diff --git a/.dockerignore b/.dockerignore
index a49dd2c0..7ed41f3d 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -19,8 +19,10 @@ ui/host/node_modules/
 ui/host/dist/
 
 # Dev files
-.env
-.env.*
+.env*
+**/.env*
+secrets/
+.sops.yaml
 .tmp/
 tmp/
 
diff --git a/.env.example b/.env.example
new file mode 100644
index 00000000..f3c44e18
--- /dev/null
+++ b/.env.example
@@ -0,0 +1,265 @@
+# Generated by cmd/fanout-docgen from internal/config/config.go.
+# Regenerate with just docs-generate; verify with just docs-generate-check.
+# Fanout does not load dotenv files. Inject through your launcher or deployment.
+# Precedence: built-in defaults < nonempty environment values.
+# All settings require restart. Empty environment values mean no override.
+# Every entry is commented out so copying this template sets nothing, preserving image ENV.
+# Uncomment only settings you want to supply; use runtime secret injection for secrets.
+# Local authentication requires FANOUT_AUTH_CODE_SECRET (32+ characters).
+# Chat is disabled unless FANOUT_AI_PROVIDER selects anthropic or openai; its key is required.
+
+# ANTHROPIC_API_KEY; string; secret
+# Required when FANOUT_AI_PROVIDER is anthropic.
+# Default: (empty)
+# ANTHROPIC_API_KEY=
+# Alternatively set ANTHROPIC_API_KEY_FILE to a secret file path; do not set both.
+
+# ANTHROPIC_BASE_URL; string
+# Defaults to https://api.anthropic.com. Fanout appends /v1/messages, preserving any gateway path prefix. Use an HTTP(S) base URL without embedded credentials, a query, or a fragment.
+# Default: (empty)
+# ANTHROPIC_BASE_URL=
+
+# FANOUT_ADDR; string
+# Binds the browser, API, MCP, OTLP/gRPC and OTLP/HTTP listener.
+# Default: 127.0.0.1:7520
+# FANOUT_ADDR=
+
+# FANOUT_AI_MODEL; string
+# Overrides the provider's default: claude-sonnet-5-5 for Anthropic and gpt-6.1-sol for OpenAI. The OpenAI provider expects a reasoning model supporting reasoning.encrypted_content for stateless Responses replay. A 400 rejecting encrypted content is reported as a server-side configuration error; choose a compatible reasoning model with FANOUT_AI_MODEL.
+# Default: (empty)
+# FANOUT_AI_MODEL=
+
+# FANOUT_AI_PROVIDER; string
+# Enables chat by selecting exactly anthropic or openai. Empty disables chat.
+# Default: (empty)
+# FANOUT_AI_PROVIDER=
+
+# FANOUT_ALERTS_ENABLED; boolean
+# Runs the alert evaluation engine.
+# Default: true
+# FANOUT_ALERTS_ENABLED=
+
+# FANOUT_ALERTS_EVALUATION_INTERVAL; duration
+# Schedules alert evaluation; use a Go duration of at least 1s.
+# Default: 30s
+# FANOUT_ALERTS_EVALUATION_INTERVAL=
+
+# FANOUT_ALERTS_HISTORY_DAYS; integer
+# Sets alert history retention in days.
+# Default: 7
+# FANOUT_ALERTS_HISTORY_DAYS=
+
+# FANOUT_AUTH_CODE_SECRET; string; secret
+# Signs local sign-in codes; required in local mode with at least 32 characters.
+# Default: (empty)
+# FANOUT_AUTH_CODE_SECRET=
+# Alternatively set FANOUT_AUTH_CODE_SECRET_FILE to a secret file path; do not set both.
+
+# FANOUT_AUTH_MODE; string
+# Selects local sign-in or oidc; each mode validates its prerequisites.
+# Default: local
+# FANOUT_AUTH_MODE=
+
+# FANOUT_DATA_DIR; string
+# Stores telemetry, query state, and the control database.
+# Default: ./data
+# FANOUT_DATA_DIR=
+
+# FANOUT_DEFAULT_NAMESPACE; string
+# Supplies the namespace for telemetry without one.
+# Default: default
+# FANOUT_DEFAULT_NAMESPACE=
+
+# FANOUT_DUCKDB_MAX_CONNECTIONS; integer
+# Caps the DuckDB connection pool. Reads scan immutable Parquet concurrently; rollup-cache writes are serialized by the query write gate. Zero means "size it from the machine" — the same spelling DuckDBThreads uses for deferring to a default. Resolution happens in resolveSizing and is reported in the startup configuration log.
+# Default: 0
+# FANOUT_DUCKDB_MAX_CONNECTIONS=
+
+# FANOUT_DUCKDB_MEMORY; string
+# Caps DuckDB's memory (e.g. "8GB"). Empty means Fanout sizes it from detected memory, reserving headroom for the Go runtime; see resolveSizing. DuckDB's own default is 80% of detected RAM, which is calculated as though DuckDB owned the machine and has been observed to get the process OOM-killed once the Go heap is added on top.
+# Default: (empty)
+# FANOUT_DUCKDB_MEMORY=
+
+# FANOUT_DUCKDB_THREADS; integer
+# Caps DuckDB's global query worker pool. Zero leaves DuckDB's own default in place (one worker per core). Set it to leave cores free for ingest on a query-heavy co-tenant host.
+# Default: (empty)
+# FANOUT_DUCKDB_THREADS=
+
+# FANOUT_INGEST_BATCH_SIZE; integer
+# Limits telemetry rows per batch; valid values are 1–50000.
+# Default: 50000
+# FANOUT_INGEST_BATCH_SIZE=
+
+# FANOUT_INGEST_MAX_IN_FLIGHT_BYTES; integer
+# Caps the decoded telemetry the process will hold across concurrent requests. Concurrency is HTTP/2 streams times connections and each handler holds its batch until the commit is durable, so without a ceiling a burst is bounded only by memory. Zero is unbounded, which is the behaviour that predates this setting.
+# Default: 268435456
+# FANOUT_INGEST_MAX_IN_FLIGHT_BYTES=
+
+# FANOUT_MAINTENANCE_INTERVAL; duration
+# Controls Parquet retention and compaction, and query-cache checkpointing.
+# Default: 1h
+# FANOUT_MAINTENANCE_INTERVAL=
+
+# FANOUT_MCP_ENABLED; boolean
+# Serves the MCP endpoint at /mcp.
+# Default: true
+# FANOUT_MCP_ENABLED=
+
+# FANOUT_METRICS_PUBLIC; boolean
+# Allows unauthenticated Prometheus scrapes.
+# Default: false
+# FANOUT_METRICS_PUBLIC=
+
+# FANOUT_METRICS_TOKEN; string; secret
+# Authorizes Prometheus scrapes with a bearer token; optional when using an admin session.
+# Default: (empty)
+# FANOUT_METRICS_TOKEN=
+# Alternatively set FANOUT_METRICS_TOKEN_FILE to a secret file path; do not set both.
+
+# FANOUT_OIDC_ADMIN_GROUPS; string
+# Lists identity-provider groups mapped to admin, separated by commas.
+# Default: (empty)
+# FANOUT_OIDC_ADMIN_GROUPS=
+
+# FANOUT_OIDC_ALLOWED_DOMAINS; string
+# Lists allowed email domains, separated by commas; wildcard * requires verified email.
+# Default: (empty)
+# FANOUT_OIDC_ALLOWED_DOMAINS=
+
+# FANOUT_OIDC_ALLOWED_GROUPS; string
+# Lists allowed identity-provider groups, separated by commas.
+# Default: (empty)
+# FANOUT_OIDC_ALLOWED_GROUPS=
+
+# FANOUT_OIDC_AUTO_PROVISION; boolean
+# Creates accounts on OIDC sign-in; requires an allowed group or domain.
+# Default: false
+# FANOUT_OIDC_AUTO_PROVISION=
+
+# FANOUT_OIDC_CLIENT_ID; string
+# Identifies Fanout's client registration; required in OIDC mode.
+# Default: (empty)
+# FANOUT_OIDC_CLIENT_ID=
+
+# FANOUT_OIDC_CLIENT_SECRET; string; secret
+# Authenticates Fanout's client registration; required in OIDC mode.
+# Default: (empty)
+# FANOUT_OIDC_CLIENT_SECRET=
+# Alternatively set FANOUT_OIDC_CLIENT_SECRET_FILE to a secret file path; do not set both.
+
+# FANOUT_OIDC_DEFAULT_ROLE; string
+# Assigns viewer, operator, or admin to users without a group role mapping.
+# Default: viewer
+# FANOUT_OIDC_DEFAULT_ROLE=
+
+# FANOUT_OIDC_EMAIL_CLAIM; string
+# Names the claim containing the user's email address.
+# Default: email
+# FANOUT_OIDC_EMAIL_CLAIM=
+
+# FANOUT_OIDC_EMAIL_VERIFICATION; string
+# Selects required verified-email claims or issuer trust; issuer trust requires an allowlist.
+# Default: required
+# FANOUT_OIDC_EMAIL_VERIFICATION=
+
+# FANOUT_OIDC_ISSUER_URL; string
+# Selects the identity provider issuer; required in OIDC mode.
+# Default: (empty)
+# FANOUT_OIDC_ISSUER_URL=
+
+# FANOUT_OIDC_OPERATOR_GROUPS; string
+# Lists identity-provider groups mapped to operator, separated by commas.
+# Default: (empty)
+# FANOUT_OIDC_OPERATOR_GROUPS=
+
+# FANOUT_PPROF_ENABLED; boolean
+# Exposes Go's net/http/pprof handlers at /debug/pprof/* for CPU/heap/mutex/goroutine profiling under load. Off by default; the routes require an admin browser session with operations:read.
+# Default: false
+# FANOUT_PPROF_ENABLED=
+
+# FANOUT_PUBLIC_URL; string
+# Sets the external browser origin. Required for OIDC; HTTPS is required with MCP.
+# Default: (empty)
+# FANOUT_PUBLIC_URL=
+
+# FANOUT_RETENTION_DAYS; integer
+# Sets telemetry retention in days; zero disables expiry.
+# Default: 30
+# FANOUT_RETENTION_DAYS=
+
+# FANOUT_ROLLUP_INTERVAL; duration
+# Schedules analytical rollups; use a Go duration of at least 1s.
+# Default: 1m
+# FANOUT_ROLLUP_INTERVAL=
+
+# FANOUT_ROLLUP_SKIP_TO_LATEST; boolean
+# RollupSkipToLatest, set once at boot, advances the service and edge rollup watermarks to the current max ingested timestamp. Existing history is not aggregated into those analytical rollups. Completed-batch trace caches still rebuild all retained history in bounded passes; uncached files remain immediately queryable. Useful for large pre-seeded datasets (benchmarks, restores); off in normal operation.
+# Default: false
+# FANOUT_ROLLUP_SKIP_TO_LATEST=
+
+# FANOUT_SELF_SIGNUP; boolean
+# Allows verified email addresses to create viewer accounts; requires local auth and SMTP.
+# Default: false
+# FANOUT_SELF_SIGNUP=
+
+# FANOUT_SESSION_ABSOLUTE_TTL; duration
+# Limits total session lifetime; it must be at least FANOUT_SESSION_IDLE_TTL.
+# Default: 168h
+# FANOUT_SESSION_ABSOLUTE_TTL=
+
+# FANOUT_SESSION_IDLE_TTL; duration
+# Expires inactive sessions; use a Go duration of at least 5m.
+# Default: 12h
+# FANOUT_SESSION_IDLE_TTL=
+
+# FANOUT_SMTP_FROM; string
+# Sets the email sender address; required with SMTP.
+# Default: (empty)
+# FANOUT_SMTP_FROM=
+
+# FANOUT_SMTP_HOST; string
+# Selects the mail server. Host, username, password, and from must all be set to enable SMTP.
+# Default: (empty)
+# FANOUT_SMTP_HOST=
+
+# FANOUT_SMTP_PASSWORD; string; secret
+# Authenticates to the mail server; required with SMTP.
+# Default: (empty)
+# FANOUT_SMTP_PASSWORD=
+# Alternatively set FANOUT_SMTP_PASSWORD_FILE to a secret file path; do not set both.
+
+# FANOUT_SMTP_PORT; integer
+# Sets the mail server's positive TCP port.
+# Default: 587
+# FANOUT_SMTP_PORT=
+
+# FANOUT_SMTP_USERNAME; string
+# Authenticates to the mail server; required with SMTP.
+# Default: (empty)
+# FANOUT_SMTP_USERNAME=
+
+# FANOUT_TLS_CERT_FILE; string
+# Selects the TLS certificate file; requires FANOUT_TLS_KEY_FILE.
+# Default: (empty)
+# FANOUT_TLS_CERT_FILE=
+
+# FANOUT_TLS_KEY_FILE; string
+# Selects the TLS private key file; requires FANOUT_TLS_CERT_FILE.
+# Default: (empty)
+# FANOUT_TLS_KEY_FILE=
+
+# FANOUT_TRUSTED_PROXY_CIDRS; string
+# Lists trusted proxy networks, separated by commas; empty trusts no forwarded client addresses.
+# Default: (empty)
+# FANOUT_TRUSTED_PROXY_CIDRS=
+
+# OPENAI_API_KEY; string; secret
+# Required when FANOUT_AI_PROVIDER is openai.
+# Default: (empty)
+# OPENAI_API_KEY=
+# Alternatively set OPENAI_API_KEY_FILE to a secret file path; do not set both.
+
+# OPENAI_BASE_URL; string
+# Defaults to https://api.openai.com/v1. Fanout appends /responses, preserving the API version and any gateway path prefix. Use an HTTP(S) base URL without embedded credentials, a query, or a fragment.
+# Default: (empty)
+# OPENAI_BASE_URL=
diff --git a/.gitignore b/.gitignore
index cd672b0d..1950c6f5 100644
--- a/.gitignore
+++ b/.gitignore
@@ -39,11 +39,11 @@ coverage.out
 coverage.html
 cover.out
 
-# Local environment scratch files. Fanout runtime configuration uses explicit
-# YAML documents and process environment; it does not load dotenv files.
-.env
-.env.*
-!.env.example
+# Personal environment files and operator secret profiles remain private.
+.env*
+!/.env.example
+/secrets/
+/.sops.yaml
 
 # Root-scoped for the same reason as testdata/: a bare `*.png` would silently
 # swallow committed image assets anywhere in the tree.
diff --git a/AGENTS.md b/AGENTS.md
index 1a77df95..ac4ba3fe 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -1,5 +1,39 @@
 # Agent instructions
 
+## Configuration conventions
+
+- Configuration is environment-only. `internal/config/config.go` is the
+  authoritative schema: built-in defaults, then nonempty process environment.
+  Custom names use `FANOUT_` plus a clear name, adding the area only when it
+  clarifies; vendor credentials and endpoints keep `ANTHROPIC_API_KEY`,
+  `ANTHROPIC_BASE_URL`, `OPENAI_API_KEY`, and `OPENAI_BASE_URL`.
+  Provider and model selection remain `FANOUT_AI_PROVIDER` and `FANOUT_AI_MODEL`.
+  An empty provider disables chat; exactly `anthropic` or `openai` requires
+  that provider's key. Ignore AI credentials and endpoints when chat is disabled;
+  validate only the selected provider's endpoint.
+- Every `secret:"true"` field accepts `<ENV>_FILE`. Both forms nonempty fail;
+  secret files lose exactly one trailing LF or CRLF and must remain nonempty.
+  Errors name variables and paths, never secret contents. No file-mode check.
+- `group` tags serve docgen only, using ai, alerts, auth, ingest, mcp, metrics,
+  server, smtp, and storage. Run `just docs-generate` after schema changes and
+  verify `just docs-generate-check`. The generator owns `.env.example` and the
+  site reference; every template value is empty, with defaults and file forms
+  in comments. Secret defaults must never appear in public artifacts.
+- The binary does not load dotenv. `just run` uses Node's native `parseEnv` for
+  optional ignored `./.env`, then inherited environment values win. Personal
+  development credentials may live there. Never shell-source dotenv. Only
+  Fanout's namespace rejects unknown names; tolerate platform service variables
+  and ignore unrelated names in shared vendor namespaces.
+- Native listener default is `127.0.0.1:7520`. The image supplies
+  `FANOUT_ADDR=:7520` and `FANOUT_DATA_DIR=/var/lib/fanout/data`.
+- Repository-managed secret profiles adopt SOPS authority through a verified
+  migration, with key recovery in 1Password. Existing vault/platform delivery
+  remains authoritative until all consumers and recovery are verified. Follow
+  `docs/operations.md` for delivery; never commit credential profiles in plaintext.
+- This public product repository ships no operator secrets or recipients. Keep
+  operator `secrets/`, personal environment files, and private migration sources
+  ignored and outside Docker inputs; select private SOPS profiles explicitly.
+
 ## Public repository
 
 - Keep credentials, private telemetry, local workstation paths, and private AI
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 74f4b3fd..e8bbb304 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -14,8 +14,15 @@ You need Go 1.27.2 and a C/C++ toolchain on native Linux or macOS (amd64 or arm6
 [Bun](https://bun.sh), [just](https://just.systems),
 [golangci-lint](https://golangci-lint.run/), and
 [Lefthook](https://github.com/evilmartians/lefthook). Running in local auth mode
-also requires a 32-character authentication code secret; SMTP and an AI key are
-optional — see [README](README.md#requirements).
+also requires a 32-character authentication code secret. SMTP and AI chat are
+optional; selecting an AI provider requires its key — see [README](README.md#requirements).
+
+Copy `.env.example` to ignored `.env` for personal development settings and
+credentials. Every entry is commented out; uncomment only values you want to
+supply. Copying the template sets nothing. After building, `just run` loads it with Node's native dotenv
+parser; inherited environment values win. The binary validates the settings.
+Keep this file out of Git and Docker inputs. See
+[runtime secret delivery](docs/operations.md#runtime-secret-delivery).
 
 The DuckDB wrapper downloads the pinned, checksum-verified engine from
 [Fanout's dependency artifact mirror](https://github.com/labstack/fanout/releases/tag/duckdb-v2.0.0-alpha43763)
@@ -83,10 +90,18 @@ PNG in the same change. The recipe fails when the
 font is missing rather than shipping a card in a substitute face, which typst
 would otherwise do without complaint.
 
-**Runtime configuration is strict.** [`fanout.example.yaml`](fanout.example.yaml)
-is the complete schema. New settings need a YAML key, a `FANOUT_` environment
-name, a test, and matching documentation; unknown names deliberately fail
-startup.
+**Runtime configuration is strict.** `internal/config/config.go` owns the
+schema. New settings need an environment name, a documentation `group` tag,
+a purpose comment, a test, and matching documentation. Custom settings use
+`FANOUT_` plus a clear name, adding the area only when it clarifies; vendor
+credentials and endpoints keep the vendor's documented names. Unknown owned
+names fail startup, while unrelated shared-vendor/tool variables are ignored.
+Secrets use `secret:"true"` and automatically accept an `_FILE` form; do not
+set both forms nonempty. Run `just docs-generate` to regenerate the settings
+reference and `.env.example`; `just docs-generate-check` verifies them. The
+template leaves all values empty and documents defaults in comments.
+Personal environment files and operator profiles stay ignored and outside
+Docker. Never shell-source dotenv.
 
 **SQLite migrations own the control schema.** Write forward SQL changes in
 `internal/db/migrations` using Goose annotations. `just db-migrate-create NAME`
diff --git a/Dockerfile b/Dockerfile
index 34614b4b..3713f60a 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -46,7 +46,6 @@ LABEL org.opencontainers.image.title="Fanout" \
       org.opencontainers.image.version="${VERSION}"
 
 COPY --from=build /app/fanout /usr/local/bin/fanout
-COPY fanout.docker.yaml /etc/fanout/fanout.yaml
 COPY LICENSE NOTICE THIRD_PARTY_NOTICES TRADEMARK.md /usr/share/licenses/fanout/
 COPY --from=build --chown=nonroot:nonroot /runtime/var/lib/fanout /var/lib/fanout
 
@@ -55,6 +54,8 @@ COPY --from=build --chown=nonroot:nonroot /runtime/var/lib/fanout /var/lib/fanou
 USER nonroot:nonroot
 WORKDIR /var/lib/fanout
 
+ENV FANOUT_ADDR=:7520 FANOUT_DATA_DIR=/var/lib/fanout/data
+
 EXPOSE 7520
 
 # Startup does DuckDB catalog attachment and maintenance, so the grace period
@@ -64,4 +65,3 @@ HEALTHCHECK --interval=30s --timeout=3s --start-period=40s --retries=3 \
     CMD ["fanout", "healthcheck"]
 
 ENTRYPOINT ["fanout"]
-CMD ["--config", "/etc/fanout/fanout.yaml"]
diff --git a/README.md b/README.md
index 7ae8a847..9bfefa7b 100644
--- a/README.md
+++ b/README.md
@@ -96,7 +96,7 @@ Fanout.
 - A 32-character **authentication code secret**
 
 SMTP and an AI provider are optional. Without SMTP, an operator can mint a
-short-lived login link from the local Fanout binary. Without an AI key, ingest,
+short-lived login link from the local Fanout binary. With no AI provider selected, ingest,
 dashboards, traces, logs, metrics, and MCP continue to work; only investigation
 chat and AI-assisted controls are hidden.
 
@@ -155,17 +155,18 @@ hostname reachable from that Collector.
 
 The equivalent OTLP/gRPC endpoint is `localhost:7520` (plaintext locally).
 Behind a TLS proxy, both transports use the public origin; gRPC requires
-HTTP/2 to Fanout. See the [single-port migration notes](docs/operations.md#single-port-migration).
+HTTP/2 to Fanout.
 For later sign-in
 without SMTP, mint a 15-minute, single-use link against the running
 container's control database:
 
 ```sh
-docker exec fanout fanout --config /etc/fanout/fanout.yaml \
-  login-link admin@example.com
+docker exec fanout fanout login-link admin@example.com
 ```
 
-Add `FANOUT_AI_API_KEY` to enable chat. Configure all four SMTP settings
+Select `FANOUT_AI_PROVIDER=anthropic` and inject `ANTHROPIC_API_KEY`, or select
+`FANOUT_AI_PROVIDER=openai` and inject `OPENAI_API_KEY`, to enable chat. The
+selected provider requires its key at startup. Configure all four SMTP settings
 (`FANOUT_SMTP_HOST`, `FANOUT_SMTP_USERNAME`, `FANOUT_SMTP_PASSWORD`, and
 `FANOUT_SMTP_FROM`) to enable email-code login.
 
@@ -173,20 +174,10 @@ The distroless image runs unprivileged as UID 65532. A bind-mounted host directo
 `/var/lib/fanout/data` must be writable by that user; a named volume, as above,
 needs no such handling.
 
-The image selects `/etc/fanout/fanout.yaml` by default. That file contains only
-the container listener and data-directory defaults; it does not contain
-credentials. Start a container-specific document from that file so it retains
-the shared listener and persistent data-directory settings:
-
-```sh
-cp fanout.docker.yaml fanout.yaml
-# Add the remaining settings, then mount it over the image document:
-docker run -v ./fanout.yaml:/etc/fanout/fanout.yaml:ro \
-  labstack/fanout:latest
-```
-
-All surfaces use `server.addr` (`:7520` by default). Publish only that
-port; OTLP/HTTP and OTLP/gRPC use the same address as the application.
+The image sets `FANOUT_ADDR=:7520` and
+`FANOUT_DATA_DIR=/var/lib/fanout/data`. Override settings with deployment
+environment values or mounted secret files. Publish port `7520`; the UI, API,
+MCP, OTLP/HTTP, and OTLP/gRPC share this listener.
 
 ### From source
 
@@ -205,8 +196,9 @@ export FANOUT_AUTH_CODE_SECRET=$(openssl rand -hex 32) # must be 32+ characters
 ./bin/fanout
 ```
 
-Optionally set `FANOUT_AI_API_KEY` for chat and the SMTP variables shown above
-for email-code login. Without SMTP, run `./bin/fanout login-link
+Optionally select `FANOUT_AI_PROVIDER=anthropic` with `ANTHROPIC_API_KEY`, or
+`FANOUT_AI_PROVIDER=openai` with `OPENAI_API_KEY`, for chat. Set the SMTP variables shown above for
+email-code login. Without SMTP, run `./bin/fanout login-link
 admin@example.com` from the same configuration and data directory.
 
 Fanout serves the UI, API, MCP, OTLP/gRPC and OTLP/HTTP on
@@ -220,43 +212,60 @@ capacity tests.
 
 ## Configuration
 
-Configuration is resolved once at startup and validated before Fanout opens
-data files or listeners. Sources apply in this order: built-in defaults, an
-optional YAML document selected with `--config`, then `FANOUT_` environment
-variables. Fanout does not search for configuration or load `.env` files.
-
-[`fanout.example.yaml`](fanout.example.yaml) is the complete commented schema:
-
-```sh
-cp fanout.example.yaml fanout.yaml
-./bin/fanout --config ./fanout.yaml
-```
-
-Environment variables override the corresponding YAML values and are useful
-for container injection and secrets. An empty environment value means "no
-override"; use YAML for an explicit empty string. Unknown YAML keys and unknown
-`FANOUT_` variables are startup errors, except for the service-discovery names
-Kubernetes and Docker link-style networking inject for a Service named
-`fanout`. All environment variables outside the `FANOUT_` namespace are
-ignored.
-
-YAML null values are rejected. Boolean values must use YAML 1.2 `true` or
-`false` (not `yes`, `no`, `on`, or `off`). If a YAML document contains a
-credential, Fanout requires that the file not be accessible by group or others
-(for example, mode `0600`). The definitions live in
-[`internal/config/config.go`](internal/config/config.go); the settings most
-operators touch are:
-
-| YAML key | Environment override | Default | Purpose |
-| --- | --- | --- | --- |
-| `server.addr` | `FANOUT_ADDR` | `:7520` | UI, API, MCP, and both OTLP transports |
-| `storage.data_dir` | `FANOUT_DATA_DIR` | `./data` | Parquet, query state, and control SQLite |
-| `auth.mode` | `FANOUT_AUTH_MODE` | `local` | `local` (login link or SMTP) or `oidc` |
-| `auth.code_secret` | `FANOUT_AUTH_CODE_SECRET` | — | Required in local mode, 32+ characters |
-| `ai.provider` | `FANOUT_AI_PROVIDER` | `anthropic` | `anthropic` or `openai` |
-| `ai.api_key` | `FANOUT_AI_API_KEY` | — | Enables AI investigation chat |
-| `storage.retention_days` | `FANOUT_RETENTION_DAYS` | `30` | Telemetry retention window |
-| `mcp.enabled` | `FANOUT_MCP_ENABLED` | `true` | Serve the MCP endpoint at `/mcp` |
+Configuration is resolved once at startup from built-in defaults followed by
+nonempty process environment values, and validated before data files or
+listeners open. Every change requires a restart. Native installs bind
+`127.0.0.1:7520` by default; set `FANOUT_ADDR=:7520` for other hosts to reach it.
+
+Custom settings use `FANOUT_` plus a clear name, adding the area only when it
+clarifies. Vendor credentials and endpoints keep their documented names:
+`ANTHROPIC_API_KEY`, `ANTHROPIC_BASE_URL`, `OPENAI_API_KEY`, and
+`OPENAI_BASE_URL`. Unknown `FANOUT_` variables fail startup, except for
+platform-injected service-discovery names. Unrelated vendor/tool variables are
+ignored. Empty values mean unset. Bools, integers, and Go durations are parsed
+as their declared types.
+
+[`.env.example`](.env.example) is generated from
+[`internal/config/config.go`](internal/config/config.go), with every value
+empty and every entry commented out. Types, defaults, and secret file forms
+are documented in comments. Copying it sets nothing and preserves image ENV.
+Copy it to ignored `.env` and uncomment personal settings and development
+credentials as needed. After building, `just run` uses Node's
+`parseEnv` to load optional `./.env`, then lets inherited environment values
+win, including empty values. The binary itself reads only process environment;
+production launchers and deployments supply their own values.
+
+Every secret also accepts a file path through `<ENV>_FILE`:
+`FANOUT_AUTH_CODE_SECRET_FILE`, `FANOUT_OIDC_CLIENT_SECRET_FILE`,
+`FANOUT_SMTP_PASSWORD_FILE`, `FANOUT_METRICS_TOKEN_FILE`,
+`ANTHROPIC_API_KEY_FILE`, and `OPENAI_API_KEY_FILE`. Set either the value or
+its file path. Setting both nonempty fails startup. Fanout strips exactly one
+trailing LF or CRLF from a secret file and rejects an empty result.
+
+| Environment variable | Default | Purpose |
+| --- | --- | --- |
+| `FANOUT_ADDR` | `127.0.0.1:7520` | UI, API, MCP, and both OTLP transports |
+| `FANOUT_DATA_DIR` | `./data` | Parquet, query state, and control SQLite |
+| `FANOUT_AUTH_MODE` | `local` | Login link or SMTP, or `oidc` |
+| `FANOUT_AUTH_CODE_SECRET` | — | Required in local mode, 32+ characters |
+| `FANOUT_AI_PROVIDER` | — | Empty disables chat; `anthropic` or `openai` enables it |
+| `ANTHROPIC_API_KEY` | — | Required for Anthropic chat |
+| `OPENAI_API_KEY` | — | Required for OpenAI chat |
+| `FANOUT_RETENTION_DAYS` | `30` | Telemetry retention window |
+| `FANOUT_MCP_ENABLED` | `true` | Serve the MCP endpoint at `/mcp` |
+
+Chat requires an explicit provider and its credential. Inherited keys never
+enable it. Only the selected provider's endpoint is validated and used.
+`FANOUT_AI_MODEL` selects the model. `ANTHROPIC_BASE_URL` defaults to
+`https://api.anthropic.com`; Fanout appends `/v1/messages`. `OPENAI_BASE_URL`
+defaults to `https://api.openai.com/v1`; Fanout appends `/responses`.
+Both preserve gateway prefixes and accept a trailing slash. The selected URL
+must use HTTP(S) without credentials, a query, or a fragment.
+
+See [runtime secret delivery](docs/operations.md#runtime-secret-delivery) for
+deployment examples. This public repository excludes operator secret profiles
+and private recipient policy. Run `just docs-generate` after changing the
+schema; `just docs-generate-check` verifies `.env.example` and the reference.
 
 ### Advanced DuckDB sizing
 
@@ -270,14 +279,14 @@ These variables are escape hatches for measured, unusual workloads:
 
 | Variable | Automatic behavior | When to override |
 | --- | --- | --- |
-| `storage.duckdb.memory` / `FANOUT_DUCKDB_MEMORY` | 60% of the container or host memory available to Fanout | A measured co-tenant workload needs a different Go/DuckDB split |
-| `storage.duckdb.max_connections` / `FANOUT_DUCKDB_MAX_CONNECTIONS` | Available Go CPUs, bounded to 2–16 connections | Query concurrency has been benchmarked for this machine |
-| `storage.duckdb.threads` / `FANOUT_DUCKDB_THREADS` | DuckDB chooses its own query worker count | Query-heavy work must leave specific cores free for ingest |
+| `FANOUT_DUCKDB_MEMORY` | 60% of the container or host memory available to Fanout | A measured co-tenant workload needs a different Go/DuckDB split |
+| `FANOUT_DUCKDB_MAX_CONNECTIONS` | Available Go CPUs, bounded to 2–16 connections | Query concurrency has been benchmarked for this machine |
+| `FANOUT_DUCKDB_THREADS` | DuckDB chooses its own query worker count | Query-heavy work must leave specific cores free for ingest |
 
 An explicit value always wins. Startup logs and `/readyz` report the detected
 host and cgroup limits, the selected source, and whether detection was
 incomplete. If Fanout cannot conclusively inspect a container limit, it warns;
-set `storage.duckdb.memory` or `FANOUT_DUCKDB_MEMORY` for a guaranteed bound.
+set `FANOUT_DUCKDB_MEMORY` for a guaranteed bound.
 
 For TLS and reverse proxies, health checks, backups and restores, upgrades,
 retention, and recovery, see the [operator runbook](docs/operations.md).
diff --git a/SECURITY.md b/SECURITY.md
index d3a1bfd4..7eb0bcfa 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -37,9 +37,8 @@ release is supported. There are no backports to earlier tags.
 
 ## Operating Fanout safely
 
-Fanout serves plaintext by default. Configure `server.tls.cert_file` and
-`server.tls.key_file` in YAML (or `FANOUT_TLS_CERT_FILE` and
-`FANOUT_TLS_KEY_FILE`), or place it behind a reverse proxy that terminates TLS.
+Fanout serves plaintext by default. Configure `FANOUT_TLS_CERT_FILE` and
+`FANOUT_TLS_KEY_FILE`, or place it behind a reverse proxy that terminates TLS.
 Browser and API reads require an authenticated account, and every OTLP request
 requires the separately managed ingest token. Demo instances use the same
 credential paths as production instances.
diff --git a/THIRD_PARTY_NOTICES b/THIRD_PARTY_NOTICES
index 55c75338..0230def8 100644
--- a/THIRD_PARTY_NOTICES
+++ b/THIRD_PARTY_NOTICES
@@ -23,7 +23,6 @@ COMPONENT INVENTORY
 - Go: github.com/duckdb/duckdb-go-bindings v0.10506.0
 - Go: github.com/duckdb/duckdb-go/v2 v2.10506.0
 - Go: github.com/dustin/go-humanize v1.1.0
-- Go: github.com/fsnotify/fsnotify v1.10.1
 - Go: github.com/go-jose/go-jose/v4 v4.1.5
 - Go: github.com/go-viper/mapstructure/v2 v2.5.0
 - Go: github.com/google/jsonschema-go v0.4.3
@@ -31,16 +30,9 @@ COMPONENT INVENTORY
 - Go: github.com/grpc-ecosystem/grpc-gateway/v2 v2.31.0
 - Go: github.com/klauspost/compress v1.20.1
 - Go: github.com/klauspost/cpuid/v2 v2.4.0
-- Go: github.com/knadh/koanf/maps v0.1.3
-- Go: github.com/knadh/koanf/parsers/yaml v1.1.1
-- Go: github.com/knadh/koanf/providers/confmap v1.0.1
-- Go: github.com/knadh/koanf/providers/file v1.2.1
-- Go: github.com/knadh/koanf/v2 v2.3.7
 - Go: github.com/labstack/echo/v5 v5.4.0
 - Go: github.com/mattn/go-isatty v0.0.24
 - Go: github.com/mfridman/interpolate v0.0.2
-- Go: github.com/mitchellh/copystructure v1.2.0
-- Go: github.com/mitchellh/reflectwalk v1.0.2
 - Go: github.com/modelcontextprotocol/go-sdk v1.8.0
 - Go: github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822
 - Go: github.com/ncruces/go-strftime v1.1.0
@@ -1177,39 +1169,8 @@ SOFTWARE.
 
 <http://www.opensource.org/licenses/mit-license.php>
 
---- Applies to -------------------------------------------------------------
-- Go: github.com/fsnotify/fsnotify v1.10.1 / LICENSE
-----------------------------------------------------------------------------
-
-Copyright © 2012 The Go Authors. All rights reserved.
-Copyright © fsnotify Authors. All rights reserved.
-
-Redistribution and use in source and binary forms, with or without modification,
-are permitted provided that the following conditions are met:
-
-* Redistributions of source code must retain the above copyright notice, this
-  list of conditions and the following disclaimer.
-* Redistributions in binary form must reproduce the above copyright notice, this
-  list of conditions and the following disclaimer in the documentation and/or
-  other materials provided with the distribution.
-* Neither the name of Google Inc. nor the names of its contributors may be used
-  to endorse or promote products derived from this software without specific
-  prior written permission.
-
-THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
-ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
-WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
-DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR
-ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
-(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
-LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
-ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
-SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
 --- Applies to -------------------------------------------------------------
 - Go: github.com/go-viper/mapstructure/v2 v2.5.0 / LICENSE
-- Go: github.com/mitchellh/reflectwalk v1.0.2 / LICENSE
 ----------------------------------------------------------------------------
 
 The MIT License (MIT)
@@ -1659,36 +1620,6 @@ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
 
---- Applies to -------------------------------------------------------------
-- Go: github.com/knadh/koanf/maps v0.1.3 / LICENSE
-- Go: github.com/knadh/koanf/parsers/yaml v1.1.1 / LICENSE
-- Go: github.com/knadh/koanf/providers/confmap v1.0.1 / LICENSE
-- Go: github.com/knadh/koanf/providers/file v1.2.1 / LICENSE
-- Go: github.com/knadh/koanf/v2 v2.3.7 / LICENSE
-----------------------------------------------------------------------------
-
-The MIT License
-
-Copyright (c) 2019, Kailash Nadh. https://github.com/knadh
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in
-all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
-THE SOFTWARE.
-
 --- Applies to -------------------------------------------------------------
 - Go: github.com/labstack/echo/v5 v5.4.0 / LICENSE
 ----------------------------------------------------------------------------
@@ -1758,32 +1689,6 @@ LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
 OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
 WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 
---- Applies to -------------------------------------------------------------
-- Go: github.com/mitchellh/copystructure v1.2.0 / LICENSE
-----------------------------------------------------------------------------
-
-The MIT License (MIT)
-
-Copyright (c) 2014 Mitchell Hashimoto
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in
-all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
-THE SOFTWARE.
-
 --- Applies to -------------------------------------------------------------
 - Go: github.com/modelcontextprotocol/go-sdk v1.8.0 / LICENSE
 ----------------------------------------------------------------------------
diff --git a/cmd/fanout-docgen/main.go b/cmd/fanout-docgen/main.go
index 021a2ddb..5ece1e13 100644
--- a/cmd/fanout-docgen/main.go
+++ b/cmd/fanout-docgen/main.go
@@ -52,18 +52,19 @@ func main() {
 		// list going stale is loud rather than a quietly shorter table.
 		routeDirs = flag.String("route-dirs", "internal/api,internal/agent,cmd/fanout",
 			"comma-separated directories whose files register HTTP routes")
-		outDir = flag.String("out", "site/src/content/docs/reference", "reference root to write generated pages into")
-		check  = flag.Bool("check", false, "exit non-zero when a written page differs from the one on disk")
+		outDir     = flag.String("out", "site/src/content/docs/reference", "reference root to write generated pages into")
+		envExample = flag.String("env-example", ".env.example", "path to the generated environment template")
+		check      = flag.Bool("check", false, "exit non-zero when a written page differs from the one on disk")
 	)
 	flag.Parse()
 
-	if err := run(*source, *alerts, *routeDirs, *outDir, *check); err != nil {
+	if err := run(*source, *alerts, *routeDirs, *outDir, *envExample, *check); err != nil {
 		fmt.Fprintf(os.Stderr, "fanout-docgen: %v\n", err)
 		os.Exit(1)
 	}
 }
 
-func run(source, alertSource, routeDirs, outDir string, check bool) error {
+func run(source, alertSource, routeDirs, outDir, envExample string, check bool) error {
 	fields, err := collect(source)
 	if err != nil {
 		return err
@@ -117,9 +118,12 @@ func run(source, alertSource, routeDirs, outDir string, check bool) error {
 	}
 	pages["mcp-tools.mdx"] = toolsPage
 
-	var stale []string
+	outputs := map[string][]byte{envExample: renderEnvironment(fields)}
 	for name, body := range pages {
-		path := filepath.Join(outDir, name)
+		outputs[filepath.Join(outDir, name)] = body
+	}
+	var stale []string
+	for path, body := range outputs {
 		if check {
 			existing, err := os.ReadFile(path)
 			if err != nil {
@@ -272,7 +276,8 @@ func renderAlertEnv(vars []field) []byte {
 // field is one setting, assembled from both views of the same declaration.
 type field struct {
 	GoName  string
-	Key     string // koanf key, e.g. "storage.duckdb.memory"
+	Key     string // alert expression variable
+	Group   string // documentation area, e.g. "storage"
 	Env     string // e.g. "FANOUT_DUCKDB_MEMORY"
 	Type    string
 	Default string
@@ -281,8 +286,7 @@ type field struct {
 }
 
 func (f field) group() string {
-	key, _, _ := strings.Cut(f.Key, ".")
-	return key
+	return f.Group
 }
 
 // collect reflects over config.Config for the contract, parses source for the
@@ -302,11 +306,11 @@ func collect(source string) ([]field, error) {
 		if !sf.IsExported() {
 			continue
 		}
-		key := sf.Tag.Get("koanf")
+		group := sf.Tag.Get("group")
 		env := sf.Tag.Get("env")
-		if key == "" || env == "" {
+		if group == "" || env == "" {
 			return nil, fmt.Errorf(
-				"config.Config field %s is exported but carries no koanf/env tag; "+
+				"config.Config field %s is exported but carries no group/env tag; "+
 					"either tag it so it reaches the reference, or unexport it",
 				sf.Name,
 			)
@@ -314,7 +318,7 @@ func collect(source string) ([]field, error) {
 		seen[sf.Name] = true
 		fields = append(fields, field{
 			GoName:  sf.Name,
-			Key:     key,
+			Group:   group,
 			Env:     env,
 			Type:    typeName(sf.Type),
 			Default: sf.Tag.Get("default"),
@@ -336,7 +340,7 @@ func collect(source string) ([]field, error) {
 		}
 	}
 
-	sort.Slice(fields, func(i, j int) bool { return fields[i].Key < fields[j].Key })
+	sort.Slice(fields, func(i, j int) bool { return fields[i].Env < fields[j].Env })
 	return fields, nil
 }
 
@@ -433,7 +437,7 @@ type groupPage struct {
 	ReadWhen    []string
 }
 
-// Registering a group is deliberate. A new koanf prefix appearing in the type
+// Registering a group is deliberate. A new group appearing in the type
 // is a new section of the product, and it should be named by a person rather
 // than published under a bare key — so an unregistered group fails the run
 // instead of shipping a page called "metrics" with no explanation on it.
@@ -483,7 +487,7 @@ var groups = map[string]groupPage{
 	"ai": {
 		Title:       "AI provider settings",
 		Description: "The provider, key, model and base URL backing the chat investigator.",
-		Summary:     "Settings for the model behind the chat investigator. Without a key the agent is disabled.",
+		Summary:     "Chat is disabled unless a provider is selected; its API key is then required.",
 		ReadWhen: []string{
 			"The chat investigator is disabled and you want it on.",
 			"You are pointing Fanout at a self-hosted or proxied model endpoint.",
@@ -550,23 +554,33 @@ func renderPage(name string, page groupPage, fields []field) []byte {
 
 	b.WriteString("{/* Generated by cmd/fanout-docgen from internal/config. Edit the generator, not this page. */}\n\n")
 
-	b.WriteString("Every setting below is read from the environment variable in the second\n")
-	b.WriteString("column, or from the same key in a YAML configuration file. An unrecognised\n")
-	b.WriteString("`FANOUT_`-prefixed variable is a startup error, so a renamed setting surfaces\n")
-	b.WriteString("as a refusal to start rather than as a default nobody chose.\n\n")
+	b.WriteString("Every setting below is read once at startup and requires a restart to change.\n")
+	b.WriteString("Built-in defaults are overridden by nonempty environment values.\n")
+	b.WriteString("Unknown `FANOUT_` names fail startup; platform-injected service names are tolerated.\n")
+	b.WriteString("Custom names use `FANOUT_` plus a clear name, adding the area only when it clarifies.\n")
+	b.WriteString("Vendor credentials and endpoints keep the vendor's documented names.\n\n")
+	if name == "ai" {
+		b.WriteString("Fanout also recognizes `ANTHROPIC_API_KEY`, `ANTHROPIC_BASE_URL`,\n")
+		b.WriteString("`OPENAI_API_KEY`, and `OPENAI_BASE_URL`. Other vendor/tool variables are\n")
+		b.WriteString("ignored; only the explicitly selected AI provider's key and endpoint are used.\n\n")
+	}
 
-	b.WriteString("| Setting | Environment variable | Type | Default |\n")
-	b.WriteString("|---|---|---|---|\n")
+	b.WriteString("| Environment variable | Type | Default |\n")
+	b.WriteString("|---|---|---|\n")
 	for _, f := range fields {
 		typ := f.Type
 		if f.Secret {
 			typ += " · secret"
 		}
 		def := "—"
-		if f.Default != "" {
+		if f.Default != "" && !f.Secret {
 			def = "`" + f.Default + "`"
 		}
-		fmt.Fprintf(&b, "| `%s` | `%s` | %s | %s |\n", f.Key, f.Env, typ, def)
+		names := "`" + f.Env + "`"
+		if f.Secret {
+			names += " or `" + f.Env + "_FILE`"
+		}
+		fmt.Fprintf(&b, "| %s | %s | %s |\n", names, typ, def)
 	}
 
 	var noted []field
@@ -578,21 +592,56 @@ func renderPage(name string, page groupPage, fields []field) []byte {
 	if len(noted) > 0 {
 		b.WriteString("\n## Notes\n")
 		for _, f := range noted {
-			fmt.Fprintf(&b, "\n### `%s`\n\n%s\n", f.Key, f.Doc)
+			fmt.Fprintf(&b, "\n### `%s`\n\n%s\n", f.Env, f.Doc)
 		}
 	}
 
 	if hasSecret(fields) {
 		b.WriteString("\n:::caution[Secrets]\n")
 		b.WriteString("Settings marked `secret` are redacted from Fanout's startup configuration\n")
-		b.WriteString("log. They are still plain environment variables: anything that can read the\n")
-		b.WriteString("process environment can read them.\n")
+		b.WriteString("log. Supply either the value or its `_FILE` path, never both. File contents\n")
+		b.WriteString("lose exactly one trailing newline (LF or CRLF); empty secrets fail startup.\n")
 		b.WriteString(":::\n")
 	}
 
 	return []byte(b.String())
 }
 
+// renderEnvironment shares the exact reflected schema used by the site pages.
+// Entries are commented out; defaults and secret file forms stay in comments.
+func renderEnvironment(fields []field) []byte {
+	var b strings.Builder
+	b.WriteString("# Generated by cmd/fanout-docgen from internal/config/config.go.\n")
+	b.WriteString("# Regenerate with just docs-generate; verify with just docs-generate-check.\n")
+	b.WriteString("# Fanout does not load dotenv files. Inject through your launcher or deployment.\n")
+	b.WriteString("# Precedence: built-in defaults < nonempty environment values.\n")
+	b.WriteString("# All settings require restart. Empty environment values mean no override.\n")
+	b.WriteString("# Every entry is commented out so copying this template sets nothing, preserving image ENV.\n")
+	b.WriteString("# Uncomment only settings you want to supply; use runtime secret injection for secrets.\n")
+	b.WriteString("# Local authentication requires FANOUT_AUTH_CODE_SECRET (32+ characters).\n")
+	b.WriteString("# Chat is disabled unless FANOUT_AI_PROVIDER selects anthropic or openai; its key is required.\n")
+	for _, f := range fields {
+		fmt.Fprintf(&b, "\n# %s; %s", f.Env, f.Type)
+		if f.Secret {
+			b.WriteString("; secret")
+		}
+		b.WriteByte('\n')
+		if f.Doc != "" {
+			fmt.Fprintf(&b, "# %s\n", f.Doc)
+		}
+		defaultValue := f.Default
+		if f.Secret || defaultValue == "" {
+			defaultValue = "(empty)"
+		}
+		fmt.Fprintf(&b, "# Default: %s\n", defaultValue)
+		fmt.Fprintf(&b, "# %s=\n", f.Env)
+		if f.Secret {
+			fmt.Fprintf(&b, "# Alternatively set %s_FILE to a secret file path; do not set both.\n", f.Env)
+		}
+	}
+	return []byte(b.String())
+}
+
 func hasSecret(fields []field) bool {
 	for _, f := range fields {
 		if f.Secret {
diff --git a/cmd/fanout-docgen/main_test.go b/cmd/fanout-docgen/main_test.go
index b53429e6..a3430930 100644
--- a/cmd/fanout-docgen/main_test.go
+++ b/cmd/fanout-docgen/main_test.go
@@ -5,6 +5,8 @@ import (
 	"path/filepath"
 	"strings"
 	"testing"
+
+	"github.com/labstack/fanout/internal/config"
 )
 
 const configSource = "../../internal/config/config.go"
@@ -22,15 +24,73 @@ func TestCollectCrossChecksReflectionAgainstSource(t *testing.T) {
 	}
 
 	for _, f := range fields {
-		if f.Key == "" || f.Env == "" {
-			t.Errorf("%s: koanf and env tags are both required", f.GoName)
-		}
-		if !strings.HasPrefix(f.Env, "FANOUT_") {
-			t.Errorf("%s: environment variable %q lacks the FANOUT_ prefix the loader requires", f.GoName, f.Env)
+		if f.Group == "" || f.Env == "" {
+			t.Errorf("%s: group and env tags are both required", f.GoName)
 		}
 		if f.Type == "" {
 			t.Errorf("%s: no rendered type", f.GoName)
 		}
+		if f.Doc == "" {
+			t.Errorf("%s: setting purpose must be documented in the authoritative schema", f.GoName)
+		}
+	}
+}
+
+func TestEnvironmentTemplateMatchesSchema(t *testing.T) {
+	fields, err := collect(configSource)
+	if err != nil {
+		t.Fatal(err)
+	}
+	body := renderEnvironment(fields)
+	written, err := os.ReadFile("../../.env.example")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if string(written) != string(body) {
+		t.Error(".env.example is stale; run just docs-generate")
+	}
+	var env []string
+	seen := map[string]string{}
+	for _, line := range strings.Split(string(body), "\n") {
+		if line == "" {
+			continue
+		}
+		if !strings.HasPrefix(line, "#") {
+			t.Fatalf("template must contain only comments: %q", line)
+		}
+		entry := strings.TrimPrefix(line, "# ")
+		if !strings.HasSuffix(entry, "=") {
+			continue
+		}
+		name, value, ok := strings.Cut(entry, "=")
+		if _, duplicate := seen[name]; !ok || duplicate {
+			t.Fatal("invalid or duplicate template entry")
+		}
+		seen[name] = value
+	}
+	if len(seen) != len(fields) {
+		t.Fatalf("template has %d settings, schema has %d", len(seen), len(fields))
+	}
+	for _, f := range fields {
+		if f.Secret && !strings.Contains(string(body), f.Env+"_FILE") {
+			t.Errorf("missing file form for %s", f.Env)
+		}
+		value, exists := seen[f.Env]
+		if !exists || value != "" {
+			t.Errorf("template must leave %s empty so it preserves defaults", f.Env)
+		}
+		if f.Default != "" && !f.Secret && !strings.Contains(string(body), "# Default: "+f.Default+"\n# "+f.Env+"=\n") {
+			t.Errorf("template must document the default for %s", f.Env)
+		}
+	}
+	// A copied template contributes no overrides to the image environment.
+	env = append(env, "FANOUT_ADDR=:7520", "FANOUT_DATA_DIR=/var/lib/fanout/data", "FANOUT_AUTH_CODE_SECRET="+strings.Repeat("x", 32))
+	cfg, err := config.Load(config.LoadOptions{Environ: env})
+	if err != nil {
+		t.Fatalf("template rejected by the runtime loader: %v", err)
+	}
+	if cfg.Addr != ":7520" || cfg.DataDir != "/var/lib/fanout/data" {
+		t.Fatal("template must preserve image environment values")
 	}
 }
 
@@ -53,7 +113,7 @@ func TestEverySettingGroupIsRegistered(t *testing.T) {
 			t.Errorf(
 				"setting %q is in group %q, which has no entry in the groups registry; "+
 					"add a title and description for it",
-				f.Key, f.group(),
+				f.Env, f.group(),
 			)
 		}
 	}
@@ -74,13 +134,16 @@ func TestRenderProducesOnePageWithFrontmatterPerGroup(t *testing.T) {
 
 	for name, body := range pages {
 		text := string(body)
+		if strings.Contains(text, "Fanout also recognizes") != (name == "settings/ai.mdx") {
+			t.Errorf("%s: vendor-variable paragraph belongs only on the AI settings page", name)
+		}
 		if !strings.HasPrefix(text, "---\n") {
 			t.Errorf("%s: does not open with frontmatter", name)
 		}
 		if !strings.Contains(text, "generated: true") {
 			t.Errorf("%s: missing the generated marker, so the site cannot tell it apart from an authored page", name)
 		}
-		if !strings.Contains(text, "| Setting | Environment variable | Type | Default |") {
+		if !strings.Contains(text, "| Environment variable | Type | Default |") {
 			t.Errorf("%s: missing the settings table", name)
 		}
 		// Every page is indexed in llms.txt, which fails the site build when a
diff --git a/cmd/fanout/main.go b/cmd/fanout/main.go
index ed769cbc..f83950be 100644
--- a/cmd/fanout/main.go
+++ b/cmd/fanout/main.go
@@ -2,6 +2,9 @@ package main
 
 import (
 	"context"
+	"crypto/tls"
+	"crypto/x509"
+	"encoding/pem"
 	"errors"
 	"flag"
 	"fmt"
@@ -10,6 +13,7 @@ import (
 	"net"
 	"net/http"
 	"net/http/pprof"
+	"net/netip"
 	"net/url"
 	"os"
 	"os/signal"
@@ -58,7 +62,7 @@ type repairCommand struct {
 }
 
 func main() {
-	configPath, showVersion, loginEmail, healthURL, repair, err := parseCommandLine(os.Args[1:], os.Stderr)
+	showVersion, loginEmail, healthURL, derivedProbe, repair, err := parseCommandLine(os.Args[1:], os.Stderr)
 	if errors.Is(err, flag.ErrHelp) {
 		return
 	}
@@ -69,8 +73,15 @@ func main() {
 		fmt.Println(version)
 		return
 	}
-	if healthURL != "" {
-		if err := checkHealth(healthURL); err != nil {
+	if derivedProbe {
+		healthURL, err = healthcheckURL(os.Getenv("FANOUT_ADDR"), os.Getenv("FANOUT_TLS_CERT_FILE"))
+		if err != nil {
+			fmt.Fprintln(os.Stderr, err)
+			os.Exit(2)
+		}
+	}
+	if healthURL != "" || derivedProbe {
+		if err := checkHealth(healthURL, derivedProbe, os.Getenv("FANOUT_TLS_CERT_FILE")); err != nil {
 			fmt.Fprintln(os.Stderr, err)
 			os.Exit(1)
 		}
@@ -79,7 +90,7 @@ func main() {
 
 	slog.SetDefault(slog.New(slog.NewJSONHandler(os.Stderr, nil)))
 
-	cfg, err := config.Load(config.LoadOptions{Path: configPath})
+	cfg, err := config.Load(config.LoadOptions{})
 	if err != nil {
 		slog.Error("invalid configuration", "err", err)
 		os.Exit(1)
@@ -359,7 +370,7 @@ func main() {
 		slog.Info("browser MCP server enabled", "path", "/api/mcp", "auth", "session")
 	}
 	if cfg.AgentConfigured() {
-		provider, err := agent.NewProvider(cfg.AIProvider, cfg.AIAPIKey, cfg.AIModel, cfg.AIBaseURL)
+		provider, err := agent.NewProvider(cfg.AIProvider, cfg.AIAPIKey(), cfg.AIModel, cfg.AIBaseURL())
 		if err != nil {
 			slog.Error("agent provider init failed", "err", err)
 			os.Exit(1)
@@ -373,7 +384,7 @@ func main() {
 		agent.NewRuntime(provider, toolRegistry, agent.NewStore(sqlite.DB)).Register(e.Group("/api/agent", api.RequireCapability(api.RunAgent)))
 		slog.Info("AG-UI agent enabled", "path", "/api/agent/runs", "provider", cfg.AIProvider)
 	} else {
-		slog.Info("AG-UI agent disabled", "reason", "ai.api_key is not configured")
+		slog.Info("AG-UI agent disabled", "reason", "FANOUT_AI_PROVIDER is not selected")
 	}
 
 	// The compiled browser client is an embedded asset, not a second runtime.
@@ -423,15 +434,15 @@ func main() {
 	}
 }
 
-func parseCommandLine(args []string, output io.Writer) (configPath string, showVersion bool, loginEmail, healthURL string, repair *repairCommand, err error) {
+func parseCommandLine(args []string, output io.Writer) (showVersion bool, loginEmail, healthURL string, derivedProbe bool, repair *repairCommand, err error) {
 	if len(args) == 1 && args[0] == "version" {
-		return "", true, "", "", nil, nil
+		return true, "", "", false, nil, nil
 	}
 	if len(args) >= 1 && len(args) <= 2 && args[0] == "healthcheck" {
 		if len(args) == 2 {
-			return "", false, "", args[1], nil, nil
+			return false, "", args[1], false, nil, nil
 		}
-		return "", false, "", "http://127.0.0.1:7520/healthz", nil, nil
+		return false, "", "", true, nil, nil
 	}
 
 	flags := flag.NewFlagSet("fanout", flag.ContinueOnError)
@@ -439,34 +450,33 @@ func parseCommandLine(args []string, output io.Writer) (configPath string, showV
 	flags.Usage = func() {
 		fmt.Fprintln(output, "Usage of fanout:")
 		fmt.Fprintln(output, "  fanout [flags]")
-		fmt.Fprintln(output, "  fanout [--config path] login-link <email>")
-		fmt.Fprintln(output, "  fanout [--config path] repair verify")
-		fmt.Fprintln(output, "  fanout [--config path] repair quarantine --batch <id>")
+		fmt.Fprintln(output, "  fanout login-link <email>")
+		fmt.Fprintln(output, "  fanout repair verify")
+		fmt.Fprintln(output, "  fanout repair quarantine --batch <id>")
 		fmt.Fprintln(output, "  fanout healthcheck [url]")
 		fmt.Fprintln(output, "  fanout version")
 		fmt.Fprintln(output, "Flags:")
 		flags.PrintDefaults()
 	}
-	flags.StringVar(&configPath, "config", "", "path to a Fanout YAML configuration file")
 	flags.BoolVar(&showVersion, "version", false, "print the Fanout version")
 	flags.BoolVar(&showVersion, "v", false, "print the Fanout version")
 	if err := flags.Parse(args); err != nil {
-		return "", false, "", "", nil, err
+		return false, "", "", false, nil, err
 	}
 	if flags.NArg() == 2 && flags.Arg(0) == "login-link" {
-		return configPath, false, flags.Arg(1), "", nil, nil
+		return false, flags.Arg(1), "", false, nil, nil
 	}
 	if flags.NArg() > 0 && flags.Arg(0) == "repair" {
 		repair, err := parseRepairCommand(flags.Args()[1:], output)
-		return configPath, false, "", "", repair, err
+		return false, "", "", false, repair, err
 	}
 	if flags.NArg() != 0 {
 		err := fmt.Errorf("unexpected arguments: %s", strings.Join(flags.Args(), " "))
 		fmt.Fprintln(output, err)
 		flags.Usage()
-		return "", false, "", "", nil, err
+		return false, "", "", false, nil, err
 	}
-	return configPath, showVersion, "", "", nil, nil
+	return showVersion, "", "", false, nil, nil
 }
 
 func parseRepairCommand(args []string, output io.Writer) (*repairCommand, error) {
@@ -518,8 +528,73 @@ func runRepair(root string, command repairCommand, output io.Writer) error {
 	}
 }
 
-func checkHealth(healthURL string) error {
+func healthcheckURL(addr, certFile string) (string, error) {
+	if addr == "" {
+		addr = config.DefaultAddr
+	}
+	host, port, err := net.SplitHostPort(addr)
+	if err != nil {
+		return "", fmt.Errorf("FANOUT_ADDR must be a host:port address: %w", err)
+	}
+	if host == "" {
+		host = "127.0.0.1"
+	}
+	if ip := net.ParseIP(host); ip != nil && ip.IsUnspecified() {
+		host = "127.0.0.1"
+	}
+	scheme := "http"
+	if certFile != "" {
+		scheme = "https"
+	}
+	return (&url.URL{Scheme: scheme, Host: net.JoinHostPort(host, port), Path: "/healthz"}).String(), nil
+}
+
+func checkHealth(healthURL string, derivedProbe bool, certFile string) error {
 	client := &http.Client{Timeout: 3 * time.Second}
+	if derivedProbe {
+		// Derived probes bypass proxies. HTTPS IP literals trust only the configured
+		// certificate and verify its first DNS or IP SAN instead of the bind IP.
+		// Hostnames verify normally; explicit URLs retain all default behaviour.
+		probe, err := url.Parse(healthURL)
+		if err != nil {
+			return fmt.Errorf("healthcheck: %w", err)
+		}
+		transport := http.DefaultTransport.(*http.Transport).Clone()
+		transport.Proxy = nil
+		if _, err := netip.ParseAddr(probe.Hostname()); probe.Scheme == "https" && err == nil {
+			data, err := os.ReadFile(certFile)
+			if err != nil {
+				return fmt.Errorf("healthcheck: read certificate %q: %w", certFile, err)
+			}
+			var block *pem.Block
+			for len(data) > 0 {
+				block, data = pem.Decode(data)
+				if block == nil || block.Type == "CERTIFICATE" {
+					break
+				}
+			}
+			if block == nil || block.Type != "CERTIFICATE" {
+				return fmt.Errorf("healthcheck: no certificate in %q", certFile)
+			}
+			leaf, err := x509.ParseCertificate(block.Bytes)
+			if err != nil {
+				return fmt.Errorf("healthcheck: parse certificate %q: %w", certFile, err)
+			}
+			var serverName string
+			if len(leaf.DNSNames) > 0 {
+				serverName = leaf.DNSNames[0]
+			} else if len(leaf.IPAddresses) > 0 {
+				serverName = leaf.IPAddresses[0].String()
+			} else {
+				return fmt.Errorf("healthcheck: certificate %q has no DNS or IP SAN", certFile)
+			}
+			roots := x509.NewCertPool()
+			roots.AddCert(leaf)
+			transport.TLSClientConfig = &tls.Config{RootCAs: roots, ServerName: serverName}
+		}
+		defer transport.CloseIdleConnections()
+		client.Transport = transport
+	}
 	response, err := client.Get(healthURL)
 	if err != nil {
 		return fmt.Errorf("healthcheck: %w", err)
diff --git a/cmd/fanout/main_test.go b/cmd/fanout/main_test.go
index 3fa98739..ce518c6f 100644
--- a/cmd/fanout/main_test.go
+++ b/cmd/fanout/main_test.go
@@ -3,16 +3,26 @@ package main
 import (
 	"bytes"
 	"context"
+	"crypto/ecdsa"
+	"crypto/elliptic"
+	"crypto/rand"
+	"crypto/tls"
+	"crypto/x509"
+	"encoding/pem"
 	"errors"
 	"flag"
 	"io"
+	"math/big"
+	"net"
 	"net/http"
 	"net/http/httptest"
 	"net/url"
 	"os"
+	"os/exec"
 	"path/filepath"
 	"strings"
 	"testing"
+	"time"
 
 	"github.com/labstack/fanout/internal/auth"
 	"github.com/labstack/fanout/internal/config"
@@ -22,27 +32,28 @@ import (
 )
 
 func TestParseCommandLine(t *testing.T) {
+	t.Setenv("FANOUT_ADDR", "invalid")
+	t.Setenv("FANOUT_TLS_CERT_FILE", "cert.pem")
+	t.Setenv("FANOUT_AUTH_CODE_SECRET_FILE", "/missing")
 	tests := []struct {
 		name        string
 		args        []string
-		wantPath    string
 		wantVersion bool
 		wantEmail   string
 		wantHealth  string
+		wantDerived bool
 		wantRepair  *repairCommand
 		wantErr     bool
 	}{
 		{name: "server defaults", args: nil},
-		{name: "config", args: []string{"--config", "/etc/fanout.yaml"}, wantPath: "/etc/fanout.yaml"},
 		{name: "version command", args: []string{"version"}, wantVersion: true},
 		{name: "version flag", args: []string{"--version"}, wantVersion: true},
 		{name: "short version flag", args: []string{"-v"}, wantVersion: true},
 		{name: "login link", args: []string{"login-link", "admin@example.com"}, wantEmail: "admin@example.com"},
-		{name: "login link with config", args: []string{"--config", "/etc/fanout.yaml", "login-link", "admin@example.com"}, wantPath: "/etc/fanout.yaml", wantEmail: "admin@example.com"},
-		{name: "default healthcheck", args: []string{"healthcheck"}, wantHealth: "http://127.0.0.1:7520/healthz"},
+		{name: "default healthcheck", args: []string{"healthcheck"}, wantDerived: true},
 		{name: "custom healthcheck", args: []string{"healthcheck", "http://fanout:8080/healthz"}, wantHealth: "http://fanout:8080/healthz"},
 		{name: "repair verify", args: []string{"repair", "verify"}, wantRepair: &repairCommand{action: "verify"}},
-		{name: "repair quarantine with config", args: []string{"--config", "/etc/fanout.yaml", "repair", "quarantine", "--batch", "broken"}, wantPath: "/etc/fanout.yaml", wantRepair: &repairCommand{action: "quarantine", batch: "broken"}},
+		{name: "repair quarantine", args: []string{"repair", "quarantine", "--batch", "broken"}, wantRepair: &repairCommand{action: "quarantine", batch: "broken"}},
 		{name: "repair quarantine missing batch", args: []string{"repair", "quarantine"}, wantErr: true},
 		{name: "unknown repair action", args: []string{"repair", "delete"}, wantErr: true},
 		{name: "login link missing email", args: []string{"login-link"}, wantErr: true},
@@ -51,12 +62,12 @@ func TestParseCommandLine(t *testing.T) {
 
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
-			path, showVersion, email, healthURL, repair, err := parseCommandLine(test.args, io.Discard)
+			showVersion, email, healthURL, derivedProbe, repair, err := parseCommandLine(test.args, io.Discard)
 			if (err != nil) != test.wantErr {
 				t.Fatalf("error = %v, wantErr %v", err, test.wantErr)
 			}
-			if path != test.wantPath || showVersion != test.wantVersion || email != test.wantEmail || healthURL != test.wantHealth {
-				t.Fatalf("result = (%q, %v, %q, %q), want (%q, %v, %q, %q)", path, showVersion, email, healthURL, test.wantPath, test.wantVersion, test.wantEmail, test.wantHealth)
+			if showVersion != test.wantVersion || email != test.wantEmail || healthURL != test.wantHealth || derivedProbe != test.wantDerived {
+				t.Fatalf("result = (%v, %q, %q, %v), want (%v, %q, %q, %v)", showVersion, email, healthURL, derivedProbe, test.wantVersion, test.wantEmail, test.wantHealth, test.wantDerived)
 			}
 			if repair == nil != (test.wantRepair == nil) || repair != nil && *repair != *test.wantRepair {
 				t.Fatalf("repair = %#v, want %#v", repair, test.wantRepair)
@@ -110,7 +121,7 @@ func TestCheckHealth(t *testing.T) {
 				writer.WriteHeader(test.statusCode)
 			}))
 			defer server.Close()
-			if err := checkHealth(server.URL); (err != nil) != test.wantErr {
+			if err := checkHealth(server.URL, false, ""); (err != nil) != test.wantErr {
 				t.Fatalf("checkHealth() error = %v, wantErr %v", err, test.wantErr)
 			}
 		})
@@ -205,3 +216,305 @@ func TestCreateLoginLink(t *testing.T) {
 		t.Fatalf("issued audit events = %d, want 1", events)
 	}
 }
+
+func TestHealthcheckURL(t *testing.T) {
+	for _, tc := range []struct{ addr, cert, want string }{
+		{"", "", "http://127.0.0.1:7520/healthz"},
+		{":8080", "", "http://127.0.0.1:8080/healthz"},
+		{"0.0.0.0:8080", "", "http://127.0.0.1:8080/healthz"},
+		{"[::]:8080", "", "http://127.0.0.1:8080/healthz"},
+		{"[::1]:8080", "", "http://[::1]:8080/healthz"},
+		{"[2001:db8::1]:8080", "", "http://[2001:db8::1]:8080/healthz"},
+		{"127.0.0.1:9000", "cert.pem", "https://127.0.0.1:9000/healthz"},
+		{"localhost:9000", "", "http://localhost:9000/healthz"},
+		{"example.com:9000", "", "http://example.com:9000/healthz"},
+	} {
+		got, err := healthcheckURL(tc.addr, tc.cert)
+		if err != nil || got != tc.want {
+			t.Fatalf("healthcheckURL(%q) = %q, %v; want %q", tc.addr, got, err, tc.want)
+		}
+	}
+	if _, err := healthcheckURL("invalid", ""); err == nil {
+		t.Fatal("expected invalid address error")
+	}
+}
+
+func TestHealthcheckUsesEnvironmentWithoutValidatingSecrets(t *testing.T) {
+	t.Setenv("FANOUT_ADDR", "[::]:9090")
+	t.Setenv("FANOUT_TLS_CERT_FILE", "cert.pem")
+	t.Setenv("FANOUT_AUTH_CODE_SECRET_FILE", "/missing")
+	probe, err := healthcheckURL(os.Getenv("FANOUT_ADDR"), os.Getenv("FANOUT_TLS_CERT_FILE"))
+	if err != nil || probe != "https://127.0.0.1:9090/healthz" {
+		t.Fatalf("probe = %s, %v", probe, err)
+	}
+}
+
+func TestCheckHealthWithLocalTLS(t *testing.T) {
+	server := httptest.NewTLSServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) { w.WriteHeader(http.StatusOK) }))
+	defer server.Close()
+	certFile := writeHealthcheckCertificate(t, server.Certificate().Raw)
+	if err := checkHealth(server.URL+"/healthz", true, certFile); err != nil {
+		t.Fatal(err)
+	}
+	var verificationError *tls.CertificateVerificationError
+	if err := checkHealth(server.URL+"/healthz", false, certFile); !errors.As(err, &verificationError) {
+		t.Fatalf("explicit URL must verify the certificate, got %v", err)
+	}
+	other := *server.Certificate()
+	other.SerialNumber = big.NewInt(2)
+	other.SignatureAlgorithm = x509.UnknownSignatureAlgorithm
+	other.PublicKey = nil
+	otherCertificate := newHealthcheckCertificate(t, &other)
+	otherFile := writeHealthcheckCertificate(t, otherCertificate.Certificate[0])
+	// Only the first certificate is trusted, even when the listener's leaf follows it.
+	chain := append(pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: otherCertificate.Certificate[0]}),
+		pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: server.Certificate().Raw})...)
+	if err := os.WriteFile(otherFile, chain, 0o600); err != nil {
+		t.Fatal(err)
+	}
+	if err := checkHealth(server.URL+"/healthz", true, otherFile); !errors.As(err, &verificationError) {
+		t.Fatalf("derived IP probe must reject a different certificate, got %v", err)
+	}
+	probe := strings.Replace(server.URL, "127.0.0.1", "localhost", 1) + "/healthz"
+	if err := checkHealth(probe, true, certFile); !errors.As(err, &verificationError) {
+		t.Fatalf("derived hostname probe must verify the certificate, got %v", err)
+	}
+}
+
+func writeHealthcheckCertificate(t *testing.T, der []byte) string {
+	t.Helper()
+	path := filepath.Join(t.TempDir(), "cert.pem")
+	if err := os.WriteFile(path, pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: der}), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	return path
+}
+
+func newHealthcheckCertificate(t *testing.T, certificate *x509.Certificate) tls.Certificate {
+	t.Helper()
+	key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+	if err != nil {
+		t.Fatal(err)
+	}
+	der, err := x509.CreateCertificate(rand.Reader, certificate, certificate, &key.PublicKey, key)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return tls.Certificate{Certificate: [][]byte{der}, PrivateKey: key}
+}
+
+func TestCheckHealthCertificateFileErrors(t *testing.T) {
+	const contents = "private file contents must not appear in errors"
+	for _, test := range []struct {
+		name string
+		data []byte
+	}{
+		{name: "unreadable"},
+		{name: "non-certificate", data: []byte(contents)},
+		{name: "other PEM block", data: pem.EncodeToMemory(&pem.Block{Type: "PRIVATE KEY", Bytes: []byte(contents)})},
+		{name: "invalid certificate", data: pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: []byte(contents)})},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			path := filepath.Join(t.TempDir(), "cert.pem")
+			if test.data != nil {
+				if err := os.WriteFile(path, test.data, 0o600); err != nil {
+					t.Fatal(err)
+				}
+			}
+			err := checkHealth("https://127.0.0.1:7520/healthz", true, path)
+			if err == nil || !strings.HasPrefix(err.Error(), "healthcheck:") || !strings.Contains(err.Error(), path) || strings.Contains(err.Error(), contents) {
+				t.Fatalf("certificate file error must name its path without contents, got %v", err)
+			}
+		})
+	}
+}
+
+func TestCheckHealthTLSCertificate(t *testing.T) {
+	for _, test := range []struct {
+		name       string
+		dnsNames   []string
+		ips        []net.IP
+		expired    bool
+		clientOnly bool
+		wantErr    bool
+	}{
+		{name: "IP SAN", ips: []net.IP{net.ParseIP("192.0.2.10")}},
+		{name: "DNS before IP SAN", dnsNames: []string{"fanout.example.com", "other.example.com"}, ips: []net.IP{net.ParseIP("192.0.2.10")}},
+		{name: "no SAN", wantErr: true},
+		{name: "expired", dnsNames: []string{"fanout.example.com"}, expired: true, wantErr: true},
+		{name: "client usage", dnsNames: []string{"fanout.example.com"}, clientOnly: true, wantErr: true},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			certificate := &x509.Certificate{
+				SerialNumber: big.NewInt(1), DNSNames: test.dnsNames, IPAddresses: test.ips,
+				NotBefore: time.Now().Add(-time.Hour), NotAfter: time.Now().Add(time.Hour),
+				KeyUsage: x509.KeyUsageDigitalSignature, ExtKeyUsage: []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
+			}
+			if test.expired {
+				certificate.NotAfter = time.Now().Add(-time.Minute)
+			}
+			if test.clientOnly {
+				certificate.ExtKeyUsage = []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth}
+			}
+			server := httptest.NewUnstartedServer(http.HandlerFunc(func(w http.ResponseWriter, request *http.Request) {
+				if len(test.dnsNames) > 0 && request.TLS.ServerName != test.dnsNames[0] {
+					t.Errorf("TLS server name = %q, want %q", request.TLS.ServerName, test.dnsNames[0])
+				}
+				w.WriteHeader(http.StatusOK)
+			}))
+			server.TLS = &tls.Config{Certificates: []tls.Certificate{newHealthcheckCertificate(t, certificate)}}
+			server.StartTLS()
+			defer server.Close()
+			certFile := writeHealthcheckCertificate(t, server.Certificate().Raw)
+			err := checkHealth(server.URL+"/healthz", true, certFile)
+			if (err != nil) != test.wantErr {
+				t.Fatalf("checkHealth() error = %v, wantErr %v", err, test.wantErr)
+			}
+			if test.name == "no SAN" && (!strings.HasPrefix(err.Error(), "healthcheck:") || !strings.Contains(err.Error(), certFile)) {
+				t.Fatalf("missing SAN error must name the certificate path, got %v", err)
+			}
+		})
+	}
+}
+
+func TestCheckHealthWithInterfaceTLS(t *testing.T) {
+	certificate := &x509.Certificate{
+		SerialNumber: big.NewInt(1), DNSNames: []string{"fanout.example.com"},
+		NotBefore: time.Now().Add(-time.Hour), NotAfter: time.Now().Add(time.Hour),
+		KeyUsage: x509.KeyUsageDigitalSignature, ExtKeyUsage: []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
+	}
+	server := httptest.NewUnstartedServer(http.HandlerFunc(func(w http.ResponseWriter, request *http.Request) {
+		if request.URL.Path != "/healthz" {
+			t.Errorf("probe path = %q, want /healthz", request.URL.Path)
+		}
+		w.WriteHeader(http.StatusOK)
+	}))
+	server.TLS = &tls.Config{Certificates: []tls.Certificate{newHealthcheckCertificate(t, certificate)}}
+	server.StartTLS()
+	defer server.Close()
+	certFile := writeHealthcheckCertificate(t, server.Certificate().Raw)
+	for _, addr := range []string{"192.0.2.10:7520", "[2001:db8::10]:7520", "[fe80::1%eth0]:7520", "fanout.example.com:7520", "wrong.example.com:7520"} {
+		t.Run(addr, func(t *testing.T) {
+			original := http.DefaultTransport
+			transport := original.(*http.Transport).Clone()
+			// Route binds to a local test listener to exercise real TLS without
+			// requiring those addresses or DNS entries on the test host.
+			transport.DialContext = func(ctx context.Context, network, address string) (net.Conn, error) {
+				if address != addr {
+					t.Errorf("probe address = %q, want %q", address, addr)
+				}
+				var dialer net.Dialer
+				return dialer.DialContext(ctx, network, server.Listener.Addr().String())
+			}
+			http.DefaultTransport = transport
+			t.Cleanup(func() {
+				http.DefaultTransport = original
+				transport.CloseIdleConnections()
+			})
+			t.Setenv("FANOUT_ADDR", addr)
+			t.Setenv("FANOUT_TLS_CERT_FILE", certFile)
+			probe, err := healthcheckURL(os.Getenv("FANOUT_ADDR"), os.Getenv("FANOUT_TLS_CERT_FILE"))
+			if err != nil {
+				t.Fatal(err)
+			}
+			err = checkHealth(probe, true, certFile)
+			var verificationError *tls.CertificateVerificationError
+			if strings.HasSuffix(addr, "example.com:7520") {
+				if !errors.As(err, &verificationError) {
+					t.Fatalf("derived hostname probe must use system verification, got %v", err)
+				}
+			} else if err != nil {
+				t.Fatalf("derived TLS probe: %v", err)
+			}
+			_, _, explicitProbe, derivedProbe, _, err := parseCommandLine([]string{"healthcheck", probe}, io.Discard)
+			if err != nil {
+				t.Fatal(err)
+			}
+			err = checkHealth(explicitProbe, derivedProbe, certFile)
+			if !errors.As(err, &verificationError) {
+				t.Fatalf("explicit TLS probe must use system verification, got %v", err)
+			}
+		})
+	}
+}
+
+func TestCheckHealthDerivedIgnoresEnvironmentProxy(t *testing.T) {
+	// ProxyFromEnvironment caches settings on first use, so use a fresh process
+	// to ensure earlier tests cannot hide the configured proxies.
+	if os.Getenv("FANOUT_TEST_PROXY_CHILD") != "1" {
+		listener, err := net.Listen("tcp", "127.0.0.1:0")
+		if err != nil {
+			t.Fatal(err)
+		}
+		proxy := "http://" + listener.Addr().String()
+		if err := listener.Close(); err != nil {
+			t.Fatal(err)
+		}
+		t.Setenv("HTTP_PROXY", proxy)
+		t.Setenv("HTTPS_PROXY", proxy)
+		t.Setenv("NO_PROXY", "")
+		t.Setenv("no_proxy", "")
+		t.Setenv("REQUEST_METHOD", "")
+		t.Setenv("FANOUT_TEST_PROXY_CHILD", "1")
+		command := exec.Command(os.Args[0], "-test.run=^TestCheckHealthDerivedIgnoresEnvironmentProxy$", "-test.v")
+		if output, err := command.CombinedOutput(); err != nil {
+			t.Fatalf("proxy regression subprocess: %v\n%s", err, output)
+		}
+		return
+	}
+	for _, tc := range []struct{ scheme, addr string }{
+		{"http", "192.0.2.10:7520"}, {"https", "192.0.2.10:7520"},
+		{"http", "fanout.example.com:7520"}, {"https", "example.com:7520"},
+	} {
+		t.Run(tc.scheme+"/"+tc.addr, func(t *testing.T) {
+			scheme, addr := tc.scheme, tc.addr
+			server := httptest.NewUnstartedServer(http.HandlerFunc(func(w http.ResponseWriter, request *http.Request) {
+				if request.URL.Path != "/healthz" {
+					t.Errorf("probe path = %q, want /healthz", request.URL.Path)
+				}
+				w.WriteHeader(http.StatusOK)
+			}))
+			certFile := ""
+			if scheme == "https" {
+				server.StartTLS()
+				certFile = writeHealthcheckCertificate(t, server.Certificate().Raw)
+			} else {
+				server.Start()
+			}
+			defer server.Close()
+			original := http.DefaultTransport
+			transport := original.(*http.Transport).Clone()
+			if scheme == "https" && addr == "example.com:7520" {
+				roots := x509.NewCertPool()
+				roots.AddCert(server.Certificate())
+				transport.TLSClientConfig = &tls.Config{RootCAs: roots}
+			}
+			transport.DialContext = func(ctx context.Context, network, address string) (net.Conn, error) {
+				if address == addr {
+					address = server.Listener.Addr().String()
+				} else if "http://"+address != os.Getenv("HTTP_PROXY") {
+					return nil, errors.New("unexpected dial address: " + address)
+				}
+				var dialer net.Dialer
+				return dialer.DialContext(ctx, network, address)
+			}
+			http.DefaultTransport = transport
+			t.Cleanup(func() {
+				http.DefaultTransport = original
+				transport.CloseIdleConnections()
+			})
+			t.Setenv("FANOUT_ADDR", addr)
+			t.Setenv("FANOUT_TLS_CERT_FILE", certFile)
+			probe, err := healthcheckURL(os.Getenv("FANOUT_ADDR"), os.Getenv("FANOUT_TLS_CERT_FILE"))
+			if err != nil {
+				t.Fatal(err)
+			}
+			if err := checkHealth(probe, true, certFile); err != nil {
+				t.Fatalf("derived %s probe with unreachable proxy: %v", scheme, err)
+			}
+			if err := checkHealth(probe, false, certFile); err == nil || !strings.Contains(err.Error(), strings.TrimPrefix(os.Getenv("HTTP_PROXY"), "http://")) {
+				t.Fatalf("explicit %s probe must use the unreachable proxy, got %v", scheme, err)
+			}
+		})
+	}
+}
diff --git a/context7.json b/context7.json
index fe906ee4..69a99477 100644
--- a/context7.json
+++ b/context7.json
@@ -15,6 +15,6 @@
     "Telemetry arrives over OTLP/gRPC or OTLP/HTTP on port 7520. Point an OpenTelemetry SDK or Collector at it; do not invent a bespoke ingest protocol.",
     "Parquet is the authoritative telemetry store. DuckDB query state and rollups are rebuildable from it, and SQLite is reserved for transactional product state.",
     "Fanout exposes an MCP server, and the browser client, the in-process agent and any external MCP host all reach the same typed observability contract rather than issuing raw SQL.",
-    "Configuration is by `FANOUT_*` environment variables or a YAML file; see fanout.example.yaml. The Go module path is `github.com/labstack/fanout`."
+    "Configuration uses process environment over built-in defaults; see .env.example. Custom names use `FANOUT_`; AI keys and endpoints use documented vendor names. Secret variables also accept `_FILE` paths. The Go module path is `github.com/labstack/fanout`."
   ]
 }
diff --git a/docs/authentication.md b/docs/authentication.md
index 4dd4ea40..9308ab86 100644
--- a/docs/authentication.md
+++ b/docs/authentication.md
@@ -1,8 +1,7 @@
 # Authentication and access operations
 
-Operator reference for running Fanout's authentication safely. Every setting
-below is available as an environment variable and as a key in the layered
-configuration file.
+Operator reference for running Fanout's authentication safely. Settings are
+environment variables; see the [settings reference](https://fanout.run/reference/configuration).
 
 ## First run
 
@@ -55,10 +54,10 @@ login link remains available when delivery fails.
 ### Local self-signup
 
 Local accounts are invitation-only by default. To let any verified email
-address create an account, enable `auth.self_signup` or
-`FANOUT_SELF_SIGNUP=true`. Fanout sends the existing email code and
-creates an active `viewer` only after that code is successfully verified. The
-role is fixed: self-signup can never create an operator or administrator.
+address create an account, set `FANOUT_SELF_SIGNUP=true`. Fanout sends the
+existing email code and creates an active `viewer` only after that code is
+successfully verified. The role is fixed: self-signup can never create an
+operator or administrator.
 The setting requires complete SMTP configuration and local auth mode.
 
 Self-signup remains unavailable until the first administrator completes setup.
@@ -72,13 +71,13 @@ If you are locked out in local mode, run the command with the same configuration
 and data directory as the server:
 
 ```sh
-fanout --config /etc/fanout/fanout.yaml login-link admin@example.com
+fanout login-link admin@example.com
 ```
 
-For a container using the bundled configuration:
+For a running container:
 
 ```sh
-docker exec <container> fanout --config /etc/fanout/fanout.yaml \
+docker exec <container> fanout \
   login-link admin@example.com
 ```
 
@@ -167,19 +166,17 @@ asserts a verified email. This keeps sessions, conversations, dashboards, and
 audit attribution isolated without shared credentials or an anonymous
 authorization bypass:
 
-```yaml
-auth:
-  mode: oidc
-  oidc:
-    email_verification: required
-    auto_provision: true
-    allowed_domains: "*"
-    default_role: viewer
+```sh
+FANOUT_AUTH_MODE=oidc
+FANOUT_OIDC_EMAIL_VERIFICATION=required
+FANOUT_OIDC_AUTO_PROVISION=true
+FANOUT_OIDC_ALLOWED_DOMAINS="*"
+FANOUT_OIDC_DEFAULT_ROLE=viewer
 ```
 
 The wildcard is deliberately explicit and is rejected with
-`email_verification: issuer`. Use a specific domain or group allowlist for a
-private installation. A wildcard makes the installation available to every
+`FANOUT_OIDC_EMAIL_VERIFICATION=issuer`. Use a specific domain or group allowlist
+for a private installation. A wildcard makes the installation available to every
 identity accepted by the configured provider, so rate-limit public traffic and
 budget AI usage at the deployment edge.
 
diff --git a/docs/diagrams/architecture.d2 b/docs/diagrams/architecture.d2
index 1aa4d40f..0d8c5fbd 100644
--- a/docs/diagrams/architecture.d2
+++ b/docs/diagrams/architecture.d2
@@ -44,9 +44,9 @@ fanout: "fanout — one Go process" {
 
 store: Storage {
   style.fill: transparent
-  telemetry: "Parquet batches + trace indexes\nstorage.data_dir/telemetry" {shape: cylinder}
-  qstate: "DuckDB query state\nstorage.data_dir/query" {shape: cylinder}
-  control: "Control SQLite\nstorage.data_dir/control" {shape: cylinder}
+  telemetry: "Parquet batches + trace indexes\nFANOUT_DATA_DIR/telemetry" {shape: cylinder}
+  qstate: "DuckDB query state\nFANOUT_DATA_DIR/query" {shape: cylinder}
+  control: "Control SQLite\nFANOUT_DATA_DIR/control" {shape: cylinder}
 }
 
