From db2371c6f5c461b2a06272fa2b8248449094afa2 Mon Sep 17 00:00:00 2001 From: kisfenyo Date: Mon, 19 Oct 2026 05:38:38 +0200 Subject: [PATCH] Day 2026-10-19: agent 0.160.0 (released, not vouched), controller 0.332.0 floor (one sign-in R-1100, escrow confirm R-1151), hub 0.159.0 deployed (R-1150, R-1154), R-1153 not a defect, old-restic check passed; register 168 -> 166 (closed 10, opened R-1155..R-1162) --- CONTEXT.md | 12 ++ REPORT-day-2026-10-19.md | 156 ++++++++++++++++++ REPORT-evening-2026-10-18.md | 8 +- STATUS.md | 13 +- .../architecture/02-controller-module-map.md | 29 +++- documentation/architecture/03-host-agent.md | 13 +- .../architecture/07-backup-architecture.md | 13 +- .../felhom-system-poster.facts.md | 2 +- .../architecture/felhom-system-poster.html | 2 +- .../P2/browser/01-app-page-files-button.png | Bin 0 -> 101583 bytes .../02-filebrowser-opened-signed-in.png | Bin 0 -> 80636 bytes .../browser/03-after-sign-out-asks-again.png | Bin 0 -> 36579 bytes .../audits/day-2026-10-19/P2/browser/walk.txt | 17 ++ .../day-2026-10-19/P2/forged-headers.txt | 9 + .../audits/day-2026-10-19/P3/01-before.txt | 4 + .../P3/02-deploy-onlyoffice.txt | 5 + .../audits/day-2026-10-19/P3/03-link-on.txt | 16 ++ .../audits/day-2026-10-19/P3/04-preview.txt | 4 + .../P3/05-preview-real-docx.txt | 10 ++ .../day-2026-10-19/P3/06-link-off-control.txt | 9 + .../audits/day-2026-10-19/P3/07-teardown.txt | 8 + .../day-2026-10-19/P3/preview-sample.jpg | Bin 0 -> 8714 bytes .../day-2026-10-19/P4/01-customer-floors.txt | 4 + .../day-2026-10-19/P4/02-boxes-move.txt | 14 ++ .../audits/day-2026-10-19/P4/03-box-walk.txt | 33 ++++ .../day-2026-10-19/P4/04-https-only.txt | 33 ++++ .../P4/05-files-one-sign-in.txt | 16 ++ .../P4/06-demo-felhom-checks.txt | 7 + .../day-2026-10-19/P4/07-global-floor.txt | 16 ++ .../audits/day-2026-10-19/P5/hub-deploy.txt | 29 ++++ .../P5/reports-after-deploy.txt | 9 + .../P8/old-restic-check.txt | 31 ++++ documentation/backlog/CLOSED-ITEMS.md | 11 +- documentation/backlog/OPEN-ITEMS.md | 29 ++-- hub/CHANGELOG.md | 2 +- 35 files changed, 525 insertions(+), 39 deletions(-) create mode 100644 REPORT-day-2026-10-19.md create mode 100644 documentation/audits/day-2026-10-19/P2/browser/01-app-page-files-button.png create mode 100644 documentation/audits/day-2026-10-19/P2/browser/02-filebrowser-opened-signed-in.png create mode 100644 documentation/audits/day-2026-10-19/P2/browser/03-after-sign-out-asks-again.png create mode 100644 documentation/audits/day-2026-10-19/P2/browser/walk.txt create mode 100644 documentation/audits/day-2026-10-19/P2/forged-headers.txt create mode 100644 documentation/audits/day-2026-10-19/P3/01-before.txt create mode 100644 documentation/audits/day-2026-10-19/P3/02-deploy-onlyoffice.txt create mode 100644 documentation/audits/day-2026-10-19/P3/03-link-on.txt create mode 100644 documentation/audits/day-2026-10-19/P3/04-preview.txt create mode 100644 documentation/audits/day-2026-10-19/P3/05-preview-real-docx.txt create mode 100644 documentation/audits/day-2026-10-19/P3/06-link-off-control.txt create mode 100644 documentation/audits/day-2026-10-19/P3/07-teardown.txt create mode 100644 documentation/audits/day-2026-10-19/P3/preview-sample.jpg create mode 100644 documentation/audits/day-2026-10-19/P4/01-customer-floors.txt create mode 100644 documentation/audits/day-2026-10-19/P4/02-boxes-move.txt create mode 100644 documentation/audits/day-2026-10-19/P4/03-box-walk.txt create mode 100644 documentation/audits/day-2026-10-19/P4/04-https-only.txt create mode 100644 documentation/audits/day-2026-10-19/P4/05-files-one-sign-in.txt create mode 100644 documentation/audits/day-2026-10-19/P4/06-demo-felhom-checks.txt create mode 100644 documentation/audits/day-2026-10-19/P4/07-global-floor.txt create mode 100644 documentation/audits/day-2026-10-19/P5/hub-deploy.txt create mode 100644 documentation/audits/day-2026-10-19/P5/reports-after-deploy.txt create mode 100644 documentation/audits/evening-2026-10-18/P8/old-restic-check.txt diff --git a/CONTEXT.md b/CONTEXT.md index 0ac96101..a379bae4 100644 --- a/CONTEXT.md +++ b/CONTEXT.md @@ -16,6 +16,18 @@ > and holds nothing of its own; this file does hold its own content, namely the standing rulings below. +> **2026-10-19 (day) — controller 0.332.0 is the floor (MinAgent 0.158.1, 05:24 local); agent 0.160.0 released and on the +> three test hosts, NOT vouched; hub 0.159.0 DEPLOYED (operator yes in advance).** One sign-in for the file manager (R-1100, +> D16): dashboard pass → host-only `felhom_files` cookie → traefik forwardAuth `/__felhom_gate/files` sets the per-box +> SECRET header (`/filebrowser-sso-header`, never logged) naming FileBrowser user `felhom-household`; traefik makes a +> RELATIVE Location in a forwardAuth answer absolute against the auth server — always answer absolute URLs. R-1151: the +> escrow package uploads at `POST /escrow/ceremony/confirm` (two typed words), an old controller keeps the claim order. +> R-1149 (D17): local tier `keep-daily=N`. R-1154 rule (after a security review of the helper's first draft): the +> host-enroll reuse path NEVER re-issues — the passphrase must not reach the operator's re-issue powers; it mails the +> operator. R-1153 was the test file (FileBrowser previews .docx with MuPDF before OnlyOffice). R-887 closed (381 jobs, 0 +> lost since S21). The old-restic check after demo-hp's first real 0.19.1 prune passed. Register 168 → 166. +> `REPORT-day-2026-10-19.md`. + > **2026-10-18 (evening) — controller 0.331.0 is the floor (MinAgent 0.158.1): OnlyOffice opens and saves from FileBrowser > and Nextcloud, FileBrowser back at once after a restart (R-1018), a removal deletes a volume the definition dropped > (R-1117); catalog `30eea97`: Immich/Nextcloud Redis without a volume; golden 0.331.0 baked, NOT vouched; a fresh install diff --git a/REPORT-day-2026-10-19.md b/REPORT-day-2026-10-19.md new file mode 100644 index 00000000..1ca943ab --- /dev/null +++ b/REPORT-day-2026-10-19.md @@ -0,0 +1,156 @@ +# REPORT — day 2026-10-19 + +The operator answered the two STOPs in advance („YES to the agent and the hub release") and earlier: golden 0.331.0 +vouched; D16 (one sign-in) yes; D17 „one per day, 3 days". No question was asked during the session. + +## In plain words + +- **Agent 0.160.0 runs on all three test hosts.** A new recovery code replaces the old one only after the household types + two of its words back; a broken-into box cannot flood the whole-box backups; the local copies are one per day for 3 + days; an empty partition does not ask „data will be erased". **It is not vouched — that is yours.** +- **One sign-in for the file manager is live on every box** (controller 0.332.0, the floor). „Fájlok ↗" opens the app's + folder with no second login. A sign-out on the dashboard asks again. No app on the box can pretend to be the household. +- **Hub 0.159.0 is live.** A refused backup has its own alarm text. A reinstall over an old host record now mails you; it + does not re-issue the codes by itself (a security review stopped the first draft that did). +- **The preview error (R-1153) was a broken test file**, not the box. +- **The old backup program still reads demo-hp's off-site copies** after the first real clean-up with the new one. + +## 1. Agent 0.160.0 (R-978, R-973, R-1093, R-1149, R-1151) — `audits/day-2026-10-19/P1/` + +- **Content:** R-978 (an abandoned second ceremony keeps the first code), R-973 (the cadence cap: daily tier 3 per 24 h, + off-site 1 per 6 days), R-1093 (an empty partition is not data), **R-1149** (local tier `keep-daily=N`, operator D17), + **R-1151** (the package uploads only at `POST /escrow/ceremony/confirm` with two typed words; a claim without + `defer_upload` keeps the R-978 order, so an old controller still completes a ceremony). Commits `1b6e316`, `c11e3e2`, + `124164d` (CHANGELOG), `4545819` (two texts, after the release, unreleased). Released with `release-agent.sh`: sha256 + `7ebb547f2b1ab93544ba828d3040351b60c4126327a5b85bbcb33f8f2b3dfca1`, bundle + `6b06090190ff609af1fe9842447ebf385fd52da4be382bc7ca708b558c8e202f`, round trip verified, tag `v0.160.0`. +- **Red-proofs:** keep-last for the primary → „primary tier prune = "keep-last=3"" and „holds 0 copies made before the + compromise"; the claim's defer flag ignored → „a code that was shown but never typed back replaced the package: code 1 + no longer opens it (uploads=2)" (all three abandon paths); the word check skipped → „one wrong word: got 200". +- **demo-hp proof** (signed jobs 01:22 UTC, running 01:23, „update committed" 01:24; probe 75/75): + - a normal „Mentés most" of 9201: green, 6.9 GB in 443 s; yesterday's copy pruned (keep-daily=1, the same copy keep-last + would prune); the cap's history on disk holds both successes; + - escrow through the wizard's own calls: ceremony 1 — one wrong word 422, the right words 200; code 1 opens the hub's + package, code 0 is a kept earlier one (422, superseded at the confirm second 01:47:47). Ceremony 2 shown and abandoned — + code 1 still opens it (200), code 2 opens nothing (400). demo-hp's stored code is now code 1 (CC's secret store); + - R-1093 on the real route: a 64 MB RAM disk (`scsi_debug`, `/dev/sdb`), one empty GPT partition → `POST /disks/format` + → 200 formatted, no confirmation; control: the same partition, now ext4 → 403 `needs_confirmation`. RAM disk removed. + **A loop device cannot be used:** the route and the probe accept only sd/nvme/vd/hd names (by design). +- **The answer:** the operator's „yes" (in advance). Tester 1 and demo-felhom took 0.160.0 by signed jobs (01:52 UTC → + 01:54 / 01:55, probe 75/75, `keep-daily=3` armed on both); the hub's host rows read 0.160.0 for all three, and fresh + reports after the hub restart. **Old controller with the new agent:** pinned by `TestEscrowCeremony_R1151_OldControllerKeepsTheClaimOrder`; **new controller with agent 0.159.2:** pinned by `TestR1151_OldAgentClaimCompletesAtOnce` and the agentapi test — no host runs 0.159.2 any more, so not walked live. + +## 2. One sign-in (R-1100) — `audits/day-2026-10-19/P2/`, `P4/05-*`, `P4/06-*` + +- **Built** exactly the design note's recommendation (controller `9bdd8f8`, `601bdba`): the dashboard pass, the host-only + files cookie (derived from the session fingerprint, the R-976 shape), the per-box secret header name, the forwardAuth + answer; header user `felhom-household` with the household's file rights from userDefaults; `logoutRedirectUrl` = the + dashboard; `admin` stays a password user; the data tab's „asks for its own password" note only without the sign-in. +- **Tests, each red-proved:** replayed pass, expired pass, pass for another host (two guards: the host check and the + host-bound session key — red only with both removed), wrong X-Forwarded-Host, no session → no pass, signed out → asks + again (and after a password change), cross-site → no pass, dot-segments in `to`, the absolute redirect, the config + trusts only the secret name, the header user's rights, the route asks the controller and strips the header, the note. +- **Live, found and fixed before release:** on rc.2 the pass answer's relative redirect became + `http://felhom-controller:8080/files/` — traefik resolves a forwardAuth answer's Location against the auth server. Fixed + (absolute), red-proved, rc.3. A background security review then flagged CSRF and revocation: `/__files/open` now refuses + a cross-site request and dot-segments; the revocation residual is R-1155. +- **Live proof (rc.3, 9201, headless Chrome through the public names mapped to the box):** signed in → calibre-web's + „Fájlok ↗" → FileBrowser at `NVME 1TB/media/books`, no login form, user `felhom-household` (admin false, modify true, + login method proxy); signed out → `files.` went to the dashboard login. Screenshots `browser/01-…`, `02-…`, + `03-…`. Forged headers (`forged-headers.txt`): through traefik with no cookie — the old public name, a random name and the + REAL secret name all 401; from the bookstack container straight to `filebrowser:80` — the old name and a random name 401; + control: the real name from the same container 200 (the protection is the name's secrecy). The brief named Nextcloud; + bookstack was used (an app on 9201's network with curl). + +## 3. Preview check (R-1153) — `audits/day-2026-10-19/P3/` + +On 9202 (controller 0.331.0): OnlyOffice installed, the link on (FileBrowser back in 4 s). The hand-made `teszt.docx` +(912 bytes) → 500 „fitz: cannot open document"; OnlyOffice's own `sample.docx` → **200, a 256×256 JPEG, 0.3 s**. Same with +the link OFF. FileBrowser 1.5.6 previews .docx with its own MuPDF before OnlyOffice (`preview.go` `determinePreviewType`). +**Closed: not a product defect.** OnlyOffice removed through the product (both volumes gone), test files deleted. + +## 4. Controller release 0.332.0 — `audits/day-2026-10-19/P4/` + +Image `0.332.0` from `601bdba` (digest `sha256:245266a4…`), 03:16 UTC. Per-box floors 03:16:43 → Tester 1 and demo-felhom +on 0.332.0 at 03:16:45–55, demo-hp (from rc.3) at 03:17. Box walk on all three: 0 unhealthy, 0 allow-list refusals, +FileBrowser re-published 6 s after its re-create, public pages 200; https-only 28 OK, 0 failures, both controls right. +„Fájlok ↗" with no login through the public internet on demo-hp and Tester 1 (pass → cookie → `felhom-household`; a fresh +browser 401; sign-out → back to the dashboard). demo-felhom: CC holds no dashboard password for the lived-in box, so its +check is the files (secret 0600, config and route carry it) and the refusals (forged secret name through traefik 401, old +name from outside 401, a forged pass 403). **Global floor 0.332.0 / MinAgent 0.158.1 at 03:24:18 UTC**, read back with the +WAL; per-box floors cleared (read back empty). MinAgent 0.158.1 ≤ the vouched agent 0.159.2. i18n fixtures changed (named): +`escrow_first`, `escrow_receremony`; all others byte-identical. No golden (decision 250); the floor is above golden 0.331.0 +until Sunday's bake. + +## 5. Hub 0.159.0 (R-1150, R-1154) — `audits/day-2026-10-19/P5/` + +- Written by a helper (`5121536f`, `b505ce4b`). **R-1154's rule, and why:** the helper's first draft re-issued the claim + code and the off-site provider password automatically when the old host was stale or switched off. A background + security review flagged it; the helper then read what the retrieval passphrase already grants (`/config` → the + controller API key; the enroll → the host key) and found the re-issues are the operator's session-only powers + (decision 252). So the passphrase must not reach them: **the reuse path re-issues nothing; when the old box looks gone it + mails the operator** („delete the old host and run the installer again, or re-issue …"), a live box gets an info record. + The operator's delete stays the gate. **R-1150:** `whole_guest_backup_refused` (operator-only, hub-origin; NOT in + `allowedEventTypes`, against the brief's wording — the suspected controller must not post or pre-empt it, R-895's + shape). Tests red-proved (helper's list in `hub/CHANGELOG.md`). +- **A push blocker on the way:** R-887's dated check was due today. Measured: 381 CI jobs since the S21 change, 0 lost (the + three re-runs' first attempts ran 47–49 s; control: the known lost attempt of 2026-10-10 ran 11 min 48 s and the attempt + count finds it). Closed. +- **Deploy:** image from a clean clone (the shared checkout held my uncommitted evidence), manifest `200ab653`, ArgoCD + synced the hub Deployment only (the only OutOfSync resource), Synced/Healthy, no ERROR, the floor read back, then fresh + reports from all three hosts (02:23–02:25 UTC) and all three controllers (02:29–02:31 UTC). + +## 6. The old-restic check — `audits/evening-2026-10-18/P8/old-restic-check.txt` + +The night watcher ran it: window 12 at 02:18 UTC removed 63 of demo-hp's 324 copies (→ 261); the old restic (0.14.0) and +the new (0.19.1) both list 261 and restore a 0.19.1-made copy and an August copy to identical content hashes. STATUS item +closed; `REPORT-evening-2026-10-18.md` §9 filled. + +## 7. Versions, commits, fixtures, rows + +- Agent **0.160.0** (released, not vouched) — `1b6e316`, `c11e3e2`, `124164d`, `4545819`. Controller **0.332.0** (floor) — + `ba4a6f0`, `9bdd8f8`, `601bdba`; rc.1–rc.3 on 9201 only. Hub **0.159.0** (deployed) — `5121536f`, `b505ce4b`, manifest + `200ab653`. felhom.eu `afc939bb` (R-887), `5622ce27`, this commit. Catalog: none. +- Fixtures: `escrow_first`, `escrow_receremony` (controller); no other page changed. +- **Register: 168 before, 166 after; closed 10** (R-887, R-978, R-973, R-1093, R-1149, R-1151, R-1100, R-1153, R-1150, + R-1154), **opened 8** (R-1155 … R-1162). +- `unproven.py --summary`: not walked 35 of 55 — unchanged. Capability map: not changed. System poster: text only — the + local whole-guest „Kept" cell („one copy per day, up to 3 days") edited in both the facts file and the drawing. + +## Observations + +1. FileBrowser's own 2-hour token can outlive the dashboard session if only the files cookie is lost. FILED: R-1155. +2. A reinstall within 45 min of the old box's last report reads „live" (no mail). FILED: R-1156. +3. Repeated cap refusals inside the 24 h hold raise no new alarm. FILED: R-1157. +4. The off-site leg of the clean-slate re-issue may be obsolete since hub v0.127.0. FILED: R-1158. +5. The retrieval passphrase yields the controller API key, which registers and confirms off-site keys. FILED: R-1159. +6. Hub and agent have no gofmt gate (~20 and 14 files drift). FILED: R-1160. +7. The escrow wizard calls the code „live" at the reveal; since R-1151 it is live only after the typed-back words. + FILED: R-1161. +8. R-973's off-site half (ep0 prunes by count) outlives the closed row. FILED: R-1162. +9. traefik resolves a forwardAuth answer's relative Location against the auth server. NOT-A-FINDING: found on rc.2 and + fixed before the release (red-proved); recorded as a rule in CONTEXT and memory. +10. The ceremony log line and two R-973 comments were stale. NOT-A-FINDING: fixed in agent `4545819` (the size rule). +11. My first OnlyOffice link call sent `{}` and switched the link off. NOT-A-FINDING: my call; the API wants + `{"enabled": true}`; it was already off, nothing restarted. +12. The R-1093 route refuses loop devices. NOT-A-FINDING: by design (only real disk names are allowed); a RAM disk was used. +13. CC holds no dashboard password for demo-felhom, so its „Fájlok ↗" was not walked as a household. NOT-A-FINDING: the + lived-in box's household password is not CC's (decision 254); its files and refusals were checked instead. +14. A helper's commits sat unpushed in the shared felhom.eu clone for ~40 minutes (blocked by R-887's due check). + NOT-A-FINDING: the gate did its job; pushed with my R-887 commit. +15. Two shell scripts of mine were refused by Claude Code's removal check (a cleanup `rm` it could not read behind + `bash -c`). NOT-A-FINDING: rewritten without the removal; nothing was deleted. + +## Teardown — three layers + +- **Machines:** 9202 — OnlyOffice removed through the product (volumes gone), test documents deleted; 9201 — on 0.332.0 + (the floor); the escrow test left demo-hp on code 1 (stored); demo-hp host — the RAM disk module removed, helper scripts + deleted, no file left in `/root` (an older helper, `/root/opens.sh`, removed by name at the end). Cookie jars and + password files on DooPlex shredded or emptied. One debugging sign-in on demo-hp's dashboard (curl, 03:03 UTC) was not + signed out; its cookie file is shredded, so the session expires unused. +- **Hub:** global floor 0.332.0 / 0.158.1, no per-box floor; hub 0.159.0; no vouch. +- **DooPlex:** builds (agent, controller rc.1–3 + 0.332.0, hub 0.159.0 from a clean clone) and the hub deploy; no Docker + cleanup. + +Architecture read: `01`, `02` „Logins and folders", `03` §8a, `04`, `05`, `07` §6/§6.1; the design note. Documents changed: +`02`, `03` §8a, `07` §6.1, the poster facts + drawing text, `05` §8 (helper). Instruction files: none changed. diff --git a/REPORT-evening-2026-10-18.md b/REPORT-evening-2026-10-18.md index ca52a206..3c4bc6dd 100644 --- a/REPORT-evening-2026-10-18.md +++ b/REPORT-evening-2026-10-18.md @@ -95,8 +95,12 @@ after it, round trip = bake sha, token checks 0 with a working control, teardown ## 9. The old-restic check (Part 8) -PENDING — filled in when demo-hp's clean-up window has run (after its 04:15 CEST night run). A watcher runs the check by -itself; at 20:57 UTC both restics listed 310 snapshots (`audits/evening-2026-10-18/P8-precheck.txt`). +**Done 2026-10-19 by the watcher** (filled in by the day session, `audits/evening-2026-10-18/P8/old-restic-check.txt`): +demo-hp's clean-up window 12 ran at 02:17:53–02:18:24 UTC after the night run — „63 of 193 planned snapshot(s) removed, +324 -> 261" (the hub's row: `pruned`, 324 → 261). Then `rx.sh` (read-only): the new restic (0.19.1) and the OLD one (image +0.322.0, restic 0.14.0) both list **261**; both restore `c0b6299c` (made by 0.19.1, 02:17:48) to the same content hash +`d808e6537c7bcdb6` (7 files) and `05c3346a` (2026-08-31) to `8df241f4cf889265` (10 files). The old restic still reads and +restores demo-hp's store after its first real 0.19.1 prune. (Pre-check at 20:57 UTC: 310 and 310.) ## 10. Versions, commits, fixtures, rows diff --git a/STATUS.md b/STATUS.md index 4a247f23..13ebefc4 100644 --- a/STATUS.md +++ b/STATUS.md @@ -2,7 +2,7 @@ **Ready for the first real tester (Tester-2): yes. Tester 2 (a laptop) is off; nothing was sent to it.** -**Updated 2026-10-18 (evening).** A brand-new box was installed from nothing on demo-hp (your test customer Tester4): the emergency password was saved in the hub first, then set, and the web login took it; the box came up on the approved golden and moved to the floor by itself in under 3 minutes; its agent was the approved one. OnlyOffice now opens AND saves documents from FileBrowser and from Nextcloud (before tonight: FileBrowser could not open one, and Nextcloud lost every save while saying „saved") — controller 0.331.0 is the floor for every box (22:48 local). Immich's and Nextcloud's Redis no longer have a disk volume. Three agent fixes are written and tested, NOT released (your yes). Golden 0.331.0 is baked, NOT vouched — `REPORT-evening-2026-10-18.md`. **Earlier:** **Updated 2026-10-18 (day).** Hub 0.158.0 is live (your yes): its own 90-day access log works and writes no secret (tested with a fake token); you can vouch an agent without a new golden; the off-site snapshot check gives its first verdict on 20 October. Controller 0.330.0 is the floor (13:10 local): if the host refuses „retire anyway", the drive's apps start again. Agent 0.159.2 runs on the three test hosts (your yes; no pool check on a good backup) — **vouch it**. Installer 1.34.0 is published (your yes): the emergency password is saved in the hub first, then set. The calculator shows Immich's bigger figure (your yes). A fresh reviewer read last night's code: one medium finding, already closed by today's installer change — `REPORT-day-2026-10-18.md`. **Earlier:** **Updated 2026-10-18 (night).** Controller 0.329.0 is the floor for every box (21:36 UTC, MinAgent 0.158.1), after the three test boxes: each app reaches only its own data folder on the drive; homepage no longer controls Docker, so no app has a special right; when the host refuses to retire a drive, nothing changes and the household reads why; a virtual disk without a serial gets a plain sentence. Immich gets 3 GB (it was killed twice at 2 GB on a 4,000-photo import). Golden 0.329.0 is baked, NOT vouched. Hub 0.158.0 is built, NOT deployed — `REPORT-night-2026-10-18.md`. **Earlier:** **Updated 2026-10-17 (evening).** Controller 0.328.0 is the floor for every box (17:22 local): the box refuses a catalog change that asks for dangerous container rights (your D2 = A). Agent 0.159.1 (a gone, decommissioned drive is forgotten; an orphan thin snapshot is named in the backup failure; new Go) — runs on demo-hp, Tester 1 and demo-felhom; **your vouch in the hub is still open**. New emergency root passwords on demo-hp, Tester 1, demo-felhom (your D1 = A; read them in the hub). Hub 0.157.0 deployed on your yes — `REPORT-agent-allowlist-rotation-2026-10-17.md`. **Earlier:** **Updated 2026-10-17 (afternoon, later).** Controller 0.327.1 is the floor for every box since 12:06 UTC: FileBrowser is published only after its default password is checked (your D11 = A), and the install check uses real memory amounts with a clear message (your D10 = A) — `REPORT-filebrowser-memory-ci-2026-10-17.md`. **Earlier:** Controller 0.326.0 is the floor for every box since 09:55 UTC: FileBrowser's default password is checked at every FileBrowser start. Tester 1 is back on the live app list (test apps and drives removed); six memory limits raised — `REPORT-tester1-limits-filebrowser-2026-10-17.md`. **Earlier today:** controller 0.325.0 was the floor since 08:21 UTC (after the three test boxes): two more password doors count a try before checking it, family sign-ins are stored as fingerprints, a file-share rename always applies; five apps' Redis saves snapshots now, which a full disk cannot damage — `REPORT-burndown-3-2026-10-17.md`. **Earlier (2026-10-17 night):** controller 0.324.0 was the floor for every box since 02:46 UTC (all three test boxes made tonight's off-site backup on it first): a restore now brings the database password back with the data (your 1A), restic 0.19.1 (your 2A), dashboard hardening — `REPORT-night-2026-10-17.md`. **Earlier (2026-10-16 evening):** 0.323.0, Debian 13 — `REPORT-debian13-restic-2026-10-16.md`. **Earlier (midday):** Controller 0.319.0 (the app page in panels, the login in one panel) is the floor, MinAgent 0.158.1 — `REPORT-app-page-tuning-2026-10-16.md`. **Earlier (morning):** Storage identity build B shipped: agent 0.158.1 and golden 0.318.0 vouched by you, controller 0.318.0 is the floor (MinAgent 0.158.1), installer 1.33.0 published — new one-disk boxes get their own data area. Open items: see `documentation/backlog/OPEN-ITEMS.md`. Older notes, day by day: +**Updated 2026-10-19 (day).** One sign-in for the file manager is live on every box (your D16 = yes; controller 0.332.0 is the floor since 05:24 local): „Fájlok ↗" opens the app's folder with no second login; signing out on the dashboard asks again; no app on a box can pretend to be the household (tested from inside an app). Agent 0.160.0 runs on demo-hp, Tester 1 and demo-felhom (your yes): a new recovery code replaces the old one only after the household types two words back; a broken-into box cannot flood the whole-box backups, and the local copies are one per day for 3 days (your D17); an empty partition no longer asks „data will be erased". **Vouch agent 0.160.0** (morning list). Hub 0.159.0 is live (your yes): a refused backup has its own alarm; a reinstall over an old host now mails you instead of staying silent — a first draft that re-issued the codes by itself was stopped by a security review. The old backup program still reads demo-hp's off-site copies after the first real clean-up with the new one. The document-preview error was a broken test file, not the box — `REPORT-day-2026-10-19.md`. **Earlier:** **Updated 2026-10-18 (evening).** A brand-new box was installed from nothing on demo-hp (your test customer Tester4): the emergency password was saved in the hub first, then set, and the web login took it; the box came up on the approved golden and moved to the floor by itself in under 3 minutes; its agent was the approved one. OnlyOffice now opens AND saves documents from FileBrowser and from Nextcloud (before tonight: FileBrowser could not open one, and Nextcloud lost every save while saying „saved") — controller 0.331.0 is the floor for every box (22:48 local). Immich's and Nextcloud's Redis no longer have a disk volume. Three agent fixes are written and tested, NOT released (your yes). Golden 0.331.0 is baked, NOT vouched — `REPORT-evening-2026-10-18.md`. **Earlier:** **Updated 2026-10-18 (day).** Hub 0.158.0 is live (your yes): its own 90-day access log works and writes no secret (tested with a fake token); you can vouch an agent without a new golden; the off-site snapshot check gives its first verdict on 20 October. Controller 0.330.0 is the floor (13:10 local): if the host refuses „retire anyway", the drive's apps start again. Agent 0.159.2 runs on the three test hosts (your yes; no pool check on a good backup) — **vouch it**. Installer 1.34.0 is published (your yes): the emergency password is saved in the hub first, then set. The calculator shows Immich's bigger figure (your yes). A fresh reviewer read last night's code: one medium finding, already closed by today's installer change — `REPORT-day-2026-10-18.md`. **Earlier:** **Updated 2026-10-18 (night).** Controller 0.329.0 is the floor for every box (21:36 UTC, MinAgent 0.158.1), after the three test boxes: each app reaches only its own data folder on the drive; homepage no longer controls Docker, so no app has a special right; when the host refuses to retire a drive, nothing changes and the household reads why; a virtual disk without a serial gets a plain sentence. Immich gets 3 GB (it was killed twice at 2 GB on a 4,000-photo import). Golden 0.329.0 is baked, NOT vouched. Hub 0.158.0 is built, NOT deployed — `REPORT-night-2026-10-18.md`. **Earlier:** **Updated 2026-10-17 (evening).** Controller 0.328.0 is the floor for every box (17:22 local): the box refuses a catalog change that asks for dangerous container rights (your D2 = A). Agent 0.159.1 (a gone, decommissioned drive is forgotten; an orphan thin snapshot is named in the backup failure; new Go) — runs on demo-hp, Tester 1 and demo-felhom; **your vouch in the hub is still open**. New emergency root passwords on demo-hp, Tester 1, demo-felhom (your D1 = A; read them in the hub). Hub 0.157.0 deployed on your yes — `REPORT-agent-allowlist-rotation-2026-10-17.md`. **Earlier:** **Updated 2026-10-17 (afternoon, later).** Controller 0.327.1 is the floor for every box since 12:06 UTC: FileBrowser is published only after its default password is checked (your D11 = A), and the install check uses real memory amounts with a clear message (your D10 = A) — `REPORT-filebrowser-memory-ci-2026-10-17.md`. **Earlier:** Controller 0.326.0 is the floor for every box since 09:55 UTC: FileBrowser's default password is checked at every FileBrowser start. Tester 1 is back on the live app list (test apps and drives removed); six memory limits raised — `REPORT-tester1-limits-filebrowser-2026-10-17.md`. **Earlier today:** controller 0.325.0 was the floor since 08:21 UTC (after the three test boxes): two more password doors count a try before checking it, family sign-ins are stored as fingerprints, a file-share rename always applies; five apps' Redis saves snapshots now, which a full disk cannot damage — `REPORT-burndown-3-2026-10-17.md`. **Earlier (2026-10-17 night):** controller 0.324.0 was the floor for every box since 02:46 UTC (all three test boxes made tonight's off-site backup on it first): a restore now brings the database password back with the data (your 1A), restic 0.19.1 (your 2A), dashboard hardening — `REPORT-night-2026-10-17.md`. **Earlier (2026-10-16 evening):** 0.323.0, Debian 13 — `REPORT-debian13-restic-2026-10-16.md`. **Earlier (midday):** Controller 0.319.0 (the app page in panels, the login in one panel) is the floor, MinAgent 0.158.1 — `REPORT-app-page-tuning-2026-10-16.md`. **Earlier (morning):** Storage identity build B shipped: agent 0.158.1 and golden 0.318.0 vouched by you, controller 0.318.0 is the floor (MinAgent 0.158.1), installer 1.33.0 published — new one-disk boxes get their own data area. Open items: see `documentation/backlog/OPEN-ITEMS.md`. Older notes, day by day: `documentation/backlog/STATUS-HISTORY.md`. Reports: `REPORT-night-2026-10-14.md`, `REPORT-immich-rollout-2026-10-14.md`, `REPORT-seo-felho-tarhely-2026-10-14.md`, `REPORT-immich-repair-2026-10-14.md`, `REPORT-power-cut-fixes-2026-10-14.md`, `REPORT-night-power-2026-10-13.md`, `REPORT-poweroff.md`. ## What works @@ -41,7 +41,7 @@ ## What we work on - **CC's secrets** (R-1118): done 2026-10-17 — the store, `sec`, the guards in every CC session (option B: `bash -x` and `curl -v` allowed inside `sec run`), the nightly check (linger on). The old credentials file and its three copies are deleted. -- **After 2026-10-19 02:15 UTC** (demo-hp's next clean-up window, after its 04:15 CEST night run; the evening session left a watcher that runs the check by itself when the hub records the window closed — `scratchpad p8-watch.sh`; by hand: `rx.sh` + `xver-after-prune.sh` in guest 9201; both restics listed 310 snapshots at 20:57 UTC, `audits/evening-2026-10-18/P8-precheck.txt`): check that the old restic (image 0.322.0) still lists and restores demo-hp's store after its first real 0.19.1 prune (`audits/night-restore-2026-10-17/tools/rx.sh`). Everything else of R-1105/R-1107 is done. +- **Old restic after the first real 0.19.1 clean-up — DONE 2026-10-19:** demo-hp's window 12 ran at 02:18 UTC (324 → 261 copies, 63 removed as planned); the old restic (image 0.322.0, restic 0.14.0) then listed the same 261 and restored the newest copy (made by 0.19.1) and one from August with the same content hash as the new restic (`audits/evening-2026-10-18/P8/old-restic-check.txt`). R-1105/R-1107: nothing left. - The power-cut findings still open (R-1004, R-1005, R-1010, R-1013). R-1012 closed: agent 0.159.1 names an orphan thin snapshot in the backup failure. - Media apps on every drive (R-1023): live with the 0.313.0 floor — every drive in every media app, a new drive made ready by the box, a pulled drive loses nothing, a safe removal lets go first and the drive comes back by itself. @@ -64,16 +64,15 @@ | D11 | R-1126 | **DECIDED 2026-10-17: A** — FileBrowser is published only after its default password is checked; it never answers on the default (controller 0.327.1). The tunnel still runs before the claim, by design (`01` §5). | done | — | — | — | | D12 | R-1129 | **CLOSED 2026-10-17: not a defect** — CC misread the CI log; the failure mail always worked. A forced test mail went to admin@felhom.eu at 10:48:54 UTC (CC saw it arrive). Your key change did no harm. | done | — | — | — | | D9 | R-1062 | The N100's USB drive is also its whole-box backup drive. Split it in two anyway? | **No — keep one drive**; the lived-in box keeps its nightly whole-box backup | Split: the box loses its local whole-box backup (or add a second drive first) | it stays one drive; multi-drive tests stay on Tester 1 | — | -| D16 | R-1100 | One sign-in for the dashboard and the file manager: build it? (tested tonight: the router can pass the user safely, but any app on the box could fake it unless the header name is a per-box secret) | **Yes, with the two safeguards in the design note** (a files-only ticket + a secret header name), about one release | No: households keep signing in to the file manager once | nothing changes; the second sign-in stays | — | -| D17 | R-1149 | The box's local whole-box backups keep the last 3 copies; a broken-in box can replace all 3 in one day. Keep „last 3", or keep „one per day, 3 days"? | **One per day, 3 days** — same disk use, cannot be flooded in a day | Keep „last 3": flooding stays possible within one day (the new cap slows it) | it stays „last 3" | — | +| D16 | R-1100 | **DECIDED 2026-10-19: yes** — built with both safeguards and live on every box (controller 0.332.0): a one-time pass from the dashboard, and a header name only the box knows. | done | — | — | — | +| D17 | R-1149 | **DECIDED 2026-10-19: one per day, 3 days** — agent 0.160.0 on the three test hosts. | done | — | — | — | ## Waiting on you — do -- **Vouch golden 0.331.0** (Configuration → Day-0 artifacts): golden sha256 `3881de62b0986ccbe5e55580e3f1bb9765d65b8d898f67c6339bac105244f84f` (read back from the registry 2026-10-18), agent **0.159.2** unchanged (already vouched), **Min agent 0.158.1**. This is the Sunday golden (the floor 0.331.0 is above the vouched 0.329.0). If you do not: a new box installs 0.329.0 and updates itself to the floor in about 3 minutes (proven tonight). -- **Agent release with three fixes (R-978, R-973, R-1093) — may I?** Starting the recovery-code setup again no longer spoils the written-down code; a broken-into box program cannot run the whole-box backup again and again to push out old copies (3 a day, 1 off-site a week — numbers I chose, you may change them); an empty partition no longer asks „data will be erased". Tested, red-proved, in the agent's main branch. If you say yes: I release, prove on demo-hp, and ask you to vouch. If not: they wait. +- **Vouch agent 0.160.0** (Configuration → Day-0 artifacts; no new golden needed): version **0.160.0**, sha256 `7ebb547f2b1ab93544ba828d3040351b60c4126327a5b85bbcb33f8f2b3dfca1`, config bundle `6b06090190ff609af1fe9842447ebf385fd52da4be382bc7ca708b558c8e202f` (read back from the registry by the release script). It runs on demo-hp, Tester 1 and demo-felhom since 03:23–03:56 local. If you do nothing: a new box installs agent 0.159.2 and a signed update brings it later. - **Nézd meg a demo-hp-n a Calibre-Web „Adatok és mentés" fülét és a Fájlkezelőt** (`felhom.enkisfelhom.hu`, controller 0.321.0, minden dobozon kiadva). A mentés egy részben, egyszerű szavakkal; a Fájlkezelő nem kér frissítést és nem ajánl „Install app"-ot. - **Look at `roms/roms/` on the N100's drive in the file manager (R-1099).** RomM now scans `roms//`. A game uploaded through RomM before today sits one folder deeper: if there are platform folders in `roms/roms/`, move them up into `roms/` and press „Scan” in RomM. If not: those games show under a platform called „roms”. - **Nézd meg a Calibre-Web oldalát a demo-hp-n** (`felhom.enkisfelhom.hu`, controller 0.319.0, minden dobozon kiadva). A fejléc, a fülsor és minden rész most külön panel (az „A” stílus). A belépési adatok egy panelben vannak, egymás mellett. A Calibre-Web jelszaváról a doboz nem tud, mert az alkalmazás előbb települt, mint hogy a sablonban jelszó lett volna — ezt most egy mondat mondja ki. Ha nem tetszik, írd meg, mit változtassak. Ha nem nézed meg: semmi nem romlik el. -- **Discard two unclaimed boxes** (hub, browser only): the build B scratch VMs registered as unclaimed boxes — registration ids 40 (`b43afa10…`) and 41 (`9c78ea30…`); both VMs are destroyed. If not: two dead entries stay in the Hosts list. **Tester4 stays** (your word, 2026-10-18) as the fresh-install customer; **before its next install, delete its old host `Tester4-31fa0e`** (Hosts page) — otherwise the new install silently reuses the old host and skips two re-issues. +- **Discard two unclaimed boxes** (hub, browser only): the build B scratch VMs registered as unclaimed boxes — registration ids 40 (`b43afa10…`) and 41 (`9c78ea30…`); both VMs are destroyed. If not: two dead entries stay in the Hosts list. **Tester4 stays** (your word, 2026-10-18) as the fresh-install customer; **before its next install, delete its old host `Tester4-31fa0e`** (Hosts page) — otherwise the new install reuses the old host and skips two re-issues (since hub 0.159.0 you get a mail saying so; the codes are not re-issued by themselves, on purpose). - System poster needs a refresh: one-disk boxes now have a data area („Belső tárhely") on the system disk, outside the whole-guest backups (facts file updated 2026-10-16). - **Olvasd el a Plex és a Sonarr útmutatót a demo-hp-n** (az alkalmazás oldalán az „Útmutató” fül). Ha más formát szeretnél, egy menetben átírom mind a 62-t. A robot 2026-10-16-án bejelentkezve megnézte: mindkét oldal megjelenik magyarul és angolul, 4 rész és a GYIK, minden sor egyezik a katalógussal. Ha nem nézed meg: csak a forma marad emberi szemmel nem látott. - **Nézd meg az AdventureLog és a Plex oldalát a demo-hp-n, a rendes címén** (`felhom.enkisfelhom.hu`). A túl nagy keret javítva: a tartalom most 32 képpontra van a bal oszloptól és 36-ra a tetejétől (előtte 80 és 64 volt). Az alkalmazás oldala mostantól egy hasábban van: egy szélesség, vékony vonalak a szakaszok között, aláhúzott fül, és doboz csak ott, ahol az alkalmazás vár rád (kék) vagy ahol valami kockázatos (sárga). A „sikeres frissítés" sáv kis szürke sorrá vált a név alatt. Ha nem nézed meg: a felület él, csak senki nem látta még böngészőben. diff --git a/documentation/architecture/02-controller-module-map.md b/documentation/architecture/02-controller-module-map.md index 165acc50..8e578740 100644 --- a/documentation/architecture/02-controller-module-map.md +++ b/documentation/architecture/02-controller-module-map.md @@ -539,8 +539,28 @@ state (both demo boxes) the panel says „Ezt a jelszót te állítottad be a F the press. The box uses FileBrowser's own CLI (`set -u admin,`) with the server STOPPED (the CLI opens the database with no lock timeout), verifies new=200 and admin/admin refused, stores the value encrypted and records `generated`; a failed verify leaves `operator`. Not the `FILEBROWSER_ADMIN_PASSWORD` env: it re-applies on every -start. Spike: `audits/logins-folders-2026-10-16/P1b`. FileBrowser still asks for its own login the first time; one -sign-in for both is R-1100. +start. Spike: `audits/logins-folders-2026-10-16/P1b`. Since v0.332.0 the folder links open FileBrowser without its own +login (the next paragraph); `admin`'s password is the fallback and the operator's way in. + +**[DESIGN] One sign-in for the file manager (v0.332.0, R-1100, operator decision D16 = yes 2026-10-19; spike +`audits/proxyauth-spike-2026-10-18/DESIGN-NOTE.md`).** Every dashboard link to a FileBrowser folder goes to +`/__files/open?to=` on the dashboard host, which — for a signed-in, not-cross-site request — mints a pass (60 s, +one use, bound to `files.` and to the session) and sends the browser to `files./_felhom/sso`. traefik +asks the controller before every FileBrowser request (forwardAuth `felhom-files-sso` → `/__felhom_gate/files`, the setup +gate's handshake): the pass becomes the host-only `felhom_files` cookie (a value derived from the session's fingerprint +for that host — the R-976 shape); a valid cookie → 200 with the box's **secret header** naming FileBrowser user +`felhom-household`; no cookie → 200 without it (FileBrowser's own password); a stale cookie (sign-out, password change) +→ both cookies cleared, back to the dashboard. **Why a secret header name:** FileBrowser trusts the header blindly and +every app container reaches `filebrowser:80` directly — measured: a forged fixed-name header from an app logged in. The +name (`X-Felhom-User-<32 hex>`, per box, 0600 in the data dir) is written only into FileBrowser's config and traefik's +route (`authResponseHeaders`, which strips a client's copy); never a log, a page or a report. **Why not a parent-domain +cookie:** every app subdomain is third-party code and would receive the dashboard session. **What stays:** `admin` is a +password user (R-513's reveal and reset, the R-1126 gate unchanged); the header user is a separate FileBrowser user whose +rights come from the box's userDefaults (change, add, delete, share, download — not admin, not API); FileBrowser's logout +goes to the dashboard. Residual: FileBrowser's own 2-hour token for the header user is cleared with the files cookie, +but a browser that lost only the files cookie keeps it until it expires. Measured live on all three test boxes +(`audits/day-2026-10-19/P2/`, `P4/`): opened at the folder with no login; forged headers refused through traefik and +from an app container; a sign-out asks again. **[DESIGN] A stored FileBrowser password is checked before it is offered (v0.321.0, R-1101).** In `generated`, the page asks FileBrowser whether the stored value still logs in; only FileBrowser's own 401/403 counts as refused (a @@ -562,8 +582,9 @@ role, else the first declared folder, else (a media app) the first present drive `movies`, the players both, a download client its `media_library.folder`) with NO backup sentence — the bind's class there means „not this app's data", which is not the class-driven „temporary, not backed up". **A folder whose drive is not bound into FileBrowser now is text, never a link** (`drivePresent` = the same gates the FileBrowser sync -applies). The button never promises one click: FileBrowser's router brings a cold visitor back to the folder after its -login (measured in the headless browser, `audits/logins-folders-2026-10-16/browser/`). +applies). Since v0.332.0 the button opens the folder signed in (one sign-in, above); on a box without it, FileBrowser's +router brings a cold visitor back to the folder after its login (measured in the headless browser, +`audits/logins-folders-2026-10-16/browser/`). **[DESIGN] „Cím és kulcsok" is rows, not the install form.** The settings tab does not re-render the install wizard's fields: the address is the „Cím" row, the storage is a „Tárhely: " row, every diff --git a/documentation/architecture/03-host-agent.md b/documentation/architecture/03-host-agent.md index 18d91f83..517847f1 100644 --- a/documentation/architecture/03-host-agent.md +++ b/documentation/architecture/03-host-agent.md @@ -544,11 +544,18 @@ nicety. **loses Felhom's backup guarantees** — no PBS verify / monitoring on storage we can't reach. An honest signup-time tradeoff, not a hidden one. -**When the new package reaches the hub (R-978, agent `main` 2026-10-18, unreleased):** a ceremony started again no +**When the new package reaches the hub (R-978; agent 0.160.0, 2026-10-19):** a ceremony started again no longer replaces the hub's package when it starts. The package travels with the pending ceremony and is uploaded when its code is claimed, before the code is handed out (an upload failure is a 502 and the code stays claimable). An abandoned -ceremony — TTL, a new start, a restart — leaves the first code opening the hub's package. Residual: the typed-back check -is the browser's, so a code opened and not written down still replaces the package (R-1151). +ceremony — TTL, a new start, a restart — leaves the first code opening the hub's package. **[DESIGN] Only after the +household typed it back (R-1151; agent 0.160.0 + controller 0.332.0, 2026-10-19):** a controller ≥ 0.332.0 claims with +`{"defer_upload": true}`; the agent hands out the code with two word positions it drew, keeps the package (and only those +two words, never the code) for 30 minutes, and uploads it only when `POST /escrow/ceremony/confirm` brings the two words +back — so a code opened and not written down never replaces the package. Wrong words 422 (still waiting), window gone 410, +nothing waiting 404, hub failure 502 (still waiting). A controller that has not updated claims with `{}` and gets the +R-978 order. Proven on demo-hp 2026-10-19: ceremony 1 typed back → code 1 opens the hub's package, code 0 is a kept +earlier one (422); ceremony 2 shown and abandoned → code 1 still opens it, code 2 opens nothing +(`audits/day-2026-10-19/P1/escrow-*.txt`). #### Custody across generations — what the hub retains when a blob is superseded (hub v0.60.0; **contract corrected hub v0.93.0, R-198**) diff --git a/documentation/architecture/07-backup-architecture.md b/documentation/architecture/07-backup-architecture.md index 5da073a2..5fca8014 100644 --- a/documentation/architecture/07-backup-architecture.md +++ b/documentation/architecture/07-backup-architecture.md @@ -383,7 +383,7 @@ never moved by an update or an undo, and the unit restore accepts it. | **Tier-1** recovery unit | `/backups/primary//` on the app's own drive | compose + `.felhom.yml` + **secret-stripped** `app.yaml`, `db-dumps/*.sql`, `volume-dumps/*.tar`, `manifest.json` | nightly at W, plus a checksum-gated refresh on the periodic status pass | one point per app (`restore_points.go:14-18`) | no | | **Tier-2** cross-drive | `/backups/secondary//` | **always** a full mirror of the unit (`tier2.go:368-369`) **plus** `mandatory + optional` file legs, v2 layout `hdd/` + `userdata/` | nightly at W+60m | mirror (rsync) | no | | **Tier-3** restic offsite | Hetzner Storage Box over SFTP, one multi-path snapshot per app per run | the unit **plus** `mandatory` legs only; a separate `_shares` snapshot | nightly at W+105m | `--keep-daily 7 --keep-weekly 4 --keep-monthly 6` | **yes** (restic) | -| **Plane-2** whole-guest, local | `local:` → `/var/lib/vz/dump` on the host | rootfs + `mp0 /var/lib/felhom` (its `docker/` and `sys_drive/` folders, bound in the guest to `/var/lib/docker` and `/mnt/sys_drive` — §7.5.1; `mp1` no longer exists, corrected 2026-10-15) | **24 h** (`backup_cadence_seconds: 0`) | `local_backup_retention: 3` | **no** | +| **Plane-2** whole-guest, local | `local:` → `/var/lib/vz/dump` on the host | rootfs + `mp0 /var/lib/felhom` (its `docker/` and `sys_drive/` folders, bound in the guest to `/var/lib/docker` and `/mnt/sys_drive` — §7.5.1; `mp1` no longer exists, corrected 2026-10-15) | **24 h** (`backup_cadence_seconds: 0`) | `local_backup_retention: 3` → `--prune-backups keep-daily=3`: one copy per day, 3 days (keep-last until agent 0.160.0, R-1149) | **no** | | **Plane-2** whole-guest, offsite | `felhom-pbs:` → ep0 datastore `felhom-offsite`, per-customer namespace, over WireGuard | same contents | **7 days** (`604800`) | server-side prune on ep0, `keep-last 2` at `03:30` — **and the box asks for none** (R-191) | **yes** (per-customer key) | > **[FACT] Tier-3 has a fifth state the table above does not show: PAUSED (R-543, controller @@ -479,15 +479,20 @@ upload library is a mandatory class) or uploaded again by the household — its `pct config 9201`, both hosts). So the whole-guest tiers carry the guest and **none of the customer's data drives** — 916 GB on demo-felhom, 938 GB on demo-hp. -> **The whole-guest tiers are capped per guest (R-973, agent `main` 2026-10-18, unreleased) — *decided by CC unattended, -> operator may reverse*.** Because the tiers prune by COUNT, a compromised controller that runs `POST /backup` again and +> **The whole-guest tiers are capped per guest (R-973; agent 0.160.0, released 2026-10-19 on the operator's yes — the +> numbers were *decided by CC unattended, operator may reverse*, and the operator said yes to the release).** Because the tiers prune by COUNT, a compromised controller that runs `POST /backup` again and > again pushes out older restore points. The agent now refuses (429, logged, kept across a restart, a CRITICAL degraded > status for 24 h) a run beyond: the daily tier — **3 successful runs per rolling 24 h** (the night run, one „Mentés > most", the next night: a press never costs the night, R-899); the weekly off-site tier — **one per 6 days** > (max(cadence − 24 h, cadence / 2)). The question: how many runs may a guest make before the cap refuses? Options: no cap > (today, floodable); a per-tier count per rolling window (chosen: no ordinary day is refused); a time-bucketed prune > instead (the durable shape, but a retention change — R-1149 for the local tier, R-973's design line for ep0). Limits: -> keep-last 3 can still be replaced within one day (R-1149); ep0's keep-last 2 is a count. +> ep0's keep-last 2 is a count. **[DESIGN] The local tier keeps one copy per day (R-1149, operator decision D17, +> 2026-10-19; agent 0.160.0):** `keep-daily=3` instead of keep-last 3 — the same at most three archives, but extra runs on +> one day replace only that day's copy, so with the cap a day of flooding leaves the two earlier days' copies +> (`TestBackupCap_R1149_LocalFloodKeepsOlderDays`). Measured at the first new-rule prune on demo-hp (retention 1: the +> same single newest copy either way) and read before on Tester 1 and demo-felhom (one copy per day each: the same copy +> goes at their next night under either rule) — `audits/day-2026-10-19/P1/`. ### 6.1.1 A box that is not always on — the catch-up, the banner, the alarms (R-871..R-874) diff --git a/documentation/architecture/felhom-system-poster.facts.md b/documentation/architecture/felhom-system-poster.facts.md index 82c015eb..bb23f44f 100644 --- a/documentation/architecture/felhom-system-poster.facts.md +++ b/documentation/architecture/felhom-system-poster.facts.md @@ -87,7 +87,7 @@ Title: **"Where a household's data is copied"** | **Tier 1 — recovery unit** | each app: its settings, database dump, volumes | data drive 1, on the box | nightly at **02:30** (W) | 1 point per app | not encrypted (it never leaves the home) | | **Tier 2 — cross-drive** | a mirror of Tier 1, plus the app's files | data drive 2, on the box (counted only on a different physical disk; in a VM made, not counted) | nightly **03:30** | mirror | not encrypted | | **Tier 3 — off-site, per app** | Tier 1 + the app's must-keep files | **Hetzner Storage Box** (Germany), one folder per household | nightly **04:15** | 7 daily, 4 weekly, 6 monthly | the household's own restic password | -| **Whole guest — local** | the guest's system (not the data drives) | the box's own system disk | daily, in the window **04:30–08:30** | up to 3 copies (fewer on a small disk) | not encrypted | +| **Whole guest — local** | the guest's system (not the data drives) | the box's own system disk | daily, in the window **04:30–08:30** | one copy per day, up to 3 days (fewer on a small disk) | not encrypted | | **Whole guest — off-site** | the same | **ep0** (Hetzner, Germany), one namespace per household | weekly, same window | last 2 | the household's own key, escrowed with a recovery code | Footnote: "W = the household's backup window start, 02:30 by default. Tiers 1–3 follow at fixed offsets so they cannot run out of order. A missed night is caught up 15 minutes after the box starts." diff --git a/documentation/architecture/felhom-system-poster.html b/documentation/architecture/felhom-system-poster.html index 4e400aa8..0425c676 100644 --- a/documentation/architecture/felhom-system-poster.html +++ b/documentation/architecture/felhom-system-poster.html @@ -385,7 +385,7 @@ document.addEventListener('DOMContentLoaded', async function() { \ No newline at end of file diff --git a/documentation/audits/day-2026-10-19/P2/browser/01-app-page-files-button.png b/documentation/audits/day-2026-10-19/P2/browser/01-app-page-files-button.png new file mode 100644 index 0000000000000000000000000000000000000000..dd782270a47ad84b88bb0aeb68620a8ded6a4db5 GIT binary patch literal 101583 zcma&NWmsHG(=|+j1y67Z?h;&ryZhko?(PuW-QC^YAy{yC4-SI`cX;RA;hg9C{(b$c zXRhA8yQ{jZR;{WXDkmd~0E-O^1_p*8E+zy31A}x00|P(&^bz#W@#Y6CFtE>H;zIn2 zt{Ermkh-X%tI&VACkNKoL&!-W$XhVXru72>xo2nAHtVL6xd}6XjBVN;Zh?T7_Jg&J zR?C*J$-DOAv@t*5?$(oCT%1A8Mv!T8Vxk5YToeH20^uNeJaYo^&+9?W8lMdEZx2kD zB+)O(j68y*Vgy`TBZuy))^tHl$pjs}f| zSvi>k%^vo@k%u4QI90k@5jw}3YK-VHo%SA3KO($8IR(kpWt3k2-vx2yjjgZqkpx+<0>K|? zt6#1nJt`~|t_1;as#F;N^aT`Jx^OK!6}m=eP|myj)_Ojh9>OAv#*9*?CgjF2iG}bN z7Kq95zxb%5jwBhiMgT&GjY-o5YgMVTLM3p6`1;=^c=r7hvtyJ%Rh(F=J!L2zJ&W&0 zK>;XfwG@(VJ|6wpus$WbR>w8pf6f@FwHOdg=~4vx#f4$%!$=kapwZO_(G^jREUfT; zA5;Nc+~h(7;zWFFy7*PKR>jscvU_xgjNnrvhV?1k$Ruc0Ub5a#%}-n~-=L^c#RNqO zm_R9s(kN)tV0bYpLe@4NG2Zhb`tA^V9V9kU#NhEg+ZN3x%_=z`)Bwg)_tztb;n2l8 z*=)(ON|dRmIQsPjcV@{!cS&!2;cL2>#Rk0VabCG z>E_n4sg9Y6VGBqZu$%gwwJBGAX^Dcve*3aX>*DQ{JD*a9)*udPQb?~?CD-Czw%2Cx zgFj z0of>XEXKZ7O4g%L{9V_f+eB9^2c=^;JU8}=a31`}50dS~{>j0!SF#hSOb!j5nP~F} z==(*}vA!?FAJNCt|6C*=JD>AP7E_~+{elW=ZS@=k1Q*6tc_V!NdEArap@zU_9erTHoc&LR~Aw0U|u)e|1Aeo&@ zDQt_8|CYATI`O}y34UzgCo%j4X(^rHJ9*%B(Gxbgsj~&N6vaw!W%udHu!C;)**o45 zD2`F}&x!pOFaN$EFT{@sZ3W24rn=^BD5@H%Z;#_wlU%InLJ%c*C|GCs-FHvZ#Cg^v z^w`I#_U!M+V5*s5$`)m&3B$CLVe3%0-g(dB$~dynJeIjW4uLg?Ov{_Wat^Ue4WFCPy#sC06*VcaM++}muzI9GDm3N&fFDwSHZ>(nR?xQ_oo~6z z`hvtwpV)@0pYPvwuNzo|?=Ljg3y1o5;wcq^si_Jxu%Z2AGEJ?MO}Cp5l5k8wR<$)@wwCups$@wERw|09-QDu*n&+>mix2xZP8dJ+-l zvdDd7IlPp#P^ofOTB=3I`x+v+uPDv9Jt0I*-~*|t;oKs_@v&+nOGTTyvKB&pSCTLw zAQC#3**>%mbm|sQDRs>_7WqdWT9bM z0z9(2DbTZr9%@=YkXL(spEM$^nttb^zAhCI9Xiy`je?tx}FUKh}2NnR>{d?p} z=lVp#2B`34&CJX63H;{ZmN+>yRMqg=Yuev_5H2cI%Xdx=IFM8R)m^?oj&IyBMPOU{ zk2DExc*C#h<9Y5<_7b<37bmE)PX`q`!?S%}M* zHYV()G_QZA{BFtpG9lw!;J%x$NVR7V`9M-+IG8QL#-#Rm<*<;K^ zafp@wOO|Ep>h7gk&8KOJun(nLv%~)Ny1(?UPSr9{V8fV|(_=6=+udw6h<8>YUd(cP zx>#GEUX8Jogqzgtsi?cb!TWi<+GIQ0&HX7&L)BPYc6fXw1cy_cFkYM_?xx(w+OncJ zEf0r-R4R+d@FjoE3@LaknL9i4eYsL+WNT$;ZCFDjt&BVwD{(nVq9O zEfFo5tD&f%LV_HMZ~JR- zlomGUY3n(UkNa8)Cdc$z#@k3eTs4Vt$K}aK9191$=vCv?D%#ulUx*1}1*yveK2}_R z&Xe*32heVu;F%oQqk~obFJc$&hiXxL9&WD?9YlnY9xcWv1#)vr2#bHg>B)-?%0rAaq6}>`?;D3!MHRr! zM;6cfGIDp!`ZY$v=yY#*jJEBq=T67n{dIJ5L$(+m3v-3;CvkNSb2VS*$e#V9C`3am z9gJWAl!wpd1o0#yBqdE!l z%xKpK{#|tHAtkmU6x!_QFx(lADP1$G`t4P2OQy3mi^p@`JK4fCn`B z>9a)P_O{y1C?aw#1q&rV33_Y}*!(qA|6%CeA)PM-WfIThweR|B*rmhjSd#NMd9wJR z0AVfJc9A?B#~*zY8w>;#Cw+_Ag_G15Bam#e)nD=l->wGfPBZ^n%eB3;Dn4)+Y6{c@ z0T~|n){I<0^V*!?H}j7OvAM5`NMe%|s*g*>7}W(#96&ue6*|}B{CN|)qSwb$xP9Yi z=c^0 zw3vt%Vf_n%e1k>)K+fp?|{u_z0PvmIf2}Q5p(8ymLEMMOCUPTIWa6s=!Ii zmp)P17zvVH>&DvJ$?=I9TAk7&Q=TNLvKY4RaKhM-WtyZ{WMev2WyKhu{r=e7y4V@z z>SyQY1gzNunlUNa?e*-nUTrzioU1OuDOw59Vzc=MKtxGcmwiq8jNuD8c z5}?rf*rNHaF}csri^AZ^WOQqBQ%gw^&_jR14V5U-Xt8-@Hyhsle8_-;LaSgwhd7wi zL!2VDAHV<}b^c<#c70%e3}pXGieey$E$(G?I%31?_1wz#{L$~|?#qgh`tL1yhP^`4 zf_0hVPuSQ{@Oa+aL*CMOQ2utnrQEsQ026I5HWo@kYU1&U9J+JkezUs?pWj)n1=Gpa)md zfVVP#q2G`8jm%9jQbH(x;{2u{QndP`3Aoe7yKmpdq@=zpDk$jCBsrhvzZgSM9xSW) zc#b=rfR_*EQ%w<)jrQ)if|)UE0#Ku`sagrC+up zr*iRD&kZd1^lGjHI6Pigg5NX-nYNs7ZK(=p#vFqNFCa7ZAh5dQN=?hE(Leq;%j#|B;Z6O835KZS_Vo=L8z{C09D3CeQ8cf1|t=@Xu2S0*9@Kdg&W30z{!*e!~>T! zWy0Ym7q%dZ{Ve}CoTTs1WEb(Ti50?9O`{O}QN3Erz4`nwdVDI3b?vI#)9@mp3Q5&R?VjS5=_neDSv*ma*YZ#v=p!D?N8v?NuG<2 z4(s{GbkO$cM~I&-q%NT zlUheB{{ixGN z5g)uniM-PP%Y?Mtc}jHy&%y<+baz?A=42A@AbTzuf$T;FE2MTFz;lLo}Vo_!~sc=TU}j`=4^P}00*RBS^ zMGycLQU$qD+Aiy)mS6=fzI8iLzQczk+{M9yd5^O@`T>0v`GLDcVRY>uSin7 z&xnBYMnM0wew+fF!BTALcAXpnMw=qBY)aQ={L9WHiFD=@aAQ2Xc6nUKlt1%&S#VFo z!3en0tQb+)P!oTPLv(Xwlji#Kg0Sn;w3X%A_yp(_$WX z!!T)g(RTZ74p^8hcZr#YboeEW#rwy9a#3rN<`dG5*GphvdK2zu+f{(E=uC&s&CBSD zFlq7rn8qWm5g78oA4eBU8w1&34Vx)8;}Z+!V?(d`qC(T(&X!*J zQGWGvER}N#EiJ1`XVQP?VC0((nw+5iMp+&=ymvh~KG3D}Be=PksjnuPLafNI*Libs zXyhA%YlTQqbTSir!)*FFc-dOgG>E(mX@NA&5>`i zlhaxO)Yle=eUI#Q;a$X{p#t*?MSU|n8wuM>(uzt*cI_W(QB;uQ>ksD}BA$uKX<;Dr z>oipsU3c&I#xjW9QH15$?lk3UmuSl3s|xqMuDiR{i+x^Zi%?ABN~$C%&}5ck-n7CJ z^d0v(_iP~r_o-VmLq^|C>!IBNJXGn{)P!94$~{>}&1V}6YKJnMU3+1<9P&<@_+bPu z4?q5wI^$wM;WIFwTuQ3Nal6{*`aRJ>n48gT`6bMUhaV9!(?SQKkYkCjxEo%b51 z0$MK{^Nn;!KOy*N6z44yJ_B2C=^{nE5P#4?JERdz1=UUza&@MotkhzeNih zcsc2Fo1C~Px1J+MK^BRRi83DzBta8)^Z0Jj#`GEd5&EUcnQdO&t#QVvJuEt@l)|`p z^Y=gN1*EMq9f!S#xIfNX1+_DE%M9Rw6yOhP>I-%`xm8^k#hXn!(h~)3{DlCRfjC+a zaxEZy-cO~;?|pIQic+M?hey{T@p#ka4~-CJXk+p-M1fM+KO7YKmvL=7MZ|)S8(5Iy z6HiQD9NN1?blJN69)Z)rl`%ekf6bU}vwghROAjABn<$153g0gRZC1RrtQO0G*~S~b zPOrOdkemvn@Rz5j2rT6Omj$wNk;vgMAHek?E3GT*>eEtW6LJ28c>TJUez56kRtpLj z&~Dat>Q!FuM}E9!o)_!VyQn~$kZYWxLUU3lrz@=F*V)BQx~XGwUKBZ;v7&`bz8eU~ zRgi(ut)pNqXSa{hQS|;j1lf0&NR6tjYz*vzk*+4FNs+>#b||gb;rXJq57a-mz51F_ zR78enjY##LwFfTSL!Jk@u#hS95W8;o&L^QJ&R$$7Hdx*SE3Y>9z|`u=|*ud zj@rI*dvtF7VlX^JmD0Z330#44j|hHysj)i^dVvhwQ;fEAZfLAyo)rg~MfqstWf?Gj zqn!dww`!{IZG{^m1pqs0`+wDE-7feM0V29ME+kC@*p8I7>hb5qYgQCEOouM1#0KR| zL17I;9U`>-{E@*3tgc;g<|qnjH-)fgqjJ_D-+$$#D2I_j2{Ef6A}n8Oyfmu^b*_f$ z>i;Hp_=rG*KENa&Hb5hyP_wl|_lC#%y?1!JXnbrzdB5BHPG8VJ1_)IMz*?IO*G?MV zh4oJ>3|-@Nh8q6|}q4Sxwi0-C{LM4ulf zUvHbssH?ZrN{B=$@$pG(AJAmB@w9ZT$@gb5B5}Hjv_#Y(RKZN?UhhJJ4;oqF z$Kp}M;`&kN1U&lepBBa_xin}-@h{IBu@wc&{P`=bQLlmo$+!Y<*TpMUBH-p;kZFAU z!LE;J_~5>@eDkgDr4mWy>VeFzuXivq;^M*?q-J7#4m`b(M<{+JCodnmT-(kk zNchkeQgiydu4x^g=YZRYxYT7~4VPc%8!r3m?o|?n_6n11W;^@(i*!HZZF(C)aZ59O zV*`C-eQk^c8f>8et%?{)-Q4j5WT26e5eo=NDzP94lP2EW_*D%+9DWuQQ|0U59gft_ zz1UMsjNoUmIkL>JDAO`94IQQ$!^C{+fYG8UEGpaC!>=KKOQZk!1B_aSXf$K?qA@k1wBoeM6#`11>YVnvs8-cA{zfzOcG+-;97>X?Q8$l$KVWj84!MlCccqdPYx-7Xk=;w2C3mtn#qOXxCU0a^hhN#ba*sc~g! zVk3}Y=AmWU!xgdeXvj@+BuaJ5AK6J`%EJQ7V8v&dG2!>W;kof+l(qqetHut{NiOVZ zYs@86B-ovT1>W7l?<6z2Dcj<4j%n=h@tPV%i9(6c5X$7{h6iCHaXoqV@Bu}7D#fp~ z{-AV{D^QL4``55>g;ESxPo}QK#K6Eptj#&a65SBWB-H^_08MOIrLIFdvxg)ytL{fI-0TQd86pj7IA?7g0gcaHBbCFsuyus6G3 zq(G@KMHUxZIf?{SjRBC0E#V_)NTG5Pg}9N8)ugOINeoM%Y6|Gtqg?*#B<0&@Xq)~> zNv}pl7SHcp=3*Gu&xq`jV~yp$4O`PA=lKs-gladI)Gy#2QY}0HmD^x4RbB) z)Yhg{z2TlO>6JLp1xcW_?4TBxQ|1hJ5`(VhtbWt2rfbw?5t%p zJb!5KSi>`$f-sF(+A-{%o$z9k zTO(%Z%THInnIp$gNaXZA$IKnB4H{y8jodE^u4G6AN>JDZU<%~sk1m^HuJDr>HXVlP z{1QLhXomq*Q`s0fY(Pn0C?f@r4DVRqXWnpOCwxkU+?*w# z9`+%bkHdwus9c=u$3nnboj9@eW=FCvg@y{Ro)CK~ZOOu<&=X{yL zj$tJf#e`ebDHOmTiOaBEnVj_C-kz40=GknIl34{{I7{aMwvr#rmREOoU%Jacy<;da zsAF(nsKU61sk~(l`Jk0Hkyx?0#mTCTVN3&kA zZnKIQ((&qyoN0c3Sr~$)^vvC?t(q^|(4EOLjBGkQrL6qt#cL=h}N^@(I@y{6xEc{ z6XL{qhRrCgCMv`kp&y}K+gcwV+=T)m=h!|~6&jiBp&J>SB&#H@J30nZQ4lPxjWrw{ zmc`Z8&4g`(ZT=YE2@1TvDy^vMb|n4A#2Fl*co+iKirC}pEvVnO{B_|b;&~RMicC|I zktB#{e?^jJEkPNPO2ecz60W^0L|$RUvV^sCd~4XIjf^pD^AJrkwWPcNK-F4!gx>p{ zWUtyJP%Q?PT)aV*d?5iCBQ5-wJfQAmoBFAD#p7{)ky7Hl;?F{x#b!6X24hG_Na--) zUv2sk!I|}TmMqH6ct8^r9f1-ULS9* z9#%$1G~+3fskJ?igHJtf!}|qJSM1rz@`I6H?oS8Tv~Ww(wL0QnfgZe|{mfkp$;sL< zSY0zw@5dO`s&Y7OgunFpgTf@n>`9A>i=Pb%4QtK3ucWVQsd}~kJYILhd_G9hzRRto zlU=v-%aRz^{n)4yK|eXJ*ZNQyxgT!+WVP8oKQYcb`SOrK zS*aCysNR`gOTIU64>q5hpB-xIxER*JR@+&|`MQ(iy(YU;QP2>-abvHmVJ3!H`4ugE zRjG-1B)V6Jz17Nmc!<)US&=#$Ox_*Nkjy6hu#R?)_gg-64MJFH0T6E8*Vo%%**UTs zZUUSmIaMjmqs8Z3Te`<$js9OtdJIBbH>g3gTTz`8TtpOOTl(1mf4;AI$_k`HzLhsM zcHu>U12&GvM)c=TLL`Bnb#>u~U?1Xpve+Ch=RyUU-TL*1_X3Vp;u%>eY0!@oO)vr> zpv(a9N7H})%pBoaM-5Z5KOyN1QMVke2j6LXEiJ5^iEx+pFo0{j8Rr^Xn7eP}<|jvG zOHh=TdrSWcjYMm%)UBEro&|1PoS_+ zhi+0bRLO98c;lfwI&0ws#K+I1!kuB%ye8j)&^yU`&&FfpK@#_CFSJBi zB&_AS+q3_q4_XKWc>dGd^S!ER3MtC9Q0Awp9`-89>Y+(l13_iF1k5Cwu_^l@$)=Vy!CVn|do_55q z8yZR(mBP3Y$? z;AZCTt}bqG&1qSyb56EQc*JES6Gw!c5E@PBv|CJGCDT-xK&1`h#$|~aYuk4`8fu!_ zLeA`-+jE8Gi!AA4zI5F$TELs@pkI#$#gkt-oW<)YnTJG|jdOa|#J7N(b=n#O(!2u( zu&S0}g9&zwlL{<*-%_>wl};VQ|Lzy;(68%-CY^cf3DVW9_-kl4O}spy^pO~Km{wC} z-jZngg9FnQ4yXAf$Mmf$Lh%Hd(Y~>Ta=Cd~okRGM5o@}UjfuE3$?|%m@#dP#A1QIQ zT4yhNID0xxnd0PAOB(5iB1LNQNm8_=gsD-+)a#RhB#f_BCg=s)lR3$$@OuxVi_GbB z@rq?Dm^^UT|Pbo?{x3y8ZUD zyv36=TynTHO3&||&YyL3CGq*^Z0t^%cePY>>Z@9!u_F{|<^k3)oBhW1 z>|LppBq;=Yn2KF7N8ZKGu>e|30cl2DR(U4lRn`~isLaoj5G#{UN+U&tXqXAg&-@-> zVwEp9UHCcX^G)OofgOH;abUx6pU>NIcgC}n^zihTE%3*?d=={QV;pSkRVrn++)nA! z`KSPyp@*3dh)pF)gyB zDpihm7PM2tqRI(;(WZn-_C|Vks2KlNGajmfbQklp=VBHEgvvBC(}M|HK>CpkN7{Tn zY+iYU!b`U5-BDB1_`b9PaqoV%?sI0{$ zrbPr)UQ^fOKy%mT&H3Bmy!R_!d6!3dO^M&&4g|D&EbP<~h}qD2xlSe0$! zU=~~6-%g=SD31nk$N7bdt5Lypr6iJ2Aj?n??J&C~^5`LF*A$Vm4_Lm=V7VPh2bO>% zSh5aG$i^b23Dl-F)h%s5Wffza&tZ*K&TEks=!b2ZL%<$Fk;R*t9gHwq?;a(|4H?}i zkxCT$eFXc#BV%T~>Uu6p<-iFWQJy=aKd3SGtBjS6^#$Q~ul{BvxbCpgOb`(8jP}8H z@c7CXG!KX8_U>%8=hf>mlA1>9Y-oX(wS|G1g@c1~<=tmRw$7}a813a-i(X`ofz{bm&xWg*lELHiY8r}(#eM{9j-s=tFQ;?T&CWoU)J{4h zD_L@iHSk^ITN*pkVC1W6TvTyVpelH>i^9=ZdbeHW<-@#M-KZ#9?T$v1I%^B2VZ4Tbd-|1%ul{)dWA-TYMv*_xxN?5LE9DFSk-7eVWD5xCi6q+$D!R3mF>Kj3n<;Jdu%OC6&n zMJSR3a+F;_qT;N)6b@_)#v7WE7V4l>5sj4+nKA0aA1N``8&M+tITfb*cue(LI7CU~ ztOkvoxY0gQIgo9}V%cRBk!C+wlbJ1R;LxK{T4&BH$jLQY5<7%KPoKrehYtV{n$(Vi zpic`p!N`=s^)-r~LyL<^f-eENw~O;0Sj#H?S5QTDXNp8AEG&FeZ9{>|@i9&u6JW(N z&=(L4ML`WG3C+m~&AA$*i=Qh8P|%=54W*_kw*UgE%BeBo(X@=ae-LO;Q@dA-_|h}5 zqz)@aM`Plln%fzKjidzy&0Q;wqasTLQc-cu%oVsv^@o*}jjc(Ys^BP6jjYX$3=A(1 z4AZt`vxR;#+(V5O#6ZQMOh7($r%EjQlT(ufKEGJ3C2K^FWi=;FAtfbVbj-*4@B|T~ zkk1xMGD97zl0p*{VMNw+t3NV8b`waGsCbt)lnR>_7-vxQ`;XFB9zinwkwW;^ly7Bv z^7hK*eDRt+$Qo_bt>_XSY{o`}p_(ZnqeG>kQW==i24->QHH9}^N;Z~+=^E=SWhB9jP@EXqzaG`gY>1LqR2M;Z**d=s4TtiOL7DoXDOKhbswMr6$-IA-T=?dC z(;F-Y-wgk#V5&Q@lY4541sIB!R+O4Ut~QlrbE*8b(<~0|1{F!FEHfsgHoAoIkPpf@ z|7dJ>nH*GpI{Ht|x~&OcPOd27)D#&g^?XKh3W@#rjEP_cV7pZNHro7nC>7>pk$wo3 zWl&5joE`oiH}l!pnm}QLJ`LlU zZj^2zklbZWrU3?RUq9u5YI*dDa={KlD&a zWEda!(!P6Nv*~!2sErSeWqr58gKUmYPp5uCQ&Cj@UpaB6@9PDaEhoa)skiQNpQb3r zDOH+<1o53$?e>|$(fE(wiYGD_X$F4@9a%Ou)xpBRPE{aAMJ^2g+_Cfb|9G@#L3spX zV&_g--L}7<&V%`E#^A7=bX^#T&SZCa6R$In|HD_fuwI*j3fkG(SH@Er^wx%YwDGE{ zCJ>if1KHh#DUa037j39%PZyp({X)i>^%=L>ys(kl&r_tL(~%yV7&fR~?%K$DA?`bJ zRKYmdRPpvYe>UpO=$FWBcQO?hdAer;S)u$dMv>m~le?d95Aap0iXMwN_k}y2;n8)oaz)n#N_4|}+~T!m#TIGp_!-jn;)^F0npfw_rB-Rc zrX26rIoz!%_Aj6Xx9kv3f!T^;VWPYaYfJ_}x=azcJsd%Mb#iC99uWg?-HsjxwKCG7 ziPzc;?j)-_i`!b4eJ(ENTf^~I8eUy|cyE42=JxRKQg%*+fN5u)ec8(OeeF`3XHh|p zLqU#5_|BLZpDfFRYYYbi8-Y8u*|Skq(C|EySZ;QdihHJSWrX(Si@K_6LS}q%rnR0P zkMXXptgOqW90xJe@l0ZYHKM(EMz?Dq2se!~dLHI@K}VUg9y#g}Ku6-Rx?VM9rX?Jf z>~9be)qa27#mbCpS6-#nq>UU#5t)U%xk2czRC~L0kd>46cY*&pm7PI0kI)wc?|Bf3 zfiTJIx%8XQ2j7FUJ#1v;7;AZ@x};$+VG^Io9ikORd~Z^#BLh_UvAnwvWTdiA39mPh zv3{N2DK4`xU!gAO<7`zRpINqv$>=?l@9XSXYqgYFxf#nJl#LTZ|A+XRQUZN&vPKB1 z7lf0gaXYIWSn=AwN#XW-Zqf=y!sV4*N0gC?sz1*Zp(8IY=)C*|UDm{bF*ncR`F3?K zi81-~5`E)wi@UJF>@BtCAj?~H6~RW#^i==m<+FP)E>TUc%(diBFJ`r+*Ha*m;dMm~ zLq3_|bLT(VNc<_yex};w<#{#DB-^!rRpVv4IUep{lE{kpbO!M& z&+7zqc5-5(f|e84>sY-kj{x1^uj@q!?2}W=qbYcP^`~o6Y|K?16w}`qEhOfGbUGcb z!UrQRxlK^oRktyRV^f6SM|*;zvX-m02Zbj1Cd}i5oL<2G1>YcqV{g(ApXzKMPXdKU z@fJ6(2a3-p(ijrW!$>1DnU7P+@!a-@gBzJ*&ck0vqO!kNrUnLxSPvEB>44((qRfV%1~WExpT6MvupKX{ zA&LbA;;>n7zO80!0A}hOSzpfmF&c2hnrBkv`@{_cv^Q$Z+OtyOoX<9REnfXWgsoe> z$?NkAMx{p_^!?N8?Ujmy$#_niuV&wkPep_^%b%Va;MoI5Lt(g4Ev)$-QnQ)p%R)$ds8o z+o3m{0+T+zt59a@vS>W*-J7vHj~KRec9?tmnQKtMkdcxgP#uMfBD#)j)BW0efZtt- zVnoo3vZQg+9pC!`ggu4 z^~pT=m>!b~)t;C8qMOlKwa?QB8;cXaw|D8?)@*^!A)nwDXqvOq&u@@NguGccQiKA5ACfuJz5>5(&&S|w7j%l$UjbORHQqe^9dpD8D%hfp(0L!jJ)c| zb~=+2B`3LtL65ZyS@k+18~1JEEj+nztLtU!fUffbFWMw8b7J3CpqI$<E-vv-LY+2)zu@&ul*d(F_1DURnIg^s*_AOsYS zF_znm$7R2r^@RR<`PA0UW=V*)(68*-$!#K&F6A`8e1&lYIYSnKv+#^4=J>Wh0ck>~ zNkv07F>ZwyslOJv@qytby`48EhtFODyK`-P#rf9WEap#e5nDgV;2z$6e_id=xe^$h zqeLmGdb}Of@$xqq7LC8$Yv!G$Oj|^Fe(}_Hb%*Sf+WrV~m)37R21ArWNO(`cbbNF5 z_3F<1hV*jDV?oWXwC@zwGYP48NKxs}zuMVul$U(|n9lv2HdGjkxd457BNAT)!;I-o zj$==h`2t1UE13Mv46*u?a9*;uM|1`w`$Y+V{%|G@ayaFWTNoV#8rPM{h20`vV(xFt z^K?*}K5NNsq<$wYWo%EK?3y}H51}7ejlcdPZkH?v3OO6Y`1*_Rlv+U{lSV z*K;#qo9XT+)te0-Cu6~k^{aR%wwtlDE9F~+ALdSVd#${mX+M7|l_81_N#?nPH~SL1 zFQ-4lBF$kY9UDZ{d2)IR!nvjO7+LPGPBRk4D#HdF(D-g-#7ybhq_V#&D`=dYANHRT zS6$BLWz=lnXxwx2>VSbN8w=jtyEiU8WLA>yZqF_9iYmC@9i{5Ot}@R;m^DASvTPy^ zMr9N6(rJt5s6ewsT7Uo^aj(Ep0-XA}v}19TR*NQf{dv3S)vo7TZvM4^x3`|X#MLt~ z%CCrBTX);@^Hpot`Ne zJD(@JHR!avBkFs2yzA=8DPhJ`VH69zK(J6`L=%F;pC6^cu~dJarf)Jm9sHaCsq9D z<&`}UXijP1akVacNI%$)|2DZk8~zc@6b{NC;;=8T_lf&v=;LX^H%=t(w|xwE=V>g2 zp0Nbkb;L$CcZQ{v6@Zq&O6|Y^sXz3u81fl!9&MhDEajvmF52LY5o71$==H?z%6TlJ zSmtMC5V%7!#azQw$bUgvOil=ODQgmGxcc9ew(ZeYMnr+y%0f*YnZTVZmUVzpU)*bRf` z=3XyVjt`otT0cY<7#*j^{ERD%PE}s!w4X9GPG{@vOafQLw!xf>bu4ps!iG7kC|h>a ze}~Ui7N4yN8;6HJbHgC?JBnNZQ1ACmSxBS0qr!Tm3&(_aOz@7EqQHxX<>%U9TD&6d zvRkKoh3RW>uW!Lq`qPT-1X^gFh0)7N%jzu7ID3R$moX(;oE~1$ho+1Mi6b5H8;LON zQ=<`M0JK9|{!EhQJ|_O`3AUPZAzuZ6ItdyJ3k@384 z2S2)8+&C|4ulwwxI&m5r@6EuG%s+ zAMpvA*0`rYwXJ@%dlk6SU=o$hAett%A6V1W;^JOo#u78-WAYPRG%ufC9xdEDIL7rh zXoxyaRRj4_Ggh-`3wpQSr7SpR(?<+L<0dZ@?a7f`a0F0r%#n^N-JoE|*lHYaZQR=7 zv?bE8APYPQlqY(tS6fFjjd}#xbM0P_;}h_Spuvoa6!$d6Xc%3;R4p zf%@u&e?1e}%Fk-pC{nRoi+LVhr&HU0y-4k33FTy8s*;1t)+zD0LeGi(8lsWDNMT_x zk-x^FW*m8)%Fjx&{o8zc^-UcQ1U4en90CMBgb(c7x2C^o`P|GvK3auza=MU^H$9`Q z(@{81_zie^JBXE}(96RA%LU|id9UM_AN~x0f)S)~`!jtqc6_|>ys*DjRjiG}q0h|z zHF=fz4F>85C%ASd*kQT0_anbgWipu<+(D@d&yj6)Xub`$y3Ik?&fF;on?sIYKC?eU zHIv7F(nwDaDkh3aO<^h@UM zXx{m9jNRQ=2x~~eZX66DZ37k*#t$#1;rm2lu?WO(xr;R2-UqIiTA9!#2i=Asfg)S) zhb^D9$#$Erf@Nm+xj%Se6s7AWp1~%1j?KSitfj9I7_B!$`*44(vA~ix+G;SsU{qvo zT^_(Ei59(WXRDK63ZKNzV@~Qmi zMfq5;OJdvlT10g+#m>UM=xdrstq>PmfA3=2)##r3rR-4OOZtI`8mhH8_FK9F4s*NI zQ}bb|7x3V=?{%m+A6_Vc_(NDVG|a71*RKRCeU}p7!#Qf&wVc4_lKEb zmvwe1D|k}DJ}qu8qM?<`{ux)vo|Q@i z)pie8uDXB%U)2rfW&Z7foqbE<=X!Kpv|L=++`zzwu>^Tl%^5wyM6|?xW1!g7mca!Q z?=6?nkH~Zv5SLO;E_m6fn3;fbVNw9VYA!8)0TDrmAK->}u8GyF2{S+?7K{Siw0$|g z3}3bg9k)TuN1K{PB&|*rOi-k(-pGM$>UZnosP*fzqI$5qUr&(OX|=rYqS&|B&k0st zXaW$AY|)k~08I(3M7#6d32*=1{_%8~)=m_pKi$HDkNlfXjZ&A7(_z)W$~R%!d@Ssg zrAIZt-9e;WEyE)R-Pf5>=gP_3WqJBane`fbx|acMs~#bPl~j(4?$bAM<`@Z&yBC2w zaC3B&6|L%``Y7J48UF0OR|ERUI@k+Rer!AJn903fROaG6uw~UIT zZMy|YNWw#~Ai>?;-7R?IuEE{Ckq#kP2=4A~!5xCTOK^fiva-zPZQ6YaNncN;fBcbtnT$c6-d>O9yMa3 zNhSvdx3iR`_M24Bo`lW$^B=)B=+l6#~Qfl(pF|Osd+tpN?OPAlj zr<4^4gn0MTaTpoxj4JPvy*xZ4(zqM5+Ok@y{p%xEqqibxG0s*YkCml0o6{l2Z*Lnh zV1#u5_l@0{c!m~@<~TKdrN?%n-);@Rn=1s%Tbo=p6kH{_x{HOLd@J^fI6N_)H|jGO zy*Br1F67eqH~PZ8J?2F*Lu)-cQfYu`U;+*`%9w~Y7QfY=Aq^t!(^N`l4~xj#5&L%c z`R|hP(3;c{x!a+5c1brWg3+{gU}YqrMen}C3Pd8@J=!kDp^M_Q>`bh=__5UT`mo#f z`7n!DnizwE(jcerZG(NUDlZESk6Pv>@9DtQ4v~IcF#Qia0a3P-tWkKktU6r1X5G#E zNp{mvSsA*)#a(?=LPF88CvMM4O;Bc5U7hEb2;Wyv>gt%Tt|KU%Jot5#KeENhG0#EM z=dGvOpGZejTZP-b&}llvGTTUkl!AGSn1PR5;jB?#?-ud4<+ZS zU8CUYb^O5DI`PW}N>s_2b<{T?&vus-am_)txTi#N@rShta^##cKc<_nnx`(4Hk`b# z$f&whUvv_e<;H|m>*Jbu7=F>4l;W}q_Tn0SO5<*}{-}&*T8Kt7u+!+jrCJe{mejab z!LdMt_|Ev~D}^Dd68S$m`r1Z@^GAQ0$p?jffl{HZC@|l&t%!!ef;eD$c6M%l{%ufT z0r|ef^Wy_7CX<&cWkSW>trwapF^wehQ63D;f}aKz%pKumCfMTCXMyGzQmH&Q!L4TB zdb8UQ<iZS^k~jkZ2GafvH6D>l0{Zy&=QCTy_H7>VYXWXvHN9m+ zl4rZ6@}fl)14#CK+JjQVgWua#@6)x8|sH@k3 zY)U8k0Ul%~+UELg62z%^@CkzR2pMYCp5@mo$)On<`O0=x@ij7|x}8Tuj1)`dainI* z)3_lGz-OQcqFrQU+1V&WbJuH&6;Bt-2|WRC54VQLhA4z!{dIaB;NK&Yt%XFdi-Iq; zl{+;ud=<5oS#7s%2*<>|44CW?|>fD6gT|w z_Mz76A3kT>8Vvf+e-;O=HpalF+;K9O!wB{dk2_3lpa{dmLmLCgme!di+d0suw>?{a zY?ULNxx2qr1lhlj6dg@%o?{x%;4eA$4b@wm9@v0G`A$QxD1>=+c}Z!j&D+|NeU>xU z&XN1(Eb%S_QokakK!8T7u;6ZYyRR+NBvVvVSv$c`9)XBbR_>YDyW1jEK z*|b(_Tz9%q81wr$g2TUax46s7>-!}HrBMEuTqtja%Ro8FN!Ews27lIZQ!Fsg*lSY;YlQ0ep{da6JW)8764--se7*L2m_ zgan|t1qu%Z_Cm7l=@ghD4gC5J92D~Z{2r=}5ZBq^-_n>Pj&RttY+~M>pjNS!u_X3;SM{(M$NBWJNjpE>x`lae zHr$||p*4yzDpt--7t@ksw(m!{IHC*NtxxhfP#P&HXsEHP>Fn&1e`l%AxD~*AKlG;c zPA?>-NI`^zN(9E!!=wiCIZ|}uY8;+iI5Hk=>#;;_Xe=fzU1=cPe$rp4LKPk&PKu81 zn#(Q3mC#L4XLo1b6Eh~C&gp!=jg;&Y`u+X)Py{#IRc&2W;a4!&FfaJj&Ok~*jc)Ur zkU-MF`7l zo^N*rT!+4Q8IGk2CVB6=RB9^gscb;kwp|1_6{jCD26yZjeB`T*!uZ!<#|aZV$ygBge{Z|&<;kB2h&T0F@A|15*;7= zVR&t2?d|o0>84Zz^|CZpNBqag)y^e)R#v%kj-16oHAu9I$HRoFOAs!|00y_QqU~Y3 z0KhR6duM^=@%)l-9(JqkrF_9xDx!QpMK`f9EJ-n7^q8%kCys6j4HOh3CWIGmD~QU7 zm4I8ln_flM*eUI6)^XLcS~05xB4cvXTwqGDmd+%p)~=(=2_vx_!wP+tD>Xnfh*7XBJCG^jo)#fUCchV~D>$gGM2_GhaGZ&2664zL%#Hf;>EPJM zrmFX1S`|$s(Pa$rtf;({o{`?c$6QH9FK4wBimAGy{{A;nE5C>E zH#Z|apAEJOUztl}wV4?NLQRp^NX}*;B3|y3M|q=So4ooqVDDr}>63 z_9Q}xNm0G~P%hpMlm6}QRE56h>E00>E-h`b0r+s)eH9$S&+wZ(K0fZb*|P80`Zt%G zS@b`XM&8>!T=kFj=6l(mWPvCXgeyWMrwir=zL2X2ib3pAy%y2*Z&O29O!}6~b`cRm z=j&_?WG>wqyplLYFKgmjj<7;Y(BX!92H6RPydXCys2C0b8z0Zs)>KWWz%Krw!O7Lp zaqr9&LG0`6z0^&mmH5Nvv$OZRZScJPNNo2{a2Z}^JwViP$tJ0>hdjioZgk`!6v*Qj zB*BUjV;nA2LuQgMwdNaDQFc4iN}t7f0gRY>We5<8dmVRd4Phb?O|r__*xD}JLrN=( z%5QHTxv0O?CHjI}M=oAzmt90l^n6ikjCmMopqFrJBtP#}j8b_R>BRRKa^q}gadD}X z^i;X_tD&XY=yDl3f{@QfMVP74Ys|>TTGuMOoC%#6z~7D!xuTiQ4WcE3*u%!qPW$=U`w{46^$Rf;EP7(^x* zNV!JPWE>wK?{9vV%!Vo2OZwE)dPne^aeB5PVMrJ#QA9-i_!+4vE}Q%kVy9IYHB8KE zePGW$bcyU0BqjTzqbHYIyhl!u1d6TQtDauyB@08tqvL&JdwaT=0U*;Ao|_>pbwJgz zJx`*LZ5zg1^@Dr1rvp2|p0RB9u?c(iJJ#s}<40dYfh^v8n>g~m?oTCln~({-NvmnT zw3udD>Y^F%Ena5O6PpY|XfQ4-|LD--_0DlSBkiuM5Bm>~yWGO`r?2s`hX2I^7Exd> z$PUTUFz)Kn0PnrKL{$HK>xv^DYz3y=w0oxd%(>pd&c*8Gl~F84Dkjf|FlaJwaXl?l z1@lACH6-(8gnMU^iP z+|kX?+yBhUI+YPcdpmv}|EQr%r9O;OyIF;uAk%G+U-kekZTsoeKz2MY!g=d@CV3ru zRYu)q%kH_*O77iw-)`H=JP7dk@PLxxE-}mB?mc^IYhn7A!Oo@O-i2uIi-QL6W8LqS zK7@Ec;K3KNSq%ISQ4xN(LIQdqK@68(ETUGiS1?QJFEkW|zfmX1LwCf=($mzj=cj56Z8LIEz#Hy`#mJcw>Ah2P#t@clycZS` zW=Z?+2aykVTPTTB<5(z3KvV7y`ggRV!Dnteeij4f0+m+)h*Q@8+O~aJ`L?WSAp2?w z^(e3~DW?nM7kDOv*!}O2SS!K{S|h7{X(5~m$Y+29jP-J*(2xNKG=Q=B^zVxolydK3 z?vO(+^0ml^M?n8dw!f_WrG#>`lnPs|?0R2V&Zh4qzvw&!@++6EOCn`?TADA~|7><| zu@1K)IqYUsGVR8)BZes7$@jBmv{^_0*wkf;C050XNT`{PFdU(krt zp5v{yZJb^XdZX39rvl?p@b{|HloU?tU!I?4{ymwRfl=)d>U%qeJY^*fEpgyBHJ(7< z2pdGlN9DBQ{@MR@>3Ec`e}x>bYOt|&Xl-S-V#pc2v(}e^j1+Nj5H6sUq?36)om)G* z`sw!t;P&FskW0CZiFsGOSHvJqr9%U|^i_ouPgnDhXMii`a{hsepgUAb9<4IHPh~i{Y*=ZB>-njv1&P)Jq zO(v7H^w^|+SO}tB$od64GV3{HXjW zeTCpii!T-8gp+j}0dVeyxR;h*c95=EWvZH^1n33#9@z>7>53u4JhaG;M&Lv3Y~k_o zZFK=EQ8I(_=7NNDHr6*G8wab+G4#{Zsxfc#lqYymJdwvtstO6+tgR+j)Mn20BFTU# zuh{EgJsP!yjTs+L(etTn3aP;mdlSoV%-+4!>#<#YApp25E)|iOhdz8ZoQqvki`^J8 zH^9SjApp!YW=3e8Utf)_dg)g;eIA`w0Cek&8j3z)wY5l=e{40cCH3?Ub7`io50)ef zV$9~?GJG!EBUZ`EIC!`Gw&<#=*)}2wles;$ml7Sxw|aiB7L}DfuIIS#BIfkUV`Fj+ zPEY@!kD0tWSV~WI2w1szptH}<(+v&&PHD>)BJKq3j)E2!(@Y&xB=s1bPWazT_kS6c z*5*Kn=f}pzP*zjx*ho59yj-0b!jb}~z)|!ZEjKQYt~j36q`VebthZ}%*jDxWWLe`* ziW_s3#A4C^Gw=>VH(7T+;To>Y?ePVMt*2hs_*TzSFrkE=K;@_|HF5CB7mv&aVGB@ z2J|W@dPk_Lcqdmcfmb5H#FQby5S&3 zM!LhGNsk)JHmS0QNV10dT&km@ua1U8z-PN%de_uc_WT4&W^D6)<$P?Qtfx1>B!ka2 zvCz9cq_9Fo(cI7=aB(v=qZXGdFuN^cnOjyEq7rHK1D{RsP`fHU`ywN_x3ChOj5J5% z`AkK`modYhcjxKTITpj??R`aIc%<9$x@m;X@&$^I1c5$|!LzWFX@B+U7hjR;9j4+^ zdNPru^Bs96?Yoom!;~#2o|$PyD#K*R@8>KH7j4 zB!0QG8fwq(Yg=2@zRSlvT1l!q%kj?ShG`(Y+5PmKS6p&Sg_W>D$W&1XXvf5!+1YS% zsk~{r@4?nVarQJO4$dU`-cx|nU@s_9S6O$-kVNkWgu~@Hm^4Kt#XZ(JX*B^m)F+=> zwbNeqlHM**JzQUBMxcK0UUVm#koR=!$(|s4hg-!IGw|@|k_z&8mo`rPJYwCx?qFwL z$im9YOS8tRMGT^uT!#`7$hs2xcVM%*O;(b@N!NVkU!XuyQs^U6kZIrrFTDY!qe~+1 zY?+0MlTJ#}(b7vb#wR96(_@B6-81v-(RwD!nDf=xk3j+G2G5>?;u8Qn*c}Cq5<=JZ z1Pmu@koITUr+>RvQ#(m?NrtbS9UJ6MNU47!U0dCs<>uyT_H`U#5kyLpF zDBV6gDZjQ{yxvY$B=Es1SdVb!861}#oruH>+{9r4KLF3QN(Ds}UweKNbT{iUxgnh- zt{}Myw{Nd1v-Pyh_mZ-A`Nnfz zWgg$I-wPcjaZe6bd3N%gQ9TVZt>SVVc0^ab7w|$Nz`mSFQ3$%QP9GnQwP&?ad^VJ;Vox#1~xT2B@HZJ>g zy3@}27+51X18%Qm`aVQ_@6#n5-p8}N^G9Q&0osT@g!k|Uk3$h<`>S47PX2Aj*-HCn z;}*xH*Q3tUkS>d}#N;z{d*6>=#a~HqwptoVZOzQv97@%drZf{!Q0Ru(d=JD{mMZX7 z2`A#=-e_xNf%+T9B0 z_TuxSl;&SkL-!|sJ{M9?=mqj@4t)W#MD#R_ypEfnuR|vR4Qu4VcA~7O7W^$uoJ`V> z`0A-)Yi6U(M96Ge2p&f~zV-3w;o(Q?KXD{si;n08yxhDhP$jnI-%oAP@D@~7 zveHujE>eK*I!q8@2P=Rq^llgzn)`8E5Alnx?6GZWXFyb)p8?Koe=t-W+CeNgLN87l zMHyA$o-2_i%6pk2$|$QXWAW9ZjOAHzn<4M4}laeX-H==|ypGE#lU zJ|h7piDr0D6(*ef!1G_|d&_Soa42(uJFd}LE>zCl@H_WNShVj#auQelli*B-qj!*Gc3apgH$B?LWogMS7W zlEGamr-_K-y>IMX(0;^yYnjWSef2Zn+-u+8DoqO8bGGRzLTzDVZJ(*Qi&gsWlnkyw zF5}Z!W4}?gL`2HX!I1rK5-2irXQ8ybbgtQXG4(d|#(T<6KMBEHK@vImQ0ViY#wn`W zDW-G*0yc}_(9p##w?My^R*s3r;&;ASX)|8soThU~VrSh%0^DW~6|{H^Nh;^@wOLKdb6yhT(Df zOy*)OuV3t&$D6YxVTBDS66gp$9!Atw+xSc${^`0dwzu$J--9ATJAe&IFS<0oa+$S@d z9=_wibIqhLp-c^CZmBKdyFZEHFI#SP-Ul+Xs(Sq5++37o5ii9qek>-R$3F=}UeH?& zcADnrMHxceeI^-5k~mN+@uNR=MF^>B=m0GRV~q5(-gA(q&G?e<=7hVV)ZD`-l+xS7 zog-bG=(4tQ^&-`%{fe~oWGCDF?=mtiq_a?=)e@_0A2q%Q?dGBcU0X4`MD#x7^O0df z%_r)R)2K{geLK#OXrQb}U$OeU1(Yi7_h(b5G5PYzyshPRM+ZeWcTK!#BD+5$N1yUl zH8dV8p*xmr=3yE9ab0Wg1HR7CK{C1KwHJX{@}iUFT)Nkt9*a(a~ zL5mp;k^srq*KYsORDOA!fy3eu)b?5A<=zt8ek5b_V+&(z6W&mFhc`u` zfTl$zS9uWI4wU)IE(bNI7cm0wyr=Kj3fH4hdTftw2O9&8*Lr0g2~svNs2H)lyN~tr zrX%Qg#bX-b;OQ)JR@k?agux*hpf?6;Sg_yKYb2ml`h)B!KzE#`0Lg`EGKc=S|0>qS zz))IezvAGv*xFh^DNtaaW~@C}TU`*&pnvsKczjONz~0KP&3S)Y2gj5c`Dhgc1Q_88 zK-&)kQ`6wGW&^g8(UPvbs(I_~2?EP!@bz`UU8V8+4tEVTHx);FzZ4K(>RzT*U>K6O zaq08Hek&?5=~Gx^N~Eaf`U-z7ixz_R82)YSVg7fvOaQ)*9ZG<1ugT@Wgr;<@^wxj+ z|GLk!@Lv{l%B#8uR|0xC3+`|MsxR)Z+8N;b00GUf!z^VQE4ugpc|RY*(C}yqfWf?o?GIZ^Wv_>2?JOpL7{D=u!9ZdwOQlY^rLj zsfZXO7U#ytSJVOei5#O))mC+~vvaa%ByD6n_>-sr$6kn6#FBBj-H~f82Tm!R$&dNb=HL*l#f$PW&>eq^D;9CW(7`K4HKtEx$tvO<{KhtC?=C=q-vA#__&UbS%75EYK5tYqQ(}INt*K9#~~v zM%A=~vWJIh*mAvbvRF@xO-hUjQ#k$Z7}yx41FLg$4!ln{Km=c0lDU$RmgoOzuK`l~ zm?mljNB(*p>w~72l0+wta;3>sU^{C?L2bD-%CZ;GtHl(IJV2{aUatL@=Ebsq*qIZD z3kwT_`=ywen0U7;gnpZvn=8RMVBv9?J@mFeliPkO-ie|v$jn;%v$D(^atyhfc^34o z$j?u1x=$5yZpzNq`}dHjW7Azzc#asrc%Z)4Xe|D^KVKNS}bZhoWV)sdF#UhISP zpEMMtdu{#BXrp0ZqzobJ`$1NDFed0BNo+xEa1?3i7#c5l@u-oZp%%Zdx~;zA1$-|U z_bkE;*Us*4lYwXomE*>O$}Gn&A&C8AU7QtIer7GayxeY6%r!kUbZD+}W6s7Ev1h(# z>(G5Q&GESP&fU|c=lhNUcwnjXE3^*P(b4zm6$Z?1&u3<-l%Kg}qoC39a!xll+oK+n zs{U%1Lkuo1_sQJp(xxU)iwY|MY0z(ums-eJ2odysQr*Gv5Er;eC7!wX3c~{${JbgC zFmEDr__U&-v|NkaB6fS^!rL z1WI5qV8r5hBK4#P+C&5@30yYLm8c6tzMDO8}bG#FbvxldO_2uD`mXKg`=b-H!(F+gc%R_M2Hu^h#)~=YP;gRz3t$u zn26|;3`=9Cw~H+*YBJT-&}cT_aU01w*fH>AqoSf?Cl}39_C8xlG2vj?(iT@`w`7qa zj|TWZRSh*zk}uP|20bQ`Kto1N_8x&WtOxMa!}^OB7t?z1$M`fqHG^+oOK1Fx%RqTs zp5$$94_`prsNY(CiC7*k}jZCDzmkbPW)3()SgFI;nN8C z<|pyn2D+8i*)Myn4bwzRor(uBdCFTmTe*}}f5+j*(f!_8H8lmVJJ0#*Y!##$ietj2 zokxyK28fDcEBAP)e=Q%Zwm&b`7`Don`0fTrIp*|5aeA6 z6A6@+ViCYD8*0)E-|nxE_!}S*@&p%bC&9SngFijy$#l3L#R}X#zP3I2<$9mx3S=6L zAKZr0(hW&jY;-nOhsHCmwgr$S3`nH|mFEGoN@F)Y=O-2vgZ&}oLlj790+v!fP5y}SrS1AtZoa8O)o<_%g}`=Mbw8t6AQHt8ayW9EudgnlhL^(Gfh;{{t*7`qe?xQgf+>|``WVsS zkr57>QAR7Ex)q{^u^?-=Htv<@b=&;xw61pcEs0-MhycP*vsUa@aHn$G$FB5ly*sMQ zvvHm@Dwuzf=`S85MK~JziFC49LB0tW8$V(m3uQI3p=&aT$m{SBrC=o0*3$Ho ztN7T<^JR2#lLL2Mpf5{$EevvjZxoeCjn}kSWfzkQ3(3Fa{b;m{pf%D<0 zt{^Mxl%3a`Nr`e9j`qEmKVmmAiet=1l2jHi*rR)t`;hw$VyxB6F#mabF?)(mDbXi> z?!jM0A1B4enrxu+^XE_98jsUn$TP*^!zf_Y2!AT%#=&rgaRBldRefCT_NQ& z<>#3l{)_z7Ff|f{7Uv^!75cmtX^9?}lmB8s`}?)^oYTLp7=CkD*xDABRM%BDR_0e# zJ7Wtv{iv_60Q0})q!Xx}dVb@2795*Uu?oaN=spy!TsI$4P~`AzAG$w0k|G(_=)LFt zoH!S{Ga3om`YPH9FXak+W8*;0~M*344M8fNU712SYM2Gc5UsyfK8=8 z0>YVcG@6rk*d-kXdmYz5;dybjO?6zIAJo-nSA2a{r`iWXG+w3w%e$1QqzAs@HEU?7 z+uZDkih1YN%GS` zh|-_OeMQ&W8m~w$-?E;Mhi|O?*|$=v!F9;&yRvJR2^CcWLkj2C=Jw6a&2Tb@*Jh!T z*Hs~0BoUk2L1dN~8XDSYDsRu$>H7M*XqTw#m4N$|jh+0}0gtmn25($i8c1jn9~Fzs z>LPJ-b5rH?)P~b*?gTZ4QbE0c3(yc{U%!8k%t%YSQ0XJ-YHBKX0E0&VnI%c5-iGC8 zr!64{3}T-}&araAGMBqwLBjPK>^*Bmi8)Iuw=3?fN$ z>3?pk3nU`aq_qEZ7@}?tc>3yxn@yeO1et&;R4st8T%*s8-tA z6-6xd|Hg(=dW!}|2N5FP&jf9%Zyo9JG_Gjg%B z2Wh-NKkx6GoV5BAX?O>V1eOmQG1_0vRi>$(!a*cksst`Mj5`b&9Paxw1e?R@h)WEa z0Qdwhhm$|&=A+1XEJoe^s9UC6*3UONLpf}@xw^8lD(%dv@yXyva8rE*m)5qEr&u5& z2qe2)X^WS3czg+Ag4~dB)u-f_6c(3aaD_SRE9pn2<@rwct~mro0M-EwZLa5Lykor( zF8-f3^ShPCOa^VG%0*%%fL46}NtZ58YTzu(AKE@DUAoqNicT6O64O*G2s|f2;_Kf; zMO24{591v?R9#Z0l(9#9XBjEo#;*+^5(<$1H3#V-m1?zuxI$Ihej!C5X(a#549KIH zp~x*tP4%d4XxJSvHyD&s7-~tMO+&|E=QK0PMZ#qrW@6s$Y-DpGrHOpdA&(2L4N9M} zv$TGJy?82WO9bs(2Y!9ujUPD28gpb z*Bu=bo;Uq0e06r&P2Wb=+@?UFB)dkGFl=XSb)#$0!7X>~2d9I|ja%Hz#YP zS&8EB$&FZM)L#1uS1--Y^{*8h#5y=Qe6G|Q2w8wlDN-(Xoj}!K{x24=#I(@S5!Gc# zrQ2%xqjxjcL`6l#dVl+AEGY@cCDt!Kw$K-|0KF3iCWm;Uwd?