763v12kal0WihN2JtvxlbkpdwnOCzQACxh6MpYovRzTN6qG/EjDMci6MCvnLxB87kwFNHoR1QJiWRAxwF7v+1mPIDhQ/xtsQ34N8I5lea8CX1dGM5tEXY9+imOYEEn4dMHxqbTXvxVexy4gIW7rixpQSWRhwr6H3twFnk+OVlzBF568ng5SMtEfdcAlYHueuYv1MARYiHjUPkVZIH6mtHMfOAY5QdNvgQU90Hn2XSqeCjeNw7BoZ8MhqOZl7wZTrcWqwlFgTSyaJ4o2GqG+ovxLb+tiCqRggx0bVc+ouwdhgIsX8cDqQ/xBNIx25YEY1ifMC3bvhYXdtXoVDRtva157axEVv1H2ljX3vytr4Wvan4jwiNK9kmuouRw+z12AuL/a4dny0VX1hEv/shSoxxb+l6DA0XRfTbz9p/9VeAbfpTu5C5YMfMXpC5wGXYTxO7aD8pdvGC3R0FR6L5xic45R7M7j/9J5ufeNqTjoPBavLBxWTXvZUcYuiUWkEWux66F6iaRGAIILN2LPHjUX+4SLJX4rUZ7NziHWah7uAqX1sKYGH8Z/6dR8j0vMMQwDRDT0bBJ+sY7rEDqKx07IZAMNycq7qKUAiK9cKUo+f6dH+MMo+MoigNQw3Cn2ywgqEpcWMYM837BGS2Mrv1e6XQRVIRotnAG4bh4B0y2SWmUevlzVazXL9UQepmEBviIHT8rlP2IIkBWMimlsJMhOBuiDmkaIfFOYRnySDSFfoPaWDM6f7lpXLrR43ark+KcYQEIMHFGAKsC7KTJMiLIDwQv2ejEdhohiNDw+/jlY0Y4RIG9/s02xgFph6fwv6QrToW7Hsy0V9G9d2s7+9ulEGcMBkCcwD8hSgLz8Sq7jZQAGntXUapY7KwsPDSD0EOs17A44cnC8Ec+ySQiPT6CxcskcXT5vYJaM+5+VGYg9fXX90qFj0My1mkFksXrBcwELBk8xuY37g8Hi8uvLp1/TpIhdevw68FbNVtQyNsG7/YbS/Ckx6snLTZMMAO8rnIQQwP7BeY37V/6EwmzrGQMGFXF7/f99AY5C5yiyX7dbkfiIUu2G/oW3RtgWBvwS5d5EQ8/Z/ID5ftBea96SXlc6du5dNlMYUbF0ASfIFFNZy7sSMRugjYnheUWIofdNvxixQ2XB4MFoU2oLINpwMXYooSFBmZWn24OtuV3UvNy4vy8yW7LKqcLaM9NKNeLMME6SXPFU7dTnDPGJncrCwuIDTEA1ImLMnv+aKdwg4Op0eD1pGDhsWIXuLn6aLjeaIHv4Otem3HvtNrKU+zK5eB8Ni0XbDS0oKxY3atvlmp2+tX/a2grYlZCDIiEIiw/4Kkn3RoAPvy9yJS/wXNl4MaIL1YoAS5ZQq9pocCwpb8g6kNAaeIM+FSmi0WmeUy+KFYhGiBq9C7Zs0EP9qfDJ7LUNivGKc/7Lp36phD5lmPpPUsxgJW3oEjaODhVLvPerxA72JMF6XpFjl48IAgqM8ZjWpYL/5gSY3E3w5GB0ZfR84dypX5pM7K25XGRmVxp/zqIn/Y7y4tpyJ7t+wbBHYI1tSx32d9dBsvu+xWQv6yqH6g/8lbuewQHC0DehPCJj4cON60NXaHmJGzJZz4+ZapO0Zdn33BgAej+8FmVv9qzFXYUROJkSXyQ6Q3/wve6mg959zu5jTnviJUfHM7imorj0c95SPyS9EAanc7h8AFK+18SxJOZBjYqnB9GBPNkCNpuSTAMx4XqIl5Jvpifxdgp7xXwZJ51Y3aZuWvAo8b2xROxY+ru6+Ut6vQtrm12gLJv9GsNvebFcR6PK/rwzkzq+xu0rx+eBFIO9L7HUp59x+O3AM81oaK4tOvHWfoHLiTxaX4RcDf68fV7qIJrPAd0XnxMYgV4s/4xb5XRY0kgF53ESk/bXyPnAwWG02gIXUgYuXNTSpM2MQta2IuCNwr6JWZxf50EdhOIuqi1/HErbvtWX/QXSQWBSBJTNKc+ab/ghqyLYjKm1wDUMIsYE7n0F7Ue6BF4ofN47G7gVpdVM2hpYha4VO5jhdkWceSPbeHy9xk0f+Yl/UCwDt+J7qIXxwBzsD3W8QpiYWKjjZl0j7Ywws+X0V90G7DH/GLhHr9XdZnCLybO3CnblnuihpB4h/RL/6Dxs3+cObyE+bOXiBgQulXTP9ghkns1e/bhxg9tDglTlwbH7GhsUw+gvnzWKadWRYDLtspbWK8aOwSecg2HN5NyT3K1zzgSyU5YdidF18Uk71op1P4jz7BKHCUV7Neu1RHtZ649D5Iyn8YNNPaU38yasNoRsZWBs6kNhnDE7f7pD0Rw9AFBvpzAJBWnw1rqOyXMCXh+9oNY88BijZkdsumc7Bo3iXgx3DUKn27yPzbeKQukp+GexGGvu5na75O9N//XSySDUR2EL84IxEaeGhq6G3DPoDoTnHyMKC7jeVSFxXO4Zlo1zqE6PlYEJuWgKCGkfu1BcbuC6WLC5hTdWF5QSX19OCh2p4bkfhfIHprCfqOGbiaVDUNxNWqAmkYaZeeCmUnzoewS0+Wzkq6bPZCu/QXXTyA0W2vdIYcI9mkZVfK4C0MsVkWqZiXUa5CJn2ZfE1CfJTgXWQvF3/oywPymdBVXHuhfUNRxwhyDPN8HsRYnpxIMtB6pVKvbl094wQ5jgPobouSX1darYUL3z0x9gWpBZogAjH9cYMprpx2CeYIc1pQhEkkoYQv4bF9naj1dabW1wUHd93n4BZxOhKH+HKz6CR+UV1JRl9TolxKniDwkywacQkcRtQUjxYXeKPYW6XF/YNYem1B/AmL4r9uyCF43bBo1o15CzcExSZ0Lan2tQU+Drjn8AExyvg3uZDBf6lmFD7ojg6wB6TgN91jgzyJAXC1PIVr2OSG/cMfsm7CJD3A6JNuY1F+R7qMIPloVDhme6faaFR3LxHZYFKRB2Kmk4jwMsXwQb3pgnPL6Q+wyC9s1iLab5fUHK5pL2nilNs1YF1dOHS8KpyRF/W9ejf/c04xhx+LU9c+F+/o44UFXwF8wyB6cq2a+oJOFfoDvL9IULVsR2pBSrF0bAH1eCWeXABIOLtOyweBed1yh3FuX4qpD87ROcPUOTumxmd1SnvAai7RJVp7qUuDvYvcsyiQw/S0onp1FNilFdgR0ogAO+0C3TABChioyA/EjhiN9asVnCJrW/cqdZofXA9VbIATE2/qE84s6bBjbkbEcRMLHH1iZ02JM9PARPauRu1a9oxJ6DshkFB436KbC7R03uaMvM69zZxNpyVx0P5u+ZVydbu8vl3Rl5ZTS3uD7AV2kJiMBl2fmDwzhB/C798CGZxxrWDSLUxUHtUVJXlUuRtk/h5ZI+auyhj3WCVFxuxffyvjuJdtUSOdg+m4ujYFjKlUg4+x4jXGv4oPRYd3E382IpizXQbI+Gs/Czq4QtzuJmY5FddPB4uVIFi87kvg+TxJDUGmXDJY87ny56ZyCbHpmJhacXpXBX8nHUwRDHBuyxN32fcOWfaOveXZZIBOOWNn4rkWlhMpwdME2ouvpW9YdCv8J5kbyHlRq9KCMMcvsAkINdulBYZX8Ua5Ey9csL3OoXvklhbQ2xh+4rRKC6upBdx9rs7ZYlJaWkllLbL8i2HQmyI8RrhXT3Wby2Uj+sV6q755kD2hGlToAHOsLeZSS+zBhCLDIuyKMG11jrolnx9ZUDbcDjQB9iruoaQVv4n/ih85d8juDz+yKXoiY5xkndHlhXRqgXq7ISE8cjfFyGTCh24Q3w9uQb+9hddxE94ovo5LfaOYzhQSKfhfeuGGpX/jTzg+wong/2/Dv64PW8LtVJS5abX+4nXcvRbC7BsLCA7a9MalgHsUWkzneDnNcWzS3JUifYu+X0oVI04jLSyt7p1pKWhPXSB7KjG+5Mcj2C7GDaWoNS6ozWbDjzCfYu9Rg2e4w/aoe7wsoAebJibeeADvhf0pbVg30TGP20qnoqVl7IAyHJbg3BhW3ygmk3yEyQWL21OzEsMdSUjWISabx1p46GSAOXH7GOub6PWHXQeE2UkMG5SuXY8t3Fi89n/if37Q8bzrKHGJn0v0MkZdw6VPVJUD4O0SYoPEbOh6HWfsLsITXgcNmgDyBuRsUccKCfhBHhA4uWVsv2QNR5MjZ9CCUXGa4pfYKjHvGc6aOuWhYZ1ikTMe0PhKDuwZ76B/+aKtD9oiuICTXmDfDP/NEich7rZ8Mx95bemPxTzpcfgC2phYjvEe4Rp+oC1kVgruDoMFNbmWusErGDv9iWe2pH+3XvMGi7PEazN3crx803XHrfbAGd5k45On+bTiHbt2Qwh9s2GX75AUAu2by7dwg2kYH2fAcm7CtGGVC6bDEHeBvRuPYUpTOLE7vjvLrQSvBq7XEnZ354bxATyJYnASA7jwC/JeUa/m+GoweZ7ze1kyPrxVgpnwKdP3/lvECKKzRdiNJYVeaK2aYwKdfOjQZkNeKBwGX83lWWLoToGDhj/QlL4c/EIQdvLdmiV6E+cAgw6WlgIjaTC2LJ5oN5yfRH4jEVjYjI2bqnVlMVdRet1SwmlRDAhPmKUqIjOFjRNi2uRzbHBRxfkCJw5IuAM+8acGX0TPLXAz8SvFkxW/U/YzuBC20NLm0H1dki/kPhpYCV+GDnWhGD5ns53crdAj9NJnH+4Fn4skzo1YyIUXNRdzwTlGuJgHPMx1B3O4K8uw40sAlHAReHLfLwVYoSiSt7JkRbJc8BAvNe0VOgI5w+PFO99HZspHGcaWLUX1nl8yWDqT14Hnf0avcxm6lVRoSSHUbqwxWtAYTYyX2vHeiJpTYSnMvBrDonCphp07ZNRwwan4Uk/URFajt3z+FvAR4+vFEHzz0YjxQ1AdeThr5xjf3wuKDXnCYbKcgzw6E9I+IHAA60XEOIK9QW+tJ1nHWarDhmeZq2NyW9o6s4hb4Brco4/Hyf1NdsPqqEYswl9Q8IuavyDxlkyM2st2egkEL/HTpZ+SpXiS56C+hpj0aVe7RH7UZlCHuY+qN90NXvPHB+5yNZGN3TBdJjXXPUVpTAd/6lfFmJDeqtX3WnD4epwJJi0okY/gtRg3it1QzM7EHSzbi+gNRwEhS7j9ekxXoo8q3EXNG3Eyuo06hUmHPA7he5/iyusOLbDr0W12SqTlsMckDmS8Y7818fLQMVkbsZk+eyYeyMHnBdMtyRCn0NbAvXw2W7NbufIfcmuID+VVS1UaYRo3uHQ0kYm183DKGyZGKjXVKIVmgwnvCIlL+CF508MSxUyFsx58GU8vLWFIQYr3kbz3POpBjELufEtmd6Jx+xgjCM2GgAADbQ23Tv9qyZHQM1/nfNETNsQJa878iDVxKe3jwHc3eB4aAYmh2wCtLv3Ez8Uw3IeP0INdyMsL3HZLJjinU1q2DbTiGEeleTdCh6+/wYfF7l9GO3zCbsavvyEQHfMrKlQT//HDP+zFWAo3DPUWIE5H65ximhVHROTAd2n5nSc/1Jq+cY1XcyP67MR0NSfKGO2RnO21lHleevv9ySDQOB3Z2Hdm5OYxEe0ci2pseiKKD3KBpri52j4j/HNDIyA5BCnad74LoAYX6EqSTs0bynQVFAOmUVNllwfjQ8dOnzkiuxaeBchaY8MBMYYEk6+2Ablw1GzA9xRlk6mbfM0IgBuSPv+yckv1O4oW+qhTo4mLUT4Tf8E3UI665FNLDTsw1VxLLYvZ09OzuQelwHkSe8AxN9u1SyaDgD5eIE8MR60zNmnZHmOFXhMrn7WpisOFpv5EKO7XoBAat4ZlC1/d4tCgRiDaw/RZog95SLjVwWNSLWjK0ID+G/GeZEF4j8IgznMpok2/60ELSReUf0eANNwwv3wjGJjpH4K5SHkGFJjW4qhqk1MTSZ5Kdg/YXyq85c6s9dLrejQSh2svvWHtlc7y1ZgXAWBR0NT3oWc79sJ6zOqzz6Id79rxI7sAjD88DnjSxugZebHGrM7Yjo8xyCr2wt58j9tYRDf6a7ObqHh5f8zAC2MFe3O8dGMsefdsTfTmnSuhv9T14QJJGLjpGO1TCrLBeO0BvA8pJnXQwaBUOhstGHUtpeA+FjlITEXSzkKiAzdrYakQipzRIYMtWXIyxPJpTBIWa+Ng/W9x+snXobs3YkIKo8SpZItbVOHas4m7N/L6dyhuG8daSnDDJRNC/YsdE4B6wZ4dOd5NO5UxogRfhGtlwtjKivFaB259KPHxBbtZemHx6CYCwRO+w+bJhFJWJV6lf2JGd0sXKEjw4vXYC83r0HnnEGRWO5XP5Wz/0eg23vTRtEheTvK5saajW3a8J2IN4e3cmdEWmusJQ+aVerVZYcAEyIxp5MAHzrMI1XxojaRYxMw9gQ6ZUO1P8CygplZBmBaH31LJVUyUJ6Qa7NG3Y52RrEPj8+bcfK1FFPrg1zf8uc+9dIt+/pgkPjEzGKjkBJQM0SUJ97tB5gCHT0C2erNIlKph47M6egLON7uZg9Sjsb01ORL36SycPjnq9ieBRjE7Y8b5Ugnj8B0TdVbqlUazVq88ZyoQMdhZF8dsHrpBZNfnUBoTxM6HHc7HxvpRGmfwqpncGUjC9Fqev1rRLrBKkUKsRWXCjtUpkKLAUI2c4eiaEDbixZjybY3JLuaf8tkqL1SdnKHqIq9h5I7vaLzuomZiQ8MV6fco7/cim9kS5CPr3e5j3qh5LiZ63hjKRWHuPG4wV841t1d2YjrJRSknw8HM2J/QRsZKMaGePJ/Aoc9dDEYCQHh5qB8IMfT2D36A03kjFEQswIPcFs6ADfRYQZ1OLFhZju5ubNk2PlL+GPMTeRg7hf88KX+MnEVYruBEMqbPTsQlk/+cJ7GMaPfE5DK0Ei1BTuhlZIIZ/MdnWs6faAb/YWigxWJVp0CuGfyHL+E5Erb4M5hM5Bfw53m+iLyW+M+3vZq+3S6Uz8m/m+a+ietFSl/5DEYw7ywdUBDUtK/Pdzn1f4K3DmcefeVidBfgAf03cAUDpx9x7yNOXLv8YrVGZiEzP4GabFgQD+x75dXKRiwMu2E9AX38RF0BtTLXHt1m0kGFgraCuX0hXEJb+Pe14moqdSPc8I151wv/CV4alaoB/xHpGsI50gJfRiJ8/MfApvjgHHyDicl0gvhEPBbCN8+BUs65jk9BJudv2fOjkcE78oyuaphaMqEk+8ocDahYV8BgqG/ak/T//rLKe3u+j/tu5UrM6GeupcvvQPC/qC6Do9gpNzcum32cbTfyO5KMYFRXcxhMNJGIFlE8hvb6nLrTGPcQ9z9UToPmXhtH5YuPel9o9VeCEiVG63emYmj2HnvOp1nb3px3mgGTbug00QM7fJpRxj0yJxpLnXuu9dr2NgrNET3PZ+XmnTwMedbJ+6/Ju0bber/rp4QJv8szYQI+mrZAHPE5Xdr1ZXvgtN3BnyP8kSA7TwTkUc5tqkDpb3dke8fDqXOHoyE9u+tOyeR1lgCIItt2dbfZwpyWvCSx8M5g5k3dSYuimBejswWqdG+MFDE/GyfH06TyrCaVKzeo2RCrD6iJBRnQEBy/sgO9Uqw+CC67Pn2Q8/G32aDI/z/P/DU3h5dxesJbzTZz790Ig1xY4fBnnWc64jyDVHhjex/z1CFYkeJG0/TNBlMfiwpvQFFaAv6QhR9axLO4Xe2J0BJ2xaRMtjfmp8Br7G83FfbVdsZkdaXJFfiBdGCTRbFsNFsV7Y3qZuC1uDFFW7kyGh/zSlpHThd5DYyeXBTPlkLHbK5VNg8+n/ud3BH4MPTM/+YNefqWxcdEicvJ0IIeXnA2/NgvqwHHBsuWzzXlQ2WnXMVTb23tb2/LisMt8WED+tuq1VE3kcmIj2lkrYet7doVcSQxpc2OXxS+CJyOPn5RLiZO1T/81xNXNDjoT+PjmXeIuT1kYn7odgkLulBTYRoELMOuNPLx0WzqsJ+E+ZzqDyD9UW+w42Av9CzYBcyFEot5LT5m/w3CEbzswLT1D3DieAN6/cmR9hgvGDquBk9/fgN51FJARvKPs+FUmCV0DkGKivVvZBOP6av8OTZ/EkPicxB+q8jHlmLysTAv5iExxRq4+y/5GbCRPYgzCb+IaIGyiDLy+HZeWXgsAeuCLu4hRhsnZC45cpbRci0Tu6QNFyUQ+qUIsHpMs9q8qoQbF6WwSpM93Q0bR6S9RHwmnaZEDvE7Ca46F/agIlGOqg/AKyQGi0sqlkXxfDHff1/0/P1zOkkFkfr/x96bbbmNJImC7zon/yFak9WSmpKwb5lX1U1iIwgSILGSSNXRxUqCxEbsQN+abx+AjE0Rocys6u6ZhwlWpYIEzM3Nzc3NzdzdzB8aem8jquzdatNDboDv2/mjM3rXDZ7xhOZ9Gsc7MsdDyw+TU3ryk0tG9SuiB5oGBty/fGIWfL2kQPCc988m2b8Wdu2/8PiaNOXZC0FSWUW7eTaZr0c2PHvMsEv2hccKOzCL/u75dVH02bT5wOGVrl3vKlWHZz+aPJ8L3sM8el/gYep7KCkr9JxVh4nvUgUnbFn1xxPgne7DQOTbuDYwzPuXM8qD5Xwap7fvs6tfitypoPsp8O24A/GULxc1eXUHQvvbaMdA366bcIPuqi4u+Au4x6rHI9WDWtv77TBs28vE9j3kw1w2/rnepTKI5pgy++3118U8/1Qc0ubT7b2md/7JVQ1eQHO//nQZuyP0eOHGnbBfLapbqAfT+NMYvuH6kR0mX2ro+qS6mDAn3/t00f5fhsF575eMmVa/XZ2LC6ao+HR9OBZN83B/yT4cvB1PkAMjYQXwn9f7Qv7+HY7RSr5HdrtgMh5vvh6Fv6/lEn379uEE9pUtgzq4vYNkGFGX1g9P7m8YuejcSx1Pnt7ahk8k+HJDwri5NojlH0nhd7CPxO+uh365pXA8WTiQNfwe/1zWoC88+uUuV+0gFJFvJ7dS8PfHVuwTL+fN3fLY1ee7P/r48ebRceuPN/cnvscLpR6s1xfL3e/lPeR4+uNS//DG2nVtZPh7V/JHdVz88R81Z7TEfljihYb8Hvx/vQmPsP9g+2oQtuWaVS4e7GMf4TIGwUerMPesvXUbv3t3IfjHKzQF+PHhDOyHu2CM70CyEeSK5qUlnCcC/+LyTQHeo/7+RQb+aFXnOdoCfHE9J3v++IerOndIv62nyoOp8mDvXcJtwd++O2T8t9/ePk6d+fYuEvO7QtmfK/Tcdhxre6D8Nj76GVT2AtRTqbkexJxNVXa8ROyyuvtwtvm2iR/vDy3fkv/358tSjwbqo5WpJ0tbd+PgB0tbL7x+cQHrUV2PKfSDKNwfyt8teVtD9sNiT/kz9D23FPj5s7H03THJJ2Ppmad0H+v63Fm6f/X8JNITrN8dtHjy7tGK+nPuvNyyW204mDKKqn27XK31tI2PDw/948R8V+pRVz0R5w8/YMxDoMaPKL9fbR20osw9U3b/37H6Jdf3vvIf94M0XT5txKPzZ49dtkcbQNfzlo+u8PreXfvOcb3cvzQeFRtznIwlvzsydln/Hh/6bViU44OL8fPdBvHl/fU44+f45IX57dnGuwuGLkW/padHseMXhlyuh/s8RghefMYnzuXHm4dziC/5/NcQnVuFfrH6vDAIrrbi5YTAc+U9MoQROO7bYLXT4nc26LfLBt5/wRL9bhvwqmzcshp6ejym+sgLHSF+Q37526UXL/uLo0/2mIZxv91PLoAfbv765QZ9cOgeY/yXL88ux7q/VuvFlqu0vL6bAy+tHCT52qDxAo4XkNyL7YXfd170g8f8lOn2wPZbjGN2wsst808Yc9kffbRBccH9j7dkvJ6Ued6g6wLQhYL4Yu8Hvl0O1u+YIO+yi3O5F2yo8XIg8eY2l95vl1vC/naL6Nki0v0YfbS287tOTRg8An2w9V9qyLiSN/z5vvA/K4EvuhCyqt1WwgjKvZlyqWJcF3viH13ofMlJ+v5Oof9mr+uOq/+E6/UYwb98uef7S6xQ2JWssY95/Wxh8Ht1/GNXSx4wDQ7/j139UcHeulp33f/E+76jdIC4+/p01fmhafce2stw4xL/uDZwmSN+5Ltn3war5vet+Sf29FjgYmtfvr1sMH/73S3Qy7kQZnBrtNul6luL4r7Wi707Yv8jk/da2eXhi5VcLdZLVXci/p0p9qix3y8033f5k7Xm3zMLHnPuO5vg0YvHBsH39uWPTMrL2v5Fqp6YLMFAzp+wL7KncC9VOyrd4CFI98LWR7+f8vZiftydDP7O0blF9MiTuMP16NHL6B5cqCcIf6RVf29kX1GO92ssHw/t/w7ldJ914R7V/RrOUx31hwQ+Vz7/jYr+WgX/RMc/XbG5l7qX9NoVxd297T9WbLcz7A+V1q0KuRA7QCFPXj/Ixi838PNtvot9fB35d+cQHjmc34Nfxusz2Owp7HeLWM8G3eXbS4u9z03xP4B6cfy+BPhHe3pTTmOVb1dVfgPfp/D6fhv3rSy+vV6s9PHm9lbPyw2lj2q833Qcc0XcYnmatGKYyd/cnv96dOXmmIp3eHq31eT5t/FWw7OXmzSuSeuXfcjbyzpv5fv7+fW7HFDfadsxZvaRVn6+N/SDbbpnyaJePJT6nb/6SEM//vxQjT/+PPZgny4ZPJkInx57epRd7vHnxf3Np0C/tw35cokf9M/tMc1b//hOTEctrAnD4JcNVpkul7cLjbdpX5+w4c8drP0fovay9XErgd/donbrSTz262+TuDxacPmflKrv1wIef35vzeDx5x9bHfmT4vV7yycvwT3flP9HevcZ336vc5+u1jxRmvfF/1+Ut5dIuhW5x5L2fClilLXRUPjec/wTx+Xv9+GHzr0cO3u8LPN8A/7x549WeB5/BqIvFbx0FPsJ3HcrPT+GvKPgc5WMm5fvn4ve+Pl+kL5Y/hLBeLvUNND4gghfN6u/jTF0T5p7tyP+9lmhF5n9BNvnS1zeC5Tfipysst87G48/l2RQzwr+QK5Gok1ZETWFvQ+X+6fF/R+t5AUB/j0x/cPQhsf1zYWxmt0LQQ5vb5ccaIWdXhYn5W/MuE0+GkjGhT5W+8YNf+bfhDHl8UYXlGGueRptcHVrxmNjxVV9XU5rPfHahzH0ZMnmuqf6RKONbuyj2fbeBv/hRDCO6h8rl2eD6c/poad23IMp/mRf/77VH39cw92JvT+m4fdsYEWeMqvp+tYuVW8Pkz1A/hk7EnqwI5/I7o9Nxbe6dL/ax25pdn2xnV82d3/Ipv9GgXhA+iSw7Gl8xv8QA39683AMZTndDT4APHjKW20s9vwdcuuUfxmnomuK0k8Y+pD08nqyD/nsxt6LhedTGMO/YATiYi6FBj5G+R5IwD5IoTAJ4Tjp+hSJEp6L2hRJwiBE2bBDUh7p2FgAUaBHwRCBv4R6ttNY9QtEwCD10utLky7nIH968x+XdOVpEPz0prjkNbWjGyYsxjT6zOAGd77HtpmdjKdGLxCX+3G4L3/5vwPw7U9v3v7lykAlTcu/fL1+R+CvZph4aVOs08bP1YMfRV9r6DP4NRt/F+PvYX7z3958ktJluk/Hv+s8Hbk4fk2EZHCZr9l9bj6xre9Woyyv0yh0u5tZNyr+m0/09bzqzdufL3PE9HIccp37gZ/7iet/eaeW6ZhD/Ofyy2+C/Hm8Muxvv/yiDN7yNIq08aTWz35S/zI25sNn5XaL/7drKqK//TaYFfnfIOTju3cfBhTxl3f/181FhDB0mPtMVlHn7GClz2Rm925yCwwOgOGXn8vPwpidSQ7e/xwPZcPhb3jzKSpvwA//eblJGv77AOiMgGrlXOsbQCY/x5+XfrIvD2OFhy+/qUOzh4m5+0znXVam+9zODt3nq8wMDaEvw+r9COx9ef/bLByvrxoM2IFzw1stVW8RHz4PjMqq0p/bxeH9b2PDP7PjOf2xmb/8MmaM/8yPN9aNs//Pzofhc8+NS0Lwdx8+a0MvDR0nJLWdh/Z4f9pI4udBSrK0uNAwttK7+ZT4N+8CH8c9hKRskHRd3w+QAHJID8dwn4Jx1yUwm8QCAvIgH0UdcvgfTPk+FdhoQJCYF7jvHrHpX2/e/6ZeAudn45UVD80eCf317a08KvSXv1yWHpeswS7/Mjy+IACcm78o9F9+evPDrvvpze/KzvA6Gy2rMaPJl3f0L18HGR3zht2MslR8XVeatvt6gRileQS/rktd4BdpmHwav91cxGxcbrt590DHnd66LMUitytTn8u2HNFcj6P/E2hUjZF17RGawTX559AM/HxAM66N/VNoxrTqt2h+urtJ8P3P2Whm/8f7R9z6+KjJHx/R/fFR5eM9Qj9dFLcylKv9T+N9PDefluGoK6IrUdnNJ25cvRu0xkO/3qjjRV1l1NG3d/b99ObvIz2DzH4aPYb32jBBX1v1BNtd599c3o4XD94sfTt4oOSRYjFHI/peszyQ/fHdYJ+tv6yXgiTehQsOKoNN6jBPkzEz9FBY8pvluNF4xXoV/wuVA43/8X4Ynp/W1wDqQT3a8TDIMnvvDwPx3979fks/DIO/SsqL+oH+GaqnPDuVtMehD3+e9vvx8OU/hv5/f5/sZ9xR/HIf0vHLXdDLL7c/h39+vVnS36bL5Rf6cj/DeDfFWOj26UMenOt17V8uZy1vVI1df7mVxZunsvg1eTem7xnm+5/fh4Oiqj788vP7u1uWbz4Vl5PX4C8XTB9ufv315t8+3DZl+O4XtvvrzV0qFMAvXWAABO5iLwYPYrDBRzZd9z+UYV4dw0A+x97Nv/7rbbn8nyxX/MPlxiRFnz79Y8W+z4Ny2/DnLUagbw8BJxyrjKvUP2rlH8IWfwr2aWt+BPpyC+4E5SuIIL8hUPx9y68HEL7I4uU1GH9N7uDuUT8HeXefrYoghq/JKNaz6eBDsZJxM/633mlzWbrI6/XrSO8jZo7ifrGyrhFNhzQerCzn02BDlJ/yKrln0L8M2ujPQ39q/3HYR7kunne7dwOMZ/CBJ3ncP93vwD0u4n15DDzU9ekyED/BOEiBxKf70fjpOhp/vbkcULnLGzf072A8wL/fhQ9xOl9+F/fX5LJ0+mV0bxVjcGtu9zzHTAD66N0MXXjz1589wC7HlbxynJ5G++WP2fe71d7Gct08ZZc3mFJpdxHhpyz/JNx8mt18cm/u7t8Zd1Bw9ONhMNSi0Llcu9MPX371vox/LtFpcTZ4ZcX7K+RnB0dvQ9YeXcYzGEbXA3Y3t4g+X3Pvvvc+fD74rRfuh/59/+HL4+t6fh3jUgaAdze+lJeBV3YoGaowUwHTdJ0WjZKowvl05ovALjozne2oSNxHZyv2T/yepYWpauQNNBXTiILmLJGjGLCk10CKtIcTgMJyQQH7LTTvT/25memoLmYWkR37VCJ2JzU8LQwrskwjsmLD2CpJh+pbkfHjoJegtjG36wBnaiycI5gXC0uUlmV3EkR7jjgquJnCW6RYdAFDnv1dOEGKSWyoQTMX/bOGwdaqmfAkB7aBrgfc/jxPVDnK7EMyOQHzRM+OFWFtYTx2KSBnvNxTztDWxiaBl/SB0WTlZDLpm9mUnS1AKZxVWFgfOWR96t3waHgTYSDIA0sRBW3Bi0yaQKrTlg/LJqKcbVkcc2/V4SgSF4RMVdgpIywLbrMaPlaype1iEymdqq8hxIFtsz5k9JomUcroJ5KmM+akpZl9RCymGGIfJuY8RGDaADYwtlk41CxzF4eBNgFfe/iy42e1E6wqH7GtalZMFji083J4V2F1Qs837fE0m+oEL+Jy7UGSQHYVRWwayTiw582ORKLZQdpsKSQ/kDKlrph2r/hB16QkS1JbFESYQ9A3XLnKUGKuG+ZWAktoS7Fw2QfLMM88hJCdCqm0uVvbc8ZHcBL21maVQFm4q4hKyr3cP1YnkK/tuDQhKVlzfu0TheZnUov3Tp/hUGVCNQyfs57fDwoTkEullbHVftUvmI1xluVocYZNr3Kl5c4Z5ui+5pHtUL9U5YmGLHde1p98B6sIZlvPnRMKU1hfElv+CJuH6ojD9grG7N4GSxgn5tG03+f5SZEZmm94G6DPomjJ+QY+wHudAvxzFDtURcB5CbomCXqnRbYInK6XBsMQL6dDLTxkeoWzwQP+aOUWLw8NxhCvKqNCOtqlGUNIhWLgPJb5/UmdnEReWmTLAC67nNBOhIlVcmVuTbw2y4E37CAEprYsK0fbOSC/XiJSmRMp7MERwSRpX9Y2yLM8VZlnu4ewQ7EuS4mnN/tdv4VzLuuLY+3DVJsRjO0huuPBJWLBVG7NijMhQ9axiCG73Gb9Ljo7pY/E+dA+RwByUNrG2FBHSfuLbbZoyp2bTCfHPFMoNA7pkCfPXcY2ZpIvdGSZhBuM9Mx2xeXHzbnmTwGQzFom0xPZk0KHOyNneBsJeCgrhLERuYMGAq7RnhiPbG0figBpigQxyEpZgoTNbBZOSwteoEXvbpYlNC9yMdEiT7bhvvX6gy7jbKTGVQ5PWxHf4smxTkrV0aItoPFJmmegWidqpLsIhBD7IEbmAthEM1OSKmifC523RVAeb6cqphqkKbRLfb2dkmq3EiRV1E8Hv1CADUtgWsQ5Yt1yrdFBBiFH83bRYDUhuk2vlVCHDA2WA/XARIds09sB3DhyLzFgb84PExVaL8W0h+soD3eH+SQECi1CXYokpB271BcK5to6JmJNvSdXHpxZIVKclrGPB2dZYgnwdFoTEr5rgz2TQdxs13SZXKyXMapkxsw68tBxx5wlFKUIiyCCcMYdODBD0dZtFtoG3Aq6Omv041bF8TyJmV1iKmKmWSAmQJwspblGGlbfD/Jp+YYzX9WRGE+bBbtvIHqGhdB2c64AsysGD+C8NbqKbWYUzjQslhpOWxkHPpPoVtio6V4P4Vm67m0Gbk4iPiUJrM9F5TgnKYc5yEiSAIslTtqtk8fNYreNkEQ00zDazDVhNakRlVIagjieFofjGfXna59okfMeZVti0Z/rXXUw92mCOkux3QucsjjV03JjhlQB8evz/HxUebXHdKhnjLo3KbsnbTrmp3xubGR3thHWZA3tYIOA4RUSnHhjpVn6MWbr7hivG/iwiFk7MlbFpuyWJnGaGdrON7x6psXHs5gddO/ARxg6NctDB81mtF+h3YkCYOi8MabNlCPJ+Ryp50dOTWtDh7I9vmd6R9vGHLtX8JjLWO5UB34fT7DTmSFmeL0TskhtQeIA5qZnpxC24KJdDqyWXlWvDLIIRG05KTNbQreSGp+SwgnoRXbm5hDjKFU/G2pR07DIC7kKGo+agWIKqEUjyKir4HR13KfWhk4ddFkquaRzdbroasRJoGaRIwgJtaUDlIeEAJIYrgsqFrNiX4Db/VSmTp7t0p1OY3pEZfkZ0o3zljKoXGr2QIwVrSImRKamul0GSJQYa8dYE+CCmsLOmSkkDs3PacMdN3VxyJeHmbTj9/zEpVgCcupKAhV0JafSYQK3Kb6GJnkDwB1XolBdGidhKvhLqTqsZxRgHGsc9ufyniaNquVOBxEqJ4vDqQs2VQ4QMmoaE1ZcWPpitlAbFF7SXoUimH08Sz5BL85yINuNHgk6S0dRxOUBwTQZlGPz0kDwydSlUmqFz6vCCmq1OZX1nJBTWMOBEyTuBDs7ncwOE0DLZPwkXWU2gxLAer2feovCSFZTAaim5FwWz1NrnViGXkfVsSfFbGITGFrv0x2YrOd0ah+cc0dV0xx1ZHC69NdTB9djNjsHAMqxy5rnu+2sY4okZgcESK6ujzxPAJAzh3TIdlYhza5NoloKSdSGm4ML2aIJsa5c8Ud21Yg8FHRQhKqlEA4mxJxiEAtZDlLZOxMUnyFcCHCqyIpqNNN0c+qRC4SeGScGQ+fFemOe9I3FdHsGZXTCYqZZvQS02YrD+4Wabyg2nQICn21I5YQs0KQuenrtt0Eyg+HGgjfMRrSmDH7oCqEVt5o8q8IpL7sJPjfQ1ly2R2rCzCELPbir9cI1JZlaO5M1c2gaa1VR25XVEIs2EaAkz0xyu525FF43q5nCzxsDleZ9kPir/tCRdZIh9ZJcn1F3a08VxY8g1FIxhS73ji1Nutpoz+02mBtQsOcMzGuMlZL6TTuluQJzp74NTbu9RRzPdDRFZ1q5XW72WBmIIuzUYjlxktiduFNSq8SMQoGUNwvd3nf7bA5Kk3Rm4bnWictlWpyqxoi83Sz2xMkEA5gwNqOOb2s/TWKZXTlRZmEsaNeNIpGt0UDOsmZPu3Y3WzKJ4avmbm8QWybe7RlxYuuThE9JHufA3dzab6bbbBPU06mSo0sd9/OEAL0kPhwoa6nOwwNJ7lsZTpFUUU62SlOWCc/1SM0ZRIYPKX/gIsESm6Jil4W5Y7CNLeT7hRVJRys5I8fMn2WBoHILp3abpt1X0oSAVCxp94OBsNRotSHpnF36ZXpWD63m1+CxtifkRIvimcPxS5sRfAEH4r21mrQBQ1krnjE3QCBZDaVO6K0wJ/VSFadzmhIFdJvFPrJxj5VJg9XONtDdPOtBOiK1mX3aNH28SgNvJ5gk2za03/GhlbELI9EOmkOKoqstcefQw0RSN6QGoMPkvZpL9m51dlbTDTNfdDJgDxaIM+vjPYaDqA2ZK5BRDsNwVtrzgYCXBT6HHTUOWzmTOcpV8yzCGED1Fcqp8FRitlpZ1pS0Uzy3iszKgqe1GK42cmulm7Y/EmFDorAug6mvbom2X3sTsz4ujOg0UVNGPksyVu5kZks13B53idk8b2DN1lO4wwVMOR+3Wk83jTmY3EI1zKpJC632EjzjhPOCY7CdJy4Jkt8hBpwwq+12g6INpitoUXLRVHeYE6V36S71w25qJ37BEzSdTkKSVXHXZqY7h6TddV7Z57ZZLZUlI2x8H9/yVZwdJYXRq/40DM4qwNltn8/XtkwxZBTuA4+qZuycYMK+jNeEic53QjCvGmsQd+lgIfsW4uZ5sbW8fivZWUZ6ulNN1igdzb2A0BuNhKG62igYQcJHLsM9zYUxX8Yw83zopkBC9OCShUwjPMzPSF8zIsoFbY65DCS3oTKT+F4yeiwMeI1p0Z3rZXuaL4V5a7dUySquHBYSqJrTQB68DkEsmMUR3IDgiikz3fd2EUZoHrnLB7Mot0RxulhzfBeCQBiRG0Eqlm6xb6cGS0PHc+zZUirsnYHVO3cddt4G7c+7eC97aCrQp5oJ8g5f+QEczeZSgzD0Zqmiq6o2RWyG5CtPMaaomTLrBtA4S82741xiFWapG8tlM0fleQ6LaDhfKeWEEzBB0h0XigrBO1R9uVkkc0eIdgf6PCfRbb10N1yFktiWUbMDRKVnlnagAKn7nLPbigzkOQ+HcLo3TuGmBnWlFBFTYU7SRF4lfNxPB+Vi5ZuVZGWKcIKx2Z4nBqdk0NrbozwNTJhn9lodBK7r+Dij28Bh7fC0KQuWVlAUAZN+M88AsNBDHsAOKZRu1YphlQY/cGxYaDtq2UcRE8IroD0s5AO96fO+NwQzISEC5ps1pmb6Eq2Vdrne7LJmpjFe5a+k3iyl5FTuj93cYMqtEa9heMtuNFqhyAjdrFUOgFLSzc0aOGIARMH71YIdzC+jUujBmpT2c3Q7mdLVwLB2rhSCHCFoAkLLVN3SJYtm/nFXnFnIKUQ6joIyOpkJsquqvS+hPiPkUXowYBgN6JCBj9oaWXNb+DBbHgzV8LQzb0+rMt3h5yDZOjQIgmeCMk6D6Zp2Bw/CkeOYTIKwzsg8Z/qd3Mgig0D5sUWVWC9Pi2A7PU4lSEtSVpl25+I4Rw2+SiJRm9aO7rVwt2XdekYR0wlraa3pBtF5LWRmi/YRL+WYpDhHV9amjOs3dc0fkYp0AaKNZ8Ic4qZowe/tYsOuvZVwrgMA4OS5fQpLZTpoWHwVC7lTHgsu3yhwpK640A5MM9qw6NkQoXOZU4dz4OplJda7fTmQbrNyGECDZap0LAstshylzfwUBuiSXfba8DBvmnXKaa68LOnFEWKwtjcZtFFharkWa5BOYEdR1d0a5rV8vYs50iUV04HmJmpHpAlvmelacEWLPh4pLDpWnUXKSSCvV1PaR3iJn0+5GtH9TDYXLMn4RWi5QnEQJgFGcFm1iVq0oegYTndbSFzYypZB+dWKxYUFniQuv3cB24z2MGzwPbMbXH/Wjyq3Xi4qPlFqZu2dtdhP90pazSknLLNGdLrT4UQ1265rK+hMrgJQPi74wNAoPIJIDzNbLgrilKa2mIxn7nK1m6ELHsQFg+JcYSsNZtowB0yUaGEYR/Eo0DCUH3btsfTCo14I3VY5INoZZnfldB6d+WK13JtwpqObrRDrHcUy7GxwgsU1PzssU1T1kGKRmZpvBUIxYJUPZ89DBzUFgPPaQiNvrQiEfkitXeit0gVb6PxsahnOfr7gp60dGw4tLsuMyAMzDTQBYJAybpDGQfA1fQoC2zSBjmx2sCoyRbfqRT4G+z0x4xwIVyoCmM5NbiX7ExewEK50QfCosFizsLTY7HeoARb1zAxEnDSKdU6h4AR0+TMrV8dDDlDHypPKusrzXWk6eqkH9hKi1XCYJuzCX3aKp03ohALCSm+sLJvtQDhfbTthUxsgQhGTapsFCIC3IABQ3gpYAwiEu4A4/qQEah0ACKhhwIQf/vGDDAHWDpiDgylvEZOWkoEgSLezHTOZ4AFA1tpg2VHApKiSoDvlGkBqdQ3T2oBMRRI8BJZggGGTvZIBhzID9sECmAIHwNAIikX6Jjz0hyW1DfLpoYNpc6FJPeJ54gzeHShg0/lpdUrCwjD1sJm0BwKljhbG6PFxzQwGzxnp8tbqVCvJFuT64JtaBrh9KWPERDXFqaOWhHZMZCZMCAbBMEwHW9H0Mj/HtFiex0KmmK4DoMURPYNiJ6hteiyXjXCOticY4Lhyb7InHzJP7ikPIJmiitaq/XMZnkkDIbLWOqFL5chOzxAzs3JTrAg9dBNysWpxnYvKwcSvoH6zLIH5qotZWMmyOY+fvDQmEYlZNs1OMFAfm0WbPegHi6Mo77G2gKyQ1/t0FR+nnINDlosURtytOXFFbafltFl254l8yAyTaDXYiJFSnqz7odj5yO6G4bfTdtNIMvJWF8ktlsw1jR38a3pfZ4A/9bAFqa46dDsHBMSBhrb7sJiY6JLCXWOzwcmNlIddIwRHYAYceknzUDiMrMnBZRrgyCgT1d9rS8JklZZdnBGH3qopwswlOliKqt+q+mHbFU05OVsGTJK7o5YH9nZb7SGrWxOGMMEH84sTfKb3iZjHUiswW57hHSfoG8JYs8nJJBuFljnAYmK9WO+jHRX0MUchPXBWidKJF+E8XUknNBMtXdkIa3fXpsgCr9aTdr9zmhQK9y6rmUK9mG8j4aDU6zgIy64d+C7OsDlBl0kke9V87cz4wNRbfu9t44g7BTa2BegjTJYIQdFHtACiKozU8+EARi6hb5b7Q2ud95PsTNShWW03oMjPKUFcGKaEDYaJxOYGzc3I87RZ2QbrYHpMT8hYO0F7OoVPPdUaNQfnBGMcFqoyuOuddkZ3GzsyVSncIvv5hFwZuwV/3mxXM4GDokqpu/iw3AyW3raVDlTk7BKuXkB6ssCn4TFGONtBVMlvpmf2eIZsVQabgpbVTgrz1uGCLQkP/I4rksID+1xnE2y7X2NGPTeV/DjoZcCyynWdMVqYrAu3UL263LpWskq9qWjAgOCtsqNACJUPhyDII5kVzWSenw4OxsFgTo2wK4ICTXyz6pKUAfGKxWVs7u6dk7I6da6YafGa4VwOVYwsmih04/ZIUyzsJNxuSrs52RZeeLWuSo01y5q0VTNucs5Pi8NUwEi7lEzXUzb8HkQk8pziXiM2qcwunbO5PfVbtDnhmInX55aRa9Kbzc6Wul+sDrt4mL5WWGdY0m7BGQecbytrmDLOK7EKKYfdyHZAJDStrxbSeY6C2UwkOitay4WpcITvEgkbbrypp4dWwUvOcvAFQ8ukq64LLMAAVj2s8PAGrAfXJ7LpaMIGCxVkc2zFmFm77hF5FfVCbmwUq4r7uYyFDmuqmD6QtWYJwTVdE0Ut0bcXzHzVNkofq4cTut2Lh4OQTPnak0SYFS0VGtpm0Flx4g5amIWGv6N5TZ4TGuFQ9C6MTL5dLlSudspTrKmds5OjNcnnyxOPGLsSsk3dzgI8lqF0yfRZptFkijcwYWlqey5ZLkOWId9Undp2ne2w2xNlbhC7Ny1iPT067ITLlp3mOvwJBRaeae2JNTKt03Y5ORQdIzNd0LilNLc21Zme7v0Wipiju17xBWH6cAsl2wNI52VVGScZPrLG8P9kr0rWUajBUlmtaX2zggRosoHRkq5DxoripuUz3/D3J3cJECnIS6l+7LayeoQ3G6iHw1WlKzgUiAcGi2V3EPFTs6mxCT/ziGiHQBbvrsL4RJz0/Gj1+y08sC7oVrRrlozkIrtRDjt7Yg3u2m7FR13K6LqpFf4KB3M+3DG6O9+cciGouZVBbTlWRGOLlvDBf9zpwLTojiE7CbeKcl5ksxkt+DU/W6iG6kFHfjETVSTnSSkgurZs15YoqCt43R9nPtuuVzKIbWkBRDOooEmAEYtBTwCTrDwxXnzIJe8gCsOkb60LOcYV0kF7N2IHnqWHchMO/xT8vFoJlV7uTs4yS3cVmWmtxcCZiZ91dR7G6UrDVCrD1oMXYaiVm3f+HiXX+5nWMuJenE5ZYqaasUuW+kKMF6fazPEdbVXdQTBOQana8GLbbvClHy4NxmRnujar9khpBrlLLFazrt2cJiFNu7UpFbwTZsTivF/OF3InnE+G3qZnwSkUdo6RlrDmwJw8yXR7sN1dMCficAdYosepmhdPjmg7EbPS3uyUEJnOXVye2Cc6L1BgGJKQOFiH4+bTnsH9VYSvyNSXKcwVdpG6UHAud+CiG1400WADNUqzVlaoFg8zL50ChN3GU7eywmVLrxpe7Gdb9LherqeiznRqtGD9nBN3NL3lp2fVgU0FzGTO37B4G2Z6mWvYDs4gyVMtMebwRrGmi53Kcoa7khI9CjfbQ5aV6LpWuuMODjYuMpHXAj04pssEaS3e3IDb9WDeh5vj3ukkY77ssgSdYtVM8Ay15lLzVAUTKs6jTdIN03ySC5t8v+Zdv2BWCOJhDqwz0zkNNIvJbrlrYK3bn1dxBQz+28nTu9WSA5njoaSHqSmeKnBHN+YiqpkyVtAVP5ik/hxaz2YLUzlwsTcXLRSKB8dlN52sKFxbNscaVBLWy3bdjuudGXpotrtjJ7eLZQOG1cQ4yvJsyc5O88pi9rzHMNJO9M+WXktl3yKhftqw/QwIVG8jFviZFB1I1zqpFbB88AuWGA5BlZJhi2YqevzxzJN0cRYB/zw1t5janDmjyvrFxlutu4O84BZnSLAshz/PzCozFhbasRnlWXjg2mWczrigg8OuL+q5NFvV2Qx3MVjLzkXfJ2FI4ySIQuSCPNsldtKa1TxKwuo0bfbI3N4jxwBcJPp5Z871OCoOKzn1B1uDKI2VEGfgKdkZmUBmgnVoERkDcV9dibOoWHRlwSwicp9xJxlTYpnjgN4/1MFUAY9djjTHNpnnNCXTIJ7nSJesZY6gCK0y4ZNhp12zEIrUOjcGI80CGy6sswWcqY0NhsmMgGd2p4lwqZoUlxrOYqXnNWTzuRHYxMzm0EWE00tMOe4WBrQNBlt7u4kMQhNcnhGBrUFOzxuzD/ZFd4YI09LCXWHOETpeoguqSwSxw/VJ7+N6l6qBtFORSgWPXJFTql7HGoDIOu/TtCVmdFHOlos+584ZabuQW7jhzod33ums4041xVPVTjO27xvNDzvIOEWuT/HFZkfAclnZLVOspc7K0enJ1ifDIwVZO65qBxxFesVOGHgHcqC8mevbZC/7Tggce2Eub1se3mX7WM0McGXVUFhDZOueKc3D1CPkwK1P8ha1xhEVlwjJWzb8SdwjWEKTsRV76eh7pckk5RGIWsk9RNkTko43Az+81lozOiMuqGBr68rBbiM4nkdY3JJqLEmOdU6JiFfdg9UBMTWo3sU2yQvmcGLqaYSQB1qa7nUxkxghPmlbsSSPULlJS0iXdF9dk/V5w6HWMGuquMgXu9yXiMZzjAMNwsOMGU5mGI3WrIjwdq6neAGQc87H151+6lkfXqfL/dkiycO+XUQnBz2wWrbQtoi644N5a4uarScRSsa6fKAOsJY27n6uISsG36yq0HAIgMOOXcwcuHG3CzxoZrdXTjkvrZRDvTpUXLKS4KQ6xwZ3Pio4EArr0FjVlUbGwwxu5/B027l7TG5jjZivqihJMkxbhthKX7qRUK+6ye60ha3BxwZZsGC8wCaRvhQRRtc0Uthupb1akkzfHPJmECJodQ4iB4tt0sE8/IgnPk+IgbzWQlScbIrWSHLZSmvHOkEr/JzJO887dgQdJ2DUTad1ttJWcxbng9UEbRSuswCogGiyBllY42ll0U1BOa8pdgUtnTqTV/Plbm8c9tw89Xt7ZcHcdOMfZssQ11WU5mosICpia4tTBI0ZnypCS/I4k3E5iJmkOKisoNXBAtQsnIA8rEiLEBf6ybmNlgRGh2XUJxp55PUugY3AQaFVn7G1xG21c2c4Ih8BC9Wlu7oyYGaqx4HlAgxQGXVNrldYu6YkQA91stJKTwyKbQPrDScGJerziyO/puqIX4nMhi0gJuIXIaq4wqGImxUa6Msd7p4biF6IoLXY92Kd2byI6K7CTQhcQVF1u+tjc88mvbOc1/UipfJs7tuyBUsL6aha8U705iu47I/ETstsIj4OEwM0GaxxrJvJ3kQfDA5MWEYVJq+3EQceCwbjAevUsbbkiq20EbVhbtmdyq2/wE0rtocZDDexBnBjrd+yMx5zDYfzj1SigjoAs368DgpJVGuYxaYmRORzdgbCztkr8MHQgs7dsuZlk5KNeR/6G9vflX7vTM/rHMkOaruuLVg20H3kT8TtMdKVXLePxFyzV6nTc4e96JwmK09r2CyhXK6Vd/X2QEypQT0AAAkFS+LIDL43lZzhuJsH9dETwqhBUUB02pz3VxYiGOuq9VEGgkRup1czNgzsMmP5Ukn2oLDMNlgNOtBxxraItGs73mqHzmWVJiqR8GgR3PYoAlOeo6BDNge5vghjJz9GdG1N1y53snveibcrp8QROHLXsu4LUNLPCTXTRJEz4rXGxVkKw7MM96H5wRK17cqNKIbkFczJ4Y0ATVtDcba+2s5loixi+Ri6ZZY2m2awFgeDShqsaNdIHX8QkD2Mz63dstkEVCkhg9Hly0si81b5qibZvX/u99Ng5VPrYhfze8ivrFmj7HCitgD0JB4UaVl2zXyliNl+RhpTjGZKba8b6WoXBX6Dzqu5zXTJMkImjDffl8Qw5+rhZgGedusu1+ebVdgZi7Dzc49BC2MdsYhXacmcCj10j4YbUzxV4X7pbFpTnDS7HRakUjejydJeWrupUskrmAn9o3zgaXe3OKOx0pOBMOvPIDvnMYVyGpygHZ7raBFPpcHf2QeHItiAQQQIR15VeX95sg5kWixPCr9OFDAM/E3Ho1K/BoH26O1TJNrs9Bqd2ilXnUyQmlVdkcx2bF4sO0ctLM0kVRRXrZ1KREXkssUhkneqUM9llovWicqQjpfuAIXEpT2E79axahGl4CsTa6LqkRxXCySUqG2/Ycxky+J7NHPlIIem25ALUc4MC7xTGDvgq6B2yT6omdlCPCc6imK8VC2mDC5JpAdO3SPQu7W2m+2p2GadrSxkiw6Yh+XyAGGJepRPqxNWB/NlK8WNYnh7k16X3ib0J7TjgRi/cgpwEZih2zubCbiKSisMhLZUW93DDZJMiaoevG05S6YGpwInd52Du7KKC2LDiOTBWZcyw+HwkQcPwZZY62sN2MyW85ZF82OvHYDTEqUPRFmdHSXd8egMShBRb7bipPUNqY5gDzG0pWHQ4Ew8Dzbr/ETj0QLb42iWcrAmQfsYofcV5Jz2cbBXSnGn76Ez4Z2xAxwRWlM5zCyuLUux8EXU443FsjiwMsqTFvuuAcBOm5piuZZ6lalBLdvvFtB8XYlHBWGVDHDple7FluLax50kEntygyxjK6/qubG1Oj1fxVw1d0oazknu1K87FaBjY7fCOFTJ8MjbCYbl+TIKIRpK6hrPBNPVMF1RpLUkt2R4PGzoAtsUO2aRHf2eWx6ELgMnkS2tiKllglOPlMj9Xom4euer+MzjVdlVj/omKxtQY08dcBJox+5oswfjw4yuhG1/oCdEx8XcSeh3iwQQpztpzaVrosu5VAnx7NAv9+Y6PZgOORfE3TZcTbatgseSxXpi2YFnndxAY7ZoJ8cSKM1hciLgCQaXFFXs7BBFpha074+Ng6FI4m30oihBix+G0wwAdhUtHfryTE3hZZ74GUma0jBZMtGOxYWGNSsM7kIqbZxEgY+keUzkvQpzh549nWiTXjGKJVgd2/A+7wCtfeCySWH3kbLdqvYasq3Bzo1VQj76Z1YVkN47krBhLogjSjhQOAiFvFYyNfMTO+YXPR+pRbU19Nw5nvbl8A8wx2DajAfXyTb5xaAz7A0FsrMQptokkerBFjnLJ8sjyBZRdsMknW7izZn1UhEDOdmmB1Vv7qYqPo3KkrY0CcljeFZqOnaIjaLsFHI3mUgVNoEWdogtbEtcVJbWRaLY53GUiNuz0Z8UcbfQ1aWyrA/CAY+PtbX21zbLDoZHPEtBlsoXQZEu9hQVxPLJLBabhati0UreTcQZvy2qo02XaethrVomVHDuZTcBj2idHF3JqRbH4oAtJotlVjVTV+uWOzMgF0tPcqM286igiTZtLa9YG0yzXasB7WnwDmudWdLMUaHSfVa7ReKweEUY3nHiwocjORhFptTaUONlzW5zJNfGIMX7atMvsn5ZHJaJYDoYMLjZTBSk1nprEbFGD3aeyLL7wR3WBN0PUHhK50AwnXebHWRP17UEhSF43O313jILQVTao2I0m5ILV7UEKLwkVGCdnsi43M8RGAOxqWXre8xRjzMQZ/0VknvqejeYAmdsO9ix3IHoW3eKx1thFRcbYM/MZ5Eg5OxAked7ctMusKialgWm5J1XLMWdNljhR3FO6SbP7JPBbzxRe6+acdLqJBeb6aY0ZzxVE+xqIzdBzdNraRg6HslN0bN+Eo9NBWwq3Aho5dAqYjo0w2APZb42z1s2mcaHAoc9aEZLGElzWyDX1ViOaGpqMVqlpiAKrDhanLkOzw7eVNnPRRWTSH1SLHyDPBrbCYeHm3Bi6wbZwwtu2wMlszUVCE+mqdjJJASX83hKH3oggHSX64bf7nqvIUmw09OpUHf2sU/mW2FPlnyDMcBs76SMHvaIF/AxY+TLIGaBHWiEMycmsIgnex4OoU23L7Bp7sUduzYQURTOC5EKqTBYISdrpearxUoojFAwwvxwCvexF23WEmhNk12B5P1UVFxsIQmDpcBsllZdNL2oxrAGicaKO8XgotnCs2C54BrTNFT8BISbZc4ZPkt0UdGtV4M77yYbVCh4jZ6zC8VL0t3BPe+12fqM4w68aSIgx3gD6+0tKGCK41aKGIY8i6lKjzjNUhu8BlFMMg6NKabtdkfJzBFel/fAbs+A+oraOvOO6w3D3grGZtdw5wLrybXdbqTaNpTjiVivsjjIwrnAhC6vz9ec3HS0WnCFIWrHHItm21rL6n2vL5Je6lchSXb+ti7R89qVsuJsKInKRUQnnQFrokuntYjpBnCufGpaRdPCSMF2XofhIdpC6UxE4hmGkIs1ES8MgKNt52hYTE3WM1O3tu5iRwnbcgosArzpe1HWoSjImPCwgCeiZepsngE+7+ZOpmceZ6l2pNb4OR0cBEd2SUnFPIpW0GI1OqLCQRN3FO0ES9VPLDOoHNOOz75XbWDN6Np0UJXbJSDPFA1aLRnm1E+QlMJrCinJ0/RYA5YBaOaiNCZZ6WjQKTCPBdVp7BrCgzResnMGiyMhaptlN1OLgKjlUOhIPUe2h1PXoZTokBjaVmEM5LOja+X6Ke09ikFy0W5ZQ46WCihOFxGzATl4K5EbJyPLKbneg2VmwYvdIgdnS3hrr9v1QfU6QWnUYcZlNZcTT4uW7Oh66Mb8gJ0tvRN8YxFHcaAdmU6fyeBKl1nYtKG9GaRsCUoeqRmUzCtLfpcU3DbbchjfEYlAbWyc4HuBajQcSOuIPtSUjgNAQ9C1QgZRkJto0OEKM+UG78RZz2Nwg1sQeFr1a37nusYM62S5z51NJg8T2xGhrfl0Es3tjJxIAnFASS1FF9t5gAAK7kr2qW/LRmpsbVb3cXAOHRFmoQbrB/Xe7bbVmd7BvHPuGriwtqvBdZkxYU5ixtI+ipQ2JSPCOe44Fihw0KeWB983iaXYE94h2SAuQZhrrawThEY9kle7nlgdcYIdzJfBjeYkpdbCZZogeAWuqYTvE7DyW3xTiIrQgK4zLXyNOIr9vAEavs45Kb+hCHtwwwkbJjAf8xCQwigoIGzCB1HUIzwMd2zMgQPUxW0QJ70ARzDEsX0IJQiQgEj0EsvS5HaW+fnnKN3fwH/9V+jXm/LgJze5+wX89Zqscfj687//ehOE/0xEzTVgJvddP7wLmLlDYioDEKt8U+gvA9QzsEts+c+5+8Kr+4u29dlSoC93N3zhBY2d3qdLv8tMcCHgOeoxQGhA/eGnN+/+4yHW8PbvfQzz2/+d/+/k7ce3wz8fPmt5GLOJ9/7yazL++9ObH0ZDPg5PvU3Nfw2fHmOmH4VQj2n+fg4uyX8+XKIe/3zw9k/jbTJ3YZk/XxPL/gPB3M/C2m+juB8o/5Ph3D+9+fvNJSlDNFDzOLL7LlD2lrZrhDcBeTZs4zgMoyCBYTDhkbYNoi4ED8675wyy7FABSJAegbsISgUuiDkoaaMOCSI26iLv/olI1LvUfWOk3d0Nfv9QKKqd74sv/zHwwBkvSRsY8cneD6XGL0Vx+b0e/oHh8Vv87uPj3n93uZnsf60VwbhcT7I20L+++zBGh39Rx+wfD8G5Y1uexQ5P8301ErgMi0FgRzrGJAcDrdckCTefTHsg9NPaLgrtkFc3nxTfCwdRLwfkiWfnnlyVQ5/fPIqRfg5zzRn3KHR6HBHDmM8+j6kt6MFKu3DhyteBD1cW/Wkd8O7jbYFrHPM42icD/runt71zvYXsy+0dCoL07TKe78te80NeY9TH8o9ivp9CsIpyC3HfnA83n47peDnOi33+O+P4kSzdfv+B3Py54X2nd356IVkI8jvJQtDvkoX8iUwAL6K4pgz5r47Al1DfpgxBUZh46fXjlCGvsdyvsdyvsdyvsdyvsdyvsdyvsdyvsdyvsdyvsdyvsdyvsdyvsdyvsdyvsdyvsdyvsdyvsdyvsdyvsdyvsdyvsdyvsdyvsdyvsdyvsdyvsdyvsdyvsdyvsdyvsdyvsdyvsdyvsdyvsdyvsdyvsdyvsdyvsdyvsdyvsdyvsdyvsdyvsdyvsdyvsdyvsdyvsdyvsdyvsdyvsdyvsdyvsdyvsdyvsdz/f4rlfiGmEv2dmErspQvYsWcXsH/KXXu8hP2XXxwc/eWXMQLnRVzX4EqSgiAEIl0PgVCMgH0voFwcQREXpBzUJREPJhGfQnHPgxGK9G3YBwcw2HYpx0NR230J9W1wJYij0EuvHwdX3gYQ3Qb83P08Fmly9z2zy8evBji/vf9ROdk1GvnNG1pgbr7cvP1dgVDoKfT2DTcVlizz7c8UePvG1AagWxo+j2G1798+Dy8DPjdpfipz3y+AgbTIH0Nt7fGS4k9XMDdKC9/7FNfZJxi81IW//fBmpkwlej4S8X0h4MeF3shL5tucnV5IB4ch5mC260Ew6hM4GRAgAmIO4hG+a8MBRmHkMNAo8L7JjKD8bmvG+Le3N5ObBw59eHM7ToZyj5AAN28fjdy3b0ayBoj/vAQ2v3XTpMzTKPLzt7/cvMUQCqR8AkN8G7NBCMIwMBikCrQ9yEVQ2CZQ16YolHJ8kIK9wPEoDEZReBBB26fgAHn78Yp1DHqL7NIvvrVxNCJ2YcoF0YB0KISASdQnYcglCQoj8KEuknDhALddEEID20UGWSRtMMAdiPRJFKFg2wsGxH9/M3T/jwjHIcpDSSogXBdxUHxQXJRLgHBgk+RgeA7qz4cH99PF3cB3hlHkUwGE+jbk+ZSL4B7u3RFe+Hkduv6IEvVsEAlgHKZQ28HHU2A2NDAA93wfdRzcJuFBc6IBQvmjZTMwAXdc0B8GIophngd5P+QFhGOgi3jkoGhRxx1V7HgTPYEFUAANZHswNihoZyDXgUEbdkh0YANkD2weBjpI4tCFF28ESR0V18CQd//r37ND9jX5eZSOL1/fAbWdA03TAEGaD877VV6ArHKi0P367tevSe6fqzD3by4FPg8FitwFttznEcv4/uvXLffLL8WYQeD9BebD8PDnQYS+3L7xyyqbZtn7r++23Nfhs66c8c/w6Ou7C6znfBnhP/3Vc96PD74mQZVcbwKP/dJ+/3P24eY/vyYjf8Lg5v2/hMW3UVGOz4cXN/lQQZ7cjFGav978/Qp3++y3r++cMZfE13df/joWKcL+Uuzj13fXCMTxxaiirggfnn4cgP42kPL3kZqfr7rgy3ccsD0vTQpAurBrfQG4sOPnMRAyChP/y/u9X97Fc4/BjQOzr4Nx4NU+TPZD62/+/QYFb365AS+t/vm+878MPPn018Av3cM0it5f2/RWZZdjH5ZhGfkfB98z8r+F3sclK/Ha/P1d2Q83U/Xm0uiP40Rw//zj0K7Lu2sTP769+XyL9mZMV6CxQ+s9u7Q/PQkXHXhxj/qv4IjgUMbRt9jOT37+IpZPf4zCLYpbDI8QcIq8ummDb3ewN+acVdibC6OHhg7s+57ZN7LCDOprtru558WFNW+/Jlcp+tkfs0n8PjMvIGNRv3X9bJS5b2WX+R/jYeqx9/7HUS7GDvw4dukLxF7Lj0bOldo7fH/99wfy7p7dLIWVoN0g4NuPVzS/3QvL3+5pzv2iisovv10hvr67k6BRUr8TqI93EKNxELqX+WUEui15feekdu5Nh7FUXxC8Ly4ZWD48cERO/Pd3vEiv7a/tqPLvG3h9eNu6W4hLZ3yH+u0dOY+q1fPof6TOC94nFYaJ57dKWpX/7c18jPlJpdd+ddMqKS+1DsbjD6qk5cF+fP9vH56LzYsoY7sdKv9DnNMlq9Ls+9V0+/5OxD58BF+s5FrH3+5lpkir3PWficvDNDm+ulW+l+E2qr1BcQP0PcTtOLzOA9+34nZefAmHen11W5gZFM5LCL6bBV9C821UVcA92OcL2LNW3r8fUTxo1/v3g566MukKcPs1+dtlJF78hLcPWTsGE/Mbr7Oq9m2hDn7BvS4YTdpvfnKJeb8dvR9HiG+6NHTPdD0YVrok0DLD/p8nj9XlVJ2z6vWxIBnTpTDAahz5TdVnqiZousZ+uFc5X78mbwfC/v2v79688fzgxo/D8v3p4039RUoT/8Mvb27nx/omLG7GR9cn4+fi14ywQVQVhy9aXvkfrrmFoqFAWITJMCUlrv++/njz3gvd8uNNFBbDv06aRh9vhsJj0dQuP3x4hnQwKt9+GU3LkQ+fvSrOihGNnxRV7n+zCzcMv3Bj2pmPN8XQfd9OfldcKBh++5md2+Woot+//fj2483bX95++PASlcXzxtzXO4z19/WTUhcGDTbv+8Fb+njzb2MTsqr8dpkWL+z6OMyisT+M6i8QDN426tZmeHA9Po8Y7uu9oLrg+fII29CKS/qfL4+K/T/FPW172riy3/M8+Q+6XvZibzALtEmbZL2nNKFtbhPIAbI9u4TDAnaALTHUhjY05f72Oy+SLZuXJD33PKcfGpBmRqPRaDQzEtLl2WWFykGhVsojeooB+Tcn+kOv/5FlRUCyGwMY5p/wuiXJ5hScOGSsZUTXNwAISs8+MXIkjg9NkAfhtOOOHhYsvZvTPH9Avc3BN+5GXl7eYMxnN/ZLJBrwrVuGlUejOoV1h4Ghb48A5i58GnRN8A9h+QLk4bTD1idWWa4TDkQ+ICvXONKFDt1tRd9pJkQX9fz86RZbHcy9kASAV0bg31KxYOSSOLYdLvz+MJj4k3mIMEWSmC2lQyWlNVjTbhiCw+aOfA0J/4/vzhhOX+YhnlRI7TU6++m7OlH8T3eC1QUvEAP+zSRVupLl2thwd9G1ARh8eVF8kcuL0rEwklQg6BA3eNHRk+4GeujqnWPhTtItqduAgOUb4E678ycukTf7yII1l7+8eIakfQ9TPV4/1QQYJGHk8XIvk3IZ+U9zkJx5Zwns5R328pMVYViP0HEcmTAc0ng1V4Z1guWv8Rq4C5iFzsIL14PgrXv92TsYnffe4gSNDPhGm8GvpniVjgQPHX+yHgwcAVgiZ01lRlfVTgcDd6rMl9uEzopa0710pCqAwfqWUkRl82IbLG15bE3ycgmWxsjSLPy+tHxgaXSrJ/4LVVRTdLKL98Ys6PohuhqdoA8ReNJQarXkLhDAg+awdbRfKLSX1NYsWMSNol8ZQOdo8YQV1g3NR5hiuSxSxCIqKnB5uCsFIEItdrA9KJALsxF0v6iObG+5dVQsRD0BeRK1PBhv08AJgmiGtUGwqfmYZi1ZTeaQq9a2sRYcbWACHj7a6CliHyLm16LC+KWaCoJtqCwBgIfB29ggwXCci1m9zb4kAWIcCGA+3vZn3sVGA0ckhBBvhgChaaHc7/KUcAm/jGZDk1tAz4k8QTU2/mRGNB+nF5rA8auMzmMVSUk4oQiSrqbE2G4LImfF21FbugI8WTt4gaFnoqSkFxAGfeg7FrAgGQ7EeL/kDsWhCa5FAM5wWmLPEiAxAJcEKM0hx0AGJIAZIarcHQNEsUGCeDIZt4U+SFvnzxG189OWzltbdH03YkM66FSmtSzRkq22V4bPAChDNav5pwkGqpUPSQYiOGzUVJys61GErkSUxE0wTHAphtl5XWUbYA1dXYzT+tmbpsF6oWisakYw+RImVCNqDrSj1Zbjh4kfBGvJiciZIF56A5xFSIZZG3bDDuawALrrL0yMcUyJpaW2wMomka0IuR+Ga3C1nNZ6VHR0JZvAp0FJsg6HtFI/cMZG3OkFQHu7GmwkDDNX/54HqFC2lmhpYysbR43iT95k2d/nXR+YDVwa7+MBA7TZwOVo9/iGzI7aiWBIANO3Jhhas5e18ulF+RJvFS2fVRsAXSrpNC+umrRb12mc1C4r2OlqrYoXuZZPO7Xq+e/A2A5ISe545FUC2YqErNWEi1u89NZU6tf9AoOt6gOv67LrYcpFOOJBbTvSHhmwgNYPkK1NcLxNB4CpO/EQR78VTxmoO1xqoHLL6kyQHz1v2pkG3s3ojs1ZNKTGybtys1O7al5eyW068tC0wgqNhDZ8DjmQINyrBn2snzia92bwTbkwiNVmvXzS7OjIBErkq28rjc5F+bTCJGrn56/LJ+87OqFoAIERIMCQaU6TTJLmgXLoZGKNQYg4NEhwKftUu6QPzQBE1+v2P0o6asEYg9fqkWNO6zLOZ/oAUxrHYmVFxo/6opwYBqu9SQkolwdqf34G+kppQqk6igM5/pz1WI+rBJTOm+g8K3Itu7RfOGqn0ykItkpgW6M8CjpGHPKu9vPiDMK56lvAkAmaTk70wAnpD3OiA0LGJIfBBRydhsPJF7s/DwLPn4FiA/gQpp4GHHifIa4NQo9GGiY6Q3H40KGESgQ7Dm0uR9hJMBpQIHwDNG7Cn5Fu+PM9b9kumQrfr6xR4AJmDSxp3xt3R77zWYbSc1hmQYM816ZNJqc7Bm9hJ4qcY55Ya0yrVWijzsQVfCLCALMKzfEaGG9eSrkcKYlxKfINZSQWLpF9PJJ0ZWl/7HXR1ze5D5RlUf6z7FeH9Bhg+GtCt1tHJfR7l5q1fXvW7NCNptD7iF0YU7mvBYxjwseQXwFI7j5aO5jdUdWU6dHqtAaAOGj026gRSUm3+Jf12mlUj6Sw/Q57kQkfU+GKZKZTFucEpjstKf6r6vtq7UPV2Jmuo0StpMhg2QYaYWc2RR8j5dl8Jz9raT2Ro51wfgseyiLWLBy9ydjtaLok3VA+ioDLo1LjuDgXIyvl0nUrVi3skQzPEQaFmqqMfTmsh06m6qP9EG4Dy9jb0ja9OEiIorZo/8R4jIwpGcxtouRibqcat1SjszrVWKVKnU8s+H4mV8aPOVyqwWvxhKZhw5t3URHAoXMoV89rfQSZGF5egigM0et5BLVKVn1H8y+5mDQwXTxdDz1NQlvJud2sdBpX4CTUf8e5zczA9A3mvu8FHTzEsnqW5YGbkMHcjijjryis8fFStWk/j2vJt+NsUwS84vTJSuWTaZgPOWexHOpX1eo2L1AjusYdXKGT8Dp1XCvKLWjdWvFgpI8Z3KY8xg0ulO5zYYCJ/lMHlXESeO7aSvKMknV8PTUGTa6nl0tbgkOG63Rc8Rvu2NILEQlfjXZoqXchzK7Y9RnlIu/H8+e3XoAmk/qrBaegNRjIYVMicvRm7OWBNDRIRfYviuqQdROmsFnIiZGwxTMrJ25Hvony5zawfE88t1IkNI7zXdc1/1pxteSIRk41nw3c6uURT7i95rmmJK41KxNLxFbrr7bed8WuJX4V+4VCklUNjxOYmOLO5/OtJrCIhz1O23EGnDugbQLeG3Rk4giY2xNFzJyC0sFXLF1u2CB85Ibgw8J6nHeq5iDjrPioDLhxCqhF9LMXhCNKpxaVyzUBm+a7aN6PMPxNOFt4qKv2Xq2SiUmgsm076+fOhupo3h3RWrGztFKxOQpj3ZHU/S1HUg9Wn/nQHvk4L1crZX7H4vlppXH2tvq8w4+eyOc/Tsr1+hmewa2c1H6r1H/HY6trG+GzqoWDwrPnzz334ODg0PNKL3rus563X9wvdV+6B8/77ouD570D1+33X+Bxuf3+M6jpFg/7bu/F4U2xuJY0n1U9fHG45qjqQeKo6iva6p/c3OzugAWhVYY+yRgTY543zo//e1Mwdnem+ORQOPTG4zzMMnwB5zKYoIyEXbnz+nNc6y8nsOovxOsF7rsJ+4S1QRgZiN6d1deO+HkXz/98FDdnHWc4l+Rkf/jhB3FZ+1CpZ/eyjXeV83NmW0B59jgzcpBq/gwnfe3GlFjWMT52BHZpPBMF6572rg4Ly+PMNGT4xrwXyseYRnsSKX/u+YPZ0Dr+b2G2Gv1gNJ29BmF8jB96AnTLMqRsIL7/kbbmziu/Vc5/NOSTMj/3xI/1kx93dyK+U0zv7mTIhpdpV+gSYjAPgry+52Qbs8k0C9X9ketkE6d3y+nzu0rrEJx3j2tj92QFb+X9H3ztSD1p5GRPjq5h9AZB91bgkITXl/Nm8/drgsDhRXDc1WxSC87aB5QkyHtvUe3eQifCcGh7bml/v3j4qlQ6WoHe3YkON771ZnaDlvt33p3ZwvW61W5n6PUr+bZUBtyBJzzDRbtL8ZHILU9wAd3EI1yy1Uc9syWW2FL00BYxGb+1hbVLrZeyfZsaaE6uZjcv1/c1wTq/YaS9X4TnYvIgMdUBibnETdv+MEbM0IZtiofK3RRmoP0HOFjr28bpQt/lJKCZ88JapSrZlE+d+U4Cyz6Q5SEYAM+pel/sWu8vrz8T3CYgyAfDykHQXeDQTaYL2XKulGO8XCGX8eXjX5mRfxHqhMB6XEBAFixADl731pQ4Cnwyn22Fl2BuGuZEPuMBwsqfejcY58gGiINcKwWjfcbNZ+jJafQUiOSFhxOaymMnmxOTmcMh01QHqiPNOebuJlWJ+O05jAzKSJIjWC7RsNVY9RDrSYrx9utoukUpHz0WjPm0sRhsG4u3f4ym/08DMdg+EIP/7EDUPbfbn9m0FrZ4aWpn8JsyhDOHvqrJisvlVaNSv6zX3pydV2CmIsQssl5pgFz2F+3br1nq0i/1ymmZspmNSrVx1jz7rUKJ2F+5wVbgDbw7Wqgl0Vkua/5tZJmh14fOfJtNPnr+t+501OrY7b999BbWdfhT68hp459/Xoe542zWaO+BHc0UnV8C6qLn0qN7mxu47hUPS9f54sHL6/y1e1/MPVvGH3pAa/UFv63ECmvI/Cv0XgBzZrF1YB+2v5Wu3W/PWoVi23oCbaUGs6QGlF3XvvJHn+YejvN5d+EFZubvc2/u5TINz/NzkVo0KEeTW6cmoBqq+OjoLKyCptWCD8MRmLMp9YFgY7tOep3hsyQblxz5HCWhEvzQSSzdkoBSTWQ2j+dkuyM/BL/AzAxXWkSYVmbYBpWFWIOKqKvQ/Cf8a7amYX8Ofv3thOxC+9U999qRvT9GbnhKHAMjTmZ4TGw6zItckJaWfDcS+LIhoDabECvY/PTiOQgl6I5X3nnE/5uLqSfOve6NJZ3HUmFJRF6Z2PPooUh0eUR22h144Bj8lAUfOPbsRAOPzs/GCxTFyIeICoQy92e0tBYV3eJSezw0AypHoj2bebfQyBT8hgVzJLLv3p9cHV03JjezL93Au26Mbid+E2q6t9Jta4RDdWopzQk4lnJ0SArYTv6ywSY3LxsagdSoP3Zfjp3QPbtIEiW0XMqmxUX4UCW4hwlj3liE0BHo9njMZ6BCUCffC0b9PL6iqTQVJgHEb90+eGFTDOT5WUvzfyYjn/ueNmYiezr54tNJi6yVexjYCz+ia/0Y0EmfHvlUdAmiWbm4ZNQGpoxspSe4NyPSgcvuDkhKTYWpsOm4wUa109RNzhgIXhgJR4p/dBRGs4l+8nPf+jwZuW1ZBWYDS5fqgdRbHBjvScMgp5g2DEgaR4Lb4P6gXp4MR2MXlTPVD4K36+imhx6/n7p9LohvvKB+GELwo/iENawT+5+eKJb2X5YOiyWWB9RV7maej0u9sElNshhWg5XN97r4Amx+Ghbxz+xuhuubauPNJKhAr6JWdmXORnNtaG0HtI3RaSf/BkwpzYMYA0cYkLTR0UMxqQYR+d4a4tKyrqUOXjKPsxxRGulVs6gjCEFxnUYvWUsRGtSu1kjbqcSfrET7aqYtvpWEYXM8YwdF/VtqQEv1MbIdsiTSXDL8ut5mtygurRZKczEIDWFFcV4h0UiLb0mFpfhgBVqzwgpuVRC6MA3K9hh7mVuSkQXYeYQVzOEYUb5vagEbd+eM/rKwu/NlSD/go8bVsjCYiYJUdW5IWy9idNaqzMSRyKceL5gkaqkxEp1Mw4SX7OBOOTTZVtn+o2t/LdiHez+374svC7mlc1/IlZZZgqTf8zgFCnEjSbIog7v8BUsT6OalK8GjiHOhL/vhiecF674HuB+V30xVe3sJh5yyQTI6hinxJpjcvqZHFFWIe3ubp5S3HuX2lQFZxu1iQkcLW4sFaF3BKQb4mWVnTTBOjMTEGFDabflt0wwXNj7WrDBI0QQ5yFHe5Zv+k71vMlPaGbnf6Fd913nMF3+Lf6aDv+PJaobjYY2FcWCHaM+gn8UblmIoml3U/6+OlgNIdflr3GDm6wYZfVUQhBDJ5+sDsvn675HL90iGLwxA+XyNjNQyIaS0LsGEVGsPFOOZBdv7JAp3xRuttKhKX/Y0MQ4cLbLWxM2NDPSeZAYbRD5IrjSDSOiDB4Q++HcJ/fvEPgARoNgHs3WrgTYC0Uow8sG3AJcJz+n/S37MmMzWWDOcKMkx2/S1MsoqC7wKYz5KYt8CPA4tP0cv81pZJUdporUusp0eW7EI9FrhgKOTKPgmGjCCSiikMsIGH7fv+Ri4WfxCfE+XHEV2bFZfz8GF84LdHclI2MuXp1NAxafTzezWXQxOYjsYsmEou56Cdnguu4e57I2QyVOLTvLI4uYGmEWF3OhcVupvavWLyilQ2Iwlj13iGY4kh4kJ9ECb5ebJOz6lhpjKMaNl+lGor8uNSrV8UWkAuhaoY0Rigueae2UqojDKab9VOm5Ly7Ie1ZjcW/q+lsDV29rQaQV/0Xkq95MikeiOy0bcs2qzUq80mnjEKYWvTwtFBLc4Jnj/QAFnhnuHf1MzXEOLpzkhkTsCPk6hkHBJkA67I5mZo+Xe1MSPaOiLwSFT4URbvINUyHHFnvGn/0u0Ncw9+9Xg5piXPUdEFDV3LSkeI71Zl7kHZpdqPxKc07G0sNbTabBKMI1h9+kEeFOR8ONc75MoxBuPxmbkzOw7CdNWL9lQ2gBMaxMv1awi63UzMnW83e2gvUhZw1q9o7T/svz7eQ0MVrXW7LwBHT5F+7Pkc0tPaCTukSJY+e3slB67j6l+n8UGgUT2GqaP93nk0mYjUol2wyyqef2oLKCiQPR+EOe4WzxeCJVzF3j4VyS2UAQe6RYuF+Hv0vAeLLpgJRzCF1gvB0OBZ4zsiQ+U+IhOHkMm77Y2n23dQXjSTg7Te8QWgirJUXbSkhk62qz5EIxwI1hKC7eq5Ee1e7x5ewcX94ySk+c6kp/EVoIsinBwv7a7wEzX64PnerTUnCRjpZiuhoOBeypul9ySMkwXjpF85x49ZPXY/bHoPfzIfVZjL2vl7OI+9GL9W/e91Fv3WY3LrLx7zOypA2RZOkAGK5U8PwbEQeOdbBb333FjvXH2D0HnEEQIAhh7Nv3aVIAb1J3yKaYB+oZdPMR+uZgNJ76Y+J6Np29IuaaLvyOC6xhZ/BU9fI/2TqAkZ2T/NP6U/4HzuifgD6Y46TCo8+B5PIGOj6bUqRth+EKz5zZRsPvdIBh5gQ1R2wSGd4G/wY1/mUy8PxP2mbBfC7svIs4NNnLyfKryVFvXwbXfzqps7T571DBjV/xBnNhqnpuZGzxag7qDY+ykcqSYAaUuRSLgRBPC7mXzXER5N3Q96UeUCQD5u8oYwAuCNAD+gjQCwINCKQA6mc0AWiKN5mOUpot5y8nPOey6FbEtbdymRFyMH6OsmUQaLRqDVHLMfAx9C4I13xNxI2rEDnjE8PYC55WZtXs4rjAR7C4oNKY57TCk75fwX6mEn26zOTNrgPsU09+D71ZOO71BZsFp4FGqeP8CmVzZACkHA8qBY0wliA885gPa82Hku5Mvwv7QBT5BO8KwOQzm4k9c6GxwoijtAC34bjdwwYxN54Afa8MqDGWIhaYPKPS+k5nmK3d4cMP1tox1rCQ5M/GLHQo6wBkL/vQvz8+q7zuVf5zhubVTcp6CPlfVKxc1PIgbeUTRQHD9qsdvpDx+htvkzBprnFnGMCyllHVo8rNnr0uoRwMJg4S/t9ieTpdnj6Bzu2vOuR1o59ye6nrs7jzOv9jd+T8=""),-15); assert hashlib.sha256(b).hexdigest()==""3e42ff5453c3a7d13173a7b65113281df1d7b740d4b59d957bd78ed810fa49d7""; print(b.decode(""utf-8"",""replace""),end="""")
-                                                                     ^
-SyntaxError: invalid decimal literal
+LOCAL_APPLY3_CARRIER_RECOVERY5_BEGIN=true
+COMMAND_ID=NEWFI-260907-A-PORTAL200-APPLY4DESIGN5
+MUTATION_SCOPE=NONE_READ_ONLY
+LOCAL_MUTATIONS_PERFORMED=NO
+TARGET_OLD_COMMAND_ID=NEWFI-260907-PORTAL200-APPLY3
+SEED_COUNT=41
+SEED_BASENAMES=NEWFI.txt,NEWFI-260907-A-PORTAL200-APPLY4PREP1.stdout.txt,NEWFI-260907-B-PORTAL200-RUNNERCONTRACT2_REMOTE.txt,NEWFI-260907-B-PORTAL200-RUNNERCONTRACT2_STDOUT.txt,NEWFI-260907-B-PORTAL200-RUNNERCONTRACT4_REMOTE.txt,NEWFI-260907-B-PORTAL200-RUNNERCONTRACT4_STDOUT.txt,NEWFI-260907-B-PORTAL200-RUNNERCONTRACT5_REMOTE.txt,NEWFI-260907-B-PORTAL200-RUNNERCONTRACT5_STDOUT.txt,newfi-38-portal200-apply.cmd,newfi-39-portal200-rca1.cmd,newfi-40-plink-portal200-rca.cmd,newfi-41-plink-portal200-rca3.cmd,newfi-45-pageant-portal200-rca4.cmd,newfi-46-portal200-http-rca.cmd,newfi-48-portal200-apply2.cmd,newfi-49-portal200-preflight-rca.cmd,newfi-50-portal200-preflight-tail-rca.cmd,newfi-51-portal200-prod-http-network-rca.cmd,newfi-52-prod-public-http-rca.cmd,newfi-53-public-css-regex-rca.cmd,newfi-54-portal200-apply3.cmd,newfi-55-portal200-apply3-rca.cmd,newfi-56-portal200-apply3-failure-contract-rca.cmd,newfi-57-portal200-contract-rule-rca.cmd,newfi-58-portal200-exact-contract-rca.cmd,newfi-59-portal200-contract-ast-rca.cmd,newfi-60-portal200-import-contract-discovery.cmd,newfi-61-portal200-import-compact-discovery.cmd,newfi-62-xf-addon-rebuild-help.cmd,NEWFI45_PORTAL200_RCA4_REMOTE.txt,NEWFI45_PORTAL200_RCA4_REPORT.txt,NEWFI46_PORTAL200_HTTP_RCA_REMOTE.txt,NEWFI46_PORTAL200_HTTP_RCA_REPORT.txt,NEWFI46_PORTAL200_HTTP_RCA_STDOUT.txt,NEWFI48_PORTAL200_APPLY2_REMOTE.txt,NEWFI54_PORTAL200_APPLY3_REMOTE.txt,NEWFI55_REMOTE.txt,NEWFI55_STDOUT.txt,NEWFI56_REMOTE.txt,NEWFI56_STDOUT.txt,NEWFI_PARALLEL_FULL_HANDOFF_2026-09-07.txt
+SEED_SHA256=869d6fdf2d4ac222d9ab4b83242563676f201e6ab21b84360fa73fc7f9bf7195,240d0fad482deb05c93289edd7ac58a84e34b98fc620d1e924b561aace8630bb,92255a714b86966ab5a15a86d18c6257c6c131b20520a6d2d2443b8fe969e93a,9bffe2728a05e52f03ec52fddfcce229588b6f6cff59e8932d6c8b5ae97c592b,e92d1a64266be86cc8e5441ff9f51e2161e35e00ffd12dce1eb049a4b6437dd0,53c8ea2dc91c33b2872da3974ac5a682cbdc907c9d232a29921b674d490d474e,0b4ba8d2b1eef91c627884071bbcdeea8ad9b4f6c04c8650e44eb468253d15f6,a59a4b7a482a0a39a51e08553749c1f15bcf74d4ba449f6d50caf7a6ba60f9b5,8481b33b162a78f0e1398b69fda50f581ace72f87cdfb2a16fb66ceb67fa4987,34245e3a7c02145e7f11e3c7919385ff955e739a5b278ede66f8ec91499a31e4,a398e89eec09cca84a907876dfe46cf491d8b61c402c1dc4e4ec36eb92167845,11ea567ce0485bd87c5da8292c4d01d55e741a85b75fe0bf5073ca33133055f7,96b2de593d982ef7a5cd09c5618e6aabaac259f896a70cc8f1b476b0c3b16a58,2ce247a8dae973819605d246273b294bf23ce1d118c3e8b92517696caff927c9,f0ad32266492990e58a90991f2d6ae808c3e57c1ad53244bfcd26100e163cd73,2d5a55fbb00e63a280680b312d3eff3e28d524e29e8acf9ee8cae77b7c7d1f2e,fae07cfd5e9196871cd8bec8305262c95ecd09654994675e9a4ac4617d761f99,9aca123af4a9674c2bc10f308a65b622dce616cac17fbfe9b58db3782fbd2d0e,c8e9abf642daba2118f3419a00ceaeb0a0cc9a54ae75575e5e903a8db8fd1c1d,92b919e1b4e0b910da5b8357619d853c5791dc73fb8a70d097563128d7c818e7,573c5c94fe59ed072e094281668ce9847dc4a9882019a2b89d8ba5f190d92176,6c98cb81713e91d9866d264e59c513b8a968c4f52bfbad55450957524600bb10,69d7a46640fd020c0daab39c3195ca77ff777242c22b419f66dfcb69be3a8a23,1f99ab8666c4d51844b8e95bf3768cb1b017921824e9ba8857a6579dfaafb6af,e10dcbd211b75626199ed50dda79f34ae169caef24ba747c74b9c79ddaab509e,3621712ba5fecff93abca54c601f4f176d976a67344a506a92d6de79918f05a5,07d2b88b41b30e90058fa1d389cc52d1ea3b20b557a962f9004db720bfc8d2b0,88b9f92828c1ee19537526a1eea93a52c59bc2f32a7034e45508e53cca2e3667,c8827d2f8b0ddc34771c1c71ffbf517d1bd117dcf36b4d3e5439ae262bc86c32,7fc78755edbeee8c49d3d47e26a723c01ee0e1e6b022b8fd2f70ccacdf8f4338,edba9db8c9ddedb0fe3e727c7ed5a255d1da6de82da722431f3db053abff2f38,3ea9e7e83411127caf13af674570f0ef9ac968b13393b0a173ce1344d6a29cf0,1c91f522bb94d4ce292bb451dd847f394362c0a8f4745ae8823a5eed33e2a10b,cfd23052413cad9d435f9aba290956e93d9191312d568cd1cc69437fc602ad03,474b251535372a61e8be1acf215c1cc2240f8414bdd1c5e03309fd5faa2f8f99,71da2a66224075527d8aa04c1281fdb7a2b9f078d76c349fc05b48a4b803a4c3,f4600697557109030fc188376f1407fc02e4ec2eff2c635d81e2438f8a325fe3,65ff188b6b7bd06f59feca719f4fad6e07ff8304ef157425b162b3928f674d31,5f2eb373b3b37d29dff72b8b7d5cc1346283f7b2de02ae2eb95a229e542c5468,b2968ec8823fa4bb7b3d6fd4a25f25d6a486eb9740ecc6ef362d1b31e5f439b2,869d6fdf2d4ac222d9ab4b83242563676f201e6ab21b84360fa73fc7f9bf7195