 model: "Anthropic or OpenAI" {style.stroke-dash: 3}
diff --git a/docs/diagrams/architecture.svg b/docs/diagrams/architecture.svg
index 01633b3e..18433e2a 100644
--- a/docs/diagrams/architecture.svg
+++ b/docs/diagrams/architecture.svg
@@ -1,24 +1,24 @@
-<?xml version="1.0" encoding="utf-8"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" data-d2-version="v0.7.1-HEAD" preserveAspectRatio="xMinYMin meet" viewBox="0 0 2211 1635"><svg class="d2-625626608 d2-svg" width="2211" height="1635" viewBox="-101 -121 2211 1635"><rect x="-101.000000" y="-121.000000" width="2211.000000" height="1635.000000" rx="0.000000" fill="#FFFFFF" class=" fill-N7" stroke-width="0" /><style type="text/css"><![CDATA[
-.d2-625626608 .text {
-	font-family: "d2-625626608-font-regular";
+<?xml version="1.0" encoding="utf-8"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" data-d2-version="v0.7.1-HEAD" preserveAspectRatio="xMinYMin meet" viewBox="0 0 2220 1635"><svg class="d2-37886755 d2-svg" width="2220" height="1635" viewBox="-101 -121 2220 1635"><rect x="-101.000000" y="-121.000000" width="2220.000000" height="1635.000000" rx="0.000000" fill="#FFFFFF" class=" fill-N7" stroke-width="0" /><style type="text/css"><![CDATA[
+.d2-37886755 .text {
+	font-family: "d2-37886755-font-regular";
 }
 @font-face {
-	font-family: d2-625626608-font-regular;
-	src: url("data:application/font-woff;base64,d09GRgABAAAAABNoAAoAAAAAHTgAAguFAAAAAAAAAAAAAAAAAAAAAAAAAABPUy8yAAAA9AAAAGAAAABgXd/Vo2NtYXAAAAFUAAAAxgAAAS4G2ygtZ2x5ZgAAAhwAAAxAAAAQ6FHrM5doZWFkAAAOXAAAADYAAAA2G4Ue32hoZWEAAA6UAAAAJAAAACQKhAX9aG10eAAADrgAAADJAAAA7HCLDEJsb2NhAAAPhAAAAHgAAAB4hFCIfm1heHAAAA/8AAAAIAAAACAAUwD2bmFtZQAAEBwAAAMrAAAIFAbDVU1wb3N0AAATSAAAACAAAAAg/9EAMgADAgkBkAAFAAACigJYAAAASwKKAlgAAAFeADIBIwAAAgsFAwMEAwICBGAAAvcAAAADAAAAAAAAAABBREJPAEAAIP//Au7/BgAAA9gBESAAAZ8AAAAAAeYClAAAACAAA3icjM7JLkMBHMXh72pRtMaap9uaSs1Uxc5CRESsrBtL8QRei73hKWx5jCL5i7uS2MjZ/pLvIJGToCifVFGTyitI1a3bsGnLtl0NTUdOnLlwpeXGXVqO4E+5n5XHTp271HLt9qeMdyVduuUU4is+4yPa0Y6XeI6neIzXeIj7t0r25X9LHGbajuYvf0+HnLzOzCro0atPUUm/AYOGDBtxoGzUmHETJk2ZNmPWnHmpiqoFi5YsW1Gzak1dg28AAAD//wMAoQMtFAAAeJx0V2twG9d5/e4FiCUJ8LECFkuAAIHdJbHEiyCxWCxJgACJBwmR4AsgxZdIPUyJpGSpEtXIlUVTTRxLnsR1kcYeexzFURrPNG7jxp7MyPF4Op1ascvWsd3MtHVcp46bH4wndpqGZZq6MRedXYAUqWl/7c7O7r3nnO9859sLFTADgEX8BGigCurgEFAAAsmQLQzPc4QkSBJHayQekcQM+olcQOhwSBsOazsSHyeuXLuGptfxEzv3d39xaen1hQcekP9o8yM5iN7+CDBoALAdF6AKSAAjIfAuF8/pdBqjYOR4jnjT8brjkLNeW+f8lw8WPpiJ/SqOfm9xUTrX1XVOnsWFnQsbGwAAGpgFwM24ACRYgVOwCUGzmTLpCEq96DiNEAyLIRfHkbs3s3eSp7o6ApGh+IXB9RMTg8PDp1YnF+aPrOKCs7+7Y7ROqx9J9R7xoCvdwa72ne14oqcLABCEitu4Ed8EO0AF63KJoXBYCJppwuXiWJ2OMpnNQjAs0TodyuU+P5T9Yj561Oa3JjyxeSE4FwsMOtr4k4bxp8+eeTrX4Qzb2L7LudyVRCsb8gcBAKtcQrgAlYomKhPKpOP4PdzPPf3s15+cHLp06dKlIVx4/ubX/zL15bW1R1RsswDoA1wAvfIlQzGUQHEUQ82iB+X3Pv0UdeBC/9sD/z6wx8OFb4Lz/+Oh0BA5USB1OnT0yPXsyKNTqXlbmyURTJwUL65wvcYvv+tYKVMRmsLW5r7LubWvUIf+Ii1/wnjLeHBwF4/iGIHkSIaczaOOiQn5HVyQf4mMOxeQKL+5ix9ewAXFF8r7s3lc2LlQXieOC2AoPReQQBg5DUHN5jWIXHjrl/M/uIgL8svo8P/IZ9DkI/9QXgv9EBegorw3NZtHDlzYeVmhX17zIVxQ6iiQgtFspoVwWDIqCENhiSM0nIbnzGaKnF1cN9AGrYEyrJ0aqdRoQ2vSWkirIXBB/lM2zbJpFi3sXEArvrPeJ+XvoIknvWd98lNqLRWvnMI3oe4et6im5INhtaSsIrYZZXPXBgau5fLrmcx6PjLVfmZ6+kz7tGHimZWVp8bHn1pZeWbicPJK7sHHH38wdyUJe17Rq/qa9rme48i7Nn918Hzs+v33nzySnzqygAvNk5mlRfkzlOnrH5DKGOfwJXwTasAD0HIAUwXr4tvwfszEXXdn9zAizdyD9oH7oyX03cv99KRoZmvq64JdyasTCuCJq8kPZpLV039yvMRloTBj8PoqtL26qj0eTlyAWqD38VBqvJ/KW8nlyFjqzxaefeD8cC43fB4XuPFUdp6Uf4Yo+WM0E+/tCym6IPAUt9Gv8E3wq6rzkopaDLlc/F0+Zacr2tN0E1bYofr0ZW+QOyb0ZewdjgVHj1tciEQWOX/T4TYpyQSt866e5vCiQfR1t/gj7WyrrdZd40m0B0f9/uawnQn5HG6rvrXe39cRmgwCAhsA+gwXgFBYcSJDceTP3kAfvoEH+/t3bpewThW3cRsuKJmqOoQUyFKGhNVbnQ4lk2djeXfa6+t3j8XOGMJrK+jz8kOjcy7X3Ch6WL62shZW67iNXkJbYIVmAJpVgkkKqRQJXi0gRXI8p9PxwbAk6pT6vtYz/sdfI72tnkG7k72ve2YsRWjYcTMX466cCBoO941Nko5OzmnqMrvPzcn/3G3zJFjHjbpowN0CGHLFbfQ7vAHGcoLwHMGRAkWU9ir5W6kbq6YwcrOHnRoikcPMaOuxk5Fj/dHRSNrRyznjBsYexBuvTdv56xfzl2Pppdmx+1hn0UaX9GkrbqPvoi2wHeige3JKMeSh3uVo39lYe9rioQJ2X5rPJ9luczMzZoiujuVWoywdNjYEJjvzS3aTZGcU3wWK2+i9XQ4lzRT0NC8Ku2JJ4t5G/z13PnJC8sSc2nyK0Niylt6oo6uJj7v6DY9cGb0Ua7LmX93p7LK500nZRgfynVP3AVbx/z3aggZwHGCgGJzZaycNo0qF6L4zsfiiNH8KYfn7FVP9XKTR7hh9E2njXcK4oWd1dGw1trZcY6kaPkqRYVMTcg0Oj6o6NQGgOP5HxUeK1yQxVNaJYyllDpDHE4n0YdpTf6jRllpaQt+KVQwPTlURccPCcFKeV+eov+hEn6At6IAeGN5zkejad1EXFSiuPFhZXpVGKNdcs1tzymQ2lvuWdZXe+a+ZCy7mkIU1NvDBiQ5Tc83ziyTdPhbk2ZpDLR0Lk5PR81lPT9TrjfaE+yeEwEQtU29tGPowFXd0mbX6VpujrUZrSnnFEQ9REa8XHaGsm9Q3mugmqcefDaCX4qIYjYpiXH60x8VatVqjh+LbVG1yAOhdvFFOyV2PKkmvYCXIXE7DDQeHB3K+9pZIC954bZEJnJiXf4jcqZirRb4FxSKkAeB7+DZ2gfIfoIPuNdhbexNv7M0mozKbeILKjWvemfvWK7OPz+ENuQnBHflff3HmD8vfFLfhx3gD6koaK32+a4Tn29y52iotQegrzYYuEZ/eecJIIhTTaks88K/RFjDqXsrAUqpxgA2xd82lCI0z6+2M17lGfEOHc762cCrnC4RTaLOfC3T43KFdikPyrfJlVyu0Bab9e+zXKkVouJE9sdTFDmhV9vx/oC2og8b/c+7teQTVRZbi8aVI9HQ8fjoaHx6Ox0ZGyv0aXc2NrUZTS/mJ5eWJ/JLSr7migH6Htsr9ehed6kQXT1Nlz5UyRxGAGfUunIwc62STLH5AjZx4MxN7C3+v09Z642LucqzJOvkc0h3IHCUXBPTe7j4VoqQuv2d+SSA1+3MBXdfahzylcOhlcGXinb1geOuFaVurGg52e9vOMNLdTYZd7yygrfKfXolNOdlKQlsybjtdbzDVOZIWtDndFq7OaLXBmKz+9yKwFbfRw2hLmdz0wTmnjrl7plxpyP0otMC5nSlvezsjNLIJz8yof8TWagk727xN7Y1cyu8eNfA2ycL4HRaWrq5hRHdk1EmHjA0eG22n9DWM1MYnWtX9G4rbKI3PA132MSdKkqCGzZ6fPx7pyWSr0w8/zHhqmgz1poBhNoNqYhWPPpqUt/wdVdoYoVfXGipuo7fRJpju6QmyHMUfDmfy3nZXhFV0YbOGE/MoJL+bivFeNCNbs63tgJQeRH+LNqEGQNDs+6fTvPrdyaN6Wq/V09VHx7+DNuVPmjMcl2lGJtmq8ADAt9EmMPd8t28FTlM6mxCab9yYyFTWEtrK+qqhsWwVWamtrCMGRr6w2F9VV6WtrK9OoU3552ySZZMssuy7s6IKLtXSkubkzwBBLQB6EW2CBUCQeIEubyUJBM2Vz0EEUfuNr8706RtqtHqzPnLkq8/ODNRYa7U1DYaE/NFZo8dk8hjP/vo3F80+ivLSF1UdDcWAqkHjfk9I0gE5avFsvd1QX2mqcofr9Hcm79Nb9Fq9qXpq7GUykP6RTtuHKyL+ZvRz+T8dGZbJOFHNzlZ71q/0oK+4jV7HXwL9btVD5Rbc39efHj937vixc+eOdaZSnZ3ptOGFW9/89re/eeuFxLXHHrt69bHHrqlYmwHQD/CXlJQQxBgWQ/t/V0w6nRLUAtV6/Hp/tKc1ZQu0zsVmTic/l7V2Wl7pOP6VzwlSv98Z8IlLk9GrN0axdgCw0kvon/A6VClOkgRlcilSGkVGRAKpHIiWN7RIa7DWCvK/IfLo1NTWK9aMhfbRcujFMHpa/v3Eiwo2S3Eb/Q1eB+d+HXcRGhmKI+5G2i+yi0yrPdsZGR+MMQG7j0Lx35J0m12aCfecNISZsM0/mkwMmow2JAz8laHWO51OnwiWetineBavq56NYYkRGapWQ7yk44fj8mvoa12ZVpP2D/76+akBIfPIjWeUOY2gr7gN34dV0B+swEMWjrM0cJyBa7RznL2RU94NFI/AG7AKhwBoPhzmdSy375OkyduOsA43cM0WZ0v/n7cb463Ibmt0hPy9J0CZe+pe6H3MQwcAWgGdcgUEbngf1SGrclaTRIFyb74fjyv7ueGn+LeoofScodz47Z92dam+/AL6qPiK8pwWGcqAfrIuSYCgungcjeM31OdIQNVIH5V/c0tz+rNnSvqwsIzewT6Fq3ocFdWAoX58+3bf7dvLd2J37sTulLMUnkObu2fHXA5tKr1d/Ds8CBK+rXxP7iPe4HA0NDgceNBuaWhqarDY4X8BAAD//wMAR5WfdQABAAAAAguF9LN0U18PPPUAAwPoAAAAANhdoKEAAAAA3WYvNv46/tsIbwPIAAAAAwACAAAAAAAAAAEAAAPY/u8AAAiY/jr+OghvAAEAAAAAAAAAAAAAAAAAAAA7eJwsyr1KA1EcRPEzs4UgQbGRFUJYNM36kTSLImIhYqXVvxGvYCs+iJ329r6HdWxsLHwDW70gIakiu6Q6M/DzMzdMwBWFr0g+ofE9yeskP9D4iaQVks9J+ib5i+QXGh8ue0zyJrsu6fuRa81oXBOaMPIeY/0y0pCBZhy4IphyoR+CBVGcEt4hPOhsdP6W0Ct9BaUrLvVJzx+UemOt3crsKzNUZkOZrfYz54w547Y6oi4qav3R0x2rymwzJWDx/g8AAP//AwCOWy4dAAAAAAAALAAsAFAAhgC2ANQA6gEcATQBQAFaAWoBnAHMAe4CMAJYApwCrgLSAwoDPgNsA54D0gP0BGAEggSOBKgExAT2BRgFRAV4BawFzAYMBjIGVAZwBqoG1gcGBywHVgd6B64HyAfeB/4ICggWCCIILgg+CFIIXgh0AAEAAAA7AIwADABmAAcAAQAAAAAAAAAAAAAAAAAEAAN4nJyU32obVxDGf4oltaE0F8UE58acy7Y4KzXYIbGv1nVMlhor1Sr9A6WwltaSkLS77K7kuPQBet236Fvkqs/Rhyi9LjMaKdq0ECxCzLc6M998Z+abA+zyDzvU6veBP5s/GK6x3zw2fI8HzQPDO1w0/jJc34hpMGj8arjJl42u4Y94W//d8Mcc1n82fJ+9+rnhT3hS3zX86Y7jb8MPOOTtEtfgGb8ZrrFHZvgeu/xkeIeHGGetzkPahht8xr7hJvtAjzElU8YkDHFcM2bInJyYgpCYnDHXxAxwBPhMKfXXhEiRY/i/v0aElOREyjiixDElZEpEwcgYf9GslFdaUerkiqSaT8mIiCvNmBCR4EgZkpIQM1GekpKMY1q0KOir3oySAo+CMVM8UnKGtOhwzgU9RowpcJwrkygLSbmm5IZI6zuLkM70iUkoTNWchIHqdKov1uyACxwdMo3dZL6oMBzg+E6zRZvEOL7C0/9uQ1m17kpNxEL7KT28Yqo6b3SCI+241PX5VnHJMW6r/lSVfLhHA1Unsx5zxVznL/OTPFGS4NwePqE6KHSPcJzqd0CoHfmegB4v6fCann77dOnic0mPgBea26GL42s6XHKmGYHi5dm5OuaSH3F8Q6Axwh1bf6Tn8vWGzNwt2sUZco8ZmW6BzFjuL86Pt5qw7FBacUehrujrHkmk7IF0RfYsYmiuyNQVM+3lyhuF9W9gjpDTUmf77ly2YWG7t9riW1LdYcfcNMnkloo+NFXvPc/c6D+PiAEpVxrRJ2VGi5JbvdsrIuZMcZypj1/qlpT46xypc6suiZmpgoBEeXIy/RuZb0LT3q/43tlbIps30x2drG+1TRVhTjZm9Fq7tzoLrcvxxgRaNtXUcmTCwry8qXhfor2K/lDdX+jrlvKYLrG+rjL//D/vwBM82hxyxAkjrSP8CQt7I9r6TrR5zon2YEKsUfJqvtFuCcMRHk854ojnPK1w+pxxSoeTO2hcZnU45cV7J5scbs3ijOcPVdNWvY7H669nW8/r8zv48gsOKi+jKJc9yFkY2zv/XxIxEy1ub7Mv7hHevwAAAP//AwAHW0wwAAADAAAAAAAA/84AMgAAAAAAAAAAAAAAAAAAAAAAAAAA");
+	font-family: d2-37886755-font-regular;
+	src: url("data:application/font-woff;base64,d09GRgABAAAAABOoAAoAAAAAHZgAAguFAAAAAAAAAAAAAAAAAAAAAAAAAABPUy8yAAAA9AAAAGAAAABgXd/Vo2NtYXAAAAFUAAAAvAAAARhGIOgOZ2x5ZgAAAhAAAAyEAAARVGhvYYRoZWFkAAAOlAAAADYAAAA2G4Ue32hoZWEAAA7MAAAAJAAAACQKhAX/aG10eAAADvAAAADQAAAA9HUADPZsb2NhAAAPwAAAAHwAAAB8iryO3m1heHAAABA8AAAAIAAAACAAVQD2bmFtZQAAEFwAAAMrAAAIFAbDVU1wb3N0AAATiAAAACAAAAAg/9EAMgADAgkBkAAFAAACigJYAAAASwKKAlgAAAFeADIBIwAAAgsFAwMEAwICBGAAAvcAAAADAAAAAAAAAABBREJPAEAAIP//Au7/BgAAA9gBESAAAZ8AAAAAAeYClAAAACAAA3ichM25NjMBHMbhZ5L5PtuILfZtjF0SewSd0lGrc5SOK3Bf9NyFktuw/R2j0zhv+zvvg0RVgkyaZCjkUhW5hqaWHbv2tXWcOnep69ptXo/gV3NYNmcudF25+W7iRU2PXn3xGR/xHm/xGo/xEE9xH3fPRSn/tcSJA23Htktpr7QqqlL//P/5129AZlDNkGEjRo2pG9cxYdKUaTNmzZm3YFFuSWHZilVr1m3YtKWhqeWILwAAAP//AwCdiCg8eJx0V2twG+d1vd+HJZYUwMcKWCxBAgR2lwSIF0FisVhSAAERL0Ik+AJIUSRF6mFKJCVLlahGrixaauJY0iSuizT22OPIjtJ4plEbN/ZkRo7H0+nUil22ju1mJq3jOFXc/GA8sZ00LNPUDy46uwAhUtP+2p2d3XvvOffcc/eDKpgCwCJ+HDRQA/WwG2gAgWKpNtbp5ElJkCSe0UhORJFT6OdyAaF9QSIUIrriH8YvXL6MDlzCj2/ev+fLCwuvzT3wgPxnax/IAfTWB4BBA4CtuAA1QAEYSMHpcDh5rVZjEAy8kyffsL1m221vIOrtP7szd2cq+tsY+qP5eelUT88peRoXNs+srgIAaGAaALfiAlDQBLxSmxAwmWijlqTVi5bXCIGQGHTwPLV1M307caynyx8ejJ0ZuHRkfGBo6NjyxNzs/mVcsKf3dI3UE7rh5N79bnRhT6Cnc3MjFu/tAQAEweIGbsbXwQpQxTkcYjAUEgImhnQ4eE6rpY0mkxAISYxWi3K5Lw5mv5yPHLT4muLu6KwQmIn6B2wdzqP6sadOnngq12UPWbi+87nchXg7F/QFAACrWIK4ANUKJyoS2qjlnZW6n3vq2WeemBg8d+7cuUFcuHn9mb9NfnVl5RG1tmkAdAcXQKd8ydIsLdA8zdLT6EH53U8+QV24kH6r/zf9lXd/onJ/911KffPTT3EhfSct/6yC14Gvg/3/w6vAFXlRoLRadHD/lezwtcnkrKXDHA/Ej4pnl/i9hq++Y1sqQxZaQk2tfedzK1+jd/9NSv6I9ZRrwYGtuhVlCRRPsdR0HnWNj8tv44L8MTJsnkGi/MZW7fA8Lij6Ud6fzuPC5plynBgugL70XEACaeA1JD2d1yBq7s2PZ394Fhfkl9C+T+UTaOKRfynHQj/CBagq56an88iGC5svKTSVYz6EC0q/BUowmEyMEApJBqXCYEjiSQ2vcfImE01Nz1/SM3pCT+tXjg1Xa4jgirQSJDQkLsh/yaU4LsWhuc0zaMl70vOE/F00/oTnpFd+spLDhwtgKOVgBIdDpASqEnn/x/2EhhzZ/5t+glDizV8LnAyi/OYZ9MzVrsWgfBOw2qdj+DrU36NMdQCcgZAqH05pmAllc5f7+y/n8pcymUv58GTniQMHTnQe0I8/vbT05NjYk0tLT4/vS1zIPfjYYw/mLiSgokud2iPjtgnjeeruSL0ycDp65f77j+7PT+6fw4XWiczCvPw5yvSl+yU1RrA4g8/h61ALboC2HTVVcQ5nB95eM3l3krKVGpFm5kFr//2RUvV7FtPMhGjiahvqAz2Ji+NKweMXE3emErsO/MXhEpa5wpTe460i9mprKjjsuAB1wGzDoehkO5Q3E4vh0eRfzT37wOmhXG7oNC7wY8nsLCX/EtHyh2gqtrcvqPCCwF3cQL/F18Gnsu6U1KrFoMPhvIunPC0K9wzTghV0qCF13hPgDwl9GWuXbc7W6xLnwuF53teyr0NKsIGmWUdva2heL3r3tPnCnVy7pc5V6453BkZ8vtaQlQ16ba4mXXuDr68rOBEABBYA9DkuAKmg4kWW5qlfvo7efx0PpNObt0q1ThY3cAcuKP6tKoQSqJJfhRS5KVUlEiejeVfK4027RqMn9KGVJfRF+aGRGYdjZgQ9LF9eWgmpfdxAL6J1aIJWAIZTTFAKqhBJp9pAmuKdvFbrDIQkUav099XesT//BuVpdw9Y7dx9e6ZGk6SGGzPxUf7CkYB+X9/oBGXr5u3GHpPr1Iz8b3ss7jhnu1of8bvaAEOuuIE+w6tgKLuQkyd5SqDJUq6SvpW+carjIxe3z64h4znMjrQfOho+lI6MhFO2vbw9pmetAbz66gGr88rZ/PloamF69D7OXrQwJX46ihvoe2gdLDsm6B6vUwS5e+9ipO9ktDNldtN+qzflzCe4PaZWdlQfWR7NLUc4JmRo9E905xesRsnKKrrzFzfQu1sYSpwp1TNOUdgiSxIrif5n5nT4iOSO2ol8ktRYsua9EVtPizPmSOsfuTByLtrSlH9ls7vH4kolZAvjz3dP3gdYrf+f0To0gm0HAkXgbGWcNKxKFWL6TkRj89LsMYTlH1RNpvlws9U28gYiYj3CmL53eWR0ObqyWGuuGTpIUyFjC3IMDI2oPLUAoBj+iaIjRWuSGCzzxHO0ukcOx+OpfYy7YXezJbmwgL4drRoamKwhY/q5oYQ8q+5sX9GOPkLr0AW9MFRRkejYdlGDCjRfXuKcU6VGKPdcs9Vz2mgylOeWc5Te+e+pMw52t5kzNDoD413G1tqb8xTTORpwcrW727rmJiYip7Pu3ojHE+kNpccF/3gd29DUOPh+MmbrMRG6douto5YwJj3isJusijWItmDWRemajUyL1OvL+tGLMVGMREQxJl/rdXBNBGFw084OlZscAHoHr5ZdckujyrZQaiWpXE7DDwWG+nPezrZwG159dZ71H5mVf4RcyaijTb4BxSKkAOD7+BZ2wB4A0EJ4BSqx1/BqZb8ZlP3mJOncmObtmW+/PP3YDF6VWxDclv/91yf+tPxNcQN+ilehvsSxMudbQrjZ4crV1RAkqas26XtEfHzzcQOFUJQgSjjw79A6sGouZekp3diBhqxcc0lSY896umP1jmHv4L6ctyOUzHn9oSRaS/P+Lq8ruAVxUL5RvmxxhdbBuD3Hdq6SpIYfrpClBtvBVVnz/4nWoR6a/8+9V9EIqg8vxGIL4cjxWOx4JDY0FIsOD5fnNbKcG12OJBfy44uL4/kFZV5zRQF9htbL83q3OlWJDidDlzVX8hyFAHbEM3c0fKibS3D4AdVyYq1s9E38/W5L+9WzufPRlqaJ55B2h+coviCgd7fyVImSGr4ifkmgNNt9AV0hrIPukjnsZXF1/O2KMbz5/AFLu2oOVmvH5hDS3nWGLe3MofXyX2UJTdnZSkSbMy4r06A31tsSZrR2oCO0K0MQgais/mMjsBQ30MNoXdnczM49p665e7Zcacn9ODjHu+xJT2cnKzRzcffUiG/Y0m4O2Ts8LZ3NfNLnGtE7LZKZ9dnMHLOrlhVd4RE7EzQ0ui2MldbVslKHM96u5m8sbqAUPg1MWce8KEmCajYVPX843JvJ7ko9/DDrrm3RNxj9+ukMqo1WXbuWkNd9XTVElNSpsQaLG+gttAbGe2aCKlvx+0OZvKfTEeYUXris/sgsCsrvJKNOD5qSm7LtnYCUGUT/iNagFkDQbPsv1LzyvYmDOkZH6JhdB8e+i9bkj1ozPJ9pRUa5ScEBgG+hNWDv+W5bBF5TOgeRmm9eHc9U15FEdUPN4Gi2hqomquvJ/uEvzadr6muI6oZdSbQm/4pLcFyCQ+Ztd02oik+2taV4+XNAUAeAXkBrYAYQJKfAlFNJAsnw5TMXSdZ98+tTfbrGWkJn0oX3f/3Zqf7apjqitlEflz84aXAbjW7Dyd/9/qzJS9Me5qzKo77oVzlo3q4JSdpBRx2ebrDqG6qNNa5Qve72xH06s47QGXdNjr5E+VM/1hJ9uCrsa0W/kv/LluHYjB3Vbq53Zn3KDHqLG+g1/BXQbXU9WB7B7XP9yeFTpw4fOnXqUHcy2d2dSumfv/Gt73znWzeej19+9NGLFx999LJaaysA+iH+iuISghjFYnD774pRq1WMWqDbD19JR3rbkxZ/+0x06njiC9mmbvPLXYe/9gVBSvvsfq+4MBG5eHUEE/2AlVlC/4ovQY2iJElQNpdCpUFkRSRQyuFrcZVAhL6pTpD/A1EHJyfXX27KmBkvIwdfCKGn5D+Ov6DUZi5uoH/Al8C+ncetCg0szZN3Le3X2Xm23ZrtDo8NRFm/1Uuj2B8opsMqTYV6j+pDbMjiG0nEB4wGCxL6/05f5zmQSh0JlGbYq2gWX1I1G8USK7J0nYZ8Uescismvom/0ZNqNxJ/8/c3JfiHzyNWnlT2NwF/cD6/DMuwGYJyhkFPL8dsakTB6OhHW4ka+1WxvS/91pyHWjqyWZlvQt/cIKLusr7gBP0DvYSdEANASaJUrIHDBe6geNSlnOEkUaNfae7GYks8Fv8B/QI2l5yztwm/9oqdH1dqX0AfFl5XnjMjSevTzS5IECHYVD6Mx/Lr6HAloF9JF5N/f0Bz//OkSZg4W0dvYq5wt1WOqqJoG/dNbt/pu3Vq8Hb19O3q77I/wHFrbOlPmcmhNmdfiP+EBkPAt5XtqG/BGm62x0WbDA1ZzY0tLo9mqxFCxwjLodqr1ITPPmxt5Xs83W3ne2szD/wIAAP//AwCxTLsVAAEAAAACC4UzWYfJXw889QADA+gAAAAA2F2goQAAAADdZi82/jr+2whvA8gAAAADAAIAAAAAAAAAAQAAA9j+7wAACJj+Ov46CG8AAQAAAAAAAAAAAAAAAAAAAD14nCzKvUoDURxE8TOzhSBBsZEVQlg0zfqRNIsiYhHESqvbiH/BVnwQsdHe3vewjo2NhW9gqV6QkK0iCVYzB35+5JIxuKLwOeEjGt8QXiX0RfiWxg+ElgifEPok/EH4nvATjff/95DwOtsu6fqOC01pXJM0ZuAdhvphoD49TdlzRWLCqb5JzEjFMclbJPcWNi38FUnPdJUoXXGmdzp+o9QLK/OvzK4yfWXWlNmYNy1DWkY6oC4qav3S0TXLymwyIcHslZbRHwAAAP//AwByWDBJAAAALAAsAFAAhgC2ANQA6gD+ATABSAFUAW4BfgGwAdICAgIkAmYCjgLSAuQDCANAA3QDogPUBAgEKgSWBLgExATeBPoFLAVOBXoFrgXiBgIGQgZoBooGpgbgBwwHPAdiB4wHsAfkB/4IHggqCDYIQghOCF4Icgh+CJQIqgABAAAAPQCMAAwAZgAHAAEAAAAAAAAAAAAAAAAABAADeJyclN9qG1cQxn+KJbWhNBfFBOfGnMu2OCs12CGxr9Z1TJYaK9Uq/QOlsJbWkpC0u+yu5Lj0AXrdt+hb5KrP0YcovS4zGinatBAsQsy3OjPffGfmmwPs8g871Or3gT+bPxiusd88NnyPB80DwztcNP4yXN+IaTBo/Gq4yZeNruGPeFv/3fDHHNZ/Nnyfvfq54U94Ut81/OmO42/DDzjk7RLX4Bm/Ga6xR2b4Hrv8ZHiHhxhnrc5D2oYbfMa+4Sb7QI8xJVPGJAxxXDNmyJycmIKQmJwx18QMcAT4TCn114RIkWP4v79GhJTkRMo4osQxJWRKRMHIGH/RrJRXWlHq5Iqkmk/JiIgrzZgQkeBIGZKSEDNRnpKSjGNatCjoq96MkgKPgjFTPFJyhrTocM4FPUaMKXCcK5MoC0m5puSGSOs7i5DO9IlJKEzVnISB6nSqL9bsgAscHTKN3WS+qDAc4PhOs0WbxDi+wtP/bkNZte5KTcRC+yk9vGKqOm90giPtuNT1+VZxyTFuq/5UlXy4RwNVJ7Mec8Vc5y/zkzxRkuDcHj6hOih0j3Cc6ndAqB35noAeL+nwmp5++3Tp4nNJj4AXmtuhi+NrOlxyphmB4uXZuTrmkh9xfEOgMcIdW3+k5/L1hszcLdrFGXKPGZlugcxY7i/Oj7easOxQWnFHoa7o6x5JpOyBdEX2LGJorsjUFTPt5cobhfVvYI6Q01Jn++5ctmFhu7fa4ltS3WHH3DTJ5JaKPjRV7z3P3Og/j4gBKVca0SdlRouSW73bKyLmTHGcqY9f6paU+OscqXOrLomZqYKARHlyMv0bmW9C096v+N7ZWyKbN9MdnaxvtU0VYU42ZvRau7c6C63L8cYEWjbV1HJkwsK8vKl4X6K9iv5Q3V/o65bymC6xvq4y//w/78ATPNoccsQJI60j/AkLeyPa+k60ec6J9mBCrFHyar7RbgnDER5POeKI5zytcPqccUqHkztoXGZ1OOXFeyebHG7N4oznD1XTVr2Ox+uvZ1vP6/M7+PILDiovoyiXPchZGNs7/18SMRMtbm+zL+4R3r8AAAD//wMAB1tMMAAAAwAAAAAAAP/OADIAAAAAAAAAAAAAAAAAAAAAAAAAAA==");
 }
-.d2-625626608 .text-bold {
-	font-family: "d2-625626608-font-bold";
+.d2-37886755 .text-bold {
+	font-family: "d2-37886755-font-bold";
 }
 @font-face {
-	font-family: d2-625626608-font-bold;
-	src: url("data:application/font-woff;base64,d09GRgABAAAAABNIAAoAAAAAHQQAAguFAAAAAAAAAAAAAAAAAAAAAAAAAABPUy8yAAAA9AAAAGAAAABgXxHXrmNtYXAAAAFUAAAAxgAAAS4G2ygtZ2x5ZgAAAhwAAAwdAAAQnFrSemRoZWFkAAAOPAAAADYAAAA2G38e1GhoZWEAAA50AAAAJAAAACQKfwX6aG10eAAADpgAAADIAAAA7HcRCkZsb2NhAAAPYAAAAHgAAAB4gWiFim1heHAAAA/YAAAAIAAAACAAUwD3bmFtZQAAD/gAAAMvAAAIKgjwVkFwb3N0AAATKAAAACAAAAAg/9EAMgADAioCvAAFAAACigJYAAAASwKKAlgAAAFeADIBKQAAAgsHAwMEAwICBGAAAvcAAAADAAAAAAAAAABBREJPACAAIP//Au7/BgAAA9gBESAAAZ8AAAAAAfAClAAAACAAA3icjM7JLkMBHMXh72pRtMaap9uaSs1Uxc5CRESsrBtL8QRei73hKWx5jCL5i7uS2MjZ/pLvIJGToCifVFGTyitI1a3bsGnLtl0NTUdOnLlwpeXGXVqO4E+5n5XHTp271HLt9qeMdyVduuUU4is+4yPa0Y6XeI6neIzXeIj7t0r25X9LHGbajuYvf0+HnLzOzCro0atPUUm/AYOGDBtxoGzUmHETJk2ZNmPWnHmpiqoFi5YsW1Gzak1dg28AAAD//wMAoQMtFAAAeJyEV2twG9d1PvcCxIrg8gEsFguAxHOJXTxIkMBiAT5AghDBhyiAT4mkLL7CkWVKoihGoiLaoqLO+NU6UOWYjErbra1o7Gma2qk9bmdUd9ROPRO7ajT5UTvNn8SxG48miac2k2HSxCYXnbsEKUjtTH4Ql7Oz95zvfPc739kLJTAIgGfxGmigFCrBCCyAZHAbvJIo8lRcisd5ThMXkYEaxEbl1VdEv9bv1wZc687HpqdRdgqvbc8fzc7O/m66tVV56R/fVq6gc28D4PwXALgT56AUDAAMJYmCIPI6nYaRGF7kqbtV36gsry7X0tYv7rx55y997/lQXyIRXpCip5UncW576cUXAQA0kAXACZwDA9jAQ7BJEbOZNekoVl10vEaKxOSowPMGKaKu2Z+l5zvqfZHO9Nme6a5YOBLtHnk00TaCc/buZHCkUlt+MNV5yI+eDvCCSxkfD3oBEITym7gRr0M1QIlHEORoLCZFzBwlCLxHp2NNZikSi3M6NDn8zMjhK8PJY+5+a5yvOxAc7fUlLf3DdOZbp+efH5I8U5w9MrX/2GKtdWIGMGQBcAbnQA9sEXodL0qRGMFNAN889tzQ4NWZ+pqmkVBopKkG59JXFxef67ngm+jvP+IFgi8LgD7HOSgjHLhZNyuxPOtms2hd+fLDD1Elzq08fvHaCuzWksbr4Pz/aimUIvOyZNDp0Okj3zw89uxYz3FX1toUyMxMHDUJ9Pxnnq8WCoq6p8yOxdlji3r94rLygTu0gwUf3sUisZIsGXgDb8iufry29jHOffnl9hKqUjZ2ccNHOAca9V1DdhXntpcKMeZxDuid5xIjaRheQ7HZVe07N77/y2+/nME55beoTNlSlhFz7O92OfgvnIOSnT1uNruKMM5tb5CyCzFfxzlSN4loNnNSLBZnJANPKIjzFMWLIu/ALJv99gm9Ua/VG/SPXH+KKtVo5cmhyahWu4/COeXDmnaHo70GebaXPncNDDpf/MMfXnQODrg+B8Aqt1/H61D5gFJUMYo7UlRJRqPjTx48+OT4zm9nf39nZ38/Pfz8yVPfGhi4dvLk88OXl2ZnFxZmZ5dIXKKTRpUPU5HKdTzP7un6o97z3d1LXUO9yx2JNM6JEwOZ2YafouE5KUDqJ9j68HW8DmUgAHiLsXgE8T6klLmgZx0aLUBDtkee5ecu7SBenOYG/Ky3wmZsnT8/R1DOnVc+fDhj/t4zO/Af/9tqj4PSniotL2AfwTmoAK64Q0mjE/QqDj77adfZdFJee/XSUKalra0lg3Pe8f7eSU758tNP0Uy4sVEgZ8znN7Eer0NAZVeMq0DlqCCKIfx/hMxxaiYdMnVcjhziR32heil42J0QWk+kmxYDB10dolDfHDjU2t2yQDeGHnYIHrvTbqytaOhuiI1H6wKT1mpnjcNh8FgOdcUmmgCBFQAzOAcUqYSX3SxvuPMW+uItXLWysk0kDQgO5DfxgOpJBKNskAxqT6n/6FD/5afWWuLxxJ8/Tl97BU0pqzOZzAw6rdx45RpgCOQ30QdoC6zAA3Aecihx1WMoUS2ONfDEJ+OkRVXf+ef04BOrmPc7O2rlhlMt08eX9Vpnzz6rl+lPOOmxZP94pVu0sF+x1y6cVT6RavizHDOmD9otnKqJVH4Tm/EtMBXcQOQp3iCx1AOi5T3EUFGXu9Oupc+tau1pT2K8ITE9LsRG6/wmH+12yfjWaxmbvf2rmcOPJpe7M0/V/8BYofJRm99Et9AW2B70m3t2w+l0yNp1JtX7tXSop6aLd8nJZKMlxLR4R+m288MjS20ObtqeSXVk2coZVzXhGYOY30Rb+BYw4NrliqDmRFkqYmlXDL+ZONM6HfU3WXWry3qtrRtbRCMTNPGxBvobjw6db6+xZP5muzNs45dN1h8YKzp7DnQBVrF/jLbA8oBbEl1RbqI+0iUaKUqyIGfP2f2d8609kw1arPxY3x2WY2Fh6oW3xDpPjG5fGh5aSiZPpRlvaUxyH7E5UItfbiC1ILAAoCV8m6xEV/EHtEzs3PDQ/v21g53OaFV1uY2udhw5gi6dLqmWR6O0br6kxC04zimPA2jAk6/HFNqCBmiFPpUZQY7GZRV7YYlJEU5i+YKJeERCkETkZdLpNEXOwBS60yOor/ymZaqph6l2WWz+lim5zv0PA1RpdDxudxo9/sGJr6RX+uyiaLeLoj/SIXolq5uubnvf1lSX8GnLfc7qSJXWmA4mBnz0qTKPqbmvVl9pZoytndJQCN0O+EW/z+cPKKu1Vq5Ko7FYa+w73KTIYasaBWlPm6yBN6ikU4bUKlVzMDJ0YNXuqvFZ8K3XjliDpyaVO8gd81k55U3I5yEOAD/F72MBmgGAghZ4Zi+2A9/amzNxiWJ4kWJTV7V/df17//TyYhLfUha+f0f5yb/2PEbez28iI74FlSqve71NRPBvmdZVQ2kJpTPSXvroQcxv/5gzInS6hCL7ADR2tAVuNQ8ZPOR076uE2ltTpIe7w3KKcfeFBw+u2l3eRvLTgDY6nPVBnye8W16j8mZh2eUJbYGpOEcxT8t6rSu7RxTaSDrq7+NpR++qdv74/DInz6TTZ5LJhXR6IVkfCtWH6usLvdq2NDJ8vu1CtiOVIS1LYKXyvdiMtoABBwB3D50qP0HkWOaezZDy7QfEh+YS0zFXwlYyIMRGgwGT7yb+TtjG/9m5w8vJauvAN1HtnskQL+hFW2p8F0CJHFfD7jaRFJcMmmIvQCd01v2eHUNoJ472yZ4Z3PyLjMWpGoLdFd4eR7X33KCgF3QVbYHxvnOkhHsMV2cEtkZvKbdW1bSZ0MZYJFxSclmr9UeUjwABm99EL6MtEFX93Jtfws782gtGppcDsybd++FHhP2epNPtsIdsjlbficPNY879tqituVlwtfnnaME5Ya3mGIOZ0dO1zf6uUdEybjKLFmtFGd8c6pzc6SFDfhMt4CUygclMknk5HpeIqxQZMEwMpDOGxy5c4O20Vc8xcfrk6O3TuieeOPdewKvTntLRO7ES+U30e7QBpgd6wFCw3f8cOrDqcNUI5tXlMo2zjz41iaLKz2S/zY56laoubx0g0m8ojzagHEDSSFzhWywuad7667UOPaPXljL61JUbaONX3qwoZr2/Uqp2fRJvoA1wP7CvKAJfuEtQ1NrKc406vU5LlZfGLzeVVlJaqpRq+NMLr9VT5ZSWKqPq0MZdb68g9PF31bXXe1epepfv9vm6+XfVfBUAaBNtkLkvMWJRQoq7l6di/epLdXqzXrvPuM+z/uzzLzXSHK0tNZWKCH82yAZZNsgO5n89zNaxbNA8TOLS+Xa0jTagulgH8fh9VFTgZbO70kYZ93l9eupf1nrKjHrtPkNp4sprXNPAOzrtIiqptdvQz3/k6fbyPfyPlLL2w4VvPW9+E32Kn4ayQh/L0UK7ibv3ip1rixntO37p0nHyZ/VxnM9q8VksPvq7N268+uqNG989650aG5vweCbGxqbUe5ADAH2Cn4YaAElux3K06NuEhNeRLweJ9Q5d6g77PXHLYMNsOjklt05ELQnznxzKXjpR3xAWbQMRKXK0TT5zJqYpWSH+wACg3+OLUEpUxUhkUpEjZGS3zBDT59nrT5UgLW2riCj//Yu/P3AA7XvEOeSwxaqVhfWH0deVK4vrBB+X30Qf4YvgLOZ1FyXjZnlqD+n/9M8L++1pX7ilqa7Ga99vRHO/LHML8aNNqZN01Dtp80bCjZEKYwClVi5UBsbS3ceiqibqANBdfFHVbjuOu2U3W6GhXtZ5uhPKz9Hb8U5vlfbkd14YWXmo82sXnyUNiKAtvwmfw+vkTsQVncY1QZIEQZJoWfTJsk+UybuhfDsCeJ14DCfGYqLHwxdtyTiaWhDWYj4WEyLRiXf6TSlv0CeE+lLDywBk1qm50K+xCGEAlAYdWQFBEG4jNwqTu1Zcltjg727PzZF8Qfgh/i2q23nuZoP43384NaVqdAn9Iv8eec7JbpZGP8mNjACC8vwMiuF31eeMpCm/PXP7uub41gsklgem0Gc4RupU75Dyjsn8xxtvzL/xxtTNuZs3524WfBQ+QBu7977UKtpQqgDlX8fNMILfJ/sNRUV7QyGvNxTCzQGeDwR4PgD/CwAA//8DAEDPjYYAAAAAAQAAAAILhdUA7OdfDzz1AAED6AAAAADYXaCEAAAAAN1mLzb+N/7ECG0D8QABAAMAAgAAAAAAAAABAAAD2P7vAAAImP43/jcIbQABAAAAAAAAAAAAAAAAAAAAO3icLMqxLgRRFMfh3/lPsiEGVyxWs5E1IjHXtCT2FqeRSJxEgkKh5CUkvIFeq6bRegG9V1Fts2Ki+ppPH1zwBSrzmW4JndLpgVBD6JFOr4QdEronNCA0I/RGp6t/7whldpXZ1gtnWuVABbdvGhX2NaCxa0baZKIT3IYcqcFtjFc3uKa42v7637dn3D7ZsCfWdMxUS9TVAiOJFS1SK7GnxFiJdSW2lMiWKZbpes9pqx1a+6G2S5aVmNgQh/n7LwAAAP//AwDdHx+6AAAALAAsAFAAhACwANQA6gEaATABPAFWAWYBmAHEAeYCIgJIAogCmgK4AvADIgNOA4ADtAPaBEIEZARwBIgEpATWBPgFJAVUBYgFqAXkBgoGLAZIBoAGrAbcBwgHNAdYB4oHpAe6B9oH5gfyB/4ICggYCCwIOAhOAAEAAAA7AJAADABjAAcAAQAAAAAAAAAAAAAAAAAEAAN4nJyUz24bZRTFf05s0wrBAkVVuom+BYsitWNTJVXbrCakVkZEcfC4ICSENLYntuXxzMgzdhqegDVvwVt0xUPwHIg1utfXrl0QBSuKdWbm/jnfued+wAF/sk+leh/4rZ4arnBUvza8x736heF9WvU9w1Ue1X43XGNQWxiu83mtY/gj3lZ/MXyP4+qPhu9zWG0Z/pin1QPDn+w7/jD8Kce8XeIKPOdnwxUOyQ3vccAPhvd5gNWsVHlA03CNzzgyXOcI6DKmJGFMyhDHDWOGzJkRUxASM2PMDTEDHAE+CaW+TYkUOYb/+DYipGRGpBVHlDgSQhIiCkZW8SfNyrjWjtJnpki6+ZSMiOhpxoSIFEfGkIyUmInWKSnJeUmDBgV95ZtTUuBRMCbBI2PGkAZtWlzSZcSYAkdLKwmzkIwbSm6JtL+zCFGmT0xKYazmpAyUp1N+sWYHXOJok2vsZuXLrQqPcXyr2cJNYhxf4um/22C23XfFJmKheoqGPRLleasTHKni0tfnG8UlL3E76bPN5MMaDZSdzHpMj7nOX+YnecIkxblDfEJ1UOge4jjT54BQFfmOgC4XtHlNV599OnTwuaJLwCvNbdPB8RVtrjjXjEDx8ltLHXPF9zi+JtAYqR2bPqK5PL0hN3cLd3GGnGNKrlsgM5bzi/PjnSYsO5RtuaNQV/R1jyRS9kBUkT2LGJorcnXFVLVceaMw/QbmCPla6mzffZdtWNjurbb4jkx32DE3TjK5JaMPTdV7zzO3+ucRMSCjpxF9MqY0KLnTs10TMSfBca4+vtAtKfHXOdLnTl0SM1UGAanWmZHrb2S+CY17f8v3zu4S2byp7uhkfapdukjldGNGr1W91bfQVI43JtCwqWaWIxOWysuTivcl2tviH6r7C73dMp5wRkbC4G83wFM8mhxzwikj7SCVUxZ2OzT1hmjyglM9/YRYo+S+fKM6SYUTPJ5xwgkvePaejismzri4NZfN3j7nnNHm9D+dYhnf5oxX63f/3vVXZdrUszierJ+e7zzFR//DrV/weOu+7OgtIJuzsGrvtuKKiKlwcYebWriHeH8BAAD//wMA9LdPUQAAAwAAAAAAAP/OADIAAAAAAAAAAAAAAAAAAAAAAAAAAA==");
+	font-family: d2-37886755-font-bold;
+	src: url("data:application/font-woff;base64,d09GRgABAAAAABOIAAoAAAAAHWQAAguFAAAAAAAAAAAAAAAAAAAAAAAAAABPUy8yAAAA9AAAAGAAAABgXxHXrmNtYXAAAAFUAAAAvAAAARhGIOgOZ2x5ZgAAAhAAAAxgAAARCD8W3F1oZWFkAAAOcAAAADYAAAA2G38e1GhoZWEAAA6oAAAAJAAAACQKfwX8aG10eAAADswAAADNAAAA9Hu2CuBsb2NhAAAPnAAAAHwAAAB8h9KL5m1heHAAABAYAAAAIAAAACAAVQD3bmFtZQAAEDgAAAMvAAAIKgjwVkFwb3N0AAATaAAAACAAAAAg/9EAMgADAioCvAAFAAACigJYAAAASwKKAlgAAAFeADIBKQAAAgsHAwMEAwICBGAAAvcAAAADAAAAAAAAAABBREJPACAAIP//Au7/BgAAA9gBESAAAZ8AAAAAAfAClAAAACAAA3ichM25NjMBHMbhZ5L5PtuILfZtjF0SewSd0lGrc5SOK3Bf9NyFktuw/R2j0zhv+zvvg0RVgkyaZCjkUhW5hqaWHbv2tXWcOnep69ptXo/gV3NYNmcudF25+W7iRU2PXn3xGR/xHm/xGo/xEE9xH3fPRSn/tcSJA23Htktpr7QqqlL//P/5129AZlDNkGEjRo2pG9cxYdKUaTNmzZm3YFFuSWHZilVr1m3YtKWhqeWILwAAAP//AwCdiCg8eJyEV2twG9d1PvdiiRVB8AEsFguAxHOJXYAgQQKLBfgACT7AhyiAT4mkLL7CkWVKoihGoiLaoqLM+NU6UKSYjExbra1o7Gnq2qk9bmdUt2qnnoldNZr8qJ3mT+LYjkd14qnNZJjUsclF5y5BClI7kx/E5ezcPfc73/nOd/ZCAQwA4Bm8ChoohFIwAgsgGdwGrySKPB2TYjGe08REZKAHsFF56UXRT/n9VJVrzfnI1BRKT+LVrblD6ZmZP0w1NSnP/8ObykV0+k0AnP0SAHfgDBSCAYChJVEQRF6r1TASw4s8fafs26XF5cWU3vrl7ddv/4XvHR/qjcdD81LkhPI4zmwtXr0KAKCBNACO4wwYwAYegk0Km82sSUuz6qLlNVI4KkcEnjdIYXVN/zI511rjC3ckT3VPdUZD4UjX8MPx5mGcsXclAsOlVPG+to79fvRkFS+4lLGxgBcAQTC7gevwGpQDFHgEQY5Eo1LYzNGCwHu0WtZklsLRGKdFE0NPDR+4OJQ47O6zxvjqvYGRHl/C0jekT33vxNyzg5JnkrOHJ9sPL1Rax6cBQxoAp3AGdMDmodfyohSOEtwE8I3DTw8OXJquqagfDgaH6ytwJnlpYeHp7rO+8b6+g14g+NIA6HOcgSLCgZt1sxLLs242jdaUr95/H5XizPKj564s7+79ROU+b28aXVW++OgjnFl+ZnkLYCfnJF4D5/+Xcy5lmZclg1aLThz87oHRy6PdR1xpa31Vanr8kEnQz33m+Xou8Yh70uxYmDm8oNMtLCnvuYPbOPCBHcwSK8mSgTfwhvTKh6urH+LMV19tLaIyZX0HM3yAM6BR9xrSKziztZiLMYczoN9+LjGShuE1NJteod66/qNff/+FFM4ov0dFyqayhJjDf7uT/0c4AwXb77jZ9ArCOLO1TujJxXwVZ0jeJKLZzEnRaIyRDDyhIMbTNC+KvAOzbPr7R3VGHaUz6B669gRdqKHkicGJCEXtoXFGeb+ixeFoqUCercXPXf0Dzqt//ONV50C/6/OdM0jdme0zOEkQZJK/RuTNZpZNP/NyK0WVZMhSUIwzyj9djnyr8c7WIur8TnS58b8AAKv1+SZeg9L7VKkKX9yWvVooNDL2+L59j49t/3b09XV09PXph549dvx7/f1Xjh17dujC4szM/PzMzCKJS7DVqZya8jpKy/Psbg990HOmq2uxc7BnqTWexBlxvD81U/sLNDQrVUEOWy++htegCAQAbz4WjyDeg5Q253pHi0Zy0JDtocv87PltxAtTXL+f9ZbYjE1zZ2YJytkzyvsPpsw/fGob/qN/U+5x0NTxwuIc9mGcgRLg8t2AmApBr+Lg0592nkom5NWXzg+mGpubG1M44x3r65nglK8+/RRNh+rqBFIjPruBdXgNqlR2xZgKVI4IohjE/6cZOE49SYtMrRfC+/kRX7BGChxwx4Wmo8n6hap9rlZRqGmo2t/U1Tivrws+6BA8dqfdWFlS21UbHYtUV01Yy50VDofBY9nfGR2vBwRWAMzgDNAkE152s7zh9hvoyzdw2fLyFmkLQLA3u4H7Vf8jGGWDZFD7Uv1Hi/ouPLHaGIvFv/Oo/sqLaFJZmU6lptEJ5fqLVwBDVXYDvYc2wQo8AOchRYmpfkaLanKsgSeeHCNtrnrcPycHHlvBvN/ZWinXHm+cOrKko5zde6xepi/u1I8m+sZK3aKF/Zq9cv6U8rFUwZ/imFFdwG7hVE20ZTewGd8EU85RRJ7mDRJL3yda3kPMG3W6O+yU/vQKZU964mO18akxITpS7Tf59G6XjG++krLZW76eOvBwYqkr9UTNj40lKh+V2Q10E22C7X7PumtZnFaLrJ0n23q+kQx2V3TyLjmRqLMEmUbviL75zNDwYrODm7Kn2lrTbOm0q5zwjEHMbqBNfBMYcO1wRVBzoizlsbQjht+Nn2yaivjrrdqVJR1l68IW0cgETHy0Vv/thwfPtFRYUn+91RGy8Usm64+NJR3dezsBq9g/RJtguc9xia5oN1Ef6RKNFCGnIGf3qfaOuabuiVoKKz/TdYXkaEiYfO4NsdoT1bcsDg0uJhLHk4y3MCq5D9ocqNEv15JcEFgA0CK+RVaiq9h9WibjwPBAe3vlQIczUlZebNOXOw4eROdPFJTLIxG9dq6gwC04TiuPAmjAk63BNNqEWmiCXpUZQY7EZBV7bolKYU5i+ZyJeERCkETkZdJqNXnOwOS60yOoW37XOFnfzZS7LDZ/46Rc7f77frowMhazO40e/8D415LLvXZRtNtF0R9uFb2S1a0vb37XVl8d91HFPmd5uIwyJgPxfp/+eJHH1NBbqSs1M8amDmkwiG5V+UW/z+evUlYqrVyZRmOxVti3uWkjxVY1CtKuNlkDb1BJpw1tK3TFvvDg3hW7q8JnwTdfOWgNHJ9QbiN31GfllNchm4UYAPwCv4sFaAQAGprgqd3YDnxzd1bFJJrhRZptu0T95bUf/uMLCwl8U5n/0W3l5//a/QjZn91ARnwTSlVed3ubiODfUk0rhsICWmvUe/WH9mF+62ecEaETBTR5D0BjR5vgVs8hw4tU955M6N21jfRwV0huY9y9oYF9K3aXt4781KL1VmdNwOcJ7aRXp7yeW3Z4Qptgyj8jn6clHeVK7xKF1hOOmnt42ta7qp0/Pb/MiZPJ5MlEYj6ZnE/UBIM1wZqaXK82Lw4PnWk+m25tS5GWJbDasj3YjDaBAQcAdxedKj9B5Fjmrs2Q9O17xQdm41NRV9xW0C9ERwJVJt8N/IOQjf/z0weWEuXW/u+iyl2TIV7QgzbV+C6AAjmmht1pIikmGTT5XoCOaq3tnm1DaCGO9vGuGdx4JmVxqoZgd4W2xlDlXTfI6QVdQptgvKeOtHCX4fKUwFboLMXWsopmE1ofDYcKCi5QlD+sfAAI2OwGegFtgqjq5+78Erbn124wMr0cmDVp3w09JLR7Ek63wx60OZp8Rw80jDrbbRFbQ4PgavbP6gXnuLWcYwxmRqevbPB3joiWMZNZtFhLiviGYMfEdg8ZshtoHi+SCUxmkszLsZhEXCXPgGG8P5kyPHL2LG/XW3UcE9MfG7l1QvvYY6ffqfJqqeNa/XaseHYDfYHWwXRfDxhytvufg3tXHK4KwbyyVKRx9uqPT6CI8kvZb7OjHqWs01sNiPQbyqJ1KAaQNBKX+56LSZo3/mq1VcfoqEJG13bxOlr/jTctimnvb5SyHZ/E62gd3Pe9lxeBz91baHp1+ek6rU5L0cWFsQv1haU0RRfStX929pUaupim6CK6Gq3f8fYIQi9/R117vHeUsrf5Lp+vi39bPa8EAG2gdTL3JUbMO5Dm7p5Tsnbp+WqdWUftMe7xrF1+9vk6PaenCk2FIsKfDbABlg2wA9nfDrHVLBswD5G4+mwL2kLrUJ6vg1jsHipK8JLZXWqjjXu8Ph39L6vdRUYdtcdQGL/4Clff/5aWWkAFlXYb+tVPPV1evpv/qVLUciD3refNbqBP8ZNQlOtjOZJrN3HnDrN9RTKjPUfOnz9C/qw+jvNZLT6Lxad/+fr1l166fv3lU97J0dFxj2d8dHRSvXM5ANDH+EmoAJDkFixH8r5NSHgt+XKQWO/g+a6Q3xOzDNTOJBOTctN4xBI3f2t/+vzRmtqQaOsPS+FDzfLJk1FNwTLxBwYAfYHPQSFRFSORSUVKyMhumSGmz7PXnihAlN5WElb++5O/27sX7XnIOeiwRcuV+bUH0TeViwtrBB+X3UAf4HPgzOd1ByXjZnl6F+n/9M0J7fakL9RYX13htbcb0eyvi9xC7FB92zF9xDth84ZDdeESYxVqWz5bWjWa7DocUTVRDYDu4HOqdltwzC272RIN/YLW0xVXfoXejHV4y6hjP3huePmBjm+cuzyRu7e1IIBXiW9wYjQqejx8XlFSjvpGhCnMR6NCODL+Vp+pzRvwCcHetqElADK/mrMb8Dn6LRYhDoCSoCUrIAjALeRGIXIHi8kSG/jDrdlZcl4AfoJ/j6q3n7vZAP73n0xOqrpbRJ9k3yHPOdnN6tHPM8PDgKA4O42i+G31OSNpim9N37qmObL5HInlgUn0GY6SO6F6t5S3jeM/Xntt7rXXJm/M3rgxeyPnjfAeWt+5D7atoHWlDFD2VdwAw/hd8r4hL2lvMOj1BoO4oYrnq8gfiaHmCa+SvVze3iuCJAmCJOll0SfLPlGG/wUAAP//AwBokaj1AAEAAAACC4V3ypiBXw889QABA+gAAAAA2F2ghAAAAADdZi82/jf+xAhtA/EAAQADAAIAAAAAAAAAAQAAA9j+7wAACJj+N/43CG0AAQAAAAAAAAAAAAAAAAAAAD14nATAsS5DURzH8e//d5OGuDiiqKWROtLEPc5Komc4i0Tin0gwGIy8hIQ3sHc112L1AnavYupy+9E3t/yCSr/UE64rsl5xRVwtrjeyPnE7w/WCa4BriWuOa0HWPa4FWc+4EsdKHGrOtbY5VaHaH1GFqQZEe2CkfSa6pNqQc0WqjanNI1UzqjqiClWFqX1Q7Yc9e2dHF8y0QdusMZLY0jqtAicKjBXYVeBAgWSJbIliN3TNEZ3909odmwpMbEiF/ssSZQUAAP//AwAcaiD9AAAAAAAALAAsAFAAhACwANQA6gD+AS4BRAFQAWoBegGsAc4B+gIcAlgCfgK+AtAC7gMmA1gDhAO2A+oEEAR4BJoEpgS+BNoFDAUuBVoFigW+Bd4GGgZABmIGfga2BuIHEgc+B2oHjgfAB9oH+ggGCBIIHggqCDgITAhYCG4IhAABAAAAPQCQAAwAYwAHAAEAAAAAAAAAAAAAAAAABAADeJyclM9uG2UUxX9ObNMKwQJFVbqJvgWLIrVjUyVV26wmpFZGRHHwuCAkhDS2J7bl8czIM3YanoA1b8FbdMVD8ByINbrX165dEAUrinVm5v4537nnfsABf7JPpXof+K2eGq5wVL82vMe9+oXhfVr1PcNVHtV+N1xjUFsYrvN5rWP4I95WfzF8j+Pqj4bvc1htGf6Yp9UDw5/sO/4w/CnHvF3iCjznZ8MVDskN73HAD4b3eYDVrFR5QNNwjc84MlznCOgypiRhTMoQxw1jhsyZEVMQEjNjzA0xAxwBPgmlvk2JFDmG//g2IqRkRqQVR5Q4EkISIgpGVvEnzcq41o7SZ6ZIuvmUjIjoacaEiBRHxpCMlJiJ1ikpyXlJgwYFfeWbU1LgUTAmwSNjxpAGbVpc0mXEmAJHSysJs5CMG0puibS/swhRpk9MSmGs5qQMlKdTfrFmB1ziaJNr7Gbly60Kj3F8q9nCTWIcX+Lpv9tgtt13xSZioXqKhj0S5XmrExyp4tLX5xvFJS9xO+mzzeTDGg2Uncx6TI+5zl/mJ3nCJMW5Q3xCdVDoHuI40+eAUBX5joAuF7R5TVeffTp08LmiS8ArzW3TwfEVba4414xA8fJbSx1zxfc4vibQGKkdmz6iuTy9ITd3C3dxhpxjSq5bIDOW84vz450mLDuUbbmjUFf0dY8kUvZAVJE9ixiaK3J1xVS1XHmjMP0G5gj5Wups332XbVjY7q22+I5Md9gxN04yuSWjD03Ve88zt/rnETEgo6cRfTKmNCi507NdEzEnwXGuPr7QLSnx1znS505dEjNVBgGp1pmR629kvgmNe3/L987uEtm8qe7oZH2qXbpI5XRjRq9VvdW30FSONybQsKlmliMTlsrLk4r3Jdrb4h+q+wu93TKecEZGwuBvN8BTPJocc8IpI+0glVMWdjs09YZo8oJTPf2EWKPkvnyjOkmFEzyeccIJL3j2no4rJs64uDWXzd4+55zR5vQ/nWIZ3+aMV+t3/971V2Xa1LM4nqyfnu88xUf/w61f8HjrvuzoLSCbs7Bq77biioipcHGHm1q4h3h/AQAA//8DAPS3T1EAAAMAAAAAAAD/zgAyAAAAAAAAAAAAAAAAAAAAAAAAAAA=");
 }
-.d2-625626608 .text-italic {
-	font-family: "d2-625626608-font-italic";
+.d2-37886755 .text-italic {
+	font-family: "d2-37886755-font-italic";
 }
 @font-face {
-	font-family: d2-625626608-font-italic;
-	src: url("data:application/font-woff;base64,d09GRgABAAAAABOYAAoAAAAAHhwAARhRAAAAAAAAAAAAAAAAAAAAAAAAAABPUy8yAAAA9AAAAGAAAABgW1SVeGNtYXAAAAFUAAAAxgAAAS4G2ygtZ2x5ZgAAAhwAAAxsAAARrAxaa2poZWFkAAAOiAAAADYAAAA2G7Ur2mhoZWEAAA7AAAAAJAAAACQLeAjfaG10eAAADuQAAADPAAAA7GzVBppsb2NhAAAPtAAAAHgAAAB4ibqOAm1heHAAABAsAAAAIAAAACAAUwD2bmFtZQAAEEwAAAMrAAAIMgntVzNwb3N0AAATeAAAACAAAAAg/8YAMgADAeEBkAAFAAACigJY//EASwKKAlgARAFeADIBIwAAAgsFAwMEAwkCBCAAAHcAAAADAAAAAAAAAABBREJPAAEAIP//Au7/BgAAA9gBESAAAZMAAAAAAeYClAAAACAAA3icjM7JLkMBHMXh72pRtMaap9uaSs1Uxc5CRESsrBtL8QRei73hKWx5jCL5i7uS2MjZ/pLvIJGToCifVFGTyitI1a3bsGnLtl0NTUdOnLlwpeXGXVqO4E+5n5XHTp271HLt9qeMdyVduuUU4is+4yPa0Y6XeI6neIzXeIj7t0r25X9LHGbajuYvf0+HnLzOzCro0atPUUm/AYOGDBtxoGzUmHETJk2ZNmPWnHmpiqoFi5YsW1Gzak1dg28AAAD//wMAoQMtFAAAeJx8V3tsW9d5P9+51L2yRD3Iy4dJi6LIQ15K1CUl8ZK8oiRSD+pBSaSshyUrtkTJ8iuyFUexI8ee7aSJhswJWpcJsg0LgiXbuqFDsCVwumEFvBRrukZL5mIb0i1b0gBpUqW1V6QRNK8tonuHc0lJlIf2H+pAB+f7vt/vfL/fdw8qQR6E8Dn8AmLQPlSFjMiMkMS7GEaSZWJlJJ+PcJzs43nO8xSsPfWiLnnkJ/Wv/Ep06gae/Mvh/55/Fb+wtQRfmX3iCeXo9ZMnD9+9q/jh3+8ihBBW30UIfohzaB8yIMRzkk8QfIRlASSe+Aj3SdtbZboync4uKf8MJ46kx4w/XYTLy8vhM62x08oYzm0t376NEIMIQrgO55AB2ela4qWQxWxiWY6zaH8JI4WikbBAdhdk9bW5pcakB6T+gasjbdnskb6ho2fPZ89lBh/FuaEBsVcs1em7WwdnRbg4IAdCW3f60qE4rRtQTN3EAfwSciJU4haESDiBpZDFygkCcVdis8likUJR2cqy4B5+MNp85Fq6dWx/lI8KbXM9HvdQe32yjnhm9clLI5kXHhuQ/Q11vviJSx3ts5G6AyFngHJDceCoxg1fhIj4pFB0G8HvPPO1yZcfnpqavJo8fTyKc793+bFvnew69AfHZhfzddIY1TiHymkEF+fiJI5wLo6swpkK5RP/F5WfSyBU4lz3D3vu9RRwteOXkFvD9RtgyUSWGJYF8eK15qNPjrWP2WRerk8s9HlIutMT473XK34Q82T1z10aeeGx/h1wbdno/uq/6VI+rfXu1La4XZvEuHiJIbyLIasjrVDfmlkd6VTeT+CcchfMW8vQqqzlz6BNnENM/gxZHVnFua3lnXiHcQ7p83sSSBxPGI4jqyPdDAxO3/v9scefCeCccgt6v1SWYOHpD7fPwfM4h0oKddADF8FUgXNbN3sKcW/hHLJp+7xVkrVKo1GZcAxhaL9yDFmdjVl0/W/Nrg6n99n1uoP/IMYtOraydAjnlD++fh0WtpbhvHim8XnlGzDzvLgoKjcQRh3qJs7il1A1qitm3GI2VWJfKIHpPeeZB+e5leDUSv/QyXBw6tFk5HDCPTRCfwf1f3h1OLfS13tlYvi5lb5kx8JK7NhK+8JK2/zFnT4KaDybivuIMPyuFL49c37oyUOL4e65k2fSqZM4NzQ1erpF+SUMjB6MSbSXaK1ZrdYqJCLk3VOc1S34dlSgFc9tKwBIUan/O3HZNnG4AKNx5KEew2S46kBFiSvSfvxiW77qhYv/kR7lv362gCn11fODbGOjjomXF7D4cA5VIMsuFnrNe9B8a+aRcxMXJpbOy73HsyeGU/M41z9x9JxB+QQsyh2YHO+PNlFMgPTqJij4JeRHiGKQtaojYcGnwYlGd7qfZSlMa95NPksu18cck3LHWMCb9rdHZtrb552SrT/ojThaPOmmcPspfVtbY2Oot9UTsgTtg3JoPBSuD9Y2OJsPCE2WQM2A3HY0jADNIoQjOIc4iobILo4wf7HyZgW8W/GdFZxJJrfeyNd5UN3Ep3COota6JEp7kJZESaZLFmpPnGV1QyPD+7r6Wo+Yx9LjNU/pF0+Zm2ywrDwTcPdnZs7C88rZG5fpXfrUTfglbCATZdS6q3RJlhgiE5b1haKyvCP7N7rS4lBW8sUNOj5xrLNUR6aNwkGPaA7VeJIRZ4v+6GT/5Rmp3hVX7ClvU1ew6T8Ft39wNtSp+SVGTnUTfoHXkJlOE8o04QgvcZykUbyn2zXPvuOLGxhT542Mz4I9hwJa+ognGaltbnCPkaBJ0te74njtzXlH45EpmrrLPzgrJeJ+72eCGwHyqptwEzZQzR50uzdZcOf3D54QM8ciYoclwAuO5qlorK0uanHbM/pTs70XJpvctmaruXc52dNvN4RM1Lby3GFfEZZd7n47eW1GplrI5ArsjXjvZ89XN/fmVuv99GENy3dgA9mRtzgf7UTOxe5MGkaKUjVThJ9OLQaGZ5rl7lp9ifK9fXVJvyNmrXWM/ZGKGWMDiWT1Z471LY+LwdFQjVTZOeq1GSSzE7zl+ytqWpyTCFAjQvA1/B6yan3ZiYuVwNEhwjROdpZ3V1eNxO1+44GyAwZXQ6lhQX98Er4ZKxkbmqgol7myUONEQpmm/QaqBzZgAzlRsFhpssyypJhB2snMHvZebZkinpq++sRQpU041BQfbRycaRESBobvPMVfiJExd6OlpYZ0S7VNHwqOiNWd7npQEKcmk48+EKL9yMydAlej/18Ed0P/dHN7O71DoHMb3sdrBU/f7UNOM/ZImLhZjnHeyDRX6xrGxUSkNJHu0OlSNalgH167GydN3a1Oj/IOiKb9FcP+oPJNVaUx0a/xTSygGEKIRW2p3Vw/x2s7c4mnc8nHcc4bmXn8q+nvrozMLtvxmuIAeFf5yc/PX0GARHUT/RqvISNlKxLW1M6aTYWrfqibvZK5BmBgWA7KLPpOgw2f3XqO28cYAbfrdDt58R3YoN5GMeYhWgtA2T1Ii0Ef6+R0woTQ1lLSNO2NR3W6RCau0w2YU2If5aDfkmrsg/VBT4tcL0rdrYZaUzEPu6sd7O/DBtpfXMP9NNOMDePBPSxrGe4neUd/8AFsoCrkKNZD3kRo1G2Rv3cwKw5lQwfnxOGsPzAmRUP0R//g0b4Lk8H8b1fPcm/PQHK5t6efxlbvqRL8Ajby2uaKKq7ERHMtjt/jU2XPdrKMdzKoGVRI6OCx0fnnxT51G7/R5QwUBO588GWAglEJP/W6tvFImhdrOUtkmfw/TexVBLhctdg7HSz25GdfLjaU2y8/JjTtWPJWBmCvIWu9AVdhA1UX3YuVE7bvo1znSAds5gPVdk/aGYf1WTG+r7e0s125jUD9Ut2Ea7CBfPfPzPtHJp2Y+YH5Zy2ztmZrl+CPN7QGY+KgGByqCfKSS2iJ1iXCzeP6cL3grA8Su89pTzQ0dns9tfUme8BZKxjdHWKg10tr7lA3YRov7Xh6VOZJJ5Y0Nyry9G93hXUQGyhPe7oPXNFfizE17kp7uaG6Sd8ZqLJXgDFW8vTTCeWO0VhbW1Yic1U0dqu6CZ/DOrLtxt5VHF+w9Vd31JByDIh9aToI6w/pe2SDk4eo8h5vo20K04p9iGjfTIDaEYKPYR1VIESVb7FYpSgNCE8NpD06VqczePivZ5QtWFc+I8PEM+gBm2LPn+1HCL8N68h139ndFUOY/HuJYxZJuhoAdFUHqr8ybMAYdJX26idSP5qr1P7rqLoI68qP3b1ud68baotWdigjKY8nRZR7CNT3EIJ/y/NAeJ9kLaSSJc5KCm8zjhP/6+iIv7SS01XVVU1OrB0/KJYaynTVbj4L+NMli89sajAv/c8X5y1Bi0W0XkAI1O+qTfAJrCM7Qpz2nUV5lfcwUonZsrpKm9Ho7bYZJ9JCSSmjM3iNX00rP7a1p/6V42L74iECnymfuzKEpN1g2PqiKSNSrjDyq5vwA/wsMlC2rG7ht3xIr4UGvP7B+Uio39MwONfiS4YdYlD71bceTzzwJ1cH2o4njrxypT/e+8j13uThvkeu9/YcRqDeQwi+h5+lGIicYAom4NsxCM7FlZXO38g2SZG6brdPPNw8Pu0fvzoBJn1w7MrCA0Gxw+VsFhoe6I1k55dTPbRu2ny38eOoDJkQchHZJYPESBzxSjJ9X7AsB8MpovxsH2QPjU7oJxT1HwXWyOlM9abXw/CispxI/L2j21UT3k95AITUTfgAP47qirVZsETOx7s4whXqZdlb3VlHyNLd6k+JnWGnWOcahcaKn4UNfltqLnlO3xlocIX9GSnRUW2wQ6DnVql+ciL9cN4/FhHCJfhxbaYlsOySXVwl5i45hh4eU96phBtlxy8mrZfe/qvRntDsre8/pJ2xqpvoOlqi7728xvJ19FtsvhrLfq++xmIXHRabSPvlY3UG5dAS9SfOR5koOmAqb4px2FJLHPaaI98IGjs8dovN56kdpM9AVdXyrMGPsA+1oC54BLGopfDO+wjKwEbfjrIscUT/QcVH298DBH2MPwJrfs/FkXL8evnH0Sg9p36o/i68rv4t3eNkF+cph38quxoKaXt/p87Dn+Lva3sgQQputiqZV5hTX76Yj9uMTsM72E8xyxESkSKSWTIT80d//VrHa6+ffjv21luxtwt+jG7D+va71nksswDrmhEAGsDD6Ca+SWPwRTRc4muJ1eQgeNhqsbn2W2x1/wcAAP//AwDWbrmVAAEAAAABGFF4/VtnXw889QABA+gAAAAA2F2gzAAAAADdZi83/r3+3QgdA8kAAgADAAIAAAAAAAAAAQAAA9j+7wAACED+vf28CB0D6ADC/9EAAAAAAAAAAAAAADt4nATAIUtzURzH8e/vt/g8omC4znLC3+2CEzQ6vFVXBA1is2sxWfY2fB8mi3FqEQSTceEM88oNU2Ts+PEdO7yBVuXdI8J9hj4n9E34lKFvCZaE9wl9EH4mPKZxn/CYxgNCv/zXiitfc+YutbdIeqTnilozetpm4E3kfyTmJE1J/LDXSSSvkdyhdlUW7lLrkqT7stQxjTc41IQjv3Kih/KpSXlRZle5LJRZVwZlbmipaMuMlkoDoiNCX2Wqi/KkzAFzEjD6AwAA//8DAFuyN6wAAAAALgAuAFIAigC8AN4A9gEsAUYBVAFwAYABrgHgAgQCRgJuAq4CwgLqAyIDWgOIA8AD+gQiBGoElASgBLoE3AUeBUgFdgWwBeoGCAZEBnIGnga8BvYHIgdSB4QHrgfWCAoIJAg6CFgIZAhyCIAIjgieCLIIwAjWAAEAAAA7AIwADABmAAcAAQAAAAAAAAAAAAAAAAAEAAN4nJyU3W4aVxSFP2KgTf8uKitybqxzmUrO4EZxlMRX4zpWRkWQMqQ/UlVpgDEgYGbEDDjOE/S6b9G3yFUfo09R9bramw1hIqtWUBRrDWf/rLP22gfY51/2qFTvAn/Vl4YrHNZ/NnyHL+pNw3uc1T8zXOWo9rfhGoPaW8N1HtQ6hj/hXfUPw5/yuPqb4bscVC8Mf86j6r7hL/cc/xj+ise8W+EKPOV3wxUOyAzfYZ9fDe9xD6tZqXKPY8M1vubQcJ1DoMuYgiljEoY4LhkzZMGcmJyQmDljLokZ4AjwmVLorwmRIsfwxl8jQgrmRFpxRIFjSsiUiJyRVXyrWSmvtKP0mSuSbj4FIyJ6mjEhIsGRMiQlIWaidQoKMp7ToEFOX/lmFOR45IyZ4pEyZ0iDNhc06TJiTI7jQisJs5CUSwquiLS/swhRpk9MQm6sFiQMlKdTfrFmBzRxtMk0drtys1ThCMePmi3cJMbxLZ7+d1vMyn3XbCKWqqdo2GOqPK90giNVXPr6/KC44DluJ33KTG7XaKDsZNZjeix0/jI/yRMmCc4d4BOqg0J3H8eZfgeEqshPBHR5SZvXdPXbp0MHnxZdAl5obpsOju9o0+JcMwLFq7MLdUyLX3B8T6AxUjs2fURz+XpDZu4W7uIMuceMTLdAZiz3F+fHO01YdigtuSNXV/R1jyRS9kBUkT2LGJorMnXFTLVceyM3/QbmCDktdLbvz2UblrZ76y2+JtUddiyMk0xuxei2qXofeOZK/3lEDEjpaUSflBkNCq71bq+IWDDFca4+fqlbUuBvcqTPtbokZqYMAhKtMyfTv5H5JjTu/ZLvnb0lsnkz3dHJ5la7dJHKydaMXqt667PQVI63JtCwqaaWIxOWyqubivcl2ivxD9X9ub5uKQ8JtK5Msn/jK3DMM044ZaRdpHrCcnMmr4REnKoCE2KNkjfzjWr1CI8TPJ5wwgnPePKBlms2zvi4Ep/t/j7nnNHm9NbbrGLbnPGiVO3/O/+pbI/1Po6Hm6+nO0/zwUe49huOSu9mR18D2aClVXu/HS0iZsLFHWxr4e7j/QcAAP//AwByoVFAAAADAAD/9QAA/84AMgAAAAAAAAAAAAAAAAAAAAAAAAAA");
+	font-family: d2-37886755-font-italic;
+	src: url("data:application/font-woff;base64,d09GRgABAAAAABPgAAoAAAAAHogAARhRAAAAAAAAAAAAAAAAAAAAAAAAAABPUy8yAAAA9AAAAGAAAABgW1SVeGNtYXAAAAFUAAAAvAAAARhGIOgOZ2x5ZgAAAhAAAAyyAAASJGJ3I9poZWFkAAAOxAAAADYAAAA2G7Ur2mhoZWEAAA78AAAAJAAAACQLeAjhaG10eAAADyAAAADVAAAA9HEZBuBsb2NhAAAP+AAAAHwAAAB8kMaVDm1heHAAABB0AAAAIAAAACAAVQD2bmFtZQAAEJQAAAMrAAAIMgntVzNwb3N0AAATwAAAACAAAAAg/8YAMgADAeEBkAAFAAACigJY//EASwKKAlgARAFeADIBIwAAAgsFAwMEAwkCBCAAAHcAAAADAAAAAAAAAABBREJPAAEAIP//Au7/BgAAA9gBESAAAZMAAAAAAeYClAAAACAAA3ichM25NjMBHMbhZ5L5PtuILfZtjF0SewSd0lGrc5SOK3Bf9NyFktuw/R2j0zhv+zvvg0RVgkyaZCjkUhW5hqaWHbv2tXWcOnep69ptXo/gV3NYNmcudF25+W7iRU2PXn3xGR/xHm/xGo/xEE9xH3fPRSn/tcSJA23Htktpr7QqqlL//P/5129AZlDNkGEjRo2pG9cxYdKUaTNmzZm3YFFuSWHZilVr1m3YtKWhqeWILwAAAP//AwCdiCg8eJx8V39QG1d+f9+3yy4/xA9p9cOSEUJ60gqklQCtpEWABEIgBEjYgMHEBoHxr2ATh9jBsWs7uYRO6mQuPiXjXqeZTJ32rp3rZNpknGunN+PmppfrhSb1TdvJ9dIml5lccuTO7k0Shrp3N2HV2ZUA4U7zz+qN3r7v+34+7/v5fPehMuRECJ/B1xGFKlAt0iEDQiJnpyhRkoiJEt1uwrKSm+NY51Ow+tSLdOLQL5pe/q1gowee/Mvh/5p7BV/fXISvzTzxhHz46vHjB+/elT3w73cRQgjn30EIfoJzqAJpEeJY0c3zbsIwACJH3IT9uOPNSrqSpi2i/M9w7FB6VPfLBbi4tBQ81R45KY/i3ObS7dsIUYgghBtxDmmRRRmLnBgwGvQMw7JG9ZdQYiAcCvJkZ0BWXp1d9CacICYHLo90ZLOH+ocOnz6bPZMZfBTnhgaEPqGc1sTbB2cEOD8g+QKbd/rTgaiSN6BIfgP78EvIhlCZg+dDwRgWA0YTy/PEUYMNeqNRDIQlE8OAY/jBcOuhK+n20T1hLsx3zPY6HUOdTYlG4pzRJC6MZK4/NiB5mhvd0WMXujpnQo17Azafwo2CA4dVbrgSRMQtBsJbCH7vmecmbjw8OTlxOXHyaBjn/uDiY9893nPgm0dmFgp5KjHqcA5VKRHsrJ0VWcLaWbICp6rljz1f1HwmAl+Dc/Gf9N7rLXm/ouR9qvi274vqz7twLv5Jr/zTLQ468UvIoXLw/1AgEUmkGAaE81daDz852jlqljipKTbf7yTpbmeEc12t/nHEmdU8f2Hk+mPJbSI6suE9dX/TI3/S4NrGsbCFQ6TsnEgRzk6RlZF2aGrPrIx0y+/FcE6+C4bNJWiXVwtr0AbOIaqwhqyMrODc5tJ2vIM4hzSFORFEliMUy5KVkTgFg1P3/nD08Wd8OCffgr4v5UWYf/qDrXXwAs6hsmIeyoLzoK/Guc2bW/zdwjlkVuc5kyipmYbDEmEpQim1zVJkZSZipJNvzqwMpyssGnrfPwhRI83UlA/hnPwnV6/C/OYSnBVOeV+Qvw3TLwgLgnytGPsEziFuK3Y4rEbfjjryTQ/N1FT2D69krntpprYyiXPy9DNtD4kwvbkE33pOPBWQb6i11ZXfwFn8EqpDjaWnZzToa7A7EMNKfRVOEWxnlv2Ty8mh40H/5KOJ0MGYY2hEeQ5q/ujycG65v+/S+PDzy/2JrvnlyJHlzvnljrnz2/XrU89MX1q/hOJ2JPi96bNDTx5YCMZnj59Kp47j3NDk/pNt8m9gYP++iIiKuWbVXGuRgJBrV3ImB+/eVp+aPLulPCAlqf7P+EXz+MEiDO/IQ73aiWDt3uoye6jz6PmOQtbz53+a3s9943QRU+rrZwcZr5emolVFLG6cQ9XIuINFKZldaL47/ciZ8XPji2elvqPZY8OpOZxLjh8+o5U/BqN8BybGkuEWBRMgTX4DZPwS8iCkYJDUrENB3q3CCYe3lcQwCkxTwcU+TSw1RawTUteoz5X2dIamOzvnbKI56XeFrG3OdEuw84Smo8PrDfS1OwNGv2VQCowFgk3+hmZb616+xeirH5A6DgcRoBmEcAjnEKugIZKdJdRfLL9RDe9Uf38ZZxKJzdcLee7Lb6g1ZyxWiVpxSkoKycqQgYZjpxl6aGS4oqe//ZBhND1W/5Rm4YShxQxL8jM+RzIzfRpekE9fu6icpTu/Ab+BdaRXGDXtuIYoiRSRCMO4A2FJ2raQ13vSwlBWdEe1NBc70l1Okykdv88pGAL1zkTI1qY5PJG8OC022aOyJeVq6fG3/Afv8AzOBLpVn8bIlt+Az/EqMihdTGGasIQTWVZUKd5V7WqvuOOOail997WM24idB3zq9iFnItTQ2uwYJX69qGmyR/HqG3NW76FJZesez+CMGIt6XJ/yDgTIld+Am7CO6neh2znJYld4b98xIXMkJHQZfRxvbZ0MRzoaw0aHJaM5MdN3bqLFYW41GfqWEr1JizagVyywwB12l2DZ4e6ryevQUXV8Jldkb8R1P3vuxtk3Ntvvpw+rWL4P68iCXKX7KZXI2pntDkeJYUXNCsJPJhd8w9OtUrxBUyb/sKIx4bFGTA3W0T/OY0rXTEJZzakj/Utjgn9/oF6s6d7vMmtFgw1cVXuq69tsEwiQFyF4Dr+LTGpdduNSJbBK86K8E91V8brakajFo9tbuVdrby7XzmuOTsB3ImWjQ+PVVRJbGfCOx+Qppd4g74R1WEc25C9VmiQxDCllUKlkahd7r7RNEmd9f1NsqMbMH2iJ7vcOTrfxMS3FdZ/gzkXIqMNrbKsncbGh5QPeGjI50j0P8sLkROLRBwJKPVKzJ8Du9fwL72hOTrV2dipnCMr3AryHV4v9YacOWbVJhILEwbCU7VqmtY5uHhNiofJYuoumU/Upfz9evRslLfF2m1N+GwT9nuphj1/+Tj6vxES/wzcxjzoQQgzqTO3s9Wu8ut3jOKXHuVnWdi0zh3879YPlkZklC16VrQDvyL/49dlLCJCQ30C/w6tIp7AVCqpqZwz64lE/FGcuZa4AaCmGhUqjpltrxqc3n2crKB3gTpre3hffgXXF2xSMBYimIlBmF9JS0Ee6WZof5zvaylqmXNEwTccyUZoeMKSEfoWDpDHl7Ye1QWeb1CSI8XZtg76Uh53RNvb3YB3tKc3hfpqVHZvH/LtYVne4n+Rt/cH7sI5qkbVUDwUTUaJuifzdfVlhKBvYNysMZz2+UTEcUB6aBw/3n5vwF549vUt9vQOJpb7epBI7fy8vwuewXtA2W5JxDSaqa7HcLp+qfLaboVwTftWgAnwXh3W2Py/1qdv49R6bryhw24M3AIpGxf/SZd/CI6perO5ZJknk/2hityLAbm/Aril/qSc/e6PUUG7feIxv2bbkzQzAbkNWawMuwzqqKzkXE8tvnUcVbU37zIa9dRZn2haFtRkhWtFX3t0p30aQ/zK/AVdgHbnv75n3t0ylYxYa5rfaZsytph7eE21u90eEQcE/VO/nRDvfFm6MBVvHNMEm3tbkJxa3zRJr9sZdzoYmvcVna+B1ji7B1+dScu7Kb8AUXtz29LDEkW4sqm5U4unf6wnSEBmoSjvjey9prkSoekeNpUpb16Lp9tVaqkEXKXv66Zh8R6draKgsk9haJXZ7fgM+gzVk3om9oziuaOuvbKshZR0Q+tNKI2w6oOmVtDYOwvK7nFkpU5iSLUNE/WYC1IkQfARrqBohRflGY/FrEZ4aSDtphqa1Tu4bGXkT1uRPyTBxDjrBLFsKa5MI4bdgDdnvW7szoghVuKex1AJJ1wEAXbu37mvDWoyBrrHUPZH62WyN+q+19jysyT939DkcfQ5oKBlZoJKknM4Uke8hyL+LEPxbgQfCuUVTcStJZE2keCdkWeE/D494ymtYuraxdmJ89eg+oVxbSdc5uCzgTxaNboO+2bD431+cNfqNRsF0DiHI/yDfAh/DGrIgxKrfWQqv0i5GajBT2Vhj1ulccbNuPM2XlVO01qX7elr+ubkz9a8sG6mIBgh8Kn9mzxCSdoB284uWjKBwhZEnvwE/xs8ircKWycF/xYf0amDA5RmcCwWSzubB2TZ3ImgV/OpT03409sCfXh7oOBo79PKlZLTvkat9iYP9j1zt6z2IIH8PIfghflbBQKQYVTQB97ZBsHa2snzuWrZFDDXGHW7hYOvYlGfs8jjoNf7RS/MP+IUuu62Vb36gL5SdW0r1KnkrxXcbP44qkR4hO5HsEoiUyBKXKCl3FYZhYThF5F9VQPbA/nHNuJz/R57RsbS+Sf9aEF6Ul2Kxv7fG7fXBPQoPgFB+A97Hj6PGUm0WLZF1c3aWsMV8GeZWPGsNGOPtnpTQHbQJjfb94K3+VVDrMadmE2c03b5me9CTEWNddVoL+HpvlWsmxtMPF/xjASFchh9Xe1oMS3bJztZg9oJ16OFR+e0auFZ59HzCdOGtv9rfG5i59aOHlDX5j/LTKIcWFc9h3Qo6pfEXk9FXtURYbGwgVkv9oW/7dV1Oi9HsdjYMKtfEfB6Z8htoFX6G3agL9cAjiEFdxXvgh1AJZuVuKUkiSzTvV3+41eMJ+gh/CKbCnJ0lVfi1qo/CYWVd/oP878Nr+b9V5ljJzjqr4J8qLwcC6tzf5efgz/CP1DkQIQU32+XMy9SJL18sxG1FJ+Ft7FHuwFKIhMSQaBANxPDhX7/a9eprJ9+KvPlm5K2ix6LbsLZ177UdyczDmipuQAN4GN3EN5UYXAkNF7gGYtJbCR42Gc32PUZzIwIV+1W0qLxrKnk3aTS76417XJp6o0WwGs0C+l8AAAD//wMA6ZfVHAAAAAEAAAABGFE3lFj7Xw889QABA+gAAAAA2F2gzAAAAADdZi83/r3+3QgdA8kAAgADAAIAAAAAAAAAAQAAA9j+7wAACED+vf28CB0D6ADC/9EAAAAAAAAAAAAAAD14nATAIUtzURzH8e/vt/g8omC4znLC3+2CEzQ6XNUVQYPY7Ipgsuxt+D5MFuPUIggmi7Bwhnnlhikydvz4li1eQcvy5iHhLn2fEvom9En4mL5vCBaEdwm9E34ifE14xMBdwiMG7hH65b+WXPiSE7epvUHSAx1X1JrS0SY9ryP/IzEjaULih51WInmF5Ba1qzJ3m1rnJN2VhQ4ZeI19jTnwC0e6Lx8al2dltpXLXJlVZVDmiqZMaajUI1oi9FUmOiuPyuwxIwFDGqo/AAAA//8DAOd7OTkAAAAAAAAuAC4AUgCKALwA3gD2AQwBQgFcAWoBhgGWAcQB6gIcAkACggKqAuoC/gMmA14DlgPEA/wENgReBKYE0ATcBPYFGAVaBYQFsgXsBiYGRAaABq4G2gb4BzIHXgeOB8AH6ggSCEYIYAh+CIoImAimCLQIxAjYCOYI/AkSAAEAAAA9AIwADABmAAcAAQAAAAAAAAAAAAAAAAAEAAN4nJyU3W4aVxSFP2KgTf8uKitybqxzmUrO4EZxlMRX4zpWRkWQMqQ/UlVpgDEgYGbEDDjOE/S6b9G3yFUfo09R9bramw1hIqtWUBRrDWf/rLP22gfY51/2qFTvAn/Vl4YrHNZ/NnyHL+pNw3uc1T8zXOWo9rfhGoPaW8N1HtQ6hj/hXfUPw5/yuPqb4bscVC8Mf86j6r7hL/cc/xj+ise8W+EKPOV3wxUOyAzfYZ9fDe9xD6tZqXKPY8M1vubQcJ1DoMuYgiljEoY4LhkzZMGcmJyQmDljLokZ4AjwmVLorwmRIsfwxl8jQgrmRFpxRIFjSsiUiJyRVXyrWSmvtKP0mSuSbj4FIyJ6mjEhIsGRMiQlIWaidQoKMp7ToEFOX/lmFOR45IyZ4pEyZ0iDNhc06TJiTI7jQisJs5CUSwquiLS/swhRpk9MQm6sFiQMlKdTfrFmBzRxtMk0drtys1ThCMePmi3cJMbxLZ7+d1vMyn3XbCKWqqdo2GOqPK90giNVXPr6/KC44DluJ33KTG7XaKDsZNZjeix0/jI/yRMmCc4d4BOqg0J3H8eZfgeEqshPBHR5SZvXdPXbp0MHnxZdAl5obpsOju9o0+JcMwLFq7MLdUyLX3B8T6AxUjs2fURz+XpDZu4W7uIMuceMTLdAZiz3F+fHO01YdigtuSNXV/R1jyRS9kBUkT2LGJorMnXFTLVceyM3/QbmCDktdLbvz2UblrZ76y2+JtUddiyMk0xuxei2qXofeOZK/3lEDEjpaUSflBkNCq71bq+IWDDFca4+fqlbUuBvcqTPtbokZqYMAhKtMyfTv5H5JjTu/ZLvnb0lsnkz3dHJ5la7dJHKydaMXqt667PQVI63JtCwqaaWIxOWyqubivcl2ivxD9X9ub5uKQ8JtK5Msn/jK3DMM044ZaRdpHrCcnMmr4REnKoCE2KNkjfzjWr1CI8TPJ5wwgnPePKBlms2zvi4Ep/t/j7nnNHm9NbbrGLbnPGiVO3/O/+pbI/1Po6Hm6+nO0/zwUe49huOSu9mR18D2aClVXu/HS0iZsLFHWxr4e7j/QcAAP//AwByoVFAAAADAAD/9QAA/84AMgAAAAAAAAAAAAAAAAAAAAAAAAAA");
 }]]></style><style type="text/css"><![CDATA[.shape {
   shape-rendering: geometricPrecision;
   stroke-linejoin: round;
@@ -32,79 +32,79 @@
   opacity: 0.5;
 }
 
-		.d2-625626608 .fill-N1{fill:#0A0F25;}
-		.d2-625626608 .fill-N2{fill:#676C7E;}
-		.d2-625626608 .fill-N3{fill:#9499AB;}
-		.d2-625626608 .fill-N4{fill:#CFD2DD;}
-		.d2-625626608 .fill-N5{fill:#DEE1EB;}
-		.d2-625626608 .fill-N6{fill:#EEF1F8;}
-		.d2-625626608 .fill-N7{fill:#FFFFFF;}
-		.d2-625626608 .fill-B1{fill:#000536;}
-		.d2-625626608 .fill-B2{fill:#0F66B7;}
-		.d2-625626608 .fill-B3{fill:#4393DD;}
-		.d2-625626608 .fill-B4{fill:#87BFF3;}
-		.d2-625626608 .fill-B5{fill:#BCDDFB;}
-		.d2-625626608 .fill-B6{fill:#E5F3FF;}
-		.d2-625626608 .fill-AA2{fill:#7639C5;}
-		.d2-625626608 .fill-AA4{fill:#C1A2F3;}
-		.d2-625626608 .fill-AA5{fill:#DACEFB;}
-		.d2-625626608 .fill-AB4{fill:#EA99C6;}
-		.d2-625626608 .fill-AB5{fill:#FFDEF1;}
-		.d2-625626608 .stroke-N1{stroke:#0A0F25;}
-		.d2-625626608 .stroke-N2{stroke:#676C7E;}
-		.d2-625626608 .stroke-N3{stroke:#9499AB;}
-		.d2-625626608 .stroke-N4{stroke:#CFD2DD;}
-		.d2-625626608 .stroke-N5{stroke:#DEE1EB;}
-		.d2-625626608 .stroke-N6{stroke:#EEF1F8;}
-		.d2-625626608 .stroke-N7{stroke:#FFFFFF;}
-		.d2-625626608 .stroke-B1{stroke:#000536;}
-		.d2-625626608 .stroke-B2{stroke:#0F66B7;}
-		.d2-625626608 .stroke-B3{stroke:#4393DD;}
-		.d2-625626608 .stroke-B4{stroke:#87BFF3;}
-		.d2-625626608 .stroke-B5{stroke:#BCDDFB;}
-		.d2-625626608 .stroke-B6{stroke:#E5F3FF;}
-		.d2-625626608 .stroke-AA2{stroke:#7639C5;}
-		.d2-625626608 .stroke-AA4{stroke:#C1A2F3;}
-		.d2-625626608 .stroke-AA5{stroke:#DACEFB;}
-		.d2-625626608 .stroke-AB4{stroke:#EA99C6;}
-		.d2-625626608 .stroke-AB5{stroke:#FFDEF1;}
-		.d2-625626608 .background-color-N1{background-color:#0A0F25;}
-		.d2-625626608 .background-color-N2{background-color:#676C7E;}
-		.d2-625626608 .background-color-N3{background-color:#9499AB;}
-		.d2-625626608 .background-color-N4{background-color:#CFD2DD;}
-		.d2-625626608 .background-color-N5{background-color:#DEE1EB;}
-		.d2-625626608 .background-color-N6{background-color:#EEF1F8;}
-		.d2-625626608 .background-color-N7{background-color:#FFFFFF;}
-		.d2-625626608 .background-color-B1{background-color:#000536;}
-		.d2-625626608 .background-color-B2{background-color:#0F66B7;}
-		.d2-625626608 .background-color-B3{background-color:#4393DD;}
-		.d2-625626608 .background-color-B4{background-color:#87BFF3;}
-		.d2-625626608 .background-color-B5{background-color:#BCDDFB;}
-		.d2-625626608 .background-color-B6{background-color:#E5F3FF;}
-		.d2-625626608 .background-color-AA2{background-color:#7639C5;}
-		.d2-625626608 .background-color-AA4{background-color:#C1A2F3;}
-		.d2-625626608 .background-color-AA5{background-color:#DACEFB;}
-		.d2-625626608 .background-color-AB4{background-color:#EA99C6;}
-		.d2-625626608 .background-color-AB5{background-color:#FFDEF1;}
-		.d2-625626608 .color-N1{color:#0A0F25;}
-		.d2-625626608 .color-N2{color:#676C7E;}
-		.d2-625626608 .color-N3{color:#9499AB;}
-		.d2-625626608 .color-N4{color:#CFD2DD;}
-		.d2-625626608 .color-N5{color:#DEE1EB;}
-		.d2-625626608 .color-N6{color:#EEF1F8;}
-		.d2-625626608 .color-N7{color:#FFFFFF;}
-		.d2-625626608 .color-B1{color:#000536;}
-		.d2-625626608 .color-B2{color:#0F66B7;}
-		.d2-625626608 .color-B3{color:#4393DD;}
-		.d2-625626608 .color-B4{color:#87BFF3;}
-		.d2-625626608 .color-B5{color:#BCDDFB;}
-		.d2-625626608 .color-B6{color:#E5F3FF;}
-		.d2-625626608 .color-AA2{color:#7639C5;}
-		.d2-625626608 .color-AA4{color:#C1A2F3;}
-		.d2-625626608 .color-AA5{color:#DACEFB;}
-		.d2-625626608 .color-AB4{color:#EA99C6;}
-		.d2-625626608 .color-AB5{color:#FFDEF1;}.appendix text.text{fill:#0A0F25}.md{--color-fg-default:#0A0F25;--color-fg-muted:#676C7E;--color-fg-subtle:#9499AB;--color-canvas-default:#FFFFFF;--color-canvas-subtle:#EEF1F8;--color-border-default:#000536;--color-border-muted:#0F66B7;--color-neutral-muted:#EEF1F8;--color-accent-fg:#0F66B7;--color-accent-emphasis:#0F66B7;--color-attention-subtle:#676C7E;--color-danger-fg:red;}.sketch-overlay-B1{fill:url(#streaks-darker-d2-625626608);mix-blend-mode:lighten}.sketch-overlay-B2{fill:url(#streaks-dark-d2-625626608);mix-blend-mode:overlay}.sketch-overlay-B3{fill:url(#streaks-dark-d2-625626608);mix-blend-mode:overlay}.sketch-overlay-B4{fill:url(#streaks-normal-d2-625626608);mix-blend-mode:color-burn}.sketch-overlay-B5{fill:url(#streaks-normal-d2-625626608);mix-blend-mode:color-burn}.sketch-overlay-B6{fill:url(#streaks-bright-d2-625626608);mix-blend-mode:darken}.sketch-overlay-AA2{fill:url(#streaks-dark-d2-625626608);mix-blend-mode:overlay}.sketch-overlay-AA4{fill:url(#streaks-normal-d2-625626608);mix-blend-mode:color-burn}.sketch-overlay-AA5{fill:url(#streaks-normal-d2-625626608);mix-blend-mode:color-burn}.sketch-overlay-AB4{fill:url(#streaks-normal-d2-625626608);mix-blend-mode:color-burn}.sketch-overlay-AB5{fill:url(#streaks-bright-d2-625626608);mix-blend-mode:darken}.sketch-overlay-N1{fill:url(#streaks-darker-d2-625626608);mix-blend-mode:lighten}.sketch-overlay-N2{fill:url(#streaks-dark-d2-625626608);mix-blend-mode:overlay}.sketch-overlay-N3{fill:url(#streaks-normal-d2-625626608);mix-blend-mode:color-burn}.sketch-overlay-N4{fill:url(#streaks-normal-d2-625626608);mix-blend-mode:color-burn}.sketch-overlay-N5{fill:url(#streaks-bright-d2-625626608);mix-blend-mode:darken}.sketch-overlay-N6{fill:url(#streaks-bright-d2-625626608);mix-blend-mode:darken}.sketch-overlay-N7{fill:url(#streaks-bright-d2-625626608);mix-blend-mode:darken}.light-code{display: block}.dark-code{display: none}]]></style><g class="Y2xpZW50cw=="><g class="shape" ><rect x="258.000000" y="20.000000" width="1040.000000" height="126.000000" stroke="#000536" fill="transparent" class=" stroke-B1" style="stroke-width:2;" /></g><text x="778.000000" y="7.000000" fill="#0A0F25" class="text fill-N1" style="text-anchor:middle;font-size:28px">Clients</text></g><g class="ZmFub3V0"><g class="shape" ><rect x="239.000000" y="307.000000" width="1470.000000" height="751.000000" stroke="#000536" fill="#87BFF3" class=" stroke-B1 fill-B4" style="stroke-width:2;" /></g><text x="974.000000" y="294.000000" fill="#0A0F25" class="text fill-N1" style="text-anchor:middle;font-size:28px">fanout — one Go process</text></g><g class="c3RvcmU="><g class="shape" ><rect x="769.000000" y="1219.000000" width="1240.000000" height="194.000000" stroke="#000536" fill="transparent" class=" stroke-B1" style="stroke-width:2;" /></g><text x="1389.000000" y="1206.000000" fill="#0A0F25" class="text fill-N1" style="text-anchor:middle;font-size:28px">Storage</text></g><g class="bW9kZWw="><g class="shape" ><rect x="0.000000" y="954.000000" width="189.000000" height="66.000000" stroke="#0F66B7" fill="#E5F3FF" class=" stroke-B2 fill-B6" style="stroke-width:2;stroke-dasharray:6.000000,5.919384;" /></g><text x="94.500000" y="992.500000" fill="#0A0F25" class="text-bold fill-N1" style="text-anchor:middle;font-size:16px">Anthropic or OpenAI</text></g><g class="Y2xpZW50cy5jb2xsZWN0b3I="><g class="shape" ><rect x="288.000000" y="50.000000" width="200.000000" height="66.000000" stroke="#0F66B7" fill="#BCDDFB" class=" stroke-B2 fill-B5" style="stroke-width:2;stroke-dasharray:6.000000,5.919384;" /></g><text x="388.000000" y="88.500000" fill="#0A0F25" class="text-bold fill-N1" style="text-anchor:middle;font-size:16px">OTLP collector or SDK</text></g><g class="Y2xpZW50cy5icm93c2Vy"><g class="shape" ><rect x="548.000000" y="50.000000" width="104.000000" height="66.000000" stroke="#0F66B7" fill="#BCDDFB" class=" stroke-B2 fill-B5" style="stroke-width:2;stroke-dasharray:6.000000,5.919384;" /></g><text x="600.000000" y="88.500000" fill="#0A0F25" class="text-bold fill-N1" style="text-anchor:middle;font-size:16px">Browser</text></g><g class="Y2xpZW50cy5leHQ="><g class="shape" ><rect x="1095.000000" y="50.000000" width="173.000000" height="66.000000" stroke="#0F66B7" fill="#BCDDFB" class=" stroke-B2 fill-B5" style="stroke-width:2;stroke-dasharray:6.000000,5.919384;" /></g><text x="1181.500000" y="88.500000" fill="#0A0F25" class="text-bold fill-N1" style="text-anchor:middle;font-size:16px">External MCP host</text></g><g class="ZmFub3V0Lmh0dHA="><g class="shape" ><rect x="870.000000" y="337.000000" width="226.000000" height="82.000000" stroke="#000536" fill="#BCDDFB" class=" stroke-B1 fill-B5" style="stroke-width:2;" /></g><text x="983.000000" y="375.500000" fill="#0A0F25" class="text-bold fill-N1" style="text-anchor:middle;font-size:16px"><tspan x="983.000000" dy="0.000000">HTTP :7520</tspan><tspan x="983.000000" dy="18.500000">routes + auth middleware</tspan></text></g><g class="ZmFub3V0LmluZ2VzdA=="><g class="shape" ><rect x="279.000000" y="743.000000" width="218.000000" height="82.000000" stroke="#000536" fill="#BCDDFB" class=" stroke-B1 fill-B5" style="stroke-width:2;" /></g><text x="388.000000" y="781.500000" fill="#0A0F25" class="text-bold fill-N1" style="text-anchor:middle;font-size:16px"><tspan x="388.000000" dy="0.000000">Ingest</tspan><tspan x="388.000000" dy="18.500000">OTLP gRPC + HTTP :7520</tspan></text></g><g class="ZmFub3V0LnVp"><g class="shape" ><rect x="468.000000" y="548.000000" width="211.000000" height="66.000000" stroke="#000536" fill="#BCDDFB" class=" stroke-B1 fill-B5" style="stroke-width:2;" /></g><text x="573.500000" y="586.500000" fill="#0A0F25" class="text-bold fill-N1" style="text-anchor:middle;font-size:16px">Embedded React assets</text></g><g class="ZmFub3V0LmFnZW50"><g class="shape" ><rect x="721.000000" y="743.000000" width="169.000000" height="82.000000" stroke="#000536" fill="#BCDDFB" class=" stroke-B1 fill-B5" style="stroke-width:2;" /></g><text x="805.500000" y="781.500000" fill="#0A0F25" class="text-bold fill-N1" style="text-anchor:middle;font-size:16px"><tspan x="805.500000" dy="0.000000">Agent runtime</tspan><tspan x="805.500000" dy="18.500000">model + tool loop</tspan></text></g><g class="ZmFub3V0Lm1jcA=="><g class="shape" ><rect x="845.000000" y="540.000000" width="239.000000" height="82.000000" stroke="#000536" fill="#BCDDFB" class=" stroke-B1 fill-B5" style="stroke-width:2;" /></g><text x="964.500000" y="578.500000" fill="#0A0F25" class="text-bold fill-N1" style="text-anchor:middle;font-size:16px"><tspan x="964.500000" dy="0.000000">MCP server</tspan><tspan x="964.500000" dy="18.500000">5 typed + 4 dashboard tools</tspan></text></g><g class="ZmFub3V0Lm9icw=="><g class="shape" ><rect x="989.000000" y="751.000000" width="249.000000" height="66.000000" stroke="#000536" fill="#BCDDFB" class=" stroke-B1 fill-B5" style="stroke-width:2;" /></g><text x="1113.500000" y="789.500000" fill="#0A0F25" class="text-bold fill-N1" style="text-anchor:middle;font-size:16px">Typed observability contract</text></g><g class="ZmFub3V0LmNvbW1pdA=="><g class="shape" ><rect x="269.000000" y="946.000000" width="237.000000" height="82.000000" stroke="#000536" fill="#BCDDFB" class=" stroke-B1 fill-B5" style="stroke-width:2;" /></g><text x="387.500000" y="984.500000" fill="#0A0F25" class="text-bold fill-N1" style="text-anchor:middle;font-size:16px"><tspan x="387.500000" dy="0.000000">Telemetry commit workers</tspan><tspan x="387.500000" dy="18.500000">atomic Parquet batches</tspan></text></g><g class="ZmFub3V0LnF1ZXJ5"><g class="shape" ><rect x="1069.000000" y="946.000000" width="165.000000" height="82.000000" stroke="#000536" fill="#BCDDFB" class=" stroke-B1 fill-B5" style="stroke-width:2;" /></g><text x="1151.500000" y="984.500000" fill="#0A0F25" class="text-bold fill-N1" style="text-anchor:middle;font-size:16px"><tspan x="1151.500000" dy="0.000000">Query kernel</tspan><tspan x="1151.500000" dy="18.500000">DuckDB + rollups</tspan></text></g><g class="ZmFub3V0Lm1haW50"><g class="shape" ><rect x="1294.000000" y="946.000000" width="259.000000" height="82.000000" stroke="#000536" fill="#BCDDFB" class=" stroke-B1 fill-B5" style="stroke-width:2;" /></g><text x="1423.500000" y="984.500000" fill="#0A0F25" class="text-bold fill-N1" style="text-anchor:middle;font-size:16px"><tspan x="1423.500000" dy="0.000000">Storage maintenance</tspan><tspan x="1423.500000" dy="18.500000">retention + native compaction</tspan></text></g><g class="ZmFub3V0LmFsZXJ0"><g class="shape" ><rect x="1438.000000" y="743.000000" width="241.000000" height="82.000000" stroke="#000536" fill="#BCDDFB" class=" stroke-B1 fill-B5" style="stroke-width:2;" /></g><text x="1558.500000" y="781.500000" fill="#0A0F25" class="text-bold fill-N1" style="text-anchor:middle;font-size:16px"><tspan x="1558.500000" dy="0.000000">Alert engine</tspan><tspan x="1558.500000" dy="18.500000">rule evaluation + webhooks</tspan></text></g><g class="c3RvcmUudGVsZW1ldHJ5"><g class="shape" ><path d="M 799 1273 C 799 1249 921 1249 935 1249 C 948 1249 1070 1249 1070 1273 V 1359 C 1070 1383 948 1383 935 1383 C 921 1383 799 1383 799 1359 V 1273 Z" stroke="#000536" fill="#DACEFB" class=" stroke-B1 fill-AA5" style="stroke-width:2;" /><path d="M 799 1273 C 799 1297 921 1297 935 1297 C 948 1297 1070 1297 1070 1273" stroke="#000536" fill="#DACEFB" class=" stroke-B1 fill-AA5" style="stroke-width:2;" /></g><text x="934.500000" y="1325.500000" fill="#0A0F25" class="text-bold fill-N1" style="text-anchor:middle;font-size:16px"><tspan x="934.500000" dy="0.000000">Parquet batches + trace indexes</tspan><tspan x="934.500000" dy="18.500000">storage.data_dir/telemetry</tspan></text></g><g class="c3RvcmUucXN0YXRl"><g class="shape" ><path d="M 1404 1273 C 1404 1249 1499 1249 1510 1249 C 1521 1249 1616 1249 1616 1273 V 1359 C 1616 1383 1521 1383 1510 1383 C 1499 1383 1404 1383 1404 1359 V 1273 Z" stroke="#000536" fill="#DACEFB" class=" stroke-B1 fill-AA5" style="stroke-width:2;" /><path d="M 1404 1273 C 1404 1297 1499 1297 1510 1297 C 1521 1297 1616 1297 1616 1273" stroke="#000536" fill="#DACEFB" class=" stroke-B1 fill-AA5" style="stroke-width:2;" /></g><text x="1510.000000" y="1325.500000" fill="#0A0F25" class="text-bold fill-N1" style="text-anchor:middle;font-size:16px"><tspan x="1510.000000" dy="0.000000">DuckDB query state</tspan><tspan x="1510.000000" dy="18.500000">storage.data_dir/query</tspan></text></g><g class="c3RvcmUuY29udHJvbA=="><g class="shape" ><path d="M 1758 1273 C 1758 1249 1857 1249 1869 1249 C 1880 1249 1979 1249 1979 1273 V 1359 C 1979 1383 1880 1383 1869 1383 C 1857 1383 1758 1383 1758 1359 V 1273 Z" stroke="#000536" fill="#DACEFB" class=" stroke-B1 fill-AA5" style="stroke-width:2;" /><path d="M 1758 1273 C 1758 1297 1857 1297 1869 1297 C 1880 1297 1979 1297 1979 1273" stroke="#000536" fill="#DACEFB" class=" stroke-B1 fill-AA5" style="stroke-width:2;" /></g><text x="1868.500000" y="1325.500000" fill="#0A0F25" class="text-bold fill-N1" style="text-anchor:middle;font-size:16px"><tspan x="1868.500000" dy="0.000000">Control SQLite</tspan><tspan x="1868.500000" dy="18.500000">storage.data_dir/control</tspan></text></g><g class="ZmFub3V0Lihpbmdlc3QgLSZndDsgY29tbWl0KVswXQ=="><marker id="mk-d2-625626608-3488378134" markerWidth="10.000000" markerHeight="12.000000" refX="7.000000" refY="6.000000" viewBox="0.000000 0.000000 10.000000 12.000000" orient="auto" markerUnits="userSpaceOnUse"> <polygon points="0.000000,0.000000 10.000000,6.000000 0.000000,12.000000" fill="#000536" class="connection fill-B1" stroke-width="2" /> </marker><path d="M 387.500000 826.500000 C 387.500000 873.299988 387.500000 897.700012 387.500000 942.500000" stroke="#000536" fill="none" class="connection stroke-B1" style="stroke-width:2;" marker-end="url(#mk-d2-625626608-3488378134)" mask="url(#d2-625626608)" /></g><g class="ZmFub3V0LihodHRwIC0mZ3Q7IHVpKVswXQ=="><path d="M 867.808675 406.471888 C 632.349976 464.798004 573.000000 493.299988 573.000000 544.500000" stroke="#000536" fill="none" class="connection stroke-B1" style="stroke-width:2;" marker-end="url(#mk-d2-625626608-3488378134)" mask="url(#d2-625626608)" /><text x="692.000000" y="455.000000" fill="#676C7E" class="text-italic fill-N2" style="text-anchor:middle;font-size:16px">serves embedded assets</text></g><g class="ZmFub3V0LihodHRwIC0mZ3Q7IGFnZW50KVswXQ=="><path d="M 891.684484 419.338988 C 787.900024 467.299988 761.500000 499.799988 761.500000 530.250000 C 761.500000 560.700012 766.700012 694.700012 785.931607 739.820307" stroke="#000536" fill="none" class="connection stroke-B1" style="stroke-width:2;" marker-end="url(#mk-d2-625626608-3488378134)" mask="url(#d2-625626608)" /><text x="762.000000" y="550.000000" fill="#676C7E" class="text-italic fill-N2" style="text-anchor:middle;font-size:16px">AG-UI stream</text></g><g class="ZmFub3V0LihodHRwIC0mZ3Q7IG1jcClbMF0="><path d="M 974.645069 420.468254 C 966.200012 467.299988 964.000000 491.700012 964.000000 536.500000" stroke="#000536" fill="none" class="connection stroke-B1" style="stroke-width:2;" marker-end="url(#mk-d2-625626608-3488378134)" mask="url(#d2-625626608)" /></g><g class="ZmFub3V0LihtY3AgLSZndDsgYWdlbnQpWzBd"><path d="M 940.026283 623.246962 C 913.799988 670.299988 895.000000 694.700012 849.804956 740.648295" stroke="#000536" fill="none" class="connection stroke-B1" style="stroke-width:2;" marker-end="url(#mk-d2-625626608-3488378134)" mask="url(#d2-625626608)" /><text x="900.500000" y="693.000000" fill="#676C7E" class="text-italic fill-N2" style="text-anchor:middle;font-size:16px">in-memory transport</text></g><g class="ZmFub3V0LihtY3AgLSZndDsgb2JzKVswXQ=="><path d="M 983.034197 623.339847 C 1003.049988 670.299988 1022.250000 696.299988 1075.401299 748.691994" stroke="#000536" fill="none" class="connection stroke-B1" style="stroke-width:2;" marker-end="url(#mk-d2-625626608-3488378134)" mask="url(#d2-625626608)" /></g><g class="ZmFub3V0LihodHRwIC0mZ3Q7IG9icylbMF0="><path d="M 1098.189095 406.989806 C 1327.449951 464.899994 1385.250000 499.799988 1385.250000 530.250000 C 1385.250000 560.700012 1348.650024 696.299988 1205.992789 750.088784" stroke="#000536" fill="none" class="connection stroke-B1" style="stroke-width:2;" marker-end="url(#mk-d2-625626608-3488378134)" mask="url(#d2-625626608)" /><text x="1385.000000" y="531.000000" fill="#676C7E" class="text-italic fill-N2" style="text-anchor:middle;font-size:16px">typed HTTP API</text></g><g class="ZmFub3V0LihvYnMgLSZndDsgcXVlcnkpWzBd"><path d="M 1113.000000 818.500000 C 1113.000000 871.700012 1117.599976 897.700012 1134.588782 942.757212" stroke="#000536" fill="none" class="connection stroke-B1" style="stroke-width:2;" marker-end="url(#mk-d2-625626608-3488378134)" mask="url(#d2-625626608)" /></g><g class="ZmFub3V0LihhbGVydCAtJmd0OyBxdWVyeSlbMF0="><path d="M 1453.893890 825.244886 C 1334.150024 873.299988 1285.750000 897.700012 1217.061124 944.255794" stroke="#000536" fill="none" class="connection stroke-B1" style="stroke-width:2;" marker-end="url(#mk-d2-625626608-3488378134)" mask="url(#d2-625626608)" /><text x="1329.500000" y="881.000000" fill="#676C7E" class="text-italic fill-N2" style="text-anchor:middle;font-size:16px">evaluates rollups</text></g><g class="KGNsaWVudHMuY29sbGVjdG9yIC0mZ3Q7IGZhbm91dC5pbmdlc3QpWzBd"><path d="M 387.500000 118.000000 C 387.500000 156.000000 387.500000 178.100006 387.500000 196.250000 C 387.500000 214.399994 387.500000 238.600006 387.500000 256.750000 C 387.500000 274.899994 387.500000 305.200012 387.500000 332.500000 C 387.500000 359.799988 387.500000 398.299988 387.500000 428.750000 C 387.500000 459.200012 387.500000 499.799988 387.500000 530.250000 C 387.500000 560.700012 387.500000 694.700012 387.500000 739.500000" stroke="#000536" fill="none" class="connection stroke-B1" style="stroke-width:2;" marker-end="url(#mk-d2-625626608-3488378134)" mask="url(#d2-625626608)" /><text x="387.500000" y="435.000000" fill="#676C7E" class="text-italic fill-N2" style="text-anchor:middle;font-size:16px">OTLP/gRPC or OTLP/HTTP</text></g><g class="KGNsaWVudHMuYnJvd3NlciAtJmd0OyBmYW5vdXQuaHR0cClbMF0="><path d="M 599.500000 118.000000 C 599.500000 156.000000 599.500000 178.100006 599.500000 196.250000 C 599.500000 214.399994 653.549988 299.833008 865.858203 350.243923" stroke="#000536" fill="none" class="connection stroke-B1" style="stroke-width:2;" marker-end="url(#mk-d2-625626608-3488378134)" mask="url(#d2-625626608)" /><text x="664.500000" y="308.000000" fill="#676C7E" class="text-italic fill-N2" style="text-anchor:middle;font-size:16px">HTTPS</text></g><g class="KGNsaWVudHMuZXh0IC0mZ3Q7IGZhbm91dC5odHRwKVswXQ=="><path d="M 1181.250000 118.000000 C 1181.250000 156.000000 1181.250000 178.100006 1181.250000 196.250000 C 1181.250000 214.399994 1159.449951 297.000000 1075.885732 335.332232" stroke="#000536" fill="none" class="connection stroke-B1" style="stroke-width:2;" marker-end="url(#mk-d2-625626608-3488378134)" mask="url(#d2-625626608)" /><text x="1170.500000" y="260.000000" fill="#676C7E" class="text-italic fill-N2" style="text-anchor:middle;font-size:16px">/mcp — OAuth</text></g><g class="KGZhbm91dC5jb21taXQgLSZndDsgc3RvcmUudGVsZW1ldHJ5KVswXQ=="><path d="M 387.500000 1030.000000 C 387.500000 1068.000000 387.500000 1090.099976 387.500000 1108.250000 C 387.500000 1126.400024 469.799988 1216.599976 795.088443 1286.163506" stroke="#000536" fill="none" class="connection stroke-B1" style="stroke-width:2;" marker-end="url(#mk-d2-625626608-3488378134)" mask="url(#d2-625626608)" /></g><g class="KGZhbm91dC5xdWVyeSAtJmd0OyBzdG9yZS50ZWxlbWV0cnkpWzBd"><path d="M 1066.809872 1008.138712 C 843.950012 1063.930054 787.750000 1090.099976 787.750000 1108.250000 C 787.750000 1126.400024 801.200012 1209.800049 851.881053 1250.495569" stroke="#000536" fill="none" class="connection stroke-B1" style="stroke-width:2;" marker-end="url(#mk-d2-625626608-3488378134)" mask="url(#d2-625626608)" /><text x="835.000000" y="1074.000000" fill="#676C7E" class="text-italic fill-N2" style="text-anchor:middle;font-size:16px">indexed traces + SQL scans</text></g><g class="KGZhbm91dC5xdWVyeSAtJmd0OyBzdG9yZS5xc3RhdGUpWzBd"><path d="M 1194.428147 1029.400142 C 1233.800049 1068.000000 1244.000000 1090.099976 1244.000000 1108.250000 C 1244.000000 1126.400024 1276.199951 1213.000000 1401.331720 1267.405096" stroke="#000536" fill="none" class="connection stroke-B1" style="stroke-width:2;" marker-end="url(#mk-d2-625626608-3488378134)" mask="url(#d2-625626608)" /></g><g class="KGZhbm91dC5tYWludCAtJmd0OyBzdG9yZS50ZWxlbWV0cnkpWzBd"><path d="M 1423.250000 1030.000000 C 1423.250000 1068.000000 1423.250000 1090.099976 1423.250000 1108.250000 C 1423.250000 1126.400024 1352.599976 1216.000000 1073.888999 1283.064218" stroke="#000536" fill="none" class="connection stroke-B1" style="stroke-width:2;" marker-end="url(#mk-d2-625626608-3488378134)" mask="url(#d2-625626608)" /><text x="1314.500000" y="1231.000000" fill="#676C7E" class="text-italic fill-N2" style="text-anchor:middle;font-size:16px">atomic replacement</text></g><g class="KGZhbm91dC5odHRwIC0mZ3Q7IHN0b3JlLmNvbnRyb2wpWzBd"><path d="M 1097.986840 390.729053 C 1713.599976 461.700012 1868.000000 499.799988 1868.000000 530.250000 C 1868.000000 560.700012 1868.000000 601.299988 1868.000000 631.750000 C 1868.000000 662.200012 1868.000000 702.799988 1868.000000 733.250000 C 1868.000000 763.700012 1868.000000 804.299988 1868.000000 834.750000 C 1868.000000 865.200012 1868.000000 905.799988 1868.000000 936.250000 C 1868.000000 966.700012 1868.000000 1005.200012 1868.000000 1032.500000 C 1868.000000 1059.800049 1868.000000 1090.099976 1868.000000 1108.250000 C 1868.000000 1126.400024 1868.000000 1209.000000 1868.000000 1245.000000" stroke="#000536" fill="none" class="connection stroke-B1" style="stroke-width:2;" marker-end="url(#mk-d2-625626608-3488378134)" mask="url(#d2-625626608)" /><text x="1853.000000" y="502.000000" fill="#676C7E" class="text-italic fill-N2" style="text-anchor:middle;font-size:16px">users, sessions, settings, dashboards, threads</text></g><g class="KGZhbm91dC5hbGVydCAtJmd0OyBzdG9yZS5jb250cm9sKVswXQ=="><path d="M 1601.164214 825.914213 C 1648.550049 873.299988 1660.750000 905.799988 1660.750000 936.250000 C 1660.750000 966.700012 1660.750000 1005.200012 1660.750000 1032.500000 C 1660.750000 1059.800049 1660.750000 1090.099976 1660.750000 1108.250000 C 1660.750000 1126.400024 1682.599976 1211.400024 1766.521163 1259.025742" stroke="#000536" fill="none" class="connection stroke-B1" style="stroke-width:2;" marker-end="url(#mk-d2-625626608-3488378134)" mask="url(#d2-625626608)" /><text x="1661.000000" y="1064.000000" fill="#676C7E" class="text-italic fill-N2" style="text-anchor:middle;font-size:16px">rules and fired alerts</text></g><g class="KGZhbm91dC5hZ2VudCAtJmd0OyBtb2RlbClbMF0="><path d="M 805.750000 826.500000 C 805.750000 873.299988 682.349976 903.099976 192.709926 972.935213" stroke="#000536" fill="none" class="connection stroke-B1" style="stroke-width:2;" marker-end="url(#mk-d2-625626608-3488378134)" mask="url(#d2-625626608)" /><text x="522.500000" y="931.000000" fill="#676C7E" class="text-italic fill-N2" style="text-anchor:middle;font-size:16px">HTTPS</text></g><mask id="d2-625626608" maskUnits="userSpaceOnUse" x="-101" y="-121" width="2211" height="1635">
-<rect x="-101" y="-121" width="2211" height="1635" fill="white"></rect>
+		.d2-37886755 .fill-N1{fill:#0A0F25;}
+		.d2-37886755 .fill-N2{fill:#676C7E;}
+		.d2-37886755 .fill-N3{fill:#9499AB;}
+		.d2-37886755 .fill-N4{fill:#CFD2DD;}
+		.d2-37886755 .fill-N5{fill:#DEE1EB;}
+		.d2-37886755 .fill-N6{fill:#EEF1F8;}
+		.d2-37886755 .fill-N7{fill:#FFFFFF;}
+		.d2-37886755 .fill-B1{fill:#000536;}
+		.d2-37886755 .fill-B2{fill:#0F66B7;}
+		.d2-37886755 .fill-B3{fill:#4393DD;}
+		.d2-37886755 .fill-B4{fill:#87BFF3;}
+		.d2-37886755 .fill-B5{fill:#BCDDFB;}
+		.d2-37886755 .fill-B6{fill:#E5F3FF;}
+		.d2-37886755 .fill-AA2{fill:#7639C5;}
+		.d2-37886755 .fill-AA4{fill:#C1A2F3;}
+		.d2-37886755 .fill-AA5{fill:#DACEFB;}
+		.d2-37886755 .fill-AB4{fill:#EA99C6;}
+		.d2-37886755 .fill-AB5{fill:#FFDEF1;}
+		.d2-37886755 .stroke-N1{stroke:#0A0F25;}
+		.d2-37886755 .stroke-N2{stroke:#676C7E;}
+		.d2-37886755 .stroke-N3{stroke:#9499AB;}
+		.d2-37886755 .stroke-N4{stroke:#CFD2DD;}
+		.d2-37886755 .stroke-N5{stroke:#DEE1EB;}
+		.d2-37886755 .stroke-N6{stroke:#EEF1F8;}
+		.d2-37886755 .stroke-N7{stroke:#FFFFFF;}
+		.d2-37886755 .stroke-B1{stroke:#000536;}
+		.d2-37886755 .stroke-B2{stroke:#0F66B7;}
+		.d2-37886755 .stroke-B3{stroke:#4393DD;}
+		.d2-37886755 .stroke-B4{stroke:#87BFF3;}
+		.d2-37886755 .stroke-B5{stroke:#BCDDFB;}
+		.d2-37886755 .stroke-B6{stroke:#E5F3FF;}
+		.d2-37886755 .stroke-AA2{stroke:#7639C5;}
+		.d2-37886755 .stroke-AA4{stroke:#C1A2F3;}
+		.d2-37886755 .stroke-AA5{stroke:#DACEFB;}
+		.d2-37886755 .stroke-AB4{stroke:#EA99C6;}
+		.d2-37886755 .stroke-AB5{stroke:#FFDEF1;}
+		.d2-37886755 .background-color-N1{background-color:#0A0F25;}
+		.d2-37886755 .background-color-N2{background-color:#676C7E;}
+		.d2-37886755 .background-color-N3{background-color:#9499AB;}
+		.d2-37886755 .background-color-N4{background-color:#CFD2DD;}
+		.d2-37886755 .background-color-N5{background-color:#DEE1EB;}
+		.d2-37886755 .background-color-N6{background-color:#EEF1F8;}
+		.d2-37886755 .background-color-N7{background-color:#FFFFFF;}
+		.d2-37886755 .background-color-B1{background-color:#000536;}
+		.d2-37886755 .background-color-B2{background-color:#0F66B7;}
+		.d2-37886755 .background-color-B3{background-color:#4393DD;}
+		.d2-37886755 .background-color-B4{background-color:#87BFF3;}
+		.d2-37886755 .background-color-B5{background-color:#BCDDFB;}
+		.d2-37886755 .background-color-B6{background-color:#E5F3FF;}
+		.d2-37886755 .background-color-AA2{background-color:#7639C5;}
+		.d2-37886755 .background-color-AA4{background-color:#C1A2F3;}
+		.d2-37886755 .background-color-AA5{background-color:#DACEFB;}
+		.d2-37886755 .background-color-AB4{background-color:#EA99C6;}
+		.d2-37886755 .background-color-AB5{background-color:#FFDEF1;}
+		.d2-37886755 .color-N1{color:#0A0F25;}
+		.d2-37886755 .color-N2{color:#676C7E;}
+		.d2-37886755 .color-N3{color:#9499AB;}
+		.d2-37886755 .color-N4{color:#CFD2DD;}
+		.d2-37886755 .color-N5{color:#DEE1EB;}
+		.d2-37886755 .color-N6{color:#EEF1F8;}
+		.d2-37886755 .color-N7{color:#FFFFFF;}
+		.d2-37886755 .color-B1{color:#000536;}
+		.d2-37886755 .color-B2{color:#0F66B7;}
+		.d2-37886755 .color-B3{color:#4393DD;}
+		.d2-37886755 .color-B4{color:#87BFF3;}
+		.d2-37886755 .color-B5{color:#BCDDFB;}
+		.d2-37886755 .color-B6{color:#E5F3FF;}
+		.d2-37886755 .color-AA2{color:#7639C5;}
+		.d2-37886755 .color-AA4{color:#C1A2F3;}
+		.d2-37886755 .color-AA5{color:#DACEFB;}
+		.d2-37886755 .color-AB4{color:#EA99C6;}
+		.d2-37886755 .color-AB5{color:#FFDEF1;}.appendix text.text{fill:#0A0F25}.md{--color-fg-default:#0A0F25;--color-fg-muted:#676C7E;--color-fg-subtle:#9499AB;--color-canvas-default:#FFFFFF;--color-canvas-subtle:#EEF1F8;--color-border-default:#000536;--color-border-muted:#0F66B7;--color-neutral-muted:#EEF1F8;--color-accent-fg:#0F66B7;--color-accent-emphasis:#0F66B7;--color-attention-subtle:#676C7E;--color-danger-fg:red;}.sketch-overlay-B1{fill:url(#streaks-darker-d2-37886755);mix-blend-mode:lighten}.sketch-overlay-B2{fill:url(#streaks-dark-d2-37886755);mix-blend-mode:overlay}.sketch-overlay-B3{fill:url(#streaks-dark-d2-37886755);mix-blend-mode:overlay}.sketch-overlay-B4{fill:url(#streaks-normal-d2-37886755);mix-blend-mode:color-burn}.sketch-overlay-B5{fill:url(#streaks-normal-d2-37886755);mix-blend-mode:color-burn}.sketch-overlay-B6{fill:url(#streaks-bright-d2-37886755);mix-blend-mode:darken}.sketch-overlay-AA2{fill:url(#streaks-dark-d2-37886755);mix-blend-mode:overlay}.sketch-overlay-AA4{fill:url(#streaks-normal-d2-37886755);mix-blend-mode:color-burn}.sketch-overlay-AA5{fill:url(#streaks-normal-d2-37886755);mix-blend-mode:color-burn}.sketch-overlay-AB4{fill:url(#streaks-normal-d2-37886755);mix-blend-mode:color-burn}.sketch-overlay-AB5{fill:url(#streaks-bright-d2-37886755);mix-blend-mode:darken}.sketch-overlay-N1{fill:url(#streaks-darker-d2-37886755);mix-blend-mode:lighten}.sketch-overlay-N2{fill:url(#streaks-dark-d2-37886755);mix-blend-mode:overlay}.sketch-overlay-N3{fill:url(#streaks-normal-d2-37886755);mix-blend-mode:color-burn}.sketch-overlay-N4{fill:url(#streaks-normal-d2-37886755);mix-blend-mode:color-burn}.sketch-overlay-N5{fill:url(#streaks-bright-d2-37886755);mix-blend-mode:darken}.sketch-overlay-N6{fill:url(#streaks-bright-d2-37886755);mix-blend-mode:darken}.sketch-overlay-N7{fill:url(#streaks-bright-d2-37886755);mix-blend-mode:darken}.light-code{display: block}.dark-code{display: none}]]></style><g class="Y2xpZW50cw=="><g class="shape" ><rect x="258.000000" y="20.000000" width="1040.000000" height="126.000000" stroke="#000536" fill="transparent" class=" stroke-B1" style="stroke-width:2;" /></g><text x="778.000000" y="7.000000" fill="#0A0F25" class="text fill-N1" style="text-anchor:middle;font-size:28px">Clients</text></g><g class="ZmFub3V0"><g class="shape" ><rect x="239.000000" y="307.000000" width="1470.000000" height="751.000000" stroke="#000536" fill="#87BFF3" class=" stroke-B1 fill-B4" style="stroke-width:2;" /></g><text x="974.000000" y="294.000000" fill="#0A0F25" class="text fill-N1" style="text-anchor:middle;font-size:28px">fanout — one Go process</text></g><g class="c3RvcmU="><g class="shape" ><rect x="761.000000" y="1219.000000" width="1257.000000" height="194.000000" stroke="#000536" fill="transparent" class=" stroke-B1" style="stroke-width:2;" /></g><text x="1389.500000" y="1206.000000" fill="#0A0F25" class="text fill-N1" style="text-anchor:middle;font-size:28px">Storage</text></g><g class="bW9kZWw="><g class="shape" ><rect x="0.000000" y="954.000000" width="189.000000" height="66.000000" stroke="#0F66B7" fill="#E5F3FF" class=" stroke-B2 fill-B6" style="stroke-width:2;stroke-dasharray:6.000000,5.919384;" /></g><text x="94.500000" y="992.500000" fill="#0A0F25" class="text-bold fill-N1" style="text-anchor:middle;font-size:16px">Anthropic or OpenAI</text></g><g class="Y2xpZW50cy5jb2xsZWN0b3I="><g class="shape" ><rect x="288.000000" y="50.000000" width="200.000000" height="66.000000" stroke="#0F66B7" fill="#BCDDFB" class=" stroke-B2 fill-B5" style="stroke-width:2;stroke-dasharray:6.000000,5.919384;" /></g><text x="388.000000" y="88.500000" fill="#0A0F25" class="text-bold fill-N1" style="text-anchor:middle;font-size:16px">OTLP collector or SDK</text></g><g class="Y2xpZW50cy5icm93c2Vy"><g class="shape" ><rect x="548.000000" y="50.000000" width="104.000000" height="66.000000" stroke="#0F66B7" fill="#BCDDFB" class=" stroke-B2 fill-B5" style="stroke-width:2;stroke-dasharray:6.000000,5.919384;" /></g><text x="600.000000" y="88.500000" fill="#0A0F25" class="text-bold fill-N1" style="text-anchor:middle;font-size:16px">Browser</text></g><g class="Y2xpZW50cy5leHQ="><g class="shape" ><rect x="1095.000000" y="50.000000" width="173.000000" height="66.000000" stroke="#0F66B7" fill="#BCDDFB" class=" stroke-B2 fill-B5" style="stroke-width:2;stroke-dasharray:6.000000,5.919384;" /></g><text x="1181.500000" y="88.500000" fill="#0A0F25" class="text-bold fill-N1" style="text-anchor:middle;font-size:16px">External MCP host</text></g><g class="ZmFub3V0Lmh0dHA="><g class="shape" ><rect x="870.000000" y="337.000000" width="226.000000" height="82.000000" stroke="#000536" fill="#BCDDFB" class=" stroke-B1 fill-B5" style="stroke-width:2;" /></g><text x="983.000000" y="375.500000" fill="#0A0F25" class="text-bold fill-N1" style="text-anchor:middle;font-size:16px"><tspan x="983.000000" dy="0.000000">HTTP :7520</tspan><tspan x="983.000000" dy="18.500000">routes + auth middleware</tspan></text></g><g class="ZmFub3V0LmluZ2VzdA=="><g class="shape" ><rect x="279.000000" y="743.000000" width="218.000000" height="82.000000" stroke="#000536" fill="#BCDDFB" class=" stroke-B1 fill-B5" style="stroke-width:2;" /></g><text x="388.000000" y="781.500000" fill="#0A0F25" class="text-bold fill-N1" style="text-anchor:middle;font-size:16px"><tspan x="388.000000" dy="0.000000">Ingest</tspan><tspan x="388.000000" dy="18.500000">OTLP gRPC + HTTP :7520</tspan></text></g><g class="ZmFub3V0LnVp"><g class="shape" ><rect x="468.000000" y="548.000000" width="211.000000" height="66.000000" stroke="#000536" fill="#BCDDFB" class=" stroke-B1 fill-B5" style="stroke-width:2;" /></g><text x="573.500000" y="586.500000" fill="#0A0F25" class="text-bold fill-N1" style="text-anchor:middle;font-size:16px">Embedded React assets</text></g><g class="ZmFub3V0LmFnZW50"><g class="shape" ><rect x="721.000000" y="743.000000" width="169.000000" height="82.000000" stroke="#000536" fill="#BCDDFB" class=" stroke-B1 fill-B5" style="stroke-width:2;" /></g><text x="805.500000" y="781.500000" fill="#0A0F25" class="text-bold fill-N1" style="text-anchor:middle;font-size:16px"><tspan x="805.500000" dy="0.000000">Agent runtime</tspan><tspan x="805.500000" dy="18.500000">model + tool loop</tspan></text></g><g class="ZmFub3V0Lm1jcA=="><g class="shape" ><rect x="845.000000" y="540.000000" width="239.000000" height="82.000000" stroke="#000536" fill="#BCDDFB" class=" stroke-B1 fill-B5" style="stroke-width:2;" /></g><text x="964.500000" y="578.500000" fill="#0A0F25" class="text-bold fill-N1" style="text-anchor:middle;font-size:16px"><tspan x="964.500000" dy="0.000000">MCP server</tspan><tspan x="964.500000" dy="18.500000">5 typed + 4 dashboard tools</tspan></text></g><g class="ZmFub3V0Lm9icw=="><g class="shape" ><rect x="989.000000" y="751.000000" width="249.000000" height="66.000000" stroke="#000536" fill="#BCDDFB" class=" stroke-B1 fill-B5" style="stroke-width:2;" /></g><text x="1113.500000" y="789.500000" fill="#0A0F25" class="text-bold fill-N1" style="text-anchor:middle;font-size:16px">Typed observability contract</text></g><g class="ZmFub3V0LmNvbW1pdA=="><g class="shape" ><rect x="269.000000" y="946.000000" width="237.000000" height="82.000000" stroke="#000536" fill="#BCDDFB" class=" stroke-B1 fill-B5" style="stroke-width:2;" /></g><text x="387.500000" y="984.500000" fill="#0A0F25" class="text-bold fill-N1" style="text-anchor:middle;font-size:16px"><tspan x="387.500000" dy="0.000000">Telemetry commit workers</tspan><tspan x="387.500000" dy="18.500000">atomic Parquet batches</tspan></text></g><g class="ZmFub3V0LnF1ZXJ5"><g class="shape" ><rect x="1069.000000" y="946.000000" width="165.000000" height="82.000000" stroke="#000536" fill="#BCDDFB" class=" stroke-B1 fill-B5" style="stroke-width:2;" /></g><text x="1151.500000" y="984.500000" fill="#0A0F25" class="text-bold fill-N1" style="text-anchor:middle;font-size:16px"><tspan x="1151.500000" dy="0.000000">Query kernel</tspan><tspan x="1151.500000" dy="18.500000">DuckDB + rollups</tspan></text></g><g class="ZmFub3V0Lm1haW50"><g class="shape" ><rect x="1294.000000" y="946.000000" width="259.000000" height="82.000000" stroke="#000536" fill="#BCDDFB" class=" stroke-B1 fill-B5" style="stroke-width:2;" /></g><text x="1423.500000" y="984.500000" fill="#0A0F25" class="text-bold fill-N1" style="text-anchor:middle;font-size:16px"><tspan x="1423.500000" dy="0.000000">Storage maintenance</tspan><tspan x="1423.500000" dy="18.500000">retention + native compaction</tspan></text></g><g class="ZmFub3V0LmFsZXJ0"><g class="shape" ><rect x="1438.000000" y="743.000000" width="241.000000" height="82.000000" stroke="#000536" fill="#BCDDFB" class=" stroke-B1 fill-B5" style="stroke-width:2;" /></g><text x="1558.500000" y="781.500000" fill="#0A0F25" class="text-bold fill-N1" style="text-anchor:middle;font-size:16px"><tspan x="1558.500000" dy="0.000000">Alert engine</tspan><tspan x="1558.500000" dy="18.500000">rule evaluation + webhooks</tspan></text></g><g class="c3RvcmUudGVsZW1ldHJ5"><g class="shape" ><path d="M 791 1273 C 791 1249 913 1249 926 1249 C 940 1249 1061 1249 1061 1273 V 1359 C 1061 1383 940 1383 926 1383 C 913 1383 791 1383 791 1359 V 1273 Z" stroke="#000536" fill="#DACEFB" class=" stroke-B1 fill-AA5" style="stroke-width:2;" /><path d="M 791 1273 C 791 1297 913 1297 926 1297 C 940 1297 1061 1297 1061 1273" stroke="#000536" fill="#DACEFB" class=" stroke-B1 fill-AA5" style="stroke-width:2;" /></g><text x="926.000000" y="1325.500000" fill="#0A0F25" class="text-bold fill-N1" style="text-anchor:middle;font-size:16px"><tspan x="926.000000" dy="0.000000">Parquet batches + trace indexes</tspan><tspan x="926.000000" dy="18.500000">FANOUT_DATA_DIR/telemetry</tspan></text></g><g class="c3RvcmUucXN0YXRl"><g class="shape" ><path d="M 1392 1273 C 1392 1249 1495 1249 1507 1249 C 1518 1249 1621 1249 1621 1273 V 1359 C 1621 1383 1518 1383 1507 1383 C 1495 1383 1392 1383 1392 1359 V 1273 Z" stroke="#000536" fill="#DACEFB" class=" stroke-B1 fill-AA5" style="stroke-width:2;" /><path d="M 1392 1273 C 1392 1297 1495 1297 1507 1297 C 1518 1297 1621 1297 1621 1273" stroke="#000536" fill="#DACEFB" class=" stroke-B1 fill-AA5" style="stroke-width:2;" /></g><text x="1506.500000" y="1325.500000" fill="#0A0F25" class="text-bold fill-N1" style="text-anchor:middle;font-size:16px"><tspan x="1506.500000" dy="0.000000">DuckDB query state</tspan><tspan x="1506.500000" dy="18.500000">FANOUT_DATA_DIR/query</tspan></text></g><g class="c3RvcmUuY29udHJvbA=="><g class="shape" ><path d="M 1748 1273 C 1748 1249 1856 1249 1868 1249 C 1880 1249 1988 1249 1988 1273 V 1359 C 1988 1383 1880 1383 1868 1383 C 1856 1383 1748 1383 1748 1359 V 1273 Z" stroke="#000536" fill="#DACEFB" class=" stroke-B1 fill-AA5" style="stroke-width:2;" /><path d="M 1748 1273 C 1748 1297 1856 1297 1868 1297 C 1880 1297 1988 1297 1988 1273" stroke="#000536" fill="#DACEFB" class=" stroke-B1 fill-AA5" style="stroke-width:2;" /></g><text x="1868.000000" y="1325.500000" fill="#0A0F25" class="text-bold fill-N1" style="text-anchor:middle;font-size:16px"><tspan x="1868.000000" dy="0.000000">Control SQLite</tspan><tspan x="1868.000000" dy="18.500000">FANOUT_DATA_DIR/control</tspan></text></g><g class="ZmFub3V0Lihpbmdlc3QgLSZndDsgY29tbWl0KVswXQ=="><marker id="mk-d2-37886755-3488378134" markerWidth="10.000000" markerHeight="12.000000" refX="7.000000" refY="6.000000" viewBox="0.000000 0.000000 10.000000 12.000000" orient="auto" markerUnits="userSpaceOnUse"> <polygon points="0.000000,0.000000 10.000000,6.000000 0.000000,12.000000" fill="#000536" class="connection fill-B1" stroke-width="2" /> </marker><path d="M 387.500000 826.500000 C 387.500000 873.299988 387.500000 897.700012 387.500000 942.500000" stroke="#000536" fill="none" class="connection stroke-B1" style="stroke-width:2;" marker-end="url(#mk-d2-37886755-3488378134)" mask="url(#d2-37886755)" /></g><g class="ZmFub3V0LihodHRwIC0mZ3Q7IHVpKVswXQ=="><path d="M 867.808675 406.471888 C 632.349976 464.798004 573.000000 493.299988 573.000000 544.500000" stroke="#000536" fill="none" class="connection stroke-B1" style="stroke-width:2;" marker-end="url(#mk-d2-37886755-3488378134)" mask="url(#d2-37886755)" /><text x="692.000000" y="455.000000" fill="#676C7E" class="text-italic fill-N2" style="text-anchor:middle;font-size:16px">serves embedded assets</text></g><g class="ZmFub3V0LihodHRwIC0mZ3Q7IGFnZW50KVswXQ=="><path d="M 891.684484 419.338988 C 787.900024 467.299988 761.500000 499.799988 761.500000 530.250000 C 761.500000 560.700012 766.700012 694.700012 785.931607 739.820307" stroke="#000536" fill="none" class="connection stroke-B1" style="stroke-width:2;" marker-end="url(#mk-d2-37886755-3488378134)" mask="url(#d2-37886755)" /><text x="762.000000" y="550.000000" fill="#676C7E" class="text-italic fill-N2" style="text-anchor:middle;font-size:16px">AG-UI stream</text></g><g class="ZmFub3V0LihodHRwIC0mZ3Q7IG1jcClbMF0="><path d="M 974.645069 420.468254 C 966.200012 467.299988 964.000000 491.700012 964.000000 536.500000" stroke="#000536" fill="none" class="connection stroke-B1" style="stroke-width:2;" marker-end="url(#mk-d2-37886755-3488378134)" mask="url(#d2-37886755)" /></g><g class="ZmFub3V0LihtY3AgLSZndDsgYWdlbnQpWzBd"><path d="M 940.026283 623.246962 C 913.799988 670.299988 895.000000 694.700012 849.804956 740.648295" stroke="#000536" fill="none" class="connection stroke-B1" style="stroke-width:2;" marker-end="url(#mk-d2-37886755-3488378134)" mask="url(#d2-37886755)" /><text x="900.500000" y="693.000000" fill="#676C7E" class="text-italic fill-N2" style="text-anchor:middle;font-size:16px">in-memory transport</text></g><g class="ZmFub3V0LihtY3AgLSZndDsgb2JzKVswXQ=="><path d="M 983.034197 623.339847 C 1003.049988 670.299988 1022.250000 696.299988 1075.401299 748.691994" stroke="#000536" fill="none" class="connection stroke-B1" style="stroke-width:2;" marker-end="url(#mk-d2-37886755-3488378134)" mask="url(#d2-37886755)" /></g><g class="ZmFub3V0LihodHRwIC0mZ3Q7IG9icylbMF0="><path d="M 1098.189095 406.989806 C 1327.449951 464.899994 1385.250000 499.799988 1385.250000 530.250000 C 1385.250000 560.700012 1348.650024 696.299988 1205.992789 750.088784" stroke="#000536" fill="none" class="connection stroke-B1" style="stroke-width:2;" marker-end="url(#mk-d2-37886755-3488378134)" mask="url(#d2-37886755)" /><text x="1385.000000" y="531.000000" fill="#676C7E" class="text-italic fill-N2" style="text-anchor:middle;font-size:16px">typed HTTP API</text></g><g class="ZmFub3V0LihvYnMgLSZndDsgcXVlcnkpWzBd"><path d="M 1113.000000 818.500000 C 1113.000000 871.700012 1117.599976 897.700012 1134.588782 942.757212" stroke="#000536" fill="none" class="connection stroke-B1" style="stroke-width:2;" marker-end="url(#mk-d2-37886755-3488378134)" mask="url(#d2-37886755)" /></g><g class="ZmFub3V0LihhbGVydCAtJmd0OyBxdWVyeSlbMF0="><path d="M 1453.893890 825.244886 C 1334.150024 873.299988 1285.750000 897.700012 1217.061124 944.255794" stroke="#000536" fill="none" class="connection stroke-B1" style="stroke-width:2;" marker-end="url(#mk-d2-37886755-3488378134)" mask="url(#d2-37886755)" /><text x="1329.500000" y="881.000000" fill="#676C7E" class="text-italic fill-N2" style="text-anchor:middle;font-size:16px">evaluates rollups</text></g><g class="KGNsaWVudHMuY29sbGVjdG9yIC0mZ3Q7IGZhbm91dC5pbmdlc3QpWzBd"><path d="M 387.500000 118.000000 C 387.500000 156.000000 387.500000 178.100006 387.500000 196.250000 C 387.500000 214.399994 387.500000 238.600006 387.500000 256.750000 C 387.500000 274.899994 387.500000 305.200012 387.500000 332.500000 C 387.500000 359.799988 387.500000 398.299988 387.500000 428.750000 C 387.500000 459.200012 387.500000 499.799988 387.500000 530.250000 C 387.500000 560.700012 387.500000 694.700012 387.500000 739.500000" stroke="#000536" fill="none" class="connection stroke-B1" style="stroke-width:2;" marker-end="url(#mk-d2-37886755-3488378134)" mask="url(#d2-37886755)" /><text x="387.500000" y="435.000000" fill="#676C7E" class="text-italic fill-N2" style="text-anchor:middle;font-size:16px">OTLP/gRPC or OTLP/HTTP</text></g><g class="KGNsaWVudHMuYnJvd3NlciAtJmd0OyBmYW5vdXQuaHR0cClbMF0="><path d="M 599.500000 118.000000 C 599.500000 156.000000 599.500000 178.100006 599.500000 196.250000 C 599.500000 214.399994 653.549988 299.833008 865.858203 350.243923" stroke="#000536" fill="none" class="connection stroke-B1" style="stroke-width:2;" marker-end="url(#mk-d2-37886755-3488378134)" mask="url(#d2-37886755)" /><text x="664.500000" y="308.000000" fill="#676C7E" class="text-italic fill-N2" style="text-anchor:middle;font-size:16px">HTTPS</text></g><g class="KGNsaWVudHMuZXh0IC0mZ3Q7IGZhbm91dC5odHRwKVswXQ=="><path d="M 1181.250000 118.000000 C 1181.250000 156.000000 1181.250000 178.100006 1181.250000 196.250000 C 1181.250000 214.399994 1159.449951 297.000000 1075.885732 335.332232" stroke="#000536" fill="none" class="connection stroke-B1" style="stroke-width:2;" marker-end="url(#mk-d2-37886755-3488378134)" mask="url(#d2-37886755)" /><text x="1170.500000" y="260.000000" fill="#676C7E" class="text-italic fill-N2" style="text-anchor:middle;font-size:16px">/mcp — OAuth</text></g><g class="KGZhbm91dC5jb21taXQgLSZndDsgc3RvcmUudGVsZW1ldHJ5KVswXQ=="><path d="M 387.500000 1030.000000 C 387.500000 1068.000000 387.500000 1090.099976 387.500000 1108.250000 C 387.500000 1126.400024 468.200012 1216.599976 787.091864 1286.147668" stroke="#000536" fill="none" class="connection stroke-B1" style="stroke-width:2;" marker-end="url(#mk-d2-37886755-3488378134)" mask="url(#d2-37886755)" /></g><g class="KGZhbm91dC5xdWVyeSAtJmd0OyBzdG9yZS50ZWxlbWV0cnkpWzBd"><path d="M 1066.809792 1008.124357 C 843.750000 1063.927002 787.500000 1090.099976 787.500000 1108.250000 C 787.500000 1126.400024 800.000000 1209.599976 846.949235 1249.412949" stroke="#000536" fill="none" class="connection stroke-B1" style="stroke-width:2;" marker-end="url(#mk-d2-37886755-3488378134)" mask="url(#d2-37886755)" /><text x="836.000000" y="1073.000000" fill="#676C7E" class="text-italic fill-N2" style="text-anchor:middle;font-size:16px">indexed traces + SQL scans</text></g><g class="KGZhbm91dC5xdWVyeSAtJmd0OyBzdG9yZS5xc3RhdGUpWzBd"><path d="M 1194.428147 1029.400142 C 1233.800049 1068.000000 1244.000000 1090.099976 1244.000000 1108.250000 C 1244.000000 1126.400024 1274.199951 1212.400024 1391.343755 1264.377694" stroke="#000536" fill="none" class="connection stroke-B1" style="stroke-width:2;" marker-end="url(#mk-d2-37886755-3488378134)" mask="url(#d2-37886755)" /></g><g class="KGZhbm91dC5tYWludCAtJmd0OyBzdG9yZS50ZWxlbWV0cnkpWzBd"><path d="M 1423.250000 1030.000000 C 1423.250000 1068.000000 1423.250000 1090.099976 1423.250000 1108.250000 C 1423.250000 1126.400024 1350.800049 1216.000000 1064.894232 1283.086240" stroke="#000536" fill="none" class="connection stroke-B1" style="stroke-width:2;" marker-end="url(#mk-d2-37886755-3488378134)" mask="url(#d2-37886755)" /><text x="1309.500000" y="1231.000000" fill="#676C7E" class="text-italic fill-N2" style="text-anchor:middle;font-size:16px">atomic replacement</text></g><g class="KGZhbm91dC5odHRwIC0mZ3Q7IHN0b3JlLmNvbnRyb2wpWzBd"><path d="M 1097.986840 390.729053 C 1713.599976 461.700012 1868.000000 499.799988 1868.000000 530.250000 C 1868.000000 560.700012 1868.000000 601.299988 1868.000000 631.750000 C 1868.000000 662.200012 1868.000000 702.799988 1868.000000 733.250000 C 1868.000000 763.700012 1868.000000 804.299988 1868.000000 834.750000 C 1868.000000 865.200012 1868.000000 905.799988 1868.000000 936.250000 C 1868.000000 966.700012 1868.000000 1005.200012 1868.000000 1032.500000 C 1868.000000 1059.800049 1868.000000 1090.099976 1868.000000 1108.250000 C 1868.000000 1126.400024 1868.000000 1209.000000 1868.000000 1245.000000" stroke="#000536" fill="none" class="connection stroke-B1" style="stroke-width:2;" marker-end="url(#mk-d2-37886755-3488378134)" mask="url(#d2-37886755)" /><text x="1853.000000" y="502.000000" fill="#676C7E" class="text-italic fill-N2" style="text-anchor:middle;font-size:16px">users, sessions, settings, dashboards, threads</text></g><g class="KGZhbm91dC5hbGVydCAtJmd0OyBzdG9yZS5jb250cm9sKVswXQ=="><path d="M 1601.164214 825.914213 C 1648.550049 873.299988 1660.750000 905.799988 1660.750000 936.250000 C 1660.750000 966.700012 1660.750000 1005.200012 1660.750000 1032.500000 C 1660.750000 1059.800049 1660.750000 1090.099976 1660.750000 1108.250000 C 1660.750000 1126.400024 1682.000000 1211.000000 1763.516986 1257.033121" stroke="#000536" fill="none" class="connection stroke-B1" style="stroke-width:2;" marker-end="url(#mk-d2-37886755-3488378134)" mask="url(#d2-37886755)" /><text x="1661.000000" y="1062.000000" fill="#676C7E" class="text-italic fill-N2" style="text-anchor:middle;font-size:16px">rules and fired alerts</text></g><g class="KGZhbm91dC5hZ2VudCAtJmd0OyBtb2RlbClbMF0="><path d="M 805.750000 826.500000 C 805.750000 873.299988 682.349976 903.099976 192.709926 972.935213" stroke="#000536" fill="none" class="connection stroke-B1" style="stroke-width:2;" marker-end="url(#mk-d2-37886755-3488378134)" mask="url(#d2-37886755)" /><text x="522.500000" y="931.000000" fill="#676C7E" class="text-italic fill-N2" style="text-anchor:middle;font-size:16px">HTTPS</text></g><mask id="d2-37886755" maskUnits="userSpaceOnUse" x="-101" y="-121" width="2220" height="1635">
+<rect x="-101" y="-121" width="2220" height="1635" fill="white"></rect>
 <rect x="610.000000" y="439.000000" width="164" height="21" fill="black"></rect>
 <rect x="717.000000" y="534.000000" width="90" height="21" fill="black"></rect>
 <rect x="830.000000" y="677.000000" width="141" height="21" fill="black"></rect>
@@ -113,9 +113,9 @@
 <rect x="300.000000" y="419.000000" width="175" height="21" fill="black"></rect>
 <rect x="640.000000" y="292.000000" width="49" height="21" fill="black"></rect>
 <rect x="1122.000000" y="244.000000" width="97" height="21" fill="black"></rect>
-<rect x="745.000000" y="1058.000000" width="180" height="21" fill="black"></rect>
-<rect x="1246.000000" y="1215.000000" width="137" height="21" fill="black"></rect>
+<rect x="746.000000" y="1057.000000" width="180" height="21" fill="black"></rect>
+<rect x="1241.000000" y="1215.000000" width="137" height="21" fill="black"></rect>
 <rect x="1702.000000" y="486.000000" width="302" height="21" fill="black"></rect>
-<rect x="1591.000000" y="1048.000000" width="140" height="21" fill="black"></rect>
+<rect x="1591.000000" y="1046.000000" width="140" height="21" fill="black"></rect>
 <rect x="498.000000" y="915.000000" width="49" height="21" fill="black"></rect>
 </mask></svg></svg>
diff --git a/docs/diagrams/persistence.d2 b/docs/diagrams/persistence.d2
index d5b508b5..b0d74d6f 100644
--- a/docs/diagrams/persistence.d2
+++ b/docs/diagrams/persistence.d2
@@ -49,7 +49,7 @@ maintenance: "Bounded maintenance" {
   merge -> swap
 }
 