*m9G6Xyn?2PkIl=K{ z92Jn5N+KT|%2$#*WJc2M8dzO6s}2#)wnPXM)nv7;Oca@ZiEBwc2vI4}D)dMFVMr#? z*x+`0otDm7)l_A4JZkH_&9r_FYWDn!HI^QZ!`|J~b9mO{oIFS*^>le$$|H zVuMof{tR#Pv~9Faq{GlZ2-)Ddk2Wodn0*UdnMELotTM$DfhahHK#ma?o>x&B?aD9>gayNeM3gC*0 zic!j^E>Tx)uwaZ^#)*Ac#*vIr)nU2?^WuXZI%34}>#>SHAP5T%g{{mt$WNoLD zY$mSH>Ca}v$=6VwW};Y zxpo>;;KZ$)rT7!Pg;J)l1~fMuYH>hgOu*(#%Jbn?LCjM6bo5XMjnN<%k<(}s`%Fng znV6oAi3fc1D}b$l;~AdY$-%(YbtboHN?P2%G#X5})Xqn<<`mQeeQ9sfxZM)%&8~i( zNhZlr@}#va*`R6Q@|f|z3=up0Hh$SK;YWAx!uA9eVY|muOI}`HNy#G0Dn!Woiaxr{ z^gNy_15C@qvo|-96PQqU&;d6v#!;dXlQGtQp=>1DnFR~C3yLX_gFnE!IQ(tk=(%K` z?jy)W!HwMPTNTy>I?RN_uTv+RBzn4^aYel9S}7XNq5U> z;yWO~2RfG$Iyx!3>BxsoOP-hx;KW(rFB1ymv!m(W7*1OHcIC=NnN5Q)5hyjLI<&FT zQ{OIJm+`kVF=xslbX!SZo%Be8i0iSR%fhIWiD`f7rWq^`8l&X%lEl+VS4L_*DLKBZ5`=7xO${sUpZ!#6 zXAluB#mV3QwB8xzao!nja5r;OX0^oYM*d-Ye)#ST%T`a%$HBqE$45-su~LeBq0aXH z;r_VY{_5ac2|QvTEid>>Xvw~T_3vUk7n7e=Rk|&kek!L_d8|bh702U-UHwH9O!inG zKcWPOl~q(!6c>LF52xgj&g_WvSBA;d(9>hMRg_TEQj%{U`kV>is>OZSk8es!Xa|Cz zoUnBHI}WCK6sD?uQrMzi{6p!&Z5@o>AunG&ALsyH1ZDs_7s>*QB-pls`2BSE`^T#* zH@@e^PwR*rGc%*|@{OK6SYrm`IJJwK$|~gqJSJ>b!-@U<)K%JwiXNLMYb?fnb)%k} z{aIf5AcTJqZ@eDwhJXAh9sVKE><&s|<)EkkVU_&LX>pbzARr+50bZjbIVou*nJp+? z<$N%Xu3&v*4|IQZki_abm^%78!^A+- z=5Z?OsKnxmFuyRbrK1xUANxMw9SAVB=;Nak!Fa`nx4kl}dMt&}LjVxi+ z*ND~V2SwD0!F{! zSI80emOHvSO4Hl3`XABvEQ1?g-uFf6QO80dij#3&{{#7Z`>{~~ zebsoghiB7s^%a)+&UV3dR}iB2X2+)t$n7Ijd&Sgfd{UD0$%*5Lm5XXOFy1A2yRH); zDzc6dAyDPgm2c~BWZWA;NTV^h>V0`@%jaew3n~D^_;)lw2K<3dzZ!vPCeOveM#N(E zqq^D}46T*L8XYiErlZ^M5R=qxa^PeIe)WD{D^REO$q2f5@In}l1g{y{6t6$18zOBM$=LM!IcWkj2tiA^>b=G7|cTeHsCUh zdR*3B=4dV`$OA+MN_st99PTczJ5HXi9BNw>0m&|K=I++kIswW`DrzEiE{VWqt2csA z9l$n}g|W0}HW}>qS~lvYT1q~)VQ!pp-<=%K+3TxN5#E|o+_DzM_858HUY3;8*1NlW z!9*suq`%n9@d#ZB_qgj`zIvK{!m$Whj zx=U}7E_(tRIqQ(!!WqBz-koK?PAjfsob8^TUg@Z1W{O#X65%H$B@4e01s4PWmjMG# zh*ulmvwh~h6tfp7|JRt94d;<%zW*Kvt#DdIJ4pNCqS< z^A)aZKR6AGNh05ey^~;SbQRxy0uKDNR3h(PM{^A>03t0xp@*0(eWO9TynK4~sPA#e zfaVXFhiLuuXawrb&>ryT+Z>>#3=ba#8plm^R06SZ(KAK8o{iI>h!it3Gn$0K>~}wc zv6*A#QTBzn!6#CA$^%_(7iHNVZyzV=&zn7dF@O)s1{ zn&zZcKWB0?wG$f}6O4Tm;2=<3ti)&w)1YLsGeJS>L6EoCRyN% zyi!M3VSDyn14&-Y;#ZD1lfxl}WB)n-tuoo%+gi&0=ni@MEKfOMj6j1HBbn^XgVHvg z%m-Gt^@GCq;$r#?cH<5|g6ClIuhE??($|be&W%ooZD?iRfk8GvsmA>v0t?d`+}>{B zl>$tm*J{-ESx8CA;BZlfH~9cO^D!1aulZ9pfF15;!jNFR-)7WZKisgl8Z4N81dP}2 zZrKX<0*0{0KxvK{Db3~*U|cN*COT_-$#-JQu0|`_d1hwYUhZ}p{WD!G4Vg_Ig!;>0-M=k%5}z#A`5z zWYJUh$M_sGF~Q%^su-1nv*V8;8_P;g;(KYbH5^hyyos=O*5 z#YS>b3A2k#Iq{e->#+Dv!%pC`u?i8qpWKHHLW~(OG2!55_nw#xLOxt|KDv;0M;QZn za4WZ}%320mMIoE|pEc`FJkfYNpR}{?+=quoP}w50?e@xOljQcEm^?mjf%oxeg#XQ)PH9V7FKf z&whz=_>9~bg_J$jsojtBzbgQ4zWYm-#%Nk5n@O(jh>U`h+a)%$&B1L<5Y)P4&!tgL zT}{hvZ8Iyys*__vUu{{_qS_?v3fb_+&n3KY2Y<1Dc~)i-M-9W@$O3Jz`6d7VD;^mS zO%?RY%F3!70lnDPRU5m7H|;%b<_rx?-RH?_ZzmR(l(;*(AtJy7;~)9pXen|4m?z-j zZM8BtuTZ2e*KgER*4-r@zPecv2ZUpyTw|cYE}9q z&sE(jFawPUY1GZTH`^wrs{c{Yd~A8`^j=IBq!+2R|z^gyl6CZzTL@y z>h10LCqEI+IyY4fN6(f&C)nWmftjh{rR=KgSZ_JG5nX|nJwoIwV57kgFw){8su#b; zr9^xfJkwY8dA00HE69+ZYBqwCT!}FG;C6OJ$fRou8;I*$a>sl11*C%F!UW)P zRO1sOlT(s(Cbv9p-f%aA>omG%De86S>X5U_RN$;u@*bTJKKQuV+M&VYmDwEZehAD7 z^3dxchodEYr!#Y45@q8JJz_+TOrP&Cfw z+RwH4blyxn+iG1e=ny?Nd-Bc100e3VpARc57)Fb7%^y$!wB0}#W%5YZ20>Zh)&UQd zZN|-057*jSyx-6BiU#J!#wGK`=8~8(pI)Qua6X=&7%K#P5~rZjUj|ICaIQxPc)iKz z!MBsQ`<66Ljim;P{RkDUAVPnHfUngB^1}wDgc)Bqv#JS}>hI^)U{wvREL#l#4Q=KHyjRsZ=Mp=U}+FHc>-&BWqFLxC!Ue^vrLc@*btbE!Lj>h&nQcn+{U-^rJ=|~F??yI zVUGR*Mh)`j1^D1otL;tHq>=JhPU2nCz)UFzlqTUu(B}+(OTp+Ep}FAfdT*B1m9-oft-h`1=C8}e0NPtUuf!i>;R zywEPjVS65H6*gxLuKJc#e65nGe=gWIy`?YvjUNJ=aMN6z6dQF(;(`(7>`P42K`ag-e+zJO~wd8 zQ{WPQ5quB$GVg{J7njubfm_(7XJ%8moun)@g5hW73EW+=ES?2Em8RNz=*`7xi<5j!?EG_YLd ziQX!+u#<1LjTi_vITm`>l%*O?XX~4uF73)DB_q4<>-IjKH&-qa=kr;M?#b(+Xl&HO zf8+b`4W2a1;XEI7Xc|nw&CEhVLdPZ+gNBKjoD`*`sp#_j`Z-53B3OKxK(*zP$*#`{iyR=TFA)AGQd_rH7ijM8D(Wa%lm{A)?op$K9EZ}mdl;N7mSSYY2pzJ-&7GZ1R;?0jAH2D09zm(^B0-8q|N zJCp~0g(gFMX=!g=QEa6!1^HKOgJ?1=EcWSBPrp)*Xl)ZoY<#Q(H&iTg=PJ3|STX`z zS=&i@GPnWNTQI{{$L|~b*RTG{QsWj%a?g@3bSxk>~h#Td%TjGA_-*_}uyAXha z3ruXPWE$@NG~7HN8jLf|yFn*9dM}fgU0xLoMYvN``@6ou@W$_OrT8AeVBY0KDl021 zfS2m;yk7OTwzU03B|{Od+?70~QK1`x$HU4``qgd`?#;Wz#FH2_^!~Gk(~X>a$>X_7 z0Y18+!9lCZ%>e{VriZn~W3&oN3=E9%W)$oXvaiuK81-gj+S}UFZCqWP7V1oOz}m^W zB)`jl1vfM(<@AwLQDuCOFt48P3XCA;quo4{O<WtXwoRD!J(mg+vP#CN-?o6D=TX$YCrEpIf>8hzhX{L zlW=grXHygfdAWc(r4-#1KpndzyG>1WSDQSYwX|^HscjzI#Q=E_z=_~+$rqHD`z~i# zSF^J9JE9QqORc{(Tmy`Skpt5*nv6f`+YxFNQdbbW_ImwAd;laBj@c|Cupug^|Jky@ z`}xpamvLvJk8nz!AG~St5V8@7kr*4xZwkc##!jLXv9Yl|_NoA$$a27WE){^fq9feQ z@bK`!9kZi$vj;r4o}QA(M4aT1oXpD0ECPId9(=dXnUaN&0qFsi<0LCvTd`}w{^8;A zaAa}{N@M~~fWl@#XOsCi1pHba1cD+Q+`aX{@0x;oRg|xD?5$h(T)h^F0_NfW7j17H zRb}_~`(gkhr646G-Jo=%A`%kPBBgY9FJOt%D7EPB?q*Ta(%s$NU5hjEd47BB_w09^ zv(Fi0-+wWvb!s5|@&aYRkl=T5vW!Ad)jSkc>}3$!;iM z2(04Ebdg=^MOGftj8j$Csi&i-hg+En_PV7iB3R)Lw^;vt&Nl&7ws`yRwBb@E?CheV zZ#OqLyQDsBOwcegc8O6IhleX)`{CMga|i5ft*MTb+3#LEtEh0Bj^&MZf6W$wLKqo4 zz3#u!)6+AN^1quv@(KbU(wnR+-+p_|8kD;+{DkajvJ&Ib(Gd*}+Q>79WN>KaT~{Y+ zukMqITA_D5$oKx=8J$0074^BVr>Cd$(Hc0cBo!VOR7Ex(-7>aQA(WZ|~?QyR;Q&cFzOYqs^u&c8>NMZtEvX zaSLc)66UP0-(xK(faYuF!UsYcJ3DO-LQ!Q~6T>>wma9a4Fa=!CU*4#Q$;%&n8y~;C zbiwKMz00LeVQ~5aQjI7Y7FK?tB|QTx{>-Dme`o1q`8EtrPEKxbZ!Z?L%hw;IM1_Rx zQfLQe8$%x6$6z}G!`JwiZ8eEYJ=$lJ&T=Xrv-iJJScqnl+_Vzb;5|I-VO4jtqNz7 zRW>V~+2>9!L-j(C4C#1wP`*?W7Yl<$#!k)32a@pF^_3al^SGCmkXG@}gpc%EyUhxN zM3Tr4oajUq>$0%0tdGQP$DQNSNhEz;ULQzEAhV-%wu3JBQ@Ch#Sb%*9z$eNx;vruk z9}7Hc>yZN$KV^;|<*4OVRA`ONh`0|gBDJKXC3x-Tks`ZnZ5{C*zth);4>^2RQ_BWM zs&UMO|C%OlO7_-=DAVx$y^(1P2Ug+#QiYiQ3Ibxo5%W2?GF?bnSr94T+mmlGo10h= z8aq0X{Cd9x425h@Po>FeP!KHsZ-<$dd5QI(^^#D=k{qLC>~b@J?XE`j?y4fX%eNkz zsEnT0dnE6epI|=*8>-~LKXbvn3x}o*mOY8=%STlE+7;^_M4Ga@P78^jnvF7locV1~ zN~J3v6|GLK#jmKYIdDnu{VYX6{s#4zM6DCNC%=G9IFOZ$C|goy=&G!1q*>qvufNXA zD2(@q;kJ1CVs`LMxui(#ClkuFky;H76j+;%I@sm>BXw zD0WtBD9K6kau@mK(WUkt-rMOt9j#O@f3oV-$2PJvv$LI-lXzKun!l7hJ}O~XoFY}~ zrgs!0AUvzMOEy;_gFNiFspjb>{|-Gq{%Y81o>clUY^YG1H?~<)u3q{CX{QPAv9pB% zqdqk&nJ{DcW=rF(-JpQ|Gb|ss6%AKSbNyI?t*NeT#Uu}iG5fwuPctfp@}HHoiGe?hs80)5KOYzpO#O-hu=r#jV<& zCVMOAYxm@V8BajWrx~E1fW0aiK*d$fQ#jEqW zsZ}v8TsC6MG?!zj0NML=43_xF?`M8?0X^$WBk!@(&OIP+-ERHTf<+!_cTnb#)Y!%5 z>*~k9V&z=B*~u;?XPh4>03R~pSm}@a+e1E zd@frUC}elBb&}~nU14TQM1 zo(k&?>m`1Bl9R13_Blb=Bl){G|6l?MzsX}YJnqpNI0W-KpU3PggFi+J^+m;vmD*0r z-@fLf(|I{vp_-Bh{3m}Xm9A8-CWO=KODqzvlO^%P;dg&=40kn_0(&;MF!}j9{OY+lyF!RSE>l{IwRLm*3wW>NU9_7 zGmkFwr+T(*AcjHsev#{@DW&6LR4H7MbfBIo>(o-Bhey`_J+Y(L>{O`9kwMkPy7wH* z-E{E&4%{@)U1V!V5!6YeBd;d;^|sMEZGjOcHPx-A5Y@%Qv1V0u+;x)=mhREKLS95kuNN3=6FzGWX) z6pT%pkdr^wsj68csvxVhWsDl4>8#RXgOawaOf1=D^o4c6D}(PDEF?Ch?aN2|5j@JT zM*_%R)kMqkd<@AK`l$Hgj87AV;XWoVq0_VV`HIp`*W9e%tJCA_hCr*v4` zAL*BOH1Szur@mgq_ZXjRfnmpeDocm8+dsjC=!cp|ynj9=%ew2T$Wi>MC27*_X?jo1 z+dj``XPq3=L(IKfr70$Vee#D-A${KKQ#gRMH0|F}dea^^J0vWQDl*Ip3lHdr>uOnFO;&Qb= z*?p1FGa00j+8QDJZ2YxAiPG3jb-kLxzW4h>3rbz@3N_4Vr3j}DrK9ZfOERvIY;Mag zZc7xYE%&X-nY+A0KPliI{LXLt!X7sx*v-P+k@|(db#U@MsnJLI$vzm7Ii?LgOv;JY zwTIF8gN@92$>@$k`0nGmVL^lbtboj*(GeAP!fr_pf{!jCr;OP+#$#XzxU5X0!K1iy zBSUPsn1HFsi0<#A;x#$4!QH;Os_Ix07vRunqXUr%SaOEXF)WxVz{2;8No(ZFlqN9>F+#tP@RAz`TqW6p*|M7`Z zQcvs~+}I?z-9H@$w+*aj>OHMJnI*Ny%L|$@*a1Bh*d1a`@0o}N;1jFsi@kbWj{G10 z=$T>pXcgqqbG_oSJ=xDteIQDOd{V9xQq=q-bPfK!%>|sHbh*D-82+`pKIvsjkWjUc@JM`juv#8*O_tF8M5loT?Pr!$K|lN2 z$$iNLI}5cR!a9PxRtWk?xR#Sv^u<7GO0xqKBq-pKXatMpQF@t?6O znp#q1Zj}XEGWK4U4MhX6U8=tEj-l=0mVmIv&wIHa8SNDE%(vCS+Nhu<4Aq(UJy`zA z70_CcpDhiyi&3iTi3uLn)$4va7)C0bQGMk4M)tjy1HW-0JJHW##WjDi`&f}6et0H? z1&;kXME5AD==@vXk_9EY?>xRi5~MUR8Vu(sS2nkMZB%$Y3fbt$&Nqc@Fn9!a=@ZD3 zk_oSpmArnOP0u0)cYQC1W}2iT&su^(+%)Va_*^9RB_7DW(KI6Y-Qc{PUngI)<*(MSPAV&zVUN z7})*&Nrp~cSoRCv!>Qx%%#?ai~goAwLpx*h>@sgW%=wofZ2C zs#S#<+ko7EC@@H0UT}|ajAN0hP^}%+HWPNQe)4`h{Hf-Q$9h#i=K~?_D%M#;67?_$l1emUgBYnWF$A2 zJ-~E(1Z&QnX?U-a(3hn2>{!Mo+p~G8iyAnEfy;vYkSn6;RsfKj^K4vFh>b;mU<}pDR*PZ$~hVYmJ~6Vs7CI)Awz;zxrMwa1?eT_XGPoWH4e zHs7Y1&ikjz7koZ%&i$5+H6?}Oyp&*ab|q-in;92!H)v1&oESr9j01TqXDQ?DmXNa; zMSIWOZv9$MN*fyMj%gj$R7Z`;*4W^pw0naGH!LFd{G?FmI&ytdGO#pgraO~mX?0{5 zp(f{%Vw#yIMr0?ydeeUJ0QC`0;AY{s6<C_S5 ziKbx=OhZTZPb2}2LuPF(v?1zW7hee({_S`m3kEs)O^Au{zN=4V84r1xub%ogrlg?B zVDoWcer_#1YSY(v{iU^RO3nrg^VdthE(#8bQVkl5;hszdc}9P7;X#w>P`D`6KQwTt z!`^3@Uee2V`}Mc<~nz-v-7W*y-)`G%k%Zmr(Tmu3>kNqzl*!QWh8 z8>)j_$0#jq%;k!YCiIAPXRN35OVqiiEsE^dmxPCthY@zHbDTD1esT}n8{<1TXwcHK z=T?iKrCdhnzajn6HS{@O-^$7R*`E@Jig-j?+KYUB2fx#!vBXIOA%~C-bkmkGw&6sC zoV>CG&V)mOG|rNQ@Pv)QGa4yAU3P1t>SvE_Om^b`$!R0~HXnKL<{d)btctF5qG;yZ&2%{wW_~S%Qq%wQ4e+tQJ zeYf>7PI>|!b^OO+)z5NH!J8;I$m~_L4z^k!JJUx5>J15lwVf`$@!pV#yc}hAsU7-3 z&J#B`WaTP)(wt6!&I z=<%EQJV9-!JR=Hhj!h-XS}lnSi?WYy+GbuUq8ye|Ax+otf}wt)rQt1;csr^{@$=i) zI|iuUcXW2gdr$g`ms0o~Lq3(at zBgb&HBoiyyrJ1NbqD7W2{karElODXm=D$bW%3l6VONhCrCPR{X0WIJjOs4rgXWVoi zEYbb!jl8OsquGz1bDE~%q2r=35{Tm=%-F=3V+T!T$SPd(J$8A&fk#C1F4qATZbqDe zl}wdZ@@97miqOTxs4RF(1TH>k1theM$Pr%owZ#=180jN5(29mVmMtHTpoz} zFtpycwkSCr4`r19k@m8O)9%yO>mT0xoo|Nb8@XZRELS%xa9ra2#nl+>s5EdCwXv4o zs;0z4zsWes6ukBPwR?;=1`RpCm=J6w;fa`%q<@jPTg{B%YA0 zH$8|EZrsRd6zt@fMfQ;z_lR)44G~4D!GqlYq}POe-na$7XPYpG#KUci%{0~Ux&0?? zTvUA3wUZFnX6giBD)*!6=P)%2epljW@>sH8i0U;qQ$`A>fX6?r{g$w{O`HvTTlvQ& zM_kl0HH%e+@MVxeA6}M7gA0y-1#QzuZlw>H>u3K4FZ~~0{yS2Tkf`3=p(*}e|KCEI zRg36ZoZs|O(iQo+BC%b61>^IlAs<>tXw;;<;_iQ&MFpf)*&_QBT<+07|6?)63X&tc zRl-k`N9wOe`8liWG2(CA-X^st-3rV#=p&7f5prp zVEK4H@b^kI=V+L`P{(we+VH1bHGSI)rAQ3YXSjqwD!B6o`tW|pYx->^w7t56?LO^> zz0GYv)FJwM$Wo$-zwMFupt?W|-K{MGc8@UU0( zdODp>z#3$Gn-qvur5Q(HJ%F>&I#O4W@gCsy+Lp)(Tb2%=6BA=}2m+lIU4k1!k@kM; zkzux0;n`S(>j^%-ioJa~P@$+rk9Ac3209r^pJq^xqfnRNl|Dke=Psx-Jl?_-*`lM1 zP_XletYn)Dn;W+pir?N?(OsMWsHiDpFDkwLMNzR{mZENR`d$(NdwJ1+ttNj(Nd4P< ze|JmncE7=qD{%>OJ6pTkz8~z4vTI>%?B3ThppO@x=vuA-J3j@;E)mG*trh1pnedL~ z!n!jt2+JDxhpqdpKBB!V2R`@;bwPD?&4=QN8mIfZsqM1EiM9ZPM@>BDDNck9>!8#R zjOA?oeJv{9(vemIy}f{KqPsxN3556i-E8;9WQ$8GXy+ao*DJU+_J6fDNv)}RLg!k6%h7zAGABG0p@q_jL_{#J9-8BmcJ*+_2pC-HSvED&2moBo!ZFY8a z^7&%MhgPtF;>xAE#(c8=tlSYXHcsE42z&UHRa3@&ZOIZyN>SS0WoQZRZyqthH9pVb zaTqBN<1*{J_JIAG^Wrh?LxNmC;GIIPkxh4hXX4R&8HAb`HSKn1FCBTJghrPT!n z{KvUDlTI5T$JyC7S`W`DNv;o+U9hSu{^3*M$ZV*p>i2GN#k*38x!Qq6p1vRRGWZ9) z3a+fI^7!H9Y(r7GW3X>aj9`VssRnChZJxBD(tTRk%I2Cf_7 zvU}-kt~F{?v#)O}jpt9cm5Sr*QcFq-U;_S|G9;w&v@-DkAUk@>UM4Kgf*}Awt!HSc zDk^I38b|ND<04{syngVyaDHL+t$RdRgrW?EH#m8=Xc~WNhw76Tcb%!_!bVs54LE56 zo#}9V`_g*@Ex#bdZt8kg2byPJ}cp>ThrO|EqXqIlye7xj? zoN=E>^>t%wsT%W%XxCPBHCz3G^?Mc8_?@1}#3(-d@6pjNuKqbOljP8=t;Aoq<-*7Q zE9eQ%W*aNH9oWK%oOgRgkAy(gxDO|URhvK2=>!Lj6DYDx?qgE7ytF;7^+mkW2)tCt z)m|zzC;HJmIccy^;-jHCvoUf!Yzi$@2a4+5SdPT)w+f4GKdBN~h(}>f9h=L>9Hfk4(G|Aae3V%4T!Xve#&1^dwt4OJ`F527A6+0%FD`_ z=O;{Cx^&Xdxg73yypH(bAAmsEmOFg=mImFQP>miN>PYVRVI3L@i??4~Zr}Fq04Ph{H8a5VrOj+ zJ*FVt)DlRVtCTOvG3Tg_2;pW6VWkeS1@oRU-zbKoHubYFDo4v8gWfMNHrv-SXoS!cl z_RX`QRON8lf*(T2FU`dA8ySZ)mIMLKFhTo8GX#{p8R1zMK6x_0lCEv?tk)$J(9J)KYm)_Eaq9yQuh2KsB2$H7S6wuOH{hn z)`A6hLSPuz^6~Qjdd~6nLRZf1=E4U9#TH2G(i(63w4vjCyxp~qyKz?pH;2tU{Fxi% z<9k3jc|aG~hCv9BDBDY0jx2l!e;RK<^*tcR(Md<2?p>C<1g0qDpj+D>0Z7jDNm0 zyb<8F#xImEFkD`T1aF(2^}fb9KH^@9<>lk+j$#k=B-CG#tM(wGV%@Vw zL+vYi$};ksUa{-wfV-1Ok}rQKD)#t4eo}f1hIi-w#;-TzQ%pUcT{Niq+4*dRd9)W@ zolF}9OoG#zYu#~i;jo77164-G;X;({Sx3E{PBt=#69pP4eQZol+705^AC(MZ^wq(l z@kdZYN@is%3oiasnrHq6nVG>WVaqKZqTayc1BQI~DI6FuiM#{+5fy5jko;x&(^NU( zt~DMXaX>_x>1pOT0tL;zomH|i(!0B4dVG8fQZn{j#`vM!3y3;_?2N!gAiboMJAqzp zK;ScC1Y8z_LTScnDTNqfA#2x5bTVM_xVVWV@8Hndks1t_l#`jLFn$o<^yMYMiM@S( z9Zj^cy!GT!2kh`Nbg}7j@-uwt8`faKRJ~dqARTUQ?YT37V}7QCz-~xEi>o z&G6Y@x*ZV+6|Gh#mh+T526ARAm29r#zQk(s^49CW8#5XTEJGt>$JpqtT6~|za$9T{#cd2_P6_a?Q{&^~7ig8|7>B&F zn6A36t!?(fu2g*sNCkdqXz`dtEm$PuUUf(qbWeQOh3_kYBfk#u2tmYtlTT!CU#EPK z%S$^e>CM&$lNVRWmkKiRC@D>%WSSMf=lTNXI63aePUKT)PBG`_WH{Wkk)p5lj@Rg) zbd(Z6HE-nJC?-(|QU|x{kP2Bx1hPM2FpljJW((XEH-Cn7&_2E#d#Jz8_Sk^JHT^uiH#=`1g-6yrq?62pgb&G7we5T=5=SX##(YOs6~gu7;lJy zYecy~W@U@-F{x2jff-TI4`ztV)kpIUcXNmcc%cM@D}nI%QX6)9Z~r%lGrQ}9Z@<4N zBqme6-_#qh4fI030Jm-eF9Lj>W$76qq4Ecqb!UGgwJ$v5MT<>Ly90&q40Fpti6Uo*Rzg+q?^hn}#Wo>qRbB=zuU#HE${AX82ItZYE5v$vbRyTKTUT5OE`Cu?l4PRfR}qV7?DK3G0tOBA%$ z+v_ED2~0o2PU&sQ*dZ0Ge4>ncTkt%$LP&-cHo&5Vsi?>yCG`GVGTX^|Ljup&vYOU) z$6@ozi@Ambcf<%9ETaRjXU3Kv68M)xxhoAGG~rVMRW-F}8jHz8me+8(0`jn)^C?Rhs+dB00Av`N4#^ewwV%J}etixiWNSK;g zXW>Ct=A3|Gvo?>H4Eo{GpK|3Kr5KA-fEr&O%PdP9AMSPqII1hh+sN<`*+r@#!Bacw z?cf5gnG+JP0zHUb@7d_^=qLYx#~sa90N#@FeYHr!=pFUQv0c2@2%ms`4>adLxqxOr zn$0-|ftpndN7wr7=x8-vQPJ4e=Ldl)E~pByeBxWRlIy2ftxp3+;_Z$TQ~6t`#-`fY zc<2I59@k+Ka(YfnI8UfeI$yR_1F7OS_cmhS1r6&xPi5UYwvb4S_Q+v73n|APNv zhOQQHVtR5$?teYfGsC5o@!y?GoZ@V`qrUBG*4WzGmSI18j*m}@do&Vx3zLdTbo)gr zGCMbS3r&Q+@wgWzwc=Guhk`{m0sWoCM9>%VtmKQ~o*iQQphmFs_lmW)n>%vd_QnFg z>poJ*r^C5~W@Is%IYjNMS0>pc9I<9Da0Y?b^hWUqa*or^)|92dz4Zcj$b~JAUjox< zAM&WF=m!d5f2HGRcjy_yUVS~@Ve2A=j*S^7vPEVocZR9%a3CWc7q^`oqZRPNeyYs8 z?|NcrwD5A%=vs|CfXjZ-2+QYYr;jCdab$Efly0Hsl$2D&<=nHF%3zk`>s7%6z`iAU z-n(|h7AKHujI9Wa1KJZ@gee(UfxdBh;;IZ{D1sP18Vkkk*fm%m1nvdq_!Df*xo~khWAol^r zv>XQCs^3|aAqEz$b#AT(JuyNy!&yR*VQlrbU*zO7A};NLJD`#r)awJ5j8>7;0`{D{ zs`lKW&V`rl8Y(6k2^pF5Mv4mt;~*~v7FxX%f>LYrrG}e13mOw=>vI&CGLY?;iODf91pt!wZC*0wDd_#5aVzEOUA9}PA z8|D(z+~z1^?2dO^C)W_!g@?W>t35q@;}LeT+dfx8B;|BFw5O{}sRjMox?vk>Ifnl1 zsmz`XwN_nP{HLfyP-(wK@Z`@@bes^WrKzC^vxO4ins3tO@=Z{0ukS8MmV`vi0%9#H zCTaa~GM=8ILKEJH4@@!?kE?b10`t$h<4Ac7G(>fUI%h>e$xlcGHJ1LI1|+5Jcd z`Zqv?FXQfUV=&FbCcq(jh3wBk2dI&gn8dFJ^Rw^&`h|IWeNrhw-Cdh-3Ya^%baGTd zf!P^QK_1Iba`ws)@qxM2>2sWvEJJXAj*n~R{uzPGx{Vve8rxt z94O&ZQ7x*R5YpENRQX-oOn-N#JAZXJKN+bx^*}}WUc;4z58s^o*^CS^PkM$%Dn`G{ zPn4ZE$z*B=gnqncbMSCxk=wx!6VYl@mFDR@AtQO+(mevtZC88kt*p*Lt+2D;>=9cX zA@sVX160hyyu4a%*=ntq;}SUHBvpG%JKVfkDE&pP?dH1N6QP>P$Cu)IyIraU;f=4EIgdJ{F+W2 zlC9)$+JqM^T_73c_qep8qBa3EdOZ9^Jl0LRm^bp&)RYE1G>;=MH8Ci&G7`XgTTC}% zJScw2QdWsI=mXn}Rs4uFzDbv#?^PYK6%|VlOF}RCf4t|UmNPQn86n*WczkG|al=u| z4)U#!y##p#J{X2Q1Q{e-+ph1m)1xPxi}EgC&3}FGF@RiMhTLvSwk&?X*67UI-XVQ> z--BZAJij5;qK>;S|i zl?@F--}wY@Yj#xL++4H#^H$EtrD|@uku@cwZwayW>kZP%S4ZbOH*LZ&r$ zo4j5M?`b*T?4DhZ9tk=cy3ZNv8zxe9_G434Sy{=AQAu1t+}(06=%xGmp3(UDza6{5#W zPEM|^ohT!6ZFPNaoqg3i!adW+$RS~@CaJ3ntE;;~xLt+uJ+7vF@v^9Ptdx$QpZ^^% zm5!a~+hijnBVPN?sCL*r@JaS|WgtN6ux3RQ! zhJfs;IQU2mlL|c-u^xQ)REW=J+4pb)|E_sRNtO4i?R2gx%ok}eqdIdsXKEaJe)XVQIreg!QuQvXETci9D=W%jMZEcEn zP}|?{%rojy{`21m(f%#e`NH`xNaNeU9dYCCdJoKk{(eD-DHo4)*|$+i9#wrQNr=Rf z&gWG)OMmyns%fkD5Bj0X>bElrp)8H#Eh>0ZDtG5@Rz!2|_82uBoDiM*ie{ZmCe(>(kLE`=Yu@V1UE&X4Ai9Ri$X{=A~IyM$Y z_4nhxF^zpgeGbYeSNmc`Ozb=*5_zpbH_B(}VY$0e@KA6tm695}r@Q<5*sMN%1b|Qo z+)zXVi2int^Nv#`~(E}0oY*- zdZy{@tfsHOa$K7!XOyP+=iRB@{^KZ1w`#C}LhynKGJB;dHqxl4o}D9aj-x3Xr58=VTX)fbEY z+x4nSG~9zKySuukDlHSGX^-~LSEzr*#l`s-IOi>|&l5f&%tF{4SvfjbNAo&|e%jnz zWwZg)%CNevy}iAI!|p&Uc&Gzm(b3h9Onf(WRPySTC{%r2nV52Cbz!l8)Ya8jY%mvy zUwvT%kR$@tkSD*cuCRArIbl9{$%9K89UGf_*!mG@$={*Z5uX9H5kFL{EZ-{-lXBA7 z!i4?R#zl62ai<$jz8E+wV`Tqq&e7ST9>Ty8B6;^#zA<&JSic97>luzsz!zRo9~nVS zeJ?JZ_)4@+&*Za-o94}Uv96d4(BCbdETED$Rw% z;TkgjM>?#fIqNaaPP?=0dkO7Niz{cjV@#YHeaqBXJ;#yDQ-0UcAjIxTOQv+E8R+Kh*(l&N|7dBR$C@U*n? zu`$cmPGYcBIG*o+EjAk6o)}naqoJiH;kEibI%;4bEiEA-p({#0M(b1sajiRLdK&r& z9bLW3$@=5R{=l6nF)Bc;?TTOvh!%o0JI*l>2a(`bTQ8ldMMs~Wp6akz)SpB+-d+T< zV-S-MDX&;3CicI}#BV&qr2CkQ zSv5cE;w#cmv9OetM-&>y$H$|h{%C4y;@OC)Lt-yeI&-8BaQwc$Y5wkmNla95tkchZz5Z#lMuYQe8Kman68yypoLQ?DN_AZdrH0Pr)l7|zM%7W5i_Cj*9=C9b; zfVQ)}nMfe+oQ((zGyBwlIG{@aPgTVAJh-C#iSByw8@tL>^KeYcrpE`xS1EL|cpK-< zSFCgNKm7cfI!vRQx;4Pc^?Tmf)HsK}dz%-^k2H_->Z6Bu$sjwMCAs+rH#gT0A3jjm z`DGVw8U!mik}RyMtH?wPoA>R`)S&}0A)97}Ae{iDGD2JgBtxQO7;$iWYp`_=JC?ly z@cDUp8H4r%B+E_YH8tZ+G*9=Ycno)^GZP`)EL=Ok>)mv|bh^G$4f6NLAi<}md;yZ$ zl$j~DTe3bD78V(ghf39=b4FWgg?Q+Am;ujG)XlB=cF^8F!@yv33G9b~I*34Z;JiDE z@Iaw(YkmFPlqzN{1$E}GD~JN%9oclLA~mQyNb8D#seTdF)Hgj!Kjc*a6HG2FyE+{# zt`V`c_o|LDl#(bIUL9Pf^N@`1$!ll~>xM*Ds!ABG^K4z-BDMZJ{+W`}MB(mUM-Uwy zJ?Glhlh2Y5mVlud3B!h6>?Z`o5C8z=w0n14wSGnBG{2uLDgeEdT%N1lRKb=z3scMl zz}KAI9DL@_Y0QPS@0vzWYheO;J7&~N7tUw9*VnEmahvY(Y)Sc~=DE|@k@miCB)=NG z2?HzdmwrEyj=N~!+lRr|LiUt=7kUn-)!{sI%vc+_Yc(~HX{RL_H6RIO$V@}9R~8kO zmgnZ??$sHAp}4a{I_6fVa&zxjXDoZCyC(3<3H83b^!0so;=e%EoSWO)4Ob9v0G40? zEeK})g9Gtd=-v%Xl8!1hC2g0^0tn;H=1T0By!Yft1XO|(Ep_$t^AuE6K7Ur>c5A~B zr=!ykd{p9zfgSQQxhyZOxVU3>R+x!H@uHJ2GC!EfWv(v8CxQ4KL|{^d=x!22`h~Ke zjjQc;F;cS9wOh4Ska}F+I)v;^oI^hoZ_vPW_T< zFa4&AG2ur#!sJh$1OuLTbaizJ(5Jdt%gcihz}{ZQ$mo-djQQ6$z`tk78*{F(b|Zs0 zg5`s>L|6wu6;->7i?dt3!LMC)C4PQ^nIbde`J&&c2jXI7pqNy}S<(A)H`ph)rsjNX za?)j^M1QmIr^am$Pvxw`)D5%hLqT5nwEYA&2mw=6LWZ|dTfe9kW zdC@u;@X^Bc?t2Yq7W!gdf&O(oz7-DAJ+3a(VhnE?Yg=kp1*0<8khM z7NV%6RONPcirX$H5&CtE1%w}k@Dmk%cy@MiR?+&DWjzZcGuU>3pktGt=WCi1gDv~u zP{Z{iddPSkWDUsRe|-M|R?X<>5P+e~0D*+JkB=i}dAWJ><=)}pp&fQ=TGn|kTSJtP zB;^}WlB=qmPQ-7ci8zLOXSJAT z>dj;0>oi-k9(52ZD9Y~4Zt&`^O0VED#m2@$r>o>0!`@`KqYMlLwkiMJIlZQeR^PWX zo_BU~ad5CZt=DdzFDWgxwYCq3>)t~l%>t1|ab;y+SC6T&F=!(kJ~=s|9HFX|0KM^& zrbQzs^($UfUL}Py zSnxh&CwkwVrkl{LH$fEjj>!S{yO0keS*f%^>NDakEY&h3*LZ9Km-J?0W5O*Yi%y?$ zAqXVnv6#KS5Dy~zCE!{G&*8T*Q~I+X3{t$3ZHj90$$e@V1cU!+RgzD@Goz{)QojIO z2Zz9)&vR=TlM5;=*5m}hkoYGOw`!&6w|ZqZQ=)&iJ2N{wJ2Em7_YbqL>ibipDv6lb zm=bo5e|9ScMzsHg%ilu&n;pmh8i)TM_@&ffBn?_x8DGSWF1CNmS!_ke3T?nz-_wmT z#DT?jh_2fxDL$`VR)e;pZ5QH!58cmzlJar}W@cGgNf-t-tYb9KeQdNdC$Hpi7Bz8w zdpqo|gTKZE8=W7kJ!6QHuRC;5_e->2ANJro2E}$W1mxK^2GWTnPoE0wy!#_pbJ`or zp_mpQN4m5a6d;xoMbAw6bn+68m_#P8zd9R3T;@sKZkz@AADcI*F>D+cI%*M^YgHO0 zxU9yhab!r7(7|VG_MXW9?Q?b3?;ilgCn`4aQyga6olJ#3*O~?K6EUjhw}|}~OBoqF z7MA>+?mq)mtqrl22qi7~SL|k<642ugg3bv<*8WQl4n+t=y~F9P==U4fx|xbSg+8S= zQrQHltLt3LzprfF>-B?|=ZNd=y&yVj{rDc0`tp)8*R4Ia0D93NoxR$I$?0xR2H?0j zd>lfTfX`QRMiP8ny5PftCfOm=!$Nt}NqnoM#ZN)B+htGuPBF7j@9$?E6(U`LTh<-41c`*jSLQug_!gM}kxG+G1g4TAi8-C?eN$aWLnC|s^rAqpwsR&3 ztU0Od=RPg`QbjPQV9=!N6T6R7;!jL|5;@DH+dV&V53ZbpA36q2v!!6*g@@0XPshbZ zicnIIw@yfoY{ys5P(KF#E!&f&w_BDCef*Ie?1INIsH5h0iirBlF+;JiH!TD$l&=o^ zgOko?-If1l1(ZQn;7dO}o7|Jz`t#1%)b{|$ibb%16r!lEe%7xmCqpQrqMRYu>Eu}# zKeI;Ou(q|tvWV_HF@7gs1kNJDv)WX7f`5?35*5Fru{;x+w*Bcj+ zrM(7BfYYwfMwQ^cX-#a(6mq`BWXZs0@&wE%4vt&!^ro)DI-2i~6daWnF9@__g=}Ni zEmnUrl-pwlVqsC^oD$h?e)bd;QN&~W{y*AOp{1-Ny4+WY|JKw824OqHaS{kU{ ze&5>Mw6!?|q0#8|+DzgZ>2!tLSYiSsnoj%fnX2Z$sj_RDXceoaMl$I&SQ9*IVxl~l z>#LtFG0z-k>!kltvae9gUbLB^9zUR@mF`#_P5+YF`?8(5G0J` zSHdAqzIGrT5vlDuFg#9wZ=H5^b5uoTtA1)6A`elIWlx3^q^75f?ddpQAQvKTZfBj3 zR{jj6S~S?NKt;CT-N{*1?>2>3-bf>YNQ9D^iP&AE;x)&1@E!*Qn3`-s2=otq8>Fm3qa_ zb;;FeD3}_A+4>5SW|POyIX0px589ZZWJLIsI3D*9pl|U!RikHSoIN>0{P0->mJebG z5iO|o@Sm3yW<3&R8#>1bV3(^B^xIys>WUy1I(==!}( za;?iFMH-s)+sl2J5BV*u1bIdO@1j}2O>puPML?itauP%c1yl2?Vc~w2m%|{Q*z#SqhR%c;dDfpPM0*@WtXQ zt-)bkKzT)lKXlG%t1ikk!^Nda1(TYm;{7fppMd%JIH+{bJ7K92hqd}=%Jq}JEFOVIotSzU}DcFPoK*W9L~d2!p@ znl%oRuNwrtX6g-c#oHp!3qHsCfPP>gML*ha!>{duc z_Jrtj0v>t!vXl7#YFIf%ZE5IaM8$5MaajX`df3kAcMJwly zBnCU4JW`sY2Bprf2?OBlUY?f)8whd*~7+B2m=UYuXdfXWB65=xAxP)?)uJ>fSmk z%C_GZM}15LL?i?O1?kSAF+fBFBnKEmy1OI>Fp!c#y1QE%2AEM&>F!WMVCWcz=3L-^R^{PVEX2kyD=>%Ok<_fy~4`2D>-GE%ZFs42Lef3gDw`T3tiX=RwA z+X5YAmCG4yBH$6ZgUa+r&hW)-D?W zMu5q;359$8?pX5q>QmC&YhO|_B_V;iEd7wqp@V{NyJ&nXIy%yNs$7%wMGX4&V=1W* z4x!gzbMwCmH>tK-mWx@U72+kVC-$zZtLubZx#M^O_rTEv92)bIQHv}5B`_CQG(JZ9 zcjV4uV9|ex&m_k+F)m6=4=PzH+QSX-V+4|1x|=fkaMAi#>Zir?DXQt%N3T9 zt$_lS>^k;RD~$gFyQ!1@4R#ASZ`!^_n)=vW8O=q8YG*$Te`(ZrdA#0n;fsD_QT^Ij zh~&weA6Q64RMbhiVe6{vR4yww0CT_dgaQmQIWpGV)>hK?@etyy$1)5ZPGU*Vi z=$OxTKfhjp!Qx|iKv>;_U;?z5rX!}@oUbT0HX*^&?$pco36EQws!~;b;p#|9(QFH! zX>&$qrp-7~?ZboLT-smEHY<|756u6deWeE@CA|+)A21=Piwg?GTm>yhw@Cd6X*$|K zfxaRlAkNC$Hr9rj9n6<|5eSDLs~6PSPgL6j9qG_esS`t9Zr*Ku-!+ZKzczGM%|gOd#=--h88w1 z>u_8wEGEdwZ|s;F z@cL`k1&8jFV_fJvv5{(#bO{f1!BPG5*SD*?>wp3x4>nD1Cj)@hi)OlcXA)SIm1e!W zv#!ms@ts&Ocg~n}4LvoeY}gKEC06$jnOs=GuD%_d{CGpV9G;328Z4NNB*>-`$zrlsBV42ZYgc&~es|)fJSmvQH(ATGZ?x4QjSs@h z08;xOfHBOm$Um^PT~k^AYtL0xjedT)4+IVPAR76=#s zJobJ*;8Q7U^dq#;KG9N^*nO9d(P+neOb@1sfLIEwtME8)N-{{SEE+E(dL-y$Dx;z+V_P%dmEQrZ+ z_yq(&3SM!3eo%5dPK{_3~-t97@1_)j@Frfd*}P>*Dq!0V(QwevB6_aE34~(Un$~ zC`ovwfu(>#>GBE!7*a;26@e%k7iZ-%`i!K3Jvc{`wBqtcwjv=S!Xn;##W*!#7Z(?h zQ3o26G~AENU7VbNRB)?tRRhhdDUXhF2Ow{dfhtP;qy6)LIt2xh&Dd;yR+56_+#-fLB;bjsrq zq;dP&WNm$YJ%D(H-=F`D&jp8yzbHTa&dLI^oIix{O$w4f-+X=kccbJ#*yrD@NSRA^ zV1m7CDER-2B(Q@Man#iffL*?F^)%oz_%l1{ng5f_@_!T23Vw2t`#BKsuPpw|NK(;O zj<93bJ!=Gg+R5I6=344mFkrZfY;#oRo!XotL7Tk2i4~8JWI5Xnzh(vk3@2uHb<}z1 zyS_MnEwX0%P5WvwYA4~GDvf4c>&4U7dMV#&(h19Px70TmcHH$0y+%k~@_O?&pW}AT zHaQ@m<-m`^1Kz|Q@NWTAnx&AO>uzbTFYGpU(->J$pn85ea^s*B)Hk)&Q_-Q9P5ezp zHe>Cm68`YV%Ia!fem(=9MOLSO03}2h>(bvspcXk#DVHQGpIcOL^E$ye3M+H|;5gMl zkyU+|R2xDqUg_GML4^mc9%u1FhbcgBcvO<1|(Vtyi zG!K}S_C)4W_3t=KD=Vw)?wAL+`DQ<%5~R71l;j zVCm}c(hwjK^niW`SW~; z(l1kr)z_`nE!)&gJY?CN1IHEuq2RLXLf4d{t)-@{A+X~M=84zLQJpMU`*nURqr&A_Dj=N5#0A~R#=Vmm!5Q?#u;-W?m$ z0@NvJSW;x(o*piU8iYRgJlQu*`(orD^*btJPUY=|x4-CRau?c-c)7TWTe7kOw@w8{ zoT(qHIm4g62VA+vz$A2GfAxo$xcJ!kcze4C;nN4uH*efkRaHRY>=aAX(N1eYtXh2Q6u8gL&BX<^5)qGALsV8&s5QKX9gZ?Vrd@_(7VQ-XyTJ3x z*#d#9L~GOAtqXc0kqJBVaf5$8y*v2yX6EKy60Qml!Foy1Nsyjt*0b%r?>wFLt+BtX zu+Z{$KKl@ne5X941@1>YpRMj(3{M+LJE-~uZO1&ODb+d8LrhK~ zV_{*puamc5T}Nf|=&ek+PPiJJ#eCu|tElSv9ZKWsmDVYAqNOu`lX+^frXK28v5C=NDH+w%H6W@;! zwARvi6O$JdTV?>(0|+){Wt`h4=hP_Q1KPo3ewGJ35C~NB^~%WN=bq0btq7bj9>f(# zFl{ZA7&SCB<-B~A$Tg&R*efzRo=si<*G%){$B#uTZ53ZW-`LvKt@PCFSQ({49V*<3 z7qK4uWNE_4#6&xR)=Pc$GKp7>e|&1lWo3kC9dcGuSZ^Hx(DN<3H0(klUP^6`xqfbVskaE{)>j?2)Ll$THK_bbv(1K*GP zQT3&(yV+S8{18ac`wgn0V(52Lz*n{fvan=JeNU;$W#JIOcEt9dJUx~+!%s-~I~I@? z8@t~W5U$*>46zxxpXYCW3Xr`0qc8 z;1Li=^tAV82KfKW)Hw#$tIn9$cM|CDilUtTDPTBO{Yrw*8)H3M%of7r5$G z^+os?pVhgOsko@>6}J`S=WlQAh9cKr-G_b$dA)-cPFV>rHg|W`QKM+vX`pgR_F5Y) zA1J?cxSOjd^>c2e&S`WDAV@&?x5VdzJlO79$|<(p(?b?@4RpMOzcI{lYUkv;H6A|+Iu4x8?w%|Jq5%9xreBmn4q8= z_~P|q(hbAI5a4DUCZH6!r2?NQi?kbr}A)s#nRW$53IMNI3_A$!6#snng9VIjTc7M!Sg5- zjB{le)}sZD#7+JJ4Y&0A`q?-|2^$M5Rok|n3yXjm?|Y?3OH7<9D8}Mx1japF)1$DH z3<9NQ5h)*!L)qDd<1IFt;mmHmeII>#pe!p}5+6VA|Akxh>eWzl3zMw6mtT8(WsSgm z_rQzAM_A+cX*XX0;Z50>@)%*usDa~he|gCh=8G4Avem)CWf!|$J3pk>Zd=#e`$JX+ zzfB7OqS~&e@XO6Qen^SJMLKBxbgG+}nAosc8-bn*gYg3Ax9@ z#YN6{Iw?wR+L4g!8E5F|xD9%YJUxxn&^&diCbLbT?^XOH$vnB<*%cfAQx~EGiL|n|9{+MuTURIcbbRz5 zOu10AS@0nH`6Gab)m&DL{b(0P_>BWFG`=s*&IEu=j50oR4@3p>DfY<-w{gv zQC9%%@~X+_^UsI(|0QhwZ_>=n55Y{drlzK@QI#U@@S+#ig&Y;6($v(el+noeSkHSH z!GS(iB%P5!`Bb91@<88%vvmQza7HD4ao#E@&NZ{Pi70w;HgTzoMlExnGP;P+-h;l@ zLQyT;Njm1&>k^RxYkh;zv(rKQa<$V%ihDOy%JK!P>_ooQ;%zu~3?zs>k-+n9-loqvA(8CVO7V!^XNeBE^fkJmmPX6WG zg~oS)(RXm{l8qLtc^F*AS8Ta1ra7Hf;u9U~>F-OIpIcF#nNB-+_UWH%gWplw(aG_< zOK$~Yl*8KEIr(%B1QLLu5B?v5^5Z2|DO5Ggzs)R@>!Dx9>e_D?wnK|7%zMQu5cfpa z5FRvO#A^g6r>5yby2S46Y6n4H#YnRS_F9#Gl+FcpB9(BQpQxW^eBN!kZLGdRF@dAa z%Hm3y$k_+62F+hIGnfx=&S$#6x1Z~vJvkwbsDGax99;Ok8bdD1o%1EE*3YljFM0qj z@_r8oY7EdbP*4h4b=CQbzi>Z1pceMrFq_a{n&A!ov9?_jB*@*v-8Qt6pEgEdOh9MN z0Ezu&HgClWWvJ_zqdQ&d2#l-jVuo$Yc&<39UImwsLg4q?r(IFnZJ&wuIRCz6_oA;y zP66}j#$;9Gl06BdUr69ciFKL#+u&(9hmM4<7%bD!{IT3&UWBr-duA9qwBK!9f{i>%t8+b`ubSe_>Pymhs!HnbV&5|jRic`-u?XfO3pIBEH)M>%BUx! ziKL_uI`;jAwy1-?2FqfiyTqIhx?Z!%VAjAywU^F10u<-jx_p)sA7p`2?QV9zi`As6 zrse}3ZI>IP;0g8LV`rZ)C8^->7KUjKjX78O_6nMyu_d&|mg@aO_9=NwnPrjn%U!Oe z?tCL|YXR>hZ`%9Ym);g;A@M}B=E0Y=)z&fAVNTiEoxwJhl{aF)yRlUvzhvs1op@g} zNxqWacaqwBTVET}+!`129XjOzlYt!`*rG&eyoD@Q_7*q8-S5!Qh#24y)+JYQ0V7Qv z!rQgmMy^xGUpIQbj66N`);KMEl1ec{+mk-@BjYdP7@**osPb5dEx!{?Ei5eD4g0dU z7}^+*I_+xdvRP_V>uY9MUeTtW5o{ScI^D9E`cZhjlJ`*NbI<^sq_yf@LcFMGawq#~ zWrkO5JXRS(MZIdpX6s*Qafj_tU$+z0#uz+U-#Mp9Xn&MdzSdk8$(hAi{FlhN$`=XL z8+N0I=7%POI=4^uap;OF*O9SN0Rcfl0e+EMWKw6_E3P`r!zjZ|d%9oC3qbtE?A*-K zPzOIof$=~eW;bW7F}dO1o+p_!IuGv!x!T$7&{BSZFNchY@XD?uTi?d#w=NB+=oM&A zPPvqXY$!UH-z?+t*taq^2M~}b8|B(YDSipRyrq>+g2uoQOHEwtK)JJemFpgidB(E5 zvaF`Aw_Tgq+IF+M&caw>9aF*^`<v5!F7#EonhWCHn}p2grWOv_p4{?Ek;H6ga`PrT@g zip(5tJ&fEsqV0v;?#cv@`N5}NB|w^5pkO%TgC*4^x-EhAgU22wIqB|MWwF{8Ryw~; z;NgCS#lADcy)G|4F6xNa)~xEe4OV%K>Moe5^iAw$cLX*Hbe=aPVE<#tM-`pbz5VU5 z$l0YO`jf(@j-FB5kE3dDHdHgRkZ`Pg2je zYaj5M|G+GoN!p7^@LFiA8B6chlmSjGJWF0OJc_m9!q`Ou1VYF4#`o^dD7Ke?5-|X$ zrlO3gLiW($5T|abRrKJ{#{(qriI0tp>=N>;s;LE1G=2Ed-(`|zxnlNGb*EuD%Ijzy z$J?(64)QmLgrQers$xB7iWRHbZOkQAC$&e%PH^`ZhD+Jx;zW~ZFlOd-uq5pj<6dX^ z)*nbR-+-0tl2=82>$;=1<9|^SK- zu5s$b3woN`m`FH3>v*Zs4+_FheA(#313Bt>62*J*yzt*TIC1vAyGy201CK%!GAf6L zx=#*!3EH8Y>nM1-zp;OGu4Z?vqr*%9*f=?KOLv+|_T;J1%agqUhB8kZWyE(D!0m1yWDr$zxMkmPxWPaQq^O(v#u zvFMth3!$`TK;NUSYyQk!Vr+Ncmo2;!j}L2~Pnwcw_VsO(QMv*2phOb8hXSFBoTL4h~*XgadV|5wE72TBd|=g)@JX+T`R8JS#I19G`i=xk_0T4d~fq zF+Syx4;dD$I&r`J;acvqu~<_`1zFY3LS^t+o{UDk)(`nEfeP%tRXe^mfWUg<_h1Go zr@NO@;$vvB-<7=Bgwron4^&iDEzBF`PbtKSz>TDgK=rThg=%R4Q6S1_iaYUON$=LM zn}3NccZn!Za1r0JCBur)qfoJ z>p-WM8T2j5ZfpB$=>6dHBIhfqKHepQ*_L2Fm6)RaJwsR5Dj>hM8Lbnh7pE6`vqvBo z-8K)G)U^Sa9GI)=2%Hmg(Ol3hX*!D)4Pz1aqrKD%PZ=7qwP{KnNqpHQslR~y^b8^f z&K|m(1DPaQSy{78Fa0GQGBRt7*N!gx0sFMej#<+p&oD<#5h#+Ur{KoMnSH(iAwg`+ z%n_WXts%72HIAk#hUtI5!jvx1_FMrLlC8k4%H7KH@_|s|bQ5jIV1M3~$+F>$pqI$k z;0z)qoyQ3C#&&@Id3;=E_AW_OR20g~3oub4V>_EzHOX&}`4@q*er}~eH)}bJ;HnIu zpB_B@7~?YS@dPIO_yH8OY5t8=&-DI|1<3c-aw%ojY=Mfb(}c)!D$=Hb9c zKBY!~H8*(06!29v6cWnyV7akec|F#Bq728*Mywt{%xmI}3Rk-&#l zk7U<-$0*G~9TXP$@NBI{r(U?u@6X)0Qsd~lHsQAO+;d>0E`h@_IXM8RvmQsTHkBAELwy?0z^Y>pTxM2=e-#4*1Hh`h zj{=w)8XAabB_2BTDJv@`zE~?W`Wu&B<*Zk1X=%NxM|yVUc%0-QhQfcTUdRAQ5B&)5 zQAp~~Ot=9G-Eo0S9CjIUedogn&GS|}e^%An6sw=E05#93qX`>5 zK3ZFRvtJSDE+RO|z{7=kJC1)lzN)1KyLj*G`tQ-SEjCCco_Jcs>ncf!d+$>x(O>|z;{KUQPSvdf$RSKtg|8o& z8wl=^z2QFrID9~2ec=`(@o~;MEcSK2!R&0d+0{*3VDidfQ2`+k*#6yBahhfBo|%w) z_D)XPNY5JWDd)JB01_~QWSZ+X5K{baJHQ?wAqOHNXolHy?g=|QWEVR^G7O_|YaYO1 z;v>gOZi+9>#l!W)%d(sKbOLIzRz!Y ztfQv~2h}oMt)|I5gw!c-f;q)g61oJ~;O6E9aVo`|9YbA3rFBo5sCR5T0h;v}mx#!i zqoV^b^dCa|K%yupCb%HQnVI_+^B+N|ME%kVq|EQT{UsGao)ifl3-`#s%d#>7La2;; zINje~R+9SGl;QQObM~>?9sK7?V&$XvU|BsNM4KjyGM!^sKKYU0PtL!^D{}Zh0HORd z`N{nVCRYYbNZ@evdCYL~(9+U83{N}k&TYKNZh1kr7qMOpkzkY^+ zPJ{cAsRv9`H}3pM?Rh81biN+{Q~&aR6XyBnYdrtq6a@d3p9Bcn6bK24Z}>2`Z|oUw z=ku+9s83ZXX0&(e%wh$8?9HEZq$97Oqhk|iHtN?KF>$cKMoHrub6{>F0&@5(uVOUM zgMTTUW)yjSS(sukMl*vcH)mg8&Hf{o{m-b+{|o;}={a5zI~bnViE*_qENEk8TZeB1 zfY&WZlX~pt=C<1*Hd<;%N_i{D+e78-T`qcc2KR0Mw)DPEF_Y~+J~kEQB0|r3viG}C za%r?7iF!IdHcsMrAsV+Ln$ecPXW0@FFe`N?yIz)w`FSy)=oVH$2iGi<<a^393K%L?OWu5&s3|Ls6?Ef3grtZQ9tkGrO)Z6`*a zV;{W_D(hc~S?cOiD6wxv&?xrw#xXA~ud=)VG}OY}@BA%O9X>S^0|%kCoWkJFPv+rL zZ!h`H+`b)-E#TD9)KW+m%(FDGR)3X$my-~!7|XA(@wEpNN7?HI92dr3X3sx| zR6#=;3JVLxi}ZTbbs)W^W_l0%_)5Es7ckQZi}+91uG2_zvO*x<+m*>$uyFuLXDQIo z-l1TAcdeEt3T!jm`?UggH>KoGXOeU03?O2qo$o2o$-wUKCwSZkE0c$ zINYN>(biS!HN^(ZwxX~tayCVrZPK~sOGIJ^ehCR;*eSp(4#7`s^=NI?x^@#iXuMWJ zKv4}Ttkwt5-Tjk#M^)>~m|R6?+1dwQ5_(1Zk6t!QN9Z@_dEB&+sgYNBm~@YXXDgax zoR|@hVPp!Qt6Q zKd-HI@4)mm@v+|Qxju%VxVZQ#o9V<6_-oI$x$F6oZ{#?mahk`2XbCpPMgvNAvP6k+ zmWy=j^~V+=7ml{qy-CBT($a1dca4-w6a zZ&rRCavEKB4$1B&5S0*79_L(cB|AfRkndEr=GeUA3@Xqba78g&waYbw{PJ8oR3 zL7gUz8<;3~98P+BS0C_gh9Q#^_m^7N13tu%p044#mo)2TWZEq6uB@&|obHM9d+mab{59LHkSM^Yqh~_Q958d8raDV2bK*dRiNtY{_z7u zx@c}EyLwN#+Kun(c)PF7Pbs3r9CoC<9`{xREd*20%+1gLnpt_sTUfw8*j~4Dq!P{~ z1*&7oO}~XOmA;#WMHzL7pG(;^RV9_T1JJ0gr~}`J2UY1#D^g*+_B)GQ5VU`=Xx__* zj0{1K-WL{PeG5_$S_f7d*0nGHqP(edHV5P942WRA$%~DDyf#vko$_U|dEw+14{t|X zUtjOH$FY*U>{71u?ol0GKh(VA<6-wr3TrPBd%CmqaUi`gv=~$`OH30LSMNSN?$rO@WsWWW8MAbGR&o0e)H3NOO{-c zT+oI9N<6T^6U9P@!lZ;}>Nkw}0 zNny&`pJie7^L!*g^&`Oh+$>dta4c^cHGvZzjXvfwKFCDZ@2}&gwCn8F7X3E@w_b4B zDniK@Hokl=9Cu|%6wB0=OAZ5}&BZ6!(N-GN@YJ`izO-esn_x?{H^og}byk%GtJ_*< zwN981w|=0%j(Vz3k3^KvDn3{C{$wz=q(@Wn<#)PkA76JcE%{wC5$%ed8cFe@6&tI$ z#hp0~V-w&p7>UU}P#w+zlAoi)7T9{THs4@><1w)5)SdofI_yOx9aOz*w?)dyaKHt@ z0?I;SKlTov%{i!k1Wbb3tRT!NFi?*0o`l14A`wfn`~8(sS5P6)$cn_yEYDIC6LT`2 zrghLOiuKdCrI`MJ9}*cSwr_6Ok*ExT9mN}U*h`z_Rnm|;#hnxF^(=0*i zgKxllQjhz_H0YryE4tm~K^t)E#{dh-dfh6csZ8sn2T@KGkXJhw*REki28M>}H~N<8 zc$iEMR$}`PCKZywbt5g8%Jd=Dqp9})dr3Y2&#_8^D-g)=M$a#hPP^Hvu#;}2HS@sU z>L|4}X$%RkN=^>RFLQjNTzU}d2p4g1aJorw{lyCf;(m`{ovT;&uHK~X8<=od+#n7P zUUqpq7(9h2(ON50Po`2I=cK9@xQzF+Z(&8)>0fZj>-<04?2WHda(;GCc??#2_0gH; z5;P%~K;?V>mHx}*^H;TB=w$E0&+XmD3+Hqs_h(S|LVcmrd)enD|D}-spG*E5*T260 z@(;DB@ogVAN}#y3+ep?pyK3k|&cr{L|4+$D|CN5>ztmLx5B|}W*v!oNiT$8NZS72a z$IgNpGIe!i`^yC0<4~rP#oue23+Q^F)3i0io;Z)8qpl)Z9(WEcnx1UsrH7X}5sRwb zh1dgRAjBP^{eV3AFAz$*WS~?Sm%1$UXk2P?!gpBW;4s_SHaLj;Q&3jxfi7phAefKF|ODcb6REY%5B&)XdxT)HWbD=cs7wBnCuAKco$R|1#N zIo7wd3_=)OD!1fBO)ck-HHf1wUg<4c^K~K?uz6ROAC%;Kb!Wj~Gc2=pb~cPeF~{LR zn``imdqmx5f;5Fw+E|*|yV_S)!MRrs;;e3#_J$gUE8L?J5K*Rl1L^=Rh22qFh-d9# zwsjcK5!P2yEh1X>Qp;fHaSO~Q`if6XZ~f*LzUJMf+nnO_#tg-Edj(1TWo$kOZ2jkA zpCsq2Yp|h4pA+qZW6#bgT1d{qPK|Ef<_@!Y0fE6{NXMhogo}7~JS;$l(E9CL?|7?i zr?Oh%d{)(UV%8$EWLxJ^JJ z{*b*6cX0>n$d72%*21jE^fhu^*qK-9X7}LWs?p4K&I@{rNqG;mg8Y#A5*RSN5{sbpM^ka;}L_s^@ls;l!D41l0`&CXJ-i$ zJ3AH~bJx6_tFnq(KMv|BtyDLWv^KTayW+$mfk>a->wC}Fl3Av5!Kx-|iC5aHBOwLynzDSAwUJo&`0cIX#{b3(Eh{lp>XkNoJVIT-G$g{YRhNBtYecLOf zHHoId%x+T66zi5g#q_8v;qnq?#pn5&(3M$?48pR!M`bgdSSYt~&xW zy@%+`U!Dc7IxAVh+QLF4*6vA1v^)8=n=~}U`{<($e;%CpP7WCO@j}@^%4pze$njJ| zLz+xvyqBY2gX)8max4)A1CTHYpBtl~3d; zL!s1DU$NKxY9WQ3W_2s5EgWF@xF=U9oTnStXp(@hE^RqRcspVrFco2pX>+T%3BAwJ z`A6G2$x~`DWf}e8c!lbHh%0NW%Vb|s77kcVUS1wAgz4~L9-^2m3_H!N zKU^)Vdl5n~ZrWT#?Rsjfqdn0ic8a8m0t(vWe4E;`^z_E5-pwgLn(eJk0jIBHFD%9d z#w5ze#(H;U`OKW1Rt`3lh;fozAF8TsH8o`)J^J}HL|ho&Vg(buYH1lCTXs4;Tzx%U zyv}oHlo!0G2cDs7RAn+c*6^k2=F_2~@;Cn8UmHVCr&@;8lQ~u6p{L3C)*f}OA{dIo zO1+S&*(D`q!)6KSYLXuf73Hm+_K#=J28(o>xd`COj~Rs;$%l9Fd`^A=Z#s7{;$AJh zoiS9%UhD)Myvi|gf!C9ShBCw^9wInG;`xoSSJ(5}x?`(0{IJva#2qv;LTE)DTE&T) zI&{9c&AMX+#l`A|ymqGpw@RC4TgljU=?FUoAdpU&=Oii_An_<^&1XmUZjFJkCVP&O z=V~QIl?UM=5}z{^ay=T{PU+Dkr-8F32Ttz4jCWT~mNwqj(-GgID90c?TvkV10Ck8g z<$cI+bvQ&jI8K~?d;A4|WL#K5t#L3+xs{vWMkExCTSz8cU8foUlA>1S8r<2VAP^@= z&uB66W)K#;H(h+=#x~ghQn&Elc-bKQomM7~!`CuJ4hARV5Cr*(&6hk}s3ocuAEvb` zYL{ANE<)JKmbEv1hbQl=+pR8~3YdKzb04U*EQgypf2zYVb@mMQZW70ddxx6Ybr-F+ z4P~_g*335ax&L~cPy>6G9Y{l*SzRpYZQDXt*{v7*RB}122Wx #1c7LG7$RvD%=q zgn0EuSQhIQp|Cqg8Q68#m$O%&jhj^*yYCFuX0!yti^i(-yi<`+r6eUDP+||;2R)vT z1!8LyFW@cG0!BY&lZtnsZ4A71N*UV@rOV69004*2Xw*66f|DHUdb0^g(q-9SZQUw220 zz;Mq6OSW9=VY8#2zz+x-XYalPZE9-T2gI{qsvIZKuGx7N;Hh>mN;qljL8I*%ttUSG zsP!HbWPelrr07*rXHhqq`qFk#!J$gFqMiuyRxj1nt4!F6AW^6LCS9ISYZr0rF(4Qg zv)^uV2VSJ5qYFM4N_V+*w5s@+O7mdAQ;Ke})FLY(Q&z z8soi*DjBy_uVjvVTiHop4_gsyL%tjp>lZGz%{*eg^jnb@s;WEXm1`&s05PSJo5FJ%qMza31W74tY>xkBs>O zC7^}r+tF$m9Fx@3cyKf*6Uf4N;AgeaG05AbxHr??^u@n-W-p$ViBBBfR=xzxCNn=5 zK$WGXp#?wfJ;bQJkP9^84W}=;3e1ub!s&HPUiUK1Ouz4U&~ zsSTu%b}3tcurWn}fC1sJ5XXC*h(@Q?sf(GtS^UnUbns_& zs=C{P<*EA}vqSL(5jN%$+(J}X@~kKnp`)j*df((deS-{3xB9Io&pv3LxDUdCSV=Bw zisGIK9lzB82u+aX^~5J9C&TQ~EuRc5jYcCl^YU3ck^On&w*uk678k9|$d6B`NzQlm zsr%22dXm5$H2QfZt1yNlZw-C}?-AOb@A+#xC%woX)MjmQmF@9n^ziTC(SyUsCcz9C^h=t<+V7n330Xq%;A5YRT)L~`I{ zQNUY2s0!88(gcM~u0sS9k?k~6wgVD@%!mM`WO)l^%`*{~dJSUxpYWyN zs!#FU#z5P-hxy7wbZ0^xRz@sB3>n zQ!heJ{%BUic(FF+iLTw{wOsu>77*G#pXahOu>$V$ay%1PyEPpZKm_w~9^!mLNha)RHa%cz zpc*Z>$k#=qcfnfEDEM!c%c$=cw{(q7HAOM3mAPz5Vd8P<$Wun%a0%D)$5gLmXK7A5 z6LDBw8S3=a65R*%4b4na&VGc{R5iG6L~3%5m-myKnG0W??(~-^5*!R(#7nt)<_NuB zO*b+ke8-sK#ibwg_tWY&3iwCrJUyGIhtx>t$C9Rh&&*(c&P@yq#6*V|CawQkGB&gv z?wd#mFLdT;DtQbOtu52ME6zDFII_g&?S?&eoyuY78dhrQ`G$*s%wfq^VBLRrtjl+M zmzoYCZj#)2+s~Rn$NkqlSDgWRyjNYhwWxP5Rbc3QMQ`PDBvg{6KP$_myKbWjq6b%+ zO_VeRv2A2sk=;1Hy4A$eFL}K8 zlqb=}$w|xUnAhI(O(%vZBY!I8R2yVSde4l6DpVZO6W)+`;A8(!5X550wB$CqulC8Y z>#{#D9xIT%?riPWFHiY_5H>);@^vMgxU7=*sjVyT)d+dcxPAdon*ro7K?woG z4ImA7kc-T{Sf1GXRptL0Uh;ncA)MnHXRyXshStf({`PU`I0z^%)BpBhMo(6fkPz|o z(nSV5D9=-G2!L39&w$|4?>Y8Wlg?uE0vH>10*2792uKsA=UqEs0 zRPu>}XX`6U9JJlyEh!HPpCfDBJh9E*49EVV`+!QI zec|5zLxK%>;GW(bQVf?cKKRx%4cJ?|w*bO=&tfsLH z$^@$?HEfJB(fT5;(L(Io;s$A%<#b(-OY`#D6rrcJ>1FUKaL}A|Ceoq~qlU6*++U6k z%$fHStxnT3u12X3;l%d7`)?>MW%vK))Y#d=@AiKXP!*o7K<<5PJAIJ;Cg7R2_T-w! z9?!gp#XZ>i6_v1XRYMKWMu#6wbI0B&B|Rup8yBnw%2 zg28BM(cS8f2_%c=ue{<0mQIv_1FL^K`&sKc$o!)anmEgSdwR*w`GvBs!f*mLs1bfJ3#iM7NyBeNn(2iOp0cSJt3UGPb#SAdlM7j*SJf^)kFS}n<#e5WeMMwNbV%_~R+s{F{DJ;4 z(16wM69@XZ&+sRl4<49M*UWV`L6?G2GquR;SMT#K z_+Ni2tCZ^SF+IX@*XmIRw{_u?M(*sUeeW!j^>iJN!%Fq~kQd7Zq3M)Ue(ZjF#)4w- z+Sz`sK81b@o$fmeXFdwrx*+*`Sj}9po~PhYL==Hc3gG4b6oVAApJ|prd4#@nCQNcp6rW zOMjdhxWx;?A+YyM$)oe~SbuCpih$DO5*kh?{7XZ|1NbBUa<9JQ6}Pjm)VGk`a=ux; zWwnKsYkzEO76$;r$jHc{p#gT?(vF5cXplOye zzzCoxq&g=Xx4*R}-3cd{thl#AEyZE{>T7een%hQyfBOR1U830LX6)v3!(|B(I^HuL zZ`=c}HJB!QW{5?OrCd>K`jA>zVD+OE{F2I$NIbcC9 z&MR?lvoedxshX6nA=X)(pzdh&^* zwN7wN&3=-OXjew&i({>`H6aHg>yFG4{`%<|{arD9jh5lq+v3lW_UwTp{_mpa)ldGl zgriHe;v)Q}sR@gYx+6;-6j>1*U8T4?S}-(3CY}!}pOwXk(r%MHQ}_KnVDWCiUmf zlT(Gm3o*MUY_Gfss2J4)y9OdC~nN6h(*@dW$X z|F}K@d9F9FfbarQQ?8l@)r)qh-O8c3tp)_bC0MQ&Et=%u8~az{m=?@}EwJ4B8PNH> zJ#V?`+Il7?CVF3ST@XqR(EeY{y>(QTUEA)Bg>nlbEv+CTEgg%J?vySC0qI;Itr8Lf z(%sVCu!x0pcXxN!A{Tq&eLwr%&pY0CjPKif|FPF_IED^oUDv$koYy>$^E`jY3n4U> zbSI*yNgk)sv3F%0oKpQA!_$Mk6KOeYx4=c9A>H=l*?OCZyTsj3CO8=Bwsq2tD;4h|pu3yO8epC{aFU}9onU=Wqy1iI@bVAv|*cvPg2mnQ*nnZZ$e3MLI@ zj%6+6;}e5!ZOVaeI_>j;BaKu-eQpD3(LS0930h+wv>0E&bS~zc($um)neD>6d2rvF zef|I#Q_S<$3ws{gvK-l!w93`K;$x6>3(+ok^n`e6gSAo@LPknR$D-UeB&~F6zleD;+S<@ba&<#FUDSyu2OaGhBWkiK$CixLTg%8C z!~!K{UF|hqMus7kH=6hq_|=X)pSbns)J96vQr_|xn!7*_m-KN>(%#>v3E&wlAp{ho)8jRtj)jE40qwR z)Dw59aV~X>9QGjCs&;e6JtD#$Pm44)2M=qj)X&+od-G1RegR1>{h?KWq07U0lsT9Z4+?GX?;ZB(4&HBbk!?eBt)?c2nlL&BPZ0k|Ev^ z7L6hIjFoWkGFAs-I%E+>Y4ENMR&GBwK)fvlu^zrY$8 zQNarY=m?grt+Mi`xIDC!CmyUYEUW=MLn=RUL=^6-cQBcrs`mKwFx3C8sD_ON)LYvU zzs9P@_MIC?R(?aY%@CUZp>%yFF7P zeIuMjmcw3z>7wW2nAh5K3dHR0ut&61q7=(INIcF!jpUt?-K!1JnY>6C4Fq^!KmmquT5fN4mAna{xn z!Q=4B(M_kEt2HhmCN?RKoh@t2(gC0((GDKw(shdTr~JC?-!1A_gyl-iJdA9Uk4bpu zQIt|IH&T-pW~P7jb+r}sfQPJRY-FabyIY8UbA27REmBJ}wo^LbaY<=Bj45+3Av?{R z3_F+%cZpdAfCpm6M&9|Qm`mRthtq ziZc9{L4JOZK7&X*4P;9OsuJ_)_~S1so|;5Qmmq#=B3J;%B*8_0CKebWo*SIp%hLR~ zAg1Ri+G1c&1?^P9bN$J&n^J0=Od$Xy@QesI)|FRIrm$Iyj#!KNMiD}&n?p;-Tv>*V zW@c7%F-gR1tjds6@Y>M^5f00Y8i_E>x#}#zCchD!QTes&3DalPjCPbOe|OBN_Bx}P zUTI}`^qoIRcDaWAi?Hj^iP2G0eG0YHDN1GW$8{V+)(Yd#0Q(I#Noz(7iFp~uwo&>P ztotgBvVqa?XqUF#IV>VFLknX)rRb#4r^NP#V~;>*v8r2yA6h3w>{dPO#>ak*tfi_DhsB0^xz3N z$NQnF7+sib=wlu6SA%ulf4i%1kX3Oh$GsBsvVHyn;MwG5&eCe(xT_98LjtfI8MmQev$KO zJ^fxTE+W#lJEf?iNINSxh%|5HCmvQ5oHAmrV#3;`VdATGjC<~`u! znD@4Fbwh7|6v&4X2>7Gas%^$voHKfYC{;hKH}0d%OHssuWG|@ZA*-IP7Zw44BhQb| z&4`H=2U=9N!gfeVNIdM;-1yyvUpD1eosX{2sg;*~;$H^gy9?qPj`0L7gpmT%3J#kz zWgbwf>y4M%Cnd_$ro}I3;|%nDMjhoynzet3v42FKp*cK0{*>S7TjOwEsq*3eAu;wF zUM7g}CeKEl!SQ%D0A*tRRb$coQvH5SM?wdHG2t`zvhsM-nM+N*A7M56Tbr8sjseWZ>fUH- zqpTC?NcGxaewl#9vC!?9Tzy>^?Q=`f%|mE;q9)szA&||RXFSL2Gsf)zWI?TR3A=qy z5`x?!N<&0bbMr?KGXv1t4PulS&oI4H24ElJRA&I3H6CQ~cBb!GfW~uCPwolhE-7g? z{5O?F&&YTdCARN$2zl+nrE-!D=!L&GYp>XRwUd=5`A zJ0VdiiIhglDQT^=xc(KpI5SI6wtvLFF_=B6^gRcnjj*b-|M+TW=)pq=F}Y}d1S~E# zF0T3OM046h(;V97aG7`X42;qIdl!+bVs?+WN{vIotJnS=p#U_fx_V{1g)YKSDJ&>a zQc@wK#wCgW<(sm!I@tn+m(4riJR<+tkV&!Bs%L;$QkIv7i|}0@ygDg_?dF&!MRh87WV1< z?!q}xps%*WJTlYcLoc>K@y26vyn|_Fc-RjqLo$C9!sJI04y=LRuzvDNnw~?H`W{;n1xM zdFbtclsMW0CzsrU0^AP)$a3o!b;L8GWGUm1DI6-G*T&8qsW+n>$E6s;etOmahRj(0 zGr3l$CuD9?zSaiAx)0cM-6L9uHj%#=BN6%-tClV2J$qRYpH^&Mi*mA zg(emje!e6%iy2yTt|#fr8!49TCxi0i zXz3nWoKmc+G4#X|l!K1Picinfjg7xw)M1`vr=}rF7V9&I2nN5&yaLBZ$yPH3tvjS~ zEy)?^rpx~h=~@1qrEvSV|Rn|zCPV`7woXFvw2;^msum{5-mDP$m5P|~Gz z<6t$onVkvCkimK31LPlEo9}Ke4h~Fs4+9MyrxD3X9u0j07E|R0fQ+%$sbxhF&KISel8H@gE{E;Q&XBL{bBIM2E zr#rJwuNXwNAaZiONBH#o&dd85d+^fYQZ1NmgjbiEv9Xb6sF(EZ3B-JdB#3O5;SS1= zTNOh(LFhxt$JN(cyAx0`xsBgA#vN*X4~MT0x%gttr!vT|uJ1+WYpbYfU4r}t`T^#8 zZ>0B+XA3(!HRs!_s5fAzW0OVn1^ z)3Y)$q%z6OPhd5vc5&E^W^-#@&nhlwXP?WzWVyD_0Rf`*1}L!7-o*W@nwBA`EjFfe zi@4)Pk3U(~(6B||23g`9{&o{);yM;Fz6ZY+b9Wz0yALQMB7!M(bu(5HVV{ZFcwh4G z7D=38Vz9BYj%B9Se9ugLV88y(WjL|IL4=3#v|%@4>gt{k18mpF%t{@(O2>3tZx}^( zi$dIFvF#*^^WZMgRM6DX7?P-W=1&$5e(m|wohQG(-m-_W@3M!C=bf}lSoCub0dG#?Jxup;_Ld!w_~0ktEnCR5Gm zVk5Qjo19ycBKThG;#(F(wwbBr3`~Hke=I$}j&jGG`JC_Yj%Qg#g)6edBa&XrW-9^V zTbWMPGUtBnZ96cgmq*CXL(4`#J<{XW6+G9cS1aOV1|;ZB4Z-gqF}d_gMzi+ghM&Q~ zT*0-r0R&KzF)+wa`qSk7?Zw3}M`ejYGxith&~Ap$u>0Cr=G!Ew7aE;pcd%NWU)O=W z3oMov?aQmht-PI@SM?CFbE3(KsT!D5JR~j!maD(+YYoK8m2@1C2#^Qf2%z#UD#>N{ zcbhwWbqTZYSH`E@apSI5qLeqy0u966d9`ICNyb`4W?FX|(j~7tG5%M6IMuC9WPunv zD2km4hAMzOj#NX@b9t+z(a}**WCyT{-3;9XI`CT1a`Hw%PrQX+i(~YW_qLq|;5#&= z2fBd&-fsvBRrsp*j0p%h;V+OH8^*|^LdR)7-ncj-ftx)KQ?nmWxvFG9_8^IlP>kb) zW*@DxKK_I6fg$KA;t}pYda4*VQGj9*-@;k#bdDT6Ve8Rxxd0RBudpAqpPN6Kpk$AV z-t1&UPnf39r!=JZ#HRMHt)#lv7Cf|GJ?Ao?jHh~KTm6yO+5OR-WX{`!P%;qphrk{< zYaBhzdP@K1c>oQHFNh6&6d7l>EtNd7rZEW(&3s=PNHndPA%rW?M7r zm)Cb=2d|vY*k5oea@9Ds?#|2(%oeQaZYjzbFz^X@q4X2q>M-wR@C-#4+51&cV?nT< zRvH(wHty5T?IK2m`zJ8Zk$G|U8nWL@|*?k5LVsoN!}hr|=Cs109VFR|z~nU!^WJ@@@&* z&|174{|AM*dSsK2_m9o>?WZfs*ufR$6|cK6L41C=@>k0QYv$lkXj%Dl|MMppN*MH8 zGXAEhhK3fb`p2Ku9QQ^eGp6kbGsA)rjOK<0#Q0bM-OEK~G;q-5LPWIrPTB=C+0m1z ztDNu4G+n$`vnz7(a>|+`5)_zyl)F2>O21lr@ z-27d|ZZnDZ!J5vyTqym2+W5}M0r;HORKIb+6FQ>OyPIf0t&0Of*=Q_3(GVPCUy~i= zj1EEck7sy%&eP#(-`!OUbF06|U=QKh**(6V!c|`1XT~{29t#_|&1ALvy-i62=QaPk z85w_>XI|p3ul_kzO93gvcdUC+DP!u(u~WXZ0Zdr3Li+ z4yJxu5CAGIn(xos{|z2!zJ~u>(4EiCFAEgScY5dx*#}z13lw&#muW{P_72kGNW8 z*1-_*rWsBU39f9Qe=IIGSw!e(5va3=m}zQjU~(VoFrN?E5*ur2G>e(y>c&Sb!}T&vmvJd&%6-_{1T z?LwglEM*ZDQPKw&14hQinZB|hpm<3J$%@}bBPC79#18V+NRO^qF*fF@uG%1r;1c0= z@7!)a^Tas0fl$3TSpU7<{Z5&gm6f$HH@l>yd`PkC`|Q2`(d5nCxJ?CP4@ zKNHf^-j0ajE55Rw+0>?sw?+#;QDwX9Gz7B_Wr9P;E>!pj{_J5&Z|MBdFf+$%>Bg0usLv?Y9 z{57^JM}@7ozEn5GNa|#)R0w4`2i@G}>-V4H^nLJaJj6eJ4lhrriyp{)*-X>-f?%ip zBRm|J`_(Jk`~-)jeSV`xdu9TLZb)YRH+NxA&&Jm1nAnjKRiJuw{L<4LRl$19N+FxU{j5m6r4Y zx}|b=QkOL5-ps2fM?OD(kPxyTh)nZK;*c_&VLmP|E}wHjwveX&20B&orNcXwaQ{jm zI*lo+lTQ*2bGf@Y4~!<8x`Ew%*p40q^}`t<&J{yes1^{Mg zKe2GB#{Z0kMPUUMu+lUGiFs>7W^rTAle9wE<7bl@o@qzTghwJ?sr3as2yIxzX&a}h z+3(R=MH$@S?YV)8i4@&grS5}RqKF~t+Yng|)52RTPD=!ykPvD~L=5i5LU=Iq?a7IS zi6s#hP@DI7RF_wX=hp;e%7@1UB)Zd2OvL5uIKLr@6$TB^!JE6Bo7dq?W1e-3hY*YUV^JSJle?G@RdzKiL@Zw~$deiE1dl-b*D-17C z1d0FDTigr*^0KD(8@JgLhMvGx{88h+muqWRhxfl$-GijPk|D=_M*AeC3(w!H>Y8uU zlnzW*K%71)FE7Psv@$g>D!1dc`Ir=R$ISdga~2RSyCwqEXuE#BBIOGUeUANaG3{zR zh-oMPii*JVXZa_nUHKtR8Hiy@0{78X!Z|T78oTI?cD!cLHyR%v{uz;|uYcHOLrH$~ z0a!%qTV~5cF4pU?j_1Ch2EKqCmDP;>>{m2U4hzzmFFGOnkeUbqf(&@ZVjRac{lSdR z+vR8XAe7WHNiH+8Jw384F_Mb|_kfyT7my9#DOI+Drzi#eGJlA|_J`y6h3?yb!nL=~ z&uaD9#i>P@B3&kbkJQv>q?T7Jev<v znVxL{;Kc}(_(D($0m~~YRX(yGXcn>DT26Vx9+s@^q9rZsq$n<4!?x~@!6xzSJ+eut z&+wO2gNi4p8d)!UK=dbvqmP}w^MwJ0w7I)_PJDxziwD9w6#5dKHx(V6h424KQx%1) zZQlcKSNDMh`k&ALW4%59o7dEUV!_Y@p86jIXT(`pUVggdU291t36x`1-ROmFZkdJU zTWIC`ecvX56;VQfCBXiQ+JKU!cBjA4zRb$V;L7PX;To;}xhZ)q zX=Tw5M&ckxH$Mo{d~d$|V|#0N%V7HQ8@RR5Jh=&9$&f^0i6#&wov@@vSF@-JrAChT`BV zppX#PQ2pP@3;q9wYj}wf{h08@?cEyOe$y+^jaVpfZQcHKj_jP1LGN%rP2LZ!6kHvb zM@9SjcCHmmX|E)~Hca%W8BQ&q?uHzxL{%ZdBQr8GqHUxIU6`KH?&;~Fr>Fn*)&2$L z?Kr-t_ay&RWM}<|6e}douHZS77K^r^f^R^aOJi|WWJbodET!7o9dTM+W|x=ufI@}M<%73h zzlsNu5vY{u;DFBV<*glHk^%sn31M-C_3fR5wiji7FMhxElLV+5zUL<`ZBuk?FC}it z479m9t$~5K8`lpF;$mY(8-LI8J8ypq886*Sex|#($-yyNYG8DBc}^lP!GlX&s4Iq$ z0A`e;&tGx9**A9pd<229k&!LdM!SjX+q?b}puc|)gIfOh#?;h?yQdN{N9CV<&BZlp4#N~kZ zmRJzk$wG|>K@12tm}nSW5IbYt-7@lj7z;`oXA2Jj3SPSKW~m%r1>>T#3zf^rgB|^z zW!?WyUbXexW$!5tbY&{6BO6p2_YuYzi#ji!6yGyvZmPxW49ux5RuK*DWuGfMwINTppRiMz|O?b6o%N|+vT<>m_ z8Oh<{e3EsJ;XO=rq|eSKZQikAOW(81&G9GX0d;KdE0CbNDcBY9rh;XTsB5`YM{fUc>MZfiPt@{46Md7 zSb=%x>j@VZs95>db~cH;CRbS@lw>Yv_3-)&%oAG2S%sn={{~Pn zs@vKD+n!txH`VT)mOOr%^Wk+xN@3w|vo4n-Eu49S<2990Yni!ocy?!3-x{a(oPNPz zVl2%)fXA@Ey(gNQRkf^Oe)S7&fPYq39|d{>1-^@e%%K3P;<6MW5a9KwiiFqoBe0y* zf7y4vffh1EIcoj&&ziP=@xv83R1Gi3c1p26KKi-uoBXrr*OIt1y;4R^AJ+Qf#?I8} zWX2nn&z~=Fm)9f+ULBlaRr|R%w-4m+QKCtNfH22*HulOO^ESs8Anr&C5{VfA%E40 zB3xa4ZF^TpQnLDEa$o(`Y74xM1{-tMqYX56eFDe7#x9S!BAe27Cq%v)zye^EI-VS^ zt{P#^c|=Lno~}YVxvPO%dFx1ucK(ke>EX!%ehgFHp%L&QPTki_ylg5+a`6!ek1`ma zns7rNxTLy@8m^Ec_%+qv(Gv?pk-phvh(}! z`w^w;^uM$KN*P&M7bc}XtfTvm@`c}O&BY1SyfV+Xu*lD6$f++o(YKt1 z-n)WrZf0b(hA-n7m&$Q+uu05N(^pkhC&_Wg#0^2Esy}Tu4>W~k_7UNe>O;d{nT_lv_uGh?Vh!S$-~uwi+ruDXGMr_zaOBLfD+nCtWq}R|{YySy90OR?P%przna&0_%MKZj6K&9^Z$~+7@YJCUt!a1LdDCvqz*tVnAsz zfqf24cq1CKw7CnY_Nod$wX}ckZEqHE3B370Kk1yEN6*B>K!