+DECODED_LAYER_COUNT=64
+STRONG_LAYER_COUNT=3
+SOURCE_LAYER_COUNT=9
+CHOSEN_LAYER_COUNT=9
+CANDIDATE_LAYER_1_SOURCE=file:NEWFI.txt
+CANDIDATE_LAYER_1_SHA256=869d6fdf2d4ac222d9ab4b83242563676f201e6ab21b84360fa73fc7f9bf7195
+CANDIDATE_LAYER_1_BYTES=57343
+CANDIDATE_LAYER_1_TEXT_BEGIN
+
+ПОЛНЫЙ ПАРАЛЛЕЛЬНЫЙ HANDOFF: NEWFI / PORTAL200
+Дата сборки: 2026-09-07
+Назначение: начать работу сразу в двух чатах без повторного восстановления контекста.
+
+===============================================================================
+0. КРИТИЧЕСКОЕ РАЗДЕЛЕНИЕ ПРОЕКТОВ
+===============================================================================
+
+Приложенный handoff второго чата относится к KINGOFWOLK CSP.
+
+KINGOFWOLK:
+- agreed safe CSP stage полностью закрыт;
+- shared counter = 0;
+- final accepted checkpoint = KOW-260907-A-FINAL1;
+- его product-state НЕ переносить в NEWFI.
+
+Из KINGOFWOLK для NEWFI переиспользуются только проверенные operational rules:
+- true-parallel read-only direct bridge;
+- один writer для любых изменений;
+- Pageant -> Plink -> pve01 transport;
+- authority checks;
+- homelab-chat-run contracts;
+- immutable Gitea readback;
+- unique COMMAND_ID;
+- fail-closed drift handling;
+- destructive Git / raw SQL mutation prohibition.
+
+Полный KINGOFWOLK handoff приложен ниже как APPENDIX A.
+
+===============================================================================
+1. АКТИВНЫЙ ПРОЕКТ
+===============================================================================
+
+Проект: NEWFI.
+Активный участок: Portal200.
+
+Сейчас НЕ продолжаем KingOfWolk и НЕ занимаемся Linux.
+
+Текущая рабочая проблема:
+предыдущая change-команда Portal200 APPLY3 не является accepted checkpoint.
+После неё выполнены read-only RCA/discovery шаги.
+
+===============================================================================
+2. AUTHORITATIVE GITEA RUNTIME
+===============================================================================
+
+Runtime repo:
+homelab-admin/homelab-public-context
+
+Branch:
+assistant-runtime
+
+Authoritative exact readback:
+runtime/history/<COMMAND_ID>.txt
+
+Не полагаться на generic latest без точного COMMAND_ID.
+
+Ключевые текущие NEWFI checkpoints:
+
+A) NEWFI-260907-PORTAL200-APPLY3
+
+STATUS=FAIL
+RC=76
+HOST=pve01
+MODE=change
+COMPONENT=newfi-portal200-deploy
+
+Критично:
+RESULT_CONTRACT_VALID=false
+RESULT_CONTRACT_STATUS=UNKNOWN
+RESULT_CONTRACT_ERROR=INVALID_CONTRACT:ValueError
+COMMAND_RC=1
+CHANGES_MADE=unknown
+ROLLBACK_STARTED=unknown
+ROLLBACK_RESTORED=null
+MUTATION_OUTCOME=UNKNOWN
+
+Следствие:
+APPLY3 НЕЛЬЗЯ считать ни успешным deploy, ни доказанным rollback.
+Не повторять этот COMMAND_ID.
+Не строить следующий change на предположении, что production/staging точно остались
+в старом состоянии.
+
+B) NEWFI-260907-PORTAL200-CONTRACTAST1
+
+STATUS=OK
+RC=0
+MODE=read-only
+COMPONENT=newfi-portal200-contract-ast-rca
+CHANGES_MADE=false
+MUTATION_OUTCOME=NO_MUTATION
+
+Назначение:
+read-only RCA runner result-contract / AST после APPLY3.
+
+Это accepted diagnostic checkpoint.
+
+C) NEWFI-260907-PORTAL200-IMPORTDISC2
+
+STATUS=OK
+RC=0
+MODE=read-only
+COMPONENT=newfi-portal200-import-compact-discovery
+CHANGES_MADE=false
+MUTATION_OUTCOME=NO_MUTATION
+
+Назначение:
+compact read-only discovery import path + runner-contract requirements.
+
+Из опубликованного evidence видно, что runner contract жёстко валидирует как минимум:
+- поддерживаемую version;
+- command_id exact match;
+- status только OK / BLOCKED / FAIL;
+- changes_made обязан быть boolean.
+
+При APPLY4 не импровизировать contract JSON:
+сначала перечитать CONTRACTAST1/IMPORTDISC2 и runner source.
+
+D) NEWFI-260907-PORTAL200-REBUILDHELP1
+
+STATUS=OK
+RC=0
+MODE=read-only
+COMPONENT=newfi-portal200-rebuild-help
+CHANGES_MADE=false
+MUTATION_OUTCOME=NO_MUTATION
+
+Ключевой вывод:
+
+XenForo CLI поддерживает штатный:
+xf:addon-rebuild [options] [--] <id>
+
+Arguments:
+id = Add-On ID
+
+Option:
+-f, --force
+Skip verifying that the add-on is rebuildable
+
+Следствие:
+старый ручной PHP/import loop не должен быть механизмом следующего deploy.
+Следующий candidate должен опираться на штатный XenForo add-on rebuild,
+НО exact Add-On ID сначала должен быть подтверждён read-only evidence.
+Не hardcode Newfi/Portal только по памяти.
+
+===============================================================================
+3. ГЛАВНЫЙ ВЫВОД ПО APPLY3
+===============================================================================
+
+APPLY3 имеет ДВЕ независимые проблемы, которые нельзя смешивать:
+
+1. RUNNER / PUBLICATION CONTRACT FAILURE
+   Runner отклонил result contract:
+   INVALID_CONTRACT:ValueError.
+
+2. PRODUCT MUTATION STATE НЕ ДОКАЗАН
+   Outer runtime показывает:
+   CHANGES_MADE=unknown
+   ROLLBACK_STARTED=unknown
+   MUTATION_OUTCOME=UNKNOWN
+
+Поэтому правильная последовательность сейчас:
+
+НЕ:
+"сразу повторить deploy как APPLY4"
+
+А:
+- параллельно восстановить current prestate;
+- параллельно построить корректный APPLY4 design;
+- change запускать только после read-only PASS prestate.
+
+===============================================================================
+4. ПАРАЛЛЕЛЬНАЯ МОДЕЛЬ ДЛЯ NEWFI
+===============================================================================
+
+Использовать проверенную KOW concurrency model.
+
+LANE A = SINGLE WRITER / DEPLOY DESIGN
+LANE B = TRUE PARALLEL READ-ONLY AUDITOR
+
+Разрешено одновременно:
+- Lane A читает Git/Gitea/reference и строит новый carrier;
+- Lane B выполняет direct read-only audit;
+- оба читают immutable Gitea history.
+
+Запрещено:
+- два change одновременно;
+- два git commit/push writer;
+- два application/XenForo mutation path;
+- повтор failed COMMAND_ID;
+- Lane B mutation.
+
+На момент фактического APPLY4:
+Lane A — единственный writer.
+Lane B не должен запускать новый state-sensitive snapshot в середине mutation,
+кроме специально спроектированного concurrent monitor с drift guards.
+
+===============================================================================
+5. COMMAND_ID FAMILY ДЛЯ НОВОЙ ПАРАЛЛЕЛЬНОЙ СЕССИИ
+===============================================================================
+
+Чтобы не путать старую историю:
+
+Lane A:
+NEWFI-260907-A-PORTAL200-...
+
+Lane B:
+NEWFI-260907-B-PORTAL200-...
+
+Каждый attempt:
+новый COMMAND_ID.
+
+Не reuse:
+NEWFI-260907-PORTAL200-APPLY3
+или любой другой failed ID.
+
+===============================================================================
+6. LANE B — ПЕРВАЯ ЗАДАЧА, КОТОРУЮ МОЖНО ЗАПУСКАТЬ СРАЗУ
+===============================================================================
+
+Цель:
+POST-APPLY3 CURRENT-STATE RECOVERY AUDIT.
+
+Только read-only.
+
+Lane B должен доказать:
+
+1. Authority:
+   /etc/pve/HOMELAB_ASSISTANT_ERROR_REGISTER.md
+   /etc/pve/31_HOMELAB_REFERENCE.md
+   readable + nonempty + прочитаны.
+
+2. Runner:
+   current /usr/local/sbin/homelab-chat-run SHA;
+   exact result-contract schema;
+   duplicate command semantics.
+
+3. Git:
+   authoritative NEWFI repo/worktree;
+   branch;
+   local HEAD;
+   remote HEAD;
+   clean/dirty;
+   relevant Portal200 files + hashes;
+   no unknown local mutation.
+
+4. XenForo environment:
+   exact production/staging VM/CT IDs;
+   exact docroots;
+   exact XenForo versions;
+   service health;
+   current addon list.
+
+5. Exact Portal Add-On ID:
+   resolve from add-on metadata/live XF state.
+   Do not mutate.
+   Candidate methods:
+   - xf:addon-list;
+   - addon.json;
+   - xf_addon read-only SELECT;
+   - existing deployment metadata.
+
+6. Current Portal add-on state:
+   installed/active/version;
+   pending rebuild/install state if observable read-only;
+   relevant cache/code-cache presence;
+   current route behavior.
+
+7. APPLY3 aftermath:
+   whether product files differ from accepted pre-APPLY3 baseline;
+   whether DB/install state changed;
+   whether staging changed;
+   whether production changed;
+   whether rollback evidence exists.
+
+8. Health:
+   Nginx / PHP-FPM / MariaDB / related app services;
+   HTTP codes for important NEWFI routes.
+
+9. DB:
+   SELECT only.
+   No UPDATE/INSERT/DELETE/ALTER.
+
+10. Final decision:
+   ELIGIBLE_FOR_PORTAL200_APPLY4_PREP
+   or exact HOLD_...
+
+Lane B output should be bounded and sanitized.
+No secrets/private credentials.
+
+===============================================================================
+7. LANE A — ПЕРВАЯ ЗАДАЧА, КОТОРУЮ МОЖНО ДЕЛАТЬ ПАРАЛЛЕЛЬНО
+===============================================================================
+
+Lane A НЕ должен ждать Lane B, чтобы начать design.
+
+Он может сразу:
+
+1. перечитать:
+   APPLY3
+   CONTRACTAST1
+   IMPORTDISC2
+   REBUILDHELP1
+
+2. перечитать:
+   /etc/pve/HOMELAB_ASSISTANT_ERROR_REGISTER.md
+   /etc/pve/31_HOMELAB_REFERENCE.md
+
+3. найти authoritative NEWFI Git worktree / branch / Portal200 deployment source.
+
+4. построить APPLY4 carrier OFFLINE / PREP ONLY.
+
+5. В APPLY4 заранее исправить:
+   - result contract;
+   - official XenForo rebuild path;
+   - fail-closed prestate;
+   - explicit rollback semantics;
+   - exact mutation accounting;
+   - exact COMMAND_ID;
+   - publication/readback.
+
+6. Не запускать APPLY4 mutation, пока Lane B не подтвердил current-state eligibility.
+
+===============================================================================
+8. APPLY4 — ЧТО ДОЛЖНО БЫТЬ В ДИЗАЙНЕ
+===============================================================================
+
+APPLY4 не должен быть слепым rerun APPLY3.
+
+Обязательные свойства:
+
+A. PRESTATE
+- authority checks;
+- runner SHA;
+- exact Git local/remote/clean;
+- exact expected source bytes/hashes;
+- exact current Portal add-on state;
+- services healthy;
+- target environment identity;
+- no unexplained post-APPLY3 drift.
+
+B. ADD-ON IMPORT / REBUILD
+- use native XenForo command:
+  xf:addon-rebuild <CONFIRMED_ADDON_ID>
+- use -f only if evidence/design shows it is needed;
+- do not return to manual PHP import loop.
+
+C. RESULT CONTRACT
+Must match runner schema exactly.
+At minimum:
+- supported version;
+- exact command_id;
+- status in OK/BLOCKED/FAIL;
+- changes_made boolean;
+- rollback fields with correct types.
+Do not emit unknown where boolean is required.
+
+D. FAIL CLOSED
+If prestate is not exact:
+BLOCKED / no mutation.
+
+E. ROLLBACK
+Before mutation:
+- prove rollback target/material exists;
+- preserve previous product/app state;
+- rollback on any failed verification;
+- verify rollback result.
+
+F. VERIFICATION
+After candidate:
+- XenForo CLI exit;
+- add-on version/state;
+- relevant DB rows read-only;
+- routes;
+- services;
+- XenForo error log;
+- no unexpected file drift.
+
+G. GIT
+If Git promotion belongs in this Portal200 stage:
+- one writer;
+- explicit path staging;
+- git diff --check;
+- no git add .;
+- no reset --hard;
+- no git clean -fd;
+- no force push;
+- verify local == remote after push.
+
+H. PUBLICATION
+Exact runtime/history/<CID>.txt must be readable and match COMMAND_ID.
+
+===============================================================================
+9. ЧТО НЕЛЬЗЯ ДЕЛАТЬ
+===============================================================================
+
+- Не считать APPLY3 успешным.
+- Не считать APPLY3 rollback успешным.
+- Не reuse APPLY3 ID.
+- Не запускать raw SQL mutation.
+- Не запускать manual PHP import loop, пока native rebuild доказан.
+- Не hardcode add-on ID без live/source evidence.
+- Не делать git reset --hard.
+- Не делать git clean -fd.
+- Не force push.
+- Не запускать два writer.
+- Не принимать generic latest как authoritative без exact COMMAND_ID.
+- Не использовать KOW VM/IP/path как NEWFI environment.
+- Не переносить KOW product state в NEWFI.
+
+===============================================================================
+10. WINDOWS / SSH TRANSPORT — ПЕРЕИСПОЛЬЗУЕМ ИЗ KOW
+===============================================================================
+
+Plink:
+C:\Program Files\PuTTY\plink.exe
+
+Pageant:
+C:\Program Files\PuTTY\pageant.exe
+
+SSH key:
+<USERPROFILE>\Documents\ssh\homelab_ed25519.ppk
+
+Encrypted PPK.
+<REDACTED_SENSITIVE_LINE>
+
+Normal transport:
+
+CMD
+ -> PowerShell 5.1
+ -> Start-Process
+ -> Plink -batch -agent -ssh -P 22 -m <remotePath>
+ -> root@<PRIVATE_IPV4>
+ -> pve01
+ -> direct read-only bridge OR homelab-chat-run
+ -> Gitea runtime publication
+ -> exact immutable readback
+
+Do not use:
+- MobaXterm;
+- -i in normal carrier;
+- pause;
+- Notepad;
+- blind host-key acceptance.
+
+PowerShell:
+separate stdout/stderr;
+-NoNewWindow;
+-Wait;
+-PassThru;
+real ExitCode.
+
+Remote command file:
+UTF-8 no BOM;
+one physical line;
+SHA verified.
+
+Large payload:
+zlib + base64;
+SHA256;
+python3 -I -B.
+
+===============================================================================
+11. AUTHORITY CHECKS
+===============================================================================
+
+Перед серьёзной server command:
+
+/etc/pve/HOMELAB_ASSISTANT_ERROR_REGISTER.md
+/etc/pve/31_HOMELAB_REFERENCE.md
+
+Оба:
+readable;
+nonempty;
+прочитать.
+
+Visibly emit:
+
+ERROR_REGISTER_CHECK=OK
+REFERENCE_CHECK=OK
+AUTHORITY_CHECK_SCOPE=READABILITY_ONLY_INCIDENTS_NOT_CLOSED
+
+Fail -> STOP.
+
+===============================================================================
+12. GITEA READBACK
+===============================================================================
+
+Authoritative:
+
+https://git.gram1.ru/homelab-admin/homelab-public-context/raw/branch/assistant-runtime/runtime/history/<COMMAND_ID>.txt
+
+JSON, если нужен:
+
+https://git.gram1.ru/homelab-admin/homelab-public-context/raw/branch/assistant-runtime/runtime/history/<COMMAND_ID>.json
+
+Нельзя делать вывод по runtime/latest.txt,
+если COMMAND_ID не совпадает.
+
+===============================================================================
+13. КАК СИНХРОНИЗИРОВАТЬ ДВА ЧАТА
+===============================================================================
+
+После каждого accepted checkpoint:
+
+1. чат публикует exact COMMAND_ID;
+2. второй чат читает immutable Gitea history;
+3. оба обновляют общий current-state;
+4. FAIL/RCA не считать product progress;
+5. PASS read-only может закрывать audit/preflight;
+6. mutation checkpoint только Lane A.
+
+Если Lane A сделал change:
+Lane B перед следующим audit обязан заново прочитать этот exact checkpoint.
+
+Если Lane B обнаружил HOLD:
+Lane A не запускает mutation до разбора HOLD.
+
+===============================================================================
+14. PROMPT ДЛЯ ЧАТА A — SINGLE WRITER
+===============================================================================
+
+Ты LANE A / SINGLE WRITER для NEWFI Portal200.
+
+Используй Gitea assistant-runtime как machine truth.
+Не занимайся KingOfWolk: KOW CSP agreed stage уже CLOSED.
+
+Current NEWFI checkpoints:
+- APPLY3 FAIL, invalid result contract, mutation outcome UNKNOWN.
+- CONTRACTAST1 OK read-only.
+- IMPORTDISC2 OK read-only.
+- REBUILDHELP1 OK read-only.
+- native XenForo command xf:addon-rebuild [options] <id> подтверждён.
+
+Твоя задача:
+параллельно с Lane B спроектировать NEWFI Portal200 APPLY4,
+но НЕ запускать mutation, пока Lane B не вернёт
+ELIGIBLE_FOR_PORTAL200_APPLY4_PREP.
+
+APPLY4:
+- новый unique COMMAND_ID family NEWFI-260907-A-PORTAL200-...
+- exact authority checks;
+- current-state preconditions;
+- correct homelab-chat-run result contract;
+- native xf:addon-rebuild with exact live-confirmed add-on ID;
+- fail closed;
+- rollback proof;
+- verification;
+- single writer;
+- exact Gitea publication/readback.
+
+Перед каждой реальной mutation заново прочитай последние Lane A + Lane B checkpoints.
+
+===============================================================================
+15. PROMPT ДЛЯ ЧАТА B — READ-ONLY AUDITOR
+===============================================================================
+
+Ты LANE B / STRICT READ-ONLY AUDITOR для NEWFI Portal200.
+
+Никаких Git/application/DB/production mutations.
+
+Используй proven bridge:
+direct read-only phase outside homelab-chat-run;
+serialized sanitized publication through runner.
+
+COMMAND_ID family:
+NEWFI-260907-B-PORTAL200-...
+
+Сразу выполни post-APPLY3 current-state recovery audit:
+
+- authority checks;
+- runner SHA + contract;
+- authoritative Git local/remote/clean;
+- exact NEWFI staging/prod identity;
+- exact XenForo docroot/version;
+- exact Portal Add-On ID;
+- installed/version/rebuildable state;
+- APPLY3 aftermath;
+- file/source hashes;
+- service health;
+- relevant HTTP routes;
+- XF error log state;
+- read-only DB evidence;
+- no mutation.
+
+Final decision:
+ELIGIBLE_FOR_PORTAL200_APPLY4_PREP
+or exact HOLD_...
+
+Публикуй bounded sanitized evidence в immutable Gitea history.
+После публикации сообщи exact COMMAND_ID.
+
+===============================================================================
+16. РЕКОМЕНДУЕМЫЙ СТАРТ СЕЙЧАС
+===============================================================================
+
+Лучший быстрый порядок:
+
+NOW:
+- текущий чат = Lane A;
+- новый второй чат = Lane B.
+
+Одновременно:
+Lane A готовит APPLY4 design.
+Lane B снимает current-state recovery audit.
+
+Когда Lane B PASS:
+Lane A сверяет immutable evidence и запускает единственный change APPLY4.
+
+После APPLY4:
+Lane B выполняет независимый read-only post-change verification,
+если это реально добавляет evidence и не дублирует уже встроенный rollback/canary.
+
+===============================================================================
+17. COUNTER / ROADMAP
+===============================================================================
+
+Не использовать KingOfWolk counter.
+У KOW counter = 0 и scope закрыт.
+
+Для NEWFI ранее использовалась рабочая оценка оставшихся команд,
+но её нельзя считать authoritative runtime state без восстановления NEWFI roadmap.
+
+Первый Lane B recovery audit должен также найти/проверить текущую NEWFI roadmap/
+accepted-stage count, если он хранится в repo/reference.
+
+До этого не печатать ложный точный countdown.
+
+===============================================================================
+18. SOURCE-OF-TRUTH PRIORITY
+===============================================================================
+
+При конфликте:
+
+1. /etc/pve/HOMELAB_ASSISTANT_ERROR_REGISTER.md
+2. /etc/pve/31_HOMELAB_REFERENCE.md
+3. exact immutable Gitea runtime/history/<CID>.txt
+4. authoritative Git source/current live state
+5. этот handoff
+
+Этот handoff ускоряет старт, но не перекрывает более свежий live/Gitea evidence.
+
+===============================================================================
+APPENDIX A
+ПОЛНЫЙ HANDOFF ИЗ ВТОРОГО ЧАТА: KINGOFWOLK CSP
+(сохранён целиком; используется для operational/concurrency rules, не как NEWFI product-state)
+===============================================================================
+
+
+ПОЛНЫЙ HANDOFF: KINGOFWOLK CSP
+Дата контекста: 2026-09-07
+
+1. СТАТУС ПРОЕКТА НА МОМЕНТ HANDOFF
+
+Проект: KingOfWolk forum CSP.
+
+Shared counter:
+0 команд до полного финиша.
+
+Важно: 0 означает, что согласованный безопасный CSP-stage полностью завершён и подтверждён evidence. Это не означает, что CSP доведён до теоретически максимальной жёсткости.
+
+Отдельно оставлены будущие hardening-задачи:
+- удаление style-src 'unsafe-inline';
+- рефакторинг существующего javascript: URL;
+- перевод script-src-elem из Report-Only в enforcing после достаточного периода наблюдения.