-querystate: "Rebuildable query state\nstorage.data_dir/query" {
+querystate: "Rebuildable query state\nFANOUT_DATA_DIR/query" {
   shape: cylinder
   tooltip: DuckDB rollups and temporary spill. Not authoritative telemetry.
 }
diff --git a/docs/diagrams/persistence.svg b/docs/diagrams/persistence.svg
index 50c353fc..13d27eb5 100644
--- a/docs/diagrams/persistence.svg
+++ b/docs/diagrams/persistence.svg
@@ -1,27 +1,27 @@
-<?xml version="1.0" encoding="utf-8"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" data-d2-version="v0.7.1-HEAD" preserveAspectRatio="xMinYMin meet" viewBox="0 0 1274 2176"><svg class="d2-1108726992 d2-svg" width="1274" height="2176" viewBox="-89 -89 1274 2176"><rect x="-89.000000" y="-89.000000" width="1274.000000" height="2176.000000" rx="0.000000" fill="#FFFFFF" class=" fill-N7" stroke-width="0" /><style type="text/css"><![CDATA[
-.d2-1108726992 .text {
-	font-family: "d2-1108726992-font-regular";
+<?xml version="1.0" encoding="utf-8"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" data-d2-version="v0.7.1-HEAD" preserveAspectRatio="xMinYMin meet" viewBox="0 0 1274 2176"><svg class="d2-2701310579 d2-svg" width="1274" height="2176" viewBox="-89 -89 1274 2176"><rect x="-89.000000" y="-89.000000" width="1274.000000" height="2176.000000" rx="0.000000" fill="#FFFFFF" class=" fill-N7" stroke-width="0" /><style type="text/css"><![CDATA[
+.d2-2701310579 .text {
+	font-family: "d2-2701310579-font-regular";
 }
 @font-face {
-	font-family: d2-1108726992-font-regular;
-	src: url("data:application/font-woff;base64,d09GRgABAAAAABI8AAoAAAAAG1QAAguFAAAAAAAAAAAAAAAAAAAAAAAAAABPUy8yAAAA9AAAAGAAAABgXd/Vo2NtYXAAAAFUAAAAtwAAAPpHquUgZ2x5ZgAAAgwAAAs6AAAPXAGFQdRoZWFkAAANSAAAADYAAAA2G4Ue32hoZWEAAA2AAAAAJAAAACQKhAX3aG10eAAADaQAAAC9AAAA1GMGCvBsb2NhAAAOZAAAAGwAAABsbFhwPG1heHAAAA7QAAAAIAAAACAATQD2bmFtZQAADvAAAAMrAAAIFAbDVU1wb3N0AAASHAAAACAAAAAg/9EAMgADAgkBkAAFAAACigJYAAAASwKKAlgAAAFeADIBIwAAAgsFAwMEAwICBGAAAvcAAAADAAAAAAAAAABBREJPAEAAIP//Au7/BgAAA9gBESAAAZ8AAAAAAeYClAAAACAAA3icfM07LgQBHIDx35i1Xmut93vNetu3uYFEIxGdeqIUJ3ANJ3ACeqJwAjeQuIBaI38xB9h85a/4kEglqKn4RlNDqi7T0dM3kDt34dK1wq371kMEMm3d0ofOSr9SuHH37/GlSvwSP/Eeb/EaL/ERz/H0+VjeRpUYOtXV0zFw7ETbmFTFuKoJk6ZMm1Ezq25OX8O8BYuWLFuxas26DZu2bGvakWnZtWffgUNHcv4AAAD//wMAJfUl2AB4nGxXa3Ab13n97gWIJQmA4AqPBUCAAHZJLB7Eg1gsliRAgCTAh/gCCZAUHyIlSpRIPStRjTSyFKmJHEnjqi6auBOPKzvKRDONOlXTTGboePTPqlW6iePJTCePJvV48oPR1G5ds3QfY3HR2QVIgZr8WswC995zzne+811AFcwAYB6/BgqoAR3sAyMAR7rIZhfLMoTACQJDKQQWkcQM+q1YQGh/VBmLKVt7Pum5fP06mr6GX9s+3fHy8vJ7C5cuiX+28VSMoJ89BQwKAGzHBagBEkBPcKzbzTIqlULP6RmWIX7ieM+xz1mv1Dn/5aOFj2aSn6XQHy0tCWfa28+Is7iwfW59HQBAAbMAuAkXgAQrMBI2LmIyGQ0qwig/VIyCi8T4qJthyJ0Ps4/Tx9pbQ/Gh1LnBa4sTgyMjx1YnF+anVnHB2dfRmtUp1aOZrikfutwRaQ9vb6V6OtsBAEG0uIUb8F2wA1TRbjcfjcW4iIki3G6GVqmMBpOJi8QESqVCudzXhoZfzicO2gLWHl9ynovMJUODjiB7RDP++qmTr+danTEb3X0xl7vc46GjgQgAYJlLFBegWtJEZmI0qBh2F/f919968y8nhy5cuHBhCBce3H3z7zJ/evXqN2RsswDwEBckXTmSI2fzuLB9rvQe/RQXoKr03mWczSMHLmy/3Q8763AAF0Avf6+nOLebJzmSUbCMyWQkZ6f+vV+pILJT/9GvVBK4IC7djpyKovz2OfTmrdaVqPgAsKzLMXwXdC8oIxeAjcRk+LQsEBrOXe/vv57LXxsYuJaPHwifnJ4+GZ7WTLxx4sS3x8e/feLEGxP705dzL7366ku5y2nY1UWNC6AGQ0WFGYZ8XtJHg2eTN0+fPjKVPzC1gAtNkwPLS+IzNNDd1y/Ie0SLc/gCvgta8AE078FURbvZIK7ETDyv5PAuRqSYe8nefzpRQt+x0kdN8iZaW6+LtKevTEiAJ66kP5pJ105/83CJy0JhRuNvqVJ2qWp2eThxAeqAquBB6BlFJZUP0ivxscxfL7x16exILjdyFheY8czwPCn+DhnFT9BMqqs7KumCwFfcQp/huxCQVWcFGTUfdbvZ53zK7pS0p6hGLLFD9b0X/RHmENc9YG91LDg6vfxCPL7EBBr3B4W0K2Kdd3c2xZY0fEtHcyAepj22Oq/W1xOOZAOBppjdFW1xeK1qT32guzU6GQEENgD0DBeAkFgxvMvIkL97gj5+ggf7+rbXSlgPFLdwEBek/JAdQnJkqV9ikt0kVOn0qWTe2+tv6fOOJU9qYldPoK+JX83Oud1zWXRDvH7iakyu4xb6IdoEKzQBULTUhEJUpkiwcgGNJCMFCRuJCbzclO92jv/5X5F+j2/Q7qSPdsyMZQgFPW5ikszlxYhmf/fYJOloY5yGdpP3zJz4iw6br4d23NIlQt5mwJArbqEv8TrowSkjZxmCITkjUTqr5G+pbrScOMhL73cqiJ4cdmU9h47ED/UlsvFeRxfjTGlc9ghef3fazt48n7+Y7F2eHTtKO4s2qqRPsLiFfoA2wbangyqyZceQ+7pWEt2nkuFei88Ysrf0svk03WFqco1pEqtjudUETcX05tBkW37ZbhDsLsl3oeIW+vUOh5JmEnqK5bkdsQR+96D/nTsbXxR8SacynyEUtmFLV8LR3sim3H2ab1zOXkg2WvOPttvabd7etGijQvm2A0cBy/j/CW2CGRx7GEgGd+22k8IlS4Wo7pPJ1JIwfwxh8cdVB/qYeIPdkf0JUqbauXFN52p2bDV5dUVrqRk5aCRjhkbkHhzJyjo1AqAU/mfJR5LXBD5a1omhjUbOyJCHe3p691O++n0NtszyMvpesmpk8EANkdIsjKTFeXlmBIpO9CnahFbohJFdF/Huioe8KWdkykOEZmVpuHLNFTs1NxpM+nLf0u7Sb/575pzbtc9C681sZKLV0KR9sERS4bEIS2v3NbcuTE4mzg77OhN+f6Iz1jfBhSbqXPVW89DHmZSj3aRUe2yOoFZpyPj5UR9RlarnHdFhL6luMFCNQmdgOIR+mOL5RILnU+LtTjdtVSr1PiMblLXJAaBf4vVySu54lGRIWXSCzOUUzEhkpD/XEm6ON+P1d5dcocV58afIm0m6m8V7UCxCLwD8CK9hN3AAoILoVdjdewOvg0bem+T0HKFnWMKYG1d8OPe9d2ZfncPrYiOCx+K//tvJPymvKW7Br/A66EoaS32+Y4QHQW+urkZJEOpqk6adx8e3X9OTCCWVyhIP/DnaBJd8FsXJPKg9bIjdZy5DKJzD/raUzj3aMrQ/1xKMZXItoVgGbfQxodYWb3SH4pB4r/zY0QptgqHyjEqtMoSCGd0VS95sj1Zlz/8n2gQdNPzBubfrEaSLL6dSy/HE8VTqeCI1MpJKjo6W+zWxmhtbTWSW8xMrKxP5Zalfc0UOfYk2y/36HJ3sRDdLGcueK2WOJIAr6184Ej/URqdpfEmOnFSTK/kB/lGbzXPrfO5istE6eR+p9mSOlAsc+vXOOVW8IG+/a36BIxWVuYBuKu1DvlI4dLlwdc+Hu8HwwcNpm0cOB7s9uD2CVM+TYcc7C2izfKspsSknW0loy4DXTtVrDDpH2oI2poOx2gGlMpIU5TseAltxC91Am9LkpvbOOXnMvTDlSkPu59EFxuvM+MNhF9dA9/hmsoFRm8cScwb9jeEGJhPwZjWsTbC4Ag4LTdVqXbw3nnVSUb3ZZ6PsRrXWJQTZHo98vrm4hXrxWaDKPmZ4QeDksNn18yejnQPDtb03brh82kZNvSGkmR1A2mTV7dtpcTPQWqNMEmp5r6HiFvoZ2gDDCz1BlqP445GBvD/sjtOSLvSwZnEeRcVfZpKsH82I1mFPGJDUg+gf0QZoATgFpzeZJEkFPad49IPJg2pKrVRTtQfH/xZtiJ82DTDMQBMyiFaJBwBeQxvgemFdxQ6MonQPJxTfuTUxUF1HKKvra4bGhmvIamW1jugf/fpSX42uRlldX5tBG+Lv6TRNp2lkqfhkRVVMprm5lxGfAYI6APT3aAMsAJzAclT5KIEjKKZ85yeIuu98a6ZbbdYq1SZ1fOpbb830a611Sq1Z0yM+PaX3GQw+/anPvzhvajEa/dR5WUdNMSRr0FDpCUHYI0cdnq23a+qrDTXemE79ePKo2qJWqg21B8beJkO9P1cpu3FVPNCEfi/+l2OAdg04kXZ7MzwckHqwpbiF3sOvgHqn6tFyC1b29f8dPnPm8KEzZw61ZTJtbb29mof3vvv973/33sOe63fuXLly5851GWsWAL2Nr0l146SRy8dighTQ2W/+cUu3NfVyBv2Cr6bqt59kSn5vAkD/gF+RUoXjk5iPVl5vDCqVFOyc0XP4Zl+i05OxhTxzyZnj6a8MW9ss77Qe/ouvcEJfwBlq4ZcnE1duZbGyHxB0F7fgx7AK6r1svmphGIuZYTRMg51h7A2MdH6oOAVPYBX2AVBsLMaqaKZiSdrgDyOswmamyeJs7vubsD7lQXZbgyMa6FqU8XvhN0iHrNJ/EYHnjN6N36RS0ntN8evoafEd6T3Fu4wa9NtrggAIaouH0Th+Ir9HHKpF6oT4xT3F8WdvlPToQPfRCl6XvKRnBVagBI4SKIIi2Fc87Yu64zWtNcu6xTa2H923L3iCltOnzEHPgn1KWkvDCvoQt0i8BZ7hOV5uXOOv1ta619ZWHicfP04+ln7HFj/HWUxADUAVK7h4FysgI0r53xcH0dr7flSvCz7KPAqK/6PcnYdwH23s/N/K5dCG1GPF9/EgCHhNOo+sEM3scJjNDgcetFvMjY1mix3+HwAA//8DAIXxQU4AAAABAAAAAguFXuYgA18PPPUAAwPoAAAAANhdoKEAAAAA3WYvNv46/tsIbwPIAAAAAwACAAAAAAAAAAEAAAPY/u8AAAiY/jr+OghvAAEAAAAAAAAAAAAAAAAAAAA1eJwsyq1KBGEcRvHzPBsEWYwyYVkGXZD1Y7cMiorBYFIQ/kV8BavB6xCT3az3YV6LxXuw6gsyzKQRh03nhJ+fuGYBLhn4guRjKt+RtELSF8mPJD9TeX/ZQ5LX2XbByA9cqaHylNCCmXeY64eZJozVsOeSoOZM3wQdMTghvEl43Nvo/Q2hV0YKCpec65OhPyj0xtr/K7OrzKUyE1pOaZnrgKl+GeqWVb1wpMyG79miJqB7/wMAAP//AwC6/ik8AAAAAAAALAAsAFAAhgC2ANQA4ADwARIBQgFkAaYBzgISAiQCSAKAArQC4gMUA0gDagPWA/gEBAQeBDoEbASOBLoE7gUiBUIFggWoBcoF5gYgBkwGfAaiBroG5Ab6BxoHJgcyB0IHYAd0B4wHmAeuAAEAAAA1AIwADABmAAcAAQAAAAAAAAAAAAAAAAAEAAN4nJyU32obVxDGf4oltaE0F8UE58acy7Y4KzXYIbGv1nVMlhor1Sr9A6WwltaSkLS77K7kuPQBet236Fvkqs/Rhyi9LjMaKdq0ECxCzLc6M998Z+abA+zyDzvU6veBP5s/GK6x3zw2fI8HzQPDO1w0/jJc34hpMGj8arjJl42u4Y94W//d8Mcc1n82fJ+9+rnhT3hS3zX86Y7jb8MPOOTtEtfgGb8ZrrFHZvgeu/xkeIeHGGetzkPahht8xr7hJvtAjzElU8YkDHFcM2bInJyYgpCYnDHXxAxwBPhMKfXXhEiRY/i/v0aElOREyjiixDElZEpEwcgYf9GslFdaUerkiqSaT8mIiCvNmBCR4EgZkpIQM1GekpKMY1q0KOir3oySAo+CMVM8UnKGtOhwzgU9RowpcJwrkygLSbmm5IZI6zuLkM70iUkoTNWchIHqdKov1uyACxwdMo3dZL6oMBzg+E6zRZvEOL7C0/9uQ1m17kpNxEL7KT28Yqo6b3SCI+241PX5VnHJMW6r/lSVfLhHA1Unsx5zxVznL/OTPFGS4NwePqE6KHSPcJzqd0CoHfmegB4v6fCann77dOnic0mPgBea26GL42s6XHKmGYHi5dm5OuaSH3F8Q6Axwh1bf6Tn8vWGzNwt2sUZco8ZmW6BzFjuL86Pt5qw7FBacUehrujrHkmk7IF0RfYsYmiuyNQVM+3lyhuF9W9gjpDTUmf77ly2YWG7t9riW1LdYcfcNMnkloo+NFXvPc/c6D+PiAEpVxrRJ2VGi5JbvdsrIuZMcZypj1/qlpT46xypc6suiZmpgoBEeXIy/RuZb0LT3q/43tlbIps30x2drG+1TRVhTjZm9Fq7tzoLrcvxxgRaNtXUcmTCwry8qXhfor2K/lDdX+jrlvKYLrG+rjL//D/vwBM82hxyxAkjrSP8CQt7I9r6TrR5zon2YEKsUfJqvtFuCcMRHk854ojnPK1w+pxxSoeTO2hcZnU45cV7J5scbs3ijOcPVdNWvY7H669nW8/r8zv48gsOKi+jKJc9yFkY2zv/XxIxEy1ub7Mv7hHevwAAAP//AwAHW0wwAAADAAAAAAAA/84AMgAAAAAAAAAAAAAAAAAAAAAAAAAA");
+	font-family: d2-2701310579-font-regular;
+	src: url("data:application/font-woff;base64,d09GRgABAAAAABJkAAoAAAAAG4wAAguFAAAAAAAAAAAAAAAAAAAAAAAAAABPUy8yAAAA9AAAAGAAAABgXd/Vo2NtYXAAAAFUAAAAvQAAAQQFXCgIZ2x5ZgAAAhQAAAtVAAAPhBtfDoloZWFkAAANbAAAADYAAAA2G4Ue32hoZWEAAA2kAAAAJAAAACQKhAX4aG10eAAADcgAAADAAAAA2GT0C0psb2NhAAAOiAAAAG4AAABucnBuuG1heHAAAA74AAAAIAAAACAATgD2bmFtZQAADxgAAAMrAAAIFAbDVU1wb3N0AAASRAAAACAAAAAg/9EAMgADAgkBkAAFAAACigJYAAAASwKKAlgAAAFeADIBIwAAAgsFAwMEAwICBGAAAvcAAAADAAAAAAAAAABBREJPAEAAIP//Au7/BgAAA9gBESAAAZ8AAAAAAeYClAAAACAAA3icfM5LLsNRHAXg72qpR73f73+9taVVK5CIRCJmxo2hWIFt2IEVMCfCDqxAYhdM/MSNsZzBmXzJOUhKEqrKPlEolHM37NnX0nHsxKkzF7qu3NRuI7Koa2bRdvQnznVduv4V8aEixbcUX/EaL/EcT/EYb/EQ9+93efP/JAc6+UNT2666hh4lZb36VPQbMGhI1bARo8a0jJswacq0GbPmzFuwaMmyFasKNWvWbdi0ZduOQ34AAAD//wMAh9cocQAAAHicbFdrcBvXef3uBYglCYDgCo8FQIAAdkksHsSDWCyWJECAJECQ4gskQFJ8mJRo0yL1rEw11ugRqYkcSeOqLpq4E48rO8pEM406VdNMZuh49M+qVbqJ48lMJomTVOPJD0ZTp03NMn3E4qKzC5ACNfm1mMXee79zvnPOtws1MAuAefw6KKAOdHAAjAAc6SJbXSzLEAInCAylEFhEErPoV2IRoYNRZSymbO/7tO/8lSto5jJ+fedk1ysrK+8vnjsn/sXmYzGCfvQYMCgAsB0XoQ5IAD3BsW43y6hUCj2nZ1iG+IHjfccBZ6NS5/zFo8VHs8nfpdCfLC8Lpzo7T4lzuLhzZmMDAEABcwC4BReBBCswUm1cxGQyGlSEUb6oGAUXifFRN8OQuz/mHqRf7GwPxYdTZ4YuL00OjY6+uDa1uDC9hovObFd7TqdUj2V6pn3ofFekM7yznerr7gQABNHSNm7Ct8AOUEO73Xw0FuMiJopwuxlapTIaTCYuEhMolQrl818aHnmlkHjOFrD2+ZILXGQ+GRpyBNnnNRNvnDj+Rr7dGbPRvS/n8+f7PHQ0EAEALGOJ4iLUSpzISIwGFcPu1X3njbff+uup4bNnz54dxsW7t976h8yfX7r0Fbm2OQD0E5lPqT9Gl5EzMuQcuiB+/Ic/4GL2UVb8xe5zcA8XJf45kiPnCri4c6ay/oe4CDXl+y7jXAE5cHHnnQHYXYcDuAh6+X89xbndPMmRjIJlTCYjOTf97wNKBZGb/o8BpZLARXH5RuREFBV2zqC3rrevRsW7gGX+XsS3QPcMg3Kj2EhMhknLRKKR/JWBgSv5wuXBwcuF+KHw8ZmZ4+EZzeSbx459fWLi68eOvTl5MH0+f+G11y7kz6dhjz81LoIaDFVKYBjyaevvD51OXjt58vnpwqHpRVxsmRpcWRafoMHe7IAg7xEtzeOz+BZowQfQuq+mGtrNBnF1zcTTjo/s1YgU8xfsAycT5eq7VrPUFG+itY26SGf64qRU8OTF9KPZdP3MV4+UsSwWZzX+thplj6puD4cTF6EBqCochJ5RVEP5ML0aH8/87eLb506P5vOjp3GRmciMLJDir5FR/BTNpnp6oxIvCHylbfQ7fAsCMuusIFfNR91u9imeiool7imqGUvoUGP/y/4Ic5jrHbS3OxYd3V5+MR5fZgLNB4NC2hWxLri7W2LLGr6tqzUQD9MeW4NX6+sLR3KBQEvM7oq2ObxWtacx0NsenYoAAhsAeoKLQEioGN5lZMhfP0SfPMRD2ezOernWQ6VtHMRFKWdkhZAcWfZVTJKbVFU6fSJZ8Pb727Le8eRxTezSMfQl8Yu5ebd7PoeuileOXYrJfdxG30VbYIUWAIqWzCpEZYgEKzfQSDJS4LCRmMDL5n2ve+Iv/4b0e3xDdif9QtfseIZQ0BMmJsmcX4poDvaOT5GODsZp6DR5T82LP+2y+fpox3VdIuRtBQz50jb6HG+AHpxy5SxDMCRnJMpnlfUt9Y2Wkwl56YNOBdGXx66c5/Dz8cPZRC7e7+hhnCmNyx7BG+/N2NlrLxVeTvavzI2/QDtLNqrMT7C0jb6DtsC2z0FVGbQryAM9q4neE8lwv8VnDNnb+tlCmu4ytbjGNYm18fxagqZienNoqqOwYjcIdpeku1BpG328i6HMmVQ9xfLcLlkCv3fQ/86fji8JvqRTWcgQCtuIpSfh6GxmU+6s5ivnc2eTzdbC/Z2OTpu3Py3aqFCh49ALgOX6/wVtgRkc+xBIAnft2UnhkqlCVO/xZGpZWHgRYfH7NYeyTLzJ7sj9AClTndyEpnstN76WvLSqtdSNPmckY4Zm5B4azck8NQOgFP6JpCNJawIfrfDE0EY5G4/09fUfpHyNB5psmZUV9K1kzejQoToipVkcTYsL8mwJlJzot2gL2qEbRvdUxLurLvKmnJGpDBualanhKj1X7PbcaDDpK76l3eVn/nv2jNt1wELrzWxkst3Qor27TFLh8QhLaw+0ti9OTSVOj/i6E35/ojuWneRCkw2uRqt5+JNMytFpUqo9NkdQqzRk/PyYj6hJNfKO6IiXVDcZqGahOzASQt9N8XwiwfMp8Ua3m7YqlXqfkQ3K3OQB0M/wRiUldzVKMqRMOkHm8wpmNDI6kG8Lt8Zb8cZ7y67Q0oL4Q+TNJN2t4m0olaAfAL6H17EbpJBRAX8J9vbexBugkfcmOT1H6BmWMOYnFB/Nf+vdudfm8YbYjOCB+K//dvzPKmtK2/BzvAG6MseSz3eFcDfozTfUKQlCXWvSdPL46M7rehKhpFJZxoE/Q1vgks+iOBkHtQ8NsXfNZwiFc8TfkdK5x9qGD+bbgrFMvi0Uy6DNLBNqb/NGdyEOi7crl12u0BYYqs+o5ipDKJixPbLkzfZxVdH8f6It0EHTH517expBuvhKKrUSTxxNpY4mUqOjqeTYWMWvibX8+Fois1KYXF2dLKxIfs2XOPQ52qr49Wl1shLdLGWsaK6cORIBrpx/8fn44Q46TeNzcuSkWlzJD/H3Omye6y/lX042W6fuINW+zJFygUMf755Twwvy9nviFzhSUZ0L6JrSPuwrh0OPC9f2fbQXDB/em7F55HCw24M7o0j1NBl2tbOItipvP2U0lWQrE20Z9NqpRo1B50hb0OZMMFY/qFRGkqL8LojAVtpGV9GWNLmp/XNOHnPPTLnykPtxdJHxOjP+cNjFNdF9vtlcYMzmscScQX9zuInJBLw5DWsTLK6Aw0JT9VoX743nnFRUb/bZKLtRrXUJQbbPI59vLm2jfnwaqIqOGV4QODls9vT86Vj34Eh9/9WrLp+2WdNoCGnmBpE2WXPjRlrcCrTXKZOEWt5ruLSNfoQ2wfCMJ8hKFH8yOljwh91xWuKFHtEsLaCo+LNMkvWjWdE64gkDkjyI/hltghaAU3B6k0miVNBzivvfmXpOTamVaqr+uYm/R5vib1sGGWawBRlEq4QDAK+jTXA9s65qB0ZRfl8nFN+4PjlY20AoaxvrhsdH6shaZa2OGBj78nK2TlenrG2sz6BN8Td0mqbTNLJU/bKiGibT2trPiE8AQQMA+ke0CRYATmA5qnKUwBEUU/k2IIiGb3xttldt1irVJnV8+mtvzw5orQ1KrVnTJz4+ofcZDD79ic9+/5KpzWj0Uy/JPGpKIZmDpmpNCMI+OhrwXKNd01hrqPPGdOoHUy+oLWql2lB/aPwdMtT/Y5WyF9fEAy3oN+J/OQZp16ATaXe2wiMByYNtpW30Pn4V1Ltdj1YsWO3r/zty6tSRw6dOHe7IZDo6+vs1925/89vf/ubte31Xbt68ePHmzStyrTkA9A6+LPWNk0YuH4sJUkDnvvqnbb3W1CsZ9FO+lmrceZgp670FAP0TflVKFY5PYj5a/XpjUKmkYOeMniPXsoluT8YW8swnZ4+mvzBi7bC8237kr77ACdmAM9TGr0wlLl7PYeUAIOgtbcP3YQ3U+9F80cIwFjPDaJgmO8PYmxjp/FBpGh7CGhwAoNhYjFXRTNWStMEfRliFzUyLxdma/buwPuVBdluTIxroWZLr98IvkQ5ZpW8RgeeM3s1fplLSfU3py+hx6V3pPsW7jBr0q8uCAAjqS0fQBH4o30ccqkfqhPj724qjT94s89GF7qBVvCFpSc8KrEAJHCVQBEWwr3o6l3RH69rrVnRLHewAumNf9AQtJ0+Yg55F+7S0loZV9BFuk3ALPMNzvGxc48/X13vX11cfJB88SD6QnmNLn+EcJqTvrBpWcPEuVkBGlPJ/IA6h9Q/8qFEXvJ+5HxT/R7k3D+EO2tz93srn0abksdIHeAgEvC6dR1aRZnY4zGaHAw/ZLebmZrPFDv8PAAD//wMAGYpMuwAAAAABAAAAAguFn8IBb18PPPUAAwPoAAAAANhdoKEAAAAA3WYvNv46/tsIbwPIAAAAAwACAAAAAAAAAAEAAAPY/u8AAAiY/jr+OghvAAEAAAAAAAAAAAAAAAAAAAA2eJwsyq1KBGEcRvHzPBsEWYwyYVkGXZD1Y7cMiorBYFIQ/kV8BavB6xCT3az3YV6LxXswqi/IMJNGHEznhJ8fuGQBLhn4jORDKt+Q9EnSEkkfJN+T/Ejl3f/uk7zKpgtGvuNCDZWnhBbMvMVc38w0YayGHZcENSf6IuiIwRHhdcLj3kbvrwg9M1JQuORU7wz9RqEXVv5emW1lzpWZ0HJMy1x7TPXDUNcs64kDZdZ8ywY1Ad3rLwAAAP//AwC+mSqFAAAALAAsAFAAhgC2ANQA6AD0AQQBJgFWAXgBugHiAiYCOAJcApQCyAL2AygDXAN+A+oEDAQYBDIETgSABKIEzgUCBTYFVgWWBbwF3gX6BjQGYAaQBrYGzgb4Bw4HLgc6B0YHVgd0B4gHoAesB8IAAAABAAAANgCMAAwAZgAHAAEAAAAAAAAAAAAAAAAABAADeJyclN9qG1cQxn+KJbWhNBfFBOfGnMu2OCs12CGxr9Z1TJYaK9Uq/QOlsJbWkpC0u+yu5Lj0AXrdt+hb5KrP0YcovS4zGinatBAsQsy3OjPffGfmmwPs8g871Or3gT+bPxiusd88NnyPB80DwztcNP4yXN+IaTBo/Gq4yZeNruGPeFv/3fDHHNZ/Nnyfvfq54U94Ut81/OmO42/DDzjk7RLX4Bm/Ga6xR2b4Hrv8ZHiHhxhnrc5D2oYbfMa+4Sb7QI8xJVPGJAxxXDNmyJycmIKQmJwx18QMcAT4TCn114RIkWP4v79GhJTkRMo4osQxJWRKRMHIGH/RrJRXWlHq5Iqkmk/JiIgrzZgQkeBIGZKSEDNRnpKSjGNatCjoq96MkgKPgjFTPFJyhrTocM4FPUaMKXCcK5MoC0m5puSGSOs7i5DO9IlJKEzVnISB6nSqL9bsgAscHTKN3WS+qDAc4PhOs0WbxDi+wtP/bkNZte5KTcRC+yk9vGKqOm90giPtuNT1+VZxyTFuq/5UlXy4RwNVJ7Mec8Vc5y/zkzxRkuDcHj6hOih0j3Cc6ndAqB35noAeL+nwmp5++3Tp4nNJj4AXmtuhi+NrOlxyphmB4uXZuTrmkh9xfEOgMcIdW3+k5/L1hszcLdrFGXKPGZlugcxY7i/Oj7easOxQWnFHoa7o6x5JpOyBdEX2LGJorsjUFTPt5cobhfVvYI6Q01Jn++5ctmFhu7fa4ltS3WHH3DTJ5JaKPjRV7z3P3Og/j4gBKVca0SdlRouSW73bKyLmTHGcqY9f6paU+OscqXOrLomZqYKARHlyMv0bmW9C096v+N7ZWyKbN9MdnaxvtU0VYU42ZvRau7c6C63L8cYEWjbV1HJkwsK8vKl4X6K9iv5Q3V/o65bymC6xvq4y//w/78ATPNoccsQJI60j/AkLeyPa+k60ec6J9mBCrFHyar7RbgnDER5POeKI5zytcPqccUqHkztoXGZ1OOXFeyebHG7N4oznD1XTVr2Ox+uvZ1vP6/M7+PILDiovoyiXPchZGNs7/18SMRMtbm+zL+4R3r8AAAD//wMAB1tMMAAAAwAAAAAAAP/OADIAAAAAAAAAAAAAAAAAAAAAAAAAAA==");
 }
 .appendix-icon {
 	filter: drop-shadow(0px 0px 32px rgba(31, 36, 58, 0.1));
 }
-.d2-1108726992 .text-bold {
-	font-family: "d2-1108726992-font-bold";
+.d2-2701310579 .text-bold {
+	font-family: "d2-2701310579-font-bold";
 }
 @font-face {
-	font-family: d2-1108726992-font-bold;
-	src: url("data:application/font-woff;base64,d09GRgABAAAAABIYAAoAAAAAGywAAguFAAAAAAAAAAAAAAAAAAAAAAAAAABPUy8yAAAA9AAAAGAAAABgXxHXrmNtYXAAAAFUAAAAtwAAAPpHquUgZ2x5ZgAAAgwAAAsUAAAPHJcQngloZWFkAAANIAAAADYAAAA2G38e1GhoZWEAAA1YAAAAJAAAACQKfwX0aG10eAAADXwAAAC9AAAA1GjMCQdsb2NhAAAOPAAAAGwAAABsafxt2G1heHAAAA6oAAAAIAAAACAATQD3bmFtZQAADsgAAAMvAAAIKgjwVkFwb3N0AAAR+AAAACAAAAAg/9EAMgADAioCvAAFAAACigJYAAAASwKKAlgAAAFeADIBKQAAAgsHAwMEAwICBGAAAvcAAAADAAAAAAAAAABBREJPACAAIP//Au7/BgAAA9gBESAAAZ8AAAAAAfAClAAAACAAA3icfM07LgQBHIDx35i1Xmut93vNetu3uYFEIxGdeqIUJ3ANJ3ACeqJwAjeQuIBaI38xB9h85a/4kEglqKn4RlNDqi7T0dM3kDt34dK1wq371kMEMm3d0ofOSr9SuHH37/GlSvwSP/Eeb/EaL/ERz/H0+VjeRpUYOtXV0zFw7ETbmFTFuKoJk6ZMm1Ezq25OX8O8BYuWLFuxas26DZu2bGvakWnZtWffgUNHcv4AAAD//wMAJfUl2AB4nIRXaWwb13Y+93IZixotXIZDUuI64gwXiRI5HI4WSpQsipJlUqstyc/anpD4yZYsu7b8pKR2/YA4L60f/ZxGimMnbRK4MdqmTuDAKOCmVYsGaBIj/lUnDVAkTdoGbhEDiRqoQZFKZHGHkkz7T3+IV7i8y3e+853vXIIGBgDwDF4FFZRABRiAARD1br1XFASOkkVZ5liVLCA9NYANuRtvCX61368OuK46n52aQplJvLo1fzgzM/PjVEtL7vW/ej93CZ1+HwDnfwLAnTgLJaAHMFKiwPMCp9WqjKKREzjqQeVvKsqqytS09ad77937I99HPtQbj4cXxOjx3PM4u7X42msAACrIAOA4zoIebOAh2MSI2cyYtBSjDFpOJUZiUpTnOL0YUcbMV8n59jpfpDN5qnuqKxaORFPDz8Rbh3HWnkoEhyvUZfs7Og/40QsBjnflxsaCXgAEofwGbsBXoQpA4+F5KRqLiREzS/E859FqGZNZjMRkVosmhi4OH7w0lHjK3WeVudp9wZEeX8LSN0SnXz4+f21Q9Eyy9sjk3qdO1ljHpwFDBgCncRZ0wBSh13KCGIkR3ATwnadeGhy4PF1X3TgcCg03VuNs8vLJky91L/nG+/oOeYHgywDA1zgLKoUDfWYFZ7cWC/Po33AWNIV5N5NZQRhnt9bPws4+5X6j8r2RFXlekkQ9pxI4s5lhMq+83a5Wl2fJoCnD2dzfvBj9VfODrUXU9dvY2eb/AACscPN7+CpUPMGOkgChQL+HcIRGxp7fv//5scJnZ19fZ2dfHz107djcy/39V44duzZ0fnFmZmFhZmaRnEu4acBZoMFUlFktxzG7ufy650wqtdg12LPcHk/irDDen56p/xINzYoB2MbWi9/EV6EUeABvMRYPLzyGlDJv51CLRrahIdsvXuRmzxUQn5xi+/2Mt9xmaJk/M0tQzp7J/cvTafO7Fwvwn/uLKo+DUs+VlG1jH8ZZKAe2WJVE3AS9goPLPOw6lUxIqzfODaabW1ub0zjrHevrmWBz//vwIZoONzTwJEdcfgPr8FUIKOwKsgJUivKCEMKPC5ExmVlWuUmLTO3nIwe4EV+oTgwedMf5lqPJxpOB/a52ga9rChxoSTUv0A2hpx28x+60G2rK61P1sbFobWDCWuWsdjj0HsuBrth4IyCwAmAjzgJFIuEkN8Pp791GP93GlWfPbq0TnhHsy2/gfqUOCUZJL+qVklD+0aK+879ebZbl+G+fo6+8hSZzK9Pp9DQ6nrv+1hXAEMhvoE/RJliBA2A9JCmyUleUoATH6DniDXIkJktKrf1tcuDCCub8zvYaqX6ueerIsk7t7N5j9Rr74k56NNE3VuEWLMzP7TULp3LfiNXcKdY4qgvaLayiiY78BjbjNTCBs8AoR3F6kaGeEC3nISaCutyddjV9ekVtT3riY/XxqTE+NlLrN/lot0vCazfTNnvb76QPPpNYTqV/XfeJoVzhoya/gdbQJtie9AvO88gttMjadaKj55fJUHd1F+eSEokGS8jY7B2hW88MDS+2Otgpe7qjPcNUTLuqCM8YhPwG2sRrYATXDlcENStIYhFLO2L4YfxEy1TU32jVrizr1LYUtggGY9DExerp3zwzeKat2pL+863OsI1bNlk/MZR3du/rAqxg/1e0CRZwPoae6IpyE/UR7CoxSm5Bzu5TezvnW7on6tU497kuFZZiYX7y1dtCrSdGty0ODS4mEnNJo7ckJroP2Ryo2S/Vk1gQWADQIr5LRqIr+QktMyLD6X+2d2/NQKczWllVZqOrHIcOoXPHNVXSSJTWzms0bt5xOvccgAo8+TpMoU2ohxboVZjhpagsKdi3h5gYYUWG2zYRj0AIEom8TFqtqsgZjNvV6eGVJT80TzZ2G6tcFpu/eVKqdf9lP1USHZPtToPHPzD+8+TZXrsg2O2C4I+0C17R6qarWu/bGmvjPnWZz1kVqVQbksF4v4+eK/WYmnprdBVmo6GlUxwMobsBv+D3+fyB3EqNla1UqSzWanuBmw6SbEWjIO5qk9FzeoV0St+xQlXvjwzuW7G7qn0WvHbzkDU4N5G7h9wxn5XNvQf5PMgA8CW+j3kQAYCCKFzcPduB14AmvIt6URYpIydQTMdl9R+/+e5fv3EygddyC/9wL/fF33c/S9bnN5ABr0GFwutubRMRfJxuWdGXaCitgfbSh/djbutz1oDQcQ1F9gGo7GgT3Mo9rKjEwD4WCbU7dpAaToWlDqO7Nzywf8Xu8jaQj3q03u6sC/o84Z3wGnLvbQ87PKFNMBXfUczTsk7tyuwShdYTjrrHeCroXdHO/9+/zIkTyeSJRGIhmVxI1IVCdaG6uu1abV0cHjrTupRp70iTkiWwOvI92Iw2wQgOAPYROkV+vMAyxkc2Q8K37xN+NhufirniNk0/HxsJBky+O/jPwjbuD04fXE5UWfv/ENXsmgzxgh60qZzvAtBIsnLsThGJsqhXFXsBOqq17vUUDKGNONo3u2Zw55W0xakYgt0V3hpDNY/cYFsv6DLaBMNjeaT4RwxXpXmmWmcps1ZWt5rQ+mgkrNGcV6v9kdzXgIDJb6A30CYIin4e9S++0L92DyPdy4EZk/Z++Bf8Xk/C6XbYQzZHi+/owaZR515b1NbUxLta/bM07xy3VrFGvdmoo2ua/F0jgmXMZBYs1vJSrinUOVGoIX1+Ay3gRdKBSU+SOEmWReIqRQYM4/3JtP7ZpSXOTlt1rFGmj43cPa69cOH0RwGvVj2npQtnxfMb6H/QOpieqAH9tu3+0+C+FYermjevLJeqnL303ASK5r6S/DY76slVdnlrAZF6Q3m0DmUAokpkzWYiCFkWVbf/dLVdZ9SpS4y6jkvX0fq33owgZLzf5ip3fBKvo3VwP7Gv6ARu+/1MUatnX2rQ6rRqqqxEPt9YUkGpqRKq/veXbtZRZZSaKqVq0foDbw/P93IPlLHH+yBX+SGX8vlS3IfKfeUAaAOtk74vGoWiCyn20T3lVy+/Xqsz69R7DHs8V1+89noDzdLqElOJgPB3A0yQYYLMQP6/hphahgmah8i5dL4NbaF1qCrWgSw/RkU5Xja7K2yUYY/Xp6P+brW71KBT79GXxC/dZBv7P9CqTyJNjd2G/v0zT8rLdXOf5UrbDm6/9bz5DfQQvwCl23UsRbfLTdh5Sxee6ma058i5c0fIn9XHsj6rxWex+Oi3r1+/ceP69bdPeSdHR8c9nvHR0Unl7Z8CQP+Mf5fkTyRtVorFZGLKqYtL0R7P/NISOnFYV23a2lwiOBCpdvQNfgGqyfo2LEWL3jIEjpa8NETGO3guFfZ7ZMtA/UwyMSm1jEctcfOvDmTOHa2rDwu2/ogYOdwqnTgRU2nOknNb8xvwPbwDpTudvxDdFV4UeV4UaUnwSZJPkMjaUL4NAbxDapYVYjHB4+GKtqQdjc0IqzEXi/GR6PgHfaYOb9DHh3o7hpYLMQThLnKjMPk9IUsiE/zx7uwsmafzi+g/8x+ReVZyMzT6Ijs8DAjK8tMohj9U5o2iquzu9N03VUc2XyV7eDSB/gR/DOUARkEWZFYWWZmlWEpYbW2ZZxfLMmWnLfMtrQNoonY23GP55ZK1Jzxbe4js9cAk+g7HSMyyxEmiVCjgf7x1a/7Wrck7s3fuzN4h63z57/EwLoESAI0guyW3ICMGtaau5F5DT19JIbO+/8Lihf7cf6t3+yt8itZ3fi91rKD1XCWg/Du4CYbxfXKfvogwbyjk9YZCuCnAcYEAxwXg/wAAAP//AwCcbS4SAAEAAAACC4UmU2whXw889QABA+gAAAAA2F2ghAAAAADdZi82/jf+xAhtA/EAAQADAAIAAAAAAAAAAQAAA9j+7wAACJj+N/43CG0AAQAAAAAAAAAAAAAAAAAAADV4nCzKvy7GUBjH8e/ze5M3RHEkL6mlQ9Wf6NGVRM/wLE0kTiLBYDAaXIPBHdh7DyxWN8DsVkyWCjF9lo9eueAdlKZv3ZI10OmBbEdkzckayXqm09W/d2RFdhTZ1siZ1jlUwu2TRol9zWnsmlJb1DrFbcGxGtwqfHaDq8fV/l3//faE2xub9siGTui1QjFbopRY0zKFArsKDApUFkkW6eyc1r4o7JJV+2BPgVr3HNgCh+nlBwAA//8DAFdwHSkAAAAAAAAsACwAUACEALAA1ADgAPABEgE+AWABnAHCAgICFAIyAmoCnALIAvoDLgNUA7wD3gPqBAIEHgRQBHIEngTOBQIFIgVeBYQFpgXCBfoGJgZWBoIGmgbGBtwG/AcIBxQHIgdAB1QHbAd4B44AAQAAADUAkAAMAGMABwABAAAAAAAAAAAAAAAAAAQAA3icnJTPbhtlFMV/TmzTCsECRVW6ib4FiyK1Y1MlVdusJqRWRkRx8LggJIQ0tie25fHMyDN2Gp6ANW/BW3TFQ/AciDW619euXRAFK4p1Zub+Od+5537AAX+yT6V6H/itnhqucFS/NrzHvfqF4X1a9T3DVR7VfjdcY1BbGK7zea1j+CPeVn8xfI/j6o+G73NYbRn+mKfVA8Of7Dv+MPwpx7xd4go852fDFQ7JDe9xwA+G93mA1axUeUDTcI3PODJc5wjoMqYkYUzKEMcNY4bMmRFTEBIzY8wNMQMcAT4Jpb5NiRQ5hv/4NiKkZEakFUeUOBJCEiIKRlbxJ83KuNaO0memSLr5lIyI6GnGhIgUR8aQjJSYidYpKcl5SYMGBX3lm1NS4FEwJsEjY8aQBm1aXNJlxJgCR0srCbOQjBtKbom0v7MIUaZPTEphrOakDJSnU36xZgdc4miTa+xm5cutCo9xfKvZwk1iHF/i6b/bYLbdd8UmYqF6ioY9EuV5qxMcqeLS1+cbxSUvcTvps83kwxoNlJ3MekyPuc5f5id5wiTFuUN8QnVQ6B7iONPngFAV+Y6ALhe0eU1Xn306dPC5okvAK81t08HxFW2uONeMQPHyW0sdc8X3OL4m0BipHZs+ork8vSE3dwt3cYacY0quWyAzlvOL8+OdJiw7lG25o1BX9HWPJFL2QFSRPYsYmitydcVUtVx5ozD9BuYI+VrqbN99l21Y2O6ttviOTHfYMTdOMrklow9N1XvPM7f65xExIKOnEX0ypjQoudOzXRMxJ8Fxrj6+0C0p8dc50udOXRIzVQYBqdaZketvZL4JjXt/y/fO7hLZvKnu6GR9ql26SOV0Y0avVb3Vt9BUjjcm0LCpZpYjE5bKy5OK9yXa2+IfqvsLvd0ynnBGRsLgbzfAUzyaHHPCKSPtIJVTFnY7NPWGaPKCUz39hFij5L58ozpJhRM8nnHCCS949p6OKybOuLg1l83ePuec0eb0P51iGd/mjFfrd//e9Vdl2tSzOJ6sn57vPMVH/8OtX/B4677s6C0gm7Owau+24oqIqXBxh5tauId4fwEAAP//AwD0t09RAAADAAAAAAAA/84AMgAAAAAAAAAAAAAAAAAAAAAAAAAA");
+	font-family: d2-2701310579-font-bold;
+	src: url("data:application/font-woff;base64,d09GRgABAAAAABJAAAoAAAAAG2QAAguFAAAAAAAAAAAAAAAAAAAAAAAAAABPUy8yAAAA9AAAAGAAAABgXxHXrmNtYXAAAAFUAAAAvQAAAQQFXCgIZ2x5ZgAAAhQAAAswAAAPRL0qLP9oZWFkAAANRAAAADYAAAA2G38e1GhoZWEAAA18AAAAJAAAACQKfwX1aG10eAAADaAAAADAAAAA2GrYCVRsb2NhAAAOYAAAAG4AAABucBBsWG1heHAAAA7QAAAAIAAAACAATgD3bmFtZQAADvAAAAMvAAAIKgjwVkFwb3N0AAASIAAAACAAAAAg/9EAMgADAioCvAAFAAACigJYAAAASwKKAlgAAAFeADIBKQAAAgsHAwMEAwICBGAAAvcAAAADAAAAAAAAAABBREJPACAAIP//Au7/BgAAA9gBESAAAZ8AAAAAAfAClAAAACAAA3icfM5LLsNRHAXg72qpR73f73+9taVVK5CIRCJmxo2hWIFt2IEVMCfCDqxAYhdM/MSNsZzBmXzJOUhKEqrKPlEolHM37NnX0nHsxKkzF7qu3NRuI7Koa2bRdvQnznVduv4V8aEixbcUX/EaL/EcT/EYb/EQ9+93efP/JAc6+UNT2666hh4lZb36VPQbMGhI1bARo8a0jJswacq0GbPmzFuwaMmyFasKNWvWbdi0ZduOQ34AAAD//wMAh9cocQAAAHichFdrbBvZdT738jEWNXrwMRySEp8jzvAhUSKHw9GDEiWLomSZ1NOW5FivCLuObMmya8uRdivXAdabbR063q4Urx23m4W7RtutN/DCKOCmVYsG6G6M+FedNECRNNvtwg1iIFEDdbHYSmRxh5RM+09+aK4wvI/vfOc737kDGhgCwHN4A1RQBlVgAAZA1Lv1XlEQOEoWZZljVbKA9NQQNuTuvCf41X6/OuC64Xx1ZgZlpvHG7uLxzNzc5zNtbbl3/u4Huavo/A8AcP5LANyNs1AGegAjJQo8L3BarcooGjmBo55Uf6uqoqZCTVu/fPThoz/zfexD/fF4eEmMns69jrO7y7duAQCoIAOA4zgLerCBh2ATI2YzY9JSjDJoOZUYiUlRnuP0YkQZM79MLnY2+CLdyXO9Mz2xcCSaGn0l3j6Ks/ZUIjhapa443NV9xI/eCHC8KzcxEfQCIAjlt3ETvgE1ABoPz0vRWEyMmFmK5zmPVsuYzGIkJrNaNDVyZfTo1ZHES+4Bq8zVHwqO9fkSloEROv2d04s3h0XPNGuPTB986WyddXIWMGQAcBpnQQdMCXotJ4iRGMFNAD946a3hoWuzDbXNo6HQaHMtziavnT37Vu+Kb3Jg4JgXCL4MAPqVwifJD+NmRIZjMuhW7otPP8XZtbfXdmFvHnyCs6BSuNJn1nF2d7m4/lOcBU3hvZvJrCOMs7tba/vrFJxG5XcjK/K8JIl6TiVwZjPDZN5+v1OtrsySQVOBs7l/eDP6jdYnu8uo59uxtdb/BgCscPhH+AZUvcCikiihkCYP4RKNTbx++PDrE4Vn98BAd/fAAD1y89TCdwYHr586dXPk0vLc3NLS3Nwy2Zdga8JZoMFUogAtxzH7Of+k70Iqtdwz3LfaGU/irDA5mJ5r/AUamRcDUMTWj9/FN6AceABvKRYPLzyHlDIXc61FY0VoyPa1N7n5iwXEZ2fYQT/jrbQZ2hYvzBOU8xdy//Fy2vz9KwX4r/1NjcdBqRfKKorYR3EWKoEtVS8pAoJewcFlnvacSyakjTsXh9Ot7e2taZz1Tgz0TbG5/3v6FM2Gm5p4kiMuv411+AYEFHYFWQEqRXlBCOHnBcuYzCyrnKRFps5LkSPcmC/UIAaPuuN828lk89nAYVenwDe0BI60pVqX6KbQyw7eY3faDXWVjanG2ES0PjBlrXHWOhx6j+VIT2yyGRBYAbARZ4EikXCSm+H0j+6jL+/j6rW13S3CM4JD+W08qNQrwSjpRb1SOso/WjRw6ZsbrbIc//Zr9PX30HRufTadnkWnc7ffuw4YAvlt9BO0A1bgAFgPSYqs1B8lKMExeo54iByJyZJSk/+YHLq8jjm/s7NOalxonTmxqlM7ew9YvcaBuJMeTwxMVLkFC/NVe93SudxnYi13jjWO64J2C6tooiu/jc14E0zgLDDKUZxeZKgXRMt5iNmgHne3XU2fX1fbk574RGN8ZoKPjdX7TT7a7ZLw5t20zd7xB+mjryRWU+lvNvzYUKnwUZffRptoB2wv+grneeYqWmTtOdPV9/VkqLe2h3NJiUSTJWRs9Y7R7RdGRpfbHeyMPd3VmWGqZl01hGcMQn4b7eBNMIJrjyuCmhUksYSlPTH8bvJM20zU32zVrq/q1LYUtggGY9DExRrpb70yfKGj1pL+693usI1bNVl/bKjs7j3UA1jB/p9oByzgfA490RXlJuoj2FVilJyCnL3nDnYvtvVONapx7me6VFiKhfnp794X6j0xumN5ZHg5kVhIGr1lMdF9zOZArX6pkcSCwAKAlvFDMhJdyS9omVid/isHD9YNdTuj1TUVNrrGcewYunhaUyONRWntokbj5h3nc68BqMCTb8AU2oFGaIN+hRleisqSgr04xMQIKzJc0UQ8AiFIJPIyabWqEmcwFqvTwytTftc63dxrrHFZbP7Waane/beDVFl0QrY7DR7/0ORXk2v9dkGw2wXBH+kUvKLVTde0P7Y118d96gqfsyZSrTYkg/FBH71Q7jG19NfpqsxGQ1u3OBxCDwN+we/z+QO59TorW61SWay19gI3XSTZikZB3Ncmo+f0CumUvmudqj0cGT60bnfV+ix48+4xa3BhKvcIuWM+K5v7EPJ5kAHgF/gx5iEKABRIcGV/bwfeBJrwLupFWaSMnEAxXdfUf/7u9//+e2cTeDO39C+Pcj//595Xyfz8NjLgTahSeN2vbSKCH6Xb1vVlGkproL308cOY2/0Za0DotIYi6wBUdrQDbuUcVlRiYJ+LhNofu0gNp8JSl9HdHx46vG53eZvIoxFtdTobgj5PeC+8ptyHxWGPJ7QDptIzSnla1aldmX2i0FbC0fAcTwW9K9r5/f3LnDiTTJ5JJJaSyaVEQyjUEGpoKNZq+/LoyIX2lUxnV5qULIHVle/DZrQDRnAAsM/QKfLjBZYxPrMZEr79kPCV+fhMzBW3aQb52FgwYPI9wH8VtnF/cv7oaqLGOvinqG7fZIgX9KEdZX8XgEaSlW33ikiURb2q1AvQSa31oKdgCB3E0T7bN4MHb6ctTsUQ7K7w7gSqe+YGRb2ga2gHDM/lkeKfMVyT5planaXCWl3bbkJb45GwRnNJrfZHcp8AAia/jb6HdkBQ9POsf/GF/rW/GeleDsyYtI/DX+MPehJOt8MesjnafCePtow7D9qitpYW3tXun6d556S1hjXqzUYdXdfi7xkTLBMms2CxVpZzLaHuqUIN6fPbaAkvkw5MepLESbIsElcpMWCYHEym9a+urHB22qpjjTJ9auzhae3ly+c/Dni16gUtXdgrnt9GX6AtML1QA/qi7f7b8KF1h6uWN6+vlquc/fTCFIrmfin5bXbUl6vu8dYDIvWG8mgLKgBElciazUQQsiyq7v/lRqfOqFOXGXVdV2+jrV97M4KQ8f46V73nk3gLbYH7hXUlO3DFezZFbay91aTVadVURZl8qbmsilJTZVTjH6/cbaAqKDVVTtWjrSfePp7v554oY5/3Sa76Iy7l86W4j5TzKgHQNtoifV80CiUHUuyzcypvXHunXmfWqQ8YDnhuvHnznSaapdVlpjIB4d8MMUGGCTJD+f8ZYeoZJmgeIfvS+Q60i7agplQHsvwcFZV41eyuslGGA16fjvqnjd5yg059QF8Wv3qXbR78oVZ9Fmnq7Db0Xz/1pLxcL/fTXHnH0eJdz5vfRk/xG1BerGMpWiw3Ye/OXbjSm9GBExcvniB/Vh/L+qwWn8Xio9+/ffvOndu33z/nnR4fn/R4JsfHp5VvhBQA+nf8hyR/ImmzUiwmE1NOXVmJ9nkWV1bQmeO6WtPuzgrBgUi1o8/wG1BL5ndgKVpylyFwtOSmITLe4YupsN8jW4Ya55KJaaltMmqJm79xJHPxZENjWLANRsTI8XbpzJmYSrNG9m3Pb8Nv4QMo3+v8heiu86LI86JIS4JPknyCROaG8h0I4ANSs6wQiwkeD1eyJO1obkVYjblYjI9EJ384YOryBn18qL9rZLUQQxAeIjcKk+8JWRKZ4OcP5+fJezq/jH6V/5i8ZyU3Q6OfZ0dHAUFFfhbF8EfKe6Ooqng4+/Bd1Ymd75I1PJpCf4F/BJUARkEWZFYWWZmlWErYaG9bZJcrMhXnLYtt7UNoqn4+3Gf5+oq1Lzxff4ys9cA0+g2OkZhliZNEqVDA/3rv3uK9e9MP5h88mH9A5vnyv8WjuIx8J2kE2S25BRkxqD11PXcLvXw9hcz6wcvLlwdz/6ve76/wE7S1973UtY62ctWA8h/gFhjFj8l5+hLCvKGQ1xsK4ZYAxwUCHBeA/wcAAP//AwBd7DjPAAEAAAACC4VOe8kdXw889QABA+gAAAAA2F2ghAAAAADdZi82/jf+xAhtA/EAAQADAAIAAAAAAAAAAQAAA9j+7wAACJj+N/43CG0AAQAAAAAAAAAAAAAAAAAAADZ4nCzKPS4FURjH4d/7v8kNcXAkl1zNLcb4iDmmJTGneJtJJE4iQaFQKqxBYQf62QON1gaobUWlGSGqp3n0ygXvoDx+65ainlYPFAWKHVE0pWig6JlWV//eUZTYUWJbA2da51AZt09qZfY1pbZr5tqi0iluM45V47bAJze4OlzN3/Xfb0+4vbFpj2zohE4rhMkSc4k1LRMU2VWkV2RhiWyJ1s5p7Itgl6zaB3uKVLrnwGY4jC8/AAAA//8DALKBHYQAAAAsACwAUACEALAA1ADoAPQBBAEmAVIBdAGwAdYCFgIoAkYCfgKwAtwDDgNCA2gD0APyA/4EFgQyBGQEhgSyBOIFFgU2BXIFmAW6BdYGDgY6BmoGlgauBtoG8AcQBxwHKAc2B1QHaAeAB4wHogAAAAEAAAA2AJAADABjAAcAAQAAAAAAAAAAAAAAAAAEAAN4nJyUz24bZRTFf05s0wrBAkVVuom+BYsitWNTJVXbrCakVkZEcfC4ICSENLYntuXxzMgzdhqegDVvwVt0xUPwHIg1utfXrl0QBSuKdWbm/jnfued+wAF/sk+leh/4rZ4arnBUvza8x736heF9WvU9w1Ue1X43XGNQWxiu83mtY/gj3lZ/MXyP4+qPhu9zWG0Z/pin1QPDn+w7/jD8Kce8XeIKPOdnwxUOyQ3vccAPhvd5gNWsVHlA03CNzzgyXOcI6DKmJGFMyhDHDWOGzJkRUxASM2PMDTEDHAE+CaW+TYkUOYb/+DYipGRGpBVHlDgSQhIiCkZW8SfNyrjWjtJnpki6+ZSMiOhpxoSIFEfGkIyUmInWKSnJeUmDBgV95ZtTUuBRMCbBI2PGkAZtWlzSZcSYAkdLKwmzkIwbSm6JtL+zCFGmT0xKYazmpAyUp1N+sWYHXOJok2vsZuXLrQqPcXyr2cJNYhxf4um/22C23XfFJmKheoqGPRLleasTHKni0tfnG8UlL3E76bPN5MMaDZSdzHpMj7nOX+YnecIkxblDfEJ1UOge4jjT54BQFfmOgC4XtHlNV599OnTwuaJLwCvNbdPB8RVtrjjXjEDx8ltLHXPF9zi+JtAYqR2bPqK5PL0hN3cLd3GGnGNKrlsgM5bzi/PjnSYsO5RtuaNQV/R1jyRS9kBUkT2LGJorcnXFVLVceaMw/QbmCPla6mzffZdtWNjurbb4jkx32DE3TjK5JaMPTdV7zzO3+ucRMSCjpxF9MqY0KLnTs10TMSfBca4+vtAtKfHXOdLnTl0SM1UGAanWmZHrb2S+CY17f8v3zu4S2byp7uhkfapdukjldGNGr1W91bfQVI43JtCwqWaWIxOWysuTivcl2tviH6r7C73dMp5wRkbC4G83wFM8mhxzwikj7SCVUxZ2OzT1hmjyglM9/YRYo+S+fKM6SYUTPJ5xwgkvePaejismzri4NZfN3j7nnNHm9D+dYhnf5oxX63f/3vVXZdrUszierJ+e7zzFR//DrV/weOu+7OgtIJuzsGrvtuKKiKlwcYebWriHeH8BAAD//wMA9LdPUQAAAwAAAAAAAP/OADIAAAAAAAAAAAAAAAAAAAAAAAAAAA==");
 }
-.d2-1108726992 .text-italic {
-	font-family: "d2-1108726992-font-italic";
+.d2-2701310579 .text-italic {
+	font-family: "d2-2701310579-font-italic";
 }
 @font-face {
-	font-family: d2-1108726992-font-italic;
-	src: url("data:application/font-woff;base64,d09GRgABAAAAABJYAAoAAAAAHCgAARhRAAAAAAAAAAAAAAAAAAAAAAAAAABPUy8yAAAA9AAAAGAAAABgW1SVeGNtYXAAAAFUAAAAtwAAAPpHquUgZ2x5ZgAAAgwAAAtUAAAQEKwYBA9oZWFkAAANYAAAADYAAAA2G7Ur2mhoZWEAAA2YAAAAJAAAACQLeAjZaG10eAAADbwAAADCAAAA1F/QBfFsb2NhAAAOgAAAAGwAAABscPZ08m1heHAAAA7sAAAAIAAAACAATQD2bmFtZQAADwwAAAMrAAAIMgntVzNwb3N0AAASOAAAACAAAAAg/8YAMgADAeEBkAAFAAACigJY//EASwKKAlgARAFeADIBIwAAAgsFAwMEAwkCBCAAAHcAAAADAAAAAAAAAABBREJPAAEAIP//Au7/BgAAA9gBESAAAZMAAAAAAeYClAAAACAAA3icfM07LgQBHIDx35i1Xmut93vNetu3uYFEIxGdeqIUJ3ANJ3ACeqJwAjeQuIBaI38xB9h85a/4kEglqKn4RlNDqi7T0dM3kDt34dK1wq371kMEMm3d0ofOSr9SuHH37/GlSvwSP/Eeb/EaL/ERz/H0+VjeRpUYOtXV0zFw7ETbmFTFuKoJk6ZMm1Ezq25OX8O8BYuWLFuxas26DZu2bGvakWnZtWffgUNHcv4AAAD//wMAJfUl2AB4nHxXbWxb13l+z7lXvBJFfZCXHyYlkiIvea9EXpISL8krSiL1QYqiJFK2JEtWZH1a/ohtxVPsyIlne0ntoUuyxmWLoMOKDM7WregQYAmcYlj/pGtcLGozD9uQbdnaGWjTyoW9oqmgZW5R3TsckpIoF+ifywMenPO+z/O+z3POgSrwAOAL+HWgoAYawAAmAIl1UZQky5yFkgSBYxhZYFnGcwNt3PgqnZr9aeubvxKd9NDn/nr0f5bewq/vrKKX5l98UTn+8qlTxx49Unzo3x8BAGD1QwD0b7gANaAHYBlJ4HmB02gQklhO4JhPuu5qaS1N2yTlH9HJ2dy44Wdn0ZW1tci5zvgZZRwXdtbu3QOggAPALbgAerCRscRKYbPJqNEwjLn4y1FSOBaN8Nz+gLv59uKqP+VBUmbo2ljXwsLs4Mjx8xcXLuSHn8OFkSExLVbTuv7O4XkRXR6SA+Gdh4O5cILkjSCubuMAfgOcAFVuno9GklgKmy0Mz3Puemwyms1SOCZbNBrkHn061j57Pdc5fijGxviuxQGPe6S7NdXCeeZ1qRfG8q8/PyT72lqExMkXerrnoy1NYWeAcENw4FiRG7YCESdI4dgugt9/5bWp2783PT11LXVmJYYLf3Tl+W+e6jv6leX5s6U8OQDYxgWgijtQ3M2xm7iws7Y7h76MC1BVmnMx3M2xy8hYhws7dwZK8/g0LpSjsxYpFpNZieIoUiGG7PUVH62p1w6O3sy/7qc1DdoMLihzr3Q8I6G5nTX0tdekc2HldhFLj7qNF/Ab0AgtRcbKhJlNxnoshJOY4CkRh5wX1oPT65mRU5Hg9HOp6LGke2SMfId1f3JttLA+mL46Ofql9cFUz4n1+PJ694n1rqXLe3wFcAFqwVjJF0ex+yX/1tzFkc8dPRvpXzx1Lpc9hQsj00fOdCiP0dCRw3EJyrkuFHNtABHAeyA5i5sX9qpdTJ7ZrTTiKlL9v8kr1sljZRj+sWcG9FORhqa6Kle0e+VyVynrE5f/I3eE/eL5MqbsFy4Oa/x+mkrUlrEIuAB1YN7HwrAcdQDNN+eevTB5aXL1opxeWTg5ml3Chczk8Qt65RNkVh6iqYlMLEQwIdCp20jBb4APgGCQi1lHI7xQhBOL7TWvRkNgWkqqeZBaa43bp+Se8YA35+uOznV3Lzklaybojdo7PLlQpPu0rqvL7w+nOz1hc9A2LIcnwpHWoKPN2d7Eh8yB5iG563gEEMwD4CguAEPQcLKL4aivr79Xhz6s+/Y6zqdSO++W8jysbhd7zlzukmLHkZQIyWSoQY6T5zX0yNhoTd9g56xpPDfRfEN39rQpZEVryisBdyY/dx59WTl/6wqppaBuo8doC4yEUcte31kkWaI4mdNohHBMlvdU+25fThxZkISEnmaTy73VNDdj4A97RFO42ZOKOjt0x6cyV+akVldCsWW9ob5g6D95t294Ptxb9AUMTnUbfYo3wERckzDNMRwrMYxUpPhAtxe96aGQ0FPG3lt5wYw9RwPF8FFPKupob3OPc0GjpGt1JfDGe0t2/+w0Cd3nG56Xkgmf9wHvBgRedRvdQVvQfADdfiXLLvTx4ZNifjkq9pgDLG9vn47Fu1piZrctrzs9n740FXJb2y2m9FpqIGPTh43eEhZB3cZCBZZ97n43eV0GqpHPF8rsjXmfZE9oWXxvp/NJ+nARy7fRFtjAWxmPdCLj0uw5KiXFiJoJwp9Mnw2MzrXL/Q5dlfLdmpaUzx63OOzjf6piytDGRRd055YH1ybE4JFws1Tfe8Rr1UsmJ/LWHqpr7nBOAQI/AHoNfwSWYl/24kolMIzEcJR/qre2v7FhLGHzGZq0TXpXW7X+hG5lCn0jXjU+MllXKzPasH8yqcwQzpDqQVtoC5wQrFSaLGs0XCWDpJOpA+y91THNeZoHW5Mj9Vb+aChxxD8818En9RTbe5q9FOfG3X5zRzPXLzlCP+TtUYs71/c0L05PpZ57Kkz6kVo8jVx+3z/z7rbMTHt3N6khIucT+hhvgJXgq+hDhuJYQiPn1jCU81a+vZFumxCT0epkroems83Z4CDeeJTgQv2dTo/yfSQaD9WN+oLKN1SV7Am/xncwD8QwNRDJ7sf6Od4AXTEWReKxnMAwzlv5JfyrmffXx+bXbHhDsSP0ofLTn1+8CghEdRt+jTfAQNiKRopq15iM5VI/06+5mr+OkJ7SMEhr1vXqrfj8zpeYGsqAcDdN78XFD9EW8TYSsyQ1Sxmo5gDSStDLvQzNT/JdHVWhGW8iRtPJfIKmh0xZcZBwkDFn/YNoc9jTIbeKUn+n3mGs5GF/tIf9Y7QFhypzeJJmErFtIniA5WKEJ0ne0x/6AdqCBrBX6qFkImTXXZF/dHhBHFkIH14URxd8gXEpFiYf3dPHBy9NBUvfvoG19MBQai09kCF7q5+pEvoUbZW0zVRkXI+5omsx7AGf0r7aq6G8U8GiQYX5HhYbnH9V6VP38Lt9zkBZ4M6nbyNUNir+Z17XLh4JPd6NWSXL3G9p4qAikMvlwN6ZYKUnv3q70lDu3X6eD+1Z8k4eoYOGXOwNdA1tQWNFXSwMv1uPWtqeC1hNTY02T86ZQJvzYqImXd3brdwDpP5G3UbX0RYIT56ZTx6Z5MQsHZhf65i3tlv6eF+irTMYF4fF4EhzkJVcfEesJRlpn9BFWnlna5CzCU5bss3f7/U4Wo22gNPBG9w9YiDtJTn3qNtoBq/ueXpMZrleLBXdqMLTv9UXoVF8qDbn6W+6qrsep5rd9bZafWNI1xtosNUhQ7zq859PKg8NBodDWyUzDWTvTnUb/QJtgnV/733FsWVbf2tPDVn7kDiYIwdh61HdgKx3siimfMRaSZuiGcU2whELAATdAOhHaBPqACRKYs3m8m0R3RjKeWgNTes97Bfzyg7aVB5wo5xn2IOsiq20NgOAP0Cb4Hpi7f6I4qjSu4ChznK5RoQQ3dDU+NKoHmNE19saX8z+92J98V97w2W0qfzYnXa7027kqBjZkJbLejxZTvkMkPoRAPrXEg8cK0iWcihZYixc+Q3CMOJ/HR/zVdczdENLw9TkxsphsVqvpRvd7ALCP1k1CyZjm2n1f3950Rw0m0XLJQCkvq+G0CdoE2wATPGeRXiVDzBSjzXalnqrweDttxomc3xVNUXrvYYv5JQfW7uz/8Iw8ZpEmEMPlF+48hyXcyP9zi9DeZFwhcGnbqN/wq+CnrBlcfO/4yK9ER7y+oaXouGMp214sUNIRexisPjVda4kn/rza0NdK8nZN69mEulnX06njg0++3J64Bggkjt6Cf8B1AJIMrmtxWSJkhhb3R8vPaudkrufu6HrQ/fDOvfO+30E82cA6Lv4VbKOk5NU2TSEPUNhXIy2eunWQkiKtvS7BfFY+8SMb+LaJDLqguNXTzwVFHtczna+7al0dGFpLTtAesKibsPLsEpyKPVpcS9NxmwVms2HvLpms020m60iif8jdQ4KsEo0zgixmMxVLDDWhuIMNjs4u6159i+Dhh6PzWwVPI7htd330X2kRVbyPpJlieF0P6i7Xz471R+qf4jeUf+WzDGyi/HUou9pr4XDZJ36d+oS+gv8D8U5JKEsutOp5N+kTv/mq8W1cB19Hf0Z/h7UA7CCLMgW2cLIFsbCCO+0DM4YVqxi9RnmDN8aQXfsMx2trnP0+Xq/c9kyAwja4Qz6PvYR7HKUi0pRySSZONP9v3m75+13znwQv3s3/gGJYVQ/xUlcBTUAVYLsiroEGZlQp3BX6UN/f1dAmkbfd3q/41MeV+2dk3APbe6+BZ3L+RNosyhCBEN4FO7gOyQmW0HfC6yDsxjtHB61mK2uQ2Zry/8DAAD//wMA3XNZfwABAAAAARhRA4DzEV8PPPUAAQPoAAAAANhdoMwAAAAA3WYvN/69/t0IHQPJAAIAAwACAAAAAAAAAAEAAAPY/u8AAAhA/r39vAgdA+gAwv/RAAAAAAAAAAAAAAA1eJwEwCFLQ1EYxvH/8yyqIChct3LCcbvgNRgVb9VFFcRmF6yWBb+Efg6TxTi0CILJuHCGeWVhiIy9+/mBfT5Bq/jykOwBJ74ksyTrm+x7ske0HpA9onVD1j+bWnHrOy7cpfYeSa/0XVFrSl89Gu8gb5CYkTQh8cdhJ5G8RXKH2lUs3KXWDUlPsdQZrbc51phTf3Cul/jRON5VOFChpxIL5lTMY6qGrN+Y6Dre9MyjCke+YpcZCRiuAQAA//8DAEFyMvUAAAAAAC4ALgBSAIoAvADeAOwA/AEiAVQBeAG6AeICIgI2Al4ClgLOAvwDNANuA5YD3gQIBBQELgRQBJIEvATqBSQFXgV8BbgF5gYSBjAGagaWBsYG+AcQBzoHUAduB3wHigeaB7gHzAfkB/IICAABAAAANQCMAAwAZgAHAAEAAAAAAAAAAAAAAAAABAADeJyclN1uGlcUhT9ioE3/Liorcm6sc5lKzuBGcZTEV+M6VkZFkDKkP1JVaYAxIGBmxAw4zhP0um/Rt8hVH6NPUfW62psNYSKrVlAUaw1n/6yz9toH2Odf9qhU7wJ/1ZeGKxzWfzZ8hy/qTcN7nNU/M1zlqPa34RqD2lvDdR7UOoY/4V31D8Of8rj6m+G7HFQvDH/Oo+q+4S/3HP8Y/orHvFvhCjzld8MVDsgM32GfXw3vcQ+rWalyj2PDNb7m0HCdQ6DLmIIpYxKGOC4ZM2TBnJickJg5Yy6JGeAI8JlS6K8JkSLH8MZfI0IK5kRacUSBY0rIlIickVV8q1kpr7Sj9Jkrkm4+BSMiepoxISLBkTIkJSFmonUKCjKe06BBTl/5ZhTkeOSMmeKRMmdIgzYXNOkyYkyO40IrCbOQlEsKroi0v7MIUaZPTEJurBYkDJSnU36xZgc0cbTJNHa7crNU4QjHj5ot3CTG8S2e/ndbzMp912wilqqnaNhjqjyvdIIjVVz6+vyguOA5bid9ykxu12ig7GTWY3osdP4yP8kTJgnOHeATqoNCdx/HmX4HhKrITwR0eUmb13T126dDB58WXQJeaG6bDo7vaNPiXDMCxauzC3VMi19wfE+gMVI7Nn1Ec/l6Q2buFu7iDLnHjEy3QGYs9xfnxztNWHYoLbkjV1f0dY8kUvZAVJE9ixiaKzJ1xUy1XHsjN/0G5gg5LXS2789lG5a2e+stvibVHXYsjJNMbsXotql6H3jmSv95RAxI6WlEn5QZDQqu9W6viFgwxXGuPn6pW1Lgb3Kkz7W6JGamDAISrTMn07+R+SY07v2S7529JbJ5M93RyeZWu3SRysnWjF6reuuz0FSOtybQsKmmliMTlsqrm4r3Jdor8Q/V/bm+bikPCbSuTLJ/4ytwzDNOOGWkXaR6wnJzJq+ERJyqAhNijZI3841q9QiPEzyecMIJz3jygZZrNs74uBKf7f4+55zR5vTW26xi25zxolTt/zv/qWyP9T6Oh5uvpztP88FHuPYbjkrvZkdfA9mgpVV7vx0tImbCxR1sa+Hu4/0HAAD//wMAcqFRQAAAAwAA//UAAP/OADIAAAAAAAAAAAAAAAAAAAAAAAAAAA==");
+	font-family: d2-2701310579-font-italic;
+	src: url("data:application/font-woff;base64,d09GRgABAAAAABKIAAoAAAAAHGQAARhRAAAAAAAAAAAAAAAAAAAAAAAAAABPUy8yAAAA9AAAAGAAAABgW1SVeGNtYXAAAAFUAAAAvQAAAQQFXCgIZ2x5ZgAAAhQAAAtzAAAQPGrXayBoZWFkAAANiAAAADYAAAA2G7Ur2mhoZWEAAA3AAAAAJAAAACQLeAjaaG10eAAADeQAAADFAAAA2GGpBhRsb2NhAAAOrAAAAG4AAABud1xzim1heHAAAA8cAAAAIAAAACAATgD2bmFtZQAADzwAAAMrAAAIMgntVzNwb3N0AAASaAAAACAAAAAg/8YAMgADAeEBkAAFAAACigJY//EASwKKAlgARAFeADIBIwAAAgsFAwMEAwkCBCAAAHcAAAADAAAAAAAAAABBREJPAAEAIP//Au7/BgAAA9gBESAAAZMAAAAAAeYClAAAACAAA3icfM5LLsNRHAXg72qpR73f73+9taVVK5CIRCJmxo2hWIFt2IEVMCfCDqxAYhdM/MSNsZzBmXzJOUhKEqrKPlEolHM37NnX0nHsxKkzF7qu3NRuI7Koa2bRdvQnznVduv4V8aEixbcUX/EaL/EcT/EYb/EQ9+93efP/JAc6+UNT2666hh4lZb36VPQbMGhI1bARo8a0jJswacq0GbPmzFuwaMmyFasKNWvWbdi0ZduOQ34AAAD//wMAh9cocQAAAHicfFdtbFvXeT7vuVe8MkV9kJcfJi2SIi95r0RekhIvyStKIvVBiqIkUrYkS1ZsfVr+iG3FU+zIiWd7Se2hS7LGZYugw4oMztat6BBgCZxiWP+ka1wsajMP25Ct2doFaJMqhbOiiaBlblHdO5xLSqI8oH+ODnR53vd9nvM+zzkH1SAfQvgifhlR6ABqRCZkQUhiPRQlyTJnoyRB4BhGFliW8d2E9ZtfpzPHf9766q9FNz30hb8e/e/F1/DL2yvw3Nyzzyonnj99+tgnnygB+PdPEEIIq+8iBP+GS+gAMiLEMpLA8wKn0wFILCdwzIdd9/S0nqYdkvKPcOp4Ydz0i3NwdXU1dr4zeVYZx6Xt1fv3EaIQhxBuwSVkRA4yl1gparWYdTqGsWp/OUqKJuIxntubcLdeX1gJZnwg5Yauj3XNzx8fHDlx4dL8xeLwU7g0MiRmxVra0N85PCfClSE5FN1+MFiIpkjdgJLqFg7hV5AboRovz8djaSxFrTaG5zlvA7aYrVYpmpBtOh14Rx9PtB+/UegcP5hgE3zXwoDPO9LdmmnhfHOGzDNjxZefHpIDbS1C6tQzPd1z8ZZDUXeIcENw4ITGDVuFiBOkaGIHwe+/8NLUnd+bnp66njm7nMClP7r69LdP9x392tLcuXKdJEaTFoPsGeNhJIajuFtwvl75MPRZ/ac9uNT/0YDyo8pv0RYuIUrLRnG3xm7h0vbqThz4Ki6hmvI3D8PdGrsC5npc2r47UMlzBpcqlbI2KZGQWYniKLKbDIn1tQCta9APjt4qvhykdY36HC4psy90PCHB7PYqfOMl6XxUuaPh7lG38Dx+BTWhFo3dCrlWi7kBC9E0JtjLJIP74lp4ei03cjoWnn4qEz+W9o6MkXHY8CfXR0trg9lrk6NfWRvM9JxcSy6tdZ9c61q8ssttCJdQHTJXc8tR7F57fGf20sgXjp6L9S+cPl/In8alkekjZzuUhzB05HBSQpVa57VaG5GIkH9fcTYvL+x2hlY8s9MVwFWV+r+TV+2TxyowgmNPDBinYo2H6ms88e7lK13lqk9e+VHhCPvlCxVM+S9dGtYFgzSVqqtgEXAJ1SPrHhaG5ah9aL49++TFycuTK5fk7PL8qdH8Ii7lJk9cNCofglV5AFMTuUSEYAJkULdAwa+gAEIEg6xVHY/xggYnkdhtdJ2OwLSVFfZxZrU16ZySe8ZD/kKgOz7b3b3oluy5sD/u7PAVIrHuM4aurmAwmu30Ra1hx7AcnYjGWsOuNnf7IT5iDTUPyV0nYgjQHEI4jkuIIWg42cNw1DfX3qqHd+u/u4aLmcz2m+U6D6tbWs9ZK12idRwpiZBMpjpwnbqgo0fGRg/0DXYet4wXJppvGs6dsUTssKq8EPLmirMX4KvKhdtXyV4K6hY8hE1kJozadvvOJskSxcmcTidEE7K8q/A3+wriyLwkpIw0m17qraW5GRN/2Cdaos2+TNzdYTgxlbs6K7V6Uooj74/0hSP/wXsDw3PRXs1DMHKrW/ApXkcW4rCEaY7hWIlhJI3ifd2u+dgDIWWkzL23i4IV+46GtPRxXybuam/zjnNhs2Ro9aTw+luLzuDxaZK6LzA8J6VTAf/HvBcB8qtbcBc2UfM+dHs7WXGs9w+fEotLcbHHGmJ5Z/t0ItnVkrB6HUXDmbns5amI195us2RXMwM5hzFq9pexCOoWFqqw7HH3u8nrMlFNfLFUYW/M/yh7QsvCW9udj9KHNSzfhU3kQP7qfKQTGY9u130pKUHUTBB+NH0uNDrbLve7DDXK9w+0ZALOpM3lHP9TFVOmNi4+bzi/NLg6IYaPRJulht4jfrtRsrjBX3ewvrnDPYUABRGCl/B7yKb1ZS+uVgKjGWtwqreuv6lxLOUImA7pDxk9bbXGk4blKfhWsmZ8ZLK+Tmb00eBkWpkhnIHqg03YRG4UrlaaLOt0XDWDpJOpfey91jHN+ZoHW9MjDXb+aCR1JDg828GnjRTbe4a9nOTGvUFrRzPXL7kiP+GdcZu30Pc4L05PZZ56LEr6kVo4A55g4J95b1tupr27m+whkLMM3sfryE7wVfUhQ3EsoZHz6hjKfbvY3kS3TYjpeG260EPT+eZ8eBCvf5LiIv2dbp/yQxDNB+tHA2HlW6pKYqLf4LuYRzGEkA7F83u5fonXkUHLRZF8LCcwjPt2cRH/eubttbG5VQdeV5wA7yo//+WlawiQqG6h3+B1ZCJsxWOa2nUWc2Wrn+jXXSveADBSOgb0VkOv0Y4vbH+FOUCZAHfT9G5e/AA2ibeRnGWp2SpAdfuQVoNe6mVofpLv6qiJzPhTCZpOF1M0PWTJi4OEg5w1HxyEjWFfh9wqSv2dRpe5moe92S7292ETHayu4VGaSca2ifA+lrUMj5K8qz/4MWyiRuSs1kPZREjUHZG/d3heHJmPHl4QR+cDoXEpESWD4fETg5enwuWxb2A1OzCUWc0O5Ehs9XNVgk9hs6xtpqriBsxprsWw+3xK/2KvjvJPhTWDivI9LDa5/6rap+7jN/vcoYrA3Y/fAagYFf8Lv2cHjwQPd3LWyDL3/zSxXxHg8biwfyZc7ckv3qk2lPt3nuYju5a8XQTYb8hab8B12ERNVftiY/id/aijnYWQ3XKoyeEruFOwMSemDmRre7uV+wjU36pbcAM2kfDomfnokUlOzPKB+Y2OOXu7rY8PpNo6w0lxWAyPNIdZycN3JFrSsfYJQ6yVd7eGOYfgdqTbgv1+n6vV7Ai5XbzJ2yOGsn5Sc4+6BTN4ZdfTEzLL9WJJc6MqT/9OX4yG5FBdwdd/6JrhRpJq9jY46oxNEUNvqNFRD6ZkzRe/mFYemEwul75GZhpJ7E51C34FG8i+F3tPcWzF1l/bVUPeOSQOFshB2HrUMCAb3SwklPdYO2lTmFEcI5x2ZwLUjRD8FDZQPUISJbFWa+W2CDeHCj5aR9NGH/vlorING8rH3CjnG/aBXXGU1+YQwu/ABvI8snZvRnFU+Q3BUOe4QhMA0I2Hmp4bNWIMdIOj6dn8fy00aP91Nl6BDeVn3qzXm/WCq2rmAD2X9/nynPI5AvU9hOBfyzxwrCDZKqlkibFxlfcKw4j/eWIsUNvA0I0tjVOT68uHxVqjnm7ysvOAP1qxChZzm2Xlfz67ZA1braLtMkKgvq1G4EPYQA6EGO2eRXiV9zHSgHX6lga7yeTvt5smC3xNLUUb/aYvFZSf2bvz/8IwyQOpKAcfK7/yFDmu4AXj9meRoki4wiigbsE/4ReRkbBl8/K/4yK9Hh3yB4YX49Gcr214oUPIxJxiWBsNncvpx/78+lDXcvr4q9dyqeyTz2czxwaffD47cAwBqR2ew3+A6hCSZHJbS8gSJTGO+j9efFI/JXc/ddPQBx9EDd7tt/sI5s8Rgu/jF8k6Tk5TFdMQdg2F8TD62sXb8xEp3tLvFcRj7RMzgYnrk2A2hMevnXwsLPZ43O1822PZ+Pzian6A9IRN3ULPoxVSQ7lPtVi6nNUuNFsP+g3NVofotNpFkv+n6iwqoRWicUZIJGSuaoG5LpJksNXFOR3Nx/8ybOrxOax2wecaXt15S30AerCT95EsSwxn+HH9B5WzU/2J+ofwhvq35BsjexhfHfxAfz0aJevUv1MX4S/wP2jfQII83O1Uiq9SZ377dW0tugHfhD/DP0ANCLGCLMg22cbINsbGCG+0DM6Ylu1i7VnmLN8ag7vOmY5Wz3n6QkPQvWSbQYDa0Vn4IQ4Q7HKci0txySJZOMsHf/N6z+tvnH0nee9e8h2Sw6x+itO4hrwDawTZE/cIMligU7in9MHf3xNA1xT4Xu/3AsrDmt1zEt2HjZ23oHupeBI2NBECGsKj6C6+S3KyVfQ9w7o4m9nJ4VGb1e45aLW3/B8AAAD//wMAlV9kbAAAAQAAAAEYUfofn9tfDzz1AAED6AAAAADYXaDMAAAAAN1mLzf+vf7dCB0DyQACAAMAAgAAAAAAAAABAAAD2P7vAAAIQP69/bwIHQPoAML/0QAAAAAAAAAAAAAANnicBMAhS0NRGMbx//MsqiAoXLdywnG74DUYFW/VRRXEZheslgW/hH4Ok8U4tAiCySIsnGFeWRgiY68/37HLO2gVHx6SPeDI52R9k1mS9Un2LdkjWg/IHtG6IeuPda249g1n7lJ7h6Rn+q6oNaWvHo23kNdIzEiakPhlv5NI3iC5Q+0qFu5S64qkh1jqhNabHGrMsd841VN8aRyvKuyp0FOJBXMq5jFVQ9ZPTHQZL3rkXoUDX7DNjAQM/wEAAP//AwATtzPyAAAAAAAALgAuAFIAigC8AN4A9AECARIBOAFqAY4B0AH4AjgCTAJ0AqwC5AMSA0oDhAOsA/QEHgQqBEQEZgSoBNIFAAU6BXQFkgXOBfwGKAZGBoAGrAbcBw4HJgdQB2YHhAeSB6AHsAfOB+IH+ggICB4AAAABAAAANgCMAAwAZgAHAAEAAAAAAAAAAAAAAAAABAADeJyclN1uGlcUhT9ioE3/Liorcm6sc5lKzuBGcZTEV+M6VkZFkDKkP1JVaYAxIGBmxAw4zhP0um/Rt8hVH6NPUfW62psNYSKrVlAUaw1n/6yz9toH2Odf9qhU7wJ/1ZeGKxzWfzZ8hy/qTcN7nNU/M1zlqPa34RqD2lvDdR7UOoY/4V31D8Of8rj6m+G7HFQvDH/Oo+q+4S/3HP8Y/orHvFvhCjzld8MVDsgM32GfXw3vcQ+rWalyj2PDNb7m0HCdQ6DLmIIpYxKGOC4ZM2TBnJickJg5Yy6JGeAI8JlS6K8JkSLH8MZfI0IK5kRacUSBY0rIlIickVV8q1kpr7Sj9Jkrkm4+BSMiepoxISLBkTIkJSFmonUKCjKe06BBTl/5ZhTkeOSMmeKRMmdIgzYXNOkyYkyO40IrCbOQlEsKroi0v7MIUaZPTEJurBYkDJSnU36xZgc0cbTJNHa7crNU4QjHj5ot3CTG8S2e/ndbzMp912wilqqnaNhjqjyvdIIjVVz6+vyguOA5bid9ykxu12ig7GTWY3osdP4yP8kTJgnOHeATqoNCdx/HmX4HhKrITwR0eUmb13T126dDB58WXQJeaG6bDo7vaNPiXDMCxauzC3VMi19wfE+gMVI7Nn1Ec/l6Q2buFu7iDLnHjEy3QGYs9xfnxztNWHYoLbkjV1f0dY8kUvZAVJE9ixiaKzJ1xUy1XHsjN/0G5gg5LXS2789lG5a2e+stvibVHXYsjJNMbsXotql6H3jmSv95RAxI6WlEn5QZDQqu9W6viFgwxXGuPn6pW1Lgb3Kkz7W6JGamDAISrTMn07+R+SY07v2S7529JbJ5M93RyeZWu3SRysnWjF6reuuz0FSOtybQsKmmliMTlsqrm4r3Jdor8Q/V/bm+bikPCbSuTLJ/4ytwzDNOOGWkXaR6wnJzJq+ERJyqAhNijZI3841q9QiPEzyecMIJz3jygZZrNs74uBKf7f4+55zR5vTW26xi25zxolTt/zv/qWyP9T6Oh5uvpztP88FHuPYbjkrvZkdfA9mgpVV7vx0tImbCxR1sa+Hu4/0HAAD//wMAcqFRQAAAAwAA//UAAP/OADIAAAAAAAAAAAAAAAAAAAAAAAAAAA==");
 }]]></style><style type="text/css"><![CDATA[.shape {
   shape-rendering: geometricPrecision;
   stroke-linejoin: round;
@@ -35,104 +35,104 @@
   opacity: 0.5;
 }
 