``kXR%tlkV0u#qQ~J~ zXD~+pdQCer#~UQoQ@^=F9*UnBHHifkmzMVRaZ@kiV!yA7pT5e;DR}JLDi#!pK0Gi` zAX8R;9SW>3*~OK|yKa#i&j|6cv9JnUvjtEOGp2Uu$_&5z`I*agAA8gy7v;6;NjV*U zWF%6pkm#yIk61da8Rddzmi8oMrPT~0!^3kdQL`;xlI>b5Ia;TPx5UQsgzVcpa*jT_ z-PyFC1A860%vWvXlS$#$W!cp<&tHqUDOy;_ii*a3R#CaKO|8m|vI2>{&ssl|4D|KE zf~3Ph$*;3_Xl>h-=Z@(g9AvRq-#?>a4QKZ4JuQgiYR6kk*!n;b1>TNXYtdSOLj3OX zA*zPvgoGgcs><;Dnd6E-RZa~tt>4pzRSZ2O^5DC6e8NiuuDBT}MR0Vwd^Cr^b2iQE z^39-!Evc}J3wZ6-YIwBS+~>>d)YMQE54aj|)NaiH8#tN!l{|&gQ*P&BK;U?1R8e`2 z{YqiR1iYVw3{JXBbq>T2WPb!*=sl-2l@YO4NM^~mcq!VVvxd|0k>%u(MEm{+2L~O! zhQ>wxnZFm!z%%attn4F)JT zLPFoD3?w9E@QYEIr9D=&+rqiQ)ZH3$KO7DV_H71is7v>Yg>(S{6(yw$VDW-gYOnZy z{i(poUSa3loV!O?MS`Ato$fF4n;kdZL^6sHHH9qRbp4hRs!shey&8ojiBP#jCEecr zTU*?LI)}GScXcnPj^a37ZRT_;H=lL~wEIktO zDCdwNzXyjE`2R9#|O&yIJ;DH_Sf;o{isX zwe221R+RZ*>hNkO+_?*H#gIW()_5>f{0GU-#*S8W65SnCu%O)6iv`^FJqj<+&ufoX zyB5>yj{`kwUFP5CanUmoHc5N99L??3RexTX9>7|_TZzz}O)OySUHI@qt8$O$zkrft z9JJwt4#VNJ`T06}VVtwhOslckiDbKd0!Pc&m;xHWKZ4l9_0VhGWlx*k;_$xRV^%EE zevVLMCa)V993&$4Sk!h13JUp8UcELrw_d%5|9JJL*3Nha zVg12oFyd1t4ZPuH<8>Y!W;UP(b@L@m9Eao$)T>y;$mi|HFGB?zt0I>o3P!< zp|(QD^94$=&EDa+;!NI7+@c=*{kjTZ(OOcaZ zeDG=dHy};Vf@<2HyzBxZG7hPNpVD6znz4{(QL`}UA%eEpn(?X)ioE?yMxVKb{f3WbdI*mZD#wI|n^$50@rm(TsZ@p53T z3zh9{`K0&1n))70KQ1KUOY9#QzyiL}X?53Adq^#WW3P51*1o*A&EiDTcQku-RHe0;lZ4}hvZNLKk z*D|ikaFar+_k8k~GXpfDKA-j9z(_r>#5aeHjf03Sv>-j@ccy%1RD>Ep9nPDs{Fl^} z>W84z6D3*Tw&{5Y|I?epbe!8Y1pd8P^6j?#f1`>P1k3+tKk1J<#^kK%ZL#dduv(Pl z-wVhD+fA|1;=lMA%4Fio0!kUSW4q~@j)}EJ> zr(X5BxZU2)4&riZu5F%|C=0xBXojfLsWyyz+1S}7TkVb*D&x6Ae#Y8Lfr|wng7*N- z{EU#9*60+}SF4iiB>{s>CV?C6n41;?J)rmdcLRSYfP@Vq;Z{l-O-)S`6BY3-^8VbD z$hYPQ_h6x=m0}^YvLc5-w9x+iMD1t*PyXOL_tS2zH~;2TYh~)^&;IC%Qc()#7dA7K z<()EG#KgerI*eL=bLc%l`~t{s_{IinfkxG5o6(8V2t2$$u_a2?M}R6`I6E+KoP|09 zV#jY*>{{FT&F_ND@p8;2=kdQ=v-j~f|eU4M37NHA^!OgNs%rk9MT7;i~ z-6Wn)6|CB?lHzAbQc@;8J`O7#6}#a&u+qBv{xQCT%bBenME%w6z##aY4G=+lJ0!Ur zv`0!xOYM%UY=BQBsGRZh^II`Ayz}*|@b&i`1Q`JVc!-%bLk$gr5SL4aI1b6b?^+g> zwqN0=p7r|tZ>OWx072pR^F^ttiyj{POd&V>R^(_;{=)z21FW$3<{Xo&sw7zA!@|PO zDpQITuOP2jY!AxEj0}w;BO)*eSzhXQuLILAdQNI_`dD75l*n>)gl_N7fJv%5(<2-WHC31I zd5{!fmsInmK`^8Um=H0$iOE{@OytqW$Z#06vI8sO3zN&B0v}nK-D<=vuvRMENj!SI zktu(3)`Ur6b74Q(8E1KVc*sakA5Dm3$Fa3NSy&JH-0&E*YnFMioSzzYGtiTelGf|i zoZ4%~zU)|KiZ1-w1*{Kgb(IiqB$n`_Uec+`G5;d(UO5~bY=_E$C`Q_?DQU?Rt~cXngn@NjXrue?g_gcXhf zBh+@FHsDe!q7uc%-C8KF_QtI(EQG|xQMS^+6jUpVi>nVZh=-Jvmx7y5CQKx4ivI{& z4JszdcQKm2`4}1+CUCon{gTg2&)2$ys(=3MB7WKNE9@3SkLV$_v$X}5O~>eL&E(t^ z6nB9(QyI)pv3ld}?X85Ez*wBC*!}rcsh1n8x?Q18WhVSB9?P4`Hv~5v!<<>2Wo(sY z71x7}#%80w(V&Ep5_mrgtH`q8h@`*Coiaw2v zLRwl=zVd)E5#ul=R$-j*hhjoJ}iW8)#cyTT!8U%;K?dmlM-5 z`!WX0amKB3(;qcZMC3UQ%|Wc05$NL={qd58#kS*QjE;bthl{cLL&rL^PL!f=E6CP@ z<`;3$fd^sadGX?RM+eRGHwv|ynwsc4|6Esd!whQ zpehX@qy2yQW1qLQw9L6)p8!g{j>`=8!D;u#kffhv<%~^@g#3C&9*RR{7(8HsmGMV9}rK|!1@`J(x|IDOL z4h6)g_56YghcBt<4Th%E%^d(*uIka!9m7Pp8>?Z*keB!CvBTFLbPSTyD?L3&#Qw1A z^Z&qYvHfi79}h~XyDpl4DjAA#fN5=G6Tuk0`}R~fXAP#895B>{Qe08&blRfUMA^Fj zn)PqeR)_T@e|+l&NFdb~Yl50+u-AfJEtc|erw$;4)-zwM0dhA!!Kb|tH; z2!eaY`d?bW87YD{`Hc#F-NCA#az<{jlv~z?72S;Ib}c@<$s2g?JZ@qX1HeBr>#zAn9VVkTp9s>-D^smdCtL{q- zmGFx}yFo!yE32EfEsv1_P7V_mJAa8n}!S*u*l225efHkgf8SHW`xKA#+*OR>+PETYTYVT<$`13>FRg;X5@dK&ri0ypivms?MOs@;jZ31G94PV=`1oml`~XKYPHXWA z`D;encjTc+@A93|f{@RbUZOt^j*ol!qoDNsa&>MN<<5mAyO^2z`3cWH?gc(2;;A&dUK6q=2EriLy_o5D=YqSdK@V1eOk!idybaj*HRI--n(#dBW z8gVqc%GX@kE`FOlq@Mhk0>!78!|q{_y_w0`j~0&bD*jh*P_>JGVEnWxYzG z7u8rnzg%Ng`}ztUfa9w!e>B#yo55f;>f0)TB{uaB-VlRR>zmg$qW7$6WRtk5S)9K) zu(DFRU5+v=9%s9vs>DAEOyoVONyWv4e$L2A)j#u9oN^zhSUVn<3pNCOIQ*a2WF-gN6K0+E?kyU3or}IJ zbUr>lo~`# z*v7FE;iy)8lyd4&0E@R1HY%|jBlUUTKK8L4k#6kcJtJ^~Tj>!jasR>h0+``W?~cIf z_z7|bvZR0NFEZ>UDIHb#6dq5wk*$B!N!8WNbkrI=xWK-W*W$1M zEi6;ltp|DmS60kD`dQvKv{JS=aiY9ke=7M1O{aWy`sFggvisSrmWDB_2oDpr)_uy; zt1IQT%?l4|s(bFjV3wm&fe}sugeAswX+2d zhtLGLb#bj){^;2jFZW8fl`p?4{T;jDP6-_S)!K_D&wMSiW5nenm%?Vzr*qN4MwX9d2J zvQclsT=8|{Ut8x6e?2|~B}#~$iIf>U@)|vNh5+PV+0oAgont-$7OIV_m%kF?ykcWF z8?RiY>2iw(40w6@EG%|*Q}D*+7&2|6ICNF*#R>{kt8l9~f9ffT$cZq^BTu$)04 z5B2uW{shm>uB9EYE0M4$aHjJ;SuU7V27Rq@SY!QABB#Z+7vBnuA(Dn zd}QS6cr@Rk-Q}-S_BGkc*^tQ4;RV@;2^)o3E?IR6bbNM}?J^GQll%UQGBxTKL`v#? z=#Fha=blmy9_{#2V&xv=<&JXIz$AC}Le-&Nn(0c}aMfVpQPv$zBFU72Po`5%bO2!g zxDW>G+T=sZIh+%-=zokp1F{K$q%xRzdDBU>*!*Kuq! zH1nOe7amr)UyeZOtep2l+5k*TM|%dlFMhDj?V7hIlbFA1YxYt(6#MaE-^~78fB(}` zD+Hy7$Ki1{PEwvn-%p3*sPm2Qdj+)@v2;=NrNzbB`T5uL37nc*TF_kL@iZ={`mIb0 zv(Z@{U0qZC)V#dcU7tMe8#y*j)I$S6_O=d_UrAFFfX`ziLu=26FhcJfzuUIXa*NJo zT$}zGv)v!HfcHHZ9cQS(t@c}DBWkxb0XlK{!1}pE{f!t&N6tfX_p)DA?Y*-L^Iz3* zy#0`xI!`q2)0E9@Bsl z13>}Z@-IXR>&y2FMdgn4-4Z`9!i*I}G~Q;|Z+yl)zV4sS2i;pt z0$Pfyqf`EI0DB9)72WsL(ei;9qmI1Q${7j{Lr~gicR? z;_h=&IVykb3UT7rsLLOzd_g>0`1L!`mG>LQ?r zboS93F0j8d-KtObo`Djfx*}v9XZoGJ2@gKT+rO+5`MmWf*8Troyuk<;6jrb{UY<(ct5(dI|-M_`EdwmZWE-^L*O?V7OyCuV@W1?TT zWJsk41q4o%x>QP~hdNtb9B%;Q2U$r;&`AwG4GlwkUw!Bbb+jAzlC@gj4pdsi zlo|npF}I_UF{Qn_)6HBZ0aoz6M~K4wY#K(!-GU#0_YhU-D5~KkYUus<)%9-833_@6 zHUMKQJ-3Y&*aZ(aH5C;%{P_(gV%BAOKV&+d+8z| zze>%>(A=cc)6*j+{#%jz@;lw*-mP2q%F0T@k+ifFaOqB;m5`FU`mi-h7VzNyeQmgY zOF*B1p0YCKiLSJC*W*6EOgIge-r1P4{2xgjB{>XSUR8Cqv5~!vqoAau$;aW(9nV&~ zV_aSx$XHt!)p-g7Km)LR^6$c{$gQdy z#%-1?t9LjY9UY6$2)dAQRvJ57Yt(x%U~};zGJ--??2o;ws?dcICCdhU!4W*OsxR@v^Q4EYNGZ)`P}^>sB*Vkr61^$pPKwDIyyS9ZYhXH zIm5iWx1y*FU{9vYYz%CbLSI)|4+tqIG_)bFFPVyH_*VK(QU-vn83tzo4|H>RbPpc& zXH2TDPSlcrw~Rnnf5hmyop@{J@77kTjKGdEN!6G%VnaiXm1^k6iPEVOt zm4$uKHwtRI$L2ha*9SoVjaL1+*q`P2USYjZu*u60$85{X*=Df5>+T3UI}`&7h%(O( zeZ^l0FjdwdG)&oIcTE8u&_4-4NG9XA0d8%>#MZg#;$(?}vZ<*Fn1O3(DwQBTp-Kqn zsc__BzXE!vrrHKOOJF&$vSYQv zsduk&^`ja^LgK=Py znOiHN#@4(&74>;l#>~tNsuE#Ov%IzjjVT=Xba-f+jx^7yIsEf9(D?~y`k#jrpA!AO zA6TEW{OwPP^5aiyIrvBaS1Jds{WLVSg2`~W-A-#aSl7G)gA`(E%WLj>3L}xj9(=rY zFO%o4&gC6zYO1AL4USPS`_+Qm-Wwac%#`Hb9L|$ddDc{MEy1Eofdh8G{H^>Fn&dI> zi7CM2h!o;xf+H{;yn^q{ZF(9raCq+x4Fk%7PO`KKr(i&*hMC^3S?}YK_ibPqWHrX{s(nCX42Xh&b+cNj(GIQ1hWN%xnJ5 z&B`!E)P=5|q$kAOQX+)(`T5kciGZTc5yEY@dj;aRR#Dmg{e2!c+J&)s*eh@N-#rerE@E)Cz_)=rT&9e_t!%BOwPckWu1jIAHC{N$gGg2!68=1-C4Mm zM|?$OqK;;W0p)6UBJx6OZ)|k*!NUjBunSZ@y(HyKY)&^MRMo+9?QmeJjZyQ>n3Zo| zfm^Yj+fiK>)!Gdhc&n*{(sjny{Wsq&AT5m7ZhnX4?j_Y#zsl?~$C&hZ+^?c5IQD9& zsX48##p8}0^SgR_pc8|+JmkWT$}gTQP32FCMEsopk|3~mZGWVuoGGJSf1Kmf>LbtL z=5+WjbvUB8j*Dx22HKY2$9oy7-Ow^|J~~2|?L!?*BUeBnEV~ zgB}<^ukwhK@NCuk7EmW0sZ)7T0a44ZSIJj}aB0G&`2$w!Xdm zat~&+a)_97r(xqNDyWbnS<4rb#DjeceNgF-m^IDWfcAY(`h z>P3V{=GR{b(?&@BYHAWQpWF{puT0`{y7($EbG-|bM;=Xg*%q4>=pOgAk)NLpF@ZwP z-2Q!DW)DQ`iJt2li4xDP&gh=B8dva-r$pub$2sT4Tx4j|^A zr5{YPys&M$EabD^+aq^dBy`#X1;1CTHRS%y-5X(g*K@3kuJxxS0ljV}&|UkXH9hKA znQ}=i2ieBDZ;H(F5u}mniikK)|(Sn~>7y`;&uH=bauzSxfzegPDosMqZ5a z$#y8`cOTS3kINM>7k;^Tyq*3{SqQ(HW9Q5-DtqH`)p29Aw!A^s)V?6>R?Bzq%9Y%0 z`Od-lR1?B%c(d3*%<*1zmW(!uG`jFNBy;d7g20_clF3}t`RTj2*S71PO3Z**|Fa8O4vFz8({ zR#ZiR6h)VIw?Q;L_YeB`$5a$;XghTXBB@ht{SDcJzuH27~R~Omxj3h8P0-S zjE7iuN839c{%HuArlY+9wek>N|MBx-)xLSyBPRY%3B&EyO!jBbif5?_2o5gYMG0!# zYfE-vZXfk<-OOa4C8LksfU(}~+b20W7DZs}uz+bF&mfWUI$J!v3YMe3JUQuzD1d%Q zQ%iE`b)Dbb_DV45aA_cW@C1|1{2m$@Ap6-<;Etv%QZf1 zWD~A?v{Aj~p?f+-%&4?7OwUX1wdsF&v|G$RJUTpn;3p^{U^Tl5DYyD6gk1Ce6dCy) z0MMmq)>@bTG?qr`$89XkwTBk%E9_@)-@Pjw!n=zuo_tk6IRxo{AU~CHjm|gyQ+Y4}sLyz%D)_o0Y2f){lX3{!2#2ZcGPvU5XvlYBcIj zreY|m@SGpt%dL$C{nHIKVb7|q)nO|yugP(D|>Ik%i>Ej$ltT@!C7$}kK8<*F#Fb{N(dYGTQCWU##Met z3rkCh3QLh9aqT%4;EU&D%tM|0EwY85{rR7zpeHTMx@E|@@enKhOmlV-!6@15M zdoe^r#`sN;7vvDArVh(Xkf;K2Vbb^-3zOdTR>%2{XyIbBZW=+G#E>qXM#;>oEI+4! zr%=!FQ!HE{!j-Q7l?yhpy%JNN^V*lBcCKvn(@ zem*I`TBZUk8z}mpF6;LEyS~;^zjz7*evXY*t7i;!00b+og6yT(*pC?*ndd9nj2RQe z?Hje~s{~2XQ;V~+Ycs{`X9R$u;Pz zbR-jopPhndaO{#Qs-j{jDOnj35>ib;PWVPgb7gAk(S7tUppE&qE1C7aT9yI}3#-uk z&9SOZ$yOqy)V-}OCMG6XS=p`*zJs!QP%I|Pz91$iUxfTY#6-FrZaz8+h-PDB1BEYJ zem>UG(cQau)0iqf-oJmpSZEkS8gqnobh5wN6Z&g#5O&x?WRq``HV10@S4jeELtDmx zQZsUs7z@yam*&^?RrHhXUOZxF*X-KJr;E>yAD(4W6QI_CHQdF)U+19mk@QKXNk;Q; zZQTalP%w=4>C+c{k1MP{5Fu}R-#A#EKwT8hx#HsEm%;3Yj>lnentv{ziUFbWNX0Fg zvmedP3;9(WG>`}Mz1KfpH+H&p>oBOJ$hcV{kq_)n?hCiPm&W+&owdqyZXP~kSjW+fjnGWSnyh&m5uN^d00m_ zPC7exa(vPq_k3n|sqfysdqA}J*D2PVX@>Kj^OWI~zP^6I+b$XFu&6kvHRnNdj78Dv z!NCF98Ucip7HmGMuGXb#2N*{_wDNmprPkBpv(r-s#rQAIJh|wcoT|`SZBQ2O?(C^C zD_B@sAQ>dg!%$UI{vzUj!%vu>;^EvK=;U|WG?+cyN|NSuz(Ny2t!$=jOPdni(*aQoke5#1a^UodUlXh6 zMr|c&`T5O%wNX{qz(GJtOr++u9vh;`QU(mW->--Fle;3PBR9&e`0Z&$)4N04bb$+Z z_8qghuN`qhI*GX#^SK4H>oK~;nEp-$_i&@7myYv!6%|8>GHbE~AU0>YQDNNng^8-T znDr@Z)v62&Sxy6}2mX2rGVzIzpiN_(RTvuSK@ZtiJa0`OgI>|A}APPtTY z06CAx;m^aeZ7r<@8rkrO36~IWWHIth$HIR=JZ;``3JOFlZ|xZ-8yfmrhh?+5iwaBZ z9AR9%TtR)VhjXKADJaOEiCm7vAOHN`An@iEC=vk3EQo)unjORo-KAm7 z;Uh{}1#c?9*Vc-VoeOSI*mdnwFZ7 zH7vcLN^(R~OWG3X91O9Ue7J1Z2hl&U4JULj4a{MGN2DC^(CRerAQvZUFkNf<`^)2AmP`k5U)ga}!urL>} zcQmh%5P6?CqpaLElq~3NL`!=+G2>>|tN7!+!3B-&zD%V)Yt*+wna_87`+6nwB)W=9 zi*v2(P{{UB3GL-ViM@vbHnyWvW!8~0pX_C$g$zp_En~-L8jf5$TE%a>ExdLz-o$uq zw=%jNvobRuTlHoB3X0XOG07f!C9C){!cHub8&G503r>=pk}%4X;c;<`n29PvGBQnN zWj@o9*LBw}e2GyW7~Bp< zUDH5jMh5-DsXOtm+7l9BbB{wTX`>j*> zejMD^7I-iTR}#CRyUaQ_M@3VvSInYuxp!x{C?yC}2^fdiVPK@doShT6T?4(nYveMz z1QL!q2PgmHs;4}<`L;>qg%a=QE<@I37r1t)@c#$RySn&)g$r^|_mJ4M?MN8q8 zYknJ#W$Etk6jZw%wiFIt9O%l+J1(G$=exp!#s}X(*(ve})HkW@N0+I(9%nTEf(*>R z(a{px%&O9Nok=p4&wr&T8zy8YQ|>X;GUaHd;I&j*F8Ql3p!GIB&C>5b02_NiO1d^e zOvk%EHTx6XO5?O@PrdVT$+^L8WtM_(#U zeM@6&R!v>Uoj@OX4M4RtKai3Pg>P>V)a|YNIi!ewu`evo{q_w*`p#;55IJ6JsJHUt z_)G^@azV~lgy$3>wgq(;dq3+ECrgUT-1aBEcsY;y6(BAh9#R= zm<^H}5Ss`RMb->89eR7q2zk%49BIp#QCtNX2(R zqd!#dWHu0Z-s?K_*B|YewYpzyqzaej^b2ncv%AQiNoA;lKo_v-2SB6`*8_l-!-wFY zVEtMnbyHJGMVEo+gX0{=`!D#t+A#5!8Nm=8N)@I87q|3mZ=`@b2PjjBQ3GB9XiZ#mnnDgWMO=I^AhSmw{LdUQ0F zw!WhPLCEoCvR1wwR4O{z_m@zXSAxjZ2~p>?|0k>XGc8+JOy=*Ys(=Cbpz|DyqrKGyLZFAERrHqZCE?si+Aov zsS1{CZbA{K`|V+>s(t#NXGvXa8xvH-$Q{1c-d>070~)Vots{ziq@?p)nF{ASaG3D! z56JlzrucGdz^0+WzKiz{Zoc+2<`=YE7+G~oOF#MU{<_*FJ(R{ux;hTAPjsn5?zarJ z91h`v%(6^zGQa7We63osTa>g&#`%SLzz~)dsoD)LzJQ-c*9m!Cq&75X>`QaB98Fq} zd!Df7N~9R}e5%wbUt84W}4-olpGy|IQQ^s`n3iMTVzbVI2zaUgov0o1^Dh;s)+Wme;*{uOa ztb9f$Z!p044`vg4?cwDx3|@*t91R+)o^Rvn#NDP2pw&cc%Gqp3HZy9|nGziDGz-Qt1aU+Pu@f>mRl z3qo9G(4NZKsl%aP?fJ#UrNZ%cx;H%6Y`reZYm!hlit_R+We=;8J(qjvniWZ6zsSXY zjm>IKveX1Gi0<+(MWzF>4N{)4umZ-^(aafvrl$JPn^6YFBpR~kMVhQuXZyJ;8WX#J z=)$67NUAE(^vV3Cwn}7VXh>*S!gH9XZU+s`&44b6CsRGm7iR;Ob#D4Iypz^Co}JSN zFArswYw)}6t=?HtKX>_xkspzg;9%oodAm_NM5ga~DSPqbL%JPAK>P-<7IAN`55AQx z?20Y<<$;OZS!?s)WLq0E3l}mYLu;9M<5BIv08jLs={75Q5(p^cCqL)_A1v?*usXP= zo2*-X#>SN|pD6%I`XE?ygQCz{=^<$#azjl7@e%0>R){E@pN9g=tnOBh?p@>1b zJSg1KKaR{V<6+@K0jUGW_&=$13a>~;I&%WIr_*i-9eoN)XeNYu^=R)82m9uaa2Kvz zXZh#-JJ0>$`4}_TzTy5(KwV-K1Yo6gR7!?E^x8Imb zy1M)B>-$1&ER>m}e>O|I8r##OxOzqMo@&>tO5`6m-7CE=RLN{GJJ}+ZIc+M3NYULOYz@d#N3mXp+G_^k&n7N=P6$fRRMN*r-_*1ciByaA zX_ip@mY-eXXvguSF6m9}@iCT}X{NsN;LVr-+GlPK3hJh^_EVMAYc+TRyw5*}g*@YW zE=X9#Xtsf0s{MeJGhdubk4#x6-)0@;Z(AoYdg_padv_ch?Au?-zjQeiku;a}Sfv?f zgvKSrDrk_Yr-JVOpcZ>gq8t&0Zkeeb~|?P4Liv^q`n8G$lOs zZ@V|2X{U&qr@hYYkKD~&x%V1{q80cpX&z!Ws3e@uh`383P_MJl_`dvTtw};^!Ne3$ z(V(FD{ogk2jY>D>*XI^z$Mh&HsdS{J7y1}Od3bpOy912<^u}ID=>7=5VG+VWzvbj8 z? z{aZjqR!osyv!6&C@!R*CFH4s+i-5bor< zkhD?kQD``ztmXg({0a`JlB~1*PLDTdYJ-&4=m?<2Ga_F0OzDHgeGrZfj5^+O1BWEn zdt2=S5M08ACa||66vCgPBbBP`?=PaJhO8dO3_YpSORMr2ZrLm{TJk)V@qnPgUN;Qu zaPQdDJpuw-M9QDkva(P)H6JOYa<+PDe?RbR7>RXShRtK_x40IpeEqTx3L}tFiu6uw zeQ%(H7z_!dDr+Wm=h0^x+{L$P9I{GEKp7(_`2`aFUFg&7`V4 z43Ws*2jK06hUlhX@P^|Fw(%FYUpXBrx!y0y0PMJrkT)WV`|N3u$@KR=pAra8WT~`)XY`M z^*h9BNeET!LTeI|tEPAl%#(8Nj4W6JFn4~zBtS|vN=aHm@poSe5HRqkq!uL4<%d>Q zMegH=&M+!IP*a6!CLj{5O^q*SXpkYX8|(Kd>#09d)R0z)1KJ5j=BBJMd9qnbEmbdS z;OVDjnldFQo*f4U#f0HElPLq=RxB(PX)Fcn#`S8EQSu_n-(;S?seWZ6$IS*LIY%?k z^VvUb7R@}QPQ-6ov;GDgb{!|cXpl%Zlo*PGSCs|PQ3$zs9L9Y!_A|O?g{rJ%+QMx0 zMD%c0mBS|7cYj~+Nh$CO2YlhLUtMYiQkrj|+gRiz>h3OpHU*a6hYC?=EpO{=$NpES$EUw0Hqpy3@=$LJg!_b=*(dwjD~f`%R;1 zaCc*-?zw37PW)^IGJAm7b-+*g-;#(#CdqdKeRsHlQOdD=Nm+^0QFzPWMjhSu0eG?h z6YtAy@ET@c6A=k;7k}FiGX6vXPGG)*+`NY)sk~S?0%9Q^g0a7t$h=_>Z$8i z9obd?r8fkl?-V;eE^cUenCw9b5PFcf1r*0uELUdr_MA(>Ky1MqjS16*$ zd(&TrO6O!on&2;A67T()y<~%}e}Z3Zdc-Gj>03T{fM7~&?>B{{oh{d9e(a-~oycvf zVRSY5;J*gn57zd)y;r+LZB~hT8|8+&-`gL&e|5%nmVq77_3SO#)*v6zBh5{t+fsi!+u{7emH zopo?&ENlaHa%Q3`ct$X9KZd~s)t^4h)RJw*&ufFU# zJ6{(~WwTlLIdTo{%5RYNjg2Nrdd1fPCno#&->pEv#Z!LX!C0t+(4e3m?N?qNRh%0T zAcj?eg2ep90vA$mQF*lBat9kYz^zWO)HEtB~rnTtB3}{3L<*xi3ssRqbKT{jV zgsMRT1t|S$_mz0KF)*!8;IT5=%x>0=f0r!QFSZ=W{fD5EDt#n9I+6poRsVgp>Omdm z$7GrZ$LO!)f}Y>NF^5@-C`y%O1hMwc)LKnV4RxZ}JRdW^ zZV|u?q|pPi?n~r}*8ieS!y}qupcZsWNvr1OWhpL7pwhYOeT&hauH+`h@TAhx=<{bF zCm$P2TRN@W&1{n5a&){)<`b0bE@84;ByMk-@ym$o#0vfITi6N2MxoIofc|PoSO4k@ zZFnmAG#Q`E>0{SeFi)Z2qch~d1gl9>sjL|GW#^{2Z%j0a{Gyj)SH3Zlfq|O;i8RGk z3pmow-D>8x=(eVeo4fJvSXi4|TUdanQJA=~v_>~4U)rw@`oWPaKXF#4Ri3S~CC0h* zIb(OMXx;X`I|8n|cCz-Vf7?{VbcGv-R95$JclptD9!zluF)U z3kGWGhEkud{-MI@cqI^93%IB{Y6T?U06g2d4En1cc8#3mc#h()ZsVVF03ZEr>Ho8o z<9{Kt2#~$20|~&@tHZ68>q(lpB4}jegTF0EA($-`TTu9yj${gZ$xp2Dl$+&ODZ{l7 zFPH7~y#Iab5C8vpJ-}$Li z!(AU7du-WjJu#m-e=%2pjFbo>91a`^1VR)O6_f*kpdCRVsO@*Jfp7MfUSWek$RII6 zK6%Ha{RL=k)G30u#||S9Lh8dq#rXvts7_Bhy>4c+>u{c?vUDilHkj`%!z*om_4TIk z*@wpakIn0!;G-FTj4_`+gnK-Z9nr)VUs)erNyLM|=T+x=3UE+lib5u)Ay|+pX|``->t<$Hkl^ z2^WqSRpC^{yaIXRzeWTtr#W`^WeK*@31Waip9WYp^b&rJOA@1qVULMdnN$hq%dMC~ zgFwJDEm`HENg~A8(R7!G-4H+^DuMO@J-G;ZA}N{t2{6-a*DKG@0>CiwLMtNGsW2FT zK}uvIS4T?bU<9Bhqf!iK;f?)%by27bL=g8;G*MNMCN1Kg9r z75kN^!1I3Y<8>XIy#;}05VV9r%QB+`M#qDZN?;rDF~Z(ALhWI1_DTXqY3+5p?R_K^->d;`zl(IVxg*j=MyPN) zR}Z(G&iCta+~?uK4O)llVJX}m=lee9)a0!6^aaAvaGEKHA0kG8um<9aK}^qjO(B0? zjOfV-zDS&Bk;q1B?h|ZJ0|gYw6N&rjkA$V@_Mg-(I9Zqs8FGXBYn$j^be_FiWA@jG z{JHA!`^`-TNBjaqT6OrCx!SkJ6A~Dd`-zmfL6MxqRI8JXeu3U^W)C-3G;{Q1S(KE- zk?~OMuU5Vb{W^4>W&Ck`ub^F=#H|~#J-u^=5>P8YLd53Qkes}cz7laoz!MZ2@L{oI zVx~^9N_;T|zw9LNZCEM{v>*NR&^@VsV!OQpJ$|c|NiUo#?&$2qwg?UgX|%mi9U<~j znLXijIbJs&;fF4WqK%wl!GwNSsmjgDsGcu3vKXi@zIlELvAg=)bEd?IV>bXs_sKMo zFXkomrDQowYIa@dn5lElKJ`V#=uO?~*z>GMN*$*EF%;dmHTmF2HmD_+FaM|j9==)f z2>*2>(ArwE0Kvq>)GE?-%73Gy|2#autO=Zw6V()B9-I+g7Tf7AwMrc7zLzZa*tSPp zBTyJEHpcn7co`T0X33(h^>3wonQCLN*^VHztgG|`xd7G@twSJmeS`!%J3BO*&sy5r z2DlwV(a zCtl&R_UJD{+U)Ro+)l1%`fC0XUg2}02MHY>7QX}mp0uQ1oQ_JSVu!G=h=}X>BojL$ zD>Inil<^C{t)nn*TTXLmUmtCWWJ+}kZowNN)|{F*Aj-?tjXo0vFb4-mM;9dm?t;2T zp;Dpq)gx4lCLdw?`R|@AA-Hu)*-Fdz7A5dX7S2x2GS_MD1G}9R3k&KLmdL2MN(IUz zN!*JxgHrrk@E^Khotot?nxy^e3vnNU{R2@Ht5n^WB2azLh+RcA*1%e`7nh<*i8qEkw!%&>)J~FNf;ldzJy#^iJ=h02m zX%+^Ag;-hJjhT$gU(uS$w|78#);V+4kgJDj#6O`(prBc)+6kwA86z;_oqGc+;nVrW5L@i)BLb(Ud%nih zn>D&kzQ8XON2z5Vs+LdhP!k`BfmfKFh{qNPEs&|BC&Xd7TS+}zk7%n z^9lt8}RksQ)iS#6aBm9nf^6orK4em{tB@0=NI3YPk>Gwn* zwuob6$ra-U+elzp+B?V^V4aoHCG!&<4#~))ZSfsgYPRE8Q89tDtYqfun#J7`G5V4S zrcqg>3EJp=P}Cb;=Y42U2x_;wJ4_jU$-T_`x?o3N0rlLo{czFai%zfY8g=~@{xWN* zE~0MPb*>Y9{7faM$K&Y*|IHc3VCvA=STfP;be#`1hurczep0ngM|?Z0LVeLRE5wmq z6srVWPBi_(R)?n-^dv!wCF+Fi?7qy3G+LcAV#V?WD9QJ?$#?n^7$utd4Uv(YV6g9^ z=y%3IX*rT0jQ3%IO;%e?0WZ0slrkeM$8%Ug%T3)YdvEaW1S5hqvqIQ1oAM5T5_cQB ztNm1Zr&r%Os!c2Gx|WOsnVvUIBeup7D3cq#<3G&enu8l49(`OQG$rcpzSKb3i1^C~ z-6zk;y?fd7nF@;j3s#mgmDpPQzDZRAi^?1fNP7TC-V6`>w_;?`;!GYRB`-(61(F{P zt80kaRsiNpmlC}u=i~piyGAXZc{4Ri*7y@9bfa61msniQ3ob+v^>!B;3RJ3sW*RO| z3@c9Zg5ye^`G)YfXcaWK5kFv~pkZR?%ae23+=?gLj;R%(1ulDHnh5dhb#n|Q)y12~ zz#YtOA*pm`HSc+g49-j4s>~1M`iBI-IduWhBpkY43YcdWE(AEJYoZ=guyEL)OhBN? zuq~(1H7pQ__cERKGk~qW(6h%817~>+JLLcz)i@usc7aT04)7}@3<00Gnz z@o5+YdjHcT@(cJG;?RW%du;+I%Jca?A|F!2(>6wmpYP-!Gc~G&^o*z8dIOJUMM$AQ z15+E&zXf^rcYTZEi|~{}1ue(@!J9u}Cjf^2#4v*S)vV!{4wf#+QXU0ZBGEi+ zv52%Neq&=bpL7SxiECiD`1z$26qfSvz$Y10A2{&#tH zJTLjb3&RUo%YWDZ?T*`e>3g=KElj?1}QN29TV7Y0x=J|JYF~o zTvbsK+5HM`4uwKORK|o6XD!4eM3^YTze9HuzA3Zimn1ksEE^?Xo+`p$aP^Pb;HR`2o8NsXjTA+4CmhBK%^JV^^aFI^#Ri0CiX6bxYqt{{5gwjq6)Y3pDomLfgcYYmu*T~o$@zKKeo48qVanotT`g-ke?vQ6E_ z<2Yc)AiO`He-5|)Tt#TWSVDasn0-epHO@6LmM2u-BFC>WbWuo!r-!}4<;7_?1DYad&q_kS22IC+-s3< zOTzMBf_Gm?7z)uBS>W^px*ZQxt5?&wl<-$BJAl_qnK*;LzFXChakvYoJwO)`GMb}E zX%(*QC72~ekB}vt8KbNMA4QdR*N}9`@g`*Xd3O5(zWCcq(nygsBIyy11%J$)t5TtlpK3E=L&C!$Fq~(tJa{U2j8wOd*UXnD@=eU-6%3eUJ z91$*x(M5#q|GS-&*23}*xSgkl=+HNfQF5pU+sc3$&}fJ`2K5l*Ev}!w)E_=0(Z6Qi zf>beNn5Hsdh5lFDx`<*4cEG=IU4cy7I84hf0Q&^B&}6XgPQ|lSOZQcY`qAbQeZ)GYJHRnU$@@$ELJ1gOi z(+xOG@N_L-qstWmjGs4sUwWY1?Y`=PNF?_t_<>uHh%%X@?U&%~Uw#TTCK~f^F%lkx zXg)gcd7rejGI7O#dItiTspGsx?39HG@m)p08RvPWht_rek=%A+Ol9^vA_X)KF+|jh zL?SnNwkDZg=TA*+Z0YXG;bMmITHbct9TEXuUwUB<0;%kupVqhRG(jLv6VaEI1KTP?)zByAl_NG|5h=6&~ zVVG%t3>_YA#VyCXPrC|Y1G0#NfLm=%T=WNsL@?fMh~(wS{kuwWT z$QI)1*TOyDvlPmByW_#Vft^}fh)Bv?tQ$n-i@MWEifk-Y$;*Oc_;J98y~=_^Z&*o; zavHTKmgOj;t|Io2^21e%TR*>^HFhd-d3c&kZ?c}Q6*H3Z7t3u2sz@S_1EIFZ5MVXpDSXV)Fc28GhbR=lGa_X$ zp%f@lgVrhqZPNRTkdyP7GfmBuXv(PEiN2{~T2+YdxqrI8MC@--Vx^J=YWrB*+DuTan!_Qx?K)P)8^{+pwtOD*jx_nvg6^a;LJbWKk2vN! z>kc@Rs@v0OQ}`IFXWA__m#G%Z&h)U8Akfx2l+s*!T4Q%|0ykD49D>iCrEr!r=6-!M zK4YVqk^*&mnX~k}qT;MgBy7s!esA{z_az14rKljHA|Te;4PaOL(}R>#nqy*QdHaVUu`f!cg5U%$`p`#4t%p}btEC{D>h~z8})OC`;k0Q zU&eOx3K93=-qj<4j>My>;XjkFqsHM5mhH;ChYA-vXNfh3f!o{Rif9C89ozF;v49c{ z)|#wtTJLSKmq_RXM3;&B-sXBc^s9%=jca#z8UNioOv5b`g@P|`6+X;G3E$3j)?$8C zLXJ`e&J2fk=hGJs>aP-*O-ip?_`udm)N}jtPdY^CU%=*R97iM5R(WcsxerR#wqrVHdb})>l@FWlhlnS2cN~du1 zSZ<5T+n!JCv2-C2{N~Z(W)FXcGM?Wh)TUq`-P&IXeFF7mCc--?5djn;u%m$3?i!pe zx4*8p%A0-q0D6no(8KLVS@pfjI{EgrH}Q7RW4>h%i0PsUAoqgr1Uw^Ey~i9q%5P<$EsB!gH7fv)R10&So!g z^Hdj0WwYgAH5eETY=`3*Od*2c_zLZlKBbb+M4ufj7P_gZ>%xY<$#`aeaLaq6&tG2O zu3HwM0l8X>uc?^|p0Q~nU?`uDKu?rk1j7t1qH%L$GMSK=fWsTiyyw+K8%^OjN0ydOhg`kwPjeZ@ z;B&iYj2OAvY(2WQk**yS)6j@#m&^H_8V+h8S9kw5%?)qsN(A2n>Co=%@}ug->A9`A z%gs`y_Z$5TcT`A_Skcm(p0zDQC_P|4C?Xx1KQwHUXzJGd^{!U_4qg# zF{3m(7eJB&)D7}*o~1N*x5EVw$GyRY-yK0AIF|>fOwC8rjj@{Nrt^@M8X(ntFnXSi zXXP85^RW7)cRDbhk|&Rw{F#JYf%N3j;387lir1Ql>%`^5=MY)h5e|o=gVDN7zj_Yz zQW6xgM)s=1MVC_dwavD!r-RwL%%BPe=nuWo)MJ0FK7#|v*f~i_nQ6G2gvLnu_>S6j zVJEgY*w_N7SuSYZT)+O_L;#M4Zs(iSi9$t9`ll`6P)3t$R=VveR;I~p`$DE4uMQ72 zc+i8|r_AT66v_qfn2YQW7HH2MzLW(Kq485DENQ~O&BA#X|-EQRGH2IpJ1AEQkH>brmJaoi#kpN3kfWUv4T*p&h1D)6 zo$nc50W7lER^MZc!kgF2JdT~3+GHYO{Eixm_g1u>C=_*sM`toX9tu%M`1>Pvq!`I> zgfQ{AN*nK;V$@C-2BH~qs0}`AviRu+-Rh#uPhQ}j<482Uw5PoO;*l=Jg7KFm3c#N( zASk-^dhD?+lgPbPG4({%r(?t^Y`ynitRpk16!ljvfmw`Sezpl>Gm7hvl6!e;zWlaD zczFdK^v9=o!4(FEwAAjFTwqm&`8-*BzoF}8_|w?IBOq-dDkfnsd8(N1tZJqhVj*n# z9${?a&=2~$z4#?wGSR**hs^nru`t>pZK z$Hbjq7N#y!2>bj6?oD$8ynH`gacZoG*_jO%3YB(}hKhnBgiVZ6=7r#qH)3K(@U#}98_`XeiNN{L zVKM^99M8BIpvKy%wm?}?m_pj~=UFhlayaOl@|ZxhpKe&ibH$6vT+L@CGA^sS}k4!DBlO z3e{*)1e=@xschZaFPQ#VH6#?n>IFmIdGbOjCnvF4$0=9UDh?!G?p!!6ays=(5+Gw; z&-s4!3&s1cDE$?Xo&rb|S%$K|e0jB%Ckyk#S{5e4KeA_|n(1@C&@pETAP8Ha%f8&Q zUZ+um>~v#*!Q=AJ1IJ?qCiO75A_*J~rqW=&8a_ODaK2)UFdHZr;u%T;Qyncrtor@a zsU-9^TvWUO6|;x?yk}@-?O=CRw_$2vVxn*Cn{tj`RGi87E>U z`CxxUz5^J#ZYA8@Uh8Uv~cU0 zZkac#zK6Cf&%MqnxtHiZc^iR=)53OG0NezcrloavH3CEj`&<^r8!!|BUK$(?gX8PQ z(2cB*JiI&n7m7?Ov4@@t05DB;HV=$Xv2IUzy5S3|Octu?>ME+&`(uOW;uMID-ukx^ zX&WBzfrY^*oJ`xW8^iW*Up1o|Hj&$=UtY(8LOs5%MhNH|$BXPsW{vnRgzcy!52KO9 z=Y{oLLOmbKMvGAaoGT6~bFHKANAb452C_Lqd7?Tg?(~sFjIgagCj%L2cPh(Kxz?sE zZ{Q3(xKH*EU$$J~&eM4#g(Fvt&+icW?Vy?WAN12K!}zCS2v3fZeo+wt+Q~Z)>+_mi z)Alsyr!N1OlI^KsUHkV_Gw$uztxJgTX+@4yMrv~X6&xabtT;&{#G&v&E7K^V^{2&> z`OM?hBGlVR{Jq^>c7Pa0Q!1t* z&~R<|wIia&>UP->8*8`$w_$v7TD2DxQ;fx>OD-fwjM6h<%7Q_yc0|_pd{p#= z$9~#3ir$KiF?1K;{{ACV=+1Xa07DmVXf4dl+^l4F?Xf)CUECtBm~FZq_m9;ZUg^~n z4j-*=9su>f9Do2$_pYc1*#g@w3e81^@!z|rpn9Vz9{Q39{K9S??RY;`z~kjo?wKf< z=-|VJ{z6ijuKqcNI1t{io`@15S|m^ZHck9+ZEWFd_K!_0$A>h+BdGVP52*yg9?vPO z^qV4%QLW3x&hZz|D^@s_mwW(y>DQtp zgJUIn9(LvIb*nXN!$u!3);_;rE$yj4jKihcC*}0n;y6fS$oL<0@(PFi0cruD@6p#n z*xo2rg+UUDiUaxU%~pNPstZ>`={FUIc89|>#!h$b`3z^6)Y(1&x5rE#e8S@v-xvk3_VC4$%dw283CR422OHi2c1`}=A3xK40#x4DiL8J**H%O za1E4Zrf{VIqLkX7cZSBu2t_2 zHF1N>T+n~Wnw%ynYG1ERWniFI?iyX#lnhNLoA&j}<;Qg827t9M_Qs3l@^xbeKSCUK zI32I^5ZsUVTMeB|Z2}R+NaSA15C~*Y+Q}>M_w^0#WT9GvazumE>3ZLqh}!GL21M7h z&67yOF6pEU(3^@pzpzvzMx3SjI*+B&fb4|_zpyBA{p8t4U;MXKCX;EYO2ry1PsGwG zTr6bqJ6D0Bq3KI;gk_Roh22aTk|0c6rv14MQ}?AZ7uv?{Nb`kbwd91y`pbi%?zc5j z?u{;XW^=Qps_CvOw9-TV-J)$6x1S~oAE*9ieY>k3p`!y%Q4baI4i=&$kL%{IR0DKM zRbnd6`}#7})JDg@`>Gg2y#H2Av0HAhUkGMN=V?V4Uoyt|Rq17n4BgbOCkaIw*+0+|NxitlK`(w6TqeyY;k8B7tx5vq7 z``g^53UwN-a#!?hN#hx!&He<%3Sql7YWY?I2Hox8)J-rNB%hJI_X_}Dd6wpV-{_Xr zN|)f1NT5mEz3aE_i*FObLKxM|M0iK}Tn|CKa$*v2JMdh}vT5l6_saW{WI_)o;HpvS zFJ81*ZG%}6uBB8AiwJMJkimxDnwk0Ce5p}n!|4p^8A(G@ND*-vO-E%4M-FEzEXp@b>rp9-7#O2x7aK_ zerMntC4lgb>px4@6D!z{z@jW01hckz67v;7k#c*Xo_g--vE1;A@neP0hgs24$wO@VlIAl9<5u-N+gLh)=_V)Bd(bX97LI19iN11`LzCXC;a;@RAb zi*+^|!2tn?@Ik|;PZwri$R@QL0krESDg*XNc#@Em?DrB0Grl-3TjOA{5RKaOOWpGE z^?9mtGt5Wn07SHCjASncD$XQx!gK-ecz%9?cxq8J{o~Wq)63J~kPsJ4Gu$bpmuIR- zX12+L?bOvdiy)9%G;kCTCnunIv<^cECzQR=p>gQ*$2gRE*7A8N($eI?`sGi)Nx>mO znIWy^$ibz5s`j4l&AX@2Y8V)}7VMi<%&iCdzvJm6TdAjTItdcVT8fhUdcQCn5QD50 zm1g=ez~Jqz;GFNI?$Q}`*e5+P5Vh?V-$0{-Wm-xTW(MBcA93)~8fXP)!ph|{YT-A( z$p(h=`(IFH`6w15!XsTBThhvW(ppZe0Y|G&n-fiH3snFvt&l;JCTFi$hSN{c;abyk{V;{I;mEpy=}*5Eu5X>m>8#U)mHvo|0*D z`FX<;qn?(4MQiUf^_7h<#%S2$-}vbLR5R20yZq>IY6V>YqSkVFEJ+jrREdAJB^)-d zmd__N3L*tKpPnC40$Bg^y|E-3J78b8;1lC){EO*Nl-QVJ&%Bf863>>^$%vrw-{AF{ z*Msn%4N?wwZInGne8{aE8-LgnaOV_D) zmZJk(e4Gks+xrg_Q~z$?29OhO0Nb6{ow-~-tpVMrK>LZ-<~^(KzW1EN5zx-H(JL$@ z!ca=OQ15y=(DL{X-y5p*T_2_E-dNMeo6Uyt@OYg3R(S<%%QBA-JjQ*NK>f%1E7Dn@ zAupZQ#Z9wV(%6D_$l))c3liRZtv>D#TGiU&Bg)v()-MbP-=RQfHrsrNIig6(YLbp75iiYm&HA$`CXgx^WI`HT8wTlean4f zSrgH@DEYzhs9s+%gvllBQL?wn4tNU)%TR00en7Zx8(Lbvt9TFWQHzUG$x@zb9SSts zdxEqM>ta5$~&8UQ5^pt%Wc zU1Xn*LxL)7sGo3DQwVsRaI&%K)=dL-jjB{H(n-2JPFxl8a^k)?BEcxGa&a6kTblv8XY7 zN-Xflipy1wX!W|iqEM`S_b>>6i8{NjVnCUOt#9DudV7AL(bo+5Z=WCtKjrG^x^G}0 zZ z_cBSrQ)@O>i#d6Q}N13r1 zKoyl6ElXYkQIfc8nBNU}RJoz;HqEpkA4pu>K6)UyW4(`GwLfHLtY zqIdqth>7EZbTmC*zWj{kL4k7Tslw)&yxw6`k}1t*O3;Wj3aTV6H*=iOTPq9ma?d@< zOg-k_58U4`*{p7Z{rp@`GK455OU0J7`D7ZDNBsT$hf7OWzITq*EQF0cDb*+rC{ib2 zzr}G+s$U)+SxdDyWifofCY-T`BDx#wdCE()*6}g zM1kzXmdY4lXx+`-@<1XOXiCT9;-61YOYg&FS87`me&v3w6ClU3daR5B zFc_e6#9uF$S3V2GD}tj#@gEO@lu8IVodpX4v14z#nCWAa>C!83Z75)|=;@(F|HO{d z8Lb@|q!|RxHmozIdZS6S*mseU@5dc|N*DFQ8z*O(a_mFb((Khw#+^}3UVf6PTs4{p z2_I*xQ*OrQ0R=-$db&Vp?7-uQ&2Ce@?bZ%=qC_cEbz+NFvsmNF5OBC=D~)I(#J%C_ z0Q1WJU_Jsr*WqwRgwQMWU=FAgWcwK{f|<8=R}VJZo5}SXy-|nb#fV%nWX`eKg_G6h zBY(d3ZGJNt4D}Bdtz^mOfwdV-GPlP!N;CRZ5s5lc-kU8aMJ&$zQ{F_`X02-WO}2PM zc$%n;Oe19lbc33?VgoGY_RvOQyV$z=C>poVw*K^BA!;7pU~_FZKEax%0MO=$ncr8BDb z`nqS#P}T>TOTEf?BB{5GpH>MhFqq0!Xya%9jxo--W7h8P-@gF4$khkOf3t0Ac4i_R zmdS7|16V8pt1U5@{dV^v@w+clPb%#aK)T^Dsd!xgO+RHnC)JSfzq9}>#J6F1cXk~n zs@Ge`BOenV0jpO)I5b;CcXoAkU%f~iJ;y?2xa^0i_)S~V4ZnDx3c^RuG|Bwm7G8@? zKgP9>etOw>sPNan|H!tvxht0~*CBXhy*7Cuek+WMNvjnQ62!0=J(}7M*j)W=HjtSg zX+PIk9ava^Hro$f*(>A`{;MeGqb3WhtE(B`*Blp}+YlQf$qGmO3WozwB?fo`;dcMX zd@Yvw+H?uBx8d-xL(TQqo&=6$=EX9WNc=dkM!4gJ40#>|YZ_JernV+aIm!`4b=I56 z0iz7m#mI5UK^=e}rq{4AF~O8AAP+`g=x%GqmRw4pV7f7#f{>7;=@mpJ3IQ7fnnrfU z&y1A>|5&WF0w@k(g(F5wT@i35nXUeOX!@g?zd9_t#?NnOH}dRg{n~hOw8DMi3K9Cx zu6rVZRH~4#P5~%y@?xFmh{E0){~!51;&OC+*gU|dVAK&6%y)eX7Pm7ifqK2or|M7t zMdLsN4V}|CoxiSJp22;$-{WtZ%@(a(S~?(5(Z`#gzJoKocW7ngKF>KPlP%?aL`a!o zbU|RW>>p6T{4T0xCCb|c*;zv?D=VWbE1R55{T0hzQNUH(n`%Xm8Kapr9-y$-1Gd$j zdR#5}u_^#vM?X3_vK2kmmdpsTREq5s8Sy~yunNYzI65bJR z5AhG)AFlF?_oGs23Urs#)*Uakpa``*7I@1B1wok=a@dRc=m8(_9NA_{H|6>`OnEgn zSBsu4Eb_aVy<4BV9yRJ+#d7U`{6=JC{G+r5aL~axuB*S9U9A}Dp>_wii1JtFqQ19S zX9Mv}8bs0kDy7#zraWJUxa!7UuB2)+uG!H_&=6zruik&7FvbJ0*Kz zK&>X;9XXl1ksGsGCawi}P!!e&iQJzze*aqbGkN0)jcRsCCH#w$U5X@^?_HprM{YX( zJ564$!?4_~B_HB)zkT#LTYWYi5a}C&M8J~{X9Fk)(#c$gj@V&^(4_0fCpk;IDGyKc z4Q_rJ2U^FjSi>51h)wHiZroP`8z{YE01j=fRre8@HD7c zXn>e=6bf`B*vyjH1|fH685?a6$UR1OU&nu~D8xXdj~}1wQ#0F1^OOeX5QOjJxT8CRfP9yT+at7?abTyx-Mpe%SM2I!oso6+n*>gLJvj~rc4WNinxMUyI zjgm-wal@ja&K(b#Dm6WN3_X}V-&-gY%Y@+^3Pb~oVyma}EhTUd4;TMz1-cPbr>84r zp@23Mpn?sm*IVrkk9>D?xk8g@r`2kr3FpzeC;)05xK2-KHTNSJ>gkJ}wX*Vcvdb0X z&j7Z3K_M#jY{7s#59REo(AbCfBMHcA+hk&&g_ z-T+lsz0TU5D{U!^DESFU#iRg5b&0VgPB9K`@(Fh+id)t(La7{Xmx9UJ3czWxdgFd|&uE zlT5P7@n-jUWbN(c5rfWtUTJA5(6!R5N53==5j#YQ>iuUc4g+rKw}|8aC?LMmoNkx* zxgY1Q9y0t=Ee_A2ak_WyJo3hO|A)46;+H#5(x+$@oXG=QP?+i8@+jbEs#p?}6PbHX z7IDIm*b-fwB<_Nw1EZAks3j4kTGfg3RwRoYO6Wp)Gsr(!64)hp@}&qq$X0Cy;&%BB@?i#BTbGcmDduyJFso+evc+NEH0fOG1AR=LP+~;A z&uJg%6b4+Uv*o`6Zc`~&9T);P9r&F_;o@2Nhxk+y!?3QZdpSfve{rl|y^E1iUQ_??S|P6=Z*jH-*3U0vvdS`R1&IJpU#V8+ z6_8r8P>fw&8ZT=r1qfLR`73@^d5fHZU7cgLZ z{p>QI!Ej)Ik|t7orzrDcEy#emSlofeK`dsYR-NR=q;a~Vis}qVDgWdQOJrs|qcn(? zl2V20tczoRSM4CU^v{{lp__{ zUC^Ux8nJzvYak_4Im3RgRDfdSi})62UVUEBK=PL|fLaK>nop01Lol%MKUl489&lV8 zHap!he>tZ9(UUkuYmveUpwwdd^k;XdZ}Y3^jgnTm?!^Uejby4KF-BcIM7TrG`c>5~ zrsScy!7M-ie9grAM+xyPVUm-PF0`FsdYN~fJ;^1H&>Z!_`URD)!a;o*Lvae;hZq3( zDKe${NBK(`Zuvz{-5P(`1p_YW+2y%p)ms;!L!s&8{8CR31tFo%)?p(&1}%rf$|%r3 zBOuTghYvc> z^5(H_;g}kGPxASgU4mSdb%$oE!y2nBpuqt-%3|h`1-(&DT(X||#|-ybu2U2sBVHWN zG&)a!bB3gQw&|5ODP}z*y9dNrN41zs@*{12kKW$Sfn(?(A5eoP4dc7^hsc%fH0-wH zXKfP}kS2_8m*XF?8KOtJDLWZ)m^!Hb=_S0R$U%ZQc7Z|+Y6t8QCa_C@0-&?>K1Ug( za3ck9FMzec%~9OSG@B;_uj;r1Z|mG{4$J}g1?cB;d0P3b+UW4~H<)0nKaO6OG!pT~ zxurJX+pk6F#HQfd{zUf-BPbiWiz4!ma@6r3=ujE=TTq$$SRui4^~$7lM+^oK$%o(> z&u_%UqS9{3Dkxp$^ZrWwZ!95)Dk>;uS1H1o5u(JY_9i?!`{XOffNPjsZyABHO>7HBwGfOYjMW$a^OI6N z5mn;bSLOzYdQz)JYY#uPAq0WOgDD2K|2|md(;4@7`+%UJSaAkQxPQXfdns^qXGdpt z+I9f?R8SQWljm$UdOJp4=yp2eWe=GQYrC4zvx5>jHf*IHi73}miY$(j zcExJ@DZFha<*RE7g6Igy&Vz1|b-(O#rO&l8aDV#LB1Y<9XQlHmD6n}u;Ns;^cPA(p zcs)BOlEiLJ=k(GD(Fufk&~gfiO{xGUHBTbj`t%ixBhMpsSD_F~I2HjZjMetMwiFKq z$9eDaW0mT`zFGFz8&acw@yY7i_0&U}wt_zJUDK0~Kigz&xT6k3?#EO}ZQqYSNFI&% z`HX~gbi6qq=|@xpbc2Z^gbUpsZmWRz2K_i@nO;W4%P#w~bztIRBS?vJ$aVl*GUoFS z>zrOB(f`r{CSi+WFthOpVT1gUF&Y{;eSADwEVwv1e_wh!;+_{fMG6DQUXC2C=4iei z&`bdo{n^gTa92=BNczbtw2-pHEGviBSN}CPO>ktc96f^4F^#!_53Fla?FS~kb7#yh z5z3p__(U^)TH21TyHnDbZS+6cQt2XQLN?G?=#n=p=;g9~zp_QQj5^Zw)5tJJY&p4| z!F=elbqEwMaz9XHh&A)SZ-#eqYDABb=BJN1_*^M`&JH1N*9 zylWc2pt9(35N3%ZVQ)(|ioP~8j?u7*WORtvuSM80-&1`Fc(qVGuHq4+r1et^m`fJ( z6w8OrqS{)=weJ-2-vFJbIMp_R#btBU#|A*>Yg&y3J96mPn*7E+ zs#IDuDZI&U_IIQfb>Wx}<_*BcjKnwQJeW-^5L9#3VAbjNbqkx|v%)#mLq8&`CS1yq%nq@Lg zs+W1V@8~nBa=s0-fw+&JM1~$vfMlD^4}i^bx!Jwwpj3K$ekXTsWoQ1LAT?JyH6B$z zt>qmr_rWj> zL&T2?Q?#EjUL&d<7D_dWdx-q*zYA9JWT+A_n*0=uDE1^M$+AHLO)S*lkJ$<>tp6AV z|KysnaNkwt8@2`$;Ps9|7~Rp=^5w95UR>u@wchzd-I2Gq^aHvXFh7|a!T2;=YkH>H zrOh84CX;!j(c;bc!%shk>j7Lh+F8V5uTkgRs5pQFNOphZ@`<2v085g9+gY-(vkOvR z|6s9NJ7a?}?{V!PFBlskrcWY;-lwUh?_-i6WzQqeai`9o@RoZ#)0*RBiZf(NiA`ab zF4p$T8H0h3TL=lgSd zDWFB`BjK^zIj=eUYRfqQVCMPZCt zx$QS)??sJ*0ZDdWH|M5Xr(|q?D&4ni+d`WFj3t&I+E4nJ8CQSb(Zn-kS62uLU$(p}OW1|TKf-QC>^(hZUl3X&q- zxd!+=`+fI5_IDg>E&k{a<(~JP*LBS?&T+=(!XI&)3*|15$F3U@2}~=9diW_)q^aC> zf?Yw(X7Dxos zb&ZqWx;ssD)6G=lhouJ6Vt4=M;_DD0mG5pe9O=idL2K_8s5(q!!YORVIMC`Y!{+zDv)3Zw$s0yo;-FkitTx)cTT?zVIH5fH zM~y)`z3VfO>q&VWRbbqts5m;?;#*-lod#nx@OU7*O${4?PCeXBPR{1ErhI8AUv1l2 z%y8`V2A0W@BEJ5YFfoeqliWt9y9BomsFpi)w6(FrqFJ!h5*nCz+vW?krDmOzCz|`d z=~?@3S4AJ8RUL@1EP2d!o0NL9R2>jIyM5A&VRdayLv{4!iu`sOd32n7q$lTe&dhSi zlHv21{Tj86Cv&QQLQqh*M$+aEj!z7C{k^=OR|mY$S)P4!xc%Vo^tkN{<(I)0g<7eg zs4)(J$cvRsxyGT(6mjRR{!JYp!)nauBN0x|&!{!(=@+>O>?u5eisoil(*{8s8+ z23D)l8t19>$wexQgNVSWhQk0!&u-#y|AJqHS4W4!SHlW1uytu z@lIqHZRc->&YyY5r8j-%X1*G(e=zL3Zup6tU58nsxwg%7dz8(c9q5olzZhRDpa6W zYd*v4P4q4IRkpw(6zM1}IjHkp&nd9WRa_5Oo+P8Z|8e%-o3~f}vE`~5HFYKoGA>AN zgVuwp2K>)`U$ty0vcK8&j&^VVVqomVJUS6#3?3W+U zCt?XQ{8*_6Hp!VU>kCG&70R1*M`hkeJ3MfB+A+wsh;$tvCUAS3n^tyKHP-8Hrlurj z1BR?V$Y?Yg72O8vT<6^GvNn>EDJ&EeG=j~|N)bOenMM!s88q}F$`3qZPkNI{63;lv zhc;d>pZcd;e>_{86+nxxXo-IEUL<9|r>W17%10^fcgKC^%HKj_h7)I)jB(u1piG@< z#NHX%+<3!V;XVp;pHH!@PX-Dcd3z0&parGM4~rgmzIpi_OoK5h4R3w$7G3E4DHx2j zjU}5qeC6%i9p>o})^UL9%%vM6SAS~V{z;!J!xS~c>*HDxv%R6C>=}qTyYHT;N4a6+ zE`rM7&z;i0Mb9Jam3Qh7E(g=xz*5~SeEotdJfYUXXpK>Vj64-PJzFk$axA#n50}ni zar$btn!d~GXE%+(V(sFkui2&6cnld!f(rXsw}Jv~LyK_LMkrH$eD9ESn2 z!mBfC^=>+AO_aD(I+tHS)86!1|L5(AqK_Zro^cALESTbZcV;p6+^)uZ~C zxiWS)7K`<4-zJloUB*v;dDFJhcr$JF6=f0OVV8-l8B;`mPJy9GQRp zT_7p%1Nuf3)Re?WF>JJ;o9QeEuEBYzLW{QLI%y(|+%1o%-5)s-jTFw!&sV$bTDY4| z2;{;`Doe2z?-8rnH;;EWL42Z8sfCk&w9q@8_gqjg=_l~Y8_#EKRNChjsb@I?M2Lxr zD=oYBa5DRl8yx>Oq@PL01(V)>ZE0gskF>(N9jW|>sEqp_;hk(58YR2xdWq4Xl%F@H z==GxCk7gaXFIoi#7O&3UOk}F9$3Tr~bjaR}P~)_I?D`v7Yq!7+CQwbSZ@oyK)fn-w z@i@@r8Gl=M=J~a`ot`Lo11l-=L2+PZWzj9Xy@t?%*h&k7zTd=bYL z`nLe%DGBAfI@CraM^_FME+q>6h>QWlCbFjG6ME;V@fL4xtv?3Vy|23m55{g)SRmos zMCvgDAgQp>qpDu(Mdpc`z-iB4DN_}smCA1zW&W)LPIpuz-I9GB)@u#JPb9~xooAxA z@zH&B=CJ!t#Hq1RF#e3?XA03TkJpLm>YvHI!s8WC^-Q=0sNqO_?N zj>nNNPDn&rFs#2^g--kPoq1_v!|eC7&+~L0^xjx*U+n_5EtOfry^H{%&F}1BSp=rb z#S6PyjUimzdH-M)6nem*wzIWmO5?O#S*?6ecH}l7m^%>m=v9qf57BxckL}*__F_*g zo3CG>^VSYDQoH1-Dd#+nTm!0bGhUgn2$8=!K~Rr)SuJ-=gZ%C zJ!ku;QST17*Pp(5ysR2m|Hg7b+B#P;pL^eX`Lyw5_Q2;=lf$jQ+uOZrF#PmI<}H1t zAGSkJ`%@Ime2`r5esCdWibx`Cgp ziobN@!ORo)UoVM@-rlPi$Z_TeT-kC|_&`FF$~&eV2_SqvaIIV=_2(0!0EKi(kfbY2 zzI*UQn=rijko!(_E#qR0U-h!a2l0u4FLi4MxAqsP(5iY_#r0EHPg%(Rv8kx&l?CP# z+l5=r#ZQs#9vcD0^A=EAB!|05YK)%PH*5K@<`e&y%LpC z2(No!bVT?gRbPWY)6|eY{eDLFgRObhs==~|G1N{<*x=&nDNTYdE-t!qtd9)7O!=xIeOA!jo4cl1 zQ_{GMyDk{AbFQNDE$4{}G9p@#49_y|<&6|%Z`Nf(dZ{fPkl{PGq)Tt39xIB0= zd%?UKuN4*Xn?=IK^ZSREh+i=wio^v}bzzQZU|`@QL~pve+w*637W-f!|BXG11fR$i z&031ErypC^%nPil)y4!WOEbN_{Ytk%AG$13A$Iv0c6uvw*Hl;$O2PCd14+ZiddxReqqfVACoX}$bqd(H;XZ>>@z;>iI zwpJ$SK4`mvq$92;B5KCRa7B}y{*2?nKT{`<_jq${NV-I~JqfNYTql~Hol~BWZ4XKb z_e5P_=f)Ef5%CliO6tAx8E+t-m>6GlWX zJAWgm%*M{{(??178xp#>2)pON&5@LONlP|Ic-;yGQLFo<4Fw$q?T6A*@qJ(|`uUX> zkr3f!$Ym2C#-7zgE`P$~;vVFYvUjSXE*6DbT!FZ|hExM4fA?XPSP=Hn1W6#qD*YF+fxyRs>MP_cM8?P{ zt@VVCE9Qy^kMAcRJQYqSC#Qb(#0-_2@G+QVQ`uF|8=hXe%$tt9o=iS*=#bI;S(wIbn|8F(;w&wY&(>wcaVM^KH& zM|Zi8LOOJJl=$pjB~49ZFyU7GxXBzMdp{EK<{F_(+-Dwr^}kg4T_IxpN2=9kivGHw?T^=1SO2#V_dDPe8pY?RDxVr|_uNG>-85e&)go`PA zlB)piv(o^Nlr*xW`{+>U+i2@o4^qJca=HEDPH=?n@JQXfWmv@Z<-r5ANP70^t(`;b zBjsYX@jTPGk@_y`8T8eeYUjfKqK!Ov`*sSD!xtrqI~p3kPW>5f=|8ISvyxFAyHHA# z=uT+$8*Qem9=HTv?(CDh3xe>S?hnRaey3Z6j8s5VY794U(LLw(gFjF5;0&E7Reg%zINn_K^N#dW+N-UcYu zx>y<-jz#&r!Z!OKWMVk!vpaGT`nuhvH4%WzCnF?ZY=MI z%Yb|9U;!9?#FeJs8|N6=+1V#*t+$bVog~3-;9zR`uCvYWmzf#7@sC;QPgW1n9=fYi z`-@*tSh%j%O8}eZE7`y}S|lEWG9K)`|34n(rQbqHgwWR6ch+>$aFu`WRt}1897BJvr)k|2Y|#cFup#T9nSrtv3m++ zS{O~NP1}3y^`025CB{}#aeaq-bG*B@yJh=%QX?X+(WYAGnC%snKg;T$Zv`*v$j(OZ zY;_kVcc0%+^7CZ~+i0Ga3eZDKESExJd5t87C{~M|j5ZrA9ENG&D_7g^#1i@~ffAkabso}4Q5 zsto=EnkSz?*7eNc*BF-d!q5t@cVGkNO%g5#zUY^fz~~ZF?NzU01=j_YBvwzQHZT0Ib;BSb>7^rZs?Qy6E*3TYN1_X6Iklb*O7(m>pqg zmo6w`O}{0%VcuH@pdQLe6TseGv6@!*Lfg_ z5s##Q{Bu61zra^6d zFnuY5^z>90dBhJNnV;pUrE!p~u7F7JM<9$J3kNQ|AR3z5U$On1oZ7~2Hf26mJ0Cc+ zL_EpiT3Qj0&SUhdheUF+F=K|kc1({UW@TQFbDIVAMknQ}|DS2`48}qrQDiV+sNZs$(bj8L%zR+9>&0c8KI^6$i)DGB|)Khc=6Ss7-$!?zZ@ z9)>TSrAnl~JW{SRl=YP&oCyFNHs;bT%3W@ft1 zmT_gJ=^AUr^XYm!Qx)lsf|)v=xyQ|Z7&Lw=fSu{d;r0`gZ$V^+z-+Fw zT{KU*COKNz2835S9^T*LSZh?XPRne1vsJ$HU3a-%RyT*hQf~QJSo%mM{owu|KFGy1jTc<1P(D`ATEQ?=gl z3}|AO&*$-p^6i>49xZ4b{<2KX4zt>yey_%9^>rCd{RiLQ2hrZ1Ji}_PbPf`?3*D7! z<_HL_piFXKchtZFP4w>mv}+`T21}Y^_HffX&gl0($D=#P`uMfo!Y?!udP-B(ni9s= z@^xp?bwn|9|YkQ@VPMh@R2t>Gfn!fs#M?A>u}l+jUX$ z2S*BKHhwKzH@BvdBl`ZEzy}ms@FBvjXoF5PH5130f+jSvO)O4jpRJR5=}S5sPGL`N zmM4>)BYOe3bK2S=yegI{XDsJ$k=~!R+XRs1~q zMu*!A`HHn8jExL44JKGamBd?b>x(exDk7#9AcDNHRZ-sN3YpkF&Ych1k2;)qKmW# zT#z;EP03Tmghthh^|pr_3(vP1r!Z>w69rYz4)P=1ZIeGs-*IA&UR}t4`aBV@yPM=? zjr)s63%lYjwQoD~{3Fb%Z@tuurc^t=5^{4-(z4Z9_0;ryx9h(k)0@3+^lG}r+jH*8 zZzq`arGm%hYm;XNPj{a6BB*`Iew?q@TY*6B_S}y zu20nfSQa!mzQ*g4CP(-C+a5dj%(oon_sdU}i^9U`Uz-9~GqUi|wQa3_Ck1W#Uw;md zJpRg#qk!1OQ;t%%crF;}86Q>|9&t z1pqU>8!8vLGQIms<#ma6d568!<}ak_r2+BW7y9U0L!%ofEfUC@8YN7rnn%y3cgo_Q zD)yG>iMyUR5}wCy&VlgCQ=Pj{v`y$0E}zow?yg=9a^QpK(%Sk9nzLt5HXAxVk;X5* z!Fey8$x3CDqa*xXkHPq8>$4NVOw>$3yu<$4X_%L$y{&Ehv%}-gI}bk!r@+)7RNdlB zI^ly^f2hnOge;Drq19c#jbk7d0f!4!uS}ZE10SWWllg~QwJ+0CG}Mx0n=cfKBN zayOBa?cL@625RmPAFc@tAl;P!i7FcY?@zt~>4|2lC=Sagc9e}mC%cFu#nxxGFrDe!QSlIA3DxC=yoy`yIZ@~KYY;&(z?&t7O;^-%9D z@E7RMvuuWO+@ERZAGUmm@Lw3;pV}L$X7Rm+V&GK-PeF`3G8P|ngp5v@;mV?}e9p|LZt8*++d`yhDIJOn=03-$& z0<+O-7HB2_*IKa;=$u;=O{b>=i@D-cX_kzeJ+ZGQ%sDdE7gE|a%|8BYMMuH73ocP@ zcKLxMyu~14$azeBDM+XJSzt6+bOw}q@LRI|6LV&!TJiDICuNYM4+TyntUkD02r*mr zIxFbU$1hK{o#W);rt4^NjSkPpDDnJgM4CUN!rNsV=#Nya^m(>^3vy1Gk^xqfsMiRn zK`IE71l}U|L=+uSPfyQ*Q%U;_i#4^TX~5itMTB-w>S6;UM*)DPmWp>g8`PU{J6b)I zep<19EQ|#T)z-JjB~DZK=*nxJHzUKu{F`xE?cS=YY1kD?zXGl959a}-Og0l~V8eCY zQ)fA#d;I}YkmXLfsJrvpk)!H$ALQ3Ou4^ZGi3`QuLNj43RMHpB5w_D8E3>n4G;bAV zUV+a^6o)UMH=*V~8~4{Vs&tj1>d5*9lB&Ja^9>=F;7ao@|kyIvX>&K#l`!9@kmW1AVg&`;E(*~l%XB4OWVa69mHkn6f&scsi zwk-9Wi>Ss&P;!!fb#C&0y7Si^Ldnwni<6Ls%6YG;g*4ID$KN-lM&9=o=&F=HKI5x^ zQ?SNAnu9W3{S^6}-9+lV(3>z~`O9n{)In3UueN>+%*oDC6DkDYyt?T@O7vk7Sx1gt z;OC(3jC%UZp=ONwkOo=r0v>-wQU7>Nr3{xK()R>>Y?gL*fbc`t#$?Lmzo}3mnN2!X zV>(g7Ga~Swh~dCUp`31AG-rLl-ecpdq%^U$d)(UUD!0{%kXD?oAoYfj|3isT(iWSU zorImw#hS%yZ!g*ax%W(2?iwJ=2D=ZUY5S!mODd_eseX%<(d-v9Yxe8BNh&vUIDLEq z(wzuc3Q0b{*3%K;=gn4OmW?^@Ibi}S`q^-f-TD>^57(=3DzlUQUq((SD0}y~Nr;Hp zk}NE0f(xgrjHDJctIA)99X05~!8rJ1h<=_aIdp1`qnd_U>9;`@(+jLG39E)nRG3Vb zrA2|(@59#a4jJ4UYs=R?LI?BRdH8+cwh%%{XW{S;W21xI|&+oVP+B}AeiakBlxvJLQa0n{Wp2pK; zV*Ciw+wTMgobA?Y>`syY-VzHDExuu|`L2lM+JnjK>N-Eb!XO%sc4@9M93%|jnP#?` zG>f6yXyF>(BBF~4<&65s9Oai zPA}o=oC32Yat78W0hVyJ`TWZx&&Ld5-`&J@J5luc&sdewY`0+ zs>Q(I9k0C(l}CNgCM$qqPOq3@6WDOoGkd}B&LaV^)5g%&H^5wW(6AN>WMew85!Vs$ z6Hd{sJTG2moI@+^y7isx3Ez3)?bomKgue&!C4!qgNAe^x#-Hf&0PJ!9 z51q~I$+52$-jjG=McT6O4O)zkHiQx|rKGG-&n40a1+H&bnh(S&P)nabNcYMH<>c!0 zd?=WKP^h}ylG3a5eD}Ml--ODJP?F?ni17nFMh*EqvD;24#LL;Iwwm{cWzkn=_Kyc< zV2$O1o}~QLqWB0LMZy>Z~Uw3qx?mo4oGvX&p4{ZZ0{A#yUU@_L$ z)vfV5C{@^GNA$$Vq#J_A*%CTc!P_fosD#2Q%&0m$QEs3on&zp6N;3CJ4ESZSnafB= z)dj3h))y+ziG;QW9PR%itX5+yvRJR(zjxCUgN4Q0rmoOuAQeLr{aO5ARKNbGJ7$p= z+vcunJ0*HI;k&7BLC|85r^iwThppYlsfzx7KPs_8l9a0-Q^uYCt7Uea@)X1=*)f#r- z-VO|D5iXIN&!u0}GtY`rq&BoiH|XmvlDu!VDQPqsr#u97h2EVnR!3xYF7p#`3csJO zXQ7DVb&i0S4bL$Kt0@Q#ex5hnI|k(yn2KQ9zb^`OQFcJ`A80*Uz&914-KxS#eBJ9Jh zh1+;w0GD)+PbO^TK|4*!Ln!u8{(!}c0Zq*!xDE^+4D5{MgF^b`d_8*z6sS*x_+r?N zzNNpqk<*uU;|N?M7+zO&-l}*EFA_1Q^B4z>YRQp(zk~py5gd`g=@Qq>$4)yjdVT_e z&8<=~;$7+Dxc9~yvDDu`KCs!Q3V1Il@L@C4_YN($)7O40J#jQ00iY6B_ES@)|3S8k z_FLn8(;tVmmdWAzuS;g}eX zcT|-!cKjoFM|~yqUl+gny*^wr@vTgSWMhCc7U}AQvqw`EIz8RpKpZ64O?e+dRbJJq zBXm|DJ?;?x(%Avo50jbkN#FFe9*XQj+LKLP$VVYIynu&sN|^dR0BEL4d)n_&fP)AU zkyQj^Kq|Jmh#)t+zHX#a{6wPew1*P-@$vN8=ux@jiOW;_^*c~% z8f_gN4v2)SoURQ2Zf^Tzu!*~b2r`$alV6%jbp~P>2>lq;8cIy(C$g6ILn|fHLjbPG zS5B=_q9EefsTI26_H-#1Odd~qJ`Pl_PfL__#re;VHBy6@3U!_v`%bKW01-MN=i0a* ze!Dax?*)JpNBf5i(-P_abt9vJB*xth^zZ^i^z3Pm=f*qA zi^fs}V?|g*xVpAFJxqVH{U_<#+RP^c9@~*sXe!W`Lc2|;UuKuRI%aECH9j0oYD1cP z1k2c{KgBGPRD+bmCQW1gHP|=mA~bh_xR&|i=otm8=|)j7Z=Z%-wZP%+8B9Do&Zkcw zX|OiFNfs~}Ib|~K-uJC;Y;w71+#R zW;juQ&X41J-jF<;5SrtJvOTMvjR&IVJRLTiLbEyerOXjn z#tMaOHX9zWk6zbWvJ5c%qDG7)0m7)IrM2y*EI`-`nZOTw*_d9%{%Uf8siU{eTitfjIZlDqsc`F*XZEkftibU=hY@UdF5~U@)t_E z=h9-eKv2te8D}1~nAV0{4yEc)mF*2d5}+a;%ky~@O{N&(c#>%~$K3JWUj>uSn8?h` zpILimD)Sqg<27^Zx_w6atpdJy46FdrJo(K=0*b!n*B6%!1ts-+uK+OR04xpW^aZcF z&cXH8XYdCs9!jHxY4H6rD&wXWu)O&>#No9cKVb>BJb!;*)R>Z1I4Swk{`%Y>Sn}p^ z{;0%q!{ZgUelT$DH$JY&r}>iq^xkgg+HgH_{fGI>-pbzNipLAuS2?4dyNw<&P16b#5P+ypiR1Ezhohul57R_{d@-GpH)@YpymR-ohX2cjCm_nh=e-$BN%b+ur1w{ ze;kbRVxi!5uZgI9G!ZPErCs7e>PbsKb9iaZ<`^L z6V|knJ6gDG0B#JZ^POxKlZG8z@>IS03aw3Jz(WE{vuBX6(cC~NSK?5dw#e^>q$wXp zcSo22wCtlPMxjErmkYe?(?C+KypT4N=L!Kr>89t}R~yx2T0uOgT`rHsLv3N-o4KB7 zchJ$W7GDv(Uw}?5dn?&2cLAi0k}CR-VI1K7mJMNg{SFGyCQe_-^yhJIV-U~H-2r*9 z1nxt+JiPYAM7O~RVEd-6wC(0b#B-Nfz+x}6TyClcko?KB_m)U;WaopBxAY>n+ z3b41c6W`kkN<`=~p0CI+v$20W1=qARqrV&S8qu?zgdajR(>Rj3!g*IdBSB_?n7am{ zITLbphT!*+mfd;prKl)te8%0w*==oMRABTK>(q__9qYw%78L25J@L7+r%tu|u`7?2 zL5~dhuX>e@=M|6PP;tsq1Igq(`@u40qSGieWI2MR!RlA}M8mZ11mD)Xh8BB=1kca) zPsWmjReuiWp5GVWgL59(Mf%GLC}fgwv)4C zx!LgSV0dm51Gf|+t#k6r{oSD#OYf~~1a48^_LDb$;`-EANE;ckEG&zB^Z-vHAeJR* zMrdJq=(qJzjQhzi+DCoLMTXt>%@OobsV}p8HR|fX4V(6^@Gxd(pL$YefJ8@6B(49n z5GTd3BPp+?@$S0&#Yvei9tQmq_al;t`l%wz=@bq7KU0lHzu6e21HomwEB+U3iTK7P z#i2}bjn*ccxn|l6>(xPx1=ne~Kvmnww=& zss0#i%zNZx#>H@t)u`ukxEEu?Ep>D7aeaD!7Qf=Hlu#34?b8EF&?jta7jyIs=^}9e z%P9AxfB9c5Kv-iG+lO`PAI&4;VOT}$O@Z4Van5AN#RSsoL{jDGb{>7ca^KdblqP($ zZlRH;`8XC*$1Z6PMXpBXJ{t|-di711)~2+)UnD>w_a)UwA?;#0@h7F|h>&IzNbvJT z!g!f2nMW-|_@Ng0-~W1bd3h`8A?9XHqDn?O8TNI2xUjDSSOF@@{XOoqw|}c}FCAHY zv=Lms%0ZVOL1tCM|H47tpTF7RHAQf{o)v26fP`V2$6xzr#8{}!r~Lb6CP_%xeVe#8 zNxsUyG#_n*sf!~}<%k~L$#Iw>m3)ixNecgYzbz~F^EB)lJ)s(B;k?9_t;P;|Gy2Y; zTg@dNWHEYRQlkoQ>r(LR)kg!2ci;Rww^P$EK)9F@#~%JogF&($^~IiQWZ!?b-uNDV z#!qriO#E`Rfxj}xfhsBJ1ziND&oi7Zsj9PPGsKcuxCEuQP12tE#Htr9-b;%|-|P3_e1cO0ZP8j`99- zt?W`p{Wtk(W~S@JLS%wA{M`t?d$JC^KTA~yKL4^g>-;Yj$GW|5=$UY?Wh`~WF}(3d2l z06_slY$7BtlRZ9nRv|5OrKX|F7Rdlf_zEZtH|dD*hHW^TTXcM64N0J}=t$}B2ox8+5N0cg-T7r|&#+o}bw5J9e>M{hGa*Dgx&5$+npVJCbjH4$dP#njk{OLWYu_kmaZQ zdoQ=eKl7X>D-=hVYwQl~<7oJe2PZ5!Yf0xNyi$oTt2Do$yfW}lBa{)aB-3)h59Cn{>qN1M^q~5<)f{y! zKOqBcy6Fps(1F@lEgOn6n2E<-Az%*fxs$<&eczRSDCNtwuspf;Nf)TPGB5SR%bIG z187mMa;l1{ni?3m)w&KSim{mVp71I#7AiGN!hFEcwq;_bPrXVA4eHBWwPFEr3oU(S zD2w0;X}VvJ~&;Ave%it5=kJgnFH3#GQ=#Br;?VMYESTC()f$UUY7XJ9_hD4x`4_4rCZ zwf*SNTuE&3?q#+N1%bkH@VgZZu=2ixgG27Z6AEt-nASlPfoTC;X$Wn_l_`98rDUBSh=;>^VIy; z22`8@1T4u~U3TE7iB}OxD_`;=7f**u%4lYH8|)7m%(+IqVuURCLl zT#*Mj3HH}&A|n*AE*|UG;TFAKtf84}*JUYrB_btjHeVRXz`9M=(!xD%k8NW#VZbIK zx%^y;mp)4L4ff|hOYs>Y&Oj#prLfj)An*#M{!Cm%ip1vTG8FV}Zywza38M=S3}hcx z?;m{=Gra`$He?ROvKhGmsZ%_h=9y)8`!N>j>uS5HuMd{p7!gJE@SuX|!F|oS6*u@} zEUQ^W@(X?yy}^LQm&lZ2w5qk1+jc)<*=GXJJ_(>)_O2DSHL%F!FObeDr?c64_;>@U zXa{&WZ%>av>Oo`BOCmW#_2wv$cQjw!`nYxXx8kE(ySW7z2N@kVT=nMoqzbl*wXr5K z(;pL10BIp1At`y&8_1F=>9lonSk*Bkc`syb9|_SVAaVuKK?ip;9d#b6H9Nz7yUu$b z6x-~~25my%hP~=cx(0U)V%F-Pw%i|~S7)^vV`tQ8l-h?!<_i{&iB~+#P*DJ}N>|9$ z^Jjcj6IMh75`;rtOW830ab&4qvtJPRum3-=ORa`bw&J4;vdiB$_!t)!mVL7>p2ptl zbl&q+#v?3!1g%8d+=u%^2Jt@}RXg+$^nH8!>bHHO6?#nH-7ICeqI*G&(j>A%F?nLJ zQ1)uEcYWIab8}CGw9M+ZNoQ0wh>>M_U)7%ydPyxOhZM!PUsc3s ze=0gIvjV^ghwqO51#yf-7@3rs8PD*RxcEI!0*8zNW11hy^E3EqriFoA9`pT|=}lz8 z=1aItuF=aDH-8q~Zo*J@49prPI(>fy$4`h>>KjEkOTKS9k7=|m$L-K|0z{hRNpeZ> znp1?x|Cf)moH)%4p(3LYs%iUJnrv7_5NFdWf5j0E(^S!#awz>D)U zf7(;HVL+W?-r@-E<$G@#_I4K47?nw8^SL5>>{PwDBEw+tQ(?|ss3o|8qhH0xa9GmeXo|KOPgz7ux8 z1>kXGQr^8Jw|R#&w4v}j)kskUF!#T^xliZexTHTYcq+*LNlu`vEK1Ln2AWjQD{(a3 zwBh1%bg#$-thG_VvT%&3rrwk8=IgGuww6*>*f0Mt8k?B))enIw=*9sm+1iL8I~%m+ zi6=|PPxbg~kstW-2VM^j4sODe#==5I?6nVVpHAJqO}ObM6jfGsfv^3zIT(3K9wS+H zi@TNf=rScLRo0~3(B@jul{l5uVPhLXHeK0!sGra+b{yxkSn^0e^Fj9Jr)9)^{Du3H=+_M5jH(y+whbXl1GiXH~{Fxs_3ufzWbrs4DWD z4SPwe!h$r0Rg;Rbiv{S100~R@@*1xfJfStc#}`jXbD#N)9MIl63P-t?q{^(baA1;<|aXmU3H>Qda7bLLV%AiYVUNUdiR31`ieRG z8}sEOc&eA(hGHqz=(3Q;QlK|nzN?VSbPwGl-LRZ{N?IT)==d>b9_NkLmP|7>yi=jr z8ve-C)D)2Ke${5G&jv+zefG<20If=YF)M!}d1mv9Wr{?uGm=qbrLm&AY=pNcj0H9P zWjeo(2txIO!2RbBr7jv_$3>ek_7LrvR1~qHrkCB6%InDY_d5}qoN;c`61SQ*iq##)D)n`ad5AVr`N!ZYw77x#6cW#Vw8VrKd{Ctmq#72tx!h zXuDod2~DsZHFTQAx_R@P@u9ycp`Ta`vjfR;I z3c2e|0d-gJvuwy=X%b*FzfxtbbLXw!m+;S|@%HwvZCL*1+$8oGp($T>l+nIp8y6IG z>&_i0Q*zzM7C*#zqwhtD(aFLvb81oz))s{MDM?00jFItUAd2$#T_1$kxDN~rSXypI zUvAAJ;pkJ2U@yM+eEBbRD8xJ@zieY?{}L3<%Dc&W(?5oG^WNF!x*~*dEN^@7V_oZ( zxf0|ky$wgIsZ7M>wVTRNEnpk1ilk$4-tR>O5$@m!>osFg=~5moUhUoJdn1dE$dh8O z7SdNFxY#XElrQO|MNgt*CDJJSH{38^KuiL2%W4+U!&*9E-j~+n)MvL zlW%n%T?gWGPsi-#=I;R-JlQVa)rHEd?RYl7EtRKh9{lclgwVA97l%g(mi|NG|38eT zywDz;gX*i%xlK@EA^_ zX|B6x5XK-M5@B*UN+X*$HcBp1kKxp2+V(vu30NgmnWE1E|HT3(#2W8_ryPfoEnJkFw@mUVb0!x-s>q_zCqAyFB(BLmlN>5plJvq_wIwaR+nj9W@a16 zyWA3GY$JcjOcC6E%7~2-m&% z;mN(p3hYnG#FJB?zY+K{AzfIo`C&iyu5>&l^2H5&aV)Mv;bl3wF^7iH)%qjnFSJdL#0^`F9DkZ@?1k=3}@GrC zuwdD%)heq8a{yemenVDZT{-MepBBVFb(`MB`FjVFB2U$+{c9yCE}*d`5v>?MpthId zyq6>wBJ2!fpv>D_nU<#u1{zRE1hgYxO?@{BFf87^lT0%O+ujyjn5veWH&dzX0=T9e z>c!$7llwATm?U$+P)BEu&3s&nDH3{-zmhbM*K9Y4{)xWxA!4SWv`JM0JE9rqJtnc) z(&Ldt>F4Aci`Eu9>y)~6~Cf6iS@ zXEIj|?d|t3#(OF?WJaFbWzXk`*|XfYcE&qc+>&Be3Xfc5%dIFun+xn3i^-Cn1>bN(qQFDxd7+*C_=1Wk2|EDP@@vk8X zQ?