+
+Финальный accepted checkpoint:
+
+KOW-260907-A-FINAL1
+STATUS=OK
+RC=0
+DECISION=KINGOFWOLK_CSP_AGREED_STAGE_FINAL_EVIDENCE_CLOSED
+
+Финальный canary не внёс изменений в production.
+
+
+2. CANONICAL KINGOFWOLK ENVIRONMENT
+
+Форум:
+
+Domain:
+https://kingofwolk.ru
+
+Forum VM:
+VM160
+host: pve02
+IP: <PRIVATE_IPV4>
+
+XenForo:
+2.3.12
+XF id: 2031270
+
+Database:
+xf_kingofwolk
+
+Document root:
+/var/www/forums/kingofwolk/public
+
+XF source:
+/var/www/forums/kingofwolk/src/XF
+
+Из ранее принятого baseline:
+
+boardActive = 1
+board title = KingOfWolk
+style id = 2
+style name = KingOfWolk Dark
+
+CAPTCHA = Cloudflare Turnstile
+friendly URLs = enabled
+third-party add-ons = none
+
+users = 2
+admins = 1
+nodes = 13
+threads = 73
+posts = 73
+attachments = 0
+XF errors = 0
+
+Origin-side services были healthy:
+
+Nginx
+MariaDB
+php8.3-fpm
+
+CSP реализуется на edge, а не origin XenForo.
+
+
+3. EDGE / NPMPLUS
+
+Edge находится на:
+
+VM130
+host: pve03
+
+NPMplus:
+
+container: npmplus
+image: zoeyvid/npmplus:2026-06-17-b1
+
+Live KingOfWolk proxy config:
+
+/opt/npmplus/nginx/proxy_host/996.conf
+
+Metadata:
+
+owner: root:root
+mode: 0644
+
+CSP collector log:
+
+/opt/npmplus/csp-reports/kingofwolk-csp-report.log
+
+Log metadata:
+
+root:root
+0600
+
+Directory:
+
+0700
+
+Collector endpoint:
+
+/__csp-report-v1
+
+Semantics:
+
+GET  -> 405
+Allow -> POST
+
+Collector поддерживает:
+
+application/csp-report
+application/reports+json
+application/json
+
+Collector sanitizes:
+- script-sample;
+- query/fragment у URI.
+
+Rotation threshold:
+
+>= 5 MiB
+
+Финальный canary снова подтвердил:
+
+collector GET = 405
+Allow = POST
+
+
+4. GIT — AUTHORITATIVE SOURCE
+
+Используемый repo:
+
+homelab-admin/homelab-ops
+
+Изолированный CSP worktree:
+
+/root/kingofwolk-csp-baseline-20260907
+
+Branch:
+
+forum/kingofwolk-csp-baseline-20260907
+
+Не использовать /srv/homelab-ops для изменений KingOfWolk CSP.
+Исторически он был dirty/diverged и использовался только как reference.
+
+Clone-local Git identity:
+
+user.name  = homelab-ops-bootstrap
+user.email = root@pve01.gram1.ru
+
+Текущий финальный accepted HEAD:
+
+6f584c5faa76d0067b08977aeb583fa0e4de14aa
+
+Parent:
+
+3e5d8584ae6887c292cc910c5796e73d8d20aecd
+
+Commit message:
+
+csp(kingofwolk): stage script nonce and enforce font media
+
+Текущий source file:
+
+deploy/forums/kingofwolk/edge/996.conf
+
+Текущий source SHA / production edge SHA:
+
+458c2cf0763e4790f7d2d3757efd883b25813a31aab4e8dce6f785b8dea48a6e
+
+Финальный canary подтвердил:
+
+Git local HEAD  = 6f584c5faa76d0067b08977aeb583fa0e4de14aa
+Git remote HEAD = 6f584c5faa76d0067b08977aeb583fa0e4de14aa
+worktree clean  = true
+
+И edge до/после финального canary оставался:
+
+458c2cf0763e4790f7d2d3757efd883b25813a31aab4e8dce6f785b8dea48a6e
+
+
+5. ИСТОРИЯ ACCEPTED GIT CSP COMMITS
+
+Последовательность основных accepted commits:
+
+6908d4ebf2552244a68e3c0990fdc3a219c05d2c
+initial CSP baseline docs
+
+f8d1ae6981df35f25d09a41392bc0a26742b7f38
+JoyPixels Report-Only allowance
+
+34f9c76c5cbf81f9cdf7f50d1ac501cf870abc9c
+minimal structural enforcement source
+
+c7a8a68a74fd3eb74cfb708b6bd3b866159b4899
+csp(kingofwolk): enforce same-origin form submissions
+
+Его source SHA:
+
+834973af57263b326ca6aee52b2ecb3fa2cf0fb486e5a77a62d4210395b8d9c3
+
+Следующий:
+
+e4635c9997801a0ea65aad727270c88ee3bdb817
+csp(kingofwolk): enforce PWA self sources
+
+Source SHA:
+
+28e855ff56c4844768f0e8606fe0edc2acb3f548a5c06fa15c0d80ae00e2bc1b
+
+Следующий:
+
+3e5d8584ae6887c292cc910c5796e73d8d20aecd
+csp(kingofwolk): enforce image and network sources
+
+Source SHA:
+
+fc9fb1dbdb6141bfb43a8122dcf3db435a94da48d0a0c02fe9dfae019b1439c5
+
+Финальный текущий commit:
+
+6f584c5faa76d0067b08977aeb583fa0e4de14aa
+csp(kingofwolk): stage script nonce and enforce font media
+
+Source SHA:
+
+458c2cf0763e4790f7d2d3757efd883b25813a31aab4e8dce6f785b8dea48a6e
+
+
+6. ТЕКУЩИЙ PRODUCTION ENFORCING CSP
+
+Финальный enforcing CSP:
+
+base-uri 'self';
+object-src 'none';
+frame-ancestors 'self';
+form-action 'self';
+worker-src 'self';
+manifest-src 'self';
+img-src 'self' data: blob: https://cdn.jsdelivr.net/joypixels/assets/8.0/png/unicode/64/;
+connect-src 'self' https://challenges.cloudflare.com;
+frame-src 'self' https://challenges.cloudflare.com;
+font-src 'self' data:;
+media-src 'self';
+
+В одной строке:
+
+base-uri 'self'; object-src 'none'; frame-ancestors 'self'; form-action 'self'; worker-src 'self'; manifest-src 'self'; img-src 'self' data: blob: https://cdn.jsdelivr.net/joypixels/assets/8.0/png/unicode/64/; connect-src 'self' https://challenges.cloudflare.com; frame-src 'self' https://challenges.cloudflare.com; font-src 'self' data:; media-src 'self';
+
+Что намеренно НЕ enforcing:
+
+default-src
+script-src
+script-src-elem
+script-src-attr
+style-src
+style-src-elem
+style-src-attr
+
+Также enforcing policy не содержит:
+
+'unsafe-inline'
+'unsafe-eval'
+
+Это намеренно: script/style hardening ещё не переведён в production enforcement.
+
+
+7. ТЕКУЩИЙ PRODUCTION REPORT-ONLY CSP
+
+Source-template на edge содержит Nginx variable $request_id.
+
+Логическая policy:
+
+default-src 'self';
+base-uri 'self';
+object-src 'none';
+frame-ancestors 'self';
+form-action 'self';
+
+script-src 'self' 'unsafe-inline' https://challenges.cloudflare.com;
+
+script-src-elem
+    'self'
+    'nonce-$request_id'
+    https://challenges.cloudflare.com;
+
+style-src 'self' 'unsafe-inline';
+
+img-src
+    'self'
+    data:
+    blob:
+    https://cdn.jsdelivr.net/joypixels/assets/8.0/png/unicode/64/;
+
+font-src 'self' data:;
+
+connect-src
+    'self'
+    https://challenges.cloudflare.com;
+
+frame-src
+    'self'
+    https://challenges.cloudflare.com;
+
+worker-src 'self';
+manifest-src 'self';
+media-src 'self';
+
+report-uri /__csp-report-v1;
+
+Точная source-строка:
+
+default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'self'; form-action 'self'; script-src 'self' 'unsafe-inline' https://challenges.cloudflare.com; script-src-elem 'self' 'nonce-$request_id' https://challenges.cloudflare.com; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: https://cdn.jsdelivr.net/joypixels/assets/8.0/png/unicode/64/; font-src 'self' data:; connect-src 'self' https://challenges.cloudflare.com; frame-src 'self' https://challenges.cloudflare.com; worker-src 'self'; manifest-src 'self'; media-src 'self'; report-uri /__csp-report-v1;
+
+При HTTP response $request_id уже заменён Nginx на фактический per-request nonce.
+
+
+8. NGINX NONCE TRANSPORT
+
+Текущий source также содержит transport для nonce-инъекции.
+
+Ключевые строки:
+
+proxy_set_header Accept-Encoding "";
+sub_filter_once off;
+sub_filter '<script' '<script nonce="$request_id"';
+
+Зачем отключено upstream compression:
+
+sub_filter должен видеть HTML body в несжатом виде.
+
+До production promotion был отдельно доказан forwarded-origin request:
+
+HTTP = 200
+Content-Encoding = NONE
+
+Nonce source:
+
+$request_id
+
+В Report-Only header используется:
+
+'nonce-$request_id'
+
+В HTML тот же $request_id инъектируется в каждый <script> tag.
+
+
+9. ФИНАЛЬНЫЙ NONCE EVIDENCE
+
+Финальный checkpoint:
+
+KOW-260907-A-FINAL1
+
+проверил HTML маршруты дважды:
+
+/
+ /login/
+ /register/
+ /help/smilies/
+ /threads/dobro-pozhalovat-na-ofitsial-nyi-forum-kingofwolk.1/
+
+Для каждого запроса проверялось:
+
+HTTP = 200
+ровно один nonce в CSP Report-Only
+nonce не содержит literal $
+nonce имеет допустимый формат
+каждый <script> имеет ровно один nonce
+nonce каждого <script> == nonce из response CSP header
+raw nonce count == parsed script count
+
+Дополнительно:
+
+nonce не должен повторяться между двумя запросами одного route
+nonce не должен совпадать ни с одним nonce других canary requests
+
+Финальный результат:
+
+KOWAFINAL1_NONCE_UNIQUE_ACROSS_ALL_REQUESTS=true
+KOWAFINAL1_NONCE_VALUES_EXPORTED=NO
+
+То есть сами nonce наружу не публиковались.
+
+
+10. CSP REPORT LOG BASELINE
+
+Принятый baseline:
+
+SHA256:
+2f7977cbfaed7953bd70033c0cf92138eedf974f5886fadf4b4971f2d00a4143
+
+lines:
+2
+
+Исторически в нём:
+
+line 1 = synthetic test
+line 2 = historical real JoyPixels violation до allow-list
+
+Этот baseline не менялся через:
+
+- PWA stage;
+- img/connect/frame stage;
+- nonce design;
+- font/media promotion;
+- production Stage2;
+- финальный browser/evidence canary.
+
+Финальный результат:
+
+KOWAFINAL1_NEW_CSP_REPORTS_AFTER_FINAL_BROWSER_CANARY=0
+
+NPMplus:
+
+before = healthy
+after  = healthy
+
+
+11. ДРУГИЕ SECURITY HEADERS
+
+Они не менялись и финальный canary проверил их exact match.
+
+X-Frame-Options:
+SAMEORIGIN
+
+X-Content-Type-Options:
+nosniff
+
+Referrer-Policy:
+strict-origin-when-cross-origin
+
+Strict-Transport-Security:
+max-age=31536000
+
+Permissions-Policy:
+geolocation=(), microphone=(), camera=()
+
+Ранее жёлтые browser console warnings были связаны с Permissions-Policy, а не с CSP.
+
+
+12. JOYPIXELS
+
+Разрешён только path-scoped источник:
+
+https://cdn.jsdelivr.net/joypixels/assets/8.0/png/unicode/64/
+
+Не разрешён весь:
+
+https://cdn.jsdelivr.net
+
+Ранее dedicated evidence:
+- реальный historical CSP report указывал JoyPixels;
+- /help/smilies/ реально использует этот path;
+- bad JoyPixels path count = 0.
+
+Финальный canary:
+
+KOWAFINAL1_JOYPIXELS_RENDERED_REF_COUNT=32
+KOWAFINAL1_JOYPIXELS_SAMPLE_HTTP=200
+
+
+13. CLOUDFLARE TURNSTILE
+
+Turnstile остаётся обязательной runtime зависимостью для регистрации.
+
+Нужные разрешения сохранены:
+
+script:
+https://challenges.cloudflare.com
+
+connect:
+https://challenges.cloudflare.com
+
+frame:
+https://challenges.cloudflare.com
+
+В текущем enforcing уже есть:
+
+connect-src 'self' https://challenges.cloudflare.com;
+frame-src 'self' https://challenges.cloudflare.com;
+
+В Report-Only script policies также Cloudflare разрешён.
+
+Критически важный урок:
+
+не требовать статический <script src="https://challenges.cloudflare.com/..."> в исходном HTML.
+
+Turnstile может быть динамически instantiated.
+
+Именно из-за неправильного static-script требования ранее упал:
+
+KOW-260907-A-ICF5
+
+с:
+
+TURNSTILE_SCRIPT_REF_MISSING
+
+После исправления модели:
+
+KOW-260907-A-ICF6
+
+был accepted.
+
+Финальный canary проверял наличие Turnstile/challenges runtime tokens на /register/, а не статический script tag.
+
+
+14. FORM-ACTION
+
+Этап полностью закрыт ранее.
+
+Enforcing:
+
+form-action 'self'
+
+Перед promotion были проверены:
+
+external public form origins = 0
+payment profiles = 0
+user upgrades = 0
+provider/options related external forms = 0
+
+Production apply был с rollback proof и browser/server canary.
+
+Не пересматривать без новой фактической причины.
+
+
+15. PWA DIRECTIVES
+
+Полностью accepted:
+
+worker-src 'self'
+manifest-src 'self'
+
+Закрыты checkpoints:
+
+PWA3 audit
+PWA4 preflight
+PWA5 Git promotion
+PWA6 production + rollback proof
+PWA9 final recovery/readback
+
+Исторический transport bug:
+
+PWA7 browser canary сам по себе был PASS,
+но outer publication сломался.
+
+PWA8 RCA:
+publisher ошибочно ожидал evidence path в sys.argv[1].
+
+После этого правило:
+
+publisher должен использовать literal evidence path, а не рассчитывать, что sys.argv[1] содержит путь.
+
+
+16. IMG/CONNECT/FRAME STAGE
+
+Полностью закрыт.
+
+Текущие enforcing directives:
+
+img-src 'self' data: blob: https://cdn.jsdelivr.net/joypixels/assets/8.0/png/unicode/64/;
+
+connect-src 'self' https://challenges.cloudflare.com;
+
+frame-src 'self' https://challenges.cloudflare.com;
+
+Ключевые accepted checkpoints:
+
+KOW-260907-A-ICF2
+STATUS=OK
+DECISION=ELIGIBLE_FOR_IMG_CONNECT_FRAME_SOURCE_PREP
+
+Evidence:
+
+CSS bytes scanned = 297724
+stylesheets = 9
+CSS url refs = 245
+origins = DATA / SELF
+
+Git promotion:
+
+KOW-260907-A-ICF3
+
+Commit:
+
+3e5d8584ae6887c292cc910c5796e73d8d20aecd
+
+Production apply:
+
+KOW-260907-A-ICF4
+
+Rollback proof passed.
+
+Browser recovery:
+
+KOW-260907-A-ICF6
+DECISION=IMG_CONNECT_FRAME_ENFORCEMENT_POST_BROWSER_CANARY_CLEAN
+
+
+17. INLINE SCRIPT/STYLE AUDIT — ИСХОДНЫЕ ВЫВОДЫ
+
+До nonce stage:
+
+rendered nonce attrs = 0
+native nonce source signals = 0
+
+KOW-260907-A-INLINE1 показал по 5 guest routes:
+
+external_scripts = 35
+
+inline executable scripts = 5
+inline non-executable scripts = 3
+inline script tags total = 8
+
+style attributes = 31
+
+javascript: URLs = 6 occurrences
+distinct javascript: values later narrowed to 1
+
+event-handler attrs = 0
+
+script nonce attrs = 0
+style nonce attrs = 0
+style tags = 0
+
+Основной decision:
+
+HOLD_UNSAFE_INLINE_APPLICATION_NONCE_HASH_DESIGN_REQUIRED
+
+
+18. ПОЧЕМУ СТАТИЧЕСКИЕ HASHES ДЛЯ INLINE SCRIPTS БЫЛИ ОТКЛОНЕНЫ
+
+KOW-260907-A-INLINE2:
+
+STATUS=OK
+RC=0
+
+DECISION=
+APPLICATION_TEMPLATE_REFACTOR_DESIGN_REQUIRED
+
+Было установлено:
+
+EXEC_SCRIPTS_WITH_DYNAMIC_MARKERS=5
+GLOBAL_DISTINCT_EXEC_SCRIPT_BODIES=5
+GLOBAL_DISTINCT_STYLE_ATTR_VALUES=7
+GLOBAL_DISTINCT_JAVASCRIPT_URLS=1
+GLOBAL_DISTINCT_EVENT_HANDLER_VALUES=0
+
+То есть все 5 executable inline scripts имеют динамические признаки.
+
+Поэтому:
+- хеширование уже rendered script bodies не использовать;
+- не публиковать и не хешировать dynamic rendered inline values;
+- nonce оказался более подходящим механизмом для <script> elements.
+
+
+19. STYLE ATTRIBUTES
+
+Было обнаружено:
+
+31 style attributes
+7 distinct style attribute values
+
+Они оказались стабильными между guest renders и не сработал secretish gate.
+
+Но removal style-src 'unsafe-inline' не включён в текущий завершённый scope.
+
+Причина:
+
+nonce работает для <style> / <script> elements, но не решает обычные style="" attributes.
+
+Потенциальные будущие пути:
+- template/application refactor style attrs;
+- либо отдельный строго доказанный style-src-attr / 'unsafe-hashes' design.
+
+На текущем production:
+
+Report-Only:
+style-src 'self' 'unsafe-inline';
+
+Enforcing style-src отсутствует.
+
+
+20. JAVASCRIPT: URLS
+
+Исходно:
+
+6 occurrences
+1 distinct value
+event handlers = 0
+
+В процессе анализа было решено:
+
+JAVASCRIPT_URL_DESIGN=
+APPLICATION_REFACTOR_REQUIRED_NOT_HASH_ALLOWLIST
+
+То есть javascript: URL не закрывается текущей CSP-stage через hash allowlist.
+
+Было выполнено source mapping на VM160 по:
+
+/var/www/forums/kingofwolk/internal_data/code_cache/templates
+/var/www/forums/kingofwolk/src/XF
+/var/www/forums/kingofwolk/public/js
+
+Raw javascript: value наружу не публиковался.
+
+Текущий статус:
+
+deferred application refactor.
+
+
+21. EDGE NONCE DESIGN SEQUENCE И HARNESS FAILURES
+
+Во время разработки nonce-stage было несколько не product failures, которые важно не путать с production regressions.
+
+KOW-260907-A-INLINE3
+
+STATUS=FAIL
+RC=23
+
+Failed step:
+
+origin_compression
+
+Error:
+
+origin_compression:RC_2
+
+Причина:
+
+probe зависел от Python внутри guest/runtime path
+
+Product mutation:
+
+NO
+
+
+KOW-260907-A-INLINE4
+
+STATUS=FAIL
+RC=23
+
+Failed step:
+
+transform_and_hash_candidates
+
+Error:
+
+'str' object has no attribute 'decode'
+
+Причина — чистый harness bug:
+- transformed HTML уже был str;
+- helper повторно вызывал .decode().
+
+До падения подтвердилось:
+
+Git clean
+NPMplus healthy
+nginx sub module compiled = true
+nginx version = 1.31.2
+
+proxy_pass count = 1
+origin gzip = gzip
+origin identity = NONE
+HTTP = 200
+
+
+KOW-260907-A-INLINE5
+
+STATUS=FAIL
+RC=23
+
+Failed step:
+
+nginx_nonce_syntax_probe_tempfile
+
+Error:
+
+EPHEMERAL_PROBE_FILE_NOT_CLEANED
+
+Это был слишком строгий/неправильный cleanup harness.
+
+Product mutation не было.
+
+
+KOW-260907-A-INLINE6
+
+STATUS=FAIL
+RC=23
+
+Failed step:
+
+vm160_jsurl_source_map
+
+Error:
+
+qout() got an unexpected keyword argument 'timeout'
+
+Опять чистый harness bug.
+
+До падения уже было подтверждено:
+
+distinct javascript URLs = 1
+distinct style attrs = 7
+event handlers = 0
+Git clean
+production exact
+stale probe files = 0
+
+
+KOW-260907-A-INLINE7
+
+Recovery без повторения всего INLINE6.
+
+STATUS=OK
+RC=0
+
+Он прочитал evidence INLINE6 и выполнил только недостающий VM160 source-map.
+
+Decision:
+
+HOLD_NONCE_STYLE_HASH_DESIGN
+
+Но единственный HOLD был:
+
+UPSTREAM_IDENTITY_PROBE_NOT_CLEAN
+
+Почему:
+
+direct upstream ответил:
+
+HTTP=301
+Content-Encoding=NONE
+
+То есть compression уже был в порядке; harness ошибочно требовал именно HTTP==200.
+
+
+KOW-260907-A-INLINE8
+
+Исправил probe с правильными forwarded headers.
+
+Результат:
+
+STATUS=OK
+RC=0
+
+FORWARDED_IDENTITY_200_OK=true
+FORWARDED_IDENTITY_TRANSPORT_OK=true
+
+HOLD_REASONS=[]
+
+DECISION=
+ELIGIBLE_FOR_STAGED_SCRIPT_ELEM_NONCE_SOURCE_PREP
+
+Это финально закрыло nonce design.
+
+
+22. LANE B — FONT/MEDIA
+
+Lane B выполнил независимый read-only audit.
+
+Accepted checkpoint:
+
+KOW-260907-B-FONTMEDIA4
+STATUS=OK
+RC=0
+
+DECISION=
+ELIGIBLE_FOR_FONT_MEDIA_SOURCE_PREP
+
+Подтверждено:
+
+native media attachments = 0
+XFMG media = 0
+[MEDIA] content = 0
+board URL = https://kingofwolk.ru
+
+При этом наличие media-site capability не считалось само по себе runtime requirement.
+
+Lane B после этого прекратил новые checkpoints.
+
+Lane A стал единственным writer.
+
+
+23. FONT/MEDIA FINAL POLICY
+
+После независимого Lane B audit и дополнительной precommit verification были enforcing добавлены:
+
+font-src 'self' data:;
+media-src 'self';
+
+На финальном canary:
+
+FONT_ORIGINS=[]
+
+для непосредственно проверенных текущих страниц, то есть никаких новых внешних font runtime origins выявлено не было.
+
+Ранее dedicated audit уже доказал допустимость SELF/DATA.
+
+Rendered media origins также не потребовали дополнительного allow-list.
+
+
+24. KOW-260907-A-STAGE1 — GIT PROMOTION
+
+Команда:
+
+KOW-260907-A-STAGE1
+MODE=change
+COMPONENT=kingofwolk-csp-font-media-nonce-stage-git-promotion
+
+Выполнила перед mutation:
+
+- exact Git branch/head/remote/clean checks;
+- production old edge SHA check;
+- CSP log baseline;
+- NPMplus health;
+- font/media audit;
+- route checks;
+- DB read-only media checks;
+- repository validation;
+- unit tests.
+
+После этого построила exact candidate:
+
+1. enforcement:
+
++ font-src 'self' data:;
++ media-src 'self';
+
+2. Report-Only:
+
++ script-src-elem 'self' 'nonce-$request_id' https://challenges.cloudflare.com;
+
+3. transport:
+
+proxy_set_header Accept-Encoding "";
+sub_filter_once off;
+sub_filter '<script' '<script nonce="$request_id"';
+
+Не менялись:
+
+style-src 'unsafe-inline'
+base script-src 'unsafe-inline'
+javascript: behavior
+
+Repository validation:
+
+PASS
+
+Tests:
+
+PASS
+
+Новый Git HEAD:
+
+6f584c5faa76d0067b08977aeb583fa0e4de14aa
+
+Новый source SHA:
+
+458c2cf0763e4790f7d2d3757efd883b25813a31aab4e8dce6f785b8dea48a6e
+
+Local == remote.
+
+Во время Stage1 production оставался на старом SHA.
+
+
+25. KOW-260907-A-STAGE2 — PRODUCTION APPLY
+
+KOW-260907-A-STAGE2
+STATUS=OK
+RC=0
+MODE=change
+RESULT_CONTRACT_STATUS=OK
+CHANGES_MADE=true
+
+Перед apply были проверены:
+
+runner SHA
+Git branch/head/parent/message
+source exact bytes
+production old SHA
+live file owner/mode
+CSP log baseline
+NPMplus health
+nginx -t
+public old CSP exact
+
+Runner baseline SHA:
+
+b248a4c32c9cc64e5747e7dce6c7fc0a23f5124a77c71ce72e27a81aceae9d2d
+
+Stage2 sequence:
+
+Phase 1 — APPLY1
+
+Установлен новый candidate.
+
+Проверены:
+- nginx -t;
+- reload;
+- routes;
+- exact enforcing CSP;
+- dynamic Report-Only nonce;
+- каждый HTML <script> получил nonce;
+- nonce == header nonce;
+- CSP log baseline;
+- NPMplus health.
+
+Phase 2 — ROLLBACK PROOF
+
+Production вернули к старому:
+
+fc9fb1dbdb6141bfb43a8122dcf3db435a94da48d0a0c02fe9dfae019b1439c5
+
+Проверены old policies, routes, отсутствие nonce injection, health/log.
+
+Rollback proof:
+
+PASS
+
+Phase 3 — FINAL REAPPLY
+
+Candidate применён повторно.
+
+Финальный edge:
+
+458c2cf0763e4790f7d2d3757efd883b25813a31aab4e8dce6f785b8dea48a6e
+
+Git не drifted.
+
+Итоговая reason:
+
+FONT_MEDIA_ENFORCED_AND_SCRIPT_ELEM_NONCE_REPORT_ONLY_STAGED_WITH_ROLLBACK_PROOF
+
+
+26. PRODUCTION ROLLBACK ARTIFACT
+
+Stage2 создал manual rollback backup в NPMplus VM/container filesystem:
+
+/opt/npmplus/manual-backups/kingofwolk-csp-font-media-nonce-stage-20260907-6f584c5/
+
+Old config:
+
+996.conf.before
+
+Old SHA:
+
+fc9fb1dbdb6141bfb43a8122dcf3db435a94da48d0a0c02fe9dfae019b1439c5
+
+Также stage directory использовался для candidate copy.
+
+Если когда-либо потребуется ручной emergency rollback, сначала всё равно заново проверить текущий live state и не предполагать, что этот backup всё ещё является правильной rollback target после будущих изменений.
+
+
+27. KOW-260907-A-FINAL1 — ФИНАЛЬНЫЙ EVIDENCE CLOSURE
+
+STATUS=OK
+RC=0
+MODE=read-only
+CHANGES_MADE=false
+
+Decision:
+
+KINGOFWOLK_CSP_AGREED_STAGE_FINAL_EVIDENCE_CLOSED
+
+Closure scope:
+
+AGREED_SAFE_CSP_STAGE
+
+Проверено:
+
+- Git exact local/remote/clean;
+- source SHA exact;
+- production edge SHA exact;
+- edge metadata 0:0:644;
+- CSP log baseline before;
+- NPMplus healthy;
+- nginx -t;
+- пять HTML routes по два запроса;
+- /service_worker.js;
+- /webmanifest.php;
+- exact security headers;
+- exact enforcing CSP;
+- exact dynamic Report-Only CSP;
+- unique nonce across requests;
+- nonce coherence для всех <script>;
+- JoyPixels rendered refs + HTTP sample;
+- fonts;
+- media origins;
+- Turnstile signal;
+- collector 405/POST;
+- CSP log baseline after;
+- production SHA after;
+- Git state after.
+
+Финал:
+
+NEW_CSP_REPORTS_AFTER_FINAL_BROWSER_CANARY=0
+NONCE_UNIQUE_ACROSS_ALL_REQUESTS=true
+NPMPLUS_HEALTH_AFTER=healthy
+
+
+28. CURRENT FINAL HASHES / IDENTIFIERS — БЫСТРЫЙ БЛОК
+
+Git repo:
+/root/kingofwolk-csp-baseline-20260907
+
+Branch:
+forum/kingofwolk-csp-baseline-20260907
+
+Current HEAD:
+6f584c5faa76d0067b08977aeb583fa0e4de14aa
+
+Parent:
+3e5d8584ae6887c292cc910c5796e73d8d20aecd
+
+Current source:
+deploy/forums/kingofwolk/edge/996.conf
+
+Current source / production edge SHA:
+458c2cf0763e4790f7d2d3757efd883b25813a31aab4e8dce6f785b8dea48a6e
+
+Previous production SHA:
+fc9fb1dbdb6141bfb43a8122dcf3db435a94da48d0a0c02fe9dfae019b1439c5
+
+CSP report log SHA:
+2f7977cbfaed7953bd70033c0cf92138eedf974f5886fadf4b4971f2d00a4143
+
+CSP report log lines:
+2
+
+Runner SHA:
+b248a4c32c9cc64e5747e7dce6c7fc0a23f5124a77c71ce72e27a81aceae9d2d
+
+
+29. OPERATIONAL COMMAND CONTRACT
+
+Любая новая server command по этому проекту должна сначала читать:
+
+/etc/pve/HOMELAB_ASSISTANT_ERROR_REGISTER.md
+/etc/pve/31_HOMELAB_REFERENCE.md
+
+И visibly emit:
+
+ERROR_REGISTER_CHECK=OK
+REFERENCE_CHECK=OK
+AUTHORITY_CHECK_SCOPE=READABILITY_ONLY_INCIDENTS_NOT_CLOSED
+
+Обычно shell:
+
+root@pve01:~#
+
+Git discipline:
+
+Перед любым change:
+
+git status
+branch
+local HEAD
+remote HEAD
+
+Fail closed при неизвестном drift.
+
+До commit:
+
+git diff --check
+
+Staging:
+
+git add <explicit path>
+
+Не использовать:
+
+git add .
+
+После staging:
+
+git diff --cached --check
+git diff --cached
+
+После push:
+
+git fetch
+LOCAL_HEAD == REMOTE_HEAD
+
+Запрещённый destructive workflow:
+
+git reset --hard
+git clean -fd
+force push
+
+Также:
+
+не мутировать XenForo state raw SQL.
+
+Read-only SQL допустим.
+
+
+30. CONCURRENCY / LANE MODEL
+
+Была доказана настоящая параллельность read-only lanes через direct bridge.
+
+Checkpoint:
+
+KOW-260907-PBR2
+
+Decision:
+
+ALLOW_TRUE_PARALLEL_READ_ONLY_LANES
+
+При этом обычные full runner carriers сериализуются из-за flock.
+
+Checkpoint:
+
+KOW-260907-CONC1
+
+Поэтому правила:
+
+read-only direct bridge:
+может работать параллельно
+
+Git commit/push:
+ровно один writer
+
+edge production apply:
+ровно один writer
+
+XenForo/app mutation:
+ровно один writer
+
+Сейчас Lane B закончен.
+
+Если CSP scope снова открыть:
+
+текущий чат/следующий оператор должен оставаться единственным writer.
+
+
+31. WINDOWS TRANSPORT
+
+Стандартный transport:
+
+.CMD
+  -> Windows PowerShell 5.1
+  -> Plink
+  -> Pageant
+  -> SSH pve01
+  -> direct bridge или homelab-chat-run
+  -> Gitea publication
+  -> readback
+
+PuTTY:
+
+C:\Program Files\PuTTY\plink.exe
+C:\Program Files\PuTTY\pageant.exe
+
+PPK:
+
+<USERPROFILE>\Documents\ssh\homelab_ed25519.ppk
+
+PPK encrypted:
+aes256-cbc
+
+<REDACTED_SENSITIVE_LINE>
+
+<REDACTED_SENSITIVE_LINE>
+
+Нормальный carrier:
+
+plink
+-batch
+-agent
+-ssh
+-P 22
+-m <remotePath>
+root@<PRIVATE_IPV4>
+
+Не использовать обычным carrier:
+
+-i
+
+Pageant должен уже держать unlocked key.
+
+Endpoint:
+
+pve01
+root@<PRIVATE_IPV4>:22
+
+PuTTY registry host key:
+
+HKCU:\Software\SimonTatham\PuTTY\SshHostKeys
+
+ssh-ed25519@22:<PRIVATE_IPV4>
+
+
+32. CARRIER IMPLEMENTATION RULES
+
+PowerShell запускает Plink через:
+
+Start-Process
+
+Обязательно:
+
+separate stdout
+separate stderr
+real ExitCode
+-NoNewWindow
+
+Не использовать:
+
+pause
+notepad
+MobaXterm
+
+Temp diagnostics:
+
+%TEMP%
+
+Remote command file:
+
+UTF-8
+no BOM
+one physical line
+SHA verified
+
+Большие payloads:
+
+zlib + base64
+SHA256 verification
+/usr/bin/python3 -I -B
+
+Каждый attempt:
+
+новый COMMAND_ID
+
+Не reuse failed ID.
+
+Runner:
+
+/usr/local/sbin/homelab-chat-run <CID> read-only|change <component> -- <command>
+
+Change result contract:
+
+OK
+BLOCKED
+FAIL
+
+
+33. GITEA RUNTIME PUBLICATION / READBACK
+
+Runtime repo:
+
+homelab-admin/homelab-public-context
+
+Branch:
+
+assistant-runtime
+
+Authoritative history path:
+
+runtime/history/<COMMAND_ID>.txt
+
+Главное правило:
+
+не доверять generic latest без проверки COMMAND_ID.
+
+Exact history конкретного command ID — authoritative.
+
+Fast latest может вернуть unrelated/stale result.
+
+
+34. НЕДАВНИЕ .CMD ARTIFACTS ИЗ ЭТОГО ЧАТА
+
+Последовательность последних команд:
+
+KOW-260907-A-INLINE2
+KOW_CSP_INLINE_HASH_FEASIBILITY_AUDIT_PLINK_GITEA_MOSCOW.cmd
+
+KOW-260907-A-INLINE3
+KOW_CSP_EDGE_NONCE_UNSAFE_HASHES_FEASIBILITY_PLINK_GITEA_MOSCOW.cmd
+
+KOW-260907-A-INLINE4
+KOW_CSP_EDGE_NONCE_UNSAFE_HASHES_FEASIBILITY2_PLINK_GITEA_MOSCOW.cmd
+
+KOW-260907-A-INLINE5
+KOW_CSP_EDGE_NONCE_UNSAFE_HASHES_FINAL_FEASIBILITY_PLINK_GITEA_MOSCOW.cmd
+
+KOW-260907-A-INLINE6
+KOW_CSP_EDGE_NONCE_STYLE_HASH_JSURL_DESIGN_AUDIT_PLINK_GITEA_MOSCOW.cmd
+
+KOW-260907-A-INLINE7
+KOW_CSP_INLINE6_RECOVERY_JSURL_SOURCE_MAP_PLINK_GITEA_MOSCOW.cmd
+
+KOW-260907-A-INLINE8
+KOW_CSP_SCRIPT_ELEM_NONCE_DESIGN_CLOSURE_PLINK_GITEA_MOSCOW.cmd
+
+KOW-260907-A-STAGE1
+KOW_CSP_FONT_MEDIA_NONCE_STAGE_GIT_PROMOTION_PLINK_GITEA_MOSCOW.cmd
+
+KOW-260907-A-STAGE2
+KOW_CSP_FONT_MEDIA_NONCE_STAGE_PRODUCTION_PLINK_GITEA_MOSCOW.cmd
+
+KOW-260907-A-FINAL1
+KOW_CSP_FINAL_BROWSER_EVIDENCE_CLOSURE_PLINK_GITEA_MOSCOW.cmd
+
+Не нужно повторно запускать их для «проверки», если нет новой причины.
+При новом scope создавать новые IDs.
+
+
+35. ЧТО НЕ НАДО ПОВТОРЯТЬ СЛЕДУЮЩЕМУ ОПЕРАТОРУ
+
+Уже закрыто, не делать заново без новой фактической причины:
+
+form-action audit
+PWA worker/manifest audit
+img-src audit
+connect-src audit
+frame-src audit
+JoyPixels path audit
+Turnstile static-script search
+font-src/media-src discovery
+inline hash feasibility
+nonce feasibility
+upstream identity/compression feasibility
+font/media Git promotion
+font/media production promotion
+rollback proof
+final browser/evidence closure
+
+Особенно:
+
+не повторять KOW-260907-B-FONTMEDIA4.
+
+Lane B audit уже accepted.
+
+
+36. ЧТО ОСТАЁТСЯ ТОЛЬКО КАК FUTURE HARDENING
+
+Это не незавершённые команды текущего counter.
+
+Текущий counter:
+
+0
+
+Future scope можно открыть отдельно.
+
+
+A. script-src-elem enforcement
+
+Сейчас:
+
+Report-Only only
+
+Nonce транспорт уже работает и финально доказан.
+
+Следующий возможный будущий шаг — только после периода наблюдения CSP report log:
+
+перенести script-src-elem nonce policy в enforcing
+
+Но до этого надо заново проверить:
+
+- log не накопил реальные violations;
+- authenticated flows;
+- Turnstile;
+- admin/Account overlays, если входят в scope;
+- все важные XenForo page types.
+
+
+B. style-src 'unsafe-inline'
+
+Сейчас всё ещё Report-Only:
+
+style-src 'self' 'unsafe-inline'
+
+Причина — style attributes.
+
+Исходное evidence:
+
+31 occurrences
+7 distinct values
+
+Нужен отдельный application/template design.
+
+
+C. javascript: refactor
+
+Есть:
+
+1 distinct javascript: value
+несколько rendered occurrences
+
+Не разрешать это через сомнительный hash workaround.