-		.d2-1108726992 .fill-N1{fill:#0A0F25;}
-		.d2-1108726992 .fill-N2{fill:#676C7E;}
-		.d2-1108726992 .fill-N3{fill:#9499AB;}
-		.d2-1108726992 .fill-N4{fill:#CFD2DD;}
-		.d2-1108726992 .fill-N5{fill:#DEE1EB;}
-		.d2-1108726992 .fill-N6{fill:#EEF1F8;}
-		.d2-1108726992 .fill-N7{fill:#FFFFFF;}
-		.d2-1108726992 .fill-B1{fill:#000536;}
-		.d2-1108726992 .fill-B2{fill:#0F66B7;}
-		.d2-1108726992 .fill-B3{fill:#4393DD;}
-		.d2-1108726992 .fill-B4{fill:#87BFF3;}
-		.d2-1108726992 .fill-B5{fill:#BCDDFB;}
-		.d2-1108726992 .fill-B6{fill:#E5F3FF;}
-		.d2-1108726992 .fill-AA2{fill:#7639C5;}
-		.d2-1108726992 .fill-AA4{fill:#C1A2F3;}
-		.d2-1108726992 .fill-AA5{fill:#DACEFB;}
-		.d2-1108726992 .fill-AB4{fill:#EA99C6;}
-		.d2-1108726992 .fill-AB5{fill:#FFDEF1;}
-		.d2-1108726992 .stroke-N1{stroke:#0A0F25;}
-		.d2-1108726992 .stroke-N2{stroke:#676C7E;}
-		.d2-1108726992 .stroke-N3{stroke:#9499AB;}
-		.d2-1108726992 .stroke-N4{stroke:#CFD2DD;}
-		.d2-1108726992 .stroke-N5{stroke:#DEE1EB;}
-		.d2-1108726992 .stroke-N6{stroke:#EEF1F8;}
-		.d2-1108726992 .stroke-N7{stroke:#FFFFFF;}
-		.d2-1108726992 .stroke-B1{stroke:#000536;}
-		.d2-1108726992 .stroke-B2{stroke:#0F66B7;}
-		.d2-1108726992 .stroke-B3{stroke:#4393DD;}
-		.d2-1108726992 .stroke-B4{stroke:#87BFF3;}
-		.d2-1108726992 .stroke-B5{stroke:#BCDDFB;}
-		.d2-1108726992 .stroke-B6{stroke:#E5F3FF;}
-		.d2-1108726992 .stroke-AA2{stroke:#7639C5;}
-		.d2-1108726992 .stroke-AA4{stroke:#C1A2F3;}
-		.d2-1108726992 .stroke-AA5{stroke:#DACEFB;}
-		.d2-1108726992 .stroke-AB4{stroke:#EA99C6;}
-		.d2-1108726992 .stroke-AB5{stroke:#FFDEF1;}
-		.d2-1108726992 .background-color-N1{background-color:#0A0F25;}
-		.d2-1108726992 .background-color-N2{background-color:#676C7E;}
-		.d2-1108726992 .background-color-N3{background-color:#9499AB;}
-		.d2-1108726992 .background-color-N4{background-color:#CFD2DD;}
-		.d2-1108726992 .background-color-N5{background-color:#DEE1EB;}
-		.d2-1108726992 .background-color-N6{background-color:#EEF1F8;}
-		.d2-1108726992 .background-color-N7{background-color:#FFFFFF;}
-		.d2-1108726992 .background-color-B1{background-color:#000536;}
-		.d2-1108726992 .background-color-B2{background-color:#0F66B7;}
-		.d2-1108726992 .background-color-B3{background-color:#4393DD;}
-		.d2-1108726992 .background-color-B4{background-color:#87BFF3;}
-		.d2-1108726992 .background-color-B5{background-color:#BCDDFB;}
-		.d2-1108726992 .background-color-B6{background-color:#E5F3FF;}
-		.d2-1108726992 .background-color-AA2{background-color:#7639C5;}
-		.d2-1108726992 .background-color-AA4{background-color:#C1A2F3;}
-		.d2-1108726992 .background-color-AA5{background-color:#DACEFB;}
-		.d2-1108726992 .background-color-AB4{background-color:#EA99C6;}
-		.d2-1108726992 .background-color-AB5{background-color:#FFDEF1;}
-		.d2-1108726992 .color-N1{color:#0A0F25;}
-		.d2-1108726992 .color-N2{color:#676C7E;}
-		.d2-1108726992 .color-N3{color:#9499AB;}
-		.d2-1108726992 .color-N4{color:#CFD2DD;}
-		.d2-1108726992 .color-N5{color:#DEE1EB;}
-		.d2-1108726992 .color-N6{color:#EEF1F8;}
-		.d2-1108726992 .color-N7{color:#FFFFFF;}
-		.d2-1108726992 .color-B1{color:#000536;}
-		.d2-1108726992 .color-B2{color:#0F66B7;}
-		.d2-1108726992 .color-B3{color:#4393DD;}
-		.d2-1108726992 .color-B4{color:#87BFF3;}
-		.d2-1108726992 .color-B5{color:#BCDDFB;}
-		.d2-1108726992 .color-B6{color:#E5F3FF;}
-		.d2-1108726992 .color-AA2{color:#7639C5;}
-		.d2-1108726992 .color-AA4{color:#C1A2F3;}
-		.d2-1108726992 .color-AA5{color:#DACEFB;}
-		.d2-1108726992 .color-AB4{color:#EA99C6;}
-		.d2-1108726992 .color-AB5{color:#FFDEF1;}.appendix text.text{fill:#0A0F25}.md{--color-fg-default:#0A0F25;--color-fg-muted:#676C7E;--color-fg-subtle:#9499AB;--color-canvas-default:#FFFFFF;--color-canvas-subtle:#EEF1F8;--color-border-default:#000536;--color-border-muted:#0F66B7;--color-neutral-muted:#EEF1F8;--color-accent-fg:#0F66B7;--color-accent-emphasis:#0F66B7;--color-attention-subtle:#676C7E;--color-danger-fg:red;}.sketch-overlay-B1{fill:url(#streaks-darker-d2-1108726992);mix-blend-mode:lighten}.sketch-overlay-B2{fill:url(#streaks-dark-d2-1108726992);mix-blend-mode:overlay}.sketch-overlay-B3{fill:url(#streaks-dark-d2-1108726992);mix-blend-mode:overlay}.sketch-overlay-B4{fill:url(#streaks-normal-d2-1108726992);mix-blend-mode:color-burn}.sketch-overlay-B5{fill:url(#streaks-normal-d2-1108726992);mix-blend-mode:color-burn}.sketch-overlay-B6{fill:url(#streaks-bright-d2-1108726992);mix-blend-mode:darken}.sketch-overlay-AA2{fill:url(#streaks-dark-d2-1108726992);mix-blend-mode:overlay}.sketch-overlay-AA4{fill:url(#streaks-normal-d2-1108726992);mix-blend-mode:color-burn}.sketch-overlay-AA5{fill:url(#streaks-normal-d2-1108726992);mix-blend-mode:color-burn}.sketch-overlay-AB4{fill:url(#streaks-normal-d2-1108726992);mix-blend-mode:color-burn}.sketch-overlay-AB5{fill:url(#streaks-bright-d2-1108726992);mix-blend-mode:darken}.sketch-overlay-N1{fill:url(#streaks-darker-d2-1108726992);mix-blend-mode:lighten}.sketch-overlay-N2{fill:url(#streaks-dark-d2-1108726992);mix-blend-mode:overlay}.sketch-overlay-N3{fill:url(#streaks-normal-d2-1108726992);mix-blend-mode:color-burn}.sketch-overlay-N4{fill:url(#streaks-normal-d2-1108726992);mix-blend-mode:color-burn}.sketch-overlay-N5{fill:url(#streaks-bright-d2-1108726992);mix-blend-mode:darken}.sketch-overlay-N6{fill:url(#streaks-bright-d2-1108726992);mix-blend-mode:darken}.sketch-overlay-N7{fill:url(#streaks-bright-d2-1108726992);mix-blend-mode:darken}.light-code{display: block}.dark-code{display: none}]]></style><g class="aW5nZXN0"><g class="shape" ><rect x="370.000000" y="12.000000" width="253.000000" height="82.000000" stroke="#0F66B7" fill="#E5F3FF" class=" stroke-B2 fill-B6" style="stroke-width:2;stroke-dasharray:6.000000,5.919384;" /></g><text x="496.500000" y="50.500000" fill="#0A0F25" class="text-bold fill-N1" style="text-anchor:middle;font-size:16px"><tspan x="496.500000" dy="0.000000">Authenticated OTLP requests</tspan><tspan x="496.500000" dy="18.500000">spans, logs, metrics</tspan></text></g><g class="d3JpdGVycw=="><g class="shape" ><rect x="255.000000" y="169.000000" width="483.000000" height="638.000000" stroke="#000536" fill="transparent" class=" stroke-B1" style="stroke-width:2;" /></g><text x="496.500000" y="202.000000" fill="#0A0F25" class="text fill-N1" style="text-anchor:middle;font-size:28px">Durable write path</text></g><g class="YXV0aG9yaXR5"><g class="shape" ><path d="M 175 997 C 175 973 464 973 497 973 C 529 973 818 973 818 997 V 1187 C 818 1211 529 1211 497 1211 C 464 1211 175 1211 175 1187 V 997 Z" stroke="#000536" fill="#C1A2F3" class=" stroke-B1 fill-AA4" style="stroke-width:2;" /><path d="M 175 997 C 175 1021 464 1021 497 1021 C 529 1021 818 1021 818 997" stroke="#000536" fill="#C1A2F3" class=" stroke-B1 fill-AA4" style="stroke-width:2;" /></g><text x="496.500000" y="1054.000000" fill="#0A0F25" class="text fill-N1" style="text-anchor:middle;font-size:28px"><tspan x="496.500000" dy="0.000000">Authoritative telemetry</tspan><tspan x="496.500000" dy="32.000000">immutable *.batch directories</tspan></text><title>Ordinary Parquet files are authoritative</title></g><g class="cmVhZGVycw=="><g class="shape" ><rect x="12.000000" y="1345.000000" width="659.000000" height="334.000000" stroke="#000536" fill="transparent" class=" stroke-B1" style="stroke-width:2;" /></g><text x="341.500000" y="1378.000000" fill="#0A0F25" class="text fill-N1" style="text-anchor:middle;font-size:28px">Readers</text></g><g class="bWFpbnRlbmFuY2U="><g class="shape" ><rect x="691.000000" y="1296.000000" width="393.000000" height="486.000000" stroke="#000536" fill="transparent" class=" stroke-B1" style="stroke-width:2;" /></g><text x="887.500000" y="1329.000000" fill="#0A0F25" class="text fill-N1" style="text-anchor:middle;font-size:28px">Bounded maintenance</text></g><g class="cXVlcnlzdGF0ZQ=="><g class="shape" ><path d="M 389 1876 C 389 1852 485 1852 496 1852 C 507 1852 603 1852 603 1876 V 1962 C 603 1986 507 1986 496 1986 C 485 1986 389 1986 389 1962 V 1876 Z" stroke="#000536" fill="#C1A2F3" class=" stroke-B1 fill-AA4" style="stroke-width:2;" /><path d="M 389 1876 C 389 1900 485 1900 496 1900 C 507 1900 603 1900 603 1876" stroke="#000536" fill="#C1A2F3" class=" stroke-B1 fill-AA4" style="stroke-width:2;" /></g><text x="496.000000" y="1928.500000" fill="#0A0F25" class="text-bold fill-N1" style="text-anchor:middle;font-size:16px"><tspan x="496.000000" dy="0.000000">Rebuildable query state</tspan><tspan x="496.000000" dy="18.500000">storage.data_dir/query</tspan></text><title>DuckDB rollups and temporary spill. Not authoritative telemetry.</title></g><g class="d3JpdGVycy5hZG1pc3Npb24="><g class="shape" ><rect x="338.000000" y="219.000000" width="316.000000" height="82.000000" stroke="#000536" fill="#BCDDFB" class=" stroke-B1 fill-B5" style="stroke-width:2;" /></g><text x="496.000000" y="257.500000" fill="#0A0F25" class="text-bold fill-N1" style="text-anchor:middle;font-size:16px"><tspan x="496.000000" dy="0.000000">Bounded group admission</tspan><tspan x="496.000000" dy="18.500000">configured row target + 20 ms window</tspan></text></g><g class="d3JpdGVycy53b3JrZXJz"><g class="shape" ><rect x="334.000000" y="371.000000" width="324.000000" height="82.000000" stroke="#000536" fill="#BCDDFB" class=" stroke-B1 fill-B5" style="stroke-width:2;" /></g><text x="496.000000" y="409.500000" fill="#0A0F25" class="text-bold fill-N1" style="text-anchor:middle;font-size:16px"><tspan x="496.000000" dy="0.000000">Up to four commit workers</tspan><tspan x="496.000000" dy="18.500000">independent batches encode in parallel</tspan></text></g><g class="d3JpdGVycy5zdGFnZQ=="><g class="shape" ><rect x="305.000000" y="523.000000" width="383.000000" height="82.000000" stroke="#000536" fill="#BCDDFB" class=" stroke-B1 fill-B5" style="stroke-width:2;" /></g><text x="496.500000" y="561.500000" fill="#0A0F25" class="text-bold fill-N1" style="text-anchor:middle;font-size:16px"><tspan x="496.500000" dy="0.000000">Staging batch directory</tspan><tspan x="496.500000" dy="18.500000">metadata + signal Parquet + trace.fidx for spans</tspan></text></g><g class="d3JpdGVycy5wdWJsaXNo"><g class="shape" ><rect x="340.000000" y="675.000000" width="313.000000" height="82.000000" stroke="#000536" fill="#BCDDFB" class=" stroke-B1 fill-B5" style="stroke-width:2;" /></g><text x="496.500000" y="713.500000" fill="#0A0F25" class="text-bold fill-N1" style="text-anchor:middle;font-size:16px"><tspan x="496.500000" dy="0.000000">Durable publication</tspan><tspan x="496.500000" dy="18.500000">fsync → atomic rename → fsync parent</tspan></text></g><g class="YXV0aG9yaXR5LnB1Ymxpc2hlZCBiYXRjaCBkaXJlY3RvcmllcyBhcmUgZGlzY292ZXJlZCBkaXJlY3RseSBmcm9tIHRoZSBmaWxlc3lzdGVt"><g class="shape" ><rect x="225.000000" y="1095.000000" width="543.000000" height="66.000000" stroke="#000536" fill="#BCDDFB" class=" stroke-B1 fill-B5" style="stroke-width:2;" /></g><text x="496.500000" y="1133.500000" fill="#0A0F25" class="text-bold fill-N1" style="text-anchor:middle;font-size:16px">published batch directories are discovered directly from the filesystem</text></g><g class="cmVhZGVycy50cmFjZQ=="><g class="shape" ><rect x="62.000000" y="1395.000000" width="290.000000" height="82.000000" stroke="#000536" fill="#BCDDFB" class=" stroke-B1 fill-B5" style="stroke-width:2;" /></g><text x="207.000000" y="1433.500000" fill="#0A0F25" class="text-bold fill-N1" style="text-anchor:middle;font-size:16px"><tspan x="207.000000" dy="0.000000">Indexed trace read</tspan><tspan x="207.000000" dy="18.500000">binary-search .fidx → Parquet rows</tspan></text></g><g class="cmVhZGVycy5zcWw="><g class="shape" ><rect x="372.000000" y="1395.000000" width="249.000000" height="82.000000" stroke="#000536" fill="#BCDDFB" class=" stroke-B1 fill-B5" style="stroke-width:2;" /></g><text x="496.500000" y="1433.500000" fill="#0A0F25" class="text-bold fill-N1" style="text-anchor:middle;font-size:16px"><tspan x="496.500000" dy="0.000000">DuckDB SQL</tspan><tspan x="496.500000" dy="18.500000">filters, ordering, broad scans</tspan></text></g><g class="cmVhZGVycy5yb2xsdXBz"><g class="shape" ><rect x="375.000000" y="1547.000000" width="243.000000" height="82.000000" stroke="#000536" fill="#BCDDFB" class=" stroke-B1 fill-B5" style="stroke-width:2;" /></g><text x="496.500000" y="1585.500000" fill="#0A0F25" class="text-bold fill-N1" style="text-anchor:middle;font-size:16px"><tspan x="496.500000" dy="0.000000">DuckDB rollups</tspan><tspan x="496.500000" dy="18.500000">rebuildable analytical cache</tspan></text></g><g class="bWFpbnRlbmFuY2UuY2hvb3Nl"><g class="shape" ><rect x="743.000000" y="1346.000000" width="289.000000" height="82.000000" stroke="#000536" fill="#BCDDFB" class=" stroke-B1 fill-B5" style="stroke-width:2;" /></g><text x="887.500000" y="1384.500000" fill="#0A0F25" class="text-bold fill-N1" style="text-anchor:middle;font-size:16px"><tspan x="887.500000" dy="0.000000">Retention + compaction admission</tspan><tspan x="887.500000" dy="18.500000">bounded batch and row groups</tspan></text></g><g class="bWFpbnRlbmFuY2UubWVyZ2U="><g class="shape" ><rect x="749.000000" y="1498.000000" width="277.000000" height="82.000000" stroke="#000536" fill="#BCDDFB" class=" stroke-B1 fill-B5" style="stroke-width:2;" /></g><text x="887.500000" y="1536.500000" fill="#0A0F25" class="text-bold fill-N1" style="text-anchor:middle;font-size:16px"><tspan x="887.500000" dy="0.000000">Native Parquet merge</tspan><tspan x="887.500000" dy="18.500000">prepared outside the reader gate</tspan></text></g><g class="bWFpbnRlbmFuY2Uuc3dhcA=="><g class="shape" ><rect x="741.000000" y="1650.000000" width="293.000000" height="82.000000" stroke="#000536" fill="#BCDDFB" class=" stroke-B1 fill-B5" style="stroke-width:2;" /></g><text x="887.500000" y="1688.500000" fill="#0A0F25" class="text-bold fill-N1" style="text-anchor:middle;font-size:16px"><tspan x="887.500000" dy="0.000000">Crash-safe namespace swap</tspan><tspan x="887.500000" dy="18.500000">marker + bounded renames + fsync</tspan></text></g><g class="d3JpdGVycy4oYWRtaXNzaW9uIC0mZ3Q7IHdvcmtlcnMpWzBd"><marker id="mk-d2-1108726992-3488378134" markerWidth="10.000000" markerHeight="12.000000" refX="7.000000" refY="6.000000" viewBox="0.000000 0.000000 10.000000 12.000000" orient="auto" markerUnits="userSpaceOnUse"> <polygon points="0.000000,0.000000 10.000000,6.000000 0.000000,12.000000" fill="#000536" class="connection fill-B1" stroke-width="2" /> </marker><path d="M 496.500000 303.000000 L 496.500000 367.000000" stroke="#000536" fill="none" class="connection stroke-B1" style="stroke-width:2;" marker-end="url(#mk-d2-1108726992-3488378134)" mask="url(#d2-1108726992)" /></g><g class="d3JpdGVycy4od29ya2VycyAtJmd0OyBzdGFnZSlbMF0="><path d="M 496.500000 455.000000 L 496.500000 519.000000" stroke="#000536" fill="none" class="connection stroke-B1" style="stroke-width:2;" marker-end="url(#mk-d2-1108726992-3488378134)" mask="url(#d2-1108726992)" /></g><g class="d3JpdGVycy4oc3RhZ2UgLSZndDsgcHVibGlzaClbMF0="><path d="M 496.500000 607.000000 L 496.500000 671.000000" stroke="#000536" fill="none" class="connection stroke-B1" style="stroke-width:2;" marker-end="url(#mk-d2-1108726992-3488378134)" mask="url(#d2-1108726992)" /></g><g class="bWFpbnRlbmFuY2UuKGNob29zZSAtJmd0OyBtZXJnZSlbMF0="><path d="M 887.500000 1430.000000 L 887.500000 1494.000000" stroke="#000536" fill="none" class="connection stroke-B1" style="stroke-width:2;" marker-end="url(#mk-d2-1108726992-3488378134)" mask="url(#d2-1108726992)" /></g><g class="bWFpbnRlbmFuY2UuKG1lcmdlIC0mZ3Q7IHN3YXApWzBd"><path d="M 887.500000 1582.000000 L 887.500000 1646.000000" stroke="#000536" fill="none" class="connection stroke-B1" style="stroke-width:2;" marker-end="url(#mk-d2-1108726992-3488378134)" mask="url(#d2-1108726992)" /></g><g class="KGluZ2VzdCAtJmd0OyB3cml0ZXJzLmFkbWlzc2lvbilbMF0="><path d="M 496.500000 96.000000 L 496.500000 215.000000" stroke="#000536" fill="none" class="connection stroke-B1" style="stroke-width:2;" marker-end="url(#mk-d2-1108726992-3488378134)" mask="url(#d2-1108726992)" /></g><g class="KHdyaXRlcnMucHVibGlzaCAtJmd0OyBhdXRob3JpdHkpWzBd"><path d="M 496.504630 758.999995 L 496.990741 969.000011" stroke="#000536" fill="none" class="connection stroke-B1" style="stroke-width:2;" marker-end="url(#mk-d2-1108726992-3488378134)" mask="url(#d2-1108726992)" /><text x="496.500000" y="871.000000" fill="#676C7E" class="text-italic fill-N2" style="text-anchor:middle;font-size:16px">acknowledge only after publication</text></g><g class="KGF1dGhvcml0eSAtJmd0OyByZWFkZXJzLnRyYWNlKVswXQ=="><path d="M 335.988372 1209.999966 L 335.808139 1241.000169 S 335.750000 1251.000000 325.750000 1251.000000 L 217.000000 1251.000000 S 207.000000 1251.000000 207.000000 1261.000000 L 207.000000 1391.000000" stroke="#000536" fill="none" class="connection stroke-B1" style="stroke-width:2;" marker-end="url(#mk-d2-1108726992-3488378134)" mask="url(#d2-1108726992)" /></g><g class="KGF1dGhvcml0eSAtJmd0OyByZWFkZXJzLnNxbClbMF0="><path d="M 496.989131 1212.999970 L 496.021739 1391.000059" stroke="#000536" fill="none" class="connection stroke-B1" style="stroke-width:2;" marker-end="url(#mk-d2-1108726992-3488378134)" mask="url(#d2-1108726992)" /></g><g class="cmVhZGVycy4oc3FsIC0mZ3Q7IHJvbGx1cHMpWzBd"><path d="M 496.500000 1479.000000 L 496.500000 1543.000000" stroke="#000536" fill="none" class="connection stroke-B1" style="stroke-width:2;" marker-end="url(#mk-d2-1108726992-3488378134)" mask="url(#d2-1108726992)" /></g><g class="KHJlYWRlcnMucm9sbHVwcyAtJmd0OyBxdWVyeXN0YXRlKVswXQ=="><path d="M 496.504484 1630.999995 L 496.991031 1848.000010" stroke="#000536" fill="none" class="connection stroke-B1" style="stroke-width:2;" marker-end="url(#mk-d2-1108726992-3488378134)" mask="url(#d2-1108726992)" /></g><g class="KGF1dGhvcml0eSAtJmd0OyBtYWludGVuYW5jZS5jaG9vc2UpWzBd"><path d="M 657.011628 1209.999966 L 657.191861 1241.000169 S 657.250000 1251.000000 667.250000 1251.000000 L 877.500000 1251.000000 S 887.500000 1251.000000 887.500000 1261.000000 L 887.500000 1342.000000" stroke="#000536" fill="none" class="connection stroke-B1" style="stroke-width:2;" marker-end="url(#mk-d2-1108726992-3488378134)" mask="url(#d2-1108726992)" /></g><g transform="translate(770 969)" class="appendix-icon"><title>Ordinary Parquet files are authoritative</title><svg width="32" height="32" viewBox="0 0 32 32" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_3427_35082111-d2-1108726992-MF2XI2DPOJUXI6I)">
+		.d2-2701310579 .fill-N1{fill:#0A0F25;}
+		.d2-2701310579 .fill-N2{fill:#676C7E;}
+		.d2-2701310579 .fill-N3{fill:#9499AB;}
+		.d2-2701310579 .fill-N4{fill:#CFD2DD;}
+		.d2-2701310579 .fill-N5{fill:#DEE1EB;}
+		.d2-2701310579 .fill-N6{fill:#EEF1F8;}
+		.d2-2701310579 .fill-N7{fill:#FFFFFF;}
+		.d2-2701310579 .fill-B1{fill:#000536;}
+		.d2-2701310579 .fill-B2{fill:#0F66B7;}
+		.d2-2701310579 .fill-B3{fill:#4393DD;}
+		.d2-2701310579 .fill-B4{fill:#87BFF3;}
+		.d2-2701310579 .fill-B5{fill:#BCDDFB;}
+		.d2-2701310579 .fill-B6{fill:#E5F3FF;}
+		.d2-2701310579 .fill-AA2{fill:#7639C5;}
+		.d2-2701310579 .fill-AA4{fill:#C1A2F3;}
+		.d2-2701310579 .fill-AA5{fill:#DACEFB;}
+		.d2-2701310579 .fill-AB4{fill:#EA99C6;}
+		.d2-2701310579 .fill-AB5{fill:#FFDEF1;}
+		.d2-2701310579 .stroke-N1{stroke:#0A0F25;}
+		.d2-2701310579 .stroke-N2{stroke:#676C7E;}
+		.d2-2701310579 .stroke-N3{stroke:#9499AB;}
+		.d2-2701310579 .stroke-N4{stroke:#CFD2DD;}
+		.d2-2701310579 .stroke-N5{stroke:#DEE1EB;}
+		.d2-2701310579 .stroke-N6{stroke:#EEF1F8;}
+		.d2-2701310579 .stroke-N7{stroke:#FFFFFF;}
+		.d2-2701310579 .stroke-B1{stroke:#000536;}
+		.d2-2701310579 .stroke-B2{stroke:#0F66B7;}
+		.d2-2701310579 .stroke-B3{stroke:#4393DD;}
+		.d2-2701310579 .stroke-B4{stroke:#87BFF3;}
+		.d2-2701310579 .stroke-B5{stroke:#BCDDFB;}
+		.d2-2701310579 .stroke-B6{stroke:#E5F3FF;}
+		.d2-2701310579 .stroke-AA2{stroke:#7639C5;}
+		.d2-2701310579 .stroke-AA4{stroke:#C1A2F3;}
+		.d2-2701310579 .stroke-AA5{stroke:#DACEFB;}
+		.d2-2701310579 .stroke-AB4{stroke:#EA99C6;}
+		.d2-2701310579 .stroke-AB5{stroke:#FFDEF1;}
+		.d2-2701310579 .background-color-N1{background-color:#0A0F25;}
+		.d2-2701310579 .background-color-N2{background-color:#676C7E;}
+		.d2-2701310579 .background-color-N3{background-color:#9499AB;}
+		.d2-2701310579 .background-color-N4{background-color:#CFD2DD;}
+		.d2-2701310579 .background-color-N5{background-color:#DEE1EB;}
+		.d2-2701310579 .background-color-N6{background-color:#EEF1F8;}
+		.d2-2701310579 .background-color-N7{background-color:#FFFFFF;}
+		.d2-2701310579 .background-color-B1{background-color:#000536;}
+		.d2-2701310579 .background-color-B2{background-color:#0F66B7;}
+		.d2-2701310579 .background-color-B3{background-color:#4393DD;}
+		.d2-2701310579 .background-color-B4{background-color:#87BFF3;}
+		.d2-2701310579 .background-color-B5{background-color:#BCDDFB;}
+		.d2-2701310579 .background-color-B6{background-color:#E5F3FF;}
+		.d2-2701310579 .background-color-AA2{background-color:#7639C5;}
+		.d2-2701310579 .background-color-AA4{background-color:#C1A2F3;}
+		.d2-2701310579 .background-color-AA5{background-color:#DACEFB;}
+		.d2-2701310579 .background-color-AB4{background-color:#EA99C6;}
+		.d2-2701310579 .background-color-AB5{background-color:#FFDEF1;}
+		.d2-2701310579 .color-N1{color:#0A0F25;}
+		.d2-2701310579 .color-N2{color:#676C7E;}
+		.d2-2701310579 .color-N3{color:#9499AB;}
+		.d2-2701310579 .color-N4{color:#CFD2DD;}
+		.d2-2701310579 .color-N5{color:#DEE1EB;}
+		.d2-2701310579 .color-N6{color:#EEF1F8;}
+		.d2-2701310579 .color-N7{color:#FFFFFF;}
+		.d2-2701310579 .color-B1{color:#000536;}
+		.d2-2701310579 .color-B2{color:#0F66B7;}
+		.d2-2701310579 .color-B3{color:#4393DD;}
+		.d2-2701310579 .color-B4{color:#87BFF3;}
+		.d2-2701310579 .color-B5{color:#BCDDFB;}
+		.d2-2701310579 .color-B6{color:#E5F3FF;}
+		.d2-2701310579 .color-AA2{color:#7639C5;}
+		.d2-2701310579 .color-AA4{color:#C1A2F3;}
+		.d2-2701310579 .color-AA5{color:#DACEFB;}
+		.d2-2701310579 .color-AB4{color:#EA99C6;}
+		.d2-2701310579 .color-AB5{color:#FFDEF1;}.appendix text.text{fill:#0A0F25}.md{--color-fg-default:#0A0F25;--color-fg-muted:#676C7E;--color-fg-subtle:#9499AB;--color-canvas-default:#FFFFFF;--color-canvas-subtle:#EEF1F8;--color-border-default:#000536;--color-border-muted:#0F66B7;--color-neutral-muted:#EEF1F8;--color-accent-fg:#0F66B7;--color-accent-emphasis:#0F66B7;--color-attention-subtle:#676C7E;--color-danger-fg:red;}.sketch-overlay-B1{fill:url(#streaks-darker-d2-2701310579);mix-blend-mode:lighten}.sketch-overlay-B2{fill:url(#streaks-dark-d2-2701310579);mix-blend-mode:overlay}.sketch-overlay-B3{fill:url(#streaks-dark-d2-2701310579);mix-blend-mode:overlay}.sketch-overlay-B4{fill:url(#streaks-normal-d2-2701310579);mix-blend-mode:color-burn}.sketch-overlay-B5{fill:url(#streaks-normal-d2-2701310579);mix-blend-mode:color-burn}.sketch-overlay-B6{fill:url(#streaks-bright-d2-2701310579);mix-blend-mode:darken}.sketch-overlay-AA2{fill:url(#streaks-dark-d2-2701310579);mix-blend-mode:overlay}.sketch-overlay-AA4{fill:url(#streaks-normal-d2-2701310579);mix-blend-mode:color-burn}.sketch-overlay-AA5{fill:url(#streaks-normal-d2-2701310579);mix-blend-mode:color-burn}.sketch-overlay-AB4{fill:url(#streaks-normal-d2-2701310579);mix-blend-mode:color-burn}.sketch-overlay-AB5{fill:url(#streaks-bright-d2-2701310579);mix-blend-mode:darken}.sketch-overlay-N1{fill:url(#streaks-darker-d2-2701310579);mix-blend-mode:lighten}.sketch-overlay-N2{fill:url(#streaks-dark-d2-2701310579);mix-blend-mode:overlay}.sketch-overlay-N3{fill:url(#streaks-normal-d2-2701310579);mix-blend-mode:color-burn}.sketch-overlay-N4{fill:url(#streaks-normal-d2-2701310579);mix-blend-mode:color-burn}.sketch-overlay-N5{fill:url(#streaks-bright-d2-2701310579);mix-blend-mode:darken}.sketch-overlay-N6{fill:url(#streaks-bright-d2-2701310579);mix-blend-mode:darken}.sketch-overlay-N7{fill:url(#streaks-bright-d2-2701310579);mix-blend-mode:darken}.light-code{display: block}.dark-code{display: none}]]></style><g class="aW5nZXN0"><g class="shape" ><rect x="370.000000" y="12.000000" width="253.000000" height="82.000000" stroke="#0F66B7" fill="#E5F3FF" class=" stroke-B2 fill-B6" style="stroke-width:2;stroke-dasharray:6.000000,5.919384;" /></g><text x="496.500000" y="50.500000" fill="#0A0F25" class="text-bold fill-N1" style="text-anchor:middle;font-size:16px"><tspan x="496.500000" dy="0.000000">Authenticated OTLP requests</tspan><tspan x="496.500000" dy="18.500000">spans, logs, metrics</tspan></text></g><g class="d3JpdGVycw=="><g class="shape" ><rect x="255.000000" y="169.000000" width="483.000000" height="638.000000" stroke="#000536" fill="transparent" class=" stroke-B1" style="stroke-width:2;" /></g><text x="496.500000" y="202.000000" fill="#0A0F25" class="text fill-N1" style="text-anchor:middle;font-size:28px">Durable write path</text></g><g class="YXV0aG9yaXR5"><g class="shape" ><path d="M 175 997 C 175 973 464 973 497 973 C 529 973 818 973 818 997 V 1187 C 818 1211 529 1211 497 1211 C 464 1211 175 1211 175 1187 V 997 Z" stroke="#000536" fill="#C1A2F3" class=" stroke-B1 fill-AA4" style="stroke-width:2;" /><path d="M 175 997 C 175 1021 464 1021 497 1021 C 529 1021 818 1021 818 997" stroke="#000536" fill="#C1A2F3" class=" stroke-B1 fill-AA4" style="stroke-width:2;" /></g><text x="496.500000" y="1054.000000" fill="#0A0F25" class="text fill-N1" style="text-anchor:middle;font-size:28px"><tspan x="496.500000" dy="0.000000">Authoritative telemetry</tspan><tspan x="496.500000" dy="32.000000">immutable *.batch directories</tspan></text><title>Ordinary Parquet files are authoritative</title></g><g class="cmVhZGVycw=="><g class="shape" ><rect x="12.000000" y="1345.000000" width="659.000000" height="334.000000" stroke="#000536" fill="transparent" class=" stroke-B1" style="stroke-width:2;" /></g><text x="341.500000" y="1378.000000" fill="#0A0F25" class="text fill-N1" style="text-anchor:middle;font-size:28px">Readers</text></g><g class="bWFpbnRlbmFuY2U="><g class="shape" ><rect x="691.000000" y="1296.000000" width="393.000000" height="486.000000" stroke="#000536" fill="transparent" class=" stroke-B1" style="stroke-width:2;" /></g><text x="887.500000" y="1329.000000" fill="#0A0F25" class="text fill-N1" style="text-anchor:middle;font-size:28px">Bounded maintenance</text></g><g class="cXVlcnlzdGF0ZQ=="><g class="shape" ><path d="M 382 1876 C 382 1852 485 1852 497 1852 C 508 1852 611 1852 611 1876 V 1962 C 611 1986 508 1986 497 1986 C 485 1986 382 1986 382 1962 V 1876 Z" stroke="#000536" fill="#C1A2F3" class=" stroke-B1 fill-AA4" style="stroke-width:2;" /><path d="M 382 1876 C 382 1900 485 1900 497 1900 C 508 1900 611 1900 611 1876" stroke="#000536" fill="#C1A2F3" class=" stroke-B1 fill-AA4" style="stroke-width:2;" /></g><text x="496.500000" y="1928.500000" fill="#0A0F25" class="text-bold fill-N1" style="text-anchor:middle;font-size:16px"><tspan x="496.500000" dy="0.000000">Rebuildable query state</tspan><tspan x="496.500000" dy="18.500000">FANOUT_DATA_DIR/query</tspan></text><title>DuckDB rollups and temporary spill. Not authoritative telemetry.</title></g><g class="d3JpdGVycy5hZG1pc3Npb24="><g class="shape" ><rect x="338.000000" y="219.000000" width="316.000000" height="82.000000" stroke="#000536" fill="#BCDDFB" class=" stroke-B1 fill-B5" style="stroke-width:2;" /></g><text x="496.000000" y="257.500000" fill="#0A0F25" class="text-bold fill-N1" style="text-anchor:middle;font-size:16px"><tspan x="496.000000" dy="0.000000">Bounded group admission</tspan><tspan x="496.000000" dy="18.500000">configured row target + 20 ms window</tspan></text></g><g class="d3JpdGVycy53b3JrZXJz"><g class="shape" ><rect x="334.000000" y="371.000000" width="324.000000" height="82.000000" stroke="#000536" fill="#BCDDFB" class=" stroke-B1 fill-B5" style="stroke-width:2;" /></g><text x="496.000000" y="409.500000" fill="#0A0F25" class="text-bold fill-N1" style="text-anchor:middle;font-size:16px"><tspan x="496.000000" dy="0.000000">Up to four commit workers</tspan><tspan x="496.000000" dy="18.500000">independent batches encode in parallel</tspan></text></g><g class="d3JpdGVycy5zdGFnZQ=="><g class="shape" ><rect x="305.000000" y="523.000000" width="383.000000" height="82.000000" stroke="#000536" fill="#BCDDFB" class=" stroke-B1 fill-B5" style="stroke-width:2;" /></g><text x="496.500000" y="561.500000" fill="#0A0F25" class="text-bold fill-N1" style="text-anchor:middle;font-size:16px"><tspan x="496.500000" dy="0.000000">Staging batch directory</tspan><tspan x="496.500000" dy="18.500000">metadata + signal Parquet + trace.fidx for spans</tspan></text></g><g class="d3JpdGVycy5wdWJsaXNo"><g class="shape" ><rect x="340.000000" y="675.000000" width="313.000000" height="82.000000" stroke="#000536" fill="#BCDDFB" class=" stroke-B1 fill-B5" style="stroke-width:2;" /></g><text x="496.500000" y="713.500000" fill="#0A0F25" class="text-bold fill-N1" style="text-anchor:middle;font-size:16px"><tspan x="496.500000" dy="0.000000">Durable publication</tspan><tspan x="496.500000" dy="18.500000">fsync → atomic rename → fsync parent</tspan></text></g><g class="YXV0aG9yaXR5LnB1Ymxpc2hlZCBiYXRjaCBkaXJlY3RvcmllcyBhcmUgZGlzY292ZXJlZCBkaXJlY3RseSBmcm9tIHRoZSBmaWxlc3lzdGVt"><g class="shape" ><rect x="225.000000" y="1095.000000" width="543.000000" height="66.000000" stroke="#000536" fill="#BCDDFB" class=" stroke-B1 fill-B5" style="stroke-width:2;" /></g><text x="496.500000" y="1133.500000" fill="#0A0F25" class="text-bold fill-N1" style="text-anchor:middle;font-size:16px">published batch directories are discovered directly from the filesystem</text></g><g class="cmVhZGVycy50cmFjZQ=="><g class="shape" ><rect x="62.000000" y="1395.000000" width="290.000000" height="82.000000" stroke="#000536" fill="#BCDDFB" class=" stroke-B1 fill-B5" style="stroke-width:2;" /></g><text x="207.000000" y="1433.500000" fill="#0A0F25" class="text-bold fill-N1" style="text-anchor:middle;font-size:16px"><tspan x="207.000000" dy="0.000000">Indexed trace read</tspan><tspan x="207.000000" dy="18.500000">binary-search .fidx → Parquet rows</tspan></text></g><g class="cmVhZGVycy5zcWw="><g class="shape" ><rect x="372.000000" y="1395.000000" width="249.000000" height="82.000000" stroke="#000536" fill="#BCDDFB" class=" stroke-B1 fill-B5" style="stroke-width:2;" /></g><text x="496.500000" y="1433.500000" fill="#0A0F25" class="text-bold fill-N1" style="text-anchor:middle;font-size:16px"><tspan x="496.500000" dy="0.000000">DuckDB SQL</tspan><tspan x="496.500000" dy="18.500000">filters, ordering, broad scans</tspan></text></g><g class="cmVhZGVycy5yb2xsdXBz"><g class="shape" ><rect x="375.000000" y="1547.000000" width="243.000000" height="82.000000" stroke="#000536" fill="#BCDDFB" class=" stroke-B1 fill-B5" style="stroke-width:2;" /></g><text x="496.500000" y="1585.500000" fill="#0A0F25" class="text-bold fill-N1" style="text-anchor:middle;font-size:16px"><tspan x="496.500000" dy="0.000000">DuckDB rollups</tspan><tspan x="496.500000" dy="18.500000">rebuildable analytical cache</tspan></text></g><g class="bWFpbnRlbmFuY2UuY2hvb3Nl"><g class="shape" ><rect x="743.000000" y="1346.000000" width="289.000000" height="82.000000" stroke="#000536" fill="#BCDDFB" class=" stroke-B1 fill-B5" style="stroke-width:2;" /></g><text x="887.500000" y="1384.500000" fill="#0A0F25" class="text-bold fill-N1" style="text-anchor:middle;font-size:16px"><tspan x="887.500000" dy="0.000000">Retention + compaction admission</tspan><tspan x="887.500000" dy="18.500000">bounded batch and row groups</tspan></text></g><g class="bWFpbnRlbmFuY2UubWVyZ2U="><g class="shape" ><rect x="749.000000" y="1498.000000" width="277.000000" height="82.000000" stroke="#000536" fill="#BCDDFB" class=" stroke-B1 fill-B5" style="stroke-width:2;" /></g><text x="887.500000" y="1536.500000" fill="#0A0F25" class="text-bold fill-N1" style="text-anchor:middle;font-size:16px"><tspan x="887.500000" dy="0.000000">Native Parquet merge</tspan><tspan x="887.500000" dy="18.500000">prepared outside the reader gate</tspan></text></g><g class="bWFpbnRlbmFuY2Uuc3dhcA=="><g class="shape" ><rect x="741.000000" y="1650.000000" width="293.000000" height="82.000000" stroke="#000536" fill="#BCDDFB" class=" stroke-B1 fill-B5" style="stroke-width:2;" /></g><text x="887.500000" y="1688.500000" fill="#0A0F25" class="text-bold fill-N1" style="text-anchor:middle;font-size:16px"><tspan x="887.500000" dy="0.000000">Crash-safe namespace swap</tspan><tspan x="887.500000" dy="18.500000">marker + bounded renames + fsync</tspan></text></g><g class="d3JpdGVycy4oYWRtaXNzaW9uIC0mZ3Q7IHdvcmtlcnMpWzBd"><marker id="mk-d2-2701310579-3488378134" markerWidth="10.000000" markerHeight="12.000000" refX="7.000000" refY="6.000000" viewBox="0.000000 0.000000 10.000000 12.000000" orient="auto" markerUnits="userSpaceOnUse"> <polygon points="0.000000,0.000000 10.000000,6.000000 0.000000,12.000000" fill="#000536" class="connection fill-B1" stroke-width="2" /> </marker><path d="M 496.500000 303.000000 L 496.500000 367.000000" stroke="#000536" fill="none" class="connection stroke-B1" style="stroke-width:2;" marker-end="url(#mk-d2-2701310579-3488378134)" mask="url(#d2-2701310579)" /></g><g class="d3JpdGVycy4od29ya2VycyAtJmd0OyBzdGFnZSlbMF0="><path d="M 496.500000 455.000000 L 496.500000 519.000000" stroke="#000536" fill="none" class="connection stroke-B1" style="stroke-width:2;" marker-end="url(#mk-d2-2701310579-3488378134)" mask="url(#d2-2701310579)" /></g><g class="d3JpdGVycy4oc3RhZ2UgLSZndDsgcHVibGlzaClbMF0="><path d="M 496.500000 607.000000 L 496.500000 671.000000" stroke="#000536" fill="none" class="connection stroke-B1" style="stroke-width:2;" marker-end="url(#mk-d2-2701310579-3488378134)" mask="url(#d2-2701310579)" /></g><g class="bWFpbnRlbmFuY2UuKGNob29zZSAtJmd0OyBtZXJnZSlbMF0="><path d="M 887.500000 1430.000000 L 887.500000 1494.000000" stroke="#000536" fill="none" class="connection stroke-B1" style="stroke-width:2;" marker-end="url(#mk-d2-2701310579-3488378134)" mask="url(#d2-2701310579)" /></g><g class="bWFpbnRlbmFuY2UuKG1lcmdlIC0mZ3Q7IHN3YXApWzBd"><path d="M 887.500000 1582.000000 L 887.500000 1646.000000" stroke="#000536" fill="none" class="connection stroke-B1" style="stroke-width:2;" marker-end="url(#mk-d2-2701310579-3488378134)" mask="url(#d2-2701310579)" /></g><g class="KGluZ2VzdCAtJmd0OyB3cml0ZXJzLmFkbWlzc2lvbilbMF0="><path d="M 496.500000 96.000000 L 496.500000 215.000000" stroke="#000536" fill="none" class="connection stroke-B1" style="stroke-width:2;" marker-end="url(#mk-d2-2701310579-3488378134)" mask="url(#d2-2701310579)" /></g><g class="KHdyaXRlcnMucHVibGlzaCAtJmd0OyBhdXRob3JpdHkpWzBd"><path d="M 496.504630 758.999995 L 496.990741 969.000011" stroke="#000536" fill="none" class="connection stroke-B1" style="stroke-width:2;" marker-end="url(#mk-d2-2701310579-3488378134)" mask="url(#d2-2701310579)" /><text x="496.500000" y="871.000000" fill="#676C7E" class="text-italic fill-N2" style="text-anchor:middle;font-size:16px">acknowledge only after publication</text></g><g class="KGF1dGhvcml0eSAtJmd0OyByZWFkZXJzLnRyYWNlKVswXQ=="><path d="M 335.988372 1209.999966 L 335.808139 1241.000169 S 335.750000 1251.000000 325.750000 1251.000000 L 217.000000 1251.000000 S 207.000000 1251.000000 207.000000 1261.000000 L 207.000000 1391.000000" stroke="#000536" fill="none" class="connection stroke-B1" style="stroke-width:2;" marker-end="url(#mk-d2-2701310579-3488378134)" mask="url(#d2-2701310579)" /></g><g class="KGF1dGhvcml0eSAtJmd0OyByZWFkZXJzLnNxbClbMF0="><path d="M 496.989131 1212.999970 L 496.021739 1391.000059" stroke="#000536" fill="none" class="connection stroke-B1" style="stroke-width:2;" marker-end="url(#mk-d2-2701310579-3488378134)" mask="url(#d2-2701310579)" /></g><g class="cmVhZGVycy4oc3FsIC0mZ3Q7IHJvbGx1cHMpWzBd"><path d="M 496.500000 1479.000000 L 496.500000 1543.000000" stroke="#000536" fill="none" class="connection stroke-B1" style="stroke-width:2;" marker-end="url(#mk-d2-2701310579-3488378134)" mask="url(#d2-2701310579)" /></g><g class="KHJlYWRlcnMucm9sbHVwcyAtJmd0OyBxdWVyeXN0YXRlKVswXQ=="><path d="M 496.504484 1630.999995 L 496.991031 1848.000010" stroke="#000536" fill="none" class="connection stroke-B1" style="stroke-width:2;" marker-end="url(#mk-d2-2701310579-3488378134)" mask="url(#d2-2701310579)" /></g><g class="KGF1dGhvcml0eSAtJmd0OyBtYWludGVuYW5jZS5jaG9vc2UpWzBd"><path d="M 657.011628 1209.999966 L 657.191861 1241.000169 S 657.250000 1251.000000 667.250000 1251.000000 L 877.500000 1251.000000 S 887.500000 1251.000000 887.500000 1261.000000 L 887.500000 1342.000000" stroke="#000536" fill="none" class="connection stroke-B1" style="stroke-width:2;" marker-end="url(#mk-d2-2701310579-3488378134)" mask="url(#d2-2701310579)" /></g><g transform="translate(770 969)" class="appendix-icon"><title>Ordinary Parquet files are authoritative</title><svg width="32" height="32" viewBox="0 0 32 32" fill="none" xmlns="http://www.w3.org/2000/svg">
+<g clip-path="url(#clip0_3427_35082111-d2-2701310579-MF2XI2DPOJUXI6I)">
 <path d="M16 31.1109C24.3456 31.1109 31.1111 24.3454 31.1111 15.9998C31.1111 7.65415 24.3456 0.888672 16 0.888672C7.65436 0.888672 0.888885 7.65415 0.888885 15.9998C0.888885 24.3454 7.65436 31.1109 16 31.1109Z" fill="white" stroke="#DEE1EB"/>
 <path d="M16 26C21.5228 26 26 21.5228 26 16C26 10.4772 21.5228 6 16 6C10.4772 6 6 10.4772 6 16C6 21.5228 10.4772 26 16 26Z" stroke="#2E3346" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/>
 <path d="M16 19.998V15.998" stroke="#2E3346" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/>
 <path d="M16 12H16.0098" stroke="#2E3346" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/>
 </g>
 <defs>
-<clipPath id="clip0_3427_35082111-d2-1108726992-MF2XI2DPOJUXI6I">
+<clipPath id="clip0_3427_35082111-d2-2701310579-MF2XI2DPOJUXI6I">
 <rect width="32" height="32" fill="white"/>
 </clipPath>
 </defs>
 </svg>
-</g><g transform="translate(571 1846)" class="appendix-icon"><title>DuckDB rollups and temporary spill. Not authoritative telemetry.</title><svg width="32" height="32" viewBox="0 0 32 32" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_3427_35082111-d2-1108726992-OF2WK4TZON2GC5DF)">
+</g><g transform="translate(578 1846)" class="appendix-icon"><title>DuckDB rollups and temporary spill. Not authoritative telemetry.</title><svg width="32" height="32" viewBox="0 0 32 32" fill="none" xmlns="http://www.w3.org/2000/svg">
+<g clip-path="url(#clip0_3427_35082111-d2-2701310579-OF2WK4TZON2GC5DF)">
 <path d="M16 31.1109C24.3456 31.1109 31.1111 24.3454 31.1111 15.9998C31.1111 7.65415 24.3456 0.888672 16 0.888672C7.65436 0.888672 0.888885 7.65415 0.888885 15.9998C0.888885 24.3454 7.65436 31.1109 16 31.1109Z" fill="white" stroke="#DEE1EB"/>
 <path d="M16 26C21.5228 26 26 21.5228 26 16C26 10.4772 21.5228 6 16 6C10.4772 6 6 10.4772 6 16C6 21.5228 10.4772 26 16 26Z" stroke="#2E3346" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/>
 <path d="M16 19.998V15.998" stroke="#2E3346" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/>
 <path d="M16 12H16.0098" stroke="#2E3346" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/>
 </g>
 <defs>
-<clipPath id="clip0_3427_35082111-d2-1108726992-OF2WK4TZON2GC5DF">
+<clipPath id="clip0_3427_35082111-d2-2701310579-OF2WK4TZON2GC5DF">
 <rect width="32" height="32" fill="white"/>
 </clipPath>
 </defs>
 </svg>
-</g><mask id="d2-1108726992" maskUnits="userSpaceOnUse" x="-89" y="-89" width="1274" height="2176">
+</g><mask id="d2-2701310579" maskUnits="userSpaceOnUse" x="-89" y="-89" width="1274" height="2176">
 <rect x="-89" y="-89" width="1274" height="2176" fill="white"></rect>
 <rect x="379.000000" y="855.000000" width="235" height="21" fill="black"></rect>
 </mask></svg></svg>
diff --git a/docs/operations.md b/docs/operations.md
index d1cac7ca..55f78a0d 100644
--- a/docs/operations.md
+++ b/docs/operations.md
@@ -4,14 +4,136 @@ Fanout is one process and one persistent data directory. Operate those two
 things as a unit: preserve the directory, pin the binary or image version, and
 give ingest credentials only to trusted services and collectors.
 
+## Runtime secret delivery
+
+Runtime configuration uses built-in defaults followed by nonempty process
+environment values. Every setting requires a restart. Fanout reads no
+configuration document or dotenv file. Generated `.env.example` lists the
+settings as commented-out empty entries, with types, defaults, and secret file
+forms in comments. Copying the template sets nothing and preserves image ENV;
+uncomment only settings you want to supply. For development, `just run`
+loads optional ignored `./.env` with Node's native `parseEnv`; inherited values
+win, including empty values. Personal development credentials may live there.
+Personal environment files and operator profiles are excluded from Git and Docker.
+
+Custom names use `FANOUT_` plus a clear name, adding the area only when it
+clarifies. Vendor credentials and endpoints keep their documented names.
+Unknown `FANOUT_` names fail startup, except platform service-discovery names;
+unrelated names in shared vendor namespaces are ignored.
+
+### Environment and mounted secret files
+
+Deliver credentials through deployment environment injection or managed mounts.
+Every secret accepts either its value or its file path:
+
+| Value variable | File path variable |
+| --- | --- |
+| `FANOUT_AUTH_CODE_SECRET` | `FANOUT_AUTH_CODE_SECRET_FILE` |
+| `FANOUT_OIDC_CLIENT_SECRET` | `FANOUT_OIDC_CLIENT_SECRET_FILE` |
+| `FANOUT_SMTP_PASSWORD` | `FANOUT_SMTP_PASSWORD_FILE` |
+| `FANOUT_METRICS_TOKEN` | `FANOUT_METRICS_TOKEN_FILE` |
+| `ANTHROPIC_API_KEY` | `ANTHROPIC_API_KEY_FILE` |
+| `OPENAI_API_KEY` | `OPENAI_API_KEY_FILE` |
+
+Both forms nonempty fail startup. Fanout strips exactly one trailing LF or CRLF
+from file contents, then rejects an empty result. Errors identify the variable
+and path, never the contents. Fanout performs no file-mode check; the deployment
+controls mount access. Do not bake credentials into images or frontend bundles.
+
+For Docker, mount a provisioned secret and inject its path:
+
+```sh
+docker run --name fanout -p 7520:7520 \
+  -v fanout-data:/var/lib/fanout/data \
+  --mount type=bind,src="$AUTH_SECRET_PATH",dst=/run/secrets/auth_code,readonly \
+  -e FANOUT_AUTH_CODE_SECRET_FILE=/run/secrets/auth_code \
+  labstack/fanout:latest
+```
+
+The source secret must be readable by the image's UID 65532. In Compose, grant
+only the required secret to the service:
+
+```yaml
+services:
+  fanout:
+    image: labstack/fanout:latest
+    ports: ["7520:7520"]
+    volumes: ["fanout-data:/var/lib/fanout/data"]
+    environment:
+      FANOUT_AUTH_CODE_SECRET_FILE: /run/secrets/auth_code
+    secrets: [auth_code]
+secrets:
+  auth_code:
+    file: ${AUTH_SECRET_PATH}
+volumes:
+  fanout-data:
+```
+
+For Kubernetes, put ordinary settings in a ConfigMap and credentials in a
+Secret provisioned through your platform's secret manager. This Pod fragment
+injects both without putting credential values in the manifest:
+
+```yaml
+containers:
+  - name: fanout
+    image: labstack/fanout:latest
+    envFrom:
+      - configMapRef:
+          name: fanout-settings
+    env:
+      - name: FANOUT_AUTH_CODE_SECRET
+        valueFrom:
+          secretKeyRef:
+            name: fanout-credentials
+            key: auth_code_secret
+```
+
+Alternatively mount the Secret as files and set the corresponding `_FILE`
+paths. Use the existing persistent-volume and access policy for telemetry data.
+
+### SOPS runtime injection
+
+Use one authoritative SOPS-encrypted profile per actual workload/credential
+set, such as ignored `secrets/fanout.env`. Select a complete profile explicitly;
+never layer different credential sets or fall back on a missing profile.
+Platform-owned credentials remain platform-owned. This public repository ships
+no operator secrets, recipient policy, or decryption keys.
+
+With a provisioned SOPS key and existing encrypted profile, launch through
+[SOPS runtime injection](https://getsops.io/docs/usage/advanced/#passing-secrets-to-other-processes)
+without writing decrypted credentials to disk:
+
+```sh
+sops exec-env secrets/fanout.env './bin/fanout'
+# For local development with optional personal settings:
+sops exec-env secrets/fanout.env 'just run'
+```
+
+The profile supplies environment values to the child; ordinary settings may
+also come from deployment inputs. A dotenv parser neither decrypts SOPS nor
+resolves 1Password references. Verify synthetic values containing dollars,
+quotes, spaces, and newlines through the actual deployment parser before
+using a profile. Keep private age identities out of Git, restrict their
+local files to mode `0600`, and document key recovery in the existing 1Password
+item. 1Password holds recovery rather than a second maintained copy of
+SOPS-owned application secrets.
+
+AI chat is disabled by default. Select exactly `anthropic` or `openai` with
+`FANOUT_AI_PROVIDER`, then deliver its required `ANTHROPIC_API_KEY` or
+`OPENAI_API_KEY`. A selected provider without its key fails startup. Inherited
+keys never enable chat. Only the selected endpoint is validated and used.
+Overrides are `ANTHROPIC_BASE_URL` and `OPENAI_BASE_URL`; the OpenAI base
+includes `/v1`, while Anthropic's excludes it.
+
 ## Network surface
 
 | Default | Purpose | Exposure |
 |---|---|---|
-| `:7520` | Browser, API, MCP, health, metrics, OTLP/gRPC and OTLP/HTTP | Users, trusted services or a reverse proxy |
+| `127.0.0.1:7520` (native), `:7520` (image) | Browser, API, MCP, health, metrics, OTLP/gRPC and OTLP/HTTP | Users, trusted services or a reverse proxy |
 
-Both native and container deployments use one listener. Set
-`FANOUT_ADDR=127.0.0.1:7520` for loopback-only access. Every OTLP request
+Both native and container deployments use one listener. Native installs default
+to loopback; set `FANOUT_ADDR=:7520` for remote access. The image supplies
+`FANOUT_ADDR=:7520` and `FANOUT_DATA_DIR=/var/lib/fanout/data`. Every OTLP request
 requires the ingest token created during first-admin setup; browser sessions
 and MCP tokens do not authorize ingest. Do not embed the ingest token in a
 browser or shipped mobile application.
@@ -51,6 +173,15 @@ original host.
 
 ## Health and monitoring
 
+`fanout healthcheck` derives `/healthz` from `FANOUT_ADDR` or its built-in
+default. Empty, `0.0.0.0`, and `::` bind hosts become `127.0.0.1`.
+`FANOUT_TLS_CERT_FILE` selects HTTPS. Derived probes bypass environment proxies.
+HTTPS IP-literal probes trust only the configured certificate and verify its
+first DNS or IP SAN, which may differ from the bind IP; hostname probes verify
+normally. Healthcheck reads only these two settings and does not require valid
+secrets. An explicit `fanout healthcheck <url>` uses default proxy and
+certificate verification behaviour.
+
 - `/healthz` is the liveness check.
 - `/readyz` includes storage readiness and resolved runtime sizing.
 - `/metrics` exposes Prometheus metrics. Keep it private or configure
@@ -67,16 +198,6 @@ Fanout uses SQLite with the modernc driver, sqlc query bindings, and embedded
 Goose SQL migrations. Pending migrations run forward at startup. PostgreSQL
 and pgx are not required.
 
-This preview replaces the Atlas migration history with a fresh Goose baseline.
-Existing Atlas-managed control databases are unsupported; startup rejects them
-without converting or resetting their data. To start fresh, stop Fanout, back
-up the complete data directory, and move `data/control` aside (under your
-configured data directory). Startup creates a new control database. Complete
-first-admin setup again and reconfigure the ingest token, users, alert rules,
-and dashboards; prior sessions, OAuth grants, and agent history remain only in
-the saved control database. Telemetry and query files stay in place. Restore
-the saved directory with the previous binary if you need the previous state.
-
 ## Backup
 
 The supported portable baseline is a **cold backup** of the complete
@@ -112,44 +233,6 @@ Never recover an account by deleting its row from the control database; that
 cascades to sessions, OAuth grants, and owned dashboards. Use `fanout login-link
 <email>` as documented in [authentication.md](authentication.md).
 
-## Single-port migration
-
-This is a breaking configuration change:
-
-1. Remove `FANOUT_OTLP_GRPC_ADDR` and `FANOUT_OTLP_HTTP_ADDR`, or YAML
-   `ingest.otlp_grpc_addr` and `ingest.otlp_http_addr`. They are rejected at startup.
-2. Rename `FANOUT_HTTP_ADDR` to `FANOUT_ADDR`, or YAML `server.http_addr`
-   to `server.addr` (default `:7520`). Publish only that container port.
-3. Change exporters from ports `4317`/`4318` to `7520`, or to the public HTTPS
-   origin and port. The ingest token and OTLP signal paths do not change.
-4. Enable HTTP/2 backend forwarding for gRPC at any proxy. Remove obsolete
-   ingest port mappings and proxy upstreams. A separate ingest hostname may
-   still route to the same Fanout port if required by the edge configuration.
-5. Set `FANOUT_PUBLIC_URL` to the external origin so setup instructions start
-   with the reachable endpoint. If collectors use a different private hostname,
-   edit the endpoint on **Connect telemetry** before copying the configuration.
-   Remove `FANOUT_INGEST_ADVERTISED_ENDPOINT` or YAML
-   `ingest.advertised_endpoint`; these guidance-only settings are rejected.
-
-Local comparison results are in [the single-port benchmark report](benchmarks/single-port-2026-09-08.md).
-
-### Network isolation changes
-
-Ingest can no longer bind to a different interface from the application.
-For an internet-facing dashboard with LAN-only ingest, keep the backend port
-private and configure the public proxy to deny `/v1`, `/v1/*`, and the OTLP
-gRPC service paths under `/opentelemetry.proto.collector.*`. Allow collectors
-through the private network or an explicitly restricted proxy route. Verify
-that both OTLP transports are inaccessible through the public origin; the
-ingest token is still required on the private path.
-
-Single-port removes the need for a proxy solely to combine listeners. Splitting
-public application access from private ingest still requires network-aware
-routing. The mandatory default is deliberate for this pre-release product:
-there is one existing operator, so keeping two listener topologies would add
-configuration and testing costs without an installed compatibility base. The
-address rename is a separate breaking change, bundled into this migration.
-
 ## Upgrade and rollback
 
 1. Read the release notes and pin the target image tag or binary version.
@@ -169,7 +252,7 @@ SMTP is optional. Creating a local user without it succeeds and returns
 operator with access to the same configuration and data directory then runs:
 
 ```sh
-fanout --config /etc/fanout/fanout.yaml login-link user@example.com
+fanout login-link user@example.com
 ```
 
 The resulting link expires after 15 minutes, works once, and is recorded in the
diff --git a/fanout.docker.yaml b/fanout.docker.yaml
deleted file mode 100644
index ad49d6e6..00000000
--- a/fanout.docker.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-# One listener for the browser, API, MCP and both OTLP transports.
-# Runtime environment variables override these container defaults.
-server:
-  addr: ":7520"
-
-storage:
-  data_dir: /var/lib/fanout/data
diff --git a/fanout.example.yaml b/fanout.example.yaml
deleted file mode 100644
index 7b6a8053..00000000
--- a/fanout.example.yaml
+++ /dev/null
@@ -1,87 +0,0 @@
-# Fanout runtime configuration.
-#
-# Start with: fanout --config /path/to/fanout.yaml
-# Every value can be overridden by its documented FANOUT_ environment variable.
-# Secrets are intentionally omitted below; inject them through the environment
-# or add them to a suitably protected copy of this file.
-# Use YAML 1.2 true/false for booleans; yes/no/on/off are strings and rejected.
-# Null values (a key with nothing after the colon) are rejected.
-
-server:
-  addr: ":7520" # FANOUT_ADDR
-  public_url: "" # FANOUT_PUBLIC_URL
-  trusted_proxy_cidrs: "" # FANOUT_TRUSTED_PROXY_CIDRS
-  pprof_enabled: false # FANOUT_PPROF_ENABLED
-  tls:
-    cert_file: "" # FANOUT_TLS_CERT_FILE
-    key_file: "" # FANOUT_TLS_KEY_FILE
-
-ingest:
-  default_namespace: default # FANOUT_DEFAULT_NAMESPACE
-  batch_size: 50000 # FANOUT_INGEST_BATCH_SIZE
-  # Decoded telemetry held across concurrent requests before new ones are
-  # refused with a retryable status. 0 disables the ceiling.
-  max_in_flight_bytes: 268435456 # FANOUT_INGEST_MAX_IN_FLIGHT_BYTES
-
-storage:
-  data_dir: ./data # FANOUT_DATA_DIR
-  retention_days: 30 # FANOUT_RETENTION_DAYS
-  rollup_interval: 1m # FANOUT_ROLLUP_INTERVAL
-  rollup_skip_to_latest: false # FANOUT_ROLLUP_SKIP_TO_LATEST
-  maintenance_interval: 1h # FANOUT_MAINTENANCE_INTERVAL
-  duckdb:
-    # Empty/zero values let Fanout size these from the machine.
-    memory: "" # FANOUT_DUCKDB_MEMORY
-    threads: 0 # FANOUT_DUCKDB_THREADS
-    max_connections: 0 # FANOUT_DUCKDB_MAX_CONNECTIONS
-
-alerts:
-  enabled: true # FANOUT_ALERTS_ENABLED
-  evaluation_interval: 30s # FANOUT_ALERTS_EVALUATION_INTERVAL
-  history_days: 7 # FANOUT_ALERTS_HISTORY_DAYS
-
-ai:
-  provider: anthropic # FANOUT_AI_PROVIDER
-  model: "" # FANOUT_AI_MODEL
-  base_url: "" # FANOUT_AI_BASE_URL
-  # Optional; enables investigation chat: FANOUT_AI_API_KEY
-  # api_key: ""
-
-smtp:
-  host: "" # FANOUT_SMTP_HOST
-  port: 587 # FANOUT_SMTP_PORT
-  username: "" # FANOUT_SMTP_USERNAME
-  from: "" # FANOUT_SMTP_FROM
-  # Optional with the other SMTP fields; enables email-code login: FANOUT_SMTP_PASSWORD
-  # password: ""
-
-auth:
-  mode: local # FANOUT_AUTH_MODE
-  session_idle_ttl: 12h # FANOUT_SESSION_IDLE_TTL
-  session_absolute_ttl: 168h # FANOUT_SESSION_ABSOLUTE_TTL
-  # Required in local auth mode: FANOUT_AUTH_CODE_SECRET (32+ characters)
-  # code_secret: ""
-  # Allow verified email addresses to create viewer accounts.
-  self_signup: false # FANOUT_SELF_SIGNUP
-  oidc:
-    issuer_url: "" # FANOUT_OIDC_ISSUER_URL
-    client_id: "" # FANOUT_OIDC_CLIENT_ID
-    email_claim: email # FANOUT_OIDC_EMAIL_CLAIM
-    email_verification: required # FANOUT_OIDC_EMAIL_VERIFICATION
-    auto_provision: false # FANOUT_OIDC_AUTO_PROVISION
-    allowed_groups: "" # FANOUT_OIDC_ALLOWED_GROUPS
-    # Use "*" only with email_verification: required to admit any verified identity.
-    allowed_domains: "" # FANOUT_OIDC_ALLOWED_DOMAINS
-    default_role: viewer # FANOUT_OIDC_DEFAULT_ROLE
-    operator_groups: "" # FANOUT_OIDC_OPERATOR_GROUPS
-    admin_groups: "" # FANOUT_OIDC_ADMIN_GROUPS
-    # Required in OIDC mode: FANOUT_OIDC_CLIENT_SECRET
-    # client_secret: ""
-
-metrics:
-  public: false # FANOUT_METRICS_PUBLIC
-  # Optional bearer token: FANOUT_METRICS_TOKEN
-  # token: ""
-
-mcp:
-  enabled: true # FANOUT_MCP_ENABLED
diff --git a/go.mod b/go.mod
index e8fa1808..1a85b188 100644
--- a/go.mod
+++ b/go.mod
@@ -9,14 +9,9 @@ require (
 	github.com/alexedwards/scs/v2 v2.9.0
 	github.com/coreos/go-oidc/v3 v3.21.0
 	github.com/duckdb/duckdb-go/v2 v2.10506.0
-	github.com/go-viper/mapstructure/v2 v2.5.0
 	github.com/golang-jwt/jwt/v5 v5.3.1
 	github.com/google/jsonschema-go v0.4.3
 	github.com/google/uuid v1.6.0
-	github.com/knadh/koanf/parsers/yaml v1.1.1
-	github.com/knadh/koanf/providers/confmap v1.0.1
-	github.com/knadh/koanf/providers/file v1.2.1
-	github.com/knadh/koanf/v2 v2.3.7
 	github.com/labstack/echo/v5 v5.4.0
 	github.com/modelcontextprotocol/go-sdk v1.8.0
 	github.com/parquet-go/parquet-go v0.32.0
@@ -50,19 +45,16 @@ require (
 	github.com/duckdb/duckdb-go-bindings/lib/linux-arm64 v0.10506.0 // indirect
 	github.com/duckdb/duckdb-go-bindings/lib/windows-amd64 v0.10506.0 // indirect
 	github.com/dustin/go-humanize v1.1.0 // indirect
-	github.com/fsnotify/fsnotify v1.10.1 // indirect
 	github.com/go-jose/go-jose/v4 v4.1.5 // indirect
+	github.com/go-viper/mapstructure/v2 v2.5.0 // indirect
 	github.com/goccy/go-json v0.11.2 // indirect
 	github.com/google/flatbuffers v25.12.19+incompatible // indirect
 	github.com/grpc-ecosystem/grpc-gateway/v2 v2.31.0 // indirect
 	github.com/klauspost/compress v1.20.1 // indirect
 	github.com/klauspost/cpuid/v2 v2.4.0 // indirect
-	github.com/knadh/koanf/maps v0.1.3 // indirect
 	github.com/kylelemons/godebug v1.1.0 // indirect
 	github.com/mattn/go-isatty v0.0.24 // indirect
 	github.com/mfridman/interpolate v0.0.2 // indirect
-	github.com/mitchellh/copystructure v1.2.0 // indirect
-	github.com/mitchellh/reflectwalk v1.0.2 // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
 	github.com/ncruces/go-strftime v1.1.0 // indirect
 	github.com/parquet-go/bitpack v1.1.0 // indirect
diff --git a/go.sum b/go.sum
index 742ca040..f1edba6e 100644
--- a/go.sum
+++ b/go.sum
@@ -42,8 +42,6 @@ github.com/duckdb/duckdb-go/v2 v2.10506.0 h1:mcZjUQ/kSNeZdtGCqyj5/JEDUdj7/kvILfI
 github.com/duckdb/duckdb-go/v2 v2.10506.0/go.mod h1:6pLO+4GMcb0q36+z+RlQ7h+MMxum1lL0eAVf4GsPAxs=
 github.com/dustin/go-humanize v1.1.0 h1:dbKTrvD0klcbBV/h4AWJdMuZogJACoMlvWIWZ5b2xWg=
 github.com/dustin/go-humanize v1.1.0/go.mod h1:hc1CvRkJMsgxqjmjMQF3QNRAZBwY8AXBAzKYoSX9sFI=
-github.com/fsnotify/fsnotify v1.10.1 h1:b0/UzAf9yR5rhf3RPm9gf3ehBPpf0oZKIjtpKrx59Ho=
-github.com/fsnotify/fsnotify v1.10.1/go.mod h1:TLheqan6HD6GBK6PrDWyDPBaEV8LspOxvPSjC+bVfgo=
 github.com/go-jose/go-jose/v4 v4.1.5 h1:RjgjO2LOtWOJKUC5wpwY9LR3B3vwVAz6JS2YHfYU6eA=
 github.com/go-jose/go-jose/v4 v4.1.5/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08=
 github.com/go-viper/mapstructure/v2 v2.5.0 h1:vM5IJoUAy3d7zRSVtIwQgBj7BiWtMPfmPEgAXnvj1Ro=
@@ -75,16 +73,6 @@ github.com/klauspost/compress v1.20.1 h1:T7kKElXUMXrUJ2E9QhQhxFtcK5rPyLdsGZvdbLM
 github.com/klauspost/compress v1.20.1/go.mod h1:LUdAzn7YLVvxLpc7y3V1m40wESHTgc1422pwwBSKYuI=
 github.com/klauspost/cpuid/v2 v2.4.0 h1:S6Hrbc7+ywsr0r+RLapfGBHfyefhCTwEh3A0tV913Dw=
 github.com/klauspost/cpuid/v2 v2.4.0/go.mod h1:19jmZ9mjzoF//ddRSUsv0zfBTJWh3QJh9FNxZTMrGxU=
-github.com/knadh/koanf/maps v0.1.3 h1:P1z7EvTqdFBrPYbzSvorvrpib+sjkUMxf0FVvA5NKK4=
-github.com/knadh/koanf/maps v0.1.3/go.mod h1:npD/QZY3V6ghQDdcQzl1W4ICNVTkohC8E73eI2xW4yI=
-github.com/knadh/koanf/parsers/yaml v1.1.1 h1:u70vV5IyaM0HvONh8HoqBC97oTgO33KcpZbTLiKVinU=
-github.com/knadh/koanf/parsers/yaml v1.1.1/go.mod h1:HHmcHXUrp9cOPcuC+2wrr44GTUB0EC+PyfN3HZD9tFg=
-github.com/knadh/koanf/providers/confmap v1.0.1 h1:L15hbvMqlvhwUuCtL9BkL+rqiMAjk6cZc8O9XoDtE3A=
-github.com/knadh/koanf/providers/confmap v1.0.1/go.mod h1:txHYHiI2hAtF0/0sCmcuol4IDcuQbKTybiB1nOcUo1A=
-github.com/knadh/koanf/providers/file v1.2.1 h1:bEWbtQwYrA+W2DtdBrQWyXqJaJSG3KrP3AESOJYp9wM=
-github.com/knadh/koanf/providers/file v1.2.1/go.mod h1:bp1PM5f83Q+TOUu10J/0ApLBd9uIzg+n9UgthfY+nRA=
-github.com/knadh/koanf/v2 v2.3.7 h1:amceufOeoQcq6VFKjm7/ggJ3t0Dkqaxy5fza4j3YgTA=
-github.com/knadh/koanf/v2 v2.3.7/go.mod h1:gRb40VRAbd4iJMYYD5IxZ6hfuopFcXBpc9bbQpZwo28=
 github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0SNc=
 github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw=
 github.com/labstack/echo/v5 v5.4.0 h1:iY674460IvSmUcj7MziL3YrgyTClghz5BpdZoKiGxR4=
@@ -93,10 +81,6 @@ github.com/mattn/go-isatty v0.0.24 h1:tGZZoVgT/KiqK1c8ocVLeDS8BSWMRd47J3Lbz7vsRe
 github.com/mattn/go-isatty v0.0.24/go.mod h1:nMCL3Zebbrt45jsMDgnfIwz6ydEQApk5oEI3HqDio6A=
 github.com/mfridman/interpolate v0.0.2 h1:pnuTK7MQIxxFz1Gr+rjSIx9u7qVjf5VOoM/u6BbAxPY=
 github.com/mfridman/interpolate v0.0.2/go.mod h1:p+7uk6oE07mpE/Ik1b8EckO0O4ZXiGAfshKBWLUM9Xg=
-github.com/mitchellh/copystructure v1.2.0 h1:vpKXTN4ewci03Vljg/q9QvCGUDttBOGBIa15WveJJGw=
-github.com/mitchellh/copystructure v1.2.0/go.mod h1:qLl+cE2AmVv+CoeAwDPye/v+N2HKCj9FbZEVFJRxO9s=
-github.com/mitchellh/reflectwalk v1.0.2 h1:G2LzWKi524PWgd3mLHV8Y5k7s6XUvT0Gef6zxSIeXaQ=
-github.com/mitchellh/reflectwalk v1.0.2/go.mod h1:mSTlrgnPZtwu0c4WaC2kGObEpuNDbx0jmZXqmk4esnw=
 github.com/modelcontextprotocol/go-sdk v1.8.0 h1:KIvahhYqwtbeniWVPs3TcXEA7b8jEtwfBpOTAI+Urx4=
 github.com/modelcontextprotocol/go-sdk v1.8.0/go.mod h1:dL7u98E/zjJTGzEq+j30jQ8K2k1mb6LeAH4inEcSGts=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
diff --git a/internal/agent/provider_contract_test.go b/internal/agent/provider_contract_test.go
index 2e62b9b3..25306982 100644
--- a/internal/agent/provider_contract_test.go
+++ b/internal/agent/provider_contract_test.go
@@ -55,8 +55,8 @@ func TestOpenAIOutputItemsReplayVerbatim(t *testing.T) {
 	// Test request replay independently of parser failures: retained output must
 	// replace rebuilt text/calls and calls without executed results must vanish.
 	unsafe := json.RawMessage(`{"type":"function_call","call_id":"not_executed","name":"status","arguments":"{}"}`)
-	body := captureRequestBody(t, lines(`data: {"type":"response.completed","response":{}}`), func(url string) error {
-		p, err := NewProvider("openai", "test", "", url)
+	body := captureRequestBody(t, lines(`data: {"type":"response.completed","response":{}}`), "/v1/responses", func(url string) error {
+		p, err := NewProvider("openai", "test", "", url+"/v1")
 		if err != nil {
 			return err
 		}
@@ -134,13 +134,13 @@ func TestOpenAIEncryptedContentConfigurationError(t *testing.T) {
 		_, _ = io.WriteString(w, `{"error":{"message":"reasoning.encrypted_content is unsupported by this model"}}`)
 	}))
 	defer server.Close()
-	p, err := NewProvider("openai", "test", "custom-model", server.URL)
+	p, err := NewProvider("openai", "test", "custom-model", server.URL+"/v1")
 	if err != nil {
 		t.Fatal(err)
 	}
 	err = p.Stream(context.Background(), StreamParams{}, func(StreamEvent) error { return nil })
 	var apiErr *APIError
-	if err == nil || !strings.Contains(err.Error(), "reasoning model") || !strings.Contains(err.Error(), "ai.model") || !errors.As(err, &apiErr) || apiErr.StatusCode != 400 {
+	if err == nil || !strings.Contains(err.Error(), "reasoning model") || !strings.Contains(err.Error(), "FANOUT_AI_MODEL") || !errors.As(err, &apiErr) || apiErr.StatusCode != 400 {
 		t.Errorf("configuration error = %v", err)
 	}
 	if got := clientErrorMessage(err); got != "Fanout could not reach the model provider. Please try again." {
@@ -149,8 +149,8 @@ func TestOpenAIEncryptedContentConfigurationError(t *testing.T) {
 }
 
 func TestNewProviderNewestDefaults(t *testing.T) {
-	for _, kind := range []string{"", "anthropic", "openai"} {
-		p, err := NewProvider(kind, "test", "", "")
+	for _, kind := range []string{"anthropic", "openai"} {
+		p, err := NewProvider(kind, "test", "", "https://provider.example/gateway")
 		if err != nil {
 			t.Fatal(err)
 		}
@@ -167,6 +167,14 @@ func TestNewProviderNewestDefaults(t *testing.T) {
 	}
 }
 
+func TestNewProviderRejectsUnsupportedNames(t *testing.T) {
+	for _, kind := range []string{"", "OpenAI", " OpenAI ", " openai ", "Anthropic", "unsupported"} {
+		if _, err := NewProvider(kind, "test", "", "https://provider.example"); err == nil {
+			t.Errorf("provider %q must be rejected", kind)
+		}
+	}
+}
+
 func TestAnthropicCacheBreakpoints(t *testing.T) {
 	for _, finalRole := range []Role{RoleUser, RoleTool} {
 		t.Run(string(finalRole), func(t *testing.T) {
@@ -176,7 +184,7 @@ func TestAnthropicCacheBreakpoints(t *testing.T) {
 			} else {
 				messages = append(messages, ProviderMessage{Role: RoleTool, ToolResult: &ToolResult{ToolCallID: "b", Content: "last"}})
 			}
-			body := captureRequestBody(t, lines(`data: {"type":"message_delta","delta":{"stop_reason":"end_turn"}}`), func(url string) error {
+			body := captureRequestBody(t, lines(`data: {"type":"message_delta","delta":{"stop_reason":"end_turn"}}`), "/v1/messages", func(url string) error {
 				p, err := NewProvider("anthropic", "test", "", url)
 				if err != nil {
 					return err
@@ -268,7 +276,7 @@ func TestRuntimeOpenAITerminalNotices(t *testing.T) {
 		t.Run(tc.name, func(t *testing.T) {
 			server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) { _, _ = io.WriteString(w, tc.sse) }))
 			defer server.Close()
-			p, err := NewProvider("openai", "test", "", server.URL)
+			p, err := NewProvider("openai", "test", "", server.URL+"/v1")
 			if err != nil {
 				t.Fatal(err)
 			}
diff --git a/internal/agent/provider_http.go b/internal/agent/provider_http.go
index 3af87726..d634db5e 100644
--- a/internal/agent/provider_http.go
+++ b/internal/agent/provider_http.go
@@ -15,23 +15,17 @@ import (
 )
 
 func NewProvider(kind, apiKey, model, baseURL string) (Provider, error) {
-	switch strings.ToLower(strings.TrimSpace(kind)) {
-	case "", "anthropic":
+	switch kind {
+	case "anthropic":
 		if model == "" {
 			model = "claude-sonnet-5-5"
 		}
-		if baseURL == "" {
-			baseURL = "https://api.anthropic.com"
-		}
-		return &anthropicProvider{apiKey: apiKey, model: model, baseURL: strings.TrimRight(baseURL, "/"), client: modelHTTPClient()}, nil
+		return &anthropicProvider{apiKey: apiKey, model: model, baseURL: baseURL, client: modelHTTPClient()}, nil
 	case "openai":
 		if model == "" {
 			model = "gpt-6.1-sol"
 		}
-		if baseURL == "" {
-			baseURL = "https://api.openai.com"
-		}
-		return &openAIProvider{apiKey: apiKey, model: model, baseURL: strings.TrimRight(baseURL, "/"), client: modelHTTPClient()}, nil
+		return &openAIProvider{apiKey: apiKey, model: model, baseURL: baseURL, client: modelHTTPClient()}, nil
 	default:
 		return nil, fmt.Errorf("unsupported AI provider %q", kind)
 	}
@@ -106,11 +100,11 @@ func (p *openAIProvider) Stream(ctx context.Context, params StreamParams, cb fun
 		}
 		body["tools"] = tools
 	}
-	response, err := postModel(ctx, p.client, p.baseURL+"/v1/responses", p.apiKey, "openai", body)
+	response, err := postModel(ctx, p.client, p.baseURL+"/responses", p.apiKey, "openai", body)
 	if err != nil {
 		var apiErr *APIError
 		if errors.As(err, &apiErr) && apiErr.StatusCode == http.StatusBadRequest && strings.Contains(strings.ToLower(apiErr.Body), "encrypted") {
-			return fmt.Errorf("OpenAI configuration error: ai.model must select a reasoning model supporting reasoning.encrypted_content (default gpt-6.1-sol): %w", err)
+			return fmt.Errorf("OpenAI configuration error: FANOUT_AI_MODEL must select a reasoning model supporting reasoning.encrypted_content (default gpt-6.1-sol): %w", err)
 		}
 		return err
 	}
diff --git a/internal/agent/provider_http_test.go b/internal/agent/provider_http_test.go
index 8bf0079c..04feac58 100644
--- a/internal/agent/provider_http_test.go
+++ b/internal/agent/provider_http_test.go
@@ -12,6 +12,7 @@ import (
 	"testing"
 
 	agtypes "github.com/ag-ui-protocol/ag-ui/sdks/community/go/pkg/core/types"
+	"github.com/labstack/fanout/internal/config"
 )
 
 // lines joins SSE lines with \n.
@@ -19,6 +20,39 @@ func lines(ss ...string) string {
 	return strings.Join(ss, "\n") + "\n"
 }
 
+func TestProviderBaseURLPreservesGatewayPath(t *testing.T) {
+	for _, tc := range []struct {
+		provider, basePath, requestPath, response string
+	}{
+		{"openai", "/gateway/v1", "/gateway/v1/responses", lines(`data: {"type":"response.completed","response":{}}`)},
+		{"anthropic", "/gateway", "/gateway/v1/messages", lines(`data: {"type":"message_delta","delta":{"stop_reason":"end_turn"}}`, `data: {"type":"message_stop"}`)},
+	} {
+		for _, slash := range []string{"", "/"} {
+			t.Run(tc.provider+slash, func(t *testing.T) {
+				server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+					if r.Method != http.MethodPost || r.URL.Path != tc.requestPath {
+						t.Errorf("request = %s %s, want POST %s", r.Method, r.URL.Path, tc.requestPath)
+					}
+					if tc.provider == "openai" && r.Header.Get("Authorization") != "Bearer test-key" || tc.provider == "anthropic" && r.Header.Get("X-Api-Key") != "test-key" {
+						t.Error("provider credential was not mapped to the correct header")
+					}
+					w.Header().Set("Content-Type", "text/event-stream")
+					_, _ = io.WriteString(w, tc.response)
+				}))
+				defer server.Close()
+				cfg := config.Config{AIProvider: tc.provider, AnthropicBaseURL: server.URL + tc.basePath + slash, OpenAIBaseURL: server.URL + tc.basePath + slash}
+				p, err := NewProvider(tc.provider, "test-key", "", cfg.AIBaseURL())
+				if err != nil {
+					t.Fatal(err)
+				}
+				if err := p.Stream(context.Background(), StreamParams{}, func(StreamEvent) error { return nil }); err != nil {
+					t.Fatal(err)
+				}
+			})
+		}
+	}
+}
+
 // collect runs a parser over SSE input and buckets the emitted events.
 func collect(t *testing.T, parse func(io.Reader, func(StreamEvent) error) error, input string) (texts []string, toolCalls []ToolCall, stopReasons []string, errs []string, parseErr error) {
 	t.Helper()
@@ -53,7 +87,7 @@ func openAIStream(t *testing.T) func(io.Reader, func(StreamEvent) error) error {
 			_, _ = io.Copy(w, reader)
 		}))
 		defer server.Close()
-		provider := &openAIProvider{apiKey: "sk-test", model: "gpt-6.1-sol", baseURL: server.URL, client: server.Client()}
+		provider := &openAIProvider{apiKey: "sk-test", model: "gpt-6.1-sol", baseURL: server.URL + "/v1", client: server.Client()}
 		return provider.Stream(context.Background(), StreamParams{}, cb)
 	}
 }
@@ -317,10 +351,13 @@ func TestParseAnthropicSkipsNonDataLines(t *testing.T) {
 
 // captureRequestBody serves one canned SSE response and returns the decoded
 // request body the provider sent.
-func captureRequestBody(t *testing.T, sseBody string, run func(baseURL string) error) map[string]any {
+func captureRequestBody(t *testing.T, sseBody, requestPath string, run func(baseURL string) error) map[string]any {
 	t.Helper()
 	var body map[string]any
 	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path != requestPath {
+			t.Errorf("request path = %q, want %q", r.URL.Path, requestPath)
+		}
 		if err := json.NewDecoder(r.Body).Decode(&body); err != nil {
 			t.Errorf("decode request body: %v", err)
 		}
@@ -335,8 +372,8 @@ func captureRequestBody(t *testing.T, sseBody string, run func(baseURL string) e
 }
 
 func TestOpenAIResponsesRequestBodyShape(t *testing.T) {
-	body := captureRequestBody(t, lines(`data: {"type":"response.completed","response":{}}`), func(baseURL string) error {
-		provider, err := NewProvider("openai", "sk-test", "", baseURL+"/")
+	body := captureRequestBody(t, lines(`data: {"type":"response.completed","response":{}}`), "/v1/responses", func(baseURL string) error {
+		provider, err := NewProvider("openai", "sk-test", "", baseURL+"/v1")
 		if err != nil {
 			return err
 		}
@@ -414,7 +451,7 @@ func TestOpenAIResponsesReasoningReplayWithinRun(t *testing.T) {
 		}
 	}))
 	defer server.Close()
-	provider := &openAIProvider{apiKey: "sk-test", model: "gpt-6.1-sol", baseURL: server.URL, client: server.Client()}
+	provider := &openAIProvider{apiKey: "sk-test", model: "gpt-6.1-sol", baseURL: server.URL + "/v1", client: server.Client()}
 	runtime := NewRuntime(provider, &fakeTools{execution: ToolExecution{Content: `{"ok":true}`}}, nil)
 	emitter, output := newTestEmitter()
 	messages := []agtypes.Message{{ID: "user-1", Role: agtypes.RoleUser, Content: "status?"}}
@@ -459,7 +496,7 @@ func TestAnthropicRequestBodyShape(t *testing.T) {
 		`data: {"type":"content_block_delta","index":0,"delta":{"type":"text_delta","text":"ok"}}`,
 		`data: {"type":"message_delta","delta":{"stop_reason":"end_turn"}}`,
 	)
-	body := captureRequestBody(t, sseBody, func(baseURL string) error {
+	body := captureRequestBody(t, sseBody, "/v1/messages", func(baseURL string) error {
 		provider := &anthropicProvider{apiKey: "sk-test", model: "claude-sonnet-5-5", baseURL: baseURL, client: http.DefaultClient}
 		params := StreamParams{
 			System: "be helpful",
diff --git a/internal/api/health_test.go b/internal/api/health_test.go
index 02ce36b3..f6b407f0 100644
--- a/internal/api/health_test.go
+++ b/internal/api/health_test.go
@@ -78,7 +78,7 @@ func TestReadiness_NilDuck(t *testing.T) {
 func TestReadinessReportsSizingResolvedByLoader(t *testing.T) {
 	environ := []string{
 		"FANOUT_AUTH_CODE_SECRET=0123456789abcdef0123456789abcdef",
-		"FANOUT_AI_API_KEY=sk-test",
+		"ANTHROPIC_API_KEY=sk-test",
 		"FANOUT_SMTP_HOST=smtp.example.com",
 		"FANOUT_SMTP_USERNAME=user",
 		"FANOUT_SMTP_PASSWORD=pass",
diff --git a/internal/api/oauth.go b/internal/api/oauth.go
index 4f2b7bc3..eb5909a7 100644
--- a/internal/api/oauth.go
+++ b/internal/api/oauth.go
@@ -71,7 +71,7 @@ func NewMCPAuthorization(store *appauth.OAuthStore, users *appauth.UserStore, re
 		// registration). Bound how many clients one source can create before
 		// the janitor collects the abandoned ones. The budget is per client
 		// IP, which collapses to one bucket when Fanout sits behind a proxy
-		// and server.trusted_proxy_cidrs is unset, so it is set well above a
+		// and FANOUT_TRUSTED_PROXY_CIDRS is unset, so it is set well above a
 		// plausible team rollout rather than at the tightest defensible value.
 		registerLimiter: appauth.NewKeyedLimiter(60, 15*time.Minute),
 	}, nil
diff --git a/internal/config/config.go b/internal/config/config.go
index 54ed8cbb..818cd965 100644
--- a/internal/config/config.go
+++ b/internal/config/config.go
@@ -14,43 +14,79 @@ import (
 
 const maxIngestBatchSize = 50_000
 
-// Config is Fanout's canonical configuration schema. Public names use
-// FANOUT_ plus the shortest stable term that is clear in a docker run, and the
-// same terminology across YAML, environment variables, Go, logs, and docs.
+const (
+	DefaultAddr             = "127.0.0.1:7520"
+	DefaultAnthropicBaseURL = "https://api.anthropic.com"
+	DefaultOpenAIBaseURL    = "https://api.openai.com/v1"
+)
+
+type providerSettings struct {
+	keyEnv, baseURLEnv, defaultBaseURL string
+	key, baseURL                       func(Config) string
+}
+
+var providers = map[string]providerSettings{
+	"anthropic": {
+		keyEnv: "ANTHROPIC_API_KEY", baseURLEnv: "ANTHROPIC_BASE_URL", defaultBaseURL: DefaultAnthropicBaseURL,
+		key: func(c Config) string { return c.AnthropicAPIKey }, baseURL: func(c Config) string { return c.AnthropicBaseURL },
+	},
+	"openai": {
+		keyEnv: "OPENAI_API_KEY", baseURLEnv: "OPENAI_BASE_URL", defaultBaseURL: DefaultOpenAIBaseURL,
+		key: func(c Config) string { return c.OpenAIAPIKey }, baseURL: func(c Config) string { return c.OpenAIBaseURL },
+	},
+}
+
+func providerForEnvironment(name string) string {
+	for provider, settings := range providers {
+		if name == settings.keyEnv || name == settings.baseURLEnv {
+			return provider
+		}
+	}
+	return ""
+}
+
+// Config is Fanout's canonical configuration schema. Custom environment names
+// use FANOUT_; provider credentials and endpoints use their vendor's names.
 // Elapsed-time settings use time.Duration with unit-bearing values.
 type Config struct {
 	// Addr binds the browser, API, MCP, OTLP/gRPC and OTLP/HTTP listener.
-	Addr            string `koanf:"server.addr" env:"FANOUT_ADDR" default:":7520"`
-	DataDir         string `koanf:"storage.data_dir" env:"FANOUT_DATA_DIR" default:"./data"`
-	IngestBatchSize int    `koanf:"ingest.batch_size" env:"FANOUT_INGEST_BATCH_SIZE" default:"50000"`
+	Addr string `group:"server" env:"FANOUT_ADDR" default:"127.0.0.1:7520"`
+	// DataDir stores telemetry, query state, and the control database.
+	DataDir string `group:"storage" env:"FANOUT_DATA_DIR" default:"./data"`
+	// IngestBatchSize limits telemetry rows per batch; valid values are 1–50000.
+	IngestBatchSize int `group:"ingest" env:"FANOUT_INGEST_BATCH_SIZE" default:"50000"`
 	// IngestMaxInFlightBytes caps the decoded telemetry the process will hold
 	// across concurrent requests. Concurrency is HTTP/2 streams times
 	// connections and each handler holds its batch until the commit is
 	// durable, so without a ceiling a burst is bounded only by memory. Zero is
 	// unbounded, which is the behaviour that predates this setting.
-	IngestMaxInFlightBytes int           `koanf:"ingest.max_in_flight_bytes" env:"FANOUT_INGEST_MAX_IN_FLIGHT_BYTES" default:"268435456"`
-	RollupInterval         time.Duration `koanf:"storage.rollup_interval" env:"FANOUT_ROLLUP_INTERVAL" default:"1m"`
-	MCPEnabled             bool          `koanf:"mcp.enabled" env:"FANOUT_MCP_ENABLED" default:"true"`
-	RetentionDays          int           `koanf:"storage.retention_days" env:"FANOUT_RETENTION_DAYS" default:"30"`
+	IngestMaxInFlightBytes int `group:"ingest" env:"FANOUT_INGEST_MAX_IN_FLIGHT_BYTES" default:"268435456"`
+	// RollupInterval schedules analytical rollups; use a Go duration of at least 1s.
+	RollupInterval time.Duration `group:"storage" env:"FANOUT_ROLLUP_INTERVAL" default:"1m"`
+	// MCPEnabled serves the MCP endpoint at /mcp.
+	MCPEnabled bool `group:"mcp" env:"FANOUT_MCP_ENABLED" default:"true"`
+	// RetentionDays sets telemetry retention in days; zero disables expiry.
+	RetentionDays int `group:"storage" env:"FANOUT_RETENTION_DAYS" default:"30"`
 	// MaintenanceInterval controls Parquet retention and compaction, and
 	// query-cache checkpointing.
-	MaintenanceInterval time.Duration `koanf:"storage.maintenance_interval" env:"FANOUT_MAINTENANCE_INTERVAL" default:"1h"`
+	MaintenanceInterval time.Duration `group:"storage" env:"FANOUT_MAINTENANCE_INTERVAL" default:"1h"`
 	// RollupSkipToLatest, set once at boot, advances the service and edge rollup
 	// watermarks to the current max ingested timestamp. Existing history is not
 	// aggregated into those analytical rollups. Completed-batch trace caches
 	// still rebuild all retained history in bounded passes;
 	// uncached files remain immediately queryable. Useful for large pre-seeded
 	// datasets (benchmarks, restores); off in normal operation.
-	RollupSkipToLatest bool   `koanf:"storage.rollup_skip_to_latest" env:"FANOUT_ROLLUP_SKIP_TO_LATEST" default:"false"`
-	DefaultNamespace   string `koanf:"ingest.default_namespace" env:"FANOUT_DEFAULT_NAMESPACE" default:"default"`
+	RollupSkipToLatest bool `group:"storage" env:"FANOUT_ROLLUP_SKIP_TO_LATEST" default:"false"`
+	// DefaultNamespace supplies the namespace for telemetry without one.
+	DefaultNamespace string `group:"ingest" env:"FANOUT_DEFAULT_NAMESPACE" default:"default"`
 	// PprofEnabled exposes Go's net/http/pprof handlers at /debug/pprof/* for
 	// CPU/heap/mutex/goroutine profiling under load. Off by default; the routes
 	// require an admin browser session with operations:read.
-	PprofEnabled bool `koanf:"server.pprof_enabled" env:"FANOUT_PPROF_ENABLED" default:"false"`
+	PprofEnabled bool `group:"server" env:"FANOUT_PPROF_ENABLED" default:"false"`
 	// The DuckDB knobs below self-size where possible and otherwise default to
 	// values validated on the reference deployment target, a small shared VM
 	// (Hetzner CPX32: 4 vCPU, 8 GB RAM, 160 GB disk). There the self-sizing
-	// resolves to a ~6.4 GB memory cap and 4 query threads (deterministic from
+	// resolves to a ~4.8 GB memory cap and 4 query threads (deterministic from
 	// 8 GB / 4 vCPU). Measure the target host with the external fanout-bench
 	// harness before setting
 	// production limits; throughput and memory use vary with CPU, disk, and the
@@ -66,57 +102,98 @@ type Config struct {
 	// resolveSizing. DuckDB's own default is 80% of detected RAM, which is
 	// calculated as though DuckDB owned the machine and has been observed to
 	// get the process OOM-killed once the Go heap is added on top.
-	DuckDBMemory string `koanf:"storage.duckdb.memory" env:"FANOUT_DUCKDB_MEMORY"`
+	DuckDBMemory string `group:"storage" env:"FANOUT_DUCKDB_MEMORY"`
 	// DuckDBThreads caps DuckDB's global query worker pool. Zero leaves
 	// DuckDB's own default in place (one worker per core). Set it to leave
 	// cores free for ingest on a query-heavy co-tenant host.
-	DuckDBThreads int `koanf:"storage.duckdb.threads" env:"FANOUT_DUCKDB_THREADS"`
+	DuckDBThreads int `group:"storage" env:"FANOUT_DUCKDB_THREADS"`
 	// DuckDBMaxConns caps the DuckDB connection pool. Reads scan immutable Parquet
 	// concurrently; rollup-cache writes are serialized by the query write gate.
 	// Zero means "size it from the machine" — the same spelling DuckDBThreads
 	// uses for deferring to a default. Resolution happens in resolveSizing and
 	// is reported in the startup configuration log.
-	DuckDBMaxConns          int           `koanf:"storage.duckdb.max_connections" env:"FANOUT_DUCKDB_MAX_CONNECTIONS" default:"0"`
-	AlertEnabled            bool          `koanf:"alerts.enabled" env:"FANOUT_ALERTS_ENABLED" default:"true"`
-	AlertEvaluationInterval time.Duration `koanf:"alerts.evaluation_interval" env:"FANOUT_ALERTS_EVALUATION_INTERVAL" default:"30s"`
-	AlertHistoryDays        int           `koanf:"alerts.history_days" env:"FANOUT_ALERTS_HISTORY_DAYS" default:"7"`
-	AIProvider              string        `koanf:"ai.provider" env:"FANOUT_AI_PROVIDER" default:"anthropic"`
-	AIAPIKey                string        `koanf:"ai.api_key" env:"FANOUT_AI_API_KEY" secret:"true"`
+	DuckDBMaxConns int `group:"storage" env:"FANOUT_DUCKDB_MAX_CONNECTIONS" default:"0"`
+	// AlertEnabled runs the alert evaluation engine.
+	AlertEnabled bool `group:"alerts" env:"FANOUT_ALERTS_ENABLED" default:"true"`
+	// AlertEvaluationInterval schedules alert evaluation; use a Go duration of at least 1s.
+	AlertEvaluationInterval time.Duration `group:"alerts" env:"FANOUT_ALERTS_EVALUATION_INTERVAL" default:"30s"`
+	// AlertHistoryDays sets alert history retention in days.
+	AlertHistoryDays int `group:"alerts" env:"FANOUT_ALERTS_HISTORY_DAYS" default:"7"`
+	// AIProvider enables chat by selecting exactly anthropic or openai. Empty disables chat.
+	AIProvider string `group:"ai" env:"FANOUT_AI_PROVIDER" default:""`
 	// AIModel overrides the provider's default: claude-sonnet-5-5 for Anthropic
 	// and gpt-6.1-sol for OpenAI. The OpenAI provider expects a reasoning model
 	// supporting reasoning.encrypted_content for stateless Responses replay.
 	// A 400 rejecting encrypted content is reported as a server-side configuration
-	// error; choose a compatible reasoning model with ai.model.
-	AIModel               string        `koanf:"ai.model" env:"FANOUT_AI_MODEL"`
-	AIBaseURL             string        `koanf:"ai.base_url" env:"FANOUT_AI_BASE_URL"`
-	SMTPHost              string        `koanf:"smtp.host" env:"FANOUT_SMTP_HOST"`
-	SMTPPort              int           `koanf:"smtp.port" env:"FANOUT_SMTP_PORT" default:"587"`
-	SMTPUser              string        `koanf:"smtp.username" env:"FANOUT_SMTP_USERNAME"`
-	SMTPPass              string        `koanf:"smtp.password" env:"FANOUT_SMTP_PASSWORD" secret:"true"`
-	SMTPFrom              string        `koanf:"smtp.from" env:"FANOUT_SMTP_FROM"`
-	AuthMode              string        `koanf:"auth.mode" env:"FANOUT_AUTH_MODE" default:"local"`
-	PublicURL             string        `koanf:"server.public_url" env:"FANOUT_PUBLIC_URL"`
-	AuthCodeSecret        string        `koanf:"auth.code_secret" env:"FANOUT_AUTH_CODE_SECRET" secret:"true"`
-	SelfSignup            bool          `koanf:"auth.self_signup" env:"FANOUT_SELF_SIGNUP" default:"false"`
-	SessionIdleTTL        time.Duration `koanf:"auth.session_idle_ttl" env:"FANOUT_SESSION_IDLE_TTL" default:"12h"`
-	SessionAbsoluteTTL    time.Duration `koanf:"auth.session_absolute_ttl" env:"FANOUT_SESSION_ABSOLUTE_TTL" default:"168h"`
-	OIDCIssuerURL         string        `koanf:"auth.oidc.issuer_url" env:"FANOUT_OIDC_ISSUER_URL"`
-	OIDCClientID          string        `koanf:"auth.oidc.client_id" env:"FANOUT_OIDC_CLIENT_ID"`
-	OIDCClientSecret      string        `koanf:"auth.oidc.client_secret" env:"FANOUT_OIDC_CLIENT_SECRET" secret:"true"`
-	OIDCEmailClaim        string        `koanf:"auth.oidc.email_claim" env:"FANOUT_OIDC_EMAIL_CLAIM" default:"email"`
-	OIDCEmailVerification string        `koanf:"auth.oidc.email_verification" env:"FANOUT_OIDC_EMAIL_VERIFICATION" default:"required"`
-	OIDCAutoProvision     bool          `koanf:"auth.oidc.auto_provision" env:"FANOUT_OIDC_AUTO_PROVISION" default:"false"`
-	OIDCAllowedGroups     string        `koanf:"auth.oidc.allowed_groups" env:"FANOUT_OIDC_ALLOWED_GROUPS"`
-	OIDCAllowedDomains    string        `koanf:"auth.oidc.allowed_domains" env:"FANOUT_OIDC_ALLOWED_DOMAINS"`
-	OIDCDefaultRole       string        `koanf:"auth.oidc.default_role" env:"FANOUT_OIDC_DEFAULT_ROLE" default:"viewer"`
-	OIDCOperatorGroups    string        `koanf:"auth.oidc.operator_groups" env:"FANOUT_OIDC_OPERATOR_GROUPS"`
-	OIDCAdminGroups       string        `koanf:"auth.oidc.admin_groups" env:"FANOUT_OIDC_ADMIN_GROUPS"`
-	MetricsToken          string        `koanf:"metrics.token" env:"FANOUT_METRICS_TOKEN" secret:"true"`
-	MetricsPublic         bool          `koanf:"metrics.public" env:"FANOUT_METRICS_PUBLIC" default:"false"`
-	TrustedProxyCIDRs     string        `koanf:"server.trusted_proxy_cidrs" env:"FANOUT_TRUSTED_PROXY_CIDRS"`
-	TLSCertFile           string        `koanf:"server.tls.cert_file" env:"FANOUT_TLS_CERT_FILE"`
-	TLSKeyFile            string        `koanf:"server.tls.key_file" env:"FANOUT_TLS_KEY_FILE"`
-	resolvedSizing        sizingSource
+	// error; choose a compatible reasoning model with FANOUT_AI_MODEL.
+	AIModel string `group:"ai" env:"FANOUT_AI_MODEL"`
+	// AnthropicAPIKey is required when FANOUT_AI_PROVIDER is anthropic.
+	AnthropicAPIKey string `group:"ai" env:"ANTHROPIC_API_KEY" secret:"true"`
+	// AnthropicBaseURL defaults to https://api.anthropic.com. Fanout appends
+	// /v1/messages, preserving any gateway path prefix. Use an HTTP(S) base URL
+	// without embedded credentials, a query, or a fragment.
+	AnthropicBaseURL string `group:"ai" env:"ANTHROPIC_BASE_URL"`
+	// OpenAIAPIKey is required when FANOUT_AI_PROVIDER is openai.
+	OpenAIAPIKey string `group:"ai" env:"OPENAI_API_KEY" secret:"true"`
+	// OpenAIBaseURL defaults to https://api.openai.com/v1. Fanout appends
+	// /responses, preserving the API version and any gateway path prefix.
+	// Use an HTTP(S) base URL without embedded credentials, a query, or a fragment.
+	OpenAIBaseURL string `group:"ai" env:"OPENAI_BASE_URL"`
+	// SMTPHost selects the mail server. Host, username, password, and from must all be set to enable SMTP.
+	SMTPHost string `group:"smtp" env:"FANOUT_SMTP_HOST"`
+	// SMTPPort sets the mail server's positive TCP port.
+	SMTPPort int `group:"smtp" env:"FANOUT_SMTP_PORT" default:"587"`
+	// SMTPUser authenticates to the mail server; required with SMTP.
+	SMTPUser string `group:"smtp" env:"FANOUT_SMTP_USERNAME"`
+	// SMTPPass authenticates to the mail server; required with SMTP.
+	SMTPPass string `group:"smtp" env:"FANOUT_SMTP_PASSWORD" secret:"true"`
+	// SMTPFrom sets the email sender address; required with SMTP.
+	SMTPFrom string `group:"smtp" env:"FANOUT_SMTP_FROM"`
+	// AuthMode selects local sign-in or oidc; each mode validates its prerequisites.
+	AuthMode string `group:"auth" env:"FANOUT_AUTH_MODE" default:"local"`
+	// PublicURL sets the external browser origin. Required for OIDC; HTTPS is required with MCP.
+	PublicURL string `group:"server" env:"FANOUT_PUBLIC_URL"`
+	// AuthCodeSecret signs local sign-in codes; required in local mode with at least 32 characters.
+	AuthCodeSecret string `group:"auth" env:"FANOUT_AUTH_CODE_SECRET" secret:"true"`
+	// SelfSignup allows verified email addresses to create viewer accounts; requires local auth and SMTP.
+	SelfSignup bool `group:"auth" env:"FANOUT_SELF_SIGNUP" default:"false"`
+	// SessionIdleTTL expires inactive sessions; use a Go duration of at least 5m.
+	SessionIdleTTL time.Duration `group:"auth" env:"FANOUT_SESSION_IDLE_TTL" default:"12h"`
+	// SessionAbsoluteTTL limits total session lifetime; it must be at least FANOUT_SESSION_IDLE_TTL.
+	SessionAbsoluteTTL time.Duration `group:"auth" env:"FANOUT_SESSION_ABSOLUTE_TTL" default:"168h"`
+	// OIDCIssuerURL selects the identity provider issuer; required in OIDC mode.
+	OIDCIssuerURL string `group:"auth" env:"FANOUT_OIDC_ISSUER_URL"`
+	// OIDCClientID identifies Fanout's client registration; required in OIDC mode.
+	OIDCClientID string `group:"auth" env:"FANOUT_OIDC_CLIENT_ID"`
+	// OIDCClientSecret authenticates Fanout's client registration; required in OIDC mode.
+	OIDCClientSecret string `group:"auth" env:"FANOUT_OIDC_CLIENT_SECRET" secret:"true"`
+	// OIDCEmailClaim names the claim containing the user's email address.
+	OIDCEmailClaim string `group:"auth" env:"FANOUT_OIDC_EMAIL_CLAIM" default:"email"`
+	// OIDCEmailVerification selects required verified-email claims or issuer trust; issuer trust requires an allowlist.
+	OIDCEmailVerification string `group:"auth" env:"FANOUT_OIDC_EMAIL_VERIFICATION" default:"required"`
+	// OIDCAutoProvision creates accounts on OIDC sign-in; requires an allowed group or domain.
+	OIDCAutoProvision bool `group:"auth" env:"FANOUT_OIDC_AUTO_PROVISION" default:"false"`
+	// OIDCAllowedGroups lists allowed identity-provider groups, separated by commas.
+	OIDCAllowedGroups string `group:"auth" env:"FANOUT_OIDC_ALLOWED_GROUPS"`
+	// OIDCAllowedDomains lists allowed email domains, separated by commas; wildcard * requires verified email.
+	OIDCAllowedDomains string `group:"auth" env:"FANOUT_OIDC_ALLOWED_DOMAINS"`
+	// OIDCDefaultRole assigns viewer, operator, or admin to users without a group role mapping.
+	OIDCDefaultRole string `group:"auth" env:"FANOUT_OIDC_DEFAULT_ROLE" default:"viewer"`
+	// OIDCOperatorGroups lists identity-provider groups mapped to operator, separated by commas.
+	OIDCOperatorGroups string `group:"auth" env:"FANOUT_OIDC_OPERATOR_GROUPS"`
+	// OIDCAdminGroups lists identity-provider groups mapped to admin, separated by commas.
+	OIDCAdminGroups string `group:"auth" env:"FANOUT_OIDC_ADMIN_GROUPS"`
+	// MetricsToken authorizes Prometheus scrapes with a bearer token; optional when using an admin session.
+	MetricsToken string `group:"metrics" env:"FANOUT_METRICS_TOKEN" secret:"true"`
+	// MetricsPublic allows unauthenticated Prometheus scrapes.
+	MetricsPublic bool `group:"metrics" env:"FANOUT_METRICS_PUBLIC" default:"false"`
+	// TrustedProxyCIDRs lists trusted proxy networks, separated by commas; empty trusts no forwarded client addresses.
+	TrustedProxyCIDRs string `group:"server" env:"FANOUT_TRUSTED_PROXY_CIDRS"`
+	// TLSCertFile selects the TLS certificate file; requires FANOUT_TLS_KEY_FILE.
+	TLSCertFile string `group:"server" env:"FANOUT_TLS_CERT_FILE"`
+	// TLSKeyFile selects the TLS private key file; requires FANOUT_TLS_CERT_FILE.
+	TLSKeyFile     string `group:"server" env:"FANOUT_TLS_KEY_FILE"`
+	resolvedSizing sizingSource
 }
 