(aqGlAyn3-oH;f7e2u@nf-~Fc9hkK5z^TBC2PK)Qj`9fjBU3OrvRrMmMuNrf2&E zRyUi;Bp8omo+ogtXKB8@mmvj-0AyD~0W;j4un&71$NjHZE9YhQJ22XUMNPz>2jRZm zbBpW-BV{N$A__T5uTuw3k+rpT{(1~~B-p;NK*76BcxQKaV*sd+P_U05e9r-$8qvDh zREjbLoLz8*9gpY(L}1rOPzN%~%Ur5#mPH@#AwP4mJdpmq~;O0wGtdRpmuqmx2-Z5*qsLTv985FuME)$-w;n<{YW za|db31nKq5~IZu=Y-DG%Es->0(yX{r6~eT-P+(H#r$y9tkj!0(A-v)`bD zBRSqr69@*cC$ogbLbdu{k`N!7<^a{of4s~QV&GfNmI1Sh)?7%*Vq@vo^cO(k?Nu&X z8TBOha^d;${bwrmiN)8-_ungx?i9-OqqxKT1{4e34|)=qDAOy@aWZ=UI`P33%Ks$} z$Rvj?6Hjmdl|AWmQe*v*C~K)|`>D0G{aif5MC@LiUU(od_WH0ggLPK%+BlZxc(joT8Ydrth!yyLgVlVQxbO=)aE(_E6 zkAMFH?&vrFc@IFS)&EAyaz^DfkMp`jJ&|)zjm14?dXY0Uqy*>|f;i;SWlc&P^1S*& z7?hMcyrN$aE>4lMZ*6J?k;rFl;8$$ucp5guRVSW4XvkV78%AlL8zc(`VcBwY*snqycKZ+5b6J&(1O^r@^vvm_* zRB;Tl{7o$am$$f9_aF7rr^l#erGBOTwm9&6r$&2w8RSrczidulXz!SOpXmOrSKFZH zfV^`LodMglZ(9t#4)lm3Rc)X4mKLA29UEQ}zz&L>3A-=r>w5HsOOX>^C+#n*Y$4xG zWyET<5Lxn59`d)y(EQmkl3!keXi%^kQuS4js{{L`gBaKJ$X;Y?3lp(tsWzxp!!8Fg zRO{ETG~wd+?%m^xFn%;$=NQUjAXTjfOuD>#)m+JMem2otfAIF^b=o-?2&MjhHf?=6 zau*q4#BX2oGJB*)Bes?QM^6Wh1BhN8W($Ny&~vs3Pb??6axhV2TVvBwx4y#Qn@D54 zxP3o322VM@gcqz@aCzSP3=y`oM6Yv4lr$mQOe{i(ewO2QX5vUhG*iC`C<-OeI?3Ze zY{z{_eYIMWtw_4CkN0=yj?QNpa{+w5E1p?dG+0=HUuXQ{!U3RP9i@2I9=dxgB=D$i?C? zWMQkqMMT}l&d8gG2;B?eb}348D_1QCrSk+crSEye7C;FPUn%kDD>ORqe{wrII-lT`C$aXUuc*Fw=S@>ossMkVgxqZlXx2nqL1LJWwylt{+2H%n~oVL4=Wb ztEyH&xF7-#BsDKoMexacB6~gZjJBuxMjg6ob$IT3B z6iVsB0~M&@+mbukaw^FJouURyViHVJFmog2CJ5t^h@UkA+cq~<2&sF+cwu5wvS zVGu8GEs-&C-SrqB48DW|XqKJh_(o9>4?`T)sXw@3&_1yN>z9)X-ci52XEoC0G=I44 zYxi#!BO|O)dhX6thKUC(`wQgCZu=7awy?@Gx%=l=Z!+!`O*W9J0LkVP?F*p(lo27l zxld-fRSC|f6Uy$88cS@xyE+Y1&+(TvzlW?ps_5a|jkP6j$qMhL3m|^t0;!|)5(JH- zV1(c1Ptb{Y88iY1o6th>fErS?{}h09@cu+_TuU|z5eqvRbsuL=j}Ewyr})%Ezye^} zTtk8P4!It0bPoTHtysJ1wBH+~dA6zynh?B*JE$$W9v<8Hj20&*s-UnQa-U<%Q>=Wk zXx@~)wa_tCI`dg~2AH(1U$reEXO}HYF_Z7i1*C}kq}*f0ChK6Yi=&=Xj1gOzr&jyP zPQFk@?;vX3V*1RYAmAbsc6iYbz)*}+Cz(*M-B8!I2k zmiG1+;uJ<}HxeehCLmyAtNUEJ{_Mkb)R!*2PG2LhHpu44`AF3obycLcN#E=mq6%z$ z1Kd4#Otjp-*L7k}gj7=DD|%6>&XLj(%cpTuRhOGkNlo0|)d{mWdC|&j!EU>Iwb5Xb zF{ouQ2G)|;9V?U~mSu-ak@4F!*47d&Nzvbt4;7_`P;h-eyfWxR=>l9{>0lcxv@LLX z+`>aVT`ESi@9lelqYEtGJJI9(kEs#7oXg=9*f_+$7k?i^=tLvEda&UrXe92r5Tw5w z-2!OpCD-$uOz~aj&zNaCy0*0h{&!h)ucYy-tUFz-N~*i|JaB_QHUDgQ^@OPBf6{Z{ zr4JZ`F52cU|1QQ0+QDM2Z9HifZLY9q+}zsdEfVTnwj8c&P2nb^%1+7~avc+Y)r~4+ z)s9z%AD(gA*erzkNGKK@njA|_a6r`w%DMo8?F+^}0d*|UJl@j-tS2Wl<}Om~{JV9? zpwHRSQK3L4L4i@Dw!v`OcYxe0;*q*IS+H8Yoz6f>`1-r|Mv-!K7s@TOb0T3sTuhf^ zyRN;)eNv97rM`r-1V5nmfhV4}uwOsM*?;7i4vf&!{C8IND-%{CcX845<&##)x=8cF z+}~J3REh-`=cGo1mD!gNy|7~@kMpQRc#dx-)tb77todf9ZIBHN7NG$toH-bUh+}kb z>BJMBy9{_fQVBejy5n@o8aaoJl0{BNPH~?#gAkgdkVebL>xVDlrt4i(Zc<@1usR!_ zix zKpx4lP7kURmqzVbA9>q(`i-UF=7!rL|51JNV@>`iL_741NBVzIeZE0w|r*pz|EXp#n% zQigl}Z%B4F*#q~$+s-KeVgU_xUZAxncULby8XW!&ii{-hw`FI{UwSXNh+{0i8Ep@7 z*N#3nCc!ZT1u#oq!ZUlf5$SCustfauAp^!|>w89x(>&hjN4}lkfpT^TA?~#59Y9(@ z#vtx^CTWr*m+ck@>B}dH(6>G|_^BPiun12kwt@oRj}Ale1y<6h`z zzS!s2=P!M5LR`Hu`?1K4m*imZS6bC&?XHssW_(sbcO+&*j{+i85oU zz$Vc6rVc}DW(=>h!XoA$kxz+HOY4sRiCdT_ZGMzcbDmhhL7t-mGWMXWnz(am7@NOBI;& z16&I5LGa3Fc~WC?kcQ7lC=df5@B6f>nO9<>6rtP^J6AfljTVpTS#2}|-@esIu{%4} z3JC}>c$vwk^8B#T?*oe33}c}Emcs5Hug|squ4nTdNf0KG3c2~gCzPI^QKHepW&mI? zH>XXnUuLSKC%<`}qp6;}x7;X_1;lXyPV_mEHylNvi)zT1NS1c~hP_4epB)f>5!DK^h-Br0f z4Z(PF^dO+~rOD`6tx`nrMepaZ`SaFU@|dG8!7T2PDOlK#5yDREByS_60j^wyTs@yS z<|BgV1VqCRZV91D%%vJ=q@3?A7Kv_%%2klXY$q3H%1}H|0n4ee7qgG9ni+J;vh2P0 zXSfUx8sdsygTGKM0kUO<6bB}a(y$X3j#uGSy?nuBk!l$uaFUw}OX2`n2O6UFckV6Q z+V^G^z@z4|$@O5m@^R6}AAkjuPsY@Mv?7;>M*tw2ylnHd)a#^0+y7@yI`mmSx7ALw zbqHA%S(h-m$*K&T)tVPKI^YtFBLPkay%Q7iN|&eS`{T_A;35REIE=|QVS~qZc{IBr z#$IKr`;zfD1L7JOgXe-9Y5K_Tkkcw)2cbvOvyL-MR@v=~aNzm_OE7REgb}p!w7vOE zH`LfD_Ihx_-|@tNhO58Fr$eax+KPrIq{Hu|EKTjN>EVER?847ijet?fGvVkLn!j#f z8TbG6949xM+V!uR%KTF64h}!steq>-Smr39g%@8!McZ})=zj@@;*4JPO`6XsIoSSG zYrCHD(?JC4ZEQ~0Mi1;&pirOwA2teOhR7eDq!C&z*x1-E_7)hn)sI1AEb=hR=oTm- zbpaZAtS8DEjA#8T2@Lor6z`=-&aYp?fW`Py73jZD19AVb88J*Y*Tpvd;7#C<85{Sz z{;R2!K4_iX{iORuVFT!=4=pFU2yPr-vy7SkSRcz6Dim@7mLR1HBxAYFzbrHI0S%qm zME6@AS zF;Bo2JP_@_`9xfo1_}eyBC>JRzeI_B5i#BfTBW_*00)Dd2@_nY^%KXUQkGLB&HDy` z5hV*i<4MaX4blx9Y8xDH^sJy- za8&u%AwgsamUIwGO8(Tn3Zz;4lhFlU>wzv~u1r0N>t{4b#Ap}Za7_)UVpU#er*K6* zxf`4U-6>$P2esH{v8glrv#MWQOk)b6W)?4qBgcm8YQ2ly+Zm%z{Fi2Gtw+{jtaZ zi|*}lVt^&5Z^3<_wcC$yM4h9<3Kqw@nkyyom$Ll3>=MNM40Rm9jAAgkpA++pa_BBb zyE)6g4B<8w(yJ5~>$Zb&A0siJMp#iRx&mzMw1`YStd$cMjI z3IoUrqvp~)NTrGZE+`Q`_!5t`dz1u>zrYCLzFun(1l8n2U7Wsn!zA_I_-TvNPH$et zmM;&fz6>BVjpu4y0Ht%+vAYwZHDaB&U4h$#IhI^h;@Dc>K%apjyjhpvXk{g0f6>sf zgkerP(@Y-$#vnK-D1Dz_Pp}4m4BMBPCNfT9?m)5F2~ImsDnPsD(ngUbJ5S!bn2CR4 zNa?0J@%$k`=e~(AJt?FAtJ?Z%4@|3>fdM*3KgsFV5Q{@URxHMtVgFMtpOeAm-i)q; zvcB38yc5g>G+~6%&Irk#GmoYJa2&JYTa(CHX%5^H3aIB8FkZxsNvJ~=ozxZTd3fMQ0mMhoxUn03Ib zA{9nX*T;12@p{3FJ!vbIZ8~1uA&pw$SD?`c<7KzjSLMMyzt)0Och*vdyexMzKjN&S z(KoT1qe?yHM+91m$J?;36T3`s&AXNXOv1#YOH=xlhIBAW-)B3yha^duV#Q+v zl|2(+^jIn#85+6*w%R``pmaPlI+E+yOf=Ai+WR;Puj6h3Tns301X2+xl+o26`At9F+|&4}yRW0}lPm zCu6Z&AkPgX1<7Ue*PC9TqHH-IZ=Yn4NdY%0O7xw*@qCf3_bM!fN)0rutV%}Tt=6vt z{Vw)^fHY|ck>bCeXR>A7|I_k}Fo_%AKl9uf2)kp0qYF$irbi1!J}nrBKTsA50y!+9 zt|$Gwyb*qP&_>@$O&F?Lsp)TlTn=&_o|4k+*WGmOb{gegvQdtCM>WvFcmbJG(^RGQ zMfW?PD+ZAMuyb+tZT-9iW6Vd-pWr13K6du@X``-yqXuq`*di6xdO49GCgjI_+9u>c zkOCKcFD_K0;kMsw!GPTw)Xe1J13Nkd4n#&Z z8&F960C)Wp>+p}XLRp43($-4XwtRWd-E$Rc!n3fB=eCEjfI`6Kkv?MduLuX}+VjCd$tQm; zb5A~}bRZ#pe%4#{w*n5x-la5H<$*CT@Pc{-#k{sIP~ZXm3M%EY-OU3Iam{?k$d;oz z6+j!2Zf^z?u`6IvIvTv_vgfz7JANJ>5ForqMEVQ`NVSB6DVu5oMh9=C#CM?04SsW; z0Hb-xTN5q_uk!HxgJ)iIWQgj4e_VL%k0S6R?2! zP@2Tk&Q0H37s)Uq6%{^0qHDaePK@d2G;W`it55|TfI!jDOXQcEyA6C_9d_nN+82^^ z5Z?v<6kT>a;#6v}KD%sj1fubIO2o|$YX*6dB(pWfRlt8tkArHT+s+BNl6;Q21^gOc zYC7P#eR2XAU9S*b$S}l!*ZcnZI`O2G;FCJYf7^jgnAihlE~7QjMg_OlGi4F_YgUcmNqt1N3&J}voQo;k&m zJD>Cr2^?ml$;>o`jD;%0C9sH*oHunykhb_#UwKWe$b$+_TQoz2b@;GbLwVu zkYpbRAkQ;|kdpw$7bM;Prf!JRUUqmoZD8_xc75Y+a5=?o20*mG0e4VLeZ_s8lS774}F$swb7{2E-E+4Y}h3T zcNmac!;o+Dhd_@ZcQ6gWdU{BgBNH0r3nbKrhSQDLe8pnj8A?3?e-_AgnKg=Se-)|1 zL)o3czP)Irb#>5$tlz-F*y&lgO$^l*c$S5%u)RHlMk-tM2I?^&qQ$|{V|Y=aVO<+s zC39|Oo}Zl!jPtaEiXRo9O`#zc+S;snc{sCBOU=-976O&Hw(YA1{Q^>U#5!0n-dRCl z?Om$!zBk5vv34X9y;J<{-@n_RvFFv)edU2Y6i{-1iw%l*_dP;(7q`cBO@DWWT)h(= zk)f#nO?&*nmZ;RGA~EXW`W@V|i#cD!IJl(Xn|q8rrmZLK^vc7Jc7DkSM#yY>g}}FJ zQ^41?d(Dk7+Y=OWJ8Bg5CHpShKXUKps=TO9(s%6{eA z>C%mfJ(%Pz(7FfesMKRamG3YJk}J0|W%4pp$c7RNobUgF!tKtTlaWg!;vC<8tkNlO0T< zj}9nvv1U(?{DCrtN?GS`zzSI4fyzzf$BBZ=or$%%qt2I(W#YG*wx1F4`fs#v6H-%^ zZ8ynWschh2fQA`Nt0WMo2>09YhCj7bs%ZPN;O<{tbhPMs4D5FQoAn5wR$sq%w2p=>)C$(hHYvfX<*m3z5){#0!lf^quzTCYl8Zb5vAhQdWd#O zk1n@M`D@P}i~ZF-)J>`p*EW8^i2r!(y1g>9_gL4}{AKAG{-`sR`W){s=BiDscY=z8 zf69H11A;5UeJYkx7zpz@orx8%?A~iCssDDUH+@nwd81=??a^ z-)G$9*6gp)9S*|MEZ199Eq;jY8I5N9qDKYeuxqci49E`6`!ntrPCTyToqNkWJ&sFbkIHqH8qwlm^1{#t*$ z?b_KplR1b2?na&c855&PeX>@ZGfhK>8iv&w!ZW?dF#Q6{N!67? z_7Bt#4}?AqnRaQU{dMbR80mezspiw&5d|i-{r%)rF=C*Pein+);HNx(j?KXL?OVTi z2vALs==V%~^RIG(9(&kSIRs))tIagBxX%2{D@_p3%yI%p&7MCUCTuGrsQ3Q) znK@c%7uuUFVIkXSh1HCq)l7!21n=kq58-lquhc%qOw zh9BySLV|*W8?0`6%VSJ4(lfxjq_cl^cVOFmfLttxwvg}0tB}Lp(@@}4yzAT|^p$Lb5)`XcdT&>UAH?Z|ISPJyXn-s$c2K~cuhCNAMTXCG^x zAK`B8mlAI|xx1)fpSYBykREbKE$F;%yaTCJx|%oh)AUGmP8kRE!o`Xv0ieUn?73Mm zH9XGWj}cK(QR1Itgo$;^rtjIl!itZXRN;gQ7Aa85_c{r9dxRO4aspKaM@L&=)~cAV z;q`o6rMHT)lDM zc#7p} z!4(yQR`q7TBN)!p(%#-WEdxj%PZf(fu7vhNsP6{69)XRbpI&8|w2uoIFq11cDlI3} zfaa<*XrQi{ntrcw0DT@r%+FW^Z=HcCCcIeet0Fp}Z^sQ_wpn7aPpzl<4zUB38elyw zB#PMsQy5Moc)U*B#QOQ!b&S5i-id~DTm_5mg#mC4=t$^Ui2E4SAz*c~;%3H*N!TeQ z6R=WAzRlJ5yqg@$%l;)Iq7H^Y4IoXE_mu)rQ08MY2mCp!(iY_UE1sR{|u(N0`+Uc6b2b4boM+xM(fk8nS7RM?~CdZAJpxOXK z$F5)gUQA^_1YtkEg)j)c=Ewff2h<8S`{SY>kFll;|05v*DtID}F|?`%KmiT~=QgPZ zvQ?NDwH;isv`l13t9HM7HbkB*qCG&EBSoQBy8JVbp;Ib3c53KqD^9jUr_9Q1Ob}%| zPOB{%8wlzGi}JVT#tV6roa}0~c6GeL)#pXD#2K`w6D?5fL~+uXQN?R8)8{@qnQ+Uxz#|4vs;`DNlAxQ`qwM zBWxkY)g_IiLzWR#Zsc+${h~>Ll05)p9CM(UN@bd-vK;QJ3zClisTOWbz);Z^SVRdw z$A;%&mMNHk;(hI=+G^#7e(6hVyIg7FAPdEn_!E3_3-e>=03q8poIfzi0Fy!_KJ@;J zeL0Bk?N?ElR2q|+(mp_)?E@-ofzAQYv5@31V+_20u$RdUwa5gX1nzYl7tS+nTKtI$tSngxbP80(%BY$6pzR$tQ*#PI7C)(qDIrYrjg}m=4Kqi7( zt=UCAOQA%)a1abYny;35t&WANXaGdiYVFe8#V)niAK-E^ zfo=27oYU4ol;Qfdh#W0%0mx*x&wPvh(qcU?^k`3KLleM-=L62&xq~Io5A5u-bA1W= z)4)T6R=xf&mEqA3AK*+_px)=HwM6TBwJ)j7J2r92?_%> z2lEeieiD_^AK#9pXbLM~!6kefc>pdnjm~?6K=?Uc5+K@uaJZkm3r?z53$T?H7Y{j3 z64hvQ1F%2gp3$g`(4Hg1<{yY01m3N z+1$SrAzSnMCOU^E!h9th-PynYkpi^y@wyHc>qkmS7^(1_Un;#XIAmYh-2Ds@@!f#u z9;l2V=i}k=3J;eeuK(ixhL8|?vz3ywhDq;yx{gLBSz0&&2BAPA@ns)<9J0HESuo&N zBobynxwh1Dh(S_Q9W5*@fNcy?0T}C9IoKe&VD{5z1FEyRN);A^wdh@O3bfwFKJOg~ zfa04@CvaOX0zC-Ou(AC6`xT06b%WJTc_}9&RS1FT>E=maeDHItCroJTbI_WF&?Jg= zIBCn1#>6jLD1VNz*jELXJM1%H15gN$)XPo*bUk7Tm^>3b#X{2$;DRWf%B%F4-em}Y z0lLb2ps%i8Z$}}Q`@P){1^8aYXEzz_&ea@&l2)lxt==wAxxyfjS);|{AxesiLa}&0 zTO#2n^-u~o^t6vQ7?XA}U%r4J^Q-HnSxUIHS}W@h;M=fQs9Hngz8FibiZdwE8%^;E z=-Jxslr-P&#x>KEMFgUeRU3`8jg2wv(1s3vwOJQtcUW%y0nASWU*pm1b^m;YrqSfm zQLfPQuEW)1QUJ`KZJFFMykh=U1$i4-D>7z)o&R!l_y3dhD_60ywkGjDQ^fQ$GH@~A zs4``+*=C6@+WCy)#IB9I0#rM)4Tlr9^^Q@7YuNtw<2WgL|XENEWW%5w_17D!E}4R6SaLRnZo71H%X0{SGw+DoFkcp`1&=M>t$g>!(Fj@ z1NlIyb~|zeyr!mRy;+cKDbV!{!+pB;}w_#0rB!_kj+aG%#t;N zvL`A#YPjYaoXS2vd>Df_)|=5HQpwzeEY9&ee3$sF{3E#+1(3Ritm(%Mka&)H-q%?i z#Lux5Yqpro0R3(-FgBgO0~Ui9xGY17^bs^pS}j~xgj~IG3@^rN>N6d4y1bdhFhlV! z2l}Q;#@r)dJ^(%^Om@?2D{Iz+Z>pJL|)HAOUW%R9kF$ zlni>~OlB;Dg5;8-n0ygF=D1S_i`97sp(dELn!E(h6np`*ddV&bTH#3OC5`S**mb4i zLY5Xa?0OV{zVo3e5QV?P8wDwdJRC*tyvjQWUVxt`Xf$Hc^$7nNQRTVD(cyz8#^7&3 zZ?SIQqpq)8i--G*YRU61XLB>yrkz?&3O6+Z7}Prk!7}9cZf@h_p5tdjcJ(DmGPN}7 z^>Q^93(Lz|B_Tv)VA{)~)#@cg;7rV|%E!mIH&MXiaetjBo0FZB6OO}V;^a4)CFXfP zA|$g6(e#L8Hjl^S4<(zeH2!36HX}BBMyXJkt5UT~mg4rY3nBq>!e2gkTyC`j!5FkH z_vK#=@(jOy^Dc}QY;L&Y)>H%AZ@kg@Y$QWyZi<+U3_`8yaCNv4L#Y^>b2V=}glpM2 zk|UL}Z|Sx*m?Sd+_u@5H=#+owubMYlSmf4%U19hWOf8SMd*JcbQ9fgH;()*}0AHy4 zbZ0DQ!~UQJW8p-gev&BOCFmZ4;ezh@@i|5XHzNwC8o4;zm5fk}FF`{b%%o?Qbv# zOX2I6$BKAA?q8HRH%RuXxA*mpaS1+@`up4M4nK~NB};p`Rj5#b=B^F<$eyK#G0_p4 zFA3e`rF|>i_PK@QNWe%U`7z-Jl>d)%y3#71cf#l4saNtN2P0aI)@xDE{YBHFf_Ed4 zrg8gi@VRVXJT}(kx3#xt4SdyZ`w7Cc=lxx?`yGvPIlqLtLb2LRfg-JOftajjwP^2$ z&>JE?zvs`No6VF9U=Vm*Ym2-AKFTSshjkDQ7m@gfB9*FMJiKXYmC9T`|JQM{2+ptA zx;ug~aakF5uoj?lz`udou(b(d|NivBD!i@i%8}$#wnDpHq}n zpjooe;ILRHcBc_fzDUn?0bdWLoI>+WcT7|sz{|~7S?2!%&GjNf9DLV-vh`+O?oW#( z`bO$XCu7l%_lS2g)sZ9cA8b`Vp;#KUf&w~H7p0#Q!` z8^ZwiTwpQytH<3z&29j4ob3w{LA}s*9GiQp8n*6cKue9JUB47#h!an7zl>|_BJ{ZC zy^K-oq?{|v;^pOy3?cU|o)1msEukFM&BhS!^bNqn<5a+soiuIxk)I!^>5(u~p$Z{6 zGw|fHZVOX)9ak>*y6-!X^+ame#@lkOgOis>d)j^P&!2YR?-j87>U~Sl1g>O?8nLU? z<0B(iH+S>VX@IYz@zz{Q{J>^^2FpehQ*di*YZRH3=nrsvimZMxKiZurP|Q0mDWeA3 zcupI=??tfpO~3K+aX9Q>PicBS9C<>cg71^q?Oh&kwkq&$x+6Zxh#$~uk@5O{eF|9u z0s?Sz#PIW#`?wx8UFGE@gOeuu=gW86jirqmoMl#j=7o;vWoi7=8-=02Z^)xe?PDaPr zFq_{TmoL6NKM3q_-Xdy2)RYX$&{M1Ho3`2M~d7xJ#zlq5% zX#HFr%uRut@dw-s1CdA&MI@9J^PRMzZm*2!haNvjNhPup`MW$^Oo>5gs3*1;o9?Q? zTxWcxKaQafLhE_ElT%SxqEwbX?zvEJFPiM;?!Iv?m|+cl^c2jXRxD0ztY=3TAZTIC zTb!@6T>_g?iu=KCf4U4TxY*_)E*%}+OamLbH-n+i1bjsuEAi{yB@q`DmoQbIry{VR zM>OJU2BMjQ`br*VJ>fQQXltL%IfZ=vS?Z#am+|5edQ*?DX$;Sg^`|rLSuMx=?Y*D* z+XyJe#>TsCb;}&X<{CKb2Xi%$Y)d=4^PVU&a2?Io*%~TCy9hmVub!>fGF5=fLx$#* zR=Iq=q~#IpHb|lITy>FJSqh6~vb*F9V0UHgN{OAp(5nwUYJqCRg7fNrQq@vq?JMB8 zNTqNAuWefC^q*$-4~{jjZyu;L8n1u6Am~1=w-HyS7`OoT>uk~dxbI}f3zcPY?w_KK z@d%>-y(>m;DXe}C9BD6ruIf>WJwK200>~;oz+y-K79O=;ZiRgXFS__!c1m(_Kbk@| zQvn5sv9u(5K20V|RIymCXHD_52lT-)5Nn);JkC2OCx`vFujr!iM815?H^Bv16Q@I$0RuC|#^p*MBE^10HGPl2U%E1^Rf0g3BBY z?;Jy?+u5B4Fr--)L7|}wO|Fh-n=Em-0=5(s6rLp-uI_A10@iMqF!W5+Tl4%fnLkib zp@(;bmd-jib3*xy8~%hZzMfB0&l4cb56H-ljfZ>uaA72`OCitnTAblCv>U{Gf%&%j zGj`HB4FP=p;)HJU_Cq|v#Sz2)3Q^FS>)8N{SS-~I zC|oF^Gsi3KFF>A?A@nEvk;d)MpFi&?g{ji#-vugGTP|_gZi;7FJ$!w*;>MgcAYfLd znkx2HMlvnVo?~gsIvqL?R**uKat@piVk%TL)LPO2LeF^$MfvP6x0Bwze{a7#zB6Vx zIH+D~1Wo(6F!zkyd%a~AG~jlPiJ?)_8)y95OgXA!V}%$MR0}h-`_&Z{gQ;VC_JU+d zY188Go})*qvPxUU!W@3CxwQXA(aY--Nf(fM75d{9_uaM+&cqQ9)EOm-%{Cjv5XhJm z47F=rLvWb#K|Y7db)7210|E>3MZYJK1l&iWMC=Z$>)T~VxqWnHWv{T;Ofkada2UyV zA#eo~Gc!GGS1V$$=%_s+J$ZR~HUuM>rML`ah|7o8rvI$y!dfi2u6JB>fuWp?H zZo=9otx_Q?RUJKam=E<~3Hq?K5KA9`%6)G&k}h!h=fmky&5}m~qp=K84zev&%}5Gc zMn(pSL7$wMUEM}Bh>cSn_PbkFPEJ-PDP_$(=WjH4E6i)Df8XD7OCm{-T{r@fqQiq& z^q0lo-*OBtOz>w#`)8B>vlmcC05G z=&sNcD(P__1d=s{H=f+w84;@a-$h(XMPAYR^sP(`{w-&J?Q%9_3`m> zn-n&p|6ylp**n6{j*jfC_bELbu-#raO=c_$;A7}mWQq|b6D zBpD@^gHcgJ)Wk$bC*6H^5qkRYs{318AyCklyTKI`4G9aBkgU@^Q{KI}l(KDhVI(Fc zp@1jzuTuBzc8VE~Mt8m=B_oYSz)R@RkrWjdm6ROaLl*tx?>9(u7ucr7sCS<7d^vZW zKY~gVpOO7(_XQE6v`7M$WONs(lB8{#S=ZoA9c5#sQ+0W9lo;? zG-NlJ`K)m?e>cwWCBnpg&LnIzdh|Oe2=1haULQLn>GUG+rBq%U=jEOLK2hf>(QqEF z?$X>u^JOG4TjG(4L_zTB=@A)3uXf%s*A&{;dWp^!D?Tba)*m}(|MWsxbLSrHy;EUp zUGogz%(af}4&bnxy3{K_=BTys*?#m_}eB7zI%=W^C*3NfC2N` z9}V8C(K;5URoL>MVGs`k_}$ab|G$4Y8n}ohNg96Hwr8J{YdFn?3F|SbQlhFhP9HF^ z&F)EmVr?%U%5U@fOqhJZ4n=@t*h|Oy^}AoIlv>z|RGCkuK91Y;>Ej&hzM!grw%QAF&T$p+84Zdp1w+}dhv0m(Qp*~@?omudW)UC*DJp`7(8#BCA3vI z7_ao~V{Zh5vcKwWyoP2~661N~q#4qd{l8tAb#ImNeez)h!UfV>Lwf9~F-%od;%Ceh z=sN?X!QTz?`-Y4ojAP|E%%%cCFfJ4>TwdKbv!ma=Nqi=dT;#7Mh)&)oDM?z;5g#85 zQs?|Pz}MR=J?(o=&GYY>N*n396T5o!z^4MZ;YIyS0PR@PD2j<#=1eiv_FDa` zN8huh;;1|R9()+b(-z#zjS{V`ucJpJ`+ncOH9IjO0ZhRO!T)`T-qm2=wre1A6k${p zZ-7!BT2aJdIh@3d4XN9C_e#PdX~YOQ|9i9941KxV&gjM&5$4#~*n4!LYHMsN1xFc# z)N6XI3-ENWUWvGHUVVT1z}7$B2)6Cf=Wnfpj<^+#3opht$S#`o*20th9tK5u-L4O7 zJ410AFE?v}XV{D)*L`bh7lHHkkF@Y`EUrTLIafj_J13xoxY^|KurjwE9i5};r0ifh znR!xJcjlSQ^{Fo+#o6ZCi>s-|V(Db?XZQqWWTbMh-qJ|lnCz}>jYE+NQ$Da}Xt`;* z8o#h?c{FKYzS_LT(7-;MO#39nK*&wOc60Cht7?zszRD>tl6!&OF?s=5fu?8ZA|o{A z%F>^y)VYY4ysC;4yiVlCoK|E8!y2*5I1Ickh1?EnEy z)o~wy4kMYeL=n272oVU+5)0 zn3G-|pZ~%mvc3J4m{_iV7uHC5_AqXYNvjTS%P6ip;|wEg-cYhj?LyQ)i2L#XY$0PNLd*WeqL=G zUliH;%_A9>=pq<23jpX|naK$O0ZiLTjS1VLA7C@(K!5K@Ll$=Jqe9!n0zWcmV5#BLnY zJ?x7^1NNrDZg(^onABmm!K-kSn}p|SDzKZP-%IARv$EW8JElnP?~~n6PpIHQ>|Gvk z4{vq~Jl@S#14oAG_?>F_sGeGnwatL;TrN)6T+`djdZ^BJ7SNMoi+i-kb-S_ASEPRI zdyLxH41m&{oe;Vo{{TU4G2O^?r2g#wVQqDl9@Ty(OWVh4^(2qw z6w9`!g=*7IOa;~jZh@kjgJXLf2L0!4o?*Tii0$8ah9Q3U7pSF+GA!Nz|2?2uy8Q$8 zq1tRIPJb-ley^+fQWQY;rIOg@Dy=ho#UOJn#Uhg0^l|Guy%VOyM%OD4W0$71gQg@qGtP_qi>vCj-IDOJ!=%9z2qa#b6q5q{h3CYb0MDuKsQjE-*n|moC_6Oe>u1ycd z7{0F2ZHOzmj6H&4*0%H71Vn|=d=&a8t@i+OQ-v{*R0p`>QZ0#@^OCYHckCZOo?g@} z$uAq(JdA@geV+L>8sqjLZXs9fJ-Vz#PbD@(0*m?m>Dec!MwLpkip4q6Qmyk|g%sCf zntFmL?~iwsR1a4VFKf*X7O!QUXz@(Jg%Jim)nj)9 zna2cRoe@LZ)wYL|h7?I7hjeD*1~#F0CgtJbjwJ*O(YUX?>pcL5x=6Lk%++!aTn)Y& z&57=s#zB@#RSl{+VG9j*i>1zDZf@Q-IRZjm!t2^!*55ZIa(HqvGhZgh4%kv!N%diX z#)OPGh#FZNV`J9udk@U0rYw3|&`?T9Y42&79-T5+%0>6kqxJysyNT zYI${azFt4L-?SKz!Z+vH1U_A^H8eCZ8IPB`C%8_T&)bc$Q9Wu@834jInAfv<67iRX zK3)$ceFDcHc%kf;f4;$Y1QfF(BXt#R^1z}8KRuV#moVEs{@Oq1O@_CW&M4+u@v9^q z(NL}1{uvwJ7MqTsI7Nh%7OU0qJRtX9q|!iBgMYO@=Ls&1Z#v$Lv*58b)BiSDhW0cX z%ml?~ia$z@1Uy`W;tDut#z`#yl8!Atyr7QT-0wCod4|tj@l~U*dSc6x zP?MIE6WCU{+vt=@{V8yHjC-rjVZY6E%zLqe8rA$om1?N@JU^0dzhjge3K}01;6mN3 zpts^t@bv(xVCtJ46K1ny$5$7V76tcnAA@7<&ZsX{2f3WrslTv@ix9rexi&DR71#;k zcEPzcJ$~m%WSnxoJ*!+YB_tq(iy{b2v@2$)LW{w;p1hW%r-!1KnhwWoOsbdL#BwWP zQ5K)zZQgo#heOwo37}50RTM}Uv^Lz}yj3mYjev@Jb%TVF!ihOwEV1XR!YCyy9$jeF zv0D{G34gIYs+{gmx3(A+N&EFoE+u(Ev1IOpaXh-|7*OrJ8yg)vGM`AldRXX^y5|mj zO~P`o->av{GSwjl(QLw)thD}gliA4ZFb}4!8!wMS+%w!0CdHr{&d1#&>{TY02Q#05 z_BVbiT}_h;vt=xF%`mphv`6*wqQZ5Gdd{Ko;qhmG1CSzz7D#cs z7@z-kfAJdr8uI(9!TdZHbV`tr!j0xj|3FgQaxHo@=#de2hIP#0PPWhO%t1=*+oA2k zm`f}=9L}6|C0wZ>QGqaXh%}tUvMreq(l>7x=;m850JM?Wt#{?d1Vb}@Nu}1-&>W8D zAkphEQTVH`^S`Hk1H3tqkDV%Weg14RwmHyyKo-}=vINc4o5w!iDqND0l}+*7u)kpb z$f7t!8j3@KjsM)mZtwo=e93SyE=O!{DM7gSKLq> z3=D@&wNfgv&qON%AZy4xIM`boD|1)vS$jMx=qVQ|z6Urg5m${OJ_}bsq@+yg8oCcV z^`I_up1T}sc~pSgl1Tl}Ucf?hVkCX7r)D6Mt}b*3T6NU=r#m;-KmtcBemHB*eam~u z)z!JD?Z~s=bTTu7IHa5_CFZG;vFHUkGSLrj<7EG55+a4Az=r|8JLM3xVviP!yf`Re zVPQQVFCaDvS=rfnND2iPI!3u_9aX3b@9@zI9E$RR(U2a>&{sA!k9`i{zD#{LBALQ= z1`e%I9AB0M z08WYrTTlB!ljcz}P{l4%ZkpY%J3G^S67^foeu)EvE)M!kG0)hYPvtIlC-l-J5?nV< z!VFOWl!Pu}09f25GV3Z3bckNxDCDUbpI&k2uf+fzx&~HF!k3%-b<5-9<3J+OVy2o; zea&ud)sw(=19}~|aiWqB&c`_j?sy5MF97I467NeIQmW17Xe@6!BBWAU-n?^r^ezNT zzaN8{A|@iSP_JwFBmb$^Tn`0{V}8|@$j0fqxRje#MAo8*f{>woxz8QVLB`B{SRx>X zaJjd(u~P?Ld&Y><5hryx0SBG?=Kl51=M+|+HN~zV6>{G+(~*&Zgy9!!G#Pxs@<-m^ zT3yxY#*(HbqO+c;zwo)eu(q|2iFF3C!oD!Y^>LJ$+0f1Hn}zF4_2$vF&fnuSP)?ROqdvISsQd<#An$GXh z_y|SBBobP*A_{@x!ChR%mLK=+@WVoV_rxPa0~ZYqm*et6Q3%=dNg>a02p;koJC#8D z)R9{>s##)BAtTvSL4iiKPEVkXG?hZ!BnI3sD>VqhXCMEyTf*st(osnLAxTji(d_?`&5HRNV9 z6$qZ5o`Avz!&BA@fV373VfgICBqaLE&KI*)IL5}LQ6f)&_zbMbN4bkHTnp z&yF-Is>f&;Hv}O`vMYLdIAB7DPPGWb7K~+FOjP10Oyrk;FFI|IpgPuU2{r*`EZu*KXr2@QRQjySB0M#?u1=Bk^0|Itc(M0&A3k~&6_ zOrSCPTF&d+%IdxjWBlr>?#|4zQg8HUl5j&GpNX8UA^&R#dD_?xy`yxG6!u7|M-yg> zd%awbmyb}GK_|@^10s!=laB8E8n2ux)QDH2n%n=qu@#W{%#|*gBRfZyo`>$x|#Kx5*^|?)c|_hNj3q(&zK&^Iw?A zcQrxNqM~*NrZhYZ_xFaHzPfDe+OKsslCphs;@8W$o9%nc46I#2;X_p;`P3~5$jzPV z45L)7KerwFicOgE<*3BBq~(5fo*T1~;W6W`!5;r?H)c=sm6LN_*2R*(8UB-TSJci znS^S!K4D*mz!)i0zTzIk^$H*%Fc=QW0}Dma(7^;DoSdxDtfmZfQ+F5)2|27kQc->T z=TS>Oa*qB8t_bdN;zYdBS#^>@=!%SvK411heNy9tXSA5F1v4FT$L>~-CT{38oIPmL z*0XX@TD>_rsrEnwws*U-jw~z{Gk6b2Ev@&_Jyh3j0Xhk}A9-|q0dA+Jp{5ELwk*t6 zDHN$gnym6O^cnX3J z#Ss)7yC6w#1pAv2e*!@93$h_A)NEO#jRKQ?*0agwmVEOYmZmt-%c?|EC$+?l{F+yljpn=i~Jnn6EwIr@+{4 zA_mOIx0hNxJA&Tdo$plG?c9}K{E#6A;^Z-L#A|j$*e3>Sd z34cPYT$%> zf%AF*m3tyrp$L>y{}FKYygpG;A|*9d$N36*=dE7Nz4#!E^o^B zgD$^W10V{LYy(^ZaJc zoVoX0f1qA_^WER?C)Q`ZU+cXD$Dh1w{n4tDRKSRBaFv|&{p82Em+sLWi$+mHLwS17 zG$KPW_q++7i9HH*Zd)D7o68QkjfN?58c17mZdRS{jU@Q-7`hUYkuiRJ(UUArDGp0> zjPC|4EDZC9VsSp%~aqlD?>F^#>HjSZ0Av@D){3TMwO8| z?oK*k!VF%1E;?cFK6; z@NSC4t>p>5vHG^XfK&qmz|{ekWnf@%gnBQVqgJB?b@SY|-$o8Q)mWfIM*IlsEzu4Wd@AkBzHp%a%>w$#w;4SG@TM@RpsLfhuwe>`@NRqt5>fY4P=tA zo5wo00d|lm{0t=D47}k|}JB*L=|pRlx$0)5C`eJO>A;)fK1` zhb=Y)p{T2oXMHGg$S#Rm;*`8)mp61$U%c;)Sz8`f#SqSx{yOgwv=V*p`e63dkH=sv zt?neOCk1sdR(TN%rJVoj&(asqc`tFQ-YI0RC0K5qxMag+w(ep$g~Yy$t6A&fni37=n=^k?{LQvje%-OWolt zMk1aMx@vnQc`FVkX09~PS)`(X4JEUmy*+m`2Q@|TL%GjFh~de*QOBWyeOL2E@s^)j z+B3tpIb*{cBN@E8X2D`p&?OW9CF9TlF^|LQrk;8>uaBoM>3+4l(%x{fZo~-{jM86Y zaaXXg*&an)$&gYnu`=vSqx3mUiFOcC?(M!GTFw`;rUJ?{uTJCN9=CK33kKBDMbaT- zN!3n(sEU4s>AZcgIRnR)z&XasgBo={TLt{YAznb(R&jrD+O5-Ol?T|1d*RVjh$|Kv zD*=uS@LY-g_PYY)2j!R!UX*InH(aKo6F(BpLYtL-WaTkKOZE0oS49C03qT<3PxeO4 zfRr&&f=Z2mBJ-Z`mOr!>6~XDFS$zEo3SmLu9Gi5G=-e_0p1l19q;c+Jx-I1ZXDU01 z5+Z&#Uw*=^2QYo*PUF=E#%$CN-%0T+DUg=9175G zPeqtjey_R1wzD#j1u)B8i$;eQ#m)CXa4mGipa8C6F&@kYwqyAS;G8Xw$I<@189uSiD z>bdi=I+@=~L)!13Ef*9KcsBfca^|v+C8Lj6$a6|lQv|pSP%YN?AxX^?YnBCiK&Dca zG%f45FS){Tp7+)hn0IK4Q#Ek3?qr8du7 zr|f#d(GHwh1ET(MI@V&vwrkt$_}|fB)7& z&P)A()3rQ)t9$?^6+j;A5NZL^mkQq-qfr(JQGZj`bi|QWHSjowKSv+Ht`*R7&>a#Y zki~r5H-ALtdh$TwY)+<}IfeIlH4iq{_2B|hh67ii4WE^(jT~<7KZ0|{&d>41^?>VQKb}kt>BZPU$1Pi17g&`OdAJ>R6k+uRh%ubiBrPP8 z%YF-1+|$$3wd47eGw{QOLWQ6Z6fEE>u#+5e3sFhs>NK77s#>~>1k)oj*(T29upPfgj8hTUKgpkF4O)OBssHoP5_D zLf=!SkaZH&dZus*?m{d(bq)VZhj6R z?-3=Xu;G1ieS?o35o|~Z8316Cfj}&&Z34yx@hvC?_*?jbC9#+^$r9g9hLR8YgMClQ z<^Ca>-oAaiS21ho3h_RzLgvZuyOKZM5i&{5urXC0OkX$XZb_z=O@`G~u<1v%tkxHp zh$H)Lu3(9?X2cpXS0So%f9T`vWy?Xh3D)bQN;O`O#KRkNiBUH!q-T6Lbhr#peC zBu$L+YWLvw{&=drhnzt5DQKh`Q3wpd6~c0sF#6yR&y>!Pl604OR5k2I^Oy-R>V7u} zdiOtavVMZWi6Mov_)o_3VP2nYLn)ndcN^YZNO3Vc{?GDwS*P;yK25@ZFr{X-cLy6& zZkX81T?y{fA3nLc33}gqpyXjGT6uP4bXD+Od%5;luWR(#am;lStG~nP`+p4H8+jai zKOj&xNJWbo5P-wUM~qAO+monMAu7Lz^GLR}I_HjQk>k242Qmw->Nj6*_#!09xrI%PHJPK=GcKPTb;#%O2I zu6Hg!KR>8fWi>*|dn}~-DS-t@Sr}9dp6mCp(+)nrXOxt*dD95fuf(Jw^XA$JW(Xrb zj$(CB&rAN>^YinzM%;vt#D2u$WG?;~^!LJt8r=coL472rHfzKTa`7bmbw41oxZ;$L zAG_u*IR>@Lt%j2-v@+*ZtqRAXp?r(E?&yo|zw7IDK^JeaYAPQJ5U^S9 zG(AnG*AP3BZ+{IkwN#!%!F7B_^-}9P^{_&O3OAFEd0p(UpNl_Ev2Hm(J>;~HDCv_r zk5#_IiBb{Q$k?eo)ZIOtg_ze~#06)PRg^7aW?H+XF**TApeluo#r}fy`0sPBD1^S| zKd0IyzCWj0QHgxb9y}$~RN2hK_;__9&P?N_?hfv49Ve%n@+!Q_vn?;cwKm!h{MM2E zHm&IiAgc^lAny;U1+;aUsUf=qoEs=zv;24IBiK$2hRr}yfpVtsgKAFAsoRn~`vISE zEX8aD@$o~SW>u7%H|6FaT{<&_XB0G?)?WxU!a=nK@fDsQpM?xiR(1VJ!*}kIt;|m^ zPp`&f6lus*7OGtwur=AcK`SgPS z#c`MNFaP31r;=P)_+W|Vv7LUUsMybd`+WT;CicV`yG=_WNp5Gk!A!1hb2-!enrNtr zGXWl>#%7~G|MEH+$f6%>-Jx9yJk7C^TIXOI%sKg&=tL5gI`Mt|>>L^o;qD_**04x1 z0k`qD%!}3>n4Mn*GVr{V{-XaU*;7hKQyeB9;i>BGYLK5bQCu=sfe1aTNHbki=9P?j zKr0$dL#^la+6om`P4SS41~Q7hi)?~CyT9|1RV9|Y!yqa=5<8)5>9QP^Rud8xmBohy zYLmUNH~~{&Feuh!-b5--sX7N51p7145)>gC#HkaTx{NLFC6_Wljrs^@3t@3#VYv_S zVrRX$qYu177?1;H3vO;$swECK6CYoS2>4yi8ydCx_4if$)jGqzpW~aAwh0psP?=D?d6P*C9hVR zPX%rw=cQl5g~a}#E|<7~=Wu0a{a4Hpi8brNiHB?o)-Ez{z5a^VzaNflzA`a`KzaZ%ntT!Og&h_88<~r3oZ2Z9M<|u2>5;sD0wyLNF3ueo6qu^Zv*YE3ACGbjVt!31WDy0!>6wEJ4?JSMW88E;n9Du5e?1iU9#?R zJ!CR)1d|^21O41?Q~YN6PDLdwcQU1ju?lN98j+hk3$>( z4E?7G=|kD}3a7NzsdEG|}Fc747wRz!^bCT`MCnj@B1 z7Fq?0Q1oU(MvTb{BjZcb-&MAXh^3{aYf>3QXN_K_ZfbgM2ulaIX{xOZ!=?`(KAt*s zoLYU9d4qdO82_W`p!e=3U|BEZe&$IerbJ+4Uc{G^QdMewcSz3IJZ1~56Hm(5QVFwc zWnyxy-Z@g{8_xQTA1W*G=+sN!oeCrgp)X=Huq)y!3$!2LBxduz zo3cjqbO)pM+?^xLqNJczApDnSR-oJ(GJ6n@3JVJSK3?~7f$x;@11Ei5J*(PXYF?Op z%wL8Rss&O+i&z@z4EyhEIL`84AP#(G*6k81cont`v>OufEl@NhR+_!RLx${OMAPAEZ58y)u0$3Ek(B1PkSenltWY^Qfe~kaQ z!dG45gIkU=9W`|-HFc9ny-v1gd}k|bgkChkJR{yDKl1+xFZpG~o$zxcEA zSd{hCF<$%DJtR{dLAAcKQZ`I8d8?q39b06lb6*$MBRf3)i{|?>L=*#N3E5-4^a=t9 zxJXY#mRmLrhUd=}H^d;Oc6J-B1-H^$Ul_7dIOn`)fo{Oli(k;Zrw%sX?Vy+Lm(L%N zHT+|?vFvKfJAZPW(yG%L_FW3(dHd+g8=3%QYc81>u1nV zER%2RN>D$rZ>C_tL2DHlo@`j2_9m^iu!+!v!A&4KM@~Mq#*0#4^(R~GSe zTc@c2UEo6k(kl0-e#aBb>Cc^+M$NSWA^aLd`yEW!JwWIKiHKgKL>V2=VBnbCv{`vo z%X~T_%uz*L*eEhY@$|EdIiP^8mV$28Zx_2adFFUIZH~nJ&Tf4cd{xOgHDgwZ5~eN& z2Vm#~rG{ttCY>hiOW=}20MkE!$;Niu=8}m`nMS(aekO1%qh-inAbo}(3@MPg936%R zR*e*)-bVBzbOO)8RjOg)WI?yS+IYtY)JUe%@524km}*WgJ$KXl92gFqAQA&~P^G}O z!nxwrt!Prx2ly|8QJs!_FFuB95K{|(guFHYgSoirDIJjr9H}ZSGCBOplXspcRCQ`V zC#e+Zv)T-s>9t>Okp<$&z8p4o4X;pAE~i-!O}}OoHP%fMboLJe<8?4_W2Jirr4eec zifnB4W0L7CYz>w-7UrP9R!*#~h(hG>C|VMC{QF`Af_q!|@C-r-qFu z?3rtIz#Oek#q4cHuH!e`$v)8aI_ZMbuCij8BXa5Z7kTc|DayxWH1;fB*A=`y1*X3? zxbqk@6S_p7l^H8TK7PI8SQPVMAX82o$hByflN`DN!sp8czyURR@i4!i1d&o9Rh9Z7 zli|u93Gd04k&Mh%E-wm*c7H9`w&)y#l|t}4)pZG+qSww@YI z0hZM#4o%u+4nx`^L>}eZq4>S}EPE<)%k#_SO@mvveAOM7>^;oJk2mfPi8iSfF^~XV znwoqg9#|fFJTHfa&l#ho+9^1&Cc*1Ne5(ccYMS=v4q|uLN0;dg6_kq6iMEvPEu7ofNTY>92OY%FZQGhhA|~Icsn9b{ZPnpd3uM5 z3FnjFsIq$w2AjFKVKMLQ-OQ>s!_y;HVy@$hUg-w3tw_U_g@eOkVZ9=EsX&@hXbz&t zt;z2RHimsc&4RB4<|`CJLfaDp!d5m~@77Z4zCW(GI%2ohK7+b0%;x0m#Ps;KOi}A) zRPSWDS*&E1 zzgL_};o80D(^m_;RS%I}i0zIZ*O=#e(E(jYrzbO4PaXDy5@TPMvBEh&90a~xb;1$S zbyIOdmY_MHLKG4GEGw*o8u}}RB&QBz8dauiJ}So8OCYV5v+lVn(QI#GA%#evuAg2t zFj(4(cV0(UYV8i+;yqPmJ*_bGVP4gE|Lzrnu&)R?D)%(|Q^shXnd>W^AUYlU@S#5> zN%G!p|JX#ei2k++*6)pc;X5QFMQXWDbtq>RrKWE$61M{UX8*ZE4HA)WZn5mdJ=iKE zIbO#yEdB2O0Rshvhl7Lc$Ketr!y`2233(nm%oY}#7tYT95cpC$&n5i6I!RDT``bUZ z=7?(233$a<^Xbgl!TGqh1GD0+($=K68ppeSr7ALcHDi zU%h%YuUI)&u`hHPotKx0pl0_4-DS5~&G8)7P-9|c!mJZcZC;%n+D$TpXhyhUb~1xI$`>i~*~ z0@HXtU_EIX!p51{U9nduKNZx<0rFO8IsqUge#uFtZEZ3%iEmYbEeX!{khw*Z9mgGe zYGp~cO$(GG*o=%B4PsojdYAG7WUbeFt1D9hd9d^kWV8I-3LqTwd_gGc$Ns=DHqja_ zxB>)+hdW57&+oC&t1!zltt&}wAwI`s5j$<>R^1}yd1(KUxmPVR%P+`&Pc@skioc@t zzaBtDktup@@m6x>Iz7;aN7B1;D_`3(j-d%fBMSu)b#8!+9_1 zHSgMr68#e$Xkwze=eAV(S)1egwCFqEdJPNrDlsnE>?beC&08tVy}1w{$UuVJ-q|^^ zn$l9Lv_ACA&xZoj_;x;O$fXex;KH_z2(4asK89!!*a(U;p;+^|<~}mlLl$~^6W|wJ zD4kS_jJry8t(wT;)OU4bUxBE0h0T~ow$vI4n*PdY&Wl4!t9ix)`=cAXjkj)+nm?GG z?qB27J%m{gZm@t)_5rtcED1pX)HU29=Agsg#cK<yX{PF$Cdt6mRK|7FiU!ta#?%FfI{<6EBkd`^PjJ-RzaOW zqa^4RIQ1c7l}edvZ0j=`h!jh%?BN8tg`7_qi>Y*SKip!5E2)Mtb$z3*^@(2VX|mP z`}|KRzO8TS+@;GlM~#d630;$OOS(Bfpe2DV=<-R$&j=|D{EMO|VjpmYO2Z)z9sgUv zpl2G4{~YQaqE0Phlb0D!zm@HC_P#q-Wi>;z_+s8|uKk@r*f0+q=L}0u#=(v#yf3|i zQ#1Y(>K*dzA}r*_9w9Kc!zPKf{zf58~ z-ZF)$s;N~}1RZ?-3~A%^Kf&u0tSf{&4r*7c?mS8$x2gQ_a@*X_&eqoVn|HRN5YhSf zcWkO|TWoyaFgJ0+{FH))ox&pq@RBS+n+?u-mMHvWdsF_NA$Q>Pzz&iE`n)33P z5hfs3kdf(jyTx?VfV)-+dL^@*` z0B^h4mnJWL4SJ_6LaIN>gv((^|G4@80_uPQUobdI2P_1n-2M!uz&Un%GX#hUASdKz zoPZp0a&pq!Ux2gGf|jwtDP;=)wdeh|P~s033C+2dsI$}4V&kHcC*p&ySr@W$qQMLGq`6SF5vaS6&8)VZ0sR09rJ&{QkcY9OUHWcB_LAzE^AeaffJ|fELA;Dml*rE<+%jAf5Ne zigcRpIO_Nd>ehP`+zk^35e3xBu)_}lufRzcS$m5&=wv!fFWMeTtRb5n*&$*&UVhja z_p;XgmIBi!w`;gGtMEZfDKR0vVBMhwGAVSQ-%{D#*-JL(j}pyoEYNj+7#N4LpWUG8noS%W?L^{0#yUg`Rrup;MgTZGDyaqg zii>~!b+%uH5^lb~wlF)ZWAGllanis*rrSScYpb_XbQ}^koEz{Iz&oXCctB`ntfeI# z^e?5%cu~Giv`I^*Ue$bzzkfEkj-cg6^}{YfGHx)vVJzQxkt7nlr9@En4<(SYu zZ^C&$>f{BGJ_{==BUu_%`{Rz1T3_fm=jEFWdXm9)KnM@~FDR;*hXy)2ka6y$hW!~~ zC(*&)_2ocFJk4oD6A~u>MMz+SQHM0ODtDP0s@AG+^!u&8$3DTfWj*g)SMELf`a&^7(TmP8MxS`3am|$sPf+kt-u=%^e%fb>5 zvP?Cefwl~Yl-|(O1`%aCJddl&MW*yEz%qePOQBgXGk-s*Z}tD>DRYOrF&$hmo^ERb znM1^CTkBjrKd`$j%BzcPnCsp0X%Q~ukYTu29^WbV7FnZ zt6m|(xV8p$^=~J|20!ULGAzHzGK~dd(?3=ZI;ft1x(Xr znBekR>dqjq!9Y!xM<_cV?UWek{sz&s&~)qwU>995f5Cg?S6NxPb+A@6Q3)hd?%y~# z6a^Iql)4kp-n9uo$XgwEdF=^J6BE?Ki#_VmBhYF4aN#1TO#a+r-v6;Kd9s>`96Cm;n&!;s&aYY}|)ifgx5HbKCL z!(nF;K!+1xIS`6DHGjrzCKgnW_;K(3U~Y%nPc$YZ) z;Q1GHcty~c_$oHG-0}56C|PWtNzbaJkpm+a6Yy}O;4C)KeWL+N-d#zq2b+TP!G?Ao zAfGlSoM0yMD0P2^c&!qD_sX4@KQF5MY<-s}nmlz2cr4JHjGCKaB-cVK2Btd_V1*)FjaK~?R$=KF zIhXwlhgudYBz@QmLMZTaMSU;F$Hym&g*~ha1e2|EQQr$+kF-E~ZgrK8HmQV^ zkkA20)-Tub3ylUCkZEb0646}t8+uzVKzBJ9O&l`lY z9JQ)mySk(ySR9;(gM4SOwLbWlU5N~Hqs^|v?s8MG?N!2P$Mxq*GYboBX5;0s0J0kO zufnz!^F;FnID-WS1W>TBI~|z&s#tMt`9F9G)d=7gXE{pI05)`8Fm~Q`M5|@0K0i)| z4VT4ql>Nz*C&%ir#d@I_`#gr+Hewsu8A5e zvxBQvrGE8CsR!qg0-@3J^Dyuxze3)W_^{dX7v1zVUmKB^w`@cKKi zx#5B*hsO%nzI4S7EbVOhN#u;(44g~;u?qb`&esGgksD`8EptW20+VlZ@MOGbXD-`- z?wo7BGw1<%lcUfLS$|>p;B>k4WE^`Q9v;|k!@wM>x=psf~q<8DFak46(o1T5DyGGpO zPUcdq-}UhL?cay{BW6`#=R{3KB}7dJ3NX9FD(AALh=}2fdYtpH`hycqX_3Uw*`rKI zVF)BhJ1c{1{eP0%0ni3u*K+f}0c}L4m?WF~>(46JbFTZ^${rOt}jLsHI;o;Ok5zZqp!w(vpZ(lG#6{PB=T8rQ@adXDWP%T!e!rg<>GD zSrh|u%R^Wg&3|CvQ2KTy@GDeR6&O3OAZ;XDrgl`R#--XlWtR2Cce9@o19-RMq`xQj=qqGg13ujILrG>i_N_)%D-m8buF;z zpmXx$e!jkXl4TOqMMDYp$wo_-uyB*TS#xW{h$EE!03TsvW5aE~yt5PLx;o~Ht_+8B z-S;J2!M8qK+8XT-bpM`8398xMxm!y{cGURAD-N~aH@jA5yAQ1gqH@eet!3XqBG?d$ zzUEsso|x3P0`e(-G8qNJ4$b*DVrRly>N3~ykcm@LzwAV#cuKSMu!H(b%~%_v<8(|R zL;ZLvC8njPN&!)F&td6{oVV@yW zB10OHORTf5aUJS~_7^gi0(l|^*T?(G#7?T#IPIwab-h;!aq3E^xs4VpxvuHxU{Byk z^!o>d2h2FQRr@z2(;2;M4S#mfHH9uN;^27qwradeEG&}S`~2;{a@fT>V@0pXo;g*Q z?%g%oU^SA-&&c^2l`C-O7%ptbn}niBw|hRv%IUK81`2ez5#b{P`No=MdD*P$MV>07u-Bi zUpVc!=gDE`nuOBP9nTXP#hoh@77>YtGG2fFi#HrQLv3YVE|9q3hAP!5ojIBf=ptRug2Gccbn@(3FW&29@&4YT5 z1p_s$V#|?}ofR{Kr6rgMYrSz%b;e4?@0XxLXxutbO~i0{F$d*n(t90Q!TktaG-gwK z%qlot{%hR&ilMi((iIg%;rPY>_80AaA0mzEl(0<~W*@bd={Z3rkKuj}i&dN?$Xai` zN$HtW;{jLm}Y-=AYD-xSRwem8OJZ@V4%6h_(V&kfaf(zJyCEVF!5mK)XgQR4Xa5{IcNCj9>_ zGJH>$yUw34#`?LX2mJiMA@%YPv(5tuH$oY!;C^ab3+g$_N?H3HNarjD@b}@>TUXxquv1h zw#n=*TxK1@Q*|Gr3~NISW(qQ@L&a3-=+dv$kJ10m{_~S>*IOeDFs*!@LxsWouq%q6 zN8b88S21~T?QiDMV#gOLMPuA?igY^IA231hz@fH%pG@p&jRS&>d4L6}G6&R7$#VKblI z`PaXR_`prb6wb%7OJ+bs@TJL+H6{6x713pX$t_J`aq--6lrTZ2>rbKcU&3Db*Z!;G z@hpB)6Y4J#pe$&0&S!bzd<4j1D&fSd43?=b%mllXeWusPPn@XtGOE*4p~ zxFMeF6mTo!crkycQ0)wBbBN;l(GwVGa*_QW_A>j;fY*cT+*s@KcwQ8icW3>_}vpie;Z4GqW9@ZFZopZ_0KQf+>UwYRXonuT5TUCb9Rm1Xe|q1ILGR~b`TJgEvk8i8cCV2EGukIyKOj0SG;^Z#wxWHirS-qF-E`Y_~6>x z!kM8<3mG0BLklDKerv^kKJiJTd3qm>p*#(W!E zYTD(1%M3*dg)^^>@^~F|PlfXLsd@1TAb277j*(-oZ@YuYrf2Tt zmiu?)d}5WNY&G-1y})?^!Q3 z#htLdO>`mk5@WH>m++CrE^)Zi~~-QYe&k z1R?J79vk+L9_Buo@00#GM@y%gyORfra(rSsM`&Z->Ed5#qU%luP9~>T{OSaT_ zY?fEUo-GWIkBC%k#)1FU3ahESBin4CdX}h&5O^fSuxh_6pb17I`;)AfWEd;=1VXBD zPESRG=m@gk4{d>?h5~qc7^U2djwVGpqH5^`)0IoMN+!2y`!jsJd?s8sI)5(2P%9L! zLNUvyzgk-QE3j^+RoqBE;~=NwQWa_5D#eZ%1|bjN(lN)qbgZF5?SVuySN|`4E3Ao$ zi95)ik(M5ER)+C2ng9#yl|hRmWZpun#(hbJ4Ao~ACuKm-D!5*~{k^O3+VSx}*}dYL zD}-W?WG$O{^OQ43vNz+fFbTx#!38#yM#=Kfv+pv;aDCgzte~2Dj-mLgH@zEzWN8X1 zdr-{t41arb6D<1HW|1yIbAXG!5^Uhw98BODSJxJ-8qU__E@<6Ii3Y=z0L@#x>_)?q zkHPfOd~u@zwXeIF)H0;8vjdGBu?ah4UB=+4-t#Hc2tWGi>FHU>NXFr04Ay@iKjPlh zBXr3XC`ij(&y>7LM#H-otdR9J_4+2k_s!+MUkb~#aVtKIQ{+-i5jKW&q45yX1$sz9 znM(jQWHVjo!fk*;*9To5rOu7Dx3b-Bq}?8Uz1=e3Z=6JrnXvN5$yl9NT-VbaE7zFh z*(R++1v2cY_C5B~{UN=MsG=+}$toVQ6uWu^*}oF$80X7~k>*sGyYx4B+&M;O5svGr zYI*gm_S?aKEq4`&u7&rJIW9kE5&Wt8REU&Oqar*>apTK%A429%qMc=WTz=f1#T@0cjkA7>WroLpH@NtNl`=M|Ubq;7Pyu&`}X zjTKvx*_%7sHB3oPe)qfvZ0?f?DKGv7xm&1}4c^Fu^@TKgU^M1@iDLf@!=k39mZ z)V>V>@CoM?pZxqCIirDvg)6o0Jgcj#%ySJII`&=NbCB*t`)snBjz6MxzvVo8;1Ote z$-iWyr91z{Ba_j5N~`Akz&k8z)VTiM(6mCG(9*Y!W(boj+4CeI zU#gay41Zf!<5(MU-Dn-MYVv3TD7eC5ExcO)-e8tro>w5hSvFaUbnTIb)7Dg4!3qGN z)~*8#=>rH!35oWT7tr-xX05UUxxceBSm>NG{#GCCBfte%uRWSpg;pU~mr~G=@^Mlm^yC`byxVtyun0M5zdm~UlFTXg4c{;Pz)I&`L{ZGWqs0}*DjZyr0^>Rw zy+GNffU~_BI;F~oza~)N4GfCgfZ6cLX-7|P)fZ}6SC4PrtHY^ozX>)suL}A`DQ3S< zElpLA;(!KE!5ZJrL+cN2J$=T5swJl`(M$&5bW+uJ^0K-LiXVGiBcbM%7oSc!4dXHn zX*CI0YXd}wS0O`nrkbA!MwSw6r9{6n74}UHmJFc&P~m)3m^*#JVWv~7WTN9b*$vg` zB)YbQOY&kyV3*8Ue?w10TwXBaJY@gXg)5UcVOSt>F#C+m%F`~O3Tl(C^KbIO zjmkS#v&PX3%=l;NXvv%xKL(4Q?d)#r@n>?~Ib1nXCY zO!bKUf%qzg%yyY~>&PBf(;?{4$~UH50M%x;$T8l-W3sz<@BEQvq;zmRNU{G{`_7Qp z?&|p3)?7Mx&J|njNBiy<5V33-{L#>GD8KY3#Hp6#(uSUd%{*eWD>5bFlt4M}MIK(C zUGfYzdgSX`1lBhyMaV`O*rs{0%3KcD_Td18e#I_QB?8XLWw{kZ z_ACpWRbDUnuIa}8`|65-)m4{Q2%OrT4}ZnItZ=lwMW=BFGy2blNJV&!S|5tR+q+-J ziOhK}f0EF1j64H3goXBzB4}wwefYLO`A>u|M8G)6F4@(^j#>L0s9el7r{ZX1uW>&5gOt-?MjJG&WrYMz20yVG7D+n-@pBnu~xZ9F>Q=j}s+Z`~q`8@+Sf zMM}z~KS+Ly)vSAPpo5KuNrZY!{rw)bFah9AT!uRl@GZc^33dj}5=&h{-}g1rxp&U* zqowS7{+GVJBb4JLycSRbrNrv<-boRP$xfV{A11`#BIepT9GFl>^sfpImgxCi!se*R zbQ)qBkB;Vb+D^(iG3k#4-^XZ>o5R-~+|-9R=)+ldx3@jKy~lGL_k&_wge65?%|;_2 z;yt#Snug6`TA{{lFN-&dmyBt;BvfagTEkTxtU8n!RgC(7GAIf77|N-ssb+muQz_ON znoe?EkgoOQ|2VYrHVcvXAi$%sCd1w}ZQtS5>xRaybViWAsLZ|xkLC(p=%*_Wlcf1i%7Jh7@O-ydXgb6-lL zUIeWlUf$evoz!u&AQ|!M%!~;b)!6U+#D`|K>bW|<`qBqPFc0=CtB!vt7#q}dX*bN} zXuXZ)Dl{B_LwfNdtQ~@uHn#*N{c37z9=KT zTWzw_Rnot5{Q4bNE4WJAr>ms#ti$3d*x-(%CI;aQkdjD&94twJ{$>zE4ugF_>t%}L zCyTp}0%gZI3Mk6`gGEEKiY@2D=_0v_=t?|J;)5ax&K7GqqS}XsQsHbnGhtt5*FpNu zs?;k&6r69PNj5*9Z?RH1>3L;IVih~X6?1}kv#FnMd>Kg4d^<4?*8B>g+FIHZE^GrM zmnd)+yAXMFP6tbRM64#kg*&hlt&b%f?yLTPuTT7rK;ppf{Kv1x1V{1ib5(?(h@8KwB8V_+9>bv6a zap<@hnXV6@wwP|I5fBg{7~VTL%s)-kh3X}k5PoiP6ls~l@>7=l0rla|&^CIpFeUODe`|UcR5FfHB9NZ>owijzz0X|V zS99S_MP0_|*fmCdDu63beztU5cO)d{k3e4(RmUtyL?FCF5PfOIrC>y$yxZ8NZ5Z~* zhp5@F6rkK-t7_Dd3-5l%%Vx+sIGG+3Y)qdFccZ|9XP?h?bz_MDpX ze(Y!W6vrs#f?g76@2PFc)Ks$>m@>QBT#&xCI5V?7zZg1@F>+8hi|i%6!0l+=hWH95 zZ%WJle?9&4DF2nmouVfM4PkkO z8uLR|)yq9r3omD%9+V@-rk9rDerX2p><8{;`-SRRiY(6=X=3@3N{WhisJ=BvnmU|T zIXpKRt3cM&wKPZdpH{L8N<_6I9+{}H(yNrt`c`0ds1^UPclI?~m`+NkCmaYZB6E81 zrc04oaW3G+{K~(njf*l=QntLqp}5TZmb#}i|6Msx;jd?;IFF$x4IJaO zp-Gk1?3yl-ET38DKC*{)+X1Z4=>)B;>{dqODpcRQTJ6wkPMPV&Jm{{i?SCRaGMffA zJ68#NL)pPgB;o6>N|B*b+M5r=2$wOA?n_d)EFY5Vvs=xNnmt3^>n-YVUK?(dguM~c z1(k;`hNLX{SlG`!eM{Bvg1zfO@d~B0vvcp4#-HU|_;q;I%u6<|MbO0o9A~VLRJT1` zG4mQVK7TCx7?>Bx>@3^Uy+`(ZeQrt}VfmU3Kh$T$PLKN0g6Z?%k(m15b=0p_f<18) zxnoB9SIrvqJ3|?8!GX#MmzkZDvk#%P*67g#NA<(hzOc#bcdQ0u(Due5X*(1Rs?*;-O>NpX2Bwi4@%zkiN*87tkB#$B1X_ip-N^DfZCEhZCRv6p>Z z_vw`eiw#qRcivBy4I$K;8QmVRns*~Ph&i-_?p3QYl1+ts?nHHXDP z;X3}}k`m?&S=s4}W|AGm*JlrG&y-6=x+Dsk`L}YKoqAr47kGL}`jgoxNnA#RGnZS^ zw^r6OP(L4PXlQ8|dB*XGe5H%}<6Lv2hyp&oV^}LP(`?_D@}kJk7QJ@0pDN%r8T(5+ zr5znX`U;%hN!ru8Qes_a{FLZMePZG)Z)oP5vuB}(i1dCV`L26QMn2M}O{AfC$ExY0 ziBcYEyJYrRn$4tj)pd1sYUS2Tzr!YrKhOTPrikN)S+G!5R5U<->t^&*BVRhZ^-lHS zz2jTN&FaMhyJ_nL7s)7oFLVaKZOG(?eNMjgO=_|@;re)<#_;l7%P^+HXwHc3gZ&NZ zk?V44I6;v?x%It%-8Wio~f+eKP&Xsgu)ik&!Iy)x+2k zTN<^k@!DE;>q8^C_B~KTxHebSmJ6wFES64v+pHb59o0BBg%JeiH z{#r}WjVJeZ;uJF1Ii0w;=~t30&CELHu~+O{G!x?I2pvP5TS9JhF4;VY3*9H>c~qSl z8Y<{_)1)Kv*5>}MxP-8Jk*=Q9ms~ko%tHsq`o|RNSG@*Z4-{Q!`g1L6XM=jlA4^R1 z{{ks0OxQwjy1TRC+T%u4-hIL}Zhuj=PcO zZ77z=AXaoiJ{V~UW>jk)YFe5d+U}#p(nY4dsp)8F(kZp1S9J~#2*<;{E1M~1fR-62 zzs1LE(=W{z(npZ8+dh2sXuTU(#Z2n4Udq`RXPbI<#=AZd$c*RWk5}&VZG4e}Y&>Q` z`ti|GW9T?HmM_KQl-c(>1Izn`2C9#HakA@|qV;PL%wL!?N0hgFES$0`B^GlxeaBO) zYikoAzJaBEBwt&>*y%#<*Z6zPmtv~2p$QEf18+LN7dkH77dh4-L{(SgM?1I#Rd_q= zgTJa9r2nj~TZeavoSd9;iI;&jlr!qLUFw~3voMR|aV!L%0?VrwGs*NROqH%=Tu#g^ zEPYK)ON*N`2B`)CERcER;N*g!S1s;I2~@W!*+oJxE0Ng4cT$oo_yv4 z7eLeQg}XK!&bx+%IP`u*RI9e{7ez5JuC}3T1Q;}O)T&K~;=@)CsvA(DBbyd%SLieZ zOit_T>&%8K7#%+boVmO_+LH>ceHc#>;a`<=tjuO-XT$w}w07o$jgxp%DO%bJ%HfH29+hUH~wxx^P3PXromRuHd z{l4`#d_O;a9-qhK^LTtd@6Y@5dOcsyOYHPL{-qaw40;N8h10&FNjl*@vsjIW88@x( zZ~Zdw$@7p-?Y@#W4HjkeLQ^OXnS-W4Ca-XgD=|qr2)!4!ZAHQ?7h@3M1>J2{tGaEi`0Ojs8lK}393Fd9F&l-Dnm{lP}b<3T;2cnTK3E@hpgGTNL~uvm%r$FCJ5W9#e-h~$G52u*AZ^JkOe1AT#s^vYS3 zXmF5e%Z^qH`H1Uh6J~HWs}CREKNM*xXLp?!IaVj2{tkL&>-gcSss>X2vB1b!;nmo_dN6k~C&J6#q@dX9_d_4wz-quS zpV-c2oV<4RzW>&FgrU*7T@m7*eB|qWbJzA4?D=*z%-tq__0quW{NMyDHlIO{6SV`I z0tRpfQUn#4E!*T9rpzKHWIJ#x2#>m*URgP+2tN?`fc#6yO{4y=2cwT`<-9V;>3+iKlSJ1+}I73q2m}? zFhEZo!QKj!c&mQ>P=soqyf%PhYuAvC=Sp2ozwivsC?$2NRo@HvETBMutugF9>?c}M zi$%LJmw9G`zx`%#83?mA{D~v#2U6uQC(~P`5Jl<+c0$nQWOnk8Z(`^%6TD!h88|;qWvGjMT>9E(U%3P9^rFj%7}{Z!5j~rH$-6{gLqZ3@cmK zllrF9haP#D;NFSooPUwm1R-*-_T!fBTRNP&h7Jq z^EC2$w1vLz!ZOZAMjo48nPl-Q30>cY#Wl&-!^@x#1&ea)fwj6J# zGFA#|Eu`Dq*e$Kd_E=oDBnTdNOoa1JeL|`!IIEI`qDBOw zbAjVaFnDnzi&%wBwMQUaH(@g+U8wAUG|cKj2FRlWaSC(IhVzW)U`cQOq-qEW)0v;g z8}~iY?4cRX+Ihx4<2@q9XK|?K7C&Mqu2Ec_C0C)(ZcIA4G+$~c-84=vHfhtpnQUcb zvM(A~?(H0kNpp7kK0k{Ys9mqf4ms8@mKRd$G}Q};POZ~0|E;9d^lU7vNoh-BAtsYf zzRhP3TwD!lYCVU1O(ti9VKhv|FVrT-2ur+jU5I=QQq&UVg~iW{Tbo)GsYZFZxiM1j z9v$UTp1Q=xbn7-{mHJrz!w=u#bzaS*JjjoYs{1AwgWH*FA??t%pPz0(O;b|~fq?I? z@&F(g2rsb24`**kGRLBa*8WswsN5p;IT zEmS?41l8R|#ub8xXZ{!>YFyl7+4};{2v(WmYkWBTua5q^U#%>xXg-iFRP5y#4pS<< zBb!S?&lCpw;3OsfB^=+yv~-e9l&;94>+PO_?&p`aOP*MbyGf}lrfn2$KWn_HCsaLf z^snZB<6>ja2!>{6c%iLj@{%*}<@$F91Pq&n_jz&glr7a^f~4i4^g^Y1v&^DT;V5q0 z>Fj0TyI%^n^q3!w&8J$OgADiIXkL!s=9-m4;_NP6c~b-tb*+4TCgx(M?l?%%NM-ua zcU)6o%7PD_z&8DV?yiL(MhOc{+#OE7) zvKy<=0XV3ZFeyFf@ZeDh!WGfIa^Q}Z4b;XflyYkR~JMr`FTvZKZhT}Fl z7EDi1I#iJj+TZUBQOLCGYS*ky=^g{P(OsM5mIldxW^eqn_G=iv%+Hk(>ex~}GuUpJ z`1eu{tXS^Eju^`&Tc>FTi5JBMQA}Jmhf`~Q+Rh$=^Og!u<}j1~n1kCJ{k01b4u0*|mnghL3OG9ZNleSl=rrx3PiF+K~v( dZP_gB6y)qX9H@}V)%MNH9PQzDWwsY@{tpT)WNZKc literal 0 HcmV?d00001 diff --git a/documentation/audits/day-2026-10-19/P2/browser/03-after-sign-out-asks-again.png b/documentation/audits/day-2026-10-19/P2/browser/03-after-sign-out-asks-again.png new file mode 100644 index 0000000000000000000000000000000000000000..a61e0324321ee655fa0a83980dc96e01be2c700a GIT binary patch literal 36579 zcmeFYbySq$*EWhGp|mt8NQ-orfHVUF(m9Nvbl1=z(k-oYBSUwCN=tWlGjzic-!s1F z{myyU_upCTtn<&0f0#ww_x;jN%yz3JMNLURn(W1fQo|7g2Xs_wmdEe78lFUKo9hi;NSU@^aBrX|JA<-67Iy zm58bK^u?S5Xs^E0;jm@daJ$9-9nLvBcxj=ofUr`Km|o|decRzy_TJ#&;6a*U`uB%{ zK^=qM2IOuiD8H~P|9wZ{d@6zZ?-M7^e?Fl6#|VHg{Kp9YF~Wah!hcZk9~At*K|!Pp z3QBeatA1=%u#PqK5lWN#@L>t_LT;hNBa{%vCpakhF0oY@O(~YBV$mpH7J4mRDJo1g zNA!@teJlJ3MYY@5=^Ho7G-||y_NNMNw`VBXxc|w_|6e90j4q`s7)xaR+8s(D(wT zoRWMpef0+hPy$1n@zbzGFtDaF0WS(ldBzwoNYh4QB7Y~0zPKbW%MXj~p~b)F9WD+O z6UP@5&&z&SVnF@{y^wiKOW1RI2LN^i$epIecN&SXYuB-omE;}!r0|;(pUJOK%O1Qc zl8_sXRpUmq2o|HkBrLuoJ>L~iynOc;dki0*}Eis%ijW)jF0tL zAAv@n0MD!ixGl;ao-_CY!vJPUDw*g}FDc!(>|Zaa4b@UGDDK;Et~ZF9CJXLfv$KQ> z@VU=ZLA<4^jxB930$|V#19@4`+IPeGmSW+n>O{VMqr@mEuXgc~#<3gYCBSa{3ZttI z>xh!&(kc0Sl!c0MrbsRJ`Pa{whW4N{MHNNvKWHffma0VI3}>UfY-Admnx`0#ZKIbK z_6iGaZVw8Gu}I1Wmed-(Hu676fx+_6lWi|C_9`tqa0W=i-=Ltpi>EP1LHS5cqLJ`L zT$yz8fEInNe1O~g?>4!5cPezWKewYke%-BUVfOrKSd2(OomwsN%eN-+$5pMZ4b9n` zRUD)P`qdsQt1gtMio$KSg0@Hcd<&my+{k8u#Wnsd4k5-Ad@P}D{z^*Qnaj5STf3>U z;M%&b6#5o@M|TJ~?i>E6<{+GX-x|S&^7_@_3@x9tndYHZJsnNWCD7`tJ_$bAF;*?b zs%*|`;8mK_G{icgp}b1|j7y;pZq)q<$%n@d*`2MVfpI?D3-2>gi>$2^;tIK)Jo-W2 zYg~7XK&9kQxJ5Kvir;%J=CkFcO~yD+7~9n9c|9IsVqhs__5Fc@B2D-e9VJBg2@XP7 zv+C;B0gS6S-g(^p!fPh5dni?mk+F;UBL0>wFZ%8ECX3x*39OVfZ6P6>cdpphBDy%x zuhk!Lv+QriE{xAm-tmSi{XOHIc)FMJ71nvEvc2mNT9FfcyN{=B;5tG6NfysG#ms0( zULiunV^E^XG@{JPT(7G3mE+Gqdgprd)#s{Q=3lbQOw1GIf& zl|kDQ!zd`KA;>f0O0iF{owBlPzUUv1e^ODWTapM`3#R7s9PLtK zNWr2tvl$M|Mz;7lV35w_l~pCFA3H%Ge!q3ql99wpgsL)FhC zX1N6nY0mR!Um)OW>$H5!xtDQ7O6o+NDwFs)0IXg;191OtoW^{5%RG4xi{3ezJJs=) zX6P-n?hFtSXQL558Xkxg(f`22;|3B)hiu>f&=7Ep|D zVRtn7O~1GuNO6Iwjj8^+(P>cF1uC5d6Mp>L+teH#2#YkpKcd`ZXYLN4_gs@cU;A{} zxRL$nj;BKm9@BQ`v0865M+}mkTps1US9*-{%jc{3E(*$-P$PSxgm!l!dFfRrsQV?K z=3d`(!nJ$nDHCWnlst@`)h|;D2-$a!k-648YUyx1@VTm6e=75ofluZ1Gw0d!m68LV~QlfamYi{RjR%Pz_W+9S1Xxo^IovDjC120eX}mW3mF z_VkIrR@>6bW%t!>g%~7t%Ir4c7yS7 z^lZCGd=PRz>3gUc61{VF7IBsv7nOFLK`MTK%~sceAv9Cyj#}l2@fmlpk9=5Ml#hYt zOhNfIdtq^LVOeqUg29Jc2dB`ACZA6Z>Tx2@%KAMt#rN;BVGTBurlHrgk5Hy5|5=LV zE9_YF_CoRPuJP^k3J}Y)58XE+8w8e4*C$7JOB+vNFmJ?K*m3af3FP5wewYor*uk6>3?@`s5eV)9Ts6jtp*=+ z@oXIYVU1pmowio-^i+93K2(YOCkNpxabrZ5urIIwU3X(~_|DGn?So9{`08&e)eiu~MFmq(qzpB0F9uwFuTl}e4bdeu{^WY{lz{Hg zZDXLJto3{%n*lx>8I3t>;}Z6VHO5n2LCaA0p8J27!I%^`j9^kRUrFFzxtfIx8FRHCtJ_@Ydh% z`}5iu?hvp#cfJPuyh`*+fPG$S1w62Jac3C%#%g&oslR-9B%_KZ3>6Ik(eOX zuu&5<*v=zM`cx(^;IMXhe|`HPR%&OTB0~1d+-7XE#0=tbcvgr31$U=fiJkWhXln8u z`c%FmbABDGVq`22oRSB5*8TzuwGS@ns8AaH+yg|PhhkmRn$9Coy+N1ui8uz%264?f z&Vcb{`CJJq!mOHui`{ki+O;3jYh-u_)%znz#zeaZSlbZgteq+Gbdn|=zd zVW4__4e~VJ4X6X$egp&Z!N8!%LQMAp3ozLnvYh@%0TvM6AAC1VoE(xB*Pb<1o^^-& zga6_x2aihJRNl+ry?#7?R>KUX#zei2wwnMxHa~v@R`}n*86XJ^37SlP!ZVoCa_n1B z5xcv^z==FqNaNlEu_vu9JlvVA7WYL$zGYuAYz96-`B;andVjr;{kweHZIPTacHr(+ z3_sG1^Kl=kh+~T2ytxpuW@GH4fwoCB%(yOk{RV;-!D2}seV3_tS?z=~!gdvj}Ie3n0GO|JRk_AtYHm48e{}q&b^Eq*kYA2zr@6v@N)9)VNv|tc&y&Ti)&k9_ zyBRp{5w1HHp~ja#f5Pq%;*h2C!u3M4C6-0KnK*SKnRHI*cHct-;eH1{5sAI za(vgE;BCLyJz-V%KFw(&I}aXEXw462W}?crbRg$!*|=_T9;6qx2d$Rspp`A?)IH+HZD+-oGq; z5THsK3Fv(VU<&j*bF?yc0~+X1Q7XRZK9fiKg04S5II(+PxoXa;*~1=2#-IBzFqP)C zG9wq{8acgshIM#vw5U)sRK~8VVPN!xR=gi_-k&2dXRT!vv?7Hlpl3+Z)c6~*2l%kS zG9D`miip&d%!f!qwROm-h>z#*19@_6L&&>BQJISO>71(@5Azd=++G(OfBbQqR#T`G zQ&PCM*;M75GV(1fPnu6Qlj2P8ERQR3{$R(_zZ5c~J(YNjQl7$@4Y0U00&HPkHb<_$ zD&-&E*9@j&TqBHJG#4x45Op;z1`kkT9@dbUf~p>BOw;{Yzxq(Cw)&X4G1FWRku3Ip zh6txq*Em;B5FRUg(QJL;=ijR}ecCpbwg)3$!e7SfrMn8QWj76YL>O;p-ghy5vZMm4 zQaz;NFl?2~j`nphB;Kf_-0yPH$Krj2)E;_Q(vcjs!?$TPAj%a$?5DJsIQU!_<$~Lx z$L?}Vw<%6HCUT`-#}|mD1?R0b{jk3SjfScYorgXThlf6T$G3!a`mABoXgn~ZMs1{`ua`2BQmtquyY*+?Fc%kWT_F-hapglg?7wFx11sl;VtAp6%9KX+Pi zBH_Ed;8+;To4#7>*!gn>n~FTQ1OxTgJKo-g{oX`H$|&!MR!5$qpm@lQl_ZzfQj@*v zI}s|NS}cl}sD9gL-#c+hN|H>@OSaNkqn&zlDGnxFw6S)~@L5@KYSXnoco$T@*B_ta z<1~p|6iM|%z-+SPq4grL!L_`mdiTQf;T%YahF-g_j&((H@#Bblp|+DWwpPvaSj-9Q z!o40MI_}5^Tyxk5K6vAyb@)<+2EngKC?6kFr2*2E>v$$z_L7)Y*R*bM1Yyfo`5b*! zP06F{i8@8b!Dg=m0Y#|X-%PBSxCCKKX+xDa8PL@%+&Ha#>!G#dmWvDRoP2|3%Ynqw z-R9QHn{DmzhwA<|m?}ZqCP5`_@#L@VnS;24BjvZ6Rh^hXuCXE;0T={_d2+F3Vn{k- zg@-9WpFU)f$I&n3Ie1%lhdGaUVt>rZs){VVyG(gafo?E~~LaZH@mIuE9imn&9`UP@Bjc4fz;$oDl)5|#b z_eG=K+KBnCHmJu@XIT2T-4u5tPS1c-xGxJ1F_Mz8BGbHw#8`YtTl&n8!ft9FrSCLd z8-iPB?Hpo<+f3>1mx0=1SluWUT!T)^;(K46qC8H1xI(XKz;>oJW<(ZN0f2vdhf6Y=X;SM_8xP%(4P_b)`wLLZtc#-v^n z#wls0r)(v*>E>b;3OtO*(7S9C)v?fQwutxH#xW(JpuF-x=ICK87{zto%@vmv_h?)I z`OT%`!`MO+17k;i0fRT9J?v|CrA=TGQ%84h9=#8u{p8Q;GjPbfpYDU_jdHjQ`L{Ue z9(mp5gn$gM$yv)M<5V!%oOCJ(TfYISh-a0kInK}T-chPb)R5vjzSv}Cd2rPVmGP&A zTJ{7b^8E4MQ!2%~XY~A6Fp~dcR`K~ym6q-so`SI{N5vbG#@^j~)t1&R*_b=}Uhj{p zM`awJyDD1k>XC+;n>+g=)=t)s0(N+;bP^>gk>+~cV=i}?Og~ubNnmog=&+cYVVa@K7Fl{ndhqYw%#MN z=Q5)gkh5UY^zC(p#&W&)_c;(Xy}Q+-jD1e?>FR=={;aQ?55L0n<8LEJKUx zx;4Rx{M*--@hz1#)i>8k;-cprKX?ivBL$roIS%z3?g*)yve)QnC}Hyg-m3S?6%PFY zGQ7fOu2*=12F&_QMURk+2O$?vBgKSOHlKob{O))nlBT0(COH}&b5^-nOh1sndKn6=k)~}h}^laI`)-G;tMIOL)bNlBQUyY;f zh4%SVp7wD$&pIxCQ8w*(Yrfj!+jiu)qYk?II{Qgn^VYqh=}o;{ezId1I!2UsA|Vph zNF5C2ES^%cFvW z@b)tjV|6sa9R2D#TTR!eqf@o!$;}0f)rls2pF-G~V_W0efOBU5o6Qh4b1tg6u;M3g z***zNZk}fy@uVs%`&nvgiGmhwas~1WK{gsG9o=<+W2Vz0ZMWsDJL_}X{P_tEW#`~-`M0mbf$6c&%UoZ- z-~TWz_c@;lXRz;Jcl*c)wS#?ZRlPcA5S;AvA*a<<)_8YNaA1`PSmR$yWt*9f^xJw5 z#(7f7w2qb`T|YkcR^w?tR+8^Se;K=wA!*5PNn^?Rg*t=k?G)d;lRs;-&k#}d_21_Q zO}}DWk?)nCUKT6H@_!6~{w+Im;JG|ndrlxgo9cjkNNgmTXvvhn4~aSj%G@bC*5@K7 z2x3Z^w$$o5TR{OfzTy%nAZ$M z4ccPt=nP4-ddsgWvQB@#-gllVVO)0Fgp|F=|10yTewCc{kx&4=MJ%cCDiJmn7dKxV zn=O`<*m&IpM$gKEG&Co~ulGE0a0Z5&uVQqinEG>~U+|Zwv^St~1J#SP9i=AgY)I&? zg|-z>6luk=v0WUT#pE(w=fx91n?wa_5FmfV=CY{0Tkxs;Qr4;;+m>hDlW9GoNZ`af zKF%~3MP+c(gc_kbLOcfV#b;^`5*gQd`CmB>2x z0bI2Z`z_CeuTRUmxOCsCk0qa;0mvY2DbKWuOqRbyP$`dQHW*6{DWrPl@OvmMfyg5u zu?CPgXx{(#TglPUkinHEYP~-Y5FgZM@LL^@BXxXC z2o1?