From 7e1c6df3a09754f511c078911b9c3fcbf605d103 Mon Sep 17 00:00:00 2001 From: kisfenyo Date: Fri, 16 Oct 2026 19:10:08 +0200 Subject: [PATCH] burndown 2: controller 0.322.0 released; R-1033, R-970, R-1103 closed; R-972 narrowed; R-1104, R-1105 filed --- REPORT-burndown2-2026-10-16.md | 105 ++++++++++++++++ STATUS.md | 2 + .../architecture/01-topology-and-trust.md | 5 + .../P1/calibre-web-data.png | Bin 0 -> 172591 bytes .../burndown2-2026-10-16/P1/report.json | 17 +++ .../P2/boxes-and-versions.txt | 5 + .../burndown2-2026-10-16/P2/https-only.txt | 40 ++++++ .../burndown2-2026-10-16/P2/tester2.txt | 3 + .../P3/live-door-check.txt | 14 +++ .../P4/govulncheck-after.txt | 4 + .../P4/govulncheck-before.txt | 4 + .../P4/restic-0.14-after-0.18-nightchain.txt | 40 ++++++ .../P4/restic-0.18-nightchain-start.txt | 2 + .../P4/restic-0.18-nightchain.txt | 40 ++++++ .../P4/trivy-after-controller-rc3.txt | 5 + .../burndown2-2026-10-16/P4/trivy-after.txt | 9 ++ .../burndown2-2026-10-16/P4/trivy-before.txt | 10 ++ .../redproof/redproof-datatab.txt | 8 ++ .../redproof/redproof-r1103.txt | 3 + .../redproof/redproof-r970.txt | 10 ++ .../release/containers.txt | 12 ++ .../release/customer-floors-cleared.txt | 3 + .../release/customer-floors.txt | 3 + .../release/dashboards.txt | 3 + .../release/global-floor-readback.txt | 9 ++ .../release/global-floor.txt | 3 + .../release/https-only.txt | 40 ++++++ .../release/hub-page-floor.txt | 1 + .../burndown2-2026-10-16/tools/cdp_datatab.py | 118 ++++++++++++++++++ .../tools/trivy_counts.py | 22 ++++ documentation/backlog/CLOSED-ITEMS.md | 8 ++ documentation/backlog/OPEN-ITEMS.md | 13 +- 32 files changed, 554 insertions(+), 7 deletions(-) create mode 100644 REPORT-burndown2-2026-10-16.md create mode 100644 documentation/audits/burndown2-2026-10-16/P1/calibre-web-data.png create mode 100644 documentation/audits/burndown2-2026-10-16/P1/report.json create mode 100644 documentation/audits/burndown2-2026-10-16/P2/boxes-and-versions.txt create mode 100644 documentation/audits/burndown2-2026-10-16/P2/https-only.txt create mode 100644 documentation/audits/burndown2-2026-10-16/P2/tester2.txt create mode 100644 documentation/audits/burndown2-2026-10-16/P3/live-door-check.txt create mode 100644 documentation/audits/burndown2-2026-10-16/P4/govulncheck-after.txt create mode 100644 documentation/audits/burndown2-2026-10-16/P4/govulncheck-before.txt create mode 100644 documentation/audits/burndown2-2026-10-16/P4/restic-0.14-after-0.18-nightchain.txt create mode 100644 documentation/audits/burndown2-2026-10-16/P4/restic-0.18-nightchain-start.txt create mode 100644 documentation/audits/burndown2-2026-10-16/P4/restic-0.18-nightchain.txt create mode 100644 documentation/audits/burndown2-2026-10-16/P4/trivy-after-controller-rc3.txt create mode 100644 documentation/audits/burndown2-2026-10-16/P4/trivy-after.txt create mode 100644 documentation/audits/burndown2-2026-10-16/P4/trivy-before.txt create mode 100644 documentation/audits/burndown2-2026-10-16/redproof/redproof-datatab.txt create mode 100644 documentation/audits/burndown2-2026-10-16/redproof/redproof-r1103.txt create mode 100644 documentation/audits/burndown2-2026-10-16/redproof/redproof-r970.txt create mode 100644 documentation/audits/burndown2-2026-10-16/release/containers.txt create mode 100644 documentation/audits/burndown2-2026-10-16/release/customer-floors-cleared.txt create mode 100644 documentation/audits/burndown2-2026-10-16/release/customer-floors.txt create mode 100644 documentation/audits/burndown2-2026-10-16/release/dashboards.txt create mode 100644 documentation/audits/burndown2-2026-10-16/release/global-floor-readback.txt create mode 100644 documentation/audits/burndown2-2026-10-16/release/global-floor.txt create mode 100644 documentation/audits/burndown2-2026-10-16/release/https-only.txt create mode 100644 documentation/audits/burndown2-2026-10-16/release/hub-page-floor.txt create mode 100644 documentation/audits/burndown2-2026-10-16/tools/cdp_datatab.py create mode 100644 documentation/audits/burndown2-2026-10-16/tools/trivy_counts.py diff --git a/REPORT-burndown2-2026-10-16.md b/REPORT-burndown2-2026-10-16.md new file mode 100644 index 00000000..7ad1b6cb --- /dev/null +++ b/REPORT-burndown2-2026-10-16.md @@ -0,0 +1,105 @@ +# REPORT — burndown 2: Data tab leftovers, plain http closed, the hub-key door removed, Go 1.27.2, the dead install-form branches (2026-10-16) + +Written in ASD-STE100 Simplified Technical English. Operator brief „burndown 2", operator present. +Design read first: `architecture/01-topology-and-trust.md` §4 and §10 (now records R-970), `04-control-plane-authorization.md`, +`09-update-architecture.md` §0 and the release rule. Evidence: `documentation/audits/burndown2-2026-10-16/`. + +## 0. A decision I took (inside the brief; reversible) + +**The controller runtime stays on Debian 12 (12.13, all fixes) — not Debian 13.** The brief said „the current Debian +stable". Debian 13 changes restic, the off-site backup engine, from 0.14.0 to 0.18.0. The off-site code relies on +measured 0.14.0 behaviour (a missing source path is only a warning, the progress output, the clean-up windows, +restore without a lock). Changing it silently changes how customer backups behave. The Go toolchain and every fixable +OS package are updated; the Debian 13 move is its own row with the re-proof (R-1105). + +## 1. Each part + +| Part | Result | +|---|---| +| 1 — Data tab leftovers | **Done** (controller 0.322.0). The export password field: `autocomplete="new-password"`, name `fab_encryption_key`. The 2nd copy's status rows are gone; the form is the one place (its no-target reason moved into it); the warning stays. Browser (headless Chrome through the public address): the field renders with the attribute and stays empty; no status rows; one target label. **Headless Chrome has no saved passwords, so the autofill itself is not proven — the attribute is.** `P1/` | +| 2 — plain http (R-1033, P1) | **Closed.** The hub's newest reports: demo-hp, Tester 1, demo-felhom on ≥ 0.321.0. `https_only_check.py`: 35 public names → 301 on all three. **Tester 2** (`sajatfelhom.hu`, 0.292.0, off since 2026-10-04) is not checked: both http and https answer Cloudflare 530 (tunnel down). R-1104 checks it when it returns. `P2/` | +| 3 — the box settings route (R-970, P2) | **Closed.** See §3. | +| 4 — Go and base images (R-972, P2) | **Controller released, hub built and waiting for your yes, agent committed (no release).** See §4. | +| 5 — dead install-form branches (R-1103, P4) | **Closed.** The installed-only branches of `app_fields.html` removed. Retired tests and where their rule is now: `TestDeployPage_DeployedApp_DoesNotCarryTheSecret` → `TestAppPage_LoginPairPanel` + `TestR255_NoPlantedSecretReachesAnyPage`; `TestR709_AnInstalledAppsPasswordIsNotInThePage` → the same two (its install-form half stays as `TestR709_TheInstallFormKeepsItsGenerator`); `TestR694_TheDeployPageDoesNotOfferAGeneratedLogin` → `TestR694_TheSettingsTabDoesNotOfferAGeneratedLogin` (new, red-proved); the parity cases `deploy_installed` and `deploy_installed_restored`. | + +## 2. https check per box (`P2/https-only.txt`) + +tester-1 13 names, demo-hp 14, demo-felhom 8 — each `http://` → 301 to the same `https://` address; the negative +control convicted. Tester 2: not checked (530, off). + +## 3. The removed route (R-970) + +- **What:** the routes that read and replaced the box's settings file, and the hub-key access to the self-update and + geo routes (the dashboard keeps using those with a session). The matching CSRF exemption for the hub key is gone. +- **Nothing called them:** no caller in the hub (it never connects into a box; its geo switch goes to Cloudflare + directly), the agent, the controller's own pages, or any script in the five repos. The hub README listed „Push/Pull + Config", „Show Diff" and „Trigger Update" — no code exists for them; the four rows are removed. + `02-controller-module-map.md` marked config-apply as needing rework, not as a planned use. +- **Proof:** the route table is now one function (`buildMux`), and `TestR970_HubKeyOpensNoDoor` drives that real table + with real servers: every method on every former door, with the box's key and no session, is refused, and a planted + settings file is neither served nor changed. Plus `TestR970_ConfigRoutesAreGone` and + `TestR970_HubKeyIsNoCSRFExemption`. Each red-proved (`redproof/`). **Live on demo-hp:** every former door answers 401 + with the box's own key (read inside the box, never printed); `/api/health` 200 (`P3/live-door-check.txt`). + +## 4. Go and base images (R-972) + +| | before | after | +|---|---|---| +| controller binary | Go 1.24.13, x/crypto v0.31.0 | **Go 1.27.2, x/crypto v0.58.0** | +| controller runtime | `debian:bookworm-slim` | **`debian:12.13-slim@sha256:67b3…` + `apt-get upgrade`** (restic stays 0.14.0) | +| controller builder | `golang:1.24-bookworm` | `golang:1.27.2-trixie@sha256:4766…` | +| hub | Go 1.24.13, x/crypto v0.31.0, `alpine:3.21` | **Go 1.27.2, x/crypto v0.58.0, `alpine:3.24.2@sha256:294b…`** (builder `golang:1.27.2-alpine3.24@sha256:f92b…`) | +| agent | Go 1.26.0 (binary 0.158.1), x/crypto v0.52.0 | `go.mod` Go 1.27.2, x/crypto v0.58.0 — committed, **not released** | + +Scanners (the review's own tools: trivy 0.74.0, govulncheck v1.1.4): + +| image | critical (fixable) | high (fixable) | govulncheck on the binary | +|---|---|---|---| +| controller 0.321.0 (before) | 16 (12) | 200 (64) | 62 | +| controller 0.322.0-rc.3 = the release's commit | **4 (0)** | **140 (4)** | **1** | +| hub 0.155.0 (before) | 0 (0) | 36 (36) | 62 | +| hub 0.156.0 | **0 (0)** | **0 (0)** | **1** | + +The 4 remaining fixable highs are in Docker's own `docker-compose` plugin (its Go), not ours. The one govulncheck note +is `x/crypto/openpgp`, a package neither program links (`go mod why`), reported at module level. Full suites green on +Go 1.27.2 in all three repos (the i18n parity suite included). + +**Restic, measured on demo-hp:** an off-site backup with restic 0.18.0 (rc.1, Debian 13) — „backup OK", 172 snapshots; +then with 0.14.0 (rc.2) on the same store — „backup OK", 186 snapshots. The store stays readable both ways; the other +0.14.0 assumptions are not measured on 0.18 → R-1105. + +## 5. Versions, commits, fixtures, rows + +- **felhom-controller** `8fe46a1` → `f037be7` (R-970, Data tab, R-1103) → `fc77fcb` (Go 1.27.2) → `52619e8` + (Debian 12.13) → `e9d0d72` (CHANGELOG, `apt-get upgrade`) → docs. Test images rc.1 (Debian 13), rc.2, rc.3 (demo-hp + only); release **0.322.0**, MinAgent 0.158.1. +- **felhom.eu** `836d64ef` → `9d6f3b46` (hub 0.156.0) → this commit. **Hub 0.156.0 is pushed to the registry, NOT + deployed** — waiting for the operator's yes. +- **felhom-agent** `dd8b2ac` → `37b99d7` (Go 1.27.2, not released). +- **Fixtures re-captured (8):** `app_data_deployed`, `app_data_export`, `app_data_notarget_disabled`, + `app_data_target_auto`, `app_data_target_ssd`, `deploy_new`, `deploy_new_blocked`, `deploy_new_memory_blocked` + (the last three: whitespace only, plus one test-data option production never renders). **Removed (2):** + `deploy_installed`, `deploy_installed_restored`. Every other fixture byte-identical. +- **Rows: before 175, after 174. Closed 3** (R-1033, R-970, R-1103). **Opened 2** (R-1104, R-1105). R-972 NARROWED. + +**The release (`release/`):** Tester 1, demo-hp and demo-felhom took 0.322.0 through per-box floors (all three on it at +19:01). Nothing unhealthy, restarting, exited or created; the three dashboards 200; https-only 35 names OK; restic 0.14.0 +in each controller. **Global floor 0.322.0 / MinAgent 0.158.1** at 19:04:50 (`303` → `flash=floor_set`); the three +per-box floors cleared. Read back on two channels: the hub's own `/configuration` page, and one `tar` of `hub.db` + +`-wal` + `-shm` (integrity ok, newest report 12 min old): `min_controller_version` 0.322.0, `…declared_min_agent` +`0.322.0=0.158.1`, the three per-box floors empty. + +## 6. Observations + +1. Tester 2 is not checked for plain http while it is off. FILED: R-1104 +2. Debian 13 would move the off-site engine to restic 0.18.0 with assumptions measured on 0.14.0. FILED: R-1105 +3. govulncheck names `x/crypto/openpgp` in both new binaries. NOT-A-FINDING: neither program links it (`go mod why`: not needed); the report is module-level because the binaries are stripped. +4. The parity case `deploy_new_memory_blocked` set „the current drive is missing" on a NOT-installed app, which the handler never does. NOT-A-FINDING: test data only; the re-captured fixture now shows what production renders. +5. The Samba image (48 fixable high in the review) was not rebuilt in this task. NOT-A-FINDING: it is already named in R-972, which stays NARROWED for it. + +## 7. Teardown (three layers) + +- **Machine:** demo-hp 9201 ran rc.1, rc.2, rc.3, then the release by the floor; two by-day backup runs (off-site + included). The door-check script ran inside the controller container and was removed; the key never left the box. +- **Host:** nothing. +- **Hub:** per-box floors set and cleared; the global floor raised (the release). Hub image 0.156.0 pushed, not deployed. diff --git a/STATUS.md b/STATUS.md index 510106f8..d90f16a4 100644 --- a/STATUS.md +++ b/STATUS.md @@ -6,6 +6,7 @@ `documentation/backlog/STATUS-HISTORY.md`. Reports: `REPORT-night-2026-10-14.md`, `REPORT-immich-rollout-2026-10-14.md`, `REPORT-seo-felho-tarhely-2026-10-14.md`, `REPORT-immich-repair-2026-10-14.md`, `REPORT-power-cut-fixes-2026-10-14.md`, `REPORT-night-power-2026-10-13.md`, `REPORT-poweroff.md`. ## What works +- **The hub's key can no longer open anything on a box** (controller 0.322.0, 2026-10-16): the settings route is gone, and every former door answers 401 even with the box's own key. Every box that reports answers only over https (35 names). The controller is built on a supported Go (1.27.2): known Go weaknesses in it 62 → 1, fixable OS ones 0. - **RomM game saves are in the backup now** (2026-10-16, catalog): a save survived a backup, a removal and a restore on demo-hp, byte for byte. Eight apps no longer claim „a known, shared password" (your D10 = A). If someone changes the file manager's password in the file manager, the box notices and offers a new one (controller 0.321.0). - **Every installed app says where its login is, and has a „Fájlok ↗" button to its folder** (controller 0.320.0, 2026-10-16). The file manager is shown as part of the box again, with its password; on a box that does not know that password, one press sets a new one (done on demo-hp and, at your yes, on the N100). - **Every app but three has a user guide and an FAQ, in Hungarian and English** (catalog, 2026-10-15 night): the „Útmutató” tab shows it on boxes with controller 0.315.0 or newer. Every button name in a guide was checked in the app's own files at the version we ship; a guide that could not be checked stays hidden (plant-it, home-assistant), and Emby has none (R-1092). @@ -52,6 +53,7 @@ | D9 | R-1062 | The N100's USB drive is also its whole-box backup drive. Split it in two anyway? | **No — keep one drive**; the lived-in box keeps its nightly whole-box backup | Split: the box loses its local whole-box backup (or add a second drive first) | it stays one drive; multi-drive tests stay on Tester 1 | — | ## Waiting on you — do +- **Say yes in chat to deploy hub v0.156.0** (built, scanned: 0 critical, 0 high; no code change — only the new Go and Alpine). If you do nothing: the hub keeps running on Go 1.24 with 36 known high findings. - **Nézd meg a demo-hp-n a Calibre-Web „Adatok és mentés" fülét és a Fájlkezelőt** (`felhom.enkisfelhom.hu`, controller 0.321.0, minden dobozon kiadva). A mentés egy részben, egyszerű szavakkal; a Fájlkezelő nem kér frissítést és nem ajánl „Install app"-ot. - **Look at `roms/roms/` on the N100's drive in the file manager (R-1099).** RomM now scans `roms//`. A game uploaded through RomM before today sits one folder deeper: if there are platform folders in `roms/roms/`, move them up into `roms/` and press „Scan” in RomM. If not: those games show under a platform called „roms”. - **Nézd meg a Calibre-Web oldalát a demo-hp-n** (`felhom.enkisfelhom.hu`, controller 0.319.0, minden dobozon kiadva). A fejléc, a fülsor és minden rész most külön panel (az „A” stílus). A belépési adatok egy panelben vannak, egymás mellett. A Calibre-Web jelszaváról a doboz nem tud, mert az alkalmazás előbb települt, mint hogy a sablonban jelszó lett volna — ezt most egy mondat mondja ki. Ha nem tetszik, írd meg, mit változtassak. Ha nem nézed meg: semmi nem romlik el. diff --git a/documentation/architecture/01-topology-and-trust.md b/documentation/architecture/01-topology-and-trust.md index e71829c3..7f6dc901 100644 --- a/documentation/architecture/01-topology-and-trust.md +++ b/documentation/architecture/01-topology-and-trust.md @@ -102,6 +102,11 @@ credentials. - The agent and the controller **poll** the hub; the hub never initiates inbound. - Operator actions are delivered as **signed jobs**: the agent verifies an operator signature before executing, so a compromised hub database alone cannot forge commands. +- **[FACT, 2026-10-16, R-970]** The last contradiction is gone: until controller v0.322.0 the box's own hub API key, + sent as a Bearer token, opened `/api/config/` (read `controller.yaml` with every secret in it, and REPLACE it, + unsigned) and the self-update and geo routes. Nothing called them (the hub never connects to a box). The config + routes are removed and no route accepts the hub key; every `/api/` route needs a dashboard session (pinned by + `TestR970_HubKeyOpensNoDoor` on the real route table). The box exposes no control endpoint, as stated above. - All operator-initiated actions are recorded in a **customer-visible audit log**. --- diff --git a/documentation/audits/burndown2-2026-10-16/P1/calibre-web-data.png b/documentation/audits/burndown2-2026-10-16/P1/calibre-web-data.png new file mode 100644 index 0000000000000000000000000000000000000000..ead937fc39a53bceae136f6fb0a14692a4c03763 GIT binary patch literal 172591 zcmdRV^;?u(*e$*aDuN0U0s_(@oe~4mT|>9DX4BZVP-AH%W3<45E z$KloY`_B0n4nOUS>zN(*UeCJMz4m^>)K%s1amjJ9u(0qIeSw_E*~U%;d`as@hm?{fAG zCxWY^*}tR>2%RJHc|9Ev#hwe8;EuPb9T9{i!~ee-7r{K zr>u;B8(3VgU$6caQGJ6sS`=F_cu7l zgwpdRuOI6$=H?Lw8+E;2(LuZpn(eyf>meR&=V5^n#mwLegqWAdivnP*Sadu8{fb$7 zeuxI!u>1>4T(o7smYkOH4?Bw&jJ*x(G=!`|Mhrc=Xw@)zsQHkl*ZZ z{&e%vNwQ-%8K|H@AOG%q9ublrNv5Nag8z(cU9gA$?RPrn?+d+cDeY!%La#WI*yDP& zp9y8l*F$|)TqTXnH-q{QCiwA>EAps=(pVhcD>5Ln`d5}mtp4lTOwT6@mgVOPWt~@q zeIkwat zzWN2T4-N)tWJ-Uw;d?VKfi6XPC?Ox0;XGivd(L}e)V7~QwWfwAx8aNBLeVPBRq2r((eZ0s@3u*&yx3%F?)zC*j zr>1ft|DfjEh7Ma0biNPk)5JWD>2(s^6mk;fU*@Ito3C}utF9d$qYD+8|3s!vcV&E7 z;1M>S#C^kb(7Es87Io3(uWRs04T+W-FW)++J{RgNqjY}Z*ES3NhQN3w4EW!!3u6=1 zGK3{d&u{uHrlh>Qxfnbe78S^})Id%>cnFcDyz#$EZmVVFLfb=m$o_j}8>Bj#@f8yA z$-9{h4WZZ7H`OvnjKJpMzESrh5Ge8`+SC3YP4!_d=D(A}8X=%{;)TVw_`7PhY#h8@ z^1E0+?rkp+>FgU_UlL#RsH)AA+i+!^p{mgSvl^_dC(`rQlJ}%I?ENJdeH=0OEBB8# z@^^RHZZD6Fsgk6k6d9DuL;pe?%lP%GKuj-lOu_j~-E9l^v*I*`1^g8nvCM!nRpUnD z2)(yPWPiGSM;cnELe9xO;U0ST!n7Qr6)ouQqdD}e-7ls!B#z6BBz^`N!D4Ckll*%& z2HUX~%@@&^FYWVcX1qNAyZLjC7hEI-Rj_XYQj~|4z z=acW#NaNOj#zAIhXc)E^6`N`6mfIoq`LzdT?MR@s1vc^wJq>+#qGef{)--Ov64H1K!gq`oVG$3UvZKw^)>~DpF zH}iqAkWVzjq!p>uvP(-Xmm4F*zK_mM_H^(a zPPfsR(K#_P0sYjDH{6K+9sfJl=TIdDSiI3scP1kkT2hn1K_CLn|5yQPpLz8QV$>kq zi2EfcN^HrOLHIn1+O)iqTelYP*zNSBOs$`}s){S)IROvfxS+XZba5p1jOd{{GZ7Co zO>{MuCwHjZxFON~#Fq`Rr`W*;RW^IiY*R@_bo|XF&IWyOE_bp!vdHG!v0azEo&1J0 zf2b+5)4YG9LLgON&p`ZYT&c14COzeq8t@=jt-0fUMINDx9q=k+Hyox;DQv=m0}29BW0A2#9g@52K#X~4hjFP*EUz9AR# z0Dd@ogrkYU?rllGwYHh3zt5Pz`6RKVrly+7p2ig0xc)hKbKQ)+@!cO_&I3a0;*}>~ zVKYTN0ee*BLk5>_UwQB3M#?Y{vyU<&-xu?NjMk|`a6#5-DFN5CUW{8qS` ztT=T+Sv8s4=cch#Oh%YKmtYM(LU4K`(=We$y;pgP-mwb|{=#W+;4BNV^H;U@Y5W&1 zSk9yijRd*~hYOZCo^c5-(Sh#yfn+o`5b+D8+p<)JNtUK{ELDM6w*}fS2B1)#oZ^?S z0ahLAw-P3*Lf)N1-bf9OBwqTS!a*wqtdmpl^^!=G=xxUjPx14kDe+Um@i?B6wEoP!7?x7TK-VtmgBK zo~jgbjIwy>NxE)bJHy7nt;(8khK<((jg@!hrz}?Rp6q8@ZlB78oxb7NLDp!GDkx#Eyv?3S0RR^n1_KxpakSVRzq@}@G8!w53u<)KRal`B2&6Mk4G4Z zoE#Tu!u$+Y`q|s+fB8B4UclgsOyj1MybOC=C*RGHTKZ!uLU zNuvRqG#e*rX+>3s6@)SBURNWFlWq)zVUV|$+dV(7j6h3RJo6*!Tl_t`rb{2S+$Zq$ z*iIU3Ow71voTyCDK*zIC?%Zy*n9$Dk1v_hNXgV}|rd3jAv5EsB&0#NmsLw`HuFtj$ z7%;79c+GjbI@5EK60;~!bn9{WRj87bO+`&bxXjJo&#yQr0jyxwB3%1oh79!re(_=E zPqzBlxNQV#Ve!!9kuKY;E?W|FuGPAG*vEfXlY~+Uw8Q0M*y*-KR&h%+- z?@toDs8ylA#D4meot=X=EGA=AU6)kA_jsl!7cGE?vv!4g(fhc3xaop}rPn$S79EcM zTK}Z=>UZRY@PvM~(v+wy80Z7Qqa;{aU%kLE?SB9zCZ(6Jz)O>rC&%?qIZe)g?~D8E zYv|Znn<46PmEP>2k$oo~pZ?^)xlrhR^;H4`fp#YqA>yp8tW#+{+XIMd`jX7~Q~spx7muA~oz!Sq zPT{5E;q?#=C5qeSXk_0Z_1$c{ImL6RFFhS8UkMmhMk+G`0yd?sWM*mx1K11>qNz-m z#>c`T85`8;VU#5`i za;dXW;cE%bKsa*t5IH+nW268MZ!MkMUuv%V6?5y7$MZDgbA}|4!~28na~}6~OnbVsEo?3+Bqe&mtnPHB)AWh1w=SSBG7qXtHvh*%9)KH zho_icpae*V(&j7uly^EK{vRKR%)D>^$X8kpVPfR&;c+GhleR;ok z!!=C0YpZa`aH0NmV3mKLS2$Azu8cQ#wq~!B$msJl&1WSt^AJ}NL1ks(=wZIEJ3HLz z=(vKceMS|*!-uvM+Y7;qREglVK==YDzdo^wYMWX=gpfRuV>`VMMIp3K zx2L622e)_FYh{rwJ+=Q*`p7B%fSU_8hJLAH{Cu*1VdXd*baS(TIXNsQd6T3Js5q)5 zSn)TQ_3{?JXlL@M=FMtrOac=U;y*a!3JH>a0>>iW_sLuFsKJ*o%)#scg9^vCczMFs|MmcX}L++}rEa@7L7g@n&@ z1*b-*x<@<5!=y?(Y5!K^-`|yMAj1F03lPYnEm7}L?@P_eiA+G5inrQ*=z$A^R_jK_ z9=7~kltpOG&L&ff6JHyo-JUoocQ`>4IFep>7NF6I1+>&Acnh)%3ypZiR!tVHqB<3_o@zq0F1GG?7h zG!1mLmqt));S0vQ>uRrtU*R@7}Cz%2g(rB{4{{$EdC+(A) zsS)r8@#B=e3n|=Gn`Z&`wq~;?YYmXL*lKEzla^}Q^7YK6CEUj+$ReciO;2|>ZLUbb zj**>S!G1=7SVh@~wNK9 z4Qn#~#IGNzI4&V?6THVi@^bA({Ix)g1)Py}qlO!53^K(g0#ZsX43<3J+Tiqy(GGeB zU?f-r;-a|bY{H|IZb6K6^OLdKn0UtKQ&^+=e0ghfT$V;ne#jc_kx^Ki!OY z{cxLGLx**cBx-*LX<{+nc?NxA3TRr>6lg?Y4;IFV`sBFl)@W5@1}VCLFZJbdBBSf@ ze@2N|JNrG8LS+3HoA7&tF2uNsj8>y7(N{|YEbYQZ(v{5P!rqE+f$a)sF2%q zB_{mxgsAY)QSM8dX3)(G0_Q&h>;3na%-TjmQhw#jZTF~TgD)C5Q`1t8e)F2@=uD2X zV3P2CPN`d-zwnI1GmUB#vgu8&uV*-B1O7I;p1vKoOevE1*$;3wr-q2X`%%Cc{T^^Gie^4}VTA#7U$EW2n($u8(-h@DO?g1il3g!x{ z6-iQMz(8}?AvseAC&2YiW=&@EOEs{zL;3r@$@%?QdZJw3QkIZ8F7xuwb77#r1cY@_ zbPsH5l%g#{>NeUjwT69Gf9D$j7vA;Nh%F8smuaz%Vf3tUF#TQExUkj2sEm=Zwb2&= z*GJ!Nmag8A>_ED+NNN~#0Fb68gKYZ)ow$Kfg|{E7B(AvsIuco#6psjWvt6{`Gr;(G z`O(eu!qv~blSreTf&LA{heKRiV1x1 zwwThb`x;-C{n;R_i_lNcU7*T@WAXI!JmkY&?99k*XM%d8gVR3 zl%k<%dIp(#;Tfb-o%Hnc%%vM)c`#75+7k2WhbDt!_zY?d#^1|kOcb0rkRtitWW_07 zKV;?AM(HGgdWTnIztK6VI9{u@?$*adtAYc82%^vq@yTX|S0lb>ooM#vD~!)_Pas ze;^STRHrSGos4LBX=#zOWE&RcKK6sMzyrmVr6 zA3#?279~QReLp((PFQv|Qf7KcMA;u@LgvIgQ)4?}e+l8D{*Dl!Y~h1;eMR-yux{E? zbW4#khafk%`h*3=vokAhs5N6Sp=~#KnWM6{vZ~>FNcQ3aqWV-vaW|rTI{YI+1&otr z;Tm#hw9IjLfd6;8?}j=V!lDMX`+_3diK^|FX0YA556(p$Bjy!PZOOc!=r-x<8_Q+( zUv@s5yP1XXakj>z`D-RO8M|=U8F9|)5hYR+s_qP(hUe3l2`x0~jl0F);uW3r1^y=K zkzxF_%hf|K#qu&1Ix12B^WO(b&jzRpVa@XN8jHf81WU_=MsS02=0yo$_bck8=TYXI z`tZzB`yJGswd9y+odCHAUl}6`q+`BzTIke$Vl72nD4O)wlG@(FQSGoQXU@owq&Md# zx7h18z2UXueCdH-V2E^usgy34kr3@1-!csFAwfNw4m0RkEJ3 zCdk@aOMAlids%F^F3z{aXX*0LlfCLJFF{T&2K@gGk~1ww+mx=Nysb`lc#2CHnW=v( z=2~zP2@-F#570V`mQejR8IRU!7#L|=9A9|%`S;Q-m197O-CBYX!0PwQ^JVUMm~m95 z$DC^CEo!KpQ@o6oqV&ChNNAQv_ z|BZ0_N8x^wQ6GLDkqRm}T1mC14){=#O_NClaJ%U`ZT;0dz`A^dp_Ro}C8t1d+JVd+ z-ch*|PRckMOUYO{T3I=oD-O*(DYr#=la|o)2xrQp+&&evtEd#Q+3hyjrTv5671d4( zX}P~rLmpjq`Cq;JH-FUW;(rfSdPM%xT*J-8`0V>xskp!7kr)64#cn*2 zqZD=J=H@ptsP0Hqw7lk<^>myqZ62$!K z|7#}WSa&dxliSy$&ro}Iw`ez|&0(@ajx9p^>U^usOkoPQ6Gf^~+ zB5@80XrH;o2LHJ9bXak|U1mJsiXKFjVWQKKT+EF7MqBOB`py%JY*W64%GGSSe~oKrWP zdZ*YJBtv}XVOhqvBslp6M&mt_F+Ys%T~~y~eyjEc0KT=f#2~^lVzRRlh!!YfbX?Kg zGK0yIL~%yYp5i`xoVTYry9$R5DLuvF+a8XVUM)1lrO5vQ0qMWQwM-@WosQ$~=mqZaNvh9&3e(H|qP?ZyRl&H`9n2XC+2j8oEQp zJsa^>8n`SBaZh{h$No*xv+kwRM#zH#GeV7-S1`%!cm-l0izcH@-$rCN0dGo)SCL}9 zqV^9*;Z_|5wX6VSe&J!B-CnU63PuipqxT94FVKDWtiYd@?1yk-St8+h1wFoHGRs|R z?Eg?;J{4c~Ks#QtOTCBe{^@JWzq;}1f)s&nq@@8zlqk`c3hqIkWFBk=b)Gt0G8WX~ zI_}fJQMz_KGBpk}ULlApNowyJOR`Zo9B%1GCfbtLPA8rK%m5C51on|B;~?NXT1*GKzXs>iwmP=x&0%NS1%Y7;E zgNo0zLWwtsz2|?EDfvPKfo}1EusS_+UvD6cJief-Bl1X#sRYTv*ZH1{I3B&d(Pb|e zb5CbXChw*4MB5M^NpBS%L=W6l5z9h={QO}JmWo1hPG~*Me}RY{u;hw&H>)W(SIz{? zd0i9%+deow_9KYv6{tP6blYDhK>a)HNVqaBlC4j@#|4kBYCMy+B!~O)Xb67XZMmM- zX^hy0Yk09RWzy4Bl?A~P35i%X#K>a#6WXQb#>byZ26h1tFxtR_ca1QvyRP2d{#ZFs zSjiUU4Em?exHYVfQFgOk@?i-63D~7(u#bg}jTPX@B0$H~Z0`wWC{G;bb#`$*#&}p& zPS2fCT2}T-!%CA%p$LM7{H7*h_DjaNu;s^t(?)=G!@J%;Hh%M^w@94>Vig}ph3;7H zAJ6y<-<_6Cq`d_%x@jdbua9?dTP#9ss~ZcOTUr)9cWTGR5)`}c^L7JH*UcfvnA54H z0ma;Z7mbCLmAU=!PG-Irt8(y<@HI5nNq+i#OKVHgJR9poo%s10kNVN>{;837 ztuDKLIkB;;6_T8urKmXBb9~n~rA5soaj_XtnIEF*GQCI3JGvc4`tH@!1%;UrC-#lKnUEet+O50h+TSLG*M z7dUO_A+3ABOAf**j90j;nSxi%|5NT!s78XM_D#Qw#kK6fhqfk9?ap%$cSpZ8_sb7Z zPbQmkzSWUfCsyXGdRZ?>YQB*2^8dpc`X-)*xYQ@TjcO1dVT8!Q z00-oxx|GAX5y`O8NBk8>6Xen%2@8}v>T0|kyC3_DXmR2?SR0{iH8xm5jF%{C`FV7x zxIA5}d`)R^G2WrX_e{C3$Yly`UjTr{C;z9$?1kM1b|||Y#%aItfHc%zt)npKKAh2_ z4j>x@6!h4FF0hOy@ag`U-A0Z#dFSjLvbq*ubFh7nMh^}xu{;{ zyb|t^npo4-J_b}fRQq7&qtskW6X?)#5MO;C8#OXCiw@y5`7l%)dF5+l3W3xor4HXN zdQ0*yAq55|_ToG<%6Mw?XC-vBw)iBgwuuLQ3l&gkx|AcWbm+dLjQwAL`=tXSBw~VHgIM2D5uKnhVvU)^k@orvlNO1Gv01z|3KA!dhUXm_E zZ3xtnQCo2p%51*!dlkLU>1r|%M ztL+u>01P2ZT&&p>w>5C#7U1;4Mlo3H)UobW`q}K|65QHSUth1-geOF-D!Hth+tbsf zg+x~(*pbb#^D){PnBO>ptCzp9s%?Mq(k{&IIfGlAc7Yjs)QpM)ky_O5*|j|+)1 z1rFm<{#sjq?`f}G8D3bf6S?wheid$d&cn?w!}x+UVg2^^+~jJkA|w$JMiZE=I7Dv= zsjF{j-~%g#H$M|UYW)K$MDsq4pbf%c0q1yVnvq*_%X*DSWQB5gTEUHlmRr=q8~ za;tQq4v`@v?0deu9}CK#oS4dJagG^xov6I>nM?a7$V{iU{8}Luk3OG@LuHrlP!i1;@6{7^Pe`AUTjk^rU#7K#3si z{Siw`*LgcG0?0JA4+}>2jjw)gb zHiJ?I2EW$N=R-<4wpOjTh-wP<6BBh2a;T&C3LO}CH+3~-)qY!-5s zcVDsL`GGvl&(3=9&cW30S*)xnpshHlraX5%T0cR%T1$?|feJR|o5pM9^d{|+4QBEt zPJ+ykZ+K!%SH>Lr-`$Vx+Y8SQ{^cX~0Tn*@TM>gexztDn)Wl?$B!L>LK!Q0>xZ#wI z1;+=%2j9l|R0fU<@3X^%rbeXmATi<6S|YjvBoV@%Zd8O#39qOoXl+vUs-{eOH{R$O zDawNJNKOCTX!grDYypM<6W!>9_)>wVFs%ao# z4^)8VSuY8K=>c{QA4YQS!7TOklM&tW+KI>6P1g_J2PvyA)I8pGFzhe3rwfR4=qH*4 zn$vWyEuoFudQ|9kvSzh3RTXBLS8Cq=W6-+^e8usfTTzSI4}BA(0CcjBdWkO0IP7}Z z+QrCNp;t5+nV@LpXw3fjldE?`j;#+y!Rp~!BsVWRuNnZowkwG)Na5F_le*6&M*-1$ z{X9WeYphpGNkyyH(Z2RcVqON}xS-s8utD<+inE;9lLoW$1WUnWo^qi7&XuJ=Nbd?u z!XS;o5O1E>TdO~X6V^q;4W)|$j*{ZwWE#(D3wO6_CUF=ApM9F5%o?H+Pm%82&cs~N z!n;^*jnxpQ7;Eiz7(S6(nICmyanw>Y?+zZOk@#dLh4V9aBcU1$#yEoKTqS)fXXk_o zXM1l(f2Ob(S%;Fx$7_#?(rH3(KgbM-2}t#+8|NraFnLEaN%!$?C>Cx@a>vDT+ba@( zqf()qty6enj^a&Xz%Ai>{dx7j^NV+;Q>}CyVMR6^(xfE1({lppPLQSXm@ZlBmg}FO ziE6MYhhbDVFE@V$kKmE3=c3QLyS1wD#2Am8E6`~(`huOTrdr^3XUj9g>mY7D73B-K zS;kr#Y;A!%k%3oaWj#nzr7*7vb#`9;V4%t#2(~kEDw6Q#38C3E0hoC<+1+> zvYFj+toHNO)42=by0OaUtr8kVq9;Y7ZzUIWR!ClZJo)e{R%0NaG(9G6b~=o8wPJ=y zL{LG%0jJaM?jBkMl~)F`5XjHPr=1YSKpVb8fV%o$)d)rkFZ?>J zco1-xhNwAZ*pDCMx!ztH3447W1uq-^@^VJsbAyAbu!*^=_YMx-c?h>6AQNlLB4YoU)grH{693Em)F>&%<+%wD0WJs z7u#13BH0}Z`*E2+nv6Z8Ezx2vEVfsFR_pXySN?XUeoJdS0c^iHn8wpLKhQJ1T?4UD zu$>q@Hi9+@4fR?c3S7p^^G!`0?l8p2=VZJ|>g5+)4p|bAF%CWdb7Ce;I2svmcIE%Hg><`Z8==% zvn$et{Q~SgzkU0K>}SphD!#lPIQ$M=X_P@_n-2*M`Z}vGY(ERcSA?=T z2)4pmajs{J%@=zc`oC_79T&cN-$ ztxO`-$MYQ8z-2|-JnNeX96c0@;ocCX!|r}JwDLyCH(0ADUg0GVfuUY!j%AUKsY}l~ zTTFTGXZyS|_xFigaRWt6tTc^`%aF@F^q<%%i%d}NG84M z`iUtW&FdH5NFTKKzXfrD^@0E{B(nD+$WfIk^WNS@fUJ-6se*3v^~|%2+!iXAMp^LB z0KsYgK`s?KCp4|06w0o3+cP1eh*Xz|2 zR_S>GnpH{A&gs@_jRG;J{$RT&WLG&HY}20o?Q$9c&so~|w#P!d9h%W1^_H*Nhxj| z^i&>qoSzOGG;H6~R)U$|1ll879Oa#}U{+(cPe?gTY@b(&!ryRxpPKASp=$9GYG`TM z=*7P0FXrJPaQu5>n__~WU(4qBY^-z5g-%v*DYK}cfS!gW=yT)N&+2}-O2#`xNwQw0 z^+M&H%zh{S?-g@TXl~#&MX8t|c(jgWjC3&b^2U&p8sLwvEcNdh+*yT@rlKLmuN@X``xN@5>Fi8b2zf7WHkC34FHX2N+oj zq4MAC6g;ICoy}>x1hw*5Dl93KaI&K)D-_~e>J7p|Qg%}!M^-X{7Vp9+qCoFTZ| zuEjuBj_)7uZiAG+ABtD72x)vfGdE{oWxZvyK|~L;c9^bcEUPn=yFH2jJwihfaQQ7@ zM{)xSPh?V`q{G7!^MLW2c|*$A4$jZ;ZC2Rd*&L_pm>Rpp9GHiA}{!NqeV!@cQ*J5?rObt-6 zUb!#ed%m_bZfs@dbTddwU2wF!Q8*=jwWJ%?i$LR;(FBS^_W6N>bnPW2L!jo9tBBGT zCCnG85Vd*besz471g%?o5+!q|j;L2us=*3viPF-8m5zq-j=gRl935faI!9$@+2|EF z(h_ygxdGd_iI_%Y!|cF#JYMwdja;U$3OIH6wVK_#m;cXXW$zl^{61DUChuFC3ejRT zOgl%d{(4EYy}yex(aDXTpNQIuwMxLpR#jPmrFe*Q)&B4>5fo?8$I91}6> z81JBG?hzMn{WzY(52qj_Q++8iJ2MkQv^qM<8rWL$4oCT$2 zDs-S8IF;$n`gWEOHxtu-Dz*QD&vNLd^x)KW($Xzte^>V_9{#vnlw5}2?%*?p6b8r1 z5(6Z>I~N`|QU{(ZQERzsk%5eFq|YNLQNP~EFUs^Mab&&OszRevmTqVNy%m3~RyR-d z{oVWb-S7 z^s!TOXjs@!