 // LogStartup reports the effective non-secret sizing and security-sensitive
@@ -124,10 +201,10 @@ type Config struct {
 func (c Config) LogStartup() {
 	c.logResolvedSizing(c.resolvedSizing)
 	if !c.SecureCookies() {
-		slog.Warn("browser session cookies are not Secure; configure server.public_url or local TLS before exposing Fanout")
+		slog.Warn("browser session cookies are not Secure; configure FANOUT_PUBLIC_URL or local TLS before exposing Fanout")
 	}
 	if strings.TrimSpace(c.PublicURL) != "" && !c.TLSEnabled() && strings.TrimSpace(c.TrustedProxyCIDRs) == "" {
-		slog.Warn("reverse-proxy client IPs are not trusted; configure server.trusted_proxy_cidrs so audit and rate limits use end-client addresses")
+		slog.Warn("reverse-proxy client IPs are not trusted; configure FANOUT_TRUSTED_PROXY_CIDRS so audit and rate limits use end-client addresses")
 	}
 	if c.MetricsPublic {
 		slog.Warn("Prometheus metrics are publicly accessible", "path", "/metrics")
@@ -166,7 +243,7 @@ func (c Config) ControlSQLitePath() string {
 }
 
 // TLSEnabled reports whether a cert/key pair is configured. When true, HTTP
-// serves HTTPS and OTLP gRPC over TLS on server.addr.
+// serves HTTPS and OTLP gRPC over TLS on FANOUT_ADDR.
 func (c Config) TLSEnabled() bool {
 	return strings.TrimSpace(c.TLSCertFile) != "" &&
 		strings.TrimSpace(c.TLSKeyFile) != ""
@@ -175,113 +252,120 @@ func (c Config) TLSEnabled() bool {
 // Validate checks that config values are sane.
 func (c Config) Validate() error {
 	if strings.TrimSpace(c.Addr) == "" {
-		return fmt.Errorf("server.addr must not be empty")
+		return fmt.Errorf("FANOUT_ADDR must not be empty")
 	}
 	if strings.TrimSpace(c.DataDir) == "" {
-		return fmt.Errorf("storage.data_dir must not be empty")
+		return fmt.Errorf("FANOUT_DATA_DIR must not be empty")
 	}
 	if c.IngestBatchSize <= 0 || c.IngestBatchSize > maxIngestBatchSize {
-		return fmt.Errorf("ingest.batch_size must be between 1 and %d, got %d", maxIngestBatchSize, c.IngestBatchSize)
+		return fmt.Errorf("FANOUT_INGEST_BATCH_SIZE must be between 1 and %d, got %d", maxIngestBatchSize, c.IngestBatchSize)
 	}
 	if c.RollupInterval < time.Second {
-		return fmt.Errorf("storage.rollup_interval must be at least 1s, got %s", c.RollupInterval)
+		return fmt.Errorf("FANOUT_ROLLUP_INTERVAL must be at least 1s, got %s", c.RollupInterval)
 	}
 	if c.RetentionDays < 0 {
-		return fmt.Errorf("storage.retention_days must be >= 0, got %d", c.RetentionDays)
+		return fmt.Errorf("FANOUT_RETENTION_DAYS must be >= 0, got %d", c.RetentionDays)
 	}
 	if c.MaintenanceInterval < time.Second {
-		return fmt.Errorf("storage.maintenance_interval must be at least 1s, got %s", c.MaintenanceInterval)
+		return fmt.Errorf("FANOUT_MAINTENANCE_INTERVAL must be at least 1s, got %s", c.MaintenanceInterval)
 	}
 	if c.DuckDBThreads < 0 {
-		return fmt.Errorf("storage.duckdb.threads must be >= 0, got %d", c.DuckDBThreads)
+		return fmt.Errorf("FANOUT_DUCKDB_THREADS must be >= 0, got %d", c.DuckDBThreads)
 	}
 	if c.DuckDBMaxConns <= 0 {
-		return fmt.Errorf("storage.duckdb.max_connections must resolve to > 0, got %d", c.DuckDBMaxConns)
+		return fmt.Errorf("FANOUT_DUCKDB_MAX_CONNECTIONS must resolve to > 0, got %d", c.DuckDBMaxConns)
 	}
 	if c.AlertEvaluationInterval < time.Second {
-		return fmt.Errorf("alerts.evaluation_interval must be at least 1s, got %s", c.AlertEvaluationInterval)
+		return fmt.Errorf("FANOUT_ALERTS_EVALUATION_INTERVAL must be at least 1s, got %s", c.AlertEvaluationInterval)
 	}
 	if c.AlertHistoryDays < 0 {
-		return fmt.Errorf("alerts.history_days must be >= 0, got %d", c.AlertHistoryDays)
+		return fmt.Errorf("FANOUT_ALERTS_HISTORY_DAYS must be >= 0, got %d", c.AlertHistoryDays)
 	}
 	if c.MCPEnabled {
 		u, err := url.Parse(c.MCPResourceURL())
 		if err != nil || u.Scheme != "https" || u.Host == "" || u.User != nil || u.Path != "/mcp" || u.RawQuery != "" || u.Fragment != "" {
-			return fmt.Errorf("server.public_url must be an HTTPS origin when MCP is enabled")
+			return fmt.Errorf("FANOUT_PUBLIC_URL must be an HTTPS origin when MCP is enabled")
 		}
 	}
 	authMode := strings.ToLower(strings.TrimSpace(c.AuthMode))
 	if authMode == "" {
-		return fmt.Errorf("auth.mode must not be empty")
+		return fmt.Errorf("FANOUT_AUTH_MODE must not be empty")
 	}
 	if authMode != "local" && authMode != "oidc" {
-		return fmt.Errorf("auth.mode must be local or oidc")
+		return fmt.Errorf("FANOUT_AUTH_MODE must be local or oidc")
 	}
 	idleTTL := c.SessionIdleTTL
 	absoluteTTL := c.SessionAbsoluteTTL
 	if idleTTL < 5*time.Minute {
-		return fmt.Errorf("auth.session_idle_ttl must be at least 5m")
+		return fmt.Errorf("FANOUT_SESSION_IDLE_TTL must be at least 5m")
 	}
 	if absoluteTTL <= 0 || idleTTL > absoluteTTL {
-		return fmt.Errorf("auth.session_absolute_ttl must be positive and at least auth.session_idle_ttl")
+		return fmt.Errorf("FANOUT_SESSION_ABSOLUTE_TTL must be positive and at least FANOUT_SESSION_IDLE_TTL")
 	}
 	if authMode == "local" {
 		if len(strings.TrimSpace(c.AuthCodeSecret)) < 32 {
-			return fmt.Errorf("auth.code_secret must be at least 32 characters")
+			return fmt.Errorf("FANOUT_AUTH_CODE_SECRET must be at least 32 characters")
 		}
 	}
 	if anySet(c.SMTPHost, c.SMTPUser, c.SMTPPass, c.SMTPFrom) {
 		if !c.SMTPConfigured() {
-			return fmt.Errorf("smtp.host, smtp.username, smtp.password, and smtp.from must all be set when SMTP is configured")
+			return fmt.Errorf("FANOUT_SMTP_HOST, FANOUT_SMTP_USERNAME, FANOUT_SMTP_PASSWORD, and FANOUT_SMTP_FROM must all be set when SMTP is configured")
 		}
 		if c.SMTPPort <= 0 {
-			return fmt.Errorf("smtp.port must be > 0")
+			return fmt.Errorf("FANOUT_SMTP_PORT must be > 0")
 		}
 	}
 	if c.SelfSignup {
 		if authMode != "local" {
-			return fmt.Errorf("auth.self_signup requires auth.mode=local")
+			return fmt.Errorf("FANOUT_SELF_SIGNUP requires FANOUT_AUTH_MODE=local")
 		}
 		if !c.SMTPConfigured() {
-			return fmt.Errorf("auth.self_signup requires SMTP")
+			return fmt.Errorf("FANOUT_SELF_SIGNUP requires SMTP")
 		}
 	}
 	if authMode == "oidc" {
 		issuer, err := url.Parse(strings.TrimSpace(c.OIDCIssuerURL))
 		if err != nil || issuer.Scheme != "https" || issuer.Host == "" {
-			return fmt.Errorf("auth.oidc.issuer_url must be an HTTPS URL")
+			return fmt.Errorf("FANOUT_OIDC_ISSUER_URL must be an HTTPS URL")
 		}
 		if strings.TrimSpace(c.OIDCClientID) == "" || strings.TrimSpace(c.OIDCClientSecret) == "" {
-			return fmt.Errorf("auth.oidc.client_id and auth.oidc.client_secret are required in oidc mode")
+			return fmt.Errorf("FANOUT_OIDC_CLIENT_ID and FANOUT_OIDC_CLIENT_SECRET are required in oidc mode")
 		}
 		publicURL, err := url.Parse(strings.TrimSpace(c.PublicURL))
 		if err != nil || publicURL.Scheme != "https" || publicURL.Host == "" {
-			return fmt.Errorf("server.public_url must be an HTTPS URL in oidc mode")
+			return fmt.Errorf("FANOUT_PUBLIC_URL must be an HTTPS URL in oidc mode")
 		}
 		if c.OIDCEmailVerification != "required" && c.OIDCEmailVerification != "issuer" {
-			return fmt.Errorf("auth.oidc.email_verification must be required or issuer")
+			return fmt.Errorf("FANOUT_OIDC_EMAIL_VERIFICATION must be required or issuer")
 		}
 		if c.OIDCEmailVerification != "required" && csvContains(c.OIDCAllowedDomains, "*") {
-			return fmt.Errorf("auth.oidc.allowed_domains wildcard requires auth.oidc.email_verification=required")
+			return fmt.Errorf("FANOUT_OIDC_ALLOWED_DOMAINS wildcard requires FANOUT_OIDC_EMAIL_VERIFICATION=required")
 		}
 		if strings.TrimSpace(c.OIDCEmailClaim) == "" {
-			return fmt.Errorf("auth.oidc.email_claim must not be empty")
+			return fmt.Errorf("FANOUT_OIDC_EMAIL_CLAIM must not be empty")
 		}
 		if c.OIDCEmailVerification == "issuer" && strings.TrimSpace(c.OIDCAllowedGroups) == "" && strings.TrimSpace(c.OIDCAllowedDomains) == "" {
-			return fmt.Errorf("OIDC issuer email verification requires auth.oidc.allowed_groups or auth.oidc.allowed_domains")
+			return fmt.Errorf("OIDC issuer email verification requires FANOUT_OIDC_ALLOWED_GROUPS or FANOUT_OIDC_ALLOWED_DOMAINS")
 		}
 		if !appauth.ValidRole(c.OIDCDefaultRole) {
-			return fmt.Errorf("auth.oidc.default_role must be viewer, operator, or admin")
+			return fmt.Errorf("FANOUT_OIDC_DEFAULT_ROLE must be viewer, operator, or admin")
 		}
 		if c.OIDCAutoProvision && strings.TrimSpace(c.OIDCAllowedGroups) == "" && strings.TrimSpace(c.OIDCAllowedDomains) == "" {
-			return fmt.Errorf("OIDC auto-provisioning requires auth.oidc.allowed_groups or auth.oidc.allowed_domains")
+			return fmt.Errorf("OIDC auto-provisioning requires FANOUT_OIDC_ALLOWED_GROUPS or FANOUT_OIDC_ALLOWED_DOMAINS")
 		}
 	}
+	provider, supported := providers[c.AIProvider]
+	if c.AIProvider != "" && !supported {
+		return fmt.Errorf("FANOUT_AI_PROVIDER must be anthropic or openai")
+	}
 	if c.AgentConfigured() {
-		switch strings.ToLower(strings.TrimSpace(c.AIProvider)) {
-		case "", "anthropic", "openai":
-		default:
-			return fmt.Errorf("ai.provider must be anthropic or openai")
+		if strings.TrimSpace(c.AIAPIKey()) == "" {
+			return fmt.Errorf("%s is required when FANOUT_AI_PROVIDER is %s", provider.keyEnv, c.AIProvider)
+		}
+		baseURL := c.AIBaseURL()
+		u, err := url.Parse(baseURL)
+		if err != nil || (u.Scheme != "http" && u.Scheme != "https") || u.Hostname() == "" || u.User != nil || u.RawQuery != "" || u.ForceQuery || u.Fragment != "" || strings.Contains(baseURL, "#") {
+			return fmt.Errorf("%s must be an HTTP(S) base URL without credentials, query, or fragment", provider.baseURLEnv)
 		}
 	}
 	for _, raw := range strings.Split(c.TrustedProxyCIDRs, ",") {
@@ -290,11 +374,11 @@ func (c Config) Validate() error {
 			continue
 		}
 		if _, _, err := net.ParseCIDR(value); err != nil {
-			return fmt.Errorf("server.trusted_proxy_cidrs contains invalid CIDR %q", value)
+			return fmt.Errorf("FANOUT_TRUSTED_PROXY_CIDRS contains invalid CIDR %q", value)
 		}
 	}
 	if anySet(c.TLSCertFile, c.TLSKeyFile) && !c.TLSEnabled() {
-		return fmt.Errorf("server.tls requires cert_file and key_file")
+		return fmt.Errorf("FANOUT_TLS_CERT_FILE and FANOUT_TLS_KEY_FILE must both be set")
 	}
 	return nil
 }
@@ -308,7 +392,7 @@ func (c Config) SecureCookies() bool {
 }
 
 // MCPResourceURL returns the canonical OAuth resource URI for the MCP route.
-// MCP is served by the main HTTP server, so it always shares server.public_url.
+// MCP is served by the main HTTP server, so it always shares FANOUT_PUBLIC_URL.
 // The localhost value preserves zero-configuration development when no public
 // origin is configured.
 func (c Config) MCPResourceURL() string {
@@ -329,7 +413,28 @@ func (c Config) SMTPConfigured() bool {
 
 // AgentConfigured reports whether the in-process AI agent should be started.
 func (c Config) AgentConfigured() bool {
-	return strings.TrimSpace(c.AIAPIKey) != ""
+	return c.AIProvider != ""
+}
+
+// AIAPIKey returns only the explicitly selected provider's credential.
+func (c Config) AIAPIKey() string {
+	if provider, ok := providers[c.AIProvider]; ok {
+		return provider.key(c)
+	}
+	return ""
+}
+
+// AIBaseURL returns the selected provider's API base, including its default.
+func (c Config) AIBaseURL() string {
+	provider, ok := providers[c.AIProvider]
+	if !ok {
+		return ""
+	}
+	baseURL := provider.baseURL(c)
+	if strings.TrimSpace(baseURL) == "" {
+		return provider.defaultBaseURL
+	}
+	return strings.TrimRight(strings.TrimSpace(baseURL), "/")
 }
 
 func csvContains(value, target string) bool {
diff --git a/internal/config/config_test.go b/internal/config/config_test.go
index 30e911fc..42a14c84 100644
--- a/internal/config/config_test.go
+++ b/internal/config/config_test.go
@@ -7,16 +7,12 @@ import (
 	"strings"
 	"testing"
 	"time"
-
-	"github.com/knadh/koanf/parsers/yaml"
-	"github.com/knadh/koanf/providers/file"
-	"github.com/knadh/koanf/v2"
 )
 
 func validEnvironment() []string {
 	return []string{
 		"FANOUT_AUTH_CODE_SECRET=0123456789abcdef0123456789abcdef",
-		"FANOUT_AI_API_KEY=sk-test",
+		"ANTHROPIC_API_KEY=sk-test",
 		"FANOUT_SMTP_HOST=smtp.example.com",
 		"FANOUT_SMTP_USERNAME=user",
 		"FANOUT_SMTP_PASSWORD=pass",
@@ -27,541 +23,197 @@ func validEnvironment() []string {
 func TestLoadReturnsDefaults(t *testing.T) {
 	cfg, err := Load(LoadOptions{Environ: validEnvironment()})
 	if err != nil {
-		t.Fatalf("Load: %v", err)
-	}
-
-	if cfg.Addr != ":7520" {
-		t.Errorf("Addr = %q, want %q", cfg.Addr, ":7520")
-	}
-
-	if cfg.DataDir != "./data" {
-		t.Errorf("DataDir = %q, want %q", cfg.DataDir, "./data")
-	}
-	if cfg.IngestBatchSize != 50000 {
-		t.Errorf("IngestBatchSize = %d, want %d", cfg.IngestBatchSize, 50000)
-	}
-	if cfg.RollupInterval != time.Minute {
-		t.Errorf("RollupInterval = %s, want %s", cfg.RollupInterval, time.Minute)
-	}
-	if cfg.RetentionDays != 30 {
-		t.Errorf("RetentionDays = %d, want %d", cfg.RetentionDays, 30)
-	}
-	if cfg.DefaultNamespace != "default" {
-		t.Errorf("DefaultNamespace = %q, want %q", cfg.DefaultNamespace, "default")
-	}
-	// DuckDBMemory is no longer asserted to be empty: Load resolves it from
-	// detected memory, and what it resolves to depends on the machine running
-	// the test. On a host where detection declines it stays empty, which is the
-	// documented fallback rather than a failure. The resolution rules
-	// themselves are covered in sizing_test.go.
-	if cfg.DuckDBThreads != 0 {
-		t.Errorf("DuckDBThreads = %d, want 0 (DuckDB self-sizes to core count)", cfg.DuckDBThreads)
-	}
-	// Sized from the machine rather than fixed at 4, so assert the contract:
-	// above the write-gate invariant and within the auto-sizing ceiling.
-	if cfg.DuckDBMaxConns < minDuckDBConns || cfg.DuckDBMaxConns > maxAutoDuckDBConns {
-		t.Errorf("DuckDBMaxConns = %d, want between %d and %d",
-			cfg.DuckDBMaxConns, minDuckDBConns, maxAutoDuckDBConns)
-	}
-}
-
-func TestLoadLayering(t *testing.T) {
-	path := filepath.Join(t.TempDir(), "fanout.yaml")
-	if err := os.WriteFile(path, []byte(`server:
-  addr: ":1111"
-mcp:
-  enabled: false
-metrics:
-  public: true
-auth:
-  session_idle_ttl: 10h
-  self_signup: true
-`), 0o600); err != nil {
-		t.Fatalf("write config: %v", err)
-	}
-
-	cfg, err := Load(LoadOptions{
-		Path:    path,
-		Environ: append(validEnvironment(), "FANOUT_ADDR=:2222"),
-	})
-	if err != nil {
-		t.Fatalf("Load: %v", err)
+		t.Fatal(err)
 	}
-	if cfg.Addr != ":2222" {
-		t.Fatalf("Addr = %q, want environment override", cfg.Addr)
+	if cfg.Addr != "127.0.0.1:7520" || cfg.DataDir != "./data" || cfg.IngestBatchSize != 50000 || cfg.RollupInterval != time.Minute || cfg.RetentionDays != 30 || cfg.DefaultNamespace != "default" || !cfg.MCPEnabled || !cfg.AlertEnabled || cfg.AIProvider != "" {
+		t.Fatal("built-in defaults were not resolved")
 	}
-	if cfg.MCPEnabled || !cfg.MetricsPublic || cfg.SessionIdleTTL != 10*time.Hour || !cfg.SelfSignup {
-		t.Fatalf("YAML values were not merged: %+v", cfg)
+	if cfg.DuckDBThreads != 0 || cfg.DuckDBMaxConns < minDuckDBConns || cfg.DuckDBMaxConns > maxAutoDuckDBConns {
+		t.Fatal("machine sizing did not preserve the connection and thread defaults")
 	}
 }
 
 func TestLoadTypedEnvironmentValues(t *testing.T) {
 	cfg, err := Load(LoadOptions{Environ: append(validEnvironment(),
-		"FANOUT_MCP_ENABLED=false",
-		"FANOUT_METRICS_PUBLIC=true",
-		"FANOUT_SESSION_IDLE_TTL=10h",
-		"FANOUT_SELF_SIGNUP=true",
+		"FANOUT_ADDR=:9000", "FANOUT_MCP_ENABLED=false", "FANOUT_METRICS_PUBLIC=true",
+		"FANOUT_SESSION_IDLE_TTL=10h", "FANOUT_SELF_SIGNUP=true", "FANOUT_RETENTION_DAYS=0",
+		"FANOUT_ROLLUP_INTERVAL=5m", "FANOUT_MAINTENANCE_INTERVAL=2h", "FANOUT_ALERTS_EVALUATION_INTERVAL=45s",
 	)})
 	if err != nil {
-		t.Fatalf("Load: %v", err)
+		t.Fatal(err)
 	}
-	if cfg.MCPEnabled || !cfg.MetricsPublic || cfg.SessionIdleTTL != 10*time.Hour || !cfg.SelfSignup {
-		t.Fatalf("environment values were not decoded: %+v", cfg)
+	if cfg.Addr != ":9000" || cfg.MCPEnabled || !cfg.MetricsPublic || cfg.SessionIdleTTL != 10*time.Hour || !cfg.SelfSignup || cfg.RetentionDays != 0 || cfg.RollupInterval != 5*time.Minute || cfg.MaintenanceInterval != 2*time.Hour || cfg.AlertEvaluationInterval != 45*time.Second {
+		t.Fatal("environment values were not decoded")
 	}
 }
 
 func TestLoadTreatsEmptyEnvironmentValuesAsAbsent(t *testing.T) {
-	cfg, err := Load(LoadOptions{Environ: append(validEnvironment(),
-		"FANOUT_ADDR=",
-		"FANOUT_MCP_ENABLED=",
-		"FANOUT_RETENTION_DAYS=",
-	)})
-	if err != nil {
-		t.Fatalf("Load: %v", err)
-	}
-	if cfg.Addr != ":7520" || !cfg.MCPEnabled || cfg.RetentionDays != 30 {
-		t.Fatalf("empty environment values erased defaults: %+v", cfg)
-	}
-}
-
-func TestMCPResourceURL(t *testing.T) {
-	tests := []struct {
-		name      string
-		publicURL string
-		want      string
-	}{
-		{name: "local default", want: "https://localhost:7520/mcp"},
-		{name: "public origin", publicURL: "https://fanout.example.com", want: "https://fanout.example.com/mcp"},
-		{name: "trimmed origin", publicURL: "  https://fanout.example.com/  ", want: "https://fanout.example.com/mcp"},
-	}
-	for _, tc := range tests {
-		t.Run(tc.name, func(t *testing.T) {
-			cfg := Config{PublicURL: tc.publicURL}
-			if got := cfg.MCPResourceURL(); got != tc.want {
-				t.Fatalf("MCPResourceURL() = %q, want %q", got, tc.want)
-			}
-		})
-	}
-}
-
-func TestExampleConfigurationMatchesSchema(t *testing.T) {
-	path := filepath.Join("..", "..", "fanout.example.yaml")
-	cfg, err := Load(LoadOptions{
-		Path:    path,
-		Environ: validEnvironment(),
-	})
-	if err != nil {
-		t.Fatalf("Load example: %v", err)
-	}
-	if cfg.Addr != ":7520" || cfg.DataDir != "./data" {
-		t.Fatalf("example defaults = HTTP %q data %q", cfg.Addr, cfg.DataDir)
-	}
-	defaults, err := Load(LoadOptions{Environ: validEnvironment()})
+	cfg, err := Load(LoadOptions{Environ: append(validEnvironment(), "FANOUT_ADDR=", "FANOUT_MCP_ENABLED=", "FANOUT_RETENTION_DAYS=", "FANOUT_AUTH_CODE_SECRET_FILE=")})
 	if err != nil {
-		t.Fatalf("Load defaults: %v", err)
-	}
-	if !reflect.DeepEqual(cfg, defaults) {
-		t.Error("example values do not match built-in defaults")
-	}
-
-	raw, err := os.ReadFile(path)
-	if err != nil {
-		t.Fatalf("read example: %v", err)
-	}
-	example := koanf.New(".")
-	if err := example.Load(file.Provider(path), yaml.Parser()); err != nil {
-		t.Fatalf("parse example: %v", err)
-	}
-	active := make(map[string]bool, len(example.Keys()))
-	for _, key := range example.Keys() {
-		active[key] = true
-	}
-
-	specs, err := configFieldSpecs()
-	if err != nil {
-		t.Fatalf("field specs: %v", err)
-	}
-	wantSecrets := map[string]bool{
-		"ai.api_key":              true,
-		"smtp.password":           true,
-		"auth.code_secret":        true,
-		"auth.oidc.client_secret": true,
-		"metrics.token":           true,
-	}
-	foundSecrets := make(map[string]bool, len(wantSecrets))
-	rawText := string(raw)
-	for _, spec := range specs {
-		if !strings.Contains(rawText, spec.env) {
-			t.Errorf("example does not document %s", spec.env)
-		}
-		if spec.secret != wantSecrets[spec.key] {
-			t.Errorf("secret classification for %s = %t, want %t", spec.key, spec.secret, wantSecrets[spec.key])
-		}
-		if spec.secret {
-			foundSecrets[spec.key] = true
-		}
-		if spec.secret && active[spec.key] {
-			t.Errorf("secret key %s must be documented but inactive in the example", spec.key)
-		}
-		if spec.secret {
-			leaf := spec.key[strings.LastIndex(spec.key, ".")+1:]
-			if !strings.Contains(rawText, "# "+leaf+":") {
-				t.Errorf("secret key %s is not documented as a commented YAML key", spec.key)
-			}
-		}
-		if !spec.secret && !active[spec.key] {
-			t.Errorf("non-secret key %s must be active in the example", spec.key)
-		}
+		t.Fatal(err)
 	}
-	if !reflect.DeepEqual(foundSecrets, wantSecrets) {
-		t.Errorf("secret settings = %v, want exactly %v", foundSecrets, wantSecrets)
+	if cfg.Addr != "127.0.0.1:7520" || !cfg.MCPEnabled || cfg.RetentionDays != 30 {
+		t.Fatal("empty values erased defaults")
 	}
 }
 
 func TestConfigurationSchemaUsesUnitBearingDurations(t *testing.T) {
 	specs, err := configFieldSpecs()
 	if err != nil {
-		t.Fatalf("field specs: %v", err)
+		t.Fatal(err)
 	}
-	durationType := reflect.TypeOf(time.Duration(0))
 	for _, spec := range specs {
-		key := strings.ToLower(spec.key)
-		env := strings.ToLower(spec.env)
-		if strings.Contains(key, "_seconds") || strings.Contains(key, "_ms") ||
-			strings.Contains(env, "_seconds") || strings.Contains(env, "_ms") {
-			t.Errorf("elapsed-time setting uses a unit suffix: %s / %s", spec.key, spec.env)
+		if strings.HasSuffix(spec.env, "_SECONDS") || strings.HasSuffix(spec.env, "_MS") {
+			t.Errorf("unit suffix in %s", spec.env)
 		}
-		if spec.typ == durationType && !strings.HasSuffix(key, "_interval") && !strings.HasSuffix(key, "_ttl") && !strings.HasSuffix(key, "_retention") {
-			t.Errorf("duration setting %s must end in _interval or _ttl", spec.key)
+		if spec.typ == reflect.TypeOf(time.Duration(0)) && !strings.HasSuffix(spec.env, "_INTERVAL") && !strings.HasSuffix(spec.env, "_TTL") {
+			t.Errorf("duration name %s must end in _INTERVAL or _TTL", spec.env)
 		}
 	}
 }
 
-func TestLoadDurationIntervals(t *testing.T) {
-	t.Run("YAML", func(t *testing.T) {
-		path := filepath.Join(t.TempDir(), "fanout.yaml")
-		document := `storage:
-  rollup_interval: 5m
-  maintenance_interval: 1h
-alerts:
-  evaluation_interval: 45s
-`
-		if err := os.WriteFile(path, []byte(document), 0o600); err != nil {
-			t.Fatalf("write config: %v", err)
-		}
-		cfg, err := Load(LoadOptions{Path: path, Environ: validEnvironment()})
-		if err != nil {
-			t.Fatalf("Load: %v", err)
-		}
-		if cfg.RollupInterval != 5*time.Minute ||
-			cfg.MaintenanceInterval != time.Hour ||
-			cfg.AlertEvaluationInterval != 45*time.Second {
-			t.Fatalf("duration values were not decoded: %+v", cfg)
-		}
-	})
-
-	t.Run("environment", func(t *testing.T) {
-		cfg, err := Load(LoadOptions{Environ: append(validEnvironment(),
-			"FANOUT_ROLLUP_INTERVAL=5m",
-			"FANOUT_MAINTENANCE_INTERVAL=1h",
-			"FANOUT_ALERTS_EVALUATION_INTERVAL=45s",
-		)})
-		if err != nil {
-			t.Fatalf("Load: %v", err)
-		}
-		if cfg.RollupInterval != 5*time.Minute ||
-			cfg.MaintenanceInterval != time.Hour ||
-			cfg.AlertEvaluationInterval != 45*time.Second {
-			t.Fatalf("duration values were not decoded: %+v", cfg)
-		}
-	})
-}
-
-func TestDockerConfigurationMatchesSchema(t *testing.T) {
-	path := filepath.Join("..", "..", "fanout.docker.yaml")
-	cfg, err := Load(LoadOptions{Path: path, Environ: validEnvironment()})
-	if err != nil {
-		t.Fatalf("Load Docker config: %v", err)
-	}
-	if cfg.Addr != ":7520" || cfg.DataDir != "/var/lib/fanout/data" {
-		t.Fatalf("Docker config values = HTTP %q data %q", cfg.Addr, cfg.DataDir)
-	}
-}
-
-func TestLoadRejectsUnknownInputs(t *testing.T) {
-	t.Run("YAML key", func(t *testing.T) {
-		path := filepath.Join(t.TempDir(), "fanout.yaml")
-		if err := os.WriteFile(path, []byte("server:\n  htpp_addr: ':1111'\n"), 0o600); err != nil {
-			t.Fatalf("write config: %v", err)
-		}
-		_, err := Load(LoadOptions{Path: path, Environ: validEnvironment()})
-		if err == nil || !strings.Contains(err.Error(), "server.htpp_addr") {
-			t.Fatalf("error = %v, want unknown YAML key", err)
-		}
-	})
-
-	t.Run("environment variable", func(t *testing.T) {
-		_, err := Load(LoadOptions{Environ: append(validEnvironment(), "FANOUT_HTPP_ADDR=:1111")})
-		if err == nil || !strings.Contains(err.Error(), "FANOUT_HTPP_ADDR") {
-			t.Fatalf("error = %v, want unknown environment variable", err)
-		}
-	})
-
-	t.Run("removed ingest YAML key", func(t *testing.T) {
-		path := filepath.Join(t.TempDir(), "fanout.yaml")
-		if err := os.WriteFile(path, []byte("ingest:\n  public_endpoint: https://ingest.example.com\n"), 0o600); err != nil {
-			t.Fatalf("write config: %v", err)
-		}
-		_, err := Load(LoadOptions{Path: path, Environ: validEnvironment()})
-		if err == nil || !strings.Contains(err.Error(), "ingest.public_endpoint") {
-			t.Fatalf("error = %v, want removed YAML key rejected", err)
-		}
-	})
-
-	t.Run("removed ingest environment variable", func(t *testing.T) {
-		_, err := Load(LoadOptions{Environ: append(validEnvironment(), "FANOUT_INGEST_ENDPOINT=https://ingest.example.com")})
-		if err == nil || !strings.Contains(err.Error(), "FANOUT_INGEST_ENDPOINT") {
-			t.Fatalf("error = %v, want removed environment variable rejected", err)
-		}
-	})
-
-	t.Run("removed YAML keys", func(t *testing.T) {
-		for _, test := range []struct {
-			key, document string
-		}{
-			{"agent.provider", "agent:\n  provider: anthropic\n"},
-			{"agent.api_key", "agent:\n  api_key: secret\n"},
-			{"agent.model", "agent:\n  model: test\n"},
-			{"agent.base_url", "agent:\n  base_url: https://ai.example.com\n"},
-			{"ingest.flush_seconds", "ingest:\n  flush_seconds: 15\n"},
-			{"storage.rollup_every_seconds", "storage:\n  rollup_every_seconds: 60\n"},
-			{"storage.merge_every_seconds", "storage:\n  merge_every_seconds: 60\n"},
-			{"storage.maintenance_every_seconds", "storage:\n  maintenance_every_seconds: 3600\n"},
-			{"alerts.evaluation_interval_seconds", "alerts:\n  evaluation_interval_seconds: 30\n"},
-			{"mcp.public_url", "mcp:\n  public_url: https://fanout.example.com/mcp\n"},
-		} {
-			t.Run(test.key, func(t *testing.T) {
-				path := filepath.Join(t.TempDir(), "fanout.yaml")
-				if err := os.WriteFile(path, []byte(test.document), 0o600); err != nil {
-					t.Fatalf("write config: %v", err)
-				}
-				_, err := Load(LoadOptions{Path: path, Environ: validEnvironment()})
-				if err == nil || !strings.Contains(err.Error(), test.key) {
-					t.Fatalf("error = %v, want removed key %s rejected", err, test.key)
-				}
-			})
-		}
-	})
-
-	t.Run("removed environment variables", func(t *testing.T) {
-		for _, name := range []string{
-			"FANOUT_ROLLUP_EVERY_SECONDS",
-			"FANOUT_MERGE_EVERY_SECONDS",
-			"FANOUT_MERGE_INTERVAL",
-			"FANOUT_MAINTENANCE_EVERY_SECONDS",
-			"FANOUT_ALERTS_EVALUATION_INTERVAL_SECONDS",
-			"FANOUT_MCP_PUBLIC_URL",
-		} {
-			t.Run(name, func(t *testing.T) {
-				_, err := Load(LoadOptions{Environ: append(validEnvironment(), name+"=1")})
-				if err == nil || !strings.Contains(err.Error(), name) {
-					t.Fatalf("error = %v, want removed environment variable %s rejected", err, name)
-				}
-			})
-		}
-	})
-
-	t.Run("near platform variable", func(t *testing.T) {
-		_, err := Load(LoadOptions{Environ: append(validEnvironment(), "FANOUT_SERVICE_PORTAL=7520")})
-		if err == nil || !strings.Contains(err.Error(), "FANOUT_SERVICE_PORTAL") {
-			t.Fatalf("error = %v, want unknown environment variable", err)
-		}
-	})
-
-	t.Run("malformed environment entry", func(t *testing.T) {
-		_, err := Load(LoadOptions{Environ: append(validEnvironment(), "FANOUT_ADDR")})
-		if err == nil || !strings.Contains(err.Error(), "NAME=value") {
-			t.Fatalf("error = %v, want malformed environment error", err)
+func TestLoadRejectsUnknownAndMalformedEnvironment(t *testing.T) {
+	for _, entry := range []string{"FANOUT_HTPP_ADDR=:1111", "FANOUT_SERVICE_PORTAL=7520", "FANOUT_ADDR", "FANOUT_ADDR_FILE=/unused", "FANOUT_UNKNOWN_SETTING=synthetic-private-value"} {
+		_, err := Load(LoadOptions{Environ: append(validEnvironment(), entry)})
+		name, _, _ := strings.Cut(entry, "=")
+		if err == nil || !strings.Contains(err.Error(), name) || strings.Contains(err.Error(), "synthetic-private-value") {
+			t.Fatalf("expected redacted error naming %s", name)
 		}
-	})
-}
-
-func TestLoadIgnoresKubernetesServiceEnvironment(t *testing.T) {
-	environ := append(validEnvironment(),
-		"FANOUT_SERVICE_HOST=10.0.0.1",
-		"FANOUT_SERVICE_PORT=7520",
-		"FANOUT_SERVICE_PORT_HTTP=7520",
-		"FANOUT_PORT=tcp://10.0.0.1:7520",
-		"FANOUT_PORT_7520_TCP_ADDR=10.0.0.1",
-	)
-	if _, err := Load(LoadOptions{Environ: environ}); err != nil {
-		t.Fatalf("Load with Kubernetes service variables: %v", err)
-	}
-}
-
-func TestLoadIgnoresEnvironmentOutsideNamespace(t *testing.T) {
-	if _, err := Load(LoadOptions{Environ: append(validEnvironment(),
-		"OTHER_APP_SETTING=value",
-	)}); err != nil {
-		t.Fatalf("Load with unrelated environment variable: %v", err)
 	}
 }
 
-func TestLoadAllowsEmptyYAMLSections(t *testing.T) {
-	for _, document := range []string{
-		"metrics:\n",
-		"auth:\n  oidc:\n    # client_id: fanout\n",
-		"server: {}\n",
-	} {
-		path := filepath.Join(t.TempDir(), "fanout.yaml")
-		if err := os.WriteFile(path, []byte(document), 0o600); err != nil {
-			t.Fatal(err)
-		}
-		if _, err := Load(LoadOptions{Path: path, Environ: validEnvironment()}); err != nil {
-			t.Fatalf("Load %q: %v", document, err)
+func TestLoadRejectsDuplicateEnvironmentNames(t *testing.T) {
+	for _, entry := range []string{"FANOUT_ADDR=", "ANTHROPIC_API_KEY=test", "FANOUT_METRICS_TOKEN_FILE="} {
+		name, _, _ := strings.Cut(entry, "=")
+		_, err := Load(LoadOptions{Environ: []string{entry, entry}})
+		if err == nil || !strings.Contains(err.Error(), "duplicate") || !strings.Contains(err.Error(), name) {
+			t.Fatalf("expected duplicate error for %s", name)
 		}
 	}
 }
 
-func TestLoadRejectsYAMLNullValues(t *testing.T) {
-	for _, key := range []struct {
-		name, document string
-	}{
-		{"HTTP address", "server:\n  addr:\n"},
-		{"MCP enabled", "mcp:\n  enabled:\n"},
-		{"retention", "storage:\n  retention_days:\n"},
-	} {
-		t.Run(key.name, func(t *testing.T) {
-			path := filepath.Join(t.TempDir(), "fanout.yaml")
-			if err := os.WriteFile(path, []byte(key.document), 0o600); err != nil {
-				t.Fatal(err)
-			}
-			_, err := Load(LoadOptions{Path: path, Environ: validEnvironment()})
-			if err == nil || !strings.Contains(err.Error(), "must not be null") {
-				t.Fatalf("error = %v, want null rejection", err)
-			}
-		})
+func TestLoadIgnoresPlatformAndUnrelatedEnvironment(t *testing.T) {
+	env := append(validEnvironment(), "FANOUT_SERVICE_HOST=10.0.0.1", "FANOUT_SERVICE_PORT=7520", "FANOUT_SERVICE_PORT_HTTP=7520", "FANOUT_PORT=tcp://10.0.0.1:7520", "FANOUT_PORT_7520_TCP_ADDR=10.0.0.1", "OTHER_APP_SETTING=value", "OPENAI_MODEL=other-model")
+	if _, err := Load(LoadOptions{Environ: env}); err != nil {
+		t.Fatal(err)
 	}
 }
 
-func TestLoadRejectsInvalidFilesAndValues(t *testing.T) {
-	t.Run("missing file", func(t *testing.T) {
-		_, err := Load(LoadOptions{Path: filepath.Join(t.TempDir(), "missing.yaml"), Environ: validEnvironment()})
-		if err == nil {
-			t.Fatal("expected missing file error")
-		}
-	})
-
-	for _, test := range []struct {
-		name, document string
-	}{
-		{"invalid duration", "storage:\n  rollup_interval: never\n"},
-		{"fractional integer", "smtp:\n  port: 25.9\n"},
-		{"integer as boolean", "mcp:\n  enabled: 2\n"},
-		{"YAML keyword as boolean", "alerts:\n  enabled: off\n"},
+func TestLoadRejectsInvalidTypedValuesWithoutLeakingValues(t *testing.T) {
+	for _, entry := range []string{
+		"FANOUT_ROLLUP_INTERVAL=private-value", "FANOUT_SMTP_PORT=25.9", "FANOUT_MCP_ENABLED=off", "FANOUT_RETENTION_DAYS=999999999999999999999999999",
+		"FANOUT_INGEST_BATCH_SIZE=0", "FANOUT_DUCKDB_MAX_CONNECTIONS=-3", "FANOUT_DUCKDB_THREADS=-4",
+		"FANOUT_ROLLUP_INTERVAL=999ms", "FANOUT_MAINTENANCE_INTERVAL=-5s", "FANOUT_ALERTS_EVALUATION_INTERVAL=0s",
 	} {
-		t.Run(test.name, func(t *testing.T) {
-			path := filepath.Join(t.TempDir(), "fanout.yaml")
-			if err := os.WriteFile(path, []byte(test.document), 0o600); err != nil {
-				t.Fatalf("write config: %v", err)
-			}
-			_, err := Load(LoadOptions{Path: path, Environ: validEnvironment()})
-			if err == nil {
-				t.Fatal("expected type error")
+		env := validEnvironment()
+		name, _, _ := strings.Cut(entry, "=")
+		for i, existing := range env {
+			if strings.HasPrefix(existing, name+"=") {
+				env = append(env[:i], env[i+1:]...)
+				break
 			}
-		})
-	}
-
-	t.Run("invalid merged config", func(t *testing.T) {
-		_, err := Load(LoadOptions{Environ: append(validEnvironment(), "FANOUT_INGEST_BATCH_SIZE=0")})
-		if err == nil || !strings.Contains(err.Error(), "batch_size") {
-			t.Fatalf("error = %v, want validation error", err)
-		}
-	})
-
-	t.Run("explicit empty auth mode", func(t *testing.T) {
-		path := filepath.Join(t.TempDir(), "fanout.yaml")
-		if err := os.WriteFile(path, []byte("auth:\n  mode: \"\"\n"), 0o600); err != nil {
-			t.Fatal(err)
 		}
-		_, err := Load(LoadOptions{Path: path, Environ: validEnvironment()})
-		if err == nil || !strings.Contains(err.Error(), "auth.mode must not be empty") {
-			t.Fatalf("error = %v, want explicit empty auth-mode rejection", err)
+		_, err := Load(LoadOptions{Environ: append(env, entry)})
+		if err == nil || !strings.Contains(err.Error(), name) || strings.Contains(err.Error(), "private-value") {
+			t.Fatalf("expected redacted validation error for %s", name)
 		}
-	})
-
-	for _, test := range []struct {
-		name, assignment, key string
-	}{
-		{"negative max connections is not auto", "FANOUT_DUCKDB_MAX_CONNECTIONS=-3", "max_connections"},
-		{"zero alert interval", "FANOUT_ALERTS_EVALUATION_INTERVAL=0s", "evaluation_interval"},
-		{"negative maintenance interval", "FANOUT_MAINTENANCE_INTERVAL=-5s", "maintenance_interval"},
-		{"negative DuckDB threads", "FANOUT_DUCKDB_THREADS=-4", "duckdb.threads"},
-	} {
-		t.Run(test.name, func(t *testing.T) {
-			_, err := Load(LoadOptions{Environ: append(validEnvironment(), test.assignment)})
-			if err == nil || !strings.Contains(err.Error(), test.key) {
-				t.Fatalf("error = %v, want validation error for %s", err, test.key)
-			}
-		})
-	}
-
-	for _, test := range []struct {
-		name, assignment, key string
-	}{
-		{"subsecond rollup interval", "FANOUT_ROLLUP_INTERVAL=999ms", "rollup_interval"},
-		{"subsecond maintenance interval", "FANOUT_MAINTENANCE_INTERVAL=500ms", "maintenance_interval"},
-		{"subsecond alert interval", "FANOUT_ALERTS_EVALUATION_INTERVAL=999ms", "evaluation_interval"},
-	} {
-		t.Run(test.name, func(t *testing.T) {
-			_, err := Load(LoadOptions{Environ: append(validEnvironment(), test.assignment)})
-			if err == nil || !strings.Contains(err.Error(), test.key) {
-				t.Fatalf("error = %v, want lower-bound validation for %s", err, test.key)
-			}
-		})
 	}
 }
 
 func TestLoadIgnoresDotenvInputs(t *testing.T) {
 	dir := t.TempDir()
 	if err := os.WriteFile(filepath.Join(dir, ".env"), []byte("FANOUT_ADDR=:9999\n"), 0o600); err != nil {
-		t.Fatalf("write .env: %v", err)
+		t.Fatal(err)
 	}
 	t.Chdir(dir)
-
 	cfg, err := Load(LoadOptions{Environ: validEnvironment()})
 	if err != nil {
-		t.Fatalf("Load: %v", err)
+		t.Fatal(err)
 	}
-	if cfg.Addr != ":7520" {
-		t.Fatalf("Addr = %q, want default", cfg.Addr)
+	if cfg.Addr != "127.0.0.1:7520" {
+		t.Fatal("binary loaded dotenv")
 	}
 }
 
-func TestLoadErrorsDoNotContainSecrets(t *testing.T) {
-	const secret = "do-not-print-this-password"
-	path := filepath.Join(t.TempDir(), "fanout.yaml")
-	document := "smtp:\n  password: " + secret + "\n  port: 25.9\n"
-	if err := os.WriteFile(path, []byte(document), 0o600); err != nil {
+func TestLoadSecretFiles(t *testing.T) {
+	names := []string{"FANOUT_AUTH_CODE_SECRET", "FANOUT_OIDC_CLIENT_SECRET", "FANOUT_SMTP_PASSWORD", "FANOUT_METRICS_TOKEN", "ANTHROPIC_API_KEY", "OPENAI_API_KEY"}
+	specs, err := configFieldSpecs()
+	if err != nil {
 		t.Fatal(err)
 	}
-	_, err := Load(LoadOptions{Path: path, Environ: validEnvironment()})
-	if err == nil {
-		t.Fatal("expected decode error")
-	}
-	if strings.Contains(err.Error(), secret) {
-		t.Fatalf("error leaked secret: %v", err)
+	for _, name := range names {
+		for _, tc := range []struct{ name, suffix, retained string }{
+			{"no newline", "", ""},
+			{"LF", "\n", ""},
+			{"CRLF", "\r\n", ""},
+			{"two LF", "\n\n", "\n"},
+			{"two CRLF", "\r\n\r\n", "\r\n"},
+			{"bare CR", "\r", "\r"},
+			{"spaces", "  \n", "  "},
+		} {
+			t.Run(name+"/"+tc.name, func(t *testing.T) {
+				secret := strings.Repeat("x", 32)
+				path := filepath.Join(t.TempDir(), "secret")
+				if err := os.WriteFile(path, []byte(secret+tc.suffix), 0o644); err != nil {
+					t.Fatal(err)
+				}
+				env := []string{}
+				for _, entry := range validEnvironment() {
+					if !strings.HasPrefix(entry, name+"=") {
+						env = append(env, entry)
+					}
+				}
+				env = append(env, name+"=", name+"_FILE="+path)
+				if provider := providerForEnvironment(name); provider != "" {
+					env = append(env, "FANOUT_AI_PROVIDER="+provider)
+				}
+				cfg, err := Load(LoadOptions{Environ: env})
+				if err != nil {
+					t.Fatal(err)
+				}
+				want := secret + tc.retained
+				for _, spec := range specs {
+					if spec.env == name && reflect.ValueOf(cfg).Field(spec.index).String() != want {
+						t.Fatalf("%s did not preserve exact file contents", name)
+					}
+				}
+			})
+		}
 	}
 }
 
-func TestLoadRequiresPrivatePermissionsForConfigSecrets(t *testing.T) {
-	path := filepath.Join(t.TempDir(), "fanout.yaml")
-	if err := os.WriteFile(path, []byte("ai:\n  api_key: secret-from-file\n"), 0o644); err != nil {
-		t.Fatal(err)
+func TestLoadRejectsConflictingOrInvalidSecretFiles(t *testing.T) {
+	const name = "FANOUT_METRICS_TOKEN"
+	const secret = "synthetic-private-value"
+	path := filepath.Join(t.TempDir(), "secret")
+	for _, content := range []string{"", "\n", "\r\n", secret} {
+		if err := os.WriteFile(path, []byte(content), 0o644); err != nil {
+			t.Fatal(err)
+		}
+		env := append(validEnvironment(), name+"_FILE="+path)
+		if content == secret {
+			env = append(env, name+"="+secret)
+		}
+		_, err := Load(LoadOptions{Environ: env})
+		if err == nil || !strings.Contains(err.Error(), name+"_FILE") || !strings.Contains(err.Error(), path) || strings.Contains(err.Error(), secret) {
+			t.Fatal("expected redacted file error naming variable and path")
+		}
 	}
-	_, err := Load(LoadOptions{Path: path, Environ: validEnvironment()})
-	if err == nil || !strings.Contains(err.Error(), "must not be accessible by group or others") {
-		t.Fatalf("error = %v, want file permission rejection", err)
+	for _, invalidPath := range []string{path + "-missing", filepath.Dir(path)} {
+		_, err := Load(LoadOptions{Environ: append(validEnvironment(), name+"_FILE="+invalidPath)})
+		if err == nil || !strings.Contains(err.Error(), name+"_FILE") || !strings.Contains(err.Error(), invalidPath) {
+			t.Fatal("expected file read error naming variable and path")
+		}
+	}
+}
+
+func TestMCPResourceURL(t *testing.T) {
+	for _, tc := range []struct{ publicURL, want string }{
+		{"", "https://localhost:7520/mcp"}, {"https://fanout.example.com", "https://fanout.example.com/mcp"}, {"  https://fanout.example.com/  ", "https://fanout.example.com/mcp"},
+	} {
+		if got := (Config{PublicURL: tc.publicURL}).MCPResourceURL(); got != tc.want {
+			t.Fatalf("MCPResourceURL = %s, want %s", got, tc.want)
+		}
 	}
 }
 
@@ -577,7 +229,7 @@ func TestValidate(t *testing.T) {
 		AlertEvaluationInterval: 30 * time.Second,
 		AlertHistoryDays:        7,
 		AIProvider:              "anthropic",
-		AIAPIKey:                "sk-test",
+		AnthropicAPIKey:         "sk-test",
 		SMTPHost:                "smtp.example.com",
 		SMTPPort:                587,
 		SMTPUser:                "user",
@@ -659,8 +311,8 @@ func TestValidate(t *testing.T) {
 	t.Run("local mode allows absent SMTP and agent", func(t *testing.T) {
 		c := valid
 		c.SMTPHost, c.SMTPUser, c.SMTPPass, c.SMTPFrom = "", "", "", ""
-		c.AIAPIKey = ""
-		c.AIProvider = "ignored-without-a-key"
+		c.AnthropicAPIKey = ""
+		c.AIProvider = ""
 		if err := c.Validate(); err != nil {
 			t.Fatalf("minimal local config should pass: %v", err)
 		}
@@ -728,7 +380,7 @@ func TestValidate(t *testing.T) {
 		} {
 			c.PublicURL = invalid
 			if err := c.Validate(); err == nil {
-				t.Errorf("server.public_url %q should be rejected with MCP enabled", invalid)
+				t.Errorf("FANOUT_PUBLIC_URL %q should be rejected with MCP enabled", invalid)
 			}
 		}
 	})
@@ -753,34 +405,34 @@ func TestFieldSpecsRejectInvalidSchemas(t *testing.T) {
 		want string
 	}{
 		{
-			name: "duplicate key",
+			name: "secret file name collision",
 			typ: reflect.TypeOf(struct {
-				A string `koanf:"same" env:"FANOUT_A"`
-				B string `koanf:"same" env:"FANOUT_B"`
+				A string `env:"FANOUT_SECRET" secret:"true"`
+				B string `env:"FANOUT_SECRET_FILE"`
 			}{}),
-			want: "share key",
+			want: "share environment variable",
 		},
 		{
 			name: "duplicate environment",
 			typ: reflect.TypeOf(struct {
-				A string `koanf:"a" env:"FANOUT_SAME"`
-				B string `koanf:"b" env:"FANOUT_SAME"`
+				A string `env:"FANOUT_SAME"`
+				B string `env:"FANOUT_SAME"`
 			}{}),
 			want: "share environment variable",
 		},
 		{
 			name: "missing tag",
 			typ: reflect.TypeOf(struct {
-				A string `koanf:"a"`
+				A string
 			}{}),
 			want: "must declare",
 		},
 		{
 			name: "missing prefix",
 			typ: reflect.TypeOf(struct {
-				A string `koanf:"a" env:"A"`
+				A string `env:"A"`
 			}{}),
-			want: "lacks FANOUT_ prefix",
+			want: "outside the supported configuration contract",
 		},
 	}
 	for _, test := range tests {
@@ -812,31 +464,3 @@ func TestSecureCookies(t *testing.T) {
 		})
 	}
 }
-
-func TestRemovedListenerAndEndpointSettingsRejected(t *testing.T) {
-	t.Run("old server address", func(t *testing.T) {
-		path := filepath.Join(t.TempDir(), "fanout.yaml")
-		if err := os.WriteFile(path, []byte("server:\n  http_addr: ':7520'\n"), 0o600); err != nil {
-			t.Fatal(err)
-		}
-		if _, err := Load(LoadOptions{Path: path, Environ: validEnvironment()}); err == nil || !strings.Contains(err.Error(), "server.http_addr") {
-			t.Fatalf("removed key: %v", err)
-		}
-	})
-	for _, key := range []string{"otlp_grpc_addr", "otlp_http_addr", "advertised_endpoint"} {
-		t.Run(key, func(t *testing.T) {
-			path := filepath.Join(t.TempDir(), "fanout.yaml")
-			if err := os.WriteFile(path, []byte("ingest:\n  "+key+": ':4317'\n"), 0o600); err != nil {
-				t.Fatal(err)
-			}
-			if _, err := Load(LoadOptions{Path: path, Environ: validEnvironment()}); err == nil || !strings.Contains(err.Error(), key) {
-				t.Fatalf("removed key: %v", err)
-			}
-		})
-	}
-	for _, name := range []string{"FANOUT_HTTP_ADDR", "FANOUT_OTLP_GRPC_ADDR", "FANOUT_OTLP_HTTP_ADDR", "FANOUT_INGEST_ADVERTISED_ENDPOINT"} {
-		if _, err := Load(LoadOptions{Environ: append(validEnvironment(), name+"=:4317")}); err == nil || !strings.Contains(err.Error(), name) {
-			t.Fatalf("removed variable: %v", err)
-		}
-	}
-}
diff --git a/internal/config/loader.go b/internal/config/loader.go
index 6c6945d3..1398f19a 100644
--- a/internal/config/loader.go
+++ b/internal/config/loader.go
@@ -8,23 +8,16 @@ import (
 	"strconv"
 	"strings"
 	"time"
-
-	"github.com/go-viper/mapstructure/v2"
-	"github.com/knadh/koanf/parsers/yaml"
-	"github.com/knadh/koanf/providers/confmap"
-	"github.com/knadh/koanf/providers/file"
-	"github.com/knadh/koanf/v2"
 )
 
-// LoadOptions selects the explicit configuration inputs. A nil Environ uses
-// os.Environ; an empty slice deliberately supplies no environment variables.
+// LoadOptions selects the environment. A nil Environ uses os.Environ;
+// an empty slice deliberately supplies no environment variables.
 type LoadOptions struct {
-	Path    string
 	Environ []string
 }
 
 type fieldSpec struct {
-	key          string
+	index        int
 	env          string
 	typ          reflect.Type
 	defaultValue any
@@ -32,79 +25,71 @@ type fieldSpec struct {
 	secret       bool
 }
 
-// Load resolves defaults, an optional YAML document, and process environment
-// in that order, then sizes and validates the effective configuration.
+// Load resolves built-in defaults and process environment, then sizes and
+// validates the effective configuration.
 func Load(options LoadOptions) (Config, error) {
 	specs, err := configFieldSpecs()
 	if err != nil {
 		return Config{}, err
 	}
-
-	specByKey := make(map[string]fieldSpec, len(specs))
-	specByEnv := make(map[string]fieldSpec, len(specs))
-	defaults := make(map[string]any)
+	known := make(map[string]bool, len(specs))
+	var cfg Config
+	value := reflect.ValueOf(&cfg).Elem()
 	for _, spec := range specs {
-		specByKey[spec.key] = spec
-		specByEnv[spec.env] = spec
-		if spec.hasDefault {
-			defaults[spec.key] = spec.defaultValue
-		}
-	}
-
-	k := koanf.New(".")
-	if err := k.Load(confmap.Provider(defaults, "."), nil); err != nil {
-		return Config{}, fmt.Errorf("load configuration defaults: %w", err)
-	}
-
-	if options.Path != "" {
-		info, statErr := os.Stat(options.Path)
-		if statErr != nil {
-			return Config{}, fmt.Errorf("load config %q: %w", options.Path, statErr)
-		}
-		if !info.Mode().IsRegular() {
-			return Config{}, fmt.Errorf("load config %q: not a regular file", options.Path)
+		known[spec.env] = true
+		if spec.secret {
+			known[spec.env+"_FILE"] = true
 		}
-		fromFile := koanf.New(".")
-		if err := fromFile.Load(file.Provider(options.Path), yaml.Parser()); err != nil {
-			return Config{}, fmt.Errorf("load config %q: %w", options.Path, err)
-		}
-		if err := validateYAMLKeys(fromFile, specByKey); err != nil {
-			return Config{}, fmt.Errorf("config %q: %w", options.Path, err)
-		}
-		if containsSecretValues(fromFile, specs) && info.Mode().Perm()&0o077 != 0 {
-			return Config{}, fmt.Errorf("config %q contains secrets and must not be accessible by group or others (mode is %04o)", options.Path, info.Mode().Perm())
-		}
-		if err := k.Merge(fromFile); err != nil {
-			return Config{}, fmt.Errorf("merge config %q: %w", options.Path, err)
+		if spec.hasDefault {
+			value.Field(spec.index).Set(reflect.ValueOf(spec.defaultValue))
 		}
 	}
-
 	environ := options.Environ
 	if environ == nil {
 		environ = os.Environ()
 	}
-	overrides, err := environmentOverrides(environ, specByEnv)
+	values, err := environmentValues(environ, known)
 	if err != nil {
 		return Config{}, err
 	}
-	if err := k.Load(confmap.Provider(overrides, "."), nil); err != nil {
-		return Config{}, fmt.Errorf("load environment configuration: %w", err)
-	}
-
-	var cfg Config
-	if err := k.UnmarshalWithConf("", &cfg, koanf.UnmarshalConf{
-		Tag:       "koanf",
-		FlatPaths: true,
-		DecoderConfig: &mapstructure.DecoderConfig{
-			DecodeHook:       mapstructure.StringToTimeDurationHookFunc(),
-			ErrorUnused:      true,
-			WeaklyTypedInput: false,
-		},
-	}); err != nil {
-		return Config{}, fmt.Errorf("decode configuration: %w", err)
+	for _, spec := range specs {
+		// Shared vendor settings, including secret mounts, belong only to the
+		// explicitly selected provider. Fanout-owned secrets always resolve.
+		if provider := providerForEnvironment(spec.env); provider != "" && provider != values["FANOUT_AI_PROVIDER"] {
+			continue
+		}
+		text := values[spec.env]
+		if spec.secret {
+			name := spec.env + "_FILE"
+			if path := values[name]; path != "" {
+				if text != "" {
+					return Config{}, fmt.Errorf("%s and %s (%q) must not both be set", spec.env, name, path)
+				}
+				content, err := os.ReadFile(path)
+				if err != nil {
+					return Config{}, fmt.Errorf("read %s file %q: %w", name, path, err)
+				}
+				text = string(content)
+				if strings.HasSuffix(text, "\r\n") {
+					text = strings.TrimSuffix(text, "\r\n")
+				} else {
+					text = strings.TrimSuffix(text, "\n")
+				}
+				if text == "" {
+					return Config{}, fmt.Errorf("%s file %q is empty", name, path)
+				}
+			}
+		}
+		if text == "" {
+			continue
+		}
+		parsed, err := parseTextValue(text, spec.typ)
+		if err != nil {
+			return Config{}, fmt.Errorf("environment variable %s %w", spec.env, err)
+		}
+		value.Field(spec.index).Set(reflect.ValueOf(parsed))
 	}
-	// Size before validating: validation should judge the configuration the
-	// process will actually run with, not the holes left for it to fill.
+	// Validation judges the sizing the process will actually use.
 	cfg.resolveSizing()
 	if err := cfg.Validate(); err != nil {
 		return Config{}, fmt.Errorf("validate configuration: %w", err)
@@ -121,26 +106,29 @@ func fieldSpecs(typ reflect.Type) ([]fieldSpec, error) {
 		return nil, fmt.Errorf("configuration schema must be a struct, got %s", typ)
 	}
 	specs := make([]fieldSpec, 0, typ.NumField())
-	keys := make(map[string]string, typ.NumField())
 	envs := make(map[string]string, typ.NumField())
 	for index := 0; index < typ.NumField(); index++ {
 		field := typ.Field(index)
 		if !field.IsExported() {
 			continue
 		}
-		key := field.Tag.Get("koanf")
-		envName := field.Tag.Get("env")
-		if key == "" || envName == "" {
-			return nil, fmt.Errorf("configuration field %s must declare koanf and env tags", field.Name)
+		name := field.Tag.Get("env")
+		if name == "" {
+			return nil, fmt.Errorf("configuration field %s must declare an env tag", field.Name)
 		}
-		if previous, exists := keys[key]; exists {
-			return nil, fmt.Errorf("configuration fields %s and %s share key %q", previous, field.Name, key)
+		if !strings.HasPrefix(name, "FANOUT_") && providerForEnvironment(name) == "" {
+			return nil, fmt.Errorf("environment variable %s is outside the supported configuration contract", name)
 		}
-		if previous, exists := envs[envName]; exists {
-			return nil, fmt.Errorf("configuration fields %s and %s share environment variable %q", previous, field.Name, envName)
+		secret := field.Tag.Get("secret") == "true"
+		names := []string{name}
+		if secret {
+			names = append(names, name+"_FILE")
 		}
-		if !strings.HasPrefix(envName, "FANOUT_") {
-			return nil, fmt.Errorf("configuration field %s environment variable %q lacks FANOUT_ prefix", field.Name, envName)
+		for _, env := range names {
+			if previous, exists := envs[env]; exists {
+				return nil, fmt.Errorf("configuration fields %s and %s share environment variable %s", previous, field.Name, env)
+			}
+			envs[env] = field.Name
 		}
 		defaultText, hasDefault := field.Tag.Lookup("default")
 		var defaultValue any
@@ -148,158 +136,47 @@ func fieldSpecs(typ reflect.Type) ([]fieldSpec, error) {
 			var err error
 			defaultValue, err = parseTextValue(defaultText, field.Type)
 			if err != nil {
-				return nil, fmt.Errorf("configuration field %s has invalid default: %w", field.Name, err)
+				return nil, fmt.Errorf("environment variable %s has invalid default: %w", name, err)
 			}
 		}
 		specs = append(specs, fieldSpec{
-			key:          key,
-			env:          envName,
+			index:        index,
+			env:          name,
 			typ:          field.Type,
 			defaultValue: defaultValue,
 			hasDefault:   hasDefault,
-			secret:       field.Tag.Get("secret") == "true",
+			secret:       secret,
 		})
-		keys[key] = field.Name
-		envs[envName] = field.Name
 	}
 	return specs, nil
 }
 
-func validateYAMLKeys(k *koanf.Koanf, known map[string]fieldSpec) error {
-	var unknown []string
-	var emptyContainers []string
-	for _, key := range k.Keys() {
-		value := k.Get(key)
-		if spec, exists := known[key]; exists {
-			if value == nil {
-				return fmt.Errorf("key %s must not be null", key)
-			}
-			if err := validateYAMLValue(value, spec.typ); err != nil {
-				return fmt.Errorf("key %s %w", key, err)
-			}
-			continue
-		}
-		if isSchemaContainer(key, known) && isEmptyContainer(value) {
-			emptyContainers = append(emptyContainers, key)
-			continue
-		}
-		unknown = append(unknown, key)
-	}
-	if len(unknown) == 0 {
-		for _, key := range emptyContainers {
-			k.Delete(key)
-		}
-		return nil
-	}
-	sort.Strings(unknown)
-	return fmt.Errorf("contains unknown keys: %s", strings.Join(unknown, ", "))
-}
-
-func isSchemaContainer(key string, known map[string]fieldSpec) bool {
-	prefix := key + "."
-	for candidate := range known {
-		if strings.HasPrefix(candidate, prefix) {
-			return true
-		}
-	}
-	return false
-}
-
-func validateYAMLValue(value any, typ reflect.Type) error {
-	if typ == reflect.TypeOf(time.Duration(0)) {
-		text, ok := value.(string)
-		if !ok {
-			return fmt.Errorf("must be a duration string")
-		}
-		if _, err := time.ParseDuration(text); err != nil {
-			return fmt.Errorf("must be a Go duration: %w", err)
-		}
-		return nil
-	}
-	kind := reflect.TypeOf(value).Kind()
-	switch typ.Kind() {
-	case reflect.String:
-		if kind != reflect.String {
-			return fmt.Errorf("must be a string")
-		}
-	case reflect.Bool:
-		if kind != reflect.Bool {
-			return fmt.Errorf("must be true or false")
-		}
-	case reflect.Int, reflect.Int8, reflect.Int16, reflect.Int32, reflect.Int64:
-		if kind < reflect.Int || kind > reflect.Int64 {
-			return fmt.Errorf("must be an integer")
-		}
-	default:
-		return fmt.Errorf("uses unsupported configuration type %s", typ)
-	}
-	return nil
-}
-
-func isEmptyContainer(value any) bool {
-	if value == nil {
-		return true
-	}
-	rv := reflect.ValueOf(value)
-	return (rv.Kind() == reflect.Map || rv.Kind() == reflect.Slice) && rv.Len() == 0
-}
-
-func containsSecretValues(k *koanf.Koanf, specs []fieldSpec) bool {
-	for _, spec := range specs {
-		if !spec.secret {
-			continue
-		}
-		value := k.Get(spec.key)
-		if value == nil {
-			continue
-		}
-		if text, ok := value.(string); ok && strings.TrimSpace(text) == "" {
-			continue
-		}
-		return true
-	}
-	return false
-}
-
-func environmentOverrides(environ []string, known map[string]fieldSpec) (map[string]any, error) {
-	overrides := make(map[string]any)
+func environmentValues(environ []string, known map[string]bool) (map[string]string, error) {
+	values := make(map[string]string)
 	var unknown []string
 	for _, assignment := range environ {
 		name, value, found := strings.Cut(assignment, "=")
-		_, isKnown := known[name]
-		if !found {
-			if isKnown || strings.HasPrefix(name, "FANOUT_") {
-				return nil, fmt.Errorf("environment entry %s must use NAME=value form", name)
-			}
+		isKnown := known[name]
+		if !isKnown && (!strings.HasPrefix(name, "FANOUT_") || isPlatformInjectedEnvironment(name)) {
 			continue
 		}
-		if !strings.HasPrefix(name, "FANOUT_") {
-			continue
+		if !found {
+			return nil, fmt.Errorf("environment entry %s must use NAME=value form", name)
 		}
-		spec, exists := known[name]
-		if !exists {
-			if isPlatformInjectedEnvironment(name) {
-				continue
-			}
+		if !isKnown {
 			unknown = append(unknown, name)
 			continue
 		}
-		// An explicitly empty environment value means "no override", so it cannot
-		// erase a safe default or silently disable a feature.
-		if value == "" {
-			continue
-		}
-		parsed, err := parseTextValue(value, spec.typ)
-		if err != nil {
-			return nil, fmt.Errorf("environment variable %s has an invalid value for %s: %w", name, spec.key, err)
+		if _, exists := values[name]; exists {
+			return nil, fmt.Errorf("duplicate environment variable %s", name)
 		}
-		overrides[spec.key] = parsed
+		values[name] = value
 	}
 	if len(unknown) > 0 {
 		sort.Strings(unknown)
 		return nil, fmt.Errorf("unknown Fanout environment variables: %s", strings.Join(unknown, ", "))
 	}
-	return overrides, nil
+	return values, nil
 }
 
 func isPlatformInjectedEnvironment(name string) bool {
@@ -314,7 +191,7 @@ func parseTextValue(value string, typ reflect.Type) (any, error) {
 	if typ == reflect.TypeOf(time.Duration(0)) {
 		parsed, err := time.ParseDuration(value)
 		if err != nil {
-			return nil, fmt.Errorf("must be a Go duration: %w", err)
+			return nil, fmt.Errorf("must be a Go duration")
 		}
 		return parsed, nil
 	}
@@ -324,13 +201,13 @@ func parseTextValue(value string, typ reflect.Type) (any, error) {
 	case reflect.Bool:
 		parsed, err := strconv.ParseBool(value)
 		if err != nil {
-			return nil, fmt.Errorf("must be true or false: %w", err)
+			return nil, fmt.Errorf("must be true or false")
 		}
 		return parsed, nil
 	case reflect.Int, reflect.Int8, reflect.Int16, reflect.Int32, reflect.Int64:
 		parsed, err := strconv.ParseInt(value, 10, typ.Bits())
 		if err != nil {
-			return nil, fmt.Errorf("must be an integer: %w", err)
+			return nil, fmt.Errorf("must be an integer")
 		}
 		result := reflect.New(typ).Elem()
 		result.SetInt(parsed)
diff --git a/internal/config/pinned_memory_test.go b/internal/config/pinned_memory_test.go
index 74de5a80..29826aa4 100644
--- a/internal/config/pinned_memory_test.go
+++ b/internal/config/pinned_memory_test.go
@@ -2,7 +2,7 @@ package config
 
 import "testing"
 
-// Pinning storage.duckdb.memory skips detection entirely, so nothing compares
+// Pinning FANOUT_DUCKDB_MEMORY skips detection entirely, so nothing compares
 // the value to the machine. Both production deployments pinned 4GB on 8 GiB
 // hosts and were OOM-killed repeatedly: DuckDB's budget is not the process's
 // budget, and the Go runtime, the ingest appender and compaction's merges all
diff --git a/internal/config/provider_test.go b/internal/config/provider_test.go
new file mode 100644
index 00000000..5096a330
--- /dev/null
+++ b/internal/config/provider_test.go
@@ -0,0 +1,162 @@
+package config
+
+import (
+	"fmt"
+	"os"
+	"path/filepath"
+	"reflect"
+	"strings"
+	"testing"
+)
+
+func TestDefaultAddrMatchesSchema(t *testing.T) {
+	field, ok := reflect.TypeOf(Config{}).FieldByName("Addr")
+	if !ok || field.Tag.Get("default") != DefaultAddr {
+		t.Fatalf("Addr default tag = %q, want %q", field.Tag.Get("default"), DefaultAddr)
+	}
+}
+
+func TestLoadIgnoresInactiveProviderSecretFiles(t *testing.T) {
+	emptyPath := filepath.Join(t.TempDir(), "empty")
+	if err := os.WriteFile(emptyPath, nil, 0o644); err != nil {
+		t.Fatal(err)
+	}
+	for _, provider := range []string{"", "anthropic", "openai"} {
+		for _, vendor := range []string{"anthropic", "openai"} {
+			if vendor == provider {
+				continue
+			}
+			for _, file := range []struct{ name, path string }{
+				{"missing", "/missing"}, {"empty", emptyPath},
+			} {
+				for _, bothSet := range []bool{false, true} {
+					t.Run(fmt.Sprintf("%s/%s/%s/both_set=%t", provider, vendor, file.name, bothSet), func(t *testing.T) {
+						env := []string{"FANOUT_AUTH_CODE_SECRET=" + strings.Repeat("x", 32), "FANOUT_AI_PROVIDER=" + provider}
+						if provider != "" {
+							env = append(env, strings.ToUpper(provider)+"_API_KEY=selected-key")
+						}
+						name := strings.ToUpper(vendor)
+						env = append(env, name+"_API_KEY_FILE="+file.path, name+"_BASE_URL=unused-invalid-url")
+						if bothSet {
+							env = append(env, name+"_API_KEY=unused-key")
+						}
+						cfg, err := Load(LoadOptions{Environ: env})
+						if err != nil {
+							t.Fatal(err)
+						}
+						if vendor == "anthropic" && (cfg.AnthropicAPIKey != "" || cfg.AnthropicBaseURL != "") ||
+							vendor == "openai" && (cfg.OpenAIAPIKey != "" || cfg.OpenAIBaseURL != "") {
+							t.Fatal("inactive provider settings must be ignored")
+						}
+					})
+				}
+			}
+		}
+	}
+}
+
+func TestLoadRejectsSelectedProviderSecretFileErrors(t *testing.T) {
+	for _, provider := range []string{"anthropic", "openai"} {
+		for _, bothSet := range []bool{false, true} {
+			t.Run(fmt.Sprintf("%s/both_set=%t", provider, bothSet), func(t *testing.T) {
+				name := strings.ToUpper(provider) + "_API_KEY"
+				path := filepath.Join(t.TempDir(), "missing")
+				env := []string{
+					"FANOUT_AUTH_CODE_SECRET=" + strings.Repeat("x", 32), "FANOUT_AI_PROVIDER=" + provider,
+					name + "_FILE=" + path,
+				}
+				if bothSet {
+					env = append(env, name+"=synthetic-private-value")
+				}
+				_, err := Load(LoadOptions{Environ: env})
+				if err == nil || !strings.Contains(err.Error(), name+"_FILE") || !strings.Contains(err.Error(), path) || strings.Contains(err.Error(), "synthetic-private-value") {
+					t.Fatalf("expected redacted file error naming variable and path, got %v", err)
+				}
+				if bothSet && !strings.Contains(err.Error(), "must not both be set") {
+					t.Fatalf("expected selected provider conflict, got %v", err)
+				}
+			})
+		}
+	}
+}
+
+func TestLoadSelectsProviderCredentials(t *testing.T) {
+	for _, tc := range []struct {
+		name, provider, key, baseURL string
+		credentials                  []string
+	}{
+		{"anthropic", "anthropic", "anthropic-test", "https://anthropic.example/gateway", []string{"ANTHROPIC_API_KEY=anthropic-test", "ANTHROPIC_BASE_URL=https://anthropic.example/gateway/", "OPENAI_API_KEY=openai-test", "OPENAI_BASE_URL=https://openai.example/v1"}},
+		{"openai", "openai", "openai-test", "https://openai.example/gateway/v1", []string{"ANTHROPIC_API_KEY=anthropic-test", "ANTHROPIC_BASE_URL=not-used", "OPENAI_API_KEY=openai-test", "OPENAI_BASE_URL=https://openai.example/gateway/v1/"}},
+		{"inherited credentials do not enable chat", "", "", "", []string{"ANTHROPIC_API_KEY=anthropic-test", "OPENAI_API_KEY=openai-test", "ANTHROPIC_BASE_URL=not-used", "OPENAI_BASE_URL=not-used"}},
+		{"anthropic default endpoint", "anthropic", "anthropic-test", DefaultAnthropicBaseURL, []string{"ANTHROPIC_API_KEY=anthropic-test", "OPENAI_BASE_URL=not-used"}},
+		{"openai default endpoint", "openai", "openai-test", DefaultOpenAIBaseURL, []string{"OPENAI_API_KEY=openai-test", "ANTHROPIC_BASE_URL=not-used"}},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			env := []string{"FANOUT_AUTH_CODE_SECRET=" + strings.Repeat("x", 32), "FANOUT_AI_PROVIDER=" + tc.provider}
+			cfg, err := Load(LoadOptions{Environ: append(env, tc.credentials...)})
+			if err != nil {
+				t.Fatal(err)
+			}
+			if cfg.AIProvider != tc.provider || cfg.AIAPIKey() != tc.key || cfg.AIBaseURL() != tc.baseURL || cfg.AgentConfigured() != (tc.provider != "") {
+				t.Fatal("selected provider credential, endpoint, or enabled state is incorrect")
+			}
+		})
+	}
+}
+
+func TestLoadIgnoresOtherVendorEnvironment(t *testing.T) {
+	cfg, err := Load(LoadOptions{Environ: []string{
+		"FANOUT_AUTH_CODE_SECRET=" + strings.Repeat("x", 32),
+		"FANOUT_AI_PROVIDER=openai", "OPENAI_API_KEY=openai-env",
+		"OPENAI_BASE_URL=https://gateway.example/api/v1/", "FANOUT_AI_MODEL=configured-model",
+		"ANTHROPIC_API_KEY=", "ANTHROPIC_BASE_URL=",
+		"OPENAI_MODEL=unrelated-tool", "ANTHROPIC_MODEL=unrelated-tool",
+		"OPENAI_PROJECT_ID=another-consumer", "ANTHROPIC_AUTH_TOKEN=another-consumer",
+	}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if cfg.AIAPIKey() != "openai-env" || cfg.AIBaseURL() != "https://gateway.example/api/v1" || cfg.AIModel != "configured-model" || cfg.AnthropicAPIKey != "" || cfg.AnthropicBaseURL != "" {
+		t.Fatal("provider environment or shared consumer isolation is incorrect")
+	}
+}
+
+func TestLoadRejectsInvalidProviderURLWithoutLeakingValues(t *testing.T) {
+	for _, provider := range []string{"anthropic", "openai"} {
+		name := strings.ToUpper(provider) + "_BASE_URL"
+		for _, value := range []string{"file:///private", "https://user:private-value@example.com", "https://example.com?key=private-value", "https://example.com#private-value", "https://example.com?", "https://example.com#", "https://", "https://example.com/%zz"} {
+			_, err := Load(LoadOptions{Environ: []string{"FANOUT_AUTH_CODE_SECRET=" + strings.Repeat("x", 32), "FANOUT_AI_PROVIDER=" + provider, strings.ToUpper(provider) + "_API_KEY=test-key", name + "=" + value}})
+			if err == nil || !strings.Contains(err.Error(), name) || strings.Contains(err.Error(), value) || strings.Contains(err.Error(), "private-value") {
+				t.Fatalf("expected redacted validation error naming %s", name)
+			}
+		}
+	}
+}
+
+func TestLoadRejectsUnsupportedProviderWithoutAKey(t *testing.T) {
+	for _, provider := range []string{"unsupported", "OpenAI", " OpenAI ", " openai ", "Anthropic"} {
+		_, err := Load(LoadOptions{Environ: []string{"FANOUT_AUTH_CODE_SECRET=" + strings.Repeat("x", 32), "FANOUT_AI_PROVIDER=" + provider}})
+		if err == nil || !strings.Contains(err.Error(), "FANOUT_AI_PROVIDER") {
+			t.Fatal("unsupported provider must fail at startup, even without a key")
+		}
+	}
+}
+
+func TestLoadRequiresSelectedProviderKey(t *testing.T) {
+	for _, provider := range []string{"anthropic", "openai"} {
+		otherKey := "OPENAI_API_KEY"
+		if provider == "openai" {
+			otherKey = "ANTHROPIC_API_KEY"
+		}
+		for _, value := range []string{"", "   "} {
+			name := strings.ToUpper(provider) + "_API_KEY"
+			_, err := Load(LoadOptions{Environ: []string{
+				"FANOUT_AUTH_CODE_SECRET=" + strings.Repeat("x", 32), "FANOUT_AI_PROVIDER=" + provider,
+				name + "=" + value, otherKey + "=other-provider-key",
+			}})
+			if err == nil || !strings.Contains(err.Error(), name) {
+				t.Fatalf("expected missing key error naming the environment variable, got %v", err)
+			}
+		}
+	}
+}
diff --git a/internal/config/sizing.go b/internal/config/sizing.go
index 5aa1f490..b8fa0312 100644
--- a/internal/config/sizing.go
+++ b/internal/config/sizing.go
@@ -134,13 +134,13 @@ func (c Config) logResolvedSizing(src sizingSource) {
 		"gomaxprocs", runtime.GOMAXPROCS(0),
 	)
 	if src.MemoryAuto && src.MemoryDetectionIncomplete {
-		slog.Warn("memory limit detection was incomplete; automatic DuckDB sizing may exceed a container limit — configure storage.duckdb.memory explicitly",
+		slog.Warn("memory limit detection was incomplete; automatic DuckDB sizing may exceed a container limit — configure FANOUT_DUCKDB_MEMORY explicitly",
 			"memory_source", src.MemorySource,
 			"detected_memory_bytes", src.DetectedRAM,
 		)
 	}
 	if src.MemoryAuto && c.DuckDBMemory == "" {
-		slog.Warn("could not detect available memory; DuckDB will size itself to 80% of RAM, which can exceed the machine once the Go runtime is added — configure storage.duckdb.memory explicitly")
+		slog.Warn("could not detect available memory; DuckDB will size itself to 80% of RAM, which can exceed the machine once the Go runtime is added — configure FANOUT_DUCKDB_MEMORY explicitly")
 	}
 	// A pinned budget skipped detection, so this is the only place it is ever
 	// compared to the machine it will run on.
@@ -174,7 +174,7 @@ func resolveDuckDBMemory(available uint64) string {
 // pinnedMemoryConcern reports why an operator-pinned DuckDB budget looks wrong
 // for this machine, or "" when it looks fine or cannot be judged.
 //
-// Pinning storage.duckdb.memory skips detection entirely (resolveSizing only
+// Pinning FANOUT_DUCKDB_MEMORY skips detection entirely (resolveSizing only
 // fills a value that is empty), so without this nothing ever compares the
 // figure to the machine it will run on. DuckDB's budget is not the process's
 // budget: the Go heap, the ingest appender and compaction's merges all sit on
@@ -192,14 +192,14 @@ func pinnedMemoryConcern(pinned string, detectedRAM uint64) string {
 	}
 	budget, ok := parseByteSize(pinned)
 	if !ok {
-		return fmt.Sprintf("storage.duckdb.memory %q could not be parsed as a size; DuckDB may reject it or fall back to its own default", pinned)
+		return fmt.Sprintf("FANOUT_DUCKDB_MEMORY %q could not be parsed as a size; DuckDB may reject it or fall back to its own default", pinned)
 	}
 	if budget >= detectedRAM {
-		return fmt.Sprintf("storage.duckdb.memory %q is at or above the %d bytes detected for this machine; the Go runtime and compaction allocate on top of it", pinned, detectedRAM)
+		return fmt.Sprintf("FANOUT_DUCKDB_MEMORY %q is at or above the %d bytes detected for this machine; the Go runtime and compaction allocate on top of it", pinned, detectedRAM)
 	}
 	share := detectedRAM / 100 * duckDBMemoryPercent
 	if budget > share {
-		return fmt.Sprintf("storage.duckdb.memory %q takes more than the %d%% of %d bytes automatic sizing would leave DuckDB; the remainder has to cover the Go heap, the ingest appender and compaction merges", pinned, duckDBMemoryPercent, detectedRAM)
+		return fmt.Sprintf("FANOUT_DUCKDB_MEMORY %q takes more than the %d%% of %d bytes automatic sizing would leave DuckDB; the remainder has to cover the Go heap, the ingest appender and compaction merges", pinned, duckDBMemoryPercent, detectedRAM)
 	}
 	return ""
 }
diff --git a/internal/query/duck.go b/internal/query/duck.go
index 1d29989b..7e8458ce 100644
--- a/internal/query/duck.go
+++ b/internal/query/duck.go
@@ -153,7 +153,7 @@ func duckDBPoolSize(cfg config.Config) int {
 // of a constant that's wrong everywhere but the box it was tuned for.
 func duckDSN(dbPath, mem string, threads int) (string, error) {
 	if strings.ContainsAny(mem, "&?'\"\\; ") {
-		return "", fmt.Errorf("invalid storage.duckdb.memory value: %q", mem)
+		return "", fmt.Errorf("invalid FANOUT_DUCKDB_MEMORY value: %q", mem)
 	}
 	params := make([]string, 0, 2)
 	if threads > 0 {
@@ -292,7 +292,7 @@ func NewDuck(ctx context.Context, cfg config.Config, repository *telemetrystore.
 		return tags
 	})
 	if cfg.DuckDBMemory == "" {
-		// Only when the operator hasn't pinned storage.duckdb.memory: keep DuckDB's
+		// Only when the operator hasn't pinned FANOUT_DUCKDB_MEMORY: keep DuckDB's
 		// cgroup-aware auto limit on big boxes but leave absolute RAM headroom on
 		// small ones, so the kernel doesn't OOM-kill the whole process.
 		if err := applyMemoryHeadroom(ctx, db); err != nil {
diff --git a/justfile b/justfile
index 98504e14..25c9f315 100644
--- a/justfile
+++ b/justfile
@@ -32,6 +32,10 @@ embedded := "internal/ui/dist internal/mcp/apps"
 default:
     @just --list
 
+# Load optional ignored .env, then inherited values. Build with `just build` first.
+run *ARGS='':
+    node scripts/run-fanout.mjs -- ./bin/fanout {{ARGS}}
+
 # Split out so CI installs exactly what a contributor does, without also
 # writing git hooks into the runner.
 