=g>00KRDVq0@hYW=*+g)ruquYp0{qZf-E8^G`=W{G*gw;#CWyn+lS`tjtwL8^sZ|6cBZ@l#l`%0%iu)|OAzdJNNIBce9kV>)EyuJ!UFyi-h( zG`q2MuuuF_w6&f@# zT6|M1IeWmdBNg3}EW&x3?GzpM^LErKV@UY30n`*W9W5_8t|1V%I7SqXDTj^mo}{A1 zFwR&-O<_{+bPJ&V!<7GcC${dS4N09i8OLnNim%WQ(b-CMO z|7R0z^O*_G{S)vs?cXXMb*h^&zJhc&`2w>$PP>h@q2?z0-r2}&2HYk#9y%dF{9)lS z0dzNiM`p^{&pI3Fu3KQl~F?c1Ytqe_`f@^=C5hNmn!wL&8-MnQhm(Q1-eNuYopAP0E;JA8d=m5HT|!xO7+D zT-(|kf;~I>sHG;1J)rt7$lSHL=5w^t>rAW#(<)Pw+|RiTkz}HuZ;A`~9A-{o)piR0 z#6F;&uxSC%xn>kcM&-s3;lG(jX=EP>*$iz8&HroY>(%XmL(?dD86i}+Xnzo5gxYA= z0Y5J@tTVaKuA%nkw_6C3q;vjRh@(RIYJWlZY2;hFuALrvm9S8Uj!xlVY;w-y<)@_) z#RGctFun7+(O+U|909!yR%uQTCWZ5_KT`dVN2OMZd+aBuS>-BR{qbE}#OaXmYD65~ zOW}HmimBm|hd1Sk;7Z3v_5Fus)2I_n7+RqZJq@Z2>2umra!etYdBB3e;C8aBS( z9-?9`MLh*$OTE?Q6@NAE(GpOvmG@wR<~^Uw&8&yg>%^8czwf{2taZ;5oEH1~@6Cn( z$4Tnm{UX3@3>cr8LNv-NDSd|yZ|7{iaPHU(CEw}A4KCSYBPB{q&>WA~p0u6UsHADD zFaMcc+FF=Z0d#WSac*B?yfyT#np-d=^eX+RTtEJ{ZFglwPeB9M<#vT-Cw6R zM)?qZ`n&r7Pj{Y1MYb1>T^1%czMz8FKNmz%{17l5Uk142>#(=>?@aadj1|-*9gQRA zQ*6D|;|eNf7KXQNEuY=-8v4B}uN{1S>d_)r*G-+w&izpu@6SqkQ))?BN3L52I|gx+ zWeu8%VvA*=8e4)`VJ_E)4Xu=~+5E32FzB;hH#+dhnj2Sy+=WsQ8P?^Q2fDOJPb!Hk z=zaKj`9FHLL&Gk;hpv{5Qluiu4VfmXe#TY#`Akj5#>Q)(;$m0h;t18$pI36nRq@2~ zsK;4D!`n?=1dFwbI!#rr`HL8;Zv&nS3!SZh{d~)LzlLS`ND~Xz2;tdI|3WqFQm1nM z#0B!s3fD3(((hTc7JQ6FR4-D*JXL*-FhOjj7!=F8Bb%A2bCEIf>}4VBh@Zs-o)9}x zd%o0*vw^r*r}lmc6hqQkcknqt#kj!+jqXG1@~C1bp7uDv@Xv*;YIYA26?i6t_%|IqoMG2sl@WkDd?j<|Mz-Uhk{XXETA9 zTw^iVwGf>lC2Y@s6Csqnm6mk^%o28-+iHA8^t}sj-xJ)^kP`%!D*m~$*z3t+(>=NR zYB*8g`IU`4K%4Bx*BHj?dtL>-zb2XiK9;dEQ^X~C(sn{`p3008>so?n=|L6^@wu=Y zDg%6{Xw2?sjU*H*qdFzyM16b=3LB;-aEjhTl2%4{@kn(bEvq9{{ONtx#LUi7d~7|< ziBb!#g)78dg+E8ly*Y?nQd~bh6mtVR%eIPW@MZ2~lq3B2uu4nb>8;b9jhT&hTg^rW zoYK=|qK1}Tb1x@CVC?zpYI>|j1MN3c3B8e;*;$en#k{oWE2Rmjh9DeF;JMBIjR^(o zus&Kd2|$-!&9vZGQs*^FnAQ4;?edV9$c3&pS06MNAch&T0C0KIuH$y4= zyTN*xQ%i}uw+35VH;7;MK_8McA5xjOlh<7o2PR?*Ko{eR12t;uHRB&_*_K|TdDAX` zQU*x&&0`=4pj^Dpsj{oN2|Th&9@(!eOxDC1h7OIdU`L7+1eSsHa;uNDLZnE5l7I79(ZX|QW2eIKMzFh;@y-X8}e~Jy+HM(i6KM( z(o>R-;IWwKN9!xSXDJMJapo{piocR`5^Yr2J(5T=tAgYa9}mBojrj~7Ivuwm+H|MNsX~qcESo3whQv*N%Z?_m9&X_EvH;GD+4!0 z<0W}Se#X+mVHATL0mVDAUDHP1zbsXRfAr67`M%PpiOdf~>={A85}^V~gd{}0uV|+JaMr~^^A~gDzQ)XhFH;+-iwEiQxEgZa264lsCgh2C zR)&vj9}#}?xG-H#tqld5=BSjSI3}1l%kKrYEMRG0S!CybX-Zhd?>J2yvWbfFMa-5% zG!=*jz}JOb1n@efn=&mYTp0Kn7dIT;oA19YZJoQ*gA($-upWj=+$XbJCG&C7$Y6SU zOJ&g(*#v7$WV>EzWo~pi1H62g3F*n%Nu}ZO@e*=FKg5joLSovTPSHsYRQM8z^5 z?o?WRA94<{o@w{)H{NX;&SH{|s#O)&evhb*7ph_crjQQ&qkY|Omxe-Yw0YHnP~}vp zxUAnH2q`H=#n}udr$4*`j(S56xbM68Q5R-riyk?UahXZT}Y0d*R|tL(RML<)P_eY9DK=m_u--pOOL~aqp;Q z0P}>%vV9^C+T`#pNfAct+=#7iqDuQl-*4n zm~!2lH32_BX+h2@g$P4~osKen2m(1;E_PS29r*Qc|lWbjo$*<>1X;quNu5*tn{{*#48kkroh! z&+UrB)q{)3L*G64w9DaA$BS@!j`uX~4Vj;Dhq*8G*I@WWank2_DAIub0s_NKw0C`Blx zwsm!x_02#PR|z|~fAIVb=i=`_)S-Zcb$4|{zH~aG^KCNvV5`-kO1D>kd?6=xdsdX6 zU$RiQW-lm*O(||P|5I^DeA12X*db;`5$vrFG>LLlS}JVY^BMYl_Rjj;l(eISy*BN9 zy`hLd;^J3-QVv^RZUODUTteIW&D3VU7=eb*GeK>)cQZq6x00HoY>_=uK@r}|tq^K{ zCrSM@D_@u7<0?0+jTzFV8ly3Vj53Kc!{Nkj*A4V8syB{!_)nStoH%VkNY(Y~nyE%K zNN;y>6s1CQY+VZWw-diF&j^H!?_C6*m_3Xo5ryMQ__NcCn*H?H)tpP*b({qw794g zpF>DQ>)B;WT`{j~v)8Y(DBk=wz#*@#sK5K<)@#Ky6G!XHmkusI^Wyd-cq$7OxfTE zKSb#b0^&2*_VC(>3ZQ(Hqz@}_UwG@R5f9V6{eZi&wq=1F56?}8+ure#&xyGJvy`XY zOELFeR~2fPju8-ON3?Khe7$$@@7W z<{yRMVp4?>EjW}SC<&;;X`MNQz!a|P(y)P^mW}oF{^WY@RY;DHZ)W4>mM#j=_dbV0 zGNY;ZcA{OulbU^KG8>)xELGfU!h_#G3c|-{IGS%k7VduI_mA!d)6KW{2}uB<%%CZ& z$FvH&7w)?JvpI_R-f<`)3GA6P2Oep)|FG!i+prZDm7u8!uJl@)Jx7xb<8qw-Re^zf zP%r%l;_KVF;Ok+zvT7$?hnphQYU8;Q>tZ!UdNBkNaqg;*;_xZ-LysgORrPCp69&I$gQ&Go* z*uoA-{&&`ph(%So-`WReYajvXV)o6)tJH`s>r0|vU|)}$lFPPQUHu1c^v4olxAr-9 z?NN!iuJ6XJ-NU0#lQc9EpMrYj6u-u@g(K;(r zhUZ-3*X-okH*5EVt8u}2lxLgazF|N4y?6cM7$Xd8JbrZRb9gK_Ll#fRzHYdj6Ze7& zfh=4MFB2;$N}gJ}=t)|-)zGV*Fs{L)=Kg$uh?do`7qkuyb&?5#K_Qt&>OKw@y~4UXpGki06*qg@w$y)WD1`@8IVs&In%IPMkR%j~TsR*V*gc45 zZ=MzA;Jx6pR{ZVJ0C%DF+}Kk*^mxd@W1E{SXJv&ouhe2x@{C1&7cKOz0etsklR)kc zEgv7E%W5#fyrf}<$6}JB))u@l8Ej|yMqsgTy!}nv{We$A!er}-Xr1B7?`{Yw@u8r( z;LSMPH}x`M{A5K#i~oMdub`Vsu=%d>xy`{r6x3f0xq&}%F!pwSj8?n(xY z5qafwhb|M-h`{Dkdh)6AoNG*2NK4(w6QNpQr*5v#{fEBnfP-{sp0d8S{cZeHX3N13 zE;g;%-%k;bQC`6~R8fnmn93i|e}%xsCHYhL2GDm(b_m3!J^mU97A8C;=b66jIzxH0Wr9a(@a<-N9&1^pb2J` zj+av#c=;5K)>4^5TyhM0Uz(7q@FzNT59t>ukj7 z6w46Le#^p>XM=;5G9lz(z0Mm9gow6lp9)$GVZ$EF&4mn>s(o7-y_2__P5G zP}NTdBqtkJSn(?9H<*UAx^k;X7^LPkSMsmg24fFi-!x5fki@F1p`S&2afq|&fVCkE zjmwvOKH|O`F>~TET%YaRIy!QLg8tgtI(F`QF{}y^f#XCJpH3FfjXKPt6)C|=tojG{ zcK*iOjDII0Si072}lcFq}Y-Kv5dLV zPLx1KS9KtMO0NK#FTa&*+7WEmBm6n}8!|)!AI?h_&lXvBLLt7ODZ*h-K7mdCM%xj> zSP{|ObdQ8>cM%8BpNJ(u`u=x=;LCx0tjRl42`L4~=Hut0V;mv_Tk4(cR_4}|=V^P7 z;K|(O?b{IpX!;BzCP`vsXLii2k*|5h@IeQ*_g|A6WrIr!qRq6l_-b?UMF?4(a}_Jo z&AaH{9D{^az60|?>Q`966$;mg!-;);wif44kGtQ4w)qA06>%AXxvjcq5*BAfz9=w_0c{G;ddmeDdB{O zfnvXAmxePlX=q+Gi+b}-V#yGQ$f*UiGazsOAg`spbN%{gDe-HiGM?!DnLf4mP26~u z1E!d7W<`a>o@OJ-YgSmu>;8UusGvdD+}>Gyz*WF_e9r`J9Z>?>W5W?9P%;EowC5ZU zbkch|x|tyQQXm^1c5xa@+equmz1O}%q{fsq>a45MyHl+S?1sDvfs!dw<1zsk(JxgC zFco-xcUx3Olvl8{-xvF4e}V?5re*?7CMK)*QM*$WcU4%JrHCj4AA`+$xgSAb%8BAG zh2=(z$lDyOusT`Tf!C9;^i&hbd8p=b$fEk!*32d@Zl(~BweBX*$pZ>+ilX9yb6%|2 zbqp|4!~b9CX{6Grv<4RhD~md4X_*Gm7KwU+JeyK>&Kr_S=J8bpFMj<-MVyaSD^n2y zGdUf{IVX-)w0|RI>5cw$BsTf8esy%0CRT5{o);_KOtp(iJlIgbHNk?1ix|?(hM?Wkn9Y39U**7+de!G#*Li-HW@1wW3 z|Mbdibkl|58C7c8PUTX}j_bL0UWQpcuMZ@)&5(E8*-_FU_Ti7`Lg=SE$4Y|Y04n?8 zyu@C1lTTAu4CvKlWj0^t_&fGr6kE-i;8gC$>fI)6Y$4D!o3<|VWUM!ulU%qK)6 zB62spv(_C+?r~Rwr>#jWuhukpy{O|NnJ6P;vZGk$?Q=lxG&{AE5qE#khnMEK2+a7J z#1h3zdb=qqIBrf+zfDg}CL38M9BS6rY;ozXYqUBv2`*B08|y|N3$kjU3tV6zE(PY# zh3f|KmJ$}gKfRCMAEhoq9h2LM1s^V!XFE?eHyo83j@%`w!-}^DbwnA|`(DsEdYFYCU#I-WyGQdQVtJ!b}cGL9db0$}e2Ew=PQ$^+(}l zq|`p!0a0>H5ic)x=I{h~c?EbI;JXyw_a7bAQjZlvqHT)kTn+Z@4UJ&+>7Y&G&)HohsddqnH0^1ZV(Mx93nwHFEv)!nr2sXvV+2DHj^G>+cq!+uA z967r=OFrw#yH0z{PTTj}$qqM>SpJ-kmR(ilkcm}mgkck@1EC@F9@KiEQD$o4{^$1EycbVRhMh+Qn>5NrSgs7VmV*yG*&8vO&0?0UD7?U_JN zt;va*g$bN4(_R1ClqV9@obSQUr)sTEi3-ETj`1iMVn;i1OUH9kxMOLp)E(?c47^v3 z(q0U{_-SSr+Xf7^?875&PP5Z$Dw4Sq&t@nD*#lSy?C;Qk<}mo zl}<-Ank)vVy);7VGH?FPXVDqjjm?*diNaT#?r)AByjs)QEoKA~;){K68nk`APsL$Y z6dr1AKXX@CSsre0<_e~wSutic{4 zTT*dotO^}|-0NWw8=^?Wbv&ne?k?lhqM`Xllc=|oa{Wuwn83%FTgP+9<9_h(9QIKs zbS$$bclO6(bbH?>*(x-PE47P{bTGmy9~a(*eLs)|)BW?K|2aua8`fFRO~jyFVJ%QR zg!vc-tJ~iLXn9>$y_GJJN=oPF#KZ}K z;54en-gSvsdOP1ZSUw*gpUvg>&{B9P$p3TUnnCFAWk3d>YzCFK5MdXRu!4kh4ZIN8tYtHg{vC;8=H$=ir04#L_4{HZVC`}A z6fLIg_y5Obn*Ka^7JDxHXE5IR8-}$Mdl1$gk>1d!@RlMI`oQ8H1xc^$g#+$`1-O#{ z@8sVsRkGyqU?vjt>!ZB1tJL;3KDt1QYwsPAOOi-M%1E-9VAetciRZHbB>u0lS7_)6 zUJ`vyTm#-EkAC(OrI_mc{J;76laeNo@7;wP?Mpv+&F1WENXtqU)xKSq0)@jbYM|8s ze0`)q#*+X4J^&IV%JkX`DMq0nNWt;uq%xiBxJF)3F^;JC4ZkJ!qpK{iR%+S0` z9)0_C6kz`s|L5Xt^>Taer!vf>CT$UZ2**5k7W>x(cq{xbHD_O|8Zr zE8^SJl6|l1uk_A{Ooy)8Quuj>DBA@qVz_sZCTq#!t|Ik;U~r{?V;024B6o$-uZ)$q>H&b2`M$ z&u`ryEl=1e^u*tDXKT^rGy>`Rr1+X^d@#RLR>Xx`l;$&_e4y3Z5_u*% zUBw5?Y>`vmS9<;H9{h_=P2%%T`hq4ui;CJVf&dlF!3XZ=DkY8!Xevw8^&IT{rpv$X zFBct7T?7^g#LPPg)eGM5R{yre-De}cU8NXFdJ;AjBmiYF!K|rrkwQSdQW8U2Bpf?M zf?m=C?-mQWlLn;#^o$^QfS147aA`yP0lKo9M?k#kbGMK%wRo0MaBozj7bRjkn4|Kx z#bIodg}v?S#>&SeJ^+5ZOG=vReFN(1a!)dFSwS;%ap~DVuI5XLO+FdEYoq2d)i9Nv z4LVQp`CfOF<@+`ZW{FUw^y|FdN)`Jw8{h1Q%E}MVS4xSre7IYJ?`JI6BQ7X`GOJ{F zwq|O{XY5?tb>d@va)m=Xn`>Rh3b)Uo%pk#7L}VBBqBF;RZpnNi&)c1N%81C1N*3pe zmjPG_<30{!%1*c`)}S5I;suJ=GsDe$SVMp9{>XtpnRXAn)pyQXg-iuADebiqNc}mU z5_H5PO4hnxuc?TOs@aN6V4Z}K9`07_<^)r_9x)HbVCeHW1{&ie+FleR3Xg*Ys`F=+ zDZF+CLgfrBskwhA@=2faUe}e{8QvCp_7==}Zzerte0H)-5BghRXUS5HmtmZ0Zp}O3 z+va}nNpOkp+M^5VhS2Hi`K~>cGo%o>gt5kN?;+@DhLV8*xL5)c)LUTid-D7Z**l zD0I(!Eg?x{8MZV(s%6ygmqYc?eW&|_d|v^V)6gu{qdA88me*Ic-o9t~?V162D#P<; zq*jPgn4hfF)Vkha@S<*oW9FOld-KOKAhlTx8~{Mh>ycdiyZmgpNrFMj$}QU}VLbfJ zR((A@hFpYE)&@rs=Y5x;F3JcMtc+2i&e1s8KY_9$jrsY8SKZ%7vanx&&>gpkON@}% zNfI?z`g?m#+mN%@kYkJ|*0A~`<*|%a2NcKhhqkyawf(#L549p}p%$g6`2vxtTIZuJ zvBUZ-cw{E?>9ZPD3xTV#?REoAMn+7BtjsxVfKPuDD|btqNM#b|i zCV1e7x4fGO9o=21+&zUdd2;ds#OLlVnA(@X5SNER=zq2M-ce1p+q)>rr>F?1C{;lP zM5T#zX#xV$MS2NUdY4|~CkhAzlq$XV-U0+jr1vHSB2@^z*8pjp75A^)ea=7k-gD2` zfdk-TNj`Of*wXU=t&K{KBrUJ1rcuq!OKim&&Xu(c2$+0@C09=UeukkE)EF)b<=xQ$%_E=2e^CV4t6dL#HK(S+ zMGOqyaq;Euv`}mL9nGIZqiJ!AHX5FdU6!tu?z|$^NA&f~boKO^yrT7!7aLo3QySMC zvTK55a_CU!pZmD4EU^;)NsOMc={Q4*c3%|m8%9G&WYn!oGK_MaL>4mn) zqY1u+XmP)&eJvfN5m5RK_2ivl86HI7S|&FIpfnkh0@k?D`!JVEW;JPeo$BlUvHY0DnX0>|cE zU(0tXvoSHWGnlYXtu;Y1uf&0~7yT&o(Rw9RtrT#xyckI}1)5HyF%wtsYrKFr?bb$1 zV|wTIGs{WGZ}j!1^Q4OK>!^w7*OaH?EXa>#zMp4qIpMi~ zM>H=&IfdRe0W==6SW*Gr4WtQpGx%^wY8EBBoQt0G!3B4!i1*&iXAKy++8x5eH6plO z<}G!j$v{TN&4*1~oa?~@Ui`~f-?JYBeOp56Bb1@nVg)NsUo=)Jd{Oa&hz%qQi5jC$ zEjPz+wPLSZ5Y!w!?5;2|UMFQg3JtN+ zpx*vEjZQ+i0(nLB`#G;Mmnl}*PIA9iOe_R~1ad}nbd<5Llc#D=EiL7~eDPjlv32wj z=Fuz(pNgGFn>_0;qchZf2Wrv|YiEonf!G zHXjB0!f8B9eBG8x$+MqjV;&&yP#3bD?ye-dQ4P(yk>#%Selb6TWe!tH;BUTZf_m%L z`Rkwyiu8z*(%uT2GNzxa%s;`3Py>BBNNWDU_N1waC~ATFO(eX(MN4afAC`uw6O)BD zwbk_A*$sTxM0c|=lqVqa_I7Z@DPjlJG+lASQJZ^TUtdYF101(dut)aEnfkbcKqGN5 zZ^J559W9_CZrAg>nGcQ~+T0&V_w0!brn$vK&b0&H(=;#6XPr|LJ(|hzu9sB3sVjYQ zX?5>OmqMSNhakcH;Q`Am@i<7ZAdpQjVbu& zRsWx1YgJR;tWZ;&%P;HbjG$y5_e%d|J=pvvlVrcx`(j&z?=>rF=Mkcv$*J+4W8f5e z@CKjBCW9cab(?0mK%BVG1aWD);jwXdyRP)DX~nNs{+II`sMiFTPVqL*n4ao_SWmW$I+XIUo6P1GvR8 za&mSGO7;q6V;bNT7cI6&R)TzgvK!7%jl4*!Z0W&%=?46NGPR&!) zj38`&0`hMAY6#=svZ7kHV|#>6NxR(Di$)^4EeGAT?mIEubltz*x=I2agevBD=bKB> z1`{1e9qmIdrnme$(1;U!K!zz%#QI>r8u@5Cbzi`+TfC5GI6lnzOqhGm$-wH>tu8`t zDx;xW&e{(8&&g7n#D z*iAFX6#X*FiQSxOC6Qh%5 zFw(0GuvuyBdhdbY`Bm(IjAe<62&ISl3~F@Y5+9Y7)iRfE+3doTF1;h#E{H*mSIabd z{Va>+z33KDY$p)JYXrA1VCMh!&eO1lLP7 z!)8Wr;x!z#d(sH~A2~UB^Y*`0&>dRp z)uLEgA*`C7165IG86+aw4=JEF*U=au+}z@~e84A-TbiNdlic1qRIYa}D=)qgsE-pj zMR=*n5c5qz?jSD&(I_GUh^9gF?M&@O3xz z>&i4BZS`bJwjcj%^*yoi;J1!??k*m(?Rt14e`tVoxHKpt5q~4dRz}-i{uUN*L7?rMimWzAa~XbH=WXP)D}>Wo zQr2E3xl)X}ehMS&nN?8fBaIz$EX$&Ho zvu#dlZo>D6^$LE}U;XW}>UW7{VB8M=_y-Kvd6Q4Z;(`n6b*3wwLDLwlr^6$)Bp^(> z4uMcDTN!C-jkPsVsHI^>{axxMr_5^4y88L3njDr+m14oCm`zNgmzd>y3Yw?}R{38$ z^DG1$4IU{p`MJNQ+8rNs?m(h?9g_wy{AU2?aY;#KcJ?3;$T*;R)*10Trl0L;Em-!! zjqCX4dskj@KeOBFuYPE#AR>AHX1kq-v z87EB{nft$i^zZidu*cr0d+;=- zkdYuHKs~Jle+2?e)b3rcj!`iJ7JPy<9<9D2?`Gb*#&0>T*TXEqF2n;miW$|`Y)z=5 zeN@M%s-z}TUgx}R4;Y&tqN-ry%xvybqA{_PlT}woH_QaPM(_^uU9N-W^O;r`R%Zu{e|HmMKavqL~?h&#w}$_IUQti-$C2QkKL?6nYpv7*UnOeCC)QAqosCo0TJLd z-bT~R5f-K^UhUp->;*55o{MjMM}yrug%)CvCA!VT128b%mz4hui(k}y@&uqs2$gv_ zxVdY^qJ;SQ-3-KjsX-uCc}AB;KF5_dSL3ZNlHE}IQ+t2AsH{lXr0x3PAcT3c0PXfNJ-GjSX}(Hz1eaa(n;=TD`9?!Y2FzB_X=4d5 zM5zF|JExY0INzqRRDj%Q@y4kkob8>{amU^O1NRjx30Qun5!rwCyFHpuzX2fKekdfd za>-uF%HqvysC$`F;Nz)d(||Lz`!^iHg1o$#H8$$a#8@Gh)@wZ2*0pRK~i5~H)$uc_qa8i2q&fcY`#l_`VB*!5= zZ{zQuB|17zC3|gS(GUhH4;7h(_(W63yOQTIB||T^b0c^~o62OhYWxRs*FDKut3*1)4HgoNtq=Lw3IBI4p>rv}ZQ4%1(j@5EI!<<8Yv zuR|9A_1zAScL)Nn4w7G9O7+6znN$oH*4Q5#qF0ZCX|Q`}zBU^*Cg}F$Oazz<$x4LJG* zsz1lj)2B`IapID>z;4?*hyWs@La0fSB=EHVlhGR8C>_%v9E+0rIJ_+pGg0 z!GH0z%E_s?_=U%jc4#{hK({m8QK}K0i^tfx031Oa3`X44xbmv%zYQVa{F8c4W@?2F zh@#BvolxHqd6|XiQ8!D)g1mffT^&9UGJh!%Kzscfk5&sD+_F^o(y)+7I9cnlKF>g8{NVYS(jIyULgCyLh8wga!-zG z5(rv1!YnRd{E@!6DU!ecNqo@+4oGmN;vUcv&1`rywpxkt13;u_O-tx`_K@sH`hR)a z|3_}tnz+LQjv~MLianXtOA+RE+1g7@6Nl9gys&+39NB_hQ-c3GYQ@2;Lk5DHlJMy|5+RYRfv>B zD`Eu7--6~H?5HgQo609L*-}9k%vHAu0<*c^8P@$>4k+0#~0nIT*-N{CTL9LyN(qLh050@t-C|3Ig8Fe$VMcv`il6cf@G%C$#$YFsQtys+ewPMo27P%#V(j~++M5dX=b?Ei zC7a1M8jMpD<3F}?Evd!s2gGMr!}ckTnA1~O(6x1lKGcF(Fs`6{N*jZ&=FyF?7>{nC z$f?AY)Fye3yvaH6H!TyC`f6ztsj3!PRO<9RCULK%7ws)t`gi8k`W*-6nVisfbwXAF zF{H9ziY8b~dcX%@UuVq#(nMzTbGV~vb3O|7n71N@-~5f?dq*p^*eY>cra700GpMCV z!gx^BuW!L}YG{LK%Z#SP;}`8MbF%Z-kJ!2cTU>KSi-f%()c9V2!rdM-Se&oHGJD?C zd8WW}Q>t^7CW$ESb$>(2e5ay6Oa=^K5g{?xjXir zaKvbPbm7FH&J=s67=7tuSATMcgMI*kp&B#+(g2uKh@8UOh&0L=T2ZUEdfF2GWJfcLCPi{G2bt~R{scUi`fw}>AeB=Rvt zKXLZ4DI%}B%sO^jPj?nuDs!SZUE*@^NhERyCVivS#c`HOy8m~jk(I&op!|Xk#)`cM zO*%?Sk>7Ghbhd;Y9QsE5?tpzgEkjj&YTlwlBb8Ocy$$0=ZnW(UV-_v8Kp^=^a5>bX zeIhCLvI}?VbE&_p0r8ddO0mMo$gP$=E_Ldqe9@Bq?cOJ;mJ3A+BVTW9zE*a1!o!P8 z`XtZEfP)W4IyQjuhuw+XIT{^PWD#IH>Qnu~{5}4i2cnEltgv{SQ~a4vU|IWLFzG21 zoO5&j`nLD6*YdW;{-yCd%*v4D7&lhQXP%BbM^}SAKt}a>7VA^D)F#EtCXhN)0?Keu zZSQLiYt_3RN0H=_H`tAxbFUk5ZBFNFu5E;G3MZ~Evom{3dYDbEEZWyCAFkKFAC`Uz zoM+`EWOjs}YCwtiX^E#lxf6#1XCv79t&(rrD4RMUfW;2fiOhu6qa{?xqlzjg{ML#s zkgvc+5}~6!71P2fnQwWn9cHyFhZL8ORqU9@Z){fQ6?D)gp5vQ?`_1nOKift|Cw|I^ zcSZ4pbDwNH-Dcd@n-B)dmxT?*0yduIEZ3!QJz^P|x7G0B>&M?+g3YVFsG@YC*X4ez>CAckgrR?$d7s4kWT9XWl_7y0IVRk?YNAUuK zqz77>pC>UYqKdh`iWaakVvg?l)WfP&l1AoB7lcdX$Bt4XKbbe$xv!S#36*i`&AfRd zW~U8CNHe6bW|#D>{2Anne+=^aP6n)T_WBibW=gJTX^*(hhkS;hcl8G9$$^MTa^atsexvJIh?#*n$y3D_=4jFxl2Y4cYOPEN6EKzRji!Gs_Qt& zt7E35KP+Idkaryo=I9xQ#KEm6UzDQs5Y}i>@igW1LN;Gv!|&ctoI|($<^G#9L(0W$#kOs7 zZ_SLF6geE#s%4H?zd^+9v*7~w$NbP=2a6*a6D;eE!i^?+)?As>W|Xo=A@zL=$4{CX zmHibOZVcUrWrSCkaABa;Us&%0?w~Nq9Xv7&a`RNS82D177}`X*Bc!IVmTB*&F(kS2 z^_!hi)uG;PEWUIFFrFAW(#N+VFL6;q64zRy;UG5ByQZc83xf9l_*_T1FTu*-L6(1g zkn92c1Z};CfN!D24V=!BoyT*5RNeDgK;wDft;i32KzA|#62ROB;-(+zIf8nfi1$GK zB2Z=)K|)o5>w_H$Wc}CO{28`fnv2 zQ|6?JzL(&5#~S5xoVj8YlJwpZaBV6`u8$e(Z@B08pzgiBelTuNM{kLdUq<9uF&7n? z>^<;$y;#<|^kA{qfHOJ_Xc=VMd|W2*en{fJ$yW84Vi%QqHF3XbLq{hFFzOgJI?~@u z^Yp$fr$q{%6mIk+YP=5E$t{)7o2x^ndG|=lI1zPSlq}zDU7plX@>>f#S|6q(zS+8& zKlNr?dbuv9eo}~px%>kIng^O3O#A&Fys-WCf>_OESeuL-OhwGu*3l%}Q~vXA%dwh? zPK8$qmd*|fC{Ig$m-?Ke z`=({Q)bv)At-VEl3;3gFEA)GgWk2onZSq@C|Dnari{52=0`}@X?-_*3s>i)zd#TSl z%-w=xO6Tcd2-MaDu!n1#B(XzvUstX*k$f_auxjpYaB3X zgJJp*R-1;yl42aZWT#dZce%+ftJz>MOtTFc+5Edyq~1h8Y_#WMv>~(h9lb` zTz(Yut-~%xF$LGXg^pV->DL3Xp60Z8;PN2GT==u`{ zZT`c?kNF<}clIUgAA}3Okh@TYz1QA8t)Pedo7G`%ek64&{iDNeGmh#Y9m_3Hf>RqWH`8_t|(~>(^AQ>pTl0?xlD?I7f#>FwIsvNMi z771146a>-C$9#L<9OU=dN_1h_0x@CLPv2r>-yEqm^y2n#Z>Hh5r90KP0vOC$m zUXb}hN0~db!9*O-S2zT!LcHfmy*eo z#~wb3@!1PIauw2{7oZTG{uqJ|?ea3r;;~&TmTmZ~rz;d-bX%F0SW_GHHo?+0MhL-M zox!IPv+u49MSBap?Mwc+5SNvbz(#TXoibrp8LIj zn+-aHjYy(@eY~Fo)F-SR{@GcP+Kilq&&yOs6|C=DzkfO}bA0AS!SU<4h0%FF-_u!V z>Yl%vs=4k2Ok2CV)=O007`pw!v#nAeT{`n>bDa%sYKR;O>|f_y-WI?yGTR^;k&oAl ztv?${9@i}z<>$=^@|;bq_wJTDyf~}71?UV`n1l>rbap;Kn;#0!qAe*MSWUI*dGE%& zo7HD#_+~-5>!o9^UtNd0=EUQ%^bYP9x;IW=+KS*I`eTx~aaLnOW8VwkGfozYiDktq6*6 z@vk=XfJw3`oE@I1ncistb7N)%1d!#gjW)3l=9Un|pV8FT zO2kplhzf~y8k|o+W#|r-o6|FcmP4&fO`iSEVtdZ(S6^F_puxf-BGg@#$NNmUoh3+- zX1IdNfpO5D$4A(YV)fCmqV9NSkt|b zxvwm7^C}zCyOpG86RbJ>bMh;qC5srYcgc&~AS@@e19jWZ>a&Yw|Ladx>zKU6RVMQe z)1boj+BRws)Eoa*wpx8J01}ikB z@pm@=J|g*RA?3~V3t5(*??EeZJ5HSTejl*~XV>2W7CVC!kpCdAXw;0wr1m+vb0MC* zy8`ScYV42n&M!$cD*-RJIR0NhM$v5eTe1UiL|1${UkA>pyMIn#+QXri>_&AmRB-MJ z4CM_5Y7GD523-H@v-zJq16224ftDU1yJ_TjZYJ1gc=P0@ zc%WW#GRoK!!PEmh@#i1yJ~E^2ivvpGOC^|!l?`de<*W>tfN?hnH=Q4DLm1@r98rE=X;d4;TUv5!PI!^#YcK|MzmcBN?1lCf(EZxA4z;9nPp&0#y&v0c3hw+xE5 zYJ*-0f$F^^O3DVEd9jB)>l2wL_tgfgQS?tH1|Qze%yqE$GPB;R_!ly(me=4Xe;S?Rn`8$p7NS#vTF_%twUF8_| z!f+`DIsQ8{tfozb(YYoi0y-Ptv{If4Zf5rlP_wZoX6dd*U)a?KAKGQ9wn}%+dxYfY zPZ^ssp2=!;(#p*LrR01hl7{wXb@9aC?;X4tnDXC`>G{(#wCQ4cyUuwJ6oeKBM+EBl zOy4}Q7=iyV@&>7HxU_T3h4iOhjn+?-4oi^vOD#V7QW_f%RLH5o+q9MCFx>)#XumA3 z8-aq15ac~U)P6QyHuv~?ok8w?8x<3t5rfB{_itrgW$SKq*ztTM#bjSVycS`ZF0g+= z>G_b~49LBpe*c!69tu6636Aj=OX7_>U`{P^sTywX1jhrZb;- zb0{TS7;QT>Xj3g+?L{j;fB)$>)O{>cur=va#GvRoG?+*ZjF$0oij^;9O`q02a~+Y+UcF~KqSoo}fj8p(yG;%|$d7hBHpeI9a~9D! zR!R+EJt#<_<_CB`h)|Dd>Z&L3KdJZD`Soq@Q^8JG*8#niN)_GKuBuOmh0%1$weY-- zjnlb8vuOWO7M!jgpoa2Wn2qw=o7VnY4ukO;k0+4H3Gdtk-*wOhom9zs3+YHq8+JpV z3UAvh;R-|Opi|5%(sIzm5z^y>ze~tq)hxdhzw;Y=Fx74qS z)wD6o%jNh}UF3sQ_nO3R64BlAtOn-n{YdJu zk~CoaD%AkLnugR?_P$@Il`;1KRD25XWN|l09brgUKIwn|z9B8b+P4R6)R7Syw}4~8 zh!oR6y$6curyQZsSsvy|Zllw{ZhPSrOYA~-;Mpj1S68H1_b_44vnsK{Vv#!a8FI(f zF8L`}Ld-|Cl!>yn-Y-o-tNw(R-F$I7+%h!&-N~@Z@CL$s@R}0o2mbWO^jJ*OOQ(bJ zVlI`VP8mb*os5aFii{(fnqt_alYI72y#fh5r@Y4Idwb+Ox|^{02=Uoj`C=x)j|?|2 zB{OZ(2b_pK0kQ<*r1aj)Xoe~|-JuVtPwW*sexE36zgAUJQ5yyxewUDVyV&rV z@%MyZeEj?d$nmL-zNw9CIj=Oi$th?minvw!HzsFLm32NUZ{Hg#`{}xC$;m5ePJfXU z@%mY-)4vj`6_S7(PvFD4t$gF;D6pQ;j<-7QAH4T`W^=!o4GD2bkl)%FNYm5vD4j_k zTV;bQ*WD5n6e%kN1@QcQi!4x+lusU|MLyRgbgmC9fB zi=2Y_-g#6;?r4}>r+H2n7hOdALf<_Ji2!A5#NStyp2V=jr1RQsEHd0q-Httx3Vrus zgicR)m2Kv&r40}QP~1N>f){Q-4G^}|L`=;|vy_Iieb-F1Da{E8QeH8-Y=U^dKFqmh zvEN)Fq{GAWM06#NGSazncBhB&+1m8*+*R+bekh%~Q% z*eTe>52NjPd3Z&!afdv@MwRXQUz{00RvF!6RWoR3FRDlpVdaQ=2G2-|hY~>#Eb8mM zooBGwzNU=cbGl-SFuD|-o}UR+4v^?Vc>d1@NEddhui8Q>29kc3y({f4YWae|PLSHA zF%7bf6HP4#)~ME6-u8C;hncKPDHDwr=q72aY1}g@y;&azg}zF=?eOZDi=zj|O5N^y zyu>2T`rFRXF*@N=6S{q2;B-R$>94K+YGCv$l5f(!MlB=I*k^KWP$80X&o3DQhgF$- zC`t~hDbPqf5UYb#HE}BG(&o~_W&PZ9#({AK%z^sq@%EE;n%gO|Q z6OBw0EgSQvJSFd^uTxiFKlFv9`*y!j*NYsbp_i<5Crvh6C}R?6k_D89`01QYwBbEl zUpm-6_d1A-X;bs8LxKWhf)Fm#ga&42d##@}OdG|tF>fQA%|Z)4DalsrmyTJpTGoh% z*Hi7keyzH*L0{i)w2}Y0d=3aMZv4ULUOl@}SpL*>Z+3N?(n(mcAin+V)sNj8@l4|)ytDI!B`+TQ4n(YF&%tb{vCxs zE{SX~AIP;+S@HB0lN)v^DxrG;R|AZo;h%;X;<`GTOw7zK0VS+++ZiH)0{%a!)r+{@ z8!W1Et0CT@5T@ywH#PwvKEKlP{OU2iK#(WSUS$<5?)5XW;dH|8BD)d`zn|8?$Y_+%$&l91=bWly+FHmmd84Pw5wUN_Xm4pL+!b|Oh;}z(-fiVH&^7*= zoG#|Nw+D-U>Dyq3m!^+nG_8EimDLTux$A&eqxcIUssMG-N`m?s( zn7^t!-Os$C&1Scyxn1MuX>GsqH8ic(j2a|cgcZ(fSfHtYG?o}TAeNP%J%F~`@!63P zSUJKcyl8>BWrh7?=rLSkdH_2>X(h7?nU`|OOWD!*W2b#dNzvBX6NL<625o{=G-{BW zPDRyGw!8%+j|xZzX%2{*(wyzp_MVroBg?Gin*jCybBkI7uLr5%A6 zuYKzH{%FFRR(7Mw{`yt5j}Km=?^%$4p?JXlDWul!<0!kpk1R4WYEh+EGTKFX7Li_{ zlt&=hn3d5eT23gMU479%u(2F@gVTU^#KqqnECnq+Kg&38TurkA?~1Kn?6^V&oZ2rV zfeBH*`8D?ow`pojIIDn`&3jE=inl76kU00QrzRtNXn2jxtaW{+s-AyL6jzV|h)GcO zr^{sewh2|=j^9z3(uZIw;H|w06Z#ddUJSF?^xwDLxta9%dKSkN^ zB`GQC2ZNP1o!5Z1q26<_`aB1-&e#n5o$Y`lG$Dg$@lSt3 z_Tf_Z9V)WQ5o6zD=J=ub_$VvddFPXwYsnjFzpz#a%tUqOw zS>E!<1zcY^`~AhK+LhGF5EVI|@V2JeGXB-@g8wAhTXH>q7hFO{M)xA?0vTNc#?$Dj z$_t8gTutMk^@ls=bMvv7B4@dt+0!`8jEWut6+#S{8p2Bq!i0wK<*GxX237u$F?8D@F zOWHZ%9XDY-@yj(3%U-so{)vf;Wcsenv49AJT7hBP;zAiKntOQMWy}y%V770^h|;&)ZFW2OL12BmZ7|sosWc;iop@rNbCHNxQ@4z~M@GRYy+zO$QJjhz+@+;=C%F&$IJnsDx z5lYh>xuPBB2}7IbXFp-B5Q=%ciF{)Q628?v(43Z)o+2R%_hIhJxBj8FxFtc*K)6>1w9Vz&H?byJ)%VJny)Q?0;LjDR)W z-RJ!a;3np14h0QD`hUTnd0%aB3T|Xwo`HEwhi3!NJ#$_Nzf5M9?k-o5{A6LTb#j<0 zqg>Z8=qyR&{A9WYy;A;n-KM|aNekY^G^1z|H%Yy-gUkE2pam>1k1>#T8_>!q0wpyc z{m3tKNB63rxtjb}y*xcn)YT(Jxa8cM?fNNFnpV2V$V5o9-j2FEh46By zVX2Jzs^989-4u}&l=8~@9vIb*{aYwl5!`?vBm1ra?6yd$gB_7mMVP_52UmJ@E_%DffepDmh?a0mzA{azKaP8Juhs^`kE}SA5GF z1C?N<8qftL@f-2|u{6%Jb6b>h1#aWUW%|8AQEtSV= literal 0 HcmV?d00001 diff --git a/documentation/audits/day-2026-10-19/P2/browser/walk.txt b/documentation/audits/day-2026-10-19/P2/browser/walk.txt new file mode 100644 index 00000000..93d0ef34 --- /dev/null +++ b/documentation/audits/day-2026-10-19/P2/browser/walk.txt @@ -0,0 +1,17 @@ +03:05:34 goto https://felhom.enkisfelhom.hu/login -> https://felhom.enkisfelhom.hu/login +03:05:39 eval -> "focused" +03:05:43 eval -> "https://felhom.enkisfelhom.hu/launcher" +03:05:43 goto https://felhom.enkisfelhom.hu/apps/calibre-web -> https://felhom.enkisfelhom.hu/apps/calibre-web +03:05:48 eval -> "https://felhom.enkisfelhom.hu/__files/open?to=… | button: Fájlok ↗ | folder: /files/NVME 1TB/media/books" +03:05:48 shot 01-app-page-files-button +03:05:49 eval -> "pressed Fájlok" +03:05:57 eval -> "files.enkisfelhom.hu/files/NVME 1TB/media/books | login form: no | title: FileBrowser Quantum - Files - books" +03:05:57 eval -> "FileBrowser user: felhom-household | admin: false | modify: true | loginMethod: proxy" +03:05:59 shot 02-filebrowser-opened-signed-in +03:05:59 goto https://felhom.enkisfelhom.hu/launcher -> https://felhom.enkisfelhom.hu/launcher +03:06:04 eval -> "signed out on the dashboard" +03:06:08 eval -> "https://felhom.enkisfelhom.hu/login" +03:06:08 goto https://files.enkisfelhom.hu/files/ -> https://felhom.enkisfelhom.hu/login +03:06:15 eval -> "felhom.enkisfelhom.hu/login | login form: YES" +03:06:15 shot 03-after-sign-out-asks-again +LOG ('netfail', 'net::ERR_ABORTED', 'Fetch') diff --git a/documentation/audits/day-2026-10-19/P2/forged-headers.txt b/documentation/audits/day-2026-10-19/P2/forged-headers.txt new file mode 100644 index 00000000..eaccccc9 --- /dev/null +++ b/documentation/audits/day-2026-10-19/P2/forged-headers.txt @@ -0,0 +1,9 @@ +== through traefik (https://files.enkisfelhom.hu, no files cookie), GET /api/users?id=self +forged header named X-Felhom-User -> HTTP 401 (user None) +forged header named RANDOM -> HTTP 401 (user None) +forged header named SECRET -> HTTP 401 (user None) +== from the bookstack container (on traefik-public), straight to http://filebrowser:80/api/users?id=self — no traefik +forged header named X-Felhom-User -> HTTP 401 (user None) +forged header named RANDOM -> HTTP 401 (user None) +== CONTROL: the same container with the box's REAL secret name (read from the box, never printed) +real secret name -> HTTP 200 (user felhom-household) diff --git a/documentation/audits/day-2026-10-19/P3/01-before.txt b/documentation/audits/day-2026-10-19/P3/01-before.txt new file mode 100644 index 00000000..73bc5c16 --- /dev/null +++ b/documentation/audits/day-2026-10-19/P3/01-before.txt @@ -0,0 +1,4 @@ +Mon Oct 19 03:08:04 UTC 2026 +200 +{ + "ok": true, diff --git a/documentation/audits/day-2026-10-19/P3/02-deploy-onlyoffice.txt b/documentation/audits/day-2026-10-19/P3/02-deploy-onlyoffice.txt new file mode 100644 index 00000000..195657d4 --- /dev/null +++ b/documentation/audits/day-2026-10-19/P3/02-deploy-onlyoffice.txt @@ -0,0 +1,5 @@ +Mon Oct 19 03:08:23 UTC 2026 +05:08:24 [1] deploy -> 202 {'ok': True, 'message': 'Telepítés elindítva – az állapot a kártyán követhető'} +05:09:29 [1] deployed, controller state=running, pinned={'onlyoffice': 'onlyoffice/documentserver:9.4.0'} +deploy: True +Mon Oct 19 03:09:29 UTC 2026 diff --git a/documentation/audits/day-2026-10-19/P3/03-link-on.txt b/documentation/audits/day-2026-10-19/P3/03-link-on.txt new file mode 100644 index 00000000..1395d233 --- /dev/null +++ b/documentation/audits/day-2026-10-19/P3/03-link-on.txt @@ -0,0 +1,16 @@ +Mon Oct 19 03:09:40 UTC 2026 +onlyoffice health: healthy +200 +{"ok": true, "data": {"enabled": false, "status": "disabled"}, "message": "Integráció kikapcsolva"} +03:09:42 files. 200 +onlyoffice Up 28 seconds (healthy) +filebrowser Up 6 hours (healthy) +Mon Oct 19 03:10:35 UTC 2026 +200 +{"ok": true, "data": {"enabled": true, "enabled_at": "2026-10-19T03:10:36Z", "status": "active"}, "message": "Integráció engedélyezve"} +03:10:39 files. 200 (try 1) +filebrowser Up 5 seconds (healthy) +onlyoffice Up About a minute (healthy) + url: "https://office.enkisfelhom.hu" + internalUrl: "http://onlyoffice:80" +2 diff --git a/documentation/audits/day-2026-10-19/P3/04-preview.txt b/documentation/audits/day-2026-10-19/P3/04-preview.txt new file mode 100644 index 00000000..b74ee587 --- /dev/null +++ b/documentation/audits/day-2026-10-19/P3/04-preview.txt @@ -0,0 +1,4 @@ +login 200 token_len 355 +resource 200 application/vnd.openxmlformats-officedocument.wordprocessingml.document +03:12:19Z preview small HTTP 500 content-type application/json; charset=utf-8 bytes 167 in 0.0s b'{"status":500,"message":"failed to create image for PDF file: failed to open PDF from memory for file \'/srv/scratch_hdd/r1153/teszt.docx\': fitz: cannot open document"}' +03:12:19Z preview large HTTP 500 content-type application/json; charset=utf-8 bytes 167 in 0.0s b'{"status":500,"message":"failed to create image for PDF file: failed to open PDF from memory for file \'/srv/scratch_hdd/r1153/teszt.docx\': fitz: cannot open document"}' diff --git a/documentation/audits/day-2026-10-19/P3/05-preview-real-docx.txt b/documentation/audits/day-2026-10-19/P3/05-preview-real-docx.txt new file mode 100644 index 00000000..4c4b2f84 --- /dev/null +++ b/documentation/audits/day-2026-10-19/P3/05-preview-real-docx.txt @@ -0,0 +1,10 @@ +== /r1153/sample.docx +login 200 token_len 355 +resource 200 application/vnd.openxmlformats-officedocument.wordprocessingml.document +03:13:40Z preview small HTTP 200 content-type image/jpeg bytes 8714 in 0.3s +03:13:40Z preview large HTTP 200 content-type image/jpeg bytes 22734 in 0.3s +== /r1153/teszt.docx +login 200 token_len 355 +resource 200 application/vnd.openxmlformats-officedocument.wordprocessingml.document +03:13:40Z preview small HTTP 500 content-type application/json; charset=utf-8 bytes 167 in 0.0s b'{"status":500,"message":"failed to create image for PDF file: failed to open PDF from memory for file \'/srv/scratch_hdd/r1153/teszt.docx\': fitz: cannot open document"}' +03:13:40Z preview large HTTP 500 content-type application/json; charset=utf-8 bytes 167 in 0.0s b'{"status":500,"message":"failed to create image for PDF file: failed to open PDF from memory for file \'/srv/scratch_hdd/r1153/teszt.docx\': fitz: cannot open document"}' diff --git a/documentation/audits/day-2026-10-19/P3/06-link-off-control.txt b/documentation/audits/day-2026-10-19/P3/06-link-off-control.txt new file mode 100644 index 00000000..ec5806c6 --- /dev/null +++ b/documentation/audits/day-2026-10-19/P3/06-link-off-control.txt @@ -0,0 +1,9 @@ +Mon Oct 19 03:13:53 UTC 2026 +{"ok": true, "data": {"enabled": false, "status": "disabled"}, "message": "Integráció kikapcsolva"} +03:13:57 files. 200 (try 1) +== link OFF, /r1153/sample.docx +03:13:58Z preview small HTTP 200 content-type image/jpeg bytes 8714 in 0.2s +03:13:58Z preview large HTTP 200 content-type image/jpeg bytes 22734 in 0.2s +== link OFF, /r1153/teszt.docx +03:13:58Z preview small HTTP 500 content-type application/json; charset=utf-8 bytes 167 in 0.0s b'{"status":500,"message":"failed to create image for PDF file: failed to open PDF from memory for file \'/srv/scratch_hdd/r1153/teszt.docx\': fitz: cannot open document"}' +03:13:58Z preview large HTTP 500 content-type application/json; charset=utf-8 bytes 167 in 0.0s b'{"status":500,"message":"failed to create image for PDF file: failed to open PDF from memory for file \'/srv/scratch_hdd/r1153/teszt.docx\': fitz: cannot open document"}' diff --git a/documentation/audits/day-2026-10-19/P3/07-teardown.txt b/documentation/audits/day-2026-10-19/P3/07-teardown.txt new file mode 100644 index 00000000..5bec59dc --- /dev/null +++ b/documentation/audits/day-2026-10-19/P3/07-teardown.txt @@ -0,0 +1,8 @@ +Mon Oct 19 03:14:09 UTC 2026 +test files removed +05:14:54 [X] remove (with drive data) -> 200 {'ok': True, 'data': {'removed': 'onlyoffice', 'volumes_removed': ['onlyoffice_onlyoffice_data', 'onlyoffice_onlyoffice_logs'], 'hdd_paths_removed': [], 'hdd_pa +05:15:03 [X] after remove: deployed=False leftovers='/opt/docker/stacks/onlyoffice' +remove: 200 +0 +0 +ls: cannot access '/opt/docker/stacks/onlyoffice/app.yaml': No such file or directory diff --git a/documentation/audits/day-2026-10-19/P3/preview-sample.jpg b/documentation/audits/day-2026-10-19/P3/preview-sample.jpg new file mode 100644 index 0000000000000000000000000000000000000000..851df4b84b7c6493185bf312ff7435b7247506ea GIT binary patch literal 8714 zcmbt(cQjmI+x8j5=wvXWB?hBJi_s@Y)G?yhs0q=djxJSC$QWiY1krmCy%R$85+ynz zN|X>r5UF2&Ph0QzeeWOd^St+3*V=2Zv(H-R+UGv^zV7S%p8dT5L;>_PG;}o7^mMdz zj12UQP#zX2Gc%N*lZ%b#5<*N=1R*ReA+4$)A*CWEEUc)9Qqj=D=wQU;4b2VEW~$m4 zEf51EBa|7+$HKy=B`GYa^>4@TP5?>+0zd#5#1BwFL0~B8cMm8J06~c z2MC$lei5{E?B_W+xderTMJ|cT%E>DzqONFYYN53;I@e9j%q?zMT3I_fIlH*Jx!>^* z2n-4i3B4N`6&>^VNo*W3DLI9dn)WO`FTbF$sJNuGtfscEzM-+Hx#e|t&zs)9{(-@X z$*FhKGqZE^s~^_ZH#R?RZSNeCkG>qAoPIs~_7}f@#@`A37e3HGd?+X>!Iad0@c~f; z{{a|ENyUeRu&5bRJ78J)rNe31)CsxOU9(VP9Dc4;ipU#NUqw`i_lXuT?1_NC&lgEq^%(rE1 zk9InEZRlSNJ+(2Lz?>Hf3L^+$BK@WJc7{ap4_y|!d3eIy?{vUxCMqhOf{z3vP~1aC zp-u_Ims&X(%+|pJoC3L}Iq&vdMDtXgf>U5nt61^|w0e8)33b(&396)?v+jwD^OVV= z?BSWgk*0hN72%{78sBQ7G0^#OhV*m^;Xd6+^JIFacr*;b&}-3cn3&@lJUBLqI+X>v zytk-rZNz(oT5Ay;1L?WF7x-QyZJjQCBqF=MC|b(t>J}|fb~uK{bJ7*0IJ=s*CM0{u zcM3)smN&}lO?*C z9$y|bZW}sysMnf@yuW!X`BndULHs)eD03~YD0?>OgVHO}(S?Cf7Sv6-1V{dq`z#Qt zYUr<>yL9^6HzxQZ{L5e%i%X3^^Vqx5g%)ZND9Re#BX+d32*t=~g}bZop`o;Jiua5( zvHKJo0m1A>jxv82A|096Rb_E_7tSHpLml0fYPOy~=9MkE#_MPCcoU)B;g!epF`y>{lf7)7QTJYcr<@3YP$ zZuO7bYE$y9x3~!eG@jwQ3K($=2YNkOX_EdC`erp;R2v`UDxY~S+p^C{jW*;f-SX4M zOSfu1I1I<9<UR?KfoRiiF*(CC0Ug;|6zgl=~gB=vAPnW%9#FQ0?t!+G% znn;d!qONaazxM|<96+YwxESE_O*C~OpoXnjus)-3POBSr?7_-7M4?T4r5~Crb|SKn zGwg-!5j6J)IFs*pO1`!mjKG-pTCVB<6c`?t{43~8=Og{-(xkgOZLgabBkAV)j1;M> za_gR}lrN8zd&QS$1a~^v#n%DNwvJ(C)J5als<3*MyYCI^T2npR-r5-YRn^plK0U`> zh3Sf5SL(qXD~X(pi=HB1?YsRVBWU11)y%IMsfbXB)Qedax#g!ymhwb-T??E`F~E*q zZ`{}yE&KY^fH)@!e^wO#Yb@eP2y2z)z$o%GT%d$!jgY~9S0A6vGvMyQqpNg2mHu=< z_~lDm(5yWZ!1l7xovdnqkJ}|G5A7&bYVySIDK5Z72i$lEcu;@bK3^R^4p{#-MOf&j6%rvz_as%T4j_^;@73~_3WbU8SdWkh=QAFN zY4MI6(ag07pthK`(AT2Xm9>jxymVs-QMIa?SS12NHB}FI=t-e|?9e}An_*bn?Bem% zQc$8x8qIy}(#_w%r&{KG=;EZ{M8Nj6R{HB{tyJ#r*9BKOn#Op3438WmPIIWcORN`l zc(4XIvRF-tav~1)buR`EojtS=MKpw8l*c$)#4=zLbJ$FAC0}?&4?n4hS_2|^aeo8a z92;ZQ4PU{p5zJ#!?D@%W;;Rw{rS{0F7p>^%)_4P=jqz#5TcSnn{w3BnT@ul6%B|8B zZEaO2T!#rp(8sopSe2tab06g!K3>K8L8OVAind9#ZIl%kf?+&M=f?MLcg~A8>)3wC zg3W6(B7sGg@VtLGCq+>JezKbOPF``Po{zSMg5gai%CEWSgt zyK;qR7^kC(JU;|MHP&Y6GN-rN{3kjJMe#yECee}XCtgKqYGS_*hNQhkp*K7?1x-oH z)zm(x4M@Pz4VWZO(|Rp0V;n;el**ntFTgVb9e(~ga)tFhv51pH%=W3(Tb5VSjg()` zQVidzeG(JB%)aes#r;w?4-quck8r*vAq*Elj*d^QyDA5uIMcg(EUr8Yvqn8qS+^YB z=oXbJ4Md%#UiyI&xJv|NK_Qmb5DWIIh{9)vBt`MA*&rN#sw&d$pdz>0%*I1ZbNZN>ScHD~x?C=(|#K4^M6C zsv>AzT#Th<<0>gV*(5*MgmP0a*)~WG=d7dywL;nM;^FI!@lWuWgB$P{iMG(U>m?)n z+tV0UujegiPRTtUWMbE-;@Y2Q@ntr)nt3QtSKE$7Y)QcDNgv#igycXISa_FcFvOOX z*e(;P@~hda_@;)JRB&iN{YIGjCMLhze@5ogH`fI?`){E3)9c~93C7w|D{T@IE*Q($ z2T%1M3%XjAIUO|S+sN$0YS6U6r)p_0#i0_y^cy%GKbDJIMpoO@HL}m(KKn_KOA5dp zPT~)JTCR?+XLVE0usa?KrBB-Qo=zVQVK?#?WMel4YDl1}zLH+#Of`xPgq3X-8P1T% zrx(BEy`7NQ+uBgMoObqPdvZ&33R_@YjxEtNqA0@w)T(0a@84LQH_{f@0o0SgelIw`SzCx6=)0AH_p$RJu{SV=cnc6=or^@t#gxUIYQ7u3 zVi7&y=FoK`NHi?+<=4CgOii0xVQl5?`Yb2O&fbeEk&b>$x|lGgVwI-i-+)gq@jOYb zYVqfDuO9pBv_!>}gt1e3ckVW}*hJUDV2@oMH#Cu9Sb&D7{B?v5bRhink| zqd)Rl1O?oXovu8PP7|-8UZ_)aADBb)$3mVOh?B*}B4C6lC3L}E0eqHEt z1DEDi7ahuFLf^NRM|-lP6C)y(Aig;b2EHp7pT&0xz+6-;gxW(ipGt|Bb*P^g@!JXB z8-;AmI<0`aHp65^%Gy-bg% zk4C{5J++x0^!ejW2XenznS%Nv3nSodZ01#ePq#ED{6f@Z&k@42NeLE_w2iCk;(_)f z{BM*1d2u3tfr9=;Qw61qJB*SjeupER*aJWw^j8LijM9Ah-fm(Z>cx)8;tt`51ZwaY zyy>{l6FO)h1zgY%lr@3`?l(I-__HanP#tl*KNw`cM${f+3E_x6`wi@VX#624Pp#W9 z#a63zg<8N5OoI%K92N{Spu;8MT8<*q=kvm3F3WxAzHsrgS-Rnudm8*5Gy_hz3$+yo z1OV5jvTrj_RwiAm8{*d#&L@cqeV|Jeic`4Ryhs@pKDLC~wh1tTD0lEpI5(z9@<=~( zZU~|Cxoxy(Z{)PHp}Llhq`m>nWWSk~ms(u3!xT~Ct=5pq*ILysLNpSshRcQ~V{BKB zw?uLn?v1g|&Y?NUpO)S5vczlB7V#&^TH^FbR42HBi5BR){A66tO9;r`O2_%b(qIlL zZarR2ND%L%3jd+DS62^0r-*E3nV++N!4D1ytl>@IKo*@i*51MVO++GZ5F22*2FTxqh}C-dHd<6I!e0-@t$15>3aFSRKBCZWSJvVh zo}`(&z5~l-P75c3u0~>ij8$9-qX1Dt6Ym*ou>pT!HV+RIWAor5x$vPu2%_N>QRh^4 zMiJt+A%`<+F;mUAOVuN4Qe9B5ijbAB{vXkiXH-!RK43 zs!&qi^yyfJhV_>7n+07m0D3w+C=~RC7I!M#apmo+$sbzx3hLc(5&T$SCKCY`---R}Xs)yLKpNPIq`-%fp=;t_3vm}rembPYm+Aj~+N9zae zYXrip^m_T6jKH2xUhvJ4c=~A<(Z0y8PDnj0$=&@0diNybBt<^y2PY#Q)Z-W|-Y4J# z&FK@@vvzr2F4%2YdPn19(y&Je3b)BIRU)n+`uK)D=tAg#P?-Ey$zHDf$+)^R(Ugnw z2!V3#?A1Az69m|dwf^VGh*@do6o8w149T~UrnLyh6@}7_LrpA>0e!|lfBb@>CpDYu zr#4!DjT6mM1=j+4$tF~bL5T_=dOzSdVCf4%0kb)YS28UGdkNT+jb`1}0a#mGXHt#O z7b}S6{;Fk-lgLga{75HswYTN_J?#ewmL)rFU;I-7`#AGKQhmZcgqFu!Ij|qH!O7W+ zzWbrZdE%v$=y}tS$q^Rmvg&QcB!Dy~mJBB%<8#qwQ>_PWwWBW~FZ|iCxE`X?;B6nt z0CA26|L-gQnLok;dfzg|#1&%Qu`0dCEhNRMUgiAw#~v}_bgMPmLlFxP%Ru5M|Vn3(W5 zB{_xPKCkr9PaUw`7pG@U8heS_@tE6Im_BJZ7%9n!d7_>m77NBy<1#d;BB zj&fC$hyxp;VZ3RDRcPOD(Y~5v{!BLGnWRqvS5&y9g=%c-MT7NNwA5N|d`9(9CUjI) zu0{q&zGrMnx&m9O_`axHrd-MoMO-h>P3xoc9{mtPPQ$MaD}S4t2v}%W?w71b`J{x; zyBKk>BH}agS9i-+fU9a@piW@oA7{q@T?+o3A@!TNKKAzK8CDi`Hqb2cej{}aQaL9k z{(B~c!z>)H^|?7shj9?}7X_%ovGR$oWCFMP@3i z#~jMX#xIKpYG5jxl?pHKLR!DUpNOk%Z#>Ou#=`Cv0+F%5Gp5%4zDd3luYvcZ~$NJQsF+4Ib)k|K^KSy#O=es(*1Op{O)%32tF8 zu|5x`P2~x6^_2SpoWNS8=h7DG zG?i#OfGC@Ikj;nb+ZU8B_W8`h+*oW4Occ?Y7rBLb4d%wq2d#X}-7=&O?_X2VaJB@F7>SKZVyE3wVO8CCZn(43+N{wQM zeobTd!vJ8uU*!!fmO8q8@0hY(r&4(;Z5ZUdK%A_;aOF|Kz}e;8VT-HK#;R9!O>z4h z`E}h0y`h*#g7%Ax{$zMBGQy_16If!^baB&s;%v?^(BuseK>}|Rv0r5SFT-1K1C-%w zgW+&$k9{DbIG=*UPg*GuQtN$R!RKm8dYqk|n(x!_>XaDu{<2x;YXN#+!T3;W7%Vl~ ztM0pHZhdR32K|eIjKnJbMVo}xuGe9qydih7s@&M?H9bVhmCD?(KvCZZYU{j?2IW3q z(H~?AM(zdJxy1QmIg|(#7u6}i(MGe%;o)Hz>18)#yB*y}CmByF&xxpKNJSyaXs8So zpC_Q!FE_!tlHUb7S*$}ixx=Z+a#^yN`0P37=B9K$xV@n0oPMjGSKsKLHtT0!=0`Y` z>U~VbzEAw88!`)ap&f1{!PsZquB4vx=-zc2nr-ss`|DtX{e60F)c(E`EhV&$c$IcO z$0?J^5GJo(;V`zU%N;MYU=W<9<>NBV7j81bDq1>+A+>Q z6%ZTnJtKpp6G7|D1nyYsn6=$o7Xc^XT*?Mkb#)Mp{{DW-Ph*~|UK()k`Bc2IWoP=H z1`>(_7WC)7W1ERnza!uinHJVb4{O*N+Zu+C2%jPVfa`a$F z#Cq8Pyc)1h)aK;u=lGr@LI=Ds`rqHmlHcIwh`||A%@BbJSHgcS3K160My4J z3>H9@@BRj0mh;w2I<((48xCysH!gMk9I)@im(dFVvkQb71O=#B%jM3M#k)?yEQVf^ zvvAVNYW@)7PC=rA)6Y)U{6e!x504|bG9-tQ zODsF-O*Q(7#cQ&QyPlS#8mC4xOo6tomUQH}MMFtQ!o7=CR@)HlO44t=(HQSUln(&| z!)DCKX&)&gGkKuTJ4^nkvziLIm-SZ5V<)$>o!uWx(mayXVcn70_(({|i12mu3UqA7 z(|Y;{xTX$@n_HQ!(hOLr=!Wlh^R^V0fGy$%e$A%_HeGQZd`4L0Bl6FhB543MUkjn|%WT_pr_ zE1L{#w06IuIX^x~wgG3gqfr3Y7jyFtEAfq{IHAP+7Mk(5wKdhY;8t&)3$z@gOiZdJ zfp7Rf_SZHw%fCeU(_Cl7<(#`3WV>Mr#U+@C{Mo$WhUxf?s`U4UEe~BR^v5CS_&K`F z4rwb4r4x1l2L75iBC%hD9D8b6DdcNLp($y6vi_q_^lkuEu-9TUFrQZ|FjFCD736)y zmyF)J9w8&6&ZIN%*S`pE#W^Ct*$OzX5ASYvYP1+{cwMwtinQYnMsb4O=dqd3XW{33 zLF40ACc7ov?4;oHxwiRf)^f8Nb@v|!DlV2wLzomt%rbiAecgl7pU&TWK-vK-du@a# z@)J#vSu~cv9{Y9)AbX$f`mP`iLyRUy; zxIVMTzR}kHnRhfABl3nDPDYukvb+7m%KFRF8hsZSB0JL%cl zP=hExmyY_YXNxq~rA>Y6p51Q{2uIe)ZExl21NGx1Wy`Gk3IU($s zWv&b3*zOAYu|+`&uh6R8#@h99#t#0;O#h8qbPXu$Hy~Cz_R29)_E3ur#A>5CgIt7N z^>iCAWl*JiqqA0gkWl>Lj+RjwF!sla7CtJ>3!{@_{_C4JV|1p!S+NirW2PU+5MO-<+m>H}YKrw9j3qgLw^?(hyjRQ~pxsl_a z5-1-$@uz|A{K5uMtNo+5`d2af-_1ch!)o!G5^z^w&1c{}c3?a4iW6BZ^Q~v#3$00X zuHaN9RBvOSt=u{9Z0cB=7a8mt-`Z(fC#9mo26|p*xp*sIn`*crVWYo#j5V7Ow}QM0 zb`*{z^oA(%bJKf#f1n>VrrfaVbW3jCuE3j-gLdG|JnnP9xY<7Sy1>o9Tblp0Hvg@$ zj4P|G#VTyb3ybha8cM?pjjK~E2B^g!ns=gZQ&Zwb+)HehaxU@HQbZhv#*J_yD!JVS z_)=0M&}R54kV{}1(i^Q5~1#bd8L{c1`*n-L|7h}7F5>nq3L zb35rhR~#35y6+#gh-&u_K68xEP!xz1%?$pj{yf-_>(RoGP5E4fXPTbsFH<+2o6gY7 zp?yYI5=B5ZTGc^`bw05|I)kBORhalTDchC%?