+
+Принятый design:
+
+APPLICATION_REFACTOR_REQUIRED_NOT_HASH_ALLOWLIST
+
+
+37. ТОЧКА СТАРТА ДЛЯ НОВОГО ЧАТА
+
+Новый чат должен считать canonical current state следующим:
+
+KINGOFWOLK CSP AGREED SAFE STAGE = CLOSED
+
+shared counter = 0
+
+current Git HEAD:
+6f584c5faa76d0067b08977aeb583fa0e4de14aa
+
+current edge/source SHA:
+458c2cf0763e4790f7d2d3757efd883b25813a31aab4e8dce6f785b8dea48a6e
+
+CSP log SHA:
+2f7977cbfaed7953bd70033c0cf92138eedf974f5886fadf4b4971f2d00a4143
+
+CSP log lines:
+2
+
+NPMplus:
+healthy
+
+final accepted checkpoint:
+KOW-260907-A-FINAL1
+
+final decision:
+KINGOFWOLK_CSP_AGREED_STAGE_FINAL_EVIDENCE_CLOSED
+
+Если пользователь просит «продолжить CSP», сначала надо считать, что открывается новый hardening scope, потому что прежний shared counter уже завершён.
+
+Наиболее логичный новый порядок:
+
+1. read-only observation / authenticated coverage для script-src-elem Report-Only
+2. javascript: application refactor design
+3. style attribute refactor/hash design
+4. только затем новый enforcement promotion с отдельным rollback proof
+
+Но ничего из этого не является долгом старого плана.
+
+
+38. КОРОТКАЯ ИТОГОВАЯ ФОРМУЛИРОВКА ДЛЯ ВСТАВКИ В НОВЫЙ ЧАТ
+
+KingOfWolk CSP agreed safe stage полностью закрыт. Shared counter = 0.
+Финальный accepted checkpoint KOW-260907-A-FINAL1, STATUS=OK, RC=0,
+DECISION=KINGOFWOLK_CSP_AGREED_STAGE_FINAL_EVIDENCE_CLOSED.
+
+Текущий Git HEAD:
+6f584c5faa76d0067b08977aeb583fa0e4de14aa
+
+Branch:
+forum/kingofwolk-csp-baseline-20260907
+
+Worktree:
+/root/kingofwolk-csp-baseline-20260907
+
+Source:
+deploy/forums/kingofwolk/edge/996.conf
+
+Source/production edge SHA:
+458c2cf0763e4790f7d2d3757efd883b25813a31aab4e8dce6f785b8dea48a6e
+
+CSP log baseline SHA:
+2f7977cbfaed7953bd70033c0cf92138eedf974f5886fadf4b4971f2d00a4143
+
+CSP log:
+2 строки
+
+Новых reports после финального browser-canary:
+0
+
+NPMplus:
+healthy
+
+Enforcing сейчас закрывает:
+base-uri
+object-src
+frame-ancestors
+form-action
+worker-src
+manifest-src
+img-src
+connect-src
+frame-src
+font-src
+media-src
+
+script-src-elem с per-request $request_id nonce находится только в Report-Only.
+Nginx добавляет тот же nonce каждому <script> через sub_filter.
+Финальный canary доказал unique nonce per request и полную header↔script coherence.
+
+style-src 'unsafe-inline', существующий javascript: URL и перевод script-src-elem в enforcing оставлены как отдельный будущий hardening scope.
+
+Lane B KOW-260907-B-FONTMEDIA4 accepted и не должен повторяться.
+
+Любой новый change:
+- один writer;
+- authority checks;
+- exact Git/source/edge/log prestate;
+- explicit staging;
+- rollback proof;
+- новый COMMAND_ID.
+
+
+39. ОСНОВНЫЕ AUTHORITATIVE EVIDENCE URLS
+
+Финальный evidence:
+https://git.gram1.ru/homelab-admin/homelab-public-context/raw/branch/assistant-runtime/runtime/history/KOW-260907-A-FINAL1.txt
+
+Production apply:
+https://git.gram1.ru/homelab-admin/homelab-public-context/raw/branch/assistant-runtime/runtime/history/KOW-260907-A-STAGE2.txt
+
+Git promotion:
+https://git.gram1.ru/homelab-admin/homelab-public-context/raw/branch/assistant-runtime/runtime/history/KOW-260907-A-STAGE1.txt
+
+Lane B font/media:
+https://git.gram1.ru/homelab-admin/homelab-public-context/raw/branch/assistant-runtime/runtime/history/KOW-260907-B-FONTMEDIA4.txt
+
+Nonce design closure:
+https://git.gram1.ru/homelab-admin/homelab-public-context/raw/branch/assistant-runtime/runtime/history/KOW-260907-A-INLINE8.txt
+
+Inline feasibility:
+https://git.gram1.ru/homelab-admin/homelab-public-context/raw/branch/assistant-runtime/runtime/history/KOW-260907-A-INLINE2.txt
+
+Img/connect/frame final recovery:
+https://git.gram1.ru/homelab-admin/homelab-public-context/raw/branch/assistant-runtime/runtime/history/KOW-260907-A-ICF6.txt
+
+Img/connect/frame production:
+https://git.gram1.ru/homelab-admin/homelab-public-context/raw/branch/assistant-runtime/runtime/history/KOW-260907-A-ICF4.txt
+
+CANDIDATE_LAYER_1_TEXT_END
+CANDIDATE_LAYER_2_SOURCE=file:newfi-54-portal200-apply3.cmd::b64::zlib
+CANDIDATE_LAYER_2_SHA256=97a1807a275e5d309591f7a7e044d7d56ba5b2f4c6a068df6353bae147707184
+CANDIDATE_LAYER_2_BYTES=34155
+CANDIDATE_LAYER_2_TEXT_BEGIN
+import hashlib
+import json
+import pathlib
+import shlex
+import shutil
+import subprocess
+import sys
+import xml.etree.ElementTree as ET
+
+CID = "NEWFI-260907-PORTAL200-APPLY3"
+BRANCH = "implementation/newfi-closed-mvp-20260906"
+OLD_HEAD = "06bab5acd124e768f70305b3d7eca2f595871890"
+WT = pathlib.Path("/root/newfi-portal/.worktrees/implementation-newfi-closed-mvp-20260906")
+CAND_ROOT = pathlib.Path("/root/newfi-portal200-candidate/src/addons/Newfi/Portal")
+PORTAL_REL = pathlib.Path("src/addons/Newfi/Portal")
+GIT_PORTAL = WT / PORTAL_REL
+EXPECTED_NEW = {
+    "Pub/Controller/Portal.php": (363, "619d489f7cc3b461479c702fa8825097ae22d3c6cfeb911e9f14ea1de9c36d6d"),
+    "Service/PortalData.php": (5213, "4da03f26294ab6d163a1a746dee4bb6a82d7d4f39e66b24246bc0eb4c455dd1d"),
+    "_data/templates.xml": (10977, "1650c3d868d4bc47703f1b75f1f179cd25309b2d3b20a2b848e81a4423c00861"),
+}
+EXPECTED_OLD = {
+    "Pub/Controller/Portal.php": (247, "53909e753ea5a011550fd280ad1c342a74ca9949be092dfbd95244243cae92f3"),
+    "_data/templates.xml": (1461, "c29c04f8b937284e821c87957653e87c2f6ac014fac30648a0f6b18e84392adf"),
+}
+EXPECTED_GIT_PATHS = [str(PORTAL_REL / p) for p in sorted(EXPECTED_NEW)]
+BACKUP = f"/root/newfi-portal200-backup-{CID}"
+
+
+class PortalError(RuntimeError):
+    pass
+
+
+def emit(key, value=None):
+    if value is None:
+        print(key, flush=True)
+    elif isinstance(value, (dict, list, tuple, bool, int, float)):
+        print(
+            key + "=" + json.dumps(value, ensure_ascii=False, sort_keys=True, separators=(",", ":")),
+            flush=True,
+        )
+    else:
+        print(key + "=" + str(value), flush=True)
+
+
+def fail(code):
+    raise PortalError(code)
+
+
+def sha_bytes(data):
+    return hashlib.sha256(data).hexdigest()
+
+
+def file_meta(path):
+    data = pathlib.Path(path).read_bytes()
+    return len(data), sha_bytes(data)
+
+
+def run(cmd, *, input_bytes=None, timeout=180, ok=(0,)):
+    try:
+        p = subprocess.run(
+            cmd,
+            input=input_bytes,
+            stdout=subprocess.PIPE,
+            stderr=subprocess.PIPE,
+            timeout=timeout,
+            check=False,
+        )
+    except subprocess.TimeoutExpired:
+        fail("SUBPROCESS_TIMEOUT")
+    if p.returncode not in ok:
+        fail("SUBPROCESS_RC")
+    return p
+
+
+def git(*args, ok=(0,), timeout=120):
+    p = run(["/usr/bin/git", "-C", str(WT), *args], timeout=timeout, ok=ok)
+    return p.stdout.decode("utf-8", "replace").strip()
+
+
+def qga(target, argv, *, input_bytes=None, timeout=180):
+    if target == "prod":
+        cmd = [
+            "/usr/sbin/qm",
+            "guest",
+            "exec",
+            "210",
+            "--synchronous",
+            "1",
+            "--timeout",
+            str(timeout),
+        ]
+        if input_bytes is not None:
+            cmd += ["--pass-stdin", "1"]
+        cmd += ["--", *argv]
+    elif target == "staging":
+        q = [
+            "/usr/sbin/qm",
+            "guest",
+            "exec",
+            "211",
+            "--synchronous",
+            "1",
+            "--timeout",
+            str(timeout),
+        ]
+        if input_bytes is not None:
+            q += ["--pass-stdin", "1"]
+        q += ["--", *argv]
+        remote = (
+            "test \"$(id -u):$(hostname -s)\" = 0:pve03 || exit 72; "
+            "for f in /etc/pve/HOMELAB_ASSISTANT_ERROR_REGISTER.md /etc/pve/31_HOMELAB_REFERENCE.md; do "
+            "test -r \"$f\" && test -s \"$f\" && cat -- \"$f\" >/dev/null || exit 73; done; exec "
+            + " ".join(shlex.quote(x) for x in q)
+        )
+        cmd = [
+            "/usr/bin/ssh",
+            "-T",
+            "-o",
+            "BatchMode=yes",
+            "-o",
+            "StrictHostKeyChecking=yes",
+            "-o",
+            "UpdateHostKeys=no",
+            "-o",
+            "ConnectTimeout=10",
+            "-o",
+            "ConnectionAttempts=1",
+            "root@pve03",
+            remote,
+        ]
+    else:
+        fail("BAD_TARGET")
+
+    p = run(cmd, input_bytes=input_bytes, timeout=timeout + 30)
+    try:
+        data = json.loads(p.stdout.decode("utf-8"))
+    except Exception:
+        fail("QGA_JSON")
+    if data.get("exited") not in (1, True) or data.get("exitcode") != 0:
+        fail("QGA_GUEST_RC")
+    if data.get("out-truncated") or data.get("err-truncated"):
+        fail("QGA_TRUNCATED")
+    return data.get("out-data", "")
+
+
+INSPECT_PHP = r'''<?php
+$root = '/var/www/forums/newfi/public';
+require $root . '/src/XF.php';
+\XF::start($root);
+$app = \XF::setupApp('XF\\Pub\\App');
+$db = $app->db();
+function srcMeta(string $path): ?array {
+    if (!is_file($path)) { return null; }
+    return ['bytes' => filesize($path), 'sha256' => hash_file('sha256', $path)];
+}
+$portal = $root . '/src/addons/Newfi/Portal';
+$templates = $db->fetchAll(
+    "SELECT title, style_id, LENGTH(template) AS bytes, SHA2(template,256) AS sha256, " .
+    "LOCATE('data-newfi-portal200', template) > 0 AS html_marker, " .
+    "LOCATE('--newfi-portal200', template) > 0 AS css_marker " .
+    "FROM xf_template WHERE addon_id='Newfi/Portal' ORDER BY style_id,title"
+);
+$result = [
+ 'hostname' => gethostname(),
+ 'application' => [
+  'boardActive' => (string)$db->fetchOne("SELECT option_value FROM xf_option WHERE option_id='boardActive'"),
+  'boardUrl' => (string)$db->fetchOne("SELECT option_value FROM xf_option WHERE option_id='boardUrl'"),
+  'indexRoute' => (string)$db->fetchOne("SELECT option_value FROM xf_option WHERE option_id='indexRoute'"),
+  'defaultStyleId' => (string)$db->fetchOne("SELECT option_value FROM xf_option WHERE option_id='defaultStyleId'"),
+  'error_count' => (int)$db->fetchOne("SELECT COUNT(*) FROM xf_error_log"),
+  'error_max_id' => (int)$db->fetchOne("SELECT COALESCE(MAX(error_id),0) FROM xf_error_log")
+ ],
+ 'addon' => $db->fetchRow(
+  "SELECT addon_id,version_id,version_string,active,is_processing,last_pending_action " .
+  "FROM xf_addon WHERE addon_id='Newfi/Portal'"
+ ),
+ 'source' => [
+  'Pub/Controller/Portal.php' => srcMeta($portal . '/Pub/Controller/Portal.php'),
+  'Service/PortalData.php' => srcMeta($portal . '/Service/PortalData.php'),
+  '_data/templates.xml' => srcMeta($portal . '/_data/templates.xml')
+ ],
+ 'templates' => $templates
+];
+echo "PORTAL200_INSPECT_JSON_BEGIN\n";
+echo json_encode(
+    $result,
+    JSON_UNESCAPED_UNICODE|JSON_UNESCAPED_SLASHES|JSON_INVALID_UTF8_SUBSTITUTE
+);
+echo "\nPORTAL200_INSPECT_JSON_END\n";
+?>'''
+
+
+IMPORT_PHP = r'''<?php
+$root = '/var/www/forums/newfi/public';
+require $root . '/src/XF.php';
+\XF::start($root);
+$app = \XF::setupApp('XF\\Pub\\App');
+$addOn = $app->addOnManager()->getById('Newfi/Portal');
+if (!$addOn || !$addOn->isInstalled()) {
+    fwrite(STDERR, "ADDON_NOT_INSTALLED\n");
+    exit(30);
+}
+$addOn->preRebuild();
+$dataManager = $app->addOnDataManager();
+$imported = [];
+foreach ($dataManager->getDataTypeClasses() as $dataType) {
+    $handler = $dataManager->getDataTypeHandler($dataType);
+    $xml = $handler->openTypeFile($addOn->getDataDirectory());
+    if (!$xml || !$xml->count()) {
+        $handler->deleteAddOnData($addOn->addon_id);
+        continue;
+    }
+    $start = 0;
+    $guard = 0;
+    while (true) {
+        $last = $handler->importAddOnData($addOn->addon_id, $xml, $start, 0);
+        if (!$last) { break; }
+        if ($last <= $start || ++$guard > 100000) {
+            fwrite(STDERR, "IMPORT_PROGRESS_INVALID\n");
+            exit(31);
+        }
+        $start = $last;
+    }
+    $handler->deleteOrphanedAddOnData($addOn->addon_id, $xml);
+    \XF::triggerRunOnce();
+    $imported[] = $handler->getContainerTag();
+}
+$addOn->postDataImport();
+$repo = $app->repository(\XF\Repository\StyleRepository::class);
+$repo->updateAllStylesLastModifiedDateLater();
+$addOn->postRebuild();
+echo "PORTAL200_IMPORT_JSON=" . json_encode(
+    ['result'=>'PASS','containers'=>$imported],
+    JSON_UNESCAPED_SLASHES
+) . "\n";
+?>'''
+
+
+ERRORS_PHP_TEMPLATE = r'''<?php
+$root='/var/www/forums/newfi/public';
+require $root.'/src/XF.php';
+\XF::start($root);
+$app=\XF::setupApp('XF\\Pub\\App');
+$db=$app->db();
+$b=%d;
+$rows=$db->fetchAll(
+    "SELECT error_id,exception_type,message,filename,line FROM xf_error_log WHERE error_id>? ORDER BY error_id",
+    [$b]
+);
+echo json_encode(
+    $rows,
+    JSON_UNESCAPED_UNICODE|JSON_UNESCAPED_SLASHES|JSON_INVALID_UTF8_SUBSTITUTE
+);
+?>'''
+
+
+RUNTIME_VERIFY_PHP_TEMPLATE = r'''<?php
+$state = '__STATE__';
+$root = '/var/www/forums/newfi/public';
+require $root . '/src/XF.php';
+\XF::start($root);
+$app = \XF::setupApp('XF\\Pub\\App');
+$result = ['state'=>$state];
+if ($state === 'new') {
+    $service = new \Newfi\Portal\Service\PortalData($app);
+    $portal = $service->build();
+    $html = (string)$app->templater()->renderTemplate('public:newfi_portal', ['portal'=>$portal]);
+    $result['sections'] = [];
+    foreach (['forums','resources','media','events','dogs'] as $key) {
+        $section = $portal[$key] ?? null;
+        if (!is_array($section)) { fwrite(STDERR, "SECTION_MISSING\n"); exit(60); }
+        $result['sections'][$key] = [
+            'available'=>(bool)($section['available'] ?? false),
+            'hasItems'=>(bool)($section['hasItems'] ?? false),
+            'status'=>(string)($section['status'] ?? '')
+        ];
+    }
+    $result['html_marker'] = strpos($html, 'data-newfi-portal200="1"') !== false;
+    $result['locked_resources'] = strpos($html, 'data-portal-locked="resources"') !== false;
+    $result['locked_media'] = strpos($html, 'data-portal-locked="media"') !== false;
+    $result['html_bytes'] = strlen($html);
+    if (!$result['html_marker']) { fwrite(STDERR, "HTML_MARKER_MISSING\n"); exit(61); }
+    if ($result['sections']['resources']['available'] || $result['sections']['media']['available']) {
+        fwrite(STDERR, "GUEST_PERMISSION_CONTRACT_CHANGED\n"); exit(62);
+    }
+    if (!$result['locked_resources'] || !$result['locked_media']) {
+        fwrite(STDERR, "LOCKED_COPY_MISSING\n"); exit(63);
+    }
+    if (!$result['sections']['forums']['available'] || !$result['sections']['events']['available'] || !$result['sections']['dogs']['available']) {
+        fwrite(STDERR, "PUBLIC_SECTION_UNAVAILABLE\n"); exit(64);
+    }
+} else if ($state === 'old') {
+    $html = (string)$app->templater()->renderTemplate('public:newfi_portal', []);
+    $result['html_marker'] = strpos($html, 'data-newfi-portal200') !== false;
+    $result['old_copy'] = strpos($html, 'Закрытое пространство для общения, знаний и материалов сообщества.') !== false;
+    $result['html_bytes'] = strlen($html);
+    if ($result['html_marker'] || !$result['old_copy']) {
+        fwrite(STDERR, "OLD_RENDER_CONTRACT\n"); exit(65);
+    }
+} else {
+    exit(66);
+}
+echo "PORTAL200_RUNTIME_JSON=" . json_encode(
+    $result,
+    JSON_UNESCAPED_UNICODE|JSON_UNESCAPED_SLASHES|JSON_INVALID_UTF8_SUBSTITUTE
+) . "\n";
+?>'''
+
+
+HTTP_VERIFY_PY = r'''import html,json,re,subprocess,sys,urllib.parse
+mode=sys.argv[1]
+state=sys.argv[2]
+if mode=='staging':
+    host='newfi-staging.gram1.ru'; scheme='http'; port='80'; expected_status=503
+elif mode=='prod':
+    host='newfi.ru'; scheme='https'; port='443'; expected_status=200
+else:
+    raise SystemExit(40)
+def fetch(url):
+    cmd=[
+        '/usr/bin/curl','-sS','-k','--max-time','30','--connect-timeout','10'
+    ]
+    if mode=='staging':
+        cmd += ['--resolve',f'{host}:{port}:127.0.0.1']
+    cmd += [
+        '-o','-','-w','\n__PORTAL_STATUS__%{http_code}',url
+    ]
+    p=subprocess.run(cmd,stdout=subprocess.PIPE,stderr=subprocess.PIPE,check=False)
+    if p.returncode!=0: raise SystemExit(41)
+    text=p.stdout.decode('utf-8','replace')
+    marker='\n__PORTAL_STATUS__'
+    if marker not in text: raise SystemExit(42)
+    body,status=text.rsplit(marker,1)
+    return int(status.strip()),body
+root=f'{scheme}://{host}/'
+status,body=fetch(root)
+hrefs=[]
+for raw in re.findall(r"href=[\"']([^\"']*css\.php[^\"']*)[\"']",body,re.I):
+    raw=html.unescape(raw)
+    hrefs.append(urllib.parse.urljoin(root,raw))
+normal_css=[]
+normal_status=[]
+for u in hrefs:
+    s,b=fetch(u)
+    normal_status.append(s)
+    normal_css.append(b)
+normal_css_text='\n'.join(normal_css)
+forced_css_marker=None
+forced_css_status=None
+if mode=='staging' and state=='new' and hrefs:
+    u=urllib.parse.urlsplit(hrefs[0])
+    pairs=urllib.parse.parse_qsl(u.query,keep_blank_values=True)
+    out=[]
+    found=False
+    for k,v in pairs:
+        if k=='css':
+            found=True
+            parts=[x for x in v.split(',') if x]
+            if 'public:newfi_portal.less' not in parts:
+                parts.append('public:newfi_portal.less')
+            v=','.join(parts)
+        out.append((k,v))
+    if found:
+        forced=urllib.parse.urlunsplit((u.scheme,u.netloc,u.path,urllib.parse.urlencode(out),u.fragment))
+        forced_css_status,forced_body=fetch(forced)
+        forced_css_marker='--newfi-portal200' in forced_body
+result={
+ 'status':status,
+ 'bytes':len(body.encode()),
+ 'html_marker':'data-newfi-portal200="1"' in body,
+ 'css_marker':'--newfi-portal200' in normal_css_text,
+ 'old_copy':'Закрытое пространство для общения, знаний и материалов сообщества.' in body,
+ 'css_count':len(hrefs),
+ 'css_status':normal_status,
+ 'forced_css_status':forced_css_status,
+ 'forced_css_marker':forced_css_marker,
+}
+print('PORTAL200_HTTP_JSON='+json.dumps(result,ensure_ascii=False,sort_keys=True,separators=(',',':')))
+if status!=expected_status: raise SystemExit(45)
+if mode=='prod':
+    if not hrefs or any(x!=200 for x in normal_status): raise SystemExit(46)
+elif mode=='staging':
+    if any(x!=200 for x in normal_status): raise SystemExit(46)
+else:
+    raise SystemExit(50)
+if mode=='prod' and state=='new':
+    if not result['html_marker'] or not result['css_marker']: raise SystemExit(47)
+elif mode=='prod' and state=='old':
+    if result['html_marker'] or result['css_marker'] or not result['old_copy']: raise SystemExit(48)
+elif mode=='staging' and state=='new':
+    if hrefs and (forced_css_status!=200 or not forced_css_marker): raise SystemExit(49)
+elif mode=='staging' and state=='old':
+    pass
+else:
+    raise SystemExit(50)
+'''
+
+
+def parse_inspect(text):
+    b = "PORTAL200_INSPECT_JSON_BEGIN\n"
+    e = "\nPORTAL200_INSPECT_JSON_END"
+    if b not in text or e not in text:
+        fail("INSPECT_MARKERS")
+    try:
+        return json.loads(text.split(b, 1)[1].split(e, 1)[0])
+    except Exception:
+        fail("INSPECT_JSON")
+
+
+def inspect(target):
+    return parse_inspect(
+        qga(target, ["/usr/bin/php8.3"], input_bytes=INSPECT_PHP.encode(), timeout=120)
+    )
+
+
+def source_is_old(data):
+    src = data["source"]
+    for rel, (size, sha) in EXPECTED_OLD.items():
+        row = src.get(rel)
+        if not row or row.get("bytes") != size or row.get("sha256") != sha:
+            return False
+    return src.get("Service/PortalData.php") is None
+
+
+def source_is_new(data):
+    src = data["source"]
+    for rel, (size, sha) in EXPECTED_NEW.items():
+        row = src.get(rel)
+        if not row or row.get("bytes") != size or row.get("sha256") != sha:
+            return False
+    return True
+
+
+def template_state_new(data):
+    rows = data.get("templates", [])
+    rows0 = [r for r in rows if int(r.get("style_id", -1)) == 0]
+    titles = [r.get("title") for r in rows0]
+    by = {r.get("title"): r for r in rows0}
+    return (
+        titles == ["newfi_portal", "newfi_portal.less"]
+        and int(by["newfi_portal"].get("html_marker", 0)) == 1
+        and int(by["newfi_portal.less"].get("css_marker", 0)) == 1
+    )
+
+
+def app_contract(data, target):
+    a = data.get("application", {})
+    addon = data.get("addon") or {}
+    expected = {
+        "staging": ("0", "http://newfi-staging.gram1.ru"),
+        "prod": ("1", "https://newfi.ru"),
+    }[target]
+    return (
+        a.get("boardActive") == expected[0]
+        and a.get("boardUrl") == expected[1]
+        and a.get("indexRoute") == "portal/"
+        and a.get("defaultStyleId") == "4"
+        and addon.get("addon_id") == "Newfi/Portal"
+        and int(addon.get("version_id", 0)) == 1000010
+        and addon.get("version_string") == "1.0.0 Alpha 1"
+        and int(addon.get("active", 0)) == 1
+        and int(addon.get("is_processing", 1)) == 0
+    )
+
+
+def new_errors(target, baseline):
+    raw = qga(
+        target,
+        ["/usr/bin/php8.3"],
+        input_bytes=(ERRORS_PHP_TEMPLATE % int(baseline)).encode(),
+        timeout=90,
+    )
+    try:
+        return json.loads(raw)
+    except Exception:
+        fail("ERROR_LOG_JSON")
+
+
+def assert_no_new_errors(target, baseline, phase):
+    rows = new_errors(target, baseline)
+    if rows:
+        emit(
+            "PORTAL200_NEW_XF_ERRORS",
+            {
+                "target": target,
+                "phase": phase,
+                "count": len(rows),
+                "ids": [r.get("error_id") for r in rows],
+            },
+        )
+        fail("NEW_XF_ERRORS")
+
+
+def guest_backup(target):
+    script = f'''set -eu
+B={shlex.quote(BACKUP)}
+P=/var/www/forums/newfi/public/src/addons/Newfi/Portal
+test ! -e "$B"
+install -d -m 700 "$B/Pub/Controller" "$B/_data"
+cp -p -- "$P/Pub/Controller/Portal.php" "$B/Pub/Controller/Portal.php"
+cp -p -- "$P/_data/templates.xml" "$B/_data/templates.xml"
+test ! -e "$P/Service/PortalData.php"
+printf 'PORTAL200_BACKUP=PASS\n'
+'''
+    out = qga(target, ["/bin/bash", "-lc", script], timeout=90)
+    if "PORTAL200_BACKUP=PASS" not in out:
+        fail("BACKUP_FAILED")
+
+
+def guest_write(target, rel, data):
+    dest = f"/var/www/forums/newfi/public/src/addons/Newfi/Portal/{rel}"
+    parent = str(pathlib.PurePosixPath(dest).parent)
+    script = (
+        "set -eu; umask 022; "
+        + "install -d -m 755 "
+        + shlex.quote(parent)
+        + "; T=$(mktemp "
+        + shlex.quote(parent + "/.portal200.XXXXXX")
+        + "); cat >\"$T\"; chmod 0644 \"$T\"; chown root:root \"$T\"; "
+        + "mv -f -- \"$T\" "
+        + shlex.quote(dest)
+        + "; printf 'PORTAL200_WRITE=PASS\\n'"
+    )
+    out = qga(
+        target,
+        ["/bin/bash", "-lc", script],
+        input_bytes=data,
+        timeout=90,
+    )
+    if "PORTAL200_WRITE=PASS" not in out:
+        fail("WRITE_FAILED")
+
+
+def install_candidate(target):
+    for rel in [
+        "Pub/Controller/Portal.php",
+        "Service/PortalData.php",
+        "_data/templates.xml",
+    ]:
+        guest_write(target, rel, (CAND_ROOT / rel).read_bytes())
+
+
+def restore_old(target):
+    script = f'''set -eu
+B={shlex.quote(BACKUP)}
+P=/var/www/forums/newfi/public/src/addons/Newfi/Portal
+test -f "$B/Pub/Controller/Portal.php"
+test -f "$B/_data/templates.xml"
+cp -p -- "$B/Pub/Controller/Portal.php" "$P/Pub/Controller/Portal.php"
+cp -p -- "$B/_data/templates.xml" "$P/_data/templates.xml"
+rm -f -- "$P/Service/PortalData.php"
+rmdir -- "$P/Service" 2>/dev/null || true
+printf 'PORTAL200_SOURCE_RESTORE=PASS\n'
+'''
+    out = qga(target, ["/bin/bash", "-lc", script], timeout=90)
+    if "PORTAL200_SOURCE_RESTORE=PASS" not in out:
+        fail("SOURCE_RESTORE_FAILED")
+
+
+def import_addon(target):
+    out = qga(
+        target,
+        ["/usr/bin/php8.3"],
+        input_bytes=IMPORT_PHP.encode(),
+        timeout=240,
+    )
+    if "PORTAL200_IMPORT_JSON=" not in out:
+        fail("IMPORT_FAILED")
+
+
+def runtime_verify(target, state):
+    src = RUNTIME_VERIFY_PHP_TEMPLATE.replace("__STATE__", state)
+    out = qga(target, ["/usr/bin/php8.3"], input_bytes=src.encode(), timeout=120)
+    line = next(
+        (x for x in out.splitlines() if x.startswith("PORTAL200_RUNTIME_JSON=")),
+        None,
+    )
+    if not line:
+        fail("RUNTIME_MARKER_MISSING")
+    try:
+        data = json.loads(line.split("=", 1)[1])
+    except Exception:
+        fail("RUNTIME_JSON")
+    emit("PORTAL200_RUNTIME", {"target": target, **data})
+    return data
+
+
+def http_verify(target, state):
+    argv = ["/usr/bin/python3", "-", target, state]
+    if target == "prod":
+        try:
+            p = subprocess.run(
+                argv,
+                input=HTTP_VERIFY_PY.encode(),
+                stdout=subprocess.PIPE,
+                stderr=subprocess.PIPE,
+                timeout=180,
+                check=False,
+            )
+        except subprocess.TimeoutExpired:
+            fail("HTTP_PROD_TIMEOUT")
+        out = p.stdout.decode("utf-8", "replace")
+        err = p.stderr.decode("utf-8", "replace")
+        line = next(
+            (x for x in out.splitlines() if x.startswith("PORTAL200_HTTP_JSON=")),
+            None,
+        )
+        data = None
+        if line:
+            try:
+                data = json.loads(line.split("=", 1)[1])
+                emit("PORTAL200_HTTP", {"target": target, "state": state, **data})
+            except Exception:
+                fail("HTTP_JSON")
+        if p.returncode != 0:
+            emit(
+                "PORTAL200_HTTP_EXEC",
+                {
+                    "target": target,
+                    "state": state,
+                    "rc": p.returncode,
+                    "stderr": err[:800],
+                },
+            )
+            fail("HTTP_PROD_RC")
+        if data is None:
+            fail("HTTP_MARKER_MISSING")
+        return data
+
+    out = qga(
+        target,
+        argv,
+        input_bytes=HTTP_VERIFY_PY.encode(),
+        timeout=180,
+    )
+    line = next(
+        (x for x in out.splitlines() if x.startswith("PORTAL200_HTTP_JSON=")),
+        None,
+    )
+    if not line:
+        fail("HTTP_MARKER_MISSING")
+    try:
+        data = json.loads(line.split("=", 1)[1])
+    except Exception:
+        fail("HTTP_JSON")
+    emit("PORTAL200_HTTP", {"target": target, "state": state, **data})
+    return data
+
+
+def verify_new(target, baseline):
+    data = inspect(target)
+    if not app_contract(data, target):
+        fail("APP_CONTRACT_NEW")
+    if not source_is_new(data):
+        fail("SOURCE_NEW_MISMATCH")
+    if not template_state_new(data):
+        fail("TEMPLATE_NEW_MISMATCH")
+    runtime_verify(target, "new")
+    http_verify(target, "new")
+    assert_no_new_errors(target, baseline, "verify-new")
+    return inspect(target)
+
+
+def verify_old(target, baseline, old_templates, strict_errors=True):
+    data = inspect(target)
+    if not app_contract(data, target):
+        fail("APP_CONTRACT_OLD")
+    if not source_is_old(data):
+        fail("SOURCE_OLD_MISMATCH")
+    if data.get("templates") != old_templates:
+        fail("TEMPLATE_ROLLBACK_MISMATCH")
+    if target == "prod":
+        runtime_verify(target, "old")
+    http_verify(target, "old")
+    if strict_errors:
+        assert_no_new_errors(target, baseline, "verify-old")
+    return inspect(target)
+
+
+def lint_php(target, source, label):
+    out = qga(
+        target,
+        ["/usr/bin/php8.3", "-l"],
+        input_bytes=source.encode(),
+        timeout=90,
+    )
+    if "No syntax errors detected" not in out:
+        fail("PHP_LINT_" + label)
+
+
+def cluster_guard():
+    p = run(["/usr/sbin/qm", "status", "210"], timeout=30)
+    if "status: running" not in p.stdout.decode():
+        fail("VM210_NOT_RUNNING")
+    p = run(
+        [
+            "/usr/bin/ssh",
+            "-T",
+            "-o",
+            "BatchMode=yes",
+            "-o",
+            "StrictHostKeyChecking=yes",
+            "-o",
+            "UpdateHostKeys=no",
+            "-o",
+            "ConnectTimeout=10",
+            "root@pve03",
+            "/usr/sbin/qm status 211",
+        ],
+        timeout=40,
+    )
+    if "status: running" not in p.stdout.decode():
+        fail("VM211_NOT_RUNNING")
+    emit("PORTAL200_CLUSTER", "PASS")
+
+
+def result_contract(status, changes, rollback_started, rollback_restored):
+    emit(
+        "HOMELAB_RESULT_CONTRACT",
+        {
+            "version": 1,
+            "command_id": CID,
+            "status": status,
+            "changes_made": bool(changes),
+            "rollback_started": bool(rollback_started),
+            "rollback_restored": rollback_restored,
+        },
+    )
+
+
+emit("NEWFI200_BEGIN")
+emit("COMMAND_ID", CID)
+emit("PORTAL200_REMAINING_FULL_PRODUCT_COMMANDS_BEFORE", 22)
+emit(
+    "PORTAL200_FLOW",
+    "candidate->staging-apply->rollback-proof->staging-reapply->git-push->production",
+)
+
+staging_backup = False
+staging_mutated = False
+staging_final_new = False
+prod_backup = False
+prod_mutated = False
+git_files_changed = False
+commit_created = False
+push_confirmed = False
+failure_rollback_started = False
+failure_rollback_restored = None
+old_git_bytes = {}
+new_head = None
+s_error = None
+p_error = None
+s_old_templates = None
+p_old_templates = None
+
+try:
+    compile(HTTP_VERIFY_PY, "<portal200-http-verify>", "exec")
+    for rel, (size, sha) in EXPECTED_NEW.items():
+        p = CAND_ROOT / rel
+        if not p.is_file() or file_meta(p) != (size, sha):
+            fail("CANDIDATE_IDENTITY")
+    tree = ET.parse(CAND_ROOT / "_data/templates.xml")
+    titles = sorted(x.attrib.get("title") for x in tree.getroot().findall("template"))
+    if titles != ["newfi_portal", "newfi_portal.less"]:
+        fail("CANDIDATE_TEMPLATE_SET")
+    service = (CAND_ROOT / "Service/PortalData.php").read_text("utf-8")
+    if any(
+        token in service
+        for token in [
+            "\\XF::db(",
+            "->save(",
+            "->delete(",
+            "INSERT ",
+            "UPDATE ",
+            "DELETE ",
+            "REPLACE ",
+        ]
+    ):
+        fail("CANDIDATE_MUTATION_SCAN")
+    emit("PORTAL200_CANDIDATE_IDENTITY", "PASS")
+    emit(
+        "PORTAL200_ORCHESTRATION_FIXES",
+        {
+            "staging_503_without_css_links": True,
+            "failure_status": "FAIL",
+            "prod_http_via_pve01_public_route": True,
+            "css_href_regex_fixed": True,
+        },
+    )
+
+    branch = git("branch", "--show-current")
+    head = git("rev-parse", "HEAD")
+    status = git("status", "--porcelain=v1", "--untracked-files=all")
+    remote_out = git("ls-remote", "origin", f"refs/heads/{BRANCH}")
+    remote = remote_out.split()[0] if remote_out else ""
+    if branch != BRANCH or head != OLD_HEAD or remote != OLD_HEAD or status:
+        fail("GIT_PRESTATE")
+    emit(
+        "PORTAL200_GIT_PRESTATE",
+        {"branch": branch, "head": head, "remote": remote, "clean": True},
+    )
+    cluster_guard()
+
+    lint_php("staging", INSPECT_PHP, "INSPECT_STAGING")
+    lint_php("staging", IMPORT_PHP, "IMPORT_STAGING")
+    lint_php("staging", RUNTIME_VERIFY_PHP_TEMPLATE.replace("__STATE__", "new"), "RUNTIME_STAGING")
+    lint_php("prod", INSPECT_PHP, "INSPECT_PROD")
+    lint_php("prod", IMPORT_PHP, "IMPORT_PROD")
+    lint_php("prod", RUNTIME_VERIFY_PHP_TEMPLATE.replace("__STATE__", "new"), "RUNTIME_PROD")
+    emit("PORTAL200_RUNTIME_HELPER_LINT", "PASS")
+
+    s0 = inspect("staging")
+    p0 = inspect("prod")
+    if not app_contract(s0, "staging") or not app_contract(p0, "prod"):
+        fail("APP_PRESTATE")
+    if not source_is_old(s0) or not source_is_old(p0):
+        fail("SOURCE_PRESTATE")
+    if s0.get("templates") != p0.get("templates"):
+        fail("TEMPLATE_PRESTATE_PARITY")
+    s_error = int(s0["application"]["error_max_id"])
+    p_error = int(p0["application"]["error_max_id"])
+    s_old_templates = s0["templates"]
+    p_old_templates = p0["templates"]
+    emit("PORTAL200_ERROR_BASELINE", {"staging": s_error, "prod": p_error})
+    http_verify("staging", "old")
+    runtime_verify("prod", "old")