diff --git a/scripts/run-fanout.mjs b/scripts/run-fanout.mjs
new file mode 100644
index 00000000..12da133a
--- /dev/null
+++ b/scripts/run-fanout.mjs
@@ -0,0 +1,54 @@
+import { spawn } from "node:child_process";
+import { readFileSync } from "node:fs";
+import { dirname, resolve } from "node:path";
+import { fileURLToPath, pathToFileURL } from "node:url";
+import { parseEnv } from "node:util";
+
+/** @param {string} root @param {Record<string, string | undefined>} inherited */
+export function prepareEnvironment(root, inherited) {
+  let content = "";
+  try {
+    content = readFileSync(resolve(root, ".env"), "utf8");
+  } catch (error) {
+    if (!error || typeof error !== "object" || !("code" in error) || error.code !== "ENOENT") {
+      throw new Error("Cannot read dotenv file: .env");
+    }
+  }
+  // Node's parser preserves literal dollars and never executes shell code.
+  const values = parseEnv(content);
+  for (const [name, value] of Object.entries(inherited)) {
+    if (value !== undefined) values[name] = value;
+  }
+  return values;
+}
+
+/** @param {string[]} args @returns {Promise<number>} */
+export async function main(args) {
+  if (args.length < 2 || args[0] !== "--") {
+    throw new Error("Usage: node scripts/run-fanout.mjs -- command [args]");
+  }
+  const root = resolve(dirname(fileURLToPath(import.meta.url)), "..");
+  const env = prepareEnvironment(root, process.env);
+  const child = spawn(args[1], args.slice(2), { cwd: root, env, stdio: "inherit" });
+  const handlers = new Map(["SIGINT", "SIGTERM", "SIGHUP"].map(signal => [signal, () => child.kill(signal)]));
+  for (const [signal, handler] of handlers) process.on(signal, handler);
+  try {
+    return await new Promise((resolveExit, reject) => {
+      child.once("error", reject);
+      child.once("exit", (code, signal) => resolveExit(code ?? ({ SIGINT: 130, SIGTERM: 143, SIGHUP: 129 }[signal] ?? 1)));
+    });
+  } finally {
+    for (const [signal, handler] of handlers) process.off(signal, handler);
+  }
+}
+
+if (process.argv[1] && pathToFileURL(resolve(process.argv[1])).href === import.meta.url) {
+  try {
+    process.exitCode = await main(process.argv.slice(2));
+  } catch (error) {
+    const message = error instanceof Error ? error.message : "Environment launch failed";
+    console.error(message.startsWith("Cannot read dotenv") || message.startsWith("Usage:")
+      ? message : "Cannot launch command; ensure it is executable (for Fanout, run just build)");
+    process.exitCode = 1;
+  }
+}
diff --git a/scripts/run-fanout.test.ts b/scripts/run-fanout.test.ts
new file mode 100644
index 00000000..73aa8990
--- /dev/null
+++ b/scripts/run-fanout.test.ts
@@ -0,0 +1,113 @@
+import { afterEach, expect, test } from "bun:test";
+import { copyFileSync, mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { spawn } from "node:child_process";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+import { pathToFileURL } from "node:url";
+import { main, prepareEnvironment } from "./run-fanout.mjs";
+
+const roots: string[] = [];
+afterEach(() => { for (const root of roots.splice(0)) rmSync(root, { recursive: true, force: true }); });
+
+function fixture(): string {
+  const root = mkdtempSync(join(tmpdir(), "fanout-env-"));
+  roots.push(root);
+  return root;
+}
+
+test("dotenv is optional and inherited values win, including empty values", () => {
+  const root = fixture();
+  expect(prepareEnvironment(root, { PATH: "/synthetic/path" })).toEqual({ PATH: "/synthetic/path" });
+  writeFileSync(join(root, ".env"), "FANOUT_ADDR=:9000\nFANOUT_AI_MODEL=personal\nANTHROPIC_API_KEY=synthetic-only\nFANOUT_UNKNOWN=value\n");
+  const env = prepareEnvironment(root, { FANOUT_ADDR: "", FANOUT_AI_MODEL: "injected", PATH: "/synthetic/path" });
+  expect(env.FANOUT_ADDR).toBe("");
+  expect(env.FANOUT_AI_MODEL).toBe("injected");
+  expect(env.ANTHROPIC_API_KEY).toBe("synthetic-only");
+  expect(env.FANOUT_UNKNOWN).toBe("value");
+  expect(env.PATH).toBe("/synthetic/path");
+});
+
+test("dotenv parsing preserves literal shell text, CRLF, and multiline values", () => {
+  const root = fixture();
+  writeFileSync(join(root, ".env"), `FANOUT_DATA_DIR='  $HOME $(printf unsafe) "quoted"  '
+FANOUT_AI_MODEL="line one
+line two"
+`.replace(/\n/g, "\r\n"));
+  const env = prepareEnvironment(root, {});
+  expect(env.FANOUT_DATA_DIR).toBe('  $HOME $(printf unsafe) "quoted"  ');
+  expect(env.FANOUT_AI_MODEL).toBe("line one\nline two");
+  const result = Bun.spawnSync(["node", "--input-type=module", "-e",
+    "const {prepareEnvironment}=await import(process.argv[2]); process.stdout.write(JSON.stringify(prepareEnvironment(process.argv[1], {})));",
+    root, pathToFileURL(join(import.meta.dir, "run-fanout.mjs")).href], { cwd: root });
+  expect(result.exitCode).toBe(0);
+  expect(JSON.parse(result.stdout.toString())).toEqual(env);
+});
+
+test("unreadable dotenv fails and launcher requires a command", async () => {
+  const root = fixture();
+  mkdirSync(join(root, ".env"));
+  expect(() => prepareEnvironment(root, {})).toThrow("Cannot read dotenv");
+  await expect(main([])).rejects.toThrow("Usage:");
+  await expect(main(["--"])).rejects.toThrow("Usage:");
+});
+
+function launchFixture(childCode: string) {
+  const root = fixture();
+  mkdirSync(join(root, "scripts"));
+  copyFileSync(join(import.meta.dir, "run-fanout.mjs"), join(root, "scripts/run-fanout.mjs"));
+  const harness = `
+import { main } from './scripts/run-fanout.mjs';
+const signals = ['SIGINT', 'SIGTERM', 'SIGHUP'];
+const before = signals.map(signal => process.listenerCount(signal));
+const code = await main(['--', process.execPath, '-e', process.argv[2]]);
+console.log('cleanup:' + signals.every((signal, index) => process.listenerCount(signal) === before[index]));
+process.exitCode = code;
+`;
+  writeFileSync(join(root, "harness.mjs"), harness);
+  return spawn("node", [join(root, "harness.mjs"), childCode], { env: { PATH: process.env.PATH }, stdio: ["ignore", "pipe", "pipe"] });
+}
+
+test("launcher forwards repeated SIGINT, SIGTERM, and SIGHUP until exit and removes handlers", async () => {
+  const signals = ["SIGINT", "SIGTERM", "SIGHUP", "SIGINT", "SIGTERM", "SIGHUP"] as const;
+  const launcher = launchFixture(`
+let count = 0;
+setTimeout(() => process.exit(1), 10000);
+for (const signal of ['SIGINT', 'SIGTERM', 'SIGHUP']) process.on(signal, () => {
+  console.log(signal);
+  if (++count === 6) process.exit(0);
+});
+console.log('ready');
+`);
+  let output = "";
+  let index = 0;
+  const result = new Promise<number | null>((resolveExit, reject) => {
+    launcher.once("error", reject);
+    launcher.once("close", code => resolveExit(code));
+    // Acknowledgement of each delivery avoids timing-dependent signal coalescing.
+    launcher.stdout.on("data", data => {
+      output += data.toString();
+      const lines = output.trimEnd().split("\n");
+      if (lines.length === index + 1 && index < signals.length) launcher.kill(signals[index++]);
+    });
+  });
+  try {
+    expect(await result).toBe(0);
+    expect(output.trimEnd().split("\n")).toEqual(["ready", ...signals, "cleanup:true"]);
+  } finally {
+    if (launcher.exitCode === null) launcher.kill("SIGKILL");
+  }
+}, 15000);
+
+test("launcher maps child signal exits to conventional codes and removes handlers", async () => {
+  for (const [signal, code] of [["SIGINT", 130], ["SIGTERM", 143], ["SIGHUP", 129]] as const) {
+    const launcher = launchFixture(`process.kill(process.pid, '${signal}');`);
+    let output = "";
+    launcher.stdout.on("data", data => { output += data.toString(); });
+    const exitCode = await new Promise<number | null>((resolveExit, reject) => {
+      launcher.once("error", reject);
+      launcher.once("close", code => resolveExit(code));
+    });
+    expect(exitCode).toBe(code);
+    expect(output.trim()).toBe("cleanup:true");
+  }
+});
diff --git a/site/public/diagrams/architecture.svg b/site/public/diagrams/architecture.svg
index 01633b3e..18433e2a 100644
--- a/site/public/diagrams/architecture.svg
+++ b/site/public/diagrams/architecture.svg
@@ -1,24 +1,24 @@
-<?xml version="1.0" encoding="utf-8"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" data-d2-version="v0.7.1-HEAD" preserveAspectRatio="xMinYMin meet" viewBox="0 0 2211 1635"><svg class="d2-625626608 d2-svg" width="2211" height="1635" viewBox="-101 -121 2211 1635"><rect x="-101.000000" y="-121.000000" width="2211.000000" height="1635.000000" rx="0.000000" fill="#FFFFFF" class=" fill-N7" stroke-width="0" /><style type="text/css"><![CDATA[
-.d2-625626608 .text {
-	font-family: "d2-625626608-font-regular";
+<?xml version="1.0" encoding="utf-8"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" data-d2-version="v0.7.1-HEAD" preserveAspectRatio="xMinYMin meet" viewBox="0 0 2220 1635"><svg class="d2-37886755 d2-svg" width="2220" height="1635" viewBox="-101 -121 2220 1635"><rect x="-101.000000" y="-121.000000" width="2220.000000" height="1635.000000" rx="0.000000" fill="#FFFFFF" class=" fill-N7" stroke-width="0" /><style type="text/css"><![CDATA[
+.d2-37886755 .text {
+	font-family: "d2-37886755-font-regular";
 }
 @font-face {
-	font-family: d2-625626608-font-regular;
-	src: url("data:application/font-woff;base64,d09GRgABAAAAABNoAAoAAAAAHTgAAguFAAAAAAAAAAAAAAAAAAAAAAAAAABPUy8yAAAA9AAAAGAAAABgXd/Vo2NtYXAAAAFUAAAAxgAAAS4G2ygtZ2x5ZgAAAhwAAAxAAAAQ6FHrM5doZWFkAAAOXAAAADYAAAA2G4Ue32hoZWEAAA6UAAAAJAAAACQKhAX9aG10eAAADrgAAADJAAAA7HCLDEJsb2NhAAAPhAAAAHgAAAB4hFCIfm1heHAAAA/8AAAAIAAAACAAUwD2bmFtZQAAEBwAAAMrAAAIFAbDVU1wb3N0AAATSAAAACAAAAAg/9EAMgADAgkBkAAFAAACigJYAAAASwKKAlgAAAFeADIBIwAAAgsFAwMEAwICBGAAAvcAAAADAAAAAAAAAABBREJPAEAAIP//Au7/BgAAA9gBESAAAZ8AAAAAAeYClAAAACAAA3icjM7JLkMBHMXh72pRtMaap9uaSs1Uxc5CRESsrBtL8QRei73hKWx5jCL5i7uS2MjZ/pLvIJGToCifVFGTyitI1a3bsGnLtl0NTUdOnLlwpeXGXVqO4E+5n5XHTp271HLt9qeMdyVduuUU4is+4yPa0Y6XeI6neIzXeIj7t0r25X9LHGbajuYvf0+HnLzOzCro0atPUUm/AYOGDBtxoGzUmHETJk2ZNmPWnHmpiqoFi5YsW1Gzak1dg28AAAD//wMAoQMtFAAAeJx0V2twG9d5/e4FiCUJ8LECFkuAAIHdJbHEiyCxWCxJgACJBwmR4AsgxZdIPUyJpGSpEtXIlUVTTRxLnsR1kcYeexzFURrPNG7jxp7MyPF4Op1ascvWsd3MtHVcp46bH4wndpqGZZq6MRedXYAUqWl/7c7O7r3nnO9859sLFTADgEX8BGigCurgEFAAAsmQLQzPc4QkSBJHayQekcQM+olcQOhwSBsOazsSHyeuXLuGptfxEzv3d39xaen1hQcekP9o8yM5iN7+CDBoALAdF6AKSAAjIfAuF8/pdBqjYOR4jnjT8brjkLNeW+f8lw8WPpiJ/SqOfm9xUTrX1XVOnsWFnQsbGwAAGpgFwM24ACRYgVOwCUGzmTLpCEq96DiNEAyLIRfHkbs3s3eSp7o6ApGh+IXB9RMTg8PDp1YnF+aPrOKCs7+7Y7ROqx9J9R7xoCvdwa72ne14oqcLABCEitu4Ed8EO0AF63KJoXBYCJppwuXiWJ2OMpnNQjAs0TodyuU+P5T9Yj561Oa3JjyxeSE4FwsMOtr4k4bxp8+eeTrX4Qzb2L7LudyVRCsb8gcBAKtcQrgAlYomKhPKpOP4PdzPPf3s15+cHLp06dKlIVx4/ubX/zL15bW1R1RsswDoA1wAvfIlQzGUQHEUQ82iB+X3Pv0UdeBC/9sD/z6wx8OFb4Lz/+Oh0BA5USB1OnT0yPXsyKNTqXlbmyURTJwUL65wvcYvv+tYKVMRmsLW5r7LubWvUIf+Ii1/wnjLeHBwF4/iGIHkSIaczaOOiQn5HVyQf4mMOxeQKL+5ix9ewAXFF8r7s3lc2LlQXieOC2AoPReQQBg5DUHN5jWIXHjrl/M/uIgL8svo8P/IZ9DkI/9QXgv9EBegorw3NZtHDlzYeVmhX17zIVxQ6iiQgtFspoVwWDIqCENhiSM0nIbnzGaKnF1cN9AGrYEyrJ0aqdRoQ2vSWkirIXBB/lM2zbJpFi3sXEArvrPeJ+XvoIknvWd98lNqLRWvnMI3oe4et6im5INhtaSsIrYZZXPXBgau5fLrmcx6PjLVfmZ6+kz7tGHimZWVp8bHn1pZeWbicPJK7sHHH38wdyUJe17Rq/qa9rme48i7Nn918Hzs+v33nzySnzqygAvNk5mlRfkzlOnrH5DKGOfwJXwTasAD0HIAUwXr4tvwfszEXXdn9zAizdyD9oH7oyX03cv99KRoZmvq64JdyasTCuCJq8kPZpLV039yvMRloTBj8PoqtL26qj0eTlyAWqD38VBqvJ/KW8nlyFjqzxaefeD8cC43fB4XuPFUdp6Uf4Yo+WM0E+/tCym6IPAUt9Gv8E3wq6rzkopaDLlc/F0+Zacr2tN0E1bYofr0ZW+QOyb0ZewdjgVHj1tciEQWOX/T4TYpyQSt866e5vCiQfR1t/gj7WyrrdZd40m0B0f9/uawnQn5HG6rvrXe39cRmgwCAhsA+gwXgFBYcSJDceTP3kAfvoEH+/t3bpewThW3cRsuKJmqOoQUyFKGhNVbnQ4lk2djeXfa6+t3j8XOGMJrK+jz8kOjcy7X3Ch6WL62shZW67iNXkJbYIVmAJpVgkkKqRQJXi0gRXI8p9PxwbAk6pT6vtYz/sdfI72tnkG7k72ve2YsRWjYcTMX466cCBoO941Nko5OzmnqMrvPzcn/3G3zJFjHjbpowN0CGHLFbfQ7vAHGcoLwHMGRAkWU9ir5W6kbq6YwcrOHnRoikcPMaOuxk5Fj/dHRSNrRyznjBsYexBuvTdv56xfzl2Pppdmx+1hn0UaX9GkrbqPvoi2wHeige3JKMeSh3uVo39lYe9rioQJ2X5rPJ9luczMzZoiujuVWoywdNjYEJjvzS3aTZGcU3wWK2+i9XQ4lzRT0NC8Ku2JJ4t5G/z13PnJC8sSc2nyK0Niylt6oo6uJj7v6DY9cGb0Ua7LmX93p7LK500nZRgfynVP3AVbx/z3aggZwHGCgGJzZaycNo0qF6L4zsfiiNH8KYfn7FVP9XKTR7hh9E2njXcK4oWd1dGw1trZcY6kaPkqRYVMTcg0Oj6o6NQGgOP5HxUeK1yQxVNaJYyllDpDHE4n0YdpTf6jRllpaQt+KVQwPTlURccPCcFKeV+eov+hEn6At6IAeGN5zkejad1EXFSiuPFhZXpVGKNdcs1tzymQ2lvuWdZXe+a+ZCy7mkIU1NvDBiQ5Tc83ziyTdPhbk2ZpDLR0Lk5PR81lPT9TrjfaE+yeEwEQtU29tGPowFXd0mbX6VpujrUZrSnnFEQ9REa8XHaGsm9Q3mugmqcefDaCX4qIYjYpiXH60x8VatVqjh+LbVG1yAOhdvFFOyV2PKkmvYCXIXE7DDQeHB3K+9pZIC954bZEJnJiXf4jcqZirRb4FxSKkAeB7+DZ2gfIfoIPuNdhbexNv7M0mozKbeILKjWvemfvWK7OPz+ENuQnBHflff3HmD8vfFLfhx3gD6koaK32+a4Tn29y52iotQegrzYYuEZ/eecJIIhTTaks88K/RFjDqXsrAUqpxgA2xd82lCI0z6+2M17lGfEOHc762cCrnC4RTaLOfC3T43KFdikPyrfJlVyu0Bab9e+zXKkVouJE9sdTFDmhV9vx/oC2og8b/c+7teQTVRZbi8aVI9HQ8fjoaHx6Ox0ZGyv0aXc2NrUZTS/mJ5eWJ/JLSr7migH6Htsr9ehed6kQXT1Nlz5UyRxGAGfUunIwc62STLH5AjZx4MxN7C3+v09Z642LucqzJOvkc0h3IHCUXBPTe7j4VoqQuv2d+SSA1+3MBXdfahzylcOhlcGXinb1geOuFaVurGg52e9vOMNLdTYZd7yygrfKfXolNOdlKQlsybjtdbzDVOZIWtDndFq7OaLXBmKz+9yKwFbfRw2hLmdz0wTmnjrl7plxpyP0otMC5nSlvezsjNLIJz8yof8TWagk727xN7Y1cyu8eNfA2ycL4HRaWrq5hRHdk1EmHjA0eG22n9DWM1MYnWtX9G4rbKI3PA132MSdKkqCGzZ6fPx7pyWSr0w8/zHhqmgz1poBhNoNqYhWPPpqUt/wdVdoYoVfXGipuo7fRJpju6QmyHMUfDmfy3nZXhFV0YbOGE/MoJL+bivFeNCNbs63tgJQeRH+LNqEGQNDs+6fTvPrdyaN6Wq/V09VHx7+DNuVPmjMcl2lGJtmq8ADAt9EmMPd8t28FTlM6mxCab9yYyFTWEtrK+qqhsWwVWamtrCMGRr6w2F9VV6WtrK9OoU3552ySZZMssuy7s6IKLtXSkubkzwBBLQB6EW2CBUCQeIEubyUJBM2Vz0EEUfuNr8706RtqtHqzPnLkq8/ODNRYa7U1DYaE/NFZo8dk8hjP/vo3F80+ivLSF1UdDcWAqkHjfk9I0gE5avFsvd1QX2mqcofr9Hcm79Nb9Fq9qXpq7GUykP6RTtuHKyL+ZvRz+T8dGZbJOFHNzlZ71q/0oK+4jV7HXwL9btVD5Rbc39efHj937vixc+eOdaZSnZ3ptOGFW9/89re/eeuFxLXHHrt69bHHrqlYmwHQD/CXlJQQxBgWQ/t/V0w6nRLUAtV6/Hp/tKc1ZQu0zsVmTic/l7V2Wl7pOP6VzwlSv98Z8IlLk9GrN0axdgCw0kvon/A6VClOkgRlcilSGkVGRAKpHIiWN7RIa7DWCvK/IfLo1NTWK9aMhfbRcujFMHpa/v3Eiwo2S3Eb/Q1eB+d+HXcRGhmKI+5G2i+yi0yrPdsZGR+MMQG7j0Lx35J0m12aCfecNISZsM0/mkwMmow2JAz8laHWO51OnwiWetineBavq56NYYkRGapWQ7yk44fj8mvoa12ZVpP2D/76+akBIfPIjWeUOY2gr7gN34dV0B+swEMWjrM0cJyBa7RznL2RU94NFI/AG7AKhwBoPhzmdSy375OkyduOsA43cM0WZ0v/n7cb463Ibmt0hPy9J0CZe+pe6H3MQwcAWgGdcgUEbngf1SGrclaTRIFyb74fjyv7ueGn+LeoofScodz47Z92dam+/AL6qPiK8pwWGcqAfrIuSYCgungcjeM31OdIQNVIH5V/c0tz+rNnSvqwsIzewT6Fq3ocFdWAoX58+3bf7dvLd2J37sTulLMUnkObu2fHXA5tKr1d/Ds8CBK+rXxP7iPe4HA0NDgceNBuaWhqarDY4X8BAAD//wMAR5WfdQABAAAAAguF9LN0U18PPPUAAwPoAAAAANhdoKEAAAAA3WYvNv46/tsIbwPIAAAAAwACAAAAAAAAAAEAAAPY/u8AAAiY/jr+OghvAAEAAAAAAAAAAAAAAAAAAAA7eJwsyr1KA1EcRPEzs4UgQbGRFUJYNM36kTSLImIhYqXVvxGvYCs+iJ329r6HdWxsLHwDW70gIakiu6Q6M/DzMzdMwBWFr0g+ofE9yeskP9D4iaQVks9J+ib5i+QXGh8ue0zyJrsu6fuRa81oXBOaMPIeY/0y0pCBZhy4IphyoR+CBVGcEt4hPOhsdP6W0Ct9BaUrLvVJzx+UemOt3crsKzNUZkOZrfYz54w547Y6oi4qav3R0x2rymwzJWDx/g8AAP//AwCOWy4dAAAAAAAALAAsAFAAhgC2ANQA6gEcATQBQAFaAWoBnAHMAe4CMAJYApwCrgLSAwoDPgNsA54D0gP0BGAEggSOBKgExAT2BRgFRAV4BawFzAYMBjIGVAZwBqoG1gcGBywHVgd6B64HyAfeB/4ICggWCCIILgg+CFIIXgh0AAEAAAA7AIwADABmAAcAAQAAAAAAAAAAAAAAAAAEAAN4nJyU32obVxDGf4oltaE0F8UE58acy7Y4KzXYIbGv1nVMlhor1Sr9A6WwltaSkLS77K7kuPQBet236Fvkqs/Rhyi9LjMaKdq0ECxCzLc6M998Z+abA+zyDzvU6veBP5s/GK6x3zw2fI8HzQPDO1w0/jJc34hpMGj8arjJl42u4Y94W//d8Mcc1n82fJ+9+rnhT3hS3zX86Y7jb8MPOOTtEtfgGb8ZrrFHZvgeu/xkeIeHGGetzkPahht8xr7hJvtAjzElU8YkDHFcM2bInJyYgpCYnDHXxAxwBPhMKfXXhEiRY/i/v0aElOREyjiixDElZEpEwcgYf9GslFdaUerkiqSaT8mIiCvNmBCR4EgZkpIQM1GekpKMY1q0KOir3oySAo+CMVM8UnKGtOhwzgU9RowpcJwrkygLSbmm5IZI6zuLkM70iUkoTNWchIHqdKov1uyACxwdMo3dZL6oMBzg+E6zRZvEOL7C0/9uQ1m17kpNxEL7KT28Yqo6b3SCI+241PX5VnHJMW6r/lSVfLhHA1Unsx5zxVznL/OTPFGS4NwePqE6KHSPcJzqd0CoHfmegB4v6fCann77dOnic0mPgBea26GL42s6XHKmGYHi5dm5OuaSH3F8Q6Axwh1bf6Tn8vWGzNwt2sUZco8ZmW6BzFjuL86Pt5qw7FBacUehrujrHkmk7IF0RfYsYmiuyNQVM+3lyhuF9W9gjpDTUmf77ly2YWG7t9riW1LdYcfcNMnkloo+NFXvPc/c6D+PiAEpVxrRJ2VGi5JbvdsrIuZMcZypj1/qlpT46xypc6suiZmpgoBEeXIy/RuZb0LT3q/43tlbIps30x2drG+1TRVhTjZm9Fq7tzoLrcvxxgRaNtXUcmTCwry8qXhfor2K/lDdX+jrlvKYLrG+rjL//D/vwBM82hxyxAkjrSP8CQt7I9r6TrR5zon2YEKsUfJqvtFuCcMRHk854ojnPK1w+pxxSoeTO2hcZnU45cV7J5scbs3ijOcPVdNWvY7H669nW8/r8zv48gsOKi+jKJc9yFkY2zv/XxIxEy1ub7Mv7hHevwAAAP//AwAHW0wwAAADAAAAAAAA/84AMgAAAAAAAAAAAAAAAAAAAAAAAAAA");
+	font-family: d2-37886755-font-regular;
+	src: url("data:application/font-woff;base64,d09GRgABAAAAABOoAAoAAAAAHZgAAguFAAAAAAAAAAAAAAAAAAAAAAAAAABPUy8yAAAA9AAAAGAAAABgXd/Vo2NtYXAAAAFUAAAAvAAAARhGIOgOZ2x5ZgAAAhAAAAyEAAARVGhvYYRoZWFkAAAOlAAAADYAAAA2G4Ue32hoZWEAAA7MAAAAJAAAACQKhAX/aG10eAAADvAAAADQAAAA9HUADPZsb2NhAAAPwAAAAHwAAAB8iryO3m1heHAAABA8AAAAIAAAACAAVQD2bmFtZQAAEFwAAAMrAAAIFAbDVU1wb3N0AAATiAAAACAAAAAg/9EAMgADAgkBkAAFAAACigJYAAAASwKKAlgAAAFeADIBIwAAAgsFAwMEAwICBGAAAvcAAAADAAAAAAAAAABBREJPAEAAIP//Au7/BgAAA9gBESAAAZ8AAAAAAeYClAAAACAAA3ichM25NjMBHMbhZ5L5PtuILfZtjF0SewSd0lGrc5SOK3Bf9NyFktuw/R2j0zhv+zvvg0RVgkyaZCjkUhW5hqaWHbv2tXWcOnep69ptXo/gV3NYNmcudF25+W7iRU2PXn3xGR/xHm/xGo/xEE9xH3fPRSn/tcSJA23Htktpr7QqqlL//P/5129AZlDNkGEjRo2pG9cxYdKUaTNmzZm3YFFuSWHZilVr1m3YtKWhqeWILwAAAP//AwCdiCg8eJx0V2twG+d1vd+HJZYUwMcKWCxBAgR2lwSIF0FisVhSAAERL0Ik+AJIUSRF6mFKJCVLlahGrixaauJY0iSuizT22OPIjtJ4plEbN/ZkRo7H0+nUil22ju1mJq3jOFXc/GA8sZ00LNPUDy46uwAhUtP+2p2d3XvvOffcc/eDKpgCwCJ+HDRQA/WwG2gAgWKpNtbp5ElJkCSe0UhORJFT6OdyAaF9QSIUIrriH8YvXL6MDlzCj2/ev+fLCwuvzT3wgPxnax/IAfTWB4BBA4CtuAA1QAEYSMHpcDh5rVZjEAy8kyffsL1m221vIOrtP7szd2cq+tsY+qP5eelUT88peRoXNs+srgIAaGAaALfiAlDQBLxSmxAwmWijlqTVi5bXCIGQGHTwPLV1M307caynyx8ejJ0ZuHRkfGBo6NjyxNzs/mVcsKf3dI3UE7rh5N79bnRhT6Cnc3MjFu/tAQAEweIGbsbXwQpQxTkcYjAUEgImhnQ4eE6rpY0mkxAISYxWi3K5Lw5mv5yPHLT4muLu6KwQmIn6B2wdzqP6sadOnngq12UPWbi+87nchXg7F/QFAACrWIK4ANUKJyoS2qjlnZW6n3vq2WeemBg8d+7cuUFcuHn9mb9NfnVl5RG1tmkAdAcXQKd8ydIsLdA8zdLT6EH53U8+QV24kH6r/zf9lXd/onJ/911KffPTT3EhfSct/6yC14Gvg/3/w6vAFXlRoLRadHD/lezwtcnkrKXDHA/Ej4pnl/i9hq++Y1sqQxZaQk2tfedzK1+jd/9NSv6I9ZRrwYGtuhVlCRRPsdR0HnWNj8tv44L8MTJsnkGi/MZW7fA8Lij6Ud6fzuPC5plynBgugL70XEACaeA1JD2d1yBq7s2PZ394Fhfkl9C+T+UTaOKRfynHQj/CBagq56an88iGC5svKTSVYz6EC0q/BUowmEyMEApJBqXCYEjiSQ2vcfImE01Nz1/SM3pCT+tXjg1Xa4jgirQSJDQkLsh/yaU4LsWhuc0zaMl70vOE/F00/oTnpFd+spLDhwtgKOVgBIdDpASqEnn/x/2EhhzZ/5t+glDizV8LnAyi/OYZ9MzVrsWgfBOw2qdj+DrU36NMdQCcgZAqH05pmAllc5f7+y/n8pcymUv58GTniQMHTnQe0I8/vbT05NjYk0tLT4/vS1zIPfjYYw/mLiSgokud2iPjtgnjeeruSL0ycDp65f77j+7PT+6fw4XWiczCvPw5yvSl+yU1RrA4g8/h61ALboC2HTVVcQ5nB95eM3l3krKVGpFm5kFr//2RUvV7FtPMhGjiahvqAz2Ji+NKweMXE3emErsO/MXhEpa5wpTe460i9mprKjjsuAB1wGzDoehkO5Q3E4vh0eRfzT37wOmhXG7oNC7wY8nsLCX/EtHyh2gqtrcvqPCCwF3cQL/F18Gnsu6U1KrFoMPhvIunPC0K9wzTghV0qCF13hPgDwl9GWuXbc7W6xLnwuF53teyr0NKsIGmWUdva2heL3r3tPnCnVy7pc5V6453BkZ8vtaQlQ16ba4mXXuDr68rOBEABBYA9DkuAKmg4kWW5qlfvo7efx0PpNObt0q1ThY3cAcuKP6tKoQSqJJfhRS5KVUlEiejeVfK4027RqMn9KGVJfRF+aGRGYdjZgQ9LF9eWgmpfdxAL6J1aIJWAIZTTFAKqhBJp9pAmuKdvFbrDIQkUav099XesT//BuVpdw9Y7dx9e6ZGk6SGGzPxUf7CkYB+X9/oBGXr5u3GHpPr1Iz8b3ss7jhnu1of8bvaAEOuuIE+w6tgKLuQkyd5SqDJUq6SvpW+carjIxe3z64h4znMjrQfOho+lI6MhFO2vbw9pmetAbz66gGr88rZ/PloamF69D7OXrQwJX46ihvoe2gdLDsm6B6vUwS5e+9ipO9ktDNldtN+qzflzCe4PaZWdlQfWR7NLUc4JmRo9E905xesRsnKKrrzFzfQu1sYSpwp1TNOUdgiSxIrif5n5nT4iOSO2ol8ktRYsua9EVtPizPmSOsfuTByLtrSlH9ls7vH4kolZAvjz3dP3gdYrf+f0To0gm0HAkXgbGWcNKxKFWL6TkRj89LsMYTlH1RNpvlws9U28gYiYj3CmL53eWR0ObqyWGuuGTpIUyFjC3IMDI2oPLUAoBj+iaIjRWuSGCzzxHO0ukcOx+OpfYy7YXezJbmwgL4drRoamKwhY/q5oYQ8q+5sX9GOPkLr0AW9MFRRkejYdlGDCjRfXuKcU6VGKPdcs9Vz2mgylOeWc5Te+e+pMw52t5kzNDoD413G1tqb8xTTORpwcrW727rmJiYip7Pu3ojHE+kNpccF/3gd29DUOPh+MmbrMRG6douto5YwJj3isJusijWItmDWRemajUyL1OvL+tGLMVGMREQxJl/rdXBNBGFw084OlZscAHoHr5ZdckujyrZQaiWpXE7DDwWG+nPezrZwG159dZ71H5mVf4RcyaijTb4BxSKkAOD7+BZ2wB4A0EJ4BSqx1/BqZb8ZlP3mJOncmObtmW+/PP3YDF6VWxDclv/91yf+tPxNcQN+ilehvsSxMudbQrjZ4crV1RAkqas26XtEfHzzcQOFUJQgSjjw79A6sGouZekp3diBhqxcc0lSY896umP1jmHv4L6ctyOUzHn9oSRaS/P+Lq8ruAVxUL5RvmxxhdbBuD3Hdq6SpIYfrpClBtvBVVnz/4nWoR6a/8+9V9EIqg8vxGIL4cjxWOx4JDY0FIsOD5fnNbKcG12OJBfy44uL4/kFZV5zRQF9htbL83q3OlWJDidDlzVX8hyFAHbEM3c0fKibS3D4AdVyYq1s9E38/W5L+9WzufPRlqaJ55B2h+coviCgd7fyVImSGr4ifkmgNNt9AV0hrIPukjnsZXF1/O2KMbz5/AFLu2oOVmvH5hDS3nWGLe3MofXyX2UJTdnZSkSbMy4r06A31tsSZrR2oCO0K0MQgais/mMjsBQ30MNoXdnczM49p665e7Zcacn9ODjHu+xJT2cnKzRzcffUiG/Y0m4O2Ts8LZ3NfNLnGtE7LZKZ9dnMHLOrlhVd4RE7EzQ0ui2MldbVslKHM96u5m8sbqAUPg1MWce8KEmCajYVPX843JvJ7ko9/DDrrm3RNxj9+ukMqo1WXbuWkNd9XTVElNSpsQaLG+gttAbGe2aCKlvx+0OZvKfTEeYUXris/sgsCsrvJKNOD5qSm7LtnYCUGUT/iNagFkDQbPsv1LzyvYmDOkZH6JhdB8e+i9bkj1ozPJ9pRUa5ScEBgG+hNWDv+W5bBF5TOgeRmm9eHc9U15FEdUPN4Gi2hqomquvJ/uEvzadr6muI6oZdSbQm/4pLcFyCQ+Ztd02oik+2taV4+XNAUAeAXkBrYAYQJKfAlFNJAsnw5TMXSdZ98+tTfbrGWkJn0oX3f/3Zqf7apjqitlEflz84aXAbjW7Dyd/9/qzJS9Me5qzKo77oVzlo3q4JSdpBRx2ebrDqG6qNNa5Qve72xH06s47QGXdNjr5E+VM/1hJ9uCrsa0W/kv/LluHYjB3Vbq53Zn3KDHqLG+g1/BXQbXU9WB7B7XP9yeFTpw4fOnXqUHcy2d2dSumfv/Gt73znWzeej19+9NGLFx999LJaaysA+iH+iuISghjFYnD774pRq1WMWqDbD19JR3rbkxZ/+0x06njiC9mmbvPLXYe/9gVBSvvsfq+4MBG5eHUEE/2AlVlC/4ovQY2iJElQNpdCpUFkRSRQyuFrcZVAhL6pTpD/A1EHJyfXX27KmBkvIwdfCKGn5D+Ov6DUZi5uoH/Al8C+ncetCg0szZN3Le3X2Xm23ZrtDo8NRFm/1Uuj2B8opsMqTYV6j+pDbMjiG0nEB4wGCxL6/05f5zmQSh0JlGbYq2gWX1I1G8USK7J0nYZ8Uescismvom/0ZNqNxJ/8/c3JfiHzyNWnlT2NwF/cD6/DMuwGYJyhkFPL8dsakTB6OhHW4ka+1WxvS/91pyHWjqyWZlvQt/cIKLusr7gBP0DvYSdEANASaJUrIHDBe6geNSlnOEkUaNfae7GYks8Fv8B/QI2l5yztwm/9oqdH1dqX0AfFl5XnjMjSevTzS5IECHYVD6Mx/Lr6HAloF9JF5N/f0Bz//OkSZg4W0dvYq5wt1WOqqJoG/dNbt/pu3Vq8Hb19O3q77I/wHFrbOlPmcmhNmdfiP+EBkPAt5XtqG/BGm62x0WbDA1ZzY0tLo9mqxFCxwjLodqr1ITPPmxt5Xs83W3ne2szD/wIAAP//AwCxTLsVAAEAAAACC4UzWYfJXw889QADA+gAAAAA2F2goQAAAADdZi82/jr+2whvA8gAAAADAAIAAAAAAAAAAQAAA9j+7wAACJj+Ov46CG8AAQAAAAAAAAAAAAAAAAAAAD14nCzKvUoDURxE8TOzhSBBsZEVQlg0zfqRNIsiYhHESqvbiH/BVnwQsdHe3vewjo2NhW9gqV6QkK0iCVYzB35+5JIxuKLwOeEjGt8QXiX0RfiWxg+ElgifEPok/EH4nvATjff/95DwOtsu6fqOC01pXJM0ZuAdhvphoD49TdlzRWLCqb5JzEjFMclbJPcWNi38FUnPdJUoXXGmdzp+o9QLK/OvzK4yfWXWlNmYNy1DWkY6oC4qav3S0TXLymwyIcHslZbRHwAAAP//AwByWDBJAAAALAAsAFAAhgC2ANQA6gD+ATABSAFUAW4BfgGwAdICAgIkAmYCjgLSAuQDCANAA3QDogPUBAgEKgSWBLgExATeBPoFLAVOBXoFrgXiBgIGQgZoBooGpgbgBwwHPAdiB4wHsAfkB/4IHggqCDYIQghOCF4Icgh+CJQIqgABAAAAPQCMAAwAZgAHAAEAAAAAAAAAAAAAAAAABAADeJyclN9qG1cQxn+KJbWhNBfFBOfGnMu2OCs12CGxr9Z1TJYaK9Uq/QOlsJbWkpC0u+yu5Lj0AXrdt+hb5KrP0YcovS4zGinatBAsQsy3OjPffGfmmwPs8g871Or3gT+bPxiusd88NnyPB80DwztcNP4yXN+IaTBo/Gq4yZeNruGPeFv/3fDHHNZ/Nnyfvfq54U94Ut81/OmO42/DDzjk7RLX4Bm/Ga6xR2b4Hrv8ZHiHhxhnrc5D2oYbfMa+4Sb7QI8xJVPGJAxxXDNmyJycmIKQmJwx18QMcAT4TCn114RIkWP4v79GhJTkRMo4osQxJWRKRMHIGH/RrJRXWlHq5Iqkmk/JiIgrzZgQkeBIGZKSEDNRnpKSjGNatCjoq96MkgKPgjFTPFJyhrTocM4FPUaMKXCcK5MoC0m5puSGSOs7i5DO9IlJKEzVnISB6nSqL9bsgAscHTKN3WS+qDAc4PhOs0WbxDi+wtP/bkNZte5KTcRC+yk9vGKqOm90giPtuNT1+VZxyTFuq/5UlXy4RwNVJ7Mec8Vc5y/zkzxRkuDcHj6hOih0j3Cc6ndAqB35noAeL+nwmp5++3Tp4nNJj4AXmtuhi+NrOlxyphmB4uXZuTrmkh9xfEOgMcIdW3+k5/L1hszcLdrFGXKPGZlugcxY7i/Oj7easOxQWnFHoa7o6x5JpOyBdEX2LGJorsjUFTPt5cobhfVvYI6Q01Jn++5ctmFhu7fa4ltS3WHH3DTJ5JaKPjRV7z3P3Og/j4gBKVca0SdlRouSW73bKyLmTHGcqY9f6paU+OscqXOrLomZqYKARHlyMv0bmW9C096v+N7ZWyKbN9MdnaxvtU0VYU42ZvRau7c6C63L8cYEWjbV1HJkwsK8vKl4X6K9iv5Q3V/o65bymC6xvq4y//w/78ATPNoccsQJI60j/AkLeyPa+k60ec6J9mBCrFHyar7RbgnDER5POeKI5zytcPqccUqHkztoXGZ1OOXFeyebHG7N4oznD1XTVr2Ox+uvZ1vP6/M7+PILDiovoyiXPchZGNs7/18SMRMtbm+zL+4R3r8AAAD//wMAB1tMMAAAAwAAAAAAAP/OADIAAAAAAAAAAAAAAAAAAAAAAAAAAA==");
 }
-.d2-625626608 .text-bold {
-	font-family: "d2-625626608-font-bold";
+.d2-37886755 .text-bold {
+	font-family: "d2-37886755-font-bold";
 }
 @font-face {
-	font-family: d2-625626608-font-bold;
-	src: url("data:application/font-woff;base64,d09GRgABAAAAABNIAAoAAAAAHQQAAguFAAAAAAAAAAAAAAAAAAAAAAAAAABPUy8yAAAA9AAAAGAAAABgXxHXrmNtYXAAAAFUAAAAxgAAAS4G2ygtZ2x5ZgAAAhwAAAwdAAAQnFrSemRoZWFkAAAOPAAAADYAAAA2G38e1GhoZWEAAA50AAAAJAAAACQKfwX6aG10eAAADpgAAADIAAAA7HcRCkZsb2NhAAAPYAAAAHgAAAB4gWiFim1heHAAAA/YAAAAIAAAACAAUwD3bmFtZQAAD/gAAAMvAAAIKgjwVkFwb3N0AAATKAAAACAAAAAg/9EAMgADAioCvAAFAAACigJYAAAASwKKAlgAAAFeADIBKQAAAgsHAwMEAwICBGAAAvcAAAADAAAAAAAAAABBREJPACAAIP//Au7/BgAAA9gBESAAAZ8AAAAAAfAClAAAACAAA3icjM7JLkMBHMXh72pRtMaap9uaSs1Uxc5CRESsrBtL8QRei73hKWx5jCL5i7uS2MjZ/pLvIJGToCifVFGTyitI1a3bsGnLtl0NTUdOnLlwpeXGXVqO4E+5n5XHTp271HLt9qeMdyVduuUU4is+4yPa0Y6XeI6neIzXeIj7t0r25X9LHGbajuYvf0+HnLzOzCro0atPUUm/AYOGDBtxoGzUmHETJk2ZNmPWnHmpiqoFi5YsW1Gzak1dg28AAAD//wMAoQMtFAAAeJyEV2twG9d1PvcCxIrg8gEsFguAxHOJXTxIkMBiAT5AghDBhyiAT4mkLL7CkWVKoihGoiLaoqLO+NU6UOWYjErbra1o7Gma2qk9bmdUd9ROPRO7ajT5UTvNn8SxG48miac2k2HSxCYXnbsEKUjtTH4Ql7Oz95zvfPc739kLJTAIgGfxGmigFCrBCCyAZHAbvJIo8lRcisd5ThMXkYEaxEbl1VdEv9bv1wZc687HpqdRdgqvbc8fzc7O/m66tVV56R/fVq6gc28D4PwXALgT56AUDAAMJYmCIPI6nYaRGF7kqbtV36gsry7X0tYv7rx55y997/lQXyIRXpCip5UncW576cUXAQA0kAXACZwDA9jAQ7BJEbOZNekoVl10vEaKxOSowPMGKaKu2Z+l5zvqfZHO9Nme6a5YOBLtHnk00TaCc/buZHCkUlt+MNV5yI+eDvCCSxkfD3oBEITym7gRr0M1QIlHEORoLCZFzBwlCLxHp2NNZikSi3M6NDn8zMjhK8PJY+5+a5yvOxAc7fUlLf3DdOZbp+efH5I8U5w9MrX/2GKtdWIGMGQBcAbnQA9sEXodL0qRGMFNAN889tzQ4NWZ+pqmkVBopKkG59JXFxef67ngm+jvP+IFgi8LgD7HOSgjHLhZNyuxPOtms2hd+fLDD1Elzq08fvHaCuzWksbr4Pz/aimUIvOyZNDp0Okj3zw89uxYz3FX1toUyMxMHDUJ9Pxnnq8WCoq6p8yOxdlji3r94rLygTu0gwUf3sUisZIsGXgDb8iufry29jHOffnl9hKqUjZ2ccNHOAca9V1DdhXntpcKMeZxDuid5xIjaRheQ7HZVe07N77/y2+/nME55beoTNlSlhFz7O92OfgvnIOSnT1uNruKMM5tb5CyCzFfxzlSN4loNnNSLBZnJANPKIjzFMWLIu/ALJv99gm9Ua/VG/SPXH+KKtVo5cmhyahWu4/COeXDmnaHo70GebaXPncNDDpf/MMfXnQODrg+B8Aqt1/H61D5gFJUMYo7UlRJRqPjTx48+OT4zm9nf39nZ38/Pfz8yVPfGhi4dvLk88OXl2ZnFxZmZ5dIXKKTRpUPU5HKdTzP7un6o97z3d1LXUO9yx2JNM6JEwOZ2YafouE5KUDqJ9j68HW8DmUgAHiLsXgE8T6klLmgZx0aLUBDtkee5ecu7SBenOYG/Ky3wmZsnT8/R1DOnVc+fDhj/t4zO/Af/9tqj4PSniotL2AfwTmoAK64Q0mjE/QqDj77adfZdFJee/XSUKalra0lg3Pe8f7eSU758tNP0Uy4sVEgZ8znN7Eer0NAZVeMq0DlqCCKIfx/hMxxaiYdMnVcjhziR32heil42J0QWk+kmxYDB10dolDfHDjU2t2yQDeGHnYIHrvTbqytaOhuiI1H6wKT1mpnjcNh8FgOdcUmmgCBFQAzOAcUqYSX3SxvuPMW+uItXLWysk0kDQgO5DfxgOpJBKNskAxqT6n/6FD/5afWWuLxxJ8/Tl97BU0pqzOZzAw6rdx45RpgCOQ30QdoC6zAA3Aecihx1WMoUS2ONfDEJ+OkRVXf+ef04BOrmPc7O2rlhlMt08eX9Vpnzz6rl+lPOOmxZP94pVu0sF+x1y6cVT6RavizHDOmD9otnKqJVH4Tm/EtMBXcQOQp3iCx1AOi5T3EUFGXu9Oupc+tau1pT2K8ITE9LsRG6/wmH+12yfjWaxmbvf2rmcOPJpe7M0/V/8BYofJRm99Et9AW2B70m3t2w+l0yNp1JtX7tXSop6aLd8nJZKMlxLR4R+m288MjS20ObtqeSXVk2coZVzXhGYOY30Rb+BYw4NrliqDmRFkqYmlXDL+ZONM6HfU3WXWry3qtrRtbRCMTNPGxBvobjw6db6+xZP5muzNs45dN1h8YKzp7DnQBVrF/jLbA8oBbEl1RbqI+0iUaKUqyIGfP2f2d8609kw1arPxY3x2WY2Fh6oW3xDpPjG5fGh5aSiZPpRlvaUxyH7E5UItfbiC1ILAAoCV8m6xEV/EHtEzs3PDQ/v21g53OaFV1uY2udhw5gi6dLqmWR6O0br6kxC04zimPA2jAk6/HFNqCBmiFPpUZQY7GZRV7YYlJEU5i+YKJeERCkETkZdLpNEXOwBS60yOor/ymZaqph6l2WWz+lim5zv0PA1RpdDxudxo9/sGJr6RX+uyiaLeLoj/SIXolq5uubnvf1lSX8GnLfc7qSJXWmA4mBnz0qTKPqbmvVl9pZoytndJQCN0O+EW/z+cPKKu1Vq5Ko7FYa+w73KTIYasaBWlPm6yBN6ikU4bUKlVzMDJ0YNXuqvFZ8K3XjliDpyaVO8gd81k55U3I5yEOAD/F72MBmgGAghZ4Zi+2A9/amzNxiWJ4kWJTV7V/df17//TyYhLfUha+f0f5yb/2PEbez28iI74FlSqve71NRPBvmdZVQ2kJpTPSXvroQcxv/5gzInS6hCL7ADR2tAVuNQ8ZPOR076uE2ltTpIe7w3KKcfeFBw+u2l3eRvLTgDY6nPVBnye8W16j8mZh2eUJbYGpOEcxT8t6rSu7RxTaSDrq7+NpR++qdv74/DInz6TTZ5LJhXR6IVkfCtWH6usLvdq2NDJ8vu1CtiOVIS1LYKXyvdiMtoABBwB3D50qP0HkWOaezZDy7QfEh+YS0zFXwlYyIMRGgwGT7yb+TtjG/9m5w8vJauvAN1HtnskQL+hFW2p8F0CJHFfD7jaRFJcMmmIvQCd01v2eHUNoJ472yZ4Z3PyLjMWpGoLdFd4eR7X33KCgF3QVbYHxvnOkhHsMV2cEtkZvKbdW1bSZ0MZYJFxSclmr9UeUjwABm99EL6MtEFX93Jtfws782gtGppcDsybd++FHhP2epNPtsIdsjlbficPNY879tqituVlwtfnnaME5Ya3mGIOZ0dO1zf6uUdEybjKLFmtFGd8c6pzc6SFDfhMt4CUygclMknk5HpeIqxQZMEwMpDOGxy5c4O20Vc8xcfrk6O3TuieeOPdewKvTntLRO7ES+U30e7QBpgd6wFCw3f8cOrDqcNUI5tXlMo2zjz41iaLKz2S/zY56laoubx0g0m8ojzagHEDSSFzhWywuad7667UOPaPXljL61JUbaONX3qwoZr2/Uqp2fRJvoA1wP7CvKAJfuEtQ1NrKc406vU5LlZfGLzeVVlJaqpRq+NMLr9VT5ZSWKqPq0MZdb68g9PF31bXXe1epepfv9vm6+XfVfBUAaBNtkLkvMWJRQoq7l6di/epLdXqzXrvPuM+z/uzzLzXSHK0tNZWKCH82yAZZNsgO5n89zNaxbNA8TOLS+Xa0jTagulgH8fh9VFTgZbO70kYZ93l9eupf1nrKjHrtPkNp4sprXNPAOzrtIiqptdvQz3/k6fbyPfyPlLL2w4VvPW9+E32Kn4ayQh/L0UK7ibv3ip1rixntO37p0nHyZ/VxnM9q8VksPvq7N268+uqNG989650aG5vweCbGxqbUe5ADAH2Cn4YaAElux3K06NuEhNeRLweJ9Q5d6g77PXHLYMNsOjklt05ELQnznxzKXjpR3xAWbQMRKXK0TT5zJqYpWSH+wACg3+OLUEpUxUhkUpEjZGS3zBDT59nrT5UgLW2riCj//Yu/P3AA7XvEOeSwxaqVhfWH0deVK4vrBB+X30Qf4YvgLOZ1FyXjZnlqD+n/9M8L++1pX7ilqa7Ga99vRHO/LHML8aNNqZN01Dtp80bCjZEKYwClVi5UBsbS3ceiqibqANBdfFHVbjuOu2U3W6GhXtZ5uhPKz9Hb8U5vlfbkd14YWXmo82sXnyUNiKAtvwmfw+vkTsQVncY1QZIEQZJoWfTJsk+UybuhfDsCeJ14DCfGYqLHwxdtyTiaWhDWYj4WEyLRiXf6TSlv0CeE+lLDywBk1qm50K+xCGEAlAYdWQFBEG4jNwqTu1Zcltjg727PzZF8Qfgh/i2q23nuZoP43384NaVqdAn9Iv8eec7JbpZGP8mNjACC8vwMiuF31eeMpCm/PXP7uub41gsklgem0Gc4RupU75Dyjsn8xxtvzL/xxtTNuZs3524WfBQ+QBu7977UKtpQqgDlX8fNMILfJ/sNRUV7QyGvNxTCzQGeDwR4PgD/CwAA//8DAEDPjYYAAAAAAQAAAAILhdUA7OdfDzz1AAED6AAAAADYXaCEAAAAAN1mLzb+N/7ECG0D8QABAAMAAgAAAAAAAAABAAAD2P7vAAAImP43/jcIbQABAAAAAAAAAAAAAAAAAAAAO3icLMqxLgRRFMfh3/lPsiEGVyxWs5E1IjHXtCT2FqeRSJxEgkKh5CUkvIFeq6bRegG9V1Fts2Ki+ppPH1zwBSrzmW4JndLpgVBD6JFOr4QdEronNCA0I/RGp6t/7whldpXZ1gtnWuVABbdvGhX2NaCxa0baZKIT3IYcqcFtjFc3uKa42v7637dn3D7ZsCfWdMxUS9TVAiOJFS1SK7GnxFiJdSW2lMiWKZbpes9pqx1a+6G2S5aVmNgQh/n7LwAAAP//AwDdHx+6AAAALAAsAFAAhACwANQA6gEaATABPAFWAWYBmAHEAeYCIgJIAogCmgK4AvADIgNOA4ADtAPaBEIEZARwBIgEpATWBPgFJAVUBYgFqAXkBgoGLAZIBoAGrAbcBwgHNAdYB4oHpAe6B9oH5gfyB/4ICggYCCwIOAhOAAEAAAA7AJAADABjAAcAAQAAAAAAAAAAAAAAAAAEAAN4nJyUz24bZRTFf05s0wrBAkVVuom+BYsitWNTJVXbrCakVkZEcfC4ICSENLYntuXxzMgzdhqegDVvwVt0xUPwHIg1utfXrl0QBSuKdWbm/jnfued+wAF/sk+leh/4rZ4arnBUvza8x736heF9WvU9w1Ue1X43XGNQWxiu83mtY/gj3lZ/MXyP4+qPhu9zWG0Z/pin1QPDn+w7/jD8Kce8XeIKPOdnwxUOyQ3vccAPhvd5gNWsVHlA03CNzzgyXOcI6DKmJGFMyhDHDWOGzJkRUxASM2PMDTEDHAE+CaW+TYkUOYb/+DYipGRGpBVHlDgSQhIiCkZW8SfNyrjWjtJnpki6+ZSMiOhpxoSIFEfGkIyUmInWKSnJeUmDBgV95ZtTUuBRMCbBI2PGkAZtWlzSZcSYAkdLKwmzkIwbSm6JtL+zCFGmT0xKYazmpAyUp1N+sWYHXOJok2vsZuXLrQqPcXyr2cJNYhxf4um/22C23XfFJmKheoqGPRLleasTHKni0tfnG8UlL3E76bPN5MMaDZSdzHpMj7nOX+YnecIkxblDfEJ1UOge4jjT54BQFfmOgC4XtHlNV599OnTwuaJLwCvNbdPB8RVtrjjXjEDx8ltLHXPF9zi+JtAYqR2bPqK5PL0hN3cLd3GGnGNKrlsgM5bzi/PjnSYsO5RtuaNQV/R1jyRS9kBUkT2LGJorcnXFVLVceaMw/QbmCPla6mzffZdtWNjurbb4jkx32DE3TjK5JaMPTdV7zzO3+ucRMSCjpxF9MqY0KLnTs10TMSfBca4+vtAtKfHXOdLnTl0SM1UGAanWmZHrb2S+CY17f8v3zu4S2byp7uhkfapdukjldGNGr1W91bfQVI43JtCwqWaWIxOWysuTivcl2tviH6r7C73dMp5wRkbC4G83wFM8mhxzwikj7SCVUxZ2OzT1hmjyglM9/YRYo+S+fKM6SYUTPJ5xwgkvePaejismzri4NZfN3j7nnNHm9D+dYhnf5oxX63f/3vVXZdrUszierJ+e7zzFR//DrV/weOu+7OgtIJuzsGrvtuKKiKlwcYebWriHeH8BAAD//wMA9LdPUQAAAwAAAAAAAP/OADIAAAAAAAAAAAAAAAAAAAAAAAAAAA==");
+	font-family: d2-37886755-font-bold;
+	src: url("data:application/font-woff;base64,d09GRgABAAAAABOIAAoAAAAAHWQAAguFAAAAAAAAAAAAAAAAAAAAAAAAAABPUy8yAAAA9AAAAGAAAABgXxHXrmNtYXAAAAFUAAAAvAAAARhGIOgOZ2x5ZgAAAhAAAAxgAAARCD8W3F1oZWFkAAAOcAAAADYAAAA2G38e1GhoZWEAAA6oAAAAJAAAACQKfwX8aG10eAAADswAAADNAAAA9Hu2CuBsb2NhAAAPnAAAAHwAAAB8h9KL5m1heHAAABAYAAAAIAAAACAAVQD3bmFtZQAAEDgAAAMvAAAIKgjwVkFwb3N0AAATaAAAACAAAAAg/9EAMgADAioCvAAFAAACigJYAAAASwKKAlgAAAFeADIBKQAAAgsHAwMEAwICBGAAAvcAAAADAAAAAAAAAABBREJPACAAIP//Au7/BgAAA9gBESAAAZ8AAAAAAfAClAAAACAAA3ichM25NjMBHMbhZ5L5PtuILfZtjF0SewSd0lGrc5SOK3Bf9NyFktuw/R2j0zhv+zvvg0RVgkyaZCjkUhW5hqaWHbv2tXWcOnep69ptXo/gV3NYNmcudF25+W7iRU2PXn3xGR/xHm/xGo/xEE9xH3fPRSn/tcSJA23Htktpr7QqqlL//P/5129AZlDNkGEjRo2pG9cxYdKUaTNmzZm3YFFuSWHZilVr1m3YtKWhqeWILwAAAP//AwCdiCg8eJyEV2twG9d1PvdiiRVB8AEsFguAxHOJXYAgQQKLBfgACT7AhyiAT4mkLL7CkWVKoihGoiLaoqLM+NU6UKSYjExbra1o7Gnq2qk9bmdUt2qnnoldNZr8qJ3mT+LYjkd14qnNZJjUsclF5y5BClI7kx/E5ezcPfc73/nOd/ZCAQwA4Bm8ChoohFIwAgsgGdwGrySKPB2TYjGe08REZKAHsFF56UXRT/n9VJVrzfnI1BRKT+LVrblD6ZmZP0w1NSnP/8ObykV0+k0AnP0SAHfgDBSCAYChJVEQRF6r1TASw4s8fafs26XF5cWU3vrl7ddv/4XvHR/qjcdD81LkhPI4zmwtXr0KAKCBNACO4wwYwAYegk0Km82sSUuz6qLlNVI4KkcEnjdIYXVN/zI511rjC3ckT3VPdUZD4UjX8MPx5mGcsXclAsOlVPG+to79fvRkFS+4lLGxgBcAQTC7gevwGpQDFHgEQY5Eo1LYzNGCwHu0WtZklsLRGKdFE0NPDR+4OJQ47O6zxvjqvYGRHl/C0jekT33vxNyzg5JnkrOHJ9sPL1Rax6cBQxoAp3AGdMDmodfyohSOEtwE8I3DTw8OXJquqagfDgaH6ytwJnlpYeHp7rO+8b6+g14g+NIA6HOcgSLCgZt1sxLLs242jdaUr95/H5XizPKj564s7+79ROU+b28aXVW++OgjnFl+ZnkLYCfnJF4D5/+Xcy5lmZclg1aLThz87oHRy6PdR1xpa31Vanr8kEnQz33m+Xou8Yh70uxYmDm8oNMtLCnvuYPbOPCBHcwSK8mSgTfwhvTKh6urH+LMV19tLaIyZX0HM3yAM6BR9xrSKziztZiLMYczoN9+LjGShuE1NJteod66/qNff/+FFM4ov0dFyqayhJjDf7uT/0c4AwXb77jZ9ArCOLO1TujJxXwVZ0jeJKLZzEnRaIyRDDyhIMbTNC+KvAOzbPr7R3VGHaUz6B669gRdqKHkicGJCEXtoXFGeb+ixeFoqUCercXPXf0Dzqt//ONV50C/6/OdM0jdme0zOEkQZJK/RuTNZpZNP/NyK0WVZMhSUIwzyj9djnyr8c7WIur8TnS58b8AAKv1+SZeg9L7VKkKX9yWvVooNDL2+L59j49t/3b09XV09PXph549dvx7/f1Xjh17dujC4szM/PzMzCKJS7DVqZya8jpKy/Psbg990HOmq2uxc7BnqTWexBlxvD81U/sLNDQrVUEOWy++htegCAQAbz4WjyDeg5Q253pHi0Zy0JDtocv87PltxAtTXL+f9ZbYjE1zZ2YJytkzyvsPpsw/fGob/qN/U+5x0NTxwuIc9mGcgRLg8t2AmApBr+Lg0592nkom5NWXzg+mGpubG1M44x3r65nglK8+/RRNh+rqBFIjPruBdXgNqlR2xZgKVI4IohjE/6cZOE49SYtMrRfC+/kRX7BGChxwx4Wmo8n6hap9rlZRqGmo2t/U1Tivrws+6BA8dqfdWFlS21UbHYtUV01Yy50VDofBY9nfGR2vBwRWAMzgDNAkE152s7zh9hvoyzdw2fLyFmkLQLA3u4H7Vf8jGGWDZFD7Uv1Hi/ouPLHaGIvFv/Oo/sqLaFJZmU6lptEJ5fqLVwBDVXYDvYc2wQo8AOchRYmpfkaLanKsgSeeHCNtrnrcPycHHlvBvN/ZWinXHm+cOrKko5zde6xepi/u1I8m+sZK3aKF/Zq9cv6U8rFUwZ/imFFdwG7hVE20ZTewGd8EU85RRJ7mDRJL3yda3kPMG3W6O+yU/vQKZU964mO18akxITpS7Tf59G6XjG++krLZW76eOvBwYqkr9UTNj40lKh+V2Q10E22C7X7PumtZnFaLrJ0n23q+kQx2V3TyLjmRqLMEmUbviL75zNDwYrODm7Kn2lrTbOm0q5zwjEHMbqBNfBMYcO1wRVBzoizlsbQjht+Nn2yaivjrrdqVJR1l68IW0cgETHy0Vv/thwfPtFRYUn+91RGy8Usm64+NJR3dezsBq9g/RJtguc9xia5oN1Ef6RKNFCGnIGf3qfaOuabuiVoKKz/TdYXkaEiYfO4NsdoT1bcsDg0uJhLHk4y3MCq5D9ocqNEv15JcEFgA0CK+RVaiq9h9WibjwPBAe3vlQIczUlZebNOXOw4eROdPFJTLIxG9dq6gwC04TiuPAmjAk63BNNqEWmiCXpUZQY7EZBV7bolKYU5i+ZyJeERCkETkZdJqNXnOwOS60yOoW37XOFnfzZS7LDZ/46Rc7f77frowMhazO40e/8D415LLvXZRtNtF0R9uFb2S1a0vb37XVl8d91HFPmd5uIwyJgPxfp/+eJHH1NBbqSs1M8amDmkwiG5V+UW/z+evUlYqrVyZRmOxVti3uWkjxVY1CtKuNlkDb1BJpw1tK3TFvvDg3hW7q8JnwTdfOWgNHJ9QbiN31GfllNchm4UYAPwCv4sFaAQAGprgqd3YDnxzd1bFJJrhRZptu0T95bUf/uMLCwl8U5n/0W3l5//a/QjZn91ARnwTSlVed3ubiODfUk0rhsICWmvUe/WH9mF+62ecEaETBTR5D0BjR5vgVs8hw4tU955M6N21jfRwV0huY9y9oYF9K3aXt4781KL1VmdNwOcJ7aRXp7yeW3Z4Qptgyj8jn6clHeVK7xKF1hOOmnt42ta7qp0/Pb/MiZPJ5MlEYj6ZnE/UBIM1wZqaXK82Lw4PnWk+m25tS5GWJbDasj3YjDaBAQcAdxedKj9B5Fjmrs2Q9O17xQdm41NRV9xW0C9ERwJVJt8N/IOQjf/z0weWEuXW/u+iyl2TIV7QgzbV+C6AAjmmht1pIikmGTT5XoCOaq3tnm1DaCGO9vGuGdx4JmVxqoZgd4W2xlDlXTfI6QVdQptgvKeOtHCX4fKUwFboLMXWsopmE1ofDYcKCi5QlD+sfAAI2OwGegFtgqjq5+78Erbn124wMr0cmDVp3w09JLR7Ek63wx60OZp8Rw80jDrbbRFbQ4PgavbP6gXnuLWcYwxmRqevbPB3joiWMZNZtFhLiviGYMfEdg8ZshtoHi+SCUxmkszLsZhEXCXPgGG8P5kyPHL2LG/XW3UcE9MfG7l1QvvYY6ffqfJqqeNa/XaseHYDfYHWwXRfDxhytvufg3tXHK4KwbyyVKRx9uqPT6CI8kvZb7OjHqWs01sNiPQbyqJ1KAaQNBKX+56LSZo3/mq1VcfoqEJG13bxOlr/jTctimnvb5SyHZ/E62gd3Pe9lxeBz91baHp1+ek6rU5L0cWFsQv1haU0RRfStX929pUaupim6CK6Gq3f8fYIQi9/R117vHeUsrf5Lp+vi39bPa8EAG2gdTL3JUbMO5Dm7p5Tsnbp+WqdWUftMe7xrF1+9vk6PaenCk2FIsKfDbABlg2wA9nfDrHVLBswD5G4+mwL2kLrUJ6vg1jsHipK8JLZXWqjjXu8Ph39L6vdRUYdtcdQGL/4Clff/5aWWkAFlXYb+tVPPV1evpv/qVLUciD3refNbqBP8ZNQlOtjOZJrN3HnDrN9RTKjPUfOnz9C/qw+jvNZLT6Lxad/+fr1l166fv3lU97J0dFxj2d8dHRSvXM5ANDH+EmoAJDkFixH8r5NSHgt+XKQWO/g+a6Q3xOzDNTOJBOTctN4xBI3f2t/+vzRmtqQaOsPS+FDzfLJk1FNwTLxBwYAfYHPQSFRFSORSUVKyMhumSGmz7PXnihAlN5WElb++5O/27sX7XnIOeiwRcuV+bUH0TeViwtrBB+X3UAf4HPgzOd1ByXjZnl6F+n/9M0J7fakL9RYX13htbcb0eyvi9xC7FB92zF9xDth84ZDdeESYxVqWz5bWjWa7DocUTVRDYDu4HOqdltwzC272RIN/YLW0xVXfoXejHV4y6hjP3huePmBjm+cuzyRu7e1IIBXiW9wYjQqejx8XlFSjvpGhCnMR6NCODL+Vp+pzRvwCcHetqElADK/mrMb8Dn6LRYhDoCSoCUrIAjALeRGIXIHi8kSG/jDrdlZcl4AfoJ/j6q3n7vZAP73n0xOqrpbRJ9k3yHPOdnN6tHPM8PDgKA4O42i+G31OSNpim9N37qmObL5HInlgUn0GY6SO6F6t5S3jeM/Xntt7rXXJm/M3rgxeyPnjfAeWt+5D7atoHWlDFD2VdwAw/hd8r4hL2lvMOj1BoO4oYrnq8gfiaHmCa+SvVze3iuCJAmCJOll0SfLPlGG/wUAAP//AwBokaj1AAEAAAACC4V3ypiBXw889QABA+gAAAAA2F2ghAAAAADdZi82/jf+xAhtA/EAAQADAAIAAAAAAAAAAQAAA9j+7wAACJj+N/43CG0AAQAAAAAAAAAAAAAAAAAAAD14nATAsS5DURzH8e//d5OGuDiiqKWROtLEPc5Komc4i0Tin0gwGIy8hIQ3sHc112L1AnavYupy+9E3t/yCSr/UE64rsl5xRVwtrjeyPnE7w/WCa4BriWuOa0HWPa4FWc+4EsdKHGrOtbY5VaHaH1GFqQZEe2CkfSa6pNqQc0WqjanNI1UzqjqiClWFqX1Q7Yc9e2dHF8y0QdusMZLY0jqtAicKjBXYVeBAgWSJbIliN3TNEZ3909odmwpMbEiF/ssSZQUAAP//AwAcaiD9AAAAAAAALAAsAFAAhACwANQA6gD+AS4BRAFQAWoBegGsAc4B+gIcAlgCfgK+AtAC7gMmA1gDhAO2A+oEEAR4BJoEpgS+BNoFDAUuBVoFigW+Bd4GGgZABmIGfga2BuIHEgc+B2oHjgfAB9oH+ggGCBIIHggqCDgITAhYCG4IhAABAAAAPQCQAAwAYwAHAAEAAAAAAAAAAAAAAAAABAADeJyclM9uG2UUxX9ObNMKwQJFVbqJvgWLIrVjUyVV26wmpFZGRHHwuCAkhDS2J7bl8czIM3YanoA1b8FbdMVD8ByINbrX165dEAUrinVm5v4537nnfsABf7JPpXof+K2eGq5wVL82vMe9+oXhfVr1PcNVHtV+N1xjUFsYrvN5rWP4I95WfzF8j+Pqj4bvc1htGf6Yp9UDw5/sO/4w/CnHvF3iCjznZ8MVDskN73HAD4b3eYDVrFR5QNNwjc84MlznCOgypiRhTMoQxw1jhsyZEVMQEjNjzA0xAxwBPgmlvk2JFDmG//g2IqRkRqQVR5Q4EkISIgpGVvEnzcq41o7SZ6ZIuvmUjIjoacaEiBRHxpCMlJiJ1ikpyXlJgwYFfeWbU1LgUTAmwSNjxpAGbVpc0mXEmAJHSysJs5CMG0puibS/swhRpk9MSmGs5qQMlKdTfrFmB1ziaJNr7Gbly60Kj3F8q9nCTWIcX+Lpv9tgtt13xSZioXqKhj0S5XmrExyp4tLX5xvFJS9xO+mzzeTDGg2Uncx6TI+5zl/mJ3nCJMW5Q3xCdVDoHuI40+eAUBX5joAuF7R5TVeffTp08LmiS8ArzW3TwfEVba4414xA8fJbSx1zxfc4vibQGKkdmz6iuTy9ITd3C3dxhpxjSq5bIDOW84vz450mLDuUbbmjUFf0dY8kUvZAVJE9ixiaK3J1xVS1XHmjMP0G5gj5Wups332XbVjY7q22+I5Md9gxN04yuSWjD03Ve88zt/rnETEgo6cRfTKmNCi507NdEzEnwXGuPr7QLSnx1znS505dEjNVBgGp1pmR629kvgmNe3/L987uEtm8qe7oZH2qXbpI5XRjRq9VvdW30FSONybQsKlmliMTlsrLk4r3Jdrb4h+q+wu93TKecEZGwuBvN8BTPJocc8IpI+0glVMWdjs09YZo8oJTPf2EWKPkvnyjOkmFEzyeccIJL3j2no4rJs64uDWXzd4+55zR5vQ/nWIZ3+aMV+t3/971V2Xa1LM4nqyfnu88xUf/w61f8HjrvuzoLSCbs7Bq77biioipcHGHm1q4h3h/AQAA//8DAPS3T1EAAAMAAAAAAAD/zgAyAAAAAAAAAAAAAAAAAAAAAAAAAAA=");
 }
-.d2-625626608 .text-italic {
-	font-family: "d2-625626608-font-italic";
+.d2-37886755 .text-italic {
+	font-family: "d2-37886755-font-italic";
 }
 @font-face {
-	font-family: d2-625626608-font-italic;
-	src: url("data:application/font-woff;base64,d09GRgABAAAAABOYAAoAAAAAHhwAARhRAAAAAAAAAAAAAAAAAAAAAAAAAABPUy8yAAAA9AAAAGAAAABgW1SVeGNtYXAAAAFUAAAAxgAAAS4G2ygtZ2x5ZgAAAhwAAAxsAAARrAxaa2poZWFkAAAOiAAAADYAAAA2G7Ur2mhoZWEAAA7AAAAAJAAAACQLeAjfaG10eAAADuQAAADPAAAA7GzVBppsb2NhAAAPtAAAAHgAAAB4ibqOAm1heHAAABAsAAAAIAAAACAAUwD2bmFtZQAAEEwAAAMrAAAIMgntVzNwb3N0AAATeAAAACAAAAAg/8YAMgADAeEBkAAFAAACigJY//EASwKKAlgARAFeADIBIwAAAgsFAwMEAwkCBCAAAHcAAAADAAAAAAAAAABBREJPAAEAIP//Au7/BgAAA9gBESAAAZMAAAAAAeYClAAAACAAA3icjM7JLkMBHMXh72pRtMaap9uaSs1Uxc5CRESsrBtL8QRei73hKWx5jCL5i7uS2MjZ/pLvIJGToCifVFGTyitI1a3bsGnLtl0NTUdOnLlwpeXGXVqO4E+5n5XHTp271HLt9qeMdyVduuUU4is+4yPa0Y6XeI6neIzXeIj7t0r25X9LHGbajuYvf0+HnLzOzCro0atPUUm/AYOGDBtxoGzUmHETJk2ZNmPWnHmpiqoFi5YsW1Gzak1dg28AAAD//wMAoQMtFAAAeJx8V3tsW9d5P9+51L2yRD3Iy4dJi6LIQ15K1CUl8ZK8oiRSD+pBSaSshyUrtkTJ8iuyFUexI8ee7aSJhswJWpcJsg0LgiXbuqFDsCVwumEFvBRrukZL5mIb0i1b0gBpUqW1V6QRNK8tonuHc0lJlIf2H+pAB+f7vt/vfL/fdw8qQR6E8Dn8AmLQPlSFjMiMkMS7GEaSZWJlJJ+PcJzs43nO8xSsPfWiLnnkJ/Wv/Ep06gae/Mvh/55/Fb+wtQRfmX3iCeXo9ZMnD9+9q/jh3+8ihBBW30UIfohzaB8yIMRzkk8QfIRlASSe+Aj3SdtbZboync4uKf8MJ46kx4w/XYTLy8vhM62x08oYzm0t376NEIMIQrgO55AB2ela4qWQxWxiWY6zaH8JI4WikbBAdhdk9bW5pcakB6T+gasjbdnskb6ho2fPZ89lBh/FuaEBsVcs1em7WwdnRbg4IAdCW3f60qE4rRtQTN3EAfwSciJU4haESDiBpZDFygkCcVdis8likUJR2cqy4B5+MNp85Fq6dWx/lI8KbXM9HvdQe32yjnhm9clLI5kXHhuQ/Q11vviJSx3ts5G6AyFngHJDceCoxg1fhIj4pFB0G8HvPPO1yZcfnpqavJo8fTyKc793+bFvnew69AfHZhfzddIY1TiHymkEF+fiJI5wLo6swpkK5RP/F5WfSyBU4lz3D3vu9RRwteOXkFvD9RtgyUSWGJYF8eK15qNPjrWP2WRerk8s9HlIutMT473XK34Q82T1z10aeeGx/h1wbdno/uq/6VI+rfXu1La4XZvEuHiJIbyLIasjrVDfmlkd6VTeT+CcchfMW8vQqqzlz6BNnENM/gxZHVnFua3lnXiHcQ7p83sSSBxPGI4jqyPdDAxO3/v9scefCeCccgt6v1SWYOHpD7fPwfM4h0oKddADF8FUgXNbN3sKcW/hHLJp+7xVkrVKo1GZcAxhaL9yDFmdjVl0/W/Nrg6n99n1uoP/IMYtOraydAjnlD++fh0WtpbhvHim8XnlGzDzvLgoKjcQRh3qJs7il1A1qitm3GI2VWJfKIHpPeeZB+e5leDUSv/QyXBw6tFk5HDCPTRCfwf1f3h1OLfS13tlYvi5lb5kx8JK7NhK+8JK2/zFnT4KaDybivuIMPyuFL49c37oyUOL4e65k2fSqZM4NzQ1erpF+SUMjB6MSbSXaK1ZrdYqJCLk3VOc1S34dlSgFc9tKwBIUan/O3HZNnG4AKNx5KEew2S46kBFiSvSfvxiW77qhYv/kR7lv362gCn11fODbGOjjomXF7D4cA5VIMsuFnrNe9B8a+aRcxMXJpbOy73HsyeGU/M41z9x9JxB+QQsyh2YHO+PNlFMgPTqJij4JeRHiGKQtaojYcGnwYlGd7qfZSlMa95NPksu18cck3LHWMCb9rdHZtrb552SrT/ojThaPOmmcPspfVtbY2Oot9UTsgTtg3JoPBSuD9Y2OJsPCE2WQM2A3HY0jADNIoQjOIc4iobILo4wf7HyZgW8W/GdFZxJJrfeyNd5UN3Ep3COota6JEp7kJZESaZLFmpPnGV1QyPD+7r6Wo+Yx9LjNU/pF0+Zm2ywrDwTcPdnZs7C88rZG5fpXfrUTfglbCATZdS6q3RJlhgiE5b1haKyvCP7N7rS4lBW8sUNOj5xrLNUR6aNwkGPaA7VeJIRZ4v+6GT/5Rmp3hVX7ClvU1ew6T8Ft39wNtSp+SVGTnUTfoHXkJlOE8o04QgvcZykUbyn2zXPvuOLGxhT542Mz4I9hwJa+ognGaltbnCPkaBJ0te74njtzXlH45EpmrrLPzgrJeJ+72eCGwHyqptwEzZQzR50uzdZcOf3D54QM8ciYoclwAuO5qlorK0uanHbM/pTs70XJpvctmaruXc52dNvN4RM1Lby3GFfEZZd7n47eW1GplrI5ArsjXjvZ89XN/fmVuv99GENy3dgA9mRtzgf7UTOxe5MGkaKUjVThJ9OLQaGZ5rl7lp9ifK9fXVJvyNmrXWM/ZGKGWMDiWT1Z471LY+LwdFQjVTZOeq1GSSzE7zl+ytqWpyTCFAjQvA1/B6yan3ZiYuVwNEhwjROdpZ3V1eNxO1+44GyAwZXQ6lhQX98Er4ZKxkbmqgol7myUONEQpmm/QaqBzZgAzlRsFhpssyypJhB2snMHvZebZkinpq++sRQpU041BQfbRycaRESBobvPMVfiJExd6OlpYZ0S7VNHwqOiNWd7npQEKcmk48+EKL9yMydAlej/18Ed0P/dHN7O71DoHMb3sdrBU/f7UNOM/ZImLhZjnHeyDRX6xrGxUSkNJHu0OlSNalgH167GydN3a1Oj/IOiKb9FcP+oPJNVaUx0a/xTSygGEKIRW2p3Vw/x2s7c4mnc8nHcc4bmXn8q+nvrozMLtvxmuIAeFf5yc/PX0GARHUT/RqvISNlKxLW1M6aTYWrfqibvZK5BmBgWA7KLPpOgw2f3XqO28cYAbfrdDt58R3YoN5GMeYhWgtA2T1Ii0Ef6+R0woTQ1lLSNO2NR3W6RCau0w2YU2If5aDfkmrsg/VBT4tcL0rdrYZaUzEPu6sd7O/DBtpfXMP9NNOMDePBPSxrGe4neUd/8AFsoCrkKNZD3kRo1G2Rv3cwKw5lQwfnxOGsPzAmRUP0R//g0b4Lk8H8b1fPcm/PQHK5t6efxlbvqRL8Ajby2uaKKq7ERHMtjt/jU2XPdrKMdzKoGVRI6OCx0fnnxT51G7/R5QwUBO588GWAglEJP/W6tvFImhdrOUtkmfw/TexVBLhctdg7HSz25GdfLjaU2y8/JjTtWPJWBmCvIWu9AVdhA1UX3YuVE7bvo1znSAds5gPVdk/aGYf1WTG+r7e0s125jUD9Ut2Ea7CBfPfPzPtHJp2Y+YH5Zy2ztmZrl+CPN7QGY+KgGByqCfKSS2iJ1iXCzeP6cL3grA8Su89pTzQ0dns9tfUme8BZKxjdHWKg10tr7lA3YRov7Xh6VOZJJ5Y0Nyry9G93hXUQGyhPe7oPXNFfizE17kp7uaG6Sd8ZqLJXgDFW8vTTCeWO0VhbW1Yic1U0dqu6CZ/DOrLtxt5VHF+w9Vd31JByDIh9aToI6w/pe2SDk4eo8h5vo20K04p9iGjfTIDaEYKPYR1VIESVb7FYpSgNCE8NpD06VqczePivZ5QtWFc+I8PEM+gBm2LPn+1HCL8N68h139ndFUOY/HuJYxZJuhoAdFUHqr8ybMAYdJX26idSP5qr1P7rqLoI68qP3b1ud68baotWdigjKY8nRZR7CNT3EIJ/y/NAeJ9kLaSSJc5KCm8zjhP/6+iIv7SS01XVVU1OrB0/KJYaynTVbj4L+NMli89sajAv/c8X5y1Bi0W0XkAI1O+qTfAJrCM7Qpz2nUV5lfcwUonZsrpKm9Ho7bYZJ9JCSSmjM3iNX00rP7a1p/6V42L74iECnymfuzKEpN1g2PqiKSNSrjDyq5vwA/wsMlC2rG7ht3xIr4UGvP7B+Uio39MwONfiS4YdYlD71bceTzzwJ1cH2o4njrxypT/e+8j13uThvkeu9/YcRqDeQwi+h5+lGIicYAom4NsxCM7FlZXO38g2SZG6brdPPNw8Pu0fvzoBJn1w7MrCA0Gxw+VsFhoe6I1k55dTPbRu2ny38eOoDJkQchHZJYPESBzxSjJ9X7AsB8MpovxsH2QPjU7oJxT1HwXWyOlM9abXw/CispxI/L2j21UT3k95AITUTfgAP47qirVZsETOx7s4whXqZdlb3VlHyNLd6k+JnWGnWOcahcaKn4UNfltqLnlO3xlocIX9GSnRUW2wQ6DnVql+ciL9cN4/FhHCJfhxbaYlsOySXVwl5i45hh4eU96phBtlxy8mrZfe/qvRntDsre8/pJ2xqpvoOlqi7728xvJ19FtsvhrLfq++xmIXHRabSPvlY3UG5dAS9SfOR5koOmAqb4px2FJLHPaaI98IGjs8dovN56kdpM9AVdXyrMGPsA+1oC54BLGopfDO+wjKwEbfjrIscUT/QcVH298DBH2MPwJrfs/FkXL8evnH0Sg9p36o/i68rv4t3eNkF+cph38quxoKaXt/p87Dn+Lva3sgQQputiqZV5hTX76Yj9uMTsM72E8xyxESkSKSWTIT80d//VrHa6+ffjv21luxtwt+jG7D+va71nksswDrmhEAGsDD6Ca+SWPwRTRc4muJ1eQgeNhqsbn2W2x1/wcAAP//AwDWbrmVAAEAAAABGFF4/VtnXw889QABA+gAAAAA2F2gzAAAAADdZi83/r3+3QgdA8kAAgADAAIAAAAAAAAAAQAAA9j+7wAACED+vf28CB0D6ADC/9EAAAAAAAAAAAAAADt4nATAIUtzURzH8e/vt/g8omC4znLC3+2CEzQ6vFVXBA1is2sxWfY2fB8mi3FqEQSTceEM88oNU2Ts+PEdO7yBVuXdI8J9hj4n9E34lKFvCZaE9wl9EH4mPKZxn/CYxgNCv/zXiitfc+YutbdIeqTnilozetpm4E3kfyTmJE1J/LDXSSSvkdyhdlUW7lLrkqT7stQxjTc41IQjv3Kih/KpSXlRZle5LJRZVwZlbmipaMuMlkoDoiNCX2Wqi/KkzAFzEjD6AwAA//8DAFuyN6wAAAAALgAuAFIAigC8AN4A9gEsAUYBVAFwAYABrgHgAgQCRgJuAq4CwgLqAyIDWgOIA8AD+gQiBGoElASgBLoE3AUeBUgFdgWwBeoGCAZEBnIGnga8BvYHIgdSB4QHrgfWCAoIJAg6CFgIZAhyCIAIjgieCLIIwAjWAAEAAAA7AIwADABmAAcAAQAAAAAAAAAAAAAAAAAEAAN4nJyU3W4aVxSFP2KgTf8uKitybqxzmUrO4EZxlMRX4zpWRkWQMqQ/UlVpgDEgYGbEDDjOE/S6b9G3yFUfo09R9bramw1hIqtWUBRrDWf/rLP22gfY51/2qFTvAn/Vl4YrHNZ/NnyHL+pNw3uc1T8zXOWo9rfhGoPaW8N1HtQ6hj/hXfUPw5/yuPqb4bscVC8Mf86j6r7hL/cc/xj+ise8W+EKPOV3wxUOyAzfYZ9fDe9xD6tZqXKPY8M1vubQcJ1DoMuYgiljEoY4LhkzZMGcmJyQmDljLokZ4AjwmVLorwmRIsfwxl8jQgrmRFpxRIFjSsiUiJyRVXyrWSmvtKP0mSuSbj4FIyJ6mjEhIsGRMiQlIWaidQoKMp7ToEFOX/lmFOR45IyZ4pEyZ0iDNhc06TJiTI7jQisJs5CUSwquiLS/swhRpk9MQm6sFiQMlKdTfrFmBzRxtMk0drtys1ThCMePmi3cJMbxLZ7+d1vMyn3XbCKWqqdo2GOqPK90giNVXPr6/KC44DluJ33KTG7XaKDsZNZjeix0/jI/yRMmCc4d4BOqg0J3H8eZfgeEqshPBHR5SZvXdPXbp0MHnxZdAl5obpsOju9o0+JcMwLFq7MLdUyLX3B8T6AxUjs2fURz+XpDZu4W7uIMuceMTLdAZiz3F+fHO01YdigtuSNXV/R1jyRS9kBUkT2LGJorMnXFTLVceyM3/QbmCDktdLbvz2UblrZ76y2+JtUddiyMk0xuxei2qXofeOZK/3lEDEjpaUSflBkNCq71bq+IWDDFca4+fqlbUuBvcqTPtbokZqYMAhKtMyfTv5H5JjTu/ZLvnb0lsnkz3dHJ5la7dJHKydaMXqt667PQVI63JtCwqaaWIxOWyqubivcl2ivxD9X9ub5uKQ8JtK5Msn/jK3DMM044ZaRdpHrCcnMmr4REnKoCE2KNkjfzjWr1CI8TPJ5wwgnPePKBlms2zvi4Ep/t/j7nnNHm9NbbrGLbnPGiVO3/O/+pbI/1Po6Hm6+nO0/zwUe49huOSu9mR18D2aClVXu/HS0iZsLFHWxr4e7j/QcAAP//AwByoVFAAAADAAD/9QAA/84AMgAAAAAAAAAAAAAAAAAAAAAAAAAA");
+	font-family: d2-37886755-font-italic;
+	src: url("data:application/font-woff;base64,d09GRgABAAAAABPgAAoAAAAAHogAARhRAAAAAAAAAAAAAAAAAAAAAAAAAABPUy8yAAAA9AAAAGAAAABgW1SVeGNtYXAAAAFUAAAAvAAAARhGIOgOZ2x5ZgAAAhAAAAyyAAASJGJ3I9poZWFkAAAOxAAAADYAAAA2G7Ur2mhoZWEAAA78AAAAJAAAACQLeAjhaG10eAAADyAAAADVAAAA9HEZBuBsb2NhAAAP+AAAAHwAAAB8kMaVDm1heHAAABB0AAAAIAAAACAAVQD2bmFtZQAAEJQAAAMrAAAIMgntVzNwb3N0AAATwAAAACAAAAAg/8YAMgADAeEBkAAFAAACigJY//EASwKKAlgARAFeADIBIwAAAgsFAwMEAwkCBCAAAHcAAAADAAAAAAAAAABBREJPAAEAIP//Au7/BgAAA9gBESAAAZMAAAAAAeYClAAAACAAA3ichM25NjMBHMbhZ5L5PtuILfZtjF0SewSd0lGrc5SOK3Bf9NyFktuw/R2j0zhv+zvvg0RVgkyaZCjkUhW5hqaWHbv2tXWcOnep69ptXo/gV3NYNmcudF25+W7iRU2PXn3xGR/xHm/xGo/xEE9xH3fPRSn/tcSJA23Htktpr7QqqlL//P/5129AZlDNkGEjRo2pG9cxYdKUaTNmzZm3YFFuSWHZilVr1m3YtKWhqeWILwAAAP//AwCdiCg8eJx8V39QG1d+f9+3yy4/xA9p9cOSEUJ60gqklQCtpEWABEIgBEjYgMHEBoHxr2ATh9jBsWs7uYRO6mQuPiXjXqeZTJ32rp3rZNpknGunN+PmppfrhSb1TdvJ9dIml5lccuTO7k0Shrp3N2HV2ZUA4U7zz+qN3r7v+34+7/v5fPehMuRECJ/B1xGFKlAt0iEDQiJnpyhRkoiJEt1uwrKSm+NY51Ow+tSLdOLQL5pe/q1gowee/Mvh/5p7BV/fXISvzTzxhHz46vHjB+/elT3w73cRQgjn30EIfoJzqAJpEeJY0c3zbsIwACJH3IT9uOPNSrqSpi2i/M9w7FB6VPfLBbi4tBQ81R45KY/i3ObS7dsIUYgghBtxDmmRRRmLnBgwGvQMw7JG9ZdQYiAcCvJkZ0BWXp1d9CacICYHLo90ZLOH+ocOnz6bPZMZfBTnhgaEPqGc1sTbB2cEOD8g+QKbd/rTgaiSN6BIfgP78EvIhlCZg+dDwRgWA0YTy/PEUYMNeqNRDIQlE8OAY/jBcOuhK+n20T1hLsx3zPY6HUOdTYlG4pzRJC6MZK4/NiB5mhvd0WMXujpnQo17Azafwo2CA4dVbrgSRMQtBsJbCH7vmecmbjw8OTlxOXHyaBjn/uDiY9893nPgm0dmFgp5KjHqcA5VKRHsrJ0VWcLaWbICp6rljz1f1HwmAl+Dc/Gf9N7rLXm/ouR9qvi274vqz7twLv5Jr/zTLQ468UvIoXLw/1AgEUmkGAaE81daDz852jlqljipKTbf7yTpbmeEc12t/nHEmdU8f2Hk+mPJbSI6suE9dX/TI3/S4NrGsbCFQ6TsnEgRzk6RlZF2aGrPrIx0y+/FcE6+C4bNJWiXVwtr0AbOIaqwhqyMrODc5tJ2vIM4hzSFORFEliMUy5KVkTgFg1P3/nD08Wd8OCffgr4v5UWYf/qDrXXwAs6hsmIeyoLzoK/Guc2bW/zdwjlkVuc5kyipmYbDEmEpQim1zVJkZSZipJNvzqwMpyssGnrfPwhRI83UlA/hnPwnV6/C/OYSnBVOeV+Qvw3TLwgLgnytGPsEziFuK3Y4rEbfjjryTQ/N1FT2D69krntpprYyiXPy9DNtD4kwvbkE33pOPBWQb6i11ZXfwFn8EqpDjaWnZzToa7A7EMNKfRVOEWxnlv2Ty8mh40H/5KOJ0MGYY2hEeQ5q/ujycG65v+/S+PDzy/2JrvnlyJHlzvnljrnz2/XrU89MX1q/hOJ2JPi96bNDTx5YCMZnj59Kp47j3NDk/pNt8m9gYP++iIiKuWbVXGuRgJBrV3ImB+/eVp+aPLulPCAlqf7P+EXz+MEiDO/IQ73aiWDt3uoye6jz6PmOQtbz53+a3s9943QRU+rrZwcZr5emolVFLG6cQ9XIuINFKZldaL47/ciZ8XPji2elvqPZY8OpOZxLjh8+o5U/BqN8BybGkuEWBRMgTX4DZPwS8iCkYJDUrENB3q3CCYe3lcQwCkxTwcU+TSw1RawTUteoz5X2dIamOzvnbKI56XeFrG3OdEuw84Smo8PrDfS1OwNGv2VQCowFgk3+hmZb616+xeirH5A6DgcRoBmEcAjnEKugIZKdJdRfLL9RDe9Uf38ZZxKJzdcLee7Lb6g1ZyxWiVpxSkoKycqQgYZjpxl6aGS4oqe//ZBhND1W/5Rm4YShxQxL8jM+RzIzfRpekE9fu6icpTu/Ab+BdaRXGDXtuIYoiRSRCMO4A2FJ2raQ13vSwlBWdEe1NBc70l1Okykdv88pGAL1zkTI1qY5PJG8OC022aOyJeVq6fG3/Afv8AzOBLpVn8bIlt+Az/EqMihdTGGasIQTWVZUKd5V7WqvuOOOail997WM24idB3zq9iFnItTQ2uwYJX69qGmyR/HqG3NW76FJZesez+CMGIt6XJ/yDgTIld+Am7CO6neh2znJYld4b98xIXMkJHQZfRxvbZ0MRzoaw0aHJaM5MdN3bqLFYW41GfqWEr1JizagVyywwB12l2DZ4e6ryevQUXV8Jldkb8R1P3vuxtk3Ntvvpw+rWL4P68iCXKX7KZXI2pntDkeJYUXNCsJPJhd8w9OtUrxBUyb/sKIx4bFGTA3W0T/OY0rXTEJZzakj/Utjgn9/oF6s6d7vMmtFgw1cVXuq69tsEwiQFyF4Dr+LTGpdduNSJbBK86K8E91V8brakajFo9tbuVdrby7XzmuOTsB3ImWjQ+PVVRJbGfCOx+Qppd4g74R1WEc25C9VmiQxDCllUKlkahd7r7RNEmd9f1NsqMbMH2iJ7vcOTrfxMS3FdZ/gzkXIqMNrbKsncbGh5QPeGjI50j0P8sLkROLRBwJKPVKzJ8Du9fwL72hOTrV2dipnCMr3AryHV4v9YacOWbVJhILEwbCU7VqmtY5uHhNiofJYuoumU/Upfz9evRslLfF2m1N+GwT9nuphj1/+Tj6vxES/wzcxjzoQQgzqTO3s9Wu8ut3jOKXHuVnWdi0zh3879YPlkZklC16VrQDvyL/49dlLCJCQ30C/w6tIp7AVCqpqZwz64lE/FGcuZa4AaCmGhUqjpltrxqc3n2crKB3gTpre3hffgXXF2xSMBYimIlBmF9JS0Ee6WZof5zvaylqmXNEwTccyUZoeMKSEfoWDpDHl7Ye1QWeb1CSI8XZtg76Uh53RNvb3YB3tKc3hfpqVHZvH/LtYVne4n+Rt/cH7sI5qkbVUDwUTUaJuifzdfVlhKBvYNysMZz2+UTEcUB6aBw/3n5vwF549vUt9vQOJpb7epBI7fy8vwuewXtA2W5JxDSaqa7HcLp+qfLaboVwTftWgAnwXh3W2Py/1qdv49R6bryhw24M3AIpGxf/SZd/CI6perO5ZJknk/2hityLAbm/Aril/qSc/e6PUUG7feIxv2bbkzQzAbkNWawMuwzqqKzkXE8tvnUcVbU37zIa9dRZn2haFtRkhWtFX3t0p30aQ/zK/AVdgHbnv75n3t0ylYxYa5rfaZsytph7eE21u90eEQcE/VO/nRDvfFm6MBVvHNMEm3tbkJxa3zRJr9sZdzoYmvcVna+B1ji7B1+dScu7Kb8AUXtz29LDEkW4sqm5U4unf6wnSEBmoSjvjey9prkSoekeNpUpb16Lp9tVaqkEXKXv66Zh8R6draKgsk9haJXZ7fgM+gzVk3om9oziuaOuvbKshZR0Q+tNKI2w6oOmVtDYOwvK7nFkpU5iSLUNE/WYC1IkQfARrqBohRflGY/FrEZ4aSDtphqa1Tu4bGXkT1uRPyTBxDjrBLFsKa5MI4bdgDdnvW7szoghVuKex1AJJ1wEAXbu37mvDWoyBrrHUPZH62WyN+q+19jysyT939DkcfQ5oKBlZoJKknM4Uke8hyL+LEPxbgQfCuUVTcStJZE2keCdkWeE/D494ymtYuraxdmJ89eg+oVxbSdc5uCzgTxaNboO+2bD431+cNfqNRsF0DiHI/yDfAh/DGrIgxKrfWQqv0i5GajBT2Vhj1ulccbNuPM2XlVO01qX7elr+ubkz9a8sG6mIBgh8Kn9mzxCSdoB284uWjKBwhZEnvwE/xs8ircKWycF/xYf0amDA5RmcCwWSzubB2TZ3ImgV/OpT03409sCfXh7oOBo79PKlZLTvkat9iYP9j1zt6z2IIH8PIfghflbBQKQYVTQB97ZBsHa2snzuWrZFDDXGHW7hYOvYlGfs8jjoNf7RS/MP+IUuu62Vb36gL5SdW0r1KnkrxXcbP44qkR4hO5HsEoiUyBKXKCl3FYZhYThF5F9VQPbA/nHNuJz/R57RsbS+Sf9aEF6Ul2Kxv7fG7fXBPQoPgFB+A97Hj6PGUm0WLZF1c3aWsMV8GeZWPGsNGOPtnpTQHbQJjfb94K3+VVDrMadmE2c03b5me9CTEWNddVoL+HpvlWsmxtMPF/xjASFchh9Xe1oMS3bJztZg9oJ16OFR+e0auFZ59HzCdOGtv9rfG5i59aOHlDX5j/LTKIcWFc9h3Qo6pfEXk9FXtURYbGwgVkv9oW/7dV1Oi9HsdjYMKtfEfB6Z8htoFX6G3agL9cAjiEFdxXvgh1AJZuVuKUkiSzTvV3+41eMJ+gh/CKbCnJ0lVfi1qo/CYWVd/oP878Nr+b9V5ljJzjqr4J8qLwcC6tzf5efgz/CP1DkQIQU32+XMy9SJL18sxG1FJ+Ft7FHuwFKIhMSQaBANxPDhX7/a9eprJ9+KvPlm5K2ix6LbsLZ177UdyczDmipuQAN4GN3EN5UYXAkNF7gGYtJbCR42Gc32PUZzIwIV+1W0qLxrKnk3aTS76417XJp6o0WwGs0C+l8AAAD//wMA6ZfVHAAAAAEAAAABGFE3lFj7Xw889QABA+gAAAAA2F2gzAAAAADdZi83/r3+3QgdA8kAAgADAAIAAAAAAAAAAQAAA9j+7wAACED+vf28CB0D6ADC/9EAAAAAAAAAAAAAAD14nATAIUtzURzH8e/vt/g8omC4znLC3+2CEzQ6XNUVQYPY7Ipgsuxt+D5MFuPUIggmi7Bwhnnlhikydvz4li1eQcvy5iHhLn2fEvom9En4mL5vCBaEdwm9E34ifE14xMBdwiMG7hH65b+WXPiSE7epvUHSAx1X1JrS0SY9ryP/IzEjaULih51WInmF5Ba1qzJ3m1rnJN2VhQ4ZeI19jTnwC0e6Lx8al2dltpXLXJlVZVDmiqZMaajUI1oi9FUmOiuPyuwxIwFDGqo/AAAA//8DAOd7OTkAAAAAAAAuAC4AUgCKALwA3gD2AQwBQgFcAWoBhgGWAcQB6gIcAkACggKqAuoC/gMmA14DlgPEA/wENgReBKYE0ATcBPYFGAVaBYQFsgXsBiYGRAaABq4G2gb4BzIHXgeOB8AH6ggSCEYIYAh+CIoImAimCLQIxAjYCOYI/AkSAAEAAAA9AIwADABmAAcAAQAAAAAAAAAAAAAAAAAEAAN4nJyU3W4aVxSFP2KgTf8uKitybqxzmUrO4EZxlMRX4zpWRkWQMqQ/UlVpgDEgYGbEDDjOE/S6b9G3yFUfo09R9bramw1hIqtWUBRrDWf/rLP22gfY51/2qFTvAn/Vl4YrHNZ/NnyHL+pNw3uc1T8zXOWo9rfhGoPaW8N1HtQ6hj/hXfUPw5/yuPqb4bscVC8Mf86j6r7hL/cc/xj+ise8W+EKPOV3wxUOyAzfYZ9fDe9xD6tZqXKPY8M1vubQcJ1DoMuYgiljEoY4LhkzZMGcmJyQmDljLokZ4AjwmVLorwmRIsfwxl8jQgrmRFpxRIFjSsiUiJyRVXyrWSmvtKP0mSuSbj4FIyJ6mjEhIsGRMiQlIWaidQoKMp7ToEFOX/lmFOR45IyZ4pEyZ0iDNhc06TJiTI7jQisJs5CUSwquiLS/swhRpk9MQm6sFiQMlKdTfrFmBzRxtMk0drtys1ThCMePmi3cJMbxLZ7+d1vMyn3XbCKWqqdo2GOqPK90giNVXPr6/KC44DluJ33KTG7XaKDsZNZjeix0/jI/yRMmCc4d4BOqg0J3H8eZfgeEqshPBHR5SZvXdPXbp0MHnxZdAl5obpsOju9o0+JcMwLFq7MLdUyLX3B8T6AxUjs2fURz+XpDZu4W7uIMuceMTLdAZiz3F+fHO01YdigtuSNXV/R1jyRS9kBUkT2LGJorMnXFTLVceyM3/QbmCDktdLbvz2UblrZ76y2+JtUddiyMk0xuxei2qXofeOZK/3lEDEjpaUSflBkNCq71bq+IWDDFca4+fqlbUuBvcqTPtbokZqYMAhKtMyfTv5H5JjTu/ZLvnb0lsnkz3dHJ5la7dJHKydaMXqt667PQVI63JtCwqaaWIxOWyqubivcl2ivxD9X9ub5uKQ8JtK5Msn/jK3DMM044ZaRdpHrCcnMmr4REnKoCE2KNkjfzjWr1CI8TPJ5wwgnPePKBlms2zvi4Ep/t/j7nnNHm9NbbrGLbnPGiVO3/O/+pbI/1Po6Hm6+nO0/zwUe49huOSu9mR18D2aClVXu/HS0iZsLFHWxr4e7j/QcAAP//AwByoVFAAAADAAD/9QAA/84AMgAAAAAAAAAAAAAAAAAAAAAAAAAA");
 }]]></style><style type="text/css"><![CDATA[.shape {
   shape-rendering: geometricPrecision;
   stroke-linejoin: round;
@@ -32,79 +32,79 @@
   opacity: 0.5;
 }
 