(p#UTq1qJrj<-7= z6O2G{4)?; zaL8)t*{oj`vkc|M4|MB&ikUh2Ep5Gvjhk(u)Q)K>La2A#+#(9Tg z@x#{k``Z%=&Jh+>#<ZPYY8?AX3=OIsr!DAk3AH?p!|IADQ-6;i)A=^ZT32G%tBrz7mtP#X073DFtv9Q5 zl!bea4PGd6!1Lw(T(KnZS@DrW?|d9QXWLAW)W+Wa4aDn%*HKuVhQ^>Ai>J4}$fbKV zmt)@pNLEeF-dQiN3erL2*VVro2rV80DjT6-A(n#MsC4JUn~ zrL|eMmHr`oU~I1Y?vm<1FQ4CKlnX(sq(+;5Pj=N76?s)^e!tEX_~N$)FJrfh45^ra z>qcES#pr;jg(R3J8++)Ds2rT)9cQSz|UnWV)W zis)r-w+l<8&r?bv0&d%(GuvlhUy4}F{_4~P8G9suDbY3YMS?FcaN3SITLBIORhOj2 zIrea=&-ar!_1_HxsJu^F9wy!#cIOAw?9o#csbcm@hTLpa;0@@}gb$F9c`>1ewYT_W zqgv|C?id4q2{R9mG5zj1Cv9n|5WWOog;y%_irFEJ_0{Qq4de2^b#y=8k*FFqfAjvb z24-c9*T(%KquK6X0&4`l^)7(lIatHTM3}bb3@Rs1(dKVdjA6%}x=WNizW>YwMX$Ut z^*fRRFZ%3u!YP048kGJk1k4D=tOxv@y*iEs7n_SEeU8r%ZBpHF`q^}hx5xdm7rstdhdJ1u?s#!mgPKMqKIp}Fy#m)YVzFj=uu8b19)j2Bnnz6&o zo6*T0c{QcqI+8?ax3*eaZ|1dahdvI*30BfA!JIxD9j%OsIY5U{KY2thdGFtEc(AVL zl+=n3U0Zk0rrGD7sis}3L#*eLG=&MhCEWN%h9ep%j_Xtyx`T1noQ9PvSfLu=R=79hn3=_~*n1sXb*v1D*P^^Tlr>~K96a4Q z{Uu%`WYrsZw0#da>$j3n%m1v)|2jQN0ht}bRO_bp-uRV>ivi%(q8G7M?8^yHWq{wN z=s6kX3#F*1_M!m^L_UH4T%lNW`M&}8h9*5$P{7pN?|x{zm7g!*+n?s=ufF8v+uN%_ zxf0t^o&B;!dJXE$_c)tR_DY%`DrhI#Df`WN?D_39t8ME;AWc@a|K#PLir*khN;0T! zPFszCPJu?+^H?vtL~b?3BTapeG+kUY9hWwB^c!uKdei-|li2LUo}LHkF5VTUSTk10 z@=%q5ACWGu3^tgD=W3pdm(WvA_|UK_Y=A_0 zCf1Xy`4gIclo%E5AI$|SUebMP*V8AzbT&7P?ncGQO;qxXf^II>YN06G;{q+l!NFc6 z0+A1yP2InVdOE%De-)Hl`2>69blFuC>w0?myTqO1lXmMHx@O7+O6%>2ImeMsk*lZujc?grHgU1q_C%H2 zXHgprhQ!q41V?`_o2Lm;SqAYin8%kyxu9YvXX8Bt)pDk zVQA%S;Gt@w*Ylo7-9%$%^`dvC-n*t|((>Kyq{~88287A;?)`F{S4FyXE40XgKv|be1T4kN|4M05SZXsUG$!Tc{~TqOn#hhs*3fNZoce@=5L-qZFmuD`YKBy zkw%v zFDBiFGesQtm)A+3_pCS@83PX8L|Teof2Rx%eKHbteKtdplADyXMip=%wHr~_C~WtQ zDpK?gK`64BW31lk^*BF>EXf2}-mjCZu^pXKFZCl=F#z+00fit^LEf%~?Ca6)6a$c% zsNNf!eb!K4fOtn)`RnJv`vo4!FDVcq-FH%YQs*16k?KVN=ESiPf)S>4x%ShBuZ_YC zR{JLMEymT-0ctH%uZNQZo6{@f0vqlz~W9RW7r0d zbm3~yX&(aJyOU%!(4~qOFI~j9y1N3H-MW{;Ry9V^3a!sh(QjESvfuV6OYVI0NV5b< z8+~|o4&3=5+uTTY8qqsRdKeUJw7HYZUP2O{jMo=BcicSC_j(P(>k!0ar62ffkeg&G zTzc(h$T6Cgn#}z0nva4bLPD?~5mTRBMn;`4Oz!5v>C9{!J@=B&k4|d!Ajdc;;yRLw z++27YK5)!BL3UX9S*0c2uK9yawsZ;o?vk*vYAn0LPs>T&xZ+AAY)`!4DGd$Sn8$zt z_*?JmX}5lfh~AaGGJdK=y5YvEW1C8Gbdx~e=Lh?tt*&U8qtUQa=c?8r`a>Z)WSw++FREFuL@y~THTw+INM^c3h+iuoA1grwMeP> zUYi}b$+>BWk_u(OT&K?owUE>TJ}HN>_A^eCtlb~Q^!HO!7d-Ca0Vn4gP)XfX`YrZo`EtwFDeB-`RhMt=c@o0J>l>A8*Ye1jw{U6;h9iS``D%-j%oS-mB0l3O#!xcsBKGoA#%q zIGv~F5a(23Z)S8z2%qt(kA4<+Sh`5;&UnPYMd>nv4r#Da5Oicb`afQPxEsn>DH^@A z?YZv##j16yy(5n1ZhfuNR)vABF9-ovzL0-@j_|{t(z0#clcQ147UMzSryQh^Fojh;e zH&YNn7#2V0Wwi6vHf~#qHipnVuS=r!&MSHF5HZwBDZt0aJQ9`Rb&jrfaw;}R$}C}N zNDnC*-WpC8ww+oGJT7Q>*Vhc@D^0n01zL!aS6ITp2QA7TgNF0%w}^;IGy%xJiM{t5 zg}|PxkI3GJcL)dhgX^hC!h;=npL}^do_Jj$S1$5gc>UCy>~IE;@MEh(no>`K))(GZ z3FL?cub7aj3y&fA?ZLjFowXPF;{KR#YT+%ReeR)F$OBN5h7_Ju4c&gScNJx6-1_ky1%)A@h|1t>3s*%{rg&y) zt4()+J`|byXi-@~EMRlI>T+{>MkrJoxi#P030@sXfvds08-}`qQN;Gt3H??9R~Hrv zE{~o_z|~3IM3iWHY|3KJ;QIez>?@<%YP)Tzw@{$PiWIj31qu`=P@s5lcXyZI(v||n z-6goYJH_1z4k-@7N^rlM_dVY^XWSom-2IC|c9Ok!o@dEibIlcKNUGBk(`~@0TdCJm z9Z1-KukgfrZ%F zfsrGPzrq4-k32_?;HtyTyo-s=Fujr|>pvUr}axOlknv9>?-OsIpmJ67Yrw#3Mk7Aw zCI40Ou~;0g=kS*%WiP{J*Cq_gf6FO0MR;VrBk#HEsV%s6)H&3X^jEinT|lNTk*&|J zvguKxEcCYMS-iyU^|#JNL4O55)&?yD!?9}goX3|>7LIiZ%#S9-k5$DI52Z_>O)VST zG>4*Ut=RgJYBc1RwLpMC^GHm6sjV43B?2k1o5H3=R$nS!ih{ z?XO!m74|x2P@dr$nwiO?WZKDYY#iw5=$H}sM3=E~K0*StOtQ-{dl3pPv&tZ{!hl~q5*u?1Quea%*JsVbL2Z5G%%lO1jBgQHH zz3*YY2uph)TfaLRtmF4hIv8?VpY0DC7{K7Yv|S)Mt-bwwdOsB$9ZqSf%5(_;$>F4n zcMGGs<6Cady|J2)6mGS&!&(^?(s+FWTVI4UKBBux3v3)y)Lf{^vm7ZVK&$}qKk}}- zNK-&urL87N-``)l%)?!D^7}7QQGcJ}`yQAGWLTewXqU9@cBmjV+WXihl}@@+D|l_0 z^R`Oc>+$|OXmg$$boSZ=>~_Dex~-3Vde>r11j}mtD>Ge52_y~om$r58>XmDVCTzt} z*y-r~In%TBC~?kCguGGK5M?_r*1Wj;o-5LpBtW)$kt@fJ>mDi=hfA}6q%2JSK7vW zUV1vH0o~B+O04G|J=_8-BvU84<>q}i5wH!Z9UH1s^7%uG|Nb-A`g#Q=Q2s^8!oAcJ zpffsyiz!yf$%VR0EiY0y3RXxk>haEa*TrlZ|7Ci8zS;ERC8JI0?kYlNYaulBR1-Db zRv2(0_ilf`@8r@9tKRlAf1GPQPdF1fXtQ07t|Ohjxq1PQQ$4$BdFqs>L=Saa3H7u#wyF*4V`yJ8rP0{96)HhvFuh)i~7^KI;`h_aK!OYtE z>StWK6)Ge&H8Dsio}5fnBE$KwRpLp+%@5%B&Y*hnQ{$%vOb74=ZWcP_0=b05hdR#t30KrLF~eo=jr^S;UVwJp5neuaH-=U5d$@l*Ml*%)X?yZZ%+|7h~s zU0fXNkSMLS*X4!nj|}wy2DpH9>W~1tG^eQ4>CQ2URgsP8H(Wy<3>b zGr9A>%K^GhD^te%|Gik&R7Eqjp-|$oVy(7FW=NY7yLNCUNvPv`#<)u3R%%suN6}ny*M*z^PO3 znj?}dH9o^mS$gF@xCEas1!+_I`;F(JW9NnuGU1N}V9RT#6q8V@^Us_mw_5!KT z+}{qi@Nw%tt#eHm4SIT}imDp(rBUX#dv-$vRb#oik=dK~@5v_XWqYpR_cTp^0rYRj z_vO^7ETNmO*X6J*fK=qTYrI?TpLfZwD*Gb_^%kC=JddIHObLoiR!tx2LDBwXE7soL zEu$+d4=^3DHi3WzgMAr#HZDvZIrqby;k#D%8CyNcxEnBTu|b(36srl&B&~D=pTSktuiHWdaVBi`1K5@#Q^4W9AA2O zv=uj0yufdF(`3zgS$=mxS@hYK+=H5DGfTGBeWN?CiPU~@fL_;qf5`>z9;oyZh8-*= zdB4zl9^O_v<+Ay>kE)38cs04{oLHmAYCK__@-wqG5mEfbPCQ(<(IFJ^Dn83l{4|^- zEG*1C6+bJJsr3SUoH#4L#jFUbuF>{rJV@qO2YK$T(-ji0gCZhgB;jN(uCBid0wo}! zh$lzkyPP<9cxBoxQ=`4fHWCBxc+cPW_4jA(Rxn0z4&A(%;X5B{Y^cgruZA#e+WOqY zTJB6is90qVrDL2gTU7l@a$*;%_O_hgGOFoO zv>@@I*;sQfPT+t~FD%4<6D>#bs!`>(&%?HP(LGa%{_ z=%^RyqWc$`aM{9pA&!vR+FB-h`jL@-WoYg~QRA7+bn8PL5E}9tw6ye*aX3c-04K*8 z!wdr+6`N>dLXDO)N-$@ck!k+dc-8BR|(t-|fsceS;qP$uHoxLB7n9QA!7iOi)`cw}iybd9Z%scw5? z<5j|}D{A_A$+D^vWfb!nCk<@LQY4d8Ce{ZcvG6YG`*gEuK;p)99|=flu?@Me{n=~! zc0IVt_uBcq-4o631<)CF!bTaeglEqzQpB`tYhj zbt5Z4vQN183~*6Yn5aB!$KlHvCDr%ee2@5&dl13}sj$ zrOW2iZQldGL(Ae4o8bDKjru;ShnK#vJwP(h>camJ`aTN-mQ$8%Z^7FX7nS;7US!=T zI+SgJuBe652rILE*?;K6zZoAMjf8f~7ssiwZx8=-!p(X_+kBFA#sJQ<+xsSzASv+Um{fvrTNS^g_=tUmxuKXsKXv`2wGd zn$~E;)1DMNi|ky9Vr2QuIZpXiQc4_iTI=o&3}Ya@%9QrE2>;>wvTOng*#}#X)@1e z-($d%uSVjkr>|;WkFk}e0%?0SUEc#f9$kp9LB~?|QyK!D8UwiDlkRbfL zGTSfy61D+nhZ4U+GfYAE1Ics}fr7rm;`DEVySGL~RaBIQ61)V=KVk*S5DQ3l&@V-K zrs-4~gw}=Yiii+|=eex^ZY7#2i`ua+jdAjDy(dAF+TE$Lxen4FEwxr~Y_vMVRTX+7uI^tvxD0YACgTcxHMukh5w z_~QCme=PF8<(vlQ=HgANt)&GhfEAt{)ztNmVlKN$Q^_rfgX1}eV$9hBLW9W0l?s$L zH;t%iyDUdwl}FajnQ|X0+1Mr~6>p#X@VPoe+fNM%OBkDjWTXv;Vs7lhR?60A^2!)(E!omw4c*wd$}`(U=8Z#v?FEf17YL{ zZ1fQ72-w=%i0V)kS`2MC#&dJO&W3}>TVEE05DU2Hi=dEjn^<*SNKlz%=fT(Q>+b~H zgX2EF3;t?e(C_r5?RUBlr}alhI#fVejNL`YT6(zj{*Ih9X$jPf$6udWS=men1t(cp zn4E3gFVlh+=D7I)+FLB{2Gy(T1_eS1I>b*fhvDAOe!9R{8jTaJloo3=GU%unbAJbA z-5TaRTkn3nh-cKPMQk0mW%3AN%^+dnd-He9En>v{YzJw}>xty2U&;jekKZvfFf)_u zzR+s$)SoL1z}%Z7kM7U!`6b>;c40dRb!ae{E3ENwb}&+)OFVcG_RC<8)>5n&mF@>Ccw^26KjN={AU>!4cHcM^TXeSc{A-L?$vlo6 zZuHv?#5SIew4KR3<6FA{;rQ(411Fgs9T>bj9kv761#C<@TvDy#tgIaBwGR7T1#B4m z3nGA_-bQ&r|Kx=2afaDwyZA8OXsITL_mG@+oH1)6Y4hEBnQq(K;abC5Ss7PK(PAm9S7p!HD4}d~6ySUShYDbt8ol3coBgdDB%x+Ysnyk)=(m_5PGS zaE6@ts-U2^j)H-fgTfE-4^;hB1<5};du@^?XrDJj}{ z;N%*}WKZLKl8v*-nc2zg5%2v1comfZ7xme_)x4Rp;qITQ_MC3S$f@`x5&V%gHn3?FOyB#iJq7So&0i(rWnajBBB63X#kX(WXF zpUL^-vIkn5sg=aax-au5wMXi_j7TAFoe>;{J+d@8YwKOE$dR(bVlK#P{uL3mHbIUDEw3m^B@OsF-`zm@XP)2 z<+;x?C!{#ge$tw+FJSOgx0T&yIw>=Xl~F46J-8KLIK|M9owyx>1lh(GjJ~op^ zr=wURRMb#Y3nk%ghrzTVxlGBiNyUn>3%`Gx?F`gJ(uSKDn>bY!<$_j^X=R&iv2v7T zjXn{ag@rwHITxohg0&3Y|8Kk7Tr$*{+jWpmzDLwTimV%!3iZzWmx^ zAJp&VNLtgTKV^M#dTC!r>Iz0~&GxJ{LgrkR*&NX(KCYb!Gp-sM{vdL!XG(QKaBhIt zkGL^EzE&pQjf}=2Evk44#5FG-ObRKMG1P58TEOQ<4%9u>^}*rrP~hh75I_=UxSFzqep_iwpzR2`=s5ocn-h& zNu_9O$&&C2>E<{ihSYhO>YZRonH@i>B72+QvGa+FwApoew-ZqmNJWasPXxmrd95ag z2^H9POVum}i(e~CJFm~HXG+3GUk55j=Z;iY*5)Y9Y&hKPhM%6CFvO39L%CpGT~nN7 zzmy)cW45U5@@fk0c36%tM;A}eoJCsPqi0DJG+T?|zqU@EabJ`0N>Et(JuUtLr;rv| zqk~o`LYsOeO)e`XsUV~`_U1mly;Ce~`C@l8k-+@F4Q);*?TGbarRnKJ1A=bTgvPe5 zI*e~MdO~5MGAL+p&#L%6v6bl07j<);u-#YVoChNf_3KrTFMt2A(S`$dw~!Wt1WS^H z3J{KRs8F*qvdZL#jrGl{Efsh7I!%a@nc=_ZQ95>X{PQPbdL|hbrj#$#8Q^t)n%5ml zi|4?lWoQ_Erc!8*7@9LuyuZ3-BW^;J%T|g}Nr`u5hMa6-o`{O}Kp=(gS(`Q%JPvxc zfRXR$_(2QxqGM#IzBQ3_Nh8o-lV8jd73;%AWhHCGH77*uPEII@Kbq`Z*g}*T7((Zx z@J0*6%0$o}7LyUF=GdLTeBIlZKLM}I^fgsp_Vr8D>4b%&9yCIPR1g}ibm|>Eu5FtR z==IST7MtQAaah!Uc#is2bIbhR>vQ$4cOTuri5zSOH($R3oxfvmN4lSFmo491T(9LV zT>K&0-l_p;zImkDjd}+$XUKhK9~)@Z9sz>s=;+jxHBmlKHp(j9J0+NBV`W1cPDVw` z5IyA>q6Bpz$m$8Hs&bKIE>fc3wXiI)-kZvz4JRSt)UPb_A%nR#{`nheD9+A>oYgO6 z6VHzuT+hud^o^6?Q>(qwKef*;Q7x>Xe3acnjHN~0%h?a@uDTd zOJ?_;m@?J%79Ip?yu88?jomN~I6u@WcO`(9!G}#Z5jkk>`YXa6{yMF8GLG&iIcOQ3 zqCibY%XUjh(ZxkdgRh9E6)zR$l4dPg$NAbE8-lp_*+0qG;+uwKTAx;Yvnog;I1l0U`h- z7i0WNz&2$_1h*oOIDPKVmI$JIw_BC0wQsSReLO!RA4AR~6l4L1pyj;~8YWH+6evIQ zdAd#|_GJZ}4JX!Z!|Il4C#$Mh9ULp!HAw^<^mYnsKH}|$#w*d?PWXMmh(G>=gq?WV zD90~cS_+$@@n;J`?Cwi9ib(00nc3N@$TqU@K-Fq=jGh-Snc{(LzAQiQ{bF4(&Oo(G zPKzuB!ih>Y{QmEnEKEstmk1wF#kjA%p~Kp7>cvqwI6gvCYqr|xfqNf}un8x@rj;0Q zB#}3kGO{v~DMi_B56t`Phb|AgZ;#r?W~;f_;tPoWZ<&H%& z^*3ObkGih#3BPmnS104k#TkMZ3%RM;-kLzF4#E7V<6*30w(DoV9#H(8n;|H>pwo@%_j^)1D?9$px%)a#kwg;_C>x&x2 zRI`aY#O&-m0U;sqq2rv&nS|k{Y5bNWt=bE8DBpTy75{0vp!}+Z&vh{OOX~Q{PQCF@ zYdQJdW-b*Gp?X5%6pRySmVXx;)7_Pm!cFQ$$0PGGQVz5-@>Q!oxF;m}6OTd17HL~i z7~X8u@}%zBc<-psa^{96r|poqqBilsQm5r*Qb66!=?kxld|uz5h*_c;NvR+p%LjNK zFMtviKADZldh>CAIL?>zp_JoqWj^T@k^KPvd}y0C}=OAJ*8?4gSyi7D_ zRe1y~B;XR^z6|tF7Kzz6L}=oifzBcrJi=3o<6q^>Z4cm+4lr^QbhP9C1q8l~>OUy0 zqda*WpQoy;EObgE%%-XD#r_QRvvY-qyQy!3HSnv@DXZ6$PG!t8?BK7)IW5;T_V$qY z!jmf!h+^^rx5ZGseRM8W4_uBuMk7ueNRb+HjAc}4U=m=O!J&?c>5;U-ji9a$JWC+E zrmA{ae7=Kg(=)Id&iLL*Y*fOS0S=CdzP{O!_Q>JQUq2r+YEBRxf{-LtE_THQrI`Sb z5;n%ky1PH>Jx01TPR|tF4aBD{k4d#dDa5px9U|gn5D#v{;X6HN- z8hBKp#GG7b*1vM=5fzP<-&%6&OqiSiPU2XDws8&^J20a8hvRSTt=3xhsuV`kNT;&! z7(5Ohre|QRt*+MpM8GmrdazIXZQJ!h z%Jtz)YhTvxH0XXp%3oAesV+3|*WbSjCr~r{(!wmKga$DbLIc*Kma?5h(DKeR-*_s5rS&shB5CEx>6r`vrm(SOdfz{5~tqV47qOFCO*7 z_S@^4YD^3gD`V^1LxKBhuEQeBjsT3%;Lu@l*({WF;^4UAmxNf7&viWat&zvRE;?CK zKLGzvfXgDIs~am}VNr;=56@zPKfoXA>I8S*f(|(Valb`ER51$6_jy1>F$G@mC^WRV zI6r~q+Pkt?oQel>^P%7NubXT?iq+rri1e}mP?>_@C zC@sCa$#M}VyZJM@5Y)&pQ#v>V4(EaVSVke9$q&rl&S4;(uh}PU)SGR`Fv-2Xcph;$ z|Cv{-*(wK21FwKoHIDud+R^_PV66c8N?~d3^wdzw(N}31+;^L;(kPVh#c)mA#cEeyB5uq*@A$#ZF)Yuq3Bd?8Zvt;dY*mCA9 zeO*j9X@Wt7E7;nvOds38t=|9YAM?9t4I;Id9v=GP>uYUg6&xIVd-Eh4YX?fi`2iQz z-RAF~^wmrQ@+7xX*6fX74k-TQ%O;pr%sNZSge! z58451`PK6LGO7&2Fq65+*?M&<{Z9mX+s)U3LaG-`u6A>)#zo$DcSX~(@jTwq*7&^o z4w9?ZTd!Q|^*=KfC4YwWbfcL{=yCjS6eFjhxFod`;2|w|su-5(0=BU+G0`o#?1$_Z zy~t^S5!{U&D$jXdp2)V9^}$~dS%Eg^CG7R!*OighwYJACdB!uZ`5tqtpZK_5M;!=PG1!eSAV5xLSgp7oKDvG%r3In@>@S!ro6jiiQW z^7MDZU_(S(4JjX44W`6dfxWnKu+qL^ z&mK<&KM(%e!7+0nUAjpG+Gmr|VWCQ-fq%6L4%9kTVT)l{ zU!2nN4B_D7;%shlbMeS)XRZ;NQ^8Bsj{EMG7Iqx+nRvwqN*(}|JBj}WP}n9Eb}e_s zJu?@6`eRD}3a5r+MPZ1A6Sp0=4LikQ{|_9qKCw9|!o}SrlgMGYn;QzLVNZ46+%eHm z>0NQy*;R^8@JAYRV zwF=QOyltqgG`PitM|3p-Tt6L;>rNmvCQ43_BOb4`oHq?65J<#Xh{j&)_ed|ST%8Kc zveub@D3u(Pla#K8;Y$dmB9qHnSM3{QLC4_rery;_+C^<;XJbf>_V6xr=N6=Ymf_F36Yy@(gl5lJM73T~XE5xxPOo-a_V(8w+>W;Z#HA zpI|S#BC|vzdzp7<;&I+ZkN>K8D;$76W6S3TCVLYRbr?Gs53?K^9fmkLWM&mB(Mw56 zF1ERp31yH$Vd8a3HFFZtG%WZ-(mwY&4a1%On6{2NC}V_lt4HW3wpvY@+$;w@HP0|h z<-(_DrY%NFib|&OOA96wG*uOa>FerxV({=(vU+9gAQ075&OwtL8kZ|sIocWVhJV4D z7&ic{QRF#HH@Ro8VFw6GsxRuj_Xi@z{sJzlUzeM-?KiOHW~a!Z0&eqO(fON1Tb~kM zdx-V^XntP^n>5zbt9II$?~4|zvT2)wG7(L$AVz?!^Z0ki*xwaE!Cc~~LcOGv=7U+j z?V-U7fHGcK(t`U<8VuG3@#Xil^#f*8OicISZ=*`~mcM4OYFxba(hV(vos;t`BA(R- z)#b(VyWTVUM&g5{@(i89k6vEhi~9kN(PhtjI7n_WfS=Gs9#c%~P|!Ew^=5|%nzZyV zl|lgz%lzy-llNc2NV#&$EsP)q=L}OKqNdb^I>1XeG&Bq+bNcMn+XrA2Fop5xuXeqq z6zl5g(c$w+8(b6l`t{<)MV;CiGDm7oJ@NS6$7Z`bPZJXw?NI{kw=6a{KY`;|Ufzns zV``gaGFLW!&}gPqJ1ZV}bjtYQ!)%kOt+AV%nJa!^!ABa$nUPc;8@ptNXDCZ7^ISSv zlO$^OU31;105xidQ~BIKk;f4acHI+_`u8w5^z9l=6pVPeEw9Cd=ipDQ)K;%-iex3! z_RE_BJOEiQFiqu#2+g~qRB4z?$S0?M)UL_RFaNVwLiE>cX4$`{jt8p^@UoA6{V!gi zlkhv7^yvDG4At+uKTRaq`Q9!(-~8j~PejB-lmVnGG`K}ZmrY$PTSKPR87!+9E89Pl z1c6Am^8-j8Ur4C5e;9raXw_nlog=u!D^8(cEJa4L=^-Bg9MXIHV~67*Mx~tB4ML^8 z8|cLRHv`>LKqx`L<_tEM*wOX5o7ExTblD&GR`wlFks|ICI}taGQNKiz-qlSGxhCa~ zq)4Cbmca!qK~lZwla)M3+>E+#(!jEJqfqK_z_W{nKxZjd(?G-x2mPj{V%N1?Z8HP& zaX7Q*2lFzJSIM1;{Ej0vMXKWMDb4lSCQbX$HialGc8;bWF=aI_nZ`5XMle<>vNzAs zF@SkAq96vc4-Z;m-P9K{%kKw?rqGh^f7m2yMdMQ7anpBGQPyu1{A za>XVmC$~MNg2NSIq#8d>QMTW%djQgNnBmEv=4J#UESeXF0aOa0e2S6qE~eT@7{v~* zpD@=ThWucdMd5cjsv1Cv%6ih1!VAdV3YrKD3_cl7CD=QkY2SF|+4d-^>o~jKA3O_= zKf1hHT5R8zdM6YRT3+Q?PvWKCa%4&oKAHduZ)JRQDaG|Kc;y@OS@YxW8qpW}BF(#- zmTu)R*zI6w{*c!^}6Lc#iCVxL=Z+$66MyLbEBH(XpS{3;%* z8V})FzG5#eIBj!hUwD*|(>^Gx3fR+t_0hyswZFZ&&6P>jfyD&4y zoqU%D@(2^TKL5T~Tl)U8SOYv4I!E{-n~n}uEbo!iWDXi2FS^yfQM6OkRKT=UUP+@lko>%?KQ_Y^5-ZRDGtUA;Zk4>U>W$lYVVak~*W zHtw!YtdfYM$ua`k06_Sp9xa_VHGI(;CaEB=C|kX9hy5%tP4u3Oj5E!p=tFhwADg56 z+VZeM36q75-Qy&%H>*sGg@dEE&gEj|`fzI)Dwcb=SaIB+mnJFxOTY^ebI?+vQ{~?X z(Oulqb*E$EIP0n~JSpB`GjYX4UIN>+p6`HdlpmTJ+u*fOt2xNB{Ulc4`b4pnji-?gE$S8Vl^=Wj)$s7H@CKIZ_jm42~|sVtSv0AmN?-Nm<&dt z*%!yhvI6;N4be2RB>Vu7Z;eTmgaLL0?XwX zv8Yhkw)XGI?M|#vvaN(*mVOw>OrJ?eNYI#@jrxAm{C=2ghWNjLwp>YMIMcp_U&KFn zoP0}quglnCM-<;WtGSGG?Ui?VOC7KcObsnf&CC*_Q>ml-tBZk2cR)4^KvrLuxJt!% zk*J8BBPl5!7e4{Urd;DVznq%H26cVGN0l~xZ9_#LJ`R9c=$xIcU5r@yiSgu}SFxa8#I+0=pcjm0sKQA&Umv)>mXzhRtn z64}X9SW=MTE**ZTXDs3tz8I|hV0;^+Rx_~*4XIEpby$ixBUH=Lm^0(FCs~U!n`8JM zrrd0^xwEb|HZ-w*=mAgybq$R@xXU-H#liteO`_zzl;Uj$RZXqP$~-DsYSFY$M4b9U zc7OF)lj7qa_V>>~Y|Xlm5I%c&vAWK(&b`%KR9akIWSaB#pYH^0CeNQfl?$zVHs4}N zTd-TW(7Rl(uc!CPw*B#yj0g)0%T`v>!M4ZxSOx)`DL9!wRe^XoL8NuY*7jKA;qD#| zK&mME1--!W;&HZ|x|R|?u~$ubdPJiy0CRz*rGtWlo;^-waw#^kva&Ka7I`iyDM^S( z#$;0@B^=&BzJI^}480>trMEdTAt55l*4mo!nb#8ltpq-}-sR61V>3lr75lc^D+UBp zL2vD^vI%SB~r3zNd$c`E-LpwVC5|- zFt2pcTy)bJy(U(nA_DP*i?6l9&l;jGnCy71M0jW|ehqy3Clr9b@;kL>)9zXvkUxqu zlPLG14?XADHzx&NP1k*ZKFw62l4~u}9`gXv24(x5UBf>#uKx!_`oFIF+uiV7_x?C7 z6#XS3_~BVBJ}`~bp%ryi!{FA!%h?tPC4>_npV0f{vM!6Vrzj7cz;|1M$)Dp+_^QH4 z1lZixBg7z^$Ivop%p2KL8YWfSj*v^Gx>F?qp0i>vh!qE~Q`g0>{wnF=lKEZ7n-e#s zGHd5U5E1ZQ=N}({-K+O#j>p_pxmTAMm9@2!U`Y@WWMy?@8_)XgVi(GwS~l6q&R(+* zIi2gZeQ|Xy4XsK*umgqL=ENi|4F&KLb^J(bNnx?vhjpB4iul3G$>@b-%dPcXCHhek z_=DK)?=KG$K3>7WRcmcNw+5CAN)_(`i3m!|IIpvf^R}A`i7KGodHN{YbSjJ7*VhD` ze9|`B7CX2Bh+dub6_zZxV4`8B@_847$vuu?TP}y7goG5y)5p(!kNyO)3wYlqf@vmG z0Ad!G$>LK@&FiW4E=yHrsT?e9?8z0%Uacl~IxecA<#rZo>YXc?ltW@l8VRXS=i~w{ z|7MaJg?UA~N!?kP%=hoUYc^WU^z?eH>f|fJUN?`Cj*g`|jk9BNVuTkLmzWp?^wAQA zrP{;dQs^&9R`m|^b@3A7@5%jIC88t1G@q+VU@R_mD-|~hL2F2?2{31~($S9NGYj@BLdhV99IRKt-Ofk& zO6u|!=GK5P2m@VTEQ68tndd^+g6hgPVq<%?-KY}4z7?Vka2(uracgGv6w!*NEv;I@ zrIS@vtc0tZzLdr>m(EF=L>p=~4s`jLeOp&}f;_(-U+V*{~d75q#kU z2z4k|apB7z+NrkYRKl$ni`e?)^CRr1M@Je}NI{Nd5r3dVzOOtwt0k`~SdD(=_%g%y ziS#hIfF#c-f;3O&JsTSvl>7P-;>=p7^(sS<-&xk&xADiiCSEi#iyKF` z+<I!9k*~-pQfEd^~IzF-c>=o+q2?iPVeyWzg2-v316mJ1G z84sRn4LVcF=2n%3|8|tqTO-tlSz0-g_Dg#Cb}TmE5+N+a1Az82vaBCh8XjWt`i6Pc zYUaB(rx(vLm<|xn(|jL4_>wV#!g`dkfTvg2A@50+-5cr488z{}ZvEW{?)hDP`L-u5_52Hux}e^i69a%M>I@EW=l4B^iBgMq>1$G{14;@qU%SU05UEM zI+xTJyo(Lq0)7Cy2346cfEVJ9?@XM6kxzwIjMmEx-hpA{J~7FObI?V+c80d?8AssrGvS= zzx7`O@oKK4sP?|mWZ`JE1q`8g|I8H?+ec7(P+)oW^TTVZS=l;O?Or} z)3>%$(-3|_^rr{*VM1BNZKs-BDs2B&^@G)ifzd?gdsdEkhRI^gIz-$%P3m|R>uc{#Ze;}cO)XLwZX`mE(%=9zfqEa)z%HJ(2i1fR;3C`Z)ZnXT2pRMIqMTz! za-1pE7~I4J&8U^2N-UnWw=mqo6Ei(CD>I{sO{WUEJ`+dLFsRHx+9kJi0618rBPC=i zkZmhI9%s`eci?l_FbB{mG44Kfk$Cb!BHIZ{k@0OLb3Ly-BTdG?#6xAW5_O+J0s9q^ z_#2oO<=pMrnS6_zLB}^)I0v*BWDW+B}A_H3tQ@hn}WW3)E zS)GXR8yXr$Ln=KJr8LB5il=O?(WSaK)BQxtTa?l2eO255=*5>44g+ux;KL9 zOFl3+xF2*`Yj(gU-zzT@npK(BoT+472Wb?`5AxTJH{jA$k%1ww1l;ic5LgUSp^Wl&(SlclL8@t-Y2TT`i1nhd#e zuU(o-XZNX&4h5!o_^&`F`l0g^!t6PRp5lf_g6%+QNlK-doE-*KklD8^)c=m%ExkC~ zi}=;$NUA0-ioIsoZBWq^@1i2Ap)PUMMK=j#eg2{Efp+TASlo9|5F|4rW4Ws<1pEq} z)OjC4Ei7y(YfB1HpbCrX`O<9lK7gzY53Tgflyp?UB<@$w&tytZoNVv^_|ID?bXwW+ z5R{gckjt}Cukh%?``Sg6>*~rY(Fr)>JZ0q*;CKSB0L!j3%Z0!sxFvANZXkCEYgChmDqujVm$n8uFs{Hd_vqi2 z_apar>=bMM*wv4e+B|#amZ>SG%iB~Bx>~Q&^*MX{st!*juG`O#hbbQ@N<0bf92vD< zw)A=;?C~NXrTC+H5t~fSq_I!`X5@siwzP8aj!_P4q80@nf~%z@&5dRg57$`aM7@|1 zpD?kUdl50fT1Zq~mO02U;YAARHK=sEx&oXkuxjQ7@8%Hyl;JaifQ>hDrF*~FYN*>6 z@r6}OULJBQni7TvG&e-OfN@5+CPv21FBhL7OU|Axe1(4zj|SXQOiaPDAcw5Rq^N_9 zy?ri5ULCBezBzj-FQ>KCAHlI-w2cgMf{QKn)pqXW53rni#|?-3Ixiv_&4cXn`aa(Io3p&(0z z{v4BJQC}6X2w{ZU1;A+4#>Pf@ZDRuiWRIpTvt~tR%X32t3O>G;&v_yE+=zV_ION<; zx7nzFu&lLX>$u>+yyd^rukE)W^={bKv14VW%fYNnc$87TtzMsAeyPUgIn-wydy82u zz07t@U$woxU06u?p$;7QwV2y$CupPFPh@URyZQIdI-TOr$L(SJ3k#NS_?^tOtgJ-c zliVf0eDiVF(D2r2_m$$4O$`DDb$GN7O&9%pci%|H0epZ2hseXX+aSudfO~vtsdMZ% z899F%qHuSn%y#x~Kt3DG>3V;($N7PAWy1Yk6`V2H7P>71;Wu$Q@gU}K9Kl>w`*)G1SGX$_1W{qgtIRBL@r z)0d_ufHb%|9S$n%n7ben3X}lSNZRV_#hKzKtJFT?C2DFYDCokSh+b*(^7+!m`agTzKF4NSs?`b}r9j)<+T`Kk2DnoSg&vFpQBhduhf7i& z5FJ+Xn>-LZl&iACfxg-3nd3LbGQ!Q$B!vrR}(B} zYO2dhN~j%6tgW067gLj>D53{HbLxS=cGVwYV_{*9h>29p?a62LMm*bKovX2&*?!L7 z+L}Gz>@vDMfJBb{{e-2c4&E$H<)vHFYIOqAJIA{pe(y%0qeDZ*g@xG;4;x`)4w;^43y*Hp=MUH9t%u_X8~@2ZboLk4%h=OD&e~lDp5& zG4l&cDahma62SiFWQUIO@;m0{8uOE&JSu8h8k*|9y7w5SCkel*tCO3Y_dd|kk;^+T z_-HyhIP}P-^wrn!0;zcRr{u^q(P@v>3;QUgCy$>nGL|?k2q?2~)A9zqj){$nwC<4~ z`1dlG9+0?S6>EJyNs6uaXS_`D$J>VC<}!S^ZuE#f0&Sj z+RFUY1W}!v-~_HnzRyI-iHYM+Hu3O|H<|l}`vdvh6yncL(N9ZMfoX34!u?|@K)m|t zxHU01*TktCkVlYai|^^}jua~O^%dqRjr(_Mf*t3HQCCf6B^WF|)odPtV3i8xM0dZR zZm0*UW95KER)sJYAwa{&!g;Tys64!JR4SsYILd=dAVFW06lz&m)Gx~vUuU#~Rq(aZ zdVyoOVZUZZreLqfDs;X^p(+>s-`j1;3fGZOq>22+HZgH~dt+f?Ar%z7!$2D!8;|No zfsGxVUuC*uVuiP`)R~oOf6&n#3gLVdr4U15e=M&;McVt)rrB-+phETM!UYL^`A! zq#L9gq@|^$yGuntK)M;a8;PMyq`MnNx3Y@SCKbN?z6)4jvrR78z zGSkvNM#ua;8$|dhDL+?Rv#*4RlSc!u;u|Zg-4HbNfYf?JmcNg#dL-sqZCT5b@XL3d zMR9|wJC@s_?1ePi+FCJ>ioDXfRaIr4tU2WrCw<2D%gyU&EY()D(U%4Dh0u znCH1gP~>QoMK(dE{d6XsIjeG?N&Ib#peH1Wtj1=qSEYf|Cozod7G8ez zSo-vkF}~;t;q&KCLi8bNF8?d3`MW5wZem_r8{gCO{CqHZ9jpX3G1g3f8x8O2b$&Y| zkvn~A{5%HrISm0J;b^v2l9sahaP${`*K2oka~e-_I!(zm9uZh+J_H;t1_uVP(LD5R zNqjo&hHLWi0ggtykU3gcMP=*_%-gW&e`Wb~nTNlR>W{o+q_gl~r+ohWxe9zgD)pfr z9svZ$yi29IcS^7>i#GK4YWAUV@V{of=aQ2J8(pD^(rioHJ<>(Ek!;pMaWeX7$E1za63k8C7Xq!NIl&0)l27(I+ak&Qmf5N8?cd&f^QpJ(=tk!u#;NwD zUFl$aDgT5iodTDuA{j*&@e)*~-*sn~5E(P{rz6i}Y6f8%3c>ot{`ixg#w>KtGaFQp zT>VJ~lBdi z8-#ABYNH4J2(KqnSJhkEh2$h)x{rwetkU}ZN0~TracS8YHya73ZPzwMW3Ebt ze^p~>Hvr)(eF=DAta|)Q`8jjCpdz1jd2@Tq?{l7BEHF&tD2%N*n4g$bl=y_^EG2}=Xo2(01V`mSWjRQL%>Hpmy2zB(kU_*DkvyhRq1j9M|C_u z-Lc^y~Y5<>YkO3UO~G`rTo#vyzwxaMp~&6wG`>KLa^;P&O+QepKx4+FUH*e@T&TeZ)a2ME*}6@8ywQN8PrqzOUMp)$+gNNDrG-$sik7%~siP>n^v@RZ+j4c|9HQ__W!lygx ze8{`M{|M5bnfP_D8e8Q>Ss~+dwB+!ggTsmx>mp-fd+kPaJ<^<%o>4U?P#4JMqZ zf690hiu0$9&^hO09?+pyPqU;_{|NAyrR0plO9J_P@Ibak{LFQB>S9|y8vcxYR>V=P zrb0|sUTN@drZAg-+wQG2+4MXM5AQ8OuER^dQXXL)a-3RU&G#N+H8be&I1&4;9xiS% z`lv2Fept0tslL>y8@Wvj)4VtP8-l~yvSx7dy{C#n4*5?m;F1L>0qVx_HJ1jzbXu>J=2u2m>R*e(UX*+e|CIwv7;PqROjh!u`8Zq&D%cB{g{}G`Lew*dB+ji zpV#I9OO_!zwud@O{24YE+Xh^#0m8-2!n7?ZY1vfTtU6N=tT~iABH&pgR+?bLnmd?l zqGBQ8(L1T(1ho!U0uyEFb0Wiu23W&XvMLJe8^YqC{u`$0I@L78{u@+zpFi;pYGy*g zKoONAPN;M{`$>o=pLCqjaFo&snv7eN$r5T0x<_VW_Yy82eX3k(7x_qb@=ay5i)uu> zmBHCZELu~6yjR-h$}0tD*Yb!jv&ik)yJSr zU;>*VG=EW%=HR4<#CRq9L`fxiqQ$!OrcOL3_8wXlX)Pa{V;BT?_DL7s=rCcS@#)eP znsQD|gSPHKLGK5JIw*dYu4Td1RQF&0n{Mm$S6Of1;u>!6<1(3fiq91;KNw5U#9HFg5?bEmvPlNtu@c&{;soQ!c?UyA)EyF$yo2UKxPMr{#g$RY z?Y}|Z(5h42lnlns&7`nujUKB-U-S1lt6^5uw8Om=@`(|iLJ`s zKQ&*dMqg&Y%kMm3qLN`;F*B*Y4g!Hl3|l8TX_MH{BM>n3^8IUOdi zsE2fEvAFE(nl7w1w;7nA(`ne3l3!Elu~6Lwd@YS0>z$zgCubLyW#x5Kt1l}jr=X`J zD~I`6p1Rrdc5MswJnH_KjFyAQ^=YWK=lf&5Q7E^G7Z`4MkMqtj-rtzLL>dg;y0#sK zTY?z#gyMJG3U=EEkl@!&!3VkG-`+ChsRxM<^t%4df;~AK1d6@v0wt+)@`^m(+L_mWHX)%fjz+*K8Ql>nVG?l4z9;fe<#F#U$0(&lS{Z0#njsKO?|KhTl*X6 zF8p}Y`8TNlqaOPE*8j`O|KBeH;`85nr2n7)$1FDrW>whRVe`7>k)$;mfAiNanB7Y; zyDQ~QK3U7Zv~+9Rrhf44w39D>KSpzM_lP-43{X2?SRVZ2Ob6NnX4DSf>F_3f)f;fa zc=rmTQmy;ez~_Qn`O>9G4$m`C1GDA(yNdqXE4ApDj5J$3J}B983MGR+ClOaE8CeL) zRMf^wvw{q(d>0GOX6}@@jrp6!u>irpj}Y&dC)JAMUNhrnEA5aH-TY+~NW$r@(J$pj2GLiu7fR>VBb%|%EA40PScRfBCdI-RPQzD z3p5ep`7se~WoemYqsQ|D8oeg{^yv7q0cKZI#Fg?TZ}X;-ZLmMhZAcHBF_@~Te6hv1 z*CGmsR+TiU(Un*=t1~)zRqAW0v*sSBi5?cx%GQ26Hu-Hk3@-cg$aXOa2fl|Rvcpok zAgj~ep6Pfu%w!oSTUfBMW~Q=tVw(8j5B%TQdEak=a_Z_SLt{Q{Ha*U_Y z3R|7$T7FYySWz|)dyUEJE+a7b8P110qKOc6mUS!-5vLUJ{xCGo>K5Xi=1nitqJ^Uw09p_K1z6j>}Abss- ze92n3u|^%3mbo1pmvc}52$rw5`Y>0%YXFzhpro-n{rd_YM!G4N1uvpT_Nkk8|6e`e zy@h_yWnEq5Y=k*OWu<^hBladWy=C8kS=nmhJQx>+;agV`Sf-tHgb_8kIr>~AtU>>X z<`%S=^5;gYg(E&1D^Qmf@E+B^x_vBIztNG`fbR9;lQtV;uVSP+j)S${ylxcjX%P>D zA~e2k9NC|SjYqe^p1xNGn^JEL6K#4avnlVZK+nBl&NsvCIR`634cttG8EW*j$f}%j zZ*=N6y>jKVJmE6}+0UE;@LAQb{IVeGdx$CcckZv<%$8q-i}~~$QvaQhbqS~59dS73 zs$u3qmaVk0v^ty#7Dgg2*bXw9*3bLrs^+(qMcR2|MvtYpZ0cOAO;wS_hM6MSoss>& zN2(`qDQ&_}{kwPTA3Br}B?66C2F zDRMP)<$;G*bnn`%7a>MtM6671Zv9-N3R~i}$nvM^T?_(E?Unk61emG4Y|tppgzERO zr=;p`XTl$Yp{L1rU>a)qY~hxrq6{xp?erXe;+Y(6dYmRS-j=w7%tRc`Va0lmUsGW^ zD@I?0HKlp4-z-a4@_aKN%s@+Ghsl3fyH9U} zZ{Oo_DHN)qsg_Hlu@~3^pcZtRYSnNAIN-EftsaEgAnT`XA~6>Neti5IwS`Rcu4dn_(U-u+oN z?aOyc>1_=t${AyK?cK7LcHek;O+JjDZ|GsCbCz>1a6$U>wtL_IP4$Cv>3=JF{`(jI zHEcPEgCO5Oc|;v!V|&=U0spgN*Lj&>DVr(>iZW;4vkd|mHq?zXl24cP|8u7WW|K0@ znF1^U59)|P!{ydLT$-2&9Ppq2ETbUpogpH6i(>PC3~qiOLT>K)_Zl8w$Ww=Y^702v z*5ClyfIt19TaQ7TWd`Z%mgecm1W41??>Y9G=6AL9<{o@s@DU3ic)|HTh|m9AuU>K9Y~EXVE-$aZk|Id# zw%Q;{mJeQk_rd7@C>EczVJ&u3D-|kes1;&z+EnyzLJcOoPsnS0Gy%Uj3NwdEM1Mu@6d;*#SP;azQ>>VDQ zh2FrTSIG5nXh=tbK4X-Yl>s7Igy#wpI;p&(Y>%{(6{~>J8eYA8i%mZ)b*B^^R0DzI zj+~6_O!X0WQN+>F+1tDQAd{c1dML1)3mqmVQtf*Cz7E!B<2VU%Zo9_~)XZk?fs-hUa@w1E|h=i-_i<|(-czE)Hxp9BrVR5bY%7@@6v5- z0Nk*mVM1Q|PlINpK&{l!5YjN;17kLRKAzrklU1GbRxs-NJDJvrf31FIgUE4tymtDW z8whz=>?KS;H2SMia^0S>-|%={=7g2rBuk~et9aYMXk}~YfbgF1gWT#10AqSeeLb;$63|wj}FFxQON-4DJJG0lO54~dCgapuceio-iUW| zAO*`Y-+1FA>2)>FU0YK%cQsiTvuJ4{-!}wWJ(`@!LUstHPp`heuzG8qdi&Nz)nNYj zcf$oE7jO)8qkP!|d;zEFP*T1c6xIO64sg9gqLrG#P%KRVNGUox8Fh8y1bi7wK~Hx- z0Jw^F`4JRhU8UgF93_#WxA6G!*E!w3simcX_D?%Bc?ux~#l^rnp&%@7eMVVKXJFla zhO#|MmIeQPb4gY9P0wM)zsWh%*x3WZZl=^ zXl?(>6tlJ|sb&%C=~t){0}E5r%uBqnU|N8XCdg~_2aSu8~whE9NSK|l91QV8Y{X}Xa-rPiEPJbnY9Y1 z-FQHNdcSS65^Dhj8i}nV zHHWh5l1~B?=nZ`Q-pAYXlpJH(n=F#T$2&n77@s1RJbl6BFzM@~!i?6;HLEO zNtcPqy3pyEm)5L@$pwODx=c$bof!_3AND;8ix_9C0;tf_wa@W74OK!RKok>cJ;FwE$x_`X#kr$m1tkOkE*JVp;)8bD=F4|egVd8XJc^O z_NkM}m(#XG_v+_(`Iuc^G&iq|k%@+eS=X#;Hvq=i7+Wb7`YKuZ-W(Ca87#~XFV>t` zBvOL~9N)1l&KKMHyhe)<_P){DwS``HL1z=k5N`WVo(GF_PR4=0Uj;dZmZazfBU`U4 z>D$Ceb53@O!GVSLfq|5PXxW^jBi6=Rzz#bUgDw1-HlD0NKg(-*vNh^`6OSAG4DGYB zGSFCcw5r=Ht?nF2U*rVM57W> zw~x>5V5u(A*$TO<{#Kdnb=Uq7llf{r$gYQ+eN*7I(42;vS_+S6&q$m7%$HG2M(;>( z(Xe_~btf0+7N(y5o8yR6x0@X(dww{Duu_VU-+_^{smtK!FUyp(vbk(*NB*^G>FmZT zz9L6{jZYGjl7`X+nc9YRntw{!wfxDoz->TAo(O&teXx8q*r5 z>7dH#=%C8YGmY*#Y&ttx@i>nvo3fh`bvr%lSE4t8-?=Wj-l_A!sPoMP-~*6kM7;aq zpt<>QV%_=AVBkGj-@sF*-}3H9MEXEVYy5YUGQEn7jBgilwZcvguHO3y7t)r~>nwGp z+8G6vxJ9R*GaGkjL&>a$Ya@|l-*3U!xT$eqDAZO;XFIF!))c;hUujQ~CouFZh%6mk zJxOh{NANXIR4J8szysXo7GSovHn7o+a^&0w*SQSf6)2f1_=13IV7_~LaFK$Qj2V8R zOxpT^EOS}aY~a$a-yn6rrWsbpMYwy>=$cPQSBY_FgSe{5H%P3t-{wyDW5h<|*tEJM z1k!a0Ecom=O>r^3R5(5%7GJCgt9JUcMX7TD7`+T$3IWDSt}*%YE%wWzbAu2jGY>D! zWHuLVS64*`2WQ8X8omxiMywau*dsq$e0|Yzm<32(4uDMC=Ij+UdDgdY1)VP# z`6i&b_Zqrpq+NK@OPi5G2g!dJF8@%CiE*`q$qs|AA%I!?b&4+krLkhYT$m^&W!x?= zavR@*ySH0PN{U8LBkC!ks=AhpkXQ`n2%r|^)6`58LI%y)k}w{qgcmW<50sad(*SC<~O5T}csJg=$4?(a~Ab2sh9bOVugicMZ>uM>|dxNoz(m zmYSHHluD}yXHg~KmDsjdI8H6OCycedu_F#=DpZNqrYd|J-Gve%eha;I5)(u6oHaMN zqV4e;=^Za(P?pmBO8soQyh2ho+Qe7nS+F=|99n27-dY{{iXacAHF|IKXjHrf#8XoA&sohV5kXH-AEBd8 zw8T?%509ia!O!wdJ}|yu>+pNOs#1Dhd!;k)R((5}fvNuz)n@p~0Ix~VYeU74~QA!1($=s^c&F&Xu199Qjxt%k;Kxn;?p z-Q6Caua%?Whc}Znn=QtyU42re30IFzD4IVx@<9Q>lk!^f1JHE@+OBBAiS4dCydWui zDI!8k#$8`$TWoZKZU)i>=f{fHXLS(>1flO;vqL1S#aPZlN=gikQq8p3#WzETii%W> z;$^WQS3|mci!$Oy4a~BH{0{I~i}Nsi{=#bUI22^WrOye%2KN?P>-I9elx|Xie}P&t z$=1redmY|W5UyEZsRU^b{@m_lt`ruIcQ>|sm`6#I!slCERud@iW^YfPe*1iNb;1Qw zIkwW2Vy&{u_KE`=?XyV;q%ptT;2u7Y-&yQi?{hmitHXjcyK0QTl+vi_JO#}VXp1n7 zreC?da*w9V&t@J+#7oP{&`8LtJWyv5;u$#{os<(0)V=U5+6)rED#%;Tu zH^|MF$BpiC8slyQ`hwv27}6J!qoSv*t`2*xADOq=no-cvJuh~pz4fK|K%7(e4bhhH z7fZSG+L}XE(j=v#@KYBT@~97MI-auXrUA|V6q8hZx3`vedX12CK5})<+?}RfK>ciL z^65Q`G_nq*);?nuW&swnYOBC-8CULXVsuuEedTQN_fPAarAb~E7dQDbU4-Aw+Ah_O zkdA_aVsj8;XJ)&!Y;)p!c_iieZcq%fcOBl!Wjm45zwYpaL}2DEhK9S()w9@C= zR>{ZgPN7AzsRz$IBkFtseyVPWxy-p^P+qBjxOpE7ijTjY({%;dZaP{z-JKmK<~cD& zsvUKxYMK^@`@e1lxmBZ4f&!y@F4vA((!p-zey6Y3FgZTn=(`_MTYDJ0T?JrJ4>8;j z$6F`8MZ++#nb2UKcCb?Xc>MST%2F^qeRaG!tedhIkt*OO$n~+)gjq)*VFwurNl0ey zN6-@w_~;87B?Cq#tJNF7eMwQ#F&n8Caf47QVd3jNDHXOB$QWv{P>gsrZ)5n^z9J&)PdDp*0P8A}_yHRWUJI7fDABb5BiafG*6eCW$E(;_ml$c1mXI8fw-0 z0sj6-2oBY^Z!^-2OiaXYZ-)8@ z1o%QcpbUj9S|Y-%7T;bS5`gAvrdjAd448E-zadhI&gGkvn#9(01O8omC69}acE5cy zr08j+rC}GVQfQs|9ryKv>@|3j7byS4$HkSsg{sK0=c+uzCh|Uoo4TOwV_WG!w5rVb zIr1KmgO0M+Qk~w`SQB^9GB&BMes<=%hID?Ju9jXbASf7!K{#Yo82+lHq-5qVQ>FQ5 zti`x!;NxYun!zv7;6N&1|B9bq&Pn3-{(Z8{OkiLVAii+obJx)uBPb}?da>t(=A7|{ zwoIRo-}zz&h^36O)DtSGkZ|I;G?`QDyN{WI!*{&iX}{G%Tp&wRuIy@-PfSh`34J?n z;l&iVJwewj*RB3mO@0(TXy$vi+;}2o?xti{E|LTQq^mSa`x68V4E>ZUsB{BBXSSB} z4^#6jKMznBOwG-0h)!rdi2%TXsW;`8@-_Qoh=M5NF2S=kCsfpmwfWr0NPCr9UdL~U zhVK|*q%tvBD=S824>3>`zK}*gB@|nvQl*x_BOr+ME><*BTV>L}yIen}i|M+q-ThfB zZ0o%}D^+uSbh=&8PsC-_6??REg&fC8(o7^oX+L(M9FMbsS*}|!>*T7~BF&g2WLly| z&F^yn&t+hpcO%sn@SBQ&q-ZetJB$?qIVP=?}}dg9d;fcIJvkk zG#uYEP#W&)s?0j-*<>E6jGs&9V?wW4g7E_*i*+C|qkLKFa}sd^z?FPB@u7C6%BRA*4)VVI=YmlFto>-?g%~_R88?ll@UvrdW`ElY3N}T*G3slbfY%hEY<5R$;m#Zl_098hQD4yUrR*Wz)SF(Nujl64Hu4>$Zii{3{}cp=*B4Jo9`J>L@}L}`S$ zy6X1l6>AijV@T&3cU$U@dp&n|tXRZTEy`8f&+e~xfg<2hI z&9C8jxU9D1_%A{`!K=3H9bk=L{NXhMq%x*?`HQ7L;_?+jUJ6GL@n`cM^+9I<1vr!J zdmeQcA=jb(w_3eQ`!jf_Q*Vqtg-}usTWi;I1(}ffip^iw_2U3lN6fbCzUCn(=j1~3 zAakq#(3j%KeLWh5p1xRm^;`&%hRwBIwuKD*g-gx8sC(VT9R3jV*Y`7A4CtTc#MHdK zDYrSR;lgB2T<70%C_0Lr;}*VdC@EQ4+XlM2V?;~@6yeXwrxuAsroKFBW{us5uVih{!NB+@eoeb$Wt zX?DuzEa6YQ8Em*O7{8!hq+8Y0n^ zOP|wr5R14eeOEPGc0jUbAXp(Cn*dQbrInK_21zhIUtGScE3Zwz>4x$_pPa)`NObHs zi&eWdn1K|{CbEcF#nfTl)oKe;8?l+;=G1)pO@{DJ=haF$B!drW)7fN=VwYsG)y_{j zp$NK9cK13kFwouIGpb1zMxgI=DwlP87X1vdHY!lulGcJnjSz1)bfT6|ktRtF8ywK~ zjSjCTak@jojC>In7l%PYloAsY<~{$Aaw<)@w4vg;P~lcVPTdy)Z6%h0;cUd;+9W5)<{Jr z+W@IsksAoRwr47i*fi9^S?Ah`01uX+4SXe5v?qV;ERVO`oT+dvYlC=^c++56ge8Z!oqrJUH zZ7n|2h{_2Dk!i;lj&D`G5HCMN$E!c#jr%H3mor86X?OwEmO zM;(PkXLjaIk&Xhv07N*wf7P|-dGK4uzi1KKSlLRdoOIOZ)I5B=cPFcurH505#6B(^ zJ4eA{OT5NwW`rta@Yl+#*4C+Pylt=EpPMXLoV}TKNFcv;;_guISZFj1n3l!Ra3}~8FmDLMA8;}2Xecba=7Y?s;>jEK9ASS6I z@`};w%IfOB5Q?qhrw;s2eNHWb9?M3d^q^MopFg+zq4B}9S|osziF;9ZD)8r}*TQZ8 zA4*=}E8e@jf1E$%RGLCpmmuBe7%HSC{`(;~BmdU5W2%wfs;eZ6eHZj^T3D0#U9!2y zhYD&(TPU9^XnOtsl$u7+{vV1-TmK}94=f-3xtY4+9x1jYaq;`rpPU@-^JQkyF18PW z`kLIoZ7OJ(FFLoeUo(J)qtuN5txw{2qwJsSzjh=2&nnm5Y$N6e>dI@(pU>-t&E;^LWJt)}MmlGkC#!+-AQo-cXH!0!S^6BY2I z@6jJ!&8BcCc^nRU*_pLp!_BCXACUdq1BLhK^S`yVcQ2p*TU-0^@%4XdYyaIFpT0W( zoS%Su14)eoVb-6^Ib0FbK|x-D=4<*$zTG1QgGSf=pC4}&!W90>ZSK96TIEGZv8A@n zbj$!Df4NsgM#jsEw@qG~%z=PM-$NnLMN76UDJyH~>Pl^-xAiuDitC|8#oxacD7nBn z6OyNKw?5q&8F^DE9-Ww2XR|vsHWm$s!;3Y`(f$#|#EiI)1V}Z=di6x53d**&2jPl} zfS$Y8zp&7hnJGdZ)$`o_>H-fRAM`e|V}5AUZzl0uLA`GfnUHvN)$jRpdu>08s+iS)=y9&e!pW!|qce%a+6&%s6!UnTp5fc7zrZ#@QywvQ44liU=VXCUuLJYNyl5vdruJuHP6RX!iooHDYZoJZe zS?}+G$`jt7`}q()e(K9XOGC3cQK$;sDmps@Qe)!c)Tu)=@N@`u41|R{6JkQEn*D!d zkoj8_X2(zrvU0I%Fb;yXbZJT7;>D7XkXmd-1!}-}Z0ZVYXYPZR4;v5&q3z6rz@%FE<4bRK<(Y!+!|ZC#Z?)2 z_&)bpSigV8rn1Dqle|Dp&%|M5pFUzAV7oS|libU`!uofl5$9WdU7>e)AGS{4*FRee zxAM6|GDV(xI3pX1IVzTfi{2pReq-X|Mv)2ZgE zr1Zu|MyFg)cZC^MB>M0J!eV6P)77bW(7YNh8vgnD{;SmpArlVW0(tg+S-HhU!GZ@^ z!8}w{r(*%3t2AHT?45IR!3NBcr>CyoNln5JynS1Jt(SADsJzbi279D8-*Gd-V zJ!YMXPpP)VPh6TE*JUjV;XgM|6KD4JtX&)Y?tXn}`(UM67N3w{o|8YAEV#KaTV-Kk zvA%9v?L6}fSQdnbL_`RCT~@z-iO1$VbAkH2gNaFv5wbWt>$1BsxQ)NP*x&-;b;6Mt zx;op>MF4*aDk>_HnbvfpRn!=2#Wc3l-!UA*Fw+n~9ffZ$jFpu$^Yf=uJe(-V$%oQ~ zl|m&W@Sl@Bdq()&X=4B%oIRD5mG9rbf9hhRi@LY62cPc3z?+`3p`L?7{!35-hJVj490`>goX%meB;#@v@6e%^Ye0I<70Un8`w&P(TRj!uB>#1qMRR^YfDM_-5?U;A_UEBm{x4fj8q=z zc!V^FU7h2i{ezu6reoP2c0nkJgk%~3K(NdCN@=q4(iyc95)$*ZHeLq-xSu|K8cr9^ zFMOeflKW(tSxPm=Mf5&X*m@u)f#mq;rjpCz#Z-^E{pG@1$_}Ijo_;h-N z7tg&mXZRe zNgnb)jKheDQ^A=o>76t6qF6 z#6VBM!=m<0&3|$MPOJWK3Z>t-jY*RkjE^A@YeK_%&u?0b?BH}}W}DqSg?C>CWcjLl z1{axLzOp~2zVVBvrsB=bcnO>Dmvf1#sObG9h0DRsX*X9L-1xLm|NP_Fo1L(Wi?%lX z6&)!ft17L4h?F!TDTx(O*9f}Q zQV#d_*xU}TtE)M3(+4KOClo^CToe>acd~eoH$uc~Ah&Y`7ggMQ#_8^EbFxT1E>I{S z&V}Ind!cA*sK{#$Rp@8F!NbOu|B*R5n$U8)vs<_80HSR9-9tPNPfuVI;Ic z`QYi``g_a2F-{v&!SnQjrsZLbDzjnj8l%qjt*x0vJRyS-{v4&dZ{NOt{aWf~`)M*d zIJlxbos{2(0tQcEJZ_2{BcPEW%kLfN@k4acXarf_huIXF0g@zg_PWOa3Q zVA?Y|J#7bTFX)98ej z%s}j{bo_0k%*`*S+uMycO0+^+JF0AsHzefZOSG;oN+B{h@i;<4i+%kJ@(O%E&4%*2 z@&p^*hSS(}$m4$V4>bfWCulL1%FA0XE1OEbQe;~Oy{DIY&!{&4cfI+5@`fg`Zcssi zaLVoxIywe=1Xx&U2kB^ggx!DrgceWZN!AvBPEAR{W!COc%BTVNaAr&vA6$LQZ&c}CjVe> z?{b->vdD6v@N@(|cZ*%C@7KM``9O@_yLZ~8PA+>}qhQHJLVld_l9!cCI z?+n!@Xsx2Y#FGfvw`rRYkI{VIe#C+2yZ2@Pi*oi1?7pS7^+K}~jhlDB%Ffep#|bWQ z3;@^9`yEd32ot{a(Bfh>a`k4G^IO1bGxM{E&w7)JOtVi+1O|notD>rEws&53c6J=p z#lu1i0V{XiIC8%g^jeZ{@M5^$^Kja?-fz9xu*&nFnVX%Ro0FxiMA7Q?`&w(7*BX0cWKy?s6WLD1{$6>(6Y4ivxMMv2!F@;A8r^}1e)?BK`V zSZ64JFk~9u%vyc0DzXYE5^~({d-1o)?;anv=z^EwU5ih5II)wPTX{)I$J@V6&#!4j zzIa7&aB<}1=KUMgk67^Sy8R0hym!F*e-&&0zYfa(n>YRgZkG1f8T{fT+s$HS?)1X# z_Qv4P%{4p$U+{d;PuP2YdVaTU*%)?v(deD$-@JHk(A!>g4!qlP`={}?IL1knIE-dq zYHDukc|EzUFbws+-P=|b6aCa_bOgD(looOtzdQ`^{@$JL>vJG_5-i65HK5(^7Uo5x zm}=$36oQ}h1dC+KZsSDe;J|iLeX?SDwf0~}M@75q&yW(;{cu%~?