+    http_verify("prod", "old")
+    assert_no_new_errors("staging", s_error, "preflight")
+    assert_no_new_errors("prod", p_error, "preflight")
+    emit("PORTAL200_PREFLIGHT", "PASS")
+
+    guest_backup("staging")
+    staging_backup = True
+    staging_mutated = True
+    install_candidate("staging")
+    import_addon("staging")
+    verify_new("staging", s_error)
+    emit("PORTAL200_STAGING_FIRST_APPLY", "PASS")
+
+    restore_old("staging")
+    import_addon("staging")
+    verify_old("staging", s_error, s_old_templates)
+    staging_mutated = False
+    emit("PORTAL200_STAGING_ROLLBACK_PROOF", "PASS")
+
+    staging_mutated = True
+    install_candidate("staging")
+    import_addon("staging")
+    verify_new("staging", s_error)
+    staging_final_new = True
+    emit("PORTAL200_STAGING_FINAL", "PASS")
+
+    for rel in EXPECTED_NEW:
+        dest = GIT_PORTAL / rel
+        old_git_bytes[str(rel)] = dest.read_bytes() if dest.exists() else None
+        dest.parent.mkdir(parents=True, exist_ok=True)
+        shutil.copyfile(CAND_ROOT / rel, dest)
+    git_files_changed = True
+
+    if git("diff", "--check"):
+        fail("GIT_DIFF_CHECK")
+    status_lines = git("status", "--porcelain=v1", "--untracked-files=all").splitlines()
+    actual_paths = sorted(line[3:] for line in status_lines if len(line) >= 4)
+    if actual_paths != sorted(EXPECTED_GIT_PATHS):
+        fail("GIT_SCOPE")
+    git("add", "--", *EXPECTED_GIT_PATHS)
+    staged = sorted(x for x in git("diff", "--cached", "--name-only").splitlines() if x)
+    if staged != sorted(EXPECTED_GIT_PATHS):
+        fail("GIT_STAGED_SCOPE")
+    git("commit", "-m", f"feat: build data-backed Newfi portal [{CID}]")
+    commit_created = True
+    new_head = git("rev-parse", "HEAD")
+    if new_head == OLD_HEAD:
+        fail("GIT_COMMIT_HEAD")
+    if git("status", "--porcelain=v1", "--untracked-files=all"):
+        fail("GIT_POSTCOMMIT_DIRTY")
+    git("push", "origin", f"HEAD:refs/heads/{BRANCH}", timeout=180)
+    remote_out = git("ls-remote", "origin", f"refs/heads/{BRANCH}")
+    remote_head = remote_out.split()[0] if remote_out else ""
+    if remote_head != new_head:
+        fail("GIT_REMOTE_HEAD")
+    push_confirmed = True
+    emit(
+        "PORTAL200_GIT_PROMOTION",
+        {
+            "old_head": OLD_HEAD,
+            "new_head": new_head,
+            "remote_head": remote_head,
+            "result": "PASS",
+        },
+    )
+
+    p_pre = inspect("prod")
+    if not source_is_old(p_pre) or p_pre.get("templates") != p_old_templates:
+        fail("PROD_DRIFT_BEFORE_APPLY")
+    if int(p_pre["application"]["error_max_id"]) != p_error:
+        fail("PROD_ERROR_DRIFT")
+    guest_backup("prod")
+    prod_backup = True
+    prod_mutated = True
+    install_candidate("prod")
+    import_addon("prod")
+    verify_new("prod", p_error)
+    emit("PORTAL200_PRODUCTION", "PASS")
+
+    sf = verify_new("staging", s_error)
+    pf = verify_new("prod", p_error)
+    if sf["source"] != pf["source"]:
+        fail("FINAL_SOURCE_PARITY")
+    if sf["templates"] != pf["templates"]:
+        fail("FINAL_TEMPLATE_PARITY")
+    if git("rev-parse", "HEAD") != new_head:
+        fail("FINAL_LOCAL_HEAD")
+    remote_out = git("ls-remote", "origin", f"refs/heads/{BRANCH}")
+    if not remote_out or remote_out.split()[0] != new_head:
+        fail("FINAL_REMOTE_HEAD")
+    if git("status", "--porcelain=v1", "--untracked-files=all"):
+        fail("FINAL_GIT_DIRTY")
+    cluster_guard()
+    emit(
+        "PORTAL200_FINAL_EVIDENCE",
+        {
+            "commit": new_head,
+            "source_files": 3,
+            "templates": 2,
+            "staging_error_baseline": s_error,
+            "prod_error_baseline": p_error,
+        },
+    )
+    emit("PORTAL200_PORTAL", "PASS")
+    emit("PORTAL200_STAGING", "PASS")
+    emit("PORTAL200_PRODUCTION", "PASS")
+    emit("PORTAL200_REMAINING_FULL_PRODUCT_COMMANDS_AFTER_PASS", 21)
+    result_contract("OK", True, False, None)
+    emit("NEWFI200_END")
+    raise SystemExit(0)
+
+except PortalError as exc:
+    code = str(exc)
+    emit("PORTAL200_FAILURE", code)
+
+    if push_confirmed:
+        if prod_mutated and prod_backup:
+            failure_rollback_started = True
+            try:
+                restore_old("prod")
+                import_addon("prod")
+                verify_old("prod", p_error, p_old_templates, strict_errors=False)
+                prod_mutated = False
+                failure_rollback_restored = False
+                emit("PORTAL200_FAILURE_PROD_ROLLBACK", "PASS_PARTIAL_OVERALL_STATE_CHANGED")
+            except Exception:
+                failure_rollback_restored = False
+                emit("PORTAL200_FAILURE_PROD_ROLLBACK", "FAIL")
+    else:
+        if staging_mutated and staging_backup:
+            failure_rollback_started = True
+            try:
+                restore_old("staging")
+                import_addon("staging")
+                verify_old("staging", s_error, s_old_templates, strict_errors=False)
+                staging_mutated = False
+                staging_final_new = False
+                failure_rollback_restored = True
+                emit("PORTAL200_FAILURE_STAGING_ROLLBACK", "PASS")
+            except Exception:
+                failure_rollback_restored = False
+                emit("PORTAL200_FAILURE_STAGING_ROLLBACK", "FAIL")
+
+        if git_files_changed and not commit_created:
+            try:
+                for rel, old in old_git_bytes.items():
+                    dest = GIT_PORTAL / rel
+                    if old is None:
+                        if dest.exists():
+                            dest.unlink()
+                    else:
+                        dest.write_bytes(old)
+                service_dir = GIT_PORTAL / "Service"
+                try:
+                    service_dir.rmdir()
+                except OSError:
+                    pass
+                emit("PORTAL200_FAILURE_GIT_WORKTREE_RESTORE", "PASS")
+            except Exception:
+                emit("PORTAL200_FAILURE_GIT_WORKTREE_RESTORE", "FAIL")
+
+        if commit_created:
+            emit(
+                "PORTAL200_FAILURE_GIT_HISTORY",
+                "COMMIT_CREATED_NO_DESTRUCTIVE_RESET_FRESH_ID_REQUIRED",
+            )
+
+    persisted = bool(push_confirmed or commit_created or staging_final_new or prod_mutated)
+    if failure_rollback_started and failure_rollback_restored is None:
+        failure_rollback_restored = False
+    result_contract(
+        "FAIL",
+        persisted,
+        failure_rollback_started,
+        failure_rollback_restored,
+    )
+    emit("PORTAL200_ROADMAP_REMAINS", 22)
+    emit("NEWFI200_END")
+    raise SystemExit(1)
+
+except Exception:
+    emit("PORTAL200_FAILURE", "UNEXPECTED_EXCEPTION")
+    result_contract(
+        "FAIL",
+        bool(push_confirmed or commit_created or staging_final_new or prod_mutated),
+        False,
+        None,
+    )
+    emit("PORTAL200_ROADMAP_REMAINS", 22)
+    emit("NEWFI200_END")
+    raise SystemExit(1)
+
+CANDIDATE_LAYER_2_TEXT_END
+CANDIDATE_LAYER_3_SOURCE=file:newfi-48-portal200-apply2.cmd::b64::zlib
+CANDIDATE_LAYER_3_SHA256=5e3aa56505b7d7ef5b7f0cf588f89d5e1c5f6b8bd9bffc13b8debdbdc5be26c7
+CANDIDATE_LAYER_3_BYTES=32663
+CANDIDATE_LAYER_3_TEXT_BEGIN
+import hashlib
+import json
+import pathlib
+import shlex
+import shutil
+import subprocess
+import sys
+import xml.etree.ElementTree as ET
+
+CID = "NEWFI-260907-PORTAL200-APPLY2"
+BRANCH = "implementation/newfi-closed-mvp-20260906"
+OLD_HEAD = "06bab5acd124e768f70305b3d7eca2f595871890"
+WT = pathlib.Path("/root/newfi-portal/.worktrees/implementation-newfi-closed-mvp-20260906")
+CAND_ROOT = pathlib.Path("/root/newfi-portal200-candidate/src/addons/Newfi/Portal")
+PORTAL_REL = pathlib.Path("src/addons/Newfi/Portal")
+GIT_PORTAL = WT / PORTAL_REL
+EXPECTED_NEW = {
+    "Pub/Controller/Portal.php": (363, "619d489f7cc3b461479c702fa8825097ae22d3c6cfeb911e9f14ea1de9c36d6d"),
+    "Service/PortalData.php": (5213, "4da03f26294ab6d163a1a746dee4bb6a82d7d4f39e66b24246bc0eb4c455dd1d"),
+    "_data/templates.xml": (10977, "1650c3d868d4bc47703f1b75f1f179cd25309b2d3b20a2b848e81a4423c00861"),
+}
+EXPECTED_OLD = {
+    "Pub/Controller/Portal.php": (247, "53909e753ea5a011550fd280ad1c342a74ca9949be092dfbd95244243cae92f3"),
+    "_data/templates.xml": (1461, "c29c04f8b937284e821c87957653e87c2f6ac014fac30648a0f6b18e84392adf"),
+}
+EXPECTED_GIT_PATHS = [str(PORTAL_REL / p) for p in sorted(EXPECTED_NEW)]
+BACKUP = f"/root/newfi-portal200-backup-{CID}"
+
+
+class PortalError(RuntimeError):
+    pass
+
+
+def emit(key, value=None):
+    if value is None:
+        print(key, flush=True)
+    elif isinstance(value, (dict, list, tuple, bool, int, float)):
+        print(
+            key + "=" + json.dumps(value, ensure_ascii=False, sort_keys=True, separators=(",", ":")),
+            flush=True,
+        )
+    else:
+        print(key + "=" + str(value), flush=True)
+
+
+def fail(code):
+    raise PortalError(code)
+
+
+def sha_bytes(data):
+    return hashlib.sha256(data).hexdigest()
+
+
+def file_meta(path):
+    data = pathlib.Path(path).read_bytes()
+    return len(data), sha_bytes(data)
+
+
+def run(cmd, *, input_bytes=None, timeout=180, ok=(0,)):
+    try:
+        p = subprocess.run(
+            cmd,
+            input=input_bytes,
+            stdout=subprocess.PIPE,
+            stderr=subprocess.PIPE,
+            timeout=timeout,
+            check=False,
+        )
+    except subprocess.TimeoutExpired:
+        fail("SUBPROCESS_TIMEOUT")
+    if p.returncode not in ok:
+        fail("SUBPROCESS_RC")
+    return p
+
+
+def git(*args, ok=(0,), timeout=120):
+    p = run(["/usr/bin/git", "-C", str(WT), *args], timeout=timeout, ok=ok)
+    return p.stdout.decode("utf-8", "replace").strip()
+
+
+def qga(target, argv, *, input_bytes=None, timeout=180):
+    if target == "prod":
+        cmd = [
+            "/usr/sbin/qm",
+            "guest",
+            "exec",
+            "210",
+            "--synchronous",
+            "1",
+            "--timeout",
+            str(timeout),
+        ]
+        if input_bytes is not None:
+            cmd += ["--pass-stdin", "1"]
+        cmd += ["--", *argv]
+    elif target == "staging":
+        q = [
+            "/usr/sbin/qm",
+            "guest",
+            "exec",
+            "211",
+            "--synchronous",
+            "1",
+            "--timeout",
+            str(timeout),
+        ]
+        if input_bytes is not None:
+            q += ["--pass-stdin", "1"]
+        q += ["--", *argv]
+        remote = (
+            "test \"$(id -u):$(hostname -s)\" = 0:pve03 || exit 72; "
+            "for f in /etc/pve/HOMELAB_ASSISTANT_ERROR_REGISTER.md /etc/pve/31_HOMELAB_REFERENCE.md; do "
+            "test -r \"$f\" && test -s \"$f\" && cat -- \"$f\" >/dev/null || exit 73; done; exec "
+            + " ".join(shlex.quote(x) for x in q)
+        )
+        cmd = [
+            "/usr/bin/ssh",
+            "-T",
+            "-o",
+            "BatchMode=yes",
+            "-o",
+            "StrictHostKeyChecking=yes",
+            "-o",
+            "UpdateHostKeys=no",
+            "-o",
+            "ConnectTimeout=10",
+            "-o",
+            "ConnectionAttempts=1",
+            "root@pve03",
+            remote,
+        ]
+    else:
+        fail("BAD_TARGET")
+
+    p = run(cmd, input_bytes=input_bytes, timeout=timeout + 30)
+    try:
+        data = json.loads(p.stdout.decode("utf-8"))
+    except Exception:
+        fail("QGA_JSON")
+    if data.get("exited") not in (1, True) or data.get("exitcode") != 0:
+        fail("QGA_GUEST_RC")
+    if data.get("out-truncated") or data.get("err-truncated"):
+        fail("QGA_TRUNCATED")
+    return data.get("out-data", "")
+
+
+INSPECT_PHP = r'''<?php
+$root = '/var/www/forums/newfi/public';
+require $root . '/src/XF.php';
+\XF::start($root);
+$app = \XF::setupApp('XF\\Pub\\App');
+$db = $app->db();
+function srcMeta(string $path): ?array {
+    if (!is_file($path)) { return null; }
+    return ['bytes' => filesize($path), 'sha256' => hash_file('sha256', $path)];
+}
+$portal = $root . '/src/addons/Newfi/Portal';
+$templates = $db->fetchAll(
+    "SELECT title, style_id, LENGTH(template) AS bytes, SHA2(template,256) AS sha256, " .
+    "LOCATE('data-newfi-portal200', template) > 0 AS html_marker, " .
+    "LOCATE('--newfi-portal200', template) > 0 AS css_marker " .
+    "FROM xf_template WHERE addon_id='Newfi/Portal' ORDER BY style_id,title"
+);
+$result = [
+ 'hostname' => gethostname(),
+ 'application' => [
+  'boardActive' => (string)$db->fetchOne("SELECT option_value FROM xf_option WHERE option_id='boardActive'"),
+  'boardUrl' => (string)$db->fetchOne("SELECT option_value FROM xf_option WHERE option_id='boardUrl'"),
+  'indexRoute' => (string)$db->fetchOne("SELECT option_value FROM xf_option WHERE option_id='indexRoute'"),
+  'defaultStyleId' => (string)$db->fetchOne("SELECT option_value FROM xf_option WHERE option_id='defaultStyleId'"),
+  'error_count' => (int)$db->fetchOne("SELECT COUNT(*) FROM xf_error_log"),
+  'error_max_id' => (int)$db->fetchOne("SELECT COALESCE(MAX(error_id),0) FROM xf_error_log")
+ ],
+ 'addon' => $db->fetchRow(
+  "SELECT addon_id,version_id,version_string,active,is_processing,last_pending_action " .
+  "FROM xf_addon WHERE addon_id='Newfi/Portal'"
+ ),
+ 'source' => [
+  'Pub/Controller/Portal.php' => srcMeta($portal . '/Pub/Controller/Portal.php'),
+  'Service/PortalData.php' => srcMeta($portal . '/Service/PortalData.php'),
+  '_data/templates.xml' => srcMeta($portal . '/_data/templates.xml')
+ ],
+ 'templates' => $templates
+];
+echo "PORTAL200_INSPECT_JSON_BEGIN\n";
+echo json_encode(
+    $result,
+    JSON_UNESCAPED_UNICODE|JSON_UNESCAPED_SLASHES|JSON_INVALID_UTF8_SUBSTITUTE
+);
+echo "\nPORTAL200_INSPECT_JSON_END\n";
+?>'''
+
+
+IMPORT_PHP = r'''<?php
+$root = '/var/www/forums/newfi/public';
+require $root . '/src/XF.php';
+\XF::start($root);
+$app = \XF::setupApp('XF\\Pub\\App');
+$addOn = $app->addOnManager()->getById('Newfi/Portal');
+if (!$addOn || !$addOn->isInstalled()) {
+    fwrite(STDERR, "ADDON_NOT_INSTALLED\n");
+    exit(30);
+}
+$addOn->preRebuild();
+$dataManager = $app->addOnDataManager();
+$imported = [];
+foreach ($dataManager->getDataTypeClasses() as $dataType) {
+    $handler = $dataManager->getDataTypeHandler($dataType);
+    $xml = $handler->openTypeFile($addOn->getDataDirectory());
+    if (!$xml || !$xml->count()) {
+        $handler->deleteAddOnData($addOn->addon_id);
+        continue;
+    }
+    $start = 0;
+    $guard = 0;
+    while (true) {
+        $last = $handler->importAddOnData($addOn->addon_id, $xml, $start, 0);
+        if (!$last) { break; }
+        if ($last <= $start || ++$guard > 100000) {
+            fwrite(STDERR, "IMPORT_PROGRESS_INVALID\n");
+            exit(31);
+        }
+        $start = $last;
+    }
+    $handler->deleteOrphanedAddOnData($addOn->addon_id, $xml);
+    \XF::triggerRunOnce();
+    $imported[] = $handler->getContainerTag();
+}
+$addOn->postDataImport();
+$repo = $app->repository(\XF\Repository\StyleRepository::class);
+$repo->updateAllStylesLastModifiedDateLater();
+$addOn->postRebuild();
+echo "PORTAL200_IMPORT_JSON=" . json_encode(
+    ['result'=>'PASS','containers'=>$imported],
+    JSON_UNESCAPED_SLASHES
+) . "\n";
+?>'''
+
+
+ERRORS_PHP_TEMPLATE = r'''<?php
+$root='/var/www/forums/newfi/public';
+require $root.'/src/XF.php';
+\XF::start($root);
+$app=\XF::setupApp('XF\\Pub\\App');
+$db=$app->db();
+$b=%d;
+$rows=$db->fetchAll(
+    "SELECT error_id,exception_type,message,filename,line FROM xf_error_log WHERE error_id>? ORDER BY error_id",
+    [$b]
+);
+echo json_encode(
+    $rows,
+    JSON_UNESCAPED_UNICODE|JSON_UNESCAPED_SLASHES|JSON_INVALID_UTF8_SUBSTITUTE
+);
+?>'''
+
+
+RUNTIME_VERIFY_PHP_TEMPLATE = r'''<?php
+$state = '__STATE__';
+$root = '/var/www/forums/newfi/public';
+require $root . '/src/XF.php';
+\XF::start($root);
+$app = \XF::setupApp('XF\\Pub\\App');
+$result = ['state'=>$state];
+if ($state === 'new') {
+    $service = new \Newfi\Portal\Service\PortalData($app);
+    $portal = $service->build();
+    $html = (string)$app->templater()->renderTemplate('public:newfi_portal', ['portal'=>$portal]);
+    $result['sections'] = [];
+    foreach (['forums','resources','media','events','dogs'] as $key) {
+        $section = $portal[$key] ?? null;
+        if (!is_array($section)) { fwrite(STDERR, "SECTION_MISSING\n"); exit(60); }
+        $result['sections'][$key] = [
+            'available'=>(bool)($section['available'] ?? false),
+            'hasItems'=>(bool)($section['hasItems'] ?? false),
+            'status'=>(string)($section['status'] ?? '')
+        ];
+    }
+    $result['html_marker'] = strpos($html, 'data-newfi-portal200="1"') !== false;
+    $result['locked_resources'] = strpos($html, 'data-portal-locked="resources"') !== false;
+    $result['locked_media'] = strpos($html, 'data-portal-locked="media"') !== false;
+    $result['html_bytes'] = strlen($html);
+    if (!$result['html_marker']) { fwrite(STDERR, "HTML_MARKER_MISSING\n"); exit(61); }
+    if ($result['sections']['resources']['available'] || $result['sections']['media']['available']) {
+        fwrite(STDERR, "GUEST_PERMISSION_CONTRACT_CHANGED\n"); exit(62);
+    }
+    if (!$result['locked_resources'] || !$result['locked_media']) {
+        fwrite(STDERR, "LOCKED_COPY_MISSING\n"); exit(63);
+    }
+    if (!$result['sections']['forums']['available'] || !$result['sections']['events']['available'] || !$result['sections']['dogs']['available']) {
+        fwrite(STDERR, "PUBLIC_SECTION_UNAVAILABLE\n"); exit(64);
+    }
+} else if ($state === 'old') {
+    $html = (string)$app->templater()->renderTemplate('public:newfi_portal', []);
+    $result['html_marker'] = strpos($html, 'data-newfi-portal200') !== false;
+    $result['old_copy'] = strpos($html, 'Закрытое пространство для общения, знаний и материалов сообщества.') !== false;
+    $result['html_bytes'] = strlen($html);
+    if ($result['html_marker'] || !$result['old_copy']) {
+        fwrite(STDERR, "OLD_RENDER_CONTRACT\n"); exit(65);
+    }
+} else {
+    exit(66);
+}
+echo "PORTAL200_RUNTIME_JSON=" . json_encode(
+    $result,
+    JSON_UNESCAPED_UNICODE|JSON_UNESCAPED_SLASHES|JSON_INVALID_UTF8_SUBSTITUTE
+) . "\n";
+?>'''
+
+
+HTTP_VERIFY_PY = r'''import html,json,re,subprocess,sys,urllib.parse
+mode=sys.argv[1]
+state=sys.argv[2]
+if mode=='staging':
+    host='newfi-staging.gram1.ru'; scheme='http'; port='80'; expected_status=503
+elif mode=='prod':
+    host='newfi.ru'; scheme='https'; port='443'; expected_status=200
+else:
+    raise SystemExit(40)
+def fetch(url):
+    cmd=[
+        '/usr/bin/curl','-sS','-k','--max-time','30','--connect-timeout','10',
+        '--resolve',f'{host}:{port}:127.0.0.1','-o','-','-w',
+        '\n__PORTAL_STATUS__%{http_code}',url
+    ]
+    p=subprocess.run(cmd,stdout=subprocess.PIPE,stderr=subprocess.PIPE,check=False)
+    if p.returncode!=0: raise SystemExit(41)
+    text=p.stdout.decode('utf-8','replace')
+    marker='\n__PORTAL_STATUS__'
+    if marker not in text: raise SystemExit(42)
+    body,status=text.rsplit(marker,1)
+    return int(status.strip()),body
+root=f'{scheme}://{host}/'
+status,body=fetch(root)
+hrefs=[]
+for raw in re.findall(r"href=[\"']([^\"']*css\\.php[^\"']*)[\"']",body,re.I):
+    raw=html.unescape(raw)
+    hrefs.append(urllib.parse.urljoin(root,raw))
+normal_css=[]
+normal_status=[]
+for u in hrefs:
+    s,b=fetch(u)
+    normal_status.append(s)
+    normal_css.append(b)
+normal_css_text='\n'.join(normal_css)
+forced_css_marker=None
+forced_css_status=None
+if mode=='staging' and state=='new' and hrefs:
+    u=urllib.parse.urlsplit(hrefs[0])
+    pairs=urllib.parse.parse_qsl(u.query,keep_blank_values=True)
+    out=[]
+    found=False
+    for k,v in pairs:
+        if k=='css':
+            found=True
+            parts=[x for x in v.split(',') if x]
+            if 'public:newfi_portal.less' not in parts:
+                parts.append('public:newfi_portal.less')
+            v=','.join(parts)
+        out.append((k,v))
+    if found:
+        forced=urllib.parse.urlunsplit((u.scheme,u.netloc,u.path,urllib.parse.urlencode(out),u.fragment))
+        forced_css_status,forced_body=fetch(forced)
+        forced_css_marker='--newfi-portal200' in forced_body
+result={
+ 'status':status,
+ 'bytes':len(body.encode()),
+ 'html_marker':'data-newfi-portal200="1"' in body,
+ 'css_marker':'--newfi-portal200' in normal_css_text,
+ 'old_copy':'Закрытое пространство для общения, знаний и материалов сообщества.' in body,
+ 'css_count':len(hrefs),
+ 'css_status':normal_status,
+ 'forced_css_status':forced_css_status,
+ 'forced_css_marker':forced_css_marker,
+}
+print('PORTAL200_HTTP_JSON='+json.dumps(result,ensure_ascii=False,sort_keys=True,separators=(',',':')))
+if status!=expected_status: raise SystemExit(45)
+if mode=='prod':
+    if not hrefs or any(x!=200 for x in normal_status): raise SystemExit(46)
+elif mode=='staging':
+    if any(x!=200 for x in normal_status): raise SystemExit(46)
+else:
+    raise SystemExit(50)
+if mode=='prod' and state=='new':
+    if not result['html_marker'] or not result['css_marker']: raise SystemExit(47)
+elif mode=='prod' and state=='old':
+    if result['html_marker'] or result['css_marker'] or not result['old_copy']: raise SystemExit(48)
+elif mode=='staging' and state=='new':
+    if hrefs and (forced_css_status!=200 or not forced_css_marker): raise SystemExit(49)
+elif mode=='staging' and state=='old':
+    pass
+else:
+    raise SystemExit(50)
+'''
+
+
+def parse_inspect(text):
+    b = "PORTAL200_INSPECT_JSON_BEGIN\n"
+    e = "\nPORTAL200_INSPECT_JSON_END"
+    if b not in text or e not in text:
+        fail("INSPECT_MARKERS")
+    try:
+        return json.loads(text.split(b, 1)[1].split(e, 1)[0])
+    except Exception:
+        fail("INSPECT_JSON")
+
+
+def inspect(target):
+    return parse_inspect(
+        qga(target, ["/usr/bin/php8.3"], input_bytes=INSPECT_PHP.encode(), timeout=120)
+    )
+
+
+def source_is_old(data):
+    src = data["source"]
+    for rel, (size, sha) in EXPECTED_OLD.items():
+        row = src.get(rel)
+        if not row or row.get("bytes") != size or row.get("sha256") != sha:
+            return False
+    return src.get("Service/PortalData.php") is None
+
+
+def source_is_new(data):
+    src = data["source"]
+    for rel, (size, sha) in EXPECTED_NEW.items():
+        row = src.get(rel)
+        if not row or row.get("bytes") != size or row.get("sha256") != sha:
+            return False
+    return True
+
+
+def template_state_new(data):
+    rows = data.get("templates", [])
+    rows0 = [r for r in rows if int(r.get("style_id", -1)) == 0]
+    titles = [r.get("title") for r in rows0]
+    by = {r.get("title"): r for r in rows0}
+    return (
+        titles == ["newfi_portal", "newfi_portal.less"]
+        and int(by["newfi_portal"].get("html_marker", 0)) == 1
+        and int(by["newfi_portal.less"].get("css_marker", 0)) == 1
+    )
+
+
+def app_contract(data, target):
+    a = data.get("application", {})
+    addon = data.get("addon") or {}
+    expected = {
+        "staging": ("0", "http://newfi-staging.gram1.ru"),
+        "prod": ("1", "https://newfi.ru"),
+    }[target]
+    return (
+        a.get("boardActive") == expected[0]
+        and a.get("boardUrl") == expected[1]
+        and a.get("indexRoute") == "portal/"
+        and a.get("defaultStyleId") == "4"
+        and addon.get("addon_id") == "Newfi/Portal"
+        and int(addon.get("version_id", 0)) == 1000010
+        and addon.get("version_string") == "1.0.0 Alpha 1"
+        and int(addon.get("active", 0)) == 1
+        and int(addon.get("is_processing", 1)) == 0
+    )
+
+
+def new_errors(target, baseline):
+    raw = qga(
+        target,
+        ["/usr/bin/php8.3"],
+        input_bytes=(ERRORS_PHP_TEMPLATE % int(baseline)).encode(),
+        timeout=90,
+    )
+    try:
+        return json.loads(raw)
+    except Exception:
+        fail("ERROR_LOG_JSON")
+
+
+def assert_no_new_errors(target, baseline, phase):
+    rows = new_errors(target, baseline)
+    if rows:
+        emit(
+            "PORTAL200_NEW_XF_ERRORS",
+            {
+                "target": target,
+                "phase": phase,
+                "count": len(rows),
+                "ids": [r.get("error_id") for r in rows],
+            },
+        )
+        fail("NEW_XF_ERRORS")
+
+
+def guest_backup(target):
+    script = f'''set -eu
+B={shlex.quote(BACKUP)}
+P=/var/www/forums/newfi/public/src/addons/Newfi/Portal
+test ! -e "$B"
+install -d -m 700 "$B/Pub/Controller" "$B/_data"
+cp -p -- "$P/Pub/Controller/Portal.php" "$B/Pub/Controller/Portal.php"
+cp -p -- "$P/_data/templates.xml" "$B/_data/templates.xml"
+test ! -e "$P/Service/PortalData.php"
+printf 'PORTAL200_BACKUP=PASS\n'
+'''
+    out = qga(target, ["/bin/bash", "-lc", script], timeout=90)
+    if "PORTAL200_BACKUP=PASS" not in out:
+        fail("BACKUP_FAILED")
+
+
+def guest_write(target, rel, data):
+    dest = f"/var/www/forums/newfi/public/src/addons/Newfi/Portal/{rel}"
+    parent = str(pathlib.PurePosixPath(dest).parent)
+    script = (
+        "set -eu; umask 022; "
+        + "install -d -m 755 "
+        + shlex.quote(parent)
+        + "; T=$(mktemp "
+        + shlex.quote(parent + "/.portal200.XXXXXX")
+        + "); cat >\"$T\"; chmod 0644 \"$T\"; chown root:root \"$T\"; "
+        + "mv -f -- \"$T\" "
+        + shlex.quote(dest)
+        + "; printf 'PORTAL200_WRITE=PASS\\n'"
+    )
+    out = qga(
+        target,
+        ["/bin/bash", "-lc", script],
+        input_bytes=data,
+        timeout=90,
+    )
+    if "PORTAL200_WRITE=PASS" not in out:
+        fail("WRITE_FAILED")
+
+
+def install_candidate(target):
+    for rel in [
+        "Pub/Controller/Portal.php",
+        "Service/PortalData.php",
+        "_data/templates.xml",
+    ]:
+        guest_write(target, rel, (CAND_ROOT / rel).read_bytes())
+
+
+def restore_old(target):
+    script = f'''set -eu
+B={shlex.quote(BACKUP)}
+P=/var/www/forums/newfi/public/src/addons/Newfi/Portal
+test -f "$B/Pub/Controller/Portal.php"
+test -f "$B/_data/templates.xml"
+cp -p -- "$B/Pub/Controller/Portal.php" "$P/Pub/Controller/Portal.php"
+cp -p -- "$B/_data/templates.xml" "$P/_data/templates.xml"
+rm -f -- "$P/Service/PortalData.php"
+rmdir -- "$P/Service" 2>/dev/null || true
+printf 'PORTAL200_SOURCE_RESTORE=PASS\n'
+'''
+    out = qga(target, ["/bin/bash", "-lc", script], timeout=90)
+    if "PORTAL200_SOURCE_RESTORE=PASS" not in out:
+        fail("SOURCE_RESTORE_FAILED")
+
+
+def import_addon(target):
+    out = qga(
+        target,
+        ["/usr/bin/php8.3"],
+        input_bytes=IMPORT_PHP.encode(),
+        timeout=240,
+    )
+    if "PORTAL200_IMPORT_JSON=" not in out:
+        fail("IMPORT_FAILED")
+
+
+def runtime_verify(target, state):
+    src = RUNTIME_VERIFY_PHP_TEMPLATE.replace("__STATE__", state)
+    out = qga(target, ["/usr/bin/php8.3"], input_bytes=src.encode(), timeout=120)
+    line = next(
+        (x for x in out.splitlines() if x.startswith("PORTAL200_RUNTIME_JSON=")),
+        None,
+    )
+    if not line:
+        fail("RUNTIME_MARKER_MISSING")
+    try:
+        data = json.loads(line.split("=", 1)[1])
+    except Exception:
+        fail("RUNTIME_JSON")
+    emit("PORTAL200_RUNTIME", {"target": target, **data})
+    return data
+
+
+def http_verify(target, state):
+    out = qga(
+        target,
+        ["/usr/bin/python3", "-", target, state],
+        input_bytes=HTTP_VERIFY_PY.encode(),
+        timeout=180,
+    )
+    line = next(
+        (x for x in out.splitlines() if x.startswith("PORTAL200_HTTP_JSON=")),
+        None,
+    )
+    if not line:
+        fail("HTTP_MARKER_MISSING")
+    try:
+        data = json.loads(line.split("=", 1)[1])
+    except Exception:
+        fail("HTTP_JSON")
+    emit("PORTAL200_HTTP", {"target": target, "state": state, **data})
+    return data
+
+
+def verify_new(target, baseline):
+    data = inspect(target)
+    if not app_contract(data, target):
+        fail("APP_CONTRACT_NEW")
+    if not source_is_new(data):
+        fail("SOURCE_NEW_MISMATCH")
+    if not template_state_new(data):
+        fail("TEMPLATE_NEW_MISMATCH")
+    runtime_verify(target, "new")
+    http_verify(target, "new")
+    assert_no_new_errors(target, baseline, "verify-new")
+    return inspect(target)
+
+
+def verify_old(target, baseline, old_templates, strict_errors=True):
+    data = inspect(target)
+    if not app_contract(data, target):
+        fail("APP_CONTRACT_OLD")
+    if not source_is_old(data):
+        fail("SOURCE_OLD_MISMATCH")
+    if data.get("templates") != old_templates:
+        fail("TEMPLATE_ROLLBACK_MISMATCH")
+    if target == "prod":
+        runtime_verify(target, "old")
+    http_verify(target, "old")
+    if strict_errors:
+        assert_no_new_errors(target, baseline, "verify-old")
+    return inspect(target)
+
+
+def lint_php(target, source, label):
+    out = qga(
+        target,
+        ["/usr/bin/php8.3", "-l"],
+        input_bytes=source.encode(),
+        timeout=90,
+    )
+    if "No syntax errors detected" not in out:
+        fail("PHP_LINT_" + label)
+
+
+def cluster_guard():
+    p = run(["/usr/sbin/qm", "status", "210"], timeout=30)
+    if "status: running" not in p.stdout.decode():
+        fail("VM210_NOT_RUNNING")
+    p = run(
+        [
+            "/usr/bin/ssh",
+            "-T",
+            "-o",
+            "BatchMode=yes",
+            "-o",
+            "StrictHostKeyChecking=yes",
+            "-o",
+            "UpdateHostKeys=no",
+            "-o",
+            "ConnectTimeout=10",
+            "root@pve03",
+            "/usr/sbin/qm status 211",
+        ],
+        timeout=40,
+    )
+    if "status: running" not in p.stdout.decode():
+        fail("VM211_NOT_RUNNING")
+    emit("PORTAL200_CLUSTER", "PASS")
+
+
+def result_contract(status, changes, rollback_started, rollback_restored):
+    emit(
+        "HOMELAB_RESULT_CONTRACT",
+        {
+            "version": 1,
+            "command_id": CID,
+            "status": status,
+            "changes_made": bool(changes),
+            "rollback_started": bool(rollback_started),
+            "rollback_restored": rollback_restored,
+        },
+    )
+
+
+emit("NEWFI200_BEGIN")
+emit("COMMAND_ID", CID)
+emit("PORTAL200_REMAINING_FULL_PRODUCT_COMMANDS_BEFORE", 22)
+emit(
+    "PORTAL200_FLOW",
+    "candidate->staging-apply->rollback-proof->staging-reapply->git-push->production",
+)
+
+staging_backup = False
+staging_mutated = False
+staging_final_new = False
+prod_backup = False
+prod_mutated = False
+git_files_changed = False
+commit_created = False
+push_confirmed = False
+failure_rollback_started = False
+failure_rollback_restored = None
+old_git_bytes = {}
+new_head = None
+s_error = None
+p_error = None
+s_old_templates = None
+p_old_templates = None
+
+try:
+    compile(HTTP_VERIFY_PY, "<portal200-http-verify>", "exec")
+    for rel, (size, sha) in EXPECTED_NEW.items():
+        p = CAND_ROOT / rel
+        if not p.is_file() or file_meta(p) != (size, sha):
+            fail("CANDIDATE_IDENTITY")
+    tree = ET.parse(CAND_ROOT / "_data/templates.xml")
+    titles = sorted(x.attrib.get("title") for x in tree.getroot().findall("template"))
+    if titles != ["newfi_portal", "newfi_portal.less"]:
+        fail("CANDIDATE_TEMPLATE_SET")
+    service = (CAND_ROOT / "Service/PortalData.php").read_text("utf-8")
+    if any(
+        token in service
+        for token in [
+            "\\XF::db(",
+            "->save(",
+            "->delete(",
+            "INSERT ",
+            "UPDATE ",
+            "DELETE ",
+            "REPLACE ",
+        ]
+    ):
+        fail("CANDIDATE_MUTATION_SCAN")
+    emit("PORTAL200_CANDIDATE_IDENTITY", "PASS")
+    emit("PORTAL200_ORCHESTRATION_FIXES", {"staging_503_without_css_links": True, "failure_status": "FAIL"})
+
+    branch = git("branch", "--show-current")