-		.d2-625626608 .fill-N1{fill:#0A0F25;}
-		.d2-625626608 .fill-N2{fill:#676C7E;}
-		.d2-625626608 .fill-N3{fill:#9499AB;}
-		.d2-625626608 .fill-N4{fill:#CFD2DD;}
-		.d2-625626608 .fill-N5{fill:#DEE1EB;}
-		.d2-625626608 .fill-N6{fill:#EEF1F8;}
-		.d2-625626608 .fill-N7{fill:#FFFFFF;}
-		.d2-625626608 .fill-B1{fill:#000536;}
-		.d2-625626608 .fill-B2{fill:#0F66B7;}
-		.d2-625626608 .fill-B3{fill:#4393DD;}
-		.d2-625626608 .fill-B4{fill:#87BFF3;}
-		.d2-625626608 .fill-B5{fill:#BCDDFB;}
-		.d2-625626608 .fill-B6{fill:#E5F3FF;}
-		.d2-625626608 .fill-AA2{fill:#7639C5;}
-		.d2-625626608 .fill-AA4{fill:#C1A2F3;}
-		.d2-625626608 .fill-AA5{fill:#DACEFB;}
-		.d2-625626608 .fill-AB4{fill:#EA99C6;}
-		.d2-625626608 .fill-AB5{fill:#FFDEF1;}
-		.d2-625626608 .stroke-N1{stroke:#0A0F25;}
-		.d2-625626608 .stroke-N2{stroke:#676C7E;}
-		.d2-625626608 .stroke-N3{stroke:#9499AB;}
-		.d2-625626608 .stroke-N4{stroke:#CFD2DD;}
-		.d2-625626608 .stroke-N5{stroke:#DEE1EB;}
-		.d2-625626608 .stroke-N6{stroke:#EEF1F8;}
-		.d2-625626608 .stroke-N7{stroke:#FFFFFF;}
-		.d2-625626608 .stroke-B1{stroke:#000536;}
-		.d2-625626608 .stroke-B2{stroke:#0F66B7;}
-		.d2-625626608 .stroke-B3{stroke:#4393DD;}
-		.d2-625626608 .stroke-B4{stroke:#87BFF3;}
-		.d2-625626608 .stroke-B5{stroke:#BCDDFB;}
-		.d2-625626608 .stroke-B6{stroke:#E5F3FF;}
-		.d2-625626608 .stroke-AA2{stroke:#7639C5;}
-		.d2-625626608 .stroke-AA4{stroke:#C1A2F3;}
-		.d2-625626608 .stroke-AA5{stroke:#DACEFB;}
-		.d2-625626608 .stroke-AB4{stroke:#EA99C6;}
-		.d2-625626608 .stroke-AB5{stroke:#FFDEF1;}
-		.d2-625626608 .background-color-N1{background-color:#0A0F25;}
-		.d2-625626608 .background-color-N2{background-color:#676C7E;}
-		.d2-625626608 .background-color-N3{background-color:#9499AB;}
-		.d2-625626608 .background-color-N4{background-color:#CFD2DD;}
-		.d2-625626608 .background-color-N5{background-color:#DEE1EB;}
-		.d2-625626608 .background-color-N6{background-color:#EEF1F8;}
-		.d2-625626608 .background-color-N7{background-color:#FFFFFF;}
-		.d2-625626608 .background-color-B1{background-color:#000536;}
-		.d2-625626608 .background-color-B2{background-color:#0F66B7;}
-		.d2-625626608 .background-color-B3{background-color:#4393DD;}
-		.d2-625626608 .background-color-B4{background-color:#87BFF3;}
-		.d2-625626608 .background-color-B5{background-color:#BCDDFB;}
-		.d2-625626608 .background-color-B6{background-color:#E5F3FF;}
-		.d2-625626608 .background-color-AA2{background-color:#7639C5;}
-		.d2-625626608 .background-color-AA4{background-color:#C1A2F3;}
-		.d2-625626608 .background-color-AA5{background-color:#DACEFB;}
-		.d2-625626608 .background-color-AB4{background-color:#EA99C6;}
-		.d2-625626608 .background-color-AB5{background-color:#FFDEF1;}
-		.d2-625626608 .color-N1{color:#0A0F25;}
-		.d2-625626608 .color-N2{color:#676C7E;}
-		.d2-625626608 .color-N3{color:#9499AB;}
-		.d2-625626608 .color-N4{color:#CFD2DD;}
-		.d2-625626608 .color-N5{color:#DEE1EB;}
-		.d2-625626608 .color-N6{color:#EEF1F8;}
-		.d2-625626608 .color-N7{color:#FFFFFF;}
-		.d2-625626608 .color-B1{color:#000536;}
-		.d2-625626608 .color-B2{color:#0F66B7;}
-		.d2-625626608 .color-B3{color:#4393DD;}
-		.d2-625626608 .color-B4{color:#87BFF3;}
-		.d2-625626608 .color-B5{color:#BCDDFB;}
-		.d2-625626608 .color-B6{color:#E5F3FF;}
-		.d2-625626608 .color-AA2{color:#7639C5;}
-		.d2-625626608 .color-AA4{color:#C1A2F3;}
-		.d2-625626608 .color-AA5{color:#DACEFB;}
-		.d2-625626608 .color-AB4{color:#EA99C6;}
-		.d2-625626608 .color-AB5{color:#FFDEF1;}.appendix text.text{fill:#0A0F25}.md{--color-fg-default:#0A0F25;--color-fg-muted:#676C7E;--color-fg-subtle:#9499AB;--color-canvas-default:#FFFFFF;--color-canvas-subtle:#EEF1F8;--color-border-default:#000536;--color-border-muted:#0F66B7;--color-neutral-muted:#EEF1F8;--color-accent-fg:#0F66B7;--color-accent-emphasis:#0F66B7;--color-attention-subtle:#676C7E;--color-danger-fg:red;}.sketch-overlay-B1{fill:url(#streaks-darker-d2-625626608);mix-blend-mode:lighten}.sketch-overlay-B2{fill:url(#streaks-dark-d2-625626608);mix-blend-mode:overlay}.sketch-overlay-B3{fill:url(#streaks-dark-d2-625626608);mix-blend-mode:overlay}.sketch-overlay-B4{fill:url(#streaks-normal-d2-625626608);mix-blend-mode:color-burn}.sketch-overlay-B5{fill:url(#streaks-normal-d2-625626608);mix-blend-mode:color-burn}.sketch-overlay-B6{fill:url(#streaks-bright-d2-625626608);mix-blend-mode:darken}.sketch-overlay-AA2{fill:url(#streaks-dark-d2-625626608);mix-blend-mode:overlay}.sketch-overlay-AA4{fill:url(#streaks-normal-d2-625626608);mix-blend-mode:color-burn}.sketch-overlay-AA5{fill:url(#streaks-normal-d2-625626608);mix-blend-mode:color-burn}.sketch-overlay-AB4{fill:url(#streaks-normal-d2-625626608);mix-blend-mode:color-burn}.sketch-overlay-AB5{fill:url(#streaks-bright-d2-625626608);mix-blend-mode:darken}.sketch-overlay-N1{fill:url(#streaks-darker-d2-625626608);mix-blend-mode:lighten}.sketch-overlay-N2{fill:url(#streaks-dark-d2-625626608);mix-blend-mode:overlay}.sketch-overlay-N3{fill:url(#streaks-normal-d2-625626608);mix-blend-mode:color-burn}.sketch-overlay-N4{fill:url(#streaks-normal-d2-625626608);mix-blend-mode:color-burn}.sketch-overlay-N5{fill:url(#streaks-bright-d2-625626608);mix-blend-mode:darken}.sketch-overlay-N6{fill:url(#streaks-bright-d2-625626608);mix-blend-mode:darken}.sketch-overlay-N7{fill:url(#streaks-bright-d2-625626608);mix-blend-mode:darken}.light-code{display: block}.dark-code{display: none}]]></style><g class="Y2xpZW50cw=="><g class="shape" ><rect x="258.000000" y="20.000000" width="1040.000000" height="126.000000" stroke="#000536" fill="transparent" class=" stroke-B1" style="stroke-width:2;" /></g><text x="778.000000" y="7.000000" fill="#0A0F25" class="text fill-N1" style="text-anchor:middle;font-size:28px">Clients</text></g><g class="ZmFub3V0"><g class="shape" ><rect x="239.000000" y="307.000000" width="1470.000000" height="751.000000" stroke="#000536" fill="#87BFF3" class=" stroke-B1 fill-B4" style="stroke-width:2;" /></g><text x="974.000000" y="294.000000" fill="#0A0F25" class="text fill-N1" style="text-anchor:middle;font-size:28px">fanout — one Go process</text></g><g class="c3RvcmU="><g class="shape" ><rect x="769.000000" y="1219.000000" width="1240.000000" height="194.000000" stroke="#000536" fill="transparent" class=" stroke-B1" style="stroke-width:2;" /></g><text x="1389.000000" y="1206.000000" fill="#0A0F25" class="text fill-N1" style="text-anchor:middle;font-size:28px">Storage</text></g><g class="bW9kZWw="><g class="shape" ><rect x="0.000000" y="954.000000" width="189.000000" height="66.000000" stroke="#0F66B7" fill="#E5F3FF" class=" stroke-B2 fill-B6" style="stroke-width:2;stroke-dasharray:6.000000,5.919384;" /></g><text x="94.500000" y="992.500000" fill="#0A0F25" class="text-bold fill-N1" style="text-anchor:middle;font-size:16px">Anthropic or OpenAI</text></g><g class="Y2xpZW50cy5jb2xsZWN0b3I="><g class="shape" ><rect x="288.000000" y="50.000000" width="200.000000" height="66.000000" stroke="#0F66B7" fill="#BCDDFB" class=" stroke-B2 fill-B5" style="stroke-width:2;stroke-dasharray:6.000000,5.919384;" /></g><text x="388.000000" y="88.500000" fill="#0A0F25" class="text-bold fill-N1" style="text-anchor:middle;font-size:16px">OTLP collector or SDK</text></g><g class="Y2xpZW50cy5icm93c2Vy"><g class="shape" ><rect x="548.000000" y="50.000000" width="104.000000" height="66.000000" stroke="#0F66B7" fill="#BCDDFB" class=" stroke-B2 fill-B5" style="stroke-width:2;stroke-dasharray:6.000000,5.919384;" /></g><text x="600.000000" y="88.500000" fill="#0A0F25" class="text-bold fill-N1" style="text-anchor:middle;font-size:16px">Browser</text></g><g class="Y2xpZW50cy5leHQ="><g class="shape" ><rect x="1095.000000" y="50.000000" width="173.000000" height="66.000000" stroke="#0F66B7" fill="#BCDDFB" class=" stroke-B2 fill-B5" style="stroke-width:2;stroke-dasharray:6.000000,5.919384;" /></g><text x="1181.500000" y="88.500000" fill="#0A0F25" class="text-bold fill-N1" style="text-anchor:middle;font-size:16px">External MCP host</text></g><g class="ZmFub3V0Lmh0dHA="><g class="shape" ><rect x="870.000000" y="337.000000" width="226.000000" height="82.000000" stroke="#000536" fill="#BCDDFB" class=" stroke-B1 fill-B5" style="stroke-width:2;" /></g><text x="983.000000" y="375.500000" fill="#0A0F25" class="text-bold fill-N1" style="text-anchor:middle;font-size:16px"><tspan x="983.000000" dy="0.000000">HTTP :7520</tspan><tspan x="983.000000" dy="18.500000">routes + auth middleware</tspan></text></g><g class="ZmFub3V0LmluZ2VzdA=="><g class="shape" ><rect x="279.000000" y="743.000000" width="218.000000" height="82.000000" stroke="#000536" fill="#BCDDFB" class=" stroke-B1 fill-B5" style="stroke-width:2;" /></g><text x="388.000000" y="781.500000" fill="#0A0F25" class="text-bold fill-N1" style="text-anchor:middle;font-size:16px"><tspan x="388.000000" dy="0.000000">Ingest</tspan><tspan x="388.000000" dy="18.500000">OTLP gRPC + HTTP :7520</tspan></text></g><g class="ZmFub3V0LnVp"><g class="shape" ><rect x="468.000000" y="548.000000" width="211.000000" height="66.000000" stroke="#000536" fill="#BCDDFB" class=" stroke-B1 fill-B5" style="stroke-width:2;" /></g><text x="573.500000" y="586.500000" fill="#0A0F25" class="text-bold fill-N1" style="text-anchor:middle;font-size:16px">Embedded React assets</text></g><g class="ZmFub3V0LmFnZW50"><g class="shape" ><rect x="721.000000" y="743.000000" width="169.000000" height="82.000000" stroke="#000536" fill="#BCDDFB" class=" stroke-B1 fill-B5" style="stroke-width:2;" /></g><text x="805.500000" y="781.500000" fill="#0A0F25" class="text-bold fill-N1" style="text-anchor:middle;font-size:16px"><tspan x="805.500000" dy="0.000000">Agent runtime</tspan><tspan x="805.500000" dy="18.500000">model + tool loop</tspan></text></g><g class="ZmFub3V0Lm1jcA=="><g class="shape" ><rect x="845.000000" y="540.000000" width="239.000000" height="82.000000" stroke="#000536" fill="#BCDDFB" class=" stroke-B1 fill-B5" style="stroke-width:2;" /></g><text x="964.500000" y="578.500000" fill="#0A0F25" class="text-bold fill-N1" style="text-anchor:middle;font-size:16px"><tspan x="964.500000" dy="0.000000">MCP server</tspan><tspan x="964.500000" dy="18.500000">5 typed + 4 dashboard tools</tspan></text></g><g class="ZmFub3V0Lm9icw=="><g class="shape" ><rect x="989.000000" y="751.000000" width="249.000000" height="66.000000" stroke="#000536" fill="#BCDDFB" class=" stroke-B1 fill-B5" style="stroke-width:2;" /></g><text x="1113.500000" y="789.500000" fill="#0A0F25" class="text-bold fill-N1" style="text-anchor:middle;font-size:16px">Typed observability contract</text></g><g class="ZmFub3V0LmNvbW1pdA=="><g class="shape" ><rect x="269.000000" y="946.000000" width="237.000000" height="82.000000" stroke="#000536" fill="#BCDDFB" class=" stroke-B1 fill-B5" style="stroke-width:2;" /></g><text x="387.500000" y="984.500000" fill="#0A0F25" class="text-bold fill-N1" style="text-anchor:middle;font-size:16px"><tspan x="387.500000" dy="0.000000">Telemetry commit workers</tspan><tspan x="387.500000" dy="18.500000">atomic Parquet batches</tspan></text></g><g class="ZmFub3V0LnF1ZXJ5"><g class="shape" ><rect x="1069.000000" y="946.000000" width="165.000000" height="82.000000" stroke="#000536" fill="#BCDDFB" class=" stroke-B1 fill-B5" style="stroke-width:2;" /></g><text x="1151.500000" y="984.500000" fill="#0A0F25" class="text-bold fill-N1" style="text-anchor:middle;font-size:16px"><tspan x="1151.500000" dy="0.000000">Query kernel</tspan><tspan x="1151.500000" dy="18.500000">DuckDB + rollups</tspan></text></g><g class="ZmFub3V0Lm1haW50"><g class="shape" ><rect x="1294.000000" y="946.000000" width="259.000000" height="82.000000" stroke="#000536" fill="#BCDDFB" class=" stroke-B1 fill-B5" style="stroke-width:2;" /></g><text x="1423.500000" y="984.500000" fill="#0A0F25" class="text-bold fill-N1" style="text-anchor:middle;font-size:16px"><tspan x="1423.500000" dy="0.000000">Storage maintenance</tspan><tspan x="1423.500000" dy="18.500000">retention + native compaction</tspan></text></g><g class="ZmFub3V0LmFsZXJ0"><g class="shape" ><rect x="1438.000000" y="743.000000" width="241.000000" height="82.000000" stroke="#000536" fill="#BCDDFB" class=" stroke-B1 fill-B5" style="stroke-width:2;" /></g><text x="1558.500000" y="781.500000" fill="#0A0F25" class="text-bold fill-N1" style="text-anchor:middle;font-size:16px"><tspan x="1558.500000" dy="0.000000">Alert engine</tspan><tspan x="1558.500000" dy="18.500000">rule evaluation + webhooks</tspan></text></g><g class="c3RvcmUudGVsZW1ldHJ5"><g class="shape" ><path d="M 799 1273 C 799 1249 921 1249 935 1249 C 948 1249 1070 1249 1070 1273 V 1359 C 1070 1383 948 1383 935 1383 C 921 1383 799 1383 799 1359 V 1273 Z" stroke="#000536" fill="#DACEFB" class=" stroke-B1 fill-AA5" style="stroke-width:2;" /><path d="M 799 1273 C 799 1297 921 1297 935 1297 C 948 1297 1070 1297 1070 1273" stroke="#000536" fill="#DACEFB" class=" stroke-B1 fill-AA5" style="stroke-width:2;" /></g><text x="934.500000" y="1325.500000" fill="#0A0F25" class="text-bold fill-N1" style="text-anchor:middle;font-size:16px"><tspan x="934.500000" dy="0.000000">Parquet batches + trace indexes</tspan><tspan x="934.500000" dy="18.500000">storage.data_dir/telemetry</tspan></text></g><g class="c3RvcmUucXN0YXRl"><g class="shape" ><path d="M 1404 1273 C 1404 1249 1499 1249 1510 1249 C 1521 1249 1616 1249 1616 1273 V 1359 C 1616 1383 1521 1383 1510 1383 C 1499 1383 1404 1383 1404 1359 V 1273 Z" stroke="#000536" fill="#DACEFB" class=" stroke-B1 fill-AA5" style="stroke-width:2;" /><path d="M 1404 1273 C 1404 1297 1499 1297 1510 1297 C 1521 1297 1616 1297 1616 1273" stroke="#000536" fill="#DACEFB" class=" stroke-B1 fill-AA5" style="stroke-width:2;" /></g><text x="1510.000000" y="1325.500000" fill="#0A0F25" class="text-bold fill-N1" style="text-anchor:middle;font-size:16px"><tspan x="1510.000000" dy="0.000000">DuckDB query state</tspan><tspan x="1510.000000" dy="18.500000">storage.data_dir/query</tspan></text></g><g class="c3RvcmUuY29udHJvbA=="><g class="shape" ><path d="M 1758 1273 C 1758 1249 1857 1249 1869 1249 C 1880 1249 1979 1249 1979 1273 V 1359 C 1979 1383 1880 1383 1869 1383 C 1857 1383 1758 1383 1758 1359 V 1273 Z" stroke="#000536" fill="#DACEFB" class=" stroke-B1 fill-AA5" style="stroke-width:2;" /><path d="M 1758 1273 C 1758 1297 1857 1297 1869 1297 C 1880 1297 1979 1297 1979 1273" stroke="#000536" fill="#DACEFB" class=" stroke-B1 fill-AA5" style="stroke-width:2;" /></g><text x="1868.500000" y="1325.500000" fill="#0A0F25" class="text-bold fill-N1" style="text-anchor:middle;font-size:16px"><tspan x="1868.500000" dy="0.000000">Control SQLite</tspan><tspan x="1868.500000" dy="18.500000">storage.data_dir/control</tspan></text></g><g class="ZmFub3V0Lihpbmdlc3QgLSZndDsgY29tbWl0KVswXQ=="><marker id="mk-d2-625626608-3488378134" markerWidth="10.000000" markerHeight="12.000000" refX="7.000000" refY="6.000000" viewBox="0.000000 0.000000 10.000000 12.000000" orient="auto" markerUnits="userSpaceOnUse"> <polygon points="0.000000,0.000000 10.000000,6.000000 0.000000,12.000000" fill="#000536" class="connection fill-B1" stroke-width="2" /> </marker><path d="M 387.500000 826.500000 C 387.500000 873.299988 387.500000 897.700012 387.500000 942.500000" stroke="#000536" fill="none" class="connection stroke-B1" style="stroke-width:2;" marker-end="url(#mk-d2-625626608-3488378134)" mask="url(#d2-625626608)" /></g><g class="ZmFub3V0LihodHRwIC0mZ3Q7IHVpKVswXQ=="><path d="M 867.808675 406.471888 C 632.349976 464.798004 573.000000 493.299988 573.000000 544.500000" stroke="#000536" fill="none" class="connection stroke-B1" style="stroke-width:2;" marker-end="url(#mk-d2-625626608-3488378134)" mask="url(#d2-625626608)" /><text x="692.000000" y="455.000000" fill="#676C7E" class="text-italic fill-N2" style="text-anchor:middle;font-size:16px">serves embedded assets</text></g><g class="ZmFub3V0LihodHRwIC0mZ3Q7IGFnZW50KVswXQ=="><path d="M 891.684484 419.338988 C 787.900024 467.299988 761.500000 499.799988 761.500000 530.250000 C 761.500000 560.700012 766.700012 694.700012 785.931607 739.820307" stroke="#000536" fill="none" class="connection stroke-B1" style="stroke-width:2;" marker-end="url(#mk-d2-625626608-3488378134)" mask="url(#d2-625626608)" /><text x="762.000000" y="550.000000" fill="#676C7E" class="text-italic fill-N2" style="text-anchor:middle;font-size:16px">AG-UI stream</text></g><g class="ZmFub3V0LihodHRwIC0mZ3Q7IG1jcClbMF0="><path d="M 974.645069 420.468254 C 966.200012 467.299988 964.000000 491.700012 964.000000 536.500000" stroke="#000536" fill="none" class="connection stroke-B1" style="stroke-width:2;" marker-end="url(#mk-d2-625626608-3488378134)" mask="url(#d2-625626608)" /></g><g class="ZmFub3V0LihtY3AgLSZndDsgYWdlbnQpWzBd"><path d="M 940.026283 623.246962 C 913.799988 670.299988 895.000000 694.700012 849.804956 740.648295" stroke="#000536" fill="none" class="connection stroke-B1" style="stroke-width:2;" marker-end="url(#mk-d2-625626608-3488378134)" mask="url(#d2-625626608)" /><text x="900.500000" y="693.000000" fill="#676C7E" class="text-italic fill-N2" style="text-anchor:middle;font-size:16px">in-memory transport</text></g><g class="ZmFub3V0LihtY3AgLSZndDsgb2JzKVswXQ=="><path d="M 983.034197 623.339847 C 1003.049988 670.299988 1022.250000 696.299988 1075.401299 748.691994" stroke="#000536" fill="none" class="connection stroke-B1" style="stroke-width:2;" marker-end="url(#mk-d2-625626608-3488378134)" mask="url(#d2-625626608)" /></g><g class="ZmFub3V0LihodHRwIC0mZ3Q7IG9icylbMF0="><path d="M 1098.189095 406.989806 C 1327.449951 464.899994 1385.250000 499.799988 1385.250000 530.250000 C 1385.250000 560.700012 1348.650024 696.299988 1205.992789 750.088784" stroke="#000536" fill="none" class="connection stroke-B1" style="stroke-width:2;" marker-end="url(#mk-d2-625626608-3488378134)" mask="url(#d2-625626608)" /><text x="1385.000000" y="531.000000" fill="#676C7E" class="text-italic fill-N2" style="text-anchor:middle;font-size:16px">typed HTTP API</text></g><g class="ZmFub3V0LihvYnMgLSZndDsgcXVlcnkpWzBd"><path d="M 1113.000000 818.500000 C 1113.000000 871.700012 1117.599976 897.700012 1134.588782 942.757212" stroke="#000536" fill="none" class="connection stroke-B1" style="stroke-width:2;" marker-end="url(#mk-d2-625626608-3488378134)" mask="url(#d2-625626608)" /></g><g class="ZmFub3V0LihhbGVydCAtJmd0OyBxdWVyeSlbMF0="><path d="M 1453.893890 825.244886 C 1334.150024 873.299988 1285.750000 897.700012 1217.061124 944.255794" stroke="#000536" fill="none" class="connection stroke-B1" style="stroke-width:2;" marker-end="url(#mk-d2-625626608-3488378134)" mask="url(#d2-625626608)" /><text x="1329.500000" y="881.000000" fill="#676C7E" class="text-italic fill-N2" style="text-anchor:middle;font-size:16px">evaluates rollups</text></g><g class="KGNsaWVudHMuY29sbGVjdG9yIC0mZ3Q7IGZhbm91dC5pbmdlc3QpWzBd"><path d="M 387.500000 118.000000 C 387.500000 156.000000 387.500000 178.100006 387.500000 196.250000 C 387.500000 214.399994 387.500000 238.600006 387.500000 256.750000 C 387.500000 274.899994 387.500000 305.200012 387.500000 332.500000 C 387.500000 359.799988 387.500000 398.299988 387.500000 428.750000 C 387.500000 459.200012 387.500000 499.799988 387.500000 530.250000 C 387.500000 560.700012 387.500000 694.700012 387.500000 739.500000" stroke="#000536" fill="none" class="connection stroke-B1" style="stroke-width:2;" marker-end="url(#mk-d2-625626608-3488378134)" mask="url(#d2-625626608)" /><text x="387.500000" y="435.000000" fill="#676C7E" class="text-italic fill-N2" style="text-anchor:middle;font-size:16px">OTLP/gRPC or OTLP/HTTP</text></g><g class="KGNsaWVudHMuYnJvd3NlciAtJmd0OyBmYW5vdXQuaHR0cClbMF0="><path d="M 599.500000 118.000000 C 599.500000 156.000000 599.500000 178.100006 599.500000 196.250000 C 599.500000 214.399994 653.549988 299.833008 865.858203 350.243923" stroke="#000536" fill="none" class="connection stroke-B1" style="stroke-width:2;" marker-end="url(#mk-d2-625626608-3488378134)" mask="url(#d2-625626608)" /><text x="664.500000" y="308.000000" fill="#676C7E" class="text-italic fill-N2" style="text-anchor:middle;font-size:16px">HTTPS</text></g><g class="KGNsaWVudHMuZXh0IC0mZ3Q7IGZhbm91dC5odHRwKVswXQ=="><path d="M 1181.250000 118.000000 C 1181.250000 156.000000 1181.250000 178.100006 1181.250000 196.250000 C 1181.250000 214.399994 1159.449951 297.000000 1075.885732 335.332232" stroke="#000536" fill="none" class="connection stroke-B1" style="stroke-width:2;" marker-end="url(#mk-d2-625626608-3488378134)" mask="url(#d2-625626608)" /><text x="1170.500000" y="260.000000" fill="#676C7E" class="text-italic fill-N2" style="text-anchor:middle;font-size:16px">/mcp — OAuth</text></g><g class="KGZhbm91dC5jb21taXQgLSZndDsgc3RvcmUudGVsZW1ldHJ5KVswXQ=="><path d="M 387.500000 1030.000000 C 387.500000 1068.000000 387.500000 1090.099976 387.500000 1108.250000 C 387.500000 1126.400024 469.799988 1216.599976 795.088443 1286.163506" stroke="#000536" fill="none" class="connection stroke-B1" style="stroke-width:2;" marker-end="url(#mk-d2-625626608-3488378134)" mask="url(#d2-625626608)" /></g><g class="KGZhbm91dC5xdWVyeSAtJmd0OyBzdG9yZS50ZWxlbWV0cnkpWzBd"><path d="M 1066.809872 1008.138712 C 843.950012 1063.930054 787.750000 1090.099976 787.750000 1108.250000 C 787.750000 1126.400024 801.200012 1209.800049 851.881053 1250.495569" stroke="#000536" fill="none" class="connection stroke-B1" style="stroke-width:2;" marker-end="url(#mk-d2-625626608-3488378134)" mask="url(#d2-625626608)" /><text x="835.000000" y="1074.000000" fill="#676C7E" class="text-italic fill-N2" style="text-anchor:middle;font-size:16px">indexed traces + SQL scans</text></g><g class="KGZhbm91dC5xdWVyeSAtJmd0OyBzdG9yZS5xc3RhdGUpWzBd"><path d="M 1194.428147 1029.400142 C 1233.800049 1068.000000 1244.000000 1090.099976 1244.000000 1108.250000 C 1244.000000 1126.400024 1276.199951 1213.000000 1401.331720 1267.405096" stroke="#000536" fill="none" class="connection stroke-B1" style="stroke-width:2;" marker-end="url(#mk-d2-625626608-3488378134)" mask="url(#d2-625626608)" /></g><g class="KGZhbm91dC5tYWludCAtJmd0OyBzdG9yZS50ZWxlbWV0cnkpWzBd"><path d="M 1423.250000 1030.000000 C 1423.250000 1068.000000 1423.250000 1090.099976 1423.250000 1108.250000 C 1423.250000 1126.400024 1352.599976 1216.000000 1073.888999 1283.064218" stroke="#000536" fill="none" class="connection stroke-B1" style="stroke-width:2;" marker-end="url(#mk-d2-625626608-3488378134)" mask="url(#d2-625626608)" /><text x="1314.500000" y="1231.000000" fill="#676C7E" class="text-italic fill-N2" style="text-anchor:middle;font-size:16px">atomic replacement</text></g><g class="KGZhbm91dC5odHRwIC0mZ3Q7IHN0b3JlLmNvbnRyb2wpWzBd"><path d="M 1097.986840 390.729053 C 1713.599976 461.700012 1868.000000 499.799988 1868.000000 530.250000 C 1868.000000 560.700012 1868.000000 601.299988 1868.000000 631.750000 C 1868.000000 662.200012 1868.000000 702.799988 1868.000000 733.250000 C 1868.000000 763.700012 1868.000000 804.299988 1868.000000 834.750000 C 1868.000000 865.200012 1868.000000 905.799988 1868.000000 936.250000 C 1868.000000 966.700012 1868.000000 1005.200012 1868.000000 1032.500000 C 1868.000000 1059.800049 1868.000000 1090.099976 1868.000000 1108.250000 C 1868.000000 1126.400024 1868.000000 1209.000000 1868.000000 1245.000000" stroke="#000536" fill="none" class="connection stroke-B1" style="stroke-width:2;" marker-end="url(#mk-d2-625626608-3488378134)" mask="url(#d2-625626608)" /><text x="1853.000000" y="502.000000" fill="#676C7E" class="text-italic fill-N2" style="text-anchor:middle;font-size:16px">users, sessions, settings, dashboards, threads</text></g><g class="KGZhbm91dC5hbGVydCAtJmd0OyBzdG9yZS5jb250cm9sKVswXQ=="><path d="M 1601.164214 825.914213 C 1648.550049 873.299988 1660.750000 905.799988 1660.750000 936.250000 C 1660.750000 966.700012 1660.750000 1005.200012 1660.750000 1032.500000 C 1660.750000 1059.800049 1660.750000 1090.099976 1660.750000 1108.250000 C 1660.750000 1126.400024 1682.599976 1211.400024 1766.521163 1259.025742" stroke="#000536" fill="none" class="connection stroke-B1" style="stroke-width:2;" marker-end="url(#mk-d2-625626608-3488378134)" mask="url(#d2-625626608)" /><text x="1661.000000" y="1064.000000" fill="#676C7E" class="text-italic fill-N2" style="text-anchor:middle;font-size:16px">rules and fired alerts</text></g><g class="KGZhbm91dC5hZ2VudCAtJmd0OyBtb2RlbClbMF0="><path d="M 805.750000 826.500000 C 805.750000 873.299988 682.349976 903.099976 192.709926 972.935213" stroke="#000536" fill="none" class="connection stroke-B1" style="stroke-width:2;" marker-end="url(#mk-d2-625626608-3488378134)" mask="url(#d2-625626608)" /><text x="522.500000" y="931.000000" fill="#676C7E" class="text-italic fill-N2" style="text-anchor:middle;font-size:16px">HTTPS</text></g><mask id="d2-625626608" maskUnits="userSpaceOnUse" x="-101" y="-121" width="2211" height="1635">
-<rect x="-101" y="-121" width="2211" height="1635" fill="white"></rect>
+		.d2-37886755 .fill-N1{fill:#0A0F25;}
+		.d2-37886755 .fill-N2{fill:#676C7E;}
+		.d2-37886755 .fill-N3{fill:#9499AB;}
+		.d2-37886755 .fill-N4{fill:#CFD2DD;}
+		.d2-37886755 .fill-N5{fill:#DEE1EB;}
+		.d2-37886755 .fill-N6{fill:#EEF1F8;}
+		.d2-37886755 .fill-N7{fill:#FFFFFF;}
+		.d2-37886755 .fill-B1{fill:#000536;}
+		.d2-37886755 .fill-B2{fill:#0F66B7;}
+		.d2-37886755 .fill-B3{fill:#4393DD;}
+		.d2-37886755 .fill-B4{fill:#87BFF3;}
+		.d2-37886755 .fill-B5{fill:#BCDDFB;}
+		.d2-37886755 .fill-B6{fill:#E5F3FF;}
+		.d2-37886755 .fill-AA2{fill:#7639C5;}
+		.d2-37886755 .fill-AA4{fill:#C1A2F3;}
+		.d2-37886755 .fill-AA5{fill:#DACEFB;}
+		.d2-37886755 .fill-AB4{fill:#EA99C6;}
+		.d2-37886755 .fill-AB5{fill:#FFDEF1;}
+		.d2-37886755 .stroke-N1{stroke:#0A0F25;}
+		.d2-37886755 .stroke-N2{stroke:#676C7E;}
+		.d2-37886755 .stroke-N3{stroke:#9499AB;}
+		.d2-37886755 .stroke-N4{stroke:#CFD2DD;}
+		.d2-37886755 .stroke-N5{stroke:#DEE1EB;}
+		.d2-37886755 .stroke-N6{stroke:#EEF1F8;}
+		.d2-37886755 .stroke-N7{stroke:#FFFFFF;}
+		.d2-37886755 .stroke-B1{stroke:#000536;}
+		.d2-37886755 .stroke-B2{stroke:#0F66B7;}
+		.d2-37886755 .stroke-B3{stroke:#4393DD;}
+		.d2-37886755 .stroke-B4{stroke:#87BFF3;}
+		.d2-37886755 .stroke-B5{stroke:#BCDDFB;}
+		.d2-37886755 .stroke-B6{stroke:#E5F3FF;}
+		.d2-37886755 .stroke-AA2{stroke:#7639C5;}
+		.d2-37886755 .stroke-AA4{stroke:#C1A2F3;}
+		.d2-37886755 .stroke-AA5{stroke:#DACEFB;}
+		.d2-37886755 .stroke-AB4{stroke:#EA99C6;}
+		.d2-37886755 .stroke-AB5{stroke:#FFDEF1;}
+		.d2-37886755 .background-color-N1{background-color:#0A0F25;}
+		.d2-37886755 .background-color-N2{background-color:#676C7E;}
+		.d2-37886755 .background-color-N3{background-color:#9499AB;}
+		.d2-37886755 .background-color-N4{background-color:#CFD2DD;}
+		.d2-37886755 .background-color-N5{background-color:#DEE1EB;}
+		.d2-37886755 .background-color-N6{background-color:#EEF1F8;}
+		.d2-37886755 .background-color-N7{background-color:#FFFFFF;}
+		.d2-37886755 .background-color-B1{background-color:#000536;}
+		.d2-37886755 .background-color-B2{background-color:#0F66B7;}
+		.d2-37886755 .background-color-B3{background-color:#4393DD;}
+		.d2-37886755 .background-color-B4{background-color:#87BFF3;}
+		.d2-37886755 .background-color-B5{background-color:#BCDDFB;}
+		.d2-37886755 .background-color-B6{background-color:#E5F3FF;}
+		.d2-37886755 .background-color-AA2{background-color:#7639C5;}
+		.d2-37886755 .background-color-AA4{background-color:#C1A2F3;}
+		.d2-37886755 .background-color-AA5{background-color:#DACEFB;}
+		.d2-37886755 .background-color-AB4{background-color:#EA99C6;}
+		.d2-37886755 .background-color-AB5{background-color:#FFDEF1;}
+		.d2-37886755 .color-N1{color:#0A0F25;}
+		.d2-37886755 .color-N2{color:#676C7E;}
+		.d2-37886755 .color-N3{color:#9499AB;}
+		.d2-37886755 .color-N4{color:#CFD2DD;}
+		.d2-37886755 .color-N5{color:#DEE1EB;}
+		.d2-37886755 .color-N6{color:#EEF1F8;}
+		.d2-37886755 .color-N7{color:#FFFFFF;}
+		.d2-37886755 .color-B1{color:#000536;}
+		.d2-37886755 .color-B2{color:#0F66B7;}
+		.d2-37886755 .color-B3{color:#4393DD;}
+		.d2-37886755 .color-B4{color:#87BFF3;}
+		.d2-37886755 .color-B5{color:#BCDDFB;}
+		.d2-37886755 .color-B6{color:#E5F3FF;}
+		.d2-37886755 .color-AA2{color:#7639C5;}
+		.d2-37886755 .color-AA4{color:#C1A2F3;}
+		.d2-37886755 .color-AA5{color:#DACEFB;}
+		.d2-37886755 .color-AB4{color:#EA99C6;}
+		.d2-37886755 .color-AB5{color:#FFDEF1;}.appendix text.text{fill:#0A0F25}.md{--color-fg-default:#0A0F25;--color-fg-muted:#676C7E;--color-fg-subtle:#9499AB;--color-canvas-default:#FFFFFF;--color-canvas-subtle:#EEF1F8;--color-border-default:#000536;--color-border-muted:#0F66B7;--color-neutral-muted:#EEF1F8;--color-accent-fg:#0F66B7;--color-accent-emphasis:#0F66B7;--color-attention-subtle:#676C7E;--color-danger-fg:red;}.sketch-overlay-B1{fill:url(#streaks-darker-d2-37886755);mix-blend-mode:lighten}.sketch-overlay-B2{fill:url(#streaks-dark-d2-37886755);mix-blend-mode:overlay}.sketch-overlay-B3{fill:url(#streaks-dark-d2-37886755);mix-blend-mode:overlay}.sketch-overlay-B4{fill:url(#streaks-normal-d2-37886755);mix-blend-mode:color-burn}.sketch-overlay-B5{fill:url(#streaks-normal-d2-37886755);mix-blend-mode:color-burn}.sketch-overlay-B6{fill:url(#streaks-bright-d2-37886755);mix-blend-mode:darken}.sketch-overlay-AA2{fill:url(#streaks-dark-d2-37886755);mix-blend-mode:overlay}.sketch-overlay-AA4{fill:url(#streaks-normal-d2-37886755);mix-blend-mode:color-burn}.sketch-overlay-AA5{fill:url(#streaks-normal-d2-37886755);mix-blend-mode:color-burn}.sketch-overlay-AB4{fill:url(#streaks-normal-d2-37886755);mix-blend-mode:color-burn}.sketch-overlay-AB5{fill:url(#streaks-bright-d2-37886755);mix-blend-mode:darken}.sketch-overlay-N1{fill:url(#streaks-darker-d2-37886755);mix-blend-mode:lighten}.sketch-overlay-N2{fill:url(#streaks-dark-d2-37886755);mix-blend-mode:overlay}.sketch-overlay-N3{fill:url(#streaks-normal-d2-37886755);mix-blend-mode:color-burn}.sketch-overlay-N4{fill:url(#streaks-normal-d2-37886755);mix-blend-mode:color-burn}.sketch-overlay-N5{fill:url(#streaks-bright-d2-37886755);mix-blend-mode:darken}.sketch-overlay-N6{fill:url(#streaks-bright-d2-37886755);mix-blend-mode:darken}.sketch-overlay-N7{fill:url(#streaks-bright-d2-37886755);mix-blend-mode:darken}.light-code{display: block}.dark-code{display: none}]]></style><g class="Y2xpZW50cw=="><g class="shape" ><rect x="258.000000" y="20.000000" width="1040.000000" height="126.000000" stroke="#000536" fill="transparent" class=" stroke-B1" style="stroke-width:2;" /></g><text x="778.000000" y="7.000000" fill="#0A0F25" class="text fill-N1" style="text-anchor:middle;font-size:28px">Clients</text></g><g class="ZmFub3V0"><g class="shape" ><rect x="239.000000" y="307.000000" width="1470.000000" height="751.000000" stroke="#000536" fill="#87BFF3" class=" stroke-B1 fill-B4" style="stroke-width:2;" /></g><text x="974.000000" y="294.000000" fill="#0A0F25" class="text fill-N1" style="text-anchor:middle;font-size:28px">fanout — one Go process</text></g><g class="c3RvcmU="><g class="shape" ><rect x="761.000000" y="1219.000000" width="1257.000000" height="194.000000" stroke="#000536" fill="transparent" class=" stroke-B1" style="stroke-width:2;" /></g><text x="1389.500000" y="1206.000000" fill="#0A0F25" class="text fill-N1" style="text-anchor:middle;font-size:28px">Storage</text></g><g class="bW9kZWw="><g class="shape" ><rect x="0.000000" y="954.000000" width="189.000000" height="66.000000" stroke="#0F66B7" fill="#E5F3FF" class=" stroke-B2 fill-B6" style="stroke-width:2;stroke-dasharray:6.000000,5.919384;" /></g><text x="94.500000" y="992.500000" fill="#0A0F25" class="text-bold fill-N1" style="text-anchor:middle;font-size:16px">Anthropic or OpenAI</text></g><g class="Y2xpZW50cy5jb2xsZWN0b3I="><g class="shape" ><rect x="288.000000" y="50.000000" width="200.000000" height="66.000000" stroke="#0F66B7" fill="#BCDDFB" class=" stroke-B2 fill-B5" style="stroke-width:2;stroke-dasharray:6.000000,5.919384;" /></g><text x="388.000000" y="88.500000" fill="#0A0F25" class="text-bold fill-N1" style="text-anchor:middle;font-size:16px">OTLP collector or SDK</text></g><g class="Y2xpZW50cy5icm93c2Vy"><g class="shape" ><rect x="548.000000" y="50.000000" width="104.000000" height="66.000000" stroke="#0F66B7" fill="#BCDDFB" class=" stroke-B2 fill-B5" style="stroke-width:2;stroke-dasharray:6.000000,5.919384;" /></g><text x="600.000000" y="88.500000" fill="#0A0F25" class="text-bold fill-N1" style="text-anchor:middle;font-size:16px">Browser</text></g><g class="Y2xpZW50cy5leHQ="><g class="shape" ><rect x="1095.000000" y="50.000000" width="173.000000" height="66.000000" stroke="#0F66B7" fill="#BCDDFB" class=" stroke-B2 fill-B5" style="stroke-width:2;stroke-dasharray:6.000000,5.919384;" /></g><text x="1181.500000" y="88.500000" fill="#0A0F25" class="text-bold fill-N1" style="text-anchor:middle;font-size:16px">External MCP host</text></g><g class="ZmFub3V0Lmh0dHA="><g class="shape" ><rect x="870.000000" y="337.000000" width="226.000000" height="82.000000" stroke="#000536" fill="#BCDDFB" class=" stroke-B1 fill-B5" style="stroke-width:2;" /></g><text x="983.000000" y="375.500000" fill="#0A0F25" class="text-bold fill-N1" style="text-anchor:middle;font-size:16px"><tspan x="983.000000" dy="0.000000">HTTP :7520</tspan><tspan x="983.000000" dy="18.500000">routes + auth middleware</tspan></text></g><g class="ZmFub3V0LmluZ2VzdA=="><g class="shape" ><rect x="279.000000" y="743.000000" width="218.000000" height="82.000000" stroke="#000536" fill="#BCDDFB" class=" stroke-B1 fill-B5" style="stroke-width:2;" /></g><text x="388.000000" y="781.500000" fill="#0A0F25" class="text-bold fill-N1" style="text-anchor:middle;font-size:16px"><tspan x="388.000000" dy="0.000000">Ingest</tspan><tspan x="388.000000" dy="18.500000">OTLP gRPC + HTTP :7520</tspan></text></g><g class="ZmFub3V0LnVp"><g class="shape" ><rect x="468.000000" y="548.000000" width="211.000000" height="66.000000" stroke="#000536" fill="#BCDDFB" class=" stroke-B1 fill-B5" style="stroke-width:2;" /></g><text x="573.500000" y="586.500000" fill="#0A0F25" class="text-bold fill-N1" style="text-anchor:middle;font-size:16px">Embedded React assets</text></g><g class="ZmFub3V0LmFnZW50"><g class="shape" ><rect x="721.000000" y="743.000000" width="169.000000" height="82.000000" stroke="#000536" fill="#BCDDFB" class=" stroke-B1 fill-B5" style="stroke-width:2;" /></g><text x="805.500000" y="781.500000" fill="#0A0F25" class="text-bold fill-N1" style="text-anchor:middle;font-size:16px"><tspan x="805.500000" dy="0.000000">Agent runtime</tspan><tspan x="805.500000" dy="18.500000">model + tool loop</tspan></text></g><g class="ZmFub3V0Lm1jcA=="><g class="shape" ><rect x="845.000000" y="540.000000" width="239.000000" height="82.000000" stroke="#000536" fill="#BCDDFB" class=" stroke-B1 fill-B5" style="stroke-width:2;" /></g><text x="964.500000" y="578.500000" fill="#0A0F25" class="text-bold fill-N1" style="text-anchor:middle;font-size:16px"><tspan x="964.500000" dy="0.000000">MCP server</tspan><tspan x="964.500000" dy="18.500000">5 typed + 4 dashboard tools</tspan></text></g><g class="ZmFub3V0Lm9icw=="><g class="shape" ><rect x="989.000000" y="751.000000" width="249.000000" height="66.000000" stroke="#000536" fill="#BCDDFB" class=" stroke-B1 fill-B5" style="stroke-width:2;" /></g><text x="1113.500000" y="789.500000" fill="#0A0F25" class="text-bold fill-N1" style="text-anchor:middle;font-size:16px">Typed observability contract</text></g><g class="ZmFub3V0LmNvbW1pdA=="><g class="shape" ><rect x="269.000000" y="946.000000" width="237.000000" height="82.000000" stroke="#000536" fill="#BCDDFB" class=" stroke-B1 fill-B5" style="stroke-width:2;" /></g><text x="387.500000" y="984.500000" fill="#0A0F25" class="text-bold fill-N1" style="text-anchor:middle;font-size:16px"><tspan x="387.500000" dy="0.000000">Telemetry commit workers</tspan><tspan x="387.500000" dy="18.500000">atomic Parquet batches</tspan></text></g><g class="ZmFub3V0LnF1ZXJ5"><g class="shape" ><rect x="1069.000000" y="946.000000" width="165.000000" height="82.000000" stroke="#000536" fill="#BCDDFB" class=" stroke-B1 fill-B5" style="stroke-width:2;" /></g><text x="1151.500000" y="984.500000" fill="#0A0F25" class="text-bold fill-N1" style="text-anchor:middle;font-size:16px"><tspan x="1151.500000" dy="0.000000">Query kernel</tspan><tspan x="1151.500000" dy="18.500000">DuckDB + rollups</tspan></text></g><g class="ZmFub3V0Lm1haW50"><g class="shape" ><rect x="1294.000000" y="946.000000" width="259.000000" height="82.000000" stroke="#000536" fill="#BCDDFB" class=" stroke-B1 fill-B5" style="stroke-width:2;" /></g><text x="1423.500000" y="984.500000" fill="#0A0F25" class="text-bold fill-N1" style="text-anchor:middle;font-size:16px"><tspan x="1423.500000" dy="0.000000">Storage maintenance</tspan><tspan x="1423.500000" dy="18.500000">retention + native compaction</tspan></text></g><g class="ZmFub3V0LmFsZXJ0"><g class="shape" ><rect x="1438.000000" y="743.000000" width="241.000000" height="82.000000" stroke="#000536" fill="#BCDDFB" class=" stroke-B1 fill-B5" style="stroke-width:2;" /></g><text x="1558.500000" y="781.500000" fill="#0A0F25" class="text-bold fill-N1" style="text-anchor:middle;font-size:16px"><tspan x="1558.500000" dy="0.000000">Alert engine</tspan><tspan x="1558.500000" dy="18.500000">rule evaluation + webhooks</tspan></text></g><g class="c3RvcmUudGVsZW1ldHJ5"><g class="shape" ><path d="M 791 1273 C 791 1249 913 1249 926 1249 C 940 1249 1061 1249 1061 1273 V 1359 C 1061 1383 940 1383 926 1383 C 913 1383 791 1383 791 1359 V 1273 Z" stroke="#000536" fill="#DACEFB" class=" stroke-B1 fill-AA5" style="stroke-width:2;" /><path d="M 791 1273 C 791 1297 913 1297 926 1297 C 940 1297 1061 1297 1061 1273" stroke="#000536" fill="#DACEFB" class=" stroke-B1 fill-AA5" style="stroke-width:2;" /></g><text x="926.000000" y="1325.500000" fill="#0A0F25" class="text-bold fill-N1" style="text-anchor:middle;font-size:16px"><tspan x="926.000000" dy="0.000000">Parquet batches + trace indexes</tspan><tspan x="926.000000" dy="18.500000">FANOUT_DATA_DIR/telemetry</tspan></text></g><g class="c3RvcmUucXN0YXRl"><g class="shape" ><path d="M 1392 1273 C 1392 1249 1495 1249 1507 1249 C 1518 1249 1621 1249 1621 1273 V 1359 C 1621 1383 1518 1383 1507 1383 C 1495 1383 1392 1383 1392 1359 V 1273 Z" stroke="#000536" fill="#DACEFB" class=" stroke-B1 fill-AA5" style="stroke-width:2;" /><path d="M 1392 1273 C 1392 1297 1495 1297 1507 1297 C 1518 1297 1621 1297 1621 1273" stroke="#000536" fill="#DACEFB" class=" stroke-B1 fill-AA5" style="stroke-width:2;" /></g><text x="1506.500000" y="1325.500000" fill="#0A0F25" class="text-bold fill-N1" style="text-anchor:middle;font-size:16px"><tspan x="1506.500000" dy="0.000000">DuckDB query state</tspan><tspan x="1506.500000" dy="18.500000">FANOUT_DATA_DIR/query</tspan></text></g><g class="c3RvcmUuY29udHJvbA=="><g class="shape" ><path d="M 1748 1273 C 1748 1249 1856 1249 1868 1249 C 1880 1249 1988 1249 1988 1273 V 1359 C 1988 1383 1880 1383 1868 1383 C 1856 1383 1748 1383 1748 1359 V 1273 Z" stroke="#000536" fill="#DACEFB" class=" stroke-B1 fill-AA5" style="stroke-width:2;" /><path d="M 1748 1273 C 1748 1297 1856 1297 1868 1297 C 1880 1297 1988 1297 1988 1273" stroke="#000536" fill="#DACEFB" class=" stroke-B1 fill-AA5" style="stroke-width:2;" /></g><text x="1868.000000" y="1325.500000" fill="#0A0F25" class="text-bold fill-N1" style="text-anchor:middle;font-size:16px"><tspan x="1868.000000" dy="0.000000">Control SQLite</tspan><tspan x="1868.000000" dy="18.500000">FANOUT_DATA_DIR/control</tspan></text></g><g class="ZmFub3V0Lihpbmdlc3QgLSZndDsgY29tbWl0KVswXQ=="><marker id="mk-d2-37886755-3488378134" markerWidth="10.000000" markerHeight="12.000000" refX="7.000000" refY="6.000000" viewBox="0.000000 0.000000 10.000000 12.000000" orient="auto" markerUnits="userSpaceOnUse"> <polygon points="0.000000,0.000000 10.000000,6.000000 0.000000,12.000000" fill="#000536" class="connection fill-B1" stroke-width="2" /> </marker><path d="M 387.500000 826.500000 C 387.500000 873.299988 387.500000 897.700012 387.500000 942.500000" stroke="#000536" fill="none" class="connection stroke-B1" style="stroke-width:2;" marker-end="url(#mk-d2-37886755-3488378134)" mask="url(#d2-37886755)" /></g><g class="ZmFub3V0LihodHRwIC0mZ3Q7IHVpKVswXQ=="><path d="M 867.808675 406.471888 C 632.349976 464.798004 573.000000 493.299988 573.000000 544.500000" stroke="#000536" fill="none" class="connection stroke-B1" style="stroke-width:2;" marker-end="url(#mk-d2-37886755-3488378134)" mask="url(#d2-37886755)" /><text x="692.000000" y="455.000000" fill="#676C7E" class="text-italic fill-N2" style="text-anchor:middle;font-size:16px">serves embedded assets</text></g><g class="ZmFub3V0LihodHRwIC0mZ3Q7IGFnZW50KVswXQ=="><path d="M 891.684484 419.338988 C 787.900024 467.299988 761.500000 499.799988 761.500000 530.250000 C 761.500000 560.700012 766.700012 694.700012 785.931607 739.820307" stroke="#000536" fill="none" class="connection stroke-B1" style="stroke-width:2;" marker-end="url(#mk-d2-37886755-3488378134)" mask="url(#d2-37886755)" /><text x="762.000000" y="550.000000" fill="#676C7E" class="text-italic fill-N2" style="text-anchor:middle;font-size:16px">AG-UI stream</text></g><g class="ZmFub3V0LihodHRwIC0mZ3Q7IG1jcClbMF0="><path d="M 974.645069 420.468254 C 966.200012 467.299988 964.000000 491.700012 964.000000 536.500000" stroke="#000536" fill="none" class="connection stroke-B1" style="stroke-width:2;" marker-end="url(#mk-d2-37886755-3488378134)" mask="url(#d2-37886755)" /></g><g class="ZmFub3V0LihtY3AgLSZndDsgYWdlbnQpWzBd"><path d="M 940.026283 623.246962 C 913.799988 670.299988 895.000000 694.700012 849.804956 740.648295" stroke="#000536" fill="none" class="connection stroke-B1" style="stroke-width:2;" marker-end="url(#mk-d2-37886755-3488378134)" mask="url(#d2-37886755)" /><text x="900.500000" y="693.000000" fill="#676C7E" class="text-italic fill-N2" style="text-anchor:middle;font-size:16px">in-memory transport</text></g><g class="ZmFub3V0LihtY3AgLSZndDsgb2JzKVswXQ=="><path d="M 983.034197 623.339847 C 1003.049988 670.299988 1022.250000 696.299988 1075.401299 748.691994" stroke="#000536" fill="none" class="connection stroke-B1" style="stroke-width:2;" marker-end="url(#mk-d2-37886755-3488378134)" mask="url(#d2-37886755)" /></g><g class="ZmFub3V0LihodHRwIC0mZ3Q7IG9icylbMF0="><path d="M 1098.189095 406.989806 C 1327.449951 464.899994 1385.250000 499.799988 1385.250000 530.250000 C 1385.250000 560.700012 1348.650024 696.299988 1205.992789 750.088784" stroke="#000536" fill="none" class="connection stroke-B1" style="stroke-width:2;" marker-end="url(#mk-d2-37886755-3488378134)" mask="url(#d2-37886755)" /><text x="1385.000000" y="531.000000" fill="#676C7E" class="text-italic fill-N2" style="text-anchor:middle;font-size:16px">typed HTTP API</text></g><g class="ZmFub3V0LihvYnMgLSZndDsgcXVlcnkpWzBd"><path d="M 1113.000000 818.500000 C 1113.000000 871.700012 1117.599976 897.700012 1134.588782 942.757212" stroke="#000536" fill="none" class="connection stroke-B1" style="stroke-width:2;" marker-end="url(#mk-d2-37886755-3488378134)" mask="url(#d2-37886755)" /></g><g class="ZmFub3V0LihhbGVydCAtJmd0OyBxdWVyeSlbMF0="><path d="M 1453.893890 825.244886 C 1334.150024 873.299988 1285.750000 897.700012 1217.061124 944.255794" stroke="#000536" fill="none" class="connection stroke-B1" style="stroke-width:2;" marker-end="url(#mk-d2-37886755-3488378134)" mask="url(#d2-37886755)" /><text x="1329.500000" y="881.000000" fill="#676C7E" class="text-italic fill-N2" style="text-anchor:middle;font-size:16px">evaluates rollups</text></g><g class="KGNsaWVudHMuY29sbGVjdG9yIC0mZ3Q7IGZhbm91dC5pbmdlc3QpWzBd"><path d="M 387.500000 118.000000 C 387.500000 156.000000 387.500000 178.100006 387.500000 196.250000 C 387.500000 214.399994 387.500000 238.600006 387.500000 256.750000 C 387.500000 274.899994 387.500000 305.200012 387.500000 332.500000 C 387.500000 359.799988 387.500000 398.299988 387.500000 428.750000 C 387.500000 459.200012 387.500000 499.799988 387.500000 530.250000 C 387.500000 560.700012 387.500000 694.700012 387.500000 739.500000" stroke="#000536" fill="none" class="connection stroke-B1" style="stroke-width:2;" marker-end="url(#mk-d2-37886755-3488378134)" mask="url(#d2-37886755)" /><text x="387.500000" y="435.000000" fill="#676C7E" class="text-italic fill-N2" style="text-anchor:middle;font-size:16px">OTLP/gRPC or OTLP/HTTP</text></g><g class="KGNsaWVudHMuYnJvd3NlciAtJmd0OyBmYW5vdXQuaHR0cClbMF0="><path d="M 599.500000 118.000000 C 599.500000 156.000000 599.500000 178.100006 599.500000 196.250000 C 599.500000 214.399994 653.549988 299.833008 865.858203 350.243923" stroke="#000536" fill="none" class="connection stroke-B1" style="stroke-width:2;" marker-end="url(#mk-d2-37886755-3488378134)" mask="url(#d2-37886755)" /><text x="664.500000" y="308.000000" fill="#676C7E" class="text-italic fill-N2" style="text-anchor:middle;font-size:16px">HTTPS</text></g><g class="KGNsaWVudHMuZXh0IC0mZ3Q7IGZhbm91dC5odHRwKVswXQ=="><path d="M 1181.250000 118.000000 C 1181.250000 156.000000 1181.250000 178.100006 1181.250000 196.250000 C 1181.250000 214.399994 1159.449951 297.000000 1075.885732 335.332232" stroke="#000536" fill="none" class="connection stroke-B1" style="stroke-width:2;" marker-end="url(#mk-d2-37886755-3488378134)" mask="url(#d2-37886755)" /><text x="1170.500000" y="260.000000" fill="#676C7E" class="text-italic fill-N2" style="text-anchor:middle;font-size:16px">/mcp — OAuth</text></g><g class="KGZhbm91dC5jb21taXQgLSZndDsgc3RvcmUudGVsZW1ldHJ5KVswXQ=="><path d="M 387.500000 1030.000000 C 387.500000 1068.000000 387.500000 1090.099976 387.500000 1108.250000 C 387.500000 1126.400024 468.200012 1216.599976 787.091864 1286.147668" stroke="#000536" fill="none" class="connection stroke-B1" style="stroke-width:2;" marker-end="url(#mk-d2-37886755-3488378134)" mask="url(#d2-37886755)" /></g><g class="KGZhbm91dC5xdWVyeSAtJmd0OyBzdG9yZS50ZWxlbWV0cnkpWzBd"><path d="M 1066.809792 1008.124357 C 843.750000 1063.927002 787.500000 1090.099976 787.500000 1108.250000 C 787.500000 1126.400024 800.000000 1209.599976 846.949235 1249.412949" stroke="#000536" fill="none" class="connection stroke-B1" style="stroke-width:2;" marker-end="url(#mk-d2-37886755-3488378134)" mask="url(#d2-37886755)" /><text x="836.000000" y="1073.000000" fill="#676C7E" class="text-italic fill-N2" style="text-anchor:middle;font-size:16px">indexed traces + SQL scans</text></g><g class="KGZhbm91dC5xdWVyeSAtJmd0OyBzdG9yZS5xc3RhdGUpWzBd"><path d="M 1194.428147 1029.400142 C 1233.800049 1068.000000 1244.000000 1090.099976 1244.000000 1108.250000 C 1244.000000 1126.400024 1274.199951 1212.400024 1391.343755 1264.377694" stroke="#000536" fill="none" class="connection stroke-B1" style="stroke-width:2;" marker-end="url(#mk-d2-37886755-3488378134)" mask="url(#d2-37886755)" /></g><g class="KGZhbm91dC5tYWludCAtJmd0OyBzdG9yZS50ZWxlbWV0cnkpWzBd"><path d="M 1423.250000 1030.000000 C 1423.250000 1068.000000 1423.250000 1090.099976 1423.250000 1108.250000 C 1423.250000 1126.400024 1350.800049 1216.000000 1064.894232 1283.086240" stroke="#000536" fill="none" class="connection stroke-B1" style="stroke-width:2;" marker-end="url(#mk-d2-37886755-3488378134)" mask="url(#d2-37886755)" /><text x="1309.500000" y="1231.000000" fill="#676C7E" class="text-italic fill-N2" style="text-anchor:middle;font-size:16px">atomic replacement</text></g><g class="KGZhbm91dC5odHRwIC0mZ3Q7IHN0b3JlLmNvbnRyb2wpWzBd"><path d="M 1097.986840 390.729053 C 1713.599976 461.700012 1868.000000 499.799988 1868.000000 530.250000 C 1868.000000 560.700012 1868.000000 601.299988 1868.000000 631.750000 C 1868.000000 662.200012 1868.000000 702.799988 1868.000000 733.250000 C 1868.000000 763.700012 1868.000000 804.299988 1868.000000 834.750000 C 1868.000000 865.200012 1868.000000 905.799988 1868.000000 936.250000 C 1868.000000 966.700012 1868.000000 1005.200012 1868.000000 1032.500000 C 1868.000000 1059.800049 1868.000000 1090.099976 1868.000000 1108.250000 C 1868.000000 1126.400024 1868.000000 1209.000000 1868.000000 1245.000000" stroke="#000536" fill="none" class="connection stroke-B1" style="stroke-width:2;" marker-end="url(#mk-d2-37886755-3488378134)" mask="url(#d2-37886755)" /><text x="1853.000000" y="502.000000" fill="#676C7E" class="text-italic fill-N2" style="text-anchor:middle;font-size:16px">users, sessions, settings, dashboards, threads</text></g><g class="KGZhbm91dC5hbGVydCAtJmd0OyBzdG9yZS5jb250cm9sKVswXQ=="><path d="M 1601.164214 825.914213 C 1648.550049 873.299988 1660.750000 905.799988 1660.750000 936.250000 C 1660.750000 966.700012 1660.750000 1005.200012 1660.750000 1032.500000 C 1660.750000 1059.800049 1660.750000 1090.099976 1660.750000 1108.250000 C 1660.750000 1126.400024 1682.000000 1211.000000 1763.516986 1257.033121" stroke="#000536" fill="none" class="connection stroke-B1" style="stroke-width:2;" marker-end="url(#mk-d2-37886755-3488378134)" mask="url(#d2-37886755)" /><text x="1661.000000" y="1062.000000" fill="#676C7E" class="text-italic fill-N2" style="text-anchor:middle;font-size:16px">rules and fired alerts</text></g><g class="KGZhbm91dC5hZ2VudCAtJmd0OyBtb2RlbClbMF0="><path d="M 805.750000 826.500000 C 805.750000 873.299988 682.349976 903.099976 192.709926 972.935213" stroke="#000536" fill="none" class="connection stroke-B1" style="stroke-width:2;" marker-end="url(#mk-d2-37886755-3488378134)" mask="url(#d2-37886755)" /><text x="522.500000" y="931.000000" fill="#676C7E" class="text-italic fill-N2" style="text-anchor:middle;font-size:16px">HTTPS</text></g><mask id="d2-37886755" maskUnits="userSpaceOnUse" x="-101" y="-121" width="2220" height="1635">
+<rect x="-101" y="-121" width="2220" height="1635" fill="white"></rect>
 <rect x="610.000000" y="439.000000" width="164" height="21" fill="black"></rect>
 <rect x="717.000000" y="534.000000" width="90" height="21" fill="black"></rect>
 <rect x="830.000000" y="677.000000" width="141" height="21" fill="black"></rect>
@@ -113,9 +113,9 @@
 <rect x="300.000000" y="419.000000" width="175" height="21" fill="black"></rect>
 <rect x="640.000000" y="292.000000" width="49" height="21" fill="black"></rect>
 <rect x="1122.000000" y="244.000000" width="97" height="21" fill="black"></rect>
-<rect x="745.000000" y="1058.000000" width="180" height="21" fill="black"></rect>
-<rect x="1246.000000" y="1215.000000" width="137" height="21" fill="black"></rect>
+<rect x="746.000000" y="1057.000000" width="180" height="21" fill="black"></rect>
+<rect x="1241.000000" y="1215.000000" width="137" height="21" fill="black"></rect>
 <rect x="1702.000000" y="486.000000" width="302" height="21" fill="black"></rect>
-<rect x="1591.000000" y="1048.000000" width="140" height="21" fill="black"></rect>
+<rect x="1591.000000" y="1046.000000" width="140" height="21" fill="black"></rect>
 <rect x="498.000000" y="915.000000" width="49" height="21" fill="black"></rect>
 </mask></svg></svg>
diff --git a/site/public/diagrams/persistence.svg b/site/public/diagrams/persistence.svg
index 50c353fc..13d27eb5 100644
--- a/site/public/diagrams/persistence.svg
+++ b/site/public/diagrams/persistence.svg
@@ -1,27 +1,27 @@
-<?xml version="1.0" encoding="utf-8"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" data-d2-version="v0.7.1-HEAD" preserveAspectRatio="xMinYMin meet" viewBox="0 0 1274 2176"><svg class="d2-1108726992 d2-svg" width="1274" height="2176" viewBox="-89 -89 1274 2176"><rect x="-89.000000" y="-89.000000" width="1274.000000" height="2176.000000" rx="0.000000" fill="#FFFFFF" class=" fill-N7" stroke-width="0" /><style type="text/css"><![CDATA[
-.d2-1108726992 .text {
-	font-family: "d2-1108726992-font-regular";
+<?xml version="1.0" encoding="utf-8"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" data-d2-version="v0.7.1-HEAD" preserveAspectRatio="xMinYMin meet" viewBox="0 0 1274 2176"><svg class="d2-2701310579 d2-svg" width="1274" height="2176" viewBox="-89 -89 1274 2176"><rect x="-89.000000" y="-89.000000" width="1274.000000" height="2176.000000" rx="0.000000" fill="#FFFFFF" class=" fill-N7" stroke-width="0" /><style type="text/css"><![CDATA[
+.d2-2701310579 .text {
+	font-family: "d2-2701310579-font-regular";
 }
 @font-face {
-	font-family: d2-1108726992-font-regular;
-	src: url("data:application/font-woff;base64,d09GRgABAAAAABI8AAoAAAAAG1QAAguFAAAAAAAAAAAAAAAAAAAAAAAAAABPUy8yAAAA9AAAAGAAAABgXd/Vo2NtYXAAAAFUAAAAtwAAAPpHquUgZ2x5ZgAAAgwAAAs6AAAPXAGFQdRoZWFkAAANSAAAADYAAAA2G4Ue32hoZWEAAA2AAAAAJAAAACQKhAX3aG10eAAADaQAAAC9AAAA1GMGCvBsb2NhAAAOZAAAAGwAAABsbFhwPG1heHAAAA7QAAAAIAAAACAATQD2bmFtZQAADvAAAAMrAAAIFAbDVU1wb3N0AAASHAAAACAAAAAg/9EAMgADAgkBkAAFAAACigJYAAAASwKKAlgAAAFeADIBIwAAAgsFAwMEAwICBGAAAvcAAAADAAAAAAAAAABBREJPAEAAIP//Au7/BgAAA9gBESAAAZ8AAAAAAeYClAAAACAAA3icfM07LgQBHIDx35i1Xmut93vNetu3uYFEIxGdeqIUJ3ANJ3ACeqJwAjeQuIBaI38xB9h85a/4kEglqKn4RlNDqi7T0dM3kDt34dK1wq371kMEMm3d0ofOSr9SuHH37/GlSvwSP/Eeb/EaL/ERz/H0+VjeRpUYOtXV0zFw7ETbmFTFuKoJk6ZMm1Ezq25OX8O8BYuWLFuxas26DZu2bGvakWnZtWffgUNHcv4AAAD//wMAJfUl2AB4nGxXa3Ab13n97gWIJQmA4AqPBUCAAHZJLB7Eg1gsliRAgCTAh/gCCZAUHyIlSpRIPStRjTSyFKmJHEnjqi6auBOPKzvKRDONOlXTTGboePTPqlW6iePJTCePJvV48oPR1G5ds3QfY3HR2QVIgZr8WswC995zzne+811AFcwAYB6/BgqoAR3sAyMAR7rIZhfLMoTACQJDKQQWkcQM+q1YQGh/VBmLKVt7Pum5fP06mr6GX9s+3fHy8vJ7C5cuiX+28VSMoJ89BQwKAGzHBagBEkBPcKzbzTIqlULP6RmWIX7ieM+xz1mv1Dn/5aOFj2aSn6XQHy0tCWfa28+Is7iwfW59HQBAAbMAuAkXgAQrMBI2LmIyGQ0qwig/VIyCi8T4qJthyJ0Ps4/Tx9pbQ/Gh1LnBa4sTgyMjx1YnF+anVnHB2dfRmtUp1aOZrikfutwRaQ9vb6V6OtsBAEG0uIUb8F2wA1TRbjcfjcW4iIki3G6GVqmMBpOJi8QESqVCudzXhoZfzicO2gLWHl9ynovMJUODjiB7RDP++qmTr+danTEb3X0xl7vc46GjgQgAYJlLFBegWtJEZmI0qBh2F/f919968y8nhy5cuHBhCBce3H3z7zJ/evXqN2RsswDwEBckXTmSI2fzuLB9rvQe/RQXoKr03mWczSMHLmy/3Q8763AAF0Avf6+nOLebJzmSUbCMyWQkZ6f+vV+pILJT/9GvVBK4IC7djpyKovz2OfTmrdaVqPgAsKzLMXwXdC8oIxeAjcRk+LQsEBrOXe/vv57LXxsYuJaPHwifnJ4+GZ7WTLxx4sS3x8e/feLEGxP705dzL7366ku5y2nY1UWNC6AGQ0WFGYZ8XtJHg2eTN0+fPjKVPzC1gAtNkwPLS+IzNNDd1y/Ie0SLc/gCvgta8AE078FURbvZIK7ETDyv5PAuRqSYe8nefzpRQt+x0kdN8iZaW6+LtKevTEiAJ66kP5pJ105/83CJy0JhRuNvqVJ2qWp2eThxAeqAquBB6BlFJZUP0ivxscxfL7x16exILjdyFheY8czwPCn+DhnFT9BMqqs7KumCwFfcQp/huxCQVWcFGTUfdbvZ53zK7pS0p6hGLLFD9b0X/RHmENc9YG91LDg6vfxCPL7EBBr3B4W0K2Kdd3c2xZY0fEtHcyAepj22Oq/W1xOOZAOBppjdFW1xeK1qT32guzU6GQEENgD0DBeAkFgxvMvIkL97gj5+ggf7+rbXSlgPFLdwEBek/JAdQnJkqV9ikt0kVOn0qWTe2+tv6fOOJU9qYldPoK+JX83Oud1zWXRDvH7iakyu4xb6IdoEKzQBULTUhEJUpkiwcgGNJCMFCRuJCbzclO92jv/5X5F+j2/Q7qSPdsyMZQgFPW5ikszlxYhmf/fYJOloY5yGdpP3zJz4iw6br4d23NIlQt5mwJArbqEv8TrowSkjZxmCITkjUTqr5G+pbrScOMhL73cqiJ4cdmU9h47ED/UlsvFeRxfjTGlc9ghef3fazt48n7+Y7F2eHTtKO4s2qqRPsLiFfoA2wbangyqyZceQ+7pWEt2nkuFei88Ysrf0svk03WFqco1pEqtjudUETcX05tBkW37ZbhDsLsl3oeIW+vUOh5JmEnqK5bkdsQR+96D/nTsbXxR8SacynyEUtmFLV8LR3sim3H2ab1zOXkg2WvOPttvabd7etGijQvm2A0cBy/j/CW2CGRx7GEgGd+22k8IlS4Wo7pPJ1JIwfwxh8cdVB/qYeIPdkf0JUqbauXFN52p2bDV5dUVrqRk5aCRjhkbkHhzJyjo1AqAU/mfJR5LXBD5a1omhjUbOyJCHe3p691O++n0NtszyMvpesmpk8EANkdIsjKTFeXlmBIpO9CnahFbohJFdF/Huioe8KWdkykOEZmVpuHLNFTs1NxpM+nLf0u7Sb/575pzbtc9C681sZKLV0KR9sERS4bEIS2v3NbcuTE4mzg77OhN+f6Iz1jfBhSbqXPVW89DHmZSj3aRUe2yOoFZpyPj5UR9RlarnHdFhL6luMFCNQmdgOIR+mOL5RILnU+LtTjdtVSr1PiMblLXJAaBf4vVySu54lGRIWXSCzOUUzEhkpD/XEm6ON+P1d5dcocV58afIm0m6m8V7UCxCLwD8CK9hN3AAoILoVdjdewOvg0bem+T0HKFnWMKYG1d8OPe9d2ZfncPrYiOCx+K//tvJPymvKW7Br/A66EoaS32+Y4QHQW+urkZJEOpqk6adx8e3X9OTCCWVyhIP/DnaBJd8FsXJPKg9bIjdZy5DKJzD/raUzj3aMrQ/1xKMZXItoVgGbfQxodYWb3SH4pB4r/zY0QptgqHyjEqtMoSCGd0VS95sj1Zlz/8n2gQdNPzBubfrEaSLL6dSy/HE8VTqeCI1MpJKjo6W+zWxmhtbTWSW8xMrKxP5Zalfc0UOfYk2y/36HJ3sRDdLGcueK2WOJIAr6184Ej/URqdpfEmOnFSTK/kB/lGbzXPrfO5istE6eR+p9mSOlAsc+vXOOVW8IG+/a36BIxWVuYBuKu1DvlI4dLlwdc+Hu8HwwcNpm0cOB7s9uD2CVM+TYcc7C2izfKspsSknW0loy4DXTtVrDDpH2oI2poOx2gGlMpIU5TseAltxC91Am9LkpvbOOXnMvTDlSkPu59EFxuvM+MNhF9dA9/hmsoFRm8cScwb9jeEGJhPwZjWsTbC4Ag4LTdVqXbw3nnVSUb3ZZ6PsRrXWJQTZHo98vrm4hXrxWaDKPmZ4QeDksNn18yejnQPDtb03brh82kZNvSGkmR1A2mTV7dtpcTPQWqNMEmp5r6HiFvoZ2gDDCz1BlqP445GBvD/sjtOSLvSwZnEeRcVfZpKsH82I1mFPGJDUg+gf0QZoATgFpzeZJEkFPad49IPJg2pKrVRTtQfH/xZtiJ82DTDMQBMyiFaJBwBeQxvgemFdxQ6MonQPJxTfuTUxUF1HKKvra4bGhmvIamW1jugf/fpSX42uRlldX5tBG+Lv6TRNp2lkqfhkRVVMprm5lxGfAYI6APT3aAMsAJzAclT5KIEjKKZ85yeIuu98a6ZbbdYq1SZ1fOpbb830a611Sq1Z0yM+PaX3GQw+/anPvzhvajEa/dR5WUdNMSRr0FDpCUHYI0cdnq23a+qrDTXemE79ePKo2qJWqg21B8beJkO9P1cpu3FVPNCEfi/+l2OAdg04kXZ7MzwckHqwpbiF3sOvgHqn6tFyC1b29f8dPnPm8KEzZw61ZTJtbb29mof3vvv973/33sOe63fuXLly5851GWsWAL2Nr0l146SRy8dighTQ2W/+cUu3NfVyBv2Cr6bqt59kSn5vAkD/gF+RUoXjk5iPVl5vDCqVFOyc0XP4Zl+i05OxhTxzyZnj6a8MW9ss77Qe/ouvcEJfwBlq4ZcnE1duZbGyHxB0F7fgx7AK6r1svmphGIuZYTRMg51h7A2MdH6oOAVPYBX2AVBsLMaqaKZiSdrgDyOswmamyeJs7vubsD7lQXZbgyMa6FqU8XvhN0iHrNJ/EYHnjN6N36RS0ntN8evoafEd6T3Fu4wa9NtrggAIaouH0Th+Ir9HHKpF6oT4xT3F8WdvlPToQPfRCl6XvKRnBVagBI4SKIIi2Fc87Yu64zWtNcu6xTa2H923L3iCltOnzEHPgn1KWkvDCvoQt0i8BZ7hOV5uXOOv1ta619ZWHicfP04+ln7HFj/HWUxADUAVK7h4FysgI0r53xcH0dr7flSvCz7KPAqK/6PcnYdwH23s/N/K5dCG1GPF9/EgCHhNOo+sEM3scJjNDgcetFvMjY1mix3+HwAA//8DAIXxQU4AAAABAAAAAguFXuYgA18PPPUAAwPoAAAAANhdoKEAAAAA3WYvNv46/tsIbwPIAAAAAwACAAAAAAAAAAEAAAPY/u8AAAiY/jr+OghvAAEAAAAAAAAAAAAAAAAAAAA1eJwsyq1KBGEcRvHzPBsEWYwyYVkGXZD1Y7cMiorBYFIQ/kV8BavB6xCT3az3YV6LxXuw6gsyzKQRh03nhJ+fuGYBLhn4guRjKt+RtELSF8mPJD9TeX/ZQ5LX2XbByA9cqaHylNCCmXeY64eZJozVsOeSoOZM3wQdMTghvEl43Nvo/Q2hV0YKCpec65OhPyj0xtr/K7OrzKUyE1pOaZnrgKl+GeqWVb1wpMyG79miJqB7/wMAAP//AwC6/ik8AAAAAAAALAAsAFAAhgC2ANQA4ADwARIBQgFkAaYBzgISAiQCSAKAArQC4gMUA0gDagPWA/gEBAQeBDoEbASOBLoE7gUiBUIFggWoBcoF5gYgBkwGfAaiBroG5Ab6BxoHJgcyB0IHYAd0B4wHmAeuAAEAAAA1AIwADABmAAcAAQAAAAAAAAAAAAAAAAAEAAN4nJyU32obVxDGf4oltaE0F8UE58acy7Y4KzXYIbGv1nVMlhor1Sr9A6WwltaSkLS77K7kuPQBet236Fvkqs/Rhyi9LjMaKdq0ECxCzLc6M998Z+abA+zyDzvU6veBP5s/GK6x3zw2fI8HzQPDO1w0/jJc34hpMGj8arjJl42u4Y94W//d8Mcc1n82fJ+9+rnhT3hS3zX86Y7jb8MPOOTtEtfgGb8ZrrFHZvgeu/xkeIeHGGetzkPahht8xr7hJvtAjzElU8YkDHFcM2bInJyYgpCYnDHXxAxwBPhMKfXXhEiRY/i/v0aElOREyjiixDElZEpEwcgYf9GslFdaUerkiqSaT8mIiCvNmBCR4EgZkpIQM1GekpKMY1q0KOir3oySAo+CMVM8UnKGtOhwzgU9RowpcJwrkygLSbmm5IZI6zuLkM70iUkoTNWchIHqdKov1uyACxwdMo3dZL6oMBzg+E6zRZvEOL7C0/9uQ1m17kpNxEL7KT28Yqo6b3SCI+241PX5VnHJMW6r/lSVfLhHA1Unsx5zxVznL/OTPFGS4NwePqE6KHSPcJzqd0CoHfmegB4v6fCann77dOnic0mPgBea26GL42s6XHKmGYHi5dm5OuaSH3F8Q6Axwh1bf6Tn8vWGzNwt2sUZco8ZmW6BzFjuL86Pt5qw7FBacUehrujrHkmk7IF0RfYsYmiuyNQVM+3lyhuF9W9gjpDTUmf77ly2YWG7t9riW1LdYcfcNMnkloo+NFXvPc/c6D+PiAEpVxrRJ2VGi5JbvdsrIuZMcZypj1/qlpT46xypc6suiZmpgoBEeXIy/RuZb0LT3q/43tlbIps30x2drG+1TRVhTjZm9Fq7tzoLrcvxxgRaNtXUcmTCwry8qXhfor2K/lDdX+jrlvKYLrG+rjL//D/vwBM82hxyxAkjrSP8CQt7I9r6TrR5zon2YEKsUfJqvtFuCcMRHk854ojnPK1w+pxxSoeTO2hcZnU45cV7J5scbs3ijOcPVdNWvY7H669nW8/r8zv48gsOKi+jKJc9yFkY2zv/XxIxEy1ub7Mv7hHevwAAAP//AwAHW0wwAAADAAAAAAAA/84AMgAAAAAAAAAAAAAAAAAAAAAAAAAA");
+	font-family: d2-2701310579-font-regular;
+	src: url("data:application/font-woff;base64,d09GRgABAAAAABJkAAoAAAAAG4wAAguFAAAAAAAAAAAAAAAAAAAAAAAAAABPUy8yAAAA9AAAAGAAAABgXd/Vo2NtYXAAAAFUAAAAvQAAAQQFXCgIZ2x5ZgAAAhQAAAtVAAAPhBtfDoloZWFkAAANbAAAADYAAAA2G4Ue32hoZWEAAA2kAAAAJAAAACQKhAX4aG10eAAADcgAAADAAAAA2GT0C0psb2NhAAAOiAAAAG4AAABucnBuuG1heHAAAA74AAAAIAAAACAATgD2bmFtZQAADxgAAAMrAAAIFAbDVU1wb3N0AAASRAAAACAAAAAg/9EAMgADAgkBkAAFAAACigJYAAAASwKKAlgAAAFeADIBIwAAAgsFAwMEAwICBGAAAvcAAAADAAAAAAAAAABBREJPAEAAIP//Au7/BgAAA9gBESAAAZ8AAAAAAeYClAAAACAAA3icfM5LLsNRHAXg72qpR73f73+9taVVK5CIRCJmxo2hWIFt2IEVMCfCDqxAYhdM/MSNsZzBmXzJOUhKEqrKPlEolHM37NnX0nHsxKkzF7qu3NRuI7Koa2bRdvQnznVduv4V8aEixbcUX/EaL/EcT/EYb/EQ9+93efP/JAc6+UNT2666hh4lZb36VPQbMGhI1bARo8a0jJswacq0GbPmzFuwaMmyFasKNWvWbdi0ZduOQ34AAAD//wMAh9cocQAAAHicbFdrcBvXef3uBYglCYDgCo8FQIAAdkksHsSDWCyWJECAJECQ4gskQFJ8mJRo0yL1rEw11ugRqYkcSeOqLpq4E48rO8pEM406VdNMZuh49M+qVbqJ48lMJomTVOPJD0ZTp03NMn3E4qKzC5ACNfm1mMXee79zvnPOtws1MAuAefw6KKAOdHAAjAAc6SJbXSzLEAInCAylEFhEErPoV2IRoYNRZSymbO/7tO/8lSto5jJ+fedk1ysrK+8vnjsn/sXmYzGCfvQYMCgAsB0XoQ5IAD3BsW43y6hUCj2nZ1iG+IHjfccBZ6NS5/zFo8VHs8nfpdCfLC8Lpzo7T4lzuLhzZmMDAEABcwC4BReBBCswUm1cxGQyGlSEUb6oGAUXifFRN8OQuz/mHqRf7GwPxYdTZ4YuL00OjY6+uDa1uDC9hovObFd7TqdUj2V6pn3ofFekM7yznerr7gQABNHSNm7Ct8AOUEO73Xw0FuMiJopwuxlapTIaTCYuEhMolQrl818aHnmlkHjOFrD2+ZILXGQ+GRpyBNnnNRNvnDj+Rr7dGbPRvS/n8+f7PHQ0EAEALGOJ4iLUSpzISIwGFcPu1X3njbff+uup4bNnz54dxsW7t976h8yfX7r0Fbm2OQD0E5lPqT9Gl5EzMuQcuiB+/Ic/4GL2UVb8xe5zcA8XJf45kiPnCri4c6ay/oe4CDXl+y7jXAE5cHHnnQHYXYcDuAh6+X89xbndPMmRjIJlTCYjOTf97wNKBZGb/o8BpZLARXH5RuREFBV2zqC3rrevRsW7gGX+XsS3QPcMg3Kj2EhMhknLRKKR/JWBgSv5wuXBwcuF+KHw8ZmZ4+EZzeSbx459fWLi68eOvTl5MH0+f+G11y7kz6dhjz81LoIaDFVKYBjyaevvD51OXjt58vnpwqHpRVxsmRpcWRafoMHe7IAg7xEtzeOz+BZowQfQuq+mGtrNBnF1zcTTjo/s1YgU8xfsAycT5eq7VrPUFG+itY26SGf64qRU8OTF9KPZdP3MV4+UsSwWZzX+thplj6puD4cTF6EBqCochJ5RVEP5ML0aH8/87eLb506P5vOjp3GRmciMLJDir5FR/BTNpnp6oxIvCHylbfQ7fAsCMuusIFfNR91u9imeiool7imqGUvoUGP/y/4Ic5jrHbS3OxYd3V5+MR5fZgLNB4NC2hWxLri7W2LLGr6tqzUQD9MeW4NX6+sLR3KBQEvM7oq2ObxWtacx0NsenYoAAhsAeoKLQEioGN5lZMhfP0SfPMRD2ezOernWQ6VtHMRFKWdkhZAcWfZVTJKbVFU6fSJZ8Pb727Le8eRxTezSMfQl8Yu5ebd7PoeuileOXYrJfdxG30VbYIUWAIqWzCpEZYgEKzfQSDJS4LCRmMDL5n2ve+Iv/4b0e3xDdif9QtfseIZQ0BMmJsmcX4poDvaOT5GODsZp6DR5T82LP+2y+fpox3VdIuRtBQz50jb6HG+AHpxy5SxDMCRnJMpnlfUt9Y2Wkwl56YNOBdGXx66c5/Dz8cPZRC7e7+hhnCmNyx7BG+/N2NlrLxVeTvavzI2/QDtLNqrMT7C0jb6DtsC2z0FVGbQryAM9q4neE8lwv8VnDNnb+tlCmu4ytbjGNYm18fxagqZienNoqqOwYjcIdpeku1BpG328i6HMmVQ9xfLcLlkCv3fQ/86fji8JvqRTWcgQCtuIpSfh6GxmU+6s5ivnc2eTzdbC/Z2OTpu3Py3aqFCh49ALgOX6/wVtgRkc+xBIAnft2UnhkqlCVO/xZGpZWHgRYfH7NYeyTLzJ7sj9AClTndyEpnstN76WvLSqtdSNPmckY4Zm5B4azck8NQOgFP6JpCNJawIfrfDE0EY5G4/09fUfpHyNB5psmZUV9K1kzejQoToipVkcTYsL8mwJlJzot2gL2qEbRvdUxLurLvKmnJGpDBualanhKj1X7PbcaDDpK76l3eVn/nv2jNt1wELrzWxkst3Qor27TFLh8QhLaw+0ti9OTSVOj/i6E35/ojuWneRCkw2uRqt5+JNMytFpUqo9NkdQqzRk/PyYj6hJNfKO6IiXVDcZqGahOzASQt9N8XwiwfMp8Ua3m7YqlXqfkQ3K3OQB0M/wRiUldzVKMqRMOkHm8wpmNDI6kG8Lt8Zb8cZ7y67Q0oL4Q+TNJN2t4m0olaAfAL6H17EbpJBRAX8J9vbexBugkfcmOT1H6BmWMOYnFB/Nf+vdudfm8YbYjOCB+K//dvzPKmtK2/BzvAG6MseSz3eFcDfozTfUKQlCXWvSdPL46M7rehKhpFJZxoE/Q1vgks+iOBkHtQ8NsXfNZwiFc8TfkdK5x9qGD+bbgrFMvi0Uy6DNLBNqb/NGdyEOi7crl12u0BYYqs+o5ipDKJixPbLkzfZxVdH8f6It0EHTH517expBuvhKKrUSTxxNpY4mUqOjqeTYWMWvibX8+Fois1KYXF2dLKxIfs2XOPQ52qr49Wl1shLdLGWsaK6cORIBrpx/8fn44Q46TeNzcuSkWlzJD/H3Omye6y/lX042W6fuINW+zJFygUMf755Twwvy9nviFzhSUZ0L6JrSPuwrh0OPC9f2fbQXDB/em7F55HCw24M7o0j1NBl2tbOItipvP2U0lWQrE20Z9NqpRo1B50hb0OZMMFY/qFRGkqL8LojAVtpGV9GWNLmp/XNOHnPPTLnykPtxdJHxOjP+cNjFNdF9vtlcYMzmscScQX9zuInJBLw5DWsTLK6Aw0JT9VoX743nnFRUb/bZKLtRrXUJQbbPI59vLm2jfnwaqIqOGV4QODls9vT86Vj34Eh9/9WrLp+2WdNoCGnmBpE2WXPjRlrcCrTXKZOEWt5ruLSNfoQ2wfCMJ8hKFH8yOljwh91xWuKFHtEsLaCo+LNMkvWjWdE64gkDkjyI/hltghaAU3B6k0miVNBzivvfmXpOTamVaqr+uYm/R5vib1sGGWawBRlEq4QDAK+jTXA9s65qB0ZRfl8nFN+4PjlY20AoaxvrhsdH6shaZa2OGBj78nK2TlenrG2sz6BN8Td0mqbTNLJU/bKiGibT2trPiE8AQQMA+ke0CRYATmA5qnKUwBEUU/k2IIiGb3xttldt1irVJnV8+mtvzw5orQ1KrVnTJz4+ofcZDD79ic9+/5KpzWj0Uy/JPGpKIZmDpmpNCMI+OhrwXKNd01hrqPPGdOoHUy+oLWql2lB/aPwdMtT/Y5WyF9fEAy3oN+J/OQZp16ATaXe2wiMByYNtpW30Pn4V1Ltdj1YsWO3r/zty6tSRw6dOHe7IZDo6+vs1925/89vf/ubte31Xbt68ePHmzStyrTkA9A6+LPWNk0YuH4sJUkDnvvqnbb3W1CsZ9FO+lmrceZgp670FAP0TflVKFY5PYj5a/XpjUKmkYOeMniPXsoluT8YW8swnZ4+mvzBi7bC8237kr77ACdmAM9TGr0wlLl7PYeUAIOgtbcP3YQ3U+9F80cIwFjPDaJgmO8PYmxjp/FBpGh7CGhwAoNhYjFXRTNWStMEfRliFzUyLxdma/buwPuVBdluTIxroWZLr98IvkQ5ZpW8RgeeM3s1fplLSfU3py+hx6V3pPsW7jBr0q8uCAAjqS0fQBH4o30ccqkfqhPj724qjT94s89GF7qBVvCFpSc8KrEAJHCVQBEWwr3o6l3RH69rrVnRLHewAumNf9AQtJ0+Yg55F+7S0loZV9BFuk3ALPMNzvGxc48/X13vX11cfJB88SD6QnmNLn+EcJqTvrBpWcPEuVkBGlPJ/IA6h9Q/8qFEXvJ+5HxT/R7k3D+EO2tz93srn0abksdIHeAgEvC6dR1aRZnY4zGaHAw/ZLebmZrPFDv8PAAD//wMAGYpMuwAAAAABAAAAAguFn8IBb18PPPUAAwPoAAAAANhdoKEAAAAA3WYvNv46/tsIbwPIAAAAAwACAAAAAAAAAAEAAAPY/u8AAAiY/jr+OghvAAEAAAAAAAAAAAAAAAAAAAA2eJwsyq1KBGEcRvHzPBsEWYwyYVkGXZD1Y7cMiorBYFIQ/kV8BavB6xCT3az3YV6LxXswqi/IMJNGHEznhJ8fuGQBLhn4jORDKt+Q9EnSEkkfJN+T/Ejl3f/uk7zKpgtGvuNCDZWnhBbMvMVc38w0YayGHZcENSf6IuiIwRHhdcLj3kbvrwg9M1JQuORU7wz9RqEXVv5emW1lzpWZ0HJMy1x7TPXDUNcs64kDZdZ8ywY1Ad3rLwAAAP//AwC+mSqFAAAALAAsAFAAhgC2ANQA6AD0AQQBJgFWAXgBugHiAiYCOAJcApQCyAL2AygDXAN+A+oEDAQYBDIETgSABKIEzgUCBTYFVgWWBbwF3gX6BjQGYAaQBrYGzgb4Bw4HLgc6B0YHVgd0B4gHoAesB8IAAAABAAAANgCMAAwAZgAHAAEAAAAAAAAAAAAAAAAABAADeJyclN9qG1cQxn+KJbWhNBfFBOfGnMu2OCs12CGxr9Z1TJYaK9Uq/QOlsJbWkpC0u+yu5Lj0AXrdt+hb5KrP0YcovS4zGinatBAsQsy3OjPffGfmmwPs8g871Or3gT+bPxiusd88NnyPB80DwztcNP4yXN+IaTBo/Gq4yZeNruGPeFv/3fDHHNZ/Nnyfvfq54U94Ut81/OmO42/DDzjk7RLX4Bm/Ga6xR2b4Hrv8ZHiHhxhnrc5D2oYbfMa+4Sb7QI8xJVPGJAxxXDNmyJycmIKQmJwx18QMcAT4TCn114RIkWP4v79GhJTkRMo4osQxJWRKRMHIGH/RrJRXWlHq5Iqkmk/JiIgrzZgQkeBIGZKSEDNRnpKSjGNatCjoq96MkgKPgjFTPFJyhrTocM4FPUaMKXCcK5MoC0m5puSGSOs7i5DO9IlJKEzVnISB6nSqL9bsgAscHTKN3WS+qDAc4PhOs0WbxDi+wtP/bkNZte5KTcRC+yk9vGKqOm90giPtuNT1+VZxyTFuq/5UlXy4RwNVJ7Mec8Vc5y/zkzxRkuDcHj6hOih0j3Cc6ndAqB35noAeL+nwmp5++3Tp4nNJj4AXmtuhi+NrOlxyphmB4uXZuTrmkh9xfEOgMcIdW3+k5/L1hszcLdrFGXKPGZlugcxY7i/Oj7easOxQWnFHoa7o6x5JpOyBdEX2LGJorsjUFTPt5cobhfVvYI6Q01Jn++5ctmFhu7fa4ltS3WHH3DTJ5JaKPjRV7z3P3Og/j4gBKVca0SdlRouSW73bKyLmTHGcqY9f6paU+OscqXOrLomZqYKARHlyMv0bmW9C096v+N7ZWyKbN9MdnaxvtU0VYU42ZvRau7c6C63L8cYEWjbV1HJkwsK8vKl4X6K9iv5Q3V/o65bymC6xvq4y//w/78ATPNoccsQJI60j/AkLeyPa+k60ec6J9mBCrFHyar7RbgnDER5POeKI5zytcPqccUqHkztoXGZ1OOXFeyebHG7N4oznD1XTVr2Ox+uvZ1vP6/M7+PILDiovoyiXPchZGNs7/18SMRMtbm+zL+4R3r8AAAD//wMAB1tMMAAAAwAAAAAAAP/OADIAAAAAAAAAAAAAAAAAAAAAAAAAAA==");
 }
 .appendix-icon {
 	filter: drop-shadow(0px 0px 32px rgba(31, 36, 58, 0.1));
 }
-.d2-1108726992 .text-bold {
-	font-family: "d2-1108726992-font-bold";
+.d2-2701310579 .text-bold {
+	font-family: "d2-2701310579-font-bold";
 }
 @font-face {
-	font-family: d2-1108726992-font-bold;
-	src: url("data:application/font-woff;base64,d09GRgABAAAAABIYAAoAAAAAGywAAguFAAAAAAAAAAAAAAAAAAAAAAAAAABPUy8yAAAA9AAAAGAAAABgXxHXrmNtYXAAAAFUAAAAtwAAAPpHquUgZ2x5ZgAAAgwAAAsUAAAPHJcQngloZWFkAAANIAAAADYAAAA2G38e1GhoZWEAAA1YAAAAJAAAACQKfwX0aG10eAAADXwAAAC9AAAA1GjMCQdsb2NhAAAOPAAAAGwAAABsafxt2G1heHAAAA6oAAAAIAAAACAATQD3bmFtZQAADsgAAAMvAAAIKgjwVkFwb3N0AAAR+AAAACAAAAAg/9EAMgADAioCvAAFAAACigJYAAAASwKKAlgAAAFeADIBKQAAAgsHAwMEAwICBGAAAvcAAAADAAAAAAAAAABBREJPACAAIP//Au7/BgAAA9gBESAAAZ8AAAAAAfAClAAAACAAA3icfM07LgQBHIDx35i1Xmut93vNetu3uYFEIxGdeqIUJ3ANJ3ACeqJwAjeQuIBaI38xB9h85a/4kEglqKn4RlNDqi7T0dM3kDt34dK1wq371kMEMm3d0ofOSr9SuHH37/GlSvwSP/Eeb/EaL/ERz/H0+VjeRpUYOtXV0zFw7ETbmFTFuKoJk6ZMm1Ezq25OX8O8BYuWLFuxas26DZu2bGvakWnZtWffgUNHcv4AAAD//wMAJfUl2AB4nIRXaWwb13Y+93IZixotXIZDUuI64gwXiRI5HI4WSpQsipJlUqstyc/anpD4yZYsu7b8pKR2/YA4L60f/ZxGimMnbRK4MdqmTuDAKOCmVYsGaBIj/lUnDVAkTdoGbhEDiRqoQZFKZHGHkkz7T3+IV7i8y3e+853vXIIGBgDwDF4FFZRABRiAARD1br1XFASOkkVZ5liVLCA9NYANuRtvCX61368OuK46n52aQplJvLo1fzgzM/PjVEtL7vW/ej93CZ1+HwDnfwLAnTgLJaAHMFKiwPMCp9WqjKKREzjqQeVvKsqqytS09ad77937I99HPtQbj4cXxOjx3PM4u7X42msAACrIAOA4zoIebOAh2MSI2cyYtBSjDFpOJUZiUpTnOL0YUcbMV8n59jpfpDN5qnuqKxaORFPDz8Rbh3HWnkoEhyvUZfs7Og/40QsBjnflxsaCXgAEofwGbsBXoQpA4+F5KRqLiREzS/E859FqGZNZjMRkVosmhi4OH7w0lHjK3WeVudp9wZEeX8LSN0SnXz4+f21Q9Eyy9sjk3qdO1ljHpwFDBgCncRZ0wBSh13KCGIkR3ATwnadeGhy4PF1X3TgcCg03VuNs8vLJky91L/nG+/oOeYHgywDA1zgLKoUDfWYFZ7cWC/Po33AWNIV5N5NZQRhnt9bPws4+5X6j8r2RFXlekkQ9pxI4s5lhMq+83a5Wl2fJoCnD2dzfvBj9VfODrUXU9dvY2eb/AACscPN7+CpUPMGOkgChQL+HcIRGxp7fv//5scJnZ19fZ2dfHz107djcy/39V44duzZ0fnFmZmFhZmaRnEu4acBZoMFUlFktxzG7ufy650wqtdg12LPcHk/irDDen56p/xINzYoB2MbWi9/EV6EUeABvMRYPLzyGlDJv51CLRrahIdsvXuRmzxUQn5xi+/2Mt9xmaJk/M0tQzp7J/cvTafO7Fwvwn/uLKo+DUs+VlG1jH8ZZKAe2WJVE3AS9goPLPOw6lUxIqzfODaabW1ub0zjrHevrmWBz//vwIZoONzTwJEdcfgPr8FUIKOwKsgJUivKCEMKPC5ExmVlWuUmLTO3nIwe4EV+oTgwedMf5lqPJxpOB/a52ga9rChxoSTUv0A2hpx28x+60G2rK61P1sbFobWDCWuWsdjj0HsuBrth4IyCwAmAjzgJFIuEkN8Pp791GP93GlWfPbq0TnhHsy2/gfqUOCUZJL+qVklD+0aK+879ebZbl+G+fo6+8hSZzK9Pp9DQ6nrv+1hXAEMhvoE/RJliBA2A9JCmyUleUoATH6DniDXIkJktKrf1tcuDCCub8zvYaqX6ueerIsk7t7N5j9Rr74k56NNE3VuEWLMzP7TULp3LfiNXcKdY4qgvaLayiiY78BjbjNTCBs8AoR3F6kaGeEC3nISaCutyddjV9ekVtT3riY/XxqTE+NlLrN/lot0vCazfTNnvb76QPPpNYTqV/XfeJoVzhoya/gdbQJtie9AvO88gttMjadaKj55fJUHd1F+eSEokGS8jY7B2hW88MDS+2Otgpe7qjPcNUTLuqCM8YhPwG2sRrYATXDlcENStIYhFLO2L4YfxEy1TU32jVrizr1LYUtggGY9DExerp3zwzeKat2pL+863OsI1bNlk/MZR3du/rAqxg/1e0CRZwPoae6IpyE/UR7CoxSm5Bzu5TezvnW7on6tU497kuFZZiYX7y1dtCrSdGty0ODS4mEnNJo7ckJroP2Ryo2S/Vk1gQWADQIr5LRqIr+QktMyLD6X+2d2/NQKczWllVZqOrHIcOoXPHNVXSSJTWzms0bt5xOvccgAo8+TpMoU2ohxboVZjhpagsKdi3h5gYYUWG2zYRj0AIEom8TFqtqsgZjNvV6eGVJT80TzZ2G6tcFpu/eVKqdf9lP1USHZPtToPHPzD+8+TZXrsg2O2C4I+0C17R6qarWu/bGmvjPnWZz1kVqVQbksF4v4+eK/WYmnprdBVmo6GlUxwMobsBv+D3+fyB3EqNla1UqSzWanuBmw6SbEWjIO5qk9FzeoV0St+xQlXvjwzuW7G7qn0WvHbzkDU4N5G7h9wxn5XNvQf5PMgA8CW+j3kQAYCCKFzcPduB14AmvIt6URYpIydQTMdl9R+/+e5fv3EygddyC/9wL/fF33c/S9bnN5ABr0GFwutubRMRfJxuWdGXaCitgfbSh/djbutz1oDQcQ1F9gGo7GgT3Mo9rKjEwD4WCbU7dpAaToWlDqO7Nzywf8Xu8jaQj3q03u6sC/o84Z3wGnLvbQ87PKFNMBXfUczTsk7tyuwShdYTjrrHeCroXdHO/9+/zIkTyeSJRGIhmVxI1IVCdaG6uu1abV0cHjrTupRp70iTkiWwOvI92Iw2wQgOAPYROkV+vMAyxkc2Q8K37xN+NhufirniNk0/HxsJBky+O/jPwjbuD04fXE5UWfv/ENXsmgzxgh60qZzvAtBIsnLsThGJsqhXFXsBOqq17vUUDKGNONo3u2Zw55W0xakYgt0V3hpDNY/cYFsv6DLaBMNjeaT4RwxXpXmmWmcps1ZWt5rQ+mgkrNGcV6v9kdzXgIDJb6A30CYIin4e9S++0L92DyPdy4EZk/Z++Bf8Xk/C6XbYQzZHi+/owaZR515b1NbUxLta/bM07xy3VrFGvdmoo2ua/F0jgmXMZBYs1vJSrinUOVGoIX1+Ay3gRdKBSU+SOEmWReIqRQYM4/3JtP7ZpSXOTlt1rFGmj43cPa69cOH0RwGvVj2npQtnxfMb6H/QOpieqAH9tu3+0+C+FYermjevLJeqnL303ASK5r6S/DY76slVdnlrAZF6Q3m0DmUAokpkzWYiCFkWVbf/dLVdZ9SpS4y6jkvX0fq33owgZLzf5ip3fBKvo3VwP7Gv6ARu+/1MUatnX2rQ6rRqqqxEPt9YUkGpqRKq/veXbtZRZZSaKqVq0foDbw/P93IPlLHH+yBX+SGX8vlS3IfKfeUAaAOtk74vGoWiCyn20T3lVy+/Xqsz69R7DHs8V1+89noDzdLqElOJgPB3A0yQYYLMQP6/hphahgmah8i5dL4NbaF1qCrWgSw/RkU5Xja7K2yUYY/Xp6P+brW71KBT79GXxC/dZBv7P9CqTyJNjd2G/v0zT8rLdXOf5UrbDm6/9bz5DfQQvwCl23UsRbfLTdh5Sxee6ma058i5c0fIn9XHsj6rxWex+Oi3r1+/ceP69bdPeSdHR8c9nvHR0Unl7Z8CQP+Mf5fkTyRtVorFZGLKqYtL0R7P/NISOnFYV23a2lwiOBCpdvQNfgGqyfo2LEWL3jIEjpa8NETGO3guFfZ7ZMtA/UwyMSm1jEctcfOvDmTOHa2rDwu2/ogYOdwqnTgRU2nOknNb8xvwPbwDpTudvxDdFV4UeV4UaUnwSZJPkMjaUL4NAbxDapYVYjHB4+GKtqQdjc0IqzEXi/GR6PgHfaYOb9DHh3o7hpYLMQThLnKjMPk9IUsiE/zx7uwsmafzi+g/8x+ReVZyMzT6Ijs8DAjK8tMohj9U5o2iquzu9N03VUc2XyV7eDSB/gR/DOUARkEWZFYWWZmlWEpYbW2ZZxfLMmWnLfMtrQNoonY23GP55ZK1Jzxbe4js9cAk+g7HSMyyxEmiVCjgf7x1a/7Wrck7s3fuzN4h63z57/EwLoESAI0guyW3ICMGtaau5F5DT19JIbO+/8Lihf7cf6t3+yt8itZ3fi91rKD1XCWg/Du4CYbxfXKfvogwbyjk9YZCuCnAcYEAxwXg/wAAAP//AwCcbS4SAAEAAAACC4UmU2whXw889QABA+gAAAAA2F2ghAAAAADdZi82/jf+xAhtA/EAAQADAAIAAAAAAAAAAQAAA9j+7wAACJj+N/43CG0AAQAAAAAAAAAAAAAAAAAAADV4nCzKvy7GUBjH8e/ze5M3RHEkL6mlQ9Wf6NGVRM/wLE0kTiLBYDAaXIPBHdh7DyxWN8DsVkyWCjF9lo9eueAdlKZv3ZI10OmBbEdkzckayXqm09W/d2RFdhTZ1siZ1jlUwu2TRol9zWnsmlJb1DrFbcGxGtwqfHaDq8fV/l3//faE2xub9siGTui1QjFbopRY0zKFArsKDApUFkkW6eyc1r4o7JJV+2BPgVr3HNgCh+nlBwAA//8DAFdwHSkAAAAAAAAsACwAUACEALAA1ADgAPABEgE+AWABnAHCAgICFAIyAmoCnALIAvoDLgNUA7wD3gPqBAIEHgRQBHIEngTOBQIFIgVeBYQFpgXCBfoGJgZWBoIGmgbGBtwG/AcIBxQHIgdAB1QHbAd4B44AAQAAADUAkAAMAGMABwABAAAAAAAAAAAAAAAAAAQAA3icnJTPbhtlFMV/TmzTCsECRVW6ib4FiyK1Y1MlVdusJqRWRkRx8LggJIQ0tie25fHMyDN2Gp6ANW/BW3TFQ/AciDW619euXRAFK4p1Zub+Od+5537AAX+yT6V6H/itnhqucFS/NrzHvfqF4X1a9T3DVR7VfjdcY1BbGK7zea1j+CPeVn8xfI/j6o+G73NYbRn+mKfVA8Of7Dv+MPwpx7xd4go852fDFQ7JDe9xwA+G93mA1axUeUDTcI3PODJc5wjoMqYkYUzKEMcNY4bMmRFTEBIzY8wNMQMcAT4Jpb5NiRQ5hv/4NiKkZEakFUeUOBJCEiIKRlbxJ83KuNaO0memSLr5lIyI6GnGhIgUR8aQjJSYidYpKcl5SYMGBX3lm1NS4FEwJsEjY8aQBm1aXNJlxJgCR0srCbOQjBtKbom0v7MIUaZPTEphrOakDJSnU36xZgdc4miTa+xm5cutCo9xfKvZwk1iHF/i6b/bYLbdd8UmYqF6ioY9EuV5qxMcqeLS1+cbxSUvcTvps83kwxoNlJ3MekyPuc5f5id5wiTFuUN8QnVQ6B7iONPngFAV+Y6ALhe0eU1Xn306dPC5okvAK81t08HxFW2uONeMQPHyW0sdc8X3OL4m0BipHZs+ork8vSE3dwt3cYacY0quWyAzlvOL8+OdJiw7lG25o1BX9HWPJFL2QFSRPYsYmitydcVUtVx5ozD9BuYI+VrqbN99l21Y2O6ttviOTHfYMTdOMrklow9N1XvPM7f65xExIKOnEX0ypjQoudOzXRMxJ8Fxrj6+0C0p8dc50udOXRIzVQYBqdaZketvZL4JjXt/y/fO7hLZvKnu6GR9ql26SOV0Y0avVb3Vt9BUjjcm0LCpZpYjE5bKy5OK9yXa2+IfqvsLvd0ynnBGRsLgbzfAUzyaHHPCKSPtIJVTFnY7NPWGaPKCUz39hFij5L58ozpJhRM8nnHCCS949p6OKybOuLg1l83ePuec0eb0P51iGd/mjFfrd//e9Vdl2tSzOJ6sn57vPMVH/8OtX/B4677s6C0gm7Owau+24oqIqXBxh5tauId4fwEAAP//AwD0t09RAAADAAAAAAAA/84AMgAAAAAAAAAAAAAAAAAAAAAAAAAA");
+	font-family: d2-2701310579-font-bold;
+	src: url("data:application/font-woff;base64,d09GRgABAAAAABJAAAoAAAAAG2QAAguFAAAAAAAAAAAAAAAAAAAAAAAAAABPUy8yAAAA9AAAAGAAAABgXxHXrmNtYXAAAAFUAAAAvQAAAQQFXCgIZ2x5ZgAAAhQAAAswAAAPRL0qLP9oZWFkAAANRAAAADYAAAA2G38e1GhoZWEAAA18AAAAJAAAACQKfwX1aG10eAAADaAAAADAAAAA2GrYCVRsb2NhAAAOYAAAAG4AAABucBBsWG1heHAAAA7QAAAAIAAAACAATgD3bmFtZQAADvAAAAMvAAAIKgjwVkFwb3N0AAASIAAAACAAAAAg/9EAMgADAioCvAAFAAACigJYAAAASwKKAlgAAAFeADIBKQAAAgsHAwMEAwICBGAAAvcAAAADAAAAAAAAAABBREJPACAAIP//Au7/BgAAA9gBESAAAZ8AAAAAAfAClAAAACAAA3icfM5LLsNRHAXg72qpR73f73+9taVVK5CIRCJmxo2hWIFt2IEVMCfCDqxAYhdM/MSNsZzBmXzJOUhKEqrKPlEolHM37NnX0nHsxKkzF7qu3NRuI7Koa2bRdvQnznVduv4V8aEixbcUX/EaL/EcT/EYb/EQ9+93efP/JAc6+UNT2666hh4lZb36VPQbMGhI1bARo8a0jJswacq0GbPmzFuwaMmyFasKNWvWbdi0ZduOQ34AAAD//wMAh9cocQAAAHichFdrbBvZdT738jEWNXrwMRySEp8jzvAhUSKHw9GDEiWLomSZ1NOW5FivCLuObMmya8uRdivXAdabbR063q4Urx23m4W7RtutN/DCKOCmVYsG6G6M+FedNECRNNvtwg1iIFEDdbHYSmRxh5RM+09+aK4wvI/vfOc737kDGhgCwHN4A1RQBlVgAAZA1Lv1XlEQOEoWZZljVbKA9NQQNuTuvCf41X6/OuC64Xx1ZgZlpvHG7uLxzNzc5zNtbbl3/u4Huavo/A8AcP5LANyNs1AGegAjJQo8L3BarcooGjmBo55Uf6uqoqZCTVu/fPThoz/zfexD/fF4eEmMns69jrO7y7duAQCoIAOA4zgLerCBh2ATI2YzY9JSjDJoOZUYiUlRnuP0YkQZM79MLnY2+CLdyXO9Mz2xcCSaGn0l3j6Ks/ZUIjhapa443NV9xI/eCHC8KzcxEfQCIAjlt3ETvgE1ABoPz0vRWEyMmFmK5zmPVsuYzGIkJrNaNDVyZfTo1ZHES+4Bq8zVHwqO9fkSloEROv2d04s3h0XPNGuPTB986WyddXIWMGQAcBpnQQdMCXotJ4iRGMFNAD946a3hoWuzDbXNo6HQaHMtziavnT37Vu+Kb3Jg4JgXCL4MAPqVwifJD+NmRIZjMuhW7otPP8XZtbfXdmFvHnyCs6BSuNJn1nF2d7m4/lOcBU3hvZvJrCOMs7tba/vrFJxG5XcjK/K8JIl6TiVwZjPDZN5+v1OtrsySQVOBs7l/eDP6jdYnu8uo59uxtdb/BgCscPhH+AZUvcCikiihkCYP4RKNTbx++PDrE4Vn98BAd/fAAD1y89TCdwYHr586dXPk0vLc3NLS3Nwy2Zdga8JZoMFUogAtxzH7Of+k70Iqtdwz3LfaGU/irDA5mJ5r/AUamRcDUMTWj9/FN6AceABvKRYPLzyHlDIXc61FY0VoyPa1N7n5iwXEZ2fYQT/jrbQZ2hYvzBOU8xdy//Fy2vz9KwX4r/1NjcdBqRfKKorYR3EWKoEtVS8pAoJewcFlnvacSyakjTsXh9Ot7e2taZz1Tgz0TbG5/3v6FM2Gm5p4kiMuv411+AYEFHYFWQEqRXlBCOHnBcuYzCyrnKRFps5LkSPcmC/UIAaPuuN828lk89nAYVenwDe0BI60pVqX6KbQyw7eY3faDXWVjanG2ES0PjBlrXHWOhx6j+VIT2yyGRBYAbARZ4EikXCSm+H0j+6jL+/j6rW13S3CM4JD+W08qNQrwSjpRb1SOso/WjRw6ZsbrbIc//Zr9PX30HRufTadnkWnc7ffuw4YAvlt9BO0A1bgAFgPSYqs1B8lKMExeo54iByJyZJSk/+YHLq8jjm/s7NOalxonTmxqlM7ew9YvcaBuJMeTwxMVLkFC/NVe93SudxnYi13jjWO64J2C6tooiu/jc14E0zgLDDKUZxeZKgXRMt5iNmgHne3XU2fX1fbk574RGN8ZoKPjdX7TT7a7ZLw5t20zd7xB+mjryRWU+lvNvzYUKnwUZffRptoB2wv+grneeYqWmTtOdPV9/VkqLe2h3NJiUSTJWRs9Y7R7RdGRpfbHeyMPd3VmWGqZl01hGcMQn4b7eBNMIJrjyuCmhUksYSlPTH8bvJM20zU32zVrq/q1LYUtggGY9DExRrpb70yfKGj1pL+693usI1bNVl/bKjs7j3UA1jB/p9oByzgfA490RXlJuoj2FVilJyCnL3nDnYvtvVONapx7me6VFiKhfnp794X6j0xumN5ZHg5kVhIGr1lMdF9zOZArX6pkcSCwAKAlvFDMhJdyS9omVid/isHD9YNdTuj1TUVNrrGcewYunhaUyONRWntokbj5h3nc68BqMCTb8AU2oFGaIN+hRleisqSgr04xMQIKzJc0UQ8AiFIJPIyabWqEmcwFqvTwytTftc63dxrrHFZbP7Waane/beDVFl0QrY7DR7/0ORXk2v9dkGw2wXBH+kUvKLVTde0P7Y118d96gqfsyZSrTYkg/FBH71Q7jG19NfpqsxGQ1u3OBxCDwN+we/z+QO59TorW61SWay19gI3XSTZikZB3Ncmo+f0CumUvmudqj0cGT60bnfV+ix48+4xa3BhKvcIuWM+K5v7EPJ5kAHgF/gx5iEKABRIcGV/bwfeBJrwLupFWaSMnEAxXdfUf/7u9//+e2cTeDO39C+Pcj//595Xyfz8NjLgTahSeN2vbSKCH6Xb1vVlGkproL308cOY2/0Za0DotIYi6wBUdrQDbuUcVlRiYJ+LhNofu0gNp8JSl9HdHx46vG53eZvIoxFtdTobgj5PeC+8ptyHxWGPJ7QDptIzSnla1aldmX2i0FbC0fAcTwW9K9r5/f3LnDiTTJ5JJJaSyaVEQyjUEGpoKNZq+/LoyIX2lUxnV5qULIHVle/DZrQDRnAAsM/QKfLjBZYxPrMZEr79kPCV+fhMzBW3aQb52FgwYPI9wH8VtnF/cv7oaqLGOvinqG7fZIgX9KEdZX8XgEaSlW33ikiURb2q1AvQSa31oKdgCB3E0T7bN4MHb6ctTsUQ7K7w7gSqe+YGRb2ga2gHDM/lkeKfMVyT5planaXCWl3bbkJb45GwRnNJrfZHcp8AAia/jb6HdkBQ9POsf/GF/rW/GeleDsyYtI/DX+MPehJOt8MesjnafCePtow7D9qitpYW3tXun6d556S1hjXqzUYdXdfi7xkTLBMms2CxVpZzLaHuqUIN6fPbaAkvkw5MepLESbIsElcpMWCYHEym9a+urHB22qpjjTJ9auzhae3ly+c/Dni16gUtXdgrnt9GX6AtML1QA/qi7f7b8KF1h6uWN6+vlquc/fTCFIrmfin5bXbUl6vu8dYDIvWG8mgLKgBElciazUQQsiyq7v/lRqfOqFOXGXVdV2+jrV97M4KQ8f46V73nk3gLbYH7hXUlO3DFezZFbay91aTVadVURZl8qbmsilJTZVTjH6/cbaAqKDVVTtWjrSfePp7v554oY5/3Sa76Iy7l86W4j5TzKgHQNtoifV80CiUHUuyzcypvXHunXmfWqQ8YDnhuvHnznSaapdVlpjIB4d8MMUGGCTJD+f8ZYeoZJmgeIfvS+Q60i7agplQHsvwcFZV41eyuslGGA16fjvqnjd5yg059QF8Wv3qXbR78oVZ9Fmnq7Db0Xz/1pLxcL/fTXHnH0eJdz5vfRk/xG1BerGMpWiw3Ye/OXbjSm9GBExcvniB/Vh/L+qwWn8Xio9+/ffvOndu33z/nnR4fn/R4JsfHp5VvhBQA+nf8hyR/ImmzUiwmE1NOXVmJ9nkWV1bQmeO6WtPuzgrBgUi1o8/wG1BL5ndgKVpylyFwtOSmITLe4YupsN8jW4Ya55KJaaltMmqJm79xJHPxZENjWLANRsTI8XbpzJmYSrNG9m3Pb8Nv4QMo3+v8heiu86LI86JIS4JPknyCROaG8h0I4ANSs6wQiwkeD1eyJO1obkVYjblYjI9EJ384YOryBn18qL9rZLUQQxAeIjcKk+8JWRKZ4OcP5+fJezq/jH6V/5i8ZyU3Q6OfZ0dHAUFFfhbF8EfKe6Ooqng4+/Bd1Ymd75I1PJpCf4F/BJUARkEWZFYWWZmlWErYaG9bZJcrMhXnLYtt7UNoqn4+3Gf5+oq1Lzxff4ys9cA0+g2OkZhliZNEqVDA/3rv3uK9e9MP5h88mH9A5vnyv8WjuIx8J2kE2S25BRkxqD11PXcLvXw9hcz6wcvLlwdz/6ve76/wE7S1973UtY62ctWA8h/gFhjFj8l5+hLCvKGQ1xsK4ZYAxwUCHBeA/wcAAP//AwBd7DjPAAEAAAACC4VOe8kdXw889QABA+gAAAAA2F2ghAAAAADdZi82/jf+xAhtA/EAAQADAAIAAAAAAAAAAQAAA9j+7wAACJj+N/43CG0AAQAAAAAAAAAAAAAAAAAAADZ4nCzKPS4FURjH4d/7v8kNcXAkl1zNLcb4iDmmJTGneJtJJE4iQaFQKqxBYQf62QON1gaobUWlGSGqp3n0ygXvoDx+65ainlYPFAWKHVE0pWig6JlWV//eUZTYUWJbA2da51AZt09qZfY1pbZr5tqi0iluM45V47bAJze4OlzN3/Xfb0+4vbFpj2zohE4rhMkSc4k1LRMU2VWkV2RhiWyJ1s5p7Itgl6zaB3uKVLrnwGY4jC8/AAAA//8DALKBHYQAAAAsACwAUACEALAA1ADoAPQBBAEmAVIBdAGwAdYCFgIoAkYCfgKwAtwDDgNCA2gD0APyA/4EFgQyBGQEhgSyBOIFFgU2BXIFmAW6BdYGDgY6BmoGlgauBtoG8AcQBxwHKAc2B1QHaAeAB4wHogAAAAEAAAA2AJAADABjAAcAAQAAAAAAAAAAAAAAAAAEAAN4nJyUz24bZRTFf05s0wrBAkVVuom+BYsitWNTJVXbrCakVkZEcfC4ICSENLYntuXxzMgzdhqegDVvwVt0xUPwHIg1utfXrl0QBSuKdWbm/jnfued+wAF/sk+leh/4rZ4arnBUvza8x736heF9WvU9w1Ue1X43XGNQWxiu83mtY/gj3lZ/MXyP4+qPhu9zWG0Z/pin1QPDn+w7/jD8Kce8XeIKPOdnwxUOyQ3vccAPhvd5gNWsVHlA03CNzzgyXOcI6DKmJGFMyhDHDWOGzJkRUxASM2PMDTEDHAE+CaW+TYkUOYb/+DYipGRGpBVHlDgSQhIiCkZW8SfNyrjWjtJnpki6+ZSMiOhpxoSIFEfGkIyUmInWKSnJeUmDBgV95ZtTUuBRMCbBI2PGkAZtWlzSZcSYAkdLKwmzkIwbSm6JtL+zCFGmT0xKYazmpAyUp1N+sWYHXOJok2vsZuXLrQqPcXyr2cJNYhxf4um/22C23XfFJmKheoqGPRLleasTHKni0tfnG8UlL3E76bPN5MMaDZSdzHpMj7nOX+YnecIkxblDfEJ1UOge4jjT54BQFfmOgC4XtHlNV599OnTwuaJLwCvNbdPB8RVtrjjXjEDx8ltLHXPF9zi+JtAYqR2bPqK5PL0hN3cLd3GGnGNKrlsgM5bzi/PjnSYsO5RtuaNQV/R1jyRS9kBUkT2LGJorcnXFVLVceaMw/QbmCPla6mzffZdtWNjurbb4jkx32DE3TjK5JaMPTdV7zzO3+ucRMSCjpxF9MqY0KLnTs10TMSfBca4+vtAtKfHXOdLnTl0SM1UGAanWmZHrb2S+CY17f8v3zu4S2byp7uhkfapdukjldGNGr1W91bfQVI43JtCwqWaWIxOWysuTivcl2tviH6r7C73dMp5wRkbC4G83wFM8mhxzwikj7SCVUxZ2OzT1hmjyglM9/YRYo+S+fKM6SYUTPJ5xwgkvePaejismzri4NZfN3j7nnNHm9D+dYhnf5oxX63f/3vVXZdrUszierJ+e7zzFR//DrV/weOu+7OgtIJuzsGrvtuKKiKlwcYebWriHeH8BAAD//wMA9LdPUQAAAwAAAAAAAP/OADIAAAAAAAAAAAAAAAAAAAAAAAAAAA==");
 }
-.d2-1108726992 .text-italic {
-	font-family: "d2-1108726992-font-italic";
+.d2-2701310579 .text-italic {
+	font-family: "d2-2701310579-font-italic";
 }
 @font-face {
-	font-family: d2-1108726992-font-italic;
-	src: url("data:application/font-woff;base64,d09GRgABAAAAABJYAAoAAAAAHCgAARhRAAAAAAAAAAAAAAAAAAAAAAAAAABPUy8yAAAA9AAAAGAAAABgW1SVeGNtYXAAAAFUAAAAtwAAAPpHquUgZ2x5ZgAAAgwAAAtUAAAQEKwYBA9oZWFkAAANYAAAADYAAAA2G7Ur2mhoZWEAAA2YAAAAJAAAACQLeAjZaG10eAAADbwAAADCAAAA1F/QBfFsb2NhAAAOgAAAAGwAAABscPZ08m1heHAAAA7sAAAAIAAAACAATQD2bmFtZQAADwwAAAMrAAAIMgntVzNwb3N0AAASOAAAACAAAAAg/8YAMgADAeEBkAAFAAACigJY//EASwKKAlgARAFeADIBIwAAAgsFAwMEAwkCBCAAAHcAAAADAAAAAAAAAABBREJPAAEAIP//Au7/BgAAA9gBESAAAZMAAAAAAeYClAAAACAAA3icfM07LgQBHIDx35i1Xmut93vNetu3uYFEIxGdeqIUJ3ANJ3ACeqJwAjeQuIBaI38xB9h85a/4kEglqKn4RlNDqi7T0dM3kDt34dK1wq371kMEMm3d0ofOSr9SuHH37/GlSvwSP/Eeb/EaL/ERz/H0+VjeRpUYOtXV0zFw7ETbmFTFuKoJk6ZMm1Ezq25OX8O8BYuWLFuxas26DZu2bGvakWnZtWffgUNHcv4AAAD//wMAJfUl2AB4nHxXbWxb13l+z7lXvBJFfZCXHyYlkiIvea9EXpISL8krSiL1QYqiJFK2JEtWZH1a/ohtxVPsyIlne0ntoUuyxmWLoMOKDM7WregQYAmcYlj/pGtcLGozD9uQbdnaGWjTyoW9oqmgZW5R3TsckpIoF+ifywMenPO+z/O+z3POgSrwAOAL+HWgoAYawAAmAIl1UZQky5yFkgSBYxhZYFnGcwNt3PgqnZr9aeubvxKd9NDn/nr0f5bewq/vrKKX5l98UTn+8qlTxx49Unzo3x8BAGD1QwD0b7gANaAHYBlJ4HmB02gQklhO4JhPuu5qaS1N2yTlH9HJ2dy44Wdn0ZW1tci5zvgZZRwXdtbu3QOggAPALbgAerCRscRKYbPJqNEwjLn4y1FSOBaN8Nz+gLv59uKqP+VBUmbo2ljXwsLs4Mjx8xcXLuSHn8OFkSExLVbTuv7O4XkRXR6SA+Gdh4O5cILkjSCubuMAfgOcAFVuno9GklgKmy0Mz3Puemwyms1SOCZbNBrkHn061j57Pdc5fijGxviuxQGPe6S7NdXCeeZ1qRfG8q8/PyT72lqExMkXerrnoy1NYWeAcENw4FiRG7YCESdI4dgugt9/5bWp2783PT11LXVmJYYLf3Tl+W+e6jv6leX5s6U8OQDYxgWgijtQ3M2xm7iws7Y7h76MC1BVmnMx3M2xy8hYhws7dwZK8/g0LpSjsxYpFpNZieIoUiGG7PUVH62p1w6O3sy/7qc1DdoMLihzr3Q8I6G5nTX0tdekc2HldhFLj7qNF/Ab0AgtRcbKhJlNxnoshJOY4CkRh5wX1oPT65mRU5Hg9HOp6LGke2SMfId1f3JttLA+mL46Ofql9cFUz4n1+PJ694n1rqXLe3wFcAFqwVjJF0ex+yX/1tzFkc8dPRvpXzx1Lpc9hQsj00fOdCiP0dCRw3EJyrkuFHNtABHAeyA5i5sX9qpdTJ7ZrTTiKlL9v8kr1sljZRj+sWcG9FORhqa6Kle0e+VyVynrE5f/I3eE/eL5MqbsFy4Oa/x+mkrUlrEIuAB1YN7HwrAcdQDNN+eevTB5aXL1opxeWTg5ml3Chczk8Qt65RNkVh6iqYlMLEQwIdCp20jBb4APgGCQi1lHI7xQhBOL7TWvRkNgWkqqeZBaa43bp+Se8YA35+uOznV3Lzklaybojdo7PLlQpPu0rqvL7w+nOz1hc9A2LIcnwpHWoKPN2d7Eh8yB5iG563gEEMwD4CguAEPQcLKL4aivr79Xhz6s+/Y6zqdSO++W8jysbhd7zlzukmLHkZQIyWSoQY6T5zX0yNhoTd9g56xpPDfRfEN39rQpZEVryisBdyY/dx59WTl/6wqppaBuo8doC4yEUcte31kkWaI4mdNohHBMlvdU+25fThxZkISEnmaTy73VNDdj4A97RFO42ZOKOjt0x6cyV+akVldCsWW9ob5g6D95t294Ptxb9AUMTnUbfYo3wERckzDNMRwrMYxUpPhAtxe96aGQ0FPG3lt5wYw9RwPF8FFPKupob3OPc0GjpGt1JfDGe0t2/+w0Cd3nG56Xkgmf9wHvBgRedRvdQVvQfADdfiXLLvTx4ZNifjkq9pgDLG9vn47Fu1piZrctrzs9n740FXJb2y2m9FpqIGPTh43eEhZB3cZCBZZ97n43eV0GqpHPF8rsjXmfZE9oWXxvp/NJ+nARy7fRFtjAWxmPdCLj0uw5KiXFiJoJwp9Mnw2MzrXL/Q5dlfLdmpaUzx63OOzjf6piytDGRRd055YH1ybE4JFws1Tfe8Rr1UsmJ/LWHqpr7nBOAQI/AHoNfwSWYl/24kolMIzEcJR/qre2v7FhLGHzGZq0TXpXW7X+hG5lCn0jXjU+MllXKzPasH8yqcwQzpDqQVtoC5wQrFSaLGs0XCWDpJOpA+y91THNeZoHW5Mj9Vb+aChxxD8818En9RTbe5q9FOfG3X5zRzPXLzlCP+TtUYs71/c0L05PpZ57Kkz6kVo8jVx+3z/z7rbMTHt3N6khIucT+hhvgJXgq+hDhuJYQiPn1jCU81a+vZFumxCT0epkroems83Z4CDeeJTgQv2dTo/yfSQaD9WN+oLKN1SV7Am/xncwD8QwNRDJ7sf6Od4AXTEWReKxnMAwzlv5JfyrmffXx+bXbHhDsSP0ofLTn1+8CghEdRt+jTfAQNiKRopq15iM5VI/06+5mr+OkJ7SMEhr1vXqrfj8zpeYGsqAcDdN78XFD9EW8TYSsyQ1Sxmo5gDSStDLvQzNT/JdHVWhGW8iRtPJfIKmh0xZcZBwkDFn/YNoc9jTIbeKUn+n3mGs5GF/tIf9Y7QFhypzeJJmErFtIniA5WKEJ0ne0x/6AdqCBrBX6qFkImTXXZF/dHhBHFkIH14URxd8gXEpFiYf3dPHBy9NBUvfvoG19MBQai09kCF7q5+pEvoUbZW0zVRkXI+5omsx7AGf0r7aq6G8U8GiQYX5HhYbnH9V6VP38Lt9zkBZ4M6nbyNUNir+Z17XLh4JPd6NWSXL3G9p4qAikMvlwN6ZYKUnv3q70lDu3X6eD+1Z8k4eoYOGXOwNdA1tQWNFXSwMv1uPWtqeC1hNTY02T86ZQJvzYqImXd3brdwDpP5G3UbX0RYIT56ZTx6Z5MQsHZhf65i3tlv6eF+irTMYF4fF4EhzkJVcfEesJRlpn9BFWnlna5CzCU5bss3f7/U4Wo22gNPBG9w9YiDtJTn3qNtoBq/ueXpMZrleLBXdqMLTv9UXoVF8qDbn6W+6qrsep5rd9bZafWNI1xtosNUhQ7zq859PKg8NBodDWyUzDWTvTnUb/QJtgnV/733FsWVbf2tPDVn7kDiYIwdh61HdgKx3siimfMRaSZuiGcU2whELAATdAOhHaBPqACRKYs3m8m0R3RjKeWgNTes97Bfzyg7aVB5wo5xn2IOsiq20NgOAP0Cb4Hpi7f6I4qjSu4ChznK5RoQQ3dDU+NKoHmNE19saX8z+92J98V97w2W0qfzYnXa7027kqBjZkJbLejxZTvkMkPoRAPrXEg8cK0iWcihZYixc+Q3CMOJ/HR/zVdczdENLw9TkxsphsVqvpRvd7ALCP1k1CyZjm2n1f3950Rw0m0XLJQCkvq+G0CdoE2wATPGeRXiVDzBSjzXalnqrweDttxomc3xVNUXrvYYv5JQfW7uz/8Iw8ZpEmEMPlF+48hyXcyP9zi9DeZFwhcGnbqN/wq+CnrBlcfO/4yK9ER7y+oaXouGMp214sUNIRexisPjVda4kn/rza0NdK8nZN69mEulnX06njg0++3J64Bggkjt6Cf8B1AJIMrmtxWSJkhhb3R8vPaudkrufu6HrQ/fDOvfO+30E82cA6Lv4VbKOk5NU2TSEPUNhXIy2eunWQkiKtvS7BfFY+8SMb+LaJDLqguNXTzwVFHtczna+7al0dGFpLTtAesKibsPLsEpyKPVpcS9NxmwVms2HvLpms020m60iif8jdQ4KsEo0zgixmMxVLDDWhuIMNjs4u6159i+Dhh6PzWwVPI7htd330X2kRVbyPpJlieF0P6i7Xz471R+qf4jeUf+WzDGyi/HUou9pr4XDZJ36d+oS+gv8D8U5JKEsutOp5N+kTv/mq8W1cB19Hf0Z/h7UA7CCLMgW2cLIFsbCCO+0DM4YVqxi9RnmDN8aQXfsMx2trnP0+Xq/c9kyAwja4Qz6PvYR7HKUi0pRySSZONP9v3m75+13znwQv3s3/gGJYVQ/xUlcBTUAVYLsiroEGZlQp3BX6UN/f1dAmkbfd3q/41MeV+2dk3APbe6+BZ3L+RNosyhCBEN4FO7gOyQmW0HfC6yDsxjtHB61mK2uQ2Zry/8DAAD//wMA3XNZfwABAAAAARhRA4DzEV8PPPUAAQPoAAAAANhdoMwAAAAA3WYvN/69/t0IHQPJAAIAAwACAAAAAAAAAAEAAAPY/u8AAAhA/r39vAgdA+gAwv/RAAAAAAAAAAAAAAA1eJwEwCFLQ1EYxvH/8yyqIChct3LCcbvgNRgVb9VFFcRmF6yWBb+Efg6TxTi0CILJuHCGeWVhiIy9+/mBfT5Bq/jykOwBJ74ksyTrm+x7ske0HpA9onVD1j+bWnHrOy7cpfYeSa/0XVFrSl89Gu8gb5CYkTQh8cdhJ5G8RXKH2lUs3KXWDUlPsdQZrbc51phTf3Cul/jRON5VOFChpxIL5lTMY6qGrN+Y6Dre9MyjCke+YpcZCRiuAQAA//8DAEFyMvUAAAAAAC4ALgBSAIoAvADeAOwA/AEiAVQBeAG6AeICIgI2Al4ClgLOAvwDNANuA5YD3gQIBBQELgRQBJIEvATqBSQFXgV8BbgF5gYSBjAGagaWBsYG+AcQBzoHUAduB3wHigeaB7gHzAfkB/IICAABAAAANQCMAAwAZgAHAAEAAAAAAAAAAAAAAAAABAADeJyclN1uGlcUhT9ioE3/Liorcm6sc5lKzuBGcZTEV+M6VkZFkDKkP1JVaYAxIGBmxAw4zhP0um/Rt8hVH6NPUfW62psNYSKrVlAUaw1n/6yz9toH2Odf9qhU7wJ/1ZeGKxzWfzZ8hy/qTcN7nNU/M1zlqPa34RqD2lvDdR7UOoY/4V31D8Of8rj6m+G7HFQvDH/Oo+q+4S/3HP8Y/orHvFvhCjzld8MVDsgM32GfXw3vcQ+rWalyj2PDNb7m0HCdQ6DLmIIpYxKGOC4ZM2TBnJickJg5Yy6JGeAI8JlS6K8JkSLH8MZfI0IK5kRacUSBY0rIlIickVV8q1kpr7Sj9Jkrkm4+BSMiepoxISLBkTIkJSFmonUKCjKe06BBTl/5ZhTkeOSMmeKRMmdIgzYXNOkyYkyO40IrCbOQlEsKroi0v7MIUaZPTEJurBYkDJSnU36xZgc0cbTJNHa7crNU4QjHj5ot3CTG8S2e/ndbzMp912wilqqnaNhjqjyvdIIjVVz6+vyguOA5bid9ykxu12ig7GTWY3osdP4yP8kTJgnOHeATqoNCdx/HmX4HhKrITwR0eUmb13T126dDB58WXQJeaG6bDo7vaNPiXDMCxauzC3VMi19wfE+gMVI7Nn1Ec/l6Q2buFu7iDLnHjEy3QGYs9xfnxztNWHYoLbkjV1f0dY8kUvZAVJE9ixiaKzJ1xUy1XHsjN/0G5gg5LXS2789lG5a2e+stvibVHXYsjJNMbsXotql6H3jmSv95RAxI6WlEn5QZDQqu9W6viFgwxXGuPn6pW1Lgb3Kkz7W6JGamDAISrTMn07+R+SY07v2S7529JbJ5M93RyeZWu3SRysnWjF6reuuz0FSOtybQsKmmliMTlsqrm4r3Jdor8Q/V/bm+bikPCbSuTLJ/4ytwzDNOOGWkXaR6wnJzJq+ERJyqAhNijZI3841q9QiPEzyecMIJz3jygZZrNs74uBKf7f4+55zR5vTW26xi25zxolTt/zv/qWyP9T6Oh5uvpztP88FHuPYbjkrvZkdfA9mgpVV7vx0tImbCxR1sa+Hu4/0HAAD//wMAcqFRQAAAAwAA//UAAP/OADIAAAAAAAAAAAAAAAAAAAAAAAAAAA==");
+	font-family: d2-2701310579-font-italic;
+	src: url("data:application/font-woff;base64,d09GRgABAAAAABKIAAoAAAAAHGQAARhRAAAAAAAAAAAAAAAAAAAAAAAAAABPUy8yAAAA9AAAAGAAAABgW1SVeGNtYXAAAAFUAAAAvQAAAQQFXCgIZ2x5ZgAAAhQAAAtzAAAQPGrXayBoZWFkAAANiAAAADYAAAA2G7Ur2mhoZWEAAA3AAAAAJAAAACQLeAjaaG10eAAADeQAAADFAAAA2GGpBhRsb2NhAAAOrAAAAG4AAABud1xzim1heHAAAA8cAAAAIAAAACAATgD2bmFtZQAADzwAAAMrAAAIMgntVzNwb3N0AAASaAAAACAAAAAg/8YAMgADAeEBkAAFAAACigJY//EASwKKAlgARAFeADIBIwAAAgsFAwMEAwkCBCAAAHcAAAADAAAAAAAAAABBREJPAAEAIP//Au7/BgAAA9gBESAAAZMAAAAAAeYClAAAACAAA3icfM5LLsNRHAXg72qpR73f73+9taVVK5CIRCJmxo2hWIFt2IEVMCfCDqxAYhdM/MSNsZzBmXzJOUhKEqrKPlEolHM37NnX0nHsxKkzF7qu3NRuI7Koa2bRdvQnznVduv4V8aEixbcUX/EaL/EcT/EYb/EQ9+93efP/JAc6+UNT2666hh4lZb36VPQbMGhI1bARo8a0jJswacq0GbPmzFuwaMmyFasKNWvWbdi0ZduOQ34AAAD//wMAh9cocQAAAHicfFdtbFvXeT7vuVe8MkV9kJcfJi2SIi95r0RekhIvyStKIvVBiqIkUrYkS1ZsfVr+iG3FU+zIiWd7Se2hS7LGZYugw4oMztat6BBgCZxiWP+ka1wsajMP25Ct2doFaJMqhbOiiaBlblHdO5xLSqI8oH+ODnR53vd9nvM+zzkH1SAfQvgifhlR6ABqRCZkQUhiPRQlyTJnoyRB4BhGFliW8d2E9ZtfpzPHf9766q9FNz30hb8e/e/F1/DL2yvw3Nyzzyonnj99+tgnnygB+PdPEEIIq+8iBP+GS+gAMiLEMpLA8wKn0wFILCdwzIdd9/S0nqYdkvKPcOp4Ydz0i3NwdXU1dr4zeVYZx6Xt1fv3EaIQhxBuwSVkRA4yl1gparWYdTqGsWp/OUqKJuIxntubcLdeX1gJZnwg5Yauj3XNzx8fHDlx4dL8xeLwU7g0MiRmxVra0N85PCfClSE5FN1+MFiIpkjdgJLqFg7hV5AboRovz8djaSxFrTaG5zlvA7aYrVYpmpBtOh14Rx9PtB+/UegcP5hgE3zXwoDPO9LdmmnhfHOGzDNjxZefHpIDbS1C6tQzPd1z8ZZDUXeIcENw4ITGDVuFiBOkaGIHwe+/8NLUnd+bnp66njm7nMClP7r69LdP9x392tLcuXKdJEaTFoPsGeNhJIajuFtwvl75MPRZ/ac9uNT/0YDyo8pv0RYuIUrLRnG3xm7h0vbqThz4Ki6hmvI3D8PdGrsC5npc2r47UMlzBpcqlbI2KZGQWYniKLKbDIn1tQCta9APjt4qvhykdY36HC4psy90PCHB7PYqfOMl6XxUuaPh7lG38Dx+BTWhFo3dCrlWi7kBC9E0JtjLJIP74lp4ei03cjoWnn4qEz+W9o6MkXHY8CfXR0trg9lrk6NfWRvM9JxcSy6tdZ9c61q8ssttCJdQHTJXc8tR7F57fGf20sgXjp6L9S+cPl/In8alkekjZzuUhzB05HBSQpVa57VaG5GIkH9fcTYvL+x2hlY8s9MVwFWV+r+TV+2TxyowgmNPDBinYo2H6ms88e7lK13lqk9e+VHhCPvlCxVM+S9dGtYFgzSVqqtgEXAJ1SPrHhaG5ah9aL49++TFycuTK5fk7PL8qdH8Ii7lJk9cNCofglV5AFMTuUSEYAJkULdAwa+gAEIEg6xVHY/xggYnkdhtdJ2OwLSVFfZxZrU16ZySe8ZD/kKgOz7b3b3oluy5sD/u7PAVIrHuM4aurmAwmu30Ra1hx7AcnYjGWsOuNnf7IT5iDTUPyV0nYgjQHEI4jkuIIWg42cNw1DfX3qqHd+u/u4aLmcz2m+U6D6tbWs9ZK12idRwpiZBMpjpwnbqgo0fGRg/0DXYet4wXJppvGs6dsUTssKq8EPLmirMX4KvKhdtXyV4K6hY8hE1kJozadvvOJskSxcmcTidEE7K8q/A3+wriyLwkpIw0m17qraW5GRN/2Cdaos2+TNzdYTgxlbs6K7V6Uooj74/0hSP/wXsDw3PRXs1DMHKrW/ApXkcW4rCEaY7hWIlhJI3ifd2u+dgDIWWkzL23i4IV+46GtPRxXybuam/zjnNhs2Ro9aTw+luLzuDxaZK6LzA8J6VTAf/HvBcB8qtbcBc2UfM+dHs7WXGs9w+fEotLcbHHGmJ5Z/t0ItnVkrB6HUXDmbns5amI195us2RXMwM5hzFq9pexCOoWFqqw7HH3u8nrMlFNfLFUYW/M/yh7QsvCW9udj9KHNSzfhU3kQP7qfKQTGY9u130pKUHUTBB+NH0uNDrbLve7DDXK9w+0ZALOpM3lHP9TFVOmNi4+bzi/NLg6IYaPRJulht4jfrtRsrjBX3ewvrnDPYUABRGCl/B7yKb1ZS+uVgKjGWtwqreuv6lxLOUImA7pDxk9bbXGk4blKfhWsmZ8ZLK+Tmb00eBkWpkhnIHqg03YRG4UrlaaLOt0XDWDpJOpfey91jHN+ZoHW9MjDXb+aCR1JDg828GnjRTbe4a9nOTGvUFrRzPXL7kiP+GdcZu30Pc4L05PZZ56LEr6kVo4A55g4J95b1tupr27m+whkLMM3sfryE7wVfUhQ3EsoZHz6hjKfbvY3kS3TYjpeG260EPT+eZ8eBCvf5LiIv2dbp/yQxDNB+tHA2HlW6pKYqLf4LuYRzGEkA7F83u5fonXkUHLRZF8LCcwjPt2cRH/eubttbG5VQdeV5wA7yo//+WlawiQqG6h3+B1ZCJsxWOa2nUWc2Wrn+jXXSveADBSOgb0VkOv0Y4vbH+FOUCZAHfT9G5e/AA2ibeRnGWp2SpAdfuQVoNe6mVofpLv6qiJzPhTCZpOF1M0PWTJi4OEg5w1HxyEjWFfh9wqSv2dRpe5moe92S7292ETHayu4VGaSca2ifA+lrUMj5K8qz/4MWyiRuSs1kPZREjUHZG/d3heHJmPHl4QR+cDoXEpESWD4fETg5enwuWxb2A1OzCUWc0O5Ehs9XNVgk9hs6xtpqriBsxprsWw+3xK/2KvjvJPhTWDivI9LDa5/6rap+7jN/vcoYrA3Y/fAagYFf8Lv2cHjwQPd3LWyDL3/zSxXxHg8biwfyZc7ckv3qk2lPt3nuYju5a8XQTYb8hab8B12ERNVftiY/id/aijnYWQ3XKoyeEruFOwMSemDmRre7uV+wjU36pbcAM2kfDomfnokUlOzPKB+Y2OOXu7rY8PpNo6w0lxWAyPNIdZycN3JFrSsfYJQ6yVd7eGOYfgdqTbgv1+n6vV7Ai5XbzJ2yOGsn5Sc4+6BTN4ZdfTEzLL9WJJc6MqT/9OX4yG5FBdwdd/6JrhRpJq9jY46oxNEUNvqNFRD6ZkzRe/mFYemEwul75GZhpJ7E51C34FG8i+F3tPcWzF1l/bVUPeOSQOFshB2HrUMCAb3SwklPdYO2lTmFEcI5x2ZwLUjRD8FDZQPUISJbFWa+W2CDeHCj5aR9NGH/vlorING8rH3CjnG/aBXXGU1+YQwu/ABvI8snZvRnFU+Q3BUOe4QhMA0I2Hmp4bNWIMdIOj6dn8fy00aP91Nl6BDeVn3qzXm/WCq2rmAD2X9/nynPI5AvU9hOBfyzxwrCDZKqlkibFxlfcKw4j/eWIsUNvA0I0tjVOT68uHxVqjnm7ysvOAP1qxChZzm2Xlfz67ZA1braLtMkKgvq1G4EPYQA6EGO2eRXiV9zHSgHX6lga7yeTvt5smC3xNLUUb/aYvFZSf2bvz/8IwyQOpKAcfK7/yFDmu4AXj9meRoki4wiigbsE/4ReRkbBl8/K/4yK9Hh3yB4YX49Gcr214oUPIxJxiWBsNncvpx/78+lDXcvr4q9dyqeyTz2czxwaffD47cAwBqR2ew3+A6hCSZHJbS8gSJTGO+j9efFI/JXc/ddPQBx9EDd7tt/sI5s8Rgu/jF8k6Tk5TFdMQdg2F8TD62sXb8xEp3tLvFcRj7RMzgYnrk2A2hMevnXwsLPZ43O1822PZ+Pzian6A9IRN3ULPoxVSQ7lPtVi6nNUuNFsP+g3NVofotNpFkv+n6iwqoRWicUZIJGSuaoG5LpJksNXFOR3Nx/8ybOrxOax2wecaXt15S30AerCT95EsSwxn+HH9B5WzU/2J+ofwhvq35BsjexhfHfxAfz0aJevUv1MX4S/wP2jfQII83O1Uiq9SZ377dW0tugHfhD/DP0ANCLGCLMg22cbINsbGCG+0DM6Ylu1i7VnmLN8ag7vOmY5Wz3n6QkPQvWSbQYDa0Vn4IQ4Q7HKci0txySJZOMsHf/N6z+tvnH0nee9e8h2Sw6x+itO4hrwDawTZE/cIMligU7in9MHf3xNA1xT4Xu/3AsrDmt1zEt2HjZ23oHupeBI2NBECGsKj6C6+S3KyVfQ9w7o4m9nJ4VGb1e45aLW3/B8AAAD//wMAlV9kbAAAAQAAAAEYUfofn9tfDzz1AAED6AAAAADYXaDMAAAAAN1mLzf+vf7dCB0DyQACAAMAAgAAAAAAAAABAAAD2P7vAAAIQP69/bwIHQPoAML/0QAAAAAAAAAAAAAANnicBMAhS0NRGMbx//MsqiAoXLdywnG74DUYFW/VRRXEZheslgW/hH4Ok8U4tAiCySIsnGFeWRgiY68/37HLO2gVHx6SPeDI52R9k1mS9Un2LdkjWg/IHtG6IeuPda249g1n7lJ7h6Rn+q6oNaWvHo23kNdIzEiakPhlv5NI3iC5Q+0qFu5S64qkh1jqhNabHGrMsd841VN8aRyvKuyp0FOJBXMq5jFVQ9ZPTHQZL3rkXoUDX7DNjAQM/wEAAP//AwATtzPyAAAAAAAALgAuAFIAigC8AN4A9AECARIBOAFqAY4B0AH4AjgCTAJ0AqwC5AMSA0oDhAOsA/QEHgQqBEQEZgSoBNIFAAU6BXQFkgXOBfwGKAZGBoAGrAbcBw4HJgdQB2YHhAeSB6AHsAfOB+IH+ggICB4AAAABAAAANgCMAAwAZgAHAAEAAAAAAAAAAAAAAAAABAADeJyclN1uGlcUhT9ioE3/Liorcm6sc5lKzuBGcZTEV+M6VkZFkDKkP1JVaYAxIGBmxAw4zhP0um/Rt8hVH6NPUfW62psNYSKrVlAUaw1n/6yz9toH2Odf9qhU7wJ/1ZeGKxzWfzZ8hy/qTcN7nNU/M1zlqPa34RqD2lvDdR7UOoY/4V31D8Of8rj6m+G7HFQvDH/Oo+q+4S/3HP8Y/orHvFvhCjzld8MVDsgM32GfXw3vcQ+rWalyj2PDNb7m0HCdQ6DLmIIpYxKGOC4ZM2TBnJickJg5Yy6JGeAI8JlS6K8JkSLH8MZfI0IK5kRacUSBY0rIlIickVV8q1kpr7Sj9Jkrkm4+BSMiepoxISLBkTIkJSFmonUKCjKe06BBTl/5ZhTkeOSMmeKRMmdIgzYXNOkyYkyO40IrCbOQlEsKroi0v7MIUaZPTEJurBYkDJSnU36xZgc0cbTJNHa7crNU4QjHj5ot3CTG8S2e/ndbzMp912wilqqnaNhjqjyvdIIjVVz6+vyguOA5bid9ykxu12ig7GTWY3osdP4yP8kTJgnOHeATqoNCdx/HmX4HhKrITwR0eUmb13T126dDB58WXQJeaG6bDo7vaNPiXDMCxauzC3VMi19wfE+gMVI7Nn1Ec/l6Q2buFu7iDLnHjEy3QGYs9xfnxztNWHYoLbkjV1f0dY8kUvZAVJE9ixiaKzJ1xUy1XHsjN/0G5gg5LXS2789lG5a2e+stvibVHXYsjJNMbsXotql6H3jmSv95RAxI6WlEn5QZDQqu9W6viFgwxXGuPn6pW1Lgb3Kkz7W6JGamDAISrTMn07+R+SY07v2S7529JbJ5M93RyeZWu3SRysnWjF6reuuz0FSOtybQsKmmliMTlsqrm4r3Jdor8Q/V/bm+bikPCbSuTLJ/4ytwzDNOOGWkXaR6wnJzJq+ERJyqAhNijZI3841q9QiPEzyecMIJz3jygZZrNs74uBKf7f4+55zR5vTW26xi25zxolTt/zv/qWyP9T6Oh5uvpztP88FHuPYbjkrvZkdfA9mgpVV7vx0tImbCxR1sa+Hu4/0HAAD//wMAcqFRQAAAAwAA//UAAP/OADIAAAAAAAAAAAAAAAAAAAAAAAAAAA==");
 }]]></style><style type="text/css"><![CDATA[.shape {
   shape-rendering: geometricPrecision;
   stroke-linejoin: round;
@@ -35,104 +35,104 @@
   opacity: 0.5;
 }
 