{}_$|JDIjCWJjK zER3!t3pJ`IxnA?a`?lbjm<9Qzqr8ME)$!9rHj4#6VfWC~JPiisWC4fAH;oqkLvX^MFM{tSbEf`@iH_ZF$NA=go2yZlE*wvP5a-B1x z$mnwSi2MDkn##)L`k)Eh1nxToxjGw5>(2;bZq>wQqghd0^L+Dk{hP63yFbC}pO4V{ z0N7D8qZHRS*JJEePe^$6RaN_kBDP==$X=l#a>nJ|RZeTGzT7dYRh5o-v+uu6j(kUI zymBorDdKZFFp{-wP+9izL=oh(L*^$Q~s zi(7JwBURV;?`0)TDPejqj`{d_XpyU7H@^tg>8P0eM@^9mv(!}|z9&!W>l@f8_%^pM z8ns{6j8f_7>37-LkOQH!CIuelRhmkEe?}xYk_udyDMGFz64Gm`pr)`E#9S!$()IPc zWOCYwXOyLb%y!%I^BH%$g~VqDzVMIMMt!=M)3dV{Alv%^ME)HA*hl&Lv^*V_~51=Z4+12i6e<_#w7~y1Lq} zDjcxstK`zXz1Q!WuSV~Lyyr*1r=>axG8-<#yW>8|*v#?!4SfwbHm?{D#U09>z9RKG zyBYSg-!v^g>8L8-6L$YP>WM^m1SaY6v`ZQD5H@T`>jKX$fYTQOC0Pk5|-APpMs<7|f9j!M#J@agf6)8rUww89&Q3P&0 zQ@oz})n?v4_N>Z;)Q>dlOHh&-Z)L4G!WJLxFuz0K1}I@$+Ada@!#-wnLS0rRBit?b z(K^*lOw5$)dK6(zaRh{f1{%~}uA^|O<8(jIu&Aif(dYSem9qUkJH$j6$8PDPZ|IqP zcA>bMOa{_NOkoTvoqY`SGZ*ol8Uvl37A9+v^DiJg@hdvP;+4LuQ(Wlgr>F-Ka)omk z7-20!0D^v3Ul@#9y1Q2&TAADIC3v-FnL9L**9`2%CnO1;$3q1vLh}mkpaaDrUPyF~ zZcaD*-7Iu1xg2t&UJaF%Azr!3HKAEbLZ10jZU%j)y|}PH>+uI=u&{(@sd{`U`rN(R zd^tAG;Q*GWKIpJ=j+9diVr8{LISPBxW~MrIWu};Q`p0E}e5%0huL{-pcpQpAjJ%V1 z*8@|z3z#`ffX{A2>h3C}`B!3>_Ow6^rRBsgrPgc3miP!^#17=pub#x`Q{LU-BIc}@ z5LkQCbt%xRg{}`b_deuEoA|t&mJAtB^YmUPC9Dyc<9piRcDKA~;1Sa@7hF($(dLwo<!>b_$x|fi9^&AP5)`Y`{2&}w4o7$= z-*!U|D}H2h1R?+}&F^Y*(I9HE<@YCKOFqdCNrEI{;1h|k*Y3@Xn=Qk!%5)ot6m?sU zJ66$gS*o6cU4`y9*yT-8&C>oPOF0+emrwf1cf*=#*|r(Me$98mEBoI)HF>J-(k0N% z#yg73oBN+w{b{jxG7#1ELP5E#1?Cv{?*(Q)Q$`C}vjhGnLqzj~ij6${tfk7TMkgr+AChI$U13l!u&A@l68X(g^=h2KoBd`0#TN^z=i2Kf(!(j`eXl1fhyAoPq zNaKm}@V%_qior~sdOuENXDOQSDj3zl%JAl)F5ef}qwS#VGi(?v%Q z4G6{IZLAw{R#Y4U(IYp=ciqbn5ixu=?#XE_e&-9{RYUT0t*wcd5Jv=5hU!`TvOm22 zacrifbG@ajE$+m14NXPh}-N-RF zV=etYpV1S%S6UR}-6S|0qWrnW;dme2CtDIjQ(o-FyxZ2+H7|%8*p?RLaenU4IeiIJ zu1BASobB%yG|gGR)KIitLb*e%9N)D_WtYq04qmOFhs~9!xit0=3wV=r3RabreEO3f zdw720po)Zo!B+L^Zmsq1>UvxW^!_40#%sIx!EBRRyz2a|@Ad6n1yY)Ci%|OAISgBM z9T%HK&^KA3W|?IcDP`v3OmbxqEYf?|w>P4+-dVxjQ$l{110Do(#6r#)b1z28&rlpi zuTBj&J36{lU&=Cg?#G$W@^XyT*{lwik9?_!GnF*sA{=eL>0$tz&h2iw&|SYUDXg{Q7GCvbCBnWi;W>U25CDgr_UDF1h{eN%!mJTdU947=PQ$#h|{( z>?r9yn_n9o%=%~ap&e|~mO-H|z_G#wy2qPkN=0>|0nr7COsv8ja4v9(DlTTg$XMH4 zXT@v+*-NwGB&V~Jq-?2(SNG;Jzx@JpMf+}-?|%^Y)=^QtkKQOI3MwiHf&wZc4blxF z0@9sBC|yJM5Gv9o9Ye#=-8o2i4mospci+cvob@~FJ?H*$*ShQFPZltn{p|h3C#7+Y z;~=i-1%0iZp$+M0o}Q6cyLLJ{xNzDnVL9iIPr)85u6j%JHr!_aXs8%Wx{g-HE#JKR z5`V|X4BLW&T*eg7x{Hg@Vtt8Ar%7or_qiNTUtexzUrR-^0FR}Gs!=7pIy=SP#X{!y zmAgoO>!ic{CJyp!qj3w#hua#YFP@Q;@pSBBGcnCqBS?G&RZW0$LK*1~Pm-3+(#Q7u zNo{WassXoUU}B=Hgl~+-c;US=!7{rR%(6R_!MIp%XtSZmO?U4EsEsQeX>1$F_WuGc zE9R#H=8iT;@(n(GtA?)^%mxRO2|GDCE)p!5gjxdhl}0JYCdu$<+puRZJSYI*c&j%Z zz}@NT=;CoYpuClc?K@oi)8t<)K*OL1Vt28i>ho!!d)%*qf{4@EW>xJ>nUV0tn4E5@ zcblmhFI+qP2 zUs)In8Ngq2u^F3Wr?-~KI|H3cJe-rMNRFBYPjqNJ(YwmI){ z@y(v6SLf#{El=4quKccYKs*iEcKw8_lk$ejVn`p6HU1Z+!m$&3K^86b`0?XW8V>Jw z+B(`Gf$E)P^xV=C(F>Tyn@s$1G%3zHi%{`eY4o12Z-Ic$Lc3w? zQStSKpZ+64&S;mV0yd9w5g0m~iXov_+Lu@SI?r{lxlu$qs~bkj4kFxtH?~ieLJShl z1(XM=2&jt*7J+JqXxATOT9vT6+^tuyc4tYL8w z--YU=>=80QOsc4?>{n4zHOgFjqpVz>mXjS&-1_qc}7i)uF-21apT;L*aI^18^l#w}^tTHz|LquwUm*Q+a zKfr$~bzpB`V7;)=9TP{YGTeE6SW=6B`f7HTfI;2jct=L!GouB-saxK?lUNUWx;a^_ zOwt5cNJfy}rSa*8H7IH*k34QAoxDOs%mz1--F?8q9?5$Up4=@@A+1^EaIV10!}FuT z2>HRz4)RN@zzEgiyXVX2BKStcUq;>bAHaV2vHc&sKACYD!1WXa%K&b#s;(|>mkSBK zMppzAXUIaBbSzdN?km{oZ|({ot@F>I^;Gi*e%8A0Bd{r+Oxqc4yX+W!k#-wX*&+*F zY3|{1+uf__`-OhGflaoJ6OXmXsQ25iQSbjH6`F8);S^wbS z;kHMNYT!ouCbDig-t1lLo#zg8=pGO7EPp`oFIjScb6ON7Ya;ONTey1Hu+ z=ot8tt4T8>hdG}1V_N<1TsV8adad!$+7J&JiIDqKk8=l5mDPaxDVEQXn(_7bV2v}C z63|%!1R}2~DNoi)vrAU~Lc=>rV1g;tbypXi9jzqAW%&J&B$+?AabW>6US|5$51{HT zCTJx9eGU$ssSNJN9IwqOCgq!|z$x%bjbt44g9Q z#Y80&s%5fCQ(b;P!^f9QDEI%fHTg!LEdOx=E-DIVyLyKAk~YG7KCiVf2(Gq&f*uco zuTh;V`j1A9>WBo%J;-z^WU&G{iMxzCEhKz4Q9o3gg+OrX$M3(u)gd^hhlhvT+kNm6 z>4**kIn(I4aAG`KY|Fpl^@lsuOTPaFuLm^6^Vu4M!mn%R`NPzvROWOks=Se&Dc7YO z(C`)A%EC_(t-W1PAXB%+`;wR#pddz4s;iqE2`RenAj#kL=;sDz=-N7Ii@~4hrauaY zKGixu_$NzOeb6uL;^O}Kt(dr^o|Y0Hy0ponTb;~ z3ynb6Yw>bd#AgHu@GLJVc+P4Z=9NA&qUEBhsZ{pAAkdJ6ya_;JyPO9)0?~C8D-GMb zh}KX~&m((V>+|^$EreWVZtbMMD)VL4xkeyTqQ0QC&9^o?;-{j&iNl*_D#C2RyE?hVNl6x#wUPY3 zUVjTSM`-x9i&@Y_TH4#~@oIy)CQ*>wE3uAiQ)WIM1Lh8t&>fE#SL*!w6DP>aGsdEI z(-&+x*Y3fWuY3Ulz5x*MvR`2f3;ZMb={`EGffDgd2roArCvoN=VqPw4YUAJEZj?+l z{k(l@I~XJO4^msZ`)8{JYik%7sIUM2PR!TOXd!gf5GVo4%F3SlY(Tc8&m-+{GN?2+o8RXHaJdQ66N|qx zp;s&_KugD8Uk`47{Kt6x{_(wkVDH}_Uj5U-jdAPyV}k#SKRAQ*dCsCc@sr9oKcf)$ z`DDOL-k!mUSVqJ7caknk2sbQ`mW^>(pYBjDik(&+PMs-b^Axd%`7prw%tJXYR^w`W zniS&q$rxpmGsEYi1v|e5;fAG=Js@J5n5q|rhrJA#<47x6rT_S%M0)!DW#A`rXj#U- zT{z|fvp^@`$Wy)5Ez;lbdCW<*Ffm1hBNf*_1=Yl`A=rd$XIh*ruJ8@rIG9fg?tGK_ z_LyJ>dHN85cp8+P55d)Ca8S49JrAKA6|)BFb8zjX~4XxzrthM9M<M$Rr-&d46-o(m|eaa#uqO96ms_+PdI^JoFV39 z+Ur`o%Dd-EWhEK*gW7rY=7(1BRPX#=T^gC3=9jrD6PmC(=yQ#+I6l}yl_%7?>kI^( zM43cFV&IDVRh6*2ckd+dxc=10V)JwRl0O?P3wFD}!`a^TSz63L(g5ed+GM(Uh5~f} z(t)0rRj6zGEdy`v-M5&h7k5hJ(Zv=4zALYmhH2ZNmiyjGuPM0Q&thAeScvbT&F@8!z>w6? zK=ntyq}b?%q19gtQ@96LU9%h)f)PYeZhL3D{h#_HVt)0aWPYR zujXS;WB<8<*McHBD*IvX?zoq`uDUH7P6~rg1t?l%DlTda4!mbSBnoL|6&2J z!(2|+C_Dq6D?%W2kME^*M{yg}&#@6$DvOr3#|*6ZYf5quWvo)OZkGGSN{!bVeCP}9 zt=-r}eO=U8 z7lZ%T2pXf-Cp8hd#RkiEM4iUWkx#)ex{k;BC+xLl&Wi-ToM=TNP~C*qBnW|^mX^DL z$VK|orozVM-q_UpT6HAYk-T;XeK$_mDwxeqO?R zRWc1@d#EhF$%v4&Z`Q0;{}q{Cl3;P1tF1F``lLLx6(@mv5ur$99!_6>vs2&c~sG>!;(oM&c0Uzq4ydxizGW%@NxTE2U%)gdOXov#_q zp+^)Tn#KFLWcsny+2*MgnzYg%zob2T{dK01wBfSBqm70^q&

KN&U_#RczyZt>Nw$=2_x|pBP0FklH}<)dd>K>BszKwP<+Rm z=!i)8=FE(tiGjiL%zLv2JiE+KZw{3l*usm8JN+xMfsdQAjw!2~HVbQSZ^dK@ERJy+ z>Y(t(qoqaceuz1FAud(9Sy@R*!7iPsIFeQSpn?sX)A8cod3i#gmJ4;NvIQwy(@=?b z3d_(t6V&ZEbasiYn7E&m|jds)>a@nQ2RS1kZePpwHIbmYNEmn`dV3Av$IyaycTiM&~SC-L)}-`(10CcaXIeYj>~7(h$s(|2HF=# zRl-{ul9pd(JK`#2+f&4q($Xfh&5fCu%M&%iC~B+2JmFa;Tk+Mskdh6jjiG{q?*`Iw zUoau)u4Lnj1(6?4UT<4k`xA8It8PE_`5E_EyvetbLpu|&WTmQ~yQkd)s;bnuTxKMf|=-65jL3O!#rSmF}iztu5)g0jY zk|goT4~UOul7bVimtBsQ@<@1Z!H%(YY??H@&F!y~8*ZLLq@}lkCESX3j$X2~or_hV z?r1GWd}K3u-HyWJ^z>trk6$)Kz?Fo%6$quqnpr{TpG$U`x$PwHLP>91a0otOxsu#f z7?VkG+wibvQ0Yom_tpRdqln+iPnB1X`(CN&=#Y_BvyS}im-2cUqQ;gEEFf zutV|e7W{a|)Teifd4z>SdT=g1-BH(PWN7G(blB=g1dWY#x*GNM^tdj@P`nWd2sike zPsmr{hI84ipU_?(hsY{w=$eQiKCyuwB58`daTd7{+{4Bt$ zO`3h^D3^^q8{r}x7*^sfCA>_hZoE9xR>CK5KU>s#;*88QNlNt7^ruH}&|f~aF7bXd zJ`uaocU5%$fQ~ljZZ>QM>dn2Y)4M%h>T+}; z#87i~H=ul!o8#TPCYq^p8!sDhJj!=DtAvR9oH}y8R0Y#kZ#>^F;P$7y>#mmb`I&O- zcs~ONEod23)T{KUTxtFmu%6KqbZgQ`&*{nGz)Zv>UQpN zzc{a0A9=oMv0*B9Zv7$u3%Y3UoPyJWh2m_^ktB%UYyc1WgrAwrcAm7ZD~eZ(y4IzB zZP9O8uWr!lD0Pk)E9Ynm#%$JL@DXmHpS;} zQW(R*wnOAJE5Vd&NPW{FkVJBZFLw89r)&`#hY`b&KR(p$Ey~jH!eT$InUDYiUW$tzg9E^00wioD##%{y6chuhmdYYz=`; z&?^0Wdxr8HSzJ^Uf^NH;q3f`)<9*{+ceh@omu!^FU;Y8}X_Cf%Al%f<;IZ6WxXOJ^ zzdmlej)jd?LV08c_4De4dwue z?yh*(t0Ayn3BW%>qc_Kdh+n>hZfv|DTC*-*b%M{6fxr*gAN{hnAM#x@uo*x$R5jETB zCGSk5)tu2UD=O-Pd9l>u6^dq3xO-=7VzPH>HFDWjrV}4;+tb#x{xYGhp zs(kT+z5&x_i^k`#0?4#Z>>>JrQZX*X2xtJQtU5ire_I%Y3iuC$bq4)5Vv@ve`4OXH zOqE6uuhYO_b)ZEX#3gC!knuS6p*;!cO7lOu|f2B^2X{~%s{eQhAkC*lnz z1XA6OGU(^zdNI9sda)Zy(%#-a0Pxz)aiLXztnyI0!zl=NRgNZx%&B%xElT@Fz5AN(WNm2-vRTU%Qj zkU|wxU0sE7W0V$r)N4tWvPXD+5@vI}z3R4funKTsHkw~yzZ~XUCOf5`hCZbvkd#p% zMAy~Hyh>CF3!dZ(aU#1C?)@;PNBuF$Vx?fVy}i5)I@YlC--se=7-KQojw*Tkt`SE} zu*RjLgolYLS+(kuf3biZIp_^8K|4Eraq;3jzp9^+nlQ-kND*9x6#f>7)e<^Dz9*aMF1}CuTW(+IkK@m$HBpYb>|~d2qMyo$xf)$ zo>Wm8*pipF>Px14ItX^=^J!YF27bP{zxVj~AX6SxvYju#$Okzmah$edyCE8&f+@OK z-#|~Fgxg60jx{)V1$|jvcC>}sH!(5Ba~luHGN8pPQ|c9^#Ov$J({4GbI1vq{0G)kB z^M%Ia&605KaAWK~Lf1>nI1=!`2Th;z-%VT}FVss}>za1EioY>AtCPf>sC?stI5CHB z=l)I&v1K@3XP%zZ{`T<%{=#x~ReQX^^6Dzs#HH-rqhzIQ)7@@9Jluy=7|ODfk~Sx} z^8W35&_3(%#Y%$`jfj(Fv(L@nx&`wP`I)a-eRNT2E%K<-bq4O~M!-{*SefaF0)d08 zhq)LAizURfuCILmHkmpk+NgN1&#e{dw#&s76qbrgRO~jVC#a5lFNgz!VKz0*Em(VA zn?{B1ZZH4UrziPG9-#hqz|T`+er_%X4)^=Vy6_~Ry6FCG=NlgNh}d3|FV=T3F=;N| zGvq7FFxZJv;+>rz*I1JAah=K8*c_Csq5$7H`q;jwrt(ejW@1pWyv=4rJzXH z6c89@V`GswH0{z1Gchp{Vb)OBpsGK=c9Kp%iLm{0eM6oZC7U9`oGbltsu;%Zk%$Wt zo{Gzl5B8jF`WwcqmjUu-8TNY#Yh!3VcolU~Wxw6un9!oXs7y8fm-E4TjVuVL9I!oZ zngl;P|I*&}gv{B+h02hfjWOv}gk}#t{h8vo7am*V<=Z>!AYm#;^?>1$-C&DHnY|pa zx8k;hKcR+(896yv4<00E#Y9KjDir<==;I&*ohR@(9p`iv1`Uar6{<@rDxzv56>-SP zn@4o=kGDx(PY1|}Xc1BSqff@4qzD(*1*1ksD`3k~&7Dz0Aq^&J*Jm>kF(EbP+wnfQ z6#X*HWY|uSzZs2>14TVqalNC=^Qm)Y49g4fZ{c&2VCW@hG{TYb^*eX%XvKATSb(P@423V3q!@rwHMe_9m&ukt^yzko_;rtu7+ zcT)m~?aI{B=K5Rrk)^eL^(ly~97J;8AdSqxz(iR1Z*b)pzi(l@rvET9Q#D5>-y6SI zKIe({%=x+2iMeL3p^xrfAL1uJWaUiA)h1E+2(u4LN9NT!W*RoaeD?!rKPA_r$OB4+ z+-iGmUaESr3@$ilAqBf`-Q|>U&RIkEcgVxl3F=Vlsv-OBSWB)mc@%#>Q1Bl3K;?m7 z@HfxcQMacDS{nFcHJiEl@_jfvcyhX62j*?HinjXj)UuFD<)$IMLsg${L}kd*yO>{t z3hy<%RDXYvKPK5=*%W`4Ue1&Y`;(;n?JLmi_J!j?uRf^Dc1b}z1MFjqhN+$B8eh)I zjc>c`uRrbW_lu)HSyfCEXWS{jR^=|%L(_O%z9z1=5W}sm&Pb~0G%cZ6B`t-At z;8|pZrcZ5N4EbA*4Erx192JKaO&C3dnzQc5632b~aZ5u(y~x@+zeznmCo6;jNJObmZtjL;HuvO(KAgj`<;N1~NE$h*m9w7@z^`JM(FzS%Zix{( z5R++uK^EMWml(+VI=AkULRB7rS;*XnMtrR}w5$4YD>){Y}=K?va%$t(HpqAJ05|k_*uV~)V-S-(pA4}jU@xLxywwiaU@U6<*_!@ ziPLyd>apaR*|S^LP@h3(CVBi_9KQSR8-t%9-Z2Sfs zDyr$+Y_7sbN9C8z+_G@iNF!onfY(_B^{A{&knD|AEbqu`S#pnxc#CQe4)IE&$*?@d^PhStQKaF7P z)^p@R{!TWyO-^}onn3r=qa@6Hexd4sHz^?W(*$iEJ^S_(V_eR3o9pAD$Rp~AY4s2& zv#GxLii%?eIT45I%8EwOrF=};2KT^hut91_#8QZQv6%~{1>$juAS4mK^UY!jYcdghTzfa97JtW(LTq<=3G4B?$rk^s<<8dVh<91J<9j%F zhV61oa}&{O9s!Cu=@H$tTe#5A0siVsb;7&GheKqh6K#Kn$C$b&Ik5B*saDatc$sdt zt4>$V&2?M`?{#X3p@zJH@18%a;PSki=-;0KrhMU^!0*up^AjLiLr^u1Hzo=bC2#}uP<#Lj#X`wKOM8Lx4iE| z(HrkJ>r)C$O+fH4siaD*BgJdeG**cPPZ}J>JLq;psn_rLoBI#_qIrBt{IlefdrfesuTvvSg zGBmkpEovTdjtplTf*-DIbFAO-^2s(-D0n@;rKiBUo4)yuM}NxXaq;mB;fXgkdyIB_ znZ4cyn97bV_>y-B@3_^FXXeg8xGQom+LA}UU`4+@9ExxeX2aKCaM^!ARy}V0ZE|$+ zozzr7WjTvpaL_J(j$1k3X%X#5*ugdBt5ihkh%|?U8W2}1cJ&vzOm`ZuPfuGeVf#KD zDdL=P8MvEiYKV5sqczKskJJ91;kcTy-n=OOJ> z1}572m!a$eg1kdaOr;i3;yT2=8Vi(HytH$BwY5H&uFxsFaF1dG=y)yrTMqBLAI74A z$^%%ZIIL7vRTY&K3wPddK` z6L0s?3yu$O!gZGyHu;@Ol9CwT(6X?kmh;qmtk5u8?y^j9S#}vtn@s^;U}SC%hm^ma z{_yDFC8uddq!&cWj6|r1U0!bN)EEVS{vyctCH`niwG3rV{4W(q_PmfBMqC=M8^K7^ zpv`8ebd{sS#T5v^INm^5@0JYWZ5CHoR-(j>{@5hTgK)Sd!I{Et;{enbUsfG|u}QaY zdGz|Jk0xxs+ry8583UbJQ&B#5fbXQJIe}7$X`SEQpvXm>76Br%xbRiLEMpq-^}*AT zFu!#Z!Uh;)n`z}B;T?YCc;R(fTY8Nl7lUiyBU^P3TI z8N$sZkN7Krk`_Ajc(Zs8Ek>k<$5p`|zR;!wo&T+qO2@kR5kio?{ol7>Ghf@O4RAiB%Kjj1dwVx@FryUm;EsVWUf#9wb@+M!X`%@+pEk-^~& z&y;vb?u6p=p0n$c61IcIL&4<{$GWUHlyJsX8& z!m)hz#~sAqKfM2HGe`!m8#%$yBZw^k6z_4$cTOgty-2uR{U&`7_{$+sIUpk%sh<@2^bv3A#J;i0W9 zgl#&7bpQ4(8AsRZ3rqPX+ts>m=N~_N_-=};n(D93ZdaWUBWQ)wmTsEBVhp<~MGG^W zT?L09o+*FPOAkYyt-W5~xgX*3#ss%V?TCclECZ3GVHfW7DYCV2@zl{&G=1@d--5=Z?OmsDrQ6RE+NlcKCpZ#(wpvQWo)Gr z6zQxw>k#lP?j1M%k>->&M+mQ^bqSi=Z>cG{(9()z>p+??@Skx5y%QJK!Lhxi)!9`! zf7sH<@DMSV-J3cYJF@mBM%mETfUy#nbnPE4X)U#0K{=|(xAd>u2gW`H0(JRg4AD;l z3Jo>pGJSzA=L_Og4W`C5=LEV9Q5m!DcZ*PtckXC8AEykg5y4|lZXy%%rS+wHHdR>? z--fG1LBhf!pyS2TjEoOU=wrBHt;k!5#YNDIM>5vUYRATgzobvDr}yaS=+r}qg{9Vd z`f6i>M=i{O=Cmo=I#}@TWf>y`de)MruSL4;cDamu^sY&Mxd#Swe2;yz&u>G3^g28Yk9iZQZl6tON!rZDa=nN$Ot`Ca)!Wdf|DiJ zktrMRa%jhne2%h}vJr2q`Oeca?SK8Aaz87pEJ}S142-Fne~&n|QGofi&@NQ4C-=wn zlx}On4U7*sN)bx9!a)~H%hL)3(6LGgpUYg=m~sM4n5v1Kh0BSVvw5nAKGj~v&UI=r zsycE&K|wJ(CR#;J4T$@$hBx?~!!%j?X%d$cciuZPHNz}(b93Th&WB^z{dhd6as0xQ zpt`b8LXYeV%Ecw6r(r9f1$D^aR#OK??U_cF_sbKepOBy# zT@V9K0jNqM!rdsl&W?^OIR{@Z)EO-YH#fJueDRMT&O@@=Ahrurq!p;?*Vd>d^_(1> zusnVoa35dFe>XETJAC*M)DrHofS4Y|XW<7zaoO48nwpx{*2QUIpMDcmR8)n9hi6WG z5>O?2L9~L+j5vL%ih)NMtrm59sH5BK-C;!E4$aKQuR39gT=av?v&8oenqBN=`N528 zf*aB!)~t%RUVn@<>%LPo3F+AR_~X*?&T z95>Zb!l$TWcL}BW9tSrZ&Dqnb8==rhRTdZWX>4lkau$s7EoRl5eU%N>C^^O_EeV937vnfi>I`Rnacx0oomlym&#WG!o zu-j!yAD3lF-l!Iw4J0P3MhqxqojY0Bfe|#3!CX41%F~m4f4RVX^Aj6Ol#!|FOP9kK z+x6VC4d+4?v9Dxt8={INjxtKJ0+yyY(`H((*Tr+rT=uo$AzY??AJ~e*u~(+zlI2Uo zGqdtQQZGwUhiAo4VH-EKYl?uPK#&+<+i)Vut;={cvvY+Pc~xoq0`3_RNX$8RT*qcm zs##K_-G9@LFYbqLPVS;)L3wFzPS$W3GPx+^uI)1#K>>4XW)d1~oS)zor{d}C?zXnF zOIw}fw&$xd><8Ncqb4RY-hhwlX=Id|84|H^vGK6kJD@f4#R`V_=L&&!z3mZuE6aE$ zy{ziUU{U+xK6*1IGuh8BZS{nd6;S4il_$!^l+8DaU=iHebE`xGyXnQ36`P$?`D zY(l{E21pTGS=r#Uu-RFVm>e*Vtvf=A527j1CBZjMw;DK$FdnCm<%>0UZ63w_ZO zCv)ibAUr6WYZAtyom6sGz_kx)!RUq^vD@uEQC3#K(_@-j8gS?5>UHY3U4^k0wjv}S zrt#HE^1|f0f;7O%i=k`!-dnocV{uF7~nq4Z&CV~3x@nL7NPVOF~Kte%J~ zLibrK`y1pP48!!3rcZ!Dl!CLoCZpkgM;|Y2Pqj5!dj0rZu+$y%XS$wl(JoZwb3#o+ z!^Mwr>4x(64yuwZf2BJbOAnoelNMA^s6|yg@hiRpS5Z&q$A7NhCu|Z zY0cW!+T8r2Bf|E5v=rPxBD%tQ`v!F%Y7z=|Jgrg*{bBK*7DhD&b5Z>w((%To##=8Y zXx?(1?3F&hJ9DEC#M~qbxKB(@YU}8^->0La1Llh2&u^1;Y{z_`jg4_Olar(Iw6(Q2 z)|b;cS{oYVKZ=(}`}azr&e6u0 z;8*5aVqSd-!@9mWZhH`sA=lk19aZq9KSj&+h?Cn)BI*1ncO1yD`=7IlbjYTp7~Ver zeRau_$oqAmsa-zpYIodx!o#HF=5Hq3?H;MmP2DV35L+{m=4K63T}2n8pwv9{JFBwp z86%1HOAgju18S*hB&wSJ%0|E?pxgU2`9|n!Zbeer#X?#~G341cRd^`d@GyC7`37&z zS&w_#XK_orv3~xIWc;eGYl_<3UgX#>m(T#7<{`a1{MRVgJ=`+EG-koHa)t2lgwZxl zk8CRJ^0k%AxhmuFwn|edyc65c-g%2-)5!5A9lUXpLe01fsp|MOy?bW$NGCFUOCw!g zni`jVq$Qzri$B8CnS5x`SA6iOQc6-LYk4|?l|6#=%;N^eHz~p0wMxIp2wtxIva-C) z%tB<+*Yl~%jpP~4?+4p)k0Z-1wz|ZX^Qd{Vd=)iiPfzXnC5ZXW26w*Ns2M_`lJn*K z*OjunPBR80d@WLa)J#QIt|ymU^UtmK_BuK`HJz=Xijn~-wT)%GFvF#j3|Skc(>eK| zVxz!V9+! zAGn!LF`WlzUOQh!pS85ati@nQ=HF9G;Jsln4aE1{`Vxvyn#*-s0#X>qtqpp99&T?h zFGpIC)i(@iw-tPKCc7$MM`mW_m=-_A^5os-X_1r#jL3OKCWwp`^=Gk~Pz_HOO4^mS>@y%gdxS-VOUCn@{=T}^A4$(t z)Q4UGlrfLX-e5G)`WETv=?MuodEt<7xm~@?rJ*CY1wqKrH0RyLNM>dxHgoi+eMu0K zYG_f35DKDwVAu+1+nJv3fVd{mbjiXWw|Xz!gsl+w4;;!B_Pa;%%lx216ji38_5E+b zh=30Zp9MX5GJp2R^-TpZSmBK*uo38G&`boHQ)%bV3^9qrvs27}Lpt_Y$ou{rfRjlt zodztAIwJ%Gv96u-w<65=bw&v#0cIDdr)@g7I2#X<>FXKqzJ2q%U#PsM!1puO3)2G65gQ%>DuUpn$= zIyw?^_tw|TQa%p!^-YePqc(+_UnhQ+ga)utNhffz+D%lrA$OhRvb`w$#fiGMx72}(SPh|}M?k=c@c8$=c_%&o;*%nM6MNazVQgZ%Yp zkzCx|aon(BR41$>EK|$n(1S;c?;qBxqXX;Eogzj~v&Ldp*xC8Zm;4>?ogtHvcz*k> zw%JA}gB#!SI(fc)YfNSJ-wDM_?j4*B}Fl^v3af;>6lb6?Y2@# z#Fki}AI*g%gUI9H&!2R%Oo?u2&8#mgpB<-@;|7L(OzNAiTMl@!3+znEDJkia2_!`L z!ZZV9*tak=)LlACedXbZkchRY6yG}2zoG+(vl~CEbHiZ1=3`MxB+~;cl-Bv)pN9SL z88~5Q67tre`S}b(vn%~6MJ7QI5qn}t!lvohuZ-5iw7x%|F%J)Sm_=kzGVt4-?40<3 zN{~5u`HRSc{g1$`4ReC8a-VXk5Pd2fI>QomTdt8Q34Vo`E-zL-f81Ob6ACo=*FAfhN+5sx&5LJfN2 zyO)9F>j+(HVgN~4R?w7n{jbEUUt$QK`}f6^?{#Wa*-%k(oCF)m*PZQU|Cfs?%kBEA zB%`p<5*V4pcIo`c7XJ;=;vZv(9BAA0Jak)$`rupJ%Q8G@@|X7%(nEX?p|6WxLk*h}|4J}zC&P8D*Od2)CscGh2E z^|A7l8Ve=X)uDwt33|3i>v)Hil*l|EaN1toOvx9r)`v$$WoV?DK$j&GjxKOb?&91t z;DXw|9NQ)sGM4rxQdCio)l$ibQ7QFPD4!Y6N9yY9w-}C$Hd}Ke1$r~nU8T=mqlU5Z6uPYcajcHhhnD^jVC4F zy?npjz&PRNn_j7&c4eTV)7xUlgmGV!xL#jP8yp`?%n3ZkB~6Hl&*ajA5@edyqm~)$ z~UGTury3EK92}~(EJQS(BbYvfxc^t+gh5c0`~#fv#`&)IX(ez zM@`lygL{%DJT-L0Ru;|48RH}fJ!BbD?aWQIZ)I|uX66jMSqf8Aw0&qh;{Dn^(*Q&e zgssi5e3>2{Rne5CO31gtYnwLadS8j7G8E7ptf`!}xb9L@Vz4eVbyQn7uyt8 zMiU0jK74>aJDa>_lr61_P7c6yF^VJ-tADc7u{!E33d5Wo2 zYiE9AC@97aAS8?qiI7#)klZKeO;}%^pBxt#-hFQtC)bHw4}shFd{cRjWy);t%md4cg9p8oLpQoeoRHhtgJHdAtQMR zmf;A!mhc!{Erud6(8|gtkvfjUIwGY|;Kr38=EI%C-L#PzZwqb+JgUM$GQbId#k?2J zLT^l9ka0^{GAf6>OaQB&DMI84jMNT2I+Zg6_FAmMc&t`_G3Oc?dY|krim(0*`e9H? ze!Pz2{ym+Li_!eTqj^na;I5a~$k32RpwGjdZ2<#QQ_8%u^@?LG$Hmh8ByIXyoEvdv zMQC>qR;y8&7r}-f2Q$uE?ygnIHhT3(vAu9NLYI$Em>ZGq9Pdlkgm>j>4@C8w<>ehH zrLSeiwOg7}8}%CaIrlDH<;YB;IGj8?{O_$3JbkGkrzDlMH%UCxQ)Q-n-UE@uOiMeB zVT(vRsFH&qNm|7*P2)?%w@B*v;l=PlBgU;=#-0@M_;K=-DCai>HiPl-xRco6Jrt+fA4Qu`t zUmyYKYnFJ)9dpG2pwCF7%ObnehEscj0K(Gs-$~#sZP$;=RyuQVoV=V;rVa@3tHUQ4 ziD5Dx?0Ze>dL*P#yWzic+NylKvku71tp&rn^O@OB<^2Axeh@3+^+2u8ktV1$#d^h_ z?~36L#k-ak6oq8!S8^h6IFH!_7r`2%bE!1jM5F!*&VyrELhM^g{XXp^=jvC()j1ySjDcpr?lh!_ zp$8wd%LTBIi#n{y@*ZCyimat;yrw*4BZzr{ zpgd;%R_Xa=TT>ld{V?Z?Zz8rq$4Q(aGhdd&1>du#H`wwBoGNDKC{RdcYE@d#9)Gjm zenYr_iNN_}h*nS~@JeP+pZbCGo0R~SC*KYVUf9V0UXCgtPmtH?oDh}AoZjmDw6EaJ zUEa9$Eir9eferUc-hJQV#l$5BZ?fJ#o0qAwIn$mL4XCEp_8Gwin-O2Maj|Y#sOS|; z&VvS;%OB3I7BhXxu9eVVT9`r~j6c{mv$EP)zF3qpFRdd<0QBu7_N~O(Y2`c0zkU^c z?&dQXg2fJaZ)W0uP2Szkp>Jw#v$C~J_MXe&B=q*K_;#Ve&&wKSjppDp(l?^)KK%8o zuj@fXJqqPNWZOw=kxocNwlwVch1G4QleRJL%Q;|eBWpI@ldX`&OVyYsXa-%x&*?)x z<}LnwzRij(S`z#Gss$hVVbl*Yw1d|p;N+*I8@t3bKhM@4u#{8iax`ezl-(|uLB?Kg zH+{{KzIiS`IrMD4Afi11p%{Eu;M0|QdLiWg2zUI}S~n_QZICsEdMEqQZT z#ENHGF!6ftMJ24$@~wxm)3+(A=@`SmI%YV@}YkCleS^Focjqc(lKX%0X`&A5V?ih@J3$+)O16Y){cA z2#kpnOU;M(^f8aBf@Ju)QKu@vn!F34EGZEGbfCP|uz*g>N{b>)Rw%!nk@_wJFCih} zJKOd~My}H3QGA=k$jBw#ygM}}u9z_6!C14<*59mAVtiaIWr#pNt97&-T?XatzMRTR zm&4Q`ye52ktf*st1DuqYMYL8#B~Q=6?M@e#44NlC($Z4RQ&{U!(2o^QiQL*Eg6^2H z+J0dHLVGV9biDnEt`nBrC(e-E>S^zR_%4p*Juwqy3B_7%-%$D5<-XvS1`*vM2ts|n zx|HW<$bJ0&?Ymm7%FzaC$HD-dNO*;k2KM3dzHya~rJ80xQG8qMYxDbbpJ=!CSHvj` z`^}hXzm@jA#hz|(FuiU~=UykSN)~QS$>3V*M|)(ZM;=Ck)v3|pGflYtwaeGHfEa1- zRJdH0|9MbgveWHOg~PT!`MvA@wo78Kb1Eyo8Ob3@Vk2w&Ug?|3rtp|jTHFfsK%sn^ zrOcp1GnBpPimWT2Z31{Ptjq}t@8xZ6_g=n#@p9id#JRaR50nQ&+spll3Sh%NTv8j6 zXi}Vy|IN^$U5<8`p9H5rjgXB*zeLlTUAbs=MfOMuDG=07W(5WLb8d2H@9J+nM9JFHc|w}PSJzs8H+@LQC@SG?~MG80F=5ZYxrMA-K&3Y~iJVsD$3+Bzb!j z#LS?nkw*NtpxOGXy@&e`VQb}s_=jpnvkak;Vm?4YBMg_u0=`@)gPm4(T} z!`~T$3BlOzIbZ#K?I=}SI(k^sp+IObq=MRb8=aQYuJhJum_^d8q(3!nX_#ng`Mw#{ zakViI%=ZCBU?dcKuO|2TMO-V*eTv(C?D|J2*7XS;BxUb0bg@6yEZk|U6fc)cq*+9C zZDnO?zDeP;nR7*0a+r4>=K(Kcu95AS`FgUO$PvgUw`sua<$&cj#-^V}Q!}U_F$CH_ z-*aurBvnM#-MA{O7wqSZNMV=Eq6h};{@ia+l+caJp#G7?R%T7#e1`Fnm(t+3B|B;n z?fnz2yJ8 z*AK_7^Xwu=uk6K>-J=Gp^%ziN0^~{JRw!BLwKN81W&p{UZBq-@AH%%DeSDWK%sD$7||JWk{I90a>Kp5l(V3o3G}b3c6nKTFdiSJL@%aPvb`vvnj&kK7A5>BG5+F1lpI9_JpB2XJG&-FppfG$W3l*WtD6g9 zrupFX@2EO@o+5#%!tHOR@Y1QN^qUTrI96xQbDv92n+opkP6`c;h;>eD@XS~F$r9Iao2owftGR-KOTp(DJ=w16)KNS$Bcn-b+VEg202kd zt1JF|IPX_X_o5KC%Z9TixFXE(`Gg#xh&WH|%;Qn^0Gc5QPMMzA=jTN>u3f`&J-wF& zDUdA@W1$EWkxhA-sE64IQLS2!5EHCAYVg$1Z}*~RO3kmz&hunx z*r@d@U)WI?dk{7ox67I8Ow{X=d6WlfNh~nD8E}>S>ZM+uUQlAyol0b%yYcnEidaVl zye%;#7W#-eej{N^Ur!%!a~tZK8&K)9{mGVvjj4C@I_>bBuXcPMhX|MSyxTo)IbAb| zxXv0G+0l~c$L}xVeM2502^f?6^TBQCd9Oi5H1$qP6Ehu!K=k(ZHnB*&e0j3BZjx27 zIF`DtQnsX0wb7wAdNO9Tu0yr(Gg!#mWpUvLB~-^No4_}^EJIq|-hE-F6K%1Gj@rzK z!9_u(SFLS}^70I6$I^itvCMMEHI@A>8BgO`2D66nv11V(GeV21{ceI-=Qk5S7HC@X zydW8()CX@87CkyeD^OZmW~V`JDbr65r~Z=Mh@p9Cupv~z<_`AGzlFQ6T2_A&R(`-{ z?J@CTq*#xAw7MM+}e6XQ#=w-zgm&TJLXFnOmjEpY*#PH=ILjzI)vmHW09v zR2Q@NC8Qxwko74Ab#cZw=I_OwX`kYsp8IK*(xJmac8xwD04`vo2!k#64ip!VCq}U? zC#S^TzIF+mzIx{bUq~W1^*WqZ4W?(LYVT^1-@5_Gwp!#8;EFzwoT4Y=)t(CP=alUd z{;GNZHOrCiCj{U4!wUef`rk3m(Ly9A*DWObY9W!+R-llkxQB5zHi^R1{DoH{2{iu= zh5#}XVAOH|q^GoyP$BV}ukXh7>(f?bZBb^rxMTZSXgad({pRmG zRd(4{9ce3Sq|53CNWn-j{yec4}UaAt~BU*CW!eC7<(a8q?=;qm{N1W#WuHcG+0YhGUbEj|d4 z_31$#%$ZEyvPh+S#jT4UZu`l~m^5FHYS)J>D(WazTYs-VE*K;XDR#ysrA*X%<+^}F zoz7tTvbgwiHk*8w#^6Yf=1V1|sd2Z9H3tkMGT9c!aiNbqZVEWADN0NG7NyMMNTn}3 zxgn9pt&NSLXutFYsJ+`GPa@16Z~9mM=@zDQ{V6+u36yWOF)$w0XEU+h8#ChUd6RN{ z@waSF^_>Y=A+InE`_HkldR%i?SA2RYDz`W?ky82fEis*-M%-v0?0wH`A89~Bgd9)q zSsgi*Bj9jPBFee><(MDVA%@U&=F4c42=lbBkV1fmAUF?TH1i}OgrJ$HzJ8g*!nL0fm-jG>{h2Oo!UYg6@vp_C6QT``uC zM^y=iVLdg>lC_h?$VhVh=W5U(y5hF;{;#D2Wrjeimx*48!WDgu1_kmqUbqISFMy(Ziuf}icCemq~~v#2P0$82M1y}#?5!+0~4l>e+i64TnLaN3)WT-;0` zq^y6>;aK19e866<)mih8|<9j)!ELl4iM z<7I+j-|L+Q@BM)?@qkw*P!P6V7WrA3{KaRo(AA(MFAzKVH^$UPRk0tl>Vc`q3>OZs=|V?KyrR{&f8Zl+c-TPR3u^SRU}a) zq*fx{pxf=WxolQ?H}89&ff6MOGo-*FINXW?5 z)!zYb1rwvetevABH#d)p@+h^jjU_B0Zmqy(EG(=gp)LO6BZn<~nsPvFpqk7f5ex@T z)ap^Ts@&I{)uEPpU_1?mAIY)hQU0IOetiRj_`-B|adB>+Metl95iK)BMDsOs8M#T3 z563_ak)D%dWZe*?g%QWtP+R$ekutzdyhhG^(OLvZoU7^TMzqH2ndrT=0L}zP@(728 z!^?G^%+eYv{f)Y;Qe*;lxlnw9MUPfHwf`JCPRaZp+6P*{2&@(eLd24(Nnvis6x|w_T zh^TLK+Wac+LEoT!rB(QWCNT$jaH}>B^G#4G%{n5e-3K97BWYT&EOgRbCR- zxuwU);nHu?3Ug#y#Desvo`GIKa6lf(zbu8fK{*5DSrN-c;hff%T_}Efmp-jLsJ;A! zpdUnbKliWRiHU}C$WSB_fVIo`I^(lb=-EZ!Xt6pTER`%N7lR@{3+!>1L5Jz|{r}Hf zL}zdQAN1YEk2%sC&vp+DZ!p=FI4*E;#bPpSM+VA49j9*)7JkfH?x6vGLP&AivBI`v zeb4$=Ujn`<{2x}214BXMF2?KBJrtbsy1$_y4?kV5@sIyNCU|<*YyEFLOQ~jL`+3ww z!5J~BdG@o3kB@)AH8{>82@`==if3)T|Cun}0L6oIZtd>>r~iTfR!|SjZ_(&FnK;IO zlay9bmllstQ;SPVE@5JEE1CViZN42S-1fRw93d9mqxvVYb$AXAO`hWH-Nv4Rl!e3A zz=+pS7XGIW75gbk@$|D;6=(#U;Kt|3-FLm1#IO|J5;m8VlKjWBA*8J$Mk3bXQEDId zy#2i_PFEsMmGhZ91OpP!mj$YMUx-vC_RS` zR<4{Beqkr^xeqmuj=vqzFxUFzLtL8UEf`!dWpc9*whj9GK=)JYG#w63XruLF@reph zim(gN##>j*=R8HenVWn5665zOv;5ic`_&=D=7~dXQEj==cbh6k_j~0hWJQ9DMk z5$z)X>!i*zE<1WMvg#U{k+O{}Je5_*qPZ5dS^6VZkljK0y}Dv7Qh&4}HYm-&3L@9L zH^Mr78ITEO%N@g(PU4wPU{Y?#j2g5N+_&Jd4G%i?u(QKofNxMdJYMg~fkf|n0b_jw zBd$-(ZJeA!g={R(FS8d zHv@$qg`v44rT}B|WnQ+oWJiK5ZNAB@{pBtkM59}|ql@i-8lC}<)dLUEXk@X3AEi%L z6mx&lC_Pv#EO>K|siP4Lf>dVx83fr5{xEBQlC)bWIAb?oX^||uWhk;Q)b3FIaWZ`- z0q^0rXxjI6Yo(7tC)~Xu@R(M-1k4BZkMd)mx+L4@RJT^HM26F+JyE0>It|FcMkWLF+lMsAFy#{2U?;uQU&a9d}C(nJuj}?CH>9u1!X+_QI zBG@O*y*pv@4>Hh|KH-#v{uykvsr&`*zj3CIl&<&pt!etyT<3G1+pCQbP76JYE}o<= zc4g;%)a~f5b9W=4&sUa<4;u6F>GN>}~O$9&aV7pgp44+Jw1@WpphHZ4(*# zV$es=wfnpHSdeKY;L^gGSe`vht8jS{-qP-`+m9;_;ifRTC;WXT@?eYj-C!S`Rxo!@ zA)BDMZ>!_Y4;loJ`7yYOB)3Z0es@f{MJ#E*>b3jA?l+fZ=>+ms2KaNO>xeLPj#bkE z7Fyxul0fPFxx;bCNn9wH5$s9PF*<#;#y^5n>r3`4>~GY4l<>zp9M3ERCO+Kx zUn_iK;m5ZK6oi zL0fCtR?C*oF76b-%;#0#>V4TaLHy+4RUdsc1}_r*s|UV|^}BLGlD&*my4C5czn?6r z;n?wlZ1>xm(TEJPj)7K#c}J3DzM16dll@Y3Ubta6?a`kA?nwd0USGZ?woPAa*GqWE zN-FMSVG_coh=z>VhK_s>qZ<;97YOc)>}+h6;*1I^@j4FU?X$|s{?8QhE2an*Y07Th zL2=nV2#FQk_EzE^3A36uPV!|L^m;r+ug%(!1S)(wg_n1_nVFqZ5IfBGz3YXE(*e7W z1=VMB(!*^OIxXfbVu4(9>JU5oFD&2##e#YC#5YZl>+wmwms9dSeKx3rm?S=0 zM+AxRq(5g4TW`x6ETWG&Pja!p7MU$r5e9KCEWk4xFAYerKDAlYjzvB`z{Jl;oJIUN zQedK${R*g=C(U)(8t_$r4)#IV-6eF7q#F{m)Y^8d31#?P>G1Vo&HsXuJN%B?Dzhy% zHJN|V9RJh}LoJ@w+kcaVow7*ggL!Xc1nzyLrL9|WNgBsD4{hX3)pG@IM+LOEk$geS z#Z;e!k5*_`n$LqlI%x`jX|!OgiJuv3rbRie3w+-|fc$JlWCOtV{lqU(S-t98_gyoPeDbHRfH`nmx>UN}|Dt)pM3TmIZ3 zbw`s}@Oh4_r#1$*%U72kpJ}tq%SfiaFYrd@YMeZ_s=B9+yZS1Cd#-uSjzJ}$K&S8q zrQ+_aqfHST=l)$>*_wF3B)oYh;l}BD(_E0~6_=6BwO#5PoOS6W{Rr?QiZ`<2O0wbz za)yFkRoIPKi#z<0lS8QPa-3$DhM{ss33s6O8AS6;5^SV%rJT1Y#yKEFvR)=EzP!$< zy((>I*Sd4c-|3Y7&rB_-Ytk9HXWRt@?sKIOCU!=#ZGy8Hu{zGFd-gVv)m`}ib4dIT z5eW<~pUV5%dEKDm{!l;l#&7uy+&WtN4Mdl9x4P@H+uQG#IPC5}bx_bk%4MDrhe&3P zp>{%QwcTY=JHDf3)fFUjV|w#n?O(*_wuKH;DI9!8$4}o(bg;H=j5%Fg+)o{_mnYIx zSS}nLMZt0l^C>y?8`Cz(DMnb~Ttl_BuPocYrz*JD)$O^v-!BPgkIor`98H!qXJALm z=dm%ax^3gS#pTj5y+!xF#qs-L(xr^v#eQ7MQjZ9RJ{y*1bQ^bxpD zbnKV&U)bF18Gr`L>U`-+Z{>7k(=3(q&d>^7a9s5oyk5QTBUlX5U5IKo+XsWpp z=u(-%jGLH@Z0KJ8N4G;uf-6NN|9Ump5EZ`Ds?7wu`8! zIa@n`PVL@qu5&AgDpIPG%nr46jV`N7X*^d5auUsA!ifS zPBk6``$NQx*KAl0Mvm_vA|RqNmXIk!-J+LmdVCfEcDEPl-XMq zt=}^X3A=>=##7v0#A-rN{}W1h1E@(&7nsoa{s+ASUY60Kl%WdSS?ufVArY_}|G9en zhA)IkH|am%#_N)l?6-D6yKM(xeWvC#LQlKvn!0-H_6E|pti$D57A9s{?y3(B;R1Xq z-%Kb0=CwhWa$e9&&uEAiwSTi{r4!R-4b$@GAom;hZjUlBdYSPDP8jGLS#cl!n$A$J zEZ15WFf*JmM!~cCVhc4;PK`Z7Ed@F&<1ZWJ(P*#13y!cIYC+>KIe~l?S0uj=4dPbq zgp=DEx@O^mFfgm;B037B(Q2*`ZCcyPzbFsQnUdx21w0=A4NDSx>=4DHn)>q%=XI^PxNw&)*3?Abzi*C80ss=uS;Y+0 z-nwZcnrLYKV;cB*S4aopDO-5kw_pP?N=7W7~2#yJ)TGWrbrQOT1*et+#Hp@rtk<%c_t7l=@C;d525wQ ziCmf^v;#`y*ilMBnw_bt-5%v0nkxox<%Zp-wEsfOVXnuz7*K#JpsQE$fyK%eY z5058LuRL8vWkl^?z-L`L(-JE#BC(W^LTk?9(tMsgz=gla0b0qq8ggeI`UjkOwr|HH z?*z361OSupb#b-d*#*SB4^8;g`jL*eaxIu#;;fF&(9vb`kM|+QK^Y;~3vc}V2TmY@QICkCaa>7z*L4J zYXS@55L%N*SUhiiiPK>z1RN7_#DL;KA$l!ie`{X0#=xHW*0b=}=7Ig*nc_ScjE`*- zICtNo^-qCSV-|l*n93;=B+=VP`gr@ zzBJYq!Qs&3BRRX_=XaAvwCyJ z+F7Ri-!LOm3g?2}wLCGsHP<6UmtKUIyT{izFreR{z180UEztU3z_pP7fNLEOfT!RC zX9{Q1a1y1dgGCQnFwF0_%%7i8m|D2p?);wF(KmaV(d;VkDDqRdSH83rchi{%{>w`XN*2OSFdBnupMUY}AYc|uiIHgWwHjXaY?+q^|24LAE{+E0^AjWg_0Nl^nH8oa)am5&j&UG6ElE@jb+YHDwCge@^s z+MzkPs-ob~eurz>(4Fd+Tq!aR%WJ))q@=tL5rEnjE$AqBz%8^x8!2YBFD);opsfJ; zXb4*!@ScxWFjugAgCNaF&mPRT+WD%E72De%@~D?E%b!!Oq*3RG-|I}2RI#y<(kRt+ zxP~4e%zLM(tmrg8w}xn9T2H+-&(jhto#&u$4boV>pB^PhJbLnKLcPmxWhqeNAD z?ax{IO?4SE`^1{8MJY?}QeMY$6@el`@R!4A$i17f|tadEY>Vz?)==;ccMx!v34^vhBh`f>)hOj zyRqz5hB!9~1Ciko(2?Cb5WkNB&ugkuizR4;l;c*SGI@(aX%2+XeR1PV@7q?JE*UI? zE&hwex%zgT=8aO%8AhFA3$I5>ATNk5v7mIwdTT`vOMyiWOMQ`)6`Dz>->~p>58kP> zNPiHGLlOOF>{?-1)Mm1nC9faksisgV*$yzS&Rd2fvw;d+cHfV7!;~a%4$Ojj`k5oB zDaIeHcVp$RUj7PH6)aor2ckt?tKTt3@(V&|dfp5UmZ<6dZrAoR1dDsFl>QXdzP-1* zk%Nog$PGFJw?)@?XpKO)IX9QE`sz%Z>fE{iFTF^<9Mq&f3_Pv=?FL?JP<(0s4!k;! zIZ8Go6vW>-Ozr&(3lKehP*zuepjRoO_rA10J_VXNqe&#Lotf;T~80bcR9emeW? ze=U!-3?{q_EQwJA0{rQ0J`~*F$(SnlJ=|I7Dfl1@T67E5JYYR!eY01BY3o~f$)+^cg<5gwKMYJNq&pG3bc=Zma~0T8L>9`Q z*W{OFuI<7xp+=qQ5cg=^;lwNdsfBlMtadRbxrXtkHJPVc(!Wd>DU|qN?sQB z#9so20DzE6EM(N!d1uBjpDU@l=HVdWUbNgpojWW~oW=uKU5O}!H#gT3Rl>q#X5T_X zp<<@Zn~o)j+Y*JeyD-S-u$WYIiko=#-@QiUzfF}D}pV<^ji zb6ajiEJX%k&$F-Vgy-42k8z|f@|^nZl^9a<@Cr^y&^T5NBX6yN36CY!fEKLJI5&7n zu;)<ze%UQeFP{*Y!_UOeYbhEA!Bt>sKH^^=~|=#anOdj{BRWZ z%@m8Sx`YhV$Yy2lk9%Q~F2rhNi)vmETilcYjJH31`OCotG0IDyVz-EvT#s;Jz%XxT zX*9cZv&TCzf<5iTEWSH9VQ0)<%d)*{bf3UV$9b>GbJIfAP!Jmx3Qxn`3Xp5JqSe~3 zF0=SFRjPx|WaSf_KH9A)D#i|vZI2>E;#(&82ZU@K%?^L7B?~yY@J1W&DWY{X%sI?pC zgfl_SIV{i1TewW4U3Hwhyr(ucw@mxvGs~M6Key)<^RLvI!z6TsBVypc+V2ZE4DVT` zP%SL<7+PBG+_-T~)c)|bv=vu{&Hv!gG8i>-SbA_k&|HA_(hQ)%&V1`u z$FE;sYj=zNHkHj5TJtdlw1Q4a$cmS8Fp15&jr9i+yofaTPqEzo)ka1=;t=o{=^G|7 z(A8(mKnn!Yx4L?`(n+t<@)xJZ{loRhUzX|a;0+4ysZO^F!CuvVq6Xeo)k&gT7O@NI z>ECx3(}lh*;COg^k|o(Wmqv+;hei!0WHV5sUKKDpZl^B=1&jW>1CcCUqa%m=wmR*FWFIhB9%vkBNF#_|P^m?uScu_OdmU*$S_6pN5`{LV)&$%W%w zB6~U0zkL=dDP?jGj0muO+-Xw$=SbubX3oKGydb9f*ID#RK||> z=4esJ=ToVic&C8Hb4acC5u%0k>Kixbi}t;ZfV%MA>;{kT9>Bmv8n|vssUIFX zf-g;?ivI_975h_bmYcN6vPkv6W+sITz|5qXkCU?(WUY5YLsLth%Em||W>T{Pp&hAN zU)-$+ayXa8seIf4)CEd)KnZ@WPIx7)A>0nE>{V19h_tD3X*W?#B+J_nV3Q`}KM>40Ml&&Z`^&YxNO&K+ zA9J_Afx2i;Y;>zc2XwQf)MXrR<{DRQsb$oy04 zFXFqsYFFWAf7QaVtrSBIF(m(-z1)knc1nou+5vW z$kU`gAoi8Tpvlb~?GiLT52Ns#etD$C-{bngor{!u-r$^Wu+jPaSoM9~E>mE%pvzQa zwKHB*uo})et3c^$Y+CMYOJ)o9%rNiqv9vnm4ZfF!I7KEg=vwoDAy+SbaaiPAb#0p4 z6xN?k%rO=5vR2BAiG@Zzs$Vo@^?0mbs4Ho)4%Hsj4F1|m&Dy34&?=qI+49-ZEF4sW zQuW4YCuH@ti?}5&nHf%LZ$%MHcEpN^6Hi>cB8%V&q(p?nWh@v(o_-6+_jf(~HPcNW zl}+$ZM%%Xv5s@625_I9VtfLlU>1kwOA}{d|PGWjm5$o~Vu5b9E^WQw>kfNF`0h6yk zO%6w<*B2`$x`nr@Fh2NPEybOVUE6m~7#Flj&;Ofg+Mj zT!-s738iFz8x8s&$x-OS$#Gj1Npqc13jt$~qs)kbd0s@ON$k023;<^SG-hXS%T<&s z;}xMr7Zwr*kUngg{FsT_G0gp)uI~HwHpF^Sa&o@K+V%By_ zc#%jg!&a?R#pFG4OJH*ebj@HlZ~mqq7BvWZoisY)G_4MBSu!@Q5{v%A@?ktLF;`Zg zcwRw)Sp278a#xY?_B@Bp8$WVF%i7bLipW?U@xxIeV5lp23n`IP`d(ca!i-9 z8x9T+)qKNk=ZIf*TRs-K?DYJ_p^XSMqrrovv8_v)vH=%HS%*%Hz*R9ALmd(KhThw( zBd>o`G9NL8Kt5hn3l4WOshuk;x(N-D38a=sd_&H69w{Nr;*;87_v#yhctw7X&*|&w z+3ru>v4{K4w!iX6#u-RjK8_1=f_;UtipE+P7-(r}B|F2+;OakO8x-tS>PM@ct|Rt$ ziMdCjk&M}_d@Ee}%gtlDKy3@V#kZopG^`lTARQgs%!Ns+eL=2M8AjbP5Zcu`P=Yu* z>^EUsPAhYXMn3wqdUv3VkXpoyKJ(-3>pETHvC8!)+#eRvlVa0DC;id38Ev&Pi{ElC zZ7+vidtl%^OxTo!F%%)lWijJ&%Tx`}cGB!mCw6VdD#wl)a=Fk6jTna5ED)cY69$?0 zGNLng6}Pa^rDvf-s;Z+y-pwvEpIKC#`+Doj$XW<3;R1Cq1ucU)WCDW;xAzU#3ap?c z<6Xt45#vXK4QI%#m)k=|WtDzJXlg03x*p60hovzU4Gb0GWQO7OnQ3{?A+OUQw34_@zo;mIWMJ4#itSXz<~Q9ZoDzDsh>kR>#WI!g zwoPT1Gq)TQ*Y+m!>RCuy2A4uxIxVFhm|K1HSRg7*Xp+}>%OR7OSGss7l>f<|?Gol? z_#LHm`I9=)>4C;!DO`6gqZ5>8mX2?@v{nxL-ZPoDXRP#{qrDEoTRorKA0zd!ae{)5JEs5(5nj5R^_pR}C5{3gLI!gJO%psd*;K(Z0IZzivdOj{|2gm~TzMCYQD zK0XWZ;|}1oGoG3~v5&1_&yei+IePSqzk6l0avGS9anEu7v6Xpl<>PzJ4ulx;_V9>^ zJczMVT4i=Pl7*IUo2Pc!`s*s=gn*v zOs`Fi<@mcY#YEhowEDgIrD0-j42Y>_%ipQR17*{Wsz==pQnINN#?JSWiUpwO?`Z^C zF3Rk2)u(2dnJr-;`7R=9Ca?fiWz|rV^m1lE3@Eoy)@tS4i{97lO1J~Gb(bFV7{D`_ zsJ@XB#UggP5?Sfg^D#U3Ka5&Dk=)N`rR|ki36goIS2doMU=i~{qsGvqA*V9;<$LX) zsEMed*9#c~siUyT-y~+?W_v%hYLP&BI<}n{PN;Qc%(w-kB(~Bcud2_y#7dmYlHjE_ zKAe@jx?NE0pGkcQW{%@l?+4+r{ab_V`C;0MuLqq)c%hfKt$w4&BJ0Y zse3WX%vlhTjKrKp2AP;ZDIbWMK1gddY4^NGCw>Ra-EDlC4?EZWex3GSK-Dz604rf2ID9# z8#(3AUn+8Io!Yx(giGN}=_S9WH(%qjvSMK|=^gDv2|yPUaa_YZN!3G9R%9UQ&3mch z(4(3{)F6w+sZjN{YeQ#aes*p1aut>=1SH53UvRvPl|EKI_*QXoM}GOH!pNfa(T6Vf z{%@<6Np0CLSQ6ekjs8l8-3*Xfe3VJf=IGZkYl783a!^FzeKh?ON$-alDZ}J8;y!lI z%;aa$s^E1RDw%g&dVjbeoqrJBY)yoid#3_)jcDpr!s3R;GmKh?E#d;0HAPYk1wT+rM+wO=c*G%H_m<3EMFuCDq!| zGFW7CfZy}gw%hU#o_y#?&`|r`Zo59~`8Q95dSun%{*Wn+_p3wTDPtn_6k7$@6@O*~ zGUqxgM`mWoJaJCt-m?GhqU-T~qN2)>X#j5jiFTz1#)uzkcRZZ-@loQG+R1{JCM(~4 zK3NmBvXUXJw9LWwrRBn+s36B)YHSEW=)?N$RDPsiEYKQ!~ z=pmKuA+&?t+NY(o_>;S$krkVVK@Fes7(xMf3Dck z0ZV=uH4oX;s&tw$v2b18nx&112#2bB0rN-X1C`LQ&nM>o+umC5N1kM5A}FbV?IYH@k|`n!=wYZwVb?-CtNbUu#+w% zC21yAB8L;ZM=kWK3T9Im_(-BGCLTq2=_|hVMjchbJyyYVq@&mNpnyhv+B)^?xjWBl z!u;=9%502yDma!qrjCas;~%A=KjOPWj0{=X*!6Q(%v^QjGh&01k?6EaCNAx&OEM-{ zy9>YTGpWj}c4Bb!i=pQP!z)aR+C_K1WnTrUyOyGP;kvyU06g4&rk18lEk2DbkH!bc zJ}F~)qVpT#4@Hu8rKK+nLJ@6KY)VRO627P95;H4HoTTneL9^oROsy4dXh+P?=Lo;y zjAce@43j#t$n~ip%*$nI!G~7T4De!#%%<&%QVX z(5@Pf|6z~<)NlV1j|%CHFVBDO@SK5aw*-Kp=pT6P%7q7Pe?I#=#{<6j-+UYK$5EhB521M>^CgH_UqPJrl7{b5~)d$skcLe{#IvyI-o2ES|~55ZI%v(*3=n zLTPvWBS{*KNbYG*o{ZFaLIz?PuedkN^(c`(G78ZW0ptO7_^o8H8n0I>KQ70Jaz6-@ z;^I;anbaHH6Mm%q;gb%#h0eAau$jhVqz&lm(pfO*eAImN`ez4Ujz8iwIWhhzGmxGB%!^K=G5e2mNq-45c4}%FSBLS*q5lw9Mo!8)bdU4EQ}PX z4@XCTN>m@N%_FnAF70E1RkQ%&mbi1|mXzo#|R z=)=nKMGx%~yFzr*YfBq2cz#51(=5}X_^va}+8pU(Z&JCnd0IW(M%lynNi&2!!T zMXxwsy4yj81K66uY+72HGPAQk+w6S6WhIn{Ub8TVK+K^D-swKq0x*%0jWKUkl+*`1 z-^Si{U7G4TGIf&vhQ2A+-t>kqzn~j|K%{3d=V*zJz18U-5qoQ?*PP32c4#@QzsK1Os56I;WVVnWvhMOtZX_#u zPu};jfPCq1$nlISp}Tm?KO7|y?|tu#qqIYc3;m%=suJm8n6@8{ zjC{82a5gqJAnv3+TFF#&ci>6rNN-z3QtI10eafn~*4Nacy6->5x{xq)t$t!