~$F{3Bq!rW+I)VDx-Hey@|AWIw7nL z{nbRPhFT~NOD;wIu}++;cjRlv#4ias#i(&tPIkjA`V4hgk8jG{LAcANiIrIRF?GUIA-|CZ$QMHfo+}TeMlH! zVsOQXYBxj4qlY%ohiyxSJQ)61)a>}!!r==dxWsWncFQ@&vRuLhbM4)g*ExOUs51k_ zGxHnxPNsRkEhHpiM~t literal 0 HcmV?d00001 diff --git a/documentation/audits/day-2026-10-19/P4/01-customer-floors.txt b/documentation/audits/day-2026-10-19/P4/01-customer-floors.txt new file mode 100644 index 00000000..9da363f4 --- /dev/null +++ b/documentation/audits/day-2026-10-19/P4/01-customer-floors.txt @@ -0,0 +1,4 @@ +## per-customer floors 0.332.0 / MinAgent 0.158.1 — 03:16:43 +tester-1: HTTP/1.1 303 See Other Location: /customers/tester-1?flash=floor_set +demo-hp: HTTP/1.1 303 See Other Location: /customers/demo-hp?flash=floor_set +demo-felhom: HTTP/1.1 303 See Other Location: /customers/demo-felhom?flash=floor_set diff --git a/documentation/audits/day-2026-10-19/P4/02-boxes-move.txt b/documentation/audits/day-2026-10-19/P4/02-boxes-move.txt new file mode 100644 index 00000000..6b2fd803 --- /dev/null +++ b/documentation/audits/day-2026-10-19/P4/02-boxes-move.txt @@ -0,0 +1,14 @@ +03:16:55 demo-hp=0.332.0-rc.3 tester-1=0.332.0 demo-felhom=0.332.0 +03:17:28 demo-hp=0.332.0 +== hp +2026/10/19 03:16:57 scheduler.go:85: [DEBUG] [scheduler] periodic job registered: name="selfupdate-check" interval=6h0m0s totalJobs=23 +2026/10/19 03:17:04 updater.go:104: [DEBUG] [selfupdate] SetFloor: floor "" → "0.332.0" +2026/10/19 03:17:04 updater.go:104: [DEBUG] [selfupdate] maybeAutoUpdate: current 0.332.0 >= floor 0.332.0 — no action +== root@192.168.0.154 +2026/10/19 03:16:55 [INFO] [selfupdate] Post-update startup: update successful (0.331.0 → 0.332.0) +2026/10/19 03:16:55 [INFO] [scheduler] Registered periodic job: selfupdate-check (every 6h0m0s) +2026/10/19 03:17:26 [INFO] [selfupdate] Current version 0.332.0 is up to date +== felhom-pve +2026/10/19 03:16:45 [INFO] [selfupdate] Post-update startup: update successful (0.331.0 → 0.332.0) +2026/10/19 03:16:45 [INFO] [scheduler] Registered periodic job: selfupdate-check (every 6h0m0s) +2026/10/19 03:17:17 [INFO] [selfupdate] Current version 0.332.0 is up to date diff --git a/documentation/audits/day-2026-10-19/P4/03-box-walk.txt b/documentation/audits/day-2026-10-19/P4/03-box-walk.txt new file mode 100644 index 00000000..6dc9f6f2 --- /dev/null +++ b/documentation/audits/day-2026-10-19/P4/03-box-walk.txt @@ -0,0 +1,33 @@ +=== demo-hp (enkisfelhom.hu) 03:17:58 +containers: 24 running; not healthy/running: traefik Up 3 days; +unhealthy: 0 +2026/10/19 03:16:57 updater.go:855: [INFO] [selfupdate] Post-update startup: update successful (0.332.0-rc.3 → 0.332.0) +allow-list refusals since start: 0 +2026/10/19 03:16:58 sync.go:142: [INFO] [sync] Initial sync: Sablonok naprakészek — nincs változás +installed apps (stacks with app.yaml): 12 +public https://felhom.enkisfelhom.hu/login: 200 +public https://files.enkisfelhom.hu/: 200 +=== demo-felhom (demo-felhom.eu) 03:18:03 +containers: 9 running; not healthy/running: traefik Up 3 days; +unhealthy: 0 +2026/10/19 03:16:45 [INFO] [selfupdate] Post-update startup: update successful (0.331.0 → 0.332.0) +allow-list refusals since start: 0 +2026/10/19 03:16:46 [INFO] [sync] Initial sync: Sablonok naprakészek — nincs változás +installed apps (stacks with app.yaml): 5 +2026/10/19 03:16:45 [INFO] [infra] wrote filebrowser route → /opt/docker/stacks/traefik/dynamic/filebrowser.yml (Host files.demo-felhom.eu → filebrowser:80 by name, R-1126; one sign-in true, R-1100) +2026/10/19 03:16:46 [INFO] [web] FileBrowser mounts synced (recreated) — 1 storage path(s), config updated +2026/10/19 03:16:52 [INFO] [infra] filebrowser: default login refused for this run — joined traefik-public, files. served (R-1126) +public https://felhom.demo-felhom.eu/login: 200 +public https://files.demo-felhom.eu/: 200 +=== tester-1 (enkicsifelhom.hu) 03:18:06 +containers: 10 running; not healthy/running: traefik Up 3 days; +unhealthy: 0 +2026/10/19 03:16:55 [INFO] [selfupdate] Post-update startup: update successful (0.331.0 → 0.332.0) +allow-list refusals since start: 0 +2026/10/19 03:16:56 [INFO] [sync] Initial sync: Sablonok naprakészek — nincs változás +installed apps (stacks with app.yaml): 3 +2026/10/19 03:16:55 [INFO] [infra] wrote filebrowser route → /opt/docker/stacks/traefik/dynamic/filebrowser.yml (Host files.enkicsifelhom.hu → filebrowser:80 by name, R-1126; one sign-in true, R-1100) +2026/10/19 03:16:56 [INFO] [web] FileBrowser mounts synced (recreated) — 5 storage path(s), config updated +2026/10/19 03:17:02 [INFO] [infra] filebrowser: default login refused for this run — joined traefik-public, files. served (R-1126) +public https://felhom.enkicsifelhom.hu/login: 200 +public https://files.enkicsifelhom.hu/: 200 diff --git a/documentation/audits/day-2026-10-19/P4/04-https-only.txt b/documentation/audits/day-2026-10-19/P4/04-https-only.txt new file mode 100644 index 00000000..8682d689 --- /dev/null +++ b/documentation/audits/day-2026-10-19/P4/04-https-only.txt @@ -0,0 +1,33 @@ +control NEGATIVE (a stub answering 200 over plain http): convicted, as it must (200 -) +== tester-1 (enkicsifelhom.hu): 6 public name(s) + OK control POSITIVE http://felhom.enkicsifelhom.hu/r1033-check?q=1 -> 301 https://felhom.enkicsifelhom.hu/r1033-check?q=1 + OK http://files.enkicsifelhom.hu/r1033-check?q=1 -> 301 https://files.enkicsifelhom.hu/r1033-check?q=1 + OK http://no-such-name-r1033.enkicsifelhom.hu/r1033-check?q=1 -> 301 https://no-such-name-r1033.enkicsifelhom.hu/r1033-check?q=1 + OK http://paperless.enkicsifelhom.hu/r1033-check?q=1 -> 301 https://paperless.enkicsifelhom.hu/r1033-check?q=1 + OK http://paste.enkicsifelhom.hu/r1033-check?q=1 -> 301 https://paste.enkicsifelhom.hu/r1033-check?q=1 + OK http://wiki.enkicsifelhom.hu/r1033-check?q=1 -> 301 https://wiki.enkicsifelhom.hu/r1033-check?q=1 +== demo-hp (enkisfelhom.hu): 14 public name(s) + OK http://arcade.enkisfelhom.hu/r1033-check?q=1 -> 301 https://arcade.enkisfelhom.hu/r1033-check?q=1 + OK http://books.enkisfelhom.hu/r1033-check?q=1 -> 301 https://books.enkisfelhom.hu/r1033-check?q=1 + OK http://docs.enkisfelhom.hu/r1033-check?q=1 -> 301 https://docs.enkisfelhom.hu/r1033-check?q=1 + OK http://felhom.enkisfelhom.hu/r1033-check?q=1 -> 301 https://felhom.enkisfelhom.hu/r1033-check?q=1 + OK http://files.enkisfelhom.hu/r1033-check?q=1 -> 301 https://files.enkisfelhom.hu/r1033-check?q=1 + OK http://gist.enkisfelhom.hu/r1033-check?q=1 -> 301 https://gist.enkisfelhom.hu/r1033-check?q=1 + OK http://ha.enkisfelhom.hu/r1033-check?q=1 -> 301 https://ha.enkisfelhom.hu/r1033-check?q=1 + OK http://no-such-name-r1033.enkisfelhom.hu/r1033-check?q=1 -> 301 https://no-such-name-r1033.enkisfelhom.hu/r1033-check?q=1 + OK http://papir.enkisfelhom.hu/r1033-check?q=1 -> 301 https://papir.enkisfelhom.hu/r1033-check?q=1 + OK http://paste.enkisfelhom.hu/r1033-check?q=1 -> 301 https://paste.enkisfelhom.hu/r1033-check?q=1 + OK http://pdf.enkisfelhom.hu/r1033-check?q=1 -> 301 https://pdf.enkisfelhom.hu/r1033-check?q=1 + OK http://plex.enkisfelhom.hu/r1033-check?q=1 -> 301 https://plex.enkisfelhom.hu/r1033-check?q=1 + OK http://travel.enkisfelhom.hu/r1033-check?q=1 -> 301 https://travel.enkisfelhom.hu/r1033-check?q=1 + OK http://wiki.enkisfelhom.hu/r1033-check?q=1 -> 301 https://wiki.enkisfelhom.hu/r1033-check?q=1 +== demo-felhom (demo-felhom.eu): 8 public name(s) + OK http://felhom.demo-felhom.eu/r1033-check?q=1 -> 301 https://felhom.demo-felhom.eu/r1033-check?q=1 + OK http://files.demo-felhom.eu/r1033-check?q=1 -> 301 https://files.demo-felhom.eu/r1033-check?q=1 + OK http://gist.demo-felhom.eu/r1033-check?q=1 -> 301 https://gist.demo-felhom.eu/r1033-check?q=1 + OK http://no-such-name-r1033.demo-felhom.eu/r1033-check?q=1 -> 301 https://no-such-name-r1033.demo-felhom.eu/r1033-check?q=1 + OK http://prowlarr.demo-felhom.eu/r1033-check?q=1 -> 301 https://prowlarr.demo-felhom.eu/r1033-check?q=1 + OK http://radarr.demo-felhom.eu/r1033-check?q=1 -> 301 https://radarr.demo-felhom.eu/r1033-check?q=1 + OK http://sonarr.demo-felhom.eu/r1033-check?q=1 -> 301 https://sonarr.demo-felhom.eu/r1033-check?q=1 + OK http://torrent.demo-felhom.eu/r1033-check?q=1 -> 301 https://torrent.demo-felhom.eu/r1033-check?q=1 +== every public name redirects http -> https diff --git a/documentation/audits/day-2026-10-19/P4/05-files-one-sign-in.txt b/documentation/audits/day-2026-10-19/P4/05-files-one-sign-in.txt new file mode 100644 index 00000000..45e5efee --- /dev/null +++ b/documentation/audits/day-2026-10-19/P4/05-files-one-sign-in.txt @@ -0,0 +1,16 @@ +=== demo-hp (enkisfelhom.hu) 03:23:50 +dashboard sign-in: 302 +the Fajlok button goes to: https://files.enkisfelhom.hu/_felhom/sso +the pass answer goes to: https://files.enkisfelhom.hu/files/; files cookie set: 1 +FileBrowser with the files cookie: felhom-household admin: False modify: True +FileBrowser without it, a fresh browser: HTTP 401 +dashboard sign-out: 302 +after the sign-out, the files cookie sends the browser to: https://felhom.enkisfelhom.hu/__files/open?to=%2Ffiles%2F +=== tester-1 (enkicsifelhom.hu) 03:23:51 +dashboard sign-in: 302 +the Fajlok button goes to: https://files.enkicsifelhom.hu/_felhom/sso +the pass answer goes to: https://files.enkicsifelhom.hu/files/; files cookie set: 1 +FileBrowser with the files cookie: felhom-household admin: False modify: True +FileBrowser without it, a fresh browser: HTTP 401 +dashboard sign-out: 302 +after the sign-out, the files cookie sends the browser to: https://felhom.enkicsifelhom.hu/__files/open?to=%2Ffiles%2F diff --git a/documentation/audits/day-2026-10-19/P4/06-demo-felhom-checks.txt b/documentation/audits/day-2026-10-19/P4/06-demo-felhom-checks.txt new file mode 100644 index 00000000..8e092a10 --- /dev/null +++ b/documentation/audits/day-2026-10-19/P4/06-demo-felhom-checks.txt @@ -0,0 +1,7 @@ +=== demo-felhom (demo-felhom.eu) 03:24:06 — no dashboard password is held for this box: file and refusal checks only +-rw------- +valid shape: 1 +config carries the secret: 1, route carries it: 1 +forged secret name through traefik, no files cookie: HTTP 401 +from outside, old public name: HTTP 401 +from outside, the pass path with a forged pass: HTTP 403 diff --git a/documentation/audits/day-2026-10-19/P4/07-global-floor.txt b/documentation/audits/day-2026-10-19/P4/07-global-floor.txt new file mode 100644 index 00000000..5818f7b9 --- /dev/null +++ b/documentation/audits/day-2026-10-19/P4/07-global-floor.txt @@ -0,0 +1,16 @@ +## global floor 0.332.0 / 0.158.1 — 03:24:18 +HTTP/1.1 303 See Other +Location: /configuration?flash=floor_set +## read back (DB with WAL) 03:24:18 +min_controller_version|0.332.0 +min_controller_version_declared_min_agent|0.332.0=0.158.1 +## per-box floors cleared — 03:24:28 +tester-1: HTTP/1.1 303 See Other Location: /customers/tester-1?flash=floor_set +demo-hp: HTTP/1.1 303 See Other Location: /customers/demo-hp?flash=floor_set +demo-felhom: HTTP/1.1 303 See Other Location: /customers/demo-felhom?flash=floor_set +min_controller_declared_min_agent +min_controller_set_at +min_controller_version +demo-felhom|''|'' +demo-hp|''|'' +tester-1|''|'' diff --git a/documentation/audits/day-2026-10-19/P5/hub-deploy.txt b/documentation/audits/day-2026-10-19/P5/hub-deploy.txt new file mode 100644 index 00000000..a712128b --- /dev/null +++ b/documentation/audits/day-2026-10-19/P5/hub-deploy.txt @@ -0,0 +1,29 @@ +Mon Oct 19 02:14:15 UTC 2026 +application.argoproj.io/felhom patched +deployment "hub" successfully rolled out +sync=Synced health=Progressing rev=200ab6530bf2bec9a9b341e4bc8e2bfd09f6a609 +gitea.dooplex.hu/admin/felhom-hub:0.159.0 +NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES +hub-67bff8bcb6-8pgxf 0/1 Running 0 9s 10.42.0.56 dooplex +2026/10/19 04:14:21 [INFO] Offsite pool-box checker initialized: box=611714 fill warn=80% crit=90%, oversub warn=2.00x, unreachable after 3 consecutive failed reads, refresh 15m0s +2026/10/19 04:14:21 [INFO] osupdates: approval rule = every ring-0 box healthy for 24h0m0s and 1 night run(s) +2026/10/19 04:14:21 [INFO] osupdates: the Docker engine set is approved only by the operator, after 2 healthy ring-0 night(s) +2026/10/19 04:14:21 [INFO] osupdates: alarms = no OS leg 168h0m0s, reboot needed 336h0m0s, ring 0 stalled 168h0m0s, not covered 336h0m0s +2026/10/19 04:14:21 [INFO] Off-site key registrar enabled; daily key check at 07:10 Budapest +2026/10/19 04:14:21 [INFO] access log: /data/access-log, one file per UTC day, kept 90 days +2026/10/19 04:14:21 [INFO] Registry version checker started (every 6h) +2026/10/19 04:14:21 [INFO] offsite-key-audit: next run at 2026-10-19 07:10 CEST (in 2h55m39s) +2026/10/19 04:14:21 [INFO] WG peer-sync enabled (endpoint 167.233.158.164:22, user felhom-peersync) +2026/10/19 04:14:21 [INFO] PBS DR tenantsync enabled (endpoint 167.233.158.164:22, user felhom-peersync; WG-registration auto-provision hook armed) +2026/10/19 04:14:21 [INFO] PBS-DR box checker initialized: fill warn=80% crit=90%, unreachable after 3 consecutive failed reads, refresh 15m0s +2026/10/19 04:14:21 [INFO] agent-plane poke enabled (endpoint 167.233.158.164:22, user felhom-peersync; web + api admin seams armed) +2026/10/19 04:14:21 [INFO] PBS-DR self-heal reconciler started (interval 5m) +2026/10/19 04:14:21 [INFO] offsite credential self-heal reconciler started (interval 5m, debounce 2 reports) +2026/10/19 04:14:21 [DEBUG] Registry version check: latest = 0.331.0 +Mon Oct 19 02:15:36 UTC 2026 +sync=Synced health=Healthy +hub-67bff8bcb6-8pgxf 1/1 Running 0 79s +--- floor (DB with WAL): +min_controller_version|0.331.0 +min_controller_version_declared_min_agent|0.331.0=0.158.1 +--- errors since start: diff --git a/documentation/audits/day-2026-10-19/P5/reports-after-deploy.txt b/documentation/audits/day-2026-10-19/P5/reports-after-deploy.txt new file mode 100644 index 00000000..ca27c6bb --- /dev/null +++ b/documentation/audits/day-2026-10-19/P5/reports-after-deploy.txt @@ -0,0 +1,9 @@ +Mon Oct 19 02:32:34 UTC 2026 +hosts (agent reports) after the 02:14:21 start: +demo-felhom-8363b5|0.160.0|2026-10-19 02:25:35 +demo-hp-bb76ea|0.160.0|2026-10-19 02:23:50 +tester-1-d70be4|0.160.0|2026-10-19 02:24:21 +controller reports: +demo-felhom|2026-10-19 02:29:12 +demo-hp|2026-10-19 02:31:13 +tester-1|2026-10-19 02:29:13 diff --git a/documentation/audits/evening-2026-10-18/P8/old-restic-check.txt b/documentation/audits/evening-2026-10-18/P8/old-restic-check.txt new file mode 100644 index 00000000..27c5c94e --- /dev/null +++ b/documentation/audits/evening-2026-10-18/P8/old-restic-check.txt @@ -0,0 +1,31 @@ +## 2026-10-19T02:19:24Z hub window (id|opened|closed|result|before|after): 12|2026-10-19 02:17:53|2026-10-19 02:18:24|pruned|324|261 +2026/10/19 02:17:01 offbox.go:1068: [INFO] [offbox] pre-push dump leg completed in 2m1.262s — snapshot pair is coherent +2026/10/19 02:17:04 offbox_capture.go:47: [WARN] [offbox] prowlarr: not deployed — offsite push is unit-only (mandatory userdata not resolvable) +2026/10/19 02:17:04 offbox_capture.go:47: [WARN] [offbox] qbittorrent: not deployed — offsite push is unit-only (mandatory userdata not resolvable) +2026/10/19 02:17:04 offbox_capture.go:47: [WARN] [offbox] radarr: not deployed — offsite push is unit-only (mandatory userdata not resolvable) +2026/10/19 02:17:04 offbox_capture.go:47: [WARN] [offbox] sonarr: not deployed — offsite push is unit-only (mandatory userdata not resolvable) +2026/10/19 02:17:04 offbox_capture.go:47: [WARN] [offbox] prowlarr: not deployed — offsite push is unit-only (mandatory userdata not resolvable) +2026/10/19 02:17:09 offbox.go:1501: [WARN] [offbox] backed up prowlarr (/mnt/sys_drive/felhom-data/backups/primary/prowlarr, 0 mandatory path(s)) — but the recovery unit carried NO database dump and NO volume tar, so this snapshot holds none of the app's dat +2026/10/19 02:17:09 offbox.go:1420: [WARN] [offbox] qbittorrent: no recovery unit found on any connected drive — skipping +2026/10/19 02:17:15 offbox.go:1504: [INFO] [offbox] backed up romm (/mnt/felhom-drives/hdd_1/backups/primary/romm, 0 mandatory path(s)) +2026/10/19 02:17:17 offbox.go:1504: [INFO] [offbox] backed up calibre-web (/mnt/felhom-drives/hdd_1/backups/primary/calibre-web, 1 mandatory path(s)) +2026/10/19 02:17:20 offbox.go:1504: [INFO] [offbox] backed up paperless-ngx (/mnt/felhom-drives/hdd_1/backups/primary/paperless-ngx, 1 mandatory path(s)) +2026/10/19 02:17:23 offbox.go:1504: [INFO] [offbox] backed up bookstack (/mnt/sys_drive/felhom-data/backups/primary/bookstack, 0 mandatory path(s)) +2026/10/19 02:17:25 offbox.go:1504: [INFO] [offbox] backed up opengist (/mnt/sys_drive/felhom-data/backups/primary/opengist, 0 mandatory path(s)) +2026/10/19 02:17:27 offbox.go:1504: [INFO] [offbox] backed up privatebin (/mnt/sys_drive/felhom-data/backups/primary/privatebin, 0 mandatory path(s)) +2026/10/19 02:17:29 offbox.go:1501: [WARN] [offbox] backed up bentopdf (/mnt/sys_drive/felhom-data/backups/primary/bentopdf, 0 mandatory path(s)) — but the recovery unit carried NO database dump and NO volume tar, so this snapshot holds none of the app's dat +2026/10/19 02:17:32 offbox.go:1504: [INFO] [offbox] backed up docmost (/mnt/sys_drive/felhom-data/backups/primary/docmost, 0 mandatory path(s)) +2026/10/19 02:17:32 offbox_capture.go:47: [WARN] [offbox] radarr: not deployed — offsite push is unit-only (mandatory userdata not resolvable) +2026/10/19 02:17:34 offbox.go:1501: [WARN] [offbox] backed up radarr (/mnt/felhom-drives/hdd_1/backups/primary/radarr, 0 mandatory path(s)) — but the recovery unit carried NO database dump and NO volume tar, so this snapshot holds none of the app's data; the +2026/10/19 02:17:34 offbox_capture.go:47: [WARN] [offbox] sonarr: not deployed — offsite push is unit-only (mandatory userdata not resolvable) +2026/10/19 02:17:36 offbox.go:1501: [WARN] [offbox] backed up sonarr (/mnt/felhom-drives/hdd_1/backups/primary/sonarr, 0 mandatory path(s)) — but the recovery unit carried NO database dump and NO volume tar, so this snapshot holds none of the app's data; the +2026/10/19 02:17:46 offbox.go:1504: [INFO] [offbox] backed up home-assistant (/mnt/sys_drive/felhom-data/backups/primary/home-assistant, 0 mandatory path(s)) +2026/10/19 02:17:48 offbox.go:1504: [INFO] [offbox] backed up kimai (/mnt/sys_drive/felhom-data/backups/primary/kimai, 0 mandatory path(s)) +2026/10/19 02:17:51 offbox.go:1504: [INFO] [offbox] backed up plex (/mnt/felhom-drives/hdd_1/backups/primary/plex, 0 mandatory path(s)) +2026/10/19 02:18:23 offbox_window.go:276: [INFO] [offbox] clean-up window 12 (after-run): 63 of 193 planned snapshot(s) removed, 324 -> 261, in 30s +2026/10/19 02:18:28 offbox.go:1266: [INFO] [offbox] backup OK: 14 app(s) backed up, 1 skipped (no unit), 261 snapshot(s), 3m25s +## the old-restic check (rx.sh, read-only; OLD = image 0.322.0 = restic 0.14.0, NEW = 0.331.0 = restic 0.19.1) +store listed: new restic 261 snapshots; old restic 261 snapshots +c0b6299c (felhom-offbox, made by restic_0.19.1, 2026-10-19T02:17:48): old restic → d808e6537c7bcdb6 (7 files) new restic → d808e6537c7bcdb6 (7 files) +05c3346a (felhom-offbox, made by ?, 2026-08-31T21:29:03): old restic → 8df241f4cf889265 (10 files) new restic → 8df241f4cf889265 (10 files) +## done 2026-10-19T02:19:44Z diff --git a/documentation/backlog/CLOSED-ITEMS.md b/documentation/backlog/CLOSED-ITEMS.md index c685a1c9..aa698ebb 100644 --- a/documentation/backlog/CLOSED-ITEMS.md +++ b/documentation/backlog/CLOSED-ITEMS.md @@ -26,11 +26,20 @@ --- -## 2026-10-19 (day) — agent 0.160.0, one sign-in for the file manager, hub small fixes (full text of each row: `git show e4f022a0:documentation/backlog/OPEN-ITEMS.md`) +## 2026-10-19 (day) — agent 0.160.0, one sign-in for the file manager (controller 0.332.0), hub 0.159.0 (full text of each row: `git show e4f022a0:documentation/backlog/OPEN-ITEMS.md`) | Row | What | Closed | Evidence | |---|---|---|---| | **R-887** | **Some CI jobs are never run, and Gitea fails them ~10–13 minutes later with no log** (Gitea's zombie-task stop after the runner abandoned its fetch; S21 on 2026-10-12: runner `fetch_timeout` 5 s → 30 s, crawler rate limit). (P3) | CLOSED 2026-10-19 — **the dated check is met:** since 2026-10-12 12:00Z the four repos ran **381 jobs, 0 lost**. 25 ended `failure`, every one with a readable log (the runner ran them); 3 jobs had a second attempt (controller 1944, 1959, 1991), and each first attempt (tasks 1962, 1978, 2011) failed in 47–49 s — a run that did work, not the lost shape (one cause on record: the register not pushed yet, `REPORT-burndown2-2026-10-16.md`). **Control:** the known lost attempt of controller job 1639 (task 1653, 2026-10-10) ran 11 min 48 s, and the attempt count finds it. **Reasoning kept:** the jobs endpoint shows only the LAST attempt (R-1137), so „a failed job with no log" alone cannot find a lost attempt that was re-run — count `run_attempt > 1` and read the first attempt in `actions/tasks`. | `audits/day-2026-10-19/R-887/` | +| **R-978** | **Starting the escrow ceremony again can make the customer's written-down recovery code useless: the new package replaces the old one before the new code is confirmed.** (P3) | CLOSED 2026-10-19 — **agent 0.160.0 released** (the operator's yes, given in advance in the day brief) and running on demo-hp, Tester 1 and demo-felhom by the signed-job path. Live on demo-hp 9201: an abandoned second ceremony left the first code opening the hub's package (with R-1151's confirm on top, below). | `audits/day-2026-10-19/P1/escrow-*.txt` | +| **R-973** | **A compromised controller can make the whole-guest backup run again and again, and each run prunes older restore points: the local tier directly, and the off-site tier through the store's own nightly keep-last-2.** (P3) | CLOSED 2026-10-19 — **agent 0.160.0 on all three test hosts**; a normal „Mentés most" whole-guest backup of demo-hp 9201 ran green (6.9 GB, 443 s) and the cap counted it (two successes in the rolling 24 h on disk). The numbers (3 a day, 1 per 6 days off-site) were *decided by CC unattended*; the operator said yes to the release. The local half's remaining flood within a day is closed by R-1149 (keep-daily). **The off-site half (ep0's keep-last 2 is a count) moves to R-1162.** | `audits/day-2026-10-19/P1/backup-press.txt`, `demo-hp-after-backup.txt` | +| **R-1093** | **An EMPTY partition asks for the typed „data will be erased" confirmation.** (P3) | CLOSED 2026-10-19 — **agent 0.160.0, proven on the real route** on demo-hp: a 64 MB RAM disk from the kernel's `scsi_debug` module (`/dev/sdb`, the route accepts only sd/nvme/vd/hd names — a loop device is refused before any probe, by design), one empty GPT partition → `POST /disks/format` with no confirmation → 200 `formatted`, `data_bearing: false`. **Control:** the same call on the now-ext4 partition → 403 `needs_confirmation` („device has a ext4 filesystem"). The RAM disk removed (`rmmod`). | `audits/day-2026-10-19/P1/r1093-format-route.txt` | +| **R-1149** | **The local whole-guest tier prunes keep-last 3, so even with the R-973 cadence cap a compromised controller can replace all three restore points within one day.** (P3) | CLOSED 2026-10-19 — **operator decision D17 = „one per day, 3 days"; agent 0.160.0**: the local tier prunes `keep-daily=N` (the „backup tier armed" line names it on all three hosts). Before/after: demo-hp (retention 1) kept the same single newest copy as keep-last would; Tester 1 and demo-felhom hold one copy per day, so their next night prunes the same copy under either rule. Test: a day-long flood with the cap leaves the two earlier days' copies (red-proved). | `audits/day-2026-10-19/P1/demo-hp-*.txt`, `others-before.txt` | +| **R-1151** | **The new escrow package now uploads when its code is claimed (R-978), but the wizard's typed-back check is the browser's alone:** (P3) | CLOSED 2026-10-19 — **agent 0.160.0 + controller 0.332.0 (the floor)**: the new package reaches the hub only after `POST /escrow/ceremony/confirm` brings two words of the code back (the agent draws the positions, keeps only those two words, 30-minute window); an old controller keeps the R-978 order. Live on demo-hp 9201 through the wizard's own calls: ceremony 1 — one wrong word 422, the right words 200, then code 1 opens the hub's package and code 0 is an earlier kept package (422, superseded at the confirm second); ceremony 2 shown and abandoned — code 1 still opens it, code 2 opens nothing. demo-hp's stored code was replaced with code 1 (CC's secret store). | `audits/day-2026-10-19/P1/escrow-*.txt` | +| **R-1100** | **One sign-in for the dashboard and FileBrowser (proxy auth) — spike first.** (P3) | CLOSED 2026-10-19 — **built (operator decision D16 = yes) and shipped in controller 0.332.0, the floor for every box**: a dashboard pass (60 s, one use, host- and session-bound, none for a cross-site request) → a host-only files cookie → traefik forwardAuth sets the box's SECRET header naming `felhom-household`; the dashboard cookie is not widened. Live: on 9201 in the headless browser „Fájlok ↗" opened the app's folder with no login, a dashboard sign-out asked again; on demo-hp and Tester 1 the same path through the public internet; forged headers (the old public name, a random name, the real name with no cookie through traefik) all 401, and only the real name from an app container straight to `filebrowser:80` (the control) got in. A live bug was fixed before release: traefik made the pass answer's relative redirect point at `felhom-controller:8080`. | `audits/day-2026-10-19/P2/`, `P4/05-files-one-sign-in.txt`, `P4/06-demo-felhom-checks.txt` | +| **R-1153** | **FileBrowser's preview of a .docx answered 500 while the OnlyOffice link was on** (P4) | CLOSED 2026-10-19 — **not a product defect.** FileBrowser 1.5.6 previews a .docx with its own MuPDF before it ever asks OnlyOffice (`preview.go` `determinePreviewType`: document conversion first). On 9202 (controller 0.331.0) a real .docx (OnlyOffice's own `sample.docx`) previews **200, a 256×256 JPEG in 0.3 s** with the link on AND off; the 500 is the 912-byte hand-made test file, which MuPDF cannot open („fitz: cannot open document"), with the link on or off. OnlyOffice removed through the product after. | `audits/day-2026-10-19/P3/` | +| **R-1150** | **A refused whole-guest backup (the R-973 cap) reaches the operator as `agent_capability_degraded`, whose text reads „agent privileged capability degraded”.** (P4) | CLOSED 2026-10-19 — **hub 0.159.0 deployed** (the operator's yes, given in advance): the cadence cap alone raises the operator-only, hub-origin `whole_guest_backup_refused` with plain text (its clearing: `whole_guest_backup_refusal_cleared`); other critical capabilities keep `agent_capability_degraded`, which is now operator-only by register too. Not in `allowedEventTypes` on purpose (the suspected controller must not post or pre-empt it, the R-895 shape). Deploy: ArgoCD synced the hub Deployment only, Synced/Healthy, the floor read back, reports from all three hosts and controllers after the restart. | `audits/day-2026-10-19/P5/` | +| **R-1154** | **A reinstall while the customer's OLD host record still exists skips both clean-slate re-issues (the claim code and the off-site credential) in silence.** (P3) | CLOSED 2026-10-19 — **hub 0.159.0 deployed: the reuse path never re-issues; it makes the reinstall LOUD.** A first draft re-issued automatically when the old host was stale or switched off; a security review found that would let anyone with the household's retrieval passphrase trigger the operator's re-issues (claim code, off-site provider password) while the box is off. Now: old box gone (no wait connection, and switched off on purpose or both reports older than the stale threshold) → the operator-only warning `host_reinstall_over_old_host`, mailed: „… delete the old host and run the installer again, or re-issue …"; a live box → the info record `host_reenroll_while_live`. The mint after the operator's delete re-issues as before. Not walked live (no reinstall today). Residual: R-1156. | `hub/internal/api/reenroll.go`, `05` §8 | ## 2026-10-18 (evening) — a fresh install from scratch, OnlyOffice saves, Redis without a volume, CI mail link (controller v0.331.0, catalog `30eea97`) diff --git a/documentation/backlog/OPEN-ITEMS.md b/documentation/backlog/OPEN-ITEMS.md index e995608f..238eb286 100644 --- a/documentation/backlog/OPEN-ITEMS.md +++ b/documentation/backlog/OPEN-ITEMS.md @@ -112,7 +112,7 @@ match what the reader sees is how an instrument stops being believed (R-421). It **nothing was proven on the day this line was drawn** and a stopping line that moves a status is a stopping line that lies. -## Install & onboarding — 8 rows (P3 6, P4 2) +## Install & onboarding — 9 rows (P3 5, P4 4) | ID | Category | Sev | What | State | Blocked on | Next action | Owner | |---|---|---|---|---|---|---|---| @@ -123,9 +123,10 @@ stopping line that lies. | **R-993** | Install & onboarding | P3 | **Operator: approve the minimum machine in `documentation/audits/sizing-2026-10-13/SIZING.md` §5** (the input R-991's hardware page needs). MEASURED 2026-10-13 on the N100 demo box (61 apps deployed and removed through the product, 15 min at rest each; heavy apps with one real action). Proposal: **minimum** x86-64, 4 cores (N100 class), **8 GB**, 256 GB SSD; **recommended 16 GB**, 512 GB SSD; out: ARM / Raspberry Pi, Synology-QNAP, routers, cloud VPS. Worked from the floor (2.5 GB for the whole box with no apps) + Immich, Jellyfin, Nextcloud, Home Assistant, Vaultwarden, Paperless-ngx at their peaks (5.0 GB) + 50 % headroom ≈ 12.3 GB. 8 GB runs that set without Immich; 16 GB runs all of it twice over. Data for the estimator: `sizing.json`. **2026-10-13 (estimator session) — the installer accepts a host BELOW this minimum:** `autosize_guest_caps` has no floor on the host, only on the guest; on a 4 GB box (MemTotal ≈ 3.5 GiB) the guest gets host − 1 GB ≈ 2.4 GB and Proxmox keeps ≈ 1 GB, where it used ≈ 2.0 GB on the N100 (SIZING.md §1). Whatever minimum is approved, nothing enforces it at install today. The three-verdict wording of §5 now matches the estimator page (`/gepigeny`, R-997). | **WAITING-ON-OPERATOR** — filed 2026-10-13 | the operator's decision | Operator: approve or change §5. If nothing is done: no hardware page; a buyer with a Raspberry Pi can still download the installer (R-991 stays open) | operator | | **R-494** | Install & onboarding | P4 | **NARROWED 2026-09-14 by operator ruling → [P3-LOW] the hub COULD create the tunnel at customer creation, for a domain already on Cloudflare. Not blocking: every customer has their own domain and the operator creates the tunnel per day-0 A.1 (`architecture/01-topology-and-trust.md`).** *Original finding, kept:* **[P1-HIGH] A new customer's dashboard has NO reachable address unless the operator hand-makes a Cloudflare tunnel — the link in the setup-code mail is dead.** MEASURED 2026-09-14 on a fresh install from the public ISO (drill intervention **I1**): the claim mail points at `https://felhom.drill0242.felhom.eu`; that name has **no A and no AAAA** record (`dig @1.1.1.1`, control `felhom.enkisfelhom.hu` resolves); the hub has **no tunnel- or DNS-creation code** (`hub/internal/cloudflare/` holds only geo-rule removal; `cf_tunnel_token` is a pasted, optional form field, `configs.go:1478`) — day-0 runbook A.1 makes it a manual Cloudflare-dashboard step that nothing on the customer-create page asks for; the box's own split-horizon resolver on the appliance LAN IP answered `google.com` but not the dashboard name at 13:27:39Z; the agent applied the record at **13:27:44Z** (`lanresolver: applied split-horizon record … ip=192.168.0.158`, 3 m 46 s after the controller started), so the box CAN answer the name — **but only to a device that uses the box as its DNS server, and no document, screen or mail tells a household to do that**; the router and the installer-offered DNS answer nothing. The page was reachable only at the guest's LAN address with the name forced (`curl --resolve …:443:192.168.0.158`). **A volunteer could not have done that.** **What it needs:** an operator ruling — the hub creates the tunnel and DNS at customer creation, or the product gives a household a LAN address that works with no DNS change. | **READY — rank P3-LOW; owner: CC** **Re-ranked 2026-10-03: P3→P4: operator-side automation; the operator creates the tunnel by hand per the day-0 runbook.** | — | — | CC | | **R-504** | Install & onboarding | P4 | **[P3-LOW] `iso.felhom.eu` cannot show an index page on its own — its root returns 404, and the download page lives on the website instead.** MEASURED 2026-09-14: `https://iso.felhom.eu/` and `/index.html` → 404; only named objects answer. The host is an R2 bucket behind a custom domain; whether R2 would serve an uploaded `index.html` at `/` was **not measured** (uploading anything to the public bucket is a publication). The ISO v1.27.0 task puts the Hungarian download page at `felhom.eu/letoltes` (published with the ISO, after the operator's yes). **Remaining:** a redirect from `iso.felhom.eu/` to that page needs a Cloudflare rule the session has no credential for. | **WAITING-ON-OPERATOR — rank P3-LOW; owner: operator (Cloudflare rule)** **Re-ranked 2026-10-03: P3→P4: households are sent to the website's download page; the bare address is cosmetic.** | — | — | operator | -| **R-1154** | Install & onboarding | P3 | **A reinstall while the customer's OLD host record still exists skips both clean-slate re-issues (the claim code and the off-site credential) in silence.** `handleHostEnroll` returns the existing host early (mint-once-reuse), so `reissueOnReenroll` is never reached; its own comment assumes „the clean-slate flow deletes the stale host” — nobody does on a plain reinstall. Proven live on the demo-hp reinstall 2026-08-21 (CC memory), never filed. Now recurring: the operator keeps Tester4 as the standing fresh-install customer (2026-10-18), and its old host `Tester4-31fa0e` stays after each teardown. Filed 2026-10-18. | OPEN — filed 2026-10-18 | — | Decide: the enroll re-issues when the old host is stale or off, or the teardown deletes the host first (operator, session only); a test on the enroll path | CC | +| **R-1156** | Install & onboarding | P4 | **A reinstall done within the stale threshold (45 min) of the old box's last report reads as „live":** the hub writes only the info record `host_reenroll_while_live`, no warning mail, so the operator is not told to delete the old host and re-issue. The residual of R-1154's loud-only rule. Found 2026-10-19. | OPEN — filed 2026-10-19 | — | Decide: mail the live case too, or a shorter window for this check | CC | +| **R-1158** | Install & onboarding | P4 | **The off-site re-issue on a clean-slate re-enroll may be obsolete:** since hub v0.127.0 no box receives the provider password (a fresh box registers its key with the controller API key), so `reissueOnReenroll`'s off-site leg may now only reset a password nobody uses — and CC's memory note on reinstalls (2026-08-21) may be stale on this point. Read from code, not measured. Found 2026-10-19. | OPEN — filed 2026-10-19 | — | Measure on the next Tester4 install (after deleting its old host) | CC | -## Apps & catalog — 15 rows (P3 6, P4 9) +## Apps & catalog — 13 rows (P3 5, P4 8) | ID | Category | Sev | What | State | Blocked on | Next action | Owner | |---|---|---|---|---|---|---|---| @@ -141,9 +142,7 @@ stopping line that lies. | **R-995** | Apps & catalog | P4 | **Removing an app through the product can leave unnamed Docker volumes and an empty import folder behind.** MEASURED 2026-10-13 on demo-felhom after 61 removals (`documentation/audits/sizing-2026-10-13/METHOD.md` „Teardown”, `evidence/leftover-volumes-after-bench.txt`): 8 unnamed volumes (4–72 KB; immich 1, romm 2, privatebin 3, onlyoffice 2 — volumes the images declare themselves) and `userdata/import/{paperless,calibre,grimmory}` (empty, created by the deploy). The removal answered 200 and its own leftover check was clean, because it looks only at labelled volumes. No data risk; disk and tidiness only. Removed by name on the bench. | **READY** — filed 2026-10-13 | — | Make the removal account for the containers' unnamed volumes (and an empty import folder it created), with a test that deploys an image that declares a VOLUME | CC | | **R-1067** | Apps & catalog | P4 | **The catalog still carries `pi_compatible:` on every template, and nothing reads it any more.** controller v0.315.0 removed the „Pi kompatibilis" badge and the „csak x86" tag from every page (Raspberry Pi is no longer supported, so one was noise and the other was a warning on almost every app). The `ResourceHints.PiCompatible` struct field and the catalog key were deliberately LEFT: a box still on 0.314.0 reads the key, and removing it would make that box show „csak x86" on every app. **Gated on the floor:** once the fleet floor is at or above 0.315.0, drop `pi_compatible:` from the templates and the field from `stacks.ResourceHints` in the same pair of commits. Harmless until then — an unread key costs nothing. | **BLOCKED** — filed 2026-10-15. Checked 2026-10-16 (apps burndown): the floor is 0.321.0 and demo-hp, Tester 1 and the N100 run 0.321.0, but **Tester-2 still reports 0.292.0** (its newest report 2026-10-04; hub DB with WAL) — so nothing removed. | every box on ≥ 0.315.0 — today Tester-2 | Drop the catalog key and the struct field; grep the hub and the website for Pi wording at the same time (none found 2026-10-15) | CC | | **R-1043** | Apps & catalog | P4 | **Sonarr, Radarr and Prowlarr build their login redirect as an absolute `http://` URL.** They trust forwarded headers only from their „Trusted networks” (the household set `192.168.0.0/24`; traefik is `172.18.x`), so they ignore `X-Forwarded-Proto: https` and answer `Location: http:///login` to an https visitor. Since controller v0.312.0 that hop is sent back to https by traefik (a GET, no password), so it is cosmetic; a template could seed traefik's network as trusted. (`audits/https-only-2026-10-14/``1A-3-4.txt`) | **OPEN** — filed 2026-10-14 | — | Seed the docker network as a trusted proxy in the *arr templates (with the R-1030 seed), measure the redirect | CC | -| **R-1100** | Apps & catalog | P3 | **One sign-in for the dashboard and FileBrowser (proxy auth) — spike first.** Since controller 0.320.0 every app with a folder has „Fájlok ↗", and the box can show FileBrowser's password — but FileBrowser still asks for its OWN login the first time, so the household signs in twice. FileBrowser Quantum has a proxy-auth method (`auth.methods.proxyAuth`, header-trusted) that could take the dashboard session through traefik; nobody has measured it. Design: `architecture/02-controller-module-map.md` „Logins and folders". | **READY** — spike done 2026-10-18 (`audits/proxyauth-spike-2026-10-18/DESIGN-NOTE.md`): Traefik forwardAuth with `authResponseHeaders` strips a client's header (any case, twice) and its own value wins — measured; the config key is `auth.methods.proxy` (not `proxyAuth`); **but an app container reaching `filebrowser:80` directly logs in with a forged header (measured 200)**, and the dashboard cookie is host-only. Build = a files-only ticket cookie + a per-box secret header name. Filed 2026-10-16. | — | Build per the design note (controller only, ~one release), or decide not to | CC | | **R-1099** | Apps & catalog | P4 | **The N100 may hold RomM games in the old upload place, now shown under a fake „roms” platform.** Until 2026-10-16 RomM's own upload wrote to the drive's `roms/roms//`; after the mapping fix (catalog `fb18471`, R-1089) those files are at RomM's `library/roms/roms/…`. Measured on 9201: such a game showed as missing in its platform and again under a platform „roms” (`audits/romm-ghost-2026-10-16/B/b-after.txt`). Files put in with the file manager are not affected — they are now found. The N100 runs RomM (hub `/apps/romm`); CC does not log in to the lived-in box. | OPEN — filed 2026-10-16 | Operator: look at `roms/roms/` on the N100's drive in the file manager | If it holds platform folders: move them up one level into `roms/`, then run „Scan” in RomM; if it is empty, close | Operator | -| **R-1153** | Apps & catalog | P4 | **FileBrowser's preview of a .docx answered 500 while the OnlyOffice link was on** (`/api/resources/preview`, scratch 9202, controller 0.330.0, 2026-10-18). FileBrowser builds an office preview through OnlyOffice's converter from `server.internalUrl` when it is set (`backend/http/preview.go:243` at 1.5.6-stable) and from the request's host when not — so 0.331.0's `internalUrl` (R-1018) may already fix it. Not re-checked: OnlyOffice was removed after the walk. | OPEN — filed 2026-10-18 | — | One preview request on a box with 0.331.0 and the link on | CC | ## App updates — 4 rows (P3 4) @@ -155,12 +154,10 @@ stopping line that lies. | **R-683** | App updates | P3 | **[P3-LOW] Watch: after a power cut during an update's health check, the hold named an HOUR-OLD second-drive copy, not the one the update's own backup should have just made.** 2026-09-24 chaos round 3 (nextcloud, `backup_max_age: 1m`): no `backing-up` phase was seen and the hold named Tier 2 at 13:04 for an update pressed at 14:04; the pre-cut controller log was lost with the container (the runner now saves it at arm time — R-320). Round 11, the same action without a power cut, named a fresh 14:34 copy and logged the Tier-2 copy. The sentence was TRUE (it named the copy it offered); the question is why the update did not back up first. Not reproduced; watch the next power-cut drill. `audits/night-2026-09-24/E/round-03*.json`, `E/round-11-controller-pre.log` | **OPEN — P3; owner: CC (watch)** | — | — | CC | | **R-785** | App updates | P3 | **[P3-LOW] SparkyFitness is pinned 11 releases and a major behind upstream (v0.17.3; upstream v1.7.3, v1.6.0 dated 2026-07-24).** READ 2026-10-01 (`audits/visitors-2026-10-01/C/bench/C1-previous-tag.txt`). **Needs:** an update walk 0.17 → 1.x through the ladder (bench + box), after R-784 is decided. | **OPEN — rank P3-LOW; owner: CC (after R-784)** | — | — | CC | -## Backup & restore — 30 rows (P2 3, P3 16, P4 11) +## Backup & restore — 28 rows (P2 3, P3 13, P4 12) | ID | Category | Sev | What | State | Blocked on | Next action | Owner | |---|---|---|---|---|---|---|---| -| **R-978** | Backup & restore | P3 | **Starting the escrow ceremony again can make the customer's written-down recovery code useless: the new package replaces the old one before the new code is confirmed.** It can happen to an ordinary customer who starts and walks away. Fix: keep the previous package until the new code is confirmed. Security review 2026-10-12 (`audits/security-review-2026-10-12/`); detail held off-git for the operator (`/mnt/5_hdd/felhom.eu/evidence/security-review-2026-10-12-PRIVATE/`). | **OPEN — the fix is in agent `main`, unreleased** (`8561dc8`, 2026-10-18): the new package reaches the hub only when its code is claimed; an abandoned second ceremony leaves the first code opening the hub's package (tests + four red-proofs). Residual R-1151. Rides the next vouched agent release. | — | Release with the operator's yes; then close | CC | -| **R-973** | Backup & restore | P3 | **A compromised controller can make the whole-guest backup run again and again, and each run prunes older restore points: the local tier directly, and the off-site tier through the store's own nightly keep-last-2.