+    head = git("rev-parse", "HEAD")
+    status = git("status", "--porcelain=v1", "--untracked-files=all")
+    remote_out = git("ls-remote", "origin", f"refs/heads/{BRANCH}")
+    remote = remote_out.split()[0] if remote_out else ""
+    if branch != BRANCH or head != OLD_HEAD or remote != OLD_HEAD or status:
+        fail("GIT_PRESTATE")
+    emit(
+        "PORTAL200_GIT_PRESTATE",
+        {"branch": branch, "head": head, "remote": remote, "clean": True},
+    )
+    cluster_guard()
+
+    lint_php("staging", INSPECT_PHP, "INSPECT_STAGING")
+    lint_php("staging", IMPORT_PHP, "IMPORT_STAGING")
+    lint_php("staging", RUNTIME_VERIFY_PHP_TEMPLATE.replace("__STATE__", "new"), "RUNTIME_STAGING")
+    lint_php("prod", INSPECT_PHP, "INSPECT_PROD")
+    lint_php("prod", IMPORT_PHP, "IMPORT_PROD")
+    lint_php("prod", RUNTIME_VERIFY_PHP_TEMPLATE.replace("__STATE__", "new"), "RUNTIME_PROD")
+    emit("PORTAL200_RUNTIME_HELPER_LINT", "PASS")
+
+    s0 = inspect("staging")
+    p0 = inspect("prod")
+    if not app_contract(s0, "staging") or not app_contract(p0, "prod"):
+        fail("APP_PRESTATE")
+    if not source_is_old(s0) or not source_is_old(p0):
+        fail("SOURCE_PRESTATE")
+    if s0.get("templates") != p0.get("templates"):
+        fail("TEMPLATE_PRESTATE_PARITY")
+    s_error = int(s0["application"]["error_max_id"])
+    p_error = int(p0["application"]["error_max_id"])
+    s_old_templates = s0["templates"]
+    p_old_templates = p0["templates"]
+    emit("PORTAL200_ERROR_BASELINE", {"staging": s_error, "prod": p_error})
+    http_verify("staging", "old")
+    runtime_verify("prod", "old")
+    http_verify("prod", "old")
+    assert_no_new_errors("staging", s_error, "preflight")
+    assert_no_new_errors("prod", p_error, "preflight")
+    emit("PORTAL200_PREFLIGHT", "PASS")
+
+    guest_backup("staging")
+    staging_backup = True
+    staging_mutated = True
+    install_candidate("staging")
+    import_addon("staging")
+    verify_new("staging", s_error)
+    emit("PORTAL200_STAGING_FIRST_APPLY", "PASS")
+
+    restore_old("staging")
+    import_addon("staging")
+    verify_old("staging", s_error, s_old_templates)
+    staging_mutated = False
+    emit("PORTAL200_STAGING_ROLLBACK_PROOF", "PASS")
+
+    staging_mutated = True
+    install_candidate("staging")
+    import_addon("staging")
+    verify_new("staging", s_error)
+    staging_final_new = True
+    emit("PORTAL200_STAGING_FINAL", "PASS")
+
+    for rel in EXPECTED_NEW:
+        dest = GIT_PORTAL / rel
+        old_git_bytes[str(rel)] = dest.read_bytes() if dest.exists() else None
+        dest.parent.mkdir(parents=True, exist_ok=True)
+        shutil.copyfile(CAND_ROOT / rel, dest)
+    git_files_changed = True
+
+    if git("diff", "--check"):
+        fail("GIT_DIFF_CHECK")
+    status_lines = git("status", "--porcelain=v1", "--untracked-files=all").splitlines()
+    actual_paths = sorted(line[3:] for line in status_lines if len(line) >= 4)
+    if actual_paths != sorted(EXPECTED_GIT_PATHS):
+        fail("GIT_SCOPE")
+    git("add", "--", *EXPECTED_GIT_PATHS)
+    staged = sorted(x for x in git("diff", "--cached", "--name-only").splitlines() if x)
+    if staged != sorted(EXPECTED_GIT_PATHS):
+        fail("GIT_STAGED_SCOPE")
+    git("commit", "-m", f"feat: build data-backed Newfi portal [{CID}]")
+    commit_created = True
+    new_head = git("rev-parse", "HEAD")
+    if new_head == OLD_HEAD:
+        fail("GIT_COMMIT_HEAD")
+    if git("status", "--porcelain=v1", "--untracked-files=all"):
+        fail("GIT_POSTCOMMIT_DIRTY")
+    git("push", "origin", f"HEAD:refs/heads/{BRANCH}", timeout=180)
+    remote_out = git("ls-remote", "origin", f"refs/heads/{BRANCH}")
+    remote_head = remote_out.split()[0] if remote_out else ""
+    if remote_head != new_head:
+        fail("GIT_REMOTE_HEAD")
+    push_confirmed = True
+    emit(
+        "PORTAL200_GIT_PROMOTION",
+        {
+            "old_head": OLD_HEAD,
+            "new_head": new_head,
+            "remote_head": remote_head,
+            "result": "PASS",
+        },
+    )
+
+    p_pre = inspect("prod")
+    if not source_is_old(p_pre) or p_pre.get("templates") != p_old_templates:
+        fail("PROD_DRIFT_BEFORE_APPLY")
+    if int(p_pre["application"]["error_max_id"]) != p_error:
+        fail("PROD_ERROR_DRIFT")
+    guest_backup("prod")
+    prod_backup = True
+    prod_mutated = True
+    install_candidate("prod")
+    import_addon("prod")
+    verify_new("prod", p_error)
+    emit("PORTAL200_PRODUCTION", "PASS")
+
+    sf = verify_new("staging", s_error)
+    pf = verify_new("prod", p_error)
+    if sf["source"] != pf["source"]:
+        fail("FINAL_SOURCE_PARITY")
+    if sf["templates"] != pf["templates"]:
+        fail("FINAL_TEMPLATE_PARITY")
+    if git("rev-parse", "HEAD") != new_head:
+        fail("FINAL_LOCAL_HEAD")
+    remote_out = git("ls-remote", "origin", f"refs/heads/{BRANCH}")
+    if not remote_out or remote_out.split()[0] != new_head:
+        fail("FINAL_REMOTE_HEAD")
+    if git("status", "--porcelain=v1", "--untracked-files=all"):
+        fail("FINAL_GIT_DIRTY")
+    cluster_guard()
+    emit(
+        "PORTAL200_FINAL_EVIDENCE",
+        {
+            "commit": new_head,
+            "source_files": 3,
+            "templates": 2,
+            "staging_error_baseline": s_error,
+            "prod_error_baseline": p_error,
+        },
+    )
+    emit("PORTAL200_PORTAL", "PASS")
+    emit("PORTAL200_STAGING", "PASS")
+    emit("PORTAL200_PRODUCTION", "PASS")
+    emit("PORTAL200_REMAINING_FULL_PRODUCT_COMMANDS_AFTER_PASS", 21)
+    result_contract("OK", True, False, None)
+    emit("NEWFI200_END")
+    raise SystemExit(0)
+
+except PortalError as exc:
+    code = str(exc)
+    emit("PORTAL200_FAILURE", code)
+
+    if push_confirmed:
+        if prod_mutated and prod_backup:
+            failure_rollback_started = True
+            try:
+                restore_old("prod")
+                import_addon("prod")
+                verify_old("prod", p_error, p_old_templates, strict_errors=False)
+                prod_mutated = False
+                failure_rollback_restored = False
+                emit("PORTAL200_FAILURE_PROD_ROLLBACK", "PASS_PARTIAL_OVERALL_STATE_CHANGED")
+            except Exception:
+                failure_rollback_restored = False
+                emit("PORTAL200_FAILURE_PROD_ROLLBACK", "FAIL")
+    else:
+        if staging_mutated and staging_backup:
+            failure_rollback_started = True
+            try:
+                restore_old("staging")
+                import_addon("staging")
+                verify_old("staging", s_error, s_old_templates, strict_errors=False)
+                staging_mutated = False
+                staging_final_new = False
+                failure_rollback_restored = True
+                emit("PORTAL200_FAILURE_STAGING_ROLLBACK", "PASS")
+            except Exception:
+                failure_rollback_restored = False
+                emit("PORTAL200_FAILURE_STAGING_ROLLBACK", "FAIL")
+
+        if git_files_changed and not commit_created:
+            try:
+                for rel, old in old_git_bytes.items():
+                    dest = GIT_PORTAL / rel
+                    if old is None:
+                        if dest.exists():
+                            dest.unlink()
+                    else:
+                        dest.write_bytes(old)
+                service_dir = GIT_PORTAL / "Service"
+                try:
+                    service_dir.rmdir()
+                except OSError:
+                    pass
+                emit("PORTAL200_FAILURE_GIT_WORKTREE_RESTORE", "PASS")
+            except Exception:
+                emit("PORTAL200_FAILURE_GIT_WORKTREE_RESTORE", "FAIL")
+
+        if commit_created:
+            emit(
+                "PORTAL200_FAILURE_GIT_HISTORY",
+                "COMMIT_CREATED_NO_DESTRUCTIVE_RESET_FRESH_ID_REQUIRED",
+            )
+
+    persisted = bool(push_confirmed or commit_created or staging_final_new or prod_mutated)
+    if failure_rollback_started and failure_rollback_restored is None:
+        failure_rollback_restored = False
+    result_contract(
+        "FAIL",
+        persisted,
+        failure_rollback_started,
+        failure_rollback_restored,
+    )
+    emit("PORTAL200_ROADMAP_REMAINS", 22)
+    emit("NEWFI200_END")
+    raise SystemExit(1)
+
+except Exception:
+    emit("PORTAL200_FAILURE", "UNEXPECTED_EXCEPTION")
+    result_contract(
+        "FAIL",
+        bool(push_confirmed or commit_created or staging_final_new or prod_mutated),
+        False,
+        None,
+    )
+    emit("PORTAL200_ROADMAP_REMAINS", 22)
+    emit("NEWFI200_END")
+    raise SystemExit(1)
+
+CANDIDATE_LAYER_3_TEXT_END
+CANDIDATE_LAYER_4_SOURCE=file:newfi-38-portal200-apply.cmd::b64::zlib
+CANDIDATE_LAYER_4_SHA256=e9d137ac729d7513d8d9aa1d9fb509005aefaa7bfe03f5cb26b9896fb1310f62
+CANDIDATE_LAYER_4_BYTES=32448
+CANDIDATE_LAYER_4_TEXT_BEGIN
+import hashlib
+import json
+import pathlib
+import shlex
+import shutil
+import subprocess
+import sys
+import xml.etree.ElementTree as ET
+
+CID = "NEWFI-260907-PORTAL200-APPLY1"
+BRANCH = "implementation/newfi-closed-mvp-20260906"
+OLD_HEAD = "06bab5acd124e768f70305b3d7eca2f595871890"
+WT = pathlib.Path("/root/newfi-portal/.worktrees/implementation-newfi-closed-mvp-20260906")
+CAND_ROOT = pathlib.Path("/root/newfi-portal200-candidate/src/addons/Newfi/Portal")
+PORTAL_REL = pathlib.Path("src/addons/Newfi/Portal")
+GIT_PORTAL = WT / PORTAL_REL
+EXPECTED_NEW = {
+    "Pub/Controller/Portal.php": (363, "619d489f7cc3b461479c702fa8825097ae22d3c6cfeb911e9f14ea1de9c36d6d"),
+    "Service/PortalData.php": (5213, "4da03f26294ab6d163a1a746dee4bb6a82d7d4f39e66b24246bc0eb4c455dd1d"),
+    "_data/templates.xml": (10977, "1650c3d868d4bc47703f1b75f1f179cd25309b2d3b20a2b848e81a4423c00861"),
+}
+EXPECTED_OLD = {
+    "Pub/Controller/Portal.php": (247, "53909e753ea5a011550fd280ad1c342a74ca9949be092dfbd95244243cae92f3"),
+    "_data/templates.xml": (1461, "c29c04f8b937284e821c87957653e87c2f6ac014fac30648a0f6b18e84392adf"),
+}
+EXPECTED_GIT_PATHS = [str(PORTAL_REL / p) for p in sorted(EXPECTED_NEW)]
+BACKUP = f"/root/newfi-portal200-backup-{CID}"
+
+
+class PortalError(RuntimeError):
+    pass
+
+
+def emit(key, value=None):
+    if value is None:
+        print(key, flush=True)
+    elif isinstance(value, (dict, list, tuple, bool, int, float)):
+        print(
+            key + "=" + json.dumps(value, ensure_ascii=False, sort_keys=True, separators=(",", ":")),
+            flush=True,
+        )
+    else:
+        print(key + "=" + str(value), flush=True)
+
+
+def fail(code):
+    raise PortalError(code)
+
+
+def sha_bytes(data):
+    return hashlib.sha256(data).hexdigest()
+
+
+def file_meta(path):
+    data = pathlib.Path(path).read_bytes()
+    return len(data), sha_bytes(data)
+
+
+def run(cmd, *, input_bytes=None, timeout=180, ok=(0,)):
+    try:
+        p = subprocess.run(
+            cmd,
+            input=input_bytes,
+            stdout=subprocess.PIPE,
+            stderr=subprocess.PIPE,
+            timeout=timeout,
+            check=False,
+        )
+    except subprocess.TimeoutExpired:
+        fail("SUBPROCESS_TIMEOUT")
+    if p.returncode not in ok:
+        fail("SUBPROCESS_RC")
+    return p
+
+
+def git(*args, ok=(0,), timeout=120):
+    p = run(["/usr/bin/git", "-C", str(WT), *args], timeout=timeout, ok=ok)
+    return p.stdout.decode("utf-8", "replace").strip()
+
+
+def qga(target, argv, *, input_bytes=None, timeout=180):
+    if target == "prod":
+        cmd = [
+            "/usr/sbin/qm",
+            "guest",
+            "exec",
+            "210",
+            "--synchronous",
+            "1",
+            "--timeout",
+            str(timeout),
+        ]
+        if input_bytes is not None:
+            cmd += ["--pass-stdin", "1"]
+        cmd += ["--", *argv]
+    elif target == "staging":
+        q = [
+            "/usr/sbin/qm",
+            "guest",
+            "exec",
+            "211",
+            "--synchronous",
+            "1",
+            "--timeout",
+            str(timeout),
+        ]
+        if input_bytes is not None:
+            q += ["--pass-stdin", "1"]
+        q += ["--", *argv]
+        remote = (
+            "test \"$(id -u):$(hostname -s)\" = 0:pve03 || exit 72; "
+            "for f in /etc/pve/HOMELAB_ASSISTANT_ERROR_REGISTER.md /etc/pve/31_HOMELAB_REFERENCE.md; do "
+            "test -r \"$f\" && test -s \"$f\" && cat -- \"$f\" >/dev/null || exit 73; done; exec "
+            + " ".join(shlex.quote(x) for x in q)
+        )
+        cmd = [
+            "/usr/bin/ssh",
+            "-T",
+            "-o",
+            "BatchMode=yes",
+            "-o",
+            "StrictHostKeyChecking=yes",
+            "-o",
+            "UpdateHostKeys=no",
+            "-o",
+            "ConnectTimeout=10",
+            "-o",
+            "ConnectionAttempts=1",
+            "root@pve03",
+            remote,
+        ]
+    else:
+        fail("BAD_TARGET")
+
+    p = run(cmd, input_bytes=input_bytes, timeout=timeout + 30)
+    try:
+        data = json.loads(p.stdout.decode("utf-8"))
+    except Exception:
+        fail("QGA_JSON")
+    if data.get("exited") not in (1, True) or data.get("exitcode") != 0:
+        fail("QGA_GUEST_RC")
+    if data.get("out-truncated") or data.get("err-truncated"):
+        fail("QGA_TRUNCATED")
+    return data.get("out-data", "")
+
+
+INSPECT_PHP = r'''<?php
+$root = '/var/www/forums/newfi/public';
+require $root . '/src/XF.php';
+\XF::start($root);
+$app = \XF::setupApp('XF\\Pub\\App');
+$db = $app->db();
+function srcMeta(string $path): ?array {
+    if (!is_file($path)) { return null; }
+    return ['bytes' => filesize($path), 'sha256' => hash_file('sha256', $path)];
+}
+$portal = $root . '/src/addons/Newfi/Portal';
+$templates = $db->fetchAll(
+    "SELECT title, style_id, LENGTH(template) AS bytes, SHA2(template,256) AS sha256, " .
+    "LOCATE('data-newfi-portal200', template) > 0 AS html_marker, " .
+    "LOCATE('--newfi-portal200', template) > 0 AS css_marker " .
+    "FROM xf_template WHERE addon_id='Newfi/Portal' ORDER BY style_id,title"
+);
+$result = [
+ 'hostname' => gethostname(),
+ 'application' => [
+  'boardActive' => (string)$db->fetchOne("SELECT option_value FROM xf_option WHERE option_id='boardActive'"),
+  'boardUrl' => (string)$db->fetchOne("SELECT option_value FROM xf_option WHERE option_id='boardUrl'"),
+  'indexRoute' => (string)$db->fetchOne("SELECT option_value FROM xf_option WHERE option_id='indexRoute'"),
+  'defaultStyleId' => (string)$db->fetchOne("SELECT option_value FROM xf_option WHERE option_id='defaultStyleId'"),
+  'error_count' => (int)$db->fetchOne("SELECT COUNT(*) FROM xf_error_log"),
+  'error_max_id' => (int)$db->fetchOne("SELECT COALESCE(MAX(error_id),0) FROM xf_error_log")
+ ],
+ 'addon' => $db->fetchRow(
+  "SELECT addon_id,version_id,version_string,active,is_processing,last_pending_action " .
+  "FROM xf_addon WHERE addon_id='Newfi/Portal'"
+ ),
+ 'source' => [
+  'Pub/Controller/Portal.php' => srcMeta($portal . '/Pub/Controller/Portal.php'),
+  'Service/PortalData.php' => srcMeta($portal . '/Service/PortalData.php'),
+  '_data/templates.xml' => srcMeta($portal . '/_data/templates.xml')
+ ],
+ 'templates' => $templates
+];
+echo "PORTAL200_INSPECT_JSON_BEGIN\n";
+echo json_encode(
+    $result,
+    JSON_UNESCAPED_UNICODE|JSON_UNESCAPED_SLASHES|JSON_INVALID_UTF8_SUBSTITUTE
+);
+echo "\nPORTAL200_INSPECT_JSON_END\n";
+?>'''
+
+
+IMPORT_PHP = r'''<?php
+$root = '/var/www/forums/newfi/public';
+require $root . '/src/XF.php';
+\XF::start($root);
+$app = \XF::setupApp('XF\\Pub\\App');
+$addOn = $app->addOnManager()->getById('Newfi/Portal');
+if (!$addOn || !$addOn->isInstalled()) {
+    fwrite(STDERR, "ADDON_NOT_INSTALLED\n");
+    exit(30);
+}
+$addOn->preRebuild();
+$dataManager = $app->addOnDataManager();
+$imported = [];
+foreach ($dataManager->getDataTypeClasses() as $dataType) {
+    $handler = $dataManager->getDataTypeHandler($dataType);
+    $xml = $handler->openTypeFile($addOn->getDataDirectory());
+    if (!$xml || !$xml->count()) {
+        $handler->deleteAddOnData($addOn->addon_id);
+        continue;
+    }
+    $start = 0;
+    $guard = 0;
+    while (true) {
+        $last = $handler->importAddOnData($addOn->addon_id, $xml, $start, 0);
+        if (!$last) { break; }
+        if ($last <= $start || ++$guard > 100000) {
+            fwrite(STDERR, "IMPORT_PROGRESS_INVALID\n");
+            exit(31);
+        }
+        $start = $last;
+    }
+    $handler->deleteOrphanedAddOnData($addOn->addon_id, $xml);
+    \XF::triggerRunOnce();
+    $imported[] = $handler->getContainerTag();
+}
+$addOn->postDataImport();
+$repo = $app->repository(\XF\Repository\StyleRepository::class);
+$repo->updateAllStylesLastModifiedDateLater();
+$addOn->postRebuild();
+echo "PORTAL200_IMPORT_JSON=" . json_encode(
+    ['result'=>'PASS','containers'=>$imported],
+    JSON_UNESCAPED_SLASHES
+) . "\n";
+?>'''
+
+
+ERRORS_PHP_TEMPLATE = r'''<?php
+$root='/var/www/forums/newfi/public';
+require $root.'/src/XF.php';
+\XF::start($root);
+$app=\XF::setupApp('XF\\Pub\\App');
+$db=$app->db();
+$b=%d;
+$rows=$db->fetchAll(
+    "SELECT error_id,exception_type,message,filename,line FROM xf_error_log WHERE error_id>? ORDER BY error_id",
+    [$b]
+);
+echo json_encode(
+    $rows,
+    JSON_UNESCAPED_UNICODE|JSON_UNESCAPED_SLASHES|JSON_INVALID_UTF8_SUBSTITUTE
+);
+?>'''
+
+
+RUNTIME_VERIFY_PHP_TEMPLATE = r'''<?php
+$state = '__STATE__';
+$root = '/var/www/forums/newfi/public';
+require $root . '/src/XF.php';
+\XF::start($root);
+$app = \XF::setupApp('XF\\Pub\\App');
+$result = ['state'=>$state];
+if ($state === 'new') {
+    $service = new \Newfi\Portal\Service\PortalData($app);
+    $portal = $service->build();
+    $html = (string)$app->templater()->renderTemplate('public:newfi_portal', ['portal'=>$portal]);
+    $result['sections'] = [];
+    foreach (['forums','resources','media','events','dogs'] as $key) {
+        $section = $portal[$key] ?? null;
+        if (!is_array($section)) { fwrite(STDERR, "SECTION_MISSING\n"); exit(60); }
+        $result['sections'][$key] = [
+            'available'=>(bool)($section['available'] ?? false),
+            'hasItems'=>(bool)($section['hasItems'] ?? false),
+            'status'=>(string)($section['status'] ?? '')
+        ];
+    }
+    $result['html_marker'] = strpos($html, 'data-newfi-portal200="1"') !== false;
+    $result['locked_resources'] = strpos($html, 'data-portal-locked="resources"') !== false;
+    $result['locked_media'] = strpos($html, 'data-portal-locked="media"') !== false;
+    $result['html_bytes'] = strlen($html);
+    if (!$result['html_marker']) { fwrite(STDERR, "HTML_MARKER_MISSING\n"); exit(61); }
+    if ($result['sections']['resources']['available'] || $result['sections']['media']['available']) {
+        fwrite(STDERR, "GUEST_PERMISSION_CONTRACT_CHANGED\n"); exit(62);
+    }
+    if (!$result['locked_resources'] || !$result['locked_media']) {
+        fwrite(STDERR, "LOCKED_COPY_MISSING\n"); exit(63);
+    }
+    if (!$result['sections']['forums']['available'] || !$result['sections']['events']['available'] || !$result['sections']['dogs']['available']) {
+        fwrite(STDERR, "PUBLIC_SECTION_UNAVAILABLE\n"); exit(64);
+    }
+} else if ($state === 'old') {
+    $html = (string)$app->templater()->renderTemplate('public:newfi_portal', []);
+    $result['html_marker'] = strpos($html, 'data-newfi-portal200') !== false;
+    $result['old_copy'] = strpos($html, 'Закрытое пространство для общения, знаний и материалов сообщества.') !== false;
+    $result['html_bytes'] = strlen($html);
+    if ($result['html_marker'] || !$result['old_copy']) {
+        fwrite(STDERR, "OLD_RENDER_CONTRACT\n"); exit(65);
+    }
+} else {
+    exit(66);
+}
+echo "PORTAL200_RUNTIME_JSON=" . json_encode(
+    $result,
+    JSON_UNESCAPED_UNICODE|JSON_UNESCAPED_SLASHES|JSON_INVALID_UTF8_SUBSTITUTE
+) . "\n";
+?>'''
+
+
+HTTP_VERIFY_PY = r'''import html,json,re,subprocess,sys,urllib.parse
+mode=sys.argv[1]
+state=sys.argv[2]
+if mode=='staging':
+    host='newfi-staging.gram1.ru'; scheme='http'; port='80'; expected_status=503
+elif mode=='prod':
+    host='newfi.ru'; scheme='https'; port='443'; expected_status=200
+else:
+    raise SystemExit(40)
+def fetch(url):
+    cmd=[
+        '/usr/bin/curl','-sS','-k','--max-time','30','--connect-timeout','10',
+        '--resolve',f'{host}:{port}:127.0.0.1','-o','-','-w',
+        '\n__PORTAL_STATUS__%{http_code}',url
+    ]
+    p=subprocess.run(cmd,stdout=subprocess.PIPE,stderr=subprocess.PIPE,check=False)
+    if p.returncode!=0: raise SystemExit(41)
+    text=p.stdout.decode('utf-8','replace')
+    marker='\n__PORTAL_STATUS__'
+    if marker not in text: raise SystemExit(42)
+    body,status=text.rsplit(marker,1)
+    return int(status.strip()),body
+root=f'{scheme}://{host}/'
+status,body=fetch(root)
+hrefs=[]
+for raw in re.findall(r"href=[\"']([^\"']*css\\.php[^\"']*)[\"']",body,re.I):
+    raw=html.unescape(raw)
+    hrefs.append(urllib.parse.urljoin(root,raw))
+normal_css=[]
+normal_status=[]
+for u in hrefs:
+    s,b=fetch(u)
+    normal_status.append(s)
+    normal_css.append(b)
+normal_css_text='\n'.join(normal_css)
+forced_css_marker=None
+forced_css_status=None
+if mode=='staging' and state=='new':
+    if not hrefs: raise SystemExit(43)
+    u=urllib.parse.urlsplit(hrefs[0])
+    pairs=urllib.parse.parse_qsl(u.query,keep_blank_values=True)
+    out=[]
+    found=False
+    for k,v in pairs:
+        if k=='css':
+            found=True
+            parts=[x for x in v.split(',') if x]
+            if 'public:newfi_portal.less' not in parts:
+                parts.append('public:newfi_portal.less')
+            v=','.join(parts)
+        out.append((k,v))
+    if not found: raise SystemExit(44)
+    forced=urllib.parse.urlunsplit((u.scheme,u.netloc,u.path,urllib.parse.urlencode(out),u.fragment))
+    forced_css_status,forced_body=fetch(forced)
+    forced_css_marker='--newfi-portal200' in forced_body
+result={
+ 'status':status,
+ 'bytes':len(body.encode()),
+ 'html_marker':'data-newfi-portal200="1"' in body,
+ 'css_marker':'--newfi-portal200' in normal_css_text,
+ 'old_copy':'Закрытое пространство для общения, знаний и материалов сообщества.' in body,
+ 'css_count':len(hrefs),
+ 'css_status':normal_status,
+ 'forced_css_status':forced_css_status,
+ 'forced_css_marker':forced_css_marker,
+}
+print('PORTAL200_HTTP_JSON='+json.dumps(result,ensure_ascii=False,sort_keys=True,separators=(',',':')))
+if status!=expected_status: raise SystemExit(45)
+if not hrefs or any(x!=200 for x in normal_status): raise SystemExit(46)
+if mode=='prod' and state=='new':
+    if not result['html_marker'] or not result['css_marker']: raise SystemExit(47)
+elif mode=='prod' and state=='old':
+    if result['html_marker'] or result['css_marker'] or not result['old_copy']: raise SystemExit(48)
+elif mode=='staging' and state=='new':
+    if forced_css_status!=200 or not forced_css_marker: raise SystemExit(49)
+elif mode=='staging' and state=='old':
+    pass
+else:
+    raise SystemExit(50)
+'''
+
+
+def parse_inspect(text):
+    b = "PORTAL200_INSPECT_JSON_BEGIN\n"
+    e = "\nPORTAL200_INSPECT_JSON_END"
+    if b not in text or e not in text:
+        fail("INSPECT_MARKERS")
+    try:
+        return json.loads(text.split(b, 1)[1].split(e, 1)[0])
+    except Exception:
+        fail("INSPECT_JSON")
+
+
+def inspect(target):
+    return parse_inspect(
+        qga(target, ["/usr/bin/php8.3"], input_bytes=INSPECT_PHP.encode(), timeout=120)
+    )
+
+
+def source_is_old(data):
+    src = data["source"]
+    for rel, (size, sha) in EXPECTED_OLD.items():
+        row = src.get(rel)
+        if not row or row.get("bytes") != size or row.get("sha256") != sha:
+            return False
+    return src.get("Service/PortalData.php") is None
+
+
+def source_is_new(data):
+    src = data["source"]
+    for rel, (size, sha) in EXPECTED_NEW.items():
+        row = src.get(rel)
+        if not row or row.get("bytes") != size or row.get("sha256") != sha:
+            return False
+    return True
+
+
+def template_state_new(data):
+    rows = data.get("templates", [])
+    rows0 = [r for r in rows if int(r.get("style_id", -1)) == 0]
+    titles = [r.get("title") for r in rows0]
+    by = {r.get("title"): r for r in rows0}
+    return (
+        titles == ["newfi_portal", "newfi_portal.less"]
+        and int(by["newfi_portal"].get("html_marker", 0)) == 1
+        and int(by["newfi_portal.less"].get("css_marker", 0)) == 1
+    )
+
+
+def app_contract(data, target):
+    a = data.get("application", {})
+    addon = data.get("addon") or {}
+    expected = {
+        "staging": ("0", "http://newfi-staging.gram1.ru"),
+        "prod": ("1", "https://newfi.ru"),
+    }[target]
+    return (
+        a.get("boardActive") == expected[0]
+        and a.get("boardUrl") == expected[1]
+        and a.get("indexRoute") == "portal/"
+        and a.get("defaultStyleId") == "4"
+        and addon.get("addon_id") == "Newfi/Portal"
+        and int(addon.get("version_id", 0)) == 1000010
+        and addon.get("version_string") == "1.0.0 Alpha 1"
+        and int(addon.get("active", 0)) == 1
+        and int(addon.get("is_processing", 1)) == 0
+    )
+
+
+def new_errors(target, baseline):
+    raw = qga(
+        target,
+        ["/usr/bin/php8.3"],
+        input_bytes=(ERRORS_PHP_TEMPLATE % int(baseline)).encode(),
+        timeout=90,
+    )
+    try:
+        return json.loads(raw)
+    except Exception:
+        fail("ERROR_LOG_JSON")
+
+
+def assert_no_new_errors(target, baseline, phase):
+    rows = new_errors(target, baseline)
+    if rows:
+        emit(
+            "PORTAL200_NEW_XF_ERRORS",
+            {
+                "target": target,
+                "phase": phase,
+                "count": len(rows),
+                "ids": [r.get("error_id") for r in rows],
+            },
+        )
+        fail("NEW_XF_ERRORS")
+
+
+def guest_backup(target):
+    script = f'''set -eu
+B={shlex.quote(BACKUP)}
+P=/var/www/forums/newfi/public/src/addons/Newfi/Portal
+test ! -e "$B"
+install -d -m 700 "$B/Pub/Controller" "$B/_data"
+cp -p -- "$P/Pub/Controller/Portal.php" "$B/Pub/Controller/Portal.php"
+cp -p -- "$P/_data/templates.xml" "$B/_data/templates.xml"
+test ! -e "$P/Service/PortalData.php"
+printf 'PORTAL200_BACKUP=PASS\n'
+'''
+    out = qga(target, ["/bin/bash", "-lc", script], timeout=90)
+    if "PORTAL200_BACKUP=PASS" not in out:
+        fail("BACKUP_FAILED")
+
+
+def guest_write(target, rel, data):
+    dest = f"/var/www/forums/newfi/public/src/addons/Newfi/Portal/{rel}"
+    parent = str(pathlib.PurePosixPath(dest).parent)
+    script = (
+        "set -eu; umask 022; "
+        + "install -d -m 755 "
+        + shlex.quote(parent)
+        + "; T=$(mktemp "
+        + shlex.quote(parent + "/.portal200.XXXXXX")
+        + "); cat >\"$T\"; chmod 0644 \"$T\"; chown root:root \"$T\"; "
+        + "mv -f -- \"$T\" "
+        + shlex.quote(dest)
+        + "; printf 'PORTAL200_WRITE=PASS\\n'"
+    )
+    out = qga(
+        target,
+        ["/bin/bash", "-lc", script],
+        input_bytes=data,
+        timeout=90,
+    )
+    if "PORTAL200_WRITE=PASS" not in out:
+        fail("WRITE_FAILED")
+
+
+def install_candidate(target):
+    for rel in [
+        "Pub/Controller/Portal.php",
+        "Service/PortalData.php",
+        "_data/templates.xml",
+    ]:
+        guest_write(target, rel, (CAND_ROOT / rel).read_bytes())
+
+
+def restore_old(target):
+    script = f'''set -eu
+B={shlex.quote(BACKUP)}
+P=/var/www/forums/newfi/public/src/addons/Newfi/Portal
+test -f "$B/Pub/Controller/Portal.php"
+test -f "$B/_data/templates.xml"
+cp -p -- "$B/Pub/Controller/Portal.php" "$P/Pub/Controller/Portal.php"
+cp -p -- "$B/_data/templates.xml" "$P/_data/templates.xml"
+rm -f -- "$P/Service/PortalData.php"
+rmdir -- "$P/Service" 2>/dev/null || true
+printf 'PORTAL200_SOURCE_RESTORE=PASS\n'
+'''
+    out = qga(target, ["/bin/bash", "-lc", script], timeout=90)
+    if "PORTAL200_SOURCE_RESTORE=PASS" not in out:
+        fail("SOURCE_RESTORE_FAILED")
+
+
+def import_addon(target):
+    out = qga(
+        target,
+        ["/usr/bin/php8.3"],
+        input_bytes=IMPORT_PHP.encode(),
+        timeout=240,
+    )
+    if "PORTAL200_IMPORT_JSON=" not in out:
+        fail("IMPORT_FAILED")
+
+
+def runtime_verify(target, state):
+    src = RUNTIME_VERIFY_PHP_TEMPLATE.replace("__STATE__", state)
+    out = qga(target, ["/usr/bin/php8.3"], input_bytes=src.encode(), timeout=120)
+    line = next(
+        (x for x in out.splitlines() if x.startswith("PORTAL200_RUNTIME_JSON=")),
+        None,
+    )
+    if not line:
+        fail("RUNTIME_MARKER_MISSING")
+    try:
+        data = json.loads(line.split("=", 1)[1])
+    except Exception:
+        fail("RUNTIME_JSON")
+    emit("PORTAL200_RUNTIME", {"target": target, **data})
+    return data
+
+
+def http_verify(target, state):
+    out = qga(
+        target,
+        ["/usr/bin/python3", "-", target, state],
+        input_bytes=HTTP_VERIFY_PY.encode(),
+        timeout=180,
+    )
+    line = next(
+        (x for x in out.splitlines() if x.startswith("PORTAL200_HTTP_JSON=")),
+        None,
+    )
+    if not line:
+        fail("HTTP_MARKER_MISSING")
+    try:
+        data = json.loads(line.split("=", 1)[1])
+    except Exception:
+        fail("HTTP_JSON")
+    emit("PORTAL200_HTTP", {"target": target, "state": state, **data})
+    return data
+
+
+def verify_new(target, baseline):
+    data = inspect(target)
+    if not app_contract(data, target):
+        fail("APP_CONTRACT_NEW")
+    if not source_is_new(data):
+        fail("SOURCE_NEW_MISMATCH")
+    if not template_state_new(data):
+        fail("TEMPLATE_NEW_MISMATCH")
+    runtime_verify(target, "new")
+    http_verify(target, "new")
+    assert_no_new_errors(target, baseline, "verify-new")
+    return inspect(target)
+
+
+def verify_old(target, baseline, old_templates, strict_errors=True):
+    data = inspect(target)
+    if not app_contract(data, target):
+        fail("APP_CONTRACT_OLD")
+    if not source_is_old(data):
+        fail("SOURCE_OLD_MISMATCH")
+    if data.get("templates") != old_templates:
+        fail("TEMPLATE_ROLLBACK_MISMATCH")
+    if target == "prod":
+        runtime_verify(target, "old")
+    http_verify(target, "old")
+    if strict_errors:
+        assert_no_new_errors(target, baseline, "verify-old")
+    return inspect(target)
+
+
+def lint_php(target, source, label):
+    out = qga(
+        target,
+        ["/usr/bin/php8.3", "-l"],
+        input_bytes=source.encode(),
+        timeout=90,
+    )
+    if "No syntax errors detected" not in out:
+        fail("PHP_LINT_" + label)
+
+
+def cluster_guard():
+    p = run(["/usr/sbin/qm", "status", "210"], timeout=30)
+    if "status: running" not in p.stdout.decode():
+        fail("VM210_NOT_RUNNING")
+    p = run(
+        [
+            "/usr/bin/ssh",
+            "-T",
+            "-o",
+            "BatchMode=yes",
+            "-o",
+            "StrictHostKeyChecking=yes",
+            "-o",
+            "UpdateHostKeys=no",
+            "-o",
+            "ConnectTimeout=10",
+            "root@pve03",
+            "/usr/sbin/qm status 211",
+        ],
+        timeout=40,
+    )
+    if "status: running" not in p.stdout.decode():
+        fail("VM211_NOT_RUNNING")
+    emit("PORTAL200_CLUSTER", "PASS")
+
+
+def result_contract(status, changes, rollback_started, rollback_restored):
+    emit(
+        "HOMELAB_RESULT_CONTRACT",
+        {
+            "version": 1,
+            "command_id": CID,
+            "status": status,
+            "changes_made": bool(changes),
+            "rollback_started": bool(rollback_started),
+            "rollback_restored": rollback_restored,
+        },
+    )
+
+
+emit("NEWFI200_BEGIN")
+emit("COMMAND_ID", CID)
+emit("PORTAL200_REMAINING_FULL_PRODUCT_COMMANDS_BEFORE", 22)
+emit(
+    "PORTAL200_FLOW",