`lh3nV zV#~Gqc>3IpAIH0Sc7G+g@=P2EgY`Y6l6Yuf=U3oMMKsj>8xS}(!qh@bic1ydC}2Ma=_YkAAG>j|e|%VWsFA^h--~l^_MB4o&OZM8u(CYz8})>h70`3x zlz&=2pz%MPc-yvnstH&XVr!?RyAHOO{&uL&3F0b>-wxLI(Q`jB{T)knj4RI5c}F1> z{r7Kl<_TJo*mlNMYm1K7iHo0spN-|g61 z1ZuX9S1#E(*wYNSe(BQMOa`vk4?%}>@OD2I8=^WfH}%Sb>3e%y+s6=baeukjGIM?4 z7X{ijXN9&zBtp(bX-xqwL-pwB=%)qwy4ml;B1|nTXld?zTp9ln8$nJ*rKzDfxj5V3 zmV%hXv1^yVRZ^;{P!tmrGYK*tixK&oO$@UjNhfEfXMj8)>~NQmWO9GchMke|(0qiC z`=lu)W_x8q{s9|NO^m1wDmV8_7ckMJKGIavkw4kKPK11F1J!_nV!*qo$o6$rrR(9g zBTSWymGY^n@oVF%!{KuH!U8Z!vRUcUtBGBNxV(NnCW(?y96&n=?4a&d(wv#$tkd%+G2zl zShzy!UtpLx{^9rnhC|HFN4L#}9^du$^z;k^I?ZY7z?llBpk!5mC_@OV85+_H1%<;U zPH+Q*t9ufm23Q>`rpjai#k5f9FOOn>A|kNVzv}~SEiHjYcY;GV^8h|PJltxwLsm-0 zuhKfNEsTtm?C)Usrw$ucub~Rb9W)xP$!F2UP2^*a+f{q}DfivOfHIm0Ai|Fp6=h~& z$pC_dz*rdQlPWxEp52Ibn1T2RZ)|Kt_1)3hFG}WlXJBCPwl(^pD@)a$DorLl65d&5 zg8|KaS%29!)*|WMqkbJG%9W8aTi_Q>S62sQd!@~^Sp7HK5n@%@*)Fr&OM+Ra)<585 zIT@%&TUmW(QjHe10-7HN5Xj&lHiZe5yvJL}t3+d8+t-IGEv;{9S!|v*M*5KY))Cyg z51uyIvk(9Hr;(A7DB|Jp;O65wwmfuxdRq1jV|-lPj~AUk$K!yQYp#{Ul}lGIzkqY_ za&B)dTCV-N>@bMKW!WFDjf+-59DaTGhHY<;IUkt$7P|+}=PCZVs$v4cMO#ZfJ-y$P z*-B2*HCd{vsvBgjMzdo3b1$x6_dP7Xpg}@KOiY`y!4(CLEPbO{zk5Of64t_Lle8%H=Kve0nJaIQePe4rRxPLQ`>I3uz%-EN z*y;ROU;B2yj!Rlv+DF{SmC+G!Hr?Yk?u_Cx+Q#EV^tLm3O#1SD6_pg_kb+G}WPT(Z z?r+}P+4*T1FF^ST1^CGBh?DbgSiwH|g9YrHG>1x}M4$SPj+WYQIN-PFTEe?Gf2x{p z$GRRW1cseb7XTH)=(oV05lYo2Bx2uC2w(xM$`M*p!rkn-yPgVcsb}TD+wV+3HnMtLgi>K^_KT~Am z6aN==e;E)}_q_qb+$x|TqEgZ#-5@2cARsL2cbvvg-9(nk#Cx--#Y{pCf00(!6k17R!*-W(vN|WRD;|^adAT}uiaN)+_+A}r`aC|&uxw8Nu`A} zHBlvrq~C=#MV<8qvi}V}PJDl=;#IW0%63bQF$~`&I%0#@eua?=dd++$lNWJXe=yuk zcipT=E*?oEWOjCX&Z;pf-cC8Jz9fqX(CTI*XJ5uy1W{gJ;Lbr=K(_L$j{^xHq8A`6SL zC;S2e32~ZYLUve4{v6lH4<>1mZma^F8EM8~u*6tpTZVy$*;EH@uNC<4j_Z6os;gif zKuSH`>mw+*d0B-oy9=veFus!qKns6V7dGbA<&PGhwV8gNkiA^)8DM-Vz%5LNGo(BYhmEr=M>k|| zbsO)GZMl8Ca%MlyV!9 zkWpJzW4Z-!3w>^S0OI3(U#qEn9=8e3Lp#QTQuocCX{A&lnF)WaGxYkJYZ?XRj8w2} zzg332AS-K79&mp1qmI+^gPOd;up?64PG&WGjJS~(u!MB2R=4!GUy$V0_k+U2s9B2* zx7)`6J3Aph5O-71zbAaEZLQlDxwM~J{j&t^c?m&#U)4hVMTNIKbUQmYA_gI6jMJrV zUa;38E3te>GLMRiiY)ui4D3+;BU=-<_;=?*Qcl&c zaL@&xLR#8x&hGOMnxn5tdg?GSrF2~Pvkc9P4(i8f)3uxY^lqlCI7_u#BUk4EYCcPC zbGBcYUCkI{{qz_?e&Giub-)?2-8=IKC z-zf|v#J_y<4uh0;a>+-^;Yf$3MIS@6G-751c)M0?(sMpwPHzZ{!-{ z%t+f8wpo|an*At*J;Qe=?CN`tT`PLS$IoW81jl)ZlT;#c-Syhug!i>2Yr*s!1NS#Q-u%AY+$N}WXZckUMyasJy!t9H3C3C z*zJ1zc)~g!?R_x}IW_Y+Yb%@C^EB|e>*tGL4<_Tgo#1RcJvni!b}n#7+;xq#otQZ~ z;z|XImmultH8CIoaP-2^-PP!tRea0U&>G>F*7GIbTEv39W9#j@fAAV`o;^0#w!81+ z5XP2$chr_qinA?`QoB(hKJWioA_-k#FEp!vite9$f74zc-_*u`~E(K+jkCmvi zc%P=>_x>bP>WcmoGNV-aP0!-y>&mIx9DNI+VFh`4{D3#C!VG+`POb{8u%A$&ddU&} z2>;x2E`hSoyRpZ>ptLWJj`rnskR*VKsIbSyCj9U=LI4iAif6ERd>vZWioRfl`tV&2 z)a>ndZw%I1Ij^jmy1csZ5DBQ)&>&XWGwtH%f0dlb?>s&kyf*Uym~DDiwn_k~LMa}2 zG~liu{u?qffxe^q5khJK=k31W=3774B{xAJBm#tJJ?|FP)eZSg&P0J2h9&e>RadW) zCCfz5Y_KJs)kXquOm_BaQ4v{G-vDe@OHA!mgZF(KVBEdYqtk?v>t1`CXfS z1etgY7LWMdrH(|_@^!b&r{1iBaSUQWESZUt6*tHjK_l&O#0uB>5ww&9 zMDDvsrLJfM5!n@Lb3P-(>yVnaDy5DD+Tz>xG{kP_z}PB7+Txyt?c^tE(yaA+ z)CGB&*L6R#tnKEO6YkCL``al`vZwo(+DADX_k%d|SwY^MW}CH*Wo> z&Wh((6%ZxrMdy>rhRmrTDZQ`;4&u-l+ojf%>uH3zveNL2r_aa;XHMg>EeMWacrq^t%lk{qu z-r%fn~V~F;U_YOoU8ai7izu6_&d`%RV}R=qhUwFxrTDw4}IsS93dj3^6{Ics^}z47qpk(fUf?yZO0((d%K{%_<|X(dw=?EgRb_ zWe1eGRF0>nEE|=9BAn@N~)&cgf2@FB-%{|1A%(kOEb+f)Bit zvk>@b1th4}dNVgSOJyilx8BQp??Tk=4Z$BL_QJ?8__4RXpBj^f+8idw!Vr_i#0(%8 zILHzIYe&mnH*b~I0X5LN%E~}JXd>3BwRRV0ViFPg`M*E7DwD&vZ*oGI+1gh4BJL6sr_aWh zTIKfmZ5}_y0|bu-`Ve(^)Y77q=OZM4Zp5V3rY7Iug*ZVIImpmyc*^LGD^_LnO8zp!+^&0!s{TR~I zZRV;MTWwgClU)vkCrj6Ekalf6A!LFcXEnu|uQFu*m!W@r$0E?}?BWvcc^VjMrV$sw&U(lUySK2`dW=HxG}cX8W`v_Clun_a$9j zFS~;9O--6j2|>AXM53bJf0q>lgGC8=ag8YrW@hH>)0pQmB{n6b?%xB&L>+IcCrzF_ zd4j@z{HevkR9YH~w$0Da55%f*L?RV+uquW7KXm4*Tiy1Dm7(GFE7hTv`ru$$sxWeH zqAb0p3*~gNtQ8|kT1Y`cnU}C@cG9p;^#>(6oQDrTPmD$uS{=+0$Hx~kGk4(o&DvoS z06g(uipc;{(-s_t_vA?)8x|IpVlr=wGcrE3N?tH@RhhE@3LC zZ>q#yLEZtQJAv!|qvPOgJ9;|0#N@<+!b0wisS>HvcanjC;zv(!FDW^>sfo$Bf{w5! zxv&oZJO4mDnQ$r_OG{ZpM$FVM=_h5XH7v-fOd3hOqNW^%{5L{^5gBhfCWnUF+aqx% z$EKKlRc?0#fn5gD^`cy8z!mY|7syOyu_vqx&NtTv?+zw#zK469ulCH>?eOaFZn>sJ z;e|zwQ(vA)t%r*G?wjTNQ;XEQ-H8ZO5)p|SP4?YKUR1i06c-d!+b#yiJFMth-UESP z6>GnMlsHTgu#2x^Nxm0-la(X z!=LU9-M#Vyrsn46pDi+>(1}t#PZuShci(Jg3#|2R5BH|ayuG}kPzQg9`qX6C3^c^#RQI}&2TFOJ#zts!1_KhprAcvngMh(_nV zTJWL}GdG}Yq4(3|gt#Xoofka0t@Zx9{P`{iOfOwZo&f= zz78l-auF4MH|)|Qx-j+96~QYI^Sww744oCc!NN*16`-;LTM7wlUbZ;~-2w6`j9#c3 zotDNil`$gFBrwMc_%5Jig_sN`XaS1eQ_x;So88cG|NpEnlLB~PZoMra5Ufda&y)y$$UUnp&`h1rNmCuwQv1+^6h;jtvbPb-1(mMX} z-{rxWxb$ue_2dE6*vs&sAQ@dgR1hu}*p(H&E_PcvQ1K|oQK z2t=st@y^}dUFHcT6~B?&fly6`h)-ub$$f0sKfC-DC*Md5LZo(`Tw^g-swbRW|K%_> zBZK<111PFl?pd@c`liI5Wl(dgs;FeusjGtkdbp;lO7ys7z=QyAc<5s@mYA9t&yy6A zzqcVT>;Dcb2tMKJb2Xl-&d$!dot?*TH~vK~j{f{M^3EiWlMS&JfAV+E8_=Bi0`$M2 z_Ldnqm;N*?<9 zu9?{;Z&Yfk`lnBQ7+=5IiUJcOZ-O4c|Dr({fOU#?gH%8Vqgj$Md5Y>F*tV&?{TOAN zZ~})u8#A*ZM&?kfxa+@w*+<(rABe+5o+25arPtlUbsVe4D11XcLA0eg*@NFSHlQN7 zBBrXUw3LIEk&=>fz{1G7)9apzUBEuaO2sD>g*9)+30_1t);?iY!rpK)9HhKiynuIRib?KN#F2`&Fhqad3Y38AiF%^DB3o*wpJJ7F6R`cvHK+_ zvGTr-gR)mSIXx<>Up+N_vFVL^ac4|>UtgvvuH9koq-|7g`pE^9DFol#2YEiJ<(MJU z8cW||Bp+*`0DlOMaYX z0`(mMmXyTgU+_lyH;nuYQ!TAtG^H}e_;}94)n~kU`&KRd{QOBtr1Q1b-pC8~Vaus( zcL^g2AY58Vv)kAR3pZ(U8W4k&GB;FP8sp;5r`S_A*x~K%ql=5EqZLU~Qae*wgFpA1 zmJkZBr*ySMT{1s24QGyiJnV?A)YMtR@~HsG8cqW3%1(FL?r?7EE^M9BfLsu|gEpQm zmGwx}0Cx-cu8L^eH8n%8!-%j*l!h&||gU1*7GKsqs~ zI)asMlXQ}GHQJ;|vPrN!?~Q?K+aP&)6F*a0JahiW{)8<{Fy!3kdiqCacd1;d7BT`m>3szwK ztM$RY%fSpO(Yf50)_SxDV+z;*wu;kq+ zQAtVkd}}|M4XDMvOI=4wIetG$;4pxDE`K;ROZWD48SWpx_C&A9&?vjJye#ZAO4#0C z=K^14vVis_B+?JX-PA1}s;JVF^OeB+^Y!pZdXXJ8Kp}N`WV}EBpwI9=(6b5zH1_R| zt_gF_aRq0-nr|r2I`B$bOqwHVDh<-B>_|drV*Si{jM|s_!v}@v$p?2-w&Mlw%;6WH zgM-qAdhhiaW|!O#2T#+%@+^_Gh3i06bKcok%Xb;x8Zppq^f>)B>|4xIyVqSC>an&P zHh;bcll>qkL*$KTyf%&|tB;&@-rB8Dm_-v&Ere$MxD;Fj^=wpSO^- z;pWS5RAVxWi5|}@q_8r51Ci^&uY=$hEHtDc1#~xiAU03 zA-{bng)zEx#k(f3ZQz=Udj*Le6T@Ce zijBYDWVI(01O_=cp7`9_&QS~d=+qghsMtq^#cdcg@$+3+yfntF$B~z7u-)L))=th> zGO$=*@v(qEF{Y(0gzmvwPFqD&fNF$0DUn{A&tezS70@X;GIuAUq*bqg4U&XY2)(4I zkBh&XaGjVgy8$f`+q<%a*xd6K^!9K;Ic`bczmE#lv~${9SlJf$1v0k3#(zrK_e{sZ z9PScyi2#3sAHW8g7=wz0`Jw5&hOwVHvPxqnId;QDg?+3hw-*CxYChfZO1OR-sOQ63 zdeLk=IJf&dTq{XyQobq=6`|N(wQ=N>nKN$E&*TKDWGgO|n5r4Q`)wd=+q1K?8}?#6 zgSES_?{iVhXBDnyqI-^0B9?`x^G&Z(g!SR_po$ix9%%WI48nt`kR{tL z=AHY(bBYz|X=TC&Mh53kd#Qo`gGxe+&!0aSk_#(xSLNnzz*seB686Iecwg(nvdDyc z7ZxNW)fV9hC245}J@%@as_97&0bAX9s8WWQH-K|Xc1c)GmcS+_PN#-bfV-K=puOG9 zG7!Pdq_KKDIbg*I6p}Mp+@fzZIy$@0JPPQHO<&Sa;lE3dPE{B)E1t6H?2?#(=LuMk zMsf&I3Asfwqvpyrv8gi(G|N_3SHY7dW0{8c9dSc}Q=JJ{=NlFtx#}|I^{ur$?aUC}LYogH(M zfpe(8@$7XTZTT8y%vgK6YE5=J-Va zYIlE??czoLj!cB4Cc93#Sr_q`(aw+qG7l6QUn1y!)4WgWikPi)M^Yuf5X(W2h!4Hs z^BI8c)$MF#XKei><7PTq@|NBB0WHs=pDH-yb)H%{`mx2Eb1`u_frocKu>^nll6i2w ztoOFnbb6qst*Zam&lk6-eLMHcR6$ok2L4u4o)IZ|4ST4(f*h6DCi#U9jq{@JC1O^t zf0<0h0WolgIgywrr|>UlB25P`P8dw%z1rI26w+wFNO|Hht8 z)17{!5oJoCUpuDw$h8%M#w9CTuXm!9dJ8q+oe|&mX?CKoh7V`1^^}&?z3RVOK$+tF zU1snUdy7DcmV{&!Z|5(-?_4uy{`lSd(r%nGt1(oXIBwmlHBek4{c-Te(V{)rqD^6g zO*iiatTA2sPxgOe7=#bt*e~u*g(-hnXmP~GyZWK{_I@C(bXc~@>%jUNU8^zb%h%l8 z$FRW!zek6QE%Lq!mQFUx^cmu=99-?bP<$ScY6b8|1X*%^GYVCpJx+Fg)su`b}@ zra1;uetc@IiL*gqqUyyVv^1}@sC2H#W`22j*;ppLJaliYm@%MUm)`QM#(9t5$ES`n zl~r^SfF8ps1xmH5%#hjH)zvjU96u!A?FSq8KG-8BC#NkGH1hP%Hs}zvgSQgR<21TF zr6LwHTbStzdP2`gf2^4T)j9IV2DIcj&F{Art_ati$U!tv&6WhT+WgOr3^UNY16d{;+HXK#-j{LqV}ePE!`75(m=D{407 zyOzjK!29n(l>{T5T{yV7vsdx&rN7tN8r&YyEkm$udCQ;FcX?{4`5H+Bst4`2w+8>5tVHKhY>zI|&bWs%0U{cm0u zC0ToW|C@6+xwSGE!*~BEe-k-(f`S&8rZ(#o=Nous!ZY&Tlq>FSX4kFB*-TH2esPhA zH`>svX48RWlGokNK9ZBo$Olvmqyw>{YboydUe#7lb5~TF5YlNHNsl?RH@3;^an!Av z(9MwtV%?lfh0r=@#5L{`>3dW3{Qnp^-s8thdHDbb{Lw+ij-@4_e*4q<-u-(sh*j0e z^;OjtNQ817mFScGdB#`;0|0Aozspk2P<_v+{VrfJtQtzwO@ zzLqzdWlP@YyeIBE+wm2J+yPMlM1665p8IWhd%M8Ve55igGDxvZR#`~)B zTGP5)y^#D>Rd$~I-MOG<`$bjs*G%zCD#D?Y)60qZ8XNbGIjEnXLU7tz+r;k^MPt`wU5cs9&s?boPuLqw2p*fa-VR#!}CNuF1uQ!6!E-fm`kiWlwC3@`P`25-9+4&whxtkFvD=!q*d`t3!2we5 z8FCjkn8VuUZZS_LCuaJ7+^BAc`t8{9oSmP)c;q(MBU)$hpS8`LDa>-Kfq)UBgHdze zvU6Lk0<1;L-u`D~!>lE5fwx36ODW0no~}lOO$6fK|fq(6CPJpRW=AZEf0(gPmH;{o`8a^90AFU7^B@pot zs)kI3wFzdo&RaU*zAqILJY`%ilKUQ)6}GDU-=RCjIj!Gk68*995SFz5Z0`Ubcn4=>k?iwWP> z2OnthV>4yohROq2hF(I|$2%`KJD{Nn&{^O>Bvbu#w>M&dN5$$XUFbIOtcXilPKb8l zx>xL`SOa!9+Dhr;dXGcDp(BQ#cR#7L)K*VG^H7!tR6I97KYzlRoAdrkB3*MrI)bXL zsYps@(ZhLff95=4pZz)A-1ixQV-ZmW#g8BrlqWi?j|9Q7sja1zmy>hk`cS#%8h5?W z{PXC2GG52BE#ljwMNLMg6DNE7$39nygY+}buWbdDCAxBmS>=;Mda5@1X1*B>#)?9k zUjH+*BUjMxVuPy<&?=q zbJ)@|dw+C%7xj^AwouI+D64vVUJ?_xG&yK=mOom;w6nJ}VwO*9wACdBy5IFgTN2Sr zLMIuRmX?j`Wh=g0ziXj7(`9<*Cf2JOWwvoFAg0$M<-X`}n|TZCB+vaX3JQ<)q^zb& z1QS}M28sQ0dwP4+zTVu z>65l{if95Bm!%LZYt>n@tE@fV^jsLZ=fUhTB0?mND|g!C^`MaiC1skDUK1{H=aRP9 z;gD=d$ZW6NaejiPt*vb)`k;gMS8{Tkn8eWJr1j8uS?HY0`p7xIsG^MKG=Si=J*W_E zf7`ROI#1J9{(0&WmzZ6v=WZBny5S#0)8gr}vp!L)dC5W0nv|4+%z&fv)>!bsbo2@7 zB1tJpO6Uu#3VI~=0tDU0VIcpE49P@7$|FZ#NHGSaNIM!$Q?mrf`C1lH4Mqlrtt}El zl7u63Ss*^hvX&2>$14ueleuwf7K-lC- zMqra4#eGgn_Ssi|0I3qb8o?7v!3z6>aWa@Zwe`yCe!V#|u-_nJ0|68YfLzI7?e-9?s9S`X*V!lQ>HhkSKGhO7OBUjhcv^XEITp2xpC=qr6@Lz@ z!B*W6YvxIc(K>9!`A<4{)F(u=p7lX}6=PQ$S@G-TaZ zZb*Yqt-{3Q^6oKb`X&$^E21h!DO`9zRTE{q6|sBDVUk_ZZ^P^`Q1+abtZC@3HgVX8 zt`tp_IDj|W zJO5V3r4ACg^}KYErT=m84;G8kGzX<}+B2W=nIy-Ao3njsS_~%~=j;6@&W&;UxLw=a z`TmK~hh#gVHzS8v^$!5*7I_`Q2{9+DdL3)EThf5Mn{hyGre$K|n~wBJs$yb!!*r@U zjno1~9xXQ8T*im7LLkPIe3O>V$xEx8sY3?MUgwno`4NZS$1DR2L;FWj1pBBE5v^^C zn=)^COLT{yT7f-chBa z2SZ?k#A%|fh>bx2m@U$6@kv32Gbsm^cWb2NzYWic-Z2Wvis~4<-=yCXk~avgLm`yX zt}_h!iFbua>nI9)1`_j(Wak`SkP3Y?N;)x#Wv%GkOMW&BH#In{SA)_^E^S_yB22d?(+wBzs;%FHS3%K`Y}+L=Yv^P)r(o~9`I&kEcZotBU?7c7J{{liMg?XDj;nv3wgp1r>3v9YQRGxZq@e)d8p`?x=-iYjPMUaWksj7&nIx zYxCyYZ>H|=W1zp%bOqj_rZYxfrQ72n7R$=4pssCJK-}aZlVN9Ss?yx|n=y&rWhfNX z1?tK6_WO>}n8(A5zJq9)%jm!(}I9YZU6eOfW>I_zlm+JzY zi368ixAf%G?8@w(tJMt+0TqQ>wzj{m`e_doW)TD9k^99YQJ9$5ui4%mo~h2xX^z2Q z^7698H}5h}5?&hPw+Bt;sNAQe?Gpay5}3m&t{@#S7!_N2rp4*P&wHvg`!V8Yz=Te+ zw)Qty|C5swqGEiti&#xo+$tTPZ+-@2>Y3)<{O`bmVWMO&$jN_oH@ly}w@^n;!0G3X z6RTb6DJme3TeZKRs^jy|Pu|MQ2)3Sqnr$2!%Rxhv?YFYsW?sv_4e({|XCto~9%063 zA2r5TL>s|eT|JLaKpq}gw2VDM<=Np1RuK$N00vYAO{(jIC@_{>x zNV;oxci;UxT7Hc@MixyrVAO!9w`fRHHe8$_ks2>XbuvG@=tKzMs$1IGDdXil$9d4| zA!i)N>o$moEBr?2F}ax0DWa{n&G#iisNBTVm`}=`#zAl1MD0J~ySTm*cY-Da+{&hWmgi^TSv| zO^x?2$sgk>Kn?thLt?}}@DhF%`Cl#IzaF{&e=ydsoXP2$oM9}b*{9B;UNyQRi6MD9 zWnrk!Q!oSnZU5u>h>v4@glTpQ*H$T7o}_p-Stilr0Q%XU04y6uJIQdS3Q4G8=nFjd zj-=!ZzG3Vkn1ho!VQzL7WJBG+tu(OK{*pPksf|_6yDMX{eB&*M@_tqlcoTF+=BhL! z6vo`=olpY9;3pMOspziz^I>9!e~{r;C$hZSyv6)mq_*CKSKmD%n1lD*0v&a3>dKF9 zw(o5Bv(w#24rPb$ZWuGN*I#5MNy(0JpEk+iMX*L*X#oFCJEH<1`tX%g=O$M)5Q=3M zpgV|rnxDX+*UG`nG2r18#>~7jZZR`GZZ)dE*bG+cJ1@Z|N%RwOX*EPXo5e5N<=f6Q z+(<+%OI&oZ@~Sn(=NqPEvCK98N@G}W^-4sZ@hd+9mWUUt*ifI3lZ9>q?WW@KO2_)w zK^Oh3T?5Ycq;2VRxumSUY#zFzdF#?WnU>$w@|#bu6POPMooIf;8B`Q|eiSl*WZR8@ zGWh^nRCBtPZXUGI=lhJUkSN-siFd%;B>`YbeT~2ay7Dm$8vVL8EzNxdsJS$y)MToX zQ(9dS-HYN}Jpn%lnqGYDZAlvz&;dC=cA(N5vs$;}aZU({r$WXX4t~=h5U`kOB-}Dh zx=1sgv_C_>hG3F(sQLB$FaYsZ^B~g39Be=Hgl+DJ`&(YF#0BR1pLgS7v15nW z1kh>!#$#tJnK(cC!$Dg%?qULZ=L?!!Zt7~Sc&h#px6rUx6mQDqx(isIXGr_SNUfVp zu7Di zyfDXAYH>pPUX#VP&*Lax7HuJV_gRVa!H7r7Gq3s3Fv$4Mc0O^J?{IyyjJ3R*DzQ0T zuU%46XY3QjVjaObg~ceJ{z5LX@tk=Ru*6M+jrHraM(8ls@7!mf$22}fUy3lD&uE|C ziPI6SSFFtdpK?_3hpzBdwcmH7E~%yNC4&fRAcN)JDQvj7C}kG>NuB$U_gk8psyf}( z)4YXBfOuH>Awoq>lZT7__Xk504jO^m(v9s6(&-D+CE*koua=ocqGtEfY-kzac7Zhn zab?+s!ynpXUZYN^_*>}-ySBb#Zco`Hfz&f?%@R1Ca&3t;YA={(D-Guv`GbbR&ejZe zG1X3|S-6l^yAe^mKOLW9B0yIv#>XNiQ5tu2*)=D1(XDH1QRzEb!`9_X2V5gshpzke z3G_Wu=sb>=7Og8*u3LJ#{p4JDL6yt7v@|8Kn!+(IH?Gp(Ri@E9Fsm3!hd5@Y&u+&# zY#u3WSCwyA6+tp>)wb?h3nc#V+##RAMH%*-mxrbcdHva^H2~9khj-;5uI(utaA+^x zKmNR&mbx68&4asY@R|io>Kaa*`>VoH-6<^8ajED7bIJQ(&(&-2ULzS-eYLyilk7#aKCW-)bDt@anC23Z5QP+C zgrVbO2~G3Is*A$ES=QOnX~YTS+E14`g9Xe7d=92cM%aj)hxeBU=`jUK1uk?Rqd|)U zg}ez_4L#dLf`+a*YqSB{9kiSbuk0@`|0-XJVFEN=3=C$~@G>6is~FTJ_9=nBcOySDcS+)5cXzKz|u2-+A`>OzPG6Wo+T8@f6iPxId2q8c)E;?wi57U5x`K1PK#qs)ExJ6CqeCe`BEB{ zmZYMt+uh2`SH~q#=aG`WsoSCfmU}+D!a(=&*kTpMz>v&LLKKlVJfQcXFmDM8kY<2c zVu=xQYVyK7eCdS>Hw;sPNtXZPi#1{~{3SO-LMVDbAduB6EIPYJpbU}}9nG-B&OAq` z7@r)S82#xYA=bj&03@jvV-_FFWqU|PI8D#cO_C7HdjSRpJpbY`sF3m%DiVC7Ch|)O z(E5NC!{5*gMs+&jc*~pH6GRtq86n@Xcza7)kt2O^xm9wW(x`vY=8g$rtXHSu1t?mPCANRcty3!#lyox;fytzpX>Gbguq#w zbAWeo=F2uYP*8QOiR>wn&KcteK#T-Zap~{rI+L|8Zyu5Go1NKRKxJ%*9SRUT)|Q&h zSd_HEuTk89F#$i+I#Pl4{4O9W@yDzBc?^t2#f4)}O*iMA#<~eDX6HaH=VCayyt))R z(gDBh+&2@<$1v!{zRX2d6}@=NwW3NJ;`I`;^ECMPF54$n5F7s#%`i3AfJN_izB(JawGz(3XVuuav9ZN>ZhL;@^I6IEiRO>SKxw^8 zX$w}Gj zvWbz|@v7Dgs>xL~<~hpFV6eY`Q*Lx}^vrsRftez%tEC%BP57nQV_2y1<_4e= z8%9v$ENcDjH^BHP%W~3GFB^Q!e*rRRiIA{#8=dK1?`RSBvs71CXCfXR95gim1{+i= ztDC_}=fC=OVPD<`$i?#-#7oJvc+ezPz7)?Wq|m5!QTokyb{+ExND=$g4y^S*CdhUi4v~^`K=H8QI3MLe9NA1%=4zn61^r{?+fnFf9)J24*JTM zcUx;lZELsY3{SpIUw+Ngd6B#&+ynIKqtKFtm1bO;vZOCwiW~V0vMMbKJun?3L-|C_ z?&Jgv=J|#5ZNVqm(}vgABx$iv8LxVMf~$=zEiCvg)?w{kF@Zne&A}YF>q+%9(^^`j zlbStPu?jy%%y4Al-s>eT&z&XXWAo>!q z&%(y`Gt5T{Kng`&E-ePsGF!jV^b}v-w@qjs0Z_TDD0|wG%}MN8tt4KtGDv>!zhC9` zlt?fH$uAoBYmZF8M&skhOejRYLT!63XkTZl))8|fbaPc?RRA-@r> zH8#T9>^DSUIr{$6&U*r_)NVSe7XZIHp9X)|owvdHym`Cn-8a{Q?<}y?kkF9HNtl$( z`&@>nvC+vN3~dH4TJaG#`E818n{DA9mWHM}EgETnlNjNatnB9H7Q%|W8Tm!&J*l3t z@NdkYRqqd##M^kCI5?g?ek|#S_%GUi4>1kXP{35nvKPTI#id89KMn({CZAPThujI0 z?u3?p;r+R@d1$}22@GU6!Fi@QG<4rKZmDU0rdSH>a8h-|n72u+*sLwq>??3_&PqC% z^RNM`JS}go{Kb)%4=@Y72|$KEG_>0+D*3H`B?%Khu$-X%MRsNyF?RO2>sLw1$zv-8<(bPHp<96ew{MLM{i>)OK`lF~ zM+vaBX-XIu-M(W;GtQ->*XSI{l{0V(DBe^T-38J0)bT1F9~6^}%v|$wfQ__oy2K|{ zlU=?zMAf_}BFf+8<3S^rEpP}6Dbg*}!1vty^)qK;t6xRO5Qv$0A+N`&9B_~Ss|AdW z9q&wr8R1tTw6*5l_^f90T9l!4&WXywIxRQiLk69;>ltF?I><4CJAp6Tec7*qQ>xQj z#h^a|sT9BGiF3J=uzTLykyh!*k=#N7~o~2(Psi=OlJv zmlo3%F{56E!pW1n$8-e+c=wm@7yo>EiJM(i1pfT_1v>BSQ5Rt{8F`ACxmktX*yl=a zO8P-6Bq5sNSNrHksal!0Fz3tB2?4LCgzfDKS^D=Q;%(+VJ@`nxiwz-p1Z_$B6E(F- zN$weU{@70_d%V7!74B@Wvk6tH)unr0S}QBcnu%d6w#YYK4h2I1wkv(^*t9?30t^<7jI!JFZk|hgq{~ z6FM7=FS)YeK*}1dt5@_kALNFTVjW`lO9RHn?7__2#XT>(dt07)rbbotQ@i0Zi)Z14 z@~c_feX#?LS4=~K^MPu-^1XEJN2}V5#vbX)Z}0eYs%pvgs??@GA|`yFN(Cx3#O2!& z%{=V6h>$TJfnZ-wU{8gyCIIL+Zi}$lssI50;fO9tIU!eAXpv(-8Q)3SyuhITB;`YL ziECnL+7-+78>W}03oa_Q`q-^g94?I1dB^e-$J@t~&r0pnMT#`xo~qHsmdn-3b(cZ% z4Ia5@vu~L`DllJ};#q1L6uJm?g^Rn|039K}Vo@f?KM_8a6&0SR41w2Q+1Q{r_*4}p zE4m#?XDW?e$0D1j_GimtH*3lBbIZ zoFXC{BVx@NqXA`Gug?$d2Xk}2GpjIXjm=i}K2DITMdZmF>jpl%J*FZe_3guMW%~7t z!Q}$vYB$eo^IMn9%afRDphc?dEz>cCKlK(%nq0U_Uz`(dIzd$-@kYEIh8n09_}tN zaeRayB1nV{rBX~*TBB17&M(Z}m?)eFm{t-Qfk&}#X@iD!YPtD%d?`_{N8!rbIMq42 zxpuR&)An|6$B>~UBZwQMJFl&TP2r9~rsB z+Qug*i}v)zX=v`!+YI!5dx|*~;X-x$80oQHJ z5k2r!kt71Bw)V7!`y9U-@9*DOT67g3kecohx^k*0(+<<{7+u70>57~rRtlZ6nRhv2 z*0I22SA_lrsO2+gls6_z)uw;9%IPko9F69W&~`r1$tuc|_Qyc)qi8ufGxEJ=>$s?#@@!aWdL=Ck|;Roamv$N51n_3)ry3++K z1N51=;R(MpR?6}})w+Om_v-bU9HJI&uX*D0A#|Wmr5vWDFJ7opK5#V$2)rN2JU!&+ z5CwWG%GC3kj(u*(3)w!&yKIvk9UDD8P6V+gM>+xE-!1)qI(<$2bF)n_tIt+;8L6?| z=MBv|p9KZnq&uU+;s@JgLl5xooO|2oKR}m?6QVBfp{}d?TEl0iK+w&Xg+zXCV*h9r zv9REYkWD)|L#}xCcZ@sOlgxX9ed3SHo;BQPj4QEBQ!&&j0r?I}mN4>_b{{G71@>;Jm3t4n`U7a@HSK%6} zj;n=-DtF{qwtGgpD13)`iu*cc4H)GQ)hvNe5q-dGZf*p$oYZ}xgYil_dwg&j!eQUN zg3wGAvQ=4&j^;9)h=<002NDrt7NnVp*}&cS1b_dO24H6?C+naByr_(p z81zR@r3nLtJs(4n2ue@gJG0etG5UG!QQe4?i?79cBt*n7U$zZPxo;j*Bqy5-xIPxe zv78(H+9y2mn0{wtETg~GK6^5`V`OA2ulZN*c>eNi)3524$XUyQ9BDtvP#yDem_7al zD16LEeqt+j{Us&|RbN|MGcz?;ezy)SCGH&`96UpfXgmy)zkT~Qmst(>k=gONql&cc z>lk=J0lo*OprJuTd3VLZOLjOk(e3EW?0Z4VEYJc>@;4jmxw)fQ0g3r1LEJ+6M@_|F zl5#-D1*4%G)T(bFoq(I;T`;PykF+;;CIqEp`hWeR&&`xj=0!(dYau6w7;gI$gBz>0 z!XNQKYuky!11=;xX{x~`mE9grnFWJ!TTeR84MdblE1Ih2@eZ9)a|u&3NB6ERL1!|6 z@fA*R(s&{I%&f@d?7+%^kmY2Hf9|Z*hV=c;06ZxxYX!`(BDwK2yW+p025Rr`+pes{ zZhP<%Es+$d|D{=BDz*BPmv^#k`mTtxsVKCQxp+5G@kKA7UiMc@%3b6>^x`Sp&m_^d z>K@y^c~geYM46oH+MJXvU8XCtSb&1IqQ%aUAt{b=SFKQ}mY*k^KvB-|*dy9l!EjT7 zEHm>eY-)5OPXokDNI0tyq@-t_SWf=Q>`e9Y19B4@w;vICozuiE6qb@uz$ zqgj4z{*oFA2?tg_%hPkT6qD?;S%=m`fIxFZ-&IQcu25H$T&FoLU|35<)DD^+QXZ+o zj^yL}0PyWc;HGurDA3Jw;*x3y=mHDN_NQLJ#GO()?TXf+TGFshPc^zU7cXewdc{dN zBfUJcD1H%@E%8O@9?&;VqRWG)@HG7kbEZm6x7i&gwl=WH_ zR+YQ`I-E0umEHTlFw?m7^;qN%Y#){;zJX_#%I6f%GQY8mV}Uidr0vd-9 z;}b@>ltNh*S~{ddhFv>1vz1|umD`!BWxu(bGRsnPw9!42BYV?m+k;=p^zO;k(=+Cl z0-2bGt3a1ZlV02#if{jfNBn$?d7LF~aaNe2+gTpk+TeQCe%$MDmYTJmX*^J*1kxwI zm${xgZQ5RSNd*0zI9T7xJyG{F_4tgmyCuz-u&Tq?ZK%Mxu8sKSY@b^c0<)D_MA}A~ zY{H@hCOH_Vl|C{ttH;?nRyi%VY?B$)mO_r6zmRb@mYl->98rOyn8v8T+w*iv%%*>O z5&OdJhf;p0cB@J7g4Ia&!|~y9W5TH$-KEVCzLNWolhn(2GM(NiRCc@D_{*S)cAh_x;kPvy_o)XMhusq!-ul|jJ}ll)!O;!JC+w}#sruFcoc6N6MSst8Yh4ABM^`R z5wyWekHdy}iQ{9~Ulkel>jt4z(>R9Kn{I^UOS1#N$}5nK{!&uK_(xIgc5}S-Omo0v&Z_u|xT}P*7XO6igc9J3JnPYlYYB;7(|*ud#c)ojjTRI&p9t5>*o# zQ8n?thFa_Eg4R&{vZ@b3{`bIU2VV(KR+l6yDQG7Y1ykC5 z{-W)Nkk=dTmzr%u@72`C>M!uHYc|>5Q)#e+atCyE?s3@Ic%F^?!tRy)!(P9=Z+*zz zcD6M#kP0ai^I_Kctx)_jPOYb9s3ZO%LtGUvrwlVg;RuW3{85L!VH7Ok;}mS5Sbc~( zC(dLF-fN zl&XZt#rFr44>YjzZ(K7ImFQ!6P(NCTRR`D+1Y&-2M~?E&?FKh|ePo>+SM~-dj;8pg z*k1fvFH%L;Kc|S(lbUZ=5qU2b-lp;N={CR9C%vI3iS9S?((qh}h+>{+v^B^G1Q}ah}L8cF@*bRV3o4WoM_x z#+q4JEX<_$0+Gi7D~NLlypFqvX1rY>A+fN#5|Hy={NGr>qnhrFQ%^b@1JcN;mhiq` z@g;0__V(=E)W*ptc>RXfZBfM@aO9Ky?J2(k3ISYK6>%n=XN7AkX&HG@sc}r4CQ->T zy~j!P(zFoIILXXZVH}ck=u>ag{J+GcgdRLR*xRdfykb1LlKh{I5rnvT=;a*icI(6b zmUHWFqxmnr=zn$uhY=aKrHXGLVM-me@~!{)3rvKZ8HWUe(^gE`z2f@cGwUq>-UFF_ zrE}d|Tg*WvhI+O=7on-fq4Z;w=~6`gCsieU9nP-|8H%t^OI12R+4}A6SFOJ&XB#(H zb_OSEC1lZgr#!{wX5+8~>yNtpH6tbEd5J%ER~d)7d^dtE8<2kVTO zNUyrPE_t4<3%gV$25tD%yT{u>fMc?f(lVvU?`T07FCBkgy39{JgJb+SP?1Ju^<)O4 zwhTgD>;Tbn2#%!_v)bS*k?~a3hh8 z+jmzATtx192T~ze4jf+V#Bv}!OVD&63Mg0|} zqdn=@{Lw%cbJhOPDJ;p|uiYqaNiQ1rF2F=C=})h_N&4ZVKu4sM&mtPsCI6cXrKjhu zbL?ofy1_MByYenH5r!x8&6NW7{_N63;CHQSo+Fc&oD5@qAk0l}yarcbqEehEJSUEg zld~+}(gMsk+(+tSW4Up?0d5rH1HYix*n6U-3l_%$Q;b{t&{Ln!9#sZmj zRAS7mAa(!m=I7*%w4uO_juO;9q3Sg&qe2v*vz5Vr&31S74f4GD@GH~K%EwMM2GjAf zJRzNs|5!%zR!o-07_=acKI7ZBgspN$jAraU!9XYM&IN^wS`6c;$$O#eUNTp8@_tgK zpVqCEs^Xp333+dW3E$s_mPUL3!a8-BbGBuAD@dc1MbVsFxdU(gI5h&O+;#8m|(k-HjQX z%$}1&u&1YWzr`T^q(VSg=~XDdvT`X1>MA!wMhK51(VP@II^a^dehjX!?A{beT+QFy z+3y8mafCpGpd+3gyx@6`XSFan4U=R!M_uHJ+`e(qt%E_%xSene@OThjevY8x-xH-8 zs&G1XfI>6IYTG}I<*U}h)erYENmDuB;v%HiDXLwodDABW9%-^GWcPs$0S6WXL%eri zgs=8fr|Z^dPPk0u>=V8WO?cxv_Z^?YLne@U?bd?T90f?lDb`cat@GF(h*&(pIe6kf zMNPw7jK0jURc70e-q=tllnoR_tjvkyqyughS6G`gAeajfo^5;ySw3XaS25A*W#$je zD2@e`-_pZYE6R~dVC6%`X+a3Y9V~8ZIkx>RVz*OOnaaWTFs~Z3nw|)j-15IOa0*#0 z;>k+kw~v%J){2=KrZvT0LPKIMaPxw>P2{);m7iC=&Wr=D@T#TE(<7chF z@NT6a9@s`@aqpX{U9%`MORL7X85+3o%M|@np}YfIMRMG#N|*gL7a6-9^93{3Q*+vG zO=2_uf%aJD)X$j)*#!lTGJ&|DU~osT7p4{9Klae`A!;v`T-w%>mLgKRbpP=ILq9-$ z+ldpd(bWiU3_hV1`T{UG&As6)nw6bJ^Sk@J`rv+0csNYBhST(um9C1)k66uS;qHer zSzf=|PW-+!I$i8}DZWtXCmUzwFhZ@E4d$}QU6z?VjeE9c)s%MSt;&WYT(yeo*g@~V zxVrN&S;*K5`q4L``gY8-Qv_MD$&bUa&^&uD&C@qa^QhWN2%}HIwQjYI)$fTyWoRTY zi7>ecCp>k;PFcQlegR74Gl%u8tXv?SRY}n3ET`!A04}oyjyk;y**zM^tdVe{1mvT`=LeTZ}yX0duF8%ka-KC{z&|}?K zrnc7lqNpN?$aplKVLN-KbPkAWR7Y;uI)todB^E<`_48TNU`P^zsy?*q+ z%s`mzY?(qK1WF~&{e9n}vO)FbNpPW=5@P2ZJ%Qal3cLL0sF7xr>1*(mT6?3M@-p>} zTMlM!e%KfjAOFbON?$rq;~2TJJbj~e!IT*j5h`4$XuanQ>fJr&g^|~cmiLg5I{}h^ zIa}rB=5(nt!Ob=3>%ndsQFuG%&p`*wsYZdUQBbfRM9d{?c^fxsr8NaDYP_&JV$mrf zbXUO-HV!A)pmNp9Yzlh`i9N7>@}MbOq_sp6m{O$Wi8Im~Jukpku56GJpCGtS&AK(0 z{f8aOfI?&*lsMTbcpXl9Bc{e0usx%*U^J!9dj{y9 zyE|De!*3$bIL-EDmI95>y461e`v8Xo%xLhtW1iSIpvN~S(+UD;&cQ8j&iKQBn61X% zcpA{o%kG%Ul$bcBdAp@;s24OGt7O+XGKkTeB&M{};&^FE+^KuMzq|1^qqeHF6!#>L zsS-B1yDPDXH9RkG*oZC7{3-ibZo1Pg_?mB_Pue^VAM4f0)Q>u*u+`E4CA7U9af$az z7m~U-@2$;Eg5($7noO$!`#uT(W{QCK*sAM7X9o6Z8;wS@aW{;P^B7uxW>#X5mX^sK zQMSaQKDDnU(z@a4b?EUWxOen-UV{3en)lX(Y-+>HmsvXQN3g>u$3Mh?4MZg*e7rED z3m+Bvc#uw_-aR8zd|sKj`YYmd6vUBq3bDLFe6Z)^8Iwzh8v4L)?a}?U0_Ip7#-#&k z{LOTVQ~a^BVuXOV) z`yx3ry$dC=Y*8|?g>B(e@~D;>tWq`izgFq_I?Ge@qh@*J!XgNaHBv7iYCqKY1>O4B zveYsJ72HU}4T(6U?@GOMQ)%xhyy=lTtXTc9rG=Wq{_rz$9OOVJ=Z%+@l?;xJNz2II z^FIIT{xa#20fDksZEj`e3=8~szJ*0EOFkNn%UND_X{`g1W9Xk0Xfl4;v>S`ii5Xmc znGl~i*fC$aSLAnboqi@J6^2knvK(mqo-LtDRS|MO+1i>$7|*!j3M7^P3&Mkk~o-5G;poDwK#3!gVL*8{^mjrW@4<^yZGO^E3_?LQv| zz6ez#o?F=}y}r;|s)onHO}NNm@AxQ> zr24Vd>c9RuoN?J!xq4EgriSnG&*U5o9S>&1wZP;YK$q-#Pe?bx>{nE5x>Nc-ntj9Q zw!qpyc1m->su3AgKl1Z?E-x<=3#@X@2u1TI)EzAbI)XjB#|m;A((skJhmb|zDt*#k z^P>h~l6D_&9MZmi&1F3>!EvgKMfQi52fp6&s*Z)<5v*F(s}#wocqs3G+uzld7jGA3 zvjxMbk1UBx@3Sy4)4!9J z5%<9PS;V~!?0Fm$@LCbNS5zx(;QzfSy*Qc=1355<&6~%(k(I%jSpdPn*fu`~Krpn_ z=8(yNOVw8SVKy}?@-*VCTozwxVs&h5YlQ%(dheVIs!J8?O{ zXDC|s$oKb(&b@)r`nd5ML zknQHx6`1Oke$&|;L8v$COG`@wMHY}Te~bNOuHIT6hAd|y!NIw%KSLGBlmk~8(Dr{3 zdgy9{VZDgWD23qq=%uqVGuAm=Kak@*M$3N4`;36)hJ{?Bk^x_j>8gp}LL%*g2Q4b5qDeUn*OAAqlkmzM1nI2V)Kh0^rk6a1{g@t4UVa^Q(n-c2Z?c-MJH>QU!9CGv+RUmdHlq zcY##}1XML9lex)Rv9Su-R)x9^_dH2Otu-_?{utO;>(L4c?U;6eJoD=-eD>ntN80@V zGX=?c0j41E(eJR%bQ;>ML;){C*%*@TTesik+5mZ5dh*NiYu|brhT=?$*j~zObg?H_ zU`VBP>K6f(d;*$nz4Y#wGQC4)fJ-c+Mp`RG3sP3sWhMJE5}3)d2VN^%5EmcCm2}aZ zgog++JEcX2-Jh1ptmux1*bu}N%cL)VJ@!~SyjQ#_x)Df%^|rNzp0!D8ab@>-*KtjXZ01@t| znkE0e7)e*DkmN@fe42Z*VZ^V!h6pVwlIigLX2{$WO{b=&M4u*`k2qLQ#3zpp4_hOf zInVp^GS!9Ms${jSOWe>7)5DzVa{yPnAj-`CuDu4s@&v$D6VOHo~Ycd{0v?iaAHE@l=bu}{OgJ-?4J zFnR0>WIkGT`$kthK@r<6?+b`yuPU~MC~(I zZi81D@N!R0_|BcGU3So;kk!dJ7Ol$R;qmPI=H^IXTm+^sx9`quP9x}aBKy0$Lp=}A z!?%+r_ebN`=&>~mbQ+q7B(gO!+T{4WPE)fLM86P=aO~bW9d!6FXN;P#K3$n?k&u_O zy_MEeO+cEy<)D<>mj+@%*Nm)&)UVe6VEgbhaK6xvmjGOHV6ZZed3(8&Y|c3<-A(Mp3#YoTZNOzl7F zLA6IN@|w%IO}it??ujHkUFWZ~`WQbXb#thK^KXFo=9|mWInxsQ>))WW-mBG66Ik+cCD~%j-hvFtyZgBP6zZZ*5@F9 z;FrDlsp%n?b=ui@$Gmfs^IBh%BsP0vaGj~jy&9ji|m7^>hK$WsZ+uF`J($nWVfo=*cw z(Pu3haimFA0;wy6knxr3$n95~8*kn{1?oViv@_)DZ)|BpR^>Dwcb zftkZ>NMSp0yiv+7xETH}CE@SSh>;Wiu+|aSEJ8_{Qdyu!bh(ijRzR6tm~-#aL|xlL zR`S!G6T7{=*ZryfI9|2k)3{Z`<;GOlwt}QwxWIZMo4gp&(b@S4&>mSo(E)nlEh(8` znIKgamD4y_R+fDAtvFQ`$=KtARb2GR=BP84e-)*ifPtP=_E!N^Iq;z((&g64OxM(W z*1tgv%g7Tm7g@^-nA8AnntTGmkA6R#!X)wV2g^&JFQtBpHVXd^`#)RGZ})9AHTkx-e{PZQ9DfLsy>VqV zn3@(bn90Cl`u>F=SL;6rpHZW+YJHaZ%pFQ?CAu*3IwQp{v%@nEZNtuIOmUZ4x-HIe1=^?*`y5GQ60{NZpad^apU zrk@sSA22fsvBt_bnm9ywTHwJ|Ys12toIQ#9AY!i_0@gH<2wP?AorZlpHA^MVpTA3M zBw8C?Gt$zGEDgv`UdAS8s8&GJGj!QYZ0+C?kEq(~^P#Y*qrAA&yyiy7`w>jV-;=46 za%k+1v~G{-IRtuA;;Z%1+G)5PvlVv}O%-+zA7VR5oI$>iB!FW*Qw@ra*HEHRou}xF zJc(CK(YA|uan4K4nVr6Yh4qX?zzTbAv7@)Q{@-X5vFxO4Qo6Qw#6ZyFKj;v)+pqvmQ*K9>*q7E`9!@{UD^ebBHA}Rzel_ zJXz@KF3-Nj4m5-KYWHgN=MA5*jUai&I^}2H&5bjIl`or3lm?g;Du@uyJ>uVdN zPoA(F2{+hXjBy<&KxH)uIUPo-zSfWVXN!#P=R7Cm--LyJq8O%)2MpCWds5qmyqXi__zD}Kz?xIcjM-z)!-!) zNnhxb3r885$lP2_O*6ZtLt}@aw;50WHzD_O%+^e){lXG_K1~7jyWzrY4D7sfTyj3o zzUj>0w>a#B!NobTd*td0+Q{MLqeTzyr??!z{5X`UWB2%o*mCOrtjkL{x!uN-daf^) z{yu3+P07ey#^oBPw$l8!-oivgT)^{UL}gUB-lG8wya9)T8UHIiVW0arst~=ZZ>2-v zHZT$hulT-{c?+J$Pe-@M!Fz|SwP!C=UuMYktR%-jRyTy9QggF z{qg&~`I8Wh8@fpCm(XRny_9mf0tm5Nxhfgv$j;7hz6!l*B02`jrPI?t#+3@cK*1zT zI>RYMz+yX3@iHnllKD8BjWLrvH>sw^4V@Q<9r%@<6{4Ug43f~2v!1t8tz4DZb>2u@ zouvP+t|euBP{xboMr6y%@bYBX^odGcq6fICw@M*vGz)JZ77W)0!95yS_oR+0!*U zE7UXy)erK#MSt0>r!S9|je=ztP95`*!C;X4H_y38S_wTm;|BmeU|KbPJ z`mmbXKN$VCNHCfE0B`&AlO9iXX$a*eqMyd8wP2}`0&yYL-PTHew$*bf!oTU*dI4FZ zqudGuyTvqqf8}siDLtKA{JF37cjo1uL|PQpbjzI>Ab|e+*J9Cw1k8WF`$+=|gTKH1 z9QmI>Oqu`WEdT%K2R-EPJa{ruloq&lNh#>=>h8{w8o$3tmzb2mfvv<`$XpE)4bM+z zZ-Vh#jmL6LeRBOk?PxBq$I&PjW42Z$rDT9)Nu30f(LppEebQ*1h29yiG>c&rfSep{ zd+bcpG6pe75g0b3dSo=uE0wdiXHLQa3tL&_4j$#g0#v8y<0Y5M&ueJuJGp0$$!Znh z?|p)%w3k~gpRh;5QlOQ()udWJOt6n9GJ`su!^4{kF!OS49V2EDU833u6&IuY{QUmZ z#*u1!^%U&`D{Fz^MPoBF87kU7R@P-UnPcrB&-Yj!3xA3mlb;pRe9prW8Pf3 zF>YPtxOuFG&;rTDcvM0kk;lo?@H_olWza+(Yu#~#)z$eCo%|2<`0UNb%bJmi32}!( z2TgAMmfs*Ivcc^L3Oyn;shZ&G7?!0harjB&fIZRR+0I*P{K@DOJJFYgTNfpeJKB|d zC*e2h>B>7Vjk-$Yd1HzTJE1-b_EcWB=X63h8M?=q+zpne7&93a=z=SPk#m#x zSy&LJ!^X@yC2!E{%Ed_Ovy)Bi>33avPY16&yDF9YQ~2G_(b6f}&`KWZCCl3IaBIx< zO*izK>UH}2f!0EWOixK0JVoY-%@9T-v zU;FNZ##nv$yr$(B_<-O3d}M4ba0SsE$ePCQs1%%;ri;fdr(rKuh>HQF*SQJI4v z+n=5#F@rz!Lh`+|d(Dl^3MMwT-8?VP3De?aHTXq&9b*PN%9|(Y%&^Q7dA$+S4Xj`^ z>WSZI0Y&FOnSy2#($e=2MLbUNa6aQNTO}!FyKdN>;Y%4ccH|@*B$gwgq zHaK1ozu2>VpQncS6PJ;rbhz9d2ZCfD>^1)CD^%-E!+iDuX7y=lX>{RK8Jp$ccfrit zK;a*iEsJ~K)dg7e7kqa+nqJo-A&HxqhzG_8LZ0X17WXX{9#Zf@7a|uHqUaQ+s~71s z4?*Mrm-V3C$xia5hQ_q)wYHhrhJ()J@Gw6QT{{ZXS8Z=x74AW*Y&l$!oQy!AC>lA8 z<#A#e;IK=0^j+q}{Bp(W$ZtV^r>K z-X9CyY!9Qb9Lh9Z?bES4vO*QAG1O9Uc zUg;vYk35XkZsEg)dYG?Y_wM5D*xLiA-M5zB`wO@GAG?mNgSE~H^&Op?9M3EuRZu8= zDJNLX35cSN*3(TL6-r7A3T9MsBgEIRcT=x^f5JzO3bYeEW$Lv25?S-r827+|+54A9 z5XA#n0sBX*PqW$9jlD_UBuG=Day@%-o=80J@ALFd&mPZ|yXLl|oSv)Zslb&=S9%hL zF|)Pd(Ag?4Ir`>6%%5EjuE)>)vMMSgRJG21@w~`^rXr=qmpV00Ny3=y^cHH;w}u1* ztJARv{^{wBhOn>#&GL;PqP&3cC!G!DALgm$Sb8BOY&EsDAp9`&N)$dp7RBehQ?q~4 z3&KOf!-7gmOZ954{PN5#rD@SyqwZr{yN?M7M8#73;$NGi*NR19O1h+@A@}eIE~jG> zH&(p^6xgEG;Rnt zA*=+CX_E!N1O`GpAu8ucG>BGp<34)4r6BFNGn$82ui9VV+=z>DZSeC`c2YYYfe+Kk z{-7zpmBvM1o>1cOOubSyZ+sG|-rL^`BS3MPkM}1v7Ufh;47J!@ormu1?Cyldl`$^s z;50NOdm*d7QL~yUQSekEv?|GxE|Cz?O60eh9Ktoh*tE3yz4;eaaiK|^+cUM+z@@AI z@!9x#P>lJ6*+5pes@R6y=aT%y09?VTa?AFPQYFuli#OxM*JuH6%`>9j_2;fvIx8qq#Z` zF}vMT&P=Tnh{#Crgr zHa*68bqhgPw}9kQ$Lf|Iv(0kxZW#x&lf1}lGSp>BiaDgfif%itkZt`NtCx9cC_mDWsOHXOwjlsDJ zDP?9HhjHJI@CQYky_+ej47-|7c+EI1`#DAX8n|rcequa1BrFg#mMRCwlyRFK5n{lg zIQt!2))q6c#@!)dOYZOQU)7-YPPjO}K3Yw6H)-kacArllGJ7{Q4mh4scl;-8pOfAL zW`7rDaOEei+_~WOCP5OXpkb;pb^2d>sVnkmDHN6vnVGDSHL80{xgmaOBkcZPoiru3 z$1ln5AL`?=Pm2->J^HpYpd8^G_s)@gfg<%ghqfKX9=T~e~3J0Jbp?1Ek_rI5oO2(Qai zV~taB0S@BK%q*Bodmf%ZUo$7sKNj+V@$vDe=T1&G4xC)C2gin1*!ch~ocekbn2h@J zI7s)lrgPlism&*BL)AJL8g;9IL|cHl9UrT%xd{WCQ>6&4nHo`7iOo(F#}+xZ=}J$E zG##-+%6O)96hg~sYogc@bM1L){SAgdL?tD4%c~da`Zf09<71vaI`;O?o7hHHj*gDz zBP`br>X;F+ummX63!1$vlCm2&E^)B2CzKWJFkT?}Tx`-*IuBY<{^;phPgj>)e~Qku zmcx#Oezr-B3pb;`I~y&nKj}oNdLfECpNI1m+G@yxq}jX?0{V-@_ZiaVq?U1yy5=e|>j*a>f%^wRqqE?tvN{ zBVc!`2m+N(b})eji!zMUO+U-N|M;OjSou5l)e#Z|W^Cu{WP=f1R@cP^OhdTuY7!Hs zCzUFnE-cX$6)d3?IM-ciJt5eO)&1E#mGcwKElDMy$l~eR?Z(YOR zh{zzD79mqT=DVgQ6_Z&hp7*;{>Gkqjy)vDG!`htK(e7ZWvAFmI$Zm3pr7xEqG(MI^Lfhj zgp-R4;Ea!r73kFVMbU*%@`A$sArKU+G)H@7KBan76n?!{>U20}d9rh7w$3%<3%-}d z;^Aulx?d@tIG;^~IN77Um&kW&eYq zF^<#un<**!-N4uQYRS4`MgD~qszG9vNzw?_5{XuWex!bpZXiX)Q(5DH>$|C-vC-q# zc&nMKqwz15cSc|K^1=GIfZQqvpxLbC1JgthRX<28GnGRFw1wjZI>~&NlHec!rv1n2 zlc8S)AS(G}5+_`fo4m_NI55bC#Cp7de1vyjRb5mmYMlJg5(xD|C zJ8=^}5<|_PZbbgTh(S5}!`~NEL$q@$5wti)-z7Y%gzBpyJSD_3I}ZkO$m(1d`FK`E z6d%P%FLsux+i?i*8B;eI|8YB#pje9KJMukX8YiM9wXGqV=*z&h`}nR9pDAV zZMJ3_TcGvfvuY7A|)d$H9O)v?=W7KP39H^;_a2g zI$9NDKINwZE*(9SD1>f#r2CUXX2+FwJ>NOf=&7Cqb;+-pf9{i?LCL)KLCB3Dt{nkt;sKG-Q0WvpO- zuxkrFz8L|Ov}N_47Z1_xFjHiKr-**@LMzTVLZ|l{p<5b6-7lYvIlL)Pb;^N12WU9j zSVm&0Vdr;;>&hmRU<=FcCmX9@AvU{1Tk(u1g>j zI52Fw#?gMPXWimClNz&Dkn>IJ)(oibSfxZkYQN;3&3E zAo_Yn&^_>|T*k+Rzk;k(f{s#tF1Cl`k_s$MMEvr_ON=ZNzg?qbBIoMn)+nc7;C&U` zm?G$o&WxJ!y!+6O%XG3u>loVudQmk|@v5%*lawu6A)#yhTmmwB=5Fe^Gx zz#m%Bu;(`UJ;+XfC>~-_&oXk{CMQEB*)bzOT_D!p9mk4oRBd+#U1imA-o8AkEup#w z&+8DDZobik_1WTIGId7LJw^kRzjcC)*kb6Xl@(rIUeU%?`CnXP+}uD3B_eW?NepfD z0<6|w+X3TAMSoAIb`5SQ?3H- zw*e%Ujp(bdH2r>gIN_w-ecqLW5$Ea0mJvnYV-aw zcvSVSQe2}fC1)8F$cDYIC-qX;yQ?XM{XMnY(2?8^s)?T;yQIGzKE=z7RKr#%=z8;n zv7*b6L1aF|+*L)=h;i?&%JppQASiP39~iHa)+j&>7=05$4S+oV=AIrPVl3@F^{)a0 z0MPqCE&W9Hl+!>iJPiTVf{2spr@x-nhNbSSd%LXBhh z)2K|MRPDd9fLvY`1Qh0aNSscq4z>11*O%)Go}`HdhEni1fU5=f2>Z#W9Hor5B?e_= zg?YONsmX9Ua7`VpZ5i%Q6g2LPG{PlwyVtA!A^E`K6M&cM-Hy`kgFZGmu3*&8(Fhnb zeF5`X$m%9?vO$I@>+yg_a9YIk!-xUXpa~cxvGBcVNcwHBov}jHM6Eg%uuy4Ea6n{w zUWD0y>hJ05FM^;f?tV)VlN12G+)?bR(vkpG_)4%F4>Q3Y%&OA_yBim-7om{jP303wRjz}(QV{q&3>7NWt+7d!iUqP$c=S2tzu z(zu_x#%Z7EhqBL=+I-&IvI?qC)l^vO#(`#G!k2F<0h}ayzX4;#eOO#>jtokks5j4E ztL>_6SNg(jhK~PodRo3YMngwC=myuRtq8YXeIfPmbxgi}TmeYlnl86*SBp5^%YaBr zPd0k%sf;ik!!mQBHpsdJI^|9e&sxJexklSXJ~{8vLcE(;sVo4SO^pKB=J|htBJx+~ zxKm}8#>VEG&h5JZFaVg0c9;2hL76$qr(j>N+T(0%a#;JhLzaXFIR!bTu$PC-hbMuo zKTfD#4UCO(b8@1W_6-URblu(DxJ=J?H6%ntns>=~_SjT%+{jayNmzeuj#NXq?zU_3 z6j1Ryl}SfsCG$IX_I3-pp})=%ITX{r%T4?KKbTN-aIDMPoUnAKw1s+^)$mwrD=jzo z%EVv>h-<({;#mkzY6Do{XB-Ke?jvSY&$Msiv#CGoh;&uO49VU&Hoe&zN98>x!)Z+y z^x9zYqExNprq}f}ul4RHeEfMl%IVd}P%<8$^Hl)xP5<}voUT!9XfTTSmePKXIR6gW7`k|Q&Xt9DyvudlPY z7Lcf0S$Vu$1jyf+h+=sP9vz*TxQK{ar`=4G@1DWjh**T?VACfH*`8pK$5I+X&gHiE zJq>LIl0G|YlmV3WBQ8m*bIm3@12LSdnzuGSm@S{u)77^zTTh4h33##2JJTX*Z?rxg zuCV0jfMDK??Y$O%9Os)it6G)tI4!3}+S<6OsTT%+eK7%cy(O};Z2M4lE20K72!AWjDZke+>``L36VBBu-!b0!EF*)q|3Tu>+ zg+&WYyVx%DAB?9GB@g|Mv{X@D_USsbu-`}zlSmUFV{)UEC8 zG`MbZzYu%TEHNxCSzEE4$qGnd04V{a1R*Y0VQLNZ_SrWqgYREc9Ch{OUSan(FEo#Kx~q4M_-{-DWr+u1=@?5tr%--7v~nAorR zUs5)$+*U(n&btlK0ZGH9>bn}HjUe3d9!L0kS{Mmx6JKbv&k>}zD%y+QYTt~C-v zj0B89#$qwH_K_<8+LP0fw1|htI>pHN5i61q%o)F)$?7s{h{n-Bw5ae#>`Wd10=^UNy$| z1jS4`P}bI5+lAl7;8siIKGLpqD&Hbn+;a#XQEgk$6DhHfk2LGnD;e2{F@~&YP%sxG zpLkaeo9KIJ|Cmc$*!5^mR*xlOoFZbUBnMNgrwI&p(Tlw;9Yvw9u@MaL3pV2^bOK?k zPPNCk8By`|H4|gQPvnAj@j447M0ts>JQ??1G4gF7;lp-zcA$ED{N&MFg9F0sk}C!f z;bi?