-		.d2-1108726992 .fill-N1{fill:#0A0F25;}
-		.d2-1108726992 .fill-N2{fill:#676C7E;}
-		.d2-1108726992 .fill-N3{fill:#9499AB;}
-		.d2-1108726992 .fill-N4{fill:#CFD2DD;}
-		.d2-1108726992 .fill-N5{fill:#DEE1EB;}
-		.d2-1108726992 .fill-N6{fill:#EEF1F8;}
-		.d2-1108726992 .fill-N7{fill:#FFFFFF;}
-		.d2-1108726992 .fill-B1{fill:#000536;}
-		.d2-1108726992 .fill-B2{fill:#0F66B7;}
-		.d2-1108726992 .fill-B3{fill:#4393DD;}
-		.d2-1108726992 .fill-B4{fill:#87BFF3;}
-		.d2-1108726992 .fill-B5{fill:#BCDDFB;}
-		.d2-1108726992 .fill-B6{fill:#E5F3FF;}
-		.d2-1108726992 .fill-AA2{fill:#7639C5;}
-		.d2-1108726992 .fill-AA4{fill:#C1A2F3;}
-		.d2-1108726992 .fill-AA5{fill:#DACEFB;}
-		.d2-1108726992 .fill-AB4{fill:#EA99C6;}
-		.d2-1108726992 .fill-AB5{fill:#FFDEF1;}
-		.d2-1108726992 .stroke-N1{stroke:#0A0F25;}
-		.d2-1108726992 .stroke-N2{stroke:#676C7E;}
-		.d2-1108726992 .stroke-N3{stroke:#9499AB;}
-		.d2-1108726992 .stroke-N4{stroke:#CFD2DD;}
-		.d2-1108726992 .stroke-N5{stroke:#DEE1EB;}
-		.d2-1108726992 .stroke-N6{stroke:#EEF1F8;}
-		.d2-1108726992 .stroke-N7{stroke:#FFFFFF;}
-		.d2-1108726992 .stroke-B1{stroke:#000536;}
-		.d2-1108726992 .stroke-B2{stroke:#0F66B7;}
-		.d2-1108726992 .stroke-B3{stroke:#4393DD;}
-		.d2-1108726992 .stroke-B4{stroke:#87BFF3;}
-		.d2-1108726992 .stroke-B5{stroke:#BCDDFB;}
-		.d2-1108726992 .stroke-B6{stroke:#E5F3FF;}
-		.d2-1108726992 .stroke-AA2{stroke:#7639C5;}
-		.d2-1108726992 .stroke-AA4{stroke:#C1A2F3;}
-		.d2-1108726992 .stroke-AA5{stroke:#DACEFB;}
-		.d2-1108726992 .stroke-AB4{stroke:#EA99C6;}
-		.d2-1108726992 .stroke-AB5{stroke:#FFDEF1;}
-		.d2-1108726992 .background-color-N1{background-color:#0A0F25;}
-		.d2-1108726992 .background-color-N2{background-color:#676C7E;}
-		.d2-1108726992 .background-color-N3{background-color:#9499AB;}
-		.d2-1108726992 .background-color-N4{background-color:#CFD2DD;}
-		.d2-1108726992 .background-color-N5{background-color:#DEE1EB;}
-		.d2-1108726992 .background-color-N6{background-color:#EEF1F8;}
-		.d2-1108726992 .background-color-N7{background-color:#FFFFFF;}
-		.d2-1108726992 .background-color-B1{background-color:#000536;}
-		.d2-1108726992 .background-color-B2{background-color:#0F66B7;}
-		.d2-1108726992 .background-color-B3{background-color:#4393DD;}
-		.d2-1108726992 .background-color-B4{background-color:#87BFF3;}
-		.d2-1108726992 .background-color-B5{background-color:#BCDDFB;}
-		.d2-1108726992 .background-color-B6{background-color:#E5F3FF;}
-		.d2-1108726992 .background-color-AA2{background-color:#7639C5;}
-		.d2-1108726992 .background-color-AA4{background-color:#C1A2F3;}
-		.d2-1108726992 .background-color-AA5{background-color:#DACEFB;}
-		.d2-1108726992 .background-color-AB4{background-color:#EA99C6;}
-		.d2-1108726992 .background-color-AB5{background-color:#FFDEF1;}
-		.d2-1108726992 .color-N1{color:#0A0F25;}
-		.d2-1108726992 .color-N2{color:#676C7E;}
-		.d2-1108726992 .color-N3{color:#9499AB;}
-		.d2-1108726992 .color-N4{color:#CFD2DD;}
-		.d2-1108726992 .color-N5{color:#DEE1EB;}
-		.d2-1108726992 .color-N6{color:#EEF1F8;}
-		.d2-1108726992 .color-N7{color:#FFFFFF;}
-		.d2-1108726992 .color-B1{color:#000536;}
-		.d2-1108726992 .color-B2{color:#0F66B7;}
-		.d2-1108726992 .color-B3{color:#4393DD;}
-		.d2-1108726992 .color-B4{color:#87BFF3;}
-		.d2-1108726992 .color-B5{color:#BCDDFB;}
-		.d2-1108726992 .color-B6{color:#E5F3FF;}
-		.d2-1108726992 .color-AA2{color:#7639C5;}
-		.d2-1108726992 .color-AA4{color:#C1A2F3;}
-		.d2-1108726992 .color-AA5{color:#DACEFB;}
-		.d2-1108726992 .color-AB4{color:#EA99C6;}
-		.d2-1108726992 .color-AB5{color:#FFDEF1;}.appendix text.text{fill:#0A0F25}.md{--color-fg-default:#0A0F25;--color-fg-muted:#676C7E;--color-fg-subtle:#9499AB;--color-canvas-default:#FFFFFF;--color-canvas-subtle:#EEF1F8;--color-border-default:#000536;--color-border-muted:#0F66B7;--color-neutral-muted:#EEF1F8;--color-accent-fg:#0F66B7;--color-accent-emphasis:#0F66B7;--color-attention-subtle:#676C7E;--color-danger-fg:red;}.sketch-overlay-B1{fill:url(#streaks-darker-d2-1108726992);mix-blend-mode:lighten}.sketch-overlay-B2{fill:url(#streaks-dark-d2-1108726992);mix-blend-mode:overlay}.sketch-overlay-B3{fill:url(#streaks-dark-d2-1108726992);mix-blend-mode:overlay}.sketch-overlay-B4{fill:url(#streaks-normal-d2-1108726992);mix-blend-mode:color-burn}.sketch-overlay-B5{fill:url(#streaks-normal-d2-1108726992);mix-blend-mode:color-burn}.sketch-overlay-B6{fill:url(#streaks-bright-d2-1108726992);mix-blend-mode:darken}.sketch-overlay-AA2{fill:url(#streaks-dark-d2-1108726992);mix-blend-mode:overlay}.sketch-overlay-AA4{fill:url(#streaks-normal-d2-1108726992);mix-blend-mode:color-burn}.sketch-overlay-AA5{fill:url(#streaks-normal-d2-1108726992);mix-blend-mode:color-burn}.sketch-overlay-AB4{fill:url(#streaks-normal-d2-1108726992);mix-blend-mode:color-burn}.sketch-overlay-AB5{fill:url(#streaks-bright-d2-1108726992);mix-blend-mode:darken}.sketch-overlay-N1{fill:url(#streaks-darker-d2-1108726992);mix-blend-mode:lighten}.sketch-overlay-N2{fill:url(#streaks-dark-d2-1108726992);mix-blend-mode:overlay}.sketch-overlay-N3{fill:url(#streaks-normal-d2-1108726992);mix-blend-mode:color-burn}.sketch-overlay-N4{fill:url(#streaks-normal-d2-1108726992);mix-blend-mode:color-burn}.sketch-overlay-N5{fill:url(#streaks-bright-d2-1108726992);mix-blend-mode:darken}.sketch-overlay-N6{fill:url(#streaks-bright-d2-1108726992);mix-blend-mode:darken}.sketch-overlay-N7{fill:url(#streaks-bright-d2-1108726992);mix-blend-mode:darken}.light-code{display: block}.dark-code{display: none}]]></style><g class="aW5nZXN0"><g class="shape" ><rect x="370.000000" y="12.000000" width="253.000000" height="82.000000" stroke="#0F66B7" fill="#E5F3FF" class=" stroke-B2 fill-B6" style="stroke-width:2;stroke-dasharray:6.000000,5.919384;" /></g><text x="496.500000" y="50.500000" fill="#0A0F25" class="text-bold fill-N1" style="text-anchor:middle;font-size:16px"><tspan x="496.500000" dy="0.000000">Authenticated OTLP requests</tspan><tspan x="496.500000" dy="18.500000">spans, logs, metrics</tspan></text></g><g class="d3JpdGVycw=="><g class="shape" ><rect x="255.000000" y="169.000000" width="483.000000" height="638.000000" stroke="#000536" fill="transparent" class=" stroke-B1" style="stroke-width:2;" /></g><text x="496.500000" y="202.000000" fill="#0A0F25" class="text fill-N1" style="text-anchor:middle;font-size:28px">Durable write path</text></g><g class="YXV0aG9yaXR5"><g class="shape" ><path d="M 175 997 C 175 973 464 973 497 973 C 529 973 818 973 818 997 V 1187 C 818 1211 529 1211 497 1211 C 464 1211 175 1211 175 1187 V 997 Z" stroke="#000536" fill="#C1A2F3" class=" stroke-B1 fill-AA4" style="stroke-width:2;" /><path d="M 175 997 C 175 1021 464 1021 497 1021 C 529 1021 818 1021 818 997" stroke="#000536" fill="#C1A2F3" class=" stroke-B1 fill-AA4" style="stroke-width:2;" /></g><text x="496.500000" y="1054.000000" fill="#0A0F25" class="text fill-N1" style="text-anchor:middle;font-size:28px"><tspan x="496.500000" dy="0.000000">Authoritative telemetry</tspan><tspan x="496.500000" dy="32.000000">immutable *.batch directories</tspan></text><title>Ordinary Parquet files are authoritative</title></g><g class="cmVhZGVycw=="><g class="shape" ><rect x="12.000000" y="1345.000000" width="659.000000" height="334.000000" stroke="#000536" fill="transparent" class=" stroke-B1" style="stroke-width:2;" /></g><text x="341.500000" y="1378.000000" fill="#0A0F25" class="text fill-N1" style="text-anchor:middle;font-size:28px">Readers</text></g><g class="bWFpbnRlbmFuY2U="><g class="shape" ><rect x="691.000000" y="1296.000000" width="393.000000" height="486.000000" stroke="#000536" fill="transparent" class=" stroke-B1" style="stroke-width:2;" /></g><text x="887.500000" y="1329.000000" fill="#0A0F25" class="text fill-N1" style="text-anchor:middle;font-size:28px">Bounded maintenance</text></g><g class="cXVlcnlzdGF0ZQ=="><g class="shape" ><path d="M 389 1876 C 389 1852 485 1852 496 1852 C 507 1852 603 1852 603 1876 V 1962 C 603 1986 507 1986 496 1986 C 485 1986 389 1986 389 1962 V 1876 Z" stroke="#000536" fill="#C1A2F3" class=" stroke-B1 fill-AA4" style="stroke-width:2;" /><path d="M 389 1876 C 389 1900 485 1900 496 1900 C 507 1900 603 1900 603 1876" stroke="#000536" fill="#C1A2F3" class=" stroke-B1 fill-AA4" style="stroke-width:2;" /></g><text x="496.000000" y="1928.500000" fill="#0A0F25" class="text-bold fill-N1" style="text-anchor:middle;font-size:16px"><tspan x="496.000000" dy="0.000000">Rebuildable query state</tspan><tspan x="496.000000" dy="18.500000">storage.data_dir/query</tspan></text><title>DuckDB rollups and temporary spill. Not authoritative telemetry.</title></g><g class="d3JpdGVycy5hZG1pc3Npb24="><g class="shape" ><rect x="338.000000" y="219.000000" width="316.000000" height="82.000000" stroke="#000536" fill="#BCDDFB" class=" stroke-B1 fill-B5" style="stroke-width:2;" /></g><text x="496.000000" y="257.500000" fill="#0A0F25" class="text-bold fill-N1" style="text-anchor:middle;font-size:16px"><tspan x="496.000000" dy="0.000000">Bounded group admission</tspan><tspan x="496.000000" dy="18.500000">configured row target + 20 ms window</tspan></text></g><g class="d3JpdGVycy53b3JrZXJz"><g class="shape" ><rect x="334.000000" y="371.000000" width="324.000000" height="82.000000" stroke="#000536" fill="#BCDDFB" class=" stroke-B1 fill-B5" style="stroke-width:2;" /></g><text x="496.000000" y="409.500000" fill="#0A0F25" class="text-bold fill-N1" style="text-anchor:middle;font-size:16px"><tspan x="496.000000" dy="0.000000">Up to four commit workers</tspan><tspan x="496.000000" dy="18.500000">independent batches encode in parallel</tspan></text></g><g class="d3JpdGVycy5zdGFnZQ=="><g class="shape" ><rect x="305.000000" y="523.000000" width="383.000000" height="82.000000" stroke="#000536" fill="#BCDDFB" class=" stroke-B1 fill-B5" style="stroke-width:2;" /></g><text x="496.500000" y="561.500000" fill="#0A0F25" class="text-bold fill-N1" style="text-anchor:middle;font-size:16px"><tspan x="496.500000" dy="0.000000">Staging batch directory</tspan><tspan x="496.500000" dy="18.500000">metadata + signal Parquet + trace.fidx for spans</tspan></text></g><g class="d3JpdGVycy5wdWJsaXNo"><g class="shape" ><rect x="340.000000" y="675.000000" width="313.000000" height="82.000000" stroke="#000536" fill="#BCDDFB" class=" stroke-B1 fill-B5" style="stroke-width:2;" /></g><text x="496.500000" y="713.500000" fill="#0A0F25" class="text-bold fill-N1" style="text-anchor:middle;font-size:16px"><tspan x="496.500000" dy="0.000000">Durable publication</tspan><tspan x="496.500000" dy="18.500000">fsync → atomic rename → fsync parent</tspan></text></g><g class="YXV0aG9yaXR5LnB1Ymxpc2hlZCBiYXRjaCBkaXJlY3RvcmllcyBhcmUgZGlzY292ZXJlZCBkaXJlY3RseSBmcm9tIHRoZSBmaWxlc3lzdGVt"><g class="shape" ><rect x="225.000000" y="1095.000000" width="543.000000" height="66.000000" stroke="#000536" fill="#BCDDFB" class=" stroke-B1 fill-B5" style="stroke-width:2;" /></g><text x="496.500000" y="1133.500000" fill="#0A0F25" class="text-bold fill-N1" style="text-anchor:middle;font-size:16px">published batch directories are discovered directly from the filesystem</text></g><g class="cmVhZGVycy50cmFjZQ=="><g class="shape" ><rect x="62.000000" y="1395.000000" width="290.000000" height="82.000000" stroke="#000536" fill="#BCDDFB" class=" stroke-B1 fill-B5" style="stroke-width:2;" /></g><text x="207.000000" y="1433.500000" fill="#0A0F25" class="text-bold fill-N1" style="text-anchor:middle;font-size:16px"><tspan x="207.000000" dy="0.000000">Indexed trace read</tspan><tspan x="207.000000" dy="18.500000">binary-search .fidx → Parquet rows</tspan></text></g><g class="cmVhZGVycy5zcWw="><g class="shape" ><rect x="372.000000" y="1395.000000" width="249.000000" height="82.000000" stroke="#000536" fill="#BCDDFB" class=" stroke-B1 fill-B5" style="stroke-width:2;" /></g><text x="496.500000" y="1433.500000" fill="#0A0F25" class="text-bold fill-N1" style="text-anchor:middle;font-size:16px"><tspan x="496.500000" dy="0.000000">DuckDB SQL</tspan><tspan x="496.500000" dy="18.500000">filters, ordering, broad scans</tspan></text></g><g class="cmVhZGVycy5yb2xsdXBz"><g class="shape" ><rect x="375.000000" y="1547.000000" width="243.000000" height="82.000000" stroke="#000536" fill="#BCDDFB" class=" stroke-B1 fill-B5" style="stroke-width:2;" /></g><text x="496.500000" y="1585.500000" fill="#0A0F25" class="text-bold fill-N1" style="text-anchor:middle;font-size:16px"><tspan x="496.500000" dy="0.000000">DuckDB rollups</tspan><tspan x="496.500000" dy="18.500000">rebuildable analytical cache</tspan></text></g><g class="bWFpbnRlbmFuY2UuY2hvb3Nl"><g class="shape" ><rect x="743.000000" y="1346.000000" width="289.000000" height="82.000000" stroke="#000536" fill="#BCDDFB" class=" stroke-B1 fill-B5" style="stroke-width:2;" /></g><text x="887.500000" y="1384.500000" fill="#0A0F25" class="text-bold fill-N1" style="text-anchor:middle;font-size:16px"><tspan x="887.500000" dy="0.000000">Retention + compaction admission</tspan><tspan x="887.500000" dy="18.500000">bounded batch and row groups</tspan></text></g><g class="bWFpbnRlbmFuY2UubWVyZ2U="><g class="shape" ><rect x="749.000000" y="1498.000000" width="277.000000" height="82.000000" stroke="#000536" fill="#BCDDFB" class=" stroke-B1 fill-B5" style="stroke-width:2;" /></g><text x="887.500000" y="1536.500000" fill="#0A0F25" class="text-bold fill-N1" style="text-anchor:middle;font-size:16px"><tspan x="887.500000" dy="0.000000">Native Parquet merge</tspan><tspan x="887.500000" dy="18.500000">prepared outside the reader gate</tspan></text></g><g class="bWFpbnRlbmFuY2Uuc3dhcA=="><g class="shape" ><rect x="741.000000" y="1650.000000" width="293.000000" height="82.000000" stroke="#000536" fill="#BCDDFB" class=" stroke-B1 fill-B5" style="stroke-width:2;" /></g><text x="887.500000" y="1688.500000" fill="#0A0F25" class="text-bold fill-N1" style="text-anchor:middle;font-size:16px"><tspan x="887.500000" dy="0.000000">Crash-safe namespace swap</tspan><tspan x="887.500000" dy="18.500000">marker + bounded renames + fsync</tspan></text></g><g class="d3JpdGVycy4oYWRtaXNzaW9uIC0mZ3Q7IHdvcmtlcnMpWzBd"><marker id="mk-d2-1108726992-3488378134" markerWidth="10.000000" markerHeight="12.000000" refX="7.000000" refY="6.000000" viewBox="0.000000 0.000000 10.000000 12.000000" orient="auto" markerUnits="userSpaceOnUse"> <polygon points="0.000000,0.000000 10.000000,6.000000 0.000000,12.000000" fill="#000536" class="connection fill-B1" stroke-width="2" /> </marker><path d="M 496.500000 303.000000 L 496.500000 367.000000" stroke="#000536" fill="none" class="connection stroke-B1" style="stroke-width:2;" marker-end="url(#mk-d2-1108726992-3488378134)" mask="url(#d2-1108726992)" /></g><g class="d3JpdGVycy4od29ya2VycyAtJmd0OyBzdGFnZSlbMF0="><path d="M 496.500000 455.000000 L 496.500000 519.000000" stroke="#000536" fill="none" class="connection stroke-B1" style="stroke-width:2;" marker-end="url(#mk-d2-1108726992-3488378134)" mask="url(#d2-1108726992)" /></g><g class="d3JpdGVycy4oc3RhZ2UgLSZndDsgcHVibGlzaClbMF0="><path d="M 496.500000 607.000000 L 496.500000 671.000000" stroke="#000536" fill="none" class="connection stroke-B1" style="stroke-width:2;" marker-end="url(#mk-d2-1108726992-3488378134)" mask="url(#d2-1108726992)" /></g><g class="bWFpbnRlbmFuY2UuKGNob29zZSAtJmd0OyBtZXJnZSlbMF0="><path d="M 887.500000 1430.000000 L 887.500000 1494.000000" stroke="#000536" fill="none" class="connection stroke-B1" style="stroke-width:2;" marker-end="url(#mk-d2-1108726992-3488378134)" mask="url(#d2-1108726992)" /></g><g class="bWFpbnRlbmFuY2UuKG1lcmdlIC0mZ3Q7IHN3YXApWzBd"><path d="M 887.500000 1582.000000 L 887.500000 1646.000000" stroke="#000536" fill="none" class="connection stroke-B1" style="stroke-width:2;" marker-end="url(#mk-d2-1108726992-3488378134)" mask="url(#d2-1108726992)" /></g><g class="KGluZ2VzdCAtJmd0OyB3cml0ZXJzLmFkbWlzc2lvbilbMF0="><path d="M 496.500000 96.000000 L 496.500000 215.000000" stroke="#000536" fill="none" class="connection stroke-B1" style="stroke-width:2;" marker-end="url(#mk-d2-1108726992-3488378134)" mask="url(#d2-1108726992)" /></g><g class="KHdyaXRlcnMucHVibGlzaCAtJmd0OyBhdXRob3JpdHkpWzBd"><path d="M 496.504630 758.999995 L 496.990741 969.000011" stroke="#000536" fill="none" class="connection stroke-B1" style="stroke-width:2;" marker-end="url(#mk-d2-1108726992-3488378134)" mask="url(#d2-1108726992)" /><text x="496.500000" y="871.000000" fill="#676C7E" class="text-italic fill-N2" style="text-anchor:middle;font-size:16px">acknowledge only after publication</text></g><g class="KGF1dGhvcml0eSAtJmd0OyByZWFkZXJzLnRyYWNlKVswXQ=="><path d="M 335.988372 1209.999966 L 335.808139 1241.000169 S 335.750000 1251.000000 325.750000 1251.000000 L 217.000000 1251.000000 S 207.000000 1251.000000 207.000000 1261.000000 L 207.000000 1391.000000" stroke="#000536" fill="none" class="connection stroke-B1" style="stroke-width:2;" marker-end="url(#mk-d2-1108726992-3488378134)" mask="url(#d2-1108726992)" /></g><g class="KGF1dGhvcml0eSAtJmd0OyByZWFkZXJzLnNxbClbMF0="><path d="M 496.989131 1212.999970 L 496.021739 1391.000059" stroke="#000536" fill="none" class="connection stroke-B1" style="stroke-width:2;" marker-end="url(#mk-d2-1108726992-3488378134)" mask="url(#d2-1108726992)" /></g><g class="cmVhZGVycy4oc3FsIC0mZ3Q7IHJvbGx1cHMpWzBd"><path d="M 496.500000 1479.000000 L 496.500000 1543.000000" stroke="#000536" fill="none" class="connection stroke-B1" style="stroke-width:2;" marker-end="url(#mk-d2-1108726992-3488378134)" mask="url(#d2-1108726992)" /></g><g class="KHJlYWRlcnMucm9sbHVwcyAtJmd0OyBxdWVyeXN0YXRlKVswXQ=="><path d="M 496.504484 1630.999995 L 496.991031 1848.000010" stroke="#000536" fill="none" class="connection stroke-B1" style="stroke-width:2;" marker-end="url(#mk-d2-1108726992-3488378134)" mask="url(#d2-1108726992)" /></g><g class="KGF1dGhvcml0eSAtJmd0OyBtYWludGVuYW5jZS5jaG9vc2UpWzBd"><path d="M 657.011628 1209.999966 L 657.191861 1241.000169 S 657.250000 1251.000000 667.250000 1251.000000 L 877.500000 1251.000000 S 887.500000 1251.000000 887.500000 1261.000000 L 887.500000 1342.000000" stroke="#000536" fill="none" class="connection stroke-B1" style="stroke-width:2;" marker-end="url(#mk-d2-1108726992-3488378134)" mask="url(#d2-1108726992)" /></g><g transform="translate(770 969)" class="appendix-icon"><title>Ordinary Parquet files are authoritative</title><svg width="32" height="32" viewBox="0 0 32 32" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_3427_35082111-d2-1108726992-MF2XI2DPOJUXI6I)">
+		.d2-2701310579 .fill-N1{fill:#0A0F25;}
+		.d2-2701310579 .fill-N2{fill:#676C7E;}
+		.d2-2701310579 .fill-N3{fill:#9499AB;}
+		.d2-2701310579 .fill-N4{fill:#CFD2DD;}
+		.d2-2701310579 .fill-N5{fill:#DEE1EB;}
+		.d2-2701310579 .fill-N6{fill:#EEF1F8;}
+		.d2-2701310579 .fill-N7{fill:#FFFFFF;}
+		.d2-2701310579 .fill-B1{fill:#000536;}
+		.d2-2701310579 .fill-B2{fill:#0F66B7;}
+		.d2-2701310579 .fill-B3{fill:#4393DD;}
+		.d2-2701310579 .fill-B4{fill:#87BFF3;}
+		.d2-2701310579 .fill-B5{fill:#BCDDFB;}
+		.d2-2701310579 .fill-B6{fill:#E5F3FF;}
+		.d2-2701310579 .fill-AA2{fill:#7639C5;}
+		.d2-2701310579 .fill-AA4{fill:#C1A2F3;}
+		.d2-2701310579 .fill-AA5{fill:#DACEFB;}
+		.d2-2701310579 .fill-AB4{fill:#EA99C6;}
+		.d2-2701310579 .fill-AB5{fill:#FFDEF1;}
+		.d2-2701310579 .stroke-N1{stroke:#0A0F25;}
+		.d2-2701310579 .stroke-N2{stroke:#676C7E;}
+		.d2-2701310579 .stroke-N3{stroke:#9499AB;}
+		.d2-2701310579 .stroke-N4{stroke:#CFD2DD;}
+		.d2-2701310579 .stroke-N5{stroke:#DEE1EB;}
+		.d2-2701310579 .stroke-N6{stroke:#EEF1F8;}
+		.d2-2701310579 .stroke-N7{stroke:#FFFFFF;}
+		.d2-2701310579 .stroke-B1{stroke:#000536;}
+		.d2-2701310579 .stroke-B2{stroke:#0F66B7;}
+		.d2-2701310579 .stroke-B3{stroke:#4393DD;}
+		.d2-2701310579 .stroke-B4{stroke:#87BFF3;}
+		.d2-2701310579 .stroke-B5{stroke:#BCDDFB;}
+		.d2-2701310579 .stroke-B6{stroke:#E5F3FF;}
+		.d2-2701310579 .stroke-AA2{stroke:#7639C5;}
+		.d2-2701310579 .stroke-AA4{stroke:#C1A2F3;}
+		.d2-2701310579 .stroke-AA5{stroke:#DACEFB;}
+		.d2-2701310579 .stroke-AB4{stroke:#EA99C6;}
+		.d2-2701310579 .stroke-AB5{stroke:#FFDEF1;}
+		.d2-2701310579 .background-color-N1{background-color:#0A0F25;}
+		.d2-2701310579 .background-color-N2{background-color:#676C7E;}
+		.d2-2701310579 .background-color-N3{background-color:#9499AB;}
+		.d2-2701310579 .background-color-N4{background-color:#CFD2DD;}
+		.d2-2701310579 .background-color-N5{background-color:#DEE1EB;}
+		.d2-2701310579 .background-color-N6{background-color:#EEF1F8;}
+		.d2-2701310579 .background-color-N7{background-color:#FFFFFF;}
+		.d2-2701310579 .background-color-B1{background-color:#000536;}
+		.d2-2701310579 .background-color-B2{background-color:#0F66B7;}
+		.d2-2701310579 .background-color-B3{background-color:#4393DD;}
+		.d2-2701310579 .background-color-B4{background-color:#87BFF3;}
+		.d2-2701310579 .background-color-B5{background-color:#BCDDFB;}
+		.d2-2701310579 .background-color-B6{background-color:#E5F3FF;}
+		.d2-2701310579 .background-color-AA2{background-color:#7639C5;}
+		.d2-2701310579 .background-color-AA4{background-color:#C1A2F3;}
+		.d2-2701310579 .background-color-AA5{background-color:#DACEFB;}
+		.d2-2701310579 .background-color-AB4{background-color:#EA99C6;}
+		.d2-2701310579 .background-color-AB5{background-color:#FFDEF1;}
+		.d2-2701310579 .color-N1{color:#0A0F25;}
+		.d2-2701310579 .color-N2{color:#676C7E;}
+		.d2-2701310579 .color-N3{color:#9499AB;}
+		.d2-2701310579 .color-N4{color:#CFD2DD;}
+		.d2-2701310579 .color-N5{color:#DEE1EB;}
+		.d2-2701310579 .color-N6{color:#EEF1F8;}
+		.d2-2701310579 .color-N7{color:#FFFFFF;}
+		.d2-2701310579 .color-B1{color:#000536;}
+		.d2-2701310579 .color-B2{color:#0F66B7;}
+		.d2-2701310579 .color-B3{color:#4393DD;}
+		.d2-2701310579 .color-B4{color:#87BFF3;}
+		.d2-2701310579 .color-B5{color:#BCDDFB;}
+		.d2-2701310579 .color-B6{color:#E5F3FF;}
+		.d2-2701310579 .color-AA2{color:#7639C5;}
+		.d2-2701310579 .color-AA4{color:#C1A2F3;}
+		.d2-2701310579 .color-AA5{color:#DACEFB;}
+		.d2-2701310579 .color-AB4{color:#EA99C6;}
+		.d2-2701310579 .color-AB5{color:#FFDEF1;}.appendix text.text{fill:#0A0F25}.md{--color-fg-default:#0A0F25;--color-fg-muted:#676C7E;--color-fg-subtle:#9499AB;--color-canvas-default:#FFFFFF;--color-canvas-subtle:#EEF1F8;--color-border-default:#000536;--color-border-muted:#0F66B7;--color-neutral-muted:#EEF1F8;--color-accent-fg:#0F66B7;--color-accent-emphasis:#0F66B7;--color-attention-subtle:#676C7E;--color-danger-fg:red;}.sketch-overlay-B1{fill:url(#streaks-darker-d2-2701310579);mix-blend-mode:lighten}.sketch-overlay-B2{fill:url(#streaks-dark-d2-2701310579);mix-blend-mode:overlay}.sketch-overlay-B3{fill:url(#streaks-dark-d2-2701310579);mix-blend-mode:overlay}.sketch-overlay-B4{fill:url(#streaks-normal-d2-2701310579);mix-blend-mode:color-burn}.sketch-overlay-B5{fill:url(#streaks-normal-d2-2701310579);mix-blend-mode:color-burn}.sketch-overlay-B6{fill:url(#streaks-bright-d2-2701310579);mix-blend-mode:darken}.sketch-overlay-AA2{fill:url(#streaks-dark-d2-2701310579);mix-blend-mode:overlay}.sketch-overlay-AA4{fill:url(#streaks-normal-d2-2701310579);mix-blend-mode:color-burn}.sketch-overlay-AA5{fill:url(#streaks-normal-d2-2701310579);mix-blend-mode:color-burn}.sketch-overlay-AB4{fill:url(#streaks-normal-d2-2701310579);mix-blend-mode:color-burn}.sketch-overlay-AB5{fill:url(#streaks-bright-d2-2701310579);mix-blend-mode:darken}.sketch-overlay-N1{fill:url(#streaks-darker-d2-2701310579);mix-blend-mode:lighten}.sketch-overlay-N2{fill:url(#streaks-dark-d2-2701310579);mix-blend-mode:overlay}.sketch-overlay-N3{fill:url(#streaks-normal-d2-2701310579);mix-blend-mode:color-burn}.sketch-overlay-N4{fill:url(#streaks-normal-d2-2701310579);mix-blend-mode:color-burn}.sketch-overlay-N5{fill:url(#streaks-bright-d2-2701310579);mix-blend-mode:darken}.sketch-overlay-N6{fill:url(#streaks-bright-d2-2701310579);mix-blend-mode:darken}.sketch-overlay-N7{fill:url(#streaks-bright-d2-2701310579);mix-blend-mode:darken}.light-code{display: block}.dark-code{display: none}]]></style><g class="aW5nZXN0"><g class="shape" ><rect x="370.000000" y="12.000000" width="253.000000" height="82.000000" stroke="#0F66B7" fill="#E5F3FF" class=" stroke-B2 fill-B6" style="stroke-width:2;stroke-dasharray:6.000000,5.919384;" /></g><text x="496.500000" y="50.500000" fill="#0A0F25" class="text-bold fill-N1" style="text-anchor:middle;font-size:16px"><tspan x="496.500000" dy="0.000000">Authenticated OTLP requests</tspan><tspan x="496.500000" dy="18.500000">spans, logs, metrics</tspan></text></g><g class="d3JpdGVycw=="><g class="shape" ><rect x="255.000000" y="169.000000" width="483.000000" height="638.000000" stroke="#000536" fill="transparent" class=" stroke-B1" style="stroke-width:2;" /></g><text x="496.500000" y="202.000000" fill="#0A0F25" class="text fill-N1" style="text-anchor:middle;font-size:28px">Durable write path</text></g><g class="YXV0aG9yaXR5"><g class="shape" ><path d="M 175 997 C 175 973 464 973 497 973 C 529 973 818 973 818 997 V 1187 C 818 1211 529 1211 497 1211 C 464 1211 175 1211 175 1187 V 997 Z" stroke="#000536" fill="#C1A2F3" class=" stroke-B1 fill-AA4" style="stroke-width:2;" /><path d="M 175 997 C 175 1021 464 1021 497 1021 C 529 1021 818 1021 818 997" stroke="#000536" fill="#C1A2F3" class=" stroke-B1 fill-AA4" style="stroke-width:2;" /></g><text x="496.500000" y="1054.000000" fill="#0A0F25" class="text fill-N1" style="text-anchor:middle;font-size:28px"><tspan x="496.500000" dy="0.000000">Authoritative telemetry</tspan><tspan x="496.500000" dy="32.000000">immutable *.batch directories</tspan></text><title>Ordinary Parquet files are authoritative</title></g><g class="cmVhZGVycw=="><g class="shape" ><rect x="12.000000" y="1345.000000" width="659.000000" height="334.000000" stroke="#000536" fill="transparent" class=" stroke-B1" style="stroke-width:2;" /></g><text x="341.500000" y="1378.000000" fill="#0A0F25" class="text fill-N1" style="text-anchor:middle;font-size:28px">Readers</text></g><g class="bWFpbnRlbmFuY2U="><g class="shape" ><rect x="691.000000" y="1296.000000" width="393.000000" height="486.000000" stroke="#000536" fill="transparent" class=" stroke-B1" style="stroke-width:2;" /></g><text x="887.500000" y="1329.000000" fill="#0A0F25" class="text fill-N1" style="text-anchor:middle;font-size:28px">Bounded maintenance</text></g><g class="cXVlcnlzdGF0ZQ=="><g class="shape" ><path d="M 382 1876 C 382 1852 485 1852 497 1852 C 508 1852 611 1852 611 1876 V 1962 C 611 1986 508 1986 497 1986 C 485 1986 382 1986 382 1962 V 1876 Z" stroke="#000536" fill="#C1A2F3" class=" stroke-B1 fill-AA4" style="stroke-width:2;" /><path d="M 382 1876 C 382 1900 485 1900 497 1900 C 508 1900 611 1900 611 1876" stroke="#000536" fill="#C1A2F3" class=" stroke-B1 fill-AA4" style="stroke-width:2;" /></g><text x="496.500000" y="1928.500000" fill="#0A0F25" class="text-bold fill-N1" style="text-anchor:middle;font-size:16px"><tspan x="496.500000" dy="0.000000">Rebuildable query state</tspan><tspan x="496.500000" dy="18.500000">FANOUT_DATA_DIR/query</tspan></text><title>DuckDB rollups and temporary spill. Not authoritative telemetry.</title></g><g class="d3JpdGVycy5hZG1pc3Npb24="><g class="shape" ><rect x="338.000000" y="219.000000" width="316.000000" height="82.000000" stroke="#000536" fill="#BCDDFB" class=" stroke-B1 fill-B5" style="stroke-width:2;" /></g><text x="496.000000" y="257.500000" fill="#0A0F25" class="text-bold fill-N1" style="text-anchor:middle;font-size:16px"><tspan x="496.000000" dy="0.000000">Bounded group admission</tspan><tspan x="496.000000" dy="18.500000">configured row target + 20 ms window</tspan></text></g><g class="d3JpdGVycy53b3JrZXJz"><g class="shape" ><rect x="334.000000" y="371.000000" width="324.000000" height="82.000000" stroke="#000536" fill="#BCDDFB" class=" stroke-B1 fill-B5" style="stroke-width:2;" /></g><text x="496.000000" y="409.500000" fill="#0A0F25" class="text-bold fill-N1" style="text-anchor:middle;font-size:16px"><tspan x="496.000000" dy="0.000000">Up to four commit workers</tspan><tspan x="496.000000" dy="18.500000">independent batches encode in parallel</tspan></text></g><g class="d3JpdGVycy5zdGFnZQ=="><g class="shape" ><rect x="305.000000" y="523.000000" width="383.000000" height="82.000000" stroke="#000536" fill="#BCDDFB" class=" stroke-B1 fill-B5" style="stroke-width:2;" /></g><text x="496.500000" y="561.500000" fill="#0A0F25" class="text-bold fill-N1" style="text-anchor:middle;font-size:16px"><tspan x="496.500000" dy="0.000000">Staging batch directory</tspan><tspan x="496.500000" dy="18.500000">metadata + signal Parquet + trace.fidx for spans</tspan></text></g><g class="d3JpdGVycy5wdWJsaXNo"><g class="shape" ><rect x="340.000000" y="675.000000" width="313.000000" height="82.000000" stroke="#000536" fill="#BCDDFB" class=" stroke-B1 fill-B5" style="stroke-width:2;" /></g><text x="496.500000" y="713.500000" fill="#0A0F25" class="text-bold fill-N1" style="text-anchor:middle;font-size:16px"><tspan x="496.500000" dy="0.000000">Durable publication</tspan><tspan x="496.500000" dy="18.500000">fsync → atomic rename → fsync parent</tspan></text></g><g class="YXV0aG9yaXR5LnB1Ymxpc2hlZCBiYXRjaCBkaXJlY3RvcmllcyBhcmUgZGlzY292ZXJlZCBkaXJlY3RseSBmcm9tIHRoZSBmaWxlc3lzdGVt"><g class="shape" ><rect x="225.000000" y="1095.000000" width="543.000000" height="66.000000" stroke="#000536" fill="#BCDDFB" class=" stroke-B1 fill-B5" style="stroke-width:2;" /></g><text x="496.500000" y="1133.500000" fill="#0A0F25" class="text-bold fill-N1" style="text-anchor:middle;font-size:16px">published batch directories are discovered directly from the filesystem</text></g><g class="cmVhZGVycy50cmFjZQ=="><g class="shape" ><rect x="62.000000" y="1395.000000" width="290.000000" height="82.000000" stroke="#000536" fill="#BCDDFB" class=" stroke-B1 fill-B5" style="stroke-width:2;" /></g><text x="207.000000" y="1433.500000" fill="#0A0F25" class="text-bold fill-N1" style="text-anchor:middle;font-size:16px"><tspan x="207.000000" dy="0.000000">Indexed trace read</tspan><tspan x="207.000000" dy="18.500000">binary-search .fidx → Parquet rows</tspan></text></g><g class="cmVhZGVycy5zcWw="><g class="shape" ><rect x="372.000000" y="1395.000000" width="249.000000" height="82.000000" stroke="#000536" fill="#BCDDFB" class=" stroke-B1 fill-B5" style="stroke-width:2;" /></g><text x="496.500000" y="1433.500000" fill="#0A0F25" class="text-bold fill-N1" style="text-anchor:middle;font-size:16px"><tspan x="496.500000" dy="0.000000">DuckDB SQL</tspan><tspan x="496.500000" dy="18.500000">filters, ordering, broad scans</tspan></text></g><g class="cmVhZGVycy5yb2xsdXBz"><g class="shape" ><rect x="375.000000" y="1547.000000" width="243.000000" height="82.000000" stroke="#000536" fill="#BCDDFB" class=" stroke-B1 fill-B5" style="stroke-width:2;" /></g><text x="496.500000" y="1585.500000" fill="#0A0F25" class="text-bold fill-N1" style="text-anchor:middle;font-size:16px"><tspan x="496.500000" dy="0.000000">DuckDB rollups</tspan><tspan x="496.500000" dy="18.500000">rebuildable analytical cache</tspan></text></g><g class="bWFpbnRlbmFuY2UuY2hvb3Nl"><g class="shape" ><rect x="743.000000" y="1346.000000" width="289.000000" height="82.000000" stroke="#000536" fill="#BCDDFB" class=" stroke-B1 fill-B5" style="stroke-width:2;" /></g><text x="887.500000" y="1384.500000" fill="#0A0F25" class="text-bold fill-N1" style="text-anchor:middle;font-size:16px"><tspan x="887.500000" dy="0.000000">Retention + compaction admission</tspan><tspan x="887.500000" dy="18.500000">bounded batch and row groups</tspan></text></g><g class="bWFpbnRlbmFuY2UubWVyZ2U="><g class="shape" ><rect x="749.000000" y="1498.000000" width="277.000000" height="82.000000" stroke="#000536" fill="#BCDDFB" class=" stroke-B1 fill-B5" style="stroke-width:2;" /></g><text x="887.500000" y="1536.500000" fill="#0A0F25" class="text-bold fill-N1" style="text-anchor:middle;font-size:16px"><tspan x="887.500000" dy="0.000000">Native Parquet merge</tspan><tspan x="887.500000" dy="18.500000">prepared outside the reader gate</tspan></text></g><g class="bWFpbnRlbmFuY2Uuc3dhcA=="><g class="shape" ><rect x="741.000000" y="1650.000000" width="293.000000" height="82.000000" stroke="#000536" fill="#BCDDFB" class=" stroke-B1 fill-B5" style="stroke-width:2;" /></g><text x="887.500000" y="1688.500000" fill="#0A0F25" class="text-bold fill-N1" style="text-anchor:middle;font-size:16px"><tspan x="887.500000" dy="0.000000">Crash-safe namespace swap</tspan><tspan x="887.500000" dy="18.500000">marker + bounded renames + fsync</tspan></text></g><g class="d3JpdGVycy4oYWRtaXNzaW9uIC0mZ3Q7IHdvcmtlcnMpWzBd"><marker id="mk-d2-2701310579-3488378134" markerWidth="10.000000" markerHeight="12.000000" refX="7.000000" refY="6.000000" viewBox="0.000000 0.000000 10.000000 12.000000" orient="auto" markerUnits="userSpaceOnUse"> <polygon points="0.000000,0.000000 10.000000,6.000000 0.000000,12.000000" fill="#000536" class="connection fill-B1" stroke-width="2" /> </marker><path d="M 496.500000 303.000000 L 496.500000 367.000000" stroke="#000536" fill="none" class="connection stroke-B1" style="stroke-width:2;" marker-end="url(#mk-d2-2701310579-3488378134)" mask="url(#d2-2701310579)" /></g><g class="d3JpdGVycy4od29ya2VycyAtJmd0OyBzdGFnZSlbMF0="><path d="M 496.500000 455.000000 L 496.500000 519.000000" stroke="#000536" fill="none" class="connection stroke-B1" style="stroke-width:2;" marker-end="url(#mk-d2-2701310579-3488378134)" mask="url(#d2-2701310579)" /></g><g class="d3JpdGVycy4oc3RhZ2UgLSZndDsgcHVibGlzaClbMF0="><path d="M 496.500000 607.000000 L 496.500000 671.000000" stroke="#000536" fill="none" class="connection stroke-B1" style="stroke-width:2;" marker-end="url(#mk-d2-2701310579-3488378134)" mask="url(#d2-2701310579)" /></g><g class="bWFpbnRlbmFuY2UuKGNob29zZSAtJmd0OyBtZXJnZSlbMF0="><path d="M 887.500000 1430.000000 L 887.500000 1494.000000" stroke="#000536" fill="none" class="connection stroke-B1" style="stroke-width:2;" marker-end="url(#mk-d2-2701310579-3488378134)" mask="url(#d2-2701310579)" /></g><g class="bWFpbnRlbmFuY2UuKG1lcmdlIC0mZ3Q7IHN3YXApWzBd"><path d="M 887.500000 1582.000000 L 887.500000 1646.000000" stroke="#000536" fill="none" class="connection stroke-B1" style="stroke-width:2;" marker-end="url(#mk-d2-2701310579-3488378134)" mask="url(#d2-2701310579)" /></g><g class="KGluZ2VzdCAtJmd0OyB3cml0ZXJzLmFkbWlzc2lvbilbMF0="><path d="M 496.500000 96.000000 L 496.500000 215.000000" stroke="#000536" fill="none" class="connection stroke-B1" style="stroke-width:2;" marker-end="url(#mk-d2-2701310579-3488378134)" mask="url(#d2-2701310579)" /></g><g class="KHdyaXRlcnMucHVibGlzaCAtJmd0OyBhdXRob3JpdHkpWzBd"><path d="M 496.504630 758.999995 L 496.990741 969.000011" stroke="#000536" fill="none" class="connection stroke-B1" style="stroke-width:2;" marker-end="url(#mk-d2-2701310579-3488378134)" mask="url(#d2-2701310579)" /><text x="496.500000" y="871.000000" fill="#676C7E" class="text-italic fill-N2" style="text-anchor:middle;font-size:16px">acknowledge only after publication</text></g><g class="KGF1dGhvcml0eSAtJmd0OyByZWFkZXJzLnRyYWNlKVswXQ=="><path d="M 335.988372 1209.999966 L 335.808139 1241.000169 S 335.750000 1251.000000 325.750000 1251.000000 L 217.000000 1251.000000 S 207.000000 1251.000000 207.000000 1261.000000 L 207.000000 1391.000000" stroke="#000536" fill="none" class="connection stroke-B1" style="stroke-width:2;" marker-end="url(#mk-d2-2701310579-3488378134)" mask="url(#d2-2701310579)" /></g><g class="KGF1dGhvcml0eSAtJmd0OyByZWFkZXJzLnNxbClbMF0="><path d="M 496.989131 1212.999970 L 496.021739 1391.000059" stroke="#000536" fill="none" class="connection stroke-B1" style="stroke-width:2;" marker-end="url(#mk-d2-2701310579-3488378134)" mask="url(#d2-2701310579)" /></g><g class="cmVhZGVycy4oc3FsIC0mZ3Q7IHJvbGx1cHMpWzBd"><path d="M 496.500000 1479.000000 L 496.500000 1543.000000" stroke="#000536" fill="none" class="connection stroke-B1" style="stroke-width:2;" marker-end="url(#mk-d2-2701310579-3488378134)" mask="url(#d2-2701310579)" /></g><g class="KHJlYWRlcnMucm9sbHVwcyAtJmd0OyBxdWVyeXN0YXRlKVswXQ=="><path d="M 496.504484 1630.999995 L 496.991031 1848.000010" stroke="#000536" fill="none" class="connection stroke-B1" style="stroke-width:2;" marker-end="url(#mk-d2-2701310579-3488378134)" mask="url(#d2-2701310579)" /></g><g class="KGF1dGhvcml0eSAtJmd0OyBtYWludGVuYW5jZS5jaG9vc2UpWzBd"><path d="M 657.011628 1209.999966 L 657.191861 1241.000169 S 657.250000 1251.000000 667.250000 1251.000000 L 877.500000 1251.000000 S 887.500000 1251.000000 887.500000 1261.000000 L 887.500000 1342.000000" stroke="#000536" fill="none" class="connection stroke-B1" style="stroke-width:2;" marker-end="url(#mk-d2-2701310579-3488378134)" mask="url(#d2-2701310579)" /></g><g transform="translate(770 969)" class="appendix-icon"><title>Ordinary Parquet files are authoritative</title><svg width="32" height="32" viewBox="0 0 32 32" fill="none" xmlns="http://www.w3.org/2000/svg">
+<g clip-path="url(#clip0_3427_35082111-d2-2701310579-MF2XI2DPOJUXI6I)">
 <path d="M16 31.1109C24.3456 31.1109 31.1111 24.3454 31.1111 15.9998C31.1111 7.65415 24.3456 0.888672 16 0.888672C7.65436 0.888672 0.888885 7.65415 0.888885 15.9998C0.888885 24.3454 7.65436 31.1109 16 31.1109Z" fill="white" stroke="#DEE1EB"/>
 <path d="M16 26C21.5228 26 26 21.5228 26 16C26 10.4772 21.5228 6 16 6C10.4772 6 6 10.4772 6 16C6 21.5228 10.4772 26 16 26Z" stroke="#2E3346" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/>
 <path d="M16 19.998V15.998" stroke="#2E3346" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/>
 <path d="M16 12H16.0098" stroke="#2E3346" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/>
 </g>
 <defs>
-<clipPath id="clip0_3427_35082111-d2-1108726992-MF2XI2DPOJUXI6I">
+<clipPath id="clip0_3427_35082111-d2-2701310579-MF2XI2DPOJUXI6I">
 <rect width="32" height="32" fill="white"/>
 </clipPath>
 </defs>
 </svg>
-</g><g transform="translate(571 1846)" class="appendix-icon"><title>DuckDB rollups and temporary spill. Not authoritative telemetry.</title><svg width="32" height="32" viewBox="0 0 32 32" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_3427_35082111-d2-1108726992-OF2WK4TZON2GC5DF)">
+</g><g transform="translate(578 1846)" class="appendix-icon"><title>DuckDB rollups and temporary spill. Not authoritative telemetry.</title><svg width="32" height="32" viewBox="0 0 32 32" fill="none" xmlns="http://www.w3.org/2000/svg">
+<g clip-path="url(#clip0_3427_35082111-d2-2701310579-OF2WK4TZON2GC5DF)">
 <path d="M16 31.1109C24.3456 31.1109 31.1111 24.3454 31.1111 15.9998C31.1111 7.65415 24.3456 0.888672 16 0.888672C7.65436 0.888672 0.888885 7.65415 0.888885 15.9998C0.888885 24.3454 7.65436 31.1109 16 31.1109Z" fill="white" stroke="#DEE1EB"/>
 <path d="M16 26C21.5228 26 26 21.5228 26 16C26 10.4772 21.5228 6 16 6C10.4772 6 6 10.4772 6 16C6 21.5228 10.4772 26 16 26Z" stroke="#2E3346" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/>
 <path d="M16 19.998V15.998" stroke="#2E3346" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/>
 <path d="M16 12H16.0098" stroke="#2E3346" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/>
 </g>
 <defs>
-<clipPath id="clip0_3427_35082111-d2-1108726992-OF2WK4TZON2GC5DF">
+<clipPath id="clip0_3427_35082111-d2-2701310579-OF2WK4TZON2GC5DF">
 <rect width="32" height="32" fill="white"/>
 </clipPath>
 </defs>
 </svg>
-</g><mask id="d2-1108726992" maskUnits="userSpaceOnUse" x="-89" y="-89" width="1274" height="2176">
+</g><mask id="d2-2701310579" maskUnits="userSpaceOnUse" x="-89" y="-89" width="1274" height="2176">
 <rect x="-89" y="-89" width="1274" height="2176" fill="white"></rect>
 <rect x="379.000000" y="855.000000" width="235" height="21" fill="black"></rect>
 </mask></svg></svg>
diff --git a/site/src/content/docs/explanation/storage-model.mdx b/site/src/content/docs/explanation/storage-model.mdx
index 8a7d6b51..526d7d7d 100644
--- a/site/src/content/docs/explanation/storage-model.mdx
+++ b/site/src/content/docs/explanation/storage-model.mdx
@@ -107,11 +107,8 @@ Discarded hashes force decoding; they do not establish a stored checksum.
 Verification failures such as memory exhaustion or cancellation never authorize
 quarantine.
 
-Telemetry batches use format 4. An older or unknown batch format makes startup
-fail before cleanup or schema rewriting, leaving the files intact. This build
-has no reader or automatic conversion for previous formats. Start with an
-empty telemetry directory; retain previous data separately for its original
-reader. SQLite control state is independent of this telemetry format change.
+Telemetry batches use format 4. An unsupported batch format makes startup
+fail before cleanup or schema rewriting, leaving the files intact.
 
 ## Small files are bounded by compaction
 
@@ -175,7 +172,7 @@ Narrow file selections use explicit lists from footer bounds. Broad selections
 use a glob with a captured-batch-ID filter, which excludes files published after
 snapshot capture. Only signals referenced by a query are bound.
 
-`storage.rollup_skip_to_latest` skips historical service and edge aggregation.
+`FANOUT_ROLLUP_SKIP_TO_LATEST` skips historical service and edge aggregation.
 Completed-batch trace caches still rebuild retained history
 in bounded passes; uncached files remain immediately queryable.
 
diff --git a/site/src/content/docs/guides/back-up-and-restore.mdx b/site/src/content/docs/guides/back-up-and-restore.mdx
index 12e88954..ef257adf 100644
--- a/site/src/content/docs/guides/back-up-and-restore.mdx
+++ b/site/src/content/docs/guides/back-up-and-restore.mdx
@@ -56,15 +56,6 @@ Migrations run forward at startup. A rollback to the previous binary after they
 have run is not assumed safe — restore the pre-upgrade backup with the previous
 version instead.
 
-The Goose migration baseline requires a fresh control database. Existing
-Atlas-managed control databases are rejected without conversion or reset. For
-this transition, stop Fanout, back up the complete directory, and move its
-`control` subdirectory aside before starting the new version. Telemetry and
-query files remain in place. Complete first-admin setup again, then reconfigure
-the ingest token, users, alert rules, and dashboards. Prior sessions, OAuth
-grants, and agent history remain in the saved control database; recover that
-state using the previous version and its backup.
-
 ## Never delete an account from the control database
 
 Removing a user row cascades to sessions, OAuth grants and owned dashboards. To
diff --git a/site/src/content/docs/guides/troubleshoot.mdx b/site/src/content/docs/guides/troubleshoot.mdx
index b813a75b..3dd0405d 100644
--- a/site/src/content/docs/guides/troubleshoot.mdx
+++ b/site/src/content/docs/guides/troubleshoot.mdx
@@ -83,7 +83,7 @@ trace index. First stop Fanout and back up `telemetry/`, then verify the full
 authoritative set:
 
 ```sh
-fanout --config /etc/fanout/fanout.yaml repair verify
+fanout repair verify
 ```
 
 The command is read-only and names every unreadable batch. Restore each named
@@ -92,7 +92,7 @@ only its telemetry is preferable to leaving the instance offline, set it aside
 explicitly:
 
 ```sh
-fanout --config /etc/fanout/fanout.yaml repair quarantine --batch <id>
+fanout repair quarantine --batch <id>
 ```
 
 Quarantine is an atomic rename beside the authoritative batch set, not a
@@ -137,7 +137,7 @@ operator with shell access to the same configuration and data directory then
 mints a link directly:
 
 ```sh
-fanout --config /etc/fanout/fanout.yaml login-link user@example.com
+fanout login-link user@example.com
 ```
 
 The link expires after 15 minutes, works once, and is recorded in the
diff --git a/site/src/content/docs/reference/configuration.mdx b/site/src/content/docs/reference/configuration.mdx
index 923354de..9804d1f1 100644
--- a/site/src/content/docs/reference/configuration.mdx
+++ b/site/src/content/docs/reference/configuration.mdx
@@ -1,55 +1,85 @@
 ---
 title: Configuration
 description: How Fanout is configured, where settings come from, and how the reference stays true to the binary.
-summary: The rules that govern every setting — precedence, naming, secrets, and what happens to a name that changes.
+summary: The rules that govern every setting — precedence, naming, secret files, and validation.
 read_when:
   - You are configuring an instance and want the rules before the list.
   - A setting you set appears to have been ignored.
 status: preview
 ---
 
-Fanout is configured from the environment, or from a YAML file using the same
-keys. Every setting is listed under [Settings](/reference/settings/server),
+Fanout resolves built-in defaults followed by nonempty process environment
+values. Every setting is listed under [Settings](/reference/settings/server),
 grouped by the part of the product it belongs to.
 
-Those pages are generated from `internal/config` by `cmd/fanout-docgen`, and
-`just check` fails when a committed page no longer matches the type the loader
-binds. That is the whole point of generating them: the reference cannot describe
-a setting the binary does not accept, and cannot omit one it does.
+Those pages and `.env.example` are generated from `internal/config` by
+`cmd/fanout-docgen`. `just docs-generate-check` verifies that they match the
+schema the binary uses.
 
 ## Where a value comes from
 
-An environment variable wins over the YAML file, and the file wins over the
-built-in default. A setting with no default and no value is empty, which for
-most settings means the feature it configures is off.
+All settings are read once at startup and require a restart. An empty
+environment value means unset and preserves the built-in default. Native
+installs listen on `127.0.0.1:7520`; the image supplies `FANOUT_ADDR=:7520`
+and `FANOUT_DATA_DIR=/var/lib/fanout/data`.
+
+The binary reads only process environment. `.env.example` comments out every
+empty entry and documents types, defaults, and secret file forms in comments.
+Copying the template sets nothing and preserves image ENV. For a source
+checkout, copy it to ignored `.env` and uncomment personal settings and
+development credentials as needed. Build the binary, then use `just run`:
+Node's native `parseEnv` loads optional `./.env`, and inherited environment values win, including empty
+values. Values are never executed as shell code or interpolated. The binary
+validates unknown names and types. Production deployments supply their own
+environment values or managed secret mounts.
 
 ## Naming
 
-Every environment variable is `FANOUT_`-prefixed. The YAML key is the dotted
-path in the first column of each settings table — `storage.duckdb.memory` is
-`FANOUT_DUCKDB_MEMORY`, and the two are the same setting.
+Custom names use `FANOUT_` plus a clear name, adding the area only when it
+clarifies. Vendor credentials and endpoints keep `ANTHROPIC_API_KEY`,
+`ANTHROPIC_BASE_URL`, `OPENAI_API_KEY`, and `OPENAI_BASE_URL`.
 
-## An unknown variable is an error
+`FANOUT_AI_PROVIDER` defaults to empty, disabling chat. Exactly `anthropic`
+or `openai` enables chat and requires that provider's key. Only the selected
+provider's endpoint is validated and used. Inherited credentials never select
+a provider. `FANOUT_AI_MODEL` selects the model; unrelated vendor/tool settings
+such as `ANTHROPIC_MODEL` and `OPENAI_MODEL` are ignored. See
+[AI settings](/reference/settings/ai) for base URL meanings.
 
-Fanout rejects an unrecognised `FANOUT_`-prefixed variable at startup rather
-than ignoring it. This matters more than it looks: Fanout is pre-release and
-settings get renamed without aliases, so the alternative is a variable you
-believe is in effect, silently replaced by a default nobody chose, discovered
-months later. A refusal to start is the version of that failure you can act on.
+## Unknown names
 
-The consequence is that upgrading can require a configuration change, and the
-process tells you which one at the first boot after the upgrade.
+Unknown `FANOUT_` names fail startup. Platform-injected service-discovery names
+are tolerated, and unrelated names in shared vendor namespaces are ignored.
+Errors name the relevant environment variable. Boolean, integer, and Go
+duration values must parse as their declared types.
 
 ## Secrets
 
-Settings marked `secret` are redacted from the startup configuration log. They
-are ordinary environment variables otherwise: anything that can read the process
-environment can read them. Fanout does not encrypt them at rest and does not
-integrate with a secret manager — mount them the way you would for any other
-process.
+Every secret accepts either its value or its file path:
+
+| Value variable | File path variable |
+|---|---|
+| `FANOUT_AUTH_CODE_SECRET` | `FANOUT_AUTH_CODE_SECRET_FILE` |
+| `FANOUT_OIDC_CLIENT_SECRET` | `FANOUT_OIDC_CLIENT_SECRET_FILE` |
+| `FANOUT_SMTP_PASSWORD` | `FANOUT_SMTP_PASSWORD_FILE` |
+| `FANOUT_METRICS_TOKEN` | `FANOUT_METRICS_TOKEN_FILE` |
+| `ANTHROPIC_API_KEY` | `ANTHROPIC_API_KEY_FILE` |
+| `OPENAI_API_KEY` | `OPENAI_API_KEY_FILE` |
+
+Setting both forms nonempty fails startup. File contents lose exactly one
+trailing LF or CRLF; an empty result fails. Errors name variables and paths,
+never contents. The deployment controls file access; Fanout performs no
+file-mode check. Secrets are redacted from startup logs.
+
+Use deployment environment injection, Docker/Compose secrets, Kubernetes
+Secrets, or a private selected SOPS profile. This public repository ships no
+operator profiles or recipients. See
+[runtime secret delivery](https://github.com/labstack/fanout/blob/main/docs/operations.md#runtime-secret-delivery)
+for examples.
 
 ## Validation
 
-The whole configuration is validated before any listener opens, so a value the
-binary will not accept stops it at startup. [First boot](/start/first-boot)
-lists what is checked.
+The whole configuration is validated before any listener opens. A value the
+binary cannot accept stops startup. [First boot](/start/first-boot) lists what
+is checked. The healthcheck command derives its probe from the listener and
+TLS environment settings without validating unrelated settings or secrets.
diff --git a/site/src/content/docs/reference/settings/ai.mdx b/site/src/content/docs/reference/settings/ai.mdx
index d8efe765..5ed983de 100644
--- a/site/src/content/docs/reference/settings/ai.mdx
+++ b/site/src/content/docs/reference/settings/ai.mdx
@@ -1,7 +1,7 @@
 ---
 title: "AI provider settings"
 description: "The provider, key, model and base URL backing the chat investigator."
-summary: "Settings for the model behind the chat investigator. Without a key the agent is disabled."
+summary: "Chat is disabled unless a provider is selected; its API key is then required."
 read_when:
   - "The chat investigator is disabled and you want it on."
   - "You are pointing Fanout at a self-hosted or proxied model endpoint."
@@ -11,26 +11,53 @@ generated: true
 
 {/* Generated by cmd/fanout-docgen from internal/config. Edit the generator, not this page. */}
 
-Every setting below is read from the environment variable in the second
-column, or from the same key in a YAML configuration file. An unrecognised
-`FANOUT_`-prefixed variable is a startup error, so a renamed setting surfaces
-as a refusal to start rather than as a default nobody chose.
+Every setting below is read once at startup and requires a restart to change.
+Built-in defaults are overridden by nonempty environment values.
+Unknown `FANOUT_` names fail startup; platform-injected service names are tolerated.
+Custom names use `FANOUT_` plus a clear name, adding the area only when it clarifies.
+Vendor credentials and endpoints keep the vendor's documented names.
 
-| Setting | Environment variable | Type | Default |
-|---|---|---|---|
-| `ai.api_key` | `FANOUT_AI_API_KEY` | string · secret | — |
-| `ai.base_url` | `FANOUT_AI_BASE_URL` | string | — |
-| `ai.model` | `FANOUT_AI_MODEL` | string | — |
-| `ai.provider` | `FANOUT_AI_PROVIDER` | string | `anthropic` |
+Fanout also recognizes `ANTHROPIC_API_KEY`, `ANTHROPIC_BASE_URL`,
+`OPENAI_API_KEY`, and `OPENAI_BASE_URL`. Other vendor/tool variables are
+ignored; only the explicitly selected AI provider's key and endpoint are used.
+
+| Environment variable | Type | Default |
+|---|---|---|
+| `ANTHROPIC_API_KEY` or `ANTHROPIC_API_KEY_FILE` | string · secret | — |
+| `ANTHROPIC_BASE_URL` | string | — |
+| `FANOUT_AI_MODEL` | string | — |
+| `FANOUT_AI_PROVIDER` | string | — |
+| `OPENAI_API_KEY` or `OPENAI_API_KEY_FILE` | string · secret | — |
+| `OPENAI_BASE_URL` | string | — |
 
 ## Notes
 
-### `ai.model`
+### `ANTHROPIC_API_KEY`
+
+Required when FANOUT_AI_PROVIDER is anthropic.
+
+### `ANTHROPIC_BASE_URL`
+
+Defaults to https://api.anthropic.com. Fanout appends /v1/messages, preserving any gateway path prefix. Use an HTTP(S) base URL without embedded credentials, a query, or a fragment.
+
+### `FANOUT_AI_MODEL`
+
+Overrides the provider's default: claude-sonnet-5-5 for Anthropic and gpt-6.1-sol for OpenAI. The OpenAI provider expects a reasoning model supporting reasoning.encrypted_content for stateless Responses replay. A 400 rejecting encrypted content is reported as a server-side configuration error; choose a compatible reasoning model with FANOUT_AI_MODEL.
+
+### `FANOUT_AI_PROVIDER`
+
+Enables chat by selecting exactly anthropic or openai. Empty disables chat.
+
+### `OPENAI_API_KEY`
+
+Required when FANOUT_AI_PROVIDER is openai.
+
+### `OPENAI_BASE_URL`
 
-Overrides the provider's default: claude-sonnet-5-5 for Anthropic and gpt-6.1-sol for OpenAI. The OpenAI provider expects a reasoning model supporting reasoning.encrypted_content for stateless Responses replay. A 400 rejecting encrypted content is reported as a server-side configuration error; choose a compatible reasoning model with ai.model.
+Defaults to https://api.openai.com/v1. Fanout appends /responses, preserving the API version and any gateway path prefix. Use an HTTP(S) base URL without embedded credentials, a query, or a fragment.
 
 :::caution[Secrets]
 Settings marked `secret` are redacted from Fanout's startup configuration
-log. They are still plain environment variables: anything that can read the
-process environment can read them.
+log. Supply either the value or its `_FILE` path, never both. File contents
+lose exactly one trailing newline (LF or CRLF); empty secrets fail startup.
 :::
diff --git a/site/src/content/docs/reference/settings/alerts.mdx b/site/src/content/docs/reference/settings/alerts.mdx
index 6daeb6c9..8836fe5c 100644
--- a/site/src/content/docs/reference/settings/alerts.mdx
+++ b/site/src/content/docs/reference/settings/alerts.mdx
@@ -10,13 +10,28 @@ generated: true
 
 {/* Generated by cmd/fanout-docgen from internal/config. Edit the generator, not this page. */}
 
-Every setting below is read from the environment variable in the second
-column, or from the same key in a YAML configuration file. An unrecognised
-`FANOUT_`-prefixed variable is a startup error, so a renamed setting surfaces
-as a refusal to start rather than as a default nobody chose.
-
-| Setting | Environment variable | Type | Default |
-|---|---|---|---|
-| `alerts.enabled` | `FANOUT_ALERTS_ENABLED` | boolean | `true` |
-| `alerts.evaluation_interval` | `FANOUT_ALERTS_EVALUATION_INTERVAL` | duration | `30s` |
-| `alerts.history_days` | `FANOUT_ALERTS_HISTORY_DAYS` | integer | `7` |
+Every setting below is read once at startup and requires a restart to change.
+Built-in defaults are overridden by nonempty environment values.
+Unknown `FANOUT_` names fail startup; platform-injected service names are tolerated.
+Custom names use `FANOUT_` plus a clear name, adding the area only when it clarifies.
+Vendor credentials and endpoints keep the vendor's documented names.
+
+| Environment variable | Type | Default |
+|---|---|---|
+| `FANOUT_ALERTS_ENABLED` | boolean | `true` |
+| `FANOUT_ALERTS_EVALUATION_INTERVAL` | duration | `30s` |
+| `FANOUT_ALERTS_HISTORY_DAYS` | integer | `7` |
+
+## Notes
+
+### `FANOUT_ALERTS_ENABLED`
+
+Runs the alert evaluation engine.
+
+### `FANOUT_ALERTS_EVALUATION_INTERVAL`
+
+Schedules alert evaluation; use a Go duration of at least 1s.
+
+### `FANOUT_ALERTS_HISTORY_DAYS`
+
+Sets alert history retention in days.
diff --git a/site/src/content/docs/reference/settings/auth.mdx b/site/src/content/docs/reference/settings/auth.mdx
index 0d04de24..40086be4 100644
--- a/site/src/content/docs/reference/settings/auth.mdx
+++ b/site/src/content/docs/reference/settings/auth.mdx
@@ -11,32 +11,99 @@ generated: true
 
 {/* Generated by cmd/fanout-docgen from internal/config. Edit the generator, not this page. */}
 
-Every setting below is read from the environment variable in the second
-column, or from the same key in a YAML configuration file. An unrecognised
-`FANOUT_`-prefixed variable is a startup error, so a renamed setting surfaces
-as a refusal to start rather than as a default nobody chose.
-
-| Setting | Environment variable | Type | Default |
-|---|---|---|---|
-| `auth.code_secret` | `FANOUT_AUTH_CODE_SECRET` | string · secret | — |
-| `auth.mode` | `FANOUT_AUTH_MODE` | string | `local` |
-| `auth.oidc.admin_groups` | `FANOUT_OIDC_ADMIN_GROUPS` | string | — |
-| `auth.oidc.allowed_domains` | `FANOUT_OIDC_ALLOWED_DOMAINS` | string | — |
-| `auth.oidc.allowed_groups` | `FANOUT_OIDC_ALLOWED_GROUPS` | string | — |
-| `auth.oidc.auto_provision` | `FANOUT_OIDC_AUTO_PROVISION` | boolean | `false` |
-| `auth.oidc.client_id` | `FANOUT_OIDC_CLIENT_ID` | string | — |
-| `auth.oidc.client_secret` | `FANOUT_OIDC_CLIENT_SECRET` | string · secret | — |
-| `auth.oidc.default_role` | `FANOUT_OIDC_DEFAULT_ROLE` | string | `viewer` |
-| `auth.oidc.email_claim` | `FANOUT_OIDC_EMAIL_CLAIM` | string | `email` |
-| `auth.oidc.email_verification` | `FANOUT_OIDC_EMAIL_VERIFICATION` | string | `required` |
-| `auth.oidc.issuer_url` | `FANOUT_OIDC_ISSUER_URL` | string | — |
-| `auth.oidc.operator_groups` | `FANOUT_OIDC_OPERATOR_GROUPS` | string | — |
-| `auth.self_signup` | `FANOUT_SELF_SIGNUP` | boolean | `false` |
-| `auth.session_absolute_ttl` | `FANOUT_SESSION_ABSOLUTE_TTL` | duration | `168h` |
-| `auth.session_idle_ttl` | `FANOUT_SESSION_IDLE_TTL` | duration | `12h` |
+Every setting below is read once at startup and requires a restart to change.
+Built-in defaults are overridden by nonempty environment values.
+Unknown `FANOUT_` names fail startup; platform-injected service names are tolerated.
+Custom names use `FANOUT_` plus a clear name, adding the area only when it clarifies.
+Vendor credentials and endpoints keep the vendor's documented names.
+
+| Environment variable | Type | Default |
+|---|---|---|
+| `FANOUT_AUTH_CODE_SECRET` or `FANOUT_AUTH_CODE_SECRET_FILE` | string · secret | — |
+| `FANOUT_AUTH_MODE` | string | `local` |
+| `FANOUT_OIDC_ADMIN_GROUPS` | string | — |
+| `FANOUT_OIDC_ALLOWED_DOMAINS` | string | — |
+| `FANOUT_OIDC_ALLOWED_GROUPS` | string | — |
+| `FANOUT_OIDC_AUTO_PROVISION` | boolean | `false` |
+| `FANOUT_OIDC_CLIENT_ID` | string | — |
+| `FANOUT_OIDC_CLIENT_SECRET` or `FANOUT_OIDC_CLIENT_SECRET_FILE` | string · secret | — |
+| `FANOUT_OIDC_DEFAULT_ROLE` | string | `viewer` |
+| `FANOUT_OIDC_EMAIL_CLAIM` | string | `email` |
+| `FANOUT_OIDC_EMAIL_VERIFICATION` | string | `required` |
+| `FANOUT_OIDC_ISSUER_URL` | string | — |
+| `FANOUT_OIDC_OPERATOR_GROUPS` | string | — |
+| `FANOUT_SELF_SIGNUP` | boolean | `false` |
+| `FANOUT_SESSION_ABSOLUTE_TTL` | duration | `168h` |
+| `FANOUT_SESSION_IDLE_TTL` | duration | `12h` |
+
+## Notes
+
+### `FANOUT_AUTH_CODE_SECRET`
+
+Signs local sign-in codes; required in local mode with at least 32 characters.
+
+### `FANOUT_AUTH_MODE`
+
+Selects local sign-in or oidc; each mode validates its prerequisites.
+
+### `FANOUT_OIDC_ADMIN_GROUPS`
+
+Lists identity-provider groups mapped to admin, separated by commas.
+
+### `FANOUT_OIDC_ALLOWED_DOMAINS`
+
+Lists allowed email domains, separated by commas; wildcard * requires verified email.
+
+### `FANOUT_OIDC_ALLOWED_GROUPS`
+
+Lists allowed identity-provider groups, separated by commas.
+
+### `FANOUT_OIDC_AUTO_PROVISION`
+
+Creates accounts on OIDC sign-in; requires an allowed group or domain.
+
+### `FANOUT_OIDC_CLIENT_ID`
+
+Identifies Fanout's client registration; required in OIDC mode.
+
+### `FANOUT_OIDC_CLIENT_SECRET`
+
+Authenticates Fanout's client registration; required in OIDC mode.
+
+### `FANOUT_OIDC_DEFAULT_ROLE`
+
+Assigns viewer, operator, or admin to users without a group role mapping.
+
+### `FANOUT_OIDC_EMAIL_CLAIM`
+
+Names the claim containing the user's email address.
+
+### `FANOUT_OIDC_EMAIL_VERIFICATION`
+
+Selects required verified-email claims or issuer trust; issuer trust requires an allowlist.
+
+### `FANOUT_OIDC_ISSUER_URL`
+
+Selects the identity provider issuer; required in OIDC mode.
+
+### `FANOUT_OIDC_OPERATOR_GROUPS`
+
+Lists identity-provider groups mapped to operator, separated by commas.
+
+### `FANOUT_SELF_SIGNUP`
+
+Allows verified email addresses to create viewer accounts; requires local auth and SMTP.
+
+### `FANOUT_SESSION_ABSOLUTE_TTL`
+
+Limits total session lifetime; it must be at least FANOUT_SESSION_IDLE_TTL.
+
+### `FANOUT_SESSION_IDLE_TTL`
+
+Expires inactive sessions; use a Go duration of at least 5m.
 
 :::caution[Secrets]
 Settings marked `secret` are redacted from Fanout's startup configuration
-log. They are still plain environment variables: anything that can read the
-process environment can read them.
+log. Supply either the value or its `_FILE` path, never both. File contents
+lose exactly one trailing newline (LF or CRLF); empty secrets fail startup.
 :::
diff --git a/site/src/content/docs/reference/settings/ingest.mdx b/site/src/content/docs/reference/settings/ingest.mdx
index 39cc5e1b..02271e66 100644
--- a/site/src/content/docs/reference/settings/ingest.mdx
+++ b/site/src/content/docs/reference/settings/ingest.mdx
@@ -11,19 +11,28 @@ generated: true
 
 {/* Generated by cmd/fanout-docgen from internal/config. Edit the generator, not this page. */}
 
-Every setting below is read from the environment variable in the second
-column, or from the same key in a YAML configuration file. An unrecognised
-`FANOUT_`-prefixed variable is a startup error, so a renamed setting surfaces
-as a refusal to start rather than as a default nobody chose.
+Every setting below is read once at startup and requires a restart to change.
+Built-in defaults are overridden by nonempty environment values.
+Unknown `FANOUT_` names fail startup; platform-injected service names are tolerated.
+Custom names use `FANOUT_` plus a clear name, adding the area only when it clarifies.
+Vendor credentials and endpoints keep the vendor's documented names.
 
-| Setting | Environment variable | Type | Default |
-|---|---|---|---|
-| `ingest.batch_size` | `FANOUT_INGEST_BATCH_SIZE` | integer | `50000` |
-| `ingest.default_namespace` | `FANOUT_DEFAULT_NAMESPACE` | string | `default` |
-| `ingest.max_in_flight_bytes` | `FANOUT_INGEST_MAX_IN_FLIGHT_BYTES` | integer | `268435456` |
+| Environment variable | Type | Default |
+|---|---|---|
+| `FANOUT_DEFAULT_NAMESPACE` | string | `default` |
+| `FANOUT_INGEST_BATCH_SIZE` | integer | `50000` |
+| `FANOUT_INGEST_MAX_IN_FLIGHT_BYTES` | integer | `268435456` |
 
 ## Notes
 
-### `ingest.max_in_flight_bytes`
+### `FANOUT_DEFAULT_NAMESPACE`
+
+Supplies the namespace for telemetry without one.
+
+### `FANOUT_INGEST_BATCH_SIZE`
+
+Limits telemetry rows per batch; valid values are 1–50000.
+
+### `FANOUT_INGEST_MAX_IN_FLIGHT_BYTES`
 
 Caps the decoded telemetry the process will hold across concurrent requests. Concurrency is HTTP/2 streams times connections and each handler holds its batch until the commit is durable, so without a ceiling a burst is bounded only by memory. Zero is unbounded, which is the behaviour that predates this setting.
diff --git a/site/src/content/docs/reference/settings/mcp.mdx b/site/src/content/docs/reference/settings/mcp.mdx
index 1b8d2ef2..799c2e83 100644
--- a/site/src/content/docs/reference/settings/mcp.mdx
+++ b/site/src/content/docs/reference/settings/mcp.mdx
@@ -10,11 +10,18 @@ generated: true
 
 {/* Generated by cmd/fanout-docgen from internal/config. Edit the generator, not this page. */}
 
-Every setting below is read from the environment variable in the second
-column, or from the same key in a YAML configuration file. An unrecognised
-`FANOUT_`-prefixed variable is a startup error, so a renamed setting surfaces
-as a refusal to start rather than as a default nobody chose.
+Every setting below is read once at startup and requires a restart to change.
+Built-in defaults are overridden by nonempty environment values.
+Unknown `FANOUT_` names fail startup; platform-injected service names are tolerated.
+Custom names use `FANOUT_` plus a clear name, adding the area only when it clarifies.
+Vendor credentials and endpoints keep the vendor's documented names.
 
-| Setting | Environment variable | Type | Default |
-|---|---|---|---|
-| `mcp.enabled` | `FANOUT_MCP_ENABLED` | boolean | `true` |
+| Environment variable | Type | Default |
+|---|---|---|
+| `FANOUT_MCP_ENABLED` | boolean | `true` |
+
+## Notes
+
+### `FANOUT_MCP_ENABLED`
+
+Serves the MCP endpoint at /mcp.
diff --git a/site/src/content/docs/reference/settings/metrics.mdx b/site/src/content/docs/reference/settings/metrics.mdx
index 0bfeceae..10cf1d1c 100644
--- a/site/src/content/docs/reference/settings/metrics.mdx
+++ b/site/src/content/docs/reference/settings/metrics.mdx
@@ -10,18 +10,29 @@ generated: true
 
 {/* Generated by cmd/fanout-docgen from internal/config. Edit the generator, not this page. */}
 
-Every setting below is read from the environment variable in the second
-column, or from the same key in a YAML configuration file. An unrecognised
-`FANOUT_`-prefixed variable is a startup error, so a renamed setting surfaces
-as a refusal to start rather than as a default nobody chose.
+Every setting below is read once at startup and requires a restart to change.
+Built-in defaults are overridden by nonempty environment values.
+Unknown `FANOUT_` names fail startup; platform-injected service names are tolerated.
+Custom names use `FANOUT_` plus a clear name, adding the area only when it clarifies.
+Vendor credentials and endpoints keep the vendor's documented names.
 
-| Setting | Environment variable | Type | Default |
-|---|---|---|---|
-| `metrics.public` | `FANOUT_METRICS_PUBLIC` | boolean | `false` |
-| `metrics.token` | `FANOUT_METRICS_TOKEN` | string · secret | — |
+| Environment variable | Type | Default |
+|---|---|---|
+| `FANOUT_METRICS_PUBLIC` | boolean | `false` |
+| `FANOUT_METRICS_TOKEN` or `FANOUT_METRICS_TOKEN_FILE` | string · secret | — |
+
+## Notes
+
+### `FANOUT_METRICS_PUBLIC`
+
+Allows unauthenticated Prometheus scrapes.
+
+### `FANOUT_METRICS_TOKEN`
+
+Authorizes Prometheus scrapes with a bearer token; optional when using an admin session.
 
 :::caution[Secrets]
 Settings marked `secret` are redacted from Fanout's startup configuration
-log. They are still plain environment variables: anything that can read the
-process environment can read them.
+log. Supply either the value or its `_FILE` path, never both. File contents
+lose exactly one trailing newline (LF or CRLF); empty secrets fail startup.
 :::
diff --git a/site/src/content/docs/reference/settings/server.mdx b/site/src/content/docs/reference/settings/server.mdx
index 3cbc4b5d..eaf93934 100644
--- a/site/src/content/docs/reference/settings/server.mdx
+++ b/site/src/content/docs/reference/settings/server.mdx
@@ -11,26 +11,43 @@ generated: true
 
 {/* Generated by cmd/fanout-docgen from internal/config. Edit the generator, not this page. */}
 
-Every setting below is read from the environment variable in the second
-column, or from the same key in a YAML configuration file. An unrecognised
-`FANOUT_`-prefixed variable is a startup error, so a renamed setting surfaces
-as a refusal to start rather than as a default nobody chose.
-
-| Setting | Environment variable | Type | Default |
-|---|---|---|---|
-| `server.addr` | `FANOUT_ADDR` | string | `:7520` |
-| `server.pprof_enabled` | `FANOUT_PPROF_ENABLED` | boolean | `false` |
-| `server.public_url` | `FANOUT_PUBLIC_URL` | string | — |
-| `server.tls.cert_file` | `FANOUT_TLS_CERT_FILE` | string | — |
-| `server.tls.key_file` | `FANOUT_TLS_KEY_FILE` | string | — |
-| `server.trusted_proxy_cidrs` | `FANOUT_TRUSTED_PROXY_CIDRS` | string | — |
+Every setting below is read once at startup and requires a restart to change.
+Built-in defaults are overridden by nonempty environment values.
+Unknown `FANOUT_` names fail startup; platform-injected service names are tolerated.
+Custom names use `FANOUT_` plus a clear name, adding the area only when it clarifies.
+Vendor credentials and endpoints keep the vendor's documented names.
+
+| Environment variable | Type | Default |
+|---|---|---|
+| `FANOUT_ADDR` | string | `127.0.0.1:7520` |
+| `FANOUT_PPROF_ENABLED` | boolean | `false` |
+| `FANOUT_PUBLIC_URL` | string | — |
+| `FANOUT_TLS_CERT_FILE` | string | — |
+| `FANOUT_TLS_KEY_FILE` | string | — |
+| `FANOUT_TRUSTED_PROXY_CIDRS` | string | — |
 
 ## Notes
 
-### `server.addr`
+### `FANOUT_ADDR`
 
 Binds the browser, API, MCP, OTLP/gRPC and OTLP/HTTP listener.
 
-### `server.pprof_enabled`
+### `FANOUT_PPROF_ENABLED`
 
 Exposes Go's net/http/pprof handlers at /debug/pprof/* for CPU/heap/mutex/goroutine profiling under load. Off by default; the routes require an admin browser session with operations:read.
+
+### `FANOUT_PUBLIC_URL`
+
+Sets the external browser origin. Required for OIDC; HTTPS is required with MCP.
+
+### `FANOUT_TLS_CERT_FILE`
+
+Selects the TLS certificate file; requires FANOUT_TLS_KEY_FILE.
+
+### `FANOUT_TLS_KEY_FILE`
+
+Selects the TLS private key file; requires FANOUT_TLS_CERT_FILE.
+
+### `FANOUT_TRUSTED_PROXY_CIDRS`
+
+Lists trusted proxy networks, separated by commas; empty trusts no forwarded client addresses.
diff --git a/site/src/content/docs/reference/settings/smtp.mdx b/site/src/content/docs/reference/settings/smtp.mdx
index f259359e..ea1d09db 100644
--- a/site/src/content/docs/reference/settings/smtp.mdx
+++ b/site/src/content/docs/reference/settings/smtp.mdx
@@ -10,21 +10,44 @@ generated: true
 
 {/* Generated by cmd/fanout-docgen from internal/config. Edit the generator, not this page. */}
 
-Every setting below is read from the environment variable in the second
-column, or from the same key in a YAML configuration file. An unrecognised
-`FANOUT_`-prefixed variable is a startup error, so a renamed setting surfaces
-as a refusal to start rather than as a default nobody chose.
-
-| Setting | Environment variable | Type | Default |
-|---|---|---|---|
-| `smtp.from` | `FANOUT_SMTP_FROM` | string | — |
-| `smtp.host` | `FANOUT_SMTP_HOST` | string | — |
-| `smtp.password` | `FANOUT_SMTP_PASSWORD` | string · secret | — |
-| `smtp.port` | `FANOUT_SMTP_PORT` | integer | `587` |
-| `smtp.username` | `FANOUT_SMTP_USERNAME` | string | — |
+Every setting below is read once at startup and requires a restart to change.
+Built-in defaults are overridden by nonempty environment values.
+Unknown `FANOUT_` names fail startup; platform-injected service names are tolerated.
+Custom names use `FANOUT_` plus a clear name, adding the area only when it clarifies.
+Vendor credentials and endpoints keep the vendor's documented names.
+
+| Environment variable | Type | Default |
+|---|---|---|
+| `FANOUT_SMTP_FROM` | string | — |
+| `FANOUT_SMTP_HOST` | string | — |
+| `FANOUT_SMTP_PASSWORD` or `FANOUT_SMTP_PASSWORD_FILE` | string · secret | — |
+| `FANOUT_SMTP_PORT` | integer | `587` |
+| `FANOUT_SMTP_USERNAME` | string | — |
+
+## Notes
+
+### `FANOUT_SMTP_FROM`
+
+Sets the email sender address; required with SMTP.
+
+### `FANOUT_SMTP_HOST`
+
+Selects the mail server. Host, username, password, and from must all be set to enable SMTP.
+
+### `FANOUT_SMTP_PASSWORD`
+
+Authenticates to the mail server; required with SMTP.
+
+### `FANOUT_SMTP_PORT`
+
+Sets the mail server's positive TCP port.
+
+### `FANOUT_SMTP_USERNAME`
+
+Authenticates to the mail server; required with SMTP.
 
 :::caution[Secrets]
 Settings marked `secret` are redacted from Fanout's startup configuration
-log. They are still plain environment variables: anything that can read the
-process environment can read them.
+log. Supply either the value or its `_FILE` path, never both. File contents
+lose exactly one trailing newline (LF or CRLF); empty secrets fail startup.
 :::
diff --git a/site/src/content/docs/reference/settings/storage.mdx b/site/src/content/docs/reference/settings/storage.mdx
index 5905ae30..b852f70d 100644
--- a/site/src/content/docs/reference/settings/storage.mdx
+++ b/site/src/content/docs/reference/settings/storage.mdx
@@ -11,40 +11,53 @@ generated: true
 
 {/* Generated by cmd/fanout-docgen from internal/config. Edit the generator, not this page. */}
 
-Every setting below is read from the environment variable in the second
-column, or from the same key in a YAML configuration file. An unrecognised
-`FANOUT_`-prefixed variable is a startup error, so a renamed setting surfaces
-as a refusal to start rather than as a default nobody chose.
-
-| Setting | Environment variable | Type | Default |
-|---|---|---|---|
-| `storage.data_dir` | `FANOUT_DATA_DIR` | string | `./data` |
-| `storage.duckdb.max_connections` | `FANOUT_DUCKDB_MAX_CONNECTIONS` | integer | `0` |
-| `storage.duckdb.memory` | `FANOUT_DUCKDB_MEMORY` | string | — |
-| `storage.duckdb.threads` | `FANOUT_DUCKDB_THREADS` | integer | — |
-| `storage.maintenance_interval` | `FANOUT_MAINTENANCE_INTERVAL` | duration | `1h` |
-| `storage.retention_days` | `FANOUT_RETENTION_DAYS` | integer | `30` |
-| `storage.rollup_interval` | `FANOUT_ROLLUP_INTERVAL` | duration | `1m` |
-| `storage.rollup_skip_to_latest` | `FANOUT_ROLLUP_SKIP_TO_LATEST` | boolean | `false` |
+Every setting below is read once at startup and requires a restart to change.
+Built-in defaults are overridden by nonempty environment values.
+Unknown `FANOUT_` names fail startup; platform-injected service names are tolerated.
+Custom names use `FANOUT_` plus a clear name, adding the area only when it clarifies.
+Vendor credentials and endpoints keep the vendor's documented names.
+
+| Environment variable | Type | Default |
+|---|---|---|
+| `FANOUT_DATA_DIR` | string | `./data` |
+| `FANOUT_DUCKDB_MAX_CONNECTIONS` | integer | `0` |
+| `FANOUT_DUCKDB_MEMORY` | string | — |
+| `FANOUT_DUCKDB_THREADS` | integer | — |
+| `FANOUT_MAINTENANCE_INTERVAL` | duration | `1h` |
+| `FANOUT_RETENTION_DAYS` | integer | `30` |
+| `FANOUT_ROLLUP_INTERVAL` | duration | `1m` |
+| `FANOUT_ROLLUP_SKIP_TO_LATEST` | boolean | `false` |
 
 ## Notes
 
-### `storage.duckdb.max_connections`
+### `FANOUT_DATA_DIR`
+
+Stores telemetry, query state, and the control database.
+
+### `FANOUT_DUCKDB_MAX_CONNECTIONS`
 
 Caps the DuckDB connection pool. Reads scan immutable Parquet concurrently; rollup-cache writes are serialized by the query write gate. Zero means "size it from the machine" — the same spelling DuckDBThreads uses for deferring to a default. Resolution happens in resolveSizing and is reported in the startup configuration log.
 
-### `storage.duckdb.memory`
+### `FANOUT_DUCKDB_MEMORY`
 
 Caps DuckDB's memory (e.g. "8GB"). Empty means Fanout sizes it from detected memory, reserving headroom for the Go runtime; see resolveSizing. DuckDB's own default is 80% of detected RAM, which is calculated as though DuckDB owned the machine and has been observed to get the process OOM-killed once the Go heap is added on top.
 
-### `storage.duckdb.threads`
+### `FANOUT_DUCKDB_THREADS`
 
 Caps DuckDB's global query worker pool. Zero leaves DuckDB's own default in place (one worker per core). Set it to leave cores free for ingest on a query-heavy co-tenant host.
 
-### `storage.maintenance_interval`
+### `FANOUT_MAINTENANCE_INTERVAL`
 
 Controls Parquet retention and compaction, and query-cache checkpointing.
 
-### `storage.rollup_skip_to_latest`
+### `FANOUT_RETENTION_DAYS`
+
+Sets telemetry retention in days; zero disables expiry.
+
+### `FANOUT_ROLLUP_INTERVAL`
+
+Schedules analytical rollups; use a Go duration of at least 1s.
+
+### `FANOUT_ROLLUP_SKIP_TO_LATEST`
 
 RollupSkipToLatest, set once at boot, advances the service and edge rollup watermarks to the current max ingested timestamp. Existing history is not aggregated into those analytical rollups. Completed-batch trace caches still rebuild all retained history in bounded passes; uncached files remain immediately queryable. Useful for large pre-seeded datasets (benchmarks, restores); off in normal operation.
diff --git a/site/src/content/docs/start/install.mdx b/site/src/content/docs/start/install.mdx
index b6d46919..264f4751 100644
--- a/site/src/content/docs/start/install.mdx
+++ b/site/src/content/docs/start/install.mdx
@@ -32,9 +32,11 @@ pick whichever registry your hosts already pull from.
 `FANOUT_AUTH_CODE_SECRET` is required in the default `local` auth mode and must
 be at least 32 characters — the container refuses to start without it. It is the
 only setting the command above adds; the image ships listener and data-directory
-defaults of its own. Add `FANOUT_AI_API_KEY` to enable the chat investigator,
-which is optional: without a key the process starts normally and logs that the
-agent is disabled.
+defaults of its own. Select `FANOUT_AI_PROVIDER=anthropic` with `ANTHROPIC_API_KEY`,
+or `FANOUT_AI_PROVIDER=openai` with `OPENAI_API_KEY`, to enable the chat
+investigator. Chat is optional and disabled when no provider is selected, even
+with inherited vendor credentials or endpoints. Selecting a provider requires
+its key at startup and validates only its endpoint.
 
 :::caution[Use a named volume, or fix the ownership yourself]
 The image is distroless and runs unprivileged as UID/GID 65532. A **named
@@ -43,8 +45,9 @@ is not: `-v "$PWD/data:/var/lib/fanout/data"` fails to open its data directory
 unless that directory is already writable by 65532.
 :::
 
-Both the image and native binary bind the shared listener on all interfaces.
-Set `FANOUT_ADDR=127.0.0.1:7520` for a local-only instance.
+The image sets `FANOUT_ADDR=:7520` and `FANOUT_DATA_DIR=/var/lib/fanout/data`.
+Native installs default to `127.0.0.1:7520`; set `FANOUT_ADDR=:7520` to accept
+connections from other hosts.
 
   </TabItem>
   <TabItem label="Install script">
@@ -70,6 +73,7 @@ run it:
 
 ```sh
 chmod +x fanout
+export FANOUT_AUTH_CODE_SECRET=$(openssl rand -hex 32)
 ./fanout
 ```
 
@@ -114,24 +118,19 @@ reasoning is in the repository's release contract.
 
 | Port or path | Purpose | Native default |
 |---|---|---|
-| `7520` | Browser, API, chat, MCP, OTLP/gRPC and OTLP/HTTP | `:7520`, all interfaces |
+| `7520` | Browser, API, chat, MCP, OTLP/gRPC and OTLP/HTTP | `127.0.0.1:7520`, loopback |
 | `./data` | Telemetry, query state, users, sessions, dashboards, alerts and agent history | `./data` |
 
 Every OTLP export requires the ingest token, including on the shared port.
 Ingest rejects requests before setup completes. Read [authenticate
 exporters](/start/send-telemetry) before pointing a service at the instance.
 
-Upgrading from separate ports? Remove `FANOUT_OTLP_GRPC_ADDR` and
-`FANOUT_OTLP_HTTP_ADDR` (or YAML `ingest.otlp_grpc_addr` and
-`ingest.otlp_http_addr`), update exporters to port `7520` or your public HTTPS
-origin, and remove the old port mappings. Rename `FANOUT_HTTP_ADDR` to
-`FANOUT_ADDR` (YAML `server.http_addr` to `server.addr`). Removed settings are
-startup errors. Also remove `FANOUT_INGEST_ADVERTISED_ENDPOINT` or YAML
-`ingest.advertised_endpoint`; change a private collector hostname directly on
-**Connect telemetry** before copying its generated configuration.
-
-Separate interface bindings are also removed. If the dashboard is public but
-ingest must remain LAN-only, keep Fanout's backend port private and deny
+Exporters use the shared port `7520` or the public HTTPS origin. Every OTLP
+export requires the ingest token. A private collector hostname can be entered
+on **Connect telemetry** before copying its generated configuration.
+
+If the dashboard is public but ingest must remain LAN-only, keep Fanout's
+backend port private and deny
 `/v1`, `/v1/*`, and `/opentelemetry.proto.collector.*` on the public proxy.
 Allow collectors through the private network or a restricted proxy route,
 and verify that neither OTLP transport is reachable through the public origin.
diff --git a/site/src/pages/llms.txt.ts b/site/src/pages/llms.txt.ts
index 96174879..3e0a5d8f 100644
--- a/site/src/pages/llms.txt.ts
+++ b/site/src/pages/llms.txt.ts
@@ -63,7 +63,7 @@ export const GET: APIRoute = async ({ site }) => {
     "",
     "## Operating Fanout from an agent",
     "",
-    "- Fanout is a server. Its whole command line is three forms: `fanout [flags]` to run it, `fanout version`, and `fanout [--config path] login-link <email>` — a local-auth-mode recovery path that needs shell access on the host. Everything else is done over HTTP or MCP; there are no operational subcommands to script.",
+    "- Fanout reads built-in defaults and process environment. Native installs listen on 127.0.0.1:7520; the image supplies FANOUT_ADDR=:7520. Secret variables accept _FILE paths. Commands: `fanout [flags]`, `fanout version`, `fanout login-link <email>` (local recovery with host access), `fanout healthcheck [url]`, `fanout repair verify`, and `fanout repair quarantine --batch <id>`. Product operations use HTTP or MCP.",
     "- MCP is the intended agent interface. The server exposes its tools at `/mcp`.",
     "- MCP and the HTTP API authenticate with an API key, which is not the same credential as the ingest token. Both are `fo_`-prefixed; the routes tell them apart by prefix.",
     "- Telemetry goes in over OTLP only: gRPC and HTTP on the same port as the application (7520 by default). There is no bespoke ingest API to script against.",
diff --git a/site/src/styles/fanout.css b/site/src/styles/fanout.css
index cb9070e4..9704db7e 100644
--- a/site/src/styles/fanout.css
+++ b/site/src/styles/fanout.css
@@ -262,7 +262,7 @@ h1#_top {
 /* Code inside a heading is set smaller than the heading's own size.
    The generated settings reference titles every note with a setting key, and a
    key is one long unbreakable token: at Starlight's h3 size,
-   `storage.duckdb.max_connections` is wider than the content column and breaks
+   `FANOUT_DUCKDB_MAX_CONNECTIONS` is wider than the content column and breaks
    mid-identifier, rendering as "max_connection" above a lone "s". */
 .sl-markdown-content :is(h1, h2, h3, h4, h5, h6) code {
   font-size: 0.78em;
diff --git a/ui/host/e2e/global-setup.ts b/ui/host/e2e/global-setup.ts
index 6bf3d7de..24b9113a 100644
--- a/ui/host/e2e/global-setup.ts
+++ b/ui/host/e2e/global-setup.ts
@@ -73,13 +73,15 @@ export default async function globalSetup() {
   try {
     const base = `http://127.0.0.1:${await freePort()}`;
     // Ignore inherited product configuration and keys; this instance is disposable.
-    const env = Object.fromEntries(Object.entries(process.env).filter(([key]) => !key.startsWith("FANOUT_") && !/(?:API_KEY|TOKEN|SECRET)$/.test(key)));
+    const env = Object.fromEntries(Object.entries(process.env).filter(([key]) =>
+      !key.startsWith("FANOUT_") && !key.startsWith("ANTHROPIC_") && !key.startsWith("OPENAI_") &&
+      !/(?:API_KEY|TOKEN|SECRET)$/.test(key)));
     const startDeadline = Date.now() + 30_000;
     const fd = openSync(serverLog, "a", 0o600);
     child = spawn(resolve(process.env.FANOUT_E2E_BINARY ?? join(root, "bin/fanout")), [], {
       cwd: dir,
       env: { ...env, FANOUT_DATA_DIR: join(dir, "data"), FANOUT_ADDR: new URL(base).host,
-        FANOUT_AUTH_CODE_SECRET: randomBytes(32).toString("hex"), FANOUT_AI_API_KEY: "",
+        FANOUT_AUTH_CODE_SECRET: randomBytes(32).toString("hex"),
         FANOUT_ROLLUP_INTERVAL: "1s" },
       stdio: ["ignore", fd, fd],
     });