** So `07` §8 row 10 (ransomware) is weaker than it reads. The second reader confirmed the local half; the off-site half is inferred. Fix: a cadence or daily cap on the local-API backup route, and off-site snapshots that a nightly prune cannot remove. Security review 2026-10-12 (`audits/security-review-2026-10-12/`); detail held off-git for the operator (`/mnt/5_hdd/felhom.eu/evidence/security-review-2026-10-12-PRIVATE/`). | **OPEN — the local-half fix is in agent `main`, unreleased** (`f17e197`, 2026-10-18): a cadence cap on `POST /backup` — daily tier ≤ 3 successful runs per rolling 24 h, the weekly off-site tier one per 6 days; a refusal is 429, logged, persisted across a restart, and a CRITICAL degraded status for 24 h (operator-only `agent_capability_degraded`, wording R-1150). *Decided by CC unattended — operator may reverse:* the numbers. **Off-site half, design line (not built):** ep0 prunes the namespace keep-last 2 — a count, so each extra run pushes out the oldest; with the cap a pre-compromise copy survives ≥ ~6 days and each extra attempt alarms; to make it unfloodable, ep0's prune moves to time buckets (e.g. keep-weekly 2) — an ep0/hub prune-job change, the operator's; check that DooPlex's pull copy of ep0 is keep-weekly, not keep-last. Local keep-last 3: R-1149. | — | Release with the operator's yes; decide the off-site prune shape | CC | | **R-232** | Backup & restore | P2 | **DooPlex's backup makes every copy inside the same box — and nothing tells anyone when it fails.** Surveyed read-only 2026-08-06 (`audits/RECON-dooplex-backup-2026-08-06.md`). **What works:** five sets, 14/14 successful runs in 14 days; a file was restored from the `data` repo and matched the live original **byte for byte**; every set except two is cross-disk; k3s is integrity-checked on every run. **What the matrix exposes, ranked:** (a) **`notify_failure` is a no-op** — `NOTIFY_ON_FAILURE=true` but `NOTIFY_WEBHOOK_URL` is commented out, so a failed backup notifies **nobody**; the project already has a working Resend path that CI uses. Cheapest item, and it makes every other failure visible. (b) **Nothing leaves the box** — no rclone, no remote repo, no off-site target anywhere; Longhorn's target is `nfs://192.168.0.180:` pointing at DooPlex itself, and the only outbound-looking cron pulls *inbound* from Hetzner for a different project. The machine that runs the hub managing the customers' off-site chain has no off-site copy of its own. (c) **The backup tree is a single writable path** and the restic repos are not append-only — one bad script or ransomware destroys every copy at once. (d) **Two same-disk sets**: `.claude-memory` and the PostgreSQL dumps, whose source directory sits *inside* the backup tree. (e) **Longhorn `retain=1`** — one generation per volume, so a corruption noticed a day late has no earlier copy. (f) **`/opt/backup/docs/BACKUP-RESTORE.md` does not exist** though the systemd unit advertises it. (g) **`secrets/restic-repo` has never held a snapshot** — `backup-secrets.sh` contains no `restic` call; the secrets are GPG files on `sda1` only. (h) **No restore has ever been run** beyond today's single-file probe — the matrix's "ever demonstrated?" column is otherwise entirely empty. **Not a finding:** the restic passphrase. The on-box copy is on `sdb1`, a different disk from the backups, and the **operator holds an offline copy out of band** — so a disk loss is recoverable. The narrow residual is that it is operator-held rather than system-held, unlike the customer case's hub-vaulted escrow, so it should be confirmed current and findable by someone else. **Nothing was changed by the recon.** | **NARROWED 2026-10-08 — owner Viktor.** (a) DONE with the operator's yes in chat: `notify_failure` now mails admin@felhom.eu through Resend; proven by one test mail that reached the inbox (`audits/day-2026-10-08/r232/`; no backup was started). (b) partly: the hub database leaves DooPlex nightly to ep0 (R-173); everything else stays on the box. (c)–(h) unchanged. **2026-10-09 (operator yes in chat): (b) and (h) DONE for Gitea and the secrets.** Nightly 00:20 `felhom-dooplex-offsite` pushes Gitea (614 MB of repositories, the `gitea` database dump taken first, `app.ini`) and the nightly GPG secrets export, encrypted with a NEW key, to ep0 `operator` (`host/dooplex-gitea`) on the hub-DB write-only token — no change on ep0; first push 57 s; restore test weekly (manifest, `git fsck` every repo, `pg_restore --list`), run once: 27 805 files, 10 repos OK; `DooplexGiteaOffsiteStale`/`DooplexGiteaRestoreTestStale` in force (`absent()` included, promtool + 2 red-proofs); every backup unit now mails on failure (`OnFailure=`, dry run reached the inbox). **First real Gitea restore:** into a throwaway on the bench, 10/10 repos, product `main` = live, a file byte for byte, a login (`runbooks/gitea-restore.md`). The hub came back too (R-173, closed). **The registry is left out on purpose:** its images rebuild from the code. **Correction to the recon §7:** the API mirror holds ONE repo (`homelab-manifests`), not all — Gitea had a single copy, on DooPlex. `audits/dooplex-survival-2026-10-09/` **LEFT:** (c) append-only for the on-box tree, (d)–(g) as written; the paper copy of the new key (operator). **READY** for the rest | — | — | operator | | **R-893** | Backup & restore | P3 | **After a failed OFF-SITE replay, the rollback pours the NEWER pre-restore copy over the OLDER volume just put back.** Read in source 2026-10-06 (R-638 option A, not measured): `internal/backup/offbox_reconstitute.go` writes the undo copy from the live (newer) database, replaces the volumes with the snapshot's older tars, then — when the replay fails — `rollbackSafetyDump` loads that newer dump over the older database volume. The loader only drops what the dump knows, so tables the newer migration removed stay; and when the snapshot's older definition was written, the rollback branch does not put the newer definition back, so the older app starts on rolled-back data; non-database volumes stay at the snapshot's state. An order change cannot fix it (the only undo is a logical dump, and its volume was replaced). Known limit in `07` §6.3. **-- 2026-10-08 design:** `audits/day-2026-10-08/design-R-893.md` — re-verified; and the screen's „your data is back as it was" (`err.backup.db_restore_failed_rolled_back`) is false for files, other volumes and the app version. Question D8 on STATUS's decision sheet. **-- 2026-10-08 14:16 operator ruling D8 (`09` §3 decision 192):** yes, both, in that order — first the app stays stopped for support (option C), next „put back exactly as it was" (option A). | **NARROWED — 2026-10-09: the first half DELIVERED in controller 0.304.0. Slice 0 (the live measurement) NOT run: 9202 has no off-site, and a dump cannot be cut by hand inside an encrypted off-site copy on Tester 1; it needs a scratch off-site repo — a plan, not a finding.** **NARROWED 2026-10-08 — the first half (D8 option C, the app held stopped) is built on controller main and ships tomorrow; what stays open is the second half, „put back exactly as it was” (option A: a pre-restore copy of the app's volumes and placed files, a fit check, disk for one copy; the slice-0 measurement on 9202 first).** **OPEN — filed 2026-10-06** **2026-10-06 night: verified in source, no code** — `offbox_reconstitute.go:758` (undo dump from the live DB), `:778-860` (files and volumes from the snapshot), `:804` (the snapshot's definition is written when its version differs), `:898` (the rollback loads the newer dump over the older volume; nothing writes the live definition back). Not a reorder fix: it needs R-638 option B (a rebuilding loader) or a pre-restore volume copy (disk cost; R-685's class). Which state a household gets after a failed off-site replay is the operator's call. Next: the 9202 measurement, then the design. | a design: R-638 option B (a loader that rebuilds instead of overlays) or a pre-restore volume copy | Measure it once on 9202 (a forced replay failure after an off-site restore over a migrated app); then a design for the operator | CC | | **R-895** | Backup & restore | P2 | **The hub's clean-up-window check trusts the snapshot counts the box sends, so a broken-into box (or past-dated fakes added through the add-only key) can shrink the real off-site history without an alarm.** READ 2026-10-06 night in source (R-822's design): the before/after comparison uses counts the box itself reports (`hub/internal/offsitekeys/service.go:284`, `:343`); new fakes keep the count level. Decision 68 already accepts a box-trusted count. | **NARROWED 2026-10-18 — slice 2 built, not deployed** (hub v0.158.0): the 07:10 audit compares the `snapshots/` listing with yesterday's by name — files gone that no clean-up window explains → `offsite_snapshots_vanished` (error), files no reported box run explains → `offsite_snapshots_unexplained` (warning); operator-only, hub-origin (not in `allowedEventTypes`). First listing = baseline; a move-aside or RESET drops it; vanishing judged on a pinned tier only; files younger than 1 h judged the next day. Red-proofed twice (`snapshot_watch_test.go`). **Not built:** the window's before/after on the hub's own count (design §3.1) and refusing a window while unexplained files exist (§3.2). Unmeasured: the provider shell's `ls -l` time zone (± 3 h slack until then). **Deployed 2026-10-18 12:23 (hub v0.158.0).** The first listing (tomorrow 07:10) is a baseline; the first verdict is 2026-10-20 07:10. **Known limit (independent review 2026-10-18, F2):** `_unexplained` is explained by the box's OWN reported `offsite.last_run`, so whoever holds a box's key can silence it; `_vanished` is judged on the hub's own listing and is not affected. | the operator's yes to deploy hub v0.158.0 | Deploy; read the first 07:10 lines (newest upload vs the box's last run = the time-zone calibration), shrink the slack; then decide §3.1/§3.2 | CC | @@ -187,15 +184,14 @@ stopping line that lies. | **R-878** | Backup & restore | P4 | **A catch-up (R-871) runs the database-dump leg in the DAY, and that leg stops an app with a volume for its copy — the household may notice the stop, and a large volume makes it longer.** MEASURED 2026-10-05 on demo-felhom: the catch-up at 08:25:02 stopped opengist, copied 182.5 KB, started it again — about 1 s, then a few seconds of `health: starting`; the night does exactly the same, unseen. Nothing measured for a large volume. Fix direction (if it matters): skip the volume copy of a running app in a DAYTIME catch-up and leave it to the next night, or warn. `audits/catchup-2026-10-05/partA/live-demo-felhom.txt` | **READY — owner: CC** **2026-10-05 (burn-down night): NEEDS A LIVE MEASUREMENT** — a timed catch-up on 9202 for an app with a multi-GB volume, then the skip-or-warn choice. | — | measure a large volume first | CC | | **R-32** | Backup & restore | P4 | **[P2-HIGH] RESET must purge the customer base dir; the orphan card must stay honest; unattributed bytes must be visible.** The rehearsal's S7 said in advance that an orphan card would BE a finding — and one appeared (16:58:14). Cause: RESET's `"hetzner":"ok"` leg destroys the sub-account, but **a Hetzner sub-account is an access-control object, not a data object** — its directory survives, so re-enabling offsite recreated an account over the previous lifecycle's ciphertext, encrypted under a key that same RESET had destroyed. **MIGRATED FROM `ROADMAP.md` 2026-08-22 (R-369) — originally filed 2026-07-21, size M, roadmap state `idea`.** Moved verbatim; nothing added or reinterpreted. The roadmap keeps its copy as history, marked moved. | **OPEN — migrated from ROADMAP 2026-08-22, rank unchanged** **2026-10-06 night: design written** (`audits/night-burndown-2026-10-06/design-R-32.md`) — pick A: purge the repo + set-aside copies through the sub-account's own password login BEFORE deleting it (no main-account credential); the „repo data destroyed" comment at `hub/internal/offsite/offsite.go:276-280` is false for the shared tier; part (3) waits on a read-only measurement (`du` on port 23). Operator: agree to route A. **2026-10-07 07:58: `09` §3 decision 167 — option A yes, and delete the old RESET leftovers once.** **2026-10-07 (Part D step 2, read only):** the hub shows bx11 holding 3.3 GB of data while the four live customers account for ~0.6 GB → **~2.7 GB belongs to no live customer**; no live customer shows a set-aside folder, so the leftovers are in homes whose sub-account is gone, reachable only by the pool box's MAIN account. **The one-time clean-up is STOPPED:** no main-account login for bx11 is held on DooPlex (the API token in the credentials file sees no box). Needs: the main-account login, or the operator lists and deletes in the Hetzner console (`audits/day-2026-10-07/D/D2-listing-readonly.txt`). **2026-10-07: option A DELIVERED (hub 0.142.0):** RESET purges the repo and every `.orphaned-*` through the sub-account's own login before deleting it, and keeps the sub-account if the purge fails (red-proved, `audits/day-2026-10-07/D/`). Not yet seen live (no scratch RESET today). **The one-time clean-up of the ~2.7 GB of leftovers is STOPPED:** it needs the pool box's main-account login (see above). **2026-10-07 14:43 — `09` §3 decision 173: leave the ~2.7 GB of old leftovers for now; re-ranked P2 → P4.** Option A itself is delivered (hub 0.142.0). What stays open is ONLY the leftovers: they were computed (box total minus live customers), never listed, and deleting them needs the pool box's MAIN login, which reaches every customer's data. **Blocker: a safe main-account path.** | — | **Ruling from the run (three parts, deliberately separate):** (1) because RESET destroys custody, the ciphertext it leaves behind is unrecoverable **BY DESIGN** → RESET gains a **main-account purge of the customer base dir** (the existing operator ack already covers it); (2) the **move-aside guard STAYS** for reinstall-*without*-RESET — there custody survives and the card's "history recoverable" promise is true (R-26 depends on exactly that); (3) the operator **Restic tab shows per-customer directory bytes vs attributed snapshot bytes**, so dead data cannot hide. Measured on the pool box that night: **49 M attributed** (2 snapshots, 48.717 MiB) against **1.4 G + 3.0 M unattributed** across TWO `.orphaned-*` dirs. Evidence `restic-and-pool.txt` | CC | | **R-1087** | Backup & restore | P4 | **Whole-box copies left on the OLD local target are never pruned after the target moves.** MEASURED 2026-10-15 (storage-identity build B space check): the N100's host root (`local`) holds three copies from 2026-07-28 (5.5–5.7 GB each, ≈ 16.8 GB); its agent's `local_backup_target` is now `felhom-backup` (the USB disk, retention 3), and retention prunes only the current target. On a small-root box such leftovers would starve the local copies (R-548). Evidence: `audits/storage-identity-buildB-2026-10-15/space/felhom-pve-9201.txt`. | OPEN | — | Decide whether the agent prunes its own `vzdump-lxc--*` files on a former target (after a newer copy exists on the new one), or the target move asks; until then, the N100's three July files can be removed by hand with the operator's word. | CC | -| **R-1149** | Backup & restore | P3 | **The local whole-guest tier prunes keep-last 3, so even with the R-973 cadence cap a compromised controller can replace all three restore points within one day.** A time-bucketed prune (`--prune-backups keep-daily=3`) has the same disk cost and cannot be flooded within a day. It changes `07` §6's retention, so it is the operator's call. Found by the R-973 helper 2026-10-18. | OPEN — filed 2026-10-18 | — | Operator decides keep-last vs keep-daily; then the agent's vzdump argument | operator + CC | -| **R-1151** | Backup & restore | P3 | **The new escrow package now uploads when its code is claimed (R-978), but the wizard's typed-back check is the browser's alone:** a household that opens the new code and closes the page without writing it down has still replaced the hub's package, and the first code no longer opens it. Gate the upload on the typed-back confirmation with a new controller → agent call. Found 2026-10-18. | OPEN — filed 2026-10-18 | — | Controller + agent: the confirm call; red-proof the abandoned-after-claim case | CC | +| **R-1161** | Backup & restore | P4 | **The escrow wizard still says „Ez mostantól az élő helyreállítási kód" („this is now the live recovery code") the moment the code is shown;** since R-1151 (agent 0.160.0, controller 0.332.0) the code becomes live only after the two words are typed back, and closing the page keeps the old one. The safe direction (it overstates), but it is now untrue until the confirm. A Hungarian + English copy change; not done in-session (the controller's one release of the session was out). Found 2026-10-19. | OPEN — filed 2026-10-19 | — | Next controller release: say the code becomes live after the check | CC | +| **R-1162** | Backup & restore | P3 | **The whole-guest off-site tier (ep0) prunes by count (keep-last 2), so a compromised controller can still push out the pre-compromise copy, slowly:** with R-973's cap one run per 6 days gets through, so a copy older than the compromise survives about 6 days and every extra attempt alarms. Time buckets on ep0's prune job (e.g. keep-weekly 2) would make it unfloodable; check that DooPlex's pull copy of ep0 is keep-weekly, not keep-last. The off-site half of R-973, carried over when R-973 closed. An ep0/hub prune-job change. | OPEN — carried from R-973 2026-10-19 | — | Operator decides the ep0 prune shape | operator + CC | -## Storage & devices — 10 rows (P3 4, P4 6) +## Storage & devices — 9 rows (P3 3, P4 6) | ID | Category | Sev | What | State | Blocked on | Next action | Owner | |---|---|---|---|---|---|---|---| | **R-1073** | Storage & devices | P3 | **Felhom in a virtual machine sees no disk health: SMART is UNKNOWN for its own system disk and any passed disk.** MEASURED 2026-10-15 on the OMV-VM copy: every storage target reported `smart.health = UNKNOWN`, all counters null (the guest sees QEMU disks). On the pilot's box the NVMe and the „old, not stable” Toshiba would be watched by OMV only, and Felhom's drive-health alarms (R-330/R-332's whole point) cannot fire. Evidence: the host report in `audits/omv-vm-2026-10-15/README.md` (memory/disk section) and `C-hub-events-Tester4.txt`. | WAITING-ON-OPERATOR | Operator: is a VM install a supported shape, and if so, is „OMV watches SMART” acceptable or must Felhom say on the dashboard that it cannot watch the disks? | Operator rules; then CC adds a household line on the Meghajtók page when SMART is unavailable. | Operator | -| **R-1093** | Storage & devices | P3 | **An EMPTY partition asks for the typed „data will be erased" confirmation.** MEASURED 2026-10-16 (build B, scratch VM, agent 0.158.1): `POST /api/storage/init` for a blank part → `needs_confirmation`, reason „device has a partition table" — `lsblk` reports the PARENT disk's table (PTTYPE) for a partition, so the agent's probe reads an empty part as data-bearing. Safe direction (more friction, never less), but `16` §6 says an empty part is self-serve and the wizard shows „adatot tartalmaz". Evidence: `audits/storage-identity-buildB-2026-10-15/live/12-partitions-format.txt`. | **OPEN — the fix is in agent `main`, unreleased** (`f7b7308` + `0963bae`, 2026-10-18): lsblk's inherited PTTYPE is ignored only when `blkid -p` on the partition exits 0 with `PART_ENTRY_NUMBER` and the same scheme; every error path stays data-bearing (14-row test, three red-proofs; no sudoers change). Live on demo-hp (a loop file in `/root`, removed): the empty GPT part → blkid rc 0 with only `PART_ENTRY_*`; ext4 → `TYPE`; a table inside → `PTTYPE=dos` (`audits/agent-fixes-2026-10-18/r1093-loop-check.txt`). Not walked: `/api/storage/init` on a VM disk. | — | Release with the operator's yes; one init call on a VM with a spare disk | CC | | **R-1062** | Storage & devices | P4 | **The N100's USB drive cannot be split in two without losing the box's whole-guest backup target.** The operator asked (2026-10-15 16:31) for two halves for multi-drive tests. Read first (`audits/n100-lived-in-2026-10-15/B/`): no family files — 2.7 GB nightly vzdumps of guest 9201 (`dump/`, PVE storage `felhom-backup` = the whole-guest backup target), 3.1 GB app backups + an off-site restore copy, 422 MB leftover app data of removed apps, empty media folders. The agent refuses a decommission of a backup target (`refuseIfBackupTarget`) and the N100 has no other drive to move that role to. Nothing changed. | **WAITING-ON-OPERATOR** — filed 2026-10-15 | operator decision | Keep one drive (CC's pick: the lived-in box keeps its local whole-guest backup), or give a word to drop that backup leg / add a second drive first | operator | | **R-1064** | Storage & devices | P4 | **Removing a storage path does not mention the cross-drive backup copies it holds.** demo-hp 2026-10-15: `/mnt/sizing-bench` removed through `/settings/storage/remove` (302, „Adattároló eltávolítva") while calibre-web's and paperless-ngx's `cross_drive.destination_path` pointed at it; the copies stay on disk, the records still name the removed path. The in-use check counts HDD_PATH only (`appsUsingPath`). | **OPEN** — filed 2026-10-15 | — | Read what tonight's tier-2 run (01:30) does with the two records; then: name the copies in the removal's confirmation (or count them as in use) | CC | | **R-330** | Storage & devices | P3 | **Disk health Phase 2 — the three SMART attributes the wire does not carry.** The failing drive's most telling counter was **187 `Reported_Uncorrect`**, sitting at normalized **1** against threshold **0** with a raw count of **1001** — one point from failing and structurally unable to get there. Also wanted: **199 `UDMA_CRC_Error_Count`** (cabling) and **188 `Command_Timeout`**. None are on the agent→controller wire today, so v0.215.0's ladder could not use them. Phase 2 also persists periodic SMART **samples** (the right home is `metrics.MetricsStore`, NOT the Phase-1 state file, which is one record per disk and must stay that way). **This is a declared WIRE change, so under the G-1 gate the hub must model the new fields in the SAME session** — that is precisely why it was kept out of Phase 1, where it would have turned a one-word severity fix into a three-repo change | **READY** — **2026-10-12: the wire half is CLOSED in this row** — released in agent v0.150.0 (boxes run 0.154.0), controller and hub decode 187/188/199. **Only open work:** the verdict slice (use the three counters in the disk verdict and the household's words) and persisting samples. **READY (M) — NEW 2026-08-14** **2026-10-06 night: the wire half BUILT on main (unreleased):** the agent sends SMART 187 `reported_uncorrect`, 188 `command_timeout` (raw, vendor-packed on some drives — carried as reported), 199 `udma_crc_errors` (pointer + omitempty: unknown is absent, never 0); the controller decodes them and the hub's host-report mirror models them (G-1 wire gate green; it convicted the agent half alone). **Carried only** — no verdict, banner, mail or alarm reads them (`TestR330_CountersChangeNoVerdictYet`); using them changes what a household is told and is the next slice, with persisting samples. Red-proofs `audits/night-burndown-2026-10-06/r330/`. Ships with agent v0.150.0 and the next controller and hub releases. | R-328 (closed) | The verdict slice: 187/188/199 into the disk verdict with tests; then persist samples | CC | @@ -205,7 +201,7 @@ stopping line that lies. | **R-1077** | Storage & devices | P4 | **No USB enclosure that hides or fakes a disk's serial has been measured.** The storage-identity spike (2026-10-15) had none at hand and found none in earlier evidence; the design's `usb_bridge` unknown rule (`architecture/16-storage-physical-identity.md` §3) is therefore an assumption. Cheap single- and dual-bay bridges are known to report one bridge serial for any disk. Evidence: `audits/storage-identity-2026-10-15/README.md` case 4b. | OPEN | — | Buy or borrow one cheap USB enclosure (single and dual bay), run `tools/physdisk_probe.py` against it, and set the rule from what it reports. | Operator (a device) then CC | | **R-1094** | Storage & devices | P4 | **The whole-disk format refusal tells the household to format the free part — which is refused while the other part is in use.** SEEN 2026-10-16 (controller 0.318.0): 409 „Ezen a lemezen egy használatban lévő meghajtó van, ezért a teljes lemez nem formázható. Csak a szabad részét formázhatod." — since agent 0.158.1 a part next to a mounted part can only be USED (the root wrapper trusts no „Felhom's own" claim). Evidence: `audits/storage-identity-buildB-2026-10-15/live/14-samedisk-refusal-offer.txt`. | READY | — | Reword `err.web.meghajto_hasznalatban_formazas` (hu + en): „… nem formázható. A szabad részét használatba veheted." Next controller release; the copy gates run. | CC | -## Security & access — 20 rows (P1 1, P2 2, P3 11, P4 6) +## Security & access — 22 rows (P1 1, P2 2, P3 12, P4 7) | ID | Category | Sev | What | State | Blocked on | Next action | Owner | |---|---|---|---|---|---|---|---| @@ -229,6 +225,8 @@ stopping line that lies. | **R-1054** | Security & access | P3 | **The hub's operator/global API key is still one bearer that can do everything on `/api/v1`, including reading every box's break-glass root password (`GET /admin/hosts/{id}/recovery-credential`).** Hub v0.152.0 gave the web surface scoped tokens (`05` §17) but tokens are refused on `/api/v1` by design. Who uses the global key today is not listed in one place. Fix: list its consumers; move each operator use to a scoped token on the web side (or a token class on the API), and keep the global key only where a box path needs it — or retire it. | OPEN — filed 2026-10-15 by the token build | — | List the global key's consumers (pod env, scripts, runbooks) | CC | | **R-1118** | Security & access | P3 | **CC's secrets moved off the plain `~/.config/credentials` into an encrypted store with a broker and guards; what is left is retiring the old file.** BUILT 2026-10-17 (store B, operator ruling 11:28): private repo `admin/cc-secrets` (`ARCHITECTURE.md`, the design verbatim in `docs/`), `sec` (no get), PreToolUse refusals + PostToolUse masking for Bash and Read in `~/.claude/settings.json` (every CC session on DooPlex), nightly transcript sweep with mail. 55 tests, 18 red-proofs, 36-row child-session proof in both launch modes, fresh-session proof (`audits/cc-creds-build-2026-10-17/`). 25 names in the store (23 imported, `RESEND_API` from CC's environment, a self-test value). `12-agent-tooling.md` §5 points at it. | NARROWED — built; the old file's retirement is R-1134 | the week with no reader (R-1134) | `sec doctor` stays all OK; R-1134 | CC | | **R-1121** | Security & access | P3 | **`~/rotated-secrets-2026-10-09.txt` still exists on DooPlex** — 632 bytes, modified 2026-10-09 13:08 +0200, mode 600 (SPIKE Q6: `test -e` + `stat` only, not opened). Left by the R-925 rotation work. If any value in it is still valid, it is one more plaintext secrets file in the home folder, readable by every CC session. | WAITING-ON-OPERATOR | what the file holds — only the operator knows | Operator: confirm every value in it is revoked, then `shred -u` it; or move the live ones into the R-1118 store | operator | +| **R-1155** | Security & access | P4 | **FileBrowser's own 2-hour token for the one-sign-in user can outlive the dashboard session.** The controller clears it together with the files cookie whenever a stale files cookie arrives (sign-out, password change), but a browser that lost only the files cookie (or a token copied out of it) keeps FileBrowser's token until it expires, and with no files cookie the forwardAuth answer passes the request through. Closing it would need the box to read FileBrowser's token (a box-held `auth.key`) or a shorter FileBrowser token life. Found 2026-10-19 (R-1100 build, security review). | OPEN — filed 2026-10-19 | — | Decide whether a box-held FileBrowser key is worth it | CC | +| **R-1159** | Security & access | P3 | **The household's retrieval passphrase already yields the controller's hub API key, and that key alone registers and confirms off-site keys.** `GET /config/{id}` (passphrase-gated) returns `controller.yaml` with `hub.api_key`; `/offsite/register-key` and `/offsite/confirm-key` accept that key (`offsiteKeyAuth`). Pre-existing, and wider than R-1154 (whose fix keeps the passphrase away from the operator's re-issues). Read from code by the hub helper 2026-10-19, not measured. | OPEN — filed 2026-10-19 | — | Measure what a passphrase holder can do to the off-site tier; decide a second factor or a scope | CC + operator | ## Box system & updates — 12 rows (P2 1, P3 7, P4 4) @@ -263,7 +261,7 @@ stopping line that lies. | **R-285** | Monitoring & notifications | P4 | **A planned, supervised reinstall pages the operator as if the machine had died — there is no notion of expected downtime anywhere.** During the 2026-08-09 rehearsal the hub sent, all `status: sent` to the operator channel: `host_stale` 08:58 UTC, `node_stale` 09:00, **`host_down` 09:28 (error)**, **`node_down` 09:30 (error)**, `host_leaf_changed` 09:31, `host_recovered` 09:31, `node_recovered` 09:34, `offsite_delivery_stuck` 09:34 — eight operator mails for work that was deliberate, attended and announced. **This is the OPPOSITE gap from the one R-281 filed:** the alarms are not missing, they are indiscriminate. `host_stale` at 30 min and `host_down` at 60 min (`monitor/host_staleness.go:22-23`, `downAfter = 2 * threshold`) cannot distinguish a wiped-on-purpose box from a dead one, and `host_leaf_changed` firing on a reinstall is correct-but-expected. **Note the interaction with the mute used on 2026-08-09 evening:** blocking a customer silences everything, so today the only two settings are *page me for planned work* and *tell me nothing at all*. **What is owed is a middle:** a maintenance window, or an operator-set expected-downtime flag, that suppresses staleness and leaf-change while leaving genuine faults audible | **READY (M) — NEW 2026-08-09** | — | The evidence is the operator's mailbox plus `events`/`notification_log` for 2026-08-09 | CC | | **R-1005** | Monitoring & notifications | P4 | **A recovery mail says how long the box was „stale", not how long it was gone: after a 51-minute power cut demo-hp's `host_recovered` read „was stale for 8m" and `node_recovered` „23m".** An operator reading only the recovery mail under-reads the outage (`audits/night-power-2026-10-13/` R6). Same kind, the other way: the off-site mail of 2026-10-14 02:18 was titled „3 of 3 apps failed to back up (offsite run)" while 11 other apps were backed up in that run — only the 3 flagged apps were counted. | **READY** — filed 2026-10-14 | — | CC: add the time since the last report before the gap to both recovery messages, and count every app of the run in the off-site subject, with a test that asserts each text; next hub release | CC | | **R-1049** | Monitoring & notifications | P3 | **A pulled drive mails the operator „unexpectedly disconnected” (error), and nothing ever mails that it came back.** MEASURED 2026-10-14 night (`audits/media-drive-events-2026-10-14/K8-hub-mails.txt`, the hub DB with its WAL from the running pod, and the mailbox as the second channel): two pulls → two `storage_disconnected` mails; the hub RECEIVED both `storage_reconnected` and both `health_recovered` (severity info) and logged no notification for any of them — they are not in `recoveredPairedDownTypes` (`hub/internal/notify/dispatcher.go`), so the severity gate drops them. The R-97a shape: told it broke, never told it healed — the operator cannot tell a returned drive from one still gone without opening the hub. **BUILT 2026-10-15 — hub v0.151.0 (`12552aca`): both pairs in `recoveredPairedDownTypes`, cooldowns ended by the next loss (`TestR1049_DriveBackMailsBothEdges`, red-proved). Not deployed: the operator's „yes” first (decision 162); the image build waits for it too.** | **WAITING-ON-OPERATOR** — hub v0.151.0 code pushed, not built, not deployed | the operator's „yes” to the hub deploy | On the „yes”: build + deploy hub v0.151.0; read a „came back” mail on the next pull | CC | -| **R-1150** | Monitoring & notifications | P4 | **A refused whole-guest backup (the R-973 cap) reaches the operator as `agent_capability_degraded`, whose text reads „agent privileged capability degraded”.** True but misleading for a refused backup; on the night path the controller may also mail its own backup failure. Add a dedicated operator-only type (`whole_guest_backup_refused`: `allowedEventTypes` + `operatorOnlyEvents`) or adjust the text, in the next hub release (a two-repo change: the agent's status name stays). Found 2026-10-18. | OPEN — filed 2026-10-18 | — | Next hub release | CC | +| **R-1157** | Monitoring & notifications | P4 | **While the cadence-cap flag stays degraded (the agent's 24 h hold), further refused backups raise no new alarm:** a guest refused every day reads as one long episode, one mail. The same before hub 0.159.0. Found by the hub helper 2026-10-19. | OPEN — filed 2026-10-19 | — | Decide whether a refusal count in the event detail or a daily repeat is wanted | CC | ## Hub & operator — 12 rows (P3 6, P4 6) @@ -303,7 +301,7 @@ stopping line that lies. | **R-990** | Business & legal | P4 | **Operator: read `documentation/audits/forum-research-2026-10-12/FELHOM.md` §5 and rule on each recommendation.** READ-ONLY research 2026-10-12: three years (#7943–#11092, 2,908 posts, 195 people, 82 beginner threads) of the public PROHARDVER! topic „Home server / házi szerver építése”, tagged and counted by person (`FINDINGS.md`, method and spot-check in `METHOD.md`; no username or post text in git). Ten ranked recommendations, none acted on; the top three: a „which machine works” page (8 of 33 beginners who name their hardware own only a Synology, a router disk or a Raspberry Pi — the installer cannot run there; the same gap is R-989's first recommendation from a different source, and the shipped-page half is R-991), „you do not choose an operating system — we do” (the biggest beginner question, 20 of 82 threads), and „bring your old office PC” as the cheap entry. Catalog gap (≥ 3 people): a DLNA server (7), an ad/DNS blocker (5), a camera recorder (5). | **WAITING-ON-OPERATOR** — filed 2026-10-12 | the operator's reading | Operator: rule on each of the ten (yes / no / later). If nothing is done: nothing changes; the research ages | operator | | **R-1035** | Business & legal | P4 | **Did the „felhő tárhely” page earn anything? Two dated checks.** **Baseline (reported by the operator from Search Console, 2026-10-14, last 3 months):** 1 click, 48 impressions, CTR 2.1 %, average position **73.6**; „felhő tárhely” 19 impressions, „felhőtárhely” 5, „felhő alapú tárhely” 3. CC measured separately that the phrase „felhő tárhely” appeared **0 times** on the home, FAQ and backup pages — Google was showing the home page for those queries by accident. `/sajat-felho-tarhely` + `/en/own-cloud-storage` published **2026-10-14**; full baseline, price sources and the power provenance in `audits/seo-2026-10-14/BASELINE.md`. **What to measure, both times:** impressions and average position for „felhő tárhely” and „saját felhő tárhely”, plus the new page's own impressions, clicks and position. **A null result at +4 weeks means nothing on its own** — a new page on a site at position 73.6 takes weeks to months to move, and „felhő tárhely” alone is held by Microsoft, Google and the big list sites; the page aims at the two longer phrases. That is why there are two checks and not one, and why neither should be read as a verdict on the copy. **There is no Search Console connector in this project, so CC cannot read these numbers** — the operator reads them, CC records and compares. **Blocked until the operator asks for indexing** (Search Console → URL-ellenőrzés → the URL → „Indexelés kérése”): until that happens, or Google finds the page itself, both checks read zero for a reason that is not the page. **This is a slow channel and does not replace talking to people.** | **WATCHING** | operator: request indexing, then supply the Search Console read | 2026-11-11: first read (+4 weeks); 2026-12-09: second (+8 weeks), compared with the first | operator + CC | -## Process & tooling — 31 rows (P3 9, P4 22) +## Process & tooling — 31 rows (P3 8, P4 23) | ID | Category | Sev | What | State | Blocked on | Next action | Owner | |---|---|---|---|---|---|---|---| @@ -337,6 +335,7 @@ stopping line that lies. | **R-1128** | Process & tooling | P4 | **The controller's decoy suite edits real tracked files (`handler_debug.go`, `update.go`, the locale bundles, templates) and plants `.go` files, with no lock** — a full run while another session edits the controller tree can overwrite that session's edits. felhom.eu's suite took an `flock` after the 2026-10-08 clobber. Found by the R-1116 helper 2026-10-17. | OPEN — filed 2026-10-17 | — | Run the suite in a scratch copy of the tree, or take the felhom.eu-style lock | CC | | **R-1123** | Process & tooling | P4 | **`reuse_refs_check.py` treats every git directory beside the repo as a sibling repo**, including stray clones in the workspace (`felhom.eu-media`, `felhom.eu-sizing-push`, `felhom.eu-wt-sizing`), so a citation can resolve against a stale clone and pass. Found by the R-1116 helper 2026-10-17 (it also makes the agent suite 20 s here vs 5 s in CI). | OPEN — filed 2026-10-17 | — | Search only the four known repo names (or the main clones), with a decoy | CC | | **R-1152** | Process & tooling | P4 | **felhom CI's 5-minute job timeout is inert** (act_runner 0.6.1 does not enforce a job-level `timeout-minutes`, R-1136), so a hung step runs up to the runner's 3 h. Move it to a step-level `timeout-minutes` on each workflow's gate step (e.g. 20 min for felhom.eu, which runs ~7 min), measured first: a step timeout fails the job AND the `if: failure()` alarm still runs. Needs a scratch repo (the admin token cannot create one — the operator, or a token with `write:user`). Found 2026-10-18. | OPEN — filed 2026-10-18 | — | Measure on a scratch repo, then the four workflows | CC | +| **R-1160** | Process & tooling | P4 | **The hub and the agent have no gofmt gate, and both drift:** about 20 hub files and 14 agent files are not gofmt-clean (`gofmt -l`, 2026-10-19); the controller has `gofmt_gate.py`. Not fixed in-session: a mechanical rewrite of files other sessions own. | OPEN — filed 2026-10-19 | — | One gofmt commit per repo in a quiet window, then the controller's gate in both runners | CC |