%sZ2WJmGcRkJ4?8d()w6AL1@O%ay-C5#U&(;c1Fe26;AqvPxxx9M(iBrWMtCU zc$k?jhQ=4cr!nZl6r&_H3Uz8_Xb0M&Vq(e-I~RVsi_G>W_9h(G|51)(z{}n2cXvQ> z4|Mk%({RYeLy8yFEx*;mr&^XDBN#)o9#RQK%4k)f$FaOId{&O1daqM_`=jW>0s{iD zkK^mKGUyqfzgXNxhE$3kGVR*nV#VAA^BCio)YLzcb9CziV#>?wJ&8!!Kdusz5LJ&N zx?vCKFAQlNh+zc5{`tdv8q9W>8+fZ`in}#%3pfjv^$Vl*n%}U%&T-*osNnBJMZeQknDTN<`0Jr_4?X9^r6SI%$2pEeB!C=hwid_DLwgYya z4VSny;z@TatR~Y+e;mJ`adEHk89a$V!4d?ofT7kuduh;8b|^7M+-wzRrw$4s-p0QD z@FA4JCOSij|C+hP!XOC2@YI<+$l7$|yfccO&7Rtwjo0ToAE#$EX7n` zVNQXIi<|hqa%V(4>=k0o%6b9reLs2FZm*rFi$pc%W2~r6VdSMjwU_H**vAf*;2A~gzc44I^ zq^FBIwG0e=m(MWm@O5W8XvJw3`PR}R>Z2_I>=6Nd+JX0nJXh6OwBU;ue#zHXeLXJ% z@wiMTY<91`P3{FJ!_(7CPUC1#{CvS~r0*83-mo<+G*)`9TDpchGjfd8^i{;Yef8$V z7{l*H;mJ3NoW!Z8ogyMHzG_k^%Y*l+GziHlHJC{U&RPVPoRZf&&$?=#ijemm2@%6%8ZuYa$v) z`vo{+M73Y9{=lO1GS4rLlv9kmsXb<)dXW3(*8O`9cRH}E5_#< zh0(C4F?vQeVLdHnh{-1yWx-!R4?Yl*%-J7Zp4s!IE>d=g0BcJC(Vdm9ZEOq~neNQ< zI5{12b60GY0Z7;9=EYig-(zm;8K+&Vx!xq6EDwHFJ=BNJNb9ar#s7o3w~UJG+rC7T zkU)R{Avgp`a3=((kR${M5ZpbuyL$w8cPF@O0fh!jaJK>qcZVvxc!&J%?f)44ZjU#{ z>mJ=*pYow{>ah1YYp*reTywhD{8qVN?=rwE3g`uIF(Ll}2Git|?_2OX?^i{RkL{hL zXzD46`NjSdHYrCT5)tMlOCL=xaAhaAW-;9=bUt4C-@|$2NiRtgwfAF#M;^?{`gh(M1=cG@OeIpggaD&C2jn{i zqmPf3u9l8XYfNNKH=PdV;lD0xoT8e2MGBpQ_d(h%9<=Ru*zm7QhIeZg(a*Ds1LDau zpFpKihVo83J0Cm7n_8}oRMrF+6#+>75}eUr4Qvo-`Jj;DzVoG>mzS3z?Cfy7LMtmP z`+0U46~KCZ)(SapG=L)&emabqrlXxyz1fRA*?ob)RQ@;I*muAMxYXtBUeR`U16^%6 zeEa4$O=I4+lcD~86Lr6vVLe&EX_C0}g;quwe94yZmQUUs&RA~xE(;7c{ewZ?zDkN7 z+L;MtI_-B$wcnc=y*wqV*7MAjMwd>kc#6?CE3YDLt8sd)5SKssA#(Z9gl?MQ(vClzqXNXNyC_>i1`zf zWLtiP0nb>dQ}GTkrnK|geOgE z1%zJZ7keKYHeYkWNjw_m$*&LYAg(AyEvaCuT!E1lpiCvYyt%w|H2vpM@bmX4Bp{lu zxXbLN^;zoVexQsW1~6TErv4K~$Si75rmK>&9w~wh35nq0ZVJEe zq8!l6Ji$4_!M&(v!=htRZ%En?VL~8?*wbKbzLe>SL5Lq;%=ePe@33r3fllf!*_JJ| zHCA@c%6k7`0RlR_RXfB+I=+)paXw43uMLWdk_aUn%H(k5ag|#D7zU_V6b^g8^|POD z&el976`cKV*r`gXp~SYxZeOf)mBsJ6r;Sbi)aLOVFL;#2DPk;`J^u(!#)g>cE$RJz zG_Z&%_#G~mvZ(<&$ImK04S~#PQ-2I+|2@yE=FCkt?S_Wj$cp$pIDA))#NVS-P{YsS zV0#_n?vdQv%pC= zSC`15k&u-1iQB0}E7E%xa%jS?)0E?qE>I`!`;Bq?rqPky+v}p{;&MUQdqa6sR)>M2 z)$JHye~?n6Sd6Ce*8mORKSJUes8+64&|j?(yN+g{sp01CL6VxH3-QQn^}HR@X~J0K ze&tu-@!hZZ>SR3>fSPTVf9WyMxHvN3(y@w7D>GNYI27D0*Q(Lxk1Z#w3HFJ;pNgz4 zlRjVy2`Mi^L3vPJ^>;S+d(qR5k}z+gR%52`0OSdns5S7~8u_MR>J;XW7Xb_oOmC*~ zFZp%hGO8vf^0Q*cAv%SRG?)`{_H5&M<1rS~X{&B4ZfK6Fl-A$ zS)cW~jh>-V{ za)w1EGZj0p+M=|kgEeaH`!WB8Z@1Uz!cw=Ll;v%Y|H8Ae+lryefIWaWqIB&dwJj5-sj10nGMKL!Nc8Rb>eX@YVZmo)y>b5(fNHU@umH5F8mn1Fcg*eClEl{5 zj%_7+*MpfMFVY4*sm(9WD1SSXuh4*S1)#%m0KXK#sDu0d5+)z~&vPf+6K#%`UbC@H zCQH5Xx%ueG>9`Tv3;(gzg*KHf+6$0Ti0^-C{eGb4zW`exd54btj#5wr!k&y!i;?6X zxM+p0w;!EwC4dq+ZX&HrY&!1$9|Pk(%QM8TaO0vg(s8|SWfv;^_HE3i+XujI`DD$$ z%}4JqcT`F${o&W)-iu?r+Z&tdA|-l8{>xvNj$8#kx2QlWTvJmAhpf783~cX}vaqcK z{HVFQL-{(3I_5<7Od-z{=AXJku6-+8OGg*St4alO4yPq5j$0yMvdYS=&CIs`toG{m zHY3i?EXF2crRC-2kFI;LfH|XLia`2)f6Pq*=L5z60h#MH3E*pK@f(J+Uh#RC#~R2l zvvPAm?tK$cQGtoUut?1tuXOMQ3Z$7makWhDz!beu4AdXsDLyn%e4di|{7?>i&Pznc#T|uQWxG6b!z` z>J#7I)+eK@CwG)?I?S-F37OZwuZi4w|^+i*`LTNbnCO_y!KmRcd9J=+xrw@m$Ro&1Pyy5v|7CwuMb*V zd~Yu|DN>G3PIMc#rUz4b65`_S!N_4s2-s@2E1v`aa{dQkiR;0|C?zoH{HgOR5G|vd zfGI!wi<%q9FEBmdTS+|cYj1Anoimd0f-(6wEouCYE_V-qeE>6!)q=;N`K9{6Sw- zi5gpPZ#TE~PNU7fg~l8MVK=y6tyB~2vJZg1ev3?UnQ^UfSe>BB0AETc0R;iM3LpV| zc0bVs3{P(ZJ}?&pA3yrl;7yiHS60{8gDXCuc<-gHkOI zRMab=^WurvTN&E}@D>14*>jQ~Y3Xib5%StvDvIq@E7KmzP=&rF>#K^g)e6dA&XQ~r*o zPY$!nqlAmrcP#Yv856d;)dJ|p+I zJON%u)zQy@QWo%cG*aR_T^zmFAna3#r1lgF#VAS504hy=MN`w;zH4W`+my zhF=UM5lIo@0S`$xw9${wNC7H3HMK%uMxoKtK<0$y^an&^7SIsYTB8x-(E9K4;eA>hp`9B4_%m1mm%$^|v8%1Q&-b6&>4Zr9F zR5L#ujEn|)uBbr}`|vYBg_UrF5Iq?EpIf>&juBQfH!muXOV|DvFTlypP8;HK`&+^A zq6T=@b~ZDK_#h2$j3ecd|8(`abZSfnMegRH0}v7!`T`mPeEbA_A~4Xnm@YUycQjdV zp*&Nv%04lPZh1UP%A_6F3=l{Fgk%=;F$TV8n^hMaKuj2fDTO>(sOd9k71gX@t#xNw zkXy7`v)K?N(DdLG5y>1hGdDIiw)SQ}Vv_;RwQtD35uEnB0P#856gQh+Q;K)C0GLrFz)w)K)(#n#Tr&$v0l92l z0PVXo@HW>%gCyP+`&A|L{j)Hf`2U@leWZlbNCK^@e>%;>SO-@mNt}-^$V~h4_XD?a^Bwm12}H~uNkWFddZF#lA@|+cz;{1#7-xo z1@E4{GgdSOY`}=yI1KxzQBToc^#Kj|WZ-4ZJt*W9qiUJ+TGenNdkyv7cpR%B*)cI&dgY>6uLvaIz%SV4!dBkB|Qbxd&d4 zfczwW`um4}V*y9@`0hvDV86vYE)*_21btvt6wG)uKx-Zh~QS`9PIjPrX8x_3wC-Fc!ec5RUMBbbMSEz~pEwI9^1j zM`~bX)L=53vn26aRNQAFN9Wv-ewZZ*lp5fejFYE!J`^p7;%`!1R3w`w=-7MEavzI< zH}flC^CZlwb@jF^Jy~EXtdsq-%eO8gL_N>@jz~JWYc^)c8FGztv*PR!T4OKHla>t8)%ciVI31-{>-k^ zs4Fl3d%a8tVv;_`EtlE&oPb=Eakr__1+eC&6R5Q$$c#EW8a3qc>_k0?12h;@2W2?{ zFy0$fTL-Q=#(CD{O)p>jI%2Z;>Z)EkNUquA*2O^zgIBNi?FW()2p_+4i361V>;AX7 zI*VGXWif)*eIhrJi|8+%SVhYaa=*uqdU$R@g$y+&HRQ4krkkiO;39gyT#|QV>&94Zg9Wlnr}3v?CwMl zmUQ8nip&h~;e=oF+8?KTL)ov_3%)mh_xnj>N+0+Yavm6w@-sJA#+_0GtERp>D{E-x zw^;`}Gve0K>9$y}$!VuO!FOYRT@p4#n412mITy`kx>)0Oy@Y|j*McjyC+&%)^J>0c zY!3y#1K^HaY*{#bX+QdBd~;hTqc7|Z7KRCMN=mdgBdvEMGX>7azvsoZY7u3sNN@JG z1}mwlfotDnzFiF*H)XF1ZE#x`$2`o>2{nTjU+xfu0#qdfgGD|8Wh|^vVnKsPV*Lip z^8=9W0F^dH#MTyZNXhuvIK6BJ`OO=@#hmQDDg-2W1AE{qBM(nWt~u1!cw#2EV+;2O_+W;b6y~7Y z76G?e$dh!00k*+FzwK=NhIStW-<~)8vaiXF<})d+rDZuf>{zbdGTUB~E(b<-ir-b} zF3fp*03#_pHXEX|?7FRpg@LgOG+)mB>p$bZS?KiBJ@_!GJ{wa@Q9S(VOBc!!)Arvt z&0fsR(jA&A6$g9cExrX5D5P%n5c|`i`NMp3v%*ug0C_KnWxpmVwehN!fvIJS*JOYy zxd)HsIDBmz(@+9?{RL#QoU!R?%H3*OQRIgVH@CW6@Z7~&&PAiSA&w*g^748ccQ}*R z`ao2H87^vKG8N-5g27`1`_?&Gta6O78i*4@Db-0O?3GR1sQ8Q87uj;&5dQ2{FKI<2||E@ip& zLnHk}6*(U=1nX*Qj;&Szv4u4vy9!Z=s?`-h4(GKVJ34C&7#YdF1pS)pJ6T#@&872VRxV+Mo_`c;$qxpaw2h~U7djvrS|iiVBjuiK zi+DXE)2Igrb^18{G>vZmi6|&sxX^SN&YiP%&D_6_mPe^wQ9uhyJ0fN-EW2O;dPTktd>fO@qi4J*m%B}-(`nmfQpj%!t|2+cY9|CPn2_^Lbro^kKbxZPEo)gcA!iFLFsJ^WojApCMq7gu zyr;RbChcX(Xn(}MRwl?k%R7}&P$Ne#5!Fu=6`pG*uZU1(Z5~RWm%{@RLIvY(>B96! z0nfHTrW^Qy7AmM`yNw=~zkv7xIMJV|ZOqBE0oauWY}j^rpWo?7ZQ%NgmW)g|qo=IO zxlOu}PFEyn5mKdOPRYyzxh4Vx^WZYOwNSN!A?=IpYm(eRoN92*Ev#!4<|VWd*@o25 zTpP$v1djUbDp;aI#q3gAo5B6_D^GHdYeXx=L04S!rCB#tIQbp8&uvyzA%rre+E<5a zioQDaF1te_=J?U#n7q~tgTD=X(%b>gSF_vID;Xj}!g9^F%awRC!Q2KeV$Ykk#wU)Z z&ifPk?IZREHRET?x%6Nw?QWAshke!GvGN@sY!=YBrW!jN6hzGgxb|j$+P1}3z2$lV zG3ne$R-#`(U}m|U07s&Z*3?^L!%Ejj2db_vD~eZW^Rcx-)@>CzSDeOr3i%!SE>Wsh z{-!=6zLR55YD~ROJJX698{OkfX8Yhd-qnZgqryTE3SpNJ??3;bR)xM1|*og z58_z5{ytqykA1kFb^(>~t3Zrr_Rjyx02w&?>XhZwFf~)j9fBVEKMiQOKlmBQ{Tf~o z-p`NlNf}N9sbOb>`?EM{dj)$tyHEU-_lB4c9%K>$P+eA9wWEUv7V*8&Ct&aVSnjWA z9`JA4Z~tX8{l9w{{eRz23%3@l>;VK4=ZejIAcpgFtVtT4@6Q^T>kqZ=jZRMY^~Dr@ z2I%?Zb9E~T>aR8HkA$mjO`)oTf1SC%_5pXgWLUhad3us8sy0lyP~+VheG59g2FT3j zY4W6=AZW0mL|U60?Q4$U^cvvR^l-M|h?kU*@H`D5IDqf`PSVxWV?Qx}CDtuy-kQnJ z&&j-dQkVKSd3(1m4-`+-RW)_9SJ%Z|KjRKJ*jhbST~s_FL&DZ~y!LU~*&V<1)Exc* z{T3i=afe@7Z{PtAaFvGVi)soL=1oBU%$zvn>R`>1^iEFAbbStnawz=eey1NWVcnNr zCX4gQ=H|9-q=Eu~H;!&kFa6_1$Q>P9YgT2Hw4ssFOyxHSkPHLzVu|J2>dwJZof7eWLfzUesL!|aAC#kMfOzFyyQjJNw(|l2 zu^fDIH2cUa{CayixA(J#m-PBX@v@?_y3;CxeDvP-`@sX{rvy4mXs8d24F9Evf&1*) z+2KO#QGazE1hE$zmtSLhZQORF9HkZ&6}Psx_T26qIie8DU=;2}%I7oY#PfXeZ^{cF zU6luNUVwv4E!vsxiGUwMIbU=98S1$@9v`vI_mR`D`I%#ej1dEL(n1YkT_EL>6<7L7 zF~{K@n+&U}W!&MxL7CH2%&_nJywLGb;r5M1_-OUa31E9sooZsXH$@qi-vxZmdoUGcRA{Oet&>wz5K6? z)AhcXDn_{AQwfK9F){-4*Hbx}o7#;YHQ&@gnKrk9;Yhufrn>91Jtlx8K3%m~2H`S4 zAUj)H-dg_QlhXFnyFfVI^BJ)48|@Vyl1zXnWVeX#`I7#pToZBuIPtsf-6>}R7DRV{ zq4*+s5fIdDy?7llK;uJG9+$;fWddhbQ~AK$Em2RzOQxjtRCAbI1`EqFLx+#--?R3B&71B2_pjmw+@iz&`dU2oZ@Bv1I+ifYuAwM5y$Owjohu=Ipa5kF` zL7tsC>9u$))Jlq01rMjSeY`VQMvSfR@;5e0$fac`vg?ZZ3%XmFno<`rTmgFc+Go2= zh#`Hcw$nDzzJeiLBS2w5Sgvyjz_hqp%y$nA3x<^ZZWc-zd3aO-i=Qwf3aojZH1bV$ z&HITFcJrsMz*}KCWtX4)&pRj9`FCMWhxLq%OcWlw?FVGeJPrszJ-aJeTmW`_mjBY- zUGfj30p8~NdKKPmqx+@%le?keK_wN1c;&eI1VWj%;Ly!6dODg=b{_gfM$aRHTRn(D zv|M2Q@^A(b0e*^B5>RS##>@h#)7^Ac)qL88U)R_a2{AzY2R;OVU`BiIdz1pM6#=t% zhbVy&Z4sBekF?u%5=-~?_(j+}PPo!^*|h4G5$W#`WkC3PoOwwDk`x1~$qy)PIw041 z$lV)In+`PLMy$?!vJ@zevUBfTck4x3v;_|#CW|uuWB5dOWM{%YFQo2L-MRU_5idXm z3Mj6mrr4N~U;f?&6Y2foVTQ}nl=^QhK(%x>DO0b~^ZF_PzB?+7g$1YF{Cv7UgU}rj z&9_QAADbjQ-57FkC>3W1)!TX>bbUiuYrZ*&Rh|IO!&LAs$6aqSzS?*W&OUUsI+@;A z!Rn$oKffnV2&=>sESqBvBso3HK#~LK?gx7v?@T0Pig=3{0{Yenm-@R@zN^%V-kalT z5sg{?fA7@2tRmhuoy}gCIcMvw$7VtufVXqeuSsqNRmIv~KB+`E8At{@ul9u&;JnRi z>r-m5xZMa-vM@!pUqrt5xgs02zivW3N=O*lK$uMc~0)bpj)#^HR2b zVP{D8gE^2^3i+JOe{Za5a@l$FWvd|>Hmq0Y)UihbyLn@3VPmrhBq)hx+QWaBPWjP| z+4HY2nT{lWJRUVGkU%+4n&JJf7rI_+c92(=M{>*(gQ}B!g3DU0Dnn$+++Q+nTf=V7 z0}6Ta`zXMBrVbAjZqW55@ zGcZ+w3TSSKa%yoqW8H_7rG9y3^&_538GCzN6nXQ%igWm|jrDZ`Q`3J$YEV_UokclQ zYrCeOz02#kFVxY(VT42ke-Tu@X9AZUtXA@~|3?&Qq{Q^}Ds(JusYOvL=&;hsOa8g1 z7x%*$luCxV-jFH8?qu@inze4t@49?WnRz~Ng~E@f&rgo6#=b0`EBO(2tX^q!C+cQ2 z$1u#3RV(NF9uC36C}m$C^h{y`I%a;0aC6v6BrEfy3X0h(d-GlwRwH-I4jkA4tS;hK ztLFfEvGuCvc%GhI z@&|20>P`)%UQWucKn+0U09pN{MlKW5_mxi;TP3k{ac#B%nUL;DttXDzI@xHrOKIxk zy>wLM-c}y!K@K?zEV?7({k)^aCOZj~S#`$K!dIRbe6`ZOJf_%(TceFFBMu@k_y=bS z?wgVT_<~Uc>hG6ju#p3mVwU4NAg5fKt;hNb5Lxuk=V;u9}~HeP|C~zAyX#h zJ7Jwnu~v)*B5n83i_+W5FYD=FuhAmXkls+e54P~_ZO@ytyjatUGyzxRMRv=;@J!(> zJvC`eMu#4c}Q`C@)s83b|uk`FnbM~1m6YdKfg`epgU?mA~oOoGo@mp`uP)l(Ui z2Va}TpB-4+m@x4L>SB}4gg(6ZdjI&DFqAqwmQ~#y{eik3cuy8EgOv32Z12jQn*`>x ztJB-qbK`OY;n&uaf&f9r;~cV$*XUXT0^PKl=r7gf(qmhZ->Bf&AUC)}n_Mj<+)>J3 zBJHPWSY-w)Je-l6kyyM#hXsk+mrP7dH3hN_Za0ysMA$4h_Doo?(a%-=FFc9tIV;3{ zt+m7^W0kG*Su}Ou`c9=w2O_L=X0vpyJNDA&zyj`w>M!YyVk1k?gTa0j;L)gcQMjHO zB(|r?%XTQNg7C1Owt2Y?#!y;Yml_RA?@T){AfXlK<&@W+*E_93piwiI3LD`)Eo!v$ zWDboBY%N1W(VeE#UKb@wMN>t!{)SfxKatV3Cj6I|Pv)J}yFxd}TctjIj=4&Rq9iK! zIOB5~sPy^H`D7Z?d1EFTrI5_LX4w{34h*199WL98>6U@W^RZyF)1u)Z-sdGa@a(e8JMH^F#{eo;)4!r~vfv zeXt~B0h>15`_5m|nY+%zrcPP;ZXuUZaAb6})qQhu2j)UZL}WW#cQ|lavZs|1zH57D zEvf9Z_g!zAoZqM1HklWg zri@R5!{rZ;e`Y)6e;D`U8bPhU>AUKTzx5)VdAAq2KT%aCXKA zd;7-1yb}$|ET~rZ+itkhn-0#ceeddx<*+s_$fjAoRN()fd0utfS!1HnE35M}nYEdW zlge%J#qRGvnDBY+#>5Z1{sN8{S&O*Q>~ir7;L>+sPfri|(jk}abxUyI+2Lrh242Pn z%=7uLMJX9y^x!`mCUo1joEM4A>YX#ZKyyJ-SBCWO8?(oz+Xxq+ix56RSZPT90G~yC55(`f5`V=JyQhSN*j^Kofp2B-0GJ^YKX%xJIfX5`{xBPsbOuLL~H zk1xWa@n-kv*wK>bz-TkA#c6e-V_&GriO=Iiuw}m1@o*8P*PQAInLCaK9(P;FHZ>oQ?|s}iXvupp?|b1_*3&}PYhB7JmPlKyo34rPP^#T_dyy>tjNP=C zsl*2=tADgX?wQ#ZjP;p8weR)^S{g#DG>cV&KwpFKwdsjHB}^Q_xck z!PRDcd3uP_D|NlL0xu~*0w7U4`>RhDx*nEuyt#=L3)Oc=j0o1NFp(x#Jn(!sGfxQ5 z(dhV55scNK0Ea@z@uYpKqW76bwM8ro7A{moahiqSXD27Sb+K5l6#$_i&YK6VKMKB! zW=MHUmriroGSE$r$lsS|5M2f**!3`achl{`ZJ;#Kz}0oT{eiA!lbxN}u&v;r+~?0e z3iZ+Q4bscUGq$ZjsS;a1@5*f?*4;H_XWw9VnLony;K6SOMtIEVdD@2L z9~#W&U?#<|+|o_O@}r{8ow>w+V`O3?vh&KXT z#i>>rO$QEl%43`RligQ)7mmQeSadz|o9OaHkn3D@PK<9>2z$NsICXi&ose#8WpuH!e?e_?%(G{hCjvlV41;><-`dGUV6*2Y}jmKwDXc z@2YCM>#6D|Z|S&~31FHCjGSR#qLY>jfeMU{Jo{ z5*UW;?(UxN&p97&8_L|C{P{3kg@WJyH7B#>WQE9^w@ILDGEzq};X<`sROiD*->%H0 z04kL46o`YVD%%QKU=o9xZs7OOpS(-=%gdA(bJBGLUY9)7p^vh^|Du{5e_G%2^QU^x ziT{CVf`Xz{%2I!AEf-*ur@{2+#Xe<`WrFC##X7BrXA-NYcYCw%n4>+#@rSiOkWRUV zx*=jb8Jlz;gI~HsbR?uhF+NL5-`Q#{o^WOI;E=NE)|^S)K|1!5Dkp$AA7!>{22kFX z?w>?jHevg%8Io(4az+-GoQs6-x~NN?_w10_kr8=Y=-BSne*4cgWg8Rl(7x9kILBTG z!`r%yl{%yCXEI>1Fn730yV2GbMv8kGBkZ8*#@lKSib@y7)kHZL2#mOR8<3mE(?B|ETphuYA=HMR4N%0CAHb1XjHJP8FT4LaOJtTC+ z$;~rY>9Dx;PzZc5-y0YHnUsXs%-llpDUG_@MNOjeTv3f0g%G;o=GOMMg}K?&0J-X) z(SG!{z+qSmCTW3O+VL`t%QtGJr|`N-OsBd{K=yqB7EYUuwI=slRYj}2o4PyVyA+`F z#^8-Qxm7gEVLQV=u^$}Fm_V2>Xd7JSRYp2=>*<NN-WO;+W8T}Gtd z&LuiOypz+@MeR3o8pj3uGx80sj2gT~Uy>pPXzVgsMKGioT?}mBIh1WTJ9V%eux1;h z>-)}aMz%=k0v#CpFZosj@>X?>TesHh&GoE8$z#V{)`0EKuXCL1yboiXZ$DB#`Dow& zjk-V$dF6fEl;@hKnUq?72}cXbTbH3mmjlA;Hv>a^;kl@w4)1x9W!$kL^`2EYP_0=L|Bs$z(g_5mvLUE;z~4WqJnp zHaz^u#n9&q$VP{ZqfppuE2VcTyI7^&uF~*hrG+QJQA8I z$8C0&ZLF;&%^yo^wV9t+zHjkG+Psx9H8GJ%Z#k0O;v`{aEb{$XKKn#^I+6rAS?%x0 zfX&i^3;t;|zeX9OsCWsZQlg8<63O3V>WQs16=6}g*I1iP`e*&`noeAscHTpIln^@W zCEy#zr<>-;d~QrQ9B#&v!km4+6kN>?R-29haKsv3x~H-Louu7VLTq~C+rtO5>YzsY zHunzY$DCxn17P#dVkIh_{EUqLp`YDG9+Z}atLVR99t52mH7cnEK~hT^8~=1hjbOM3 z_{~@-rA>{rL?qNFWctbnx3iAm*S@^GKG$D0sdSx0X0|}S+Co2H@Uit`b1IF$8>f?b zZETWXx9ZHhXfpt@=51OawgD2WMPiT{q@I~GFD+p14X1$YiEyw$Te%^#OA1fX)wNHv zYyv>`I{Q=)AEt)xCipt{wnQGzw8;55$$!w6kMebQ2Q2tJ>*K0iHAa&g-JkS8s4TsY zw!tD!Ts#!y1h{wvRi?hxv!-UWWTfV0zE-m}IVWQ$A!+ko5DG<;dOemYD_d}A=KvIH zXgc=rSnWYgV5zka{SA5jE2z5!7m45Iww!O2z0CPD1WIUE;$?c zO2+G<6i(}*Qbt}F{Ai>Dow604sS#Sv!orl$G`w;;+_b#Y4PH3C$hZx>mx8{!rX8n? zOm#(abNhzpWxfu(785AbcAZ?&)qi~w=q6L}@BuvvE)hK$E>R^4;6r|i7@x*lG1T+8 z{oyKdCADJ{DeTsJ8M?v8SL@T!(TWn7c`>}(*T#(bpglP_C^R-a2y^CJ5HvT8SfDWb zz3olwybTcr;R_hA$KkiQ19C;w2U+ygD=S8;yZH~&$^~xh7nE4&dE4+P^??S+JE9ed zANR1r1E%-?G(-v?uQ0M!tVdReo{tq^Zf1qGbO<*xufe?2VDKvx-0Pjr~yrSbq?f_3je) zNXE2j+t;YRld;ZgS4sMn$5*Ef_bb#!SBt&U{&b<)M8i=jwwov+0*1Y3?r3a$d9(^U z830y^zA#UW^sPnACyytMv#hLxtNBBxm`i0lNkeTavqv8=&RzYsl9;CXq4wr-Lqy)a}{!dhQkrO;-5i?O}-&w4C)Fl0!D zhhstNO9}8mJY`d65uSx|Z4UvN@L~p5!f~qGh*W{;$-&(6`nkEAdI(xEQ~z2w%8y^- zvMCxGx~dAgRL-#hO>=N&UtB!kB2}t%K1)FZXZX0zG?P{5jN=`aSweClV=G?vu}zUD z^<3O!VHKK$o<*x*6we7&wW&#Ec*H@0eA%{R!FaRxEwF)8WfvN)&_dgwJv=o{?N{ks z%_}d)0~ajM5?N~lFBSIQ+<9l z)n&VlsG;ahR} z8;i3SGkj4tIW={Xo!vr3UOShTyL}blVTiTg-;0oY8O2wfooxfW8zA1Y^0KljW9BZV z6;v!t%*Zi*0YajU{l%uCFJ@d?&Mx9oGBWW=jH)!q@UURcU47|rk^0GfO_ehHkuKV2 zSm=@XzFX|S2L-&oxY7swnyVNc9L$BaXXo5Hd}~D)?UN2^zI|k+#p>>>;8QOMn_J|qp5a*+Vz97twvRmw z#m&Yl@lnaJ%`bd&{;97cso|UIN}jlp;g62z&tEp#ud}Pf6ZGx#LZ7T`n;6I5waulI zsRn%fn0lE1OM4unJC>^1^$e+#8opq5%^Y@;QN14jUhpAx&NV3!?(1GR#YH$fwKI1N ze6_c}-k3NOe@f4xj3NXh)M=liLOXS!a~zZp`zi$DsrS{Wx!ixZbM$27jQF=e$`ttS zi)U<2x0)>nKBKCdViJ8K?jMa(1|j#%Btq)V9xrA~Toj0E+On+*x~Mq8`X(t(K}Tor zx>0^2{yNm*W=0Wpiw%e=AeDr~m%>q84mW4q{l0NwhaElAFUl#nYgE1GL@{-LYKzBs&shD}sZnWGFt2CtN{nL`CQh`CM1 z_HOoaRaDjqcdT5y<6>j`{YWs!V$Mm14Opk>#H#|r)5pflogBi8^II}b4FAALF|^4ll7i`yhqBOiDDs!jtR z(Jg`(v!+7|TrF{~FR;mkG!FDJ!z&o#!E?IxD8a7Pn_&FWIr-Kn*F5luO^ z?errsa-qdr)LE?2*A8ghDDhV4&gL+*)5@F^VQXpDPfkNv9@d!s5M^n^;sbAWk| zh&md5T}}_|t6v4*Z@-d`>Nb2Q*dY;~IqESloxoX8;hPm2T5@co|Gr$@@NyDT+^oFj zxXLWv=Jy)JQ(>c*Jv7Srmd*z%Ub32CdZDGFBBt>fhIHt1c5op$J>Oq6SUt|Q>w2^h zF}(6ZW?l zv>2YC*s!wQh!*!y5oHhv67(?dCpp>Y;WWSe{CpHom!K2>MvaxQ8?&qBkdu|Bxt$47 zN#wWQx1YxlSQ6vd0wFaN^qV_<4!m;g>jF?&1x;WAx*KFH-q(?99{8EkN-x!{@xswo ztDhOm!&~!Y@z>2u|C4>s+|IJ+CC}-1C81Ni6O$p(p+U<>KRkmSSrk$kzG%ajZy{0` zr{O})zUNa@6l??i{3#pL2n}j2QffS$;Dsu~)#8*L437NQ34MR0A`enu&Hh1f&ov-q z5AFN$&+FVZqOTEkpg-DI}@`Yui zEJRnIWsec0N3wQlaAa}jmn;e8nMk2Iiama7uzyhnwvK@(O8DRA9EHr)^?GgUD#no+ z_Kx@ValArh!a{ASDJiLgi^FA}8>aT8x<%F^cG6?xai0@Y*_JZAiev>>*mX4&NsM6w zF=Mth&vZg7p11~%`P9Y9!uwmu9$sQ>JRQzksNyL)g<-p7Hv`+qU{_|LtCgmZ@en`% zEXh74!C_pF9BN1`3L08jYGA=dP06;zMwe&Ch1$SuvyJ=Rx6Xx@=5El^w*{@w?Dkw` z1%F=2#y<0vA^SLxP~a(Xz6<(N7@Mo)tkMVxO#HOe=NuBoHgrSxSu1ODJ8ZL8eBaU% zc5<@vVbxU%%+Ah;2sAsu%C?kxIjSUb zoWS$_KEW7+y~ic{(^?BpFjB4Nz~nE4U}w`cor`M3n4Wz@YN+nW5sp|f;@|zkIob`< zy5cMpB8YmK<@M1yA6%g#VDsX8n_FYq88O1E4z~?&iJw=9Yoe8`GDCPOIIdaB>wrUn z{@P5_$jYnl+k!$Bx(VzBJ=t3e15xkv--R(kS{~vpD#6adrBIN7?3v>=DNL3k-{f@_Yt080k2jZr@QaE?$?WSL z5#FVU9!w2HHeFp!nuCbzU7{y(yZDBffj9?*n_8;{gGAKNoUJn*YgDza6CfUL+~Af~ zO)W@E7gHB{_|2d|K9?q%s~kI8*_7MP(*CaAR6QFM@@tNCVLtLYU&dALuxU=yT{BIt zRQ)7=0yoss%EpE#+)GosZ6~`KAzP~a{u)5V{P!bCJg4)tbxVJD50)V-2AxjNN-N6l zx8@JcPMvM410_IDIVXGb@tNvx*HBD{P|VXu-+zUiII;|ZFJ5;!9$ z-EIGk1tirDT3p|a`4G)i|EYiZ2@A_vc8IOVWCn?0Xe~Dj?|b#J8*zSgrt1iB+vvBA zyXKA!)u5%$K~*?q`%;$ohq&+eio*Ifat1-~QgW0b*&!@vcs(x=#Kz`IT%ps=gP<6X zR}4QBkH=1!Je$W;FGKeh8ik9uFt0iMzQr451@#&35B?Z*~nLYn_p0su(!RA7u^6>`32tPs z*Q_FG4I83;HW_HkYAv4{?{}S61qImoul%~9`=P%xfBGyue8s5z4Lh`4ATpm8 zEl>Jxh5>RuqC0>p`56HC8UUo0!9zroq^q$qmf+}N8j*npkAJt!rbC38|EmHqSeuEiRisM6GEoHvM9x<37e2@G3d+p@#8M2jgBZ_y2_ z_YXK9>gQ*gJ;fMb&Zt|De+}e)rl!-$rmP7>xU@KwGpy;giMW=%k!9APBpNy9HbKpK z_PPe&6mBwRhvlaeP(4($0) z`_s^v2QzdubX7F$qB|sMX*xnJ-cmrPAdskw@*@3ZIulc0S8|jQz5R;=O5(BkF=btc zd1Hn2l5tIIhkj=PYY4kdm1Zkm7gMvBmvks*SfXdJt5cb(<;_~^MJG_V$jX|e7-_9` zudFz2o*#X0W8d44Pf@Bgsa zp#Qpm-s%7~>hmsi9&vYb53TX4X`@h2^`(k~!nVcYaA+v++Wk6md61VS=IQm#znm^J z>Z*>=Tf@`^eFTofrO zMk<50Ci{IVxj&e3-M$ET?C;0yCHsPJp}Pm?1vTe--hz8Q20Lxoz#jc9){C5GhiZSO7y2X;P!o1O(~5C`gkMdQXBP9YjHj^d_h@={=}4 z>757xLPu)o5Yo=fT6>>;>VEgT-}B?UzWe~L@Ra#HbB-~`xW_%ln3o0iv%VS&n%A!l zYA9vxXpyFpVK~wH`n5*-6bd6=_^uA)+EZQ*#lVtta@^rgp3XK(IyzQIGo(x4VZ6ap zPTu6LFfdf8DEeSxjG&MiKA9NVxfoR6qQWf8AJ6W}pM7L(=gKT0zEWLe@zicuZL$Y- z?Msd|8ylOKlM!b4+0Rn@N~LQ6gY=+DJC!Nj^1ovPqt88EgF=FXm6zE$z<%uoGqb%d zn#`YdMZ|Y>QLL-wU1co2Rw;l4Q%sV(RL|30capfMWf>s;^vAES)0;|g_~_f=dARg~ z9{@gB$039F3wk7zi(wxPc(JH&HbrHq{n0yOdhw0fmJYWdv2<(VqT(%dtjh~?2JbQ| z-MhwtZSEjYp}RyW8F;ufFX}ivKYz0RmTIJvMNXx&=z79h)Vt*5Tf#b`Dnzy`3_RmG ze@9!|Rm)>4zrbVc*+pH?$;*Gg*6QPX-+6TAWPL%wEd{)*&Jyc|kihBwXb5s(m2Lc> z`5a7lwanK@`4Jmzs-ccGlFhF4L5c*RpH1ryN!1-aJmxqz!=`OuCg>SFIQ#N*gm%%W z{m!^`w3EF{%b~sHF_)zTF<_UUJ{26IsIX|m@m4e$MLL_$IdSdgnTu?Rez!Y}Ro=F@ zslTs(x`(q5-4A)C1opGb%=4@Ui2#tPsJU%VsQccq_Cj8XnR#Ap7#;4%&XMNrWR~dV zlaZhQn3(yLky~}q)`UMJG41K-v_7&@)qb6|XH!@Qm{3(PVtHQG^TS^qDDr*(DwwL; z6dNn&!os?N?i(xDXiEX6714cphra6(=RoFtxJd6M`!9b;3>AwRZ){fK+nl$yXdbc1 zWPdJe$mNAT-P~OHton9KHG&2-U^LP)*EY~`%CcfxnP)Qo*=m(vSL3@eRY%_Zc0Da; z2e{N_uXDqm_C3wvVV>t?l&`O3f)tiW4@3{zg+!-cuX<2em&+?8rzMIKU9wwo?HRJ; zcg}1*?=&eIbpOP$X`q>Riv%HW0_R+*R#lC^58>$aO(zqqrUArRTB79Kg^e5EQ_OCd z7#pXinE`-1&dc#`jcxt1whBgqU0wPYZ-{hSY5}BcQl?Qs*775mhmp#W_%n^>*FXH} zQ*t=J{63zNoJ_kmHt_SOW>U%x?%jdiX2u2J2abFSjU}E8VjTUbnLj*ulu;fDygGnc z#^iC7IYf`vX%!k=zU|coyiSE*iL1cu9c%J00F-*|q(pboo|1Ku!7A@}KD>Y2b!>0b z6B}W)ylc!K9~aL#DRJL<9c5<1w&%BSUb<1sZLamUkHcJ~Lb6688!V4>X57c{mLs4U zedTKl?z|T>y*Tq}WclVJizlf%dPX-FA4XpkPq^IiY^QF4be7ipV4LaO!q*LfJhbG& z>kYK`S4|$}{FTpc-gH9Ix%7Lwdha?6syjO)Y0}Il3*!?nhx=U~6)bzd)%;#P11i38ZA@Ln`1oxxENN-1l!b`i0FPK6>n~SdHeDU*gdh{e)FV z2mQVk>6+;c3{J3*@n|4^prJoJesu#yCWj(}_yqmayuVrN9etFVx>`Wn@A%Y#X~zoP zRw!1+YG%B-s~Q!o>eMtkBz;RitHCI!hqrK&37BC|)1srJjjr%n%F_Z4^3hu@f5X+b z@z0&H*)L1umQI}tj<`RZmBWKSeFihKHfQWZ6f7<%;JE7%)jOcleeT>U#}$S|xadgn zdFg7cQQozFT1bWKke_0kAO27UY%cldb87BY^9lBfh>G|AWk-hVmRpk|W~^>1?=K65 zXje*2ZV0Rv3fPrC^EFaY*Bgn#GY?ZsXyP}Y8TZ8fHXPSp=m%>LXD@2(Wty6~o zvQ%rdEi6*f-R?z2-g+nD@Wnpv@~E?pfuV8Ex+kZ)8ZB+)8r0_%e#w*3Xmyh#g&f6p z+i^2&tH?qWeq8{dox_&O+v1nS(ITV%d*{EPa-N0ut)As%-mCF{XMConN5 zA=q`FHx3Wqe>Q+^qUhGJ}T_@Jox9+lPW;VN9U_%~Zkdl(Tdl~z@iH{P~=zOZPL zX>`=Q4Phet%ctY~cg;N6wK%rl2iCGN7=8Kty8*dV%7 zU{Tj4{CA5;%QVxL{(f;yrdh&}-OfF8m6-F@eA};S1G}RI2ITUP3i>- zi?$S2DijIMQCxSsg?R7oO-}(-34lfx_xjU0*a`)lrySM%J0InkV?PR2R({tg4Y-^} zJRkq(26Gwg<@qnNa&AiAz3YgrQ2pNF?Sk9y-~0hwVkzbJy76T7g2Zt-rp|OwvFVq& z>BkE{XD)-EU{RO=SCoGiq^pC!{~t&Cs8{@#LY345{}C(9iaX{JYUACs;-2ofwVBw< zuGg9lC3R)hDNxHzY0xUUzSz+6%v&(|CX#uy#sgxQU=IMDNq^n6HAXqPw|(#f-=rG< zRh{aX?#s59bY_3Y0{#Vq4xIeYExxaxhf}PclgD890^?3mZ$%qc^L06QAB8Zg-rI7Q z+<1?{s2TWqW1A&fADXQY$?5O_jtoRZk~$t~!Tyu9$i-xd+JoJvV!SX>>% zFKwsgz)d(K*w9@gjtJFoaw^O%eO#0K&oj=Yotmx~{K=n&#_ohXm4mJGGkbHrzkFNn zyG+`dTKlDgy|8`P36q~+=3PADI+39{HcC;17ug|O^v-Y+J00UH6k{^RuTpL`0pnPP zFkRu;nBDk@zm_v<*!)G4St}?fNU8XK_vM^+8iH@zp;U2Kq1k&a3_tbWvNZI}chf2= z9(E0WwhBl~&$v<{T;JQ=G4tXa8RNFfAsU-MRQh59a>l<=OenXvUt8D8$1a=ly5Wc~ zVOB71CB0cetS=`jX3}2|LAzF#mVD-1u+mC|-WX2`sK`f^JiiNI-PT=d{=9Bm zEN5KLSHJOA<#?}g&)bN$Wi99GsNFP*wU?h!PNkn0bA`<~GHPqbyXf$0?YQwpTGnM! z`2(d_bu#6pxgVWI+Jv7{XEqe5t>^Aj)sjtuuYK(GS9$DPe_KC^WFjRP=iH8{7po@6 z$;Kzr?X#l0_Cn`%9mK+x*^m$)FTZK^YXL30{`I%?iF-8i;8OSKvi@iP{5+#XfIylk zZLBEI=%h-)n8D9C&*8)>2CZD%ATNB_K z1nL9>hmYKA~I@mE`ye`v~ohZgd` z4T$>1f9;X}*DHLbJp&KQDK7xZG0^#jM#qICzjJoVf9=rGN(DP~(Ib+QYT&G2a+cFs z*P)fIPk`}G|2Hbjx8T1j3I3U9*}nGs|_u!RMQv3w77EW_&2Qj(TR&6 z#3Zi#jbwy)3V&YE#mcrqof8i(Wm^N`P0du#hbLaQ2X_W?cxVXDn^2#dN29~zwW;A* zntumW_!md}Phg4v;uRk79KWZ`?SJ5hhsH#PoB8j{?hn(LX#?Eg*e^FKi=|<6El2om zBc>1A07sYiHQm~~&YW6)TiEr9j?Pf?V`BSV_q}bdGRuX8gj+zI2IXrP-UTlZw@(H0JkC0BT3@6UBlXWp~5w&7(A4^z{0| zNdDuBZ%+&>o>UPvXETpaO_`siK$RJqm2}y);5J3TpA`W z8#hWCiG^`-bKX$0+eS8?HCpL%{c084DC}pzQX@r>PaxjmE^h7g0oFeyqogF@VCF0i zfp3Dr4?7aK&1%oki-E2ajdy)_5;&}s=n}c=C{q{{3JD!&0Vi0wxb&kl8W{#46Fx-lUAMJg^g^-+KAKMgiT&T?`6Q+gFdLgHASTB=_=<80VorS(=R{rg z99ht2#$#r80K<+ZQVrCOB(x}8fq8oFNqghM*BJytoZ6#U_lJbKoKZ6?S9Ey9M1Pgk z&b)np*3{%lw3(f9DvfFCB21?w=XnjatmJd0X&dv@3VWt;`)=jD45x zx=X4yzvR%-Cv-XJtMcn-!66~nTMpuljX@#w0ppH~=wBY=7Kz0V)w?tW@pxs}tKg8Z zXZ4_so^qO1fa%%~dikcq6@RdnGs`Dr;00ahfm#5T=A>iWaQLi^)KalO7umG~M?ny4 zXPPg`zYLlp^`^XglyXC1+5K*2MLSFj1)2WHb=E7r4M^6a{ZHW!AE=O$YCw>v^Et41U*3{19XAnq4x zMLmQbmG~QwYc;51RmVydtJA@Xc;9x?@v@4BJ(_5>u1?OQgCShwUhHqhvm3>^jW84` z%f9q6ppV#q~CL-G$*HTUu{cHxbq37wd*;X1dyI!JM& zQ@;xhng?T8R+qOpz+;hg8$RPM)buvPf`ws(u*}053vL=%tkiPa@8cBxObmIIQ+Nx^ z`@4kri=6LV`pl}6m}<5MBL!t(Z
+aBYg+;~u!L?*Xeh&xYt-Myjy2zs#FboQcM z^f$O=wmE!;kKS)*o2C%{TUB0_2Kjx)Q~9%9?n)QbJv z2RnT-vrDTf$%y%x_VmdH&vr;3bn5^@sY1*pfL=CTt*NQ(8NRbw($2NLnD(xbR>f}o ze&`Lz_@%YU1KDkSJ4|u+JY^a4Smd>h(%$Re@m0krayo&_$*$kTp<|Sz-bN$E17}v9 zirn}vF?BSpxm~)N3Pl`@ysNmDqkNIAAKE+nvhzl@GgeQ}Ow4w)!V`itFZY@Yd^I}U z=zfsC-y}m-QmKCc*D?K9RZ0nmu;W9kocph|=}#vT>(*lQ95~q7)BRVT!eBzR-JtaC zP|UNCSEs@QAR)dMzU!0zTt1HwcGws4O9H5sJ~6iBl$2JVPd}=+8jG*or4Hyu$S(|k&;kx>#b4<&pazAjQ~gxt{@Bu(Fc-Y$XqCcgqA@?Db5&IE)y=s+(3j!}>OH=O-{*@S(iaiX7NqVXh9 z27w}v)fG!mrHTS$!hds?7TnoG5*d4>p2!W@^>uYKRo!qbO1mxQiW&dEU)g*kVCJD5Z{H zLdc>l<3}6Vbz=89dHMP8q(S``hvf#|_BCy{y^s%;E^L|XA+10JnHZ3Trq{;WdPerv zg5A|RI}u0LpQ!We0cv^!Z95J3R#e_k$OlS~RcU$t z z{s@yX&gsZRneu4X<7y(T4D&H`c6KU0Crz&#w8gLqkUXz$74$(}mx|EJii%T+u1X5w zP(Z=}os{&EN!?)*G-7BDVQ2eMsUIF1N+7_1r8QgAKz!-W)Jxh&;-Xo^TPj{8ng^ha zNariB;C=ijeJ0~|Zbrx9dedY{I0JL;(0$rOkO6Q^1IXDgxn%vvq$L33$CVHW)_vfJ zGmYc~=?xK4u}axr)62`QBr$`viALK|B8_wH4%ye%q7c1W(sZP4b=pYMcP?Kb>CWmJ zdMW@aC+O8%Xx}GC`5eHv4U7d>aw|IQT(By)UvRkayby{!vq9i|FSV4)l}MbLm~b5b z+Wg7hja1UK_reqzs(uMY-mne&=0cXV?eOlC^+&+r&CFQhlddu_)UV+HrpZhJwj7Mo z9t4FG><#V0!jeOE2BYZI(`2TGnj1ft9ra?I-!18)hcB@F4&(pgzO=Ej!YW)k+viz5 z;iIllvbnzp(T#PzzVqX4H$a!;)E+b(;Bh{wS#YP)E99tA6P1!GZ?Ofu#~ax zpiu3Wrd2e|Z}$`Pyrl5JTW>!HAvRJL9HQBlOc7WCQ}Vlc`-oDYxw2i0ngxjaSBd zfXHkCSIcr^OW6em5B_v8O<(fd%1WI#CCg03|3j}cRpmXA1|%={^`G$-h@sIg!P+kk z*(+bO=E++m=R*P`4!Mh`DQWohW%xx7c&91G@LCc zX-bJpfh0IRf4&iWGyF^dWv)cR3>lwV3~O32#&6W^ zrA+x9Tw74o9x`tFfZtXVWS6j+Pxegdgxo6B+ujlCA_l-=sF}}T$uoFMI8N=iNpn3k z8_pGK!f&;$78e#53pXCsF{FUd%CVms|1)^s8Oi7&71`(|1l@Z-djVyixr2=mKm0>ksKre;k9;Gw#46xd*WZ-;+a{4Ay`{@SiglmCp zqCfHD-QS}CUEnO$cRhAY55QH_-~SRXfO_CR5DAY>ap++BNW=!w&kSXJBc2lao#Egf`;UuK?x zhos)*-x$q5fh00-adK`9YMwj5=_RKmOzO1{ud`LtpC45;HR z1jEjcE=-+>>`j4*yU#Q%vqsBnxqeDwn)@)IMPEI&V+Rj1m(mMpXxwPrIojW;uM&=2 z?D4_Hl_1UbZ9`XqUi|tVgbh>05kzZ6T-cXG1pJY0Z?d@Sa)j8nhdE+KPhu)1K8`2t zL8E`L8R~HD&uf%4?sTN!;Lcrs#{u`Dc01PnB$4!JDXc!xBH;C@)CW@MzS?IuWV_8J zq%8@il7@F+Kipex+hgUlu#|>JIRg{^?Rz5muiafe@$Nl&OXl$Eva)dxBZt!pnhne2 zYWa^?(qa+wtrS#~L*Ma8kv^#Z#%bF=v7*ghLPmEFq-JrOrnq5VrbwSKqFk~u<-fVi zJf&-h#t1=6W$m$nH9uzu%Xr8;bxGG)k?0~c$Qa{o%KX&@L*j|68RM|Z);mmSusG`m zKo;B4Qkn$69Imjdm=GEOH+m9?&BrzTJ|^8zjG9T|Lc|5?fYR#I9^0#f(EP`o4h{ZO z-zC{3aK8^6?57kbOFIlQV+HYjT{xebdgM`Wqz#QRWRn<2S5sTZk6NkPOQ~u)I1<@D zkgUw8wK_m~%N=Q>7@6Wv9TI@S5gxlLf%943qe}rcFcF(rqHk{SfbtVU_9_nRX%ci0 z;QI`x?AhKacjNLu8sS2idky&RV3F(g^fBrwPDN3zdnW)oRx#Um5mc(;?vF5poPo8f z_f{*5xRXumjZSDV0@GutV_R>PvuAYbw^8#s*N~<%utr= zuRWomA*U7=m|2-C^fMoOv_zIPA+L)pt<#|%cKvuH9ed+^MTU{CZtTGRn;)r`>*%SY zd+O>%H7Nmi8>^~NA3j(wtVDAZt4+X3X^)!@ZNi7e2MOI)2N7FKiP%F;^XJQ*o=pe> zIU6s6BwE+XDAztB{5g7EQ*FQHO3LBF9KMepr~a<*z@49>-wGh60N?X&0ZPcdir^ZuHm3-wc?Uh1-E)a)> zy`8IJr+T5_U=3P^ShW{*znM@$}P7*G&e(F!E*nQ;7Eq?RP-P_YU zFod{Ze2T#zXQD%I++?{{ECB5Gdwp7(h90dK4-nhEJKPfy_1su<1gR0A0$=%>gFC<4 zFD_yAHQwKC1DX}tt4r^#_=`~_1F@TqB<&>REiQ5;5Vv}jEm)J2yA#Uv?_GF9CM+9# zZ+^+;|Eu@$l#NbC3`u$H&W>72&WccE$-NtM=S58U0$Wo8yvKEoU@2Q}x>BqSQt zR47_vx`0yUyaASTnFEfAVzV?K831`ua_Y|*UH<#^`h9&py}l$V#L>L#fgG_giD5)K zU}j=jgvngc;sQU}d1d~WU0qn^32q)`rB{*1pStesY$4Wzl?9Cg_LVc>7{p>d7s8if zhW7XKks;1^Ena+XUutb;qdgeIazUM;J=(O|HAO}_XW)W5`{ra!6UKP)kUEi^4_d~l zGUUU+gUvSi)6YQ|)gA4#6&IG2fQBcD!^wNb3j1*-zpZegm&V#R#2~Pudxj7DSA}Hm zI1RE0ug|W`ZfrRBOBkn0+AiiQ?$}Nta8{L-o;LB!Oz~mIF)z-M-l46PhIf_|p>kU# z^#I4ZRZ04>?*4d!=S)PC3E&sru~}tQSc7`cI4*!tw#)gjtER$lAjcW1w*21G12GxV{9$3qXWTq^*NjWVm{l3FMDO==Lr$BjB(Y%%DCJY9TB~ z9799J#97Dt0#+B=Wo0H314zZCz3xJ_TTk4QlkECeTUl@t84X@{_kLuzqCJ1I<%$BSFu!mKUUxCjt)Eq@S&;aTGHCzU*o^d(4)3N!`S&is-pl()!-) zC(AYAK{h5&~Tc|nfZvv|6?2Ppys@0F8!G%TmEkl^r$=6 zKQ`k3!`9~!b5lMiNT26#duzL)@3$BT6!j+mIo=@kgnv4$|34n!ap{;I&E^4{)H6*0DYx}ta)&yJ)Ra#Fq~~t@`-;Pq{A%WN+_AXc(c{!(}MyyZ&1)9|9 zJj0nASh#L|edQB;$GN!JRwz~4U1_Co~TAqfAx{BuUS?sM^Ms zpYWFOF4f9WrcKoN8lNcO?T&z?R*<&xgr*)%fEJp2Cc)3vqbxSX78FV&Hvx2B6TDUOt z&{!QL+0$q+9Zs{@!+OUj)Be2$!U9#lo;?4yIkY!bSn?{$;<<4fxJUQwY^8z4Eiws! zjnVG>2?zW84SQ`46w~@|lRbNdzU2TFt6u*pknp)knklM1`ii90cy0}%RI=8$i*o4R znz7nFUZ}ag;>l)Zm7Vv9y&hsuY0rS`nQL9;9JCWPFhlta|Cn)hF6QG~E99^x-wfv`FfS!Rk7Ru z@C7pL`|=g#KB)KfLZT_}8EA&jqN0_PmD0t>8Y+;(Rh^pA&MxLNk-uXgGP*MJOH1yf z#4%o^s$Z;Cyg#A1 zQ(^36PK!hh@2-LHdBZoV6shfzEzu{?ez*X8+=Txnk7X*i1(%f8HQy8 zmD)hvTTNG$<(krK9}EBpb}aQzzknVf?8Qxs5oz@Y-O0#r0Ih}M)*|=(NPA8viF_AD9_RmTCDk2ax?Rtr11A;H^%@1l*TDA|yt%OvQ9NxTtzoO{5*CRW7I&R` zYqLKOFxcRrNdc`NnA;STJN57cJb-ASNvYh}^)CU2cAM4)SQ&?J!PnY)j#e;SXLn=j zpKbYO_ehxge_(M*msxcz9sbF;L(8d3-(1^v#@o=X0(icNiC@#xnftOfr4sX@`|Hvy%*+s=mZ!Vr0U-Vgw4?I(t1-~i z$NFNT=_b9=ADAsP&2&Vbe08;uzoDcW!`^Y3erwL#BJGYVk%}28SmLvu%AbLfafFs1 zOX}66@=u@a$A?v>rqXc%oA%D;sNp00NL`}2uUb@MuXER%2X+q~>}{FsXD#XdS4AzkRT)H?|R7nToD4Mw@nTet#P zLyCprb*cLk-x0_m^#3Vhq)ex4@c z^Xh8?H!nT^{|$Gz6qH)hv>nCkvYJMBIq_Y@IatZ)xT(1(Qfbo1Rp+K6uOpHt9Kw7&#yZ zYhXQdaCpKf2a>|Qcw9TB+{z%ZNl+z24b%%rx8k?^nu6fdIsuwrz%3HOw(;%QN{q_u?>rG6J z>zoM1a>7~?rv9xPx$q_dv#SPr+Q!L<>mqW+B>~D#-3ka z@LY028|djFcgGAq*NvNwq2q!8j0!%~uJA@(>= ziOI>qLCZp?<-vHgg}*N@Y_q$N-PNF$*g3NL^2CX$Bb>WsT|>icp7aI-UjGpm(I*ch z9r)6lE?9yvukS{yL~2@El*96uD}Y053OQ2&t0UiXWssDy$G$jcrEJ7+Un?VlWVB-fpT=+Y>-e}})St-}n)-KM^1CHxY%j3$*lVMNg+1c4as4MRc zqjhuW%_BU1ctoNQ`(0sS`2|){m|g56|tz;0Qw!854f!lU?LP z9RPTIRstC&fNGgqD@T~c5Q!&*fB&qhRD$NYu^tCq8{fHdLEXR%*&Y)8C)q9aEm+QL znPpU_Pv8)94nV0u{ai5d|50G$pB+FYRGtMNA3ph=iaK+0W5q>9MbV?cl*nv%?_W^}6Ab@M`+tj9ef|6d z`IydtC-{U^k-S}CVq~1gif}-q>B)czV7K-2p%CO!(rjZRypS<$g8`EdOFgx#3*tq} zDR&$CCeD$1oToSib(C8D>ZDCf=U*Dh6B{OT8JLE;klSH$A$c~zcfz+o0N+ncl=X6F zl9*oBf)aE0#{A8iy1Tt;Z>DG00Bx*4$j+uuwgCD4UU}^d{aZ`agQSYK$!2+emfu;P z6$Qq`;1&!lum#?^&zfi`USp>tg+^BQn7BZTjzhx5>ix)=#K80jz<;+39o+He>ZF%= zOqaO!(#^LnZ-avM^pFa@x-~PX(l0&iJ(BRwukqXXt(NJclKj<90f6Y{0_SymvSTbe z2N(l>7XUV@GGt@w)3Ja!{-W)DZ*MQNgU;aSlC$Fp*NuX1ZkFl!&cjll{7uP_jn{oQ0P>@xt3A145%Yxs&ABN zV9JLzYZTK<-*oZh9G1|XH~&;nG&TC|mco%)Dc+@hk2s0Lic9u7DMeCv*m4m>Q; zjI>zLCm|*lUT>S`{vwq}I;$dgzS$ew-P4g!XKZBOfhlR^e;mUqf|#CeSx`fY34HNe za69*FjEXhdcYgfIK`8(Jvf=E(MFu2Wx^xy2p)yh&v#c`7G-}Z^swtzLS(I!^v$+V<&dKU{ZVI3qLH}~kCGivbeI`xOViXtlb}~o zQE_1%t9If2N(HU5o0>Q0kAxCiXN#E9PkLe(^8^xcM}D=hS^6>9cG;$yJCZs5EYs2B z1}uz=Xz0zK72O#oCZWkiP9O(Ew&iV9#m8TAplR39`VtP%e(rc2{zxtC-UPKlbBc?d z%NGTIv0pwAv>kTuGJ2>)+u1mPf5zQeR;0qd+0}&)IUJ z{5QYKInb~g@&C?#$qxhFz|{HXu*5T-9vsp}9j(o^DZyvI&@-C{jM4PT$RTGWx10?0 zq4)`iiG&mAj#5%oWH&o}C8sUQ-PKh^U9N(7VA0vBdLz>Wq{+A#pWoeb8Mb#nf2(Rk z`qqhj7E9S!9ZP+sQ$Ma)9dUH>zS(gKj3G>@oMRl>TlLQ4;Sx~&#USJ4fla82jLMH% zfjl=U^Rw_m;2X}76jh2wul{J-Te%ro@Gy!7$3XuDDuC1(q%WPG2tNmk9_+ECJRfxv zrsvpzI+!+uRkC^8zI%s$#4#zs-9l`BxDMgJRgh3J%2d4~)fgFRm6N6N6cqpa%}C9;IE5Nn0x?oy)~w!75tB1}QO$j1Ph#(N1b!#x10<2cdHGV^VHu=V zo?BwdWz`IRv~SYnHG*p*Umk~i$6_6)(c3S@nZi~xzC6bd_OOk%wembl5kq^FHu`%- zPC&-1yhb9LLum~Q+WY#Dy$$76u*u!77%a%9OshWBKKIKRLOaG!}PP9 z!bM}_FV)r0n4B*(-N(FkGHFqG^;?NB{E@>{qg6^w3{2Ofy9}FHF(UHSQq~W?YHf7? z#nq0p2T1Z30ptmRSEOKiFStS0ROwLs&1j54Y{KCTYT*80u9yz?+I%b4ppI?x+qm8?W~WzZJBM` z|3E%=ja#}a{hS1!5M%A|;B#PJOWk_{LT2Pc z-$nO9?-8YuGqrh&vNE!uHF2wg%0THsO=raUpsaz4sLIoj&MqfDO_Lziw3mO!0^HXi zP|#7ubn+dd>#MPBD4lhYd1=7JJfD0>%*W4##En(ThwEJL0-Y6GPV3qc`;*K<%g*jy z+}ZJh6n$iLXXmK2ysdxXMKTj0u?^ds!0$$pRDdoIdkk@jJCf1QRmL% z+p36DxY2s&NDq>r)Y>9w=&|wLUC3uf7Qu7oV+E&c(G`9Ao3?&UYKdB>I0fO^*R>0@EuM}GMWZ5mudB^J*zmrpm_ z6u7v%UOtU7uT#5_5K%AKYnf%0u>!N`%Zhps*;D-4{lUmP* z@+jPud@jMm5#PlNqbk#ABNU@{EZxYku7ytrW0Mg6Q(2iMIon;~9h|hVbSK7UZLHD# z+t^a*-pb@hG#!WB_qNkcLYbKj4c*`FOWP20qbe>t>|NlHb0cT($oVYoRlJ)gHcV`W z^%5@$^;aI&@lEfJX2PD^*WVfQuu<_{^;G6wNYEQqXJHk{YrVUK8YZe-JNjX9{KJss zBNnE)=}eVAL05OzWZ|2F*E9ECK7D&Vjoou`u3)ji?qc?aa}iQ;-@`jyhFd=!^HkP` zHjg>%o1sO?sM;5WXKA9`Uf(xahE6a+F3|07Ff-OX?|NFQ=q4Pj9tS)@4pH$HC}FcP z?`E^Lfdydsc-Pm1>hC1u0%X zp8LKG`H!mg`-(X*LqpomDAEQ`hQBq~Nr8HMc+Y#N2Ct}c%#qF zBeouE8FKOq6cm!ItlZ4xSC#!vz-4dJ;;w~2Cr#6~BX1cv%B^jzTxTLWc6j-E+7u++ z7R`H%3ykpfzkGU2_#3on!o(~eW)WlL{|FaRIw~BL(^8hr`PiFzfKv;FDw1XH z<}7n_cX+?gsNq1GwYC^a$0HPDSs1FS>;WZ(kxq!qA^-TSQ=?k%?+p!&Cxae`5d796P---61joOrDavda6T>8lIETn*?9mKGBdUdGN9$6k6dgl#ul&E(@Raz=i0 z@weO^Y3(S@&2C$h|H3iqKC_ku5$9oJD2d50C@8m*&-r$@J!&2Fl%$R}T<3RJO#N&! zo24aT<7ZWEX{qavFZ5^RhZZk7Fr1;KrNQkHhhp^f^dIK4aSLjQ%SFNcqPOIIfwOV9_7Jqo0H1#^*WeeYdWh0l0qCQP$G$G#Z*Yh_ zaCV3hzp@Mbg-cT0ejWWE6aNng`>!np6eDhOl(UGx<6xI&057Scd7aGk$C2v)TAR}4 z$idn9GjH$PW4p)x%3}Nf7?l2JxLYIhcQgD~3rPMo4&nxZ2;veVYlmd4@ByVd~1RE@xNFUPGH?RZo_ znd0}w2uV>KKSd_3^V88C1l3D~=@FMch2rYg&(xl@A}FX$wiKuR6nOkQ@c5{CxqnDR z#}~6-6%$jVfxdgr=4AGKC>cA?eh0bnXb2BUMDREtCnLBOf1G}K;^cLI7Kb+)Sya9U z1wmf$26#n<>syVAa+2{Qh;W)5p-^%bYmFr00ik7o)VD6K+HQ5<4Dii!h84TLMge{U z-~v{*i-2qN?MqfrYw7}IG&j%sAl%!z~s;AfaK8sOZX`@H8(=4WTuW@ZxJRp7oMp*PY* zXMZsk9BvK?