+    "candidate->staging-apply->rollback-proof->staging-reapply->git-push->production",
+)
+
+staging_backup = False
+staging_mutated = False
+staging_final_new = False
+prod_backup = False
+prod_mutated = False
+git_files_changed = False
+commit_created = False
+push_confirmed = False
+failure_rollback_started = False
+failure_rollback_restored = None
+old_git_bytes = {}
+new_head = None
+s_error = None
+p_error = None
+s_old_templates = None
+p_old_templates = None
+
+try:
+    compile(HTTP_VERIFY_PY, "<portal200-http-verify>", "exec")
+    for rel, (size, sha) in EXPECTED_NEW.items():
+        p = CAND_ROOT / rel
+        if not p.is_file() or file_meta(p) != (size, sha):
+            fail("CANDIDATE_IDENTITY")
+    tree = ET.parse(CAND_ROOT / "_data/templates.xml")
+    titles = sorted(x.attrib.get("title") for x in tree.getroot().findall("template"))
+    if titles != ["newfi_portal", "newfi_portal.less"]:
+        fail("CANDIDATE_TEMPLATE_SET")
+    service = (CAND_ROOT / "Service/PortalData.php").read_text("utf-8")
+    if any(
+        token in service
+        for token in [
+            "\\XF::db(",
+            "->save(",
+            "->delete(",
+            "INSERT ",
+            "UPDATE ",
+            "DELETE ",
+            "REPLACE ",
+        ]
+    ):
+        fail("CANDIDATE_MUTATION_SCAN")
+    emit("PORTAL200_CANDIDATE_IDENTITY", "PASS")
+
+    branch = git("branch", "--show-current")
+    head = git("rev-parse", "HEAD")
+    status = git("status", "--porcelain=v1", "--untracked-files=all")
+    remote_out = git("ls-remote", "origin", f"refs/heads/{BRANCH}")
+    remote = remote_out.split()[0] if remote_out else ""
+    if branch != BRANCH or head != OLD_HEAD or remote != OLD_HEAD or status:
+        fail("GIT_PRESTATE")
+    emit(
+        "PORTAL200_GIT_PRESTATE",
+        {"branch": branch, "head": head, "remote": remote, "clean": True},
+    )
+    cluster_guard()
+
+    lint_php("staging", INSPECT_PHP, "INSPECT_STAGING")
+    lint_php("staging", IMPORT_PHP, "IMPORT_STAGING")
+    lint_php("staging", RUNTIME_VERIFY_PHP_TEMPLATE.replace("__STATE__", "new"), "RUNTIME_STAGING")
+    lint_php("prod", INSPECT_PHP, "INSPECT_PROD")
+    lint_php("prod", IMPORT_PHP, "IMPORT_PROD")
+    lint_php("prod", RUNTIME_VERIFY_PHP_TEMPLATE.replace("__STATE__", "new"), "RUNTIME_PROD")
+    emit("PORTAL200_RUNTIME_HELPER_LINT", "PASS")
+
+    s0 = inspect("staging")
+    p0 = inspect("prod")
+    if not app_contract(s0, "staging") or not app_contract(p0, "prod"):
+        fail("APP_PRESTATE")
+    if not source_is_old(s0) or not source_is_old(p0):
+        fail("SOURCE_PRESTATE")
+    if s0.get("templates") != p0.get("templates"):
+        fail("TEMPLATE_PRESTATE_PARITY")
+    s_error = int(s0["application"]["error_max_id"])
+    p_error = int(p0["application"]["error_max_id"])
+    s_old_templates = s0["templates"]
+    p_old_templates = p0["templates"]
+    emit("PORTAL200_ERROR_BASELINE", {"staging": s_error, "prod": p_error})
+    http_verify("staging", "old")
+    runtime_verify("prod", "old")
+    http_verify("prod", "old")
+    assert_no_new_errors("staging", s_error, "preflight")
+    assert_no_new_errors("prod", p_error, "preflight")
+    emit("PORTAL200_PREFLIGHT", "PASS")
+
+    guest_backup("staging")
+    staging_backup = True
+    staging_mutated = True
+    install_candidate("staging")
+    import_addon("staging")
+    verify_new("staging", s_error)
+    emit("PORTAL200_STAGING_FIRST_APPLY", "PASS")
+
+    restore_old("staging")
+    import_addon("staging")
+    verify_old("staging", s_error, s_old_templates)
+    staging_mutated = False
+    emit("PORTAL200_STAGING_ROLLBACK_PROOF", "PASS")
+
+    staging_mutated = True
+    install_candidate("staging")
+    import_addon("staging")
+    verify_new("staging", s_error)
+    staging_final_new = True
+    emit("PORTAL200_STAGING_FINAL", "PASS")
+
+    for rel in EXPECTED_NEW:
+        dest = GIT_PORTAL / rel
+        old_git_bytes[str(rel)] = dest.read_bytes() if dest.exists() else None
+        dest.parent.mkdir(parents=True, exist_ok=True)
+        shutil.copyfile(CAND_ROOT / rel, dest)
+    git_files_changed = True
+
+    if git("diff", "--check"):
+        fail("GIT_DIFF_CHECK")
+    status_lines = git("status", "--porcelain=v1", "--untracked-files=all").splitlines()
+    actual_paths = sorted(line[3:] for line in status_lines if len(line) >= 4)
+    if actual_paths != sorted(EXPECTED_GIT_PATHS):
+        fail("GIT_SCOPE")
+    git("add", "--", *EXPECTED_GIT_PATHS)
+    staged = sorted(x for x in git("diff", "--cached", "--name-only").splitlines() if x)
+    if staged != sorted(EXPECTED_GIT_PATHS):
+        fail("GIT_STAGED_SCOPE")
+    git("commit", "-m", f"feat: build data-backed Newfi portal [{CID}]")
+    commit_created = True
+    new_head = git("rev-parse", "HEAD")
+    if new_head == OLD_HEAD:
+        fail("GIT_COMMIT_HEAD")
+    if git("status", "--porcelain=v1", "--untracked-files=all"):
+        fail("GIT_POSTCOMMIT_DIRTY")
+    git("push", "origin", f"HEAD:refs/heads/{BRANCH}", timeout=180)
+    remote_out = git("ls-remote", "origin", f"refs/heads/{BRANCH}")
+    remote_head = remote_out.split()[0] if remote_out else ""
+    if remote_head != new_head:
+        fail("GIT_REMOTE_HEAD")
+    push_confirmed = True
+    emit(
+        "PORTAL200_GIT_PROMOTION",
+        {
+            "old_head": OLD_HEAD,
+            "new_head": new_head,
+            "remote_head": remote_head,
+            "result": "PASS",
+        },
+    )
+
+    p_pre = inspect("prod")
+    if not source_is_old(p_pre) or p_pre.get("templates") != p_old_templates:
+        fail("PROD_DRIFT_BEFORE_APPLY")
+    if int(p_pre["application"]["error_max_id"]) != p_error:
+        fail("PROD_ERROR_DRIFT")
+    guest_backup("prod")
+    prod_backup = True
+    prod_mutated = True
+    install_candidate("prod")
+    import_addon("prod")
+    verify_new("prod", p_error)
+    emit("PORTAL200_PRODUCTION", "PASS")
+
+    sf = verify_new("staging", s_error)
+    pf = verify_new("prod", p_error)
+    if sf["source"] != pf["source"]:
+        fail("FINAL_SOURCE_PARITY")
+    if sf["templates"] != pf["templates"]:
+        fail("FINAL_TEMPLATE_PARITY")
+    if git("rev-parse", "HEAD") != new_head:
+        fail("FINAL_LOCAL_HEAD")
+    remote_out = git("ls-remote", "origin", f"refs/heads/{BRANCH}")
+    if not remote_out or remote_out.split()[0] != new_head:
+        fail("FINAL_REMOTE_HEAD")
+    if git("status", "--porcelain=v1", "--untracked-files=all"):
+        fail("FINAL_GIT_DIRTY")
+    cluster_guard()
+    emit(
+        "PORTAL200_FINAL_EVIDENCE",
+        {
+            "commit": new_head,
+            "source_files": 3,
+            "templates": 2,
+            "staging_error_baseline": s_error,
+            "prod_error_baseline": p_error,
+        },
+    )
+    emit("PORTAL200_PORTAL", "PASS")
+    emit("PORTAL200_STAGING", "PASS")
+    emit("PORTAL200_PRODUCTION", "PASS")
+    emit("PORTAL200_REMAINING_FULL_PRODUCT_COMMANDS_AFTER_PASS", 21)
+    result_contract("OK", True, False, None)
+    emit("NEWFI200_END")
+    raise SystemExit(0)
+
+except PortalError as exc:
+    code = str(exc)
+    emit("PORTAL200_FAILURE", code)
+
+    if push_confirmed:
+        if prod_mutated and prod_backup:
+            failure_rollback_started = True
+            try:
+                restore_old("prod")
+                import_addon("prod")
+                verify_old("prod", p_error, p_old_templates, strict_errors=False)
+                prod_mutated = False
+                failure_rollback_restored = False
+                emit("PORTAL200_FAILURE_PROD_ROLLBACK", "PASS_PARTIAL_OVERALL_STATE_CHANGED")
+            except Exception:
+                failure_rollback_restored = False
+                emit("PORTAL200_FAILURE_PROD_ROLLBACK", "FAIL")
+    else:
+        if staging_mutated and staging_backup:
+            failure_rollback_started = True
+            try:
+                restore_old("staging")
+                import_addon("staging")
+                verify_old("staging", s_error, s_old_templates, strict_errors=False)
+                staging_mutated = False
+                staging_final_new = False
+                failure_rollback_restored = True
+                emit("PORTAL200_FAILURE_STAGING_ROLLBACK", "PASS")
+            except Exception:
+                failure_rollback_restored = False
+                emit("PORTAL200_FAILURE_STAGING_ROLLBACK", "FAIL")
+
+        if git_files_changed and not commit_created:
+            try:
+                for rel, old in old_git_bytes.items():
+                    dest = GIT_PORTAL / rel
+                    if old is None:
+                        if dest.exists():
+                            dest.unlink()
+                    else:
+                        dest.write_bytes(old)
+                service_dir = GIT_PORTAL / "Service"
+                try:
+                    service_dir.rmdir()
+                except OSError:
+                    pass
+                emit("PORTAL200_FAILURE_GIT_WORKTREE_RESTORE", "PASS")
+            except Exception:
+                emit("PORTAL200_FAILURE_GIT_WORKTREE_RESTORE", "FAIL")
+
+        if commit_created:
+            emit(
+                "PORTAL200_FAILURE_GIT_HISTORY",
+                "COMMIT_CREATED_NO_DESTRUCTIVE_RESET_FRESH_ID_REQUIRED",
+            )
+
+    persisted = bool(push_confirmed or commit_created or staging_final_new or prod_mutated)
+    if failure_rollback_started and failure_rollback_restored is None:
+        failure_rollback_restored = False
+    result_contract(
+        "ERROR",
+        persisted,
+        failure_rollback_started,
+        failure_rollback_restored,
+    )
+    emit("PORTAL200_ROADMAP_REMAINS", 22)
+    emit("NEWFI200_END")
+    raise SystemExit(1)
+
+except Exception:
+    emit("PORTAL200_FAILURE", "UNEXPECTED_EXCEPTION")
+    result_contract(
+        "ERROR",
+        bool(push_confirmed or commit_created or staging_final_new or prod_mutated),
+        False,
+        None,
+    )
+    emit("PORTAL200_ROADMAP_REMAINS", 22)
+    emit("NEWFI200_END")
+    raise SystemExit(1)
+
+CANDIDATE_LAYER_4_TEXT_END
+CANDIDATE_LAYER_5_SOURCE=file:newfi-55-portal200-apply3-rca.cmd::b64::zlib
+CANDIDATE_LAYER_5_SHA256=8911318cd314572edf9c6343c09b4c83d283e946dd2398ea2e05722ac9bd44ac
+CANDIDATE_LAYER_5_BYTES=10641
+CANDIDATE_LAYER_5_TEXT_BEGIN
+import hashlib
+import json
+import pathlib
+import shlex
+import subprocess
+
+CID = "NEWFI-260907-PORTAL200-APPLY3RCA1"
+FAILED_CID = "NEWFI-260907-PORTAL200-APPLY3"
+WT = pathlib.Path("/root/newfi-portal/.worktrees/implementation-newfi-closed-mvp-20260906")
+BRANCH = "implementation/newfi-closed-mvp-20260906"
+OLD_HEAD = "06bab5acd124e768f70305b3d7eca2f595871890"
+FAILED_DIR = pathlib.Path("/root/newfi-run-" + FAILED_CID)
+WRAPPER = FAILED_DIR / "wrapper.log"
+
+OLD = {
+    "controller": "53909e753ea5a011550fd280ad1c342a74ca9949be092dfbd95244243cae92f3",
+    "templates_xml": "c29c04f8b937284e821c87957653e87c2f6ac014fac30648a0f6b18e84392adf",
+}
+NEW = {
+    "controller": "619d489f7cc3b461479c702fa8825097ae22d3c6cfeb911e9f14ea1de9c36d6d",
+    "service": "4da03f26294ab6d163a1a746dee4bb6a82d7d4f39e66b24246bc0eb4c455dd1d",
+    "templates_xml": "1650c3d868d4bc47703f1b75f1f179cd25309b2d3b20a2b848e81a4423c00861",
+}
+
+INSPECT = '<?php\n$root=\'/var/www/forums/newfi/public\';\nrequire $root.\'/src/XF.php\';\n\\XF::start($root);\n$app=\\XF::setupApp(\'XF\\\\Pub\\\\App\');\n$db=$app->db();\n\nfunction meta($p) {\n    if (!is_file($p)) { return null; }\n    return [\'bytes\'=>filesize($p),\'sha256\'=>hash_file(\'sha256\',$p)];\n}\n\n$portal=$root.\'/src/addons/Newfi/Portal\';\n$baseline=(gethostname()===\'newfi-staging\') ? 40 : 0;\n\n$templates=$db->fetchAll(\n    "SELECT title,style_id,LENGTH(template) AS bytes,SHA2(template,256) AS sha256," .\n    " LOCATE(\'data-newfi-portal200\',template)>0 AS html_marker," .\n    " LOCATE(\'--newfi-portal200\',template)>0 AS css_marker" .\n    " FROM xf_template WHERE addon_id=\'Newfi/Portal\' ORDER BY style_id,title"\n);\n\n$errors=$db->fetchAll(\n    "SELECT error_id,exception_type,message,filename,line" .\n    " FROM xf_error_log WHERE error_id>? ORDER BY error_id LIMIT 30",\n    [$baseline]\n);\n\n$result=[\n    \'hostname\'=>gethostname(),\n    \'application\'=>[\n        \'boardActive\'=>(string)$db->fetchOne("SELECT option_value FROM xf_option WHERE option_id=\'boardActive\'"),\n        \'boardUrl\'=>(string)$db->fetchOne("SELECT option_value FROM xf_option WHERE option_id=\'boardUrl\'"),\n        \'indexRoute\'=>(string)$db->fetchOne("SELECT option_value FROM xf_option WHERE option_id=\'indexRoute\'"),\n        \'error_count\'=>(int)$db->fetchOne("SELECT COUNT(*) FROM xf_error_log"),\n        \'error_max_id\'=>(int)$db->fetchOne("SELECT COALESCE(MAX(error_id),0) FROM xf_error_log")\n    ],\n    \'source\'=>[\n        \'controller\'=>meta($portal.\'/Pub/Controller/Portal.php\'),\n        \'service\'=>meta($portal.\'/Service/PortalData.php\'),\n        \'templates_xml\'=>meta($portal.\'/_data/templates.xml\')\n    ],\n    \'templates\'=>$templates,\n    \'new_errors\'=>$errors\n];\n\necho "PORTAL200_RCA_GUEST_JSON=" .\n    json_encode($result,JSON_UNESCAPED_UNICODE|JSON_UNESCAPED_SLASHES|JSON_INVALID_UTF8_SUBSTITUTE) .\n    "\\n";\n?>'
+
+def emit(k, v=None):
+    if v is None:
+        print(k, flush=True)
+    elif isinstance(v, (dict, list, bool, int, float)):
+        print(k + "=" + json.dumps(v, ensure_ascii=False, sort_keys=True, separators=(",", ":")), flush=True)
+    else:
+        print(k + "=" + str(v), flush=True)
+
+def run(cmd, *, input_bytes=None, timeout=120):
+    return subprocess.run(
+        cmd, input=input_bytes, stdout=subprocess.PIPE, stderr=subprocess.PIPE,
+        timeout=timeout, check=False
+    )
+
+def git(*args):
+    p = run(["/usr/bin/git", "-C", str(WT), *args], timeout=90)
+    return p.returncode, p.stdout.decode("utf-8", "replace").strip(), p.stderr.decode("utf-8", "replace").strip()
+
+def qga(target, php_source):
+    if target == "prod":
+        cmd = [
+            "/usr/sbin/qm", "guest", "exec", "210",
+            "--synchronous", "1", "--timeout", "120",
+            "--pass-stdin", "1", "--", "/usr/bin/php8.3"
+        ]
+    else:
+        q = [
+            "/usr/sbin/qm", "guest", "exec", "211",
+            "--synchronous", "1", "--timeout", "120",
+            "--pass-stdin", "1", "--", "/usr/bin/php8.3"
+        ]
+        remote = (
+            "test \"$(id -u):$(hostname -s)\" = 0:pve03 || exit 72; "
+            "for f in /etc/pve/HOMELAB_ASSISTANT_ERROR_REGISTER.md /etc/pve/31_HOMELAB_REFERENCE.md; do "
+            "test -r \"$f\" && test -s \"$f\" && cat -- \"$f\" >/dev/null || exit 73; done; exec "
+            + " ".join(shlex.quote(x) for x in q)
+        )
+        cmd = [
+            "/usr/bin/ssh", "-T",
+            "-o", "BatchMode=yes",
+            "-o", "StrictHostKeyChecking=yes",
+            "-o", "UpdateHostKeys=no",
+            "-o", "ConnectTimeout=10",
+            "-o", "ConnectionAttempts=1",
+            "root@pve03", remote
+        ]
+    p = run(cmd, input_bytes=php_source.encode("utf-8"), timeout=150)
+    if p.returncode != 0:
+        return {"transport_rc": p.returncode, "transport_error": p.stderr.decode("utf-8", "replace")[:500]}
+    try:
+        outer = json.loads(p.stdout.decode("utf-8", "replace"))
+    except Exception:
+        return {"transport_rc": 0, "outer_json": False, "raw": p.stdout.decode("utf-8", "replace")[:1000]}
+    if outer.get("exitcode") != 0:
+        return {
+            "transport_rc": 0,
+            "guest_rc": outer.get("exitcode"),
+            "guest_out": outer.get("out-data", "")[:1000],
+            "guest_err": outer.get("err-data", "")[:1000],
+        }
+    out = outer.get("out-data", "")
+    marker = "PORTAL200_RCA_GUEST_JSON="
+    line = next((x for x in out.splitlines() if x.startswith(marker)), None)
+    if not line:
+        return {"transport_rc": 0, "guest_rc": 0, "marker": False, "guest_out": out[:1000]}
+    return json.loads(line[len(marker):])
+
+def source_state(data):
+    src = data.get("source", {})
+    controller = (src.get("controller") or {}).get("sha256")
+    service = src.get("service")
+    templates = (src.get("templates_xml") or {}).get("sha256")
+    if controller == OLD["controller"] and service is None and templates == OLD["templates_xml"]:
+        return "OLD"
+    if (
+        controller == NEW["controller"]
+        and (service or {}).get("sha256") == NEW["service"]
+        and templates == NEW["templates_xml"]
+    ):
+        return "NEW"
+    return "DRIFT"
+
+def template_state(data):
+    rows = data.get("templates", [])
+    titles = [r.get("title") for r in rows]
+    has_html = any(bool(r.get("html_marker")) for r in rows)
+    has_css = any(bool(r.get("css_marker")) for r in rows)
+    if titles == ["newfi_portal"] and not has_html and not has_css:
+        return "OLD"
+    if titles == ["newfi_portal", "newfi_portal.less"] and has_html and has_css:
+        return "NEW"
+    return "DRIFT"
+
+emit("NEWFI55_BEGIN")
+emit("COMMAND_ID", CID)
+emit("RCA_TARGET_FAILED_COMMAND", FAILED_CID)
+emit("PORTAL200_ROADMAP_REMAINS", 22)
+emit("RCA_MUTATION_SCOPE", "NONE_READ_ONLY")
+
+if WRAPPER.is_file() and not WRAPPER.is_symlink():
+    raw = WRAPPER.read_bytes()
+    emit("RCA_WRAPPER_BYTES", len(raw))
+    emit("RCA_WRAPPER_SHA256", hashlib.sha256(raw).hexdigest())
+    text = raw.decode("utf-8", "replace")
+    keep_prefixes = (
+        "CHAT_OUTPUT_BEGIN", "CHAT_OUTPUT_END", "COMMAND_ID=", "STATUS=", "RC=",
+        "RESULT_CONTRACT_", "COMMAND_RC=", "CHANGES_MADE=", "ROLLBACK_",
+        "MUTATION_OUTCOME=", "OUTPUT_BEGIN", "OUTPUT_END", "NEWFI200",
+        "PORTAL200_", "HOMELAB_RESULT_CONTRACT=", "STOP=", "Traceback",
+    )
+    selected = [line for line in text.splitlines() if line.startswith(keep_prefixes)]
+    emit("RCA_WRAPPER_SELECTED_LINE_COUNT", len(selected))
+    print("RCA_WRAPPER_SELECTED_BEGIN", flush=True)
+    for line in selected[-250:]:
+        print(line, flush=True)
+    print("RCA_WRAPPER_SELECTED_END", flush=True)
+else:
+    emit("RCA_WRAPPER_MISSING", True)
+
+_, branch, _ = git("branch", "--show-current")
+_, head, _ = git("rev-parse", "HEAD")
+_, remote_out, _ = git("ls-remote", "origin", f"refs/heads/{BRANCH}")
+_, status, _ = git("status", "--porcelain=v1", "--untracked-files=all")
+remote = remote_out.split()[0] if remote_out else ""
+
+git_state = {
+    "branch": branch,
+    "head": head,
+    "remote": remote,
+    "clean": (status == ""),
+    "status_lines": status.splitlines()[:20],
+}
+emit("RCA_GIT_STATE", git_state)
+
+staging = qga("staging", INSPECT)
+prod = qga("prod", INSPECT)
+
+emit("RCA_STAGING_STATE", staging)
+emit("RCA_PROD_STATE", prod)
+
+s_src = source_state(staging) if isinstance(staging, dict) else "UNKNOWN"
+p_src = source_state(prod) if isinstance(prod, dict) else "UNKNOWN"
+s_tpl = template_state(staging) if isinstance(staging, dict) else "UNKNOWN"
+p_tpl = template_state(prod) if isinstance(prod, dict) else "UNKNOWN"
+
+summary = {
+    "git_old_head": head == OLD_HEAD and remote == OLD_HEAD,
+    "git_clean": status == "",
+    "staging_source": s_src,
+    "staging_templates": s_tpl,
+    "staging_error_max": staging.get("application", {}).get("error_max_id") if isinstance(staging, dict) else None,
+    "prod_source": p_src,
+    "prod_templates": p_tpl,
+    "prod_error_max": prod.get("application", {}).get("error_max_id") if isinstance(prod, dict) else None,
+}
+summary["clean_old_prestate"] = bool(
+    summary["git_old_head"]
+    and summary["git_clean"]
+    and s_src == "OLD"
+    and s_tpl == "OLD"
+    and p_src == "OLD"
+    and p_tpl == "OLD"
+)
+emit("RCA_STATE_SUMMARY", summary)
+
+runner_path = pathlib.Path("/usr/local/sbin/homelab-chat-run")
+if runner_path.is_file() and not runner_path.is_symlink():
+    runner_bytes = runner_path.read_bytes()
+    runner_text = runner_bytes.decode("utf-8", "replace")
+    emit("RCA_RUNNER_SHA256", hashlib.sha256(runner_bytes).hexdigest())
+    emit("RCA_RUNNER_BYTES", len(runner_bytes))
+    lines = runner_text.splitlines()
+    terms = (
+        "HOMELAB_RESULT_CONTRACT",
+        "rollback_restored",
+        "rollback_started",
+        "changes_made",
+        "status not in",
+        "ValueError",
+    )
+    indexes = set()
+    for i, line in enumerate(lines):
+        if any(t in line for t in terms):
+            for j in range(max(0, i - 3), min(len(lines), i + 4)):
+                indexes.add(j)
+    print("RCA_RUNNER_CONTRACT_SOURCE_BEGIN", flush=True)
+    for j in sorted(indexes):
+        line = lines[j]
+        if len(line) > 500:
+            line = line[:500] + "...[TRUNCATED]"
+        print(json.dumps({"line": j + 1, "text": line}, ensure_ascii=False, separators=(",", ":")), flush=True)
+    print("RCA_RUNNER_CONTRACT_SOURCE_END", flush=True)
+else:
+    emit("RCA_RUNNER_SOURCE_MISSING", True)
+
+emit("HOMELAB_RESULT_CONTRACT", {
+    "version": 1,
+    "command_id": CID,
+    "status": "OK",
+    "changes_made": False,
+    "rollback_started": False,
+    "rollback_restored": None
+})
+emit("NEWFI55_END")
+
+CANDIDATE_LAYER_5_TEXT_END
+CANDIDATE_LAYER_6_SOURCE=file:newfi-39-portal200-rca1.cmd::b64::zlib
+CANDIDATE_LAYER_6_SHA256=08edd716820df9797dc01cbee765750d9924fc4f94855fde4aba2c25eacb76f2
+CANDIDATE_LAYER_6_BYTES=9466
+CANDIDATE_LAYER_6_TEXT_BEGIN
+import hashlib
+import json
+import pathlib
+import shlex
+import subprocess
+
+CID = "NEWFI-260907-PORTAL200-RCA1"
+FAILED_CID = "NEWFI-260907-PORTAL200-APPLY1"
+WT = pathlib.Path("/root/newfi-portal/.worktrees/implementation-newfi-closed-mvp-20260906")
+BRANCH = "implementation/newfi-closed-mvp-20260906"
+OLD_HEAD = "06bab5acd124e768f70305b3d7eca2f595871890"
+FAILED_DIR = pathlib.Path("/root/newfi-run-" + FAILED_CID)
+WRAPPER = FAILED_DIR / "wrapper.log"
+
+OLD = {
+    "controller": "53909e753ea5a011550fd280ad1c342a74ca9949be092dfbd95244243cae92f3",
+    "templates_xml": "c29c04f8b937284e821c87957653e87c2f6ac014fac30648a0f6b18e84392adf",
+}
+NEW = {
+    "controller": "619d489f7cc3b461479c702fa8825097ae22d3c6cfeb911e9f14ea1de9c36d6d",
+    "service": "4da03f26294ab6d163a1a746dee4bb6a82d7d4f39e66b24246bc0eb4c455dd1d",
+    "templates_xml": "1650c3d868d4bc47703f1b75f1f179cd25309b2d3b20a2b848e81a4423c00861",
+}
+
+INSPECT = '<?php\n$root=\'/var/www/forums/newfi/public\';\nrequire $root.\'/src/XF.php\';\n\\XF::start($root);\n$app=\\XF::setupApp(\'XF\\\\Pub\\\\App\');\n$db=$app->db();\n\nfunction meta($p) {\n    if (!is_file($p)) { return null; }\n    return [\'bytes\'=>filesize($p),\'sha256\'=>hash_file(\'sha256\',$p)];\n}\n\n$portal=$root.\'/src/addons/Newfi/Portal\';\n$baseline=(gethostname()===\'newfi-staging\') ? 40 : 0;\n\n$templates=$db->fetchAll(\n    "SELECT title,style_id,LENGTH(template) AS bytes,SHA2(template,256) AS sha256," .\n    " LOCATE(\'data-newfi-portal200\',template)>0 AS html_marker," .\n    " LOCATE(\'--newfi-portal200\',template)>0 AS css_marker" .\n    " FROM xf_template WHERE addon_id=\'Newfi/Portal\' ORDER BY style_id,title"\n);\n\n$errors=$db->fetchAll(\n    "SELECT error_id,exception_type,message,filename,line" .\n    " FROM xf_error_log WHERE error_id>? ORDER BY error_id LIMIT 30",\n    [$baseline]\n);\n\n$result=[\n    \'hostname\'=>gethostname(),\n    \'application\'=>[\n        \'boardActive\'=>(string)$db->fetchOne("SELECT option_value FROM xf_option WHERE option_id=\'boardActive\'"),\n        \'boardUrl\'=>(string)$db->fetchOne("SELECT option_value FROM xf_option WHERE option_id=\'boardUrl\'"),\n        \'indexRoute\'=>(string)$db->fetchOne("SELECT option_value FROM xf_option WHERE option_id=\'indexRoute\'"),\n        \'error_count\'=>(int)$db->fetchOne("SELECT COUNT(*) FROM xf_error_log"),\n        \'error_max_id\'=>(int)$db->fetchOne("SELECT COALESCE(MAX(error_id),0) FROM xf_error_log")\n    ],\n    \'source\'=>[\n        \'controller\'=>meta($portal.\'/Pub/Controller/Portal.php\'),\n        \'service\'=>meta($portal.\'/Service/PortalData.php\'),\n        \'templates_xml\'=>meta($portal.\'/_data/templates.xml\')\n    ],\n    \'templates\'=>$templates,\n    \'new_errors\'=>$errors\n];\n\necho "PORTAL200_RCA_GUEST_JSON=" .\n    json_encode($result,JSON_UNESCAPED_UNICODE|JSON_UNESCAPED_SLASHES|JSON_INVALID_UTF8_SUBSTITUTE) .\n    "\\n";\n?>'
+
+def emit(k, v=None):
+    if v is None:
+        print(k, flush=True)
+    elif isinstance(v, (dict, list, bool, int, float)):
+        print(k + "=" + json.dumps(v, ensure_ascii=False, sort_keys=True, separators=(",", ":")), flush=True)
+    else:
+        print(k + "=" + str(v), flush=True)
+
+def run(cmd, *, input_bytes=None, timeout=120):
+    return subprocess.run(
+        cmd, input=input_bytes, stdout=subprocess.PIPE, stderr=subprocess.PIPE,
+        timeout=timeout, check=False
+    )
+
+def git(*args):
+    p = run(["/usr/bin/git", "-C", str(WT), *args], timeout=90)
+    return p.returncode, p.stdout.decode("utf-8", "replace").strip(), p.stderr.decode("utf-8", "replace").strip()
+
+def qga(target, php_source):
+    if target == "prod":
+        cmd = [
+            "/usr/sbin/qm", "guest", "exec", "210",
+            "--synchronous", "1", "--timeout", "120",
+            "--pass-stdin", "1", "--", "/usr/bin/php8.3"
+        ]
+    else:
+        q = [
+            "/usr/sbin/qm", "guest", "exec", "211",
+            "--synchronous", "1", "--timeout", "120",
+            "--pass-stdin", "1", "--", "/usr/bin/php8.3"
+        ]
+        remote = (
+            "test \"$(id -u):$(hostname -s)\" = 0:pve03 || exit 72; "
+            "for f in /etc/pve/HOMELAB_ASSISTANT_ERROR_REGISTER.md /etc/pve/31_HOMELAB_REFERENCE.md; do "
+            "test -r \"$f\" && test -s \"$f\" && cat -- \"$f\" >/dev/null || exit 73; done; exec "
+            + " ".join(shlex.quote(x) for x in q)
+        )
+        cmd = [
+            "/usr/bin/ssh", "-T",
+            "-o", "BatchMode=yes",
+            "-o", "StrictHostKeyChecking=yes",
+            "-o", "UpdateHostKeys=no",
+            "-o", "ConnectTimeout=10",
+            "-o", "ConnectionAttempts=1",
+            "root@pve03", remote
+        ]
+    p = run(cmd, input_bytes=php_source.encode("utf-8"), timeout=150)
+    if p.returncode != 0:
+        return {"transport_rc": p.returncode, "transport_error": p.stderr.decode("utf-8", "replace")[:500]}
+    try:
+        outer = json.loads(p.stdout.decode("utf-8", "replace"))
+    except Exception:
+        return {"transport_rc": 0, "outer_json": False, "raw": p.stdout.decode("utf-8", "replace")[:1000]}
+    if outer.get("exitcode") != 0:
+        return {
+            "transport_rc": 0,
+            "guest_rc": outer.get("exitcode"),
+            "guest_out": outer.get("out-data", "")[:1000],
+            "guest_err": outer.get("err-data", "")[:1000],
+        }
+    out = outer.get("out-data", "")
+    marker = "PORTAL200_RCA_GUEST_JSON="
+    line = next((x for x in out.splitlines() if x.startswith(marker)), None)
+    if not line:
+        return {"transport_rc": 0, "guest_rc": 0, "marker": False, "guest_out": out[:1000]}
+    return json.loads(line[len(marker):])
+
+def source_state(data):
+    src = data.get("source", {})
+    controller = (src.get("controller") or {}).get("sha256")
+    service = src.get("service")
+    templates = (src.get("templates_xml") or {}).get("sha256")
+    if controller == OLD["controller"] and service is None and templates == OLD["templates_xml"]:
+        return "OLD"
+    if (
+        controller == NEW["controller"]
+        and (service or {}).get("sha256") == NEW["service"]
+        and templates == NEW["templates_xml"]
+    ):
+        return "NEW"
+    return "DRIFT"
+
+def template_state(data):
+    rows = data.get("templates", [])
+    titles = [r.get("title") for r in rows]
+    has_html = any(bool(r.get("html_marker")) for r in rows)
+    has_css = any(bool(r.get("css_marker")) for r in rows)
+    if titles == ["newfi_portal"] and not has_html and not has_css:
+        return "OLD"
+    if titles == ["newfi_portal", "newfi_portal.less"] and has_html and has_css:
+        return "NEW"
+    return "DRIFT"
+
+emit("NEWFI39_BEGIN")
+emit("COMMAND_ID", CID)
+emit("RCA_TARGET_FAILED_COMMAND", FAILED_CID)
+emit("PORTAL200_ROADMAP_REMAINS", 22)
+emit("RCA_MUTATION_SCOPE", "NONE_READ_ONLY")
+
+if WRAPPER.is_file() and not WRAPPER.is_symlink():
+    raw = WRAPPER.read_bytes()
+    emit("RCA_WRAPPER_BYTES", len(raw))
+    emit("RCA_WRAPPER_SHA256", hashlib.sha256(raw).hexdigest())
+    text = raw.decode("utf-8", "replace")
+    keep_prefixes = (
+        "CHAT_OUTPUT_BEGIN", "CHAT_OUTPUT_END", "COMMAND_ID=", "STATUS=", "RC=",
+        "RESULT_CONTRACT_", "COMMAND_RC=", "CHANGES_MADE=", "ROLLBACK_",
+        "MUTATION_OUTCOME=", "OUTPUT_BEGIN", "OUTPUT_END", "NEWFI200",
+        "PORTAL200_", "HOMELAB_RESULT_CONTRACT=", "STOP=", "Traceback",
+    )
+    selected = [line for line in text.splitlines() if line.startswith(keep_prefixes)]
+    emit("RCA_WRAPPER_SELECTED_LINE_COUNT", len(selected))
+    print("RCA_WRAPPER_SELECTED_BEGIN", flush=True)
+    for line in selected[-250:]:
+        print(line, flush=True)
+    print("RCA_WRAPPER_SELECTED_END", flush=True)
+else:
+    emit("RCA_WRAPPER_MISSING", True)
+
+_, branch, _ = git("branch", "--show-current")
+_, head, _ = git("rev-parse", "HEAD")
+_, remote_out, _ = git("ls-remote", "origin", f"refs/heads/{BRANCH}")
+_, status, _ = git("status", "--porcelain=v1", "--untracked-files=all")
+remote = remote_out.split()[0] if remote_out else ""
+
+git_state = {
+    "branch": branch,
+    "head": head,
+    "remote": remote,
+    "clean": (status == ""),
+    "status_lines": status.splitlines()[:20],
+}
+emit("RCA_GIT_STATE", git_state)
+
+staging = qga("staging", INSPECT)
+prod = qga("prod", INSPECT)
+
+emit("RCA_STAGING_STATE", staging)
+emit("RCA_PROD_STATE", prod)
+
+s_src = source_state(staging) if isinstance(staging, dict) else "UNKNOWN"
+p_src = source_state(prod) if isinstance(prod, dict) else "UNKNOWN"
+s_tpl = template_state(staging) if isinstance(staging, dict) else "UNKNOWN"
+p_tpl = template_state(prod) if isinstance(prod, dict) else "UNKNOWN"
+
+summary = {
+    "git_old_head": head == OLD_HEAD and remote == OLD_HEAD,
+    "git_clean": status == "",
+    "staging_source": s_src,
+    "staging_templates": s_tpl,
+    "staging_error_max": staging.get("application", {}).get("error_max_id") if isinstance(staging, dict) else None,
+    "prod_source": p_src,
+    "prod_templates": p_tpl,
+    "prod_error_max": prod.get("application", {}).get("error_max_id") if isinstance(prod, dict) else None,
+}
+summary["clean_old_prestate"] = bool(
+    summary["git_old_head"]
+    and summary["git_clean"]
+    and s_src == "OLD"
+    and s_tpl == "OLD"
+    and p_src == "OLD"
+    and p_tpl == "OLD"
+)
+emit("RCA_STATE_SUMMARY", summary)
+
+emit("HOMELAB_RESULT_CONTRACT", {
+    "version": 1,
+    "command_id": CID,
+    "status": "OK",
+    "changes_made": False,
+    "rollback_started": False,
+    "rollback_restored": None
+})
+emit("NEWFI39_END")
+
+CANDIDATE_LAYER_6_TEXT_END
+RECOVERED_VERSION_IDS=
+RECOVERED_VERSION_STRINGS==
+RECOVERED_SHA256_COUNT=11
+RECOVERED_SHA256=458c2cf0763e4790f7d2d3757efd883b25813a31aab4e8dce6f785b8dea48a6e,834973af57263b326ca6aee52b2ecb3fa2cf0fb486e5a77a62d4210395b8d9c3,28e855ff56c4844768f0e8606fe0edc2acb3f548a5c06fa15c0d80ae00e2bc1b,fc9fb1dbdb6141bfb43a8122dcf3db435a94da48d0a0c02fe9dfae019b1439c5,2f7977cbfaed7953bd70033c0cf92138eedf974f5886fadf4b4971f2d00a4143,b248a4c32c9cc64e5747e7dce6c7fc0a23f5124a77c71ce72e27a81aceae9d2d,619d489f7cc3b461479c702fa8825097ae22d3c6cfeb911e9f14ea1de9c36d6d,4da03f26294ab6d163a1a746dee4bb6a82d7d4f39e66b24246bc0eb4c455dd1d,1650c3d868d4bc47703f1b75f1f179cd25309b2d3b20a2b848e81a4423c00861,53909e753ea5a011550fd280ad1c342a74ca9949be092dfbd95244243cae92f3,c29c04f8b937284e821c87957653e87c2f6ac014fac30648a0f6b18e84392adf
+RECOVERY_RESULT=STRONG_APPLY3_CANDIDATE_EVIDENCE_FOUND
+LOCAL_APPLY3_CARRIER_RECOVERY5_END=true
 
 OUTPUT_END
 CHAT_OUTPUT_END