#n{+XKa5R6?4;2#j_37188h0k?Mo4{THe;w3`hB zpLQG34QM@yR9etxbmu+qI=|fA4E$h4b#6B6G68b^Z1irE*&tHlr&f@Rn~ARJC6;NZ z>vuzXK$~aF9U27`<|TfVs#J%gg&F{VYj55FP^;P_c2GYD`PV3~)8T~ zH7;MMe&yz;oGLz1!+twa?}_p8#lEH^b8TG%10+enJ2E_?Q+2L8uA0FK%QV2YB$$lc z*)xC>n*06&I(~*z>rbQwd0>1xu({*YpwS(BE(wsA{51>w+r-ZjUS3!05 zzV&p@4R>30%FGh>UE-x{aYAy0kNKhPAx%mJi`~gpPc{kxfCIwwh33^;(bdq8fb?V5 z0=R}dbl8vRRpjAvb)=x-Wj2OJkV>AP?ps^fF#C;wOO^E0w(;uiQ%gV{3@o)N@{juN zTr}uQx-(EHYeD%kA6a$Jvgk^0uZH)O*Ibl+95J9l!g2g)76P+o*JEAWU|{fU7eK4C zNY^!FKZyF#xZUO-9IV)Rv0Q)TP0I@kio(@uZH=DtL7${F%w_K|RaUiks9ZpWPt_c5 zug0(H+SR&=NDa)4R*f5uC}$vi_ZXSm4_51KapY>~p(81z=e$X7e`wVj?Sk2pTfDrR z`za-9cM%maF^>nQNI2x-7zmZL21GjP*nN3KY~_(E^L92T19<1%LCwdRJcp9YG0qs2 ziAF3_B;W3o%6P)03PF45PRlWz?^5a>uy%Sto2@lK0I!SAGD^l5R~((;yK1=Y8sE8+ ztH`C|c}Dtql9*KlNb6v6GTB}&bInoi28(Ya^-3o_x*bCpqMHg^MK5W(t(f58{EHKa z9nWg4TM_YNb+s)>U^o=M)`!}RNJwCs)21~(D?BkgF(KnOf7`bgppb;tws(mJo!Cy1 z+gHseTDWmYA~aaaU-?y}Uw3jvu|PDh=v1k%_pO0Nu^dwVFRrdyVsZ` zT;?~ka1G>_AF~=7xc|64Jsa7ZCg(H=vT~%|M7!Fe#TJ&A`B+meGBh_MCL7d}~gLj!Rsjuy>q^@8D@@y}YlhjwQ>^ zq=dzVbF{Iz2#w#X0ZncdgcGWNiaT5sPZoU|b?Ch_%F!k{S~vbvz%9eWun>;p&`^<9 z!IW8JXz5+sW3B+B{a7Z$A-`aMTEz2QKA6g+Y-4ocSFa9f6*n?NC<)>dyz3udEMT`yTUrxdSyz^q5q1R?5y;xk#=;9${cx)CE}1RWguc#jV1LrlnaqR ztUs&)nMF+9Db}S=I{jS3nH>1ahleNs`}b@>fDe9k%EWY;4TelgNfdGh zd0H9bzTcBQ*%s7mSzr|f%ZG>^I+XITH z@Q7j()vwDyncWmby&I3Qv%iSrvdaRs{%w4L-+J@`=u_INPE?;shLD-)Ic;1c-#I`a z5S=Lwj*Sym9rkhU2j}SuiV7HlzFMAaO~sJ6GFcMk9LQ_#%)RwTA=2a3J>!D6&;Mpe za+?E9pJ@+zr%0eEg)m-?^t&rDoHz9wgAorl! zNHAx!N2}acBkrst*d+Xaq3T-{?Cn3*n;foP(dpqXehcb+Tfn%4ggKMmzZd9Z7k2#N zRBb99@aqX6Az7)Mjc&8N*m~o`wt|sw@L_es>`#Ne%N2^uMWf#mq=ZnvCfLY`+9V(1 z`^5RLd0#;K#LPG4^nkS)WJJXu&Ign3m@YuE3yv3JIRBjBX3xXZjyCseBW4{#zBO4J zH)Qk7UZ|32PM|fITDkVVo!eP!t9066P(NQIKc0X23thaoa%dzQ?o4$wX>ozM^SvfW z)oc1F{zt#X%4G=yi7l9(XOZjcXtT+u!V6QY<4&LKFkQ1SLlA`L76-wDubk9e06Xu7 zOQLK04}z*IPu#CNucefA27k+XW|pQ;I87*|7lcAVPSd!M+ua)iVggoEsaIlTJo*|G zBNfju$m@YvaV(%~w+X0RysYteEC3_nJe81;ur&?E{eIj~>UgJTZ<5s3Kf#1rpjzkVgw~}DS>#4H2q2{g%#+K?wm)rl=oHs{9th6cBm&8zV2Yp}*GoDkq|=AN@^)pR*} z`v`wvY)McE4F(mhl(Kri1)XU)oM4bjb2b>90%Y6H1jV-3oLha!iKBsh3lw3-c6J}j zoN=jxs`r?#ZG`k-SXp;ba&m9!8|PtcO!5;3X0BVx83BBQ-@{>r#6}&B*RKKZ`NoG2 zX%4>k0+Hzb+HHM*V*G*Q1oy(Y)C5OoWJ<9gsZGH0^`U$B$%Cn_!=WOmv<%pk*uPp@ znqdwYt6?dX@0F~r87)ywO&I~`Hd(~%StYb{B+CX9g^4*4P;9><6ilZpM3KFZ=)5I_ zdv~UrGQ=AXMedZL!A@t}mt-kC8*%)@c0>fQ{$_xYNhatel56G_iHeI|a`#T5o@1gv7S!rqXICrJz-Z>IM7XR}k$fjgo z=Ym%4&86{uy24~2P&Yf**M!S1Lxg8>$?P>c8~GSJyRL_f$Qst)le~U61Ay4Zu;&;(0yq@~S=qe_Lt!%r@l7#e>3&aL9VZw7Bpv&=pEzQbhZ zJ2soQnDm`yULjy3R@KWLIo6vUp6> zOi$#Gs~WW$|E<0A3~F*)`#y+@3W9}RL_tL<0@4BqD4mT2kshk_B18yP1OztHLAo@l zQY8=|^dc=N9f1Tw6G0F#AT5+oo|QB2d*0bI@0r=pGv|DJK4m7E+*w)oTI;^ny8hSi z?<6SC>W8ctBf7-7IfHO(l6?#7n>FRJ-a$>rnH)4J?NM9lWu zv<7YN+8_AIq3jfBA1_yv+_PUrcnD`MyM6Y6JtQm(~{D_Af?va z*KEO9o**hjGe_5mk&dPBWHbiF&}qk+)a0?`G?w%(?s zfEtsP@GaV`Kr7&2KP11=7YPoZpWOX>byxo)J!yD}g#r7O+vEI6_7n9y)b0&*#Iodd z*G})^s-Sjm6|J-n9u+&h{W4RrJ&m89d+<$~_oQ2qFlhvx`5?@BE%+>;u*ozwsLMVj zot;FFs=EaZChBw$m*&I0aIAZd=P5ElAPt4jHIoEjhhFemieioEbP28bA@M>TtK0o< z?(WsQIakF_4*5AUGxFDLv9!zvwRMz=I`o7p{fDV4^KT)qUa9m17T5-Zt#ut2qvs>i zn8*I{%FMJF%oU+BS%V_%7P~&0?|d6~m1gTc`-1o##bD^ud(G^Ru2uTGFaJA5dq``el) zLF1F4d%~+XradmWkC#^J5c#ZKl}$HKf00US@i^kLw45)Qy|ASG8p} z1^bBk(v?ME;Q_5G;p=&f`|1yJnB_CtN7d5ZpRy}fN+KE>*oq0da@U3Xx^b=5)kXQj z=J5h1*H^zUF0QTVJxwe>e2XqQ3|0W-KdK-FQ`2e0{Sn%;!Dxcuy&iDJL%2v?CUH}s zy??q&SiZ2bY1DEbWW7lJ!;T(-H|Bs;G`A)->SdF#lnZ5|M}Az|Nd+4DS9Dzuvx&z3G8lOmtbWLjQ|q5xH!jp z<(iR!>8*z9;xE}ItqQRob^9~^lsjl~aGd5w=~~_BeNW9>`3qy5yvqtuPDV}zVCb2s?G*i*O&&hu z^_;7sr_g=8`g4VcvLZSZu4d{{KWf#vtvR&1T6O(Ci92B0<8zxzdaV5HH*SQK6!gmqRqXVQbxe=&-*8QYB#cOo8c&&NZ>p_O zYHt;Vi&6!5TzrEW-)plp-bBRI2noH3>XT4S%mBFWyo4&XlHsE(u&Y*+hS6PTKR1i{ z5GN=Db2Q&zz$`sHrC1qT5N;FQUxD4?WD;J3I1$352wc}#bxe)4^^6LdxCF5luFQ8B zJUzBJAlACT(@x2Kwl1)vCxT|xu{6op9@TB#lRjH}^6k?%vorOnZgZ51Dv|GCZ_{nc z%JJ(?B06&~R?>xU%KDfamfKe~3zb9tbzRcCG^?<*^Ff<`o_kIss@VY&3kI%bN(UK_VlKADoiefZ3t!8V)C@i-OY&;T}eT0Iv%4;9^YI7#rbBw?%H8 z(o=G8ZTiJiHlq5pQ`3=Dk`s5;?$<<3o1t08Hemv#tz;>}DQRK&{G@GC^7w86cxGm% zC&g7aqZe8@)4LyMmNluV^c+`yZNI_8i!|SlGIG^N+hpA$~x|G&L7Dacm)BtZKA82XM#oqs>M&H_One|+C^Wl z=TFT#ql((P2LlFUF1ig}vGd@z2~k#(u}8a63c*{?i!xc~bG#ii(M**ceWs^;roQ|3 zCZe;lXOf?<=nnto!g|XG-4?>Xrke2H7>5sssL;;TA_y)42zE?xs}6~`DsWE9UaAr7t#R;S20!LV&Vt9=Pq@fcKzd-F_yP3lx67NR&1PJe$0Uz_A7f?M`is;>w<=>JL}W*l&(d=-U!Jb5 z&M&I`bt3HFf$69c=057__;+Y|XN&Pn(v+rU{9%_8dR>6uiX$1dtq1HsXrqg8hi zIhmlT3YGp?^5Mt0URqgUET-h+^YZIw%{o7Qt}8}}$9DwE8Us8xe+qNP^c0ZoPGvtU z5bf2_IEIz`P~p8Sd^tVy6awk+Je)Go`s1-Z;_nEjezbQ7P(6tpzl(HPdzm?ayjJD6 zB`O*Zd=Gl%;_))K?}^G9)xRM5P0!7Z-Uykg_)(nmIOomPWwAyu8u9Xa&PF}s_{Bxr z5fdEu8en_)>NwBV$9wb;P`l?{RGzv1P{HrQ>>POC=i6~n6w!k^d`*X!$~z*Q42%K! z>pKRWoMP@#c>@lE1JMOEVXeE7h;I3Sla`u-KO9LDU*7({BLY^&HNX=7_1*E%jO!%( z(hudn&*F7;fKz#mWW+H0`V**3G$o+gLaEdzztVF7M1_AVWjOHtc$^~cThvh^P+8Y} zU*snD8@WzF0d8A>Ypgd?W!t%U;YY|yPlRo;O>e`GXy;&gPDiJzMh9wXsrsKgCnu@3 zbdB2eucHat|Lmyaz?^!c<<086goMx(EgR+HoM8)t*i`ND!;d`0RBvK7Ht4r^=%*Sy z>)qyvqy|K2!d<84XY)FF2xGsX$jO~;Nh?p`j6GX0k{Ugc-rO3Qmg`rih+RqS4mhXG zu1xRywPl#Jg z;-{%;m;D54^ z=qu*e*J)Ir%DTDR4dZ|AYCh==NnJZ4HaohK7el60WD!E#ecXX4chvumla_Z}%{Sc< zH;}~Ol@SExK-M(L89L?15z0NVo|Xo(B!zY!;H-9&;)xJ>g2uB{i2G}=n8P+JW4B|L z`BfCEr3s@_OJ5MZy%9J8lC~qs+R8_LF41R6d~^)bSjVtnQ(w;fd z=GhhlL6@}6dsUyGD`ytvbU>?!?mvICh}ygq&QRl#877a{%@`ev^*P7+)!;6bG}I6D z03Q0Q#LoPMp^~4e^M*Os$Qg>A;lCvCGY2}&cRi%L zkvuZ@ofNh;OsC;lL{oZ&{m06RnSlWh6it9Vp~Z(emlu~@Dh#ek+})xFJkz8kn~S$w zcde{Z?93SfW0hHQDFGb?9sV^aSu8QndWq>S1ChAFd>7{8S-6_=YwDE__JZ*wj@KVz zG$q!Ee?EL3Yq9=4(|9@@USOIu-iVOtpXnG&?vfc+^Q9j^z9dqvfO@e1SB?GTQK$0Y z$q6IE6odDOz+Th zv)_K<29caWjK$&G`(Tl07*5wY!daL3lTAsuO3nzPtF+9(e1a_FM3P{5+dZSCXzXU0 zsUW!Yr{x$>{%xz2F==rHIK*qYJZGQm_3(@$ksA3sUurJdB})1?)N+@79L5KMZNYu9 z+67(KlI{NZBMx*LSA6Ma2`%qeUC>oU044|N4}0ueWC)k${W>{3rj4lEGgOJ%bafwg z_^QEfb;v!T)ZoCak$*suwAkHTvWxw#@K_;hy ztotprW?qL$=b@RIG;f*pRW`BuvD73#V37xf-IZ9yxgijFxNU4k0#Wa1KQ7P9>Vw3N)+SY}PpILl`I*LOQ@QzUi6GF3jg9 zMTT?i`NDQ;re2E3ULW##CQoliK;;{bj34d<@?Bn0(z7fMVpFVWyjR}fVXbFo5)~6s zVm1T2eI#xOgWC^FtBr6>CFkp|e=e1Dj_o={7w_JGi7TKM`&wG0y{rQByKU`)A0l$f zAN5sF)sdb-JnZ~1i&wYR?4P*7!R7Q|JxfcA?5$h~eRu1xk@++cFG=c&TfnVANs&;yqB2$mYrRylmP>ti8YR0Jl(PquSt6<#bpGf;MS zc>2p+=t4>26~Bs57yT$wpZzYC@&TrRDGpw`(?6R(wxBB!VFLiU5Z(dBn2?~zfw@wu zBY@L*L+^n*Mp4^(vG`@Pm;m-~Huf(2?rH-$4M!q7Mgw1PUse%J@czXpq*=kV<$FE;rPVuBa)_##m&SJ8yDAx$)rvvY9cr zYS|Lji{m51KO5l2r9V1W9CvBKqTT%i%J(P=fpRJrf7^?fnw@4;Od_DZ)lK2g$-Q&9 z^OuodZUH^+4N+usnP9xi*U!#K7o3I7|NZ?>4j_S1^ypoo%VVJwJZ4dtK2yzwy)wq{ zhug=jk(In||M0?q*HwG96`1Sh*QN#swXZQar+Z%65Gn8ZmOJupY-%)_KU!Y*=Gj0J zHKeTnqiL2=A>5_@`CEhh+B^pzr!!NWoJ|>MuJz*IUSlz|2-d4>eEKizbm6_&FFDQS z>#i4F%=^IYdLCYyr{dEH)`k}_K>H|6rH~|K$gN=-KX_=$Y_Sc*Y+VY@TK^@`dcDob zF+ZJU*qIcxfGs~KCp3cya1D;F@_Y)%f$2-7{8CXv1D5I!mOGZujLRaJZjpgm2V)mM z538z3s8dbD;R@DU3Yk)xo`>*A&R&YkK_-@mCiO=+ZwBJUI zovmN?S3~l_?T^kl{G|rzfL)H z)mKFHt_2;;J}nhQ-Ye{Rt2^|Tu;#D24Z66y(O6}bJ%)v=SJ%1H31ek1w`<# zr9KS`M`1Mi33or~`Sz;Kg0%x@i;cLfp=B3Z-Rggcy@SDNj}Yf(RD4wgI6H&W=K{3qM@;Dd! zof$e@L%NYwTabj`ld<6Szghe3e$@{=VJTh|%rTtfWhEEeK)*QM^lK)+w>X5WeSeCQ zH-XGM<6tW>AqxBhzT(cQ@~^#~$u0Pg#wUNnZ~C8YkYU-rNLKoRHyV;4w?u!g-pb~T zPB%{kcu=;o0eLa~r3ErtJew322+T7^nShH2S%OKvK+$PtJ~9*N-%Pb3U-AFz-b4Q2 z-w`nV=SaMN$Ajp9|HXf1z#P+4P@J4dolaT-J$#mY20%seV&jwn($f7CxzE*=p-M;v Hi=h7k@829A literal 0 HcmV?d00001 diff --git a/documentation/audits/burndown2-2026-10-16/P1/report.json b/documentation/audits/burndown2-2026-10-16/P1/report.json new file mode 100644 index 00000000..aedfa580 --- /dev/null +++ b/documentation/audits/burndown2-2026-10-16/P1/report.json @@ -0,0 +1,17 @@ +after login url: /launcher +{ + "path": "/apps/calibre-web/data", + "keyField": { + "name": "fab_encryption_key", + "autocomplete": "new-password", + "type": "password", + "valueLength": 0 + }, + "oldIdPresent": false, + "statusRows": 0, + "targetLabels": 1, + "form": true, + "warnCallout": true, + "scrollWidth": 1270, + "console": [] +} diff --git a/documentation/audits/burndown2-2026-10-16/P2/boxes-and-versions.txt b/documentation/audits/burndown2-2026-10-16/P2/boxes-and-versions.txt new file mode 100644 index 00000000..1a880565 --- /dev/null +++ b/documentation/audits/burndown2-2026-10-16/P2/boxes-and-versions.txt @@ -0,0 +1,5 @@ +every box's newest controller report (hub DB + WAL, one tar, read 2026-10-16T16:41:33Z): + demo-hp 0.322.0-rc.1 https://felhom.enkisfelhom.hu 2026-10-16 16:40:15 + tester-1 0.321.0 https://felhom.enkicsifelhom.hu 2026-10-16 16:36:41 + demo-felhom 0.321.0 https://felhom.demo-felhom.eu 2026-10-16 16:36:35 + Tester-2 0.292.0 https://felhom.sajatfelhom.hu 2026-10-04 18:06:24 diff --git a/documentation/audits/burndown2-2026-10-16/P2/https-only.txt b/documentation/audits/burndown2-2026-10-16/P2/https-only.txt new file mode 100644 index 00000000..ad440aff --- /dev/null +++ b/documentation/audits/burndown2-2026-10-16/P2/https-only.txt @@ -0,0 +1,40 @@ +control NEGATIVE (a stub answering 200 over plain http): convicted, as it must (200 -) +== tester-1 (enkicsifelhom.hu): 13 public name(s) + OK control POSITIVE http://felhom.enkicsifelhom.hu/r1033-check?q=1 -> 301 https://felhom.enkicsifelhom.hu/r1033-check?q=1 + OK http://files.enkicsifelhom.hu/r1033-check?q=1 -> 301 https://files.enkicsifelhom.hu/r1033-check?q=1 + OK http://media.enkicsifelhom.hu/r1033-check?q=1 -> 301 https://media.enkicsifelhom.hu/r1033-check?q=1 + OK http://no-such-name-r1033.enkicsifelhom.hu/r1033-check?q=1 -> 301 https://no-such-name-r1033.enkicsifelhom.hu/r1033-check?q=1 + OK http://paperless.enkicsifelhom.hu/r1033-check?q=1 -> 301 https://paperless.enkicsifelhom.hu/r1033-check?q=1 + OK http://paste.enkicsifelhom.hu/r1033-check?q=1 -> 301 https://paste.enkicsifelhom.hu/r1033-check?q=1 + OK http://plex.enkicsifelhom.hu/r1033-check?q=1 -> 301 https://plex.enkicsifelhom.hu/r1033-check?q=1 + OK http://prowlarr.enkicsifelhom.hu/r1033-check?q=1 -> 301 https://prowlarr.enkicsifelhom.hu/r1033-check?q=1 + OK http://radarr.enkicsifelhom.hu/r1033-check?q=1 -> 301 https://radarr.enkicsifelhom.hu/r1033-check?q=1 + OK http://sonarr.enkicsifelhom.hu/r1033-check?q=1 -> 301 https://sonarr.enkicsifelhom.hu/r1033-check?q=1 + OK http://torrent.enkicsifelhom.hu/r1033-check?q=1 -> 301 https://torrent.enkicsifelhom.hu/r1033-check?q=1 + OK http://transmission.enkicsifelhom.hu/r1033-check?q=1 -> 301 https://transmission.enkicsifelhom.hu/r1033-check?q=1 + OK http://wiki.enkicsifelhom.hu/r1033-check?q=1 -> 301 https://wiki.enkicsifelhom.hu/r1033-check?q=1 +== demo-hp (enkisfelhom.hu): 14 public name(s) + OK http://arcade.enkisfelhom.hu/r1033-check?q=1 -> 301 https://arcade.enkisfelhom.hu/r1033-check?q=1 + OK http://books.enkisfelhom.hu/r1033-check?q=1 -> 301 https://books.enkisfelhom.hu/r1033-check?q=1 + OK http://docs.enkisfelhom.hu/r1033-check?q=1 -> 301 https://docs.enkisfelhom.hu/r1033-check?q=1 + OK http://felhom.enkisfelhom.hu/r1033-check?q=1 -> 301 https://felhom.enkisfelhom.hu/r1033-check?q=1 + OK http://files.enkisfelhom.hu/r1033-check?q=1 -> 301 https://files.enkisfelhom.hu/r1033-check?q=1 + OK http://gist.enkisfelhom.hu/r1033-check?q=1 -> 301 https://gist.enkisfelhom.hu/r1033-check?q=1 + OK http://ha.enkisfelhom.hu/r1033-check?q=1 -> 301 https://ha.enkisfelhom.hu/r1033-check?q=1 + OK http://no-such-name-r1033.enkisfelhom.hu/r1033-check?q=1 -> 301 https://no-such-name-r1033.enkisfelhom.hu/r1033-check?q=1 + OK http://papir.enkisfelhom.hu/r1033-check?q=1 -> 301 https://papir.enkisfelhom.hu/r1033-check?q=1 + OK http://paste.enkisfelhom.hu/r1033-check?q=1 -> 301 https://paste.enkisfelhom.hu/r1033-check?q=1 + OK http://pdf.enkisfelhom.hu/r1033-check?q=1 -> 301 https://pdf.enkisfelhom.hu/r1033-check?q=1 + OK http://plex.enkisfelhom.hu/r1033-check?q=1 -> 301 https://plex.enkisfelhom.hu/r1033-check?q=1 + OK http://travel.enkisfelhom.hu/r1033-check?q=1 -> 301 https://travel.enkisfelhom.hu/r1033-check?q=1 + OK http://wiki.enkisfelhom.hu/r1033-check?q=1 -> 301 https://wiki.enkisfelhom.hu/r1033-check?q=1 +== demo-felhom (demo-felhom.eu): 8 public name(s) + OK http://felhom.demo-felhom.eu/r1033-check?q=1 -> 301 https://felhom.demo-felhom.eu/r1033-check?q=1 + OK http://files.demo-felhom.eu/r1033-check?q=1 -> 301 https://files.demo-felhom.eu/r1033-check?q=1 + OK http://gist.demo-felhom.eu/r1033-check?q=1 -> 301 https://gist.demo-felhom.eu/r1033-check?q=1 + OK http://no-such-name-r1033.demo-felhom.eu/r1033-check?q=1 -> 301 https://no-such-name-r1033.demo-felhom.eu/r1033-check?q=1 + OK http://prowlarr.demo-felhom.eu/r1033-check?q=1 -> 301 https://prowlarr.demo-felhom.eu/r1033-check?q=1 + OK http://radarr.demo-felhom.eu/r1033-check?q=1 -> 301 https://radarr.demo-felhom.eu/r1033-check?q=1 + OK http://sonarr.demo-felhom.eu/r1033-check?q=1 -> 301 https://sonarr.demo-felhom.eu/r1033-check?q=1 + OK http://torrent.demo-felhom.eu/r1033-check?q=1 -> 301 https://torrent.demo-felhom.eu/r1033-check?q=1 +== every public name redirects http -> https diff --git a/documentation/audits/burndown2-2026-10-16/P2/tester2.txt b/documentation/audits/burndown2-2026-10-16/P2/tester2.txt new file mode 100644 index 00000000..cc3d858e --- /dev/null +++ b/documentation/audits/burndown2-2026-10-16/P2/tester2.txt @@ -0,0 +1,3 @@ +Tester 2 (sajatfelhom.hu), read only, 2026-10-16T16:42:09Z: + http://felhom.sajatfelhom.hu/login -> 530 server=cloudflare + https://felhom.sajatfelhom.hu/login -> 530 server=cloudflare diff --git a/documentation/audits/burndown2-2026-10-16/P3/live-door-check.txt b/documentation/audits/burndown2-2026-10-16/P3/live-door-check.txt new file mode 100644 index 00000000..68ffa0c9 --- /dev/null +++ b/documentation/audits/burndown2-2026-10-16/P3/live-door-check.txt @@ -0,0 +1,14 @@ +key length read: 64 +GET /api/config with the hub key -> 401 +POST /api/config with the hub key -> 401 +GET /api/config/ with the hub key -> 401 +POST /api/config/ with the hub key -> 401 +GET /api/config/apply with the hub key -> 401 +POST /api/config/apply with the hub key -> 401 +GET /api/config/hash with the hub key -> 401 +POST /api/config/hash with the hub key -> 401 +GET /api/selfupdate/check with the hub key -> 401 +POST /api/selfupdate/check with the hub key -> 401 +GET /api/geo/settings with the hub key -> 401 +POST /api/geo/settings with the hub key -> 401 +control: GET /api/health (no auth) -> 200 diff --git a/documentation/audits/burndown2-2026-10-16/P4/govulncheck-after.txt b/documentation/audits/burndown2-2026-10-16/P4/govulncheck-after.txt new file mode 100644 index 00000000..e57f85ca --- /dev/null +++ b/documentation/audits/burndown2-2026-10-16/P4/govulncheck-after.txt @@ -0,0 +1,4 @@ +ctl-0.322.0-rc.2.bin: go1.27.2 +ctl-0.322.0-rc.2: 1 vulnerabilities reported +hub-0.156.0.bin: go1.27.2 +hub-0.156.0: 1 vulnerabilities reported diff --git a/documentation/audits/burndown2-2026-10-16/P4/govulncheck-before.txt b/documentation/audits/burndown2-2026-10-16/P4/govulncheck-before.txt new file mode 100644 index 00000000..e4024e4f --- /dev/null +++ b/documentation/audits/burndown2-2026-10-16/P4/govulncheck-before.txt @@ -0,0 +1,4 @@ +ctl-0.321.0.bin: go1.24.13 +ctl-0.321.0: 62 vulnerabilities reported +hub-0.155.0.bin: go1.24.13 +hub-0.155.0: 62 vulnerabilities reported diff --git a/documentation/audits/burndown2-2026-10-16/P4/restic-0.14-after-0.18-nightchain.txt b/documentation/audits/burndown2-2026-10-16/P4/restic-0.14-after-0.18-nightchain.txt new file mode 100644 index 00000000..c13081fa --- /dev/null +++ b/documentation/audits/burndown2-2026-10-16/P4/restic-0.14-after-0.18-nightchain.txt @@ -0,0 +1,40 @@ +2026/10/16 16:50:06 offsiteapply.go:148: [INFO] [offsite-apply] settle-gate: GO — at/above floor 0.321.0 (we are 0.322.0-rc.2), no managed update running +2026/10/16 16:50:43 night_chain.go:108: [INFO] [night-chain] manual run started from 172.18.0.4:57016: [db-dump tier2 offsite update-leg] +2026/10/16 16:50:43 night_chain.go:84: [INFO] [night-chain] manual run of tonight's chain: dump → second drive → off-site → update leg +2026/10/16 16:50:43 night_chain.go:77: [INFO] [night-chain] db-dump: started +2026/10/16 16:52:40 night_chain.go:82: [INFO] [night-chain] db-dump: done in 1m57s +2026/10/16 16:52:40 night_chain.go:77: [INFO] [night-chain] tier2: started +2026/10/16 16:53:03 night_chain.go:82: [INFO] [night-chain] tier2: done in 22s +2026/10/16 16:53:03 night_chain.go:77: [INFO] [night-chain] offsite: started +2026/10/16 16:53:03 offbox.go:1021: [INFO] [offbox] backup run started (15 app(s) toggled) +2026/10/16 16:54:56 scheduler.go:450: [INFO] [scheduler] Running job: offsite-credential-retry +2026/10/16 16:54:56 scheduler.go:467: [INFO] [scheduler] Job offsite-credential-retry completed (took 0s) +2026/10/16 16:55:05 offbox.go:1068: [INFO] [offbox] pre-push dump leg completed in 2m2.212s — snapshot pair is coherent +2026/10/16 16:55:08 offbox_capture.go:45: [WARN] [offbox] prowlarr: not deployed — offsite push is unit-only (mandatory userdata not resolvable) +2026/10/16 16:55:08 offbox_capture.go:45: [WARN] [offbox] qbittorrent: not deployed — offsite push is unit-only (mandatory userdata not resolvable) +2026/10/16 16:55:08 offbox_capture.go:45: [WARN] [offbox] radarr: not deployed — offsite push is unit-only (mandatory userdata not resolvable) +2026/10/16 16:55:08 offbox_capture.go:45: [WARN] [offbox] sonarr: not deployed — offsite push is unit-only (mandatory userdata not resolvable) +2026/10/16 16:55:12 offbox.go:1504: [INFO] [offbox] backed up bookstack (/mnt/sys_drive/felhom-data/backups/primary/bookstack, 0 mandatory path(s)) +2026/10/16 16:55:15 offbox.go:1504: [INFO] [offbox] backed up docmost (/mnt/sys_drive/felhom-data/backups/primary/docmost, 0 mandatory path(s)) +2026/10/16 16:55:17 offbox.go:1504: [INFO] [offbox] backed up opengist (/mnt/sys_drive/felhom-data/backups/primary/opengist, 0 mandatory path(s)) +2026/10/16 16:55:20 offbox.go:1504: [INFO] [offbox] backed up paperless-ngx (/mnt/felhom-drives/hdd_1/backups/primary/paperless-ngx, 1 mandatory path(s)) +2026/10/16 16:55:22 offbox.go:1504: [INFO] [offbox] backed up privatebin (/mnt/sys_drive/felhom-data/backups/primary/privatebin, 0 mandatory path(s)) +2026/10/16 16:55:22 offbox_capture.go:45: [WARN] [offbox] prowlarr: not deployed — offsite push is unit-only (mandatory userdata not resolvable) +2026/10/16 16:55:24 offbox.go:1501: [WARN] [offbox] backed up prowlarr (/mnt/sys_drive/felhom-data/backups/primary/prowlarr, 0 mandatory path(s)) — but the recovery unit carried NO database dump and NO volume tar, so this snapshot holds none of the app's data; the next run with a dump leg will replace it +2026/10/16 16:55:26 offbox.go:1501: [WARN] [offbox] backed up bentopdf (/mnt/sys_drive/felhom-data/backups/primary/bentopdf, 0 mandatory path(s)) — but the recovery unit carried NO database dump and NO volume tar, so this snapshot holds none of the app's data; the next run with a dump leg will replace it +2026/10/16 16:55:28 offbox.go:1504: [INFO] [offbox] backed up kimai (/mnt/sys_drive/felhom-data/backups/primary/kimai, 0 mandatory path(s)) +2026/10/16 16:55:30 offbox.go:1504: [INFO] [offbox] backed up plex (/mnt/felhom-drives/hdd_1/backups/primary/plex, 0 mandatory path(s)) +2026/10/16 16:55:30 offbox.go:1420: [WARN] [offbox] qbittorrent: no recovery unit found on any connected drive — skipping +2026/10/16 16:55:30 offbox_capture.go:45: [WARN] [offbox] radarr: not deployed — offsite push is unit-only (mandatory userdata not resolvable) +2026/10/16 16:55:33 offbox.go:1501: [WARN] [offbox] backed up radarr (/mnt/felhom-drives/hdd_1/backups/primary/radarr, 0 mandatory path(s)) — but the recovery unit carried NO database dump and NO volume tar, so this snapshot holds none of the app's data; the next run with a dump leg will replace it +2026/10/16 16:55:36 offbox.go:1504: [INFO] [offbox] backed up romm (/mnt/felhom-drives/hdd_1/backups/primary/romm, 0 mandatory path(s)) +2026/10/16 16:55:38 offbox.go:1504: [INFO] [offbox] backed up calibre-web (/mnt/felhom-drives/hdd_1/backups/primary/calibre-web, 1 mandatory path(s)) +2026/10/16 16:55:42 offbox.go:1504: [INFO] [offbox] backed up home-assistant (/mnt/sys_drive/felhom-data/backups/primary/home-assistant, 0 mandatory path(s)) +2026/10/16 16:55:42 offbox_capture.go:45: [WARN] [offbox] sonarr: not deployed — offsite push is unit-only (mandatory userdata not resolvable) +2026/10/16 16:55:44 offbox.go:1501: [WARN] [offbox] backed up sonarr (/mnt/felhom-drives/hdd_1/backups/primary/sonarr, 0 mandatory path(s)) — but the recovery unit carried NO database dump and NO volume tar, so this snapshot holds none of the app's data; the next run with a dump leg will replace it +2026/10/16 16:55:46 offbox_window.go:231: [INFO] [offbox] retention skipped (after-run): no clean-up window now (not due (last window 2026-10-12T02:16:53Z)) — nothing deleted (decision 68) +2026/10/16 16:55:52 offbox.go:1266: [INFO] [offbox] backup OK: 14 app(s) backed up, 1 skipped (no unit), 186 snapshot(s), 2m43s +2026/10/16 16:55:52 night_chain.go:82: [INFO] [night-chain] offsite: done in 2m49s +2026/10/16 16:55:52 night_chain.go:77: [INFO] [night-chain] update-leg: started +2026/10/16 16:55:52 night_chain.go:82: [INFO] [night-chain] update-leg: done in 0s +2026/10/16 16:55:52 night_chain.go:93: [INFO] [night-chain] finished in 5m9s diff --git a/documentation/audits/burndown2-2026-10-16/P4/restic-0.18-nightchain-start.txt b/documentation/audits/burndown2-2026-10-16/P4/restic-0.18-nightchain-start.txt new file mode 100644 index 00000000..9b391783 --- /dev/null +++ b/documentation/audits/burndown2-2026-10-16/P4/restic-0.18-nightchain-start.txt @@ -0,0 +1,2 @@ +{"data":{"legs":["db-dump","tier2","offsite","update-leg"]},"message":"started","ok":true} + 202 diff --git a/documentation/audits/burndown2-2026-10-16/P4/restic-0.18-nightchain.txt b/documentation/audits/burndown2-2026-10-16/P4/restic-0.18-nightchain.txt new file mode 100644 index 00000000..79bf6431 --- /dev/null +++ b/documentation/audits/burndown2-2026-10-16/P4/restic-0.18-nightchain.txt @@ -0,0 +1,40 @@ +2026/10/16 16:40:18 offsiteapply.go:148: [INFO] [offsite-apply] settle-gate: GO — at/above floor 0.321.0 (we are 0.322.0-rc.1), no managed update running +2026/10/16 16:41:03 night_chain.go:108: [INFO] [night-chain] manual run started from 172.18.0.4:42566: [db-dump tier2 offsite update-leg] +2026/10/16 16:41:03 night_chain.go:84: [INFO] [night-chain] manual run of tonight's chain: dump → second drive → off-site → update leg +2026/10/16 16:41:03 night_chain.go:77: [INFO] [night-chain] db-dump: started +2026/10/16 16:42:59 night_chain.go:82: [INFO] [night-chain] db-dump: done in 1m56s +2026/10/16 16:42:59 night_chain.go:77: [INFO] [night-chain] tier2: started +2026/10/16 16:43:21 night_chain.go:82: [INFO] [night-chain] tier2: done in 23s +2026/10/16 16:43:21 night_chain.go:77: [INFO] [night-chain] offsite: started +2026/10/16 16:43:21 offbox.go:1021: [INFO] [offbox] backup run started (15 app(s) toggled) +2026/10/16 16:45:08 scheduler.go:450: [INFO] [scheduler] Running job: offsite-credential-retry +2026/10/16 16:45:08 scheduler.go:467: [INFO] [scheduler] Job offsite-credential-retry completed (took 0s) +2026/10/16 16:45:22 offbox.go:1068: [INFO] [offbox] pre-push dump leg completed in 2m0.527s — snapshot pair is coherent +2026/10/16 16:45:25 offbox_capture.go:45: [WARN] [offbox] sonarr: not deployed — offsite push is unit-only (mandatory userdata not resolvable) +2026/10/16 16:45:25 offbox_capture.go:45: [WARN] [offbox] qbittorrent: not deployed — offsite push is unit-only (mandatory userdata not resolvable) +2026/10/16 16:45:25 offbox_capture.go:45: [WARN] [offbox] prowlarr: not deployed — offsite push is unit-only (mandatory userdata not resolvable) +2026/10/16 16:45:25 offbox_capture.go:45: [WARN] [offbox] radarr: not deployed — offsite push is unit-only (mandatory userdata not resolvable) +2026/10/16 16:45:29 offbox.go:1504: [INFO] [offbox] backed up paperless-ngx (/mnt/felhom-drives/hdd_1/backups/primary/paperless-ngx, 1 mandatory path(s)) +2026/10/16 16:45:31 offbox.go:1504: [INFO] [offbox] backed up privatebin (/mnt/sys_drive/felhom-data/backups/primary/privatebin, 0 mandatory path(s)) +2026/10/16 16:45:31 offbox_capture.go:45: [WARN] [offbox] sonarr: not deployed — offsite push is unit-only (mandatory userdata not resolvable) +2026/10/16 16:45:33 offbox.go:1501: [WARN] [offbox] backed up sonarr (/mnt/felhom-drives/hdd_1/backups/primary/sonarr, 0 mandatory path(s)) — but the recovery unit carried NO database dump and NO volume tar, so this snapshot holds none of the app's data; the next run with a dump leg will replace it +2026/10/16 16:45:36 offbox.go:1504: [INFO] [offbox] backed up calibre-web (/mnt/felhom-drives/hdd_1/backups/primary/calibre-web, 1 mandatory path(s)) +2026/10/16 16:45:36 offbox.go:1420: [WARN] [offbox] qbittorrent: no recovery unit found on any connected drive — skipping +2026/10/16 16:45:38 offbox.go:1504: [INFO] [offbox] backed up romm (/mnt/felhom-drives/hdd_1/backups/primary/romm, 0 mandatory path(s)) +2026/10/16 16:45:38 offbox_capture.go:45: [WARN] [offbox] prowlarr: not deployed — offsite push is unit-only (mandatory userdata not resolvable) +2026/10/16 16:45:40 offbox.go:1501: [WARN] [offbox] backed up prowlarr (/mnt/sys_drive/felhom-data/backups/primary/prowlarr, 0 mandatory path(s)) — but the recovery unit carried NO database dump and NO volume tar, so this snapshot holds none of the app's data; the next run with a dump leg will replace it +2026/10/16 16:45:40 offbox_capture.go:45: [WARN] [offbox] radarr: not deployed — offsite push is unit-only (mandatory userdata not resolvable) +2026/10/16 16:45:42 offbox.go:1501: [WARN] [offbox] backed up radarr (/mnt/felhom-drives/hdd_1/backups/primary/radarr, 0 mandatory path(s)) — but the recovery unit carried NO database dump and NO volume tar, so this snapshot holds none of the app's data; the next run with a dump leg will replace it +2026/10/16 16:45:44 offbox.go:1504: [INFO] [offbox] backed up opengist (/mnt/sys_drive/felhom-data/backups/primary/opengist, 0 mandatory path(s)) +2026/10/16 16:45:47 offbox.go:1504: [INFO] [offbox] backed up plex (/mnt/felhom-drives/hdd_1/backups/primary/plex, 0 mandatory path(s)) +2026/10/16 16:45:49 offbox.go:1501: [WARN] [offbox] backed up bentopdf (/mnt/sys_drive/felhom-data/backups/primary/bentopdf, 0 mandatory path(s)) — but the recovery unit carried NO database dump and NO volume tar, so this snapshot holds none of the app's data; the next run with a dump leg will replace it +2026/10/16 16:45:52 offbox.go:1504: [INFO] [offbox] backed up bookstack (/mnt/sys_drive/felhom-data/backups/primary/bookstack, 0 mandatory path(s)) +2026/10/16 16:45:54 offbox.go:1504: [INFO] [offbox] backed up docmost (/mnt/sys_drive/felhom-data/backups/primary/docmost, 0 mandatory path(s)) +2026/10/16 16:45:57 offbox.go:1504: [INFO] [offbox] backed up home-assistant (/mnt/sys_drive/felhom-data/backups/primary/home-assistant, 0 mandatory path(s)) +2026/10/16 16:45:59 offbox.go:1504: [INFO] [offbox] backed up kimai (/mnt/sys_drive/felhom-data/backups/primary/kimai, 0 mandatory path(s)) +2026/10/16 16:46:01 offbox_window.go:231: [INFO] [offbox] retention skipped (after-run): no clean-up window now (not due (last window 2026-10-12T02:16:53Z)) — nothing deleted (decision 68) +2026/10/16 16:46:06 offbox.go:1266: [INFO] [offbox] backup OK: 14 app(s) backed up, 1 skipped (no unit), 172 snapshot(s), 2m40s +2026/10/16 16:46:06 night_chain.go:82: [INFO] [night-chain] offsite: done in 2m44s +2026/10/16 16:46:06 night_chain.go:77: [INFO] [night-chain] update-leg: started +2026/10/16 16:46:06 night_chain.go:82: [INFO] [night-chain] update-leg: done in 0s +2026/10/16 16:46:06 night_chain.go:93: [INFO] [night-chain] finished in 5m3s diff --git a/documentation/audits/burndown2-2026-10-16/P4/trivy-after-controller-rc3.txt b/documentation/audits/burndown2-2026-10-16/P4/trivy-after-controller-rc3.txt new file mode 100644 index 00000000..04c5edb7 --- /dev/null +++ b/documentation/audits/burndown2-2026-10-16/P4/trivy-after-controller-rc3.txt @@ -0,0 +1,5 @@ +== gitea.dooplex.hu/admin/felhom-controller:0.322.0-rc.3 + gitea.dooplex.hu/admin/felhom-controller:0.322.0-rc.3 (debia debian crit 4 (fixable 0) high 136 (fixable 0) + usr/libexec/docker/cli-plugins/docker-compose gobinary crit 0 (fixable 0) high 4 (fixable 4) + usr/local/bin/felhom-controller gobinary crit 0 (fixable 0) high 0 (fixable 0) + TOTAL crit 4 (fixable 0) high 140 (fixable 4) diff --git a/documentation/audits/burndown2-2026-10-16/P4/trivy-after.txt b/documentation/audits/burndown2-2026-10-16/P4/trivy-after.txt new file mode 100644 index 00000000..0dcf7c28 --- /dev/null +++ b/documentation/audits/burndown2-2026-10-16/P4/trivy-after.txt @@ -0,0 +1,9 @@ +== gitea.dooplex.hu/admin/felhom-controller:0.322.0-rc.2 + gitea.dooplex.hu/admin/felhom-controller:0.322.0-rc.2 (debia debian crit 6 (fixable 2) high 144 (fixable 8) + usr/libexec/docker/cli-plugins/docker-compose gobinary crit 0 (fixable 0) high 4 (fixable 4) + usr/local/bin/felhom-controller gobinary crit 0 (fixable 0) high 0 (fixable 0) + TOTAL crit 6 (fixable 2) high 148 (fixable 12) +== gitea.dooplex.hu/admin/felhom-hub:0.156.0 + gitea.dooplex.hu/admin/felhom-hub:0.156.0 (alpine 3.24.2) alpine crit 0 (fixable 0) high 0 (fixable 0) + usr/local/bin/felhom-hub gobinary crit 0 (fixable 0) high 0 (fixable 0) + TOTAL crit 0 (fixable 0) high 0 (fixable 0) diff --git a/documentation/audits/burndown2-2026-10-16/P4/trivy-before.txt b/documentation/audits/burndown2-2026-10-16/P4/trivy-before.txt new file mode 100644 index 00000000..bc237451 --- /dev/null +++ b/documentation/audits/burndown2-2026-10-16/P4/trivy-before.txt @@ -0,0 +1,10 @@ +== gitea.dooplex.hu/admin/felhom-controller:0.321.0 + gitea.dooplex.hu/admin/felhom-controller:0.321.0 (debian 12. debian crit 16 (fixable 12) high 159 (fixable 23) + usr/bin/docker gobinary crit 0 (fixable 0) high 3 (fixable 3) + usr/libexec/docker/cli-plugins/docker-compose gobinary crit 0 (fixable 0) high 4 (fixable 4) + usr/local/bin/felhom-controller gobinary crit 0 (fixable 0) high 34 (fixable 34) + TOTAL crit 16 (fixable 12) high 200 (fixable 64) +== gitea.dooplex.hu/admin/felhom-hub:0.155.0 + gitea.dooplex.hu/admin/felhom-hub:0.155.0 (alpine 3.21.8) alpine crit 0 (fixable 0) high 2 (fixable 2) + usr/local/bin/felhom-hub gobinary crit 0 (fixable 0) high 34 (fixable 34) + TOTAL crit 0 (fixable 0) high 36 (fixable 36) diff --git a/documentation/audits/burndown2-2026-10-16/redproof/redproof-datatab.txt b/documentation/audits/burndown2-2026-10-16/redproof/redproof-datatab.txt new file mode 100644 index 00000000..ce7f5c47 --- /dev/null +++ b/documentation/audits/burndown2-2026-10-16/redproof/redproof-datatab.txt @@ -0,0 +1,8 @@ +## no autocomplete=new-password on the export key + logins_folders_test.go:423: hu: the export password field lacks autocomplete="new-password" or still has a login-like name + logins_folders_test.go:423: en: the export password field lacks autocomplete="new-password" or still has a login-like name +--- FAIL: TestAppData_OneBackupSection (0.09s) +## a status row back above the form + logins_folders_test.go:416: hu: the 2nd copy's status rows repeat the form + logins_folders_test.go:419: hu: the target drive is labelled 2 times, want once (the form) + logins_folders_test.go:416: en: the 2nd copy's status rows repeat the form diff --git a/documentation/audits/burndown2-2026-10-16/redproof/redproof-r1103.txt b/documentation/audits/burndown2-2026-10-16/redproof/redproof-r1103.txt new file mode 100644 index 00000000..1c2fe2a1 --- /dev/null +++ b/documentation/audits/burndown2-2026-10-16/redproof/redproof-r1103.txt @@ -0,0 +1,3 @@ +## R-694 on the settings tab: the Restored branch removed + r694_restored_login_test.go:35: the restored login is offered for reveal +--- FAIL: TestR694_TheSettingsTabDoesNotOfferAGeneratedLogin (0.07s) diff --git a/documentation/audits/burndown2-2026-10-16/redproof/redproof-r970.txt b/documentation/audits/burndown2-2026-10-16/redproof/redproof-r970.txt new file mode 100644 index 00000000..80ab8ff4 --- /dev/null +++ b/documentation/audits/burndown2-2026-10-16/redproof/redproof-r970.txt @@ -0,0 +1,10 @@ +## an /api/geo/ route without the session check (a door) + r970_no_hub_key_door_test.go:74: GET /api/geo/countries with the hub key answered 200 — the key opens a door +--- FAIL: TestR970_HubKeyOpensNoDoor (0.08s) +## the /config GET case back + r970_config_routes_test.go:31: GET /api/config answered 200, want the router's 404 + r970_config_routes_test.go:31: GET /api/config/ answered 200, want the router's 404 +--- FAIL: TestR970_ConfigRoutesAreGone (0.00s) +## the Bearer CSRF exemption back + r970_csrf_test.go:40: a POST carrying the hub key passed CSRF (code 200) +--- FAIL: TestR970_HubKeyIsNoCSRFExemption (0.00s) diff --git a/documentation/audits/burndown2-2026-10-16/release/containers.txt b/documentation/audits/burndown2-2026-10-16/release/containers.txt new file mode 100644 index 00000000..c8eabe4d --- /dev/null +++ b/documentation/audits/burndown2-2026-10-16/release/containers.txt @@ -0,0 +1,12 @@ +== tester-1 +unhealthy=0 restarting=0 exited=0 created=0 +controller gitea.dooplex.hu/admin/felhom-controller:0.322.0 Up About a minute (healthy) +restic 0.14.0 +== demo-hp +unhealthy=0 restarting=0 exited=0 created=0 +controller gitea.dooplex.hu/admin/felhom-controller:0.322.0 Up About a minute (healthy) +restic 0.14.0 +== demo-felhom +unhealthy=0 restarting=0 exited=0 created=0 +controller gitea.dooplex.hu/admin/felhom-controller:0.322.0 Up About a minute (healthy) +restic 0.14.0 diff --git a/documentation/audits/burndown2-2026-10-16/release/customer-floors-cleared.txt b/documentation/audits/burndown2-2026-10-16/release/customer-floors-cleared.txt new file mode 100644 index 00000000..8600ce1c --- /dev/null +++ b/documentation/audits/burndown2-2026-10-16/release/customer-floors-cleared.txt @@ -0,0 +1,3 @@ +tester-1 Location: /customers/tester-1?flash=floor_set +demo-hp Location: /customers/demo-hp?flash=floor_set +demo-felhom Location: /customers/demo-felhom?flash=floor_set diff --git a/documentation/audits/burndown2-2026-10-16/release/customer-floors.txt b/documentation/audits/burndown2-2026-10-16/release/customer-floors.txt new file mode 100644 index 00000000..eea08604 --- /dev/null +++ b/documentation/audits/burndown2-2026-10-16/release/customer-floors.txt @@ -0,0 +1,3 @@ +demo-hp Location: /customers/demo-hp?flash=floor_set +tester-1 Location: /customers/tester-1?flash=floor_set +demo-felhom Location: /customers/demo-felhom?flash=floor_set diff --git a/documentation/audits/burndown2-2026-10-16/release/dashboards.txt b/documentation/audits/burndown2-2026-10-16/release/dashboards.txt new file mode 100644 index 00000000..7635a913 --- /dev/null +++ b/documentation/audits/burndown2-2026-10-16/release/dashboards.txt @@ -0,0 +1,3 @@ +felhom.enkisfelhom.hu 200 +felhom.enkicsifelhom.hu 200 +felhom.demo-felhom.eu 200 diff --git a/documentation/audits/burndown2-2026-10-16/release/global-floor-readback.txt b/documentation/audits/burndown2-2026-10-16/release/global-floor-readback.txt new file mode 100644 index 00000000..d6b658fc --- /dev/null +++ b/documentation/audits/burndown2-2026-10-16/release/global-floor-readback.txt @@ -0,0 +1,9 @@ +integrity ok +newest report 2026-10-16 16:54:54 now 2026-10-16 17:06:26 +min_controller_version ('0.322.0',) +min_controller_version_declared_min_agent ('0.322.0=0.158.1',) +customer floor columns [] +customer_configs ['min_controller_version', 'min_controller_declared_min_agent', 'min_controller_set_at'] + ('demo-felhom', '', '', '') + ('demo-hp', '', '', '') + ('tester-1', '', '', '') diff --git a/documentation/audits/burndown2-2026-10-16/release/global-floor.txt b/documentation/audits/burndown2-2026-10-16/release/global-floor.txt new file mode 100644 index 00000000..cca645de --- /dev/null +++ b/documentation/audits/burndown2-2026-10-16/release/global-floor.txt @@ -0,0 +1,3 @@ +19:04:50 +HTTP/1.1 303 See Other +Location: /configuration?flash=floor_set diff --git a/documentation/audits/burndown2-2026-10-16/release/https-only.txt b/documentation/audits/burndown2-2026-10-16/release/https-only.txt new file mode 100644 index 00000000..ad440aff --- /dev/null +++ b/documentation/audits/burndown2-2026-10-16/release/https-only.txt @@ -0,0 +1,40 @@ +control NEGATIVE (a stub answering 200 over plain http): convicted, as it must (200 -) +== tester-1 (enkicsifelhom.hu): 13 public name(s) + OK control POSITIVE http://felhom.enkicsifelhom.hu/r1033-check?q=1 -> 301 https://felhom.enkicsifelhom.hu/r1033-check?q=1 + OK http://files.enkicsifelhom.hu/r1033-check?q=1 -> 301 https://files.enkicsifelhom.hu/r1033-check?q=1 + OK http://media.enkicsifelhom.hu/r1033-check?q=1 -> 301 https://media.enkicsifelhom.hu/r1033-check?q=1 + OK http://no-such-name-r1033.enkicsifelhom.hu/r1033-check?q=1 -> 301 https://no-such-name-r1033.enkicsifelhom.hu/r1033-check?q=1 + OK http://paperless.enkicsifelhom.hu/r1033-check?q=1 -> 301 https://paperless.enkicsifelhom.hu/r1033-check?q=1 + OK http://paste.enkicsifelhom.hu/r1033-check?q=1 -> 301 https://paste.enkicsifelhom.hu/r1033-check?q=1 + OK http://plex.enkicsifelhom.hu/r1033-check?q=1 -> 301 https://plex.enkicsifelhom.hu/r1033-check?q=1 + OK http://prowlarr.enkicsifelhom.hu/r1033-check?q=1 -> 301 https://prowlarr.enkicsifelhom.hu/r1033-check?q=1 + OK http://radarr.enkicsifelhom.hu/r1033-check?q=1 -> 301 https://radarr.enkicsifelhom.hu/r1033-check?q=1 + OK http://sonarr.enkicsifelhom.hu/r1033-check?q=1 -> 301 https://sonarr.enkicsifelhom.hu/r1033-check?q=1 + OK http://torrent.enkicsifelhom.hu/r1033-check?q=1 -> 301 https://torrent.enkicsifelhom.hu/r1033-check?q=1 + OK http://transmission.enkicsifelhom.hu/r1033-check?q=1 -> 301 https://transmission.enkicsifelhom.hu/r1033-check?q=1 + OK http://wiki.enkicsifelhom.hu/r1033-check?q=1 -> 301 https://wiki.enkicsifelhom.hu/r1033-check?q=1 +== demo-hp (enkisfelhom.hu): 14 public name(s) + OK http://arcade.enkisfelhom.hu/r1033-check?q=1 -> 301 https://arcade.enkisfelhom.hu/r1033-check?q=1 + OK http://books.enkisfelhom.hu/r1033-check?q=1 -> 301 https://books.enkisfelhom.hu/r1033-check?q=1 + OK http://docs.enkisfelhom.hu/r1033-check?q=1 -> 301 https://docs.enkisfelhom.hu/r1033-check?q=1 + OK http://felhom.enkisfelhom.hu/r1033-check?q=1 -> 301 https://felhom.enkisfelhom.hu/r1033-check?q=1 + OK http://files.enkisfelhom.hu/r1033-check?q=1 -> 301 https://files.enkisfelhom.hu/r1033-check?q=1 + OK http://gist.enkisfelhom.hu/r1033-check?q=1 -> 301 https://gist.enkisfelhom.hu/r1033-check?q=1 + OK http://ha.enkisfelhom.hu/r1033-check?q=1 -> 301 https://ha.enkisfelhom.hu/r1033-check?q=1 + OK http://no-such-name-r1033.enkisfelhom.hu/r1033-check?q=1 -> 301 https://no-such-name-r1033.enkisfelhom.hu/r1033-check?q=1 + OK http://papir.enkisfelhom.hu/r1033-check?q=1 -> 301 https://papir.enkisfelhom.hu/r1033-check?q=1 + OK http://paste.enkisfelhom.hu/r1033-check?q=1 -> 301 https://paste.enkisfelhom.hu/r1033-check?q=1 + OK http://pdf.enkisfelhom.hu/r1033-check?q=1 -> 301 https://pdf.enkisfelhom.hu/r1033-check?q=1 + OK http://plex.enkisfelhom.hu/r1033-check?q=1 -> 301 https://plex.enkisfelhom.hu/r1033-check?q=1 + OK http://travel.enkisfelhom.hu/r1033-check?q=1 -> 301 https://travel.enkisfelhom.hu/r1033-check?q=1 + OK http://wiki.enkisfelhom.hu/r1033-check?q=1 -> 301 https://wiki.enkisfelhom.hu/r1033-check?q=1 +== demo-felhom (demo-felhom.eu): 8 public name(s) + OK http://felhom.demo-felhom.eu/r1033-check?q=1 -> 301 https://felhom.demo-felhom.eu/r1033-check?q=1 + OK http://files.demo-felhom.eu/r1033-check?q=1 -> 301 https://files.demo-felhom.eu/r1033-check?q=1 + OK http://gist.demo-felhom.eu/r1033-check?q=1 -> 301 https://gist.demo-felhom.eu/r1033-check?q=1 + OK http://no-such-name-r1033.demo-felhom.eu/r1033-check?q=1 -> 301 https://no-such-name-r1033.demo-felhom.eu/r1033-check?q=1 + OK http://prowlarr.demo-felhom.eu/r1033-check?q=1 -> 301 https://prowlarr.demo-felhom.eu/r1033-check?q=1 + OK http://radarr.demo-felhom.eu/r1033-check?q=1 -> 301 https://radarr.demo-felhom.eu/r1033-check?q=1 + OK http://sonarr.demo-felhom.eu/r1033-check?q=1 -> 301 https://sonarr.demo-felhom.eu/r1033-check?q=1 + OK http://torrent.demo-felhom.eu/r1033-check?q=1 -> 301 https://torrent.demo-felhom.eu/r1033-check?q=1 +== every public name redirects http -> https diff --git a/documentation/audits/burndown2-2026-10-16/release/hub-page-floor.txt b/documentation/audits/burndown2-2026-10-16/release/hub-page-floor.txt new file mode 100644 index 00000000..b8ddc42b --- /dev/null +++ b/documentation/audits/burndown2-2026-10-16/release/hub-page-floor.txt @@ -0,0 +1 @@ +hub page /configuration shows 0.322.0: 3 times diff --git a/documentation/audits/burndown2-2026-10-16/tools/cdp_datatab.py b/documentation/audits/burndown2-2026-10-16/tools/cdp_datatab.py new file mode 100644 index 00000000..027b08b0 --- /dev/null +++ b/documentation/audits/burndown2-2026-10-16/tools/cdp_datatab.py @@ -0,0 +1,118 @@ +#!/usr/bin/env python3 +"""v0.322.0 burndown-2 browser check: the Data tab's export key field and the 2nd-copy part. Minimal CDP client: log in to the controller through its PUBLIC address in headless Chrome, open each +app-page tab, assert computed styles, collect console errors, save screenshots. The password is read +from a 0600 file and only ever sent inside a CDP message; it is never printed.""" +import base64, json, os, socket, struct, subprocess, sys, time, urllib.request + +CHROME = os.path.expanduser('~/.cache/ms-playwright/chromium_headless_shell-1243/chrome-headless-shell-linux64/chrome-headless-shell') +BASE = sys.argv[1] # https://felhom.enkisfelhom.hu +PWFILE = sys.argv[2] # the controller password (0600 file) +FBPWFILE = sys.argv[3] # FileBrowser's admin password (0600 file) — for the cold „Fajlok" click +OUT = sys.argv[4] +PORT = 9333 +os.makedirs(OUT, exist_ok=True) +prof = os.path.join(OUT, '.profile') +proc = subprocess.Popen([CHROME, f'--remote-debugging-port={PORT}', '--no-sandbox', f'--user-data-dir={prof}', + '--window-size=1280,900', 'about:blank'], stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL) +try: + for _ in range(50): + try: + tabs = json.load(urllib.request.urlopen(f'http://127.0.0.1:{PORT}/json')) + break + except Exception: + time.sleep(0.2) + ws_url = [t for t in tabs if t['type'] == 'page'][0]['webSocketDebuggerUrl'] + host, path = ws_url[len('ws://'):].split('/', 1) + h, p = host.split(':') + sock = socket.create_connection((h, int(p))) + key = base64.b64encode(os.urandom(16)).decode() + sock.send(f'GET /{path} HTTP/1.1\r\nHost: {host}\r\nUpgrade: websocket\r\nConnection: Upgrade\r\nSec-WebSocket-Key: {key}\r\nSec-WebSocket-Version: 13\r\n\r\n'.encode()) + buf = b'' + while b'\r\n\r\n' not in buf: + buf += sock.recv(4096) + st = {'pending': buf.split(b'\r\n\r\n', 1)[1]} + + def send(obj): + data = json.dumps(obj).encode() + hdr = bytearray([0x81]) + n = len(data) + if n < 126: hdr.append(0x80 | n) + elif n < 65536: hdr.append(0x80 | 126); hdr += struct.pack('>H', n) + else: hdr.append(0x80 | 127); hdr += struct.pack('>Q', n) + mask = os.urandom(4); hdr += mask + sock.sendall(bytes(hdr) + bytes(b ^ mask[i % 4] for i, b in enumerate(data))) + + def recv_exact(n): + while len(st['pending']) < n: + st['pending'] += sock.recv(1 << 20) + out, st['pending'] = st['pending'][:n], st['pending'][n:] + return out + + def recv(): + msg = b'' + while True: + b0, b1 = recv_exact(2) + n = b1 & 0x7f + if n == 126: n = struct.unpack('>H', recv_exact(2))[0] + elif n == 127: n = struct.unpack('>Q', recv_exact(8))[0] + msg += recv_exact(n) + if b0 & 0x80: return json.loads(msg) + + console = [] + mid = [0] + def call(method, **params): + mid[0] += 1; i = mid[0] + send({'id': i, 'method': method, 'params': params}) + while True: + m = recv() + if m.get('method') == 'Runtime.exceptionThrown': + console.append(('exception', m['params']['exceptionDetails'].get('text', ''), m['params']['exceptionDetails'].get('exception', {}).get('description', '')[:200])) + elif m.get('method') == 'Runtime.consoleAPICalled' and m['params']['type'] in ('error', 'warning'): + console.append((m['params']['type'], ' '.join(str(a.get('value', a.get('description', ''))) for a in m['params']['args'])[:200])) + elif m.get('method') == 'Log.entryAdded' and m['params']['entry']['level'] in ('error', 'warning'): + e = m['params']['entry']; console.append(('log-' + e['level'], e.get('text', '')[:200], e.get('url', ''))) + if m.get('id') == i: + if 'error' in m: raise RuntimeError(f'{method}: {m["error"]}') + return m.get('result', {}) + + def ev(expr): + r = call('Runtime.evaluate', expression=expr, returnByValue=True, awaitPromise=True) + return r.get('result', {}).get('value') + + def goto(url): + call('Page.navigate', url=url) + for _ in range(100): + time.sleep(0.2) + if ev('document.readyState') == 'complete': + break + time.sleep(1.5) # images' onerror, layout + + for d in ('Page', 'Runtime', 'Log', 'Network'): + call(d + '.enable') + pw = open(PWFILE).read().strip() + goto(BASE + '/login') + ev("(function(){var f=document.querySelector('input[type=password]'); f.value=%s; f.form.submit(); return 1})()" % json.dumps(pw)) + del pw + time.sleep(3) + print('after login url:', ev('location.pathname')) + console.clear() # the login page is not under test + + def shot(name): + s = call('Page.captureScreenshot', format='png', captureBeyondViewport=True) + open(os.path.join(OUT, name + '.png'), 'wb').write(base64.b64decode(s['data'])) + goto(BASE + '/apps/calibre-web/data') + time.sleep(2) # give any autofill its moment + r = ev("""(function(){ var k=document.getElementById('fabEncryptionKey'); + return {path: location.pathname, keyField: k ? {name: k.name, autocomplete: k.getAttribute('autocomplete'), type: k.type, valueLength: k.value.length} : null, + oldIdPresent: !!document.getElementById('exportPassword'), + statusRows: document.querySelectorAll('[data-backup-row="second"],[data-backup-row="target"]').length, + targetLabels: document.querySelectorAll('label[for="target"]').length, + form: !!document.querySelector('[data-second-backup-form]'), + warnCallout: !!document.querySelector('#app-backup-section .app-callout-warn'), + scrollWidth: document.documentElement.scrollWidth}; })()""") + r['console'] = console[:] + shot('calibre-web-data') + print(json.dumps(r, indent=1, ensure_ascii=False)) +finally: + proc.terminate() + subprocess.run(['rm', '-rf', prof]) diff --git a/documentation/audits/burndown2-2026-10-16/tools/trivy_counts.py b/documentation/audits/burndown2-2026-10-16/tools/trivy_counts.py new file mode 100644 index 00000000..fbfb5e17 --- /dev/null +++ b/documentation/audits/burndown2-2026-10-16/tools/trivy_counts.py @@ -0,0 +1,22 @@ +#!/usr/bin/env python3 +"""trivy_counts.py ... — per image and per target: CRITICAL/HIGH counts, all and fixable (a fixed version +exists). The burndown-2 before/after table (R-972).""" +import json, sys +from collections import Counter +for p in sys.argv[1:]: + d = json.load(open(p)) + print("== %s" % d.get("ArtifactName")) + tot_all, tot_fix = Counter(), Counter() + for r in d.get("Results", []) or []: + a, f = Counter(), Counter() + for v in r.get("Vulnerabilities") or []: + sev = v.get("Severity") + a[sev] += 1 + if v.get("FixedVersion"): + f[sev] += 1 + tot_all += a; tot_fix += f + if a: + print(" %-60s %-9s crit %3d (fixable %3d) high %3d (fixable %3d)" % (r.get("Target", "")[:60], r.get("Type", ""), + a["CRITICAL"], f["CRITICAL"], a["HIGH"], f["HIGH"])) + print(" %-60s %-9s crit %3d (fixable %3d) high %3d (fixable %3d)" % ("TOTAL", "", tot_all["CRITICAL"], tot_fix["CRITICAL"], + tot_all["HIGH"], tot_fix["HIGH"])) diff --git a/documentation/backlog/CLOSED-ITEMS.md b/documentation/backlog/CLOSED-ITEMS.md index c4a9227d..56ed0e0b 100644 --- a/documentation/backlog/CLOSED-ITEMS.md +++ b/documentation/backlog/CLOSED-ITEMS.md @@ -26,6 +26,14 @@ --- +## 2026-10-16 — burndown 2 (controller v0.322.0) + +| Row | What | Closed | Evidence | +|---|---|---|---| +| **R-1033** | **Every box answered its public names over plain http, login pages included.** (P1) | CLOSED 2026-10-16 — fixed in controller v0.312.0 (traefik 301 to https, HSTS); the floor is 0.322.0 and every box that reports runs ≥ 0.321.0. `scripts/https_only_check.py` on all three reporting boxes: **35 public names → 301**, the negative control convicted. **Not checked:** Tester 2 (`sajatfelhom.hu`, off since 2026-10-04, 0.292.0) — its addresses answer Cloudflare 530 (tunnel down), so nothing is served in plain http; it takes the fix with the floor when it returns → R-1104. | `audits/burndown2-2026-10-16/P2/` | +| **R-970** | **The box's own hub API key could read and replace the box's settings file, unsigned.** (P2) | CLOSED 2026-10-16 — **controller v0.322.0**: `/api/config`, `/api/config/hash`, `/api/config/apply` removed; no route accepts the hub key (the self-update and geo routes need a session, the CSRF exemption is gone). Nothing called them: no caller in the hub (it never connects to a box; geo-disable goes to Cloudflare), the agent, the scripts or the dashboard; the hub README's „Push/Pull Config" rows described code that no longer exists (removed). Tests on the REAL route table, red-proved; **live** on demo-hp: every former door 401 with the box's own key, `/api/health` 200. `01` §4 records it. | `audits/burndown2-2026-10-16/P3/` | +| **R-1103** | **The install form kept branches no page served since R-1095.** (P4) | CLOSED 2026-10-16 — **controller v0.322.0**: the installed-only branches of `app_fields.html` removed; the tests that only rendered that dead page retired, each rule asserted on the settings tab (list in the controller CHANGELOG; R-694 moved, red-proved). | controller CHANGELOG v0.322.0 | + ## 2026-10-16 — apps burndown (controller v0.321.0, catalog `326f846`, agent script `dd8b2ac`, hub build script) | Row | What | Closed | Evidence | diff --git a/documentation/backlog/OPEN-ITEMS.md b/documentation/backlog/OPEN-ITEMS.md index 9be260d3..09f0aa20 100644 --- a/documentation/backlog/OPEN-ITEMS.md +++ b/documentation/backlog/OPEN-ITEMS.md @@ -124,7 +124,7 @@ stopping line that lies. | **R-494** | Install & onboarding | P4 | **NARROWED 2026-09-14 by operator ruling → [P3-LOW] the hub COULD create the tunnel at customer creation, for a domain already on Cloudflare. Not blocking: every customer has their own domain and the operator creates the tunnel per day-0 A.1 (`architecture/01-topology-and-trust.md`).** *Original finding, kept:* **[P1-HIGH] A new customer's dashboard has NO reachable address unless the operator hand-makes a Cloudflare tunnel — the link in the setup-code mail is dead.** MEASURED 2026-09-14 on a fresh install from the public ISO (drill intervention **I1**): the claim mail points at `https://felhom.drill0242.felhom.eu`; that name has **no A and no AAAA** record (`dig @1.1.1.1`, control `felhom.enkisfelhom.hu` resolves); the hub has **no tunnel- or DNS-creation code** (`hub/internal/cloudflare/` holds only geo-rule removal; `cf_tunnel_token` is a pasted, optional form field, `configs.go:1478`) — day-0 runbook A.1 makes it a manual Cloudflare-dashboard step that nothing on the customer-create page asks for; the box's own split-horizon resolver on the appliance LAN IP answered `google.com` but not the dashboard name at 13:27:39Z; the agent applied the record at **13:27:44Z** (`lanresolver: applied split-horizon record … ip=192.168.0.158`, 3 m 46 s after the controller started), so the box CAN answer the name — **but only to a device that uses the box as its DNS server, and no document, screen or mail tells a household to do that**; the router and the installer-offered DNS answer nothing. The page was reachable only at the guest's LAN address with the name forced (`curl --resolve …:443:192.168.0.158`). **A volunteer could not have done that.** **What it needs:** an operator ruling — the hub creates the tunnel and DNS at customer creation, or the product gives a household a LAN address that works with no DNS change. | **READY — rank P3-LOW; owner: CC** **Re-ranked 2026-10-03: P3→P4: operator-side automation; the operator creates the tunnel by hand per the day-0 runbook.** | — | — | CC | | **R-504** | Install & onboarding | P4 | **[P3-LOW] `iso.felhom.eu` cannot show an index page on its own — its root returns 404, and the download page lives on the website instead.** MEASURED 2026-09-14: `https://iso.felhom.eu/` and `/index.html` → 404; only named objects answer. The host is an R2 bucket behind a custom domain; whether R2 would serve an uploaded `index.html` at `/` was **not measured** (uploading anything to the public bucket is a publication). The ISO v1.27.0 task puts the Hungarian download page at `felhom.eu/letoltes` (published with the ISO, after the operator's yes). **Remaining:** a redirect from `iso.felhom.eu/` to that page needs a Cloudflare rule the session has no credential for. | **WAITING-ON-OPERATOR — rank P3-LOW; owner: operator (Cloudflare rule)** **Re-ranked 2026-10-03: P3→P4: households are sent to the website's download page; the bare address is cosmetic.** | — | — | operator | -## Apps & catalog — 23 rows (P2 1, P3 12, P4 10) +## Apps & catalog — 22 rows (P2 1, P3 12, P4 9) | ID | Category | Sev | What | State | Blocked on | Next action | Owner | |---|---|---|---|---|---|---|---| @@ -149,7 +149,6 @@ stopping line that lies. | **R-1096** | Apps & catalog | P3 | **After a disk-full, an app's damaged Redis file keeps the app down for good, and nothing says what to do.** FOUND 2026-10-16 on demo-hp 9201: the standing RomM (installed 2026-08-21) was stopped; the dashboard's Start re-created it, `romm-redis` crash-looped (unhealthy), the box stopped it again (`crash_loop`, `09` §3 decision 28) and mailed `app_start_failed`. Its Redis volume dates from the 2026-09-24 thin-pool fill (R-672): Docmost's damaged append-only file was repaired by hand that day with `redis-check-aof --fix` (`audits/r672-2026-09-24/B7-redis-aof-fix.txt`); RomM's was not (the copy `romm_romm_redis_data.pre-aof-fix-20260924T135937Z` is still on the box). The Redis log was not read: the box removed the containers first. That RomM was then removed by operator ruling (`audits/romm-ghost-2026-10-16/A1/`). | OPEN — filed 2026-10-16 | — | List the catalog apps whose Redis runs with `--appendonly yes` (romm does); for each, decide whether its Redis needs persistence at all; reproduce on 9202 by damaging an append-only file, and make the box repair a copy or say what to do | CC | | **R-1100** | Apps & catalog | P3 | **One sign-in for the dashboard and FileBrowser (proxy auth) — spike first.** Since controller 0.320.0 every app with a folder has „Fájlok ↗", and the box can show FileBrowser's password — but FileBrowser still asks for its OWN login the first time, so the household signs in twice. FileBrowser Quantum has a proxy-auth method (`auth.methods.proxyAuth`, header-trusted) that could take the dashboard session through traefik; nobody has measured it. Design: `architecture/02-controller-module-map.md` „Logins and folders". | OPEN — filed 2026-10-16 (task logins-folders). | — | Spike on demo-hp: proxy auth at the pinned tag (source + measured), a forwardAuth in traefik that answers only for a dashboard session, what a stranger reaching `files.` with a forged header gets, and what happens to FileBrowser's shares. | CC | | **R-1099** | Apps & catalog | P4 | **The N100 may hold RomM games in the old upload place, now shown under a fake „roms” platform.** Until 2026-10-16 RomM's own upload wrote to the drive's `roms/roms//`; after the mapping fix (catalog `fb18471`, R-1089) those files are at RomM's `library/roms/roms/…`. Measured on 9201: such a game showed as missing in its platform and again under a platform „roms” (`audits/romm-ghost-2026-10-16/B/b-after.txt`). Files put in with the file manager are not affected — they are now found. The N100 runs RomM (hub `/apps/romm`); CC does not log in to the lived-in box. | OPEN — filed 2026-10-16 | Operator: look at `roms/roms/` on the N100's drive in the file manager | If it holds platform folders: move them up one level into `roms/`, then run „Scan” in RomM; if it is empty, close | Operator | -| **R-1103** | Apps & catalog | P4 | **`app_fields.html` still carries the install form's INSTALLED-only branches, which nothing serves since v0.321.0.** R-1095 made `/apps/{slug}/install` of an installed app answer 302 to its settings tab, so `deploy.html` now renders only for a not-installed app. The `.AlreadyDeployed` branches (disabled inputs, the eye reveals, `DeployedFieldValues`) stayed because the R-254/R-709 guard tests (`deploy_secret_exposure_test.go`, `r709_password_field_test.go`, `r694_restored_login_test.go`) render that path by hand and assert a reveal control on it; removing the branches means retiring those tests for an unreachable path. Found 2026-10-16. | OPEN | — | Remove the branches and the parity cases `deploy_installed*`; move each guard's assertion to the settings tab it now protects (most already exist there: `TestAppPage_NoStoredValueShowsSentence`, `TestR709_*`), red-proved | CC | ## App updates — 4 rows (P3 4) @@ -214,18 +213,17 @@ stopping line that lies. | **R-1077** | Storage & devices | P4 | **No USB enclosure that hides or fakes a disk's serial has been measured.** The storage-identity spike (2026-10-15) had none at hand and found none in earlier evidence; the design's `usb_bridge` unknown rule (`architecture/16-storage-physical-identity.md` §3) is therefore an assumption. Cheap single- and dual-bay bridges are known to report one bridge serial for any disk. Evidence: `audits/storage-identity-2026-10-15/README.md` case 4b. | OPEN | — | Buy or borrow one cheap USB enclosure (single and dual bay), run `tools/physdisk_probe.py` against it, and set the rule from what it reports. | Operator (a device) then CC | | **R-1094** | Storage & devices | P4 | **The whole-disk format refusal tells the household to format the free part — which is refused while the other part is in use.** SEEN 2026-10-16 (controller 0.318.0): 409 „Ezen a lemezen egy használatban lévő meghajtó van, ezért a teljes lemez nem formázható. Csak a szabad részét formázhatod." — since agent 0.158.1 a part next to a mounted part can only be USED (the root wrapper trusts no „Felhom's own" claim). Evidence: `audits/storage-identity-buildB-2026-10-15/live/14-samedisk-refusal-offer.txt`. | READY | — | Reword `err.web.meghajto_hasznalatban_formazas` (hu + en): „… nem formázható. A szabad részét használatba veheted." Next controller release; the copy gates run. | CC | -## Security & access — 21 rows (P1 2, P2 3, P3 10, P4 6) +## Security & access — 20 rows (P1 1, P2 2, P3 11, P4 6) | ID | Category | Sev | What | State | Blocked on | Next action | Owner | |---|---|---|---|---|---|---|---| -| **R-1033** | Security & access | P1 | **Every box answers its public names over plain `http://` — login pages included.** MEASURED 2026-10-14 from DooPlex over the public path (Cloudflare `Server: cloudflare`, `CF-RAY`): `http://felhom.enkicsifelhom.hu/login` → 200, `http://felhom.enkisfelhom.hu/login` (demo-hp) → 200, `http://torrent.enkicsifelhom.hu/` → 200; no redirect to https and no `Strict-Transport-Security`. Sonarr, Radarr and Prowlarr make it worse: their sign-in redirect is ABSOLUTE `http:///login`, so a household that opened the https address lands on the plain page and sends its password unencrypted between the browser and Cloudflare (`audits/media-all-drives-2026-10-14/H-indexer-sync-ncore.txt`). On an untrusted network (café Wi-Fi) that password can be read. The operator may raise this to P1. | **NARROWED** — filed 2026-10-14; **P1 by the operator 2026-10-14 22:13 (`09` §3 decision 244)**. FIXED in controller v0.312.0 (traefik sends every `http://` to `https://`, 301, path and query kept; HSTS one day; decision 246) and PROVEN on Tester 1, demo-hp and demo-felhom (29 public names, `scripts/https_only_check.py`; https answers unchanged), delivered by hand. Open: the fleet delivery — vouch 0.312.0 and the floor (morning); Tester 2 (`sajatfelhom.hu`, 0.292.0, off) gets it with the floor | the operator's vouch + floor | Vouch controller 0.312.0, raise the floor; then run `scripts/https_only_check.py` on every box and close | CC | | **R-985** | Security & access | P3 | **Our zero-knowledge wording is stronger than the product: on a live box the operator can reach the off-site backup key (through the vaulted root credential and the operator tunnel) without the customer's recovery code.** Design-shaped; decision for the operator in `STATUS.md`. Fix options: change the wording, or remove operator root reach to the key. Security review 2026-10-12 (`audits/security-review-2026-10-12/`); detail held off-git for the operator (`/mnt/5_hdd/felhom.eu/evidence/security-review-2026-10-12-PRIVATE/`). | WAITING-ON-OPERATOR — design-proposal | operator decision | Decide the wording or the change | operator | | **R-983** | Security & access | P3 | **Seven small dashboard weaknesses: after sign-in the browser can be sent to another site; the server-reboot route acts on a GET, so a link can reboot the guest (**FIXED 2026-10-13 in controller v0.310.0, R-998 session: POST only, `TestServerReboot_PostOnly` — six remain**); no anti-framing headers; parallel sign-in attempts get past the limiter; the settings page allows 8-character passwords; reset-code requests have no limit on the box; logout can be triggered from another site.** Fix each with a test, in one controller release. Security review 2026-10-12 (`audits/security-review-2026-10-12/`); detail held off-git for the operator (`/mnt/5_hdd/felhom.eu/evidence/security-review-2026-10-12-PRIVATE/`). | OPEN | — | One hardening release | CC | | **R-977** | Security & access | P3 | **FileBrowser's default password can come back if its data volume is ever re-created, because the box checks it only once; and the tunnel can start before the box is claimed.** Static; needs a live check on 9202. Fix: check at every start, and do not start the tunnel before the claim. Security review 2026-10-12 (`audits/security-review-2026-10-12/`); detail held off-git for the operator (`/mnt/5_hdd/felhom.eu/evidence/security-review-2026-10-12-PRIVATE/`). | OPEN | — | Measure on 9202; then fix | CC | | **R-976** | Security & access | P3 | **A family member's session can be copied out of a family-gated app, and a dashboard password reset does not end family or gate sessions; so a stolen session keeps working for up to 30 days.** Fix: give each app its own derived token instead of the session itself, and end every family and gate session on a reset. Security review 2026-10-12 (`audits/security-review-2026-10-12/`); detail held off-git for the operator (`/mnt/5_hdd/felhom.eu/evidence/security-review-2026-10-12-PRIVATE/`). | OPEN | — | Fix with tests in a controller release | CC | -| **R-970** | Security & access | P2 | **Whoever holds a box's own hub API key — the hub, or anyone with a copy of the hub database — can read the box's settings file with every secret in it and replace that file through the internet; the box does not check that such a change is signed.** This contradicts `01` §4 (the box exposes no control endpoint) and §10 (a hub compromise alone cannot forge commands). Nothing in the product calls this route any more. Fix: remove the route, or require an operator-signed op for it. Security review 2026-10-12 (`audits/security-review-2026-10-12/`); detail held off-git for the operator (`/mnt/5_hdd/felhom.eu/evidence/security-review-2026-10-12-PRIVATE/`). | OPEN — confirmed by a second reader | — | Remove the route with a test that it is gone; release the controller | CC | | **R-954** | Security & access | P2 | **We cannot tell whether anyone used the old hub operator key (R-950) or the open hub read routes (R-951) before 2026-10-12; if someone did, they could have read every box's break-glass root credential and every customer's box report.** The exposure began in February 2026; the logs that could show it cover only 2026-10-12 from about 09:54 and one day in June, so about 238 days are not visible. Fix (operator decision): change the break-glass root password of every box (tester-1 holds a real person's data), or accept the risk; either way, keep ingress access logs long enough to answer this next time. | WAITING-ON-OPERATOR — filed 2026-10-12 by the security review; the log search was not completed in-session | operator decision | Decide: rotate every box's break-glass root password now, or accept | operator | | **R-1042** | Security & access | P3 | **The boxes' Cloudflare keys cannot change zone settings, so Cloudflare's own „Always Use HTTPS” cannot be switched on.** Measured 2026-10-14 on all three zones (`audits/https-only-2026-10-14/``1A-1-zones-and-keys.txt`): each `cf_api_token` is valid and sees only its own zone, but GET/PATCH `settings/always_use_https`, `ssl`, `security_header` answer 403; the redirect and transform rule phases too. The https-only fix therefore lives on the box (decision 246). A second layer at Cloudflare needs „Zone Settings: Edit” (and, for headers, „Transform Rules”) added to each customer's key — the hub's zone-reach check stays. | **WAITING-ON-OPERATOR** — filed 2026-10-14 | a key permission only the operator can grant | Optional: widen each customer key, then switch „Always Use HTTPS” on per zone | operator | +| **R-1104** | Security & access | P3 | **Check https-only on Tester 2 when it reports again.** R-1033 (plain http on every public name) is closed on the three boxes that report (35 names → 301, 2026-10-16). Tester 2 (`sajatfelhom.hu`) has been off since 2026-10-04 on controller 0.292.0; its addresses answer Cloudflare 530 (tunnel down), so nothing is served in plain http while it is off. When it comes back it takes the floor (≥ 0.312.0 carries the redirect). | OPEN — filed 2026-10-16 | Tester 2 reporting again | Run `scripts/https_only_check.py` with Tester 2 in it; close | CC | | **R-955** | Security & access | P4 | **The cross-box check of the hub API is done in source and tests but not fully proven: if a later check masks a missing id check, a box's key could read or change another box's hub record without any test noticing.** Read 2026-10-12: every box-facing `/api/v1` route takes the box from its own key or refuses a different id; 14 routes already had a refusal test, 5 got one (`crossbox_refusal_test.go`). Left: red-prove the 4 new tests that were not red-proved (as the restore-directive one was), and the live read-only check with one demo box's key against the other demo box's id. | OPEN — filed 2026-10-12 by the security review | — | Red-prove the 4 tests; run the live GET check on the two demo boxes | CC | | **R-924** | Security & access | P2 | **The operator signing keys exist only on DooPlex, with no passphrase and in no backup — a loss of DooPlex means no box ever accepts a signed agent update, config bundle or OS step again without an on-site re-enrollment.** MEASURED 2026-10-09: `/mnt/5_hdd/felhom.eu/felhom-op-operational`, `felhom-rec-recovery`, `felhom_op_ed25519` (0600 `kisfenyo`); `ssh-keygen -y -P ''` opens all three (no passphrase); `/mnt/5_hdd/felhom.eu` is in no backup set, the off-site job does not carry them. `04` §1 says the operational key is "passphrase-protected" and the recovery key "kept offline" — today neither holds (custody ruling 1 of 2026-09-16 put both on DooPlex for this phase; `04` §3.1). Both keys share one fate, so the cold key cannot do its one job (re-pin after losing the operational key). `runbooks/total-loss-of-dooplex.md` S6. | **NARROWED 2026-10-09 — operator ruling: option A** (print both AND copy them). The three key files and their public halves ride the nightly encrypted DooPlex→ep0 copy (`scripts/dooplex-offsite/`, a missing key refuses the push); the Sunday restore test proves each private key still derives its own public half (never printed). **LEFT:** the operator prints S6a/S6b (`runbooks/break-glass-sheet.md`); the keys still have no passphrase (custody ruling 1 of 2026-09-16 stands until the first sale). | operator: print | Operator: print the two keys; then close | operator | | **R-132** | Security & access | P3 | **`curl -w '%{redirect_url}'` reconstructs the request URL WITH its basic-auth credential** — so a `-u ":$HUB_PW"` call that never put the password in a URL still printed it **Merged 2026-10-05 from R-350 (duplicate):** (1) 2026-08-20 occurrence: POST /configuration/artifacts answers 303; leak lives only in the CC transcript under ~/.claude/projects/ on DooPlex, not in git/evidence (checked then). (2) `-v` and `--libcurl` also re-render the credential, not only %{redirect_url}; confirm redirects with %{http_code} + follow-up GET. (3) Rotation path: hub /configuration form (current_password/new_password/confirm_password); DB override wins over ConfigMap (break-glass); CC can rotate file-to-file without printing (operator-present-one-time-secrets) if asked. | **WAITING-ON-OPERATOR** — **ACTION: rotate `HUB_PW`** **Folded R-580 2026-10-03** (the same `curl -w %{redirect_url}` credential echo, seen again 2026-09-18). **Note 2026-10-12 (security review):** `manifests/hub.yaml` also carries the hub login's bcrypt hash in this public repository (the break-glass field); when `HUB_PW` is rotated, decide whether that field should stay empty. | — | Happened on 2026-07-31 while red-proofing the R-120 gate: the hub operator password was written to the session transcript by the write-out format, not by the request. `-u` is safe; the *reporting* was not. Rule: read the redirect from `-D -` and grep `^Location:`, never `%{redirect_url}`, on any authenticated call. Rotate the hub password (`/configuration` → Login password; ConfigMap `auth.password_hash` is the reset path) and update `~/.config/credentials` | Viktor | @@ -240,15 +238,16 @@ stopping line that lies. | **R-1050** | Security & access | P4 | **Raise HSTS to one year on or after 2026-11-15, if no https trouble was reported.** `09` §3 decision 249 (D2 = A, operator 2026-10-15): HSTS stays `max-age=86400` now; after a month with no https trouble it becomes one year (`31536000`); never preload, never `includeSubDomains`. The value is `HSTSMaxAgeSeconds` in `felhom-controller/controller/internal/infra/infra.go`, pinned by `TestRenderForwardedHeaders_HTTPSOnly`. „Trouble” = any report of a name that will not open, or a box answering http after the floor. | **WATCHING** — filed 2026-10-15 | the date | On or after 2026-11-15: read the register and the operator's mail for https trouble since 2026-10-15; none → a controller release with one year (test updated), bake → vouch → floor | CC | | **R-1054** | Security & access | P3 | **The hub's operator/global API key is still one bearer that can do everything on `/api/v1`, including reading every box's break-glass root password (`GET /admin/hosts/{id}/recovery-credential`).** Hub v0.152.0 gave the web surface scoped tokens (`05` §17) but tokens are refused on `/api/v1` by design. Who uses the global key today is not listed in one place. Fix: list its consumers; move each operator use to a scoped token on the web side (or a token class on the API), and keep the global key only where a box path needs it — or retire it. | OPEN — filed 2026-10-15 by the token build | — | List the global key's consumers (pod env, scripts, runbooks) | CC | -## Box system & updates — 12 rows (P2 1, P3 7, P4 4) +## Box system & updates — 13 rows (P2 1, P3 8, P4 4) | ID | Category | Sev | What | State | Blocked on | Next action | Owner | |---|---|---|---|---|---|---|---| +| **R-1105** | Box system & updates | P3 | **The controller runtime is still Debian 12, because Debian 13 moves the off-site engine from restic 0.14.0 to 0.18.0.** The off-site code's measured behaviour is restic 0.14.0's: a missing source path is only a warning (`offbox_capture.go`), the `--json` progress shape (`offbox_progress.go`), the forget day-buckets (`offbox_window.go`), restore without a lock (`offbox_proof.go`). Debian 12's restic binary is built with go1.19.8. Measured 2026-10-16 on demo-hp: one off-site backup with 0.18.0 (backup OK, 172 snapshots), then 0.14.0 on the same store (backup OK, 186) — so the store stays readable both ways; the rest is NOT measured. | OPEN — filed 2026-10-16 | — | Re-prove each 0.14.0 assumption on restic 0.18 (a missing path, progress, a forget window, a restore), then move the runtime to Debian 13 | CC | | **R-984** | Box system & updates | P4 | **Host and agent hardening, low risk each: the backup-target route has no role check; the unsigned guest spec has no size bounds; signed ops have no maximum validity; the guarded mkfs does not refuse LVs, zvols or RAID devices; the local API is reachable from the LAN by a static route; a sudoers inspect pattern is wider than needed; install passes secrets on the command line; guest settings files are world-readable; the host offers rpcbind and DNS on the LAN.** Fix each in its own small change. Security review 2026-10-12 (`audits/security-review-2026-10-12/`); detail held off-git for the operator (`/mnt/5_hdd/felhom.eu/evidence/security-review-2026-10-12-PRIVATE/`). | OPEN | — | Batch into hardening work | CC | | **R-982** | Box system & updates | P3 | **The Proxmox host accepts root password login over SSH from the LAN (measured on demo-hp), so anyone on the household network can try the root password.** Design-shaped: the break-glass password exists for the console. Fix: key-only SSH for root; the password stays for the console. Evidence: `audits/security-review-2026-10-12/evidence/demo-hp-host-reads.txt`. | OPEN — design-proposal | — | Decide; then set it in the installer and the config bundle | CC | | **R-979** | Box system & updates | P3 | **Controller updates are trusted by registry tag alone (no digest, no signature), and the Update button offers any newer tag, even an unvouched one; the built-in traefik, cloudflared and FileBrowser images are also pinned by tag only.** Whoever can push to the registry decides what runs. Fix: pin by digest from the hub's vouched list; offer only vouched versions. Security review 2026-10-12 (`audits/security-review-2026-10-12/`); detail held off-git for the operator (`/mnt/5_hdd/felhom.eu/evidence/security-review-2026-10-12-PRIVATE/`). | OPEN — design-proposal | — | Design note, then build | CC | | **R-974** | Box system & updates | P3 | **A compromised host agent can likely become root on the host through the root wrapper that applies PBS settings: the wrapper accepts a folder path inside the agent's own writable tree and then acts on it as root.** Static (the symlink behaviour was reasoned, not run). Same class as R-861. Fix: a fixed root-owned folder, and refuse symlinks before any root action. Security review 2026-10-12 (`audits/security-review-2026-10-12/`); detail held off-git for the operator (`/mnt/5_hdd/felhom.eu/evidence/security-review-2026-10-12-PRIVATE/`). | OPEN | — | Fix the wrapper with a test on a throwaway box | CC | -| **R-972** | Box system & updates | P2 | **The shipped controller and hub programs are built with Go 1.24.13 and golang.org/x/crypto v0.31.0, and the agent with Go 1.26.0, so dozens of fixed Go security bugs (including html/template escaping fixes) are still in what runs on boxes and the hub.** Go 1.24 has had no security fixes since Go 1.26 was released (Go supports the two newest major releases: https://go.dev/doc/devel/release#policy); the scanners name fixes in Go 1.26.9 and 1.27.2. Also: the controller image's Debian 12 base has 12 fixable critical packages, and the Samba image has 48 fixable high ones. Fix: build all three on a supported, patched Go; update x/crypto; rebuild the base images. Scanner output: `audits/security-review-2026-10-12/scanners/`. | OPEN — measured on the shipped binaries | — | Bump the toolchain and bases in their own release task | CC | +| **R-972** | Box system & updates | P2 | **The shipped controller and hub programs are built with Go 1.24.13 and golang.org/x/crypto v0.31.0, and the agent with Go 1.26.0, so dozens of fixed Go security bugs (including html/template escaping fixes) are still in what runs on boxes and the hub.** Go 1.24 has had no security fixes since Go 1.26 was released (Go supports the two newest major releases: https://go.dev/doc/devel/release#policy); the scanners name fixes in Go 1.26.9 and 1.27.2. Also: the controller image's Debian 12 base has 12 fixable critical packages, and the Samba image has 48 fixable high ones. Fix: build all three on a supported, patched Go; update x/crypto; rebuild the base images. Scanner output: `audits/security-review-2026-10-12/scanners/`. | **NARROWED** 2026-10-16 (burndown 2): **controller v0.322.0 released** on Go 1.27.2 + x/crypto v0.58.0, runtime debian:12.13-slim + `apt-get upgrade` (Debian 13 deliberately not: restic 0.18, R-1105) — scanner: critical 16 → 4, fixable criticals and highs in the OS 0; govulncheck 62 → 1 (module-level, `openpgp` not linked). **Hub v0.156.0 built** (Go 1.27.2, alpine 3.24.2: 0 critical, 0 high) — deploy waits for the operator's yes. **Agent: Go 1.27.2 committed (`37b99d7`), tested, NOT released** — the next vouched agent release carries it. Open: the Samba image (48 fixable high, not rebuilt); docker-compose plugin's own Go (4 high, upstream). Evidence `audits/burndown2-2026-10-16/P4/` | the operator's yes for the hub deploy; the next vouched agent release | Deploy hub v0.156.0 on the yes; rebuild the Samba image on its current base; close when the agent release carries Go 1.27.2 | CC | | **R-862** | Box system & updates | P3 | **Tester 2 cannot take the config bundle until one by-hand bootstrap is done: its `felhom-os-apply` (agent 0.142.0) predates the bundle mode, and no signed job can write a root file on it.** FOUND 2026-10-04 (R-840 build, Part C): the route reaches every box installed from installer 1.31.0 on, and the demo boxes (bootstrapped by CC); Tester 2 has every root file of agent 0.142.0 (installer 1.30.0) and lacks only the R-858 wrapper fix, which matters only for a Docker step it gets solely from a signed job. CC has no route to Tester 2 (its door admits only the operator's WireGuard peer; `felhom-op` cannot become root). The steps: `runbooks/config-bundle.md` "Tester 2". Then CC signs the bundle and reads it back. | **WAITING-ON-OPERATOR** — the operator said (2026-10-04 ~19:05) he will try through his tunnel **2026-10-07 07:58 (`09` §3 decision 170): the operator believes Tester 2 never set up the off-site backup (no escrow); the laptop may stay off for days; the tester plans to add an HDD.** **2026-10-07 (Part H, read only):** in Tester 2's last 10 notifications (2026-10-05 09:16 → 2026-10-07 06:58) the household got 0 mails, the operator 10 (host_down ×9, expected_dbdump_missed ×1); control: the household channel shows on the other three customers. So the household is not mailed daily while the box is off; no row (`audits/day-2026-10-07/H/`). | the operator's WireGuard tunnel | the operator runs the three bootstrap commands; CC sends the bundle | operator | | **R-78** | Box system & updates | P3 | **`local_api` authority ruling — auto-reconcile vs detect-only** **MIGRATED FROM `ROADMAP.md` 2026-08-22 (R-369) — originally filed 2026-07-25, size M, roadmap state `idea (deferred OUT of R-77 on purpose)`.** Moved verbatim; nothing added or reinterpreted. The roadmap keeps its copy as history, marked moved. **An OWED OPERATOR DECISION, not a defect — moved because an owed ruling hidden among feature ideas is the shape this session exists to remove.** | **OPEN — migrated from ROADMAP 2026-08-22, rank unchanged** | — | R-77 ships detection because the fix is genuinely undecided, and **both directions can lose customer-visible function**. **Direction 1 (today):** `controller.yaml` wins and drift is silent → the 2026-07-25 island migration blinded the whole fleet's control plane for 17.5 h (drive gate, guest-reboot recovery, quiesce/backup all degrade). R-77 makes that loud but does not stop it recurring. **Direction 2 (`bootstrap.json` wins, auto-reconcile on boot):** a guest whose `controller.yaml` is CORRECT and whose `bootstrap.json` is stale — a half-completed re-provision, a hand-repaired guest, a setup-wizard box — gets a **working channel clobbered on the next restart**, fleet-wide and silently, during a routine deploy. That is not obviously better than the bug. Needs a spike: which writer is authoritative per field (endpoint vs fingerprint vs token — `mergeLocalAPI` replaces the whole block, so they cannot be reconciled independently today), whether the agent side should stamp a generation/mtime so 'newer wins' is even expressible, and whether reconcile should require an operator ack. Until then the drift alert plus a manual edit is the supported path. | CC | | **R-468** | Box system & updates | P3 | **[P3-LOW] THE GOLDEN WAIVER — goldens on a cadence, not per release (operator ruling 2026-09-13).** 25 goldens in 26 days in August, almost one per release, because `golden_currency_gate.py` trips on every release by design and the only honest ways past it were a bake or a declared `--no-verify` (thirteen by 2026-09-01, R-404/R-417). **The ruling: bake WEEKLY, and always before any drill or fresh install.** Every release still raises the FLOOR, so both demo boxes keep getting each release in ~20 s; only the golden — which protects a fresh install and nothing else — moves to a cadence. **The mechanism (built 2026-09-13):** `documentation/tests/golden-waiver. **⚠ CORRECTED THE SAME DAY (R-472): between bakes the floor does NOT carry a release — the hub holds any floor above the vouched golden (publish-train rule 1), so releases between bakes reach the demo boxes only by hand-deploy.**yml`, four lines (`issued`, `expires`, `reason`, `register_row: R-468`), read by the gate. While valid, a golden BEHIND the record makes the gate print a loud ADVISORY and exit 0; when it expires the gate is red again until someone bakes or renews. **The 14-day cap is enforced by the gate, not the runbook** — a longer, undated, unparseable, reason-less or row-less waiver is INCONCLUSIVE (exit 2), never 0 and never silently ignored. **It never covers a golden that is UNRECORDED (R-385)** — that is not a cadence choice. **A dated waiver cannot be forgotten; it just expires** — the difference from R-242's original rule, which recurred the day after it was written. Tests: `scripts/test_golden_currency_gate.py` cases 5–15 (E/F/G/H, a 15-day, absent, unparseable, bad-row and empty-reason waiver each 2; the R-421 decoy — a file saying only `expires` — 2). **This is a PRE-CUSTOMER arrangement: the first external install retires it** (delete the file in that commit). Cadence written into `RUNBOOK-manual-build.md` §4.2 and the `felhom.eu` end-of-session checklist. **Does NOT touch R-242's open half (nothing gates the VOUCH).** **2026-10-15 (`09` §3 decision 250, operator):** the cadence is now the RULE, not a waiver — a controller release needs no golden (the floor carries it), the golden is baked every Sunday night when the floor is above it (`runbooks/nightly-rotation.md`), and `golden_currency_gate.py` convicts only a golden MORE THAN 7 DAYS old while a release is ahead (CASE 18–21, red-proved). The waiver file stays as a dated exception for a missed Sunday. | **WATCHING** — the weekly bake is a night-routine step; the first external install still retires the waiver arrangement | — | — | CC |